From 19b8e3a167859cb57a8c1e5ac07be80588b7f256 Mon Sep 17 00:00:00 2001
From: "ithinc@sohu.com" <ithinc@sohu.com>
Date: Thu, 15 Sep 2011 16:01:24 +0200
Subject: [PATCH 001/209] Bug 652842 - _getToolbarItem(aId) returns null if the
 toolbaritem is on the Add-on Bar. r=enn

---
 toolkit/content/widgets/toolbar.xml | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/toolkit/content/widgets/toolbar.xml b/toolkit/content/widgets/toolbar.xml
index 8c720390a58d..bd49782918de 100644
--- a/toolkit/content/widgets/toolbar.xml
+++ b/toolkit/content/widgets/toolbar.xml
@@ -308,7 +308,9 @@
                 // look for an item with the same id, as the item may be
                 // in a different toolbar.
                 var item = document.getElementById(aId);
-                if (item && item.parentNode && item.parentNode.parentNode == toolbox) {
+                if (item && item.parentNode && 
+                    item.parentNode.localName == "toolbar" && 
+                    item.parentNode.toolbox == toolbox) {
                   newItem = item;
                   break;
                 }

From 12bf623990281921dd1af0eaa364cd1eaf344b87 Mon Sep 17 00:00:00 2001
From: Ehsan Akhgari <ehsan@mozilla.com>
Date: Thu, 15 Sep 2011 10:54:50 -0400
Subject: [PATCH 002/209] Bug 98160 - Add support for platform native text
 switching keyboard shortcuts in bidi UI on Windows; r=roc

---
 editor/libeditor/base/nsEditor.cpp            |  43 ++++-
 editor/libeditor/base/nsEditor.h              |   4 +
 .../libeditor/base/nsEditorEventListener.cpp  | 152 ++++++++++++++++++
 editor/libeditor/base/nsEditorEventListener.h |  14 ++
 widget/public/nsIBidiKeyboard.idl             |  11 +-
 widget/src/cocoa/nsBidiKeyboard.mm            |   6 +
 widget/src/gtk2/nsBidiKeyboard.cpp            |   5 +
 widget/src/os2/nsBidiKeyboard.cpp             |   6 +
 widget/src/qt/nsBidiKeyboard.cpp              |   6 +
 widget/src/windows/nsBidiKeyboard.cpp         |  12 ++
 10 files changed, 256 insertions(+), 3 deletions(-)

diff --git a/editor/libeditor/base/nsEditor.cpp b/editor/libeditor/base/nsEditor.cpp
index cd72bc1fce6b..d712dfccbb5b 100644
--- a/editor/libeditor/base/nsEditor.cpp
+++ b/editor/libeditor/base/nsEditor.cpp
@@ -5199,8 +5199,8 @@ nsEditor::GetRoot()
   return mRootElement;
 }
 
-NS_IMETHODIMP
-nsEditor::SwitchTextDirection()
+nsresult
+nsEditor::DetermineCurrentDirection()
 {
   // Get the current root direction from its frame
   nsIDOMElement *rootElement = GetRoot();
@@ -5226,6 +5226,18 @@ nsEditor::SwitchTextDirection()
     }
   }
 
+  return NS_OK;
+}
+
+NS_IMETHODIMP
+nsEditor::SwitchTextDirection()
+{
+  // Get the current root direction from its frame
+  nsIDOMElement *rootElement = GetRoot();
+
+  nsresult rv = DetermineCurrentDirection();
+  NS_ENSURE_SUCCESS(rv, rv);
+
   // Apply the opposite direction
   if (mFlags & nsIPlaintextEditor::eEditorRightToLeft) {
     NS_ASSERTION(!(mFlags & nsIPlaintextEditor::eEditorLeftToRight),
@@ -5244,6 +5256,33 @@ nsEditor::SwitchTextDirection()
   return rv;
 }
 
+void
+nsEditor::SwitchTextDirectionTo(PRUint32 aDirection)
+{
+  // Get the current root direction from its frame
+  nsIDOMElement *rootElement = GetRoot();
+
+  nsresult rv = DetermineCurrentDirection();
+  NS_ENSURE_SUCCESS(rv, );
+
+  // Apply the requested direction
+  if (aDirection == nsIPlaintextEditor::eEditorLeftToRight &&
+      (mFlags & nsIPlaintextEditor::eEditorRightToLeft)) {
+    NS_ASSERTION(!(mFlags & nsIPlaintextEditor::eEditorLeftToRight),
+                 "Unexpected mutually exclusive flag");
+    mFlags &= ~nsIPlaintextEditor::eEditorRightToLeft;
+    mFlags |= nsIPlaintextEditor::eEditorLeftToRight;
+    rootElement->SetAttribute(NS_LITERAL_STRING("dir"), NS_LITERAL_STRING("ltr"));
+  } else if (aDirection == nsIPlaintextEditor::eEditorRightToLeft &&
+             (mFlags & nsIPlaintextEditor::eEditorLeftToRight)) {
+    NS_ASSERTION(!(mFlags & nsIPlaintextEditor::eEditorRightToLeft),
+                 "Unexpected mutually exclusive flag");
+    mFlags |= nsIPlaintextEditor::eEditorRightToLeft;
+    mFlags &= ~nsIPlaintextEditor::eEditorLeftToRight;
+    rootElement->SetAttribute(NS_LITERAL_STRING("dir"), NS_LITERAL_STRING("rtl"));
+  }
+}
+
 #if DEBUG_JOE
 void
 nsEditor::DumpNode(nsIDOMNode *aNode, PRInt32 indent)
diff --git a/editor/libeditor/base/nsEditor.h b/editor/libeditor/base/nsEditor.h
index e5fc4a8b2a47..078607ec3041 100644
--- a/editor/libeditor/base/nsEditor.h
+++ b/editor/libeditor/base/nsEditor.h
@@ -205,6 +205,8 @@ public:
                                         nsIPrivateTextRangeList *aTextRange)=0;
   nsresult EndIMEComposition();
 
+  void SwitchTextDirectionTo(PRUint32 aDirection);
+
   void BeginKeypressHandling() { mLastKeypressEventWasTrusted = eTriTrue; }
   void BeginKeypressHandling(nsIDOMNSEvent* aEvent);
   void EndKeypressHandling() { mLastKeypressEventWasTrusted = eTriUnset; }
@@ -231,6 +233,8 @@ public:
 protected:
   nsCString mContentMIMEType;       // MIME type of the doc we are editing.
 
+  nsresult DetermineCurrentDirection();
+
   /** create a transaction for setting aAttribute to aValue on aElement
     */
   NS_IMETHOD CreateTxnForSetAttribute(nsIDOMElement *aElement, 
diff --git a/editor/libeditor/base/nsEditorEventListener.cpp b/editor/libeditor/base/nsEditorEventListener.cpp
index eb05fe0a645a..a0e04f9d0bc8 100644
--- a/editor/libeditor/base/nsEditorEventListener.cpp
+++ b/editor/libeditor/base/nsEditorEventListener.cpp
@@ -71,6 +71,7 @@
 #include "nsIFocusManager.h"
 #include "nsIDOMWindow.h"
 #include "nsContentUtils.h"
+#include "nsIBidiKeyboard.h"
 
 using namespace mozilla;
 
@@ -91,6 +92,11 @@ private:
 nsEditorEventListener::nsEditorEventListener() :
   mEditor(nsnull), mCommitText(PR_FALSE),
   mInTransaction(PR_FALSE)
+#ifdef HANDLE_NATIVE_TEXT_DIRECTION_SWITCH
+  , mHaveBidiKeyboards(PR_FALSE)
+  , mShouldSwitchTextDirection(PR_FALSE)
+  , mSwitchToRTL(PR_FALSE)
+#endif
 {
 }
 
@@ -107,6 +113,15 @@ nsEditorEventListener::Connect(nsEditor* aEditor)
 {
   NS_ENSURE_ARG(aEditor);
 
+#ifdef HANDLE_NATIVE_TEXT_DIRECTION_SWITCH
+  nsIBidiKeyboard* bidiKeyboard = nsContentUtils::GetBidiKeyboard();
+  if (bidiKeyboard) {
+    PRBool haveBidiKeyboards = PR_FALSE;
+    bidiKeyboard->GetHaveBidiKeyboards(&haveBidiKeyboards);
+    mHaveBidiKeyboards = haveBidiKeyboards;
+  }
+#endif
+
   mEditor = aEditor;
 
   nsresult rv = InstallToEditor();
@@ -128,6 +143,16 @@ nsEditorEventListener::InstallToEditor()
   nsEventListenerManager* elmP = piTarget->GetListenerManager(PR_TRUE);
   NS_ENSURE_STATE(elmP);
 
+#ifdef HANDLE_NATIVE_TEXT_DIRECTION_SWITCH
+  elmP->AddEventListenerByType(this,
+                               NS_LITERAL_STRING("keydown"),
+                               NS_EVENT_FLAG_BUBBLE |
+                               NS_EVENT_FLAG_SYSTEM_EVENT);
+  elmP->AddEventListenerByType(this,
+                               NS_LITERAL_STRING("keyup"),
+                               NS_EVENT_FLAG_BUBBLE |
+                               NS_EVENT_FLAG_SYSTEM_EVENT);
+#endif
   elmP->AddEventListenerByType(this,
                                NS_LITERAL_STRING("keypress"),
                                NS_EVENT_FLAG_BUBBLE |
@@ -208,6 +233,16 @@ nsEditorEventListener::UninstallFromEditor()
     return;
   }
 
+#ifdef HANDLE_NATIVE_TEXT_DIRECTION_SWITCH
+  elmP->RemoveEventListenerByType(this,
+                                  NS_LITERAL_STRING("keydown"),
+                                  NS_EVENT_FLAG_BUBBLE |
+                                  NS_EVENT_FLAG_SYSTEM_EVENT);
+  elmP->RemoveEventListenerByType(this,
+                                  NS_LITERAL_STRING("keyup"),
+                                  NS_EVENT_FLAG_BUBBLE |
+                                  NS_EVENT_FLAG_SYSTEM_EVENT);
+#endif
   elmP->RemoveEventListenerByType(this,
                                   NS_LITERAL_STRING("keypress"),
                                   NS_EVENT_FLAG_BUBBLE |
@@ -298,6 +333,12 @@ nsEditorEventListener::HandleEvent(nsIDOMEvent* aEvent)
       return Drop(dragEvent);
   }
 
+#ifdef HANDLE_NATIVE_TEXT_DIRECTION_SWITCH
+  if (eventType.EqualsLiteral("keydown"))
+    return KeyDown(aEvent);
+  if (eventType.EqualsLiteral("keyup"))
+    return KeyUp(aEvent);
+#endif
   if (eventType.EqualsLiteral("keypress"))
     return KeyPress(aEvent);
   if (eventType.EqualsLiteral("mousedown"))
@@ -320,6 +361,117 @@ nsEditorEventListener::HandleEvent(nsIDOMEvent* aEvent)
   return NS_OK;
 }
 
+#ifdef HANDLE_NATIVE_TEXT_DIRECTION_SWITCH
+#include <windows.h>
+
+namespace {
+
+// This function is borrowed from Chromium's ImeInput::IsCtrlShiftPressed
+bool IsCtrlShiftPressed(bool& isRTL)
+{
+  BYTE keystate[256];
+  if (!::GetKeyboardState(keystate)) {
+    return false;
+  }
+
+  // To check if a user is pressing only a control key and a right-shift key
+  // (or a left-shift key), we use the steps below:
+  // 1. Check if a user is pressing a control key and a right-shift key (or
+  //    a left-shift key).
+  // 2. If the condition 1 is true, we should check if there are any other
+  //    keys pressed at the same time.
+  //    To ignore the keys checked in 1, we set their status to 0 before
+  //    checking the key status.
+  const int kKeyDownMask = 0x80;
+  if ((keystate[VK_CONTROL] & kKeyDownMask) == 0)
+    return false;
+
+  if (keystate[VK_RSHIFT] & kKeyDownMask) {
+    keystate[VK_RSHIFT] = 0;
+    isRTL = true;
+  } else if (keystate[VK_LSHIFT] & kKeyDownMask) {
+    keystate[VK_LSHIFT] = 0;
+    isRTL = false;
+  } else {
+    return false;
+  }
+
+  // Scan the key status to find pressed keys. We should abandon changing the
+  // text direction when there are other pressed keys.
+  // This code is executed only when a user is pressing a control key and a
+  // right-shift key (or a left-shift key), i.e. we should ignore the status of
+  // the keys: VK_SHIFT, VK_CONTROL, VK_RCONTROL, and VK_LCONTROL.
+  // So, we reset their status to 0 and ignore them.
+  keystate[VK_SHIFT] = 0;
+  keystate[VK_CONTROL] = 0;
+  keystate[VK_RCONTROL] = 0;
+  keystate[VK_LCONTROL] = 0;
+  for (int i = 0; i <= VK_PACKET; ++i) {
+    if (keystate[i] & kKeyDownMask)
+      return false;
+  }
+  return true;
+}
+
+}
+
+// This logic is mostly borrowed from Chromium's
+// RenderWidgetHostViewWin::OnKeyEvent.
+
+NS_IMETHODIMP
+nsEditorEventListener::KeyUp(nsIDOMEvent* aKeyEvent)
+{
+  if (mHaveBidiKeyboards) {
+    nsCOMPtr<nsIDOMKeyEvent> keyEvent = do_QueryInterface(aKeyEvent);
+    if (!keyEvent) {
+      // non-key event passed to keyup.  bad things.
+      return NS_OK;
+    }
+
+    PRUint32 keyCode = 0;
+    keyEvent->GetKeyCode(&keyCode);
+    if (keyCode == nsIDOMKeyEvent::DOM_VK_SHIFT ||
+        keyCode == nsIDOMKeyEvent::DOM_VK_CONTROL) {
+      if (mShouldSwitchTextDirection && mEditor->IsPlaintextEditor()) {
+        mEditor->SwitchTextDirectionTo(mSwitchToRTL ?
+          nsIPlaintextEditor::eEditorRightToLeft :
+          nsIPlaintextEditor::eEditorLeftToRight);
+        mShouldSwitchTextDirection = PR_FALSE;
+      }
+    }
+  }
+
+  return NS_OK;
+}
+
+NS_IMETHODIMP
+nsEditorEventListener::KeyDown(nsIDOMEvent* aKeyEvent)
+{
+  if (mHaveBidiKeyboards) {
+    nsCOMPtr<nsIDOMKeyEvent> keyEvent = do_QueryInterface(aKeyEvent);
+    if (!keyEvent) {
+      // non-key event passed to keydown.  bad things.
+      return NS_OK;
+    }
+
+    PRUint32 keyCode = 0;
+    keyEvent->GetKeyCode(&keyCode);
+    if (keyCode == nsIDOMKeyEvent::DOM_VK_SHIFT) {
+      bool switchToRTL;
+      if (IsCtrlShiftPressed(switchToRTL)) {
+        mShouldSwitchTextDirection = PR_TRUE;
+        mSwitchToRTL = switchToRTL;
+      }
+    } else if (keyCode != nsIDOMKeyEvent::DOM_VK_CONTROL) {
+      // In case the user presses any other key besides Ctrl and Shift
+      mShouldSwitchTextDirection = PR_FALSE;
+    }
+  }
+
+  return NS_OK;
+}
+#endif
+
 NS_IMETHODIMP
 nsEditorEventListener::KeyPress(nsIDOMEvent* aKeyEvent)
 {
diff --git a/editor/libeditor/base/nsEditorEventListener.h b/editor/libeditor/base/nsEditorEventListener.h
index b7071f58d2c7..323dbc03d156 100644
--- a/editor/libeditor/base/nsEditorEventListener.h
+++ b/editor/libeditor/base/nsEditorEventListener.h
@@ -51,6 +51,11 @@
 #undef KeyPress
 #endif
 
+#ifdef XP_WIN
+// On Windows, we support switching the text direction by pressing Ctrl+Shift
+#define HANDLE_NATIVE_TEXT_DIRECTION_SWITCH
+#endif
+
 class nsEditor;
 class nsIDOMDragEvent;
 
@@ -67,6 +72,10 @@ public:
   NS_DECL_ISUPPORTS
   NS_DECL_NSIDOMEVENTLISTENER
 
+#ifdef HANDLE_NATIVE_TEXT_DIRECTION_SWITCH
+  NS_IMETHOD KeyDown(nsIDOMEvent* aKeyEvent);
+  NS_IMETHOD KeyUp(nsIDOMEvent* aKeyEvent);
+#endif
   NS_IMETHOD KeyPress(nsIDOMEvent* aKeyEvent);
   NS_IMETHOD HandleText(nsIDOMEvent* aTextEvent);
   NS_IMETHOD HandleStartComposition(nsIDOMEvent* aCompositionEvent);
@@ -95,6 +104,11 @@ protected:
   nsRefPtr<nsCaret> mCaret;
   PRPackedBool mCommitText;
   PRPackedBool mInTransaction;
+#ifdef HANDLE_NATIVE_TEXT_DIRECTION_SWITCH
+  PRPackedBool mHaveBidiKeyboards;
+  PRPackedBool mShouldSwitchTextDirection;
+  PRPackedBool mSwitchToRTL;
+#endif
 };
 
 #endif // nsEditorEventListener_h__
diff --git a/widget/public/nsIBidiKeyboard.idl b/widget/public/nsIBidiKeyboard.idl
index 533a0c5a0bb2..699396bf2052 100644
--- a/widget/public/nsIBidiKeyboard.idl
+++ b/widget/public/nsIBidiKeyboard.idl
@@ -39,7 +39,7 @@
 
 #include "nsISupports.idl"
 
-[scriptable, uuid(0D8F8F10-C92D-4A6A-B2BB-E1921F3F4DDA)]
+[scriptable, uuid(99957506-f21b-4a61-ad64-5b641cf508e2)]
 interface nsIBidiKeyboard : nsISupports
 {
   /**
@@ -54,5 +54,14 @@ interface nsIBidiKeyboard : nsISupports
    * @throws NS_ERROR_FAILURE if no right-to-left keyboards are installed
    */
   void setLangFromBidiLevel(in PRUint8 aLevel);
+
+  /**
+   * Determines whether the system has at least one keyboard of each direction
+   * installed.
+   *
+   * @throws NS_ERROR_NOT_IMPLEMENTED if the widget layer does not provide this
+   * information.
+   */
+  readonly attribute boolean haveBidiKeyboards;
 };
 
diff --git a/widget/src/cocoa/nsBidiKeyboard.mm b/widget/src/cocoa/nsBidiKeyboard.mm
index f121a2e170d3..de0b9bcf5abf 100644
--- a/widget/src/cocoa/nsBidiKeyboard.mm
+++ b/widget/src/cocoa/nsBidiKeyboard.mm
@@ -66,3 +66,9 @@ NS_IMETHODIMP nsBidiKeyboard::SetLangFromBidiLevel(PRUint8 aLevel)
   // XXX Insert platform specific code to set keyboard language
   return NS_OK;
 }
+
+NS_IMETHODIMP nsBidiKeyboard::GetHaveBidiKeyboards(PRBool* aResult)
+{
+  // not implemented yet
+  return NS_ERROR_NOT_IMPLEMENTED;
+}
diff --git a/widget/src/gtk2/nsBidiKeyboard.cpp b/widget/src/gtk2/nsBidiKeyboard.cpp
index bc259a7740e2..3451933b26df 100644
--- a/widget/src/gtk2/nsBidiKeyboard.cpp
+++ b/widget/src/gtk2/nsBidiKeyboard.cpp
@@ -110,3 +110,8 @@ nsBidiKeyboard::SetLangFromBidiLevel(PRUint8 aLevel)
     return NS_ERROR_NOT_IMPLEMENTED;
 }
 
+NS_IMETHODIMP nsBidiKeyboard::GetHaveBidiKeyboards(PRBool* aResult)
+{
+  // not implemented yet
+  return NS_ERROR_NOT_IMPLEMENTED;
+}
diff --git a/widget/src/os2/nsBidiKeyboard.cpp b/widget/src/os2/nsBidiKeyboard.cpp
index 25572f07fa56..da357d529294 100644
--- a/widget/src/os2/nsBidiKeyboard.cpp
+++ b/widget/src/os2/nsBidiKeyboard.cpp
@@ -61,3 +61,9 @@ NS_IMETHODIMP nsBidiKeyboard::SetLangFromBidiLevel(PRUint8 aLevel)
   // XXX Insert platform specific code to set keyboard language
   return NS_ERROR_NOT_IMPLEMENTED;
 }
+
+NS_IMETHODIMP nsBidiKeyboard::GetHaveBidiKeyboards(PRBool* aResult)
+{
+  // not implemented yet
+  return NS_ERROR_NOT_IMPLEMENTED;
+}
diff --git a/widget/src/qt/nsBidiKeyboard.cpp b/widget/src/qt/nsBidiKeyboard.cpp
index dffc5e2c2bc5..86d0ef4a01f7 100644
--- a/widget/src/qt/nsBidiKeyboard.cpp
+++ b/widget/src/qt/nsBidiKeyboard.cpp
@@ -68,3 +68,9 @@ NS_IMETHODIMP nsBidiKeyboard::SetLangFromBidiLevel(PRUint8 aLevel)
 {
     return NS_OK;
 }
+
+NS_IMETHODIMP nsBidiKeyboard::GetHaveBidiKeyboards(PRBool* aResult)
+{
+  // not implemented yet
+  return NS_ERROR_NOT_IMPLEMENTED;
+}
diff --git a/widget/src/windows/nsBidiKeyboard.cpp b/widget/src/windows/nsBidiKeyboard.cpp
index 3bd96b33c9eb..927bda45599f 100644
--- a/widget/src/windows/nsBidiKeyboard.cpp
+++ b/widget/src/windows/nsBidiKeyboard.cpp
@@ -121,6 +121,18 @@ NS_IMETHODIMP nsBidiKeyboard::IsLangRTL(PRBool *aIsRTL)
   return NS_OK;
 }
 
+NS_IMETHODIMP nsBidiKeyboard::GetHaveBidiKeyboards(PRBool* aResult)
+{
+  NS_ENSURE_ARG_POINTER(aResult);
+
+  nsresult result = SetupBidiKeyboards();
+  if (NS_FAILED(result))
+    return result;
+
+  *aResult = mHaveBidiKeyboards;
+  return NS_OK;
+}
+
 
 // Get the list of keyboard layouts available in the system
 // Set mLTRKeyboard to the first LTR keyboard in the list and mRTLKeyboard to the first RTL keyboard in the list

From eb0081091d97b5a68d245279c5b9502d5e151611 Mon Sep 17 00:00:00 2001
From: Jeff Walden <jwalden@mit.edu>
Date: Wed, 4 May 2011 16:54:24 -0400
Subject: [PATCH 003/209] Bug 686009 - Clean up some comments in jstracer.cpp
 which refer to js_InitClass uses which are now mostly removed.  Also remove
 an obsolete comment in JSObject::makeDenseArraySlow that referred to use of
 js_InitClass to initialize Array.  r=bhackett

--HG--
extra : rebase_source : ed8371bd8e8130ec6807840d7bceb209e6863be3
---
 js/src/jsarray.cpp  |  6 ------
 js/src/jstracer.cpp | 18 +++++++++++++-----
 2 files changed, 13 insertions(+), 11 deletions(-)

diff --git a/js/src/jsarray.cpp b/js/src/jsarray.cpp
index 75c2239fd586..0791144cfe09 100644
--- a/js/src/jsarray.cpp
+++ b/js/src/jsarray.cpp
@@ -1205,12 +1205,6 @@ JSObject::makeDenseArraySlow(JSContext *cx)
 
     clearSlotRange(next, capacity - next);
 
-    /*
-     * Finally, update class. If |this| is Array.prototype, then js_InitClass
-     * will create an emptyShape whose class is &SlowArrayClass, to ensure
-     * that delegating instances can share shapes in the tree rooted at the
-     * proto's empty shape.
-     */
     return true;
 }
 
diff --git a/js/src/jstracer.cpp b/js/src/jstracer.cpp
index 86c4a7282260..3ab75e654cb8 100644
--- a/js/src/jstracer.cpp
+++ b/js/src/jstracer.cpp
@@ -11048,7 +11048,11 @@ TraceRecorder::record_JSOP_OBJTOP()
 RecordingStatus
 TraceRecorder::getClassPrototype(JSObject* ctor, LIns*& proto_ins)
 {
-    // ctor must be a function created via js_InitClass.
+    /*
+     * This function requires that |ctor| be a built-in class function in order
+     * to have an immutable |ctor.prototype| that can be burned into the trace
+     * below.
+     */
 #ifdef DEBUG
     Class *clasp = ctor->getFunctionPrivate()->getConstructorClass();
     JS_ASSERT(clasp);
@@ -11060,8 +11064,10 @@ TraceRecorder::getClassPrototype(JSObject* ctor, LIns*& proto_ins)
     if (!ctor->getProperty(cx, ATOM_TO_JSID(cx->runtime->atomState.classPrototypeAtom), &pval))
         RETURN_ERROR("error getting prototype from constructor");
 
-    // ctor.prototype is a permanent data property, so this lookup cannot have
-    // deep-aborted.
+    /*
+     * |ctor.prototype| is a non-configurable, non-writable data property, so
+     * this lookup cannot have deep-aborted.
+     */
     JS_ASSERT(localtm.recorder);
 
 #ifdef DEBUG
@@ -11073,8 +11079,10 @@ TraceRecorder::getClassPrototype(JSObject* ctor, LIns*& proto_ins)
     JS_ASSERT((~attrs & (JSPROP_READONLY | JSPROP_PERMANENT)) == 0);
 #endif
 
-    // Since ctor was built by js_InitClass, we can assert (rather than check)
-    // that pval is usable.
+    /*
+     * Per requirements noted at the start of this function, pval must be
+     * usable.
+     */
     JS_ASSERT(!pval.isPrimitive());
     JSObject *proto = &pval.toObject();
     JS_ASSERT(!proto->isDenseArray());

From adf688ddf81328d82b8f377fbc95e1b802a8de27 Mon Sep 17 00:00:00 2001
From: Mark Finkle <mfinkle@mozilla.com>
Date: Thu, 15 Sep 2011 13:43:59 -0400
Subject: [PATCH 004/209] Bug 686637 - Stop extracting hyphenation files from
 the APK [r=dougt]

---
 embedding/android/GeckoApp.java       | 20 ++----
 layout/reftests/text/reftest.list     | 93 ++++++++++++++-------------
 toolkit/mozapps/installer/packager.mk |  1 -
 3 files changed, 52 insertions(+), 62 deletions(-)

diff --git a/embedding/android/GeckoApp.java b/embedding/android/GeckoApp.java
index 560e00e0d1b5..8ecd405a8512 100644
--- a/embedding/android/GeckoApp.java
+++ b/embedding/android/GeckoApp.java
@@ -492,21 +492,11 @@ abstract public class GeckoApp
         // copy any .xpi file into an extensions/ directory
         Enumeration<? extends ZipEntry> zipEntries = zip.entries();
         while (zipEntries.hasMoreElements()) {
-          ZipEntry entry = zipEntries.nextElement();
-          if (entry.getName().startsWith("extensions/") && entry.getName().endsWith(".xpi")) {
-            Log.i("GeckoAppJava", "installing extension : " + entry.getName());
-            unpackFile(zip, buf, entry, entry.getName());
-          }
-        }
-
-        // copy any hyphenation dictionaries file into a hyphenation/ directory
-        Enumeration<? extends ZipEntry> hyphenEntries = zip.entries();
-        while (hyphenEntries.hasMoreElements()) {
-          ZipEntry entry = hyphenEntries.nextElement();
-          if (entry.getName().startsWith("hyphenation/")) {
-            Log.i("GeckoAppJava", "installing hyphenation : " + entry.getName());
-            unpackFile(zip, buf, entry, entry.getName());
-          }
+            ZipEntry entry = zipEntries.nextElement();
+            if (entry.getName().startsWith("extensions/") && entry.getName().endsWith(".xpi")) {
+                Log.i("GeckoAppJava", "installing extension : " + entry.getName());
+                unpackFile(zip, buf, entry, entry.getName());
+            }
         }
     }
 
diff --git a/layout/reftests/text/reftest.list b/layout/reftests/text/reftest.list
index f436df92ee41..4cca1e088440 100644
--- a/layout/reftests/text/reftest.list
+++ b/layout/reftests/text/reftest.list
@@ -90,49 +90,50 @@ HTTP(..) == arabic-shaping-1.html arabic-shaping-1-ref.html
 # check ligature in Arial Bold on Windows, for bug 644184; may fail on other platforms depending on fonts
 random-if(!winWidget) == arial-bold-lam-alef-1.html arial-bold-lam-alef-1-ref.html
 # Tests for hyphenation with -moz-hyphens
-== auto-hyphenation-1.html auto-hyphenation-1-ref.html
-!= auto-hyphenation-1.html auto-hyphenation-1-notref.html
-== auto-hyphenation-1a.html auto-hyphenation-1-ref.html
-== auto-hyphenation-2.html auto-hyphenation-2-ref.html
-== auto-hyphenation-3.html auto-hyphenation-3-ref.html
-== auto-hyphenation-4.html auto-hyphenation-4-ref.html
-== auto-hyphenation-5.html auto-hyphenation-5-ref.html
-== auto-hyphenation-6.html auto-hyphenation-6-ref.html
-== auto-hyphenation-7.html auto-hyphenation-7-ref.html
-== auto-hyphenation-af-1.html auto-hyphenation-af-1-ref.html
-== auto-hyphenation-bg-1.html auto-hyphenation-bg-1-ref.html
-== auto-hyphenation-ca-1.html auto-hyphenation-ca-1-ref.html
-== auto-hyphenation-cy-1.html auto-hyphenation-cy-1-ref.html
-== auto-hyphenation-da-1.html auto-hyphenation-da-1-ref.html
-== auto-hyphenation-de-1901-1.html auto-hyphenation-de-1901-1-ref.html
-== auto-hyphenation-de-1996-1.html auto-hyphenation-de-1996-1-ref.html
-!= auto-hyphenation-de-1901-1.html auto-hyphenation-de-1996-1.html
-== auto-hyphenation-de-ch-1.html auto-hyphenation-de-ch-1-ref.html
-== auto-hyphenation-eo-1.html auto-hyphenation-eo-1-ref.html
-== auto-hyphenation-es-1.html auto-hyphenation-es-1-ref.html
-== auto-hyphenation-et-1.html auto-hyphenation-et-1-ref.html
-== auto-hyphenation-fi-1.html auto-hyphenation-fi-1-ref.html
-== auto-hyphenation-fr-1.html auto-hyphenation-fr-1-ref.html
-== auto-hyphenation-gl-1.html auto-hyphenation-gl-1-ref.html
-== auto-hyphenation-hr-1.html auto-hyphenation-hr-1-ref.html
-== auto-hyphenation-hsb-1.html auto-hyphenation-hsb-1-ref.html
-== auto-hyphenation-hu-1.html auto-hyphenation-hu-1-ref.html
-== auto-hyphenation-ia-1.html auto-hyphenation-ia-1-ref.html
-== auto-hyphenation-is-1.html auto-hyphenation-is-1-ref.html
-== auto-hyphenation-it-1.html auto-hyphenation-it-1-ref.html
-== auto-hyphenation-kmr-1.html auto-hyphenation-kmr-1-ref.html
-== auto-hyphenation-la-1.html auto-hyphenation-la-1-ref.html
-== auto-hyphenation-lt-1.html auto-hyphenation-lt-1-ref.html
-== auto-hyphenation-mn-1.html auto-hyphenation-mn-1-ref.html
-== auto-hyphenation-nb-1.html auto-hyphenation-nb-1-ref.html
-== auto-hyphenation-nl-1.html auto-hyphenation-nl-1-ref.html
-== auto-hyphenation-nn-1.html auto-hyphenation-nn-1-ref.html
-== auto-hyphenation-pt-1.html auto-hyphenation-pt-1-ref.html
-== auto-hyphenation-ru-1.html auto-hyphenation-ru-1-ref.html
-== auto-hyphenation-sh-1.html auto-hyphenation-sh-1-ref.html
-== auto-hyphenation-sl-1.html auto-hyphenation-sl-1-ref.html
-== auto-hyphenation-sr-1.html auto-hyphenation-sr-1-ref.html
-== auto-hyphenation-sv-1.html auto-hyphenation-sv-1-ref.html # test swedish patterns
-!= auto-hyphenation-sv-1.html auto-hyphenation-sv-1-notref.html # verify swedish != english
-== auto-hyphenation-tr-1.html auto-hyphenation-tr-1-ref.html
-== auto-hyphenation-uk-1.html auto-hyphenation-uk-1-ref.html
+# Android does not ship the hyphenation dictionaries
+skip-if(Android) == auto-hyphenation-1.html auto-hyphenation-1-ref.html
+skip-if(Android) != auto-hyphenation-1.html auto-hyphenation-1-notref.html
+skip-if(Android) == auto-hyphenation-1a.html auto-hyphenation-1-ref.html
+skip-if(Android) == auto-hyphenation-2.html auto-hyphenation-2-ref.html
+skip-if(Android) == auto-hyphenation-3.html auto-hyphenation-3-ref.html
+skip-if(Android) == auto-hyphenation-4.html auto-hyphenation-4-ref.html
+skip-if(Android) == auto-hyphenation-5.html auto-hyphenation-5-ref.html
+skip-if(Android) == auto-hyphenation-6.html auto-hyphenation-6-ref.html
+skip-if(Android) == auto-hyphenation-7.html auto-hyphenation-7-ref.html
+skip-if(Android) == auto-hyphenation-af-1.html auto-hyphenation-af-1-ref.html
+skip-if(Android) == auto-hyphenation-bg-1.html auto-hyphenation-bg-1-ref.html
+skip-if(Android) == auto-hyphenation-ca-1.html auto-hyphenation-ca-1-ref.html
+skip-if(Android) == auto-hyphenation-cy-1.html auto-hyphenation-cy-1-ref.html
+skip-if(Android) == auto-hyphenation-da-1.html auto-hyphenation-da-1-ref.html
+skip-if(Android) == auto-hyphenation-de-1901-1.html auto-hyphenation-de-1901-1-ref.html
+skip-if(Android) == auto-hyphenation-de-1996-1.html auto-hyphenation-de-1996-1-ref.html
+skip-if(Android) != auto-hyphenation-de-1901-1.html auto-hyphenation-de-1996-1.html
+skip-if(Android) == auto-hyphenation-de-ch-1.html auto-hyphenation-de-ch-1-ref.html
+skip-if(Android) == auto-hyphenation-eo-1.html auto-hyphenation-eo-1-ref.html
+skip-if(Android) == auto-hyphenation-es-1.html auto-hyphenation-es-1-ref.html
+skip-if(Android) == auto-hyphenation-et-1.html auto-hyphenation-et-1-ref.html
+skip-if(Android) == auto-hyphenation-fi-1.html auto-hyphenation-fi-1-ref.html
+skip-if(Android) == auto-hyphenation-fr-1.html auto-hyphenation-fr-1-ref.html
+skip-if(Android) == auto-hyphenation-gl-1.html auto-hyphenation-gl-1-ref.html
+skip-if(Android) == auto-hyphenation-hr-1.html auto-hyphenation-hr-1-ref.html
+skip-if(Android) == auto-hyphenation-hsb-1.html auto-hyphenation-hsb-1-ref.html
+skip-if(Android) == auto-hyphenation-hu-1.html auto-hyphenation-hu-1-ref.html
+skip-if(Android) == auto-hyphenation-ia-1.html auto-hyphenation-ia-1-ref.html
+skip-if(Android) == auto-hyphenation-is-1.html auto-hyphenation-is-1-ref.html
+skip-if(Android) == auto-hyphenation-it-1.html auto-hyphenation-it-1-ref.html
+skip-if(Android) == auto-hyphenation-kmr-1.html auto-hyphenation-kmr-1-ref.html
+skip-if(Android) == auto-hyphenation-la-1.html auto-hyphenation-la-1-ref.html
+skip-if(Android) == auto-hyphenation-lt-1.html auto-hyphenation-lt-1-ref.html
+skip-if(Android) == auto-hyphenation-mn-1.html auto-hyphenation-mn-1-ref.html
+skip-if(Android) == auto-hyphenation-nb-1.html auto-hyphenation-nb-1-ref.html
+skip-if(Android) == auto-hyphenation-nl-1.html auto-hyphenation-nl-1-ref.html
+skip-if(Android) == auto-hyphenation-nn-1.html auto-hyphenation-nn-1-ref.html
+skip-if(Android) == auto-hyphenation-pt-1.html auto-hyphenation-pt-1-ref.html
+skip-if(Android) == auto-hyphenation-ru-1.html auto-hyphenation-ru-1-ref.html
+skip-if(Android) == auto-hyphenation-sh-1.html auto-hyphenation-sh-1-ref.html
+skip-if(Android) == auto-hyphenation-sl-1.html auto-hyphenation-sl-1-ref.html
+skip-if(Android) == auto-hyphenation-sr-1.html auto-hyphenation-sr-1-ref.html
+skip-if(Android) == auto-hyphenation-sv-1.html auto-hyphenation-sv-1-ref.html # test swedish patterns
+skip-if(Android) != auto-hyphenation-sv-1.html auto-hyphenation-sv-1-notref.html # verify swedish != english
+skip-if(Android) == auto-hyphenation-tr-1.html auto-hyphenation-tr-1-ref.html
+skip-if(Android) == auto-hyphenation-uk-1.html auto-hyphenation-uk-1-ref.html
diff --git a/toolkit/mozapps/installer/packager.mk b/toolkit/mozapps/installer/packager.mk
index 8ea1f1a3c3ba..62afae62707e 100644
--- a/toolkit/mozapps/installer/packager.mk
+++ b/toolkit/mozapps/installer/packager.mk
@@ -267,7 +267,6 @@ DIST_FILES = \
   components \
   defaults \
   modules \
-  hyphenation \
   res \
   lib \
   lib.id \

From 2dd6080af099426d4cda48da21d9234f69f6be5b Mon Sep 17 00:00:00 2001
From: Wesley Johnston <wjohnston@mozilla.com>
Date: Thu, 15 Sep 2011 10:39:00 -0400
Subject: [PATCH 005/209] Bug 686903 - Remove about:home fadein animation.
 r=mbrubeck

---
 mobile/chrome/content/aboutHome.xhtml |  5 +----
 mobile/themes/core/aboutHome.css      | 10 ----------
 2 files changed, 1 insertion(+), 14 deletions(-)

diff --git a/mobile/chrome/content/aboutHome.xhtml b/mobile/chrome/content/aboutHome.xhtml
index 64fec2142c63..e358bdbcdcc1 100644
--- a/mobile/chrome/content/aboutHome.xhtml
+++ b/mobile/chrome/content/aboutHome.xhtml
@@ -62,7 +62,7 @@
   <div id="wrapper">
     <div id="header"><div id="logo"><img src="chrome://branding/content/logo.png"/></div>&aboutHome.header;</div>
 
-    <div id="content" hidden="true">
+    <div id="content">
       <div id="recentTabs" class="section-box">
         <h1>&aboutHome.recentTabs;</h1>
         <div id="loadingTabs" class="loading">
@@ -448,9 +448,6 @@
      broadcaster.removeAttribute("mode");
      doc.removeEventListener("animationend", endDiscovery, false);
      doc.removeEventListener("PanBegin", endDiscovery, false);
-     setTimeout(function() {
-       document.getElementById("content").removeAttribute("hidden");
-     }, 0);
    }
    
    function initLightbox() {
diff --git a/mobile/themes/core/aboutHome.css b/mobile/themes/core/aboutHome.css
index 2cc572e1bd3f..1cbbfc9bc859 100644
--- a/mobile/themes/core/aboutHome.css
+++ b/mobile/themes/core/aboutHome.css
@@ -228,16 +228,6 @@ body[dir="rtl"] {
   -moz-margin-start: 0 !important;
 }
 
-#content {
-  opacity: 1;
-  -moz-transition: opacity 500ms;
-}
-
-#content[hidden] {
-  display: block;
-  opacity: 0;
-}
-
 #footer-wrapper {
   font-size: 18px;
   margin-top: 24px;

From 6eac15ca485cedd007a75f67669cb36b87f6ea27 Mon Sep 17 00:00:00 2001
From: Jeff Walden <jwalden@mit.edu>
Date: Wed, 10 Aug 2011 14:54:51 -0700
Subject: [PATCH 006/209] Bug 686582 - Add element-valued inline methods to
 JSObject, which forward to the corresponding id-valued methods for the
 moment.  r=dvander

--HG--
extra : rebase_source : 5e422650d8c8b7891afaa611d09b3ff1d04d5bab
---
 js/src/jsobj.h        | 21 ++++++++++++
 js/src/jsobjinlines.h | 74 +++++++++++++++++++++++++++++++++++++++++++
 2 files changed, 95 insertions(+)

diff --git a/js/src/jsobj.h b/js/src/jsobj.h
index bf63af2d3f0d..8628dafeea5d 100644
--- a/js/src/jsobj.h
+++ b/js/src/jsobj.h
@@ -1376,6 +1376,8 @@ struct JSObject : js::gc::Cell {
         return (op ? op : js_LookupProperty)(cx, this, id, objp, propp);
     }
 
+    inline JSBool lookupElement(JSContext *cx, uint32 index, JSObject **objp, JSProperty **propp);
+
     JSBool defineProperty(JSContext *cx, jsid id, const js::Value &value,
                           js::PropertyOp getter = js::PropertyStub,
                           js::StrictPropertyOp setter = js::StrictPropertyStub,
@@ -1384,15 +1386,27 @@ struct JSObject : js::gc::Cell {
         return (op ? op : js_DefineProperty)(cx, this, id, &value, getter, setter, attrs);
     }
 
+    inline JSBool defineElement(JSContext *cx, uint32 index, const js::Value &value,
+                                js::PropertyOp getter = js::PropertyStub,
+                                js::StrictPropertyOp setter = js::StrictPropertyStub,
+                                uintN attrs = JSPROP_ENUMERATE);
+
     inline JSBool getProperty(JSContext *cx, JSObject *receiver, jsid id, js::Value *vp);
+
+    inline JSBool getElement(JSContext *cx, JSObject *receiver, uint32 index, js::Value *vp);
+
     inline JSBool getProperty(JSContext *cx, jsid id, js::Value *vp);
 
+    inline JSBool getElement(JSContext *cx, uint32 index, js::Value *vp);
+
     JSBool setProperty(JSContext *cx, jsid id, js::Value *vp, JSBool strict) {
         if (getOps()->setProperty)
             return nonNativeSetProperty(cx, id, vp, strict);
         return js_SetPropertyHelper(cx, this, id, 0, vp, strict);
     }
 
+    inline JSBool setElement(JSContext *cx, uint32 index, js::Value *vp, JSBool strict);
+
     JSBool nonNativeSetProperty(JSContext *cx, jsid id, js::Value *vp, JSBool strict);
 
     JSBool getAttributes(JSContext *cx, jsid id, uintN *attrsp) {
@@ -1400,9 +1414,16 @@ struct JSObject : js::gc::Cell {
         return (op ? op : js_GetAttributes)(cx, this, id, attrsp);
     }
 
+    inline JSBool getElementAttributes(JSContext *cx, uint32 index, uintN *attrsp);
+
     inline JSBool setAttributes(JSContext *cx, jsid id, uintN *attrsp);
+
+    inline JSBool setElementAttributes(JSContext *cx, uint32 index, uintN *attrsp);
+
     inline JSBool deleteProperty(JSContext *cx, jsid id, js::Value *rval, JSBool strict);
 
+    inline JSBool deleteElement(JSContext *cx, uint32 index, js::Value *rval, JSBool strict);
+
     JSBool enumerate(JSContext *cx, JSIterateOp iterop, js::Value *statep, jsid *idp) {
         js::NewEnumerateOp op = getOps()->enumerate;
         return (op ? op : js_Enumerate)(cx, this, iterop, statep, idp);
diff --git a/js/src/jsobjinlines.h b/js/src/jsobjinlines.h
index 656339d44a36..f6f389138cbe 100644
--- a/js/src/jsobjinlines.h
+++ b/js/src/jsobjinlines.h
@@ -67,6 +67,7 @@
 
 #include "vm/GlobalObject.h"
 
+#include "jsatominlines.h"
 #include "jsfuninlines.h"
 #include "jsgcinlines.h"
 #include "jsprobes.h"
@@ -1092,6 +1093,79 @@ JSObject::setSharedNonNativeMap()
     setMap(&js::Shape::sharedNonNative);
 }
 
+inline JSBool
+JSObject::lookupElement(JSContext *cx, uint32 index, JSObject **objp, JSProperty **propp)
+{
+    jsid id;
+    if (!js::IndexToId(cx, index, &id))
+        return false;
+    return lookupProperty(cx, id, objp, propp);
+}
+
+inline JSBool
+JSObject::defineElement(JSContext *cx, uint32 index, const js::Value &value,
+                        js::PropertyOp getter, js::StrictPropertyOp setter, uintN attrs)
+{
+    jsid id;
+    if (!js::IndexToId(cx, index, &id))
+        return false;
+    return defineProperty(cx, id, value, getter, setter, attrs);
+}
+
+inline JSBool
+JSObject::getElement(JSContext *cx, JSObject *receiver, uint32 index, js::Value *vp)
+{
+    jsid id;
+    if (!js::IndexToId(cx, index, &id))
+        return false;
+    return getProperty(cx, receiver, id, vp);
+}
+
+inline JSBool
+JSObject::getElement(JSContext *cx, uint32 index, js::Value *vp)
+{
+    jsid id;
+    if (!js::IndexToId(cx, index, &id))
+        return false;
+    return getProperty(cx, id, vp);
+}
+
+inline JSBool
+JSObject::setElement(JSContext *cx, uint32 index, js::Value *vp, JSBool strict)
+{
+    jsid id;
+    if (!js::IndexToId(cx, index, &id))
+        return false;
+    return setProperty(cx, id, vp, strict);
+}
+
+inline JSBool
+JSObject::getElementAttributes(JSContext *cx, uint32 index, uintN *attrsp)
+{
+    jsid id;
+    if (!js::IndexToId(cx, index, &id))
+        return false;
+    return getAttributes(cx, id, attrsp);
+}
+
+inline JSBool
+JSObject::setElementAttributes(JSContext *cx, uint32 index, uintN *attrsp)
+{
+    jsid id;
+    if (!js::IndexToId(cx, index, &id))
+        return false;
+    return setAttributes(cx, id, attrsp);
+}
+
+inline JSBool
+JSObject::deleteElement(JSContext *cx, uint32 index, js::Value *rval, JSBool strict)
+{
+    jsid id;
+    if (!js::IndexToId(cx, index, &id))
+        return false;
+    return deleteProperty(cx, id, rval, strict);
+}
+
 static inline bool
 js_IsCallable(const js::Value &v)
 {

From bb472a9954363749e955a7839abeb34604dc6691 Mon Sep 17 00:00:00 2001
From: Jeff Walden <jwalden@mit.edu>
Date: Wed, 10 Aug 2011 14:54:52 -0700
Subject: [PATCH 007/209] Bug 686582 - Begin to specialize
 ObjectOps::lookupElement to not just delegate to ObjectOps::lookupProperty. 
 r=dvander

--HG--
extra : rebase_source : f04ec73fec1831c717e01779e0d692585f8ed74d
---
 js/src/jsarray.cpp      | 32 ++++++++++++++++++++-----
 js/src/jsobj.cpp        | 10 ++++++++
 js/src/jsobj.h          |  3 +++
 js/src/jsobjinlines.h   |  6 ++---
 js/src/jstypedarray.cpp | 52 ++++++++++++++++++++++++++++++++++-------
 js/src/jsxml.cpp        | 20 +++++++++++++++-
 6 files changed, 103 insertions(+), 20 deletions(-)

diff --git a/js/src/jsarray.cpp b/js/src/jsarray.cpp
index 0791144cfe09..3d61b8e41174 100644
--- a/js/src/jsarray.cpp
+++ b/js/src/jsarray.cpp
@@ -686,6 +686,16 @@ array_length_setter(JSContext *cx, JSObject *obj, jsid id, JSBool strict, Value
     return true;
 }
 
+/* Returns true if the dense array has an own property at the index. */
+static inline bool
+IsDenseArrayIndex(JSObject *obj, uint32 index)
+{
+    JS_ASSERT(obj->isDenseArray());
+
+    return index < obj->getDenseArrayInitializedLength() &&
+           !obj->getDenseArrayElement(index).isMagic(JS_ARRAY_HOLE);
+}
+
 /*
  * We have only indexed properties up to initialized length, plus the
  * length property. For all else, we delegate to the prototype.
@@ -697,8 +707,7 @@ IsDenseArrayId(JSContext *cx, JSObject *obj, jsid id)
 
     uint32 i;
     return JSID_IS_ATOM(id, cx->runtime->atomState.lengthAtom) ||
-           (js_IdIsIndex(id, &i) && i < obj->getDenseArrayInitializedLength() &&
-            !obj->getDenseArrayElement(i).isMagic(JS_ARRAY_HOLE));
+           (js_IdIsIndex(id, &i) && IsDenseArrayIndex(obj, i));
 }
 
 static JSBool
@@ -727,10 +736,21 @@ static JSBool
 array_lookupElement(JSContext *cx, JSObject *obj, uint32 index, JSObject **objp,
                     JSProperty **propp)
 {
-    jsid id;
-    if (!IndexToId(cx, index, &id))
-        return false;
-    return array_lookupProperty(cx, obj, id, objp, propp);
+    if (!obj->isDenseArray())
+        return js_LookupElement(cx, obj, index, objp, propp);
+
+    if (IsDenseArrayIndex(obj, index)) {
+        *propp = (JSProperty *) 1;  /* non-null to indicate found */
+        *objp = obj;
+        return true;
+    }
+
+    if (JSObject *proto = obj->getProto())
+        return proto->lookupElement(cx, index, objp, propp);
+
+    *objp = NULL;
+    *propp = NULL;
+    return true;
 }
 
 JSBool
diff --git a/js/src/jsobj.cpp b/js/src/jsobj.cpp
index e129ad03b47c..286364b13935 100644
--- a/js/src/jsobj.cpp
+++ b/js/src/jsobj.cpp
@@ -5440,6 +5440,16 @@ js_LookupProperty(JSContext *cx, JSObject *obj, jsid id, JSObject **objp,
     return LookupPropertyWithFlagsInline(cx, obj, id, cx->resolveFlags, objp, propp);
 }
 
+JS_FRIEND_API(JSBool)
+js_LookupElement(JSContext *cx, JSObject *obj, uint32 index, JSObject **objp, JSProperty **propp)
+{
+    jsid id;
+    if (!IndexToId(cx, index, &id))
+        return false;
+
+    return LookupPropertyWithFlagsInline(cx, obj, id, cx->resolveFlags, objp, propp);
+}
+
 namespace js {
 
 bool
diff --git a/js/src/jsobj.h b/js/src/jsobj.h
index 8628dafeea5d..5ab910141328 100644
--- a/js/src/jsobj.h
+++ b/js/src/jsobj.h
@@ -247,6 +247,9 @@ extern JS_FRIEND_API(JSBool)
 js_LookupProperty(JSContext *cx, JSObject *obj, jsid id, JSObject **objp,
                   JSProperty **propp);
 
+extern JS_FRIEND_API(JSBool)
+js_LookupElement(JSContext *cx, JSObject *obj, uint32 index, JSObject **objp, JSProperty **propp);
+
 extern JSBool
 js_DefineProperty(JSContext *cx, JSObject *obj, jsid id, const js::Value *value,
                   js::PropertyOp getter, js::StrictPropertyOp setter, uintN attrs);
diff --git a/js/src/jsobjinlines.h b/js/src/jsobjinlines.h
index f6f389138cbe..39a7db901b1c 100644
--- a/js/src/jsobjinlines.h
+++ b/js/src/jsobjinlines.h
@@ -1096,10 +1096,8 @@ JSObject::setSharedNonNativeMap()
 inline JSBool
 JSObject::lookupElement(JSContext *cx, uint32 index, JSObject **objp, JSProperty **propp)
 {
-    jsid id;
-    if (!js::IndexToId(cx, index, &id))
-        return false;
-    return lookupProperty(cx, id, objp, propp);
+    js::LookupElementOp op = getOps()->lookupElement;
+    return (op ? op : js_LookupElement)(cx, this, index, objp, propp);
 }
 
 inline JSBool
diff --git a/js/src/jstypedarray.cpp b/js/src/jstypedarray.cpp
index e537a4dbc6fb..5226ef2d8d5f 100644
--- a/js/src/jstypedarray.cpp
+++ b/js/src/jstypedarray.cpp
@@ -237,12 +237,14 @@ ArrayBuffer::obj_trace(JSTracer *trc, JSObject *obj)
         MarkObject(trc, *delegate, "arraybuffer.delegate");
 }
 
+static JSProperty * const PROPERTY_FOUND = reinterpret_cast<JSProperty *>(1);
+
 JSBool
 ArrayBuffer::obj_lookupProperty(JSContext *cx, JSObject *obj, jsid id,
                                 JSObject **objp, JSProperty **propp)
 {
     if (JSID_IS_ATOM(id, cx->runtime->atomState.byteLengthAtom)) {
-        *propp = (JSProperty *) 1;
+        *propp = PROPERTY_FOUND;
         *objp = getArrayBuffer(obj);
         return true;
     }
@@ -281,10 +283,31 @@ JSBool
 ArrayBuffer::obj_lookupElement(JSContext *cx, JSObject *obj, uint32 index,
                                JSObject **objp, JSProperty **propp)
 {
-    jsid id;
-    if (!IndexToId(cx, index, &id))
+    JSObject *delegate = DelegateObject(cx, obj);
+    if (!delegate)
         return false;
-    return obj_lookupProperty(cx, obj, id, objp, propp);
+
+    /*
+     * If false, there was an error, so propagate it.
+     * Otherwise, if propp is non-null, the property
+     * was found. Otherwise it was not
+     * found so look in the prototype chain.
+     */
+    if (!delegate->lookupElement(cx, index, objp, propp))
+        return false;
+
+    if (*propp != NULL) {
+        if (*objp == delegate)
+            *objp = obj;
+        return true;
+    }
+
+    if (JSObject *proto = obj->getProto())
+        return proto->lookupElement(cx, index, objp, propp);
+
+    *objp = NULL;
+    *propp = NULL;
+    return true;
 }
 
 JSBool
@@ -589,7 +612,7 @@ TypedArray::obj_lookupProperty(JSContext *cx, JSObject *obj, jsid id,
     JS_ASSERT(tarray);
 
     if (isArrayIndex(cx, tarray, id)) {
-        *propp = (JSProperty *) 1;  /* non-null to indicate found */
+        *propp = PROPERTY_FOUND;
         *objp = obj;
         return true;
     }
@@ -608,10 +631,21 @@ JSBool
 TypedArray::obj_lookupElement(JSContext *cx, JSObject *obj, uint32 index,
                               JSObject **objp, JSProperty **propp)
 {
-    jsid id;
-    if (!IndexToId(cx, index, &id))
-        return false;
-    return obj_lookupProperty(cx, obj, id, objp, propp);
+    JSObject *tarray = getTypedArray(obj);
+    JS_ASSERT(tarray);
+
+    if (index < getLength(tarray)) {
+        *propp = PROPERTY_FOUND;
+        *objp = obj;
+        return true;
+    }
+
+    if (JSObject *proto = obj->getProto())
+        return proto->lookupElement(cx, index, objp, propp);
+
+    *objp = NULL;
+    *propp = NULL;
+    return true;
 }
 
 JSBool
diff --git a/js/src/jsxml.cpp b/js/src/jsxml.cpp
index f7f2fe1337b0..7e3eaac7091d 100644
--- a/js/src/jsxml.cpp
+++ b/js/src/jsxml.cpp
@@ -4737,10 +4737,28 @@ static JSBool
 xml_lookupElement(JSContext *cx, JSObject *obj, uint32 index, JSObject **objp,
                   JSProperty **propp)
 {
+    JSXML *xml = reinterpret_cast<JSXML *>(obj->getPrivate());
+    if (!HasIndexedProperty(xml, index)) {
+        *objp = NULL;
+        *propp = NULL;
+        return true;
+    }
+
     jsid id;
     if (!IndexToId(cx, index, &id))
         return false;
-    return xml_lookupProperty(cx, obj, id, objp, propp);
+
+    const Shape *shape =
+        js_AddNativeProperty(cx, obj, id,
+                             Valueify(GetProperty), Valueify(PutProperty),
+                             SHAPE_INVALID_SLOT, JSPROP_ENUMERATE,
+                             0, 0);
+    if (!shape)
+        return false;
+
+    *objp = obj;
+    *propp = (JSProperty *) shape;
+    return true;
 }
 
 static JSBool

From 5640581cbe41dc792fc1f711bb0278e22cf524a2 Mon Sep 17 00:00:00 2001
From: Jeff Walden <jwalden@mit.edu>
Date: Wed, 10 Aug 2011 14:54:52 -0700
Subject: [PATCH 008/209] Bug 686582 - Make the JSON Walk function do its
 walking over array elements using getElement instead of getProperty, a first
 step toward actually using element-based methods now being specialized. 
 r=dvander

--HG--
extra : rebase_source : 9816241003454d8b23c8903c97656993cb834ea1
---
 js/src/json.cpp | 35 +++++++++++++++++++++++++++--------
 1 file changed, 27 insertions(+), 8 deletions(-)

diff --git a/js/src/json.cpp b/js/src/json.cpp
index 03e5fb7b0ceb..ed65c3fa69fc 100644
--- a/js/src/json.cpp
+++ b/js/src/json.cpp
@@ -281,12 +281,33 @@ class CycleDetector
     JSObject *const obj;
 };
 
+template<typename KeyType>
+class KeyStringifier {
+};
+
+template<>
+class KeyStringifier<uint32> {
+  public:
+    static JSString *toString(JSContext *cx, uint32 index) {
+        return IndexToString(cx, index);
+    }
+};
+
+template<>
+class KeyStringifier<jsid> {
+  public:
+    static JSString *toString(JSContext *cx, jsid id) {
+        return IdToString(cx, id);
+    }
+};
+
 /*
  * ES5 15.12.3 Str, steps 2-4, extracted to enable preprocessing of property
  * values when stringifying objects in JO.
  */
+template<typename KeyType>
 static bool
-PreprocessValue(JSContext *cx, JSObject *holder, jsid key, Value *vp, StringifyContext *scx)
+PreprocessValue(JSContext *cx, JSObject *holder, KeyType key, Value *vp, StringifyContext *scx)
 {
     JSString *keyStr = NULL;
 
@@ -298,7 +319,7 @@ PreprocessValue(JSContext *cx, JSObject *holder, jsid key, Value *vp, StringifyC
             return false;
 
         if (js_IsCallable(toJSON)) {
-            keyStr = IdToString(cx, key);
+            keyStr = KeyStringifier<KeyType>::toString(cx, key);
             if (!keyStr)
                 return false;
 
@@ -319,7 +340,7 @@ PreprocessValue(JSContext *cx, JSObject *holder, jsid key, Value *vp, StringifyC
     /* Step 3. */
     if (scx->replacer && scx->replacer->isCallable()) {
         if (!keyStr) {
-            keyStr = IdToString(cx, key);
+            keyStr = KeyStringifier<KeyType>::toString(cx, key);
             if (!keyStr)
                 return false;
         }
@@ -495,18 +516,16 @@ JA(JSContext *cx, JSObject *obj, StringifyContext *scx)
 
         /* Steps 7-10. */
         Value outputValue;
-        for (jsuint i = 0; i < length; i++) {
-            jsid id = INT_TO_JSID(i);
-
+        for (uint32 i = 0; i < length; i++) {
             /*
              * Steps 8a-8c.  Again note how the call to the spec's Str method
              * is broken up into getting the property, running it past toJSON
              * and the replacer and maybe unboxing, and interpreting some
              * values as |null| in separate steps.
              */
-            if (!obj->getProperty(cx, id, &outputValue))
+            if (!obj->getElement(cx, i, &outputValue))
                 return JS_FALSE;
-            if (!PreprocessValue(cx, obj, id, &outputValue, scx))
+            if (!PreprocessValue(cx, obj, i, &outputValue, scx))
                 return JS_FALSE;
             if (IsFilteredValue(outputValue)) {
                 if (!scx->sb.append("null"))

From 6e9fe11f5940b84a9a61c553f24f3c12129b8697 Mon Sep 17 00:00:00 2001
From: Mounir Lamouri <mounir.lamouri@gmail.com>
Date: Thu, 15 Sep 2011 12:32:19 -0700
Subject: [PATCH 009/209] Bug 676711 - Tab thumbnail should be updated
 everytime the page is reloaded. r=mfinkle

This is preventing situations where a page shows an error message and when
reloading, the correct content is shown but the thumbnail still shows the
previous error message.
---
 mobile/chrome/content/browser.js | 30 +++++++++++++++++++-----------
 1 file changed, 19 insertions(+), 11 deletions(-)

diff --git a/mobile/chrome/content/browser.js b/mobile/chrome/content/browser.js
index d63567929221..0cd41b526107 100644
--- a/mobile/chrome/content/browser.js
+++ b/mobile/chrome/content/browser.js
@@ -1625,8 +1625,6 @@ Browser.WebProgress.prototype = {
       }
 
       aTab.scrolledAreaChanged(true);
-      aTab.updateThumbnail();
-
       aTab.updateContentCapture();
     });
   }
@@ -2731,6 +2729,9 @@ function Tab(aURI, aParams) {
 
   // default tabs to inactive (i.e. no display port)
   this.active = false;
+
+  // Whether the tab thumbnail has been delayed to wait for the first paint.
+  this._delayedThumbnail = false;
 }
 
 Tab.prototype = {
@@ -2843,9 +2844,22 @@ Tab.prototype = {
   endLoading: function endLoading() {
     if (!this._loading) throw "Not Loading!";
     this._loading = false;
-    if (this._drawThumb) {
-      this._drawThumb = false;
-      this.updateThumbnail();
+
+    if (!this._delayedThumbnail) {
+      if (this._firstPaint) {
+        this.updateThumbnail();
+      } else {
+        let browser = this._browser;
+        let self = this;
+
+        this._delayedThumbnail = true;
+
+        browser.messageManager.addMessageListener("Browser:FirstPaint", function (aMessage) {
+          browser.messageManager.removeMessageListener(aMessage.name, arguments.callee);
+          self.updateThumbnail();
+          self._delayedThumbnail = false;
+        });
+      }
     }
   },
 
@@ -3066,12 +3080,6 @@ Tab.prototype = {
   updateThumbnail: function updateThumbnail(options) {
     let options = options || {};
     let browser = this._browser;
-
-    if (this._loading) {
-      this._drawThumb = true;
-      return;
-    }
-
     let forceUpdate = ("force" in options && options.force);
 
     // Do not repaint thumbnail if we already painted for this load. Bad things

From bf6cfb1ea1e3df8eaf1d1372ce773c2910d7da59 Mon Sep 17 00:00:00 2001
From: Ehsan Akhgari <ehsan@mozilla.com>
Date: Thu, 15 Sep 2011 15:32:42 -0400
Subject: [PATCH 010/209] Bug 681229 - Sanitize the platform linebreaks to DOM
 linebreaks when pasting or drag-dropping text into text controls; r=roc

---
 .../text/nsPlaintextDataTransfer.cpp          |  5 ++
 editor/libeditor/text/tests/Makefile.in       |  1 +
 .../libeditor/text/tests/test_bug681229.html  | 49 +++++++++++++++++++
 .../specialpowers/content/specialpowers.js    |  6 +++
 4 files changed, 61 insertions(+)
 create mode 100644 editor/libeditor/text/tests/test_bug681229.html

diff --git a/editor/libeditor/text/nsPlaintextDataTransfer.cpp b/editor/libeditor/text/nsPlaintextDataTransfer.cpp
index 0b6c79564d6d..209c08f575a0 100644
--- a/editor/libeditor/text/nsPlaintextDataTransfer.cpp
+++ b/editor/libeditor/text/nsPlaintextDataTransfer.cpp
@@ -68,6 +68,7 @@
 #include "nsISelectionPrivate.h"
 #include "nsFrameSelection.h"
 #include "nsEventDispatcher.h"
+#include "nsContentUtils.h"
 
 NS_IMETHODIMP nsPlaintextEditor::PrepareTransferable(nsITransferable **transferable)
 {
@@ -136,6 +137,10 @@ NS_IMETHODIMP nsPlaintextEditor::InsertTextFromTransferable(nsITransferable *aTr
       nsAutoString stuffToPaste;
       textDataObj->GetData(stuffToPaste);
       NS_ASSERTION(stuffToPaste.Length() <= (len/2), "Invalid length!");
+
+      // Sanitize possible carriage returns in the string to be inserted
+      nsContentUtils::PlatformToDOMLineBreaks(stuffToPaste);
+
       nsAutoEditBatch beginBatching(this);
       rv = InsertTextAt(stuffToPaste, aDestinationNode, aDestOffset, aDoDeleteSelection);
     }
diff --git a/editor/libeditor/text/tests/Makefile.in b/editor/libeditor/text/tests/Makefile.in
index 4572909aac55..ac9980328c26 100644
--- a/editor/libeditor/text/tests/Makefile.in
+++ b/editor/libeditor/text/tests/Makefile.in
@@ -63,6 +63,7 @@ _TEST_FILES = \
 		test_bug638596.html \
 		test_bug641466.html \
 		test_bug645914.html \
+		test_bug681229.html \
 		$(NULL)
 
 # disables the key handling test on gtk2 because gtk2 overrides some key events
diff --git a/editor/libeditor/text/tests/test_bug681229.html b/editor/libeditor/text/tests/test_bug681229.html
new file mode 100644
index 000000000000..5e91c2237c6d
--- /dev/null
+++ b/editor/libeditor/text/tests/test_bug681229.html
@@ -0,0 +1,49 @@
+<!DOCTYPE HTML>
+<html>
+<!--
+https://bugzilla.mozilla.org/show_bug.cgi?id=681229
+-->
+<head>
+  <title>Test for Bug 681229</title>
+  <script type="application/javascript" src="/tests/SimpleTest/SimpleTest.js"></script>
+  <script type="text/javascript" src="/tests/SimpleTest/EventUtils.js"></script>
+  <script type="text/javascript" src="/tests/SimpleTest/WindowSnapshot.js"></script>
+  <link rel="stylesheet" type="text/css" href="/tests/SimpleTest/test.css"/>
+</head>
+<body>
+<a target="_blank" href="https://bugzilla.mozilla.org/show_bug.cgi?id=681229">Mozilla Bug 681229</a>
+<p id="display"></p>
+<div id="content">
+<textarea spellcheck="false"></textarea>
+</div>
+<pre id="test">
+<script type="application/javascript">
+
+/** Test for Bug 681229 **/
+
+SimpleTest.waitForExplicitFinish();
+SimpleTest.waitForFocus(function() {
+  var t = document.querySelector("textarea");
+  t.focus();
+
+  const kValue = "a\r\nb";
+
+  SimpleTest.waitForClipboard(kValue,
+    function() {
+      SpecialPowers.copyString(kValue);
+    },
+    function() {
+      synthesizeKey("V", {accelKey: true});
+      is(t.value, "a\nb", "The carriage return has been correctly sanitized");
+      SimpleTest.finish();
+    },
+    function() {
+      SimpleTest.finish();
+    }
+  );
+});
+
+</script>
+</pre>
+</body>
+</html>
diff --git a/testing/mochitest/specialpowers/content/specialpowers.js b/testing/mochitest/specialpowers/content/specialpowers.js
index 01f114b4ed0d..d49685c79101 100644
--- a/testing/mochitest/specialpowers/content/specialpowers.js
+++ b/testing/mochitest/specialpowers/content/specialpowers.js
@@ -407,6 +407,12 @@ SpecialPowers.prototype = {
       getService(Components.interfaces.nsICategoryManager).
       addCategoryEntry(category, entry, value, persists, replace);
   },
+
+  copyString: function(str) {
+    Cc["@mozilla.org/widget/clipboardhelper;1"].
+      getService(Ci.nsIClipboardHelper).
+      copyString(str);
+  },
 };
 
 // Expose everything but internal APIs (starting with underscores) to

From 7d425d34ecb73179c67cd7e77d23317de4974a84 Mon Sep 17 00:00:00 2001
From: Ehsan Akhgari <ehsan@mozilla.com>
Date: Thu, 15 Sep 2011 15:48:48 -0400
Subject: [PATCH 011/209] Bug 98160 - Part 2: Add some notes about the
 licensing of the code used from Chromium DONTBUILD

---
 toolkit/content/license.html | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/toolkit/content/license.html b/toolkit/content/license.html
index 77128672c8bc..4fbe0aace810 100644
--- a/toolkit/content/license.html
+++ b/toolkit/content/license.html
@@ -2218,7 +2218,9 @@ WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
 
     <h1><a name="chromium"></a>Chromium License</h1>
 
-    <p>This license applies to some files in the directories
+    <p>This license applies to parts of the code in
+      <span class="path">editor/libeditor/base/nsEditorEventListener.cpp</span>
+      and also some files in the directories
       <span class="path">ipc/chromium/</span>,
       <span class="path">dom/plugins/</span>,
       <span class="path">gfx/ots/</span> and

From 20408399edb12cbe7eff3b5b3247d58162ba965d Mon Sep 17 00:00:00 2001
From: Lucas Rocha <lucasr@mozilla.com>
Date: Thu, 15 Sep 2011 21:33:20 +0100
Subject: [PATCH 012/209] Bug 682291 / Bug 682406 - Update button with number
 of tabs on TabOpen/TabRemove events (r=mfinkle)

---
 mobile/chrome/content/TabsPopup.js  | 16 ++++++++++++++++
 mobile/chrome/content/browser-ui.js |  3 +++
 mobile/chrome/content/browser.js    |  6 ------
 3 files changed, 19 insertions(+), 6 deletions(-)

diff --git a/mobile/chrome/content/TabsPopup.js b/mobile/chrome/content/TabsPopup.js
index ef4cb04e5a13..82a99589c6c5 100644
--- a/mobile/chrome/content/TabsPopup.js
+++ b/mobile/chrome/content/TabsPopup.js
@@ -36,6 +36,13 @@
  * ***** END LICENSE BLOCK ***** */
 
 var TabsPopup = {
+  init: function() {
+    Elements.tabs.addEventListener("TabOpen", this, true);
+    Elements.tabs.addEventListener("TabRemove", this, true);
+
+    this._updateTabsCount();
+  },
+
   get box() {
     delete this.box;
     return this.box = document.getElementById("tabs-sidebar");
@@ -68,5 +75,14 @@ var TabsPopup = {
       this.hide();
     else
       this.show();
+  },
+
+  _updateTabsCount: function() {
+    let cmd = document.getElementById("cmd_showTabs");
+    cmd.setAttribute("label", Browser.tabs.length);
+  },
+
+  handleEvent: function handleEvent(aEvent) {
+    this._updateTabsCount();
   }
 };
diff --git a/mobile/chrome/content/browser-ui.js b/mobile/chrome/content/browser-ui.js
index 8f8b339ac32f..67216ad76ed3 100644
--- a/mobile/chrome/content/browser-ui.js
+++ b/mobile/chrome/content/browser-ui.js
@@ -431,6 +431,9 @@ var BrowserUI = {
     // listening AppCommand to handle special keys
     window.addEventListener("AppCommand", this, true);
 
+    // Initialize the number of tabs in toolbar
+    TabsPopup.init();
+
     // We can delay some initialization until after startup.  We wait until
     // the first page is shown, then dispatch a UIReadyDelayed event.
     messageManager.addMessageListener("pageshow", function() {
diff --git a/mobile/chrome/content/browser.js b/mobile/chrome/content/browser.js
index 0cd41b526107..a1303e605915 100644
--- a/mobile/chrome/content/browser.js
+++ b/mobile/chrome/content/browser.js
@@ -731,9 +731,6 @@ var Browser = {
     newTab.chromeTab.dispatchEvent(event);
     newTab.browser.messageManager.sendAsyncMessage("Browser:TabOpen");
 
-    let cmd = document.getElementById("cmd_showTabs");
-    cmd.setAttribute("label", this._tabs.length - 1);
-
     return newTab;
   },
 
@@ -748,9 +745,6 @@ var Browser = {
     }
 
     tab.browser.messageManager.sendAsyncMessage("Browser:CanUnload", {});
-
-    let cmd = document.getElementById("cmd_showTabs");
-    cmd.setAttribute("label", this._tabs.length - 1);
   },
 
   _doCloseTab: function _doCloseTab(aTab) {

From 2bdc61ebc83700028bf430322b113e0d975a65a4 Mon Sep 17 00:00:00 2001
From: Lucas Rocha <lucasr@mozilla.com>
Date: Thu, 15 Sep 2011 21:33:20 +0100
Subject: [PATCH 013/209] Bug 681944 - Remove "empty" attribute from the
 thumbnails of restored tabs (r=mfinkle)

Once tabs are restored and their thumbnails are loaded from session data, the canvas should not be marked as empty anymore.
---
 mobile/components/SessionStore.js | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/mobile/components/SessionStore.js b/mobile/components/SessionStore.js
index 7ebff9e64053..115d80aee066 100644
--- a/mobile/components/SessionStore.js
+++ b/mobile/components/SessionStore.js
@@ -790,8 +790,10 @@ SessionStore.prototype = {
   
             let image = new window.Image();
             image.onload = function() {
-              if (canvas)
+              if (canvas) {
                 canvas.getContext("2d").drawImage(image, 0, 0);
+                canvas.removeAttribute("empty");
+              }
             };
             image.src = tabData.extData.thumbnail;
           }

From d0f5d02a7e2689540708ed828ab2c255f3c06ca8 Mon Sep 17 00:00:00 2001
From: Ehsan Akhgari <ehsan@mozilla.com>
Date: Thu, 15 Sep 2011 17:43:24 -0400
Subject: [PATCH 014/209] Backout changeset c0e8e3ada0ac (bug 681229) because
 the test fails on Windows

---
 .../text/nsPlaintextDataTransfer.cpp          |  5 --
 editor/libeditor/text/tests/Makefile.in       |  1 -
 .../libeditor/text/tests/test_bug681229.html  | 49 -------------------
 .../specialpowers/content/specialpowers.js    |  6 ---
 4 files changed, 61 deletions(-)
 delete mode 100644 editor/libeditor/text/tests/test_bug681229.html

diff --git a/editor/libeditor/text/nsPlaintextDataTransfer.cpp b/editor/libeditor/text/nsPlaintextDataTransfer.cpp
index 209c08f575a0..0b6c79564d6d 100644
--- a/editor/libeditor/text/nsPlaintextDataTransfer.cpp
+++ b/editor/libeditor/text/nsPlaintextDataTransfer.cpp
@@ -68,7 +68,6 @@
 #include "nsISelectionPrivate.h"
 #include "nsFrameSelection.h"
 #include "nsEventDispatcher.h"
-#include "nsContentUtils.h"
 
 NS_IMETHODIMP nsPlaintextEditor::PrepareTransferable(nsITransferable **transferable)
 {
@@ -137,10 +136,6 @@ NS_IMETHODIMP nsPlaintextEditor::InsertTextFromTransferable(nsITransferable *aTr
       nsAutoString stuffToPaste;
       textDataObj->GetData(stuffToPaste);
       NS_ASSERTION(stuffToPaste.Length() <= (len/2), "Invalid length!");
-
-      // Sanitize possible carriage returns in the string to be inserted
-      nsContentUtils::PlatformToDOMLineBreaks(stuffToPaste);
-
       nsAutoEditBatch beginBatching(this);
       rv = InsertTextAt(stuffToPaste, aDestinationNode, aDestOffset, aDoDeleteSelection);
     }
diff --git a/editor/libeditor/text/tests/Makefile.in b/editor/libeditor/text/tests/Makefile.in
index ac9980328c26..4572909aac55 100644
--- a/editor/libeditor/text/tests/Makefile.in
+++ b/editor/libeditor/text/tests/Makefile.in
@@ -63,7 +63,6 @@ _TEST_FILES = \
 		test_bug638596.html \
 		test_bug641466.html \
 		test_bug645914.html \
-		test_bug681229.html \
 		$(NULL)
 
 # disables the key handling test on gtk2 because gtk2 overrides some key events
diff --git a/editor/libeditor/text/tests/test_bug681229.html b/editor/libeditor/text/tests/test_bug681229.html
deleted file mode 100644
index 5e91c2237c6d..000000000000
--- a/editor/libeditor/text/tests/test_bug681229.html
+++ /dev/null
@@ -1,49 +0,0 @@
-<!DOCTYPE HTML>
-<html>
-<!--
-https://bugzilla.mozilla.org/show_bug.cgi?id=681229
--->
-<head>
-  <title>Test for Bug 681229</title>
-  <script type="application/javascript" src="/tests/SimpleTest/SimpleTest.js"></script>
-  <script type="text/javascript" src="/tests/SimpleTest/EventUtils.js"></script>
-  <script type="text/javascript" src="/tests/SimpleTest/WindowSnapshot.js"></script>
-  <link rel="stylesheet" type="text/css" href="/tests/SimpleTest/test.css"/>
-</head>
-<body>
-<a target="_blank" href="https://bugzilla.mozilla.org/show_bug.cgi?id=681229">Mozilla Bug 681229</a>
-<p id="display"></p>
-<div id="content">
-<textarea spellcheck="false"></textarea>
-</div>
-<pre id="test">
-<script type="application/javascript">
-
-/** Test for Bug 681229 **/
-
-SimpleTest.waitForExplicitFinish();
-SimpleTest.waitForFocus(function() {
-  var t = document.querySelector("textarea");
-  t.focus();
-
-  const kValue = "a\r\nb";
-
-  SimpleTest.waitForClipboard(kValue,
-    function() {
-      SpecialPowers.copyString(kValue);
-    },
-    function() {
-      synthesizeKey("V", {accelKey: true});
-      is(t.value, "a\nb", "The carriage return has been correctly sanitized");
-      SimpleTest.finish();
-    },
-    function() {
-      SimpleTest.finish();
-    }
-  );
-});
-
-</script>
-</pre>
-</body>
-</html>
diff --git a/testing/mochitest/specialpowers/content/specialpowers.js b/testing/mochitest/specialpowers/content/specialpowers.js
index d49685c79101..01f114b4ed0d 100644
--- a/testing/mochitest/specialpowers/content/specialpowers.js
+++ b/testing/mochitest/specialpowers/content/specialpowers.js
@@ -407,12 +407,6 @@ SpecialPowers.prototype = {
       getService(Components.interfaces.nsICategoryManager).
       addCategoryEntry(category, entry, value, persists, replace);
   },
-
-  copyString: function(str) {
-    Cc["@mozilla.org/widget/clipboardhelper;1"].
-      getService(Ci.nsIClipboardHelper).
-      copyString(str);
-  },
 };
 
 // Expose everything but internal APIs (starting with underscores) to

From 1cd9f699e83f50eabfba267880039a2119a8e011 Mon Sep 17 00:00:00 2001
From: Daniel Holbert <dholbert@cs.stanford.edu>
Date: Thu, 15 Sep 2011 15:42:55 -0700
Subject: [PATCH 015/209] Bug 665392: Make <animateMotion>'s transform apply on
 top of the "transform" attribute, instead of the other way around. r=roc

---
 .../svg/content/src/nsSVGGraphicElement.cpp   | 14 ++++-----
 .../smil/motion/animateMotion-rotate-3.svg    | 30 +++++++++++++++++++
 layout/reftests/svg/smil/motion/reftest.list  |  1 +
 3 files changed, 38 insertions(+), 7 deletions(-)
 create mode 100644 layout/reftests/svg/smil/motion/animateMotion-rotate-3.svg

diff --git a/content/svg/content/src/nsSVGGraphicElement.cpp b/content/svg/content/src/nsSVGGraphicElement.cpp
index ae4d95b3a183..ba4c9a580817 100644
--- a/content/svg/content/src/nsSVGGraphicElement.cpp
+++ b/content/svg/content/src/nsSVGGraphicElement.cpp
@@ -189,13 +189,6 @@ nsSVGGraphicElement::PrependLocalTransformTo(const gfxMatrix &aMatrix) const
 {
   gfxMatrix result(aMatrix);
 
-  // animateMotion's resulting transform is supposed to apply *on top of*
-  // any transformations from the |transform| attribute. So since we're
-  // PRE-multiplying, we need to apply the animateMotion transform *first*.
-  if (mAnimateMotionTransform) {
-    result.PreMultiply(*mAnimateMotionTransform);
-  }
-
   if (mTransforms) {
     nsresult rv;
     nsCOMPtr<nsIDOMSVGTransformList> transforms;
@@ -210,6 +203,13 @@ nsSVGGraphicElement::PrependLocalTransformTo(const gfxMatrix &aMatrix) const
     }
   }
 
+  // <animateMotion>'s transformation is *supplemental* to the |transform|
+  // attribute and any transformations on ancestors.  So, we apply it
+  // (pre-multiply it) last.
+  if (mAnimateMotionTransform) {
+    result.PreMultiply(*mAnimateMotionTransform);
+  }
+
   return result;
 }
 
diff --git a/layout/reftests/svg/smil/motion/animateMotion-rotate-3.svg b/layout/reftests/svg/smil/motion/animateMotion-rotate-3.svg
new file mode 100644
index 000000000000..ad5d31cba2ff
--- /dev/null
+++ b/layout/reftests/svg/smil/motion/animateMotion-rotate-3.svg
@@ -0,0 +1,30 @@
+<svg xmlns="http://www.w3.org/2000/svg"
+     xmlns:xlink="http://www.w3.org/1999/xlink"
+     class="reftest-wait">
+  <!-- Tests for "rotate" interacting with the transform attribute. -->
+  <script xlink:href="../smil-util.js" type="text/javascript"/>
+  <script type="text/javascript">
+    function doTest() {
+      setTimeAndSnapshot(1, false);
+    }
+    window.addEventListener("MozReftestInvalidate", doTest, false);
+  </script>
+
+  <!-- Big green background to match lime.svg -->
+  <rect height="100%" width="100%" fill="lime"/>
+
+  <!-- A "shadow" rect (should be covered up by green rect). The only difference
+       between this rect and the other one is that this rect has the
+       |transform| attr set on its <g> parent instead of on it directly. -->
+  <g transform="translate(0, 50)">
+    <rect width="50" height="50" fill="red">
+     <animateMotion begin="0s" dur="1s" fill="freeze" rotate="90"
+                    path="M50 0 h50"/>
+    </rect>
+  </g>
+
+  <rect width="50" height="50" fill="lime" transform="translate(0, 50)">
+    <animateMotion begin="0s" dur="1s" fill="freeze" rotate="90"
+                   path="M50 0 h50"/>
+  </rect>
+</svg>
diff --git a/layout/reftests/svg/smil/motion/reftest.list b/layout/reftests/svg/smil/motion/reftest.list
index b9ca38d62ad4..66f25c495a48 100644
--- a/layout/reftests/svg/smil/motion/reftest.list
+++ b/layout/reftests/svg/smil/motion/reftest.list
@@ -8,6 +8,7 @@
 == animateMotion-rotate-1a.svg lime.svg
 == animateMotion-rotate-1b.svg lime.svg
 == animateMotion-rotate-2.svg  lime.svg
+== animateMotion-rotate-3.svg  lime.svg
 == animateMotion-to-overridden-1.svg lime.svg
 == animateMotion-values-linear-1.svg animateMotion-values-linear-1-ref.svg
 == animateMotion-values-paced-1a.svg animateMotion-values-paced-1-ref.svg

From a2513619c907c226c233b3aab82361be98d98d74 Mon Sep 17 00:00:00 2001
From: Daniel Holbert <dholbert@cs.stanford.edu>
Date: Thu, 15 Sep 2011 15:42:57 -0700
Subject: [PATCH 016/209] Bug 686044: Hold temporary reference to |this| inside
 DOMSVGPathSegList::InternalListWillChange whenever we're nonempty. r=jwatt

---
 content/svg/content/src/DOMSVGPathSegList.cpp | 13 ++++++++++++-
 1 file changed, 12 insertions(+), 1 deletion(-)

diff --git a/content/svg/content/src/DOMSVGPathSegList.cpp b/content/svg/content/src/DOMSVGPathSegList.cpp
index 429529aead8f..686a47c1355c 100644
--- a/content/svg/content/src/DOMSVGPathSegList.cpp
+++ b/content/svg/content/src/DOMSVGPathSegList.cpp
@@ -156,9 +156,20 @@ DOMSVGPathSegList::InternalListWillChangeTo(const SVGPathData& aNewValue)
   PRUint32 newSegType;
 
   nsRefPtr<DOMSVGPathSegList> kungFuDeathGrip;
-  if (aNewValue.Length() < length) {
+  if (length) {
     // RemovingFromList() might clear last reference to |this|.
     // Retain a temporary reference to keep from dying before returning.
+    //
+    // NOTE: For path-seg lists (unlike other list types), we have to do this
+    // *whenever our list is nonempty* (even if we're growing in length).
+    // That's because the path-seg-type of any segment could differ between old
+    // list vs. new list, which will make us destroy & recreate that segment,
+    // which could remove the last reference to us.
+    //
+    // (We explicitly *don't* want to create a kungFuDeathGrip in the length=0
+    // case, though, because we do hit this code inside our constructor before
+    // any other owning references have been added, and at that point, the
+    // deathgrip-removal would make us die before we exit our constructor.)
     kungFuDeathGrip = this;
   }
 

From e96d878fa98d3f7fc4de0ba03fb6f28265e19ab6 Mon Sep 17 00:00:00 2001
From: Jeff Walden <jwalden@mit.edu>
Date: Wed, 10 Aug 2011 14:54:52 -0700
Subject: [PATCH 017/209] Bug 686582 - Begin to specialize
 ObjectOps::getElement to not just delegate to ObjectOps::getProperty. 
 r=dvander

--HG--
extra : rebase_source : 3f9228a3fe7ff9ee817ddfbdb7a783d3a3093dec
---
 js/src/jsarray.cpp      | 30 +++++++++++++++++++++++++++++-
 js/src/jsobj.cpp        | 11 +++++++++++
 js/src/jsobj.h          |  9 +++++++++
 js/src/jstypedarray.cpp | 34 ++++++++++++++++++++++++++++++----
 4 files changed, 79 insertions(+), 5 deletions(-)

diff --git a/js/src/jsarray.cpp b/js/src/jsarray.cpp
index 3d61b8e41174..cd3e58c43df0 100644
--- a/js/src/jsarray.cpp
+++ b/js/src/jsarray.cpp
@@ -822,10 +822,38 @@ array_getProperty(JSContext *cx, JSObject *obj, JSObject *receiver, jsid id, Val
 static JSBool
 array_getElement(JSContext *cx, JSObject *obj, JSObject *receiver, uint32 index, Value *vp)
 {
+    if (!obj->isDenseArray())
+        return js_GetElement(cx, obj, index, vp);
+
+    if (index < obj->getDenseArrayCapacity() &&
+        !obj->getDenseArrayElement(index).isMagic(JS_ARRAY_HOLE))
+    {
+        *vp = obj->getDenseArrayElement(index);
+        return true;
+    }
+
+    JSObject *proto = obj->getProto();
+    if (!proto) {
+        vp->setUndefined();
+        return true;
+    }
+
+    vp->setUndefined();
+
     jsid id;
     if (!IndexToId(cx, index, &id))
         return false;
-    return array_getProperty(cx, obj, receiver, id, vp);
+
+    JSObject *obj2;
+    JSProperty *prop;
+    if (!LookupPropertyWithFlags(cx, proto, id, cx->resolveFlags, &obj2, &prop))
+        return false;
+
+    if (!prop || !obj2->isNative())
+        return true;
+
+    const Shape *shape = (const Shape *) prop;
+    return js_NativeGet(cx, obj, obj2, shape, JSGET_METHOD_BARRIER, vp);
 }
 
 static JSBool
diff --git a/js/src/jsobj.cpp b/js/src/jsobj.cpp
index 286364b13935..f6bade8a6b32 100644
--- a/js/src/jsobj.cpp
+++ b/js/src/jsobj.cpp
@@ -5877,6 +5877,17 @@ js_GetProperty(JSContext *cx, JSObject *obj, JSObject *receiver, jsid id, Value
     return js_GetPropertyHelperInline(cx, obj, receiver, id, JSGET_METHOD_BARRIER, vp);
 }
 
+JSBool
+js_GetElement(JSContext *cx, JSObject *obj, JSObject *receiver, uint32 index, Value *vp)
+{
+    jsid id;
+    if (!IndexToId(cx, index, &id))
+        return false;
+
+    /* This call site is hot -- use the always-inlined variant of js_GetPropertyHelper(). */
+    return js_GetPropertyHelperInline(cx, obj, receiver, id, JSGET_METHOD_BARRIER, vp);
+}
+
 JSBool
 js::GetPropertyDefault(JSContext *cx, JSObject *obj, jsid id, const Value &def, Value *vp)
 {
diff --git a/js/src/jsobj.h b/js/src/jsobj.h
index 5ab910141328..783ff312f735 100644
--- a/js/src/jsobj.h
+++ b/js/src/jsobj.h
@@ -257,12 +257,21 @@ js_DefineProperty(JSContext *cx, JSObject *obj, jsid id, const js::Value *value,
 extern JSBool
 js_GetProperty(JSContext *cx, JSObject *obj, JSObject *receiver, jsid id, js::Value *vp);
 
+extern JSBool
+js_GetElement(JSContext *cx, JSObject *obj, JSObject *receiver, uint32, js::Value *vp);
+
 inline JSBool
 js_GetProperty(JSContext *cx, JSObject *obj, jsid id, js::Value *vp)
 {
     return js_GetProperty(cx, obj, obj, id, vp);
 }
 
+inline JSBool
+js_GetElement(JSContext *cx, JSObject *obj, uint32 index, js::Value *vp)
+{
+    return js_GetElement(cx, obj, obj, index, vp);
+}
+
 namespace js {
 
 extern JSBool
diff --git a/js/src/jstypedarray.cpp b/js/src/jstypedarray.cpp
index 5226ef2d8d5f..46c89d6da4c6 100644
--- a/js/src/jstypedarray.cpp
+++ b/js/src/jstypedarray.cpp
@@ -351,10 +351,10 @@ ArrayBuffer::obj_getProperty(JSContext *cx, JSObject *obj, JSObject *receiver, j
 JSBool
 ArrayBuffer::obj_getElement(JSContext *cx, JSObject *obj, JSObject *receiver, uint32 index, Value *vp)
 {
-    jsid id;
-    if (!IndexToId(cx, index, &id))
+    JSObject *delegate = DelegateObject(cx, getArrayBuffer(obj));
+    if (!delegate)
         return false;
-    return obj_getProperty(cx, obj, receiver, id, vp);
+    return js_GetElement(cx, delegate, receiver, index, vp);
 }
 
 JSBool
@@ -908,10 +908,36 @@ class TypedArrayTemplate
     static JSBool
     obj_getElement(JSContext *cx, JSObject *obj, JSObject *receiver, uint32 index, Value *vp)
     {
+        JSObject *tarray = getTypedArray(obj);
+
+        if (index < getLength(tarray)) {
+            // this inline function is specialized for each type
+            copyIndexToValue(cx, tarray, index, vp);
+            return true;
+        }
+
+        JSObject *proto = obj->getProto();
+        if (!proto) {
+            vp->setUndefined();
+            return true;
+        }
+
+        vp->setUndefined();
+
         jsid id;
         if (!IndexToId(cx, index, &id))
             return false;
-        return obj_getProperty(cx, obj, receiver, id, vp);
+
+        JSObject *obj2;
+        JSProperty *prop;
+        if (!LookupPropertyWithFlags(cx, proto, id, cx->resolveFlags, &obj2, &prop))
+            return false;
+
+        if (!prop || !obj2->isNative())
+            return true;
+
+        const Shape *shape = (Shape *) prop;
+        return js_NativeGet(cx, obj, obj2, shape, JSGET_METHOD_BARRIER, vp);
     }
 
     static JSBool

From a237a27a2048caac83cb873f90c4c34de961264c Mon Sep 17 00:00:00 2001
From: Jeff Walden <jwalden@mit.edu>
Date: Wed, 10 Aug 2011 14:54:52 -0700
Subject: [PATCH 018/209] Bug 686582 - Begin to specialize
 ObjectOps::getElementAttributes to not just delegate to
 ObjectOps::getAttributes.  r=dvander

--HG--
extra : rebase_source : a3767fed5456d13c5ee5b6a8617fa22e064c758c
---
 js/src/jsarray.cpp      |  6 ++----
 js/src/jsobj.cpp        | 18 ++++++++++++++++++
 js/src/jsobj.h          |  8 +++++++-
 js/src/jsobjinlines.h   |  9 ---------
 js/src/jstypedarray.cpp | 12 +++++-------
 5 files changed, 32 insertions(+), 21 deletions(-)

diff --git a/js/src/jsarray.cpp b/js/src/jsarray.cpp
index cd3e58c43df0..1bebe34b7692 100644
--- a/js/src/jsarray.cpp
+++ b/js/src/jsarray.cpp
@@ -1004,10 +1004,8 @@ array_getAttributes(JSContext *cx, JSObject *obj, jsid id, uintN *attrsp)
 static JSBool
 array_getElementAttributes(JSContext *cx, JSObject *obj, uint32 index, uintN *attrsp)
 {
-    jsid id;
-    if (!IndexToId(cx, index, &id))
-        return false;
-    return array_getAttributes(cx, obj, id, attrsp);
+    *attrsp = JSPROP_ENUMERATE;
+    return true;
 }
 
 static JSBool
diff --git a/js/src/jsobj.cpp b/js/src/jsobj.cpp
index f6bade8a6b32..302becf54296 100644
--- a/js/src/jsobj.cpp
+++ b/js/src/jsobj.cpp
@@ -6266,6 +6266,24 @@ js_GetAttributes(JSContext *cx, JSObject *obj, jsid id, uintN *attrsp)
     return true;
 }
 
+JSBool
+js_GetElementAttributes(JSContext *cx, JSObject *obj, uint32 index, uintN *attrsp)
+{
+    JSProperty *prop;
+    if (!js_LookupElement(cx, obj, index, &obj, &prop))
+        return false;
+    if (!prop) {
+        *attrsp = 0;
+        return true;
+    }
+    if (!obj->isNative())
+        return obj->getElementAttributes(cx, index, attrsp);
+
+    const Shape *shape = (Shape *)prop;
+    *attrsp = shape->attributes();
+    return true;
+}
+
 JSBool
 js_SetNativeAttributes(JSContext *cx, JSObject *obj, Shape *shape, uintN attrs)
 {
diff --git a/js/src/jsobj.h b/js/src/jsobj.h
index 783ff312f735..820a3d99ac73 100644
--- a/js/src/jsobj.h
+++ b/js/src/jsobj.h
@@ -286,6 +286,9 @@ js_SetPropertyHelper(JSContext *cx, JSObject *obj, jsid id, uintN defineHow,
 extern JSBool
 js_GetAttributes(JSContext *cx, JSObject *obj, jsid id, uintN *attrsp);
 
+extern JSBool
+js_GetElementAttributes(JSContext *cx, JSObject *obj, uint32 index, uintN *attrsp);
+
 extern JSBool
 js_SetAttributes(JSContext *cx, JSObject *obj, jsid id, uintN *attrsp);
 
@@ -1426,7 +1429,10 @@ struct JSObject : js::gc::Cell {
         return (op ? op : js_GetAttributes)(cx, this, id, attrsp);
     }
 
-    inline JSBool getElementAttributes(JSContext *cx, uint32 index, uintN *attrsp);
+    JSBool getElementAttributes(JSContext *cx, uint32 index, uintN *attrsp) {
+        js::ElementAttributesOp op = getOps()->getElementAttributes;
+        return (op ? op : js_GetElementAttributes)(cx, this, index, attrsp);
+    }
 
     inline JSBool setAttributes(JSContext *cx, jsid id, uintN *attrsp);
 
diff --git a/js/src/jsobjinlines.h b/js/src/jsobjinlines.h
index 39a7db901b1c..bd42505277c5 100644
--- a/js/src/jsobjinlines.h
+++ b/js/src/jsobjinlines.h
@@ -1137,15 +1137,6 @@ JSObject::setElement(JSContext *cx, uint32 index, js::Value *vp, JSBool strict)
     return setProperty(cx, id, vp, strict);
 }
 
-inline JSBool
-JSObject::getElementAttributes(JSContext *cx, uint32 index, uintN *attrsp)
-{
-    jsid id;
-    if (!js::IndexToId(cx, index, &id))
-        return false;
-    return getAttributes(cx, id, attrsp);
-}
-
 inline JSBool
 JSObject::setElementAttributes(JSContext *cx, uint32 index, uintN *attrsp)
 {
diff --git a/js/src/jstypedarray.cpp b/js/src/jstypedarray.cpp
index 46c89d6da4c6..0d62cbd653a1 100644
--- a/js/src/jstypedarray.cpp
+++ b/js/src/jstypedarray.cpp
@@ -437,10 +437,10 @@ ArrayBuffer::obj_getAttributes(JSContext *cx, JSObject *obj, jsid id, uintN *att
 JSBool
 ArrayBuffer::obj_getElementAttributes(JSContext *cx, JSObject *obj, uint32 index, uintN *attrsp)
 {
-    jsid id;
-    if (!IndexToId(cx, index, &id))
+    JSObject *delegate = DelegateObject(cx, obj);
+    if (!delegate)
         return false;
-    return obj_getAttributes(cx, obj, id, attrsp);
+    return js_GetElementAttributes(cx, delegate, index, attrsp);
 }
 
 JSBool
@@ -660,10 +660,8 @@ TypedArray::obj_getAttributes(JSContext *cx, JSObject *obj, jsid id, uintN *attr
 JSBool
 TypedArray::obj_getElementAttributes(JSContext *cx, JSObject *obj, uint32 index, uintN *attrsp)
 {
-    jsid id;
-    if (!IndexToId(cx, index, &id))
-        return false;
-    return obj_getAttributes(cx, obj, id, attrsp);
+    *attrsp = JSPROP_PERMANENT | JSPROP_ENUMERATE;
+    return true;
 }
 
 JSBool

From 7c903ab2a66e4bdf8d7f8aad41aedf1a9f40b6b5 Mon Sep 17 00:00:00 2001
From: Jeff Walden <jwalden@mit.edu>
Date: Wed, 10 Aug 2011 14:54:52 -0700
Subject: [PATCH 019/209] Bug 686582 - Begin to specialize
 ObjectOps::setElementAttributes to not just delegate to
 ObjectOps::setAttributes.  r=dvander

--HG--
extra : rebase_source : fb8b2565831ba0f4457d5ae639ffa55117550445
---
 js/src/jsarray.cpp      | 11 ++++-------
 js/src/jsobj.cpp        | 13 +++++++++++++
 js/src/jsobj.h          |  8 +++++++-
 js/src/jsobjinlines.h   |  9 ---------
 js/src/jstypedarray.cpp | 15 ++++++---------
 5 files changed, 30 insertions(+), 26 deletions(-)

diff --git a/js/src/jsarray.cpp b/js/src/jsarray.cpp
index 1bebe34b7692..d04b40953e9a 100644
--- a/js/src/jsarray.cpp
+++ b/js/src/jsarray.cpp
@@ -1011,18 +1011,15 @@ array_getElementAttributes(JSContext *cx, JSObject *obj, uint32 index, uintN *at
 static JSBool
 array_setAttributes(JSContext *cx, JSObject *obj, jsid id, uintN *attrsp)
 {
-    JS_ReportErrorNumber(cx, js_GetErrorMessage, NULL,
-                         JSMSG_CANT_SET_ARRAY_ATTRS);
-    return JS_FALSE;
+    JS_ReportErrorNumber(cx, js_GetErrorMessage, NULL, JSMSG_CANT_SET_ARRAY_ATTRS);
+    return false;
 }
 
 static JSBool
 array_setElementAttributes(JSContext *cx, JSObject *obj, uint32 index, uintN *attrsp)
 {
-    jsid id;
-    if (!IndexToId(cx, index, &id))
-        return false;
-    return array_setAttributes(cx, obj, id, attrsp);
+    JS_ReportErrorNumber(cx, js_GetErrorMessage, NULL, JSMSG_CANT_SET_ARRAY_ATTRS);
+    return false;
 }
 
 namespace js {
diff --git a/js/src/jsobj.cpp b/js/src/jsobj.cpp
index 302becf54296..f24237ecb825 100644
--- a/js/src/jsobj.cpp
+++ b/js/src/jsobj.cpp
@@ -6305,6 +6305,19 @@ js_SetAttributes(JSContext *cx, JSObject *obj, jsid id, uintN *attrsp)
            : obj->setAttributes(cx, id, attrsp);
 }
 
+JSBool
+js_SetElementAttributes(JSContext *cx, JSObject *obj, uint32 index, uintN *attrsp)
+{
+    JSProperty *prop;
+    if (!js_LookupElement(cx, obj, index, &obj, &prop))
+        return false;
+    if (!prop)
+        return true;
+    return obj->isNative()
+           ? js_SetNativeAttributes(cx, obj, (Shape *) prop, *attrsp)
+           : obj->setElementAttributes(cx, index, attrsp);
+}
+
 JSBool
 js_DeleteProperty(JSContext *cx, JSObject *obj, jsid id, Value *rval, JSBool strict)
 {
diff --git a/js/src/jsobj.h b/js/src/jsobj.h
index 820a3d99ac73..0affabfd2b13 100644
--- a/js/src/jsobj.h
+++ b/js/src/jsobj.h
@@ -292,6 +292,9 @@ js_GetElementAttributes(JSContext *cx, JSObject *obj, uint32 index, uintN *attrs
 extern JSBool
 js_SetAttributes(JSContext *cx, JSObject *obj, jsid id, uintN *attrsp);
 
+extern JSBool
+js_SetElementAttributes(JSContext *cx, JSObject *obj, uint32 index, uintN *attrsp);
+
 extern JSBool
 js_DeleteProperty(JSContext *cx, JSObject *obj, jsid id, js::Value *rval, JSBool strict);
 
@@ -1436,7 +1439,10 @@ struct JSObject : js::gc::Cell {
 
     inline JSBool setAttributes(JSContext *cx, jsid id, uintN *attrsp);
 
-    inline JSBool setElementAttributes(JSContext *cx, uint32 index, uintN *attrsp);
+    JSBool setElementAttributes(JSContext *cx, uint32 index, uintN *attrsp) {
+        js::ElementAttributesOp op = getOps()->setElementAttributes;
+        return (op ? op : js_SetElementAttributes)(cx, this, index, attrsp);
+    }
 
     inline JSBool deleteProperty(JSContext *cx, jsid id, js::Value *rval, JSBool strict);
 
diff --git a/js/src/jsobjinlines.h b/js/src/jsobjinlines.h
index bd42505277c5..436adbb828db 100644
--- a/js/src/jsobjinlines.h
+++ b/js/src/jsobjinlines.h
@@ -1137,15 +1137,6 @@ JSObject::setElement(JSContext *cx, uint32 index, js::Value *vp, JSBool strict)
     return setProperty(cx, id, vp, strict);
 }
 
-inline JSBool
-JSObject::setElementAttributes(JSContext *cx, uint32 index, uintN *attrsp)
-{
-    jsid id;
-    if (!js::IndexToId(cx, index, &id))
-        return false;
-    return setAttributes(cx, id, attrsp);
-}
-
 inline JSBool
 JSObject::deleteElement(JSContext *cx, uint32 index, js::Value *rval, JSBool strict)
 {
diff --git a/js/src/jstypedarray.cpp b/js/src/jstypedarray.cpp
index 0d62cbd653a1..5701deece05c 100644
--- a/js/src/jstypedarray.cpp
+++ b/js/src/jstypedarray.cpp
@@ -461,10 +461,10 @@ ArrayBuffer::obj_setAttributes(JSContext *cx, JSObject *obj, jsid id, uintN *att
 JSBool
 ArrayBuffer::obj_setElementAttributes(JSContext *cx, JSObject *obj, uint32 index, uintN *attrsp)
 {
-    jsid id;
-    if (!IndexToId(cx, index, &id))
+    JSObject *delegate = DelegateObject(cx, obj);
+    if (!delegate)
         return false;
-    return obj_setAttributes(cx, obj, id, attrsp);
+    return js_SetElementAttributes(cx, delegate, index, attrsp);
 }
 
 JSBool
@@ -667,18 +667,15 @@ TypedArray::obj_getElementAttributes(JSContext *cx, JSObject *obj, uint32 index,
 JSBool
 TypedArray::obj_setAttributes(JSContext *cx, JSObject *obj, jsid id, uintN *attrsp)
 {
-    JS_ReportErrorNumber(cx, js_GetErrorMessage, NULL,
-                         JSMSG_CANT_SET_ARRAY_ATTRS);
+    JS_ReportErrorNumber(cx, js_GetErrorMessage, NULL, JSMSG_CANT_SET_ARRAY_ATTRS);
     return false;
 }
 
 JSBool
 TypedArray::obj_setElementAttributes(JSContext *cx, JSObject *obj, uint32 index, uintN *attrsp)
 {
-    jsid id;
-    if (!IndexToId(cx, index, &id))
-        return false;
-    return obj_setAttributes(cx, obj, id, attrsp);
+    JS_ReportErrorNumber(cx, js_GetErrorMessage, NULL, JSMSG_CANT_SET_ARRAY_ATTRS);
+    return false;
 }
 
 /* static */ int

From 4507218e6f1d9b9960260adf5f1c2a37e3bebc6d Mon Sep 17 00:00:00 2001
From: Jeff Walden <jwalden@mit.edu>
Date: Wed, 10 Aug 2011 14:54:52 -0700
Subject: [PATCH 020/209] Bug 686582 - Begin to specialize
 ObjectOps::deleteElement to not just delegate to ObjectOps::deleteProperty. 
 r=dvander

--HG--
extra : rebase_source : ea2bd6c2511e5be83fcb826b7d4b81b6d38260ce
---
 js/src/jsarray.cpp      | 19 ++++++++++++++-----
 js/src/jsiter.cpp       | 10 ++++++++++
 js/src/jsiter.h         |  3 +++
 js/src/jsobj.cpp        |  9 +++++++++
 js/src/jsobj.h          |  3 +++
 js/src/jstypedarray.cpp | 20 +++++++++++++-------
 js/src/jsxml.cpp        | 24 +++++++++++++++++++++---
 7 files changed, 73 insertions(+), 15 deletions(-)

diff --git a/js/src/jsarray.cpp b/js/src/jsarray.cpp
index d04b40953e9a..ab8e8e1b2b0f 100644
--- a/js/src/jsarray.cpp
+++ b/js/src/jsarray.cpp
@@ -1035,7 +1035,7 @@ array_deleteProperty(JSContext *cx, JSObject *obj, jsid id, Value *rval, JSBool
 
     if (JSID_IS_ATOM(id, cx->runtime->atomState.lengthAtom)) {
         rval->setBoolean(false);
-        return JS_TRUE;
+        return true;
     }
 
     if (js_IdIsIndex(id, &i) && i < obj->getDenseArrayInitializedLength()) {
@@ -1047,17 +1047,26 @@ array_deleteProperty(JSContext *cx, JSObject *obj, jsid id, Value *rval, JSBool
         return false;
 
     rval->setBoolean(true);
-    return JS_TRUE;
+    return true;
 }
 
 /* non-static for direct deletion of array elements within the engine */
 JSBool
 array_deleteElement(JSContext *cx, JSObject *obj, uint32 index, Value *rval, JSBool strict)
 {
-    jsid id;
-    if (!IndexToId(cx, index, &id))
+    if (!obj->isDenseArray())
+        return js_DeleteElement(cx, obj, index, rval, strict);
+
+    if (index < obj->getDenseArrayInitializedLength()) {
+        obj->markDenseArrayNotPacked(cx);
+        obj->setDenseArrayElement(index, MagicValue(JS_ARRAY_HOLE));
+    }
+
+    if (!js_SuppressDeletedElement(cx, obj, index))
         return false;
-    return array_deleteProperty(cx, obj, id, rval, strict);
+
+    rval->setBoolean(true);
+    return true;
 }
 
 } // namespace js
diff --git a/js/src/jsiter.cpp b/js/src/jsiter.cpp
index fb07658ef5cd..b5351c034aeb 100644
--- a/js/src/jsiter.cpp
+++ b/js/src/jsiter.cpp
@@ -920,6 +920,16 @@ js_SuppressDeletedProperty(JSContext *cx, JSObject *obj, jsid id)
     return SuppressDeletedPropertyHelper(cx, obj, SingleIdPredicate(id));
 }
 
+bool
+js_SuppressDeletedElement(JSContext *cx, JSObject *obj, uint32 index)
+{
+    jsid id;
+    if (!IndexToId(cx, index, &id))
+        return false;
+    JS_ASSERT(id == js_CheckForStringIndex(id));
+    return SuppressDeletedPropertyHelper(cx, obj, SingleIdPredicate(id));
+}
+
 class IndexRangePredicate {
     jsint begin, end;
 public:
diff --git a/js/src/jsiter.h b/js/src/jsiter.h
index 7939df660f3a..e24d350403ce 100644
--- a/js/src/jsiter.h
+++ b/js/src/jsiter.h
@@ -148,6 +148,9 @@ js_CloseIterator(JSContext *cx, JSObject *iterObj);
 bool
 js_SuppressDeletedProperty(JSContext *cx, JSObject *obj, jsid id);
 
+bool
+js_SuppressDeletedElement(JSContext *cx, JSObject *obj, uint32 index);
+
 bool
 js_SuppressDeletedIndexProperties(JSContext *cx, JSObject *obj, jsint begin, jsint end);
 
diff --git a/js/src/jsobj.cpp b/js/src/jsobj.cpp
index f24237ecb825..930f222513fc 100644
--- a/js/src/jsobj.cpp
+++ b/js/src/jsobj.cpp
@@ -6397,6 +6397,15 @@ js_DeleteProperty(JSContext *cx, JSObject *obj, jsid id, Value *rval, JSBool str
     return obj->removeProperty(cx, id) && js_SuppressDeletedProperty(cx, obj, id);
 }
 
+JSBool
+js_DeleteElement(JSContext *cx, JSObject *obj, uint32 index, Value *rval, JSBool strict)
+{
+    jsid id;
+    if (!IndexToId(cx, index, &id))
+        return false;
+    return js_DeleteProperty(cx, obj, id, rval, strict);
+}
+
 namespace js {
 
 bool
diff --git a/js/src/jsobj.h b/js/src/jsobj.h
index 0affabfd2b13..a4672f15092d 100644
--- a/js/src/jsobj.h
+++ b/js/src/jsobj.h
@@ -298,6 +298,9 @@ js_SetElementAttributes(JSContext *cx, JSObject *obj, uint32 index, uintN *attrs
 extern JSBool
 js_DeleteProperty(JSContext *cx, JSObject *obj, jsid id, js::Value *rval, JSBool strict);
 
+extern JSBool
+js_DeleteElement(JSContext *cx, JSObject *obj, uint32 index, js::Value *rval, JSBool strict);
+
 extern JS_FRIEND_API(JSBool)
 js_Enumerate(JSContext *cx, JSObject *obj, JSIterateOp enum_op,
              js::Value *statep, jsid *idp);
diff --git a/js/src/jstypedarray.cpp b/js/src/jstypedarray.cpp
index 5701deece05c..32d8e79196a4 100644
--- a/js/src/jstypedarray.cpp
+++ b/js/src/jstypedarray.cpp
@@ -484,10 +484,10 @@ ArrayBuffer::obj_deleteProperty(JSContext *cx, JSObject *obj, jsid id, Value *rv
 JSBool
 ArrayBuffer::obj_deleteElement(JSContext *cx, JSObject *obj, uint32 index, Value *rval, JSBool strict)
 {
-    jsid id;
-    if (!IndexToId(cx, index, &id))
+    JSObject *delegate = DelegateObject(cx, obj);
+    if (!delegate)
         return false;
-    return obj_deleteElement(cx, obj, index, rval, strict);
+    return js_DeleteElement(cx, delegate, index, rval, strict);
 }
 
 JSBool
@@ -1065,10 +1065,16 @@ class TypedArrayTemplate
     static JSBool
     obj_deleteElement(JSContext *cx, JSObject *obj, uint32 index, Value *rval, JSBool strict)
     {
-        jsid id;
-        if (!IndexToId(cx, index, &id))
-            return false;
-        return obj_deleteProperty(cx, obj, id, rval, strict);
+        JSObject *tarray = TypedArray::getTypedArray(obj);
+        JS_ASSERT(tarray);
+
+        if (index < getLength(tarray)) {
+            rval->setBoolean(false);
+            return true;
+        }
+
+        rval->setBoolean(true);
+        return true;
     }
 
     static JSBool
diff --git a/js/src/jsxml.cpp b/js/src/jsxml.cpp
index 7e3eaac7091d..1a36e364dcb5 100644
--- a/js/src/jsxml.cpp
+++ b/js/src/jsxml.cpp
@@ -4912,10 +4912,28 @@ xml_deleteProperty(JSContext *cx, JSObject *obj, jsid id, Value *rval, JSBool st
 static JSBool
 xml_deleteElement(JSContext *cx, JSObject *obj, uint32 index, Value *rval, JSBool strict)
 {
-    jsid id;
-    if (!IndexToId(cx, index, &id))
+    JSXML *xml = reinterpret_cast<JSXML *>(obj->getPrivate());
+    if (xml->xml_class != JSXML_CLASS_LIST) {
+        /* See NOTE in spec: this variation is reserved for future use. */
+        ReportBadXMLName(cx, DoubleValue(index));
         return false;
-    return xml_deleteProperty(cx, obj, id, rval, strict);
+    }
+
+    /* ECMA-357 9.2.1.3. */
+    DeleteListElement(cx, xml, index);
+
+    /*
+     * If this object has its own (mutable) scope,  then we may have added a
+     * property to the scope in xml_lookupProperty for it to return to mean
+     * "found" and to provide a handle for access operations to call the
+     * property's getter or setter. But now it's time to remove any such
+     * property, to purge the property cache and remove the scope entry.
+     */
+    if (!obj->nativeEmpty() && !js_DeleteElement(cx, obj, index, rval, false))
+        return false;
+
+    rval->setBoolean(true);
+    return true;
 }
 
 static JSString *

From e72e096fac9d568f4d14cf27257a958b0a4c5c8f Mon Sep 17 00:00:00 2001
From: Jeff Walden <jwalden@mit.edu>
Date: Wed, 10 Aug 2011 14:54:52 -0700
Subject: [PATCH 021/209] Bug 686582 - Begin to specialize
 ObjectOps::defineElement to not just delegate to ObjectOps::defineProperty. 
 r=dvander

--HG--
extra : rebase_source : 9a688d7d8a26b1a54721a37ea5e908131aa39a2f
---
 js/src/jsarray.cpp      | 30 +++++++++++++++++++++++++++++-
 js/src/jsobj.cpp        | 10 ++++++++++
 js/src/jsobj.h          | 16 ++++++++++++----
 js/src/jsobjinlines.h   | 10 ----------
 js/src/jstypedarray.cpp | 12 +++++-------
 5 files changed, 56 insertions(+), 22 deletions(-)

diff --git a/js/src/jsarray.cpp b/js/src/jsarray.cpp
index ab8e8e1b2b0f..95cc069754e4 100644
--- a/js/src/jsarray.cpp
+++ b/js/src/jsarray.cpp
@@ -985,10 +985,38 @@ JSBool
 array_defineElement(JSContext *cx, JSObject *obj, uint32 index, const Value *value,
                     PropertyOp getter, StrictPropertyOp setter, uintN attrs)
 {
+    if (!obj->isDenseArray())
+        return js_DefineElement(cx, obj, index, value, getter, setter, attrs);
+
     jsid id;
     if (!IndexToId(cx, index, &id))
         return false;
-    return array_defineProperty(cx, obj, id, value, getter, setter, attrs);
+
+    do {
+        /*
+         * UINT32_MAX is not an array index and must not affect the length
+         * property, so specifically reject it.
+         */
+        if (attrs != JSPROP_ENUMERATE || index == UINT32_MAX)
+            break;
+
+        JSObject::EnsureDenseResult result = obj->ensureDenseArrayElements(cx, index, 1);
+        if (result != JSObject::ED_OK) {
+            if (result == JSObject::ED_FAILED)
+                return false;
+            JS_ASSERT(result == JSObject::ED_SPARSE);
+            break;
+        }
+
+        if (index >= obj->getArrayLength())
+            obj->setDenseArrayLength(index + 1);
+        obj->setDenseArrayElementWithType(cx, index, *value);
+        return true;
+    } while (false);
+
+    if (!obj->makeDenseArraySlow(cx))
+        return false;
+    return js_DefineElement(cx, obj, index, value, getter, setter, attrs);
 }
 
 } // namespace js
diff --git a/js/src/jsobj.cpp b/js/src/jsobj.cpp
index 930f222513fc..8ab70e8925fd 100644
--- a/js/src/jsobj.cpp
+++ b/js/src/jsobj.cpp
@@ -5066,6 +5066,16 @@ js_DefineProperty(JSContext *cx, JSObject *obj, jsid id, const Value *value,
     return !!DefineNativeProperty(cx, obj, id, *value, getter, setter, attrs, 0, 0);
 }
 
+JSBool
+js_DefineElement(JSContext *cx, JSObject *obj, uint32 index, const Value *value,
+                 PropertyOp getter, StrictPropertyOp setter, uintN attrs)
+{
+    jsid id;
+    if (!IndexToId(cx, index, &id))
+        return false;
+    return !!DefineNativeProperty(cx, obj, id, *value, getter, setter, attrs, 0, 0);
+}
+
 /*
  * Backward compatibility requires allowing addProperty hooks to mutate the
  * nominal initial value of a slotful property, while GC safety wants that
diff --git a/js/src/jsobj.h b/js/src/jsobj.h
index a4672f15092d..ae37fc77f406 100644
--- a/js/src/jsobj.h
+++ b/js/src/jsobj.h
@@ -254,6 +254,10 @@ extern JSBool
 js_DefineProperty(JSContext *cx, JSObject *obj, jsid id, const js::Value *value,
                   js::PropertyOp getter, js::StrictPropertyOp setter, uintN attrs);
 
+extern JSBool
+js_DefineElement(JSContext *cx, JSObject *obj, uint32 index, const js::Value *value,
+                 js::PropertyOp getter, js::StrictPropertyOp setter, uintN attrs);
+
 extern JSBool
 js_GetProperty(JSContext *cx, JSObject *obj, JSObject *receiver, jsid id, js::Value *vp);
 
@@ -1407,10 +1411,14 @@ struct JSObject : js::gc::Cell {
         return (op ? op : js_DefineProperty)(cx, this, id, &value, getter, setter, attrs);
     }
 
-    inline JSBool defineElement(JSContext *cx, uint32 index, const js::Value &value,
-                                js::PropertyOp getter = js::PropertyStub,
-                                js::StrictPropertyOp setter = js::StrictPropertyStub,
-                                uintN attrs = JSPROP_ENUMERATE);
+    JSBool defineElement(JSContext *cx, uint32 index, const js::Value &value,
+                         js::PropertyOp getter = js::PropertyStub,
+                         js::StrictPropertyOp setter = js::StrictPropertyStub,
+                         uintN attrs = JSPROP_ENUMERATE)
+    {
+        js::DefineElementOp op = getOps()->defineElement;
+        return (op ? op : js_DefineElement)(cx, this, index, &value, getter, setter, attrs);
+    }
 
     inline JSBool getProperty(JSContext *cx, JSObject *receiver, jsid id, js::Value *vp);
 
diff --git a/js/src/jsobjinlines.h b/js/src/jsobjinlines.h
index 436adbb828db..a5c9a7b5e3d3 100644
--- a/js/src/jsobjinlines.h
+++ b/js/src/jsobjinlines.h
@@ -1100,16 +1100,6 @@ JSObject::lookupElement(JSContext *cx, uint32 index, JSObject **objp, JSProperty
     return (op ? op : js_LookupElement)(cx, this, index, objp, propp);
 }
 
-inline JSBool
-JSObject::defineElement(JSContext *cx, uint32 index, const js::Value &value,
-                        js::PropertyOp getter, js::StrictPropertyOp setter, uintN attrs)
-{
-    jsid id;
-    if (!js::IndexToId(cx, index, &id))
-        return false;
-    return defineProperty(cx, id, value, getter, setter, attrs);
-}
-
 inline JSBool
 JSObject::getElement(JSContext *cx, JSObject *receiver, uint32 index, js::Value *vp)
 {
diff --git a/js/src/jstypedarray.cpp b/js/src/jstypedarray.cpp
index 32d8e79196a4..68e02321004c 100644
--- a/js/src/jstypedarray.cpp
+++ b/js/src/jstypedarray.cpp
@@ -327,10 +327,10 @@ JSBool
 ArrayBuffer::obj_defineElement(JSContext *cx, JSObject *obj, uint32 index, const Value *v,
                    PropertyOp getter, StrictPropertyOp setter, uintN attrs)
 {
-    jsid id;
-    if (!IndexToId(cx, index, &id))
+    JSObject *delegate = DelegateObject(cx, obj);
+    if (!delegate)
         return false;
-    return obj_defineProperty(cx, obj, id, v, getter, setter, attrs);
+    return js_DefineElement(cx, delegate, index, v, getter, setter, attrs);
 }
 
 JSBool
@@ -1036,10 +1036,8 @@ class TypedArrayTemplate
     obj_defineElement(JSContext *cx, JSObject *obj, uint32 index, const Value *v,
                        PropertyOp getter, StrictPropertyOp setter, uintN attrs)
     {
-        jsid id;
-        if (!IndexToId(cx, index, &id))
-            return false;
-        return obj_defineProperty(cx, obj, id, v, getter, setter, attrs);
+        Value tmp = *v;
+        return obj_setElement(cx, obj, index, &tmp, false);
     }
 
     static JSBool

From 9cbb973a07102c4f3a211dbd097e2c97d66a75b1 Mon Sep 17 00:00:00 2001
From: Jeff Walden <jwalden@mit.edu>
Date: Wed, 10 Aug 2011 14:54:52 -0700
Subject: [PATCH 022/209] Bug 686582 - Begin to specialize
 ObjectOps::setElement to not just delegate to ObjectOps::setProperty. 
 r=dvander

--HG--
extra : rebase_source : e8e830c1baed1e51261884a0c6ec7197f552c821
---
 js/src/jsarray.cpp      | 32 +++++++++++++++-
 js/src/jsobj.cpp        | 25 ++++++++++++
 js/src/jsobj.h          | 12 +++++-
 js/src/jsobjinlines.h   |  9 -----
 js/src/jstypedarray.cpp | 84 ++++++++++++++++++++++++-----------------
 5 files changed, 116 insertions(+), 46 deletions(-)

diff --git a/js/src/jsarray.cpp b/js/src/jsarray.cpp
index 95cc069754e4..8b6b52e6bccd 100644
--- a/js/src/jsarray.cpp
+++ b/js/src/jsarray.cpp
@@ -917,7 +917,37 @@ array_setElement(JSContext *cx, JSObject *obj, uint32 index, Value *vp, JSBool s
     jsid id;
     if (!IndexToId(cx, index, &id))
         return false;
-    return array_setProperty(cx, obj, id, vp, strict);
+
+    if (!obj->isDenseArray())
+        return js_SetPropertyHelper(cx, obj, id, 0, vp, strict);
+
+    do {
+        /*
+         * UINT32_MAX is not an array index and must not affect the length
+         * property, so specifically reject it.
+         */
+        if (index == UINT32_MAX)
+            break;
+        if (js_PrototypeHasIndexedProperties(cx, obj))
+            break;
+
+        JSObject::EnsureDenseResult result = obj->ensureDenseArrayElements(cx, index, 1);
+        if (result != JSObject::ED_OK) {
+            if (result == JSObject::ED_FAILED)
+                return false;
+            JS_ASSERT(result == JSObject::ED_SPARSE);
+            break;
+        }
+
+        if (index >= obj->getArrayLength())
+            obj->setDenseArrayLength(index + 1);
+        obj->setDenseArrayElementWithType(cx, index, *vp);
+        return true;
+    } while (false);
+
+    if (!obj->makeDenseArraySlow(cx))
+        return false;
+    return js_SetPropertyHelper(cx, obj, id, 0, vp, strict);
 }
 
 JSBool
diff --git a/js/src/jsobj.cpp b/js/src/jsobj.cpp
index 8ab70e8925fd..b7ddfaea0b8a 100644
--- a/js/src/jsobj.cpp
+++ b/js/src/jsobj.cpp
@@ -3610,6 +3610,21 @@ JSObject::nonNativeSetProperty(JSContext *cx, jsid id, js::Value *vp, JSBool str
     return getOps()->setProperty(cx, this, id, vp, strict);
 }
 
+JSBool
+JSObject::nonNativeSetElement(JSContext *cx, uint32 index, js::Value *vp, JSBool strict)
+{
+    if (JS_UNLIKELY(watched())) {
+        jsid id;
+        if (!IndexToId(cx, index, &id))
+            return false;
+        JS_ASSERT(id == js_CheckForStringIndex(id));
+        WatchpointMap *wpmap = cx->compartment->watchpointMap;
+        if (wpmap && !wpmap->triggerWatchpoint(cx, this, id, vp))
+            return false;
+    }
+    return getOps()->setElement(cx, this, index, vp, strict);
+}
+
 bool
 JSObject::copyPropertiesFrom(JSContext *cx, JSObject *obj)
 {
@@ -6258,6 +6273,16 @@ js_SetPropertyHelper(JSContext *cx, JSObject *obj, jsid id, uintN defineHow,
 #endif
 }
 
+JSBool
+js_SetElementHelper(JSContext *cx, JSObject *obj, uint32 index, uintN defineHow,
+                    Value *vp, JSBool strict)
+{
+    jsid id;
+    if (!IndexToId(cx, index, &id))
+        return false;
+    return js_SetPropertyHelper(cx, obj, id, defineHow, vp, strict);
+}
+
 JSBool
 js_GetAttributes(JSContext *cx, JSObject *obj, jsid id, uintN *attrsp)
 {
diff --git a/js/src/jsobj.h b/js/src/jsobj.h
index ae37fc77f406..3c27b598cc6d 100644
--- a/js/src/jsobj.h
+++ b/js/src/jsobj.h
@@ -287,6 +287,10 @@ extern JSBool
 js_SetPropertyHelper(JSContext *cx, JSObject *obj, jsid id, uintN defineHow,
                      js::Value *vp, JSBool strict);
 
+extern JSBool
+js_SetElementHelper(JSContext *cx, JSObject *obj, uint32 index, uintN defineHow,
+                    js::Value *vp, JSBool strict);
+
 extern JSBool
 js_GetAttributes(JSContext *cx, JSObject *obj, jsid id, uintN *attrsp);
 
@@ -1434,10 +1438,16 @@ struct JSObject : js::gc::Cell {
         return js_SetPropertyHelper(cx, this, id, 0, vp, strict);
     }
 
-    inline JSBool setElement(JSContext *cx, uint32 index, js::Value *vp, JSBool strict);
+    JSBool setElement(JSContext *cx, uint32 index, js::Value *vp, JSBool strict) {
+        if (getOps()->setElement)
+            return nonNativeSetElement(cx, index, vp, strict);
+        return js_SetElementHelper(cx, this, index, 0, vp, strict);
+    }
 
     JSBool nonNativeSetProperty(JSContext *cx, jsid id, js::Value *vp, JSBool strict);
 
+    JSBool nonNativeSetElement(JSContext *cx, uint32 index, js::Value *vp, JSBool strict);
+
     JSBool getAttributes(JSContext *cx, jsid id, uintN *attrsp) {
         js::AttributesOp op = getOps()->getAttributes;
         return (op ? op : js_GetAttributes)(cx, this, id, attrsp);
diff --git a/js/src/jsobjinlines.h b/js/src/jsobjinlines.h
index a5c9a7b5e3d3..9fe81ea1af05 100644
--- a/js/src/jsobjinlines.h
+++ b/js/src/jsobjinlines.h
@@ -1118,15 +1118,6 @@ JSObject::getElement(JSContext *cx, uint32 index, js::Value *vp)
     return getProperty(cx, id, vp);
 }
 
-inline JSBool
-JSObject::setElement(JSContext *cx, uint32 index, js::Value *vp, JSBool strict)
-{
-    jsid id;
-    if (!js::IndexToId(cx, index, &id))
-        return false;
-    return setProperty(cx, id, vp, strict);
-}
-
 inline JSBool
 JSObject::deleteElement(JSContext *cx, uint32 index, js::Value *rval, JSBool strict)
 {
diff --git a/js/src/jstypedarray.cpp b/js/src/jstypedarray.cpp
index 68e02321004c..934a8126cc20 100644
--- a/js/src/jstypedarray.cpp
+++ b/js/src/jstypedarray.cpp
@@ -414,10 +414,11 @@ ArrayBuffer::obj_setProperty(JSContext *cx, JSObject *obj, jsid id, Value *vp, J
 JSBool
 ArrayBuffer::obj_setElement(JSContext *cx, JSObject *obj, uint32 index, Value *vp, JSBool strict)
 {
-    jsid id;
-    if (!IndexToId(cx, index, &id))
+    JSObject *delegate = DelegateObject(cx, obj);
+    if (!delegate)
         return false;
-    return obj_setProperty(cx, obj, id, vp, strict);
+
+    return js_SetElementHelper(cx, delegate, index, 0, vp, strict);
 }
 
 JSBool
@@ -935,33 +936,11 @@ class TypedArrayTemplate
         return js_NativeGet(cx, obj, obj2, shape, JSGET_METHOD_BARRIER, vp);
     }
 
-    static JSBool
-    obj_setProperty(JSContext *cx, JSObject *obj, jsid id, Value *vp, JSBool strict)
+    static bool
+    setElementTail(JSContext *cx, JSObject *tarray, uint32 index, Value *vp, JSBool strict)
     {
-        JSObject *tarray = getTypedArray(obj);
         JS_ASSERT(tarray);
-
-        if (JSID_IS_ATOM(id, cx->runtime->atomState.lengthAtom)) {
-            vp->setNumber(getLength(tarray));
-            return true;
-        }
-
-        jsuint index;
-        // We can't just chain to js_SetPropertyHelper, because we're not a normal object.
-        if (!isArrayIndex(cx, tarray, id, &index)) {
-#if 0
-            JS_ReportErrorNumber(cx, js_GetErrorMessage, NULL,
-                                 JSMSG_TYPED_ARRAY_BAD_INDEX);
-            return false;
-#endif
-            // Silent ignore is better than an exception here, because
-            // at some point we may want to support other properties on
-            // these objects.  This is especially true when these arrays
-            // are used to implement HTML Canvas 2D's PixelArray objects,
-            // which used to be plain old arrays.
-            vp->setUndefined();
-            return true;
-        }
+        JS_ASSERT(index < getLength(tarray));
 
         if (vp->isInt32()) {
             setIndex(tarray, index, NativeType(vp->toInt32()));
@@ -969,11 +948,10 @@ class TypedArrayTemplate
         }
 
         jsdouble d;
-
         if (vp->isDouble()) {
             d = vp->toDouble();
         } else if (vp->isNull()) {
-            d = 0.0f;
+            d = 0.0;
         } else if (vp->isPrimitive()) {
             JS_ASSERT(vp->isString() || vp->isUndefined() || vp->isBoolean());
             if (vp->isString()) {
@@ -981,7 +959,7 @@ class TypedArrayTemplate
             } else if (vp->isUndefined()) {
                 d = js_NaN;
             } else {
-                d = (double) vp->toBoolean();
+                d = double(vp->toBoolean());
             }
         } else {
             // non-primitive assignments become NaN or 0 (for float/int arrays)
@@ -1012,13 +990,49 @@ class TypedArrayTemplate
         return true;
     }
 
+    static JSBool
+    obj_setProperty(JSContext *cx, JSObject *obj, jsid id, Value *vp, JSBool strict)
+    {
+        JSObject *tarray = getTypedArray(obj);
+        JS_ASSERT(tarray);
+
+        if (JSID_IS_ATOM(id, cx->runtime->atomState.lengthAtom)) {
+            vp->setNumber(getLength(tarray));
+            return true;
+        }
+
+        jsuint index;
+        // We can't just chain to js_SetPropertyHelper, because we're not a normal object.
+        if (!isArrayIndex(cx, tarray, id, &index)) {
+            // Silent ignore is better than an exception here, because
+            // at some point we may want to support other properties on
+            // these objects.  This is especially true when these arrays
+            // are used to implement HTML Canvas 2D's PixelArray objects,
+            // which used to be plain old arrays.
+            vp->setUndefined();
+            return true;
+        }
+
+        return setElementTail(cx, tarray, index, vp, strict);
+    }
+
     static JSBool
     obj_setElement(JSContext *cx, JSObject *obj, uint32 index, Value *vp, JSBool strict)
     {
-        jsid id;
-        if (!IndexToId(cx, index, &id))
-            return false;
-        return obj_setProperty(cx, obj, id, vp, strict);
+        JSObject *tarray = getTypedArray(obj);
+        JS_ASSERT(tarray);
+
+        if (index >= getLength(tarray)) {
+            // Silent ignore is better than an exception here, because
+            // at some point we may want to support other properties on
+            // these objects.  This is especially true when these arrays
+            // are used to implement HTML Canvas 2D's PixelArray objects,
+            // which used to be plain old arrays.
+            vp->setUndefined();
+            return true;
+        }
+
+        return setElementTail(cx, tarray, index, vp, strict);
     }
 
     static JSBool

From 26fe157bd98cd888d42e8f112cad097ec5e14cbb Mon Sep 17 00:00:00 2001
From: Jeff Walden <jwalden@mit.edu>
Date: Wed, 10 Aug 2011 14:54:52 -0700
Subject: [PATCH 023/209] Bug 686582 - Start adjust existing algorithms to use
 element-specific methods in preference to jsid-generalized ones.  r=dvander

--HG--
extra : rebase_source : 0dbe07f70aa25238296aea3cb445016532f4eea9
---
 js/src/jsarray.cpp       |  2 +-
 js/src/json.cpp          |  2 +-
 js/src/jsproxy.cpp       | 12 +++++-------
 js/src/jsregexpinlines.h | 41 ++++++++++++++++++++--------------------
 js/src/jsstr.cpp         | 17 ++++++++---------
 js/src/jstypedarray.cpp  |  2 +-
 6 files changed, 36 insertions(+), 40 deletions(-)

diff --git a/js/src/jsarray.cpp b/js/src/jsarray.cpp
index 8b6b52e6bccd..a3525978eeee 100644
--- a/js/src/jsarray.cpp
+++ b/js/src/jsarray.cpp
@@ -408,7 +408,7 @@ static bool
 GetElementsSlow(JSContext *cx, JSObject *aobj, uint32 length, Value *vp)
 {
     for (uint32 i = 0; i < length; i++) {
-        if (!aobj->getProperty(cx, INT_TO_JSID(jsint(i)), &vp[i]))
+        if (!aobj->getElement(cx, i, &vp[i]))
             return false;
     }
 
diff --git a/js/src/json.cpp b/js/src/json.cpp
index ed65c3fa69fc..6b6d13af7e31 100644
--- a/js/src/json.cpp
+++ b/js/src/json.cpp
@@ -665,7 +665,7 @@ js_Stringify(JSContext *cx, Value *vp, JSObject *replacer, Value space, StringBu
             for (; i < len; i++) {
                 /* Step 4b(iv)(2). */
                 Value v;
-                if (!replacer->getProperty(cx, INT_TO_JSID(i), &v))
+                if (!replacer->getElement(cx, i, &v))
                     return false;
 
                 jsid id;
diff --git a/js/src/jsproxy.cpp b/js/src/jsproxy.cpp
index 4a0018c5c503..7199dd1d16dd 100644
--- a/js/src/jsproxy.cpp
+++ b/js/src/jsproxy.cpp
@@ -424,18 +424,16 @@ ArrayToIdVector(JSContext *cx, const Value &array, AutoIdVector &props)
     if (!js_GetLengthProperty(cx, obj, &length))
         return false;
 
-    AutoIdRooter idr(cx);
-    AutoValueRooter tvr(cx);
     for (jsuint n = 0; n < length; ++n) {
         if (!JS_CHECK_OPERATION_LIMIT(cx))
             return false;
-        if (!IndexToId(cx, n, idr.addr()))
+        Value v;
+        if (!obj->getElement(cx, n, &v))
             return false;
-        if (!obj->getProperty(cx, idr.id(), tvr.addr()))
+        jsid id;
+        if (!ValueToId(cx, v, &id))
             return false;
-        if (!ValueToId(cx, tvr.value(), idr.addr()))
-            return false;
-        if (!props.append(js_CheckForStringIndex(idr.id())))
+        if (!props.append(js_CheckForStringIndex(id)))
             return false;
     }
 
diff --git a/js/src/jsregexpinlines.h b/js/src/jsregexpinlines.h
index 1cd521877951..53dc18c03b01 100644
--- a/js/src/jsregexpinlines.h
+++ b/js/src/jsregexpinlines.h
@@ -229,27 +229,27 @@ class RegExpMatchBuilder
     JSContext   * const cx;
     JSObject    * const array;
 
+    bool setProperty(JSAtom *name, Value v) {
+        return !!js_DefineProperty(cx, array, ATOM_TO_JSID(name), &v,
+                                   PropertyStub, StrictPropertyStub, JSPROP_ENUMERATE);
+    }
+
   public:
     RegExpMatchBuilder(JSContext *cx, JSObject *array) : cx(cx), array(array) {}
 
-    bool append(int index, JSString *str) {
+    bool append(uint32 index, Value v) {
+        JS_ASSERT(!array->getOps()->getElement);
+        return !!js_DefineElement(cx, array, index, &v, PropertyStub, StrictPropertyStub,
+                                  JSPROP_ENUMERATE);
+    }
+
+    bool setIndex(int index) {
+        return setProperty(cx->runtime->atomState.indexAtom, Int32Value(index));
+    }
+
+    bool setInput(JSString *str) {
         JS_ASSERT(str);
-        return append(INT_TO_JSID(index), StringValue(str));
-    }
-
-    bool append(jsid id, Value val) {
-        return !!js_DefineProperty(cx, array, id, &val, js::PropertyStub, js::StrictPropertyStub,
-                                   JSPROP_ENUMERATE);
-    }
-
-    bool appendIndex(int index) {
-        return append(ATOM_TO_JSID(cx->runtime->atomState.indexAtom), Int32Value(index));
-    }
-
-    /* Sets the input attribute of the match array. */
-    bool appendInput(JSString *str) {
-        JS_ASSERT(str);
-        return append(ATOM_TO_JSID(cx->runtime->atomState.inputAtom), StringValue(str));
+        return setProperty(cx->runtime->atomState.inputAtom, StringValue(str));
     }
 };
 
@@ -315,18 +315,17 @@ RegExp::createResult(JSContext *cx, JSString *input, int *buf, size_t matchItemC
             JS_ASSERT(start <= end);
             JS_ASSERT(unsigned(end) <= input->length());
             captured = js_NewDependentString(cx, input, start, end - start);
-            if (!(captured && builder.append(i / 2, captured)))
+            if (!captured || !builder.append(i / 2, StringValue(captured)))
                 return NULL;
         } else {
             /* Missing parenthesized match. */
             JS_ASSERT(i != 0); /* Since we had a match, first pair must be present. */
-            if (!builder.append(INT_TO_JSID(i / 2), UndefinedValue()))
+            if (!builder.append(i / 2, UndefinedValue()))
                 return NULL;
         }
     }
 
-    if (!builder.appendIndex(buf[0]) ||
-        !builder.appendInput(input))
+    if (!builder.setIndex(buf[0]) || !builder.setInput(input))
         return NULL;
 
     return array;
diff --git a/js/src/jsstr.cpp b/js/src/jsstr.cpp
index bff981bb69e0..3a7aaba192aa 100644
--- a/js/src/jsstr.cpp
+++ b/js/src/jsstr.cpp
@@ -341,7 +341,7 @@ static JSFunctionSpec string_functions[] = {
 jschar      js_empty_ucstr[]  = {0};
 JSSubString js_EmptySubString = {0, js_empty_ucstr};
 
-#define STRING_ELEMENT_ATTRS (JSPROP_ENUMERATE|JSPROP_READONLY|JSPROP_PERMANENT)
+static const uintN STRING_ELEMENT_ATTRS = JSPROP_ENUMERATE | JSPROP_READONLY | JSPROP_PERMANENT;
 
 static JSBool
 str_enumerate(JSContext *cx, JSObject *obj)
@@ -351,9 +351,9 @@ str_enumerate(JSContext *cx, JSObject *obj)
         JSString *str1 = js_NewDependentString(cx, str, i, 1);
         if (!str1)
             return false;
-        if (!obj->defineProperty(cx, INT_TO_JSID(i), StringValue(str1),
-                                 PropertyStub, StrictPropertyStub,
-                                 STRING_ELEMENT_ATTRS)) {
+        if (!obj->defineElement(cx, i, StringValue(str1),
+                                PropertyStub, StrictPropertyStub,
+                                STRING_ELEMENT_ATTRS)) {
             return false;
         }
     }
@@ -375,8 +375,8 @@ str_resolve(JSContext *cx, JSObject *obj, jsid id, uintN flags,
         JSString *str1 = JSAtom::getUnitStringForElement(cx, str, size_t(slot));
         if (!str1)
             return JS_FALSE;
-        if (!obj->defineProperty(cx, id, StringValue(str1), NULL, NULL,
-                                 STRING_ELEMENT_ATTRS)) {
+        if (!obj->defineElement(cx, uint32(slot), StringValue(str1), NULL, NULL,
+                                STRING_ELEMENT_ATTRS)) {
             return JS_FALSE;
         }
         *objp = obj;
@@ -1510,7 +1510,7 @@ BuildFlatMatchArray(JSContext *cx, JSString *textstr, const FlatMatch &fm, Value
         return false;
     vp->setObject(*obj);
 
-    return obj->defineProperty(cx, INT_TO_JSID(0), StringValue(fm.pattern())) &&
+    return obj->defineElement(cx, 0, StringValue(fm.pattern())) &&
            obj->defineProperty(cx, ATOM_TO_JSID(cx->runtime->atomState.indexAtom),
                                Int32Value(fm.match())) &&
            obj->defineProperty(cx, ATOM_TO_JSID(cx->runtime->atomState.inputAtom),
@@ -1536,8 +1536,7 @@ MatchCallback(JSContext *cx, RegExpStatics *res, size_t count, void *p)
     }
 
     Value v;
-    return res->createLastMatch(cx, &v) &&
-           arrayobj->defineProperty(cx, INT_TO_JSID(count), v);
+    return res->createLastMatch(cx, &v) && arrayobj->defineElement(cx, count, v);
 }
 
 static JSBool
diff --git a/js/src/jstypedarray.cpp b/js/src/jstypedarray.cpp
index 934a8126cc20..a719f68f6c1e 100644
--- a/js/src/jstypedarray.cpp
+++ b/js/src/jstypedarray.cpp
@@ -1566,7 +1566,7 @@ class TypedArrayTemplate
             Value v;
 
             for (uintN i = 0; i < len; ++i) {
-                if (!ar->getProperty(cx, ::INT_TO_JSID(i), &v))
+                if (!ar->getElement(cx, i, &v))
                     return false;
                 *dest++ = nativeFromValue(cx, v);
             }

From 385958e7d70f045f1311ccd9964986ec85ae7b5f Mon Sep 17 00:00:00 2001
From: Ed Morley <bmo@edmorley.co.uk>
Date: Fri, 16 Sep 2011 01:41:34 +0100
Subject: [PATCH 024/209] Backout changeset 151783eb7f6f (bug 676711) for
 Android b-c orange; a=philor

---
 mobile/chrome/content/browser.js | 30 +++++++++++-------------------
 1 file changed, 11 insertions(+), 19 deletions(-)

diff --git a/mobile/chrome/content/browser.js b/mobile/chrome/content/browser.js
index a1303e605915..5dfda44372d4 100644
--- a/mobile/chrome/content/browser.js
+++ b/mobile/chrome/content/browser.js
@@ -1619,6 +1619,8 @@ Browser.WebProgress.prototype = {
       }
 
       aTab.scrolledAreaChanged(true);
+      aTab.updateThumbnail();
+
       aTab.updateContentCapture();
     });
   }
@@ -2723,9 +2725,6 @@ function Tab(aURI, aParams) {
 
   // default tabs to inactive (i.e. no display port)
   this.active = false;
-
-  // Whether the tab thumbnail has been delayed to wait for the first paint.
-  this._delayedThumbnail = false;
 }
 
 Tab.prototype = {
@@ -2838,22 +2837,9 @@ Tab.prototype = {
   endLoading: function endLoading() {
     if (!this._loading) throw "Not Loading!";
     this._loading = false;
-
-    if (!this._delayedThumbnail) {
-      if (this._firstPaint) {
-        this.updateThumbnail();
-      } else {
-        let browser = this._browser;
-        let self = this;
-
-        this._delayedThumbnail = true;
-
-        browser.messageManager.addMessageListener("Browser:FirstPaint", function (aMessage) {
-          browser.messageManager.removeMessageListener(aMessage.name, arguments.callee);
-          self.updateThumbnail();
-          self._delayedThumbnail = false;
-        });
-      }
+    if (this._drawThumb) {
+      this._drawThumb = false;
+      this.updateThumbnail();
     }
   },
 
@@ -3074,6 +3060,12 @@ Tab.prototype = {
   updateThumbnail: function updateThumbnail(options) {
     let options = options || {};
     let browser = this._browser;
+
+    if (this._loading) {
+      this._drawThumb = true;
+      return;
+    }
+
     let forceUpdate = ("force" in options && options.force);
 
     // Do not repaint thumbnail if we already painted for this load. Bad things

From 54e47e1cee6a52079f8038ccac86aecb1a3c469f Mon Sep 17 00:00:00 2001
From: Jason Duell <jduell.mcbugs@gmail.com>
Date: Thu, 15 Sep 2011 18:19:56 -0700
Subject: [PATCH 025/209] Bug 686067: Standardize max time for necko telemetry
 stats at 30 seconds. r=honzab

---
 toolkit/components/telemetry/TelemetryHistograms.h | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/toolkit/components/telemetry/TelemetryHistograms.h b/toolkit/components/telemetry/TelemetryHistograms.h
index eb3524604379..a16c373cbf7d 100644
--- a/toolkit/components/telemetry/TelemetryHistograms.h
+++ b/toolkit/components/telemetry/TelemetryHistograms.h
@@ -104,14 +104,14 @@ HISTOGRAM(IMAGE_DECODE_COUNT, 1,  500, 50, EXPONENTIAL, "Decode count")
 /**
  * Networking telemetry
  */
-HISTOGRAM(TOTAL_CONTENT_PAGE_LOAD_TIME, 100, 10000, 100, EXPONENTIAL, "HTTP: Total page load time (ms)")
+HISTOGRAM(TOTAL_CONTENT_PAGE_LOAD_TIME, 100, 30000, 100, EXPONENTIAL, "HTTP: Total page load time (ms)")
 HISTOGRAM(HTTP_SUBITEM_OPEN_LATENCY_TIME, 1, 30000, 50, EXPONENTIAL, "HTTP subitem: Page start -> subitem open() (ms)")
 HISTOGRAM(HTTP_SUBITEM_FIRST_BYTE_LATENCY_TIME, 1, 30000, 50, EXPONENTIAL, "HTTP subitem: Page start -> first byte received for subitem reply (ms)")
 HISTOGRAM(HTTP_REQUEST_PER_PAGE, 1, 1000, 50, EXPONENTIAL, "HTTP: Requests per page (count)")
 HISTOGRAM(HTTP_REQUEST_PER_PAGE_FROM_CACHE, 1, 101, 102, LINEAR, "HTTP: Requests serviced from cache (%)")
 
 #define _HTTP_HIST(name, label) \
-  HISTOGRAM(name, 1, 10000, 50, EXPONENTIAL, "HTTP " label) \
+  HISTOGRAM(name, 1, 30000, 50, EXPONENTIAL, "HTTP " label) \
 
 #define HTTP_HISTOGRAMS(prefix, labelprefix) \
   _HTTP_HIST(HTTP_##prefix##_DNS_ISSUE_TIME, labelprefix "open() -> DNS request issued (ms)") \

From a634cefedeb4911a97bdc16bb70a67595a92ed9e Mon Sep 17 00:00:00 2001
From: Trevor Saunders <trev.saunders@gmail.com>
Date: Fri, 3 Jun 2011 14:35:17 -0700
Subject: [PATCH 026/209] bug 481395 - replace nsAccessibilityAtoms with
 nsGkAtoms r=surkov, sicking

---
 accessible/src/atk/nsMaiInterfaceDocument.cpp |   1 -
 accessible/src/base/AccIterator.cpp           |  24 +-
 accessible/src/base/Makefile.in               |   1 -
 accessible/src/base/nsARIAGridAccessible.cpp  |  12 +-
 accessible/src/base/nsARIAMap.cpp             | 107 ++++---
 accessible/src/base/nsAccUtils.cpp            |  51 ++-
 accessible/src/base/nsAccessNode.cpp          |   5 +-
 accessible/src/base/nsAccessibilityAtomList.h | 300 ------------------
 accessible/src/base/nsAccessibilityAtoms.cpp  |  62 ----
 accessible/src/base/nsAccessibilityAtoms.h    |  67 ----
 .../src/base/nsAccessibilityService.cpp       | 125 ++++----
 accessible/src/base/nsAccessible.cpp          | 141 ++++----
 .../src/base/nsBaseWidgetAccessible.cpp       |   1 -
 accessible/src/base/nsCoreUtils.cpp           |  17 +-
 accessible/src/base/nsCoreUtils.h             |   5 +-
 accessible/src/base/nsDocAccessible.cpp       | 109 ++++---
 accessible/src/base/nsEventShell.cpp          |   2 +-
 .../src/base/nsFormControlAccessible.cpp      |   4 +-
 accessible/src/base/nsRootAccessible.cpp      |   6 +-
 accessible/src/base/nsTextAttrs.cpp           |  14 +-
 accessible/src/base/nsTextAttrs.h             |  13 +-
 accessible/src/base/nsTextEquivUtils.cpp      |   8 +-
 .../src/html/nsHTMLFormControlAccessible.cpp  |  52 ++-
 accessible/src/html/nsHTMLImageAccessible.cpp |   9 +-
 .../src/html/nsHTMLImageMapAccessible.cpp     |   4 +-
 accessible/src/html/nsHTMLLinkAccessible.cpp  |   2 +-
 .../src/html/nsHTMLSelectAccessible.cpp       |  20 +-
 accessible/src/html/nsHTMLSelectAccessible.h  |   1 -
 accessible/src/html/nsHTMLTableAccessible.cpp |  17 +-
 accessible/src/html/nsHTMLTextAccessible.cpp  |   4 +-
 accessible/src/html/nsHyperTextAccessible.cpp |  91 +++---
 accessible/src/msaa/nsAccessNodeWrap.cpp      |   1 -
 accessible/src/msaa/nsAccessibleWrap.cpp      |   3 +-
 .../src/msaa/nsXULMenuAccessibleWrap.cpp      |   3 +-
 accessible/src/xforms/nsXFormsAccessible.cpp  |  12 +-
 .../xforms/nsXFormsFormControlsAccessible.cpp |   2 +-
 .../src/xul/nsXULColorPickerAccessible.cpp    |   6 +-
 .../src/xul/nsXULComboboxAccessible.cpp       |  10 +-
 .../src/xul/nsXULFormControlAccessible.cpp    |  32 +-
 accessible/src/xul/nsXULListboxAccessible.cpp |  18 +-
 accessible/src/xul/nsXULMenuAccessible.cpp    |  39 ++-
 accessible/src/xul/nsXULSliderAccessible.cpp  |  13 +-
 accessible/src/xul/nsXULTextAccessible.cpp    |  11 +-
 .../src/xul/nsXULTreeGridAccessible.cpp       |  12 +-
 content/base/src/nsGkAtomList.h               |  77 +++++
 45 files changed, 561 insertions(+), 953 deletions(-)
 delete mode 100644 accessible/src/base/nsAccessibilityAtomList.h
 delete mode 100644 accessible/src/base/nsAccessibilityAtoms.cpp
 delete mode 100644 accessible/src/base/nsAccessibilityAtoms.h

diff --git a/accessible/src/atk/nsMaiInterfaceDocument.cpp b/accessible/src/atk/nsMaiInterfaceDocument.cpp
index e0ec4e7e76b9..0148d8076d18 100644
--- a/accessible/src/atk/nsMaiInterfaceDocument.cpp
+++ b/accessible/src/atk/nsMaiInterfaceDocument.cpp
@@ -39,7 +39,6 @@
 
 #include "nsAccessibleWrap.h"
 #include "nsMaiInterfaceDocument.h"
-#include "nsAccessibilityAtoms.h"
 
 const char *const kDocTypeName = "W3C-doctype";
 const char *const kDocUrlName = "DocURL";
diff --git a/accessible/src/base/AccIterator.cpp b/accessible/src/base/AccIterator.cpp
index 28c8ef802afc..7ab6bb51cd2d 100644
--- a/accessible/src/base/AccIterator.cpp
+++ b/accessible/src/base/AccIterator.cpp
@@ -111,7 +111,7 @@ RelatedAccIterator::
 {
   mBindingParent = aDependentContent->GetBindingParent();
   nsIAtom* IDAttr = mBindingParent ?
-    nsAccessibilityAtoms::anonid : aDependentContent->GetIDAttributeName();
+    nsGkAtoms::anonid : aDependentContent->GetIDAttributeName();
 
   nsAutoString id;
   if (aDependentContent->GetAttr(kNameSpaceID_None, IDAttr, id))
@@ -154,7 +154,7 @@ RelatedAccIterator::Next()
 HTMLLabelIterator::
   HTMLLabelIterator(nsDocAccessible* aDocument, nsIContent* aElement,
                     LabelFilter aFilter) :
-  mRelIter(aDocument, aElement, nsAccessibilityAtoms::_for),
+  mRelIter(aDocument, aElement, nsGkAtoms::_for),
   mElement(aElement), mLabelFilter(aFilter)
 {
 }
@@ -166,7 +166,7 @@ HTMLLabelIterator::Next()
   // element, or <label> ancestor which implicitly point to it.
   nsAccessible* label = nsnull;
   while ((label = mRelIter.Next())) {
-    if (label->GetContent()->Tag() == nsAccessibilityAtoms::label)
+    if (label->GetContent()->Tag() == nsGkAtoms::label)
       return label;
   }
 
@@ -177,9 +177,9 @@ HTMLLabelIterator::Next()
   // implicitly points to us). Don't go up farther than form or body element.
   nsIContent* walkUpContent = mElement;
   while ((walkUpContent = walkUpContent->GetParent()) &&
-         walkUpContent->Tag() != nsAccessibilityAtoms::form &&
-         walkUpContent->Tag() != nsAccessibilityAtoms::body) {
-    if (walkUpContent->Tag() == nsAccessibilityAtoms::label) {
+         walkUpContent->Tag() != nsGkAtoms::form &&
+         walkUpContent->Tag() != nsGkAtoms::body) {
+    if (walkUpContent->Tag() == nsGkAtoms::label) {
       // Prevent infinite loop.
       mLabelFilter = eSkipAncestorLabel;
       return GetAccService()->GetAccessible(walkUpContent);
@@ -196,7 +196,7 @@ HTMLLabelIterator::Next()
 
 HTMLOutputIterator::
 HTMLOutputIterator(nsDocAccessible* aDocument, nsIContent* aElement) :
-  mRelIter(aDocument, aElement, nsAccessibilityAtoms::_for)
+  mRelIter(aDocument, aElement, nsGkAtoms::_for)
 {
 }
 
@@ -205,7 +205,7 @@ HTMLOutputIterator::Next()
 {
   nsAccessible* output = nsnull;
   while ((output = mRelIter.Next())) {
-    if (output->GetContent()->Tag() == nsAccessibilityAtoms::output)
+    if (output->GetContent()->Tag() == nsGkAtoms::output)
       return output;
   }
 
@@ -219,7 +219,7 @@ HTMLOutputIterator::Next()
 
 XULLabelIterator::
   XULLabelIterator(nsDocAccessible* aDocument, nsIContent* aElement) :
-  mRelIter(aDocument, aElement, nsAccessibilityAtoms::control)
+  mRelIter(aDocument, aElement, nsGkAtoms::control)
 {
 }
 
@@ -228,7 +228,7 @@ XULLabelIterator::Next()
 {
   nsAccessible* label = nsnull;
   while ((label = mRelIter.Next())) {
-    if (label->GetContent()->Tag() == nsAccessibilityAtoms::label)
+    if (label->GetContent()->Tag() == nsGkAtoms::label)
       return label;
   }
 
@@ -242,7 +242,7 @@ XULLabelIterator::Next()
 
 XULDescriptionIterator::
   XULDescriptionIterator(nsDocAccessible* aDocument, nsIContent* aElement) :
-  mRelIter(aDocument, aElement, nsAccessibilityAtoms::control)
+  mRelIter(aDocument, aElement, nsGkAtoms::control)
 {
 }
 
@@ -251,7 +251,7 @@ XULDescriptionIterator::Next()
 {
   nsAccessible* descr = nsnull;
   while ((descr = mRelIter.Next())) {
-    if (descr->GetContent()->Tag() == nsAccessibilityAtoms::description)
+    if (descr->GetContent()->Tag() == nsGkAtoms::description)
       return descr;
   }
 
diff --git a/accessible/src/base/Makefile.in b/accessible/src/base/Makefile.in
index 529b3c0bf4f7..451696f6ddf7 100644
--- a/accessible/src/base/Makefile.in
+++ b/accessible/src/base/Makefile.in
@@ -60,7 +60,6 @@ CPPSRCS = \
   nsARIAMap.cpp \
   nsDocAccessible.cpp \
   nsOuterDocAccessible.cpp \
-  nsAccessibilityAtoms.cpp \
   nsCoreUtils.cpp \
   nsAccUtils.cpp \
   nsAccessibilityService.cpp \
diff --git a/accessible/src/base/nsARIAGridAccessible.cpp b/accessible/src/base/nsARIAGridAccessible.cpp
index 70c83b1860a0..323f19911486 100644
--- a/accessible/src/base/nsARIAGridAccessible.cpp
+++ b/accessible/src/base/nsARIAGridAccessible.cpp
@@ -795,11 +795,11 @@ nsARIAGridAccessible::SetARIASelected(nsAccessible *aAccessible,
 
   nsresult rv = NS_OK;
   if (aIsSelected)
-    rv = content->SetAttr(kNameSpaceID_None, nsAccessibilityAtoms::aria_selected,
+    rv = content->SetAttr(kNameSpaceID_None, nsGkAtoms::aria_selected,
                           NS_LITERAL_STRING("true"), aNotify);
   else
     rv = content->UnsetAttr(kNameSpaceID_None,
-                            nsAccessibilityAtoms::aria_selected, aNotify);
+                            nsGkAtoms::aria_selected, aNotify);
 
   NS_ENSURE_SUCCESS(rv, rv);
 
@@ -1130,10 +1130,10 @@ nsARIAGridCellAccessible::ApplyARIAState(PRUint64* aState)
 
   nsIContent *rowContent = row->GetContent();
   if (nsAccUtils::HasDefinedARIAToken(rowContent,
-                                      nsAccessibilityAtoms::aria_selected) &&
+                                      nsGkAtoms::aria_selected) &&
       !rowContent->AttrValueIs(kNameSpaceID_None,
-                               nsAccessibilityAtoms::aria_selected,
-                               nsAccessibilityAtoms::_false, eCaseMatters))
+                               nsGkAtoms::aria_selected,
+                               nsGkAtoms::_false, eCaseMatters))
     *aState |= states::SELECTABLE | states::SELECTED;
 }
 
@@ -1190,7 +1190,7 @@ nsARIAGridCellAccessible::GetAttributesInternal(nsIPersistentProperties *aAttrib
 
   nsAutoString stringIdx;
   stringIdx.AppendInt(idx);
-  nsAccUtils::SetAccAttr(aAttributes, nsAccessibilityAtoms::tableCellIndex,
+  nsAccUtils::SetAccAttr(aAttributes, nsGkAtoms::tableCellIndex,
                          stringIdx);
 
   return NS_OK;
diff --git a/accessible/src/base/nsARIAMap.cpp b/accessible/src/base/nsARIAMap.cpp
index 678da1bb46f3..ad14dc54838e 100644
--- a/accessible/src/base/nsARIAMap.cpp
+++ b/accessible/src/base/nsARIAMap.cpp
@@ -42,7 +42,6 @@
 #include "nsIAccessibleRole.h"
 #include "States.h"
 
-#include "nsAccessibilityAtoms.h"
 #include "nsIContent.h"
 
 using namespace mozilla::a11y;
@@ -602,75 +601,75 @@ nsStateMapEntry nsARIAMap::gWAIStateMap[] = {
   nsStateMapEntry(),
 
   // eARIAAutoComplete
-  nsStateMapEntry(&nsAccessibilityAtoms::aria_autocomplete,
+  nsStateMapEntry(&nsGkAtoms::aria_autocomplete,
                   "inline", states::SUPPORTS_AUTOCOMPLETION,
                   "list", states::HASPOPUP | states::SUPPORTS_AUTOCOMPLETION,
                   "both", states::HASPOPUP | states::SUPPORTS_AUTOCOMPLETION),
 
   // eARIABusy
-  nsStateMapEntry(&nsAccessibilityAtoms::aria_busy,
+  nsStateMapEntry(&nsGkAtoms::aria_busy,
                   "true", states::BUSY,
                   "error", states::INVALID),
 
   // eARIACheckableBool
-  nsStateMapEntry(&nsAccessibilityAtoms::aria_checked, kBoolType,
+  nsStateMapEntry(&nsGkAtoms::aria_checked, kBoolType,
                   states::CHECKABLE, states::CHECKED, 0, PR_TRUE),
 
   // eARIACheckableMixed
-  nsStateMapEntry(&nsAccessibilityAtoms::aria_checked, kMixedType,
+  nsStateMapEntry(&nsGkAtoms::aria_checked, kMixedType,
                   states::CHECKABLE, states::CHECKED, 0, PR_TRUE),
 
   // eARIACheckedMixed
-  nsStateMapEntry(&nsAccessibilityAtoms::aria_checked, kMixedType,
+  nsStateMapEntry(&nsGkAtoms::aria_checked, kMixedType,
                   states::CHECKABLE, states::CHECKED, 0),
 
   // eARIADisabled
-  nsStateMapEntry(&nsAccessibilityAtoms::aria_disabled, kBoolType,
+  nsStateMapEntry(&nsGkAtoms::aria_disabled, kBoolType,
                   0, states::UNAVAILABLE),
 
   // eARIAExpanded
-  nsStateMapEntry(&nsAccessibilityAtoms::aria_expanded, kBoolType,
+  nsStateMapEntry(&nsGkAtoms::aria_expanded, kBoolType,
                   0, states::EXPANDED, states::COLLAPSED),
 
   // eARIAHasPopup
-  nsStateMapEntry(&nsAccessibilityAtoms::aria_haspopup, kBoolType,
+  nsStateMapEntry(&nsGkAtoms::aria_haspopup, kBoolType,
                   0, states::HASPOPUP),
 
   // eARIAInvalid
-  nsStateMapEntry(&nsAccessibilityAtoms::aria_invalid, kBoolType,
+  nsStateMapEntry(&nsGkAtoms::aria_invalid, kBoolType,
                   0, states::INVALID),
 
   // eARIAMultiline
-  nsStateMapEntry(&nsAccessibilityAtoms::aria_multiline, kBoolType,
+  nsStateMapEntry(&nsGkAtoms::aria_multiline, kBoolType,
                   0, states::MULTI_LINE, states::SINGLE_LINE, PR_TRUE),
 
   // eARIAMultiSelectable
-  nsStateMapEntry(&nsAccessibilityAtoms::aria_multiselectable, kBoolType,
+  nsStateMapEntry(&nsGkAtoms::aria_multiselectable, kBoolType,
                   0, states::MULTISELECTABLE | states::EXTSELECTABLE),
 
   // eARIAOrientation
-  nsStateMapEntry(&nsAccessibilityAtoms::aria_orientation, eUseFirstState,
+  nsStateMapEntry(&nsGkAtoms::aria_orientation, eUseFirstState,
                   "vertical", states::VERTICAL,
                   "horizontal", states::HORIZONTAL),
 
   // eARIAPressed
-  nsStateMapEntry(&nsAccessibilityAtoms::aria_pressed, kMixedType,
+  nsStateMapEntry(&nsGkAtoms::aria_pressed, kMixedType,
                   states::CHECKABLE, states::PRESSED),
 
   // eARIAReadonly
-  nsStateMapEntry(&nsAccessibilityAtoms::aria_readonly, kBoolType,
+  nsStateMapEntry(&nsGkAtoms::aria_readonly, kBoolType,
                   0, states::READONLY),
 
   // eARIAReadonlyOrEditable
-  nsStateMapEntry(&nsAccessibilityAtoms::aria_readonly, kBoolType,
+  nsStateMapEntry(&nsGkAtoms::aria_readonly, kBoolType,
                   0, states::READONLY, states::EDITABLE, PR_TRUE),
 
   // eARIARequired
-  nsStateMapEntry(&nsAccessibilityAtoms::aria_required, kBoolType,
+  nsStateMapEntry(&nsGkAtoms::aria_required, kBoolType,
                   0, states::REQUIRED),
 
   // eARIASelectable
-  nsStateMapEntry(&nsAccessibilityAtoms::aria_selected, kBoolType,
+  nsStateMapEntry(&nsGkAtoms::aria_selected, kBoolType,
                   states::SELECTABLE, states::SELECTED, 0, PR_TRUE)
 };
 
@@ -696,40 +695,40 @@ eStateMapEntryID nsARIAMap::gWAIUnivStateMap[] = {
  * @note ARIA attributes that don't have any flags are not included here
  */
 nsAttributeCharacteristics nsARIAMap::gWAIUnivAttrMap[] = {
-  {&nsAccessibilityAtoms::aria_activedescendant,  ATTR_BYPASSOBJ                 },
-  {&nsAccessibilityAtoms::aria_atomic,                             ATTR_VALTOKEN },
-  {&nsAccessibilityAtoms::aria_busy,                               ATTR_VALTOKEN },
-  {&nsAccessibilityAtoms::aria_checked,           ATTR_BYPASSOBJ | ATTR_VALTOKEN }, /* exposes checkable obj attr */
-  {&nsAccessibilityAtoms::aria_controls,          ATTR_BYPASSOBJ                 },
-  {&nsAccessibilityAtoms::aria_describedby,       ATTR_BYPASSOBJ                 },
-  {&nsAccessibilityAtoms::aria_disabled,          ATTR_BYPASSOBJ | ATTR_VALTOKEN },
-  {&nsAccessibilityAtoms::aria_dropeffect,                         ATTR_VALTOKEN },
-  {&nsAccessibilityAtoms::aria_expanded,          ATTR_BYPASSOBJ | ATTR_VALTOKEN },
-  {&nsAccessibilityAtoms::aria_flowto,            ATTR_BYPASSOBJ                 },  
-  {&nsAccessibilityAtoms::aria_grabbed,                            ATTR_VALTOKEN },
-  {&nsAccessibilityAtoms::aria_haspopup,          ATTR_BYPASSOBJ | ATTR_VALTOKEN },
-  {&nsAccessibilityAtoms::aria_hidden,                             ATTR_VALTOKEN },/* always expose obj attr */
-  {&nsAccessibilityAtoms::aria_invalid,           ATTR_BYPASSOBJ | ATTR_VALTOKEN },
-  {&nsAccessibilityAtoms::aria_label,             ATTR_BYPASSOBJ                 },
-  {&nsAccessibilityAtoms::aria_labelledby,        ATTR_BYPASSOBJ                 },
-  {&nsAccessibilityAtoms::aria_level,             ATTR_BYPASSOBJ                 }, /* handled via groupPosition */
-  {&nsAccessibilityAtoms::aria_live,                               ATTR_VALTOKEN },
-  {&nsAccessibilityAtoms::aria_multiline,         ATTR_BYPASSOBJ | ATTR_VALTOKEN },
-  {&nsAccessibilityAtoms::aria_multiselectable,   ATTR_BYPASSOBJ | ATTR_VALTOKEN },
-  {&nsAccessibilityAtoms::aria_owns,              ATTR_BYPASSOBJ                 },
-  {&nsAccessibilityAtoms::aria_orientation,                        ATTR_VALTOKEN },
-  {&nsAccessibilityAtoms::aria_posinset,          ATTR_BYPASSOBJ                 }, /* handled via groupPosition */
-  {&nsAccessibilityAtoms::aria_pressed,           ATTR_BYPASSOBJ | ATTR_VALTOKEN },
-  {&nsAccessibilityAtoms::aria_readonly,          ATTR_BYPASSOBJ | ATTR_VALTOKEN },
-  {&nsAccessibilityAtoms::aria_relevant,          ATTR_BYPASSOBJ                 },
-  {&nsAccessibilityAtoms::aria_required,          ATTR_BYPASSOBJ | ATTR_VALTOKEN },
-  {&nsAccessibilityAtoms::aria_selected,          ATTR_BYPASSOBJ | ATTR_VALTOKEN },
-  {&nsAccessibilityAtoms::aria_setsize,           ATTR_BYPASSOBJ                 }, /* handled via groupPosition */
-  {&nsAccessibilityAtoms::aria_sort,                               ATTR_VALTOKEN },
-  {&nsAccessibilityAtoms::aria_valuenow,          ATTR_BYPASSOBJ                 },
-  {&nsAccessibilityAtoms::aria_valuemin,          ATTR_BYPASSOBJ                 },
-  {&nsAccessibilityAtoms::aria_valuemax,          ATTR_BYPASSOBJ                 },
-  {&nsAccessibilityAtoms::aria_valuetext,         ATTR_BYPASSOBJ                 }
+  {&nsGkAtoms::aria_activedescendant,  ATTR_BYPASSOBJ                 },
+  {&nsGkAtoms::aria_atomic,                             ATTR_VALTOKEN },
+  {&nsGkAtoms::aria_busy,                               ATTR_VALTOKEN },
+  {&nsGkAtoms::aria_checked,           ATTR_BYPASSOBJ | ATTR_VALTOKEN }, /* exposes checkable obj attr */
+  {&nsGkAtoms::aria_controls,          ATTR_BYPASSOBJ                 },
+  {&nsGkAtoms::aria_describedby,       ATTR_BYPASSOBJ                 },
+  {&nsGkAtoms::aria_disabled,          ATTR_BYPASSOBJ | ATTR_VALTOKEN },
+  {&nsGkAtoms::aria_dropeffect,                         ATTR_VALTOKEN },
+  {&nsGkAtoms::aria_expanded,          ATTR_BYPASSOBJ | ATTR_VALTOKEN },
+  {&nsGkAtoms::aria_flowto,            ATTR_BYPASSOBJ                 },  
+  {&nsGkAtoms::aria_grabbed,                            ATTR_VALTOKEN },
+  {&nsGkAtoms::aria_haspopup,          ATTR_BYPASSOBJ | ATTR_VALTOKEN },
+  {&nsGkAtoms::aria_hidden,                             ATTR_VALTOKEN },/* always expose obj attr */
+  {&nsGkAtoms::aria_invalid,           ATTR_BYPASSOBJ | ATTR_VALTOKEN },
+  {&nsGkAtoms::aria_label,             ATTR_BYPASSOBJ                 },
+  {&nsGkAtoms::aria_labelledby,        ATTR_BYPASSOBJ                 },
+  {&nsGkAtoms::aria_level,             ATTR_BYPASSOBJ                 }, /* handled via groupPosition */
+  {&nsGkAtoms::aria_live,                               ATTR_VALTOKEN },
+  {&nsGkAtoms::aria_multiline,         ATTR_BYPASSOBJ | ATTR_VALTOKEN },
+  {&nsGkAtoms::aria_multiselectable,   ATTR_BYPASSOBJ | ATTR_VALTOKEN },
+  {&nsGkAtoms::aria_owns,              ATTR_BYPASSOBJ                 },
+  {&nsGkAtoms::aria_orientation,                        ATTR_VALTOKEN },
+  {&nsGkAtoms::aria_posinset,          ATTR_BYPASSOBJ                 }, /* handled via groupPosition */
+  {&nsGkAtoms::aria_pressed,           ATTR_BYPASSOBJ | ATTR_VALTOKEN },
+  {&nsGkAtoms::aria_readonly,          ATTR_BYPASSOBJ | ATTR_VALTOKEN },
+  {&nsGkAtoms::aria_relevant,          ATTR_BYPASSOBJ                 },
+  {&nsGkAtoms::aria_required,          ATTR_BYPASSOBJ | ATTR_VALTOKEN },
+  {&nsGkAtoms::aria_selected,          ATTR_BYPASSOBJ | ATTR_VALTOKEN },
+  {&nsGkAtoms::aria_setsize,           ATTR_BYPASSOBJ                 }, /* handled via groupPosition */
+  {&nsGkAtoms::aria_sort,                               ATTR_VALTOKEN },
+  {&nsGkAtoms::aria_valuenow,          ATTR_BYPASSOBJ                 },
+  {&nsGkAtoms::aria_valuemin,          ATTR_BYPASSOBJ                 },
+  {&nsGkAtoms::aria_valuemax,          ATTR_BYPASSOBJ                 },
+  {&nsGkAtoms::aria_valuetext,         ATTR_BYPASSOBJ                 }
 };
 
 PRUint32 nsARIAMap::gWAIUnivAttrMapLength = NS_ARRAY_LENGTH(nsARIAMap::gWAIUnivAttrMap);
@@ -833,9 +832,9 @@ nsStateMapEntry::MapToStates(nsIContent* aContent, PRUint64* aState,
     // bail out and not explore a state mapping, which is safe.
     if (!hasAttr ||
         aContent->AttrValueIs(kNameSpaceID_None, *entry.mAttributeName,
-                              nsAccessibilityAtoms::_empty, eCaseMatters) ||
+                              nsGkAtoms::_empty, eCaseMatters) ||
         aContent->AttrValueIs(kNameSpaceID_None, *entry.mAttributeName,
-                              nsAccessibilityAtoms::_undefined, eCaseMatters)) {
+                              nsGkAtoms::_undefined, eCaseMatters)) {
 
       if (entry.mPermanentState)
         *aState &= ~entry.mPermanentState;
diff --git a/accessible/src/base/nsAccUtils.cpp b/accessible/src/base/nsAccUtils.cpp
index 11a3d8dcf00a..d11521aa21c7 100644
--- a/accessible/src/base/nsAccUtils.cpp
+++ b/accessible/src/base/nsAccUtils.cpp
@@ -43,7 +43,6 @@
 #include "nsIAccessibleTypes.h"
 
 #include "nsAccessibilityService.h"
-#include "nsAccessibilityAtoms.h"
 #include "nsARIAMap.h"
 #include "nsDocAccessible.h"
 #include "nsHyperTextAccessible.h"
@@ -88,17 +87,17 @@ nsAccUtils::SetAccGroupAttrs(nsIPersistentProperties *aAttributes,
 
   if (aLevel) {
     value.AppendInt(aLevel);
-    SetAccAttr(aAttributes, nsAccessibilityAtoms::level, value);
+    SetAccAttr(aAttributes, nsGkAtoms::level, value);
   }
 
   if (aSetSize && aPosInSet) {
     value.Truncate();
     value.AppendInt(aPosInSet);
-    SetAccAttr(aAttributes, nsAccessibilityAtoms::posinset, value);
+    SetAccAttr(aAttributes, nsGkAtoms::posinset, value);
 
     value.Truncate();
     value.AppendInt(aSetSize);
-    SetAccAttr(aAttributes, nsAccessibilityAtoms::setsize, value);
+    SetAccAttr(aAttributes, nsGkAtoms::setsize, value);
   }
 }
 
@@ -127,7 +126,7 @@ nsAccUtils::GetARIAOrDefaultLevel(nsAccessible *aAccessible)
 {
   PRInt32 level = 0;
   nsCoreUtils::GetUIntAttr(aAccessible->GetContent(),
-                           nsAccessibilityAtoms::aria_level, &level);
+                           nsGkAtoms::aria_level, &level);
 
   if (level != 0)
     return level;
@@ -276,25 +275,25 @@ nsAccUtils::SetLiveContainerAttributes(nsIPersistentProperties *aAttributes,
 
     // container-relevant attribute
     if (relevant.IsEmpty() &&
-        nsAccUtils::HasDefinedARIAToken(ancestor, nsAccessibilityAtoms::aria_relevant) &&
-        ancestor->GetAttr(kNameSpaceID_None, nsAccessibilityAtoms::aria_relevant, relevant))
-      SetAccAttr(aAttributes, nsAccessibilityAtoms::containerRelevant, relevant);
+        nsAccUtils::HasDefinedARIAToken(ancestor, nsGkAtoms::aria_relevant) &&
+        ancestor->GetAttr(kNameSpaceID_None, nsGkAtoms::aria_relevant, relevant))
+      SetAccAttr(aAttributes, nsGkAtoms::containerRelevant, relevant);
 
     // container-live, and container-live-role attributes
     if (live.IsEmpty()) {
       nsRoleMapEntry *role = GetRoleMapEntry(ancestor);
       if (nsAccUtils::HasDefinedARIAToken(ancestor,
-                                          nsAccessibilityAtoms::aria_live)) {
-        ancestor->GetAttr(kNameSpaceID_None, nsAccessibilityAtoms::aria_live,
+                                          nsGkAtoms::aria_live)) {
+        ancestor->GetAttr(kNameSpaceID_None, nsGkAtoms::aria_live,
                           live);
       } else if (role) {
         GetLiveAttrValue(role->liveAttRule, live);
       }
       if (!live.IsEmpty()) {
-        SetAccAttr(aAttributes, nsAccessibilityAtoms::containerLive, live);
+        SetAccAttr(aAttributes, nsGkAtoms::containerLive, live);
         if (role) {
           nsAccUtils::SetAccAttr(aAttributes,
-                                 nsAccessibilityAtoms::containerLiveRole,
+                                 nsGkAtoms::containerLiveRole,
                                  NS_ConvertASCIItoUTF16(role->roleString));
         }
       }
@@ -302,15 +301,15 @@ nsAccUtils::SetLiveContainerAttributes(nsIPersistentProperties *aAttributes,
 
     // container-atomic attribute
     if (atomic.IsEmpty() &&
-        nsAccUtils::HasDefinedARIAToken(ancestor, nsAccessibilityAtoms::aria_atomic) &&
-        ancestor->GetAttr(kNameSpaceID_None, nsAccessibilityAtoms::aria_atomic, atomic))
-      SetAccAttr(aAttributes, nsAccessibilityAtoms::containerAtomic, atomic);
+        nsAccUtils::HasDefinedARIAToken(ancestor, nsGkAtoms::aria_atomic) &&
+        ancestor->GetAttr(kNameSpaceID_None, nsGkAtoms::aria_atomic, atomic))
+      SetAccAttr(aAttributes, nsGkAtoms::containerAtomic, atomic);
 
     // container-busy attribute
     if (busy.IsEmpty() &&
-        nsAccUtils::HasDefinedARIAToken(ancestor, nsAccessibilityAtoms::aria_busy) &&
-        ancestor->GetAttr(kNameSpaceID_None, nsAccessibilityAtoms::aria_busy, busy))
-      SetAccAttr(aAttributes, nsAccessibilityAtoms::containerBusy, busy);
+        nsAccUtils::HasDefinedARIAToken(ancestor, nsGkAtoms::aria_busy) &&
+        ancestor->GetAttr(kNameSpaceID_None, nsGkAtoms::aria_busy, busy))
+      SetAccAttr(aAttributes, nsGkAtoms::containerBusy, busy);
 
     if (ancestor == aTopContent)
       break;
@@ -328,9 +327,9 @@ nsAccUtils::HasDefinedARIAToken(nsIContent *aContent, nsIAtom *aAtom)
 
   if (!aContent->HasAttr(kNameSpaceID_None, aAtom) ||
       aContent->AttrValueIs(kNameSpaceID_None, aAtom,
-                            nsAccessibilityAtoms::_empty, eCaseMatters) ||
+                            nsGkAtoms::_empty, eCaseMatters) ||
       aContent->AttrValueIs(kNameSpaceID_None, aAtom,
-                            nsAccessibilityAtoms::_undefined, eCaseMatters)) {
+                            nsGkAtoms::_undefined, eCaseMatters)) {
         return PR_FALSE;
   }
   return PR_TRUE;
@@ -340,11 +339,11 @@ nsIAtom*
 nsAccUtils::GetARIAToken(dom::Element* aElement, nsIAtom* aAttr)
 {
   if (!nsAccUtils::HasDefinedARIAToken(aElement, aAttr))
-    return nsAccessibilityAtoms::_empty;
+    return nsGkAtoms::_empty;
 
   static nsIContent::AttrValuesArray tokens[] =
-    { &nsAccessibilityAtoms::_false, &nsAccessibilityAtoms::_true,
-      &nsAccessibilityAtoms::mixed, nsnull};
+    { &nsGkAtoms::_false, &nsGkAtoms::_true,
+      &nsGkAtoms::mixed, nsnull};
 
   PRInt32 idx = aElement->FindAttrValueIn(kNameSpaceID_None,
                                           aAttr, tokens, eCaseMatters);
@@ -405,8 +404,8 @@ PRBool
 nsAccUtils::IsARIASelected(nsAccessible *aAccessible)
 {
   return aAccessible->GetContent()->
-    AttrValueIs(kNameSpaceID_None, nsAccessibilityAtoms::aria_selected,
-                nsAccessibilityAtoms::_true, eCaseMatters);
+    AttrValueIs(kNameSpaceID_None, nsGkAtoms::aria_selected,
+                nsGkAtoms::_true, eCaseMatters);
 }
 
 nsHyperTextAccessible*
@@ -545,7 +544,7 @@ nsAccUtils::GetRoleMapEntry(nsINode *aNode)
   nsIContent *content = nsCoreUtils::GetRoleContent(aNode);
   nsAutoString roleString;
   if (!content ||
-      !content->GetAttr(kNameSpaceID_None, nsAccessibilityAtoms::role, roleString) ||
+      !content->GetAttr(kNameSpaceID_None, nsGkAtoms::role, roleString) ||
       roleString.IsEmpty()) {
     // We treat role="" as if the role attribute is absent (per aria spec:8.1.1)
     return nsnull;
diff --git a/accessible/src/base/nsAccessNode.cpp b/accessible/src/base/nsAccessNode.cpp
index 32f204bfd2ff..a1220f0a08ba 100644
--- a/accessible/src/base/nsAccessNode.cpp
+++ b/accessible/src/base/nsAccessNode.cpp
@@ -41,7 +41,6 @@
 #include "nsIAccessible.h"
 
 #include "nsAccCache.h"
-#include "nsAccessibilityAtoms.h"
 #include "nsAccUtils.h"
 #include "nsCoreUtils.h"
 
@@ -198,8 +197,6 @@ void nsAccessNode::InitXPAccessibility()
                                       &gStringBundle);
   }
 
-  nsAccessibilityAtoms::AddRefAtoms();
-
   nsCOMPtr<nsIPrefBranch> prefBranch(do_GetService(NS_PREFSERVICE_CONTRACTID));
   if (prefBranch) {
     prefBranch->GetBoolPref("browser.formfill.enable", &gIsFormFillEnabled);
@@ -472,7 +469,7 @@ nsAccessNode::GetLanguage(nsAString& aLanguage)
   if (aLanguage.IsEmpty()) { // Nothing found, so use document's language
     nsIDocument *doc = mContent->GetOwnerDoc();
     if (doc) {
-      doc->GetHeaderData(nsAccessibilityAtoms::headerContentLanguage, aLanguage);
+      doc->GetHeaderData(nsGkAtoms::headerContentLanguage, aLanguage);
     }
   }
  
diff --git a/accessible/src/base/nsAccessibilityAtomList.h b/accessible/src/base/nsAccessibilityAtomList.h
deleted file mode 100644
index e7dcf7dd3ce0..000000000000
--- a/accessible/src/base/nsAccessibilityAtomList.h
+++ /dev/null
@@ -1,300 +0,0 @@
-/* -*- Mode: C++; tab-width: 2; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
-/* ***** BEGIN LICENSE BLOCK *****
- * Version: MPL 1.1/GPL 2.0/LGPL 2.1
- *
- * The contents of this file are subject to the Mozilla Public License Version
- * 1.1 (the "License"); you may not use this file except in compliance with
- * the License. You may obtain a copy of the License at
- * http://www.mozilla.org/MPL/
- *
- * Software distributed under the License is distributed on an "AS IS" basis,
- * WITHOUT WARRANTY OF ANY KIND, either express or implied. See the License
- * for the specific language governing rights and limitations under the
- * License.
- *
- * The Original Code is mozilla.org code.
- *
- * The Initial Developer of the Original Code is
- * Netscape Communications Corporation.
- * Portions created by the Initial Developer are Copyright (C) 2003
- * the Initial Developer. All Rights Reserved.
- *
- * Contributor(s):
- *   Original Author: Aaron Leventhal (aaronl@netscape.com)
- *
- * Alternatively, the contents of this file may be used under the terms of
- * either of the GNU General Public License Version 2 or later (the "GPL"),
- * or the GNU Lesser General Public License Version 2.1 or later (the "LGPL"),
- * in which case the provisions of the GPL or the LGPL are applicable instead
- * of those above. If you wish to allow use of your version of this file only
- * under the terms of either the GPL or the LGPL, and not to allow others to
- * use your version of this file under the terms of the MPL, indicate your
- * decision by deleting the provisions above and replace them with the notice
- * and other provisions required by the GPL or the LGPL. If you do not delete
- * the provisions above, a recipient may use your version of this file under
- * the terms of any one of the MPL, the GPL or the LGPL.
- *
- * ***** END LICENSE BLOCK ***** */
-
-/******
-
-  This file contains the list of all accessibility nsIAtoms and their values
-
-  It is designed to be used as inline input to nsAccessibilityAtoms.cpp *only*
-  through the magic of C preprocessing.
-
-  All entries must be enclosed in the macro ACCESSIBILITY_ATOM which will have cruel
-  and unusual things done to it
-
-  It is recommended (but not strictly necessary) to keep all entries
-  in alphabetical order
-
-  The first argument to ACCESSIBILITY_ATOM is the C++ identifier of the atom
-  The second argument is the string value of the atom
-
- ******/
-
-
-  // Alphabetical list of generic atoms
-ACCESSIBILITY_ATOM(button, "button")
-ACCESSIBILITY_ATOM(checkbox, "checkbox")
-ACCESSIBILITY_ATOM(col, "col")
-ACCESSIBILITY_ATOM(_empty, "")
-ACCESSIBILITY_ATOM(_false, "false")
-ACCESSIBILITY_ATOM(image, "image")
-ACCESSIBILITY_ATOM(menu, "menu")
-ACCESSIBILITY_ATOM(menuButton, "menu-button")
-ACCESSIBILITY_ATOM(multiple, "multiple")
-ACCESSIBILITY_ATOM(mixed, "mixed")
-ACCESSIBILITY_ATOM(open, "open")
-ACCESSIBILITY_ATOM(password, "password")
-ACCESSIBILITY_ATOM(radio, "radio")
-ACCESSIBILITY_ATOM(reset, "reset")
-ACCESSIBILITY_ATOM(row, "row")
-ACCESSIBILITY_ATOM(submit, "submit")
-ACCESSIBILITY_ATOM(_true, "true")
-ACCESSIBILITY_ATOM(_undefined, "undefined")
-
-  // Header info
-ACCESSIBILITY_ATOM(headerContentLanguage, "content-language")
-
-  // Alphabetical list of frame types
-ACCESSIBILITY_ATOM(areaFrame, "AreaFrame")
-ACCESSIBILITY_ATOM(blockFrame, "BlockFrame")
-ACCESSIBILITY_ATOM(boxFrame, "BoxFrame")
-ACCESSIBILITY_ATOM(brFrame, "BRFrame")
-ACCESSIBILITY_ATOM(deckFrame, "DeckFrame")
-ACCESSIBILITY_ATOM(inlineBlockFrame, "InlineBlockFrame")
-ACCESSIBILITY_ATOM(inlineFrame, "InlineFrame")
-ACCESSIBILITY_ATOM(objectFrame, "ObjectFrame")
-ACCESSIBILITY_ATOM(scrollFrame, "ScrollFrame")
-ACCESSIBILITY_ATOM(textFrame, "TextFrame")
-ACCESSIBILITY_ATOM(tableCaptionFrame, "TableCaptionFrame")
-ACCESSIBILITY_ATOM(tableCellFrame, "TableCellFrame")
-ACCESSIBILITY_ATOM(tableOuterFrame, "TableOuterFrame")
-ACCESSIBILITY_ATOM(tableRowGroupFrame, "TableRowGroupFrame")
-ACCESSIBILITY_ATOM(tableRowFrame, "TableRowFrame")
-
-  // Alphabetical list of tag names
-ACCESSIBILITY_ATOM(a, "a")
-ACCESSIBILITY_ATOM(abbr, "abbr")
-ACCESSIBILITY_ATOM(acronym, "acronym")
-ACCESSIBILITY_ATOM(area, "area")
-ACCESSIBILITY_ATOM(article, "article") // HTML landmark
-ACCESSIBILITY_ATOM(aside, "aside") // HTML landmark
-ACCESSIBILITY_ATOM(autocomplete, "autocomplete")
-ACCESSIBILITY_ATOM(blockquote, "blockquote")
-ACCESSIBILITY_ATOM(br, "br")
-ACCESSIBILITY_ATOM(body, "body")
-ACCESSIBILITY_ATOM(caption, "caption") // XUL
-ACCESSIBILITY_ATOM(choices, "choices") // XForms
-ACCESSIBILITY_ATOM(description, "description")    // XUL
-ACCESSIBILITY_ATOM(dd, "dd")
-ACCESSIBILITY_ATOM(div, "div")
-ACCESSIBILITY_ATOM(dl, "dl")
-ACCESSIBILITY_ATOM(dt, "dt")
-ACCESSIBILITY_ATOM(footer, "footer") // HTML landmark
-ACCESSIBILITY_ATOM(form, "form")
-ACCESSIBILITY_ATOM(header, "header") // HTML landmark
-ACCESSIBILITY_ATOM(h1, "h1")
-ACCESSIBILITY_ATOM(h2, "h2")
-ACCESSIBILITY_ATOM(h3, "h3")
-ACCESSIBILITY_ATOM(h4, "h4")
-ACCESSIBILITY_ATOM(h5, "h5")
-ACCESSIBILITY_ATOM(h6, "h6")
-ACCESSIBILITY_ATOM(item, "item") // XForms
-ACCESSIBILITY_ATOM(itemset, "itemset") // XForms
-ACCESSIBILITY_ATOM(img, "img")
-ACCESSIBILITY_ATOM(input, "input")
-ACCESSIBILITY_ATOM(label, "label")
-ACCESSIBILITY_ATOM(legend, "legend")
-ACCESSIBILITY_ATOM(li, "li")
-ACCESSIBILITY_ATOM(link, "link")
-ACCESSIBILITY_ATOM(listcell, "listcell") // XUL
-ACCESSIBILITY_ATOM(listcols, "listcols") // XUL
-ACCESSIBILITY_ATOM(listcol, "listcol") // XUL
-ACCESSIBILITY_ATOM(listhead, "listhead") // XUL
-ACCESSIBILITY_ATOM(listheader, "listheader") // XUL
-ACCESSIBILITY_ATOM(map, "map")
-ACCESSIBILITY_ATOM(math, "math")
-ACCESSIBILITY_ATOM(menupopup, "menupopup")     // XUL
-ACCESSIBILITY_ATOM(object, "object")
-ACCESSIBILITY_ATOM(nav, "nav") // HTML landmark
-ACCESSIBILITY_ATOM(ol, "ol")
-ACCESSIBILITY_ATOM(optgroup, "optgroup")
-ACCESSIBILITY_ATOM(option, "option")
-ACCESSIBILITY_ATOM(output, "output")
-ACCESSIBILITY_ATOM(panel, "panel") // XUL
-ACCESSIBILITY_ATOM(progress, "progress")
-ACCESSIBILITY_ATOM(q, "q")
-ACCESSIBILITY_ATOM(select, "select")
-ACCESSIBILITY_ATOM(select1, "select1") // XForms
-ACCESSIBILITY_ATOM(svg, "svg")
-ACCESSIBILITY_ATOM(table, "table")
-ACCESSIBILITY_ATOM(tabpanels, "tabpanels") // XUL
-ACCESSIBILITY_ATOM(tbody, "tbody")
-ACCESSIBILITY_ATOM(td, "td")
-ACCESSIBILITY_ATOM(th, "th")
-ACCESSIBILITY_ATOM(tfoot, "tfoot")
-ACCESSIBILITY_ATOM(thead, "thead")
-ACCESSIBILITY_ATOM(textarea, "textarea") // XForms
-ACCESSIBILITY_ATOM(textbox, "textbox")   // XUL
-ACCESSIBILITY_ATOM(toolbaritem, "toolbaritem")   // XUL
-ACCESSIBILITY_ATOM(toolbarseparator, "toolbarseparator")   // XUL
-ACCESSIBILITY_ATOM(toolbarspring, "toolbarspring")   // XUL
-ACCESSIBILITY_ATOM(toolbarspacer, "toolbarspacer")   // XUL
-ACCESSIBILITY_ATOM(tooltip, "tooltip")   // XUL
-ACCESSIBILITY_ATOM(tr, "tr")
-ACCESSIBILITY_ATOM(tree, "tree")
-ACCESSIBILITY_ATOM(ul, "ul")
-
-  // Alphabetical list of attributes (DOM)
-ACCESSIBILITY_ATOM(acceltext, "acceltext")
-ACCESSIBILITY_ATOM(accesskey, "accesskey")
-ACCESSIBILITY_ATOM(alt, "alt")
-ACCESSIBILITY_ATOM(anonid, "anonid") // Used for ID's in XBL
-ACCESSIBILITY_ATOM(checked, "checked")
-ACCESSIBILITY_ATOM(contenteditable, "contenteditable")
-ACCESSIBILITY_ATOM(control, "control")
-ACCESSIBILITY_ATOM(disabled, "disabled")
-ACCESSIBILITY_ATOM(_class, "class")
-ACCESSIBILITY_ATOM(cycles, "cycles") // used for XUL cycler attribute
-ACCESSIBILITY_ATOM(curpos, "curpos") // XUL
-ACCESSIBILITY_ATOM(data, "data")
-ACCESSIBILITY_ATOM(_default, "default") // XUL button
-ACCESSIBILITY_ATOM(draggable, "draggable")
-ACCESSIBILITY_ATOM(droppable, "droppable")   // XUL combo box
-ACCESSIBILITY_ATOM(editable, "editable")
-ACCESSIBILITY_ATOM(_for, "for")
-ACCESSIBILITY_ATOM(headers, "headers")   // HTML table
-ACCESSIBILITY_ATOM(hidden, "hidden")   // XUL tree columns
-ACCESSIBILITY_ATOM(hover, "hover") // XUL color picker
-ACCESSIBILITY_ATOM(href, "href") // XUL, XLink
-ACCESSIBILITY_ATOM(increment, "increment") // XUL
-ACCESSIBILITY_ATOM(lang, "lang")
-ACCESSIBILITY_ATOM(linkedPanel, "linkedpanel") // XUL
-ACCESSIBILITY_ATOM(longDesc, "longdesc")
-ACCESSIBILITY_ATOM(max, "max") // XUL
-ACCESSIBILITY_ATOM(maxpos, "maxpos") // XUL
-ACCESSIBILITY_ATOM(minpos, "minpos") // XUL
-ACCESSIBILITY_ATOM(_moz_menuactive, "_moz-menuactive") // XUL
-ACCESSIBILITY_ATOM(multiline, "multiline") // XUL
-ACCESSIBILITY_ATOM(name, "name")
-ACCESSIBILITY_ATOM(onclick, "onclick")
-ACCESSIBILITY_ATOM(popup, "popup")
-ACCESSIBILITY_ATOM(placeholder, "placeholder")
-ACCESSIBILITY_ATOM(readonly, "readonly")
-ACCESSIBILITY_ATOM(scope, "scope") // HTML table
-ACCESSIBILITY_ATOM(seltype, "seltype") // XUL listbox
-ACCESSIBILITY_ATOM(simple, "simple") // XLink
-ACCESSIBILITY_ATOM(src, "src")
-ACCESSIBILITY_ATOM(selected, "selected")
-ACCESSIBILITY_ATOM(summary, "summary")
-ACCESSIBILITY_ATOM(tabindex, "tabindex")
-ACCESSIBILITY_ATOM(title, "title")
-ACCESSIBILITY_ATOM(toolbarname, "toolbarname")
-ACCESSIBILITY_ATOM(tooltiptext, "tooltiptext")
-ACCESSIBILITY_ATOM(type, "type")
-ACCESSIBILITY_ATOM(usemap, "usemap")
-ACCESSIBILITY_ATOM(value, "value")
-
-  // Alphabetical list of object attributes
-ACCESSIBILITY_ATOM(checkable, "checkable")
-ACCESSIBILITY_ATOM(display, "display")
-ACCESSIBILITY_ATOM(eventFromInput, "event-from-input")
-ACCESSIBILITY_ATOM(textAlign, "text-align")
-ACCESSIBILITY_ATOM(textIndent, "text-indent")
-
-  // Alphabetical list of text attributes (AT API)
-ACCESSIBILITY_ATOM(color, "color")
-ACCESSIBILITY_ATOM(backgroundColor, "background-color")
-ACCESSIBILITY_ATOM(fontFamily, "font-family")
-ACCESSIBILITY_ATOM(fontStyle, "font-style")
-ACCESSIBILITY_ATOM(fontWeight, "font-weight")
-ACCESSIBILITY_ATOM(fontSize, "font-size")
-ACCESSIBILITY_ATOM(invalid, "invalid")
-ACCESSIBILITY_ATOM(language, "language")
-ACCESSIBILITY_ATOM(textLineThroughStyle, "text-line-through-style")
-ACCESSIBILITY_ATOM(textUnderlineStyle, "text-underline-style")
-ACCESSIBILITY_ATOM(textPosition, "text-position")
-
-  // ARIA (DHTML accessibility) attributes
-  // Also add to nsARIAMap.cpp and nsARIAMap.h
-  // ARIA role attribute
-ACCESSIBILITY_ATOM(role, "role")
-ACCESSIBILITY_ATOM(aria_activedescendant, "aria-activedescendant")
-ACCESSIBILITY_ATOM(aria_atomic, "aria-atomic")
-ACCESSIBILITY_ATOM(aria_autocomplete, "aria-autocomplete")
-ACCESSIBILITY_ATOM(aria_busy, "aria-busy")
-ACCESSIBILITY_ATOM(aria_checked, "aria-checked")
-ACCESSIBILITY_ATOM(aria_controls, "aria-controls")
-ACCESSIBILITY_ATOM(aria_describedby, "aria-describedby")
-ACCESSIBILITY_ATOM(aria_disabled, "aria-disabled")
-ACCESSIBILITY_ATOM(aria_dropeffect, "aria-dropeffect")
-ACCESSIBILITY_ATOM(aria_expanded, "aria-expanded")
-ACCESSIBILITY_ATOM(aria_flowto, "aria-flowto")
-ACCESSIBILITY_ATOM(aria_grabbed, "aria-grabbed")
-ACCESSIBILITY_ATOM(aria_haspopup, "aria-haspopup")
-ACCESSIBILITY_ATOM(aria_hidden, "aria-hidden")
-ACCESSIBILITY_ATOM(aria_invalid, "aria-invalid")
-ACCESSIBILITY_ATOM(aria_label, "aria-label")
-ACCESSIBILITY_ATOM(aria_labelledby, "aria-labelledby")
-ACCESSIBILITY_ATOM(aria_level, "aria-level")
-ACCESSIBILITY_ATOM(aria_live, "aria-live")
-ACCESSIBILITY_ATOM(aria_multiline, "aria-multiline")
-ACCESSIBILITY_ATOM(aria_multiselectable, "aria-multiselectable")
-ACCESSIBILITY_ATOM(aria_orientation, "aria-orientation")
-ACCESSIBILITY_ATOM(aria_owns, "aria-owns")
-ACCESSIBILITY_ATOM(aria_posinset, "aria-posinset")
-ACCESSIBILITY_ATOM(aria_pressed, "aria-pressed")
-ACCESSIBILITY_ATOM(aria_readonly, "aria-readonly")
-ACCESSIBILITY_ATOM(aria_relevant, "aria-relevant")
-ACCESSIBILITY_ATOM(aria_required, "aria-required")
-ACCESSIBILITY_ATOM(aria_selected, "aria-selected")
-ACCESSIBILITY_ATOM(aria_setsize, "aria-setsize")
-ACCESSIBILITY_ATOM(aria_sort, "aria-sort")
-ACCESSIBILITY_ATOM(aria_valuenow, "aria-valuenow")
-ACCESSIBILITY_ATOM(aria_valuemin, "aria-valuemin")
-ACCESSIBILITY_ATOM(aria_valuemax, "aria-valuemax")
-ACCESSIBILITY_ATOM(aria_valuetext, "aria-valuetext")
-
-  // misc atoms
-// a form property used to obtain the default label
-// of an HTML button from the button frame
-ACCESSIBILITY_ATOM(defaultLabel, "defaultLabel")
-// the attribute specifying the editor's bogus br node
-ACCESSIBILITY_ATOM(mozeditorbogusnode, "_moz_editor_bogus_node")
-
-// Object attributes
-ACCESSIBILITY_ATOM(tableCellIndex, "table-cell-index")
-ACCESSIBILITY_ATOM(containerAtomic, "container-atomic")
-ACCESSIBILITY_ATOM(containerBusy, "container-busy")
-ACCESSIBILITY_ATOM(containerLive, "container-live")
-ACCESSIBILITY_ATOM(containerLiveRole, "container-live-role")
-ACCESSIBILITY_ATOM(containerRelevant, "container-relevant")
-ACCESSIBILITY_ATOM(level, "level")
-ACCESSIBILITY_ATOM(live, "live")
-ACCESSIBILITY_ATOM(lineNumber, "line-number")
-ACCESSIBILITY_ATOM(posinset, "posinset") 
-ACCESSIBILITY_ATOM(setsize, "setsize")
-ACCESSIBILITY_ATOM(xmlroles, "xml-roles")
diff --git a/accessible/src/base/nsAccessibilityAtoms.cpp b/accessible/src/base/nsAccessibilityAtoms.cpp
deleted file mode 100644
index d55c0754d9a1..000000000000
--- a/accessible/src/base/nsAccessibilityAtoms.cpp
+++ /dev/null
@@ -1,62 +0,0 @@
-/* -*- Mode: C++; tab-width: 2; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
-/* ***** BEGIN LICENSE BLOCK *****
- * Version: MPL 1.1/GPL 2.0/LGPL 2.1
- *
- * The contents of this file are subject to the Mozilla Public License Version
- * 1.1 (the "License"); you may not use this file except in compliance with
- * the License. You may obtain a copy of the License at
- * http://www.mozilla.org/MPL/
- *
- * Software distributed under the License is distributed on an "AS IS" basis,
- * WITHOUT WARRANTY OF ANY KIND, either express or implied. See the License
- * for the specific language governing rights and limitations under the
- * License.
- *
- * The Original Code is mozilla.org code.
- *
- * The Initial Developer of the Original Code is
- * Netscape Communications Corporation.
- * Portions created by the Initial Developer are Copyright (C) 2003
- * the Initial Developer. All Rights Reserved.
- *
- * Contributor(s):
- *   Original Author: Aaron Leventhal (aaronl@netscape.com)
- *
- * Alternatively, the contents of this file may be used under the terms of
- * either of the GNU General Public License Version 2 or later (the "GPL"),
- * or the GNU Lesser General Public License Version 2.1 or later (the "LGPL"),
- * in which case the provisions of the GPL or the LGPL are applicable instead
- * of those above. If you wish to allow use of your version of this file only
- * under the terms of either the GPL or the LGPL, and not to allow others to
- * use your version of this file under the terms of the MPL, indicate your
- * decision by deleting the provisions above and replace them with the notice
- * and other provisions required by the GPL or the LGPL. If you do not delete
- * the provisions above, a recipient may use your version of this file under
- * the terms of any one of the MPL, the GPL or the LGPL.
- *
- * ***** END LICENSE BLOCK ***** */
-
-#include "nsAccessibilityAtoms.h"
-#include "nsStaticAtom.h"
-#include "nsMemory.h"
-
-// define storage for all accessibility atoms
-#define ACCESSIBILITY_ATOM(_name, _value) nsIAtom* nsAccessibilityAtoms::_name;
-#include "nsAccessibilityAtomList.h"
-#undef ACCESSIBILITY_ATOM
-
-#define ACCESSIBILITY_ATOM(name_, value_) NS_STATIC_ATOM_BUFFER(name_##_buffer, value_)
-#include "nsAccessibilityAtomList.h"
-#undef ACCESSIBILITY_ATOM
-
-static const nsStaticAtom atomInfo[] = {
-#define ACCESSIBILITY_ATOM(name_, value_) NS_STATIC_ATOM(name_##_buffer, &nsAccessibilityAtoms::name_),
-#include "nsAccessibilityAtomList.h"
-#undef ACCESSIBILITY_ATOM
-};
-
-void nsAccessibilityAtoms::AddRefAtoms()
-{
-  NS_RegisterStaticAtoms(atomInfo, NS_ARRAY_LENGTH(atomInfo));
-}
- 
diff --git a/accessible/src/base/nsAccessibilityAtoms.h b/accessible/src/base/nsAccessibilityAtoms.h
deleted file mode 100644
index 8dacce2aadfe..000000000000
--- a/accessible/src/base/nsAccessibilityAtoms.h
+++ /dev/null
@@ -1,67 +0,0 @@
-/* -*- Mode: C++; tab-width: 2; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
-/* ***** BEGIN LICENSE BLOCK *****
- * Version: MPL 1.1/GPL 2.0/LGPL 2.1
- *
- * The contents of this file are subject to the Mozilla Public License Version
- * 1.1 (the "License"); you may not use this file except in compliance with
- * the License. You may obtain a copy of the License at
- * http://www.mozilla.org/MPL/
- *
- * Software distributed under the License is distributed on an "AS IS" basis,
- * WITHOUT WARRANTY OF ANY KIND, either express or implied. See the License
- * for the specific language governing rights and limitations under the
- * License.
- *
- * The Original Code is mozilla.org code.
- *
- * The Initial Developer of the Original Code is
- * Netscape Communications Corporation.
- * Portions created by the Initial Developer are Copyright (C) 1998
- * the Initial Developer. All Rights Reserved.
- *
- * Contributor(s):
- *
- * Alternatively, the contents of this file may be used under the terms of
- * either of the GNU General Public License Version 2 or later (the "GPL"),
- * or the GNU Lesser General Public License Version 2.1 or later (the "LGPL"),
- * in which case the provisions of the GPL or the LGPL are applicable instead
- * of those above. If you wish to allow use of your version of this file only
- * under the terms of either the GPL or the LGPL, and not to allow others to
- * use your version of this file under the terms of the MPL, indicate your
- * decision by deleting the provisions above and replace them with the notice
- * and other provisions required by the GPL or the LGPL. If you do not delete
- * the provisions above, a recipient may use your version of this file under
- * the terms of any one of the MPL, the GPL or the LGPL.
- *
- * ***** END LICENSE BLOCK ***** */
-#ifndef nsAccessibilityAtoms_h___
-#define nsAccessibilityAtoms_h___
-
-#include "nsIAtom.h"
-
-/**
- * This class wraps up the creation (and destruction) of the standard
- * set of atoms used in the accessibility module. These objects
- * are created when the are needed by accessibility is being used and they
- * are destroyed when the last nsRootAccessible is destroyed.
- */
-
-class nsAccessibilityAtoms {
-public:
-
-  static void AddRefAtoms();
-  static void ReleaseAtoms();
-
-  /* Declare all atoms
-
-     The atom names and values are stored in nsAccessibilityAtomList.h and
-     are brought to you by the magic of C preprocessing
-
-     Add new atoms to nsAccessibilityAtomList and all support logic will be auto-generated
-   */
-#define ACCESSIBILITY_ATOM(_name, _value) static nsIAtom* _name;
-#include "nsAccessibilityAtomList.h"
-#undef ACCESSIBILITY_ATOM
-};
-
-#endif /* nsAccessibilityAtoms_h___ */
diff --git a/accessible/src/base/nsAccessibilityService.cpp b/accessible/src/base/nsAccessibilityService.cpp
index e3b0732c531f..25bed2a0334e 100644
--- a/accessible/src/base/nsAccessibilityService.cpp
+++ b/accessible/src/base/nsAccessibilityService.cpp
@@ -37,7 +37,6 @@
  * ***** END LICENSE BLOCK ***** */
 
 // NOTE: alphabetically ordered
-#include "nsAccessibilityAtoms.h"
 #include "nsAccessibilityService.h"
 #include "nsCoreUtils.h"
 #include "nsAccUtils.h"
@@ -274,9 +273,7 @@ nsAccessibilityService::CreateHTMLImageAccessible(nsIContent* aContent,
                                                   nsIPresShell* aPresShell)
 {
   nsAutoString mapElmName;
-  aContent->GetAttr(kNameSpaceID_None,
-                    nsAccessibilityAtoms::usemap,
-                    mapElmName);
+  aContent->GetAttr(kNameSpaceID_None, nsGkAtoms::usemap, mapElmName);
   nsCOMPtr<nsIDOMHTMLMapElement> mapElm;
   if (nsIDocument* document = aContent->GetCurrentDoc()) {
     mapElm = do_QueryInterface(document->FindImageMap(mapElmName));
@@ -891,7 +888,7 @@ static PRBool HasRelatedContent(nsIContent *aContent)
 
   nsIContent *ancestorContent = aContent;
   while ((ancestorContent = ancestorContent->GetParent()) != nsnull) {
-    if (ancestorContent->HasAttr(kNameSpaceID_None, nsAccessibilityAtoms::aria_activedescendant)) {
+    if (ancestorContent->HasAttr(kNameSpaceID_None, nsGkAtoms::aria_activedescendant)) {
         // ancestor has activedescendant property, this content could be active
       return PR_TRUE;
     }
@@ -996,7 +993,7 @@ nsAccessibilityService::GetOrCreateAccessible(nsINode* aNode,
   }
 
   PRBool isHTML = content->IsHTML();
-  if (isHTML && content->Tag() == nsAccessibilityAtoms::map) {
+  if (isHTML && content->Tag() == nsGkAtoms::map) {
     // Create hyper text accessible for HTML map if it is used to group links
     // (see http://www.w3.org/TR/WCAG10-HTML-TECHS/#group-bypass). If the HTML
     // map doesn't have 'name' attribute (or has empty name attribute) then we
@@ -1006,7 +1003,7 @@ nsAccessibilityService::GetOrCreateAccessible(nsINode* aNode,
     // (nsHTMLAreaAccessible) the map contains are attached as children of the
     // appropriate accessible for HTML image (nsHTMLImageAccessible).
     nsAutoString name;
-    content->GetAttr(kNameSpaceID_None, nsAccessibilityAtoms::name, name);
+    content->GetAttr(kNameSpaceID_None, nsGkAtoms::name, name);
     if (!name.IsEmpty()) {
       if (aIsSubtreeHidden)
         *aIsSubtreeHidden = true;
@@ -1036,10 +1033,10 @@ nsAccessibilityService::GetOrCreateAccessible(nsINode* aNode,
     nsIAtom *frameType = weakFrame.GetFrame()->GetType();
 
     PRBool partOfHTMLTable =
-      frameType == nsAccessibilityAtoms::tableCaptionFrame ||
-      frameType == nsAccessibilityAtoms::tableCellFrame ||
-      frameType == nsAccessibilityAtoms::tableRowGroupFrame ||
-      frameType == nsAccessibilityAtoms::tableRowFrame;
+      frameType == nsGkAtoms::tableCaptionFrame ||
+      frameType == nsGkAtoms::tableCellFrame ||
+      frameType == nsGkAtoms::tableRowGroupFrame ||
+      frameType == nsGkAtoms::tableRowFrame;
 
     if (partOfHTMLTable) {
       // Table-related frames don't get table-related roles
@@ -1051,7 +1048,7 @@ nsAccessibilityService::GetOrCreateAccessible(nsINode* aNode,
         if (!tableFrame)
           continue;
 
-        if (tableFrame->GetType() == nsAccessibilityAtoms::tableOuterFrame) {
+        if (tableFrame->GetType() == nsGkAtoms::tableOuterFrame) {
           nsAccessible *tableAccessible =
             GetAccessibleInWeakShell(tableContent, aWeakShell);
 
@@ -1090,7 +1087,7 @@ nsAccessibilityService::GetOrCreateAccessible(nsINode* aNode,
           break;
         }
 
-        if (tableContent->Tag() == nsAccessibilityAtoms::table) {
+        if (tableContent->Tag() == nsGkAtoms::table) {
           // Stop before we are fooled by any additional table ancestors
           // This table cell frameis part of a separate ancestor table.
           tryTagNameOrFrame = PR_FALSE;
@@ -1106,7 +1103,7 @@ nsAccessibilityService::GetOrCreateAccessible(nsINode* aNode,
       // Create ARIA grid/treegrid accessibles if node is not of a child or
       // valid child of HTML table and is not a HTML table.
       if ((!partOfHTMLTable || !tryTagNameOrFrame) &&
-          frameType != nsAccessibilityAtoms::tableOuterFrame) {
+          frameType != nsGkAtoms::tableOuterFrame) {
 
         if (roleMapEntry->role == nsIAccessibleRole::ROLE_TABLE ||
             roleMapEntry->role == nsIAccessibleRole::ROLE_TREE_TABLE) {
@@ -1140,7 +1137,7 @@ nsAccessibilityService::GetOrCreateAccessible(nsINode* aNode,
         if (!f) {
           f = aPresShell->GetRealPrimaryFrameFor(content);
         }
-        if (f->GetType() == nsAccessibilityAtoms::tableCaptionFrame &&
+        if (f->GetType() == nsGkAtoms::tableCaptionFrame &&
            f->GetRect().IsEmpty()) {
           // XXX This is not the ideal place for this code, but right now there
           // is no better place:
@@ -1165,12 +1162,12 @@ nsAccessibilityService::GetOrCreateAccessible(nsINode* aNode,
   if (!newAcc) {
     // Create generic accessibles for SVG and MathML nodes.
     if (content->GetNameSpaceID() == kNameSpaceID_SVG &&
-        content->Tag() == nsAccessibilityAtoms::svg) {
+        content->Tag() == nsGkAtoms::svg) {
       newAcc = new nsEnumRoleAccessible(content, aWeakShell,
                                         nsIAccessibleRole::ROLE_DIAGRAM);
     }
     else if (content->GetNameSpaceID() == kNameSpaceID_MathML &&
-             content->Tag() == nsAccessibilityAtoms::math) {
+             content->Tag() == nsGkAtoms::math) {
       newAcc = new nsEnumRoleAccessible(content, aWeakShell,
                                         nsIAccessibleRole::ROLE_EQUATION);
     }
@@ -1185,7 +1182,7 @@ nsAccessibilityService::GetOrCreateAccessible(nsINode* aNode,
   // of some property that makes this object interesting
   // We don't do this for <body>, <html>, <window>, <dialog> etc. which 
   // correspond to the doc accessible and will be created in any case
-  if (!newAcc && content->Tag() != nsAccessibilityAtoms::body && content->GetParent() && 
+  if (!newAcc && content->Tag() != nsGkAtoms::body && content->GetParent() && 
       ((weakFrame.GetFrame() && weakFrame.GetFrame()->IsFocusable()) ||
        (isHTML && nsCoreUtils::HasClickListener(content)) ||
        HasUniversalAriaProperty(content) || roleMapEntry ||
@@ -1260,22 +1257,22 @@ nsAccessibilityService::HasUniversalAriaProperty(nsIContent *aContent)
 {
   // ARIA attributes that take token values (NMTOKEN, bool) are special cased
   // because of special value "undefined" (see HasDefinedARIAToken).
-  return nsAccUtils::HasDefinedARIAToken(aContent, nsAccessibilityAtoms::aria_atomic) ||
-         nsAccUtils::HasDefinedARIAToken(aContent, nsAccessibilityAtoms::aria_busy) ||
-         aContent->HasAttr(kNameSpaceID_None, nsAccessibilityAtoms::aria_controls) ||
-         aContent->HasAttr(kNameSpaceID_None, nsAccessibilityAtoms::aria_describedby) ||
-         aContent->HasAttr(kNameSpaceID_None, nsAccessibilityAtoms::aria_disabled) ||
-         nsAccUtils::HasDefinedARIAToken(aContent, nsAccessibilityAtoms::aria_dropeffect) ||
-         aContent->HasAttr(kNameSpaceID_None, nsAccessibilityAtoms::aria_flowto) ||
-         nsAccUtils::HasDefinedARIAToken(aContent, nsAccessibilityAtoms::aria_grabbed) ||
-         nsAccUtils::HasDefinedARIAToken(aContent, nsAccessibilityAtoms::aria_haspopup) ||
-         aContent->HasAttr(kNameSpaceID_None, nsAccessibilityAtoms::aria_hidden) ||
-         nsAccUtils::HasDefinedARIAToken(aContent, nsAccessibilityAtoms::aria_invalid) ||
-         aContent->HasAttr(kNameSpaceID_None, nsAccessibilityAtoms::aria_label) ||
-         aContent->HasAttr(kNameSpaceID_None, nsAccessibilityAtoms::aria_labelledby) ||
-         nsAccUtils::HasDefinedARIAToken(aContent, nsAccessibilityAtoms::aria_live) ||
-         nsAccUtils::HasDefinedARIAToken(aContent, nsAccessibilityAtoms::aria_owns) ||
-         nsAccUtils::HasDefinedARIAToken(aContent, nsAccessibilityAtoms::aria_relevant);
+  return nsAccUtils::HasDefinedARIAToken(aContent, nsGkAtoms::aria_atomic) ||
+         nsAccUtils::HasDefinedARIAToken(aContent, nsGkAtoms::aria_busy) ||
+         aContent->HasAttr(kNameSpaceID_None, nsGkAtoms::aria_controls) ||
+         aContent->HasAttr(kNameSpaceID_None, nsGkAtoms::aria_describedby) ||
+         aContent->HasAttr(kNameSpaceID_None, nsGkAtoms::aria_disabled) ||
+         nsAccUtils::HasDefinedARIAToken(aContent, nsGkAtoms::aria_dropeffect) ||
+         aContent->HasAttr(kNameSpaceID_None, nsGkAtoms::aria_flowto) ||
+         nsAccUtils::HasDefinedARIAToken(aContent, nsGkAtoms::aria_grabbed) ||
+         nsAccUtils::HasDefinedARIAToken(aContent, nsGkAtoms::aria_haspopup) ||
+         aContent->HasAttr(kNameSpaceID_None, nsGkAtoms::aria_hidden) ||
+         nsAccUtils::HasDefinedARIAToken(aContent, nsGkAtoms::aria_invalid) ||
+         aContent->HasAttr(kNameSpaceID_None, nsGkAtoms::aria_label) ||
+         aContent->HasAttr(kNameSpaceID_None, nsGkAtoms::aria_labelledby) ||
+         nsAccUtils::HasDefinedARIAToken(aContent, nsGkAtoms::aria_live) ||
+         nsAccUtils::HasDefinedARIAToken(aContent, nsGkAtoms::aria_owns) ||
+         nsAccUtils::HasDefinedARIAToken(aContent, nsGkAtoms::aria_relevant);
 }
 
 nsAccessible*
@@ -1385,7 +1382,7 @@ nsAccessibilityService::CreateAccessibleByType(nsIContent* aContent,
     {
       // Don't include nameless images in accessible tree.
       if (!aContent->HasAttr(kNameSpaceID_None,
-                             nsAccessibilityAtoms::tooltiptext))
+                             nsGkAtoms::tooltiptext))
         return nsnull;
 
       accessible = new nsHTMLImageAccessibleWrap(aContent, aWeakShell);
@@ -1433,7 +1430,7 @@ nsAccessibilityService::CreateAccessibleByType(nsIContent* aContent,
       // implementations on each platform for a consistent scripting environment, but
       // then strip out redundant accessibles in the nsAccessibleWrap class for each platform.
       nsIContent *parent = aContent->GetParent();
-      if (parent && parent->NodeInfo()->Equals(nsAccessibilityAtoms::menu,
+      if (parent && parent->NodeInfo()->Equals(nsGkAtoms::menu,
                                                kNameSpaceID_XUL))
         return nsnull;
 #endif
@@ -1618,34 +1615,34 @@ nsAccessibilityService::CreateHTMLAccessibleByMarkup(nsIFrame* aFrame,
 {
   // This method assumes we're in an HTML namespace.
   nsIAtom *tag = aContent->Tag();
-  if (tag == nsAccessibilityAtoms::legend) {
+  if (tag == nsGkAtoms::legend) {
     nsAccessible* accessible = new nsHTMLLegendAccessible(aContent, aWeakShell);
     NS_IF_ADDREF(accessible);
     return accessible;
   }
 
-  if (tag == nsAccessibilityAtoms::option) {
+  if (tag == nsGkAtoms::option) {
     nsAccessible* accessible = new nsHTMLSelectOptionAccessible(aContent,
                                                                 aWeakShell);
     NS_IF_ADDREF(accessible);
     return accessible;
   }
 
-  if (tag == nsAccessibilityAtoms::optgroup) {
+  if (tag == nsGkAtoms::optgroup) {
     nsAccessible* accessible = new nsHTMLSelectOptGroupAccessible(aContent,
                                                                   aWeakShell);
     NS_IF_ADDREF(accessible);
     return accessible;
   }
 
-  if (tag == nsAccessibilityAtoms::ul || tag == nsAccessibilityAtoms::ol ||
-      tag == nsAccessibilityAtoms::dl) {
+  if (tag == nsGkAtoms::ul || tag == nsGkAtoms::ol ||
+      tag == nsGkAtoms::dl) {
     nsAccessible* accessible = new nsHTMLListAccessible(aContent, aWeakShell);
     NS_IF_ADDREF(accessible);
     return accessible;
   }
 
-  if (tag == nsAccessibilityAtoms::a) {
+  if (tag == nsGkAtoms::a) {
     // Only some roles truly enjoy life as nsHTMLLinkAccessibles, for details
     // see closed bug 494807.
     nsRoleMapEntry *roleMapEntry = nsAccUtils::GetRoleMapEntry(aContent);
@@ -1662,9 +1659,9 @@ nsAccessibilityService::CreateHTMLAccessibleByMarkup(nsIFrame* aFrame,
     return accessible;
   }
 
-  if (tag == nsAccessibilityAtoms::dt ||
-      (tag == nsAccessibilityAtoms::li &&
-       aFrame->GetType() != nsAccessibilityAtoms::blockFrame)) {
+  if (tag == nsGkAtoms::dt ||
+      (tag == nsGkAtoms::li &&
+       aFrame->GetType() != nsGkAtoms::blockFrame)) {
     // Normally for li, it is created by the list item frame (in nsBlockFrame)
     // which knows about the bullet frame; however, in this case the list item
     // must have been styled using display: foo
@@ -1673,24 +1670,24 @@ nsAccessibilityService::CreateHTMLAccessibleByMarkup(nsIFrame* aFrame,
     return accessible;
   }
 
-  if (tag == nsAccessibilityAtoms::abbr ||
-      tag == nsAccessibilityAtoms::acronym ||
-      tag == nsAccessibilityAtoms::blockquote ||
-      tag == nsAccessibilityAtoms::dd ||
-      tag == nsAccessibilityAtoms::form ||
-      tag == nsAccessibilityAtoms::h1 ||
-      tag == nsAccessibilityAtoms::h2 ||
-      tag == nsAccessibilityAtoms::h3 ||
-      tag == nsAccessibilityAtoms::h4 ||
-      tag == nsAccessibilityAtoms::h5 ||
-      tag == nsAccessibilityAtoms::h6 ||
-      tag == nsAccessibilityAtoms::q) {
+  if (tag == nsGkAtoms::abbr ||
+      tag == nsGkAtoms::acronym ||
+      tag == nsGkAtoms::blockquote ||
+      tag == nsGkAtoms::dd ||
+      tag == nsGkAtoms::form ||
+      tag == nsGkAtoms::h1 ||
+      tag == nsGkAtoms::h2 ||
+      tag == nsGkAtoms::h3 ||
+      tag == nsGkAtoms::h4 ||
+      tag == nsGkAtoms::h5 ||
+      tag == nsGkAtoms::h6 ||
+      tag == nsGkAtoms::q) {
     nsAccessible* accessible = new nsHyperTextAccessibleWrap(aContent, aWeakShell);
     NS_IF_ADDREF(accessible);
     return accessible;
   }
 
-  if (tag == nsAccessibilityAtoms::tr) {
+  if (tag == nsGkAtoms::tr) {
     nsAccessible* accessible = new nsEnumRoleAccessible(aContent, aWeakShell,
                                                         nsIAccessibleRole::ROLE_ROW);
     NS_IF_ADDREF(accessible);
@@ -1704,13 +1701,13 @@ nsAccessibilityService::CreateHTMLAccessibleByMarkup(nsIFrame* aFrame,
     return accessible;
   }
 
-  if (tag == nsAccessibilityAtoms::output) {
+  if (tag == nsGkAtoms::output) {
     nsAccessible* accessible = new nsHTMLOutputAccessible(aContent, aWeakShell);
     NS_IF_ADDREF(accessible);
     return accessible;
   }
 
-  if (tag == nsAccessibilityAtoms::progress) {
+  if (tag == nsGkAtoms::progress) {
     nsAccessible* accessible =
       new HTMLProgressMeterAccessible(aContent, aWeakShell);
     NS_IF_ADDREF(accessible);
@@ -1798,16 +1795,16 @@ nsAccessibilityService::CreateAccessibleForDeckChild(nsIFrame* aFrame,
                                                      nsIContent* aContent,
                                                      nsIWeakReference* aWeakShell)
 {
-  if (aFrame->GetType() == nsAccessibilityAtoms::boxFrame ||
-      aFrame->GetType() == nsAccessibilityAtoms::scrollFrame) {
+  if (aFrame->GetType() == nsGkAtoms::boxFrame ||
+      aFrame->GetType() == nsGkAtoms::scrollFrame) {
 
     nsIFrame* parentFrame = aFrame->GetParent();
-    if (parentFrame && parentFrame->GetType() == nsAccessibilityAtoms::deckFrame) {
+    if (parentFrame && parentFrame->GetType() == nsGkAtoms::deckFrame) {
       // If deck frame is for xul:tabpanels element then the given node has
       // tabpanel accessible.
       nsCOMPtr<nsIContent> parentContent = parentFrame->GetContent();
 #ifdef MOZ_XUL
-      if (parentContent->NodeInfo()->Equals(nsAccessibilityAtoms::tabpanels,
+      if (parentContent->NodeInfo()->Equals(nsGkAtoms::tabpanels,
                                             kNameSpaceID_XUL)) {
         nsAccessible* accessible = new nsXULTabpanelAccessible(aContent,
                                                                aWeakShell);
diff --git a/accessible/src/base/nsAccessible.cpp b/accessible/src/base/nsAccessible.cpp
index 8e0ecfad01bc..cdd190c21d3b 100644
--- a/accessible/src/base/nsAccessible.cpp
+++ b/accessible/src/base/nsAccessible.cpp
@@ -257,9 +257,9 @@ nsAccessible::GetName(nsAString& aName)
   nsIAtom *tooltipAttr = nsnull;
 
   if (mContent->IsHTML())
-    tooltipAttr = nsAccessibilityAtoms::title;
+    tooltipAttr = nsGkAtoms::title;
   else if (mContent->IsXUL())
-    tooltipAttr = nsAccessibilityAtoms::tooltiptext;
+    tooltipAttr = nsGkAtoms::tooltiptext;
   else
     return NS_OK;
 
@@ -303,7 +303,7 @@ nsAccessible::Description(nsString& aDescription)
     return;
 
   nsTextEquivUtils::
-    GetTextEquivFromIDRefs(this, nsAccessibilityAtoms::aria_describedby,
+    GetTextEquivFromIDRefs(this, nsGkAtoms::aria_describedby,
                            aDescription);
 
   if (aDescription.IsEmpty()) {
@@ -318,8 +318,8 @@ nsAccessible::Description(nsString& aDescription)
       }
 
       if (aDescription.IsEmpty()) {
-        nsIAtom *descAtom = isXUL ? nsAccessibilityAtoms::tooltiptext :
-                                    nsAccessibilityAtoms::title;
+        nsIAtom *descAtom = isXUL ? nsGkAtoms::tooltiptext :
+                                    nsGkAtoms::title;
         if (mContent->GetAttr(kNameSpaceID_None, descAtom, aDescription)) {
           nsAutoString name;
           GetName(name);
@@ -630,14 +630,14 @@ nsAccessible::IsVisible(PRBool* aIsOffscreen)
     PRBool isEmpty = PR_TRUE;
 
     nsIAtom *frameType = frame->GetType();
-    if (frameType == nsAccessibilityAtoms::textFrame) {
+    if (frameType == nsGkAtoms::textFrame) {
       // Zero area rects can occur in the first frame of a multi-frame text flow,
       // in which case the rendered text is not empty and the frame should not be marked invisible
       nsAutoString renderedText;
       frame->GetRenderedText (&renderedText, nsnull, nsnull, 0, 1);
       isEmpty = renderedText.IsEmpty();
     }
-    else if (frameType == nsAccessibilityAtoms::inlineFrame) {
+    else if (frameType == nsGkAtoms::inlineFrame) {
       // Yuck. Unfortunately inline frames can contain larger frames inside of them,
       // so we can't really believe this is a zero area rect without checking more deeply.
       // GetBounds() will do that for us.
@@ -683,8 +683,8 @@ nsAccessible::NativeState()
     disabled = mContent->IsHTML() ? 
       (elementState.HasState(NS_EVENT_STATE_DISABLED)) :
       (mContent->AttrValueIs(kNameSpaceID_None,
-                             nsAccessibilityAtoms::disabled,
-                             nsAccessibilityAtoms::_true,
+                             nsGkAtoms::disabled,
+                             nsGkAtoms::_true,
                              eCaseMatters));
   }
 
@@ -719,7 +719,7 @@ nsAccessible::NativeState()
 
   // Check if a XUL element has the popup attribute (an attached popup menu).
   if (mContent->IsXUL())
-    if (mContent->HasAttr(kNameSpaceID_None, nsAccessibilityAtoms::popup))
+    if (mContent->HasAttr(kNameSpaceID_None, nsGkAtoms::popup))
       state |= states::HASPOPUP;
 
   // Add 'linked' state for simple xlink.
@@ -915,9 +915,9 @@ void nsAccessible::GetBoundsRect(nsRect& aTotalBounds, nsIFrame** aBoundingFrame
     // If any other frame type, we only need to deal with the primary frame
     // Otherwise, there may be more frames attached to the same content node
     if (!nsCoreUtils::IsCorrectFrameType(ancestorFrame,
-                                         nsAccessibilityAtoms::inlineFrame) &&
+                                         nsGkAtoms::inlineFrame) &&
         !nsCoreUtils::IsCorrectFrameType(ancestorFrame,
-                                         nsAccessibilityAtoms::textFrame))
+                                         nsGkAtoms::textFrame))
       break;
     ancestorFrame = ancestorFrame->GetParent();
   }
@@ -942,7 +942,7 @@ void nsAccessible::GetBoundsRect(nsRect& aTotalBounds, nsIFrame** aBoundingFrame
     nsIFrame *iterNextFrame = nsnull;
 
     if (nsCoreUtils::IsCorrectFrameType(iterFrame,
-                                        nsAccessibilityAtoms::inlineFrame)) {
+                                        nsGkAtoms::inlineFrame)) {
       // Only do deeper bounds search if we're on an inline frame
       // Inline frames can contain larger frames inside of them
       iterNextFrame = iterFrame->GetFirstPrincipalChild();
@@ -1042,11 +1042,11 @@ NS_IMETHODIMP nsAccessible::SetSelected(PRBool aSelect)
     if (mRoleMapEntry) {
       if (aSelect) {
         return mContent->SetAttr(kNameSpaceID_None,
-                                 nsAccessibilityAtoms::aria_selected,
+                                 nsGkAtoms::aria_selected,
                                  NS_LITERAL_STRING("true"), PR_TRUE);
       }
       return mContent->UnsetAttr(kNameSpaceID_None,
-                                 nsAccessibilityAtoms::aria_selected, PR_TRUE);
+                                 nsGkAtoms::aria_selected, PR_TRUE);
     }
   }
 
@@ -1096,7 +1096,7 @@ nsAccessible::TakeFocus()
       nsIContent* ancestorContent = mContent;
       while ((ancestorContent = ancestorContent->GetParent()) &&
              !ancestorContent->HasAttr(kNameSpaceID_None,
-                                       nsAccessibilityAtoms::aria_activedescendant));
+                                       nsGkAtoms::aria_activedescendant));
 
       if (ancestorContent) {
         nsCOMPtr<nsIPresShell> presShell(do_QueryReferent(mWeakShell));
@@ -1105,7 +1105,7 @@ nsAccessible::TakeFocus()
           if (frame && frame->IsFocusable()) {
             focusContent = ancestorContent;
             focusContent->SetAttr(kNameSpaceID_None,
-                                  nsAccessibilityAtoms::aria_activedescendant,
+                                  nsGkAtoms::aria_activedescendant,
                                   id, PR_TRUE);
           }
         }
@@ -1215,8 +1215,8 @@ nsAccessible::GetXULName(nsAString& aLabel)
   nsIContent *parent = bindingParent? bindingParent->GetParent() :
                                       mContent->GetParent();
   while (parent) {
-    if (parent->Tag() == nsAccessibilityAtoms::toolbaritem &&
-        parent->GetAttr(kNameSpaceID_None, nsAccessibilityAtoms::title, label)) {
+    if (parent->Tag() == nsGkAtoms::toolbaritem &&
+        parent->GetAttr(kNameSpaceID_None, nsGkAtoms::title, label)) {
       label.CompressWhitespace();
       aLabel = label;
       return NS_OK;
@@ -1293,7 +1293,7 @@ nsAccessible::GetAttributes(nsIPersistentProperties **aAttributes)
   }
   
   nsAutoString xmlRoles;
-  if (mContent->GetAttr(kNameSpaceID_None, nsAccessibilityAtoms::role, xmlRoles)) {
+  if (mContent->GetAttr(kNameSpaceID_None, nsGkAtoms::role, xmlRoles)) {
     attributes->SetStringProperty(NS_LITERAL_CSTRING("xml-roles"),  xmlRoles, oldValueUnused);          
   }
 
@@ -1309,7 +1309,7 @@ nsAccessible::GetAttributes(nsIPersistentProperties **aAttributes)
 
   // Expose checkable object attribute if the accessible has checkable state
   if (State() & states::CHECKABLE)
-    nsAccUtils::SetAccAttr(attributes, nsAccessibilityAtoms::checkable, NS_LITERAL_STRING("true"));
+    nsAccUtils::SetAccAttr(attributes, nsGkAtoms::checkable, NS_LITERAL_STRING("true"));
 
   // Group attributes (level/setsize/posinset)
   PRInt32 level = 0, posInSet = 0, setSize = 0;
@@ -1343,10 +1343,10 @@ nsAccessible::GetAttributes(nsIPersistentProperties **aAttributes)
   // object attribute used for ARIA role of this accessible.
   if (mRoleMapEntry) {
     nsAutoString live;
-    nsAccUtils::GetAccAttr(attributes, nsAccessibilityAtoms::live, live);
+    nsAccUtils::GetAccAttr(attributes, nsGkAtoms::live, live);
     if (live.IsEmpty()) {
       if (nsAccUtils::GetLiveAttrValue(mRoleMapEntry->liveAttRule, live))
-        nsAccUtils::SetAccAttr(attributes, nsAccessibilityAtoms::live, live);
+        nsAccUtils::SetAccAttr(attributes, nsGkAtoms::live, live);
     }
   }
 
@@ -1373,8 +1373,8 @@ nsAccessible::GetAttributesInternal(nsIPersistentProperties *aAttributes)
   // Expose class because it may have useful microformat information
   // Let the class from an iframe's document be exposed, don't override from <iframe class>
   nsAutoString _class;
-  if (mContent->GetAttr(kNameSpaceID_None, nsAccessibilityAtoms::_class, _class))
-    nsAccUtils::SetAccAttr(aAttributes, nsAccessibilityAtoms::_class, _class);
+  if (mContent->GetAttr(kNameSpaceID_None, nsGkAtoms::_class, _class))
+    nsAccUtils::SetAccAttr(aAttributes, nsGkAtoms::_class, _class);
 
   // Get container-foo computed live region properties based on the closest container with
   // the live region attribute. 
@@ -1416,22 +1416,19 @@ nsAccessible::GetAttributesInternal(nsIPersistentProperties *aAttributes)
                                       NS_LITERAL_STRING("display"),
                                       value);
   if (NS_SUCCEEDED(rv))
-    nsAccUtils::SetAccAttr(aAttributes, nsAccessibilityAtoms::display,
-                           value);
+    nsAccUtils::SetAccAttr(aAttributes, nsGkAtoms::display, value);
 
   // Expose 'text-align' attribute.
   rv = GetComputedStyleValue(EmptyString(), NS_LITERAL_STRING("text-align"),
                              value);
   if (NS_SUCCEEDED(rv))
-    nsAccUtils::SetAccAttr(aAttributes, nsAccessibilityAtoms::textAlign,
-                           value);
+    nsAccUtils::SetAccAttr(aAttributes, nsGkAtoms::textAlign, value);
 
   // Expose 'text-indent' attribute.
   rv = GetComputedStyleValue(EmptyString(), NS_LITERAL_STRING("text-indent"),
                              value);
   if (NS_SUCCEEDED(rv))
-    nsAccUtils::SetAccAttr(aAttributes, nsAccessibilityAtoms::textIndent,
-                           value);
+    nsAccUtils::SetAccAttr(aAttributes, nsGkAtoms::textIndent, value);
 
   // Expose draggable object attribute?
   nsCOMPtr<nsIDOMNSHTMLElement> htmlElement = do_QueryInterface(mContent);
@@ -1439,7 +1436,7 @@ nsAccessible::GetAttributesInternal(nsIPersistentProperties *aAttributes)
     PRBool draggable = PR_FALSE;
     htmlElement->GetDraggable(&draggable);
     if (draggable) {
-      nsAccUtils::SetAccAttr(aAttributes, nsAccessibilityAtoms::draggable,
+      nsAccUtils::SetAccAttr(aAttributes, nsGkAtoms::draggable,
                              NS_LITERAL_STRING("true"));
     }
   }
@@ -1465,11 +1462,11 @@ nsAccessible::GroupPosition(PRInt32 *aGroupLevel,
     return NS_ERROR_FAILURE;
 
   // Get group position from ARIA attributes.
-  nsCoreUtils::GetUIntAttr(mContent, nsAccessibilityAtoms::aria_level,
+  nsCoreUtils::GetUIntAttr(mContent, nsGkAtoms::aria_level,
                            aGroupLevel);
-  nsCoreUtils::GetUIntAttr(mContent, nsAccessibilityAtoms::aria_posinset,
+  nsCoreUtils::GetUIntAttr(mContent, nsGkAtoms::aria_posinset,
                            aPositionInGroup);
-  nsCoreUtils::GetUIntAttr(mContent, nsAccessibilityAtoms::aria_setsize,
+  nsCoreUtils::GetUIntAttr(mContent, nsGkAtoms::aria_setsize,
                            aSimilarItemsInGroup);
 
   // If ARIA is missed and the accessible is visible then calculate group
@@ -1522,8 +1519,8 @@ nsAccessible::State()
   if (mRoleMapEntry && mRoleMapEntry->role == nsIAccessibleRole::ROLE_PAGETAB &&
       !(state & states::SELECTED) &&
       !mContent->AttrValueIs(kNameSpaceID_None,
-                             nsAccessibilityAtoms::aria_selected,
-                             nsAccessibilityAtoms::_false, eCaseMatters)) {
+                             nsGkAtoms::aria_selected,
+                             nsGkAtoms::_false, eCaseMatters)) {
     // Special case: for tabs, focused implies selected, unless explicitly
     // false, i.e. aria-selected="false".
     if (state & states::FOCUSED) {
@@ -1567,7 +1564,7 @@ nsAccessible::State()
       nsIContent *ancestorContent = mContent;
       nsAutoString activeID;
       while ((ancestorContent = ancestorContent->GetParent()) != nsnull) {
-        if (ancestorContent->GetAttr(kNameSpaceID_None, nsAccessibilityAtoms::aria_activedescendant, activeID)) {
+        if (ancestorContent->GetAttr(kNameSpaceID_None, nsGkAtoms::aria_activedescendant, activeID)) {
           if (id == activeID) {
             state |= states::ACTIVE;
           }
@@ -1629,7 +1626,7 @@ nsAccessible::ApplyARIAState(PRUint64* aState)
       // If has a role & ID and aria-activedescendant on the container, assume focusable
       nsIContent *ancestorContent = mContent;
       while ((ancestorContent = ancestorContent->GetParent()) != nsnull) {
-        if (ancestorContent->HasAttr(kNameSpaceID_None, nsAccessibilityAtoms::aria_activedescendant)) {
+        if (ancestorContent->HasAttr(kNameSpaceID_None, nsGkAtoms::aria_activedescendant)) {
             // ancestor has activedescendant property, this content could be active
           *aState |= states::FOCUSABLE;
           break;
@@ -1642,8 +1639,8 @@ nsAccessible::ApplyARIAState(PRUint64* aState)
     // Special case: aria-disabled propagates from ancestors down to any focusable descendant
     nsIContent *ancestorContent = mContent;
     while ((ancestorContent = ancestorContent->GetParent()) != nsnull) {
-      if (ancestorContent->AttrValueIs(kNameSpaceID_None, nsAccessibilityAtoms::aria_disabled,
-                                       nsAccessibilityAtoms::_true, eCaseMatters)) {
+      if (ancestorContent->AttrValueIs(kNameSpaceID_None, nsGkAtoms::aria_disabled,
+                                       nsGkAtoms::_true, eCaseMatters)) {
           // ancestor has aria-disabled property, this is disabled
         *aState |= states::UNAVAILABLE;
         break;
@@ -1683,8 +1680,8 @@ nsAccessible::GetValue(nsAString& aValue)
     // aria-valuenow is a number, and aria-valuetext is the optional text equivalent
     // For the string value, we will try the optional text equivalent first
     if (!mContent->GetAttr(kNameSpaceID_None,
-                           nsAccessibilityAtoms::aria_valuetext, aValue)) {
-      mContent->GetAttr(kNameSpaceID_None, nsAccessibilityAtoms::aria_valuenow,
+                           nsGkAtoms::aria_valuetext, aValue)) {
+      mContent->GetAttr(kNameSpaceID_None, nsGkAtoms::aria_valuenow,
                         aValue);
     }
   }
@@ -1708,13 +1705,13 @@ nsAccessible::GetValue(nsAString& aValue)
 NS_IMETHODIMP
 nsAccessible::GetMaximumValue(double *aMaximumValue)
 {
-  return GetAttrValue(nsAccessibilityAtoms::aria_valuemax, aMaximumValue);
+  return GetAttrValue(nsGkAtoms::aria_valuemax, aMaximumValue);
 }
 
 NS_IMETHODIMP
 nsAccessible::GetMinimumValue(double *aMinimumValue)
 {
-  return GetAttrValue(nsAccessibilityAtoms::aria_valuemin, aMinimumValue);
+  return GetAttrValue(nsGkAtoms::aria_valuemin, aMinimumValue);
 }
 
 NS_IMETHODIMP
@@ -1730,7 +1727,7 @@ nsAccessible::GetMinimumIncrement(double *aMinIncrement)
 NS_IMETHODIMP
 nsAccessible::GetCurrentValue(double *aValue)
 {
-  return GetAttrValue(nsAccessibilityAtoms::aria_valuenow, aValue);
+  return GetAttrValue(nsGkAtoms::aria_valuenow, aValue);
 }
 
 NS_IMETHODIMP
@@ -1758,8 +1755,7 @@ nsAccessible::SetCurrentValue(double aValue)
   nsAutoString newValue;
   newValue.AppendFloat(aValue);
   return mContent->SetAttr(kNameSpaceID_None,
-                           nsAccessibilityAtoms::aria_valuenow, newValue,
-                           PR_TRUE);
+                           nsGkAtoms::aria_valuenow, newValue, PR_TRUE);
 }
 
 /* void setName (in DOMString name); */
@@ -1809,16 +1805,15 @@ nsAccessible::ARIARoleInternal()
   // XXX: these unfortunate exceptions don't fit into the ARIA table. This is
   // where the accessible role depends on both the role and ARIA state.
   if (mRoleMapEntry->role == nsIAccessibleRole::ROLE_PUSHBUTTON) {
-    if (nsAccUtils::HasDefinedARIAToken(mContent,
-                                        nsAccessibilityAtoms::aria_pressed)) {
+    if (nsAccUtils::HasDefinedARIAToken(mContent, nsGkAtoms::aria_pressed)) {
       // For simplicity, any existing pressed attribute except "" or "undefined"
       // indicates a toggle.
       return nsIAccessibleRole::ROLE_TOGGLE_BUTTON;
     }
 
     if (mContent->AttrValueIs(kNameSpaceID_None,
-                              nsAccessibilityAtoms::aria_haspopup,
-                              nsAccessibilityAtoms::_true,
+                              nsGkAtoms::aria_haspopup,
+                              nsGkAtoms::_true,
                               eCaseMatters)) {
       // For button with aria-haspopup="true".
       return nsIAccessibleRole::ROLE_BUTTONMENU;
@@ -1979,7 +1974,7 @@ nsAccessible::GetAtomicRegion() const
 {
   nsIContent *loopContent = mContent;
   nsAutoString atomic;
-  while (loopContent && !loopContent->GetAttr(kNameSpaceID_None, nsAccessibilityAtoms::aria_atomic, atomic))
+  while (loopContent && !loopContent->GetAttr(kNameSpaceID_None, nsGkAtoms::aria_atomic, atomic))
     loopContent = loopContent->GetParent();
 
   return atomic.EqualsLiteral("true") ? loopContent : nsnull;
@@ -2008,17 +2003,17 @@ nsAccessible::RelationByType(PRUint32 aType)
   switch (aType) {
     case nsIAccessibleRelation::RELATION_LABEL_FOR: {
       Relation rel(new RelatedAccIterator(GetDocAccessible(), mContent,
-                                          nsAccessibilityAtoms::aria_labelledby));
-      if (mContent->Tag() == nsAccessibilityAtoms::label)
+                                          nsGkAtoms::aria_labelledby));
+      if (mContent->Tag() == nsGkAtoms::label)
         rel.AppendIter(new IDRefsIterator(mContent, mContent->IsHTML() ?
-                                          nsAccessibilityAtoms::_for :
-                                          nsAccessibilityAtoms::control));
+                                          nsGkAtoms::_for :
+                                          nsGkAtoms::control));
 
       return rel;
     }
     case nsIAccessibleRelation::RELATION_LABELLED_BY: {
       Relation rel(new IDRefsIterator(mContent,
-                                      nsAccessibilityAtoms::aria_labelledby));
+                                      nsGkAtoms::aria_labelledby));
       if (mContent->IsHTML()) {
         rel.AppendIter(new HTMLLabelIterator(GetDocAccessible(), mContent));
       } else if (mContent->IsXUL()) {
@@ -2029,7 +2024,7 @@ nsAccessible::RelationByType(PRUint32 aType)
     }
     case nsIAccessibleRelation::RELATION_DESCRIBED_BY: {
       Relation rel(new IDRefsIterator(mContent,
-                                        nsAccessibilityAtoms::aria_describedby));
+                                        nsGkAtoms::aria_describedby));
       if (mContent->IsXUL())
         rel.AppendIter(new XULDescriptionIterator(GetDocAccessible(), mContent));
 
@@ -2037,21 +2032,21 @@ nsAccessible::RelationByType(PRUint32 aType)
     }
     case nsIAccessibleRelation::RELATION_DESCRIPTION_FOR: {
       Relation rel(new RelatedAccIterator(GetDocAccessible(), mContent,
-                                            nsAccessibilityAtoms::aria_describedby));
+                                            nsGkAtoms::aria_describedby));
 
       // This affectively adds an optional control attribute to xul:description,
       // which only affects accessibility, by allowing the description to be
       // tied to a control.
-      if (mContent->Tag() == nsAccessibilityAtoms::description &&
+      if (mContent->Tag() == nsGkAtoms::description &&
           mContent->IsXUL())
         rel.AppendIter(new IDRefsIterator(mContent,
-                                          nsAccessibilityAtoms::control));
+                                          nsGkAtoms::control));
 
       return rel;
     }
     case nsIAccessibleRelation::RELATION_NODE_CHILD_OF: {
       Relation rel(new RelatedAccIterator(GetDocAccessible(), mContent,
-                                            nsAccessibilityAtoms::aria_owns));
+                                            nsGkAtoms::aria_owns));
       
       // This is an ARIA tree or treegrid that doesn't use owns, so we need to
       // get the parent the hard way.
@@ -2085,19 +2080,19 @@ nsAccessible::RelationByType(PRUint32 aType)
     }
     case nsIAccessibleRelation::RELATION_CONTROLLED_BY:
       return Relation(new RelatedAccIterator(GetDocAccessible(), mContent,
-                                             nsAccessibilityAtoms::aria_controls));
+                                             nsGkAtoms::aria_controls));
     case nsIAccessibleRelation::RELATION_CONTROLLER_FOR: {
       Relation rel(new IDRefsIterator(mContent,
-                                      nsAccessibilityAtoms::aria_controls));
+                                      nsGkAtoms::aria_controls));
       rel.AppendIter(new HTMLOutputIterator(GetDocAccessible(), mContent));
       return rel;
     }
     case nsIAccessibleRelation::RELATION_FLOWS_TO:
       return Relation(new IDRefsIterator(mContent,
-                                         nsAccessibilityAtoms::aria_flowto));
+                                         nsGkAtoms::aria_flowto));
     case nsIAccessibleRelation::RELATION_FLOWS_FROM:
       return Relation(new RelatedAccIterator(GetDocAccessible(), mContent,
-                                             nsAccessibilityAtoms::aria_flowto));
+                                             nsGkAtoms::aria_flowto));
     case nsIAccessibleRelation::RELATION_DEFAULT_BUTTON: {
       if (mContent->IsHTML()) {
         // HTML form controls implements nsIFormControl interface.
@@ -2469,7 +2464,7 @@ nsAccessible::AppendTextTo(nsAString& aText, PRUint32 aStartOffset,
   if (!frame)
     return;
 
-  if (frame->GetType() == nsAccessibilityAtoms::brFrame) {
+  if (frame->GetType() == nsGkAtoms::brFrame) {
     aText += kForcedNewLineChar;
   } else if (nsAccUtils::MustPrune(Parent())) {
     // Expose the embedded object accessible as imaginary embedded object
@@ -2506,14 +2501,14 @@ nsAccessible::GetARIAName(nsAString& aName)
 
   // aria-labelledby now takes precedence over aria-label
   nsresult rv = nsTextEquivUtils::
-    GetTextEquivFromIDRefs(this, nsAccessibilityAtoms::aria_labelledby, label);
+    GetTextEquivFromIDRefs(this, nsGkAtoms::aria_labelledby, label);
   if (NS_SUCCEEDED(rv)) {
     label.CompressWhitespace();
     aName = label;
   }
 
   if (label.IsEmpty() &&
-      mContent->GetAttr(kNameSpaceID_None, nsAccessibilityAtoms::aria_label,
+      mContent->GetAttr(kNameSpaceID_None, nsGkAtoms::aria_label,
                         label)) {
     label.CompressWhitespace();
     aName = label;
@@ -2770,7 +2765,7 @@ nsAccessible::AnchorURIAt(PRUint32 aAnchorIndex)
   // Check if it's a simple xlink.
   if (nsCoreUtils::IsXLink(mContent)) {
     nsAutoString href;
-    mContent->GetAttr(kNameSpaceID_XLink, nsAccessibilityAtoms::href, href);
+    mContent->GetAttr(kNameSpaceID_XLink, nsGkAtoms::href, href);
 
     nsCOMPtr<nsIURI> baseURI = mContent->GetBaseURI();
     nsCOMPtr<nsIDocument> document = mContent->GetOwnerDoc();
@@ -3066,7 +3061,7 @@ nsAccessible::GetActionRule(PRUint64 aStates)
 
   // Return "click" action on elements that have an attached popup menu.
   if (mContent->IsXUL())
-    if (mContent->HasAttr(kNameSpaceID_None, nsAccessibilityAtoms::popup))
+    if (mContent->HasAttr(kNameSpaceID_None, nsGkAtoms::popup))
       return eClickAction;
 
   // Has registered 'click' event handler.
@@ -3082,7 +3077,7 @@ nsAccessible::GetActionRule(PRUint64 aStates)
 
   // Get an action based on ARIA attribute.
   if (nsAccUtils::HasDefinedARIAToken(mContent,
-                                      nsAccessibilityAtoms::aria_expanded))
+                                      nsGkAtoms::aria_expanded))
     return eExpandAction;
 
   return eNoAction;
diff --git a/accessible/src/base/nsBaseWidgetAccessible.cpp b/accessible/src/base/nsBaseWidgetAccessible.cpp
index c76b83a565c2..7705c281092b 100644
--- a/accessible/src/base/nsBaseWidgetAccessible.cpp
+++ b/accessible/src/base/nsBaseWidgetAccessible.cpp
@@ -40,7 +40,6 @@
 #include "nsBaseWidgetAccessible.h"
 
 #include "States.h"
-#include "nsAccessibilityAtoms.h"
 #include "nsAccessibilityService.h"
 #include "nsAccUtils.h"
 #include "nsCoreUtils.h"
diff --git a/accessible/src/base/nsCoreUtils.cpp b/accessible/src/base/nsCoreUtils.cpp
index e8809d37968e..8ed6ad15b836 100644
--- a/accessible/src/base/nsCoreUtils.cpp
+++ b/accessible/src/base/nsCoreUtils.cpp
@@ -204,7 +204,7 @@ nsCoreUtils::GetAccessKeyFor(nsIContent *aContent)
   // Accesskeys are registered by @accesskey attribute only. At first check
   // whether it is presented on the given element to avoid the slow
   // nsEventStateManager::GetRegisteredAccessKey() method.
-  if (!aContent->HasAttr(kNameSpaceID_None, nsAccessibilityAtoms::accesskey))
+  if (!aContent->HasAttr(kNameSpaceID_None, nsGkAtoms::accesskey))
     return 0;
 
   nsCOMPtr<nsIDocument> doc = aContent->GetOwnerDoc();
@@ -577,9 +577,9 @@ nsCoreUtils::IsXLink(nsIContent *aContent)
   if (!aContent)
     return PR_FALSE;
 
-  return aContent->AttrValueIs(kNameSpaceID_XLink, nsAccessibilityAtoms::type,
-                               nsAccessibilityAtoms::simple, eCaseMatters) &&
-         aContent->HasAttr(kNameSpaceID_XLink, nsAccessibilityAtoms::href);
+  return aContent->AttrValueIs(kNameSpaceID_XLink, nsGkAtoms::type,
+                               nsGkAtoms::simple, eCaseMatters) &&
+    aContent->HasAttr(kNameSpaceID_XLink, nsGkAtoms::href);
 }
 
 void
@@ -590,8 +590,7 @@ nsCoreUtils::GetLanguageFor(nsIContent *aContent, nsIContent *aRootContent,
 
   nsIContent *walkUp = aContent;
   while (walkUp && walkUp != aRootContent &&
-         !walkUp->GetAttr(kNameSpaceID_None,
-                          nsAccessibilityAtoms::lang, aLanguage))
+         !walkUp->GetAttr(kNameSpaceID_None, nsGkAtoms::lang, aLanguage))
     walkUp = walkUp->GetParent();
 }
 
@@ -638,7 +637,7 @@ nsCoreUtils::GetTreeBoxObject(nsIContent *aContent)
   // Find DOMNode's parents recursively until reach the <tree> tag
   nsIContent* currentContent = aContent;
   while (currentContent) {
-    if (currentContent->NodeInfo()->Equals(nsAccessibilityAtoms::tree,
+    if (currentContent->NodeInfo()->Equals(nsGkAtoms::tree,
                                            kNameSpaceID_XUL)) {
       // We will get the nsITreeBoxObject from the tree node
       nsCOMPtr<nsIDOMXULElement> xulElement(do_QueryInterface(currentContent));
@@ -766,8 +765,8 @@ nsCoreUtils::IsColumnHidden(nsITreeColumn *aColumn)
   nsCOMPtr<nsIDOMElement> element;
   aColumn->GetElement(getter_AddRefs(element));
   nsCOMPtr<nsIContent> content = do_QueryInterface(element);
-  return content->AttrValueIs(kNameSpaceID_None, nsAccessibilityAtoms::hidden,
-                              nsAccessibilityAtoms::_true, eCaseMatters);
+  return content->AttrValueIs(kNameSpaceID_None, nsGkAtoms::hidden,
+                              nsGkAtoms::_true, eCaseMatters);
 }
 
 bool
diff --git a/accessible/src/base/nsCoreUtils.h b/accessible/src/base/nsCoreUtils.h
index 96c416335c69..6c4c8e5e7616 100644
--- a/accessible/src/base/nsCoreUtils.h
+++ b/accessible/src/base/nsCoreUtils.h
@@ -39,7 +39,6 @@
 #ifndef nsCoreUtils_h_
 #define nsCoreUtils_h_
 
-#include "nsAccessibilityAtoms.h"
 
 #include "nsIDOMNode.h"
 #include "nsIContent.h"
@@ -368,8 +367,8 @@ public:
    */
   static PRBool IsHTMLTableHeader(nsIContent *aContent)
   {
-    return aContent->NodeInfo()->Equals(nsAccessibilityAtoms::th) ||
-      aContent->HasAttr(kNameSpaceID_None, nsAccessibilityAtoms::scope);
+    return aContent->NodeInfo()->Equals(nsGkAtoms::th) ||
+      aContent->HasAttr(kNameSpaceID_None, nsGkAtoms::scope);
   }
 
   /**
diff --git a/accessible/src/base/nsDocAccessible.cpp b/accessible/src/base/nsDocAccessible.cpp
index 91d3ee4e3831..0142cc33d1f5 100644
--- a/accessible/src/base/nsDocAccessible.cpp
+++ b/accessible/src/base/nsDocAccessible.cpp
@@ -39,7 +39,6 @@
 #include "AccIterator.h"
 #include "States.h"
 #include "nsAccCache.h"
-#include "nsAccessibilityAtoms.h"
 #include "nsAccessibilityService.h"
 #include "nsAccTreeWalker.h"
 #include "nsAccUtils.h"
@@ -86,13 +85,13 @@ using namespace mozilla::a11y;
 
 static nsIAtom** kRelationAttrs[] =
 {
-  &nsAccessibilityAtoms::aria_labelledby,
-  &nsAccessibilityAtoms::aria_describedby,
-  &nsAccessibilityAtoms::aria_owns,
-  &nsAccessibilityAtoms::aria_controls,
-  &nsAccessibilityAtoms::aria_flowto,
-  &nsAccessibilityAtoms::_for,
-  &nsAccessibilityAtoms::control
+  &nsGkAtoms::aria_labelledby,
+  &nsGkAtoms::aria_describedby,
+  &nsGkAtoms::aria_owns,
+  &nsGkAtoms::aria_controls,
+  &nsGkAtoms::aria_flowto,
+  &nsGkAtoms::_for,
+  &nsGkAtoms::control
 };
 
 static const PRUint32 kRelationAttrsLen = NS_ARRAY_LENGTH(kRelationAttrs);
@@ -283,7 +282,7 @@ nsDocAccessible::Description(nsString& aDescription)
 
   if (aDescription.IsEmpty())
     nsTextEquivUtils::
-      GetTextEquivFromIDRefs(this, nsAccessibilityAtoms::aria_describedby,
+      GetTextEquivFromIDRefs(this, nsGkAtoms::aria_describedby,
                              aDescription);
 }
 
@@ -939,8 +938,8 @@ nsDocAccessible::AttributeWillChange(nsIDocument *aDocument,
   // Here we will want to cache whatever attribute values we are interested
   // in, such as the existence of aria-pressed for button (so we know if we
   // need to newly expose it as a toggle button) etc.
-  if (aAttribute == nsAccessibilityAtoms::aria_checked ||
-      aAttribute == nsAccessibilityAtoms::aria_pressed) {
+  if (aAttribute == nsGkAtoms::aria_checked ||
+      aAttribute == nsGkAtoms::aria_pressed) {
     mARIAAttrOldValue = (aModType != nsIDOMMutationEvent::ADDITION) ?
       nsAccUtils::GetARIAToken(aElement, aAttribute) : nsnull;
   }
@@ -1010,8 +1009,8 @@ nsDocAccessible::AttributeChangedImpl(nsIContent* aContent, PRInt32 aNameSpaceID
 
   // Universal boolean properties that don't require a role. Fire the state
   // change when disabled or aria-disabled attribute is set.
-  if (aAttribute == nsAccessibilityAtoms::disabled ||
-      aAttribute == nsAccessibilityAtoms::aria_disabled) {
+  if (aAttribute == nsGkAtoms::disabled ||
+      aAttribute == nsGkAtoms::aria_disabled) {
 
     // Note. Checking the XUL or HTML namespace would not seem to gain us
     // anything, because disabled attribute really is going to mean the same
@@ -1041,25 +1040,25 @@ nsDocAccessible::AttributeChangedImpl(nsIContent* aContent, PRInt32 aNameSpaceID
     }
   }
 
-  if (aAttribute == nsAccessibilityAtoms::alt ||
-      aAttribute == nsAccessibilityAtoms::title ||
-      aAttribute == nsAccessibilityAtoms::aria_label ||
-      aAttribute == nsAccessibilityAtoms::aria_labelledby) {
+  if (aAttribute == nsGkAtoms::alt ||
+      aAttribute == nsGkAtoms::title ||
+      aAttribute == nsGkAtoms::aria_label ||
+      aAttribute == nsGkAtoms::aria_labelledby) {
     FireDelayedAccessibleEvent(nsIAccessibleEvent::EVENT_NAME_CHANGE,
                                aContent);
     return;
   }
 
-  if (aAttribute == nsAccessibilityAtoms::aria_busy) {
+  if (aAttribute == nsGkAtoms::aria_busy) {
     PRBool isOn = aContent->AttrValueIs(aNameSpaceID, aAttribute,
-                                        nsAccessibilityAtoms::_true, eCaseMatters);
+                                        nsGkAtoms::_true, eCaseMatters);
     nsRefPtr<AccEvent> event = new AccStateChangeEvent(aContent, states::BUSY, isOn);
     FireDelayedAccessibleEvent(event);
     return;
   }
 
-  if (aAttribute == nsAccessibilityAtoms::selected ||
-      aAttribute == nsAccessibilityAtoms::aria_selected) {
+  if (aAttribute == nsGkAtoms::selected ||
+      aAttribute == nsGkAtoms::aria_selected) {
     // ARIA or XUL selection
 
     nsAccessible *multiSelect =
@@ -1077,7 +1076,7 @@ nsDocAccessible::AttributeChangedImpl(nsIContent* aContent, PRInt32 aNameSpaceID
                                  AccEvent::eAllowDupes);
 
       static nsIContent::AttrValuesArray strings[] =
-        {&nsAccessibilityAtoms::_empty, &nsAccessibilityAtoms::_false, nsnull};
+        {&nsGkAtoms::_empty, &nsGkAtoms::_false, nsnull};
       if (aContent->FindAttrValueIn(kNameSpaceID_None, aAttribute,
                                     strings, eCaseMatters) >= 0) {
         FireDelayedAccessibleEvent(nsIAccessibleEvent::EVENT_SELECTION_REMOVE,
@@ -1090,7 +1089,7 @@ nsDocAccessible::AttributeChangedImpl(nsIContent* aContent, PRInt32 aNameSpaceID
     }
   }
 
-  if (aAttribute == nsAccessibilityAtoms::contenteditable) {
+  if (aAttribute == nsGkAtoms::contenteditable) {
     nsRefPtr<AccEvent> editableChangeEvent =
       new AccStateChangeEvent(aContent, states::EDITABLE);
     FireDelayedAccessibleEvent(editableChangeEvent);
@@ -1105,21 +1104,21 @@ nsDocAccessible::ARIAAttributeChanged(nsIContent* aContent, nsIAtom* aAttribute)
   // Note: For universal/global ARIA states and properties we don't care if
   // there is an ARIA role present or not.
 
-  if (aAttribute == nsAccessibilityAtoms::aria_required) {
+  if (aAttribute == nsGkAtoms::aria_required) {
     nsRefPtr<AccEvent> event =
       new AccStateChangeEvent(aContent, states::REQUIRED);
     FireDelayedAccessibleEvent(event);
     return;
   }
 
-  if (aAttribute == nsAccessibilityAtoms::aria_invalid) {
+  if (aAttribute == nsGkAtoms::aria_invalid) {
     nsRefPtr<AccEvent> event =
       new AccStateChangeEvent(aContent, states::INVALID);
     FireDelayedAccessibleEvent(event);
     return;
   }
 
-  if (aAttribute == nsAccessibilityAtoms::aria_activedescendant) {
+  if (aAttribute == nsGkAtoms::aria_activedescendant) {
     // The activedescendant universal property redirects accessible focus events
     // to the element with the id that activedescendant points to
     nsCOMPtr<nsINode> focusedNode = GetCurrentFocus();
@@ -1135,23 +1134,23 @@ nsDocAccessible::ARIAAttributeChanged(nsIContent* aContent, nsIAtom* aAttribute)
 
   // For aria drag and drop changes we fire a generic attribute change event;
   // at least until native API comes up with a more meaningful event.
-  if (aAttribute == nsAccessibilityAtoms::aria_grabbed ||
-      aAttribute == nsAccessibilityAtoms::aria_dropeffect ||
-      aAttribute == nsAccessibilityAtoms::aria_hidden ||
-      aAttribute == nsAccessibilityAtoms::aria_sort) {
+  if (aAttribute == nsGkAtoms::aria_grabbed ||
+      aAttribute == nsGkAtoms::aria_dropeffect ||
+      aAttribute == nsGkAtoms::aria_hidden ||
+      aAttribute == nsGkAtoms::aria_sort) {
     FireDelayedAccessibleEvent(nsIAccessibleEvent::EVENT_OBJECT_ATTRIBUTE_CHANGED,
                                aContent);
   }
 
   // We treat aria-expanded as a global ARIA state for historical reasons
-  if (aAttribute == nsAccessibilityAtoms::aria_expanded) {
+  if (aAttribute == nsGkAtoms::aria_expanded) {
     nsRefPtr<AccEvent> event =
       new AccStateChangeEvent(aContent, states::EXPANDED);
     FireDelayedAccessibleEvent(event);
     return;
   }
 
-  if (!aContent->HasAttr(kNameSpaceID_None, nsAccessibilityAtoms::role)) {
+  if (!aContent->HasAttr(kNameSpaceID_None, nsGkAtoms::role)) {
     // We don't care about these other ARIA attribute changes unless there is
     // an ARIA role set for the element
     // XXX: we should check the role map to see if the changed property is
@@ -1160,18 +1159,18 @@ nsDocAccessible::ARIAAttributeChanged(nsIContent* aContent, nsIAtom* aAttribute)
   }
 
   // The following ARIA attributes only take affect when dynamic content role is present
-  if (aAttribute == nsAccessibilityAtoms::aria_checked ||
-      aAttribute == nsAccessibilityAtoms::aria_pressed) {
-    const PRUint32 kState = (aAttribute == nsAccessibilityAtoms::aria_checked) ?
+  if (aAttribute == nsGkAtoms::aria_checked ||
+      aAttribute == nsGkAtoms::aria_pressed) {
+    const PRUint32 kState = (aAttribute == nsGkAtoms::aria_checked) ?
                             states::CHECKED : states::PRESSED;
     nsRefPtr<AccEvent> event = new AccStateChangeEvent(aContent, kState);
     FireDelayedAccessibleEvent(event);
 
     nsAccessible* accessible = event->GetAccessible();
     if (accessible) {
-      bool wasMixed = (mARIAAttrOldValue == nsAccessibilityAtoms::mixed);
+      bool wasMixed = (mARIAAttrOldValue == nsGkAtoms::mixed);
       bool isMixed = aContent->AttrValueIs(kNameSpaceID_None, aAttribute,
-                                           nsAccessibilityAtoms::mixed, eCaseMatters);
+                                           nsGkAtoms::mixed, eCaseMatters);
       if (isMixed != wasMixed) {
         nsRefPtr<AccEvent> event =
           new AccStateChangeEvent(aContent, states::MIXED, isMixed);
@@ -1181,7 +1180,7 @@ nsDocAccessible::ARIAAttributeChanged(nsIContent* aContent, nsIAtom* aAttribute)
     return;
   }
 
-  if (aAttribute == nsAccessibilityAtoms::aria_readonly) {
+  if (aAttribute == nsGkAtoms::aria_readonly) {
     nsRefPtr<AccEvent> event =
       new AccStateChangeEvent(aContent, states::READONLY);
     FireDelayedAccessibleEvent(event);
@@ -1190,13 +1189,11 @@ nsDocAccessible::ARIAAttributeChanged(nsIContent* aContent, nsIAtom* aAttribute)
 
   // Fire value change event whenever aria-valuetext is changed, or
   // when aria-valuenow is changed and aria-valuetext is empty
-  if (aAttribute == nsAccessibilityAtoms::aria_valuetext ||      
-      (aAttribute == nsAccessibilityAtoms::aria_valuenow &&
-       (!aContent->HasAttr(kNameSpaceID_None,
-           nsAccessibilityAtoms::aria_valuetext) ||
-        aContent->AttrValueIs(kNameSpaceID_None,
-            nsAccessibilityAtoms::aria_valuetext, nsAccessibilityAtoms::_empty,
-            eCaseMatters)))) {
+  if (aAttribute == nsGkAtoms::aria_valuetext ||
+      (aAttribute == nsGkAtoms::aria_valuenow &&
+       (!aContent->HasAttr(kNameSpaceID_None, nsGkAtoms::aria_valuetext) ||
+        aContent->AttrValueIs(kNameSpaceID_None, nsGkAtoms::aria_valuetext,
+                              nsGkAtoms::_empty, eCaseMatters)))) {
     FireDelayedAccessibleEvent(nsIAccessibleEvent::EVENT_VALUE_CHANGE,
                                aContent);
     return;
@@ -1560,16 +1557,16 @@ nsDocAccessible::AddDependentIDsFor(nsAccessible* aRelProvider,
     if (aRelAttr && aRelAttr != relAttr)
       continue;
 
-    if (relAttr == nsAccessibilityAtoms::_for) {
+    if (relAttr == nsGkAtoms::_for) {
       if (!aRelProvider->GetContent()->IsHTML() ||
-          aRelProvider->GetContent()->Tag() != nsAccessibilityAtoms::label &&
-          aRelProvider->GetContent()->Tag() != nsAccessibilityAtoms::output)
+          aRelProvider->GetContent()->Tag() != nsGkAtoms::label &&
+          aRelProvider->GetContent()->Tag() != nsGkAtoms::output)
         continue;
 
-    } else if (relAttr == nsAccessibilityAtoms::control) {
+    } else if (relAttr == nsGkAtoms::control) {
       if (!aRelProvider->GetContent()->IsXUL() ||
-          aRelProvider->GetContent()->Tag() != nsAccessibilityAtoms::label &&
-          aRelProvider->GetContent()->Tag() != nsAccessibilityAtoms::description)
+          aRelProvider->GetContent()->Tag() != nsGkAtoms::label &&
+          aRelProvider->GetContent()->Tag() != nsGkAtoms::description)
         continue;
     }
 
@@ -1656,7 +1653,7 @@ bool
 nsDocAccessible::UpdateAccessibleOnAttrChange(dom::Element* aElement,
                                               nsIAtom* aAttribute)
 {
-  if (aAttribute == nsAccessibilityAtoms::role) {
+  if (aAttribute == nsGkAtoms::role) {
     // It is common for js libraries to set the role on the body element after
     // the document has loaded. In this case we just update the role map entry.
     if (mContent == aElement) {
@@ -1673,8 +1670,8 @@ nsDocAccessible::UpdateAccessibleOnAttrChange(dom::Element* aElement,
     return true;
   }
 
-  if (aAttribute == nsAccessibilityAtoms::href ||
-      aAttribute == nsAccessibilityAtoms::onclick) {
+  if (aAttribute == nsGkAtoms::href ||
+      aAttribute == nsGkAtoms::onclick) {
     // Not worth the expense to ensure which namespace these are in. It doesn't
     // kill use to recreate the accessible even if the attribute was used in
     // the wrong namespace or an element that doesn't support it.
@@ -1687,8 +1684,8 @@ nsDocAccessible::UpdateAccessibleOnAttrChange(dom::Element* aElement,
     return true;
   }
 
-  if (aAttribute == nsAccessibilityAtoms::aria_multiselectable &&
-      aElement->HasAttr(kNameSpaceID_None, nsAccessibilityAtoms::role)) {
+  if (aAttribute == nsGkAtoms::aria_multiselectable &&
+      aElement->HasAttr(kNameSpaceID_None, nsGkAtoms::role)) {
     // This affects whether the accessible supports SelectAccessible.
     // COM says we cannot change what interfaces are supported on-the-fly,
     // so invalidate this object. A new one will be created on demand.
diff --git a/accessible/src/base/nsEventShell.cpp b/accessible/src/base/nsEventShell.cpp
index 8597d316aeb6..8e4732e788ac 100644
--- a/accessible/src/base/nsEventShell.cpp
+++ b/accessible/src/base/nsEventShell.cpp
@@ -84,7 +84,7 @@ nsEventShell::GetEventAttributes(nsINode *aNode,
   if (aNode != sEventTargetNode)
     return;
 
-  nsAccUtils::SetAccAttr(aAttributes, nsAccessibilityAtoms::eventFromInput,
+  nsAccUtils::SetAccAttr(aAttributes, nsGkAtoms::eventFromInput,
                          sEventFromUserInput ? NS_LITERAL_STRING("true") :
                                                NS_LITERAL_STRING("false"));
 }
diff --git a/accessible/src/base/nsFormControlAccessible.cpp b/accessible/src/base/nsFormControlAccessible.cpp
index cafb35725872..c2391ecc5af3 100644
--- a/accessible/src/base/nsFormControlAccessible.cpp
+++ b/accessible/src/base/nsFormControlAccessible.cpp
@@ -116,7 +116,7 @@ ProgressMeterAccessible<Max>::GetMaximumValue(double* aMaximumValue)
     return rv;
 
   nsAutoString value;
-  if (mContent->GetAttr(kNameSpaceID_None, nsAccessibilityAtoms::max, value)) {
+  if (mContent->GetAttr(kNameSpaceID_None, nsGkAtoms::max, value)) {
     PRInt32 result = NS_OK;
     *aMaximumValue = value.ToDouble(&result);
     return result;
@@ -159,7 +159,7 @@ ProgressMeterAccessible<Max>::GetCurrentValue(double* aCurrentValue)
     return rv;
 
   nsAutoString attrValue;
-  mContent->GetAttr(kNameSpaceID_None, nsAccessibilityAtoms::value, attrValue);
+  mContent->GetAttr(kNameSpaceID_None, nsGkAtoms::value, attrValue);
 
   // Return zero value if there is no attribute or its value is empty.
   if (attrValue.IsEmpty())
diff --git a/accessible/src/base/nsRootAccessible.cpp b/accessible/src/base/nsRootAccessible.cpp
index e993dfc4e4f1..cb0b5f32785a 100644
--- a/accessible/src/base/nsRootAccessible.cpp
+++ b/accessible/src/base/nsRootAccessible.cpp
@@ -330,7 +330,7 @@ nsRootAccessible::FireAccessibleFocusEvent(nsAccessible* aFocusAccessible,
   if (content) {
     nsAutoString id;
     if (content->GetAttr(kNameSpaceID_None,
-                         nsAccessibilityAtoms::aria_activedescendant, id)) {
+                         nsGkAtoms::aria_activedescendant, id)) {
       nsIDocument* DOMDoc = content->GetOwnerDoc();
       nsIContent* activeDescendantContent = DOMDoc->GetElementById(id);
 
@@ -519,8 +519,8 @@ nsRootAccessible::ProcessDOMEvent(nsIDOMEvent* aDOMEvent)
 
 #ifdef MOZ_XUL
   PRBool isTree = targetContent ?
-    targetContent->NodeInfo()->Equals(nsAccessibilityAtoms::tree,
-                                      kNameSpaceID_XUL) : PR_FALSE;
+    targetContent->NodeInfo()->Equals(nsGkAtoms::tree, kNameSpaceID_XUL) :
+    PR_FALSE;
 
   if (isTree) {
     nsRefPtr<nsXULTreeAccessible> treeAcc = do_QueryObject(accessible);
diff --git a/accessible/src/base/nsTextAttrs.cpp b/accessible/src/base/nsTextAttrs.cpp
index 5ef69271e983..8acd7315c969 100644
--- a/accessible/src/base/nsTextAttrs.cpp
+++ b/accessible/src/base/nsTextAttrs.cpp
@@ -70,12 +70,12 @@ const char* const kCopyValue = nsnull;
 static nsCSSTextAttrMapItem gCSSTextAttrsMap[] =
 {
   // CSS name            CSS value        Attribute name                                Attribute value
-  { "color",             kAnyValue,       &nsAccessibilityAtoms::color,                 kCopyValue },
-  { "font-family",       kAnyValue,       &nsAccessibilityAtoms::fontFamily,            kCopyValue },
-  { "font-style",        kAnyValue,       &nsAccessibilityAtoms::fontStyle,             kCopyValue },
-  { "text-decoration",   "line-through",  &nsAccessibilityAtoms::textLineThroughStyle,  "solid" },
-  { "text-decoration",   "underline",     &nsAccessibilityAtoms::textUnderlineStyle,    "solid" },
-  { "vertical-align",    kAnyValue,       &nsAccessibilityAtoms::textPosition,          kCopyValue }
+  { "color",             kAnyValue,       &nsGkAtoms::color,                 kCopyValue },
+  { "font-family",       kAnyValue,       &nsGkAtoms::font_family,            kCopyValue },
+  { "font-style",        kAnyValue,       &nsGkAtoms::font_style,             kCopyValue },
+  { "text-decoration",   "line-through",  &nsGkAtoms::textLineThroughStyle,  "solid" },
+  { "text-decoration",   "underline",     &nsGkAtoms::textUnderlineStyle,    "solid" },
+  { "vertical-align",    kAnyValue,       &nsGkAtoms::textPosition,          kCopyValue }
 };
 
 ////////////////////////////////////////////////////////////////////////////////
@@ -325,7 +325,7 @@ nsCSSTextAttr::nsCSSTextAttr(PRUint32 aIndex, nsIContent *aRootContent,
 }
 
 nsIAtom*
-nsCSSTextAttr::GetName()
+nsCSSTextAttr::GetName() const
 {
   return *gCSSTextAttrsMap[mIndex].mAttrName;
 }
diff --git a/accessible/src/base/nsTextAttrs.h b/accessible/src/base/nsTextAttrs.h
index ce6f74b6e5ea..33333f3970aa 100644
--- a/accessible/src/base/nsTextAttrs.h
+++ b/accessible/src/base/nsTextAttrs.h
@@ -41,7 +41,6 @@
 
 class nsHyperTextAccessible;
 
-#include "nsAccessibilityAtoms.h"
 
 #include "nsIDOMNode.h"
 #include "nsIDOMElement.h"
@@ -136,7 +135,7 @@ public:
   /**
    * Return the name of text attribute.
    */
-  virtual nsIAtom* GetName() = 0;
+  virtual nsIAtom* GetName() const = 0;
 
   /**
    * Retrieve the value of text attribute in out param, return true if differs
@@ -247,7 +246,7 @@ public:
                  nsIContent *aContent);
 
   // nsITextAttr
-  virtual nsIAtom *GetName() { return nsAccessibilityAtoms::language; }
+  virtual nsIAtom *GetName() const { return nsGkAtoms::language; }
 
 protected:
 
@@ -272,7 +271,7 @@ public:
                 nsIContent *aContent);
 
   // nsITextAttr
-  virtual nsIAtom *GetName();
+  virtual nsIAtom *GetName() const;
 
 protected:
 
@@ -295,7 +294,7 @@ public:
   nsBGColorTextAttr(nsIFrame *aRootFrame, nsIFrame *aFrame);
 
   // nsITextAttr
-  virtual nsIAtom *GetName() { return nsAccessibilityAtoms::backgroundColor; }
+  virtual nsIAtom *GetName() const { return nsGkAtoms::backgroundColor; }
 
 protected:
   // nsTextAttr
@@ -318,7 +317,7 @@ public:
   nsFontSizeTextAttr(nsIFrame *aRootFrame, nsIFrame *aFrame);
 
   // nsITextAttr
-  virtual nsIAtom *GetName() { return nsAccessibilityAtoms::fontSize; }
+  virtual nsIAtom *GetName() const { return nsGkAtoms::font_size; }
 
 protected:
 
@@ -350,7 +349,7 @@ public:
   nsFontWeightTextAttr(nsIFrame *aRootFrame, nsIFrame *aFrame);
 
   // nsITextAttr
-  virtual nsIAtom *GetName() { return nsAccessibilityAtoms::fontWeight; }
+  virtual nsIAtom *GetName() const { return nsGkAtoms::fontWeight; }
 
 protected:
 
diff --git a/accessible/src/base/nsTextEquivUtils.cpp b/accessible/src/base/nsTextEquivUtils.cpp
index 7a83a3a40466..4225cb11d285 100644
--- a/accessible/src/base/nsTextEquivUtils.cpp
+++ b/accessible/src/base/nsTextEquivUtils.cpp
@@ -193,7 +193,7 @@ nsTextEquivUtils::AppendTextEquivFromTextContent(nsIContent *aContent,
   }
   
   if (aContent->IsHTML() &&
-      aContent->NodeInfo()->Equals(nsAccessibilityAtoms::br)) {
+      aContent->NodeInfo()->Equals(nsGkAtoms::br)) {
     aString->AppendLiteral("\r\n");
     return NS_OK;
   }
@@ -360,14 +360,14 @@ nsTextEquivUtils::AppendFromDOMNode(nsIContent *aContent, nsAString *aString)
     if (labeledEl) {
       labeledEl->GetLabel(textEquivalent);
     } else {
-      if (aContent->NodeInfo()->Equals(nsAccessibilityAtoms::label,
+      if (aContent->NodeInfo()->Equals(nsGkAtoms::label,
                                        kNameSpaceID_XUL))
-        aContent->GetAttr(kNameSpaceID_None, nsAccessibilityAtoms::value,
+        aContent->GetAttr(kNameSpaceID_None, nsGkAtoms::value,
                           textEquivalent);
 
       if (textEquivalent.IsEmpty())
         aContent->GetAttr(kNameSpaceID_None,
-                          nsAccessibilityAtoms::tooltiptext, textEquivalent);
+                          nsGkAtoms::tooltiptext, textEquivalent);
     }
 
     AppendString(aString, textEquivalent);
diff --git a/accessible/src/html/nsHTMLFormControlAccessible.cpp b/accessible/src/html/nsHTMLFormControlAccessible.cpp
index 6896c99cd0f9..b25712af7918 100644
--- a/accessible/src/html/nsHTMLFormControlAccessible.cpp
+++ b/accessible/src/html/nsHTMLFormControlAccessible.cpp
@@ -40,7 +40,6 @@
 
 #include "Relation.h"
 #include "States.h"
-#include "nsAccessibilityAtoms.h"
 #include "nsAccUtils.h"
 #include "nsTextEquivUtils.h"
 
@@ -180,9 +179,9 @@ nsHTMLRadioButtonAccessible::GetPositionAndSizeInternal(PRInt32 *aPosInSet,
   mContent->NodeInfo()->GetName(tagName);
 
   nsAutoString type;
-  mContent->GetAttr(kNameSpaceID_None, nsAccessibilityAtoms::type, type);
+  mContent->GetAttr(kNameSpaceID_None, nsGkAtoms::type, type);
   nsAutoString name;
-  mContent->GetAttr(kNameSpaceID_None, nsAccessibilityAtoms::name, name);
+  mContent->GetAttr(kNameSpaceID_None, nsGkAtoms::name, name);
 
   nsCOMPtr<nsIDOMNodeList> inputs;
 
@@ -213,9 +212,9 @@ nsHTMLRadioButtonAccessible::GetPositionAndSizeInternal(PRInt32 *aPosInSet,
 
     nsCOMPtr<nsIContent> item(do_QueryInterface(itemNode));
     if (item &&
-        item->AttrValueIs(kNameSpaceID_None, nsAccessibilityAtoms::type,
+        item->AttrValueIs(kNameSpaceID_None, nsGkAtoms::type,
                           type, eCaseMatters) &&
-        item->AttrValueIs(kNameSpaceID_None, nsAccessibilityAtoms::name,
+        item->AttrValueIs(kNameSpaceID_None, nsGkAtoms::name,
                           name, eCaseMatters)) {
 
       count++;
@@ -269,8 +268,8 @@ nsHTMLButtonAccessible::NativeState()
 {
   PRUint64 state = nsHyperTextAccessibleWrap::NativeState();
 
-  if (mContent->AttrValueIs(kNameSpaceID_None, nsAccessibilityAtoms::type,
-                            nsAccessibilityAtoms::submit, eIgnoreCase))
+  if (mContent->AttrValueIs(kNameSpaceID_None, nsGkAtoms::type,
+                            nsGkAtoms::submit, eIgnoreCase))
     state |= states::DEFAULT;
 
   return state;
@@ -291,23 +290,22 @@ nsHTMLButtonAccessible::GetNameInternal(nsAString& aName)
 
   // No name from HTML or ARIA
   nsAutoString name;
-  if (!mContent->GetAttr(kNameSpaceID_None, nsAccessibilityAtoms::value,
+  if (!mContent->GetAttr(kNameSpaceID_None, nsGkAtoms::value,
                          name) &&
-      !mContent->GetAttr(kNameSpaceID_None, nsAccessibilityAtoms::alt,
+      !mContent->GetAttr(kNameSpaceID_None, nsGkAtoms::alt,
                          name)) {
     // Use the button's (default) label if nothing else works
     nsIFrame* frame = GetFrame();
     if (frame) {
       nsIFormControlFrame* fcFrame = do_QueryFrame(frame);
       if (fcFrame)
-        fcFrame->GetFormProperty(nsAccessibilityAtoms::defaultLabel, name);
+        fcFrame->GetFormProperty(nsGkAtoms::defaultLabel, name);
     }
   }
 
   if (name.IsEmpty() &&
-      !mContent->GetAttr(kNameSpaceID_None, nsAccessibilityAtoms::src,
-                         name)) {
-    mContent->GetAttr(kNameSpaceID_None, nsAccessibilityAtoms::data, name);
+      !mContent->GetAttr(kNameSpaceID_None, nsGkAtoms::src, name)) {
+    mContent->GetAttr(kNameSpaceID_None, nsGkAtoms::data, name);
   }
 
   name.CompressWhitespace();
@@ -365,8 +363,8 @@ nsHTML4ButtonAccessible::NativeState()
 
   state |= states::FOCUSABLE;
 
-  if (mContent->AttrValueIs(kNameSpaceID_None, nsAccessibilityAtoms::type,
-                            nsAccessibilityAtoms::submit, eIgnoreCase))
+  if (mContent->AttrValueIs(kNameSpaceID_None, nsGkAtoms::type,
+                            nsGkAtoms::submit, eIgnoreCase))
     state |= states::DEFAULT;
 
   return state;
@@ -388,8 +386,8 @@ NS_IMPL_ISUPPORTS_INHERITED3(nsHTMLTextFieldAccessible, nsAccessible, nsHyperTex
 PRUint32
 nsHTMLTextFieldAccessible::NativeRole()
 {
-  if (mContent->AttrValueIs(kNameSpaceID_None, nsAccessibilityAtoms::type,
-                            nsAccessibilityAtoms::password, eIgnoreCase)) {
+  if (mContent->AttrValueIs(kNameSpaceID_None, nsGkAtoms::type,
+                            nsGkAtoms::password, eIgnoreCase)) {
     return nsIAccessibleRole::ROLE_PASSWORD_TEXT;
   }
   return nsIAccessibleRole::ROLE_ENTRY;
@@ -420,7 +418,7 @@ nsHTMLTextFieldAccessible::GetNameInternal(nsAString& aName)
     return NS_OK;
 
   // text inputs and textareas might have useful placeholder text
-  mContent->GetAttr(kNameSpaceID_None, nsAccessibilityAtoms::placeholder, aName);
+  mContent->GetAttr(kNameSpaceID_None, nsGkAtoms::placeholder, aName);
 
   return NS_OK;
 }
@@ -461,8 +459,8 @@ nsHTMLTextFieldAccessible::NativeState()
   PRUint64 state = nsHyperTextAccessibleWrap::NativeState();
 
   // can be focusable, focused, protected. readonly, unavailable, selected
-  if (mContent->AttrValueIs(kNameSpaceID_None, nsAccessibilityAtoms::type,
-                            nsAccessibilityAtoms::password, eIgnoreCase)) {
+  if (mContent->AttrValueIs(kNameSpaceID_None, nsGkAtoms::type,
+                            nsGkAtoms::password, eIgnoreCase)) {
     state |= states::PROTECTED;
   }
   else {
@@ -471,7 +469,7 @@ nsHTMLTextFieldAccessible::NativeState()
       state |= states::HASPOPUP;
   }
 
-  if (mContent->HasAttr(kNameSpaceID_None, nsAccessibilityAtoms::readonly)) {
+  if (mContent->HasAttr(kNameSpaceID_None, nsGkAtoms::readonly)) {
     state |= states::READONLY;
   }
 
@@ -489,10 +487,10 @@ nsHTMLTextFieldAccessible::NativeState()
 
   nsCOMPtr<nsIContent> bindingContent = mContent->GetBindingParent();
   if (bindingContent &&
-      bindingContent->NodeInfo()->Equals(nsAccessibilityAtoms::textbox,
+      bindingContent->NodeInfo()->Equals(nsGkAtoms::textbox,
                                          kNameSpaceID_XUL)) {
-     if (bindingContent->AttrValueIs(kNameSpaceID_None, nsAccessibilityAtoms::type,
-                                     nsAccessibilityAtoms::autocomplete,
+     if (bindingContent->AttrValueIs(kNameSpaceID_None, nsGkAtoms::type,
+                                     nsGkAtoms::autocomplete,
                                      eIgnoreCase)) {
        // If parent is XUL textbox and value of @type attribute is "autocomplete",
        // then this accessible supports autocompletion.
@@ -505,7 +503,7 @@ nsHTMLTextFieldAccessible::NativeState()
     // we're talking here is based on what the user types, where a popup of
     // possible choices comes up.
     nsAutoString autocomplete;
-    mContent->GetAttr(kNameSpaceID_None, nsAccessibilityAtoms::autocomplete,
+    mContent->GetAttr(kNameSpaceID_None, nsGkAtoms::autocomplete,
                       autocomplete);
 
     if (!autocomplete.LowerCaseEqualsLiteral("off")) {
@@ -514,7 +512,7 @@ nsHTMLTextFieldAccessible::NativeState()
       nsCOMPtr<nsIContent> formContent(do_QueryInterface(form));
       if (formContent) {
         formContent->GetAttr(kNameSpaceID_None,
-                             nsAccessibilityAtoms::autocomplete, autocomplete);
+                             nsGkAtoms::autocomplete, autocomplete);
       }
 
       if (!formContent || !autocomplete.LowerCaseEqualsLiteral("off"))
@@ -598,7 +596,7 @@ nsIContent* nsHTMLGroupboxAccessible::GetLegend()
   nsresult count = 0;
   nsIContent *legendContent = nsnull;
   while ((legendContent = mContent->GetChildAt(count++)) != nsnull) {
-    if (legendContent->NodeInfo()->Equals(nsAccessibilityAtoms::legend,
+    if (legendContent->NodeInfo()->Equals(nsGkAtoms::legend,
                                           mContent->GetNameSpaceID())) {
       // Either XHTML namespace or no namespace
       return legendContent;
diff --git a/accessible/src/html/nsHTMLImageAccessible.cpp b/accessible/src/html/nsHTMLImageAccessible.cpp
index de575fc6f512..098d9f155f51 100644
--- a/accessible/src/html/nsHTMLImageAccessible.cpp
+++ b/accessible/src/html/nsHTMLImageAccessible.cpp
@@ -39,7 +39,6 @@
 #include "nsHTMLImageAccessible.h"
 
 #include "States.h"
-#include "nsAccessibilityAtoms.h"
 #include "nsAccUtils.h"
 
 #include "imgIContainer.h"
@@ -104,7 +103,7 @@ nsresult
 nsHTMLImageAccessible::GetNameInternal(nsAString& aName)
 {
   PRBool hasAltAttrib =
-    mContent->GetAttr(kNameSpaceID_None, nsAccessibilityAtoms::alt, aName);
+    mContent->GetAttr(kNameSpaceID_None, nsGkAtoms::alt, aName);
   if (!aName.IsEmpty())
     return NS_OK;
 
@@ -212,9 +211,9 @@ nsHTMLImageAccessible::GetAttributesInternal(nsIPersistentProperties *aAttribute
   NS_ENSURE_SUCCESS(rv, rv);
 
   nsAutoString src;
-  mContent->GetAttr(kNameSpaceID_None, nsAccessibilityAtoms::src, src);
+  mContent->GetAttr(kNameSpaceID_None, nsGkAtoms::src, src);
   if (!src.IsEmpty())
-    nsAccUtils::SetAccAttr(aAttributes, nsAccessibilityAtoms::src, src);
+    nsAccUtils::SetAccAttr(aAttributes, nsGkAtoms::src, src);
 
   return NS_OK;
 }
@@ -228,7 +227,7 @@ nsHTMLImageAccessible::HasLongDesc()
   if (IsDefunct())
     return PR_FALSE;
 
-  return mContent->HasAttr(kNameSpaceID_None, nsAccessibilityAtoms::longDesc);
+  return mContent->HasAttr(kNameSpaceID_None, nsGkAtoms::longdesc);
 }
 
 PRBool
diff --git a/accessible/src/html/nsHTMLImageMapAccessible.cpp b/accessible/src/html/nsHTMLImageMapAccessible.cpp
index 23159ddde01a..01af9130e5ce 100644
--- a/accessible/src/html/nsHTMLImageMapAccessible.cpp
+++ b/accessible/src/html/nsHTMLImageMapAccessible.cpp
@@ -160,10 +160,8 @@ nsHTMLAreaAccessible::GetNameInternal(nsAString & aName)
   if (!aName.IsEmpty())
     return NS_OK;
 
-  if (!mContent->GetAttr(kNameSpaceID_None, nsAccessibilityAtoms::alt,
-                         aName)) {
+  if (!mContent->GetAttr(kNameSpaceID_None, nsGkAtoms::alt, aName))
     return GetValue(aName);
-  }
 
   return NS_OK;
 }
diff --git a/accessible/src/html/nsHTMLLinkAccessible.cpp b/accessible/src/html/nsHTMLLinkAccessible.cpp
index 468702144ff7..c213d8a380ba 100644
--- a/accessible/src/html/nsHTMLLinkAccessible.cpp
+++ b/accessible/src/html/nsHTMLLinkAccessible.cpp
@@ -77,7 +77,7 @@ nsHTMLLinkAccessible::NativeState()
 
   states  &= ~states::READONLY;
 
-  if (mContent->HasAttr(kNameSpaceID_None, nsAccessibilityAtoms::name)) {
+  if (mContent->HasAttr(kNameSpaceID_None, nsGkAtoms::name)) {
     // This is how we indicate it is a named anchor
     // In other words, this anchor can be selected as a location :)
     // There is no other better state to use to indicate this.
diff --git a/accessible/src/html/nsHTMLSelectAccessible.cpp b/accessible/src/html/nsHTMLSelectAccessible.cpp
index b300ae1a6e21..568b484e7766 100644
--- a/accessible/src/html/nsHTMLSelectAccessible.cpp
+++ b/accessible/src/html/nsHTMLSelectAccessible.cpp
@@ -89,7 +89,7 @@ nsHTMLSelectListAccessible::NativeState()
       state &= ~states::FOCUSED;
     }
   }
-  if (mContent->HasAttr(kNameSpaceID_None, nsAccessibilityAtoms::multiple))
+  if (mContent->HasAttr(kNameSpaceID_None, nsGkAtoms::multiple))
     state |= states::MULTISELECTABLE | states::EXTSELECTABLE;
 
   return state;
@@ -116,14 +116,14 @@ nsHTMLSelectListAccessible::IsSelect()
 bool
 nsHTMLSelectListAccessible::SelectAll()
 {
-  return mContent->HasAttr(kNameSpaceID_None, nsAccessibilityAtoms::multiple) ?
+  return mContent->HasAttr(kNameSpaceID_None, nsGkAtoms::multiple) ?
            nsAccessibleWrap::SelectAll() : false;
 }
 
 bool
 nsHTMLSelectListAccessible::UnselectAll()
 {
-  return mContent->HasAttr(kNameSpaceID_None, nsAccessibilityAtoms::multiple) ?
+  return mContent->HasAttr(kNameSpaceID_None, nsGkAtoms::multiple) ?
            nsAccessibleWrap::UnselectAll() : false;
 }
 
@@ -155,8 +155,8 @@ nsHTMLSelectListAccessible::CacheOptSiblings(nsIContent *aParentContent)
     }
 
     nsCOMPtr<nsIAtom> tag = childContent->Tag();
-    if (tag == nsAccessibilityAtoms::option ||
-        tag == nsAccessibilityAtoms::optgroup) {
+    if (tag == nsGkAtoms::option ||
+        tag == nsGkAtoms::optgroup) {
 
       // Get an accessible for option or optgroup and cache it.
       nsRefPtr<nsAccessible> accessible =
@@ -166,7 +166,7 @@ nsHTMLSelectListAccessible::CacheOptSiblings(nsIContent *aParentContent)
         AppendChild(accessible);
 
       // Deep down into optgroup element.
-      if (tag == nsAccessibilityAtoms::optgroup)
+      if (tag == nsGkAtoms::optgroup)
         CacheOptSiblings(childContent);
     }
   }
@@ -200,7 +200,7 @@ nsHTMLSelectOptionAccessible::GetNameInternal(nsAString& aName)
 {
   // CASE #1 -- great majority of the cases
   // find the label attribute - this is what the W3C says we should use
-  mContent->GetAttr(kNameSpaceID_None, nsAccessibilityAtoms::label, aName);
+  mContent->GetAttr(kNameSpaceID_None, nsGkAtoms::label, aName);
   if (!aName.IsEmpty())
     return NS_OK;
 
@@ -323,7 +323,7 @@ nsHTMLSelectOptionAccessible::GetLevelInternal()
   nsIContent *parentContent = mContent->GetParent();
 
   PRInt32 level =
-    parentContent->NodeInfo()->Equals(nsAccessibilityAtoms::optgroup) ? 2 : 1;
+    parentContent->NodeInfo()->Equals(nsGkAtoms::optgroup) ? 2 : 1;
 
   if (level == 1 && Role() != nsIAccessibleRole::ROLE_HEADING)
     level = 0; // In a single level list, the level is irrelevant
@@ -517,7 +517,7 @@ void
 nsHTMLSelectOptionAccessible::SelectionChangedIfOption(nsIContent *aPossibleOptionNode)
 {
   if (!aPossibleOptionNode ||
-      aPossibleOptionNode->Tag() != nsAccessibilityAtoms::option ||
+      aPossibleOptionNode->Tag() != nsGkAtoms::option ||
       !aPossibleOptionNode->IsHTML()) {
     return;
   }
@@ -564,7 +564,7 @@ nsHTMLSelectOptionAccessible::GetSelectState(PRUint64* aState)
   *aState = 0;
 
   nsIContent *content = mContent;
-  while (content && content->Tag() != nsAccessibilityAtoms::select) {
+  while (content && content->Tag() != nsGkAtoms::select) {
     content = content->GetParent();
   }
 
diff --git a/accessible/src/html/nsHTMLSelectAccessible.h b/accessible/src/html/nsHTMLSelectAccessible.h
index 9cf1a290c174..8e0842c365ba 100644
--- a/accessible/src/html/nsHTMLSelectAccessible.h
+++ b/accessible/src/html/nsHTMLSelectAccessible.h
@@ -39,7 +39,6 @@
 #ifndef __nsHTMLSelectAccessible_h__
 #define __nsHTMLSelectAccessible_h__
 
-#include "nsAccessibilityAtoms.h"
 #include "nsHTMLFormControlAccessible.h"
 #include "nsIDOMHTMLOptionsCollection.h"
 #include "nsIDOMHTMLOptionElement.h"
diff --git a/accessible/src/html/nsHTMLTableAccessible.cpp b/accessible/src/html/nsHTMLTableAccessible.cpp
index 80bdb49f385b..4c97ba8f6980 100644
--- a/accessible/src/html/nsHTMLTableAccessible.cpp
+++ b/accessible/src/html/nsHTMLTableAccessible.cpp
@@ -138,8 +138,7 @@ nsHTMLTableCellAccessible::GetAttributesInternal(nsIPersistentProperties *aAttri
 
   nsAutoString stringIdx;
   stringIdx.AppendInt(idx);
-  nsAccUtils::SetAccAttr(aAttributes, nsAccessibilityAtoms::tableCellIndex,
-                         stringIdx);
+  nsAccUtils::SetAccAttr(aAttributes, nsGkAtoms::tableCellIndex, stringIdx);
   return NS_OK;
 }
 
@@ -310,7 +309,7 @@ nsHTMLTableCellAccessible::GetHeaderCells(PRInt32 aRowOrColumnHeaderCell,
                                           nsIArray **aHeaderCells)
 {
   // Get header cells from @header attribute.
-  IDRefsIterator iter(mContent, nsAccessibilityAtoms::headers);
+  IDRefsIterator iter(mContent, nsGkAtoms::headers);
   nsIContent* headerCellElm = iter.NextElem();
   if (headerCellElm) {
     nsresult rv = NS_OK;
@@ -366,9 +365,9 @@ nsHTMLTableHeaderCellAccessible::NativeRole()
 {
   // Check value of @scope attribute.
   static nsIContent::AttrValuesArray scopeValues[] =
-    {&nsAccessibilityAtoms::col, &nsAccessibilityAtoms::row, nsnull};
+    {&nsGkAtoms::col, &nsGkAtoms::row, nsnull};
   PRInt32 valueIdx = 
-    mContent->FindAttrValueIn(kNameSpaceID_None, nsAccessibilityAtoms::scope,
+    mContent->FindAttrValueIn(kNameSpaceID_None, nsGkAtoms::scope,
                               scopeValues, eCaseMatters);
 
   switch (valueIdx) {
@@ -483,7 +482,7 @@ nsHTMLTableAccessible::GetNameInternal(nsAString& aName)
   }
 
   // If no caption then use summary as a name.
-  mContent->GetAttr(kNameSpaceID_None, nsAccessibilityAtoms::summary, aName);
+  mContent->GetAttr(kNameSpaceID_None, nsGkAtoms::summary, aName);
   return NS_OK;
 }
 
@@ -1283,7 +1282,7 @@ nsHTMLTableAccessible::Description(nsString& aDescription)
                                                    &captionText);
 
       if (!captionText.IsEmpty()) { // summary isn't used as a name.
-        mContent->GetAttr(kNameSpaceID_None, nsAccessibilityAtoms::summary,
+        mContent->GetAttr(kNameSpaceID_None, nsGkAtoms::summary,
                           aDescription);
       }
     }
@@ -1381,7 +1380,7 @@ nsHTMLTableAccessible::IsProbablyForLayout(PRBool *aIsProbablyForLayout)
     RETURN_LAYOUT_ANSWER(PR_FALSE, "Has role attribute");
   }
 
-  if (mContent->HasAttr(kNameSpaceID_None, nsAccessibilityAtoms::role)) {
+  if (mContent->HasAttr(kNameSpaceID_None, nsGkAtoms::role)) {
     // Role attribute is present, but overridden roles have already been dealt with.
     // Only landmarks and other roles that don't override the role from native
     // markup are left to deal with here.
@@ -1390,7 +1389,7 @@ nsHTMLTableAccessible::IsProbablyForLayout(PRBool *aIsProbablyForLayout)
   
   // Check for legitimate data table elements or attributes
   nsAutoString summary;
-  if ((mContent->GetAttr(kNameSpaceID_None, nsAccessibilityAtoms::summary, summary) &&
+  if ((mContent->GetAttr(kNameSpaceID_None, nsGkAtoms::summary, summary) &&
        !summary.IsEmpty()) || 
       HasDescendant(NS_LITERAL_STRING("caption"), PR_FALSE) ||
       HasDescendant(NS_LITERAL_STRING("th")) ||
diff --git a/accessible/src/html/nsHTMLTextAccessible.cpp b/accessible/src/html/nsHTMLTextAccessible.cpp
index 6d91411be350..5e0d31c65009 100644
--- a/accessible/src/html/nsHTMLTextAccessible.cpp
+++ b/accessible/src/html/nsHTMLTextAccessible.cpp
@@ -204,7 +204,7 @@ nsHTMLOutputAccessible::RelationByType(PRUint32 aType)
 {
   Relation rel = nsAccessibleWrap::RelationByType(aType);
   if (aType == nsIAccessibleRelation::RELATION_CONTROLLED_BY)
-    rel.AppendIter(new IDRefsIterator(mContent, nsAccessibilityAtoms::_for));
+    rel.AppendIter(new IDRefsIterator(mContent, nsGkAtoms::_for));
 
   return rel;
 }
@@ -221,7 +221,7 @@ nsHTMLOutputAccessible::GetAttributesInternal(nsIPersistentProperties* aAttribut
   nsresult rv = nsAccessibleWrap::GetAttributesInternal(aAttributes);
   NS_ENSURE_SUCCESS(rv, rv);
 
-  nsAccUtils::SetAccAttr(aAttributes, nsAccessibilityAtoms::live,
+  nsAccUtils::SetAccAttr(aAttributes, nsGkAtoms::live,
                          NS_LITERAL_STRING("polite"));
   
   return NS_OK;
diff --git a/accessible/src/html/nsHyperTextAccessible.cpp b/accessible/src/html/nsHyperTextAccessible.cpp
index 16985de7bd61..5200423d6f07 100644
--- a/accessible/src/html/nsHyperTextAccessible.cpp
+++ b/accessible/src/html/nsHyperTextAccessible.cpp
@@ -40,7 +40,6 @@
 #include "nsHyperTextAccessible.h"
 
 #include "States.h"
-#include "nsAccessibilityAtoms.h"
 #include "nsAccessibilityService.h"
 #include "nsAccUtils.h"
 #include "nsTextAttrs.h"
@@ -129,39 +128,39 @@ nsHyperTextAccessible::NativeRole()
 {
   nsIAtom *tag = mContent->Tag();
 
-  if (tag == nsAccessibilityAtoms::form)
+  if (tag == nsGkAtoms::form)
     return nsIAccessibleRole::ROLE_FORM;
 
-  if (tag == nsAccessibilityAtoms::blockquote ||
-      tag == nsAccessibilityAtoms::div ||
-      tag == nsAccessibilityAtoms::nav)
+  if (tag == nsGkAtoms::blockquote ||
+      tag == nsGkAtoms::div ||
+      tag == nsGkAtoms::nav)
     return nsIAccessibleRole::ROLE_SECTION;
 
-  if (tag == nsAccessibilityAtoms::h1 ||
-      tag == nsAccessibilityAtoms::h2 ||
-      tag == nsAccessibilityAtoms::h3 ||
-      tag == nsAccessibilityAtoms::h4 ||
-      tag == nsAccessibilityAtoms::h5 ||
-      tag == nsAccessibilityAtoms::h6)
+  if (tag == nsGkAtoms::h1 ||
+      tag == nsGkAtoms::h2 ||
+      tag == nsGkAtoms::h3 ||
+      tag == nsGkAtoms::h4 ||
+      tag == nsGkAtoms::h5 ||
+      tag == nsGkAtoms::h6)
     return nsIAccessibleRole::ROLE_HEADING;
 
-  if (tag == nsAccessibilityAtoms::article)
+  if (tag == nsGkAtoms::article)
     return nsIAccessibleRole::ROLE_DOCUMENT;
         
   // Deal with html landmark elements
-  if (tag == nsAccessibilityAtoms::header)
+  if (tag == nsGkAtoms::header)
     return nsIAccessibleRole::ROLE_HEADER;
 
-  if (tag == nsAccessibilityAtoms::footer)
+  if (tag == nsGkAtoms::footer)
     return nsIAccessibleRole::ROLE_FOOTER;
 
-  if (tag == nsAccessibilityAtoms::aside)
+  if (tag == nsGkAtoms::aside)
     return nsIAccessibleRole::ROLE_NOTE;
 
   // Treat block frames as paragraphs
   nsIFrame *frame = GetFrame();
-  if (frame && frame->GetType() == nsAccessibilityAtoms::blockFrame &&
-      frame->GetContent()->Tag() != nsAccessibilityAtoms::input) {
+  if (frame && frame->GetType() == nsGkAtoms::blockFrame &&
+      frame->GetContent()->Tag() != nsGkAtoms::input) {
     // An html:input @type="file" is the only input that is exposed as a
     // blockframe. It must be exposed as ROLE_TEXT_CONTAINER for JAWS.
     return nsIAccessibleRole::ROLE_PARAGRAPH;
@@ -183,7 +182,7 @@ nsHyperTextAccessible::NativeState()
     if (0 == (flags & nsIPlaintextEditor::eEditorReadonlyMask)) {
       states |= states::EDITABLE;
     }
-  } else if (mContent->Tag() == nsAccessibilityAtoms::article) {
+  } else if (mContent->Tag() == nsGkAtoms::article) {
     // We want <article> to behave like a document in terms of readonly state.
     states |= states::READONLY;
   }
@@ -200,7 +199,7 @@ nsIntRect nsHyperTextAccessible::GetBoundsForString(nsIFrame *aFrame, PRUint32 a
 {
   nsIntRect screenRect;
   NS_ENSURE_TRUE(aFrame, screenRect);
-  if (aFrame->GetType() != nsAccessibilityAtoms::textFrame) {
+  if (aFrame->GetType() != nsGkAtoms::textFrame) {
     // XXX fallback for non-text frames, happens for bullets right now
     // but in the future bullets will have proper text frames
     return aFrame->GetScreenRectExternal();
@@ -338,7 +337,7 @@ nsHyperTextAccessible::GetPosAndText(PRInt32& aStartOffset, PRInt32& aEndOffset,
       PRInt32 substringEndOffset = -1;
       PRUint32 ourRenderedStart = 0;
       PRInt32 ourContentStart = 0;
-      if (frame->GetType() == nsAccessibilityAtoms::textFrame) {
+      if (frame->GetType() == nsGkAtoms::textFrame) {
         nsresult rv = frame->GetRenderedText(nsnull, &skipChars, &iter);
         if (NS_SUCCEEDED(rv)) {
           ourRenderedStart = iter.GetSkippedOffset();
@@ -360,7 +359,7 @@ nsHyperTextAccessible::GetPosAndText(PRInt32& aStartOffset, PRInt32& aEndOffset,
           // Get out the continuing text frame with this offset
           PRInt32 outStartLineUnused;
           PRInt32 contentOffset;
-          if (frame->GetType() == nsAccessibilityAtoms::textFrame) {
+          if (frame->GetType() == nsGkAtoms::textFrame) {
             contentOffset = iter.ConvertSkippedToOriginal(startOffset) +
                             ourRenderedStart - ourContentStart;
           }
@@ -423,7 +422,7 @@ nsHyperTextAccessible::GetPosAndText(PRInt32& aStartOffset, PRInt32& aEndOffset,
         if (endOffset > 0) {
           if (aText) {
             // XXX: should use nsIAccessible::AppendTextTo.
-            if (frame->GetType() == nsAccessibilityAtoms::brFrame) {
+            if (frame->GetType() == nsGkAtoms::brFrame) {
               *aText += kForcedNewLineChar;
             } else if (nsAccUtils::MustPrune(this)) {
               *aText += kImaginaryEmbeddedObjectChar;
@@ -609,10 +608,10 @@ nsHyperTextAccessible::DOMPointToHypertextOffset(nsINode *aNode,
   if (findNode) {
     nsCOMPtr<nsIContent> findContent(do_QueryInterface(findNode));
     if (findContent && findContent->IsHTML() &&
-        findContent->NodeInfo()->Equals(nsAccessibilityAtoms::br) &&
+        findContent->NodeInfo()->Equals(nsGkAtoms::br) &&
         findContent->AttrValueIs(kNameSpaceID_None,
-                                 nsAccessibilityAtoms::mozeditorbogusnode,
-                                 nsAccessibilityAtoms::_true,
+                                 nsGkAtoms::mozeditorbogusnode,
+                                 nsGkAtoms::_true,
                                  eIgnoreCase)) {
       // This <br> is the hacky "bogus node" used when there is no text in a control
       *aHyperTextOffset = 0;
@@ -801,7 +800,7 @@ nsHyperTextAccessible::GetRelativeOffset(nsIPresShell *aPresShell,
     nsIFrame *frame = aFromAccessible->GetFrame();
     NS_ENSURE_TRUE(frame, -1);
 
-    if (frame->GetType() == nsAccessibilityAtoms::textFrame) {
+    if (frame->GetType() == nsGkAtoms::textFrame) {
       rv = RenderedToContentOffset(frame, aFromOffset, &contentOffset);
       NS_ENSURE_SUCCESS(rv, -1);
     }
@@ -1166,7 +1165,7 @@ nsHyperTextAccessible::GetTextAttributes(PRBool aIncludeDefAttrs,
 
   // Compute spelling attributes on text accessible only.
   nsIFrame *offsetFrame = accAtOffset->GetFrame();
-  if (offsetFrame && offsetFrame->GetType() == nsAccessibilityAtoms::textFrame) {
+  if (offsetFrame && offsetFrame->GetType() == nsGkAtoms::textFrame) {
     nsCOMPtr<nsIDOMNode> node = accAtOffset->GetDOMNode();
 
     PRInt32 nodeOffset = 0;
@@ -1210,17 +1209,17 @@ PRInt32
 nsHyperTextAccessible::GetLevelInternal()
 {
   nsIAtom *tag = mContent->Tag();
-  if (tag == nsAccessibilityAtoms::h1)
+  if (tag == nsGkAtoms::h1)
     return 1;
-  if (tag == nsAccessibilityAtoms::h2)
+  if (tag == nsGkAtoms::h2)
     return 2;
-  if (tag == nsAccessibilityAtoms::h3)
+  if (tag == nsGkAtoms::h3)
     return 3;
-  if (tag == nsAccessibilityAtoms::h4)
+  if (tag == nsGkAtoms::h4)
     return 4;
-  if (tag == nsAccessibilityAtoms::h5)
+  if (tag == nsGkAtoms::h5)
     return 5;
-  if (tag == nsAccessibilityAtoms::h6)
+  if (tag == nsGkAtoms::h6)
     return 6;
 
   return nsAccessibleWrap::GetLevelInternal();
@@ -1237,7 +1236,7 @@ nsHyperTextAccessible::GetAttributesInternal(nsIPersistentProperties *aAttribute
   // XXX: 'formatting' attribute is deprecated and will be removed in Mozilla2,
   // use 'display' attribute instead.
   nsIFrame *frame = GetFrame();
-  if (frame && frame->GetType() == nsAccessibilityAtoms::blockFrame) {
+  if (frame && frame->GetType() == nsGkAtoms::blockFrame) {
     nsAutoString oldValueUnused;
     aAttributes->SetStringProperty(NS_LITERAL_CSTRING("formatting"), NS_LITERAL_STRING("block"),
                                    oldValueUnused);
@@ -1248,7 +1247,7 @@ nsHyperTextAccessible::GetAttributesInternal(nsIPersistentProperties *aAttribute
     if (lineNumber >= 1) {
       nsAutoString strLineNumber;
       strLineNumber.AppendInt(lineNumber);
-      nsAccUtils::SetAccAttr(aAttributes, nsAccessibilityAtoms::lineNumber,
+      nsAccUtils::SetAccAttr(aAttributes, nsGkAtoms::lineNumber,
                              strLineNumber);
     }
   }
@@ -1257,14 +1256,14 @@ nsHyperTextAccessible::GetAttributesInternal(nsIPersistentProperties *aAttribute
   // make AT navigation schemes "just work". Note html:header is redundant as
   // a landmark since it usually contains headings. We're not yet sure how the
   // web will use html:footer but our best bet right now is as contentinfo.
-  if (mContent->Tag() == nsAccessibilityAtoms::nav)
-    nsAccUtils::SetAccAttr(aAttributes, nsAccessibilityAtoms::xmlroles,
+  if (mContent->Tag() == nsGkAtoms::nav)
+    nsAccUtils::SetAccAttr(aAttributes, nsGkAtoms::xmlroles,
                            NS_LITERAL_STRING("navigation"));
-  else if (mContent->Tag() == nsAccessibilityAtoms::footer) 
-    nsAccUtils::SetAccAttr(aAttributes, nsAccessibilityAtoms::xmlroles,
+  else if (mContent->Tag() == nsGkAtoms::footer) 
+    nsAccUtils::SetAccAttr(aAttributes, nsGkAtoms::xmlroles,
                            NS_LITERAL_STRING("contentinfo"));
-  else if (mContent->Tag() == nsAccessibilityAtoms::aside) 
-    nsAccUtils::SetAccAttr(aAttributes, nsAccessibilityAtoms::xmlroles,
+  else if (mContent->Tag() == nsGkAtoms::aside) 
+    nsAccUtils::SetAccAttr(aAttributes, nsGkAtoms::xmlroles,
                            NS_LITERAL_STRING("complementary"));
 
   return  NS_OK;
@@ -1360,7 +1359,7 @@ nsHyperTextAccessible::GetOffsetAtPoint(PRInt32 aX, PRInt32 aY,
       nsSize frameSize = frame->GetSize();
       if (pointInFrame.x < frameSize.width && pointInFrame.y < frameSize.height) {
         // Finished
-        if (frame->GetType() == nsAccessibilityAtoms::textFrame) {
+        if (frame->GetType() == nsGkAtoms::textFrame) {
           nsIFrame::ContentOffsets contentOffsets = frame->GetContentOffsetsFromPointExternal(pointInFrame, PR_TRUE);
           if (contentOffsets.IsNull() || contentOffsets.content != content) {
             return NS_OK; // Not found, will return -1
@@ -2110,7 +2109,7 @@ nsresult nsHyperTextAccessible::ContentToRenderedOffset(nsIFrame *aFrame, PRInt3
     *aRenderedOffset = 0;
     return NS_OK;
   }
-  NS_ASSERTION(aFrame->GetType() == nsAccessibilityAtoms::textFrame,
+  NS_ASSERTION(aFrame->GetType() == nsGkAtoms::textFrame,
                "Need text frame for offset conversion");
   NS_ASSERTION(aFrame->GetPrevContinuation() == nsnull,
                "Call on primary frame only");
@@ -2136,7 +2135,7 @@ nsresult nsHyperTextAccessible::RenderedToContentOffset(nsIFrame *aFrame, PRUint
   *aContentOffset = 0;
   NS_ENSURE_TRUE(aFrame, NS_ERROR_FAILURE);
 
-  NS_ASSERTION(aFrame->GetType() == nsAccessibilityAtoms::textFrame,
+  NS_ASSERTION(aFrame->GetType() == nsGkAtoms::textFrame,
                "Need text frame for offset conversion");
   NS_ASSERTION(aFrame->GetPrevContinuation() == nsnull,
                "Call on primary frame only");
@@ -2283,7 +2282,7 @@ nsHyperTextAccessible::GetDOMPointByFrameOffset(nsIFrame *aFrame,
     *aNodeOffset = parent->IndexOf(content) + 1;
     node = do_QueryInterface(parent);
 
-  } else if (aFrame->GetType() == nsAccessibilityAtoms::textFrame) {
+  } else if (aFrame->GetType() == nsGkAtoms::textFrame) {
     nsCOMPtr<nsIContent> content(aFrame->GetContent());
     NS_ENSURE_STATE(content);
 
@@ -2418,7 +2417,7 @@ nsHyperTextAccessible::GetSpellTextAttribute(nsIDOMNode *aNode,
         *aHTEndOffset = endHTOffset;
 
       if (aAttributes) {
-        nsAccUtils::SetAccAttr(aAttributes, nsAccessibilityAtoms::invalid,
+        nsAccUtils::SetAccAttr(aAttributes, nsGkAtoms::invalid,
                                NS_LITERAL_STRING("spelling"));
       }
 
diff --git a/accessible/src/msaa/nsAccessNodeWrap.cpp b/accessible/src/msaa/nsAccessNodeWrap.cpp
index 849715813bc6..7219b3df572b 100644
--- a/accessible/src/msaa/nsAccessNodeWrap.cpp
+++ b/accessible/src/msaa/nsAccessNodeWrap.cpp
@@ -41,7 +41,6 @@
 #include "AccessibleApplication.h"
 #include "ISimpleDOMNode_i.c"
 
-#include "nsAccessibilityAtoms.h"
 #include "nsAccessibilityService.h"
 #include "nsApplicationAccessibleWrap.h"
 #include "nsCoreUtils.h"
diff --git a/accessible/src/msaa/nsAccessibleWrap.cpp b/accessible/src/msaa/nsAccessibleWrap.cpp
index c506b3839e0b..bfcc43d7edd9 100644
--- a/accessible/src/msaa/nsAccessibleWrap.cpp
+++ b/accessible/src/msaa/nsAccessibleWrap.cpp
@@ -38,7 +38,6 @@
 
 #include "nsAccessibleWrap.h"
 
-#include "nsAccessibilityAtoms.h"
 #include "nsAccUtils.h"
 #include "nsCoreUtils.h"
 #include "nsWinUtils.h"
@@ -408,7 +407,7 @@ __try {
   if (content->IsElement()) {
     nsAutoString roleString;
     if (msaaRole != ROLE_SYSTEM_CLIENT &&
-        !content->GetAttr(kNameSpaceID_None, nsAccessibilityAtoms::role, roleString)) {
+        !content->GetAttr(kNameSpaceID_None, nsGkAtoms::role, roleString)) {
       nsIDocument * document = content->GetCurrentDoc();
       if (!document)
         return E_FAIL;
diff --git a/accessible/src/msaa/nsXULMenuAccessibleWrap.cpp b/accessible/src/msaa/nsXULMenuAccessibleWrap.cpp
index 0977a43933ca..20b1fd4a3f62 100644
--- a/accessible/src/msaa/nsXULMenuAccessibleWrap.cpp
+++ b/accessible/src/msaa/nsXULMenuAccessibleWrap.cpp
@@ -36,7 +36,6 @@
  * ***** END LICENSE BLOCK ***** */
 
 #include "nsXULMenuAccessibleWrap.h"
-#include "nsAccessibilityAtoms.h"
 #include "nsINameSpaceManager.h"
 
 ////////////////////////////////////////////////////////////////////////////////
@@ -60,7 +59,7 @@ nsXULMenuitemAccessibleWrap::GetName(nsAString& aName)
   }
   
   nsAutoString accel;
-  mContent->GetAttr(kNameSpaceID_None, nsAccessibilityAtoms::acceltext, accel);
+  mContent->GetAttr(kNameSpaceID_None, nsGkAtoms::acceltext, accel);
   if (!accel.IsEmpty()) {
     aName += NS_LITERAL_STRING("\t") + accel;
   }
diff --git a/accessible/src/xforms/nsXFormsAccessible.cpp b/accessible/src/xforms/nsXFormsAccessible.cpp
index 0fe70dee3a60..505223b62715 100644
--- a/accessible/src/xforms/nsXFormsAccessible.cpp
+++ b/accessible/src/xforms/nsXFormsAccessible.cpp
@@ -204,7 +204,7 @@ void
 nsXFormsAccessible::Description(nsString& aDescription)
 {
   nsTextEquivUtils::
-    GetTextEquivFromIDRefs(this, nsAccessibilityAtoms::aria_describedby,
+    GetTextEquivFromIDRefs(this, nsGkAtoms::aria_describedby,
                            aDescription);
 
   if (aDescription.IsEmpty())
@@ -300,7 +300,7 @@ nsXFormsSelectableAccessible::
   nsXFormsEditableAccessible(aContent, aShell), mIsSelect1Element(nsnull)
 {
   mIsSelect1Element =
-    mContent->NodeInfo()->Equals(nsAccessibilityAtoms::select1);
+    mContent->NodeInfo()->Equals(nsGkAtoms::select1);
 }
 
 bool
@@ -511,12 +511,12 @@ nsXFormsSelectableAccessible::GetItemByIndex(PRUint32* aIndex,
     nsIContent* childContent = child->GetContent();
     nsINodeInfo *nodeInfo = childContent->NodeInfo();
     if (nodeInfo->NamespaceEquals(NS_LITERAL_STRING(NS_NAMESPACE_XFORMS))) {
-      if (nodeInfo->Equals(nsAccessibilityAtoms::item)) {
+      if (nodeInfo->Equals(nsGkAtoms::item)) {
         if (!*aIndex)
           return childContent;
 
         --*aIndex;
-      } else if (nodeInfo->Equals(nsAccessibilityAtoms::choices)) {
+      } else if (nodeInfo->Equals(nsGkAtoms::choices)) {
         nsIContent* itemContent = GetItemByIndex(aIndex, child);
         if (itemContent)
           return itemContent;
@@ -582,13 +582,13 @@ nsXFormsSelectableItemAccessible::IsSelected()
       continue;
 
     nsCOMPtr<nsIDOMNode> DOMNode(do_QueryInterface(mContent));
-    if (nodeinfo->Equals(nsAccessibilityAtoms::select)) {
+    if (nodeinfo->Equals(nsGkAtoms::select)) {
       PRBool isSelected = PR_FALSE;
       rv = sXFormsService->IsSelectItemSelected(select, DOMNode, &isSelected);
       return NS_SUCCEEDED(rv) && isSelected;
     }
 
-    if (nodeinfo->Equals(nsAccessibilityAtoms::select1)) {
+    if (nodeinfo->Equals(nsGkAtoms::select1)) {
       nsCOMPtr<nsIDOMNode> selitem;
       rv = sXFormsService->GetSelectedItemForSelect1(select,
                                                      getter_AddRefs(selitem));
diff --git a/accessible/src/xforms/nsXFormsFormControlsAccessible.cpp b/accessible/src/xforms/nsXFormsFormControlsAccessible.cpp
index ac11a9160a67..843063e76f2b 100644
--- a/accessible/src/xforms/nsXFormsFormControlsAccessible.cpp
+++ b/accessible/src/xforms/nsXFormsFormControlsAccessible.cpp
@@ -70,7 +70,7 @@ void
 nsXFormsLabelAccessible::Description(nsString& aDescription)
 {
   nsTextEquivUtils::
-    GetTextEquivFromIDRefs(this, nsAccessibilityAtoms::aria_describedby,
+    GetTextEquivFromIDRefs(this, nsGkAtoms::aria_describedby,
                            aDescription);
 }
 
diff --git a/accessible/src/xul/nsXULColorPickerAccessible.cpp b/accessible/src/xul/nsXULColorPickerAccessible.cpp
index 44eecc307bed..20477e67fa2d 100644
--- a/accessible/src/xul/nsXULColorPickerAccessible.cpp
+++ b/accessible/src/xul/nsXULColorPickerAccessible.cpp
@@ -69,7 +69,7 @@ nsXULColorPickerTileAccessible::GetValue(nsAString& aValue)
   if (IsDefunct())
     return NS_ERROR_FAILURE;
 
-  mContent->GetAttr(kNameSpaceID_None, nsAccessibilityAtoms::color, aValue);
+  mContent->GetAttr(kNameSpaceID_None, nsGkAtoms::color, aValue);
   return NS_OK;
 }
 
@@ -94,12 +94,12 @@ nsXULColorPickerTileAccessible::NativeState()
 
   // Focused?
   PRBool isFocused = mContent->HasAttr(kNameSpaceID_None,
-                                       nsAccessibilityAtoms::hover);
+                                       nsGkAtoms::hover);
   if (isFocused)
     states |= states::FOCUSED;
 
   PRBool isSelected = mContent->HasAttr(kNameSpaceID_None,
-                                        nsAccessibilityAtoms::selected);
+                                        nsGkAtoms::selected);
   if (isSelected)
     states |= states::SELECTED;
 
diff --git a/accessible/src/xul/nsXULComboboxAccessible.cpp b/accessible/src/xul/nsXULComboboxAccessible.cpp
index e79c178572be..07fecef75ab1 100644
--- a/accessible/src/xul/nsXULComboboxAccessible.cpp
+++ b/accessible/src/xul/nsXULComboboxAccessible.cpp
@@ -62,8 +62,8 @@ nsXULComboboxAccessible::
 PRUint32
 nsXULComboboxAccessible::NativeRole()
 {
-  if (mContent->AttrValueIs(kNameSpaceID_None, nsAccessibilityAtoms::type,
-                            nsAccessibilityAtoms::autocomplete, eIgnoreCase))
+  if (mContent->AttrValueIs(kNameSpaceID_None, nsGkAtoms::type,
+                            nsGkAtoms::autocomplete, eIgnoreCase))
     return nsIAccessibleRole::ROLE_AUTOCOMPLETE;
   return nsIAccessibleRole::ROLE_COMBOBOX;
 }
@@ -138,9 +138,9 @@ nsXULComboboxAccessible::Description(nsString& aDescription)
 PRBool
 nsXULComboboxAccessible::GetAllowsAnonChildAccessibles()
 {
-  if (mContent->NodeInfo()->Equals(nsAccessibilityAtoms::textbox, kNameSpaceID_XUL) ||
-      mContent->AttrValueIs(kNameSpaceID_None, nsAccessibilityAtoms::editable,
-                            nsAccessibilityAtoms::_true, eIgnoreCase)) {
+  if (mContent->NodeInfo()->Equals(nsGkAtoms::textbox, kNameSpaceID_XUL) ||
+      mContent->AttrValueIs(kNameSpaceID_None, nsGkAtoms::editable,
+                            nsGkAtoms::_true, eIgnoreCase)) {
     // Both the XUL <textbox type="autocomplete"> and <menulist editable="true"> widgets
     // use nsXULComboboxAccessible. We need to walk the anonymous children for these
     // so that the entry field is a child
diff --git a/accessible/src/xul/nsXULFormControlAccessible.cpp b/accessible/src/xul/nsXULFormControlAccessible.cpp
index be727e6db579..7e043341905e 100644
--- a/accessible/src/xul/nsXULFormControlAccessible.cpp
+++ b/accessible/src/xul/nsXULFormControlAccessible.cpp
@@ -39,7 +39,6 @@
 
 #include "nsXULFormControlAccessible.h"
 
-#include "nsAccessibilityAtoms.h"
 #include "nsAccUtils.h"
 #include "nsAccTreeWalker.h"
 #include "nsCoreUtils.h"
@@ -159,7 +158,7 @@ nsXULButtonAccessible::NativeState()
   if (ContainsMenu())
     state |= states::HASPOPUP;
 
-  if (mContent->HasAttr(kNameSpaceID_None, nsAccessibilityAtoms::_default))
+  if (mContent->HasAttr(kNameSpaceID_None, nsGkAtoms::_default))
     state |= states::DEFAULT;
 
   return state;
@@ -178,14 +177,14 @@ nsXULButtonAccessible::CacheChildren()
   // XXX: no children until the button is menu button. Probably it's not
   // totally correct but in general AT wants to have leaf buttons.
   PRBool isMenu = mContent->AttrValueIs(kNameSpaceID_None,
-                                       nsAccessibilityAtoms::type,
-                                       nsAccessibilityAtoms::menu,
+                                       nsGkAtoms::type,
+                                       nsGkAtoms::menu,
                                        eCaseMatters);
 
   PRBool isMenuButton = isMenu ?
     PR_FALSE :
-    mContent->AttrValueIs(kNameSpaceID_None, nsAccessibilityAtoms::type,
-                          nsAccessibilityAtoms::menuButton, eCaseMatters);
+    mContent->AttrValueIs(kNameSpaceID_None, nsGkAtoms::type,
+                          nsGkAtoms::menuButton, eCaseMatters);
 
   if (!isMenu && !isMenuButton)
     return;
@@ -230,10 +229,10 @@ PRBool
 nsXULButtonAccessible::ContainsMenu()
 {
   static nsIContent::AttrValuesArray strings[] =
-    {&nsAccessibilityAtoms::menu, &nsAccessibilityAtoms::menuButton, nsnull};
+    {&nsGkAtoms::menu, &nsGkAtoms::menuButton, nsnull};
 
   return mContent->FindAttrValueIn(kNameSpaceID_None,
-                                   nsAccessibilityAtoms::type,
+                                   nsGkAtoms::type,
                                    strings, eCaseMatters) >= 0;
 }
 
@@ -600,9 +599,9 @@ nsXULToolbarButtonAccessible::IsSeparator(nsAccessible *aAccessible)
   if (!contentDomNode)
     return PR_FALSE;
 
-  return (contentDomNode->Tag() == nsAccessibilityAtoms::toolbarseparator) ||
-         (contentDomNode->Tag() == nsAccessibilityAtoms::toolbarspacer) ||
-         (contentDomNode->Tag() == nsAccessibilityAtoms::toolbarspring);
+  return (contentDomNode->Tag() == nsGkAtoms::toolbarseparator) ||
+         (contentDomNode->Tag() == nsGkAtoms::toolbarspacer) ||
+         (contentDomNode->Tag() == nsGkAtoms::toolbarspring);
 }
 
 
@@ -626,8 +625,7 @@ nsresult
 nsXULToolbarAccessible::GetNameInternal(nsAString& aName)
 {
   nsAutoString name;
-  if (mContent->GetAttr(kNameSpaceID_None, nsAccessibilityAtoms::toolbarname,
-                        name)) {
+  if (mContent->GetAttr(kNameSpaceID_None, nsGkAtoms::toolbarname, name)) {
     name.CompressWhitespace();
     aName = name;
   }
@@ -728,8 +726,8 @@ nsXULTextFieldAccessible::NativeState()
   if (menuList) {
     // <xul:menulist droppable="false">
     if (!mContent->AttrValueIs(kNameSpaceID_None,
-                               nsAccessibilityAtoms::editable,
-                               nsAccessibilityAtoms::_true, eIgnoreCase)) {
+                               nsGkAtoms::editable,
+                               nsGkAtoms::_true, eIgnoreCase)) {
       state |= states::READONLY;
     }
   }
@@ -740,8 +738,8 @@ nsXULTextFieldAccessible::NativeState()
 PRUint32
 nsXULTextFieldAccessible::NativeRole()
 {
-  if (mContent->AttrValueIs(kNameSpaceID_None, nsAccessibilityAtoms::type,
-                            nsAccessibilityAtoms::password, eIgnoreCase))
+  if (mContent->AttrValueIs(kNameSpaceID_None, nsGkAtoms::type,
+                            nsGkAtoms::password, eIgnoreCase))
     return nsIAccessibleRole::ROLE_PASSWORD_TEXT;
   return nsIAccessibleRole::ROLE_ENTRY;
 }
diff --git a/accessible/src/xul/nsXULListboxAccessible.cpp b/accessible/src/xul/nsXULListboxAccessible.cpp
index 6987eb1bf4d1..b3f467cf794a 100644
--- a/accessible/src/xul/nsXULListboxAccessible.cpp
+++ b/accessible/src/xul/nsXULListboxAccessible.cpp
@@ -177,8 +177,8 @@ nsXULListboxAccessible::NativeState()
 
   // see if we are multiple select if so set ourselves as such
 
-  if (mContent->AttrValueIs(kNameSpaceID_None, nsAccessibilityAtoms::seltype,
-                            nsAccessibilityAtoms::multiple, eCaseMatters)) {
+  if (mContent->AttrValueIs(kNameSpaceID_None, nsGkAtoms::seltype,
+                            nsGkAtoms::multiple, eCaseMatters)) {
       states |= states::MULTISELECTABLE | states::EXTSELECTABLE;
   }
 
@@ -250,7 +250,7 @@ nsXULListboxAccessible::GetColumnCount(PRInt32 *aColumnsCout)
   PRUint32 count = mContent->GetChildCount();
   for (PRUint32 index = 0; index < count; ++index) {
     nsIContent* childContent = mContent->GetChildAt(index);
-    if (childContent->NodeInfo()->Equals(nsAccessibilityAtoms::listcols,
+    if (childContent->NodeInfo()->Equals(nsGkAtoms::listcols,
                                          kNameSpaceID_XUL)) {
       headContent = childContent;
     }
@@ -264,7 +264,7 @@ nsXULListboxAccessible::GetColumnCount(PRInt32 *aColumnsCout)
   count = headContent->GetChildCount();
   for (PRUint32 index = 0; index < count; ++index) {
     nsIContent* childContent = headContent->GetChildAt(index);
-    if (childContent->NodeInfo()->Equals(nsAccessibilityAtoms::listcol,
+    if (childContent->NodeInfo()->Equals(nsGkAtoms::listcol,
                                          kNameSpaceID_XUL)) {
       columnCount++;
     }
@@ -834,8 +834,8 @@ nsXULListitemAccessible::
   nsXULMenuitemAccessible(aContent, aShell)
 {
   mIsCheckbox = mContent->AttrValueIs(kNameSpaceID_None,
-                                      nsAccessibilityAtoms::type,
-                                      nsAccessibilityAtoms::checkbox,
+                                      nsGkAtoms::type,
+                                      nsGkAtoms::checkbox,
                                       eCaseMatters);
 }
 
@@ -883,9 +883,9 @@ nsXULListitemAccessible::GetNameInternal(nsAString& aName)
 {
   nsIContent* child = mContent->GetChildAt(0);
   if (child) {
-    if (child->NodeInfo()->Equals(nsAccessibilityAtoms::listcell,
+    if (child->NodeInfo()->Equals(nsGkAtoms::listcell,
                                   kNameSpaceID_XUL)) {
-      child->GetAttr(kNameSpaceID_None, nsAccessibilityAtoms::label, aName);
+      child->GetAttr(kNameSpaceID_None, nsGkAtoms::label, aName);
       return NS_OK;
     }
   }
@@ -1214,7 +1214,7 @@ nsXULListCellAccessible::GetAttributesInternal(nsIPersistentProperties *aAttribu
 
   nsAutoString stringIdx;
   stringIdx.AppendInt(cellIdx);
-  nsAccUtils::SetAccAttr(aAttributes, nsAccessibilityAtoms::tableCellIndex,
+  nsAccUtils::SetAccAttr(aAttributes, nsGkAtoms::tableCellIndex,
                          stringIdx);
 
   return NS_OK;
diff --git a/accessible/src/xul/nsXULMenuAccessible.cpp b/accessible/src/xul/nsXULMenuAccessible.cpp
index 2e48f5e1b876..5309048a5491 100644
--- a/accessible/src/xul/nsXULMenuAccessible.cpp
+++ b/accessible/src/xul/nsXULMenuAccessible.cpp
@@ -286,15 +286,13 @@ nsXULMenuitemAccessible::NativeState()
   PRUint64 state = nsAccessible::NativeState();
 
   // Focused?
-  if (mContent->HasAttr(kNameSpaceID_None,
-                        nsAccessibilityAtoms::_moz_menuactive))
+  if (mContent->HasAttr(kNameSpaceID_None, nsGkAtoms::menuactive))
     state |= states::FOCUSED;
 
   // Has Popup?
-  if (mContent->NodeInfo()->Equals(nsAccessibilityAtoms::menu,
-                                   kNameSpaceID_XUL)) {
+  if (mContent->NodeInfo()->Equals(nsGkAtoms::menu, kNameSpaceID_XUL)) {
     state |= states::HASPOPUP;
-    if (mContent->HasAttr(kNameSpaceID_None, nsAccessibilityAtoms::open))
+    if (mContent->HasAttr(kNameSpaceID_None, nsGkAtoms::open))
       state |= states::EXPANDED;
     else
       state |= states::COLLAPSED;
@@ -302,18 +300,17 @@ nsXULMenuitemAccessible::NativeState()
 
   // Checkable/checked?
   static nsIContent::AttrValuesArray strings[] =
-    { &nsAccessibilityAtoms::radio, &nsAccessibilityAtoms::checkbox, nsnull };
+    { &nsGkAtoms::radio, &nsGkAtoms::checkbox, nsnull };
 
-  if (mContent->FindAttrValueIn(kNameSpaceID_None,
-                                nsAccessibilityAtoms::type,
-                                strings, eCaseMatters) >= 0) {
+  if (mContent->FindAttrValueIn(kNameSpaceID_None, nsGkAtoms::type, strings,
+                                eCaseMatters) >= 0) {
 
     // Checkable?
     state |= states::CHECKABLE;
 
     // Checked?
-    if (mContent->AttrValueIs(kNameSpaceID_None, nsAccessibilityAtoms::checked,
-                              nsAccessibilityAtoms::_true, eCaseMatters))
+    if (mContent->AttrValueIs(kNameSpaceID_None, nsGkAtoms::checked,
+                              nsGkAtoms::_true, eCaseMatters))
       state |= states::CHECKED;
   }
 
@@ -373,14 +370,14 @@ nsXULMenuitemAccessible::NativeState()
 nsresult
 nsXULMenuitemAccessible::GetNameInternal(nsAString& aName)
 {
-  mContent->GetAttr(kNameSpaceID_None, nsAccessibilityAtoms::label, aName);
+  mContent->GetAttr(kNameSpaceID_None, nsGkAtoms::label, aName);
   return NS_OK;
 }
 
 void
 nsXULMenuitemAccessible::Description(nsString& aDescription)
 {
-  mContent->GetAttr(kNameSpaceID_None, nsAccessibilityAtoms::description,
+  mContent->GetAttr(kNameSpaceID_None, nsGkAtoms::description,
                     aDescription);
 }
 
@@ -393,7 +390,7 @@ nsXULMenuitemAccessible::AccessKey() const
   // We do not use nsCoreUtils::GetAccesskeyFor() because accesskeys for
   // menu are't registered by nsEventStateManager.
   nsAutoString accesskey;
-  mContent->GetAttr(kNameSpaceID_None, nsAccessibilityAtoms::accesskey,
+  mContent->GetAttr(kNameSpaceID_None, nsGkAtoms::accesskey,
                     accesskey);
   if (accesskey.IsEmpty())
     return KeyBinding();
@@ -505,13 +502,13 @@ nsXULMenuitemAccessible::NativeRole()
   if (mParent && mParent->Role() == nsIAccessibleRole::ROLE_COMBOBOX_LIST)
     return nsIAccessibleRole::ROLE_COMBOBOX_OPTION;
 
-  if (mContent->AttrValueIs(kNameSpaceID_None, nsAccessibilityAtoms::type,
-                            nsAccessibilityAtoms::radio, eCaseMatters)) {
+  if (mContent->AttrValueIs(kNameSpaceID_None, nsGkAtoms::type,
+                            nsGkAtoms::radio, eCaseMatters)) {
     return nsIAccessibleRole::ROLE_RADIO_MENU_ITEM;
   }
 
-  if (mContent->AttrValueIs(kNameSpaceID_None, nsAccessibilityAtoms::type,
-                            nsAccessibilityAtoms::checkbox,
+  if (mContent->AttrValueIs(kNameSpaceID_None, nsGkAtoms::type,
+                            nsGkAtoms::checkbox,
                             eCaseMatters)) {
     return nsIAccessibleRole::ROLE_CHECK_MENU_ITEM;
   }
@@ -633,7 +630,7 @@ nsXULMenupopupAccessible::NativeState()
 #ifdef DEBUG_A11Y
   // We are onscreen if our parent is active
   PRBool isActive = mContent->HasAttr(kNameSpaceID_None,
-                                      nsAccessibilityAtoms::menuactive);
+                                      nsGkAtoms::menuactive);
   if (!isActive) {
     nsAccessible* parent = Parent();
     if (!parent)
@@ -643,7 +640,7 @@ nsXULMenupopupAccessible::NativeState()
     NS_ENSURE_TRUE(parentContent, state);
 
     isActive = parentContent->HasAttr(kNameSpaceID_None,
-                                      nsAccessibilityAtoms::open);
+                                      nsGkAtoms::open);
   }
 
   NS_ASSERTION(isActive || states & states::INVISIBLE,
@@ -661,7 +658,7 @@ nsXULMenupopupAccessible::GetNameInternal(nsAString& aName)
 {
   nsIContent *content = mContent;
   while (content && aName.IsEmpty()) {
-    content->GetAttr(kNameSpaceID_None, nsAccessibilityAtoms::label, aName);
+    content->GetAttr(kNameSpaceID_None, nsGkAtoms::label, aName);
     content = content->GetParent();
   }
 
diff --git a/accessible/src/xul/nsXULSliderAccessible.cpp b/accessible/src/xul/nsXULSliderAccessible.cpp
index 8e9dd7c4e799..356573dcd1bd 100644
--- a/accessible/src/xul/nsXULSliderAccessible.cpp
+++ b/accessible/src/xul/nsXULSliderAccessible.cpp
@@ -38,7 +38,6 @@
 
 #include "nsXULSliderAccessible.h"
 
-#include "nsAccessibilityAtoms.h"
 #include "States.h"
 
 #include "nsIDOMDocument.h"
@@ -94,7 +93,7 @@ nsXULSliderAccessible::NativeState()
 NS_IMETHODIMP
 nsXULSliderAccessible::GetValue(nsAString& aValue)
 {
-  return GetSliderAttr(nsAccessibilityAtoms::curpos, aValue);
+  return GetSliderAttr(nsGkAtoms::curpos, aValue);
 }
 
 PRUint8
@@ -137,7 +136,7 @@ nsXULSliderAccessible::GetMaximumValue(double *aValue)
   if (rv != NS_OK_NO_ARIA_VALUE)
     return rv;
 
-  return GetSliderAttr(nsAccessibilityAtoms::maxpos, aValue);
+  return GetSliderAttr(nsGkAtoms::maxpos, aValue);
 }
 
 NS_IMETHODIMP
@@ -149,7 +148,7 @@ nsXULSliderAccessible::GetMinimumValue(double *aValue)
   if (rv != NS_OK_NO_ARIA_VALUE)
     return rv;
 
-  return GetSliderAttr(nsAccessibilityAtoms::minpos, aValue);
+  return GetSliderAttr(nsGkAtoms::minpos, aValue);
 }
 
 NS_IMETHODIMP
@@ -161,7 +160,7 @@ nsXULSliderAccessible::GetMinimumIncrement(double *aValue)
   if (rv != NS_OK_NO_ARIA_VALUE)
     return rv;
 
-  return GetSliderAttr(nsAccessibilityAtoms::increment, aValue);
+  return GetSliderAttr(nsGkAtoms::increment, aValue);
 }
 
 NS_IMETHODIMP
@@ -173,7 +172,7 @@ nsXULSliderAccessible::GetCurrentValue(double *aValue)
   if (rv != NS_OK_NO_ARIA_VALUE)
     return rv;
 
-  return GetSliderAttr(nsAccessibilityAtoms::curpos, aValue);
+  return GetSliderAttr(nsGkAtoms::curpos, aValue);
 }
 
 NS_IMETHODIMP
@@ -185,7 +184,7 @@ nsXULSliderAccessible::SetCurrentValue(double aValue)
   if (rv != NS_OK_NO_ARIA_VALUE)
     return rv;
 
-  return SetSliderAttr(nsAccessibilityAtoms::curpos, aValue);
+  return SetSliderAttr(nsGkAtoms::curpos, aValue);
 }
 
 PRBool
diff --git a/accessible/src/xul/nsXULTextAccessible.cpp b/accessible/src/xul/nsXULTextAccessible.cpp
index 3e65356b2756..af2015c5e18b 100644
--- a/accessible/src/xul/nsXULTextAccessible.cpp
+++ b/accessible/src/xul/nsXULTextAccessible.cpp
@@ -40,7 +40,6 @@
 // NOTE: groups are alphabetically ordered
 #include "nsXULTextAccessible.h"
 
-#include "nsAccessibilityAtoms.h"
 #include "nsAccUtils.h"
 #include "nsBaseWidgetAccessible.h"
 #include "nsCoreUtils.h"
@@ -71,7 +70,7 @@ nsXULTextAccessible::GetNameInternal(nsAString& aName)
 {
   // if the value attr doesn't exist, the screen reader must get the accessible text
   // from the accessible text interface or from the children
-  mContent->GetAttr(kNameSpaceID_None, nsAccessibilityAtoms::value, aName);
+  mContent->GetAttr(kNameSpaceID_None, nsGkAtoms::value, aName);
   return NS_OK;
 }
 
@@ -96,7 +95,7 @@ nsXULTextAccessible::RelationByType(PRUint32 aType)
   if (aType == nsIAccessibleRelation::RELATION_LABEL_FOR) {
     // Caption is the label for groupbox
     nsIContent *parent = mContent->GetParent();
-    if (parent && parent->Tag() == nsAccessibilityAtoms::caption) {
+    if (parent && parent->Tag() == nsGkAtoms::caption) {
       nsAccessible* parent = Parent();
       if (parent && parent->Role() == nsIAccessibleRole::ROLE_GROUPING)
         rel.AppendTarget(parent);
@@ -159,14 +158,14 @@ nsXULLinkAccessible::GetValue(nsAString& aValue)
   if (IsDefunct())
     return NS_ERROR_FAILURE;
 
-  mContent->GetAttr(kNameSpaceID_None, nsAccessibilityAtoms::href, aValue);
+  mContent->GetAttr(kNameSpaceID_None, nsGkAtoms::href, aValue);
   return NS_OK;
 }
 
 nsresult
 nsXULLinkAccessible::GetNameInternal(nsAString& aName)
 {
-  mContent->GetAttr(kNameSpaceID_None, nsAccessibilityAtoms::value, aName);
+  mContent->GetAttr(kNameSpaceID_None, nsGkAtoms::value, aName);
   if (!aName.IsEmpty())
     return NS_OK;
 
@@ -255,7 +254,7 @@ nsXULLinkAccessible::AnchorURIAt(PRUint32 aAnchorIndex)
     return nsnull;
 
   nsAutoString href;
-  mContent->GetAttr(kNameSpaceID_None, nsAccessibilityAtoms::href, href);
+  mContent->GetAttr(kNameSpaceID_None, nsGkAtoms::href, href);
 
   nsCOMPtr<nsIURI> baseURI = mContent->GetBaseURI();
   nsIDocument* document = mContent->GetOwnerDoc();
diff --git a/accessible/src/xul/nsXULTreeGridAccessible.cpp b/accessible/src/xul/nsXULTreeGridAccessible.cpp
index 6d5d7ef1e231..3d84400dd0f6 100644
--- a/accessible/src/xul/nsXULTreeGridAccessible.cpp
+++ b/accessible/src/xul/nsXULTreeGridAccessible.cpp
@@ -1183,14 +1183,14 @@ nsXULTreeGridCellAccessible::GetAttributesInternal(nsIPersistentProperties *aAtt
 
   nsAutoString stringIdx;
   stringIdx.AppendInt(cellIdx);
-  nsAccUtils::SetAccAttr(aAttributes, nsAccessibilityAtoms::tableCellIndex,
+  nsAccUtils::SetAccAttr(aAttributes, nsGkAtoms::tableCellIndex,
                          stringIdx);
 
   // "cycles" attribute
   PRBool isCycler = PR_FALSE;
   nsresult rv = mColumn->GetCycler(&isCycler);
   if (NS_SUCCEEDED(rv) && isCycler)
-    nsAccUtils::SetAccAttr(aAttributes, nsAccessibilityAtoms::cycles,
+    nsAccUtils::SetAccAttr(aAttributes, nsGkAtoms::cycles,
                            NS_LITERAL_STRING("true"));
 
   return NS_OK;
@@ -1339,12 +1339,12 @@ nsXULTreeGridCellAccessible::IsEditable() const
 
   nsCOMPtr<nsIContent> columnContent(do_QueryInterface(columnElm));
   if (!columnContent->AttrValueIs(kNameSpaceID_None,
-                                  nsAccessibilityAtoms::editable,
-                                  nsAccessibilityAtoms::_true,
+                                  nsGkAtoms::editable,
+                                  nsGkAtoms::_true,
                                   eCaseMatters))
     return PR_FALSE;
 
   return mContent->AttrValueIs(kNameSpaceID_None,
-                               nsAccessibilityAtoms::editable,
-                               nsAccessibilityAtoms::_true, eCaseMatters);
+                               nsGkAtoms::editable,
+                               nsGkAtoms::_true, eCaseMatters);
 }
diff --git a/content/base/src/nsGkAtomList.h b/content/base/src/nsGkAtomList.h
index 740aba8c8652..81526645bc4e 100644
--- a/content/base/src/nsGkAtomList.h
+++ b/content/base/src/nsGkAtomList.h
@@ -1899,3 +1899,80 @@ GK_ATOM(_moz_maemo_classic, "-moz-maemo-classic")
 GK_ATOM(_moz_menubar_drag, "-moz-menubar-drag")
 GK_ATOM(_moz_device_pixel_ratio, "-moz-device-pixel-ratio")
 GK_ATOM(_moz_device_orientation, "-moz-device-orientation")
+
+#ifdef ACCESSIBILITY
+GK_ATOM(anonid, "anonid")
+GK_ATOM(aria_activedescendant, "aria-activedescendant")
+GK_ATOM(aria_atomic, "aria-atomic")
+GK_ATOM(aria_autocomplete, "aria-autocomplete")
+GK_ATOM(aria_busy, "aria-busy")
+GK_ATOM(aria_checked, "aria-checked")
+GK_ATOM(aria_controls, "aria-controls")
+GK_ATOM(aria_describedby, "aria-describedby")
+GK_ATOM(aria_disabled, "aria-disabled")
+GK_ATOM(aria_dropeffect, "aria-dropeffect")
+GK_ATOM(aria_expanded, "aria-expanded")
+GK_ATOM(aria_flowto, "aria-flowto")
+GK_ATOM(aria_grabbed, "aria-grabbed")
+GK_ATOM(aria_haspopup, "aria-haspopup")
+GK_ATOM(aria_hidden, "aria-hidden")
+GK_ATOM(aria_invalid, "aria-invalid")
+GK_ATOM(aria_label, "aria-label")
+GK_ATOM(aria_labelledby, "aria-labelledby")
+GK_ATOM(aria_level, "aria-level")
+GK_ATOM(aria_live, "aria-live")
+GK_ATOM(aria_multiline, "aria-multiline")
+GK_ATOM(aria_multiselectable, "aria-multiselectable")
+GK_ATOM(aria_orientation, "aria-orientation")
+GK_ATOM(aria_owns, "aria-owns")
+GK_ATOM(aria_posinset, "aria-posinset")
+GK_ATOM(aria_pressed, "aria-pressed")
+GK_ATOM(aria_readonly, "aria-readonly")
+GK_ATOM(aria_relevant, "aria-relevant")
+GK_ATOM(aria_required, "aria-required")
+GK_ATOM(aria_selected, "aria-selected")
+GK_ATOM(aria_setsize, "aria-setsize")
+GK_ATOM(aria_sort, "aria-sort")
+GK_ATOM(aria_valuenow, "aria-valuenow")
+GK_ATOM(aria_valuemin, "aria-valuemin")
+GK_ATOM(aria_valuemax, "aria-valuemax")
+GK_ATOM(aria_valuetext, "aria-valuetext")
+GK_ATOM(AreaFrame, "AreaFrame")
+GK_ATOM(backgroundColor, "background-color")
+GK_ATOM(checkable, "checkable")
+GK_ATOM(choices, "choices")
+GK_ATOM(containerAtomic, "container-atomic")
+GK_ATOM(containerBusy, "container-busy")
+GK_ATOM(containerLive, "container-live")
+GK_ATOM(containerLiveRole, "container-live-role")
+GK_ATOM(containerRelevant, "container-relevant")
+GK_ATOM(cycles, "cycles")
+GK_ATOM(droppable, "droppable")
+GK_ATOM(eventFromInput, "event-from-input")
+GK_ATOM(InlineBlockFrame, "InlineBlockFrame")
+GK_ATOM(invalid, "invalid")
+GK_ATOM(item, "item")
+GK_ATOM(itemset, "itemset")
+GK_ATOM(language, "language")
+GK_ATOM(lineNumber, "line-number")
+GK_ATOM(linkedPanel, "linkedpanel")
+GK_ATOM(live, "live")
+GK_ATOM(mixed, "mixed")
+GK_ATOM(multiline, "multiline")
+GK_ATOM(password, "password")
+GK_ATOM(posinset, "posinset") 
+GK_ATOM(select1, "select1")
+GK_ATOM(setsize, "setsize")
+GK_ATOM(tableCellIndex, "table-cell-index")
+GK_ATOM(textAlign, "text-align")
+GK_ATOM(textIndent, "text-indent")
+GK_ATOM(textLineThroughStyle, "text-line-through-style")
+GK_ATOM(textPosition, "text-position")
+GK_ATOM(textUnderlineStyle, "text-underline-style")
+GK_ATOM(toolbarname, "toolbarname")
+GK_ATOM(toolbarseparator, "toolbarseparator")
+GK_ATOM(toolbarspacer, "toolbarspacer")
+GK_ATOM(toolbarspring, "toolbarspring")
+GK_ATOM(_undefined, "undefined")
+GK_ATOM(xmlroles, "xml-roles")
+#endif

From 1de7c7da18f641a78f7540418c643af6826c1a59 Mon Sep 17 00:00:00 2001
From: Frank Yan <fyan@mozilla.com>
Date: Thu, 8 Sep 2011 02:02:05 -0700
Subject: [PATCH 027/209] Bug 657463 - Move adjustTabStrip for _fullyOpen tabs
 out of _handleNewTab. r=dao

---
 browser/base/content/tabbrowser.xml | 15 ++++++++-------
 1 file changed, 8 insertions(+), 7 deletions(-)

diff --git a/browser/base/content/tabbrowser.xml b/browser/base/content/tabbrowser.xml
index a90760bcfde5..7699d364ad21 100644
--- a/browser/base/content/tabbrowser.xml
+++ b/browser/base/content/tabbrowser.xml
@@ -3676,13 +3676,10 @@
         <body><![CDATA[
           if (tab.parentNode != this)
             return;
+          tab._fullyOpen = true;
 
           this.adjustTabstrip();
 
-          if (tab._fullyOpen)
-            return;
-          tab._fullyOpen = true;
-
           if (tab.getAttribute("selected") == "true") {
             this._fillTrailingGap();
             this._handleTabSelect();
@@ -3724,10 +3721,14 @@
 
         var tab = event.target;
 
-        if (tab.getAttribute("fadein") == "true")
-          this._handleNewTab(tab);
-        else if (tab.closing)
+        if (tab.getAttribute("fadein") == "true") {
+          if (tab._fullyOpen)
+            this.adjustTabstrip();
+          else
+            this._handleNewTab(tab);
+        } else if (tab.closing) {
           this.tabbrowser._endRemoveTab(tab);
+        }
       ]]></handler>
 
       <handler event="dblclick"><![CDATA[

From 879ef9373d1a06b179c228e9a1acf7a58ad61dc0 Mon Sep 17 00:00:00 2001
From: Raymond Lee <raymond@raysquare.com>
Date: Wed, 7 Sep 2011 16:54:59 +0800
Subject: [PATCH 028/209] Bug 596450 - DOM attribute for the tab node needed
 which references the tabgroup; r=ttaubert

---
 browser/base/content/tabview/groupitems.js | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/browser/base/content/tabview/groupitems.js b/browser/base/content/tabview/groupitems.js
index 2fd00861ce2f..d6c407ac1f8d 100644
--- a/browser/base/content/tabview/groupitems.js
+++ b/browser/base/content/tabview/groupitems.js
@@ -122,6 +122,7 @@ function GroupItem(listOfEls, options) {
   this.isDragging = false;
   $container
     .css({zIndex: -100})
+    .attr("data-id", this.id)
     .appendTo("body");
 
   // ___ Resizer
@@ -1050,6 +1051,7 @@ GroupItem.prototype = Utils.extend(new Item(), new Subscribable(), {
 
         item.addSubscriber("close", this._onChildClose);
         item.setParent(this);
+        $el.attr("data-group", this.id);
 
         if (typeof item.setResizable == 'function')
           item.setResizable(false, options.immediately);
@@ -1135,6 +1137,7 @@ GroupItem.prototype = Utils.extend(new Item(), new Subscribable(), {
           this._activeTab = null;
       }
 
+      $el[0].removeAttribute("data-group");
       item.setParent(null);
       item.removeClass("stacked");
       item.isStacked = false;

From 6a3ea8045952b1653b201b4ac07f21f720d929a8 Mon Sep 17 00:00:00 2001
From: Margaret Leibovic <margaret.leibovic@gmail.com>
Date: Thu, 25 Aug 2011 14:11:18 -0400
Subject: [PATCH 029/209] Bug 670194 - Startup numbers don't account for
 interactive startup interruptions. r=dtownsend

---
 toolkit/components/startup/nsAppStartup.cpp     | 17 ++++++++++++++++-
 toolkit/components/startup/nsAppStartup.h       |  1 +
 .../components/startup/public/nsIAppStartup.idl |  7 ++++++-
 toolkit/content/Services.jsm                    |  1 +
 toolkit/mozapps/extensions/XPIProvider.jsm      |  3 +++
 .../extensions/test/xpcshell/test_bug542391.js  |  1 +
 6 files changed, 28 insertions(+), 2 deletions(-)

diff --git a/toolkit/components/startup/nsAppStartup.cpp b/toolkit/components/startup/nsAppStartup.cpp
index 5a7b50bf3276..ae6f4e0a8360 100644
--- a/toolkit/components/startup/nsAppStartup.cpp
+++ b/toolkit/components/startup/nsAppStartup.cpp
@@ -134,7 +134,8 @@ nsAppStartup::nsAppStartup() :
   mRunning(PR_FALSE),
   mShuttingDown(PR_FALSE),
   mAttemptingQuit(PR_FALSE),
-  mRestart(PR_FALSE)
+  mRestart(PR_FALSE),
+  mInterrupted(PR_FALSE)
 { }
 
 
@@ -452,6 +453,20 @@ nsAppStartup::GetShuttingDown(PRBool *aResult)
   return NS_OK;
 }
 
+NS_IMETHODIMP
+nsAppStartup::SetInterrupted(PRBool aInterrupted)
+{
+  mInterrupted = aInterrupted;
+  return NS_OK;
+}
+
+NS_IMETHODIMP
+nsAppStartup::GetInterrupted(PRBool *aInterrupted)
+{
+  *aInterrupted = mInterrupted;
+  return NS_OK;
+}
+
 //
 // nsAppStartup->nsIWindowCreator
 //
diff --git a/toolkit/components/startup/nsAppStartup.h b/toolkit/components/startup/nsAppStartup.h
index 2a0ea1a4752b..fc7a6d413938 100644
--- a/toolkit/components/startup/nsAppStartup.h
+++ b/toolkit/components/startup/nsAppStartup.h
@@ -84,6 +84,7 @@ private:
   PRPackedBool mShuttingDown;   // Quit method reentrancy check
   PRPackedBool mAttemptingQuit; // Quit(eAttemptQuit) still trying
   PRPackedBool mRestart;        // Quit(eRestart)
+  PRPackedBool mInterrupted;    // Was startup interrupted by an interactive prompt?
 };
 
 #endif // nsAppStartup_h__
diff --git a/toolkit/components/startup/public/nsIAppStartup.idl b/toolkit/components/startup/public/nsIAppStartup.idl
index 55981d26a19b..2091921a6cd1 100644
--- a/toolkit/components/startup/public/nsIAppStartup.idl
+++ b/toolkit/components/startup/public/nsIAppStartup.idl
@@ -41,7 +41,7 @@
 
 interface nsICmdLineService;
 
-[scriptable, uuid(68b4b481-e21b-478f-8d75-41b131e1c261)]
+[scriptable, uuid(35fcdb69-3bb6-4484-b99a-32f49a84fabd)]
 interface nsIAppStartup : nsISupports
 {
     /**
@@ -135,6 +135,11 @@ interface nsIAppStartup : nsISupports
      * Properties may not be available depending on platform or application
      */
     void getStartupInfo();
+
+    /**
+     * True if startup was interrupted by an interactive prompt.
+     */
+    attribute boolean interrupted;
 };
 
 %{C++
diff --git a/toolkit/content/Services.jsm b/toolkit/content/Services.jsm
index 5dc5b60e407b..bbe8b39bd902 100644
--- a/toolkit/content/Services.jsm
+++ b/toolkit/content/Services.jsm
@@ -86,6 +86,7 @@ let initTable = [
   ["vc", "@mozilla.org/xpcom/version-comparator;1", "nsIVersionComparator"],
   ["wm", "@mozilla.org/appshell/window-mediator;1", "nsIWindowMediator"],
   ["ww", "@mozilla.org/embedcomp/window-watcher;1", "nsIWindowWatcher"],
+  ["startup", "@mozilla.org/toolkit/app-startup;1", "nsIAppStartup"],
 ];
 
 initTable.forEach(function ([name, contract, intf])
diff --git a/toolkit/mozapps/extensions/XPIProvider.jsm b/toolkit/mozapps/extensions/XPIProvider.jsm
index d8587b7a4c91..1737259f13e7 100644
--- a/toolkit/mozapps/extensions/XPIProvider.jsm
+++ b/toolkit/mozapps/extensions/XPIProvider.jsm
@@ -1707,6 +1707,9 @@ var XPIProvider = {
    * Shows the "Compatibility Updates" UI
    */
   showUpgradeUI: function XPI_showUpgradeUI() {
+    // Flip a flag to indicate that we interrupted startup with an interactive prompt
+    Services.startup.interrupted = true;
+
     if (!Prefs.getBoolPref(PREF_SHOWN_SELECTION_UI, false)) {
       // This *must* be modal as it has to block startup.
       var features = "chrome,centerscreen,dialog,titlebar,modal";
diff --git a/toolkit/mozapps/extensions/test/xpcshell/test_bug542391.js b/toolkit/mozapps/extensions/test/xpcshell/test_bug542391.js
index 25be6eccf9f5..ed64340b6742 100644
--- a/toolkit/mozapps/extensions/test/xpcshell/test_bug542391.js
+++ b/toolkit/mozapps/extensions/test/xpcshell/test_bug542391.js
@@ -58,6 +58,7 @@ var WindowWatcher = {
   arguments: null,
 
   openWindow: function(parent, url, name, features, arguments) {
+    do_check_true(Services.startup.interrupted);
     do_check_eq(url, URI_EXTENSION_UPDATE_DIALOG);
     do_check_true(this.expected);
     this.expected = false;

From 62e81afb2021e167ba0f5fb8c8be81684f93e682 Mon Sep 17 00:00:00 2001
From: Matheus Kerschbaum <matjk7@gmail.com>
Date: Sat, 3 Sep 2011 01:55:29 +0100
Subject: [PATCH 030/209] Bug 689920 part 1: Remove build support for old Unix
 platforms. r=ted

---
 configure.in        | 95 ---------------------------------------------
 js/src/configure.in | 95 ---------------------------------------------
 2 files changed, 190 deletions(-)

diff --git a/configure.in b/configure.in
index 1f5e367aff1b..401b96437111 100644
--- a/configure.in
+++ b/configure.in
@@ -1352,36 +1352,9 @@ solaris*)
 BSD_386)
     HOST_OS_ARCH=BSD
     ;;
-dgux)
-    HOST_OS_ARCH=DGUX
-    ;;
-UNIX_SV)
-    if "`cat /etc/bcheckrc | grep -c NCR 2>/dev/null`" != "0"; then
-        HOST_OS_ARCH=NCR
-    else
-        HOST_OS_ARCH=UNIXWARE
-    fi
-    ;;
-ncr)
-    HOST_OS_ARCH=NCR
-    ;;
-UNIX_SYSTEM_V)
-    HOST_OS_ARCH=NEC
-    ;;
-OSF1)
-    ;;
 OS_2)
     HOST_OS_ARCH=OS2
     ;;
-SCO_SV)
-    HOST_OS_ARCH=SCOOS
-    ;;
-SINIX-N | SINIX-Y | SINIX-Z |ReliantUNIX-M)
-    HOST_OS_ARCH=SINIX
-    ;;
-UnixWare)
-    HOST_OS_ARCH=UNIXWARE
-    ;;
 esac
 
 case "$OS_ARCH" in
@@ -1423,53 +1396,11 @@ AIX)
 BSD_386)
     OS_ARCH=BSD
     ;;
-dgux)
-    OS_ARCH=DGUX
-    ;;
-UNIX_SV)
-    if "`cat /etc/bcheckrc | grep -c NCR 2>/dev/null`" != "0"; then
-        OS_ARCH=NCR
-    else
-        OS_ARCH=UNIXWARE
-        OS_RELEASE=`uname -v`
-    fi
-    ;;
-ncr)
-    OS_ARCH=NCR
-    ;;
-UNIX_SYSTEM_V)
-    OS_ARCH=NEC
-    ;;
-OSF1)
-    case `uname -v` in
-    148)
-        OS_RELEASE=V3.2C
-        ;;
-    564)
-        OS_RELEASE=V4.0B
-        ;;
-    878)
-        OS_RELEASE=V4.0D
-        ;;
-    esac
-    ;;
 OS_2)
     OS_ARCH=OS2
     OS_TARGET=OS2
     OS_RELEASE=`uname -v`
     ;;
-SCO_SV)
-    OS_ARCH=SCOOS
-    OS_RELEASE=5.0
-    ;;
-SINIX-N | SINIX-Y | SINIX-Z |ReliantUNIX-M)
-    OS_ARCH=SINIX
-    OS_TEST=`uname -p`
-    ;;
-UnixWare)
-    OS_ARCH=UNIXWARE
-    OS_RELEASE=`uname -v`
-    ;;
 Darwin)
     case "${target_cpu}" in
     powerpc*)
@@ -1490,12 +1421,6 @@ Darwin)
     ;;
 esac
 
-if test "$OS_ARCH" = "NCR"; then
-    changequote(,)
-    OS_RELEASE=`awk '{print $3}' /etc/.relid | sed 's/^\([0-9]\)\(.\)\(..\)\(.*\)$/\2.\3/'`
-    changequote([,])
-fi
-
 # Only set CPU_ARCH if we recognize the value of OS_TEST
 
 case "$OS_TEST" in
@@ -2566,15 +2491,6 @@ alpha*-*-osf*)
     AC_DEFINE(NEED_USLEEP_PROTOTYPE)
     ;;
 
-*-sco*)
-    AC_DEFINE(NSCAP_DISABLE_TEST_DONTQUERY_CASES)
-    AC_DEFINE(NSCAP_DISABLE_DEBUG_PTR_TYPES)
-    CXXFLAGS="$CXXFLAGS -I/usr/include/CC"
-    if test ! "$GNU_CC"; then
-       DSO_LDOPTS='-G'
-    fi
-    ;;
-
 *-solaris*)
     AC_DEFINE(SOLARIS)
     TARGET_NSPR_MDCPUCFG='\"md/_solaris.cfg\"'
@@ -2674,10 +2590,6 @@ alpha*-*-osf*)
     esac
     ;;
 
-*-sysv4.2uw7*)
-	NSPR_LIBS="-lnspr$NSPR_VERSION -lplc$NSPR_VERSION -lplds$NSPR_VERSION -L/usr/ccs/lib -lcrt"
-    ;;
-
 *-os2*)
     HOST_NSPR_MDCPUCFG='\"md/_os2.cfg\"'
     ;;
@@ -2735,9 +2647,6 @@ case "$target" in
          fi
         fi
         ;;
-    *-nto*)
-        MOZ_COMPONENTS_VERSION_SCRIPT_LDFLAGS='-Wl,--version-script,$(BUILD_TOOLS)/gnu-ld-scripts/components-version-script'
-        ;;
     *-darwin*)
         MOZ_COMPONENTS_VERSION_SCRIPT_LDFLAGS='-Wl,-exported_symbols_list -Wl,$(BUILD_TOOLS)/gnu-ld-scripts/components-export-list'
         ;;
@@ -3505,10 +3414,6 @@ then
 			AC_DEFINE(_REENTRANT)
 			;;
 
-	    *-*-nto*)
-			AC_DEFINE(_REENTRANT)
-			;;
-
 	    *-aix4.3*|*-aix5*)
 			AC_DEFINE(_REENTRANT)
 			;;
diff --git a/js/src/configure.in b/js/src/configure.in
index 06c1484a09ba..5802c4fc6f19 100644
--- a/js/src/configure.in
+++ b/js/src/configure.in
@@ -1333,36 +1333,9 @@ solaris*)
 BSD_386)
     HOST_OS_ARCH=BSD
     ;;
-dgux)
-    HOST_OS_ARCH=DGUX
-    ;;
-UNIX_SV)
-    if "`cat /etc/bcheckrc | grep -c NCR 2>/dev/null`" != "0"; then
-        HOST_OS_ARCH=NCR
-    else
-        HOST_OS_ARCH=UNIXWARE
-    fi
-    ;;
-ncr)
-    HOST_OS_ARCH=NCR
-    ;;
-UNIX_SYSTEM_V)
-    HOST_OS_ARCH=NEC
-    ;;
-OSF1)
-    ;;
 OS_2)
     HOST_OS_ARCH=OS2
     ;;
-SCO_SV)
-    HOST_OS_ARCH=SCOOS
-    ;;
-SINIX-N | SINIX-Y | SINIX-Z |ReliantUNIX-M)
-    HOST_OS_ARCH=SINIX
-    ;;
-UnixWare)
-    HOST_OS_ARCH=UNIXWARE
-    ;;
 esac
 
 case "$OS_ARCH" in
@@ -1409,53 +1382,11 @@ AIX)
 BSD_386)
     OS_ARCH=BSD
     ;;
-dgux)
-    OS_ARCH=DGUX
-    ;;
-UNIX_SV)
-    if "`cat /etc/bcheckrc | grep -c NCR 2>/dev/null`" != "0"; then
-        OS_ARCH=NCR
-    else
-        OS_ARCH=UNIXWARE
-        OS_RELEASE=`uname -v`
-    fi
-    ;;
-ncr)
-    OS_ARCH=NCR
-    ;;
-UNIX_SYSTEM_V)
-    OS_ARCH=NEC
-    ;;
-OSF1)
-    case `uname -v` in
-    148)
-        OS_RELEASE=V3.2C
-        ;;
-    564)
-        OS_RELEASE=V4.0B
-        ;;
-    878)
-        OS_RELEASE=V4.0D
-        ;;
-    esac
-    ;;
 OS_2)
     OS_ARCH=OS2
     OS_TARGET=OS2
     OS_RELEASE=`uname -v`
     ;;
-SCO_SV)
-    OS_ARCH=SCOOS
-    OS_RELEASE=5.0
-    ;;
-SINIX-N | SINIX-Y | SINIX-Z |ReliantUNIX-M)
-    OS_ARCH=SINIX
-    OS_TEST=`uname -p`
-    ;;
-UnixWare)
-    OS_ARCH=UNIXWARE
-    OS_RELEASE=`uname -v`
-    ;;
 Darwin)
     case "${target_cpu}" in
     powerpc*)
@@ -1476,12 +1407,6 @@ Darwin)
     ;;
 esac
 
-if test "$OS_ARCH" = "NCR"; then
-    changequote(,)
-    OS_RELEASE=`awk '{print $3}' /etc/.relid | sed 's/^\([0-9]\)\(.\)\(..\)\(.*\)$/\2.\3/'`
-    changequote([,])
-fi
-
 # Only set CPU_ARCH if we recognize the value of OS_TEST
 
 case "$OS_TEST" in
@@ -2472,15 +2397,6 @@ alpha*-*-osf*)
     AC_DEFINE(NEED_USLEEP_PROTOTYPE)
     ;;
 
-*-sco*)
-    AC_DEFINE(NSCAP_DISABLE_TEST_DONTQUERY_CASES)
-    AC_DEFINE(NSCAP_DISABLE_DEBUG_PTR_TYPES)
-    CXXFLAGS="$CXXFLAGS -I/usr/include/CC"
-    if test ! "$GNU_CC"; then
-       DSO_LDOPTS='-G'
-    fi
-    ;;
-
 *-solaris*)
     AC_DEFINE(SOLARIS)
     TARGET_NSPR_MDCPUCFG='\"md/_solaris.cfg\"'
@@ -2585,10 +2501,6 @@ alpha*-*-osf*)
     esac
     ;;
 
-*-sysv4.2uw7*)
-	NSPR_LIBS="-lnspr$NSPR_VERSION -lplc$NSPR_VERSION -lplds$NSPR_VERSION -L/usr/ccs/lib -lcrt"
-    ;;
-
 *-os2*)
     HOST_NSPR_MDCPUCFG='\"md/_os2.cfg\"'
     ;;
@@ -2645,9 +2557,6 @@ case "$target" in
          fi
         fi
         ;;
-    *-nto*)
-        MOZ_COMPONENTS_VERSION_SCRIPT_LDFLAGS='-Wl,--version-script,$(BUILD_TOOLS)/gnu-ld-scripts/components-version-script'
-        ;;
     *-darwin*)
         MOZ_COMPONENTS_VERSION_SCRIPT_LDFLAGS='-Wl,-exported_symbols_list -Wl,$(BUILD_TOOLS)/gnu-ld-scripts/components-export-list'
         ;;
@@ -3402,10 +3311,6 @@ then
 			AC_DEFINE(_REENTRANT)
 			;;
 
-	    *-*-nto*)
-			AC_DEFINE(_REENTRANT)
-			;;
-
 	    *-aix4.3*|*-aix5*)
 			AC_DEFINE(_REENTRANT)
 			;;

From 91736820bac72adc9122833c6e4f5bab2df852a7 Mon Sep 17 00:00:00 2001
From: Matheus Kerschbaum <matjk7@gmail.com>
Date: Sat, 3 Sep 2011 01:55:30 +0100
Subject: [PATCH 031/209] Bug 689920 part 2: Remove remaining Tru64/Alpha
 support. r=ted

---
 configure.in                                  |  45 +-----
 js/src/configure.in                           |  45 +-----
 layout/build/Makefile.in                      |   5 +-
 xpcom/reflect/xptcall/src/md/unix/Makefile.in |   8 -
 .../src/md/unix/xptcinvoke_asm_osf1_alpha.s   |  83 ----------
 .../src/md/unix/xptcinvoke_osf1_alpha.cpp     |  93 -----------
 .../src/md/unix/xptcstubs_asm_osf1_alpha.s    |  75 ---------
 .../src/md/unix/xptcstubs_osf1_alpha.cpp      | 149 ------------------
 8 files changed, 3 insertions(+), 500 deletions(-)
 delete mode 100644 xpcom/reflect/xptcall/src/md/unix/xptcinvoke_asm_osf1_alpha.s
 delete mode 100644 xpcom/reflect/xptcall/src/md/unix/xptcinvoke_osf1_alpha.cpp
 delete mode 100644 xpcom/reflect/xptcall/src/md/unix/xptcstubs_asm_osf1_alpha.s
 delete mode 100644 xpcom/reflect/xptcall/src/md/unix/xptcstubs_osf1_alpha.cpp

diff --git a/configure.in b/configure.in
index 401b96437111..ae0d5124a325 100644
--- a/configure.in
+++ b/configure.in
@@ -1876,12 +1876,6 @@ case "$host" in
     MOZ_FIX_LINK_PATHS=
     ;;
 
-*-osf*)
-    HOST_CFLAGS="$HOST_CFLAGS -DXP_UNIX"
-    HOST_NSPR_MDCPUCFG='\"md/_osf1.cfg\"'
-    HOST_OPTIMIZE_FLAGS="${HOST_OPTIMIZE_FLAGS=-O2}"
-    ;;
-
 *)
     HOST_CFLAGS="$HOST_CFLAGS -DXP_UNIX"
     HOST_OPTIMIZE_FLAGS="${HOST_OPTIMIZE_FLAGS=-O2}"
@@ -2464,33 +2458,6 @@ ia64*-hpux*)
     fi
     ;;
 
-alpha*-*-osf*)
-    if test "$GNU_CC"; then
-      MKSHLIB='$(CXX) $(CXXFLAGS) $(DSO_PIC_CFLAGS) $(DSO_LDOPTS) -Wl,-soname,$@ -o $@'
-      MKCSHLIB='$(CC) $(CFLAGS) $(DSO_PIC_CFLAGS) $(DSO_LDOPTS) -Wl,-soname,$@ -o $@'
-
-    else
-	MOZ_DEBUG_FLAGS='-g'
-	ASFLAGS='-I$(topsrcdir)/xpcom/reflect/xptcall/public -g'
-	CFLAGS="$CFLAGS -ieee"
-	CXXFLAGS="$CXXFLAGS "'-noexceptions -ieee  -ptr $(DIST)/cxx_repository'
-	DSO_LDOPTS='-shared -msym -expect_unresolved \* -update_registry $(DIST)/so_locations'
-	DSO_CFLAGS=
-	DSO_PIC_CFLAGS=
-	MKCSHLIB='$(CC) $(CFLAGS) $(DSO_PIC_CFLAGS) $(DSO_LDOPTS) -soname $@ -o $@'
-	MKSHLIB='$(CXX) $(CXXFLAGS) $(DSO_PIC_CFLAGS) $(DSO_LDOPTS) -soname $@ -o $@'
-	MKSHLIB_FORCE_ALL='-all'
-	MKSHLIB_UNFORCE_ALL='-none'
-	dnl Might fix the libxpcom.so breakage on this platform as well....
-	AC_DEFINE(NSCAP_DISABLE_TEST_DONTQUERY_CASES)
-	AC_DEFINE(NSCAP_DISABLE_DEBUG_PTR_TYPES)
-    fi
-    if test -z "$GNU_CXX"; then
-      COMPAQ_CXX=1
-    fi
-    AC_DEFINE(NEED_USLEEP_PROTOTYPE)
-    ;;
-
 *-solaris*)
     AC_DEFINE(SOLARIS)
     TARGET_NSPR_MDCPUCFG='\"md/_solaris.cfg\"'
@@ -3422,10 +3389,6 @@ then
 			AC_DEFINE(_REENTRANT)
 			;;
 
-	    alpha*-*-osf*)
-			AC_DEFINE(_REENTRANT)
-			;;
-
 	    *-*-solaris*)
 			AC_DEFINE(_REENTRANT)
 			if test "$SOLARIS_SUNPRO_CC"; then
@@ -7719,13 +7682,7 @@ fi
 
 AC_SUBST(_MOZ_EXCEPTIONS_FLAGS_ON)
 
-# OSF native compilers do not like exception declarations
-# when exceptions are disabled
-if test -n "$COMPAQ_CXX" -o -n "$VACPP"; then
-    AC_DEFINE(CPP_THROW_NEW, [])
-else
-    AC_DEFINE(CPP_THROW_NEW, [throw()])
-fi
+AC_DEFINE(CPP_THROW_NEW, [throw()])
 AC_LANG_C
 
 dnl ========================================================
diff --git a/js/src/configure.in b/js/src/configure.in
index 5802c4fc6f19..55a06a47f622 100644
--- a/js/src/configure.in
+++ b/js/src/configure.in
@@ -1788,12 +1788,6 @@ case "$host" in
     MOZ_FIX_LINK_PATHS=
     ;;
 
-*-osf*)
-    HOST_CFLAGS="$HOST_CFLAGS -DXP_UNIX"
-    HOST_NSPR_MDCPUCFG='\"md/_osf1.cfg\"'
-    HOST_OPTIMIZE_FLAGS="${HOST_OPTIMIZE_FLAGS=-O2}"
-    ;;
-
 *)
     HOST_CFLAGS="$HOST_CFLAGS -DXP_UNIX"
     HOST_OPTIMIZE_FLAGS="${HOST_OPTIMIZE_FLAGS=-O2}"
@@ -2370,33 +2364,6 @@ ia64*-hpux*)
     fi
     ;;
 
-alpha*-*-osf*)
-    if test "$GNU_CC"; then
-      MKSHLIB='$(CXX) $(CXXFLAGS) $(DSO_PIC_CFLAGS) $(DSO_LDOPTS) -Wl,-soname,$@ -o $@'
-      MKCSHLIB='$(CC) $(CFLAGS) $(DSO_PIC_CFLAGS) $(DSO_LDOPTS) -Wl,-soname,$@ -o $@'
-
-    else
-	MOZ_DEBUG_FLAGS='-g'
-	ASFLAGS='-I$(topsrcdir)/xpcom/reflect/xptcall/public -g'
-	CFLAGS="$CFLAGS -ieee"
-	CXXFLAGS="$CXXFLAGS "'-noexceptions -ieee  -ptr $(DIST)/cxx_repository'
-	DSO_LDOPTS='-shared -msym -expect_unresolved \* -update_registry $(DIST)/so_locations'
-	DSO_CFLAGS=
-	DSO_PIC_CFLAGS=
-	MKCSHLIB='$(CC) $(CFLAGS) $(DSO_PIC_CFLAGS) $(DSO_LDOPTS) -soname $@ -o $@'
-	MKSHLIB='$(CXX) $(CXXFLAGS) $(DSO_PIC_CFLAGS) $(DSO_LDOPTS) -soname $@ -o $@'
-	MKSHLIB_FORCE_ALL='-all'
-	MKSHLIB_UNFORCE_ALL='-none'
-	dnl Might fix the libxpcom.so breakage on this platform as well....
-	AC_DEFINE(NSCAP_DISABLE_TEST_DONTQUERY_CASES)
-	AC_DEFINE(NSCAP_DISABLE_DEBUG_PTR_TYPES)
-    fi
-    if test -z "$GNU_CXX"; then
-      COMPAQ_CXX=1
-    fi
-    AC_DEFINE(NEED_USLEEP_PROTOTYPE)
-    ;;
-
 *-solaris*)
     AC_DEFINE(SOLARIS)
     TARGET_NSPR_MDCPUCFG='\"md/_solaris.cfg\"'
@@ -3319,10 +3286,6 @@ then
 			AC_DEFINE(_REENTRANT)
 			;;
 
-	    alpha*-*-osf*)
-			AC_DEFINE(_REENTRANT)
-			;;
-
 	    *-*-solaris*)
 			AC_DEFINE(_REENTRANT)
 			if test "$SOLARIS_SUNPRO_CC"; then
@@ -4978,13 +4941,7 @@ fi
 
 AC_SUBST(_MOZ_EXCEPTIONS_FLAGS_ON)
 
-# OSF native compilers do not like exception declarations
-# when exceptions are disabled
-if test -n "$COMPAQ_CXX" -o -n "$VACPP"; then
-    AC_DEFINE(CPP_THROW_NEW, [])
-else
-    AC_DEFINE(CPP_THROW_NEW, [throw()])
-fi
+AC_DEFINE(CPP_THROW_NEW, [throw()])
 AC_LANG_C
 
 dnl ========================================================
diff --git a/layout/build/Makefile.in b/layout/build/Makefile.in
index 1b7858919fb9..03fc6bfb757c 100644
--- a/layout/build/Makefile.in
+++ b/layout/build/Makefile.in
@@ -42,13 +42,10 @@ VPATH		= @srcdir@
 
 include $(DEPTH)/config/autoconf.mk
 
-# Solaris and Tru64 UNIX sh blows
+# Solaris sh blows
 ifeq ($(OS_ARCH),SunOS)
 SHELL := ksh
 endif
-ifeq ($(OS_ARCH),OSF1)
-SHELL := ksh
-endif
 
 MODULE		= layout
 LIBRARY_NAME	= gklayout
diff --git a/xpcom/reflect/xptcall/src/md/unix/Makefile.in b/xpcom/reflect/xptcall/src/md/unix/Makefile.in
index c6d3a9bb00bf..6ef8880429e7 100644
--- a/xpcom/reflect/xptcall/src/md/unix/Makefile.in
+++ b/xpcom/reflect/xptcall/src/md/unix/Makefile.in
@@ -48,7 +48,6 @@ LIBRARY_NAME	= xptcmd
 EXPORT_LIBRARY	= ../..
 MOZILLA_INTERNAL_API = 1
 
-
 #
 # The default is this buildable, but non-functioning code.
 #
@@ -177,13 +176,6 @@ endif
 # Alpha
 ######################################################################
 #
-# Tru64/Alpha
-#
-ifeq ($(OS_ARCH)$(OS_TEST),OSF1alpha)
-CPPSRCS		:= xptcinvoke_osf1_alpha.cpp xptcstubs_osf1_alpha.cpp
-ASFILES		:= xptcinvoke_asm_osf1_alpha.s xptcstubs_asm_osf1_alpha.s
-endif
-#
 # Linux/Alpha
 #
 ifneq (,$(filter Linuxalpha FreeBSDalpha NetBSDalpha,$(OS_ARCH)$(OS_TEST)))                           
diff --git a/xpcom/reflect/xptcall/src/md/unix/xptcinvoke_asm_osf1_alpha.s b/xpcom/reflect/xptcall/src/md/unix/xptcinvoke_asm_osf1_alpha.s
deleted file mode 100644
index ad7b2f82aa28..000000000000
--- a/xpcom/reflect/xptcall/src/md/unix/xptcinvoke_asm_osf1_alpha.s
+++ /dev/null
@@ -1,83 +0,0 @@
-/*
- * XPTC_PUBLIC_API(nsresult)
- * XPTC_InvokeByIndex(nsISupports* that, PRUint32 methodIndex,
- *                    PRUint32 paramCount, nsXPTCVariant* params)
- */
-.text
-.align 4
-.globl XPTC_InvokeByIndex
-.ent XPTC_InvokeByIndex
-XPTC_InvokeByIndex:
-.frame $15,32,$26,0
-.mask 0x4008000,-32
-ldgp $29,0($27)
-XPTC_InvokeByIndexXv:
-subq $30,32,$30
-stq $26,0($30)
-stq $15,8($30)
-bis $30,$30,$15
-.prologue 1
-
-/*
- * Allocate enough stack space to hold the greater of 6 or "paramCount"+1
- * parameters. (+1 for "this" pointer)  Room for at least 6 parameters
- * is required for storage of those passed via registers.
- */
-
-bis $31,5,$2      /* count = MAX(5, "paramCount") */
-cmplt $2,$18,$1
-cmovne $1,$18,$2
-s8addq $2,16,$1   /* room for count+1 params (8 bytes each) */
-bic $1,15,$1      /* stack space is rounded up to 0 % 16 */
-subq $30,$1,$30
-
-stq $16,0($30)    /* save "that" (as "this" pointer) */
-stq $17,16($15)   /* save "methodIndex" */
-
-addq $30,8,$16    /* pass stack pointer */
-bis $18,$18,$17   /* pass "paramCount" */
-bis $19,$19,$18   /* pass "params" */
-jsr $26,invoke_copy_to_stack     /* call invoke_copy_to_stack */
-ldgp $29,0($26)
-
-/*
- * Copy the first 6 parameters to registers and remove from stack frame.
- * Both the integer and floating point registers are set for each parameter
- * except the first which is the "this" pointer.  (integer only)
- * The floating point registers are all set as doubles since the
- * invoke_copy_to_stack function should have converted the floats.
- */
-ldq $16,0($30)    /* integer registers */
-ldq $17,8($30)
-ldq $18,16($30)
-ldq $19,24($30)
-ldq $20,32($30)
-ldq $21,40($30)
-ldt $f17,8($30)   /* floating point registers */
-ldt $f18,16($30)
-ldt $f19,24($30)
-ldt $f20,32($30)
-ldt $f21,40($30)
-
-addq $30,48,$30   /* remove params from stack */
-
-/*
- * Call the virtual function with the constructed stack frame.
- */
-bis $16,$16,$1    /* load "this" */
-ldq $2,16($15)    /* load "methodIndex" */
-ldq $1,0($1)      /* load vtable */
-s8addq $2,0,$2   /* vtable index = "methodIndex" * 8 + 16 */
-addq $1,$2,$1
-ldq $27,0($1)     /* load address of function */
-jsr $26,($27),0   /* call virtual function */
-ldgp $29,0($26)
-
-bis $15,$15,$30
-ldq $26,0($30)
-ldq $15,8($30)
-addq $30,32,$30
-ret $31,($26),1
-.end XPTC_InvokeByIndex
-
-
diff --git a/xpcom/reflect/xptcall/src/md/unix/xptcinvoke_osf1_alpha.cpp b/xpcom/reflect/xptcall/src/md/unix/xptcinvoke_osf1_alpha.cpp
deleted file mode 100644
index 13c3b23de78a..000000000000
--- a/xpcom/reflect/xptcall/src/md/unix/xptcinvoke_osf1_alpha.cpp
+++ /dev/null
@@ -1,93 +0,0 @@
-/* -*- Mode: C; tab-width: 8; indent-tabs-mode: nil; c-basic-offset: 4 -*- */
-/* ***** BEGIN LICENSE BLOCK *****
- * Version: MPL 1.1/GPL 2.0/LGPL 2.1
- *
- * The contents of this file are subject to the Mozilla Public License Version
- * 1.1 (the "License"); you may not use this file except in compliance with
- * the License. You may obtain a copy of the License at
- * http://www.mozilla.org/MPL/
- *
- * Software distributed under the License is distributed on an "AS IS" basis,
- * WITHOUT WARRANTY OF ANY KIND, either express or implied. See the License
- * for the specific language governing rights and limitations under the
- * License.
- *
- * The Original Code is mozilla.org code.
- *
- * The Initial Developer of the Original Code is
- * Netscape Communications Corporation.
- * Portions created by the Initial Developer are Copyright (C) 1998
- * the Initial Developer. All Rights Reserved.
- *
- * Contributor(s):
- *
- * Alternatively, the contents of this file may be used under the terms of
- * either of the GNU General Public License Version 2 or later (the "GPL"),
- * or the GNU Lesser General Public License Version 2.1 or later (the "LGPL"),
- * in which case the provisions of the GPL or the LGPL are applicable instead
- * of those above. If you wish to allow use of your version of this file only
- * under the terms of either the GPL or the LGPL, and not to allow others to
- * use your version of this file under the terms of the MPL, indicate your
- * decision by deleting the provisions above and replace them with the notice
- * and other provisions required by the GPL or the LGPL. If you do not delete
- * the provisions above, a recipient may use your version of this file under
- * the terms of any one of the MPL, the GPL or the LGPL.
- *
- * ***** END LICENSE BLOCK ***** */
-
-/* Platform specific code to invoke XPCOM methods on native objects */
-
-/* contributed by Steve Streeter <Stephen.Streeter@Compaq.com> */
-
-#include "xptcprivate.h"
-
-/* Prototype specifies unmangled function name */
-extern "C" void
-invoke_copy_to_stack(PRUint64* d, PRUint32 paramCount, nsXPTCVariant* s);
-
-extern "C" void
-invoke_copy_to_stack(PRUint64* d, PRUint32 paramCount, nsXPTCVariant* s)
-{
-    const PRUint8 NUM_ARG_REGS = 6-1;        // -1 for "this" pointer
-
-    for(PRUint32 i = 0; i < paramCount; i++, d++, s++)
-    {
-        if(s->IsPtrData())
-        {
-            *d = (PRUint64)s->ptr;
-            continue;
-        }
-        switch(s->type)
-        {
-        case nsXPTType::T_I8     : *d = (PRUint64)s->val.i8;     break;
-        case nsXPTType::T_I16    : *d = (PRUint64)s->val.i16;    break;
-        case nsXPTType::T_I32    : *d = (PRUint64)s->val.i32;    break;
-        case nsXPTType::T_I64    : *d = (PRUint64)s->val.i64;    break;
-        case nsXPTType::T_U8     : *d = (PRUint64)s->val.u8;     break;
-        case nsXPTType::T_U16    : *d = (PRUint64)s->val.u16;    break;
-        case nsXPTType::T_U32    : *d = (PRUint64)s->val.u32;    break;
-        case nsXPTType::T_U64    : *d = (PRUint64)s->val.u64;    break;
-        case nsXPTType::T_FLOAT  :
-            if(i < NUM_ARG_REGS)
-            {
-                // convert floats to doubles if they are to be passed
-                // via registers so we can just deal with doubles later
-                union { PRUint64 u64; double d; } t;
-                t.d = (double)s->val.f;
-                *d = t.u64;
-            }
-            else
-                // otherwise copy to stack normally
-                *d = (PRUint64)s->val.u32;
-            break;
-        case nsXPTType::T_DOUBLE : *d = (PRUint64)s->val.u64;    break;
-        case nsXPTType::T_BOOL   : *d = (PRUint64)s->val.b;      break;
-        case nsXPTType::T_CHAR   : *d = (PRUint64)s->val.c;      break;
-        case nsXPTType::T_WCHAR  : *d = (PRUint64)s->val.wc;     break;
-        default:
-            // all the others are plain pointer types
-            *d = (PRUint64)s->val.p;
-            break;
-        }
-    }
-}
diff --git a/xpcom/reflect/xptcall/src/md/unix/xptcstubs_asm_osf1_alpha.s b/xpcom/reflect/xptcall/src/md/unix/xptcstubs_asm_osf1_alpha.s
deleted file mode 100644
index 3bef9b1bbf14..000000000000
--- a/xpcom/reflect/xptcall/src/md/unix/xptcstubs_asm_osf1_alpha.s
+++ /dev/null
@@ -1,75 +0,0 @@
-        .text
-        .align 5
-        .globl SharedStub
-	.ent SharedStub
-SharedStub:
-	.frame  $30, 96, $26, 0
-        .mask 0x4000000,-96
-        ldgp $29,0($27)
-SharedStubXv:
-        subq $30,96,$30
-        stq $26,0($30)
-	.prologue 1
-        stt $f17,16($30)
-        stt $f18,24($30)
-        stt $f19,32($30)
-        stt $f20,40($30)
-        stt $f21,48($30)
-        stq $17,56($30)
-        stq $18,64($30)
-        stq $19,72($30)
-        stq $20,80($30)
-        stq $21,88($30)
-        bis $1,$1,$17
-        addq $30,16,$18
-        bsr $26,PrepareAndDispatch
-        ldq $26,0($30)
-        addq $30,96,$30
-        ret $31,($26),1
-        .end SharedStub
-
-/*
-   The C preprocessor doesn't handle # and ## if run with -std or -std0.
-
-   If -std  then __STDC__ is 0 [default] (K&R behavior)
-   If -std0 then __STDC__ is undefined (K&R behavior)
-   If -std1 then __STDC__ is 1 (ANSI preprocessor)
-*/
-
-#if __STDC__
-#define STUB_ENTRY(n) ;\
-        .text ;\
-        .align 5 ;\
-        .globl Stub##n##__14nsXPTCStubBase ;\
-        .globl Stub##n##__14nsXPTCStubBaseXv ;\
-        .ent Stub##n##__14nsXPTCStubBase ;\
-Stub##n##__14nsXPTCStubBase: ;\
-        .frame $30,0,$26,0 ;\
-        ldgp $29,0($27) ;\
-        .prologue 1 ;\
-Stub##n##__14nsXPTCStubBaseXv: ;\
-        lda $1,n ;\
-        br $31,SharedStubXv ;\
-        .end Stub##n##__14nsXPTCStubBase \
-
-#else
-#define STUB_ENTRY(n) ;\
-        .text ;\
-        .align 5 ;\
-        .globl Stub/**/n/**/__14nsXPTCStubBase ;\
-        .globl Stub/**/n/**/__14nsXPTCStubBaseXv ;\
-        .ent Stub/**/n/**/__14nsXPTCStubBase ;\
-Stub/**/n/**/__14nsXPTCStubBase: ;\
-        .frame $30,0,$26,0 ;\
-        ldgp $29,0($27) ;\
-        .prologue 1 ;\
-Stub/**/n/**/__14nsXPTCStubBaseXv: ;\
-        lda $1,n ;\
-        br $31,SharedStubXv ;\
-        .end Stub/**/n/**/__14nsXPTCStubBase \
-
-#endif
-
-#define SENTINEL_ENTRY(n) \
-
-#include "xptcstubsdef.inc"
diff --git a/xpcom/reflect/xptcall/src/md/unix/xptcstubs_osf1_alpha.cpp b/xpcom/reflect/xptcall/src/md/unix/xptcstubs_osf1_alpha.cpp
deleted file mode 100644
index 7674016771e8..000000000000
--- a/xpcom/reflect/xptcall/src/md/unix/xptcstubs_osf1_alpha.cpp
+++ /dev/null
@@ -1,149 +0,0 @@
-/* -*- Mode: C; tab-width: 8; indent-tabs-mode: nil; c-basic-offset: 4 -*- */
-/* ***** BEGIN LICENSE BLOCK *****
- * Version: MPL 1.1/GPL 2.0/LGPL 2.1
- *
- * The contents of this file are subject to the Mozilla Public License Version
- * 1.1 (the "License"); you may not use this file except in compliance with
- * the License. You may obtain a copy of the License at
- * http://www.mozilla.org/MPL/
- *
- * Software distributed under the License is distributed on an "AS IS" basis,
- * WITHOUT WARRANTY OF ANY KIND, either express or implied. See the License
- * for the specific language governing rights and limitations under the
- * License.
- *
- * The Original Code is mozilla.org code.
- *
- * The Initial Developer of the Original Code is
- * Netscape Communications Corporation.
- * Portions created by the Initial Developer are Copyright (C) 1999
- * the Initial Developer. All Rights Reserved.
- *
- * Contributor(s):
- *
- * Alternatively, the contents of this file may be used under the terms of
- * either of the GNU General Public License Version 2 or later (the "GPL"),
- * or the GNU Lesser General Public License Version 2.1 or later (the "LGPL"),
- * in which case the provisions of the GPL or the LGPL are applicable instead
- * of those above. If you wish to allow use of your version of this file only
- * under the terms of either the GPL or the LGPL, and not to allow others to
- * use your version of this file under the terms of the MPL, indicate your
- * decision by deleting the provisions above and replace them with the notice
- * and other provisions required by the GPL or the LGPL. If you do not delete
- * the provisions above, a recipient may use your version of this file under
- * the terms of any one of the MPL, the GPL or the LGPL.
- *
- * ***** END LICENSE BLOCK ***** */
-
-/* Implement shared vtbl methods. */
-
-/* contributed by Glen Nakamura <glen.nakamura@usa.net> */
-
-#include "xptcprivate.h"
-
-extern "C" nsresult
-PrepareAndDispatch(nsXPTCStubBase* self, uint32 methodIndex, PRUint64* args)
-{
-    const PRUint8 PARAM_BUFFER_COUNT = 16;
-    const PRUint8 NUM_ARG_REGS = 6-1;        // -1 for "this" pointer
-
-    nsXPTCMiniVariant paramBuffer[PARAM_BUFFER_COUNT];
-    nsXPTCMiniVariant* dispatchParams = NULL;
-    nsIInterfaceInfo* iface_info = NULL;
-    const nsXPTMethodInfo* info;
-    PRUint8 paramCount;
-    PRUint8 i;
-    nsresult result = NS_ERROR_FAILURE;
-
-    NS_ASSERTION(self,"no self");
-
-    self->GetInterfaceInfo(&iface_info);
-    NS_ASSERTION(iface_info,"no interface info");
-
-    iface_info->GetMethodInfo(PRUint16(methodIndex), &info);
-    NS_ASSERTION(info,"no interface info");
-
-    paramCount = info->GetParamCount();
-
-    // setup variant array pointer
-    if(paramCount > PARAM_BUFFER_COUNT)
-        dispatchParams = new nsXPTCMiniVariant[paramCount];
-    else
-        dispatchParams = paramBuffer;
-    NS_ASSERTION(dispatchParams,"no place for params");
-
-    // args[0] to args[NUM_ARG_REGS] hold floating point register values
-    PRUint64* ap = args + NUM_ARG_REGS;
-    for(i = 0; i < paramCount; i++, ap++)
-    {
-        const nsXPTParamInfo& param = info->GetParam(i);
-        const nsXPTType& type = param.GetType();
-        nsXPTCMiniVariant* dp = &dispatchParams[i];
-
-        if(param.IsOut() || !type.IsArithmetic())
-        {
-            dp->val.p = (void*) *ap;
-            continue;
-        }
-        // else
-        switch(type)
-        {
-        case nsXPTType::T_I8     : dp->val.i8  = (PRInt8)    *ap;    break;
-        case nsXPTType::T_I16    : dp->val.i16 = (PRInt16)   *ap;    break;
-        case nsXPTType::T_I32    : dp->val.i32 = (PRInt32)   *ap;    break;
-        case nsXPTType::T_I64    : dp->val.i64 = (PRInt64)   *ap;    break;
-        case nsXPTType::T_U8     : dp->val.u8  = (PRUint8)   *ap;    break;
-        case nsXPTType::T_U16    : dp->val.u16 = (PRUint16)  *ap;    break;
-        case nsXPTType::T_U32    : dp->val.u32 = (PRUint32)  *ap;    break;
-        case nsXPTType::T_U64    : dp->val.u64 = (PRUint64)  *ap;    break;
-        case nsXPTType::T_FLOAT  :
-            if(i < NUM_ARG_REGS)
-            {
-                // floats passed via registers are stored as doubles
-                // in the first NUM_ARG_REGS entries in args
-                dp->val.u64 = (PRUint64) args[i];
-                dp->val.f = (float) dp->val.d;    // convert double to float
-            }
-            else
-                dp->val.u32 = (PRUint32) *ap;
-            break;
-        case nsXPTType::T_DOUBLE :
-            // doubles passed via registers are also stored
-            // in the first NUM_ARG_REGS entries in args
-            dp->val.u64 = (i < NUM_ARG_REGS) ? args[i] : *ap;
-            break;
-        case nsXPTType::T_BOOL   : dp->val.b   = (PRBool)    *ap;    break;
-        case nsXPTType::T_CHAR   : dp->val.c   = (char)      *ap;    break;
-        case nsXPTType::T_WCHAR  : dp->val.wc  = (PRUnichar) *ap;    break;
-        default:
-            NS_ERROR("bad type");
-            break;
-        }
-    }
-
-    result = self->CallMethod((PRUint16)methodIndex, info, dispatchParams);
-
-    NS_RELEASE(iface_info);
-
-    if(dispatchParams != paramBuffer)
-        delete [] dispatchParams;
-
-    return result;
-}
-
-/*
- * nsresult nsXPTCStubBase::Stub##n() ;\
- *  Sets arguments to registers and calls PrepareAndDispatch.
- *  This is defined in the ASM file.
- */
-#define STUB_ENTRY(n) \
-
-#define SENTINEL_ENTRY(n) \
-nsresult nsXPTCStubBase::Sentinel##n() \
-{ \
-    NS_ERROR("nsXPTCStubBase::Sentinel called"); \
-    return NS_ERROR_NOT_IMPLEMENTED; \
-}
-
-#include "xptcstubsdef.inc"
-

From e1d261ef6a9cbd7a0581a010ad57b344a0773abb Mon Sep 17 00:00:00 2001
From: Matheus Kerschbaum <matjk7@gmail.com>
Date: Sat, 3 Sep 2011 01:55:30 +0100
Subject: [PATCH 032/209] Bug 682716 - Remove remaining support for Symbian.
 r=ted

---
 js/src/Makefile.in                            |  2 -
 js/src/configure.in                           | 65 -------------------
 js/src/jstypes.h                              | 15 -----
 js/src/xpconnect/shell/xpcshell.cpp           |  3 -
 .../protocol/file/nsFileProtocolHandler.cpp   |  2 +-
 5 files changed, 1 insertion(+), 86 deletions(-)

diff --git a/js/src/Makefile.in b/js/src/Makefile.in
index 01ee687e43bc..80806b254c35 100644
--- a/js/src/Makefile.in
+++ b/js/src/Makefile.in
@@ -563,7 +563,6 @@ endif
 default::
 
 ifneq (,$(CROSS_COMPILE)$(filter-out WINNT OS2,$(OS_ARCH)))
-ifneq ($(OS_ARCH),SYMBIAN)
 # nsinstall doesn't get built until we enter config/ in the exports phase,
 # so we'll have to manually ensure it gets built here if we want to use
 # $(EXPORTS)
@@ -573,7 +572,6 @@ $(PUBLIC) $(SDK_PUBLIC): config/nsinstall$(HOST_BIN_SUFFIX)
 config/nsinstall$(HOST_BIN_SUFFIX): $(srcdir)/config/nsinstall.c $(srcdir)/config/pathsub.c
 	$(MAKE) -C config/ nsinstall$(HOST_BIN_SUFFIX)
 endif
-endif
 
 include $(topsrcdir)/config/rules.mk
 
diff --git a/js/src/configure.in b/js/src/configure.in
index 55a06a47f622..7ee0053208bf 100644
--- a/js/src/configure.in
+++ b/js/src/configure.in
@@ -501,40 +501,6 @@ if test "$target" != "$host"; then
         ;;
     esac
 
-    case "$target" in
-    *symbian*)
-        AC_ARG_WITH(symbian-sdk,
-        [  --with-symbian-sdk=SYMBIAN_SDK_DIR
-                          The path to the Symbian SDK],
-        SYMBIAN_SDK_DIR=$withval)
-
-        OS_EXE_CFLAGS="$OS_EXE_CFLAGS -D__EXE__"
-        CFLAGS="-MD -nostdinc"
-        SYMBIAN_SYS_INCLUDE="-I$SYMBIAN_SDK_DIR/Epoc32/include -I$SYMBIAN_SDK_DIR/Epoc32/include/variant -I$SYMBIAN_SDK_DIR/Epoc32/include/stdapis"
-
-        case "$target" in
-        *-symbianelf)
-            OS_TARGET=GCCE
-            CC=arm-none-symbianelf-gcc.exe
-            CXX=arm-none-symbianelf-g++.exe
-            LD=arm-none-symbianelf-ld.exe
-            AR=arm-none-symbianelf-ar.exe
-            CPP=arm-none-symbianelf-cpp.exe
-            CFLAGS="$CFLAGS -c -Wall -Wno-unknown-pragmas -fexceptions -march=armv5t -mapcs -pipe -msoft-float"
-            CXXFLAGS="$CFLAGS -Wno-ctor-dtor-privacy"
-            GCCE_INCLUDE="-include $SYMBIAN_SDK_DIR/EPOC32/INCLUDE/GCCE/GCCE.h -D__PRODUCT_INCLUDE__=$SYMBIAN_SDK_DIR/Epoc32/include/variant/Symbian_OS_v9.2.hrh"
-            CFLAGS="$CFLAGS ${GCCE_INCLUDE} -x c"
-            CXXFLAGS="$CXXFLAGS ${GCCE_INCLUDE} -x c++"
-            CPPFLAGS="$CPPFLAGS ${SYMBIAN_SYS_INCLUDE}"
-            ;;
-        *-symbianwinscw)
-            dnl TODO: add emulator build code
-            OS_TARGET=WINSCW
-            ;;
-        esac
-        ;;
-    esac
-
     AC_CHECK_PROGS(CC, $CC "${target_alias}-gcc" "${target}-gcc", :)
     unset ac_cv_prog_CC
     AC_PROG_CC
@@ -2055,33 +2021,6 @@ ia64*-hpux*)
         MC=mc.exe
     fi
     ;;
-*-symbian*)
-
-    AC_DEFINE(XP_UNIX)
-    AC_DEFINE(SYMBIAN)
-    AC_DEFINE(__arm__)
-    AC_DEFINE(__SYMBIAN32__)
-    AC_DEFINE(_UNICODE)
-    AC_DEFINE(NDEBUG)
-    AC_DEFINE(__SUPPORT_CPP_EXCEPTIONS__)
-    AC_DEFINE(MOZ_STDERR_TO_STDOUT)
-    AC_DEFINE(HAVE_FCNTL_FILE_LOCKING)
-    AC_DEFINE(HAVE_SOCKLEN_T)
-    AC_DEFINE(__GCCE__)
-
-    CPU_ARCH=ARM
-    OS_RELEASE=9.2
-    OS_ARCH=SYMBIAN
-    USE_PTHREADS=1
-    LIB_SUFFIX=lib
-    DLL_SUFFIX=dll
-    MKSHLIB=
-    DSO_LDOPTS=
-    DSO_CFLAGS=
-    VISIBILITY_FLAGS=
-    TARGET_NSPR_MDCPUCFG='\"md/_symbian.cfg\"'
-    RANLIB='echo no ranlib '
-;;
 
 *-mingw*)
     DSO_CFLAGS=
@@ -5065,10 +5004,6 @@ case "$target" in
 *-mingw*)
     NO_EDITLINE=1
     ;;
-*-symbian*)
-    NO_EDITLINE=1
-    JS_DISABLE_SHELL=1
-    ;;
 *)
     ;;
 esac
diff --git a/js/src/jstypes.h b/js/src/jstypes.h
index 8ff593ed620c..994e5bd2e1ab 100644
--- a/js/src/jstypes.h
+++ b/js/src/jstypes.h
@@ -88,13 +88,6 @@
 # define JS_EXTERN_DATA(__type) extern __declspec(dllexport) __type
 # define JS_EXPORT_DATA(__type) __declspec(dllexport) __type
 
-#elif defined(__SYMBIAN32__)
-
-# define JS_EXTERN_API(__type) extern EXPORT_C __type
-# define JS_EXPORT_API(__type) EXPORT_C __type
-# define JS_EXTERN_DATA(__type) extern EXPORT_C __type
-# define JS_EXPORT_DATA(__type) EXPORT_C __type
-
 #else /* Unix */
 
 # ifdef HAVE_VISIBILITY_ATTRIBUTE
@@ -131,8 +124,6 @@
 # endif
 #elif defined(XP_OS2)
 # define JS_IMPORT_API(__x)     __declspec(dllimport) __x
-#elif defined(__SYMBIAN32__)
-# define JS_IMPORT_API(__x)     IMPORT_C __x
 #else
 # define JS_IMPORT_API(__x)     JS_EXPORT_API (__x)
 #endif
@@ -141,12 +132,6 @@
 # define JS_IMPORT_DATA(__x)      __declspec(dllimport) __x
 #elif defined(XP_OS2)
 # define JS_IMPORT_DATA(__x)      __declspec(dllimport) __x
-#elif defined(__SYMBIAN32__)
-# if defined(__CW32__)
-#   define JS_IMPORT_DATA(__x)    __declspec(dllimport) __x
-# else
-#   define JS_IMPORT_DATA(__x)    IMPORT_C __x
-# endif
 #else
 # define JS_IMPORT_DATA(__x)     JS_EXPORT_DATA (__x)
 #endif
diff --git a/js/src/xpconnect/shell/xpcshell.cpp b/js/src/xpconnect/shell/xpcshell.cpp
index aa7034f828bc..9025466cced6 100644
--- a/js/src/xpconnect/shell/xpcshell.cpp
+++ b/js/src/xpconnect/shell/xpcshell.cpp
@@ -86,9 +86,6 @@
 #ifdef XP_WIN
 #include <windows.h>
 #endif
-#ifdef __SYMBIAN32__
-#include <unistd.h>
-#endif
 
 #include "nsIScriptSecurityManager.h"
 #include "nsIPrincipal.h"
diff --git a/netwerk/protocol/file/nsFileProtocolHandler.cpp b/netwerk/protocol/file/nsFileProtocolHandler.cpp
index f3b1c57275d9..5ca21ff72c69 100644
--- a/netwerk/protocol/file/nsFileProtocolHandler.cpp
+++ b/netwerk/protocol/file/nsFileProtocolHandler.cpp
@@ -187,7 +187,7 @@ nsFileProtocolHandler::ReadURLFile(nsIFile* aFile, nsIURI** aURI)
     return rv;
 }
 
-#elif defined(XP_UNIX) && !defined(__SYMBIAN32__)
+#elif defined(XP_UNIX)
 NS_IMETHODIMP
 nsFileProtocolHandler::ReadURLFile(nsIFile* aFile, nsIURI** aURI)
 {

From b19abf1f7f565232b85699a1aeb2badc242794b6 Mon Sep 17 00:00:00 2001
From: Matheus Kerschbaum <matjk7@gmail.com>
Date: Sat, 3 Sep 2011 01:55:30 +0100
Subject: [PATCH 033/209] Bug 683874 - Remove modules/libimg/Makefile.in r=ted

---
 modules/libimg/Makefile.in | 50 --------------------------------------
 toolkit/toolkit-tiers.mk   |  5 +++-
 2 files changed, 4 insertions(+), 51 deletions(-)
 delete mode 100644 modules/libimg/Makefile.in

diff --git a/modules/libimg/Makefile.in b/modules/libimg/Makefile.in
deleted file mode 100644
index a84113b87b69..000000000000
--- a/modules/libimg/Makefile.in
+++ /dev/null
@@ -1,50 +0,0 @@
-#
-# ***** BEGIN LICENSE BLOCK *****
-# Version: MPL 1.1/GPL 2.0/LGPL 2.1
-#
-# The contents of this file are subject to the Mozilla Public License Version
-# 1.1 (the "License"); you may not use this file except in compliance with
-# the License. You may obtain a copy of the License at
-# http://www.mozilla.org/MPL/
-#
-# Software distributed under the License is distributed on an "AS IS" basis,
-# WITHOUT WARRANTY OF ANY KIND, either express or implied. See the License
-# for the specific language governing rights and limitations under the
-# License.
-#
-# The Original Code is mozilla.org code.
-#
-# The Initial Developer of the Original Code is
-# Netscape Communications Corporation.
-# Portions created by the Initial Developer are Copyright (C) 1998
-# the Initial Developer. All Rights Reserved.
-#
-# Contributor(s):
-#
-# Alternatively, the contents of this file may be used under the terms of
-# either the GNU General Public License Version 2 or later (the "GPL"), or
-# the GNU Lesser General Public License Version 2.1 or later (the "LGPL"),
-# in which case the provisions of the GPL or the LGPL are applicable instead
-# of those above. If you wish to allow use of your version of this file only
-# under the terms of either the GPL or the LGPL, and not to allow others to
-# use your version of this file under the terms of the MPL, indicate your
-# decision by deleting the provisions above and replace them with the notice
-# and other provisions required by the GPL or the LGPL. If you do not delete
-# the provisions above, a recipient may use your version of this file under
-# the terms of any one of the MPL, the GPL or the LGPL.
-#
-# ***** END LICENSE BLOCK *****
-
-DEPTH		= ../..
-topsrcdir	= @top_srcdir@
-srcdir		= @srcdir@
-VPATH		= @srcdir@
-
-include $(DEPTH)/config/autoconf.mk
-
-ifndef MOZ_NATIVE_PNG
-DIRS		= png
-endif
-
-include $(topsrcdir)/config/rules.mk
-
diff --git a/toolkit/toolkit-tiers.mk b/toolkit/toolkit-tiers.mk
index 09b9de84ac08..7861158a1c9f 100644
--- a/toolkit/toolkit-tiers.mk
+++ b/toolkit/toolkit-tiers.mk
@@ -161,9 +161,12 @@ tier_platform_dirs += \
 		$(NULL)
 endif
 
+ifndef MOZ_NATIVE_PNG
+tier_platform_dirs += modules/libimg/png
+endif
+
 tier_platform_dirs	+= \
 		uriloader \
-		modules/libimg \
 		caps \
 		parser \
 		gfx \

From 402b8829274c311f969e394d7ddfc48a32fc1b6a Mon Sep 17 00:00:00 2001
From: Mike Hommey <mh+mozilla@glandium.org>
Date: Sat, 3 Sep 2011 08:19:06 +0200
Subject: [PATCH 034/209] Backout the backout of e5815c156b6c (bug 683096),
 9ca928d8095c (merge), a286edb8ca4b (bug 683875), 61dc35b8f63f (bug 683171),
 b0741ae44def (bug 683875), 8e01bc314326 + e2697c06468f (bug 677501),
 805e28e85577 (bug 680440)

---
 Makefile.in                                   |   6 +-
 browser/app/Makefile.in                       |   2 -
 browser/installer/package-manifest.in         |   7 +-
 browser/installer/removed-files.in            |   2 +-
 build/win32/Makefile.in                       |   2 +
 build/win32/crashinjectdll/Makefile.in        |   2 +
 build/win32/vmwarerecordinghelper/Makefile.in |   2 +
 config/autoconf.mk.in                         |   8 +-
 config/config.mk                              |  19 +-
 config/rules.mk                               |  24 +--
 configure.in                                  |  34 +++-
 ipc/app/Makefile.in                           |   4 -
 js/src/Makefile.in                            |   6 -
 js/src/config/autoconf.mk.in                  |   3 +-
 js/src/config/config.mk                       |  19 +-
 js/src/config/rules.mk                        |  24 +--
 js/src/configure.in                           |   5 +-
 memory/Makefile.in                            |   1 +
 memory/jemalloc/Makefile.in                   | 110 +----------
 memory/mozalloc/Makefile.in                   |   6 -
 memory/mozutils/Makefile.in                   | 175 ++++++++++++++++++
 memory/mozutils/dummy.cpp                     |   2 +
 memory/{jemalloc => mozutils}/fixcrt.py       |   0
 .../jemalloc.def => mozutils/mozutils.def.in} |   4 +-
 mobile/app/Makefile.in                        |   2 -
 mobile/installer/package-manifest.in          |   4 +-
 other-licenses/android/Makefile.in            |  15 +-
 toolkit/library/libxul-rules.mk               |   6 -
 toolkit/mozapps/installer/packager.mk         |   2 +-
 xpcom/idl-parser/typelib.py                   |   4 +-
 xpcom/typelib/xpidl/Makefile.in               |   5 -
 xulrunner/app/Makefile.in                     |   2 -
 xulrunner/stub/Makefile.in                    |   2 -
 33 files changed, 271 insertions(+), 238 deletions(-)
 create mode 100644 memory/mozutils/Makefile.in
 create mode 100644 memory/mozutils/dummy.cpp
 rename memory/{jemalloc => mozutils}/fixcrt.py (100%)
 rename memory/{jemalloc/jemalloc.def => mozutils/mozutils.def.in} (97%)

diff --git a/Makefile.in b/Makefile.in
index ee1da71bde92..573b2f2baa1e 100644
--- a/Makefile.in
+++ b/Makefile.in
@@ -65,15 +65,11 @@ tier_base_dirs = \
 	$(NULL)
 
 ifndef LIBXUL_SDK
-ifdef MOZ_MEMORY
-tier_base_dirs += memory/jemalloc
-endif
-
 ifeq ($(OS_TARGET),Android)
 tier_base_dirs += other-licenses/android
 endif
 
-tier_base_dirs += memory/mozalloc
+tier_base_dirs += memory
 endif
 
 ifdef COMPILE_ENVIRONMENT
diff --git a/browser/app/Makefile.in b/browser/app/Makefile.in
index 9a39a45e48a2..e40172f9e245 100644
--- a/browser/app/Makefile.in
+++ b/browser/app/Makefile.in
@@ -85,8 +85,6 @@ ifdef MOZ_APP_PROFILE
 DEFINES += -DMOZ_APP_PROFILE="$(MOZ_APP_PROFILE)"
 endif
 
-LIBS += $(JEMALLOC_LIBS)
-
 ifdef LIBXUL_SDK
 include $(topsrcdir)/config/rules.mk
 else
diff --git a/browser/installer/package-manifest.in b/browser/installer/package-manifest.in
index be25880912ed..d5d239d93f21 100644
--- a/browser/installer/package-manifest.in
+++ b/browser/installer/package-manifest.in
@@ -45,9 +45,7 @@
 @BINPATH@/@DLL_PREFIX@xpcom@DLL_SUFFIX@
 @BINPATH@/@DLL_PREFIX@nspr4@DLL_SUFFIX@
 @BINPATH@/@DLL_PREFIX@mozalloc@DLL_SUFFIX@
-#ifdef MOZ_MEMORY_DARWIN
-@BINPATH@/@DLL_PREFIX@jemalloc@DLL_SUFFIX@
-#endif
+@BINPATH@/@DLL_PREFIX@mozutils@DLL_SUFFIX@
 #ifdef XP_MACOSX
 @BINPATH@/XUL
 #else
@@ -60,9 +58,6 @@
 @BINPATH@/@MOZ_CHILD_PROCESS_NAME@
 #endif
 #ifdef XP_WIN32
-#ifdef MOZ_MEMORY
-@BINPATH@/jemalloc.dll
-#endif
 #if _MSC_VER == 1400
 @BINPATH@/Microsoft.VC80.CRT.manifest
 @BINPATH@/msvcm80.dll
diff --git a/browser/installer/removed-files.in b/browser/installer/removed-files.in
index 746627754a92..dde9c503893b 100644
--- a/browser/installer/removed-files.in
+++ b/browser/installer/removed-files.in
@@ -9,6 +9,7 @@
 @DLL_PREFIX@xpcom_compat@DLL_SUFFIX@
 @DLL_PREFIX@xpistub@DLL_SUFFIX@
 @DLL_PREFIX@zlib@DLL_SUFFIX@
+@DLL_PREFIX@jemalloc@DLL_SUFFIX@
 #ifdef MOZ_STATIC_JS
 @DLL_PREFIX@mozjs@DLL_SUFFIX@
 #endif
@@ -1258,7 +1259,6 @@ xpicleanup@BIN_SUFFIX@
     dictionaries/PL.dic
     icons/mozicon16.xpm
     icons/mozicon50.xpm
-    libjemalloc.so
     plugins/libnullplugin.so
     readme.txt
   #endif
diff --git a/build/win32/Makefile.in b/build/win32/Makefile.in
index 7f6688b5cb86..e65bfcb77f4b 100644
--- a/build/win32/Makefile.in
+++ b/build/win32/Makefile.in
@@ -62,6 +62,8 @@ CPPSRCS = crashinject.cpp
 
 endif # ENABLE_TESTS
 
+MOZ_UTILS_LDFLAGS =
+
 include $(topsrcdir)/config/rules.mk
 
 ifdef WIN32_REDIST_DIR
diff --git a/build/win32/crashinjectdll/Makefile.in b/build/win32/crashinjectdll/Makefile.in
index 14ffaac4e4a0..a7cd0ab962b1 100644
--- a/build/win32/crashinjectdll/Makefile.in
+++ b/build/win32/crashinjectdll/Makefile.in
@@ -50,4 +50,6 @@ USE_STATIC_LIBS = 1
 
 CPPSRCS = crashinjectdll.cpp
 
+MOZ_UTILS_LDFLAGS =
+
 include $(topsrcdir)/config/rules.mk
diff --git a/build/win32/vmwarerecordinghelper/Makefile.in b/build/win32/vmwarerecordinghelper/Makefile.in
index 01457deac0b4..7c0e459dd709 100644
--- a/build/win32/vmwarerecordinghelper/Makefile.in
+++ b/build/win32/vmwarerecordinghelper/Makefile.in
@@ -51,4 +51,6 @@ USE_STATIC_LIBS = 1
 
 CPPSRCS = $(LIBRARY_NAME).cpp
 
+MOZ_UTILS_LDFLAGS =
+
 include $(topsrcdir)/config/rules.mk
diff --git a/config/autoconf.mk.in b/config/autoconf.mk.in
index ea68d9fcc3f0..e86645621c42 100644
--- a/config/autoconf.mk.in
+++ b/config/autoconf.mk.in
@@ -197,7 +197,6 @@ RM = rm -f
 MOZ_UI_LOCALE = @MOZ_UI_LOCALE@
 
 MOZ_COMPONENTS_VERSION_SCRIPT_LDFLAGS = @MOZ_COMPONENTS_VERSION_SCRIPT_LDFLAGS@
-MOZ_JEMALLOC_STANDALONE_GLUE_LDOPTS = @MOZ_JEMALLOC_STANDALONE_GLUE_LDOPTS@
 MOZ_COMPONENT_NSPR_LIBS=@MOZ_COMPONENT_NSPR_LIBS@
 
 MOZ_FIX_LINK_PATHS=@MOZ_FIX_LINK_PATHS@
@@ -628,13 +627,12 @@ MOZ_TOOLS_DIR	= @MOZ_TOOLS_DIR@
 MOZ_QUANTIFY	= @MOZ_QUANTIFY@
 MSMANIFEST_TOOL = @MSMANIFEST_TOOL@
 WIN32_REDIST_DIR = @WIN32_REDIST_DIR@
-MOZ_MEMORY_LDFLAGS = @MOZ_MEMORY_LDFLAGS@
+MOZ_UTILS_LDFLAGS = @MOZ_UTILS_LDFLAGS@
+MOZ_UTILS_PROGRAM_LDFLAGS = @MOZ_UTILS_PROGRAM_LDFLAGS@
 WIN32_CRT_LIBS = @WIN32_CRT_LIBS@
 
-# This is for custom CRT building
-ifdef MOZ_MEMORY
+# This is used to pass jemalloc flags to NSS
 DLLFLAGS = @DLLFLAGS@
-endif
 
 # Codesighs tools option, enables win32 mapfiles.
 MOZ_MAPINFO	= @MOZ_MAPINFO@
diff --git a/config/config.mk b/config/config.mk
index 54c03ed8e989..162cdaec2a7d 100644
--- a/config/config.mk
+++ b/config/config.mk
@@ -149,17 +149,6 @@ FINAL_LINK_COMP_NAMES = $(DEPTH)/config/final-link-comp-names
 MOZ_UNICHARUTIL_LIBS = $(LIBXUL_DIST)/lib/$(LIB_PREFIX)unicharutil_s.$(LIB_SUFFIX)
 MOZ_WIDGET_SUPPORT_LIBS    = $(DIST)/lib/$(LIB_PREFIX)widgetsupport_s.$(LIB_SUFFIX)
 
-ifdef MOZ_MEMORY
-ifneq ($(OS_ARCH),WINNT)
-JEMALLOC_LIBS = $(MKSHLIB_FORCE_ALL) $(call EXPAND_MOZLIBNAME,jemalloc) $(MKSHLIB_UNFORCE_ALL)
-# If we are linking jemalloc into a program, we want the jemalloc symbols
-# to be exported
-ifneq (,$(SIMPLE_PROGRAMS)$(PROGRAM))
-JEMALLOC_LIBS += $(MOZ_JEMALLOC_STANDALONE_GLUE_LDOPTS)
-endif
-endif
-endif
-
 CC := $(CC_WRAPPER) $(CC)
 CXX := $(CXX_WRAPPER) $(CXX)
 MKDIR ?= mkdir
@@ -247,13 +236,17 @@ endif # MOZ_DEBUG
 # We don't build a static CRT when building a custom CRT,
 # it appears to be broken. So don't link to jemalloc if
 # the Makefile wants static CRT linking.
-ifeq ($(MOZ_MEMORY)_$(USE_STATIC_LIBS),1_)
+ifeq ($(MOZ_MEMORY)_$(USE_STATIC_LIBS),1_1)
 # Disable default CRT libs and add the right lib path for the linker
-OS_LDFLAGS += $(MOZ_MEMORY_LDFLAGS)
+MOZ_UTILS_LDFLAGS=
 endif
 
 endif # WINNT && !GNU_CC
 
+ifndef MOZ_UTILS_PROGRAM_LDFLAGS
+MOZ_UTILS_PROGRAM_LDFLAGS=$(MOZ_UTILS_LDFLAGS)
+endif
+
 #
 # Build using PIC by default
 #
diff --git a/config/rules.mk b/config/rules.mk
index 726368514ecf..33339b221f8e 100644
--- a/config/rules.mk
+++ b/config/rules.mk
@@ -250,12 +250,12 @@ endif # ENABLE_TESTS
 
 ifndef LIBRARY
 ifdef STATIC_LIBRARY_NAME
-_LIBRARY		:= $(LIB_PREFIX)$(STATIC_LIBRARY_NAME).$(LIB_SUFFIX)
+REAL_LIBRARY		:= $(LIB_PREFIX)$(STATIC_LIBRARY_NAME).$(LIB_SUFFIX)
 # Only build actual library if it is installed in DIST/lib or SDK
 ifeq (,$(SDK_LIBRARY)$(DIST_INSTALL)$(NO_EXPAND_LIBS))
-LIBRARY			:= $(_LIBRARY).$(LIBS_DESC_SUFFIX)
+LIBRARY			:= $(REAL_LIBRARY).$(LIBS_DESC_SUFFIX)
 else
-LIBRARY			:= $(_LIBRARY) $(_LIBRARY).$(LIBS_DESC_SUFFIX)
+LIBRARY			:= $(REAL_LIBRARY) $(REAL_LIBRARY).$(LIBS_DESC_SUFFIX)
 endif
 endif # STATIC_LIBRARY_NAME
 endif # LIBRARY
@@ -875,7 +875,7 @@ alltags:
 $(PROGRAM): $(PROGOBJS) $(LIBS_DEPS) $(EXTRA_DEPS) $(EXE_DEF_FILE) $(RESFILE) $(GLOBAL_DEPS)
 	@$(RM) $@.manifest
 ifeq (_WINNT,$(GNU_CC)_$(OS_ARCH))
-	$(EXPAND_LD) -NOLOGO -OUT:$@ -PDB:$(LINK_PDBFILE) $(WIN32_EXE_LDFLAGS) $(LDFLAGS) $(PROGOBJS) $(RESFILE) $(LIBS) $(EXTRA_LIBS) $(OS_LIBS)
+	$(EXPAND_LD) -NOLOGO -OUT:$@ -PDB:$(LINK_PDBFILE) $(WIN32_EXE_LDFLAGS) $(LDFLAGS) $(MOZ_UTILS_PROGRAM_LDFLAGS) $(PROGOBJS) $(RESFILE) $(LIBS) $(EXTRA_LIBS) $(OS_LIBS)
 ifdef MSMANIFEST_TOOL
 	@if test -f $@.manifest; then \
 		if test -f "$(srcdir)/$@.manifest"; then \
@@ -897,10 +897,10 @@ ifdef MOZ_PROFILE_GENERATE
 endif
 else # !WINNT || GNU_CC
 ifeq ($(CPP_PROG_LINK),1)
-	$(EXPAND_CCC) -o $@ $(CXXFLAGS) $(PROGOBJS) $(RESFILE) $(WIN32_EXE_LDFLAGS) $(LDFLAGS) $(WRAP_LDFLAGS) $(LIBS_DIR) $(LIBS) $(OS_LIBS) $(EXTRA_LIBS) $(BIN_FLAGS) $(EXE_DEF_FILE)
+	$(EXPAND_CCC) -o $@ $(CXXFLAGS) $(PROGOBJS) $(RESFILE) $(WIN32_EXE_LDFLAGS) $(LDFLAGS) $(WRAP_LDFLAGS) $(MOZ_UTILS_PROGRAM_LDFLAGS) $(LIBS_DIR) $(LIBS) $(OS_LIBS) $(EXTRA_LIBS) $(BIN_FLAGS) $(EXE_DEF_FILE)
 	@$(call CHECK_STDCXX,$@)
 else # ! CPP_PROG_LINK
-	$(EXPAND_CC) -o $@ $(CFLAGS) $(PROGOBJS) $(RESFILE) $(WIN32_EXE_LDFLAGS) $(LDFLAGS) $(WRAP_LDFLAGS) $(LIBS_DIR) $(LIBS) $(OS_LIBS) $(EXTRA_LIBS) $(BIN_FLAGS) $(EXE_DEF_FILE)
+	$(EXPAND_CC) -o $@ $(CFLAGS) $(PROGOBJS) $(RESFILE) $(WIN32_EXE_LDFLAGS) $(LDFLAGS) $(MOZ_UTILS_PROGRAM_LDFLAGS) $(WRAP_LDFLAGS) $(LIBS_DIR) $(LIBS) $(OS_LIBS) $(EXTRA_LIBS) $(BIN_FLAGS) $(EXE_DEF_FILE)
 endif # CPP_PROG_LINK
 endif # WINNT && !GNU_CC
 
@@ -946,7 +946,7 @@ endif
 #
 $(SIMPLE_PROGRAMS): %$(BIN_SUFFIX): %.$(OBJ_SUFFIX) $(LIBS_DEPS) $(EXTRA_DEPS) $(GLOBAL_DEPS)
 ifeq (_WINNT,$(GNU_CC)_$(OS_ARCH))
-	$(EXPAND_LD) -nologo -out:$@ -pdb:$(LINK_PDBFILE) $< $(WIN32_EXE_LDFLAGS) $(LDFLAGS) $(LIBS) $(EXTRA_LIBS) $(OS_LIBS)
+	$(EXPAND_LD) -nologo -out:$@ -pdb:$(LINK_PDBFILE) $< $(WIN32_EXE_LDFLAGS) $(LDFLAGS) $(MOZ_UTILS_PROGRAM_LDFLAGS) $(LIBS) $(EXTRA_LIBS) $(OS_LIBS)
 ifdef MSMANIFEST_TOOL
 	@if test -f $@.manifest; then \
 		mt.exe -NOLOGO -MANIFEST $@.manifest -OUTPUTRESOURCE:$@\;1; \
@@ -955,10 +955,10 @@ ifdef MSMANIFEST_TOOL
 endif	# MSVC with manifest tool
 else
 ifeq ($(CPP_PROG_LINK),1)
-	$(EXPAND_CCC) $(CXXFLAGS) -o $@ $< $(WIN32_EXE_LDFLAGS) $(LDFLAGS) $(WRAP_LDFLAGS) $(LIBS_DIR) $(LIBS) $(OS_LIBS) $(EXTRA_LIBS) $(BIN_FLAGS)
+	$(EXPAND_CCC) $(CXXFLAGS) -o $@ $< $(WIN32_EXE_LDFLAGS) $(LDFLAGS) $(MOZ_UTILS_PROGRAM_LDFLAGS) $(WRAP_LDFLAGS) $(LIBS_DIR) $(LIBS) $(OS_LIBS) $(EXTRA_LIBS) $(BIN_FLAGS)
 	@$(call CHECK_STDCXX,$@)
 else
-	$(EXPAND_CC) $(CFLAGS) $(OUTOPTION)$@ $< $(WIN32_EXE_LDFLAGS) $(LDFLAGS) $(WRAP_LDFLAGS) $(LIBS_DIR) $(LIBS) $(OS_LIBS) $(EXTRA_LIBS) $(BIN_FLAGS)
+	$(EXPAND_CC) $(CFLAGS) $(OUTOPTION)$@ $< $(WIN32_EXE_LDFLAGS) $(LDFLAGS) $(MOZ_UTILS_PROGRAM_LDFLAGS) $(WRAP_LDFLAGS) $(LIBS_DIR) $(LIBS) $(OS_LIBS) $(EXTRA_LIBS) $(BIN_FLAGS)
 endif # CPP_PROG_LINK
 endif # WINNT && !GNU_CC
 
@@ -1016,6 +1016,8 @@ $(filter %.$(LIB_SUFFIX),$(LIBRARY)): $(OBJS) $(LOBJS) $(SHARED_LIBRARY_LIBS_DEP
 	$(RANLIB) $@
 
 $(filter-out %.$(LIB_SUFFIX),$(LIBRARY)): $(filter %.$(LIB_SUFFIX),$(LIBRARY)) $(OBJS) $(LOBJS) $(SHARED_LIBRARY_LIBS_DEPS) $(EXTRA_DEPS) $(GLOBAL_DEPS)
+# When we only build a library descriptor, blow out any existing library
+	$(if $(filter %.$(LIB_SUFFIX),$(LIBRARY)),,$(RM) $(REAL_LIBRARY) $(EXPORT_LIBRARY:%=%/$(REAL_LIBRARY)))
 	$(EXPAND_LIBS_GEN) $(OBJS) $(LOBJS) $(SHARED_LIBRARY_LIBS) > $@
 
 ifeq ($(OS_ARCH),WINNT)
@@ -1069,10 +1071,10 @@ ifdef DTRACE_LIB_DEPENDENT
 ifndef XP_MACOSX
 	dtrace -G -C -s $(MOZILLA_DTRACE_SRC) -o  $(DTRACE_PROBE_OBJ) $(shell $(EXPAND_LIBS) $(MOZILLA_PROBE_LIBS))
 endif
-	$(EXPAND_MKSHLIB) $(SHLIB_LDSTARTFILE) $(OBJS) $(LOBJS) $(SUB_SHLOBJS) $(DTRACE_PROBE_OBJ) $(MOZILLA_PROBE_LIBS) $(RESFILE) $(LDFLAGS) $(WRAP_LDFLAGS) $(SHARED_LIBRARY_LIBS) $(EXTRA_DSO_LDOPTS) $(OS_LIBS) $(EXTRA_LIBS) $(DEF_FILE) $(SHLIB_LDENDFILE)
+	$(EXPAND_MKSHLIB) $(SHLIB_LDSTARTFILE) $(OBJS) $(LOBJS) $(SUB_SHLOBJS) $(DTRACE_PROBE_OBJ) $(MOZILLA_PROBE_LIBS) $(RESFILE) $(LDFLAGS) $(MOZ_UTILS_LDFLAGS) $(WRAP_LDFLAGS) $(SHARED_LIBRARY_LIBS) $(EXTRA_DSO_LDOPTS) $(OS_LIBS) $(EXTRA_LIBS) $(DEF_FILE) $(SHLIB_LDENDFILE)
 	@$(RM) $(DTRACE_PROBE_OBJ)
 else # ! DTRACE_LIB_DEPENDENT
-	$(EXPAND_MKSHLIB) $(SHLIB_LDSTARTFILE) $(OBJS) $(LOBJS) $(SUB_SHLOBJS) $(RESFILE) $(LDFLAGS) $(WRAP_LDFLAGS) $(SHARED_LIBRARY_LIBS) $(EXTRA_DSO_LDOPTS) $(OS_LIBS) $(EXTRA_LIBS) $(DEF_FILE) $(SHLIB_LDENDFILE)
+	$(EXPAND_MKSHLIB) $(SHLIB_LDSTARTFILE) $(OBJS) $(LOBJS) $(SUB_SHLOBJS) $(RESFILE) $(LDFLAGS) $(MOZ_UTILS_LDFLAGS) $(WRAP_LDFLAGS) $(SHARED_LIBRARY_LIBS) $(EXTRA_DSO_LDOPTS) $(OS_LIBS) $(EXTRA_LIBS) $(DEF_FILE) $(SHLIB_LDENDFILE)
 endif # DTRACE_LIB_DEPENDENT
 	@$(call CHECK_STDCXX,$@)
 
diff --git a/configure.in b/configure.in
index 2f6059159e46..ae0d5124a325 100644
--- a/configure.in
+++ b/configure.in
@@ -2602,7 +2602,6 @@ dnl ========================================================
 case "$target" in
     *-linux*|*-kfreebsd*-gnu|*-gnu*)
         MOZ_COMPONENTS_VERSION_SCRIPT_LDFLAGS='-Wl,--version-script -Wl,$(BUILD_TOOLS)/gnu-ld-scripts/components-version-script'
-        MOZ_JEMALLOC_STANDALONE_GLUE_LDOPTS='-rdynamic -Wl,--version-script -Wl,$(BUILD_TOOLS)/gnu-ld-scripts/jemalloc-standalone-linkage-version-script'
         ;;
     *-solaris*)
         if test -z "$GNU_CC"; then
@@ -6952,6 +6951,21 @@ if test "$NS_TRACE_MALLOC"; then
     MOZ_MEMORY=
 fi
 
+if test "${OS_TARGET}" = "Android"; then
+  dnl On Android, we use WRAP_LDFLAGS to link everything to mozutils
+  :
+elif test "${OS_TARGET}" = "WINNT" -o "${OS_TARGET}" = "Darwin" -o "${OS_TARGET}" = "OS2"; then
+  dnl On Windows, OSX and OS2, we want to link all our binaries against mozutils
+  MOZ_UTILS_LDFLAGS='$(call EXPAND_LIBNAME_PATH,mozutils,$(LIBXUL_DIST)/lib)'
+else
+  dnl On other Unix systems, we only want to link executables against mozutils
+  MOZ_UTILS_PROGRAM_LDFLAGS='$(MKSHLIB_FORCE_ALL) $(call EXPAND_LIBNAME_PATH,mozutils,$(LIBXUL_DIST)/lib) $(MKSHLIB_UNFORCE_ALL)'
+  if test -n "$GNU_CC"; then
+    dnl And we need mozutils symbols to be exported.
+    MOZ_UTILS_PROGRAM_LDFLAGS="$MOZ_UTILS_PROGRAM_LDFLAGS -rdynamic"
+  fi
+fi
+
 if test -z "$MOZ_MEMORY"; then
   case "${target}" in
     *-mingw*)
@@ -7001,6 +7015,7 @@ else
     AC_DEFINE(MOZ_MEMORY_LINUX)
     AC_DEFINE(MOZ_MEMORY_ANDROID)
     _WRAP_MALLOC=1
+    MOZ_UTILS_LDFLAGS=
     ;;
   *-*linux*)
     AC_DEFINE(MOZ_MEMORY_LINUX)
@@ -7022,14 +7037,12 @@ else
     WIN32_CRTDLL_FULLPATH=`lib -nologo -list $WIN32_CRT_LIBS | grep crtdll\\.obj`
     lib -NOLOGO -OUT:crtdll.obj $WIN32_CRT_LIBS -EXTRACT:$WIN32_CRTDLL_FULLPATH
     if grep -q '__imp__\{0,1\}free' crtdll.obj; then
-      MOZ_MEMORY_LDFLAGS='-LIBPATH:$(DIST)/lib -NODEFAULTLIB:msvcrt -NODEFAULTLIB:msvcrtd -NODEFAULTLIB:msvcprt -NODEFAULTLIB:msvcprtd -DEFAULTLIB:mozcrt'
-    else
-      MOZ_MEMORY_LDFLAGS='$(DIST)/../memory/jemalloc/jemalloc.lib'
+      MOZ_UTILS_LDFLAGS='-LIBPATH:$(DIST)/lib -NODEFAULTLIB:msvcrt -NODEFAULTLIB:msvcrtd -NODEFAULTLIB:msvcprt -NODEFAULTLIB:msvcprtd -DEFAULTLIB:mozcrt'
     fi
     rm crtdll.obj
 
     dnl Also pass this to NSPR/NSS
-    DLLFLAGS="$DLLFLAGS $MOZ_MEMORY_LDFLAGS"
+    DLLFLAGS="$DLLFLAGS $MOZ_UTILS_LDFLAGS"
     export DLLFLAGS
     ;;
   *)
@@ -7045,7 +7058,8 @@ else
   AC_DEFINE(HAVE_JEMALLOC_MEMALIGN)
 fi # MOZ_MEMORY
 AC_SUBST(MOZ_MEMORY)
-AC_SUBST(MOZ_MEMORY_LDFLAGS)
+AC_SUBST(MOZ_UTILS_LDFLAGS)
+AC_SUBST(MOZ_UTILS_PROGRAM_LDFLAGS)
 AC_SUBST(WIN32_CRT_LIBS)
 dnl Need to set this for make because NSS doesn't have configure
 AC_SUBST(DLLFLAGS)
@@ -8454,7 +8468,6 @@ AC_SUBST(USE_ELF_DYNSTR_GC)
 AC_SUBST(USE_ELF_HACK)
 AC_SUBST(INCREMENTAL_LINKER)
 AC_SUBST(MOZ_COMPONENTS_VERSION_SCRIPT_LDFLAGS)
-AC_SUBST(MOZ_JEMALLOC_STANDALONE_GLUE_LDOPTS)
 AC_SUBST(MOZ_COMPONENT_NSPR_LIBS)
 
 AC_SUBST(MOZ_FIX_LINK_PATHS)
@@ -9028,8 +9041,11 @@ ac_configure_args="$ac_configure_args --prefix=$dist"
 ac_configure_args="$ac_configure_args --with-sync-build-files=$_topsrcdir"
 if test "$MOZ_MEMORY"; then
    ac_configure_args="$ac_configure_args --enable-jemalloc"
-   if test -n "$MOZ_MEMORY_LDFLAGS"; then
-     export MOZ_MEMORY_LDFLAGS
+   if test -n "$MOZ_UTILS_LDFLAGS"; then
+     export MOZ_UTILS_LDFLAGS
+   fi
+   if test -n "$MOZ_UTILS_PROGRAM_LDFLAGS"; then
+     export MOZ_UTILS_PROGRAM_LDFLAGS
    fi
 fi
 export MOZ_APP_NAME
diff --git a/ipc/app/Makefile.in b/ipc/app/Makefile.in
index bc1833b39bb6..c7ac94bdf0c2 100644
--- a/ipc/app/Makefile.in
+++ b/ipc/app/Makefile.in
@@ -90,10 +90,6 @@ OS_LIBS += $(call EXPAND_LIBNAME,comctl32 comdlg32 uuid shell32 ole32 oleaut32 v
 OS_LIBS += $(call EXPAND_LIBNAME,usp10 msimg32)
 endif
 
-ifneq (Android,$(OS_TARGET))
-LIBS += $(JEMALLOC_LIBS)
-endif
-
 include $(topsrcdir)/config/rules.mk
 
 ifeq ($(OS_ARCH),WINNT)
diff --git a/js/src/Makefile.in b/js/src/Makefile.in
index 8ce5acd3e866..80806b254c35 100644
--- a/js/src/Makefile.in
+++ b/js/src/Makefile.in
@@ -826,12 +826,6 @@ EXTRA_LIBS	+= -lposix4 -ldl -lnsl -lsocket
 endif
 endif
 
-ifdef MOZ_MEMORY
-ifeq ($(OS_ARCH),Darwin)
-LDFLAGS += -ljemalloc
-endif
-endif
-
 ifdef SOLARIS_SUNPRO_CXX
 ifeq ($(TARGET_CPU),sparc)
 # Sun Studio SPARC doesn't work well with gcc inline asm, use lock_SunOS_sparc*.il
diff --git a/js/src/config/autoconf.mk.in b/js/src/config/autoconf.mk.in
index a719c93c3e1f..6eb14b482455 100644
--- a/js/src/config/autoconf.mk.in
+++ b/js/src/config/autoconf.mk.in
@@ -319,7 +319,8 @@ MOZ_BROWSE_INFO	= @MOZ_BROWSE_INFO@
 MOZ_TOOLS_DIR	= @MOZ_TOOLS_DIR@
 MOZ_QUANTIFY	= @MOZ_QUANTIFY@
 MSMANIFEST_TOOL = @MSMANIFEST_TOOL@
-MOZ_MEMORY_LDFLAGS = @MOZ_MEMORY_LDFLAGS@
+MOZ_UTILS_LDFLAGS = @MOZ_UTILS_LDFLAGS@
+MOZ_UTILS_PROGRAM_LDFLAGS = @MOZ_UTILS_PROGRAM_LDFLAGS@
 
 # Codesighs tools option, enables win32 mapfiles.
 MOZ_MAPINFO	= @MOZ_MAPINFO@
diff --git a/js/src/config/config.mk b/js/src/config/config.mk
index 54c03ed8e989..162cdaec2a7d 100644
--- a/js/src/config/config.mk
+++ b/js/src/config/config.mk
@@ -149,17 +149,6 @@ FINAL_LINK_COMP_NAMES = $(DEPTH)/config/final-link-comp-names
 MOZ_UNICHARUTIL_LIBS = $(LIBXUL_DIST)/lib/$(LIB_PREFIX)unicharutil_s.$(LIB_SUFFIX)
 MOZ_WIDGET_SUPPORT_LIBS    = $(DIST)/lib/$(LIB_PREFIX)widgetsupport_s.$(LIB_SUFFIX)
 
-ifdef MOZ_MEMORY
-ifneq ($(OS_ARCH),WINNT)
-JEMALLOC_LIBS = $(MKSHLIB_FORCE_ALL) $(call EXPAND_MOZLIBNAME,jemalloc) $(MKSHLIB_UNFORCE_ALL)
-# If we are linking jemalloc into a program, we want the jemalloc symbols
-# to be exported
-ifneq (,$(SIMPLE_PROGRAMS)$(PROGRAM))
-JEMALLOC_LIBS += $(MOZ_JEMALLOC_STANDALONE_GLUE_LDOPTS)
-endif
-endif
-endif
-
 CC := $(CC_WRAPPER) $(CC)
 CXX := $(CXX_WRAPPER) $(CXX)
 MKDIR ?= mkdir
@@ -247,13 +236,17 @@ endif # MOZ_DEBUG
 # We don't build a static CRT when building a custom CRT,
 # it appears to be broken. So don't link to jemalloc if
 # the Makefile wants static CRT linking.
-ifeq ($(MOZ_MEMORY)_$(USE_STATIC_LIBS),1_)
+ifeq ($(MOZ_MEMORY)_$(USE_STATIC_LIBS),1_1)
 # Disable default CRT libs and add the right lib path for the linker
-OS_LDFLAGS += $(MOZ_MEMORY_LDFLAGS)
+MOZ_UTILS_LDFLAGS=
 endif
 
 endif # WINNT && !GNU_CC
 
+ifndef MOZ_UTILS_PROGRAM_LDFLAGS
+MOZ_UTILS_PROGRAM_LDFLAGS=$(MOZ_UTILS_LDFLAGS)
+endif
+
 #
 # Build using PIC by default
 #
diff --git a/js/src/config/rules.mk b/js/src/config/rules.mk
index 726368514ecf..33339b221f8e 100644
--- a/js/src/config/rules.mk
+++ b/js/src/config/rules.mk
@@ -250,12 +250,12 @@ endif # ENABLE_TESTS
 
 ifndef LIBRARY
 ifdef STATIC_LIBRARY_NAME
-_LIBRARY		:= $(LIB_PREFIX)$(STATIC_LIBRARY_NAME).$(LIB_SUFFIX)
+REAL_LIBRARY		:= $(LIB_PREFIX)$(STATIC_LIBRARY_NAME).$(LIB_SUFFIX)
 # Only build actual library if it is installed in DIST/lib or SDK
 ifeq (,$(SDK_LIBRARY)$(DIST_INSTALL)$(NO_EXPAND_LIBS))
-LIBRARY			:= $(_LIBRARY).$(LIBS_DESC_SUFFIX)
+LIBRARY			:= $(REAL_LIBRARY).$(LIBS_DESC_SUFFIX)
 else
-LIBRARY			:= $(_LIBRARY) $(_LIBRARY).$(LIBS_DESC_SUFFIX)
+LIBRARY			:= $(REAL_LIBRARY) $(REAL_LIBRARY).$(LIBS_DESC_SUFFIX)
 endif
 endif # STATIC_LIBRARY_NAME
 endif # LIBRARY
@@ -875,7 +875,7 @@ alltags:
 $(PROGRAM): $(PROGOBJS) $(LIBS_DEPS) $(EXTRA_DEPS) $(EXE_DEF_FILE) $(RESFILE) $(GLOBAL_DEPS)
 	@$(RM) $@.manifest
 ifeq (_WINNT,$(GNU_CC)_$(OS_ARCH))
-	$(EXPAND_LD) -NOLOGO -OUT:$@ -PDB:$(LINK_PDBFILE) $(WIN32_EXE_LDFLAGS) $(LDFLAGS) $(PROGOBJS) $(RESFILE) $(LIBS) $(EXTRA_LIBS) $(OS_LIBS)
+	$(EXPAND_LD) -NOLOGO -OUT:$@ -PDB:$(LINK_PDBFILE) $(WIN32_EXE_LDFLAGS) $(LDFLAGS) $(MOZ_UTILS_PROGRAM_LDFLAGS) $(PROGOBJS) $(RESFILE) $(LIBS) $(EXTRA_LIBS) $(OS_LIBS)
 ifdef MSMANIFEST_TOOL
 	@if test -f $@.manifest; then \
 		if test -f "$(srcdir)/$@.manifest"; then \
@@ -897,10 +897,10 @@ ifdef MOZ_PROFILE_GENERATE
 endif
 else # !WINNT || GNU_CC
 ifeq ($(CPP_PROG_LINK),1)
-	$(EXPAND_CCC) -o $@ $(CXXFLAGS) $(PROGOBJS) $(RESFILE) $(WIN32_EXE_LDFLAGS) $(LDFLAGS) $(WRAP_LDFLAGS) $(LIBS_DIR) $(LIBS) $(OS_LIBS) $(EXTRA_LIBS) $(BIN_FLAGS) $(EXE_DEF_FILE)
+	$(EXPAND_CCC) -o $@ $(CXXFLAGS) $(PROGOBJS) $(RESFILE) $(WIN32_EXE_LDFLAGS) $(LDFLAGS) $(WRAP_LDFLAGS) $(MOZ_UTILS_PROGRAM_LDFLAGS) $(LIBS_DIR) $(LIBS) $(OS_LIBS) $(EXTRA_LIBS) $(BIN_FLAGS) $(EXE_DEF_FILE)
 	@$(call CHECK_STDCXX,$@)
 else # ! CPP_PROG_LINK
-	$(EXPAND_CC) -o $@ $(CFLAGS) $(PROGOBJS) $(RESFILE) $(WIN32_EXE_LDFLAGS) $(LDFLAGS) $(WRAP_LDFLAGS) $(LIBS_DIR) $(LIBS) $(OS_LIBS) $(EXTRA_LIBS) $(BIN_FLAGS) $(EXE_DEF_FILE)
+	$(EXPAND_CC) -o $@ $(CFLAGS) $(PROGOBJS) $(RESFILE) $(WIN32_EXE_LDFLAGS) $(LDFLAGS) $(MOZ_UTILS_PROGRAM_LDFLAGS) $(WRAP_LDFLAGS) $(LIBS_DIR) $(LIBS) $(OS_LIBS) $(EXTRA_LIBS) $(BIN_FLAGS) $(EXE_DEF_FILE)
 endif # CPP_PROG_LINK
 endif # WINNT && !GNU_CC
 
@@ -946,7 +946,7 @@ endif
 #
 $(SIMPLE_PROGRAMS): %$(BIN_SUFFIX): %.$(OBJ_SUFFIX) $(LIBS_DEPS) $(EXTRA_DEPS) $(GLOBAL_DEPS)
 ifeq (_WINNT,$(GNU_CC)_$(OS_ARCH))
-	$(EXPAND_LD) -nologo -out:$@ -pdb:$(LINK_PDBFILE) $< $(WIN32_EXE_LDFLAGS) $(LDFLAGS) $(LIBS) $(EXTRA_LIBS) $(OS_LIBS)
+	$(EXPAND_LD) -nologo -out:$@ -pdb:$(LINK_PDBFILE) $< $(WIN32_EXE_LDFLAGS) $(LDFLAGS) $(MOZ_UTILS_PROGRAM_LDFLAGS) $(LIBS) $(EXTRA_LIBS) $(OS_LIBS)
 ifdef MSMANIFEST_TOOL
 	@if test -f $@.manifest; then \
 		mt.exe -NOLOGO -MANIFEST $@.manifest -OUTPUTRESOURCE:$@\;1; \
@@ -955,10 +955,10 @@ ifdef MSMANIFEST_TOOL
 endif	# MSVC with manifest tool
 else
 ifeq ($(CPP_PROG_LINK),1)
-	$(EXPAND_CCC) $(CXXFLAGS) -o $@ $< $(WIN32_EXE_LDFLAGS) $(LDFLAGS) $(WRAP_LDFLAGS) $(LIBS_DIR) $(LIBS) $(OS_LIBS) $(EXTRA_LIBS) $(BIN_FLAGS)
+	$(EXPAND_CCC) $(CXXFLAGS) -o $@ $< $(WIN32_EXE_LDFLAGS) $(LDFLAGS) $(MOZ_UTILS_PROGRAM_LDFLAGS) $(WRAP_LDFLAGS) $(LIBS_DIR) $(LIBS) $(OS_LIBS) $(EXTRA_LIBS) $(BIN_FLAGS)
 	@$(call CHECK_STDCXX,$@)
 else
-	$(EXPAND_CC) $(CFLAGS) $(OUTOPTION)$@ $< $(WIN32_EXE_LDFLAGS) $(LDFLAGS) $(WRAP_LDFLAGS) $(LIBS_DIR) $(LIBS) $(OS_LIBS) $(EXTRA_LIBS) $(BIN_FLAGS)
+	$(EXPAND_CC) $(CFLAGS) $(OUTOPTION)$@ $< $(WIN32_EXE_LDFLAGS) $(LDFLAGS) $(MOZ_UTILS_PROGRAM_LDFLAGS) $(WRAP_LDFLAGS) $(LIBS_DIR) $(LIBS) $(OS_LIBS) $(EXTRA_LIBS) $(BIN_FLAGS)
 endif # CPP_PROG_LINK
 endif # WINNT && !GNU_CC
 
@@ -1016,6 +1016,8 @@ $(filter %.$(LIB_SUFFIX),$(LIBRARY)): $(OBJS) $(LOBJS) $(SHARED_LIBRARY_LIBS_DEP
 	$(RANLIB) $@
 
 $(filter-out %.$(LIB_SUFFIX),$(LIBRARY)): $(filter %.$(LIB_SUFFIX),$(LIBRARY)) $(OBJS) $(LOBJS) $(SHARED_LIBRARY_LIBS_DEPS) $(EXTRA_DEPS) $(GLOBAL_DEPS)
+# When we only build a library descriptor, blow out any existing library
+	$(if $(filter %.$(LIB_SUFFIX),$(LIBRARY)),,$(RM) $(REAL_LIBRARY) $(EXPORT_LIBRARY:%=%/$(REAL_LIBRARY)))
 	$(EXPAND_LIBS_GEN) $(OBJS) $(LOBJS) $(SHARED_LIBRARY_LIBS) > $@
 
 ifeq ($(OS_ARCH),WINNT)
@@ -1069,10 +1071,10 @@ ifdef DTRACE_LIB_DEPENDENT
 ifndef XP_MACOSX
 	dtrace -G -C -s $(MOZILLA_DTRACE_SRC) -o  $(DTRACE_PROBE_OBJ) $(shell $(EXPAND_LIBS) $(MOZILLA_PROBE_LIBS))
 endif
-	$(EXPAND_MKSHLIB) $(SHLIB_LDSTARTFILE) $(OBJS) $(LOBJS) $(SUB_SHLOBJS) $(DTRACE_PROBE_OBJ) $(MOZILLA_PROBE_LIBS) $(RESFILE) $(LDFLAGS) $(WRAP_LDFLAGS) $(SHARED_LIBRARY_LIBS) $(EXTRA_DSO_LDOPTS) $(OS_LIBS) $(EXTRA_LIBS) $(DEF_FILE) $(SHLIB_LDENDFILE)
+	$(EXPAND_MKSHLIB) $(SHLIB_LDSTARTFILE) $(OBJS) $(LOBJS) $(SUB_SHLOBJS) $(DTRACE_PROBE_OBJ) $(MOZILLA_PROBE_LIBS) $(RESFILE) $(LDFLAGS) $(MOZ_UTILS_LDFLAGS) $(WRAP_LDFLAGS) $(SHARED_LIBRARY_LIBS) $(EXTRA_DSO_LDOPTS) $(OS_LIBS) $(EXTRA_LIBS) $(DEF_FILE) $(SHLIB_LDENDFILE)
 	@$(RM) $(DTRACE_PROBE_OBJ)
 else # ! DTRACE_LIB_DEPENDENT
-	$(EXPAND_MKSHLIB) $(SHLIB_LDSTARTFILE) $(OBJS) $(LOBJS) $(SUB_SHLOBJS) $(RESFILE) $(LDFLAGS) $(WRAP_LDFLAGS) $(SHARED_LIBRARY_LIBS) $(EXTRA_DSO_LDOPTS) $(OS_LIBS) $(EXTRA_LIBS) $(DEF_FILE) $(SHLIB_LDENDFILE)
+	$(EXPAND_MKSHLIB) $(SHLIB_LDSTARTFILE) $(OBJS) $(LOBJS) $(SUB_SHLOBJS) $(RESFILE) $(LDFLAGS) $(MOZ_UTILS_LDFLAGS) $(WRAP_LDFLAGS) $(SHARED_LIBRARY_LIBS) $(EXTRA_DSO_LDOPTS) $(OS_LIBS) $(EXTRA_LIBS) $(DEF_FILE) $(SHLIB_LDENDFILE)
 endif # DTRACE_LIB_DEPENDENT
 	@$(call CHECK_STDCXX,$@)
 
diff --git a/js/src/configure.in b/js/src/configure.in
index aee38e583a6a..7ee0053208bf 100644
--- a/js/src/configure.in
+++ b/js/src/configure.in
@@ -4350,7 +4350,7 @@ if test "$MOZ_MEMORY"; then
     ;;
   *-mingw*)
     AC_DEFINE(MOZ_MEMORY_WINDOWS)
-    # the interesting bits will get passed down in MOZ_MEMORY_LDFLAGS
+    # the interesting bits will get passed down in MOZ_UTILS_LDFLAGS
     ;;
   *)
     AC_MSG_ERROR([--enable-jemalloc not supported on ${target}])
@@ -4365,7 +4365,8 @@ if test "$MOZ_MEMORY"; then
   fi
 fi
 AC_SUBST(MOZ_MEMORY)
-AC_SUBST(MOZ_MEMORY_LDFLAGS)
+AC_SUBST(MOZ_UTILS_LDFLAGS)
+AC_SUBST(MOZ_UTILS_PROGRAM_LDFLAGS)
 
 dnl ========================================================
 dnl = Use malloc wrapper lib
diff --git a/memory/Makefile.in b/memory/Makefile.in
index 408d49f6f515..c61e5cf78346 100644
--- a/memory/Makefile.in
+++ b/memory/Makefile.in
@@ -47,6 +47,7 @@ ifdef MOZ_MEMORY
 DIRS += jemalloc
 endif
 
+DIRS += mozutils
 DIRS += mozalloc
 
 include $(topsrcdir)/config/rules.mk
diff --git a/memory/jemalloc/Makefile.in b/memory/jemalloc/Makefile.in
index a61deb0f53c3..4c572c56c4e2 100644
--- a/memory/jemalloc/Makefile.in
+++ b/memory/jemalloc/Makefile.in
@@ -52,18 +52,7 @@ VISIBILITY_FLAGS=
 CSRCS = jemalloc.c
 EXPORTS = jemalloc.h jemalloc_types.h
 LIBRARY_NAME = jemalloc
-
-ifeq (WINNT,$(OS_TARGET))
-FORCE_SHARED_LIB = 1
-
-MOZ_MEMORY_LDFLAGS = # Don't link against ourselves
-
-DEFFILE = $(srcdir)/jemalloc.def
-
-LDFLAGS += -ENTRY:DllMain
-
-NO_INSTALL_IMPORT_LIBRARY = 1
-else # Not Windows
+FORCE_STATIC_LIB= 1
 
 ifeq ($(OS_ARCH),SunOS)
 ifndef GNU_CC
@@ -71,105 +60,10 @@ MODULE_OPTIMIZE_FLAGS = -xO5
 endif
 endif
 
-# Build jemalloc as a shared lib.  This is mandatory for Darwin, since a library
-# init function is used on that platform.
-ifeq ($(OS_ARCH),Darwin)
-FORCE_SHARED_LIB= 1
-else
-# On Android, we're going to link jemalloc into mozutils, and that only works
-# properly if we only build a fakelib, which won't happen if we DIST_INSTALL
-ifneq ($(OS_TARGET),Android)
-DIST_INSTALL = 1
-endif
-FORCE_STATIC_LIB= 1
-endif
-
+ifeq (Linux,$(OS_TARGET))
 #XXX: PGO on Linux causes problems here
 # See bug 419470
 NO_PROFILE_GUIDED_OPTIMIZE = 1
 endif
 
 include $(topsrcdir)/config/rules.mk
-
-ifeq (Darwin,$(OS_TARGET))
-LDFLAGS += -init _jemalloc_darwin_init
-endif
-
-ifeq (WINNT,$(OS_TARGET))
-# Roll our own custom logic here for the import library
-
-###############################################################################
-#
-# Linking Mozilla itself to jemalloc is not particularly difficult.  To do this
-# we avoid linking directly to the Microsoft-provided CRT import libraries.
-# Instead, we link to our own import library which we generate here.  To
-# replace the CRT's malloc/free/other memory management symbols we export
-# our own versions out of jemalloc.dll.  We then take the import library that
-# the compiler generates for jemalloc.dll and combine it with the MS CRT import
-# libraries.  We put our library on the command line first, and the CRT symbols
-# are discarded in favor of our versions!
-#
-# Unfortunately that was too easy.  The CRT import library is not a standard
-# import library that contains a list of symbols and whatnot.  It also includes
-# object files that are linked into generated programs.  One of these,
-# crtdll.obj is (as one might expect) linked into all DLLs that link against
-# the CRT.  This file does things like run static C++ constructors when the
-# DLL is attached, call DllMain, etc.
-#
-# In the CRT source all malloc/free calls are made to malloc_crt and free_crt.
-# In debug builds these are both defined to malloc_dbg and free_dbg.  In opt
-# builds malloc_crt is an actual function, implemented and exposed from the
-# CRT.  free_crt is, however, defined to be just plain old free.  This works
-# fine inside the CRT where malloc_crt and free operate on the same heap.
-# Outside the CRT malloc_crt is in the CRT's heap, but free is in jemalloc's
-# heap.  This causes much pain at shutdown :-(
-#
-# The obvious solution here is to override malloc_crt too.  Unfortunately,
-# that doesn't work because the CRT expects to be able to call msize on this
-# piece of memory deep inside the CRT, which will fail because it'll call the
-# CRT's msize on a pointer in jemalloc's heap.
-#
-# Our solution to this is quite devious.  We take apart the CRT's import lib
-# and remove the problematic object file.  We then poke at the object file's
-# symbol table and replace '__imp__free' (which means grab free from some
-# other DLL) with '__imp__frex'.  Then we define our own dummy no-op function
-# in jemalloc.dll and export it as frex.  Then we put the CRT import lib
-# back together with the patched crtdll.obj, glue it to the end of jemalloc's
-# import library and link the rest of Mozilla to that.
-#
-# The result?  A binary that uses jemalloc, doesn't crash, and leaks a tiny
-# amount of memory (32 words per DLL in the 2010 CRT) at shutdown.
-#
-###############################################################################
-
-libs:: mozcrt.lib
-	$(INSTALL) $(IFLAGS2) mozcrt.lib $(DIST)/lib
-
-# And finally combine that with the jemalloc import library to get an import
-# library that has our malloc/free/etc and the CRT's everything else
-mozcrt.lib: $(IMPORT_LIBRARY) msvc_modified.lib
-	lib -OUT:$@ $^
-
-# Put the fixed object file back in
-msvc_modified.lib: msvc_removed.lib crtdll_fixed.obj
-	lib -OUT:$@ $^
-
-# Fix the object file
-crtdll_fixed.obj: crtdll.obj
-	$(PYTHON) $(srcdir)/fixcrt.py
-
-# Find the path of crtdll.obj
-CRTDLL_FULLPATH=$(subst \,\\,$(shell lib -list msvc_combined.lib | grep crtdll\\.obj))
-
-# Remove the broken object file, only after we have extracted it
-msvc_removed.lib: msvc_combined.lib crtdll.obj
-	lib -OUT:$@ msvc_combined.lib -REMOVE:$(CRTDLL_FULLPATH)
-
-# Extract the broken object file out of the combined library
-crtdll.obj: msvc_combined.lib
-	lib -OUT:$@ $^ -EXTRACT:$(CRTDLL_FULLPATH)
-
-# Grab both CRT libraries and combine them into one library to simplify things
-msvc_combined.lib:
-	lib -OUT:$@ $(WIN32_CRT_LIBS)
-endif
diff --git a/memory/mozalloc/Makefile.in b/memory/mozalloc/Makefile.in
index a59ad0d957ae..3f8fb942b1ec 100644
--- a/memory/mozalloc/Makefile.in
+++ b/memory/mozalloc/Makefile.in
@@ -54,12 +54,6 @@ LIBRARY_NAME	= mozalloc
 FORCE_SHARED_LIB= 1
 DIST_INSTALL 	= 1
 
-ifdef MOZ_MEMORY
-ifeq ($(OS_ARCH),Darwin)
-EXTRA_DSO_LDOPTS += -L$(DIST)/lib -ljemalloc
-endif
-endif
-
 ifeq (,$(filter-out OS2,$(OS_ARCH)))
 # The strndup declaration in string.h is in an ifdef __USE_GNU section
 DEFINES		+= -D_GNU_SOURCE
diff --git a/memory/mozutils/Makefile.in b/memory/mozutils/Makefile.in
new file mode 100644
index 000000000000..30a09c3368b6
--- /dev/null
+++ b/memory/mozutils/Makefile.in
@@ -0,0 +1,175 @@
+#
+# ***** BEGIN LICENSE BLOCK *****
+# Version: MPL 1.1/GPL 2.0/LGPL 2.1
+#
+# The contents of this file are subject to the Mozilla Public License Version
+# 1.1 (the "License"); you may not use this file except in compliance with
+# the License. You may obtain a copy of the License at
+# http://www.mozilla.org/MPL/
+#
+# Software distributed under the License is distributed on an "AS IS" basis,
+# WITHOUT WARRANTY OF ANY KIND, either express or implied. See the License
+# for the specific language governing rights and limitations under the
+# License.
+#
+# The Original Code is mozilla.org code.
+#
+# The Initial Developer of the Original Code is
+# Mozilla Foundation
+# Portions created by the Initial Developer are Copyright (C) 2008
+# the Initial Developer. All Rights Reserved.
+#
+# Contributor(s):
+#  Ted Mielczarek <ted.mielczarek@gmail.com>
+#
+# Alternatively, the contents of this file may be used under the terms of
+# either of the GNU General Public License Version 2 or later (the "GPL"),
+# or the GNU Lesser General Public License Version 2.1 or later (the "LGPL"),
+# in which case the provisions of the GPL or the LGPL are applicable instead
+# of those above. If you wish to allow use of your version of this file only
+# under the terms of either the GPL or the LGPL, and not to allow others to
+# use your version of this file under the terms of the MPL, indicate your
+# decision by deleting the provisions above and replace them with the notice
+# and other provisions required by the GPL or the LGPL. If you do not delete
+# the provisions above, a recipient may use your version of this file under
+# the terms of any one of the MPL, the GPL or the LGPL.
+#
+# ***** END LICENSE BLOCK *****
+
+DEPTH		= ../..
+topsrcdir	= @top_srcdir@
+srcdir		= @srcdir@
+VPATH		= @srcdir@
+
+include $(DEPTH)/config/autoconf.mk
+
+MODULE = mozutils
+LIBRARY_NAME = mozutils
+DIST_INSTALL = 1
+
+ifdef MOZ_MEMORY
+SHARED_LIBRARY_LIBS = $(call EXPAND_LIBNAME_PATH,jemalloc,../jemalloc)
+else
+# Temporary, until bug 662814 lands
+VISIBILITY_FLAGS =
+CPPSRCS = dummy.cpp
+endif
+ 
+# Build mozutils as a shared lib on Windows, OSX and Android.
+ifneq (,$(filter WINNT Darwin Android,$(OS_TARGET)))
+FORCE_SHARED_LIB = 1
+else
+FORCE_STATIC_LIB = 1
+endif
+
+MOZ_UTILS_LDFLAGS = # Don't link against ourselves
+
+ifeq (WINNT,$(OS_TARGET))
+DEFFILE = mozutils.def
+
+mozutils.def: mozutils.def.in
+	$(PYTHON) $(topsrcdir)/config/Preprocessor.py $(ACDEFINES) $< > $@
+
+GARBAGE += mozutils.def
+
+LDFLAGS += -ENTRY:DllMain
+
+ifneq (,$(filter -DEFAULTLIB:mozcrt,$(MOZ_UTILS_LDFLAGS)))
+# Don't install the import library if we use mozcrt
+NO_INSTALL_IMPORT_LIBRARY = 1
+endif
+endif
+
+ifeq (Android, $(OS_TARGET))
+# Add Android linker
+EXTRA_DSO_LDOPTS += $(ZLIB_LIBS)
+SHARED_LIBRARY_LIBS += $(call EXPAND_LIBNAME_PATH,android,$(DEPTH)/other-licenses/android)
+WRAP_LDFLAGS =
+endif
+
+include $(topsrcdir)/config/rules.mk
+
+ifdef MOZ_MEMORY
+ifeq (Darwin,$(OS_TARGET))
+LDFLAGS += -init _jemalloc_darwin_init
+endif
+
+ifeq (WINNT,$(OS_TARGET))
+# Roll our own custom logic here for the import library
+
+###############################################################################
+#
+# Linking Mozilla itself to jemalloc is not particularly difficult.  To do this
+# we avoid linking directly to the Microsoft-provided CRT import libraries.
+# Instead, we link to our own import library which we generate here.  To
+# replace the CRT's malloc/free/other memory management symbols we export
+# our own versions out of jemalloc.dll.  We then take the import library that
+# the compiler generates for jemalloc.dll and combine it with the MS CRT import
+# libraries.  We put our library on the command line first, and the CRT symbols
+# are discarded in favor of our versions!
+#
+# Unfortunately that was too easy.  The CRT import library is not a standard
+# import library that contains a list of symbols and whatnot.  It also includes
+# object files that are linked into generated programs.  One of these,
+# crtdll.obj is (as one might expect) linked into all DLLs that link against
+# the CRT.  This file does things like run static C++ constructors when the
+# DLL is attached, call DllMain, etc.
+#
+# In the CRT source all malloc/free calls are made to malloc_crt and free_crt.
+# In debug builds these are both defined to malloc_dbg and free_dbg.  In opt
+# builds malloc_crt is an actual function, implemented and exposed from the
+# CRT.  free_crt is, however, defined to be just plain old free.  This works
+# fine inside the CRT where malloc_crt and free operate on the same heap.
+# Outside the CRT malloc_crt is in the CRT's heap, but free is in jemalloc's
+# heap.  This causes much pain at shutdown :-(
+#
+# The obvious solution here is to override malloc_crt too.  Unfortunately,
+# that doesn't work because the CRT expects to be able to call msize on this
+# piece of memory deep inside the CRT, which will fail because it'll call the
+# CRT's msize on a pointer in jemalloc's heap.
+#
+# Our solution to this is quite devious.  We take apart the CRT's import lib
+# and remove the problematic object file.  We then poke at the object file's
+# symbol table and replace '__imp__free' (which means grab free from some
+# other DLL) with '__imp__frex'.  Then we define our own dummy no-op function
+# in jemalloc.dll and export it as frex.  Then we put the CRT import lib
+# back together with the patched crtdll.obj, glue it to the end of jemalloc's
+# import library and link the rest of Mozilla to that.
+#
+# The result?  A binary that uses jemalloc, doesn't crash, and leaks a tiny
+# amount of memory (32 words per DLL in the 2010 CRT) at shutdown.
+#
+###############################################################################
+
+libs:: mozcrt.lib
+	$(INSTALL) $(IFLAGS2) mozcrt.lib $(DIST)/lib
+
+# And finally combine that with the jemalloc import library to get an import
+# library that has our malloc/free/etc and the CRT's everything else
+mozcrt.lib: $(IMPORT_LIBRARY) msvc_modified.lib
+	lib -OUT:$@ $^
+
+# Put the fixed object file back in
+msvc_modified.lib: msvc_removed.lib crtdll_fixed.obj
+	lib -OUT:$@ $^
+
+# Fix the object file
+crtdll_fixed.obj: crtdll.obj
+	$(PYTHON) $(srcdir)/fixcrt.py
+
+# Find the path of crtdll.obj
+CRTDLL_FULLPATH=$(subst \,\\,$(shell lib -list msvc_combined.lib | grep crtdll\\.obj))
+
+# Remove the broken object file, only after we have extracted it
+msvc_removed.lib: msvc_combined.lib crtdll.obj
+	lib -OUT:$@ msvc_combined.lib -REMOVE:$(CRTDLL_FULLPATH)
+
+# Extract the broken object file out of the combined library
+crtdll.obj: msvc_combined.lib
+	lib -OUT:$@ $^ -EXTRACT:$(CRTDLL_FULLPATH)
+
+# Grab both CRT libraries and combine them into one library to simplify things
+msvc_combined.lib:
+	lib -OUT:$@ $(WIN32_CRT_LIBS)
+endif
+endif # MOZ_MEMORY
diff --git a/memory/mozutils/dummy.cpp b/memory/mozutils/dummy.cpp
new file mode 100644
index 000000000000..b7196600f307
--- /dev/null
+++ b/memory/mozutils/dummy.cpp
@@ -0,0 +1,2 @@
+void _dummy(void) {
+}
diff --git a/memory/jemalloc/fixcrt.py b/memory/mozutils/fixcrt.py
similarity index 100%
rename from memory/jemalloc/fixcrt.py
rename to memory/mozutils/fixcrt.py
diff --git a/memory/jemalloc/jemalloc.def b/memory/mozutils/mozutils.def.in
similarity index 97%
rename from memory/jemalloc/jemalloc.def
rename to memory/mozutils/mozutils.def.in
index 9193d2df289d..92c71f7e2534 100644
--- a/memory/jemalloc/jemalloc.def
+++ b/memory/mozutils/mozutils.def.in
@@ -33,9 +33,10 @@
 ;
 ; ***** END LICENSE BLOCK *****
 
-LIBRARY jemalloc.dll
+LIBRARY mozutils.dll
 
 EXPORTS
+#ifdef MOZ_MEMORY
   ; symbols that are actually useful
   malloc=je_malloc
   valloc=je_valloc
@@ -53,3 +54,4 @@ EXPORTS
   jemalloc_stats
   ; A hack to work around the CRT (see giant comment in Makefile.in)
   frex=je_dumb_free_thunk
+#endif
diff --git a/mobile/app/Makefile.in b/mobile/app/Makefile.in
index 4c2c272a2116..4f466df38990 100644
--- a/mobile/app/Makefile.in
+++ b/mobile/app/Makefile.in
@@ -60,8 +60,6 @@ LOCAL_INCLUDES += -I$(topsrcdir)/xpcom/build
 DEFINES += -DXPCOM_GLUE
 STL_FLAGS=
 
-LIBS += $(JEMALLOC_LIBS)
-
 LIBS += \
   $(EXTRA_DSO_LIBS) \
   $(XPCOM_STANDALONE_GLUE_LDOPTS) \
diff --git a/mobile/installer/package-manifest.in b/mobile/installer/package-manifest.in
index 464d14220d4c..a9c8c9382078 100644
--- a/mobile/installer/package-manifest.in
+++ b/mobile/installer/package-manifest.in
@@ -47,6 +47,7 @@
 @BINPATH@/@DLL_PREFIX@xpcom@DLL_SUFFIX@
 @BINPATH@/@DLL_PREFIX@nspr4@DLL_SUFFIX@
 @BINPATH@/@DLL_PREFIX@mozalloc@DLL_SUFFIX@
+@BINPATH@/@DLL_PREFIX@mozutils@DLL_SUFFIX@
 #ifdef XP_MACOSX
 @BINPATH@/XUL
 #else
@@ -58,9 +59,6 @@
 @BINPATH@/@MOZ_CHILD_PROCESS_NAME@
 #endif
 #ifdef XP_WIN32
-#ifdef MOZ_MEMORY
-@BINPATH@/jemalloc.dll
-#endif
 #if _MSC_VER == 1400
 @BINPATH@/Microsoft.VC80.CRT.manifest
 @BINPATH@/msvcm80.dll
diff --git a/other-licenses/android/Makefile.in b/other-licenses/android/Makefile.in
index 5e1fd3e22386..181d401e5fe2 100644
--- a/other-licenses/android/Makefile.in
+++ b/other-licenses/android/Makefile.in
@@ -42,10 +42,9 @@ VPATH		= @srcdir@
 
 include $(DEPTH)/config/autoconf.mk
 
-MODULE           = mozutils
-LIBRARY_NAME     = mozutils
-FORCE_SHARED_LIB = 1
-DIST_INSTALL     = 1
+MODULE           = android
+LIBRARY_NAME     = android
+FORCE_STATIC_LIB = 1
 
 DEFINES += \
   -DLINKER_DEBUG=0 \
@@ -72,12 +71,4 @@ CSRCS = \
 
 EXPORTS = APKOpen.h
 
-EXTRA_DSO_LDOPTS += $(ZLIB_LIBS)
-
-ifdef MOZ_MEMORY
-SHARED_LIBRARY_LIBS = $(call EXPAND_LIBNAME_PATH,jemalloc,$(DEPTH)/memory/jemalloc)
-endif
-
-WRAP_LDFLAGS =
-
 include $(topsrcdir)/config/rules.mk
diff --git a/toolkit/library/libxul-rules.mk b/toolkit/library/libxul-rules.mk
index 5335d970862b..e4517595f0c0 100644
--- a/toolkit/library/libxul-rules.mk
+++ b/toolkit/library/libxul-rules.mk
@@ -45,12 +45,6 @@ LOCAL_INCLUDES += \
 
 OS_LIBS += $(LIBICONV)
 
-ifdef MOZ_MEMORY
-ifeq ($(OS_ARCH),Darwin)
-EXTRA_DSO_LDOPTS += -L$(DIST)/lib -ljemalloc
-endif
-endif
-
 DEFINES += \
 	-D_IMPL_NS_COM \
 	-D_IMPL_NS_STRINGAPI \
diff --git a/toolkit/mozapps/installer/packager.mk b/toolkit/mozapps/installer/packager.mk
index bcbbf6e14939..46c8a9c9411a 100644
--- a/toolkit/mozapps/installer/packager.mk
+++ b/toolkit/mozapps/installer/packager.mk
@@ -420,7 +420,7 @@ GENERATE_CACHE = \
   rm startupCache.zip && \
   $(ZIP) -r9m omni.jar jsloader/resource/$(PRECOMPILE_RESOURCE)
 else
-GENERATE_CACHE =
+GENERATE_CACHE = true
 endif
 endif
 
diff --git a/xpcom/idl-parser/typelib.py b/xpcom/idl-parser/typelib.py
index 054097a67169..2a97230e8c43 100644
--- a/xpcom/idl-parser/typelib.py
+++ b/xpcom/idl-parser/typelib.py
@@ -94,7 +94,9 @@ def build_interface(iface, ifaces):
                                         reference=False)
 
         if isinstance(type, xpidl.Array):
-            return xpt.ArrayType(get_type(type.type, calltype), size_is,
+            # NB: For an Array<T> we pass down the iid_is to get the type of T.
+            #     This allows Arrays of InterfaceIs types to work.
+            return xpt.ArrayType(get_type(type.type, calltype, iid_is), size_is,
                                  #XXXkhuey length_is duplicates size_is (bug 677788),
                                  size_is)
 
diff --git a/xpcom/typelib/xpidl/Makefile.in b/xpcom/typelib/xpidl/Makefile.in
index 90d6b2c97a20..a5fe8f59f4a3 100644
--- a/xpcom/typelib/xpidl/Makefile.in
+++ b/xpcom/typelib/xpidl/Makefile.in
@@ -111,11 +111,6 @@ include $(topsrcdir)/config/rules.mk
 
 CFLAGS		+= $(LIBIDL_CFLAGS)
 
-# Do not link to jemalloc
-ifeq ($(OS_ARCH),SunOS)
-SOLARIS_JEMALLOC_LDFLAGS =
-endif
-
 # Compile directly against the static lib, so we can use xpidl during the build
 # without the shared library path being set.
 ifneq (,$(filter WINNT OS2,$(OS_ARCH)))
diff --git a/xulrunner/app/Makefile.in b/xulrunner/app/Makefile.in
index 10ebe166dfef..d8e4184bb484 100644
--- a/xulrunner/app/Makefile.in
+++ b/xulrunner/app/Makefile.in
@@ -130,8 +130,6 @@ endif
 RCFLAGS += -DXULRUNNER_ICO=\"$(DIST)/branding/xulrunner.ico\" -DDOCUMENT_ICO=\"$(DIST)/branding/document.ico\"
 endif
 
-LIBS += $(JEMALLOC_LIBS)
-
 include $(topsrcdir)/config/rules.mk
 
 DEFINES += -DXULRUNNER_ICO=\"$(DIST)/branding/xulrunner.ico\" -DDOCUMENT_ICO=\"$(DIST)/branding/document.ico\"
diff --git a/xulrunner/stub/Makefile.in b/xulrunner/stub/Makefile.in
index 37ac92efbc43..5ca03f5acd26 100644
--- a/xulrunner/stub/Makefile.in
+++ b/xulrunner/stub/Makefile.in
@@ -97,8 +97,6 @@ ifdef _MSC_VER
 WIN32_EXE_LDFLAGS += -ENTRY:wmainCRTStartup
 endif
 
-LIBS += $(JEMALLOC_LIBS)
-
 include $(topsrcdir)/config/rules.mk
 
 ifeq ($(OS_ARCH),WINNT)

From 6d74d004209fa1cbcd1ea57d7439e6a27283f150 Mon Sep 17 00:00:00 2001
From: Matheus Kerschbaum <matjk7@gmail.com>
Date: Sun, 4 Sep 2011 10:41:02 +0100
Subject: [PATCH 035/209] Bug 683874 - Remove modules/libimg/makefile from
 toolkit-makefiles.sh r=ted

---
 toolkit/toolkit-makefiles.sh | 5 -----
 1 file changed, 5 deletions(-)

diff --git a/toolkit/toolkit-makefiles.sh b/toolkit/toolkit-makefiles.sh
index bca73a232d5d..54869535b5ba 100644
--- a/toolkit/toolkit-makefiles.sh
+++ b/toolkit/toolkit-makefiles.sh
@@ -290,10 +290,6 @@ MAKEFILES_layout="
   layout/xul/base/src/tree/public/Makefile
 "
 
-MAKEFILES_libimg="
-  modules/libimg/Makefile
-"
-
 MAKEFILES_libjar="
   modules/libjar/Makefile
   modules/libjar/test/Makefile
@@ -759,7 +755,6 @@ add_makefiles "
   $MAKEFILES_jsductwork
   $MAKEFILES_content
   $MAKEFILES_layout
-  $MAKEFILES_libimg
   $MAKEFILES_libjar
   $MAKEFILES_libreg
   $MAKEFILES_libpref

From 95d53226f709461ab68dd5b3c9ec84cd208d3684 Mon Sep 17 00:00:00 2001
From: Mike Hommey <mh+mozilla@glandium.org>
Date: Tue, 6 Sep 2011 08:19:37 +0200
Subject: [PATCH 036/209] Bug 683441 - Always sign NSS libraries from
 packager.mk. r=ted

---
 security/manager/Makefile.in          | 61 ++-------------------------
 toolkit/mozapps/installer/packager.mk | 11 +----
 2 files changed, 6 insertions(+), 66 deletions(-)

diff --git a/security/manager/Makefile.in b/security/manager/Makefile.in
index 1a3b7daad8cf..9efe0c8a655d 100644
--- a/security/manager/Makefile.in
+++ b/security/manager/Makefile.in
@@ -57,14 +57,11 @@ NSSUTIL3_LIB = $(DLL_PREFIX)nssutil3$(DLL_SUFFIX)
 SMIME3_LIB = $(DLL_PREFIX)smime3$(DLL_SUFFIX)
 SSL3_LIB =  $(DLL_PREFIX)ssl3$(DLL_SUFFIX)
 SOFTOKEN3_LIB = $(DLL_PREFIX)softokn3$(DLL_SUFFIX)
-SOFTOKEN3_CHK = $(DLL_PREFIX)softokn3.chk
 
 ifndef NSS_DISABLE_DBM
 NSSDBM3_LIB = $(DLL_PREFIX)nssdbm3$(DLL_SUFFIX)
-NSSDBM3_CHK = $(DLL_PREFIX)nssdbm3.chk
 else
 NSSDBM3_LIB = 
-NSSDBM3_CHK = 
 endif
 
 ifndef MOZ_NATIVE_NSS
@@ -116,23 +113,17 @@ endif
 
 ifdef HAVE_FREEBL_LIBS
 FREEBL_LIB = $(DLL_PREFIX)freebl3$(DLL_SUFFIX)
-FREEBL_CHK = $(DLL_PREFIX)freebl3.chk
 endif
 ifdef HAVE_FREEBL_LIBS_32
 FREEBL_32INT_LIB = libfreebl_32int_3$(DLL_SUFFIX)
-FREEBL_32INT_CHK = libfreebl_32int_3.chk
 FREEBL_32FPU_LIB = libfreebl_32fpu_3$(DLL_SUFFIX)
-FREEBL_32FPU_CHK = libfreebl_32fpu_3.chk
 endif
 ifdef HAVE_FREEBL_LIBS_32INT64
 FREEBL_32INT64_LIB = libfreebl_32int64_3$(DLL_SUFFIX)
-FREEBL_32INT64_CHK = libfreebl_32int64_3.chk
 endif
 ifdef HAVE_FREEBL_LIBS_64
 FREEBL_64INT_LIB = libfreebl_64int_3$(DLL_SUFFIX)
-FREEBL_64INT_CHK = libfreebl_64int_3.chk
 FREEBL_64FPU_LIB = libfreebl_64fpu_3$(DLL_SUFFIX)
-FREEBL_64FPU_CHK = libfreebl_64fpu_3.chk
 endif
 
 ABS_DIST := $(call core_abspath,$(DIST))
@@ -243,6 +234,10 @@ DEFAULT_GMAKE_FLAGS += NSS_ENABLE_ZLIB=
 # Disable building of the test programs in security/nss/lib/zlib
 DEFAULT_GMAKE_FLAGS += PROGRAMS=
 
+# Disable creating .chk files. They will be generated from packager.mk
+# When bug 681624 lands, we can replace CHECKLOC= with SKIP_SHLIBSIGN=1
+DEFAULT_GMAKE_FLAGS += CHECKLOC=
+
 ifdef CROSS_COMPILE
 
 DEFAULT_GMAKE_FLAGS += \
@@ -268,10 +263,6 @@ DEFAULT_GMAKE_FLAGS += \
 	ARCHFLAG="$(CFLAGS) -DCHECK_FORK_GETPID -DRTLD_NOLOAD=0 -DANDROID_VERSION=$(ANDROID_VERSION) -include $(ABS_topsrcdir)/security/manager/android_stub.h" \
 	$(NULL)
 endif
-
-ifndef UNIVERSAL_BINARY
-SKIP_CHK=1
-endif
 endif
 
 ifdef WRAP_LDFLAGS
@@ -327,16 +318,11 @@ ifdef ENABLE_TESTS
 	$(NSSMAKE) -C $(NSS_SRCDIR)/security/nss/cmd/pk12util $(DEFAULT_GMAKE_FLAGS)
 	$(NSSMAKE) -C $(NSS_SRCDIR)/security/nss/cmd/modutil $(DEFAULT_GMAKE_FLAGS)
 endif
-ifndef SKIP_CHK
 ifndef ENABLE_TESTS # Just avoid secondary compile
 	$(NSSMAKE) -C $(NSS_SRCDIR)/security/nss/cmd/lib $(DEFAULT_GMAKE_FLAGS)
 endif
 	$(NSSMAKE) -C $(NSS_SRCDIR)/security/nss/cmd/shlibsign $(DEFAULT_GMAKE_FLAGS)
-endif
 	$(INSTALL) -m 755 $(DIST)/lib/$(LOADABLE_ROOT_MODULE) $(DIST)/bin
-ifndef SKIP_CHK
-	$(INSTALL) -m 644 $(DIST)/lib/$(SOFTOKEN3_CHK) $(DIST)/bin
-endif
 ifeq ($(OS_ARCH), SunOS)
 # has to use copy mode on Solaris, see #665509
 	$(NSINSTALL) -t -m 755 $(DIST)/lib/$(SOFTOKEN3_LIB) $(DIST)/bin
@@ -344,9 +330,6 @@ else
 	$(INSTALL) -m 755 $(DIST)/lib/$(SOFTOKEN3_LIB) $(DIST)/bin
 endif
 ifndef NSS_DISABLE_DBM
-ifndef SKIP_CHK
-	$(INSTALL) -m 644 $(DIST)/lib/$(NSSDBM3_CHK) $(DIST)/bin
-endif
 	$(INSTALL) -m 755 $(DIST)/lib/$(NSSDBM3_LIB) $(DIST)/bin
 endif
 	$(INSTALL) -m 755 $(DIST)/lib/$(NSS3_LIB) $(DIST)/bin
@@ -355,30 +338,16 @@ endif
 	$(INSTALL) -m 755 $(DIST)/lib/$(SMIME3_LIB) $(DIST)/bin
 	$(INSTALL) -m 755 $(SDK_LIBS) $(DIST)/sdk/lib
 ifdef HAVE_FREEBL_LIBS
-ifndef SKIP_CHK
-	$(INSTALL) -m 644 $(DIST)/lib/$(FREEBL_CHK) $(DIST)/bin
-endif
 	$(INSTALL) -m 755 $(DIST)/lib/$(FREEBL_LIB) $(DIST)/bin
 endif
 ifdef HAVE_FREEBL_LIBS_32
-ifndef SKIP_CHK
-	$(INSTALL) -m 644 $(DIST)/lib/$(FREEBL_32INT_CHK) $(DIST)/bin
-	$(INSTALL) -m 644 $(DIST)/lib/$(FREEBL_32FPU_CHK) $(DIST)/bin
-endif
 	$(INSTALL) -m 755 $(DIST)/lib/$(FREEBL_32INT_LIB) $(DIST)/bin
 	$(INSTALL) -m 755 $(DIST)/lib/$(FREEBL_32FPU_LIB) $(DIST)/bin
 endif
 ifdef HAVE_FREEBL_LIBS_32INT64
-ifndef SKIP_CHK
-	$(INSTALL) -m 644 $(DIST)/lib/$(FREEBL_32INT64_CHK) $(DIST)/bin
-endif
 	$(INSTALL) -m 755 $(DIST)/lib/$(FREEBL_32INT64_LIB) $(DIST)/bin
 endif
 ifdef HAVE_FREEBL_LIBS_64
-ifndef SKIP_CHK
-	$(INSTALL) -m 644 $(DIST)/lib/$(FREEBL_64INT_CHK) $(DIST)/bin
-	$(INSTALL) -m 644 $(DIST)/lib/$(FREEBL_64FPU_CHK) $(DIST)/bin
-endif
 	$(INSTALL) -m 755 $(DIST)/lib/$(FREEBL_64INT_LIB) $(DIST)/bin
 	$(INSTALL) -m 755 $(DIST)/lib/$(FREEBL_64FPU_LIB) $(DIST)/bin
 endif
@@ -402,43 +371,23 @@ check::
 install::
 ifndef MOZ_NATIVE_NSS
 	$(SYSINSTALL) -m 755 $(DIST)/lib/$(LOADABLE_ROOT_MODULE) $(DESTDIR)$(mozappdir)
-ifndef SKIP_CHK
-	$(SYSINSTALL) -m 644 $(DIST)/lib/$(SOFTOKEN3_CHK) $(DESTDIR)$(mozappdir)
-endif
 	$(SYSINSTALL) -m 755 $(DIST)/lib/$(SOFTOKEN3_LIB) $(DESTDIR)$(mozappdir)
-ifndef SKIP_CHK
-	$(SYSINSTALL) -m 644 $(DIST)/lib/$(NSSDBM3_CHK) $(DESTDIR)$(mozappdir)
-endif
 	$(SYSINSTALL) -m 755 $(DIST)/lib/$(NSSDBM3_LIB) $(DESTDIR)$(mozappdir)
 	$(SYSINSTALL) -m 755 $(DIST)/lib/$(NSS3_LIB) $(DESTDIR)$(mozappdir)
 	$(SYSINSTALL) -m 755 $(DIST)/lib/$(NSSUTIL3_LIB) $(DESTDIR)$(mozappdir)
 	$(SYSINSTALL) -m 755 $(DIST)/lib/$(SSL3_LIB) $(DESTDIR)$(mozappdir)
 	$(SYSINSTALL) -m 755 $(DIST)/lib/$(SMIME3_LIB) $(DESTDIR)$(mozappdir)
 ifdef HAVE_FREEBL_LIBS
-ifndef SKIP_CHK
-	$(SYSINSTALL) -m 644 $(DIST)/lib/$(FREEBL_CHK) $(DESTDIR)$(mozappdir)
-endif
 	$(SYSINSTALL) -m 755 $(DIST)/lib/$(FREEBL_LIB) $(DESTDIR)$(mozappdir)
 endif
 ifdef HAVE_FREEBL_LIBS_32
-ifndef SKIP_CHK
-	$(SYSINSTALL) -m 644 $(DIST)/lib/$(FREEBL_32INT_CHK) $(DESTDIR)$(mozappdir)
-	$(SYSINSTALL) -m 644 $(DIST)/lib/$(FREEBL_32FPU_CHK) $(DESTDIR)$(mozappdir)
-endif
 	$(SYSINSTALL) -m 755 $(DIST)/lib/$(FREEBL_32INT_LIB) $(DESTDIR)$(mozappdir)
 	$(SYSINSTALL) -m 755 $(DIST)/lib/$(FREEBL_32FPU_LIB) $(DESTDIR)$(mozappdir)
 endif
 ifdef HAVE_FREEBL_LIBS_32INT64
-ifndef SKIP_CHK
-	$(SYSINSTALL) -m 644 $(DIST)/lib/$(FREEBL_32INT64_CHK) $(DESTDIR)$(mozappdir)
-endif
 	$(SYSINSTALL) -m 755 $(DIST)/lib/$(FREEBL_32INT64_LIB) $(DESTDIR)$(mozappdir)
 endif
 ifdef HAVE_FREEBL_LIBS_64
-ifndef SKIP_CHK
-	$(SYSINSTALL) -m 644 $(DIST)/lib/$(FREEBL_64INT_CHK) $(DESTDIR)$(mozappdir)
-	$(SYSINSTALL) -m 644 $(DIST)/lib/$(FREEBL_64FPU_CHK) $(DESTDIR)$(mozappdir)
-endif
 	$(SYSINSTALL) -m 755 $(DIST)/lib/$(FREEBL_64INT_LIB) $(DESTDIR)$(mozappdir)
 	$(SYSINSTALL) -m 755 $(DIST)/lib/$(FREEBL_64FPU_LIB) $(DESTDIR)$(mozappdir)
 endif
@@ -460,8 +409,6 @@ endif
 ifndef MOZ_NATIVE_NSS
 	$(NSSMAKE) -C $(NSS_SRCDIR)/security/coreconf $(DEFAULT_GMAKE_FLAGS) clean
 	$(NSSMAKE) -C $(NSS_SRCDIR)/security/nss/lib $(DEFAULT_GMAKE_FLAGS) clean
-ifndef SKIP_CHK
 	$(NSSMAKE) -C $(NSS_SRCDIR)/security/nss/cmd/lib $(DEFAULT_GMAKE_FLAGS) clean
 	$(NSSMAKE) -C $(NSS_SRCDIR)/security/nss/cmd/shlibsign $(DEFAULT_GMAKE_FLAGS) clean
 endif
-endif
diff --git a/toolkit/mozapps/installer/packager.mk b/toolkit/mozapps/installer/packager.mk
index 46c8a9c9411a..5351343b758d 100644
--- a/toolkit/mozapps/installer/packager.mk
+++ b/toolkit/mozapps/installer/packager.mk
@@ -685,7 +685,6 @@ ifndef PKG_SKIP_STRIP
   ifeq ($(OS_ARCH),OS2)
 		@echo "Stripping package directory..."
 		@cd $(DIST)/$(STAGEPATH)$(MOZ_PKG_DIR) && $(STRIP)
-		$(SIGN_NSS)
   else
 		@echo "Stripping package directory..."
 		@cd $(DIST)/$(STAGEPATH)$(MOZ_PKG_DIR); find . ! -type d \
@@ -711,16 +710,10 @@ ifndef PKG_SKIP_STRIP
 				! -name "*.reg" \
 				$(PLATFORM_EXCLUDE_LIST) \
 				-exec $(STRIP) $(STRIP_FLAGS) {} >/dev/null 2>&1 \;
-		$(SIGN_NSS)
   endif
-else
-ifdef UNIVERSAL_BINARY
-# universal binaries will have had their .chk files removed prior to the unify
-# step, and if they're also --disable-install-strip then they won't get
-# re-signed in the block above.
-	$(SIGN_NSS)
-endif # UNIVERSAL_BINARY
 endif # PKG_SKIP_STRIP
+# We always sign nss because we don't do it from security/manager anymore
+	$(SIGN_NSS)
 	@echo "Removing unpackaged files..."
 ifdef NO_PKG_FILES
 	cd $(DIST)/$(STAGEPATH)$(MOZ_PKG_DIR)$(_BINPATH); rm -rf $(NO_PKG_FILES)

From 094d795c39baba18c76aaca8cdfcc2f3f8d035e8 Mon Sep 17 00:00:00 2001
From: Josh Matthews <josh@joshmatthews.net>
Date: Sun, 4 Sep 2011 12:07:17 -0400
Subject: [PATCH 037/209] Bug 684591 - Fix uninformative xpidl.py warning
 message to print relevant interface name. r=khuey

---
 xpcom/idl-parser/xpidl.py | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/xpcom/idl-parser/xpidl.py b/xpcom/idl-parser/xpidl.py
index ca31b959a4c8..d851b015828e 100644
--- a/xpcom/idl-parser/xpidl.py
+++ b/xpcom/idl-parser/xpidl.py
@@ -520,7 +520,7 @@ class Interface(object):
         parent.setName(self)
         if self.base is None:
             if self.name != 'nsISupports':
-                print >>sys.stderr, IDLError("interface '%s' not derived from nsISupports",
+                print >>sys.stderr, IDLError("interface '%s' not derived from nsISupports" % self.name,
                                              self.location, warning=True)
         else:
             realbase = parent.getName(self.base, self.location)

From 656cca26d16d70b9ebd489fd724d2f3ecaf41152 Mon Sep 17 00:00:00 2001
From: Margaret Leibovic <margaret.leibovic@gmail.com>
Date: Tue, 6 Sep 2011 13:51:11 -0700
Subject: [PATCH 038/209] Bug 655869 - Permissions tab assumes all consumers
 use testPermission. r=gavin

---
 browser/base/content/pageinfo/permissions.js | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/browser/base/content/pageinfo/permissions.js b/browser/base/content/pageinfo/permissions.js
index 9fb551b0c8e2..00d954fb8e56 100644
--- a/browser/base/content/pageinfo/permissions.js
+++ b/browser/base/content/pageinfo/permissions.js
@@ -138,7 +138,9 @@ function initRow(aPartId)
 
   var checkbox = document.getElementById(aPartId + "Def");
   var command  = document.getElementById("cmd_" + aPartId + "Toggle");
-  var perm = permissionManager.testPermission(gPermURI, aPartId);
+  // Geolocation permission consumers use testExactPermission, not testPermission. 
+  var perm = aPartId == "geo" ? permissionManager.testExactPermission(gPermURI, aPartId) :
+                                permissionManager.testPermission(gPermURI, aPartId);
   if (perm) {
     checkbox.checked = false;
     command.removeAttribute("disabled");

From 6815378be737ea1a25910bdcc4b736bf2bc72fd0 Mon Sep 17 00:00:00 2001
From: Matheus Kerschbaum <matjk7@gmail.com>
Date: Wed, 7 Sep 2011 00:14:30 +0100
Subject: [PATCH 039/209] Bug 684155 - Remove MOZ_STATIC_BUILD r=khuey

---
 browser/app/splash.rc      | 35 +----------------------------------
 browser/app/splashos2.rc   | 22 +---------------------
 gfx/thebes/gfxTypes.h      |  4 +---
 xulrunner/app/splash.rc    | 35 +----------------------------------
 xulrunner/app/splashos2.rc | 22 +---------------------
 5 files changed, 5 insertions(+), 113 deletions(-)

diff --git a/browser/app/splash.rc b/browser/app/splash.rc
index 2b5acefce083..f1140c112ca9 100644
--- a/browser/app/splash.rc
+++ b/browser/app/splash.rc
@@ -36,6 +36,7 @@
  * the terms of any one of the MPL, the GPL or the LGPL.
  *
  * ***** END LICENSE BLOCK ***** */
+
 #include <windows.h>
 #include "nsNativeAppSupportWin.h"
 
@@ -49,37 +50,3 @@ STRINGTABLE DISCARDABLE
 BEGIN
     IDS_STARTMENU_APPNAME,              "@MOZ_APP_DISPLAYNAME@"
 END
-
-#ifdef MOZ_STATIC_BUILD
-
-// XXX This code is copied from resource.h and widget.rc.  It's a work-around
-// for the limitation that only one resource file can be used in an .exe.  We
-// should develop a method, for static builds only, to combine multiple .rc
-// files into a single .rc file, and then use that to build the single .res
-// file for the .exe.
-
-#define IDC_GRAB                        4101
-#define IDC_GRABBING                    4102
-#define IDC_CELL                        4103
-#define IDC_COPY                        4104
-#define IDC_ALIAS                       4105
-#define IDC_ZOOMIN                      4106
-#define IDC_ZOOMOUT                     4107
-#define IDC_COLRESIZE                   4108
-#define IDC_ROWRESIZE                   4109
-#define IDC_VERTICALTEXT                4110
-#define IDC_NONE                        4112
-
-IDC_GRAB                CURSOR  DISCARDABLE     "../../widget/src/build/res/grab.cur"
-IDC_GRABBING            CURSOR  DISCARDABLE     "../../widget/src/build/res/grabbing.cur"
-IDC_CELL                CURSOR  DISCARDABLE     "../../widget/src/build/res/cell.cur"
-IDC_COPY                CURSOR  DISCARDABLE     "../../widget/src/build/res/copy.cur"
-IDC_ALIAS               CURSOR  DISCARDABLE     "../../widget/src/build/res/aliasb.cur"
-IDC_ZOOMIN              CURSOR  DISCARDABLE     "../../widget/src/build/res/zoom_in.cur"
-IDC_ZOOMOUT             CURSOR  DISCARDABLE     "../../widget/src/build/res/zoom_out.cur"
-IDC_COLRESIZE           CURSOR  DISCARDABLE     "../../widget/src/build/res/col_resize.cur"
-IDC_ROWRESIZE           CURSOR  DISCARDABLE     "../../widget/src/build/res/row_resize.cur"
-IDC_VERTICALTEXT        CURSOR  DISCARDABLE     "../../widget/src/build/res/vertical_text.cur"
-IDC_NONE                CURSOR  DISCARDABLE     "../../widget/src/build/res/none.cur"
-
-#endif
diff --git a/browser/app/splashos2.rc b/browser/app/splashos2.rc
index e7588320b378..2ce5b8afb1f7 100644
--- a/browser/app/splashos2.rc
+++ b/browser/app/splashos2.rc
@@ -37,6 +37,7 @@
  * the terms of any one of the MPL, the GPL or the LGPL.
  *
  * ***** END LICENSE BLOCK ***** */
+
 #include <os2.h>
 
 // Splash screen dialog ID.
@@ -55,24 +56,3 @@ BEGIN
 END
 
 //BITMAP IDB_SPLASH "splash.bmp"
-
-#ifdef MOZ_STATIC_BUILD
-#include "wdgtos2rc.h"
-
-POINTER IDC_SELECTANCHOR   "..\\..\\widget\\src\\os2\\res\\select.ptr"
-POINTER IDC_GRAB           "..\\..\\widget\\src\\os2\\res\\grab.ptr"
-POINTER IDC_GRABBING       "..\\..\\widget\\src\\os2\\res\\grabbing.ptr"
-POINTER IDC_CELL           "..\\..\\widget\\src\\os2\\res\\cell.ptr"
-POINTER IDC_COPY           "..\\..\\widget\\src\\os2\\res\\copy.ptr"
-POINTER IDC_ALIAS          "..\\..\\widget\\src\\os2\\res\\aliasb.ptr"
-POINTER IDC_ZOOMIN         "..\\..\\widget\\src\\os2\\res\\zoom_in.ptr"
-POINTER IDC_ZOOMOUT        "..\\..\\widget\\src\\os2\\res\\zoom_out.ptr"
-
-POINTER IDC_ARROWWAIT      "..\\..\\widget\\src\\os2\\res\\arrow_wait.ptr"
-POINTER IDC_CROSS          "..\\..\\widget\\src\\os2\\res\\crosshair.ptr"
-POINTER IDC_HELP           "..\\..\\widget\\src\\os2\\res\\help.ptr"
-POINTER IDC_NONE           "..\\..\\widget\\src\\os2\\res\\none.ptr"
-
-ICON    IDC_DNDURL         "..\\..\\widget\\src\\os2\\res\\dndurl.ico"
-ICON    IDC_DNDTEXT        "..\\..\\widget\\src\\os2\\res\\dndtext.ico"
-#endif
diff --git a/gfx/thebes/gfxTypes.h b/gfx/thebes/gfxTypes.h
index 8894bcfc9e2b..2563ab71fa2d 100644
--- a/gfx/thebes/gfxTypes.h
+++ b/gfx/thebes/gfxTypes.h
@@ -47,9 +47,7 @@
  */
 typedef double gfxFloat;
 
-#if defined(MOZ_STATIC_BUILD)
-# define THEBES_API
-#elif defined(IMPL_THEBES)
+#if defined(IMPL_THEBES)
 # define THEBES_API NS_EXPORT
 #else
 # define THEBES_API NS_IMPORT
diff --git a/xulrunner/app/splash.rc b/xulrunner/app/splash.rc
index 3174607dab88..495228b7d110 100644
--- a/xulrunner/app/splash.rc
+++ b/xulrunner/app/splash.rc
@@ -36,6 +36,7 @@
  * the terms of any one of the MPL, the GPL or the LGPL.
  *
  * ***** END LICENSE BLOCK ***** */
+
 #include <windows.h>
 #include "nsNativeAppSupportWin.h"
 
@@ -53,37 +54,3 @@ BEGIN
     IDS_STARTMENU_APPNAME,              "Firefox"
 #endif
 END
-
-#ifdef MOZ_STATIC_BUILD
-
-// XXX This code is copied from resource.h and widget.rc.  It's a work-around
-// for the limitation that only one resource file can be used in an .exe.  We
-// should develop a method, for static builds only, to combine multiple .rc
-// files into a single .rc file, and then use that to build the single .res
-// file for the .exe.
-
-#define IDC_GRAB                        4101
-#define IDC_GRABBING                    4102
-#define IDC_CELL                        4103
-#define IDC_COPY                        4104
-#define IDC_ALIAS                       4105
-#define IDC_ZOOMIN                      4106
-#define IDC_ZOOMOUT                     4107
-#define IDC_COLRESIZE                   4108
-#define IDC_ROWRESIZE                   4109
-#define IDC_VERTICALTEXT                4110
-#define IDC_NONE                        4112
-
-IDC_GRAB                CURSOR  DISCARDABLE     "..\\..\\widget\\src\\build\\res\\grab.cur"
-IDC_GRABBING            CURSOR  DISCARDABLE     "..\\..\\widget\\src\\build\\res\\grabbing.cur"
-IDC_CELL                CURSOR  DISCARDABLE     "..\\..\\widget\\src\\build\\res\\cell.cur"
-IDC_COPY                CURSOR  DISCARDABLE     "..\\..\\widget\\src\\build\\res\\copy.cur"
-IDC_ALIAS               CURSOR  DISCARDABLE     "..\\..\\widget\\src\\build\\res\\aliasb.cur"
-IDC_ZOOMIN              CURSOR  DISCARDABLE     "..\\..\\widget\\src\\build\\res\\zoom_in.cur"
-IDC_ZOOMOUT             CURSOR  DISCARDABLE     "..\\..\\widget\\src\\build\\res\\zoom_out.cur"
-IDC_COLRESIZE           CURSOR  DISCARDABLE     "..\\..\\widget\\src\\build\\res\\col_resize.cur"
-IDC_ROWRESIZE           CURSOR  DISCARDABLE     "..\\..\\widget\\src\\build\\res\\row_resize.cur"
-IDC_VERTICALTEXT        CURSOR  DISCARDABLE     "..\\..\\widget\\src\\build\\res\\vertical_text.cur"
-IDC_NONE                CURSOR  DISCARDABLE     "..\\..\\widget\\src\\build\\res\\none.cur"
-
-#endif
diff --git a/xulrunner/app/splashos2.rc b/xulrunner/app/splashos2.rc
index bbeb1e435789..4c08dc41c0df 100644
--- a/xulrunner/app/splashos2.rc
+++ b/xulrunner/app/splashos2.rc
@@ -37,6 +37,7 @@
  * the terms of any one of the MPL, the GPL or the LGPL.
  *
  * ***** END LICENSE BLOCK ***** */
+
 #include <os2.h>
 
 // Splash screen dialog ID.
@@ -55,24 +56,3 @@ BEGIN
 END
 
 //BITMAP IDB_SPLASH "splash.bmp"
-
-#ifdef MOZ_STATIC_BUILD
-#include "wdgtos2rc.h"
-
-POINTER IDC_SELECTANCHOR   "..\\..\\widget\\src\\os2\\res\\select.ptr"
-POINTER IDC_GRAB           "..\\..\\widget\\src\\os2\\res\\grab.ptr"
-POINTER IDC_GRABBING       "..\\..\\widget\\src\\os2\\res\\grabbing.ptr"
-POINTER IDC_CELL           "..\\..\\widget\\src\\os2\\res\\cell.ptr"
-POINTER IDC_COPY           "..\\..\\widget\\src\\os2\\res\\copy.ptr"
-POINTER IDC_ALIAS          "..\\..\\widget\\src\\os2\\res\\aliasb.ptr"
-POINTER IDC_ZOOMIN         "..\\..\\widget\\src\\os2\\res\\zoom_in.ptr"
-POINTER IDC_ZOOMOUT        "..\\..\\widget\\src\\os2\\res\\zoom_out.ptr"
-
-POINTER IDC_ARROWWAIT      "..\\..\\widget\\src\\os2\\res\\arrow_wait.ptr"
-POINTER IDC_CROSS          "..\\..\\widget\\src\\os2\\res\\crosshair.ptr"
-POINTER IDC_HELP           "..\\..\\widget\\src\\os2\\res\\help.ptr"
-POINTER IDC_NONE           "..\\..\\widget\\src\\os2\\res\\none.ptr"
-
-ICON    IDC_DNDURL         "..\\..\\widget\\src\\os2\\res\\dndurl.ico"
-ICON    IDC_DNDTEXT        "..\\..\\widget\\src\\os2\\res\\dndtext.ico"
-#endif

From b4774e2695f67f9daba12594100355808653f369 Mon Sep 17 00:00:00 2001
From: Brian Hackett <bhackett1024@gmail.com>
Date: Tue, 6 Sep 2011 22:34:23 -0700
Subject: [PATCH 040/209] PIC for GETPROP and CALLPROP on JSPropertyOp
 properties, bug 557358. r=dvander

---
 js/src/jit-test/tests/jaeger/getter-hook-1.js |  18 ++
 js/src/jit-test/tests/jaeger/getter-hook-2.js |  19 ++
 js/src/jsanalyze.h                            |   9 +-
 js/src/jsinfer.cpp                            |   8 +-
 js/src/jsinterp.cpp                           |   6 +-
 js/src/jsobj.cpp                              |  13 +-
 js/src/jsopcode.cpp                           |   1 -
 js/src/jsopcode.tbl                           |   5 +-
 js/src/jstracer.cpp                           |  13 +-
 js/src/methodjit/BaseAssembler.h              |  37 ++--
 js/src/methodjit/BaseCompiler.h               |  34 +++
 js/src/methodjit/Compiler.cpp                 |  45 ++--
 js/src/methodjit/Compiler.h                   |   7 +-
 js/src/methodjit/InvokeHelpers.cpp            |  26 ++-
 js/src/methodjit/LoopState.cpp                |   3 +-
 js/src/methodjit/MachineRegs.h                |  23 ++
 js/src/methodjit/MethodJIT.cpp                |   6 +
 js/src/methodjit/MethodJIT.h                  |  31 ++-
 js/src/methodjit/MonoIC.cpp                   | 203 +++++++++---------
 js/src/methodjit/MonoIC.h                     |  15 +-
 js/src/methodjit/PolyIC.cpp                   | 154 +++++++++++--
 js/src/methodjit/PolyIC.h                     |   3 +
 js/src/methodjit/Retcon.cpp                   |  95 ++++----
 js/src/methodjit/Retcon.h                     |   2 +-
 js/src/methodjit/StubCalls.cpp                |  11 +-
 25 files changed, 540 insertions(+), 247 deletions(-)
 create mode 100644 js/src/jit-test/tests/jaeger/getter-hook-1.js
 create mode 100644 js/src/jit-test/tests/jaeger/getter-hook-2.js

diff --git a/js/src/jit-test/tests/jaeger/getter-hook-1.js b/js/src/jit-test/tests/jaeger/getter-hook-1.js
new file mode 100644
index 000000000000..29ab9552ebee
--- /dev/null
+++ b/js/src/jit-test/tests/jaeger/getter-hook-1.js
@@ -0,0 +1,18 @@
+// GETPROP PIC with multiple stubs containing getter hooks.
+
+function foo(arr) {
+  for (var i = 0; i < 100; i++)
+    arr[i].caller;
+}
+arr = Object.create(Object.prototype);
+first = Object.create({});
+first.caller = null;
+second = Object.create({});
+second.caller = null;
+for (var i = 0; i < 100; ) {
+  arr[i++] = first;
+  arr[i++] = foo;
+  arr[i++] = second;
+}
+foo.caller;
+foo(arr);
diff --git a/js/src/jit-test/tests/jaeger/getter-hook-2.js b/js/src/jit-test/tests/jaeger/getter-hook-2.js
new file mode 100644
index 000000000000..4361ce1262dc
--- /dev/null
+++ b/js/src/jit-test/tests/jaeger/getter-hook-2.js
@@ -0,0 +1,19 @@
+// PIC on CALLPROP invoking getter hook.
+
+function foo(arr) {
+  for (var i = 0; i < 100; i++)
+    arr[i].caller(false);
+}
+arr = Object.create(Object.prototype);
+first = Object.create({});
+first.caller = bar;
+second = Object.create({});
+second.caller = bar;
+for (var i = 0; i < 100; )
+  arr[i++] = foo;
+foo.caller;
+function bar(x) {
+  if (x)
+    foo(arr);
+}
+bar(true);
diff --git a/js/src/jsanalyze.h b/js/src/jsanalyze.h
index 5570310b3466..01c1a8ef790f 100644
--- a/js/src/jsanalyze.h
+++ b/js/src/jsanalyze.h
@@ -140,6 +140,13 @@ class Bytecode
     /* Call whose result should be monitored. */
     bool monitoredTypesReturn : 1;
 
+    /*
+     * Dynamically observed state about the execution of this opcode. These are
+     * hints about the script for use during compilation.
+     */
+    bool arrayWriteHole: 1;  /* SETELEM which has written to an array hole. */
+    bool accessGetter: 1;    /* Property read on a shape with a getter hook. */
+
     /* Stack depth before this opcode. */
     uint32 stackDepth;
 
@@ -964,7 +971,6 @@ class ScriptAnalysis
     /* Accessors for bytecode information. */
 
     Bytecode& getCode(uint32 offset) {
-        JS_ASSERT(script->compartment()->activeAnalysis);
         JS_ASSERT(offset < script->length);
         JS_ASSERT(codeArray[offset]);
         return *codeArray[offset];
@@ -972,7 +978,6 @@ class ScriptAnalysis
     Bytecode& getCode(const jsbytecode *pc) { return getCode(pc - script->code); }
 
     Bytecode* maybeCode(uint32 offset) {
-        JS_ASSERT(script->compartment()->activeAnalysis);
         JS_ASSERT(offset < script->length);
         return codeArray[offset];
     }
diff --git a/js/src/jsinfer.cpp b/js/src/jsinfer.cpp
index c9503c8a47aa..5e5d6559d882 100644
--- a/js/src/jsinfer.cpp
+++ b/js/src/jsinfer.cpp
@@ -3688,7 +3688,6 @@ ScriptAnalysis::analyzeTypesBytecode(JSContext *cx, unsigned offset,
       }
 
       case JSOP_SETELEM:
-      case JSOP_SETHOLE:
         poppedTypes(pc, 1)->addSetElement(cx, script, pc, poppedTypes(pc, 2), poppedTypes(pc, 0));
         poppedTypes(pc, 0)->addSubset(cx, &pushed[0]);
         break;
@@ -6016,6 +6015,13 @@ TypeScript::Sweep(JSContext *cx, JSScript *script)
 #ifdef JS_METHODJIT
     mjit::ReleaseScriptCode(cx, script);
 #endif
+
+    /*
+     * Use counts for scripts are reset on GC. After discarding code we need to
+     * let it warm back up to get information like which opcodes are setting
+     * array holes or accessing getter properties.
+     */
+    script->resetUseCount();
 }
 
 void
diff --git a/js/src/jsinterp.cpp b/js/src/jsinterp.cpp
index 1f652b0985f9..1c66e7814eb4 100644
--- a/js/src/jsinterp.cpp
+++ b/js/src/jsinterp.cpp
@@ -4080,7 +4080,6 @@ BEGIN_CASE(JSOP_CALLELEM)
 END_CASE(JSOP_CALLELEM)
 
 BEGIN_CASE(JSOP_SETELEM)
-BEGIN_CASE(JSOP_SETHOLE)
 {
     JSObject *obj;
     FETCH_OBJECT(cx, -3, obj);
@@ -4098,12 +4097,13 @@ BEGIN_CASE(JSOP_SETHOLE)
                         break;
                     if ((jsuint)i >= obj->getArrayLength())
                         obj->setArrayLength(cx, i + 1);
-                    *regs.pc = JSOP_SETHOLE;
                 }
                 obj->setDenseArrayElementWithType(cx, i, regs.sp[-1]);
                 goto end_setelem;
             } else {
-                *regs.pc = JSOP_SETHOLE;
+                if (!script->ensureRanBytecode(cx))
+                    goto error;
+                script->analysis()->getCode(regs.pc).arrayWriteHole = true;
             }
         }
     } while (0);
diff --git a/js/src/jsobj.cpp b/js/src/jsobj.cpp
index 5243f995214d..4e1e6e609840 100644
--- a/js/src/jsobj.cpp
+++ b/js/src/jsobj.cpp
@@ -5602,6 +5602,16 @@ js_NativeGetInline(JSContext *cx, JSObject *receiver, JSObject *obj, JSObject *p
         return true;
     }
 
+    jsbytecode *pc;
+    JSScript *script = cx->stack.currentScript(&pc);
+    if (script) {
+        if (!script->ensureRanBytecode(cx))
+            return false;
+        analyze::Bytecode *code = script->analysis()->maybeCode(pc);
+        if (code)
+            code->accessGetter = true;
+    }
+
     sample = cx->runtime->propertyRemovals;
     if (!shape->get(cx, receiver, obj, pobj, vp))
         return false;
@@ -5614,9 +5624,6 @@ js_NativeGetInline(JSContext *cx, JSObject *receiver, JSObject *obj, JSObject *p
         pobj->nativeSetSlot(slot, *vp);
     }
 
-    /* Record values produced by shapes without a default getter. */
-    AddTypePropertyId(cx, obj, shape->propid, *vp);
-
     return true;
 }
 
diff --git a/js/src/jsopcode.cpp b/js/src/jsopcode.cpp
index 99d3855a0006..cf42d8382c7a 100644
--- a/js/src/jsopcode.cpp
+++ b/js/src/jsopcode.cpp
@@ -3967,7 +3967,6 @@ Decompile(SprintStack *ss, jsbytecode *pc, intN nb, JSOp nextop)
                 break;
 
               case JSOP_SETELEM:
-              case JSOP_SETHOLE:
                 rval = POP_STR();
                 op = JSOP_NOP;          /* turn off parens */
                 xval = POP_STR();
diff --git a/js/src/jsopcode.tbl b/js/src/jsopcode.tbl
index cb9c52712e18..a6320ac7bfb4 100644
--- a/js/src/jsopcode.tbl
+++ b/js/src/jsopcode.tbl
@@ -592,8 +592,5 @@ OPDEF(JSOP_UNBRANDTHIS,   229,"unbrandthis",   NULL,  1,  0,  0,  0,  JOF_BYTE)
 
 OPDEF(JSOP_SHARPINIT,     230,"sharpinit",     NULL,  3,  0,  0,  0,  JOF_UINT16|JOF_SHARPSLOT)
 
-/* Substituted for JSOP_SETELEM to indicate opcodes which have written holes in dense arrays. */
-OPDEF(JSOP_SETHOLE,       231, "sethole",      NULL,  1,  3,  1,  3,  JOF_BYTE |JOF_ELEM|JOF_SET|JOF_DETECTING)
-
 /* Pop the stack, convert to a jsid (int or string), and push back. */
-OPDEF(JSOP_TOID,          232, "toid",         NULL,  1,  1,  1,  0,  JOF_BYTE)
+OPDEF(JSOP_TOID,          231, "toid",         NULL,  1,  1,  1,  0,  JOF_BYTE)
diff --git a/js/src/jstracer.cpp b/js/src/jstracer.cpp
index 34fcef2469c4..55adcda5014a 100644
--- a/js/src/jstracer.cpp
+++ b/js/src/jstracer.cpp
@@ -6864,8 +6864,7 @@ LeaveTree(TraceMonitor *tm, TracerState& state, VMSideExit* lr)
              * Since this doesn't re-enter the recorder, the post-state snapshot
              * is invalid. Fix it up here.
              */
-            if ((op == JSOP_SETELEM || op == JSOP_SETHOLE) &&
-                JSOp(regs->pc[JSOP_SETELEM_LENGTH]) == JSOP_POP) {
+            if (op == JSOP_SETELEM && JSOp(regs->pc[JSOP_SETELEM_LENGTH]) == JSOP_POP) {
                 regs->sp -= js_CodeSpec[JSOP_SETELEM].nuses;
                 regs->sp += js_CodeSpec[JSOP_SETELEM].ndefs;
                 regs->pc += JSOP_SETELEM_LENGTH;
@@ -13405,7 +13404,7 @@ TraceRecorder::setElem(int lval_spindex, int idx_spindex, int v_spindex)
     }
 
     jsbytecode* pc = cx->regs().pc;
-    if ((*pc == JSOP_SETELEM || *pc == JSOP_SETHOLE) && pc[JSOP_SETELEM_LENGTH] != JSOP_POP)
+    if (*pc == JSOP_SETELEM && pc[JSOP_SETELEM_LENGTH] != JSOP_POP)
         set(&lval, v_ins);
 
     return ARECORD_CONTINUE;
@@ -13417,12 +13416,6 @@ TraceRecorder::record_JSOP_SETELEM()
     return setElem(-3, -2, -1);
 }
 
-JS_REQUIRES_STACK AbortableRecordingStatus
-TraceRecorder::record_JSOP_SETHOLE()
-{
-    return setElem(-3, -2, -1);
-}
-
 static JSBool FASTCALL
 CheckSameGlobal(JSObject *obj, JSObject *globalObj)
 {
@@ -17050,7 +17043,7 @@ LoopProfile::profileOperation(JSContext* cx, JSOp op)
     if (op == JSOP_NEW)
         increment(OP_NEW);
 
-    if (op == JSOP_GETELEM || op == JSOP_SETELEM || op == JSOP_SETHOLE) {
+    if (op == JSOP_GETELEM || op == JSOP_SETELEM) {
         Value& lval = cx->regs().sp[op == JSOP_GETELEM ? -2 : -3];
         if (lval.isObject() && js_IsTypedArray(&lval.toObject()))
             increment(OP_TYPED_ARRAY);
diff --git a/js/src/methodjit/BaseAssembler.h b/js/src/methodjit/BaseAssembler.h
index 40466df6e07a..1290ef6ca851 100644
--- a/js/src/methodjit/BaseAssembler.h
+++ b/js/src/methodjit/BaseAssembler.h
@@ -125,15 +125,6 @@ class Assembler : public ValueAssembler
         DataLabelPtr label;
     };
 
-    /* Need a temp reg that is not ArgReg1. */
-#if defined(JS_CPU_X86) || defined(JS_CPU_X64)
-    static const RegisterID ClobberInCall = JSC::X86Registers::ecx;
-#elif defined(JS_CPU_ARM)
-    static const RegisterID ClobberInCall = JSC::ARMRegisters::r2;
-#elif defined(JS_CPU_SPARC)
-    static const RegisterID ClobberInCall = JSC::SparcRegisters::l1;
-#endif
-
     /* :TODO: OOM */
     Label startLabel;
     Vector<CallPatch, 64, SystemAllocPolicy> callPatches;
@@ -553,14 +544,14 @@ static const JSC::MacroAssembler::RegisterID JSParamReg_Argc  = JSC::SparcRegist
         }
     }
 
-    void storeArg(uint32 i, Imm32 imm) {
+    void storeArg(uint32 i, ImmPtr imm) {
         JS_ASSERT(callIsAligned);
         RegisterID to;
         if (Registers::regForArg(callConvention, i, &to)) {
             move(imm, to);
             availInCall.takeRegUnchecked(to);
         } else {
-            store32(imm, addressOfArg(i));
+            storePtr(imm, addressOfArg(i));
         }
     }
 
@@ -625,7 +616,7 @@ static const JSC::MacroAssembler::RegisterID JSParamReg_Argc  = JSC::SparcRegist
 
 #undef STUB_CALL_TYPE
 
-    void setupInfallibleVMFrame(int32 frameDepth) {
+    void setupFrameDepth(int32 frameDepth) {
         // |frameDepth < 0| implies ic::SplatApplyArgs has been called which
         // means regs.sp has already been set in the VMFrame.
         if (frameDepth >= 0) {
@@ -633,9 +624,13 @@ static const JSC::MacroAssembler::RegisterID JSParamReg_Argc  = JSC::SparcRegist
             // regs->sp = sp
             addPtr(Imm32(sizeof(StackFrame) + frameDepth * sizeof(jsval)),
                    JSFrameReg,
-                   ClobberInCall);
-            storePtr(ClobberInCall, FrameAddress(offsetof(VMFrame, regs.sp)));
+                   Registers::ClobberInCall);
+            storePtr(Registers::ClobberInCall, FrameAddress(offsetof(VMFrame, regs.sp)));
         }
+    }
+
+    void setupInfallibleVMFrame(int32 frameDepth) {
+        setupFrameDepth(frameDepth);
 
         // The JIT has moved Arg1 already, and we've guaranteed to not clobber
         // it. Move ArgReg0 into place now. setupFallibleVMFrame will not
@@ -664,6 +659,19 @@ static const JSC::MacroAssembler::RegisterID JSParamReg_Argc  = JSC::SparcRegist
         restoreStackBase();
     }
 
+    void setupFallibleABICall(bool inlining, jsbytecode *pc, int32 frameDepth) {
+        setupFrameDepth(frameDepth);
+
+        /* Store fp and pc */
+        storePtr(JSFrameReg, FrameAddress(VMFrame::offsetOfFp));
+        storePtr(ImmPtr(pc), FrameAddress(offsetof(VMFrame, regs.pc)));
+
+        if (inlining) {
+            /* ABI calls cannot be made from inlined frames. */
+            storePtr(ImmPtr(NULL), FrameAddress(VMFrame::offsetOfInlined));
+        }
+    }
+
     void restoreStackBase() {
 #if defined(JS_CPU_X86)
         /*
@@ -867,6 +875,7 @@ static const JSC::MacroAssembler::RegisterID JSParamReg_Argc  = JSC::SparcRegist
                      const js::Shape *shape,
                      RegisterID typeReg, RegisterID dataReg)
     {
+        JS_ASSERT(shape->hasSlot());
         if (shape->isMethod())
             loadValueAsComponents(ObjectValue(shape->methodObject()), typeReg, dataReg);
         else if (obj->isFixedSlot(shape->slot))
diff --git a/js/src/methodjit/BaseCompiler.h b/js/src/methodjit/BaseCompiler.h
index 2f4976e24995..291b6444d0be 100644
--- a/js/src/methodjit/BaseCompiler.h
+++ b/js/src/methodjit/BaseCompiler.h
@@ -175,6 +175,40 @@ class LinkerHelper : public JSC::LinkBuffer
     }
 };
 
+class NativeStubLinker : public LinkerHelper
+{
+  public:
+#ifdef JS_CPU_X64
+    typedef JSC::MacroAssembler::DataLabelPtr FinalJump;
+#else
+    typedef JSC::MacroAssembler::Jump FinalJump;
+#endif
+
+    NativeStubLinker(Assembler &masm, JITScript *jit, jsbytecode *pc, FinalJump done)
+        : LinkerHelper(masm, JSC::METHOD_CODE), jit(jit), pc(pc), done(done)
+    {}
+
+    bool init(JSContext *cx);
+
+    void patchJump(JSC::CodeLocationLabel target) {
+#ifdef JS_CPU_X64
+        patch(done, target);
+#else
+        link(done, target);
+#endif
+    }
+
+  private:
+    JITScript *jit;
+    jsbytecode *pc;
+    FinalJump done;
+};
+
+bool
+NativeStubEpilogue(VMFrame &f, Assembler &masm, NativeStubLinker::FinalJump *result,
+                   int32 initialFrameDepth, int32 vpOffset,
+                   MaybeRegisterID typeReg, MaybeRegisterID dataReg);
+
 /*
  * On ARM, we periodically flush a constant pool into the instruction stream
  * where constants are found using PC-relative addressing. This is necessary
diff --git a/js/src/methodjit/Compiler.cpp b/js/src/methodjit/Compiler.cpp
index f331e3b30cdc..6908e904d259 100644
--- a/js/src/methodjit/Compiler.cpp
+++ b/js/src/methodjit/Compiler.cpp
@@ -2027,7 +2027,6 @@ mjit::Compiler::generateMethod()
           END_CASE(JSOP_TOID)
 
           BEGIN_CASE(JSOP_SETELEM)
-          BEGIN_CASE(JSOP_SETHOLE)
           {
             jsbytecode *next = &PC[JSOP_SETELEM_LENGTH];
             bool pop = (JSOp(*next) == JSOP_POP && !analysis->jumpTarget(next));
@@ -4447,6 +4446,18 @@ mjit::Compiler::jsop_getprop(JSAtom *atom, JSValueType knownType,
         shapeReg = frame.allocReg();
     }
 
+    /*
+     * If this access has been on a shape with a getter hook, make preparations
+     * so that we can generate a stub to call the hook directly (rather than be
+     * forced to make a stub call). Sync the stack up front and kill all
+     * registers so that PIC stubs can contain calls, and always generate a
+     * type barrier if inference is enabled (known property types do not
+     * reflect properties with getter hooks).
+     */
+    pic.canCallHook = usePropCache && analysis->getCode(PC).accessGetter;
+    if (pic.canCallHook)
+        frame.syncAndKillEverything();
+
     pic.shapeReg = shapeReg;
     pic.atom = atom;
 
@@ -4497,7 +4508,8 @@ mjit::Compiler::jsop_getprop(JSAtom *atom, JSValueType knownType,
 
     pic.objReg = objReg;
     frame.pushRegs(shapeReg, objReg, knownType);
-    BarrierState barrier = testBarrier(pic.shapeReg, pic.objReg);
+    BarrierState barrier = testBarrier(pic.shapeReg, pic.objReg, false, false,
+                                       /* force = */ pic.canCallHook);
 
     stubcc.rejoin(Changes(1));
     pics.append(pic);
@@ -4547,6 +4559,10 @@ mjit::Compiler::jsop_callprop_generic(JSAtom *atom)
     pic.shapeReg = shapeReg;
     pic.atom = atom;
 
+    pic.canCallHook = analysis->getCode(PC).accessGetter;
+    if (pic.canCallHook)
+        frame.syncAndKillEverything();
+
     /*
      * Store the type and object back. Don't bother keeping them in registers,
      * since a sync will be needed for the upcoming call.
@@ -4611,7 +4627,8 @@ mjit::Compiler::jsop_callprop_generic(JSAtom *atom)
     /* Adjust the frame. */
     frame.pop();
     frame.pushRegs(shapeReg, objReg, knownPushedType(0));
-    BarrierState barrier = testBarrier(pic.shapeReg, pic.objReg);
+    BarrierState barrier = testBarrier(pic.shapeReg, pic.objReg, false, false,
+                                       /* force = */ pic.canCallHook);
 
     pushSyncedEntry(1);
 
@@ -4710,6 +4727,10 @@ mjit::Compiler::jsop_callprop_obj(JSAtom *atom)
         objReg = frame.copyDataIntoReg(top);
     }
 
+    pic.canCallHook = analysis->getCode(PC).accessGetter;
+    if (pic.canCallHook)
+        frame.syncAndKillEverything();
+
     /* Guard on shape. */
     masm.loadShape(objReg, shapeReg);
     pic.shapeGuard = masm.label();
@@ -4749,7 +4770,8 @@ mjit::Compiler::jsop_callprop_obj(JSAtom *atom)
      */
     frame.dup();
     frame.storeRegs(-2, shapeReg, objReg, knownPushedType(0));
-    BarrierState barrier = testBarrier(shapeReg, objReg);
+    BarrierState barrier = testBarrier(shapeReg, objReg, false, false,
+                                       /* force = */ pic.canCallHook);
 
     /*
      * Assert correctness of hardcoded offsets.
@@ -7236,11 +7258,6 @@ mjit::Compiler::hasTypeBarriers(jsbytecode *pc)
     if (!cx->typeInferenceEnabled())
         return false;
 
-#if 0
-    /* Stress test. */
-    return js_CodeSpec[*pc].format & JOF_TYPESET;
-#endif
-
     return analysis->typeBarriers(pc) != NULL;
 }
 
@@ -7440,7 +7457,7 @@ mjit::Compiler::addTypeTest(types::TypeSet *types, RegisterID typeReg, RegisterI
 
 mjit::Compiler::BarrierState
 mjit::Compiler::testBarrier(RegisterID typeReg, RegisterID dataReg,
-                            bool testUndefined, bool testReturn)
+                            bool testUndefined, bool testReturn, bool force)
 {
     BarrierState state;
     state.typeReg = typeReg;
@@ -7462,18 +7479,12 @@ mjit::Compiler::testBarrier(RegisterID typeReg, RegisterID dataReg,
         JS_ASSERT(!testUndefined);
         if (!analysis->getCode(PC).monitoredTypesReturn)
             return state;
-    } else if (!hasTypeBarriers(PC)) {
+    } else if (!hasTypeBarriers(PC) && !force) {
         if (testUndefined && !types->hasType(types::Type::UndefinedType()))
             state.jump.setJump(masm.testUndefined(Assembler::Equal, typeReg));
         return state;
     }
 
-#if 0
-    /* Stress test. */
-    state.jump.setJump(masm.testInt32(Assembler::NotEqual, typeReg));
-    return state;
-#endif
-
     types->addFreeze(cx);
 
     /* Cannot have type barriers when the result of the operation is already unknown. */
diff --git a/js/src/methodjit/Compiler.h b/js/src/methodjit/Compiler.h
index 39e0e98c58de..b9823c93447a 100644
--- a/js/src/methodjit/Compiler.h
+++ b/js/src/methodjit/Compiler.h
@@ -184,7 +184,7 @@ class Compiler : public BaseCompiler
     };
 
     struct BaseICInfo {
-        BaseICInfo(JSOp op) : op(op)
+        BaseICInfo(JSOp op) : op(op), canCallHook(false)
         { }
         Label fastPathStart;
         Label fastPathRejoin;
@@ -192,12 +192,14 @@ class Compiler : public BaseCompiler
         Call slowPathCall;
         DataLabelPtr paramAddr;
         JSOp op;
+        bool canCallHook;
 
         void copyTo(ic::BaseIC &to, JSC::LinkBuffer &full, JSC::LinkBuffer &stub) {
             to.fastPathStart = full.locationOf(fastPathStart);
             to.fastPathRejoin = full.locationOf(fastPathRejoin);
             to.slowPathStart = stub.locationOf(slowPathStart);
             to.slowPathCall = stub.locationOf(slowPathCall);
+            to.canCallHook = canCallHook;
             to.op = op;
             JS_ASSERT(to.op == op);
         }
@@ -565,7 +567,8 @@ class Compiler : public BaseCompiler
     BarrierState pushAddressMaybeBarrier(Address address, JSValueType type, bool reuseBase,
                                          bool testUndefined = false);
     BarrierState testBarrier(RegisterID typeReg, RegisterID dataReg,
-                             bool testUndefined = false, bool testReturn = false);
+                             bool testUndefined = false, bool testReturn = false,
+                             bool force = false);
     void finishBarrier(const BarrierState &barrier, RejoinState rejoin, uint32 which);
 
     /* Non-emitting helpers. */
diff --git a/js/src/methodjit/InvokeHelpers.cpp b/js/src/methodjit/InvokeHelpers.cpp
index d45001f21ab0..87401ae5b5b9 100644
--- a/js/src/methodjit/InvokeHelpers.cpp
+++ b/js/src/methodjit/InvokeHelpers.cpp
@@ -1332,21 +1332,37 @@ js_InternalInterpret(void *returnData, void *returnType, void *returnReg, js::VM
         break;
 
       case REJOIN_NATIVE:
-      case REJOIN_NATIVE_LOWERED: {
+      case REJOIN_NATIVE_LOWERED:
+      case REJOIN_NATIVE_GETTER: {
         /*
          * We don't rejoin until after the native stub finishes execution, in
          * which case the return value will be in memory. For lowered natives,
-         * the return value will be in the 'this' value's slot.
+         * the return value will be in the 'this' value's slot. For getters,
+         * the result is at nextsp[0] (see ic::CallProp).
          */
-        if (rejoin == REJOIN_NATIVE_LOWERED)
+        if (rejoin == REJOIN_NATIVE_LOWERED) {
             nextsp[-1] = nextsp[0];
+        } else if (rejoin == REJOIN_NATIVE_GETTER) {
+            if (js_CodeSpec[op].format & JOF_CALLOP) {
+                /*
+                 * If we went through jsop_callprop_obj then the 'this' value
+                 * is still in its original slot and hasn't been shifted yet,
+                 * so fix that now. Yuck.
+                 */
+                if (nextsp[-2].isObject())
+                    nextsp[-1] = nextsp[-2];
+                nextsp[-2] = nextsp[0];
+            } else {
+                nextsp[-1] = nextsp[0];
+            }
+        }
 
         /* Release this reference on the orphaned native stub. */
         RemoveOrphanedNative(cx, fp);
 
         /*
-         * Note: there is no need to monitor the result of the native, the
-         * native stub will always do a type check before finishing.
+         * Note: there is no need to monitor the result of the native, the stub
+         * will always do a type check before finishing.
          */
         f.regs.pc = nextpc;
         break;
diff --git a/js/src/methodjit/LoopState.cpp b/js/src/methodjit/LoopState.cpp
index c14b92ef8686..83fd69810ef7 100644
--- a/js/src/methodjit/LoopState.cpp
+++ b/js/src/methodjit/LoopState.cpp
@@ -1820,7 +1820,6 @@ LoopState::analyzeLoopBody(unsigned frame)
             skipAnalysis = true;
             break;
 
-          case JSOP_SETHOLE:
           case JSOP_SETELEM: {
             SSAValue objValue = analysis->poppedValue(pc, 2);
             SSAValue elemValue = analysis->poppedValue(pc, 1);
@@ -1844,7 +1843,7 @@ LoopState::analyzeLoopBody(unsigned frame)
                     continue;
                 if (!addModifiedProperty(object, JSID_VOID))
                     return;
-                if (op == JSOP_SETHOLE && !addGrowArray(object))
+                if (analysis->getCode(pc).arrayWriteHole && !addGrowArray(object))
                     return;
             }
 
diff --git a/js/src/methodjit/MachineRegs.h b/js/src/methodjit/MachineRegs.h
index 3452c6d95a10..eade312f9f55 100644
--- a/js/src/methodjit/MachineRegs.h
+++ b/js/src/methodjit/MachineRegs.h
@@ -388,6 +388,15 @@ struct Registers {
 # error "Unsupported platform"
 #endif
 
+    /* Temp reg that can be clobbered when setting up a fallible fast or ABI call. */
+#if defined(JS_CPU_X86) || defined(JS_CPU_X64)
+    static const RegisterID ClobberInCall = JSC::X86Registers::ecx;
+#elif defined(JS_CPU_ARM)
+    static const RegisterID ClobberInCall = JSC::ARMRegisters::r2;
+#elif defined(JS_CPU_SPARC)
+    static const RegisterID ClobberInCall = JSC::SparcRegisters::l1;
+#endif
+
     static const uint32 AvailFPRegs = TempFPRegs;
 
     static inline uint32 maskReg(FPRegisterID reg) {
@@ -412,6 +421,20 @@ struct Registers {
         return regs.takeAnyReg().reg();
     }
 
+    /* Get a register which is not live before a normal ABI call with at most four args. */
+    static inline Registers tempCallRegMask() {
+        Registers regs(AvailRegs);
+#ifndef JS_CPU_X86
+        regs.takeReg(ArgReg0);
+        regs.takeReg(ArgReg1);
+        regs.takeReg(ArgReg2);
+#ifdef JS_CPU_SPARC
+        regs.takeReg(ArgReg3);
+#endif
+#endif
+        return regs;
+    }
+
     Registers(uint32 freeMask)
       : freeMask(freeMask)
     { }
diff --git a/js/src/methodjit/MethodJIT.cpp b/js/src/methodjit/MethodJIT.cpp
index 52af165854dc..ce873df03447 100644
--- a/js/src/methodjit/MethodJIT.cpp
+++ b/js/src/methodjit/MethodJIT.cpp
@@ -1115,6 +1115,12 @@ mjit::JITScript::~JITScript()
         (*pExecPool)->release();
     }
 
+    for (unsigned i = 0; i < nativeCallStubs.length(); i++) {
+        JSC::ExecutablePool *pool = nativeCallStubs[i].pool;
+        if (pool)
+            pool->release();
+    }
+
     ic::CallICInfo *callICs_ = callICs();
     for (uint32 i = 0; i < nCallICs; i++) {
         callICs_[i].releasePools();
diff --git a/js/src/methodjit/MethodJIT.h b/js/src/methodjit/MethodJIT.h
index d6a29283ee4d..879aea685c74 100644
--- a/js/src/methodjit/MethodJIT.h
+++ b/js/src/methodjit/MethodJIT.h
@@ -258,10 +258,12 @@ enum RejoinState {
     /*
      * As for REJOIN_FALLTHROUGH, but holds a reference on the compartment's
      * orphaned native pools which needs to be reclaimed by InternalInterpret.
-     * The return value needs to be adjusted if REJOIN_NATIVE_LOWERED.
+     * The return value needs to be adjusted if REJOIN_NATIVE_LOWERED, and
+     * REJOIN_NATIVE_GETTER is for ABI calls made for property accesses.
      */
     REJOIN_NATIVE,
     REJOIN_NATIVE_LOWERED,
+    REJOIN_NATIVE_GETTER,
 
     /*
      * Dummy rejoin stored in VMFrames to indicate they return into a native
@@ -553,6 +555,30 @@ struct PCLengthEntry {
     double          picsLength; /* amount of PIC stub code generated */
 };
 
+/*
+ * Pools and patch locations for managing stubs for non-FASTCALL C++ calls made
+ * from native call and PropertyOp stubs. Ownership of these may be transferred
+ * into the orphanedNativePools for the compartment.
+ */
+struct NativeCallStub {
+    /* PC for the stub. Native call stubs cannot be added for inline frames. */
+    jsbytecode *pc;
+
+    /* Pool for the stub, NULL if it has been removed from the script. */
+    JSC::ExecutablePool *pool;
+
+    /*
+     * Fallthrough jump returning to jitcode which may be patched during
+     * recompilation. On x64 this is an indirect jump to avoid issues with far
+     * jumps on relative branches.
+     */
+#ifdef JS_CPU_X64
+    JSC::CodeLocationDataLabelPtr jump;
+#else
+    JSC::CodeLocationJump jump;
+#endif
+};
+
 struct JITScript {
     typedef JSC::MacroAssemblerCodeRef CodeRef;
     CodeRef         code;       /* pool & code addresses */
@@ -611,6 +637,9 @@ struct JITScript {
     ExecPoolVector execPools;
 #endif
 
+    // Additional ExecutablePools for native call and getter stubs.
+    Vector<NativeCallStub, 0, SystemAllocPolicy> nativeCallStubs;
+
     NativeMapEntry *nmap() const;
     js::mjit::InlineFrame *inlineFrames() const;
     js::mjit::CallSite *callSites() const;
diff --git a/js/src/methodjit/MonoIC.cpp b/js/src/methodjit/MonoIC.cpp
index b28c717ab57b..1a4d11445da8 100644
--- a/js/src/methodjit/MonoIC.cpp
+++ b/js/src/methodjit/MonoIC.cpp
@@ -555,6 +555,101 @@ SlowNewFromIC(VMFrame &f, ic::CallICInfo *ic)
     return NULL;
 }
 
+bool
+NativeStubLinker::init(JSContext *cx)
+{
+    JSC::ExecutablePool *pool = LinkerHelper::init(cx);
+    if (!pool)
+        return false;
+
+    NativeCallStub stub;
+    stub.pc = pc;
+    stub.pool = pool;
+    stub.jump = locationOf(done);
+    if (!jit->nativeCallStubs.append(stub)) {
+        pool->release();
+        return false;
+    }
+
+    return true;
+}
+
+/*
+ * Generate epilogue code to run after a stub ABI call to a native or getter.
+ * This checks for an exception, and either type checks the result against the
+ * observed types for the opcode or loads the result into a register pair
+ * (it will go through a type barrier afterwards).
+ */
+bool
+mjit::NativeStubEpilogue(VMFrame &f, Assembler &masm, NativeStubLinker::FinalJump *result,
+                         int32 initialFrameDepth, int32 vpOffset,
+                         MaybeRegisterID typeReg, MaybeRegisterID dataReg)
+{
+    /* Reload fp, which may have been clobbered by restoreStackBase(). */
+    masm.loadPtr(FrameAddress(VMFrame::offsetOfFp), JSFrameReg);
+
+    Jump hasException = masm.branchTest32(Assembler::Zero, Registers::ReturnReg,
+                                          Registers::ReturnReg);
+
+    Address resultAddress(JSFrameReg, vpOffset);
+
+    Vector<Jump> mismatches(f.cx);
+    if (f.cx->typeInferenceEnabled()) {
+        if (!typeReg.isSet()) {
+            /*
+             * Test the result of this native against the known result type set
+             * for the call. We don't assume knowledge about the types that
+             * natives can return, except when generating specialized paths in
+             * FastBuiltins.
+             */
+            types::TypeSet *types = f.script()->analysis()->bytecodeTypes(f.pc());
+            if (!masm.generateTypeCheck(f.cx, resultAddress, types, &mismatches))
+                THROWV(false);
+        }
+
+        /*
+         * Can no longer trigger recompilation in this stub, clear the stub
+         * rejoin on the VMFrame.
+         */
+        masm.storePtr(ImmPtr(NULL), FrameAddress(offsetof(VMFrame, stubRejoin)));
+    }
+
+    if (typeReg.isSet())
+        masm.loadValueAsComponents(resultAddress, typeReg.reg(), dataReg.reg());
+
+    /*
+     * The final jump is a indirect on x64, so that we'll always be able
+     * to repatch it to the interpoline later.
+     */
+    Label finished = masm.label();
+#ifdef JS_CPU_X64
+    JSC::MacroAssembler::DataLabelPtr done = masm.moveWithPatch(ImmPtr(NULL), Registers::ValueReg);
+    masm.jump(Registers::ValueReg);
+#else
+    Jump done = masm.jump();
+#endif
+
+    /* Generate a call for type check failures on the native result. */
+    if (!mismatches.empty()) {
+        for (unsigned i = 0; i < mismatches.length(); i++)
+            mismatches[i].linkTo(masm.label(), &masm);
+        masm.addPtr(Imm32(vpOffset), JSFrameReg, Registers::ArgReg1);
+        masm.fallibleVMCall(true, JS_FUNC_TO_DATA_PTR(void *, stubs::TypeBarrierReturn),
+                            f.regs.pc, NULL, initialFrameDepth);
+        masm.storePtr(ImmPtr(NULL), FrameAddress(offsetof(VMFrame, stubRejoin)));
+        masm.jump().linkTo(finished, &masm);
+    }
+
+    /* Move JaegerThrowpoline into register for very far jump on x64. */
+    hasException.linkTo(masm.label(), &masm);
+    if (f.cx->typeInferenceEnabled())
+        masm.storePtr(ImmPtr(NULL), FrameAddress(offsetof(VMFrame, stubRejoin)));
+    masm.throwInJIT();
+
+    *result = done;
+    return true;
+}
+
 /*
  * Calls have an inline path and an out-of-line path. The inline path is used
  * in the fastest case: the method has JIT'd code, and |argc == nargs|.
@@ -893,32 +988,12 @@ class CallCompiler : public BaseCompiler
                                 f.regs.pc, NULL, initialFrameDepth);
         }
 
-        Registers tempRegs(Registers::AvailRegs);
-#ifndef JS_CPU_X86
-        tempRegs.takeReg(Registers::ArgReg0);
-        tempRegs.takeReg(Registers::ArgReg1);
-        tempRegs.takeReg(Registers::ArgReg2);
-#endif
+        Registers tempRegs = Registers::tempCallRegMask();
         RegisterID t0 = tempRegs.takeAnyReg().reg();
         masm.bumpStubCounter(f.script(), f.pc(), t0);
 
-        /* Store pc. */
-        masm.storePtr(ImmPtr(f.regs.pc),
-                      FrameAddress(offsetof(VMFrame, regs.pc)));
-
-        /* Store inlined. */
-        masm.storePtr(ImmPtr(f.regs.inlined()),
-                      FrameAddress(VMFrame::offsetOfInlined));
-
-        /* Store sp (if not already set by ic::SplatApplyArgs). */
-        if (ic.frameSize.isStatic()) {
-            uint32 spOffset = sizeof(StackFrame) + initialFrameDepth * sizeof(Value);
-            masm.addPtr(Imm32(spOffset), JSFrameReg, t0);
-            masm.storePtr(t0, FrameAddress(offsetof(VMFrame, regs.sp)));
-        }
-
-        /* Store fp. */
-        masm.storePtr(JSFrameReg, FrameAddress(VMFrame::offsetOfFp));
+        int32 storeFrameDepth = ic.frameSize.isStatic() ? initialFrameDepth : -1;
+        masm.setupFallibleABICall(cx->typeInferenceEnabled(), f.regs.pc, storeFrameDepth);
 
         /* Grab cx. */
 #ifdef JS_CPU_X86
@@ -959,7 +1034,7 @@ class CallCompiler : public BaseCompiler
         masm.setupABICall(Registers::NormalCall, 3);
         masm.storeArg(2, vpReg);
         if (ic.frameSize.isStatic())
-            masm.storeArg(1, Imm32(ic.frameSize.staticArgc()));
+            masm.storeArg(1, ImmPtr((void *) ic.frameSize.staticArgc()));
         else
             masm.storeArg(1, argcReg.reg());
         masm.storeArg(0, cxReg);
@@ -977,83 +1052,21 @@ class CallCompiler : public BaseCompiler
 
         masm.callWithABI(JS_FUNC_TO_DATA_PTR(void *, native), false);
 
-        /* Reload fp, which may have been clobbered by restoreStackBase(). */
-        masm.loadPtr(FrameAddress(VMFrame::offsetOfFp), JSFrameReg);
-
-        Jump hasException = masm.branchTest32(Assembler::Zero, Registers::ReturnReg,
-                                              Registers::ReturnReg);
-
-        Vector<Jump> mismatches(f.cx);
-        if (cx->typeInferenceEnabled()) {
-            types::AutoEnterTypeInference enter(f.cx);
-
-            /*
-             * Test the result of this native against the known result type
-             * set for the call. We don't assume knowledge about the types that
-             * natives can return, except when generating specialized paths in
-             * FastBuiltins. We don't need to record dependencies on the result
-             * type set, as the compiler will already have done so when making
-             * the call IC.
-             */
-            Address address(JSFrameReg, vpOffset);
-            types::TypeSet *types = f.script()->analysis()->bytecodeTypes(f.pc());
-            if (!masm.generateTypeCheck(f.cx, address, types, &mismatches))
-                THROWV(true);
-
-            /*
-             * Can no longer trigger recompilation in this stub, clear the stub
-             * rejoin on the VMFrame.
-             */
-            masm.storePtr(ImmPtr(NULL), FrameAddress(offsetof(VMFrame, stubRejoin)));
-        }
-
-        /*
-         * The final jump is a indirect on x64, so that we'll always be able
-         * to repatch it to the interpoline later.
-         */
-        Label finished = masm.label();
-#ifdef JS_CPU_X64
-        void *slowJoin = ic.slowPathStart.labelAtOffset(ic.slowJoinOffset).executableAddress();
-        DataLabelPtr done = masm.moveWithPatch(ImmPtr(slowJoin), Registers::ValueReg);
-        masm.jump(Registers::ValueReg);
-#else
-        Jump done = masm.jump();
-#endif
-
-        /* Generate a call for type check failures on the native result. */
-        if (!mismatches.empty()) {
-            for (unsigned i = 0; i < mismatches.length(); i++)
-                mismatches[i].linkTo(masm.label(), &masm);
-            masm.addPtr(Imm32(vpOffset), JSFrameReg, Registers::ArgReg1);
-            masm.fallibleVMCall(true, JS_FUNC_TO_DATA_PTR(void *, stubs::TypeBarrierReturn),
-                                f.regs.pc, NULL, initialFrameDepth);
-            masm.storePtr(ImmPtr(NULL), FrameAddress(offsetof(VMFrame, stubRejoin)));
-            masm.jump().linkTo(finished, &masm);
-        }
-
-        /* Move JaegerThrowpoline into register for very far jump on x64. */
-        hasException.linkTo(masm.label(), &masm);
-        if (cx->typeInferenceEnabled())
-            masm.storePtr(ImmPtr(NULL), FrameAddress(offsetof(VMFrame, stubRejoin)));
-        masm.throwInJIT();
-
-        LinkerHelper linker(masm, JSC::METHOD_CODE);
-        JSC::ExecutablePool *ep = poolForSize(linker, CallICInfo::Pool_NativeStub);
-        if (!ep)
+        NativeStubLinker::FinalJump done;
+        if (!NativeStubEpilogue(f, masm, &done, initialFrameDepth, vpOffset, MaybeRegisterID(), MaybeRegisterID()))
+            return false;
+        NativeStubLinker linker(masm, f.jit(), f.regs.pc, done);
+        if (!linker.init(f.cx))
             THROWV(true);
 
-        ic.fastGuardedNative = obj;
-
         if (!linker.verifyRange(jit)) {
             disable(jit);
             return true;
         }
 
-        ic.nativeJump = linker.locationOf(done);
+        linker.patchJump(ic.slowPathStart.labelAtOffset(ic.slowJoinOffset));
 
-#ifndef JS_CPU_X64
-        linker.link(done, ic.slowPathStart.labelAtOffset(ic.slowJoinOffset));
-#endif
+        ic.fastGuardedNative = obj;
 
         linker.link(funGuard, ic.slowPathStart);
         JSC::CodeLocationLabel start = linker.finalize();
@@ -1474,10 +1487,8 @@ JITScript::sweepCallICs(JSContext *cx, bool purgeAll)
             ic.purgeGuardedObject();
         }
 
-        if (nativeDead) {
-            ic.releasePool(CallICInfo::Pool_NativeStub);
+        if (nativeDead)
             ic.fastGuardedNative = NULL;
-        }
 
         if (purgeAll) {
             ic.releasePool(CallICInfo::Pool_ScriptStub);
diff --git a/js/src/methodjit/MonoIC.h b/js/src/methodjit/MonoIC.h
index 7043db8b026e..0133055968db 100644
--- a/js/src/methodjit/MonoIC.h
+++ b/js/src/methodjit/MonoIC.h
@@ -216,7 +216,6 @@ struct CallICInfo {
     enum PoolIndex {
         Pool_ScriptStub,
         Pool_ClosureStub,
-        Pool_NativeStub,
         Total_Pools
     };
 
@@ -240,17 +239,6 @@ struct CallICInfo {
     /* Inline to OOL jump, redirected by stubs. */
     JSC::CodeLocationJump funJump;
 
-    /*
-     * Native stub fallthrough jump which may be patched during recompilation.
-     * On x64 this is an indirect jump to avoid issues with far jumps on
-     * relative branches.
-     */
-#ifdef JS_CPU_X64
-    JSC::CodeLocationDataLabelPtr nativeJump;
-#else
-    JSC::CodeLocationJump nativeJump;
-#endif
-
     /* Offset to inline scripted call, from funGuard. */
     uint32 hotJumpOffset   : 16;
     uint32 joinPointOffset : 16;
@@ -281,13 +269,12 @@ struct CallICInfo {
         fastGuardedNative = NULL;
         hit = false;
         hasJsFunCheck = false;
-        pools[0] = pools[1] = pools[2] = NULL;
+        PodArrayZero(pools);
     }
 
     inline void releasePools() {
         releasePool(Pool_ScriptStub);
         releasePool(Pool_ClosureStub);
-        releasePool(Pool_NativeStub);
     }
 
     inline void releasePool(PoolIndex index) {
diff --git a/js/src/methodjit/PolyIC.cpp b/js/src/methodjit/PolyIC.cpp
index cc4524bd08c9..baeb8ba3424c 100644
--- a/js/src/methodjit/PolyIC.cpp
+++ b/js/src/methodjit/PolyIC.cpp
@@ -149,9 +149,11 @@ class PICStubCompiler : public BaseCompiler
     uint32 gcNumber;
 
   public:
+    bool canCallHook;
+
     PICStubCompiler(const char *type, VMFrame &f, JSScript *script, ic::PICInfo &pic, void *stub)
       : BaseCompiler(f.cx), type(type), f(f), script(script), pic(pic), stub(stub),
-        gcNumber(f.cx->runtime->gcNumber)
+        gcNumber(f.cx->runtime->gcNumber), canCallHook(pic.canCallHook)
     { }
 
     bool isCallOp() const {
@@ -800,10 +802,19 @@ struct GetPropertyHelper {
 
     LookupStatus testForGet() {
         if (!shape->hasDefaultGetter()) {
-            if (!shape->isMethod())
-                return ic.disable(cx, "getter");
-            if (!ic.isCallOp())
-                return ic.disable(cx, "method valued shape");
+            if (shape->isMethod()) {
+                if (!ic.isCallOp())
+                    return ic.disable(cx, "method valued shape");
+            } else {
+                if (shape->hasGetterValue())
+                    return ic.disable(cx, "getter value shape");
+                if (shape->hasSlot() && holder != obj)
+                    return ic.disable(cx, "slotful getter hook through prototype");
+                if (!ic.canCallHook)
+                    return ic.disable(cx, "can't call getter hook");
+                if (f.regs.inlined())
+                    return ic.disable(cx, "hook called from inline frame");
+            }
         } else if (!shape->hasSlot()) {
             return ic.disable(cx, "no slot");
         }
@@ -1001,6 +1012,8 @@ class GetPropCompiler : public PICStubCompiler
             return status;
         if (getprop.obj != getprop.holder)
             return disable("proto walk on String.prototype");
+        if (!getprop.shape->hasDefaultGetterOrIsMethod())
+            return disable("getter hook on String.prototype");
         if (hadGC())
             return Lookup_Uncacheable;
 
@@ -1142,6 +1155,93 @@ class GetPropCompiler : public PICStubCompiler
         return Lookup_Cacheable;
     }
 
+    void generateGetterStub(Assembler &masm, const Shape *shape,
+                            Label start, const Vector<Jump, 8> &shapeMismatches)
+    {
+        /*
+         * Getter hook needs to be called from the stub. The state is fully
+         * synced and no registers are live except the result registers.
+         */
+        JS_ASSERT(pic.canCallHook);
+        PropertyOp getter = shape->getterOp();
+
+        if (cx->typeInferenceEnabled()) {
+            masm.storePtr(ImmPtr((void *) REJOIN_NATIVE_GETTER),
+                          FrameAddress(offsetof(VMFrame, stubRejoin)));
+        }
+
+        Registers tempRegs = Registers::tempCallRegMask();
+        if (tempRegs.hasReg(Registers::ClobberInCall))
+            tempRegs.takeReg(Registers::ClobberInCall);
+
+        /* Get a register to hold obj while we set up the rest of the frame. */
+        RegisterID holdObjReg = pic.objReg;
+        if (tempRegs.hasReg(pic.objReg)) {
+            tempRegs.takeReg(pic.objReg);
+        } else {
+            holdObjReg = tempRegs.takeAnyReg().reg();
+            masm.move(pic.objReg, holdObjReg);
+        }
+
+        RegisterID t0 = tempRegs.takeAnyReg().reg();
+        masm.bumpStubCounter(f.script(), f.pc(), t0);
+
+        /*
+         * Initialize vp, which is either a slot in the object (the holder,
+         * actually, which must equal the object here) or undefined.
+         * Use vp == sp (which for CALLPROP will actually be the original
+         * sp + 1), to avoid clobbering stack values.
+         */
+        int32 vpOffset = (char *) f.regs.sp - (char *) f.fp();
+        if (shape->hasSlot()) {
+            masm.loadObjProp(obj, holdObjReg, shape,
+                             Registers::ClobberInCall, t0);
+            masm.storeValueFromComponents(Registers::ClobberInCall, t0, Address(JSFrameReg, vpOffset));
+        } else {
+            masm.storeValue(UndefinedValue(), Address(JSFrameReg, vpOffset));
+        }
+
+        int32 initialFrameDepth = f.regs.sp - f.fp()->slots();
+        masm.setupFallibleABICall(cx->typeInferenceEnabled(), f.regs.pc, initialFrameDepth);
+
+        /* Grab cx. */
+#ifdef JS_CPU_X86
+        RegisterID cxReg = tempRegs.takeAnyReg().reg();
+#else
+        RegisterID cxReg = Registers::ArgReg0;
+#endif
+        masm.loadPtr(FrameAddress(offsetof(VMFrame, cx)), cxReg);
+
+        /* Grap vp. */
+        RegisterID vpReg = t0;
+        masm.addPtr(Imm32(vpOffset), JSFrameReg, vpReg);
+
+        masm.restoreStackBase();
+        masm.setupABICall(Registers::NormalCall, 4);
+        masm.storeArg(3, vpReg);
+        masm.storeArg(2, ImmPtr((void *) JSID_BITS(shape->propid)));
+        masm.storeArg(1, holdObjReg);
+        masm.storeArg(0, cxReg);
+
+        masm.callWithABI(JS_FUNC_TO_DATA_PTR(void *, getter), false);
+
+        NativeStubLinker::FinalJump done;
+        if (!NativeStubEpilogue(f, masm, &done, 0, vpOffset, pic.shapeReg, pic.objReg))
+            return;
+        NativeStubLinker linker(masm, f.jit(), f.regs.pc, done);
+        if (!linker.init(f.cx))
+            THROW();
+
+        if (!linker.verifyRange(f.jit())) {
+            disable("code memory is out of range");
+            return;
+        }
+
+        linker.patchJump(pic.fastPathRejoin);
+
+        linkerEpilogue(linker, start, shapeMismatches);
+    }
+
     LookupStatus generateStub(JSObject *holder, const Shape *shape)
     {
         Vector<Jump, 8> shapeMismatches(cx);
@@ -1196,6 +1296,13 @@ class GetPropCompiler : public PICStubCompiler
             pic.secondShapeGuard = 0;
         }
 
+        if (!shape->hasDefaultGetterOrIsMethod()) {
+            generateGetterStub(masm, shape, start, shapeMismatches);
+            if (setStubShapeOffset)
+                pic.getPropLabels().setStubShapeJump(masm, start, stubShapeJumpLabel);
+            return Lookup_Cacheable;
+        }
+
         /* Load the value out of the object. */
         masm.loadObjProp(holder, holderReg, shape, pic.shapeReg, pic.objReg);
         Jump done = masm.jump();
@@ -1211,12 +1318,22 @@ class GetPropCompiler : public PICStubCompiler
             return disable("code memory is out of range");
         }
 
+        // The final exit jumps to the store-back in the inline stub.
+        buffer.link(done, pic.fastPathRejoin);
+
+        linkerEpilogue(buffer, start, shapeMismatches);
+
+        if (setStubShapeOffset)
+            pic.getPropLabels().setStubShapeJump(masm, start, stubShapeJumpLabel);
+        return Lookup_Cacheable;
+    }
+
+    void linkerEpilogue(LinkerHelper &buffer, Label start, const Vector<Jump, 8> &shapeMismatches)
+    {
         // The guard exit jumps to the original slow case.
         for (Jump *pj = shapeMismatches.begin(); pj != shapeMismatches.end(); ++pj)
             buffer.link(*pj, pic.slowPathStart);
 
-        // The final exit jumps to the store-back in the inline stub.
-        buffer.link(done, pic.fastPathRejoin);
         CodeLocationLabel cs = buffer.finalize();
         JaegerSpew(JSpew_PICs, "generated %s stub at %p\n", type, cs.executableAddress());
 
@@ -1225,15 +1342,10 @@ class GetPropCompiler : public PICStubCompiler
         pic.stubsGenerated++;
         pic.updateLastPath(buffer, start);
 
-        if (setStubShapeOffset)
-            pic.getPropLabels().setStubShapeJump(masm, start, stubShapeJumpLabel);
-
         if (pic.stubsGenerated == MAX_PIC_STUBS)
             disable("max stubs reached");
         if (obj->isDenseArray())
             disable("dense array");
-
-        return Lookup_Cacheable;
     }
 
     void patchPreviousToHere(CodeLocationLabel cs)
@@ -1249,8 +1361,14 @@ class GetPropCompiler : public PICStubCompiler
             shapeGuardJumpOffset = pic.getPropLabels().getStubShapeJumpOffset();
         else
             shapeGuardJumpOffset = pic.shapeGuard + pic.getPropLabels().getInlineShapeJumpOffset();
+        int secondGuardOffset = getLastStubSecondShapeGuard();
+
+        JaegerSpew(JSpew_PICs, "Patching previous (%d stubs) (start %p) (offset %d) (second %d)\n",
+                   (int) pic.stubsGenerated, label.executableAddress(),
+                   shapeGuardJumpOffset, secondGuardOffset);
+
         repatcher.relink(label.jumpAtOffset(shapeGuardJumpOffset), cs);
-        if (int secondGuardOffset = getLastStubSecondShapeGuard())
+        if (secondGuardOffset)
             repatcher.relink(label.jumpAtOffset(secondGuardOffset), cs);
     }
 
@@ -1265,8 +1383,11 @@ class GetPropCompiler : public PICStubCompiler
         if (hadGC())
             return Lookup_Uncacheable;
 
-        if (obj == getprop.holder && !pic.inlinePathPatched)
+        if (obj == getprop.holder &&
+            getprop.shape->hasDefaultGetterOrIsMethod() &&
+            !pic.inlinePathPatched) {
             return patchInline(getprop.holder, getprop.shape);
+        }
 
         return generateStub(getprop.holder, getprop.shape);
     }
@@ -2015,6 +2136,11 @@ ic::CallProp(VMFrame &f, ic::PICInfo *pic)
             NATIVE_GET(cx, &objv.toObject(), obj2, shape, JSGET_NO_METHOD_BARRIER, &rval,
                        THROW());
         }
+        /*
+         * Adjust the stack to reflect the height after the GETPROP, here and
+         * below. Getter hook ICs depend on this to know which value of sp they
+         * are updating for consistent rejoins, don't modify this!
+         */
         regs.sp++;
         regs.sp[-2] = rval;
         regs.sp[-1] = lval;
diff --git a/js/src/methodjit/PolyIC.h b/js/src/methodjit/PolyIC.h
index ebe2b20a83e4..9bf88a478a45 100644
--- a/js/src/methodjit/PolyIC.h
+++ b/js/src/methodjit/PolyIC.h
@@ -93,6 +93,9 @@ struct BaseIC : public MacroAssemblerTypedefs {
     bool hit : 1;
     bool slowCallPatched : 1;
 
+    // Whether getter/setter hooks can be called from IC stubs.
+    bool canCallHook : 1;
+
     // Number of stubs generated.
     uint32 stubsGenerated : 5;
 
diff --git a/js/src/methodjit/Retcon.cpp b/js/src/methodjit/Retcon.cpp
index 6827b1d711b0..b2391246eaf6 100644
--- a/js/src/methodjit/Retcon.cpp
+++ b/js/src/methodjit/Retcon.cpp
@@ -85,6 +85,7 @@ static inline JSRejoinState ScriptedRejoin(uint32 pcOffset)
 
 static inline JSRejoinState StubRejoin(RejoinState rejoin)
 {
+    JS_ASSERT(rejoin != REJOIN_NONE);
     return rejoin << 1;
 }
 
@@ -119,71 +120,66 @@ Recompiler::patchCall(JITScript *jit, StackFrame *fp, void **location)
 
 void
 Recompiler::patchNative(JSCompartment *compartment, JITScript *jit, StackFrame *fp,
-                        jsbytecode *pc, CallSite *inlined, RejoinState rejoin)
+                        jsbytecode *pc, RejoinState rejoin)
 {
     /*
-     * There is a native IC at pc which triggered a recompilation. The recompilation
-     * could have been triggered either by the native call itself, or by a SplatApplyArgs
-     * preparing for the native call. Either way, we don't want to patch up the call,
-     * but will instead steal the pool for the native IC so it doesn't get freed
-     * with the old script, and patch up the jump at the end to go to the interpoline.
+     * There is a native call or getter IC at pc which triggered recompilation.
+     * The recompilation could have been triggered either by the native call
+     * itself, or by a SplatApplyArgs preparing for the native call. Either
+     * way, we don't want to patch up the call, but will instead steal the pool
+     * for the IC so it doesn't get freed with the JITScript, and patch up the
+     * jump at the end to go to the interpoline.
+     *
+     * When doing this, we do not reset the the IC itself; the JITScript must
+     * be dead and about to be released due to the recompilation (or a GC).
      */
     fp->setRejoin(StubRejoin(rejoin));
 
     /* :XXX: We might crash later if this fails. */
     compartment->jaegerCompartment()->orphanedNativeFrames.append(fp);
 
-    unsigned i;
-    ic::CallICInfo *callICs = jit->callICs();
-    for (i = 0; i < jit->nCallICs; i++) {
-        CallSite *call = callICs[i].call;
-        if (inlined) {
-            /*
-             * The IC and regs.inlined will have two different call sites for
-             * the same point in the script. The IC site refers to the scripted
-             * return and regs.inlined has the prologue site (which was in use
-             * when the native stub was generated.
-             */
-            if (call->inlineIndex == inlined->inlineIndex && call->pcOffset == inlined->pcOffset)
-                break;
-        } else if (call->inlineIndex == uint32(-1) &&
-                   call->pcOffset == uint32(pc - jit->script->code)) {
-            break;
-        }
-    }
-    JS_ASSERT(i < jit->nCallICs);
-    ic::CallICInfo &ic = callICs[i];
-    JS_ASSERT(ic.fastGuardedNative);
+    DebugOnly<bool> found = false;
 
-    JSC::ExecutablePool *&pool = ic.pools[ic::CallICInfo::Pool_NativeStub];
+    /*
+     * Find and patch all native call stubs attached to the given PC. There may
+     * be multiple ones for getter stubs attached to e.g. a GETELEM.
+     */
+    for (unsigned i = 0; i < jit->nativeCallStubs.length(); i++) {
+        NativeCallStub &stub = jit->nativeCallStubs[i];
+        if (stub.pc != pc)
+            continue;
 
-    if (!pool) {
-        /* Already stole this stub. */
-        return;
-    }
+        found = true;
 
-    /* Patch the native fallthrough to go to the interpoline. */
-    {
+        /* Check for pools that were already patched. */
+        if (!stub.pool)
+            continue;
+
+        /* Patch the native fallthrough to go to the interpoline. */
+        {
 #if (defined(JS_NO_FASTCALL) && defined(JS_CPU_X86)) || defined(_WIN64)
-        /* Win64 needs stack adjustment */
-        void *interpoline = JS_FUNC_TO_DATA_PTR(void *, JaegerInterpolinePatched);
+            /* Win64 needs stack adjustment */
+            void *interpoline = JS_FUNC_TO_DATA_PTR(void *, JaegerInterpolinePatched);
 #else
-        void *interpoline = JS_FUNC_TO_DATA_PTR(void *, JaegerInterpoline);
+            void *interpoline = JS_FUNC_TO_DATA_PTR(void *, JaegerInterpoline);
 #endif
-        uint8 *start = (uint8 *)ic.nativeJump.executableAddress();
-        JSC::RepatchBuffer repatch(JSC::JITCode(start - 32, 64));
+            uint8 *start = (uint8 *)stub.jump.executableAddress();
+            JSC::RepatchBuffer repatch(JSC::JITCode(start - 32, 64));
 #ifdef JS_CPU_X64
-        repatch.repatch(ic.nativeJump, interpoline);
+            repatch.repatch(stub.jump, interpoline);
 #else
-        repatch.relink(ic.nativeJump, JSC::CodeLocationLabel(interpoline));
+            repatch.relink(stub.jump, JSC::CodeLocationLabel(interpoline));
 #endif
+        }
+
+        /* :XXX: We leak the pool if this fails. Oh well. */
+        compartment->jaegerCompartment()->orphanedNativePools.append(stub.pool);
+
+        /* Mark as stolen in case there are multiple calls on the stack. */
+        stub.pool = NULL;
     }
 
-    /* :XXX: We leak the pool if this fails. Oh well. */
-    compartment->jaegerCompartment()->orphanedNativePools.append(pool);
-
-    /* Mark as stolen in case there are multiple calls on the stack. */
-    pool = NULL;
+    JS_ASSERT(found);
 }
 
 void
@@ -199,11 +195,11 @@ Recompiler::patchFrame(JSCompartment *compartment, VMFrame *f, JSScript *script)
     void **addr = f->returnAddressLocation();
     RejoinState rejoin = (RejoinState) f->stubRejoin;
     if (rejoin == REJOIN_NATIVE ||
-        rejoin == REJOIN_NATIVE_LOWERED) {
+        rejoin == REJOIN_NATIVE_LOWERED ||
+        rejoin == REJOIN_NATIVE_GETTER) {
         /* Native call. */
         if (fp->script() == script) {
-            patchNative(compartment, fp->jit(), fp,
-                        f->regs.pc, NULL, rejoin);
+            patchNative(compartment, fp->jit(), fp, f->regs.pc, rejoin);
             f->stubRejoin = REJOIN_NATIVE_PATCHED;
         }
     } else if (rejoin == REJOIN_NATIVE_PATCHED) {
@@ -295,6 +291,7 @@ Recompiler::expandInlineFrames(JSCompartment *compartment,
         /* The VMFrame is calling CompileFunction. */
         JS_ASSERT(f->stubRejoin != REJOIN_NATIVE &&
                   f->stubRejoin != REJOIN_NATIVE_LOWERED &&
+                  f->stubRejoin != REJOIN_NATIVE_GETTER &&
                   f->stubRejoin != REJOIN_NATIVE_PATCHED);
         innerfp->setRejoin(StubRejoin((RejoinState) f->stubRejoin));
         *frameAddr = JS_FUNC_TO_DATA_PTR(void *, JaegerInterpoline);
diff --git a/js/src/methodjit/Retcon.h b/js/src/methodjit/Retcon.h
index a9faa1153e31..3a11e88fc390 100644
--- a/js/src/methodjit/Retcon.h
+++ b/js/src/methodjit/Retcon.h
@@ -100,7 +100,7 @@ private:
 
     static void patchCall(JITScript *jit, StackFrame *fp, void **location);
     static void patchNative(JSCompartment *compartment, JITScript *jit, StackFrame *fp,
-                            jsbytecode *pc, CallSite *inline_, RejoinState rejoin);
+                            jsbytecode *pc, RejoinState rejoin);
 
     static StackFrame *
     expandInlineFrameChain(StackFrame *outer, InlineFrame *inner);
diff --git a/js/src/methodjit/StubCalls.cpp b/js/src/methodjit/StubCalls.cpp
index fc304b7abb54..13a0a26cdc03 100644
--- a/js/src/methodjit/StubCalls.cpp
+++ b/js/src/methodjit/StubCalls.cpp
@@ -597,18 +597,13 @@ stubs::SetElem(VMFrame &f)
                         break;
                     if ((jsuint)i >= obj->getArrayLength())
                         obj->setArrayLength(cx, i + 1);
-                    /*
-                     * Note: this stub is used for ENUMELEM, so watch out
-                     * before overwriting the op.
-                     */
-                    if (JSOp(*f.pc()) == JSOP_SETELEM)
-                        *f.pc() = JSOP_SETHOLE;
                 }
                 obj->setDenseArrayElementWithType(cx, i, rval);
                 goto end_setelem;
             } else {
-                if (JSOp(*f.pc()) == JSOP_SETELEM)
-                    *f.pc() = JSOP_SETHOLE;
+                if (!f.script()->ensureRanBytecode(cx))
+                    THROW();
+                f.script()->analysis()->getCode(f.pc()).arrayWriteHole = true;
             }
         }
     } while (0);

From 03d1ecc1c8961a4c23194ba5bb7dc670c9db35f2 Mon Sep 17 00:00:00 2001
From: Brian Hackett <bhackett1024@gmail.com>
Date: Tue, 6 Sep 2011 22:46:01 -0700
Subject: [PATCH 041/209] [INFER] Don't check for invariant copy preservation
 in stack entries popped by REJOIN_NONE calls, bug 684943. r=dvander

---
 js/src/jit-test/tests/jaeger/bug684943.js |  7 +++++++
 js/src/methodjit/Compiler.cpp             |  4 ++--
 js/src/methodjit/Compiler.h               | 12 ++++++++----
 js/src/methodjit/FastOps.cpp              | 14 +++++++-------
 js/src/methodjit/FrameState.cpp           |  4 ++--
 js/src/methodjit/FrameState.h             |  7 +++++--
 js/src/methodjit/LoopState.cpp            |  4 ++--
 js/src/methodjit/LoopState.h              |  2 +-
 js/src/methodjit/StubCompiler.cpp         |  8 ++++----
 js/src/methodjit/StubCompiler.h           |  4 ++--
 10 files changed, 40 insertions(+), 26 deletions(-)
 create mode 100644 js/src/jit-test/tests/jaeger/bug684943.js

diff --git a/js/src/jit-test/tests/jaeger/bug684943.js b/js/src/jit-test/tests/jaeger/bug684943.js
new file mode 100644
index 000000000000..69ec5ca2bd6e
--- /dev/null
+++ b/js/src/jit-test/tests/jaeger/bug684943.js
@@ -0,0 +1,7 @@
+
+function foo(x) {
+  for (var i = 0; i < 100; i++) {
+    x.f === i;
+  }
+}
+foo({f:"three"});
diff --git a/js/src/methodjit/Compiler.cpp b/js/src/methodjit/Compiler.cpp
index 6908e904d259..59b59ad759e2 100644
--- a/js/src/methodjit/Compiler.cpp
+++ b/js/src/methodjit/Compiler.cpp
@@ -4056,7 +4056,7 @@ mjit::Compiler::addCallSite(const InternalCallSite &site)
 }
 
 void
-mjit::Compiler::inlineStubCall(void *stub, RejoinState rejoin)
+mjit::Compiler::inlineStubCall(void *stub, RejoinState rejoin, Uses uses)
 {
     DataLabelPtr inlinePatch;
     Call cl = emitStubCall(stub, &inlinePatch);
@@ -4066,7 +4066,7 @@ mjit::Compiler::inlineStubCall(void *stub, RejoinState rejoin)
     if (loop && loop->generatingInvariants()) {
         Jump j = masm.jump();
         Label l = masm.label();
-        loop->addInvariantCall(j, l, false, false, callSites.length());
+        loop->addInvariantCall(j, l, false, false, callSites.length(), uses);
     }
     addCallSite(site);
 }
diff --git a/js/src/methodjit/Compiler.h b/js/src/methodjit/Compiler.h
index b9823c93447a..c59cd863099a 100644
--- a/js/src/methodjit/Compiler.h
+++ b/js/src/methodjit/Compiler.h
@@ -488,7 +488,7 @@ class Compiler : public BaseCompiler
     Label labelOf(jsbytecode *target, uint32 inlineIndex);
     void addCallSite(const InternalCallSite &callSite);
     void addReturnSite();
-    void inlineStubCall(void *stub, RejoinState rejoin);
+    void inlineStubCall(void *stub, RejoinState rejoin, Uses uses);
 
     bool debugMode() { return debugMode_; }
     bool inlining() { return inlining_; }
@@ -778,16 +778,20 @@ class Compiler : public BaseCompiler
 // Given a stub call, emits the call into the inline assembly path. rejoin
 // indicates how to rejoin should this call trigger expansion/discarding.
 #define INLINE_STUBCALL(stub, rejoin)                                       \
-    inlineStubCall(JS_FUNC_TO_DATA_PTR(void *, (stub)), rejoin)
+    inlineStubCall(JS_FUNC_TO_DATA_PTR(void *, (stub)), rejoin, Uses(0))
+#define INLINE_STUBCALL_USES(stub, rejoin, uses)                            \
+    inlineStubCall(JS_FUNC_TO_DATA_PTR(void *, (stub)), rejoin, uses)
 
 // Given a stub call, emits the call into the out-of-line assembly path.
 // Unlike the INLINE_STUBCALL variant, this returns the Call offset.
 #define OOL_STUBCALL(stub, rejoin)                                          \
-    stubcc.emitStubCall(JS_FUNC_TO_DATA_PTR(void *, (stub)), rejoin)
+    stubcc.emitStubCall(JS_FUNC_TO_DATA_PTR(void *, (stub)), rejoin, Uses(0))
+#define OOL_STUBCALL_USES(stub, rejoin, uses)                               \
+    stubcc.emitStubCall(JS_FUNC_TO_DATA_PTR(void *, (stub)), rejoin, uses)
 
 // Same as OOL_STUBCALL, but specifies a slot depth.
 #define OOL_STUBCALL_LOCAL_SLOTS(stub, rejoin, slots)                       \
-    stubcc.emitStubCall(JS_FUNC_TO_DATA_PTR(void *, (stub)), rejoin, (slots))
+    stubcc.emitStubCall(JS_FUNC_TO_DATA_PTR(void *, (stub)), rejoin, Uses(0), (slots))
 
 } /* namespace js */
 } /* namespace mjit */
diff --git a/js/src/methodjit/FastOps.cpp b/js/src/methodjit/FastOps.cpp
index 91c8fda2d9bd..8b62c5b5b830 100644
--- a/js/src/methodjit/FastOps.cpp
+++ b/js/src/methodjit/FastOps.cpp
@@ -634,7 +634,7 @@ mjit::Compiler::jsop_not()
           default:
           {
             prepareStubCall(Uses(1));
-            INLINE_STUBCALL(stubs::ValueToBoolean, REJOIN_NONE);
+            INLINE_STUBCALL_USES(stubs::ValueToBoolean, REJOIN_NONE, Uses(1));
 
             RegisterID reg = Registers::ReturnReg;
             frame.takeReg(reg);
@@ -2344,9 +2344,9 @@ mjit::Compiler::jsop_stricteq(JSOp op)
         prepareStubCall(Uses(2));
 
         if (op == JSOP_STRICTEQ)
-            INLINE_STUBCALL(stubs::StrictEq, REJOIN_NONE);
+            INLINE_STUBCALL_USES(stubs::StrictEq, REJOIN_NONE, Uses(2));
         else
-            INLINE_STUBCALL(stubs::StrictNe, REJOIN_NONE);
+            INLINE_STUBCALL_USES(stubs::StrictNe, REJOIN_NONE, Uses(2));
 
         frame.popn(2);
         frame.pushSynced(JSVAL_TYPE_BOOLEAN);
@@ -2398,9 +2398,9 @@ mjit::Compiler::jsop_stricteq(JSOp op)
     if (needStub) {
         stubcc.leave();
         if (op == JSOP_STRICTEQ)
-            OOL_STUBCALL(stubs::StrictEq, REJOIN_NONE);
+            OOL_STUBCALL_USES(stubs::StrictEq, REJOIN_NONE, Uses(2));
         else
-            OOL_STUBCALL(stubs::StrictNe, REJOIN_NONE);
+            OOL_STUBCALL_USES(stubs::StrictNe, REJOIN_NONE, Uses(2));
     }
 
     frame.popn(2);
@@ -2413,9 +2413,9 @@ mjit::Compiler::jsop_stricteq(JSOp op)
     prepareStubCall(Uses(2));
 
     if (op == JSOP_STRICTEQ)
-        INLINE_STUBCALL(stubs::StrictEq, REJOIN_NONE);
+        INLINE_STUBCALL_USES(stubs::StrictEq, REJOIN_NONE, Uses(2));
     else
-        INLINE_STUBCALL(stubs::StrictNe, REJOIN_NONE);
+        INLINE_STUBCALL_USES(stubs::StrictNe, REJOIN_NONE, Uses(2));
 
     frame.popn(2);
     frame.pushSynced(JSVAL_TYPE_BOOLEAN);
diff --git a/js/src/methodjit/FrameState.cpp b/js/src/methodjit/FrameState.cpp
index 347ba7d083d8..372b5affcf8d 100644
--- a/js/src/methodjit/FrameState.cpp
+++ b/js/src/methodjit/FrameState.cpp
@@ -2880,7 +2880,7 @@ FrameState::clearTemporaries()
 }
 
 Vector<TemporaryCopy> *
-FrameState::getTemporaryCopies()
+FrameState::getTemporaryCopies(Uses uses)
 {
     /* :XXX: handle OOM */
     Vector<TemporaryCopy> *res = NULL;
@@ -2891,7 +2891,7 @@ FrameState::getTemporaryCopies()
         if (fe->isCopied()) {
             for (uint32 i = fe->trackerIndex() + 1; i < tracker.nentries; i++) {
                 FrameEntry *nfe = tracker[i];
-                if (!deadEntry(nfe) && nfe->isCopy() && nfe->copyOf() == fe) {
+                if (!deadEntry(nfe, uses.nuses) && nfe->isCopy() && nfe->copyOf() == fe) {
                     if (!res)
                         res = cx->new_< Vector<TemporaryCopy> >(cx);
                     res->append(TemporaryCopy(addressOf(nfe), addressOf(fe)));
diff --git a/js/src/methodjit/FrameState.h b/js/src/methodjit/FrameState.h
index dd4f19c44d78..10c97ae52272 100644
--- a/js/src/methodjit/FrameState.h
+++ b/js/src/methodjit/FrameState.h
@@ -947,8 +947,11 @@ class FrameState
     void clearTemporaries();
     inline FrameEntry *getTemporary(uint32 which);
 
-    /* Return NULL or a new vector with all current copies of temporaries. */
-    Vector<TemporaryCopy> *getTemporaryCopies();
+    /*
+     * Return NULL or a new vector with all current copies of temporaries,
+     * excluding those about to be popped per 'uses'.
+     */
+    Vector<TemporaryCopy> *getTemporaryCopies(Uses uses);
 
     inline void syncAndForgetFe(FrameEntry *fe, bool markSynced = false);
     inline void forgetLoopReg(FrameEntry *fe);
diff --git a/js/src/methodjit/LoopState.cpp b/js/src/methodjit/LoopState.cpp
index 83fd69810ef7..e04d4abf5131 100644
--- a/js/src/methodjit/LoopState.cpp
+++ b/js/src/methodjit/LoopState.cpp
@@ -195,7 +195,7 @@ LoopState::addJoin(unsigned index, bool script)
 }
 
 void
-LoopState::addInvariantCall(Jump jump, Label label, bool ool, bool entry, unsigned patchIndex)
+LoopState::addInvariantCall(Jump jump, Label label, bool ool, bool entry, unsigned patchIndex, Uses uses)
 {
     RestoreInvariantCall call;
     call.jump = jump;
@@ -203,7 +203,7 @@ LoopState::addInvariantCall(Jump jump, Label label, bool ool, bool entry, unsign
     call.ool = ool;
     call.entry = entry;
     call.patchIndex = patchIndex;
-    call.temporaryCopies = frame.getTemporaryCopies();
+    call.temporaryCopies = frame.getTemporaryCopies(uses);
 
     restoreInvariantCalls.append(call);
 }
diff --git a/js/src/methodjit/LoopState.h b/js/src/methodjit/LoopState.h
index baf1fcde0255..71d6ae8216ea 100644
--- a/js/src/methodjit/LoopState.h
+++ b/js/src/methodjit/LoopState.h
@@ -253,7 +253,7 @@ class LoopState : public MacroAssemblerTypedefs
     bool generatingInvariants() { return !skipAnalysis; }
 
     /* Add a call with trailing jump/label, after which invariants need to be restored. */
-    void addInvariantCall(Jump jump, Label label, bool ool, bool entry, unsigned patchIndex);
+    void addInvariantCall(Jump jump, Label label, bool ool, bool entry, unsigned patchIndex, Uses uses);
 
     uint32 headOffset() { return lifetime->head; }
     uint32 getLoopRegs() { return loopRegs.freeMask; }
diff --git a/js/src/methodjit/StubCompiler.cpp b/js/src/methodjit/StubCompiler.cpp
index aa0c5dc27bba..bd44d19ddb43 100644
--- a/js/src/methodjit/StubCompiler.cpp
+++ b/js/src/methodjit/StubCompiler.cpp
@@ -170,13 +170,13 @@ typedef JSC::MacroAssembler::Imm32 Imm32;
 typedef JSC::MacroAssembler::DataLabelPtr DataLabelPtr;
 
 JSC::MacroAssembler::Call
-StubCompiler::emitStubCall(void *ptr, RejoinState rejoin)
+StubCompiler::emitStubCall(void *ptr, RejoinState rejoin, Uses uses)
 {
-    return emitStubCall(ptr, rejoin, frame.totalDepth());
+    return emitStubCall(ptr, rejoin, uses, frame.totalDepth());
 }
 
 JSC::MacroAssembler::Call
-StubCompiler::emitStubCall(void *ptr, RejoinState rejoin, int32 slots)
+StubCompiler::emitStubCall(void *ptr, RejoinState rejoin, Uses uses, int32 slots)
 {
     JaegerSpew(JSpew_Insns, " ---- BEGIN SLOW CALL CODE ---- \n");
     masm.bumpStubCounter(cc.script, cc.PC, Registers::tempCallReg());
@@ -199,7 +199,7 @@ StubCompiler::emitStubCall(void *ptr, RejoinState rejoin, int32 slots)
         /* MissedBoundsCheck* are not actually called, so f.regs need to be written before InvariantFailure. */
         bool entry = (ptr == JS_FUNC_TO_DATA_PTR(void *, stubs::MissedBoundsCheckEntry))
                   || (ptr == JS_FUNC_TO_DATA_PTR(void *, stubs::MissedBoundsCheckHead));
-        cc.loop->addInvariantCall(j, l, true, entry, cc.callSites.length());
+        cc.loop->addInvariantCall(j, l, true, entry, cc.callSites.length(), uses);
     }
 
     cc.addCallSite(site);
diff --git a/js/src/methodjit/StubCompiler.h b/js/src/methodjit/StubCompiler.h
index 7d34e9ad1037..cec08c58bf8d 100644
--- a/js/src/methodjit/StubCompiler.h
+++ b/js/src/methodjit/StubCompiler.h
@@ -137,8 +137,8 @@ class StubCompiler
     bool jumpInScript(Jump j, jsbytecode *target);
     unsigned crossJump(Jump j, Label l);
 
-    Call emitStubCall(void *ptr, RejoinState rejoin);
-    Call emitStubCall(void *ptr, RejoinState rejoin, int32 slots);
+    Call emitStubCall(void *ptr, RejoinState rejoin, Uses uses);
+    Call emitStubCall(void *ptr, RejoinState rejoin, Uses uses, int32 slots);
 
     void patchJoin(unsigned i, bool script, Assembler::Address address, AnyRegisterID reg);
 };

From 69f13146257beb7bc160d35b6e77294a5aaa1162 Mon Sep 17 00:00:00 2001
From: Brian Hackett <bhackett1024@gmail.com>
Date: Tue, 6 Sep 2011 22:49:47 -0700
Subject: [PATCH 042/209] [INFER] Ensure type/prototype are preserved when
 cloning functions at method barriers, bug 683714.

---
 js/src/jsfun.cpp               |  2 +-
 js/src/jsfun.h                 | 18 ++++++++++++++++++
 js/src/jsinterp.cpp            |  6 ++++++
 js/src/jsobj.cpp               |  2 +-
 js/src/jsobjinlines.h          |  2 +-
 js/src/methodjit/StubCalls.cpp |  4 ++++
 6 files changed, 31 insertions(+), 3 deletions(-)

diff --git a/js/src/jsfun.cpp b/js/src/jsfun.cpp
index 72eaa1f5c59e..8d2f15fecb1e 100644
--- a/js/src/jsfun.cpp
+++ b/js/src/jsfun.cpp
@@ -1317,7 +1317,7 @@ StackFrame::getValidCalleeObject(JSContext *cx, Value *vp)
              * track of the method, so we associate it with the first barriered
              * object found starting from thisp on the prototype chain.
              */
-            JSObject *newfunobj = CloneFunctionObject(cx, fun, fun->getParent(), true);
+            JSObject *newfunobj = CloneFunctionObject(cx, fun);
             if (!newfunobj)
                 return false;
             newfunobj->setMethodObj(*first_barriered_thisp);
diff --git a/js/src/jsfun.h b/js/src/jsfun.h
index 83e806045b47..da84c51c3b5b 100644
--- a/js/src/jsfun.h
+++ b/js/src/jsfun.h
@@ -463,6 +463,24 @@ CloneFunctionObject(JSContext *cx, JSFunction *fun, JSObject *parent,
     return js_CloneFunctionObject(cx, fun, parent, proto);
 }
 
+inline JSObject *
+CloneFunctionObject(JSContext *cx, JSFunction *fun)
+{
+    /*
+     * Variant which makes an exact clone of fun, preserving parent and proto.
+     * Calling the above version CloneFunctionObject(cx, fun, fun->getParent())
+     * is not equivalent: API clients, including XPConnect, can reparent
+     * objects so that fun->getGlobal() != fun->getProto()->getGlobal().
+     * See ReparentWrapperIfFound.
+     */
+    JS_ASSERT(fun->getParent() && fun->getProto());
+
+    if (fun->hasSingletonType())
+        return fun;
+
+    return js_CloneFunctionObject(cx, fun, fun->getParent(), fun->getProto());
+}
+
 extern JSObject * JS_FASTCALL
 js_AllocFlatClosure(JSContext *cx, JSFunction *fun, JSObject *scopeChain);
 
diff --git a/js/src/jsinterp.cpp b/js/src/jsinterp.cpp
index 1c66e7814eb4..714c27e04a24 100644
--- a/js/src/jsinterp.cpp
+++ b/js/src/jsinterp.cpp
@@ -4812,6 +4812,7 @@ BEGIN_CASE(JSOP_DEFFUN)
         obj = CloneFunctionObject(cx, fun, obj2, true);
         if (!obj)
             goto error;
+        JS_ASSERT_IF(script->hasGlobal(), obj->getProto() == fun->getProto());
     }
 
     /*
@@ -4945,6 +4946,8 @@ BEGIN_CASE(JSOP_DEFLOCALFUN)
         }
     }
 
+    JS_ASSERT_IF(script->hasGlobal(), obj->getProto() == fun->getProto());
+
     uint32 slot = GET_SLOTNO(regs.pc);
     TRACE_2(DefLocalFunSetSlot, slot, obj);
 
@@ -5063,6 +5066,8 @@ BEGIN_CASE(JSOP_LAMBDA)
     } while (0);
 
     JS_ASSERT(obj->getProto());
+    JS_ASSERT_IF(script->hasGlobal(), obj->getProto() == fun->getProto());
+
     PUSH_OBJECT(*obj);
 }
 END_CASE(JSOP_LAMBDA)
@@ -5075,6 +5080,7 @@ BEGIN_CASE(JSOP_LAMBDA_FC)
     JSObject *obj = js_NewFlatClosure(cx, fun, JSOP_LAMBDA_FC, JSOP_LAMBDA_FC_LENGTH);
     if (!obj)
         goto error;
+    JS_ASSERT_IF(script->hasGlobal(), obj->getProto() == fun->getProto());
 
     PUSH_OBJECT(*obj);
 }
diff --git a/js/src/jsobj.cpp b/js/src/jsobj.cpp
index 4e1e6e609840..5277c5539176 100644
--- a/js/src/jsobj.cpp
+++ b/js/src/jsobj.cpp
@@ -5913,7 +5913,7 @@ CloneFunctionForSetMethod(JSContext *cx, Value *vp)
      * need to be cloned again.
      */
     if (fun == funobj) {
-        funobj = CloneFunctionObject(cx, fun, fun->parent, true);
+        funobj = CloneFunctionObject(cx, fun);
         if (!funobj)
             return false;
         vp->setObject(*funobj);
diff --git a/js/src/jsobjinlines.h b/js/src/jsobjinlines.h
index 0fe99af49e3c..46c297f9dac5 100644
--- a/js/src/jsobjinlines.h
+++ b/js/src/jsobjinlines.h
@@ -266,7 +266,7 @@ JSObject::methodReadBarrier(JSContext *cx, const js::Shape &shape, js::Value *vp
     JS_ASSERT(fun == funobj);
     JS_ASSERT(fun->isNullClosure());
 
-    funobj = CloneFunctionObject(cx, fun, funobj->getParent(), true);
+    funobj = CloneFunctionObject(cx, fun);
     if (!funobj)
         return NULL;
     funobj->setMethodObj(*this);
diff --git a/js/src/methodjit/StubCalls.cpp b/js/src/methodjit/StubCalls.cpp
index 13a0a26cdc03..25f870c0be02 100644
--- a/js/src/methodjit/StubCalls.cpp
+++ b/js/src/methodjit/StubCalls.cpp
@@ -792,6 +792,7 @@ stubs::DefFun(VMFrame &f, JSFunction *fun)
         obj = CloneFunctionObject(cx, fun, obj2, true);
         if (!obj)
             THROW();
+        JS_ASSERT_IF(f.script()->compileAndGo, obj->getGlobal() == fun->getGlobal());
     }
 
     /*
@@ -1442,6 +1443,8 @@ stubs::DefLocalFun(VMFrame &f, JSFunction *fun)
         }
     }
 
+    JS_ASSERT_IF(f.script()->compileAndGo, obj->getGlobal() == fun->getGlobal());
+
     return obj;
 }
 
@@ -1556,6 +1559,7 @@ stubs::Lambda(VMFrame &f, JSFunction *fun)
     if (!obj)
         THROWV(NULL);
 
+    JS_ASSERT_IF(f.script()->compileAndGo, obj->getGlobal() == fun->getGlobal());
     return obj;
 }
 

From 84d672c1a995197c10edf4d4bd1f6f8293061409 Mon Sep 17 00:00:00 2001
From: Brian Hackett <bhackett1024@gmail.com>
Date: Tue, 6 Sep 2011 22:52:38 -0700
Subject: [PATCH 043/209] [INFER] Don't require JS_SplicePrototype to be passed
 an object with singleton type, bug 683999.

---
 js/src/jsfriendapi.cpp | 9 +++++++++
 1 file changed, 9 insertions(+)

diff --git a/js/src/jsfriendapi.cpp b/js/src/jsfriendapi.cpp
index 8b6802cf3637..b70993c66a6d 100644
--- a/js/src/jsfriendapi.cpp
+++ b/js/src/jsfriendapi.cpp
@@ -92,6 +92,15 @@ JS_SplicePrototype(JSContext *cx, JSObject *obj, JSObject *proto)
      * does not nuke type information for the object.
      */
     CHECK_REQUEST(cx);
+
+    if (!obj->hasSingletonType()) {
+        /*
+         * We can see non-singleton objects when trying to splice prototypes
+         * due to mutable __proto__ (ugh).
+         */
+        return JS_SetPrototype(cx, obj, proto);
+    }
+
     return obj->splicePrototype(cx, proto);
 }
 

From 63e51f17741fa9c041706bd7d0d2605764f3ccab Mon Sep 17 00:00:00 2001
From: Brian Hackett <bhackett1024@gmail.com>
Date: Wed, 7 Sep 2011 03:56:20 -0700
Subject: [PATCH 044/209] [INFER] Fix red.

---
 js/src/jsinterp.cpp            | 5 ++---
 js/src/jsobj.cpp               | 4 +---
 js/src/methodjit/StubCalls.cpp | 5 ++---
 3 files changed, 5 insertions(+), 9 deletions(-)

diff --git a/js/src/jsinterp.cpp b/js/src/jsinterp.cpp
index 714c27e04a24..3429bcde6e7f 100644
--- a/js/src/jsinterp.cpp
+++ b/js/src/jsinterp.cpp
@@ -4101,9 +4101,8 @@ BEGIN_CASE(JSOP_SETELEM)
                 obj->setDenseArrayElementWithType(cx, i, regs.sp[-1]);
                 goto end_setelem;
             } else {
-                if (!script->ensureRanBytecode(cx))
-                    goto error;
-                script->analysis()->getCode(regs.pc).arrayWriteHole = true;
+                if (script->hasAnalysis())
+                    script->analysis()->getCode(regs.pc).arrayWriteHole = true;
             }
         }
     } while (0);
diff --git a/js/src/jsobj.cpp b/js/src/jsobj.cpp
index 5277c5539176..057848c53bd2 100644
--- a/js/src/jsobj.cpp
+++ b/js/src/jsobj.cpp
@@ -5604,9 +5604,7 @@ js_NativeGetInline(JSContext *cx, JSObject *receiver, JSObject *obj, JSObject *p
 
     jsbytecode *pc;
     JSScript *script = cx->stack.currentScript(&pc);
-    if (script) {
-        if (!script->ensureRanBytecode(cx))
-            return false;
+    if (script && script->hasAnalysis()) {
         analyze::Bytecode *code = script->analysis()->maybeCode(pc);
         if (code)
             code->accessGetter = true;
diff --git a/js/src/methodjit/StubCalls.cpp b/js/src/methodjit/StubCalls.cpp
index 25f870c0be02..c13e5ed8df87 100644
--- a/js/src/methodjit/StubCalls.cpp
+++ b/js/src/methodjit/StubCalls.cpp
@@ -601,9 +601,8 @@ stubs::SetElem(VMFrame &f)
                 obj->setDenseArrayElementWithType(cx, i, rval);
                 goto end_setelem;
             } else {
-                if (!f.script()->ensureRanBytecode(cx))
-                    THROW();
-                f.script()->analysis()->getCode(f.pc()).arrayWriteHole = true;
+                if (!f.script()->hasAnalysis())
+                    f.script()->analysis()->getCode(f.pc()).arrayWriteHole = true;
             }
         }
     } while (0);

From 1ab845dd4fff2c885cb23772dc382a2409dcf178 Mon Sep 17 00:00:00 2001
From: Kyle Huey <khuey@kylehuey.com>
Date: Wed, 7 Sep 2011 15:25:40 -0400
Subject: [PATCH 045/209] Bug 677922: Package pyxpidl in the SDK and stop
 building the binary xpidl. r=bsmedberg

---
 xpcom/typelib/xpidl/Makefile.in | 117 +++++---------------------------
 1 file changed, 17 insertions(+), 100 deletions(-)

diff --git a/xpcom/typelib/xpidl/Makefile.in b/xpcom/typelib/xpidl/Makefile.in
index a5fe8f59f4a3..4e0957441a50 100644
--- a/xpcom/typelib/xpidl/Makefile.in
+++ b/xpcom/typelib/xpidl/Makefile.in
@@ -40,114 +40,31 @@ topsrcdir	= @top_srcdir@
 srcdir		= @srcdir@
 VPATH		= @srcdir@
 
-include $(DEPTH)/config/autoconf.mk
+include $(topsrcdir)/config/config.mk
 
 MODULE		= xpcom
 
-INTERNAL_TOOLS	= 1
+SDK_BINARY = \
+  $(topsrcdir)/xpcom/idl-parser/xpidl.py \
+  $(topsrcdir)/xpcom/idl-parser/xpidllex.py \
+  $(topsrcdir)/xpcom/idl-parser/xpidlyacc.py \
+  $(topsrcdir)/xpcom/idl-parser/header.py \
+  $(topsrcdir)/xpcom/idl-parser/typelib.py \
+  $(NULL)
 
-# glib and libIDL link against the non-debug msvcrt
-MOZ_NO_DEBUG_RTL=1
+$(SDK_BIN_DIR)/ply::
+	$(NSINSTALL) -D $@
 
-XPIDL_CSRCS	= \
-		xpidl.c \
-		xpidl_idl.c \
-		xpidl_util.c \
-		xpidl_header.c \
-		xpidl_typelib.c \
-		xpidl_doc.c \
-		xpidl_java.c \
-		$(NULL)
+PLY_SRCS = \
+  $(topsrcdir)/other-licenses/ply/ply/__init__.py \
+  $(topsrcdir)/other-licenses/ply/ply/lex.py \
+  $(topsrcdir)/other-licenses/ply/ply/yacc.py \
+  $(NULL)
 
-ifdef CROSS_COMPILE
-
-HOST_PROGRAM	= host_xpidl$(HOST_BIN_SUFFIX)
-HOST_CSRCS	= $(XPIDL_CSRCS)
-
-ifdef LIBIDL_LIBS
-BUILD_TARGET = 1
-endif
-
-else # CROSS_COMPILE
-
-BUILD_TARGET = 1
-
-endif # CROSS_COMPILE
-
-ifdef BUILD_TARGET
-PROGRAM		= xpidl$(BIN_SUFFIX)
-CSRCS 		= $(XPIDL_CSRCS)
-SDK_BINARY  	= $(PROGRAM)
-CFLAGS         += LIBIDL_CFLAGS
-LIBS           += LIBIDL_LIBS
-endif
-
-USE_STATIC_LIBS = 1
-
-ifeq ($(OS_ARCH),Darwin)
-# The only reason to not always strip the SDK out is that the libraries
-# in / on ppc currently aren't fat, preventing the target xpidl from linking
-# on a ppc->x86 build.  The SDK, presumably 10.4u, must be included in that
-# case in order to successfully link.  Because the target xpidl isn't
-# currently built in a cross compile, though, this point is moot for the
-# time being.
-_STRIP_SDK = 1
-
-ifneq (,$(_STRIP_SDK)$(MACOS_SDK_DIR))
-# libIDL is configured for the system's headers, with no SDK involved.
-# There may be header conflicts if the SDK used for the Mozilla build
-# is used here.  There are very few specific cases where the SDK needs to
-# remain set to build xpidl.
-NEXT_ROOT=
-OS_CFLAGS := $(shell echo $(OS_CFLAGS)|sed -E -e "s%((-I|-isystem )$(MACOS_SDK_DIR)/usr/(include|lib/gcc)[^ ]*)|-F$(MACOS_SDK_DIR)(/System)?/Library/Frameworks[^ ]*|-nostdinc[^ ]*|-isysroot $(MACOS_SDK_DIR)%%g")
-OS_CFLAGS := $(patsubst -I$(MACOS_SDK_DIR)%,-I%,$(OS_CFLAGS))
-OS_LIBS := $(patsubst -L$(MACOS_SDK_DIR)/usr/lib%,,$(OS_LIBS))
-LDFLAGS := $(shell echo $(LDFLAGS)|sed -E -e "s%-Wl,-syslibroot,$(MACOS_SDK_DIR)%%g")
-endif # _STRIP_SDK
-
-endif # Darwin
+export:: $(PLY_SRCS) $(SDK_BIN_DIR)/ply
+	$(INSTALL) $(IFLAGS2) $^
 
 include $(topsrcdir)/config/rules.mk
 
-CFLAGS		+= $(LIBIDL_CFLAGS)
-
-# Compile directly against the static lib, so we can use xpidl during the build
-# without the shared library path being set.
-ifneq (,$(filter WINNT OS2,$(OS_ARCH)))
-DEFINES		+= -DEXPORT_XPT_API
-ifndef GNU_CC
-LDFLAGS += \
-	-SUBSYSTEM:CONSOLE \
-	-NODEFAULTLIB:MSVCRTD \
-	-NODEFAULTLIB:LIBC \
-	$(NULL)
-
-ifneq (,$(filter-out 1700 1710,$(_MSC_VER)))
-LDFLAGS += -SAFESEH:NO
-endif
-
-ifdef STATIC_LIBIDL
-LDFLAGS += -NODEFAULTLIB:MSVCRT
-endif
-
-endif
-endif
-
-# Tell the $(PROGRAM) target that we need to be recompiled when libxpt changes.
-LIBS		= $(DIST)/lib/$(LIB_PREFIX)xpt.$(LIB_SUFFIX) $(LIBIDL_LIBS)
-EXTRA_DEPS	= $(wildcard $(DIST)/lib/$(LIB_PREFIX)xpt.*)
-
-ifdef CROSS_COMPILE
-
-HOST_CFLAGS	+= $(HOST_LIBIDL_CFLAGS)
-HOST_LIBS	= $(DIST)/host/lib/$(LIB_PREFIX)hostxpt.$(LIB_SUFFIX) $(HOST_LIBIDL_LIBS)
-HOST_EXTRA_DEPS	= $(wildcard $(DIST)/host/lib/$(LIB_PREFIX)hostxpt.*)
-
-ifdef HOST_NSPR_MDCPUCFG
-HOST_CFLAGS	+= -DMDCPUCFG=$(HOST_NSPR_MDCPUCFG)
-endif
-
-endif
-
 export::
 	@$(MAKE) libs

From f7f6b0b885ed048ff3cd34fc2abbb42cd9bf38b7 Mon Sep 17 00:00:00 2001
From: Timothy Nikkel <tnikkel@gmail.com>
Date: Sun, 18 Sep 2011 13:16:47 -0500
Subject: [PATCH 046/209] Bug 599938. Show select drop downs in the correct
 location if they are being translated by CSS transforms. r=roc

---
 layout/forms/nsComboboxControlFrame.cpp | 46 +++++++++++++++++++++++--
 layout/forms/nsComboboxControlFrame.h   |  6 ++++
 2 files changed, 50 insertions(+), 2 deletions(-)

diff --git a/layout/forms/nsComboboxControlFrame.cpp b/layout/forms/nsComboboxControlFrame.cpp
index 97e2acb1bf5f..4a8bab6e0339 100644
--- a/layout/forms/nsComboboxControlFrame.cpp
+++ b/layout/forms/nsComboboxControlFrame.cpp
@@ -544,6 +544,43 @@ nsComboboxControlFrame::ReflowDropdown(nsPresContext*  aPresContext,
   return rv;
 }
 
+nsPoint
+nsComboboxControlFrame::GetCSSTransformTranslate()
+{
+  nsIFrame* frame = this;
+  PRBool is3DTransform = PR_FALSE;
+  gfxMatrix transform;
+  while (frame) {
+    nsIFrame* parent = nsnull;
+    gfx3DMatrix ctm = frame->GetTransformMatrix(&parent);
+    gfxMatrix matrix;
+    if (ctm.Is2D(&matrix)) {
+      transform = transform * matrix;
+    } else {
+      is3DTransform = PR_TRUE;
+      break;
+    }
+    frame = parent;
+  }
+  nsPoint translation;
+  if (!is3DTransform && !transform.HasNonTranslation()) {
+    nsPresContext* pc = PresContext();
+    gfxPoint pixelTranslation = transform.GetTranslation();
+    PRInt32 apd = pc->AppUnitsPerDevPixel();
+    translation.x = NSFloatPixelsToAppUnits(float(pixelTranslation.x), apd);
+    translation.y = NSFloatPixelsToAppUnits(float(pixelTranslation.y), apd);
+    // To get the translation introduced only by transforms we subtract the
+    // regular non-transform translation.
+    nsRootPresContext* rootPC = pc->GetRootPresContext();
+    if (rootPC) {
+      translation -= GetOffsetToCrossDoc(rootPC->PresShell()->GetRootFrame());
+    } else {
+      translation.x = translation.y = 0;
+    }
+  }
+  return translation;
+}
+
 void
 nsComboboxControlFrame::AbsolutelyPositionDropDown()
 {
@@ -558,6 +595,11 @@ nsComboboxControlFrame::AbsolutelyPositionDropDown()
    // The approach, taken here is to get use the absolute position of the display frame and use it's location
    // to determine if the dropdown will go offscreen.
 
+  // Normal frame geometry (eg GetOffsetTo, mRect) doesn't include transforms.
+  // In the special case that our transform is only a 2D translation we
+  // introduce this hack so that the dropdown will show up in the right place.
+  nsPoint translation = GetCSSTransformTranslation();
+
    // Use the height calculated for the area frame so it includes both
    // the display and button heights.
   nscoord dropdownYOffset = GetRect().height;
@@ -566,7 +608,7 @@ nsComboboxControlFrame::AbsolutelyPositionDropDown()
   nsRect screen = nsFormControlFrame::GetUsableScreenRect(PresContext());
 
   // Check to see if the drop-down list will go offscreen
-  if (GetScreenRectInAppUnits().YMost() + dropdownSize.height > screen.YMost()) {
+  if ((GetScreenRectInAppUnits() + translation).YMost() + dropdownSize.height > screen.YMost()) {
     // move the dropdown list up
     dropdownYOffset = - (dropdownSize.height);
   }
@@ -581,7 +623,7 @@ nsComboboxControlFrame::AbsolutelyPositionDropDown()
   }
   dropdownPosition.y = dropdownYOffset; 
 
-  mDropdownFrame->SetPosition(dropdownPosition);
+  mDropdownFrame->SetPosition(dropdownPosition + translation);
 }
 
 //----------------------------------------------------------
diff --git a/layout/forms/nsComboboxControlFrame.h b/layout/forms/nsComboboxControlFrame.h
index 6d6c80a20701..c18608a61303 100644
--- a/layout/forms/nsComboboxControlFrame.h
+++ b/layout/forms/nsComboboxControlFrame.h
@@ -254,6 +254,12 @@ protected:
   void HandleRedisplayTextEvent();
   void ActuallyDisplayText(PRBool aNotify);
 
+private:
+  // If our total transform to the root frame of the root document is only a 2d
+  // translation then return that translation, otherwise returns (0,0).
+  nsPoint GetCSSTransformTranslation();
+
+protected:
   nsFrameList              mPopupFrames;             // additional named child list
   nsCOMPtr<nsIContent>     mDisplayContent;          // Anonymous content used to display the current selection
   nsCOMPtr<nsIContent>     mButtonContent;           // Anonymous content for the button

From 6d60a254ef7348608d0457f328ffb1978079c146 Mon Sep 17 00:00:00 2001
From: Timothy Nikkel <tnikkel@gmail.com>
Date: Sun, 18 Sep 2011 13:20:09 -0500
Subject: [PATCH 047/209] Bug 599938. Fix bustage.

---
 layout/forms/nsComboboxControlFrame.cpp | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/layout/forms/nsComboboxControlFrame.cpp b/layout/forms/nsComboboxControlFrame.cpp
index 4a8bab6e0339..7e7e9e00471b 100644
--- a/layout/forms/nsComboboxControlFrame.cpp
+++ b/layout/forms/nsComboboxControlFrame.cpp
@@ -545,7 +545,7 @@ nsComboboxControlFrame::ReflowDropdown(nsPresContext*  aPresContext,
 }
 
 nsPoint
-nsComboboxControlFrame::GetCSSTransformTranslate()
+nsComboboxControlFrame::GetCSSTransformTranslation()
 {
   nsIFrame* frame = this;
   PRBool is3DTransform = PR_FALSE;

From 0360b639f4412ea1851f38f81276cd2f53008d2e Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Rafael=20=C3=81vila=20de=20Esp=C3=ADndola?=
 <respindola@mozilla.com>
Date: Sun, 18 Sep 2011 14:43:31 -0400
Subject: [PATCH 048/209] Bug 674647 - Set MOZ_CAN_RUN_PROGRAMS in
 mozconfig.leopard and propagate it. r=khuey.

This patch sets MOZ_CAN_RUN_PROGRAMS in mozconfig.leopard so that the build
system knows it can run programs when producing 32 bit dmg files in a 64 bit
host (10.6).

The patch also propagates MOZ_CAN_RUN_PROGRAMS from the configure system to
Makefile.
---
 build/macosx/mozconfig.leopard | 2 ++
 config/autoconf.mk.in          | 1 +
 configure.in                   | 4 +++-
 js/src/config/autoconf.mk.in   | 1 +
 js/src/configure.in            | 4 +++-
 5 files changed, 10 insertions(+), 2 deletions(-)

diff --git a/build/macosx/mozconfig.leopard b/build/macosx/mozconfig.leopard
index 7086086ace3c..cdebcbb3f050 100644
--- a/build/macosx/mozconfig.leopard
+++ b/build/macosx/mozconfig.leopard
@@ -20,6 +20,8 @@ AS=$CC
 LD=ld
 STRIP="strip -x -S"
 
+MOZ_CAN_RUN_PROGRAMS=1
+
 # We do 32 bit builds for leopard
 TARGET_CPU=i386
 CC="$CC -arch $TARGET_CPU"
diff --git a/config/autoconf.mk.in b/config/autoconf.mk.in
index a7498f8d15cc..9b17f86f19e6 100644
--- a/config/autoconf.mk.in
+++ b/config/autoconf.mk.in
@@ -657,6 +657,7 @@ MACOS_SDK_DIR	= @MACOS_SDK_DIR@
 NEXT_ROOT	= @NEXT_ROOT@
 GCC_VERSION	= @GCC_VERSION@
 UNIVERSAL_BINARY= @UNIVERSAL_BINARY@
+MOZ_CAN_RUN_PROGRAMS = MOZ_CAN_RUN_PROGRAMS@
 HAVE_DTRACE= @HAVE_DTRACE@
 
 VISIBILITY_FLAGS = @VISIBILITY_FLAGS@
diff --git a/configure.in b/configure.in
index 71fe56b9f0d2..fa30b5763e7a 100644
--- a/configure.in
+++ b/configure.in
@@ -1100,8 +1100,10 @@ esac
 AC_SUBST(GCC_VERSION)
 
 dnl The universal machinery sets UNIVERSAL_BINARY to inform packager.mk
-dnl that a universal binary is being produced.
+dnl that a universal binary is being produced and MOZ_CAN_RUN_PROGRAMS
+dnl when we can run target binaries.
 AC_SUBST(UNIVERSAL_BINARY)
+AC_SUBST(MOZ_CAN_RUN_PROGRAMS)
 
 dnl ========================================================
 dnl Check for MacOS deployment target version
diff --git a/js/src/config/autoconf.mk.in b/js/src/config/autoconf.mk.in
index f76e27585984..447a45b554d6 100644
--- a/js/src/config/autoconf.mk.in
+++ b/js/src/config/autoconf.mk.in
@@ -332,6 +332,7 @@ MACOS_SDK_DIR	= @MACOS_SDK_DIR@
 NEXT_ROOT	= @NEXT_ROOT@
 GCC_VERSION	= @GCC_VERSION@
 UNIVERSAL_BINARY= @UNIVERSAL_BINARY@
+MOZ_CAN_RUN_PROGRAMS = MOZ_CAN_RUN_PROGRAMS@
 HAVE_DTRACE= @HAVE_DTRACE@
 
 VISIBILITY_FLAGS = @VISIBILITY_FLAGS@
diff --git a/js/src/configure.in b/js/src/configure.in
index c3765e7ee700..cdee12072ed0 100644
--- a/js/src/configure.in
+++ b/js/src/configure.in
@@ -1083,8 +1083,10 @@ esac
 AC_SUBST(GCC_VERSION)
 
 dnl The universal machinery sets UNIVERSAL_BINARY to inform packager.mk
-dnl that a universal binary is being produced.
+dnl that a universal binary is being produced and MOZ_CAN_RUN_PROGRAMS
+dnl when we can run target binaries.
 AC_SUBST(UNIVERSAL_BINARY)
+AC_SUBST(MOZ_CAN_RUN_PROGRAMS)
 
 dnl ========================================================
 dnl Check for MacOS deployment target version

From a0baf7e3393de315f3e123abb444a6fe4954b5be Mon Sep 17 00:00:00 2001
From: Ed Morley <bmo@edmorley.co.uk>
Date: Sun, 18 Sep 2011 20:00:07 +0100
Subject: [PATCH 049/209] Bug 609431 - Fix various LNK4221 MSVC warnings in
 js/src/Makefile.in; r=khuey

---
 js/src/Makefile.in | 41 +++++++++++++++++++++++++++++++----------
 1 file changed, 31 insertions(+), 10 deletions(-)

diff --git a/js/src/Makefile.in b/js/src/Makefile.in
index ddb233c6337b..683a87164489 100644
--- a/js/src/Makefile.in
+++ b/js/src/Makefile.in
@@ -306,7 +306,6 @@ CPPSRCS += \
 		Fragmento.cpp  \
 		LIR.cpp        \
 		njconfig.cpp   \
-		RegAlloc.cpp   \
 		avmplus.cpp    \
 		Native$(NANOJIT_ARCH).cpp \
 		jsbuiltins.cpp \
@@ -314,6 +313,10 @@ CPPSRCS += \
 		Writer.cpp     \
 		$(NULL)
 
+ifdef MOZ_DEBUG
+CPPSRCS += RegAlloc.cpp
+endif
+
 endif # ENABLE_TRACEJIT
 ifdef ENABLE_METHODJIT
 
@@ -423,17 +426,10 @@ VPATH += 	$(srcdir)/assembler \
 		$(NONE)
 
 CPPSRCS += 	Assertions.cpp \
-		ExecutableAllocatorPosix.cpp \
-		ExecutableAllocatorWin.cpp \
-		ExecutableAllocatorOS2.cpp \
 		ExecutableAllocator.cpp \
 		ARMAssembler.cpp \
-        Logging.cpp \
 		MacroAssemblerARM.cpp \
 		MacroAssemblerX86Common.cpp \
-		OSAllocatorOS2.cpp \
-		OSAllocatorPosix.cpp \
-		OSAllocatorWin.cpp \
 		PageBlock.cpp \
 		YarrInterpreter.cpp \
 		YarrJIT.cpp \
@@ -441,6 +437,26 @@ CPPSRCS += 	Assertions.cpp \
 		YarrSyntaxChecker.cpp \
 		$(NONE)
 
+ifdef MOZ_DEBUG
+CPPSRCS += Logging.cpp
+endif
+
+ifneq (,$(filter-out OS2 WINNT,$(OS_ARCH)))
+CPPSRCS += ExecutableAllocatorPosix.cpp \
+           OSAllocatorPosix.cpp \
+           $(NONE)
+endif
+ifeq ($(OS_ARCH),WINNT)
+CPPSRCS += ExecutableAllocatorWin.cpp \
+           OSAllocatorWin.cpp \
+           $(NONE)
+endif
+ifeq ($(OS_ARCH),OS2)
+CPPSRCS += ExecutableAllocatorOS2.cpp \
+           OSAllocatorOS2.cpp \
+           $(NONE)
+endif
+
 ifeq (86, $(findstring 86,$(TARGET_CPU)))
 ifeq (x86_64, $(TARGET_CPU))
 #CPPSRCS		+= only_on_x86_64.cpp
@@ -1047,14 +1063,19 @@ ifdef ENABLE_METHODJIT
 # sources a bit.
 TESTMAIN_OBJS = \
 		Assertions.$(OBJ_SUFFIX) \
-		ExecutableAllocatorPosix.$(OBJ_SUFFIX) \
-		ExecutableAllocatorWin.$(OBJ_SUFFIX) \
 		ExecutableAllocator.$(OBJ_SUFFIX) \
 		ARMAssembler.$(OBJ_SUFFIX) \
 		MacroAssemblerARM.$(OBJ_SUFFIX) \
 		TestMain.$(OBJ_SUFFIX) \
 		jsutil.$(OBJ_SUFFIX) \
 		jslog2.$(OBJ_SUFFIX)
+
+ifeq ($(OS_ARCH),WINNT)
+TESTMAIN_OBJS += ExecutableAllocatorWin.$(OBJ_SUFFIX)
+else
+TESTMAIN_OBJS += ExecutableAllocatorPosix.$(OBJ_SUFFIX)
+endif
+
 TestMain$(HOST_BIN_SUFFIX): $(TESTMAIN_OBJS)
 	$(CXX) -o TestMain$(HOST_BIN_SUFFIX) $(TESTMAIN_OBJS)
 endif

From 743e65d21d77a58282720342756088bea9d9c7e6 Mon Sep 17 00:00:00 2001
From: Ed Morley <bmo@edmorley.co.uk>
Date: Sun, 18 Sep 2011 20:02:27 +0100
Subject: [PATCH 050/209] Bug 605174 - Fix a number of build warnings in dom/
 (based on patch by Ms2ger <ms2ger@gmail.com>); r=peterv

---
 dom/base/nsDOMException.cpp                     |  2 ++
 dom/base/nsGlobalWindow.cpp                     |  3 +--
 dom/ipc/ContentParent.cpp                       | 11 ++++++-----
 dom/plugins/ipc/PluginInstanceChild.cpp         |  2 +-
 dom/plugins/ipc/PluginModuleChild.cpp           | 17 ++++++++---------
 dom/plugins/ipc/PluginModuleParent.cpp          |  2 --
 .../ipc/PluginScriptableObjectParent.cpp        |  3 ++-
 7 files changed, 20 insertions(+), 20 deletions(-)

diff --git a/dom/base/nsDOMException.cpp b/dom/base/nsDOMException.cpp
index ed0e13ed0390..4e4c56e4a1b1 100644
--- a/dom/base/nsDOMException.cpp
+++ b/dom/base/nsDOMException.cpp
@@ -115,6 +115,8 @@ NSResultToNameAndMessage(nsresult aNSResult,
                          const char** aName,
                          const char** aMessage)
 {
+  *aName = nsnull;
+  *aMessage = nsnull;
   ResultStruct* result_struct = gDOMErrorMsgMap;
 
   while (result_struct->mName) {
diff --git a/dom/base/nsGlobalWindow.cpp b/dom/base/nsGlobalWindow.cpp
index 6ba4cfdd1e52..5c43eac51e53 100644
--- a/dom/base/nsGlobalWindow.cpp
+++ b/dom/base/nsGlobalWindow.cpp
@@ -6010,8 +6010,7 @@ PostMessageReadStructuredClone(JSContext* cx,
                                uint32 data,
                                void* closure)
 {
-  StructuredCloneInfo* scInfo = static_cast<StructuredCloneInfo*>(closure);
-  NS_ASSERTION(scInfo, "Must have scInfo!");
+  NS_ASSERTION(closure, "Must have closure!");
 
   if (tag == SCTAG_DOM_BLOB || tag == SCTAG_DOM_FILELIST) {
     NS_ASSERTION(!data, "Data should be empty");
diff --git a/dom/ipc/ContentParent.cpp b/dom/ipc/ContentParent.cpp
index 232d6af0b9a6..d1efdb09f28b 100644
--- a/dom/ipc/ContentParent.cpp
+++ b/dom/ipc/ContentParent.cpp
@@ -96,6 +96,7 @@
 #include "mozilla/Services.h"
 #include "mozilla/unused.h"
 #include "nsDeviceMotion.h"
+#include "mozilla/Util.h"
 
 #include "nsIMemoryReporter.h"
 #include "nsMemoryReporterManager.h"
@@ -224,7 +225,7 @@ ContentParent::Init()
     // If accessibility is running in chrome process then start it in content
     // process.
     if (nsIPresShell::IsAccessibilityActive()) {
-        SendActivateA11y();
+        unused << SendActivateA11y();
     }
 #endif
 }
@@ -368,7 +369,7 @@ ContentParent::ActorDestroy(ActorDestroyReason why)
                 notes.Put(NS_LITERAL_CSTRING("ProcessType"), NS_LITERAL_CSTRING("content"));
 
                 char startTime[32];
-                sprintf(startTime, "%lld", static_cast<PRInt64>(mProcessStartTime));
+                sprintf(startTime, "%lld", static_cast<long long>(mProcessStartTime));
                 notes.Put(NS_LITERAL_CSTRING("StartupTime"),
                           nsDependentCString(startTime));
 
@@ -491,7 +492,7 @@ ContentParent::RecvReadPermissions(InfallibleTArray<IPC::Permission>* aPermissio
                  "We have no permissionManager in the Chrome process !");
 
     nsCOMPtr<nsISimpleEnumerator> enumerator;
-    nsresult rv = permissionManager->GetEnumerator(getter_AddRefs(enumerator));
+    DebugOnly<nsresult> rv = permissionManager->GetEnumerator(getter_AddRefs(enumerator));
     NS_ABORT_IF_FALSE(NS_SUCCEEDED(rv), "Could not get enumerator!");
     while(1) {
         PRBool hasMore;
@@ -751,7 +752,7 @@ ContentParent::Observe(nsISupports* aSubject,
             return NS_ERROR_NOT_AVAILABLE;
     }
     else if (!strcmp(aTopic, "child-memory-reporter-request")) {
-        SendPMemoryReportRequestConstructor();
+        unused << SendPMemoryReportRequestConstructor();
     }
     else if (!strcmp(aTopic, "child-gc-request")){
         SendGarbageCollect();
@@ -764,7 +765,7 @@ ContentParent::Observe(nsISupports* aSubject,
     // gets initiated in chrome process.
     else if (aData && (*aData == '1') &&
              !strcmp(aTopic, "a11y-init-or-shutdown")) {
-        SendActivateA11y();
+        unused << SendActivateA11y();
     }
 #endif
 
diff --git a/dom/plugins/ipc/PluginInstanceChild.cpp b/dom/plugins/ipc/PluginInstanceChild.cpp
index 2fc860452917..d5eccc041497 100644
--- a/dom/plugins/ipc/PluginInstanceChild.cpp
+++ b/dom/plugins/ipc/PluginInstanceChild.cpp
@@ -212,7 +212,7 @@ NPError
 PluginInstanceChild::InternalGetNPObjectForValue(NPNVariable aValue,
                                                  NPObject** aObject)
 {
-    PluginScriptableObjectChild* actor;
+    PluginScriptableObjectChild* actor = NULL;
     NPError result = NPERR_NO_ERROR;
 
     switch (aValue) {
diff --git a/dom/plugins/ipc/PluginModuleChild.cpp b/dom/plugins/ipc/PluginModuleChild.cpp
index d933b68722f4..fd517397d72f 100644
--- a/dom/plugins/ipc/PluginModuleChild.cpp
+++ b/dom/plugins/ipc/PluginModuleChild.cpp
@@ -199,13 +199,11 @@ PluginModuleChild::Init(const std::string& aPluginFilename,
 
     nsPluginFile pluginFile(localFile);
 
-    nsresult rv;
     // Maemo flash can render with any provided rectangle and so does not
     // require this quirk.
 #if defined(MOZ_X11) && !defined(MOZ_PLATFORM_MAEMO)
     nsPluginInfo info = nsPluginInfo();
-    rv = pluginFile.GetPluginInfo(info, &mLibrary);
-    if (NS_FAILED(rv))
+    if (NS_FAILED(pluginFile.GetPluginInfo(info, &mLibrary)))
         return false;
 
     NS_NAMED_LITERAL_CSTRING(flash10Head, "Shockwave Flash 10.");
@@ -216,7 +214,7 @@ PluginModuleChild::Init(const std::string& aPluginFilename,
     if (!mLibrary)
 #endif
     {
-        rv = pluginFile.LoadPlugin(&mLibrary);
+        DebugOnly<nsresult> rv = pluginFile.LoadPlugin(&mLibrary);
         NS_ASSERTION(NS_OK == rv, "trouble with mPluginFile");
     }
     NS_ASSERTION(mLibrary, "couldn't open shared object");
@@ -259,8 +257,7 @@ PluginModuleChild::Init(const std::string& aPluginFilename,
 
 #ifdef XP_MACOSX
     nsPluginInfo info = nsPluginInfo();
-    rv = pluginFile.GetPluginInfo(info, &mLibrary);
-    if (rv == NS_OK) {
+    if (pluginFile.GetPluginInfo(info, &mLibrary) == NS_OK) {
         mozilla::plugins::PluginUtilsOSX::SetProcessName(info.fName);
     }
 #endif
@@ -688,12 +685,11 @@ PluginModuleChild::RecvSetAudioSessionData(const nsID& aId,
                                            const nsString& aDisplayName,
                                            const nsString& aIconPath)
 {
-    nsresult rv;
 #if !defined XP_WIN || MOZ_WINSDK_TARGETVER < MOZ_NTDDI_LONGHORN
     NS_RUNTIMEABORT("Not Reached!");
     return false;
 #else
-    rv = mozilla::widget::RecvAudioSessionData(aId, aDisplayName, aIconPath);
+    nsresult rv = mozilla::widget::RecvAudioSessionData(aId, aDisplayName, aIconPath);
     NS_ENSURE_SUCCESS(rv, true); // Bail early if this fails
 
     // Ignore failures here; we can't really do anything about them
@@ -2080,7 +2076,10 @@ PluginModuleChild::NPN_RetainObject(NPObject* aNPObj)
 {
     AssertPluginThread();
 
-    int32_t refCnt = PR_ATOMIC_INCREMENT((int32_t*)&aNPObj->referenceCount);
+#ifdef NS_BUILD_REFCNT_LOGGING
+    int32_t refCnt =
+#endif
+    PR_ATOMIC_INCREMENT((int32_t*)&aNPObj->referenceCount);
     NS_LOG_ADDREF(aNPObj, refCnt, "NPObject", sizeof(NPObject));
 
     return aNPObj;
diff --git a/dom/plugins/ipc/PluginModuleParent.cpp b/dom/plugins/ipc/PluginModuleParent.cpp
index e040041c8998..cd1b2280fc48 100644
--- a/dom/plugins/ipc/PluginModuleParent.cpp
+++ b/dom/plugins/ipc/PluginModuleParent.cpp
@@ -774,8 +774,6 @@ PluginModuleParent::NP_Initialize(NPNetscapeFuncs* bFuncs, NPPluginFuncs* pFuncs
 {
     PLUGIN_LOG_DEBUG_METHOD;
 
-    nsresult rv;
-
     mNPNIface = bFuncs;
 
     if (mShutdown) {
diff --git a/dom/plugins/ipc/PluginScriptableObjectParent.cpp b/dom/plugins/ipc/PluginScriptableObjectParent.cpp
index 25c544cac2ba..b25ac224ca2e 100644
--- a/dom/plugins/ipc/PluginScriptableObjectParent.cpp
+++ b/dom/plugins/ipc/PluginScriptableObjectParent.cpp
@@ -41,6 +41,7 @@
 
 #include "nsNPAPIPlugin.h"
 #include "mozilla/unused.h"
+#include "mozilla/Util.h"
 
 using namespace mozilla::plugins;
 using namespace mozilla::plugins::parent;
@@ -1083,7 +1084,7 @@ PluginScriptableObjectParent::AnswerEnumerate(InfallibleTArray<PPluginIdentifier
     if (_identifierisstring(ids[index])) {
       JSString* str = NPIdentifierToString(ids[index]);
       if (!JS_StringHasBeenInterned(cx, str)) {
-        JSString* str2 = JS_InternJSString(cx, str);
+        DebugOnly<JSString*> str2 = JS_InternJSString(cx, str);
         NS_ASSERTION(str2 == str, "Interning a JS string which is currently an ID should return itself.");
       }
     }

From 83dd84960117a250b94d3b0ee609cd3923465e4e Mon Sep 17 00:00:00 2001
From: Benoit Jacob <bjacob@mozilla.com>
Date: Wed, 7 Sep 2011 17:17:45 -0400
Subject: [PATCH 051/209] Bug 683500 - glxtest should use glXGetProcAddress,
 not dlsym - r=mattwoodrow

As discussed on https://bugs.freedesktop.org/show_bug.cgi?id=40423
---
 toolkit/xre/glxtest.cpp | 32 +++++++++++++++++---------------
 1 file changed, 17 insertions(+), 15 deletions(-)

diff --git a/toolkit/xre/glxtest.cpp b/toolkit/xre/glxtest.cpp
index 25dcfe374600..d82b05efacab 100644
--- a/toolkit/xre/glxtest.cpp
+++ b/toolkit/xre/glxtest.cpp
@@ -114,39 +114,42 @@ static void glxtest()
   void *libgl = dlopen("libGL.so.1", RTLD_LAZY);
   if (!libgl)
     fatal_error("Unable to load libGL.so.1");
+  
+  typedef void* (* PFNGLXGETPROCADDRESS) (const char *);
+  PFNGLXGETPROCADDRESS glXGetProcAddress = cast<PFNGLXGETPROCADDRESS>(dlsym(libgl, "glXGetProcAddress"));
+  
+  if (!glXGetProcAddress)
+    fatal_error("Unable to find glXGetProcAddress in libGL.so.1");
 
   typedef GLXFBConfig* (* PFNGLXQUERYEXTENSION) (Display *, int *, int *);
-  PFNGLXQUERYEXTENSION glXQueryExtension = cast<PFNGLXQUERYEXTENSION>(dlsym(libgl, "glXQueryExtension"));
+  PFNGLXQUERYEXTENSION glXQueryExtension = cast<PFNGLXQUERYEXTENSION>(glXGetProcAddress("glXQueryExtension"));
 
   typedef GLXFBConfig* (* PFNGLXQUERYVERSION) (Display *, int *, int *);
   PFNGLXQUERYVERSION glXQueryVersion = cast<PFNGLXQUERYVERSION>(dlsym(libgl, "glXQueryVersion"));
 
   typedef GLXFBConfig* (* PFNGLXCHOOSEFBCONFIG) (Display *, int, const int *, int *);
-  PFNGLXCHOOSEFBCONFIG glXChooseFBConfig = cast<PFNGLXCHOOSEFBCONFIG>(dlsym(libgl, "glXChooseFBConfig"));
+  PFNGLXCHOOSEFBCONFIG glXChooseFBConfig = cast<PFNGLXCHOOSEFBCONFIG>(glXGetProcAddress("glXChooseFBConfig"));
 
   typedef XVisualInfo* (* PFNGLXGETVISUALFROMFBCONFIG) (Display *, GLXFBConfig);
-  PFNGLXGETVISUALFROMFBCONFIG glXGetVisualFromFBConfig = cast<PFNGLXGETVISUALFROMFBCONFIG>(dlsym(libgl, "glXGetVisualFromFBConfig"));
+  PFNGLXGETVISUALFROMFBCONFIG glXGetVisualFromFBConfig = cast<PFNGLXGETVISUALFROMFBCONFIG>(glXGetProcAddress("glXGetVisualFromFBConfig"));
 
   typedef GLXPixmap (* PFNGLXCREATEPIXMAP) (Display *, GLXFBConfig, Pixmap, const int *);
-  PFNGLXCREATEPIXMAP glXCreatePixmap = cast<PFNGLXCREATEPIXMAP>(dlsym(libgl, "glXCreatePixmap"));
+  PFNGLXCREATEPIXMAP glXCreatePixmap = cast<PFNGLXCREATEPIXMAP>(glXGetProcAddress("glXCreatePixmap"));
 
   typedef GLXContext (* PFNGLXCREATENEWCONTEXT) (Display *, GLXFBConfig, int, GLXContext, Bool);
-  PFNGLXCREATENEWCONTEXT glXCreateNewContext = cast<PFNGLXCREATENEWCONTEXT>(dlsym(libgl, "glXCreateNewContext"));
+  PFNGLXCREATENEWCONTEXT glXCreateNewContext = cast<PFNGLXCREATENEWCONTEXT>(glXGetProcAddress("glXCreateNewContext"));
 
   typedef Bool (* PFNGLXMAKECURRENT) (Display*, GLXDrawable, GLXContext);
-  PFNGLXMAKECURRENT glXMakeCurrent = cast<PFNGLXMAKECURRENT>(dlsym(libgl, "glXMakeCurrent"));
+  PFNGLXMAKECURRENT glXMakeCurrent = cast<PFNGLXMAKECURRENT>(glXGetProcAddress("glXMakeCurrent"));
 
   typedef void (* PFNGLXDESTROYPIXMAP) (Display *, GLXPixmap);
-  PFNGLXDESTROYPIXMAP glXDestroyPixmap = cast<PFNGLXDESTROYPIXMAP>(dlsym(libgl, "glXDestroyPixmap"));
+  PFNGLXDESTROYPIXMAP glXDestroyPixmap = cast<PFNGLXDESTROYPIXMAP>(glXGetProcAddress("glXDestroyPixmap"));
 
   typedef void (* PFNGLXDESTROYCONTEXT) (Display*, GLXContext);
-  PFNGLXDESTROYCONTEXT glXDestroyContext = cast<PFNGLXDESTROYCONTEXT>(dlsym(libgl, "glXDestroyContext"));
+  PFNGLXDESTROYCONTEXT glXDestroyContext = cast<PFNGLXDESTROYCONTEXT>(glXGetProcAddress("glXDestroyContext"));
 
   typedef GLubyte* (* PFNGLGETSTRING) (GLenum);
-  PFNGLGETSTRING glGetString = cast<PFNGLGETSTRING>(dlsym(libgl, "glGetString"));
-
-  typedef void* (* PFNGLXGETPROCADDRESS) (const char *);
-  PFNGLXGETPROCADDRESS glXGetProcAddress = cast<PFNGLXGETPROCADDRESS>(dlsym(libgl, "glXGetProcAddress"));
+  PFNGLGETSTRING glGetString = cast<PFNGLGETSTRING>(glXGetProcAddress("glGetString"));
 
   if (!glXQueryExtension ||
       !glXQueryVersion ||
@@ -157,10 +160,9 @@ static void glxtest()
       !glXMakeCurrent ||
       !glXDestroyPixmap ||
       !glXDestroyContext ||
-      !glGetString ||
-      !glXGetProcAddress)
+      !glGetString)
   {
-    fatal_error("Unable to find required symbols in libGL.so.1");
+    fatal_error("glXGetProcAddress couldn't find required functions");
   }
   ///// Open a connection to the X server /////
   Display *dpy = XOpenDisplay(NULL);

From 812c11de6083a7c414dd87c5187625a04e783df1 Mon Sep 17 00:00:00 2001
From: Benoit Jacob <bjacob@mozilla.com>
Date: Wed, 7 Sep 2011 17:17:44 -0400
Subject: [PATCH 052/209] Bug 681026 - always get data from glxtest process and
 waitpid() for it - r=joe

This patch makes GetShouldAccelerate directly call GetData, just before the place where we call GetFeatureStatus, which we know is reached.

Initially I considered instead calling GetData from GfxInfo::Init() but that turned out to be a bad idea: Init() is called by the factory constructor, which is called significantly earlier in the startup process. We want to call GetData as late as possible, just when we need it, to maximize chances that the glxtest process be already finished by the time we waitpid() it, so that we don't end up wasting time waiting for it.
---
 widget/public/nsIGfxInfo.idl          | 3 +++
 widget/src/xpwidgets/GfxInfoBase.h    | 3 +++
 widget/src/xpwidgets/GfxInfoX11.h     | 3 ++-
 widget/src/xpwidgets/nsBaseWidget.cpp | 8 ++++++--
 4 files changed, 14 insertions(+), 3 deletions(-)

diff --git a/widget/public/nsIGfxInfo.idl b/widget/public/nsIGfxInfo.idl
index 72f12e88e260..81616fe51b66 100644
--- a/widget/public/nsIGfxInfo.idl
+++ b/widget/public/nsIGfxInfo.idl
@@ -143,5 +143,8 @@ interface nsIGfxInfo : nsISupports
    * underlying GL impl that's used to implement WebGL.
    */
   DOMString getWebGLParameter(in DOMString aParam);
+
+  // only useful on X11
+  [noscript, notxpcom] void GetData();
 };
 
diff --git a/widget/src/xpwidgets/GfxInfoBase.h b/widget/src/xpwidgets/GfxInfoBase.h
index b2f27d369337..1519ebd9bacd 100644
--- a/widget/src/xpwidgets/GfxInfoBase.h
+++ b/widget/src/xpwidgets/GfxInfoBase.h
@@ -84,6 +84,9 @@ public:
   // Ideally, Init() would be void-return, but the rules of
   // NS_GENERIC_FACTORY_CONSTRUCTOR_INIT require it be nsresult return.
   virtual nsresult Init();
+  
+  // only useful on X11
+  virtual void GetData() { }
 
 protected:
 
diff --git a/widget/src/xpwidgets/GfxInfoX11.h b/widget/src/xpwidgets/GfxInfoX11.h
index e907aff0e04d..dd1a9c2f878f 100644
--- a/widget/src/xpwidgets/GfxInfoX11.h
+++ b/widget/src/xpwidgets/GfxInfoX11.h
@@ -76,6 +76,8 @@ public:
   using GfxInfoBase::GetWebGLParameter;
 
   virtual nsresult Init();
+  
+  virtual void GetData();
 
 protected:
 
@@ -91,7 +93,6 @@ private:
   int mMajorVersion, mMinorVersion, mRevisionVersion;
 
   void AddCrashReportAnnotations();
-  void GetData();
 };
 
 } // namespace widget
diff --git a/widget/src/xpwidgets/nsBaseWidget.cpp b/widget/src/xpwidgets/nsBaseWidget.cpp
index 55684b911084..fdc6a5407f90 100644
--- a/widget/src/xpwidgets/nsBaseWidget.cpp
+++ b/widget/src/xpwidgets/nsBaseWidget.cpp
@@ -827,10 +827,14 @@ nsBaseWidget::GetShouldAccelerate()
 
   bool whitelisted = false;
 
-  // bug 655578: on X11 at least, we must always call GetFeatureStatus (even if we don't need that information)
-  // as that's what causes GfxInfo initialization which kills the zombie 'glxtest' process.
   nsCOMPtr<nsIGfxInfo> gfxInfo = do_GetService("@mozilla.org/gfx/info;1");
   if (gfxInfo) {
+    // bug 655578: on X11 at least, we must always call GetData (even if we don't need that information)
+    // as that's what causes GfxInfo initialization which kills the zombie 'glxtest' process.
+    // initially we relied on the fact that GetFeatureStatus calls GetData for us, but bug 681026 showed
+    // that assumption to be unsafe.
+    gfxInfo->GetData();
+
     PRInt32 status;
     if (NS_SUCCEEDED(gfxInfo->GetFeatureStatus(nsIGfxInfo::FEATURE_OPENGL_LAYERS, &status))) {
       if (status == nsIGfxInfo::FEATURE_NO_INFO) {

From dba887942725339f8c1f80c472359fcf614e396a Mon Sep 17 00:00:00 2001
From: Benoit Jacob <bjacob@mozilla.com>
Date: Sun, 18 Sep 2011 21:29:08 -0400
Subject: [PATCH 053/209] Backed out changeset 432a30ebd148

---
 widget/public/nsIGfxInfo.idl          | 3 ---
 widget/src/xpwidgets/GfxInfoBase.h    | 3 ---
 widget/src/xpwidgets/GfxInfoX11.h     | 3 +--
 widget/src/xpwidgets/nsBaseWidget.cpp | 8 ++------
 4 files changed, 3 insertions(+), 14 deletions(-)

diff --git a/widget/public/nsIGfxInfo.idl b/widget/public/nsIGfxInfo.idl
index 81616fe51b66..72f12e88e260 100644
--- a/widget/public/nsIGfxInfo.idl
+++ b/widget/public/nsIGfxInfo.idl
@@ -143,8 +143,5 @@ interface nsIGfxInfo : nsISupports
    * underlying GL impl that's used to implement WebGL.
    */
   DOMString getWebGLParameter(in DOMString aParam);
-
-  // only useful on X11
-  [noscript, notxpcom] void GetData();
 };
 
diff --git a/widget/src/xpwidgets/GfxInfoBase.h b/widget/src/xpwidgets/GfxInfoBase.h
index 1519ebd9bacd..b2f27d369337 100644
--- a/widget/src/xpwidgets/GfxInfoBase.h
+++ b/widget/src/xpwidgets/GfxInfoBase.h
@@ -84,9 +84,6 @@ public:
   // Ideally, Init() would be void-return, but the rules of
   // NS_GENERIC_FACTORY_CONSTRUCTOR_INIT require it be nsresult return.
   virtual nsresult Init();
-  
-  // only useful on X11
-  virtual void GetData() { }
 
 protected:
 
diff --git a/widget/src/xpwidgets/GfxInfoX11.h b/widget/src/xpwidgets/GfxInfoX11.h
index dd1a9c2f878f..e907aff0e04d 100644
--- a/widget/src/xpwidgets/GfxInfoX11.h
+++ b/widget/src/xpwidgets/GfxInfoX11.h
@@ -76,8 +76,6 @@ public:
   using GfxInfoBase::GetWebGLParameter;
 
   virtual nsresult Init();
-  
-  virtual void GetData();
 
 protected:
 
@@ -93,6 +91,7 @@ private:
   int mMajorVersion, mMinorVersion, mRevisionVersion;
 
   void AddCrashReportAnnotations();
+  void GetData();
 };
 
 } // namespace widget
diff --git a/widget/src/xpwidgets/nsBaseWidget.cpp b/widget/src/xpwidgets/nsBaseWidget.cpp
index fdc6a5407f90..55684b911084 100644
--- a/widget/src/xpwidgets/nsBaseWidget.cpp
+++ b/widget/src/xpwidgets/nsBaseWidget.cpp
@@ -827,14 +827,10 @@ nsBaseWidget::GetShouldAccelerate()
 
   bool whitelisted = false;
 
+  // bug 655578: on X11 at least, we must always call GetFeatureStatus (even if we don't need that information)
+  // as that's what causes GfxInfo initialization which kills the zombie 'glxtest' process.
   nsCOMPtr<nsIGfxInfo> gfxInfo = do_GetService("@mozilla.org/gfx/info;1");
   if (gfxInfo) {
-    // bug 655578: on X11 at least, we must always call GetData (even if we don't need that information)
-    // as that's what causes GfxInfo initialization which kills the zombie 'glxtest' process.
-    // initially we relied on the fact that GetFeatureStatus calls GetData for us, but bug 681026 showed
-    // that assumption to be unsafe.
-    gfxInfo->GetData();
-
     PRInt32 status;
     if (NS_SUCCEEDED(gfxInfo->GetFeatureStatus(nsIGfxInfo::FEATURE_OPENGL_LAYERS, &status))) {
       if (status == nsIGfxInfo::FEATURE_NO_INFO) {

From 111896e34566f1062d62aa11fbcc2a07463a7651 Mon Sep 17 00:00:00 2001
From: Benoit Jacob <bjacob@mozilla.com>
Date: Wed, 7 Sep 2011 17:17:44 -0400
Subject: [PATCH 054/209] Bug 681026 - always get data from glxtest process and
 waitpid() for it - r=joe

This patch makes GetShouldAccelerate directly call GetData, just before the place where we call GetFeatureStatus, which we know is reached.

Initially I considered instead calling GetData from GfxInfo::Init() but that turned out to be a bad idea: Init() is called by the factory constructor, which is called significantly earlier in the startup process. We want to call GetData as late as possible, just when we need it, to maximize chances that the glxtest process be already finished by the time we waitpid() it, so that we don't end up wasting time waiting for it.
---
 widget/public/nsIGfxInfo.idl          | 3 +++
 widget/src/xpwidgets/GfxInfoBase.h    | 3 +++
 widget/src/xpwidgets/GfxInfoX11.h     | 3 ++-
 widget/src/xpwidgets/nsBaseWidget.cpp | 8 ++++++--
 4 files changed, 14 insertions(+), 3 deletions(-)

diff --git a/widget/public/nsIGfxInfo.idl b/widget/public/nsIGfxInfo.idl
index 72f12e88e260..81616fe51b66 100644
--- a/widget/public/nsIGfxInfo.idl
+++ b/widget/public/nsIGfxInfo.idl
@@ -143,5 +143,8 @@ interface nsIGfxInfo : nsISupports
    * underlying GL impl that's used to implement WebGL.
    */
   DOMString getWebGLParameter(in DOMString aParam);
+
+  // only useful on X11
+  [noscript, notxpcom] void GetData();
 };
 
diff --git a/widget/src/xpwidgets/GfxInfoBase.h b/widget/src/xpwidgets/GfxInfoBase.h
index b2f27d369337..ebf43de2b6ef 100644
--- a/widget/src/xpwidgets/GfxInfoBase.h
+++ b/widget/src/xpwidgets/GfxInfoBase.h
@@ -84,6 +84,9 @@ public:
   // Ideally, Init() would be void-return, but the rules of
   // NS_GENERIC_FACTORY_CONSTRUCTOR_INIT require it be nsresult return.
   virtual nsresult Init();
+  
+  // only useful on X11
+  NS_IMETHOD_(void) GetData() { }
 
 protected:
 
diff --git a/widget/src/xpwidgets/GfxInfoX11.h b/widget/src/xpwidgets/GfxInfoX11.h
index e907aff0e04d..eaf8e7e5ee4b 100644
--- a/widget/src/xpwidgets/GfxInfoX11.h
+++ b/widget/src/xpwidgets/GfxInfoX11.h
@@ -76,6 +76,8 @@ public:
   using GfxInfoBase::GetWebGLParameter;
 
   virtual nsresult Init();
+  
+  NS_IMETHOD_(void) GetData();
 
 protected:
 
@@ -91,7 +93,6 @@ private:
   int mMajorVersion, mMinorVersion, mRevisionVersion;
 
   void AddCrashReportAnnotations();
-  void GetData();
 };
 
 } // namespace widget
diff --git a/widget/src/xpwidgets/nsBaseWidget.cpp b/widget/src/xpwidgets/nsBaseWidget.cpp
index 55684b911084..fdc6a5407f90 100644
--- a/widget/src/xpwidgets/nsBaseWidget.cpp
+++ b/widget/src/xpwidgets/nsBaseWidget.cpp
@@ -827,10 +827,14 @@ nsBaseWidget::GetShouldAccelerate()
 
   bool whitelisted = false;
 
-  // bug 655578: on X11 at least, we must always call GetFeatureStatus (even if we don't need that information)
-  // as that's what causes GfxInfo initialization which kills the zombie 'glxtest' process.
   nsCOMPtr<nsIGfxInfo> gfxInfo = do_GetService("@mozilla.org/gfx/info;1");
   if (gfxInfo) {
+    // bug 655578: on X11 at least, we must always call GetData (even if we don't need that information)
+    // as that's what causes GfxInfo initialization which kills the zombie 'glxtest' process.
+    // initially we relied on the fact that GetFeatureStatus calls GetData for us, but bug 681026 showed
+    // that assumption to be unsafe.
+    gfxInfo->GetData();
+
     PRInt32 status;
     if (NS_SUCCEEDED(gfxInfo->GetFeatureStatus(nsIGfxInfo::FEATURE_OPENGL_LAYERS, &status))) {
       if (status == nsIGfxInfo::FEATURE_NO_INFO) {

From eb64d2be1c2947e57c278071fc0f58279036e572 Mon Sep 17 00:00:00 2001
From: Jiten <jitenmt@gmail.com>
Date: Tue, 13 Sep 2011 19:53:51 +0200
Subject: [PATCH 055/209] Bug 655647 - Allow per-process GC/CC from
 about:memory. r=dougt

---
 dom/ipc/ContentChild.cpp                         | 16 ++++++++++++++++
 dom/ipc/ContentChild.h                           |  3 +++
 dom/ipc/ContentParent.cpp                        | 10 ++++++++++
 dom/ipc/Makefile.in                              |  1 +
 dom/ipc/PContent.ipdl                            |  3 +++
 .../aboutmemory/content/aboutMemory.js           |  6 ++++++
 6 files changed, 39 insertions(+)

diff --git a/dom/ipc/ContentChild.cpp b/dom/ipc/ContentChild.cpp
index 3a8799fa0463..65a0539d3542 100644
--- a/dom/ipc/ContentChild.cpp
+++ b/dom/ipc/ContentChild.cpp
@@ -73,6 +73,7 @@
 #include "nsWeakReference.h"
 #include "nsIScriptError.h"
 #include "nsIConsoleService.h"
+#include "nsJSEnvironment.h"
 
 #include "History.h"
 #include "nsDocShellCID.h"
@@ -763,5 +764,20 @@ ContentChild::GetIndexedDBPath()
     return *gIndexedDBPath;
 }
 
+bool
+ContentChild::RecvGarbageCollect()
+{
+    nsJSContext::GarbageCollectNow();
+    return true;
+}
+
+bool
+ContentChild::RecvCycleCollect()
+{
+    nsJSContext::GarbageCollectNow();
+    nsJSContext::CycleCollectNow();
+    return true;
+}
+
 } // namespace dom
 } // namespace mozilla
diff --git a/dom/ipc/ContentChild.h b/dom/ipc/ContentChild.h
index db220eeaeecb..4ab35c5e4ed6 100644
--- a/dom/ipc/ContentChild.h
+++ b/dom/ipc/ContentChild.h
@@ -148,6 +148,9 @@ public:
 
     virtual bool RecvActivateA11y();
 
+    virtual bool RecvGarbageCollect();
+    virtual bool RecvCycleCollect();
+
 #ifdef ANDROID
     gfxIntSize GetScreenSize() { return mScreenSize; }
 #endif
diff --git a/dom/ipc/ContentParent.cpp b/dom/ipc/ContentParent.cpp
index 3fd4e6e9d540..232d6af0b9a6 100644
--- a/dom/ipc/ContentParent.cpp
+++ b/dom/ipc/ContentParent.cpp
@@ -200,6 +200,8 @@ ContentParent::Init()
         obs->AddObserver(this, NS_IPC_IOSERVICE_SET_OFFLINE_TOPIC, PR_FALSE);
         obs->AddObserver(this, "child-memory-reporter-request", PR_FALSE);
         obs->AddObserver(this, "memory-pressure", PR_FALSE);
+        obs->AddObserver(this, "child-gc-request", PR_FALSE);
+        obs->AddObserver(this, "child-cc-request", PR_FALSE);
 #ifdef ACCESSIBILITY
         obs->AddObserver(this, "a11y-init-or-shutdown", PR_FALSE);
 #endif
@@ -304,6 +306,8 @@ ContentParent::ActorDestroy(ActorDestroyReason why)
         obs->RemoveObserver(static_cast<nsIObserver*>(this), "memory-pressure");
         obs->RemoveObserver(static_cast<nsIObserver*>(this), "child-memory-reporter-request");
         obs->RemoveObserver(static_cast<nsIObserver*>(this), NS_IPC_IOSERVICE_SET_OFFLINE_TOPIC);
+        obs->RemoveObserver(static_cast<nsIObserver*>(this), "child-gc-request");
+        obs->RemoveObserver(static_cast<nsIObserver*>(this), "child-cc-request");
 #ifdef ACCESSIBILITY
         obs->RemoveObserver(static_cast<nsIObserver*>(this), "a11y-init-or-shutdown");
 #endif
@@ -749,6 +753,12 @@ ContentParent::Observe(nsISupports* aSubject,
     else if (!strcmp(aTopic, "child-memory-reporter-request")) {
         SendPMemoryReportRequestConstructor();
     }
+    else if (!strcmp(aTopic, "child-gc-request")){
+        SendGarbageCollect();
+    }
+    else if (!strcmp(aTopic, "child-cc-request")){
+        SendCycleCollect();
+    }
 #ifdef ACCESSIBILITY
     // Make sure accessibility is running in content process when accessibility
     // gets initiated in chrome process.
diff --git a/dom/ipc/Makefile.in b/dom/ipc/Makefile.in
index 53a5caa20f64..627109a6db34 100644
--- a/dom/ipc/Makefile.in
+++ b/dom/ipc/Makefile.in
@@ -105,6 +105,7 @@ LOCAL_INCLUDES += \
 	-I$(srcdir)/../../xpcom/base \
 	-I$(srcdir)/../indexedDB \
 	-I$(topsrcdir)/extensions/cookie \
+	-I$(topsrcdir)/dom/base \
 	$(NULL)
 
 DEFINES += -DBIN_SUFFIX='"$(BIN_SUFFIX)"'
diff --git a/dom/ipc/PContent.ipdl b/dom/ipc/PContent.ipdl
index 13281e49a501..22b2243750dc 100644
--- a/dom/ipc/PContent.ipdl
+++ b/dom/ipc/PContent.ipdl
@@ -129,6 +129,9 @@ child:
 
     FlushMemory(nsString reason);
 
+    GarbageCollect();
+    CycleCollect();
+    
     /**
      * Start accessibility engine in content process.
      */
diff --git a/toolkit/components/aboutmemory/content/aboutMemory.js b/toolkit/components/aboutmemory/content/aboutMemory.js
index 36d38c0e9b0a..ca0216a80513 100644
--- a/toolkit/components/aboutmemory/content/aboutMemory.js
+++ b/toolkit/components/aboutmemory/content/aboutMemory.js
@@ -144,6 +144,9 @@ function $(n)
 function doGlobalGC()
 {
   Cu.forceGC();
+  var os = Cc["@mozilla.org/observer-service;1"]
+            .getService(Ci.nsIObserverService);
+  os.notifyObservers(null, "child-gc-request", null);
   update();
 }
 
@@ -152,6 +155,9 @@ function doCC()
   window.QueryInterface(Ci.nsIInterfaceRequestor)
         .getInterface(Ci.nsIDOMWindowUtils)
         .cycleCollect();
+  var os = Cc["@mozilla.org/observer-service;1"]
+            .getService(Ci.nsIObserverService);
+  os.notifyObservers(null, "child-cc-request", null);
   update();
 }
 

From f04d86218f41e0e4cea9f57d418cb8fb65a9a631 Mon Sep 17 00:00:00 2001
From: Jesper Kristensen <mail@jesperkristensen.dk>
Date: Tue, 13 Sep 2011 14:58:54 -0400
Subject: [PATCH 056/209] Bug 591780 - Part 1: Backend support for adding and
 removing spell checker dictionaries at runtime; r=ehsan

---
 browser/base/content/nsContextMenu.js         |   6 +-
 editor/composer/src/nsEditorSpellCheck.cpp    |  27 ++-
 editor/idl/nsIEditorSpellCheck.idl            |   9 +-
 editor/libeditor/base/Makefile.in             |   1 +
 editor/libeditor/base/nsEditor.cpp            |  63 +++++-
 editor/libeditor/base/nsEditor.h              |   5 +
 editor/txtsvc/public/nsISpellChecker.h        |  12 +-
 extensions/spellcheck/Makefile.in             |   4 +
 .../spellcheck/hunspell/src/Makefile.in       |   2 +
 .../spellcheck/hunspell/src/mozHunspell.cpp   |  86 +++++++-
 .../spellcheck/hunspell/src/mozHunspell.h     |   6 +
 .../idl/mozISpellCheckingEngine.idl           |  35 ++-
 .../spellcheck/src/mozInlineSpellChecker.cpp  |  12 +-
 .../spellcheck/src/mozInlineSpellChecker.h    |   4 +-
 extensions/spellcheck/src/mozSpellChecker.cpp | 202 +++++++++---------
 extensions/spellcheck/src/mozSpellChecker.h   |  10 +-
 .../spellcheck/src/mozSpellCheckerFactory.cpp |  34 +--
 extensions/spellcheck/tests/Makefile.in       |  48 +++++
 .../spellcheck/tests/chrome/Makefile.in       |  54 +++++
 .../spellcheck/tests/chrome/base/Makefile.in  |  52 +++++
 .../spellcheck/tests/chrome/base/base_utf.aff | 198 +++++++++++++++++
 .../spellcheck/tests/chrome/base/base_utf.dic |  29 +++
 .../spellcheck/tests/chrome/map/Makefile.in   |  52 +++++
 .../spellcheck/tests/chrome/map/maputf.aff    |  11 +
 .../spellcheck/tests/chrome/map/maputf.dic    |   4 +
 .../chrome/test_add_remove_dictionaries.xul   | 110 ++++++++++
 26 files changed, 911 insertions(+), 165 deletions(-)
 create mode 100644 extensions/spellcheck/tests/Makefile.in
 create mode 100644 extensions/spellcheck/tests/chrome/Makefile.in
 create mode 100644 extensions/spellcheck/tests/chrome/base/Makefile.in
 create mode 100644 extensions/spellcheck/tests/chrome/base/base_utf.aff
 create mode 100644 extensions/spellcheck/tests/chrome/base/base_utf.dic
 create mode 100644 extensions/spellcheck/tests/chrome/map/Makefile.in
 create mode 100644 extensions/spellcheck/tests/chrome/map/maputf.aff
 create mode 100644 extensions/spellcheck/tests/chrome/map/maputf.dic
 create mode 100644 extensions/spellcheck/tests/chrome/test_add_remove_dictionaries.xul

diff --git a/browser/base/content/nsContextMenu.js b/browser/base/content/nsContextMenu.js
index ef892d24d47d..b0245400947c 100644
--- a/browser/base/content/nsContextMenu.js
+++ b/browser/base/content/nsContextMenu.js
@@ -321,10 +321,8 @@ nsContextMenu.prototype = {
     var onMisspelling = InlineSpellCheckerUI.overMisspelling;
     this.showItem("spell-check-enabled", canSpell);
     this.showItem("spell-separator", canSpell || this.onEditableArea);
-    if (canSpell) {
-      document.getElementById("spell-check-enabled")
-              .setAttribute("checked", InlineSpellCheckerUI.enabled);
-    }
+    document.getElementById("spell-check-enabled")
+            .setAttribute("checked", canSpell && InlineSpellCheckerUI.enabled);
 
     this.showItem("spell-add-to-dictionary", onMisspelling);
 
diff --git a/editor/composer/src/nsEditorSpellCheck.cpp b/editor/composer/src/nsEditorSpellCheck.cpp
index 8eea444ac9c1..f3eee8e10a5d 100644
--- a/editor/composer/src/nsEditorSpellCheck.cpp
+++ b/editor/composer/src/nsEditorSpellCheck.cpp
@@ -558,6 +558,31 @@ nsEditorSpellCheck::SetCurrentDictionary(const nsAString& aDictionary)
   return mSpellChecker->SetCurrentDictionary(aDictionary);
 }
 
+NS_IMETHODIMP
+nsEditorSpellCheck::CheckCurrentDictionary()
+{
+  mSpellChecker->CheckCurrentDictionary();
+
+  // Check if our current dictionary is still available.
+  nsAutoString currentDictionary;
+  nsresult rv = GetCurrentDictionary(currentDictionary);
+  if (NS_SUCCEEDED(rv) && !currentDictionary.IsEmpty()) {
+    return NS_OK;
+  }
+
+  // If our preferred current dictionary has gone, pick another one.
+  nsTArray<nsString> dictList;
+  rv = mSpellChecker->GetDictionaryList(&dictList);
+  NS_ENSURE_SUCCESS(rv, rv);
+
+  if (dictList.Length() > 0) {
+    rv = SetCurrentDictionary(dictList[0]);
+    NS_ENSURE_SUCCESS(rv, rv);
+  }
+
+  return NS_OK;
+}
+
 NS_IMETHODIMP    
 nsEditorSpellCheck::UninitSpellChecker()
 {
@@ -658,8 +683,6 @@ nsEditorSpellCheck::UpdateCurrentDictionary()
     }
   }
 
-  SetCurrentDictionary(EmptyString());
-
   if (NS_SUCCEEDED(rv) && !dictName.IsEmpty()) {
     rv = SetCurrentDictionary(dictName);
     if (NS_FAILED(rv)) {
diff --git a/editor/idl/nsIEditorSpellCheck.idl b/editor/idl/nsIEditorSpellCheck.idl
index f06eabff7159..32075e448665 100644
--- a/editor/idl/nsIEditorSpellCheck.idl
+++ b/editor/idl/nsIEditorSpellCheck.idl
@@ -41,10 +41,17 @@
 interface nsIEditor;
 interface nsITextServicesFilter;
 
-[scriptable, uuid(af84da62-588f-409f-847d-feecc991bd93)]
+[scriptable, uuid(334946c3-0e93-4aac-b662-e1b56f95d68b)]
 interface nsIEditorSpellCheck : nsISupports
 {
 
+  /**
+   * Call this on any change in installed dictionaries to ensure that the spell
+   * checker is not using a current dictionary which is no longer available.
+   * If the current dictionary is no longer available, then pick another one.
+   */
+  void checkCurrentDictionary();
+
  /**
    * Returns true if we can enable spellchecking. If there are no available
    * dictionaries, this will return false.
diff --git a/editor/libeditor/base/Makefile.in b/editor/libeditor/base/Makefile.in
index acedb86f4994..66b7463345a3 100644
--- a/editor/libeditor/base/Makefile.in
+++ b/editor/libeditor/base/Makefile.in
@@ -94,4 +94,5 @@ INCLUDES	+= \
 		-I$(topsrcdir)/content/base/src \
 		-I$(topsrcdir)/content/events/src \
 		-I$(topsrcdir)/layout/style \
+		-I$(topsrcdir)/extensions/spellcheck/src \
 		$(NULL)
diff --git a/editor/libeditor/base/nsEditor.cpp b/editor/libeditor/base/nsEditor.cpp
index d0ccd576b3d1..cd72bc1fce6b 100644
--- a/editor/libeditor/base/nsEditor.cpp
+++ b/editor/libeditor/base/nsEditor.cpp
@@ -24,6 +24,7 @@
  *   Daniel Glazman <glazman@netscape.com>
  *   Masayuki Nakano <masayuki@d-toybox.com>
  *   Mats Palmgren <matspal@gmail.com>
+ *   Jesper Kristensen <mail@jesperkristensen.dk>
  *
  * Alternatively, the contents of this file may be used under the terms of
  * either of the GNU General Public License Version 2 or later (the "GPL"),
@@ -48,6 +49,11 @@
 #include "nsFocusManager.h"
 #include "nsUnicharUtils.h"
 #include "nsReadableUtils.h"
+#include "nsIObserverService.h"
+#include "mozilla/Services.h"
+#include "mozISpellCheckingEngine.h"
+#include "nsIEditorSpellCheck.h"
+#include "mozInlineSpellChecker.h"
 
 #include "nsIDOMText.h"
 #include "nsIDOMElement.h"
@@ -207,6 +213,7 @@ NS_INTERFACE_MAP_BEGIN_CYCLE_COLLECTION(nsEditor)
  NS_INTERFACE_MAP_ENTRY(nsISupportsWeakReference)
  NS_INTERFACE_MAP_ENTRY(nsIEditorIMESupport)
  NS_INTERFACE_MAP_ENTRY(nsIEditor)
+ NS_INTERFACE_MAP_ENTRY(nsIObserver)
  NS_INTERFACE_MAP_ENTRY_AMBIGUOUS(nsISupports, nsIEditor)
 NS_INTERFACE_MAP_END
 
@@ -300,6 +307,13 @@ nsEditor::PostCreate()
     // update the UI with our state
     NotifyDocumentListeners(eDocumentCreated);
     NotifyDocumentListeners(eDocumentStateChanged);
+
+    nsCOMPtr<nsIObserverService> obs = mozilla::services::GetObserverService();
+    if (obs) {
+      obs->AddObserver(this,
+                       SPELLCHECK_DICTIONARY_UPDATE_NOTIFICATION,
+                       PR_FALSE);
+    }
   }
 
   // update nsTextStateManager and caret if we have focus
@@ -412,6 +426,12 @@ nsEditor::PreDestroy(PRBool aDestroyingFrames)
   if (mDidPreDestroy)
     return NS_OK;
 
+  nsCOMPtr<nsIObserverService> obs = mozilla::services::GetObserverService();
+  if (obs) {
+    obs->RemoveObserver(this,
+                        SPELLCHECK_DICTIONARY_UPDATE_NOTIFICATION);
+  }
+
   // Let spellchecker clean up its observers etc. It is important not to
   // actually free the spellchecker here, since the spellchecker could have
   // caused flush notifications, which could have gotten here if a textbox
@@ -1283,6 +1303,13 @@ NS_IMETHODIMP nsEditor::GetInlineSpellChecker(PRBool autoCreate,
     return autoCreate ? NS_ERROR_NOT_AVAILABLE : NS_OK;
   }
 
+  // We don't want to show the spell checking UI if there are no spell check dictionaries available.
+  PRBool canSpell = mozInlineSpellChecker::CanEnableInlineSpellChecking();
+  if (!canSpell) {
+    *aInlineSpellChecker = nsnull;
+    return NS_ERROR_FAILURE;
+  }
+
   nsresult rv;
   if (!mInlineSpellChecker && autoCreate) {
     mInlineSpellChecker = do_CreateInstance(MOZ_INLINESPELLCHECKER_CONTRACTID, &rv);
@@ -1301,17 +1328,49 @@ NS_IMETHODIMP nsEditor::GetInlineSpellChecker(PRBool autoCreate,
   return NS_OK;
 }
 
+NS_IMETHODIMP nsEditor::Observe(nsISupports* aSubj, const char *aTopic,
+                                const PRUnichar *aData)
+{
+  NS_ASSERTION(!strcmp(aTopic,
+                       SPELLCHECK_DICTIONARY_UPDATE_NOTIFICATION),
+               "Unexpected observer topic");
+
+  // When mozInlineSpellChecker::CanEnableInlineSpellChecking changes
+  SyncRealTimeSpell();
+
+  // When nsIEditorSpellCheck::GetCurrentDictionary changes
+  if (mInlineSpellChecker) {
+    // if the current dictionary is no longer available, find another one
+    nsCOMPtr<nsIEditorSpellCheck> editorSpellCheck;
+    mInlineSpellChecker->GetSpellChecker(getter_AddRefs(editorSpellCheck));
+    if (editorSpellCheck) {
+      // Note: This might change the current dictionary, which may call
+      // this observer recursively.
+      editorSpellCheck->CheckCurrentDictionary();
+    }
+
+    // update the inline spell checker to reflect the new current dictionary
+    mInlineSpellChecker->SpellCheckRange(nsnull); // causes recheck
+  }
+
+  return NS_OK;
+}
+
 NS_IMETHODIMP nsEditor::SyncRealTimeSpell()
 {
   NS_TIME_FUNCTION;
 
   PRBool enable = GetDesiredSpellCheckState();
 
+  // Initializes mInlineSpellChecker
   nsCOMPtr<nsIInlineSpellChecker> spellChecker;
   GetInlineSpellChecker(enable, getter_AddRefs(spellChecker));
 
-  if (spellChecker) {
-    spellChecker->SetEnableRealTimeSpell(enable);
+  if (mInlineSpellChecker) {
+    // We might have a mInlineSpellChecker even if there are no dictionaries
+    // available since we don't destroy the mInlineSpellChecker when the last
+    // dictionariy is removed, but in that case spellChecker is null
+    mInlineSpellChecker->SetEnableRealTimeSpell(enable && spellChecker);
   }
 
   return NS_OK;
diff --git a/editor/libeditor/base/nsEditor.h b/editor/libeditor/base/nsEditor.h
index 1ef527abf67f..e5fc4a8b2a47 100644
--- a/editor/libeditor/base/nsEditor.h
+++ b/editor/libeditor/base/nsEditor.h
@@ -66,6 +66,7 @@
 #include "nsStubMutationObserver.h"
 #include "nsIViewManager.h"
 #include "nsCycleCollectionParticipant.h"
+#include "nsIObserver.h"
 
 class nsIDOMCharacterData;
 class nsIDOMRange;
@@ -100,6 +101,7 @@ class nsIDOMNSEvent;
 class nsEditor : public nsIEditor,
                  public nsIEditorIMESupport,
                  public nsSupportsWeakReference,
+                 public nsIObserver,
                  public nsIPhonetic
 {
 public:
@@ -153,6 +155,9 @@ public:
   /* ------------ nsIEditorIMESupport methods -------------- */
   NS_DECL_NSIEDITORIMESUPPORT
   
+  /* ------------ nsIObserver methods -------------- */
+  NS_DECL_NSIOBSERVER
+
   // nsIPhonetic
   NS_DECL_NSIPHONETIC
 
diff --git a/editor/txtsvc/public/nsISpellChecker.h b/editor/txtsvc/public/nsISpellChecker.h
index d1644df77fea..b3545d5dad46 100644
--- a/editor/txtsvc/public/nsISpellChecker.h
+++ b/editor/txtsvc/public/nsISpellChecker.h
@@ -44,9 +44,9 @@
 #define NS_SPELLCHECKER_CONTRACTID "@mozilla.org/spellchecker;1"
 
 #define NS_ISPELLCHECKER_IID                    \
-{ /* E75AC48C-E948-452E-8DB3-30FEE29FE3D2 */    \
-0xe75ac48c, 0xe948, 0x452e, \
-  { 0x8d, 0xb3, 0x30, 0xfe, 0xe2, 0x9f, 0xe3, 0xd2 } }
+{ /* 27bff957-b486-40ae-9f5d-af0cdd211868 */    \
+0x27bff957, 0xb486, 0x40ae, \
+  { 0x9f, 0x5d, 0xaf, 0x0c, 0xdd, 0x21, 0x18, 0x68 } }
 
 class nsITextServicesDocument;
 class nsString;
@@ -146,6 +146,12 @@ public:
    * empty string, spellchecker will be disabled.
    */
   NS_IMETHOD SetCurrentDictionary(const nsAString &aDictionary) = 0;
+
+  /**
+   * Call this on any change in installed dictionaries to ensure that the spell
+   * checker is not using a current dictionary which is no longer available.
+   */
+  NS_IMETHOD CheckCurrentDictionary() = 0;
 };
 
 NS_DEFINE_STATIC_IID_ACCESSOR(nsISpellChecker, NS_ISPELLCHECKER_IID)
diff --git a/extensions/spellcheck/Makefile.in b/extensions/spellcheck/Makefile.in
index e7895eacba68..b270c3e90065 100644
--- a/extensions/spellcheck/Makefile.in
+++ b/extensions/spellcheck/Makefile.in
@@ -44,4 +44,8 @@ include $(DEPTH)/config/autoconf.mk
 MODULE		= spellchecker
 DIRS		= idl locales hunspell src
 
+ifdef ENABLE_TESTS
+DIRS		+= tests
+endif
+
 include $(topsrcdir)/config/rules.mk
diff --git a/extensions/spellcheck/hunspell/src/Makefile.in b/extensions/spellcheck/hunspell/src/Makefile.in
index 7ca1316e3085..c53c279bc106 100644
--- a/extensions/spellcheck/hunspell/src/Makefile.in
+++ b/extensions/spellcheck/hunspell/src/Makefile.in
@@ -71,6 +71,8 @@ endif
 
 include $(topsrcdir)/config/rules.mk
 
+INCLUDES        += -I$(topsrcdir)/extensions/spellcheck/src
+
 ifdef MOZ_NATIVE_HUNSPELL
 CXXFLAGS += $(MOZ_HUNSPELL_CFLAGS)
 endif
diff --git a/extensions/spellcheck/hunspell/src/mozHunspell.cpp b/extensions/spellcheck/hunspell/src/mozHunspell.cpp
index 89826d2dab67..8e0eb6a75ee9 100644
--- a/extensions/spellcheck/hunspell/src/mozHunspell.cpp
+++ b/extensions/spellcheck/hunspell/src/mozHunspell.cpp
@@ -41,6 +41,7 @@
  *                 Harri Pitkanen
  *                 Andras Timar
  *                 Tor Lillqvist
+ *                 Jesper Kristensen (mail@jesperkristensen.dk)
  *
  * Alternatively, the contents of this file may be used under the terms of
  * either the GNU General Public License Version 2 or later (the "GPL"), or
@@ -70,6 +71,8 @@
 #include "nsUnicharUtilCIID.h"
 #include "nsUnicharUtils.h"
 #include "nsCRT.h"
+#include "mozInlineSpellChecker.h"
+#include "mozilla/Services.h"
 #include <stdlib.h>
 #include "nsIMemoryReporter.h"
 
@@ -122,8 +125,7 @@ mozHunspell::Init()
 
   LoadDictionaryList();
 
-  nsCOMPtr<nsIObserverService> obs =
-    do_GetService("@mozilla.org/observer-service;1");
+  nsCOMPtr<nsIObserverService> obs = mozilla::services::GetObserverService();
   if (obs) {
     obs->AddObserver(this, "profile-do-change", PR_TRUE);
   }
@@ -147,9 +149,6 @@ NS_IMETHODIMP mozHunspell::GetDictionary(PRUnichar **aDictionary)
 {
   NS_ENSURE_ARG_POINTER(aDictionary);
 
-  if (mDictionary.IsEmpty())
-    return NS_ERROR_NOT_INITIALIZED;
-
   *aDictionary = ToNewUnicode(mDictionary);
   return *aDictionary ? NS_OK : NS_ERROR_OUT_OF_MEMORY;
 }
@@ -161,8 +160,23 @@ NS_IMETHODIMP mozHunspell::SetDictionary(const PRUnichar *aDictionary)
 {
   NS_ENSURE_ARG_POINTER(aDictionary);
 
-  if (mDictionary.Equals(aDictionary))
+  if (nsDependentString(aDictionary).IsEmpty()) {
+    delete mHunspell;
+    mHunspell = nsnull;
+    mDictionary.AssignLiteral("");
+    mAffixFileName.AssignLiteral("");
+    mLanguage.AssignLiteral("");
+    mDecoder = nsnull;
+    mEncoder = nsnull;
+
+    nsCOMPtr<nsIObserverService> obs = mozilla::services::GetObserverService();
+    if (obs) {
+      obs->NotifyObservers(nsnull,
+                           SPELLCHECK_DICTIONARY_UPDATE_NOTIFICATION,
+                           nsnull);
+    }
     return NS_OK;
+  }
 
   nsIFile* affFile = mDictionaries.GetWeak(nsDependentString(aDictionary));
   if (!affFile)
@@ -178,6 +192,9 @@ NS_IMETHODIMP mozHunspell::SetDictionary(const PRUnichar *aDictionary)
   nsresult rv = affFile->GetNativePath(affFileName);
   NS_ENSURE_SUCCESS(rv, rv);
 
+  if (mAffixFileName.Equals(affFileName.get()))
+    return NS_OK;
+
   dictFileName = affFileName;
   PRInt32 dotPos = dictFileName.RFindChar('.');
   if (dotPos == -1)
@@ -191,6 +208,7 @@ NS_IMETHODIMP mozHunspell::SetDictionary(const PRUnichar *aDictionary)
   delete mHunspell;
 
   mDictionary = aDictionary;
+  mAffixFileName = affFileName;
 
   mHunspell = new Hunspell(affFileName.get(),
                          dictFileName.get());
@@ -222,6 +240,13 @@ NS_IMETHODIMP mozHunspell::SetDictionary(const PRUnichar *aDictionary)
   else
     mLanguage = Substring(mDictionary, 0, pos);
 
+  nsCOMPtr<nsIObserverService> obs = mozilla::services::GetObserverService();
+  if (obs) {
+    obs->NotifyObservers(nsnull,
+                         SPELLCHECK_DICTIONARY_UPDATE_NOTIFICATION,
+                         nsnull);
+  }
+
   return NS_OK;
 }
 
@@ -333,6 +358,14 @@ NS_IMETHODIMP mozHunspell::GetDictionaryList(PRUnichar ***aDictionaries,
   return NS_OK;
 }
 
+static PLDHashOperator
+FindFirstString(const nsAString& aString, nsIFile* aFile, void* aClosure)
+{
+  nsAString *dic = (nsAString*) aClosure;
+  dic->Assign(aString);
+  return PL_DHASH_STOP;
+}
+
 void
 mozHunspell::LoadDictionaryList()
 {
@@ -345,6 +378,7 @@ mozHunspell::LoadDictionaryList()
   if (!dirSvc)
     return;
 
+  // find built in dictionaries
   nsCOMPtr<nsIFile> dictDir;
   rv = dirSvc->Get(DICTIONARY_SEARCH_DIRECTORY,
                    NS_GET_IID(nsIFile), getter_AddRefs(dictDir));
@@ -372,6 +406,7 @@ mozHunspell::LoadDictionaryList()
     }
   }
 
+  // find dictionaries from extensions requiring restart
   nsCOMPtr<nsISimpleEnumerator> dictDirs;
   rv = dirSvc->Get(DICTIONARY_SEARCH_DIRECTORY_LIST,
                    NS_GET_IID(nsISimpleEnumerator), getter_AddRefs(dictDirs));
@@ -387,6 +422,29 @@ mozHunspell::LoadDictionaryList()
     if (dictDir)
       LoadDictionariesFromDir(dictDir);
   }
+
+  // find dictionaries from restartless extensions
+  for (PRUint32 i = 0; i < mDynamicDirectories.Count(); i++) {
+    LoadDictionariesFromDir(mDynamicDirectories[i]);
+  }
+
+  // Now we have finished updating the list of dictionaries, update the current
+  // dictionary and any editors which may use it.
+  mozInlineSpellChecker::UpdateCanEnableInlineSpellChecking();
+
+  // Check if the current dictionary is still available.
+  // If not, try to replace it with another dictionary of the same language.
+  if (!mDictionary.IsEmpty()) {
+    rv = SetDictionary(mDictionary.get());
+    if (NS_SUCCEEDED(rv))
+      return;
+  }
+
+  // If the current dictionary has gone, and we don't have a good replacement,
+  // set no current dictionary.
+  if (!mDictionary.IsEmpty()) {
+    SetDictionary(EmptyString().get());
+  }
 }
 
 NS_IMETHODIMP
@@ -542,3 +600,19 @@ mozHunspell::Observe(nsISupports* aSubj, const char *aTopic,
 
   return NS_OK;
 }
+
+/* void addDirectory(in nsIFile dir); */
+NS_IMETHODIMP mozHunspell::AddDirectory(nsIFile *aDir)
+{
+  mDynamicDirectories.AppendObject(aDir);
+  LoadDictionaryList();
+  return NS_OK;
+}
+
+/* void removeDirectory(in nsIFile dir); */
+NS_IMETHODIMP mozHunspell::RemoveDirectory(nsIFile *aDir)
+{
+  mDynamicDirectories.RemoveObject(aDir);
+  LoadDictionaryList();
+  return NS_OK;
+}
diff --git a/extensions/spellcheck/hunspell/src/mozHunspell.h b/extensions/spellcheck/hunspell/src/mozHunspell.h
index 5b76d0c36013..4b81b06cddc6 100644
--- a/extensions/spellcheck/hunspell/src/mozHunspell.h
+++ b/extensions/spellcheck/hunspell/src/mozHunspell.h
@@ -41,6 +41,7 @@
  *                 Harri Pitkanen
  *                 Andras Timar
  *                 Tor Lillqvist
+ *                 Jesper Kristensen (mail@jesperkristensen.dk)
  * 
  * Alternatively, the contents of this file may be used under the terms of
  * either the GNU General Public License Version 2 or later (the "GPL"), or
@@ -64,6 +65,7 @@
 #include "mozIPersonalDictionary.h"
 #include "nsString.h"
 #include "nsCOMPtr.h"
+#include "nsCOMArray.h"
 #include "nsIObserver.h"
 #include "nsIUnicodeEncoder.h"
 #include "nsIUnicodeDecoder.h"
@@ -109,6 +111,10 @@ protected:
   nsInterfaceHashtable<nsStringHashKey, nsIFile> mDictionaries;
   nsString  mDictionary;
   nsString  mLanguage;
+  nsCString mAffixFileName;
+
+  // dynamic dirs used to search for dictionaries
+  nsCOMArray<nsIFile> mDynamicDirectories;
 
   Hunspell  *mHunspell;
 
diff --git a/extensions/spellcheck/idl/mozISpellCheckingEngine.idl b/extensions/spellcheck/idl/mozISpellCheckingEngine.idl
index e880d87353e6..db505f9907dd 100644
--- a/extensions/spellcheck/idl/mozISpellCheckingEngine.idl
+++ b/extensions/spellcheck/idl/mozISpellCheckingEngine.idl
@@ -20,6 +20,7 @@
  * the Initial Developer. All Rights Reserved.
  *
  * Contributor(s):
+ *   Jesper Kristensen <mail@jesperkristensen.dk>
  *
  * Alternatively, the contents of this file may be used under the terms of
  * either the GNU General Public License Version 2 or later (the "GPL"), or
@@ -40,7 +41,7 @@
 interface nsIFile;
 interface mozIPersonalDictionary;
 
-[scriptable, uuid(6eb307d6-3567-481a-971a-feb666b8ae72)]
+[scriptable, uuid(8ba643a4-7ddc-4662-b976-7ec123843f10)]
 
 /**
  * This interface represents a SpellChecker.
@@ -48,12 +49,23 @@ interface mozIPersonalDictionary;
 
 interface mozISpellCheckingEngine : nsISupports {
   /**
-   * The name of the current dictionary
+   * The name of the current dictionary. Is either a value from
+   * getDictionaryList or the empty string if no dictionary is selected.
+   * Setting this attribute to a value not in getDictionaryList will throw
+   * NS_ERROR_FILE_NOT_FOUND.
+   *
+   * The spellcheck engine will send a notification with
+   * "spellcheck-dictionary-update" as topic when this changes.
+   * If the dictionary is changed to no dictionary (the empty string), an
+   * observer is allowed to set another dictionary before it returns.
    */
   attribute wstring dictionary;
 
   /**
    * The language this spellchecker is using when checking
+   *
+   * The spellcheck engine will send a notification with
+   * "spellcheck-dictionary-update" as topic when this changes.
    */
   readonly attribute wstring language;
 
@@ -89,11 +101,17 @@ interface mozISpellCheckingEngine : nsISupports {
 
   /**
    * check a word
+   *
+   * The spellcheck engine will send a notification with
+   * "spellcheck-dictionary-update" as topic when this changes.
    */
   boolean check(in wstring word);
 
   /**
    * get a list of suggestions for a misspelled word
+   *
+   * The spellcheck engine will send a notification with
+   * "spellcheck-dictionary-update" as topic when this changes.
    */
   void suggest(in wstring word,[array, size_is(count)] out wstring suggestions, out PRUint32 count);
 
@@ -101,9 +119,22 @@ interface mozISpellCheckingEngine : nsISupports {
    * Load dictionaries from the specified dir
    */
   void loadDictionariesFromDir(in nsIFile dir);
+
+  /**
+   * Add dictionaries from a directory to the spell checker
+   */
+  void addDirectory(in nsIFile dir);
+
+  /**
+   * Remove dictionaries from a directory from the spell checker
+   */
+  void removeDirectory(in nsIFile dir);
 };
 
 %{C++
 #define DICTIONARY_SEARCH_DIRECTORY "DictD"
 #define DICTIONARY_SEARCH_DIRECTORY_LIST "DictDL"
+
+#define SPELLCHECK_DICTIONARY_UPDATE_NOTIFICATION \
+  "spellcheck-dictionary-update"
 %}
diff --git a/extensions/spellcheck/src/mozInlineSpellChecker.cpp b/extensions/spellcheck/src/mozInlineSpellChecker.cpp
index e159d38e5677..12d9b9bc3d4e 100644
--- a/extensions/spellcheck/src/mozInlineSpellChecker.cpp
+++ b/extensions/spellcheck/src/mozInlineSpellChecker.cpp
@@ -600,9 +600,9 @@ nsresult mozInlineSpellChecker::Cleanup(PRBool aDestroyingFrames)
 //    do that and caches the result so we don't have to keep allocating those
 //    objects if there are no dictionaries or spellchecking.
 //
-//    This caching will prevent adding dictionaries at runtime if we start out
-//    with no dictionaries! Installing dictionaries as extensions will require
-//    a restart anyway, so it shouldn't be a problem.
+//    Whenever dictionaries are added or removed at runtime, this value must be
+//    updated before an observer notification is sent out about the change, to
+//    avoid editors getting a wrong cached result.
 
 PRBool // static
 mozInlineSpellChecker::CanEnableInlineSpellChecking()
@@ -625,6 +625,12 @@ mozInlineSpellChecker::CanEnableInlineSpellChecking()
   return (gCanEnableSpellChecking == SpellCheck_Available);
 }
 
+void // static
+mozInlineSpellChecker::UpdateCanEnableInlineSpellChecking()
+{
+  gCanEnableSpellChecking = SpellCheck_Uninitialized;
+}
+
 // mozInlineSpellChecker::RegisterEventListeners
 //
 //    The inline spell checker listens to mouse events and keyboard navigation+ //    events.
diff --git a/extensions/spellcheck/src/mozInlineSpellChecker.h b/extensions/spellcheck/src/mozInlineSpellChecker.h
index 183422fd02f1..f371ed72f8e0 100644
--- a/extensions/spellcheck/src/mozInlineSpellChecker.h
+++ b/extensions/spellcheck/src/mozInlineSpellChecker.h
@@ -229,8 +229,10 @@ public:
   NS_DECL_NSIDOMEVENTLISTENER
   NS_DECL_CYCLE_COLLECTION_CLASS_AMBIGUOUS(mozInlineSpellChecker, nsIDOMEventListener)
 
-  // returns true if it looks likely that we can enable real-time spell checking
+  // returns true if there are any spell checking dictionaries available
   static PRBool CanEnableInlineSpellChecking();
+  // update the cached value whenever the list of available dictionaries changes
+  static void UpdateCanEnableInlineSpellChecking();
 
   nsresult Blur(nsIDOMEvent* aEvent);
   nsresult MouseClick(nsIDOMEvent* aMouseEvent);
diff --git a/extensions/spellcheck/src/mozSpellChecker.cpp b/extensions/spellcheck/src/mozSpellChecker.cpp
index 96832848549b..0ea96376c38e 100644
--- a/extensions/spellcheck/src/mozSpellChecker.cpp
+++ b/extensions/spellcheck/src/mozSpellChecker.cpp
@@ -18,6 +18,7 @@
  * the Initial Developer. All Rights Reserved.
  *
  * Contributor(s): David Einstein Deinst@world.std.com
+ *   Jesper Kristensen <mail@jesperkristensen.dk>
  *
  * Alternatively, the contents of this file may be used under the terms of
  * either the GNU General Public License Version 2 or later (the "GPL"), or
@@ -77,9 +78,6 @@ mozSpellChecker::Init()
   mPersonalDictionary = do_GetService("@mozilla.org/spellchecker/personaldictionary;1");
   
   mSpellCheckingEngine = nsnull;
-  mCurrentEngineContractId = nsnull;
-  mDictionariesMap.Init();
-  InitSpellCheckDictionaryMap();
 
   return NS_OK;
 } 
@@ -307,35 +305,45 @@ mozSpellChecker::GetPersonalDictionary(nsTArray<nsString> *aWordList)
   return NS_OK;
 }
 
-struct AppendNewStruct
-{
-  nsTArray<nsString> *dictionaryList;
-  PRBool failed;
-};
-
-static PLDHashOperator
-AppendNewString(const nsAString& aString, nsCString*, void* aClosure)
-{
-  AppendNewStruct *ans = (AppendNewStruct*) aClosure;
-
-  if (!ans->dictionaryList->AppendElement(aString))
-  {
-    ans->failed = PR_TRUE;
-    return PL_DHASH_STOP;
-  }
-
-  return PL_DHASH_NEXT;
-}
-
 NS_IMETHODIMP 
 mozSpellChecker::GetDictionaryList(nsTArray<nsString> *aDictionaryList)
 {
-  AppendNewStruct ans = {aDictionaryList, PR_FALSE};
+  nsresult rv;
 
-  mDictionariesMap.EnumerateRead(AppendNewString, &ans);
+  // For catching duplicates
+  nsClassHashtable<nsStringHashKey, nsCString> dictionaries;
+  dictionaries.Init();
 
-  if (ans.failed)
-    return NS_ERROR_OUT_OF_MEMORY;
+  nsCOMArray<mozISpellCheckingEngine> spellCheckingEngines;
+  rv = GetEngineList(&spellCheckingEngines);
+  NS_ENSURE_SUCCESS(rv, rv);
+
+  for (PRUint32 i = 0; i < spellCheckingEngines.Count(); i++) {
+    nsCOMPtr<mozISpellCheckingEngine> engine = spellCheckingEngines[i];
+
+    PRUint32 count = 0;
+    PRUnichar **words = NULL;
+    engine->GetDictionaryList(&words, &count);
+    for (PRUint32 k = 0; k < count; k++) {
+      nsAutoString dictName;
+
+      dictName.Assign(words[k]);
+
+      // Skip duplicate dictionaries. Only take the first one
+      // for each name.
+      if (dictionaries.Get(dictName, NULL))
+        continue;
+
+      dictionaries.Put(dictName, NULL);
+
+      if (!aDictionaryList->AppendElement(dictName)) {
+        NS_FREE_XPCOM_ALLOCATED_POINTER_ARRAY(count, words);
+        return NS_ERROR_OUT_OF_MEMORY;
+      }
+    }
+
+    NS_FREE_XPCOM_ALLOCATED_POINTER_ARRAY(count, words);
+  }
 
   return NS_OK;
 }
@@ -343,11 +351,12 @@ mozSpellChecker::GetDictionaryList(nsTArray<nsString> *aDictionaryList)
 NS_IMETHODIMP 
 mozSpellChecker::GetCurrentDictionary(nsAString &aDictionary)
 {
+  if (!mSpellCheckingEngine) {
+    aDictionary.AssignLiteral("");
+    return NS_OK;
+  }
+
   nsXPIDLString dictname;
-
-  if (!mSpellCheckingEngine)
-    return NS_ERROR_NOT_INITIALIZED;
-
   mSpellCheckingEngine->GetDictionary(getter_Copies(dictname));
   aDictionary = dictname;
   return NS_OK;
@@ -356,44 +365,62 @@ mozSpellChecker::GetCurrentDictionary(nsAString &aDictionary)
 NS_IMETHODIMP 
 mozSpellChecker::SetCurrentDictionary(const nsAString &aDictionary)
 {
-  nsresult rv;
-  nsCString *contractId;
+  mSpellCheckingEngine = nsnull;
 
   if (aDictionary.IsEmpty()) {
-    mCurrentEngineContractId = nsnull;
-    mSpellCheckingEngine = nsnull;
     return NS_OK;
   }
 
-  if (!mDictionariesMap.Get(aDictionary, &contractId)){
-    NS_WARNING("Dictionary not found");
-    return NS_ERROR_NOT_AVAILABLE;
+  nsresult rv;
+  nsCOMArray<mozISpellCheckingEngine> spellCheckingEngines;
+  rv = GetEngineList(&spellCheckingEngines);
+  NS_ENSURE_SUCCESS(rv, rv);
+
+  for (PRUint32 i = 0; i < spellCheckingEngines.Count(); i++) {
+    // We must set mSpellCheckingEngine before we call SetDictionary, since
+    // SetDictionary calls back to this spell checker to check if the
+    // dictionary was set
+    mSpellCheckingEngine = spellCheckingEngines[i];
+
+    rv = mSpellCheckingEngine->SetDictionary(PromiseFlatString(aDictionary).get());
+
+    if (NS_SUCCEEDED(rv)) {
+      nsCOMPtr<mozIPersonalDictionary> personalDictionary = do_GetService("@mozilla.org/spellchecker/personaldictionary;1");
+      mSpellCheckingEngine->SetPersonalDictionary(personalDictionary.get());
+
+      return NS_OK;
+    }
   }
 
-  if (!mCurrentEngineContractId || !mCurrentEngineContractId->Equals(*contractId)){
-    mSpellCheckingEngine = do_GetService(contractId->get(), &rv);
-    if (NS_FAILED(rv))
-      return rv;
-
-    mCurrentEngineContractId = contractId;
-  }
-
-  nsresult res;
-  res = mSpellCheckingEngine->SetDictionary(PromiseFlatString(aDictionary).get());
-  if(NS_FAILED(res)){
-    NS_WARNING("Dictionary load failed");
-    return res;
-  }
-
-  mSpellCheckingEngine->SetPersonalDictionary(mPersonalDictionary);
-
-  nsXPIDLString language;
+  mSpellCheckingEngine = NULL;
   
-  nsCOMPtr<mozISpellI18NManager> serv(do_GetService("@mozilla.org/spellchecker/i18nmanager;1", &res));
-  if(serv && NS_SUCCEEDED(res)){
-    res = serv->GetUtil(language.get(),getter_AddRefs(mConverter));
+  // We could not find any engine with the requested dictionary
+  return NS_ERROR_NOT_AVAILABLE;
+}
+
+NS_IMETHODIMP 
+mozSpellChecker::CheckCurrentDictionary()
+{
+  // If the current dictionary has been uninstalled, we need to stop using it.
+  // This happens when there is a current engine, but that engine has no
+  // current dictionary.
+
+  if (!mSpellCheckingEngine) {
+    // We didn't have a current dictionary
+    return NS_OK;
   }
-  return res;
+
+  nsXPIDLString dictname;
+  mSpellCheckingEngine->GetDictionary(getter_Copies(dictname));
+
+  if (!dictname.IsEmpty()) {
+    // We still have a current dictionary
+    return NS_OK;
+  }
+
+  // We had a current dictionary, but it has gone, so we cannot use it anymore.
+  mSpellCheckingEngine = nsnull;
+  return NS_OK;
 }
 
 nsresult
@@ -477,11 +504,10 @@ mozSpellChecker::GetCurrentBlockIndex(nsITextServicesDocument *aDoc, PRInt32 *ou
 }
 
 nsresult
-mozSpellChecker::InitSpellCheckDictionaryMap()
+mozSpellChecker::GetEngineList(nsCOMArray<mozISpellCheckingEngine>* aSpellCheckingEngines)
 {
   nsresult rv;
   PRBool hasMoreEngines;
-  nsTArray<nsCString> contractIds;
 
   nsCOMPtr<nsICategoryManager> catMgr = do_GetService(NS_CATEGORYMANAGER_CONTRACTID);
   if (!catMgr)
@@ -508,52 +534,24 @@ mozSpellChecker::InitSpellCheckDictionaryMap()
     if (NS_FAILED(rv))
       return rv;
 
-    contractIds.AppendElement(contractId);
-  }
-
-  contractIds.AppendElement(NS_LITERAL_CSTRING(DEFAULT_SPELL_CHECKER));
-
-  // Retrieve dictionaries from all available spellcheckers and
-  // fill mDictionariesMap hash (only the first dictionary with the
-  // each name is used).
-  for (PRUint32 i=0;i < contractIds.Length();i++){
-    PRUint32 count,k;
-    PRUnichar **words;
-
-    const nsCString& contractId = contractIds[i];
-
     // Try to load spellchecker engine. Ignore errors silently
     // except for the last one (HunSpell).
     nsCOMPtr<mozISpellCheckingEngine> engine =
       do_GetService(contractId.get(), &rv);
-    if (NS_FAILED(rv)){
-      // Fail if not succeeded to load HunSpell. Ignore errors
-      // for external spellcheck engines.
-      if (i==contractIds.Length()-1){
-        return rv;
-      }
-
-      continue;
+    if (NS_SUCCEEDED(rv)) {
+      aSpellCheckingEngines->AppendObject(engine);
     }
-
-    engine->GetDictionaryList(&words,&count);
-    for(k=0;k<count;k++){
-      nsAutoString dictName;
-
-      dictName.Assign(words[k]);
-
-      nsCString dictCName = NS_ConvertUTF16toUTF8(dictName);
-
-      // Skip duplicate dictionaries. Only take the first one
-      // for each name.
-      if (mDictionariesMap.Get(dictName, NULL))
-        continue;
-
-      mDictionariesMap.Put(dictName, new nsCString(contractId));
-    }
-
-    NS_FREE_XPCOM_ALLOCATED_POINTER_ARRAY(count, words);
   }
 
+  // Try to load HunSpell spellchecker engine.
+  nsCOMPtr<mozISpellCheckingEngine> engine =
+    do_GetService(DEFAULT_SPELL_CHECKER, &rv);
+  if (NS_FAILED(rv)) {
+    // Fail if not succeeded to load HunSpell. Ignore errors
+    // for external spellcheck engines.
+    return rv;
+  }
+  aSpellCheckingEngines->AppendObject(engine);
+
   return NS_OK;
 }
diff --git a/extensions/spellcheck/src/mozSpellChecker.h b/extensions/spellcheck/src/mozSpellChecker.h
index 142c0ee15f44..10f52f21a9ad 100644
--- a/extensions/spellcheck/src/mozSpellChecker.h
+++ b/extensions/spellcheck/src/mozSpellChecker.h
@@ -20,6 +20,7 @@
  * the Initial Developer. All Rights Reserved.
  *
  * Contributor(s): David Einstein Deinst@world.std.com
+ *   Jesper Kristensen <mail@jesperkristensen.dk>
  *
  * Alternatively, the contents of this file may be used under the terms of
  * either the GNU General Public License Version 2 or later (the "GPL"), or
@@ -39,6 +40,7 @@
 #define mozSpellChecker_h__
 
 #include "nsCOMPtr.h"
+#include "nsCOMArray.h"
 #include "nsISpellChecker.h"
 #include "nsString.h"
 #include "nsITextServicesDocument.h"
@@ -75,17 +77,13 @@ public:
   NS_IMETHOD GetDictionaryList(nsTArray<nsString> *aDictionaryList);
   NS_IMETHOD GetCurrentDictionary(nsAString &aDictionary);
   NS_IMETHOD SetCurrentDictionary(const nsAString &aDictionary);
+  NS_IMETHOD CheckCurrentDictionary();
 
 protected:
   nsCOMPtr<mozISpellI18NUtil> mConverter;
   nsCOMPtr<nsITextServicesDocument> mTsDoc;
   nsCOMPtr<mozIPersonalDictionary> mPersonalDictionary;
 
-  // Hastable maps directory name to the spellchecker contract ID
-  nsClassHashtable<nsStringHashKey, nsCString> mDictionariesMap;
-
-  nsString mDictionaryName;
-  nsCString *mCurrentEngineContractId;
   nsCOMPtr<mozISpellCheckingEngine>  mSpellCheckingEngine;
   PRBool mFromStart;
 
@@ -93,6 +91,6 @@ protected:
 
   nsresult GetCurrentBlockIndex(nsITextServicesDocument *aDoc, PRInt32 *outBlockIndex);
 
-  nsresult InitSpellCheckDictionaryMap();
+  nsresult GetEngineList(nsCOMArray<mozISpellCheckingEngine> *aDictionaryList);
 };
 #endif // mozSpellChecker_h__
diff --git a/extensions/spellcheck/src/mozSpellCheckerFactory.cpp b/extensions/spellcheck/src/mozSpellCheckerFactory.cpp
index 8ab97debbcae..e4f917a83078 100644
--- a/extensions/spellcheck/src/mozSpellCheckerFactory.cpp
+++ b/extensions/spellcheck/src/mozSpellCheckerFactory.cpp
@@ -59,39 +59,7 @@ NS_GENERIC_FACTORY_CONSTRUCTOR(mozHunspellDirProvider)
 NS_GENERIC_FACTORY_CONSTRUCTOR_INIT(mozSpellChecker, Init)
 NS_GENERIC_FACTORY_CONSTRUCTOR_INIT(mozPersonalDictionary, Init)
 NS_GENERIC_FACTORY_CONSTRUCTOR(mozSpellI18NManager)
-
-// This special constructor for the inline spell checker asks the inline
-// spell checker if we can create spell checking objects at all (ie, if there
-// are any dictionaries loaded) before trying to create one. The static
-// CanEnableInlineSpellChecking caches the value so this will be faster (we
-// have to run this code for every edit box we create, as well as for every
-// right click in those edit boxes).
-static nsresult
-mozInlineSpellCheckerConstructor(nsISupports *aOuter, REFNSIID aIID,
-                                 void **aResult)
-{
-  if (! mozInlineSpellChecker::CanEnableInlineSpellChecking())
-    return NS_ERROR_FAILURE;
-
-  nsresult rv;
-
-  *aResult = NULL;
-  if (NULL != aOuter) {
-    rv = NS_ERROR_NO_AGGREGATION;
-    return rv;
-  }
-
-  mozInlineSpellChecker* inst = new mozInlineSpellChecker();
-  if (NULL == inst) {
-    rv = NS_ERROR_OUT_OF_MEMORY;
-    return rv;
-  }
-  NS_ADDREF(inst);
-  rv = inst->QueryInterface(aIID, aResult);
-  NS_RELEASE(inst);
-
-  return rv;
-}
+NS_GENERIC_FACTORY_CONSTRUCTOR(mozInlineSpellChecker)
 
 NS_DEFINE_NAMED_CID(MOZ_HUNSPELL_CID);
 NS_DEFINE_NAMED_CID(HUNSPELLDIRPROVIDER_CID);
diff --git a/extensions/spellcheck/tests/Makefile.in b/extensions/spellcheck/tests/Makefile.in
new file mode 100644
index 000000000000..686fe393fd44
--- /dev/null
+++ b/extensions/spellcheck/tests/Makefile.in
@@ -0,0 +1,48 @@
+#
+# ***** BEGIN LICENSE BLOCK *****
+# Version: MPL 1.1/GPL 2.0/LGPL 2.1
+#
+# The contents of this file are subject to the Mozilla Public License Version
+# 1.1 (the "License"); you may not use this file except in compliance with
+# the License. You may obtain a copy of the License at
+# http://www.mozilla.org/MPL/
+#
+# Software distributed under the License is distributed on an "AS IS" basis,
+# WITHOUT WARRANTY OF ANY KIND, either express or implied. See the License
+# for the specific language governing rights and limitations under the
+# License.
+#
+# The Original Code is mozilla.org code.
+#
+# The Initial Developer of the Original Code is
+# Netscape Communications Corporation.
+# Portions created by the Initial Developer are Copyright (C) 1998
+# the Initial Developer. All Rights Reserved.
+#
+# Contributor(s):
+#
+# Alternatively, the contents of this file may be used under the terms of
+# either of the GNU General Public License Version 2 or later (the "GPL"),
+# or the GNU Lesser General Public License Version 2.1 or later (the "LGPL"),
+# in which case the provisions of the GPL or the LGPL are applicable instead
+# of those above. If you wish to allow use of your version of this file only
+# under the terms of either the GPL or the LGPL, and not to allow others to
+# use your version of this file under the terms of the MPL, indicate your
+# decision by deleting the provisions above and replace them with the notice
+# and other provisions required by the GPL or the LGPL. If you do not delete
+# the provisions above, a recipient may use your version of this file under
+# the terms of any one of the MPL, the GPL or the LGPL.
+#
+# ***** END LICENSE BLOCK *****
+
+DEPTH		= ../../..
+topsrcdir	= @top_srcdir@
+srcdir		= @srcdir@
+VPATH		= @srcdir@
+relativesrcdir  = extensions/spellcheck/tests
+
+include $(DEPTH)/config/autoconf.mk
+
+DIRS		= chrome
+
+include $(topsrcdir)/config/rules.mk
diff --git a/extensions/spellcheck/tests/chrome/Makefile.in b/extensions/spellcheck/tests/chrome/Makefile.in
new file mode 100644
index 000000000000..da60413beb77
--- /dev/null
+++ b/extensions/spellcheck/tests/chrome/Makefile.in
@@ -0,0 +1,54 @@
+#
+# ***** BEGIN LICENSE BLOCK *****
+# Version: MPL 1.1/GPL 2.0/LGPL 2.1
+#
+# The contents of this file are subject to the Mozilla Public License Version
+# 1.1 (the "License"); you may not use this file except in compliance with
+# the License. You may obtain a copy of the License at
+# http://www.mozilla.org/MPL/
+#
+# Software distributed under the License is distributed on an "AS IS" basis,
+# WITHOUT WARRANTY OF ANY KIND, either express or implied. See the License
+# for the specific language governing rights and limitations under the
+# License.
+#
+# The Original Code is mozilla.org code.
+#
+# The Initial Developer of the Original Code is
+# Netscape Communications Corporation.
+# Portions created by the Initial Developer are Copyright (C) 1998
+# the Initial Developer. All Rights Reserved.
+#
+# Contributor(s):
+#
+# Alternatively, the contents of this file may be used under the terms of
+# either of the GNU General Public License Version 2 or later (the "GPL"),
+# or the GNU Lesser General Public License Version 2.1 or later (the "LGPL"),
+# in which case the provisions of the GPL or the LGPL are applicable instead
+# of those above. If you wish to allow use of your version of this file only
+# under the terms of either the GPL or the LGPL, and not to allow others to
+# use your version of this file under the terms of the MPL, indicate your
+# decision by deleting the provisions above and replace them with the notice
+# and other provisions required by the GPL or the LGPL. If you do not delete
+# the provisions above, a recipient may use your version of this file under
+# the terms of any one of the MPL, the GPL or the LGPL.
+#
+# ***** END LICENSE BLOCK *****
+
+DEPTH		= ../../../..
+topsrcdir	= @top_srcdir@
+srcdir		= @srcdir@
+VPATH		= @srcdir@
+relativesrcdir  = extensions/spellcheck/tests/chrome
+
+include $(DEPTH)/config/autoconf.mk
+
+DIRS = base map
+
+include $(topsrcdir)/config/rules.mk
+
+_TEST_FILES = 	test_add_remove_dictionaries.xul \
+				$(NULL)
+
+libs:: $(_TEST_FILES)
+	$(INSTALL) $^ $(DEPTH)/_tests/testing/mochitest/chrome/$(relativesrcdir)
diff --git a/extensions/spellcheck/tests/chrome/base/Makefile.in b/extensions/spellcheck/tests/chrome/base/Makefile.in
new file mode 100644
index 000000000000..04159b2ca7a2
--- /dev/null
+++ b/extensions/spellcheck/tests/chrome/base/Makefile.in
@@ -0,0 +1,52 @@
+#
+# ***** BEGIN LICENSE BLOCK *****
+# Version: MPL 1.1/GPL 2.0/LGPL 2.1
+#
+# The contents of this file are subject to the Mozilla Public License Version
+# 1.1 (the "License"); you may not use this file except in compliance with
+# the License. You may obtain a copy of the License at
+# http://www.mozilla.org/MPL/
+#
+# Software distributed under the License is distributed on an "AS IS" basis,
+# WITHOUT WARRANTY OF ANY KIND, either express or implied. See the License
+# for the specific language governing rights and limitations under the
+# License.
+#
+# The Original Code is mozilla.org code.
+#
+# The Initial Developer of the Original Code is
+# Netscape Communications Corporation.
+# Portions created by the Initial Developer are Copyright (C) 1998
+# the Initial Developer. All Rights Reserved.
+#
+# Contributor(s):
+#
+# Alternatively, the contents of this file may be used under the terms of
+# either of the GNU General Public License Version 2 or later (the "GPL"),
+# or the GNU Lesser General Public License Version 2.1 or later (the "LGPL"),
+# in which case the provisions of the GPL or the LGPL are applicable instead
+# of those above. If you wish to allow use of your version of this file only
+# under the terms of either the GPL or the LGPL, and not to allow others to
+# use your version of this file under the terms of the MPL, indicate your
+# decision by deleting the provisions above and replace them with the notice
+# and other provisions required by the GPL or the LGPL. If you do not delete
+# the provisions above, a recipient may use your version of this file under
+# the terms of any one of the MPL, the GPL or the LGPL.
+#
+# ***** END LICENSE BLOCK *****
+
+DEPTH		= ../../../../..
+topsrcdir	= @top_srcdir@
+srcdir		= @srcdir@
+VPATH		= @srcdir@
+relativesrcdir  = extensions/spellcheck/tests/chrome/base
+
+include $(DEPTH)/config/autoconf.mk
+include $(topsrcdir)/config/rules.mk
+
+_TEST_FILES = 	base_utf.dic \
+				base_utf.aff \
+				$(NULL)
+
+libs:: $(_TEST_FILES)
+	$(INSTALL) $^ $(DEPTH)/_tests/testing/mochitest/chrome/$(relativesrcdir)
diff --git a/extensions/spellcheck/tests/chrome/base/base_utf.aff b/extensions/spellcheck/tests/chrome/base/base_utf.aff
new file mode 100644
index 000000000000..493157b30182
--- /dev/null
+++ b/extensions/spellcheck/tests/chrome/base/base_utf.aff
@@ -0,0 +1,198 @@
+# OpenOffice.org’s en_US.aff file
+# with Unicode apostrophe: ’
+
+SET UTF-8
+TRY esianrtolcdugmphbyfvkwzESIANRTOLCDUGMPHBYFVKWZ'
+
+MAXNGRAMSUGS 1
+WORDCHARS .'’
+
+PFX A Y 1
+PFX A   0     re         .
+
+PFX I Y 1
+PFX I   0     in         .
+
+PFX U Y 1
+PFX U   0     un         .
+
+PFX C Y 1
+PFX C   0     de          .
+
+PFX E Y 1
+PFX E   0     dis         .
+
+PFX F Y 1
+PFX F   0     con         .
+
+PFX K Y 1
+PFX K   0     pro         .
+
+SFX V N 2
+SFX V   e     ive        e
+SFX V   0     ive        [^e]
+
+SFX N Y 3
+SFX N   e     ion        e
+SFX N   y     ication    y 
+SFX N   0     en         [^ey] 
+
+SFX X Y 3
+SFX X   e     ions       e
+SFX X   y     ications   y
+SFX X   0     ens        [^ey]
+
+SFX H N 2
+SFX H   y     ieth       y
+SFX H   0     th         [^y] 
+
+SFX Y Y 1
+SFX Y   0     ly         .
+
+SFX G Y 2
+SFX G   e     ing        e
+SFX G   0     ing        [^e] 
+
+SFX J Y 2
+SFX J   e     ings       e
+SFX J   0     ings       [^e]
+
+SFX D Y 4
+SFX D   0     d          e
+SFX D   y     ied        [^aeiou]y
+SFX D   0     ed         [^ey]
+SFX D   0     ed         [aeiou]y
+
+SFX T N 4
+SFX T   0     st         e
+SFX T   y     iest       [^aeiou]y
+SFX T   0     est        [aeiou]y
+SFX T   0     est        [^ey]
+
+SFX R Y 4
+SFX R   0     r          e
+SFX R   y     ier        [^aeiou]y
+SFX R   0     er         [aeiou]y
+SFX R   0     er         [^ey]
+
+SFX Z Y 4
+SFX Z   0     rs         e
+SFX Z   y     iers       [^aeiou]y
+SFX Z   0     ers        [aeiou]y
+SFX Z   0     ers        [^ey]
+
+SFX S Y 4
+SFX S   y     ies        [^aeiou]y
+SFX S   0     s          [aeiou]y
+SFX S   0     es         [sxzh]
+SFX S   0     s          [^sxzhy]
+
+SFX P Y 3
+SFX P   y     iness      [^aeiou]y
+SFX P   0     ness       [aeiou]y
+SFX P   0     ness       [^y]
+
+SFX M Y 1
+SFX M   0     's         .
+
+SFX B Y 3
+SFX B   0     able       [^aeiou]
+SFX B   0     able       ee
+SFX B   e     able       [^aeiou]e
+
+SFX L Y 1
+SFX L   0     ment       .
+
+REP 88
+REP a ei
+REP ei a
+REP a ey
+REP ey a
+REP ai ie
+REP ie ai
+REP are air
+REP are ear
+REP are eir
+REP air are
+REP air ere
+REP ere air
+REP ere ear
+REP ere eir
+REP ear are
+REP ear air
+REP ear ere
+REP eir are
+REP eir ere
+REP ch te
+REP te ch
+REP ch ti
+REP ti ch
+REP ch tu
+REP tu ch
+REP ch s
+REP s ch
+REP ch k
+REP k ch
+REP f ph
+REP ph f
+REP gh f
+REP f gh
+REP i igh
+REP igh i
+REP i uy
+REP uy i
+REP i ee
+REP ee i
+REP j di
+REP di j
+REP j gg
+REP gg j
+REP j ge
+REP ge j
+REP s ti
+REP ti s
+REP s ci
+REP ci s
+REP k cc
+REP cc k
+REP k qu
+REP qu k
+REP kw qu
+REP o eau
+REP eau o
+REP o ew
+REP ew o
+REP oo ew
+REP ew oo
+REP ew ui
+REP ui ew
+REP oo ui
+REP ui oo
+REP ew u
+REP u ew
+REP oo u
+REP u oo
+REP u oe
+REP oe u
+REP u ieu
+REP ieu u
+REP ue ew
+REP ew ue
+REP uff ough
+REP oo ieu
+REP ieu oo
+REP ier ear
+REP ear ier
+REP ear air
+REP air ear
+REP w qu
+REP qu w
+REP z ss
+REP ss z
+REP shun tion
+REP shun sion
+REP shun cion
+McDonalds’sá/w
+McDonald’sszá/g3)	st:McDonald’s	po:noun_prs	is:TRANS
+McDonald’sszal/g4)	st:McDonald’s	po:noun_prs	is:INSTR
+McDonald’ssal/w
diff --git a/extensions/spellcheck/tests/chrome/base/base_utf.dic b/extensions/spellcheck/tests/chrome/base/base_utf.dic
new file mode 100644
index 000000000000..b2b536d2854d
--- /dev/null
+++ b/extensions/spellcheck/tests/chrome/base/base_utf.dic
@@ -0,0 +1,29 @@
+28
+created/U
+create/XKVNGADS
+imply/GNSDX
+natural/PUY
+like/USPBY
+convey/BDGS
+look/GZRDS
+text
+hello
+said
+sawyer
+NASA
+rotten
+day
+tomorrow
+seven
+FAQ/SM
+can’t
+doesn’t
+etc
+won’t
+lip
+text
+horrifying
+speech
+suggest
+uncreate/V
+Hunspell
diff --git a/extensions/spellcheck/tests/chrome/map/Makefile.in b/extensions/spellcheck/tests/chrome/map/Makefile.in
new file mode 100644
index 000000000000..f9da7553bee1
--- /dev/null
+++ b/extensions/spellcheck/tests/chrome/map/Makefile.in
@@ -0,0 +1,52 @@
+#
+# ***** BEGIN LICENSE BLOCK *****
+# Version: MPL 1.1/GPL 2.0/LGPL 2.1
+#
+# The contents of this file are subject to the Mozilla Public License Version
+# 1.1 (the "License"); you may not use this file except in compliance with
+# the License. You may obtain a copy of the License at
+# http://www.mozilla.org/MPL/
+#
+# Software distributed under the License is distributed on an "AS IS" basis,
+# WITHOUT WARRANTY OF ANY KIND, either express or implied. See the License
+# for the specific language governing rights and limitations under the
+# License.
+#
+# The Original Code is mozilla.org code.
+#
+# The Initial Developer of the Original Code is
+# Netscape Communications Corporation.
+# Portions created by the Initial Developer are Copyright (C) 1998
+# the Initial Developer. All Rights Reserved.
+#
+# Contributor(s):
+#
+# Alternatively, the contents of this file may be used under the terms of
+# either of the GNU General Public License Version 2 or later (the "GPL"),
+# or the GNU Lesser General Public License Version 2.1 or later (the "LGPL"),
+# in which case the provisions of the GPL or the LGPL are applicable instead
+# of those above. If you wish to allow use of your version of this file only
+# under the terms of either the GPL or the LGPL, and not to allow others to
+# use your version of this file under the terms of the MPL, indicate your
+# decision by deleting the provisions above and replace them with the notice
+# and other provisions required by the GPL or the LGPL. If you do not delete
+# the provisions above, a recipient may use your version of this file under
+# the terms of any one of the MPL, the GPL or the LGPL.
+#
+# ***** END LICENSE BLOCK *****
+
+DEPTH		= ../../../../..
+topsrcdir	= @top_srcdir@
+srcdir		= @srcdir@
+VPATH		= @srcdir@
+relativesrcdir  = extensions/spellcheck/tests/chrome/map
+
+include $(DEPTH)/config/autoconf.mk
+include $(topsrcdir)/config/rules.mk
+
+_TEST_FILES = 	maputf.dic \
+				maputf.aff \
+				$(NULL)
+
+libs:: $(_TEST_FILES)
+	$(INSTALL) $^ $(DEPTH)/_tests/testing/mochitest/chrome/$(relativesrcdir)
diff --git a/extensions/spellcheck/tests/chrome/map/maputf.aff b/extensions/spellcheck/tests/chrome/map/maputf.aff
new file mode 100644
index 000000000000..30edb2a7850c
--- /dev/null
+++ b/extensions/spellcheck/tests/chrome/map/maputf.aff
@@ -0,0 +1,11 @@
+# With MAP suggestion, Hunspell can add missing accents to a word.
+
+SET UTF-8
+
+# switch off ngram suggestion for testing
+MAXNGRAMSUGS 0
+
+MAP 3
+MAP uúü
+MAP öóo
+MAP ß(ss)
diff --git a/extensions/spellcheck/tests/chrome/map/maputf.dic b/extensions/spellcheck/tests/chrome/map/maputf.dic
new file mode 100644
index 000000000000..1c6fa8d05893
--- /dev/null
+++ b/extensions/spellcheck/tests/chrome/map/maputf.dic
@@ -0,0 +1,4 @@
+3
+Frühstück
+tükörfúró
+groß
diff --git a/extensions/spellcheck/tests/chrome/test_add_remove_dictionaries.xul b/extensions/spellcheck/tests/chrome/test_add_remove_dictionaries.xul
new file mode 100644
index 000000000000..8299c2a93134
--- /dev/null
+++ b/extensions/spellcheck/tests/chrome/test_add_remove_dictionaries.xul
@@ -0,0 +1,110 @@
+<?xml version="1.0"?>
+<?xml-stylesheet href="chrome://global/skin" type="text/css"?>
+
+<window title="Add and remove dictionaries test"
+        xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul"
+        onload="RunTest();">
+  <title>Add and remove dictionaries test</title>
+
+  <script type="application/javascript"
+          src="chrome://mochikit/content/tests/SimpleTest/SimpleTest.js"/>
+
+  <script type="application/javascript">
+  <![CDATA[
+SimpleTest.waitForExplicitFinish();
+
+function getMisspelledWords(editor) {
+  return editor.selectionController.getSelection(Components.interfaces.nsISelectionController.SELECTION_SPELLCHECK).toString();
+}
+
+function getDictionaryList(editor) {
+  var spellchecker = editor.getInlineSpellChecker(true).spellChecker;
+  var o1 = {};
+  spellchecker.GetDictionaryList(o1, {});
+  return o1.value;
+}
+
+function getCurrentDictionary(editor) {
+  var spellchecker = editor.getInlineSpellChecker(true).spellChecker;
+  return spellchecker.GetCurrentDictionary();
+}
+
+function setCurrentDictionary(editor, dictionary) {
+  var spellchecker = editor.getInlineSpellChecker(true).spellChecker;
+  spellchecker.SetCurrentDictionary(dictionary);
+}
+
+function RunTest() {
+  var editor = document.getElementById('textbox').editor;
+
+  var dir = Components.classes["@mozilla.org/file/directory_service;1"].
+            getService(Components.interfaces.nsIProperties).
+            get("CurWorkD", Components.interfaces.nsIFile);
+  dir.append("chrome");
+  dir.append("extensions");
+  dir.append("spellcheck");
+  dir.append("tests");
+  dir.append("chrome");
+
+  var hunspell = Components
+    .classes["@mozilla.org/spellchecker/engine;1"]
+    .getService(Components.interfaces.mozISpellCheckingEngine);
+
+  // install base dictionary
+  var base = dir.clone();
+  base.append("base");
+  ok(base.exists());
+  hunspell.addDirectory(base);
+
+  // install map dictionary
+  var map = dir.clone();
+  map.append("map");
+  ok(map.exists());
+  hunspell.addDirectory(map);
+
+  // test that base and map dictionaries are available
+  var dicts = getDictionaryList(editor);
+  isnot(dicts.indexOf("base_utf"), -1, "base is available");
+  isnot(dicts.indexOf("maputf"), -1, "map is available");
+
+  // select base dictionary
+  setCurrentDictionary(editor, "base_utf");
+
+  SimpleTest.executeSoon(function() {
+    // test that base dictionary is in use
+    is(getMisspelledWords(editor), "Frühstück" + "qwertyu", "base misspellings");
+    is(getCurrentDictionary(editor), "base_utf", "current dictionary");
+
+    // select map dictionary
+    setCurrentDictionary(editor, "maputf");
+
+    SimpleTest.executeSoon(function() {
+      // test that map dictionary is in use
+      is(getMisspelledWords(editor), "created" + "imply" + "tomorrow" + "qwertyu", "map misspellings");
+      is(getCurrentDictionary(editor), "maputf", "current dictionary");
+
+      // uninstall map dictionary
+      hunspell.removeDirectory(map);
+
+      SimpleTest.executeSoon(function() {
+        // test that map dictionary is not in use
+        isnot(getMisspelledWords(editor), "created" + "imply" + "tomorrow" + "qwertyu", "map misspellings");
+        isnot(getCurrentDictionary(editor), "maputf", "current dictionary");
+
+        // test that base dictionary is available and map dictionary is unavailable
+        var dicts = getDictionaryList(editor);
+        isnot(dicts.indexOf("base_utf"), -1, "base is available");
+        is(dicts.indexOf("maputf"), -1, "map is unavailable");
+
+        // uninstall base dictionary
+        hunspell.removeDirectory(base);
+
+        SimpleTest.finish();
+      });
+    });
+  });
+}
+  ]]>
+  </script>
+  <textbox id="textbox" spellcheck="true" value="created imply Frühstück tomorrow qwertyu"/>
+</window>

From 2ee18355b9407326b23d0ee69cc4269701563db2 Mon Sep 17 00:00:00 2001
From: Ehsan Akhgari <ehsan@mozilla.com>
Date: Tue, 13 Sep 2011 15:09:51 -0400
Subject: [PATCH 057/209] Bug 686247 - Text control frames should accept
 dynamic changes to the CSS overflow property; r=bzbarsky,surkov

---
 .../mochitest/tree/test_cssoverflow.html      | 24 +++++++----------
 .../html/content/src/nsTextEditorState.cpp    | 27 ++++++++++++-------
 content/html/content/src/nsTextEditorState.h  |  2 ++
 .../editor/dynamic-overflow-change-ref.html   | 13 +++++++++
 .../editor/dynamic-overflow-change.html       | 13 +++++++++
 layout/reftests/editor/reftest.list           |  1 +
 layout/style/nsStyleStruct.cpp                |  4 +--
 7 files changed, 57 insertions(+), 27 deletions(-)
 create mode 100644 layout/reftests/editor/dynamic-overflow-change-ref.html
 create mode 100644 layout/reftests/editor/dynamic-overflow-change.html

diff --git a/accessible/tests/mochitest/tree/test_cssoverflow.html b/accessible/tests/mochitest/tree/test_cssoverflow.html
index 1a955f80cee1..8a5cf491d95c 100644
--- a/accessible/tests/mochitest/tree/test_cssoverflow.html
+++ b/accessible/tests/mochitest/tree/test_cssoverflow.html
@@ -35,10 +35,6 @@
         new invokerChecker(EVENT_FOCUS, getAccessible, this.linkNode)
       ];
 
-      this.unexpectedEventSeq = [
-        new invokerChecker(EVENT_REORDER, this.linkNode.parentNode)
-      ];
-
       this.invoke = function focusAnchor_invoke()
       {
         this.linkNode.focus();
@@ -46,8 +42,9 @@
 
       this.check = function focusAnchor_check(aEvent)
       {
-        is(this.link, aEvent.accessible,
-           "The link accessible shouldn't be recreated!");
+        todo_is(this.link, aEvent.accessible,
+                "Focus should be fired against new link accessible!");
+        todo(false, "Doubled reorder events!");
       }
 
       this.getID = function focusAnchor_getID()
@@ -65,10 +62,6 @@
         new invokerChecker(EVENT_FOCUS, getAccessible, this.linkNode)
       ];
 
-      this.unexpectedEventSeq = [
-        new invokerChecker(EVENT_REORDER, this.linkNode.parentNode)
-      ];
-
       this.invoke = function tabAnchor_invoke()
       {
         synthesizeKey("VK_TAB", { shiftKey: false });
@@ -76,8 +69,9 @@
 
       this.check = function tabAnchor_check(aEvent)
       {
-        is(this.link, aEvent.accessible,
-           "The link accessible shouldn't be recreated!");
+        todo_isnot(this.link, aEvent.accessible,
+                   "Focus should be fired against new link accessible!");
+        todo(false, "Doubled reorder events!");
       }
 
       this.getID = function tabAnchor_getID()
@@ -126,9 +120,9 @@
     Mozilla Bug 570275
   </a><br>
   <a target="_blank"
-     title="Don't recreate frames for inlines with overflow style applied"
-     href="https://bugzilla.mozilla.org/show_bug.cgi?id=606087">
-    Mozilla Bug 606087
+     title="Text control frames should accept dynamic changes to the CSS overflow property"
+     href="https://bugzilla.mozilla.org/show_bug.cgi?id=686247">
+    Mozilla Bug 686247
   </a><br>
 
   <p id="display"></p>
diff --git a/content/html/content/src/nsTextEditorState.cpp b/content/html/content/src/nsTextEditorState.cpp
index b91a54bd083c..28b24cf6ef24 100644
--- a/content/html/content/src/nsTextEditorState.cpp
+++ b/content/html/content/src/nsTextEditorState.cpp
@@ -1058,6 +1058,9 @@ nsTextEditorState::BindToFrame(nsTextControlFrame* aFrame)
 
   nsIContent *rootNode = GetRootNode();
 
+  nsresult rv = InitializeRootNode();
+  NS_ENSURE_SUCCESS(rv, rv);
+
   nsIPresShell *shell = mBoundFrame->PresContext()->GetPresShell();
   NS_ENSURE_TRUE(shell, NS_ERROR_FAILURE);
 
@@ -1545,6 +1548,17 @@ nsTextEditorState::CreateRootNode()
                                   NOT_FROM_PARSER);
   NS_ENSURE_SUCCESS(rv, rv);
 
+  if (!IsSingleLineTextControl()) {
+    mMutationObserver = new nsAnonDivObserver(this);
+    mRootNode->AddMutationObserver(mMutationObserver);
+  }
+
+  return rv;
+}
+
+nsresult
+nsTextEditorState::InitializeRootNode()
+{
   // Set the necessary classes on the text control. We use class values
   // instead of a 'style' attribute so that the style comes from a user-agent
   // style sheet and is still applied even if author styles are disabled.
@@ -1564,19 +1578,12 @@ nsTextEditorState::CreateRootNode()
         disp->mOverflowX != NS_STYLE_OVERFLOW_CLIP) {
       classValue.AppendLiteral(" inherit-overflow");
     }
-
-    mMutationObserver = new nsAnonDivObserver(this);
-    NS_ENSURE_TRUE(mMutationObserver, NS_ERROR_OUT_OF_MEMORY);
-    mRootNode->AddMutationObserver(mMutationObserver);
   }
-  rv = mRootNode->SetAttr(kNameSpaceID_None, nsGkAtoms::_class,
-                          classValue, PR_FALSE);
+  nsresult rv = mRootNode->SetAttr(kNameSpaceID_None, nsGkAtoms::_class,
+                                   classValue, PR_FALSE);
   NS_ENSURE_SUCCESS(rv, rv);
 
-  rv = mBoundFrame->UpdateValueDisplay(PR_FALSE);
-  NS_ENSURE_SUCCESS(rv, rv);
-
-  return rv;
+  return mBoundFrame->UpdateValueDisplay(PR_FALSE);
 }
 
 nsresult
diff --git a/content/html/content/src/nsTextEditorState.h b/content/html/content/src/nsTextEditorState.h
index 2e6a6b3a408f..56d162dddb38 100644
--- a/content/html/content/src/nsTextEditorState.h
+++ b/content/html/content/src/nsTextEditorState.h
@@ -253,6 +253,8 @@ private:
   void DestroyEditor();
   void Clear();
 
+  nsresult InitializeRootNode();
+
   void FinishedRestoringSelection() { mRestoringSelection = nsnull; }
 
   class InitializationGuard {
diff --git a/layout/reftests/editor/dynamic-overflow-change-ref.html b/layout/reftests/editor/dynamic-overflow-change-ref.html
new file mode 100644
index 000000000000..52e5f5bb0dd1
--- /dev/null
+++ b/layout/reftests/editor/dynamic-overflow-change-ref.html
@@ -0,0 +1,13 @@
+<!DOCTYPE html>
+<html>
+  <body>
+    <textarea rows="2" style="overflow: hidden;">
+      this
+      is
+      a
+      textarea
+      with
+      overflow
+    </textarea>
+  </body>
+</html>
diff --git a/layout/reftests/editor/dynamic-overflow-change.html b/layout/reftests/editor/dynamic-overflow-change.html
new file mode 100644
index 000000000000..57a1b8f74efe
--- /dev/null
+++ b/layout/reftests/editor/dynamic-overflow-change.html
@@ -0,0 +1,13 @@
+<!DOCTYPE html>
+<html>
+  <body onload="document.querySelector('textarea').style.overflow='hidden'">
+    <textarea rows="2">
+      this
+      is
+      a
+      textarea
+      with
+      overflow
+    </textarea>
+  </body>
+</html>
diff --git a/layout/reftests/editor/reftest.list b/layout/reftests/editor/reftest.list
index 95c0302400d0..4c51f4040478 100644
--- a/layout/reftests/editor/reftest.list
+++ b/layout/reftests/editor/reftest.list
@@ -69,3 +69,4 @@ skip-if(Android) == 674212-spellcheck.html 674212-spellcheck-ref.html
 skip-if(Android) == 338427-2.html 338427-2-ref.html
 skip-if(Android) == 338427-3.html 338427-3-ref.html
 skip-if(Android) == 462758-grabbers-resizers.html 462758-grabbers-resizers-ref.html
+== dynamic-overflow-change.html dynamic-overflow-change-ref.html
diff --git a/layout/style/nsStyleStruct.cpp b/layout/style/nsStyleStruct.cpp
index 06a7f5cb2341..f6217f120d76 100644
--- a/layout/style/nsStyleStruct.cpp
+++ b/layout/style/nsStyleStruct.cpp
@@ -2180,8 +2180,8 @@ nsChangeHint nsStyleDisplay::CalcDifference(const nsStyleDisplay& aOther) const
       || mPosition != aOther.mPosition
       || mDisplay != aOther.mDisplay
       || (mFloats == NS_STYLE_FLOAT_NONE) != (aOther.mFloats == NS_STYLE_FLOAT_NONE)
-      || (mOverflowX != aOther.mOverflowX && mDisplay != NS_STYLE_DISPLAY_INLINE)
-      || (mOverflowY != aOther.mOverflowY && mDisplay != NS_STYLE_DISPLAY_INLINE)
+      || mOverflowX != aOther.mOverflowX
+      || mOverflowY != aOther.mOverflowY
       || mResize != aOther.mResize)
     NS_UpdateHint(hint, nsChangeHint_ReconstructFrame);
 

From 795b4e1cc86a847739c924dfa2ae7f7ad0413afc Mon Sep 17 00:00:00 2001
From: Michal Novotny <michal.novotny@gmail.com>
Date: Tue, 13 Sep 2011 21:24:01 +0200
Subject: [PATCH 058/209] Bug 647391 - Increase maximum size for objects stored
 in disk cache.

---
 modules/libpref/src/init/all.js     | 12 ++++++------
 netwerk/cache/nsCacheService.h      |  6 ++++--
 netwerk/test/unit/test_bug654926.js | 17 +++++++++++++++--
 3 files changed, 25 insertions(+), 10 deletions(-)

diff --git a/modules/libpref/src/init/all.js b/modules/libpref/src/init/all.js
index a02732eff855..c21a5eb0dadc 100644
--- a/modules/libpref/src/init/all.js
+++ b/modules/libpref/src/init/all.js
@@ -64,16 +64,16 @@ pref("browser.cache.disk.enable",           true);
 pref("browser.cache.disk.smart_size.first_run", true);
 // Does the user want smart-sizing?
 pref("browser.cache.disk.smart_size.enabled", true);
-// Size explicitly set by the user. Used when smart_size.enabled == false
+// Size (in KB) explicitly set by the user. Used when smart_size.enabled == false
 pref("browser.cache.disk.capacity",         256000);
-// User-controllable max-size for entries in disk-cache. Regardless of this
-// setting, no entries bigger than 1/8 of disk-cache will be cached
-pref("browser.cache.disk.max_entry_size",    5120);
+// Max-size (in KB) for entries in disk cache. Set to -1 for no limit.
+// (Note: entries bigger than 1/8 of disk-cache are never cached)
+pref("browser.cache.disk.max_entry_size",    51200);  // 50 MB
 pref("browser.cache.memory.enable",         true);
 // -1 = determine dynamically, 0 = none, n = memory capacity in kilobytes
 //pref("browser.cache.memory.capacity",     -1);
-// User-controllable max-size for entries in mem-cache. Regardless of this
-// setting, no entries bigger than 90% of the mem-cache will be cached
+// Max-size (in KB) for entries in memory cache. Set to -1 for no limit.  
+// (Note: entries bigger than than 90% of the mem-cache are never cached)
 pref("browser.cache.memory.max_entry_size",  5120);
 pref("browser.cache.disk_cache_ssl",        true);
 // 0 = once-per-session, 1 = each-time, 2 = never, 3 = when-appropriate/automatically
diff --git a/netwerk/cache/nsCacheService.h b/netwerk/cache/nsCacheService.h
index 04c6981123c0..27b0af2a28f3 100644
--- a/netwerk/cache/nsCacheService.h
+++ b/netwerk/cache/nsCacheService.h
@@ -163,9 +163,11 @@ public:
     static void      SetDiskCacheEnabled(PRBool  enabled);
     // Sets the disk cache capacity (in kilobytes)
     static void      SetDiskCacheCapacity(PRInt32  capacity);
-    // Set max size for a disk-cache entry (in bytes). -1 disables this limit
+    // Set max size for a disk-cache entry (in KB). -1 disables limit up to
+    // 1/8th of disk cache size
     static void      SetDiskCacheMaxEntrySize(PRInt32  maxSize);
-    // Set max size for a memory-cache entry (in bytes). -1 disables this limit
+    // Set max size for a memory-cache entry (in kilobytes). -1 disables
+    // limit up to 90% of memory cache size
     static void      SetMemoryCacheMaxEntrySize(PRInt32  maxSize);
 
     static void      SetOfflineCacheEnabled(PRBool  enabled);
diff --git a/netwerk/test/unit/test_bug654926.js b/netwerk/test/unit/test_bug654926.js
index f840e90a2268..ddb1062d1f71 100644
--- a/netwerk/test/unit/test_bug654926.js
+++ b/netwerk/test/unit/test_bug654926.js
@@ -11,6 +11,15 @@ function get_cache_service() {
                  getService(Ci.nsICacheService);
 }
 
+var _PSvc;
+function get_pref_service() {
+  if (_PSvc)
+    return _PSvc;
+
+  return _PSvc = Cc["@mozilla.org/preferences-service;1"].
+                 getService(Ci.nsIPrefBranch);
+}
+
 function get_ostream_for_entry(key, asFile, append, entryRef)
 {
   var cache = get_cache_service();
@@ -79,9 +88,13 @@ function write_datafile()
   var oStr = get_ostream_for_entry("data", true, false, entry);
   var data = gen_1MiB();
 
-  // 6MiB
+  // max size in MB
+  var max_size = get_pref_service().
+                 getIntPref("browser.cache.disk.max_entry_size") / 1024;
+
+  // write larger entry than is allowed
   var i;
-  for (i=0 ; i<6 ; i++)
+  for (i=0 ; i<(max_size+1) ; i++)
     write_and_check(oStr, data, data.length);
 
   oStr.close();

From c3ab39edc6e94bd634c28d2be32ba92815388cf8 Mon Sep 17 00:00:00 2001
From: Mounir Lamouri <mounir.lamouri@gmail.com>
Date: Tue, 13 Sep 2011 12:37:51 -0700
Subject: [PATCH 059/209] Bug 675201 - Revert debug info given that the random
 orange is now fixed. r=me

---
 layout/generic/test/test_bug632379.xul | 2 --
 1 file changed, 2 deletions(-)

diff --git a/layout/generic/test/test_bug632379.xul b/layout/generic/test/test_bug632379.xul
index b023ce862bc1..9c4b5f4219a6 100644
--- a/layout/generic/test/test_bug632379.xul
+++ b/layout/generic/test/test_bug632379.xul
@@ -176,7 +176,6 @@ function snapshot(elem)
     pos[count] = elem.getBoundingClientRect().top;
     ++count;
     if (count <= 1) {
-        ok(true, "trying to open the second submenu");
         // close the submenu and open the bottom submenu
         synthesizeKey("VK_LEFT", {});
         synthesizeKey("9", {});
@@ -193,7 +192,6 @@ function doTest() {
 
 function openSubmenu()
 {
-    ok(true, "openSubMenu() called");
     // open a submenu in the middle
     synthesizeKey("5", {});
 }

From 5770abab5f1269b56e6da28043dcb77f4b498aaa Mon Sep 17 00:00:00 2001
From: Lucas Rocha <lucasr@mozilla.com>
Date: Tue, 13 Sep 2011 12:56:09 -0700
Subject: [PATCH 060/209] Bug 685568 - Add vertical divider between tab bar and
 web content (r=mbrubeck)

---
 mobile/themes/core/defines.inc | 1 +
 mobile/themes/core/tablet.css  | 2 +-
 2 files changed, 2 insertions(+), 1 deletion(-)

diff --git a/mobile/themes/core/defines.inc b/mobile/themes/core/defines.inc
index 42803a058281..fce7f956344e 100644
--- a/mobile/themes/core/defines.inc
+++ b/mobile/themes/core/defines.inc
@@ -37,6 +37,7 @@
 %define padding_xsmall 0.21mozmm
 %define padding_tiny 0.11mozmm
 
+%define border_width_xxlarge 0.64mozmm
 %define border_width_xlarge 0.42mozmm
 %define border_width_large 0.32mozmm
 %define border_width_small 0.21mozmm
diff --git a/mobile/themes/core/tablet.css b/mobile/themes/core/tablet.css
index fcf0471c5f66..2f3a90e05037 100644
--- a/mobile/themes/core/tablet.css
+++ b/mobile/themes/core/tablet.css
@@ -31,7 +31,7 @@
 }
 
 #tabs-container[tablet] {
-  -moz-border-end: 0px;
+  -moz-border-end: @border_width_xxlarge@ solid #eaeaea;
   background: #000;
 }
 

From f4cbad79bb88c22989e5f8a9663a485335b7729c Mon Sep 17 00:00:00 2001
From: Matt Brubeck <mbrubeck@mozilla.com>
Date: Tue, 13 Sep 2011 13:01:59 -0700
Subject: [PATCH 061/209] Bug 685568 - Add vertical divider between tab bar and
 web content (remove change that accidentally snuck in)

---
 mobile/themes/core/tablet.css | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/mobile/themes/core/tablet.css b/mobile/themes/core/tablet.css
index 2f3a90e05037..2472cca229aa 100644
--- a/mobile/themes/core/tablet.css
+++ b/mobile/themes/core/tablet.css
@@ -31,7 +31,7 @@
 }
 
 #tabs-container[tablet] {
-  -moz-border-end: @border_width_xxlarge@ solid #eaeaea;
+  -moz-border-end: @border_width_xlarge@ solid #eaeaea;
   background: #000;
 }
 

From 2cb2e9f876af4e63f1a4d1f0494c047a7b794faa Mon Sep 17 00:00:00 2001
From: Ehsan Akhgari <ehsan@mozilla.com>
Date: Tue, 13 Sep 2011 17:42:43 -0400
Subject: [PATCH 062/209] Backout changeset 2705abe8d3f2 (bug 686247) again
 because of the accessibility test failures

---
 .../mochitest/tree/test_cssoverflow.html      | 24 ++++++++++-------
 .../html/content/src/nsTextEditorState.cpp    | 27 +++++++------------
 content/html/content/src/nsTextEditorState.h  |  2 --
 .../editor/dynamic-overflow-change-ref.html   | 13 ---------
 .../editor/dynamic-overflow-change.html       | 13 ---------
 layout/reftests/editor/reftest.list           |  1 -
 layout/style/nsStyleStruct.cpp                |  4 +--
 7 files changed, 27 insertions(+), 57 deletions(-)
 delete mode 100644 layout/reftests/editor/dynamic-overflow-change-ref.html
 delete mode 100644 layout/reftests/editor/dynamic-overflow-change.html

diff --git a/accessible/tests/mochitest/tree/test_cssoverflow.html b/accessible/tests/mochitest/tree/test_cssoverflow.html
index 8a5cf491d95c..1a955f80cee1 100644
--- a/accessible/tests/mochitest/tree/test_cssoverflow.html
+++ b/accessible/tests/mochitest/tree/test_cssoverflow.html
@@ -35,6 +35,10 @@
         new invokerChecker(EVENT_FOCUS, getAccessible, this.linkNode)
       ];
 
+      this.unexpectedEventSeq = [
+        new invokerChecker(EVENT_REORDER, this.linkNode.parentNode)
+      ];
+
       this.invoke = function focusAnchor_invoke()
       {
         this.linkNode.focus();
@@ -42,9 +46,8 @@
 
       this.check = function focusAnchor_check(aEvent)
       {
-        todo_is(this.link, aEvent.accessible,
-                "Focus should be fired against new link accessible!");
-        todo(false, "Doubled reorder events!");
+        is(this.link, aEvent.accessible,
+           "The link accessible shouldn't be recreated!");
       }
 
       this.getID = function focusAnchor_getID()
@@ -62,6 +65,10 @@
         new invokerChecker(EVENT_FOCUS, getAccessible, this.linkNode)
       ];
 
+      this.unexpectedEventSeq = [
+        new invokerChecker(EVENT_REORDER, this.linkNode.parentNode)
+      ];
+
       this.invoke = function tabAnchor_invoke()
       {
         synthesizeKey("VK_TAB", { shiftKey: false });
@@ -69,9 +76,8 @@
 
       this.check = function tabAnchor_check(aEvent)
       {
-        todo_isnot(this.link, aEvent.accessible,
-                   "Focus should be fired against new link accessible!");
-        todo(false, "Doubled reorder events!");
+        is(this.link, aEvent.accessible,
+           "The link accessible shouldn't be recreated!");
       }
 
       this.getID = function tabAnchor_getID()
@@ -120,9 +126,9 @@
     Mozilla Bug 570275
   </a><br>
   <a target="_blank"
-     title="Text control frames should accept dynamic changes to the CSS overflow property"
-     href="https://bugzilla.mozilla.org/show_bug.cgi?id=686247">
-    Mozilla Bug 686247
+     title="Don't recreate frames for inlines with overflow style applied"
+     href="https://bugzilla.mozilla.org/show_bug.cgi?id=606087">
+    Mozilla Bug 606087
   </a><br>
 
   <p id="display"></p>
diff --git a/content/html/content/src/nsTextEditorState.cpp b/content/html/content/src/nsTextEditorState.cpp
index 28b24cf6ef24..b91a54bd083c 100644
--- a/content/html/content/src/nsTextEditorState.cpp
+++ b/content/html/content/src/nsTextEditorState.cpp
@@ -1058,9 +1058,6 @@ nsTextEditorState::BindToFrame(nsTextControlFrame* aFrame)
 
   nsIContent *rootNode = GetRootNode();
 
-  nsresult rv = InitializeRootNode();
-  NS_ENSURE_SUCCESS(rv, rv);
-
   nsIPresShell *shell = mBoundFrame->PresContext()->GetPresShell();
   NS_ENSURE_TRUE(shell, NS_ERROR_FAILURE);
 
@@ -1548,17 +1545,6 @@ nsTextEditorState::CreateRootNode()
                                   NOT_FROM_PARSER);
   NS_ENSURE_SUCCESS(rv, rv);
 
-  if (!IsSingleLineTextControl()) {
-    mMutationObserver = new nsAnonDivObserver(this);
-    mRootNode->AddMutationObserver(mMutationObserver);
-  }
-
-  return rv;
-}
-
-nsresult
-nsTextEditorState::InitializeRootNode()
-{
   // Set the necessary classes on the text control. We use class values
   // instead of a 'style' attribute so that the style comes from a user-agent
   // style sheet and is still applied even if author styles are disabled.
@@ -1578,12 +1564,19 @@ nsTextEditorState::InitializeRootNode()
         disp->mOverflowX != NS_STYLE_OVERFLOW_CLIP) {
       classValue.AppendLiteral(" inherit-overflow");
     }
+
+    mMutationObserver = new nsAnonDivObserver(this);
+    NS_ENSURE_TRUE(mMutationObserver, NS_ERROR_OUT_OF_MEMORY);
+    mRootNode->AddMutationObserver(mMutationObserver);
   }
-  nsresult rv = mRootNode->SetAttr(kNameSpaceID_None, nsGkAtoms::_class,
-                                   classValue, PR_FALSE);
+  rv = mRootNode->SetAttr(kNameSpaceID_None, nsGkAtoms::_class,
+                          classValue, PR_FALSE);
   NS_ENSURE_SUCCESS(rv, rv);
 
-  return mBoundFrame->UpdateValueDisplay(PR_FALSE);
+  rv = mBoundFrame->UpdateValueDisplay(PR_FALSE);
+  NS_ENSURE_SUCCESS(rv, rv);
+
+  return rv;
 }
 
 nsresult
diff --git a/content/html/content/src/nsTextEditorState.h b/content/html/content/src/nsTextEditorState.h
index 56d162dddb38..2e6a6b3a408f 100644
--- a/content/html/content/src/nsTextEditorState.h
+++ b/content/html/content/src/nsTextEditorState.h
@@ -253,8 +253,6 @@ private:
   void DestroyEditor();
   void Clear();
 
-  nsresult InitializeRootNode();
-
   void FinishedRestoringSelection() { mRestoringSelection = nsnull; }
 
   class InitializationGuard {
diff --git a/layout/reftests/editor/dynamic-overflow-change-ref.html b/layout/reftests/editor/dynamic-overflow-change-ref.html
deleted file mode 100644
index 52e5f5bb0dd1..000000000000
--- a/layout/reftests/editor/dynamic-overflow-change-ref.html
+++ /dev/null
@@ -1,13 +0,0 @@
-<!DOCTYPE html>
-<html>
-  <body>
-    <textarea rows="2" style="overflow: hidden;">
-      this
-      is
-      a
-      textarea
-      with
-      overflow
-    </textarea>
-  </body>
-</html>
diff --git a/layout/reftests/editor/dynamic-overflow-change.html b/layout/reftests/editor/dynamic-overflow-change.html
deleted file mode 100644
index 57a1b8f74efe..000000000000
--- a/layout/reftests/editor/dynamic-overflow-change.html
+++ /dev/null
@@ -1,13 +0,0 @@
-<!DOCTYPE html>
-<html>
-  <body onload="document.querySelector('textarea').style.overflow='hidden'">
-    <textarea rows="2">
-      this
-      is
-      a
-      textarea
-      with
-      overflow
-    </textarea>
-  </body>
-</html>
diff --git a/layout/reftests/editor/reftest.list b/layout/reftests/editor/reftest.list
index 4c51f4040478..95c0302400d0 100644
--- a/layout/reftests/editor/reftest.list
+++ b/layout/reftests/editor/reftest.list
@@ -69,4 +69,3 @@ skip-if(Android) == 674212-spellcheck.html 674212-spellcheck-ref.html
 skip-if(Android) == 338427-2.html 338427-2-ref.html
 skip-if(Android) == 338427-3.html 338427-3-ref.html
 skip-if(Android) == 462758-grabbers-resizers.html 462758-grabbers-resizers-ref.html
-== dynamic-overflow-change.html dynamic-overflow-change-ref.html
diff --git a/layout/style/nsStyleStruct.cpp b/layout/style/nsStyleStruct.cpp
index f6217f120d76..06a7f5cb2341 100644
--- a/layout/style/nsStyleStruct.cpp
+++ b/layout/style/nsStyleStruct.cpp
@@ -2180,8 +2180,8 @@ nsChangeHint nsStyleDisplay::CalcDifference(const nsStyleDisplay& aOther) const
       || mPosition != aOther.mPosition
       || mDisplay != aOther.mDisplay
       || (mFloats == NS_STYLE_FLOAT_NONE) != (aOther.mFloats == NS_STYLE_FLOAT_NONE)
-      || mOverflowX != aOther.mOverflowX
-      || mOverflowY != aOther.mOverflowY
+      || (mOverflowX != aOther.mOverflowX && mDisplay != NS_STYLE_DISPLAY_INLINE)
+      || (mOverflowY != aOther.mOverflowY && mDisplay != NS_STYLE_DISPLAY_INLINE)
       || mResize != aOther.mResize)
     NS_UpdateHint(hint, nsChangeHint_ReconstructFrame);
 

From cbe7faff4eefac8558e37c2269d8e61953ae1ab9 Mon Sep 17 00:00:00 2001
From: Jason Duell <jduell.mcbugs@gmail.com>
Date: Tue, 13 Sep 2011 15:14:01 -0700
Subject: [PATCH 063/209] Bug 682478. Wait longer to get correct filename for
 "save link as". r=limi

---
 browser/app/profile/firefox.js | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/browser/app/profile/firefox.js b/browser/app/profile/firefox.js
index a74ee5345887..3397e661e397 100644
--- a/browser/app/profile/firefox.js
+++ b/browser/app/profile/firefox.js
@@ -308,7 +308,7 @@ pref("browser.urlbar.trimURLs", true);
 // the Content-Disposition filename) before giving up and falling back to 
 // picking a filename without that info in hand so that the user sees some
 // feedback from their action.
-pref("browser.download.saveLinkAsFilenameTimeout", 1000);
+pref("browser.download.saveLinkAsFilenameTimeout", 4000);
 
 pref("browser.download.useDownloadDir", true);
 

From 84adc211f588b130e830241c8e42bc0a7f98c1bd Mon Sep 17 00:00:00 2001
From: Jason Duell <jduell.mcbugs@gmail.com>
Date: Tue, 13 Sep 2011 15:15:28 -0700
Subject: [PATCH 064/209] Bug 686558 - Get rid of gcc warning about "enumeral
 mismatch" in nsNetUtil.h. r=bz

---
 netwerk/base/public/nsNetUtil.h | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/netwerk/base/public/nsNetUtil.h b/netwerk/base/public/nsNetUtil.h
index 08e2ed8fc035..b1c1926f7032 100644
--- a/netwerk/base/public/nsNetUtil.h
+++ b/netwerk/base/public/nsNetUtil.h
@@ -1946,9 +1946,9 @@ NS_GetContentDispositionFromHeader(const nsACString& aHeader, nsIChannel *aChan
 
   if (NS_FAILED(rv)) {
     // special case (see bug 272541): empty disposition type handled as "inline"
-    return rv == NS_ERROR_FIRST_HEADER_FIELD_COMPONENT_EMPTY
-                 ? nsIChannel::DISPOSITION_INLINE
-                 : nsIChannel::DISPOSITION_ATTACHMENT;
+    if (rv == NS_ERROR_FIRST_HEADER_FIELD_COMPONENT_EMPTY)
+        return nsIChannel::DISPOSITION_INLINE;
+    return nsIChannel::DISPOSITION_ATTACHMENT;
   }
 
   return NS_GetContentDispositionFromToken(dispToken);

From 14cb86fb7f6de3ee640513fb69d805f9723f9509 Mon Sep 17 00:00:00 2001
From: Mounir Lamouri <mounir.lamouri@gmail.com>
Date: Tue, 13 Sep 2011 15:35:23 -0700
Subject: [PATCH 065/209] Bug 686350 - Check in configure script that the
 selected Android SDK is correct. r=glandium

---
 configure.in        | 22 ++++++++++++++++++++++
 js/src/configure.in | 22 ++++++++++++++++++++++
 2 files changed, 44 insertions(+)

diff --git a/configure.in b/configure.in
index 0df935078c7d..4bde68bc335b 100644
--- a/configure.in
+++ b/configure.in
@@ -295,6 +295,28 @@ case "$target" in
 
     if test -z "$android_sdk" ; then
         AC_MSG_ERROR([You must specify --with-android-sdk=/path/to/sdk when targeting Android.])
+    else
+        if ! test -e "$android_sdk"/source.properties ; then
+            AC_MSG_ERROR([The path in --with-android-sdk isn't valid (source.properties hasn't been found).])
+        fi
+
+        # Minimum Android SDK API Level we require.
+        android_min_api_level=13
+
+        # Get the api level from "$android_sdk"/source.properties.
+        android_api_level=`$AWK -F = '$1 == "AndroidVersion.ApiLevel" {print $2}' "$android_sdk"/source.properties`
+
+        if test -z "$android_api_level" ; then
+            AC_MSG_ERROR([Unexpected error: no AndroidVersion.ApiLevel field has been found in source.properties.])
+        fi
+
+        if ! test "$android_api_level" -eq "$android_api_level" ; then
+            AC_MSG_ERROR([Unexpected error: the found android api value isn't a number! (found $android_api_level)])
+        fi
+
+        if test $android_api_level -lt $android_min_api_level ; then
+            AC_MSG_ERROR([The given Android SDK provides API level $android_api_level ($android_min_api_level or higher required).])
+        fi
     fi
 
     android_platform_tools="$android_sdk"/../../platform-tools
diff --git a/js/src/configure.in b/js/src/configure.in
index 34d57e12f6d4..b26d35085d22 100644
--- a/js/src/configure.in
+++ b/js/src/configure.in
@@ -291,6 +291,28 @@ case "$target" in
     android_platform_tools="$android_sdk"/../../platform-tools
     if test ! -d "$android_platform_tools" ; then
         android_platform_tools="$android_sdk"/tools # SDK Tools < r8
+    else
+        if ! test -e "$android_sdk"/source.properties ; then
+            AC_MSG_ERROR([The path in --with-android-sdk isn't valid (source.properties hasn't been found).])
+        fi
+
+        # Minimum Android SDK API Level we require.
+        android_min_api_level=13
+
+        # Get the api level from "$android_sdk"/source.properties.
+        android_api_level=`$AWK -F = '$1 == "AndroidVersion.ApiLevel" {print $2}' "$android_sdk"/source.properties`
+
+        if test -z "$android_api_level" ; then
+            AC_MSG_ERROR([Unexpected error: no AndroidVersion.ApiLevel field has been found in source.properties.])
+        fi
+
+        if ! test "$android_api_level" -eq "$android_api_level" ; then
+            AC_MSG_ERROR([Unexpected error: the found android api value isn't a number! (found $android_api_level)])
+        fi
+
+        if test $android_api_level -lt $android_min_api_level ; then
+            AC_MSG_ERROR([The given Android SDK provides API level $android_api_level ($android_min_api_level or higher required).])
+        fi
     fi
 
     if test -z "$android_toolchain" ; then

From 72b02dfde499ae0982cc41da1c9bc7b0f91da9e0 Mon Sep 17 00:00:00 2001
From: Steve Fink <sfink@mozilla.com>
Date: Thu, 8 Sep 2011 11:25:06 -0700
Subject: [PATCH 066/209] Bug 684713 - Match full function name when giving JS
 shell help messages (r=cdleary)

--HG--
extra : rebase_source : 20c5e3748e7918cc19c13c09d732cc8560188762
---
 js/src/shell/js.cpp | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/js/src/shell/js.cpp b/js/src/shell/js.cpp
index 5be368ebca65..fd6fa356965f 100644
--- a/js/src/shell/js.cpp
+++ b/js/src/shell/js.cpp
@@ -4527,6 +4527,9 @@ Help(JSContext *cx, uintN argc, jsval *vp)
                     const char *p = strchr(msg, '(');
                     JS_ASSERT(p);
 
+                    if (size_t(p - msg) != str->length())
+                        continue;
+
                     if (strncmp(funcName.ptr(), msg, p - msg) == 0) {
                         if (!did_header) {
                             did_header = 1;

From e479aadc29a63ef36e40fe4c858deb5f51201285 Mon Sep 17 00:00:00 2001
From: Steve Fink <sfink@mozilla.com>
Date: Wed, 7 Sep 2011 17:25:25 -0700
Subject: [PATCH 067/209] Bug 686571 - Check for jit->pcLengths before using
 (r=bhackett)

---
 js/src/methodjit/PolyIC.cpp | 12 +++++++-----
 1 file changed, 7 insertions(+), 5 deletions(-)

diff --git a/js/src/methodjit/PolyIC.cpp b/js/src/methodjit/PolyIC.cpp
index 992205fd1c50..63363d828815 100644
--- a/js/src/methodjit/PolyIC.cpp
+++ b/js/src/methodjit/PolyIC.cpp
@@ -2224,13 +2224,14 @@ inline uint32 frameCountersOffset(JSContext *cx)
 LookupStatus
 BaseIC::disable(JSContext *cx, const char *reason, void *stub)
 {
-    if (cx->hasRunOption(JSOPTION_PCCOUNT)) {
+    JITScript *jit = cx->fp()->jit();
+    if (jit->pcLengths) {
         uint32 offset = frameCountersOffset(cx);
-        cx->fp()->jit()->pcLengths[offset].picsLength = 0;
+        jit->pcLengths[offset].picsLength = 0;
     }
 
     spew(cx, "disabled", reason);
-    Repatcher repatcher(cx->fp()->jit());
+    Repatcher repatcher(jit);
     repatcher.relink(slowPathCall, FunctionPtr(stub));
     return Lookup_Uncacheable;
 }
@@ -2238,9 +2239,10 @@ BaseIC::disable(JSContext *cx, const char *reason, void *stub)
 void
 BaseIC::updatePCCounters(JSContext *cx, Assembler &masm)
 {
-    if (cx->hasRunOption(JSOPTION_PCCOUNT)) {
+    JITScript *jit = cx->fp()->jit();
+    if (jit->pcLengths) {
         uint32 offset = frameCountersOffset(cx);
-        cx->fp()->jit()->pcLengths[offset].picsLength += masm.size();
+        jit->pcLengths[offset].picsLength += masm.size();
     }
 }
 

From 45f59a47636ece0a45962e9b8a970255b5129995 Mon Sep 17 00:00:00 2001
From: Steve Fink <sfink@mozilla.com>
Date: Wed, 7 Sep 2011 16:58:28 -0700
Subject: [PATCH 068/209] Bug 686571 - Add options
 javascript.options.pccounts.content and javascript.options.pccounts.chrome
 for controlling JSOPTION_PCCOUNTS (r=dmandelin)

---
 dom/base/nsJSEnvironment.cpp | 11 +++++++++++
 1 file changed, 11 insertions(+)

diff --git a/dom/base/nsJSEnvironment.cpp b/dom/base/nsJSEnvironment.cpp
index 5ac2e0805b16..2ce9b50a7a29 100644
--- a/dom/base/nsJSEnvironment.cpp
+++ b/dom/base/nsJSEnvironment.cpp
@@ -916,6 +916,8 @@ static const char js_profiling_content_str[]  = JS_OPTIONS_DOT_STR "jitprofiling
 static const char js_profiling_chrome_str[]   = JS_OPTIONS_DOT_STR "jitprofiling.chrome";
 static const char js_methodjit_always_str[]   = JS_OPTIONS_DOT_STR "methodjit_always";
 static const char js_typeinfer_str[]          = JS_OPTIONS_DOT_STR "typeinference";
+static const char js_pccounts_content_str[]   = JS_OPTIONS_DOT_STR "pccounts.content";
+static const char js_pccounts_chrome_str[]    = JS_OPTIONS_DOT_STR "pccounts.chrome";
 static const char js_memlog_option_str[] = JS_OPTIONS_DOT_STR "mem.log";
 
 int
@@ -947,6 +949,9 @@ nsJSContext::JSOptionChangedCallback(const char *pref, void *data)
   PRBool useProfiling = Preferences::GetBool(chromeWindow ?
                                                js_profiling_chrome_str :
                                                js_profiling_content_str);
+  PRBool usePCCounts = Preferences::GetBool(chromeWindow ?
+                                            js_pccounts_chrome_str :
+                                            js_pccounts_content_str);
   PRBool useMethodJITAlways = Preferences::GetBool(js_methodjit_always_str);
   PRBool useTypeInference = !chromeWindow && Preferences::GetBool(js_typeinfer_str);
   nsCOMPtr<nsIXULRuntime> xr = do_GetService(XULRUNTIME_SERVICE_CONTRACTID);
@@ -957,6 +962,7 @@ nsJSContext::JSOptionChangedCallback(const char *pref, void *data)
       useTraceJIT = PR_FALSE;
       useMethodJIT = PR_FALSE;
       useProfiling = PR_FALSE;
+      usePCCounts = PR_FALSE;
       useTypeInference = PR_FALSE;
       useMethodJITAlways = PR_TRUE;
     }
@@ -977,6 +983,11 @@ nsJSContext::JSOptionChangedCallback(const char *pref, void *data)
   else
     newDefaultJSOptions &= ~JSOPTION_PROFILING;
 
+  if (usePCCounts)
+    newDefaultJSOptions |= JSOPTION_PCCOUNT;
+  else
+    newDefaultJSOptions &= ~JSOPTION_PCCOUNT;
+
   if (useMethodJITAlways)
     newDefaultJSOptions |= JSOPTION_METHODJIT_ALWAYS;
   else

From 5ec59a92cb3bc3d91277262e8376faea42636d4f Mon Sep 17 00:00:00 2001
From: Brian Hackett <bhackett1024@gmail.com>
Date: Wed, 7 Sep 2011 22:43:06 -0700
Subject: [PATCH 069/209] Don't mark bytecodes accessing getter ops when inside
 an imacro, bug 557358.

---
 js/src/jsobj.cpp | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/js/src/jsobj.cpp b/js/src/jsobj.cpp
index 057848c53bd2..250756e4e2c8 100644
--- a/js/src/jsobj.cpp
+++ b/js/src/jsobj.cpp
@@ -5604,7 +5604,7 @@ js_NativeGetInline(JSContext *cx, JSObject *receiver, JSObject *obj, JSObject *p
 
     jsbytecode *pc;
     JSScript *script = cx->stack.currentScript(&pc);
-    if (script && script->hasAnalysis()) {
+    if (script && script->hasAnalysis() && !cx->fp()->hasImacropc()) {
         analyze::Bytecode *code = script->analysis()->maybeCode(pc);
         if (code)
             code->accessGetter = true;

From 3cfa7e139434b39d47783d604469d80c772a6e9c Mon Sep 17 00:00:00 2001
From: Mike Hommey <mh+mozilla@glandium.org>
Date: Thu, 8 Sep 2011 09:12:42 +0200
Subject: [PATCH 070/209] Bug 664090 - Store offset inside segment instead of
 pointer for nsStorageInputStream. r=bsmedberg

---
 xpcom/io/nsStorageStream.cpp | 20 ++++++++++----------
 1 file changed, 10 insertions(+), 10 deletions(-)

diff --git a/xpcom/io/nsStorageStream.cpp b/xpcom/io/nsStorageStream.cpp
index 069067145bbb..f39248e31060 100644
--- a/xpcom/io/nsStorageStream.cpp
+++ b/xpcom/io/nsStorageStream.cpp
@@ -362,8 +362,8 @@ protected:
 
 private:
     nsStorageStream* mStorageStream;
-    const char*      mReadCursor;    // Next memory location to read byte, or NULL
-    const char*      mSegmentEnd;    // One byte past end of current buffer segment
+    PRUint32         mReadCursor;    // Next memory location to read byte, or NULL
+    PRUint32         mSegmentEnd;    // One byte past end of current buffer segment
     PRUint32         mSegmentNum;    // Segment number containing read cursor
     PRUint32         mSegmentSize;   // All segments, except the last, are of this size
     PRUint32         mLogicalCursor; // Logical offset into stream
@@ -441,13 +441,15 @@ nsStorageInputStream::ReadSegments(nsWriteSegmentFun writer, void * closure, PRU
             if (!available)
                 goto out;
 
-            mReadCursor = mStorageStream->mSegmentedBuffer->GetSegment(++mSegmentNum);
-            mSegmentEnd = mReadCursor + NS_MIN(mSegmentSize, available);
-            availableInSegment = mSegmentEnd - mReadCursor;
+            mSegmentNum++;
+            mReadCursor = 0;
+            mSegmentEnd = NS_MIN(mSegmentSize, available);
+            availableInSegment = mSegmentEnd;
         }
+        const char *cur = mStorageStream->mSegmentedBuffer->GetSegment(mSegmentNum);
 	
         count = NS_MIN(availableInSegment, remainingCapacity);
-        rv = writer(this, closure, mReadCursor, aCount - remainingCapacity,
+        rv = writer(this, closure, cur + mReadCursor, aCount - remainingCapacity,
                     count, &bytesConsumed);
         if (NS_FAILED(rv) || (bytesConsumed == 0))
           break;
@@ -534,11 +536,9 @@ nsStorageInputStream::Seek(PRUint32 aPosition)
         return NS_OK;
 
     mSegmentNum = SegNum(aPosition);
-    PRUint32 segmentOffset = SegOffset(aPosition);
-    mReadCursor = mStorageStream->mSegmentedBuffer->GetSegment(mSegmentNum) +
-        segmentOffset;
+    mReadCursor = SegOffset(aPosition);
     PRUint32 available = length - aPosition;
-    mSegmentEnd = mReadCursor + NS_MIN(mSegmentSize - segmentOffset, available);
+    mSegmentEnd = mReadCursor + NS_MIN(mSegmentSize - mReadCursor, available);
     mLogicalCursor = aPosition;
     return NS_OK;
 }

From 713bbacf8d537e6b401a121f5d799cb1d682bf62 Mon Sep 17 00:00:00 2001
From: Mike Hommey <mh+mozilla@glandium.org>
Date: Thu, 8 Sep 2011 09:12:58 +0200
Subject: [PATCH 071/209] Bug 664090 - Enable test_errorhandler_filelog.js on
 windows. r=philikon

---
 services/sync/tests/unit/xpcshell.ini | 3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)

diff --git a/services/sync/tests/unit/xpcshell.ini b/services/sync/tests/unit/xpcshell.ini
index 45bc419c82fe..fb1acee2596f 100644
--- a/services/sync/tests/unit/xpcshell.ini
+++ b/services/sync/tests/unit/xpcshell.ini
@@ -27,9 +27,8 @@ tail =
 [test_enginemanager.js]
 [test_errorhandler.js]
 [test_errorhandler_filelog.js]
-# Bug 664090: this test persistently fails on Windows opt builds.
 # Bug 676978: test hangs on Android (see also testing/xpcshell/xpcshell.ini)
-skip-if = (os == "win" && !debug) || os == "android"
+skip-if = os == "android"
 [test_errorhandler_sync_checkServerError.js]
 # Bug 604565: this test intermittently hangs on OS X debug builds.
 # Bug 676978: test hangs on Android (see also testing/xpcshell/xpcshell.ini)

From 4d7078af45eb0a0a9a065088782b11d4960f80d1 Mon Sep 17 00:00:00 2001
From: Brian Hackett <bhackett1024@gmail.com>
Date: Thu, 8 Sep 2011 09:36:55 -0700
Subject: [PATCH 072/209] Don't try to generate getter ICs when fusing GETPROP,
 bug 557358.

---
 js/src/methodjit/Compiler.cpp | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/js/src/methodjit/Compiler.cpp b/js/src/methodjit/Compiler.cpp
index 59b59ad759e2..f1faec211501 100644
--- a/js/src/methodjit/Compiler.cpp
+++ b/js/src/methodjit/Compiler.cpp
@@ -4454,7 +4454,7 @@ mjit::Compiler::jsop_getprop(JSAtom *atom, JSValueType knownType,
      * type barrier if inference is enabled (known property types do not
      * reflect properties with getter hooks).
      */
-    pic.canCallHook = usePropCache && analysis->getCode(PC).accessGetter;
+    pic.canCallHook = usePropCache && JSOp(*PC) == JSOP_GETPROP && analysis->getCode(PC).accessGetter;
     if (pic.canCallHook)
         frame.syncAndKillEverything();
 

From fa75e206b85e67dcd1b72139bed41b00937728fa Mon Sep 17 00:00:00 2001
From: Felix Fung <ffung@mozilla.com>
Date: Thu, 8 Sep 2011 12:36:35 -0700
Subject: [PATCH 073/209] Bug 626626 - Reference Correct Strings in Password
 Manager. r=dolske

---
 .../passwordmgr/nsLoginManagerPrompter.js     | 30 +++++--------------
 1 file changed, 7 insertions(+), 23 deletions(-)

diff --git a/toolkit/components/passwordmgr/nsLoginManagerPrompter.js b/toolkit/components/passwordmgr/nsLoginManagerPrompter.js
index 85d740eb58c0..f90199a3d294 100644
--- a/toolkit/components/passwordmgr/nsLoginManagerPrompter.js
+++ b/toolkit/components/passwordmgr/nsLoginManagerPrompter.js
@@ -265,21 +265,6 @@ LoginManagerPrompter.prototype = {
     },
 
 
-    __brandBundle : null, // String bundle for L10N
-    get _brandBundle() {
-        if (!this.__brandBundle) {
-            var bunService = Cc["@mozilla.org/intl/stringbundle;1"].
-                             getService(Ci.nsIStringBundleService);
-            this.__brandBundle = bunService.createBundle(
-                        "chrome://branding/locale/brand.properties");
-            if (!this.__brandBundle)
-                throw "Branding string bundle not present!";
-        }
-
-        return this.__brandBundle;
-    },
-
-
     __ellipsis : null,
     get _ellipsis() {
         if (!this.__ellipsis) {
@@ -956,20 +941,19 @@ LoginManagerPrompter.prototype = {
             (Ci.nsIPrompt.BUTTON_TITLE_IS_STRING * Ci.nsIPrompt.BUTTON_POS_1) +
             (Ci.nsIPrompt.BUTTON_TITLE_IS_STRING * Ci.nsIPrompt.BUTTON_POS_2);
 
-        var brandShortName =
-                this._brandBundle.GetStringFromName("brandShortName");
         var displayHost = this._getShortDisplayHost(aLogin.hostname);
 
         var dialogText;
         if (aLogin.username) {
             var displayUser = this._sanitizeUsername(aLogin.username);
             dialogText = this._getLocalizedString(
-                                 "saveLoginText",
-                                 [brandShortName, displayUser, displayHost]);
+                                 "rememberPasswordText",
+                                 [displayUser, displayHost]);
         } else {
             dialogText = this._getLocalizedString(
-                                 "saveLoginTextNoUsername",
-                                 [brandShortName, displayHost]);
+                                 "rememberPasswordTextNoUsername",
+                                 [displayHost]);
+
         }
         var dialogTitle        = this._getLocalizedString(
                                         "savePasswordTitle");
@@ -1116,11 +1100,11 @@ LoginManagerPrompter.prototype = {
         var dialogText;
         if (aOldLogin.username)
             dialogText  = this._getLocalizedString(
-                                    "passwordChangeText",
+                                    "updatePasswordText",
                                     [aOldLogin.username]);
         else
             dialogText  = this._getLocalizedString(
-                                    "passwordChangeTextNoUser");
+                                    "updatePasswordTextNoUser");
 
         var dialogTitle = this._getLocalizedString(
                                     "passwordChangeTitle");

From ecf8e75d9b62f5cd4d04b19d61ccbed89e589336 Mon Sep 17 00:00:00 2001
From: Siddharth Agarwal <sid.bugzilla@gmail.com>
Date: Fri, 9 Sep 2011 02:00:31 +0530
Subject: [PATCH 074/209] Bug 681659 - Execute mozconfig-find just once and
 make sure mozconfig detection errors are handled properly. r=ted

---
 build/autoconf/mozconfig-find      |  8 ++++----
 build/autoconf/mozconfig2client-mk | 27 ++++++++++++++++++++-------
 build/autoconf/mozconfig2configure | 19 +++++++++++++++----
 3 files changed, 39 insertions(+), 15 deletions(-)

diff --git a/build/autoconf/mozconfig-find b/build/autoconf/mozconfig-find
index 1895292f7783..64dc1c574998 100755
--- a/build/autoconf/mozconfig-find
+++ b/build/autoconf/mozconfig-find
@@ -69,17 +69,17 @@ abspath() {
 }
 
 if [ -n "$MOZCONFIG" ] && ! [ -f "$MOZCONFIG" ]; then
-  echo "Specified MOZCONFIG \"$MOZCONFIG\" does not exist!"
+  echo "Specified MOZCONFIG \"$MOZCONFIG\" does not exist!" 1>&2
   exit 1
 fi
 
 if [ -n "$MOZ_MYCONFIG" ]; then
-  echo "Your environment currently has the MOZ_MYCONFIG variable set to \"$MOZ_MYCONFIG\". MOZ_MYCONFIG is no longer supported. Please use MOZCONFIG instead."
+  echo "Your environment currently has the MOZ_MYCONFIG variable set to \"$MOZ_MYCONFIG\". MOZ_MYCONFIG is no longer supported. Please use MOZCONFIG instead." 1>&2
   exit 1
 fi
 
 if [ -z "$MOZCONFIG" ] && [ -f "$topsrcdir/.mozconfig" ] && [ -f "$topsrcdir/mozconfig" ]; then
-  echo "Both \$topsrcdir/.mozconfig and \$topsrcdir/mozconfig are supported, but you must choose only one. Please remove the other."
+  echo "Both \$topsrcdir/.mozconfig and \$topsrcdir/mozconfig are supported, but you must choose only one. Please remove the other." 1>&2
   exit 1
 fi
 
@@ -103,7 +103,7 @@ for _config in "$topsrcdir/mozconfig.sh" \
                "$HOME/.mozmyconfig.sh"
 do
   if test -f "$_config"; then
-    echo "You currently have a mozconfig at \"$_config\". This implicit location is no longer supported. Please move it to $topsrcdir/.mozconfig or specify it explicitly via \$MOZCONFIG.";
+    echo "You currently have a mozconfig at \"$_config\". This implicit location is no longer supported. Please move it to $topsrcdir/.mozconfig or specify it explicitly via \$MOZCONFIG." 1>&2
     exit 1
   fi
 done
diff --git a/build/autoconf/mozconfig2client-mk b/build/autoconf/mozconfig2client-mk
index 6b06dd88d96a..7dbffce017d9 100755
--- a/build/autoconf/mozconfig2client-mk
+++ b/build/autoconf/mozconfig2client-mk
@@ -22,6 +22,7 @@
 #
 # Contributor(s):
 #   Stephen Lamm <slamm@netscape.com>
+#   Siddharth Agarwal <sagarwal@mozilla.com>
 #
 # Alternatively, the contents of this file may be used under the terms of
 # either of the GNU General Public License Version 2 or later (the "GPL"),
@@ -92,20 +93,32 @@ opts=""
 
 trap "rm -f $tmp_file; exit 1" 1 2 15
 
-MOZCONFIG=`$scriptdir/mozconfig-find $topsrcdir`
-
 print_header > $tmp_file
 
 # If the path changes, configure should be rerun
 echo "# PATH=$PATH" >> $tmp_file
 
-if [ "$MOZCONFIG" ]
-then
-  . "$MOZCONFIG"
+# If FOUND_MOZCONFIG isn't set, look for it and make sure the script doesn't error out
+isfoundset=${FOUND_MOZCONFIG+yes}
+if [ -z $isfoundset ]; then
+  FOUND_MOZCONFIG=`$scriptdir/mozconfig-find $topsrcdir`
+  if [ $? -ne 0 ]; then
+    echo '$(error Fix above errors before continuing.)' >> $tmp_file
+  else
+    isfoundset=yes
+  fi
 fi
 
-if [ "$opts" ]; then
-  mk_echo_options
+if [ -n $isfoundset ]; then
+  if [ "$FOUND_MOZCONFIG" ]
+  then
+    . "$FOUND_MOZCONFIG"
+  fi
+  echo "export FOUND_MOZCONFIG := $FOUND_MOZCONFIG" >> $tmp_file
+
+  if [ "$opts" ]; then
+    mk_echo_options
+  fi
 fi
 
 if test -f $out_file && cmp -s $tmp_file $out_file; then
diff --git a/build/autoconf/mozconfig2configure b/build/autoconf/mozconfig2configure
index 40c2a3b8ab71..e8278ff6d45d 100755
--- a/build/autoconf/mozconfig2configure
+++ b/build/autoconf/mozconfig2configure
@@ -22,6 +22,7 @@
 #
 # Contributor(s):
 #   Stephen Lamm <slamm@netscape.com>
+#   Siddharth Agarwal <sagarwal@mozilla.com>
 #
 # Alternatively, the contents of this file may be used under the terms of
 # either of the GNU General Public License Version 2 or later (the "GPL"),
@@ -113,14 +114,24 @@ do
   ac_options="$ac_options \"$_opt\""
 done
 
-MOZCONFIG=`$_AUTOCONF_TOOLS_DIR/mozconfig-find $topsrcdir`
-if [ "$MOZCONFIG" ]; then
-  . "$MOZCONFIG"
+
+# If FOUND_MOZCONFIG isn't set, look for it and make sure the script doesn't error out
+isfoundset=${FOUND_MOZCONFIG+yes}
+if [ -z $isfoundset ]; then
+  FOUND_MOZCONFIG=`$_AUTOCONF_TOOLS_DIR/mozconfig-find $topsrcdir`
+  if [ $? -ne 0 ]; then
+    echo "Fix above errors before continuing." 1>&2
+    exit 1
+  fi
 fi
 
+if [ "$FOUND_MOZCONFIG" ]; then
+  . "$FOUND_MOZCONFIG"
+fi
+export FOUND_MOZCONFIG
+
 if [ "$mozconfig_ac_options" ]; then
   ac_echo_options 1>&2
 fi
 
 eval "set -- $mozconfig_ac_options $ac_options"
-

From 02e4294e753fe4f5baf820d2b21c1c08e29919ae Mon Sep 17 00:00:00 2001
From: Brian Hackett <bhackett1024@gmail.com>
Date: Thu, 8 Sep 2011 14:24:10 -0700
Subject: [PATCH 075/209] Fix inverted test, use the right id when calling
 getter hooks, bug 557358.

---
 js/src/jsdbgapi.cpp            | 2 --
 js/src/methodjit/PolyIC.cpp    | 2 +-
 js/src/methodjit/StubCalls.cpp | 2 +-
 3 files changed, 2 insertions(+), 4 deletions(-)

diff --git a/js/src/jsdbgapi.cpp b/js/src/jsdbgapi.cpp
index 36f7322413a5..a4c343b091d5 100644
--- a/js/src/jsdbgapi.cpp
+++ b/js/src/jsdbgapi.cpp
@@ -2166,8 +2166,6 @@ JS_GetFunctionCallback(JSContext *cx)
 JS_PUBLIC_API(void)
 JS_DumpBytecode(JSContext *cx, JSScript *script)
 {
-    JS_ASSERT(!cx->runtime->gcRunning);
-
 #if defined(DEBUG)
     AutoArenaAllocator mark(&cx->tempPool);
     Sprinter sprinter;
diff --git a/js/src/methodjit/PolyIC.cpp b/js/src/methodjit/PolyIC.cpp
index baeb8ba3424c..3edec28fd5df 100644
--- a/js/src/methodjit/PolyIC.cpp
+++ b/js/src/methodjit/PolyIC.cpp
@@ -1219,7 +1219,7 @@ class GetPropCompiler : public PICStubCompiler
         masm.restoreStackBase();
         masm.setupABICall(Registers::NormalCall, 4);
         masm.storeArg(3, vpReg);
-        masm.storeArg(2, ImmPtr((void *) JSID_BITS(shape->propid)));
+        masm.storeArg(2, ImmPtr((void *) JSID_BITS(SHAPE_USERID(shape))));
         masm.storeArg(1, holdObjReg);
         masm.storeArg(0, cxReg);
 
diff --git a/js/src/methodjit/StubCalls.cpp b/js/src/methodjit/StubCalls.cpp
index c13e5ed8df87..8bd9a575602c 100644
--- a/js/src/methodjit/StubCalls.cpp
+++ b/js/src/methodjit/StubCalls.cpp
@@ -601,7 +601,7 @@ stubs::SetElem(VMFrame &f)
                 obj->setDenseArrayElementWithType(cx, i, rval);
                 goto end_setelem;
             } else {
-                if (!f.script()->hasAnalysis())
+                if (f.script()->hasAnalysis())
                     f.script()->analysis()->getCode(f.pc()).arrayWriteHole = true;
             }
         }

From 0666fb76cdec6ad7ab67f0122e1014c32f1fdf6e Mon Sep 17 00:00:00 2001
From: Oleg Romashin <romaxa@gmail.com>
Date: Wed, 14 Sep 2011 14:16:28 +0100
Subject: [PATCH 076/209] Bug 584217 - Add Meego Touch based filepicker
 implementation. r=jeremias.bosch,florian.haenel

---
 config/autoconf.mk.in           |   1 +
 config/system-headers           |   8 +
 configure.in                    |  14 ++
 js/src/config/system-headers    |   8 +
 widget/src/qt/Makefile.in       |  13 +-
 widget/src/qt/nsFilePicker.cpp  | 208 ++++++++++++---------
 widget/src/qt/nsFilePicker.h    |  35 ++--
 widget/src/qt/nsMFilePicker.cpp | 317 ++++++++++++++++++++++++++++++++
 widget/src/qt/nsMFilePicker.h   |  99 ++++++++++
 9 files changed, 596 insertions(+), 107 deletions(-)
 create mode 100644 widget/src/qt/nsMFilePicker.cpp
 create mode 100644 widget/src/qt/nsMFilePicker.h

diff --git a/config/autoconf.mk.in b/config/autoconf.mk.in
index 52ccb44c59b5..0d6d2107f526 100644
--- a/config/autoconf.mk.in
+++ b/config/autoconf.mk.in
@@ -547,6 +547,7 @@ MOZ_ENABLE_QMSYSTEM2    = @MOZ_ENABLE_QMSYSTEM2@
 MOZ_ENABLE_QTMOBILITY   = @MOZ_ENABLE_QTMOBILITY@
 MOZ_ENABLE_CONTENTACTION   = @MOZ_ENABLE_CONTENTACTION@
 MOZ_ENABLE_MEEGOTOUCHSHARE = @MOZ_ENABLE_MEEGOTOUCHSHARE@
+MOZ_ENABLE_CONTENTMANAGER = @MOZ_ENABLE_CONTENTMANAGER@
 
 MOZ_DBUS_CFLAGS         = @MOZ_DBUS_CFLAGS@
 MOZ_DBUS_LIBS           = @MOZ_DBUS_LIBS@
diff --git a/config/system-headers b/config/system-headers
index a62ea0c42bc5..73f8f9303ff7 100644
--- a/config/system-headers
+++ b/config/system-headers
@@ -1020,6 +1020,14 @@ proxy.h
 #if MOZ_PLATFORM_MAEMO==6
 contentaction/contentaction.h
 #endif
+#ifdef MOZ_ENABLE_CONTENTMANAGER
+SelectSingleContentItemPage.h
+SelectMultipleContentItemsPage.h
+QtSparql/qsparqlconnection.h
+QtSparql/qsparqlquery.h
+QtSparql/qsparqlresult.h
+#endif
+
 #if MOZ_TREE_PIXMAN!=1
 pixman.h
 #endif
diff --git a/configure.in b/configure.in
index 4bde68bc335b..7e560b45df79 100644
--- a/configure.in
+++ b/configure.in
@@ -6521,6 +6521,20 @@ if test $MOZ_PLATFORM_MAEMO; then
 
    fi
    if test $MOZ_PLATFORM_MAEMO = 6; then
+
+      PKG_CHECK_MODULES(LIBCONTENTMANAGER, ContentManager QtSparql,
+                        _LIB_FOUND=1,
+                        _LIB_FOUND=)
+      if test "$_LIB_FOUND"; then
+         MOZ_PLATFORM_MAEMO_LIBS="$MOZ_PLATFORM_MAEMO_LIBS $LIBCONTENTMANAGER_LIBS"
+         MOZ_PLATFORM_MAEMO_CFLAGS="$MOZ_PLATFORM_MAEMO_CFLAGS $LIBCONTENTMANAGER_CFLAGS"
+         MOZ_ENABLE_CONTENTMANAGER=1
+         AC_DEFINE(MOZ_ENABLE_CONTENTMANAGER)
+      else
+         AC_MSG_WARN([Cannot find libcontentmanager and or QtSparql building for Maemo 6])
+      fi
+      AC_SUBST(MOZ_ENABLE_CONTENTMANAGER)
+
       dnl ========================================================
       dnl = Enable meego libcontentaction
       dnl ========================================================
diff --git a/js/src/config/system-headers b/js/src/config/system-headers
index a62ea0c42bc5..73f8f9303ff7 100644
--- a/js/src/config/system-headers
+++ b/js/src/config/system-headers
@@ -1020,6 +1020,14 @@ proxy.h
 #if MOZ_PLATFORM_MAEMO==6
 contentaction/contentaction.h
 #endif
+#ifdef MOZ_ENABLE_CONTENTMANAGER
+SelectSingleContentItemPage.h
+SelectMultipleContentItemsPage.h
+QtSparql/qsparqlconnection.h
+QtSparql/qsparqlquery.h
+QtSparql/qsparqlresult.h
+#endif
+
 #if MOZ_TREE_PIXMAN!=1
 pixman.h
 #endif
diff --git a/widget/src/qt/Makefile.in b/widget/src/qt/Makefile.in
index 533f5ea0c9fa..3e2fd9757809 100644
--- a/widget/src/qt/Makefile.in
+++ b/widget/src/qt/Makefile.in
@@ -57,7 +57,14 @@ MOCSRCS = \
 		moc_nsAppShell.cpp \
 		$(NULL)
 
-CPPSRCS	= \
+ifdef MOZ_ENABLE_CONTENTMANAGER
+MOCSRCS += moc_nsMFilePicker.cpp \
+		$(NULL)
+CPPSRCS	+= nsMFilePicker.cpp \
+		$(NULL)
+endif
+
+CPPSRCS	+= \
 		$(MOCSRCS) \
 		nsAppShell.cpp \
 		nsWidgetFactory.cpp \
@@ -102,8 +109,8 @@ include $(topsrcdir)/config/config.mk
 include $(topsrcdir)/ipc/chromium/chromium-config.mk
 include $(topsrcdir)/config/rules.mk
 
-CXXFLAGS	+= $(MOZ_QT_CFLAGS) $(GLIB_CFLAGS) $(MOZ_CAIRO_CFLAGS)
-CFLAGS		+= $(MOZ_QT_CFLAGS) $(GLIB_CFLAGS) $(MOZ_CAIRO_CFLAGS)
+CXXFLAGS	+= $(MOZ_QT_CFLAGS) $(GLIB_CFLAGS) $(MOZ_CAIRO_CFLAGS) $(MOZ_PLATFORM_MAEMO_CFLAGS)
+CFLAGS		+= $(MOZ_QT_CFLAGS) $(GLIB_CFLAGS) $(MOZ_CAIRO_CFLAGS) $(MOZ_PLATFORM_MAEMO_CFLAGS)
 
 DEFINES		+= -D_IMPL_NS_WIDGET
 #DEFINES		+= -DDEBUG_WIDGETS
diff --git a/widget/src/qt/nsFilePicker.cpp b/widget/src/qt/nsFilePicker.cpp
index 5153eab4684c..d61cad047d2a 100644
--- a/widget/src/qt/nsFilePicker.cpp
+++ b/widget/src/qt/nsFilePicker.cpp
@@ -38,30 +38,39 @@
  *
  * ***** END LICENSE BLOCK ***** */
 
-#include "nsFilePicker.h"
+#include <QStringList>
+#include <QGraphicsWidget>
+#include <QGraphicsScene>
+#include <QGraphicsView>
+#include <QTemporaryFile>
 
-#include "nsILocalFile.h"
-#include "nsIURI.h"
-#include "nsISupportsArray.h"
-#include "nsMemory.h"
-#include "nsEnumeratorUtils.h"
+#ifdef MOZ_ENABLE_CONTENTMANAGER
+#include "nsMFilePicker.h"
+#define MozFileDialog MeegoFileDialog
+#else
+#include <QFileDialog>
+#define MozFileDialog QFileDialog
+#endif
+
+
+#include "nsFilePicker.h"
 #include "nsNetUtil.h"
-#include "nsReadableUtils.h"
 #include "nsIWidget.h"
-#include "mozqwidget.h"
-#include "nsWindow.h"
 #include "prlog.h"
 
 #ifdef PR_LOGGING
 static PRLogModuleInfo* sFilePickerLog = nsnull;
 #endif
 
+#include "nsDirectoryServiceDefs.h"
+
+//-----------------------------
+
 /* Implementation file */
 NS_IMPL_ISUPPORTS1(nsFilePicker, nsIFilePicker)
 
 nsFilePicker::nsFilePicker()
-    : mDialog(0),
-      mMode(nsIFilePicker::modeOpen)
+    : mMode(nsIFilePicker::modeOpen)
 {
 #ifdef PR_LOGGING
     if (!sFilePickerLog)
@@ -74,7 +83,7 @@ nsFilePicker::~nsFilePicker()
 }
 
 NS_IMETHODIMP
-nsFilePicker::Init(nsIDOMWindow *parent, const nsAString & title, PRInt16 mode)
+nsFilePicker::Init(nsIDOMWindow* parent, const nsAString& title, PRInt16 mode)
 {
     return nsBaseFilePicker::Init(parent, title, mode);
 }
@@ -88,7 +97,7 @@ nsFilePicker::AppendFilters(PRInt32 filterMask)
 
 /* void appendFilter (in AString title, in AString filter); */
 NS_IMETHODIMP
-nsFilePicker::AppendFilter(const nsAString & aTitle, const nsAString & aFilter)
+nsFilePicker::AppendFilter(const nsAString& aTitle, const nsAString& aFilter)
 {
     if (aFilter.Equals(NS_LITERAL_STRING("..apps"))) {
         // No platform specific thing we can do here, really....
@@ -107,13 +116,13 @@ nsFilePicker::AppendFilter(const nsAString & aTitle, const nsAString & aFilter)
 
 /* attribute AString defaultString; */
 NS_IMETHODIMP
-nsFilePicker::GetDefaultString(nsAString & aDefaultString)
+nsFilePicker::GetDefaultString(nsAString& aDefaultString)
 {
     return NS_ERROR_FAILURE;
 }
 
 NS_IMETHODIMP
-nsFilePicker::SetDefaultString(const nsAString & aDefaultString)
+nsFilePicker::SetDefaultString(const nsAString& aDefaultString)
 {
     mDefault = aDefaultString;
 
@@ -122,14 +131,15 @@ nsFilePicker::SetDefaultString(const nsAString & aDefaultString)
 
 /* attribute AString defaultExtension; */
 NS_IMETHODIMP
-nsFilePicker::GetDefaultExtension(nsAString & aDefaultExtension)
+nsFilePicker::GetDefaultExtension(nsAString& aDefaultExtension)
 {
     aDefaultExtension = mDefaultExtension;
 
     return NS_OK;
 }
+
 NS_IMETHODIMP
-nsFilePicker::SetDefaultExtension(const nsAString & aDefaultExtension)
+nsFilePicker::SetDefaultExtension(const nsAString& aDefaultExtension)
 {
     mDefaultExtension = aDefaultExtension;
 
@@ -138,12 +148,13 @@ nsFilePicker::SetDefaultExtension(const nsAString & aDefaultExtension)
 
 /* attribute long filterIndex; */
 NS_IMETHODIMP
-nsFilePicker::GetFilterIndex(PRInt32 *aFilterIndex)
+nsFilePicker::GetFilterIndex(PRInt32* aFilterIndex)
 {
     *aFilterIndex = mSelectedType;
 
     return NS_OK;
 }
+
 NS_IMETHODIMP
 nsFilePicker::SetFilterIndex(PRInt32 aFilterIndex)
 {
@@ -154,7 +165,7 @@ nsFilePicker::SetFilterIndex(PRInt32 aFilterIndex)
 
 /* readonly attribute nsILocalFile file; */
 NS_IMETHODIMP
-nsFilePicker::GetFile(nsILocalFile * *aFile)
+nsFilePicker::GetFile(nsILocalFile* *aFile)
 {
     NS_ENSURE_ARG_POINTER(aFile);
 
@@ -175,7 +186,7 @@ nsFilePicker::GetFile(nsILocalFile * *aFile)
 
 /* readonly attribute nsIFileURL fileURL; */
 NS_IMETHODIMP
-nsFilePicker::GetFileURL(nsIURI * *aFileURL)
+nsFilePicker::GetFileURL(nsIURI* *aFileURL)
 {
     nsCOMPtr<nsILocalFile> file;
     GetFile(getter_AddRefs(file));
@@ -189,7 +200,7 @@ nsFilePicker::GetFileURL(nsIURI * *aFileURL)
 
 /* readonly attribute nsISimpleEnumerator files; */
 NS_IMETHODIMP
-nsFilePicker::GetFiles(nsISimpleEnumerator * *aFiles)
+nsFilePicker::GetFiles(nsISimpleEnumerator* *aFiles)
 {
     NS_ENSURE_ARG_POINTER(aFiles);
 
@@ -202,94 +213,121 @@ nsFilePicker::GetFiles(nsISimpleEnumerator * *aFiles)
 
 /* short show (); */
 NS_IMETHODIMP
-nsFilePicker::Show(PRInt16 *aReturn)
+nsFilePicker::Show(PRInt16* aReturn)
 {
     nsCAutoString directory;
     if (mDisplayDirectory) {
         mDisplayDirectory->GetNativePath(directory);
     }
 
-    switch (mMode) {
-    case nsIFilePicker::modeOpen:
-        break;
-    case nsIFilePicker::modeOpenMultiple:
-        mDialog->setFileMode(QFileDialog::ExistingFiles);
-        break;
-    case nsIFilePicker::modeSave:
-        mDialog->setFileMode(QFileDialog::AnyFile);
-        mDialog->setAcceptMode(QFileDialog::AcceptSave);
-        break;
-    case nsIFilePicker::modeGetFolder:
-        mDialog->setFileMode(QFileDialog::DirectoryOnly);
-        break;
-    default:
-        break;
-    }
-
-    mDialog->selectFile(QString::fromUtf16(mDefault.get()));
-
-    mDialog->setDirectory(directory.get());
-
     QStringList filters;
     PRUint32 count = mFilters.Length();
     for (PRUint32 i = 0; i < count; ++i) {
-        filters.append( mFilters[i].get() );
+        filters.append(mFilters[i].get());
     }
-    mDialog->setFilters(filters);
 
-    switch (mDialog->exec()) {
-    case QDialog::Accepted: {
-        QStringList files = mDialog->selectedFiles();
-        QString selected;
-        if (!files.isEmpty())
-        {
-            selected = files[0];
+    QGraphicsWidget* parentWidget = 0;
+    if (mParent) {
+        parentWidget = static_cast<QGraphicsWidget*>
+            (mParent->GetNativeData(NS_NATIVE_WIDGET));
+    }
+
+    QWidget* parentQWidget = 0;
+    if (parentWidget && parentWidget->scene()) {
+        if (parentWidget->scene()->views().size()>0) {
+            parentQWidget = parentWidget->scene()->views()[0];
+        }
+    }
+
+    QStringList files;
+    QString selected;
+
+    switch (mMode) {
+    case nsIFilePicker::modeOpen:
+        selected = MozFileDialog::getOpenFileName(parentQWidget, mCaption,
+                                                  directory.get(), filters.join(";"));
+        if (selected.isNull()) {
+            *aReturn = nsIFilePicker::returnCancel;
+            return NS_OK;
+        }
+        break;
+    case nsIFilePicker::modeOpenMultiple:
+        files = MozFileDialog::getOpenFileNames(parentQWidget, mCaption,
+                                                directory.get(), filters.join(";"));
+        if (files.empty()) {
+            *aReturn = nsIFilePicker::returnCancel;
+            return NS_OK;
+        }
+        selected = files[0];
+        break;
+    case nsIFilePicker::modeSave:
+    {
+        nsCOMPtr<nsIFile> targetFile;
+        NS_GetSpecialDirectory(NS_UNIX_XDG_DOCUMENTS_DIR,
+                               getter_AddRefs(targetFile));
+        if (!targetFile) {
+            // failed to get the XDG directory, using $HOME for now
+            NS_GetSpecialDirectory(NS_UNIX_HOME_DIR,
+                                   getter_AddRefs(targetFile));
         }
 
-        QString path = QFile::encodeName(selected);
-        PR_LOG(sFilePickerLog, PR_LOG_DEBUG, ("path is '%s'", path.toAscii().data()));
-        mFile.Assign(path.toUtf8().data());
-        *aReturn = nsIFilePicker::returnOK;
-        if (mMode == modeSave) {
-            nsCOMPtr<nsILocalFile> file;
-            GetFile(getter_AddRefs(file));
-            if (file) {
-                PRBool exists = PR_FALSE;
-                file->Exists(&exists);
-                if (exists) {
-                    *aReturn = nsIFilePicker::returnReplace;
-                }
+        if (targetFile) {
+            targetFile->Append(mDefault);
+            nsString targetPath;
+            targetFile->GetPath(targetPath);
+
+            PRBool exists = PR_FALSE;
+            targetFile->Exists(&exists);
+            if (exists) {
+                // file exists already create temporary filename
+                QTemporaryFile temp(QString::fromUtf16(targetPath.get()));
+                temp.open();
+                selected = temp.fileName();
+                temp.close();
+            } else {
+                selected = QString::fromUtf16(targetPath.get());
             }
         }
     }
-        break;
-    case QDialog::Rejected: {
-        *aReturn = nsIFilePicker::returnCancel;
-    }
-        break;
+    break;
+    case nsIFilePicker::modeGetFolder:
+        selected = MozFileDialog::getExistingDirectory(parentQWidget, mCaption,
+                                                       directory.get());
+        if (selected.isNull()) {
+            *aReturn = nsIFilePicker::returnCancel;
+            return NS_OK;
+        }
+    break;
     default:
-        *aReturn = nsIFilePicker::returnCancel;
-        break;
+    break;
     }
 
+    if (!selected.isEmpty()) {
+        QString path = QFile::encodeName(selected);
+        mFile.Assign(path.toUtf8().data());
+    }
+
+    *aReturn = nsIFilePicker::returnOK;
+    if (mMode == modeSave) {
+        nsCOMPtr<nsILocalFile> file;
+        GetFile(getter_AddRefs(file));
+        if (file) {
+            PRBool exists = PR_FALSE;
+            file->Exists(&exists);
+            if (exists) {
+                *aReturn = nsIFilePicker::returnReplace;
+            }
+        }
+    }
 
     return NS_OK;
 }
 
-void nsFilePicker::InitNative(nsIWidget *parent, const nsAString &title, PRInt16 mode)
+void nsFilePicker::InitNative(nsIWidget *aParent, const nsAString &aTitle, PRInt16 mode)
 {
     PR_LOG(sFilePickerLog, PR_LOG_DEBUG, ("nsFilePicker::InitNative"));
-
-    MozQWidget *parentMozWidget = (parent) ?
-        static_cast<MozQWidget*>(parent->GetNativeData(NS_NATIVE_WIDGET)) : nsnull;
-    QWidget *parentWidget = (parentMozWidget) ?
-        parentMozWidget->getReceiver()->GetViewWidget() : nsnull;
-    if (!parentWidget) {
-        NS_WARNING("Can't find parent for QFileDialog");
-    }
-
-    nsAutoString str(title);
-    mDialog = new QFileDialog(parentWidget, QString::fromUtf16(str.get()));
-
+    nsAutoString str(aTitle);
+    mCaption = QString::fromUtf16(str.get());
+    mParent = aParent;
     mMode = mode;
 }
diff --git a/widget/src/qt/nsFilePicker.h b/widget/src/qt/nsFilePicker.h
index 5dd5d569f935..0b1c4c864914 100644
--- a/widget/src/qt/nsFilePicker.h
+++ b/widget/src/qt/nsFilePicker.h
@@ -40,16 +40,10 @@
 #ifndef NSFILEPICKER_H
 #define NSFILEPICKER_H
 
-#include <qfiledialog.h>
-#include <qpointer.h>
+#include <QPointer>
 #include "nsBaseFilePicker.h"
-#include "nsString.h"
-#include "nsIURI.h"
-#include "nsTArray.h"
 #include "nsCOMArray.h"
 
-class nsIWidget;
-class nsILocalFile;
 class QFileDialog;
 
 class nsFilePicker : public nsBaseFilePicker
@@ -60,19 +54,19 @@ public:
     NS_DECL_ISUPPORTS
 
     // nsIFilePicker (less what's in nsBaseFilePicker)
-    NS_IMETHODIMP Init(nsIDOMWindow *parent, const nsAString & title, PRInt16 mode);
+    NS_IMETHODIMP Init(nsIDOMWindow* parent, const nsAString& title, PRInt16 mode);
     NS_IMETHODIMP AppendFilters(PRInt32 filterMask);
-    NS_IMETHODIMP AppendFilter(const nsAString & aTitle, const nsAString & aFilter);
-    NS_IMETHODIMP GetDefaultString(nsAString & aDefaultString);
-    NS_IMETHODIMP SetDefaultString(const nsAString & aDefaultString);
-    NS_IMETHODIMP GetDefaultExtension(nsAString & aDefaultExtension);
-    NS_IMETHODIMP SetDefaultExtension(const nsAString & aDefaultExtension);
-    NS_IMETHODIMP GetFilterIndex(PRInt32 *aFilterIndex);
+    NS_IMETHODIMP AppendFilter(const nsAString& aTitle, const nsAString& aFilter);
+    NS_IMETHODIMP GetDefaultString(nsAString& aDefaultString);
+    NS_IMETHODIMP SetDefaultString(const nsAString& aDefaultString);
+    NS_IMETHODIMP GetDefaultExtension(nsAString& aDefaultExtension);
+    NS_IMETHODIMP SetDefaultExtension(const nsAString& aDefaultExtension);
+    NS_IMETHODIMP GetFilterIndex(PRInt32* aFilterIndex);
     NS_IMETHODIMP SetFilterIndex(PRInt32 aFilterIndex);
-    NS_IMETHODIMP GetFile(nsILocalFile * *aFile);
-    NS_IMETHODIMP GetFileURL(nsIURI * *aFileURL);
-    NS_IMETHODIMP GetFiles(nsISimpleEnumerator * *aFiles);
-    NS_IMETHODIMP Show(PRInt16 *aReturn);
+    NS_IMETHODIMP GetFile(nsILocalFile* *aFile);
+    NS_IMETHODIMP GetFileURL(nsIURI* *aFileURL);
+    NS_IMETHODIMP GetFiles(nsISimpleEnumerator* *aFiles);
+    NS_IMETHODIMP Show(PRInt16* aReturn);
 
 private:
     ~nsFilePicker();
@@ -91,6 +85,9 @@ protected:
 
     nsTArray<nsCString> mFilters;
     nsTArray<nsCString> mFilterNames;
+
+    QString mCaption;
+    nsIWidget* mParent;
 };
 
-#endif
+#endif // NSFILEPICKER_H
diff --git a/widget/src/qt/nsMFilePicker.cpp b/widget/src/qt/nsMFilePicker.cpp
new file mode 100644
index 000000000000..40cf275fdebd
--- /dev/null
+++ b/widget/src/qt/nsMFilePicker.cpp
@@ -0,0 +1,317 @@
+/* -*- Mode: C++; tab-width: 4; indent-tabs-mode: nil; c-basic-offset: 2 -*-
+ * vim: sw=2 ts=4 et :
+ */
+/* ***** BEGIN LICENSE BLOCK *****
+ * Version: MPL 1.1/GPL 2.0/LGPL 2.1
+ *
+ * The contents of this file are subject to the Mozilla Public License Version
+ * 1.1 (the "License"); you may not use this file except in compliance with
+ * the License. You may obtain a copy of the License at:
+ * http://www.mozilla.org/MPL/
+ *
+ * Software distributed under the License is distributed on an "AS IS" basis,
+ * WITHOUT WARRANTY OF ANY KIND, either express or implied. See the License
+ * for the specific language governing rights and limitations under the
+ * License.
+ *
+ * The Original Code is Mozilla Code.
+ *
+ * The Initial Developer of the Original Code is
+ *   The Mozilla Foundation
+ * Portions created by the Initial Developer are Copyright (C) 2011
+ * the Initial Developer. All Rights Reserved.
+ *
+ * Contributor(s):
+ *    Oleg Romashin <romaxa@gmail.com>
+ *
+ * Alternatively, the contents of this file may be used under the terms of
+ * either the GNU General Public License Version 2 or later (the "GPL"), or
+ * the GNU Lesser General Public License Version 2.1 or later (the "LGPL"),
+ * in which case the provisions of the GPL or the LGPL are applicable instead
+ * of those above. If you wish to allow use of your version of this file only
+ * under the terms of either the GPL or the LGPL, and not to allow others to
+ * use your version of this file under the terms of the MPL, indicate your
+ * decision by deleting the provisions above and replace them with the notice
+ * and other provisions required by the GPL or the LGPL. If you do not delete
+ * the provisions above, a recipient may use your version of this file under
+ * the terms of any one of the MPL, the GPL or the LGPL.
+ *
+ * ***** END LICENSE BLOCK ***** */
+
+
+#include <QWidget>
+#include "nsMFilePicker.h"
+
+
+// Use Qt Tracker API to get attachment data from tracker:
+#include <QtSparql/QSparqlConnection>
+#include <QtSparql/QSparqlQuery>
+#include <QtSparql/QSparqlResult>
+
+#include <MApplication>
+#include <MApplicationPage>
+#include <MApplicationWindow>
+#include <MSceneManager>
+
+#include <QFileInfo>
+#include <QPointer>
+
+#include <SelectSingleContentItemPage.h>
+#include <SelectMultipleContentItemsPage.h>
+
+MeegoFileDialog::MeegoFileDialog(QObject* aParent)
+  : QObject(aParent)
+  , mMode(Mode_Unknown)
+{
+}
+
+MeegoFileDialog::~MeegoFileDialog()
+{
+}
+
+int
+MeegoFileDialog::exec()
+{
+    MApplicationPage* page = NULL;
+    switch(mMode) {
+    case Mode_OpenFile:
+        page = createOpenFilePage();
+        break;
+    case Mode_OpenFiles:
+        page = createOpenFilesPage();
+        break;
+    case Mode_OpenDirectory:
+        page = createOpenDirectoryPage();
+        break;
+    default:
+        return 0;
+    }
+
+    page->setTitle(mCaption);
+
+    QPointer<MApplicationWindow> appWindow = new MApplicationWindow(MApplication::activeWindow());
+    QObject::connect(MApplication::activeWindow(), SIGNAL(switcherEntered()), this, SLOT(backButtonClicked()));
+    appWindow->show();
+
+    // a not so pretty Hack to build up a back button
+    // by using a empty scene window for a pseudo history stack
+    MSceneWindow* fakeWindow = new MSceneWindow();
+    // tell fake window to disappear when page back was clicked.
+    connect(page, SIGNAL(backButtonClicked()), fakeWindow, SLOT(disappear()));
+    // let new page appear on pseudo Application Window
+    appWindow->sceneManager()->appearSceneWindowNow(page);
+
+    // get, manipulate and set history stack
+    QList<MSceneWindow*> sceneWindowHistory = appWindow->sceneManager()->pageHistory();
+    sceneWindowHistory.insert(0, fakeWindow);
+    appWindow->sceneManager()->setPageHistory(sceneWindowHistory);
+
+    // start own eventloop
+    QEventLoop eventLoop;
+    mEventLoop = &eventLoop;
+    QPointer<MeegoFileDialog> guard = this;
+    (void) eventLoop.exec(QEventLoop::DialogExec);
+    if (guard.isNull()) {
+        return 0;
+    }
+    if (page) {
+        page->disappear();
+        delete page;
+    }
+    if (appWindow) {
+        delete appWindow;
+    }
+    mEventLoop = 0;
+    return 0;
+}
+
+MApplicationPage*
+MeegoFileDialog::createOpenFilePage()
+{
+    QStringList itemType("http://www.semanticdesktop.org/ontologies/2007/03/22/nfo#FileDataObject");
+
+    SelectSingleContentItemPage* page =
+        new SelectSingleContentItemPage(QString(),
+                                        itemType);
+
+    connect(page, SIGNAL(contentItemSelected(const QString&)),
+            this, SLOT  (contentItemSelected(const QString&)));
+
+    connect(page, SIGNAL(backButtonClicked()),
+            this, SLOT  (backButtonClicked()));
+
+    return page;
+}
+
+MApplicationPage*
+MeegoFileDialog::createOpenFilesPage()
+{
+    QStringList itemType("http://www.semanticdesktop.org/ontologies/2007/03/22/nfo#Folder");
+
+    SelectMultipleContentItemsPage* page = new SelectMultipleContentItemsPage(QString(), itemType);
+    connect(page, SIGNAL(contentItemsSelected(const QStringList&)),
+            this, SLOT  (contentItemsSelected(const QStringList&)));
+
+    connect(page, SIGNAL(backButtonClicked()),
+            this, SLOT  (backButtonClicked()));
+
+    return page;
+}
+
+MApplicationPage*
+MeegoFileDialog::createOpenDirectoryPage()
+{
+    QStringList itemType("http://www.semanticdesktop.org/ontologies/2007/03/22/nfo#Folder");
+
+    SelectSingleContentItemPage* page = new SelectSingleContentItemPage(QString(), itemType);
+    connect(page, SIGNAL(contentItemSelected(const QString&)),
+            this, SLOT  (contentItemSelected(const QString&)));
+
+    connect(page, SIGNAL(backButtonClicked()),
+            this, SLOT  (backButtonClicked()));
+
+    return page;
+}
+
+QStringList
+MeegoFileDialog::selectedFileNames() const
+{
+    return mSelectedFileNames;
+}
+
+bool
+MeegoFileDialog::hasSelectedFileNames() const
+{
+    return !mSelectedFileNames.isEmpty();
+}
+
+void
+MeegoFileDialog::contentItemSelected(const QString& aContentItem)
+{
+    mSelectedFileNames.clear();
+
+    if (aContentItem.isEmpty()) {
+        finishEventLoop();
+        return;
+    }
+
+    QUrl fileUrl = trackerIdToFilename(aContentItem);
+    QFileInfo fileInfo(fileUrl.toLocalFile());
+    if (fileInfo.isFile()) {
+        mSelectedFileNames << fileInfo.canonicalFilePath();
+    }
+
+    finishEventLoop();
+}
+
+void
+MeegoFileDialog::contentItemsSelected(const QStringList& aContentItems)
+{
+    mSelectedFileNames.clear();
+
+    foreach (QString contentItem, aContentItems) {
+        QUrl fileUrl = trackerIdToFilename(contentItem);
+        QFileInfo fileInfo(fileUrl.toLocalFile());
+        if (fileInfo.isFile()) {
+            mSelectedFileNames << fileInfo.canonicalFilePath();
+        }
+    }
+
+    finishEventLoop();
+}
+
+void
+MeegoFileDialog::backButtonClicked()
+{
+    mSelectedFileNames.clear();
+    finishEventLoop();
+}
+
+/* static */ QString
+MeegoFileDialog::getOpenFileName(QWidget* parent,
+                                 const QString& caption,
+                                 const QString& dir,
+                                 const QString& filter)
+{
+    QPointer<MeegoFileDialog> picker = new MeegoFileDialog(parent);
+
+    QString result;
+    picker->mMode = MeegoFileDialog::Mode_OpenFile;
+    picker->mCaption = caption;
+    picker->exec();
+
+    // Need separate 'if' because picker might have been destroyed by its parent during exec()
+    if (picker) {
+        if (picker->hasSelectedFileNames()) {
+            result = picker->selectedFileNames().first();
+        }
+        delete picker;
+    }
+
+    return result;
+}
+
+/* static */ QString
+MeegoFileDialog::getExistingDirectory(QWidget* parent,const QString& caption, const QString& dir)
+{
+    QPointer<MeegoFileDialog> picker = new MeegoFileDialog(parent);
+
+    QString result;
+    picker->mMode = MeegoFileDialog::Mode_OpenDirectory;
+    picker->mCaption = caption;
+    picker->exec();
+
+    // Need separate 'if' because picker might have been destroyed by its parent during exec()
+    if (picker) {
+        if (picker->hasSelectedFileNames()) {
+            result = picker->selectedFileNames().first();
+        }
+        delete picker;
+    }
+
+    return result;
+}
+
+/* static */ QStringList
+MeegoFileDialog::getOpenFileNames(QWidget* parent,
+                                  const QString& caption,
+                                  const QString& dir,
+                                  const QString& filter)
+{
+    QPointer<MeegoFileDialog> picker = new MeegoFileDialog(parent);
+
+    QStringList result;
+    picker->mMode = MeegoFileDialog::Mode_OpenFiles;
+    picker->mCaption = caption;
+    picker->exec();
+
+    // Need separate 'if' because picker might have been destroyed by its parent during exec()
+    if (picker) {
+        if (picker->hasSelectedFileNames()) {
+            result = picker->selectedFileNames();
+        }
+        delete picker;
+    }
+
+    return result;
+}
+
+QUrl
+MeegoFileDialog::trackerIdToFilename(const QString& trackerId)
+{
+    QSparqlQuery query("SELECT ?u WHERE { ?:tUri nie:url ?u . }");
+    query.bindValue("tUri", QUrl(trackerId)); // That puts <trackerId> into the query
+    QSparqlConnection connection("QTRACKER"); // Exact string needed to make connection to tracker
+    QSparqlResult* result = connection.exec(query);
+
+    result->waitForFinished();
+    result->first();
+
+    QUrl resultFile;
+    if (result->isValid()) {
+        resultFile = QUrl(result->binding(0).value().toString());
+    }
+    delete result;
+
+    return resultFile;
+}
diff --git a/widget/src/qt/nsMFilePicker.h b/widget/src/qt/nsMFilePicker.h
new file mode 100644
index 000000000000..94409263a478
--- /dev/null
+++ b/widget/src/qt/nsMFilePicker.h
@@ -0,0 +1,99 @@
+/* -*- Mode: C++; tab-width: 4; indent-tabs-mode: nil; c-basic-offset: 2 -*-
+ * vim: sw=2 ts=4 et :
+ */
+/* ***** BEGIN LICENSE BLOCK *****
+ * Version: MPL 1.1/GPL 2.0/LGPL 2.1
+ *
+ * The contents of this file are subject to the Mozilla Public License Version
+ * 1.1 (the "License"); you may not use this file except in compliance with
+ * the License. You may obtain a copy of the License at:
+ * http://www.mozilla.org/MPL/
+ *
+ * Software distributed under the License is distributed on an "AS IS" basis,
+ * WITHOUT WARRANTY OF ANY KIND, either express or implied. See the License
+ * for the specific language governing rights and limitations under the
+ * License.
+ *
+ * The Original Code is Mozilla Code.
+ *
+ * The Initial Developer of the Original Code is
+ *   The Mozilla Foundation
+ * Portions created by the Initial Developer are Copyright (C) 2011
+ * the Initial Developer. All Rights Reserved.
+ *
+ * Contributor(s):
+ *    Oleg Romashin <romaxa@gmail.com>
+ *    Stefan Hundhammer <HuHa-zilla@gmx.de>
+ *    Jeremias Bosch <jeremias.bosch@gmail.com>
+ *
+ * Alternatively, the contents of this file may be used under the terms of
+ * either the GNU General Public License Version 2 or later (the "GPL"), or
+ * the GNU Lesser General Public License Version 2.1 or later (the "LGPL"),
+ * in which case the provisions of the GPL or the LGPL are applicable instead
+ * of those above. If you wish to allow use of your version of this file only
+ * under the terms of either the GPL or the LGPL, and not to allow others to
+ * use your version of this file under the terms of the MPL, indicate your
+ * decision by deleting the provisions above and replace them with the notice
+ * and other provisions required by the GPL or the LGPL. If you do not delete
+ * the provisions above, a recipient may use your version of this file under
+ * the terms of any one of the MPL, the GPL or the LGPL.
+ *
+ * ***** END LICENSE BLOCK ***** */
+
+#ifndef NSMFILEDIALOG_H
+#define NSMFILEDIALOG_H
+
+#include <QEventLoop>
+#include <QStringList>
+#include <QUrl>
+
+class MApplicationPage;
+class MeegoFileDialog : public QObject
+{
+    Q_OBJECT
+public:
+
+    enum MeegoFileDialogMode {
+        Mode_Unknown = -1,
+        Mode_OpenFile = 0,
+        Mode_OpenFiles = 1,
+        Mode_OpenDirectory = 2
+        // No Mode_SaveFile - the content picker can't handle that
+    };
+
+    MeegoFileDialog(QObject* aParent = 0);
+    virtual ~MeegoFileDialog();
+
+    QStringList selectedFileNames() const;
+    bool hasSelectedFileNames() const;
+
+    static QString getOpenFileName(QWidget* parent, const QString &caption, const QString& dir, const QString& filter);
+    static QStringList getOpenFileNames(QWidget* parent, const QString& caption, const QString& dir, const QString& filter);
+    static QString getExistingDirectory(QWidget* parent, const QString& caption, const QString& dir);
+
+    int exec();
+
+private slots:
+    void contentItemSelected(const QString& aItem);
+    void contentItemsSelected(const QStringList& aItems);
+    void backButtonClicked();
+
+private:
+    QUrl trackerIdToFilename(const QString& trackerId);
+    MApplicationPage* createOpenFilePage();
+    MApplicationPage* createOpenFilesPage();
+    MApplicationPage* createOpenDirectoryPage();
+    void finishEventLoop() {
+        if (!mEventLoop)
+            return;
+        mEventLoop->exit(0);
+        mEventLoop = 0;
+    }
+
+    QEventLoop* mEventLoop;
+    MeegoFileDialogMode mMode;
+    QString mCaption;
+    QStringList mSelectedFileNames;
+};
+
+#endif // NSMFILEDIALOG_H

From f83b8ddb771c1fac76b9e7db0af602431709f75f Mon Sep 17 00:00:00 2001
From: Jacek Caban <jacek@codeweavers.com>
Date: Wed, 14 Sep 2011 16:12:15 +0200
Subject: [PATCH 077/209] Bug 686117 - Port TI assembly changes to mingw-w64
 variant [r=dvander, NPOTB, DONTBUILD]

---
 js/src/methodjit/TrampolineMingwX64.s | 69 +++++++++++++++++++++++++--
 1 file changed, 66 insertions(+), 3 deletions(-)

diff --git a/js/src/methodjit/TrampolineMingwX64.s b/js/src/methodjit/TrampolineMingwX64.s
index a513f1299438..ea956403f6d6 100644
--- a/js/src/methodjit/TrampolineMingwX64.s
+++ b/js/src/methodjit/TrampolineMingwX64.s
@@ -40,6 +40,7 @@
 .extern SetVMFrameRegs
 .extern PushActiveVMFrame
 .extern PopActiveVMFrame
+.extern js_InternalInterpret
 
 .text
 .intel_syntax noprefix
@@ -81,6 +82,8 @@ JaegerTrampoline:
     # rdx = fp
     # r9 = inlineCallCount
     # fp must go into rbx
+    push    0       # stubRejoin
+    push    rdx     # entryncode
     push    rdx     # entryFp
     push    r9      # inlineCallCount
     push    rcx     # cx
@@ -115,12 +118,12 @@ JaegerTrampoline:
 JaegerTrampolineReturn:
     # .ENDPROLOG
     or      rsi, rdi
-    mov     qword ptr [rbx + 0x30], rcx
+    mov     qword ptr [rbx + 0x30], rsi
     sub     rsp, 0x20
     lea     rcx, [rsp+0x20]
     call    PopActiveVMFrame
 
-    add     rsp, 0x58+0x20
+    add     rsp, 0x68+0x20
     pop     rbx
     pop     rsi
     pop     rdi
@@ -153,7 +156,7 @@ JaegerThrowpoline:
 throwpoline_exit:
     lea     rcx, [rsp+0x20]
     call    PopActiveVMFrame
-    add     rsp, 0x58+0x20
+    add     rsp, 0x68+0x20
     pop     rbx
     pop     rsi
     pop     rdi
@@ -166,3 +169,63 @@ throwpoline_exit:
     ret
 
 
+.globl JaegerInterpoline
+.def JaegerInterpoline
+   .scl 3
+   .type 46
+.endef
+JaegerInterpoline:
+    #.ENDPROLOG
+    mov     rcx, rdi
+    mov     rdx, rsi
+    lea     r9, [rsp+0x20]
+    mov     r8, rax
+    call    js_InternalInterpret
+    mov     rbx, qword ptr [rsp+0x38+0x20] # Load Frame
+    mov     rsi, qword ptr [rbx+0x30]      # Load rval payload
+    and     rsi, r14                       # Mask rval payload
+    mov     rdi, qword ptr [rbx+0x30]      # Load rval type
+    and     rdi, r13                       # Mask rval type
+    mov     rcx, qword ptr [rsp+0x18+0x20] # Load scratch -> argc
+    test    rax, rax
+    je      interpoline_exit
+    add     rsp, 0x20
+    jmp     rax
+
+interpoline_exit:
+    lea     rcx, [rsp+0x20]
+    call    PopActiveVMFrame
+    add     rsp, 0x68+0x20
+    pop     rbx
+    pop     rsi
+    pop     rdi
+    pop     r15
+    pop     r14
+    pop     r13
+    pop     r12
+    pop     rbp
+    xor     rax, rax
+    ret
+
+.globl JaegerInterpolineScripted
+.def JaegerInterpolineScripted
+   .scl 3
+   .type 46
+.endef
+JaegerInterpolineScripted:
+    #.ENDPROLOG
+    mov     rbx, qword ptr [rbx+0x20] # Load prev
+    mov     qword ptr [rsp+0x38], rbx # fp -> regs.fp
+    sub     rsp, 0x20
+    jmp     JaegerInterpoline
+
+.globl JaegerInterpolinePatched
+.def JaegerInterpolinePatched
+   .scl 3
+   .type 46
+.endef
+JaegerInterpolinePatched:
+    sub     rsp, 0x20
+    #.ALLOCSTACK 32
+    #.ENDPROLOG
+    jmp     JaegerInterpoline

From 75a23baafee6f68c90b5c2b9074542f361967f05 Mon Sep 17 00:00:00 2001
From: Robert O'Callahan <roc@ocallahan.org>
Date: Wed, 14 Sep 2011 15:48:32 +0100
Subject: [PATCH 078/209] Bug 619992 - Fix location calculations for light
 sources. r=longsonr

---
 content/svg/content/src/nsSVGFilters.cpp      | 10 ++++---
 ...ectBoundingBox-and-fePointLight-02-ref.svg | 22 ++++++++++++++
 .../objectBoundingBox-and-fePointLight-02.svg | 22 ++++++++++++++
 layout/reftests/svg/reftest.list              |  1 +
 layout/svg/base/src/nsSVGFilterInstance.cpp   | 29 +++++++++++++++----
 layout/svg/base/src/nsSVGFilterInstance.h     | 10 +++++--
 6 files changed, 82 insertions(+), 12 deletions(-)
 create mode 100644 layout/reftests/svg/objectBoundingBox-and-fePointLight-02-ref.svg
 create mode 100644 layout/reftests/svg/objectBoundingBox-and-fePointLight-02.svg

diff --git a/content/svg/content/src/nsSVGFilters.cpp b/content/svg/content/src/nsSVGFilters.cpp
index 8d91b9723599..28b5c0e4d0fb 100644
--- a/content/svg/content/src/nsSVGFilters.cpp
+++ b/content/svg/content/src/nsSVGFilters.cpp
@@ -4945,11 +4945,13 @@ nsSVGFELightingElement::Filter(nsSVGFilterInstance *instance,
                      x, y, surfaceScale);
 
       if (pointLight || spotLight) {
-        float Z =
-          surfaceScale * sourceData[index + GFX_ARGB32_OFFSET_A] / 255;
+        gfxPoint pt = instance->FilterSpaceToUserSpace(
+                gfxPoint(x + instance->GetSurfaceRect().x,
+                         y + instance->GetSurfaceRect().y));
+        float Z = surfaceScale * sourceData[index + GFX_ARGB32_OFFSET_A] / 255;
 
-        L[0] = lightPos[0] - x;
-        L[1] = lightPos[1] - y;
+        L[0] = lightPos[0] - pt.x;
+        L[1] = lightPos[1] - pt.y;
         L[2] = lightPos[2] - Z;
         NORMALIZE(L);
       }
diff --git a/layout/reftests/svg/objectBoundingBox-and-fePointLight-02-ref.svg b/layout/reftests/svg/objectBoundingBox-and-fePointLight-02-ref.svg
new file mode 100644
index 000000000000..0e27de608f30
--- /dev/null
+++ b/layout/reftests/svg/objectBoundingBox-and-fePointLight-02-ref.svg
@@ -0,0 +1,22 @@
+<!--
+     Any copyright is dedicated to the Public Domain.
+     http://creativecommons.org/publicdomain/zero/1.0/
+-->
+<svg width="100%" height="100%"
+  viewBox="0 0 480 360" xmlns="http://www.w3.org/2000/svg"
+  xmlns:xlink="http://www.w3.org/1999/xlink">
+  <title>Reference for objectBoundingBox with fePointLight</title>
+  <!-- From https://bugzilla.mozilla.org/show_bug.cgi?id=619992 -->
+
+  <defs>
+    <filter id="f" primitiveUnits="objectBoundingBox">
+      <feSpecularLighting lighting-color="blue" surfaceScale="5" specularConstant="10" specularExponent="6">
+        <fePointLight x="0.875" y="0.875" z="-0.0625"/>
+      </feSpecularLighting>
+    </filter>
+  </defs>
+
+  <g transform="translate(50 50)">
+    <rect x="-40" y="-40" width="80" height="80" filter="url(#f)" fill="none"/>
+  </g>
+</svg>
diff --git a/layout/reftests/svg/objectBoundingBox-and-fePointLight-02.svg b/layout/reftests/svg/objectBoundingBox-and-fePointLight-02.svg
new file mode 100644
index 000000000000..00f549add493
--- /dev/null
+++ b/layout/reftests/svg/objectBoundingBox-and-fePointLight-02.svg
@@ -0,0 +1,22 @@
+<!--
+     Any copyright is dedicated to the Public Domain.
+     http://creativecommons.org/publicdomain/zero/1.0/
+-->
+<svg width="100%" height="100%"
+  viewBox="0 0 480 360" xmlns="http://www.w3.org/2000/svg"
+  xmlns:xlink="http://www.w3.org/1999/xlink">
+  <title>Testcase for objectBoundingBox with fePointLight</title>
+  <!-- From https://bugzilla.mozilla.org/show_bug.cgi?id=619992 -->
+
+  <defs>
+    <filter id="f" primitiveUnits="userSpaceOnUse">
+      <feSpecularLighting lighting-color="blue" surfaceScale="5" specularConstant="10" specularExponent="6">
+        <fePointLight x="30" y="30" z="-5"/>
+      </feSpecularLighting>
+    </filter>
+  </defs>
+
+  <g transform="translate(50 50)">
+    <rect x="-40" y="-40" width="80" height="80" filter="url(#f)" fill="none"/>
+  </g>
+</svg>
diff --git a/layout/reftests/svg/reftest.list b/layout/reftests/svg/reftest.list
index 813d5894c3f9..2a424a1e858b 100644
--- a/layout/reftests/svg/reftest.list
+++ b/layout/reftests/svg/reftest.list
@@ -146,6 +146,7 @@ fails == inline-in-xul-basic-01.xul pass.svg
 == objectBoundingBox-and-clipPath.svg pass.svg
 # Bug 588684
 random-if(gtk2Widget) == objectBoundingBox-and-fePointLight-01.svg objectBoundingBox-and-fePointLight-01-ref.svg
+random-if(gtk2Widget) == objectBoundingBox-and-fePointLight-02.svg objectBoundingBox-and-fePointLight-02-ref.svg
 == objectBoundingBox-and-mask.svg pass.svg
 == objectBoundingBox-and-mask-02.svg pass.svg
 == objectBoundingBox-and-pattern-01a.svg objectBoundingBox-and-pattern-01-ref.svg
diff --git a/layout/svg/base/src/nsSVGFilterInstance.cpp b/layout/svg/base/src/nsSVGFilterInstance.cpp
index aafafc2a0cc7..84477da69ba9 100644
--- a/layout/svg/base/src/nsSVGFilterInstance.cpp
+++ b/layout/svg/base/src/nsSVGFilterInstance.cpp
@@ -78,12 +78,22 @@ nsSVGFilterInstance::GetPrimitiveNumber(PRUint8 aCtxType, float aValue) const
 void
 nsSVGFilterInstance::ConvertLocation(float aValues[3]) const
 {
-  if (mPrimitiveUnits == nsIDOMSVGUnitTypes::SVG_UNIT_TYPE_OBJECTBOUNDINGBOX) {
-    aValues[0] *= mTargetBBox.Width();
-    aValues[1] *= mTargetBBox.Height();
-    aValues[2] *= nsSVGUtils::ComputeNormalizedHypotenuse(
-                    mTargetBBox.Width(), mTargetBBox.Height());
-  }
+  nsSVGLength2 val[4];
+  val[0].Init(nsSVGUtils::X, 0xff, aValues[0],
+              nsIDOMSVGLength::SVG_LENGTHTYPE_NUMBER);
+  val[1].Init(nsSVGUtils::Y, 0xff, aValues[1],
+              nsIDOMSVGLength::SVG_LENGTHTYPE_NUMBER);
+  // Dummy width/height values
+  val[2].Init(nsSVGUtils::X, 0xff, 0,
+              nsIDOMSVGLength::SVG_LENGTHTYPE_NUMBER);
+  val[3].Init(nsSVGUtils::Y, 0xff, 0,
+              nsIDOMSVGLength::SVG_LENGTHTYPE_NUMBER);
+
+  gfxRect feArea = nsSVGUtils::GetRelativeRect(mPrimitiveUnits,
+    val, mTargetBBox, mTargetFrame);
+  aValues[0] = feArea.X();
+  aValues[1] = feArea.Y();
+  aValues[2] = GetPrimitiveNumber(nsSVGUtils::XY, aValues[2]);
 }
 
 already_AddRefed<gfxImageSurface>
@@ -112,6 +122,13 @@ nsSVGFilterInstance::UserSpaceToFilterSpace(const gfxRect& aRect) const
   return r;
 }
 
+gfxPoint
+nsSVGFilterInstance::FilterSpaceToUserSpace(const gfxPoint& aPt) const
+{
+  return gfxPoint(aPt.x * mFilterRect.Width() / mFilterSpaceSize.width + mFilterRect.X(),
+                  aPt.y * mFilterRect.Height() / mFilterSpaceSize.height + mFilterRect.Y());
+}
+
 gfxMatrix
 nsSVGFilterInstance::GetUserSpaceToFilterSpaceTransform() const
 {
diff --git a/layout/svg/base/src/nsSVGFilterInstance.h b/layout/svg/base/src/nsSVGFilterInstance.h
index 9d4496d3d60d..b45708f6305d 100644
--- a/layout/svg/base/src/nsSVGFilterInstance.h
+++ b/layout/svg/base/src/nsSVGFilterInstance.h
@@ -63,8 +63,6 @@ struct gfxRect;
 class NS_STACK_CLASS nsSVGFilterInstance
 {
 public:
-  void ConvertLocation(float aValues[3]) const;
-
   nsSVGFilterInstance(nsIFrame *aTargetFrame,
                       nsSVGFilterPaintCallback *aPaintCallback,
                       nsSVGFilterElement *aFilterElement,
@@ -115,10 +113,18 @@ public:
   {
     return GetPrimitiveNumber(aCtxType, aNumberPair->GetAnimValue(aIndex));
   }
+  /**
+   * Converts a point and a length in filter primitive units into filter space.
+   * For object-bounding-box units, the object bounding box offset is applied
+   * to the point.
+   */
+  void ConvertLocation(float aValues[3]) const;
+
   gfxMatrix GetUserSpaceToFilterSpaceTransform() const;
   gfxMatrix GetFilterSpaceToDeviceSpaceTransform() const {
     return mFilterSpaceToDeviceSpaceTransform;
   }
+  gfxPoint FilterSpaceToUserSpace(const gfxPoint& aPt) const;
 
 private:
   typedef nsSVGFE::Image Image;

From 84bef19b19413ce702c34e532aa38250c1a17343 Mon Sep 17 00:00:00 2001
From: Ben Turner <bent.mozilla@gmail.com>
Date: Thu, 8 Sep 2011 17:03:03 -0700
Subject: [PATCH 079/209] Bug 679551 - 'Workers: Deadlock in
 WorkerPrivate::BlockAndCollectRuntimeStats if worker is blocked (LastPass
 extension)'. r=mrbkap.

---
 dom/workers/ChromeWorkerScope.cpp       |  65 ++++++-
 dom/workers/RuntimeService.cpp          |  71 -------
 dom/workers/WorkerPrivate.cpp           | 244 +++++++++++++++++++-----
 dom/workers/WorkerPrivate.h             |  13 +-
 dom/workers/test/chromeWorker_worker.js |   5 +
 5 files changed, 272 insertions(+), 126 deletions(-)

diff --git a/dom/workers/ChromeWorkerScope.cpp b/dom/workers/ChromeWorkerScope.cpp
index 5f253dac2f47..296ac6cadb9c 100644
--- a/dom/workers/ChromeWorkerScope.cpp
+++ b/dom/workers/ChromeWorkerScope.cpp
@@ -45,6 +45,10 @@
 #include "nsNativeCharsetUtils.h"
 #include "nsStringGlue.h"
 
+#include "WorkerPrivate.h"
+
+#define CTYPES_STR "ctypes"
+
 USING_WORKERS_NAMESPACE
 
 namespace {
@@ -74,8 +78,57 @@ UnicodeToNative(JSContext* aCx, const jschar* aSource, size_t aSourceLen)
 JSCTypesCallbacks gCTypesCallbacks = {
   UnicodeToNative
 };
+
+JSBool
+CTypesLazyGetter(JSContext* aCx, JSObject* aObj, jsid aId, jsval* aVp)
+{
+  NS_ASSERTION(JS_GetGlobalObject(aCx) == aObj, "Not a global object!");
+  NS_ASSERTION(JSID_IS_STRING(aId), "Bad id!");
+  NS_ASSERTION(JS_FlatStringEqualsAscii(JSID_TO_FLAT_STRING(aId), CTYPES_STR),
+               "Bad id!");
+
+  WorkerPrivate* worker = GetWorkerPrivateFromContext(aCx);
+  NS_ASSERTION(worker->IsChromeWorker(), "This should always be true!");
+
+  if (!worker->DisableMemoryReporter()) {
+    return false;
+  }
+
+  jsval ctypes;
+  return JS_DeletePropertyById(aCx, aObj, aId) &&
+         JS_InitCTypesClass(aCx, aObj) &&
+         JS_GetPropertyById(aCx, aObj, aId, &ctypes) &&
+         JS_SetCTypesCallbacks(aCx, JSVAL_TO_OBJECT(ctypes),
+                               &gCTypesCallbacks) &&
+         JS_GetPropertyById(aCx, aObj, aId, aVp);
+}
 #endif
 
+inline bool
+DefineCTypesLazyGetter(JSContext* aCx, JSObject* aGlobal)
+{
+#ifdef BUILD_CTYPES
+  {
+    JSString* ctypesStr = JS_InternString(aCx, CTYPES_STR);
+    if (!ctypesStr) {
+      return false;
+    }
+
+    jsid ctypesId = INTERNED_STRING_TO_JSID(aCx, ctypesStr);
+
+    // We use a lazy getter here to let us unregister the blocking memory
+    // reporter since ctypes can easily block the worker thread and we can
+    // deadlock. Remove once bug 673323 is fixed.
+    if (!JS_DefinePropertyById(aCx, aGlobal, ctypesId, JSVAL_VOID,
+                               CTypesLazyGetter, NULL, 0)) {
+      return false;
+    }
+  }
+#endif
+
+  return true;
+}
+
 } // anonymous namespace
 
 BEGIN_WORKERS_NAMESPACE
@@ -85,16 +138,8 @@ namespace chromeworker {
 bool
 DefineChromeWorkerFunctions(JSContext* aCx, JSObject* aGlobal)
 {
-#ifdef BUILD_CTYPES
-  jsval ctypes;
-  if (!JS_InitCTypesClass(aCx, aGlobal) ||
-      !JS_GetProperty(aCx, aGlobal, "ctypes", &ctypes) ||
-      !JS_SetCTypesCallbacks(aCx, JSVAL_TO_OBJECT(ctypes), &gCTypesCallbacks)) {
-    return false;
-  }
-#endif
-
-  return true;
+  // Currently ctypes is the only special property given to ChromeWorkers.
+  return DefineCTypesLazyGetter(aCx, aGlobal);
 }
 
 } // namespace chromeworker
diff --git a/dom/workers/RuntimeService.cpp b/dom/workers/RuntimeService.cpp
index 4a5ee9dc25b9..a6dd441d5bcb 100644
--- a/dom/workers/RuntimeService.cpp
+++ b/dom/workers/RuntimeService.cpp
@@ -46,13 +46,11 @@
 #include "nsIPlatformCharset.h"
 #include "nsIPrincipal.h"
 #include "nsIJSContextStack.h"
-#include "nsIMemoryReporter.h"
 #include "nsIScriptSecurityManager.h"
 #include "nsISupportsPriority.h"
 #include "nsITimer.h"
 #include "nsPIDOMWindow.h"
 
-#include "jsprf.h"
 #include "mozilla/Preferences.h"
 #include "nsContentUtils.h"
 #include "nsDOMJSUtils.h"
@@ -287,61 +285,6 @@ CreateJSContextForWorker(WorkerPrivate* aWorkerPrivate)
   return workerCx;
 }
 
-class WorkerMemoryReporter : public nsIMemoryMultiReporter
-{
-  WorkerPrivate* mWorkerPrivate;
-  nsCString mPathPrefix;
-
-public:
-  NS_DECL_ISUPPORTS
-
-  WorkerMemoryReporter(WorkerPrivate* aWorkerPrivate)
-  : mWorkerPrivate(aWorkerPrivate)
-  {
-    aWorkerPrivate->AssertIsOnWorkerThread();
-
-    nsCString escapedDomain(aWorkerPrivate->Domain());
-    escapedDomain.ReplaceChar('/', '\\');
-
-    NS_ConvertUTF16toUTF8 escapedURL(aWorkerPrivate->ScriptURL());
-    escapedURL.ReplaceChar('/', '\\');
-
-    // 64bit address plus '0x' plus null terminator.
-    char address[21];
-    JSUint32 addressSize =
-      JS_snprintf(address, sizeof(address), "0x%llx", aWorkerPrivate);
-    if (addressSize == JSUint32(-1)) {
-      NS_WARNING("JS_snprintf failed!");
-      address[0] = '\0';
-      addressSize = 0;
-    }
-
-    mPathPrefix = NS_LITERAL_CSTRING("explicit/dom/workers(") +
-                  escapedDomain + NS_LITERAL_CSTRING(")/worker(") +
-                  escapedURL + NS_LITERAL_CSTRING(", ") +
-                  nsDependentCString(address, addressSize) +
-                  NS_LITERAL_CSTRING(")/");
-  }
-
-  NS_IMETHOD
-  CollectReports(nsIMemoryMultiReporterCallback* aCallback,
-                 nsISupports* aClosure)
-  {
-    AssertIsOnMainThread();
-
-    IterateData data;
-    if (!mWorkerPrivate->BlockAndCollectRuntimeStats(&data)) {
-      return NS_ERROR_FAILURE;
-    }
-
-    ReportJSRuntimeStats(data, mPathPrefix, aCallback, aClosure);
-
-    return NS_OK;
-  }
-};
-
-NS_IMPL_THREADSAFE_ISUPPORTS1(WorkerMemoryReporter, nsIMemoryMultiReporter)
-
 class WorkerThreadRunnable : public nsRunnable
 {
   WorkerPrivate* mWorkerPrivate;
@@ -368,25 +311,11 @@ public:
       return NS_ERROR_FAILURE;
     }
 
-    nsRefPtr<WorkerMemoryReporter> reporter =
-      new WorkerMemoryReporter(workerPrivate);
-    if (NS_FAILED(NS_RegisterMemoryMultiReporter(reporter))) {
-      NS_WARNING("Failed to register memory reporter!");
-      reporter = nsnull;
-    }
-
     {
       JSAutoRequest ar(cx);
       workerPrivate->DoRunLoop(cx);
     }
 
-    if (reporter) {
-      if (NS_FAILED(NS_UnregisterMemoryMultiReporter(reporter))) {
-        NS_WARNING("Failed to unregister memory reporter!");
-      }
-      reporter = nsnull;
-    }
-
     JSRuntime* rt = JS_GetRuntime(cx);
 
     // XXX Bug 666963 - CTypes can create another JSContext for use with
diff --git a/dom/workers/WorkerPrivate.cpp b/dom/workers/WorkerPrivate.cpp
index f3298a33cca1..07d0d0afb724 100644
--- a/dom/workers/WorkerPrivate.cpp
+++ b/dom/workers/WorkerPrivate.cpp
@@ -45,6 +45,7 @@
 #include "nsIDocument.h"
 #include "nsIEffectiveTLDService.h"
 #include "nsIJSContextStack.h"
+#include "nsIMemoryReporter.h"
 #include "nsIScriptError.h"
 #include "nsIScriptGlobalObject.h"
 #include "nsIScriptSecurityManager.h"
@@ -57,6 +58,7 @@
 
 #include "jscntxt.h"
 #include "jsdbgapi.h"
+#include "jsprf.h"
 #include "nsAlgorithm.h"
 #include "nsContentUtils.h"
 #include "nsDOMClassInfo.h"
@@ -140,6 +142,87 @@ SwapToISupportsArray(SmartPtr<T>& aSrc,
   dest->swap(rawSupports);
 }
 
+class WorkerMemoryReporter : public nsIMemoryMultiReporter
+{
+  WorkerPrivate* mWorkerPrivate;
+  nsCString mAddressString;
+  nsCString mPathPrefix;
+
+public:
+  NS_DECL_ISUPPORTS
+
+  WorkerMemoryReporter(WorkerPrivate* aWorkerPrivate)
+  : mWorkerPrivate(aWorkerPrivate)
+  {
+    aWorkerPrivate->AssertIsOnWorkerThread();
+
+    nsCString escapedDomain(aWorkerPrivate->Domain());
+    escapedDomain.ReplaceChar('/', '\\');
+
+    NS_ConvertUTF16toUTF8 escapedURL(aWorkerPrivate->ScriptURL());
+    escapedURL.ReplaceChar('/', '\\');
+
+    {
+      // 64bit address plus '0x' plus null terminator.
+      char address[21];
+      JSUint32 addressSize =
+        JS_snprintf(address, sizeof(address), "0x%llx", aWorkerPrivate);
+      if (addressSize != JSUint32(-1)) {
+        mAddressString.Assign(address, addressSize);
+      }
+      else {
+        NS_WARNING("JS_snprintf failed!");
+        mAddressString.AssignLiteral("<unknown address>");
+      }
+    }
+
+    mPathPrefix = NS_LITERAL_CSTRING("explicit/dom/workers(") +
+                  escapedDomain + NS_LITERAL_CSTRING(")/worker(") +
+                  escapedURL + NS_LITERAL_CSTRING(", ") + mAddressString +
+                  NS_LITERAL_CSTRING(")/");
+  }
+
+  NS_IMETHOD
+  CollectReports(nsIMemoryMultiReporterCallback* aCallback,
+                 nsISupports* aClosure)
+  {
+    AssertIsOnMainThread();
+
+    IterateData data;
+
+    if (mWorkerPrivate) {
+      bool disabled;
+      if (!mWorkerPrivate->BlockAndCollectRuntimeStats(&data, &disabled)) {
+        return NS_ERROR_FAILURE;
+      }
+
+      // Don't ever try to talk to the worker again.
+      if (disabled) {
+#ifdef DEBUG
+        {
+          nsCAutoString message("Unable to report memory for ");
+          if (mWorkerPrivate->IsChromeWorker()) {
+            message.AppendLiteral("Chrome");
+          }
+          message += NS_LITERAL_CSTRING("Worker (") + mAddressString +
+                     NS_LITERAL_CSTRING(")! It is either using ctypes or is in "
+                                        "the process of being destroyed");
+          NS_WARNING(message.get());
+        }
+#endif
+        mWorkerPrivate = nsnull;
+      }
+    }
+
+    // Always report, even if we're disabled, so that we at least get an entry
+    // in about::memory.
+    ReportJSRuntimeStats(data, mPathPrefix, aCallback, aClosure);
+    return NS_OK;
+  }
+};
+
+NS_IMPL_THREADSAFE_ISUPPORTS1(WorkerMemoryReporter, nsIMemoryMultiReporter)
+
 struct WorkerStructuredCloneCallbacks
 {
   static JSObject*
@@ -1282,19 +1365,19 @@ class CollectRuntimeStatsRunnable : public WorkerControlRunnable
   typedef mozilla::Mutex Mutex;
   typedef mozilla::CondVar CondVar;
 
-  Mutex* mMutex;
-  CondVar* mCondVar;
-  volatile bool* mDoneFlag;
+  Mutex mMutex;
+  CondVar mCondVar;
+  volatile bool mDone;
   IterateData* mData;
-  volatile bool* mSucceeded;
+  bool* mSucceeded;
 
 public:
-  CollectRuntimeStatsRunnable(WorkerPrivate* aWorkerPrivate, Mutex* aMutex,
-                              CondVar* aCondVar, volatile bool* aDoneFlag,
-                              IterateData* aData, volatile bool* aSucceeded)
+  CollectRuntimeStatsRunnable(WorkerPrivate* aWorkerPrivate, IterateData* aData,
+                              bool* aSucceeded)
   : WorkerControlRunnable(aWorkerPrivate, WorkerThread, UnchangedBusyCount),
-    mMutex(aMutex), mCondVar(aCondVar), mDoneFlag(aDoneFlag), mData(aData),
-    mSucceeded(aSucceeded)
+    mMutex("CollectRuntimeStatsRunnable::mMutex"),
+    mCondVar(mMutex, "CollectRuntimeStatsRunnable::mCondVar"), mDone(false),
+    mData(aData), mSucceeded(aSucceeded)
   { }
 
   bool
@@ -1311,6 +1394,26 @@ public:
     AssertIsOnMainThread();
   }
 
+  bool
+  DispatchInternal()
+  {
+    AssertIsOnMainThread();
+
+    if (!WorkerControlRunnable::DispatchInternal()) {
+      NS_WARNING("Failed to dispatch runnable!");
+      return false;
+    }
+
+    {
+      MutexAutoLock lock(mMutex);
+      while (!mDone) {
+        mCondVar.Wait();
+      }
+    }
+
+    return true;
+  }
+
   bool
   WorkerRun(JSContext* aCx, WorkerPrivate* aWorkerPrivate)
   {
@@ -1319,12 +1422,9 @@ public:
     *mSucceeded = CollectCompartmentStatsForRuntime(JS_GetRuntime(aCx), mData);
 
     {
-      MutexAutoLock lock(*mMutex);
-
-      NS_ASSERTION(!*mDoneFlag, "Should be false!");
-
-      *mDoneFlag = true;
-      mCondVar->Notify();
+      MutexAutoLock lock(mMutex);
+      mDone = true;
+      mCondVar.Notify();
     }
 
     return true;
@@ -2101,7 +2201,8 @@ WorkerPrivate::WorkerPrivate(JSContext* aCx, JSObject* aObject,
   mJSContext(nsnull), mErrorHandlerRecursionCount(0), mNextTimeoutId(1),
   mStatus(Pending), mSuspended(false), mTimerRunning(false),
   mRunningExpiredTimeouts(false), mCloseHandlerStarted(false),
-  mCloseHandlerFinished(false)
+  mCloseHandlerFinished(false), mMemoryReporterRunning(false),
+  mMemoryReporterDisabled(false)
 {
   MOZ_COUNT_CTOR(mozilla::dom::workers::WorkerPrivate);
 }
@@ -2308,6 +2409,13 @@ WorkerPrivate::DoRunLoop(JSContext* aCx)
     mStatus = Running;
   }
 
+  mMemoryReporter = new WorkerMemoryReporter(this);
+
+  if (NS_FAILED(NS_RegisterMemoryMultiReporter(mMemoryReporter))) {
+    NS_WARNING("Failed to register memory reporter!");
+    mMemoryReporter = nsnull;
+  }
+
   for (;;) {
     Status currentStatus;
     nsIRunnable* event;
@@ -2358,6 +2466,17 @@ WorkerPrivate::DoRunLoop(JSContext* aCx)
 
       // If we're supposed to die then we should exit the loop.
       if (currentStatus == Killing) {
+        // Call this before unregistering the reporter as we may be racing with
+        // the main thread.
+        DisableMemoryReporter();
+
+        if (mMemoryReporter) {
+          if (NS_FAILED(NS_UnregisterMemoryMultiReporter(mMemoryReporter))) {
+            NS_WARNING("Failed to unregister memory reporter!");
+          }
+          mMemoryReporter = nsnull;
+        }
+
         StopAcceptingEvents();
         return;
       }
@@ -2376,21 +2495,7 @@ WorkerPrivate::OperationCallback(JSContext* aCx)
 
   for (;;) {
     // Run all control events now.
-    for (;;) {
-      nsIRunnable* event;
-      {
-        MutexAutoLock lock(mMutex);
-        if (!mControlQueue.Pop(event)) {
-          break;
-        }
-      }
-
-      if (NS_FAILED(event->Run())) {
-        mayContinue = false;
-      }
-
-      NS_RELEASE(event);
-    }
+    mayContinue = ProcessAllControlRunnables();
 
     if (!mayContinue || !mSuspended) {
       break;
@@ -2457,35 +2562,86 @@ WorkerPrivate::ScheduleDeletion(bool aWasPending)
 }
 
 bool
-WorkerPrivate::BlockAndCollectRuntimeStats(IterateData* aData)
+WorkerPrivate::BlockAndCollectRuntimeStats(IterateData* aData, bool* aDisabled)
 {
   AssertIsOnMainThread();
-  mMutex.AssertNotCurrentThreadOwns();
   NS_ASSERTION(aData, "Null data!");
 
-  mozilla::Mutex mutex("BlockAndCollectRuntimeStats mutex");
-  mozilla::CondVar condvar(mutex, "BlockAndCollectRuntimeStats condvar");
-  volatile bool doneFlag = false;
-  volatile bool succeeded = false;
+  {
+    MutexAutoLock lock(mMutex);
+
+    if (mMemoryReporterDisabled) {
+      *aDisabled = true;
+      return true;
+    }
+
+    *aDisabled = false;
+    mMemoryReporterRunning = true;
+  }
+
+  bool succeeded;
 
   nsRefPtr<CollectRuntimeStatsRunnable> runnable =
-    new CollectRuntimeStatsRunnable(this, &mutex, &condvar, &doneFlag, aData,
-                                    &succeeded);
+    new CollectRuntimeStatsRunnable(this, aData, &succeeded);
   if (!runnable->Dispatch(nsnull)) {
     NS_WARNING("Failed to dispatch runnable!");
-    return false;
+    succeeded = false;
   }
 
   {
-    MutexAutoLock lock(mutex);
-    while (!doneFlag) {
-      condvar.Wait();
-    }
+    MutexAutoLock lock(mMutex);
+    mMemoryReporterRunning = false;
   }
 
   return succeeded;
 }
 
+bool
+WorkerPrivate::DisableMemoryReporter()
+{
+  AssertIsOnWorkerThread();
+
+  bool result = true;
+
+  {
+    MutexAutoLock lock(mMutex);
+
+    mMemoryReporterDisabled = true;
+
+    while (mMemoryReporterRunning) {
+      MutexAutoUnlock unlock(mMutex);
+      result = ProcessAllControlRunnables() && result;
+    }
+  }
+
+  return result;
+}
+
+bool
+WorkerPrivate::ProcessAllControlRunnables()
+{
+  AssertIsOnWorkerThread();
+
+  bool result = true;
+
+  for (;;) {
+    nsIRunnable* event;
+    {
+      MutexAutoLock lock(mMutex);
+      if (!mControlQueue.Pop(event)) {
+        break;
+      }
+    }
+
+    if (NS_FAILED(event->Run())) {
+      result = false;
+    }
+
+    NS_RELEASE(event);
+  }
+  return result;
+}
+
 bool
 WorkerPrivate::Dispatch(WorkerRunnable* aEvent, EventQueue* aQueue)
 {
diff --git a/dom/workers/WorkerPrivate.h b/dom/workers/WorkerPrivate.h
index cc31a26ea54b..816d5dab1c2d 100644
--- a/dom/workers/WorkerPrivate.h
+++ b/dom/workers/WorkerPrivate.h
@@ -63,6 +63,7 @@
 class JSAutoStructuredCloneBuffer;
 class nsIDocument;
 class nsIPrincipal;
+class nsIMemoryMultiReporter;
 class nsIScriptContext;
 class nsIURI;
 class nsPIDOMWindow;
@@ -512,6 +513,7 @@ class WorkerPrivate : public WorkerPrivateParent<WorkerPrivate>
   nsTArray<nsAutoPtr<TimeoutInfo> > mTimeouts;
 
   nsCOMPtr<nsITimer> mTimer;
+  nsCOMPtr<nsIMemoryMultiReporter> mMemoryReporter;
 
   mozilla::TimeStamp mKillTime;
   PRUint32 mErrorHandlerRecursionCount;
@@ -522,6 +524,8 @@ class WorkerPrivate : public WorkerPrivateParent<WorkerPrivate>
   bool mRunningExpiredTimeouts;
   bool mCloseHandlerStarted;
   bool mCloseHandlerFinished;
+  bool mMemoryReporterRunning;
+  bool mMemoryReporterDisabled;
 
 #ifdef DEBUG
   nsCOMPtr<nsIThread> mThread;
@@ -654,7 +658,11 @@ public:
   ScheduleDeletion(bool aWasPending);
 
   bool
-  BlockAndCollectRuntimeStats(mozilla::xpconnect::memory::IterateData* aData);
+  BlockAndCollectRuntimeStats(mozilla::xpconnect::memory::IterateData* aData,
+                              bool* aDisabled);
+
+  bool
+  DisableMemoryReporter();
 
 #ifdef JS_GC_ZEAL
   void
@@ -743,6 +751,9 @@ private:
     ClearQueue(&mQueue);
     ClearQueue(&mControlQueue);
   }
+
+  bool
+  ProcessAllControlRunnables();
 };
 
 WorkerPrivate*
diff --git a/dom/workers/test/chromeWorker_worker.js b/dom/workers/test/chromeWorker_worker.js
index 936188c2cd7c..5738a9ae5df4 100644
--- a/dom/workers/test/chromeWorker_worker.js
+++ b/dom/workers/test/chromeWorker_worker.js
@@ -6,6 +6,11 @@ if (!("ctypes" in self)) {
   throw "No ctypes!";
 }
 
+// Go ahead and verify that the ctypes lazy getter actually works.
+if (ctypes.toString() != "[object ctypes]") {
+  throw "Bad ctypes object: " + ctypes.toString();
+}
+
 onmessage = function(event) {
   let worker = new ChromeWorker("chromeWorker_subworker.js");
   worker.onmessage = function(event) {

From 92f904aeb48c0a68316b47afab8eb1eb84730373 Mon Sep 17 00:00:00 2001
From: Ben Turner <bent.mozilla@gmail.com>
Date: Thu, 8 Sep 2011 17:07:11 -0700
Subject: [PATCH 080/209] Bug 683280 - 'Workers: creating workers from
 'localhost' or an IP address fails'. r=sicking.

---
 content/base/src/ThirdPartyUtil.cpp          | 79 ++++++++++----------
 content/base/src/ThirdPartyUtil.h            |  1 -
 dom/workers/WorkerPrivate.cpp                | 12 +--
 dom/workers/test/Makefile.in                 |  3 +
 dom/workers/test/ipAddressOrigin_iframe.html | 23 ++++++
 dom/workers/test/ipAddressOrigin_worker.js   |  5 ++
 dom/workers/test/test_ipAddressOrigin.html   | 42 +++++++++++
 netwerk/base/public/mozIThirdPartyUtil.idl   | 20 ++++-
 8 files changed, 137 insertions(+), 48 deletions(-)
 create mode 100644 dom/workers/test/ipAddressOrigin_iframe.html
 create mode 100644 dom/workers/test/ipAddressOrigin_worker.js
 create mode 100644 dom/workers/test/test_ipAddressOrigin.html

diff --git a/content/base/src/ThirdPartyUtil.cpp b/content/base/src/ThirdPartyUtil.cpp
index b195af9f48e6..ebe7ebdc6019 100644
--- a/content/base/src/ThirdPartyUtil.cpp
+++ b/content/base/src/ThirdPartyUtil.cpp
@@ -57,46 +57,6 @@ ThirdPartyUtil::Init()
   return rv;
 }
 
-// Get the base domain for aHostURI; e.g. for "www.bbc.co.uk", this would be
-// "bbc.co.uk". Only properly-formed URI's are tolerated, though a trailing
-// dot may be present. If aHostURI is an IP address, an alias such as
-// 'localhost', an eTLD such as 'co.uk', or the empty string, aBaseDomain will
-// be the exact host. The result of this function should only be used in exact
-// string comparisons, since substring comparisons will not be valid for the
-// special cases elided above.
-nsresult
-ThirdPartyUtil::GetBaseDomain(nsIURI* aHostURI,
-                              nsCString& aBaseDomain)
-{
-  // Get the base domain. this will fail if the host contains a leading dot,
-  // more than one trailing dot, or is otherwise malformed.
-  nsresult rv = mTLDService->GetBaseDomain(aHostURI, 0, aBaseDomain);
-  if (rv == NS_ERROR_HOST_IS_IP_ADDRESS ||
-      rv == NS_ERROR_INSUFFICIENT_DOMAIN_LEVELS) {
-    // aHostURI is either an IP address, an alias such as 'localhost', an eTLD
-    // such as 'co.uk', or the empty string. Uses the normalized host in such
-    // cases.
-    rv = aHostURI->GetAsciiHost(aBaseDomain);
-  }
-  NS_ENSURE_SUCCESS(rv, rv);
-
-  // aHostURI (and thus aBaseDomain) may be the string '.'. If so, fail.
-  if (aBaseDomain.Length() == 1 && aBaseDomain.Last() == '.')
-    return NS_ERROR_INVALID_ARG;
-
-  // Reject any URIs without a host that aren't file:// URIs. This makes it the
-  // only way we can get a base domain consisting of the empty string, which
-  // means we can safely perform foreign tests on such URIs where "not foreign"
-  // means "the involved URIs are all file://".
-  if (aBaseDomain.IsEmpty()) {
-    PRBool isFileURI = PR_FALSE;
-    aHostURI->SchemeIs("file", &isFileURI);
-    NS_ENSURE_TRUE(isFileURI, NS_ERROR_INVALID_ARG);
-  }
-
-  return NS_OK;
-}
-
 // Determine if aFirstDomain is a different base domain to aSecondURI; or, if
 // the concept of base domain does not apply, determine if the two hosts are not
 // string-identical.
@@ -316,3 +276,42 @@ ThirdPartyUtil::IsThirdPartyChannel(nsIChannel* aChannel,
   return IsThirdPartyWindow(ourWin, channelURI, aResult);
 }
 
+// Get the base domain for aHostURI; e.g. for "www.bbc.co.uk", this would be
+// "bbc.co.uk". Only properly-formed URI's are tolerated, though a trailing
+// dot may be present. If aHostURI is an IP address, an alias such as
+// 'localhost', an eTLD such as 'co.uk', or the empty string, aBaseDomain will
+// be the exact host. The result of this function should only be used in exact
+// string comparisons, since substring comparisons will not be valid for the
+// special cases elided above.
+NS_IMETHODIMP
+ThirdPartyUtil::GetBaseDomain(nsIURI* aHostURI,
+                              nsACString& aBaseDomain)
+{
+  // Get the base domain. this will fail if the host contains a leading dot,
+  // more than one trailing dot, or is otherwise malformed.
+  nsresult rv = mTLDService->GetBaseDomain(aHostURI, 0, aBaseDomain);
+  if (rv == NS_ERROR_HOST_IS_IP_ADDRESS ||
+      rv == NS_ERROR_INSUFFICIENT_DOMAIN_LEVELS) {
+    // aHostURI is either an IP address, an alias such as 'localhost', an eTLD
+    // such as 'co.uk', or the empty string. Uses the normalized host in such
+    // cases.
+    rv = aHostURI->GetAsciiHost(aBaseDomain);
+  }
+  NS_ENSURE_SUCCESS(rv, rv);
+
+  // aHostURI (and thus aBaseDomain) may be the string '.'. If so, fail.
+  if (aBaseDomain.Length() == 1 && aBaseDomain.Last() == '.')
+    return NS_ERROR_INVALID_ARG;
+
+  // Reject any URIs without a host that aren't file:// URIs. This makes it the
+  // only way we can get a base domain consisting of the empty string, which
+  // means we can safely perform foreign tests on such URIs where "not foreign"
+  // means "the involved URIs are all file://".
+  if (aBaseDomain.IsEmpty()) {
+    PRBool isFileURI = PR_FALSE;
+    aHostURI->SchemeIs("file", &isFileURI);
+    NS_ENSURE_TRUE(isFileURI, NS_ERROR_INVALID_ARG);
+  }
+
+  return NS_OK;
+}
diff --git a/content/base/src/ThirdPartyUtil.h b/content/base/src/ThirdPartyUtil.h
index 85cb84902e6f..164f13e6e696 100644
--- a/content/base/src/ThirdPartyUtil.h
+++ b/content/base/src/ThirdPartyUtil.h
@@ -56,7 +56,6 @@ public:
   nsresult Init();
 
 private:
-  nsresult GetBaseDomain(nsIURI* aHostURI, nsCString& aBaseDomain);
   nsresult IsThirdPartyInternal(const nsCString& aFirstDomain,
     nsIURI* aSecondURI, PRBool* aResult);
   static already_AddRefed<nsIURI> GetURIFromWindow(nsIDOMWindow* aWin);
diff --git a/dom/workers/WorkerPrivate.cpp b/dom/workers/WorkerPrivate.cpp
index 07d0d0afb724..db58af4d4306 100644
--- a/dom/workers/WorkerPrivate.cpp
+++ b/dom/workers/WorkerPrivate.cpp
@@ -39,11 +39,11 @@
 
 #include "WorkerPrivate.h"
 
+#include "mozIThirdPartyUtil.h"
 #include "nsIClassInfo.h"
 #include "nsIConsoleService.h"
 #include "nsIDOMFile.h"
 #include "nsIDocument.h"
-#include "nsIEffectiveTLDService.h"
 #include "nsIJSContextStack.h"
 #include "nsIMemoryReporter.h"
 #include "nsIScriptError.h"
@@ -2329,14 +2329,14 @@ WorkerPrivate::Create(JSContext* aCx, JSObject* aObj, WorkerPrivate* aParent,
           domain = file;
         }
         else {
-          nsCOMPtr<nsIEffectiveTLDService> tldService =
-            do_GetService(NS_EFFECTIVETLDSERVICE_CONTRACTID);
-          if (!tldService) {
-            JS_ReportError(aCx, "Could not get TLD service!");
+          nsCOMPtr<mozIThirdPartyUtil> thirdPartyUtil =
+            do_GetService(THIRDPARTYUTIL_CONTRACTID);
+          if (!thirdPartyUtil) {
+            JS_ReportError(aCx, "Could not get third party helper service!");
             return nsnull;
           }
 
-          if (NS_FAILED(tldService->GetBaseDomain(codebase, 0, domain))) {
+          if (NS_FAILED(thirdPartyUtil->GetBaseDomain(codebase, domain))) {
             JS_ReportError(aCx, "Could not get domain!");
             return nsnull;
           }
diff --git a/dom/workers/test/Makefile.in b/dom/workers/test/Makefile.in
index e55f944c9eff..dba82ac982ab 100644
--- a/dom/workers/test/Makefile.in
+++ b/dom/workers/test/Makefile.in
@@ -58,6 +58,9 @@ _TEST_FILES = \
   errorPropagation_worker.js \
   test_eventDispatch.html \
   eventDispatch_worker.js \
+  test_ipAddressOrigin.html \
+  ipAddressOrigin_iframe.html \
+  ipAddressOrigin_worker.js \
   test_importScripts.html \
   importScripts_worker.js \
   importScripts_worker_imported1.js \
diff --git a/dom/workers/test/ipAddressOrigin_iframe.html b/dom/workers/test/ipAddressOrigin_iframe.html
new file mode 100644
index 000000000000..66a9f2c0cc0c
--- /dev/null
+++ b/dom/workers/test/ipAddressOrigin_iframe.html
@@ -0,0 +1,23 @@
+<!--
+  Any copyright is dedicated to the Public Domain.
+  http://creativecommons.org/publicdomain/zero/1.0/
+-->
+<!DOCTYPE HTML>
+<html>
+<body>
+<script>
+
+  onmessage = function (event) {
+    var url = "http://127.0.0.1" +
+      window.location.pathname.replace("ipAddressOrigin_iframe.html",
+                                       "ipAddRessOrigin_worker.js");
+
+    var worker = new Worker(url);
+    worker.onmessage = function (event) {
+      window.parent.postMessage(event.data, "*");
+    };
+  }
+
+</script>
+</body>
+</html>
diff --git a/dom/workers/test/ipAddressOrigin_worker.js b/dom/workers/test/ipAddressOrigin_worker.js
new file mode 100644
index 000000000000..92ef04503976
--- /dev/null
+++ b/dom/workers/test/ipAddressOrigin_worker.js
@@ -0,0 +1,5 @@
+/**
+* Any copyright is dedicated to the Public Domain.
+* http://creativecommons.org/publicdomain/zero/1.0/
+*/
+postMessage("done");
diff --git a/dom/workers/test/test_ipAddressOrigin.html b/dom/workers/test/test_ipAddressOrigin.html
new file mode 100644
index 000000000000..1f48e1b68fdb
--- /dev/null
+++ b/dom/workers/test/test_ipAddressOrigin.html
@@ -0,0 +1,42 @@
+<!--
+  Any copyright is dedicated to the Public Domain.
+  http://creativecommons.org/publicdomain/zero/1.0/
+-->
+<!DOCTYPE HTML>
+<html>
+<head>
+  <title>Test for Web Workers</title>
+  <script type="text/javascript" src="/tests/SimpleTest/SimpleTest.js"></script>
+  <link rel="stylesheet" type="text/css" href="/tests/SimpleTest/test.css" />
+</head>
+<body onload="go();">
+<p id="display"></p>
+<div id="content" style="display: none">
+</div>
+<pre id="test">
+<iframe id="testFrame"></iframe>
+<script class="testbody" type="text/javascript">
+
+  function go() {
+    var iframe = document.getElementById("testFrame");
+
+    iframe.addEventListener("load", function() {
+      iframe.contentWindow.postMessage("go", "*");
+      window.addEventListener("message", function(event) {
+        is(event.data, "done", "Correct message");
+        SimpleTest.finish();
+      }, "false");
+    }, false);
+
+    iframe.src =
+      "http://127.0.0.1" +
+      window.location.pathname.replace("test_ipAddressOrigin.html",
+                                       "ipAddressOrigin_iframe.html");
+  }
+
+  SimpleTest.waitForExplicitFinish();
+
+</script>
+</pre>
+</body>
+</html>
diff --git a/netwerk/base/public/mozIThirdPartyUtil.idl b/netwerk/base/public/mozIThirdPartyUtil.idl
index e0b40ef29c30..ad419857692e 100644
--- a/netwerk/base/public/mozIThirdPartyUtil.idl
+++ b/netwerk/base/public/mozIThirdPartyUtil.idl
@@ -45,7 +45,7 @@ interface nsIChannel;
  * Utility functions for determining whether a given URI, channel, or window
  * hierarchy is third party with respect to a known URI.
  */
-[scriptable, uuid(55385caa-1b94-4376-a34c-b47c51ef0837)]
+[scriptable, uuid(d994fd1d-d2fe-4372-9ae7-88b08b7d9d90)]
 interface mozIThirdPartyUtil : nsISupports
 {
   /**
@@ -155,6 +155,24 @@ interface mozIThirdPartyUtil : nsISupports
    * @see isThirdPartyWindow
    */
   boolean isThirdPartyChannel(in nsIChannel aChannel, [optional] in nsIURI aURI);
+
+  /**
+   * getBaseDomain
+   *
+   * Get the base domain for aHostURI; e.g. for "www.bbc.co.uk", this would be
+   * "bbc.co.uk". Only properly-formed URI's are tolerated, though a trailing
+   * dot may be present. If aHostURI is an IP address, an alias such as
+   * 'localhost', an eTLD such as 'co.uk', or the empty string, aBaseDomain will
+   * be the exact host. The result of this function should only be used in exact
+   * string comparisons, since substring comparisons will not be valid for the
+   * special cases elided above.
+   *
+   * @param aHostURI
+   *        The URI to analyze.
+   *
+   * @return the base domain.
+   */
+  AUTF8String getBaseDomain(in nsIURI aHostURI);
 };
 
 %{ C++

From 90f2de805ad8fa7da21d1c92c205c0ab8bbb84e9 Mon Sep 17 00:00:00 2001
From: Brian Hackett <bhackett1024@gmail.com>
Date: Thu, 8 Sep 2011 17:44:17 -0700
Subject: [PATCH 081/209] [INFER] Don't resolve NAME accesses which are on the
 DeclEnv of named lambdas, bug 685313.

---
 js/src/jit-test/tests/basic/bug685313.js | 11 +++++++++++
 js/src/jsinfer.cpp                       |  8 ++++++++
 2 files changed, 19 insertions(+)
 create mode 100644 js/src/jit-test/tests/basic/bug685313.js

diff --git a/js/src/jit-test/tests/basic/bug685313.js b/js/src/jit-test/tests/basic/bug685313.js
new file mode 100644
index 000000000000..f791e5e66bd6
--- /dev/null
+++ b/js/src/jit-test/tests/basic/bug685313.js
@@ -0,0 +1,11 @@
+
+function foo() {
+    function D(){}
+    arr = [
+	   new (function D   (  ) { 
+		   D += '' + foo; 
+	       }), 
+        new D
+	   ];
+}
+foo();
diff --git a/js/src/jsinfer.cpp b/js/src/jsinfer.cpp
index 5e5d6559d882..d185c0524eea 100644
--- a/js/src/jsinfer.cpp
+++ b/js/src/jsinfer.cpp
@@ -3221,6 +3221,14 @@ ScriptAnalysis::resolveNameAccess(JSContext *cx, jsid id, bool addDependency)
             return access;
         }
 
+        /*
+         * The script's bindings do not contain a name for the function itself,
+         * don't resolve name accesses on lambdas in DeclEnv objects on the
+         * scope chain.
+         */
+        if (atom == CallObjectLambdaName(script->function()))
+            return access;
+
         if (!script->nesting()->parent)
             return access;
         script = script->nesting()->parent;

From 123e90ea13c9a7028c0a0a4bc679f197111f7f69 Mon Sep 17 00:00:00 2001
From: Marty Rosenberg <mrosenberg@mozilla.com>
Date: Thu, 8 Sep 2011 17:47:12 -0700
Subject: [PATCH 082/209] Reset the number of instructions since the last flush
 even when we don't flush anything, bug 669715.

---
 .../assembler/AssemblerBufferWithConstantPool.h      | 12 ++++++++++--
 1 file changed, 10 insertions(+), 2 deletions(-)

diff --git a/js/src/assembler/assembler/AssemblerBufferWithConstantPool.h b/js/src/assembler/assembler/AssemblerBufferWithConstantPool.h
index ab51196fda77..8b62c74477c9 100644
--- a/js/src/assembler/assembler/AssemblerBufferWithConstantPool.h
+++ b/js/src/assembler/assembler/AssemblerBufferWithConstantPool.h
@@ -254,6 +254,7 @@ private:
     void correctDeltas(int insnSize)
     {
         m_maxDistance -= insnSize;
+        ASSERT(m_maxDistance >= 0);
         m_lastConstDelta -= insnSize;
         if (m_lastConstDelta < 0)
             m_lastConstDelta = 0;
@@ -264,6 +265,7 @@ private:
         correctDeltas(insnSize);
 
         m_maxDistance -= m_lastConstDelta;
+        ASSERT(m_maxDistance >= 0);
         m_lastConstDelta = constSize;
     }
 
@@ -304,12 +306,16 @@ private:
         m_loadOffsets.clear();
         m_numConsts = 0;
         m_maxDistance = maxPoolSize;
+        ASSERT(m_maxDistance >= 0);
+
     }
 
     void flushIfNoSpaceFor(int nextInsnSize)
     {
-        if (m_numConsts == 0)
+        if (m_numConsts == 0) {
+            m_maxDistance = maxPoolSize;
             return;
+        }
         int lastConstDelta = m_lastConstDelta > nextInsnSize ? m_lastConstDelta - nextInsnSize : 0;
         if ((m_maxDistance < nextInsnSize + lastConstDelta + barrierSize + (int)sizeof(uint32_t)))
             flushConstantPool();
@@ -317,8 +323,10 @@ private:
 
     void flushIfNoSpaceFor(int nextInsnSize, int nextConstSize)
     {
-        if (m_numConsts == 0)
+        if (m_numConsts == 0) {
+            m_maxDistance = maxPoolSize;
             return;
+        }
         if ((m_maxDistance < nextInsnSize + m_lastConstDelta + nextConstSize + barrierSize + (int)sizeof(uint32_t)) ||
             (m_numConsts * sizeof(uint32_t) + nextConstSize >= maxPoolSize))
             flushConstantPool();

From 75aab49ef5d7c31a37a570110febc9c5ac6cfeb8 Mon Sep 17 00:00:00 2001
From: Marty Rosenberg <mrosenberg@mozilla.com>
Date: Thu, 8 Sep 2011 17:48:50 -0700
Subject: [PATCH 083/209] Stop using emitInst to emit vfp instructions, bug
 684404.

---
 js/src/assembler/assembler/ARMAssembler.h     | 42 ++++++++++---------
 .../assembler/assembler/MacroAssemblerARM.h   | 18 ++++----
 2 files changed, 32 insertions(+), 28 deletions(-)

diff --git a/js/src/assembler/assembler/ARMAssembler.h b/js/src/assembler/assembler/ARMAssembler.h
index 9e6e8e140358..0960e0544a20 100644
--- a/js/src/assembler/assembler/ARMAssembler.h
+++ b/js/src/assembler/assembler/ARMAssembler.h
@@ -1456,7 +1456,12 @@ namespace JSC {
             // Encoded as bits [5,3:0].
             return ((reg << 5) & 0x20) | ((reg >> 1) & 0xf);
         }
-
+        ARMWord SN(int reg)
+        {
+            ASSERT(reg <= ARMRegisters::d31);
+            // Encoded as bits [19:16,7].
+            return ((reg << 15) & 0xf0000) | ((reg & 1) << 7);
+        }
         static ARMWord getConditionalField(ARMWord i)
         {
             return i & 0xf0000000;
@@ -1600,7 +1605,6 @@ namespace JSC {
             emitVFPInst(static_cast<ARMWord>(cc) | VFP_DXFER | VFP_MOV |
                         (fromFP ? DT_LOAD : 0) |
                         (isDbl ? VFP_DBL : 0), RD(r1), RN(r2), isDbl ? DM(rFP) : SM(rFP));
-            
         }
 
         void fcpyd_r(int dd, int dm, Condition cc = AL)
@@ -1610,7 +1614,7 @@ namespace JSC {
                            nameFpRegD(dd), nameFpRegD(dm));
             // TODO: emitInst doesn't work for VFP instructions, though it
             // seems to work for current usage.
-            emitInst(static_cast<ARMWord>(cc) | FCPYD, dd, dd, dm);
+            emitVFPInst(static_cast<ARMWord>(cc) | FCPYD, DD(dd), DM(dm), 0);
         }
 
         void faddd_r(int dd, int dn, int dm, Condition cc = AL)
@@ -1619,7 +1623,7 @@ namespace JSC {
                     IPFX   "%-15s %s, %s, %s\n", MAYBE_PAD, "vadd.f64", nameFpRegD(dd), nameFpRegD(dn), nameFpRegD(dm));
             // TODO: emitInst doesn't work for VFP instructions, though it
             // seems to work for current usage.
-            emitInst(static_cast<ARMWord>(cc) | FADDD, dd, dn, dm);
+            emitVFPInst(static_cast<ARMWord>(cc) | FADDD, DD(dd), DN(dn), DM(dm));
         }
 
         void fnegd_r(int dd, int dm, Condition cc = AL)
@@ -1635,7 +1639,7 @@ namespace JSC {
                     IPFX   "%-15s %s, %s, %s\n", MAYBE_PAD, "vdiv.f64", nameFpRegD(dd), nameFpRegD(dn), nameFpRegD(dm));
             // TODO: emitInst doesn't work for VFP instructions, though it
             // seems to work for current usage.
-            emitInst(static_cast<ARMWord>(cc) | FDIVD, dd, dn, dm);
+            emitVFPInst(static_cast<ARMWord>(cc) | FDIVD, DD(dd), DN(dn), DM(dm));
         }
 
         void fsubd_r(int dd, int dn, int dm, Condition cc = AL)
@@ -1644,7 +1648,7 @@ namespace JSC {
                     IPFX   "%-15s %s, %s, %s\n", MAYBE_PAD, "vsub.f64", nameFpRegD(dd), nameFpRegD(dn), nameFpRegD(dm));
             // TODO: emitInst doesn't work for VFP instructions, though it
             // seems to work for current usage.
-            emitInst(static_cast<ARMWord>(cc) | FSUBD, dd, dn, dm);
+            emitVFPInst(static_cast<ARMWord>(cc) | FSUBD, DD(dd), DN(dn), DM(dm));
         }
 
         void fabsd_r(int dd, int dm, Condition cc = AL)
@@ -1660,7 +1664,7 @@ namespace JSC {
                     IPFX   "%-15s %s, %s, %s\n", MAYBE_PAD, "vmul.f64", nameFpRegD(dd), nameFpRegD(dn), nameFpRegD(dm));
             // TODO: emitInst doesn't work for VFP instructions, though it
             // seems to work for current usage.
-            emitInst(static_cast<ARMWord>(cc) | FMULD, dd, dn, dm);
+            emitVFPInst(static_cast<ARMWord>(cc) | FMULD, DD(dd), DN(dn), DM(dm));
         }
 
         void fcmpd_r(int dd, int dm, Condition cc = AL)
@@ -1669,7 +1673,7 @@ namespace JSC {
                     IPFX   "%-15s %s, %s\n", MAYBE_PAD, "vcmp.f64", nameFpRegD(dd), nameFpRegD(dm));
             // TODO: emitInst doesn't work for VFP instructions, though it
             // seems to work for current usage.
-            emitInst(static_cast<ARMWord>(cc) | FCMPD, dd, 0, dm);
+            emitVFPInst(static_cast<ARMWord>(cc) | FCMPD, DD(dd), 0, DM(dm));
         }
 
         void fsqrtd_r(int dd, int dm, Condition cc = AL)
@@ -1678,49 +1682,49 @@ namespace JSC {
                     IPFX   "%-15s %s, %s\n", MAYBE_PAD, "vsqrt.f64", nameFpRegD(dd), nameFpRegD(dm));
             // TODO: emitInst doesn't work for VFP instructions, though it
             // seems to work for current usage.
-            emitInst(static_cast<ARMWord>(cc) | FSQRTD, dd, 0, dm);
+            emitVFPInst(static_cast<ARMWord>(cc) | FSQRTD, DD(dd), 0, DM(dm));
         }
 
         void fmsr_r(int dd, int rn, Condition cc = AL)
         {
             // TODO: emitInst doesn't work for VFP instructions, though it
             // seems to work for current usage.
-            emitInst(static_cast<ARMWord>(cc) | FMSR, rn, dd, 0);
+            emitVFPInst(static_cast<ARMWord>(cc) | FMSR, RD(rn), SN(dd), 0);
         }
 
         void fmrs_r(int rd, int dn, Condition cc = AL)
         {
             // TODO: emitInst doesn't work for VFP instructions, though it
             // seems to work for current usage.
-            emitInst(static_cast<ARMWord>(cc) | FMRS, rd, dn, 0);
+            emitVFPInst(static_cast<ARMWord>(cc) | FMRS, RD(rd), SN(dn), 0);
         }
 
+        // dear god :(
+        // integer registers ar encoded the same as single registers
         void fsitod_r(int dd, int dm, Condition cc = AL)
         {
             // TODO: emitInst doesn't work for VFP instructions, though it
             // seems to work for current usage.
-            emitInst(static_cast<ARMWord>(cc) | FSITOD, dd, 0, dm);
+            emitVFPInst(static_cast<ARMWord>(cc) | FSITOD, DD(dd), 0, SM(dm));
         }
 
         void fuitod_r(int dd, int dm, Condition cc = AL)
         {
             // TODO: emitInst doesn't work for VFP instructions, though it
             // seems to work for current usage.
-            emitInst(static_cast<ARMWord>(cc) | FUITOD, dd, 0, dm);
+            emitVFPInst(static_cast<ARMWord>(cc) | FUITOD, DD(dd), 0, SM(dm));
         }
 
         void ftosid_r(int fd, int dm, Condition cc = AL)
         {
-            // TODO: emitInst doesn't work for VFP instructions, though it
-            // seems to work for current usage.
-            emitInst(static_cast<ARMWord>(cc) | FTOSID, fd, 0, dm);
+            // TODO: I don't actually know what the encoding is i'm guessing SD and DM.
+            emitVFPInst(static_cast<ARMWord>(cc) | FTOSID, SD(fd), 0, DM(dm));
         }
 
         void ftosizd_r(int fd, int dm, Condition cc = AL)
         {
-            // TODO: emitInst doesn't work for VFP instructions, though it
-            // seems to work for current usage.
-            emitInst(static_cast<ARMWord>(cc) | FTOSIZD, fd, 0, dm);
+            // TODO: I don't actually know what the encoding is i'm guessing SD and DM.
+            emitVFPInst(static_cast<ARMWord>(cc) | FTOSIZD, SD(fd), 0, DM(dm));
         }
 
         void fmstat(Condition cc = AL)
diff --git a/js/src/assembler/assembler/MacroAssemblerARM.h b/js/src/assembler/assembler/MacroAssemblerARM.h
index 0a51350a7ae6..3626e5f40bde 100644
--- a/js/src/assembler/assembler/MacroAssemblerARM.h
+++ b/js/src/assembler/assembler/MacroAssemblerARM.h
@@ -1292,14 +1292,14 @@ public:
 
     void convertInt32ToDouble(RegisterID src, FPRegisterID dest)
     {
-        m_assembler.fmsr_r(dest, src);
-        m_assembler.fsitod_r(dest, dest);
+        m_assembler.fmsr_r(floatShadow(dest), src);
+        m_assembler.fsitod_r(dest, floatShadow(dest));
     }
 
     void convertUInt32ToDouble(RegisterID src, FPRegisterID dest)
     {
-        m_assembler.fmsr_r(dest, src);
-        m_assembler.fuitod_r(dest, dest);
+        m_assembler.fmsr_r(floatShadow(dest), src);
+        m_assembler.fuitod_r(dest, floatShadow(dest));
     }
 
     void convertInt32ToDouble(Address src, FPRegisterID dest)
@@ -1337,11 +1337,11 @@ public:
     // May also branch for some values that are representable in 32 bits
     Jump branchTruncateDoubleToInt32(FPRegisterID src, RegisterID dest)
     {
-        m_assembler.ftosizd_r(ARMRegisters::SD0, src);
+        m_assembler.ftosizd_r(floatShadow(ARMRegisters::SD0), src);
         // If FTOSIZD (VCVT.S32.F64) can't fit the result into a 32-bit
         // integer, it saturates at INT_MAX or INT_MIN. Testing this is
         // probably quicker than testing FPSCR for exception.
-        m_assembler.fmrs_r(dest, ARMRegisters::SD0);
+        m_assembler.fmrs_r(dest, floatShadow(ARMRegisters::SD0));
         m_assembler.cmn_r(dest, ARMAssembler::getOp2(-0x7fffffff));
         m_assembler.cmp_r(dest, ARMAssembler::getOp2(0x80000000), ARMCondition(NonZero));
         return Jump(m_assembler.jmp(ARMCondition(Zero)));
@@ -1353,11 +1353,11 @@ public:
     // (specifically, in this case, 0).
     void branchConvertDoubleToInt32(FPRegisterID src, RegisterID dest, JumpList& failureCases, FPRegisterID fpTemp)
     {
-        m_assembler.ftosid_r(ARMRegisters::SD0, src);
-        m_assembler.fmrs_r(dest, ARMRegisters::SD0);
+        m_assembler.ftosid_r(floatShadow(ARMRegisters::SD0), src);
+        m_assembler.fmrs_r(dest, floatShadow(ARMRegisters::SD0));
 
         // Convert the integer result back to float & compare to the original value - if not equal or unordered (NaN) then jump.
-        m_assembler.fsitod_r(ARMRegisters::SD0, ARMRegisters::SD0);
+        m_assembler.fsitod_r(ARMRegisters::SD0, floatShadow(ARMRegisters::SD0));
         failureCases.append(branchDouble(DoubleNotEqualOrUnordered, src, ARMRegisters::SD0));
 
         // If the result is zero, it might have been -0.0, and 0.0 equals to -0.0

From f2456e219f4bd20a403fd4bc66571baacfbbbbc5 Mon Sep 17 00:00:00 2001
From: Brian Hackett <bhackett1024@gmail.com>
Date: Thu, 8 Sep 2011 18:11:19 -0700
Subject: [PATCH 084/209] [INFER] Fix some TI ARM bustage, bug 669715.

---
 js/src/jsinfer.cpp              |  2 --
 js/src/methodjit/BaseCompiler.h |  4 ++--
 js/src/methodjit/Compiler.cpp   | 12 ++++++++++++
 js/src/methodjit/FastOps.cpp    |  2 ++
 js/src/methodjit/MachineRegs.h  |  7 +++----
 js/src/methodjit/MethodJIT.cpp  | 16 ++++++++--------
 js/src/methodjit/Retcon.cpp     | 18 ++++++++++++++++--
 7 files changed, 43 insertions(+), 18 deletions(-)

diff --git a/js/src/jsinfer.cpp b/js/src/jsinfer.cpp
index d185c0524eea..40029ac4b55b 100644
--- a/js/src/jsinfer.cpp
+++ b/js/src/jsinfer.cpp
@@ -1891,10 +1891,8 @@ TypeCompartment::init(JSContext *cx)
 {
     PodZero(this);
 
-#ifndef JS_CPU_ARM
     if (cx && cx->getRunOptions() & JSOPTION_TYPE_INFERENCE)
         inferenceEnabled = true;
-#endif
 }
 
 TypeObject *
diff --git a/js/src/methodjit/BaseCompiler.h b/js/src/methodjit/BaseCompiler.h
index 291b6444d0be..245f81472706 100644
--- a/js/src/methodjit/BaseCompiler.h
+++ b/js/src/methodjit/BaseCompiler.h
@@ -281,13 +281,13 @@ class AutoReserveICSpace {
     }
 };
 
-# define RESERVE_IC_SPACE(__masm)       AutoReserveICSpace<128> arics(__masm)
+# define RESERVE_IC_SPACE(__masm)       AutoReserveICSpace<256> arics(__masm)
 # define CHECK_IC_SPACE()               arics.check()
 
 /* The OOL path can need a lot of space because we save and restore a lot of registers. The actual
  * sequene varies. However, dumping the literal pool before an OOL block is probably a good idea
  * anyway, as we branch directly to the start of the block from the fast path. */
-# define RESERVE_OOL_SPACE(__masm)      AutoReserveICSpace<256> arics_ool(__masm)
+# define RESERVE_OOL_SPACE(__masm)      AutoReserveICSpace<2048> arics_ool(__masm)
 
 /* Allow the OOL patch to be checked before object destruction. Often, non-patchable epilogues or
  * rejoining sequences are emitted, and it isn't necessary to protect these from literal pools. */
diff --git a/js/src/methodjit/Compiler.cpp b/js/src/methodjit/Compiler.cpp
index f1faec211501..ee216056ad74 100644
--- a/js/src/methodjit/Compiler.cpp
+++ b/js/src/methodjit/Compiler.cpp
@@ -4506,6 +4506,8 @@ mjit::Compiler::jsop_getprop(JSAtom *atom, JSValueType knownType,
     labels.setInlineShapeJump(masm, pic.shapeGuard, inlineShapeJump);
 #endif
 
+    CHECK_IC_SPACE();
+
     pic.objReg = objReg;
     frame.pushRegs(shapeReg, objReg, knownType);
     BarrierState barrier = testBarrier(pic.shapeReg, pic.objReg, false, false,
@@ -4624,6 +4626,8 @@ mjit::Compiler::jsop_callprop_generic(JSAtom *atom)
     labels.setInlineShapeJump(masm, pic.shapeGuard, inlineShapeJump);
 #endif
 
+    CHECK_IC_SPACE();
+
     /* Adjust the frame. */
     frame.pop();
     frame.pushRegs(shapeReg, objReg, knownPushedType(0));
@@ -4761,6 +4765,8 @@ mjit::Compiler::jsop_callprop_obj(JSAtom *atom)
     pic.fastPathRejoin = masm.label();
     pic.objReg = objReg;
 
+    CHECK_IC_SPACE();
+
     /*
      * 1) Dup the |this| object.
      * 2) Store the property value below the |this| value.
@@ -5345,6 +5351,8 @@ mjit::Compiler::jsop_name(JSAtom *atom, JSValueType type, bool isCall)
     ScopeNameLabels &labels = pic.scopeNameLabels();
     labels.setInlineJump(masm, pic.fastPathStart, inlineJump);
 
+    CHECK_IC_SPACE();
+
     /*
      * We can't optimize away the PIC for the NAME access itself, but if we've
      * only seen a single value pushed by this access, mark it as such and
@@ -5433,6 +5441,8 @@ mjit::Compiler::jsop_xname(JSAtom *atom)
     ScopeNameLabels &labels = pic.scopeNameLabels();
     labels.setInlineJumpOffset(masm.differenceBetween(pic.fastPathStart, inlineJump));
 
+    CHECK_IC_SPACE();
+
     frame.pop();
     frame.pushRegs(pic.shapeReg, pic.objReg, knownPushedType(0));
 
@@ -6019,6 +6029,8 @@ mjit::Compiler::jsop_getgname(uint32 index)
 
     ic.load = masm.loadValueWithAddressOffsetPatch(address, treg, dreg);
 
+    CHECK_IC_SPACE();
+
     frame.pushRegs(treg, dreg, type);
 
     /*
diff --git a/js/src/methodjit/FastOps.cpp b/js/src/methodjit/FastOps.cpp
index 8b62c5b5b830..2505f6e3989b 100644
--- a/js/src/methodjit/FastOps.cpp
+++ b/js/src/methodjit/FastOps.cpp
@@ -2151,6 +2151,8 @@ mjit::Compiler::jsop_getelem(bool isCall)
 
     ic.fastPathRejoin = masm.label();
 
+    CHECK_IC_SPACE();
+
     frame.popn(2);
     frame.pushRegs(ic.typeReg, ic.objReg, knownPushedType(0));
     BarrierState barrier = testBarrier(ic.typeReg, ic.objReg, false);
diff --git a/js/src/methodjit/MachineRegs.h b/js/src/methodjit/MachineRegs.h
index eade312f9f55..26282cfe21b5 100644
--- a/js/src/methodjit/MachineRegs.h
+++ b/js/src/methodjit/MachineRegs.h
@@ -118,7 +118,7 @@ struct Registers {
 #elif defined(JS_CPU_X64)
     static const RegisterID JSFrameReg = JSC::X86Registers::ebx;
 #elif defined(JS_CPU_ARM)
-    static const RegisterID JSFrameReg = JSC::ARMRegisters::r11;
+    static const RegisterID JSFrameReg = JSC::ARMRegisters::r10;
 #elif defined(JS_CPU_SPARC)
     static const RegisterID JSFrameReg = JSC::SparcRegisters::l0;
 #endif
@@ -225,9 +225,8 @@ struct Registers {
         | (1 << JSC::ARMRegisters::r6)
         | (1 << JSC::ARMRegisters::r7)
     // r8 is reserved as a scratch register for the assembler.
-        | (1 << JSC::ARMRegisters::r9)
-        | (1 << JSC::ARMRegisters::r10);
-    // r11 is reserved for JSFrameReg.
+        | (1 << JSC::ARMRegisters::r9);
+    // r10 is reserved for JSFrameReg.
     // r13 is SP and must always point to VMFrame whilst in generated code.
     // r14 is LR and is used for return sequences.
     // r15 is PC (program counter).
diff --git a/js/src/methodjit/MethodJIT.cpp b/js/src/methodjit/MethodJIT.cpp
index 9f54e07b7c21..0649fe17f2c0 100644
--- a/js/src/methodjit/MethodJIT.cpp
+++ b/js/src/methodjit/MethodJIT.cpp
@@ -482,7 +482,7 @@ JS_STATIC_ASSERT(VMFrame::offsetOfFp ==                 (4*7));
 JS_STATIC_ASSERT(offsetof(VMFrame, scratch) ==          (4*3));
 JS_STATIC_ASSERT(offsetof(VMFrame, previous) ==         (4*2));
 
-JS_STATIC_ASSERT(JSFrameReg == JSC::ARMRegisters::r11);
+JS_STATIC_ASSERT(JSFrameReg == JSC::ARMRegisters::r10);
 JS_STATIC_ASSERT(JSReturnReg_Type == JSC::ARMRegisters::r5);
 JS_STATIC_ASSERT(JSReturnReg_Data == JSC::ARMRegisters::r4);
 
@@ -547,8 +547,8 @@ SYMBOL_STRING(JaegerTrampoline) ":"         "\n"
 
     /* Preserve 'code' (r2) in an arbitrary callee-saved register. */
 "   mov     r4, r2"                             "\n"
-    /* Preserve 'fp' (r1) in r11 (JSFrameReg). */
-"   mov     r11, r1"                            "\n"
+    /* Preserve 'fp' (r1) in r10 (JSFrameReg). */
+"   mov     r10, r1"                            "\n"
 
 "   mov     r0, sp"                             "\n"
 "   blx  " SYMBOL_STRING_VMFRAME(SetVMFrameRegs)   "\n"
@@ -564,7 +564,7 @@ asm (
 FUNCTION_HEADER_EXTRA
 ".globl " SYMBOL_STRING(JaegerTrampolineReturn)   "\n"
 SYMBOL_STRING(JaegerTrampolineReturn) ":"         "\n"
-"   strd    r4, r5, [r11, #24]"             "\n" /* fp->rval type,data */
+"   strd    r4, r5, [r10, #24]"             "\n" /* fp->rval type,data */
 
     /* Tidy up. */
 "   mov     r0, sp"                         "\n"
@@ -610,8 +610,8 @@ FUNCTION_HEADER_EXTRA
 SYMBOL_STRING(JaegerInterpolineScripted) ":"        "\n"
     /* The only difference between JaegerInterpoline and JaegerInpolineScripted is that the
      * scripted variant has to walk up to the previous StackFrame first. */
-"   ldr     r11, [r11, #(4*4)]"             "\n"    /* Load f->prev_ */
-"   str     r11, [sp, #(4*7)]"              "\n"    /* Update f->regs->fp_ */
+"   ldr     r10, [r10, #(4*4)]"             "\n"    /* Load f->prev_ */
+"   str     r10, [sp, #(4*7)]"              "\n"    /* Update f->regs->fp_ */
     /* Fall through into JaegerInterpoline. */
 
 FUNCTION_HEADER_EXTRA
@@ -623,8 +623,8 @@ SYMBOL_STRING(JaegerInterpoline) ":"        "\n"
 "   mov     r0, r4"                         "\n"    /* returnData */
 "   blx  " SYMBOL_STRING_RELOC(js_InternalInterpret) "\n"
 "   cmp     r0, #0"                         "\n"
-"   ldr     ip, [sp, #(4*7)]"               "\n"    /* Load (StackFrame*)f->regs->fp_ */
-"   ldrd    r4, r5, [ip, #(4*6)]"           "\n"    /* Load rval payload and type. */
+"   ldr     r10, [sp, #(4*7)]"              "\n"    /* Load (StackFrame*)f->regs->fp_ */
+"   ldrd    r4, r5, [r10, #(4*6)]"          "\n"    /* Load rval payload and type. */
 "   ldr     r1, [sp, #(4*3)]"               "\n"    /* Load scratch. */
 "   it      ne"                             "\n"
 "   bxne    r0"                             "\n"
diff --git a/js/src/methodjit/Retcon.cpp b/js/src/methodjit/Retcon.cpp
index b2391246eaf6..819a19304811 100644
--- a/js/src/methodjit/Retcon.cpp
+++ b/js/src/methodjit/Retcon.cpp
@@ -101,6 +101,20 @@ SetRejoinState(StackFrame *fp, const CallSite &site, void **location)
     }
 }
 
+static inline bool
+CallsiteMatches(uint8 *codeStart, const CallSite &site, void *location)
+{
+    if (codeStart + site.codeOffset == location)
+        return true;
+
+#ifdef JS_CPU_ARM
+    if (codeStart + site.codeOffset + 4 == location)
+        return true;
+#endif
+
+    return false;
+}
+
 void
 Recompiler::patchCall(JITScript *jit, StackFrame *fp, void **location)
 {
@@ -108,7 +122,7 @@ Recompiler::patchCall(JITScript *jit, StackFrame *fp, void **location)
 
     CallSite *callSites_ = jit->callSites();
     for (uint32 i = 0; i < jit->nCallSites; i++) {
-        if (callSites_[i].codeOffset + codeStart == *location) {
+        if (CallsiteMatches(codeStart, callSites_[i], *location)) {
             JS_ASSERT(callSites_[i].inlineIndex == analyze::CrossScriptSSA::OUTER_FRAME);
             SetRejoinState(fp, callSites_[i], location);
             return;
@@ -297,7 +311,7 @@ Recompiler::expandInlineFrames(JSCompartment *compartment,
         *frameAddr = JS_FUNC_TO_DATA_PTR(void *, JaegerInterpoline);
         f->stubRejoin = 0;
     }
-    if (*frameAddr == codeStart + inlined->codeOffset) {
+    if (CallsiteMatches(codeStart, *inlined, *frameAddr)) {
         /* The VMFrame returns directly into the expanded frame. */
         SetRejoinState(innerfp, *inlined, frameAddr);
     }

From c285a9e1fd90b6eba329b3204e91dd9fe45be2f0 Mon Sep 17 00:00:00 2001
From: Brian Hackett <bhackett1024@gmail.com>
Date: Fri, 9 Sep 2011 21:55:57 +0200
Subject: [PATCH 085/209] [INFER] Always maintain a synced interpreter stack
 for method JIT stub calls, bug 685358.

---
 js/src/jscompartment.cpp        |  77 +++------------
 js/src/jscompartment.h          |   2 +-
 js/src/jsgc.cpp                 |  28 ++----
 js/src/jsgcmark.cpp             |   7 --
 js/src/methodjit/Compiler.cpp   |  15 ---
 js/src/methodjit/Compiler.h     |   1 -
 js/src/methodjit/FrameState.cpp |  14 +--
 js/src/methodjit/MethodJIT.cpp  |  25 +----
 js/src/methodjit/MethodJIT.h    |   7 --
 js/src/methodjit/MonoIC.cpp     | 163 --------------------------------
 js/src/methodjit/MonoIC.h       |   3 -
 js/src/methodjit/PolyIC.cpp     |  52 ----------
 js/src/methodjit/PolyIC.h       |   1 -
 13 files changed, 24 insertions(+), 371 deletions(-)

diff --git a/js/src/jscompartment.cpp b/js/src/jscompartment.cpp
index 51a407988d48..2ab0c9c78de9 100644
--- a/js/src/jscompartment.cpp
+++ b/js/src/jscompartment.cpp
@@ -506,7 +506,7 @@ JSCompartment::markTypes(JSTracer *trc)
 }
 
 void
-JSCompartment::sweep(JSContext *cx, uint32 releaseInterval)
+JSCompartment::sweep(JSContext *cx, bool releaseTypes)
 {
     /* Remove dead wrappers from the table. */
     for (WrapperMap::Enum e(crossCompartmentWrappers); !e.empty(); e.popFront()) {
@@ -545,49 +545,8 @@ JSCompartment::sweep(JSContext *cx, uint32 releaseInterval)
         traceMonitor()->sweep(cx);
 #endif
 
-# if defined JS_METHODJIT && defined JS_POLYIC
-    /*
-     * Purge all PICs in the compartment. These can reference type data and
-     * need to know which types are pending collection.
-     */
-    for (CellIterUnderGC i(this, FINALIZE_SCRIPT); !i.done(); i.next()) {
-        JSScript *script = i.get<JSScript>();
-        if (script->hasJITCode())
-            mjit::ic::PurgePICs(cx, script);
-    }
-# endif
-
-    bool discardScripts = !active && (releaseInterval != 0 || hasDebugModeCodeToDrop);
-
-#if defined JS_METHODJIT && defined JS_MONOIC
-
-    /*
-     * The release interval is the frequency with which we should try to destroy
-     * executable pools by releasing all JIT code in them, zero to never destroy pools.
-     * Initialize counter so that the first pool will be destroyed, and eventually drive
-     * the amount of JIT code in never-used compartments to zero. Don't discard anything
-     * for compartments which currently have active stack frames.
-     */
-    uint32 counter = 1;
-    if (discardScripts)
-        hasDebugModeCodeToDrop = false;
-
-    for (CellIterUnderGC i(this, FINALIZE_SCRIPT); !i.done(); i.next()) {
-        JSScript *script = i.get<JSScript>();
-        if (script->hasJITCode()) {
-            mjit::ic::SweepCallICs(cx, script, discardScripts);
-            if (discardScripts) {
-                ScriptTryDestroyCode(cx, script, true, releaseInterval, counter);
-                ScriptTryDestroyCode(cx, script, false, releaseInterval, counter);
-            }
-        }
-    }
-
-#endif
-
 #ifdef JS_METHODJIT
-    if (types.inferenceEnabled)
-        mjit::ClearAllFrames(this);
+    mjit::ClearAllFrames(this);
 #endif
 
     if (activeAnalysis) {
@@ -597,11 +556,9 @@ JSCompartment::sweep(JSContext *cx, uint32 releaseInterval)
          * GC then shape numbers baked into the code may change.
          */
 #ifdef JS_METHODJIT
-        if (types.inferenceEnabled) {
-            for (CellIterUnderGC i(this, FINALIZE_SCRIPT); !i.done(); i.next()) {
-                JSScript *script = i.get<JSScript>();
-                mjit::ReleaseScriptCode(cx, script);
-            }
+        for (CellIterUnderGC i(this, FINALIZE_SCRIPT); !i.done(); i.next()) {
+            JSScript *script = i.get<JSScript>();
+            mjit::ReleaseScriptCode(cx, script);
         }
 #endif
     } else {
@@ -618,17 +575,19 @@ JSCompartment::sweep(JSContext *cx, uint32 releaseInterval)
          * enabled in the compartment.
          */
         if (types.inferenceEnabled) {
+            if (active)
+                releaseTypes = false;
             for (CellIterUnderGC i(this, FINALIZE_SCRIPT); !i.done(); i.next()) {
                 JSScript *script = i.get<JSScript>();
                 if (script->types) {
                     types::TypeScript::Sweep(cx, script);
 
                     /*
-                     * On each 1/8 lifetime, release observed types for all scripts.
-                     * This is always safe to do when there are no frames for the
-                     * compartment on the stack.
+                     * Periodically release observed types for all scripts.
+                     * This is always safe to do when there are no frames for
+                     * the compartment on the stack.
                      */
-                    if (discardScripts) {
+                    if (releaseTypes) {
                         script->types->destroy();
                         script->types = NULL;
                         script->typesPurged = true;
@@ -684,20 +643,6 @@ JSCompartment::purge(JSContext *cx)
         if (hasTraceMonitor())
             traceMonitor()->needFlush = JS_TRUE;
 #endif
-
-#if defined JS_METHODJIT && defined JS_MONOIC
-    /*
-     * MICs do not refer to data which can be GC'ed and do not generate stubs
-     * which might need to be discarded, but are sensitive to shape regeneration.
-     */
-    if (cx->runtime->gcRegenShapes) {
-        for (CellIterUnderGC i(this, FINALIZE_SCRIPT); !i.done(); i.next()) {
-            JSScript *script = i.get<JSScript>();
-            if (script->hasJITCode())
-                mjit::ic::PurgeMICs(cx, script);
-        }
-    }
-#endif
 }
 
 MathCache *
diff --git a/js/src/jscompartment.h b/js/src/jscompartment.h
index cfd240ac3969..32398e426165 100644
--- a/js/src/jscompartment.h
+++ b/js/src/jscompartment.h
@@ -532,7 +532,7 @@ struct JS_FRIEND_API(JSCompartment) {
     bool wrap(JSContext *cx, js::AutoIdVector &props);
 
     void markTypes(JSTracer *trc);
-    void sweep(JSContext *cx, uint32 releaseInterval);
+    void sweep(JSContext *cx, bool releaseTypes);
     void purge(JSContext *cx);
 
     void setGCLastBytes(size_t lastBytes, JSGCInvocationKind gckind);
diff --git a/js/src/jsgc.cpp b/js/src/jsgc.cpp
index 57ac9b0f38e3..3d9ca3fa6291 100644
--- a/js/src/jsgc.cpp
+++ b/js/src/jsgc.cpp
@@ -646,12 +646,8 @@ js_GCThingIsMarked(void *thing, uintN color = BLACK)
     return reinterpret_cast<Cell *>(thing)->isMarked(color);
 }
 
-/*
- * 1/8 life for JIT code. After this number of microseconds have passed, 1/8 of all
- * JIT code is discarded in inactive compartments, regardless of how often that
- * code runs.
- */
-static const int64 JIT_SCRIPT_EIGHTH_LIFETIME = 60 * 1000 * 1000;
+/* Lifetime for type sets attached to scripts containing observed types. */
+static const int64 JIT_SCRIPT_RELEASE_TYPES_INTERVAL = 60 * 1000 * 1000;
 
 JSBool
 js_InitGC(JSRuntime *rt, uint32 maxbytes)
@@ -693,7 +689,7 @@ js_InitGC(JSRuntime *rt, uint32 maxbytes)
      */
     rt->setGCLastBytes(8192, GC_NORMAL);
 
-    rt->gcJitReleaseTime = PRMJ_Now() + JIT_SCRIPT_EIGHTH_LIFETIME;
+    rt->gcJitReleaseTime = PRMJ_Now() + JIT_SCRIPT_RELEASE_TYPES_INTERVAL;
     return true;
 }
 
@@ -2127,20 +2123,12 @@ static void
 SweepCrossCompartmentWrappers(JSContext *cx)
 {
     JSRuntime *rt = cx->runtime;
-    /*
-     * Figure out how much JIT code should be released from inactive compartments.
-     * If multiple eighth-lives have passed, compound the release interval linearly;
-     * if enough time has passed, all inactive JIT code will be released.
-     */
-    uint32 releaseInterval = 0;
+
+    bool releaseTypes = false;
     int64 now = PRMJ_Now();
     if (now >= rt->gcJitReleaseTime) {
-        releaseInterval = 8;
-        while (now >= rt->gcJitReleaseTime) {
-            if (--releaseInterval == 1)
-                rt->gcJitReleaseTime = now;
-            rt->gcJitReleaseTime += JIT_SCRIPT_EIGHTH_LIFETIME;
-        }
+        releaseTypes = true;
+        rt->gcJitReleaseTime = now + JIT_SCRIPT_RELEASE_TYPES_INTERVAL;
     }
 
     /*
@@ -2151,7 +2139,7 @@ SweepCrossCompartmentWrappers(JSContext *cx)
      * (4) Sweep the method JIT ICs and release infrequently used JIT code.
      */
     for (JSCompartment **c = rt->compartments.begin(); c != rt->compartments.end(); ++c)
-        (*c)->sweep(cx, releaseInterval);
+        (*c)->sweep(cx, releaseTypes);
 }
 
 static void
diff --git a/js/src/jsgcmark.cpp b/js/src/jsgcmark.cpp
index ef7acfaf0caa..c118112205b1 100644
--- a/js/src/jsgcmark.cpp
+++ b/js/src/jsgcmark.cpp
@@ -859,13 +859,6 @@ MarkChildren(JSTracer *trc, JSScript *script)
 
     if (script->types)
         script->types->trace(trc);
-
-#ifdef JS_METHODJIT
-    if (script->jitNormal)
-        script->jitNormal->trace(trc);
-    if (script->jitCtor)
-        script->jitCtor->trace(trc);
-#endif
 }
 
 void
diff --git a/js/src/methodjit/Compiler.cpp b/js/src/methodjit/Compiler.cpp
index ee216056ad74..741046dafdc0 100644
--- a/js/src/methodjit/Compiler.cpp
+++ b/js/src/methodjit/Compiler.cpp
@@ -122,7 +122,6 @@ mjit::Compiler::Compiler(JSContext *cx, JSScript *outerScript, bool isConstructi
     jumpTables(CompilerAllocPolicy(cx, *thisFromCtor())),
     jumpTableOffsets(CompilerAllocPolicy(cx, *thisFromCtor())),
     loopEntries(CompilerAllocPolicy(cx, *thisFromCtor())),
-    rootedObjects(CompilerAllocPolicy(cx, *thisFromCtor())),
     stubcc(cx, *thisFromCtor(), frame),
     debugMode_(cx->compartment->debugMode()),
 #if defined JS_TRACER
@@ -942,7 +941,6 @@ mjit::Compiler::finishThisUp(JITScript **jitp)
                       sizeof(NativeMapEntry) * nNmapLive +
                       sizeof(InlineFrame) * inlineFrames.length() +
                       sizeof(CallSite) * callSites.length() +
-                      sizeof(JSObject *) * rootedObjects.length() +
 #if defined JS_MONOIC
                       sizeof(ic::GetGlobalNameIC) * getGlobalNames.length() +
                       sizeof(ic::SetGlobalNameIC) * setGlobalNames.length() +
@@ -1074,13 +1072,6 @@ mjit::Compiler::finishThisUp(JITScript **jitp)
             stubCode.patch(from.loopPatch.codePatch, result + codeOffset);
     }
 
-    /* Build the list of objects rooted by the script. */
-    JSObject **jitRooted = (JSObject **)cursor;
-    jit->nRootedObjects = rootedObjects.length();
-    cursor += sizeof(JSObject *) * jit->nRootedObjects;
-    for (size_t i = 0; i < jit->nRootedObjects; i++)
-        jitRooted[i] = rootedObjects[i];
-
 #if defined JS_MONOIC
     JS_INIT_CLIST(&jit->callers);
 
@@ -4661,12 +4652,6 @@ mjit::Compiler::jsop_callprop_str(JSAtom *atom)
     if (!js_GetClassPrototype(cx, globalObj, JSProto_String, &obj))
         return false;
 
-    /*
-     * Root the proto, since JS_ClearScope might overwrite the global object's
-     * copy.
-     */
-    rootedObjects.append(obj);
-
     /* Force into a register because getprop won't expect a constant. */
     RegisterID reg = frame.allocReg();
 
diff --git a/js/src/methodjit/Compiler.h b/js/src/methodjit/Compiler.h
index c59cd863099a..d49cc9c965a2 100644
--- a/js/src/methodjit/Compiler.h
+++ b/js/src/methodjit/Compiler.h
@@ -455,7 +455,6 @@ class Compiler : public BaseCompiler
     js::Vector<JumpTable, 16> jumpTables;
     js::Vector<uint32, 16> jumpTableOffsets;
     js::Vector<LoopEntry, 16> loopEntries;
-    js::Vector<JSObject *, 0, CompilerAllocPolicy> rootedObjects;
     StubCompiler stubcc;
     Label invokeLabel;
     Label arityLabel;
diff --git a/js/src/methodjit/FrameState.cpp b/js/src/methodjit/FrameState.cpp
index 372b5affcf8d..1a83e3f8b53b 100644
--- a/js/src/methodjit/FrameState.cpp
+++ b/js/src/methodjit/FrameState.cpp
@@ -1324,11 +1324,7 @@ FrameState::sync(Assembler &masm, Uses uses) const
     Registers avail(freeRegs.freeMask & Registers::AvailRegs);
     Registers temp(Registers::TempAnyRegs);
 
-    FrameEntry *bottom = (cx->typeInferenceEnabled() || cx->compartment->debugMode())
-        ? entries
-        : a->sp - uses.nuses;
-
-    for (FrameEntry *fe = a->sp - 1; fe >= bottom; fe--) {
+    for (FrameEntry *fe = a->sp - 1; fe >= entries; fe--) {
         if (!fe->isTracked())
             continue;
 
@@ -1378,7 +1374,7 @@ FrameState::sync(Assembler &masm, Uses uses) const
             /* Fall back to a slower sync algorithm if load required. */
             if ((!fe->type.synced() && backing->type.inMemory()) ||
                 (!fe->data.synced() && backing->data.inMemory())) {
-                syncFancy(masm, avail, fe, bottom);
+                syncFancy(masm, avail, fe, entries);
                 return;
             }
 #endif
@@ -1459,11 +1455,7 @@ FrameState::syncAndKill(Registers kill, Uses uses, Uses ignore)
 
     uint32 maxvisits = tracker.nentries;
 
-    FrameEntry *bottom = (cx->typeInferenceEnabled() || cx->compartment->debugMode())
-        ? entries
-        : a->sp - uses.nuses;
-
-    for (FrameEntry *fe = a->sp - 1; fe >= bottom && maxvisits; fe--) {
+    for (FrameEntry *fe = a->sp - 1; fe >= entries && maxvisits; fe--) {
         if (!fe->isTracked())
             continue;
 
diff --git a/js/src/methodjit/MethodJIT.cpp b/js/src/methodjit/MethodJIT.cpp
index 0649fe17f2c0..40d9e5b0d803 100644
--- a/js/src/methodjit/MethodJIT.cpp
+++ b/js/src/methodjit/MethodJIT.cpp
@@ -990,16 +990,10 @@ JITScript::callSites() const
     return (js::mjit::CallSite *)&inlineFrames()[nInlineFrames];
 }
 
-JSObject **
-JITScript::rootedObjects() const
-{
-    return (JSObject **)&callSites()[nCallSites];
-}
-
 char *
 JITScript::commonSectionLimit() const
 {
-    return (char *)&rootedObjects()[nRootedObjects];
+    return (char *)&callSites()[nCallSites];
 }
 
 #ifdef JS_MONOIC
@@ -1164,7 +1158,6 @@ mjit::JITScript::scriptDataSize(JSUsableSizeFun usf)
         sizeof(NativeMapEntry) * nNmapPairs +
         sizeof(InlineFrame) * nInlineFrames +
         sizeof(CallSite) * nCallSites +
-        sizeof(JSObject *) * nRootedObjects +
 #if defined JS_MONOIC
         sizeof(ic::GetGlobalNameIC) * nGetGlobalNames +
         sizeof(ic::SetGlobalNameIC) * nSetGlobalNames +
@@ -1304,20 +1297,4 @@ mjit::NativeToPC(JITScript *jit, void *ncode, mjit::CallSite **pinline)
     return jit->nativeToPC(ncode, pinline);
 }
 
-void
-JITScript::trace(JSTracer *trc)
-{
-    /*
-     * MICs and PICs attached to the JITScript are weak references, and either
-     * entirely purged or selectively purged on each GC. We do, however, need
-     * to maintain references to any scripts whose code was inlined into this.
-     */
-    InlineFrame *inlineFrames_ = inlineFrames();
-    for (unsigned i = 0; i < nInlineFrames; i++)
-        MarkObject(trc, *inlineFrames_[i].fun, "jitscript_fun");
-
-    for (uint32 i = 0; i < nRootedObjects; ++i)
-        MarkObject(trc, *rootedObjects()[i], "mjit rooted object");
-}
-
 /* static */ const double mjit::Assembler::oneDouble = 1.0;
diff --git a/js/src/methodjit/MethodJIT.h b/js/src/methodjit/MethodJIT.h
index bc356f3feccd..e3e22dc6a257 100644
--- a/js/src/methodjit/MethodJIT.h
+++ b/js/src/methodjit/MethodJIT.h
@@ -605,7 +605,6 @@ struct JITScript {
     bool            singleStepMode:1;   /* compiled in "single step mode" */
     uint32          nInlineFrames;
     uint32          nCallSites;
-    uint32          nRootedObjects;
 #ifdef JS_MONOIC
     uint32          nGetGlobalNames;
     uint32          nSetGlobalNames;
@@ -643,7 +642,6 @@ struct JITScript {
     NativeMapEntry *nmap() const;
     js::mjit::InlineFrame *inlineFrames() const;
     js::mjit::CallSite *callSites() const;
-    JSObject **rootedObjects() const;
 #ifdef JS_MONOIC
     ic::GetGlobalNameIC *getGlobalNames() const;
     ic::SetGlobalNameIC *setGlobalNames() const;
@@ -666,11 +664,6 @@ struct JITScript {
     }
 
     void nukeScriptDependentICs();
-    void sweepCallICs(JSContext *cx, bool purgeAll);
-    void purgeMICs();
-    void purgePICs();
-
-    void trace(JSTracer *trc);
 
     /* |usf| can be NULL here, in which case the fallback size computation will be used. */
     size_t scriptDataSize(JSUsableSizeFun usf);
diff --git a/js/src/methodjit/MonoIC.cpp b/js/src/methodjit/MonoIC.cpp
index 1a4d11445da8..89d41c945c0f 100644
--- a/js/src/methodjit/MonoIC.cpp
+++ b/js/src/methodjit/MonoIC.cpp
@@ -1383,168 +1383,5 @@ JITScript::resetArgsCheck()
     repatch.relink(argsCheckJump, argsCheckStub);
 }
 
-void
-JITScript::purgeMICs()
-{
-    if (!nGetGlobalNames || !nSetGlobalNames)
-        return;
-
-    Repatcher repatch(this);
-
-    ic::GetGlobalNameIC *getGlobalNames_ = getGlobalNames();
-    for (uint32 i = 0; i < nGetGlobalNames; i++) {
-        ic::GetGlobalNameIC &ic = getGlobalNames_[i];
-        JSC::CodeLocationDataLabel32 label = ic.fastPathStart.dataLabel32AtOffset(ic.shapeOffset);
-        repatch.repatch(label, int(INVALID_SHAPE));
-    }
-
-    ic::SetGlobalNameIC *setGlobalNames_ = setGlobalNames();
-    for (uint32 i = 0; i < nSetGlobalNames; i++) {
-        ic::SetGlobalNameIC &ic = setGlobalNames_[i];
-        ic.patchInlineShapeGuard(repatch, int32(INVALID_SHAPE));
-
-        if (ic.hasExtraStub) {
-            Repatcher repatcher(ic.extraStub);
-            ic.patchExtraShapeGuard(repatcher, int32(INVALID_SHAPE));
-        }
-    }
-}
-
-void
-ic::PurgeMICs(JSContext *cx, JSScript *script)
-{
-    /* MICs are purged during GC to handle changing shapes. */
-    JS_ASSERT(cx->runtime->gcRegenShapes);
-
-    if (script->jitNormal)
-        script->jitNormal->purgeMICs();
-    if (script->jitCtor)
-        script->jitCtor->purgeMICs();
-}
-
-void
-JITScript::nukeScriptDependentICs()
-{
-    if (!nCallICs)
-        return;
-
-    Repatcher repatcher(this);
-
-    ic::CallICInfo *callICs_ = callICs();
-    for (uint32 i = 0; i < nCallICs; i++) {
-        ic::CallICInfo &ic = callICs_[i];
-        if (!ic.fastGuardedObject)
-            continue;
-        repatcher.repatch(ic.funGuard, NULL);
-        repatcher.relink(ic.funJump, ic.slowPathStart);
-        ic.releasePool(CallICInfo::Pool_ClosureStub);
-        ic.fastGuardedObject = NULL;
-        ic.hasJsFunCheck = false;
-    }
-}
-
-void
-JITScript::sweepCallICs(JSContext *cx, bool purgeAll)
-{
-    Repatcher repatcher(this);
-
-    /*
-     * If purgeAll is set, purge stubs in the script except those covered by PurgePICs
-     * (which is always called during GC). We want to remove references which can keep
-     * alive pools that we are trying to destroy (see JSCompartment::sweep).
-     */
-
-    ic::CallICInfo *callICs_ = callICs();
-    for (uint32 i = 0; i < nCallICs; i++) {
-        ic::CallICInfo &ic = callICs_[i];
-
-        /*
-         * If the object is unreachable, we're guaranteed not to be currently
-         * executing a stub generated by a guard on that object. This lets us
-         * precisely GC call ICs while keeping the identity guard safe.
-         */
-        bool fastFunDead = ic.fastGuardedObject &&
-            (purgeAll || IsAboutToBeFinalized(cx, ic.fastGuardedObject));
-        bool nativeDead = ic.fastGuardedNative &&
-            (purgeAll || IsAboutToBeFinalized(cx, ic.fastGuardedNative));
-
-        /*
-         * There are three conditions where we need to relink:
-         * (1) purgeAll is true.
-         * (2) The native is dead, since it always has a stub.
-         * (3) The fastFun is dead *and* there is a closure stub.
-         *
-         * Note although both objects can be non-NULL, there can only be one
-         * of [closure, native] stub per call IC.
-         */
-        if (purgeAll || nativeDead || (fastFunDead && ic.hasJsFunCheck)) {
-            repatcher.relink(ic.funJump, ic.slowPathStart);
-            ic.hit = false;
-        }
-
-        if (fastFunDead) {
-            repatcher.repatch(ic.funGuard, NULL);
-            ic.purgeGuardedObject();
-        }
-
-        if (nativeDead)
-            ic.fastGuardedNative = NULL;
-
-        if (purgeAll) {
-            ic.releasePool(CallICInfo::Pool_ScriptStub);
-            JSC::CodeLocationJump oolJump = ic.slowPathStart.jumpAtOffset(ic.oolJumpOffset);
-            JSC::CodeLocationLabel icCall = ic.slowPathStart.labelAtOffset(ic.icCallOffset);
-            repatcher.relink(oolJump, icCall);
-        }
-    }
-
-    /* The arguments type check IC can refer to type objects which might be swept. */
-    if (argsCheckPool)
-        resetArgsCheck();
-
-    if (purgeAll) {
-        /* Purge ICs generating stubs into execPools. */
-        uint32 released = 0;
-
-        ic::EqualityICInfo *equalityICs_ = equalityICs();
-        for (uint32 i = 0; i < nEqualityICs; i++) {
-            ic::EqualityICInfo &ic = equalityICs_[i];
-            if (!ic.generated)
-                continue;
-
-            JSC::FunctionPtr fptr(JS_FUNC_TO_DATA_PTR(void *, ic::Equality));
-            repatcher.relink(ic.stubCall, fptr);
-            repatcher.relink(ic.jumpToStub, ic.stubEntry);
-
-            ic.generated = false;
-            released++;
-        }
-
-        ic::SetGlobalNameIC *setGlobalNames_ = setGlobalNames();
-        for (uint32 i = 0; i < nSetGlobalNames; i ++) {
-            ic::SetGlobalNameIC &ic = setGlobalNames_[i];
-            if (!ic.hasExtraStub)
-                continue;
-            repatcher.relink(ic.fastPathStart.jumpAtOffset(ic.inlineShapeJump), ic.slowPathStart);
-            ic.hasExtraStub = false;
-            released++;
-        }
-
-        JS_ASSERT(released == execPools.length());
-        for (uint32 i = 0; i < released; i++)
-            execPools[i]->release();
-        execPools.clear();
-    }
-}
-
-void
-ic::SweepCallICs(JSContext *cx, JSScript *script, bool purgeAll)
-{
-    if (script->jitNormal)
-        script->jitNormal->sweepCallICs(cx, purgeAll);
-    if (script->jitCtor)
-        script->jitCtor->sweepCallICs(cx, purgeAll);
-}
-
 #endif /* JS_MONOIC */
 
diff --git a/js/src/methodjit/MonoIC.h b/js/src/methodjit/MonoIC.h
index 0133055968db..982df5459079 100644
--- a/js/src/methodjit/MonoIC.h
+++ b/js/src/methodjit/MonoIC.h
@@ -301,9 +301,6 @@ JSBool JS_FASTCALL SplatApplyArgs(VMFrame &f);
 
 void GenerateArgumentCheckStub(VMFrame &f);
 
-void PurgeMICs(JSContext *cx, JSScript *script);
-void SweepCallICs(JSContext *cx, JSScript *script, bool purgeAll);
-
 } /* namespace ic */
 } /* namespace mjit */
 } /* namespace js */
diff --git a/js/src/methodjit/PolyIC.cpp b/js/src/methodjit/PolyIC.cpp
index 3edec28fd5df..562cb4a32f44 100644
--- a/js/src/methodjit/PolyIC.cpp
+++ b/js/src/methodjit/PolyIC.cpp
@@ -3261,57 +3261,5 @@ ic::SetElement(VMFrame &f, ic::SetElementIC *ic)
 template void JS_FASTCALL ic::SetElement<true>(VMFrame &f, SetElementIC *ic);
 template void JS_FASTCALL ic::SetElement<false>(VMFrame &f, SetElementIC *ic);
 
-void
-JITScript::purgePICs()
-{
-    if (!nPICs && !nGetElems && !nSetElems)
-        return;
-
-    Repatcher repatcher(this);
-
-    ic::PICInfo *pics_ = pics();
-    for (uint32 i = 0; i < nPICs; i++) {
-        ic::PICInfo &pic = pics_[i];
-        switch (pic.kind) {
-          case ic::PICInfo::SET:
-          case ic::PICInfo::SETMETHOD:
-            SetPropCompiler::reset(repatcher, pic);
-            break;
-          case ic::PICInfo::NAME:
-          case ic::PICInfo::XNAME:
-          case ic::PICInfo::CALLNAME:
-            ScopeNameCompiler::reset(repatcher, pic);
-            break;
-          case ic::PICInfo::BIND:
-            BindNameCompiler::reset(repatcher, pic);
-            break;
-          case ic::PICInfo::CALL: /* fall-through */
-          case ic::PICInfo::GET:
-            GetPropCompiler::reset(repatcher, pic);
-            break;
-          default:
-            JS_NOT_REACHED("Unhandled PIC kind");
-            break;
-        }
-        pic.reset();
-    }
-
-    ic::GetElementIC *getElems_ = getElems();
-    ic::SetElementIC *setElems_ = setElems();
-    for (uint32 i = 0; i < nGetElems; i++)
-        getElems_[i].purge(repatcher);
-    for (uint32 i = 0; i < nSetElems; i++)
-        setElems_[i].purge(repatcher);
-}
-
-void
-ic::PurgePICs(JSContext *cx, JSScript *script)
-{
-    if (script->jitNormal)
-        script->jitNormal->purgePICs();
-    if (script->jitCtor)
-        script->jitCtor->purgePICs();
-}
-
 #endif /* JS_POLYIC */
 
diff --git a/js/src/methodjit/PolyIC.h b/js/src/methodjit/PolyIC.h
index 9bf88a478a45..efb73a4de698 100644
--- a/js/src/methodjit/PolyIC.h
+++ b/js/src/methodjit/PolyIC.h
@@ -554,7 +554,6 @@ struct PICInfo : public BasePolyIC {
 };
 
 #ifdef JS_POLYIC
-void PurgePICs(JSContext *cx, JSScript *script);
 void JS_FASTCALL GetProp(VMFrame &f, ic::PICInfo *);
 void JS_FASTCALL GetPropNoCache(VMFrame &f, ic::PICInfo *);
 void JS_FASTCALL SetProp(VMFrame &f, ic::PICInfo *);

From 44b1ac317f8c53b1c22ce071d3ef0cc383454775 Mon Sep 17 00:00:00 2001
From: Brian Hackett <bhackett1024@gmail.com>
Date: Sat, 10 Sep 2011 09:58:41 +0200
Subject: [PATCH 086/209] [INFER] Check result type of property access
 stubcalls in jitcode, bug 686000.

---
 .../jit-test/tests/jaeger/getelem-sanity-8.js | 13 ++++
 js/src/jsanalyze.h                            |  1 +
 js/src/jsinterp.cpp                           |  8 +--
 js/src/methodjit/Compiler.cpp                 | 72 +++++++++++++++++--
 js/src/methodjit/Compiler.h                   |  6 +-
 js/src/methodjit/FastOps.cpp                  |  9 ++-
 js/src/methodjit/InvokeHelpers.cpp            | 14 ++--
 js/src/methodjit/PolyIC.cpp                   | 41 ++---------
 js/src/methodjit/PolyIC.h                     |  4 ++
 js/src/methodjit/StubCalls.cpp                | 48 ++++---------
 js/src/methodjit/StubCalls.h                  |  3 +-
 11 files changed, 131 insertions(+), 88 deletions(-)
 create mode 100644 js/src/jit-test/tests/jaeger/getelem-sanity-8.js

diff --git a/js/src/jit-test/tests/jaeger/getelem-sanity-8.js b/js/src/jit-test/tests/jaeger/getelem-sanity-8.js
new file mode 100644
index 000000000000..f203216ac2cc
--- /dev/null
+++ b/js/src/jit-test/tests/jaeger/getelem-sanity-8.js
@@ -0,0 +1,13 @@
+
+// TI does not account for GETELEM accessing strings, so the GETELEM PIC must
+// update type constraints according to generated stubs.
+function foo(a, b) {
+  for (var j = 0; j < 5; j++)
+    a[b[j]] + " what";
+}
+var a = {a:"zero", b:"one", c:"two", d:"three", e:"four"};
+var b = ["a", "b", "c", "d", "e"];
+foo(a, b);
+foo(a, b);
+a.e = 4;
+foo(a, b);
diff --git a/js/src/jsanalyze.h b/js/src/jsanalyze.h
index 01c1a8ef790f..8b2f6729b60b 100644
--- a/js/src/jsanalyze.h
+++ b/js/src/jsanalyze.h
@@ -145,6 +145,7 @@ class Bytecode
      * hints about the script for use during compilation.
      */
     bool arrayWriteHole: 1;  /* SETELEM which has written to an array hole. */
+    bool getStringElement:1; /* GETELEM which has accessed string properties. */
     bool accessGetter: 1;    /* Property read on a shape with a getter hook. */
 
     /* Stack depth before this opcode. */
diff --git a/js/src/jsinterp.cpp b/js/src/jsinterp.cpp
index 2f0aefce0d99..3eb6d4fd8129 100644
--- a/js/src/jsinterp.cpp
+++ b/js/src/jsinterp.cpp
@@ -3921,13 +3921,13 @@ BEGIN_CASE(JSOP_GETELEM)
         }
     }
 
+    if (JSID_IS_STRING(id) && script->hasAnalysis())
+        script->analysis()->getCode(regs.pc).getStringElement = true;
+
     if (!obj->getProperty(cx, id, &rval))
         goto error;
     copyFrom = &rval;
 
-    if (!JSID_IS_INT(id))
-        TypeScript::MonitorUnknown(cx, script, regs.pc);
-
   end_getelem:
     regs.sp--;
     regs.sp[-1] = *copyFrom;
@@ -3965,8 +3965,6 @@ BEGIN_CASE(JSOP_CALLELEM)
         regs.sp[-1] = thisv;
     }
 
-    if (!JSID_IS_INT(id))
-        TypeScript::MonitorUnknown(cx, script, regs.pc);
     TypeScript::Monitor(cx, script, regs.pc, regs.sp[-2]);
 }
 END_CASE(JSOP_CALLELEM)
diff --git a/js/src/methodjit/Compiler.cpp b/js/src/methodjit/Compiler.cpp
index 741046dafdc0..9a49e8d36908 100644
--- a/js/src/methodjit/Compiler.cpp
+++ b/js/src/methodjit/Compiler.cpp
@@ -4190,6 +4190,7 @@ mjit::Compiler::jsop_getprop_slow(JSAtom *atom, bool usePropCache)
     prepareStubCall(Uses(1));
     if (usePropCache) {
         INLINE_STUBCALL(stubs::GetProp, rejoin);
+        testPushedType(rejoin, -1, /* ool = */ false);
     } else {
         masm.move(ImmPtr(atom), Registers::ArgReg1);
         INLINE_STUBCALL(stubs::GetPropNoCache, rejoin);
@@ -4205,6 +4206,7 @@ mjit::Compiler::jsop_callprop_slow(JSAtom *atom)
     prepareStubCall(Uses(1));
     masm.move(ImmPtr(atom), Registers::ArgReg1);
     INLINE_STUBCALL(stubs::CallProp, REJOIN_FALLTHROUGH);
+    testPushedType(REJOIN_FALLTHROUGH, -1, /* ool = */ false);
     frame.pop();
     pushSyncedEntry(0);
     pushSyncedEntry(1);
@@ -4300,6 +4302,8 @@ mjit::Compiler::jsop_getprop(JSAtom *atom, JSValueType knownType,
                 stubcc.linkExit(notObject, Uses(1));
                 stubcc.leave();
                 OOL_STUBCALL(stubs::GetProp, rejoin);
+                if (rejoin == REJOIN_GETTER)
+                    testPushedType(rejoin, -1);
             }
             RegisterID reg = frame.tempRegForData(top);
             frame.pop();
@@ -4320,6 +4324,8 @@ mjit::Compiler::jsop_getprop(JSAtom *atom, JSValueType knownType,
                 stubcc.linkExit(notObject, Uses(1));
                 stubcc.leave();
                 OOL_STUBCALL(stubs::GetProp, rejoin);
+                if (rejoin == REJOIN_GETTER)
+                    testPushedType(rejoin, -1);
             }
             RegisterID reg = frame.copyDataIntoReg(top);
             frame.pop();
@@ -4382,6 +4388,8 @@ mjit::Compiler::jsop_getprop(JSAtom *atom, JSValueType knownType,
                 stubcc.linkExit(notObject, Uses(1));
                 stubcc.leave();
                 OOL_STUBCALL(stubs::GetProp, rejoin);
+                if (rejoin == REJOIN_GETTER)
+                    testPushedType(rejoin, -1);
             }
             RegisterID reg = frame.tempRegForData(top);
             frame.pop();
@@ -4445,7 +4453,8 @@ mjit::Compiler::jsop_getprop(JSAtom *atom, JSValueType knownType,
      * type barrier if inference is enabled (known property types do not
      * reflect properties with getter hooks).
      */
-    pic.canCallHook = usePropCache && JSOp(*PC) == JSOP_GETPROP && analysis->getCode(PC).accessGetter;
+    pic.canCallHook = pic.forcedTypeBarrier =
+        usePropCache && JSOp(*PC) == JSOP_GETPROP && analysis->getCode(PC).accessGetter;
     if (pic.canCallHook)
         frame.syncAndKillEverything();
 
@@ -4469,6 +4478,8 @@ mjit::Compiler::jsop_getprop(JSAtom *atom, JSValueType knownType,
     passICAddress(&pic);
     pic.slowPathCall = OOL_STUBCALL(usePropCache ? ic::GetProp : ic::GetPropNoCache, rejoin);
     CHECK_OOL_SPACE();
+    if (rejoin == REJOIN_GETTER)
+        testPushedType(rejoin, -1);
 
     /* Load the base slot address. */
     Label dslotsLoadLabel = masm.loadPtrWithPatchToLEA(Address(objReg, offsetof(JSObject, slots)),
@@ -4552,7 +4563,7 @@ mjit::Compiler::jsop_callprop_generic(JSAtom *atom)
     pic.shapeReg = shapeReg;
     pic.atom = atom;
 
-    pic.canCallHook = analysis->getCode(PC).accessGetter;
+    pic.canCallHook = pic.forcedTypeBarrier = analysis->getCode(PC).accessGetter;
     if (pic.canCallHook)
         frame.syncAndKillEverything();
 
@@ -4590,6 +4601,8 @@ mjit::Compiler::jsop_callprop_generic(JSAtom *atom)
     pic.slowPathCall = OOL_STUBCALL(ic::CallProp, REJOIN_FALLTHROUGH);
     CHECK_OOL_SPACE();
 
+    testPushedType(REJOIN_FALLTHROUGH, -1);
+
     /* Load the base slot address. */
     Label dslotsLoadLabel = masm.loadPtrWithPatchToLEA(Address(objReg, offsetof(JSObject, slots)),
                                                                objReg);
@@ -4716,7 +4729,7 @@ mjit::Compiler::jsop_callprop_obj(JSAtom *atom)
         objReg = frame.copyDataIntoReg(top);
     }
 
-    pic.canCallHook = analysis->getCode(PC).accessGetter;
+    pic.canCallHook = pic.forcedTypeBarrier = analysis->getCode(PC).accessGetter;
     if (pic.canCallHook)
         frame.syncAndKillEverything();
 
@@ -4738,6 +4751,8 @@ mjit::Compiler::jsop_callprop_obj(JSAtom *atom)
     pic.slowPathCall = OOL_STUBCALL(ic::CallProp, REJOIN_FALLTHROUGH);
     CHECK_OOL_SPACE();
 
+    testPushedType(REJOIN_FALLTHROUGH, -1);
+
     /* Load the base slot address. */
     Label dslotsLoadLabel = masm.loadPtrWithPatchToLEA(Address(objReg, offsetof(JSObject, slots)),
                                                                objReg);
@@ -5029,6 +5044,7 @@ mjit::Compiler::jsop_callprop_dispatch(JSAtom *atom)
     stubcc.leave();
     stubcc.masm.move(ImmPtr(atom), Registers::ArgReg1);
     OOL_STUBCALL(stubs::CallProp, REJOIN_FALLTHROUGH);
+    testPushedType(REJOIN_FALLTHROUGH, -1);
 
     frame.dup();
     // THIS THIS
@@ -5059,6 +5075,7 @@ mjit::Compiler::jsop_callprop(JSAtom *atom)
             stubcc.leave();
             stubcc.masm.move(ImmPtr(atom), Registers::ArgReg1);
             OOL_STUBCALL(stubs::CallProp, REJOIN_FALLTHROUGH);
+            testPushedType(REJOIN_FALLTHROUGH, -1);
         }
 
         // THIS
@@ -5329,6 +5346,7 @@ mjit::Compiler::jsop_name(JSAtom *atom, JSValueType type, bool isCall)
         passICAddress(&pic);
         pic.slowPathCall = OOL_STUBCALL(isCall ? ic::CallName : ic::Name, rejoin);
         CHECK_OOL_SPACE();
+        testPushedType(rejoin, 0);
     }
     pic.fastPathRejoin = masm.label();
 
@@ -5416,6 +5434,7 @@ mjit::Compiler::jsop_xname(JSAtom *atom)
         passICAddress(&pic);
         pic.slowPathCall = OOL_STUBCALL(ic::XName, REJOIN_GETTER);
         CHECK_OOL_SPACE();
+        testPushedType(REJOIN_GETTER, -1);
     }
 
     pic.fastPathRejoin = masm.label();
@@ -5512,7 +5531,8 @@ void
 mjit::Compiler::jsop_name(JSAtom *atom, JSValueType type, bool isCall)
 {
     prepareStubCall(Uses(0));
-        INLINE_STUBCALL(isCall ? stubs::CallName : stubs::Name, REJOIN_FALLTHROUGH);
+    INLINE_STUBCALL(isCall ? stubs::CallName : stubs::Name, REJOIN_FALLTHROUGH);
+    testPushedType(REJOIN_FALLTHROUGH, 0, /* ool = */ false);
     frame.pushSynced(type);
     if (isCall)
         frame.pushSynced(JSVAL_TYPE_UNKNOWN);
@@ -5888,6 +5908,7 @@ mjit::Compiler::jsop_getgname_slow(uint32 index)
 {
     prepareStubCall(Uses(0));
     INLINE_STUBCALL(stubs::GetGlobalName, REJOIN_GETTER);
+    testPushedType(REJOIN_GETTER, 0, /* ool = */ false);
     frame.pushSynced(JSVAL_TYPE_UNKNOWN);
 }
 
@@ -6001,6 +6022,10 @@ mjit::Compiler::jsop_getgname(uint32 index)
     passMICAddress(ic);
     ic.slowPathCall = OOL_STUBCALL(ic::GetGlobalName, REJOIN_GETTER);
 
+    CHECK_IC_SPACE();
+
+    testPushedType(REJOIN_GETTER, 0);
+
     /* Garbage value. */
     uint32 slot = 1 << 24;
 
@@ -6014,8 +6039,6 @@ mjit::Compiler::jsop_getgname(uint32 index)
 
     ic.load = masm.loadValueWithAddressOffsetPatch(address, treg, dreg);
 
-    CHECK_IC_SPACE();
-
     frame.pushRegs(treg, dreg, type);
 
     /*
@@ -6274,6 +6297,7 @@ mjit::Compiler::jsop_getelem_slow()
 {
     prepareStubCall(Uses(2));
     INLINE_STUBCALL(stubs::GetElem, REJOIN_FALLTHROUGH);
+    testPushedType(REJOIN_FALLTHROUGH, -2, /* ool = */ false);
     frame.popn(2);
     pushSyncedEntry(0);
 }
@@ -7018,6 +7042,7 @@ mjit::Compiler::jsop_callelem_slow()
 {
     prepareStubCall(Uses(2));
     INLINE_STUBCALL(stubs::CallElem, REJOIN_FALLTHROUGH);
+    testPushedType(REJOIN_FALLTHROUGH, -2, /* ool = */ false);
     frame.popn(2);
     pushSyncedEntry(0);
     pushSyncedEntry(1);
@@ -7520,3 +7545,38 @@ mjit::Compiler::finishBarrier(const BarrierState &barrier, RejoinState rejoin, u
     OOL_STUBCALL(stubs::TypeBarrierHelper, rejoin);
     stubcc.rejoin(Changes(0));
 }
+
+void
+mjit::Compiler::testPushedType(RejoinState rejoin, int which, bool ool)
+{
+    if (!cx->typeInferenceEnabled() || !(js_CodeSpec[*PC].format & JOF_TYPESET))
+        return;
+
+    types::TypeSet *types = analysis->bytecodeTypes(PC);
+    if (types->unknown())
+        return;
+
+    Assembler &masm = ool ? stubcc.masm : this->masm;
+
+    JS_ASSERT(which <= 0);
+    Address address = (which == 0) ? frame.addressOfTop() : frame.addressOf(frame.peek(which));
+
+    Vector<Jump> mismatches(cx);
+    if (!masm.generateTypeCheck(cx, address, types, &mismatches)) {
+        oomInVector = true;
+        return;
+    }
+
+    Jump j = masm.jump();
+
+    for (unsigned i = 0; i < mismatches.length(); i++)
+        mismatches[i].linkTo(masm.label(), &masm);
+
+    masm.move(Imm32(which), Registers::ArgReg1);
+    if (ool)
+        OOL_STUBCALL(stubs::StubTypeHelper, rejoin);
+    else
+        INLINE_STUBCALL(stubs::StubTypeHelper, rejoin);
+
+    j.linkTo(masm.label(), &masm);
+}
diff --git a/js/src/methodjit/Compiler.h b/js/src/methodjit/Compiler.h
index d49cc9c965a2..218339cdd62c 100644
--- a/js/src/methodjit/Compiler.h
+++ b/js/src/methodjit/Compiler.h
@@ -184,7 +184,7 @@ class Compiler : public BaseCompiler
     };
 
     struct BaseICInfo {
-        BaseICInfo(JSOp op) : op(op), canCallHook(false)
+        BaseICInfo(JSOp op) : op(op), canCallHook(false), forcedTypeBarrier(false)
         { }
         Label fastPathStart;
         Label fastPathRejoin;
@@ -193,6 +193,7 @@ class Compiler : public BaseCompiler
         DataLabelPtr paramAddr;
         JSOp op;
         bool canCallHook;
+        bool forcedTypeBarrier;
 
         void copyTo(ic::BaseIC &to, JSC::LinkBuffer &full, JSC::LinkBuffer &stub) {
             to.fastPathStart = full.locationOf(fastPathStart);
@@ -200,6 +201,7 @@ class Compiler : public BaseCompiler
             to.slowPathStart = stub.locationOf(slowPathStart);
             to.slowPathCall = stub.locationOf(slowPathCall);
             to.canCallHook = canCallHook;
+            to.forcedTypeBarrier = forcedTypeBarrier;
             to.op = op;
             JS_ASSERT(to.op == op);
         }
@@ -570,6 +572,8 @@ class Compiler : public BaseCompiler
                              bool force = false);
     void finishBarrier(const BarrierState &barrier, RejoinState rejoin, uint32 which);
 
+    void testPushedType(RejoinState rejoin, int which, bool ool = true);
+
     /* Non-emitting helpers. */
     void pushSyncedEntry(uint32 pushed);
     uint32 fullAtomIndex(jsbytecode *pc);
diff --git a/js/src/methodjit/FastOps.cpp b/js/src/methodjit/FastOps.cpp
index 2505f6e3989b..f7f9ac2c19ef 100644
--- a/js/src/methodjit/FastOps.cpp
+++ b/js/src/methodjit/FastOps.cpp
@@ -1746,6 +1746,7 @@ mjit::Compiler::jsop_getelem_dense(bool isPacked)
 
     stubcc.leave();
     OOL_STUBCALL(stubs::GetElem, REJOIN_FALLTHROUGH);
+    testPushedType(REJOIN_FALLTHROUGH, -2);
 
     frame.popn(2);
 
@@ -1837,6 +1838,7 @@ mjit::Compiler::jsop_getelem_args()
 
     stubcc.leave();
     OOL_STUBCALL(stubs::GetElem, REJOIN_FALLTHROUGH);
+    testPushedType(REJOIN_FALLTHROUGH, -2);
 
     frame.popn(2);
     frame.pushRegs(typeReg, dataReg, knownPushedType(0));
@@ -1968,6 +1970,7 @@ mjit::Compiler::jsop_getelem_typed(int atype)
 
     stubcc.leave();
     OOL_STUBCALL(stubs::GetElem, REJOIN_FALLTHROUGH);
+    testPushedType(REJOIN_FALLTHROUGH, -2);
 
     frame.popn(2);
 
@@ -2149,13 +2152,17 @@ mjit::Compiler::jsop_getelem(bool isCall)
         ic.slowPathCall = OOL_STUBCALL(stubs::GetElem, REJOIN_FALLTHROUGH);
 #endif
 
+    testPushedType(REJOIN_FALLTHROUGH, -2);
+
     ic.fastPathRejoin = masm.label();
+    ic.forcedTypeBarrier = analysis->getCode(PC).getStringElement;
 
     CHECK_IC_SPACE();
 
     frame.popn(2);
     frame.pushRegs(ic.typeReg, ic.objReg, knownPushedType(0));
-    BarrierState barrier = testBarrier(ic.typeReg, ic.objReg, false);
+    BarrierState barrier = testBarrier(ic.typeReg, ic.objReg, false, false,
+                                       /* force = */ ic.forcedTypeBarrier);
     if (isCall)
         frame.pushSynced(knownPushedType(1));
 
diff --git a/js/src/methodjit/InvokeHelpers.cpp b/js/src/methodjit/InvokeHelpers.cpp
index 87401ae5b5b9..9ac07925c830 100644
--- a/js/src/methodjit/InvokeHelpers.cpp
+++ b/js/src/methodjit/InvokeHelpers.cpp
@@ -1360,10 +1360,6 @@ js_InternalInterpret(void *returnData, void *returnType, void *returnReg, js::VM
         /* Release this reference on the orphaned native stub. */
         RemoveOrphanedNative(cx, fp);
 
-        /*
-         * Note: there is no need to monitor the result of the native, the stub
-         * will always do a type check before finishing.
-         */
         f.regs.pc = nextpc;
         break;
       }
@@ -1582,6 +1578,16 @@ js_InternalInterpret(void *returnData, void *returnType, void *returnReg, js::VM
         nextDepth = analysis->getCode(f.regs.pc).stackDepth;
     f.regs.sp = fp->base() + nextDepth;
 
+    /*
+     * Monitor the result of the previous op when finishing a JOF_TYPESET op.
+     * The result may not have been marked if we bailed out while inside a stub
+     * for the op.
+     */
+    if (js_CodeSpec[op].format & JOF_TYPESET) {
+        int which = (js_CodeSpec[op].format & JOF_CALLOP) ? -2 : -1;  /* Yuck. */
+        types::TypeScript::Monitor(cx, script, pc, f.regs.sp[which]);
+    }
+
     /* Mark the entry frame as unfinished, and update the regs to resume at. */
     JaegerStatus status = skipTrap ? Jaeger_UnfinishedAtTrap : Jaeger_Unfinished;
     cx->compartment->jaegerCompartment()->setLastUnfinished(status);
diff --git a/js/src/methodjit/PolyIC.cpp b/js/src/methodjit/PolyIC.cpp
index 562cb4a32f44..dcae8ad73bf0 100644
--- a/js/src/methodjit/PolyIC.cpp
+++ b/js/src/methodjit/PolyIC.cpp
@@ -1938,11 +1938,9 @@ ic::GetProp(VMFrame &f, ic::PICInfo *pic)
                 THROW();
             JSString *str = f.regs.sp[-1].toString();
             f.regs.sp[-1].setInt32(str->length());
-            types::TypeScript::Monitor(f.cx, f.script(), f.pc(), f.regs.sp[-1]);
             return;
         } else if (f.regs.sp[-1].isMagic(JS_LAZY_ARGUMENTS)) {
             f.regs.sp[-1].setInt32(f.regs.fp()->numActualArgs());
-            types::TypeScript::Monitor(f.cx, f.script(), f.pc(), f.regs.sp[-1]);
             return;
         } else if (!f.regs.sp[-1].isPrimitive()) {
             JSObject *obj = &f.regs.sp[-1].toObject();
@@ -1967,15 +1965,12 @@ ic::GetProp(VMFrame &f, ic::PICInfo *pic)
                     JSString *str = obj->getPrimitiveThis().toString();
                     f.regs.sp[-1].setInt32(str->length());
                 }
-                types::TypeScript::Monitor(f.cx, f.script(), f.pc(), f.regs.sp[-1]);
                 return;
             }
         }
         atom = f.cx->runtime->atomState.lengthAtom;
     }
 
-    bool usePropCache = pic->usePropCache;
-
     /*
      * ValueToObject can trigger recompilations if it lazily initializes any
      * of the primitive classes (Boolean, Number, String). :XXX: if these
@@ -2002,16 +1997,6 @@ ic::GetProp(VMFrame &f, ic::PICInfo *pic)
     if (!obj->getProperty(f.cx, ATOM_TO_JSID(atom), &v))
         THROW();
 
-    /*
-     * Ignore undefined reads for the 'prototype' property in constructors,
-     * which will be at the start of the script and are never holes due to fun_resolve.
-     * Any undefined value was explicitly stored here, and is known by inference.
-     * :FIXME: looking under the usePropCache abstraction, which is only unset for
-     * reads of the prototype.
-     */
-    if (usePropCache)
-        types::TypeScript::Monitor(f.cx, f.script(), f.pc(), v);
-
     f.regs.sp[-1] = v;
 }
 
@@ -2181,8 +2166,6 @@ ic::CallProp(VMFrame &f, ic::PICInfo *pic)
     }
 #endif
 
-    types::TypeScript::Monitor(f.cx, f.script(), f.pc(), regs.sp[-2]);
-
     if (monitor.recompiled())
         return;
 
@@ -2232,8 +2215,6 @@ ic::XName(VMFrame &f, ic::PICInfo *pic)
     if (!cc.retrieve(&rval, NULL, PICInfo::XNAME))
         THROW();
     f.regs.sp[-1] = rval;
-
-    types::TypeScript::Monitor(f.cx, f.script(), f.pc(), rval);
 }
 
 void JS_FASTCALL
@@ -2251,8 +2232,6 @@ ic::Name(VMFrame &f, ic::PICInfo *pic)
     if (!cc.retrieve(&rval, NULL, PICInfo::NAME))
         THROW();
     f.regs.sp[0] = rval;
-
-    types::TypeScript::Monitor(f.cx, f.script(), f.pc(), rval);
 }
 
 static void JS_FASTCALL
@@ -2278,8 +2257,6 @@ ic::CallName(VMFrame &f, ic::PICInfo *pic)
 
     f.regs.sp[0] = rval;
     f.regs.sp[1] = thisval;
-
-    types::TypeScript::Monitor(f.cx, f.script(), f.pc(), rval);
 }
 
 static void JS_FASTCALL
@@ -2454,6 +2431,12 @@ GetElementIC::attachGetProp(VMFrame &f, JSContext *cx, JSObject *obj, const Valu
     if (status != Lookup_Cacheable)
         return status;
 
+    // With TI enabled, string property stubs can only be added to an opcode if
+    // the value read will go through a type barrier afterwards. TI only
+    // accounts for integer-valued properties accessed by GETELEM/CALLELEM.
+    if (cx->typeInferenceEnabled() && !forcedTypeBarrier)
+        return disable(cx, "string element access may not have type barrier");
+
     Assembler masm;
 
     // Guard on the string's type and identity.
@@ -2917,9 +2900,6 @@ ic::CallElement(VMFrame &f, ic::GetElementIC *ic)
             // If the result can be cached, the value was already retrieved.
             JS_ASSERT(!f.regs.sp[-2].isMagic());
             f.regs.sp[-1].setObject(*thisObj);
-            if (!JSID_IS_INT(id))
-                types::TypeScript::MonitorUnknown(f.cx, f.script(), f.pc());
-            types::TypeScript::Monitor(f.cx, f.script(), f.pc(), f.regs.sp[-2]);
             return;
         }
     }
@@ -2939,9 +2919,6 @@ ic::CallElement(VMFrame &f, ic::GetElementIC *ic)
     {
         f.regs.sp[-1] = thisv;
     }
-    if (!JSID_IS_INT(id))
-        types::TypeScript::MonitorUnknown(f.cx, f.script(), f.pc());
-    types::TypeScript::Monitor(f.cx, f.script(), f.pc(), f.regs.sp[-2]);
 }
 
 void JS_FASTCALL
@@ -2983,18 +2960,12 @@ ic::GetElement(VMFrame &f, ic::GetElementIC *ic)
 
             // If the result can be cached, the value was already retrieved.
             JS_ASSERT(!f.regs.sp[-2].isMagic());
-            if (!JSID_IS_INT(id))
-                types::TypeScript::MonitorUnknown(f.cx, f.script(), f.pc());
-            types::TypeScript::Monitor(f.cx, f.script(), f.pc(), f.regs.sp[-2]);
             return;
         }
     }
 
     if (!obj->getProperty(cx, id, &f.regs.sp[-2]))
         THROW();
-    if (!JSID_IS_INT(id))
-        types::TypeScript::MonitorUnknown(f.cx, f.script(), f.pc());
-    types::TypeScript::Monitor(f.cx, f.script(), f.pc(), f.regs.sp[-2]);
 }
 
 #define APPLY_STRICTNESS(f, s)                          \
diff --git a/js/src/methodjit/PolyIC.h b/js/src/methodjit/PolyIC.h
index efb73a4de698..23bb702d513c 100644
--- a/js/src/methodjit/PolyIC.h
+++ b/js/src/methodjit/PolyIC.h
@@ -96,6 +96,9 @@ struct BaseIC : public MacroAssemblerTypedefs {
     // Whether getter/setter hooks can be called from IC stubs.
     bool canCallHook : 1;
 
+    // Whether a type barrier is in place for the result of the op.
+    bool forcedTypeBarrier : 1;
+
     // Number of stubs generated.
     uint32 stubsGenerated : 5;
 
@@ -105,6 +108,7 @@ struct BaseIC : public MacroAssemblerTypedefs {
     void reset() {
         hit = false;
         slowCallPatched = false;
+        forcedTypeBarrier = false;
         stubsGenerated = 0;
         secondShapeGuard = 0;
     }
diff --git a/js/src/methodjit/StubCalls.cpp b/js/src/methodjit/StubCalls.cpp
index 8bd9a575602c..2ee7b352fead 100644
--- a/js/src/methodjit/StubCalls.cpp
+++ b/js/src/methodjit/StubCalls.cpp
@@ -375,7 +375,6 @@ NameOp(VMFrame &f, JSObject *obj, bool callname)
             if (op2 == JSOP_TYPEOF) {
                 f.regs.sp++;
                 f.regs.sp[-1].setUndefined();
-                TypeScript::Monitor(cx, f.script(), f.pc(), f.regs.sp[-1]);
                 return obj;
             }
             ReportAtomNotDefined(cx, atom);
@@ -402,8 +401,6 @@ NameOp(VMFrame &f, JSObject *obj, bool callname)
             AddTypePropertyId(cx, obj, id, Type::UndefinedType());
     }
 
-    TypeScript::Monitor(cx, f.script(), f.pc(), rval);
-
     *f.regs.sp++ = rval;
 
     if (callname)
@@ -443,7 +440,6 @@ stubs::GetElem(VMFrame &f)
             if (!str)
                 THROW();
             f.regs.sp[-2].setString(str);
-            TypeScript::Monitor(cx, f.script(), f.pc(), f.regs.sp[-2]);
             return;
         }
     }
@@ -451,7 +447,6 @@ stubs::GetElem(VMFrame &f)
     if (lref.isMagic(JS_LAZY_ARGUMENTS)) {
         if (rref.isInt32() && size_t(rref.toInt32()) < regs.fp()->numActualArgs()) {
             regs.sp[-2] = regs.fp()->canonicalActualArg(rref.toInt32());
-            TypeScript::Monitor(cx, f.script(), f.pc(), regs.sp[-2]);
             return;
         }
         MarkArgumentsCreated(cx, f.script());
@@ -508,12 +503,8 @@ stubs::GetElem(VMFrame &f)
         THROW();
     copyFrom = &rval;
 
-    if (!JSID_IS_INT(id))
-        TypeScript::MonitorUnknown(cx, f.script(), f.pc());
-
   end_getelem:
     f.regs.sp[-2] = *copyFrom;
-    TypeScript::Monitor(cx, f.script(), f.pc(), f.regs.sp[-2]);
 }
 
 static inline bool
@@ -559,9 +550,6 @@ stubs::CallElem(VMFrame &f)
     {
         regs.sp[-1] = thisv;
     }
-    if (!JSID_IS_INT(id))
-        TypeScript::MonitorUnknown(cx, f.script(), f.pc());
-    TypeScript::Monitor(cx, f.script(), f.pc(), regs.sp[-2]);
 }
 
 template<JSBool strict>
@@ -1573,7 +1561,6 @@ InlineGetProp(VMFrame &f)
     if (vp->isMagic(JS_LAZY_ARGUMENTS)) {
         JS_ASSERT(js_GetOpcode(cx, f.script(), f.pc()) == JSOP_LENGTH);
         regs.sp[-1] = Int32Value(regs.fp()->numActualArgs());
-        TypeScript::Monitor(cx, f.script(), f.pc(), regs.sp[-1]);
         return true;
     }
 
@@ -1622,8 +1609,6 @@ InlineGetProp(VMFrame &f)
         }
     } while(0);
 
-    TypeScript::Monitor(cx, f.script(), f.pc(), rval);
-
     regs.sp[-1] = rval;
     return true;
 }
@@ -1742,7 +1727,6 @@ stubs::CallProp(VMFrame &f, JSAtom *origAtom)
             THROW();
     }
 #endif
-    TypeScript::Monitor(cx, f.script(), f.pc(), rval);
 }
 
 void JS_FASTCALL
@@ -2394,6 +2378,19 @@ stubs::TypeBarrierHelper(VMFrame &f, uint32 which)
     TypeScript::Monitor(f.cx, f.script(), f.pc(), result);
 }
 
+void JS_FASTCALL
+stubs::StubTypeHelper(VMFrame &f, int32 which)
+{
+    const Value &result = f.regs.sp[which];
+
+    if (f.script()->hasAnalysis() && f.script()->analysis()->ranInference()) {
+        AutoEnterTypeInference enter(f.cx);
+        f.script()->analysis()->breakTypeBarriers(f.cx, f.pc() - f.script()->code, false);
+    }
+
+    TypeScript::Monitor(f.cx, f.script(), f.pc(), result);
+}
+
 /*
  * Variant of TypeBarrierHelper for checking types after making a native call.
  * The stack is already correct, and no fixup should be performed.
@@ -2411,25 +2408,6 @@ stubs::NegZeroHelper(VMFrame &f)
     TypeScript::MonitorOverflow(f.cx, f.script(), f.pc());
 }
 
-void JS_FASTCALL
-stubs::CallPropSwap(VMFrame &f)
-{
-    /*
-     * CALLPROP operations on strings are implemented in terms of GETPROP.
-     * If we rejoin from such a GETPROP, we come here at the end of the
-     * CALLPROP to fix up the stack. Right now the stack looks like:
-     *
-     * STRING PROP
-     *
-     * We need it to be:
-     *
-     * PROP STRING
-     */
-    Value v = f.regs.sp[-1];
-    f.regs.sp[-1] = f.regs.sp[-2];
-    f.regs.sp[-2] = v;
-}
-
 void JS_FASTCALL
 stubs::CheckArgumentTypes(VMFrame &f)
 {
diff --git a/js/src/methodjit/StubCalls.h b/js/src/methodjit/StubCalls.h
index 374ed93d4dd3..41c712a24b7e 100644
--- a/js/src/methodjit/StubCalls.h
+++ b/js/src/methodjit/StubCalls.h
@@ -210,7 +210,8 @@ void JS_FASTCALL TypeBarrierHelper(VMFrame &f, uint32 which);
 void JS_FASTCALL TypeBarrierReturn(VMFrame &f, Value *vp);
 void JS_FASTCALL NegZeroHelper(VMFrame &f);
 
-void JS_FASTCALL CallPropSwap(VMFrame &f);
+void JS_FASTCALL StubTypeHelper(VMFrame &f, int32 which);
+
 void JS_FASTCALL CheckArgumentTypes(VMFrame &f);
 
 #ifdef DEBUG

From 9e5ac031fc7eb071378e2a2a0724d87f521ca49b Mon Sep 17 00:00:00 2001
From: Brian Hackett <bhackett1024@gmail.com>
Date: Sat, 10 Sep 2011 22:03:01 +0200
Subject: [PATCH 087/209] [INFER] Allow inlined frames to call native functions
 from ICs, bug 683804.

---
 js/src/methodjit/BaseAssembler.h        | 30 +++++++-------
 js/src/methodjit/BaseCompiler.h         |  5 ++-
 js/src/methodjit/Compiler.cpp           |  2 +-
 js/src/methodjit/LoopState.cpp          |  2 +-
 js/src/methodjit/MethodJIT.cpp          | 19 +++------
 js/src/methodjit/MethodJIT.h            |  4 +-
 js/src/methodjit/MonoIC.cpp             | 43 ++++++++++++--------
 js/src/methodjit/MonoIC.h               |  8 +---
 js/src/methodjit/PolyIC.cpp             | 25 ++++++++++--
 js/src/methodjit/Retcon.cpp             | 52 +++++++++++++++----------
 js/src/methodjit/Retcon.h               |  2 +-
 js/src/methodjit/StubCompiler.cpp       |  2 +-
 js/src/methodjit/TrampolineCompiler.cpp |  2 +-
 13 files changed, 113 insertions(+), 83 deletions(-)

diff --git a/js/src/methodjit/BaseAssembler.h b/js/src/methodjit/BaseAssembler.h
index 568537e10b64..9f05039203e2 100644
--- a/js/src/methodjit/BaseAssembler.h
+++ b/js/src/methodjit/BaseAssembler.h
@@ -606,7 +606,7 @@ static const JSC::MacroAssembler::RegisterID JSParamReg_Argc  = JSC::SparcRegist
     Call callWithVMFrame(bool inlining, type stub, jsbytecode *pc,                       \
                          DataLabelPtr *pinlined, uint32 fd) {                            \
         return fallibleVMCall(inlining, JS_FUNC_TO_DATA_PTR(void *, stub),               \
-                              pc, pinlined, fd);                                         \
+                              pc, NULL, pinlined, fd);                                   \
     }
 
     STUB_CALL_TYPE(JSObjStub);
@@ -638,7 +638,7 @@ static const JSC::MacroAssembler::RegisterID JSParamReg_Argc  = JSC::SparcRegist
         move(MacroAssembler::stackPointerRegister, Registers::ArgReg0);
     }
 
-    void setupFallibleVMFrame(bool inlining, jsbytecode *pc,
+    void setupFallibleVMFrame(bool inlining, jsbytecode *pc, CallSite *inlined,
                               DataLabelPtr *pinlined, int32 frameDepth) {
         setupInfallibleVMFrame(frameDepth);
 
@@ -650,26 +650,28 @@ static const JSC::MacroAssembler::RegisterID JSParamReg_Argc  = JSC::SparcRegist
 
         if (inlining) {
             /* inlined -> regs->inlined :( */
-            DataLabelPtr ptr = storePtrWithPatch(ImmPtr(NULL),
-                                                 FrameAddress(VMFrame::offsetOfInlined));
-            if (pinlined)
-                *pinlined = ptr;
+            if (inlined) {
+                storePtr(ImmPtr(inlined), FrameAddress(VMFrame::offsetOfInlined));
+            } else {
+                DataLabelPtr ptr = storePtrWithPatch(ImmPtr(NULL),
+                                                     FrameAddress(VMFrame::offsetOfInlined));
+                if (pinlined)
+                    *pinlined = ptr;
+            }
         }
 
         restoreStackBase();
     }
 
-    void setupFallibleABICall(bool inlining, jsbytecode *pc, int32 frameDepth) {
+    void setupFallibleABICall(bool inlining, jsbytecode *pc, CallSite *inlined, int32 frameDepth) {
         setupFrameDepth(frameDepth);
 
-        /* Store fp and pc */
+        /* Store fp/pc/inlined */
         storePtr(JSFrameReg, FrameAddress(VMFrame::offsetOfFp));
         storePtr(ImmPtr(pc), FrameAddress(offsetof(VMFrame, regs.pc)));
 
-        if (inlining) {
-            /* ABI calls cannot be made from inlined frames. */
-            storePtr(ImmPtr(NULL), FrameAddress(VMFrame::offsetOfInlined));
-        }
+        if (inlining)
+            storePtr(ImmPtr(inlined), FrameAddress(VMFrame::offsetOfInlined));
     }
 
     void restoreStackBase() {
@@ -697,8 +699,8 @@ static const JSC::MacroAssembler::RegisterID JSParamReg_Argc  = JSC::SparcRegist
     // parameter) that needs the entire VMFrame to be coherent, meaning that
     // |pc|, |inlined| and |fp| are guaranteed to be up-to-date.
     Call fallibleVMCall(bool inlining, void *ptr, jsbytecode *pc,
-                        DataLabelPtr *pinlined, int32 frameDepth) {
-        setupFallibleVMFrame(inlining, pc, pinlined, frameDepth);
+                        CallSite *inlined, DataLabelPtr *pinlined, int32 frameDepth) {
+        setupFallibleVMFrame(inlining, pc, inlined, pinlined, frameDepth);
         Call call = wrapVMCall(ptr);
 
         // Restore the frame pointer from the VM.
diff --git a/js/src/methodjit/BaseCompiler.h b/js/src/methodjit/BaseCompiler.h
index 245f81472706..6de548a58582 100644
--- a/js/src/methodjit/BaseCompiler.h
+++ b/js/src/methodjit/BaseCompiler.h
@@ -184,8 +184,8 @@ class NativeStubLinker : public LinkerHelper
     typedef JSC::MacroAssembler::Jump FinalJump;
 #endif
 
-    NativeStubLinker(Assembler &masm, JITScript *jit, jsbytecode *pc, FinalJump done)
-        : LinkerHelper(masm, JSC::METHOD_CODE), jit(jit), pc(pc), done(done)
+    NativeStubLinker(Assembler &masm, JITScript *jit, jsbytecode *pc, CallSite *inlined, FinalJump done)
+        : LinkerHelper(masm, JSC::METHOD_CODE), jit(jit), pc(pc), inlined(inlined), done(done)
     {}
 
     bool init(JSContext *cx);
@@ -201,6 +201,7 @@ class NativeStubLinker : public LinkerHelper
   private:
     JITScript *jit;
     jsbytecode *pc;
+    CallSite *inlined;
     FinalJump done;
 };
 
diff --git a/js/src/methodjit/Compiler.cpp b/js/src/methodjit/Compiler.cpp
index 9a49e8d36908..c091838b3275 100644
--- a/js/src/methodjit/Compiler.cpp
+++ b/js/src/methodjit/Compiler.cpp
@@ -3204,7 +3204,7 @@ mjit::Compiler::emitStubCall(void *ptr, DataLabelPtr *pinline)
     masm.bumpStubCounter(script, PC, Registers::tempCallReg());
 
     Call cl = masm.fallibleVMCall(cx->typeInferenceEnabled(),
-                                  ptr, outerPC(), pinline, frame.totalDepth());
+                                  ptr, outerPC(), NULL, pinline, frame.totalDepth());
     JaegerSpew(JSpew_Insns, " ---- END STUB CALL ---- \n");
     return cl;
 }
diff --git a/js/src/methodjit/LoopState.cpp b/js/src/methodjit/LoopState.cpp
index e04d4abf5131..c1ca54f09fa6 100644
--- a/js/src/methodjit/LoopState.cpp
+++ b/js/src/methodjit/LoopState.cpp
@@ -259,7 +259,7 @@ LoopState::flushLoop(StubCompiler &stubcc)
 
                 if (call.entry) {
                     masm.fallibleVMCall(true, JS_FUNC_TO_DATA_PTR(void *, stubs::InvariantFailure),
-                                        pc, NULL, 0);
+                                        pc, NULL, NULL, 0);
                 } else {
                     /* f.regs are already coherent, don't write new values to them. */
                     masm.infallibleVMCall(JS_FUNC_TO_DATA_PTR(void *, stubs::InvariantFailure), -1);
diff --git a/js/src/methodjit/MethodJIT.cpp b/js/src/methodjit/MethodJIT.cpp
index 40d9e5b0d803..9492f5d87539 100644
--- a/js/src/methodjit/MethodJIT.cpp
+++ b/js/src/methodjit/MethodJIT.cpp
@@ -1081,8 +1081,6 @@ static inline void Destroy(T &t)
 
 mjit::JITScript::~JITScript()
 {
-    code.release();
-
     if (pcLengths)
         Foreground::free_(pcLengths);
 
@@ -1116,25 +1114,18 @@ mjit::JITScript::~JITScript()
     }
 
     ic::CallICInfo *callICs_ = callICs();
-    for (uint32 i = 0; i < nCallICs; i++) {
-        callICs_[i].releasePools();
-        if (callICs_[i].fastGuardedObject)
-            callICs_[i].purgeGuardedObject();
-    }
+    for (uint32 i = 0; i < nCallICs; i++)
+        callICs_[i].purge();
 
     // Fixup any ICs still referring to this JIT.
     while (!JS_CLIST_IS_EMPTY(&callers)) {
         JS_STATIC_ASSERT(offsetof(ic::CallICInfo, links) == 0);
         ic::CallICInfo *ic = (ic::CallICInfo *) callers.next;
-
-        uint8 *start = (uint8 *)ic->funGuard.executableAddress();
-        JSC::RepatchBuffer repatch(JSC::JITCode(start - 32, 64));
-
-        repatch.repatch(ic->funGuard, NULL);
-        repatch.relink(ic->funJump, ic->slowPathStart);
-        ic->purgeGuardedObject();
+        ic->purge();
     }
 #endif
+
+    code.release();
 }
 
 size_t
diff --git a/js/src/methodjit/MethodJIT.h b/js/src/methodjit/MethodJIT.h
index e3e22dc6a257..236be6be58b7 100644
--- a/js/src/methodjit/MethodJIT.h
+++ b/js/src/methodjit/MethodJIT.h
@@ -561,8 +561,9 @@ struct PCLengthEntry {
  * into the orphanedNativePools for the compartment.
  */
 struct NativeCallStub {
-    /* PC for the stub. Native call stubs cannot be added for inline frames. */
+    /* pc/inlined location of the stub. */
     jsbytecode *pc;
+    CallSite *inlined;
 
     /* Pool for the stub, NULL if it has been removed from the script. */
     JSC::ExecutablePool *pool;
@@ -664,6 +665,7 @@ struct JITScript {
     }
 
     void nukeScriptDependentICs();
+    void purgeGetterPICs();
 
     /* |usf| can be NULL here, in which case the fallback size computation will be used. */
     size_t scriptDataSize(JSUsableSizeFun usf);
diff --git a/js/src/methodjit/MonoIC.cpp b/js/src/methodjit/MonoIC.cpp
index 89d41c945c0f..41188ce615b8 100644
--- a/js/src/methodjit/MonoIC.cpp
+++ b/js/src/methodjit/MonoIC.cpp
@@ -555,6 +555,25 @@ SlowNewFromIC(VMFrame &f, ic::CallICInfo *ic)
     return NULL;
 }
 
+void
+CallICInfo::purge()
+{
+    uint8 *start = (uint8 *)funGuard.executableAddress();
+    JSC::RepatchBuffer repatch(JSC::JITCode(start - 32, 64));
+
+    repatch.repatch(funGuard, NULL);
+    repatch.relink(funJump, slowPathStart);
+
+    releasePools();
+    fastGuardedNative = NULL;
+
+    if (fastGuardedObject) {
+        hasJsFunCheck = false;
+        fastGuardedObject = NULL;
+        JS_REMOVE_LINK(&links);
+    }
+}
+
 bool
 NativeStubLinker::init(JSContext *cx)
 {
@@ -564,6 +583,7 @@ NativeStubLinker::init(JSContext *cx)
 
     NativeCallStub stub;
     stub.pc = pc;
+    stub.inlined = inlined;
     stub.pool = pool;
     stub.jump = locationOf(done);
     if (!jit->nativeCallStubs.append(stub)) {
@@ -635,7 +655,7 @@ mjit::NativeStubEpilogue(VMFrame &f, Assembler &masm, NativeStubLinker::FinalJum
             mismatches[i].linkTo(masm.label(), &masm);
         masm.addPtr(Imm32(vpOffset), JSFrameReg, Registers::ArgReg1);
         masm.fallibleVMCall(true, JS_FUNC_TO_DATA_PTR(void *, stubs::TypeBarrierReturn),
-                            f.regs.pc, NULL, initialFrameDepth);
+                            f.regs.pc, f.regs.inlined(), NULL, initialFrameDepth);
         masm.storePtr(ImmPtr(NULL), FrameAddress(offsetof(VMFrame, stubRejoin)));
         masm.jump().linkTo(finished, &masm);
     }
@@ -766,15 +786,15 @@ class CallCompiler : public BaseCompiler
 
         /* Try and compile. On success we get back the nmap pointer. */
         void *compilePtr = JS_FUNC_TO_DATA_PTR(void *, stubs::CompileFunction);
-        DataLabelPtr inlined;
         if (ic.frameSize.isStatic()) {
             masm.move(Imm32(ic.frameSize.staticArgc()), Registers::ArgReg1);
             masm.fallibleVMCall(cx->typeInferenceEnabled(),
-                                compilePtr, f.regs.pc, &inlined, ic.frameSize.staticLocalSlots());
+                                compilePtr, f.regs.pc, f.regs.inlined(), NULL,
+                                ic.frameSize.staticLocalSlots());
         } else {
             masm.load32(FrameAddress(offsetof(VMFrame, u.call.dynamicArgc)), Registers::ArgReg1);
             masm.fallibleVMCall(cx->typeInferenceEnabled(),
-                                compilePtr, f.regs.pc, &inlined, -1);
+                                compilePtr, f.regs.pc, f.regs.inlined(), NULL, -1);
         }
 
         Jump notCompiled = masm.branchTestPtr(Assembler::Zero, Registers::ReturnReg,
@@ -812,11 +832,6 @@ class CallCompiler : public BaseCompiler
         JaegerSpew(JSpew_PICs, "generated CALL stub %p (%lu bytes)\n", cs.executableAddress(),
                    (unsigned long) masm.size());
 
-        if (f.regs.inlined()) {
-            JSC::LinkBuffer code((uint8 *) cs.executableAddress(), masm.size(), JSC::METHOD_CODE);
-            code.patch(inlined, f.regs.inlined());
-        }
-
         Repatcher repatch(from);
         JSC::CodeLocationJump oolJump = ic.slowPathStart.jumpAtOffset(ic.oolJumpOffset);
         repatch.relink(oolJump, cs);
@@ -953,10 +968,6 @@ class CallCompiler : public BaseCompiler
         if (ic.fastGuardedNative || ic.hasJsFunCheck)
             return true;
 
-        /* Don't generate native MICs within inlined frames, we can't recompile them yet. */
-        if (f.regs.inlined())
-            return true;
-
         /* Native MIC needs to warm up first. */
         if (!ic.hit) {
             ic.hit = true;
@@ -985,7 +996,7 @@ class CallCompiler : public BaseCompiler
             masm.bumpStubCounter(f.script(), f.pc(), Registers::tempCallReg());
             masm.fallibleVMCall(cx->typeInferenceEnabled(),
                                 JS_FUNC_TO_DATA_PTR(void *, ic::SplatApplyArgs),
-                                f.regs.pc, NULL, initialFrameDepth);
+                                f.pc(), NULL, NULL, initialFrameDepth);
         }
 
         Registers tempRegs = Registers::tempCallRegMask();
@@ -993,7 +1004,7 @@ class CallCompiler : public BaseCompiler
         masm.bumpStubCounter(f.script(), f.pc(), t0);
 
         int32 storeFrameDepth = ic.frameSize.isStatic() ? initialFrameDepth : -1;
-        masm.setupFallibleABICall(cx->typeInferenceEnabled(), f.regs.pc, storeFrameDepth);
+        masm.setupFallibleABICall(cx->typeInferenceEnabled(), f.pc(), f.regs.inlined(), storeFrameDepth);
 
         /* Grab cx. */
 #ifdef JS_CPU_X86
@@ -1055,7 +1066,7 @@ class CallCompiler : public BaseCompiler
         NativeStubLinker::FinalJump done;
         if (!NativeStubEpilogue(f, masm, &done, initialFrameDepth, vpOffset, MaybeRegisterID(), MaybeRegisterID()))
             return false;
-        NativeStubLinker linker(masm, f.jit(), f.regs.pc, done);
+        NativeStubLinker linker(masm, f.jit(), f.pc(), f.regs.inlined(), done);
         if (!linker.init(f.cx))
             THROWV(true);
 
diff --git a/js/src/methodjit/MonoIC.h b/js/src/methodjit/MonoIC.h
index 982df5459079..b8e89e4f16a8 100644
--- a/js/src/methodjit/MonoIC.h
+++ b/js/src/methodjit/MonoIC.h
@@ -284,13 +284,7 @@ struct CallICInfo {
         }
     }
 
-    inline void purgeGuardedObject() {
-        JS_ASSERT(fastGuardedObject);
-        releasePool(CallICInfo::Pool_ClosureStub);
-        hasJsFunCheck = false;
-        fastGuardedObject = NULL;
-        JS_REMOVE_LINK(&links);
-    }
+    void purge();
 };
 
 void * JS_FASTCALL New(VMFrame &f, ic::CallICInfo *ic);
diff --git a/js/src/methodjit/PolyIC.cpp b/js/src/methodjit/PolyIC.cpp
index dcae8ad73bf0..54c7ed25dfd8 100644
--- a/js/src/methodjit/PolyIC.cpp
+++ b/js/src/methodjit/PolyIC.cpp
@@ -812,8 +812,6 @@ struct GetPropertyHelper {
                     return ic.disable(cx, "slotful getter hook through prototype");
                 if (!ic.canCallHook)
                     return ic.disable(cx, "can't call getter hook");
-                if (f.regs.inlined())
-                    return ic.disable(cx, "hook called from inline frame");
             }
         } else if (!shape->hasSlot()) {
             return ic.disable(cx, "no slot");
@@ -1202,7 +1200,7 @@ class GetPropCompiler : public PICStubCompiler
         }
 
         int32 initialFrameDepth = f.regs.sp - f.fp()->slots();
-        masm.setupFallibleABICall(cx->typeInferenceEnabled(), f.regs.pc, initialFrameDepth);
+        masm.setupFallibleABICall(cx->typeInferenceEnabled(), f.pc(), f.regs.inlined(), initialFrameDepth);
 
         /* Grab cx. */
 #ifdef JS_CPU_X86
@@ -1228,7 +1226,7 @@ class GetPropCompiler : public PICStubCompiler
         NativeStubLinker::FinalJump done;
         if (!NativeStubEpilogue(f, masm, &done, 0, vpOffset, pic.shapeReg, pic.objReg))
             return;
-        NativeStubLinker linker(masm, f.jit(), f.regs.pc, done);
+        NativeStubLinker linker(masm, f.jit(), f.pc(), f.regs.inlined(), done);
         if (!linker.init(f.cx))
             THROW();
 
@@ -3232,5 +3230,24 @@ ic::SetElement(VMFrame &f, ic::SetElementIC *ic)
 template void JS_FASTCALL ic::SetElement<true>(VMFrame &f, SetElementIC *ic);
 template void JS_FASTCALL ic::SetElement<false>(VMFrame &f, SetElementIC *ic);
 
+void
+JITScript::purgeGetterPICs()
+{
+    Repatcher repatcher(this);
+    PICInfo *pics_ = pics();
+    for (uint32 i = 0; i < nPICs; i++) {
+        PICInfo &pic = pics_[i];
+        switch (pic.kind) {
+          case PICInfo::CALL: /* fall-through */
+          case PICInfo::GET:
+            GetPropCompiler::reset(repatcher, pic);
+            pic.reset();
+            break;
+          default:
+            break;
+        }
+    }
+}
+
 #endif /* JS_POLYIC */
 
diff --git a/js/src/methodjit/Retcon.cpp b/js/src/methodjit/Retcon.cpp
index 819a19304811..aae7bf464f1e 100644
--- a/js/src/methodjit/Retcon.cpp
+++ b/js/src/methodjit/Retcon.cpp
@@ -134,7 +134,7 @@ Recompiler::patchCall(JITScript *jit, StackFrame *fp, void **location)
 
 void
 Recompiler::patchNative(JSCompartment *compartment, JITScript *jit, StackFrame *fp,
-                        jsbytecode *pc, RejoinState rejoin)
+                        jsbytecode *pc, CallSite *inlined, RejoinState rejoin)
 {
     /*
      * There is a native call or getter IC at pc which triggered recompilation.
@@ -143,9 +143,6 @@ Recompiler::patchNative(JSCompartment *compartment, JITScript *jit, StackFrame *
      * way, we don't want to patch up the call, but will instead steal the pool
      * for the IC so it doesn't get freed with the JITScript, and patch up the
      * jump at the end to go to the interpoline.
-     *
-     * When doing this, we do not reset the the IC itself; the JITScript must
-     * be dead and about to be released due to the recompilation (or a GC).
      */
     fp->setRejoin(StubRejoin(rejoin));
 
@@ -160,7 +157,7 @@ Recompiler::patchNative(JSCompartment *compartment, JITScript *jit, StackFrame *
      */
     for (unsigned i = 0; i < jit->nativeCallStubs.length(); i++) {
         NativeCallStub &stub = jit->nativeCallStubs[i];
-        if (stub.pc != pc)
+        if (stub.pc != pc || stub.inlined != inlined)
             continue;
 
         found = true;
@@ -194,6 +191,19 @@ Recompiler::patchNative(JSCompartment *compartment, JITScript *jit, StackFrame *
     }
 
     JS_ASSERT(found);
+
+    if (inlined) {
+        /*
+         * Purge all ICs in the script which can make native calls, to make
+         * sure the stolen stub is not reentered. This is only necessary if we
+         * are expanding inline frames, as in other circumstances the jitcode
+         * is about to be discarded.
+         */
+        jit->purgeGetterPICs();
+        ic::CallICInfo *callICs_ = jit->callICs();
+        for (uint32 i = 0; i < jit->nCallICs; i++)
+            callICs_[i].purge();
+    }
 }
 
 void
@@ -205,6 +215,7 @@ Recompiler::patchFrame(JSCompartment *compartment, VMFrame *f, JSScript *script)
      * where the call occurred, irregardless of any frames which were pushed
      * inside the call.
      */
+    JS_ASSERT(!f->regs.inlined());
     StackFrame *fp = f->fp();
     void **addr = f->returnAddressLocation();
     RejoinState rejoin = (RejoinState) f->stubRejoin;
@@ -213,7 +224,7 @@ Recompiler::patchFrame(JSCompartment *compartment, VMFrame *f, JSScript *script)
         rejoin == REJOIN_NATIVE_GETTER) {
         /* Native call. */
         if (fp->script() == script) {
-            patchNative(compartment, fp->jit(), fp, f->regs.pc, rejoin);
+            patchNative(compartment, fp->jit(), fp, f->regs.pc, NULL, rejoin);
             f->stubRejoin = REJOIN_NATIVE_PATCHED;
         }
     } else if (rejoin == REJOIN_NATIVE_PATCHED) {
@@ -302,14 +313,20 @@ Recompiler::expandInlineFrames(JSCompartment *compartment,
 
     /* Check if the VMFrame returns into the inlined frame. */
     if (f->stubRejoin && f->fp() == fp) {
-        /* The VMFrame is calling CompileFunction. */
-        JS_ASSERT(f->stubRejoin != REJOIN_NATIVE &&
-                  f->stubRejoin != REJOIN_NATIVE_LOWERED &&
-                  f->stubRejoin != REJOIN_NATIVE_GETTER &&
-                  f->stubRejoin != REJOIN_NATIVE_PATCHED);
-        innerfp->setRejoin(StubRejoin((RejoinState) f->stubRejoin));
-        *frameAddr = JS_FUNC_TO_DATA_PTR(void *, JaegerInterpoline);
-        f->stubRejoin = 0;
+        RejoinState rejoin = (RejoinState) f->stubRejoin;
+        JS_ASSERT(rejoin != REJOIN_NATIVE_PATCHED);
+        if (rejoin == REJOIN_NATIVE ||
+            rejoin == REJOIN_NATIVE_LOWERED ||
+            rejoin == REJOIN_NATIVE_GETTER) {
+            /* The VMFrame is calling a native. */
+            patchNative(compartment, fp->jit(), innerfp, innerpc, inlined, rejoin);
+            f->stubRejoin = REJOIN_NATIVE_PATCHED;
+        } else {
+            /* The VMFrame is calling CompileFunction. */
+            innerfp->setRejoin(StubRejoin(rejoin));
+            *frameAddr = JS_FUNC_TO_DATA_PTR(void *, JaegerInterpoline);
+            f->stubRejoin = 0;
+        }
     }
     if (CallsiteMatches(codeStart, *inlined, *frameAddr)) {
         /* The VMFrame returns directly into the expanded frame. */
@@ -508,12 +525,7 @@ Recompiler::cleanup(JITScript *jit)
         JS_STATIC_ASSERT(offsetof(ic::CallICInfo, links) == 0);
         ic::CallICInfo *ic = (ic::CallICInfo *) jit->callers.next;
 
-        uint8 *start = (uint8 *)ic->funGuard.executableAddress();
-        JSC::RepatchBuffer repatch(JSC::JITCode(start - 32, 64));
-
-        repatch.repatch(ic->funGuard, NULL);
-        repatch.relink(ic->funJump, ic->slowPathStart);
-        ic->purgeGuardedObject();
+        ic->purge();
     }
 }
 
diff --git a/js/src/methodjit/Retcon.h b/js/src/methodjit/Retcon.h
index 3a11e88fc390..e2f20004a4c0 100644
--- a/js/src/methodjit/Retcon.h
+++ b/js/src/methodjit/Retcon.h
@@ -100,7 +100,7 @@ private:
 
     static void patchCall(JITScript *jit, StackFrame *fp, void **location);
     static void patchNative(JSCompartment *compartment, JITScript *jit, StackFrame *fp,
-                            jsbytecode *pc, RejoinState rejoin);
+                            jsbytecode *pc, CallSite *inlined, RejoinState rejoin);
 
     static StackFrame *
     expandInlineFrameChain(StackFrame *outer, InlineFrame *inner);
diff --git a/js/src/methodjit/StubCompiler.cpp b/js/src/methodjit/StubCompiler.cpp
index bd44d19ddb43..adbacdcc894c 100644
--- a/js/src/methodjit/StubCompiler.cpp
+++ b/js/src/methodjit/StubCompiler.cpp
@@ -182,7 +182,7 @@ StubCompiler::emitStubCall(void *ptr, RejoinState rejoin, Uses uses, int32 slots
     masm.bumpStubCounter(cc.script, cc.PC, Registers::tempCallReg());
     DataLabelPtr inlinePatch;
     Call cl = masm.fallibleVMCall(cx->typeInferenceEnabled(),
-                                  ptr, cc.outerPC(), &inlinePatch, slots);
+                                  ptr, cc.outerPC(), NULL, &inlinePatch, slots);
     JaegerSpew(JSpew_Insns, " ---- END SLOW CALL CODE ---- \n");
 
     /* Add the call site for debugging and recompilation. */
diff --git a/js/src/methodjit/TrampolineCompiler.cpp b/js/src/methodjit/TrampolineCompiler.cpp
index d37d79273386..2e466e6b9d91 100644
--- a/js/src/methodjit/TrampolineCompiler.cpp
+++ b/js/src/methodjit/TrampolineCompiler.cpp
@@ -122,7 +122,7 @@ TrampolineCompiler::generateForceReturn(Assembler &masm)
     masm.loadPtr(FrameAddress(VMFrame::offsetOfFp), JSFrameReg);
 
     /* Perform the frame epilogue. */
-    masm.fallibleVMCall(true, JS_FUNC_TO_DATA_PTR(void *, stubs::AnyFrameEpilogue), NULL, NULL, 0);
+    masm.fallibleVMCall(true, JS_FUNC_TO_DATA_PTR(void *, stubs::AnyFrameEpilogue), NULL, NULL, NULL, 0);
 
     /* Store any known return value */
     masm.loadValueAsComponents(UndefinedValue(), JSReturnReg_Type, JSReturnReg_Data);

From 41819579b864eedc30625003e330e57a0fabe3db Mon Sep 17 00:00:00 2001
From: Brian Hackett <bhackett1024@gmail.com>
Date: Sun, 11 Sep 2011 00:21:15 -0700
Subject: [PATCH 088/209] [INFER] Fix orange.

---
 js/src/jsinterp.cpp | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/js/src/jsinterp.cpp b/js/src/jsinterp.cpp
index 3eb6d4fd8129..4b0581550a0f 100644
--- a/js/src/jsinterp.cpp
+++ b/js/src/jsinterp.cpp
@@ -3921,7 +3921,7 @@ BEGIN_CASE(JSOP_GETELEM)
         }
     }
 
-    if (JSID_IS_STRING(id) && script->hasAnalysis())
+    if (JSID_IS_STRING(id) && script->hasAnalysis() && !regs.fp()->hasImacropc())
         script->analysis()->getCode(regs.pc).getStringElement = true;
 
     if (!obj->getProperty(cx, id, &rval))
@@ -3991,7 +3991,7 @@ BEGIN_CASE(JSOP_SETELEM)
                 obj->setDenseArrayElementWithType(cx, i, regs.sp[-1]);
                 goto end_setelem;
             } else {
-                if (script->hasAnalysis())
+                if (script->hasAnalysis() && !regs.fp()->hasImacropc())
                     script->analysis()->getCode(regs.pc).arrayWriteHole = true;
             }
         }

From ff4641a451492bd4e47546314136df00c152ab38 Mon Sep 17 00:00:00 2001
From: Brian Hackett <bhackett1024@gmail.com>
Date: Sun, 11 Sep 2011 01:12:04 -0700
Subject: [PATCH 089/209] [INFER] Fix orange.

---
 js/src/methodjit/MonoIC.cpp | 49 +++++++++++++++++--------------------
 js/src/methodjit/PolyIC.cpp |  6 ++---
 2 files changed, 24 insertions(+), 31 deletions(-)

diff --git a/js/src/methodjit/MonoIC.cpp b/js/src/methodjit/MonoIC.cpp
index 41188ce615b8..0d0525970155 100644
--- a/js/src/methodjit/MonoIC.cpp
+++ b/js/src/methodjit/MonoIC.cpp
@@ -626,14 +626,14 @@ mjit::NativeStubEpilogue(VMFrame &f, Assembler &masm, NativeStubLinker::FinalJum
             if (!masm.generateTypeCheck(f.cx, resultAddress, types, &mismatches))
                 THROWV(false);
         }
-
-        /*
-         * Can no longer trigger recompilation in this stub, clear the stub
-         * rejoin on the VMFrame.
-         */
-        masm.storePtr(ImmPtr(NULL), FrameAddress(offsetof(VMFrame, stubRejoin)));
     }
 
+    /*
+     * Can no longer trigger recompilation in this stub, clear the stub
+     * rejoin on the VMFrame.
+     */
+    masm.storePtr(ImmPtr(NULL), FrameAddress(offsetof(VMFrame, stubRejoin)));
+
     if (typeReg.isSet())
         masm.loadValueAsComponents(resultAddress, typeReg.reg(), dataReg.reg());
 
@@ -662,8 +662,7 @@ mjit::NativeStubEpilogue(VMFrame &f, Assembler &masm, NativeStubLinker::FinalJum
 
     /* Move JaegerThrowpoline into register for very far jump on x64. */
     hasException.linkTo(masm.label(), &masm);
-    if (f.cx->typeInferenceEnabled())
-        masm.storePtr(ImmPtr(NULL), FrameAddress(offsetof(VMFrame, stubRejoin)));
+    masm.storePtr(ImmPtr(NULL), FrameAddress(offsetof(VMFrame, stubRejoin)));
     masm.throwInJIT();
 
     *result = done;
@@ -772,15 +771,13 @@ class CallCompiler : public BaseCompiler
         masm.loadPtr(Address(t0, offset), t0);
         Jump hasCode = masm.branchPtr(Assembler::Above, t0, ImmPtr(JS_UNJITTABLE_SCRIPT));
 
-        if (cx->typeInferenceEnabled()) {
-            /*
-             * Write the rejoin state to indicate this is a compilation call
-             * made from an IC (the recompiler cannot detect calls made from
-             * ICs automatically).
-             */
-            masm.storePtr(ImmPtr((void *) ic.frameSize.rejoinState(f.pc(), false)),
-                          FrameAddress(offsetof(VMFrame, stubRejoin)));
-        }
+        /*
+         * Write the rejoin state to indicate this is a compilation call
+         * made from an IC (the recompiler cannot detect calls made from
+         * ICs automatically).
+         */
+        masm.storePtr(ImmPtr((void *) ic.frameSize.rejoinState(f.pc(), false)),
+                      FrameAddress(offsetof(VMFrame, stubRejoin)));
 
         masm.bumpStubCounter(f.script(), f.pc(), Registers::tempCallReg());
 
@@ -980,16 +977,14 @@ class CallCompiler : public BaseCompiler
         /* Guard on the function object identity, for now. */
         Jump funGuard = masm.branchPtr(Assembler::NotEqual, ic.funObjReg, ImmPtr(obj));
 
-        if (cx->typeInferenceEnabled()) {
-            /*
-             * Write the rejoin state for the recompiler to use if this call
-             * triggers recompilation. Natives use a different stack address to
-             * store the return value than FASTCALLs, and without additional
-             * information we cannot tell which one is active on a VMFrame.
-             */
-            masm.storePtr(ImmPtr((void *) ic.frameSize.rejoinState(f.pc(), true)),
-                          FrameAddress(offsetof(VMFrame, stubRejoin)));
-        }
+        /*
+         * Write the rejoin state for the recompiler to use if this call
+         * triggers recompilation. Natives use a different stack address to
+         * store the return value than FASTCALLs, and without additional
+         * information we cannot tell which one is active on a VMFrame.
+         */
+        masm.storePtr(ImmPtr((void *) ic.frameSize.rejoinState(f.pc(), true)),
+                      FrameAddress(offsetof(VMFrame, stubRejoin)));
 
         /* N.B. After this call, the frame will have a dynamic frame size. */
         if (ic.frameSize.isDynamic()) {
diff --git a/js/src/methodjit/PolyIC.cpp b/js/src/methodjit/PolyIC.cpp
index 54c7ed25dfd8..4ff41f7c5b25 100644
--- a/js/src/methodjit/PolyIC.cpp
+++ b/js/src/methodjit/PolyIC.cpp
@@ -1163,10 +1163,8 @@ class GetPropCompiler : public PICStubCompiler
         JS_ASSERT(pic.canCallHook);
         PropertyOp getter = shape->getterOp();
 
-        if (cx->typeInferenceEnabled()) {
-            masm.storePtr(ImmPtr((void *) REJOIN_NATIVE_GETTER),
-                          FrameAddress(offsetof(VMFrame, stubRejoin)));
-        }
+        masm.storePtr(ImmPtr((void *) REJOIN_NATIVE_GETTER),
+                      FrameAddress(offsetof(VMFrame, stubRejoin)));
 
         Registers tempRegs = Registers::tempCallRegMask();
         if (tempRegs.hasReg(Registers::ClobberInCall))

From 154eefb90540324a4a0d9e416888036f1846a977 Mon Sep 17 00:00:00 2001
From: Brian Hackett <bhackett1024@gmail.com>
Date: Sun, 11 Sep 2011 11:49:27 -0700
Subject: [PATCH 090/209] [INFER] Fix orange.

---
 js/src/jscompartment.cpp | 43 +++++++---------------------------------
 1 file changed, 7 insertions(+), 36 deletions(-)

diff --git a/js/src/jscompartment.cpp b/js/src/jscompartment.cpp
index 2ab0c9c78de9..e504e6921f3f 100644
--- a/js/src/jscompartment.cpp
+++ b/js/src/jscompartment.cpp
@@ -426,42 +426,6 @@ JSCompartment::wrap(JSContext *cx, AutoIdVector &props)
     return true;
 }
 
-#if defined JS_METHODJIT && defined JS_MONOIC
-/*
- * Check if the pool containing the code for jit should be destroyed, per the
- * heuristics in JSCompartment::sweep.
- */
-static inline bool
-ScriptPoolDestroyed(JSContext *cx, mjit::JITScript *jit,
-                    uint32 releaseInterval, uint32 &counter)
-{
-    JSC::ExecutablePool *pool = jit->code.m_executablePool;
-    if (pool->m_gcNumber != cx->runtime->gcNumber) {
-        /*
-         * The m_destroy flag may have been set in a previous GC for a pool which had
-         * references we did not remove (e.g. from the compartment's ExecutableAllocator)
-         * and is still around. Forget we tried to destroy it in such cases.
-         */
-        pool->m_destroy = false;
-        pool->m_gcNumber = cx->runtime->gcNumber;
-        if (--counter == 0) {
-            pool->m_destroy = true;
-            counter = releaseInterval;
-        }
-    }
-    return pool->m_destroy;
-}
-
-static inline void
-ScriptTryDestroyCode(JSContext *cx, JSScript *script, bool normal,
-                     uint32 releaseInterval, uint32 &counter)
-{
-    mjit::JITScript *jit = normal ? script->jitNormal : script->jitCtor;
-    if (jit && ScriptPoolDestroyed(cx, jit, releaseInterval, counter))
-        mjit::ReleaseScriptCode(cx, script, !normal);
-}
-#endif // JS_METHODJIT && JS_MONOIC
-
 /*
  * This method marks pointers that cross compartment boundaries. It should be
  * called only for per-compartment GCs, since full GCs naturally follow pointers
@@ -594,6 +558,13 @@ JSCompartment::sweep(JSContext *cx, bool releaseTypes)
                     }
                 }
             }
+        } else {
+#ifdef JS_METHODJIT
+            for (CellIterUnderGC i(this, FINALIZE_SCRIPT); !i.done(); i.next()) {
+                JSScript *script = i.get<JSScript>();
+                mjit::ReleaseScriptCode(cx, script);
+            }
+#endif
         }
 
         types.sweep(cx);

From c0f8365c12d77ab7dffa11722dc399611ec10960 Mon Sep 17 00:00:00 2001
From: Brian Hackett <bhackett1024@gmail.com>
Date: Sun, 11 Sep 2011 21:56:47 -0700
Subject: [PATCH 091/209] [INFER] Don't update 'this' types of a script during
 compilation, bug 684084 (round 2).

---
 js/src/jit-test/tests/jaeger/bug684084-2.js |  8 +++
 js/src/methodjit/Compiler.cpp               | 61 +++++++++++++--------
 2 files changed, 46 insertions(+), 23 deletions(-)
 create mode 100644 js/src/jit-test/tests/jaeger/bug684084-2.js

diff --git a/js/src/jit-test/tests/jaeger/bug684084-2.js b/js/src/jit-test/tests/jaeger/bug684084-2.js
new file mode 100644
index 000000000000..34ddae320a66
--- /dev/null
+++ b/js/src/jit-test/tests/jaeger/bug684084-2.js
@@ -0,0 +1,8 @@
+function Function() {
+    try {
+    var g = this;
+    g.c("evil", eval);
+    } catch(b) {}
+}
+var o0 = Function.prototype;
+var f = new Function( (null ) );
diff --git a/js/src/methodjit/Compiler.cpp b/js/src/methodjit/Compiler.cpp
index c091838b3275..f1c15705272f 100644
--- a/js/src/methodjit/Compiler.cpp
+++ b/js/src/methodjit/Compiler.cpp
@@ -6882,39 +6882,54 @@ mjit::Compiler::constructThis()
 
     JSFunction *fun = script->function();
 
-    if (cx->typeInferenceEnabled() && !fun->getType(cx)->unknownProperties()) {
+    do {
+        if (!cx->typeInferenceEnabled() || fun->getType(cx)->unknownProperties())
+            break;
+
         jsid id = ATOM_TO_JSID(cx->runtime->atomState.classPrototypeAtom);
         types::TypeSet *protoTypes = fun->getType(cx)->getProperty(cx, id, false);
 
         JSObject *proto = protoTypes->getSingleton(cx, true);
-        if (proto) {
-            JSObject *templateObject = js_CreateThisForFunctionWithProto(cx, fun, proto);
-            if (!templateObject)
-                return false;
+        if (!proto)
+            break;
 
-            /*
-             * The template incorporates a shape and/or fixed slots from any
-             * newScript on its type, so make sure recompilation is triggered
-             * should this information change later.
-             */
-            if (templateObject->type()->newScript)
-                types::TypeSet::WatchObjectStateChange(cx, templateObject->type());
+        /*
+         * Generate an inline path to create a 'this' object with the given
+         * prototype. Only do this if the type is actually known as a possible
+         * 'this' type of the script.
+         */
+        types::TypeObject *type = proto->getNewType(cx, fun);
+        if (!type)
+            return false;
+        if (!types::TypeScript::ThisTypes(script)->hasType(types::Type::ObjectType(type)))
+            break;
 
-            RegisterID result = frame.allocReg();
-            Jump emptyFreeList = masm.getNewObject(cx, result, templateObject);
+        JSObject *templateObject = js_CreateThisForFunctionWithProto(cx, fun, proto);
+        if (!templateObject)
+            return false;
 
-            stubcc.linkExit(emptyFreeList, Uses(0));
-            stubcc.leave();
+        /*
+         * The template incorporates a shape and/or fixed slots from any
+         * newScript on its type, so make sure recompilation is triggered
+         * should this information change later.
+         */
+        if (templateObject->type()->newScript)
+            types::TypeSet::WatchObjectStateChange(cx, templateObject->type());
 
-            stubcc.masm.move(ImmPtr(proto), Registers::ArgReg1);
-            OOL_STUBCALL(stubs::CreateThis, REJOIN_RESUME);
+        RegisterID result = frame.allocReg();
+        Jump emptyFreeList = masm.getNewObject(cx, result, templateObject);
 
-            frame.setThis(result);
+        stubcc.linkExit(emptyFreeList, Uses(0));
+        stubcc.leave();
 
-            stubcc.rejoin(Changes(1));
-            return true;
-        }
-    }
+        stubcc.masm.move(ImmPtr(proto), Registers::ArgReg1);
+        OOL_STUBCALL(stubs::CreateThis, REJOIN_RESUME);
+
+        frame.setThis(result);
+
+        stubcc.rejoin(Changes(1));
+        return true;
+    } while (false);
 
     // Load the callee.
     frame.pushCallee();

From af1a69d82fdeac316c0ac13bf0d28c6a6a8222a6 Mon Sep 17 00:00:00 2001
From: Brian Hackett <bhackett1024@gmail.com>
Date: Sun, 11 Sep 2011 22:36:04 -0700
Subject: [PATCH 092/209] [INFER] Don't use loop registers for entries whose
 representation changed due to a jump into the loop, bug 684824.

---
 js/src/jit-test/tests/jaeger/bug684824.js | 7 +++++++
 js/src/methodjit/Compiler.cpp             | 7 ++++++-
 2 files changed, 13 insertions(+), 1 deletion(-)
 create mode 100644 js/src/jit-test/tests/jaeger/bug684824.js

diff --git a/js/src/jit-test/tests/jaeger/bug684824.js b/js/src/jit-test/tests/jaeger/bug684824.js
new file mode 100644
index 000000000000..9e8ad9c7ee7a
--- /dev/null
+++ b/js/src/jit-test/tests/jaeger/bug684824.js
@@ -0,0 +1,7 @@
+
+function X(n) {
+    while ('' + (n--)) {
+        break;
+    }
+}
+X();
diff --git a/js/src/methodjit/Compiler.cpp b/js/src/methodjit/Compiler.cpp
index f1c15705272f..fd2765a9c872 100644
--- a/js/src/methodjit/Compiler.cpp
+++ b/js/src/methodjit/Compiler.cpp
@@ -7216,7 +7216,12 @@ mjit::Compiler::updateJoinVarTypes()
             if (newv->slot < TotalSlots(script)) {
                 VarType &vt = a->varTypes[newv->slot];
                 vt.types = analysis->getValueTypes(newv->value);
-                vt.type = vt.types->getKnownTypeTag(cx);
+                JSValueType newType = vt.types->getKnownTypeTag(cx);
+                if (newType != vt.type) {
+                    FrameEntry *fe = frame.getSlotEntry(newv->slot);
+                    frame.forgetLoopReg(fe);
+                }
+                vt.type = newType;
             }
             newv++;
         }

From 001800912067b248660588c5b51afb6681b1134f Mon Sep 17 00:00:00 2001
From: Brian Hackett <bhackett1024@gmail.com>
Date: Sun, 11 Sep 2011 22:38:33 -0700
Subject: [PATCH 093/209] [INFER] Remove bogus assert, bug 686178.

---
 js/src/methodjit/Retcon.cpp | 1 -
 1 file changed, 1 deletion(-)

diff --git a/js/src/methodjit/Retcon.cpp b/js/src/methodjit/Retcon.cpp
index aae7bf464f1e..90eae9e31e08 100644
--- a/js/src/methodjit/Retcon.cpp
+++ b/js/src/methodjit/Retcon.cpp
@@ -85,7 +85,6 @@ static inline JSRejoinState ScriptedRejoin(uint32 pcOffset)
 
 static inline JSRejoinState StubRejoin(RejoinState rejoin)
 {
-    JS_ASSERT(rejoin != REJOIN_NONE);
     return rejoin << 1;
 }
 

From ef310b7c63ab9e2aaf12f925c164e05e7d807f11 Mon Sep 17 00:00:00 2001
From: Brian Hackett <bhackett1024@gmail.com>
Date: Sun, 11 Sep 2011 23:06:52 -0700
Subject: [PATCH 094/209] [INFER] Fix bogus assert, bug 686179.

---
 js/src/jsobj.cpp      | 2 ++
 js/src/jsobjinlines.h | 2 --
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/js/src/jsobj.cpp b/js/src/jsobj.cpp
index 60a35a358531..98b2c1451c6e 100644
--- a/js/src/jsobj.cpp
+++ b/js/src/jsobj.cpp
@@ -5653,6 +5653,8 @@ js_NativeGetInline(JSContext *cx, JSObject *receiver, JSObject *obj, JSObject *p
     if (slot != SHAPE_INVALID_SLOT) {
         *vp = pobj->nativeGetSlot(slot);
         JS_ASSERT(!vp->isMagic());
+        JS_ASSERT_IF(!pobj->hasSingletonType() && shape->hasDefaultGetterOrIsMethod(),
+                     js::types::TypeHasProperty(cx, pobj->type(), shape->propid, *vp));
     } else {
         vp->setUndefined();
     }
diff --git a/js/src/jsobjinlines.h b/js/src/jsobjinlines.h
index 46c297f9dac5..cc719a7c3d11 100644
--- a/js/src/jsobjinlines.h
+++ b/js/src/jsobjinlines.h
@@ -143,8 +143,6 @@ JSObject::getProperty(JSContext *cx, JSObject *receiver, jsid id, js::Value *vp)
     } else {
         if (!js_GetProperty(cx, this, receiver, id, vp))
             return false;
-        JS_ASSERT_IF(!hasSingletonType() && nativeContains(js_CheckForStringIndex(id)),
-                     js::types::TypeHasProperty(cx, type(), id, *vp));
     }
     return true;
 }

From 4db5befa7591010d1a122271070e8e1e8c329ffc Mon Sep 17 00:00:00 2001
From: Brian Hackett <bhackett1024@gmail.com>
Date: Mon, 12 Sep 2011 00:31:38 -0700
Subject: [PATCH 095/209] [INFER] Fix orange.

---
 js/src/methodjit/Compiler.cpp      |  2 +-
 js/src/methodjit/InvokeHelpers.cpp | 96 ++++++++++++++++--------------
 js/src/methodjit/MethodJIT.h       |  5 +-
 3 files changed, 57 insertions(+), 46 deletions(-)

diff --git a/js/src/methodjit/Compiler.cpp b/js/src/methodjit/Compiler.cpp
index fd2765a9c872..69bc655e9034 100644
--- a/js/src/methodjit/Compiler.cpp
+++ b/js/src/methodjit/Compiler.cpp
@@ -6790,7 +6790,7 @@ mjit::Compiler::jumpAndTrace(Jump j, jsbytecode *target, Jump *slow, bool *tramp
         jsbytecode* pc = PC;
         PC = target;
 
-        OOL_STUBCALL(stubs::InvokeTracer, REJOIN_NONE);
+        OOL_STUBCALL(stubs::InvokeTracer, REJOIN_FINISH_FRAME);
 
         PC = pc;
     }
diff --git a/js/src/methodjit/InvokeHelpers.cpp b/js/src/methodjit/InvokeHelpers.cpp
index 9ac07925c830..2ff819e616bd 100644
--- a/js/src/methodjit/InvokeHelpers.cpp
+++ b/js/src/methodjit/InvokeHelpers.cpp
@@ -617,50 +617,46 @@ js_InternalThrow(VMFrame &f)
     StackFrame *fp = cx->fp();
     JSScript *script = fp->script();
 
-    if (cx->typeInferenceEnabled() || !fp->jit()) {
-        /*
-         * Fall back to EnterMethodJIT and finish the frame in the interpreter.
-         * With type inference enabled, we may wipe out all JIT code on the
-         * stack without patching ncode values to jump to the interpreter, and
-         * thus can only enter JIT code via EnterMethodJIT (which overwrites
-         * its entry frame's ncode). See ClearAllFrames.
-         */
-        cx->compartment->jaegerCompartment()->setLastUnfinished(Jaeger_Unfinished);
-
-        if (!script->ensureRanAnalysis(cx)) {
-            js_ReportOutOfMemory(cx);
-            return NULL;
-        }
-
-        analyze::AutoEnterAnalysis enter(cx);
-
-        cx->regs().pc = pc;
-        cx->regs().sp = fp->base() + script->analysis()->getCode(pc).stackDepth;
-
-        /*
-         * Interpret the ENTERBLOCK and EXCEPTION opcodes, so that we don't go
-         * back into the interpreter with a pending exception. This will cause
-         * it to immediately rethrow.
-         */
-        if (cx->isExceptionPending()) {
-            JS_ASSERT(js_GetOpcode(cx, script, pc) == JSOP_ENTERBLOCK);
-            JSObject *obj = script->getObject(GET_SLOTNO(pc));
-            Value *vp = cx->regs().sp + OBJ_BLOCK_COUNT(cx, obj);
-            SetValueRangeToUndefined(cx->regs().sp, vp);
-            cx->regs().sp = vp;
-            JS_ASSERT(js_GetOpcode(cx, script, pc + JSOP_ENTERBLOCK_LENGTH) == JSOP_EXCEPTION);
-            cx->regs().sp[0] = cx->getPendingException();
-            cx->clearPendingException();
-            cx->regs().sp++;
-            cx->regs().pc = pc + JSOP_ENTERBLOCK_LENGTH + JSOP_EXCEPTION_LENGTH;
-        }
-
-        *f.oldregs = f.regs;
+    /*
+     * Fall back to EnterMethodJIT and finish the frame in the interpreter.
+     * We may wipe out all JIT code on the stack without patching ncode values
+     * to jump to the interpreter, and thus can only enter JIT code via
+     * EnterMethodJIT (which overwrites its entry frame's ncode).
+     * See ClearAllFrames.
+     */
+    cx->compartment->jaegerCompartment()->setLastUnfinished(Jaeger_Unfinished);
 
+    if (!script->ensureRanAnalysis(cx)) {
+        js_ReportOutOfMemory(cx);
         return NULL;
     }
 
-    return script->nativeCodeForPC(fp->isConstructing(), pc);
+    analyze::AutoEnterAnalysis enter(cx);
+
+    cx->regs().pc = pc;
+    cx->regs().sp = fp->base() + script->analysis()->getCode(pc).stackDepth;
+
+    /*
+     * Interpret the ENTERBLOCK and EXCEPTION opcodes, so that we don't go
+     * back into the interpreter with a pending exception. This will cause
+     * it to immediately rethrow.
+     */
+    if (cx->isExceptionPending()) {
+        JS_ASSERT(js_GetOpcode(cx, script, pc) == JSOP_ENTERBLOCK);
+        JSObject *obj = script->getObject(GET_SLOTNO(pc));
+        Value *vp = cx->regs().sp + OBJ_BLOCK_COUNT(cx, obj);
+        SetValueRangeToUndefined(cx->regs().sp, vp);
+        cx->regs().sp = vp;
+        JS_ASSERT(js_GetOpcode(cx, script, pc + JSOP_ENTERBLOCK_LENGTH) == JSOP_EXCEPTION);
+        cx->regs().sp[0] = cx->getPendingException();
+        cx->clearPendingException();
+        cx->regs().sp++;
+        cx->regs().pc = pc + JSOP_ENTERBLOCK_LENGTH + JSOP_EXCEPTION_LENGTH;
+    }
+
+    *f.oldregs = f.regs;
+
+    return NULL;
 }
 
 void JS_FASTCALL
@@ -1060,6 +1056,8 @@ RunTracer(VMFrame &f)
     hits = 1;
 #endif
 
+    RecompilationMonitor monitor(cx);
+
     {
         /*
          * While the tracer is running, redirect the regs to a local variable here.
@@ -1078,9 +1076,11 @@ RunTracer(VMFrame &f)
     }
 
 #if JS_MONOIC
-    ic.loopCounterStart = *loopCounter;
-    if (blacklist)
-        DisableTraceHint(entryFrame->jit(), ic);
+    if (!monitor.recompiled()) {
+        ic.loopCounterStart = *loopCounter;
+        if (blacklist)
+            DisableTraceHint(entryFrame->jit(), ic);
+    }
 #endif
 
     // Even though ExecuteTree() bypasses the interpreter, it should propagate
@@ -1140,7 +1140,9 @@ RunTracer(VMFrame &f)
     if (FrameIsFinished(cx)) {
         if (!HandleFinishedFrame(f, entryFrame))
             THROWV(NULL);
-        *f.returnAddressLocation() = cx->jaegerCompartment()->forceReturnFromFastCall();
+        void *addr = *f.returnAddressLocation();
+        if (addr != JaegerInterpoline)
+            *f.returnAddressLocation() = cx->jaegerCompartment()->forceReturnFromFastCall();
         return NULL;
     }
 
@@ -1570,6 +1572,12 @@ js_InternalInterpret(void *returnData, void *returnType, void *returnReg, js::VM
         break;
       }
 
+      case REJOIN_FINISH_FRAME:
+        /* InvokeTracer finishes the frame it is given, including the epilogue. */
+        if (fp->isFunctionFrame())
+            fp->markFunctionEpilogueDone();
+        break;
+
       default:
         JS_NOT_REACHED("Missing rejoin");
     }
diff --git a/js/src/methodjit/MethodJIT.h b/js/src/methodjit/MethodJIT.h
index 236be6be58b7..434ba7ad3703 100644
--- a/js/src/methodjit/MethodJIT.h
+++ b/js/src/methodjit/MethodJIT.h
@@ -317,7 +317,10 @@ enum RejoinState {
      * For an opcode fused with IFEQ/IFNE, call returns a boolean indicating
      * the result of the comparison and whether to take or not take the branch.
      */
-    REJOIN_BRANCH
+    REJOIN_BRANCH,
+
+    /* Calls to RunTracer which finished the given frame. */
+    REJOIN_FINISH_FRAME
 };
 
 /* Helper to watch for recompilation and frame expansion activity on a compartment. */

From 6ad9c7610484e8a9737685f15210c7e3281a2d82 Mon Sep 17 00:00:00 2001
From: Brian Hackett <bhackett1024@gmail.com>
Date: Mon, 12 Sep 2011 12:16:43 -0700
Subject: [PATCH 096/209] [INFER] Fix orange.

---
 js/src/methodjit/InvokeHelpers.cpp | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/js/src/methodjit/InvokeHelpers.cpp b/js/src/methodjit/InvokeHelpers.cpp
index 2ff819e616bd..0d0f0f06c346 100644
--- a/js/src/methodjit/InvokeHelpers.cpp
+++ b/js/src/methodjit/InvokeHelpers.cpp
@@ -1591,7 +1591,7 @@ js_InternalInterpret(void *returnData, void *returnType, void *returnReg, js::VM
      * The result may not have been marked if we bailed out while inside a stub
      * for the op.
      */
-    if (js_CodeSpec[op].format & JOF_TYPESET) {
+    if (f.regs.pc == nextpc && (js_CodeSpec[op].format & JOF_TYPESET)) {
         int which = (js_CodeSpec[op].format & JOF_CALLOP) ? -2 : -1;  /* Yuck. */
         types::TypeScript::Monitor(cx, script, pc, f.regs.sp[which]);
     }

From ed0122d8993fefcac5979b56141fa5e4fdeab5af Mon Sep 17 00:00:00 2001
From: Brian Hackett <bhackett1024@gmail.com>
Date: Mon, 12 Sep 2011 12:46:24 -0700
Subject: [PATCH 097/209] [INFER] Fix red.

---
 js/src/methodjit/InvokeHelpers.cpp | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/js/src/methodjit/InvokeHelpers.cpp b/js/src/methodjit/InvokeHelpers.cpp
index 0d0f0f06c346..56713712b877 100644
--- a/js/src/methodjit/InvokeHelpers.cpp
+++ b/js/src/methodjit/InvokeHelpers.cpp
@@ -1141,7 +1141,7 @@ RunTracer(VMFrame &f)
         if (!HandleFinishedFrame(f, entryFrame))
             THROWV(NULL);
         void *addr = *f.returnAddressLocation();
-        if (addr != JaegerInterpoline)
+        if (addr != JS_FUNC_TO_DATA_PTR(void *, JaegerInterpoline))
             *f.returnAddressLocation() = cx->jaegerCompartment()->forceReturnFromFastCall();
         return NULL;
     }

From 7c1c2a65d9c1f3e70dc54e5e986f68374d20c819 Mon Sep 17 00:00:00 2001
From: Matt Brubeck <mbrubeck@mozilla.com>
Date: Tue, 13 Sep 2011 18:24:08 -0700
Subject: [PATCH 098/209] Bug 685568 - Back out db34d544a36b; we want to keep
 this change after all.  DONTBUILD

---
 mobile/themes/core/tablet.css | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/mobile/themes/core/tablet.css b/mobile/themes/core/tablet.css
index 2472cca229aa..2f3a90e05037 100644
--- a/mobile/themes/core/tablet.css
+++ b/mobile/themes/core/tablet.css
@@ -31,7 +31,7 @@
 }
 
 #tabs-container[tablet] {
-  -moz-border-end: @border_width_xlarge@ solid #eaeaea;
+  -moz-border-end: @border_width_xxlarge@ solid #eaeaea;
   background: #000;
 }
 

From a15784a170c664f2eb0c567477c40a81ad6f53d7 Mon Sep 17 00:00:00 2001
From: Phil Ringnalda <philringnalda@gmail.com>
Date: Tue, 13 Sep 2011 20:04:13 -0700
Subject: [PATCH 099/209] No bug, fix rammedtogether words in test error
 message DONTBUILD

---
 widget/tests/test_bug343416.xul | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/widget/tests/test_bug343416.xul b/widget/tests/test_bug343416.xul
index 8333b7acb8a9..f7a544b6a70a 100644
--- a/widget/tests/test_bug343416.xul
+++ b/widget/tests/test_bug343416.xul
@@ -169,7 +169,7 @@ function testIdleTime()
     // 1 second leniency.
     ok(timeDiff < 1000, "The idle time should have increased by roughly the " +
                         "amount of time it took for the timeout to fire. " +
-                        "You didn't touch the mouse or keyboard during the" +
+                        "You didn't touch the mouse or keyboard during the " +
                         "test did you?");
     finishedTimeoutOK = true;
 }

From 629fff94090c422aabd4eaf2fac2ef1a875ae92a Mon Sep 17 00:00:00 2001
From: Jonathan Kew <jfkthame@gmail.com>
Date: Wed, 14 Sep 2011 08:05:51 +0100
Subject: [PATCH 100/209] bug 686317 - fix format string/argument list
 mismatches in ARMAssembler.h. r=cdleary

---
 js/src/assembler/assembler/ARMAssembler.h | 10 +++++-----
 1 file changed, 5 insertions(+), 5 deletions(-)

diff --git a/js/src/assembler/assembler/ARMAssembler.h b/js/src/assembler/assembler/ARMAssembler.h
index 9e6e8e140358..d72c6f377bc1 100644
--- a/js/src/assembler/assembler/ARMAssembler.h
+++ b/js/src/assembler/assembler/ARMAssembler.h
@@ -586,7 +586,7 @@ namespace JSC {
             }
             char const * off_sign = (posOffset) ? ("+") : ("-");
             js::JaegerSpew(js::JSpew_Insns, 
-                           IPFX "%sr%s%s, [%s, #%s%u]\n", 
+                           IPFX "%sr%s%s %s, [%s, #%s%u]\n", 
                            MAYBE_PAD, mnemonic_act, mnemonic_sign, mnemonic_size,
                            nameGpReg(rd), nameGpReg(rb), off_sign, offset);
             if (size == 32 || (size == 8 && !isSigned)) {
@@ -626,7 +626,7 @@ namespace JSC {
             }
             char const * off_sign = (posOffset) ? ("+") : ("-");
             js::JaegerSpew(js::JSpew_Insns, 
-                           IPFX "%sr%s%s, [%s, #%s%s]\n", MAYBE_PAD, mnemonic_act, mnemonic_sign, mnemonic_size,
+                           IPFX "%sr%s%s %s, [%s, #%s%s]\n", MAYBE_PAD, mnemonic_act, mnemonic_sign, mnemonic_size,
                            nameGpReg(rd), nameGpReg(rb), off_sign, nameGpReg(rm));
             if (size == 32 || (size == 8 && !isSigned)) {
                 /* All (the one) 32 bit ops and the signed 8 bit ops use the original encoding.*/
@@ -1052,7 +1052,7 @@ namespace JSC {
         static void repatchInt32(void* from, int32_t to)
         {
             js::JaegerSpew(js::JSpew_Insns,
-                           ISPFX "##repatchInt32    ((%p)) holds ((%p))\n",
+                           ISPFX "##repatchInt32    ((%p)) holds ((%#x))\n",
                            from, to);
 
             patchPointerInternal(reinterpret_cast<intptr_t>(from), reinterpret_cast<void*>(to));
@@ -1606,7 +1606,7 @@ namespace JSC {
         void fcpyd_r(int dd, int dm, Condition cc = AL)
         {
             js::JaegerSpew(js::JSpew_Insns,
-                    IPFX   "%-15s %s, %s, %s\n", MAYBE_PAD, "vmov.f64", 
+                    IPFX   "%-15s %s, %s\n", MAYBE_PAD, "vmov.f64", 
                            nameFpRegD(dd), nameFpRegD(dm));
             // TODO: emitInst doesn't work for VFP instructions, though it
             // seems to work for current usage.
@@ -1650,7 +1650,7 @@ namespace JSC {
         void fabsd_r(int dd, int dm, Condition cc = AL)
         {
             js::JaegerSpew(js::JSpew_Insns,
-                    IPFX   "%-15s %s, %s, %s, %s\n", MAYBE_PAD, "fabsd", nameFpRegD(dd), nameFpRegD(dm));
+                    IPFX   "%-15s %s, %s\n", MAYBE_PAD, "fabsd", nameFpRegD(dd), nameFpRegD(dm));
             m_buffer.putInt(static_cast<ARMWord>(cc) | FABSD | DD(dd) | DM(dm));
         }
 

From bf429a8ed6ca08be094cdb792b35c98a93bad79d Mon Sep 17 00:00:00 2001
From: Oleg Romashin <romaxa@gmail.com>
Date: Wed, 14 Sep 2011 08:51:24 +0100
Subject: [PATCH 101/209] Bug 686513 - RenderFrameParent::BuildDisplayList
 crash when shadow root layer is null; r=roc

---
 layout/ipc/RenderFrameParent.cpp | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/layout/ipc/RenderFrameParent.cpp b/layout/ipc/RenderFrameParent.cpp
index 15142afe75c4..08233fb50748 100644
--- a/layout/ipc/RenderFrameParent.cpp
+++ b/layout/ipc/RenderFrameParent.cpp
@@ -811,11 +811,12 @@ RenderFrameParent::BuildDisplayList(nsDisplayListBuilder* aBuilder,
   // We're the subdoc for <browser remote="true"> and it has
   // painted content.  Display its shadow layer tree.
   nsDisplayList shadowTree;
-  if (aBuilder->IsForEventDelivery()) {
+  ContainerLayer* container = GetRootLayer();
+  if (aBuilder->IsForEventDelivery() && container) {
     nsRect bounds = aFrame->EnsureInnerView()->GetBounds();
     ViewTransform offset =
       ViewTransform(GetRootFrameOffset(aFrame, aBuilder), 1, 1);
-    BuildListForLayer(GetRootLayer(), mFrameLoader, offset,
+    BuildListForLayer(container, mFrameLoader, offset,
                       aBuilder, shadowTree, aFrame);
   } else {
     shadowTree.AppendToTop(

From 57152238b5c7971d77938aabacec8280e1a6cd6d Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Fr=C3=A9d=C3=A9ric=20Wang?= <fred.wang@free.fr>
Date: Wed, 14 Sep 2011 08:51:24 +0100
Subject: [PATCH 102/209] Bug 398505 - Remove nonstandard actiontype "restyle"
 of maction; r=karlt

---
 layout/mathml/nsMathMLmactionFrame.cpp | 49 --------------------------
 1 file changed, 49 deletions(-)

diff --git a/layout/mathml/nsMathMLmactionFrame.cpp b/layout/mathml/nsMathMLmactionFrame.cpp
index 6ab34f61a62a..5ced84a606a2 100644
--- a/layout/mathml/nsMathMLmactionFrame.cpp
+++ b/layout/mathml/nsMathMLmactionFrame.cpp
@@ -69,7 +69,6 @@
 #define NS_MATHML_ACTION_TYPE_TOGGLE       1
 #define NS_MATHML_ACTION_TYPE_STATUSLINE   2
 #define NS_MATHML_ACTION_TYPE_TOOLTIP      3 // unsupported
-#define NS_MATHML_ACTION_TYPE_RESTYLE      4
 
 
 nsIFrame*
@@ -128,37 +127,6 @@ nsMathMLmactionFrame::Init(nsIContent*      aContent,
         mActionType = NS_MATHML_ACTION_TYPE_STATUSLINE;
     }
 
-    if (NS_MATHML_ACTION_TYPE_NONE == mActionType) {
-      // expected restyle prefix (8ch)...
-      if (8 < value.Length() && 0 == value.Find("restyle#")) {
-        mActionType = NS_MATHML_ACTION_TYPE_RESTYLE;
-        mRestyle = value;
-
-        // Here is the situation:
-        // When the attribute [actiontype="restyle#id"] is set, the Style System has
-        // given us the associated style. But we want to start with our default style.
-
-        // So... first, remove the attribute actiontype="restyle#id"
-        // XXXbz this is pretty messed up, since this can change whether we
-        // should have a frame at all.  This really needs a better solution.
-        PRBool notify = PR_FALSE; // don't trigger a reflow yet!
-        aContent->UnsetAttr(kNameSpaceID_None, nsGkAtoms::actiontype_, notify);
-
-        // then, re-resolve our style
-        nsStyleContext* parentStyleContext = GetStyleContext()->GetParent();
-        newStyleContext = PresContext()->StyleSet()->
-          ResolveStyleFor(aContent->AsElement(), parentStyleContext);
-
-        if (!newStyleContext) 
-          mRestyle.Truncate();
-        else {
-          if (newStyleContext != GetStyleContext())
-            SetStyleContextWithoutNotification(newStyleContext);
-          else
-            mRestyle.Truncate();
-        }
-      }
-    }
   }
 
   // Let the base class do the rest
@@ -440,21 +408,4 @@ nsMathMLmactionFrame::MouseClick()
                          NS_FRAME_IS_DIRTY);
     }
   }
-  else if (NS_MATHML_ACTION_TYPE_RESTYLE == mActionType) {
-    if (!mRestyle.IsEmpty()) {
-      nsCOMPtr<nsIDOMElement> node( do_QueryInterface(mContent) );
-      if (node.get()) {
-        if (nsContentUtils::HasNonEmptyAttr(mContent, kNameSpaceID_None,
-                                            nsGkAtoms::actiontype_))
-          node->RemoveAttribute(NS_LITERAL_STRING("actiontype"));
-        else
-          node->SetAttribute(NS_LITERAL_STRING("actiontype"), mRestyle);
-
-        // Trigger a style change reflow
-        PresContext()->PresShell()->
-          FrameNeedsReflow(mSelectedFrame, nsIPresShell::eStyleChange,
-                           NS_FRAME_IS_DIRTY);
-      }
-    }
-  }
 }

From 6595d59ea965da9aa955c9c3fc6dd48b6c7aa6b2 Mon Sep 17 00:00:00 2001
From: Oleg Romashin <romaxa@gmail.com>
Date: Wed, 14 Sep 2011 08:51:24 +0100
Subject: [PATCH 103/209] Bug 685082 - Transparent plugins not cleared on
 Maemo; r=cjones

---
 gfx/layers/basic/BasicLayers.cpp | 1 +
 1 file changed, 1 insertion(+)

diff --git a/gfx/layers/basic/BasicLayers.cpp b/gfx/layers/basic/BasicLayers.cpp
index 3d8a391ec055..688795ffd0d4 100644
--- a/gfx/layers/basic/BasicLayers.cpp
+++ b/gfx/layers/basic/BasicLayers.cpp
@@ -2522,6 +2522,7 @@ BasicShadowableImageLayer::Paint(gfxContext* aContext)
   nsRefPtr<gfxASurface> backSurface =
     BasicManager()->OpenDescriptor(mBackBuffer);
   nsRefPtr<gfxContext> tmpCtx = new gfxContext(backSurface);
+  tmpCtx->SetOperator(gfxContext::OPERATOR_SOURCE);
   PaintContext(pat,
                nsIntRegion(nsIntRect(0, 0, mSize.width, mSize.height)),
                nsnull, 1.0, tmpCtx);

From 6b885251104a843a956d2286c13942a700938720 Mon Sep 17 00:00:00 2001
From: Oleg Romashin <romaxa@gmail.com>
Date: Wed, 14 Sep 2011 08:51:24 +0100
Subject: [PATCH 104/209] Bug 685082 - Transparent plugins not cleared on
 Maemo; r=karlt

---
 dom/plugins/ipc/PluginInstanceChild.cpp | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/dom/plugins/ipc/PluginInstanceChild.cpp b/dom/plugins/ipc/PluginInstanceChild.cpp
index 5cbde80973bf..d7fe34da42ed 100644
--- a/dom/plugins/ipc/PluginInstanceChild.cpp
+++ b/dom/plugins/ipc/PluginInstanceChild.cpp
@@ -2849,6 +2849,7 @@ PluginInstanceChild::PaintRectToPlatformSurface(const nsIntRect& aRect,
         exposeEvent.major_code = 0;
         exposeEvent.minor_code = 0;
         mPluginIface->event(&mData, reinterpret_cast<void*>(&exposeEvent));
+        aSurface->MarkDirty(gfxRect(aRect.x, aRect.y, aRect.width, aRect.height));
     } else
 #endif
     {
@@ -2926,7 +2927,7 @@ PluginInstanceChild::PaintRectToSurface(const nsIntRect& aRect,
     }
 #endif
 
-    if (aColor.a > 0.0) {
+    if (mIsTransparent && !CanPaintOnBackground()) {
        // Clear surface content for transparent rendering
        nsRefPtr<gfxContext> ctx = new gfxContext(renderSurface);
        ctx->SetColor(aColor);

From 54955c1e8bf5ab31bab0dfac9cfb314520475792 Mon Sep 17 00:00:00 2001
From: Justin Wood <Callek@gmail.com>
Date: Tue, 13 Sep 2011 01:18:01 -0400
Subject: [PATCH 105/209] Test for Bug 680113 - Select Add-ons dialog lists
 distribution add-ons as installed by the user. r=Unfocused

---
 .../test/browser/browser_select_selection.js  | 28 +++++++++++++++++++
 1 file changed, 28 insertions(+)

diff --git a/toolkit/mozapps/extensions/test/browser/browser_select_selection.js b/toolkit/mozapps/extensions/test/browser/browser_select_selection.js
index c0cbbda95f29..f4fd564640a6 100644
--- a/toolkit/mozapps/extensions/test/browser/browser_select_selection.js
+++ b/toolkit/mozapps/extensions/test/browser/browser_select_selection.js
@@ -72,11 +72,31 @@ function getString(aName) {
   return strings.GetStringFromName("action." + aName);
 }
 
+function getSourceString(aSource) {
+  if (!aSource)
+    return "";
+
+  var strings = Services.strings.createBundle("chrome://mozapps/locale/extensions/selectAddons.properties");
+  switch (aSource) {
+    case AddonManager.SCOPE_APPLICATION:
+      return strings.GetStringFromName("source.bundled");
+    case AddonManager.SCOPE_PROFILE:
+      return strings.GetStringFromName("source.profile");
+    default:
+      return strings.GetStringFromName("source.other");
+  }
+}
+
 function test() {
   waitForExplicitFinish();
 
   gProvider = new MockProvider();
 
+  // Set prefs for Distributed Extension Source tests.
+  Services.prefs.setBoolPref("extensions.installedDistroAddon.test3@tests.mozilla.org", true);
+  Services.prefs.setBoolPref("extensions.installedDistroAddon.test12@tests.mozilla.org", true);
+  Services.prefs.setBoolPref("extensions.installedDistroAddon.test15@tests.mozilla.org", true);
+
   ADDONS.forEach(function(aAddon, aPos) {
     var addon = new MockAddon("test" + aPos + "@tests.mozilla.org",
                               "Test Add-on " + aPos, "extension");
@@ -208,6 +228,14 @@ add_test(function selection_test() {
     var keep = gWin.document.getAnonymousElementByAttribute(row, "anonid", "keep");
     var action = gWin.document.getAnonymousElementByAttribute(row, "class", "addon-action-message");
     var update = gWin.document.getAnonymousElementByAttribute(row, "anonid", "update");
+    var source = gWin.document.getAnonymousElementByAttribute(row, "class", "addon-source");
+
+    if (id == 3 || id == 12 || id == 15) {
+      // Distro Installed To Profile
+      is(source.textContent, getSourceString(APP), "Source message should have the right text for Distributed Addons");
+    } else {
+      is(source.textContent, getSourceString(addon[6]), "Source message should have the right text");
+    }
 
     // Non-profile add-ons don't appear to have updates since we won't install
     // them

From f360a82fba4bd74b01305fadabd9c8d6330c2107 Mon Sep 17 00:00:00 2001
From: Makoto Kato <m_kato@ga2.so-net.ne.jp>
Date: Tue, 13 Sep 2011 16:23:42 +0900
Subject: [PATCH 106/209] Bug 686418 - [INFER] PIC doesn't work on Win64 after
 bug 557358. r=bhackett

---
 js/src/methodjit/MachineRegs.h | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/js/src/methodjit/MachineRegs.h b/js/src/methodjit/MachineRegs.h
index 26282cfe21b5..a6648d8bc924 100644
--- a/js/src/methodjit/MachineRegs.h
+++ b/js/src/methodjit/MachineRegs.h
@@ -130,11 +130,13 @@ struct Registers {
     static const RegisterID ArgReg1 = JSC::X86Registers::edx;
 #  if defined(JS_CPU_X64)
     static const RegisterID ArgReg2 = JSC::X86Registers::r8;
+    static const RegisterID ArgReg3 = JSC::X86Registers::r9;
 #  endif
 # else
     static const RegisterID ArgReg0 = JSC::X86Registers::edi;
     static const RegisterID ArgReg1 = JSC::X86Registers::esi;
     static const RegisterID ArgReg2 = JSC::X86Registers::edx;
+    static const RegisterID ArgReg3 = JSC::X86Registers::ecx;
 # endif
 #elif JS_CPU_ARM
     static const RegisterID ReturnReg = JSC::ARMRegisters::r0;
@@ -427,7 +429,7 @@ struct Registers {
         regs.takeReg(ArgReg0);
         regs.takeReg(ArgReg1);
         regs.takeReg(ArgReg2);
-#ifdef JS_CPU_SPARC
+#if defined(JS_CPU_SPARC) || defined(JS_CPU_X64)
         regs.takeReg(ArgReg3);
 #endif
 #endif

From 77be5533a616318b36f548f34df234d561db085d Mon Sep 17 00:00:00 2001
From: Makoto Kato <m_kato@ga2.so-net.ne.jp>
Date: Tue, 13 Sep 2011 18:08:17 +0900
Subject: [PATCH 107/209] Bug 685468 - warnaserr: js/src/jsinterp.cpp(6176) :
 warning C4805: '&=' : unsafe mix of type 'JSBool' and type 'bool' in
 operation. r=luke

---
 js/src/jsinterp.cpp | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/js/src/jsinterp.cpp b/js/src/jsinterp.cpp
index 6e904fdbdbef..fc524050293e 100644
--- a/js/src/jsinterp.cpp
+++ b/js/src/jsinterp.cpp
@@ -6173,7 +6173,7 @@ END_CASE(JSOP_ARRAYPUSH)
      * When a trap handler returns JSTRAP_RETURN, we jump here with
      * interpReturnOK set to true bypassing any finally blocks.
      */
-    interpReturnOK &= UnwindScope(cx, 0, interpReturnOK || cx->isExceptionPending());
+    interpReturnOK &= (JSBool)UnwindScope(cx, 0, interpReturnOK || cx->isExceptionPending());
     JS_ASSERT(regs.sp == regs.fp()->base());
 
     if (entryFrame != regs.fp())

From 34029e2a4458da75e90655a532a0a83970fe828a Mon Sep 17 00:00:00 2001
From: Matt Brubeck <mbrubeck@mozilla.com>
Date: Tue, 13 Sep 2011 07:08:31 -0700
Subject: [PATCH 108/209] Bug 686379 - Back out bug 660686 and bug 686379
 because of problems scrolling preferences

---
 mobile/chrome/content/bindings.xml            | 36 ------------
 mobile/chrome/content/browser.css             |  6 +-
 mobile/chrome/tests/Makefile.in               |  1 -
 .../tests/browser_preferences_fulltoggle.js   | 58 -------------------
 mobile/themes/core/gingerbread/browser.css    |  4 --
 5 files changed, 3 insertions(+), 102 deletions(-)
 delete mode 100644 mobile/chrome/tests/browser_preferences_fulltoggle.js

diff --git a/mobile/chrome/content/bindings.xml b/mobile/chrome/content/bindings.xml
index 8cc18199d176..2e043207b9c7 100644
--- a/mobile/chrome/content/bindings.xml
+++ b/mobile/chrome/content/bindings.xml
@@ -1852,40 +1852,4 @@
       </method>
     </implementation>
   </binding>
-  
-  <binding id="setting-fulltoggle-bool" extends="chrome://mozapps/content/extensions/setting.xml#setting-bool">
-    <handlers>
-      <handler event="click" button="0" phase="capturing">
-        <![CDATA[
-        this.input.setChecked(!this.value);
-        this.inputChanged();
-        event.stopPropagation();
-        ]]>
-      </handler>
-    </handlers>
-  </binding>
-
-  <binding id="setting-fulltoggle-boolint" extends="chrome://mozapps/content/extensions/setting.xml#setting-boolint">
-    <handlers>
-      <handler event="click" button="0" phase="capturing">
-        <![CDATA[
-        this.input.setChecked(!this.value);
-        this.inputChanged();
-        event.stopPropagation();
-        ]]>
-      </handler>
-    </handlers>
-  </binding>
-
-  <binding id="setting-fulltoggle-localized-bool" extends="chrome://mozapps/content/extensions/setting.xml#setting-localized-bool">
-    <handlers>
-      <handler event="click" button="0" phase="capturing">
-        <![CDATA[
-        this.input.setChecked(!this.value);
-        this.inputChanged();
-        event.stopPropagation();
-        ]]>
-      </handler>
-    </handlers>
-  </binding>
 </bindings>
diff --git a/mobile/chrome/content/browser.css b/mobile/chrome/content/browser.css
index a2a7ba4f1b15..f9a8b3113e10 100644
--- a/mobile/chrome/content/browser.css
+++ b/mobile/chrome/content/browser.css
@@ -27,15 +27,15 @@ settings {
 }
 
 setting[type="bool"] {
-  -moz-binding: url("chrome://browser/content/bindings.xml#setting-fulltoggle-bool");
+  -moz-binding: url("chrome://mozapps/content/extensions/setting.xml#setting-bool");
 }
 
 setting[type="bool"][localized="true"] {
-  -moz-binding: url("chrome://browser/content/bindings.xml#setting-fulltoggle-localized-bool");
+  -moz-binding: url("chrome://mozapps/content/extensions/setting.xml#setting-localized-bool");
 }
 
 setting[type="boolint"] {
-  -moz-binding: url("chrome://browser/content/bindings.xml#setting-fulltoggle-boolint");
+  -moz-binding: url("chrome://mozapps/content/extensions/setting.xml#setting-boolint");
 }
 
 setting[type="integer"] {
diff --git a/mobile/chrome/tests/Makefile.in b/mobile/chrome/tests/Makefile.in
index 28de2a13aaaa..c36b3d134776 100644
--- a/mobile/chrome/tests/Makefile.in
+++ b/mobile/chrome/tests/Makefile.in
@@ -74,7 +74,6 @@ _BROWSER_FILES = \
   browser_history.js \
   browser_mainui.js \
   browser_preferences_text.js \
-  browser_preferences_fulltoggle.js \
   browser_rect.js \
   browser_rememberPassword.js \
   browser_scroll.js \
diff --git a/mobile/chrome/tests/browser_preferences_fulltoggle.js b/mobile/chrome/tests/browser_preferences_fulltoggle.js
deleted file mode 100644
index 0e6603849679..000000000000
--- a/mobile/chrome/tests/browser_preferences_fulltoggle.js
+++ /dev/null
@@ -1,58 +0,0 @@
-// browser-chrome test for fennec preferences to toggle values while clicking on the preference name
-
-var gTests = [];
-var gCurrentTest = null;
-
-function test() {
-  // The "runNextTest" approach is async, so we need to call "waitForExplicitFinish()"
-  // We call "finish()" when the tests are finished
-  waitForExplicitFinish();
-
-  // Start the tests
-  runNextTest();
-}
-//------------------------------------------------------------------------------
-// Iterating tests by shifting test out one by one as runNextTest is called.
-function runNextTest() {
-  // Run the next test until all tests completed
-  if (gTests.length > 0) {
-    gCurrentTest = gTests.shift();
-    info(gCurrentTest.desc);
-    gCurrentTest.run();
-  }
-  else {
-    // Cleanup. All tests are completed at this point
-    finish();
-  }
-}
-
-// -----------------------------------------------------------------------------------------
-// Verify preferences and text
-gTests.push({
-  desc: "Verify full toggle on Preferences",
-
-  run: function(){
-    // 1.Click preferences to view prefs
-    document.getElementById("tool-panel-open").click();
-    is(document.getElementById("panel-container").hidden, false, "Preferences should be visible");
-
-    var contentRegion = document.getElementById("prefs-content");
-
-    // Check for *Show images*
-    var imageRegion = document.getAnonymousElementByAttribute(contentRegion, "pref", "permissions.default.image");
-    var imageValue  = imageRegion.value;
-    var imageTitle  = document.getAnonymousElementByAttribute(imageRegion, "class", "preferences-title");
-    var imageButton = document.getAnonymousElementByAttribute(imageRegion, "anonid", "input");
-    imageButton.click();
-    is(imageRegion.value, !imageValue, "Tapping on input control should change the value");
-    imageTitle.click();
-    is(imageRegion.value, imageValue, "Tapping on the title should change the value"); 
-    imageRegion.click();
-    is(imageRegion.value, !imageValue, "Tapping on the setting should change the value"); 
-
-    BrowserUI.hidePanel();
-    is(document.getElementById("panel-container").hidden, true, "Preferences panel should be closed");
-    runNextTest();
-  }
-});
-
diff --git a/mobile/themes/core/gingerbread/browser.css b/mobile/themes/core/gingerbread/browser.css
index bf2b1fd683c3..e75b3389fbe8 100644
--- a/mobile/themes/core/gingerbread/browser.css
+++ b/mobile/themes/core/gingerbread/browser.css
@@ -1244,10 +1244,6 @@ setting {
   -moz-box-orient: horizontal;
 }
 
-setting:hover:active {
-  background-color: @color_background_highlight@;
-}
-
 .setting-label {
   -moz-box-flex: 1;
 }

From 59938b9537a11f617e4dc15bf9582a4778fe0817 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Florian=20H=C3=A4nel?= <florian.haenel@heeen.de>
Date: Tue, 13 Sep 2011 07:10:11 -0700
Subject: [PATCH 109/209] Bug 686450 - Hard-code layout DPI on Maemo
 [r=mbrubeck]

---
 mobile/app/mobile.js | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/mobile/app/mobile.js b/mobile/app/mobile.js
index e22c69cd20cd..4c71d8bc2ff0 100644
--- a/mobile/app/mobile.js
+++ b/mobile/app/mobile.js
@@ -78,9 +78,11 @@ pref("browser.viewport.desktopWidth", 980);
 #ifndef MOZ_PLATFORM_MAEMO
 // On desktop builds, simulate an MDPI tablet by default.
 pref("layout.css.dpi", 160);
+#else
+// Maemo X11 lies about its dpi
+pref("layout.css.dpi", 240);
 #endif
 #endif
-
 /* allow scrollbars to float above chrome ui */
 pref("ui.scrollbarsCanOverlapContent", 1);
 

From 501895f6d6e151a4615d3d375d62825df2b8dd7f Mon Sep 17 00:00:00 2001
From: Ehsan Akhgari <ehsan@mozilla.com>
Date: Tue, 13 Sep 2011 11:39:40 -0400
Subject: [PATCH 110/209] Bug 414178 - Do not allow to inject a list outside of
 the active editing host; r=roc

---
 .../libeditor/html/crashtests/414178-1.html   | 22 +++++++++++++++++++
 .../libeditor/html/crashtests/crashtests.list |  1 +
 editor/libeditor/html/nsHTMLEditRules.cpp     |  7 ++++++
 3 files changed, 30 insertions(+)
 create mode 100644 editor/libeditor/html/crashtests/414178-1.html

diff --git a/editor/libeditor/html/crashtests/414178-1.html b/editor/libeditor/html/crashtests/414178-1.html
new file mode 100644
index 000000000000..19cc205b9195
--- /dev/null
+++ b/editor/libeditor/html/crashtests/414178-1.html
@@ -0,0 +1,22 @@
+<!DOCTYPE html>
+<html>
+<head>
+<script type="text/javascript">
+
+function boom()
+{
+  var table = document.createElement("table");
+  document.body.appendChild(table);
+  table.contentEditable = "true";
+  table.focus();
+  try {
+    // This will throw, since it's attempting to inject a list inside a table
+    document.execCommand("insertunorderedlist", false, null);
+  } catch (e) {}
+}
+
+</script>
+</head>
+
+<body onload="boom();"></body>
+</html>
diff --git a/editor/libeditor/html/crashtests/crashtests.list b/editor/libeditor/html/crashtests/crashtests.list
index 85e59eb17730..f5afec4c5368 100644
--- a/editor/libeditor/html/crashtests/crashtests.list
+++ b/editor/libeditor/html/crashtests/crashtests.list
@@ -2,6 +2,7 @@ load 336081-1.xhtml
 load 382778-1.html
 load 407074-1.html
 load 407277-1.html
+load 414178-1.html
 load 418923-1.html
 asserts(0-16) load 420439.html # Bug 439258
 load 428489-1.html
diff --git a/editor/libeditor/html/nsHTMLEditRules.cpp b/editor/libeditor/html/nsHTMLEditRules.cpp
index 905c1395d2f3..c6acf056b735 100644
--- a/editor/libeditor/html/nsHTMLEditRules.cpp
+++ b/editor/libeditor/html/nsHTMLEditRules.cpp
@@ -7335,6 +7335,13 @@ nsHTMLEditRules::SplitAsNeeded(const nsAString *aTag,
     // sniffing up the parent tree until we find 
     // a legal place for the block
     if (!parent) break;
+    // Don't leave the active editing host
+    if (!mHTMLEditor->IsNodeInActiveEditor(parent)) {
+      nsCOMPtr<nsIContent> parentContent = do_QueryInterface(parent);
+      if (parentContent != mHTMLEditor->GetActiveEditingHost()) {
+        break;
+      }
+    }
     if (mHTMLEditor->CanContainTag(parent, *aTag))
     {
       tagParent = parent;

From 4d7f2bb145bd7c7e94e67c10e4a4129b5f684af9 Mon Sep 17 00:00:00 2001
From: Ehsan Akhgari <ehsan@mozilla.com>
Date: Tue, 13 Sep 2011 11:45:54 -0400
Subject: [PATCH 111/209] Bug 686247 - Text control frames should accept
 dynamic changes to the CSS overflow property; r=bzbarsky,surkov

---
 .../mochitest/tree/test_cssoverflow.html      | 28 ++++++++-----------
 .../html/content/src/nsTextEditorState.cpp    | 27 +++++++++++-------
 content/html/content/src/nsTextEditorState.h  |  2 ++
 .../editor/dynamic-overflow-change-ref.html   | 13 +++++++++
 .../editor/dynamic-overflow-change.html       | 13 +++++++++
 layout/reftests/editor/reftest.list           |  1 +
 layout/style/nsStyleStruct.cpp                |  4 +--
 7 files changed, 59 insertions(+), 29 deletions(-)
 create mode 100644 layout/reftests/editor/dynamic-overflow-change-ref.html
 create mode 100644 layout/reftests/editor/dynamic-overflow-change.html

diff --git a/accessible/tests/mochitest/tree/test_cssoverflow.html b/accessible/tests/mochitest/tree/test_cssoverflow.html
index 1a955f80cee1..c7d38e3e08e0 100644
--- a/accessible/tests/mochitest/tree/test_cssoverflow.html
+++ b/accessible/tests/mochitest/tree/test_cssoverflow.html
@@ -32,11 +32,8 @@
       this.link = getAccessible(this.linkNode);
 
       this.eventSeq = [
-        new invokerChecker(EVENT_FOCUS, getAccessible, this.linkNode)
-      ];
-
-      this.unexpectedEventSeq = [
-        new invokerChecker(EVENT_REORDER, this.linkNode.parentNode)
+        new invokerChecker(EVENT_FOCUS, getAccessible, this.linkNode),
+        new asyncInvokerChecker(EVENT_REORDER, this.linkNode.parentNode)
       ];
 
       this.invoke = function focusAnchor_invoke()
@@ -46,8 +43,8 @@
 
       this.check = function focusAnchor_check(aEvent)
       {
-        is(this.link, aEvent.accessible,
-           "The link accessible shouldn't be recreated!");
+        todo_is(this.link, aEvent.accessible,
+                "Focus should be fired against new link accessible!");
       }
 
       this.getID = function focusAnchor_getID()
@@ -62,11 +59,8 @@
       this.link = getAccessible(this.linkNode);
 
       this.eventSeq = [
-        new invokerChecker(EVENT_FOCUS, getAccessible, this.linkNode)
-      ];
-
-      this.unexpectedEventSeq = [
-        new invokerChecker(EVENT_REORDER, this.linkNode.parentNode)
+        new invokerChecker(EVENT_FOCUS, getAccessible, this.linkNode),
+        new asyncInvokerChecker(EVENT_REORDER, this.linkNode.parentNode)
       ];
 
       this.invoke = function tabAnchor_invoke()
@@ -76,8 +70,8 @@
 
       this.check = function tabAnchor_check(aEvent)
       {
-        is(this.link, aEvent.accessible,
-           "The link accessible shouldn't be recreated!");
+        todo_isnot(this.link, aEvent.accessible,
+                   "Focus should be fired against new link accessible!");
       }
 
       this.getID = function tabAnchor_getID()
@@ -126,9 +120,9 @@
     Mozilla Bug 570275
   </a><br>
   <a target="_blank"
-     title="Don't recreate frames for inlines with overflow style applied"
-     href="https://bugzilla.mozilla.org/show_bug.cgi?id=606087">
-    Mozilla Bug 606087
+     title="Text control frames should accept dynamic changes to the CSS overflow property"
+     href="https://bugzilla.mozilla.org/show_bug.cgi?id=686247">
+    Mozilla Bug 686247
   </a><br>
 
   <p id="display"></p>
diff --git a/content/html/content/src/nsTextEditorState.cpp b/content/html/content/src/nsTextEditorState.cpp
index b91a54bd083c..28b24cf6ef24 100644
--- a/content/html/content/src/nsTextEditorState.cpp
+++ b/content/html/content/src/nsTextEditorState.cpp
@@ -1058,6 +1058,9 @@ nsTextEditorState::BindToFrame(nsTextControlFrame* aFrame)
 
   nsIContent *rootNode = GetRootNode();
 
+  nsresult rv = InitializeRootNode();
+  NS_ENSURE_SUCCESS(rv, rv);
+
   nsIPresShell *shell = mBoundFrame->PresContext()->GetPresShell();
   NS_ENSURE_TRUE(shell, NS_ERROR_FAILURE);
 
@@ -1545,6 +1548,17 @@ nsTextEditorState::CreateRootNode()
                                   NOT_FROM_PARSER);
   NS_ENSURE_SUCCESS(rv, rv);
 
+  if (!IsSingleLineTextControl()) {
+    mMutationObserver = new nsAnonDivObserver(this);
+    mRootNode->AddMutationObserver(mMutationObserver);
+  }
+
+  return rv;
+}
+
+nsresult
+nsTextEditorState::InitializeRootNode()
+{
   // Set the necessary classes on the text control. We use class values
   // instead of a 'style' attribute so that the style comes from a user-agent
   // style sheet and is still applied even if author styles are disabled.
@@ -1564,19 +1578,12 @@ nsTextEditorState::CreateRootNode()
         disp->mOverflowX != NS_STYLE_OVERFLOW_CLIP) {
       classValue.AppendLiteral(" inherit-overflow");
     }
-
-    mMutationObserver = new nsAnonDivObserver(this);
-    NS_ENSURE_TRUE(mMutationObserver, NS_ERROR_OUT_OF_MEMORY);
-    mRootNode->AddMutationObserver(mMutationObserver);
   }
-  rv = mRootNode->SetAttr(kNameSpaceID_None, nsGkAtoms::_class,
-                          classValue, PR_FALSE);
+  nsresult rv = mRootNode->SetAttr(kNameSpaceID_None, nsGkAtoms::_class,
+                                   classValue, PR_FALSE);
   NS_ENSURE_SUCCESS(rv, rv);
 
-  rv = mBoundFrame->UpdateValueDisplay(PR_FALSE);
-  NS_ENSURE_SUCCESS(rv, rv);
-
-  return rv;
+  return mBoundFrame->UpdateValueDisplay(PR_FALSE);
 }
 
 nsresult
diff --git a/content/html/content/src/nsTextEditorState.h b/content/html/content/src/nsTextEditorState.h
index 2e6a6b3a408f..56d162dddb38 100644
--- a/content/html/content/src/nsTextEditorState.h
+++ b/content/html/content/src/nsTextEditorState.h
@@ -253,6 +253,8 @@ private:
   void DestroyEditor();
   void Clear();
 
+  nsresult InitializeRootNode();
+
   void FinishedRestoringSelection() { mRestoringSelection = nsnull; }
 
   class InitializationGuard {
diff --git a/layout/reftests/editor/dynamic-overflow-change-ref.html b/layout/reftests/editor/dynamic-overflow-change-ref.html
new file mode 100644
index 000000000000..52e5f5bb0dd1
--- /dev/null
+++ b/layout/reftests/editor/dynamic-overflow-change-ref.html
@@ -0,0 +1,13 @@
+<!DOCTYPE html>
+<html>
+  <body>
+    <textarea rows="2" style="overflow: hidden;">
+      this
+      is
+      a
+      textarea
+      with
+      overflow
+    </textarea>
+  </body>
+</html>
diff --git a/layout/reftests/editor/dynamic-overflow-change.html b/layout/reftests/editor/dynamic-overflow-change.html
new file mode 100644
index 000000000000..57a1b8f74efe
--- /dev/null
+++ b/layout/reftests/editor/dynamic-overflow-change.html
@@ -0,0 +1,13 @@
+<!DOCTYPE html>
+<html>
+  <body onload="document.querySelector('textarea').style.overflow='hidden'">
+    <textarea rows="2">
+      this
+      is
+      a
+      textarea
+      with
+      overflow
+    </textarea>
+  </body>
+</html>
diff --git a/layout/reftests/editor/reftest.list b/layout/reftests/editor/reftest.list
index 95c0302400d0..4c51f4040478 100644
--- a/layout/reftests/editor/reftest.list
+++ b/layout/reftests/editor/reftest.list
@@ -69,3 +69,4 @@ skip-if(Android) == 674212-spellcheck.html 674212-spellcheck-ref.html
 skip-if(Android) == 338427-2.html 338427-2-ref.html
 skip-if(Android) == 338427-3.html 338427-3-ref.html
 skip-if(Android) == 462758-grabbers-resizers.html 462758-grabbers-resizers-ref.html
+== dynamic-overflow-change.html dynamic-overflow-change-ref.html
diff --git a/layout/style/nsStyleStruct.cpp b/layout/style/nsStyleStruct.cpp
index 06a7f5cb2341..f6217f120d76 100644
--- a/layout/style/nsStyleStruct.cpp
+++ b/layout/style/nsStyleStruct.cpp
@@ -2180,8 +2180,8 @@ nsChangeHint nsStyleDisplay::CalcDifference(const nsStyleDisplay& aOther) const
       || mPosition != aOther.mPosition
       || mDisplay != aOther.mDisplay
       || (mFloats == NS_STYLE_FLOAT_NONE) != (aOther.mFloats == NS_STYLE_FLOAT_NONE)
-      || (mOverflowX != aOther.mOverflowX && mDisplay != NS_STYLE_DISPLAY_INLINE)
-      || (mOverflowY != aOther.mOverflowY && mDisplay != NS_STYLE_DISPLAY_INLINE)
+      || mOverflowX != aOther.mOverflowX
+      || mOverflowY != aOther.mOverflowY
       || mResize != aOther.mResize)
     NS_UpdateHint(hint, nsChangeHint_ReconstructFrame);
 

From f41d89e05124c165f8eba10686abde41ff4fefbc Mon Sep 17 00:00:00 2001
From: Ehsan Akhgari <ehsan@mozilla.com>
Date: Tue, 13 Sep 2011 12:49:59 -0400
Subject: [PATCH 112/209] Bug 686342 - Uninitialize the XUL template builder
 when XPCOM is being destroyed; r=bzbarsky

---
 content/xul/templates/src/nsXULTemplateBuilder.cpp | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/content/xul/templates/src/nsXULTemplateBuilder.cpp b/content/xul/templates/src/nsXULTemplateBuilder.cpp
index 8cd66466ec74..54fab0d91979 100644
--- a/content/xul/templates/src/nsXULTemplateBuilder.cpp
+++ b/content/xul/templates/src/nsXULTemplateBuilder.cpp
@@ -224,6 +224,7 @@ nsXULTemplateBuilder::Uninit(PRBool aIsFinal)
 {
     if (mObservedDocument && aIsFinal) {
         gObserverService->RemoveObserver(this, DOM_WINDOW_DESTROYED_TOPIC);
+        gObserverService->RemoveObserver(this, NS_XPCOM_SHUTDOWN_OBSERVER_ID);
         mObservedDocument->RemoveObserver(this);
         mObservedDocument = nsnull;
     }
@@ -465,6 +466,8 @@ nsXULTemplateBuilder::Init(nsIContent* aElement)
         doc->AddObserver(this);
 
         mObservedDocument = doc;
+        gObserverService->AddObserver(this, NS_XPCOM_SHUTDOWN_OBSERVER_ID,
+                                      PR_FALSE);
         gObserverService->AddObserver(this, DOM_WINDOW_DESTROYED_TOPIC,
                                       PR_FALSE);
     }
@@ -1117,6 +1120,8 @@ nsXULTemplateBuilder::Observe(nsISupports* aSubject,
             if (doc && doc == mObservedDocument)
                 NodeWillBeDestroyed(doc);
         }
+    } else if (!strcmp(aTopic, NS_XPCOM_SHUTDOWN_OBSERVER_ID)) {
+        UninitTrue();
     }
     return NS_OK;
 }

From 23974947f60b1dfa8517dd161cd10364770f2971 Mon Sep 17 00:00:00 2001
From: Ehsan Akhgari <ehsan@mozilla.com>
Date: Tue, 13 Sep 2011 13:29:30 -0400
Subject: [PATCH 113/209] Backed out changeset c9013399fa39 (bug 686247)
 because of mochitest-a11y failures on Linux

---
 .../mochitest/tree/test_cssoverflow.html      | 28 +++++++++++--------
 .../html/content/src/nsTextEditorState.cpp    | 27 +++++++-----------
 content/html/content/src/nsTextEditorState.h  |  2 --
 .../editor/dynamic-overflow-change-ref.html   | 13 ---------
 .../editor/dynamic-overflow-change.html       | 13 ---------
 layout/reftests/editor/reftest.list           |  1 -
 layout/style/nsStyleStruct.cpp                |  4 +--
 7 files changed, 29 insertions(+), 59 deletions(-)
 delete mode 100644 layout/reftests/editor/dynamic-overflow-change-ref.html
 delete mode 100644 layout/reftests/editor/dynamic-overflow-change.html

diff --git a/accessible/tests/mochitest/tree/test_cssoverflow.html b/accessible/tests/mochitest/tree/test_cssoverflow.html
index c7d38e3e08e0..1a955f80cee1 100644
--- a/accessible/tests/mochitest/tree/test_cssoverflow.html
+++ b/accessible/tests/mochitest/tree/test_cssoverflow.html
@@ -32,8 +32,11 @@
       this.link = getAccessible(this.linkNode);
 
       this.eventSeq = [
-        new invokerChecker(EVENT_FOCUS, getAccessible, this.linkNode),
-        new asyncInvokerChecker(EVENT_REORDER, this.linkNode.parentNode)
+        new invokerChecker(EVENT_FOCUS, getAccessible, this.linkNode)
+      ];
+
+      this.unexpectedEventSeq = [
+        new invokerChecker(EVENT_REORDER, this.linkNode.parentNode)
       ];
 
       this.invoke = function focusAnchor_invoke()
@@ -43,8 +46,8 @@
 
       this.check = function focusAnchor_check(aEvent)
       {
-        todo_is(this.link, aEvent.accessible,
-                "Focus should be fired against new link accessible!");
+        is(this.link, aEvent.accessible,
+           "The link accessible shouldn't be recreated!");
       }
 
       this.getID = function focusAnchor_getID()
@@ -59,8 +62,11 @@
       this.link = getAccessible(this.linkNode);
 
       this.eventSeq = [
-        new invokerChecker(EVENT_FOCUS, getAccessible, this.linkNode),
-        new asyncInvokerChecker(EVENT_REORDER, this.linkNode.parentNode)
+        new invokerChecker(EVENT_FOCUS, getAccessible, this.linkNode)
+      ];
+
+      this.unexpectedEventSeq = [
+        new invokerChecker(EVENT_REORDER, this.linkNode.parentNode)
       ];
 
       this.invoke = function tabAnchor_invoke()
@@ -70,8 +76,8 @@
 
       this.check = function tabAnchor_check(aEvent)
       {
-        todo_isnot(this.link, aEvent.accessible,
-                   "Focus should be fired against new link accessible!");
+        is(this.link, aEvent.accessible,
+           "The link accessible shouldn't be recreated!");
       }
 
       this.getID = function tabAnchor_getID()
@@ -120,9 +126,9 @@
     Mozilla Bug 570275
   </a><br>
   <a target="_blank"
-     title="Text control frames should accept dynamic changes to the CSS overflow property"
-     href="https://bugzilla.mozilla.org/show_bug.cgi?id=686247">
-    Mozilla Bug 686247
+     title="Don't recreate frames for inlines with overflow style applied"
+     href="https://bugzilla.mozilla.org/show_bug.cgi?id=606087">
+    Mozilla Bug 606087
   </a><br>
 
   <p id="display"></p>
diff --git a/content/html/content/src/nsTextEditorState.cpp b/content/html/content/src/nsTextEditorState.cpp
index 28b24cf6ef24..b91a54bd083c 100644
--- a/content/html/content/src/nsTextEditorState.cpp
+++ b/content/html/content/src/nsTextEditorState.cpp
@@ -1058,9 +1058,6 @@ nsTextEditorState::BindToFrame(nsTextControlFrame* aFrame)
 
   nsIContent *rootNode = GetRootNode();
 
-  nsresult rv = InitializeRootNode();
-  NS_ENSURE_SUCCESS(rv, rv);
-
   nsIPresShell *shell = mBoundFrame->PresContext()->GetPresShell();
   NS_ENSURE_TRUE(shell, NS_ERROR_FAILURE);
 
@@ -1548,17 +1545,6 @@ nsTextEditorState::CreateRootNode()
                                   NOT_FROM_PARSER);
   NS_ENSURE_SUCCESS(rv, rv);
 
-  if (!IsSingleLineTextControl()) {
-    mMutationObserver = new nsAnonDivObserver(this);
-    mRootNode->AddMutationObserver(mMutationObserver);
-  }
-
-  return rv;
-}
-
-nsresult
-nsTextEditorState::InitializeRootNode()
-{
   // Set the necessary classes on the text control. We use class values
   // instead of a 'style' attribute so that the style comes from a user-agent
   // style sheet and is still applied even if author styles are disabled.
@@ -1578,12 +1564,19 @@ nsTextEditorState::InitializeRootNode()
         disp->mOverflowX != NS_STYLE_OVERFLOW_CLIP) {
       classValue.AppendLiteral(" inherit-overflow");
     }
+
+    mMutationObserver = new nsAnonDivObserver(this);
+    NS_ENSURE_TRUE(mMutationObserver, NS_ERROR_OUT_OF_MEMORY);
+    mRootNode->AddMutationObserver(mMutationObserver);
   }
-  nsresult rv = mRootNode->SetAttr(kNameSpaceID_None, nsGkAtoms::_class,
-                                   classValue, PR_FALSE);
+  rv = mRootNode->SetAttr(kNameSpaceID_None, nsGkAtoms::_class,
+                          classValue, PR_FALSE);
   NS_ENSURE_SUCCESS(rv, rv);
 
-  return mBoundFrame->UpdateValueDisplay(PR_FALSE);
+  rv = mBoundFrame->UpdateValueDisplay(PR_FALSE);
+  NS_ENSURE_SUCCESS(rv, rv);
+
+  return rv;
 }
 
 nsresult
diff --git a/content/html/content/src/nsTextEditorState.h b/content/html/content/src/nsTextEditorState.h
index 56d162dddb38..2e6a6b3a408f 100644
--- a/content/html/content/src/nsTextEditorState.h
+++ b/content/html/content/src/nsTextEditorState.h
@@ -253,8 +253,6 @@ private:
   void DestroyEditor();
   void Clear();
 
-  nsresult InitializeRootNode();
-
   void FinishedRestoringSelection() { mRestoringSelection = nsnull; }
 
   class InitializationGuard {
diff --git a/layout/reftests/editor/dynamic-overflow-change-ref.html b/layout/reftests/editor/dynamic-overflow-change-ref.html
deleted file mode 100644
index 52e5f5bb0dd1..000000000000
--- a/layout/reftests/editor/dynamic-overflow-change-ref.html
+++ /dev/null
@@ -1,13 +0,0 @@
-<!DOCTYPE html>
-<html>
-  <body>
-    <textarea rows="2" style="overflow: hidden;">
-      this
-      is
-      a
-      textarea
-      with
-      overflow
-    </textarea>
-  </body>
-</html>
diff --git a/layout/reftests/editor/dynamic-overflow-change.html b/layout/reftests/editor/dynamic-overflow-change.html
deleted file mode 100644
index 57a1b8f74efe..000000000000
--- a/layout/reftests/editor/dynamic-overflow-change.html
+++ /dev/null
@@ -1,13 +0,0 @@
-<!DOCTYPE html>
-<html>
-  <body onload="document.querySelector('textarea').style.overflow='hidden'">
-    <textarea rows="2">
-      this
-      is
-      a
-      textarea
-      with
-      overflow
-    </textarea>
-  </body>
-</html>
diff --git a/layout/reftests/editor/reftest.list b/layout/reftests/editor/reftest.list
index 4c51f4040478..95c0302400d0 100644
--- a/layout/reftests/editor/reftest.list
+++ b/layout/reftests/editor/reftest.list
@@ -69,4 +69,3 @@ skip-if(Android) == 674212-spellcheck.html 674212-spellcheck-ref.html
 skip-if(Android) == 338427-2.html 338427-2-ref.html
 skip-if(Android) == 338427-3.html 338427-3-ref.html
 skip-if(Android) == 462758-grabbers-resizers.html 462758-grabbers-resizers-ref.html
-== dynamic-overflow-change.html dynamic-overflow-change-ref.html
diff --git a/layout/style/nsStyleStruct.cpp b/layout/style/nsStyleStruct.cpp
index f6217f120d76..06a7f5cb2341 100644
--- a/layout/style/nsStyleStruct.cpp
+++ b/layout/style/nsStyleStruct.cpp
@@ -2180,8 +2180,8 @@ nsChangeHint nsStyleDisplay::CalcDifference(const nsStyleDisplay& aOther) const
       || mPosition != aOther.mPosition
       || mDisplay != aOther.mDisplay
       || (mFloats == NS_STYLE_FLOAT_NONE) != (aOther.mFloats == NS_STYLE_FLOAT_NONE)
-      || mOverflowX != aOther.mOverflowX
-      || mOverflowY != aOther.mOverflowY
+      || (mOverflowX != aOther.mOverflowX && mDisplay != NS_STYLE_DISPLAY_INLINE)
+      || (mOverflowY != aOther.mOverflowY && mDisplay != NS_STYLE_DISPLAY_INLINE)
       || mResize != aOther.mResize)
     NS_UpdateHint(hint, nsChangeHint_ReconstructFrame);
 

From 5087d14cfb62c95249b72db947592047a705b053 Mon Sep 17 00:00:00 2001
From: James Hobin <hobinjk@gmail.com>
Date: Wed, 14 Sep 2011 16:34:25 +0100
Subject: [PATCH 114/209] Bug 659576 - bool
 nsGlobalWindow::ConfirmDialogAllowed() returns nsresult; r=jst

---
 dom/base/nsGlobalWindow.cpp | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/dom/base/nsGlobalWindow.cpp b/dom/base/nsGlobalWindow.cpp
index db74defd5376..6ba4cfdd1e52 100644
--- a/dom/base/nsGlobalWindow.cpp
+++ b/dom/base/nsGlobalWindow.cpp
@@ -2675,7 +2675,7 @@ nsGlobalWindow::AreDialogsBlocked()
 bool
 nsGlobalWindow::ConfirmDialogAllowed()
 {
-  FORWARD_TO_OUTER(ConfirmDialogAllowed, (), NS_ERROR_NOT_INITIALIZED);
+  FORWARD_TO_OUTER(ConfirmDialogAllowed, (), false);
 
   NS_ENSURE_TRUE(mDocShell, false);
   nsCOMPtr<nsIPromptService> promptSvc =

From 0693fea49cb7840504fc9e2892f97f63d8defa99 Mon Sep 17 00:00:00 2001
From: Phil Ringnalda <philringnalda@gmail.com>
Date: Wed, 14 Sep 2011 09:10:41 -0700
Subject: [PATCH 115/209] Back out 307b5fa030fd (bug 683280) for timeouts in
 test_ipAddressOrigin.html

---
 content/base/src/ThirdPartyUtil.cpp          | 79 ++++++++++----------
 content/base/src/ThirdPartyUtil.h            |  1 +
 dom/workers/WorkerPrivate.cpp                | 12 +--
 dom/workers/test/Makefile.in                 |  3 -
 dom/workers/test/ipAddressOrigin_iframe.html | 23 ------
 dom/workers/test/ipAddressOrigin_worker.js   |  5 --
 dom/workers/test/test_ipAddressOrigin.html   | 42 -----------
 netwerk/base/public/mozIThirdPartyUtil.idl   | 20 +----
 8 files changed, 48 insertions(+), 137 deletions(-)
 delete mode 100644 dom/workers/test/ipAddressOrigin_iframe.html
 delete mode 100644 dom/workers/test/ipAddressOrigin_worker.js
 delete mode 100644 dom/workers/test/test_ipAddressOrigin.html

diff --git a/content/base/src/ThirdPartyUtil.cpp b/content/base/src/ThirdPartyUtil.cpp
index ebe7ebdc6019..b195af9f48e6 100644
--- a/content/base/src/ThirdPartyUtil.cpp
+++ b/content/base/src/ThirdPartyUtil.cpp
@@ -57,6 +57,46 @@ ThirdPartyUtil::Init()
   return rv;
 }
 
+// Get the base domain for aHostURI; e.g. for "www.bbc.co.uk", this would be
+// "bbc.co.uk". Only properly-formed URI's are tolerated, though a trailing
+// dot may be present. If aHostURI is an IP address, an alias such as
+// 'localhost', an eTLD such as 'co.uk', or the empty string, aBaseDomain will
+// be the exact host. The result of this function should only be used in exact
+// string comparisons, since substring comparisons will not be valid for the
+// special cases elided above.
+nsresult
+ThirdPartyUtil::GetBaseDomain(nsIURI* aHostURI,
+                              nsCString& aBaseDomain)
+{
+  // Get the base domain. this will fail if the host contains a leading dot,
+  // more than one trailing dot, or is otherwise malformed.
+  nsresult rv = mTLDService->GetBaseDomain(aHostURI, 0, aBaseDomain);
+  if (rv == NS_ERROR_HOST_IS_IP_ADDRESS ||
+      rv == NS_ERROR_INSUFFICIENT_DOMAIN_LEVELS) {
+    // aHostURI is either an IP address, an alias such as 'localhost', an eTLD
+    // such as 'co.uk', or the empty string. Uses the normalized host in such
+    // cases.
+    rv = aHostURI->GetAsciiHost(aBaseDomain);
+  }
+  NS_ENSURE_SUCCESS(rv, rv);
+
+  // aHostURI (and thus aBaseDomain) may be the string '.'. If so, fail.
+  if (aBaseDomain.Length() == 1 && aBaseDomain.Last() == '.')
+    return NS_ERROR_INVALID_ARG;
+
+  // Reject any URIs without a host that aren't file:// URIs. This makes it the
+  // only way we can get a base domain consisting of the empty string, which
+  // means we can safely perform foreign tests on such URIs where "not foreign"
+  // means "the involved URIs are all file://".
+  if (aBaseDomain.IsEmpty()) {
+    PRBool isFileURI = PR_FALSE;
+    aHostURI->SchemeIs("file", &isFileURI);
+    NS_ENSURE_TRUE(isFileURI, NS_ERROR_INVALID_ARG);
+  }
+
+  return NS_OK;
+}
+
 // Determine if aFirstDomain is a different base domain to aSecondURI; or, if
 // the concept of base domain does not apply, determine if the two hosts are not
 // string-identical.
@@ -276,42 +316,3 @@ ThirdPartyUtil::IsThirdPartyChannel(nsIChannel* aChannel,
   return IsThirdPartyWindow(ourWin, channelURI, aResult);
 }
 
-// Get the base domain for aHostURI; e.g. for "www.bbc.co.uk", this would be
-// "bbc.co.uk". Only properly-formed URI's are tolerated, though a trailing
-// dot may be present. If aHostURI is an IP address, an alias such as
-// 'localhost', an eTLD such as 'co.uk', or the empty string, aBaseDomain will
-// be the exact host. The result of this function should only be used in exact
-// string comparisons, since substring comparisons will not be valid for the
-// special cases elided above.
-NS_IMETHODIMP
-ThirdPartyUtil::GetBaseDomain(nsIURI* aHostURI,
-                              nsACString& aBaseDomain)
-{
-  // Get the base domain. this will fail if the host contains a leading dot,
-  // more than one trailing dot, or is otherwise malformed.
-  nsresult rv = mTLDService->GetBaseDomain(aHostURI, 0, aBaseDomain);
-  if (rv == NS_ERROR_HOST_IS_IP_ADDRESS ||
-      rv == NS_ERROR_INSUFFICIENT_DOMAIN_LEVELS) {
-    // aHostURI is either an IP address, an alias such as 'localhost', an eTLD
-    // such as 'co.uk', or the empty string. Uses the normalized host in such
-    // cases.
-    rv = aHostURI->GetAsciiHost(aBaseDomain);
-  }
-  NS_ENSURE_SUCCESS(rv, rv);
-
-  // aHostURI (and thus aBaseDomain) may be the string '.'. If so, fail.
-  if (aBaseDomain.Length() == 1 && aBaseDomain.Last() == '.')
-    return NS_ERROR_INVALID_ARG;
-
-  // Reject any URIs without a host that aren't file:// URIs. This makes it the
-  // only way we can get a base domain consisting of the empty string, which
-  // means we can safely perform foreign tests on such URIs where "not foreign"
-  // means "the involved URIs are all file://".
-  if (aBaseDomain.IsEmpty()) {
-    PRBool isFileURI = PR_FALSE;
-    aHostURI->SchemeIs("file", &isFileURI);
-    NS_ENSURE_TRUE(isFileURI, NS_ERROR_INVALID_ARG);
-  }
-
-  return NS_OK;
-}
diff --git a/content/base/src/ThirdPartyUtil.h b/content/base/src/ThirdPartyUtil.h
index 164f13e6e696..85cb84902e6f 100644
--- a/content/base/src/ThirdPartyUtil.h
+++ b/content/base/src/ThirdPartyUtil.h
@@ -56,6 +56,7 @@ public:
   nsresult Init();
 
 private:
+  nsresult GetBaseDomain(nsIURI* aHostURI, nsCString& aBaseDomain);
   nsresult IsThirdPartyInternal(const nsCString& aFirstDomain,
     nsIURI* aSecondURI, PRBool* aResult);
   static already_AddRefed<nsIURI> GetURIFromWindow(nsIDOMWindow* aWin);
diff --git a/dom/workers/WorkerPrivate.cpp b/dom/workers/WorkerPrivate.cpp
index db58af4d4306..07d0d0afb724 100644
--- a/dom/workers/WorkerPrivate.cpp
+++ b/dom/workers/WorkerPrivate.cpp
@@ -39,11 +39,11 @@
 
 #include "WorkerPrivate.h"
 
-#include "mozIThirdPartyUtil.h"
 #include "nsIClassInfo.h"
 #include "nsIConsoleService.h"
 #include "nsIDOMFile.h"
 #include "nsIDocument.h"
+#include "nsIEffectiveTLDService.h"
 #include "nsIJSContextStack.h"
 #include "nsIMemoryReporter.h"
 #include "nsIScriptError.h"
@@ -2329,14 +2329,14 @@ WorkerPrivate::Create(JSContext* aCx, JSObject* aObj, WorkerPrivate* aParent,
           domain = file;
         }
         else {
-          nsCOMPtr<mozIThirdPartyUtil> thirdPartyUtil =
-            do_GetService(THIRDPARTYUTIL_CONTRACTID);
-          if (!thirdPartyUtil) {
-            JS_ReportError(aCx, "Could not get third party helper service!");
+          nsCOMPtr<nsIEffectiveTLDService> tldService =
+            do_GetService(NS_EFFECTIVETLDSERVICE_CONTRACTID);
+          if (!tldService) {
+            JS_ReportError(aCx, "Could not get TLD service!");
             return nsnull;
           }
 
-          if (NS_FAILED(thirdPartyUtil->GetBaseDomain(codebase, domain))) {
+          if (NS_FAILED(tldService->GetBaseDomain(codebase, 0, domain))) {
             JS_ReportError(aCx, "Could not get domain!");
             return nsnull;
           }
diff --git a/dom/workers/test/Makefile.in b/dom/workers/test/Makefile.in
index dba82ac982ab..e55f944c9eff 100644
--- a/dom/workers/test/Makefile.in
+++ b/dom/workers/test/Makefile.in
@@ -58,9 +58,6 @@ _TEST_FILES = \
   errorPropagation_worker.js \
   test_eventDispatch.html \
   eventDispatch_worker.js \
-  test_ipAddressOrigin.html \
-  ipAddressOrigin_iframe.html \
-  ipAddressOrigin_worker.js \
   test_importScripts.html \
   importScripts_worker.js \
   importScripts_worker_imported1.js \
diff --git a/dom/workers/test/ipAddressOrigin_iframe.html b/dom/workers/test/ipAddressOrigin_iframe.html
deleted file mode 100644
index 66a9f2c0cc0c..000000000000
--- a/dom/workers/test/ipAddressOrigin_iframe.html
+++ /dev/null
@@ -1,23 +0,0 @@
-<!--
-  Any copyright is dedicated to the Public Domain.
-  http://creativecommons.org/publicdomain/zero/1.0/
--->
-<!DOCTYPE HTML>
-<html>
-<body>
-<script>
-
-  onmessage = function (event) {
-    var url = "http://127.0.0.1" +
-      window.location.pathname.replace("ipAddressOrigin_iframe.html",
-                                       "ipAddRessOrigin_worker.js");
-
-    var worker = new Worker(url);
-    worker.onmessage = function (event) {
-      window.parent.postMessage(event.data, "*");
-    };
-  }
-
-</script>
-</body>
-</html>
diff --git a/dom/workers/test/ipAddressOrigin_worker.js b/dom/workers/test/ipAddressOrigin_worker.js
deleted file mode 100644
index 92ef04503976..000000000000
--- a/dom/workers/test/ipAddressOrigin_worker.js
+++ /dev/null
@@ -1,5 +0,0 @@
-/**
-* Any copyright is dedicated to the Public Domain.
-* http://creativecommons.org/publicdomain/zero/1.0/
-*/
-postMessage("done");
diff --git a/dom/workers/test/test_ipAddressOrigin.html b/dom/workers/test/test_ipAddressOrigin.html
deleted file mode 100644
index 1f48e1b68fdb..000000000000
--- a/dom/workers/test/test_ipAddressOrigin.html
+++ /dev/null
@@ -1,42 +0,0 @@
-<!--
-  Any copyright is dedicated to the Public Domain.
-  http://creativecommons.org/publicdomain/zero/1.0/
--->
-<!DOCTYPE HTML>
-<html>
-<head>
-  <title>Test for Web Workers</title>
-  <script type="text/javascript" src="/tests/SimpleTest/SimpleTest.js"></script>
-  <link rel="stylesheet" type="text/css" href="/tests/SimpleTest/test.css" />
-</head>
-<body onload="go();">
-<p id="display"></p>
-<div id="content" style="display: none">
-</div>
-<pre id="test">
-<iframe id="testFrame"></iframe>
-<script class="testbody" type="text/javascript">
-
-  function go() {
-    var iframe = document.getElementById("testFrame");
-
-    iframe.addEventListener("load", function() {
-      iframe.contentWindow.postMessage("go", "*");
-      window.addEventListener("message", function(event) {
-        is(event.data, "done", "Correct message");
-        SimpleTest.finish();
-      }, "false");
-    }, false);
-
-    iframe.src =
-      "http://127.0.0.1" +
-      window.location.pathname.replace("test_ipAddressOrigin.html",
-                                       "ipAddressOrigin_iframe.html");
-  }
-
-  SimpleTest.waitForExplicitFinish();
-
-</script>
-</pre>
-</body>
-</html>
diff --git a/netwerk/base/public/mozIThirdPartyUtil.idl b/netwerk/base/public/mozIThirdPartyUtil.idl
index ad419857692e..e0b40ef29c30 100644
--- a/netwerk/base/public/mozIThirdPartyUtil.idl
+++ b/netwerk/base/public/mozIThirdPartyUtil.idl
@@ -45,7 +45,7 @@ interface nsIChannel;
  * Utility functions for determining whether a given URI, channel, or window
  * hierarchy is third party with respect to a known URI.
  */
-[scriptable, uuid(d994fd1d-d2fe-4372-9ae7-88b08b7d9d90)]
+[scriptable, uuid(55385caa-1b94-4376-a34c-b47c51ef0837)]
 interface mozIThirdPartyUtil : nsISupports
 {
   /**
@@ -155,24 +155,6 @@ interface mozIThirdPartyUtil : nsISupports
    * @see isThirdPartyWindow
    */
   boolean isThirdPartyChannel(in nsIChannel aChannel, [optional] in nsIURI aURI);
-
-  /**
-   * getBaseDomain
-   *
-   * Get the base domain for aHostURI; e.g. for "www.bbc.co.uk", this would be
-   * "bbc.co.uk". Only properly-formed URI's are tolerated, though a trailing
-   * dot may be present. If aHostURI is an IP address, an alias such as
-   * 'localhost', an eTLD such as 'co.uk', or the empty string, aBaseDomain will
-   * be the exact host. The result of this function should only be used in exact
-   * string comparisons, since substring comparisons will not be valid for the
-   * special cases elided above.
-   *
-   * @param aHostURI
-   *        The URI to analyze.
-   *
-   * @return the base domain.
-   */
-  AUTF8String getBaseDomain(in nsIURI aHostURI);
 };
 
 %{ C++

From ace43d215065fc7df60ef63ee1bcbdf9eb0672ce Mon Sep 17 00:00:00 2001
From: Ehsan Akhgari <ehsan@mozilla.com>
Date: Wed, 14 Sep 2011 13:37:54 -0400
Subject: [PATCH 116/209] Backout changeset d469840a370f (bug 661900) to see if
 it helps resolve the Mobile NoChrome Tp4 regression

---
 netwerk/cache/nsMemoryCacheDevice.cpp | 46 ++++++++-------------------
 1 file changed, 14 insertions(+), 32 deletions(-)

diff --git a/netwerk/cache/nsMemoryCacheDevice.cpp b/netwerk/cache/nsMemoryCacheDevice.cpp
index db678b5968d9..acc9c19153af 100644
--- a/netwerk/cache/nsMemoryCacheDevice.cpp
+++ b/netwerk/cache/nsMemoryCacheDevice.cpp
@@ -49,7 +49,7 @@
 #include "nsCache.h"
 #include "nsReadableUtils.h"
 
-// The memory cache implements the "LRU-SP" caching algorithm
+// The memory cache implements a variation of the "LRU-SP" caching algorithm
 // described in "LRU-SP: A Size-Adjusted and Popularity-Aware LRU Replacement
 // Algorithm for Web Caching" by Kai Cheng and Yahiko Kambayashi.
 
@@ -379,8 +379,8 @@ nsMemoryCacheDevice::EvictEntry(nsCacheEntry * entry, PRBool deleteEntry)
 void
 nsMemoryCacheDevice::EvictEntriesIfNecessary(void)
 {
-    nsCacheEntry * entry;
-    nsCacheEntry * maxEntry;
+    nsCacheEntry * entry, * next;
+
     CACHE_LOG_DEBUG(("EvictEntriesIfNecessary.  mTotalSize: %d, mHardLimit: %d,"
                      "mInactiveSize: %d, mSoftLimit: %d\n",
                      mTotalSize, mHardLimit, mInactiveSize, mSoftLimit));
@@ -388,40 +388,22 @@ nsMemoryCacheDevice::EvictEntriesIfNecessary(void)
     if ((mTotalSize < mHardLimit) && (mInactiveSize < mSoftLimit))
         return;
 
-    PRUint32 now = SecondsFromPRTime(PR_Now());
-    PRUint64 entryCost = 0;
-    PRUint64 maxCost = 0;
-    do {
-        // LRU-SP eviction selection: Check the head of each segment (each
-        // eviction list, kept in LRU order) and select the maximal-cost
-        // entry for eviction. Cost is time-since-accessed * size / nref.
-        maxEntry = 0;
-        for (int i = kQueueCount - 1; i >= 0; --i) {
-            entry = (nsCacheEntry *)PR_LIST_HEAD(&mEvictionList[i]);
-
-            // If the head of a list is in use, check the next available entry
-            while ((entry != &mEvictionList[i]) &&
-                   (entry->IsInUse())) {
+    for (int i = kQueueCount - 1; i >= 0; --i) {
+        entry = (nsCacheEntry *)PR_LIST_HEAD(&mEvictionList[i]);
+        while (entry != &mEvictionList[i]) {
+            if (entry->IsInUse()) {
                 entry = (nsCacheEntry *)PR_NEXT_LINK(entry);
+                continue;
             }
 
-            if (entry != &mEvictionList[i]) {
-                entryCost = (PRUint64)
-                    (now - entry->LastFetched()) * entry->Size() / 
-                    PR_MAX(1, entry->FetchCount());
-                if (!maxEntry || (entryCost > maxCost)) {
-                    maxEntry = entry;
-                    maxCost = entryCost;
-                }
-            }
-        }
-        if (maxEntry) {
-            EvictEntry(maxEntry, DELETE_ENTRY);
-        } else {
-            break;
+            next = (nsCacheEntry *)PR_NEXT_LINK(entry);
+            EvictEntry(entry, DELETE_ENTRY);
+            entry = next;
+
+            if ((mTotalSize < mHardLimit) && (mInactiveSize < mSoftLimit))
+                return;
         }
     }
-    while ((mTotalSize >= mHardLimit) || (mInactiveSize >= mSoftLimit));
 }
 
 

From 245d670b857226516cb3cbe028c1a23128318c8f Mon Sep 17 00:00:00 2001
From: Chris Lord <chrislord.net@gmail.com>
Date: Wed, 14 Sep 2011 10:54:54 -0700
Subject: [PATCH 117/209] Bug 683514 - Use GL_EXT_unpack_subimage when
 available (part 2). r=joe

The previous patch used the extension in GLContext::TexImage2D, but not
TexSubImage2D. This patch corrects that and makes sure to use the extension
in both cases.
---
 gfx/thebes/GLContext.cpp | 23 +++++++++++++++--------
 1 file changed, 15 insertions(+), 8 deletions(-)

diff --git a/gfx/thebes/GLContext.cpp b/gfx/thebes/GLContext.cpp
index b80146f9511c..d4ed722634ff 100644
--- a/gfx/thebes/GLContext.cpp
+++ b/gfx/thebes/GLContext.cpp
@@ -1854,9 +1854,9 @@ GLContext::TexImage2D(GLenum target, GLint level, GLint internalformat,
     if (rowLength > mMaxTextureSize)
       useUnpackRowLength = false;
 
-    if (useUnpackRowLength)
+    if (useUnpackRowLength) {
         fPixelStorei(LOCAL_GL_UNPACK_ROW_LENGTH, rowLength);
-    else if (stride != width * pixelsize) {
+    } else if (stride != width * pixelsize) {
         // Not using the whole row of texture data and GLES doesn't 
         // support GL_UNPACK_ROW_LENGTH. We need to upload each row
         // separately.
@@ -1916,9 +1916,18 @@ GLContext::TexSubImage2D(GLenum target, GLint level,
                         GetAddressAlignment((ptrdiff_t)stride)));
 
 #ifndef USE_GLES2
-    fPixelStorei(LOCAL_GL_UNPACK_ROW_LENGTH, stride/pixelsize);
+    bool useUnpackRowLength = true;
 #else
-    if (stride != width * pixelsize) {
+    bool useUnpackRowLength = IsExtensionSupported(EXT_unpack_subimage);
+#endif
+
+    int rowLength = stride/pixelsize;
+    if (rowLength > mMaxTextureSize)
+      useUnpackRowLength = false;
+
+    if (useUnpackRowLength) {
+        fPixelStorei(LOCAL_GL_UNPACK_ROW_LENGTH, rowLength);
+    } else if (stride != width * pixelsize) {
         // Not using the whole row of texture data and GLES doesn't 
         // support GL_UNPACK_ROW_LENGTH. We need to upload each row
         // separately.
@@ -1940,7 +1949,6 @@ GLContext::TexSubImage2D(GLenum target, GLint level,
         fPixelStorei(LOCAL_GL_UNPACK_ALIGNMENT, 4);
         return;
     }
-#endif
 
     fTexSubImage2D(target,
                    level,
@@ -1952,9 +1960,8 @@ GLContext::TexSubImage2D(GLenum target, GLint level,
                    type,
                    pixels);
 
-#ifndef USE_GLES2
-    fPixelStorei(LOCAL_GL_UNPACK_ROW_LENGTH, 0);
-#endif
+    if (useUnpackRowLength)
+        fPixelStorei(LOCAL_GL_UNPACK_ROW_LENGTH, 0);
     fPixelStorei(LOCAL_GL_UNPACK_ALIGNMENT, 4);
 }
 

From 3b86f7c833ae9ac8d7ef01fd1517eeb5738b40ef Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Rafael=20=C3=81vila=20de=20Esp=C3=ADndola?=
 <respindola@mozilla.com>
Date: Wed, 14 Sep 2011 11:38:07 -0700
Subject: [PATCH 118/209] Bug 684659 -  Drop xptc_platforms_unixish_x86.h.
 r=bsmedberg.

Drop MOZ_PRESERVE_PIC which is not used since 2002,
CFRONT_STYLE_THIS_ADJUST which was used only for really old systems
like the first Freebsd 5.

With those out, the only thing left in xptc_platforms_unixish_x86.h is
to set KEEP_STACK_16_BYTE_ALIGNED for QNX, since that is not supported
and KEEP_STACK_16_BYTE_ALIGNED can be set from Makefile.in if needed,
drop xptc_platforms_unixish_x86.h completely.
---
 .../src/md/os2/xptcstubs_gcc_x86_os2.cpp      |   1 -
 .../src/md/unix/xptc_platforms_unixish_x86.h  | 173 ------------------
 .../src/md/unix/xptcinvoke_gcc_x86_unix.cpp   |  31 ----
 .../src/md/unix/xptcinvoke_unixish_x86.cpp    |   1 -
 .../src/md/unix/xptcinvoke_x86_solaris.cpp    |   1 -
 .../src/md/unix/xptcstubs_gcc_x86_unix.cpp    |   1 -
 .../src/md/unix/xptcstubs_unixish_x86.cpp     |   1 -
 .../src/md/unix/xptcstubs_x86_solaris.cpp     |   1 -
 8 files changed, 210 deletions(-)
 delete mode 100644 xpcom/reflect/xptcall/src/md/unix/xptc_platforms_unixish_x86.h

diff --git a/xpcom/reflect/xptcall/src/md/os2/xptcstubs_gcc_x86_os2.cpp b/xpcom/reflect/xptcall/src/md/os2/xptcstubs_gcc_x86_os2.cpp
index 565a92fdbe1a..3e6fcae11c54 100644
--- a/xpcom/reflect/xptcall/src/md/os2/xptcstubs_gcc_x86_os2.cpp
+++ b/xpcom/reflect/xptcall/src/md/os2/xptcstubs_gcc_x86_os2.cpp
@@ -39,7 +39,6 @@
 
 #include "xptcprivate.h"
 #include "xptiprivate.h"
-#include "xptc_platforms_unixish_x86.h"
 #include "xptc_gcc_x86_unix.h"
 
 extern "C" {
diff --git a/xpcom/reflect/xptcall/src/md/unix/xptc_platforms_unixish_x86.h b/xpcom/reflect/xptcall/src/md/unix/xptc_platforms_unixish_x86.h
deleted file mode 100644
index f4e9a86eff88..000000000000
--- a/xpcom/reflect/xptcall/src/md/unix/xptc_platforms_unixish_x86.h
+++ /dev/null
@@ -1,173 +0,0 @@
-/* -*- Mode: C; tab-width: 8; indent-tabs-mode: nil; c-basic-offset: 4 -*- */
-/* ***** BEGIN LICENSE BLOCK *****
- * Version: MPL 1.1/GPL 2.0/LGPL 2.1
- *
- * The contents of this file are subject to the Mozilla Public License Version
- * 1.1 (the "License"); you may not use this file except in compliance with
- * the License. You may obtain a copy of the License at
- * http://www.mozilla.org/MPL/
- *
- * Software distributed under the License is distributed on an "AS IS" basis,
- * WITHOUT WARRANTY OF ANY KIND, either express or implied. See the License
- * for the specific language governing rights and limitations under the
- * License.
- *
- * The Original Code is mozilla.org code.
- *
- * The Initial Developer of the Original Code is
- * Netscape Communications Corporation.
- * Portions created by the Initial Developer are Copyright (C) 1999
- * the Initial Developer. All Rights Reserved.
- *
- * Contributor(s):
- *
- * Alternatively, the contents of this file may be used under the terms of
- * either of the GNU General Public License Version 2 or later (the "GPL"),
- * or the GNU Lesser General Public License Version 2.1 or later (the "LGPL"),
- * in which case the provisions of the GPL or the LGPL are applicable instead
- * of those above. If you wish to allow use of your version of this file only
- * under the terms of either the GPL or the LGPL, and not to allow others to
- * use your version of this file under the terms of the MPL, indicate your
- * decision by deleting the provisions above and replace them with the notice
- * and other provisions required by the GPL or the LGPL. If you do not delete
- * the provisions above, a recipient may use your version of this file under
- * the terms of any one of the MPL, the GPL or the LGPL.
- *
- * ***** END LICENSE BLOCK ***** */
-
-/* Platform specific #defines to be shared by the various platforms sharing 
-*  the unixish_86 code
-*/
-
-/*
-*  The goal here is to clearly define the binary compatibility parameters for
-*  the platforms that will use this code. Rather than switch at compile time
-*  based on the compiler that happens to be in use we are forcing implementors
-*  to make a conscious decision.
-*
-*  For some of these platforms the community may choose to have more than one
-*  binary model in effect. In that case I suggest that there be explicit sub
-*  defines for that platform specifying 'TYPE1', 'TYPE2', etc. The decision on
-*  which 'TYPE' to use would be triggered by a setting passed through from the 
-*  config system.
-*
-*  For example we might end up with something like:
-*
-* #elif defined(NTO)
-* #  if defined(TYPE1)
-* #    define CFRONT_STYLE_THIS_ADJUST
-* #  elif defined(TYPE2)
-* #    define THUNK_BASED_THIS_ADJUST
-* #  else
-* #    error "need TYPE1 or TYPE2 for NTO"
-* #  endif
-*
-*  and so on....
-*
-*/
-
-#if defined(LINUX) || (defined(__GLIBC__) && (defined(__FreeBSD_kernel__) || defined(__GNU__)))
-
-#if (__GNUC__ == 2) && (__GNUC_MINOR__ <= 7)
-/* Old gcc 2.7.x.x.  What does gcc 2.8.x do?? */
-#define CFRONT_STYLE_THIS_ADJUST
-#else
-/* egcs and later */
-#define THUNK_BASED_THIS_ADJUST
-#endif
-
-#elif defined(__FreeBSD__) 
-/* System versions of gcc on FreeBSD don't use thunks.  On 3.x, the system
- * compiler is gcc 2.7.2.3, which doesn't use thunks by default.  On 4.x and
- * 5.x, /usr/src/contrib/gcc/config/freebsd.h explicitly undef's
- * DEFAULT_VTABLE_THUNKS.  (The one exception is a brief period (September
- * 1999 - Jan 2000) during 4.0-CURRENT, after egcs was merged --
- * this was changed before 4.0-RELEASE, but we can handle it anyway.)
- *
- * Versions of gcc from the ports collection (/usr/ports/lang/egcs),
- * however, have DEFAULT_VTABLE_THUNKS #defined to 1, at least
- * in all ports collections since the 2.95 merge.  (Supporting optional
- * compilers from FreeBSD 3.2 or earlier seems unnecessary).
- *
- * The easiest way to distinguish the ports collection gcc from the system
- * gcc is that the system gcc defines __FreeBSD_cc_version.  This variable
- * can also identify versions that use thunks. This includes some 4.x versions
- * and now newer 5.x versions.
- */
-#if defined(__FreeBSD_cc_version) && \
-    (__FreeBSD_cc_version < 500003) && \
-    (__FreeBSD_cc_version < 400002 || __FreeBSD_cc_version > 400003)
-#define CFRONT_STYLE_THIS_ADJUST
-#else
-#define THUNK_BASED_THIS_ADJUST
-#endif
-
-#elif defined(__NetBSD__) 
-#define THUNK_BASED_THIS_ADJUST
-
-#elif defined(__OpenBSD__) 
-#if __GNUC__ >= 3
-#define THUNK_BASED_THIS_ADJUST
-#else
-/* OpenBSD introduces GCC 2.95.x in late May 1999 */
-#include <sys/param.h>
-#if OpenBSD <= 199905
-#define THUNK_BASED_THIS_ADJUST
-#else
-#define CFRONT_STYLE_THIS_ADJUST
-#endif
-#endif
-
-#elif defined(__bsdi__) 
-#include <sys/param.h>
-#if _BSDI_VERSION >= 199910
-/* BSDI/4.1 ships with egcs, ergo thunk-based */
-#define THUNK_BASED_THIS_ADJUST
-#else
-#define CFRONT_STYLE_THIS_ADJUST
-#endif
-
-#elif defined(NTO) 
-#if (__GNUC__ == 2) && (__GNUC_MINOR__ <= 7)
-/* Old gcc 2.7.x.x.  What does gcc 2.8.x do?? */
-#define CFRONT_STYLE_THIS_ADJUST
-#else
-/* egcs and later */
-#define THUNK_BASED_THIS_ADJUST
-#endif
-
-#elif defined(__sun__) || defined(__sun)
-#if defined(__GXX_ABI_VERSION) && __GXX_ABI_VERSION >= 100 /* G++ V3 ABI */
-#define THUNK_BASED_THIS_ADJUST
-#else
-#define CFRONT_STYLE_THIS_ADJUST
-#endif
-
-#elif defined(_WIN32)
-#define THUNK_BASED_THIS_ADJUST
-
-#elif defined(__OS2__)
-#define THUNK_BASED_THIS_ADJUST
-
-#elif defined (__APPLE__) && (__MACH__)
-#define THUNK_BASED_THIS_ADJUST
-
-#else
-#error "need a platform define if using unixish x86 code"
-#endif
-
-/***************************************************************************/
-
-#if !defined(THUNK_BASED_THIS_ADJUST) && !defined(CFRONT_STYLE_THIS_ADJUST)
-#error "need to define 'this' adjust scheme"    
-#endif
-
-#if defined(THUNK_BASED_THIS_ADJUST) && defined(CFRONT_STYLE_THIS_ADJUST)
-#error "need to define only ONE 'this' adjust scheme"    
-#endif
-
-#if defined(__QNXNTO__)
-/* Define KEEP_STACK_16_BYTE_ALIGNED if the stack needs to maintain alignment
- * in a CALL for some good reason (like ABI compliance). */
-#define KEEP_STACK_16_BYTE_ALIGNED
-#endif
diff --git a/xpcom/reflect/xptcall/src/md/unix/xptcinvoke_gcc_x86_unix.cpp b/xpcom/reflect/xptcall/src/md/unix/xptcinvoke_gcc_x86_unix.cpp
index 96f143fa2c31..96f8f3415517 100644
--- a/xpcom/reflect/xptcall/src/md/unix/xptcinvoke_gcc_x86_unix.cpp
+++ b/xpcom/reflect/xptcall/src/md/unix/xptcinvoke_gcc_x86_unix.cpp
@@ -38,7 +38,6 @@
 /* Platform specific code to invoke XPCOM methods on native objects */
 
 #include "xptcprivate.h"
-#include "xptc_platforms_unixish_x86.h"
 #include "xptc_gcc_x86_unix.h"
 
 extern "C" {
@@ -81,11 +80,6 @@ invoke_copy_to_stack(PRUint32 paramCount, nsXPTCVariant* s, PRUint32* d)
   paramCount  = ebp + 0x10
   params      = ebp + 0x14
 
-  NOTE NOTE NOTE:
-  As of 2002-04-29 this function references no global variables nor does
-  it call non-static functions so preserving and loading the PIC register
-  is unnecessary. Define MOZ_PRESERVE_PIC if this changes. See mozilla
-  bug 140412 for details. However, avoid this if you can. It's slower.
 */
 /*
  * Hack for gcc for win32 and os2.  Functions used externally must be
@@ -119,16 +113,6 @@ __asm__ (
 #endif
 	"pushl %ebp\n\t"
 	"movl  %esp, %ebp\n\t"
-#ifdef MOZ_PRESERVE_PIC 
-	"pushl %ebx\n\t"
-	"call  0f\n\t"
-	".subsection 1\n"
-	"0:\n\t"
-	"movl (%esp), %ebx\n\t"
-	"ret\n\t"
-	".previous\n\t"
-	"addl  $_GLOBAL_OFFSET_TABLE_, %ebx\n\t"
-#endif
 	"movl  0x10(%ebp), %eax\n\t"
 	"leal  0(,%eax,8),%edx\n\t"
 	"movl  %esp, %ecx\n\t"
@@ -150,26 +134,11 @@ __asm__ (
 	"movl  0x14(%ebp), %edx\n\t"
 	"call  " SYMBOL_UNDERSCORE "invoke_copy_to_stack\n\t"
 	"movl  0x08(%ebp), %ecx\n\t"	/* 'that' */
-#ifdef CFRONT_STYLE_THIS_ADJUST
-	"movl  (%ecx), %edx\n\t"
-	"movl  0x0c(%ebp), %eax\n\t"    /* function index */
-	"shll  $3, %eax\n\t"	        /* *= 8 */
-	"addl  $8, %eax\n\t"	        /* += 8 skip first entry */
-	"addl  %eax, %edx\n\t"
-	"movswl (%edx), %eax\n\t"       /* 'this' offset */
-	"addl  %eax, %ecx\n\t"
-	"pushl %ecx\n\t"
-	"addl  $4, %edx\n\t"	        /* += 4, method pointer */
-#else /* THUNK_BASED_THIS_ADJUST */
 	"pushl %ecx\n\t"
 	"movl  (%ecx), %edx\n\t"
 	"movl  0x0c(%ebp), %eax\n\t"    /* function index */
 	"leal  (%edx,%eax,4), %edx\n\t"
-#endif
 	"call  *(%edx)\n\t"
-#ifdef MOZ_PRESERVE_PIC
-	"movl  -4(%ebp), %ebx\n\t"
-#endif
 	"movl  %ebp, %esp\n\t"
 	"popl  %ebp\n\t"
 	"ret\n"
diff --git a/xpcom/reflect/xptcall/src/md/unix/xptcinvoke_unixish_x86.cpp b/xpcom/reflect/xptcall/src/md/unix/xptcinvoke_unixish_x86.cpp
index 6c48c74164b3..a5236458431e 100644
--- a/xpcom/reflect/xptcall/src/md/unix/xptcinvoke_unixish_x86.cpp
+++ b/xpcom/reflect/xptcall/src/md/unix/xptcinvoke_unixish_x86.cpp
@@ -39,7 +39,6 @@
 /* Platform specific code to invoke XPCOM methods on native objects */
 
 #include "xptcprivate.h"
-#include "xptc_platforms_unixish_x86.h"
 
 extern "C" {
 
diff --git a/xpcom/reflect/xptcall/src/md/unix/xptcinvoke_x86_solaris.cpp b/xpcom/reflect/xptcall/src/md/unix/xptcinvoke_x86_solaris.cpp
index c4074782ccb4..b343f7772265 100644
--- a/xpcom/reflect/xptcall/src/md/unix/xptcinvoke_x86_solaris.cpp
+++ b/xpcom/reflect/xptcall/src/md/unix/xptcinvoke_x86_solaris.cpp
@@ -39,7 +39,6 @@
 /* Platform specific code to invoke XPCOM methods on native objects */
 
 #include "xptcprivate.h"
-#include "xptc_platforms_unixish_x86.h"
 
 extern "C" {
 
diff --git a/xpcom/reflect/xptcall/src/md/unix/xptcstubs_gcc_x86_unix.cpp b/xpcom/reflect/xptcall/src/md/unix/xptcstubs_gcc_x86_unix.cpp
index c90d9deb3a96..9135ce9a8d22 100644
--- a/xpcom/reflect/xptcall/src/md/unix/xptcstubs_gcc_x86_unix.cpp
+++ b/xpcom/reflect/xptcall/src/md/unix/xptcstubs_gcc_x86_unix.cpp
@@ -39,7 +39,6 @@
 
 #include "xptcprivate.h"
 #include "xptiprivate.h"
-#include "xptc_platforms_unixish_x86.h"
 #include "xptc_gcc_x86_unix.h"
 
 extern "C" {
diff --git a/xpcom/reflect/xptcall/src/md/unix/xptcstubs_unixish_x86.cpp b/xpcom/reflect/xptcall/src/md/unix/xptcstubs_unixish_x86.cpp
index 3173e78b0778..24b60a9c3d94 100644
--- a/xpcom/reflect/xptcall/src/md/unix/xptcstubs_unixish_x86.cpp
+++ b/xpcom/reflect/xptcall/src/md/unix/xptcstubs_unixish_x86.cpp
@@ -38,7 +38,6 @@
 /* Implement shared vtbl methods. */
 
 #include "xptcprivate.h"
-#include "xptc_platforms_unixish_x86.h"
 #include "xptiprivate.h"
 
 static nsresult
diff --git a/xpcom/reflect/xptcall/src/md/unix/xptcstubs_x86_solaris.cpp b/xpcom/reflect/xptcall/src/md/unix/xptcstubs_x86_solaris.cpp
index 42b2ca2ab7c8..a3bb4c8728c8 100644
--- a/xpcom/reflect/xptcall/src/md/unix/xptcstubs_x86_solaris.cpp
+++ b/xpcom/reflect/xptcall/src/md/unix/xptcstubs_x86_solaris.cpp
@@ -40,7 +40,6 @@
 
 #include "xptcprivate.h"
 #include "xptiprivate.h"
-#include "xptc_platforms_unixish_x86.h"
 
 nsresult
 PrepareAndDispatch(nsXPTCStubBase* self, uint32 methodIndex, PRUint32* args)

From f1f5b007cec32c4825c5abee3b09c9da482034cd Mon Sep 17 00:00:00 2001
From: Adrian Johnson <ajohnson@redneon.com>
Date: Wed, 14 Sep 2011 11:44:15 -0700
Subject: [PATCH 119/209] Bug 454532. cairo: Print as Unicode. r=jrmuizel

--HG--
extra : rebase_source : 3b10e50f3763535d7eee5aa5dcdc6ca2ad445ad3
---
 gfx/cairo/README                              |   2 +
 .../cairo/src/cairo-win32-printing-surface.c  | 157 +++++----
 gfx/cairo/cairo/src/cairo-win32-private.h     |  11 +
 gfx/cairo/cairo/src/cairo-win32-surface.c     |  53 +--
 gfx/cairo/unicode-printing.patch              | 333 ++++++++++++++++++
 5 files changed, 475 insertions(+), 81 deletions(-)
 create mode 100644 gfx/cairo/unicode-printing.patch

diff --git a/gfx/cairo/README b/gfx/cairo/README
index 3605a8da1742..ab237dfedb3b 100644
--- a/gfx/cairo/README
+++ b/gfx/cairo/README
@@ -174,6 +174,8 @@ quartz-get-image-performance: Make cairo_quartz_get_image faster in the failure
 
 lround-c99-only.patch: Only use lround in C99 programs.
 
+unicode-printing.patch: Print as unicode (bug 454532)
+
 ==== pixman patches ====
 
 pixman-android-cpu-detect.patch: Add CPU detection support for Android, where we can't reliably access /proc/self/auxv.
diff --git a/gfx/cairo/cairo/src/cairo-win32-printing-surface.c b/gfx/cairo/cairo/src/cairo-win32-printing-surface.c
index b95a059b2c77..fd580b5370ee 100644
--- a/gfx/cairo/cairo/src/cairo-win32-printing-surface.c
+++ b/gfx/cairo/cairo/src/cairo-win32-printing-surface.c
@@ -1430,6 +1430,94 @@ _cairo_win32_printing_surface_fill (void		        *abstract_surface,
     return status;
 }
 
+static cairo_int_status_t
+_cairo_win32_printing_surface_emit_win32_glyphs (cairo_win32_surface_t 	*surface,
+						 cairo_operator_t	 op,
+						 const cairo_pattern_t  *source,
+						 cairo_glyph_t        	*glyphs,
+						 int			 num_glyphs,
+						 cairo_scaled_font_t  	*scaled_font,
+						 cairo_clip_t		*clip,
+						 int			*remaining_glyphs)
+{
+    cairo_matrix_t ctm;
+    cairo_glyph_t  *unicode_glyphs;
+    cairo_scaled_font_subsets_glyph_t subset_glyph;
+    int i, first;
+    cairo_bool_t sequence_is_unicode;
+    cairo_status_t status = CAIRO_STATUS_SUCCESS;
+
+    /* Where possible reverse the glyph indices back to unicode
+     * characters. Strings of glyphs that could not be reversed to
+     * unicode will be printed with ETO_GLYPH_INDEX.
+     *
+     * As _cairo_win32_scaled_font_index_to_ucs4() is a slow
+     * operation, the font subsetting function
+     * _cairo_scaled_font_subsets_map_glyph() is used to obtain
+     * the unicode value because it caches the reverse mapping in
+     * the subsets.
+     */
+
+    if (surface->has_ctm) {
+	for (i = 0; i < num_glyphs; i++)
+	    cairo_matrix_transform_point (&surface->ctm, &glyphs[i].x, &glyphs[i].y);
+	cairo_matrix_multiply (&ctm, &scaled_font->ctm, &surface->ctm);
+	scaled_font = cairo_scaled_font_create (scaled_font->font_face,
+						&scaled_font->font_matrix,
+						&ctm,
+						&scaled_font->options);
+    }
+
+    unicode_glyphs = _cairo_malloc_ab (num_glyphs, sizeof (cairo_glyph_t));
+    if (unicode_glyphs == NULL)
+	return _cairo_error (CAIRO_STATUS_NO_MEMORY);
+
+    memcpy (unicode_glyphs, glyphs, num_glyphs * sizeof (cairo_glyph_t));
+    for (i = 0; i < num_glyphs; i++) {
+	status = _cairo_scaled_font_subsets_map_glyph (surface->font_subsets,
+						       scaled_font,
+						       glyphs[i].index,
+						       NULL, 0,
+						       &subset_glyph);
+	if (status)
+	    goto fail;
+
+	unicode_glyphs[i].index = subset_glyph.unicode;
+    }
+
+    i = 0;
+    first = 0;
+    sequence_is_unicode = unicode_glyphs[0].index <= 0xffff;
+    while (i < num_glyphs) {
+	if (i == num_glyphs - 1 ||
+	    ((unicode_glyphs[i + 1].index < 0xffff) != sequence_is_unicode))
+	{
+	    status = _cairo_win32_surface_show_glyphs_internal (
+		surface,
+		op,
+		source,
+		sequence_is_unicode ? &unicode_glyphs[first] : &glyphs[first],
+		i - first + 1,
+		scaled_font,
+		clip,
+		remaining_glyphs,
+		! sequence_is_unicode);
+	    first = i + 1;
+	    if (i < num_glyphs - 1)
+		sequence_is_unicode = unicode_glyphs[i + 1].index <= 0xffff;
+	}
+	i++;
+    }
+
+fail:
+    if (surface->has_ctm)
+	cairo_scaled_font_destroy (scaled_font);
+
+    free (unicode_glyphs);
+
+    return status;
+}
+
 static cairo_int_status_t
 _cairo_win32_printing_surface_show_glyphs (void                 *abstract_surface,
                                            cairo_operator_t	 op,
@@ -1538,67 +1626,14 @@ _cairo_win32_printing_surface_show_glyphs (void                 *abstract_surfac
     if (cairo_scaled_font_get_type (scaled_font) == CAIRO_FONT_TYPE_WIN32 &&
 	source->type == CAIRO_PATTERN_TYPE_SOLID)
     {
-	cairo_matrix_t ctm;
-	cairo_glyph_t  *type1_glyphs = NULL;
-	cairo_scaled_font_subsets_glyph_t subset_glyph;
-
-	/* Calling ExtTextOutW() with ETO_GLYPH_INDEX and a Type 1
-	 * font on a printer DC prints garbled text. The text displays
-	 * correctly on a display DC. When using a printer
-	 * DC, ExtTextOutW() only works with characters and not glyph
-	 * indices.
-	 *
-	 * For Type 1 fonts the glyph indices are converted back to
-	 * unicode characters before calling _cairo_win32_surface_show_glyphs().
-	 *
-	 * As _cairo_win32_scaled_font_index_to_ucs4() is a slow
-	 * operation, the font subsetting function
-	 * _cairo_scaled_font_subsets_map_glyph() is used to obtain
-	 * the unicode value because it caches the reverse mapping in
-	 * the subsets.
-	 */
-	if (_cairo_win32_scaled_font_is_type1 (scaled_font)) {
-	    type1_glyphs = _cairo_malloc_ab (num_glyphs, sizeof (cairo_glyph_t));
-	    if (type1_glyphs == NULL) {
-		status = _cairo_error (CAIRO_STATUS_NO_MEMORY);
-		goto FINISH;
-	    }
-	    memcpy (type1_glyphs, glyphs, num_glyphs * sizeof (cairo_glyph_t));
-	    for (i = 0; i < num_glyphs; i++) {
-		status = _cairo_scaled_font_subsets_map_glyph (surface->font_subsets,
-							       scaled_font,
-							       type1_glyphs[i].index,
-							       NULL, 0,
-							       &subset_glyph);
-		if (status)
-		    goto FINISH;
-
-		type1_glyphs[i].index = subset_glyph.unicode;
-	    }
-	    glyphs = type1_glyphs;
-	}
-
-	if (surface->has_ctm || surface->has_gdi_ctm) {
-	    cairo_matrix_multiply (&ctm, &surface->ctm, &surface->gdi_ctm);
-	    for (i = 0; i < num_glyphs; i++)
-		cairo_matrix_transform_point (&ctm, &glyphs[i].x, &glyphs[i].y);
-	    cairo_matrix_multiply (&ctm, &scaled_font->ctm, &ctm);
-	    scaled_font = cairo_scaled_font_create (scaled_font->font_face,
-						    &scaled_font->font_matrix,
-						    &ctm,
-						    &scaled_font->options);
-	}
-	status = _cairo_win32_surface_show_glyphs (surface, op,
-						   source, glyphs,
-						   num_glyphs, scaled_font,
-						   clip,
-						   remaining_glyphs);
-	if (surface->has_ctm || surface->has_gdi_ctm)
-	    cairo_scaled_font_destroy (scaled_font);
-
-	if (type1_glyphs != NULL)
-	    free (type1_glyphs);
-
+	status = _cairo_win32_printing_surface_emit_win32_glyphs (surface,
+								  op,
+								  source,
+								  glyphs,
+								  num_glyphs,
+								  scaled_font,
+								  clip,
+								  remaining_glyphs);
 	goto FINISH;
     }
 #endif
diff --git a/gfx/cairo/cairo/src/cairo-win32-private.h b/gfx/cairo/cairo/src/cairo-win32-private.h
index 9e093b3d145a..83887d909b61 100644
--- a/gfx/cairo/cairo/src/cairo-win32-private.h
+++ b/gfx/cairo/cairo/src/cairo-win32-private.h
@@ -161,6 +161,17 @@ cairo_status_t
 _cairo_win32_surface_set_clip_region (void           *abstract_surface,
 				      cairo_region_t *region);
 
+cairo_int_status_t
+_cairo_win32_surface_show_glyphs_internal (void			 *surface,
+					   cairo_operator_t	  op,
+					   const cairo_pattern_t *source,
+					   cairo_glyph_t	 *glyphs,
+					   int			  num_glyphs,
+					   cairo_scaled_font_t	 *scaled_font,
+					   cairo_clip_t		 *clip,
+					   int			 *remaining_glyphs,
+					   cairo_bool_t		  glyph_indices);
+
 cairo_int_status_t
 _cairo_win32_surface_show_glyphs (void			*surface,
 				  cairo_operator_t	 op,
diff --git a/gfx/cairo/cairo/src/cairo-win32-surface.c b/gfx/cairo/cairo/src/cairo-win32-surface.c
index 1770f592a5bf..3b868d4b1648 100644
--- a/gfx/cairo/cairo/src/cairo-win32-surface.c
+++ b/gfx/cairo/cairo/src/cairo-win32-surface.c
@@ -1612,14 +1612,15 @@ _cairo_win32_surface_flush (void *abstract_surface)
 #define STACK_GLYPH_SIZE 256
 
 cairo_int_status_t
-_cairo_win32_surface_show_glyphs (void			*surface,
-				  cairo_operator_t	 op,
-				  const cairo_pattern_t	*source,
-				  cairo_glyph_t		*glyphs,
-				  int			 num_glyphs,
-				  cairo_scaled_font_t	*scaled_font,
-				  cairo_clip_t		*clip,
-				  int			*remaining_glyphs)
+_cairo_win32_surface_show_glyphs_internal (void			*surface,
+					   cairo_operator_t	 op,
+					   const cairo_pattern_t	*source,
+					   cairo_glyph_t		*glyphs,
+					   int			 num_glyphs,
+					   cairo_scaled_font_t	*scaled_font,
+					   cairo_clip_t		*clip,
+					   int			*remaining_glyphs,
+					   cairo_bool_t           glyph_indexing)
 {
 #ifdef CAIRO_HAS_WIN32_FONT
     if (scaled_font->backend->type == CAIRO_FONT_TYPE_DWRITE) {
@@ -1742,19 +1743,10 @@ _cairo_win32_surface_show_glyphs (void			*surface,
 	    }
 	}
 
-	/* Using glyph indices for a Type 1 font does not work on a
-	 * printer DC. The win32 printing surface will convert the the
-	 * glyph indices of Type 1 fonts to the unicode values.
-	 */
-	if ((dst->flags & CAIRO_WIN32_SURFACE_FOR_PRINTING) &&
-	    _cairo_win32_scaled_font_is_type1 (scaled_font))
-	{
-	    glyph_index_option = 0;
-	}
-	else
-	{
+	if (glyph_indexing)
 	    glyph_index_option = ETO_GLYPH_INDEX;
-	}
+	else
+	    glyph_index_option = 0;
 
 	win_result = ExtTextOutW(dst->dc,
 				 start_x,
@@ -1783,6 +1775,27 @@ _cairo_win32_surface_show_glyphs (void			*surface,
 
 #undef STACK_GLYPH_SIZE
 
+cairo_int_status_t
+_cairo_win32_surface_show_glyphs (void			*surface,
+ 				  cairo_operator_t	 op,
+ 				  const cairo_pattern_t *source,
+ 				  cairo_glyph_t	 	*glyphs,
+ 				  int			 num_glyphs,
+ 				  cairo_scaled_font_t	*scaled_font,
+ 				  cairo_clip_t          *clip,
+ 				  int		      	*remaining_glyphs)
+{
+    return _cairo_win32_surface_show_glyphs_internal (surface,
+ 						      op,
+ 						      source,
+ 						      glyphs,
+ 						      num_glyphs,
+ 						      scaled_font,
+ 						      clip,
+ 						      remaining_glyphs,
+ 						      TRUE);
+}
+
 static cairo_surface_t *
 cairo_win32_surface_create_internal (HDC hdc, cairo_format_t format)
 {
diff --git a/gfx/cairo/unicode-printing.patch b/gfx/cairo/unicode-printing.patch
new file mode 100644
index 000000000000..09b3991ea011
--- /dev/null
+++ b/gfx/cairo/unicode-printing.patch
@@ -0,0 +1,333 @@
+diff --git a/gfx/cairo/cairo/src/cairo-win32-printing-surface.c b/gfx/cairo/cairo/src/cairo-win32-printing-surface.c
+--- a/gfx/cairo/cairo/src/cairo-win32-printing-surface.c
++++ b/gfx/cairo/cairo/src/cairo-win32-printing-surface.c
+@@ -1426,16 +1426,104 @@ _cairo_win32_printing_surface_fill (void
+     }
+ 
+     fflush(stderr);
+ 
+     return status;
+ }
+ 
+ static cairo_int_status_t
++_cairo_win32_printing_surface_emit_win32_glyphs (cairo_win32_surface_t 	*surface,
++						 cairo_operator_t	 op,
++						 const cairo_pattern_t  *source,
++						 cairo_glyph_t        	*glyphs,
++						 int			 num_glyphs,
++						 cairo_scaled_font_t  	*scaled_font,
++						 cairo_clip_t		*clip,
++						 int			*remaining_glyphs)
++{
++    cairo_matrix_t ctm;
++    cairo_glyph_t  *unicode_glyphs;
++    cairo_scaled_font_subsets_glyph_t subset_glyph;
++    int i, first;
++    cairo_bool_t sequence_is_unicode;
++    cairo_status_t status = CAIRO_STATUS_SUCCESS;
++
++    /* Where possible reverse the glyph indices back to unicode
++     * characters. Strings of glyphs that could not be reversed to
++     * unicode will be printed with ETO_GLYPH_INDEX.
++     *
++     * As _cairo_win32_scaled_font_index_to_ucs4() is a slow
++     * operation, the font subsetting function
++     * _cairo_scaled_font_subsets_map_glyph() is used to obtain
++     * the unicode value because it caches the reverse mapping in
++     * the subsets.
++     */
++
++    if (surface->has_ctm) {
++	for (i = 0; i < num_glyphs; i++)
++	    cairo_matrix_transform_point (&surface->ctm, &glyphs[i].x, &glyphs[i].y);
++	cairo_matrix_multiply (&ctm, &scaled_font->ctm, &surface->ctm);
++	scaled_font = cairo_scaled_font_create (scaled_font->font_face,
++						&scaled_font->font_matrix,
++						&ctm,
++						&scaled_font->options);
++    }
++
++    unicode_glyphs = _cairo_malloc_ab (num_glyphs, sizeof (cairo_glyph_t));
++    if (unicode_glyphs == NULL)
++	return _cairo_error (CAIRO_STATUS_NO_MEMORY);
++
++    memcpy (unicode_glyphs, glyphs, num_glyphs * sizeof (cairo_glyph_t));
++    for (i = 0; i < num_glyphs; i++) {
++	status = _cairo_scaled_font_subsets_map_glyph (surface->font_subsets,
++						       scaled_font,
++						       glyphs[i].index,
++						       NULL, 0,
++						       &subset_glyph);
++	if (status)
++	    goto fail;
++
++	unicode_glyphs[i].index = subset_glyph.unicode;
++    }
++
++    i = 0;
++    first = 0;
++    sequence_is_unicode = unicode_glyphs[0].index <= 0xffff;
++    while (i < num_glyphs) {
++	if (i == num_glyphs - 1 ||
++	    ((unicode_glyphs[i + 1].index < 0xffff) != sequence_is_unicode))
++	{
++	    status = _cairo_win32_surface_show_glyphs_internal (
++		surface,
++		op,
++		source,
++		sequence_is_unicode ? &unicode_glyphs[first] : &glyphs[first],
++		i - first + 1,
++		scaled_font,
++		clip,
++		remaining_glyphs,
++		! sequence_is_unicode);
++	    first = i + 1;
++	    if (i < num_glyphs - 1)
++		sequence_is_unicode = unicode_glyphs[i + 1].index <= 0xffff;
++	}
++	i++;
++    }
++
++fail:
++    if (surface->has_ctm)
++	cairo_scaled_font_destroy (scaled_font);
++
++    free (unicode_glyphs);
++
++    return status;
++}
++
++static cairo_int_status_t
+ _cairo_win32_printing_surface_show_glyphs (void                 *abstract_surface,
+                                            cairo_operator_t	 op,
+                                            const cairo_pattern_t *source,
+                                            cairo_glyph_t        *glyphs,
+                                            int			 num_glyphs,
+                                            cairo_scaled_font_t  *scaled_font,
+ 					   cairo_clip_t		*clip,
+ 					   int			*remaining_glyphs)
+@@ -1533,77 +1621,24 @@ _cairo_win32_printing_surface_show_glyph
+         }
+     }
+ #endif
+ 
+ #if CAIRO_HAS_WIN32_FONT
+     if (cairo_scaled_font_get_type (scaled_font) == CAIRO_FONT_TYPE_WIN32 &&
+ 	source->type == CAIRO_PATTERN_TYPE_SOLID)
+     {
+-	cairo_matrix_t ctm;
+-	cairo_glyph_t  *type1_glyphs = NULL;
+-	cairo_scaled_font_subsets_glyph_t subset_glyph;
+-
+-	/* Calling ExtTextOutW() with ETO_GLYPH_INDEX and a Type 1
+-	 * font on a printer DC prints garbled text. The text displays
+-	 * correctly on a display DC. When using a printer
+-	 * DC, ExtTextOutW() only works with characters and not glyph
+-	 * indices.
+-	 *
+-	 * For Type 1 fonts the glyph indices are converted back to
+-	 * unicode characters before calling _cairo_win32_surface_show_glyphs().
+-	 *
+-	 * As _cairo_win32_scaled_font_index_to_ucs4() is a slow
+-	 * operation, the font subsetting function
+-	 * _cairo_scaled_font_subsets_map_glyph() is used to obtain
+-	 * the unicode value because it caches the reverse mapping in
+-	 * the subsets.
+-	 */
+-	if (_cairo_win32_scaled_font_is_type1 (scaled_font)) {
+-	    type1_glyphs = _cairo_malloc_ab (num_glyphs, sizeof (cairo_glyph_t));
+-	    if (type1_glyphs == NULL) {
+-		status = _cairo_error (CAIRO_STATUS_NO_MEMORY);
+-		goto FINISH;
+-	    }
+-	    memcpy (type1_glyphs, glyphs, num_glyphs * sizeof (cairo_glyph_t));
+-	    for (i = 0; i < num_glyphs; i++) {
+-		status = _cairo_scaled_font_subsets_map_glyph (surface->font_subsets,
+-							       scaled_font,
+-							       type1_glyphs[i].index,
+-							       NULL, 0,
+-							       &subset_glyph);
+-		if (status)
+-		    goto FINISH;
+-
+-		type1_glyphs[i].index = subset_glyph.unicode;
+-	    }
+-	    glyphs = type1_glyphs;
+-	}
+-
+-	if (surface->has_ctm || surface->has_gdi_ctm) {
+-	    cairo_matrix_multiply (&ctm, &surface->ctm, &surface->gdi_ctm);
+-	    for (i = 0; i < num_glyphs; i++)
+-		cairo_matrix_transform_point (&ctm, &glyphs[i].x, &glyphs[i].y);
+-	    cairo_matrix_multiply (&ctm, &scaled_font->ctm, &ctm);
+-	    scaled_font = cairo_scaled_font_create (scaled_font->font_face,
+-						    &scaled_font->font_matrix,
+-						    &ctm,
+-						    &scaled_font->options);
+-	}
+-	status = _cairo_win32_surface_show_glyphs (surface, op,
+-						   source, glyphs,
+-						   num_glyphs, scaled_font,
+-						   clip,
+-						   remaining_glyphs);
+-	if (surface->has_ctm || surface->has_gdi_ctm)
+-	    cairo_scaled_font_destroy (scaled_font);
+-
+-	if (type1_glyphs != NULL)
+-	    free (type1_glyphs);
+-
++	status = _cairo_win32_printing_surface_emit_win32_glyphs (surface,
++								  op,
++								  source,
++								  glyphs,
++								  num_glyphs,
++								  scaled_font,
++								  clip,
++								  remaining_glyphs);
+ 	goto FINISH;
+     }
+ #endif
+ 
+     SaveDC (surface->dc);
+     old_ctm = surface->ctm;
+     old_has_ctm = surface->has_ctm;
+     surface->has_ctm = TRUE;
+diff --git a/gfx/cairo/cairo/src/cairo-win32-private.h b/gfx/cairo/cairo/src/cairo-win32-private.h
+--- a/gfx/cairo/cairo/src/cairo-win32-private.h
++++ b/gfx/cairo/cairo/src/cairo-win32-private.h
+@@ -157,16 +157,27 @@ _cairo_win32_surface_get_extents (void		
+ uint32_t
+ _cairo_win32_flags_for_dc (HDC dc);
+ 
+ cairo_status_t
+ _cairo_win32_surface_set_clip_region (void           *abstract_surface,
+ 				      cairo_region_t *region);
+ 
+ cairo_int_status_t
++_cairo_win32_surface_show_glyphs_internal (void			 *surface,
++					   cairo_operator_t	  op,
++					   const cairo_pattern_t *source,
++					   cairo_glyph_t	 *glyphs,
++					   int			  num_glyphs,
++					   cairo_scaled_font_t	 *scaled_font,
++					   cairo_clip_t		 *clip,
++					   int			 *remaining_glyphs,
++					   cairo_bool_t		  glyph_indices);
++
++cairo_int_status_t
+ _cairo_win32_surface_show_glyphs (void			*surface,
+ 				  cairo_operator_t	 op,
+ 				  const cairo_pattern_t	*source,
+ 				  cairo_glyph_t		*glyphs,
+ 				  int			 num_glyphs,
+ 				  cairo_scaled_font_t	*scaled_font,
+ 				  cairo_clip_t		*clip,
+ 				  int			*remaining_glyphs);
+diff --git a/gfx/cairo/cairo/src/cairo-win32-surface.c b/gfx/cairo/cairo/src/cairo-win32-surface.c
+--- a/gfx/cairo/cairo/src/cairo-win32-surface.c
++++ b/gfx/cairo/cairo/src/cairo-win32-surface.c
+@@ -1607,24 +1607,25 @@ static cairo_status_t
+ _cairo_win32_surface_flush (void *abstract_surface)
+ {
+     return _cairo_win32_surface_set_clip_region (abstract_surface, NULL);
+ }
+ 
+ #define STACK_GLYPH_SIZE 256
+ 
+ cairo_int_status_t
+-_cairo_win32_surface_show_glyphs (void			*surface,
+-				  cairo_operator_t	 op,
+-				  const cairo_pattern_t	*source,
+-				  cairo_glyph_t		*glyphs,
+-				  int			 num_glyphs,
+-				  cairo_scaled_font_t	*scaled_font,
+-				  cairo_clip_t		*clip,
+-				  int			*remaining_glyphs)
++_cairo_win32_surface_show_glyphs_internal (void			*surface,
++					   cairo_operator_t	 op,
++					   const cairo_pattern_t	*source,
++					   cairo_glyph_t		*glyphs,
++					   int			 num_glyphs,
++					   cairo_scaled_font_t	*scaled_font,
++					   cairo_clip_t		*clip,
++					   int			*remaining_glyphs,
++					   cairo_bool_t           glyph_indexing)
+ {
+ #ifdef CAIRO_HAS_WIN32_FONT
+     if (scaled_font->backend->type == CAIRO_FONT_TYPE_DWRITE) {
+ #ifdef CAIRO_HAS_DWRITE_FONT
+         return _cairo_dwrite_show_glyphs_on_surface(surface, op, source, glyphs, num_glyphs, scaled_font, clip);
+ #endif
+     } else {
+ 	cairo_win32_surface_t *dst = surface;
+@@ -1737,29 +1738,20 @@ _cairo_win32_surface_show_glyphs (void		
+ 		dxy_buf[j+1] = _cairo_lround (logical_y - next_logical_y);
+ 		    /* note that GDI coordinate system is inverted */
+ 
+ 		logical_x = next_logical_x;
+ 		logical_y = next_logical_y;
+ 	    }
+ 	}
+ 
+-	/* Using glyph indices for a Type 1 font does not work on a
+-	 * printer DC. The win32 printing surface will convert the the
+-	 * glyph indices of Type 1 fonts to the unicode values.
+-	 */
+-	if ((dst->flags & CAIRO_WIN32_SURFACE_FOR_PRINTING) &&
+-	    _cairo_win32_scaled_font_is_type1 (scaled_font))
+-	{
++	if (glyph_indexing)
++	    glyph_index_option = ETO_GLYPH_INDEX;
++	else
+ 	    glyph_index_option = 0;
+-	}
+-	else
+-	{
+-	    glyph_index_option = ETO_GLYPH_INDEX;
+-	}
+ 
+ 	win_result = ExtTextOutW(dst->dc,
+ 				 start_x,
+ 				 start_y,
+ 				 glyph_index_option | ETO_PDY,
+ 				 NULL,
+ 				 glyph_buf,
+ 				 num_glyphs,
+@@ -1778,16 +1770,37 @@ _cairo_win32_surface_show_glyphs (void		
+     }
+ #else
+     return CAIRO_INT_STATUS_UNSUPPORTED;
+ #endif
+ }
+ 
+ #undef STACK_GLYPH_SIZE
+ 
++cairo_int_status_t
++_cairo_win32_surface_show_glyphs (void			*surface,
++ 				  cairo_operator_t	 op,
++ 				  const cairo_pattern_t *source,
++ 				  cairo_glyph_t	 	*glyphs,
++ 				  int			 num_glyphs,
++ 				  cairo_scaled_font_t	*scaled_font,
++ 				  cairo_clip_t          *clip,
++ 				  int		      	*remaining_glyphs)
++{
++    return _cairo_win32_surface_show_glyphs_internal (surface,
++ 						      op,
++ 						      source,
++ 						      glyphs,
++ 						      num_glyphs,
++ 						      scaled_font,
++ 						      clip,
++ 						      remaining_glyphs,
++ 						      TRUE);
++}
++
+ static cairo_surface_t *
+ cairo_win32_surface_create_internal (HDC hdc, cairo_format_t format)
+ {
+     cairo_win32_surface_t *surface;
+ 
+     RECT rect;
+ 
+     surface = malloc (sizeof (cairo_win32_surface_t));

From 484ce06f8adbeca4b87b38251b3334e4cf7da7c4 Mon Sep 17 00:00:00 2001
From: Tom Schuster <evilpies@gmail.com>
Date: Wed, 14 Sep 2011 20:47:08 +0200
Subject: [PATCH 120/209] Bug 686323: Put JSOP_DIV logic into its own function
 r=dvander

--HG--
extra : rebase_source : 782f70b7af3d8f0866517f17af23c4c4d11fb9cd
---
 js/src/jsinterp.cpp                 | 26 ++++----------------------
 js/src/jslibmath.h                  | 26 +++++++++++++++++++++++---
 js/src/methodjit/FastArithmetic.cpp | 16 +---------------
 3 files changed, 28 insertions(+), 40 deletions(-)

diff --git a/js/src/jsinterp.cpp b/js/src/jsinterp.cpp
index fc524050293e..fd701806a1a6 100644
--- a/js/src/jsinterp.cpp
+++ b/js/src/jsinterp.cpp
@@ -3066,29 +3066,11 @@ BEGIN_CASE(JSOP_DIV)
     if (!ToNumber(cx, lval, &d1) || !ToNumber(cx, rval, &d2))
         goto error;
     regs.sp--;
-    if (d2 == 0) {
-        const Value *vp;
-#ifdef XP_WIN
-        /* XXX MSVC miscompiles such that (NaN == 0) */
-        if (JSDOUBLE_IS_NaN(d2))
-            vp = &rt->NaNValue;
-        else
-#endif
-        if (d1 == 0 || JSDOUBLE_IS_NaN(d1))
-            vp = &rt->NaNValue;
-        else if (JSDOUBLE_IS_NEG(d1) != JSDOUBLE_IS_NEG(d2))
-            vp = &rt->negativeInfinityValue;
-        else
-            vp = &rt->positiveInfinityValue;
-        regs.sp[-1] = *vp;
+
+    regs.sp[-1].setNumber(NumberDiv(d1, d2));
+
+    if (d2 == 0 || (regs.sp[-1].isDouble() && !(lval.isDouble() || rval.isDouble())))
         TypeScript::MonitorOverflow(cx, script, regs.pc);
-    } else {
-        d1 /= d2;
-        if (!regs.sp[-1].setNumber(d1) &&
-            !(lval.isDouble() || rval.isDouble())) {
-            TypeScript::MonitorOverflow(cx, script, regs.pc);
-        }
-    }
 }
 END_CASE(JSOP_DIV)
 
diff --git a/js/src/jslibmath.h b/js/src/jslibmath.h
index 215e7a5771cb..94f4ee9071e5 100644
--- a/js/src/jslibmath.h
+++ b/js/src/jslibmath.h
@@ -42,9 +42,7 @@
 #define _LIBMATH_H
 
 #include <math.h>
-#ifdef XP_WIN
-# include "jsnum.h"
-#endif
+#include "jsnum.h"
 
 /*
  * Use system provided math routines.
@@ -88,5 +86,27 @@ js_fmod(double d, double d2)
     return fmod(d, d2);
 }
 
+namespace js {
+
+inline double
+NumberDiv(double a, double b) {
+    if (b == 0) {
+        if (a == 0 || JSDOUBLE_IS_NaN(a) 
+#ifdef XP_WIN
+            || JSDOUBLE_IS_NaN(a) /* XXX MSVC miscompiles such that (NaN == 0) */
+#endif
+        )
+            return js_NaN;    
+        else if (JSDOUBLE_IS_NEG(a) != JSDOUBLE_IS_NEG(b))
+            return js_NegativeInfinity;
+        else
+            return js_PositiveInfinity; 
+    }
+
+    return a / b;
+}
+
+}
+
 #endif /* _LIBMATH_H */
 
diff --git a/js/src/methodjit/FastArithmetic.cpp b/js/src/methodjit/FastArithmetic.cpp
index 99cebda24d09..cf2786b9e5f0 100644
--- a/js/src/methodjit/FastArithmetic.cpp
+++ b/js/src/methodjit/FastArithmetic.cpp
@@ -113,21 +113,7 @@ mjit::Compiler::tryBinaryConstantFold(JSContext *cx, FrameState &frame, JSOp op,
         dL *= dR;
         break;
       case JSOP_DIV:
-        if (dR == 0) {
-#ifdef XP_WIN
-            if (JSDOUBLE_IS_NaN(dR))
-                dL = js_NaN;
-            else
-#endif
-            if (dL == 0 || JSDOUBLE_IS_NaN(dL))
-                dL = js_NaN;
-            else if (JSDOUBLE_IS_NEG(dL) != JSDOUBLE_IS_NEG(dR))
-                dL = cx->runtime->negativeInfinityValue.toDouble();
-            else
-                dL = cx->runtime->positiveInfinityValue.toDouble();
-        } else {
-            dL /= dR;
-        }
+        dL = js::NumberDiv(dL, dR);
         break;
       case JSOP_MOD:
         if (needInt)

From 24fffb7a5b036744474f46c276e7594be2f513d7 Mon Sep 17 00:00:00 2001
From: Florian Haenel <florian.haenel@heeen.de>
Date: Wed, 14 Sep 2011 21:14:43 +0200
Subject: [PATCH 121/209] Bug 667885 - about:support causes screen freeze.
 r=chrislord

---
 gfx/thebes/GLContextProviderEGL.cpp | 20 +++++++++++++-------
 gfx/thebes/GLDefs.h                 |  3 ++-
 2 files changed, 15 insertions(+), 8 deletions(-)

diff --git a/gfx/thebes/GLContextProviderEGL.cpp b/gfx/thebes/GLContextProviderEGL.cpp
index d74c1fcdd624..d14be6dd4d32 100644
--- a/gfx/thebes/GLContextProviderEGL.cpp
+++ b/gfx/thebes/GLContextProviderEGL.cpp
@@ -169,7 +169,11 @@ typedef void *EGLCastToRelevantPtr;
 typedef void *EGLImageKHR;
 typedef void *GLeglImageOES;
 
+#ifdef MOZ_WIDGET_QT
+#define EGL_DEFAULT_DISPLAY  ((EGLNativeDisplayType)QX11Info::display())
+#else
 #define EGL_DEFAULT_DISPLAY  ((EGLNativeDisplayType)0)
+#endif
 #define EGL_NO_CONTEXT       ((EGLContext)0)
 #define EGL_NO_DISPLAY       ((EGLDisplay)0)
 #define EGL_NO_SURFACE       ((EGLSurface)0)
@@ -242,6 +246,8 @@ public:
 
     typedef EGLDisplay (GLAPIENTRY * pfnGetDisplay)(void *display_id);
     pfnGetDisplay fGetDisplay;
+    typedef EGLSurface (GLAPIENTRY * pfnGetCurrentSurface)(EGLint);
+    pfnGetCurrentSurface fGetCurrentSurface;
     typedef EGLContext (GLAPIENTRY * pfnGetCurrentContext)(void);
     pfnGetCurrentContext fGetCurrentContext;
     typedef EGLBoolean (GLAPIENTRY * pfnMakeCurrent)(EGLDisplay dpy, EGLSurface draw, EGLSurface read, EGLContext ctx);
@@ -364,6 +370,7 @@ public:
 
         LibrarySymbolLoader::SymLoadStruct earlySymbols[] = {
             SYMBOL(GetDisplay),
+            SYMBOL(GetCurrentSurface),
             SYMBOL(GetCurrentContext),
             SYMBOL(MakeCurrent),
             SYMBOL(DestroyContext),
@@ -693,7 +700,7 @@ public:
 #endif
 
         sEGLLibrary.fDestroyContext(EGL_DISPLAY(), mContext);
-        if (mSurface) {
+        if (mSurface && !mPlatformContext) {
             sEGLLibrary.fDestroySurface(EGL_DISPLAY(), mSurface);
         }
     }
@@ -825,17 +832,15 @@ public:
     }
 #endif
 
-#ifndef MOZ_WIDGET_QT
     virtual void
     ReleaseSurface() {
-        if (mSurface) {
+        if (mSurface && !mPlatformContext) {
             sEGLLibrary.fMakeCurrent(EGL_DISPLAY(), EGL_NO_SURFACE, EGL_NO_SURFACE,
                                      EGL_NO_CONTEXT);
             sEGLLibrary.fDestroySurface(EGL_DISPLAY(), mSurface);
             mSurface = NULL;
         }
     }
-#endif
 
     PRBool SetupLookupFunction()
     {
@@ -856,7 +861,7 @@ public:
 
     PRBool SwapBuffers()
     {
-        if (mSurface) {
+        if (mSurface && !mPlatformContext) {
             return sEGLLibrary.fSwapBuffers(EGL_DISPLAY(), mSurface);
         } else {
             return PR_FALSE;
@@ -1063,7 +1068,7 @@ GLContextEGL::ResizeOffscreen(const gfxIntSize& aNewSize)
 
         SetOffscreenSize(aNewSize, pbsize);
 
-        if (mSurface) {
+        if (mSurface && !mPlatformContext) {
             sEGLLibrary.fDestroySurface(EGL_DISPLAY(), mSurface);
         }
 
@@ -1733,7 +1738,8 @@ GLContextProviderEGL::CreateForWindow(nsIWidget *aWidget)
         nsRefPtr<GLContextEGL> glContext =
             new GLContextEGL(ContextFormat(DepthToGLFormat(context->device()->depth())),
                              NULL,
-                             NULL, NULL,
+                             NULL,
+                             sEGLLibrary.fGetCurrentSurface(LOCAL_EGL_DRAW), // just use same surface for read and draw
                              sEGLLibrary.fGetCurrentContext(),
                              PR_FALSE);
 
diff --git a/gfx/thebes/GLDefs.h b/gfx/thebes/GLDefs.h
index 0ef43e1f7aa0..87c48ccb02b0 100644
--- a/gfx/thebes/GLDefs.h
+++ b/gfx/thebes/GLDefs.h
@@ -3198,5 +3198,6 @@ typedef ptrdiff_t GLintptr;
 #define LOCAL_EGL_WRITE_SURFACE_BIT_KHR       0x0002
 #define LOCAL_EGL_LOCK_SURFACE_BIT_KHR        0x0080
 #define LOCAL_EGL_CORE_NATIVE_ENGINE          0x305B
-
+#define LOCAL_EGL_READ                        0x305A
+#define LOCAL_EGL_DRAW                        0x3059
 #endif

From d536205b6e54170d454ed4b2325cdb5ed52443ca Mon Sep 17 00:00:00 2001
From: Jonathan Kew <jfkthame@gmail.com>
Date: Wed, 14 Sep 2011 20:20:26 +0100
Subject: [PATCH 122/209] bug 685214 - use URI spec rather than file path to
 specify hyphenation dictionary, and read using nsIInputStream rather than
 stdio. r=bsmedberg

---
 intl/hyphenation/src/Makefile.in      |   1 +
 intl/hyphenation/src/hnjalloc.h       |  33 +++++++
 intl/hyphenation/src/hnjstdio.cpp     | 137 ++++++++++++++++++++++++++
 intl/hyphenation/src/nsHyphenator.cpp |  16 +--
 4 files changed, 180 insertions(+), 7 deletions(-)
 create mode 100644 intl/hyphenation/src/hnjstdio.cpp

diff --git a/intl/hyphenation/src/Makefile.in b/intl/hyphenation/src/Makefile.in
index 8d0af0b2531e..d2b6d1ad0101 100644
--- a/intl/hyphenation/src/Makefile.in
+++ b/intl/hyphenation/src/Makefile.in
@@ -51,6 +51,7 @@ CSRCS            = hyphen.c \
 
 CPPSRCS          = nsHyphenator.cpp \
                    nsHyphenationManager.cpp \
+                   hnjstdio.cpp \
                    $(NULL)
 
 include $(topsrcdir)/config/rules.mk
diff --git a/intl/hyphenation/src/hnjalloc.h b/intl/hyphenation/src/hnjalloc.h
index fe14ff060116..d678a7dd6382 100644
--- a/intl/hyphenation/src/hnjalloc.h
+++ b/intl/hyphenation/src/hnjalloc.h
@@ -48,3 +48,36 @@
 #define hnj_realloc(p, size)  moz_xrealloc(p, size)
 #define hnj_free(p)           moz_free(p)
 
+/*
+ * To enable us to load hyphenation dictionaries from arbitrary resource URIs,
+ * not just through file paths using stdio, we override the (few) stdio APIs
+ * that hyphen.c uses and provide our own reimplementation that calls Gecko
+ * i/o methods.
+ */
+
+#include <stdio.h> /* ensure stdio.h is loaded before our macros */
+
+#undef FILE
+#define FILE hnjFile
+
+#define fopen(path,mode)      hnjFopen(path,mode)
+#define fclose(file)          hnjFclose(file)
+#define fgets(buf,count,file) hnjFgets(buf,count,file)
+
+typedef struct hnjFile_ hnjFile;
+
+#ifdef __cplusplus
+extern "C" {
+#endif
+
+hnjFile* hnjFopen(const char* aURISpec, const char* aMode);
+
+int hnjFclose(hnjFile* f);
+
+char* hnjFgets(char* s, int n, hnjFile* f);
+
+#ifdef __cplusplus
+}
+#endif
+
+
diff --git a/intl/hyphenation/src/hnjstdio.cpp b/intl/hyphenation/src/hnjstdio.cpp
new file mode 100644
index 000000000000..4e56b2a6d6d9
--- /dev/null
+++ b/intl/hyphenation/src/hnjstdio.cpp
@@ -0,0 +1,137 @@
+/* ***** BEGIN LICENSE BLOCK *****
+ * Version: MPL 1.1/GPL 2.0/LGPL 2.1
+ *
+ * The contents of this file are subject to the Mozilla Public License Version
+ * 1.1 (the "License"); you may not use this file except in compliance with
+ * the License. You may obtain a copy of the License at
+ * http://www.mozilla.org/MPL/
+ *
+ * Software distributed under the License is distributed on an "AS IS" basis,
+ * WITHOUT WARRANTY OF ANY KIND, either express or implied. See the License
+ * for the specific language governing rights and limitations under the
+ * License.
+ *
+ * The Original Code is Mozilla Hyphenation Service.
+ *
+ * The Initial Developer of the Original Code is
+ * Mozilla Foundation.
+ * Portions created by the Initial Developer are Copyright (C) 2011
+ * the Initial Developer. All Rights Reserved.
+ *
+ * Contributor(s):
+ *   Jonathan Kew <jfkthame@gmail.com>
+ *
+ * Alternatively, the contents of this file may be used under the terms of
+ * either the GNU General Public License Version 2 or later (the "GPL"), or
+ * the GNU Lesser General Public License Version 2.1 or later (the "LGPL"),
+ * in which case the provisions of the GPL or the LGPL are applicable instead
+ * of those above. If you wish to allow use of your version of this file only
+ * under the terms of either the GPL or the LGPL, and not to allow others to
+ * use your version of this file under the terms of the MPL, indicate your
+ * decision by deleting the provisions above and replace them with the notice
+ * and other provisions required by the GPL or the LGPL. If you do not delete
+ * the provisions above, a recipient may use your version of this file under
+ * the terms of any one of the MPL, the GPL or the LGPL.
+ *
+ * ***** END LICENSE BLOCK ***** */
+
+// This file provides substitutes for the basic stdio routines used by hyphen.c
+// to read its dictionary files. We #define the stdio names to these versions
+// in hnjalloc.h, so that we can use nsIURI and nsIInputStream to specify and
+// access the dictionary resources.
+
+#include "hnjalloc.h"
+#include "nsNetUtil.h"
+
+#define BUFSIZE 1024
+
+struct hnjFile_ {
+    nsCOMPtr<nsIInputStream> mStream;
+    char                     mBuffer[BUFSIZE];
+    PRUint32                 mCurPos;
+    PRUint32                 mLimit;
+};
+
+// replacement for fopen()
+// (not a full substitute: only supports read access)
+hnjFile*
+hnjFopen(const char* aURISpec, const char* aMode)
+{
+    // this override only needs to support "r"
+    NS_ASSERTION(!strcmp(aMode, "r"), "unsupported fopen() mode in hnjFopen");
+
+    nsCOMPtr<nsIURI> uri;
+    nsresult rv = NS_NewURI(getter_AddRefs(uri), aURISpec);
+    if (NS_FAILED(rv)) {
+        return nsnull;
+    }
+
+    nsCOMPtr<nsIInputStream> instream;
+    rv = NS_OpenURI(getter_AddRefs(instream), uri);
+    if (NS_FAILED(rv)) {
+        return nsnull;
+    }
+
+    hnjFile *f = new hnjFile;
+    f->mStream = instream;
+    f->mCurPos = 0;
+    f->mLimit = 0;
+
+    return f;
+}
+
+// replacement for fclose()
+int
+hnjFclose(hnjFile* f)
+{
+    NS_ASSERTION(f && f->mStream, "bad argument to hnjFclose");
+
+    int result = 0;
+    nsresult rv = f->mStream->Close();
+    if (NS_FAILED(rv)) {
+        result = EOF;
+    }
+    f->mStream = nsnull;
+
+    delete f;
+    return result;
+}
+
+// replacement for fgets()
+// (not a full reimplementation, but sufficient for libhyphen's needs)
+char*
+hnjFgets(char* s, int n, hnjFile* f)
+{
+    NS_ASSERTION(s && f, "bad argument to hnjFgets");
+
+    int i = 0;
+    while (i < n - 1) {
+        if (f->mCurPos < f->mLimit) {
+            char c = f->mBuffer[f->mCurPos++];
+            s[i++] = c;
+            if (c == '\n' || c == '\r') {
+                break;
+            }
+            continue;
+        }
+
+        f->mCurPos = 0;
+
+        nsresult rv = f->mStream->Read(f->mBuffer, BUFSIZE, &f->mLimit);
+        if (NS_FAILED(rv)) {
+            f->mLimit = 0;
+            return nsnull;
+        }
+
+        if (f->mLimit == 0) {
+            break;
+        }
+    }
+
+    if (i == 0) {
+        return nsnull; // end of file
+    }
+
+    s[i] = '\0'; // null-terminate the returned string
+    return s;
+}
diff --git a/intl/hyphenation/src/nsHyphenator.cpp b/intl/hyphenation/src/nsHyphenator.cpp
index 89ad40fb8567..458a9e215002 100644
--- a/intl/hyphenation/src/nsHyphenator.cpp
+++ b/intl/hyphenation/src/nsHyphenator.cpp
@@ -40,23 +40,25 @@
 #include "nsUTF8Utils.h"
 #include "nsIUGenCategory.h"
 #include "nsUnicharUtilCIID.h"
+#include "nsNetUtil.h"
 
 #include "hyphen.h"
 
 nsHyphenator::nsHyphenator(nsIFile *aFile)
   : mDict(nsnull)
 {
-  nsCString path;
-  aFile->GetNativePath(path);
-  mDict = hnj_hyphen_load(path.get());
+  nsCString urlSpec;
+  nsresult rv = NS_GetURLSpecFromFile(aFile, urlSpec);
+  if (NS_FAILED(rv)) {
+    return;
+  }
+  mDict = hnj_hyphen_load(urlSpec.get());
 #ifdef DEBUG
   if (mDict) {
-    printf("loaded hyphenation patterns from %s\n", path.get());
+    printf("loaded hyphenation patterns from %s\n", urlSpec.get());
   }
 #endif
-  nsresult rv;
-  mCategories =
-    do_GetService(NS_UNICHARCATEGORY_CONTRACTID, &rv);
+  mCategories = do_GetService(NS_UNICHARCATEGORY_CONTRACTID, &rv);
   NS_ASSERTION(NS_SUCCEEDED(rv), "failed to get category service");
 }
 

From 6b622748064b9ed9f160ffef9f7dbba88968e99d Mon Sep 17 00:00:00 2001
From: Martin Richard <martius@martiusweb.net>
Date: Thu, 15 Sep 2011 07:39:50 +1200
Subject: [PATCH 123/209] Bug 646333 - Make video constants consistently const
 T. r=cpearce

---
 content/media/VideoUtils.h                    |  8 ++---
 .../media/nsAudioAvailableEventManager.cpp    |  2 +-
 content/media/nsAudioStream.cpp               |  2 +-
 .../media/nsBuiltinDecoderStateMachine.cpp    |  2 +-
 content/media/nsMediaDecoder.cpp              |  6 ++--
 content/media/nsMediaDecoder.h                |  6 ++--
 content/media/nsMediaStream.cpp               |  4 +--
 content/media/nsMediaStream.h                 |  4 +--
 content/media/ogg/nsOggCodecState.cpp         | 30 +++++++++----------
 content/media/ogg/nsOggReader.cpp             |  9 +-----
 content/media/raw/nsRawReader.cpp             |  2 +-
 content/media/wave/nsWaveReader.cpp           | 18 +++++------
 content/media/webm/nsWebMReader.h             |  2 +-
 13 files changed, 44 insertions(+), 51 deletions(-)

diff --git a/content/media/VideoUtils.h b/content/media/VideoUtils.h
index 56a83d55d867..910ce3d27962 100644
--- a/content/media/VideoUtils.h
+++ b/content/media/VideoUtils.h
@@ -141,17 +141,17 @@ PRBool SamplesToUsecs(PRInt64 aSamples, PRUint32 aRate, PRInt64& aOutUsecs);
 PRBool UsecsToSamples(PRInt64 aUsecs, PRUint32 aRate, PRInt64& aOutSamples);
 
 // Number of microseconds per second. 1e6.
-#define USECS_PER_S 1000000
+static const PRInt64 USECS_PER_S = 1000000;
 
 // Number of microseconds per millisecond.
-#define USECS_PER_MS 1000
+static const PRInt64 USECS_PER_MS = 1000;
 
 // The maximum height and width of the video. Used for
 // sanitizing the memory allocation of the RGB buffer.
 // The maximum resolution we anticipate encountering in the
 // wild is 2160p - 3840x2160 pixels.
-#define MAX_VIDEO_WIDTH  4000
-#define MAX_VIDEO_HEIGHT 3000
+static const PRInt32 MAX_VIDEO_WIDTH = 4000;
+static const PRInt32 MAX_VIDEO_HEIGHT = 3000;
 
 // Scales the display rect aDisplay by aspect ratio aAspectRatio.
 // Note that aDisplay must be validated by nsVideoInfo::ValidateVideoRegion()
diff --git a/content/media/nsAudioAvailableEventManager.cpp b/content/media/nsAudioAvailableEventManager.cpp
index d4f7021338e9..326fda865d25 100644
--- a/content/media/nsAudioAvailableEventManager.cpp
+++ b/content/media/nsAudioAvailableEventManager.cpp
@@ -41,7 +41,7 @@
 #include "nsAudioAvailableEventManager.h"
 #include "VideoUtils.h"
 
-#define MAX_PENDING_EVENTS 100
+static const nsTArray< nsCOMPtr<nsIRunnable> >::size_type MAX_PENDING_EVENTS = 100;
 
 using namespace mozilla;
 
diff --git a/content/media/nsAudioStream.cpp b/content/media/nsAudioStream.cpp
index e31d2b19c59e..c736e970b4f7 100644
--- a/content/media/nsAudioStream.cpp
+++ b/content/media/nsAudioStream.cpp
@@ -78,7 +78,7 @@ using mozilla::TimeStamp;
 PRLogModuleInfo* gAudioStreamLog = nsnull;
 #endif
 
-#define FAKE_BUFFER_SIZE 176400
+static const PRUint32 FAKE_BUFFER_SIZE = 176400;
 
 class nsAudioStreamLocal : public nsAudioStream
 {
diff --git a/content/media/nsBuiltinDecoderStateMachine.cpp b/content/media/nsBuiltinDecoderStateMachine.cpp
index 46b819bb3b46..374baeb538a7 100644
--- a/content/media/nsBuiltinDecoderStateMachine.cpp
+++ b/content/media/nsBuiltinDecoderStateMachine.cpp
@@ -59,7 +59,7 @@ extern PRLogModuleInfo* gBuiltinDecoderLog;
 // Wait this number of seconds when buffering, then leave and play
 // as best as we can if the required amount of data hasn't been
 // retrieved.
-#define BUFFERING_WAIT 30
+static const PRUint32 BUFFERING_WAIT = 30;
 
 // The amount of data to retrieve during buffering is computed based
 // on the download rate. BUFFERING_MIN_RATE is the minimum download
diff --git a/content/media/nsMediaDecoder.cpp b/content/media/nsMediaDecoder.cpp
index b59a0d2128a4..9da375179b03 100644
--- a/content/media/nsMediaDecoder.cpp
+++ b/content/media/nsMediaDecoder.cpp
@@ -57,10 +57,10 @@
 using namespace mozilla;
 
 // Number of milliseconds between progress events as defined by spec
-#define PROGRESS_MS 350
+static const PRUint32 PROGRESS_MS = 350;
 
 // Number of milliseconds of no data before a stall event is fired as defined by spec
-#define STALL_MS 3000
+static const PRUint32 STALL_MS = 3000;
 
 // Number of estimated seconds worth of data we need to have buffered 
 // ahead of the current playback position before we allow the media decoder
@@ -68,7 +68,7 @@ using namespace mozilla;
 // catching up with the download. Having this margin make the
 // nsMediaDecoder::CanPlayThrough() calculation more stable in the case of
 // fluctuating bitrates.
-#define CAN_PLAY_THROUGH_MARGIN 10
+static const PRInt64 CAN_PLAY_THROUGH_MARGIN = 10;
 
 nsMediaDecoder::nsMediaDecoder() :
   mElement(0),
diff --git a/content/media/nsMediaDecoder.h b/content/media/nsMediaDecoder.h
index baa5da1ff8f0..734c4dc8cb68 100644
--- a/content/media/nsMediaDecoder.h
+++ b/content/media/nsMediaDecoder.h
@@ -59,12 +59,12 @@ class nsTimeRanges;
 // The size to use for audio data frames in MozAudioAvailable events.
 // This value is per channel, and is chosen to give ~43 fps of events,
 // for example, 44100 with 2 channels, 2*1024 = 2048.
-#define FRAMEBUFFER_LENGTH_PER_CHANNEL 1024
+static const PRUint32 FRAMEBUFFER_LENGTH_PER_CHANNEL = 1024;
 
 // The total size of the framebuffer used for MozAudioAvailable events
 // has to be within the following range.
-#define FRAMEBUFFER_LENGTH_MIN 512
-#define FRAMEBUFFER_LENGTH_MAX 16384
+static const PRUint32 FRAMEBUFFER_LENGTH_MIN = 512;
+static const PRUint32 FRAMEBUFFER_LENGTH_MAX = 16384;
 
 // All methods of nsMediaDecoder must be called from the main thread only
 // with the exception of GetImageContainer, SetVideoData and GetStatistics,
diff --git a/content/media/nsMediaStream.cpp b/content/media/nsMediaStream.cpp
index 8d7275dfac8f..5a0bcaef9df5 100644
--- a/content/media/nsMediaStream.cpp
+++ b/content/media/nsMediaStream.cpp
@@ -62,8 +62,8 @@
 #include "mozilla/Util.h" // for DebugOnly
 #include "nsContentUtils.h"
 
-#define HTTP_OK_CODE 200
-#define HTTP_PARTIAL_RESPONSE_CODE 206
+static const PRUint32 HTTP_OK_CODE = 200;
+static const PRUint32 HTTP_PARTIAL_RESPONSE_CODE = 206;
 
 using namespace mozilla;
 
diff --git a/content/media/nsMediaStream.h b/content/media/nsMediaStream.h
index 544461ed0cbd..689fc8d8cf74 100644
--- a/content/media/nsMediaStream.h
+++ b/content/media/nsMediaStream.h
@@ -51,9 +51,9 @@
 // For HTTP seeking, if number of bytes needing to be
 // seeked forward is less than this value then a read is
 // done rather than a byte range request.
-#define SEEK_VS_READ_THRESHOLD (32*1024)
+static const PRInt64 SEEK_VS_READ_THRESHOLD = 32*1024;
 
-#define HTTP_REQUESTED_RANGE_NOT_SATISFIABLE_CODE 416
+static const PRUint32 HTTP_REQUESTED_RANGE_NOT_SATISFIABLE_CODE = 416;
 
 class nsMediaDecoder;
 
diff --git a/content/media/ogg/nsOggCodecState.cpp b/content/media/ogg/nsOggCodecState.cpp
index 7629af1b9bfa..0089b2a57ac6 100644
--- a/content/media/ogg/nsOggCodecState.cpp
+++ b/content/media/ogg/nsOggCodecState.cpp
@@ -773,34 +773,34 @@ nsSkeletonState::~nsSkeletonState()
 // http://wiki.xiph.org/Ogg_Skeleton_4
 
 // Minimum length in bytes of a Skeleton header packet.
-#define SKELETON_MIN_HEADER_LEN 28
-#define SKELETON_4_0_MIN_HEADER_LEN 80
+static const long SKELETON_MIN_HEADER_LEN = 28;
+static const long SKELETON_4_0_MIN_HEADER_LEN = 80;
 
 // Minimum length in bytes of a Skeleton 4.0 index packet.
-#define SKELETON_4_0_MIN_INDEX_LEN 42
+static const long SKELETON_4_0_MIN_INDEX_LEN = 42;
 
 // Minimum possible size of a compressed index keypoint.
-#define MIN_KEY_POINT_SIZE 2
+static const size_t MIN_KEY_POINT_SIZE = 2;
 
 // Byte offset of the major and minor version numbers in the
 // Ogg Skeleton 4.0 header packet.
-#define SKELETON_VERSION_MAJOR_OFFSET 8
-#define SKELETON_VERSION_MINOR_OFFSET 10
+static const size_t SKELETON_VERSION_MAJOR_OFFSET = 8;
+static const size_t SKELETON_VERSION_MINOR_OFFSET = 10;
 
 // Byte-offsets of the presentation time numerator and denominator
-#define SKELETON_PRESENTATION_TIME_NUMERATOR_OFFSET 12
-#define SKELETON_PRESENTATION_TIME_DENOMINATOR_OFFSET 20
+static const size_t SKELETON_PRESENTATION_TIME_NUMERATOR_OFFSET = 12;
+static const size_t SKELETON_PRESENTATION_TIME_DENOMINATOR_OFFSET = 20;
 
 // Byte-offsets of the length of file field in the Skeleton 4.0 header packet.
-#define SKELETON_FILE_LENGTH_OFFSET 64
+static const size_t SKELETON_FILE_LENGTH_OFFSET = 64;
 
 // Byte-offsets of the fields in the Skeleton index packet.
-#define INDEX_SERIALNO_OFFSET 6
-#define INDEX_NUM_KEYPOINTS_OFFSET 10
-#define INDEX_TIME_DENOM_OFFSET 18
-#define INDEX_FIRST_NUMER_OFFSET 26
-#define INDEX_LAST_NUMER_OFFSET 34
-#define INDEX_KEYPOINT_OFFSET 42
+static const size_t INDEX_SERIALNO_OFFSET = 6;
+static const size_t INDEX_NUM_KEYPOINTS_OFFSET = 10;
+static const size_t INDEX_TIME_DENOM_OFFSET = 18;
+static const size_t INDEX_FIRST_NUMER_OFFSET = 26;
+static const size_t INDEX_LAST_NUMER_OFFSET = 34;
+static const size_t INDEX_KEYPOINT_OFFSET = 42;
 
 static PRBool IsSkeletonBOS(ogg_packet* aPacket)
 {
diff --git a/content/media/ogg/nsOggReader.cpp b/content/media/ogg/nsOggReader.cpp
index 297689fb98c4..9418f58cd618 100644
--- a/content/media/ogg/nsOggReader.cpp
+++ b/content/media/ogg/nsOggReader.cpp
@@ -63,20 +63,13 @@ extern PRLogModuleInfo* gBuiltinDecoderLog;
 #define SEEK_LOG(type, msg)
 #endif
 
-// If we don't have a Theora video stream, then during seeking, if a seek
-// target is less than SEEK_DECODE_MARGIN ahead of the current playback
-// position, we'll just decode forwards rather than performing a bisection
-// search. If we have Theora video we use the maximum keyframe interval as
-// this value, rather than SEEK_DECODE_MARGIN. This makes small seeks faster.
-#define SEEK_DECODE_MARGIN 2000000
-
 // The number of microseconds of "fuzz" we use in a bisection search over
 // HTTP. When we're seeking with fuzz, we'll stop the search if a bisection
 // lands between the seek target and SEEK_FUZZ_USECS microseconds before the
 // seek target.  This is becaue it's usually quicker to just keep downloading
 // from an exisiting connection than to do another bisection inside that
 // small range, which would open a new HTTP connetion.
-#define SEEK_FUZZ_USECS 500000
+static const PRUint32 SEEK_FUZZ_USECS = 500000;
 
 enum PageSyncResult {
   PAGE_SYNC_ERROR = 1,
diff --git a/content/media/raw/nsRawReader.cpp b/content/media/raw/nsRawReader.cpp
index ebf2a95e27de..ac0a3c1dba80 100644
--- a/content/media/raw/nsRawReader.cpp
+++ b/content/media/raw/nsRawReader.cpp
@@ -43,7 +43,7 @@
 #include "nsRawDecoder.h"
 #include "VideoUtils.h"
 
-#define RAW_ID 0x595556
+static const PRUint24 RAW_ID = 0x595556;
 
 nsRawReader::nsRawReader(nsBuiltinDecoder* aDecoder)
   : nsBuiltinDecoderReader(aDecoder),
diff --git a/content/media/wave/nsWaveReader.cpp b/content/media/wave/nsWaveReader.cpp
index 07408c3faeb8..5451bd3760ef 100644
--- a/content/media/wave/nsWaveReader.cpp
+++ b/content/media/wave/nsWaveReader.cpp
@@ -62,27 +62,27 @@ extern PRLogModuleInfo* gBuiltinDecoderLog;
 #endif
 
 // Magic values that identify RIFF chunks we're interested in.
-#define RIFF_CHUNK_MAGIC 0x52494646
-#define WAVE_CHUNK_MAGIC 0x57415645
-#define FRMT_CHUNK_MAGIC 0x666d7420
-#define DATA_CHUNK_MAGIC 0x64617461
+static const PRUint32 RIFF_CHUNK_MAGIC = 0x52494646;
+static const PRUint32 WAVE_CHUNK_MAGIC = 0x57415645;
+static const PRUint32 FRMT_CHUNK_MAGIC = 0x666d7420;
+static const PRUint32 DATA_CHUNK_MAGIC = 0x64617461;
 
 // Size of RIFF chunk header.  4 byte chunk header type and 4 byte size field.
-#define RIFF_CHUNK_HEADER_SIZE 8
+static const PRUint16 RIFF_CHUNK_HEADER_SIZE = 8;
 
 // Size of RIFF header.  RIFF chunk and 4 byte RIFF type.
-#define RIFF_INITIAL_SIZE (RIFF_CHUNK_HEADER_SIZE + 4)
+static const PRUint16 RIFF_INITIAL_SIZE = RIFF_CHUNK_HEADER_SIZE + 4;
 
 // Size of required part of format chunk.  Actual format chunks may be
 // extended (for non-PCM encodings), but we skip any extended data.
-#define WAVE_FORMAT_CHUNK_SIZE 16
+static const PRUint16 WAVE_FORMAT_CHUNK_SIZE = 16;
 
 // PCM encoding type from format chunk.  Linear PCM is the only encoding
 // supported by nsAudioStream.
-#define WAVE_FORMAT_ENCODING_PCM 1
+static const PRUint16 WAVE_FORMAT_ENCODING_PCM = 1;
 
 // Maximum number of channels supported
-#define MAX_CHANNELS 2
+static const PRUint8 MAX_CHANNELS = 2;
 
 namespace {
   PRUint32
diff --git a/content/media/webm/nsWebMReader.h b/content/media/webm/nsWebMReader.h
index 50c2868c9670..f68c061d05fe 100644
--- a/content/media/webm/nsWebMReader.h
+++ b/content/media/webm/nsWebMReader.h
@@ -177,7 +177,7 @@ private:
                            PRBool aBOS,
                            PRBool aEOS,
                            PRInt64 aGranulepos);
-                     
+
   // Decode a nestegg packet of audio data. Push the audio data on the
   // audio queue. Returns PR_TRUE when there's more audio to decode,
   // PR_FALSE if the audio is finished, end of file has been reached,

From 4b72859bf6dc03e8ac45a0ab92fb010158e363ba Mon Sep 17 00:00:00 2001
From: Matt Brubeck <mbrubeck@mozilla.com>
Date: Wed, 14 Sep 2011 14:02:57 -0700
Subject: [PATCH 124/209] Bug 686743 - Fix styling of items in the overflow
 menu on Android [r=wesj]

---
 mobile/themes/core/browser.css             | 4 ++--
 mobile/themes/core/gingerbread/browser.css | 4 ++--
 mobile/themes/core/honeycomb/browser.css   | 4 ++--
 3 files changed, 6 insertions(+), 6 deletions(-)

diff --git a/mobile/themes/core/browser.css b/mobile/themes/core/browser.css
index 4a434943ce2e..5441ab2dbfe7 100644
--- a/mobile/themes/core/browser.css
+++ b/mobile/themes/core/browser.css
@@ -1485,7 +1485,7 @@ setting {
   margin: @margin_xxxnormal@ @margin_xxxnormal@ 0 @margin_xxxnormal@;
 }
 
-#appmenu-overflow-appcommands > .appmenu-button {
+#appmenu-overflow-commands > .appmenu-button {
   color: #000;
   background: transparent;
   font-size: @font_normal@ !important;
@@ -1495,7 +1495,7 @@ setting {
   -moz-box-align: center;
 }
 
-#appmenu-overflow-appcommands > .appmenu-button:hover:active {
+#appmenu-overflow-commands > .appmenu-button:hover:active {
   background-image: url("chrome://browser/skin/images/appmenu-active-hdpi.png");
   background-size: 100% 100%;
 }
diff --git a/mobile/themes/core/gingerbread/browser.css b/mobile/themes/core/gingerbread/browser.css
index e75b3389fbe8..e19160a7a53c 100644
--- a/mobile/themes/core/gingerbread/browser.css
+++ b/mobile/themes/core/gingerbread/browser.css
@@ -1453,7 +1453,7 @@ setting {
   margin: @margin_xxxnormal@ @margin_xxxnormal@ 0 @margin_xxxnormal@;
 }
 
-#appmenu-overflow-appcommands > .appmenu-button {
+#appmenu-overflow-commands > .appmenu-button {
   color: @color_text_default@;
   background: transparent;
   font-size: @font_normal@ !important;
@@ -1463,7 +1463,7 @@ setting {
   -moz-box-align: center;
 }
 
-#appmenu-overflow-appcommands > .appmenu-button:hover:active {
+#appmenu-overflow-commands > .appmenu-button:hover:active {
   background-image: url("chrome://browser/skin/images/appmenu-active-hdpi.png");
   background-size: 100% 100%;
 }
diff --git a/mobile/themes/core/honeycomb/browser.css b/mobile/themes/core/honeycomb/browser.css
index 94b511a2df1c..b23f46147fcb 100644
--- a/mobile/themes/core/honeycomb/browser.css
+++ b/mobile/themes/core/honeycomb/browser.css
@@ -1561,7 +1561,7 @@ setting {
   margin: @margin_xxxnormal@ @margin_xxxnormal@ 0 @margin_xxxnormal@;
 }
 
-#appmenu-overflow-appcommands > .appmenu-button {
+#appmenu-overflow-commands > .appmenu-button {
   color: @color_text_default@;
   background: transparent;
   font-size: @font_normal@ !important;
@@ -1571,7 +1571,7 @@ setting {
   -moz-box-align: center;
 }
 
-#appmenu-overflow-appcommands > .appmenu-button:hover:active {
+#appmenu-overflow-commands > .appmenu-button:hover:active {
   background-image: url("chrome://browser/skin/images/appmenu-active-hdpi.png");
   background-size: 100% 100%;
 }

From e74d938256b5dea6b23fd6a81a918b834d3e158c Mon Sep 17 00:00:00 2001
From: Lucas Rocha <lucasr@mozilla.com>
Date: Wed, 14 Sep 2011 14:03:08 -0700
Subject: [PATCH 125/209] Bug 685487 - Add title label to tabs pane
 (r=mbrubeck)

---
 mobile/chrome/content/browser-ui.js        | 20 ++++++++------
 mobile/chrome/content/tabs.xml             | 32 ++++++++++++++++------
 mobile/components/SessionStore.js          |  3 ++
 mobile/themes/core/browser.css             | 16 +++++++----
 mobile/themes/core/gingerbread/browser.css | 16 +++++++----
 mobile/themes/core/honeycomb/browser.css   | 16 +++++++----
 mobile/themes/core/tablet.css              | 13 +++++++--
 7 files changed, 79 insertions(+), 37 deletions(-)

diff --git a/mobile/chrome/content/browser-ui.js b/mobile/chrome/content/browser-ui.js
index e627d6c060fa..9111b7528558 100644
--- a/mobile/chrome/content/browser-ui.js
+++ b/mobile/chrome/content/browser-ui.js
@@ -115,18 +115,22 @@ var BrowserUI = {
   },
 
   _titleChanged: function(aBrowser) {
+    let url = this.getDisplayURI(aBrowser);
+    let caption = aBrowser.contentTitle || url;
+
+    if (aBrowser.contentTitle == "" && !Util.isURLEmpty(aBrowser.userTypedValue))
+      caption = aBrowser.userTypedValue;
+    else if (Util.isURLEmpty(url))
+      caption = "";
+
+    let tab = Browser.getTabForBrowser(aBrowser);
+    if (tab)
+      tab.chromeTab.updateTitle(caption);
+
     let browser = Browser.selectedBrowser;
     if (browser && aBrowser != browser)
       return;
 
-    let url = this.getDisplayURI(browser);
-    let caption = browser.contentTitle || url;
-
-    if (browser.contentTitle == "" && !Util.isURLEmpty(browser.userTypedValue))
-      caption = browser.userTypedValue;
-    else if (Util.isURLEmpty(url))
-      caption = "";
-
     if (caption) {
       this._title.value = caption;
       this._title.classList.remove("placeholder");
diff --git a/mobile/chrome/content/tabs.xml b/mobile/chrome/content/tabs.xml
index 0081c2501ace..70420436c2bc 100644
--- a/mobile/chrome/content/tabs.xml
+++ b/mobile/chrome/content/tabs.xml
@@ -8,14 +8,17 @@
 
   <binding id="documenttab">
     <content observes="bcast_urlbarState">
-      <xul:stack anonid="page" class="documenttab-container" flex="1">
-        <html:canvas anonid="thumbnail" class="documenttab-thumbnail" left="0" moz-opaque="true" empty="true"
-          onclick="document.getBindingParent(this)._onClick()" observes="bcast_urlbarState"/>
-        <xul:hbox anonid="reload" class="documenttab-reload" left="0" top="0" onclick="document.getBindingParent(this)._onUndo();" observes="bcast_urlbarState"/>
-        <xul:hbox anonid="close-container" class="documenttab-close-container" top="0" align="center" onclick="document.getBindingParent(this)._onClose()" observes="bcast_urlbarState">
-          <xul:image anonid="close" class="documenttab-close" mousethrough="always" observes="bcast_urlbarState"/>
-        </xul:hbox>
-      </xul:stack>
+      <xul:vbox anonid="container" class="documenttab-container" left="0" top="0" observes="bcast_urlbarState">
+        <xul:stack anonid="page" flex="1">
+          <html:canvas anonid="thumbnail" class="documenttab-thumbnail" left="0" moz-opaque="true" empty="true"
+            onclick="document.getBindingParent(this)._onClick()" observes="bcast_urlbarState"/>
+          <xul:hbox anonid="reload" class="documenttab-reload" left="0" top="0" onclick="document.getBindingParent(this)._onUndo();" observes="bcast_urlbarState"/>
+          <xul:hbox anonid="close-container" class="documenttab-close-container" top="0" align="center" onclick="document.getBindingParent(this)._onClose()" observes="bcast_urlbarState">
+            <xul:image anonid="close" class="documenttab-close" mousethrough="always" observes="bcast_urlbarState"/>
+          </xul:hbox>
+        </xul:stack>
+        <xul:label anonid="title" crop="end" class="documenttab-title" observes="bcast_urlbarState"/>
+      </xul:vbox>
     </content>
 
     <implementation>
@@ -23,6 +26,7 @@
       <field name="thumbnail" readonly="true">document.getAnonymousElementByAttribute(this, "anonid", "thumbnail");</field>
       <field name="_reload" readonly="true">document.getAnonymousElementByAttribute(this, "anonid", "reload");</field>
       <field name="_closeContainer" readonly="true">document.getAnonymousElementByAttribute(this, "anonid", "close-container");</field>
+      <field name="_title" readonly="true">document.getAnonymousElementByAttribute(this, "anonid", "title");</field>
       <field name="_container" readonly="true">this.parentNode.parentNode;</field>
 
       <constructor>
@@ -52,8 +56,9 @@
             if (tabWidth != thumbnail.width) {
               let reload = this._reload;
               let closeContainer = this._closeContainer;
+              let title = this._title;
 
-              thumbnail.width = reload.width = tabWidth;
+              thumbnail.width = reload.width = title.width = tabWidth;
               thumbnail.height = reload.height = tabHeight;
               closeContainer.width = closeWidth;
               closeContainer.height = closeHeight;
@@ -94,6 +99,15 @@
         </body>
       </method>
 
+      <method name="updateTitle">
+        <parameter name="title"/>
+        <body>
+          <![CDATA[
+            this._title.value = title;
+          ]]>
+        </body>
+      </method>
+
       <method name="updateThumbnail">
         <parameter name="browser"/>
         <parameter name="width"/>
diff --git a/mobile/components/SessionStore.js b/mobile/components/SessionStore.js
index 15ba3b272472..7ebff9e64053 100644
--- a/mobile/components/SessionStore.js
+++ b/mobile/components/SessionStore.js
@@ -781,6 +781,9 @@ SessionStore.prototype = {
             tab.browser.__SS_data = tabData;
             tab.browser.__SS_restore = true;
 
+            // Restore current title
+            tab.chromeTab.updateTitle(tabData.entries[tabData.index - 1].title);
+
             // Recreate the thumbnail if we are delay loading the tab
             let canvas = tab.chromeTab.thumbnail;
             canvas.setAttribute("restored", "true");
diff --git a/mobile/themes/core/browser.css b/mobile/themes/core/browser.css
index 5441ab2dbfe7..dde1dc6d6e46 100644
--- a/mobile/themes/core/browser.css
+++ b/mobile/themes/core/browser.css
@@ -978,8 +978,8 @@ documenttab[selected="true"] {
   margin: -1px;
 }
 
-documenttab:hover:active > stack > .documenttab-thumbnail,
-documenttab[selected="true"] > stack > .documenttab-thumbnail {
+documenttab:hover:active > vbox > stack > .documenttab-thumbnail,
+documenttab[selected="true"] > vbox > stack > .documenttab-thumbnail {
   opacity: 1.0;
 }
 
@@ -996,7 +996,7 @@ documenttab[selected="true"] > stack > .documenttab-thumbnail {
   list-style-image: url("chrome://browser/skin/images/close-inactive-tab-hdpi.png");
 }
 
-documenttab[selected="true"] > stack > hbox > .documenttab-close {
+documenttab[selected="true"] > vbox > stack > hbox > .documenttab-close {
   list-style-image: url("chrome://browser/skin/images/close-default-hdpi.png");
 }
 
@@ -1004,7 +1004,7 @@ documenttab[selected="true"] > stack > hbox > .documenttab-close {
   list-style-image: url("chrome://browser/skin/images/close-active-hdpi.png");
 }
 
-documenttab:only-child > stack > hbox > .documenttab-close {
+documenttab:only-child > vbox > stack > hbox > .documenttab-close {
   display: none;
 }
 
@@ -1017,14 +1017,18 @@ documenttab[reload="true"] {
   display: none;
 }
 
-documenttab[reload="true"] > stack > .documenttab-close-container {
+documenttab[reload="true"] > vbox > stack > .documenttab-close-container {
   display: none;
 }
 
-documenttab[reload="true"] > stack > .documenttab-reload {
+documenttab[reload="true"] > vbox > stack > .documenttab-reload {
   display: -moz-box;
 }
 
+.documenttab-title {
+  display: none;
+}
+
 #newtab-button {
   -moz-box-flex: 1;
   list-style-image: url("images/newtab-default-hdpi.png");
diff --git a/mobile/themes/core/gingerbread/browser.css b/mobile/themes/core/gingerbread/browser.css
index e19160a7a53c..e8d6ffb2d27f 100644
--- a/mobile/themes/core/gingerbread/browser.css
+++ b/mobile/themes/core/gingerbread/browser.css
@@ -927,8 +927,8 @@ documenttab[selected="true"] {
   margin: -1px;
 }
 
-documenttab:hover:active > stack > .documenttab-thumbnail,
-documenttab[selected="true"] > stack > .documenttab-thumbnail {
+documenttab:hover:active > vbox > stack > .documenttab-thumbnail,
+documenttab[selected="true"] > vbox > stack > .documenttab-thumbnail {
   opacity: 1.0;
 }
 
@@ -945,7 +945,7 @@ documenttab[selected="true"] > stack > .documenttab-thumbnail {
   list-style-image: url("chrome://browser/skin/images/close-inactive-tab-hdpi.png");
 }
 
-documenttab[selected="true"] > stack > hbox > .documenttab-close {
+documenttab[selected="true"] > vbox > stack > hbox > .documenttab-close {
   list-style-image: url("chrome://browser/skin/images/close-default-hdpi.png");
 }
 
@@ -953,7 +953,7 @@ documenttab[selected="true"] > stack > hbox > .documenttab-close {
   list-style-image: url("chrome://browser/skin/images/close-active-hdpi.png");
 }
 
-documenttab:only-child > stack > hbox > .documenttab-close {
+documenttab:only-child > vbox > stack > hbox > .documenttab-close {
   display: none;
 }
 
@@ -966,14 +966,18 @@ documenttab[reload="true"] {
   display: none;
 }
 
-documenttab[reload="true"] > stack > .documenttab-close-container {
+documenttab[reload="true"] > vbox > stack > .documenttab-close-container {
   display: none;
 }
 
-documenttab[reload="true"] > stack > .documenttab-reload {
+documenttab[reload="true"] > vbox > stack > .documenttab-reload {
   display: -moz-box;
 }
 
+.documenttab-title {
+  display: none;
+}
+
 #newtab-button {
   -moz-box-flex: 1;
   list-style-image: url("images/newtab-default-hdpi.png");
diff --git a/mobile/themes/core/honeycomb/browser.css b/mobile/themes/core/honeycomb/browser.css
index b23f46147fcb..2195b934b515 100644
--- a/mobile/themes/core/honeycomb/browser.css
+++ b/mobile/themes/core/honeycomb/browser.css
@@ -1016,8 +1016,8 @@ documenttab[selected="true"] {
   margin: -1px;
 }
 
-documenttab:hover:active > stack > .documenttab-thumbnail,
-documenttab[selected="true"] > stack > .documenttab-thumbnail {
+documenttab:hover:active > vbox > stack > .documenttab-thumbnail,
+documenttab[selected="true"] > vbox > stack > .documenttab-thumbnail {
   opacity: 1.0;
 }
 
@@ -1034,7 +1034,7 @@ documenttab[selected="true"] > stack > .documenttab-thumbnail {
   list-style-image: url("chrome://browser/skin/images/close-inactive-tab-hdpi.png");
 }
 
-documenttab[selected="true"] > stack > hbox > .documenttab-close {
+documenttab[selected="true"] > vbox > stack > hbox > .documenttab-close {
   list-style-image: url("chrome://browser/skin/images/close-default-hdpi.png");
 }
 
@@ -1042,7 +1042,7 @@ documenttab[selected="true"] > stack > hbox > .documenttab-close {
   list-style-image: url("chrome://browser/skin/images/close-active-hdpi.png");
 }
 
-documenttab:only-child > stack > hbox > .documenttab-close {
+documenttab:only-child > vbox > stack > hbox > .documenttab-close {
   display: none;
 }
 
@@ -1055,14 +1055,18 @@ documenttab[reload="true"] {
   display: none;
 }
 
-documenttab[reload="true"] > stack > .documenttab-close-container {
+documenttab[reload="true"] > vbox > stack > .documenttab-close-container {
   display: none;
 }
 
-documenttab[reload="true"] > stack > .documenttab-reload {
+documenttab[reload="true"] > vbox > stack > .documenttab-reload {
   display: -moz-box;
 }
 
+.documenttab-title {
+  display: none;
+}
+
 #newtab-button {
   -moz-box-flex: 1;
   list-style-image: url("images/newtab-default-hdpi.png");
diff --git a/mobile/themes/core/tablet.css b/mobile/themes/core/tablet.css
index 2f3a90e05037..aeeaf5b89049 100644
--- a/mobile/themes/core/tablet.css
+++ b/mobile/themes/core/tablet.css
@@ -71,7 +71,7 @@
   -moz-box-align: center;
 }
 
-documenttab[selected="true"] > stack > .documenttab-close-container[tablet] {
+documenttab[selected="true"] > vbox > stack > .documenttab-close-container[tablet] {
   background: url("chrome://browser/skin/images/close-background-hdpi.png");
   background-repeat: no-repeat;
   background-position: right;
@@ -85,7 +85,7 @@ documenttab[selected="true"] > stack > .documenttab-close-container[tablet] {
   list-style-image: url("chrome://browser/skin/images/close-inactive-tab-tablet-hdpi.png");
 }
 
-documenttab[selected="true"] > stack > hbox > .documenttab-close[tablet] {
+documenttab[selected="true"] > vbox > stack > hbox > .documenttab-close[tablet] {
   list-style-image: url("chrome://browser/skin/images/close-default-tablet-hdpi.png");
 }
 
@@ -97,6 +97,15 @@ documenttab[selected="true"] > stack > hbox > .documenttab-close[tablet] {
   background: url("chrome://browser/skin/images/tab-reopen-tablet-hdpi.png");
 }
 
+.documenttab-title[tablet] {
+  color: #FFF;
+  font-size: @font_xtiny@ !important;
+  padding: @padding_small@;
+  margin: 0px;
+  text-align: center;
+  display: -moz-box;
+}
+
 #newtab-button[tablet] {
   list-style-image: url("images/newtab-default-tablet-hdpi.png");
 }

From 58225fa30e5f1af263405e62f31e047b44dcfff7 Mon Sep 17 00:00:00 2001
From: Lucas Rocha <lucasr@mozilla.com>
Date: Wed, 14 Sep 2011 14:03:17 -0700
Subject: [PATCH 126/209] Bug 685487 - Reduce space between tabs in tablet mode
 (r=mbrubeck)

---
 mobile/themes/core/tablet.css | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/mobile/themes/core/tablet.css b/mobile/themes/core/tablet.css
index aeeaf5b89049..0d3c1615f969 100644
--- a/mobile/themes/core/tablet.css
+++ b/mobile/themes/core/tablet.css
@@ -51,8 +51,10 @@
   /* Use px instead of mozmm because tab bar items have hard-coded pixel sizes */
   width: 200px;
   padding: 12px;
+  padding-bottom: 0px;
   -moz-margin-start: 0px;
   background: none;
+  margin-bottom: 0px;
 }
 
 #tabs[tablet] documenttab[selected="true"] {

From 420d8a88639efee96e24477e7ce05fc864dc0cea Mon Sep 17 00:00:00 2001
From: Matt Woodrow <mwoodrow@mozilla.com>
Date: Wed, 14 Sep 2011 16:16:23 -0700
Subject: [PATCH 127/209] Bug 676690 - Don't release DataSourceSurface pointers
 until we have finished accessing the pixels. r=Bas

---
 content/canvas/src/nsCanvasRenderingContext2DAzure.cpp | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/content/canvas/src/nsCanvasRenderingContext2DAzure.cpp b/content/canvas/src/nsCanvasRenderingContext2DAzure.cpp
index eba6bcddb078..38a1c4401e8e 100644
--- a/content/canvas/src/nsCanvasRenderingContext2DAzure.cpp
+++ b/content/canvas/src/nsCanvasRenderingContext2DAzure.cpp
@@ -4098,11 +4098,12 @@ nsCanvasRenderingContext2DAzure::GetImageData_explicit(PRInt32 x, PRInt32 y, PRU
 
   PRUint8 *src = aData;
   PRUint32 srcStride = w * 4;
-    
+  
+  RefPtr<DataSourceSurface> readback;
   if (!srcReadRect.IsEmpty()) {
     RefPtr<SourceSurface> snapshot = mTarget->Snapshot();
 
-    RefPtr<DataSourceSurface> readback = snapshot->GetDataSurface();
+    readback = snapshot->GetDataSurface();
 
     srcStride = readback->Stride();
     src = readback->GetData() + srcReadRect.y * srcStride + srcReadRect.x * 4;

From 4575405e494fe0dad1a0803aa701995fc56c9b90 Mon Sep 17 00:00:00 2001
From: Joel Maher <jmaher@mozilla.com>
Date: Wed, 14 Sep 2011 19:20:11 -0400
Subject: [PATCH 128/209] =?UTF-8?q?Bug=20650535=20-=20Android=20tests=20fa?=
 =?UTF-8?q?il=20with=20"Timed=20out=20while=20waiting=20for=20server=20sta?=
 =?UTF-8?q?rtup"=20=20r=3D=3F=3F=3F?=

---
 testing/mochitest/runtests.py | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/testing/mochitest/runtests.py b/testing/mochitest/runtests.py
index abb34128535f..74f00123decc 100644
--- a/testing/mochitest/runtests.py
+++ b/testing/mochitest/runtests.py
@@ -670,6 +670,9 @@ class Mochitest(object):
     except KeyboardInterrupt:
       self.automation.log.info("INFO | runtests.py | Received keyboard interrupt.\n");
       status = -1
+    except:
+      self.automation.log.info("INFO | runtests.py | Received unexpected exception while running application '%s'\n" % (sys.exc_info()[1])
+      status = 1
 
     if options.vmwareRecording:
       self.stopVMwareRecording();

From 3803a0a40b67c2fb3e939013f1db26a2c5dab621 Mon Sep 17 00:00:00 2001
From: Joel Maher <jmaher@mozilla.com>
Date: Wed, 14 Sep 2011 20:02:02 -0400
Subject: [PATCH 129/209] Bug 650535 - bustage fix for missing right paren

---
 testing/mochitest/runtests.py | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/testing/mochitest/runtests.py b/testing/mochitest/runtests.py
index 74f00123decc..99da043f1128 100644
--- a/testing/mochitest/runtests.py
+++ b/testing/mochitest/runtests.py
@@ -671,7 +671,7 @@ class Mochitest(object):
       self.automation.log.info("INFO | runtests.py | Received keyboard interrupt.\n");
       status = -1
     except:
-      self.automation.log.info("INFO | runtests.py | Received unexpected exception while running application '%s'\n" % (sys.exc_info()[1])
+      self.automation.log.info("INFO | runtests.py | Received unexpected exception while running application '%s'\n" % (sys.exc_info()[1]))
       status = 1
 
     if options.vmwareRecording:

From 29d140647ff068c042326f2378019636832102cb Mon Sep 17 00:00:00 2001
From: Chris Leary <cdleary@mozilla.com>
Date: Wed, 14 Sep 2011 17:00:59 -0700
Subject: [PATCH 130/209] Bug 685025 - Shell should be able to read from stdin.
 (r=brendan)

--HG--
extra : rebase_source : 9ddc8e09ddb00baa50bccef395330f846a2ce531
---
 js/src/shell/jsoptparse.cpp | 8 +++-----
 1 file changed, 3 insertions(+), 5 deletions(-)

diff --git a/js/src/shell/jsoptparse.cpp b/js/src/shell/jsoptparse.cpp
index 3be80491012e..958054a10d1b 100644
--- a/js/src/shell/jsoptparse.cpp
+++ b/js/src/shell/jsoptparse.cpp
@@ -376,12 +376,9 @@ OptionParser::parseArgs(int inputArgc, char **argv)
     for (size_t i = 1; i < argc; ++i) {
         char *arg = argv[i];
         Result r;
-        if (arg[0] == '-' && optionsAllowed) {
+        /* Note: solo dash option is actually a 'stdin' argument. */
+        if (arg[0] == '-' && arg[1] != '\0' && optionsAllowed) {
             /* Option. */
-            size_t arglen = strlen(arg);
-            if (arglen < 2) /* Do not permit solo dash option. */
-                return error("Invalid dash option");
-
             Option *opt;
             if (arg[1] == '-') {
                 /* Long option. */
@@ -402,6 +399,7 @@ OptionParser::parseArgs(int inputArgc, char **argv)
             /* Argument. */
             r = handleArg(argc, argv, &i, &optionsAllowed);
         }
+
         switch (r) {
           case Okay:
             break;

From aae1b5528e7b4e0140ddb21c3a4805f80dfacb1c Mon Sep 17 00:00:00 2001
From: Chris Leary <cdleary@mozilla.com>
Date: Tue, 13 Sep 2011 22:32:14 -0700
Subject: [PATCH 131/209] Bug 670049 - JSParseNode accessors. (r=dherman)

--HG--
extra : rebase_source : c83d7bafafe951e2365573c459e2fab2d5ba4362
---
 js/src/jsemit.cpp    |  539 +++++++++++-----------
 js/src/jsparse.cpp   | 1026 +++++++++++++++++++++---------------------
 js/src/jsparse.h     |   75 +--
 js/src/jsreflect.cpp |  178 ++++----
 js/src/jsxml.cpp     |   28 +-
 5 files changed, 919 insertions(+), 927 deletions(-)

diff --git a/js/src/jsemit.cpp b/js/src/jsemit.cpp
index 5e30a01f0dd6..99b30a0bb475 100644
--- a/js/src/jsemit.cpp
+++ b/js/src/jsemit.cpp
@@ -1445,7 +1445,7 @@ EmitTraceOp(JSContext *cx, JSCodeGenerator *cg, JSParseNode *nextpn)
          * instruction. nextpn is often a block, in which case the next
          * instruction typically comes from the first statement inside.
          */
-        if (nextpn->pn_type == TOK_LC && nextpn->pn_arity == PN_LIST && nextpn->pn_head)
+        if (nextpn->isKind(TOK_LC) && nextpn->isArity(PN_LIST) && nextpn->pn_head)
             nextpn = nextpn->pn_head;
         if (!UpdateLineNumberNotes(cx, cg, nextpn->pn_pos.begin.lineno))
             return -1;
@@ -1695,7 +1695,7 @@ js_DefineCompileTimeConstant(JSContext *cx, JSCodeGenerator *cg, JSAtom *atom,
                              JSParseNode *pn)
 {
     /* XXX just do numbers for now */
-    if (pn->pn_type == TOK_NUMBER) {
+    if (pn->isKind(TOK_NUMBER)) {
         if (!cg->constMap.put(atom, NumberValue(pn->pn_dval)))
             return JS_FALSE;
     }
@@ -1955,7 +1955,7 @@ EmitSlotIndexOp(JSContext *cx, JSOp op, uintN slot, uintN index,
 bool
 JSCodeGenerator::shouldNoteClosedName(JSParseNode *pn)
 {
-    return !callsEval() && pn->pn_defn && pn->isClosed();
+    return !callsEval() && pn->isDefn() && pn->isClosed();
 }
 
 /*
@@ -1983,7 +1983,7 @@ AdjustBlockSlot(JSContext *cx, JSCodeGenerator *cg, jsint slot)
 static bool
 EmitEnterBlock(JSContext *cx, JSParseNode *pn, JSCodeGenerator *cg)
 {
-    JS_ASSERT(PN_TYPE(pn) == TOK_LEXICALSCOPE);
+    JS_ASSERT(pn->isKind(TOK_LEXICALSCOPE));
     if (!EmitObjectOp(cx, pn->pn_objbox, JSOP_ENTERBLOCK, cg))
         return false;
 
@@ -2003,7 +2003,7 @@ EmitEnterBlock(JSContext *cx, JSParseNode *pn, JSCodeGenerator *cg)
         }
 
         JSDefinition *dn = (JSDefinition *) v.toPrivate();
-        JS_ASSERT(dn->pn_defn);
+        JS_ASSERT(dn->isDefn());
         JS_ASSERT(uintN(dn->frameSlot() + depth) < JS_BIT(16));
         dn->pn_cookie.set(dn->pn_cookie.level(), uint16(dn->frameSlot() + depth));
 #ifdef DEBUG
@@ -2150,10 +2150,10 @@ BindGlobal(JSContext *cx, JSCodeGenerator *cg, JSParseNode *pn, JSAtom *atom)
     pn->pn_cookie.makeFree();
 
     JSDefinition *dn;
-    if (pn->pn_used) {
+    if (pn->isUsed()) {
         dn = pn->pn_lexdef;
     } else {
-        if (!pn->pn_defn)
+        if (!pn->isDefn())
             return true;
         dn = (JSDefinition *)pn;
     }
@@ -2190,33 +2190,33 @@ BindNameToSlot(JSContext *cx, JSCodeGenerator *cg, JSParseNode *pn)
     JSAtom *atom;
     JSDefinition::Kind dn_kind;
 
-    JS_ASSERT(pn->pn_type == TOK_NAME);
+    JS_ASSERT(pn->isKind(TOK_NAME));
 
     /* Idempotency tests come first, since we may be called more than once. */
     if (pn->pn_dflags & PND_BOUND)
         return JS_TRUE;
 
     /* No cookie initialized for these two, they're pre-bound by definition. */
-    JS_ASSERT(pn->pn_op != JSOP_ARGUMENTS && pn->pn_op != JSOP_CALLEE);
+    JS_ASSERT(!pn->isOp(JSOP_ARGUMENTS) && !pn->isOp(JSOP_CALLEE));
 
     /*
      * The parser linked all uses (including forward references) to their
      * definitions, unless a with statement or direct eval intervened.
      */
-    if (pn->pn_used) {
+    if (pn->isUsed()) {
         JS_ASSERT(pn->pn_cookie.isFree());
         dn = pn->pn_lexdef;
-        JS_ASSERT(dn->pn_defn);
+        JS_ASSERT(dn->isDefn());
         if (pn->isDeoptimized())
             return JS_TRUE;
         pn->pn_dflags |= (dn->pn_dflags & PND_CONST);
     } else {
-        if (!pn->pn_defn)
+        if (!pn->isDefn())
             return JS_TRUE;
         dn = (JSDefinition *) pn;
     }
 
-    op = PN_OP(pn);
+    op = pn->getOp();
     if (op == JSOP_NOP)
         return JS_TRUE;
 
@@ -2243,7 +2243,7 @@ BindNameToSlot(JSContext *cx, JSCodeGenerator *cg, JSParseNode *pn)
             if (cg->parser->callerFrame && dn->isTopLevel())
                 JS_ASSERT(cg->compileAndGo());
             else
-                pn->pn_op = JSOP_FALSE;
+                pn->setOp(JSOP_FALSE);
             pn->pn_dflags |= PND_BOUND;
             return JS_TRUE;
         }
@@ -2257,7 +2257,7 @@ BindNameToSlot(JSContext *cx, JSCodeGenerator *cg, JSParseNode *pn)
                     return JS_FALSE;
                 }
             }
-            pn->pn_op = op = JSOP_NAME;
+            pn->setOp(op = JSOP_NAME);
         }
     }
 
@@ -2271,7 +2271,7 @@ BindNameToSlot(JSContext *cx, JSCodeGenerator *cg, JSParseNode *pn)
             if (!BindKnownGlobal(cx, cg, dn, pn, atom))
                 return JS_FALSE;
             if (!pn->pn_cookie.isFree()) {
-                pn->pn_op = JSOP_GETGLOBAL;
+                pn->setOp(JSOP_GETGLOBAL);
                 return JS_TRUE;
             }
         }
@@ -2308,7 +2308,7 @@ BindNameToSlot(JSContext *cx, JSCodeGenerator *cg, JSParseNode *pn)
                 if (!cg->makeAtomIndex(atom, &_))
                     return JS_FALSE;
 
-                pn->pn_op = op;
+                pn->setOp(op);
                 pn->pn_dflags |= PND_BOUND;
                 return JS_TRUE;
             }
@@ -2328,7 +2328,7 @@ BindNameToSlot(JSContext *cx, JSCodeGenerator *cg, JSParseNode *pn)
         if (!cg->makeAtomIndex(atom, &_))
             return JS_FALSE;
 
-        pn->pn_op = op;
+        pn->setOp(op);
         pn->pn_dflags |= PND_BOUND;
 
         return JS_TRUE;
@@ -2406,7 +2406,7 @@ BindNameToSlot(JSContext *cx, JSCodeGenerator *cg, JSParseNode *pn)
             upvarMap[index].set(skip, slot);
         }
 
-        pn->pn_op = JSOP_GETFCSLOT;
+        pn->setOp(JSOP_GETFCSLOT);
         JS_ASSERT((index & JS_BITMASK(16)) == index);
         pn->pn_cookie.set(0, index);
         pn->pn_dflags |= PND_BOUND;
@@ -2448,12 +2448,12 @@ BindNameToSlot(JSContext *cx, JSCodeGenerator *cg, JSParseNode *pn)
         break;
 
       case JSDefinition::VAR:
-        if (PN_OP(dn) == JSOP_CALLEE) {
+        if (dn->isOp(JSOP_CALLEE)) {
             JS_ASSERT(op != JSOP_CALLEE);
             JS_ASSERT((cg->fun()->flags & JSFUN_LAMBDA) && atom == cg->fun()->atom);
 
             /*
-             * Leave pn->pn_op == JSOP_NAME if cg->fun is heavyweight to
+             * Leave pn->isOp(JSOP_NAME) if cg->fun is heavyweight to
              * address two cases: a new binding introduced by eval, and
              * assignment to the name in strict mode.
              *
@@ -2482,7 +2482,7 @@ BindNameToSlot(JSContext *cx, JSCodeGenerator *cg, JSParseNode *pn)
                 pn->pn_dflags |= PND_CONST;
             }
 
-            pn->pn_op = op;
+            pn->setOp(op);
             pn->pn_dflags |= PND_BOUND;
             return JS_TRUE;
         }
@@ -2506,8 +2506,8 @@ BindNameToSlot(JSContext *cx, JSCodeGenerator *cg, JSParseNode *pn)
         break;
     }
 
-    JS_ASSERT(op != PN_OP(pn));
-    pn->pn_op = op;
+    JS_ASSERT(!pn->isOp(op));
+    pn->setOp(op);
     pn->pn_cookie.set(0, cookie.slot());
     pn->pn_dflags |= PND_BOUND;
     return JS_TRUE;
@@ -2570,7 +2570,7 @@ CheckSideEffects(JSContext *cx, JSCodeGenerator *cg, JSParseNode *pn,
     if (!pn || *answer)
         return ok;
 
-    switch (pn->pn_arity) {
+    switch (pn->getArity()) {
       case PN_FUNC:
         /*
          * A named function, contrary to ES3, is no longer useful, because we
@@ -2583,9 +2583,8 @@ CheckSideEffects(JSContext *cx, JSCodeGenerator *cg, JSParseNode *pn,
         break;
 
       case PN_LIST:
-        if (pn->pn_op == JSOP_NOP ||
-            pn->pn_op == JSOP_OR || pn->pn_op == JSOP_AND ||
-            pn->pn_op == JSOP_STRICTEQ || pn->pn_op == JSOP_STRICTNE) {
+        if (pn->isOp(JSOP_NOP) || pn->isOp(JSOP_OR) || pn->isOp(JSOP_AND) ||
+            pn->isOp(JSOP_STRICTEQ) || pn->isOp(JSOP_STRICTNE)) {
             /*
              * Non-operators along with ||, &&, ===, and !== never invoke
              * toString or valueOf.
@@ -2620,7 +2619,7 @@ CheckSideEffects(JSContext *cx, JSCodeGenerator *cg, JSParseNode *pn,
         break;
 
       case PN_BINARY:
-        if (pn->pn_type == TOK_ASSIGN) {
+        if (pn->isKind(TOK_ASSIGN)) {
             /*
              * Assignment is presumed to be useful, even if the next operation
              * is another assignment overwriting this one's ostensible effect,
@@ -2631,19 +2630,19 @@ CheckSideEffects(JSContext *cx, JSCodeGenerator *cg, JSParseNode *pn,
              * declared in the function currently being compiled.
              */
             pn2 = pn->pn_left;
-            if (pn2->pn_type != TOK_NAME) {
+            if (!pn2->isKind(TOK_NAME)) {
                 *answer = JS_TRUE;
             } else {
                 if (!BindNameToSlot(cx, cg, pn2))
                     return JS_FALSE;
                 if (!CheckSideEffects(cx, cg, pn->pn_right, answer))
                     return JS_FALSE;
-                if (!*answer && (pn->pn_op != JSOP_NOP || !pn2->isConst()))
+                if (!*answer && (!pn->isOp(JSOP_NOP) || !pn2->isConst()))
                     *answer = JS_TRUE;
             }
         } else {
-            if (pn->pn_op == JSOP_OR || pn->pn_op == JSOP_AND ||
-                pn->pn_op == JSOP_STRICTEQ || pn->pn_op == JSOP_STRICTNE) {
+            if (pn->isOp(JSOP_OR) || pn->isOp(JSOP_AND) || pn->isOp(JSOP_STRICTEQ) ||
+                pn->isOp(JSOP_STRICTNE)) {
                 /*
                  * ||, &&, ===, and !== do not convert their operands via
                  * toString or valueOf method calls.
@@ -2661,10 +2660,10 @@ CheckSideEffects(JSContext *cx, JSCodeGenerator *cg, JSParseNode *pn,
         break;
 
       case PN_UNARY:
-        switch (pn->pn_type) {
+        switch (pn->getKind()) {
           case TOK_DELETE:
             pn2 = pn->pn_kid;
-            switch (pn2->pn_type) {
+            switch (pn2->getKind()) {
               case TOK_NAME:
                 if (!BindNameToSlot(cx, cg, pn2))
                     return JS_FALSE;
@@ -2689,7 +2688,7 @@ CheckSideEffects(JSContext *cx, JSCodeGenerator *cg, JSParseNode *pn,
             break;
 
           case TOK_UNARYOP:
-            if (pn->pn_op == JSOP_NOT) {
+            if (pn->isOp(JSOP_NOT)) {
                 /* ! does not convert its operand via toString or valueOf. */
                 ok = CheckSideEffects(cx, cg, pn->pn_kid, answer);
                 break;
@@ -2714,10 +2713,10 @@ CheckSideEffects(JSContext *cx, JSCodeGenerator *cg, JSParseNode *pn,
          * statements and property values in object initialisers, have pn_op
          * defaulted to JSOP_NOP).
          */
-        if (pn->pn_type == TOK_NAME && pn->pn_op != JSOP_NOP) {
+        if (pn->isKind(TOK_NAME) && !pn->isOp(JSOP_NOP)) {
             if (!BindNameToSlot(cx, cg, pn))
                 return JS_FALSE;
-            if (pn->pn_op != JSOP_ARGUMENTS && pn->pn_op != JSOP_CALLEE &&
+            if (!pn->isOp(JSOP_ARGUMENTS) && !pn->isOp(JSOP_CALLEE) &&
                 pn->pn_cookie.isFree()) {
                 /*
                  * Not an argument or local variable use, and not a use of a
@@ -2728,10 +2727,10 @@ CheckSideEffects(JSContext *cx, JSCodeGenerator *cg, JSParseNode *pn,
             }
         }
         pn2 = pn->maybeExpr();
-        if (pn->pn_type == TOK_DOT) {
-            if (pn2->pn_type == TOK_NAME && !BindNameToSlot(cx, cg, pn2))
+        if (pn->isKind(TOK_DOT)) {
+            if (pn2->isKind(TOK_NAME) && !BindNameToSlot(cx, cg, pn2))
                 return JS_FALSE;
-            if (!(pn2->pn_op == JSOP_ARGUMENTS &&
+            if (!(pn2->isOp(JSOP_ARGUMENTS) &&
                   pn->pn_atom == cx->runtime->atomState.lengthAtom)) {
                 /*
                  * Any dotted property reference could call a getter, except
@@ -2748,7 +2747,7 @@ CheckSideEffects(JSContext *cx, JSCodeGenerator *cg, JSParseNode *pn,
         break;
 
       case PN_NULLARY:
-        if (pn->pn_type == TOK_DEBUGGER)
+        if (pn->isKind(TOK_DEBUGGER))
             *answer = JS_TRUE;
         break;
     }
@@ -2763,7 +2762,7 @@ EmitNameOp(JSContext *cx, JSCodeGenerator *cg, JSParseNode *pn,
 
     if (!BindNameToSlot(cx, cg, pn))
         return JS_FALSE;
-    op = PN_OP(pn);
+    op = pn->getOp();
 
     if (callContext) {
         switch (op) {
@@ -2815,8 +2814,8 @@ EmitXMLName(JSContext *cx, JSParseNode *pn, JSOp op, JSCodeGenerator *cg)
     JSParseNode *pn2;
     uintN oldflags;
 
-    JS_ASSERT(pn->pn_type == TOK_UNARYOP);
-    JS_ASSERT(pn->pn_op == JSOP_XMLNAME);
+    JS_ASSERT(pn->isKind(TOK_UNARYOP));
+    JS_ASSERT(pn->isOp(JSOP_XMLNAME));
     JS_ASSERT(op == JSOP_XMLNAME || op == JSOP_CALLXMLNAME);
 
     pn2 = pn->pn_kid;
@@ -2866,7 +2865,7 @@ EmitPropOp(JSContext *cx, JSParseNode *pn, JSOp op, JSCodeGenerator *cg,
     JSParseNode *pn2, *pndot, *pnup, *pndown;
     ptrdiff_t top;
 
-    JS_ASSERT(pn->pn_arity == PN_NAME);
+    JS_ASSERT(pn->isArity(PN_NAME));
     pn2 = pn->maybeExpr();
 
     /* Special case deoptimization for __proto__. */
@@ -2878,11 +2877,11 @@ EmitPropOp(JSContext *cx, JSParseNode *pn, JSOp op, JSCodeGenerator *cg,
     }
 
     if (callContext) {
-        JS_ASSERT(pn->pn_type == TOK_DOT);
+        JS_ASSERT(pn->isKind(TOK_DOT));
         JS_ASSERT(op == JSOP_GETPROP);
         op = JSOP_CALLPROP;
-    } else if (op == JSOP_GETPROP && pn->pn_type == TOK_DOT) {
-        if (pn2->pn_type == TOK_NAME) {
+    } else if (op == JSOP_GETPROP && pn->isKind(TOK_DOT)) {
+        if (pn2->isKind(TOK_NAME)) {
             /*
              * Try to optimize arguments.length into JSOP_ARGCNT. If type
              * inference is enabled this is optimized separately.
@@ -2891,7 +2890,7 @@ EmitPropOp(JSContext *cx, JSParseNode *pn, JSOp op, JSCodeGenerator *cg,
                 return JS_FALSE;
             if (!cx->typeInferenceEnabled() &&
                 pn->pn_atom == cx->runtime->atomState.lengthAtom) {
-                if (pn2->pn_op == JSOP_ARGUMENTS)
+                if (pn2->isOp(JSOP_ARGUMENTS))
                     return js_Emit1(cx, cg, JSOP_ARGCNT) >= 0;
             }
         }
@@ -2902,17 +2901,17 @@ EmitPropOp(JSContext *cx, JSParseNode *pn, JSOp op, JSCodeGenerator *cg,
      * list linked via pn_expr temporarily so we can iterate over it from the
      * bottom up (reversing again as we go), to avoid excessive recursion.
      */
-    if (pn2->pn_type == TOK_DOT) {
+    if (pn2->isKind(TOK_DOT)) {
         pndot = pn2;
         pnup = NULL;
         top = CG_OFFSET(cg);
         for (;;) {
             /* Reverse pndot->pn_expr to point up, not down. */
             pndot->pn_offset = top;
-            JS_ASSERT(!pndot->pn_used);
+            JS_ASSERT(!pndot->isUsed());
             pndown = pndot->pn_expr;
             pndot->pn_expr = pnup;
-            if (pndown->pn_type != TOK_DOT)
+            if (!pndown->isKind(TOK_DOT))
                 break;
             pnup = pndot;
             pndot = pndown;
@@ -2930,10 +2929,10 @@ EmitPropOp(JSContext *cx, JSParseNode *pn, JSOp op, JSCodeGenerator *cg,
             }
 
             /* Special case deoptimization on __proto__, as above. */
-            if (pndot->pn_arity == PN_NAME && pndot->pn_atom == cx->runtime->atomState.protoAtom) {
+            if (pndot->isArity(PN_NAME) && pndot->pn_atom == cx->runtime->atomState.protoAtom) {
                 if (!EmitSpecialPropOp(cx, pndot, JSOP_GETELEM, cg))
                     return JS_FALSE;
-            } else if (!EmitAtomOp(cx, pndot, PN_OP(pndot), cg)) {
+            } else if (!EmitAtomOp(cx, pndot, pndot->getOp(), cg)) {
                 return JS_FALSE;
             }
 
@@ -3080,9 +3079,9 @@ EmitElemOp(JSContext *cx, JSParseNode *pn, JSOp op, JSCodeGenerator *cg)
     int32_t slot;
 
     top = CG_OFFSET(cg);
-    if (pn->pn_arity == PN_LIST) {
+    if (pn->isArity(PN_LIST)) {
         /* Left-associative operator chain to avoid too much recursion. */
-        JS_ASSERT(pn->pn_op == JSOP_GETELEM);
+        JS_ASSERT(pn->isOp(JSOP_GETELEM));
         JS_ASSERT(pn->pn_count >= 3);
         left = pn->pn_head;
         right = pn->last();
@@ -3094,10 +3093,10 @@ EmitElemOp(JSContext *cx, JSParseNode *pn, JSOp op, JSCodeGenerator *cg)
          * one or more index expression and JSOP_GETELEM op pairs. If type
          * inference is enabled this is optimized separately.
          */
-        if (left->pn_type == TOK_NAME && next->pn_type == TOK_NUMBER) {
+        if (left->isKind(TOK_NAME) && next->isKind(TOK_NUMBER)) {
             if (!BindNameToSlot(cx, cg, left))
                 return JS_FALSE;
-            if (left->pn_op == JSOP_ARGUMENTS &&
+            if (left->isOp(JSOP_ARGUMENTS) &&
                 JSDOUBLE_IS_INT32(next->pn_dval, &slot) &&
                 jsuint(slot) < JS_BIT(16) &&
                 !cx->typeInferenceEnabled() &&
@@ -3137,7 +3136,7 @@ EmitElemOp(JSContext *cx, JSParseNode *pn, JSOp op, JSCodeGenerator *cg)
             next = next->pn_next;
         }
     } else {
-        if (pn->pn_arity == PN_NAME) {
+        if (pn->isArity(PN_NAME)) {
             /*
              * Set left and right so pn appears to be a TOK_LB node, instead
              * of a TOK_DOT node.  See the TOK_FOR/IN case in js_EmitTree, and
@@ -3148,22 +3147,20 @@ EmitElemOp(JSContext *cx, JSParseNode *pn, JSOp op, JSCodeGenerator *cg)
             left = pn->maybeExpr();
             if (!left) {
                 left = &ltmp;
-                left->pn_type = TOK_STRING;
-                left->pn_op = JSOP_BINDNAME;
-                left->pn_arity = PN_NULLARY;
+                left->setKind(TOK_STRING);
+                left->setOp(JSOP_BINDNAME);
+                left->setArity(PN_NULLARY);
                 left->pn_pos = pn->pn_pos;
                 left->pn_atom = pn->pn_atom;
             }
             right = &rtmp;
-            right->pn_type = TOK_STRING;
-            right->pn_op = js_IsIdentifier(pn->pn_atom)
-                           ? JSOP_QNAMEPART
-                           : JSOP_STRING;
-            right->pn_arity = PN_NULLARY;
+            right->setKind(TOK_STRING);
+            right->setOp(js_IsIdentifier(pn->pn_atom) ? JSOP_QNAMEPART : JSOP_STRING);
+            right->setArity(PN_NULLARY);
             right->pn_pos = pn->pn_pos;
             right->pn_atom = pn->pn_atom;
         } else {
-            JS_ASSERT(pn->pn_arity == PN_BINARY);
+            JS_ASSERT(pn->isArity(PN_BINARY));
             left = pn->pn_left;
             right = pn->pn_right;
         }
@@ -3173,11 +3170,11 @@ EmitElemOp(JSContext *cx, JSParseNode *pn, JSOp op, JSCodeGenerator *cg)
          * inference is enabled this is optimized separately.
          */
         if (op == JSOP_GETELEM &&
-            left->pn_type == TOK_NAME &&
-            right->pn_type == TOK_NUMBER) {
+            left->isKind(TOK_NAME) &&
+            right->isKind(TOK_NUMBER)) {
             if (!BindNameToSlot(cx, cg, left))
                 return JS_FALSE;
-            if (left->pn_op == JSOP_ARGUMENTS &&
+            if (left->isOp(JSOP_ARGUMENTS) &&
                 JSDOUBLE_IS_INT32(right->pn_dval, &slot) &&
                 jsuint(slot) < JS_BIT(16) &&
                 !cx->typeInferenceEnabled() &&
@@ -3194,8 +3191,8 @@ EmitElemOp(JSContext *cx, JSParseNode *pn, JSOp op, JSCodeGenerator *cg)
     }
 
     /* The right side of the descendant operator is implicitly quoted. */
-    JS_ASSERT(op != JSOP_DESCENDANTS || right->pn_type != TOK_STRING ||
-              right->pn_op == JSOP_QNAMEPART);
+    JS_ASSERT(op != JSOP_DESCENDANTS || !right->isKind(TOK_STRING) ||
+              right->isOp(JSOP_QNAMEPART));
     if (!js_EmitTree(cx, cg, right))
         return JS_FALSE;
     if (js_NewSrcNote2(cx, cg, SRC_PCBASE, CG_OFFSET(cg) - top) < 0)
@@ -3407,7 +3404,7 @@ EmitSwitch(JSContext *cx, JSCodeGenerator *cg, JSParseNode *pn,
     pn2 = pn->pn_right;
 #if JS_HAS_BLOCK_SCOPE
     TempPopScope tps;
-    if (pn2->pn_type == TOK_LEXICALSCOPE) {
+    if (pn2->isKind(TOK_LEXICALSCOPE)) {
         /*
          * Push the body's block scope before discriminant code-gen to reflect
          * the order of slots on the stack. The block's locals must lie under
@@ -3448,7 +3445,7 @@ EmitSwitch(JSContext *cx, JSCodeGenerator *cg, JSParseNode *pn,
 #if !JS_HAS_BLOCK_SCOPE
     js_PushStatement(cg, stmtInfo, STMT_SWITCH, top);
 #else
-    if (pn2->pn_type == TOK_LC) {
+    if (pn2->isKind(TOK_LC)) {
         js_PushStatement(cg, stmtInfo, STMT_SWITCH, top);
     } else {
         /* Re-push the switch's statement info record. */
@@ -3472,7 +3469,7 @@ EmitSwitch(JSContext *cx, JSCodeGenerator *cg, JSParseNode *pn,
 
     if (caseCount == 0 ||
         (caseCount == 1 &&
-         (hasDefault = (pn2->pn_head->pn_type == TOK_DEFAULT)))) {
+         (hasDefault = (pn2->pn_head->isKind(TOK_DEFAULT))))) {
         caseCount = 0;
         low = 0;
         high = -1;
@@ -3486,22 +3483,22 @@ EmitSwitch(JSContext *cx, JSCodeGenerator *cg, JSParseNode *pn,
         high = JSVAL_INT_MIN;
 
         for (pn3 = pn2->pn_head; pn3; pn3 = pn3->pn_next) {
-            if (pn3->pn_type == TOK_DEFAULT) {
+            if (pn3->isKind(TOK_DEFAULT)) {
                 hasDefault = JS_TRUE;
                 caseCount--;    /* one of the "cases" was the default */
                 continue;
             }
 
-            JS_ASSERT(pn3->pn_type == TOK_CASE);
+            JS_ASSERT(pn3->isKind(TOK_CASE));
             if (switchOp == JSOP_CONDSWITCH)
                 continue;
 
             pn4 = pn3->pn_left;
-            while (pn4->pn_type == TOK_RP)
+            while (pn4->isKind(TOK_RP))
                 pn4 = pn4->pn_kid;
 
             Value constVal;
-            switch (pn4->pn_type) {
+            switch (pn4->getKind()) {
               case TOK_NUMBER:
                 constVal.setNumber(pn4->pn_dval);
                 break;
@@ -3528,15 +3525,15 @@ EmitSwitch(JSContext *cx, JSCodeGenerator *cg, JSParseNode *pn,
                 }
                 /* FALL THROUGH */
               case TOK_PRIMARY:
-                if (pn4->pn_op == JSOP_TRUE) {
+                if (pn4->isOp(JSOP_TRUE)) {
                     constVal.setBoolean(true);
                     break;
                 }
-                if (pn4->pn_op == JSOP_FALSE) {
+                if (pn4->isOp(JSOP_FALSE)) {
                     constVal.setBoolean(false);
                     break;
                 }
-                if (pn4->pn_op == JSOP_NULL) {
+                if (pn4->isOp(JSOP_NULL)) {
                     constVal.setNull();
                     break;
                 }
@@ -3689,7 +3686,7 @@ EmitSwitch(JSContext *cx, JSCodeGenerator *cg, JSParseNode *pn,
                 }
             }
             if (!pn4) {
-                JS_ASSERT(pn3->pn_type == TOK_DEFAULT);
+                JS_ASSERT(pn3->isKind(TOK_DEFAULT));
                 continue;
             }
             caseNoteIndex = js_NewSrcNote2(cx, cg, SRC_PCDELTA, 0);
@@ -3753,7 +3750,7 @@ EmitSwitch(JSContext *cx, JSCodeGenerator *cg, JSParseNode *pn,
                     return JS_FALSE;
                 memset(table, 0, tableSize);
                 for (pn3 = pn2->pn_head; pn3; pn3 = pn3->pn_next) {
-                    if (pn3->pn_type == TOK_DEFAULT)
+                    if (pn3->isKind(TOK_DEFAULT))
                         continue;
                     i = pn3->pn_pval->toInt32();
                     i -= low;
@@ -3799,7 +3796,7 @@ EmitSwitch(JSContext *cx, JSCodeGenerator *cg, JSParseNode *pn,
                     pn3 = table[i];
                     if (pn3 &&
                         (pn4 = pn3->pn_left) != NULL &&
-                        pn4->pn_type == TOK_NAME) {
+                        pn4->isKind(TOK_NAME)) {
                         /* Note a propagated constant with the const's name. */
                         JS_ASSERT(!pn4->maybeExpr());
                         jsatomid index;
@@ -3814,7 +3811,7 @@ EmitSwitch(JSContext *cx, JSCodeGenerator *cg, JSParseNode *pn,
             } else {
                 for (pn3 = pn2->pn_head; pn3; pn3 = pn3->pn_next) {
                     pn4 = pn3->pn_left;
-                    if (pn4 && pn4->pn_type == TOK_NAME) {
+                    if (pn4 && pn4->isKind(TOK_NAME)) {
                         /* Note a propagated constant with the const's name. */
                         JS_ASSERT(!pn4->maybeExpr());
                         jsatomid index;
@@ -3833,14 +3830,14 @@ EmitSwitch(JSContext *cx, JSCodeGenerator *cg, JSParseNode *pn,
 
     /* Emit code for each case's statements, copying pn_offset up to pn3. */
     for (pn3 = pn2->pn_head; pn3; pn3 = pn3->pn_next) {
-        if (switchOp == JSOP_CONDSWITCH && pn3->pn_type != TOK_DEFAULT)
+        if (switchOp == JSOP_CONDSWITCH && !pn3->isKind(TOK_DEFAULT))
             CHECK_AND_SET_JUMP_OFFSET_AT_CUSTOM(cx, cg, pn3->pn_offset, goto bad);
         pn4 = pn3->pn_right;
         ok = js_EmitTree(cx, cg, pn4);
         if (!ok)
             goto out;
         pn3->pn_offset = pn4->pn_offset;
-        if (pn3->pn_type == TOK_DEFAULT)
+        if (pn3->isKind(TOK_DEFAULT))
             off = pn3->pn_offset - top;
     }
 
@@ -3892,7 +3889,7 @@ EmitSwitch(JSContext *cx, JSCodeGenerator *cg, JSParseNode *pn,
         pc += INDEX_LEN;
 
         for (pn3 = pn2->pn_head; pn3; pn3 = pn3->pn_next) {
-            if (pn3->pn_type == TOK_DEFAULT)
+            if (pn3->isKind(TOK_DEFAULT))
                 continue;
             if (!cg->constList.append(*pn3->pn_pval))
                 goto bad;
@@ -3914,7 +3911,7 @@ out:
         ok = js_PopStatementCG(cx, cg);
 
 #if JS_HAS_BLOCK_SCOPE
-        if (ok && pn->pn_right->pn_type == TOK_LEXICALSCOPE)
+        if (ok && pn->pn_right->isKind(TOK_LEXICALSCOPE))
             ok = EmitLeaveBlock(cx, cg, JSOP_LEAVEBLOCK, box);
 #endif
     }
@@ -3983,7 +3980,7 @@ MaybeEmitVarDecl(JSContext *cx, JSCodeGenerator *cg, JSOp prologOp,
             return false;
     }
 
-    if (JOF_OPTYPE(pn->pn_op) == JOF_ATOM &&
+    if (JOF_OPTYPE(pn->getOp()) == JOF_ATOM &&
         (!cg->inFunction() || (cg->flags & TCF_FUN_HEAVYWEIGHT)) &&
         !(pn->pn_dflags & PND_GVAR))
     {
@@ -3995,7 +3992,7 @@ MaybeEmitVarDecl(JSContext *cx, JSCodeGenerator *cg, JSOp prologOp,
     }
 
     if (cg->inFunction() &&
-        JOF_OPTYPE(pn->pn_op) == JOF_LOCAL &&
+        JOF_OPTYPE(pn->getOp()) == JOF_LOCAL &&
         pn->pn_cookie.slot() < cg->bindings.countVars() &&
         cg->shouldNoteClosedName(pn))
     {
@@ -4018,11 +4015,11 @@ static JSBool
 EmitDestructuringDecl(JSContext *cx, JSCodeGenerator *cg, JSOp prologOp,
                       JSParseNode *pn)
 {
-    JS_ASSERT(pn->pn_type == TOK_NAME);
+    JS_ASSERT(pn->isKind(TOK_NAME));
     if (!BindNameToSlot(cx, cg, pn))
         return JS_FALSE;
 
-    JS_ASSERT(PN_OP(pn) != JSOP_ARGUMENTS && PN_OP(pn) != JSOP_CALLEE);
+    JS_ASSERT(!pn->isOp(JSOP_ARGUMENTS) && !pn->isOp(JSOP_CALLEE));
     return MaybeEmitVarDecl(cx, cg, prologOp, pn, NULL);
 }
 
@@ -4033,23 +4030,21 @@ EmitDestructuringDecls(JSContext *cx, JSCodeGenerator *cg, JSOp prologOp,
     JSParseNode *pn2, *pn3;
     DestructuringDeclEmitter emitter;
 
-    if (pn->pn_type == TOK_RB) {
+    if (pn->isKind(TOK_RB)) {
         for (pn2 = pn->pn_head; pn2; pn2 = pn2->pn_next) {
-            if (pn2->pn_type == TOK_COMMA)
+            if (pn2->isKind(TOK_COMMA))
                 continue;
-            emitter = (pn2->pn_type == TOK_NAME)
+            emitter = (pn2->isKind(TOK_NAME))
                       ? EmitDestructuringDecl
                       : EmitDestructuringDecls;
             if (!emitter(cx, cg, prologOp, pn2))
                 return JS_FALSE;
         }
     } else {
-        JS_ASSERT(pn->pn_type == TOK_RC);
+        JS_ASSERT(pn->isKind(TOK_RC));
         for (pn2 = pn->pn_head; pn2; pn2 = pn2->pn_next) {
             pn3 = pn2->pn_right;
-            emitter = (pn3->pn_type == TOK_NAME)
-                      ? EmitDestructuringDecl
-                      : EmitDestructuringDecls;
+            emitter = pn3->isKind(TOK_NAME) ? EmitDestructuringDecl : EmitDestructuringDecls;
             if (!emitter(cx, cg, prologOp, pn3))
                 return JS_FALSE;
         }
@@ -4069,20 +4064,20 @@ EmitDestructuringLHS(JSContext *cx, JSCodeGenerator *cg, JSParseNode *pn)
      * pop the matched value.  Otherwise emit an lvalue bytecode sequence
      * ending with a JSOP_ENUMELEM or equivalent op.
      */
-    if (pn->pn_type == TOK_RB || pn->pn_type == TOK_RC) {
+    if (pn->isKind(TOK_RB) || pn->isKind(TOK_RC)) {
         if (!EmitDestructuringOpsHelper(cx, cg, pn))
             return JS_FALSE;
         if (js_Emit1(cx, cg, JSOP_POP) < 0)
             return JS_FALSE;
     } else {
-        if (pn->pn_type == TOK_NAME) {
+        if (pn->isKind(TOK_NAME)) {
             if (!BindNameToSlot(cx, cg, pn))
                 return JS_FALSE;
             if (pn->isConst() && !pn->isInitialized())
                 return js_Emit1(cx, cg, JSOP_POP) >= 0;
         }
 
-        switch (pn->pn_op) {
+        switch (pn->getOp()) {
           case JSOP_SETNAME:
           case JSOP_SETGNAME:
             /*
@@ -4109,7 +4104,7 @@ EmitDestructuringLHS(JSContext *cx, JSCodeGenerator *cg, JSParseNode *pn)
           case JSOP_SETARG:
           {
             jsuint slot = pn->pn_cookie.asInteger();
-            EMIT_UINT16_IMM_OP(PN_OP(pn), slot);
+            EMIT_UINT16_IMM_OP(pn->getOp(), slot);
             if (js_Emit1(cx, cg, JSOP_POP) < 0)
                 return JS_FALSE;
             break;
@@ -4154,8 +4149,8 @@ EmitDestructuringOpsHelper(JSContext *cx, JSCodeGenerator *cg, JSParseNode *pn)
 #ifdef DEBUG
     intN stackDepth = cg->stackDepth;
     JS_ASSERT(stackDepth != 0);
-    JS_ASSERT(pn->pn_arity == PN_LIST);
-    JS_ASSERT(pn->pn_type == TOK_RB || pn->pn_type == TOK_RC);
+    JS_ASSERT(pn->isArity(PN_LIST));
+    JS_ASSERT(pn->isKind(TOK_RB) || pn->isKind(TOK_RC));
 #endif
 
     if (pn->pn_count == 0) {
@@ -4182,15 +4177,15 @@ EmitDestructuringOpsHelper(JSContext *cx, JSCodeGenerator *cg, JSParseNode *pn)
          * to the lvalue node, which is in the value-initializing position.
          */
         doElemOp = JS_TRUE;
-        if (pn->pn_type == TOK_RB) {
+        if (pn->isKind(TOK_RB)) {
             if (!EmitNumberOp(cx, index, cg))
                 return JS_FALSE;
             pn3 = pn2;
         } else {
-            JS_ASSERT(pn->pn_type == TOK_RC);
-            JS_ASSERT(pn2->pn_type == TOK_COLON);
+            JS_ASSERT(pn->isKind(TOK_RC));
+            JS_ASSERT(pn2->isKind(TOK_COLON));
             pn3 = pn2->pn_left;
-            if (pn3->pn_type == TOK_NUMBER) {
+            if (pn3->isKind(TOK_NUMBER)) {
                 /*
                  * If we are emitting an object destructuring initialiser,
                  * annotate the index op with SRC_INITPROP so we know we are
@@ -4201,8 +4196,7 @@ EmitDestructuringOpsHelper(JSContext *cx, JSCodeGenerator *cg, JSParseNode *pn)
                 if (!EmitNumberOp(cx, pn3->pn_dval, cg))
                     return JS_FALSE;
             } else {
-                JS_ASSERT(pn3->pn_type == TOK_STRING ||
-                          pn3->pn_type == TOK_NAME);
+                JS_ASSERT(pn3->isKind(TOK_STRING) || pn3->isKind(TOK_NAME));
                 if (!EmitAtomOp(cx, pn3, JSOP_GETPROP, cg))
                     return JS_FALSE;
                 doElemOp = JS_FALSE;
@@ -4222,8 +4216,8 @@ EmitDestructuringOpsHelper(JSContext *cx, JSCodeGenerator *cg, JSParseNode *pn)
         }
 
         /* Nullary comma node makes a hole in the array destructurer. */
-        if (pn3->pn_type == TOK_COMMA && pn3->pn_arity == PN_NULLARY) {
-            JS_ASSERT(pn->pn_type == TOK_RB);
+        if (pn3->isKind(TOK_COMMA) && pn3->isArity(PN_NULLARY)) {
+            JS_ASSERT(pn->isKind(TOK_RB));
             JS_ASSERT(pn2 == pn3);
             if (js_Emit1(cx, cg, JSOP_POP) < 0)
                 return JS_FALSE;
@@ -4289,7 +4283,7 @@ EmitGroupAssignment(JSContext *cx, JSCodeGenerator *cg, JSOp prologOp,
         }
 
         /* MaybeEmitGroupAssignment won't call us if rhs is holey. */
-        JS_ASSERT(!(pn->pn_type == TOK_COMMA && pn->pn_arity == PN_NULLARY));
+        JS_ASSERT(!(pn->isKind(TOK_COMMA) && pn->isArity(PN_NULLARY)));
         if (!js_EmitTree(cx, cg, pn))
             return JS_FALSE;
         ++limit;
@@ -4307,7 +4301,7 @@ EmitGroupAssignment(JSContext *cx, JSCodeGenerator *cg, JSOp prologOp,
             return JS_FALSE;
         EMIT_UINT16_IMM_OP(JSOP_GETLOCAL, slot);
 
-        if (pn->pn_type == TOK_COMMA && pn->pn_arity == PN_NULLARY) {
+        if (pn->isKind(TOK_COMMA) && pn->isArity(PN_NULLARY)) {
             if (js_Emit1(cx, cg, JSOP_POP) < 0)
                 return JS_FALSE;
         } else {
@@ -4333,11 +4327,11 @@ MaybeEmitGroupAssignment(JSContext *cx, JSCodeGenerator *cg, JSOp prologOp,
 {
     JSParseNode *lhs, *rhs;
 
-    JS_ASSERT(pn->pn_type == TOK_ASSIGN);
+    JS_ASSERT(pn->isKind(TOK_ASSIGN));
     JS_ASSERT(*pop == JSOP_POP || *pop == JSOP_POPV);
     lhs = pn->pn_left;
     rhs = pn->pn_right;
-    if (lhs->pn_type == TOK_RB && rhs->pn_type == TOK_RB &&
+    if (lhs->isKind(TOK_RB) && rhs->isKind(TOK_RB) &&
         !(rhs->pn_xflags & PNX_HOLEY) &&
         lhs->pn_count <= rhs->pn_count) {
         if (!EmitGroupAssignment(cx, cg, prologOp, lhs, rhs))
@@ -4375,7 +4369,7 @@ EmitVariables(JSContext *cx, JSCodeGenerator *cg, JSParseNode *pn,
      * to the start of the block, a 'for (let x = i...) ...' loop evaluates i
      * in the containing scope, and puts x in the loop body's scope.
      */
-    DebugOnly<bool> let = (pn->pn_op == JSOP_NOP);
+    DebugOnly<bool> let = (pn->isOp(JSOP_NOP));
     forInVar = (pn->pn_xflags & PNX_FORINVAR) != 0;
 
     off = noteIndex = -1;
@@ -4383,9 +4377,9 @@ EmitVariables(JSContext *cx, JSCodeGenerator *cg, JSParseNode *pn,
         first = pn2 == pn->pn_head;
         next = pn2->pn_next;
 
-        if (pn2->pn_type != TOK_NAME) {
+        if (!pn2->isKind(TOK_NAME)) {
 #if JS_HAS_DESTRUCTURING
-            if (pn2->pn_type == TOK_RB || pn2->pn_type == TOK_RC) {
+            if (pn2->isKind(TOK_RB) || pn2->isKind(TOK_RC)) {
                 /*
                  * Emit variable binding ops, but not destructuring ops.
                  * The parser (see Variables, jsparse.c) has ensured that
@@ -4396,7 +4390,7 @@ EmitVariables(JSContext *cx, JSCodeGenerator *cg, JSParseNode *pn,
                  */
                 JS_ASSERT(forInVar);
                 JS_ASSERT(pn->pn_count == 1);
-                if (!EmitDestructuringDecls(cx, cg, PN_OP(pn), pn2))
+                if (!EmitDestructuringDecls(cx, cg, pn->getOp(), pn2))
                     return JS_FALSE;
                 break;
             }
@@ -4408,7 +4402,7 @@ EmitVariables(JSContext *cx, JSCodeGenerator *cg, JSParseNode *pn,
              * (var x = i in o)...', this will cause the entire 'var [a, b] =
              * i' to be hoisted out of the loop.
              */
-            JS_ASSERT(pn2->pn_type == TOK_ASSIGN);
+            JS_ASSERT(pn2->isKind(TOK_ASSIGN));
             JS_ASSERT(!forInVar);
 
             /*
@@ -4417,9 +4411,9 @@ EmitVariables(JSContext *cx, JSCodeGenerator *cg, JSParseNode *pn,
              * here and initialize the name.
              */
 #if !JS_HAS_DESTRUCTURING
-            JS_ASSERT(pn2->pn_left->pn_type == TOK_NAME);
+            JS_ASSERT(pn2->pn_left->isKind(TOK_NAME));
 #else
-            if (pn2->pn_left->pn_type == TOK_NAME)
+            if (pn2->pn_left->isKind(TOK_NAME))
 #endif
             {
                 pn3 = pn2->pn_right;
@@ -4438,7 +4432,7 @@ EmitVariables(JSContext *cx, JSCodeGenerator *cg, JSParseNode *pn,
                 JS_ASSERT(noteIndex < 0 && !pn2->pn_next);
                 op = JSOP_POP;
                 if (!MaybeEmitGroupAssignment(cx, cg,
-                                              inLetHead ? JSOP_POP : PN_OP(pn),
+                                              inLetHead ? JSOP_POP : pn->getOp(),
                                               pn2, &op)) {
                     return JS_FALSE;
                 }
@@ -4449,7 +4443,7 @@ EmitVariables(JSContext *cx, JSCodeGenerator *cg, JSParseNode *pn,
             }
 
             pn3 = pn2->pn_left;
-            if (!EmitDestructuringDecls(cx, cg, PN_OP(pn), pn3))
+            if (!EmitDestructuringDecls(cx, cg, pn->getOp(), pn3))
                 return JS_FALSE;
 
             if (!js_EmitTree(cx, cg, pn2->pn_right))
@@ -4461,7 +4455,7 @@ EmitVariables(JSContext *cx, JSCodeGenerator *cg, JSParseNode *pn,
              * we will emit at the bottom of this function.
              */
             if (!EmitDestructuringOps(cx, cg,
-                                      inLetHead ? JSOP_POP : PN_OP(pn),
+                                      inLetHead ? JSOP_POP : pn->getOp(),
                                       pn3)) {
                 return JS_FALSE;
             }
@@ -4481,7 +4475,7 @@ EmitVariables(JSContext *cx, JSCodeGenerator *cg, JSParseNode *pn,
         if (!BindNameToSlot(cx, cg, pn2))
             return JS_FALSE;
 
-        op = PN_OP(pn2);
+        op = pn2->getOp();
         if (op == JSOP_ARGUMENTS) {
             /* JSOP_ARGUMENTS => no initializer */
             JS_ASSERT(!pn3 && !let);
@@ -4492,7 +4486,7 @@ EmitVariables(JSContext *cx, JSCodeGenerator *cg, JSParseNode *pn,
         } else {
             JS_ASSERT(op != JSOP_CALLEE);
             JS_ASSERT(!pn2->pn_cookie.isFree() || !let);
-            if (!MaybeEmitVarDecl(cx, cg, PN_OP(pn), pn2, &atomIndex))
+            if (!MaybeEmitVarDecl(cx, cg, pn->getOp(), pn2, &atomIndex))
                 return JS_FALSE;
 
             if (pn3) {
@@ -4504,7 +4498,7 @@ EmitVariables(JSContext *cx, JSCodeGenerator *cg, JSParseNode *pn,
                     JS_ASSERT(!let);
                     EMIT_INDEX_OP(JSOP_BINDGNAME, atomIndex);
                 }
-                if (pn->pn_op == JSOP_DEFCONST &&
+                if (pn->isOp(JSOP_DEFCONST) &&
                     !js_DefineCompileTimeConstant(cx, cg, pn2->pn_atom, pn3)) {
                     return JS_FALSE;
                 }
@@ -4525,7 +4519,7 @@ EmitVariables(JSContext *cx, JSCodeGenerator *cg, JSParseNode *pn,
          * emit op or any source note. Our caller, the TOK_FOR/TOK_IN case in
          * js_EmitTree, will annotate appropriately.
          */
-        JS_ASSERT_IF(pn2->pn_defn, pn3 == pn2->pn_expr);
+        JS_ASSERT_IF(pn2->isDefn(), pn3 == pn2->pn_expr);
         if (forInVar) {
             JS_ASSERT(pn->pn_count == 1);
             JS_ASSERT(!pn3);
@@ -4535,9 +4529,9 @@ EmitVariables(JSContext *cx, JSCodeGenerator *cg, JSParseNode *pn,
         if (first &&
             !inLetHead &&
             js_NewSrcNote2(cx, cg, SRC_DECL,
-                           (pn->pn_op == JSOP_DEFCONST)
+                           (pn->isOp(JSOP_DEFCONST))
                            ? SRC_DECL_CONST
-                           : (pn->pn_op == JSOP_DEFVAR)
+                           : (pn->isOp(JSOP_DEFVAR))
                            ? SRC_DECL_VAR
                            : SRC_DECL_LET) < 0) {
             return JS_FALSE;
@@ -4592,7 +4586,7 @@ EmitAssignment(JSContext *cx, JSCodeGenerator *cg, JSParseNode *lhs, JSOp op, JS
     jsatomid atomIndex = (jsatomid) -1;              /* quell GCC overwarning */
     jsbytecode offset = 1;
 
-    switch (PN_TYPE(lhs)) {
+    switch (lhs->getKind()) {
       case TOK_NAME:
         if (!BindNameToSlot(cx, cg, lhs))
             return false;
@@ -4602,7 +4596,7 @@ EmitAssignment(JSContext *cx, JSCodeGenerator *cg, JSParseNode *lhs, JSOp op, JS
             if (!cg->makeAtomIndex(lhs->pn_atom, &atomIndex))
                 return false;
             if (!lhs->isConst()) {
-                JSOp op = PN_OP(lhs) == JSOP_SETGNAME ? JSOP_BINDGNAME : JSOP_BINDNAME;
+                JSOp op = lhs->isOp(JSOP_SETGNAME) ? JSOP_BINDGNAME : JSOP_BINDNAME;
                 EMIT_INDEX_OP(op, atomIndex);
                 offset++;
             }
@@ -4616,7 +4610,7 @@ EmitAssignment(JSContext *cx, JSCodeGenerator *cg, JSParseNode *lhs, JSOp op, JS
             return false;
         break;
       case TOK_LB:
-        JS_ASSERT(lhs->pn_arity == PN_BINARY);
+        JS_ASSERT(lhs->isArity(PN_BINARY));
         if (!js_EmitTree(cx, cg, lhs->pn_left))
             return false;
         if (!js_EmitTree(cx, cg, lhs->pn_right))
@@ -4635,7 +4629,7 @@ EmitAssignment(JSContext *cx, JSCodeGenerator *cg, JSParseNode *lhs, JSOp op, JS
         break;
 #if JS_HAS_XML_SUPPORT
       case TOK_UNARYOP:
-        JS_ASSERT(lhs->pn_op == JSOP_SETXMLNAME);
+        JS_ASSERT(lhs->isOp(JSOP_SETXMLNAME));
         if (!js_EmitTree(cx, cg, lhs->pn_kid))
             return false;
         if (js_Emit1(cx, cg, JSOP_BINDXMLNAME) < 0)
@@ -4649,20 +4643,20 @@ EmitAssignment(JSContext *cx, JSCodeGenerator *cg, JSParseNode *lhs, JSOp op, JS
 
     if (op != JSOP_NOP) {
         JS_ASSERT(rhs);
-        switch (lhs->pn_type) {
+        switch (lhs->getKind()) {
           case TOK_NAME:
             if (lhs->isConst()) {
-                if (PN_OP(lhs) == JSOP_CALLEE) {
+                if (lhs->isOp(JSOP_CALLEE)) {
                     if (js_Emit1(cx, cg, JSOP_CALLEE) < 0)
                         return false;
                 } else {
-                    EMIT_INDEX_OP(PN_OP(lhs), atomIndex);
+                    EMIT_INDEX_OP(lhs->getOp(), atomIndex);
                 }
-            } else if (PN_OP(lhs) == JSOP_SETNAME) {
+            } else if (lhs->isOp(JSOP_SETNAME)) {
                 if (js_Emit1(cx, cg, JSOP_DUP) < 0)
                     return false;
                 EMIT_INDEX_OP(JSOP_GETXPROP, atomIndex);
-            } else if (PN_OP(lhs) == JSOP_SETGNAME) {
+            } else if (lhs->isOp(JSOP_SETGNAME)) {
                 if (!BindGlobal(cx, cg, lhs, lhs->pn_atom))
                     return false;
                 if (lhs->pn_cookie.isFree())
@@ -4670,10 +4664,7 @@ EmitAssignment(JSContext *cx, JSCodeGenerator *cg, JSParseNode *lhs, JSOp op, JS
                 else
                     EMIT_UINT16_IMM_OP(JSOP_GETGLOBAL, lhs->pn_cookie.asInteger());
             } else {
-                EMIT_UINT16_IMM_OP((PN_OP(lhs) == JSOP_SETARG)
-                                   ? JSOP_GETARG
-                                   : JSOP_GETLOCAL,
-                                   atomIndex);
+                EMIT_UINT16_IMM_OP(lhs->isOp(JSOP_SETARG) ? JSOP_GETARG : JSOP_GETLOCAL, atomIndex);
             }
             break;
           case TOK_DOT:
@@ -4720,7 +4711,7 @@ EmitAssignment(JSContext *cx, JSCodeGenerator *cg, JSParseNode *lhs, JSOp op, JS
          * declared in the current compilation unit, as in this case (just
          * a bit further below) we will avoid emitting the assignment op.
          */
-        if (lhs->pn_type != TOK_NAME || !lhs->isConst()) {
+        if (!lhs->isKind(TOK_NAME) || !lhs->isConst()) {
             if (js_NewSrcNote(cx, cg, SRC_ASSIGNOP) < 0)
                 return false;
         }
@@ -4729,17 +4720,17 @@ EmitAssignment(JSContext *cx, JSCodeGenerator *cg, JSParseNode *lhs, JSOp op, JS
     }
 
     /* Left parts such as a.b.c and a[b].c need a decompiler note. */
-    if (lhs->pn_type != TOK_NAME &&
+    if (!lhs->isKind(TOK_NAME) &&
 #if JS_HAS_DESTRUCTURING
-        lhs->pn_type != TOK_RB &&
-        lhs->pn_type != TOK_RC &&
+        !lhs->isKind(TOK_RB) &&
+        !lhs->isKind(TOK_RC) &&
 #endif
         js_NewSrcNote2(cx, cg, SRC_PCBASE, CG_OFFSET(cg) - top) < 0) {
         return false;
     }
 
     /* Finally, emit the specialized assignment bytecode. */
-    switch (lhs->pn_type) {
+    switch (lhs->getKind()) {
       case TOK_NAME:
         if (lhs->isConst()) {
             if (!rhs) {
@@ -4751,7 +4742,7 @@ EmitAssignment(JSContext *cx, JSCodeGenerator *cg, JSParseNode *lhs, JSOp op, JS
         }
         /* FALL THROUGH */
       case TOK_DOT:
-        EMIT_INDEX_OP(PN_OP(lhs), atomIndex);
+        EMIT_INDEX_OP(lhs->getOp(), atomIndex);
         break;
       case TOK_LB:
       case TOK_LP:
@@ -4836,7 +4827,7 @@ EmitEndInit(JSContext *cx, JSCodeGenerator *cg, uint32 count)
 bool
 JSParseNode::getConstantValue(JSContext *cx, bool strictChecks, Value *vp)
 {
-    switch (pn_type) {
+    switch (getKind()) {
       case TOK_NUMBER:
         vp->setNumber(pn_dval);
         return true;
@@ -4844,7 +4835,7 @@ JSParseNode::getConstantValue(JSContext *cx, bool strictChecks, Value *vp)
         vp->setString(pn_atom);
         return true;
       case TOK_PRIMARY:
-        switch (pn_op) {
+        switch (getOp()) {
           case JSOP_NULL:
             vp->setNull();
             return true;
@@ -4859,7 +4850,7 @@ JSParseNode::getConstantValue(JSContext *cx, bool strictChecks, Value *vp)
             return false;
         }
       case TOK_RB: {
-        JS_ASSERT((pn_op == JSOP_NEWINIT) && !(pn_xflags & PNX_NONCONST));
+        JS_ASSERT(isOp(JSOP_NEWINIT) && !(pn_xflags & PNX_NONCONST));
  
         JSObject *obj = NewDenseAllocatedArray(cx, pn_count);
         if (!obj)
@@ -4880,7 +4871,7 @@ JSParseNode::getConstantValue(JSContext *cx, bool strictChecks, Value *vp)
         return true;
       }
       case TOK_RC: {
-        JS_ASSERT((pn_op == JSOP_NEWINIT) && !(pn_xflags & PNX_NONCONST));
+        JS_ASSERT(isOp(JSOP_NEWINIT) && !(pn_xflags & PNX_NONCONST));
 
         gc::AllocKind kind = GuessObjectGCKind(pn_count, false);
         JSObject *obj = NewBuiltinClassInstance(cx, &ObjectClass, kind);
@@ -4893,7 +4884,7 @@ JSParseNode::getConstantValue(JSContext *cx, bool strictChecks, Value *vp)
                 return false;
 
             JSParseNode *pnid = pn->pn_left;
-            if (pnid->pn_type == TOK_NUMBER) {
+            if (pnid->isKind(TOK_NUMBER)) {
                 Value idvalue = NumberValue(pnid->pn_dval);
                 jsid id;
                 if (idvalue.isInt32() && INT_FITS_IN_JSID(idvalue.toInt32()))
@@ -4903,8 +4894,8 @@ JSParseNode::getConstantValue(JSContext *cx, bool strictChecks, Value *vp)
                 if (!obj->defineProperty(cx, id, value, NULL, NULL, JSPROP_ENUMERATE))
                     return false;
             } else {
-                JS_ASSERT(pnid->pn_type == TOK_NAME ||
-                          pnid->pn_type == TOK_STRING);
+                JS_ASSERT(pnid->isKind(TOK_NAME) ||
+                          pnid->isKind(TOK_STRING));
                 JS_ASSERT(pnid->pn_atom != cx->runtime->atomState.protoAtom);
                 jsid id = ATOM_TO_JSID(pnid->pn_atom);
                 if (!DefineNativeProperty(cx, obj, id, value, NULL, NULL,
@@ -4983,14 +4974,14 @@ js_EmitTree(JSContext *cx, JSCodeGenerator *cg, JSParseNode *pn)
     /* Emit notes to tell the current bytecode's source line number. */
     UPDATE_LINE_NUMBER_NOTES(cx, cg, pn->pn_pos.begin.lineno);
 
-    switch (pn->pn_type) {
+    switch (pn->getKind()) {
       case TOK_FUNCTION:
       {
         JSFunction *fun;
         uintN slot;
 
 #if JS_HAS_XML_SUPPORT
-        if (pn->pn_arity == PN_NULLARY) {
+        if (pn->isArity(PN_NULLARY)) {
             if (js_Emit1(cx, cg, JSOP_GETFUNNS) < 0)
                 return JS_FALSE;
             break;
@@ -5005,7 +4996,7 @@ js_EmitTree(JSContext *cx, JSCodeGenerator *cg, JSParseNode *pn)
              * for the already-emitted function definition prolog opcode. See
              * comments in the TOK_LC case.
              */
-            JS_ASSERT(pn->pn_op == JSOP_NOP);
+            JS_ASSERT(pn->isOp(JSOP_NOP));
             JS_ASSERT(cg->inFunction());
             if (!EmitFunctionDefNop(cx, cg, pn->pn_index))
                 return JS_FALSE;
@@ -5059,7 +5050,7 @@ js_EmitTree(JSContext *cx, JSCodeGenerator *cg, JSParseNode *pn)
         index = cg->objectList.index(pn->pn_funbox);
 
         /* Emit a bytecode pointing to the closure object in its immediate. */
-        op = PN_OP(pn);
+        op = pn->getOp();
         if (op != JSOP_NOP) {
             if ((pn->pn_funbox->tcflags & TCF_GENEXP_LAMBDA) &&
                 js_NewSrcNote(cx, cg, SRC_GENEXP) < 0) {
@@ -5125,11 +5116,11 @@ js_EmitTree(JSContext *cx, JSCodeGenerator *cg, JSParseNode *pn)
       {
         JSParseNode *pnlast = pn->last();
         for (JSParseNode *pn2 = pn->pn_head; pn2 != pnlast; pn2 = pn2->pn_next) {
-            if (!pn2->pn_defn)
+            if (!pn2->isDefn())
                 continue;
             if (!BindNameToSlot(cx, cg, pn2))
                 return JS_FALSE;
-            if (JOF_OPTYPE(pn2->pn_op) == JOF_QARG && cg->shouldNoteClosedName(pn2)) {
+            if (JOF_OPTYPE(pn2->getOp()) == JOF_QARG && cg->shouldNoteClosedName(pn2)) {
                 if (!cg->closedArgs.append(pn2->pn_cookie.slot()))
                     return JS_FALSE;
             }
@@ -5206,7 +5197,7 @@ js_EmitTree(JSContext *cx, JSCodeGenerator *cg, JSParseNode *pn)
 
             /* Ensure the branch-if-false comes here, then emit the else. */
             CHECK_AND_SET_JUMP_OFFSET_AT(cx, cg, beq);
-            if (pn3->pn_type == TOK_IF) {
+            if (pn3->isKind(TOK_IF)) {
                 pn = pn3;
                 goto if_again;
             }
@@ -5342,7 +5333,7 @@ js_EmitTree(JSContext *cx, JSCodeGenerator *cg, JSParseNode *pn)
         pn2 = pn->pn_left;
         js_PushStatement(cg, &stmtInfo, STMT_FOR_LOOP, top);
 
-        if (pn2->pn_type == TOK_IN) {
+        if (pn2->isKind(TOK_IN)) {
             /* Set stmtInfo type for later testing. */
             stmtInfo.type = STMT_FOR_IN_LOOP;
 
@@ -5355,8 +5346,8 @@ js_EmitTree(JSContext *cx, JSCodeGenerator *cg, JSParseNode *pn)
              */
             bool forLet = false;
             if (JSParseNode *decl = pn2->pn_kid1) {
-                JS_ASSERT(TokenKindIsDecl(PN_TYPE(decl)));
-                forLet = PN_TYPE(decl) == TOK_LET;
+                JS_ASSERT(TokenKindIsDecl(decl->getKind()));
+                forLet = decl->isKind(TOK_LET);
                 cg->flags |= TCF_IN_FOR_INIT;
                 if (!js_EmitTree(cx, cg, decl))
                     return JS_FALSE;
@@ -5379,7 +5370,7 @@ js_EmitTree(JSContext *cx, JSCodeGenerator *cg, JSParseNode *pn)
              * object depending on the loop variant (for-in, for-each-in, or
              * destructuring for-in).
              */
-            JS_ASSERT(pn->pn_op == JSOP_ITER);
+            JS_ASSERT(pn->isOp(JSOP_ITER));
             if (js_Emit2(cx, cg, JSOP_ITER, (uint8) pn->pn_iflags) < 0)
                 return JS_FALSE;
 
@@ -5419,7 +5410,7 @@ js_EmitTree(JSContext *cx, JSCodeGenerator *cg, JSParseNode *pn)
                 return false;
             tmp2 = CG_OFFSET(cg);
             if (pn2->pn_kid1 && js_NewSrcNote2(cx, cg, SRC_DECL,
-                                               (pn2->pn_kid1->pn_op == JSOP_DEFVAR)
+                                               (pn2->pn_kid1->isOp(JSOP_DEFVAR))
                                                ? SRC_DECL_VAR
                                                : SRC_DECL_LET) < 0) {
                 return false;
@@ -5472,7 +5463,7 @@ js_EmitTree(JSContext *cx, JSCodeGenerator *cg, JSParseNode *pn)
             } else {
                 cg->flags |= TCF_IN_FOR_INIT;
 #if JS_HAS_DESTRUCTURING
-                if (pn3->pn_type == TOK_ASSIGN &&
+                if (pn3->isKind(TOK_ASSIGN) &&
                     !MaybeEmitGroupAssignment(cx, cg, op, pn3, &op)) {
                     return JS_FALSE;
                 }
@@ -5480,14 +5471,14 @@ js_EmitTree(JSContext *cx, JSCodeGenerator *cg, JSParseNode *pn)
                 if (op == JSOP_POP) {
                     if (!js_EmitTree(cx, cg, pn3))
                         return JS_FALSE;
-                    if (TokenKindIsDecl(PN_TYPE(pn3))) {
+                    if (TokenKindIsDecl(pn3->getKind())) {
                         /*
                          * Check whether a destructuring-initialized var decl
                          * was optimized to a group assignment.  If so, we do
                          * not need to emit a pop below, so switch to a nop,
                          * just for the decompiler.
                          */
-                        JS_ASSERT(pn3->pn_arity == PN_LIST);
+                        JS_ASSERT(pn3->isArity(PN_LIST));
                         if (pn3->pn_xflags & PNX_GROUPINIT)
                             op = JSOP_NOP;
                     }
@@ -5541,7 +5532,7 @@ js_EmitTree(JSContext *cx, JSCodeGenerator *cg, JSParseNode *pn)
             if (pn3) {
                 op = JSOP_POP;
 #if JS_HAS_DESTRUCTURING
-                if (pn3->pn_type == TOK_ASSIGN &&
+                if (pn3->isKind(TOK_ASSIGN) &&
                     !MaybeEmitGroupAssignment(cx, cg, op, pn3, &op)) {
                     return JS_FALSE;
                 }
@@ -5612,7 +5603,7 @@ js_EmitTree(JSContext *cx, JSCodeGenerator *cg, JSParseNode *pn)
         if (!js_PopStatementCG(cx, cg))
             return JS_FALSE;
 
-        if (pn2->pn_type == TOK_IN) {
+        if (pn2->isKind(TOK_IN)) {
             if (!NewTryNote(cx, cg, JSTRY_ITER, cg->stackDepth, top, CG_OFFSET(cg)) ||
                 js_Emit1(cx, cg, JSOP_ENDITER) < 0) {
                 return JS_FALSE;
@@ -5831,7 +5822,7 @@ js_EmitTree(JSContext *cx, JSCodeGenerator *cg, JSParseNode *pn)
                  * block object population via count, for use when targeting
                  * guardJump at the next catch (the guard mismatch case).
                  */
-                JS_ASSERT(pn3->pn_type == TOK_LEXICALSCOPE);
+                JS_ASSERT(pn3->isKind(TOK_LEXICALSCOPE));
                 count = OBJ_BLOCK_COUNT(cx, pn3->pn_objbox->object);
                 prevBox = pn3->pn_objbox;
                 if (!js_EmitTree(cx, cg, pn3))
@@ -5980,7 +5971,7 @@ js_EmitTree(JSContext *cx, JSCodeGenerator *cg, JSParseNode *pn)
             return JS_FALSE;
 
         pn2 = pn->pn_kid1;
-        switch (pn2->pn_type) {
+        switch (pn2->getKind()) {
 #if JS_HAS_DESTRUCTURING
           case TOK_RB:
           case TOK_RC:
@@ -6095,16 +6086,16 @@ js_EmitTree(JSContext *cx, JSCodeGenerator *cg, JSParseNode *pn)
       case TOK_LC:
       {
 #if JS_HAS_XML_SUPPORT
-        if (pn->pn_arity == PN_UNARY) {
+        if (pn->isArity(PN_UNARY)) {
             if (!js_EmitTree(cx, cg, pn->pn_kid))
                 return JS_FALSE;
-            if (js_Emit1(cx, cg, PN_OP(pn)) < 0)
+            if (js_Emit1(cx, cg, pn->getOp()) < 0)
                 return JS_FALSE;
             break;
         }
 #endif
 
-        JS_ASSERT(pn->pn_arity == PN_LIST);
+        JS_ASSERT(pn->isArity(PN_LIST));
 
         noteIndex = -1;
         tmp = CG_OFFSET(cg);
@@ -6135,16 +6126,16 @@ js_EmitTree(JSContext *cx, JSCodeGenerator *cg, JSParseNode *pn)
                  * Assign the destructuring arguments before defining any
                  * functions, see bug 419662.
                  */
-                JS_ASSERT(pnchild->pn_type == TOK_SEMI);
-                JS_ASSERT(pnchild->pn_kid->pn_type == TOK_VAR);
+                JS_ASSERT(pnchild->isKind(TOK_SEMI));
+                JS_ASSERT(pnchild->pn_kid->isKind(TOK_VAR));
                 if (!js_EmitTree(cx, cg, pnchild))
                     return JS_FALSE;
                 pnchild = pnchild->pn_next;
             }
 
             for (pn2 = pnchild; pn2; pn2 = pn2->pn_next) {
-                if (pn2->pn_type == TOK_FUNCTION) {
-                    if (pn2->pn_op == JSOP_NOP) {
+                if (pn2->isKind(TOK_FUNCTION)) {
+                    if (pn2->isOp(JSOP_NOP)) {
                         if (!js_EmitTree(cx, cg, pn2))
                             return JS_FALSE;
                     } else {
@@ -6154,7 +6145,7 @@ js_EmitTree(JSContext *cx, JSCodeGenerator *cg, JSParseNode *pn)
                          * is optimized away from "if (true) function x() {}".
                          * See bug 428424.
                          */
-                        JS_ASSERT(pn2->pn_op == JSOP_DEFFUN);
+                        JS_ASSERT(pn2->isOp(JSOP_DEFFUN));
                     }
                 }
             }
@@ -6175,7 +6166,7 @@ js_EmitTree(JSContext *cx, JSCodeGenerator *cg, JSParseNode *pn)
       }
 
       case TOK_SEQ:
-        JS_ASSERT(pn->pn_arity == PN_LIST);
+        JS_ASSERT(pn->isArity(PN_LIST));
         js_PushStatement(cg, &stmtInfo, STMT_SEQ, top);
         for (pn2 = pn->pn_head; pn2; pn2 = pn2->pn_next) {
             if (!js_EmitTree(cx, cg, pn2))
@@ -6231,7 +6222,7 @@ js_EmitTree(JSContext *cx, JSCodeGenerator *cg, JSParseNode *pn)
                 op = wantval ? JSOP_POPV : JSOP_POP;
 #if JS_HAS_DESTRUCTURING
                 if (!wantval &&
-                    pn2->pn_type == TOK_ASSIGN &&
+                    pn2->isKind(TOK_ASSIGN) &&
                     !MaybeEmitGroupAssignment(cx, cg, op, pn2, &op)) {
                     return JS_FALSE;
                 }
@@ -6245,12 +6236,12 @@ js_EmitTree(JSContext *cx, JSCodeGenerator *cg, JSParseNode *pn)
                      * can't escape directly.
                      */
                     if (!wantval &&
-                        PN_TYPE(pn2) == TOK_ASSIGN &&
-                        PN_OP(pn2) == JSOP_NOP &&
-                        PN_OP(pn2->pn_left) == JSOP_SETPROP &&
-                        PN_OP(pn2->pn_right) == JSOP_LAMBDA &&
+                        pn2->isKind(TOK_ASSIGN) &&
+                        pn2->isOp(JSOP_NOP) &&
+                        pn2->pn_left->isOp(JSOP_SETPROP) &&
+                        pn2->pn_right->isOp(JSOP_LAMBDA) &&
                         pn2->pn_right->pn_funbox->joinable()) {
-                        pn2->pn_left->pn_op = JSOP_SETMETHOD;
+                        pn2->pn_left->setOp(JSOP_SETMETHOD);
                     }
                     if (!js_EmitTree(cx, cg, pn2))
                         return JS_FALSE;
@@ -6270,9 +6261,9 @@ js_EmitTree(JSContext *cx, JSCodeGenerator *cg, JSParseNode *pn)
             return JS_FALSE;
 
         pn2 = pn->expr();
-        noteType = (pn2->pn_type == TOK_LC ||
-                    (pn2->pn_type == TOK_LEXICALSCOPE &&
-                     pn2->expr()->pn_type == TOK_LC))
+        noteType = (pn2->isKind(TOK_LC) ||
+                    (pn2->isKind(TOK_LEXICALSCOPE) &&
+                     pn2->expr()->isKind(TOK_LC)))
                    ? SRC_LABELBRACE
                    : SRC_LABEL;
         noteIndex = js_NewSrcNote2(cx, cg, noteType, ptrdiff_t(index));
@@ -6325,7 +6316,7 @@ js_EmitTree(JSContext *cx, JSCodeGenerator *cg, JSParseNode *pn)
         break;
 
       case TOK_ASSIGN:
-        if (!EmitAssignment(cx, cg, pn->pn_left, PN_OP(pn), pn->pn_right))
+        if (!EmitAssignment(cx, cg, pn->pn_left, pn->getOp(), pn->pn_right))
             return false;
         break;
 
@@ -6379,7 +6370,7 @@ js_EmitTree(JSContext *cx, JSCodeGenerator *cg, JSParseNode *pn)
          * leaves the original operand value on the stack and jumps; otherwise
          * it pops and falls into the right operand's bytecode.
          */
-        if (pn->pn_arity == PN_BINARY) {
+        if (pn->isArity(PN_BINARY)) {
             if (!js_EmitTree(cx, cg, pn->pn_left))
                 return JS_FALSE;
             top = EmitJump(cx, cg, JSOP_BACKPATCH_POP, 0);
@@ -6390,9 +6381,9 @@ js_EmitTree(JSContext *cx, JSCodeGenerator *cg, JSParseNode *pn)
             off = CG_OFFSET(cg);
             pc = CG_CODE(cg, top);
             CHECK_AND_SET_JUMP_OFFSET(cx, cg, pc, off - top);
-            *pc = pn->pn_op;
+            *pc = pn->getOp();
         } else {
-            JS_ASSERT(pn->pn_arity == PN_LIST);
+            JS_ASSERT(pn->isArity(PN_LIST));
             JS_ASSERT(pn->pn_head->pn_next->pn_next);
 
             /* Left-associative operator chain: avoid too much recursion. */
@@ -6425,7 +6416,7 @@ js_EmitTree(JSContext *cx, JSCodeGenerator *cg, JSParseNode *pn)
                 pc = CG_CODE(cg, top);
                 tmp = GetJumpOffset(cg, pc);
                 CHECK_AND_SET_JUMP_OFFSET(cx, cg, pc, off - top);
-                *pc = pn->pn_op;
+                *pc = pn->getOp();
                 top += tmp;
             } while ((pn2 = pn2->pn_next)->pn_next);
         }
@@ -6443,12 +6434,12 @@ js_EmitTree(JSContext *cx, JSCodeGenerator *cg, JSParseNode *pn)
       case TOK_MINUS:
       case TOK_STAR:
       case TOK_DIVOP:
-        if (pn->pn_arity == PN_LIST) {
+        if (pn->isArity(PN_LIST)) {
             /* Left-associative operator chain: avoid too much recursion. */
             pn2 = pn->pn_head;
             if (!js_EmitTree(cx, cg, pn2))
                 return JS_FALSE;
-            op = PN_OP(pn);
+            op = pn->getOp();
             while ((pn2 = pn2->pn_next) != NULL) {
                 if (!js_EmitTree(cx, cg, pn2))
                     return JS_FALSE;
@@ -6460,10 +6451,10 @@ js_EmitTree(JSContext *cx, JSCodeGenerator *cg, JSParseNode *pn)
             uintN oldflags;
 
       case TOK_DBLCOLON:
-            if (pn->pn_arity == PN_NAME) {
+            if (pn->isArity(PN_NAME)) {
                 if (!js_EmitTree(cx, cg, pn->expr()))
                     return JS_FALSE;
-                if (!EmitAtomOp(cx, pn, PN_OP(pn), cg))
+                if (!EmitAtomOp(cx, pn, pn->getOp(), cg))
                     return JS_FALSE;
                 break;
             }
@@ -6485,7 +6476,7 @@ js_EmitTree(JSContext *cx, JSCodeGenerator *cg, JSParseNode *pn)
 #if JS_HAS_XML_SUPPORT
             cg->flags |= oldflags & TCF_IN_FOR_INIT;
 #endif
-            if (js_Emit1(cx, cg, PN_OP(pn)) < 0)
+            if (js_Emit1(cx, cg, pn->getOp()) < 0)
                 return JS_FALSE;
         }
         break;
@@ -6494,7 +6485,7 @@ js_EmitTree(JSContext *cx, JSCodeGenerator *cg, JSParseNode *pn)
 #if JS_HAS_XML_SUPPORT
       case TOK_AT:
       case TOK_DEFAULT:
-        JS_ASSERT(pn->pn_arity == PN_UNARY);
+        JS_ASSERT(pn->isArity(PN_UNARY));
         /* FALL THROUGH */
 #endif
       case TOK_UNARYOP:
@@ -6502,7 +6493,7 @@ js_EmitTree(JSContext *cx, JSCodeGenerator *cg, JSParseNode *pn)
         uintN oldflags;
 
         /* Unary op, including unary +/-. */
-        op = PN_OP(pn);
+        op = pn->getOp();
 #if JS_HAS_XML_SUPPORT
         if (op == JSOP_XMLNAME) {
             if (!EmitXMLName(cx, pn, op, cg))
@@ -6512,7 +6503,7 @@ js_EmitTree(JSContext *cx, JSCodeGenerator *cg, JSParseNode *pn)
 #endif
         pn2 = pn->pn_kid;
 
-        if (op == JSOP_TYPEOF && pn2->pn_type != TOK_NAME)
+        if (op == JSOP_TYPEOF && !pn2->isKind(TOK_NAME))
             op = JSOP_TYPEOFEXPR;
 
         oldflags = cg->flags;
@@ -6529,15 +6520,15 @@ js_EmitTree(JSContext *cx, JSCodeGenerator *cg, JSParseNode *pn)
       case TOK_DEC:
         /* Emit lvalue-specialized code for ++/-- operators. */
         pn2 = pn->pn_kid;
-        JS_ASSERT(pn2->pn_type != TOK_RP);
-        op = PN_OP(pn);
-        switch (pn2->pn_type) {
+        JS_ASSERT(!pn2->isKind(TOK_RP));
+        op = pn->getOp();
+        switch (pn2->getKind()) {
           default:
-            JS_ASSERT(pn2->pn_type == TOK_NAME);
-            pn2->pn_op = op;
+            JS_ASSERT(pn2->isKind(TOK_NAME));
+            pn2->setOp(op);
             if (!BindNameToSlot(cx, cg, pn2))
                 return JS_FALSE;
-            op = PN_OP(pn2);
+            op = pn2->getOp();
             if (op == JSOP_CALLEE) {
                 if (js_Emit1(cx, cg, op) < 0)
                     return JS_FALSE;
@@ -6558,7 +6549,7 @@ js_EmitTree(JSContext *cx, JSCodeGenerator *cg, JSParseNode *pn)
             if (pn2->isConst()) {
                 if (js_Emit1(cx, cg, JSOP_POS) < 0)
                     return JS_FALSE;
-                op = PN_OP(pn);
+                op = pn->getOp();
                 if (!(js_CodeSpec[op].format & JOF_POST)) {
                     if (js_Emit1(cx, cg, JSOP_ONE) < 0)
                         return JS_FALSE;
@@ -6599,7 +6590,7 @@ js_EmitTree(JSContext *cx, JSCodeGenerator *cg, JSParseNode *pn)
             break;
 #if JS_HAS_XML_SUPPORT
           case TOK_UNARYOP:
-            JS_ASSERT(pn2->pn_op == JSOP_SETXMLNAME);
+            JS_ASSERT(pn2->isOp(JSOP_SETXMLNAME));
             if (!js_EmitTree(cx, cg, pn2->pn_kid))
                 return JS_FALSE;
             if (js_Emit1(cx, cg, JSOP_BINDXMLNAME) < 0)
@@ -6617,11 +6608,11 @@ js_EmitTree(JSContext *cx, JSCodeGenerator *cg, JSParseNode *pn)
          * must evaluate the operand if it appears it might have side effects.
          */
         pn2 = pn->pn_kid;
-        switch (pn2->pn_type) {
+        switch (pn2->getKind()) {
           case TOK_NAME:
             if (!BindNameToSlot(cx, cg, pn2))
                 return JS_FALSE;
-            op = PN_OP(pn2);
+            op = pn2->getOp();
             if (op == JSOP_FALSE) {
                 if (js_Emit1(cx, cg, op) < 0)
                     return JS_FALSE;
@@ -6655,7 +6646,7 @@ js_EmitTree(JSContext *cx, JSCodeGenerator *cg, JSParseNode *pn)
             if (!useful) {
                 off = noteIndex = -1;
             } else {
-                JS_ASSERT_IF(pn2->pn_type == TOK_LP, !(pn2->pn_xflags & PNX_SETCALL));
+                JS_ASSERT_IF(pn2->isKind(TOK_LP), !(pn2->pn_xflags & PNX_SETCALL));
                 if (!js_EmitTree(cx, cg, pn2))
                     return JS_FALSE;
                 off = CG_OFFSET(cg);
@@ -6701,7 +6692,7 @@ js_EmitTree(JSContext *cx, JSCodeGenerator *cg, JSParseNode *pn)
          * this bytecode's immediate-indexed atom operand, and push its value
          * (not a reference to it).
          */
-        ok = EmitPropOp(cx, pn, PN_OP(pn), cg, JS_FALSE);
+        ok = EmitPropOp(cx, pn, pn->getOp(), cg, JS_FALSE);
         break;
 
       case TOK_LB:
@@ -6714,13 +6705,13 @@ js_EmitTree(JSContext *cx, JSCodeGenerator *cg, JSParseNode *pn)
          * push its value.  Set the "obj" register to the result of ToObject
          * on the left operand.
          */
-        ok = EmitElemOp(cx, pn, PN_OP(pn), cg);
+        ok = EmitElemOp(cx, pn, pn->getOp(), cg);
         break;
 
       case TOK_NEW:
       case TOK_LP:
       {
-        bool callop = (PN_TYPE(pn) == TOK_LP);
+        bool callop = pn->isKind(TOK_LP);
 
         /*
          * Emit callable invocation or operator new (constructor call) code.
@@ -6738,23 +6729,23 @@ js_EmitTree(JSContext *cx, JSCodeGenerator *cg, JSParseNode *pn)
          * global object).
          */
         pn2 = pn->pn_head;
-        switch (pn2->pn_type) {
+        switch (pn2->getKind()) {
           case TOK_NAME:
             if (!EmitNameOp(cx, cg, pn2, callop))
                 return JS_FALSE;
             break;
           case TOK_DOT:
-            if (!EmitPropOp(cx, pn2, PN_OP(pn2), cg, callop))
+            if (!EmitPropOp(cx, pn2, pn2->getOp(), cg, callop))
                 return JS_FALSE;
             break;
           case TOK_LB:
-            JS_ASSERT(pn2->pn_op == JSOP_GETELEM);
+            JS_ASSERT(pn2->isOp(JSOP_GETELEM));
             if (!EmitElemOp(cx, pn2, callop ? JSOP_CALLELEM : JSOP_GETELEM, cg))
                 return JS_FALSE;
             break;
           case TOK_UNARYOP:
 #if JS_HAS_XML_SUPPORT
-            if (pn2->pn_op == JSOP_XMLNAME) {
+            if (pn2->isOp(JSOP_XMLNAME)) {
                 if (!EmitXMLName(cx, pn2, JSOP_CALLXMLNAME, cg))
                     return JS_FALSE;
                 callop = true;          /* suppress JSOP_PUSH after */
@@ -6790,10 +6781,10 @@ js_EmitTree(JSContext *cx, JSCodeGenerator *cg, JSParseNode *pn)
             return JS_FALSE;
 
         argc = pn->pn_count - 1;
-        if (js_Emit3(cx, cg, PN_OP(pn), ARGC_HI(argc), ARGC_LO(argc)) < 0)
+        if (js_Emit3(cx, cg, pn->getOp(), ARGC_HI(argc), ARGC_LO(argc)) < 0)
             return JS_FALSE;
-        CheckTypeSet(cx, cg, PN_OP(pn));
-        if (PN_OP(pn) == JSOP_EVAL) {
+        CheckTypeSet(cx, cg, pn->getOp());
+        if (pn->isOp(JSOP_EVAL)) {
             EMIT_UINT16_IMM_OP(JSOP_LINENO, pn->pn_pos.begin.lineno);
             if (EmitBlockChain(cx, cg) < 0)
                 return JS_FALSE;
@@ -6821,7 +6812,7 @@ js_EmitTree(JSContext *cx, JSCodeGenerator *cg, JSParseNode *pn)
          * statements get braces by default from the decompiler.
          */
         noteIndex = -1;
-        type = PN_TYPE(pn->expr());
+        type = pn->expr()->getKind();
         if (type != TOK_CATCH && type != TOK_LET && type != TOK_FOR &&
             (!(stmt = stmtInfo.down)
              ? !cg->inFunction()
@@ -6844,7 +6835,7 @@ js_EmitTree(JSContext *cx, JSCodeGenerator *cg, JSParseNode *pn)
         if (!js_EmitTree(cx, cg, pn->pn_expr))
             return JS_FALSE;
 
-        op = PN_OP(pn);
+        op = pn->getOp();
         if (op == JSOP_LEAVEBLOCKEXPR) {
             if (js_NewSrcNote2(cx, cg, SRC_PCBASE, CG_OFFSET(cg) - top) < 0)
                 return JS_FALSE;
@@ -6877,7 +6868,7 @@ js_EmitTree(JSContext *cx, JSCodeGenerator *cg, JSParseNode *pn)
          * with their variable declarations on the left and the body on the
          * right.
          */
-        if (pn->pn_arity == PN_BINARY) {
+        if (pn->isArity(PN_BINARY)) {
             pn2 = pn->pn_right;
             pn = pn->pn_left;
         } else {
@@ -6893,7 +6884,7 @@ js_EmitTree(JSContext *cx, JSCodeGenerator *cg, JSParseNode *pn)
          * (essentially just setlocal, though destructuring assignment uses
          * other additional opcodes) do not care about the block chain.
          */
-        JS_ASSERT(pn->pn_arity == PN_LIST);
+        JS_ASSERT(pn->isArity(PN_LIST));
         TempPopScope tps;
         bool popScope = pn2 || (cg->flags & TCF_IN_FOR_INIT);
         if (popScope && !tps.popBlock(cx, cg))
@@ -6931,7 +6922,7 @@ js_EmitTree(JSContext *cx, JSCodeGenerator *cg, JSParseNode *pn)
         slot = AdjustBlockSlot(cx, cg, cg->arrayCompDepth);
         if (slot < 0)
             return JS_FALSE;
-        EMIT_UINT16_IMM_OP(PN_OP(pn), slot);
+        EMIT_UINT16_IMM_OP(pn->getOp(), slot);
         break;
       }
 #endif
@@ -6954,7 +6945,7 @@ js_EmitTree(JSContext *cx, JSCodeGenerator *cg, JSParseNode *pn)
 #endif
 
 #if JS_HAS_GENERATORS
-        if (pn->pn_type == TOK_ARRAYCOMP) {
+        if (pn->isKind(TOK_ARRAYCOMP)) {
             uintN saveDepth;
 
             if (!EmitNewInit(cx, cg, JSProto_Array, pn, sharpnum))
@@ -7002,7 +6993,7 @@ js_EmitTree(JSContext *cx, JSCodeGenerator *cg, JSParseNode *pn)
         for (atomIndex = 0; pn2; atomIndex++, pn2 = pn2->pn_next) {
             if (!EmitNumberOp(cx, atomIndex, cg))
                 return JS_FALSE;
-            if (pn2->pn_type == TOK_COMMA && pn2->pn_arity == PN_NULLARY) {
+            if (pn2->isKind(TOK_COMMA) && pn2->isArity(PN_NULLARY)) {
                 if (js_Emit1(cx, cg, JSOP_HOLE) < 0)
                     return JS_FALSE;
             } else {
@@ -7075,7 +7066,7 @@ js_EmitTree(JSContext *cx, JSCodeGenerator *cg, JSParseNode *pn)
         for (pn2 = pn->pn_head; pn2; pn2 = pn2->pn_next) {
             /* Emit an index for t[2] for later consumption by JSOP_INITELEM. */
             pn3 = pn2->pn_left;
-            if (pn3->pn_type == TOK_NUMBER) {
+            if (pn3->isKind(TOK_NUMBER)) {
                 if (!EmitNumberOp(cx, pn3->pn_dval, cg))
                     return JS_FALSE;
             }
@@ -7084,7 +7075,7 @@ js_EmitTree(JSContext *cx, JSCodeGenerator *cg, JSParseNode *pn)
             if (!js_EmitTree(cx, cg, pn2->pn_right))
                 return JS_FALSE;
 
-            op = PN_OP(pn2);
+            op = pn2->getOp();
             if (op == JSOP_GETTER || op == JSOP_SETTER) {
                 obj = NULL;
                 if (js_Emit1(cx, cg, op) < 0)
@@ -7092,28 +7083,28 @@ js_EmitTree(JSContext *cx, JSCodeGenerator *cg, JSParseNode *pn)
             }
 
             /* Annotate JSOP_INITELEM so we decompile 2:c and not just c. */
-            if (pn3->pn_type == TOK_NUMBER) {
+            if (pn3->isKind(TOK_NUMBER)) {
                 obj = NULL;
                 if (js_NewSrcNote(cx, cg, SRC_INITPROP) < 0)
                     return JS_FALSE;
                 if (js_Emit1(cx, cg, JSOP_INITELEM) < 0)
                     return JS_FALSE;
             } else {
-                JS_ASSERT(pn3->pn_type == TOK_NAME ||
-                          pn3->pn_type == TOK_STRING);
+                JS_ASSERT(pn3->isKind(TOK_NAME) ||
+                          pn3->isKind(TOK_STRING));
                 jsatomid index;
                 if (!cg->makeAtomIndex(pn3->pn_atom, &index))
                     return JS_FALSE;
 
                 /* Check whether we can optimize to JSOP_INITMETHOD. */
                 JSParseNode *init = pn2->pn_right;
-                bool lambda = PN_OP(init) == JSOP_LAMBDA;
+                bool lambda = init->isOp(JSOP_LAMBDA);
                 if (lambda)
                     ++methodInits;
                 if (op == JSOP_INITPROP && lambda && init->pn_funbox->joinable()) {
                     obj = NULL;
                     op = JSOP_INITMETHOD;
-                    pn2->pn_op = uint8(op);
+                    pn2->setOp(op);
                 } else {
                     /*
                      * Disable NEWOBJECT on initializers that set __proto__, which has
@@ -7170,13 +7161,13 @@ js_EmitTree(JSContext *cx, JSCodeGenerator *cg, JSParseNode *pn)
         JS_ASSERT(cg->hasSharps());
         sharpnum = pn->pn_num;
         pn = pn->pn_kid;
-        if (pn->pn_type == TOK_RB)
+        if (pn->isKind(TOK_RB))
             goto do_emit_array;
 # if JS_HAS_GENERATORS
-        if (pn->pn_type == TOK_ARRAYCOMP)
+        if (pn->isKind(TOK_ARRAYCOMP))
             goto do_emit_array;
 # endif
-        if (pn->pn_type == TOK_RC)
+        if (pn->isKind(TOK_RC))
             goto do_emit_object;
 
         if (!js_EmitTree(cx, cg, pn))
@@ -7196,7 +7187,7 @@ js_EmitTree(JSContext *cx, JSCodeGenerator *cg, JSParseNode *pn)
          * of a later function definition of the same name. See FunctionDef and
          * MakeDefIntoUse in jsparse.cpp.
          */
-        if (pn->pn_op == JSOP_NOP)
+        if (pn->isOp(JSOP_NOP))
             break;
         if (!EmitNameOp(cx, cg, pn, JS_FALSE))
             return JS_FALSE;
@@ -7210,7 +7201,7 @@ js_EmitTree(JSContext *cx, JSCodeGenerator *cg, JSParseNode *pn)
       case TOK_XMLCOMMENT:
 #endif
       case TOK_STRING:
-        ok = EmitAtomOp(cx, pn, PN_OP(pn), cg);
+        ok = EmitAtomOp(cx, pn, pn->getOp(), cg);
         break;
 
       case TOK_NUMBER:
@@ -7218,7 +7209,7 @@ js_EmitTree(JSContext *cx, JSCodeGenerator *cg, JSParseNode *pn)
         break;
 
       case TOK_REGEXP: {
-        JS_ASSERT(pn->pn_op == JSOP_REGEXP);
+        JS_ASSERT(pn->isOp(JSOP_REGEXP));
         ok = EmitIndexOp(cx, JSOP_REGEXP,
                          cg->regexpList.index(pn->pn_objbox),
                          cg);
@@ -7229,7 +7220,7 @@ js_EmitTree(JSContext *cx, JSCodeGenerator *cg, JSParseNode *pn)
       case TOK_ANYNAME:
 #endif
       case TOK_PRIMARY:
-        if (js_Emit1(cx, cg, PN_OP(pn)) < 0)
+        if (js_Emit1(cx, cg, pn->getOp()) < 0)
             return JS_FALSE;
         break;
 
@@ -7241,8 +7232,8 @@ js_EmitTree(JSContext *cx, JSCodeGenerator *cg, JSParseNode *pn)
 #if JS_HAS_XML_SUPPORT
       case TOK_XMLELEM:
       case TOK_XMLLIST:
-        JS_ASSERT(PN_TYPE(pn) == TOK_XMLLIST || pn->pn_count != 0);
-        switch (pn->pn_head ? PN_TYPE(pn->pn_head) : TOK_XMLLIST) {
+        JS_ASSERT(pn->isKind(TOK_XMLLIST) || pn->pn_count != 0);
+        switch (pn->pn_head ? pn->pn_head->getKind() : TOK_XMLLIST) {
           case TOK_XMLETAGO:
             JS_ASSERT(0);
             /* FALL THROUGH */
@@ -7255,7 +7246,7 @@ js_EmitTree(JSContext *cx, JSCodeGenerator *cg, JSParseNode *pn)
         }
 
         for (pn2 = pn->pn_head; pn2; pn2 = pn2->pn_next) {
-            if (pn2->pn_type == TOK_LC &&
+            if (pn2->isKind(TOK_LC) &&
                 js_Emit1(cx, cg, JSOP_STARTXMLEXPR) < 0) {
                 return JS_FALSE;
             }
@@ -7267,14 +7258,14 @@ js_EmitTree(JSContext *cx, JSCodeGenerator *cg, JSParseNode *pn)
 
         if (pn->pn_xflags & PNX_XMLROOT) {
             if (pn->pn_count == 0) {
-                JS_ASSERT(pn->pn_type == TOK_XMLLIST);
+                JS_ASSERT(pn->isKind(TOK_XMLLIST));
                 atom = cx->runtime->atomState.emptyAtom;
                 jsatomid index;
                 if (!cg->makeAtomIndex(atom, &index))
                     return JS_FALSE;
                 EMIT_INDEX_OP(JSOP_STRING, index);
             }
-            if (js_Emit1(cx, cg, PN_OP(pn)) < 0)
+            if (js_Emit1(cx, cg, pn->getOp()) < 0)
                 return JS_FALSE;
         }
 #ifdef DEBUG
@@ -7294,8 +7285,8 @@ js_EmitTree(JSContext *cx, JSCodeGenerator *cg, JSParseNode *pn)
 
         {
             jsatomid index;
-            JSAtom *tmp = (pn->pn_type == TOK_XMLETAGO) ? cx->runtime->atomState.etagoAtom
-                                                        : cx->runtime->atomState.stagoAtom;
+            JSAtom *tmp = (pn->isKind(TOK_XMLETAGO)) ? cx->runtime->atomState.etagoAtom
+                                                     : cx->runtime->atomState.stagoAtom;
             if (!cg->makeAtomIndex(tmp, &index))
                 return JS_FALSE;
             EMIT_INDEX_OP(JSOP_STRING, index);
@@ -7303,7 +7294,7 @@ js_EmitTree(JSContext *cx, JSCodeGenerator *cg, JSParseNode *pn)
 
         JS_ASSERT(pn->pn_count != 0);
         pn2 = pn->pn_head;
-        if (pn2->pn_type == TOK_LC && js_Emit1(cx, cg, JSOP_STARTXMLEXPR) < 0)
+        if (pn2->isKind(TOK_LC) && js_Emit1(cx, cg, JSOP_STARTXMLEXPR) < 0)
             return JS_FALSE;
         if (!js_EmitTree(cx, cg, pn2))
             return JS_FALSE;
@@ -7311,13 +7302,13 @@ js_EmitTree(JSContext *cx, JSCodeGenerator *cg, JSParseNode *pn)
             return JS_FALSE;
 
         for (pn2 = pn2->pn_next, i = 0; pn2; pn2 = pn2->pn_next, i++) {
-            if (pn2->pn_type == TOK_LC &&
+            if (pn2->isKind(TOK_LC) &&
                 js_Emit1(cx, cg, JSOP_STARTXMLEXPR) < 0) {
                 return JS_FALSE;
             }
             if (!js_EmitTree(cx, cg, pn2))
                 return JS_FALSE;
-            if ((i & 1) && pn2->pn_type == TOK_LC) {
+            if ((i & 1) && pn2->isKind(TOK_LC)) {
                 if (js_Emit1(cx, cg, JSOP_TOATTRVAL) < 0)
                     return JS_FALSE;
             }
@@ -7329,8 +7320,8 @@ js_EmitTree(JSContext *cx, JSCodeGenerator *cg, JSParseNode *pn)
 
         {
             jsatomid index;
-            JSAtom *tmp = (pn->pn_type == TOK_XMLPTAGC) ? cx->runtime->atomState.ptagcAtom
-                                                        : cx->runtime->atomState.tagcAtom;
+            JSAtom *tmp = (pn->isKind(TOK_XMLPTAGC)) ? cx->runtime->atomState.ptagcAtom
+                                                     : cx->runtime->atomState.tagcAtom;
             if (!cg->makeAtomIndex(tmp, &index))
                 return JS_FALSE;
             EMIT_INDEX_OP(JSOP_STRING, index);
@@ -7338,16 +7329,16 @@ js_EmitTree(JSContext *cx, JSCodeGenerator *cg, JSParseNode *pn)
         if (js_Emit1(cx, cg, JSOP_ADD) < 0)
             return JS_FALSE;
 
-        if ((pn->pn_xflags & PNX_XMLROOT) && js_Emit1(cx, cg, PN_OP(pn)) < 0)
+        if ((pn->pn_xflags & PNX_XMLROOT) && js_Emit1(cx, cg, pn->getOp()) < 0)
             return JS_FALSE;
         break;
       }
 
       case TOK_XMLNAME:
-        if (pn->pn_arity == PN_LIST) {
+        if (pn->isArity(PN_LIST)) {
             JS_ASSERT(pn->pn_count != 0);
             for (pn2 = pn->pn_head; pn2; pn2 = pn2->pn_next) {
-                if (pn2->pn_type == TOK_LC &&
+                if (pn2->isKind(TOK_LC) &&
                     js_Emit1(cx, cg, JSOP_STARTXMLEXPR) < 0) {
                     return JS_FALSE;
                 }
@@ -7357,10 +7348,10 @@ js_EmitTree(JSContext *cx, JSCodeGenerator *cg, JSParseNode *pn)
                     return JS_FALSE;
             }
         } else {
-            JS_ASSERT(pn->pn_arity == PN_NULLARY);
-            ok = (pn->pn_op == JSOP_OBJECT)
-                 ? EmitObjectOp(cx, pn->pn_objbox, PN_OP(pn), cg)
-                 : EmitAtomOp(cx, pn, PN_OP(pn), cg);
+            JS_ASSERT(pn->isArity(PN_NULLARY));
+            ok = pn->isOp(JSOP_OBJECT)
+                 ? EmitObjectOp(cx, pn->pn_objbox, pn->getOp(), cg)
+                 : EmitAtomOp(cx, pn, pn->getOp(), cg);
         }
         break;
 
diff --git a/js/src/jsparse.cpp b/js/src/jsparse.cpp
index 9c6b6ed54e97..0da9f55625ef 100644
--- a/js/src/jsparse.cpp
+++ b/js/src/jsparse.cpp
@@ -134,10 +134,10 @@ void
 JSParseNode::become(JSParseNode *pn2)
 {
     JS_ASSERT(!pn_defn);
-    JS_ASSERT(!pn2->pn_defn);
+    JS_ASSERT(!pn2->isDefn());
 
     JS_ASSERT(!pn_used);
-    if (pn2->pn_used) {
+    if (pn2->isUsed()) {
         JSParseNode **pnup = &pn2->pn_lexdef->dn_uses;
         while (*pnup != pn2)
             pnup = &(*pnup)->pn_link;
@@ -158,7 +158,7 @@ JSParseNode::become(JSParseNode *pn2)
      * If any pointers are pointing to pn2, change them to point to this
      * instead, since pn2 will be cleared and probably recycled.
      */
-    if (PN_TYPE(this) == TOK_FUNCTION && pn_arity == PN_FUNC) {
+    if (this->isKind(TOK_FUNCTION) && isArity(PN_FUNC)) {
         /* Function node: fix up the pn_funbox->node back-pointer. */
         JS_ASSERT(pn_funbox->node == pn2);
         pn_funbox->node = this;
@@ -176,7 +176,7 @@ void
 JSParseNode::clear()
 {
     pn_type = TOK_EOF;
-    pn_op = JSOP_NOP;
+    setOp(JSOP_NOP);
     pn_used = pn_defn = false;
     pn_arity = PN_NULLARY;
     pn_parens = false;
@@ -374,10 +374,10 @@ AddNodeToFreeList(JSParseNode *pn, js::Parser *parser)
      * recognize and process these, since their children do need to be dealt
      * with.
      */
-    JS_ASSERT(!pn->pn_used);
-    JS_ASSERT(!pn->pn_defn);
+    JS_ASSERT(!pn->isUsed());
+    JS_ASSERT(!pn->isDefn());
 
-    if (pn->pn_arity == PN_NAMESET && pn->pn_names.hasMap())
+    if (pn->isArity(PN_NAMESET) && pn->pn_names.hasMap())
         pn->pn_names.releaseMap(parser->context);
 
 #ifdef DEBUG
@@ -451,7 +451,7 @@ Parser::cleanFunctionList(JSFunctionBox **funboxHead)
                 JSParseNode **methodLink = &box->methods;
                 while (JSParseNode *method = *methodLink) {
                     /* Method nodes are never rewritten in place to be other kinds of nodes. */
-                    JS_ASSERT(method->pn_arity == PN_FUNC);
+                    JS_ASSERT(method->isArity(PN_FUNC));
                     if (!method->pn_funbox) {
                         /* Deleted: drop the node, and stay on this link. */
                         *methodLink = method->pn_link;
@@ -520,7 +520,7 @@ class NodeStack {
 static bool
 PushNodeChildren(JSParseNode *pn, NodeStack *stack)
 {
-    switch (pn->pn_arity) {
+    switch (pn->getArity()) {
       case PN_FUNC:
         /*
          * Function nodes are linked into the function box tree, and may
@@ -558,11 +558,11 @@ PushNodeChildren(JSParseNode *pn, NodeStack *stack)
          * pn_expr and pn_lexdef share storage; the latter isn't an owning
          * reference.
          */
-        if (!pn->pn_used) {
+        if (!pn->isUsed()) {
             stack->pushUnlessNull(pn->pn_expr);
             pn->pn_expr = NULL;
         }
-        return !pn->pn_used && !pn->pn_defn;
+        return !pn->isUsed() && !pn->isDefn();
 
       case PN_LIST:
         stack->pushList(pn);
@@ -585,7 +585,9 @@ PushNodeChildren(JSParseNode *pn, NodeStack *stack)
          * E4X function namespace nodes are PN_NULLARY, but can appear on use
          * lists.
          */
-        return !pn->pn_used && !pn->pn_defn;
+        return !pn->isUsed() && !pn->isDefn();
+      default:
+        ;
     }
 
     return true;
@@ -599,8 +601,8 @@ PushNodeChildren(JSParseNode *pn, NodeStack *stack)
 static void
 PrepareNodeForMutation(JSParseNode *pn, JSTreeContext *tc)
 {
-    if (pn->pn_arity != PN_NULLARY) {
-        if (pn->pn_arity == PN_FUNC) {
+    if (!pn->isArity(PN_NULLARY)) {
+        if (pn->isArity(PN_FUNC)) {
             /*
              * Since this node could be turned into anything, we can't
              * ensure it won't be subsequently recycled, so we must
@@ -684,7 +686,8 @@ NewOrRecycledNode(JSTreeContext *tc)
     }
 
     if (pn) {
-        pn->pn_used = pn->pn_defn = false;
+        pn->setUsed(false);
+        pn->setDefn(false);
         memset(&pn->pn_u, 0, sizeof pn->pn_u);
         pn->pn_next = NULL;
     }
@@ -725,32 +728,32 @@ JSParseNode::newBinaryOrAppend(TokenKind tt, JSOp op, JSParseNode *left, JSParse
      * Flatten a left-associative (left-heavy) tree of a given operator into
      * a list, to reduce js_FoldConstants and js_EmitTree recursion.
      */
-    if (PN_TYPE(left) == tt &&
-        PN_OP(left) == op &&
+    if (left->isKind(tt) &&
+        left->isOp(op) &&
         (js_CodeSpec[op].format & JOF_LEFTASSOC)) {
         if (left->pn_arity != PN_LIST) {
             pn1 = left->pn_left, pn2 = left->pn_right;
-            left->pn_arity = PN_LIST;
+            left->setArity(PN_LIST);
             left->pn_parens = false;
             left->initList(pn1);
             left->append(pn2);
             if (tt == TOK_PLUS) {
-                if (pn1->pn_type == TOK_STRING)
+                if (pn1->isKind(TOK_STRING))
                     left->pn_xflags |= PNX_STRCAT;
-                else if (pn1->pn_type != TOK_NUMBER)
+                else if (!pn1->isKind(TOK_NUMBER))
                     left->pn_xflags |= PNX_CANTFOLD;
-                if (pn2->pn_type == TOK_STRING)
+                if (pn2->isKind(TOK_STRING))
                     left->pn_xflags |= PNX_STRCAT;
-                else if (pn2->pn_type != TOK_NUMBER)
+                else if (!pn2->isKind(TOK_NUMBER))
                     left->pn_xflags |= PNX_CANTFOLD;
             }
         }
         left->append(right);
         left->pn_pos.end = right->pn_pos.end;
         if (tt == TOK_PLUS) {
-            if (right->pn_type == TOK_STRING)
+            if (right->isKind(TOK_STRING))
                 left->pn_xflags |= PNX_STRCAT;
-            else if (right->pn_type != TOK_NUMBER)
+            else if (!right->isKind(TOK_NUMBER))
                 left->pn_xflags |= PNX_CANTFOLD;
         }
         return left;
@@ -764,8 +767,8 @@ JSParseNode::newBinaryOrAppend(TokenKind tt, JSOp op, JSParseNode *left, JSParse
      * to "3pt", not "12pt").
      */
     if (tt == TOK_PLUS &&
-        left->pn_type == TOK_NUMBER &&
-        right->pn_type == TOK_NUMBER &&
+        left->isKind(TOK_NUMBER) &&
+        right->isKind(TOK_NUMBER) &&
         tc->parser->foldConstants) {
         left->pn_dval += right->pn_dval;
         left->pn_pos.end = right->pn_pos.end;
@@ -829,7 +832,7 @@ GenerateBlockIdForStmtNode(JSParseNode *pn, JSTreeContext *tc)
 {
     JS_ASSERT(tc->topStmt);
     JS_ASSERT(STMT_MAYBE_SCOPE(tc->topStmt));
-    JS_ASSERT(pn->pn_type == TOK_LC || pn->pn_type == TOK_LEXICALSCOPE);
+    JS_ASSERT(pn->isKind(TOK_LC) || pn->isKind(TOK_LEXICALSCOPE));
     if (!GenerateBlockId(tc, tc->topStmt->blockid))
         return false;
     pn->pn_blockid = tc->topStmt->blockid;
@@ -1039,11 +1042,8 @@ Compiler::compileScript(JSContext *cx, JSObject *scopeChain, StackFrame *callerF
             goto out;
 
 #if JS_HAS_XML_SUPPORT
-        if (PN_TYPE(pn) != TOK_SEMI ||
-            !pn->pn_kid ||
-            !TreeTypeIsXML(PN_TYPE(pn->pn_kid))) {
+        if (!pn->isKind(TOK_SEMI) || !pn->pn_kid || !TreeTypeIsXML(pn->pn_kid->getKind()))
             onlyXML = false;
-        }
 #endif
         RecycleTree(pn, &cg);
     }
@@ -1241,7 +1241,7 @@ HasFinalReturn(JSParseNode *pn)
     JSParseNode *pn2, *pn3;
     uintN rv, rv2, hasDefault;
 
-    switch (pn->pn_type) {
+    switch (pn->getKind()) {
       case TOK_LC:
         if (!pn->pn_head)
             return ENDS_IN_OTHER;
@@ -1254,21 +1254,21 @@ HasFinalReturn(JSParseNode *pn)
 
       case TOK_WHILE:
         pn2 = pn->pn_left;
-        if (pn2->pn_type == TOK_PRIMARY && pn2->pn_op == JSOP_TRUE)
+        if (pn2->isKind(TOK_PRIMARY) && pn2->isOp(JSOP_TRUE))
             return ENDS_IN_RETURN;
-        if (pn2->pn_type == TOK_NUMBER && pn2->pn_dval)
+        if (pn2->isKind(TOK_NUMBER) && pn2->pn_dval)
             return ENDS_IN_RETURN;
         return ENDS_IN_OTHER;
 
       case TOK_DO:
         pn2 = pn->pn_right;
-        if (pn2->pn_type == TOK_PRIMARY) {
-            if (pn2->pn_op == JSOP_FALSE)
+        if (pn2->isKind(TOK_PRIMARY)) {
+            if (pn2->isOp(JSOP_FALSE))
                 return HasFinalReturn(pn->pn_left);
-            if (pn2->pn_op == JSOP_TRUE)
+            if (pn2->isOp(JSOP_TRUE))
                 return ENDS_IN_RETURN;
         }
-        if (pn2->pn_type == TOK_NUMBER) {
+        if (pn2->isKind(TOK_NUMBER)) {
             if (pn2->pn_dval == 0)
                 return HasFinalReturn(pn->pn_left);
             return ENDS_IN_RETURN;
@@ -1277,7 +1277,7 @@ HasFinalReturn(JSParseNode *pn)
 
       case TOK_FOR:
         pn2 = pn->pn_left;
-        if (pn2->pn_arity == PN_TERNARY && !pn2->pn_kid2)
+        if (pn2->isArity(PN_TERNARY) && !pn2->pn_kid2)
             return ENDS_IN_RETURN;
         return ENDS_IN_OTHER;
 
@@ -1285,13 +1285,13 @@ HasFinalReturn(JSParseNode *pn)
         rv = ENDS_IN_RETURN;
         hasDefault = ENDS_IN_OTHER;
         pn2 = pn->pn_right;
-        if (pn2->pn_type == TOK_LEXICALSCOPE)
+        if (pn2->isKind(TOK_LEXICALSCOPE))
             pn2 = pn2->expr();
         for (pn2 = pn2->pn_head; rv && pn2; pn2 = pn2->pn_next) {
-            if (pn2->pn_type == TOK_DEFAULT)
+            if (pn2->isKind(TOK_DEFAULT))
                 hasDefault = ENDS_IN_RETURN;
             pn3 = pn2->pn_right;
-            JS_ASSERT(pn3->pn_type == TOK_LC);
+            JS_ASSERT(pn3->isKind(TOK_LC));
             if (pn3->pn_head) {
                 rv2 = HasFinalReturn(pn3->last());
                 if (rv2 == ENDS_IN_OTHER && pn2->pn_next)
@@ -1331,7 +1331,7 @@ HasFinalReturn(JSParseNode *pn)
         /* Else check the try block and any and all catch statements. */
         rv = HasFinalReturn(pn->pn_kid1);
         if (pn->pn_kid2) {
-            JS_ASSERT(pn->pn_kid2->pn_arity == PN_LIST);
+            JS_ASSERT(pn->pn_kid2->isArity(PN_LIST));
             for (pn2 = pn->pn_kid2->pn_head; pn2; pn2 = pn2->pn_next)
                 rv &= HasFinalReturn(pn2);
         }
@@ -1343,7 +1343,7 @@ HasFinalReturn(JSParseNode *pn)
 
       case TOK_LET:
         /* Non-binary let statements are let declarations. */
-        if (pn->pn_arity != PN_BINARY)
+        if (!pn->isArity(PN_BINARY))
             return ENDS_IN_OTHER;
         return HasFinalReturn(pn->pn_right);
 
@@ -1382,7 +1382,7 @@ CheckFinalReturn(JSContext *cx, JSTreeContext *tc, JSParseNode *pn)
 bool
 CheckStrictAssignment(JSContext *cx, JSTreeContext *tc, JSParseNode *lhs)
 {
-    if (tc->needStrictChecks() && lhs->pn_type == TOK_NAME) {
+    if (tc->needStrictChecks() && lhs->isKind(TOK_NAME)) {
         JSAtom *atom = lhs->pn_atom;
         JSAtomState *atomState = &cx->runtime->atomState;
         if (atom == atomState->evalAtom || atom == atomState->argumentsAtom) {
@@ -1522,8 +1522,8 @@ Parser::functionBody()
                                     JSMSG_BAD_ANON_GENERATOR_RETURN);
                     pn = NULL;
                 } else {
-                    pn->pn_type = TOK_RETURN;
-                    pn->pn_op = JSOP_RETURN;
+                    pn->setKind(TOK_RETURN);
+                    pn->setOp(JSOP_RETURN);
                     pn->pn_pos.end = pn->pn_kid->pn_pos.end;
                 }
             }
@@ -1556,9 +1556,9 @@ MakePlaceholder(JSParseNode *pn, JSTreeContext *tc)
     if (!dn)
         return NULL;
 
-    dn->pn_type = TOK_NAME;
-    dn->pn_op = JSOP_NOP;
-    dn->pn_defn = true;
+    dn->setKind(TOK_NAME);
+    dn->setOp(JSOP_NOP);
+    dn->setDefn(true);
     dn->pn_dflags |= PND_PLACEHOLDER;
     return dn;
 }
@@ -1566,8 +1566,8 @@ MakePlaceholder(JSParseNode *pn, JSTreeContext *tc)
 static bool
 Define(JSParseNode *pn, JSAtom *atom, JSTreeContext *tc, bool let = false)
 {
-    JS_ASSERT(!pn->pn_used);
-    JS_ASSERT_IF(pn->pn_defn, pn->isPlaceholder());
+    JS_ASSERT(!pn->isUsed());
+    JS_ASSERT_IF(pn->isDefn(), pn->isPlaceholder());
 
     bool foundLexdep = false;
     JSDefinition *dn = NULL;
@@ -1586,7 +1586,7 @@ Define(JSParseNode *pn, JSAtom *atom, JSTreeContext *tc, bool let = false)
         uintN start = let ? pn->pn_blockid : tc->bodyid;
 
         while ((pnu = *pnup) != NULL && pnu->pn_blockid >= start) {
-            JS_ASSERT(pnu->pn_used);
+            JS_ASSERT(pnu->isUsed());
             pnu->pn_lexdef = (JSDefinition *) pn;
             pn->pn_dflags |= pnu->pn_dflags & PND_USE2DEF_FLAGS;
             pnup = &pnu->pn_link;
@@ -1606,7 +1606,7 @@ Define(JSParseNode *pn, JSAtom *atom, JSTreeContext *tc, bool let = false)
     bool ok = let ? tc->decls.addShadow(atom, toAdd) : tc->decls.addUnique(atom, toAdd);
     if (!ok)
         return false;
-    pn->pn_defn = true;
+    pn->setDefn(true);
     pn->pn_dflags &= ~PND_PLACEHOLDER;
     if (!tc->parent)
         pn->pn_dflags |= PND_TOPLEVEL;
@@ -1616,21 +1616,21 @@ Define(JSParseNode *pn, JSAtom *atom, JSTreeContext *tc, bool let = false)
 static void
 LinkUseToDef(JSParseNode *pn, JSDefinition *dn, JSTreeContext *tc)
 {
-    JS_ASSERT(!pn->pn_used);
-    JS_ASSERT(!pn->pn_defn);
+    JS_ASSERT(!pn->isUsed());
+    JS_ASSERT(!pn->isDefn());
     JS_ASSERT(pn != dn->dn_uses);
     pn->pn_link = dn->dn_uses;
     dn->dn_uses = pn;
     dn->pn_dflags |= pn->pn_dflags & PND_USE2DEF_FLAGS;
-    pn->pn_used = true;
+    pn->setUsed(true);
     pn->pn_lexdef = dn;
 }
 
 static void
 ForgetUse(JSParseNode *pn)
 {
-    if (!pn->pn_used) {
-        JS_ASSERT(!pn->pn_defn);
+    if (!pn->isUsed()) {
+        JS_ASSERT(!pn->isDefn());
         return;
     }
 
@@ -1639,7 +1639,7 @@ ForgetUse(JSParseNode *pn)
     while ((pnu = *pnup) != pn)
         pnup = &pnu->pn_link;
     *pnup = pn->pn_link;
-    pn->pn_used = false;
+    pn->setUsed(false);
 }
 
 static JSParseNode *
@@ -1650,7 +1650,7 @@ MakeAssignment(JSParseNode *pn, JSParseNode *rhs, JSTreeContext *tc)
         return NULL;
     *lhs = *pn;
 
-    if (pn->pn_used) {
+    if (pn->isUsed()) {
         JSDefinition *dn = pn->pn_lexdef;
         JSParseNode **pnup = &dn->dn_uses;
 
@@ -1661,11 +1661,12 @@ MakeAssignment(JSParseNode *pn, JSParseNode *rhs, JSTreeContext *tc)
         pn->pn_link = NULL;
     }
 
-    pn->pn_type = TOK_ASSIGN;
-    pn->pn_op = JSOP_NOP;
-    pn->pn_arity = PN_BINARY;
-    pn->pn_parens = false;
-    pn->pn_used = pn->pn_defn = false;
+    pn->setKind(TOK_ASSIGN);
+    pn->setOp(JSOP_NOP);
+    pn->setArity(PN_BINARY);
+    pn->setInParens(false);
+    pn->setUsed(false);
+    pn->setDefn(false);
     pn->pn_left = lhs;
     pn->pn_right = rhs;
     return lhs;
@@ -1689,31 +1690,31 @@ MakeDefIntoUse(JSDefinition *dn, JSParseNode *pn, JSAtom *atom, JSTreeContext *t
             dn = (JSDefinition *) lhs;
         }
 
-        dn->pn_op = (js_CodeSpec[dn->pn_op].format & JOF_SET) ? JSOP_SETNAME : JSOP_NAME;
+        dn->setOp((js_CodeSpec[dn->getOp()].format & JOF_SET) ? JSOP_SETNAME : JSOP_NAME);
     } else if (dn->kind() == JSDefinition::FUNCTION) {
-        JS_ASSERT(dn->pn_op == JSOP_NOP);
+        JS_ASSERT(dn->isOp(JSOP_NOP));
         PrepareNodeForMutation(dn, tc);
-        dn->pn_type = TOK_NAME;
-        dn->pn_arity = PN_NAME;
+        dn->setKind(TOK_NAME);
+        dn->setArity(PN_NAME);
         dn->pn_atom = atom;
     }
 
     /* Now make dn no longer a definition, rather a use of pn. */
-    JS_ASSERT(dn->pn_type == TOK_NAME);
-    JS_ASSERT(dn->pn_arity == PN_NAME);
+    JS_ASSERT(dn->isKind(TOK_NAME));
+    JS_ASSERT(dn->isArity(PN_NAME));
     JS_ASSERT(dn->pn_atom == atom);
 
     for (JSParseNode *pnu = dn->dn_uses; pnu; pnu = pnu->pn_link) {
-        JS_ASSERT(pnu->pn_used);
-        JS_ASSERT(!pnu->pn_defn);
+        JS_ASSERT(pnu->isUsed());
+        JS_ASSERT(!pnu->isDefn());
         pnu->pn_lexdef = (JSDefinition *) pn;
         pn->pn_dflags |= pnu->pn_dflags & PND_USE2DEF_FLAGS;
     }
     pn->pn_dflags |= dn->pn_dflags & PND_USE2DEF_FLAGS;
     pn->dn_uses = dn;
 
-    dn->pn_defn = false;
-    dn->pn_used = true;
+    dn->setDefn(false);
+    dn->setUsed(true);
     dn->pn_lexdef = (JSDefinition *) pn;
     dn->pn_cookie.makeFree();
     dn->pn_dflags &= ~PND_BOUND;
@@ -1737,7 +1738,7 @@ DefineArg(JSParseNode *pn, JSAtom *atom, uintN i, JSTreeContext *tc)
     argpn = NameNode::create(atom, tc);
     if (!argpn)
         return false;
-    JS_ASSERT(PN_TYPE(argpn) == TOK_NAME && PN_OP(argpn) == JSOP_NOP);
+    JS_ASSERT(argpn->isKind(TOK_NAME) && argpn->isOp(JSOP_NOP));
 
     /* Arguments are initialized by definition. */
     argpn->pn_dflags |= PND_INITIALIZED;
@@ -1749,14 +1750,14 @@ DefineArg(JSParseNode *pn, JSAtom *atom, uintN i, JSTreeContext *tc)
         argsbody = ListNode::create(tc);
         if (!argsbody)
             return false;
-        argsbody->pn_type = TOK_ARGSBODY;
-        argsbody->pn_op = JSOP_NOP;
+        argsbody->setKind(TOK_ARGSBODY);
+        argsbody->setOp(JSOP_NOP);
         argsbody->makeEmpty();
         pn->pn_body = argsbody;
     }
     argsbody->append(argpn);
 
-    argpn->pn_op = JSOP_GETARG;
+    argpn->setOp(JSOP_GETARG);
     argpn->pn_cookie.set(tc->staticLevel, i);
     argpn->pn_dflags |= PND_BOUND;
     return true;
@@ -1838,7 +1839,7 @@ Compiler::compileFunctionBody(JSContext *cx, JSFunction *fun, JSPrincipals *prin
             pn = NULL;
         } else {
             if (fn->pn_body) {
-                JS_ASSERT(PN_TYPE(fn->pn_body) == TOK_ARGSBODY);
+                JS_ASSERT(fn->pn_body->isKind(TOK_ARGSBODY));
                 fn->pn_body->append(pn);
                 fn->pn_body->pn_pos = pn->pn_pos;
                 pn = fn->pn_body;
@@ -1936,7 +1937,7 @@ BindDestructuringArg(JSContext *cx, BindData *data, JSAtom *atom, JSTreeContext
      * the object or array destructuring pattern, and all ARGs for the formal
      * parameter list bound as locals before any VAR for a destructured name.
      */
-    pn->pn_op = JSOP_SETLOCAL;
+    pn->setOp(JSOP_SETLOCAL);
     pn->pn_dflags |= PND_BOUND;
 
     return Define(pn, atom, tc);
@@ -2035,7 +2036,7 @@ FindFunArgs(JSFunctionBox *funbox, int level, JSFunctionBoxQueue *queue)
 
     do {
         JSParseNode *fn = funbox->node;
-        JS_ASSERT(fn->pn_arity == PN_FUNC);
+        JS_ASSERT(fn->isArity(PN_FUNC));
         JSFunction *fun = funbox->function();
         int fnlevel = level;
 
@@ -2067,7 +2068,7 @@ FindFunArgs(JSFunctionBox *funbox, int level, JSFunctionBoxQueue *queue)
         uintN skipmin = UpvarCookie::FREE_LEVEL;
         JSParseNode *pn = fn->pn_body;
 
-        if (pn->pn_type == TOK_UPVARS) {
+        if (pn->isKind(TOK_UPVARS)) {
             AtomDefnMapPtr &upvars = pn->pn_names;
             JS_ASSERT(upvars->count() != 0);
 
@@ -2146,7 +2147,7 @@ Parser::markFunArgs(JSFunctionBox *funbox)
         JS_ASSERT(fn->isFunArg());
 
         JSParseNode *pn = fn->pn_body;
-        if (pn->pn_type == TOK_UPVARS) {
+        if (pn->isKind(TOK_UPVARS)) {
             AtomDefnMapPtr upvars = pn->pn_names;
             JS_ASSERT(!upvars->empty());
 
@@ -2157,7 +2158,7 @@ Parser::markFunArgs(JSFunctionBox *funbox)
                 if (!lexdep->isFreeVar() &&
                     !lexdep->isFunArg() &&
                     (lexdep->kind() == JSDefinition::FUNCTION ||
-                     PN_OP(lexdep) == JSOP_CALLEE)) {
+                     lexdep->isOp(JSOP_CALLEE))) {
                     /*
                      * Mark this formerly-Algol-like function as an escaping
                      * function (i.e., as a funarg), because it is used from
@@ -2170,7 +2171,7 @@ Parser::markFunArgs(JSFunctionBox *funbox)
                     lexdep->setFunArg();
 
                     JSFunctionBox *afunbox;
-                    if (PN_OP(lexdep) == JSOP_CALLEE) {
+                    if (lexdep->isOp(JSOP_CALLEE)) {
                         /*
                          * A named function expression will not appear to be a
                          * funarg if it is immediately applied. However, if its
@@ -2211,7 +2212,7 @@ MinBlockId(JSParseNode *fn, uint32 id)
 {
     if (fn->pn_blockid < id)
         return false;
-    if (fn->pn_defn) {
+    if (fn->isDefn()) {
         for (JSParseNode *pn = fn->dn_uses; pn; pn = pn->pn_link) {
             if (pn->pn_blockid < id)
                 return false;
@@ -2390,8 +2391,8 @@ DeoptimizeUsesWithin(JSDefinition *dn, const TokenPos &pos)
     uintN ndeoptimized = 0;
 
     for (JSParseNode *pnu = dn->dn_uses; pnu; pnu = pnu->pn_link) {
-        JS_ASSERT(pnu->pn_used);
-        JS_ASSERT(!pnu->pn_defn);
+        JS_ASSERT(pnu->isUsed());
+        JS_ASSERT(!pnu->isDefn());
         if (pnu->pn_pos.begin >= pos.begin && pnu->pn_pos.end <= pos.end) {
             pnu->pn_dflags |= PND_DEOPTIMIZED;
             ++ndeoptimized;
@@ -2418,11 +2419,11 @@ ConsiderUnbranding(JSFunctionBox *funbox)
 #if JS_HAS_EXPR_CLOSURES
     {
         JSParseNode *pn2 = funbox->node->pn_body;
-        if (PN_TYPE(pn2) == TOK_UPVARS)
+        if (pn2->isKind(TOK_UPVARS))
             pn2 = pn2->pn_tree;
-        if (PN_TYPE(pn2) == TOK_ARGSBODY)
+        if (pn2->isKind(TOK_ARGSBODY))
             pn2 = pn2->last();
-        if (PN_TYPE(pn2) != TOK_LC)
+        if (!pn2->isKind(TOK_LC))
             returnsExpr = true;
     }
 #endif
@@ -2430,7 +2431,7 @@ ConsiderUnbranding(JSFunctionBox *funbox)
         uintN methodSets = 0, slowMethodSets = 0;
 
         for (JSParseNode *method = funbox->methods; method; method = method->pn_link) {
-            JS_ASSERT(PN_OP(method) == JSOP_LAMBDA || PN_OP(method) == JSOP_LAMBDA_FC);
+            JS_ASSERT(method->isOp(JSOP_LAMBDA) || method->isOp(JSOP_LAMBDA_FC));
             ++methodSets;
             if (!method->pn_funbox->joinable())
                 ++slowMethodSets;
@@ -2465,7 +2466,7 @@ Parser::setFunctionKinds(JSFunctionBox *funbox, uint32 *tcflags)
             bool hasUpvars = false;
             bool canFlatten = true;
 
-            if (pn->pn_type == TOK_UPVARS) {
+            if (pn->isKind(TOK_UPVARS)) {
                 AtomDefnMapPtr upvars = pn->pn_names;
                 JS_ASSERT(!upvars->empty());
 
@@ -2499,24 +2500,24 @@ Parser::setFunctionKinds(JSFunctionBox *funbox, uint32 *tcflags)
                 fun->setKind(JSFUN_NULL_CLOSURE);
             } else if (canFlatten) {
                 fun->setKind(JSFUN_FLAT_CLOSURE);
-                switch (PN_OP(fn)) {
-                case JSOP_DEFFUN:
-                    fn->pn_op = JSOP_DEFFUN_FC;
+                switch (fn->getOp()) {
+                  case JSOP_DEFFUN:
+                    fn->setOp(JSOP_DEFFUN_FC);
                     break;
-                case JSOP_DEFLOCALFUN:
-                    fn->pn_op = JSOP_DEFLOCALFUN_FC;
+                  case JSOP_DEFLOCALFUN:
+                    fn->setOp(JSOP_DEFLOCALFUN_FC);
                     break;
-                case JSOP_LAMBDA:
-                    fn->pn_op = JSOP_LAMBDA_FC;
+                  case JSOP_LAMBDA:
+                    fn->setOp(JSOP_LAMBDA_FC);
                     break;
-                default:
+                  default:
                     /* js_EmitTree's case TOK_FUNCTION: will select op. */
-                    JS_ASSERT(PN_OP(fn) == JSOP_NOP);
+                    JS_ASSERT(fn->isOp(JSOP_NOP));
                 }
             }
         }
 
-        if (fun->kind() == JSFUN_INTERPRETED && pn->pn_type == TOK_UPVARS) {
+        if (fun->kind() == JSFUN_INTERPRETED && pn->isKind(TOK_UPVARS)) {
             /*
              * One or more upvars cannot be safely snapshot into a flat
              * closure's non-reserved slot (see JSOP_GETFCSLOT), so we loop
@@ -2647,7 +2648,7 @@ LeaveFunction(JSParseNode *fn, JSTreeContext *funtc, JSAtom *funAtom = NULL,
             JS_ASSERT(dn->isPlaceholder());
 
             if (atom == funAtom && kind == Expression) {
-                dn->pn_op = JSOP_CALLEE;
+                dn->setOp(JSOP_CALLEE);
                 dn->pn_cookie.set(funtc->staticLevel, UpvarCookie::CALLEE_SLOT);
                 dn->pn_dflags |= PND_BOUND;
 
@@ -2752,8 +2753,8 @@ LeaveFunction(JSParseNode *fn, JSTreeContext *funtc, JSAtom *funAtom = NULL,
                 *pnup = outer_dn->dn_uses;
                 outer_dn->dn_uses = dn;
                 outer_dn->pn_dflags |= dn->pn_dflags & ~PND_PLACEHOLDER;
-                dn->pn_defn = false;
-                dn->pn_used = true;
+                dn->setDefn(false);
+                dn->setUsed(true);
                 dn->pn_lexdef = outer_dn;
             }
 
@@ -2768,7 +2769,7 @@ LeaveFunction(JSParseNode *fn, JSTreeContext *funtc, JSAtom *funAtom = NULL,
             if (!fn->pn_body)
                 return false;
 
-            fn->pn_body->pn_type = TOK_UPVARS;
+            fn->pn_body->setKind(TOK_UPVARS);
             fn->pn_body->pn_pos = body->pn_pos;
             if (foundCallee)
                 funtc->lexdeps->remove(funAtom);
@@ -2871,8 +2872,8 @@ Parser::functionArguments(JSTreeContext &funtc, JSFunctionBox *funbox, JSParseNo
                 JSParseNode *rhs = NameNode::create(context->runtime->atomState.emptyAtom, &funtc);
                 if (!rhs)
                     return false;
-                rhs->pn_type = TOK_NAME;
-                rhs->pn_op = JSOP_GETARG;
+                rhs->setKind(TOK_NAME);
+                rhs->setOp(JSOP_GETARG);
                 rhs->pn_cookie.set(funtc.staticLevel, slot);
                 rhs->pn_dflags |= PND_BOUND;
 
@@ -2884,7 +2885,7 @@ Parser::functionArguments(JSTreeContext &funtc, JSFunctionBox *funbox, JSParseNo
                     list = ListNode::create(&funtc);
                     if (!list)
                         return false;
-                    list->pn_type = TOK_VAR;
+                    list->setKind(TOK_VAR);
                     list->makeEmpty();
                     *listp = list;
                 }
@@ -2986,8 +2987,8 @@ Parser::functionDef(JSAtom *funAtom, FunctionType type, FunctionSyntaxKind kind)
         if (JSDefinition *dn = tc->decls.lookupFirst(funAtom)) {
             JSDefinition::Kind dn_kind = dn->kind();
 
-            JS_ASSERT(!dn->pn_used);
-            JS_ASSERT(dn->pn_defn);
+            JS_ASSERT(!dn->isUsed());
+            JS_ASSERT(dn->isDefn());
 
             if (context->hasStrictOption() || dn_kind == JSDefinition::CONST) {
                 JSAutoByteString name;
@@ -3005,7 +3006,7 @@ Parser::functionDef(JSAtom *funAtom, FunctionType type, FunctionSyntaxKind kind)
 
             if (bodyLevel) {
                 tc->decls.updateFirst(funAtom, (JSDefinition *) pn);
-                pn->pn_defn = true;
+                pn->setDefn(true);
                 pn->dn_uses = dn; /* dn->dn_uses is now pn_link */
 
                 if (!MakeDefIntoUse(dn, pn, funAtom, tc))
@@ -3019,9 +3020,9 @@ Parser::functionDef(JSAtom *funAtom, FunctionType type, FunctionSyntaxKind kind)
              */
 
             if (JSDefinition *fn = tc->lexdeps.lookupDefn(funAtom)) {
-                JS_ASSERT(fn->pn_defn);
-                fn->pn_type = TOK_FUNCTION;
-                fn->pn_arity = PN_FUNC;
+                JS_ASSERT(fn->isDefn());
+                fn->setKind(TOK_FUNCTION);
+                fn->setArity(PN_FUNC);
                 fn->pn_pos.begin = pn->pn_pos.begin;
 
                 /*
@@ -3111,7 +3112,7 @@ Parser::functionDef(JSAtom *funAtom, FunctionType type, FunctionSyntaxKind kind)
 
         while (JSDefinition *apn = iter()) {
             /* Filter based on pn_op -- see BindDestructuringArg, above. */
-            if (apn->pn_op != JSOP_SETLOCAL)
+            if (!apn->isOp(JSOP_SETLOCAL))
                 continue;
 
             if (!BindLocalVariable(context, &funtc, apn, VARIABLE))
@@ -3185,13 +3186,13 @@ Parser::functionDef(JSAtom *funAtom, FunctionType type, FunctionSyntaxKind kind)
      * code without bracing the decompilation of the function body.
      */
     if (prelude) {
-        if (body->pn_arity != PN_LIST) {
+        if (!body->isArity(PN_LIST)) {
             JSParseNode *block;
 
             block = ListNode::create(outertc);
             if (!block)
                 return NULL;
-            block->pn_type = TOK_SEQ;
+            block->setKind(TOK_SEQ);
             block->pn_pos = body->pn_pos;
             block->initList(body);
 
@@ -3202,7 +3203,7 @@ Parser::functionDef(JSAtom *funAtom, FunctionType type, FunctionSyntaxKind kind)
         if (!item)
             return NULL;
 
-        item->pn_type = TOK_SEMI;
+        item->setKind(TOK_SEMI);
         item->pn_pos.begin = item->pn_pos.end = body->pn_pos.begin;
         item->pn_kid = prelude;
         item->pn_next = body->pn_head;
@@ -3254,7 +3255,7 @@ Parser::functionDef(JSAtom *funAtom, FunctionType type, FunctionSyntaxKind kind)
     funbox->kids = funtc.functionList;
 
     pn->pn_funbox = funbox;
-    pn->pn_op = op;
+    pn->setOp(op);
     if (pn->pn_body) {
         pn->pn_body->append(body);
         pn->pn_body->pn_pos = body->pn_pos;
@@ -3398,7 +3399,7 @@ Parser::statements()
     pn = ListNode::create(tc);
     if (!pn)
         return NULL;
-    pn->pn_type = TOK_LC;
+    pn->setKind(TOK_LC);
     pn->makeEmpty();
     pn->pn_blockid = tc->blockid();
     saveBlock = tc->blockNode;
@@ -3426,7 +3427,7 @@ Parser::statements()
         if (inDirectivePrologue && !recognizeDirectivePrologue(pn2, &inDirectivePrologue))
             return NULL;
 
-        if (pn2->pn_type == TOK_FUNCTION) {
+        if (pn2->isKind(TOK_FUNCTION)) {
             /*
              * PNX_FUNCDEFS notifies the emitter that the block contains body-
              * level function definitions that should be processed before the
@@ -3472,9 +3473,9 @@ Parser::condition()
     MUST_MATCH_TOKEN(TOK_RP, JSMSG_PAREN_AFTER_COND);
 
     /* Check for (a = b) and warn about possible (a == b) mistype. */
-    if (pn->pn_type == TOK_ASSIGN &&
-        pn->pn_op == JSOP_NOP &&
-        !pn->pn_parens &&
+    if (pn->isKind(TOK_ASSIGN) &&
+        pn->isOp(JSOP_NOP) &&
+        !pn->isInParens() &&
         !reportErrorNumber(NULL, JSREPORT_WARNING | JSREPORT_STRICT, JSMSG_EQUAL_AS_ASSIGN, "")) {
         return NULL;
     }
@@ -3560,7 +3561,7 @@ BindLet(JSContext *cx, BindData *data, JSAtom *atom, JSTreeContext *tc)
      * and eval code, Compiler::compileScript will adjust the slot again to
      * include script->nfixed.
      */
-    pn->pn_op = JSOP_GETLOCAL;
+    pn->setOp(JSOP_GETLOCAL);
     pn->pn_cookie.set(tc->staticLevel, uint16(n));
     pn->pn_dflags |= PND_LET | PND_BOUND;
 
@@ -3650,7 +3651,7 @@ DefineGlobal(JSParseNode *pn, JSCodeGenerator *cg, JSAtom *atom)
         if (!globalObj->lookupProperty(cx, ATOM_TO_JSID(atom), &holder, &prop))
             return false;
 
-        JSFunctionBox *funbox = (pn->pn_type == TOK_FUNCTION) ? pn->pn_funbox : NULL;
+        JSFunctionBox *funbox = pn->isKind(TOK_FUNCTION) ? pn->pn_funbox : NULL;
 
         GlobalScope::GlobalDef def;
         if (prop) {
@@ -3697,8 +3698,8 @@ DefineGlobal(JSParseNode *pn, JSCodeGenerator *cg, JSAtom *atom)
          * hoisted to the top of the script, and the |c = []| will just
          * overwrite it at runtime.
          */
-        if (pn->pn_type == TOK_FUNCTION) {
-            JS_ASSERT(pn->pn_arity = PN_FUNC);
+        if (pn->isKind(TOK_FUNCTION)) {
+            JS_ASSERT(pn->isArity(PN_FUNC));
             jsatomid index = p.value();
             globalScope->defs[index].funbox = pn->pn_funbox;
         }
@@ -3712,7 +3713,7 @@ DefineGlobal(JSParseNode *pn, JSCodeGenerator *cg, JSAtom *atom)
 static bool
 BindTopLevelVar(JSContext *cx, BindData *data, JSParseNode *pn, JSTreeContext *tc)
 {
-    JS_ASSERT(pn->pn_op == JSOP_NAME);
+    JS_ASSERT(pn->isOp(JSOP_NAME));
     JS_ASSERT(!tc->inFunction());
 
     /* There's no need to optimize bindings if we're not compiling code. */
@@ -3777,7 +3778,7 @@ BindFunctionLocal(JSContext *cx, BindData *data, MultiDeclRange &mdl, JSTreeCont
      * must be handled specially -- see NoteLValue.
      */
     if (name == cx->runtime->atomState.argumentsAtom) {
-        pn->pn_op = JSOP_ARGUMENTS;
+        pn->setOp(JSOP_ARGUMENTS);
         pn->pn_dflags |= PND_BOUND;
         return true;
     }
@@ -3795,7 +3796,7 @@ BindFunctionLocal(JSContext *cx, BindData *data, MultiDeclRange &mdl, JSTreeCont
 
         if (!BindLocalVariable(cx, tc, pn, kind))
             return false;
-        pn->pn_op = JSOP_GETLOCAL;
+        pn->setOp(JSOP_GETLOCAL);
         return true;
     }
 
@@ -3815,7 +3816,7 @@ BindVarOrConst(JSContext *cx, BindData *data, JSAtom *atom, JSTreeContext *tc)
     JSParseNode *pn = data->pn;
 
     /* Default best op for pn is JSOP_NAME; we'll try to improve below. */
-    pn->pn_op = JSOP_NAME;
+    pn->setOp(JSOP_NAME);
 
     if (!CheckStrictBinding(cx, tc, atom, pn))
         return false;
@@ -3895,18 +3896,18 @@ BindVarOrConst(JSContext *cx, BindData *data, JSAtom *atom, JSTreeContext *tc)
 
         data->fresh = false;
 
-        if (!pn->pn_used) {
+        if (!pn->isUsed()) {
             /* Make pnu be a fresh name node that uses dn. */
             JSParseNode *pnu = pn;
 
-            if (pn->pn_defn) {
+            if (pn->isDefn()) {
                 pnu = NameNode::create(atom, tc);
                 if (!pnu)
                     return JS_FALSE;
             }
 
             LinkUseToDef(pnu, dn, tc);
-            pnu->pn_op = JSOP_NAME;
+            pnu->setOp(JSOP_NAME);
         }
 
         /* Find the first non-let binding of this atom. */
@@ -3928,7 +3929,7 @@ BindVarOrConst(JSContext *cx, BindData *data, JSAtom *atom, JSTreeContext *tc)
          * same name, but that has not been declared until this point, must be
          * hoisted above the let bindings.
          */
-        if (!pn->pn_defn) {
+        if (!pn->isDefn()) {
             if (tc->lexdeps->lookup(atom)) {
                 tc->lexdeps->remove(atom);
             } else {
@@ -3937,16 +3938,16 @@ BindVarOrConst(JSContext *cx, BindData *data, JSAtom *atom, JSTreeContext *tc)
                     return JS_FALSE;
 
                 /* The token stream may be past the location for pn. */
-                pn2->pn_type = TOK_NAME;
+                pn2->setKind(TOK_NAME);
                 pn2->pn_pos = pn->pn_pos;
                 pn = pn2;
             }
-            pn->pn_op = JSOP_NAME;
+            pn->setOp(JSOP_NAME);
         }
 
         if (!tc->decls.addHoist(atom, (JSDefinition *) pn))
             return JS_FALSE;
-        pn->pn_defn = true;
+        pn->setDefn(true);
         pn->pn_dflags &= ~PND_PLACEHOLDER;
     }
 
@@ -3962,14 +3963,14 @@ BindVarOrConst(JSContext *cx, BindData *data, JSAtom *atom, JSTreeContext *tc)
 static bool
 MakeSetCall(JSContext *cx, JSParseNode *pn, JSTreeContext *tc, uintN msg)
 {
-    JS_ASSERT(pn->pn_arity == PN_LIST);
-    JS_ASSERT(pn->pn_op == JSOP_CALL || pn->pn_op == JSOP_EVAL ||
-              pn->pn_op == JSOP_FUNCALL || pn->pn_op == JSOP_FUNAPPLY);
+    JS_ASSERT(pn->isArity(PN_LIST));
+    JS_ASSERT(pn->isOp(JSOP_CALL) || pn->isOp(JSOP_EVAL) ||
+              pn->isOp(JSOP_FUNCALL) || pn->isOp(JSOP_FUNAPPLY));
     if (!ReportStrictModeError(cx, TS(tc->parser), tc, pn, msg))
         return false;
 
     JSParseNode *pn2 = pn->pn_head;
-    if (pn2->pn_type == TOK_FUNCTION && (pn2->pn_funbox->tcflags & TCF_GENEXP_LAMBDA)) {
+    if (pn2->isKind(TOK_FUNCTION) && (pn2->pn_funbox->tcflags & TCF_GENEXP_LAMBDA)) {
         ReportCompileErrorNumber(cx, TS(tc->parser), pn, JSREPORT_ERROR, msg);
         return false;
     }
@@ -3980,7 +3981,7 @@ MakeSetCall(JSContext *cx, JSParseNode *pn, JSTreeContext *tc, uintN msg)
 static void
 NoteLValue(JSContext *cx, JSParseNode *pn, JSTreeContext *tc, uintN dflag = PND_ASSIGNED)
 {
-    if (pn->pn_used) {
+    if (pn->isUsed()) {
         JSDefinition *dn = pn->pn_lexdef;
 
         /*
@@ -4035,7 +4036,7 @@ BindDestructuringVar(JSContext *cx, BindData *data, JSParseNode *pn,
      * simple variable, we must check for assignment to 'arguments' and flag
      * the enclosing function (if any) as heavyweight.
      */
-    JS_ASSERT(pn->pn_type == TOK_NAME);
+    JS_ASSERT(pn->isKind(TOK_NAME));
     atom = pn->pn_atom;
     if (atom == cx->runtime->atomState.argumentsAtom)
         tc->flags |= TCF_FUN_HEAVYWEIGHT;
@@ -4050,13 +4051,9 @@ BindDestructuringVar(JSContext *cx, BindData *data, JSParseNode *pn,
      */
     if (pn->pn_dflags & PND_BOUND) {
         JS_ASSERT(!(pn->pn_dflags & PND_GVAR));
-        pn->pn_op = (pn->pn_op == JSOP_ARGUMENTS)
-                    ? JSOP_SETNAME
-                    : JSOP_SETLOCAL;
+        pn->setOp(pn->isOp(JSOP_ARGUMENTS) ? JSOP_SETNAME : JSOP_SETLOCAL);
     } else {
-        pn->pn_op = (data->op == JSOP_DEFCONST)
-                    ? JSOP_SETCONST
-                    : JSOP_SETNAME;
+        pn->setOp((data->op == JSOP_DEFCONST) ? JSOP_SETCONST : JSOP_SETNAME);
     }
 
     if (data->op == JSOP_DEFCONST)
@@ -4087,7 +4084,7 @@ BindDestructuringVar(JSContext *cx, BindData *data, JSParseNode *pn,
 static JSBool
 BindDestructuringLHS(JSContext *cx, JSParseNode *pn, JSTreeContext *tc)
 {
-    switch (pn->pn_type) {
+    switch (pn->getKind()) {
       case TOK_NAME:
         NoteLValue(cx, pn, tc);
         /* FALL THROUGH */
@@ -4099,8 +4096,8 @@ BindDestructuringLHS(JSContext *cx, JSParseNode *pn, JSTreeContext *tc)
          * in the very weird and ECMA-262-required "for (var [x] = i in o) ..."
          * case. See bug 558633.
          */
-        if (!(js_CodeSpec[pn->pn_op].format & JOF_SET))
-            pn->pn_op = JSOP_SETNAME;
+        if (!(js_CodeSpec[pn->getOp()].format & JOF_SET))
+            pn->setOp(JSOP_SETNAME);
         break;
 
       case TOK_LP:
@@ -4110,8 +4107,8 @@ BindDestructuringLHS(JSContext *cx, JSParseNode *pn, JSTreeContext *tc)
 
 #if JS_HAS_XML_SUPPORT
       case TOK_UNARYOP:
-        if (pn->pn_op == JSOP_XMLNAME) {
-            pn->pn_op = JSOP_BINDXMLNAME;
+        if (pn->isOp(JSOP_XMLNAME)) {
+            pn->setOp(JSOP_BINDXMLNAME);
             break;
         }
         /* FALL THROUGH */
@@ -4171,21 +4168,21 @@ CheckDestructuring(JSContext *cx, BindData *data, JSParseNode *left, JSTreeConte
 {
     bool ok;
 
-    if (left->pn_type == TOK_ARRAYCOMP) {
+    if (left->isKind(TOK_ARRAYCOMP)) {
         ReportCompileErrorNumber(cx, TS(tc->parser), left, JSREPORT_ERROR,
                                  JSMSG_ARRAY_COMP_LEFTSIDE);
         return false;
     }
 
-    if (left->pn_type == TOK_RB) {
+    if (left->isKind(TOK_RB)) {
         for (JSParseNode *pn = left->pn_head; pn; pn = pn->pn_next) {
             /* Nullary comma is an elision; binary comma is an expression.*/
-            if (pn->pn_type != TOK_COMMA || pn->pn_arity != PN_NULLARY) {
-                if (pn->pn_type == TOK_RB || pn->pn_type == TOK_RC) {
+            if (!pn->isKind(TOK_COMMA) || !pn->isArity(PN_NULLARY)) {
+                if (pn->isKind(TOK_RB) || pn->isKind(TOK_RC)) {
                     ok = CheckDestructuring(cx, data, pn, tc);
                 } else {
                     if (data) {
-                        if (pn->pn_type != TOK_NAME) {
+                        if (!pn->isKind(TOK_NAME)) {
                             ReportCompileErrorNumber(cx, TS(tc->parser), pn, JSREPORT_ERROR,
                                                      JSMSG_NO_VARIABLE_NAME);
                             return false;
@@ -4200,15 +4197,15 @@ CheckDestructuring(JSContext *cx, BindData *data, JSParseNode *left, JSTreeConte
             }
         }
     } else {
-        JS_ASSERT(left->pn_type == TOK_RC);
+        JS_ASSERT(left->isKind(TOK_RC));
         for (JSParseNode *pair = left->pn_head; pair; pair = pair->pn_next) {
-            JS_ASSERT(pair->pn_type == TOK_COLON);
+            JS_ASSERT(pair->isKind(TOK_COLON));
             JSParseNode *pn = pair->pn_right;
 
-            if (pn->pn_type == TOK_RB || pn->pn_type == TOK_RC) {
+            if (pn->isKind(TOK_RB) || pn->isKind(TOK_RC)) {
                 ok = CheckDestructuring(cx, data, pn, tc);
             } else if (data) {
-                if (pn->pn_type != TOK_NAME) {
+                if (!pn->isKind(TOK_NAME)) {
                     ReportCompileErrorNumber(cx, TS(tc->parser), pn, JSREPORT_ERROR,
                                              JSMSG_NO_VARIABLE_NAME);
                     return false;
@@ -4274,23 +4271,23 @@ CheckDestructuring(JSContext *cx, BindData *data, JSParseNode *left, JSTreeConte
 static void
 UndominateInitializers(JSParseNode *left, const TokenPtr &end, JSTreeContext *tc)
 {
-    if (left->pn_type == TOK_RB) {
+    if (left->isKind(TOK_RB)) {
         for (JSParseNode *pn = left->pn_head; pn; pn = pn->pn_next) {
             /* Nullary comma is an elision; binary comma is an expression.*/
-            if (pn->pn_type != TOK_COMMA || pn->pn_arity != PN_NULLARY) {
-                if (pn->pn_type == TOK_RB || pn->pn_type == TOK_RC)
+            if (!pn->isKind(TOK_COMMA) || !pn->isArity(PN_NULLARY)) {
+                if (pn->isKind(TOK_RB) || pn->isKind(TOK_RC))
                     UndominateInitializers(pn, end, tc);
                 else
                     pn->pn_pos.end = end;
             }
         }
     } else {
-        JS_ASSERT(left->pn_type == TOK_RC);
+        JS_ASSERT(left->isKind(TOK_RC));
 
         for (JSParseNode *pair = left->pn_head; pair; pair = pair->pn_next) {
-            JS_ASSERT(pair->pn_type == TOK_COLON);
+            JS_ASSERT(pair->isKind(TOK_COLON));
             JSParseNode *pn = pair->pn_right;
-            if (pn->pn_type == TOK_RB || pn->pn_type == TOK_RC)
+            if (pn->isKind(TOK_RB) || pn->isKind(TOK_RC))
                 UndominateInitializers(pn, end, tc);
             else
                 pn->pn_pos.end = end;
@@ -4328,15 +4325,15 @@ CloneParseTree(JSParseNode *opn, JSTreeContext *tc)
     pn = NewOrRecycledNode(tc);
     if (!pn)
         return NULL;
-    pn->pn_type = opn->pn_type;
+    pn->setKind(opn->getKind());
+    pn->setOp(opn->getOp());
+    pn->setUsed(opn->isUsed());
+    pn->setDefn(opn->isDefn());
+    pn->setArity(opn->getArity());
+    pn->setInParens(opn->isInParens());
     pn->pn_pos = opn->pn_pos;
-    pn->pn_op = opn->pn_op;
-    pn->pn_used = opn->pn_used;
-    pn->pn_defn = opn->pn_defn;
-    pn->pn_arity = opn->pn_arity;
-    pn->pn_parens = opn->pn_parens;
 
-    switch (pn->pn_arity) {
+    switch (pn->getArity()) {
 #define NULLCHECK(e)    JS_BEGIN_MACRO if (!(e)) return NULL; JS_END_MACRO
 
       case PN_FUNC:
@@ -4382,7 +4379,7 @@ CloneParseTree(JSParseNode *opn, JSTreeContext *tc)
       case PN_NAME:
         // PN_NAME could mean several arms in pn_u, so copy the whole thing.
         pn->pn_u = opn->pn_u;
-        if (opn->pn_used) {
+        if (opn->isUsed()) {
             /*
              * The old name is a use of its pn_lexdef. Make the clone also be a
              * use of that definition.
@@ -4398,8 +4395,8 @@ CloneParseTree(JSParseNode *opn, JSTreeContext *tc)
              * If the old name is a definition, the new one has pn_defn set.
              * Make the old name a use of the new node.
              */
-            if (opn->pn_defn) {
-                opn->pn_defn = false;
+            if (opn->isDefn()) {
+                opn->setDefn(false);
                 LinkUseToDef(opn, (JSDefinition *) pn, tc);
             }
         }
@@ -4429,9 +4426,9 @@ ContainsStmt(JSParseNode *pn, TokenKind tt)
 
     if (!pn)
         return NULL;
-    if (PN_TYPE(pn) == tt)
+    if (pn->isKind(tt))
         return pn;
-    switch (pn->pn_arity) {
+    switch (pn->getArity()) {
       case PN_LIST:
         for (pn2 = pn->pn_head; pn2; pn2 = pn2->pn_next) {
             pnt = ContainsStmt(pn2, tt);
@@ -4452,14 +4449,14 @@ ContainsStmt(JSParseNode *pn, TokenKind tt)
          * Limit recursion if pn is a binary expression, which can't contain a
          * var statement.
          */
-        if (pn->pn_op != JSOP_NOP)
+        if (!pn->isOp(JSOP_NOP))
             return NULL;
         pnt = ContainsStmt(pn->pn_left, tt);
         if (pnt)
             return pnt;
         return ContainsStmt(pn->pn_right, tt);
       case PN_UNARY:
-        if (pn->pn_op != JSOP_NOP)
+        if (!pn->isOp(JSOP_NOP))
             return NULL;
         return ContainsStmt(pn->pn_kid, tt);
       case PN_NAME:
@@ -4571,8 +4568,8 @@ PushLexicalScope(JSContext *cx, TokenStream *ts, JSTreeContext *tc,
         return NULL;
 
     js_PushBlockScope(tc, stmt, blockbox, -1);
-    pn->pn_type = TOK_LEXICALSCOPE;
-    pn->pn_op = JSOP_LEAVEBLOCK;
+    pn->setKind(TOK_LEXICALSCOPE);
+    pn->setOp(JSOP_LEAVEBLOCK);
     pn->pn_objbox = blockbox;
     pn->pn_cookie.makeFree();
     pn->pn_dflags = 0;
@@ -4635,7 +4632,7 @@ Parser::letBlock(JSBool statement)
         pn = UnaryNode::create(tc);
         if (!pn)
             return NULL;
-        pn->pn_type = TOK_SEMI;
+        pn->setKind(TOK_SEMI);
         pn->pn_num = -1;
         pn->pn_kid = pnblock;
 
@@ -4652,7 +4649,7 @@ Parser::letBlock(JSBool statement)
          * Change pnblock's opcode to the variant that propagates the last
          * result down after popping the block, and clear statement.
          */
-        pnblock->pn_op = JSOP_LEAVEBLOCKEXPR;
+        pnblock->setOp(JSOP_LEAVEBLOCKEXPR);
         pnlet->pn_right = assignExpr();
         if (!pnlet->pn_right)
             return NULL;
@@ -4686,7 +4683,7 @@ NewBindingNode(JSAtom *atom, JSTreeContext *tc, bool let = false)
     }
 
     if (pn) {
-        JS_ASSERT(pn->pn_defn);
+        JS_ASSERT(pn->isDefn());
 
         /*
          * A let binding at top level becomes a var before we get here, so if
@@ -4795,7 +4792,7 @@ Parser::switchStatement()
         JSParseNode *pn4 = ListNode::create(tc);
         if (!pn4)
             return NULL;
-        pn4->pn_type = TOK_LC;
+        pn4->setKind(TOK_LC);
         pn4->makeEmpty();
         while ((tt = tokenStream.peekToken(TSF_OPERAND)) != TOK_RC &&
                tt != TOK_CASE && tt != TOK_DEFAULT) {
@@ -4848,23 +4845,23 @@ CloneLeftHandSide(JSParseNode *opn, JSTreeContext *tc)
     JSParseNode *pn = NewOrRecycledNode(tc);
     if (!pn)
         return NULL;
-    pn->pn_type = opn->pn_type;
+    pn->setKind(opn->getKind());
+    pn->setOp(opn->getOp());
+    pn->setUsed(opn->isUsed());
+    pn->setDefn(opn->isDefn());
+    pn->setArity(opn->getArity());
+    pn->setInParens(opn->isInParens());
     pn->pn_pos = opn->pn_pos;
-    pn->pn_op = opn->pn_op;
-    pn->pn_used = opn->pn_used;
-    pn->pn_defn = opn->pn_defn;
-    pn->pn_arity = opn->pn_arity;
-    pn->pn_parens = opn->pn_parens;
 
 #if JS_HAS_DESTRUCTURING
-    if (opn->pn_arity == PN_LIST) {
-        JS_ASSERT(opn->pn_type == TOK_RB || opn->pn_type == TOK_RC);
+    if (opn->isArity(PN_LIST)) {
+        JS_ASSERT(opn->isKind(TOK_RB) || opn->isKind(TOK_RC));
         pn->makeEmpty();
         for (JSParseNode *opn2 = opn->pn_head; opn2; opn2 = opn2->pn_next) {
             JSParseNode *pn2;
-            if (opn->pn_type == TOK_RC) {
-                JS_ASSERT(opn2->pn_arity == PN_BINARY);
-                JS_ASSERT(opn2->pn_type == TOK_COLON);
+            if (opn->isKind(TOK_RC)) {
+                JS_ASSERT(opn2->isArity(PN_BINARY));
+                JS_ASSERT(opn2->isKind(TOK_COLON));
 
                 JSParseNode *tag = CloneParseTree(opn2->pn_left, tc);
                 if (!tag)
@@ -4873,8 +4870,8 @@ CloneLeftHandSide(JSParseNode *opn, JSTreeContext *tc)
                 if (!target)
                     return NULL;
                 pn2 = BinaryNode::create(TOK_COLON, JSOP_INITPROP, opn2->pn_pos, tag, target, tc);
-            } else if (opn2->pn_arity == PN_NULLARY) {
-                JS_ASSERT(opn2->pn_type == TOK_COMMA);
+            } else if (opn2->isArity(PN_NULLARY)) {
+                JS_ASSERT(opn2->isKind(TOK_COMMA));
                 pn2 = CloneParseTree(opn2, tc);
             } else {
                 pn2 = CloneLeftHandSide(opn2, tc);
@@ -4889,24 +4886,24 @@ CloneLeftHandSide(JSParseNode *opn, JSTreeContext *tc)
     }
 #endif
 
-    JS_ASSERT(opn->pn_arity == PN_NAME);
-    JS_ASSERT(opn->pn_type == TOK_NAME);
+    JS_ASSERT(opn->isArity(PN_NAME));
+    JS_ASSERT(opn->isKind(TOK_NAME));
 
     /* If opn is a definition or use, make pn a use. */
     pn->pn_u.name = opn->pn_u.name;
-    pn->pn_op = JSOP_SETNAME;
-    if (opn->pn_used) {
+    pn->setOp(JSOP_SETNAME);
+    if (opn->isUsed()) {
         JSDefinition *dn = pn->pn_lexdef;
 
         pn->pn_link = dn->dn_uses;
         dn->dn_uses = pn;
     } else {
         pn->pn_expr = NULL;
-        if (opn->pn_defn) {
+        if (opn->isDefn()) {
             /* We copied some definition-specific state into pn. Clear it out. */
             pn->pn_cookie.makeFree();
             pn->pn_dflags &= ~PND_BOUND;
-            pn->pn_defn = false;
+            pn->setDefn(false);
 
             LinkUseToDef(pn, (JSDefinition *) opn, tc);
         }
@@ -4930,7 +4927,7 @@ Parser::forStatement()
     JSStmtInfo stmtInfo;
     js_PushStatement(tc, &stmtInfo, STMT_FOR_LOOP, -1);
 
-    pn->pn_op = JSOP_ITER;
+    pn->setOp(JSOP_ITER);
     pn->pn_iflags = 0;
     if (tokenStream.matchToken(TOK_NAME)) {
         if (tokenStream.currentToken().t_atom == context->runtime->atomState.eachAtom)
@@ -5018,36 +5015,36 @@ Parser::forStatement()
         stmtInfo.type = STMT_FOR_IN_LOOP;
 
         /* Check that the left side of the 'in' is valid. */
-        JS_ASSERT(!TokenKindIsDecl(tt) || PN_TYPE(pn1) == tt);
+        JS_ASSERT(!TokenKindIsDecl(tt) || pn1->isKind(tt));
         if (TokenKindIsDecl(tt)
-            ? (pn1->pn_count > 1 || pn1->pn_op == JSOP_DEFCONST
+            ? (pn1->pn_count > 1 || pn1->isOp(JSOP_DEFCONST)
 #if JS_HAS_DESTRUCTURING
                || (versionNumber() == JSVERSION_1_7 &&
-                   pn->pn_op == JSOP_ITER &&
+                   pn->isOp(JSOP_ITER) &&
                    !(pn->pn_iflags & JSITER_FOREACH) &&
-                   (pn1->pn_head->pn_type == TOK_RC ||
-                    (pn1->pn_head->pn_type == TOK_RB &&
+                   (pn1->pn_head->isKind(TOK_RC) ||
+                    (pn1->pn_head->isKind(TOK_RB) &&
                      pn1->pn_head->pn_count != 2) ||
-                    (pn1->pn_head->pn_type == TOK_ASSIGN &&
-                     (pn1->pn_head->pn_left->pn_type != TOK_RB ||
+                    (pn1->pn_head->isKind(TOK_ASSIGN) &&
+                     (!pn1->pn_head->pn_left->isKind(TOK_RB) ||
                       pn1->pn_head->pn_left->pn_count != 2))))
 #endif
               )
-            : (pn1->pn_type != TOK_NAME &&
-               pn1->pn_type != TOK_DOT &&
+            : (!pn1->isKind(TOK_NAME) &&
+               !pn1->isKind(TOK_DOT) &&
 #if JS_HAS_DESTRUCTURING
                ((versionNumber() == JSVERSION_1_7 &&
-                 pn->pn_op == JSOP_ITER &&
+                 pn->isOp(JSOP_ITER) &&
                  !(pn->pn_iflags & JSITER_FOREACH))
-                ? (pn1->pn_type != TOK_RB || pn1->pn_count != 2)
-                : (pn1->pn_type != TOK_RB && pn1->pn_type != TOK_RC)) &&
+                ? (!pn1->isKind(TOK_RB) || pn1->pn_count != 2)
+                : (!pn1->isKind(TOK_RB) && !pn1->isKind(TOK_RC))) &&
 #endif
-               pn1->pn_type != TOK_LP &&
+               !pn1->isKind(TOK_LP) &&
 #if JS_HAS_XML_SUPPORT
-               (pn1->pn_type != TOK_UNARYOP ||
-                pn1->pn_op != JSOP_XMLNAME) &&
+               (!pn1->isKind(TOK_UNARYOP) ||
+                !pn1->isOp(JSOP_XMLNAME)) &&
 #endif
-               pn1->pn_type != TOK_LB)) {
+               !pn1->isKind(TOK_LB))) {
             reportErrorNumber(pn1, JSREPORT_ERROR, JSMSG_BAD_FOR_LEFTSIDE);
             return NULL;
         }
@@ -5065,9 +5062,9 @@ Parser::forStatement()
             pn1->pn_xflags |= PNX_FORINVAR;
 
             pn2 = pn1->pn_head;
-            if ((pn2->pn_type == TOK_NAME && pn2->maybeExpr())
+            if ((pn2->isKind(TOK_NAME) && pn2->maybeExpr())
 #if JS_HAS_DESTRUCTURING
-                || pn2->pn_type == TOK_ASSIGN
+                || pn2->isKind(TOK_ASSIGN)
 #endif
                 ) {
                 /*
@@ -5087,7 +5084,7 @@ Parser::forStatement()
                 pnseq = ListNode::create(tc);
                 if (!pnseq)
                     return NULL;
-                pnseq->pn_type = TOK_SEQ;
+                pnseq->setKind(TOK_SEQ);
                 pnseq->pn_pos.begin = pn->pn_pos.begin;
 
                 dflag = PND_INITIALIZED;
@@ -5105,10 +5102,10 @@ Parser::forStatement()
                 pnseq->initList(pn1);
 
 #if JS_HAS_DESTRUCTURING
-                if (pn2->pn_type == TOK_ASSIGN) {
+                if (pn2->isKind(TOK_ASSIGN)) {
                     pn2 = pn2->pn_left;
-                    JS_ASSERT(pn2->pn_type == TOK_RB || pn2->pn_type == TOK_RC ||
-                              pn2->pn_type == TOK_NAME);
+                    JS_ASSERT(pn2->isKind(TOK_RB) || pn2->isKind(TOK_RC) ||
+                              pn2->isKind(TOK_NAME));
                 }
 #endif
                 pn1 = NULL;
@@ -5130,7 +5127,7 @@ Parser::forStatement()
                 return NULL;
         }
 
-        switch (pn2->pn_type) {
+        switch (pn2->getKind()) {
           case TOK_NAME:
             /* Beware 'for (arguments in ...)' with or without a 'var'. */
             NoteLValue(context, pn2, tc, dflag);
@@ -5148,7 +5145,7 @@ Parser::forStatement()
                  * Destructuring for-in requires [key, value] enumeration
                  * in JS1.7.
                  */
-                JS_ASSERT(pn->pn_op == JSOP_ITER);
+                JS_ASSERT(pn->isOp(JSOP_ITER));
                 if (!(pn->pn_iflags & JSITER_FOREACH))
                     pn->pn_iflags |= JSITER_FOREACH | JSITER_KEYVALUE;
             }
@@ -5176,13 +5173,13 @@ Parser::forStatement()
             tc->topStmt = save;
 #endif
 
-        pn4->pn_type = TOK_IN;
+        pn4->setKind(TOK_IN);
     } else {
         if (pn->pn_iflags & JSITER_FOREACH) {
             reportErrorNumber(pn, JSREPORT_ERROR, JSMSG_BAD_FOR_EACH_LOOP);
             return NULL;
         }
-        pn->pn_op = JSOP_NOP;
+        pn->setOp(JSOP_NOP);
 
         /* Parse the loop condition or null into pn2. */
         MUST_MATCH_TOKEN(TOK_SEMI, JSMSG_SEMI_AFTER_FOR_INIT);
@@ -5206,9 +5203,9 @@ Parser::forStatement()
                 return NULL;
         }
 
-        pn4->pn_type = TOK_FORHEAD;
+        pn4->setKind(TOK_FORHEAD);
     }
-    pn4->pn_op = JSOP_NOP;
+    pn4->setOp(JSOP_NOP);
     pn4->pn_kid1 = pn1;
     pn4->pn_kid2 = pn2;
     pn4->pn_kid3 = pn3;
@@ -5266,7 +5263,7 @@ Parser::tryStatement()
     JSParseNode *pn = TernaryNode::create(tc);
     if (!pn)
         return NULL;
-    pn->pn_op = JSOP_NOP;
+    pn->setOp(JSOP_NOP);
 
     MUST_MATCH_TOKEN(TOK_LC, JSMSG_CURLY_BEFORE_TRY);
     JSStmtInfo stmtInfo;
@@ -5284,7 +5281,7 @@ Parser::tryStatement()
         catchList = ListNode::create(tc);
         if (!catchList)
             return NULL;
-        catchList->pn_type = TOK_RESERVED;
+        catchList->setKind(TOK_RESERVED);
         catchList->makeEmpty();
         lastCatch = NULL;
 
@@ -5472,12 +5469,11 @@ Parser::letStatement()
         /* Check for a let statement or let expression. */
         if (tokenStream.peekToken() == TOK_LP) {
             pn = letBlock(JS_TRUE);
-            if (!pn || pn->pn_op == JSOP_LEAVEBLOCK)
+            if (!pn || pn->isOp(JSOP_LEAVEBLOCK))
                 return pn;
 
             /* Let expressions require automatic semicolon insertion. */
-            JS_ASSERT(pn->pn_type == TOK_SEMI ||
-                      pn->pn_op == JSOP_LEAVEBLOCKEXPR);
+            JS_ASSERT(pn->isKind(TOK_SEMI) || pn->isOp(JSOP_LEAVEBLOCKEXPR));
             break;
         }
 
@@ -5555,7 +5551,7 @@ Parser::letStatement()
 
 #ifdef DEBUG
             JSParseNode *tmp = tc->blockNode;
-            JS_ASSERT(!tmp || tmp->pn_type != TOK_LEXICALSCOPE);
+            JS_ASSERT(!tmp || !tmp->isKind(TOK_LEXICALSCOPE));
 #endif
 
             /* Create a new lexical scope node for these statements. */
@@ -5563,8 +5559,8 @@ Parser::letStatement()
             if (!pn1)
                 return NULL;
 
-            pn1->pn_type = TOK_LEXICALSCOPE;
-            pn1->pn_op = JSOP_LEAVEBLOCK;
+            pn1->setKind(TOK_LEXICALSCOPE);
+            pn1->setOp(JSOP_LEAVEBLOCK);
             pn1->pn_pos = tc->blockNode->pn_pos;
             pn1->pn_objbox = blockbox;
             pn1->pn_expr = tc->blockNode;
@@ -5592,7 +5588,7 @@ Parser::expressionStatement()
         return NULL;
 
     if (tokenStream.peekToken() == TOK_COLON) {
-        if (pn2->pn_type != TOK_NAME) {
+        if (!pn2->isKind(TOK_NAME)) {
             reportErrorNumber(NULL, JSREPORT_ERROR, JSMSG_BAD_LABEL);
             return NULL;
         }
@@ -5616,15 +5612,15 @@ Parser::expressionStatement()
             return NULL;
 
         /* Normalize empty statement to empty block for the decompiler. */
-        if (pn->pn_type == TOK_SEMI && !pn->pn_kid) {
-            pn->pn_type = TOK_LC;
-            pn->pn_arity = PN_LIST;
+        if (pn->isKind(TOK_SEMI) && !pn->pn_kid) {
+            pn->setKind(TOK_LC);
+            pn->setArity(PN_LIST);
             pn->makeEmpty();
         }
 
         /* Pop the label, set pn_expr, and return early. */
         PopStatement(tc);
-        pn2->pn_type = TOK_COLON;
+        pn2->setKind(TOK_COLON);
         pn2->pn_pos.end = pn->pn_pos.end;
         pn2->pn_expr = pn;
         return pn2;
@@ -5633,17 +5629,17 @@ Parser::expressionStatement()
     JSParseNode *pn = UnaryNode::create(tc);
     if (!pn)
         return NULL;
-    pn->pn_type = TOK_SEMI;
+    pn->setKind(TOK_SEMI);
     pn->pn_pos = pn2->pn_pos;
     pn->pn_kid = pn2;
 
-    switch (PN_TYPE(pn2)) {
+    switch (pn2->getKind()) {
       case TOK_LP:
         /*
          * Flag lambdas immediately applied as statements as instances of
          * the JS "module pattern". See CheckForImmediatelyAppliedLambda.
          */
-        if (PN_TYPE(pn2->pn_head) == TOK_FUNCTION &&
+        if (pn2->pn_head->isKind(TOK_FUNCTION) &&
             !pn2->pn_head->pn_funbox->node->isFunArg()) {
             pn2->pn_head->pn_funbox->tcflags |= TCF_FUN_MODULE_PATTERN;
         }
@@ -5655,12 +5651,12 @@ Parser::expressionStatement()
          * up a constructor function. See Parser::setFunctionKinds.
          */
         if (tc->funbox &&
-            PN_OP(pn2) == JSOP_NOP &&
-            PN_OP(pn2->pn_left) == JSOP_SETPROP &&
-            PN_OP(pn2->pn_left->pn_expr) == JSOP_THIS &&
-            PN_OP(pn2->pn_right) == JSOP_LAMBDA) {
-            JS_ASSERT(!pn2->pn_defn);
-            JS_ASSERT(!pn2->pn_used);
+            pn2->isOp(JSOP_NOP) &&
+            pn2->pn_left->isOp(JSOP_SETPROP) &&
+            pn2->pn_left->pn_expr->isOp(JSOP_THIS) &&
+            pn2->pn_right->isOp(JSOP_LAMBDA)) {
+            JS_ASSERT(!pn2->isDefn());
+            JS_ASSERT(!pn2->isUsed());
             pn2->pn_right->pn_link = tc->funbox->methods;
             tc->funbox->methods = pn2->pn_right;
         }
@@ -5800,7 +5796,7 @@ Parser::statement()
         if (!pn2)
             return NULL;
         pn->pn_pos.end = pn2->pn_pos.end;
-        pn->pn_op = JSOP_THROW;
+        pn->setOp(JSOP_THROW);
         pn->pn_kid = pn2;
         break;
       }
@@ -5944,14 +5940,14 @@ Parser::statement()
         pn = UnaryNode::create(tc);
         if (!pn)
             return NULL;
-        pn->pn_type = TOK_SEMI;
+        pn->setKind(TOK_SEMI);
         return pn;
 
       case TOK_DEBUGGER:
         pn = NullaryNode::create(tc);
         if (!pn)
             return NULL;
-        pn->pn_type = TOK_DEBUGGER;
+        pn->setKind(TOK_DEBUGGER);
         tc->flags |= TCF_FUN_HEAVYWEIGHT;
         break;
 
@@ -5976,7 +5972,7 @@ Parser::statement()
         JSParseNode *pn2 = expr();
         if (!pn2)
             return NULL;
-        pn->pn_op = JSOP_DEFXMLNS;
+        pn->setOp(JSOP_DEFXMLNS);
         pn->pn_pos.end = pn2->pn_pos.end;
         pn->pn_kid = pn2;
         break;
@@ -6036,7 +6032,7 @@ Parser::variables(bool inLetHead)
     pn = ListNode::create(tc);
     if (!pn)
         return NULL;
-    pn->pn_op = data.op;
+    pn->setOp(data.op);
     pn->makeEmpty();
 
     /*
@@ -6136,7 +6132,7 @@ Parser::variables(bool inLetHead)
             if (!init)
                 return NULL;
 
-            if (pn2->pn_used) {
+            if (pn2->isUsed()) {
                 pn2 = MakeAssignment(pn2, init, tc);
                 if (!pn2)
                     return NULL;
@@ -6146,13 +6142,13 @@ Parser::variables(bool inLetHead)
 
             JS_ASSERT_IF(pn2->pn_dflags & PND_GVAR, !(pn2->pn_dflags & PND_BOUND));
 
-            pn2->pn_op = (PN_OP(pn2) == JSOP_ARGUMENTS)
-                         ? JSOP_SETNAME
-                         : (pn2->pn_dflags & PND_BOUND)
-                         ? JSOP_SETLOCAL
-                         : (data.op == JSOP_DEFCONST)
-                         ? JSOP_SETCONST
-                         : JSOP_SETNAME;
+            pn2->setOp(pn2->isOp(JSOP_ARGUMENTS)
+                       ? JSOP_SETNAME
+                       : (pn2->pn_dflags & PND_BOUND)
+                       ? JSOP_SETLOCAL
+                       : (data.op == JSOP_DEFCONST)
+                       ? JSOP_SETCONST
+                       : JSOP_SETNAME);
 
             NoteLValue(context, pn2, tc, data.fresh ? PND_INITIALIZED : PND_ASSIGNED);
 
@@ -6190,7 +6186,7 @@ Parser::expr()
         do {
 #if JS_HAS_GENERATORS
             pn2 = pn->last();
-            if (pn2->pn_type == TOK_YIELD && !pn2->pn_parens) {
+            if (pn2->isKind(TOK_YIELD) && !pn2->isInParens()) {
                 reportErrorNumber(pn2, JSREPORT_ERROR, JSMSG_BAD_GENERATOR_SYNTAX, js_yield_str);
                 return NULL;
             }
@@ -6388,18 +6384,18 @@ Parser::condExpr1()
 bool
 Parser::setAssignmentLhsOps(JSParseNode *pn, JSOp op)
 {
-    switch (pn->pn_type) {
+    switch (pn->getKind()) {
       case TOK_NAME:
         if (!CheckStrictAssignment(context, tc, pn))
             return false;
-        pn->pn_op = (pn->pn_op == JSOP_GETLOCAL) ? JSOP_SETLOCAL : JSOP_SETNAME;
+        pn->setOp(pn->isOp(JSOP_GETLOCAL) ? JSOP_SETLOCAL : JSOP_SETNAME);
         NoteLValue(context, pn, tc);
         break;
       case TOK_DOT:
-        pn->pn_op = JSOP_SETPROP;
+        pn->setOp(JSOP_SETPROP);
         break;
       case TOK_LB:
-        pn->pn_op = JSOP_SETELEM;
+        pn->setOp(JSOP_SETELEM);
         break;
 #if JS_HAS_DESTRUCTURING
       case TOK_RB:
@@ -6418,8 +6414,8 @@ Parser::setAssignmentLhsOps(JSParseNode *pn, JSOp op)
         break;
 #if JS_HAS_XML_SUPPORT
       case TOK_UNARYOP:
-        if (pn->pn_op == JSOP_XMLNAME) {
-            pn->pn_op = JSOP_SETXMLNAME;
+        if (pn->isOp(JSOP_XMLNAME)) {
+            pn->setOp(JSOP_SETXMLNAME);
             break;
         }
         /* FALL THROUGH */
@@ -6457,7 +6453,7 @@ Parser::assignExpr()
     JSParseNode *rhs = assignExpr();
     if (!rhs)
         return NULL;
-    if (PN_TYPE(pn) == TOK_NAME && pn->pn_used) {
+    if (pn->isKind(TOK_NAME) && pn->isUsed()) {
         JSDefinition *dn = pn->pn_lexdef;
 
         /*
@@ -6480,15 +6476,15 @@ static JSParseNode *
 SetLvalKid(JSContext *cx, TokenStream *ts, JSTreeContext *tc,
            JSParseNode *pn, JSParseNode *kid, const char *name)
 {
-    if (kid->pn_type != TOK_NAME &&
-        kid->pn_type != TOK_DOT &&
-        (kid->pn_type != TOK_LP ||
-         (kid->pn_op != JSOP_CALL && kid->pn_op != JSOP_EVAL &&
-          kid->pn_op != JSOP_FUNCALL && kid->pn_op != JSOP_FUNAPPLY)) &&
+    if (!kid->isKind(TOK_NAME) &&
+        !kid->isKind(TOK_DOT) &&
+        (!kid->isKind(TOK_LP) ||
+         (!kid->isOp(JSOP_CALL) && !kid->isOp(JSOP_EVAL) &&
+          !kid->isOp(JSOP_FUNCALL) && !kid->isOp(JSOP_FUNAPPLY))) &&
 #if JS_HAS_XML_SUPPORT
-        (kid->pn_type != TOK_UNARYOP || kid->pn_op != JSOP_XMLNAME) &&
+        (!kid->isKind(TOK_UNARYOP) || !kid->isOp(JSOP_XMLNAME)) &&
 #endif
-        kid->pn_type != TOK_LB) {
+        !kid->isKind(TOK_LB)) {
         ReportCompileErrorNumber(cx, ts, NULL, JSREPORT_ERROR, JSMSG_BAD_OPERAND, name);
         return NULL;
     }
@@ -6510,7 +6506,7 @@ SetIncOpKid(JSContext *cx, TokenStream *ts, JSTreeContext *tc,
     kid = SetLvalKid(cx, ts, tc, pn, kid, incop_name_str[tt == TOK_DEC]);
     if (!kid)
         return JS_FALSE;
-    switch (kid->pn_type) {
+    switch (kid->getKind()) {
       case TOK_NAME:
         op = (tt == TOK_INC)
              ? (preorder ? JSOP_INCNAME : JSOP_NAMEINC)
@@ -6530,8 +6526,8 @@ SetIncOpKid(JSContext *cx, TokenStream *ts, JSTreeContext *tc,
         /* FALL THROUGH */
 #if JS_HAS_XML_SUPPORT
       case TOK_UNARYOP:
-        if (kid->pn_op == JSOP_XMLNAME)
-            kid->pn_op = JSOP_SETXMLNAME;
+        if (kid->isOp(JSOP_XMLNAME))
+            kid->setOp(JSOP_SETXMLNAME);
         /* FALL THROUGH */
 #endif
       case TOK_LB:
@@ -6544,7 +6540,7 @@ SetIncOpKid(JSContext *cx, TokenStream *ts, JSTreeContext *tc,
         JS_ASSERT(0);
         op = JSOP_NOP;
     }
-    pn->pn_op = op;
+    pn->setOp(op);
     return JS_TRUE;
 }
 
@@ -6563,8 +6559,8 @@ Parser::unaryExpr()
         pn = UnaryNode::create(tc);
         if (!pn)
             return NULL;
-        pn->pn_type = TOK_UNARYOP;      /* PLUS and MINUS are binary */
-        pn->pn_op = tokenStream.currentToken().t_op;
+        pn->setKind(TOK_UNARYOP);      /* PLUS and MINUS are binary */
+        pn->setOp(tokenStream.currentToken().t_op);
         pn2 = unaryExpr();
         if (!pn2)
             return NULL;
@@ -6602,7 +6598,7 @@ Parser::unaryExpr()
          */
         if (foldConstants && !js_FoldConstants(context, pn2, tc))
             return NULL;
-        switch (pn2->pn_type) {
+        switch (pn2->getKind()) {
           case TOK_LP:
             if (!(pn2->pn_xflags & PNX_SETCALL)) {
                 /*
@@ -6619,7 +6615,7 @@ Parser::unaryExpr()
                                        JSMSG_DEPRECATED_DELETE_OPERAND)) {
                 return NULL;
             }
-            pn2->pn_op = JSOP_DELNAME;
+            pn2->setOp(JSOP_DELNAME);
             if (pn2->pn_atom == context->runtime->atomState.argumentsAtom) {
                 tc->flags |= TCF_FUN_HEAVYWEIGHT;
                 tc->countArgumentsUse(pn2);
@@ -6826,7 +6822,7 @@ BumpStaticLevel(JSParseNode *pn, JSTreeContext *tc)
 static void
 AdjustBlockId(JSParseNode *pn, uintN adjust, JSTreeContext *tc)
 {
-    JS_ASSERT(pn->pn_arity == PN_LIST || pn->pn_arity == PN_FUNC || pn->pn_arity == PN_NAME);
+    JS_ASSERT(pn->isArity(PN_LIST) || pn->isArity(PN_FUNC) || pn->isArity(PN_NAME));
     pn->pn_blockid += adjust;
     if (pn->pn_blockid >= tc->blockidGen)
         tc->blockidGen = pn->pn_blockid + 1;
@@ -6838,7 +6834,7 @@ CompExprTransplanter::transplant(JSParseNode *pn)
     if (!pn)
         return true;
 
-    switch (pn->pn_arity) {
+    switch (pn->getArity()) {
       case PN_LIST:
         for (JSParseNode *pn2 = pn->pn_head; pn2; pn2 = pn2->pn_next) {
             if (!transplant(pn2))
@@ -6905,18 +6901,18 @@ CompExprTransplanter::transplant(JSParseNode *pn)
       case PN_NAME:
         if (!transplant(pn->maybeExpr()))
             return false;
-        if (pn->pn_arity == PN_FUNC)
+        if (pn->isArity(PN_FUNC))
             --funcLevel;
 
-        if (pn->pn_defn) {
+        if (pn->isDefn()) {
             if (genexp && !BumpStaticLevel(pn, tc))
                 return false;
-        } else if (pn->pn_used) {
-            JS_ASSERT(pn->pn_op != JSOP_NOP);
+        } else if (pn->isUsed()) {
+            JS_ASSERT(!pn->isOp(JSOP_NOP));
             JS_ASSERT(pn->pn_cookie.isFree());
 
             JSDefinition *dn = pn->pn_lexdef;
-            JS_ASSERT(dn->pn_defn);
+            JS_ASSERT(dn->isDefn());
 
             /*
              * Adjust the definition's block id only if it is a placeholder not
@@ -6938,7 +6934,7 @@ CompExprTransplanter::transplant(JSParseNode *pn)
             JSStmtInfo *stmt = js_LexicalLookup(tc, atom, NULL);
             JS_ASSERT(!stmt || stmt != tc->topStmt);
 #endif
-            if (genexp && PN_OP(dn) != JSOP_CALLEE) {
+            if (genexp && !dn->isOp(JSOP_CALLEE)) {
                 JS_ASSERT(!tc->decls.lookupFirst(atom));
 
                 if (dn->pn_pos < root->pn_pos) {
@@ -7076,7 +7072,7 @@ Parser::comprehensionTail(JSParseNode *kid, uintN blockid, bool isGenexp,
         if (!pn2)
             return NULL;
 
-        pn2->pn_op = JSOP_ITER;
+        pn2->setOp(JSOP_ITER);
         pn2->pn_iflags = JSITER_ENUMERATE;
         if (tokenStream.matchToken(TOK_NAME)) {
             if (tokenStream.currentToken().t_atom == context->runtime->atomState.eachAtom)
@@ -7149,12 +7145,12 @@ Parser::comprehensionTail(JSParseNode *kid, uintN blockid, bool isGenexp,
 
             if (versionNumber() == JSVERSION_1_7) {
                 /* Destructuring requires [key, value] enumeration in JS1.7. */
-                if (pn3->pn_type != TOK_RB || pn3->pn_count != 2) {
+                if (!pn3->isKind(TOK_RB) || pn3->pn_count != 2) {
                     reportErrorNumber(NULL, JSREPORT_ERROR, JSMSG_BAD_FOR_LEFTSIDE);
                     return NULL;
                 }
 
-                JS_ASSERT(pn2->pn_op == JSOP_ITER);
+                JS_ASSERT(pn2->isOp(JSOP_ITER));
                 JS_ASSERT(pn2->pn_iflags & JSITER_ENUMERATE);
                 if (!(pn2->pn_iflags & JSITER_FOREACH))
                     pn2->pn_iflags |= JSITER_FOREACH | JSITER_KEYVALUE;
@@ -7178,8 +7174,8 @@ Parser::comprehensionTail(JSParseNode *kid, uintN blockid, bool isGenexp,
         JSParseNode *vars = ListNode::create(tc);
         if (!vars)
             return NULL;
-        vars->pn_op = JSOP_NOP;
-        vars->pn_type = TOK_VAR;
+        vars->setOp(JSOP_NOP);
+        vars->setKind(TOK_VAR);
         vars->pn_pos = pn3->pn_pos;
         vars->makeEmpty();
         vars->append(pn3);
@@ -7211,8 +7207,8 @@ Parser::comprehensionTail(JSParseNode *kid, uintN blockid, bool isGenexp,
     pn2 = UnaryNode::create(tc);
     if (!pn2)
         return NULL;
-    pn2->pn_type = type;
-    pn2->pn_op = op;
+    pn2->setKind(type);
+    pn2->setOp(op);
     pn2->pn_kid = kid;
     *pnp = pn2;
 
@@ -7244,9 +7240,9 @@ Parser::generatorExpr(JSParseNode *kid)
     JSParseNode *pn = UnaryNode::create(tc);
     if (!pn)
         return NULL;
-    pn->pn_type = TOK_YIELD;
-    pn->pn_op = JSOP_YIELD;
-    pn->pn_parens = true;
+    pn->setKind(TOK_YIELD);
+    pn->setOp(JSOP_YIELD);
+    pn->setInParens(true);
     pn->pn_pos = kid->pn_pos;
     pn->pn_kid = kid;
     pn->pn_hidden = true;
@@ -7255,8 +7251,8 @@ Parser::generatorExpr(JSParseNode *kid)
     JSParseNode *genfn = FunctionNode::create(tc);
     if (!genfn)
         return NULL;
-    genfn->pn_type = TOK_FUNCTION;
-    genfn->pn_op = JSOP_LAMBDA;
+    genfn->setKind(TOK_FUNCTION);
+    genfn->setOp(JSOP_LAMBDA);
     JS_ASSERT(!genfn->pn_body);
     genfn->pn_dflags = PND_FUNARG;
 
@@ -7315,8 +7311,8 @@ Parser::generatorExpr(JSParseNode *kid)
     JSParseNode *result = ListNode::create(tc);
     if (!result)
         return NULL;
-    result->pn_type = TOK_LP;
-    result->pn_op = JSOP_CALL;
+    result->setKind(TOK_LP);
+    result->setOp(JSOP_CALL);
     result->pn_pos.begin = genfn->pn_pos.begin;
     result->initList(genfn);
     return result;
@@ -7344,8 +7340,8 @@ Parser::argumentList(JSParseNode *listNode)
             guard.endBody();
 
 #if JS_HAS_GENERATORS
-        if (argNode->pn_type == TOK_YIELD &&
-            !argNode->pn_parens &&
+        if (argNode->isKind(TOK_YIELD) &&
+            !argNode->isInParens() &&
             tokenStream.peekToken() == TOK_COMMA) {
             reportErrorNumber(argNode, JSREPORT_ERROR, JSMSG_BAD_GENERATOR_SYNTAX, js_yield_str);
             return JS_FALSE;
@@ -7385,8 +7381,8 @@ Parser::argumentList(JSParseNode *listNode)
 static JSParseNode *
 CheckForImmediatelyAppliedLambda(JSParseNode *pn)
 {
-    if (pn->pn_type == TOK_FUNCTION) {
-        JS_ASSERT(pn->pn_arity == PN_FUNC);
+    if (pn->isKind(TOK_FUNCTION)) {
+        JS_ASSERT(pn->isArity(PN_FUNC));
 
         JSFunctionBox *funbox = pn->pn_funbox;
         JS_ASSERT((funbox->function())->flags & JSFUN_LAMBDA);
@@ -7413,7 +7409,7 @@ Parser::memberExpr(JSBool allowCallSyntax)
         if (!pn2)
             return NULL;
         pn2 = CheckForImmediatelyAppliedLambda(pn2);
-        pn->pn_op = JSOP_NEW;
+        pn->setOp(JSOP_NEW);
         pn->initList(pn2);
         pn->pn_pos.begin = pn2->pn_pos.begin;
 
@@ -7430,17 +7426,15 @@ Parser::memberExpr(JSBool allowCallSyntax)
         if (!pn)
             return NULL;
 
-        if (pn->pn_type == TOK_ANYNAME ||
-            pn->pn_type == TOK_AT ||
-            pn->pn_type == TOK_DBLCOLON) {
+        if (pn->isKind(TOK_ANYNAME) || pn->isKind(TOK_AT) || pn->isKind(TOK_DBLCOLON)) {
             pn2 = NewOrRecycledNode(tc);
             if (!pn2)
                 return NULL;
-            pn2->pn_type = TOK_UNARYOP;
+            pn2->setKind(TOK_UNARYOP);
             pn2->pn_pos = pn->pn_pos;
-            pn2->pn_op = JSOP_XMLNAME;
-            pn2->pn_arity = PN_UNARY;
-            pn2->pn_parens = false;
+            pn2->setOp(JSOP_XMLNAME);
+            pn2->setArity(PN_UNARY);
+            pn2->setInParens(false);
             pn2->pn_kid = pn;
             pn = pn2;
         }
@@ -7472,32 +7466,32 @@ Parser::memberExpr(JSBool allowCallSyntax)
             }
 
             /* Check both tt and pn_type, to distinguish |x.(y)| and |x.y::z| from |x.y|. */
-            if (tt == TOK_NAME && pn3->pn_type == TOK_NAME) {
-                pn2->pn_op = JSOP_GETPROP;
+            if (tt == TOK_NAME && pn3->isKind(TOK_NAME)) {
+                pn2->setOp(JSOP_GETPROP);
                 pn2->pn_expr = pn;
                 pn2->pn_atom = pn3->pn_atom;
                 RecycleTree(pn3, tc);
             } else {
                 if (tt == TOK_LP) {
-                    pn2->pn_type = TOK_FILTER;
-                    pn2->pn_op = JSOP_FILTER;
+                    pn2->setKind(TOK_FILTER);
+                    pn2->setOp(JSOP_FILTER);
 
                     /* A filtering predicate is like a with statement. */
                     tc->flags |= TCF_FUN_HEAVYWEIGHT;
-                } else if (TokenKindIsXML(PN_TYPE(pn3))) {
-                    pn2->pn_type = TOK_LB;
-                    pn2->pn_op = JSOP_GETELEM;
+                } else if (TokenKindIsXML(pn3->getKind())) {
+                    pn2->setKind(TOK_LB);
+                    pn2->setOp(JSOP_GETELEM);
                 } else {
                     reportErrorNumber(NULL, JSREPORT_ERROR, JSMSG_NAME_AFTER_DOT);
                     return NULL;
                 }
-                pn2->pn_arity = PN_BINARY;
+                pn2->setArity(PN_BINARY);
                 pn2->pn_left = pn;
                 pn2->pn_right = pn3;
             }
 #else
             MUST_MATCH_TOKEN_WITH_FLAGS(TOK_NAME, JSMSG_NAME_AFTER_DOT, TSF_KEYWORD_IS_NAME);
-            pn2->pn_op = JSOP_GETPROP;
+            pn2->setOp(JSOP_GETPROP);
             pn2->pn_expr = pn;
             pn2->pn_atom = tokenStream.currentToken().t_atom;
 #endif
@@ -7512,16 +7506,16 @@ Parser::memberExpr(JSBool allowCallSyntax)
             pn3 = primaryExpr(tt, JS_TRUE);
             if (!pn3)
                 return NULL;
-            tt = PN_TYPE(pn3);
-            if (tt == TOK_NAME && !pn3->pn_parens) {
-                pn3->pn_type = TOK_STRING;
-                pn3->pn_arity = PN_NULLARY;
-                pn3->pn_op = JSOP_QNAMEPART;
+            tt = pn3->getKind();
+            if (tt == TOK_NAME && !pn3->isInParens()) {
+                pn3->setKind(TOK_STRING);
+                pn3->setArity(PN_NULLARY);
+                pn3->setOp(JSOP_QNAMEPART);
             } else if (!TokenKindIsXML(tt)) {
                 reportErrorNumber(NULL, JSREPORT_ERROR, JSMSG_NAME_AFTER_DOT);
                 return NULL;
             }
-            pn2->pn_op = JSOP_DESCENDANTS;
+            pn2->setOp(JSOP_DESCENDANTS);
             pn2->pn_left = pn;
             pn2->pn_right = pn3;
             pn2->pn_pos.begin = pn->pn_pos.begin;
@@ -7547,22 +7541,22 @@ Parser::memberExpr(JSBool allowCallSyntax)
              * instead of a string.
              */
             do {
-                if (pn3->pn_type == TOK_STRING) {
+                if (pn3->isKind(TOK_STRING)) {
                     jsuint index;
 
                     if (!js_IdIsIndex(ATOM_TO_JSID(pn3->pn_atom), &index)) {
-                        pn2->pn_type = TOK_DOT;
-                        pn2->pn_op = JSOP_GETPROP;
-                        pn2->pn_arity = PN_NAME;
+                        pn2->setKind(TOK_DOT);
+                        pn2->setOp(JSOP_GETPROP);
+                        pn2->setArity(PN_NAME);
                         pn2->pn_expr = pn;
                         pn2->pn_atom = pn3->pn_atom;
                         break;
                     }
-                    pn3->pn_type = TOK_NUMBER;
-                    pn3->pn_op = JSOP_DOUBLE;
+                    pn3->setKind(TOK_NUMBER);
+                    pn3->setOp(JSOP_DOUBLE);
                     pn3->pn_dval = index;
                 }
-                pn2->pn_op = JSOP_GETELEM;
+                pn2->setOp(JSOP_GETELEM);
                 pn2->pn_left = pn;
                 pn2->pn_right = pn3;
             } while (0);
@@ -7570,13 +7564,13 @@ Parser::memberExpr(JSBool allowCallSyntax)
             pn2 = ListNode::create(tc);
             if (!pn2)
                 return NULL;
-            pn2->pn_op = JSOP_CALL;
+            pn2->setOp(JSOP_CALL);
 
             pn = CheckForImmediatelyAppliedLambda(pn);
-            if (pn->pn_op == JSOP_NAME) {
+            if (pn->isOp(JSOP_NAME)) {
                 if (pn->pn_atom == context->runtime->atomState.evalAtom) {
                     /* Select JSOP_EVAL and flag tc as heavyweight. */
-                    pn2->pn_op = JSOP_EVAL;
+                    pn2->setOp(JSOP_EVAL);
                     tc->noteCallsEval();
                     tc->flags |= TCF_FUN_HEAVYWEIGHT;
                     /*
@@ -7586,12 +7580,12 @@ Parser::memberExpr(JSBool allowCallSyntax)
                     if (!tc->inStrictMode())
                         tc->noteHasExtensibleScope();
                 }
-            } else if (pn->pn_op == JSOP_GETPROP) {
+            } else if (pn->isOp(JSOP_GETPROP)) {
                 /* Select JSOP_FUNAPPLY given foo.apply(...). */
                 if (pn->pn_atom == context->runtime->atomState.applyAtom)
-                    pn2->pn_op = JSOP_FUNAPPLY;
+                    pn2->setOp(JSOP_FUNAPPLY);
                 else if (pn->pn_atom == context->runtime->atomState.callAtom)
-                    pn2->pn_op = JSOP_FUNCALL;
+                    pn2->setOp(JSOP_FUNCALL);
             }
 
             pn2->initList(pn);
@@ -7709,14 +7703,14 @@ Parser::propertySelector()
     pn = NullaryNode::create(tc);
     if (!pn)
         return NULL;
-    if (pn->pn_type == TOK_STAR) {
-        pn->pn_type = TOK_ANYNAME;
-        pn->pn_op = JSOP_ANYNAME;
+    if (pn->isKind(TOK_STAR)) {
+        pn->setKind(TOK_ANYNAME);
+        pn->setOp(JSOP_ANYNAME);
         pn->pn_atom = context->runtime->atomState.starAtom;
     } else {
-        JS_ASSERT(pn->pn_type == TOK_NAME);
-        pn->pn_op = JSOP_QNAMEPART;
-        pn->pn_arity = PN_NAME;
+        JS_ASSERT(pn->isKind(TOK_NAME));
+        pn->setOp(JSOP_QNAMEPART);
+        pn->setArity(PN_NAME);
         pn->pn_atom = tokenStream.currentToken().t_atom;
         pn->pn_cookie.makeFree();
     }
@@ -7735,13 +7729,13 @@ Parser::qualifiedSuffix(JSParseNode *pn)
         return NULL;
 
     /* Left operand of :: must be evaluated if it is an identifier. */
-    if (pn->pn_op == JSOP_QNAMEPART)
-        pn->pn_op = JSOP_NAME;
+    if (pn->isOp(JSOP_QNAMEPART))
+        pn->setOp(JSOP_NAME);
 
     tt = tokenStream.getToken(TSF_KEYWORD_IS_NAME);
     if (tt == TOK_STAR || tt == TOK_NAME) {
         /* Inline and specialize propertySelector for JSOP_QNAMECONST. */
-        pn2->pn_op = JSOP_QNAMECONST;
+        pn2->setOp(JSOP_QNAMECONST);
         pn2->pn_pos.begin = pn->pn_pos.begin;
         pn2->pn_atom = (tt == TOK_STAR)
                        ? context->runtime->atomState.starAtom
@@ -7759,8 +7753,8 @@ Parser::qualifiedSuffix(JSParseNode *pn)
     if (!pn3)
         return NULL;
 
-    pn2->pn_op = JSOP_QNAME;
-    pn2->pn_arity = PN_BINARY;
+    pn2->setOp(JSOP_QNAME);
+    pn2->setArity(PN_BINARY);
     pn2->pn_pos.begin = pn->pn_pos.begin;
     pn2->pn_pos.end = pn3->pn_pos.end;
     pn2->pn_left = pn;
@@ -7794,7 +7788,7 @@ Parser::attributeIdentifier()
     pn = UnaryNode::create(tc);
     if (!pn)
         return NULL;
-    pn->pn_op = JSOP_TOATTRNAME;
+    pn->setOp(JSOP_TOATTRNAME);
     tt = tokenStream.getToken(TSF_KEYWORD_IS_NAME);
     if (tt == TOK_STAR || tt == TOK_NAME) {
         pn2 = qualifiedIdentifier();
@@ -7838,7 +7832,7 @@ Parser::xmlExpr(JSBool inTag)
     MUST_MATCH_TOKEN(TOK_RC, JSMSG_CURLY_IN_XML_EXPR);
     tokenStream.setXMLTagMode(oldflag);
     pn->pn_kid = pn2;
-    pn->pn_op = inTag ? JSOP_XMLTAGEXPR : JSOP_XMLELTEXPR;
+    pn->setOp(inTag ? JSOP_XMLTAGEXPR : JSOP_XMLELTEXPR);
     return pn;
 }
 
@@ -7855,7 +7849,7 @@ Parser::xmlAtomNode()
     if (!pn)
         return NULL;
     const Token &tok = tokenStream.currentToken();
-    pn->pn_op = tok.t_op;
+    pn->setOp(tok.t_op);
     pn->pn_atom = tok.t_atom;
     if (tok.type == TOK_XMLPI)
         pn->pn_atom2 = tok.t_atom2;
@@ -7901,7 +7895,7 @@ Parser::xmlNameExpr()
                 list = ListNode::create(tc);
                 if (!list)
                     return NULL;
-                list->pn_type = TOK_XMLNAME;
+                list->setKind(TOK_XMLNAME);
                 list->pn_pos.begin = pn->pn_pos.begin;
                 list->initList(pn);
                 list->pn_xflags = PNX_CANTFOLD;
@@ -7920,9 +7914,9 @@ Parser::xmlNameExpr()
  * Macro to test whether an XMLNameExpr or XMLTagContent node can be folded
  * at compile time into a JSXML tree.
  */
-#define XML_FOLDABLE(pn)        ((pn)->pn_arity == PN_LIST                    \
-                                 ? ((pn)->pn_xflags & PNX_CANTFOLD) == 0      \
-                                 : (pn)->pn_type != TOK_LC)
+#define XML_FOLDABLE(pn)        ((pn)->isArity(PN_LIST)                     \
+                                 ? ((pn)->pn_xflags & PNX_CANTFOLD) == 0    \
+                                 : !(pn)->isKind(TOK_LC))
 
 /*
  * Parse the productions:
@@ -7950,7 +7944,7 @@ Parser::xmlTagContent(TokenKind tagtype, JSAtom **namep)
     pn = xmlNameExpr();
     if (!pn)
         return NULL;
-    *namep = (pn->pn_arity == PN_NULLARY) ? pn->pn_atom : NULL;
+    *namep = (pn->isArity(PN_NULLARY)) ? pn->pn_atom : NULL;
     list = NULL;
 
     while (tokenStream.matchToken(TOK_XMLSPACE)) {
@@ -7967,7 +7961,7 @@ Parser::xmlTagContent(TokenKind tagtype, JSAtom **namep)
             list = ListNode::create(tc);
             if (!list)
                 return NULL;
-            list->pn_type = tagtype;
+            list->setKind(tagtype);
             list->pn_pos.begin = pn->pn_pos.begin;
             list->initList(pn);
             pn = list;
@@ -8097,18 +8091,18 @@ Parser::xmlElementOrList(JSBool allowList)
         tt = tokenStream.getToken();
         if (tt == TOK_XMLPTAGC) {
             /* Point tag (/>): recycle pn if pn2 is a list of tag contents. */
-            if (pn2->pn_type == TOK_XMLSTAGO) {
+            if (pn2->isKind(TOK_XMLSTAGO)) {
                 pn->makeEmpty();
                 RecycleTree(pn, tc);
                 pn = pn2;
             } else {
-                JS_ASSERT(pn2->pn_type == TOK_XMLNAME ||
-                          pn2->pn_type == TOK_LC);
+                JS_ASSERT(pn2->isKind(TOK_XMLNAME) ||
+                          pn2->isKind(TOK_LC));
                 pn->initList(pn2);
                 if (!XML_FOLDABLE(pn2))
                     pn->pn_xflags |= PNX_CANTFOLD;
             }
-            pn->pn_type = TOK_XMLPTAGC;
+            pn->setKind(TOK_XMLPTAGC);
             pn->pn_xflags |= PNX_XMLROOT;
         } else {
             /* We had better have a tag-close (>) at this point. */
@@ -8119,7 +8113,7 @@ Parser::xmlElementOrList(JSBool allowList)
             pn2->pn_pos.end = tokenStream.currentToken().pos.end;
 
             /* Make sure pn2 is a TOK_XMLSTAGO list containing tag contents. */
-            if (pn2->pn_type != TOK_XMLSTAGO) {
+            if (!pn2->isKind(TOK_XMLSTAGO)) {
                 pn->initList(pn2);
                 if (!XML_FOLDABLE(pn2))
                     pn->pn_xflags |= PNX_CANTFOLD;
@@ -8130,7 +8124,7 @@ Parser::xmlElementOrList(JSBool allowList)
             }
 
             /* Now make pn a nominal-root TOK_XMLELEM list containing pn2. */
-            pn->pn_type = TOK_XMLELEM;
+            pn->setKind(TOK_XMLELEM);
             pn->pn_pos.begin = pn2->pn_pos.begin;
             pn->initList(pn2);
             if (!XML_FOLDABLE(pn2))
@@ -8152,7 +8146,7 @@ Parser::xmlElementOrList(JSBool allowList)
             pn2 = xmlTagContent(TOK_XMLETAGO, &endAtom);
             if (!pn2)
                 return NULL;
-            if (pn2->pn_type == TOK_XMLETAGO) {
+            if (pn2->isKind(TOK_XMLETAGO)) {
                 /* Oops, end tag has attributes! */
                 reportErrorNumber(NULL, JSREPORT_ERROR, JSMSG_BAD_XML_TAG_SYNTAX);
                 return NULL;
@@ -8165,11 +8159,11 @@ Parser::xmlElementOrList(JSBool allowList)
             }
 
             /* Make a TOK_XMLETAGO list with pn2 as its single child. */
-            JS_ASSERT(pn2->pn_type == TOK_XMLNAME || pn2->pn_type == TOK_LC);
+            JS_ASSERT(pn2->isKind(TOK_XMLNAME) || pn2->isKind(TOK_LC));
             list = ListNode::create(tc);
             if (!list)
                 return NULL;
-            list->pn_type = TOK_XMLETAGO;
+            list->setKind(TOK_XMLETAGO);
             list->initList(pn2);
             pn->append(list);
             if (!XML_FOLDABLE(pn2)) {
@@ -8182,11 +8176,11 @@ Parser::xmlElementOrList(JSBool allowList)
         }
 
         /* Set pn_op now that pn has been updated to its final value. */
-        pn->pn_op = JSOP_TOXML;
+        pn->setOp(JSOP_TOXML);
     } else if (allowList && tt == TOK_XMLTAGC) {
         /* XMLList Initialiser. */
-        pn->pn_type = TOK_XMLLIST;
-        pn->pn_op = JSOP_TOXMLLIST;
+        pn->setKind(TOK_XMLLIST);
+        pn->setOp(JSOP_TOXMLLIST);
         pn->makeEmpty();
         pn->pn_xflags |= PNX_XMLROOT;
         if (!xmlElementContent(pn))
@@ -8302,7 +8296,7 @@ JSParseNode::isConstant()
         }
       case TOK_RB:
       case TOK_RC:
-        return (pn_op == JSOP_NEWINIT) && !(pn_xflags & PNX_NONCONST);
+        return isOp(JSOP_NEWINIT) && !(pn_xflags & PNX_NONCONST);
       default:
         return false;
     }
@@ -8323,7 +8317,7 @@ Parser::primaryExpr(TokenKind tt, JSBool afterDot)
             pn2 = NullaryNode::create(tc);
             if (!pn2)
                 return NULL;
-            pn2->pn_type = TOK_FUNCTION;
+            pn2->setKind(TOK_FUNCTION);
             pn = qualifiedSuffix(pn2);
             if (!pn)
                 return NULL;
@@ -8343,8 +8337,8 @@ Parser::primaryExpr(TokenKind tt, JSBool afterDot)
         pn = ListNode::create(tc);
         if (!pn)
             return NULL;
-        pn->pn_type = TOK_RB;
-        pn->pn_op = JSOP_NEWINIT;
+        pn->setKind(TOK_RB);
+        pn->setOp(JSOP_NEWINIT);
         pn->makeEmpty();
 
 #if JS_HAS_GENERATORS
@@ -8432,7 +8426,7 @@ Parser::primaryExpr(TokenKind tt, JSBool afterDot)
                 JSParseNode *pnexp, *pntop;
 
                 /* Relabel pn as an array comprehension node. */
-                pn->pn_type = TOK_ARRAYCOMP;
+                pn->setKind(TOK_ARRAYCOMP);
 
                 /*
                  * Remove the comprehension expression from pn's linked list
@@ -8478,8 +8472,8 @@ Parser::primaryExpr(TokenKind tt, JSBool afterDot)
         pn = ListNode::create(tc);
         if (!pn)
             return NULL;
-        pn->pn_type = TOK_RC;
-        pn->pn_op = JSOP_NEWINIT;
+        pn->setKind(TOK_RC);
+        pn->setOp(JSOP_NEWINIT);
         pn->makeEmpty();
 
         for (;;) {
@@ -8574,8 +8568,8 @@ Parser::primaryExpr(TokenKind tt, JSBool afterDot)
                 tokenStream.ungetToken();
                 pn->pn_xflags |= PNX_DESTRUCT | PNX_NONCONST;
                 pnval = pn3;
-                if (pnval->pn_type == TOK_NAME) {
-                    pnval->pn_arity = PN_NAME;
+                if (pnval->isKind(TOK_NAME)) {
+                    pnval->setArity(PN_NAME);
                     ((NameNode *)pnval)->initCommon(tc);
                 }
 #endif
@@ -8665,11 +8659,11 @@ Parser::primaryExpr(TokenKind tt, JSBool afterDot)
         pn->pn_kid = primaryExpr(tt, JS_FALSE);
         if (!pn->pn_kid)
             return NULL;
-        if (PN_TYPE(pn->pn_kid) == TOK_USESHARP ||
-            PN_TYPE(pn->pn_kid) == TOK_DEFSHARP ||
-            PN_TYPE(pn->pn_kid) == TOK_STRING ||
-            PN_TYPE(pn->pn_kid) == TOK_NUMBER ||
-            PN_TYPE(pn->pn_kid) == TOK_PRIMARY) {
+        if (pn->pn_kid->isKind(TOK_USESHARP) ||
+            pn->pn_kid->isKind(TOK_DEFSHARP) ||
+            pn->pn_kid->isKind(TOK_STRING) ||
+            pn->pn_kid->isKind(TOK_NUMBER) ||
+            pn->pn_kid->isKind(TOK_PRIMARY)) {
             reportErrorNumber(pn->pn_kid, JSREPORT_ERROR, JSMSG_BAD_SHARP_VAR_DEF);
             return NULL;
         }
@@ -8695,7 +8689,7 @@ Parser::primaryExpr(TokenKind tt, JSBool afterDot)
         pn = parenExpr(&genexp);
         if (!pn)
             return NULL;
-        pn->pn_parens = true;
+        pn->setInParens(true);
         if (!genexp)
             MUST_MATCH_TOKEN(TOK_RP, JSMSG_PAREN_IN_PAREN);
         break;
@@ -8740,7 +8734,7 @@ Parser::primaryExpr(TokenKind tt, JSBool afterDot)
             pn->pn_atom2 = tokenStream.currentToken().t_atom2;
         else
 #endif
-            pn->pn_op = tokenStream.currentToken().t_op;
+            pn->setOp(tokenStream.currentToken().t_op);
         break;
 
       case TOK_NAME:
@@ -8748,7 +8742,7 @@ Parser::primaryExpr(TokenKind tt, JSBool afterDot)
         if (!pn)
             return NULL;
         JS_ASSERT(tokenStream.currentToken().t_op == JSOP_NAME);
-        pn->pn_op = JSOP_NAME;
+        pn->setOp(JSOP_NAME);
 
         if ((tc->flags & (TCF_IN_FUNCTION | TCF_FUN_PARAM_ARGUMENTS)) == TCF_IN_FUNCTION &&
             pn->pn_atom == context->runtime->atomState.argumentsAtom) {
@@ -8767,7 +8761,7 @@ Parser::primaryExpr(TokenKind tt, JSBool afterDot)
              */
             if (!afterDot && !(tc->flags & TCF_DECL_DESTRUCTURING)
                 && !tc->inStatement(STMT_WITH)) {
-                pn->pn_op = JSOP_ARGUMENTS;
+                pn->setOp(JSOP_ARGUMENTS);
                 pn->pn_dflags |= PND_BOUND;
             }
         } else if ((!afterDot
@@ -8839,7 +8833,7 @@ Parser::primaryExpr(TokenKind tt, JSBool afterDot)
                 }
             }
 
-            JS_ASSERT(dn->pn_defn);
+            JS_ASSERT(dn->isDefn());
             LinkUseToDef(pn, dn, tc);
 
             /* Here we handle the backward function reference case. */
@@ -8866,8 +8860,8 @@ Parser::primaryExpr(TokenKind tt, JSBool afterDot)
                         return NULL;
                     }
 
-                    pn->pn_arity = PN_NULLARY;
-                    pn->pn_type = TOK_FUNCTION;
+                    pn->setArity(PN_NULLARY);
+                    pn->setKind(TOK_FUNCTION);
                 }
             }
             pn = qualifiedSuffix(pn);
@@ -8909,7 +8903,7 @@ Parser::primaryExpr(TokenKind tt, JSBool afterDot)
         if (!pn->pn_objbox)
             return NULL;
 
-        pn->pn_op = JSOP_REGEXP;
+        pn->setOp(JSOP_REGEXP);
         break;
       }
 
@@ -8917,7 +8911,7 @@ Parser::primaryExpr(TokenKind tt, JSBool afterDot)
         pn = NullaryNode::create(tc);
         if (!pn)
             return NULL;
-        pn->pn_op = JSOP_DOUBLE;
+        pn->setOp(JSOP_DOUBLE);
         pn->pn_dval = tokenStream.currentToken().t_dval;
         break;
 
@@ -8925,7 +8919,7 @@ Parser::primaryExpr(TokenKind tt, JSBool afterDot)
         pn = NullaryNode::create(tc);
         if (!pn)
             return NULL;
-        pn->pn_op = tokenStream.currentToken().t_op;
+        pn->setOp(tokenStream.currentToken().t_op);
         break;
 
       case TOK_ERROR:
@@ -8962,8 +8956,8 @@ Parser::parenExpr(JSBool *genexp)
     if (tokenStream.matchToken(TOK_FOR)) {
         if (!guard.checkValidBody(pn))
             return NULL;
-        JS_ASSERT(pn->pn_type != TOK_YIELD);
-        if (pn->pn_type == TOK_COMMA && !pn->pn_parens) {
+        JS_ASSERT(!pn->isKind(TOK_YIELD));
+        if (pn->isKind(TOK_COMMA) && !pn->isInParens()) {
             reportErrorNumber(pn->last(), JSREPORT_ERROR, JSMSG_BAD_GENERATOR_SYNTAX,
                               js_generator_str);
             return NULL;
@@ -8997,29 +8991,29 @@ Parser::parenExpr(JSBool *genexp)
 static JSBool
 FoldType(JSContext *cx, JSParseNode *pn, TokenKind type)
 {
-    if (PN_TYPE(pn) != type) {
+    if (!pn->isKind(type)) {
         switch (type) {
           case TOK_NUMBER:
-            if (pn->pn_type == TOK_STRING) {
+            if (pn->isKind(TOK_STRING)) {
                 jsdouble d;
                 if (!ToNumber(cx, StringValue(pn->pn_atom), &d))
                     return JS_FALSE;
                 pn->pn_dval = d;
-                pn->pn_type = TOK_NUMBER;
-                pn->pn_op = JSOP_DOUBLE;
+                pn->setKind(TOK_NUMBER);
+                pn->setOp(JSOP_DOUBLE);
             }
             break;
 
           case TOK_STRING:
-            if (pn->pn_type == TOK_NUMBER) {
+            if (pn->isKind(TOK_NUMBER)) {
                 JSString *str = js_NumberToString(cx, pn->pn_dval);
                 if (!str)
                     return JS_FALSE;
                 pn->pn_atom = js_AtomizeString(cx, str);
                 if (!pn->pn_atom)
                     return JS_FALSE;
-                pn->pn_type = TOK_STRING;
-                pn->pn_op = JSOP_STRING;
+                pn->setKind(TOK_STRING);
+                pn->setOp(JSOP_STRING);
             }
             break;
 
@@ -9041,7 +9035,7 @@ FoldBinaryNumeric(JSContext *cx, JSOp op, JSParseNode *pn1, JSParseNode *pn2,
     jsdouble d, d2;
     int32 i, j;
 
-    JS_ASSERT(pn1->pn_type == TOK_NUMBER && pn2->pn_type == TOK_NUMBER);
+    JS_ASSERT(pn1->isKind(TOK_NUMBER) && pn2->isKind(TOK_NUMBER));
     d = pn1->pn_dval;
     d2 = pn2->pn_dval;
     switch (op) {
@@ -9106,9 +9100,9 @@ FoldBinaryNumeric(JSContext *cx, JSOp op, JSParseNode *pn1, JSParseNode *pn2,
         RecycleTree(pn1, tc);
     if (pn2 != pn)
         RecycleTree(pn2, tc);
-    pn->pn_type = TOK_NUMBER;
-    pn->pn_op = JSOP_DOUBLE;
-    pn->pn_arity = PN_NULLARY;
+    pn->setKind(TOK_NUMBER);
+    pn->setOp(JSOP_DOUBLE);
+    pn->setArity(PN_NULLARY);
     pn->pn_dval = d;
     return JS_TRUE;
 }
@@ -9123,8 +9117,8 @@ FoldXMLConstants(JSContext *cx, JSParseNode *pn, JSTreeContext *tc)
     JSString *accum, *str;
     uint32 i, j;
 
-    JS_ASSERT(pn->pn_arity == PN_LIST);
-    tt = PN_TYPE(pn);
+    JS_ASSERT(pn->isArity(PN_LIST));
+    tt = pn->getKind();
     pnp = &pn->pn_head;
     pn1 = *pnp;
     accum = NULL;
@@ -9146,7 +9140,7 @@ FoldXMLConstants(JSContext *cx, JSParseNode *pn, JSTreeContext *tc)
     for (pn2 = pn1, i = j = 0; pn2; pn2 = pn2->pn_next, i++) {
         /* The parser already rejected end-tags with attributes. */
         JS_ASSERT(tt != TOK_XMLETAGO || i == 0);
-        switch (pn2->pn_type) {
+        switch (pn2->getKind()) {
           case TOK_XMLATTR:
             if (!accum)
                 goto cantfold;
@@ -9155,7 +9149,7 @@ FoldXMLConstants(JSContext *cx, JSParseNode *pn, JSTreeContext *tc)
           case TOK_XMLSPACE:
           case TOK_XMLTEXT:
           case TOK_STRING:
-            if (pn2->pn_arity == PN_LIST)
+            if (pn2->isArity(PN_LIST))
                 goto cantfold;
             str = pn2->pn_atom;
             break;
@@ -9196,9 +9190,9 @@ FoldXMLConstants(JSContext *cx, JSParseNode *pn, JSTreeContext *tc)
                     pn1 = RecycleTree(pn1, tc);
                     --pn->pn_count;
                 }
-                pn1->pn_type = TOK_XMLTEXT;
-                pn1->pn_op = JSOP_STRING;
-                pn1->pn_arity = PN_NULLARY;
+                pn1->setKind(TOK_XMLTEXT);
+                pn1->setOp(JSOP_STRING);
+                pn1->setArity(PN_NULLARY);
                 pn1->pn_atom = js_AtomizeString(cx, accum);
                 if (!pn1->pn_atom)
                     return JS_FALSE;
@@ -9249,9 +9243,9 @@ FoldXMLConstants(JSContext *cx, JSParseNode *pn, JSTreeContext *tc)
             pn1 = RecycleTree(pn1, tc);
             --pn->pn_count;
         }
-        pn1->pn_type = TOK_XMLTEXT;
-        pn1->pn_op = JSOP_STRING;
-        pn1->pn_arity = PN_NULLARY;
+        pn1->setKind(TOK_XMLTEXT);
+        pn1->setOp(JSOP_STRING);
+        pn1->setArity(PN_NULLARY);
         pn1->pn_atom = js_AtomizeString(cx, accum);
         if (!pn1->pn_atom)
             return JS_FALSE;
@@ -9270,8 +9264,8 @@ FoldXMLConstants(JSContext *cx, JSParseNode *pn, JSTreeContext *tc)
         if (!(pn->pn_xflags & PNX_XMLROOT)) {
             pn->become(pn1);
         } else if (tt == TOK_XMLPTAGC) {
-            pn->pn_type = TOK_XMLELEM;
-            pn->pn_op = JSOP_TOXML;
+            pn->setKind(TOK_XMLELEM);
+            pn->setOp(JSOP_TOXML);
         }
     }
     return JS_TRUE;
@@ -9282,7 +9276,7 @@ FoldXMLConstants(JSContext *cx, JSParseNode *pn, JSTreeContext *tc)
 static int
 Boolish(JSParseNode *pn)
 {
-    switch (pn->pn_op) {
+    switch (pn->getOp()) {
       case JSOP_DOUBLE:
         return pn->pn_dval != 0 && !JSDOUBLE_IS_NaN(pn->pn_dval);
 
@@ -9300,7 +9294,7 @@ Boolish(JSParseNode *pn)
         if (pn->pn_count != 1)
             break;
         JSParseNode *pn2 = pn->pn_head;
-        if (pn2->pn_type != TOK_FUNCTION)
+        if (!pn2->isKind(TOK_FUNCTION))
             break;
         if (!(pn2->pn_funbox->tcflags & TCF_GENEXP_LAMBDA))
             break;
@@ -9329,7 +9323,7 @@ js_FoldConstants(JSContext *cx, JSParseNode *pn, JSTreeContext *tc, bool inCond)
 
     JS_CHECK_RECURSION(cx, return JS_FALSE);
 
-    switch (pn->pn_arity) {
+    switch (pn->getArity()) {
       case PN_FUNC:
       {
         uint32 oldflags = tc->flags;
@@ -9348,11 +9342,11 @@ js_FoldConstants(JSContext *cx, JSParseNode *pn, JSTreeContext *tc, bool inCond)
       case PN_LIST:
       {
         /* Propagate inCond through logical connectives. */
-        bool cond = inCond && (pn->pn_type == TOK_OR || pn->pn_type == TOK_AND);
+        bool cond = inCond && (pn->isKind(TOK_OR) || pn->isKind(TOK_AND));
 
         /* Don't fold a parenthesized call expression. See bug 537673. */
         pn1 = pn2 = pn->pn_head;
-        if ((pn->pn_type == TOK_LP || pn->pn_type == TOK_NEW) && pn2->pn_parens)
+        if ((pn->isKind(TOK_LP) || pn->isKind(TOK_NEW)) && pn2->isInParens())
             pn2 = pn2->pn_next;
 
         /* Save the list head in pn1 for later use. */
@@ -9368,12 +9362,12 @@ js_FoldConstants(JSContext *cx, JSParseNode *pn, JSTreeContext *tc, bool inCond)
         pn1 = pn->pn_kid1;
         pn2 = pn->pn_kid2;
         pn3 = pn->pn_kid3;
-        if (pn1 && !js_FoldConstants(cx, pn1, tc, pn->pn_type == TOK_IF))
+        if (pn1 && !js_FoldConstants(cx, pn1, tc, pn->isKind(TOK_IF)))
             return JS_FALSE;
         if (pn2) {
-            if (!js_FoldConstants(cx, pn2, tc, pn->pn_type == TOK_FORHEAD))
+            if (!js_FoldConstants(cx, pn2, tc, pn->isKind(TOK_FORHEAD)))
                 return JS_FALSE;
-            if (pn->pn_type == TOK_FORHEAD && pn2->pn_op == JSOP_TRUE) {
+            if (pn->isKind(TOK_FORHEAD) && pn2->isOp(JSOP_TRUE)) {
                 RecycleTree(pn2, tc);
                 pn->pn_kid2 = NULL;
             }
@@ -9387,7 +9381,7 @@ js_FoldConstants(JSContext *cx, JSParseNode *pn, JSTreeContext *tc, bool inCond)
         pn2 = pn->pn_right;
 
         /* Propagate inCond through logical connectives. */
-        if (pn->pn_type == TOK_OR || pn->pn_type == TOK_AND) {
+        if (pn->isKind(TOK_OR) || pn->isKind(TOK_AND)) {
             if (!js_FoldConstants(cx, pn1, tc, inCond))
                 return JS_FALSE;
             if (!js_FoldConstants(cx, pn2, tc, inCond))
@@ -9396,9 +9390,9 @@ js_FoldConstants(JSContext *cx, JSParseNode *pn, JSTreeContext *tc, bool inCond)
         }
 
         /* First kid may be null (for default case in switch). */
-        if (pn1 && !js_FoldConstants(cx, pn1, tc, pn->pn_type == TOK_WHILE))
+        if (pn1 && !js_FoldConstants(cx, pn1, tc, pn->isKind(TOK_WHILE)))
             return JS_FALSE;
-        if (!js_FoldConstants(cx, pn2, tc, pn->pn_type == TOK_DO))
+        if (!js_FoldConstants(cx, pn2, tc, pn->isKind(TOK_DO)))
             return JS_FALSE;
         break;
 
@@ -9414,10 +9408,10 @@ js_FoldConstants(JSContext *cx, JSParseNode *pn, JSTreeContext *tc, bool inCond)
          * null. This assumption does not hold true for other unary
          * expressions.
          */
-        if (pn->pn_op == JSOP_TYPEOF && pn1->pn_type != TOK_NAME)
-            pn->pn_op = JSOP_TYPEOFEXPR;
+        if (pn->isOp(JSOP_TYPEOF) && !pn1->isKind(TOK_NAME))
+            pn->setOp(JSOP_TYPEOFEXPR);
 
-        if (pn1 && !js_FoldConstants(cx, pn1, tc, pn->pn_op == JSOP_NOT))
+        if (pn1 && !js_FoldConstants(cx, pn1, tc, pn->isOp(JSOP_NOT)))
             return JS_FALSE;
         break;
 
@@ -9428,9 +9422,9 @@ js_FoldConstants(JSContext *cx, JSParseNode *pn, JSTreeContext *tc, bool inCond)
          * any) in the primary expression operand to the left of the first
          * dot in the chain.
          */
-        if (!pn->pn_used) {
+        if (!pn->isUsed()) {
             pn1 = pn->pn_expr;
-            while (pn1 && pn1->pn_arity == PN_NAME && !pn1->pn_used)
+            while (pn1 && pn1->isArity(PN_NAME) && !pn1->isUsed())
                 pn1 = pn1->pn_expr;
             if (pn1 && !js_FoldConstants(cx, pn1, tc))
                 return JS_FALSE;
@@ -9447,7 +9441,7 @@ js_FoldConstants(JSContext *cx, JSParseNode *pn, JSTreeContext *tc, bool inCond)
         break;
     }
 
-    switch (pn->pn_type) {
+    switch (pn->getKind()) {
       case TOK_IF:
         if (ContainsStmt(pn2, TOK_VAR) || ContainsStmt(pn3, TOK_VAR))
             break;
@@ -9455,7 +9449,7 @@ js_FoldConstants(JSContext *cx, JSParseNode *pn, JSTreeContext *tc, bool inCond)
 
       case TOK_HOOK:
         /* Reduce 'if (C) T; else E' into T for true C, E for false. */
-        switch (pn1->pn_type) {
+        switch (pn1->getKind()) {
           case TOK_NUMBER:
             if (pn1->pn_dval == 0 || JSDOUBLE_IS_NaN(pn1->pn_dval))
                 pn2 = pn3;
@@ -9465,9 +9459,9 @@ js_FoldConstants(JSContext *cx, JSParseNode *pn, JSTreeContext *tc, bool inCond)
                 pn2 = pn3;
             break;
           case TOK_PRIMARY:
-            if (pn1->pn_op == JSOP_TRUE)
+            if (pn1->isOp(JSOP_TRUE))
                 break;
-            if (pn1->pn_op == JSOP_FALSE || pn1->pn_op == JSOP_NULL) {
+            if (pn1->isOp(JSOP_FALSE) || pn1->isOp(JSOP_NULL)) {
                 pn2 = pn3;
                 break;
             }
@@ -9483,9 +9477,9 @@ js_FoldConstants(JSContext *cx, JSParseNode *pn, JSTreeContext *tc, bool inCond)
             break;
 #endif
 
-        if (pn2 && !pn2->pn_defn)
+        if (pn2 && !pn2->isDefn())
             pn->become(pn2);
-        if (!pn2 || (pn->pn_type == TOK_SEMI && !pn->pn_kid)) {
+        if (!pn2 || (pn->isKind(TOK_SEMI) && !pn->pn_kid)) {
             /*
              * False condition and no else, or an empty then-statement was
              * moved up over pn.  Either way, make pn an empty block (not an
@@ -9493,8 +9487,8 @@ js_FoldConstants(JSContext *cx, JSParseNode *pn, JSTreeContext *tc, bool inCond)
              * NB: pn must be a TOK_IF as TOK_HOOK can never have a null kid
              * or an empty statement for a child.
              */
-            pn->pn_type = TOK_LC;
-            pn->pn_arity = PN_LIST;
+            pn->setKind(TOK_LC);
+            pn->setArity(PN_LIST);
             pn->makeEmpty();
         }
         RecycleTree(pn2, tc);
@@ -9505,12 +9499,12 @@ js_FoldConstants(JSContext *cx, JSParseNode *pn, JSTreeContext *tc, bool inCond)
       case TOK_OR:
       case TOK_AND:
         if (inCond) {
-            if (pn->pn_arity == PN_LIST) {
+            if (pn->isArity(PN_LIST)) {
                 JSParseNode **pnp = &pn->pn_head;
                 JS_ASSERT(*pnp == pn1);
                 do {
                     int cond = Boolish(pn1);
-                    if (cond == (pn->pn_type == TOK_OR)) {
+                    if (cond == pn->isKind(TOK_OR)) {
                         for (pn2 = pn1->pn_next; pn2; pn2 = pn3) {
                             pn3 = pn2->pn_next;
                             RecycleTree(pn2, tc);
@@ -9520,7 +9514,7 @@ js_FoldConstants(JSContext *cx, JSParseNode *pn, JSTreeContext *tc, bool inCond)
                         break;
                     }
                     if (cond != -1) {
-                        JS_ASSERT(cond == (pn->pn_type == TOK_AND));
+                        JS_ASSERT(cond == pn->isKind(TOK_AND));
                         if (pn->pn_count == 1)
                             break;
                         *pnp = pn1->pn_next;
@@ -9537,7 +9531,7 @@ js_FoldConstants(JSContext *cx, JSParseNode *pn, JSTreeContext *tc, bool inCond)
                     pn2 = pn1->pn_next;
                     pn1->pn_next = NULL;
                     JS_ASSERT(!pn2->pn_next);
-                    pn->pn_arity = PN_BINARY;
+                    pn->setArity(PN_BINARY);
                     pn->pn_left = pn1;
                     pn->pn_right = pn2;
                 } else if (pn->pn_count == 1) {
@@ -9546,11 +9540,11 @@ js_FoldConstants(JSContext *cx, JSParseNode *pn, JSTreeContext *tc, bool inCond)
                 }
             } else {
                 int cond = Boolish(pn1);
-                if (cond == (pn->pn_type == TOK_OR)) {
+                if (cond == pn->isKind(TOK_OR)) {
                     RecycleTree(pn2, tc);
                     pn->become(pn1);
                 } else if (cond != -1) {
-                    JS_ASSERT(cond == (pn->pn_type == TOK_AND));
+                    JS_ASSERT(cond == pn->isKind(TOK_AND));
                     RecycleTree(pn1, tc);
                     pn->become(pn2);
                 }
@@ -9565,14 +9559,14 @@ js_FoldConstants(JSContext *cx, JSParseNode *pn, JSTreeContext *tc, bool inCond)
          * the same string that you get from decompiling a script or function
          * compiled from that same string.  As with +, += is special.
          */
-        if (pn->pn_op == JSOP_NOP)
+        if (pn->isOp(JSOP_NOP))
             break;
-        if (pn->pn_op != JSOP_ADD)
+        if (!pn->isOp(JSOP_ADD))
             goto do_binary_op;
         /* FALL THROUGH */
 
       case TOK_PLUS:
-        if (pn->pn_arity == PN_LIST) {
+        if (pn->isArity(PN_LIST)) {
             /*
              * Any string literal term with all others number or string means
              * this is a concatenation.  If any term is not a string or number
@@ -9590,7 +9584,7 @@ js_FoldConstants(JSContext *cx, JSParseNode *pn, JSTreeContext *tc, bool inCond)
                 if (!FoldType(cx, pn2, TOK_STRING))
                     return JS_FALSE;
                 /* XXX fold only if all operands convert to string */
-                if (pn2->pn_type != TOK_STRING)
+                if (!pn2->isKind(TOK_STRING))
                     return JS_TRUE;
                 length += pn2->pn_atom->length();
             }
@@ -9619,22 +9613,20 @@ js_FoldConstants(JSContext *cx, JSParseNode *pn, JSTreeContext *tc, bool inCond)
             pn->pn_atom = js_AtomizeString(cx, str);
             if (!pn->pn_atom)
                 return JS_FALSE;
-            pn->pn_type = TOK_STRING;
-            pn->pn_op = JSOP_STRING;
-            pn->pn_arity = PN_NULLARY;
+            pn->setKind(TOK_STRING);
+            pn->setOp(JSOP_STRING);
+            pn->setArity(PN_NULLARY);
             break;
         }
 
         /* Handle a binary string concatenation. */
-        JS_ASSERT(pn->pn_arity == PN_BINARY);
-        if (pn1->pn_type == TOK_STRING || pn2->pn_type == TOK_STRING) {
+        JS_ASSERT(pn->isArity(PN_BINARY));
+        if (pn1->isKind(TOK_STRING) || pn2->isKind(TOK_STRING)) {
             JSString *left, *right, *str;
 
-            if (!FoldType(cx, (pn1->pn_type != TOK_STRING) ? pn1 : pn2,
-                          TOK_STRING)) {
+            if (!FoldType(cx, !pn1->isKind(TOK_STRING) ? pn1 : pn2, TOK_STRING))
                 return JS_FALSE;
-            }
-            if (pn1->pn_type != TOK_STRING || pn2->pn_type != TOK_STRING)
+            if (!pn1->isKind(TOK_STRING) || !pn2->isKind(TOK_STRING))
                 return JS_TRUE;
             left = pn1->pn_atom;
             right = pn2->pn_atom;
@@ -9644,9 +9636,9 @@ js_FoldConstants(JSContext *cx, JSParseNode *pn, JSTreeContext *tc, bool inCond)
             pn->pn_atom = js_AtomizeString(cx, str);
             if (!pn->pn_atom)
                 return JS_FALSE;
-            pn->pn_type = TOK_STRING;
-            pn->pn_op = JSOP_STRING;
-            pn->pn_arity = PN_NULLARY;
+            pn->setKind(TOK_STRING);
+            pn->setOp(JSOP_STRING);
+            pn->setArity(PN_NULLARY);
             RecycleTree(pn1, tc);
             RecycleTree(pn2, tc);
             break;
@@ -9660,7 +9652,7 @@ js_FoldConstants(JSContext *cx, JSParseNode *pn, JSTreeContext *tc, bool inCond)
       case TOK_MINUS:
       case TOK_DIVOP:
       do_binary_op:
-        if (pn->pn_arity == PN_LIST) {
+        if (pn->isArity(PN_LIST)) {
             JS_ASSERT(pn->pn_count > 2);
             for (pn2 = pn1; pn2; pn2 = pn2->pn_next) {
                 if (!FoldType(cx, pn2, TOK_NUMBER))
@@ -9668,11 +9660,11 @@ js_FoldConstants(JSContext *cx, JSParseNode *pn, JSTreeContext *tc, bool inCond)
             }
             for (pn2 = pn1; pn2; pn2 = pn2->pn_next) {
                 /* XXX fold only if all operands convert to number */
-                if (pn2->pn_type != TOK_NUMBER)
+                if (!pn2->isKind(TOK_NUMBER))
                     break;
             }
             if (!pn2) {
-                JSOp op = PN_OP(pn);
+                JSOp op = pn->getOp();
 
                 pn2 = pn1->pn_next;
                 pn3 = pn2->pn_next;
@@ -9685,25 +9677,25 @@ js_FoldConstants(JSContext *cx, JSParseNode *pn, JSTreeContext *tc, bool inCond)
                 }
             }
         } else {
-            JS_ASSERT(pn->pn_arity == PN_BINARY);
+            JS_ASSERT(pn->isArity(PN_BINARY));
             if (!FoldType(cx, pn1, TOK_NUMBER) ||
                 !FoldType(cx, pn2, TOK_NUMBER)) {
                 return JS_FALSE;
             }
-            if (pn1->pn_type == TOK_NUMBER && pn2->pn_type == TOK_NUMBER) {
-                if (!FoldBinaryNumeric(cx, PN_OP(pn), pn1, pn2, pn, tc))
+            if (pn1->isKind(TOK_NUMBER) && pn2->isKind(TOK_NUMBER)) {
+                if (!FoldBinaryNumeric(cx, pn->getOp(), pn1, pn2, pn, tc))
                     return JS_FALSE;
             }
         }
         break;
 
       case TOK_UNARYOP:
-        if (pn1->pn_type == TOK_NUMBER) {
+        if (pn1->isKind(TOK_NUMBER)) {
             jsdouble d;
 
             /* Operate on one numeric constant. */
             d = pn1->pn_dval;
-            switch (pn->pn_op) {
+            switch (pn->getOp()) {
               case JSOP_BITNOT:
                 d = ~js_DoubleToECMAInt32(d);
                 break;
@@ -9716,26 +9708,24 @@ js_FoldConstants(JSContext *cx, JSParseNode *pn, JSTreeContext *tc, bool inCond)
                 break;
 
               case JSOP_NOT:
-                pn->pn_type = TOK_PRIMARY;
-                pn->pn_op = (d == 0 || JSDOUBLE_IS_NaN(d)) ? JSOP_TRUE : JSOP_FALSE;
-                pn->pn_arity = PN_NULLARY;
+                pn->setKind(TOK_PRIMARY);
+                pn->setOp((d == 0 || JSDOUBLE_IS_NaN(d)) ? JSOP_TRUE : JSOP_FALSE);
+                pn->setArity(PN_NULLARY);
                 /* FALL THROUGH */
 
               default:
                 /* Return early to dodge the common TOK_NUMBER code. */
                 return JS_TRUE;
             }
-            pn->pn_type = TOK_NUMBER;
-            pn->pn_op = JSOP_DOUBLE;
-            pn->pn_arity = PN_NULLARY;
+            pn->setKind(TOK_NUMBER);
+            pn->setOp(JSOP_DOUBLE);
+            pn->setArity(PN_NULLARY);
             pn->pn_dval = d;
             RecycleTree(pn1, tc);
-        } else if (pn1->pn_type == TOK_PRIMARY) {
-            if (pn->pn_op == JSOP_NOT &&
-                (pn1->pn_op == JSOP_TRUE ||
-                 pn1->pn_op == JSOP_FALSE)) {
+        } else if (pn1->isKind(TOK_PRIMARY)) {
+            if (pn->isOp(JSOP_NOT) && (pn1->isOp(JSOP_TRUE) || pn1->isOp(JSOP_FALSE))) {
                 pn->become(pn1);
-                pn->pn_op = (pn->pn_op == JSOP_TRUE) ? JSOP_FALSE : JSOP_TRUE;
+                pn->setOp(pn->isOp(JSOP_TRUE) ? JSOP_FALSE : JSOP_TRUE);
                 RecycleTree(pn1, tc);
             }
         }
@@ -9748,15 +9738,15 @@ js_FoldConstants(JSContext *cx, JSParseNode *pn, JSTreeContext *tc, bool inCond)
       case TOK_XMLSTAGO:
       case TOK_XMLETAGO:
       case TOK_XMLNAME:
-        if (pn->pn_arity == PN_LIST) {
-            JS_ASSERT(pn->pn_type == TOK_XMLLIST || pn->pn_count != 0);
+        if (pn->isArity(PN_LIST)) {
+            JS_ASSERT(pn->isKind(TOK_XMLLIST) || pn->pn_count != 0);
             if (!FoldXMLConstants(cx, pn, tc))
                 return JS_FALSE;
         }
         break;
 
       case TOK_AT:
-        if (pn1->pn_type == TOK_XMLNAME) {
+        if (pn1->isKind(TOK_XMLNAME)) {
             JSObjectBox *xmlbox;
 
             Value v = StringValue(pn1->pn_atom);
@@ -9768,9 +9758,9 @@ js_FoldConstants(JSContext *cx, JSParseNode *pn, JSTreeContext *tc, bool inCond)
             if (!xmlbox)
                 return JS_FALSE;
 
-            pn->pn_type = TOK_XMLNAME;
-            pn->pn_op = JSOP_OBJECT;
-            pn->pn_arity = PN_NULLARY;
+            pn->setKind(TOK_XMLNAME);
+            pn->setOp(JSOP_OBJECT);
+            pn->setArity(PN_NULLARY);
             pn->pn_objbox = xmlbox;
             RecycleTree(pn1, tc);
         }
@@ -9790,9 +9780,9 @@ js_FoldConstants(JSContext *cx, JSParseNode *pn, JSTreeContext *tc, bool inCond)
              * statements of the form 'this.foo = M;', which we never fold, so we're okay.
              */
             PrepareNodeForMutation(pn, tc);
-            pn->pn_type = TOK_PRIMARY;
-            pn->pn_op = cond ? JSOP_TRUE : JSOP_FALSE;
-            pn->pn_arity = PN_NULLARY;
+            pn->setKind(TOK_PRIMARY);
+            pn->setOp(cond ? JSOP_TRUE : JSOP_FALSE);
+            pn->setArity(PN_NULLARY);
         }
     }
 
diff --git a/js/src/jsparse.h b/js/src/jsparse.h
index 15d5139622f0..5c3fe7369bf9 100644
--- a/js/src/jsparse.h
+++ b/js/src/jsparse.h
@@ -48,6 +48,7 @@
 #include "jspubtd.h"
 #include "jsatom.h"
 #include "jsscan.h"
+#include "jswin.h"
 
 #include "frontend/ParseMaps.h"
 
@@ -350,15 +351,31 @@ struct GlobalScope {
 } /* namespace js */
 
 struct JSParseNode {
-    uint32              pn_type:16,     /* TOK_* type, see jsscan.h */
-                        pn_op:8,        /* see JSOp enum and jsopcode.tbl */
-                        pn_arity:5,     /* see JSParseNodeArity enum */
-                        pn_parens:1,    /* this expr was enclosed in parens */
-                        pn_used:1,      /* name node is on a use-chain */
-                        pn_defn:1;      /* this node is a JSDefinition */
+  private:
+    uint32              pn_type   : 16, /* TOK_* type, see jsscan.h */
+                        pn_op     : 8,  /* see JSOp enum and jsopcode.tbl */
+                        pn_arity  : 5,  /* see JSParseNodeArity enum */
+                        pn_parens : 1,  /* this expr was enclosed in parens */
+                        pn_used   : 1,  /* name node is on a use-chain */
+                        pn_defn   : 1;  /* this node is a JSDefinition */
 
-#define PN_OP(pn)    ((JSOp)(pn)->pn_op)
-#define PN_TYPE(pn)  ((js::TokenKind)(pn)->pn_type)
+  public:
+    JSOp getOp() const                     { return JSOp(pn_op); }
+    void setOp(JSOp op)                    { pn_op = op; }
+    bool isOp(JSOp op) const               { return getOp() == op; }
+    js::TokenKind getKind() const          { return js::TokenKind(pn_type); }
+    void setKind(js::TokenKind kind)       { pn_type = kind; }
+    bool isKind(js::TokenKind kind) const  { return getKind() == kind; }
+    JSParseNodeArity getArity() const      { return JSParseNodeArity(pn_arity); }
+    bool isArity(JSParseNodeArity a) const { return getArity() == a; }
+    void setArity(JSParseNodeArity a)      { pn_arity = a; }
+    /* Boolean attributes. */
+    bool isInParens() const                { return pn_parens; }
+    void setInParens(bool enabled)         { pn_parens = enabled; }
+    bool isDefn() const                    { return pn_defn; }
+    void setDefn(bool enabled)             { pn_defn = enabled; }
+    bool isUsed() const                    { return pn_used; }
+    void setUsed(bool enabled)             { pn_used = enabled; }
 
     js::TokenPos        pn_pos;         /* two 16-bit pairs here, for 64 bits */
     int32               pn_offset;      /* first generated bytecode offset */
@@ -580,9 +597,9 @@ public:
 
     /* True if pn is a parsenode representing a literal constant. */
     bool isLiteral() const {
-        return PN_TYPE(this) == js::TOK_NUMBER ||
-               PN_TYPE(this) == js::TOK_STRING ||
-               (PN_TYPE(this) == js::TOK_PRIMARY && PN_OP(this) != JSOP_THIS);
+        return isKind(js::TOK_NUMBER) ||
+               isKind(js::TOK_STRING) ||
+               (isKind(js::TOK_PRIMARY) && !isOp(JSOP_THIS));
     }
 
     /*
@@ -601,10 +618,10 @@ public:
      * a directive.
      */
     bool isStringExprStatement() const {
-        if (PN_TYPE(this) == js::TOK_SEMI) {
+        if (getKind() == js::TOK_SEMI) {
             JS_ASSERT(pn_arity == PN_UNARY);
             JSParseNode *kid = pn_kid;
-            return kid && PN_TYPE(kid) == js::TOK_STRING && !kid->pn_parens;
+            return kid && kid->getKind() == js::TOK_STRING && !kid->pn_parens;
         }
         return false;
     }
@@ -635,13 +652,13 @@ public:
      * True if this node is a desugared generator expression.
      */
     bool isGeneratorExpr() const {
-        if (PN_TYPE(this) == js::TOK_LP) {
+        if (getKind() == js::TOK_LP) {
             JSParseNode *callee = this->pn_head;
-            if (PN_TYPE(callee) == js::TOK_FUNCTION) {
-                JSParseNode *body = (PN_TYPE(callee->pn_body) == js::TOK_UPVARS)
+            if (callee->getKind() == js::TOK_FUNCTION) {
+                JSParseNode *body = (callee->pn_body->getKind() == js::TOK_UPVARS)
                                     ? callee->pn_body->pn_tree
                                     : callee->pn_body;
-                if (PN_TYPE(body) == js::TOK_LEXICALSCOPE)
+                if (body->getKind() == js::TOK_LEXICALSCOPE)
                     return true;
             }
         }
@@ -651,10 +668,10 @@ public:
     JSParseNode *generatorExpr() const {
         JS_ASSERT(isGeneratorExpr());
         JSParseNode *callee = this->pn_head;
-        JSParseNode *body = PN_TYPE(callee->pn_body) == js::TOK_UPVARS
+        JSParseNode *body = callee->pn_body->getKind() == js::TOK_UPVARS
             ? callee->pn_body->pn_tree
             : callee->pn_body;
-        JS_ASSERT(PN_TYPE(body) == js::TOK_LEXICALSCOPE);
+        JS_ASSERT(body->getKind() == js::TOK_LEXICALSCOPE);
         return body->pn_expr;
     }
 #endif
@@ -912,8 +929,8 @@ struct JSDefinition : public JSParseNode
      */
     JSDefinition *resolve() {
         JSParseNode *pn = this;
-        while (!pn->pn_defn) {
-            if (pn->pn_type == js::TOK_ASSIGN) {
+        while (!pn->isDefn()) {
+            if (pn->getKind() == js::TOK_ASSIGN) {
                 pn = pn->pn_left;
                 continue;
             }
@@ -923,19 +940,15 @@ struct JSDefinition : public JSParseNode
     }
 
     bool isFreeVar() const {
-        JS_ASSERT(pn_defn);
+        JS_ASSERT(isDefn());
         return pn_cookie.isFree() || test(PND_GVAR);
     }
 
     bool isGlobal() const {
-        JS_ASSERT(pn_defn);
+        JS_ASSERT(isDefn());
         return test(PND_GVAR);
     }
 
-    // Grr, windows.h or something under it #defines CONST...
-#ifdef CONST
-# undef CONST
-#endif
     enum Kind { VAR, CONST, LET, FUNCTION, ARG, UNKNOWN };
 
     bool isBindingForm() { return int(kind()) <= int(LET); }
@@ -943,12 +956,12 @@ struct JSDefinition : public JSParseNode
     static const char *kindString(Kind kind);
 
     Kind kind() {
-        if (PN_TYPE(this) == js::TOK_FUNCTION)
+        if (getKind() == js::TOK_FUNCTION)
             return FUNCTION;
-        JS_ASSERT(PN_TYPE(this) == js::TOK_NAME);
-        if (PN_OP(this) == JSOP_NOP)
+        JS_ASSERT(getKind() == js::TOK_NAME);
+        if (isOp(JSOP_NOP))
             return UNKNOWN;
-        if (PN_OP(this) == JSOP_GETARG)
+        if (isOp(JSOP_GETARG))
             return ARG;
         if (isConst())
             return CONST;
diff --git a/js/src/jsreflect.cpp b/js/src/jsreflect.cpp
index d35de1776d69..430607f74689 100644
--- a/js/src/jsreflect.cpp
+++ b/js/src/jsreflect.cpp
@@ -1823,7 +1823,7 @@ ASTSerializer::binop(TokenKind tk, JSOp op)
 bool
 ASTSerializer::statements(JSParseNode *pn, NodeVector &elts)
 {
-    JS_ASSERT(PN_TYPE(pn) == TOK_LC && pn->pn_arity == PN_LIST);
+    JS_ASSERT(pn->isKind(TOK_LC) && pn->isArity(PN_LIST));
 
     if (!elts.reserve(pn->pn_count))
         return false;
@@ -1873,7 +1873,7 @@ ASTSerializer::xmls(JSParseNode *pn, NodeVector &elts)
 bool
 ASTSerializer::blockStatement(JSParseNode *pn, Value *dst)
 {
-    JS_ASSERT(PN_TYPE(pn) == TOK_LC);
+    JS_ASSERT(pn->isKind(TOK_LC));
 
     NodeVector stmts(cx);
     return statements(pn, stmts) &&
@@ -1900,11 +1900,9 @@ ASTSerializer::sourceElement(JSParseNode *pn, Value *dst)
 bool
 ASTSerializer::declaration(JSParseNode *pn, Value *dst)
 {
-    JS_ASSERT(PN_TYPE(pn) == TOK_FUNCTION ||
-              PN_TYPE(pn) == TOK_VAR ||
-              PN_TYPE(pn) == TOK_LET);
+    JS_ASSERT(pn->isKind(TOK_FUNCTION) || pn->isKind(TOK_VAR) || pn->isKind(TOK_LET));
 
-    switch (PN_TYPE(pn)) {
+    switch (pn->getKind()) {
       case TOK_FUNCTION:
         return function(pn, AST_FUNC_DECL, dst);
 
@@ -1912,7 +1910,7 @@ ASTSerializer::declaration(JSParseNode *pn, Value *dst)
         return variableDeclaration(pn, false, dst);
 
       default:
-        JS_ASSERT(PN_TYPE(pn) == TOK_LET);
+        JS_ASSERT(pn->isKind(TOK_LET));
         return variableDeclaration(pn, true, dst);
     }
 }
@@ -1920,7 +1918,7 @@ ASTSerializer::declaration(JSParseNode *pn, Value *dst)
 bool
 ASTSerializer::variableDeclaration(JSParseNode *pn, bool let, Value *dst)
 {
-    JS_ASSERT(let ? PN_TYPE(pn) == TOK_LET : PN_TYPE(pn) == TOK_VAR);
+    JS_ASSERT(let ? pn->isKind(TOK_LET) : pn->isKind(TOK_VAR));
 
     /* Later updated to VARDECL_CONST if we find a PND_CONST declarator. */
     VarDeclKind kind = let ? VARDECL_LET : VARDECL_VAR;
@@ -1952,16 +1950,16 @@ bool
 ASTSerializer::variableDeclarator(JSParseNode *pn, VarDeclKind *pkind, Value *dst)
 {
     /* A destructuring declarator is always a TOK_ASSIGN. */
-    JS_ASSERT(PN_TYPE(pn) == TOK_NAME || PN_TYPE(pn) == TOK_ASSIGN);
+    JS_ASSERT(pn->isKind(TOK_NAME) || pn->isKind(TOK_ASSIGN));
 
     JSParseNode *pnleft;
     JSParseNode *pnright;
 
-    if (PN_TYPE(pn) == TOK_NAME) {
+    if (pn->isKind(TOK_NAME)) {
         pnleft = pn;
-        pnright = pn->pn_used ? NULL : pn->pn_expr;
+        pnright = pn->isUsed() ? NULL : pn->pn_expr;
     } else {
-        JS_ASSERT(PN_TYPE(pn) == TOK_ASSIGN);
+        JS_ASSERT(pn->isKind(TOK_ASSIGN));
         pnleft = pn->pn_left;
         pnright = pn->pn_right;
     }
@@ -2017,7 +2015,7 @@ ASTSerializer::switchStatement(JSParseNode *pn, Value *dst)
     JSParseNode *listNode;
     bool lexical;
 
-    if (PN_TYPE(pn->pn_right) == TOK_LEXICALSCOPE) {
+    if (pn->pn_right->isKind(TOK_LEXICALSCOPE)) {
         listNode = pn->pn_right->pn_expr;
         lexical = true;
     } else {
@@ -2086,9 +2084,9 @@ ASTSerializer::forInit(JSParseNode *pn, Value *dst)
         return true;
     }
 
-    return (PN_TYPE(pn) == TOK_VAR)
+    return pn->isKind(TOK_VAR)
            ? variableDeclaration(pn, false, dst)
-           : (PN_TYPE(pn) == TOK_LET)
+           : pn->isKind(TOK_LET)
            ? variableDeclaration(pn, true, dst)
            : expression(pn, dst);
 }
@@ -2097,14 +2095,14 @@ bool
 ASTSerializer::statement(JSParseNode *pn, Value *dst)
 {
     JS_CHECK_RECURSION(cx, return false);
-    switch (PN_TYPE(pn)) {
+    switch (pn->getKind()) {
       case TOK_FUNCTION:
       case TOK_VAR:
       case TOK_LET:
         return declaration(pn, dst);
 
       case TOK_NAME:
-        LOCAL_ASSERT(pn->pn_used);
+        LOCAL_ASSERT(pn->isUsed());
         return statement(pn->pn_lexdef, dst);
 
       case TOK_SEMI:
@@ -2117,7 +2115,7 @@ ASTSerializer::statement(JSParseNode *pn, Value *dst)
 
       case TOK_LEXICALSCOPE:
         pn = pn->pn_expr;
-        if (PN_TYPE(pn) == TOK_LET) {
+        if (pn->isKind(TOK_LET)) {
             NodeVector dtors(cx);
             Value stmt;
 
@@ -2126,7 +2124,7 @@ ASTSerializer::statement(JSParseNode *pn, Value *dst)
                    builder.letStatement(dtors, stmt, &pn->pn_pos, dst);
         }
 
-        if (PN_TYPE(pn) != TOK_LC)
+        if (!pn->isKind(TOK_LC))
             return statement(pn, dst);
         /* FALL THROUGH */
 
@@ -2156,7 +2154,7 @@ ASTSerializer::statement(JSParseNode *pn, Value *dst)
 
         return expression(pn->pn_left, &expr) &&
                statement(pn->pn_right, &stmt) &&
-               (PN_TYPE(pn) == TOK_WITH)
+               pn->isKind(TOK_WITH)
                ? builder.withStatement(expr, stmt, &pn->pn_pos, dst)
                : builder.whileStatement(expr, stmt, &pn->pn_pos, dst);
       }
@@ -2180,13 +2178,13 @@ ASTSerializer::statement(JSParseNode *pn, Value *dst)
 
         bool isForEach = pn->pn_iflags & JSITER_FOREACH;
 
-        if (PN_TYPE(head) == TOK_IN) {
+        if (head->isKind(TOK_IN)) {
             Value var, expr;
 
             return (!head->pn_kid1
                     ? pattern(head->pn_kid2, NULL, &var)
                     : variableDeclaration(head->pn_kid1,
-                                          PN_TYPE(head->pn_kid1) == TOK_LET,
+                                          head->pn_kid1->isKind(TOK_LET),
                                           &var)) &&
                    expression(head->pn_kid3, &expr) &&
                    builder.forInStatement(var, expr, stmt, isForEach, &pn->pn_pos, dst);
@@ -2208,14 +2206,14 @@ ASTSerializer::statement(JSParseNode *pn, Value *dst)
         JSParseNode *prelude = pn->pn_head;
         JSParseNode *loop = prelude->pn_next;
 
-        LOCAL_ASSERT(PN_TYPE(prelude) == TOK_VAR && PN_TYPE(loop) == TOK_FOR);
+        LOCAL_ASSERT(prelude->isKind(TOK_VAR) && loop->isKind(TOK_FOR));
 
         Value var;
         if (!variableDeclaration(prelude, false, &var))
             return false;
 
         JSParseNode *head = loop->pn_left;
-        JS_ASSERT(PN_TYPE(head) == TOK_IN);
+        JS_ASSERT(head->isKind(TOK_IN));
 
         bool isForEach = loop->pn_iflags & JSITER_FOREACH;
 
@@ -2232,7 +2230,7 @@ ASTSerializer::statement(JSParseNode *pn, Value *dst)
         Value label;
 
         return optIdentifier(pn->pn_atom, NULL, &label) &&
-               (PN_TYPE(pn) == TOK_BREAK
+               (pn->isKind(TOK_BREAK)
                 ? builder.breakStatement(label, &pn->pn_pos, dst)
                 : builder.continueStatement(label, &pn->pn_pos, dst));
       }
@@ -2252,7 +2250,7 @@ ASTSerializer::statement(JSParseNode *pn, Value *dst)
         Value arg;
 
         return optExpression(pn->pn_kid, &arg) &&
-               (PN_TYPE(pn) == TOK_THROW
+               (pn->isKind(TOK_THROW)
                 ? builder.throwStatement(arg, &pn->pn_pos, dst)
                 : builder.returnStatement(arg, &pn->pn_pos, dst));
       }
@@ -2263,7 +2261,7 @@ ASTSerializer::statement(JSParseNode *pn, Value *dst)
 #if JS_HAS_XML_SUPPORT
       case TOK_DEFAULT:
       {
-        LOCAL_ASSERT(pn->pn_arity == PN_UNARY);
+        LOCAL_ASSERT(pn->isArity(PN_UNARY));
 
         Value ns;
 
@@ -2280,10 +2278,10 @@ ASTSerializer::statement(JSParseNode *pn, Value *dst)
 bool
 ASTSerializer::leftAssociate(JSParseNode *pn, Value *dst)
 {
-    JS_ASSERT(pn->pn_arity == PN_LIST);
+    JS_ASSERT(pn->isArity(PN_LIST));
     JS_ASSERT(pn->pn_count >= 1);
 
-    TokenKind tk = PN_TYPE(pn);
+    TokenKind tk = pn->getKind();
     bool lor = tk == TOK_OR;
     bool logop = lor || (tk == TOK_AND);
 
@@ -2302,7 +2300,7 @@ ASTSerializer::leftAssociate(JSParseNode *pn, Value *dst)
             if (!builder.logicalExpression(lor, left, right, &subpos, &left))
                 return false;
         } else {
-            BinaryOperator op = binop(PN_TYPE(pn), PN_OP(pn));
+            BinaryOperator op = binop(pn->getKind(), pn->getOp());
             LOCAL_ASSERT(op > BINOP_ERR && op < BINOP_LIMIT);
 
             if (!builder.binaryExpression(op, left, right, &subpos, &left))
@@ -2317,11 +2315,11 @@ ASTSerializer::leftAssociate(JSParseNode *pn, Value *dst)
 bool
 ASTSerializer::comprehensionBlock(JSParseNode *pn, Value *dst)
 {
-    LOCAL_ASSERT(pn->pn_arity == PN_BINARY);
+    LOCAL_ASSERT(pn->isArity(PN_BINARY));
 
     JSParseNode *in = pn->pn_left;
 
-    LOCAL_ASSERT(in && PN_TYPE(in) == TOK_IN);
+    LOCAL_ASSERT(in && in->isKind(TOK_IN));
 
     bool isForEach = pn->pn_iflags & JSITER_FOREACH;
 
@@ -2334,12 +2332,12 @@ ASTSerializer::comprehensionBlock(JSParseNode *pn, Value *dst)
 bool
 ASTSerializer::comprehension(JSParseNode *pn, Value *dst)
 {
-    LOCAL_ASSERT(PN_TYPE(pn) == TOK_FOR);
+    LOCAL_ASSERT(pn->isKind(TOK_FOR));
 
     NodeVector blocks(cx);
 
     JSParseNode *next = pn;
-    while (PN_TYPE(next) == TOK_FOR) {
+    while (next->isKind(TOK_FOR)) {
         Value block;
         if (!comprehensionBlock(next, &block) || !blocks.append(block))
             return false;
@@ -2348,17 +2346,17 @@ ASTSerializer::comprehension(JSParseNode *pn, Value *dst)
 
     Value filter = MagicValue(JS_SERIALIZE_NO_NODE);
 
-    if (PN_TYPE(next) == TOK_IF) {
+    if (next->isKind(TOK_IF)) {
         if (!optExpression(next->pn_kid1, &filter))
             return false;
         next = next->pn_kid2;
-    } else if (PN_TYPE(next) == TOK_LC && next->pn_count == 0) {
+    } else if (next->isKind(TOK_LC) && next->pn_count == 0) {
         /* js_FoldConstants optimized away the push. */
         NodeVector empty(cx);
         return builder.arrayExpression(empty, &pn->pn_pos, dst);
     }
 
-    LOCAL_ASSERT(PN_TYPE(next) == TOK_ARRAYPUSH);
+    LOCAL_ASSERT(next->isKind(TOK_ARRAYPUSH));
 
     Value body;
 
@@ -2369,12 +2367,12 @@ ASTSerializer::comprehension(JSParseNode *pn, Value *dst)
 bool
 ASTSerializer::generatorExpression(JSParseNode *pn, Value *dst)
 {
-    LOCAL_ASSERT(PN_TYPE(pn) == TOK_FOR);
+    LOCAL_ASSERT(pn->isKind(TOK_FOR));
 
     NodeVector blocks(cx);
 
     JSParseNode *next = pn;
-    while (PN_TYPE(next) == TOK_FOR) {
+    while (next->isKind(TOK_FOR)) {
         Value block;
         if (!comprehensionBlock(next, &block) || !blocks.append(block))
             return false;
@@ -2383,14 +2381,14 @@ ASTSerializer::generatorExpression(JSParseNode *pn, Value *dst)
 
     Value filter = MagicValue(JS_SERIALIZE_NO_NODE);
 
-    if (PN_TYPE(next) == TOK_IF) {
+    if (next->isKind(TOK_IF)) {
         if (!optExpression(next->pn_kid1, &filter))
             return false;
         next = next->pn_kid2;
     }
 
-    LOCAL_ASSERT(PN_TYPE(next) == TOK_SEMI &&
-                 PN_TYPE(next->pn_kid) == TOK_YIELD &&
+    LOCAL_ASSERT(next->isKind(TOK_SEMI) &&
+                 next->pn_kid->isKind(TOK_YIELD) &&
                  next->pn_kid->pn_kid);
 
     Value body;
@@ -2403,7 +2401,7 @@ bool
 ASTSerializer::expression(JSParseNode *pn, Value *dst)
 {
     JS_CHECK_RECURSION(cx, return false);
-    switch (PN_TYPE(pn)) {
+    switch (pn->getKind()) {
       case TOK_FUNCTION:
         return function(pn, AST_FUNC_EXPR, dst);
 
@@ -2427,11 +2425,11 @@ ASTSerializer::expression(JSParseNode *pn, Value *dst)
       case TOK_OR:
       case TOK_AND:
       {
-        if (pn->pn_arity == PN_BINARY) {
+        if (pn->isArity(PN_BINARY)) {
             Value left, right;
             return expression(pn->pn_left, &left) &&
                    expression(pn->pn_right, &right) &&
-                   builder.logicalExpression(PN_TYPE(pn) == TOK_OR, left, right, &pn->pn_pos, dst);
+                   builder.logicalExpression(pn->isKind(TOK_OR), left, right, &pn->pn_pos, dst);
         }
         return leftAssociate(pn, dst);
       }
@@ -2439,8 +2437,8 @@ ASTSerializer::expression(JSParseNode *pn, Value *dst)
       case TOK_INC:
       case TOK_DEC:
       {
-        bool incr = PN_TYPE(pn) == TOK_INC;
-        bool prefix = PN_OP(pn) >= JSOP_INCNAME && PN_OP(pn) <= JSOP_DECELEM;
+        bool incr = pn->isKind(TOK_INC);
+        bool prefix = pn->getOp() >= JSOP_INCNAME && pn->getOp() <= JSOP_DECELEM;
 
         Value expr;
         return expression(pn->pn_kid, &expr) &&
@@ -2449,7 +2447,7 @@ ASTSerializer::expression(JSParseNode *pn, Value *dst)
 
       case TOK_ASSIGN:
       {
-        AssignmentOperator op = aop(PN_OP(pn));
+        AssignmentOperator op = aop(pn->getOp());
         LOCAL_ASSERT(op > AOP_ERR && op < AOP_LIMIT);
 
         Value lhs, rhs;
@@ -2471,8 +2469,8 @@ ASTSerializer::expression(JSParseNode *pn, Value *dst)
       case TOK_IN:
       case TOK_INSTANCEOF:
       case TOK_DBLDOT:
-        if (pn->pn_arity == PN_BINARY) {
-            BinaryOperator op = binop(PN_TYPE(pn), PN_OP(pn));
+        if (pn->isArity(PN_BINARY)) {
+            BinaryOperator op = binop(pn->getKind(), pn->getOp());
             LOCAL_ASSERT(op > BINOP_ERR && op < BINOP_LIMIT);
 
             Value left, right;
@@ -2485,14 +2483,14 @@ ASTSerializer::expression(JSParseNode *pn, Value *dst)
       case TOK_DELETE:
       case TOK_UNARYOP:
 #if JS_HAS_XML_SUPPORT
-        if (PN_OP(pn) == JSOP_XMLNAME ||
-            PN_OP(pn) == JSOP_SETXMLNAME ||
-            PN_OP(pn) == JSOP_BINDXMLNAME)
+        if (pn->isOp(JSOP_XMLNAME) ||
+            pn->isOp(JSOP_SETXMLNAME) ||
+            pn->isOp(JSOP_BINDXMLNAME))
             return expression(pn->pn_kid, dst);
 #endif
 
       {
-        UnaryOperator op = unop(PN_TYPE(pn), PN_OP(pn));
+        UnaryOperator op = unop(pn->getKind(), pn->getOp());
         LOCAL_ASSERT(op > UNOP_ERR && op < UNOP_LIMIT);
 
         Value expr;
@@ -2525,7 +2523,7 @@ ASTSerializer::expression(JSParseNode *pn, Value *dst)
             args.infallibleAppend(arg);
         }
 
-        return PN_TYPE(pn) == TOK_NEW
+        return pn->isKind(TOK_NEW)
                ? builder.newExpression(callee, args, &pn->pn_pos, dst)
                : builder.callExpression(callee, args, &pn->pn_pos, dst);
       }
@@ -2543,9 +2541,9 @@ ASTSerializer::expression(JSParseNode *pn, Value *dst)
         Value left, right;
         bool computed = true;
 #ifdef JS_HAS_XML_SUPPORT
-        computed = (PN_TYPE(pn->pn_right) != TOK_DBLCOLON &&
-                    PN_TYPE(pn->pn_right) != TOK_ANYNAME &&
-                    PN_TYPE(pn->pn_right) != TOK_AT);
+        computed = (!pn->pn_right->isKind(TOK_DBLCOLON) &&
+                    !pn->pn_right->isKind(TOK_ANYNAME) &&
+                    !pn->pn_right->isKind(TOK_AT));
 #endif
         return expression(pn->pn_left, &left) &&
                expression(pn->pn_right, &right) &&
@@ -2559,7 +2557,7 @@ ASTSerializer::expression(JSParseNode *pn, Value *dst)
             return false;
 
         for (JSParseNode *next = pn->pn_head; next; next = next->pn_next) {
-            if (PN_TYPE(next) == TOK_COMMA) {
+            if (next->isKind(TOK_COMMA)) {
                 elts.infallibleAppend(MagicValue(JS_SERIALIZE_NO_NODE));
             } else {
                 Value expr;
@@ -2595,7 +2593,7 @@ ASTSerializer::expression(JSParseNode *pn, Value *dst)
       case TOK_REGEXP:
       case TOK_NUMBER:
       case TOK_PRIMARY:
-        return PN_OP(pn) == JSOP_THIS ? builder.thisExpression(&pn->pn_pos, dst) : literal(pn, dst);
+        return pn->isOp(JSOP_THIS) ? builder.thisExpression(&pn->pn_pos, dst) : literal(pn, dst);
 
       case TOK_YIELD:
       {
@@ -2617,7 +2615,7 @@ ASTSerializer::expression(JSParseNode *pn, Value *dst)
       case TOK_ARRAYCOMP:
         /* NB: it's no longer the case that pn_count could be 2. */
         LOCAL_ASSERT(pn->pn_count == 1);
-        LOCAL_ASSERT(PN_TYPE(pn->pn_head) == TOK_LEXICALSCOPE);
+        LOCAL_ASSERT(pn->pn_head->isKind(TOK_LEXICALSCOPE));
 
         return comprehension(pn->pn_head->pn_expr, dst);
 
@@ -2641,25 +2639,25 @@ ASTSerializer::expression(JSParseNode *pn, Value *dst)
       {
         Value right;
 
-        LOCAL_ASSERT(pn->pn_arity == PN_NAME || pn->pn_arity == PN_BINARY);
+        LOCAL_ASSERT(pn->isArity(PN_NAME) || pn->isArity(PN_BINARY));
 
         JSParseNode *pnleft;
         bool computed;
 
-        if (pn->pn_arity == PN_BINARY) {
+        if (pn->isArity(PN_BINARY)) {
             computed = true;
             pnleft = pn->pn_left;
             if (!expression(pn->pn_right, &right))
                 return false;
         } else {
-            JS_ASSERT(pn->pn_arity == PN_NAME);
+            JS_ASSERT(pn->isArity(PN_NAME));
             computed = false;
             pnleft = pn->pn_expr;
             if (!identifier(pn->pn_atom, NULL, &right))
                 return false;
         }
 
-        if (PN_TYPE(pnleft) == TOK_FUNCTION)
+        if (pnleft->isKind(TOK_FUNCTION))
             return builder.xmlFunctionQualifiedIdentifier(right, computed, &pn->pn_pos, dst);
 
         Value left;
@@ -2671,9 +2669,9 @@ ASTSerializer::expression(JSParseNode *pn, Value *dst)
       {
         Value expr;
         JSParseNode *kid = pn->pn_kid;
-        bool computed = ((PN_TYPE(kid) != TOK_NAME || PN_OP(kid) != JSOP_QNAMEPART) &&
-                         PN_TYPE(kid) != TOK_DBLCOLON &&
-                         PN_TYPE(kid) != TOK_ANYNAME);
+        bool computed = ((!kid->isKind(TOK_NAME) || !kid->isOp(JSOP_QNAMEPART)) &&
+                         !kid->isKind(TOK_DBLCOLON) &&
+                         !kid->isKind(TOK_ANYNAME));
         return expression(kid, &expr) &&
             builder.xmlAttributeSelector(expr, computed, &pn->pn_pos, dst);
       }
@@ -2700,7 +2698,7 @@ bool
 ASTSerializer::xml(JSParseNode *pn, Value *dst)
 {
     JS_CHECK_RECURSION(cx, return false);
-    switch (PN_TYPE(pn)) {
+    switch (pn->getKind()) {
 #ifdef JS_HAS_XML_SUPPORT
       case TOK_LC:
       {
@@ -2754,10 +2752,10 @@ ASTSerializer::xml(JSParseNode *pn, Value *dst)
         return builder.xmlText(atomContents(pn->pn_atom), &pn->pn_pos, dst);
 
       case TOK_XMLNAME:
-        if (pn->pn_arity == PN_NULLARY)
+        if (pn->isArity(PN_NULLARY))
             return builder.xmlName(atomContents(pn->pn_atom), &pn->pn_pos, dst);
 
-        LOCAL_ASSERT(pn->pn_arity == PN_LIST);
+        LOCAL_ASSERT(pn->isArity(PN_LIST));
 
         {
             NodeVector elts(cx);
@@ -2792,10 +2790,10 @@ ASTSerializer::xml(JSParseNode *pn, Value *dst)
 bool
 ASTSerializer::propertyName(JSParseNode *pn, Value *dst)
 {
-    if (PN_TYPE(pn) == TOK_NAME)
+    if (pn->isKind(TOK_NAME))
         return identifier(pn, dst);
 
-    LOCAL_ASSERT(PN_TYPE(pn) == TOK_STRING || PN_TYPE(pn) == TOK_NUMBER);
+    LOCAL_ASSERT(pn->isKind(TOK_STRING) || pn->isKind(TOK_NUMBER));
 
     return literal(pn, dst);
 }
@@ -2804,7 +2802,7 @@ bool
 ASTSerializer::property(JSParseNode *pn, Value *dst)
 {
     PropKind kind;
-    switch (PN_OP(pn)) {
+    switch (pn->getOp()) {
       case JSOP_INITPROP:
         kind = PROP_INIT;
         break;
@@ -2831,7 +2829,7 @@ bool
 ASTSerializer::literal(JSParseNode *pn, Value *dst)
 {
     Value val;
-    switch (PN_TYPE(pn)) {
+    switch (pn->getKind()) {
       case TOK_STRING:
         val.setString(pn->pn_atom);
         break;
@@ -2858,10 +2856,10 @@ ASTSerializer::literal(JSParseNode *pn, Value *dst)
         break;
 
       case TOK_PRIMARY:
-        if (PN_OP(pn) == JSOP_NULL)
+        if (pn->isOp(JSOP_NULL))
             val.setNull();
         else
-            val.setBoolean(PN_OP(pn) == JSOP_TRUE);
+            val.setBoolean(pn->isOp(JSOP_TRUE));
         break;
 
       default:
@@ -2874,14 +2872,14 @@ ASTSerializer::literal(JSParseNode *pn, Value *dst)
 bool
 ASTSerializer::arrayPattern(JSParseNode *pn, VarDeclKind *pkind, Value *dst)
 {
-    JS_ASSERT(PN_TYPE(pn) == TOK_RB);
+    JS_ASSERT(pn->isKind(TOK_RB));
 
     NodeVector elts(cx);
     if (!elts.reserve(pn->pn_count))
         return false;
 
     for (JSParseNode *next = pn->pn_head; next; next = next->pn_next) {
-        if (PN_TYPE(next) == TOK_COMMA) {
+        if (next->isKind(TOK_COMMA)) {
             elts.infallibleAppend(MagicValue(JS_SERIALIZE_NO_NODE));
         } else {
             Value patt;
@@ -2897,14 +2895,14 @@ ASTSerializer::arrayPattern(JSParseNode *pn, VarDeclKind *pkind, Value *dst)
 bool
 ASTSerializer::objectPattern(JSParseNode *pn, VarDeclKind *pkind, Value *dst)
 {
-    JS_ASSERT(PN_TYPE(pn) == TOK_RC);
+    JS_ASSERT(pn->isKind(TOK_RC));
 
     NodeVector elts(cx);
     if (!elts.reserve(pn->pn_count))
         return false;
 
     for (JSParseNode *next = pn->pn_head; next; next = next->pn_next) {
-        LOCAL_ASSERT(PN_OP(next) == JSOP_INITPROP);
+        LOCAL_ASSERT(next->isOp(JSOP_INITPROP));
 
         Value key, patt, prop;
         if (!propertyName(next->pn_left, &key) ||
@@ -2923,7 +2921,7 @@ bool
 ASTSerializer::pattern(JSParseNode *pn, VarDeclKind *pkind, Value *dst)
 {
     JS_CHECK_RECURSION(cx, return false);
-    switch (PN_TYPE(pn)) {
+    switch (pn->getKind()) {
       case TOK_RC:
         return objectPattern(pn, pkind, dst);
 
@@ -2949,7 +2947,7 @@ ASTSerializer::identifier(JSAtom *atom, TokenPos *pos, Value *dst)
 bool
 ASTSerializer::identifier(JSParseNode *pn, Value *dst)
 {
-    LOCAL_ASSERT(pn->pn_arity == PN_NAME || pn->pn_arity == PN_NULLARY);
+    LOCAL_ASSERT(pn->isArity(PN_NAME) || pn->isArity(PN_NULLARY));
     LOCAL_ASSERT(pn->pn_atom);
 
     return identifier(pn->pn_atom, &pn->pn_pos, dst);
@@ -2980,7 +2978,7 @@ ASTSerializer::function(JSParseNode *pn, ASTType type, Value *dst)
 
     NodeVector args(cx);
 
-    JSParseNode *argsAndBody = (PN_TYPE(pn->pn_body) == TOK_UPVARS)
+    JSParseNode *argsAndBody = pn->pn_body->isKind(TOK_UPVARS)
                                ? pn->pn_body->pn_tree
                                : pn->pn_body;
 
@@ -2996,7 +2994,7 @@ ASTSerializer::functionArgsAndBody(JSParseNode *pn, NodeVector &args, Value *bod
     JSParseNode *pnbody;
 
     /* Extract the args and body separately. */
-    if (PN_TYPE(pn) == TOK_ARGSBODY) {
+    if (pn->isKind(TOK_ARGSBODY)) {
         pnargs = pn;
         pnbody = pn->last();
     } else {
@@ -3007,18 +3005,18 @@ ASTSerializer::functionArgsAndBody(JSParseNode *pn, NodeVector &args, Value *bod
     JSParseNode *pndestruct;
 
     /* Extract the destructuring assignments. */
-    if (pnbody->pn_arity == PN_LIST && (pnbody->pn_xflags & PNX_DESTRUCT)) {
+    if (pnbody->isArity(PN_LIST) && (pnbody->pn_xflags & PNX_DESTRUCT)) {
         JSParseNode *head = pnbody->pn_head;
-        LOCAL_ASSERT(head && PN_TYPE(head) == TOK_SEMI);
+        LOCAL_ASSERT(head && head->isKind(TOK_SEMI));
 
         pndestruct = head->pn_kid;
-        LOCAL_ASSERT(pndestruct && PN_TYPE(pndestruct) == TOK_VAR);
+        LOCAL_ASSERT(pndestruct && pndestruct->isKind(TOK_VAR));
     } else {
         pndestruct = NULL;
     }
 
     /* Serialize the arguments and body. */
-    switch (PN_TYPE(pnbody)) {
+    switch (pnbody->getKind()) {
       case TOK_RETURN: /* expression closure, no destructured args */
         return functionArgs(pn, pnargs, NULL, pnbody, args) &&
                expression(pnbody->pn_kid, body);
@@ -3026,7 +3024,7 @@ ASTSerializer::functionArgsAndBody(JSParseNode *pn, NodeVector &args, Value *bod
       case TOK_SEQ:    /* expression closure with destructured args */
       {
         JSParseNode *pnstart = pnbody->pn_head->pn_next;
-        LOCAL_ASSERT(pnstart && PN_TYPE(pnstart) == TOK_RETURN);
+        LOCAL_ASSERT(pnstart && pnstart->isKind(TOK_RETURN));
 
         return functionArgs(pn, pnargs, pndestruct, pnbody, args) &&
                expression(pnstart->pn_kid, body);
diff --git a/js/src/jsxml.cpp b/js/src/jsxml.cpp
index 2a80e588a1c9..f7f2fe1337b0 100644
--- a/js/src/jsxml.cpp
+++ b/js/src/jsxml.cpp
@@ -1171,7 +1171,7 @@ ParseNodeToQName(Parser *parser, JSParseNode *pn,
     JSObject *ns;
     JSLinearString *nsprefix;
 
-    JS_ASSERT(pn->pn_arity == PN_NULLARY);
+    JS_ASSERT(pn->isArity(PN_NULLARY));
     JSAtom *str = pn->pn_atom;
     start = str->chars();
     length = str->length();
@@ -1318,7 +1318,7 @@ ParseNodeToXML(Parser *parser, JSParseNode *pn,
     xml = NULL;
     if (!js_EnterLocalRootScope(cx))
         return NULL;
-    switch (pn->pn_type) {
+    switch (pn->getKind()) {
       case TOK_XMLELEM:
         length = inScopeNSes->length;
         pn2 = pn->pn_head;
@@ -1336,12 +1336,12 @@ ParseNodeToXML(Parser *parser, JSParseNode *pn,
         while ((pn2 = pn2->pn_next) != NULL) {
             if (!pn2->pn_next) {
                 /* Don't append the end tag! */
-                JS_ASSERT(pn2->pn_type == TOK_XMLETAGO);
+                JS_ASSERT(pn2->isKind(TOK_XMLETAGO));
                 break;
             }
 
             if ((flags & XSF_IGNORE_WHITESPACE) &&
-                n > 1 && pn2->pn_type == TOK_XMLSPACE) {
+                n > 1 && pn2->isKind(TOK_XMLSPACE)) {
                 --n;
                 continue;
             }
@@ -1392,7 +1392,7 @@ ParseNodeToXML(Parser *parser, JSParseNode *pn,
              * condition this on an XML.ignoreWhitespace setting when the list
              * constructor is XMLList (note XML/XMLList unification hazard).
              */
-            if (pn2->pn_type == TOK_XMLSPACE) {
+            if (pn2->isKind(TOK_XMLSPACE)) {
                 --n;
                 continue;
             }
@@ -1418,8 +1418,8 @@ ParseNodeToXML(Parser *parser, JSParseNode *pn,
       case TOK_XMLPTAGC:
         length = inScopeNSes->length;
         pn2 = pn->pn_head;
-        JS_ASSERT(pn2->pn_type == TOK_XMLNAME);
-        if (pn2->pn_arity == PN_LIST)
+        JS_ASSERT(pn2->isKind(TOK_XMLNAME));
+        if (pn2->isArity(PN_LIST))
             goto syntax;
 
         xml = js_NewXML(cx, JSXML_CLASS_ELEMENT);
@@ -1435,7 +1435,7 @@ ParseNodeToXML(Parser *parser, JSParseNode *pn,
             size_t length;
             const jschar *chars;
 
-            if (pn2->pn_type != TOK_XMLNAME || pn2->pn_arity != PN_NULLARY)
+            if (!pn2->isKind(TOK_XMLNAME) || !pn2->isArity(PN_NULLARY))
                 goto syntax;
 
             /* Enforce "Well-formedness constraint: Unique Att Spec". */
@@ -1455,7 +1455,7 @@ ParseNodeToXML(Parser *parser, JSParseNode *pn,
             JSAtom *atom = pn2->pn_atom;
             pn2 = pn2->pn_next;
             JS_ASSERT(pn2);
-            if (pn2->pn_type != TOK_XMLATTR)
+            if (!pn2->isKind(TOK_XMLATTR))
                 goto syntax;
 
             chars = atom->chars();
@@ -1552,7 +1552,7 @@ ParseNodeToXML(Parser *parser, JSParseNode *pn,
 
             pn2 = pn2->pn_next;
             JS_ASSERT(pn2);
-            JS_ASSERT(pn2->pn_type == TOK_XMLATTR);
+            JS_ASSERT(pn2->isKind(TOK_XMLATTR));
 
             attr = js_NewXML(cx, JSXML_CLASS_ATTRIBUTE);
             if (!attr)
@@ -1565,7 +1565,7 @@ ParseNodeToXML(Parser *parser, JSParseNode *pn,
         }
 
         /* Point tag closes its own namespace scope. */
-        if (pn->pn_type == TOK_XMLPTAGC)
+        if (pn->isKind(TOK_XMLPTAGC))
             XMLARRAY_TRUNCATE(cx, inScopeNSes, length);
         break;
 
@@ -1576,11 +1576,11 @@ ParseNodeToXML(Parser *parser, JSParseNode *pn,
       case TOK_XMLPI:
         str = pn->pn_atom;
         qn = NULL;
-        if (pn->pn_type == TOK_XMLCOMMENT) {
+        if (pn->isKind(TOK_XMLCOMMENT)) {
             if (flags & XSF_IGNORE_COMMENTS)
                 goto skip_child;
             xml_class = JSXML_CLASS_COMMENT;
-        } else if (pn->pn_type == TOK_XMLPI) {
+        } else if (pn->isKind(TOK_XMLPI)) {
             if (IS_XML(str)) {
                 Value v = StringValue(str);
                 JSAutoByteString bytes;
@@ -1609,7 +1609,7 @@ ParseNodeToXML(Parser *parser, JSParseNode *pn,
         if (!xml)
             goto fail;
         xml->name = qn;
-        if (pn->pn_type == TOK_XMLSPACE)
+        if (pn->isKind(TOK_XMLSPACE))
             xml->xml_flags |= XMLF_WHITESPACE_TEXT;
         xml->xml_value = str;
         break;

From f5d571372b737b3f4182741b46e6d0dd45f603ee Mon Sep 17 00:00:00 2001
From: Chris Leary <cdleary@mozilla.com>
Date: Wed, 14 Sep 2011 17:43:02 -0700
Subject: [PATCH 132/209] Fix SpiderMonkey build warning.

--HG--
extra : rebase_source : dfb62c170abef907f3584697cf5d40b37f93be5a
---
 js/src/jsparse.cpp | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/js/src/jsparse.cpp b/js/src/jsparse.cpp
index 0da9f55625ef..f606417859bf 100644
--- a/js/src/jsparse.cpp
+++ b/js/src/jsparse.cpp
@@ -6988,6 +6988,10 @@ CompExprTransplanter::transplant(JSParseNode *pn)
         if (!transplant(pn->pn_tree))
             return false;
         break;
+
+      case PN_NULLARY:
+        /* Nothing. */
+        break;
     }
     return true;
 }

From 21de2eb9d5a1d5b61a0d23200e3a828127658755 Mon Sep 17 00:00:00 2001
From: Alexander Surkov <surkov.alexander@gmail.com>
Date: Thu, 15 Sep 2011 11:33:16 +0900
Subject: [PATCH 133/209] Bug 685846 - DOMMenuItemActive is not fired for
 richlistitem of richlistbox autocomplete popup if it's selected repeatedly,
 r=enn

---
 toolkit/content/widgets/listbox.xml | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/toolkit/content/widgets/listbox.xml b/toolkit/content/widgets/listbox.xml
index 519a3f979826..0c10a70f4939 100644
--- a/toolkit/content/widgets/listbox.xml
+++ b/toolkit/content/widgets/listbox.xml
@@ -141,10 +141,12 @@
         </getter>
         <setter>
         <![CDATA[
-          if (val >= 0)
+          if (val >= 0) {
             this.selectItem(this.getItemAtIndex(val));
-          else
+          } else {
             this.clearSelection();
+            this.currentItem = null;
+          }
         ]]>
         </setter>
       </property>

From 4df687ca99c820ef73c8b11a4b8a6bfe96de169e Mon Sep 17 00:00:00 2001
From: Ehsan Akhgari <ehsan@mozilla.com>
Date: Tue, 13 Sep 2011 15:09:51 -0400
Subject: [PATCH 134/209] Bug 686247 - Text control frames should accept
 dynamic changes to the CSS overflow property; r=bzbarsky,surkov

---
 .../mochitest/tree/test_cssoverflow.html      | 22 +++++----------
 .../html/content/src/nsTextEditorState.cpp    | 27 ++++++++++++-------
 content/html/content/src/nsTextEditorState.h  |  2 ++
 .../editor/dynamic-overflow-change-ref.html   | 13 +++++++++
 .../editor/dynamic-overflow-change.html       | 13 +++++++++
 layout/reftests/editor/reftest.list           |  1 +
 layout/style/nsStyleStruct.cpp                |  4 +--
 7 files changed, 55 insertions(+), 27 deletions(-)
 create mode 100644 layout/reftests/editor/dynamic-overflow-change-ref.html
 create mode 100644 layout/reftests/editor/dynamic-overflow-change.html

diff --git a/accessible/tests/mochitest/tree/test_cssoverflow.html b/accessible/tests/mochitest/tree/test_cssoverflow.html
index 1a955f80cee1..7d58147138ea 100644
--- a/accessible/tests/mochitest/tree/test_cssoverflow.html
+++ b/accessible/tests/mochitest/tree/test_cssoverflow.html
@@ -35,10 +35,6 @@
         new invokerChecker(EVENT_FOCUS, getAccessible, this.linkNode)
       ];
 
-      this.unexpectedEventSeq = [
-        new invokerChecker(EVENT_REORDER, this.linkNode.parentNode)
-      ];
-
       this.invoke = function focusAnchor_invoke()
       {
         this.linkNode.focus();
@@ -46,8 +42,8 @@
 
       this.check = function focusAnchor_check(aEvent)
       {
-        is(this.link, aEvent.accessible,
-           "The link accessible shouldn't be recreated!");
+        todo_is(this.link, aEvent.accessible,
+                "Focus should be fired against new link accessible!");
       }
 
       this.getID = function focusAnchor_getID()
@@ -65,10 +61,6 @@
         new invokerChecker(EVENT_FOCUS, getAccessible, this.linkNode)
       ];
 
-      this.unexpectedEventSeq = [
-        new invokerChecker(EVENT_REORDER, this.linkNode.parentNode)
-      ];
-
       this.invoke = function tabAnchor_invoke()
       {
         synthesizeKey("VK_TAB", { shiftKey: false });
@@ -76,8 +68,8 @@
 
       this.check = function tabAnchor_check(aEvent)
       {
-        is(this.link, aEvent.accessible,
-           "The link accessible shouldn't be recreated!");
+        todo_is(this.link, aEvent.accessible,
+                   "Focus should be fired against new link accessible!");
       }
 
       this.getID = function tabAnchor_getID()
@@ -126,9 +118,9 @@
     Mozilla Bug 570275
   </a><br>
   <a target="_blank"
-     title="Don't recreate frames for inlines with overflow style applied"
-     href="https://bugzilla.mozilla.org/show_bug.cgi?id=606087">
-    Mozilla Bug 606087
+     title="Text control frames should accept dynamic changes to the CSS overflow property"
+     href="https://bugzilla.mozilla.org/show_bug.cgi?id=686247">
+    Mozilla Bug 686247
   </a><br>
 
   <p id="display"></p>
diff --git a/content/html/content/src/nsTextEditorState.cpp b/content/html/content/src/nsTextEditorState.cpp
index b91a54bd083c..28b24cf6ef24 100644
--- a/content/html/content/src/nsTextEditorState.cpp
+++ b/content/html/content/src/nsTextEditorState.cpp
@@ -1058,6 +1058,9 @@ nsTextEditorState::BindToFrame(nsTextControlFrame* aFrame)
 
   nsIContent *rootNode = GetRootNode();
 
+  nsresult rv = InitializeRootNode();
+  NS_ENSURE_SUCCESS(rv, rv);
+
   nsIPresShell *shell = mBoundFrame->PresContext()->GetPresShell();
   NS_ENSURE_TRUE(shell, NS_ERROR_FAILURE);
 
@@ -1545,6 +1548,17 @@ nsTextEditorState::CreateRootNode()
                                   NOT_FROM_PARSER);
   NS_ENSURE_SUCCESS(rv, rv);
 
+  if (!IsSingleLineTextControl()) {
+    mMutationObserver = new nsAnonDivObserver(this);
+    mRootNode->AddMutationObserver(mMutationObserver);
+  }
+
+  return rv;
+}
+
+nsresult
+nsTextEditorState::InitializeRootNode()
+{
   // Set the necessary classes on the text control. We use class values
   // instead of a 'style' attribute so that the style comes from a user-agent
   // style sheet and is still applied even if author styles are disabled.
@@ -1564,19 +1578,12 @@ nsTextEditorState::CreateRootNode()
         disp->mOverflowX != NS_STYLE_OVERFLOW_CLIP) {
       classValue.AppendLiteral(" inherit-overflow");
     }
-
-    mMutationObserver = new nsAnonDivObserver(this);
-    NS_ENSURE_TRUE(mMutationObserver, NS_ERROR_OUT_OF_MEMORY);
-    mRootNode->AddMutationObserver(mMutationObserver);
   }
-  rv = mRootNode->SetAttr(kNameSpaceID_None, nsGkAtoms::_class,
-                          classValue, PR_FALSE);
+  nsresult rv = mRootNode->SetAttr(kNameSpaceID_None, nsGkAtoms::_class,
+                                   classValue, PR_FALSE);
   NS_ENSURE_SUCCESS(rv, rv);
 
-  rv = mBoundFrame->UpdateValueDisplay(PR_FALSE);
-  NS_ENSURE_SUCCESS(rv, rv);
-
-  return rv;
+  return mBoundFrame->UpdateValueDisplay(PR_FALSE);
 }
 
 nsresult
diff --git a/content/html/content/src/nsTextEditorState.h b/content/html/content/src/nsTextEditorState.h
index 2e6a6b3a408f..56d162dddb38 100644
--- a/content/html/content/src/nsTextEditorState.h
+++ b/content/html/content/src/nsTextEditorState.h
@@ -253,6 +253,8 @@ private:
   void DestroyEditor();
   void Clear();
 
+  nsresult InitializeRootNode();
+
   void FinishedRestoringSelection() { mRestoringSelection = nsnull; }
 
   class InitializationGuard {
diff --git a/layout/reftests/editor/dynamic-overflow-change-ref.html b/layout/reftests/editor/dynamic-overflow-change-ref.html
new file mode 100644
index 000000000000..52e5f5bb0dd1
--- /dev/null
+++ b/layout/reftests/editor/dynamic-overflow-change-ref.html
@@ -0,0 +1,13 @@
+<!DOCTYPE html>
+<html>
+  <body>
+    <textarea rows="2" style="overflow: hidden;">
+      this
+      is
+      a
+      textarea
+      with
+      overflow
+    </textarea>
+  </body>
+</html>
diff --git a/layout/reftests/editor/dynamic-overflow-change.html b/layout/reftests/editor/dynamic-overflow-change.html
new file mode 100644
index 000000000000..57a1b8f74efe
--- /dev/null
+++ b/layout/reftests/editor/dynamic-overflow-change.html
@@ -0,0 +1,13 @@
+<!DOCTYPE html>
+<html>
+  <body onload="document.querySelector('textarea').style.overflow='hidden'">
+    <textarea rows="2">
+      this
+      is
+      a
+      textarea
+      with
+      overflow
+    </textarea>
+  </body>
+</html>
diff --git a/layout/reftests/editor/reftest.list b/layout/reftests/editor/reftest.list
index 95c0302400d0..4c51f4040478 100644
--- a/layout/reftests/editor/reftest.list
+++ b/layout/reftests/editor/reftest.list
@@ -69,3 +69,4 @@ skip-if(Android) == 674212-spellcheck.html 674212-spellcheck-ref.html
 skip-if(Android) == 338427-2.html 338427-2-ref.html
 skip-if(Android) == 338427-3.html 338427-3-ref.html
 skip-if(Android) == 462758-grabbers-resizers.html 462758-grabbers-resizers-ref.html
+== dynamic-overflow-change.html dynamic-overflow-change-ref.html
diff --git a/layout/style/nsStyleStruct.cpp b/layout/style/nsStyleStruct.cpp
index 06a7f5cb2341..f6217f120d76 100644
--- a/layout/style/nsStyleStruct.cpp
+++ b/layout/style/nsStyleStruct.cpp
@@ -2180,8 +2180,8 @@ nsChangeHint nsStyleDisplay::CalcDifference(const nsStyleDisplay& aOther) const
       || mPosition != aOther.mPosition
       || mDisplay != aOther.mDisplay
       || (mFloats == NS_STYLE_FLOAT_NONE) != (aOther.mFloats == NS_STYLE_FLOAT_NONE)
-      || (mOverflowX != aOther.mOverflowX && mDisplay != NS_STYLE_DISPLAY_INLINE)
-      || (mOverflowY != aOther.mOverflowY && mDisplay != NS_STYLE_DISPLAY_INLINE)
+      || mOverflowX != aOther.mOverflowX
+      || mOverflowY != aOther.mOverflowY
       || mResize != aOther.mResize)
     NS_UpdateHint(hint, nsChangeHint_ReconstructFrame);
 

From c8732ad9d743bf58df74388f91cb24f895d267d0 Mon Sep 17 00:00:00 2001
From: Ehsan Akhgari <ehsan@mozilla.com>
Date: Tue, 13 Sep 2011 15:40:27 -0400
Subject: [PATCH 135/209] Bug 686507 - Don't spam my console when processing
 IPDL files; r=bsmedberg DONTBUILD

---
 ipc/ipdl/ipdl.py | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/ipc/ipdl/ipdl.py b/ipc/ipdl/ipdl.py
index 468f242ff5e2..e47cd108a3d1 100755
--- a/ipc/ipdl/ipdl.py
+++ b/ipc/ipdl/ipdl.py
@@ -82,7 +82,7 @@ def normalizedFilename(f):
 
 # First pass: parse and type-check all protocols
 for f in files:
-    log(1, os.path.basename(f))
+    log(2, os.path.basename(f))
     filename = normalizedFilename(f)
     if f == '-':
         fd = sys.stdin

From 0d3883215784df8d67ea3144132272d6ebf353f3 Mon Sep 17 00:00:00 2001
From: Mounir Lamouri <mounir.lamouri@gmail.com>
Date: Tue, 13 Sep 2011 14:32:07 -0700
Subject: [PATCH 136/209] Bug 686545 - Fix build bustage with
 nsRefreshDriver/nsARefreshObserver not being defined. r=ehsan

The buld bustage only appears with some options being disabled in the
mozconfig. Likely, nsRefreshDriver.h is included by another hedear that isn't
included when an option is disabled.
---
 accessible/src/base/NotificationController.h | 1 +
 layout/base/nsPresShell.h                    | 1 +
 2 files changed, 2 insertions(+)

diff --git a/accessible/src/base/NotificationController.h b/accessible/src/base/NotificationController.h
index 7a8e5a317726..4d68413313f3 100644
--- a/accessible/src/base/NotificationController.h
+++ b/accessible/src/base/NotificationController.h
@@ -41,6 +41,7 @@
 
 #include "AccEvent.h"
 #include "nsCycleCollectionParticipant.h"
+#include "nsRefreshDriver.h"
 
 class nsAccessible;
 class nsDocAccessible;
diff --git a/layout/base/nsPresShell.h b/layout/base/nsPresShell.h
index 5bd3e9486fbb..9fd75d425f0e 100644
--- a/layout/base/nsPresShell.h
+++ b/layout/base/nsPresShell.h
@@ -73,6 +73,7 @@
 #include "nsFrameSelection.h"
 #include "nsGUIEvent.h"
 #include "nsContentUtils.h"
+#include "nsRefreshDriver.h"
 
 class nsIRange;
 class nsIDragService;

From 3ae9a18f24ffa50f24d46bd3d3b4216a4628da5b Mon Sep 17 00:00:00 2001
From: Brian Hackett <bhackett1024@gmail.com>
Date: Tue, 13 Sep 2011 15:01:46 -0700
Subject: [PATCH 137/209] [INFER] Fix code discarding for JM+TM integration,
 bug 685358.

---
 .../tests/basic/wrap-primitive-this.js        |  3 +-
 js/src/jsinterp.cpp                           | 76 ++------------
 js/src/jsinterp.h                             |  7 +-
 js/src/methodjit/Compiler.cpp                 |  2 +-
 js/src/methodjit/InvokeHelpers.cpp            | 98 +++++++++----------
 js/src/methodjit/MethodJIT.cpp                |  2 +-
 js/src/methodjit/MethodJIT.h                  |  7 +-
 js/src/methodjit/StubCalls.h                  |  4 +-
 8 files changed, 72 insertions(+), 127 deletions(-)

diff --git a/js/src/jit-test/tests/basic/wrap-primitive-this.js b/js/src/jit-test/tests/basic/wrap-primitive-this.js
index 5c9db8085c4a..dd8d4adfba01 100644
--- a/js/src/jit-test/tests/basic/wrap-primitive-this.js
+++ b/js/src/jit-test/tests/basic/wrap-primitive-this.js
@@ -15,9 +15,10 @@
 var HOTLOOP = this.tracemonkey ? tracemonkey.HOTLOOP : 8;
 var a;
 function f(n) {
-    for (var i = 0; i < HOTLOOP; i++)
+  for (var i = 0; i < HOTLOOP; i++) {
         if (i == HOTLOOP - 2)
             a = this;
+  }
 }
 
 /*
diff --git a/js/src/jsinterp.cpp b/js/src/jsinterp.cpp
index 56780927883e..9755668b760d 100644
--- a/js/src/jsinterp.cpp
+++ b/js/src/jsinterp.cpp
@@ -1599,10 +1599,14 @@ static inline void
 TypeCheckNextBytecode(JSContext *cx, JSScript *script, unsigned n, const FrameRegs &regs)
 {
 #ifdef DEBUG
-    if (cx->typeInferenceEnabled() &&
-        *regs.pc != JSOP_TRAP &&
+    if (*regs.pc != JSOP_TRAP &&
         n == analyze::GetBytecodeLength(regs.pc)) {
-        TypeScript::CheckBytecode(cx, script, regs.pc, regs.sp);
+        if (script->hasAnalysis() && !regs.fp()->hasImacropc()) {
+            jsbytecode *nextpc = regs.pc + GetBytecodeLength(cx, script, regs.pc);
+            JS_ASSERT(regs.sp == regs.fp()->base() + script->analysis()->getCode(nextpc).stackDepth);
+        }
+        if (cx->typeInferenceEnabled())
+            TypeScript::CheckBytecode(cx, script, regs.pc, regs.sp);
     }
 #endif
 }
@@ -1828,30 +1832,12 @@ js::Interpret(JSContext *cx, StackFrame *entryFrame, InterpMode interpMode)
             goto error;                                                       \
     JS_END_MACRO
 
-#if defined(JS_TRACER) && defined(JS_METHODJIT)
-# define LEAVE_ON_SAFE_POINT()                                                \
-    do {                                                                      \
-        JS_ASSERT_IF(leaveOnSafePoint, !TRACE_RECORDER(cx));                  \
-        JS_ASSERT_IF(leaveOnSafePoint, !TRACE_PROFILER(cx));                  \
-        JS_ASSERT_IF(leaveOnSafePoint, interpMode != JSINTERP_NORMAL);        \
-        if (leaveOnSafePoint && !regs.fp()->hasImacropc() &&                  \
-            script->maybeNativeCodeForPC(regs.fp()->isConstructing(), regs.pc)) { \
-            JS_ASSERT(!TRACE_RECORDER(cx));                                   \
-            interpReturnOK = true;                                            \
-            goto leave_on_safe_point;                                         \
-        }                                                                     \
-    } while (0)
-#else
-# define LEAVE_ON_SAFE_POINT() /* nop */
-#endif
-
 #define BRANCH(n)                                                             \
     JS_BEGIN_MACRO                                                            \
         regs.pc += (n);                                                       \
         op = (JSOp) *regs.pc;                                                 \
         if ((n) <= 0)                                                         \
             goto check_backedge;                                              \
-        LEAVE_ON_SAFE_POINT();                                                \
         DO_OP();                                                              \
     JS_END_MACRO
 
@@ -1887,13 +1873,6 @@ js::Interpret(JSContext *cx, StackFrame *entryFrame, InterpMode interpMode)
     Value *argv = regs.fp()->maybeFormalArgs();
     CHECK_INTERRUPT_HANDLER();
 
-#if defined(JS_TRACER) && defined(JS_METHODJIT)
-    bool leaveOnSafePoint = (interpMode == JSINTERP_SAFEPOINT);
-# define CLEAR_LEAVE_ON_TRACE_POINT() ((void) (leaveOnSafePoint = false))
-#else
-# define CLEAR_LEAVE_ON_TRACE_POINT() ((void) 0)
-#endif
-
     if (!entryFrame)
         entryFrame = regs.fp();
 
@@ -2078,17 +2057,8 @@ js::Interpret(JSContext *cx, StackFrame *entryFrame, InterpMode interpMode)
             LoopProfile *prof = TRACE_PROFILER(cx);
             JS_ASSERT(!TRACE_RECORDER(cx));
             LoopProfile::ProfileAction act = prof->profileOperation(cx, op);
-            switch (act) {
-                case LoopProfile::ProfComplete:
-                    if (interpMode != JSINTERP_NORMAL) {
-                        leaveOnSafePoint = true;
-                        LEAVE_ON_SAFE_POINT();
-                    }
-                    break;
-                default:
-                    moreInterrupts = true;
-                    break;
-            }
+            if (act != LoopProfile::ProfComplete)
+                moreInterrupts = true;
         }
 #endif
         if (TraceRecorder* tr = TRACE_RECORDER(cx)) {
@@ -2096,23 +2066,6 @@ js::Interpret(JSContext *cx, StackFrame *entryFrame, InterpMode interpMode)
             AbortableRecordingStatus status = tr->monitorRecording(op);
             JS_ASSERT_IF(cx->isExceptionPending(), status == ARECORD_ERROR);
 
-            if (interpMode != JSINTERP_NORMAL) {
-                JS_ASSERT(interpMode == JSINTERP_RECORD || JSINTERP_SAFEPOINT);
-                switch (status) {
-                  case ARECORD_IMACRO_ABORTED:
-                  case ARECORD_ABORTED:
-                  case ARECORD_COMPLETED:
-                  case ARECORD_STOP:
-#ifdef JS_METHODJIT
-                    leaveOnSafePoint = true;
-                    LEAVE_ON_SAFE_POINT();
-#endif
-                    break;
-                  default:
-                    break;
-                }
-            }
-
             switch (status) {
               case ARECORD_CONTINUE:
                 moreInterrupts = true;
@@ -2121,7 +2074,6 @@ js::Interpret(JSContext *cx, StackFrame *entryFrame, InterpMode interpMode)
               case ARECORD_IMACRO_ABORTED:
                 atoms = rt->atomState.commonAtomsStart();
                 op = JSOp(*regs.pc);
-                CLEAR_LEAVE_ON_TRACE_POINT();
                 if (status == ARECORD_IMACRO)
                     DO_OP();    /* keep interrupting for op. */
                 break;
@@ -2166,7 +2118,7 @@ END_EMPTY_CASES
 
 BEGIN_CASE(JSOP_TRACE)
 BEGIN_CASE(JSOP_NOTRACE)
-    LEAVE_ON_SAFE_POINT();
+    /* No-op */
 END_CASE(JSOP_TRACE)
 
 check_backedge:
@@ -2183,7 +2135,6 @@ check_backedge:
             JS_ASSERT(!TRACE_PROFILER(cx));
             MONITOR_BRANCH_TRACEVIS;
             ENABLE_INTERRUPTS();
-            CLEAR_LEAVE_ON_TRACE_POINT();
         }
         JS_ASSERT_IF(cx->isExceptionPending(), r == MONITOR_ERROR);
         RESTORE_INTERP_VARS_CHECK_EXCEPTION();
@@ -2308,7 +2259,6 @@ BEGIN_CASE(JSOP_STOP)
         if (js_CodeSpec[*imacpc].format & JOF_DECOMPOSE)
             regs.pc += GetDecomposeLength(imacpc, js_CodeSpec[*imacpc].length);
         regs.fp()->clearImacropc();
-        LEAVE_ON_SAFE_POINT();
         atoms = script->atoms;
         op = JSOp(*regs.pc);
         DO_OP();
@@ -5409,12 +5359,6 @@ END_VARLEN_CASE
 BEGIN_CASE(JSOP_EXCEPTION)
     PUSH_COPY(cx->getPendingException());
     cx->clearPendingException();
-#if defined(JS_TRACER) && defined(JS_METHODJIT)
-    if (interpMode == JSINTERP_PROFILE) {
-        leaveOnSafePoint = true;
-        LEAVE_ON_SAFE_POINT();
-    }
-#endif
     CHECK_BRANCH();
 END_CASE(JSOP_EXCEPTION)
 
diff --git a/js/src/jsinterp.h b/js/src/jsinterp.h
index f4e013db1b25..afd132cb0e42 100644
--- a/js/src/jsinterp.h
+++ b/js/src/jsinterp.h
@@ -235,10 +235,9 @@ enum InterpMode
 {
     JSINTERP_NORMAL    = 0, /* interpreter is running normally */
     JSINTERP_RECORD    = 1, /* interpreter has been started to record/run traces */
-    JSINTERP_SAFEPOINT = 2, /* interpreter should leave on a method JIT safe point */
-    JSINTERP_PROFILE   = 3, /* interpreter should profile a loop */
-    JSINTERP_REJOIN    = 4, /* as normal, but the frame has already started */
-    JSINTERP_SKIP_TRAP = 5  /* as REJOIN, but skip trap at first opcode */
+    JSINTERP_PROFILE   = 2, /* interpreter should profile a loop */
+    JSINTERP_REJOIN    = 3, /* as normal, but the frame has already started */
+    JSINTERP_SKIP_TRAP = 4  /* as REJOIN, but skip trap at first opcode */
 };
 
 /*
diff --git a/js/src/methodjit/Compiler.cpp b/js/src/methodjit/Compiler.cpp
index 915febab0e46..5033afb996a6 100644
--- a/js/src/methodjit/Compiler.cpp
+++ b/js/src/methodjit/Compiler.cpp
@@ -6790,7 +6790,7 @@ mjit::Compiler::jumpAndTrace(Jump j, jsbytecode *target, Jump *slow, bool *tramp
         jsbytecode* pc = PC;
         PC = target;
 
-        OOL_STUBCALL(stubs::InvokeTracer, REJOIN_FINISH_FRAME);
+        OOL_STUBCALL(stubs::InvokeTracer, REJOIN_RUN_TRACER);
 
         PC = pc;
     }
diff --git a/js/src/methodjit/InvokeHelpers.cpp b/js/src/methodjit/InvokeHelpers.cpp
index 56713712b877..58cdde0883cf 100644
--- a/js/src/methodjit/InvokeHelpers.cpp
+++ b/js/src/methodjit/InvokeHelpers.cpp
@@ -177,10 +177,17 @@ top:
 static void
 InlineReturn(VMFrame &f)
 {
+    bool shiftResult = f.fp()->loweredCallOrApply();
+
     JS_ASSERT(f.fp() != f.entryfp);
     JS_ASSERT(!IsActiveWithOrBlock(f.cx, f.fp()->scopeChain(), 0));
     f.cx->stack.popInlineFrame(f.regs);
 
+    if (shiftResult) {
+        f.regs.sp[-2] = f.regs.sp[-1];
+        f.regs.sp--;
+    }
+
     DebugOnly<JSOp> op = js_GetOpcode(f.cx, f.fp()->script(), f.regs.pc);
     JS_ASSERT(op == JSOP_CALL ||
               op == JSOP_NEW ||
@@ -774,18 +781,6 @@ HandleErrorInExcessFrame(VMFrame &f, StackFrame *stopFp, bool searchedTopmostFra
     return returnOK;
 }
 
-/* Returns whether the current PC has method JIT'd code. */
-static inline void *
-AtSafePoint(JSContext *cx)
-{
-    StackFrame *fp = cx->fp();
-    if (fp->hasImacropc())
-        return NULL;
-
-    JSScript *script = fp->script();
-    return script->maybeNativeCodeForPC(fp->isConstructing(), cx->regs().pc);
-}
-
 /*
  * Interprets until either a safe point is reached that has method JIT'd
  * code, or the current frame tries to return.
@@ -795,16 +790,12 @@ PartialInterpret(VMFrame &f)
 {
     JSContext *cx = f.cx;
     StackFrame *fp = cx->fp();
-
-#ifdef DEBUG
-    JSScript *script = fp->script();
     JS_ASSERT(!fp->finishedInInterpreter());
-    JS_ASSERT(fp->hasImacropc() ||
-              !script->maybeNativeCodeForPC(fp->isConstructing(), cx->regs().pc));
-#endif
 
-    JSBool ok = JS_TRUE;
-    ok = Interpret(cx, fp, JSINTERP_SAFEPOINT);
+    JS_ASSERT(!cx->compartment->jaegerCompartment()->finishingTracer);
+    cx->compartment->jaegerCompartment()->finishingTracer = true;
+    JSBool ok = Interpret(cx, fp, JSINTERP_REJOIN);
+    cx->compartment->jaegerCompartment()->finishingTracer = false;
 
     return ok;
 }
@@ -916,13 +907,6 @@ EvaluateExcessFrame(VMFrame &f, StackFrame *entryFrame)
     if (!fp->hasImacropc() && FrameIsFinished(cx))
         return HandleFinishedFrame(f, entryFrame);
 
-    if (void *ncode = AtSafePoint(cx)) {
-        if (!JaegerShotAtSafePoint(cx, ncode, false))
-            return false;
-        InlineReturn(f);
-        return true;
-    }
-
     return PartialInterpret(f);
 }
 
@@ -1013,10 +997,10 @@ js::mjit::ResetTraceHint(JSScript *script, jsbytecode *pc, uint16_t index, bool
 }
 
 #if JS_MONOIC
-void *
+JSBool
 RunTracer(VMFrame &f, ic::TraceICInfo &ic)
 #else
-void *
+JSBool
 RunTracer(VMFrame &f)
 #endif
 {
@@ -1026,7 +1010,14 @@ RunTracer(VMFrame &f)
 
     /* :TODO: nuke PIC? */
     if (!cx->traceJitEnabled)
-        return NULL;
+        return false;
+
+    /*
+     * Don't reenter the tracer while finishing frames we bailed out from,
+     * to avoid over-recursing.
+     */
+    if (cx->compartment->jaegerCompartment()->finishingTracer)
+        return false;
 
     /*
      * Force initialization of the entry frame's scope chain and return value,
@@ -1073,6 +1064,9 @@ RunTracer(VMFrame &f)
         tpa = MonitorTracePoint(f.cx, &blacklist, traceData, traceEpoch,
                                 loopCounter, hits);
         JS_ASSERT(!TRACE_RECORDER(cx));
+
+        if (tpa != TPA_Nothing)
+            ClearAllFrames(cx->compartment);
     }
 
 #if JS_MONOIC
@@ -1090,11 +1084,11 @@ RunTracer(VMFrame &f)
     JS_ASSERT(f.fp() == cx->fp());
     switch (tpa) {
       case TPA_Nothing:
-        return NULL;
+        return false;
 
       case TPA_Error:
         if (!HandleErrorInExcessFrame(f, entryFrame, f.fp()->finishedInInterpreter()))
-            THROWV(NULL);
+            THROWV(false);
         JS_ASSERT(!cx->fp()->hasImacropc());
         break;
 
@@ -1130,7 +1124,7 @@ RunTracer(VMFrame &f)
   restart:
     /* Step 1. Finish frames created after the entry frame. */
     if (!FinishExcessFrames(f, entryFrame))
-        THROWV(NULL);
+        THROWV(false);
 
     /* IMacros are guaranteed to have been removed by now. */
     JS_ASSERT(f.fp() == entryFrame);
@@ -1139,21 +1133,14 @@ RunTracer(VMFrame &f)
     /* Step 2. If entryFrame is done, use a special path to return to EnterMethodJIT(). */
     if (FrameIsFinished(cx)) {
         if (!HandleFinishedFrame(f, entryFrame))
-            THROWV(NULL);
-        void *addr = *f.returnAddressLocation();
-        if (addr != JS_FUNC_TO_DATA_PTR(void *, JaegerInterpoline))
-            *f.returnAddressLocation() = cx->jaegerCompartment()->forceReturnFromFastCall();
-        return NULL;
+            THROWV(false);
+        return true;
     }
 
-    /* Step 3. If entryFrame is at a safe point, just leave. */
-    if (void *ncode = AtSafePoint(cx))
-        return ncode;
-
-    /* Step 4. Do a partial interp, then restart the whole process. */
+    /* Step 3. Do a partial interp, then restart the whole process. */
     if (!PartialInterpret(f)) {
         if (!HandleErrorInExcessFrame(f, entryFrame))
-            THROWV(NULL);
+            THROWV(false);
     }
 
     goto restart;
@@ -1163,7 +1150,7 @@ RunTracer(VMFrame &f)
 
 #if defined JS_TRACER
 # if defined JS_MONOIC
-void *JS_FASTCALL
+JSBool JS_FASTCALL
 stubs::InvokeTracer(VMFrame &f, ic::TraceICInfo *ic)
 {
     return RunTracer(f, *ic);
@@ -1171,7 +1158,7 @@ stubs::InvokeTracer(VMFrame &f, ic::TraceICInfo *ic)
 
 # else
 
-void *JS_FASTCALL
+JSBool JS_FASTCALL
 stubs::InvokeTracer(VMFrame &f)
 {
     return RunTracer(f);
@@ -1572,10 +1559,21 @@ js_InternalInterpret(void *returnData, void *returnType, void *returnReg, js::VM
         break;
       }
 
-      case REJOIN_FINISH_FRAME:
-        /* InvokeTracer finishes the frame it is given, including the epilogue. */
-        if (fp->isFunctionFrame())
-            fp->markFunctionEpilogueDone();
+      case REJOIN_RUN_TRACER:
+        if (returnReg) {
+            /* InvokeTracer finishes the frame it is given, including the epilogue. */
+            if (fp->isFunctionFrame())
+                fp->markFunctionEpilogueDone();
+            if (fp != f.entryfp) {
+                InlineReturn(f);
+                cx->compartment->jaegerCompartment()->setLastUnfinished(Jaeger_Unfinished);
+                *f.oldregs = f.regs;
+                return NULL;
+            } else {
+                cx->compartment->jaegerCompartment()->setLastUnfinished(Jaeger_Returned);
+                return NULL;
+            }
+        }
         break;
 
       default:
diff --git a/js/src/methodjit/MethodJIT.cpp b/js/src/methodjit/MethodJIT.cpp
index 9492f5d87539..a72307a01415 100644
--- a/js/src/methodjit/MethodJIT.cpp
+++ b/js/src/methodjit/MethodJIT.cpp
@@ -894,7 +894,7 @@ mjit::EnterMethodJIT(JSContext *cx, StackFrame *fp, void *code, Value *stackLimi
 
     JaegerStatus status = cx->compartment->jaegerCompartment()->lastUnfinished();
     if (status) {
-        if (partial) {
+        if (partial || status == Jaeger_Returned) {
             /*
              * Being called from the interpreter, which will resume execution
              * where the JIT left off.
diff --git a/js/src/methodjit/MethodJIT.h b/js/src/methodjit/MethodJIT.h
index 434ba7ad3703..b89401eb0599 100644
--- a/js/src/methodjit/MethodJIT.h
+++ b/js/src/methodjit/MethodJIT.h
@@ -319,8 +319,8 @@ enum RejoinState {
      */
     REJOIN_BRANCH,
 
-    /* Calls to RunTracer which finished the given frame. */
-    REJOIN_FINISH_FRAME
+    /* Calls to RunTracer which either finished the frame or did nothing. */
+    REJOIN_RUN_TRACER
 };
 
 /* Helper to watch for recompilation and frame expansion activity on a compartment. */
@@ -463,6 +463,9 @@ class JaegerCompartment {
      */
     Vector<StackFrame *, 8, SystemAllocPolicy> orphanedNativeFrames;
     Vector<JSC::ExecutablePool *, 8, SystemAllocPolicy> orphanedNativePools;
+
+    /* Whether frames pushed after bailing out in RunTracer are unwinding. */
+    bool finishingTracer;
 };
 
 /*
diff --git a/js/src/methodjit/StubCalls.h b/js/src/methodjit/StubCalls.h
index 41c712a24b7e..7c9e72b21d93 100644
--- a/js/src/methodjit/StubCalls.h
+++ b/js/src/methodjit/StubCalls.h
@@ -114,9 +114,9 @@ void UncachedNewHelper(VMFrame &f, uint32 argc, UncachedCallResult *ucr);
 void JS_FASTCALL CreateThis(VMFrame &f, JSObject *proto);
 void JS_FASTCALL Throw(VMFrame &f);
 #if JS_MONOIC
-void * JS_FASTCALL InvokeTracer(VMFrame &f, ic::TraceICInfo *tic);
+JSBool JS_FASTCALL InvokeTracer(VMFrame &f, ic::TraceICInfo *tic);
 #else
-void * JS_FASTCALL InvokeTracer(VMFrame &f);
+JSBool JS_FASTCALL InvokeTracer(VMFrame &f);
 #endif
 
 void * JS_FASTCALL LookupSwitch(VMFrame &f, jsbytecode *pc);

From 346534afd197068fb471ca0085876ead5e024f83 Mon Sep 17 00:00:00 2001
From: Margaret Leibovic <margaret.leibovic@gmail.com>
Date: Tue, 13 Sep 2011 16:42:37 -0700
Subject: [PATCH 138/209] Bug 685302 - Use "website" instead of "web site"
 consistently across all strings in the UI. r=dao

---
 browser/locales/en-US/chrome/browser/browser.dtd     |  6 +++---
 .../locales/en-US/chrome/browser/browser.properties  |  6 +++---
 browser/locales/en-US/chrome/browser/pageInfo.dtd    | 10 +++++-----
 .../locales/en-US/chrome/browser/pageInfo.properties |  6 +++---
 .../browser/preferences/aboutPermissions.properties  |  4 ++--
 .../en-US/chrome/browser/preferences/advanced.dtd    |  2 +-
 .../en-US/chrome/browser/preferences/permissions.dtd |  2 +-
 .../browser/preferences/preferences.properties       |  8 ++++----
 .../en-US/chrome/browser/preferences/privacy.dtd     |  4 ++--
 .../en-US/chrome/overrides/appstrings.properties     |  2 +-
 browser/locales/en-US/chrome/overrides/netError.dtd  |  4 ++--
 dom/locales/en-US/chrome/appstrings.properties       |  2 +-
 dom/locales/en-US/chrome/netError.dtd                |  4 ++--
 mobile/locales/en-US/chrome/browser.dtd              |  2 +-
 mobile/locales/en-US/chrome/browser.properties       |  2 +-
 .../en-US/chrome/overrides/appstrings.properties     |  2 +-
 mobile/locales/en-US/chrome/overrides/netError.dtd   |  2 +-
 .../locales/en-US/chrome/pipnss/security.properties  |  4 ++--
 .../locales/en-US/chrome/pippki/certManager.dtd      |  4 ++--
 .../manager/locales/en-US/chrome/pippki/pippki.dtd   |  2 +-
 .../locales/en-US/chrome/pippki/pippki.properties    | 12 ++++++------
 toolkit/locales/en-US/chrome/global/aboutRights.dtd  |  4 ++--
 toolkit/locales/en-US/chrome/global/aboutSupport.dtd |  2 +-
 .../en-US/chrome/mozapps/extensions/update.dtd       |  2 +-
 24 files changed, 49 insertions(+), 49 deletions(-)

diff --git a/browser/locales/en-US/chrome/browser/browser.dtd b/browser/locales/en-US/chrome/browser/browser.dtd
index 9b538f4be77d..ef9590507bc6 100644
--- a/browser/locales/en-US/chrome/browser/browser.dtd
+++ b/browser/locales/en-US/chrome/browser/browser.dtd
@@ -296,7 +296,7 @@ can reach it easily. -->
 <!ENTITY appMenuSafeMode.accesskey "R">
 
 <!ENTITY openCmd.commandkey           "l">
-<!ENTITY urlbar.placeholder           "Go to a Web Site">
+<!ENTITY urlbar.placeholder           "Go to a Website">
 <!ENTITY urlbar.accesskey             "d">
 <!ENTITY urlbar.switchToTab.label     "Switch to tab:">
 
@@ -492,7 +492,7 @@ you can use these alternative items. Otherwise, their values should be empty.  -
 <!ENTITY pageStylePersistentOnly.label "Basic Page Style">
 <!ENTITY pageStylePersistentOnly.accesskey "b">
 
-<!ENTITY pageReportIcon.tooltip            "Change pop-up blocking settings for this web site">
+<!ENTITY pageReportIcon.tooltip            "Change pop-up blocking settings for this website">
 
 <!ENTITY allowPopups.accesskey "p">
 <!-- On Windows we use the term "Options" to describe settings, but
@@ -524,7 +524,7 @@ you can use these alternative items. Otherwise, their values should be empty.  -
 <!ENTITY editBookmark.cancel.label                   "Cancel">
 <!ENTITY editBookmark.removeBookmark.accessKey       "R">
 
-<!ENTITY identity.unverifiedsite2 "This web site does not supply identity information.">
+<!ENTITY identity.unverifiedsite2 "This website does not supply identity information.">
 <!ENTITY identity.connectedTo "You are connected to">
 <!-- Localization note (identity.runBy) : This string appears between a
 domain name (above) and an organization name (below). E.g.
diff --git a/browser/locales/en-US/chrome/browser/browser.properties b/browser/locales/en-US/chrome/browser/browser.properties
index da966fb05876..3e4383cc6bb4 100644
--- a/browser/locales/en-US/chrome/browser/browser.properties
+++ b/browser/locales/en-US/chrome/browser/browser.properties
@@ -205,11 +205,11 @@ identity.identified.verifier=Verified by: %S
 identity.identified.verified_by_you=You have added a security exception for this site.
 identity.identified.state_and_country=%S, %S
 
-identity.encrypted=Your connection to this web site is encrypted to prevent eavesdropping.
-identity.unencrypted=Your connection to this web site is not encrypted.
+identity.encrypted=Your connection to this website is encrypted to prevent eavesdropping.
+identity.unencrypted=Your connection to this website is not encrypted.
 identity.mixed_content=Your connection to this site is only partially encrypted, and does not prevent eavesdropping.
 
-identity.unknown.tooltip=This web site does not supply identity information.
+identity.unknown.tooltip=This website does not supply identity information.
 
 identity.ownerUnknown2=(unknown)
 
diff --git a/browser/locales/en-US/chrome/browser/pageInfo.dtd b/browser/locales/en-US/chrome/browser/pageInfo.dtd
index 4fc6bb7adf13..b45f59c9ba6d 100644
--- a/browser/locales/en-US/chrome/browser/pageInfo.dtd
+++ b/browser/locales/en-US/chrome/browser/pageInfo.dtd
@@ -111,17 +111,17 @@
 <!ENTITY  securityView.unknown   "Unknown">
 
 
-<!ENTITY  securityView.identity.header   "Web Site Identity">
+<!ENTITY  securityView.identity.header   "Website Identity">
 <!ENTITY  securityView.identity.owner    "Owner:">
-<!ENTITY  securityView.identity.domain   "Web site:">
+<!ENTITY  securityView.identity.domain   "Website:">
 <!ENTITY  securityView.identity.verifier "Verified by:">
 
 <!ENTITY  securityView.privacy.header                   "Privacy &amp; History">
-<!ENTITY  securityView.privacy.history                  "Have I visited this web site prior to today?">
-<!ENTITY  securityView.privacy.cookies                  "Is this web site storing information (cookies) on my computer?">
+<!ENTITY  securityView.privacy.history                  "Have I visited this website prior to today?">
+<!ENTITY  securityView.privacy.cookies                  "Is this website storing information (cookies) on my computer?">
 <!ENTITY  securityView.privacy.viewCookies              "View Cookies">
 <!ENTITY  securityView.privacy.viewCookies.accessKey    "k">
-<!ENTITY  securityView.privacy.passwords                "Have I saved any passwords for this web site?">
+<!ENTITY  securityView.privacy.passwords                "Have I saved any passwords for this website?">
 <!ENTITY  securityView.privacy.viewPasswords            "View Saved Passwords">
 <!ENTITY  securityView.privacy.viewPasswords.accessKey  "w">
 
diff --git a/browser/locales/en-US/chrome/browser/pageInfo.properties b/browser/locales/en-US/chrome/browser/pageInfo.properties
index d7a879639399..aa4ca0a61a31 100644
--- a/browser/locales/en-US/chrome/browser/pageInfo.properties
+++ b/browser/locales/en-US/chrome/browser/pageInfo.properties
@@ -70,13 +70,13 @@ generalStrictMode=Standards compliance mode
 generalSize=%S KB (%S bytes)
 generalMetaTag=Meta (1 tag)
 generalMetaTags=Meta (%S tags)
-generalSiteIdentity=This web site is owned by %S\nThis has been verified by %S
+generalSiteIdentity=This website is owned by %S\nThis has been verified by %S
 
 feedRss=RSS
 feedAtom=Atom
 feedXML=XML
 
-securityNoOwner=This web site does not supply ownership information.
+securityNoOwner=This website does not supply ownership information.
 securityOneVisit=Yes, once
 securityNVisits=Yes, %S times
 
@@ -85,4 +85,4 @@ securityNVisits=Yes, %S times
 #   e.g. indexedDBUsage : "50.23 MB"
 #   %1$S = size (in bytes or megabytes, ...)
 #   %2$S = unit of measure (bytes, KB, MB, ...)
-indexedDBUsage=This web site is using %1$S %2$S
+indexedDBUsage=This website is using %1$S %2$S
diff --git a/browser/locales/en-US/chrome/browser/preferences/aboutPermissions.properties b/browser/locales/en-US/chrome/browser/preferences/aboutPermissions.properties
index 52b2eba63040..62b389318e89 100644
--- a/browser/locales/en-US/chrome/browser/preferences/aboutPermissions.properties
+++ b/browser/locales/en-US/chrome/browser/preferences/aboutPermissions.properties
@@ -1,5 +1,5 @@
 # LOCALIZATION NOTE (visitCount): #1 is the number of history visits for a site
 visitCount=#1 visit;#1 visits
 
-passwordsCount=#1 password is stored for this web site.;#1 passwords are stored for this web site.
-cookiesCount=#1 cookie is set for this web site.;#1 cookies are set for this web site.
+passwordsCount=#1 password is stored for this website.;#1 passwords are stored for this website.
+cookiesCount=#1 cookie is set for this website.;#1 cookies are set for this website.
diff --git a/browser/locales/en-US/chrome/browser/preferences/advanced.dtd b/browser/locales/en-US/chrome/browser/preferences/advanced.dtd
index ba3421e6db15..7b13e2ee7660 100644
--- a/browser/locales/en-US/chrome/browser/preferences/advanced.dtd
+++ b/browser/locales/en-US/chrome/browser/preferences/advanced.dtd
@@ -8,7 +8,7 @@
 <!ENTITY useCursorNavigation.accesskey   "c">
 <!ENTITY searchStartTyping.label         "Search for text when I start typing">
 <!ENTITY searchStartTyping.accesskey     "x">
-<!ENTITY blockAutoRefresh.label          "Warn me when web sites try to redirect or reload the page">
+<!ENTITY blockAutoRefresh.label          "Warn me when websites try to redirect or reload the page">
 <!ENTITY blockAutoRefresh.accesskey      "b">
 
 <!ENTITY browsing.label                  "Browsing">
diff --git a/browser/locales/en-US/chrome/browser/preferences/permissions.dtd b/browser/locales/en-US/chrome/browser/preferences/permissions.dtd
index 84634f5df07f..de8e411677a9 100644
--- a/browser/locales/en-US/chrome/browser/preferences/permissions.dtd
+++ b/browser/locales/en-US/chrome/browser/preferences/permissions.dtd
@@ -7,7 +7,7 @@
 <!ENTITY removepermission.accesskey   "R">
 <!ENTITY removeallpermissions.label   "Remove All Sites">
 <!ENTITY removeallpermissions.accesskey "e">
-<!ENTITY address.label                "Address of web site:">
+<!ENTITY address.label                "Address of website:">
 <!ENTITY address.accesskey            "d">
 <!ENTITY block.label                  "Block">
 <!ENTITY block.accesskey              "B">
diff --git a/browser/locales/en-US/chrome/browser/preferences/preferences.properties b/browser/locales/en-US/chrome/browser/preferences/preferences.properties
index b78dd9866975..086e270e72a1 100644
--- a/browser/locales/en-US/chrome/browser/preferences/preferences.properties
+++ b/browser/locales/en-US/chrome/browser/preferences/preferences.properties
@@ -11,13 +11,13 @@ labelDefaultFont=Default (%S)
 
 #### Permissions Manager
 
-cookiepermissionstext=You can specify which web sites are always or never allowed to use cookies.  Type the exact address of the site you want to manage and then click Block, Allow for Session, or Allow.
+cookiepermissionstext=You can specify which websites are always or never allowed to use cookies.  Type the exact address of the site you want to manage and then click Block, Allow for Session, or Allow.
 cookiepermissionstitle=Exceptions - Cookies
-addonspermissionstext=You can specify which web sites are allowed to install add-ons. Type the exact address of the site you want to allow and then click Allow.
+addonspermissionstext=You can specify which websites are allowed to install add-ons. Type the exact address of the site you want to allow and then click Allow.
 addons_permissions_title=Allowed Sites - Add-ons Installation
-popuppermissionstext=You can specify which web sites are allowed to open pop-up windows. Type the exact address of the site you want to allow and then click Allow.
+popuppermissionstext=You can specify which websites are allowed to open pop-up windows. Type the exact address of the site you want to allow and then click Allow.
 popuppermissionstitle=Allowed Sites - Pop-ups
-imagepermissionstext=You can specify which web sites are allowed to load images. Type the exact address of the site you want to manage and then click Block or Allow.
+imagepermissionstext=You can specify which websites are allowed to load images. Type the exact address of the site you want to manage and then click Block or Allow.
 imagepermissionstitle=Exceptions - Images
 invalidURI=Please enter a valid hostname
 invalidURITitle=Invalid Hostname Entered
diff --git a/browser/locales/en-US/chrome/browser/preferences/privacy.dtd b/browser/locales/en-US/chrome/browser/preferences/privacy.dtd
index 48baec34bae8..df4e7866724f 100644
--- a/browser/locales/en-US/chrome/browser/preferences/privacy.dtd
+++ b/browser/locales/en-US/chrome/browser/preferences/privacy.dtd
@@ -1,6 +1,6 @@
 <!ENTITY tracking.label                 "Tracking">
 
-<!ENTITY doNotTrack.label               "Tell web sites I do not want to be tracked">
+<!ENTITY doNotTrack.label               "Tell websites I do not want to be tracked">
 <!ENTITY doNotTrack.accesskey           "d">
 
 <!ENTITY  history.label                 "History">
@@ -42,7 +42,7 @@
 <!ENTITY  historyHeader.custom.label       "Use custom settings for history">
 <!ENTITY  historyHeader.post.label         "">
 
-<!ENTITY  rememberDescription.label      "&brandShortName; will remember your browsing, download, form and search history, and keep cookies from Web sites you visit.">
+<!ENTITY  rememberDescription.label      "&brandShortName; will remember your browsing, download, form and search history, and keep cookies from websites you visit.">
 
 <!-- LOCALIZATION NOTE (rememberActions.pre.label): include a trailing space as needed -->
 <!-- LOCALIZATION NOTE (rememberActions.middle.label): include a starting and trailing space as needed -->
diff --git a/browser/locales/en-US/chrome/overrides/appstrings.properties b/browser/locales/en-US/chrome/overrides/appstrings.properties
index cf83185e26f2..b87d1be476bf 100644
--- a/browser/locales/en-US/chrome/overrides/appstrings.properties
+++ b/browser/locales/en-US/chrome/overrides/appstrings.properties
@@ -61,7 +61,7 @@ externalProtocolUnknown=<Unknown>
 externalProtocolChkMsg=Remember my choice for all links of this type.
 externalProtocolLaunchBtn=Launch application
 malwareBlocked=The site at %S has been reported as an attack site and has been blocked based on your security preferences.
-phishingBlocked=The web site at %S has been reported as a web forgery designed to trick users into sharing personal or financial information.
+phishingBlocked=The website at %S has been reported as a web forgery designed to trick users into sharing personal or financial information.
 cspFrameAncestorBlocked=This page has a content security policy that prevents it from being embedded in this way.
 corruptedContentError=The page you are trying to view cannot be shown because an error in the data transmission was detected.
 remoteXUL=This page uses an unsupported technology that is no longer available by default in Firefox.
diff --git a/browser/locales/en-US/chrome/overrides/netError.dtd b/browser/locales/en-US/chrome/overrides/netError.dtd
index 59f35cbefbf5..c15db2fed0d8 100644
--- a/browser/locales/en-US/chrome/overrides/netError.dtd
+++ b/browser/locales/en-US/chrome/overrides/netError.dtd
@@ -126,7 +126,7 @@
 <!ENTITY nssFailure2.longDesc "
 <ul>
   <li>The page you are trying to view can not be shown because the authenticity of the received data could not be verified.</li>
-  <li>Please contact the web site owners to inform them of this problem. Alternatively, use the command found in the help menu to report this broken site.</li>
+  <li>Please contact the website owners to inform them of this problem. Alternatively, use the command found in the help menu to report this broken site.</li>
 </ul>
 ">
 
@@ -154,7 +154,7 @@ be temporary, and you can try again later.</li>
 <!ENTITY malwareBlocked.title "Suspected Attack Site!">
 <!ENTITY malwareBlocked.longDesc "
 <p>Attack sites try to install programs that steal private information, use your computer to attack others, or damage your system.</p>
-<p>Web site owners who believe their site has been reported as an attack site in error may <a href='http://www.stopbadware.org/home/reviewinfo' >request a review</a>.</p>
+<p>Website owners who believe their site has been reported as an attack site in error may <a href='http://www.stopbadware.org/home/reviewinfo' >request a review</a>.</p>
 ">
 
 <!ENTITY phishingBlocked.title "Suspected Web Forgery!">
diff --git a/dom/locales/en-US/chrome/appstrings.properties b/dom/locales/en-US/chrome/appstrings.properties
index 0fe089ff7020..af740b5e007f 100644
--- a/dom/locales/en-US/chrome/appstrings.properties
+++ b/dom/locales/en-US/chrome/appstrings.properties
@@ -60,7 +60,7 @@ externalProtocolUnknown=<Unknown>
 externalProtocolChkMsg=Remember my choice for all links of this type.
 externalProtocolLaunchBtn=Launch application
 malwareBlocked=The site at %S has been reported as an attack site and has been blocked based on your security preferences.
-phishingBlocked=The web site at %S has been reported as a web forgery designed to trick users into sharing personal or financial information.
+phishingBlocked=The website at %S has been reported as a web forgery designed to trick users into sharing personal or financial information.
 cspFrameAncestorBlocked=This page has a content security policy that prevents it from being embedded in this way.
 corruptedContentError=The page you are trying to view cannot be shown because an error in the data transmission was detected.
 remoteXUL=This page uses an unsupported technology that is no longer available by default.
diff --git a/dom/locales/en-US/chrome/netError.dtd b/dom/locales/en-US/chrome/netError.dtd
index fa9a4c05b375..ea97efaea348 100644
--- a/dom/locales/en-US/chrome/netError.dtd
+++ b/dom/locales/en-US/chrome/netError.dtd
@@ -59,7 +59,7 @@
 <!ENTITY unknownSocketType.longDesc "<p>The site responded to the network request in an unexpected way and the browser cannot continue.</p>">
 
 <!ENTITY nssFailure2.title "Secure Connection Failed">
-<!ENTITY nssFailure2.longDesc "<p>The page you are trying to view can not be shown because the authenticity of the received data could not be verified.</p><ul><li>Please contact the web site owners to inform them of this problem.</li></ul>">
+<!ENTITY nssFailure2.longDesc "<p>The page you are trying to view can not be shown because the authenticity of the received data could not be verified.</p><ul><li>Please contact the website owners to inform them of this problem.</li></ul>">
 
 <!ENTITY nssBadCert.title "Secure Connection Failed">
 <!ENTITY nssBadCert.longDesc2 "<ul>
@@ -71,7 +71,7 @@
 <!ENTITY malwareBlocked.title "Suspected Attack Site!">
 <!ENTITY malwareBlocked.longDesc "
 <p>Attack sites try to install programs that steal private information, use your computer to attack others, or damage your system.</p>
-<p>Web site owners who believe their site has been reported as an attack site in error may <a href='http://www.stopbadware.org/home/reviewinfo' >request a review</a>.</p>
+<p>Website owners who believe their site has been reported as an attack site in error may <a href='http://www.stopbadware.org/home/reviewinfo' >request a review</a>.</p>
 ">
 
 <!ENTITY phishingBlocked.title "Suspected Web Forgery!">
diff --git a/mobile/locales/en-US/chrome/browser.dtd b/mobile/locales/en-US/chrome/browser.dtd
index 2c2f3d030b89..30cfe049210f 100644
--- a/mobile/locales/en-US/chrome/browser.dtd
+++ b/mobile/locales/en-US/chrome/browser.dtd
@@ -71,7 +71,7 @@
 <!ENTITY bookmarkEdit.label        "Edit">
 <!ENTITY bookmarkShortcut.label    "Add to Home Screen">
 
-<!ENTITY identity.unverifiedsite2 "This web site does not supply identity information.">
+<!ENTITY identity.unverifiedsite2 "This website does not supply identity information.">
 <!ENTITY identity.connectedTo2 "Connected to">
 <!-- Localization note (identity.runBy2)
  The layout of the identity dialog prevents combining this into a single string with
diff --git a/mobile/locales/en-US/chrome/browser.properties b/mobile/locales/en-US/chrome/browser.properties
index 5f8d93ca2a5c..e4f679d5a1e4 100644
--- a/mobile/locales/en-US/chrome/browser.properties
+++ b/mobile/locales/en-US/chrome/browser.properties
@@ -135,7 +135,7 @@ identity.identified.state_and_country=%S, %S
 identity.identified.title_with_country=%S (%S)
 identity.encrypted2=Encrypted
 identity.unencrypted2=Not encrypted
-identity.unknown.tooltip=This web site does not supply identity information.
+identity.unknown.tooltip=This website does not supply identity information.
 identity.ownerUnknown2=(unknown)
 
 # Geolocation UI
diff --git a/mobile/locales/en-US/chrome/overrides/appstrings.properties b/mobile/locales/en-US/chrome/overrides/appstrings.properties
index cf83185e26f2..b87d1be476bf 100644
--- a/mobile/locales/en-US/chrome/overrides/appstrings.properties
+++ b/mobile/locales/en-US/chrome/overrides/appstrings.properties
@@ -61,7 +61,7 @@ externalProtocolUnknown=<Unknown>
 externalProtocolChkMsg=Remember my choice for all links of this type.
 externalProtocolLaunchBtn=Launch application
 malwareBlocked=The site at %S has been reported as an attack site and has been blocked based on your security preferences.
-phishingBlocked=The web site at %S has been reported as a web forgery designed to trick users into sharing personal or financial information.
+phishingBlocked=The website at %S has been reported as a web forgery designed to trick users into sharing personal or financial information.
 cspFrameAncestorBlocked=This page has a content security policy that prevents it from being embedded in this way.
 corruptedContentError=The page you are trying to view cannot be shown because an error in the data transmission was detected.
 remoteXUL=This page uses an unsupported technology that is no longer available by default in Firefox.
diff --git a/mobile/locales/en-US/chrome/overrides/netError.dtd b/mobile/locales/en-US/chrome/overrides/netError.dtd
index 0490abf678cc..c30021b1e4e0 100644
--- a/mobile/locales/en-US/chrome/overrides/netError.dtd
+++ b/mobile/locales/en-US/chrome/overrides/netError.dtd
@@ -121,7 +121,7 @@
 <!ENTITY nssFailure2.longDesc "
 <ul>
   <li>The page you are trying to view can not be shown because the authenticity of the received data could not be verified.</li>
-  <li>Please contact the web site owners to inform them of this problem. Alternatively, use the command found in the help menu to report this broken site.</li>
+  <li>Please contact the website owners to inform them of this problem. Alternatively, use the command found in the help menu to report this broken site.</li>
 </ul>
 ">
 
diff --git a/security/manager/locales/en-US/chrome/pipnss/security.properties b/security/manager/locales/en-US/chrome/pipnss/security.properties
index 1ea6e76a7e88..ebe05494ae7e 100644
--- a/security/manager/locales/en-US/chrome/pipnss/security.properties
+++ b/security/manager/locales/en-US/chrome/pipnss/security.properties
@@ -39,8 +39,8 @@
 Title=Security Warning
 MixedContentMessage=You have requested an encrypted page that contains some unencrypted information. Information that you see or enter on this page could easily be read by a third party.
 LeaveSecureMessage=You are about to leave an encrypted page. Information you send or receive from now on could easily be read by a third party.
-EnterSecureMessage=You have requested an encrypted page. The web site has identified itself correctly, and information you see or enter on this page can't easily be read by a third party.
-WeakSecureMessage=You have requested a page that uses low-grade encryption. The web site has identified itself correctly, but information you see or enter on this page could be read by a third party. 
+EnterSecureMessage=You have requested an encrypted page. The website has identified itself correctly, and information you see or enter on this page can't easily be read by a third party.
+WeakSecureMessage=You have requested a page that uses low-grade encryption. The website has identified itself correctly, but information you see or enter on this page could be read by a third party. 
 PostToInsecureFromSecureMessage=Although this page is encrypted, the information you have entered is to be sent over an unencrypted connection and could easily be read by a third party.##Are you sure you want to continue sending this information?##
 PostToInsecureFromInsecureMessage=The information you have entered is to be sent over an unencrypted connection and could easily be read by a third party.##Are you sure you want to continue sending this information?##
 MixedContentShowAgain=Alert me whenever I'm about to view an encrypted page that contains some unencrypted information.
diff --git a/security/manager/locales/en-US/chrome/pippki/certManager.dtd b/security/manager/locales/en-US/chrome/pippki/certManager.dtd
index 6bd9537cc8d1..294899b0b74b 100644
--- a/security/manager/locales/en-US/chrome/pippki/certManager.dtd
+++ b/security/manager/locales/en-US/chrome/pippki/certManager.dtd
@@ -72,9 +72,9 @@
 
 <!ENTITY certmgr.editcert.title               "Edit Security Certificate Settings">
 <!ENTITY certmgr.editcacert.title             "Edit CA certificate trust settings">
-<!ENTITY certmgr.editsslcert.title            "Edit web site certificate trust settings">
+<!ENTITY certmgr.editsslcert.title            "Edit website certificate trust settings">
 <!ENTITY certmgr.editcert.edittrust           "Edit trust settings:">
-<!ENTITY certmgr.editcert.trustssl            "This certificate can identify web sites.">
+<!ENTITY certmgr.editcert.trustssl            "This certificate can identify websites.">
 <!ENTITY certmgr.editcert.trustemail          "This certificate can identify mail users.">
 <!ENTITY certmgr.editcert.trustobjsign        "This certificate can identify software makers.">
 <!ENTITY certmgr.editsslcert.edittrust        "Edit certificate trust settings:">
diff --git a/security/manager/locales/en-US/chrome/pippki/pippki.dtd b/security/manager/locales/en-US/chrome/pippki/pippki.dtd
index d0622119e138..2fedb5f95430 100644
--- a/security/manager/locales/en-US/chrome/pippki/pippki.dtd
+++ b/security/manager/locales/en-US/chrome/pippki/pippki.dtd
@@ -70,7 +70,7 @@
 <!-- Downloading a cert -->
 <!ENTITY downloadCert.title "Downloading Certificate">
 <!ENTITY downloadCert.message1 "You have been asked to trust a new Certificate Authority (CA).">
-<!ENTITY downloadCert.trustSSL "Trust this CA to identify web sites.">
+<!ENTITY downloadCert.trustSSL "Trust this CA to identify websites.">
 <!ENTITY downloadCert.trustEmail "Trust this CA to identify email users.">
 <!ENTITY downloadCert.trustObjSign "Trust this CA to identify software developers.">
 <!ENTITY downloadCert.message3 "Before trusting this CA for any purpose, you should examine its certificate and its policy and procedures (if available).">
diff --git a/security/manager/locales/en-US/chrome/pippki/pippki.properties b/security/manager/locales/en-US/chrome/pippki/pippki.properties
index 9e9eb1dece7c..801b03f043e0 100644
--- a/security/manager/locales/en-US/chrome/pippki/pippki.properties
+++ b/security/manager/locales/en-US/chrome/pippki/pippki.properties
@@ -98,12 +98,12 @@ clientAuthMessage1=Organization: "%S"
 clientAuthMessage2=Issued Under: "%S"
 
 #Page Info
-pageInfo_SiteNotVerified=Web Site Identity Not Verified
-pageInfo_WebSiteVerified=Web Site Identity Verified
-pageInfo_Identity_Verified=The web site %S supports authentication for the page you are viewing. The identity of this web site has been verified by %S, a certificate authority you trust for this purpose.
-pageInfo_ViewCertificate=View the security certificate that verifies this web site's identity.
+pageInfo_SiteNotVerified=Website Identity Not Verified
+pageInfo_WebSiteVerified=Website Identity Verified
+pageInfo_Identity_Verified=The website %S supports authentication for the page you are viewing. The identity of this website has been verified by %S, a certificate authority you trust for this purpose.
+pageInfo_ViewCertificate=View the security certificate that verifies this website's identity.
 pageInfo_NoEncryption=Connection Not Encrypted
-pageInfo_Privacy_None1=The web site %S does not support encryption for the page you are viewing.
+pageInfo_Privacy_None1=The website %S does not support encryption for the page you are viewing.
 pageInfo_Privacy_None2=Information sent over the Internet without encryption can be seen by other people while it is in transit. 
 pageInfo_Privacy_None3=The page you are viewing is not encrypted.
 # LOCALIZATION NOTE (pageInfo_StrongEncryptionWithBits): %1$S is the name of the encryption standard,
@@ -114,7 +114,7 @@ pageInfo_Privacy_Strong2=Encryption makes it very difficult for unauthorized peo
 # LOCALIZATION NOTE (pageInfo_WeakEncryptionWithBits): %1$S is the name of the encryption standard,
 # %2$S is the key size of the cipher.
 pageInfo_WeakEncryptionWithBits=Connection Encrypted: Low-grade Encryption (%1$S, %2$S bit keys)
-pageInfo_Privacy_Weak1=The web site %S is using low-grade encryption for the page you are viewing.
+pageInfo_Privacy_Weak1=The website %S is using low-grade encryption for the page you are viewing.
 pageInfo_Privacy_Weak2=Low-grade encryption may allow some unauthorized people to view this information.
 pageInfo_MixedContent=Connection Partially Encrypted
 pageInfo_Privacy_Mixed1=Parts of the page you are viewing were not encrypted before being transmitted over the Internet.
diff --git a/toolkit/locales/en-US/chrome/global/aboutRights.dtd b/toolkit/locales/en-US/chrome/global/aboutRights.dtd
index 55ba2fc32835..9ae748026fff 100644
--- a/toolkit/locales/en-US/chrome/global/aboutRights.dtd
+++ b/toolkit/locales/en-US/chrome/global/aboutRights.dtd
@@ -38,7 +38,7 @@
 
 <!-- point 4 text for unbranded builds -->
 <!ENTITY rights.intro-point4a-unbranded "If this product incorporates web services, any applicable service terms for the service(s) should be linked to the ">
-<!ENTITY rights.intro-point4b-unbranded "Web Site Services">
+<!ENTITY rights.intro-point4b-unbranded "Website Services">
 <!ENTITY rights.intro-point4c-unbranded " section.">
 
 <!ENTITY rights2.webservices-header "&brandFullName; Web-Based Information Services">
@@ -70,7 +70,7 @@
 <!ENTITY rights.locationawarebrowsing-term4 "Location-Aware Browsing is now disabled">
 
 <!-- intro paragraph for unbranded builds -->
-<!ENTITY rights.webservices-unbranded "An overview of the web site services the product incorporates, along with instructions on how to disable them, if applicable, should be included here.">
+<!ENTITY rights.webservices-unbranded "An overview of the website services the product incorporates, along with instructions on how to disable them, if applicable, should be included here.">
 
 <!-- point 1 text for unbranded builds -->
 <!ENTITY rights.webservices-term1-unbranded "Any applicable service terms for this product should be listed here.">
diff --git a/toolkit/locales/en-US/chrome/global/aboutSupport.dtd b/toolkit/locales/en-US/chrome/global/aboutSupport.dtd
index b220c07a5b0e..7394f3b56612 100644
--- a/toolkit/locales/en-US/chrome/global/aboutSupport.dtd
+++ b/toolkit/locales/en-US/chrome/global/aboutSupport.dtd
@@ -4,7 +4,7 @@
 <!ENTITY aboutSupport.pageSubtitle "
   This page contains technical information that might be useful when you're
   trying to solve a problem. If you are looking for answers to common questions
-  about &brandShortName;, check out our <a id='supportLink'>support web site</a>.
+  about &brandShortName;, check out our <a id='supportLink'>support website</a>.
 ">
 
 <!ENTITY aboutSupport.extensionsTitle "Extensions">
diff --git a/toolkit/locales/en-US/chrome/mozapps/extensions/update.dtd b/toolkit/locales/en-US/chrome/mozapps/extensions/update.dtd
index 6558e75ebc3c..d7f990c2b101 100644
--- a/toolkit/locales/en-US/chrome/mozapps/extensions/update.dtd
+++ b/toolkit/locales/en-US/chrome/mozapps/extensions/update.dtd
@@ -21,7 +21,7 @@
 <!ENTITY  found.top.label                 "Select the add-ons you would like to install:">
 <!ENTITY  found.disabledXPinstall.label   "These updates can't be installed because software installation is currently
                                            disabled. You can change this setting below.">
-<!ENTITY  found.enableXPInstall.label     "Allow web sites to install software">
+<!ENTITY  found.enableXPInstall.label     "Allow websites to install software">
 <!ENTITY  found.enableXPInstall.accesskey "A">
 
 <!ENTITY  installing.wizard.title         "Installing Compatible Add-ons">

From 26a04bcc03d0401163d3f5d0b85305fbba726a62 Mon Sep 17 00:00:00 2001
From: Justin Wood <Callek@gmail.com>
Date: Wed, 14 Sep 2011 06:33:12 -0400
Subject: [PATCH 139/209] Address review comment for Bug 680113 that I missed
 when checking in. r=Unfocused

---
 .../extensions/test/browser/browser_select_selection.js       | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/toolkit/mozapps/extensions/test/browser/browser_select_selection.js b/toolkit/mozapps/extensions/test/browser/browser_select_selection.js
index f4fd564640a6..92943113b136 100644
--- a/toolkit/mozapps/extensions/test/browser/browser_select_selection.js
+++ b/toolkit/mozapps/extensions/test/browser/browser_select_selection.js
@@ -78,9 +78,9 @@ function getSourceString(aSource) {
 
   var strings = Services.strings.createBundle("chrome://mozapps/locale/extensions/selectAddons.properties");
   switch (aSource) {
-    case AddonManager.SCOPE_APPLICATION:
+    case APP:
       return strings.GetStringFromName("source.bundled");
-    case AddonManager.SCOPE_PROFILE:
+    case PROFILE:
       return strings.GetStringFromName("source.profile");
     default:
       return strings.GetStringFromName("source.other");

From 0366796b41bb69aa0f5b1f64c3898c2ec1b2d9b2 Mon Sep 17 00:00:00 2001
From: Matt Brubeck <mbrubeck@mozilla.com>
Date: Wed, 14 Sep 2011 06:39:25 -0700
Subject: [PATCH 140/209] Bug 686380 - Hide the undo close tab thumbnail when
 switching or opening tabs [r=mfinkle]

---
 mobile/chrome/content/browser-ui.js | 24 ++++++++++++------------
 mobile/chrome/content/browser.js    | 13 ++++++++++---
 mobile/chrome/content/common-ui.js  |  8 +++-----
 3 files changed, 25 insertions(+), 20 deletions(-)

diff --git a/mobile/chrome/content/browser-ui.js b/mobile/chrome/content/browser-ui.js
index e627d6c060fa..92d51578be06 100644
--- a/mobile/chrome/content/browser-ui.js
+++ b/mobile/chrome/content/browser-ui.js
@@ -64,6 +64,7 @@ let Elements = {};
   ["contentShowing",     "bcast_contentShowing"],
   ["urlbarState",        "bcast_urlbarState"],
   ["stack",              "stack"],
+  ["tabList",            "tabs"],
   ["tabs",               "tabs-container"],
   ["controls",           "browser-controls"],
   ["panelUI",            "panel-container"],
@@ -383,7 +384,7 @@ var BrowserUI = {
 
   sizeControls: function(windowW, windowH) {
     // tabs
-    document.getElementById("tabs").resize();
+    Elements.tabList.resize();
     AwesomeScreen.doResize(windowW, windowH);
 
     // content navigator helper
@@ -665,6 +666,7 @@ var BrowserUI = {
     // new page is opened, so a call to Browser.hideSidebars() fill this
     // requirement and fix the sidebars position.
     Browser.hideSidebars();
+    Elements.tabList.removeClosedTab();
 
     // Delay doing the fixup so the raw URI is passed to loadURIWithFlags
     // and the proper third-party fixup can be done
@@ -781,6 +783,7 @@ var BrowserUI = {
   selectTab: function selectTab(aTab) {
     AwesomeScreen.activePanel = null;
     Browser.selectedTab = aTab;
+    Elements.tabList.removeClosedTab();
   },
 
   undoCloseTab: function undoCloseTab(aIndex) {
@@ -907,18 +910,14 @@ var BrowserUI = {
         this._tabSelect(aEvent);
         break;
       case "TabOpen":
-      case "TabRemove":
-      {
-        // Workaround to hide the tabstrip if it is partially visible
-        // See bug 524469 and bug 626660
-        let [tabsVisibility,,,] = Browser.computeSidebarVisibility();
-        if (tabsVisibility > 0.0 && tabsVisibility < 1.0)
-          Browser.hideSidebars();
-
+        Elements.tabList.removeClosedTab();
+        Browser.hidePartialTabSidebar();
         break;
-      }
-      case "PanFinished":
-        let tabs = document.getElementById("tabs");
+      case "TabRemove":
+        Browser.hidePartialTabSidebar();
+        break;
+      case "PanFinished": {
+        let tabs = Elements.tabList;
         let [tabsVisibility,,oldLeftWidth, oldRightWidth] = Browser.computeSidebarVisibility();
         if (tabsVisibility == 0.0 && tabs.hasClosedTab) {
           let { x: x1, y: y1 } = Browser.getScrollboxPosition(Browser.controlsScrollboxScroller);
@@ -936,6 +935,7 @@ var BrowserUI = {
           Browser.tryFloatToolbar(0, 0);
         }
         break;
+      }
       case "SizeChanged":
         this.sizeControls(ViewableAreaObserver.width, ViewableAreaObserver.height);
         break;
diff --git a/mobile/chrome/content/browser.js b/mobile/chrome/content/browser.js
index 5f13785a3d2f..d63567929221 100644
--- a/mobile/chrome/content/browser.js
+++ b/mobile/chrome/content/browser.js
@@ -554,6 +554,13 @@ var Browser = {
     this.tryUnfloatToolbar();
   },
 
+  /** Workaround to hide the tabstrip if it is partially visible (bug 524469 and bug 626660) */
+  hidePartialTabSidebar: function hidePartialSidebars() {
+    let [tabsVisibility,,,] = this.computeSidebarVisibility();
+    if (tabsVisibility > 0.0 && tabsVisibility < 1.0)
+      this.hideSidebars();
+  },
+
   hideTitlebar: function hideTitlebar() {
     let rect = Elements.browsers.getBoundingClientRect();
     this.pageScrollboxScroller.scrollBy(0, Math.round(rect.top));
@@ -2847,7 +2854,7 @@ Tab.prototype = {
   },
 
   create: function create(aURI, aParams) {
-    this._chromeTab = document.getElementById("tabs").addTab();
+    this._chromeTab = Elements.tabList.addTab();
     let browser = this._createBrowser(aURI, null);
 
     // Should we fully load the new browser, or wait until later
@@ -2866,7 +2873,7 @@ Tab.prototype = {
   },
 
   destroy: function destroy() {
-    document.getElementById("tabs").removeTab(this._chromeTab);
+    Elements.tabList.removeTab(this._chromeTab);
     this._chromeTab = null;
     this._destroyBrowser();
   },
@@ -3092,7 +3099,7 @@ Tab.prototype = {
       browser.setAttribute("type", "content-primary");
       Elements.browsers.selectedPanel = notification;
       browser.active = true;
-      document.getElementById("tabs").selectedTab = this._chromeTab;
+      Elements.tabList.selectedTab = this._chromeTab;
       browser.focus();
     } else {
       browser.messageManager.sendAsyncMessage("Browser:Blur", { });
diff --git a/mobile/chrome/content/common-ui.js b/mobile/chrome/content/common-ui.js
index 3cd9d1cd2225..556c609bae67 100644
--- a/mobile/chrome/content/common-ui.js
+++ b/mobile/chrome/content/common-ui.js
@@ -445,13 +445,11 @@ var NewTabPopup = {
       let boxRect = this.box.getBoundingClientRect();
       this.box.top = tabRect.top + (tabRect.height / 2) - (boxRect.height / 2);
 
-      let tabs = document.getElementById("tabs");
-
       // We don't use anchorTo() here because the tab
       // being anchored to might be overflowing the tabs
       // scrollbox which confuses the dynamic arrow direction
       // calculation (see bug 662520).
-      if (tabs.getBoundingClientRect().left < 0)
+      if (Elements.tabList.getBoundingClientRect().left < 0)
         this.box.pointLeftAt(aTab);
       else
         this.box.pointRightAt(aTab);
@@ -523,7 +521,7 @@ var FindHelperUI = {
     Elements.browsers.addEventListener("PanFinished", this, false);
 
     // Listen for events where form assistant should be closed
-    document.getElementById("tabs").addEventListener("TabSelect", this, true);
+    Elements.tabList.addEventListener("TabSelect", this, true);
     Elements.browsers.addEventListener("URLChanged", this, true);
   },
 
@@ -675,7 +673,7 @@ var FormHelperUI = {
     messageManager.addMessageListener("FormAssist:AutoComplete", this);
 
     // Listen for events where form assistant should be closed or updated
-    let tabs = document.getElementById("tabs");
+    let tabs = Elements.tabList;
     tabs.addEventListener("TabSelect", this, true);
     tabs.addEventListener("TabClose", this, true);
     Elements.browsers.addEventListener("URLChanged", this, true);

From 916d4e1930bc6029dbe1bc1aa6a0f93200aec9d8 Mon Sep 17 00:00:00 2001
From: Josh Aas <joshmoz@gmail.com>
Date: Wed, 14 Sep 2011 12:20:26 -0400
Subject: [PATCH 141/209] Bug 686538: Update to npapi-sdk r13. r=roc

---
 dom/plugins/base/npapi.h   | 4 +++-
 dom/plugins/base/nptypes.h | 2 +-
 2 files changed, 4 insertions(+), 2 deletions(-)

diff --git a/dom/plugins/base/npapi.h b/dom/plugins/base/npapi.h
index ccf41be7c4ba..e5baad9cec83 100644
--- a/dom/plugins/base/npapi.h
+++ b/dom/plugins/base/npapi.h
@@ -411,7 +411,9 @@ typedef enum {
 
   NPNVprivateModeBool = 18,
 
-  NPNVsupportsAdvancedKeyHandling = 21
+  NPNVsupportsAdvancedKeyHandling = 21,
+
+  NPNVdocumentOrigin = 22
 
 #if defined(XP_MACOSX)
   /* Used for negotiating drawing models */
diff --git a/dom/plugins/base/nptypes.h b/dom/plugins/base/nptypes.h
index 7cf89c2ddbb3..abcc96be0d55 100644
--- a/dom/plugins/base/nptypes.h
+++ b/dom/plugins/base/nptypes.h
@@ -55,7 +55,7 @@
   typedef unsigned int uint32_t;
   typedef long long int64_t;
   typedef unsigned long long uint64_t;
-#elif defined(_AIX) || defined(__sun) || defined(__osf__) || defined(HPUX)
+#elif defined(_AIX) || defined(__sun) || defined(__osf__) || defined(IRIX) || defined(HPUX)
   /*
    * AIX and SunOS ship a inttypes.h header that defines [u]int32_t,
    * but not bool for C.

From 145f1babc94e52b10b8c46c8b5b55ac1faeeb38d Mon Sep 17 00:00:00 2001
From: Josh Aas <joshmoz@gmail.com>
Date: Wed, 14 Sep 2011 12:22:27 -0400
Subject: [PATCH 142/209] Bug 622199: Add support for NPNVdocumentOrigin,
 ability to pass document origin directly to NPAPI plugins. r=bz

---
 dom/plugins/base/nsNPAPIPlugin.cpp            | 43 +++++++++++++++++++
 dom/plugins/ipc/PPluginInstance.ipdl          |  2 +
 dom/plugins/ipc/PluginInstanceChild.cpp       | 12 ++++++
 dom/plugins/ipc/PluginInstanceParent.cpp      | 12 ++++++
 dom/plugins/ipc/PluginInstanceParent.h        |  3 ++
 dom/plugins/ipc/PluginMessageUtils.h          |  1 +
 dom/plugins/test/mochitest/Makefile.in        |  1 +
 .../mochitest/test_NPNVdocumentOrigin.html    | 34 +++++++++++++++
 dom/plugins/test/testplugin/README            |  4 ++
 dom/plugins/test/testplugin/nptest.cpp        | 26 ++++++++++-
 10 files changed, 136 insertions(+), 2 deletions(-)
 create mode 100644 dom/plugins/test/mochitest/test_NPNVdocumentOrigin.html

diff --git a/dom/plugins/base/nsNPAPIPlugin.cpp b/dom/plugins/base/nsNPAPIPlugin.cpp
index a17649daabb1..fc6788d6d9ac 100644
--- a/dom/plugins/base/nsNPAPIPlugin.cpp
+++ b/dom/plugins/base/nsNPAPIPlugin.cpp
@@ -70,11 +70,14 @@
 #include "nsIDOMDocument.h"
 #include "nsPIDOMWindow.h"
 #include "nsIDocument.h"
+#include "nsIContent.h"
 #include "nsIScriptGlobalObject.h"
 #include "nsIScriptContext.h"
+#include "nsIUnicodeNormalizer.h"
 #include "nsDOMJSUtils.h"
 #include "nsIPrincipal.h"
 #include "nsWildCard.h"
+#include "nsContentUtils.h"
 
 #include "nsIXPConnect.h"
 
@@ -2159,6 +2162,46 @@ _getvalue(NPP npp, NPNVariable variable, void *result)
     return NPERR_GENERIC_ERROR;
   }
 
+  case NPNVdocumentOrigin: {
+    nsNPAPIPluginInstance *inst = (nsNPAPIPluginInstance *)npp->ndata;
+    if (!inst) {
+      return NPERR_GENERIC_ERROR;
+    }
+
+    nsCOMPtr<nsIDOMElement> element;
+    inst->GetDOMElement(getter_AddRefs(element));
+    if (!element) {
+      return NPERR_GENERIC_ERROR;
+    }
+
+    nsCOMPtr<nsIContent> content(do_QueryInterface(element));
+    if (!content) {
+      return NPERR_GENERIC_ERROR;
+    }
+
+    nsIPrincipal* principal = content->NodePrincipal();
+
+    nsAutoString utf16Origin;
+    res = nsContentUtils::GetUTFOrigin(principal, utf16Origin);
+    if (NS_FAILED(res)) {
+      return NPERR_GENERIC_ERROR;
+    }
+
+    nsCOMPtr<nsIUnicodeNormalizer> normalizer = do_GetService(NS_UNICODE_NORMALIZER_CONTRACTID);
+    if (!normalizer) {
+      return NPERR_GENERIC_ERROR;
+    }
+
+    nsAutoString normalizedUTF16Origin;
+    res = normalizer->NormalizeUnicodeNFKC(utf16Origin, normalizedUTF16Origin);
+    if (NS_FAILED(res)) {
+      return NPERR_GENERIC_ERROR;
+    }
+
+    *(char**)result = ToNewUTF8String(normalizedUTF16Origin);
+    return *(char**)result ? NPERR_NO_ERROR : NPERR_GENERIC_ERROR;
+  }
+
 #ifdef XP_MACOSX
   case NPNVpluginDrawingModel: {
     if (npp) {
diff --git a/dom/plugins/ipc/PPluginInstance.ipdl b/dom/plugins/ipc/PPluginInstance.ipdl
index d5a8e041300a..933ea9419e57 100644
--- a/dom/plugins/ipc/PPluginInstance.ipdl
+++ b/dom/plugins/ipc/PPluginInstance.ipdl
@@ -171,6 +171,8 @@ parent:
     returns (bool value, NPError result);
   rpc NPN_GetValue_NPNVnetscapeWindow()
     returns (NativeWindowHandle value, NPError result);
+  rpc NPN_GetValue_NPNVdocumentOrigin()
+    returns (nsCString value, NPError result);
 
   rpc NPN_SetValue_NPPVpluginWindow(bool windowed)
     returns (NPError result);
diff --git a/dom/plugins/ipc/PluginInstanceChild.cpp b/dom/plugins/ipc/PluginInstanceChild.cpp
index d7fe34da42ed..2fc860452917 100644
--- a/dom/plugins/ipc/PluginInstanceChild.cpp
+++ b/dom/plugins/ipc/PluginInstanceChild.cpp
@@ -359,6 +359,18 @@ PluginInstanceChild::NPN_GetValue(NPNVariable aVar,
         return result;
     }
 
+    case NPNVdocumentOrigin: {
+        nsCString v;
+        NPError result;
+        if (!CallNPN_GetValue_NPNVdocumentOrigin(&v, &result)) {
+            return NPERR_GENERIC_ERROR;
+        }
+        if (result == NPERR_NO_ERROR) {
+            *static_cast<char**>(aValue) = ToNewCString(v);
+        }
+        return result;
+    }
+
     case NPNVWindowNPObject: // Intentional fall-through
     case NPNVPluginElementNPObject: {
         NPObject* object;
diff --git a/dom/plugins/ipc/PluginInstanceParent.cpp b/dom/plugins/ipc/PluginInstanceParent.cpp
index 3a289e22ae2a..a388f50ae7ca 100644
--- a/dom/plugins/ipc/PluginInstanceParent.cpp
+++ b/dom/plugins/ipc/PluginInstanceParent.cpp
@@ -341,6 +341,18 @@ PluginInstanceParent::AnswerNPN_GetValue_NPNVprivateModeBool(bool* value,
     return true;
 }
 
+bool
+PluginInstanceParent::AnswerNPN_GetValue_NPNVdocumentOrigin(nsCString* value,
+                                                            NPError* result)
+{
+    void *v = nsnull;
+    *result = mNPNIface->getvalue(mNPP, NPNVdocumentOrigin, &v);
+    if (*result == NPERR_NO_ERROR && v) {
+        value->Adopt(static_cast<char*>(v));
+    }
+    return true;
+}
+
 bool
 PluginInstanceParent::AnswerNPN_SetValue_NPPVpluginWindow(
     const bool& windowed, NPError* result)
diff --git a/dom/plugins/ipc/PluginInstanceParent.h b/dom/plugins/ipc/PluginInstanceParent.h
index b3798f8681ec..97af26fbd056 100644
--- a/dom/plugins/ipc/PluginInstanceParent.h
+++ b/dom/plugins/ipc/PluginInstanceParent.h
@@ -130,6 +130,9 @@ public:
                                        NPError* result);
     virtual bool
     AnswerNPN_GetValue_NPNVprivateModeBool(bool* value, NPError* result);
+  
+    virtual bool
+    AnswerNPN_GetValue_NPNVdocumentOrigin(nsCString* value, NPError* result);
 
     virtual bool
     AnswerNPN_SetValue_NPPVpluginWindow(const bool& windowed, NPError* result);
diff --git a/dom/plugins/ipc/PluginMessageUtils.h b/dom/plugins/ipc/PluginMessageUtils.h
index 12c3f27dfe93..418c61022442 100644
--- a/dom/plugins/ipc/PluginMessageUtils.h
+++ b/dom/plugins/ipc/PluginMessageUtils.h
@@ -213,6 +213,7 @@ NPNVariableToString(NPNVariable aVar)
         VARSTR(NPNVSupportsWindowless);
 
         VARSTR(NPNVprivateModeBool);
+        VARSTR(NPNVdocumentOrigin);
 
     default: return "???";
     }
diff --git a/dom/plugins/test/mochitest/Makefile.in b/dom/plugins/test/mochitest/Makefile.in
index 0b12274ff2c7..cc1bedc03a63 100644
--- a/dom/plugins/test/mochitest/Makefile.in
+++ b/dom/plugins/test/mochitest/Makefile.in
@@ -102,6 +102,7 @@ _MOCHITEST_FILES = \
   test_zero_opacity.html \
   test_NPPVpluginWantsAllNetworkStreams.html \
   test_npruntime_npnsetexception.html \
+  test_NPNVdocumentOrigin.html \
   $(NULL)
 
 #  test_plugin_scroll_painting.html \ bug 596491
diff --git a/dom/plugins/test/mochitest/test_NPNVdocumentOrigin.html b/dom/plugins/test/mochitest/test_NPNVdocumentOrigin.html
new file mode 100644
index 000000000000..5f193a5d63a8
--- /dev/null
+++ b/dom/plugins/test/mochitest/test_NPNVdocumentOrigin.html
@@ -0,0 +1,34 @@
+<html>
+<head>
+  <title>Test NPNVdocumentOrigin</title>
+  <script type="application/javascript" src="/tests/SimpleTest/SimpleTest.js"></script>
+</head>
+<body onload="runTest()">
+  <embed id="plugin1" type="application/x-test" width="200" height="200"></embed>
+
+  <script class="testbody" type="application/javascript">
+    SimpleTest.waitForExplicitFinish();
+
+    function runTest() {
+      var p1 = document.getElementById("plugin1");
+      var realOrigin = "http://mochi.test:8888";
+
+      // Test with no modifications
+      is(p1.getNPNVdocumentOrigin(), realOrigin, "Checking for expected origin.");
+
+      // Mess with window.location.toString
+      window.location.toString = function() { return 'http://victim.rckc.at/'; }
+      is(p1.getNPNVdocumentOrigin(), realOrigin, "Checking for expected origin afer modifying window.location.toString.");
+
+      // Create a plugin in a new window with about:blank
+      var newWindow = window.open("about:blank");
+      newWindow.document.writeln('<embed id="plugin2" type="application/x-test" width="200" height="200"></embed>');
+      var p2 = newWindow.document.getElementById("plugin2");
+      is(p2.getNPNVdocumentOrigin(), realOrigin, "Checking for expected origin of plugin in new about:blank window.");
+      newWindow.close();
+
+      SimpleTest.finish();
+    }
+  </script>
+</body>
+</html>
diff --git a/dom/plugins/test/testplugin/README b/dom/plugins/test/testplugin/README
index 66c47fa102cb..4ff1a7bc4f2a 100644
--- a/dom/plugins/test/testplugin/README
+++ b/dom/plugins/test/testplugin/README
@@ -37,6 +37,10 @@ Hands back an object which reflects properties as values, e.g.
   .getReflector()['foo'] = 'foo'
   .getReflector()[1] = 1
 
+* .getNPNVdocumentOrigin()
+Returns the origin string retrieved from the browser by a NPNVdocumentOrigin
+variable request. Does not cache the value, gets it from the browser every time.
+
 == NPN_ConvertPoint testing ==
 
 * convertPointX(sourceSpace, sourceX, sourceY, destSpace)
diff --git a/dom/plugins/test/testplugin/nptest.cpp b/dom/plugins/test/testplugin/nptest.cpp
index 4c073a380a0d..2f93268a2e94 100644
--- a/dom/plugins/test/testplugin/nptest.cpp
+++ b/dom/plugins/test/testplugin/nptest.cpp
@@ -167,6 +167,7 @@ static bool constructObject(NPObject* npobj, const NPVariant* args, uint32_t arg
 static bool setSitesWithData(NPObject* npobj, const NPVariant* args, uint32_t argCount, NPVariant* result);
 static bool setSitesWithDataCapabilities(NPObject* npobj, const NPVariant* args, uint32_t argCount, NPVariant* result);
 static bool getLastKeyText(NPObject* npobj, const NPVariant* args, uint32_t argCount, NPVariant* result);
+static bool getNPNVdocumentOrigin(NPObject* npobj, const NPVariant* args, uint32_t argCount, NPVariant* result);
 
 static const NPUTF8* sPluginMethodIdentifierNames[] = {
   "npnEvaluateTest",
@@ -225,7 +226,8 @@ static const NPUTF8* sPluginMethodIdentifierNames[] = {
   "constructObject",
   "setSitesWithData",
   "setSitesWithDataCapabilities",
-  "getLastKeyText"
+  "getLastKeyText",
+  "getNPNVdocumentOrigin"
 };
 static NPIdentifier sPluginMethodIdentifiers[ARRAY_LENGTH(sPluginMethodIdentifierNames)];
 static const ScriptableFunction sPluginMethodFunctions[] = {
@@ -285,7 +287,8 @@ static const ScriptableFunction sPluginMethodFunctions[] = {
   constructObject,
   setSitesWithData,
   setSitesWithDataCapabilities,
-  getLastKeyText
+  getLastKeyText,
+  getNPNVdocumentOrigin
 };
 
 STATIC_ASSERT(ARRAY_LENGTH(sPluginMethodIdentifierNames) ==
@@ -3474,3 +3477,22 @@ bool getLastKeyText(NPObject* npobj, const NPVariant* args, uint32_t argCount,
   STRINGZ_TO_NPVARIANT(NPN_StrDup(id->lastKeyText.c_str()), *result);
   return true;
 }
+
+bool getNPNVdocumentOrigin(NPObject* npobj, const NPVariant* args, uint32_t argCount,
+                           NPVariant* result)
+{
+  if (argCount != 0) {
+    return false;
+  }
+
+  NPP npp = static_cast<TestNPObject*>(npobj)->npp;
+
+  char *origin = NULL;
+  NPError err = NPN_GetValue(npp, NPNVdocumentOrigin, &origin);
+  if (err != NPERR_NO_ERROR) {
+    return false;
+  }
+
+  STRINGZ_TO_NPVARIANT(origin, *result);
+  return true;
+}

From 7285767758ebff8a929b00af598be1e6ff48aaf2 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?D=C3=A3o=20Gottwald?= <dao@mozilla.com>
Date: Wed, 14 Sep 2011 21:05:55 +0200
Subject: [PATCH 143/209] Bug 686671 - Reduce border radii of the url bar,
 search bar and toolbar buttons on the navigation toolbar. r=shorlander

---
 browser/themes/winstripe/browser/browser.css | 20 ++++++++++----------
 1 file changed, 10 insertions(+), 10 deletions(-)

diff --git a/browser/themes/winstripe/browser/browser.css b/browser/themes/winstripe/browser/browser.css
index 9230d927a648..04924d43de89 100644
--- a/browser/themes/winstripe/browser/browser.css
+++ b/browser/themes/winstripe/browser/browser.css
@@ -687,7 +687,7 @@ menuitem.bookmark-item {
               -moz-linear-gradient(rgba(251,252,253,.95), rgba(246,247,248,.47) 49%, 
                                    rgba(231,232,233,.45) 51%, rgba(225,226,229,.3));
   background-clip: padding-box;
-  border-radius: 3.5px;
+  border-radius: 2.5px;
   border: 1px solid;
   border-color: rgba(0,0,0,.12) rgba(0,0,0,.19) rgba(0,0,0,.38);
   box-shadow: 0 0 0 1px rgba(255,255,255,.3) inset,
@@ -1195,7 +1195,7 @@ toolbar[mode="full"] .toolbarbutton-1 > .toolbarbutton-menubutton-button {
   padding: 2px;
   background-clip: padding-box;
   border: 1px solid ThreeDShadow;
-  border-radius: 3.5px;
+  border-radius: 2.5px;
 }
 
 @media all and (-moz-windows-default-theme) {
@@ -1282,13 +1282,13 @@ html|*.urlbar-input:-moz-lwtheme:-moz-placeholder,
 }
 
 #identity-box:-moz-locale-dir(ltr) {
-  border-top-left-radius: 2.5px;
-  border-bottom-left-radius: 2.5px;
+  border-top-left-radius: 1.5px;
+  border-bottom-left-radius: 1.5px;
 }
 
 #identity-box:-moz-locale-dir(rtl) {
-  border-top-right-radius: 2.5px;
-  border-bottom-right-radius: 2.5px;
+  border-top-right-radius: 1.5px;
+  border-bottom-right-radius: 1.5px;
 }
 
 #identity-box:hover {
@@ -1500,13 +1500,13 @@ richlistitem[type~="action"][actiontype="switchtab"] > .ac-url-box > .ac-action-
 }
 
 #urlbar:-moz-locale-dir(ltr) > toolbarbutton {
-  border-top-right-radius: 2px;
-  border-bottom-right-radius: 2px;
+  border-top-right-radius: 1.5px;
+  border-bottom-right-radius: 1.5px;
 }
 
 #urlbar:-moz-locale-dir(rtl) > toolbarbutton {
-  border-top-left-radius: 2px;
-  border-bottom-left-radius: 2px;
+  border-top-left-radius: 1.5px;
+  border-bottom-left-radius: 1.5px;
 }
 
 #urlbar > toolbarbutton:not([disabled]):active:hover,

From 12e76a497d8f9716ae0ffdfc95e77af355333e04 Mon Sep 17 00:00:00 2001
From: Neil Rashbrook <neil@parkwaycc.co.uk>
Date: Wed, 14 Sep 2011 20:21:20 +0100
Subject: [PATCH 144/209] Bug 611503 Constructing an nsTDependentString from an
 nsTAString makes no sense r=dbaron,dwitte

---
 dom/base/nsDOMClassInfo.cpp              |  2 +-
 layout/style/nsCSSValue.cpp              |  3 +--
 netwerk/cookie/CookieServiceParent.cpp   |  3 ++-
 netwerk/cookie/nsCookieService.cpp       | 15 +++++++--------
 netwerk/cookie/nsCookieService.h         |  2 +-
 widget/src/xpwidgets/nsXPLookAndFeel.cpp |  4 +---
 xpcom/string/public/nsTDependentString.h |  9 +++++----
 xpcom/string/src/nsTDependentString.cpp  | 17 +++++++++++++++++
 8 files changed, 35 insertions(+), 20 deletions(-)

diff --git a/dom/base/nsDOMClassInfo.cpp b/dom/base/nsDOMClassInfo.cpp
index 8f25dfa3c6fd..43c80b78a217 100644
--- a/dom/base/nsDOMClassInfo.cpp
+++ b/dom/base/nsDOMClassInfo.cpp
@@ -8120,7 +8120,7 @@ nsDOMStringMapSH::Enumerate(nsIXPConnectWrappedNative *wrapper, JSContext *cx,
   NS_ENSURE_SUCCESS(rv, rv);
 
   for (PRUint32 i = 0; i < properties.Length(); ++i) {
-    nsDependentString prop(properties[i]);
+    nsString& prop(properties[i]);
     *_retval = JS_DefineUCProperty(cx, obj, prop.get(), prop.Length(),
                                    JSVAL_VOID, nsnull, nsnull,
                                    JSPROP_ENUMERATE | JSPROP_SHARED);
diff --git a/layout/style/nsCSSValue.cpp b/layout/style/nsCSSValue.cpp
index 6fd4e0c2993b..a303eff13364 100644
--- a/layout/style/nsCSSValue.cpp
+++ b/layout/style/nsCSSValue.cpp
@@ -922,8 +922,7 @@ nsCSSValue::AppendToString(nsCSSProperty aProperty, nsAString& aResult) const
     aResult.Append(NS_LITERAL_STRING("-moz-element(#"));
     nsAutoString tmpStr;
     GetStringValue(tmpStr);
-    nsStyleUtil::AppendEscapedCSSIdent(
-      nsDependentString(tmpStr), aResult);
+    nsStyleUtil::AppendEscapedCSSIdent(tmpStr, aResult);
     aResult.Append(NS_LITERAL_STRING(")"));
   }
   else if (eCSSUnit_Percent == unit) {
diff --git a/netwerk/cookie/CookieServiceParent.cpp b/netwerk/cookie/CookieServiceParent.cpp
index 47e72da16f19..c2d3185c4a7e 100644
--- a/netwerk/cookie/CookieServiceParent.cpp
+++ b/netwerk/cookie/CookieServiceParent.cpp
@@ -95,8 +95,9 @@ CookieServiceParent::RecvSetCookieString(const IPC::URI& aHost,
   if (!hostURI)
     return false;
 
+  nsDependentCString cookieString(aCookieString, 0);
   mCookieService->SetCookieStringInternal(hostURI, aIsForeign,
-                                          aCookieString, aServerTime,
+                                          cookieString, aServerTime,
                                           aFromHttp);
   return true;
 }
diff --git a/netwerk/cookie/nsCookieService.cpp b/netwerk/cookie/nsCookieService.cpp
index 5893a06551df..93d4da4348ee 100644
--- a/netwerk/cookie/nsCookieService.cpp
+++ b/netwerk/cookie/nsCookieService.cpp
@@ -1493,11 +1493,11 @@ nsCookieService::SetCookieStringCommon(nsIURI *aHostURI,
 }
 
 void
-nsCookieService::SetCookieStringInternal(nsIURI          *aHostURI,
-                                         bool             aIsForeign,
-                                         const nsCString &aCookieHeader,
-                                         const nsCString &aServerTime,
-                                         PRBool           aFromHttp) 
+nsCookieService::SetCookieStringInternal(nsIURI             *aHostURI,
+                                         bool                aIsForeign,
+                                         nsDependentCString &aCookieHeader,
+                                         const nsCString    &aServerTime,
+                                         PRBool              aFromHttp)
 {
   NS_ASSERTION(aHostURI, "null host!");
 
@@ -1550,9 +1550,8 @@ nsCookieService::SetCookieStringInternal(nsIURI          *aHostURI,
   }
 
   // process each cookie in the header
-  nsDependentCString cookieHeader(aCookieHeader);
-  while (SetCookieInternal(aHostURI, baseDomain, requireHostMatch,
-                           cookieStatus, cookieHeader, serverTime, aFromHttp)) {
+  while (SetCookieInternal(aHostURI, baseDomain, requireHostMatch, cookieStatus,
+                           aCookieHeader, serverTime, aFromHttp)) {
     // document.cookie can only set one cookie at a time
     if (!aFromHttp)
       break;
diff --git a/netwerk/cookie/nsCookieService.h b/netwerk/cookie/nsCookieService.h
index 6fced2621b04..267ce7bc61e6 100644
--- a/netwerk/cookie/nsCookieService.h
+++ b/netwerk/cookie/nsCookieService.h
@@ -263,7 +263,7 @@ class nsCookieService : public nsICookieService
     nsresult                      GetCookieStringCommon(nsIURI *aHostURI, nsIChannel *aChannel, bool aHttpBound, char** aCookie);
     void                          GetCookieStringInternal(nsIURI *aHostURI, bool aIsForeign, PRBool aHttpBound, nsCString &aCookie);
     nsresult                      SetCookieStringCommon(nsIURI *aHostURI, const char *aCookieHeader, const char *aServerTime, nsIChannel *aChannel, bool aFromHttp);
-    void                          SetCookieStringInternal(nsIURI *aHostURI, bool aIsForeign, const nsCString &aCookieHeader, const nsCString &aServerTime, PRBool aFromHttp);
+    void                          SetCookieStringInternal(nsIURI *aHostURI, bool aIsForeign, nsDependentCString &aCookieHeader, const nsCString &aServerTime, PRBool aFromHttp);
     PRBool                        SetCookieInternal(nsIURI *aHostURI, const nsCString& aBaseDomain, PRBool aRequireHostMatch, CookieStatus aStatus, nsDependentCString &aCookieHeader, PRInt64 aServerTime, PRBool aFromHttp);
     void                          AddInternal(const nsCString& aBaseDomain, nsCookie *aCookie, PRInt64 aCurrentTimeInUsec, nsIURI *aHostURI, const char *aCookieHeader, PRBool aFromHttp);
     void                          RemoveCookieFromList(const nsListIter &aIter, mozIStorageBindingParamsArray *aParamsArray = NULL);
diff --git a/widget/src/xpwidgets/nsXPLookAndFeel.cpp b/widget/src/xpwidgets/nsXPLookAndFeel.cpp
index e698a1c4e776..d106e73bde4b 100644
--- a/widget/src/xpwidgets/nsXPLookAndFeel.cpp
+++ b/widget/src/xpwidgets/nsXPLookAndFeel.cpp
@@ -330,9 +330,7 @@ nsXPLookAndFeel::ColorPrefChanged (unsigned int index, const char *prefName)
   if (!colorStr.IsEmpty()) {
     nscolor thecolor;
     if (colorStr[0] == PRUnichar('#')) {
-      if (NS_HexToRGB(nsDependentString(
-                        Substring(colorStr, 1, colorStr.Length() - 1)),
-                      &thecolor)) {
+      if (NS_HexToRGB(nsDependentString(colorStr, 1), &thecolor)) {
         PRInt32 id = NS_PTR_TO_INT32(index);
         CACHE_COLOR(id, thecolor);
       }
diff --git a/xpcom/string/public/nsTDependentString.h b/xpcom/string/public/nsTDependentString.h
index a9192e02a4c2..818f7200d031 100644
--- a/xpcom/string/public/nsTDependentString.h
+++ b/xpcom/string/public/nsTDependentString.h
@@ -91,11 +91,10 @@ class nsTDependentString_CharT : public nsTString_CharT
           AssertValid();
         }
 
-      explicit
-      nsTDependentString_CharT( const substring_type& str )
-        : string_type(const_cast<char_type*>(str.Data()), str.Length(), F_TERMINATED)
+      nsTDependentString_CharT( const string_type& str, PRUint32 startPos )
+        : string_type()
         {
-          AssertValid();
+          Rebind(str, startPos);
         }
 
       // Create a nsTDependentSubstring to be bound later
@@ -124,6 +123,8 @@ class nsTDependentString_CharT : public nsTString_CharT
           Rebind(start, PRUint32(end - start));
         }
 
+      void Rebind( const string_type&, PRUint32 startPos );
+
     private:
       
       // NOT USED
diff --git a/xpcom/string/src/nsTDependentString.cpp b/xpcom/string/src/nsTDependentString.cpp
index f1dd21cc9262..88a41f448fdb 100644
--- a/xpcom/string/src/nsTDependentString.cpp
+++ b/xpcom/string/src/nsTDependentString.cpp
@@ -48,3 +48,20 @@ nsTDependentString_CharT::Rebind( const char_type* data, size_type length )
     SetDataFlags(F_TERMINATED);
     AssertValid();
   }
+
+void
+nsTDependentString_CharT::Rebind( const string_type& str, PRUint32 startPos )
+  {
+    // If we currently own a buffer, release it.
+    Finalize();
+
+    size_type strLength = str.Length();
+
+    if (startPos > strLength)
+      startPos = strLength;
+
+    mData = const_cast<char_type*>(str.Data()) + startPos;
+    mLength = strLength - startPos;
+
+    SetDataFlags(F_TERMINATED);
+  }

From 396ec9d7bf797bf710c52e990d610dcbfbd43255 Mon Sep 17 00:00:00 2001
From: Neil Rashbrook <neil@parkwaycc.co.uk>
Date: Wed, 14 Sep 2011 21:14:57 +0100
Subject: [PATCH 145/209] Backout of bug 611503 because Android has some weird
 string code

---
 dom/base/nsDOMClassInfo.cpp              |  2 +-
 layout/style/nsCSSValue.cpp              |  3 ++-
 netwerk/cookie/CookieServiceParent.cpp   |  3 +--
 netwerk/cookie/nsCookieService.cpp       | 15 ++++++++-------
 netwerk/cookie/nsCookieService.h         |  2 +-
 widget/src/xpwidgets/nsXPLookAndFeel.cpp |  4 +++-
 xpcom/string/public/nsTDependentString.h |  9 ++++-----
 xpcom/string/src/nsTDependentString.cpp  | 17 -----------------
 8 files changed, 20 insertions(+), 35 deletions(-)

diff --git a/dom/base/nsDOMClassInfo.cpp b/dom/base/nsDOMClassInfo.cpp
index 43c80b78a217..8f25dfa3c6fd 100644
--- a/dom/base/nsDOMClassInfo.cpp
+++ b/dom/base/nsDOMClassInfo.cpp
@@ -8120,7 +8120,7 @@ nsDOMStringMapSH::Enumerate(nsIXPConnectWrappedNative *wrapper, JSContext *cx,
   NS_ENSURE_SUCCESS(rv, rv);
 
   for (PRUint32 i = 0; i < properties.Length(); ++i) {
-    nsString& prop(properties[i]);
+    nsDependentString prop(properties[i]);
     *_retval = JS_DefineUCProperty(cx, obj, prop.get(), prop.Length(),
                                    JSVAL_VOID, nsnull, nsnull,
                                    JSPROP_ENUMERATE | JSPROP_SHARED);
diff --git a/layout/style/nsCSSValue.cpp b/layout/style/nsCSSValue.cpp
index a303eff13364..6fd4e0c2993b 100644
--- a/layout/style/nsCSSValue.cpp
+++ b/layout/style/nsCSSValue.cpp
@@ -922,7 +922,8 @@ nsCSSValue::AppendToString(nsCSSProperty aProperty, nsAString& aResult) const
     aResult.Append(NS_LITERAL_STRING("-moz-element(#"));
     nsAutoString tmpStr;
     GetStringValue(tmpStr);
-    nsStyleUtil::AppendEscapedCSSIdent(tmpStr, aResult);
+    nsStyleUtil::AppendEscapedCSSIdent(
+      nsDependentString(tmpStr), aResult);
     aResult.Append(NS_LITERAL_STRING(")"));
   }
   else if (eCSSUnit_Percent == unit) {
diff --git a/netwerk/cookie/CookieServiceParent.cpp b/netwerk/cookie/CookieServiceParent.cpp
index c2d3185c4a7e..47e72da16f19 100644
--- a/netwerk/cookie/CookieServiceParent.cpp
+++ b/netwerk/cookie/CookieServiceParent.cpp
@@ -95,9 +95,8 @@ CookieServiceParent::RecvSetCookieString(const IPC::URI& aHost,
   if (!hostURI)
     return false;
 
-  nsDependentCString cookieString(aCookieString, 0);
   mCookieService->SetCookieStringInternal(hostURI, aIsForeign,
-                                          cookieString, aServerTime,
+                                          aCookieString, aServerTime,
                                           aFromHttp);
   return true;
 }
diff --git a/netwerk/cookie/nsCookieService.cpp b/netwerk/cookie/nsCookieService.cpp
index 93d4da4348ee..5893a06551df 100644
--- a/netwerk/cookie/nsCookieService.cpp
+++ b/netwerk/cookie/nsCookieService.cpp
@@ -1493,11 +1493,11 @@ nsCookieService::SetCookieStringCommon(nsIURI *aHostURI,
 }
 
 void
-nsCookieService::SetCookieStringInternal(nsIURI             *aHostURI,
-                                         bool                aIsForeign,
-                                         nsDependentCString &aCookieHeader,
-                                         const nsCString    &aServerTime,
-                                         PRBool              aFromHttp)
+nsCookieService::SetCookieStringInternal(nsIURI          *aHostURI,
+                                         bool             aIsForeign,
+                                         const nsCString &aCookieHeader,
+                                         const nsCString &aServerTime,
+                                         PRBool           aFromHttp) 
 {
   NS_ASSERTION(aHostURI, "null host!");
 
@@ -1550,8 +1550,9 @@ nsCookieService::SetCookieStringInternal(nsIURI             *aHostURI,
   }
 
   // process each cookie in the header
-  while (SetCookieInternal(aHostURI, baseDomain, requireHostMatch, cookieStatus,
-                           aCookieHeader, serverTime, aFromHttp)) {
+  nsDependentCString cookieHeader(aCookieHeader);
+  while (SetCookieInternal(aHostURI, baseDomain, requireHostMatch,
+                           cookieStatus, cookieHeader, serverTime, aFromHttp)) {
     // document.cookie can only set one cookie at a time
     if (!aFromHttp)
       break;
diff --git a/netwerk/cookie/nsCookieService.h b/netwerk/cookie/nsCookieService.h
index 267ce7bc61e6..6fced2621b04 100644
--- a/netwerk/cookie/nsCookieService.h
+++ b/netwerk/cookie/nsCookieService.h
@@ -263,7 +263,7 @@ class nsCookieService : public nsICookieService
     nsresult                      GetCookieStringCommon(nsIURI *aHostURI, nsIChannel *aChannel, bool aHttpBound, char** aCookie);
     void                          GetCookieStringInternal(nsIURI *aHostURI, bool aIsForeign, PRBool aHttpBound, nsCString &aCookie);
     nsresult                      SetCookieStringCommon(nsIURI *aHostURI, const char *aCookieHeader, const char *aServerTime, nsIChannel *aChannel, bool aFromHttp);
-    void                          SetCookieStringInternal(nsIURI *aHostURI, bool aIsForeign, nsDependentCString &aCookieHeader, const nsCString &aServerTime, PRBool aFromHttp);
+    void                          SetCookieStringInternal(nsIURI *aHostURI, bool aIsForeign, const nsCString &aCookieHeader, const nsCString &aServerTime, PRBool aFromHttp);
     PRBool                        SetCookieInternal(nsIURI *aHostURI, const nsCString& aBaseDomain, PRBool aRequireHostMatch, CookieStatus aStatus, nsDependentCString &aCookieHeader, PRInt64 aServerTime, PRBool aFromHttp);
     void                          AddInternal(const nsCString& aBaseDomain, nsCookie *aCookie, PRInt64 aCurrentTimeInUsec, nsIURI *aHostURI, const char *aCookieHeader, PRBool aFromHttp);
     void                          RemoveCookieFromList(const nsListIter &aIter, mozIStorageBindingParamsArray *aParamsArray = NULL);
diff --git a/widget/src/xpwidgets/nsXPLookAndFeel.cpp b/widget/src/xpwidgets/nsXPLookAndFeel.cpp
index d106e73bde4b..e698a1c4e776 100644
--- a/widget/src/xpwidgets/nsXPLookAndFeel.cpp
+++ b/widget/src/xpwidgets/nsXPLookAndFeel.cpp
@@ -330,7 +330,9 @@ nsXPLookAndFeel::ColorPrefChanged (unsigned int index, const char *prefName)
   if (!colorStr.IsEmpty()) {
     nscolor thecolor;
     if (colorStr[0] == PRUnichar('#')) {
-      if (NS_HexToRGB(nsDependentString(colorStr, 1), &thecolor)) {
+      if (NS_HexToRGB(nsDependentString(
+                        Substring(colorStr, 1, colorStr.Length() - 1)),
+                      &thecolor)) {
         PRInt32 id = NS_PTR_TO_INT32(index);
         CACHE_COLOR(id, thecolor);
       }
diff --git a/xpcom/string/public/nsTDependentString.h b/xpcom/string/public/nsTDependentString.h
index 818f7200d031..a9192e02a4c2 100644
--- a/xpcom/string/public/nsTDependentString.h
+++ b/xpcom/string/public/nsTDependentString.h
@@ -91,10 +91,11 @@ class nsTDependentString_CharT : public nsTString_CharT
           AssertValid();
         }
 
-      nsTDependentString_CharT( const string_type& str, PRUint32 startPos )
-        : string_type()
+      explicit
+      nsTDependentString_CharT( const substring_type& str )
+        : string_type(const_cast<char_type*>(str.Data()), str.Length(), F_TERMINATED)
         {
-          Rebind(str, startPos);
+          AssertValid();
         }
 
       // Create a nsTDependentSubstring to be bound later
@@ -123,8 +124,6 @@ class nsTDependentString_CharT : public nsTString_CharT
           Rebind(start, PRUint32(end - start));
         }
 
-      void Rebind( const string_type&, PRUint32 startPos );
-
     private:
       
       // NOT USED
diff --git a/xpcom/string/src/nsTDependentString.cpp b/xpcom/string/src/nsTDependentString.cpp
index 88a41f448fdb..f1dd21cc9262 100644
--- a/xpcom/string/src/nsTDependentString.cpp
+++ b/xpcom/string/src/nsTDependentString.cpp
@@ -48,20 +48,3 @@ nsTDependentString_CharT::Rebind( const char_type* data, size_type length )
     SetDataFlags(F_TERMINATED);
     AssertValid();
   }
-
-void
-nsTDependentString_CharT::Rebind( const string_type& str, PRUint32 startPos )
-  {
-    // If we currently own a buffer, release it.
-    Finalize();
-
-    size_type strLength = str.Length();
-
-    if (startPos > strLength)
-      startPos = strLength;
-
-    mData = const_cast<char_type*>(str.Data()) + startPos;
-    mLength = strLength - startPos;
-
-    SetDataFlags(F_TERMINATED);
-  }

From 453d7ec72a1b0d5fd3a2b43c98e16a3745612cd9 Mon Sep 17 00:00:00 2001
From: Justin Lebar <justin.lebar@gmail.com>
Date: Thu, 15 Sep 2011 22:16:14 -0700
Subject: [PATCH 146/209] Bug 686597 - Add a copy constructor to nsAutoTArray
 and friends. r=bz

---
 xpcom/glue/nsTArray.h | 16 +++++++++++++++-
 1 file changed, 15 insertions(+), 1 deletion(-)

diff --git a/xpcom/glue/nsTArray.h b/xpcom/glue/nsTArray.h
index 112afa734481..d6f0d39b26c0 100644
--- a/xpcom/glue/nsTArray.h
+++ b/xpcom/glue/nsTArray.h
@@ -1230,7 +1230,22 @@ public:
   typedef typename base_type::Header Header;
   typedef typename base_type::elem_type elem_type;
 
+protected:
   nsAutoArrayBase() {
+    Init();
+  }
+
+  // We need this constructor because nsAutoTArray and friends all have
+  // implicit copy-constructors.  If we don't have this method, those
+  // copy-constructors will call nsAutoArrayBase's implicit copy-constructor,
+  // which won't call Init() and set up the auto buffer!
+  nsAutoArrayBase(const TArrayBase &aOther) {
+    Init();
+    AppendElements(aOther);
+  }
+
+private:
+  void Init() {
     *base_type::PtrToHdr() = reinterpret_cast<Header*>(&mAutoBuf);
     base_type::Hdr()->mLength = 0;
     base_type::Hdr()->mCapacity = N;
@@ -1241,7 +1256,6 @@ public:
                  "GetAutoArrayBuffer needs to be fixed");
   }
 
-protected:
   union {
     char mAutoBuf[sizeof(Header) + N * sizeof(elem_type)];
     PRUint64 dummy;

From 70b7558185a536afe2719ea65d193ec8fe347b17 Mon Sep 17 00:00:00 2001
From: Justin Lebar <justin.lebar@gmail.com>
Date: Wed, 14 Sep 2011 17:37:45 -0700
Subject: [PATCH 147/209] Bug 686172 - In about:memory, make the smaps
 breakdown trees appear only where they're available (on Linux). r=khuey

---
 .../aboutmemory/content/aboutMemory.js        | 14 +++--
 .../tests/chrome/test_aboutmemory.xul         | 36 ------------
 xpcom/base/MapsMemoryReporter.cpp             | 55 +++++++++++++++++--
 3 files changed, 57 insertions(+), 48 deletions(-)

diff --git a/toolkit/components/aboutmemory/content/aboutMemory.js b/toolkit/components/aboutmemory/content/aboutMemory.js
index ca0216a80513..544428feb41f 100644
--- a/toolkit/components/aboutmemory/content/aboutMemory.js
+++ b/toolkit/components/aboutmemory/content/aboutMemory.js
@@ -409,10 +409,8 @@ function buildTree(aReporters, aTreeName)
   }
 
   if (!foundReporter) {
-    // We didn't find any reporters for this tree, so create an empty one.  Its
-    // description will be set later.
-    aReporters[aTreeName] =
-      new Reporter(aTreeName, KIND_NONHEAP, UNITS_BYTES, 0, '');
+    // We didn't find any reporters for this tree, so bail.
+    return null;
   }
 
   var t = new TreeNode("falseRoot");
@@ -637,8 +635,12 @@ function genProcessText(aProcess, aReporters)
   var mapTreeText = '';
   kMapTreePaths.forEach(function(t) {
     var tree = buildTree(aReporters, t);
-    filterTree(tree._amount, tree);
-    mapTreeText += genTreeText(tree, aProcess);
+
+    // |tree| will be null if we don't have any reporters for the given path.
+    if (tree) {
+      filterTree(tree._amount, tree);
+      mapTreeText += genTreeText(tree, aProcess);
+    }
   });
 
   // We have to call genOtherText after we process all the trees, because it
diff --git a/toolkit/components/aboutmemory/tests/chrome/test_aboutmemory.xul b/toolkit/components/aboutmemory/tests/chrome/test_aboutmemory.xul
index 779e62899c25..4eb609d3e884 100644
--- a/toolkit/components/aboutmemory/tests/chrome/test_aboutmemory.xul
+++ b/toolkit/components/aboutmemory/tests/chrome/test_aboutmemory.xul
@@ -238,15 +238,6 @@ Explicit Allocations\n\
 ├────200.00 MB (20.00%) -- compartment(compartment-url)\n\
 └────101.00 MB (10.10%) -- heap-unclassified\n\
 \n\
-Resident Set Size (RSS) Breakdown\n\
-0.00 MB (100.0%) -- resident\n\
-\n\
-Virtual Size Breakdown\n\
-0.00 MB (100.0%) -- vsize\n\
-\n\
-Swap Usage Breakdown\n\
-0.00 MB (100.0%) -- swap\n\
-\n\
 Other Measurements\n\
   666.00 MB -- danger<script>window.alert(1)</script>\n\
 1,000.00 MB -- heap-allocated\n\
@@ -263,15 +254,6 @@ Explicit Allocations\n\
 │  └────0.00 MB (00.00%) -- (1 omitted)\n\
 └────0.00 MB (00.00%) -- (2 omitted)\n\
 \n\
-Resident Set Size (RSS) Breakdown\n\
-0.00 MB (100.0%) -- resident\n\
-\n\
-Virtual Size Breakdown\n\
-0.00 MB (100.0%) -- vsize\n\
-\n\
-Swap Usage Breakdown\n\
-0.00 MB (100.0%) -- swap\n\
-\n\
 Other Measurements\n\
 0.00 MB -- heap-allocated [*]\n\
 0.00 MB -- other1 [*]\n\
@@ -342,15 +324,6 @@ Explicit Allocations\n\
 ├────209,715,200 B (20.00%) -- compartment(compartment-url)\n\
 └────105,906,176 B (10.10%) -- heap-unclassified\n\
 \n\
-Resident Set Size (RSS) Breakdown\n\
-0 B (100.0%) -- resident\n\
-\n\
-Virtual Size Breakdown\n\
-0 B (100.0%) -- vsize\n\
-\n\
-Swap Usage Breakdown\n\
-0 B (100.0%) -- swap\n\
-\n\
 Other Measurements\n\
   698,351,616 B -- danger<script>window.alert(1)</script>\n\
 1,048,576,000 B -- heap-allocated\n\
@@ -368,15 +341,6 @@ Explicit Allocations\n\
 ├────────────0 B (00.00%) -- b [*]\n\
 └────────────0 B (00.00%) -- heap-unclassified [*]\n\
 \n\
-Resident Set Size (RSS) Breakdown\n\
-0 B (100.0%) -- resident\n\
-\n\
-Virtual Size Breakdown\n\
-0 B (100.0%) -- vsize\n\
-\n\
-Swap Usage Breakdown\n\
-0 B (100.0%) -- swap\n\
-\n\
 Other Measurements\n\
 0 B -- heap-allocated [*]\n\
 0 B -- other1 [*]\n\
diff --git a/xpcom/base/MapsMemoryReporter.cpp b/xpcom/base/MapsMemoryReporter.cpp
index 1b658a669d43..56362ae126d9 100644
--- a/xpcom/base/MapsMemoryReporter.cpp
+++ b/xpcom/base/MapsMemoryReporter.cpp
@@ -109,6 +109,21 @@ void GetBasename(const nsCString &aPath, nsACString &aOut)
   }
 }
 
+// MapsReporter::CollectReports uses this stuct to keep track of whether it's
+// seen a mapping under 'map/resident', 'map/vsize', and 'map/swap'.
+struct CategoriesSeen {
+  CategoriesSeen() :
+    mSeenResident(false),
+    mSeenVsize(false),
+    mSeenSwap(false)
+  {
+  }
+
+  bool mSeenResident;
+  bool mSeenVsize;
+  bool mSeenSwap;
+};
+
 } // anonymous namespace
 
 class MapsReporter : public nsIMemoryMultiReporter
@@ -130,7 +145,8 @@ private:
   nsresult
   ParseMapping(FILE *aFile,
                nsIMemoryMultiReporterCallback *aCallback,
-               nsISupports *aClosure);
+               nsISupports *aClosure,
+               CategoriesSeen *aCategoriesSeen);
 
   void
   GetReporterNameAndDescription(const char *aPath,
@@ -143,7 +159,8 @@ private:
                const nsACString &aName,
                const nsACString &aDescription,
                nsIMemoryMultiReporterCallback *aCallback,
-               nsISupports *aClosure);
+               nsISupports *aClosure,
+               CategoriesSeen *aCategoriesSeen);
 
   nsCString mLibxulDir;
   nsCStringHashSet mMozillaLibraries;
@@ -166,17 +183,37 @@ NS_IMETHODIMP
 MapsReporter::CollectReports(nsIMemoryMultiReporterCallback *aCallback,
                              nsISupports *aClosure)
 {
+  CategoriesSeen categoriesSeen;
+
   FILE *f = fopen("/proc/self/smaps", "r");
   if (!f)
     return NS_ERROR_FAILURE;
 
   while (true) {
-    nsresult rv = ParseMapping(f, aCallback, aClosure);
+    nsresult rv = ParseMapping(f, aCallback, aClosure, &categoriesSeen);
     if (NS_FAILED(rv))
       break;
   }
 
   fclose(f);
+
+  // For sure we should have created some node under 'map/resident' and
+  // 'map/vsize'; otherwise we're probably not reading smaps correctly.  If we
+  // didn't create a node under 'map/swap', create one here so about:memory
+  // knows to create an empty 'map/swap' tree.  See also bug 682735.
+
+  NS_ASSERTION(categoriesSeen.mSeenVsize, "Didn't create a vsize node?");
+  NS_ASSERTION(categoriesSeen.mSeenVsize, "Didn't create a resident node?");
+  if (!categoriesSeen.mSeenSwap) {
+    aCallback->Callback(NS_LITERAL_CSTRING(""),
+                        NS_LITERAL_CSTRING("map/swap"),
+                        nsIMemoryReporter::KIND_NONHEAP,
+                        nsIMemoryReporter::UNITS_BYTES,
+                        0,
+                        NS_LITERAL_CSTRING("This process uses no swap space."),
+                        aClosure);
+  }
+
   return NS_OK;
 }
 
@@ -219,7 +256,8 @@ nsresult
 MapsReporter::ParseMapping(
   FILE *aFile,
   nsIMemoryMultiReporterCallback *aCallback,
-  nsISupports *aClosure)
+  nsISupports *aClosure,
+  CategoriesSeen *aCategoriesSeen)
 {
   // We need to use native types in order to get good warnings from fscanf, so
   // let's make sure that the native types have the sizes we expect.
@@ -271,7 +309,8 @@ MapsReporter::ParseMapping(
   GetReporterNameAndDescription(path, perms, name, description);
 
   while (true) {
-    nsresult rv = ParseMapBody(aFile, name, description, aCallback, aClosure);
+    nsresult rv = ParseMapBody(aFile, name, description, aCallback,
+                               aClosure, aCategoriesSeen);
     if (NS_FAILED(rv))
       break;
   }
@@ -401,7 +440,8 @@ MapsReporter::ParseMapBody(
   const nsACString &aName,
   const nsACString &aDescription,
   nsIMemoryMultiReporterCallback *aCallback,
-  nsISupports *aClosure)
+  nsISupports *aClosure,
+  CategoriesSeen *aCategoriesSeen)
 {
   PR_STATIC_ASSERT(sizeof(long long) == sizeof(PRInt64));
 
@@ -421,12 +461,15 @@ MapsReporter::ParseMapBody(
   const char* category;
   if (strcmp(desc, "Size") == 0) {
     category = "vsize";
+    aCategoriesSeen->mSeenVsize = PR_TRUE;
   }
   else if (strcmp(desc, "Rss") == 0) {
     category = "resident";
+    aCategoriesSeen->mSeenResident = PR_TRUE;
   }
   else if (strcmp(desc, "Swap") == 0) {
     category = "swap";
+    aCategoriesSeen->mSeenSwap = PR_TRUE;
   }
   else {
     // Don't report this category.

From 029285d0e69e7d0bafabdcde6c51c4669ce3ac2f Mon Sep 17 00:00:00 2001
From: Hari R <innomotive@gmail.com>
Date: Wed, 14 Sep 2011 23:13:00 -0400
Subject: [PATCH 148/209] Bug 684083 - Avoid null dereference when using
 Components.utils.getWeakReference(undefined). r=mrbkap

---
 js/src/xpconnect/src/xpcJSWeakReference.cpp | 6 ++----
 1 file changed, 2 insertions(+), 4 deletions(-)

diff --git a/js/src/xpconnect/src/xpcJSWeakReference.cpp b/js/src/xpconnect/src/xpcJSWeakReference.cpp
index ebafdc7a25e6..4f363fee084e 100644
--- a/js/src/xpconnect/src/xpcJSWeakReference.cpp
+++ b/js/src/xpconnect/src/xpcJSWeakReference.cpp
@@ -71,11 +71,9 @@ nsresult xpcJSWeakReference::Init()
 
     JSAutoRequest ar(cx);
 
-    if (JSVAL_IS_NULL(argv[0])) return NS_ERROR_FAILURE;
+    if (JSVAL_IS_PRIMITIVE(argv[0])) return NS_ERROR_FAILURE;
     
-    JSObject *obj;
-    if (!JS_ValueToObject(cx, argv[0], &obj))
-        return NS_ERROR_FAILURE;
+    JSObject *obj = JSVAL_TO_OBJECT(argv[0]);
     
     XPCCallContext ccx(NATIVE_CALLER, cx);
     

From 16d506a74f588bea246fa2c1e925201e25481fa9 Mon Sep 17 00:00:00 2001
From: Justin Lebar <justin.lebar@gmail.com>
Date: Thu, 15 Sep 2011 10:53:04 -0700
Subject: [PATCH 149/209] Bug 686720 - Expose PSS from smaps in about:memory.
 r=khuey

---
 toolkit/components/aboutmemory/content/aboutMemory.js | 11 ++++++++++-
 xpcom/base/MapsMemoryReporter.cpp                     |  6 ++++++
 2 files changed, 16 insertions(+), 1 deletion(-)

diff --git a/toolkit/components/aboutmemory/content/aboutMemory.js b/toolkit/components/aboutmemory/content/aboutMemory.js
index 544428feb41f..66b7791369f6 100644
--- a/toolkit/components/aboutmemory/content/aboutMemory.js
+++ b/toolkit/components/aboutmemory/content/aboutMemory.js
@@ -82,6 +82,14 @@ const kTreeDescriptions = {
     "'resident' under 'Other Measurements' because the two measurements are not " +
     "taken at exactly the same time.",
 
+  'pss':
+    "This tree shows how much space in physical memory can be 'blamed' on this " +
+    "process.  For each mapping, its 'proportional set size' (PSS) is the " +
+    "mapping's resident size divided by the number of processes which use the " +
+    "mapping.  So if a mapping is private to this process, its PSS should equal " +
+    "its RSS.  But if a mapping is shared between three processes, its PSS in " +
+    "each of the processes would be 1/3 its RSS.",
+
   'vsize':
     "This tree shows how much virtual addres space each of the process's " +
     "mappings takes up (the mapping's 'vsize').  A mapping may have a large " +
@@ -100,12 +108,13 @@ const kTreeDescriptions = {
 const kTreeNames = {
   'explicit': 'Explicit Allocations',
   'resident': 'Resident Set Size (RSS) Breakdown',
+  'pss':      'Proportional Set Size (PSS) Breakdown',
   'vsize':    'Virtual Size Breakdown',
   'swap':     'Swap Usage Breakdown',
   'other':    'Other Measurements'
 };
 
-const kMapTreePaths = ['map/resident', 'map/vsize', 'map/swap'];
+const kMapTreePaths = ['map/resident', 'map/pss', 'map/vsize', 'map/swap'];
 
 function onLoad()
 {
diff --git a/xpcom/base/MapsMemoryReporter.cpp b/xpcom/base/MapsMemoryReporter.cpp
index 56362ae126d9..1a5662112bf9 100644
--- a/xpcom/base/MapsMemoryReporter.cpp
+++ b/xpcom/base/MapsMemoryReporter.cpp
@@ -114,12 +114,14 @@ void GetBasename(const nsCString &aPath, nsACString &aOut)
 struct CategoriesSeen {
   CategoriesSeen() :
     mSeenResident(false),
+    mSeenPss(false),
     mSeenVsize(false),
     mSeenSwap(false)
   {
   }
 
   bool mSeenResident;
+  bool mSeenPss;
   bool mSeenVsize;
   bool mSeenSwap;
 };
@@ -467,6 +469,10 @@ MapsReporter::ParseMapBody(
     category = "resident";
     aCategoriesSeen->mSeenResident = PR_TRUE;
   }
+  else if (strcmp(desc, "Pss") == 0) {
+    category = "pss";
+    aCategoriesSeen->mSeenPss = PR_TRUE;
+  }
   else if (strcmp(desc, "Swap") == 0) {
     category = "swap";
     aCategoriesSeen->mSeenSwap = PR_TRUE;

From 27163a402f99dfb6dd96cb58d9a0351ba9bfc8a0 Mon Sep 17 00:00:00 2001
From: Lucas Rocha <lucasr@mozilla.com>
Date: Fri, 16 Sep 2011 09:54:14 +0100
Subject: [PATCH 150/209] Bug 685845 - Avoid horizontal overflow on tabs
 scrollbox (r=mfinkle)

The close container was overflowing the tabs scrollbox by 1px and causing the horizontal scroll indicator to show up unnecessarily.
---
 mobile/themes/core/tablet.css | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/mobile/themes/core/tablet.css b/mobile/themes/core/tablet.css
index 0d3c1615f969..50702e6cb638 100644
--- a/mobile/themes/core/tablet.css
+++ b/mobile/themes/core/tablet.css
@@ -77,7 +77,7 @@ documenttab[selected="true"] > vbox > stack > .documenttab-close-container[table
   background: url("chrome://browser/skin/images/close-background-hdpi.png");
   background-repeat: no-repeat;
   background-position: right;
-  -moz-margin-end: -12px;
+  -moz-margin-end: -11px;
   padding-right: 2px;
 }
 

From 87f0161b5156c568366e082b8230e98e2d01021f Mon Sep 17 00:00:00 2001
From: Lucas Rocha <lucasr@mozilla.com>
Date: Fri, 16 Sep 2011 09:56:01 +0100
Subject: [PATCH 151/209] Bug 686857 - Make clickable area match close button
 boundaries (r=mfinkle)

---
 mobile/themes/core/tablet.css | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/mobile/themes/core/tablet.css b/mobile/themes/core/tablet.css
index 50702e6cb638..b36d1887ee55 100644
--- a/mobile/themes/core/tablet.css
+++ b/mobile/themes/core/tablet.css
@@ -68,7 +68,7 @@
 .documenttab-close-container[tablet] {
   left: 0px;
   -moz-margin-end: 0px;
-  -moz-margin-start: 135px;
+  -moz-margin-start: 151px;
   -moz-box-pack: end;
   -moz-box-align: center;
 }

From 0aff495323a0dbc6e7bf0bc0cc97f836278c17d7 Mon Sep 17 00:00:00 2001
From: Wesley Johnston <wjohnston@mozilla.com>
Date: Fri, 16 Sep 2011 09:56:58 +0100
Subject: [PATCH 152/209] Bug 685347 - Context menu selections in URL bar
 removes focus on the URL bar; r=mbrubeck

---
 mobile/chrome/content/AwesomePanel.js | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/mobile/chrome/content/AwesomePanel.js b/mobile/chrome/content/AwesomePanel.js
index 5e4c5ca236dd..f5a0b95e3dfd 100644
--- a/mobile/chrome/content/AwesomePanel.js
+++ b/mobile/chrome/content/AwesomePanel.js
@@ -23,7 +23,8 @@ var AwesomeScreen = {
       document.getElementById("syncsetup-container"),
 #endif
       document.getElementById("urlbar-container"),
-      document.getElementById("search-engines-popup")
+      document.getElementById("search-engines-popup"),
+      document.getElementById("context-popup")
     ]
   },
 

From 5c18d29af37c2fb825c0213bf32ecb07c6684258 Mon Sep 17 00:00:00 2001
From: Raymond Lee <raymond@raysquare.com>
Date: Thu, 15 Sep 2011 12:37:19 +0800
Subject: [PATCH 153/209] Bug 596504 - DOM attribute for the group node needed
 which references the undo button r=dietrich

---
 browser/base/content/tabview/groupitems.js | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/browser/base/content/tabview/groupitems.js b/browser/base/content/tabview/groupitems.js
index d6c407ac1f8d..eaa75edc1e9f 100644
--- a/browser/base/content/tabview/groupitems.js
+++ b/browser/base/content/tabview/groupitems.js
@@ -920,6 +920,7 @@ GroupItem.prototype = Utils.extend(new Item(), new Subscribable(), {
     this.$undoContainer = iQ("<div/>")
       .addClass("undo")
       .attr("type", "button")
+      .attr("data-group-id", this.id)
       .appendTo("body");
     iQ("<span/>")
       .text(tabviewString("groupItem.undoCloseGroup"))
@@ -1051,7 +1052,7 @@ GroupItem.prototype = Utils.extend(new Item(), new Subscribable(), {
 
         item.addSubscriber("close", this._onChildClose);
         item.setParent(this);
-        $el.attr("data-group", this.id);
+        $el.attr("data-group-id", this.id);
 
         if (typeof item.setResizable == 'function')
           item.setResizable(false, options.immediately);
@@ -1137,7 +1138,7 @@ GroupItem.prototype = Utils.extend(new Item(), new Subscribable(), {
           this._activeTab = null;
       }
 
-      $el[0].removeAttribute("data-group");
+      $el[0].removeAttribute("data-group-id");
       item.setParent(null);
       item.removeClass("stacked");
       item.isStacked = false;

From 7596a08601bc697f1858854ce56f4154162d9410 Mon Sep 17 00:00:00 2001
From: Brian Hackett <bhackett1024@gmail.com>
Date: Wed, 14 Sep 2011 22:09:40 -0700
Subject: [PATCH 154/209] [INFER] Backout bug 685358.

---
 js/src/jscompartment.cpp           |  26 +++++--
 js/src/jsgcmark.cpp                |   7 ++
 js/src/jsinterp.cpp                |  66 +++++++++++++++++-
 js/src/jsinterp.h                  |   7 +-
 js/src/methodjit/Compiler.cpp      |  17 ++++-
 js/src/methodjit/Compiler.h        |   1 +
 js/src/methodjit/InvokeHelpers.cpp | 106 +++++++++++++----------------
 js/src/methodjit/MethodJIT.cpp     |  48 ++++++++++++-
 js/src/methodjit/MethodJIT.h       |  19 +++---
 js/src/methodjit/MonoIC.cpp        |  73 ++++++++++++++++++++
 js/src/methodjit/MonoIC.h          |   8 +++
 js/src/methodjit/PolyIC.cpp        |  43 ++++++++++++
 js/src/methodjit/StubCalls.h       |   4 +-
 13 files changed, 341 insertions(+), 84 deletions(-)

diff --git a/js/src/jscompartment.cpp b/js/src/jscompartment.cpp
index e504e6921f3f..d165ff79d308 100644
--- a/js/src/jscompartment.cpp
+++ b/js/src/jscompartment.cpp
@@ -510,7 +510,14 @@ JSCompartment::sweep(JSContext *cx, bool releaseTypes)
 #endif
 
 #ifdef JS_METHODJIT
-    mjit::ClearAllFrames(this);
+    /* Purge ICs in the compartment. These can reference GC things. */
+    for (CellIterUnderGC i(this, FINALIZE_SCRIPT); !i.done(); i.next()) {
+        JSScript *script = i.get<JSScript>();
+        mjit::PurgeICs(cx, script);
+    }
+
+    if (types.inferenceEnabled)
+        mjit::ClearAllFrames(this);
 #endif
 
     if (activeAnalysis) {
@@ -520,9 +527,11 @@ JSCompartment::sweep(JSContext *cx, bool releaseTypes)
          * GC then shape numbers baked into the code may change.
          */
 #ifdef JS_METHODJIT
-        for (CellIterUnderGC i(this, FINALIZE_SCRIPT); !i.done(); i.next()) {
-            JSScript *script = i.get<JSScript>();
-            mjit::ReleaseScriptCode(cx, script);
+        if (types.inferenceEnabled) {
+            for (CellIterUnderGC i(this, FINALIZE_SCRIPT); !i.done(); i.next()) {
+                JSScript *script = i.get<JSScript>();
+                mjit::ReleaseScriptCode(cx, script);
+            }
         }
 #endif
     } else {
@@ -560,9 +569,12 @@ JSCompartment::sweep(JSContext *cx, bool releaseTypes)
             }
         } else {
 #ifdef JS_METHODJIT
-            for (CellIterUnderGC i(this, FINALIZE_SCRIPT); !i.done(); i.next()) {
-                JSScript *script = i.get<JSScript>();
-                mjit::ReleaseScriptCode(cx, script);
+            /* :XXX: bug 685358 only releasing jitcode if there are no frames on the stack */
+            if (!active) {
+                for (CellIterUnderGC i(this, FINALIZE_SCRIPT); !i.done(); i.next()) {
+                    JSScript *script = i.get<JSScript>();
+                    mjit::ReleaseScriptCode(cx, script);
+                }
             }
 #endif
         }
diff --git a/js/src/jsgcmark.cpp b/js/src/jsgcmark.cpp
index c118112205b1..ef7acfaf0caa 100644
--- a/js/src/jsgcmark.cpp
+++ b/js/src/jsgcmark.cpp
@@ -859,6 +859,13 @@ MarkChildren(JSTracer *trc, JSScript *script)
 
     if (script->types)
         script->types->trace(trc);
+
+#ifdef JS_METHODJIT
+    if (script->jitNormal)
+        script->jitNormal->trace(trc);
+    if (script->jitCtor)
+        script->jitCtor->trace(trc);
+#endif
 }
 
 void
diff --git a/js/src/jsinterp.cpp b/js/src/jsinterp.cpp
index 9755668b760d..4ca7258e43fc 100644
--- a/js/src/jsinterp.cpp
+++ b/js/src/jsinterp.cpp
@@ -1832,12 +1832,30 @@ js::Interpret(JSContext *cx, StackFrame *entryFrame, InterpMode interpMode)
             goto error;                                                       \
     JS_END_MACRO
 
+#if defined(JS_TRACER) && defined(JS_METHODJIT)
+# define LEAVE_ON_SAFE_POINT()                                                \
+    do {                                                                      \
+        JS_ASSERT_IF(leaveOnSafePoint, !TRACE_RECORDER(cx));                  \
+        JS_ASSERT_IF(leaveOnSafePoint, !TRACE_PROFILER(cx));                  \
+        JS_ASSERT_IF(leaveOnSafePoint, interpMode != JSINTERP_NORMAL);        \
+        if (leaveOnSafePoint && !regs.fp()->hasImacropc() &&                  \
+            script->maybeNativeCodeForPC(regs.fp()->isConstructing(), regs.pc)) { \
+            JS_ASSERT(!TRACE_RECORDER(cx));                                   \
+            interpReturnOK = true;                                            \
+            goto leave_on_safe_point;                                         \
+        }                                                                     \
+    } while (0)
+#else
+# define LEAVE_ON_SAFE_POINT() /* nop */
+#endif
+
 #define BRANCH(n)                                                             \
     JS_BEGIN_MACRO                                                            \
         regs.pc += (n);                                                       \
         op = (JSOp) *regs.pc;                                                 \
         if ((n) <= 0)                                                         \
             goto check_backedge;                                              \
+        LEAVE_ON_SAFE_POINT();                                                \
         DO_OP();                                                              \
     JS_END_MACRO
 
@@ -1873,6 +1891,13 @@ js::Interpret(JSContext *cx, StackFrame *entryFrame, InterpMode interpMode)
     Value *argv = regs.fp()->maybeFormalArgs();
     CHECK_INTERRUPT_HANDLER();
 
+#if defined(JS_TRACER) && defined(JS_METHODJIT)
+    bool leaveOnSafePoint = (interpMode == JSINTERP_SAFEPOINT);
+# define CLEAR_LEAVE_ON_TRACE_POINT() ((void) (leaveOnSafePoint = false))
+#else
+# define CLEAR_LEAVE_ON_TRACE_POINT() ((void) 0)
+#endif
+
     if (!entryFrame)
         entryFrame = regs.fp();
 
@@ -2057,8 +2082,17 @@ js::Interpret(JSContext *cx, StackFrame *entryFrame, InterpMode interpMode)
             LoopProfile *prof = TRACE_PROFILER(cx);
             JS_ASSERT(!TRACE_RECORDER(cx));
             LoopProfile::ProfileAction act = prof->profileOperation(cx, op);
-            if (act != LoopProfile::ProfComplete)
-                moreInterrupts = true;
+            switch (act) {
+                case LoopProfile::ProfComplete:
+                    if (interpMode != JSINTERP_NORMAL) {
+                        leaveOnSafePoint = true;
+                        LEAVE_ON_SAFE_POINT();
+                    }
+                    break;
+                default:
+                    moreInterrupts = true;
+                    break;
+            }
         }
 #endif
         if (TraceRecorder* tr = TRACE_RECORDER(cx)) {
@@ -2066,6 +2100,23 @@ js::Interpret(JSContext *cx, StackFrame *entryFrame, InterpMode interpMode)
             AbortableRecordingStatus status = tr->monitorRecording(op);
             JS_ASSERT_IF(cx->isExceptionPending(), status == ARECORD_ERROR);
 
+            if (interpMode != JSINTERP_NORMAL) {
+                JS_ASSERT(interpMode == JSINTERP_RECORD || JSINTERP_SAFEPOINT);
+                switch (status) {
+                  case ARECORD_IMACRO_ABORTED:
+                  case ARECORD_ABORTED:
+                  case ARECORD_COMPLETED:
+                  case ARECORD_STOP:
+#ifdef JS_METHODJIT
+                    leaveOnSafePoint = true;
+                    LEAVE_ON_SAFE_POINT();
+#endif
+                    break;
+                  default:
+                    break;
+                }
+            }
+
             switch (status) {
               case ARECORD_CONTINUE:
                 moreInterrupts = true;
@@ -2074,6 +2125,7 @@ js::Interpret(JSContext *cx, StackFrame *entryFrame, InterpMode interpMode)
               case ARECORD_IMACRO_ABORTED:
                 atoms = rt->atomState.commonAtomsStart();
                 op = JSOp(*regs.pc);
+                CLEAR_LEAVE_ON_TRACE_POINT();
                 if (status == ARECORD_IMACRO)
                     DO_OP();    /* keep interrupting for op. */
                 break;
@@ -2118,7 +2170,7 @@ END_EMPTY_CASES
 
 BEGIN_CASE(JSOP_TRACE)
 BEGIN_CASE(JSOP_NOTRACE)
-    /* No-op */
+    LEAVE_ON_SAFE_POINT();
 END_CASE(JSOP_TRACE)
 
 check_backedge:
@@ -2135,6 +2187,7 @@ check_backedge:
             JS_ASSERT(!TRACE_PROFILER(cx));
             MONITOR_BRANCH_TRACEVIS;
             ENABLE_INTERRUPTS();
+            CLEAR_LEAVE_ON_TRACE_POINT();
         }
         JS_ASSERT_IF(cx->isExceptionPending(), r == MONITOR_ERROR);
         RESTORE_INTERP_VARS_CHECK_EXCEPTION();
@@ -2259,6 +2312,7 @@ BEGIN_CASE(JSOP_STOP)
         if (js_CodeSpec[*imacpc].format & JOF_DECOMPOSE)
             regs.pc += GetDecomposeLength(imacpc, js_CodeSpec[*imacpc].length);
         regs.fp()->clearImacropc();
+        LEAVE_ON_SAFE_POINT();
         atoms = script->atoms;
         op = JSOp(*regs.pc);
         DO_OP();
@@ -5359,6 +5413,12 @@ END_VARLEN_CASE
 BEGIN_CASE(JSOP_EXCEPTION)
     PUSH_COPY(cx->getPendingException());
     cx->clearPendingException();
+#if defined(JS_TRACER) && defined(JS_METHODJIT)
+    if (interpMode == JSINTERP_PROFILE) {
+        leaveOnSafePoint = true;
+        LEAVE_ON_SAFE_POINT();
+    }
+#endif
     CHECK_BRANCH();
 END_CASE(JSOP_EXCEPTION)
 
diff --git a/js/src/jsinterp.h b/js/src/jsinterp.h
index afd132cb0e42..f4e013db1b25 100644
--- a/js/src/jsinterp.h
+++ b/js/src/jsinterp.h
@@ -235,9 +235,10 @@ enum InterpMode
 {
     JSINTERP_NORMAL    = 0, /* interpreter is running normally */
     JSINTERP_RECORD    = 1, /* interpreter has been started to record/run traces */
-    JSINTERP_PROFILE   = 2, /* interpreter should profile a loop */
-    JSINTERP_REJOIN    = 3, /* as normal, but the frame has already started */
-    JSINTERP_SKIP_TRAP = 4  /* as REJOIN, but skip trap at first opcode */
+    JSINTERP_SAFEPOINT = 2, /* interpreter should leave on a method JIT safe point */
+    JSINTERP_PROFILE   = 3, /* interpreter should profile a loop */
+    JSINTERP_REJOIN    = 4, /* as normal, but the frame has already started */
+    JSINTERP_SKIP_TRAP = 5  /* as REJOIN, but skip trap at first opcode */
 };
 
 /*
diff --git a/js/src/methodjit/Compiler.cpp b/js/src/methodjit/Compiler.cpp
index 5033afb996a6..32cc33ecfff5 100644
--- a/js/src/methodjit/Compiler.cpp
+++ b/js/src/methodjit/Compiler.cpp
@@ -122,6 +122,7 @@ mjit::Compiler::Compiler(JSContext *cx, JSScript *outerScript, bool isConstructi
     jumpTables(CompilerAllocPolicy(cx, *thisFromCtor())),
     jumpTableOffsets(CompilerAllocPolicy(cx, *thisFromCtor())),
     loopEntries(CompilerAllocPolicy(cx, *thisFromCtor())),
+    rootedObjects(CompilerAllocPolicy(cx, *thisFromCtor())),
     stubcc(cx, *thisFromCtor(), frame),
     debugMode_(cx->compartment->debugMode()),
 #if defined JS_TRACER
@@ -941,6 +942,7 @@ mjit::Compiler::finishThisUp(JITScript **jitp)
                       sizeof(NativeMapEntry) * nNmapLive +
                       sizeof(InlineFrame) * inlineFrames.length() +
                       sizeof(CallSite) * callSites.length() +
+                      sizeof(JSObject *) * rootedObjects.length() +
 #if defined JS_MONOIC
                       sizeof(ic::GetGlobalNameIC) * getGlobalNames.length() +
                       sizeof(ic::SetGlobalNameIC) * setGlobalNames.length() +
@@ -1072,6 +1074,13 @@ mjit::Compiler::finishThisUp(JITScript **jitp)
             stubCode.patch(from.loopPatch.codePatch, result + codeOffset);
     }
 
+    /* Build the list of objects rooted by the script. */
+    JSObject **jitRooted = (JSObject **)cursor;
+    jit->nRootedObjects = rootedObjects.length();
+    cursor += sizeof(JSObject *) * jit->nRootedObjects;
+    for (size_t i = 0; i < jit->nRootedObjects; i++)
+        jitRooted[i] = rootedObjects[i];
+
 #if defined JS_MONOIC
     JS_INIT_CLIST(&jit->callers);
 
@@ -4665,6 +4674,12 @@ mjit::Compiler::jsop_callprop_str(JSAtom *atom)
     if (!js_GetClassPrototype(cx, globalObj, JSProto_String, &obj))
         return false;
 
+    /*
+     * Root the proto, since JS_ClearScope might overwrite the global object's
+     * copy.
+     */
+    rootedObjects.append(obj);
+
     /* Force into a register because getprop won't expect a constant. */
     RegisterID reg = frame.allocReg();
 
@@ -6790,7 +6805,7 @@ mjit::Compiler::jumpAndTrace(Jump j, jsbytecode *target, Jump *slow, bool *tramp
         jsbytecode* pc = PC;
         PC = target;
 
-        OOL_STUBCALL(stubs::InvokeTracer, REJOIN_RUN_TRACER);
+        OOL_STUBCALL(stubs::InvokeTracer, REJOIN_NONE);
 
         PC = pc;
     }
diff --git a/js/src/methodjit/Compiler.h b/js/src/methodjit/Compiler.h
index 218339cdd62c..7a900d476de5 100644
--- a/js/src/methodjit/Compiler.h
+++ b/js/src/methodjit/Compiler.h
@@ -457,6 +457,7 @@ class Compiler : public BaseCompiler
     js::Vector<JumpTable, 16> jumpTables;
     js::Vector<uint32, 16> jumpTableOffsets;
     js::Vector<LoopEntry, 16> loopEntries;
+    js::Vector<JSObject *, 0, CompilerAllocPolicy> rootedObjects;
     StubCompiler stubcc;
     Label invokeLabel;
     Label arityLabel;
diff --git a/js/src/methodjit/InvokeHelpers.cpp b/js/src/methodjit/InvokeHelpers.cpp
index 58cdde0883cf..c3a48ce9bf25 100644
--- a/js/src/methodjit/InvokeHelpers.cpp
+++ b/js/src/methodjit/InvokeHelpers.cpp
@@ -177,17 +177,10 @@ top:
 static void
 InlineReturn(VMFrame &f)
 {
-    bool shiftResult = f.fp()->loweredCallOrApply();
-
     JS_ASSERT(f.fp() != f.entryfp);
     JS_ASSERT(!IsActiveWithOrBlock(f.cx, f.fp()->scopeChain(), 0));
     f.cx->stack.popInlineFrame(f.regs);
 
-    if (shiftResult) {
-        f.regs.sp[-2] = f.regs.sp[-1];
-        f.regs.sp--;
-    }
-
     DebugOnly<JSOp> op = js_GetOpcode(f.cx, f.fp()->script(), f.regs.pc);
     JS_ASSERT(op == JSOP_CALL ||
               op == JSOP_NEW ||
@@ -781,6 +774,18 @@ HandleErrorInExcessFrame(VMFrame &f, StackFrame *stopFp, bool searchedTopmostFra
     return returnOK;
 }
 
+/* Returns whether the current PC has method JIT'd code. */
+static inline void *
+AtSafePoint(JSContext *cx)
+{
+    StackFrame *fp = cx->fp();
+    if (fp->hasImacropc())
+        return NULL;
+
+    JSScript *script = fp->script();
+    return script->maybeNativeCodeForPC(fp->isConstructing(), cx->regs().pc);
+}
+
 /*
  * Interprets until either a safe point is reached that has method JIT'd
  * code, or the current frame tries to return.
@@ -790,12 +795,16 @@ PartialInterpret(VMFrame &f)
 {
     JSContext *cx = f.cx;
     StackFrame *fp = cx->fp();
-    JS_ASSERT(!fp->finishedInInterpreter());
 
-    JS_ASSERT(!cx->compartment->jaegerCompartment()->finishingTracer);
-    cx->compartment->jaegerCompartment()->finishingTracer = true;
-    JSBool ok = Interpret(cx, fp, JSINTERP_REJOIN);
-    cx->compartment->jaegerCompartment()->finishingTracer = false;
+#ifdef DEBUG
+    JSScript *script = fp->script();
+    JS_ASSERT(!fp->finishedInInterpreter());
+    JS_ASSERT(fp->hasImacropc() ||
+              !script->maybeNativeCodeForPC(fp->isConstructing(), cx->regs().pc));
+#endif
+
+    JSBool ok = JS_TRUE;
+    ok = Interpret(cx, fp, JSINTERP_SAFEPOINT);
 
     return ok;
 }
@@ -907,6 +916,13 @@ EvaluateExcessFrame(VMFrame &f, StackFrame *entryFrame)
     if (!fp->hasImacropc() && FrameIsFinished(cx))
         return HandleFinishedFrame(f, entryFrame);
 
+    if (void *ncode = AtSafePoint(cx)) {
+        if (!JaegerShotAtSafePoint(cx, ncode, false))
+            return false;
+        InlineReturn(f);
+        return true;
+    }
+
     return PartialInterpret(f);
 }
 
@@ -997,10 +1013,10 @@ js::mjit::ResetTraceHint(JSScript *script, jsbytecode *pc, uint16_t index, bool
 }
 
 #if JS_MONOIC
-JSBool
+void *
 RunTracer(VMFrame &f, ic::TraceICInfo &ic)
 #else
-JSBool
+void *
 RunTracer(VMFrame &f)
 #endif
 {
@@ -1010,14 +1026,7 @@ RunTracer(VMFrame &f)
 
     /* :TODO: nuke PIC? */
     if (!cx->traceJitEnabled)
-        return false;
-
-    /*
-     * Don't reenter the tracer while finishing frames we bailed out from,
-     * to avoid over-recursing.
-     */
-    if (cx->compartment->jaegerCompartment()->finishingTracer)
-        return false;
+        return NULL;
 
     /*
      * Force initialization of the entry frame's scope chain and return value,
@@ -1047,8 +1056,6 @@ RunTracer(VMFrame &f)
     hits = 1;
 #endif
 
-    RecompilationMonitor monitor(cx);
-
     {
         /*
          * While the tracer is running, redirect the regs to a local variable here.
@@ -1064,17 +1071,12 @@ RunTracer(VMFrame &f)
         tpa = MonitorTracePoint(f.cx, &blacklist, traceData, traceEpoch,
                                 loopCounter, hits);
         JS_ASSERT(!TRACE_RECORDER(cx));
-
-        if (tpa != TPA_Nothing)
-            ClearAllFrames(cx->compartment);
     }
 
 #if JS_MONOIC
-    if (!monitor.recompiled()) {
-        ic.loopCounterStart = *loopCounter;
-        if (blacklist)
-            DisableTraceHint(entryFrame->jit(), ic);
-    }
+    ic.loopCounterStart = *loopCounter;
+    if (blacklist)
+        DisableTraceHint(entryFrame->jit(), ic);
 #endif
 
     // Even though ExecuteTree() bypasses the interpreter, it should propagate
@@ -1084,11 +1086,11 @@ RunTracer(VMFrame &f)
     JS_ASSERT(f.fp() == cx->fp());
     switch (tpa) {
       case TPA_Nothing:
-        return false;
+        return NULL;
 
       case TPA_Error:
         if (!HandleErrorInExcessFrame(f, entryFrame, f.fp()->finishedInInterpreter()))
-            THROWV(false);
+            THROWV(NULL);
         JS_ASSERT(!cx->fp()->hasImacropc());
         break;
 
@@ -1124,7 +1126,7 @@ RunTracer(VMFrame &f)
   restart:
     /* Step 1. Finish frames created after the entry frame. */
     if (!FinishExcessFrames(f, entryFrame))
-        THROWV(false);
+        THROWV(NULL);
 
     /* IMacros are guaranteed to have been removed by now. */
     JS_ASSERT(f.fp() == entryFrame);
@@ -1133,14 +1135,19 @@ RunTracer(VMFrame &f)
     /* Step 2. If entryFrame is done, use a special path to return to EnterMethodJIT(). */
     if (FrameIsFinished(cx)) {
         if (!HandleFinishedFrame(f, entryFrame))
-            THROWV(false);
-        return true;
+            THROWV(NULL);
+        *f.returnAddressLocation() = cx->jaegerCompartment()->forceReturnFromFastCall();
+        return NULL;
     }
 
-    /* Step 3. Do a partial interp, then restart the whole process. */
+    /* Step 3. If entryFrame is at a safe point, just leave. */
+    if (void *ncode = AtSafePoint(cx))
+        return ncode;
+
+    /* Step 4. Do a partial interp, then restart the whole process. */
     if (!PartialInterpret(f)) {
         if (!HandleErrorInExcessFrame(f, entryFrame))
-            THROWV(false);
+            THROWV(NULL);
     }
 
     goto restart;
@@ -1150,7 +1157,7 @@ RunTracer(VMFrame &f)
 
 #if defined JS_TRACER
 # if defined JS_MONOIC
-JSBool JS_FASTCALL
+void * JS_FASTCALL
 stubs::InvokeTracer(VMFrame &f, ic::TraceICInfo *ic)
 {
     return RunTracer(f, *ic);
@@ -1158,7 +1165,7 @@ stubs::InvokeTracer(VMFrame &f, ic::TraceICInfo *ic)
 
 # else
 
-JSBool JS_FASTCALL
+void * JS_FASTCALL
 stubs::InvokeTracer(VMFrame &f)
 {
     return RunTracer(f);
@@ -1559,23 +1566,6 @@ js_InternalInterpret(void *returnData, void *returnType, void *returnReg, js::VM
         break;
       }
 
-      case REJOIN_RUN_TRACER:
-        if (returnReg) {
-            /* InvokeTracer finishes the frame it is given, including the epilogue. */
-            if (fp->isFunctionFrame())
-                fp->markFunctionEpilogueDone();
-            if (fp != f.entryfp) {
-                InlineReturn(f);
-                cx->compartment->jaegerCompartment()->setLastUnfinished(Jaeger_Unfinished);
-                *f.oldregs = f.regs;
-                return NULL;
-            } else {
-                cx->compartment->jaegerCompartment()->setLastUnfinished(Jaeger_Returned);
-                return NULL;
-            }
-        }
-        break;
-
       default:
         JS_NOT_REACHED("Missing rejoin");
     }
diff --git a/js/src/methodjit/MethodJIT.cpp b/js/src/methodjit/MethodJIT.cpp
index a72307a01415..3be8da7703c6 100644
--- a/js/src/methodjit/MethodJIT.cpp
+++ b/js/src/methodjit/MethodJIT.cpp
@@ -894,7 +894,7 @@ mjit::EnterMethodJIT(JSContext *cx, StackFrame *fp, void *code, Value *stackLimi
 
     JaegerStatus status = cx->compartment->jaegerCompartment()->lastUnfinished();
     if (status) {
-        if (partial || status == Jaeger_Returned) {
+        if (partial) {
             /*
              * Being called from the interpreter, which will resume execution
              * where the JIT left off.
@@ -990,10 +990,16 @@ JITScript::callSites() const
     return (js::mjit::CallSite *)&inlineFrames()[nInlineFrames];
 }
 
+JSObject **
+JITScript::rootedObjects() const
+{
+    return (JSObject **)&callSites()[nCallSites];
+}
+
 char *
 JITScript::commonSectionLimit() const
 {
-    return (char *)&callSites()[nCallSites];
+    return (char *)&rootedObjects()[nRootedObjects];
 }
 
 #ifdef JS_MONOIC
@@ -1149,6 +1155,7 @@ mjit::JITScript::scriptDataSize(JSUsableSizeFun usf)
         sizeof(NativeMapEntry) * nNmapPairs +
         sizeof(InlineFrame) * nInlineFrames +
         sizeof(CallSite) * nCallSites +
+        sizeof(JSObject *) * nRootedObjects +
 #if defined JS_MONOIC
         sizeof(ic::GetGlobalNameIC) * nGetGlobalNames +
         sizeof(ic::SetGlobalNameIC) * nSetGlobalNames +
@@ -1288,4 +1295,41 @@ mjit::NativeToPC(JITScript *jit, void *ncode, mjit::CallSite **pinline)
     return jit->nativeToPC(ncode, pinline);
 }
 
+void
+JITScript::trace(JSTracer *trc)
+{
+    /*
+     * MICs and PICs attached to the JITScript are weak references, and either
+     * entirely purged or selectively purged on each GC. We do, however, need
+     * to maintain references to any scripts whose code was inlined into this.
+     */
+    InlineFrame *inlineFrames_ = inlineFrames();
+    for (unsigned i = 0; i < nInlineFrames; i++)
+        MarkObject(trc, *inlineFrames_[i].fun, "jitscript_fun");
+
+    for (uint32 i = 0; i < nRootedObjects; ++i)
+        MarkObject(trc, *rootedObjects()[i], "mjit rooted object");
+}
+
+void
+mjit::PurgeICs(JSContext *cx, JSScript *script)
+{
+#ifdef JS_MONOIC
+    if (script->jitNormal) {
+        script->jitNormal->purgeMICs();
+        script->jitNormal->sweepCallICs(cx);
+    }
+    if (script->jitCtor) {
+        script->jitCtor->purgeMICs();
+        script->jitCtor->sweepCallICs(cx);
+    }
+#endif
+#ifdef JS_POLYIC
+    if (script->jitNormal)
+        script->jitNormal->purgePICs();
+    if (script->jitCtor)
+        script->jitCtor->purgePICs();
+#endif
+}
+
 /* static */ const double mjit::Assembler::oneDouble = 1.0;
diff --git a/js/src/methodjit/MethodJIT.h b/js/src/methodjit/MethodJIT.h
index b89401eb0599..07466d0a9b48 100644
--- a/js/src/methodjit/MethodJIT.h
+++ b/js/src/methodjit/MethodJIT.h
@@ -317,10 +317,7 @@ enum RejoinState {
      * For an opcode fused with IFEQ/IFNE, call returns a boolean indicating
      * the result of the comparison and whether to take or not take the branch.
      */
-    REJOIN_BRANCH,
-
-    /* Calls to RunTracer which either finished the frame or did nothing. */
-    REJOIN_RUN_TRACER
+    REJOIN_BRANCH
 };
 
 /* Helper to watch for recompilation and frame expansion activity on a compartment. */
@@ -463,9 +460,6 @@ class JaegerCompartment {
      */
     Vector<StackFrame *, 8, SystemAllocPolicy> orphanedNativeFrames;
     Vector<JSC::ExecutablePool *, 8, SystemAllocPolicy> orphanedNativePools;
-
-    /* Whether frames pushed after bailing out in RunTracer are unwinding. */
-    bool finishingTracer;
 };
 
 /*
@@ -612,6 +606,7 @@ struct JITScript {
     bool            singleStepMode:1;   /* compiled in "single step mode" */
     uint32          nInlineFrames;
     uint32          nCallSites;
+    uint32          nRootedObjects;
 #ifdef JS_MONOIC
     uint32          nGetGlobalNames;
     uint32          nSetGlobalNames;
@@ -649,6 +644,7 @@ struct JITScript {
     NativeMapEntry *nmap() const;
     js::mjit::InlineFrame *inlineFrames() const;
     js::mjit::CallSite *callSites() const;
+    JSObject **rootedObjects() const;
 #ifdef JS_MONOIC
     ic::GetGlobalNameIC *getGlobalNames() const;
     ic::SetGlobalNameIC *setGlobalNames() const;
@@ -670,9 +666,14 @@ struct JITScript {
         return jcheck >= jitcode && jcheck < jitcode + code.m_size;
     }
 
-    void nukeScriptDependentICs();
     void purgeGetterPICs();
 
+    void sweepCallICs(JSContext *cx);
+    void purgeMICs();
+    void purgePICs();
+
+    void trace(JSTracer *trc);
+
     /* |usf| can be NULL here, in which case the fallback size computation will be used. */
     size_t scriptDataSize(JSUsableSizeFun usf);
 
@@ -685,6 +686,8 @@ struct JITScript {
     char *polyICSectionsLimit() const;
 };
 
+void PurgeICs(JSContext *cx, JSScript *script);
+
 /*
  * Execute the given mjit code. This is a low-level call and callers must
  * provide the same guarantees as JaegerShot/CheckStackAndEnterMethodJIT.
diff --git a/js/src/methodjit/MonoIC.cpp b/js/src/methodjit/MonoIC.cpp
index 0763788456a5..175652efed28 100644
--- a/js/src/methodjit/MonoIC.cpp
+++ b/js/src/methodjit/MonoIC.cpp
@@ -1389,5 +1389,78 @@ JITScript::resetArgsCheck()
     repatch.relink(argsCheckJump, argsCheckStub);
 }
 
+void
+JITScript::purgeMICs()
+{
+    if (!nGetGlobalNames || !nSetGlobalNames)
+        return;
+
+    Repatcher repatch(this);
+
+    ic::GetGlobalNameIC *getGlobalNames_ = getGlobalNames();
+    for (uint32 i = 0; i < nGetGlobalNames; i++) {
+        ic::GetGlobalNameIC &ic = getGlobalNames_[i];
+        JSC::CodeLocationDataLabel32 label = ic.fastPathStart.dataLabel32AtOffset(ic.shapeOffset);
+        repatch.repatch(label, int(INVALID_SHAPE));
+    }
+
+    ic::SetGlobalNameIC *setGlobalNames_ = setGlobalNames();
+    for (uint32 i = 0; i < nSetGlobalNames; i++) {
+        ic::SetGlobalNameIC &ic = setGlobalNames_[i];
+        ic.patchInlineShapeGuard(repatch, int32(INVALID_SHAPE));
+
+        if (ic.hasExtraStub) {
+            Repatcher repatcher(ic.extraStub);
+            ic.patchExtraShapeGuard(repatcher, int32(INVALID_SHAPE));
+        }
+    }
+}
+
+void
+JITScript::sweepCallICs(JSContext *cx)
+{
+    Repatcher repatcher(this);
+
+    ic::CallICInfo *callICs_ = callICs();
+    for (uint32 i = 0; i < nCallICs; i++) {
+        ic::CallICInfo &ic = callICs_[i];
+
+        /*
+         * If the object is unreachable, we're guaranteed not to be currently
+         * executing a stub generated by a guard on that object. This lets us
+         * precisely GC call ICs while keeping the identity guard safe.
+         */
+        bool fastFunDead = ic.fastGuardedObject &&
+            IsAboutToBeFinalized(cx, ic.fastGuardedObject);
+        bool nativeDead = ic.fastGuardedNative &&
+            IsAboutToBeFinalized(cx, ic.fastGuardedNative);
+
+        /*
+         * There are two conditions where we need to relink:
+         * (1) The native is dead, since it always has a stub.
+         * (2) The fastFun is dead *and* there is a closure stub.
+         *
+         * Note although both objects can be non-NULL, there can only be one
+         * of [closure, native] stub per call IC.
+         */
+        if (nativeDead || (fastFunDead && ic.hasJsFunCheck)) {
+            repatcher.relink(ic.funJump, ic.slowPathStart);
+            ic.hit = false;
+        }
+
+        if (fastFunDead) {
+            repatcher.repatch(ic.funGuard, NULL);
+            ic.purgeGuardedObject();
+        }
+
+        if (nativeDead)
+            ic.fastGuardedNative = NULL;
+    }
+
+    /* The arguments type check IC can refer to type objects which might be swept. */
+    if (argsCheckPool)
+        resetArgsCheck();
+}
+
 #endif /* JS_MONOIC */
 
diff --git a/js/src/methodjit/MonoIC.h b/js/src/methodjit/MonoIC.h
index b8e89e4f16a8..7a52db92f097 100644
--- a/js/src/methodjit/MonoIC.h
+++ b/js/src/methodjit/MonoIC.h
@@ -284,6 +284,14 @@ struct CallICInfo {
         }
     }
 
+    inline void purgeGuardedObject() {
+        JS_ASSERT(fastGuardedObject);
+        releasePool(CallICInfo::Pool_ClosureStub);
+        hasJsFunCheck = false;
+        fastGuardedObject = NULL;
+        JS_REMOVE_LINK(&links);
+    }
+
     void purge();
 };
 
diff --git a/js/src/methodjit/PolyIC.cpp b/js/src/methodjit/PolyIC.cpp
index 78637edf081a..91329ec8eca9 100644
--- a/js/src/methodjit/PolyIC.cpp
+++ b/js/src/methodjit/PolyIC.cpp
@@ -3249,5 +3249,48 @@ JITScript::purgeGetterPICs()
     }
 }
 
+void
+JITScript::purgePICs()
+{
+    if (!nPICs && !nGetElems && !nSetElems)
+        return;
+
+    Repatcher repatcher(this);
+
+    ic::PICInfo *pics_ = pics();
+    for (uint32 i = 0; i < nPICs; i++) {
+        ic::PICInfo &pic = pics_[i];
+        switch (pic.kind) {
+          case ic::PICInfo::SET:
+          case ic::PICInfo::SETMETHOD:
+            SetPropCompiler::reset(repatcher, pic);
+            break;
+          case ic::PICInfo::NAME:
+          case ic::PICInfo::XNAME:
+          case ic::PICInfo::CALLNAME:
+            ScopeNameCompiler::reset(repatcher, pic);
+            break;
+          case ic::PICInfo::BIND:
+            BindNameCompiler::reset(repatcher, pic);
+            break;
+          case ic::PICInfo::CALL: /* fall-through */
+          case ic::PICInfo::GET:
+            GetPropCompiler::reset(repatcher, pic);
+            break;
+          default:
+            JS_NOT_REACHED("Unhandled PIC kind");
+            break;
+        }
+        pic.reset();
+    }
+
+    ic::GetElementIC *getElems_ = getElems();
+    ic::SetElementIC *setElems_ = setElems();
+    for (uint32 i = 0; i < nGetElems; i++)
+        getElems_[i].purge(repatcher);
+    for (uint32 i = 0; i < nSetElems; i++)
+        setElems_[i].purge(repatcher);
+}
+
 #endif /* JS_POLYIC */
 
diff --git a/js/src/methodjit/StubCalls.h b/js/src/methodjit/StubCalls.h
index 7c9e72b21d93..41c712a24b7e 100644
--- a/js/src/methodjit/StubCalls.h
+++ b/js/src/methodjit/StubCalls.h
@@ -114,9 +114,9 @@ void UncachedNewHelper(VMFrame &f, uint32 argc, UncachedCallResult *ucr);
 void JS_FASTCALL CreateThis(VMFrame &f, JSObject *proto);
 void JS_FASTCALL Throw(VMFrame &f);
 #if JS_MONOIC
-JSBool JS_FASTCALL InvokeTracer(VMFrame &f, ic::TraceICInfo *tic);
+void * JS_FASTCALL InvokeTracer(VMFrame &f, ic::TraceICInfo *tic);
 #else
-JSBool JS_FASTCALL InvokeTracer(VMFrame &f);
+void * JS_FASTCALL InvokeTracer(VMFrame &f);
 #endif
 
 void * JS_FASTCALL LookupSwitch(VMFrame &f, jsbytecode *pc);

From e626e8ff0c11fd8023c01f72bc4304389243c8ef Mon Sep 17 00:00:00 2001
From: Neil Rashbrook <neil@parkwaycc.co.uk>
Date: Thu, 15 Sep 2011 08:40:17 +0100
Subject: [PATCH 155/209] Bug 611503 Constructing an nsTDependentString from an
 nsTAString makes no sense r=dbaron,dwitte

---
 dom/base/nsDOMClassInfo.cpp                     |  2 +-
 gfx/thebes/gfxFT2FontList.cpp                   |  3 +--
 layout/style/nsCSSValue.cpp                     |  3 +--
 netwerk/cookie/CookieServiceParent.cpp          |  3 ++-
 netwerk/cookie/nsCookieService.cpp              | 15 +++++++--------
 netwerk/cookie/nsCookieService.h                |  2 +-
 .../exthandler/android/nsMIMEInfoAndroid.cpp    |  2 +-
 widget/src/android/AndroidBridge.cpp            |  2 +-
 widget/src/android/AndroidBridge.h              |  2 +-
 widget/src/xpwidgets/nsXPLookAndFeel.cpp        |  4 +---
 xpcom/string/public/nsTDependentString.h        |  9 +++++----
 xpcom/string/src/nsTDependentString.cpp         | 17 +++++++++++++++++
 12 files changed, 39 insertions(+), 25 deletions(-)

diff --git a/dom/base/nsDOMClassInfo.cpp b/dom/base/nsDOMClassInfo.cpp
index 8f25dfa3c6fd..43c80b78a217 100644
--- a/dom/base/nsDOMClassInfo.cpp
+++ b/dom/base/nsDOMClassInfo.cpp
@@ -8120,7 +8120,7 @@ nsDOMStringMapSH::Enumerate(nsIXPConnectWrappedNative *wrapper, JSContext *cx,
   NS_ENSURE_SUCCESS(rv, rv);
 
   for (PRUint32 i = 0; i < properties.Length(); ++i) {
-    nsDependentString prop(properties[i]);
+    nsString& prop(properties[i]);
     *_retval = JS_DefineUCProperty(cx, obj, prop.get(), prop.Length(),
                                    JSVAL_VOID, nsnull, nsnull,
                                    JSPROP_ENUMERATE | JSPROP_SHARED);
diff --git a/gfx/thebes/gfxFT2FontList.cpp b/gfx/thebes/gfxFT2FontList.cpp
index 9a7bef23ebcd..4604a5f9e518 100644
--- a/gfx/thebes/gfxFT2FontList.cpp
+++ b/gfx/thebes/gfxFT2FontList.cpp
@@ -312,8 +312,7 @@ gfxFT2FontList::GetDefaultFont(const gfxFontStyle* aStyle, PRBool& aNeedsBold)
     }
 #elif defined(ANDROID)
     nsAutoString resolvedName;
-    if (ResolveFontName(nsDependentString(NS_LITERAL_STRING("Droid Sans")), 
-                        resolvedName))
+    if (ResolveFontName(NS_LITERAL_STRING("Droid Sans"), resolvedName))
         return FindFontForFamily(resolvedName, aStyle, aNeedsBold);
 #endif
     /* TODO: what about Qt or other platforms that may use this? */
diff --git a/layout/style/nsCSSValue.cpp b/layout/style/nsCSSValue.cpp
index 6fd4e0c2993b..a303eff13364 100644
--- a/layout/style/nsCSSValue.cpp
+++ b/layout/style/nsCSSValue.cpp
@@ -922,8 +922,7 @@ nsCSSValue::AppendToString(nsCSSProperty aProperty, nsAString& aResult) const
     aResult.Append(NS_LITERAL_STRING("-moz-element(#"));
     nsAutoString tmpStr;
     GetStringValue(tmpStr);
-    nsStyleUtil::AppendEscapedCSSIdent(
-      nsDependentString(tmpStr), aResult);
+    nsStyleUtil::AppendEscapedCSSIdent(tmpStr, aResult);
     aResult.Append(NS_LITERAL_STRING(")"));
   }
   else if (eCSSUnit_Percent == unit) {
diff --git a/netwerk/cookie/CookieServiceParent.cpp b/netwerk/cookie/CookieServiceParent.cpp
index 47e72da16f19..c2d3185c4a7e 100644
--- a/netwerk/cookie/CookieServiceParent.cpp
+++ b/netwerk/cookie/CookieServiceParent.cpp
@@ -95,8 +95,9 @@ CookieServiceParent::RecvSetCookieString(const IPC::URI& aHost,
   if (!hostURI)
     return false;
 
+  nsDependentCString cookieString(aCookieString, 0);
   mCookieService->SetCookieStringInternal(hostURI, aIsForeign,
-                                          aCookieString, aServerTime,
+                                          cookieString, aServerTime,
                                           aFromHttp);
   return true;
 }
diff --git a/netwerk/cookie/nsCookieService.cpp b/netwerk/cookie/nsCookieService.cpp
index 5893a06551df..93d4da4348ee 100644
--- a/netwerk/cookie/nsCookieService.cpp
+++ b/netwerk/cookie/nsCookieService.cpp
@@ -1493,11 +1493,11 @@ nsCookieService::SetCookieStringCommon(nsIURI *aHostURI,
 }
 
 void
-nsCookieService::SetCookieStringInternal(nsIURI          *aHostURI,
-                                         bool             aIsForeign,
-                                         const nsCString &aCookieHeader,
-                                         const nsCString &aServerTime,
-                                         PRBool           aFromHttp) 
+nsCookieService::SetCookieStringInternal(nsIURI             *aHostURI,
+                                         bool                aIsForeign,
+                                         nsDependentCString &aCookieHeader,
+                                         const nsCString    &aServerTime,
+                                         PRBool              aFromHttp)
 {
   NS_ASSERTION(aHostURI, "null host!");
 
@@ -1550,9 +1550,8 @@ nsCookieService::SetCookieStringInternal(nsIURI          *aHostURI,
   }
 
   // process each cookie in the header
-  nsDependentCString cookieHeader(aCookieHeader);
-  while (SetCookieInternal(aHostURI, baseDomain, requireHostMatch,
-                           cookieStatus, cookieHeader, serverTime, aFromHttp)) {
+  while (SetCookieInternal(aHostURI, baseDomain, requireHostMatch, cookieStatus,
+                           aCookieHeader, serverTime, aFromHttp)) {
     // document.cookie can only set one cookie at a time
     if (!aFromHttp)
       break;
diff --git a/netwerk/cookie/nsCookieService.h b/netwerk/cookie/nsCookieService.h
index 6fced2621b04..267ce7bc61e6 100644
--- a/netwerk/cookie/nsCookieService.h
+++ b/netwerk/cookie/nsCookieService.h
@@ -263,7 +263,7 @@ class nsCookieService : public nsICookieService
     nsresult                      GetCookieStringCommon(nsIURI *aHostURI, nsIChannel *aChannel, bool aHttpBound, char** aCookie);
     void                          GetCookieStringInternal(nsIURI *aHostURI, bool aIsForeign, PRBool aHttpBound, nsCString &aCookie);
     nsresult                      SetCookieStringCommon(nsIURI *aHostURI, const char *aCookieHeader, const char *aServerTime, nsIChannel *aChannel, bool aFromHttp);
-    void                          SetCookieStringInternal(nsIURI *aHostURI, bool aIsForeign, const nsCString &aCookieHeader, const nsCString &aServerTime, PRBool aFromHttp);
+    void                          SetCookieStringInternal(nsIURI *aHostURI, bool aIsForeign, nsDependentCString &aCookieHeader, const nsCString &aServerTime, PRBool aFromHttp);
     PRBool                        SetCookieInternal(nsIURI *aHostURI, const nsCString& aBaseDomain, PRBool aRequireHostMatch, CookieStatus aStatus, nsDependentCString &aCookieHeader, PRInt64 aServerTime, PRBool aFromHttp);
     void                          AddInternal(const nsCString& aBaseDomain, nsCookie *aCookie, PRInt64 aCurrentTimeInUsec, nsIURI *aHostURI, const char *aCookieHeader, PRBool aFromHttp);
     void                          RemoveCookieFromList(const nsListIter &aIter, mozIStorageBindingParamsArray *aParamsArray = NULL);
diff --git a/uriloader/exthandler/android/nsMIMEInfoAndroid.cpp b/uriloader/exthandler/android/nsMIMEInfoAndroid.cpp
index c15b9ee2eb67..4ac91ea629c9 100644
--- a/uriloader/exthandler/android/nsMIMEInfoAndroid.cpp
+++ b/uriloader/exthandler/android/nsMIMEInfoAndroid.cpp
@@ -89,7 +89,7 @@ nsMIMEInfoAndroid::GetMimeInfoForMimeType(const nsACString& aMimeType,
     info->mPrefApp = systemDefault;
 
   nsCAutoString fileExt;
-  bridge->GetExtensionFromMimeType(nsDependentCString(aMimeType), fileExt);
+  bridge->GetExtensionFromMimeType(aMimeType, fileExt);
   info->SetPrimaryExtension(fileExt);
   
   PRUint32 len;
diff --git a/widget/src/android/AndroidBridge.cpp b/widget/src/android/AndroidBridge.cpp
index e4dad3416a4e..972bd4bb0f01 100644
--- a/widget/src/android/AndroidBridge.cpp
+++ b/widget/src/android/AndroidBridge.cpp
@@ -494,7 +494,7 @@ AndroidBridge::GetMimeTypeFromExtensions(const nsACString& aFileExt, nsCString&
 }
 
 void
-AndroidBridge::GetExtensionFromMimeType(const nsCString& aMimeType, nsACString& aFileExt)
+AndroidBridge::GetExtensionFromMimeType(const nsACString& aMimeType, nsACString& aFileExt)
 {
     ALOG_BRIDGE("AndroidBridge::GetExtensionFromMimeType");
 
diff --git a/widget/src/android/AndroidBridge.h b/widget/src/android/AndroidBridge.h
index 7a6f801feec7..cfb79eae1d9b 100644
--- a/widget/src/android/AndroidBridge.h
+++ b/widget/src/android/AndroidBridge.h
@@ -162,7 +162,7 @@ public:
                            const nsAString& aTitle = EmptyString());
 
     void GetMimeTypeFromExtensions(const nsACString& aFileExt, nsCString& aMimeType);
-    void GetExtensionFromMimeType(const nsCString& aMimeType, nsACString& aFileExt);
+    void GetExtensionFromMimeType(const nsACString& aMimeType, nsACString& aFileExt);
 
     void MoveTaskToBack();
 
diff --git a/widget/src/xpwidgets/nsXPLookAndFeel.cpp b/widget/src/xpwidgets/nsXPLookAndFeel.cpp
index e698a1c4e776..d106e73bde4b 100644
--- a/widget/src/xpwidgets/nsXPLookAndFeel.cpp
+++ b/widget/src/xpwidgets/nsXPLookAndFeel.cpp
@@ -330,9 +330,7 @@ nsXPLookAndFeel::ColorPrefChanged (unsigned int index, const char *prefName)
   if (!colorStr.IsEmpty()) {
     nscolor thecolor;
     if (colorStr[0] == PRUnichar('#')) {
-      if (NS_HexToRGB(nsDependentString(
-                        Substring(colorStr, 1, colorStr.Length() - 1)),
-                      &thecolor)) {
+      if (NS_HexToRGB(nsDependentString(colorStr, 1), &thecolor)) {
         PRInt32 id = NS_PTR_TO_INT32(index);
         CACHE_COLOR(id, thecolor);
       }
diff --git a/xpcom/string/public/nsTDependentString.h b/xpcom/string/public/nsTDependentString.h
index a9192e02a4c2..818f7200d031 100644
--- a/xpcom/string/public/nsTDependentString.h
+++ b/xpcom/string/public/nsTDependentString.h
@@ -91,11 +91,10 @@ class nsTDependentString_CharT : public nsTString_CharT
           AssertValid();
         }
 
-      explicit
-      nsTDependentString_CharT( const substring_type& str )
-        : string_type(const_cast<char_type*>(str.Data()), str.Length(), F_TERMINATED)
+      nsTDependentString_CharT( const string_type& str, PRUint32 startPos )
+        : string_type()
         {
-          AssertValid();
+          Rebind(str, startPos);
         }
 
       // Create a nsTDependentSubstring to be bound later
@@ -124,6 +123,8 @@ class nsTDependentString_CharT : public nsTString_CharT
           Rebind(start, PRUint32(end - start));
         }
 
+      void Rebind( const string_type&, PRUint32 startPos );
+
     private:
       
       // NOT USED
diff --git a/xpcom/string/src/nsTDependentString.cpp b/xpcom/string/src/nsTDependentString.cpp
index f1dd21cc9262..88a41f448fdb 100644
--- a/xpcom/string/src/nsTDependentString.cpp
+++ b/xpcom/string/src/nsTDependentString.cpp
@@ -48,3 +48,20 @@ nsTDependentString_CharT::Rebind( const char_type* data, size_type length )
     SetDataFlags(F_TERMINATED);
     AssertValid();
   }
+
+void
+nsTDependentString_CharT::Rebind( const string_type& str, PRUint32 startPos )
+  {
+    // If we currently own a buffer, release it.
+    Finalize();
+
+    size_type strLength = str.Length();
+
+    if (startPos > strLength)
+      startPos = strLength;
+
+    mData = const_cast<char_type*>(str.Data()) + startPos;
+    mLength = strLength - startPos;
+
+    SetDataFlags(F_TERMINATED);
+  }

From 08ff38052a20b0e9f6a93622a2f99aa02bdeec36 Mon Sep 17 00:00:00 2001
From: Neil Rashbrook <neil@parkwaycc.co.uk>
Date: Thu, 15 Sep 2011 09:36:07 +0100
Subject: [PATCH 156/209] Bug 660532 Remove useless uses of PromiseFlatCString
 r=sdwilsh

---
 storage/src/mozStorageStatement.cpp        |  3 +--
 toolkit/components/places/nsNavHistory.cpp | 22 +++++++++-------------
 2 files changed, 10 insertions(+), 15 deletions(-)

diff --git a/storage/src/mozStorageStatement.cpp b/storage/src/mozStorageStatement.cpp
index 12d583de00a4..e5f8edf86247 100644
--- a/storage/src/mozStorageStatement.cpp
+++ b/storage/src/mozStorageStatement.cpp
@@ -478,8 +478,7 @@ Statement::GetParameterIndex(const nsACString &aName,
   // the colon for SQLite.
   nsCAutoString name(":");
   name.Append(aName);
-  int ind = ::sqlite3_bind_parameter_index(mDBStatement,
-                                           PromiseFlatCString(name).get());
+  int ind = ::sqlite3_bind_parameter_index(mDBStatement, name.get());
   if (ind  == 0) // Named parameter not found.
     return NS_ERROR_INVALID_ARG;
 
diff --git a/toolkit/components/places/nsNavHistory.cpp b/toolkit/components/places/nsNavHistory.cpp
index 42ccab0cebdd..ab80ff868346 100644
--- a/toolkit/components/places/nsNavHistory.cpp
+++ b/toolkit/components/places/nsNavHistory.cpp
@@ -683,7 +683,7 @@ nsNavHistory::SetJournalMode(enum JournalMode aJournalMode)
   }
   else {
     NS_WARNING(nsPrintfCString(128, "Setting journal mode failed: %s",
-                               PromiseFlatCString(journalMode).get()).get());
+                               journalMode.get()).get());
     return NS_ERROR_FAILURE;
   }
 
@@ -3516,14 +3516,14 @@ PlacesSQLQueryBuilder::SelectAsSite()
     ") ",
     nsINavHistoryQueryOptions::RESULTS_AS_URI,
     mSortingMode,
-    PromiseFlatCString(timeConstraints).get(),
-    PromiseFlatCString(visitsJoin).get(),
-    PromiseFlatCString(additionalConditions).get(),
+    timeConstraints.get(),
+    visitsJoin.get(),
+    additionalConditions.get(),
     nsINavHistoryQueryOptions::RESULTS_AS_URI,
     mSortingMode,
-    PromiseFlatCString(timeConstraints).get(),
-    PromiseFlatCString(visitsJoin).get(),
-    PromiseFlatCString(additionalConditions).get()
+    timeConstraints.get(),
+    visitsJoin.get(),
+    additionalConditions.get()
   );
 
   return NS_OK;
@@ -3936,9 +3936,7 @@ nsNavHistory::GetQueryResults(nsNavHistoryQueryResultNode *aResultNode,
     PRInt32 lastError = 0;
     (void)mDBConn->GetLastError(&lastError);
     printf("Places failed to create a statement from this query:\n%s\nStorage error (%d): %s\n",
-           PromiseFlatCString(queryString).get(),
-           lastError,
-           PromiseFlatCString(lastErrorString).get());
+           queryString.get(), lastError, lastErrorString.get());
   }
 #endif
   NS_ENSURE_SUCCESS(rv, rv);
@@ -5193,9 +5191,7 @@ nsNavHistory::AsyncExecuteLegacyQueries(nsINavHistoryQuery** aQueries,
     PRInt32 lastError = 0;
     (void)mDBConn->GetLastError(&lastError);
     printf("Places failed to create a statement from this query:\n%s\nStorage error (%d): %s\n",
-           PromiseFlatCString(queryString).get(),
-           lastError,
-           PromiseFlatCString(lastErrorString).get());
+           queryString.get(), lastError, lastErrorString.get());
   }
 #endif
   NS_ENSURE_SUCCESS(rv, rv);

From be74f2b718deb804190cabc2d5c0f6c635d786fa Mon Sep 17 00:00:00 2001
From: Len <lenniger@yahoo.com>
Date: Thu, 15 Sep 2011 19:53:30 +0200
Subject: [PATCH 157/209] Bug 487242 - Implement 'unread' attribute for
 tabbrowser tabs. r=dao

---
 browser/base/content/tabbrowser.xml | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/browser/base/content/tabbrowser.xml b/browser/base/content/tabbrowser.xml
index 7699d364ad21..3c4ebcde4d84 100644
--- a/browser/base/content/tabbrowser.xml
+++ b/browser/base/content/tabbrowser.xml
@@ -565,6 +565,8 @@
 
                 this.mTab.removeAttribute("busy");
                 this.mTab.removeAttribute("progress");
+                if (!this.mTab.selected)
+                  this.mTab.setAttribute("unread", "true");
 
                 var location = aRequest.QueryInterface(nsIChannel).URI;
 
@@ -871,6 +873,7 @@
               (window.windowState != window.STATE_MINIMIZED);
             this.mCurrentBrowser = newBrowser;
             this.mCurrentTab = this.selectedTab;
+            this.mCurrentTab.removeAttribute("unread");
             this.showTab(this.mCurrentTab);
 
             if (updatePageReport)

From b9fb62bd5e010286b43723bc6b126c93dccfe80c Mon Sep 17 00:00:00 2001
From: Brian Hackett <bhackett1024@gmail.com>
Date: Thu, 15 Sep 2011 12:11:03 -0700
Subject: [PATCH 158/209] [INFER] Fail compilation rather than assert if a
 constant pool is dumped while generating an IC, bug 669715.

---
 js/src/assembler/assembler/ARMAssembler.h     |  6 +--
 .../AssemblerBufferWithConstantPool.h         | 19 +++-----
 .../assembler/assembler/MacroAssemblerARM.h   |  6 +--
 js/src/methodjit/BaseCompiler.h               | 44 +++++--------------
 js/src/methodjit/Compiler.cpp                 |  6 +++
 js/src/methodjit/Compiler.h                   |  1 +
 6 files changed, 26 insertions(+), 56 deletions(-)

diff --git a/js/src/assembler/assembler/ARMAssembler.h b/js/src/assembler/assembler/ARMAssembler.h
index 0960e0544a20..11c892eca518 100644
--- a/js/src/assembler/assembler/ARMAssembler.h
+++ b/js/src/assembler/assembler/ARMAssembler.h
@@ -947,12 +947,10 @@ namespace JSC {
             return m_buffer.sizeOfConstantPool();
         }
 
-#ifdef DEBUG
-        void allowPoolFlush(bool allowFlush)
+        int flushCount()
         {
-            m_buffer.allowPoolFlush(allowFlush);
+            return m_buffer.flushCount();
         }
-#endif
 
         JmpDst label()
         {
diff --git a/js/src/assembler/assembler/AssemblerBufferWithConstantPool.h b/js/src/assembler/assembler/AssemblerBufferWithConstantPool.h
index 8b62c74477c9..0d87bbeb09e1 100644
--- a/js/src/assembler/assembler/AssemblerBufferWithConstantPool.h
+++ b/js/src/assembler/assembler/AssemblerBufferWithConstantPool.h
@@ -106,9 +106,7 @@ public:
         , m_numConsts(0)
         , m_maxDistance(maxPoolSize)
         , m_lastConstDelta(0)
-#ifdef DEBUG
-        , m_allowFlush(true)
-#endif
+        , m_flushCount(0)
     {
         m_pool = static_cast<uint32_t*>(malloc(maxPoolSize));
         m_mask = static_cast<char*>(malloc(maxPoolSize / sizeof(uint32_t)));
@@ -241,14 +239,10 @@ public:
         return m_numConsts;
     }
 
-#ifdef DEBUG
-    // Guard constant pool flushes to ensure that they don't occur during
-    // regions where offsets into the code have to be maintained (such as PICs).
-    void allowPoolFlush(bool allowFlush)
+    int flushCount()
     {
-        m_allowFlush = allowFlush;
+        return m_flushCount;
     }
-#endif
 
 private:
     void correctDeltas(int insnSize)
@@ -273,9 +267,9 @@ private:
     {
         js::JaegerSpew(js::JSpew_Insns, " -- FLUSHING CONSTANT POOL WITH %d CONSTANTS --\n",
                        m_numConsts);
-        ASSERT(m_allowFlush);
         if (m_numConsts == 0)
             return;
+        m_flushCount++;
         int alignPool = (AssemblerBuffer::size() + (useBarrier ? barrierSize : 0)) & (sizeof(uint64_t) - 1);
 
         if (alignPool)
@@ -339,10 +333,7 @@ private:
     int m_numConsts;
     int m_maxDistance;
     int m_lastConstDelta;
-
-#ifdef DEBUG
-    bool    m_allowFlush;
-#endif
+    int m_flushCount;
 };
 
 } // namespace JSC
diff --git a/js/src/assembler/assembler/MacroAssemblerARM.h b/js/src/assembler/assembler/MacroAssemblerARM.h
index 3626e5f40bde..2ab019c5da3b 100644
--- a/js/src/assembler/assembler/MacroAssemblerARM.h
+++ b/js/src/assembler/assembler/MacroAssemblerARM.h
@@ -1380,12 +1380,10 @@ public:
         m_assembler.forceFlushConstantPool();
     }
 
-#ifdef DEBUG
-    void allowPoolFlush(bool allowFlush)
+    int flushCount()
     {
-        m_assembler.allowPoolFlush(allowFlush);
+        return m_assembler.flushCount();
     }
-#endif
 
 protected:
     ARMAssembler::Condition ARMCondition(Condition cond)
diff --git a/js/src/methodjit/BaseCompiler.h b/js/src/methodjit/BaseCompiler.h
index 6de548a58582..31cbb2091d03 100644
--- a/js/src/methodjit/BaseCompiler.h
+++ b/js/src/methodjit/BaseCompiler.h
@@ -228,67 +228,43 @@ class AutoReserveICSpace {
     typedef Assembler::Label Label;
 
     Assembler           &masm;
-#ifdef DEBUG
-    Label               startLabel;
     bool                didCheck;
-#endif
+    bool                *overflowSpace;
+    int                 flushCount;
 
   public:
-    AutoReserveICSpace(Assembler &masm) : masm(masm) {
+    AutoReserveICSpace(Assembler &masm, bool *overflowSpace)
+        : masm(masm), didCheck(false), overflowSpace(overflowSpace)
+    {
         masm.ensureSpace(reservedSpace);
-#ifdef DEBUG
-        didCheck = false;
-
-        startLabel = masm.label();
-
-        /* Assert that the constant pool is not flushed until we reach a safe point. */
-        masm.allowPoolFlush(false);
-
-        JaegerSpew(JSpew_Insns, " -- BEGIN CONSTANT-POOL-FREE REGION -- \n");
-#endif
+        flushCount = masm.flushCount();
     }
 
     /* Allow manual IC space checks so that non-patchable code at the end of an IC section can be
      * free to use constant pools. */
     void check() {
-#ifdef DEBUG
         JS_ASSERT(!didCheck);
         didCheck = true;
 
-        Label endLabel = masm.label();
-        int spaceUsed = masm.differenceBetween(startLabel, endLabel);
-
-        /* Spew the space used, to help tuning of reservedSpace. */
-        JaegerSpew(JSpew_Insns,
-                   " -- END CONSTANT-POOL-FREE REGION: %u bytes used of %u reserved. -- \n",
-                   spaceUsed, reservedSpace);
-
-        /* Assert that we didn't emit more code than we protected. */
-        JS_ASSERT(spaceUsed >= 0);
-        JS_ASSERT(size_t(spaceUsed) <= reservedSpace);
-
-        /* Allow the pool to be flushed. */
-        masm.allowPoolFlush(true);
-#endif
+        if (masm.flushCount() != flushCount)
+            *overflowSpace = true;
     }
 
     ~AutoReserveICSpace() {
-#ifdef DEBUG
         /* Automatically check the IC space if we didn't already do it manually. */
         if (!didCheck) {
             check();
         }
-#endif
     }
 };
 
-# define RESERVE_IC_SPACE(__masm)       AutoReserveICSpace<256> arics(__masm)
+# define RESERVE_IC_SPACE(__masm)       AutoReserveICSpace<256> arics(__masm, &this->overflowICSpace)
 # define CHECK_IC_SPACE()               arics.check()
 
 /* The OOL path can need a lot of space because we save and restore a lot of registers. The actual
  * sequene varies. However, dumping the literal pool before an OOL block is probably a good idea
  * anyway, as we branch directly to the start of the block from the fast path. */
-# define RESERVE_OOL_SPACE(__masm)      AutoReserveICSpace<2048> arics_ool(__masm)
+# define RESERVE_OOL_SPACE(__masm)      AutoReserveICSpace<2048> arics_ool(__masm, &this->overflowICSpace)
 
 /* Allow the OOL patch to be checked before object destruction. Often, non-patchable epilogues or
  * rejoining sequences are emitted, and it isn't necessary to protect these from literal pools. */
diff --git a/js/src/methodjit/Compiler.cpp b/js/src/methodjit/Compiler.cpp
index 32cc33ecfff5..5810d0e2e4eb 100644
--- a/js/src/methodjit/Compiler.cpp
+++ b/js/src/methodjit/Compiler.cpp
@@ -133,6 +133,7 @@ mjit::Compiler::Compiler(JSContext *cx, JSScript *outerScript, bool isConstructi
     inlining_(false),
     hasGlobalReallocation(false),
     oomInVector(false),
+    overflowICSpace(false),
     gcNumber(cx->runtime->gcNumber),
     applyTricks(NoApplyTricks),
     pcLengths(NULL)
@@ -894,6 +895,11 @@ mjit::Compiler::finishThisUp(JITScript **jitp)
     if (cx->runtime->gcNumber != gcNumber)
         return Compile_Retry;
 
+    if (overflowICSpace) {
+        JaegerSpew(JSpew_Scripts, "dumped a constant pool while generating an IC\n");
+        return Compile_Abort;
+    }
+
     for (size_t i = 0; i < branchPatches.length(); i++) {
         Label label = labelOf(branchPatches[i].pc, branchPatches[i].inlineIndex);
         branchPatches[i].jump.linkTo(label, &masm);
diff --git a/js/src/methodjit/Compiler.h b/js/src/methodjit/Compiler.h
index 7a900d476de5..13c13c2513df 100644
--- a/js/src/methodjit/Compiler.h
+++ b/js/src/methodjit/Compiler.h
@@ -472,6 +472,7 @@ class Compiler : public BaseCompiler
     bool inlining_;
     bool hasGlobalReallocation;
     bool oomInVector;       // True if we have OOM'd appending to a vector. 
+    bool overflowICSpace;   // True if we added a constant pool in a reserved space.
     uint32 gcNumber;
     enum { NoApplyTricks, LazyArgsObj } applyTricks;
     PCLengthEntry *pcLengths;

From 7baa7c76cefff45a204157c944901109360417d4 Mon Sep 17 00:00:00 2001
From: Brian Hackett <bhackett1024@gmail.com>
Date: Thu, 15 Sep 2011 12:50:19 -0700
Subject: [PATCH 159/209] [INFER] Decouple constraints generating callee types
 and 'this' types of those callees for CALLELEM, bug 686396.

---
 js/src/jit-test/tests/basic/bug686396.js | 16 +++++++++++
 js/src/jsinfer.cpp                       | 36 ++++++++++++++----------
 js/src/jsinfer.h                         |  3 +-
 3 files changed, 39 insertions(+), 16 deletions(-)
 create mode 100644 js/src/jit-test/tests/basic/bug686396.js

diff --git a/js/src/jit-test/tests/basic/bug686396.js b/js/src/jit-test/tests/basic/bug686396.js
new file mode 100644
index 000000000000..8123fc99c3e7
--- /dev/null
+++ b/js/src/jit-test/tests/basic/bug686396.js
@@ -0,0 +1,16 @@
+
+(function () { 
+  assertEquals = function assertEquals(expected, found, name_opt) {  };
+})();
+function testOne(receiver, key, result) {
+  for(var i = 0; i != 10; i++ ) {
+    assertEquals(result, receiver[key]());
+  }
+}
+function TypeOfThis() { return typeof this; }
+Number.prototype.type = TypeOfThis;
+String.prototype.type = TypeOfThis;
+Boolean.prototype.type = TypeOfThis;
+testOne(2.3, 'type', 'object');
+testOne('x', 'type', 'object');
+testOne(true, 'type', 'object');
diff --git a/js/src/jsinfer.cpp b/js/src/jsinfer.cpp
index 857a313a20dc..1ab4dc37aab2 100644
--- a/js/src/jsinfer.cpp
+++ b/js/src/jsinfer.cpp
@@ -691,16 +691,17 @@ public:
     JSScript *script;
     jsbytecode *callpc;
     Type type;
+    TypeSet *types;
 
-    TypeConstraintPropagateThis(JSScript *script, jsbytecode *callpc, Type type)
-        : TypeConstraint("propagatethis"), script(script), callpc(callpc), type(type)
+    TypeConstraintPropagateThis(JSScript *script, jsbytecode *callpc, Type type, TypeSet *types)
+        : TypeConstraint("propagatethis"), script(script), callpc(callpc), type(type), types(types)
     {}
 
     void newType(JSContext *cx, TypeSet *source, Type type);
 };
 
 void
-TypeSet::addPropagateThis(JSContext *cx, JSScript *script, jsbytecode *pc, Type type)
+TypeSet::addPropagateThis(JSContext *cx, JSScript *script, jsbytecode *pc, Type type, TypeSet *types)
 {
     /* Don't add constraints when the call will be 'new' (see addCallProperty). */
     jsbytecode *callpc = script->analysis()->getCallPC(pc);
@@ -708,7 +709,7 @@ TypeSet::addPropagateThis(JSContext *cx, JSScript *script, jsbytecode *pc, Type
     if (JSOp(*callpc) == JSOP_NEW)
         return;
 
-    add(cx, ArenaNew<TypeConstraintPropagateThis>(cx->compartment->pool, script, callpc, type));
+    add(cx, ArenaNew<TypeConstraintPropagateThis>(cx->compartment->pool, script, callpc, type, types));
 }
 
 /* Subset constraint which filters out primitive types. */
@@ -1063,10 +1064,10 @@ TypeConstraintCallProp::newType(JSContext *cx, TypeSet *source, Type type)
     UntrapOpcode untrap(cx, script, callpc);
 
     /*
-     * For CALLPROP and CALLELEM, we need to update not just the pushed types
-     * but also the 'this' types of possible callees. If we can't figure out
-     * that set of callees, monitor the call to make sure discovered callees
-     * get their 'this' types updated.
+     * For CALLPROP, we need to update not just the pushed types but also the
+     * 'this' types of possible callees. If we can't figure out that set of
+     * callees, monitor the call to make sure discovered callees get their
+     * 'this' types updated.
      */
 
     if (UnknownPropertyAccess(script, type)) {
@@ -1086,7 +1087,8 @@ TypeConstraintCallProp::newType(JSContext *cx, TypeSet *source, Type type)
                 object->getFromPrototypes(cx, id, types);
             /* Bypass addPropagateThis, we already have the callpc. */
             types->add(cx, ArenaNew<TypeConstraintPropagateThis>(cx->compartment->pool,
-                                                                 script, callpc, type));
+                                                                 script, callpc, type,
+                                                                 (TypeSet *) NULL));
         }
     }
 }
@@ -1230,8 +1232,8 @@ TypeConstraintPropagateThis::newType(JSContext *cx, TypeSet *source, Type type)
         /*
          * The callee is unknown, make sure the call is monitored so we pick up
          * possible this/callee correlations. This only comes into play for
-         * CALLPROP and CALLELEM, for other calls we are past the type barrier
-         * already and a TypeConstraintCall will also monitor the call.
+         * CALLPROP, for other calls we are past the type barrier and a
+         * TypeConstraintCall will also monitor the call.
          */
         cx->compartment->types.monitorBytecode(cx, script, callpc - script->code);
         return;
@@ -1258,7 +1260,11 @@ TypeConstraintPropagateThis::newType(JSContext *cx, TypeSet *source, Type type)
     if (!callee->script()->ensureHasTypes(cx, callee))
         return;
 
-    TypeScript::ThisTypes(callee->script())->addType(cx, this->type);
+    TypeSet *thisTypes = TypeScript::ThisTypes(callee->script());
+    if (this->types)
+        this->types->addSubset(cx, thisTypes);
+    else
+        thisTypes->addType(cx, this->type);
 }
 
 void
@@ -3682,12 +3688,12 @@ ScriptAnalysis::analyzeTypesBytecode(JSContext *cx, unsigned offset,
         TypeSet *seen = script->analysis()->bytecodeTypes(pc);
 
         poppedTypes(pc, 1)->addGetProperty(cx, script, pc, seen, JSID_VOID);
-        if (op == JSOP_CALLELEM)
-            poppedTypes(pc, 1)->addCallProperty(cx, script, pc, JSID_VOID);
 
         seen->addSubset(cx, &pushed[0]);
-        if (op == JSOP_CALLELEM)
+        if (op == JSOP_CALLELEM) {
             poppedTypes(pc, 1)->addFilterPrimitives(cx, &pushed[1], TypeSet::FILTER_NULL_VOID);
+            pushed[0].addPropagateThis(cx, script, pc, Type::UndefinedType(), &pushed[1]);
+        }
         if (CheckNextTest(pc))
             pushed[0].addType(cx, Type::UndefinedType());
         break;
diff --git a/js/src/jsinfer.h b/js/src/jsinfer.h
index 81d95ca028b7..86f4795e3d23 100644
--- a/js/src/jsinfer.h
+++ b/js/src/jsinfer.h
@@ -452,7 +452,8 @@ class TypeSet
     void addCall(JSContext *cx, TypeCallsite *site);
     void addArith(JSContext *cx, TypeSet *target, TypeSet *other = NULL);
     void addTransformThis(JSContext *cx, JSScript *script, TypeSet *target);
-    void addPropagateThis(JSContext *cx, JSScript *script, jsbytecode *pc, Type type);
+    void addPropagateThis(JSContext *cx, JSScript *script, jsbytecode *pc,
+                          Type type, TypeSet *types = NULL);
     void addFilterPrimitives(JSContext *cx, TypeSet *target, FilterKind filter);
     void addSubsetBarrier(JSContext *cx, JSScript *script, jsbytecode *pc, TypeSet *target);
     void addLazyArguments(JSContext *cx, TypeSet *target);

From 5798d2c76d93609f166cdc02e9aa4877f243ee1b Mon Sep 17 00:00:00 2001
From: Brian Hackett <bhackett1024@gmail.com>
Date: Thu, 15 Sep 2011 16:19:38 -0700
Subject: [PATCH 160/209] [INFER] Add jitcode assertions for type correctness
 around property accesses, bug 685186.

---
 js/src/methodjit/BaseAssembler.h |  5 +--
 js/src/methodjit/Compiler.cpp    | 55 ++++++++++++++++++++-----
 js/src/methodjit/Compiler.h      |  3 ++
 js/src/methodjit/FrameState.cpp  | 71 ++++++++++++++++++++++++++++++++
 js/src/methodjit/FrameState.h    | 10 +++++
 js/src/methodjit/MonoIC.cpp      |  9 ++--
 js/src/methodjit/StubCalls.cpp   | 28 +++++++++++++
 js/src/methodjit/StubCalls.h     |  2 +
 8 files changed, 166 insertions(+), 17 deletions(-)

diff --git a/js/src/methodjit/BaseAssembler.h b/js/src/methodjit/BaseAssembler.h
index 9f05039203e2..fd24e44c00c6 100644
--- a/js/src/methodjit/BaseAssembler.h
+++ b/js/src/methodjit/BaseAssembler.h
@@ -1152,7 +1152,7 @@ static const JSC::MacroAssembler::RegisterID JSParamReg_Argc  = JSC::SparcRegist
      * in the specified set. Updates mismatches with any failure jumps. Assumes
      * no data registers are live.
      */
-    bool generateTypeCheck(JSContext *cx, Address address,
+    bool generateTypeCheck(JSContext *cx, Address address, RegisterID reg,
                            types::TypeSet *types, Vector<Jump> *mismatches)
     {
         if (types->unknown())
@@ -1200,9 +1200,6 @@ static const JSC::MacroAssembler::RegisterID JSParamReg_Argc  = JSC::SparcRegist
         if (count != 0) {
             if (!mismatches->append(testObject(Assembler::NotEqual, address)))
                 return false;
-            Registers tempRegs(Registers::AvailRegs);
-            RegisterID reg = tempRegs.takeAnyReg().reg();
-
             loadPayload(address, reg);
 
             Jump notSingleton = branchTest32(Assembler::Zero,
diff --git a/js/src/methodjit/Compiler.cpp b/js/src/methodjit/Compiler.cpp
index 5810d0e2e4eb..013d8165cd86 100644
--- a/js/src/methodjit/Compiler.cpp
+++ b/js/src/methodjit/Compiler.cpp
@@ -2034,6 +2034,9 @@ mjit::Compiler::generateMethod()
 
           BEGIN_CASE(JSOP_SETELEM)
           {
+            typeCheckPopped(0);
+            typeCheckPopped(1);
+            typeCheckPopped(2);
             jsbytecode *next = &PC[JSOP_SETELEM_LENGTH];
             bool pop = (JSOp(*next) == JSOP_POP && !analysis->jumpTarget(next));
             if (!jsop_setelem(pop))
@@ -2384,18 +2387,13 @@ mjit::Compiler::generateMethod()
           END_CASE(JSOP_BINDNAME)
 
           BEGIN_CASE(JSOP_SETPROP)
-          {
-            jsbytecode *next = &PC[JSOP_SETPROP_LENGTH];
-            bool pop = JSOp(*next) == JSOP_POP && !analysis->jumpTarget(next);
-            if (!jsop_setprop(script->getAtom(fullAtomIndex(PC)), true, pop))
-                return Compile_Error;
-          }
-          END_CASE(JSOP_SETPROP)
-
           BEGIN_CASE(JSOP_SETNAME)
           BEGIN_CASE(JSOP_SETMETHOD)
           {
-            jsbytecode *next = &PC[JSOP_SETNAME_LENGTH];
+            typeCheckPopped(0);
+            if (op != JSOP_SETNAME)
+                typeCheckPopped(1);
+            jsbytecode *next = &PC[JSOP_SETPROP_LENGTH];
             bool pop = JSOp(*next) == JSOP_POP && !analysis->jumpTarget(next);
             if (!jsop_setprop(script->getAtom(fullAtomIndex(PC)), true, pop))
                 return Compile_Error;
@@ -2793,6 +2791,22 @@ mjit::Compiler::generateMethod()
                     frame.extra(fe).types = analysis->pushedTypes(lastPC - script->code, i);
                 }
             }
+
+#ifdef DEBUG
+            if ((js_CodeSpec[op].format & JOF_TYPESET) &&
+                js_GetOpcode(cx, script, PC) != JSOP_POP) {
+                FrameEntry *fe = frame.getStack(opinfo->stackDepth - nuses);
+                Jump j = frame.typeCheckEntry(fe, frame.extra(fe).types);
+                stubcc.linkExit(j, Uses(0));
+                stubcc.leave();
+
+                jsbytecode *oldPC = PC;
+                PC = lastPC;
+                OOL_STUBCALL(stubs::TypeCheckPushed, REJOIN_FALLTHROUGH);
+                PC = oldPC;
+                stubcc.rejoin(Changes(0));
+            }
+#endif
         }
 
         if (script->pcCounters) {
@@ -7602,8 +7616,11 @@ mjit::Compiler::testPushedType(RejoinState rejoin, int which, bool ool)
     JS_ASSERT(which <= 0);
     Address address = (which == 0) ? frame.addressOfTop() : frame.addressOf(frame.peek(which));
 
+    Registers tempRegs(Registers::AvailRegs);
+    RegisterID scratch = tempRegs.takeAnyReg().reg();
+
     Vector<Jump> mismatches(cx);
-    if (!masm.generateTypeCheck(cx, address, types, &mismatches)) {
+    if (!masm.generateTypeCheck(cx, address, scratch, types, &mismatches)) {
         oomInVector = true;
         return;
     }
@@ -7621,3 +7638,21 @@ mjit::Compiler::testPushedType(RejoinState rejoin, int which, bool ool)
 
     j.linkTo(masm.label(), &masm);
 }
+
+#ifdef DEBUG
+void
+mjit::Compiler::typeCheckPopped(int which)
+{
+    if (!cx->typeInferenceEnabled())
+        return;
+
+    FrameEntry *fe = frame.peek(-1 - which);
+    Jump j = frame.typeCheckEntry(fe, analysis->poppedTypes(PC, which));
+    stubcc.linkExit(j, Uses(0));
+    stubcc.leave();
+
+    stubcc.masm.move(Imm32(which), Registers::ArgReg1);
+    OOL_STUBCALL(stubs::TypeCheckPopped, REJOIN_RESUME);
+    stubcc.rejoin(Changes(0));
+}
+#endif /* DEBUG */
diff --git a/js/src/methodjit/Compiler.h b/js/src/methodjit/Compiler.h
index 13c13c2513df..65cb8cb7e8c7 100644
--- a/js/src/methodjit/Compiler.h
+++ b/js/src/methodjit/Compiler.h
@@ -558,6 +558,9 @@ class Compiler : public BaseCompiler
     CompileStatus addInlineFrame(JSScript *script, uint32 depth, uint32 parent, jsbytecode *parentpc);
     CompileStatus scanInlineCalls(uint32 index, uint32 depth);
     CompileStatus checkAnalysis(JSScript *script);
+#ifdef DEBUG
+    void typeCheckPopped(int which);
+#endif
 
     struct BarrierState {
         MaybeJump jump;
diff --git a/js/src/methodjit/FrameState.cpp b/js/src/methodjit/FrameState.cpp
index 1a83e3f8b53b..6b65f4646cda 100644
--- a/js/src/methodjit/FrameState.cpp
+++ b/js/src/methodjit/FrameState.cpp
@@ -1107,6 +1107,77 @@ FrameState::storeTo(FrameEntry *fe, Address address, bool popped)
         unpinReg(address.base);
 }
 
+#ifdef DEBUG
+JSC::MacroAssembler::Jump
+FrameState::typeCheckEntry(const FrameEntry *fe, types::TypeSet *types) const
+{
+    if (fe->isCopy())
+        fe = fe->copyOf();
+
+    Address addr1 = addressOfTop();
+    Address addr2 = Address(JSFrameReg, addr1.offset + sizeof(Value));
+
+    Registers tempRegs(Registers::AvailRegs);
+    RegisterID scratch = tempRegs.takeAnyReg().reg();
+    masm.storePtr(scratch, addr1);
+
+    do {
+        if (fe->isConstant()) {
+            masm.storeValue(fe->getValue(), addr2);
+            break;
+        }
+
+        if (fe->data.inFPRegister()) {
+            masm.storeDouble(fe->data.fpreg(), addr2);
+            break;
+        }
+
+        if (fe->isType(JSVAL_TYPE_DOUBLE)) {
+            JS_ASSERT(fe->data.inMemory());
+            masm.loadDouble(addressOf(fe), Registers::FPConversionTemp);
+            masm.storeDouble(Registers::FPConversionTemp, addr2);
+            break;
+        }
+
+        if (fe->data.inRegister())
+            masm.storePayload(fe->data.reg(), addr2);
+        else
+            JS_ASSERT(fe->data.inMemory());
+
+        if (fe->isTypeKnown())
+            masm.storeTypeTag(ImmType(fe->getKnownType()), addr2);
+        else if (fe->type.inRegister())
+            masm.storeTypeTag(fe->type.reg(), addr2);
+        else
+            JS_ASSERT(fe->type.inMemory());
+
+        if (fe->data.inMemory()) {
+            masm.loadPayload(addressOf(fe), scratch);
+            masm.storePayload(scratch, addr2);
+        }
+        if (fe->type.inMemory()) {
+            masm.loadTypeTag(addressOf(fe), scratch);
+            masm.storeTypeTag(scratch, addr2);
+        }
+    } while (false);
+
+    Vector<Jump> mismatches(cx);
+    masm.generateTypeCheck(cx, addr2, scratch, types, &mismatches);
+
+    masm.loadPtr(addr1, scratch);
+    Jump j = masm.jump();
+
+    for (unsigned i = 0; i < mismatches.length(); i++)
+        mismatches[i].linkTo(masm.label(), &masm);
+    masm.loadPtr(addr1, scratch);
+    Jump mismatch = masm.jump();
+
+    j.linkTo(masm.label(), &masm);
+
+    return mismatch;
+}
+#endif /* DEBUG */
+
 void
 FrameState::loadThisForReturn(RegisterID typeReg, RegisterID dataReg, RegisterID tempReg)
 {
diff --git a/js/src/methodjit/FrameState.h b/js/src/methodjit/FrameState.h
index 10c97ae52272..4e4d8fd62a77 100644
--- a/js/src/methodjit/FrameState.h
+++ b/js/src/methodjit/FrameState.h
@@ -618,9 +618,19 @@ class FrameState
      */
     inline FrameEntry *peek(int32 depth);
 
+#ifdef DEBUG
+    /*
+     * Check that a frame entry matches a type, returning a jump taken on
+     * mismatch. Does not affect register state or sync state of any entries.
+     */
+    Jump typeCheckEntry(const FrameEntry *fe, types::TypeSet *types) const;
+#endif
+
     /*
      * Fully stores a FrameEntry at an arbitrary address. popHint specifies
      * how hard the register allocator should try to keep the FE in registers.
+     * If scratchData and scratchType are specified, the frame entry and
+     * register state will not be modified.
      */
     void storeTo(FrameEntry *fe, Address address, bool popHint = false);
 
diff --git a/js/src/methodjit/MonoIC.cpp b/js/src/methodjit/MonoIC.cpp
index 175652efed28..faffd001ccbf 100644
--- a/js/src/methodjit/MonoIC.cpp
+++ b/js/src/methodjit/MonoIC.cpp
@@ -623,7 +623,7 @@ mjit::NativeStubEpilogue(VMFrame &f, Assembler &masm, NativeStubLinker::FinalJum
              * FastBuiltins.
              */
             types::TypeSet *types = f.script()->analysis()->bytecodeTypes(f.pc());
-            if (!masm.generateTypeCheck(f.cx, resultAddress, types, &mismatches))
+            if (!masm.generateTypeCheck(f.cx, resultAddress, Registers::ReturnReg, types, &mismatches))
                 THROWV(false);
         }
     }
@@ -1339,17 +1339,20 @@ ic::GenerateArgumentCheckStub(VMFrame &f)
     Assembler masm;
     Vector<Jump> mismatches(f.cx);
 
+    Registers tempRegs(Registers::AvailRegs);
+    RegisterID scratch = tempRegs.takeAnyReg().reg();
+
     if (!f.fp()->isConstructing()) {
         types::TypeSet *types = types::TypeScript::ThisTypes(script);
         Address address(JSFrameReg, StackFrame::offsetOfThis(fun));
-        if (!masm.generateTypeCheck(f.cx, address, types, &mismatches))
+        if (!masm.generateTypeCheck(f.cx, address, scratch, types, &mismatches))
             return;
     }
 
     for (unsigned i = 0; i < fun->nargs; i++) {
         types::TypeSet *types = types::TypeScript::ArgTypes(script, i);
         Address address(JSFrameReg, StackFrame::offsetOfFormalArg(fun, i));
-        if (!masm.generateTypeCheck(f.cx, address, types, &mismatches))
+        if (!masm.generateTypeCheck(f.cx, address, scratch, types, &mismatches))
             return;
     }
 
diff --git a/js/src/methodjit/StubCalls.cpp b/js/src/methodjit/StubCalls.cpp
index 23b43218e603..6a30c9a2c535 100644
--- a/js/src/methodjit/StubCalls.cpp
+++ b/js/src/methodjit/StubCalls.cpp
@@ -2458,6 +2458,34 @@ stubs::AssertArgumentTypes(VMFrame &f)
             TypeFailure(f.cx, "Missing type for arg %d: %s", i, TypeString(type));
     }
 }
+
+void JS_FASTCALL
+stubs::TypeCheckPushed(VMFrame &f)
+{
+    TypeScript::CheckBytecode(f.cx, f.script(), f.pc(), f.regs.sp);
+}
+
+void JS_FASTCALL
+stubs::TypeCheckPopped(VMFrame &f, int32 which)
+{
+    JSScript *script = f.script();
+    jsbytecode *pc = f.pc();
+    if (!script->hasAnalysis() || !script->analysis()->ranInference())
+        return;
+
+    AutoEnterTypeInference enter(f.cx);
+
+    const js::Value &val = f.regs.sp[-1 - which];
+    TypeSet *types = script->analysis()->poppedTypes(pc, which);
+    Type type = GetValueType(f.cx, val);
+
+    if (!types->hasType(type)) {
+        /* Display fine-grained debug information first */
+        fprintf(stderr, "Missing type at #%u:%05u popped %u: %s\n", 
+                script->id(), unsigned(pc - script->code), which, TypeString(type));
+        TypeFailure(f.cx, "Missing type popped %u", which);
+    }
+}
 #endif
 
 /*
diff --git a/js/src/methodjit/StubCalls.h b/js/src/methodjit/StubCalls.h
index 41c712a24b7e..a3b82519060e 100644
--- a/js/src/methodjit/StubCalls.h
+++ b/js/src/methodjit/StubCalls.h
@@ -216,6 +216,8 @@ void JS_FASTCALL CheckArgumentTypes(VMFrame &f);
 
 #ifdef DEBUG
 void JS_FASTCALL AssertArgumentTypes(VMFrame &f);
+void JS_FASTCALL TypeCheckPushed(VMFrame &f);
+void JS_FASTCALL TypeCheckPopped(VMFrame &f, int32 which);
 #endif
 
 void JS_FASTCALL MissedBoundsCheckEntry(VMFrame &f);

From 2f25c40d87d0ae10e94cd0662b0746a5cfc1a307 Mon Sep 17 00:00:00 2001
From: Kyle Huey <khuey@kylehuey.com>
Date: Thu, 15 Sep 2011 16:47:29 -0700
Subject: [PATCH 161/209] Remove some silly LOCAL_INCLUDES from
 content/base/src. r=me

---
 content/base/src/Makefile.in     | 1 -
 content/base/src/nsDocument.h    | 2 +-
 dom/base/nsDOMNavigationTiming.h | 2 +-
 3 files changed, 2 insertions(+), 3 deletions(-)

diff --git a/content/base/src/Makefile.in b/content/base/src/Makefile.in
index 0d85cb8b28fd..127b2ae70bbd 100644
--- a/content/base/src/Makefile.in
+++ b/content/base/src/Makefile.in
@@ -205,7 +205,6 @@ INCLUDES	+= \
 		-I$(topsrcdir)/js/src/xpconnect/src \
 		-I$(topsrcdir)/caps/include \
 		-I$(topsrcdir)/netwerk/base/src \
-		-I$(topsrcdir)/xpcom/ds \
 		$(NULL)
 
 DEFINES += -D_IMPL_NS_LAYOUT
diff --git a/content/base/src/nsDocument.h b/content/base/src/nsDocument.h
index 8f5d0d83e423..6edac34d6e5a 100644
--- a/content/base/src/nsDocument.h
+++ b/content/base/src/nsDocument.h
@@ -100,7 +100,7 @@
 #include "nsIDOMTouchEvent.h"
 #include "nsIInlineEventHandlers.h"
 #include "nsDataHashtable.h"
-#include "TimeStamp.h"
+#include "mozilla/TimeStamp.h"
 
 #define XML_DECLARATION_BITS_DECLARATION_EXISTS   (1 << 0)
 #define XML_DECLARATION_BITS_ENCODING_EXISTS      (1 << 1)
diff --git a/dom/base/nsDOMNavigationTiming.h b/dom/base/nsDOMNavigationTiming.h
index 4effb3648220..7e9ca243f16b 100644
--- a/dom/base/nsDOMNavigationTiming.h
+++ b/dom/base/nsDOMNavigationTiming.h
@@ -45,7 +45,7 @@
 #include "nscore.h"
 #include "nsCOMPtr.h"
 #include "nsCOMArray.h"
-#include "TimeStamp.h"
+#include "mozilla/TimeStamp.h"
 #include "nsIURI.h"
 
 class nsDOMNavigationTimingClock;

From b29901f2bf4775379f4f518d9a23274fd53c1831 Mon Sep 17 00:00:00 2001
From: Brian Hackett <bhackett1024@gmail.com>
Date: Thu, 15 Sep 2011 17:16:57 -0700
Subject: [PATCH 162/209] [INFER] Don't change prototype of new objects when
 reusing type in Array.{slice,splice,concat}. bug 683140.

---
 js/src/jit-test/tests/basic/bug683140.js | 13 +++++++
 js/src/jsarray.cpp                       | 47 ++++++++++--------------
 2 files changed, 32 insertions(+), 28 deletions(-)
 create mode 100644 js/src/jit-test/tests/basic/bug683140.js

diff --git a/js/src/jit-test/tests/basic/bug683140.js b/js/src/jit-test/tests/basic/bug683140.js
new file mode 100644
index 000000000000..4920ea5359e6
--- /dev/null
+++ b/js/src/jit-test/tests/basic/bug683140.js
@@ -0,0 +1,13 @@
+
+var g = newGlobal("same-compartment");
+g.eval("this.f = function(a) {" +
+       "assertEq(a instanceof Array, false);" +
+       "a = Array.prototype.slice.call(a);" +
+       "assertEq(a instanceof Array, true); }");
+g.f([1, 2, 3]);
+
+var g2 = newGlobal("new-compartment");
+g2.a = g2.Array(10);
+assertEq(g2.a instanceof Array, false);
+g2.a = Array.prototype.slice(g2.a);
+assertEq(g2.a instanceof Array, true);
diff --git a/js/src/jsarray.cpp b/js/src/jsarray.cpp
index 75c2239fd586..f195917b27af 100644
--- a/js/src/jsarray.cpp
+++ b/js/src/jsarray.cpp
@@ -2511,6 +2511,21 @@ array_unshift(JSContext *cx, uintN argc, Value *vp)
     return JS_TRUE;
 }
 
+static inline void
+TryReuseArrayType(JSObject *obj, JSObject *nobj)
+{
+    /*
+     * Try to change the type of a newly created array nobj to the same type
+     * as obj. This can only be performed if the original object is an array
+     * and has the same prototype.
+     */
+    JS_ASSERT(nobj->isDenseArray());
+    JS_ASSERT(nobj->type() == nobj->getProto()->newType);
+
+    if (obj->isArray() && !obj->hasSingletonType() && obj->getProto() == nobj->getProto())
+        nobj->setType(obj->type());
+}
+
 static JSBool
 array_splice(JSContext *cx, uintN argc, Value *vp)
 {
@@ -2521,24 +2536,11 @@ array_splice(JSContext *cx, uintN argc, Value *vp)
     jsuint length, begin, end, count, delta, last;
     JSBool hole;
 
-    /*
-     * Get the type of the result object: the original type when splicing an
-     * array, a generic array type otherwise.
-     */
-    TypeObject *type;
-    if (obj->isArray() && !obj->hasSingletonType()) {
-        type = obj->type();
-    } else {
-        type = GetTypeNewObject(cx, JSProto_Array);
-        if (!type)
-            return false;
-    }
-
     /* Create a new array value to return. */
     JSObject *obj2 = NewDenseEmptyArray(cx);
     if (!obj2)
         return JS_FALSE;
-    obj2->setType(type);
+    TryReuseArrayType(obj, obj2);
     vp->setObject(*obj2);
 
     /* Nothing to do if no args.  Otherwise get length. */
@@ -2697,8 +2699,7 @@ array_concat(JSContext *cx, uintN argc, Value *vp)
         nobj = NewDenseCopiedArray(cx, initlen, vector);
         if (!nobj)
             return JS_FALSE;
-        if (nobj->getProto() == aobj->getProto() && !aobj->hasSingletonType())
-            nobj->setType(aobj->type());
+        TryReuseArrayType(aobj, nobj);
         nobj->setArrayLength(cx, length);
         if (!aobj->isPackedDenseArray())
             nobj->markDenseArrayNotPacked(cx);
@@ -2801,22 +2802,12 @@ array_slice(JSContext *cx, uintN argc, Value *vp)
     if (begin > end)
         begin = end;
 
-    /* Get the type object for the returned array, as for array_splice. */
-    TypeObject *type;
-    if (obj->isArray() && !obj->hasSingletonType()) {
-        type = obj->type();
-    } else {
-        type = GetTypeNewObject(cx, JSProto_Array);
-        if (!type)
-            return false;
-    }
-
     if (obj->isDenseArray() && end <= obj->getDenseArrayInitializedLength() &&
         !js_PrototypeHasIndexedProperties(cx, obj)) {
         nobj = NewDenseCopiedArray(cx, end - begin, obj->getDenseArrayElements() + begin);
         if (!nobj)
             return JS_FALSE;
-        nobj->setType(type);
+        TryReuseArrayType(obj, nobj);
         if (!obj->isPackedDenseArray())
             nobj->markDenseArrayNotPacked(cx);
         vp->setObject(*nobj);
@@ -2827,7 +2818,7 @@ array_slice(JSContext *cx, uintN argc, Value *vp)
     nobj = NewDenseAllocatedArray(cx, end - begin);
     if (!nobj)
         return JS_FALSE;
-    nobj->setType(type);
+    TryReuseArrayType(obj, nobj);
     vp->setObject(*nobj);
 
     AutoValueRooter tvr(cx);

From cbf706e058128b41cee3652a6a29714ef5035ffa Mon Sep 17 00:00:00 2001
From: Brian Hackett <bhackett1024@gmail.com>
Date: Thu, 15 Sep 2011 17:19:57 -0700
Subject: [PATCH 163/209] [INFER] Fix red.

---
 js/src/methodjit/Compiler.h | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/js/src/methodjit/Compiler.h b/js/src/methodjit/Compiler.h
index 65cb8cb7e8c7..6a3872ac54dc 100644
--- a/js/src/methodjit/Compiler.h
+++ b/js/src/methodjit/Compiler.h
@@ -560,6 +560,8 @@ class Compiler : public BaseCompiler
     CompileStatus checkAnalysis(JSScript *script);
 #ifdef DEBUG
     void typeCheckPopped(int which);
+#else
+    void typeCheckPopped(int which) {}
 #endif
 
     struct BarrierState {

From 44d907488969e25ccd349483e35809f2e478d086 Mon Sep 17 00:00:00 2001
From: Mike Hommey <mh+mozilla@glandium.org>
Date: Fri, 16 Sep 2011 10:00:42 +0200
Subject: [PATCH 164/209] Bug 686694 - Don't extract libraries on Android
 unless we're starting with the DEBUG intent. r=dougt

---
 embedding/android/GeckoAppShell.java | 9 ++++-----
 1 file changed, 4 insertions(+), 5 deletions(-)

diff --git a/embedding/android/GeckoAppShell.java b/embedding/android/GeckoAppShell.java
index 6cf86e196e0a..e0957678c427 100644
--- a/embedding/android/GeckoAppShell.java
+++ b/embedding/android/GeckoAppShell.java
@@ -93,8 +93,6 @@ public class GeckoAppShell
     static private final int NOTIFY_IME_CANCELCOMPOSITION = 2;
     static private final int NOTIFY_IME_FOCUSCHANGE = 3;
 
-    static public final long kFreeSpaceThreshold = 157286400L; // 150MB
-    static private final long kLibFreeSpaceBuffer = 20971520L; // 29MB
     static private File sCacheFile = null;
     static private int sFreeSpace = -1;
 
@@ -355,8 +353,9 @@ public class GeckoAppShell
 
         putLocaleEnv();
 
-        if (freeSpace + kLibFreeSpaceBuffer < kFreeSpaceThreshold) {
-            // remove any previously extracted libs since we're apparently low
+        boolean extractLibs = GeckoApp.ACTION_DEBUG.equals(i.getAction());
+        if (!extractLibs) {
+            // remove any previously extracted libs
             File[] files = cacheFile.listFiles();
             if (files != null) {
                 Iterator cacheFiles = Arrays.asList(files).iterator();
@@ -367,7 +366,7 @@ public class GeckoAppShell
                 }
             }
         }
-        loadLibs(apkName, freeSpace > kFreeSpaceThreshold);
+        loadLibs(apkName, extractLibs);
     }
 
     private static void putLocaleEnv() {

From 836ea8092754308963c6636ad3cf7d2b1ec2b2db Mon Sep 17 00:00:00 2001
From: Mike Hommey <mh+mozilla@glandium.org>
Date: Fri, 16 Sep 2011 10:01:03 +0200
Subject: [PATCH 165/209] Bug 685130 - Build libffi with the same flags as the
 rest. r=ted

---
 js/src/configure.in | 4 ----
 1 file changed, 4 deletions(-)

diff --git a/js/src/configure.in b/js/src/configure.in
index f0a1cbc99d75..c3765e7ee700 100644
--- a/js/src/configure.in
+++ b/js/src/configure.in
@@ -5450,10 +5450,6 @@ if test "$JS_HAS_CTYPES" -a -z "$MOZ_NATIVE_FFI"; then
   if test "$CROSS_COMPILE"; then
     case "$target" in
     *-android*|*-linuxandroid*)
-      CFLAGS="$ANDROID_CFLAGS"
-      CPPFLAGS="$ANDROID_CPPFLAGS"
-      LDFLAGS="$ANDROID_LDFLAGS"
-
       export AS CC CXX CPP LD AR RANLIB STRIP CPPFLAGS CFLAGS LDFLAGS
 
       ac_configure_args="$ac_configure_args --build=$build --host=$target HOST_CC=\"$HOST_CC\""

From c8451bd14f90cae6b5a098e40369fcc063e78371 Mon Sep 17 00:00:00 2001
From: Mike Hommey <mh+mozilla@glandium.org>
Date: Fri, 16 Sep 2011 11:15:43 +0200
Subject: [PATCH 166/209] Bug 686694 - Remove library extraction splash screen.
 r=mfinkle

---
 embedding/android/GeckoApp.java               | 25 ++-----------------
 .../android/locales/en-US/android_strings.dtd |  1 -
 embedding/android/strings.xml.in              |  1 -
 3 files changed, 2 insertions(+), 25 deletions(-)

diff --git a/embedding/android/GeckoApp.java b/embedding/android/GeckoApp.java
index 560e00e0d1b5..dddceaf4ceeb 100644
--- a/embedding/android/GeckoApp.java
+++ b/embedding/android/GeckoApp.java
@@ -266,29 +266,8 @@ abstract public class GeckoApp
 
 
             }});
-        File cacheFile = GeckoAppShell.getCacheDir();
-        File libxulFile = new File(cacheFile, "libxul.so");
-
-        if (GeckoAppShell.getFreeSpace() > GeckoAppShell.kFreeSpaceThreshold &&
-            (!libxulFile.exists() ||
-             new File(getApplication().getPackageResourcePath()).lastModified()
-             >= libxulFile.lastModified())) {
-            surfaceView.mSplashStatusMsg =
-                getResources().getString(R.string.splash_screen_installing_libs);
-            File[] libs = cacheFile.listFiles(new FilenameFilter() {
-                public boolean accept(File dir, String name) {
-                    return name.endsWith(".so");
-                }
-            });
-            if (libs != null) {
-                for (int i = 0; i < libs.length; i++) {
-                    libs[i].delete();
-                }
-            }
-        } else {
-            surfaceView.mSplashStatusMsg =
-                getResources().getString(R.string.splash_screen_loading);
-        }
+        surfaceView.mSplashStatusMsg =
+            getResources().getString(R.string.splash_screen_loading);
         mLibLoadThread.start();
     }
 
diff --git a/embedding/android/locales/en-US/android_strings.dtd b/embedding/android/locales/en-US/android_strings.dtd
index 2fbc9b4fd9ba..19e20d9d450e 100644
--- a/embedding/android/locales/en-US/android_strings.dtd
+++ b/embedding/android/locales/en-US/android_strings.dtd
@@ -1,6 +1,5 @@
 
 <!ENTITY  splash_screen_loading "Loading">
-<!ENTITY  splash_screen_installing_libs "Installing libraries\u2026">
 <!ENTITY  splash_firstrun "Setting up &brandShortName;\u2026">
 
 <!ENTITY  no_space_to_start_error "There is not enough space available for &brandShortName; to start.">
diff --git a/embedding/android/strings.xml.in b/embedding/android/strings.xml.in
index ddc58538a58f..3c0e2b309e0e 100644
--- a/embedding/android/strings.xml.in
+++ b/embedding/android/strings.xml.in
@@ -6,7 +6,6 @@
 ]>
 <resources>
   <string name="splash_screen_loading">&splash_screen_loading;</string>
-  <string name="splash_screen_installing_libs">&splash_screen_installing_libs;</string>
   <string name="splash_firstrun">&splash_firstrun;</string>
   <string name="no_space_to_start_error">&no_space_to_start_error;</string>
   <string name="error_loading_file">&error_loading_file;</string>

From 19ed8ee474a079dec309570f6704bbd53d74a556 Mon Sep 17 00:00:00 2001
From: Raymond Lee <raymond@raysquare.com>
Date: Fri, 16 Sep 2011 18:17:17 +0100
Subject: [PATCH 167/209] Bug 686855 - Undeclared variable causes the tab key
 navigation to stop working r=dietrich

---
 browser/base/content/tabview/ui.js | 1 +
 1 file changed, 1 insertion(+)

diff --git a/browser/base/content/tabview/ui.js b/browser/base/content/tabview/ui.js
index 723e5edd0d47..1f8a5093bf82 100644
--- a/browser/base/content/tabview/ui.js
+++ b/browser/base/content/tabview/ui.js
@@ -1215,6 +1215,7 @@ let UI = {
               let currentIndex = tabItems.indexOf(activeTab);
 
               if (length > 1) {
+                let newIndex;
                 if (event.shiftKey) {
                   if (currentIndex == 0)
                     newIndex = (length - 1);

From 3caf9548e85f15b7f18629ecc92ff10e1ba1004c Mon Sep 17 00:00:00 2001
From: "ithinc@sohu.com" <ithinc@sohu.com>
Date: Fri, 16 Sep 2011 19:42:32 +0200
Subject: [PATCH 168/209] Bug 624363 - Reloading all tabs does not show
 progress in List all tabs pop-up. r=dao

---
 browser/base/content/tabbrowser.xml | 13 +++++++++----
 1 file changed, 9 insertions(+), 4 deletions(-)

diff --git a/browser/base/content/tabbrowser.xml b/browser/base/content/tabbrowser.xml
index 3c4ebcde4d84..bae0c71037e2 100644
--- a/browser/base/content/tabbrowser.xml
+++ b/browser/base/content/tabbrowser.xml
@@ -563,7 +563,10 @@
                 if (this.mBlank)
                   this.mBlank = false;
 
-                this.mTab.removeAttribute("busy");
+                if (this.mTab.hasAttribute("busy")) {
+                  this.mTab.removeAttribute("busy");
+                  this.mTabBrowser._tabAttrModified(this.mTab);
+                }
                 this.mTab.removeAttribute("progress");
                 if (!this.mTab.selected)
                   this.mTab.setAttribute("unread", "true");
@@ -4165,12 +4168,14 @@
         <body><![CDATA[
           aMenuitem.setAttribute("label", aTab.label);
           aMenuitem.setAttribute("crop", aTab.getAttribute("crop"));
-          aMenuitem.setAttribute("image", aTab.getAttribute("image"));
 
-          if (aTab.hasAttribute("busy"))
+          if (aTab.hasAttribute("busy")) {
             aMenuitem.setAttribute("busy", aTab.getAttribute("busy"));
-          else
+            aMenuitem.removeAttribute("image");
+          } else {
+            aMenuitem.setAttribute("image", aTab.getAttribute("image"));
             aMenuitem.removeAttribute("busy");
+          }
 
           if (aTab.selected)
             aMenuitem.setAttribute("selected", "true");

From c287ae79b3558f06a798631b71856ed9b424a6b4 Mon Sep 17 00:00:00 2001
From: Sriram Ramasubramanian <sriram@mozilla.com>
Date: Fri, 16 Sep 2011 12:10:50 -0700
Subject: [PATCH 169/209] Bug 660686 - Enable entire row region selection in
 Preferences [r=mfinkle]

---
 mobile/chrome/content/bindings.xml | 36 ++++++++++++++++++++++++++++++
 mobile/chrome/content/browser.css  |  6 ++---
 2 files changed, 39 insertions(+), 3 deletions(-)

diff --git a/mobile/chrome/content/bindings.xml b/mobile/chrome/content/bindings.xml
index 2e043207b9c7..b659ec58404c 100644
--- a/mobile/chrome/content/bindings.xml
+++ b/mobile/chrome/content/bindings.xml
@@ -1852,4 +1852,40 @@
       </method>
     </implementation>
   </binding>
+  
+  <binding id="setting-fulltoggle-bool" extends="chrome://mozapps/content/extensions/setting.xml#setting-bool">
+    <handlers>
+      <handler event="TapSingle" button="0" phase="capturing">
+        <![CDATA[
+        this.input.setChecked(!this.value);
+        this.inputChanged();
+        event.stopPropagation();
+        ]]>
+      </handler>
+    </handlers>
+  </binding>
+
+  <binding id="setting-fulltoggle-boolint" extends="chrome://mozapps/content/extensions/setting.xml#setting-boolint">
+    <handlers>
+      <handler event="TapSingle" button="0" phase="capturing">
+        <![CDATA[
+        this.input.setChecked(!this.value);
+        this.inputChanged();
+        event.stopPropagation();
+        ]]>
+      </handler>
+    </handlers>
+  </binding>
+
+  <binding id="setting-fulltoggle-localized-bool" extends="chrome://mozapps/content/extensions/setting.xml#setting-localized-bool">
+    <handlers>
+      <handler event="TapSingle" button="0" phase="capturing">
+        <![CDATA[
+        this.input.setChecked(!this.value);
+        this.inputChanged();
+        event.stopPropagation();
+        ]]>
+      </handler>
+    </handlers>
+  </binding>
 </bindings>
diff --git a/mobile/chrome/content/browser.css b/mobile/chrome/content/browser.css
index f9a8b3113e10..a2a7ba4f1b15 100644
--- a/mobile/chrome/content/browser.css
+++ b/mobile/chrome/content/browser.css
@@ -27,15 +27,15 @@ settings {
 }
 
 setting[type="bool"] {
-  -moz-binding: url("chrome://mozapps/content/extensions/setting.xml#setting-bool");
+  -moz-binding: url("chrome://browser/content/bindings.xml#setting-fulltoggle-bool");
 }
 
 setting[type="bool"][localized="true"] {
-  -moz-binding: url("chrome://mozapps/content/extensions/setting.xml#setting-localized-bool");
+  -moz-binding: url("chrome://browser/content/bindings.xml#setting-fulltoggle-localized-bool");
 }
 
 setting[type="boolint"] {
-  -moz-binding: url("chrome://mozapps/content/extensions/setting.xml#setting-boolint");
+  -moz-binding: url("chrome://browser/content/bindings.xml#setting-fulltoggle-boolint");
 }
 
 setting[type="integer"] {

From eec69a6ee9cb809731c20cd38a99aa82e07fbf3d Mon Sep 17 00:00:00 2001
From: Sriram Ramasubramanian <sriram@mozilla.com>
Date: Fri, 16 Sep 2011 12:10:53 -0700
Subject: [PATCH 170/209] Bug 660686 - Patch for browser-chrome test
 [r=mfinkle]

---
 mobile/chrome/tests/Makefile.in               |  1 +
 .../tests/browser_preferences_fulltoggle.js   | 67 +++++++++++++++++++
 2 files changed, 68 insertions(+)
 create mode 100644 mobile/chrome/tests/browser_preferences_fulltoggle.js

diff --git a/mobile/chrome/tests/Makefile.in b/mobile/chrome/tests/Makefile.in
index c36b3d134776..28de2a13aaaa 100644
--- a/mobile/chrome/tests/Makefile.in
+++ b/mobile/chrome/tests/Makefile.in
@@ -74,6 +74,7 @@ _BROWSER_FILES = \
   browser_history.js \
   browser_mainui.js \
   browser_preferences_text.js \
+  browser_preferences_fulltoggle.js \
   browser_rect.js \
   browser_rememberPassword.js \
   browser_scroll.js \
diff --git a/mobile/chrome/tests/browser_preferences_fulltoggle.js b/mobile/chrome/tests/browser_preferences_fulltoggle.js
new file mode 100644
index 000000000000..9ce68fbe22f9
--- /dev/null
+++ b/mobile/chrome/tests/browser_preferences_fulltoggle.js
@@ -0,0 +1,67 @@
+// browser-chrome test for fennec preferences to toggle values while clicking on the preference name
+
+var gTests = [];
+var gCurrentTest = null;
+
+function test() {
+  // The "runNextTest" approach is async, so we need to call "waitForExplicitFinish()"
+  // We call "finish()" when the tests are finished
+  waitForExplicitFinish();
+
+  // Start the tests
+  runNextTest();
+}
+//------------------------------------------------------------------------------
+// Iterating tests by shifting test out one by one as runNextTest is called.
+function runNextTest() {
+  // Run the next test until all tests completed
+  if (gTests.length > 0) {
+    gCurrentTest = gTests.shift();
+    info(gCurrentTest.desc);
+    gCurrentTest.run();
+  }
+  else {
+    // Cleanup. All tests are completed at this point
+    finish();
+  }
+}
+
+// -----------------------------------------------------------------------------------------
+// Verify preferences and text
+gTests.push({
+  desc: "Verify full toggle on Preferences",
+
+  run: function(){
+    // 1.Click preferences to view prefs
+    document.getElementById("tool-panel-open").click();
+    is(document.getElementById("panel-container").hidden, false, "Preferences should be visible");
+
+    var contentRegion = document.getElementById("prefs-content");
+
+    // Check for *Show images*
+    var imageRegion = document.getAnonymousElementByAttribute(contentRegion, "pref", "permissions.default.image");
+    var imageValue  = imageRegion.value;
+    var imageTitle  = document.getAnonymousElementByAttribute(imageRegion, "class", "preferences-title");
+    var imageButton = document.getAnonymousElementByAttribute(imageRegion, "anonid", "input");
+
+    var ibEvent = document.createEvent("MouseEvents");
+    ibEvent.initEvent("TapSingle", true, false);
+    imageButton.dispatchEvent(ibEvent);
+    is(imageRegion.value, !imageValue, "Tapping on input control should change the value");
+
+    var itEvent = document.createEvent("MouseEvents");
+    itEvent.initEvent("TapSingle", true, false);
+    imageTitle.dispatchEvent(itEvent);
+    is(imageRegion.value, imageValue, "Tapping on the title should change the value"); 
+
+    var irEvent = document.createEvent("MouseEvents");
+    irEvent.initEvent("TapSingle", true, false);
+    imageRegion.dispatchEvent(irEvent);
+    is(imageRegion.value, !imageValue, "Tapping on the setting should change the value"); 
+
+    BrowserUI.hidePanel();
+    is(document.getElementById("panel-container").hidden, true, "Preferences panel should be closed");
+    runNextTest();
+  }
+});
+

From 47fae45bfaf40f06b393bdef1d1f2e1aa727bbdf Mon Sep 17 00:00:00 2001
From: Sriram Ramasubramanian <sriram@mozilla.com>
Date: Fri, 16 Sep 2011 12:10:55 -0700
Subject: [PATCH 171/209] Bug 685147 - Add tap-hold selection color status to
 row selection [r=mfinkle]

---
 mobile/themes/core/gingerbread/browser.css | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/mobile/themes/core/gingerbread/browser.css b/mobile/themes/core/gingerbread/browser.css
index e8d6ffb2d27f..43454a71a083 100644
--- a/mobile/themes/core/gingerbread/browser.css
+++ b/mobile/themes/core/gingerbread/browser.css
@@ -1248,6 +1248,10 @@ setting {
   -moz-box-orient: horizontal;
 }
 
+setting:hover:active {
+  background-color: @color_background_highlight@;
+}
+
 .setting-label {
   -moz-box-flex: 1;
 }

From 44e05fde0e0f8f1b6c04775d884381dea4e956f6 Mon Sep 17 00:00:00 2001
From: Sriram Ramasubramanian <sriram@mozilla.com>
Date: Fri, 16 Sep 2011 12:10:58 -0700
Subject: [PATCH 172/209] Bug 661612 - Update download progress notification
 keeps reappearing in Android 3 [r=mfinkle,alexp]

---
 embedding/android/AlertNotification.java | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/embedding/android/AlertNotification.java b/embedding/android/AlertNotification.java
index 834f13932d42..484975e1ff7a 100644
--- a/embedding/android/AlertNotification.java
+++ b/embedding/android/AlertNotification.java
@@ -115,7 +115,7 @@ public class AlertNotification
             view.setImageViewResource(R.id.notificationImage, mIcon);
             view.setTextViewText(R.id.notificationTitle, mTitle);
             contentView = view;
-            flags |= FLAG_ONGOING_EVENT;
+            flags |= FLAG_ONGOING_EVENT | FLAG_ONLY_ALERT_ONCE;
 
             mProgressStyle = true;
         }

From ee56ede693aa4832b14ddfb0ef989c6e265cf433 Mon Sep 17 00:00:00 2001
From: Jonathan Kew <jfkthame@gmail.com>
Date: Fri, 16 Sep 2011 20:23:29 +0100
Subject: [PATCH 173/209] bug 686497 - avoid passing excessively long
 wavy-underline path to cairo for stroking. r=roc

---
 layout/base/nsCSSRendering.cpp         | 39 ++++++++++++++++++++++----
 layout/base/nsCSSRendering.h           |  2 ++
 layout/generic/nsTextFrame.h           |  2 ++
 layout/generic/nsTextFrameThebes.cpp   | 33 ++++++++++++++--------
 layout/xul/base/src/nsTextBoxFrame.cpp | 14 +++++----
 layout/xul/base/src/nsTextBoxFrame.h   |  5 ++--
 6 files changed, 69 insertions(+), 26 deletions(-)

diff --git a/layout/base/nsCSSRendering.cpp b/layout/base/nsCSSRendering.cpp
index 7bac24f24197..c03b0644dfe5 100644
--- a/layout/base/nsCSSRendering.cpp
+++ b/layout/base/nsCSSRendering.cpp
@@ -3367,6 +3367,7 @@ nsCSSRendering::DrawTableBorderSegment(nsRenderingContext&     aContext,
 
 void
 nsCSSRendering::PaintDecorationLine(gfxContext* aGfxContext,
+                                    const gfxRect& aDirtyRect,
                                     const nscolor aColor,
                                     const gfxPoint& aPt,
                                     const gfxSize& aLineSize,
@@ -3381,8 +3382,9 @@ nsCSSRendering::PaintDecorationLine(gfxContext* aGfxContext,
   gfxRect rect =
     GetTextDecorationRectInternal(aPt, aLineSize, aAscent, aOffset,
                                   aDecoration, aStyle, aDescentLimit);
-  if (rect.IsEmpty())
+  if (rect.IsEmpty() || !rect.Intersects(aDirtyRect)) {
     return;
+  }
 
   if (aDecoration != NS_STYLE_TEXT_DECORATION_LINE_UNDERLINE &&
       aDecoration != NS_STYLE_TEXT_DECORATION_LINE_OVERLINE &&
@@ -3524,14 +3526,30 @@ nsCSSRendering::PaintDecorationLine(gfxContext* aGfxContext,
        *  7. Repeat from 2 until reached to right-most edge of the area.
        */
 
-      rect.x += lineHeight / 2.0;
-      aGfxContext->NewPath();
-
-      gfxPoint pt(rect.TopLeft());
-      gfxFloat rightMost = pt.x + rect.Width() + lineHeight;
       gfxFloat adv = rect.Height() - lineHeight;
       gfxFloat flatLengthAtVertex = NS_MAX((lineHeight - 1.0) * 2.0, 1.0);
 
+      // figure out if we can trim whole cycles from the left and right edges
+      // of the line, to try and avoid creating an unnecessarily long and
+      // complex path
+      gfxFloat cycleLength = 2 * (adv + flatLengthAtVertex);
+      PRInt32 skipCycles = floor((aDirtyRect.x - rect.x) / cycleLength);
+      if (skipCycles > 0) {
+        rect.x += skipCycles * cycleLength;
+        rect.width -= skipCycles * cycleLength;
+      }
+
+      rect.x += lineHeight / 2.0;
+      gfxPoint pt(rect.TopLeft());
+      gfxFloat rightMost = pt.x + rect.Width() + lineHeight;
+
+      skipCycles = floor((rightMost - aDirtyRect.XMost()) / cycleLength);
+      if (skipCycles > 0) {
+        rightMost -= skipCycles * cycleLength;
+      }
+
+      aGfxContext->NewPath();
+
       pt.x -= lineHeight;
       aGfxContext->MoveTo(pt); // 1
 
@@ -3539,7 +3557,16 @@ nsCSSRendering::PaintDecorationLine(gfxContext* aGfxContext,
       aGfxContext->LineTo(pt); // 2
 
       PRBool goDown = PR_TRUE;
+      PRUint32 iter = 0;
       while (pt.x < rightMost) {
+        if (++iter > 1000) {
+          // stroke the current path and start again, to avoid pathological
+          // behavior in cairo with huge numbers of path segments
+          aGfxContext->Stroke();
+          aGfxContext->NewPath();
+          aGfxContext->MoveTo(pt);
+          iter = 0;
+        }
         pt.x += adv;
         pt.y += goDown ? adv : -adv;
 
diff --git a/layout/base/nsCSSRendering.h b/layout/base/nsCSSRendering.h
index a57298ae595c..fb317ea87e25 100644
--- a/layout/base/nsCSSRendering.h
+++ b/layout/base/nsCSSRendering.h
@@ -292,6 +292,7 @@ struct nsCSSRendering {
    *       not app units.
    *   input:
    *     @param aGfxContext
+   *     @param aDirtyRect        no need to paint outside this rect
    *     @param aColor            the color of the decoration line
    *     @param aPt               the top/left edge of the text
    *     @param aLineSize         the width and the height of the decoration
@@ -319,6 +320,7 @@ struct nsCSSRendering {
    *                              used for strikeout line and overline too.
    */
   static void PaintDecorationLine(gfxContext* aGfxContext,
+                                  const gfxRect& aDirtyRect,
                                   const nscolor aColor,
                                   const gfxPoint& aPt,
                                   const gfxSize& aLineSize,
diff --git a/layout/generic/nsTextFrame.h b/layout/generic/nsTextFrame.h
index 887a352d0fd5..5423bde210b5 100644
--- a/layout/generic/nsTextFrame.h
+++ b/layout/generic/nsTextFrame.h
@@ -514,6 +514,7 @@ protected:
                    PRBool aDrawSoftHyphen);
 
   void DrawTextRunAndDecorations(gfxContext* const aCtx,
+                                 const gfxRect& aDirtyRect,
                                  const gfxPoint& aFramePt,
                                  const gfxPoint& aTextBaselinePt,
                                  PRUint32 aOffset,
@@ -527,6 +528,7 @@ protected:
                                  const nscolor* const aDecorationOverrideColor);
 
   void DrawText(gfxContext* const aCtx,
+                const gfxRect& aDirtyRect,
                 const gfxPoint& aFramePt,
                 const gfxPoint& aTextBaselinePt,
                 PRUint32 aOffset,
diff --git a/layout/generic/nsTextFrameThebes.cpp b/layout/generic/nsTextFrameThebes.cpp
index 17958d0d218f..9dc2e59a6278 100644
--- a/layout/generic/nsTextFrameThebes.cpp
+++ b/layout/generic/nsTextFrameThebes.cpp
@@ -4526,7 +4526,9 @@ ComputeSelectionUnderlineHeight(nsPresContext* aPresContext,
  * This, plus SelectionTypesWithDecorations, encapsulates all knowledge about
  * drawing text decoration for selections.
  */
-static void DrawSelectionDecorations(gfxContext* aContext, SelectionType aType,
+static void DrawSelectionDecorations(gfxContext* aContext,
+    const gfxRect& aDirtyRect,
+    SelectionType aType,
     nsTextFrame* aFrame,
     nsTextPaintStyle& aTextPaintStyle,
     const nsTextRangeStyle &aRangeStyle,
@@ -4608,7 +4610,7 @@ static void DrawSelectionDecorations(gfxContext* aContext, SelectionType aType,
   }
   size.height *= relativeSize;
   nsCSSRendering::PaintDecorationLine(
-    aContext, color, pt, size, aAscent, aFontMetrics.underlineOffset,
+    aContext, aDirtyRect, color, pt, size, aAscent, aFontMetrics.underlineOffset,
     NS_STYLE_TEXT_DECORATION_LINE_UNDERLINE, style, descentLimit);
 }
 
@@ -4844,7 +4846,9 @@ nsTextFrame::PaintOneShadow(PRUint32 aOffset, PRUint32 aLength,
   // Remember that the box blur context has a device offset on it, so we don't need to
   // translate any coordinates to fit on the surface.
   gfxFloat advanceWidth;
-  DrawText(shadowContext, aFramePt + shadowOffset,
+  gfxRect dirtyRect(aDirtyRect.x, aDirtyRect.y,
+                    aDirtyRect.width, aDirtyRect.height);
+  DrawText(shadowContext, dirtyRect, aFramePt + shadowOffset,
            aTextBaselinePt + shadowOffset, aOffset, aLength, *aProvider,
            nsTextPaintStyle(this), aClipEdges, advanceWidth,
            (GetStateBits() & TEXT_HYPHEN_BREAK) != 0, decorationOverrideColor);
@@ -4955,7 +4959,7 @@ nsTextFrame::PaintTextWithSelectionColors(gfxContext* aCtx,
     aCtx->SetColor(gfxRGBA(foreground));
     gfxFloat advance;
 
-    DrawText(aCtx, aFramePt, gfxPoint(aFramePt.x + xOffset, aTextBaselinePt.y),
+    DrawText(aCtx, aDirtyRect, aFramePt, gfxPoint(aFramePt.x + xOffset, aTextBaselinePt.y),
              offset, length, aProvider, aTextPaintStyle, aClipEdges, advance,
              hyphenWidth > 0);
     if (hyphenWidth) {
@@ -5016,6 +5020,8 @@ nsTextFrame::PaintTextSelectionDecorations(gfxContext* aCtx,
   PRInt32 app = aTextPaintStyle.PresContext()->AppUnitsPerDevPixel();
   // XXX aTextBaselinePt is in AppUnits, shouldn't it be nsFloatPoint?
   gfxPoint pt(0.0, (aTextBaselinePt.y - mAscent) / app);
+  gfxRect dirtyRect(aDirtyRect.x / app, aDirtyRect.y / app,
+                    aDirtyRect.width / app, aDirtyRect.height / app);
   SelectionType type;
   nsTextRangeStyle selectedStyle;
   while (iterator.GetNextSegment(&xOffset, &offset, &length, &hyphenWidth,
@@ -5026,7 +5032,7 @@ nsTextFrame::PaintTextSelectionDecorations(gfxContext* aCtx,
       pt.x = (aFramePt.x + xOffset -
              (mTextRun->IsRightToLeft() ? advance : 0)) / app;
       gfxFloat width = NS_ABS(advance) / app;
-      DrawSelectionDecorations(aCtx, aSelectionType, this, aTextPaintStyle,
+      DrawSelectionDecorations(aCtx, dirtyRect, aSelectionType, this, aTextPaintStyle,
                                selectedStyle,
                                pt, width, mAscent / app, decorationMetrics);
     }
@@ -5306,7 +5312,7 @@ nsTextFrame::PaintText(nsRenderingContext* aRenderingContext, nsPoint aPt,
   ctx->SetColor(gfxRGBA(foregroundColor));
 
   gfxFloat advanceWidth;
-  DrawText(ctx, framePt, textBaselinePt, startOffset, maxLength, provider,
+  DrawText(ctx, dirtyRect, framePt, textBaselinePt, startOffset, maxLength, provider,
            textPaintStyle, clipEdges, advanceWidth,
            (GetStateBits() & TEXT_HYPHEN_BREAK) != 0);
 }
@@ -5339,7 +5345,7 @@ nsTextFrame::DrawTextRun(gfxContext* const aCtx,
 
 void
 nsTextFrame::DrawTextRunAndDecorations(
-    gfxContext* const aCtx,
+    gfxContext* const aCtx, const gfxRect& aDirtyRect,
     const gfxPoint& aFramePt, const gfxPoint& aTextBaselinePt,
     PRUint32 aOffset, PRUint32 aLength,
     PropertyProvider& aProvider,
@@ -5362,6 +5368,9 @@ nsTextFrame::DrawTextRunAndDecorations(
     const gfxFloat ascent = gfxFloat(mAscent) / app;
     const gfxFloat frameTop = aFramePt.y;
 
+    gfxRect dirtyRect(aDirtyRect.x / app, aDirtyRect.y / app,
+                      aDirtyRect.Width() / app, aDirtyRect.Height() / app);
+
     // Underlines
     for (PRUint32 i = aDecorations.mUnderlines.Length(); i-- > 0; ) {
       const LineDecoration& dec = aDecorations.mUnderlines[i];
@@ -5373,7 +5382,7 @@ nsTextFrame::DrawTextRunAndDecorations(
       decPt.y = (frameTop - dec.mBaselineOffset) / app;
 
       const nscolor lineColor = aDecorationOverrideColor ? *aDecorationOverrideColor : dec.mColor;
-      nsCSSRendering::PaintDecorationLine(aCtx, lineColor, decPt, decSize, ascent,
+      nsCSSRendering::PaintDecorationLine(aCtx, dirtyRect, lineColor, decPt, decSize, ascent,
         metrics.underlineOffset, NS_STYLE_TEXT_DECORATION_LINE_UNDERLINE,
         dec.mStyle);
     }
@@ -5388,7 +5397,7 @@ nsTextFrame::DrawTextRunAndDecorations(
       decPt.y = (frameTop - dec.mBaselineOffset) / app;
 
       const nscolor lineColor = aDecorationOverrideColor ? *aDecorationOverrideColor : dec.mColor;
-      nsCSSRendering::PaintDecorationLine(aCtx, lineColor, decPt, decSize, ascent,
+      nsCSSRendering::PaintDecorationLine(aCtx, dirtyRect, lineColor, decPt, decSize, ascent,
         metrics.maxAscent, NS_STYLE_TEXT_DECORATION_LINE_OVERLINE, dec.mStyle);
     }
 
@@ -5408,7 +5417,7 @@ nsTextFrame::DrawTextRunAndDecorations(
       decPt.y = (frameTop - dec.mBaselineOffset) / app;
 
       const nscolor lineColor = aDecorationOverrideColor ? *aDecorationOverrideColor : dec.mColor;
-      nsCSSRendering::PaintDecorationLine(aCtx, lineColor, decPt, decSize, ascent,
+      nsCSSRendering::PaintDecorationLine(aCtx, dirtyRect, lineColor, decPt, decSize, ascent,
         metrics.strikeoutOffset, NS_STYLE_TEXT_DECORATION_LINE_LINE_THROUGH,
         dec.mStyle);
     }
@@ -5416,7 +5425,7 @@ nsTextFrame::DrawTextRunAndDecorations(
 
 void
 nsTextFrame::DrawText(
-    gfxContext* const aCtx,
+    gfxContext* const aCtx, const gfxRect& aDirtyRect,
     const gfxPoint& aFramePt, const gfxPoint& aTextBaselinePt,
     PRUint32 aOffset, PRUint32 aLength,
     PropertyProvider& aProvider,
@@ -5433,7 +5442,7 @@ nsTextFrame::DrawText(
   const bool drawDecorations = !aProvider.GetFontGroup()->ShouldSkipDrawing() &&
                                decorations.HasDecorationLines();
   if (drawDecorations) {
-    DrawTextRunAndDecorations(aCtx, aFramePt, aTextBaselinePt, aOffset, aLength,
+    DrawTextRunAndDecorations(aCtx, aDirtyRect, aFramePt, aTextBaselinePt, aOffset, aLength,
                               aProvider, aTextStyle, aClipEdges, aAdvanceWidth,
                               aDrawSoftHyphen, decorations,
                               aDecorationOverrideColor);
diff --git a/layout/xul/base/src/nsTextBoxFrame.cpp b/layout/xul/base/src/nsTextBoxFrame.cpp
index e2b9bc34cafc..63f2651d9654 100644
--- a/layout/xul/base/src/nsTextBoxFrame.cpp
+++ b/layout/xul/base/src/nsTextBoxFrame.cpp
@@ -413,13 +413,14 @@ nsTextBoxFrame::PaintTitle(nsRenderingContext& aRenderingContext,
     if (mTitle.IsEmpty())
         return;
 
-    DrawText(aRenderingContext, mTextDrawRect + aPt, aOverrideColor);
+    DrawText(aRenderingContext, aDirtyRect, mTextDrawRect + aPt, aOverrideColor);
 }
 
 void
 nsTextBoxFrame::DrawText(nsRenderingContext& aRenderingContext,
-                         const nsRect&        aTextRect,
-                         const nscolor*       aOverrideColor)
+                         const nsRect&       aDirtyRect,
+                         const nsRect&       aTextRect,
+                         const nscolor*      aOverrideColor)
 {
     nsPresContext* presContext = PresContext();
 
@@ -497,6 +498,7 @@ nsTextBoxFrame::DrawText(nsRenderingContext& aRenderingContext,
                 presContext->AppUnitsToGfxUnits(aTextRect.y));
     gfxFloat width = presContext->AppUnitsToGfxUnits(aTextRect.width);
     gfxFloat ascentPixel = presContext->AppUnitsToGfxUnits(ascent);
+    gfxRect dirtyRect(presContext->AppUnitsToGfxUnits(aDirtyRect));
 
     // Underlines are drawn before overlines, and both before the text
     // itself, per http://www.w3.org/TR/CSS21/zindex.html point 7.2.1.4.1.1.
@@ -510,14 +512,14 @@ nsTextBoxFrame::DrawText(nsRenderingContext& aRenderingContext,
       gfxFloat sizePixel = presContext->AppUnitsToGfxUnits(size);
       if ((decorations & NS_FONT_DECORATION_UNDERLINE) &&
           underStyle != NS_STYLE_TEXT_DECORATION_STYLE_NONE) {
-        nsCSSRendering::PaintDecorationLine(ctx, underColor,
+        nsCSSRendering::PaintDecorationLine(ctx, dirtyRect, underColor,
                           pt, gfxSize(width, sizePixel),
                           ascentPixel, offsetPixel,
                           NS_STYLE_TEXT_DECORATION_LINE_UNDERLINE, underStyle);
       }
       if ((decorations & NS_FONT_DECORATION_OVERLINE) &&
           overStyle != NS_STYLE_TEXT_DECORATION_STYLE_NONE) {
-        nsCSSRendering::PaintDecorationLine(ctx, overColor,
+        nsCSSRendering::PaintDecorationLine(ctx, dirtyRect, overColor,
                           pt, gfxSize(width, sizePixel),
                           ascentPixel, ascentPixel,
                           NS_STYLE_TEXT_DECORATION_LINE_OVERLINE, overStyle);
@@ -599,7 +601,7 @@ nsTextBoxFrame::DrawText(nsRenderingContext& aRenderingContext,
       fontMet->GetStrikeout(offset, size);
       gfxFloat offsetPixel = presContext->AppUnitsToGfxUnits(offset);
       gfxFloat sizePixel = presContext->AppUnitsToGfxUnits(size);
-      nsCSSRendering::PaintDecorationLine(ctx, strikeColor,
+      nsCSSRendering::PaintDecorationLine(ctx, dirtyRect, strikeColor,
                         pt, gfxSize(width, sizePixel), ascentPixel, offsetPixel,
                         NS_STYLE_TEXT_DECORATION_LINE_LINE_THROUGH,
                         strikeStyle);
diff --git a/layout/xul/base/src/nsTextBoxFrame.h b/layout/xul/base/src/nsTextBoxFrame.h
index 1ec73c942fac..cacd27ebbbc2 100644
--- a/layout/xul/base/src/nsTextBoxFrame.h
+++ b/layout/xul/base/src/nsTextBoxFrame.h
@@ -133,8 +133,9 @@ private:
   PRBool InsertSeparatorBeforeAccessKey();
 
   void DrawText(nsRenderingContext& aRenderingContext,
-                         const nsRect&        aTextRect,
-                         const nscolor*       aOverrideColor);
+                const nsRect&       aDirtyRect,
+                const nsRect&       aTextRect,
+                const nscolor*      aOverrideColor);
 
   nsString mTitle;
   nsString mCroppedTitle;

From d6d932e4e70377366e95f00350a276ed3303f418 Mon Sep 17 00:00:00 2001
From: Doug Turner <dougt@dougt.org>
Date: Fri, 16 Sep 2011 14:34:31 -0700
Subject: [PATCH 174/209] Bug 630007 - Minimal support NPAPI on ANDROID.
 Pre-Honeycomb inproccess support only.  r=josh.

---
 dom/plugins/base/Makefile.in               |   7 +-
 dom/plugins/base/PluginPRLibrary.cpp       |  34 +-
 dom/plugins/base/PluginPRLibrary.h         |   8 +-
 dom/plugins/base/android/ANPAudio.cpp      | 323 +++++++
 dom/plugins/base/android/ANPBase.h         |  52 ++
 dom/plugins/base/android/ANPBitmap.cpp     |  80 ++
 dom/plugins/base/android/ANPCanvas.cpp     | 335 +++++++
 dom/plugins/base/android/ANPEvent.cpp      |  46 +
 dom/plugins/base/android/ANPKeyCodes.h     | 152 ++++
 dom/plugins/base/android/ANPLog.cpp        |  21 +
 dom/plugins/base/android/ANPMatrix.cpp     | 159 ++++
 dom/plugins/base/android/ANPPaint.cpp      | 416 +++++++++
 dom/plugins/base/android/ANPPath.cpp       | 133 +++
 dom/plugins/base/android/ANPSurface.cpp    | 151 ++++
 dom/plugins/base/android/ANPSystem.cpp     |  49 ++
 dom/plugins/base/android/ANPTypeface.cpp   | 113 +++
 dom/plugins/base/android/ANPWindow.cpp     |  53 ++
 dom/plugins/base/android/Makefile.in       |  81 ++
 dom/plugins/base/android/android_npapi.h   | 979 +++++++++++++++++++++
 dom/plugins/base/android_npapi.h           |   0
 dom/plugins/base/npfunctions.h             |  13 +-
 dom/plugins/base/nsNPAPIPlugin.cpp         | 125 ++-
 dom/plugins/base/nsNPAPIPluginInstance.cpp | 114 ++-
 dom/plugins/base/nsNPAPIPluginInstance.h   |  16 +
 dom/plugins/base/nsPluginHost.cpp          |  11 +-
 dom/plugins/base/nsPluginInstanceOwner.cpp | 312 ++++++-
 dom/plugins/base/nsPluginInstanceOwner.h   |   7 +-
 dom/plugins/base/nsPluginsDirUnix.cpp      |  10 +
 embedding/android/AndroidManifest.xml.in   |   7 +
 embedding/android/GeckoApp.java            | 162 +++-
 embedding/android/GeckoAppShell.java       | 197 +++++
 embedding/android/Makefile.in              |   1 +
 embedding/android/SurfaceLockInfo.java     |  18 +
 layout/build/Makefile.in                   |   1 +
 layout/generic/nsObjectFrame.cpp           |  16 +
 other-licenses/android/APKOpen.cpp         |   2 +
 widget/src/android/AndroidBridge.cpp       |  50 +-
 widget/src/android/AndroidBridge.h         |   8 +
 widget/src/android/AndroidJNI.cpp          |  13 +
 39 files changed, 4250 insertions(+), 25 deletions(-)
 create mode 100644 dom/plugins/base/android/ANPAudio.cpp
 create mode 100644 dom/plugins/base/android/ANPBase.h
 create mode 100644 dom/plugins/base/android/ANPBitmap.cpp
 create mode 100644 dom/plugins/base/android/ANPCanvas.cpp
 create mode 100644 dom/plugins/base/android/ANPEvent.cpp
 create mode 100644 dom/plugins/base/android/ANPKeyCodes.h
 create mode 100644 dom/plugins/base/android/ANPLog.cpp
 create mode 100644 dom/plugins/base/android/ANPMatrix.cpp
 create mode 100644 dom/plugins/base/android/ANPPaint.cpp
 create mode 100644 dom/plugins/base/android/ANPPath.cpp
 create mode 100644 dom/plugins/base/android/ANPSurface.cpp
 create mode 100644 dom/plugins/base/android/ANPSystem.cpp
 create mode 100644 dom/plugins/base/android/ANPTypeface.cpp
 create mode 100644 dom/plugins/base/android/ANPWindow.cpp
 create mode 100644 dom/plugins/base/android/Makefile.in
 create mode 100644 dom/plugins/base/android/android_npapi.h
 create mode 100644 dom/plugins/base/android_npapi.h
 create mode 100644 embedding/android/SurfaceLockInfo.java

diff --git a/dom/plugins/base/Makefile.in b/dom/plugins/base/Makefile.in
index 4c7a50e0ba0b..402fe7765545 100644
--- a/dom/plugins/base/Makefile.in
+++ b/dom/plugins/base/Makefile.in
@@ -99,6 +99,11 @@ CPPSRCS		= \
 		nsPluginInstanceOwner.cpp \
 		$(NULL)
 
+ifeq ($(MOZ_WIDGET_TOOLKIT),android)
+DIRS += android
+LOCAL_INCLUDES += -I$(topsrcdir)/dom/plugins/base/android
+endif
+
 ifeq ($(OS_ARCH),WINNT)
 	CPPSRCS += nsPluginsDirWin.cpp
 	CPPSRCS += nsPluginNativeWindowWin.cpp
@@ -127,7 +132,7 @@ endif
 endif
 endif
 
-LOCAL_INCLUDES = \
+LOCAL_INCLUDES += \
   -I$(topsrcdir)/xpcom/base/ \
   $(MOZ_CAIRO_CFLAGS) \
   $(NULL)
diff --git a/dom/plugins/base/PluginPRLibrary.cpp b/dom/plugins/base/PluginPRLibrary.cpp
index 2eeeb53bec11..8fbbb3c345aa 100644
--- a/dom/plugins/base/PluginPRLibrary.cpp
+++ b/dom/plugins/base/PluginPRLibrary.cpp
@@ -37,7 +37,6 @@
  * ***** END LICENSE BLOCK ***** */
 
 #include "mozilla/PluginPRLibrary.h"
-
 // Some plugins on Windows, notably Quake Live, implement NP_Initialize using
 // cdecl instead of the documented stdcall. In order to work around this,
 // we force the caller to use a frame pointer.
@@ -52,9 +51,38 @@ static int gNotOptimized;
 #define CALLING_CONVENTION_HACK
 #endif
 
-namespace mozilla {
+#ifdef ANDROID
+#include "AndroidBridge.h"
+#include "android_npapi.h"
+#include <android/log.h>
+#define ALOG(args...) __android_log_print(ANDROID_LOG_INFO, "GeckoJavaEnv", ## args)
+#endif
 
-#if defined(XP_UNIX) && !defined(XP_MACOSX)
+namespace mozilla {
+#ifdef ANDROID
+nsresult
+PluginPRLibrary::NP_Initialize(NPNetscapeFuncs* bFuncs,
+			       NPPluginFuncs* pFuncs, NPError* error)
+{
+  if (mNP_Initialize) {
+    *error = mNP_Initialize(bFuncs, pFuncs, GetJNIForThread());
+  } else {
+    NP_InitializeFunc pfNP_Initialize = (NP_InitializeFunc)
+      PR_FindFunctionSymbol(mLibrary, "NP_Initialize");
+    if (!pfNP_Initialize)
+      return NS_ERROR_FAILURE;
+    *error = pfNP_Initialize(bFuncs, pFuncs, GetJNIForThread());
+  }
+
+
+  // Save pointers to functions that get called through PluginLibrary itself.
+  mNPP_New = pFuncs->newp;
+  mNPP_GetValue = pFuncs->getvalue;
+  mNPP_ClearSiteData = pFuncs->clearsitedata;
+  mNPP_GetSitesWithData = pFuncs->getsiteswithdata;
+  return NS_OK;
+}
+#elif defined(XP_UNIX) && !defined(XP_MACOSX)
 nsresult
 PluginPRLibrary::NP_Initialize(NPNetscapeFuncs* bFuncs,
 			       NPPluginFuncs* pFuncs, NPError* error)
diff --git a/dom/plugins/base/PluginPRLibrary.h b/dom/plugins/base/PluginPRLibrary.h
index 250d1ac92bb7..2dbcb5ec2df1 100644
--- a/dom/plugins/base/PluginPRLibrary.h
+++ b/dom/plugins/base/PluginPRLibrary.h
@@ -63,9 +63,11 @@ public:
         mNP_GetEntryPoints(nsnull),
 #endif
         mNPP_New(nsnull),
+        mNPP_GetValue(nsnull),
         mNPP_ClearSiteData(nsnull),
         mNPP_GetSitesWithData(nsnull),
-        mLibrary(aLibrary)
+        mLibrary(aLibrary),
+        mFilePath(aFilePath)
     {
         NS_ASSERTION(mLibrary, "need non-null lib");
         // addref here??
@@ -159,6 +161,8 @@ public:
                                     const nsGUIEvent& anEvent, bool* handled);
 #endif
 
+    virtual void GetLibraryPath(nsACString& aPath) { aPath.Assign(mFilePath); }
+
 private:
     NP_InitializeFunc mNP_Initialize;
     NP_ShutdownFunc mNP_Shutdown;
@@ -170,9 +174,11 @@ private:
     NP_GetEntryPointsFunc mNP_GetEntryPoints;
 #endif
     NPP_NewProcPtr mNPP_New;
+    NPP_GetValueProcPtr mNPP_GetValue;
     NPP_ClearSiteDataPtr mNPP_ClearSiteData;
     NPP_GetSitesWithDataPtr mNPP_GetSitesWithData;
     PRLibrary* mLibrary;
+    nsCString mFilePath;
 };
 
 
diff --git a/dom/plugins/base/android/ANPAudio.cpp b/dom/plugins/base/android/ANPAudio.cpp
new file mode 100644
index 000000000000..1a681701533a
--- /dev/null
+++ b/dom/plugins/base/android/ANPAudio.cpp
@@ -0,0 +1,323 @@
+#include "base/basictypes.h"
+#include "AndroidBridge.h"
+
+#include <android/log.h>
+#include <stdlib.h>
+#include <time.h>
+
+#include "assert.h"
+#include "ANPBase.h"
+#include "nsIThread.h"
+#include "nsThreadUtils.h"
+
+#define LOG(args...)  __android_log_print(ANDROID_LOG_INFO, "GeckoPluginsAudio" , ## args)
+#define ASSIGN(obj, name)   (obj)->name = anp_audio_##name
+
+/* android.media.AudioTrack */
+struct AudioTrack {
+  jclass    at_class;
+  jmethodID constructor;
+  jmethodID flush;
+  jmethodID pause;
+  jmethodID play;
+  jmethodID setvol;
+  jmethodID stop;
+  jmethodID write;
+  jmethodID getpos;
+};
+
+enum AudioTrackMode {
+  MODE_STATIC = 0,
+  MODE_STREAM = 1
+};
+
+/* android.media.AudioManager */
+enum AudioManagerStream {
+  STREAM_VOICE_CALL = 0,
+  STREAM_SYSTEM = 1,
+  STREAM_RING = 2,
+  STREAM_MUSIC = 3,
+  STREAM_ALARM = 4,
+  STREAM_NOTIFICATION = 5,
+  STREAM_DTMF = 8
+};
+
+/* android.media.AudioFormat */
+enum AudioFormatChannel {
+  CHANNEL_OUT_MONO = 4,
+  CHANNEL_OUT_STEREO = 12
+};
+
+enum AudioFormatEncoding {
+  ENCODING_PCM_16BIT = 2,
+  ENCODING_PCM_8BIT = 3
+};
+
+static struct AudioTrack at;
+
+static jclass
+init_jni_bindings(JNIEnv *jenv) {
+  jclass jc = jenv->FindClass("android/media/AudioTrack");
+
+  at.constructor = jenv->GetMethodID(jc, "<init>", "(IIIIII)V");
+  at.flush       = jenv->GetMethodID(jc, "flush", "()V");
+  at.pause       = jenv->GetMethodID(jc, "pause", "()V");
+  at.play        = jenv->GetMethodID(jc, "play",  "()V");
+  at.setvol      = jenv->GetMethodID(jc, "setStereoVolume",  "(FF)I");
+  at.stop        = jenv->GetMethodID(jc, "stop",  "()V");
+  at.write       = jenv->GetMethodID(jc, "write", "([BII)I");
+  at.getpos      = jenv->GetMethodID(jc, "getPlaybackHeadPosition", "()I");
+
+  return jc;
+}
+
+struct ANPAudioTrack {
+  jobject output_unit;
+  jclass at_class;
+
+  unsigned int rate;
+  unsigned int channels;
+  unsigned int bufferSize;
+  unsigned int isStopped;
+  unsigned int keepGoing;
+
+  void* user;
+  ANPAudioCallbackProc proc;
+  ANPSampleFormat format;
+};
+
+class AudioRunnable : public nsRunnable
+{
+public:
+  NS_DECL_NSIRUNNABLE
+
+  AudioRunnable(ANPAudioTrack* aAudioTrack) {
+    mTrack = aAudioTrack;
+  }
+
+  ANPAudioTrack* mTrack;
+};
+
+NS_IMETHODIMP
+AudioRunnable::Run()
+{
+  JNIEnv* jenv = GetJNIForThread();
+
+  if (jenv->PushLocalFrame(128)) {
+    return NS_ERROR_FAILURE;
+  }
+
+  jbyteArray bytearray = jenv->NewByteArray(mTrack->bufferSize);
+  if (!bytearray) {
+    LOG("AudioRunnable:: Run.  Could not create bytearray");
+    return NS_ERROR_FAILURE;
+  }
+
+  jbyte *byte = jenv->GetByteArrayElements(bytearray, NULL);
+  if (!byte) {
+    LOG("AudioRunnable:: Run.  Could not create bytearray");
+    return NS_ERROR_FAILURE;
+  }
+
+  ANPAudioBuffer buffer;
+  buffer.channelCount = mTrack->channels;
+  buffer.format = mTrack->format;
+  buffer.bufferData = (void*) byte;
+
+  while (mTrack->keepGoing)
+  {
+    // reset the buffer size
+    buffer.size = mTrack->bufferSize;
+
+    // Get data from the plugin
+    mTrack->proc(kMoreData_ANPAudioEvent, mTrack->user, &buffer);
+
+    if (buffer.size == 0) {
+      LOG("%p - kMoreData_ANPAudioEvent", mTrack);
+      continue;
+    }
+
+    size_t wroteSoFar = 0;
+    jint retval;
+    do {
+      retval = jenv->CallIntMethod(mTrack->output_unit,
+                                   at.write,
+                                   bytearray,
+                                   wroteSoFar,
+                                   buffer.size - wroteSoFar);
+      if (retval < 0) {
+        LOG("%p - Write failed %d", mTrack, retval);
+        break;
+      }
+
+      wroteSoFar += retval;
+
+    } while(wroteSoFar < buffer.size);
+  }
+
+  jenv->DeleteGlobalRef(mTrack->output_unit);
+  jenv->DeleteGlobalRef(mTrack->at_class);
+
+  free(mTrack);
+
+  jenv->ReleaseByteArrayElements(bytearray, byte, 0);
+  jenv->PopLocalFrame(NULL);
+
+  return NS_OK;
+}
+
+ANPAudioTrack*
+anp_audio_newTrack(uint32_t sampleRate,    // sampling rate in Hz
+                   ANPSampleFormat format,
+                   int channelCount,       // MONO=1, STEREO=2
+                   ANPAudioCallbackProc proc,
+                   void* user)
+{
+  ANPAudioTrack *s = (ANPAudioTrack*) malloc(sizeof(ANPAudioTrack));
+  if (s == NULL) {
+    return NULL;
+  }
+
+  JNIEnv *jenv = GetJNIForThread();
+  if (!jenv)
+    return NULL;
+
+  s->at_class = init_jni_bindings(jenv);
+  s->rate = sampleRate;
+  s->channels = channelCount;
+  s->bufferSize = s->rate * s->channels;
+  s->isStopped = true;
+  s->keepGoing = false;
+  s->user = user;
+  s->proc = proc;
+  s->format = format;
+
+  int jformat;
+  switch (format) {
+  case kPCM16Bit_ANPSampleFormat:
+    jformat = ENCODING_PCM_16BIT;
+    break;
+  case kPCM8Bit_ANPSampleFormat:
+    jformat = ENCODING_PCM_8BIT;
+    break;
+  default:
+    LOG("Unknown audio format.  defaulting to 16bit.");
+    jformat = ENCODING_PCM_16BIT;
+    break;
+  }
+
+  int jChannels;
+  switch (channelCount) {
+  case 1:
+    jChannels = CHANNEL_OUT_MONO;
+    break;
+  case 2:
+    jChannels = CHANNEL_OUT_STEREO;
+    break;
+  default:
+    LOG("Unknown channel count.  defaulting to mono.");
+    jChannels = CHANNEL_OUT_MONO;
+    break;
+  }
+
+  jobject obj = jenv->NewObject(s->at_class,
+                                at.constructor,
+                                STREAM_MUSIC,
+                                s->rate,
+                                jChannels,
+                                jformat,
+                                s->bufferSize,
+                                MODE_STREAM);
+
+  jthrowable exception = jenv->ExceptionOccurred();
+  if (exception) {
+    LOG("%s fAILED  ", __PRETTY_FUNCTION__);
+    jenv->ExceptionDescribe();
+    jenv->ExceptionClear();
+    jenv->DeleteGlobalRef(s->at_class);
+    free(s);
+    return NULL;
+  }
+
+  s->output_unit = jenv->NewGlobalRef(obj);
+  return s;
+}
+
+void
+anp_audio_deleteTrack(ANPAudioTrack* s)
+{
+  if (s == NULL) {
+    return;
+  }
+
+  s->keepGoing = false;
+
+  // deallocation happens in the AudioThread.  There is a
+  // potential leak if anp_audio_start is never called, but
+  // we do not see that from flash.
+}
+
+void
+anp_audio_start(ANPAudioTrack* s)
+{
+  if (s == NULL || s->output_unit == NULL) {
+    return;
+  }
+  
+  if (s->keepGoing) {
+    // we are already playing.  Ignore.
+    LOG("anp_audio_start called twice!");
+    return;
+  }
+
+  JNIEnv *jenv = GetJNIForThread();
+  jenv->CallVoidMethod(s->output_unit, at.play);
+
+  s->isStopped = false;
+  s->keepGoing = true;
+
+  // AudioRunnable now owns the ANPAudioTrack
+  nsRefPtr<AudioRunnable> runnable = new AudioRunnable(s);
+
+  nsCOMPtr<nsIThread> thread;
+  NS_NewThread(getter_AddRefs(thread), runnable);
+}
+
+void
+anp_audio_pause(ANPAudioTrack* s)
+{
+  if (s == NULL || s->output_unit == NULL) {
+    return;
+  }
+
+  JNIEnv *jenv = GetJNIForThread();
+  jenv->CallVoidMethod(s->output_unit, at.pause);
+}
+
+void
+anp_audio_stop(ANPAudioTrack* s)
+{
+  if (s == NULL || s->output_unit == NULL) {
+    return;
+  }
+
+  s->isStopped = true;
+  JNIEnv *jenv = GetJNIForThread();
+  jenv->CallVoidMethod(s->output_unit, at.stop);
+}
+
+bool
+anp_audio_isStopped(ANPAudioTrack* s)
+{
+  return s->isStopped;
+}
+
+void InitAudioTrackInterface(ANPAudioTrackInterfaceV0 *i) {
+  _assert(i->inSize == sizeof(*i));
+  ASSIGN(i, newTrack);
+  ASSIGN(i, deleteTrack);
+  ASSIGN(i, start);
+  ASSIGN(i, pause);
+  ASSIGN(i, stop);
+  ASSIGN(i, isStopped);
+}
diff --git a/dom/plugins/base/android/ANPBase.h b/dom/plugins/base/android/ANPBase.h
new file mode 100644
index 000000000000..5fcbf596ca1f
--- /dev/null
+++ b/dom/plugins/base/android/ANPBase.h
@@ -0,0 +1,52 @@
+#include "android_npapi.h"
+#include <stdlib.h>
+#include "nsAutoPtr.h"
+#include "gfxFont.h"
+
+#define NOT_IMPLEMENTED_FATAL() do {                                    \
+    __android_log_print(ANDROID_LOG_ERROR, "GeckoPlugins",              \
+                        "%s not implemented %s, %d",                    \
+                        __PRETTY_FUNCTION__, __FILE__, __LINE__);       \
+    abort();                                                            \
+  } while(0)
+
+#define NOT_IMPLEMENTED()                                               \
+    __android_log_print(ANDROID_LOG_ERROR, "GeckoPlugins",              \
+                        "!!!!!!!!!!!!!!  %s not implemented %s, %d",    \
+                        __PRETTY_FUNCTION__, __FILE__, __LINE__);       \
+
+class gfxFont;
+
+void InitAudioTrackInterface(ANPAudioTrackInterfaceV0 *i);
+void InitBitmapInterface(ANPBitmapInterfaceV0 *i);
+void InitCanvasInterface(ANPCanvasInterfaceV0 *i);
+void InitEventInterface(ANPEventInterfaceV0 *i);
+void InitLogInterface(ANPLogInterfaceV0 *i);
+void InitMatrixInterface(ANPMatrixInterfaceV0 *i);
+void InitPaintInterface(ANPPaintInterfaceV0 *i);
+void InitPathInterface(ANPPathInterfaceV0 *i);
+void InitSurfaceInterface(ANPSurfaceInterfaceV0 *i);
+void InitSystemInterface(ANPSystemInterfaceV0 *i);
+void InitTypeFaceInterface(ANPTypefaceInterfaceV0 *i);
+void InitWindowInterface(ANPWindowInterfaceV0 *i);
+
+struct ANPTypeface {
+  nsRefPtr<gfxFont> mFont;
+};
+
+
+typedef struct {
+  ANPMatrixFlag flags;
+  ANPColor color;
+  ANPPaintStyle style;
+  float strokeWidth;
+  float strokeMiter;
+  ANPPaintCap paintCap;
+  ANPPaintJoin paintJoin;
+  ANPTextEncoding textEncoding;
+  ANPPaintAlign paintAlign;
+  float textSize;
+  float textScaleX;
+  float textSkewX;
+  ANPTypeface typeface;
+} ANPPaintPrivate;
diff --git a/dom/plugins/base/android/ANPBitmap.cpp b/dom/plugins/base/android/ANPBitmap.cpp
new file mode 100644
index 000000000000..f06143dfc53f
--- /dev/null
+++ b/dom/plugins/base/android/ANPBitmap.cpp
@@ -0,0 +1,80 @@
+#include "assert.h"
+#include "ANPBase.h"
+#include <android/log.h>
+
+#define LOG(args...)  __android_log_print(ANDROID_LOG_INFO, "GeckoPlugins" , ## args)
+#define ASSIGN(obj, name)   (obj)->name = anp_bitmap_##name
+
+
+#define SK_A32_BITS     8
+#define SK_R32_BITS     8
+#define SK_G32_BITS     8
+#define SK_B32_BITS     8
+
+#ifdef IS_BIG_ENDIAN
+#define SK_R32_SHIFT    24
+#define SK_G32_SHIFT    16
+#define SK_B32_SHIFT    8
+#define SK_A32_SHIFT    0
+#else
+#define SK_R32_SHIFT    0
+#define SK_G32_SHIFT    8
+#define SK_B32_SHIFT    16
+#define SK_A32_SHIFT    24
+#endif
+
+#define SK_A32_MASK     ((1 << SK_A32_BITS) - 1)
+#define SK_R32_MASK     ((1 << SK_R32_BITS) - 1)
+#define SK_G32_MASK     ((1 << SK_G32_BITS) - 1)
+#define SK_B32_MASK     ((1 << SK_B32_BITS) - 1)
+
+#define SK_R16_BITS     5
+#define SK_G16_BITS     6
+#define SK_B16_BITS     5
+
+#define SK_R16_SHIFT    (SK_B16_BITS + SK_G16_BITS)
+#define SK_G16_SHIFT    (SK_B16_BITS)
+#define SK_B16_SHIFT    0
+
+#define SK_R16_MASK     ((1 << SK_R16_BITS) - 1)
+#define SK_G16_MASK     ((1 << SK_G16_BITS) - 1)
+#define SK_B16_MASK     ((1 << SK_B16_BITS) - 1)
+
+bool
+anp_bitmap_getPixelPacking(ANPBitmapFormat fmt, ANPPixelPacking* packing) {
+  LOG("%s", __PRETTY_FUNCTION__);
+  switch (fmt) {
+    case kRGBA_8888_ANPBitmapFormat:
+      if (packing) {
+        packing->AShift = SK_A32_SHIFT;
+        packing->ABits  = SK_A32_BITS;
+        packing->RShift = SK_R32_SHIFT;
+        packing->RBits  = SK_R32_BITS;
+        packing->GShift = SK_G32_SHIFT;
+        packing->GBits  = SK_G32_BITS;
+        packing->BShift = SK_B32_SHIFT;
+        packing->BBits  = SK_B32_BITS;
+      }
+      return true;
+    case kRGB_565_ANPBitmapFormat:
+      if (packing) {
+        packing->AShift = 0;
+        packing->ABits  = 0;
+        packing->RShift = SK_R16_SHIFT;
+        packing->RBits  = SK_R16_BITS;
+        packing->GShift = SK_G16_SHIFT;
+        packing->GBits  = SK_G16_BITS;
+        packing->BShift = SK_B16_SHIFT;
+        packing->BBits  = SK_B16_BITS;
+      }
+      return true;
+  default:
+    break;
+  }
+  return false;
+}
+
+void InitBitmapInterface(ANPBitmapInterfaceV0 *i) {
+  _assert(i->inSize == sizeof(*i));
+  ASSIGN(i, getPixelPacking);
+}
diff --git a/dom/plugins/base/android/ANPCanvas.cpp b/dom/plugins/base/android/ANPCanvas.cpp
new file mode 100644
index 000000000000..fafac968685d
--- /dev/null
+++ b/dom/plugins/base/android/ANPCanvas.cpp
@@ -0,0 +1,335 @@
+#include "assert.h"
+#include "ANPBase.h"
+#include <android/log.h>
+
+#include "cairo.h"
+#include "gfxPlatform.h"
+#include "gfxASurface.h"
+#include "gfxImageSurface.h"
+#include "gfxUtils.h"
+#include "gfxContext.h"
+
+#define LOG(args...)  __android_log_print(ANDROID_LOG_INFO, "GeckoPlugins" , ## args)
+#define ASSIGN(obj, name)   (obj)->name = anp_canvas_##name
+
+
+ANPCanvas*
+anp_canvas_newCanvas(const ANPBitmap* bitmap)
+{
+  PRUint32 stride;
+  gfxASurface::gfxImageFormat  format;
+
+  if (bitmap->format == ANPBitmapFormats::kRGBA_8888_ANPBitmapFormat) {
+    stride = bitmap->width * 4;
+    format = gfxImageSurface::ImageFormatARGB32;
+  }
+  else if (bitmap->format == ANPBitmapFormats::kRGB_565_ANPBitmapFormat) {
+    stride = bitmap->width * 2;
+    format = gfxImageSurface::ImageFormatRGB16_565;
+  }
+  else {
+    LOG("%s -- Unknown format", __PRETTY_FUNCTION__);
+    return nsnull;
+  }
+
+  gfxImageSurface* pluginSurface = new gfxImageSurface(static_cast<unsigned char*>(bitmap->baseAddr),
+                                                       gfxIntSize(bitmap->width,  bitmap->height), 
+                                                       stride,
+                                                       format);
+  if (pluginSurface->CairoStatus()) {
+    LOG("%s -- %d x %d FAILED to create gfxImageSurface", __PRETTY_FUNCTION__, bitmap->width, bitmap->height);
+    return nsnull;
+  }
+
+  gfxContext *pluginContext = new gfxContext(pluginSurface);
+  NS_ADDREF(pluginContext);
+  return (ANPCanvas*) pluginContext;
+}
+
+void
+anp_canvas_deleteCanvas(ANPCanvas* canvas)
+{
+  if (!canvas)
+    return;
+  gfxContext *ctx = (gfxContext*)canvas;
+  NS_RELEASE( ctx );
+}
+
+void
+anp_canvas_save(ANPCanvas* canvas)
+{
+  if (!canvas)
+    return;
+
+  gfxContext* ctx = (gfxContext*)canvas;
+  ctx->Save();
+}
+
+void
+anp_canvas_restore(ANPCanvas* canvas)
+{
+  if (!canvas)
+    return;
+
+  gfxContext* ctx = (gfxContext*)canvas;
+  ctx->Restore();
+}
+
+void
+anp_canvas_translate(ANPCanvas* canvas, float tx, float ty)
+{
+  if (!canvas)
+    return;
+
+  gfxContext* ctx = (gfxContext*)canvas;
+  ctx->Translate(gfxPoint(tx,ty));
+}
+
+void
+anp_canvas_scale(ANPCanvas* canvas, float sx, float sy)
+{
+  if (!canvas)
+    return;
+
+  gfxContext* ctx = (gfxContext*)canvas;
+  ctx->Scale(sx, sy);
+}
+
+void
+anp_canvas_rotate(ANPCanvas* canvas, float degrees)
+{
+  if (!canvas)
+    return;
+
+  gfxContext* ctx = (gfxContext*)canvas;
+  ctx->Rotate(degrees);
+}
+
+void
+anp_canvas_skew(ANPCanvas* canvas, float kx, float ky)
+{
+  if (!canvas)
+    return;
+
+  gfxContext* ctx = (gfxContext*)canvas;
+  LOG("%s is not impl.", __PRETTY_FUNCTION__);
+}
+
+void
+anp_canvas_concat(ANPCanvas* canvas, const ANPMatrix*)
+{
+  if (!canvas)
+    return;
+
+  gfxContext* ctx = (gfxContext*)canvas;
+  LOG("%s is not impl.", __PRETTY_FUNCTION__);
+}
+
+void
+anp_canvas_clipRect(ANPCanvas* canvas, const ANPRectF* r)
+{
+  if (!canvas)
+    return;
+
+  gfxContext* ctx = (gfxContext*)canvas;
+  ctx->Clip(gfxRect(r->left,
+                    r->top,
+                    r->right - r->left,
+                    r->bottom - r->top));
+}
+
+void
+anp_canvas_clipPath(ANPCanvas* canvas, const ANPPath*)
+{
+  if (!canvas)
+    return;
+
+  gfxContext* ctx = (gfxContext*)canvas;
+  LOG("%s is not impl.", __PRETTY_FUNCTION__);
+}
+
+void
+anp_canvas_getTotalMatrix(ANPCanvas* canvas, ANPMatrix*)
+{
+  if (!canvas)
+    return;
+
+  gfxContext* ctx = (gfxContext*)canvas;
+  LOG("%s is not impl.", __PRETTY_FUNCTION__);
+}
+
+bool
+anp_canvas_getLocalClipBounds(ANPCanvas* canvas, ANPRectF* bounds, bool aa)
+{
+  if (!canvas)
+    return false;
+
+  gfxContext* ctx = (gfxContext*)canvas;
+  LOG("%s is not impl.", __PRETTY_FUNCTION__);
+  return false;
+}
+
+bool
+anp_canvas_getDeviceClipBounds(ANPCanvas* canvas, ANPRectI* bounds)
+{
+  if (!canvas)
+    return false;
+
+  gfxContext* ctx = (gfxContext*)canvas;
+  LOG("%s is not impl.", __PRETTY_FUNCTION__);
+  return false;
+}
+
+void
+anp_canvas_drawColor(ANPCanvas* canvas, ANPColor c)
+{
+  if (!canvas)
+    return;
+
+  gfxContext* ctx = (gfxContext*)canvas;
+  ctx->SetDeviceColor(gfxRGBA(c, gfxRGBA::PACKED_ARGB));
+  LOG("returning from %s", __PRETTY_FUNCTION__);
+}
+
+void
+anp_canvas_drawPaint(ANPCanvas* canvas, const ANPPaint* paint)
+{
+  if (!canvas)
+    return;
+
+  gfxContext* ctx = (gfxContext*)canvas;
+  LOG("%s", "                    **************   NOT IMPLEMENTED!!!");
+}
+
+void
+anp_canvas_drawLine(ANPCanvas* canvas, float x0, float y0, float x1, float y1,
+                    const ANPPaint* paint)
+{
+  if (!canvas)
+    return;
+
+  gfxContext* ctx = (gfxContext*)canvas;
+  ctx->NewPath();
+  ctx->SetColor(((ANPPaintPrivate*)paint)->color);
+  ctx->Line(gfxPoint(x0, y0), gfxPoint(x1, y1));
+  ctx->Fill();
+}
+
+void
+anp_canvas_drawRect(ANPCanvas* canvas, const ANPRectF* r, const ANPPaint* paint)
+{
+  if (!canvas)
+    return;
+
+  gfxContext* ctx = (gfxContext*)canvas;
+
+  ctx->NewPath();
+  ctx->SetColor(((ANPPaintPrivate*)paint)->color);
+  ctx->Rectangle(gfxRect(r->left,
+                         r->top,
+                         r->right - r->left,
+                         r->bottom - r->top));
+  ctx->Fill();
+}
+
+void
+anp_canvas_drawOval(ANPCanvas* canvas, const ANPRectF* r, const ANPPaint* paint)
+{
+  if (!canvas)
+    return;
+
+  gfxContext* ctx = (gfxContext*)canvas;
+   
+  ctx->NewPath();
+  ctx->SetColor(((ANPPaintPrivate*)paint)->color);
+
+  float sizeX = (r->right   - r->left);
+  float sizeY = (r->bottom  - r->top);
+
+  ctx->Ellipse(gfxPoint(r->left + ( sizeX / 2), r->top  + ( sizeY  / 2)),
+               gfxSize(sizeX, sizeY));
+  ctx->Fill();
+}
+
+void
+anp_canvas_drawPath(ANPCanvas* canvas, const ANPPath*, const ANPPaint* paint)
+{
+  if (!canvas)
+    return;
+
+  gfxContext* ctx = (gfxContext*)canvas;
+  LOG("%s is not impl.", __PRETTY_FUNCTION__);
+}
+
+void
+anp_canvas_drawText(ANPCanvas* canvas, const void* text, uint32_t byteLength,
+                                float x, float y, const ANPPaint* paint)
+{
+  if (!canvas)
+    return;
+
+  gfxContext* ctx = (gfxContext*)canvas;
+  LOG("%s is not impl.", __PRETTY_FUNCTION__);
+}
+
+void
+anp_canvas_drawPosText(ANPCanvas* canvas, const void* text, uint32_t byteLength,
+                       const float xy[], const ANPPaint* paint)
+{
+  if (!canvas)
+    return;
+
+  gfxContext* ctx = (gfxContext*)canvas;
+  LOG("%s is not impl.", __PRETTY_FUNCTION__);
+}
+
+void
+anp_canvas_drawBitmap(ANPCanvas* canvas, const ANPBitmap*, float x, float y,
+                      const ANPPaint* paint)
+{
+  if (!canvas)
+    return;
+
+  gfxContext* ctx = (gfxContext*)canvas;
+  LOG("%s is not impl.", __PRETTY_FUNCTION__);
+}
+
+void
+anp_canvas_drawBitmapRect(ANPCanvas* canvas, const ANPBitmap*,
+                          const ANPRectI* src, const ANPRectF* dst,
+                          const ANPPaint* paint)
+{
+  if (!canvas)
+    return;
+
+  gfxContext* ctx = (gfxContext*)canvas;
+  LOG("%s is not impl.", __PRETTY_FUNCTION__);
+}
+
+void InitCanvasInterface(ANPCanvasInterfaceV0 *i) {
+  _assert(i->inSize == sizeof(*i));
+  ASSIGN(i, newCanvas);
+  ASSIGN(i, deleteCanvas);
+  ASSIGN(i, save);
+  ASSIGN(i, restore);
+  ASSIGN(i, translate);
+  ASSIGN(i, scale);
+  ASSIGN(i, rotate);
+  ASSIGN(i, skew);
+  ASSIGN(i, concat);
+  ASSIGN(i, clipRect);
+  ASSIGN(i, clipPath);
+  ASSIGN(i, getTotalMatrix);
+  ASSIGN(i, getLocalClipBounds);
+  ASSIGN(i, getDeviceClipBounds);
+  ASSIGN(i, drawColor);
+  ASSIGN(i, drawPaint);
+  ASSIGN(i, drawLine);
+  ASSIGN(i, drawRect);
+  ASSIGN(i, drawOval);
+  ASSIGN(i, drawPath);
+  ASSIGN(i, drawText);
+  ASSIGN(i, drawPosText);
+  ASSIGN(i, drawBitmap);
+  ASSIGN(i, drawBitmapRect);
+}
diff --git a/dom/plugins/base/android/ANPEvent.cpp b/dom/plugins/base/android/ANPEvent.cpp
new file mode 100644
index 000000000000..05ff0c946740
--- /dev/null
+++ b/dom/plugins/base/android/ANPEvent.cpp
@@ -0,0 +1,46 @@
+#include "assert.h"
+#include "ANPBase.h"
+#include <android/log.h>
+#include "nsThreadUtils.h"
+#include "nsNPAPIPluginInstance.h"
+#include "AndroidBridge.h"
+#include "nsNPAPIPlugin.h"
+
+#define LOG(args...)  __android_log_print(ANDROID_LOG_INFO, "GeckoPlugins" , ## args)
+#define ASSIGN(obj, name)   (obj)->name = anp_event_##name
+
+class PluginEventRunnable : public nsRunnable
+{
+public:
+  PluginEventRunnable(NPP inst, ANPEvent* event, NPPluginFuncs* aFuncs)
+    : mInstance(inst), mEvent(*event), mFuncs(aFuncs) {}
+  virtual nsresult Run() {
+    (*mFuncs->event)(mInstance, &mEvent);
+    return NS_OK;
+  }
+private:
+  NPP mInstance;
+  ANPEvent mEvent;
+  NPPluginFuncs* mFuncs;
+};
+
+void
+anp_event_postEvent(NPP inst, const ANPEvent* event)
+{
+  LOG("%s", __PRETTY_FUNCTION__);
+  if (!mozilla::AndroidBridge::Bridge()) {
+    LOG("no bridge in %s!!!!", __PRETTY_FUNCTION__);
+    return;
+  }
+  nsNPAPIPluginInstance* pinst = static_cast<nsNPAPIPluginInstance*>(inst->ndata);
+  NPPluginFuncs* pluginFunctions = pinst->GetPlugin()->PluginFuncs();
+  mozilla::AndroidBridge::Bridge()->PostToJavaThread(
+    new PluginEventRunnable(inst, const_cast<ANPEvent*>(event), pluginFunctions), PR_TRUE);
+  LOG("returning from %s", __PRETTY_FUNCTION__);
+}
+
+
+void InitEventInterface(ANPEventInterfaceV0 *i) {
+  _assert(i->inSize == sizeof(*i));
+  ASSIGN(i, postEvent);
+}
diff --git a/dom/plugins/base/android/ANPKeyCodes.h b/dom/plugins/base/android/ANPKeyCodes.h
new file mode 100644
index 000000000000..edfe2b95cdba
--- /dev/null
+++ b/dom/plugins/base/android/ANPKeyCodes.h
@@ -0,0 +1,152 @@
+/*
+ * Copyright 2008, The Android Open Source Project
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *  * Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ *  * Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE COPYRIGHT OWNER OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef ANPKeyCodes_DEFINED
+#define ANPKeyCodes_DEFINED
+
+/*  List the key codes that are set to a plugin in the ANPKeyEvent.
+ 
+    These exactly match the values in android/view/KeyEvent.java and the
+    corresponding .h file android/keycodes.h.
+*/
+enum ANPKeyCodes {
+    kUnknown_ANPKeyCode = 0,
+
+    kSoftLeft_ANPKeyCode = 1,
+    kSoftRight_ANPKeyCode = 2,
+    kHome_ANPKeyCode = 3,
+    kBack_ANPKeyCode = 4,
+    kCall_ANPKeyCode = 5,
+    kEndCall_ANPKeyCode = 6,
+    k0_ANPKeyCode = 7,
+    k1_ANPKeyCode = 8,
+    k2_ANPKeyCode = 9,
+    k3_ANPKeyCode = 10,
+    k4_ANPKeyCode = 11,
+    k5_ANPKeyCode = 12,
+    k6_ANPKeyCode = 13,
+    k7_ANPKeyCode = 14,
+    k8_ANPKeyCode = 15,
+    k9_ANPKeyCode = 16,
+    kStar_ANPKeyCode = 17,
+    kPound_ANPKeyCode = 18,
+    kDpadUp_ANPKeyCode = 19,
+    kDpadDown_ANPKeyCode = 20,
+    kDpadLeft_ANPKeyCode = 21,
+    kDpadRight_ANPKeyCode = 22,
+    kDpadCenter_ANPKeyCode = 23,
+    kVolumeUp_ANPKeyCode = 24,
+    kVolumeDown_ANPKeyCode = 25,
+    kPower_ANPKeyCode = 26,
+    kCamera_ANPKeyCode = 27,
+    kClear_ANPKeyCode = 28,
+    kA_ANPKeyCode = 29,
+    kB_ANPKeyCode = 30,
+    kC_ANPKeyCode = 31,
+    kD_ANPKeyCode = 32,
+    kE_ANPKeyCode = 33,
+    kF_ANPKeyCode = 34,
+    kG_ANPKeyCode = 35,
+    kH_ANPKeyCode = 36,
+    kI_ANPKeyCode = 37,
+    kJ_ANPKeyCode = 38,
+    kK_ANPKeyCode = 39,
+    kL_ANPKeyCode = 40,
+    kM_ANPKeyCode = 41,
+    kN_ANPKeyCode = 42,
+    kO_ANPKeyCode = 43,
+    kP_ANPKeyCode = 44,
+    kQ_ANPKeyCode = 45,
+    kR_ANPKeyCode = 46,
+    kS_ANPKeyCode = 47,
+    kT_ANPKeyCode = 48,
+    kU_ANPKeyCode = 49,
+    kV_ANPKeyCode = 50,
+    kW_ANPKeyCode = 51,
+    kX_ANPKeyCode = 52,
+    kY_ANPKeyCode = 53,
+    kZ_ANPKeyCode = 54,
+    kComma_ANPKeyCode = 55,
+    kPeriod_ANPKeyCode = 56,
+    kAltLeft_ANPKeyCode = 57,
+    kAltRight_ANPKeyCode = 58,
+    kShiftLeft_ANPKeyCode = 59,
+    kShiftRight_ANPKeyCode = 60,
+    kTab_ANPKeyCode = 61,
+    kSpace_ANPKeyCode = 62,
+    kSym_ANPKeyCode = 63,
+    kExplorer_ANPKeyCode = 64,
+    kEnvelope_ANPKeyCode = 65,
+    kNewline_ANPKeyCode = 66,
+    kDel_ANPKeyCode = 67,
+    kGrave_ANPKeyCode = 68,
+    kMinus_ANPKeyCode = 69,
+    kEquals_ANPKeyCode = 70,
+    kLeftBracket_ANPKeyCode = 71,
+    kRightBracket_ANPKeyCode = 72,
+    kBackslash_ANPKeyCode = 73,
+    kSemicolon_ANPKeyCode = 74,
+    kApostrophe_ANPKeyCode = 75,
+    kSlash_ANPKeyCode = 76,
+    kAt_ANPKeyCode = 77,
+    kNum_ANPKeyCode = 78,
+    kHeadSetHook_ANPKeyCode = 79,
+    kFocus_ANPKeyCode = 80,
+    kPlus_ANPKeyCode = 81,
+    kMenu_ANPKeyCode = 82,
+    kNotification_ANPKeyCode = 83,
+    kSearch_ANPKeyCode = 84,
+    kMediaPlayPause_ANPKeyCode = 85,
+    kMediaStop_ANPKeyCode = 86,
+    kMediaNext_ANPKeyCode = 87,
+    kMediaPrevious_ANPKeyCode = 88,
+    kMediaRewind_ANPKeyCode = 89,
+    kMediaFastForward_ANPKeyCode = 90,
+    kMute_ANPKeyCode = 91,
+    kPageUp_ANPKeyCode = 92,
+    kPageDown_ANPKeyCode = 93,
+    kPictsymbols_ANPKeyCode = 94,
+    kSwitchCharset_ANPKeyCode = 95,
+    kButtonA_ANPKeyCode = 96,
+    kButtonB_ANPKeyCode = 97,
+    kButtonC_ANPKeyCode = 98,
+    kButtonX_ANPKeyCode = 99,
+    kButtonY_ANPKeyCode = 100,
+    kButtonZ_ANPKeyCode = 101,
+    kButtonL1_ANPKeyCode = 102,
+    kButtonR1_ANPKeyCode = 103,
+    kButtonL2_ANPKeyCode = 104,
+    kButtonR2_ANPKeyCode = 105,
+    kButtonThumbL_ANPKeyCode = 106,
+    kButtonThumbR_ANPKeyCode = 107,
+    kButtonStart_ANPKeyCode = 108,
+    kButtonSelect_ANPKeyCode = 109,
+    kButtonMode_ANPKeyCode = 110,
+
+    // NOTE: If you add a new keycode here you must also add it to several other files.
+    //       Refer to frameworks/base/core/java/android/view/KeyEvent.java for the full list.
+};
+
+#endif
diff --git a/dom/plugins/base/android/ANPLog.cpp b/dom/plugins/base/android/ANPLog.cpp
new file mode 100644
index 000000000000..8ae222d7e5a2
--- /dev/null
+++ b/dom/plugins/base/android/ANPLog.cpp
@@ -0,0 +1,21 @@
+#include "assert.h"
+#include "ANPBase.h"
+#include <android/log.h>
+
+#define LOG(args...)  __android_log_print(ANDROID_LOG_INFO, "GeckoPlugins" , ## args)
+#define ASSIGN(obj, name)   (obj)->name = anp_log_##name
+
+void
+anp_log_log(ANPLogType type, const char format[], ...) {
+
+  va_list argp;
+  va_start(argp,format);
+  __android_log_vprint(type == kError_ANPLogType ? ANDROID_LOG_ERROR : type == kWarning_ANPLogType ?
+                       ANDROID_LOG_WARN : ANDROID_LOG_INFO, "GeckoPluginLog", format, argp);
+  va_end(argp);
+}
+
+void InitLogInterface(ANPLogInterfaceV0 *i) {
+      _assert(i->inSize == sizeof(*i));
+      ASSIGN(i, log);
+}
diff --git a/dom/plugins/base/android/ANPMatrix.cpp b/dom/plugins/base/android/ANPMatrix.cpp
new file mode 100644
index 000000000000..f278911dea36
--- /dev/null
+++ b/dom/plugins/base/android/ANPMatrix.cpp
@@ -0,0 +1,159 @@
+#include "assert.h"
+#include "ANPBase.h"
+#include <android/log.h>
+
+#define LOG(args...)  __android_log_print(ANDROID_LOG_INFO, "GeckoPlugins" , ## args)
+#define ASSIGN(obj, name)   (obj)->name = anp_matrix_##name
+
+/** Return a new identity matrix
+ */
+ANPMatrix*
+anp_matrix_newMatrix()
+{
+  NOT_IMPLEMENTED();
+  return 0;
+}
+
+/** Delete a matrix previously allocated by newMatrix()
+ */
+void
+anp_matrix_deleteMatrix(ANPMatrix*)
+{
+  NOT_IMPLEMENTED();
+}
+
+
+ANPMatrixFlag
+anp_matrix_getFlags(const ANPMatrix*)
+{
+  NOT_IMPLEMENTED();
+  return 0;
+}
+
+
+void
+anp_matrix_copy(ANPMatrix* dst, const ANPMatrix* src)
+{
+  NOT_IMPLEMENTED();
+}
+
+
+void
+anp_matrix_get3x3(const ANPMatrix*, float[9])
+{
+  NOT_IMPLEMENTED();
+}
+
+void
+anp_matrix_set3x3(ANPMatrix*, const float[9])
+{
+  NOT_IMPLEMENTED();
+}
+
+
+void
+anp_matrix_setIdentity(ANPMatrix*)
+{
+  NOT_IMPLEMENTED();
+}
+
+void
+anp_matrix_preTranslate(ANPMatrix*, float tx, float ty)
+{
+  NOT_IMPLEMENTED();
+}
+
+void
+anp_matrix_postTranslate(ANPMatrix*, float tx, float ty)
+{
+  NOT_IMPLEMENTED();
+}
+
+void
+anp_matrix_preScale(ANPMatrix*, float sx, float sy)
+{
+  NOT_IMPLEMENTED();
+}
+
+void
+anp_matrix_postScale(ANPMatrix*, float sx, float sy)
+{
+  NOT_IMPLEMENTED();
+}
+
+void
+anp_matrix_preSkew(ANPMatrix*, float kx, float ky)
+{
+  NOT_IMPLEMENTED();
+}
+
+void
+anp_matrix_postSkew(ANPMatrix*, float kx, float ky)
+{
+  NOT_IMPLEMENTED();
+}
+
+void
+anp_matrix_preRotate(ANPMatrix*, float degrees)
+{
+  NOT_IMPLEMENTED();
+}
+
+void
+anp_matrix_postRotate(ANPMatrix*, float degrees)
+{
+  NOT_IMPLEMENTED();
+}
+
+void
+anp_matrix_preConcat(ANPMatrix*, const ANPMatrix*)
+{
+  NOT_IMPLEMENTED();
+}
+
+void
+anp_matrix_postConcat(ANPMatrix*, const ANPMatrix*)
+{
+  NOT_IMPLEMENTED();
+}
+
+
+bool
+anp_matrix_invert(ANPMatrix* dst, const ANPMatrix* src)
+{
+  NOT_IMPLEMENTED();
+  return false;
+}
+
+void
+anp_matrix_mapPoints(ANPMatrix*, float dst[], const float src[],
+                                 int32_t count)
+{
+  NOT_IMPLEMENTED();
+}
+
+
+void InitMatrixInterface(ANPMatrixInterfaceV0 *i) {
+  _assert(i->inSize == sizeof(*i));
+  ASSIGN(i, newMatrix);
+  ASSIGN(i, deleteMatrix);
+  ASSIGN(i, getFlags);
+  ASSIGN(i, copy);
+  ASSIGN(i, get3x3);
+  ASSIGN(i, set3x3);
+  ASSIGN(i, setIdentity);
+  ASSIGN(i, preTranslate);
+  ASSIGN(i, postTranslate);
+  ASSIGN(i, preScale);
+  ASSIGN(i, postScale);
+  ASSIGN(i, preSkew);
+  ASSIGN(i, postSkew);
+  ASSIGN(i, preRotate);
+  ASSIGN(i, postRotate);
+  ASSIGN(i, preConcat);
+  ASSIGN(i, postConcat);
+  ASSIGN(i, invert);
+  ASSIGN(i, mapPoints);
+}
+
+
diff --git a/dom/plugins/base/android/ANPPaint.cpp b/dom/plugins/base/android/ANPPaint.cpp
new file mode 100644
index 000000000000..30e4f9ffe90b
--- /dev/null
+++ b/dom/plugins/base/android/ANPPaint.cpp
@@ -0,0 +1,416 @@
+#include <stdlib.h>
+#include <assert.h>
+#include <android/log.h>
+#include "ANPBase.h"
+
+#define LOG(args...)  
+//__android_log_print(ANDROID_LOG_INFO, "GeckoPlugins" , ## args)
+#define ASSIGN(obj, name)   (obj)->name = anp_paint_##name
+
+ANPPaint*
+anp_paint_newPaint()
+{
+  LOG("%s", __PRETTY_FUNCTION__);
+
+  ANPPaintPrivate* p = (ANPPaintPrivate*) calloc(1, sizeof(ANPPaintPrivate));
+  return (ANPPaint*) p;
+}
+
+void
+anp_paint_deletePaint(ANPPaint* paint)
+{
+  LOG("%s", __PRETTY_FUNCTION__);
+  if (!paint)
+    return;
+
+  ANPPaintPrivate* p = (ANPPaintPrivate*) paint;
+  free((void*)p);
+}
+
+
+ANPPaintFlags
+anp_paint_getFlags(const ANPPaint* paint)
+{
+  LOG("%s", __PRETTY_FUNCTION__);
+  if (!paint)
+    return kAntiAlias_ANPPaintFlag;
+
+  ANPPaintPrivate* p = (ANPPaintPrivate*) paint;
+  return p->flags;
+}
+
+void
+anp_paint_setFlags(ANPPaint* paint, ANPPaintFlags flags)
+{
+  LOG("%s", __PRETTY_FUNCTION__);
+  if (!paint)
+    return;
+
+  ANPPaintPrivate* p = (ANPPaintPrivate*) paint;  
+  p->flags = flags;
+}
+
+
+ANPColor
+anp_paint_getColor(const ANPPaint* paint)
+{
+  LOG("%s", __PRETTY_FUNCTION__);
+  if (!paint)
+    return ANP_MAKE_COLOR(1, 255, 255, 255);
+
+  ANPPaintPrivate* p = (ANPPaintPrivate*) paint;
+  return p->color;
+}
+
+void
+anp_paint_setColor(ANPPaint* paint, ANPColor color)
+{
+  LOG("%s", __PRETTY_FUNCTION__);
+  if (!paint)
+    return;
+
+  ANPPaintPrivate* p = (ANPPaintPrivate*) paint;
+  p->color = color;
+}
+
+
+ANPPaintStyle
+anp_paint_getStyle(const ANPPaint* paint)
+{
+  LOG("%s", __PRETTY_FUNCTION__);
+  if (!paint)
+    return kFill_ANPPaintStyle;
+
+  ANPPaintPrivate* p = (ANPPaintPrivate*) paint;
+  return p->style;
+}
+
+void
+anp_paint_setStyle(ANPPaint* paint, ANPPaintStyle style)
+{
+  LOG("%s", __PRETTY_FUNCTION__);
+  if (!paint)
+    return;
+
+  ANPPaintPrivate* p = (ANPPaintPrivate*) paint;
+  p->style = style;
+}
+
+float
+anp_paint_getStrokeWidth(const ANPPaint* paint)
+{
+  LOG("%s", __PRETTY_FUNCTION__);
+  if (!paint)
+    return 0;
+
+  ANPPaintPrivate* p = (ANPPaintPrivate*) paint;
+  return p->strokeWidth;
+}
+
+float
+anp_paint_getStrokeMiter(const ANPPaint* paint)
+{
+  LOG("%s", __PRETTY_FUNCTION__);
+  if (!paint)
+    return 0;
+
+  ANPPaintPrivate* p = (ANPPaintPrivate*) paint;
+  return p->strokeMiter;
+}
+
+ANPPaintCap
+anp_paint_getStrokeCap(const ANPPaint* paint)
+{
+  LOG("%s", __PRETTY_FUNCTION__);
+  if (!paint)
+    return kButt_ANPPaintCap;
+
+  ANPPaintPrivate* p = (ANPPaintPrivate*) paint;
+  return p->paintCap;
+}
+
+ANPPaintJoin
+anp_paint_getStrokeJoin(const ANPPaint* paint)
+{
+  LOG("%s", __PRETTY_FUNCTION__);
+  if (!paint)
+    return kMiter_ANPPaintJoin;
+
+  ANPPaintPrivate* p = (ANPPaintPrivate*) paint;
+  return p->paintJoin;
+}
+
+void
+anp_paint_setStrokeWidth(ANPPaint* paint, float width)
+{
+  LOG("%s", __PRETTY_FUNCTION__);
+  if (!paint)
+    return;
+
+  ANPPaintPrivate* p = (ANPPaintPrivate*) paint;
+  p->strokeWidth = width;
+}
+
+void
+anp_paint_setStrokeMiter(ANPPaint* paint, float miter)
+{
+  LOG("%s", __PRETTY_FUNCTION__);
+  if (!paint)
+    return;
+
+  ANPPaintPrivate* p = (ANPPaintPrivate*) paint;
+  p->strokeMiter = miter;
+}
+
+void
+anp_paint_setStrokeCap(ANPPaint* paint, ANPPaintCap cap)
+{
+  LOG("%s", __PRETTY_FUNCTION__);
+  if (!paint)
+    return;
+
+  ANPPaintPrivate* p = (ANPPaintPrivate*) paint;
+  p->paintCap = cap;
+}
+
+void
+anp_paint_setStrokeJoin(ANPPaint* paint, ANPPaintJoin join)
+{
+  LOG("%s", __PRETTY_FUNCTION__);
+  if (!paint)
+    return;
+
+  ANPPaintPrivate* p = (ANPPaintPrivate*) paint;
+  p->paintJoin = join;
+}
+
+
+ANPTextEncoding
+anp_paint_getTextEncoding(const ANPPaint* paint)
+{
+  LOG("%s", __PRETTY_FUNCTION__);
+  if (!paint)
+    return kUTF8_ANPTextEncoding;
+
+  ANPPaintPrivate* p = (ANPPaintPrivate*) paint;
+  return p->textEncoding;
+}
+
+ANPPaintAlign
+anp_paint_getTextAlign(const ANPPaint* paint)
+{
+  LOG("%s", __PRETTY_FUNCTION__);
+  if (!paint)
+    return kLeft_ANPPaintAlign;
+
+  ANPPaintPrivate* p = (ANPPaintPrivate*) paint;
+  return p->paintAlign;
+}
+
+float
+anp_paint_getTextSize(const ANPPaint* paint)
+{
+  LOG("%s", __PRETTY_FUNCTION__);
+  if (!paint)
+    return 0;
+
+  ANPPaintPrivate* p = (ANPPaintPrivate*) paint;
+  return p->textSize;
+}
+
+float
+anp_paint_getTextScaleX(const ANPPaint* paint)
+{
+  LOG("%s", __PRETTY_FUNCTION__);
+  if (!paint)
+    return 0;
+
+  ANPPaintPrivate* p = (ANPPaintPrivate*) paint;
+  return p->textScaleX;
+}
+
+float
+anp_paint_getTextSkewX(const ANPPaint* paint)
+{
+  LOG("%s", __PRETTY_FUNCTION__);
+  if (!paint)
+    return 0;
+
+  ANPPaintPrivate* p = (ANPPaintPrivate*) paint;
+  return p->textSkewX;
+}
+
+void
+anp_paint_setTextEncoding(ANPPaint* paint, ANPTextEncoding encoding)
+{
+  LOG("%s", __PRETTY_FUNCTION__);
+  if (!paint)
+    return;
+
+  ANPPaintPrivate* p = (ANPPaintPrivate*) paint;
+  p->textEncoding = encoding;
+}
+
+void
+anp_paint_setTextAlign(ANPPaint* paint, ANPPaintAlign align)
+{
+  LOG("%s", __PRETTY_FUNCTION__);
+  if (!paint)
+    return;
+
+  ANPPaintPrivate* p = (ANPPaintPrivate*) paint;
+  p->paintAlign = align;  
+}
+
+void
+anp_paint_setTextSize(ANPPaint* paint, float size)
+{
+  LOG("%s", __PRETTY_FUNCTION__);
+  if (!paint)
+    return;
+
+  ANPPaintPrivate* p = (ANPPaintPrivate*) paint;
+  p->textSize = size;
+}
+
+void
+anp_paint_setTextScaleX(ANPPaint* paint, float scale)
+{
+  LOG("%s", __PRETTY_FUNCTION__);
+  if (!paint)
+    return;
+
+  ANPPaintPrivate* p = (ANPPaintPrivate*) paint;
+  p->textScaleX = scale;
+}
+
+void
+anp_paint_setTextSkewX(ANPPaint* paint, float skew)
+{
+  LOG("%s", __PRETTY_FUNCTION__);
+  if (!paint)
+    return;
+
+  ANPPaintPrivate* p = (ANPPaintPrivate*) paint;
+  p->textSkewX = skew;
+}
+
+
+/** Return the typeface in paint, or null if there is none. This does not
+    modify the owner count of the returned typeface.
+*/
+ANPTypeface*
+anp_paint_getTypeface(const ANPPaint* paint)
+{
+  LOG("%s", __PRETTY_FUNCTION__);
+  if (!paint)
+    return NULL;
+
+  ANPPaintPrivate* p = (ANPPaintPrivate*) paint;
+  return &p->typeface;
+}
+
+
+/** Set the paint's typeface. If the paint already had a non-null typeface,
+    its owner count is decremented. If the new typeface is non-null, its
+    owner count is incremented.
+*/
+void
+anp_paint_setTypeface(ANPPaint* paint, ANPTypeface* typeface)
+{
+  LOG("%s", __PRETTY_FUNCTION__);
+  if (!paint)
+    return;
+
+  ANPPaintPrivate* p = (ANPPaintPrivate*) paint;
+  LOG("%s is not impl.", __PRETTY_FUNCTION__);
+}
+
+/** Return the width of the text. If bounds is not null, return the bounds
+    of the text in that rectangle.
+*/
+float
+anp_paint_measureText(ANPPaint* paint, const void* text, uint32_t byteLength,
+                      ANPRectF* bounds)
+{
+  LOG("%s", __PRETTY_FUNCTION__);
+  if (!paint)
+    return 0;
+
+  ANPPaintPrivate* p = (ANPPaintPrivate*) paint;
+
+  LOG("%s is not impl.", __PRETTY_FUNCTION__);
+  return 0;
+}
+
+
+/** Return the number of unichars specifed by the text.
+    If widths is not null, returns the array of advance widths for each
+    unichar.
+    If bounds is not null, returns the array of bounds for each unichar.
+*/
+int
+anp_paint_getTextWidths(ANPPaint* paint, const void* text, uint32_t byteLength,
+                        float widths[], ANPRectF bounds[])
+{
+  LOG("%s", __PRETTY_FUNCTION__);
+  if (!paint)
+    return 0;
+
+  ANPPaintPrivate* p = (ANPPaintPrivate*) paint;
+  LOG("%s is not impl.", __PRETTY_FUNCTION__);
+  return 0;
+}
+
+
+/** Return in metrics the spacing values for text, respecting the paint's
+    typeface and pointsize, and return the spacing between lines
+    (descent - ascent + leading). If metrics is NULL, it will be ignored.
+*/
+float
+anp_paint_getFontMetrics(ANPPaint* paint, ANPFontMetrics* metrics)
+{
+  LOG("%s", __PRETTY_FUNCTION__);
+  if (!paint)
+    return 0;
+
+  ANPPaintPrivate* p = (ANPPaintPrivate*) paint;
+  LOG("%s is not impl.", __PRETTY_FUNCTION__);
+  return 0;
+}
+
+
+void InitPaintInterface(ANPPaintInterfaceV0 *i) {
+  _assert(i->inSize == sizeof(*i));
+  ASSIGN(i, newPaint);
+  ASSIGN(i, deletePaint);
+  ASSIGN(i, getFlags);
+  ASSIGN(i, setFlags);
+  ASSIGN(i, getColor);
+  ASSIGN(i, setColor);
+  ASSIGN(i, getStyle);
+  ASSIGN(i, setStyle);
+  ASSIGN(i, getStrokeWidth);
+  ASSIGN(i, getStrokeMiter);
+  ASSIGN(i, getStrokeCap);
+  ASSIGN(i, getStrokeJoin);
+  ASSIGN(i, setStrokeWidth);
+  ASSIGN(i, setStrokeMiter);
+  ASSIGN(i, setStrokeCap);
+  ASSIGN(i, setStrokeJoin);
+  ASSIGN(i, getTextEncoding);
+  ASSIGN(i, getTextAlign);
+  ASSIGN(i, getTextSize);
+  ASSIGN(i, getTextScaleX);
+  ASSIGN(i, getTextSkewX);
+  ASSIGN(i, setTextEncoding);
+  ASSIGN(i, setTextAlign);
+  ASSIGN(i, setTextSize);
+  ASSIGN(i, setTextScaleX);
+  ASSIGN(i, setTextSkewX);
+  ASSIGN(i, getTypeface);
+  ASSIGN(i, setTypeface);
+  ASSIGN(i, measureText);
+  ASSIGN(i, getTextWidths);
+  ASSIGN(i, getFontMetrics);
+}
diff --git a/dom/plugins/base/android/ANPPath.cpp b/dom/plugins/base/android/ANPPath.cpp
new file mode 100644
index 000000000000..1ea17b2e97bb
--- /dev/null
+++ b/dom/plugins/base/android/ANPPath.cpp
@@ -0,0 +1,133 @@
+#include "assert.h"
+#include "ANPBase.h"
+#include <android/log.h>
+
+#define LOG(args...)  __android_log_print(ANDROID_LOG_INFO, "GeckoPlugins" , ## args)
+#define ASSIGN(obj, name)   (obj)->name = anp_path_##name
+
+
+// maybe this should store a list of actions (lineTo,
+// moveTo), and when canvas_drawPath() we apply all of these
+// actions to the gfxContext.
+
+ANPPath*
+anp_path_newPath()
+{
+  LOG("%s - NOT IMPL.", __PRETTY_FUNCTION__);
+  return 0;
+}
+
+
+void
+anp_path_deletePath(ANPPath* p)
+{
+  LOG("%s - NOT IMPL.", __PRETTY_FUNCTION__);
+}
+
+
+void
+anp_path_copy(ANPPath* dst, const ANPPath* src)
+{
+  LOG("%s - NOT IMPL.", __PRETTY_FUNCTION__);
+}
+
+
+bool
+anp_path_equal(const ANPPath* path0, const ANPPath* path1)
+{
+  LOG("%s - NOT IMPL.", __PRETTY_FUNCTION__);
+  return false;
+}
+
+
+void
+anp_path_reset(ANPPath* p)
+{
+  LOG("%s - NOT IMPL.", __PRETTY_FUNCTION__);
+}
+
+
+bool
+anp_path_isEmpty(const ANPPath* p)
+{
+  LOG("%s - NOT IMPL.", __PRETTY_FUNCTION__);
+  return false;
+}
+
+
+void
+anp_path_getBounds(const ANPPath* p, ANPRectF* bounds)
+{
+  LOG("%s - NOT IMPL.", __PRETTY_FUNCTION__);
+
+  bounds->left = 0;
+  bounds->top = 0;
+  bounds->right = 1000;
+  bounds->left = 1000;
+}
+
+
+void
+anp_path_moveTo(ANPPath* p, float x, float y)
+{
+  LOG("%s - NOT IMPL.", __PRETTY_FUNCTION__);
+}
+
+void
+anp_path_lineTo(ANPPath* p, float x, float y)
+{
+  LOG("%s - NOT IMPL.", __PRETTY_FUNCTION__);
+}
+
+void
+anp_path_quadTo(ANPPath* p, float x0, float y0, float x1, float y1)
+{
+  LOG("%s - NOT IMPL.", __PRETTY_FUNCTION__);
+}
+
+void
+anp_path_cubicTo(ANPPath* p, float x0, float y0, float x1, float y1,
+                      float x2, float y2)
+{
+  LOG("%s - NOT IMPL.", __PRETTY_FUNCTION__);
+}
+
+void
+anp_path_close(ANPPath* p)
+{
+  LOG("%s - NOT IMPL.", __PRETTY_FUNCTION__);
+}
+
+
+void
+anp_path_offset(ANPPath* src, float dx, float dy, ANPPath* dst)
+{
+  LOG("%s - NOT IMPL.", __PRETTY_FUNCTION__);
+}
+
+
+void
+anp_path_transform(ANPPath* src, const ANPMatrix*, ANPPath* dst)
+{
+  LOG("%s - NOT IMPL.", __PRETTY_FUNCTION__);
+}
+
+
+
+void InitPathInterface(ANPPathInterfaceV0 *i) {
+  _assert(i->inSize == sizeof(*i));
+  ASSIGN(i, newPath);
+  ASSIGN(i, deletePath);
+  ASSIGN(i, copy);
+  ASSIGN(i, equal);
+  ASSIGN(i, reset);
+  ASSIGN(i, isEmpty);
+  ASSIGN(i, getBounds);
+  ASSIGN(i, moveTo);
+  ASSIGN(i, lineTo);
+  ASSIGN(i, quadTo);
+  ASSIGN(i, cubicTo);
+  ASSIGN(i, close);
+  ASSIGN(i, offset);
+  ASSIGN(i, transform);
+}
diff --git a/dom/plugins/base/android/ANPSurface.cpp b/dom/plugins/base/android/ANPSurface.cpp
new file mode 100644
index 000000000000..91400af1f2db
--- /dev/null
+++ b/dom/plugins/base/android/ANPSurface.cpp
@@ -0,0 +1,151 @@
+#include "assert.h"
+#include "ANPBase.h"
+#include <android/log.h>
+#include "AndroidBridge.h"
+#include "gfxImageSurface.h"
+#include "gfxContext.h"
+
+#define LOG(args...)  __android_log_print(ANDROID_LOG_INFO, "GeckoPlugins" , ## args)
+#define ASSIGN(obj, name)   (obj)->name = anp_surface_##name
+
+
+// used to cache JNI method and field IDs for Surface Objects
+static struct ANPSurfaceInterfaceJavaGlue {
+  bool        initialized;
+  jclass geckoAppShellClass;
+  jclass lockInfoCls;
+  jmethodID lockSurfaceANP;
+  jmethodID jUnlockSurfaceANP;
+  jfieldID jDirtyTop;
+  jfieldID jDirtyLeft;
+  jfieldID jDirtyBottom;
+  jfieldID jDirtyRight;
+  jfieldID jFormat;
+  jfieldID jWidth ;
+  jfieldID jHeight;
+  jfieldID jBuffer;
+} gSurfaceJavaGlue;
+
+#define getClassGlobalRef(env, cname)                                    \
+     (jClass = jclass(env->NewGlobalRef(env->FindClass(cname))))
+
+static void init(JNIEnv* env) {
+  if (gSurfaceJavaGlue.initialized)
+    return;
+  
+  gSurfaceJavaGlue.geckoAppShellClass = mozilla::AndroidBridge::GetGeckoAppShellClass();
+  
+  jmethodID getClass = env->GetStaticMethodID(gSurfaceJavaGlue.geckoAppShellClass, 
+                                              "getSurfaceLockInfoClass",
+                                              "()Ljava/lang/Class;");
+
+  gSurfaceJavaGlue.lockInfoCls = (jclass) env->NewGlobalRef(env->CallStaticObjectMethod(gSurfaceJavaGlue.geckoAppShellClass, getClass));
+
+  gSurfaceJavaGlue.jDirtyTop = env->GetFieldID(gSurfaceJavaGlue.lockInfoCls, "dirtyTop", "I");
+  gSurfaceJavaGlue.jDirtyLeft = env->GetFieldID(gSurfaceJavaGlue.lockInfoCls, "dirtyLeft", "I");
+  gSurfaceJavaGlue.jDirtyBottom = env->GetFieldID(gSurfaceJavaGlue.lockInfoCls, "dirtyBottom", "I");
+  gSurfaceJavaGlue.jDirtyRight = env->GetFieldID(gSurfaceJavaGlue.lockInfoCls, "dirtyRight", "I");
+
+  gSurfaceJavaGlue.jFormat = env->GetFieldID(gSurfaceJavaGlue.lockInfoCls, "format", "I");
+  gSurfaceJavaGlue.jWidth = env->GetFieldID(gSurfaceJavaGlue.lockInfoCls, "width", "I");
+  gSurfaceJavaGlue.jHeight = env->GetFieldID(gSurfaceJavaGlue.lockInfoCls, "height", "I");
+
+  gSurfaceJavaGlue.jBuffer = env->GetFieldID(gSurfaceJavaGlue.lockInfoCls, "buffer", "Ljava/nio/Buffer;");
+  gSurfaceJavaGlue.lockSurfaceANP = env->GetStaticMethodID(gSurfaceJavaGlue.geckoAppShellClass, "lockSurfaceANP", "(Landroid/view/SurfaceView;IIII)Lorg/mozilla/gecko/SurfaceLockInfo;");
+  gSurfaceJavaGlue.jUnlockSurfaceANP = env->GetStaticMethodID(gSurfaceJavaGlue.geckoAppShellClass, "unlockSurfaceANP", "(Landroid/view/SurfaceView;)V");
+  gSurfaceJavaGlue.initialized = true;
+}
+
+static bool anp_lock(JNIEnv* env, jobject surfaceView, ANPBitmap* bitmap, ANPRectI* dirtyRect) {
+  LOG("%s", __PRETTY_FUNCTION__);
+  if (!bitmap || !surfaceView) {
+    LOG("%s, null bitmap or surface, exiting", __PRETTY_FUNCTION__);
+    return false;
+  }
+
+  init(env);
+
+  jvalue args[5];
+  args[0].l = surfaceView;
+  if (dirtyRect) {
+    args[1].i = dirtyRect->top;
+    args[2].i = dirtyRect->left;
+    args[3].i = dirtyRect->bottom;
+    args[4].i = dirtyRect->right;
+    LOG("dirty rect: %d, %d, %d, %d", dirtyRect->top, dirtyRect->left, dirtyRect->bottom, dirtyRect->right);
+  } else {
+    args[1].i = args[2].i = args[3].i = args[4].i = 0;
+  }
+  
+  jobject info = env->CallStaticObjectMethod(gSurfaceJavaGlue.geckoAppShellClass,
+                                             gSurfaceJavaGlue.lockSurfaceANP, 
+                                             surfaceView, args[1].i, args[2].i, args[3].i, args[4].i);
+
+  LOG("info: %p", info);
+  if (!info)
+    return false;
+
+  // the surface may have expanded the dirty region so we must to pass that
+  // information back to the plugin.
+  if (dirtyRect) {
+    dirtyRect->left   = env->GetIntField(info, gSurfaceJavaGlue.jDirtyLeft);
+    dirtyRect->right  = env->GetIntField(info, gSurfaceJavaGlue.jDirtyRight);
+    dirtyRect->top    = env->GetIntField(info, gSurfaceJavaGlue.jDirtyTop);
+    dirtyRect->bottom = env->GetIntField(info, gSurfaceJavaGlue.jDirtyBottom);
+    LOG("dirty rect: %d, %d, %d, %d", dirtyRect->top, dirtyRect->left, dirtyRect->bottom, dirtyRect->right);
+  }
+
+  bitmap->width  = env->GetIntField(info, gSurfaceJavaGlue.jWidth);
+  bitmap->height = env->GetIntField(info, gSurfaceJavaGlue.jHeight);
+
+  int format = env->GetIntField(info, gSurfaceJavaGlue.jFormat);
+
+  // format is PixelFormat
+  if (format & 0x00000001) {
+    bitmap->format = kRGBA_8888_ANPBitmapFormat;
+    bitmap->rowBytes = bitmap->width * 4;
+  }
+  else if (format & 0x00000004) {
+    bitmap->format = kRGB_565_ANPBitmapFormat;
+    bitmap->rowBytes = bitmap->width * 2;
+  }
+  else {
+    LOG("format from glue is unknown %d\n", format);
+    return false;
+  }
+
+  jobject buf = env->GetObjectField(info, gSurfaceJavaGlue.jBuffer);
+  bitmap->baseAddr = env->GetDirectBufferAddress(buf);
+  
+  LOG("format: %d, width: %d, height: %d",  bitmap->format,  bitmap->width,  bitmap->height);
+  env->DeleteLocalRef(info);
+  env->DeleteLocalRef(buf);
+  return ( bitmap->width > 0 && bitmap->height > 0 );
+}
+
+static void anp_unlock(JNIEnv* env, jobject surfaceView) {
+  LOG("%s", __PRETTY_FUNCTION__);
+
+  if (!surfaceView) {
+    LOG("null surface, exiting %s", __PRETTY_FUNCTION__);
+    return;
+  }
+
+  init(env);
+  env->CallStaticVoidMethod(gSurfaceJavaGlue.geckoAppShellClass, gSurfaceJavaGlue.jUnlockSurfaceANP, surfaceView);
+  LOG("returning from %s", __PRETTY_FUNCTION__);
+
+}
+
+///////////////////////////////////////////////////////////////////////////////
+
+#define ASSIGN(obj, name)   (obj)->name = anp_##name
+
+void InitSurfaceInterface(ANPSurfaceInterfaceV0 *i) {
+
+  ASSIGN(i, lock);
+  ASSIGN(i, unlock);
+
+  // setup the java glue struct
+  gSurfaceJavaGlue.initialized = false;
+}
diff --git a/dom/plugins/base/android/ANPSystem.cpp b/dom/plugins/base/android/ANPSystem.cpp
new file mode 100644
index 000000000000..ccca3eaed348
--- /dev/null
+++ b/dom/plugins/base/android/ANPSystem.cpp
@@ -0,0 +1,49 @@
+#include "base/basictypes.h"
+
+
+#include "assert.h"
+#include "ANPBase.h"
+#include <android/log.h>
+#include "nsNPAPIPluginInstance.h"
+#include "AndroidBridge.h"
+#include "nsNPAPIPlugin.h"
+#include "PluginPRLibrary.h"
+
+#define LOG(args...)  __android_log_print(ANDROID_LOG_INFO, "GeckoPlugins" , ## args)
+#define ASSIGN(obj, name)   (obj)->name = anp_system_##name
+
+const char*
+anp_system_getApplicationDataDirectory()
+{
+  LOG("getApplicationDataDirectory return /data/data/org.mozilla.%s", MOZ_APP_NAME);
+  return "/data/data/org.mozilla." MOZ_APP_NAME;
+}
+
+jclass anp_system_loadJavaClass(NPP instance, const char* className)
+{
+  LOG("%s", __PRETTY_FUNCTION__);
+
+  JNIEnv* env = GetJNIForThread();
+  jclass cls = env->FindClass("org/mozilla/gecko/GeckoAppShell");
+  jmethodID method = env->GetStaticMethodID(cls,
+                                            "loadPluginClass",
+                                            "(Ljava/lang/String;Ljava/lang/String;)Ljava/lang/Class;");
+
+  // pass libname and classname, gotta create java strings
+  nsNPAPIPluginInstance* pinst = static_cast<nsNPAPIPluginInstance*>(instance->ndata);
+  mozilla::PluginPRLibrary* lib = static_cast<mozilla::PluginPRLibrary*>(pinst->GetPlugin()->GetLibrary());
+
+  nsCString libName;
+  lib->GetLibraryPath(libName);
+
+  jstring jclassName = env->NewStringUTF(className);
+  jstring jlibName = env->NewStringUTF(libName.get());
+  jobject obj = env->CallStaticObjectMethod(cls, method, jclassName, jlibName);
+  return reinterpret_cast<jclass>(obj);
+}
+
+void InitSystemInterface(ANPSystemInterfaceV0 *i) {
+  _assert(i->inSize == sizeof(*i));
+  ASSIGN(i, getApplicationDataDirectory);
+  ASSIGN(i, loadJavaClass);
+}
diff --git a/dom/plugins/base/android/ANPTypeface.cpp b/dom/plugins/base/android/ANPTypeface.cpp
new file mode 100644
index 000000000000..a3cf75a88d4b
--- /dev/null
+++ b/dom/plugins/base/android/ANPTypeface.cpp
@@ -0,0 +1,113 @@
+#include "assert.h"
+#include "ANPBase.h"
+#include <android/log.h>
+#include "gfxAndroidPlatform.h"
+
+#define LOG(args...)  __android_log_print(ANDROID_LOG_INFO, "GeckoPlugins" , ## args)
+#define ASSIGN(obj, name)   (obj)->name = anp_typeface_##name
+
+ANPTypeface*
+anp_typeface_createFromName(const char name[], ANPTypefaceStyle aStyle)
+{
+  LOG("%s - %s\n", __PRETTY_FUNCTION__, name);
+
+  gfxFontStyle style (aStyle == kItalic_ANPTypefaceStyle ? FONT_STYLE_ITALIC :
+                      FONT_STYLE_NORMAL,
+                      NS_FONT_STRETCH_NORMAL,
+                      aStyle == kBold_ANPTypefaceStyle ? 700 : 400,
+                      16.0,
+                      NS_NewPermanentAtom(NS_LITERAL_STRING("en")),
+                      0.0,
+                      PR_FALSE, PR_FALSE,
+                      NS_LITERAL_STRING(""),
+                      NS_LITERAL_STRING(""));
+  ANPTypeface* tf = new ANPTypeface;
+  gfxAndroidPlatform * p = (gfxAndroidPlatform*)gfxPlatform::GetPlatform();
+  tf->mFont = gfxFT2Font::GetOrMakeFont(NS_ConvertASCIItoUTF16(name), &style);
+  return tf;
+}
+
+ANPTypeface*
+anp_typeface_createFromTypeface(const ANPTypeface* family,
+                                ANPTypefaceStyle)
+{
+  NOT_IMPLEMENTED();
+  return 0;
+}
+
+int32_t
+anp_typeface_getRefCount(const ANPTypeface*)
+{
+  NOT_IMPLEMENTED();
+  return 0;
+}
+
+void
+anp_typeface_ref(ANPTypeface* tf)
+{
+  LOG("%s\n", __PRETTY_FUNCTION__);
+  if (tf->mFont)
+    tf->mFont->AddRef();
+
+}
+
+void
+anp_typeface_unref(ANPTypeface* tf)
+{
+  LOG("%s\n", __PRETTY_FUNCTION__);
+  if (tf->mFont)
+    tf->mFont->Release();
+}
+
+ANPTypefaceStyle
+anp_typeface_getStyle(const ANPTypeface* ft)
+{
+  LOG("%s\n", __PRETTY_FUNCTION__);
+  return kBold_ANPTypefaceStyle;
+}
+
+int32_t
+anp_typeface_getFontPath(const ANPTypeface*, char path[], int32_t length,
+                         int32_t* index)
+{
+  NOT_IMPLEMENTED();
+  return 0;
+}
+
+static const char* gFontDir;
+#define FONT_DIR_SUFFIX     "/fonts/"
+
+const char*
+anp_typeface_getFontDirectoryPath()
+{
+  LOG("%s\n", __PRETTY_FUNCTION__);
+  if (NULL == gFontDir) {
+    const char* root = getenv("ANDROID_ROOT");
+    size_t len = strlen(root);
+    char* storage = (char*)malloc(len + sizeof(FONT_DIR_SUFFIX));
+    if (NULL == storage) {
+      return NULL;
+    }
+    memcpy(storage, root, len);
+    memcpy(storage + len, FONT_DIR_SUFFIX, sizeof(FONT_DIR_SUFFIX));
+    // save this assignment for last, so that if multiple threads call us
+    // (which should never happen), we never return an incomplete global.
+    // At worst, we would allocate storage for the path twice.
+    gFontDir = storage;
+  }
+
+  return 0;
+}
+
+void InitTypeFaceInterface(ANPTypefaceInterfaceV0 *i) {
+  _assert(i->inSize == sizeof(*i));
+  ASSIGN(i, createFromName);
+  ASSIGN(i, createFromTypeface);
+  ASSIGN(i, getRefCount);
+  ASSIGN(i, ref);
+  ASSIGN(i, unref);
+  ASSIGN(i, getStyle);
+  ASSIGN(i, getFontPath);
+  ASSIGN(i, getFontDirectoryPath);
+}
+
diff --git a/dom/plugins/base/android/ANPWindow.cpp b/dom/plugins/base/android/ANPWindow.cpp
new file mode 100644
index 000000000000..64ab95dc31f5
--- /dev/null
+++ b/dom/plugins/base/android/ANPWindow.cpp
@@ -0,0 +1,53 @@
+#include "assert.h"
+#include "ANPBase.h"
+#include <android/log.h>
+
+#define LOG(args...)  __android_log_print(ANDROID_LOG_INFO, "GeckoPlugins" , ## args)
+#define ASSIGN(obj, name)   (obj)->name = anp_window_##name
+
+void
+anp_window_setVisibleRects(NPP instance, const ANPRectI rects[], int32_t count)
+{
+  NOT_IMPLEMENTED();
+}
+
+void
+anp_window_clearVisibleRects(NPP instance)
+{
+  NOT_IMPLEMENTED();
+}
+
+void
+anp_window_showKeyboard(NPP instance, bool value)
+{
+  NOT_IMPLEMENTED();
+}
+
+void
+anp_window_requestFullScreen(NPP instance)
+{
+  NOT_IMPLEMENTED();
+}
+
+void
+anp_window_exitFullScreen(NPP instance)
+{
+  NOT_IMPLEMENTED();
+}
+
+void
+anp_window_requestCenterFitZoom(NPP instance)
+{
+  NOT_IMPLEMENTED();
+}
+
+void InitWindowInterface(ANPWindowInterfaceV0 *i) {
+  _assert(i->inSize == sizeof(*i));
+  ASSIGN(i, setVisibleRects);
+  ASSIGN(i, clearVisibleRects);
+  ASSIGN(i, showKeyboard);
+  ASSIGN(i, requestFullScreen);
+  ASSIGN(i, exitFullScreen);
+  ASSIGN(i, requestCenterFitZoom);
+}
+
diff --git a/dom/plugins/base/android/Makefile.in b/dom/plugins/base/android/Makefile.in
new file mode 100644
index 000000000000..42e5067f3aed
--- /dev/null
+++ b/dom/plugins/base/android/Makefile.in
@@ -0,0 +1,81 @@
+#
+# ***** BEGIN LICENSE BLOCK *****
+# Version: MPL 1.1/GPL 2.0/LGPL 2.1
+#
+# The contents of this file are subject to the Mozilla Public License Version
+# 1.1 (the "License"); you may not use this file except in compliance with
+# the License. You may obtain a copy of the License at
+# http://www.mozilla.org/MPL/
+#
+# Software distributed under the License is distributed on an "AS IS" basis,
+# WITHOUT WARRANTY OF ANY KIND, either express or implied. See the License
+# for the specific language governing rights and limitations under the
+# License.
+#
+# The Original Code is mozilla.org code.
+#
+# The Initial Developer of the Original Code is
+# Netscape Communications Corporation.
+# Portions created by the Initial Developer are Copyright (C) 1998
+# the Initial Developer. All Rights Reserved.
+#
+# Contributor(s):
+#
+# Alternatively, the contents of this file may be used under the terms of
+# either the GNU General Public License Version 2 or later (the "GPL"), or
+# the GNU Lesser General Public License Version 2.1 or later (the "LGPL"),
+# in which case the provisions of the GPL or the LGPL are applicable instead
+# of those above. If you wish to allow use of your version of this file only
+# under the terms of either the GPL or the LGPL, and not to allow others to
+# use your version of this file under the terms of the MPL, indicate your
+# decision by deleting the provisions above and replace them with the notice
+# and other provisions required by the GPL or the LGPL. If you do not delete
+# the provisions above, a recipient may use your version of this file under
+# the terms of any one of the MPL, the GPL or the LGPL.
+#
+# ***** END LICENSE BLOCK *****
+
+DEPTH		= ../../../..
+topsrcdir	= @top_srcdir@
+srcdir		= @srcdir@
+VPATH		= @srcdir@
+
+include $(DEPTH)/config/autoconf.mk
+
+MODULE		= plugin
+LIBRARY_NAME	= gkpluginandroid_s
+
+LIBXUL_LIBRARY   = 1
+FORCE_STATIC_LIB = 1
+EXPORT_LIBRARY = 1
+
+include $(topsrcdir)/config/config.mk
+include $(topsrcdir)/ipc/chromium/chromium-config.mk
+
+EXPORTS = \
+  android_npapi.h \
+  $(NULL)
+
+CPPSRCS += ANPAudio.cpp    \
+           ANPCanvas.cpp   \
+           ANPEvent.cpp    \
+           ANPMatrix.cpp   \
+           ANPPath.cpp     \
+           ANPSystem.cpp   \
+           ANPWindow.cpp   \
+           ANPBitmap.cpp   \
+           ANPLog.cpp      \
+           ANPPaint.cpp    \
+           ANPSurface.cpp  \
+           ANPTypeface.cpp \
+           $(NULL)
+
+LOCAL_INCLUDES += \
+  -I$(topsrcdir)/dom/plugins/base \
+  $(MOZ_CAIRO_CFLAGS) \
+  $(NULL)
+
+DEFINES += -DMOZ_APP_NAME='"$(MOZ_APP_NAME)"'
+
+include $(topsrcdir)/config/rules.mk
+
diff --git a/dom/plugins/base/android/android_npapi.h b/dom/plugins/base/android/android_npapi.h
new file mode 100644
index 000000000000..27b0c0c9fab3
--- /dev/null
+++ b/dom/plugins/base/android/android_npapi.h
@@ -0,0 +1,979 @@
+/*
+ * Copyright 2009, The Android Open Source Project
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *  * Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ *  * Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE COPYRIGHT OWNER OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+/*  Defines the android-specific types and functions as part of npapi
+
+    In particular, defines the window and event types that are passed to
+    NPN_GetValue, NPP_SetWindow and NPP_HandleEvent.
+
+    To minimize what native libraries the plugin links against, some
+    functionality is provided via function-ptrs (e.g. time, sound)
+ */
+
+#ifndef android_npapi_H
+#define android_npapi_H
+
+#include <stdint.h>
+#include "npapi.h"
+#include <jni.h>
+
+///////////////////////////////////////////////////////////////////////////////
+// General types
+
+enum ANPBitmapFormats {
+    kUnknown_ANPBitmapFormat    = 0,
+    kRGBA_8888_ANPBitmapFormat  = 1,
+    kRGB_565_ANPBitmapFormat    = 2
+};
+typedef int32_t ANPBitmapFormat;
+
+struct ANPPixelPacking {
+    uint8_t AShift;
+    uint8_t ABits;
+    uint8_t RShift;
+    uint8_t RBits;
+    uint8_t GShift;
+    uint8_t GBits;
+    uint8_t BShift;
+    uint8_t BBits;
+};
+
+struct ANPBitmap {
+    void*           baseAddr;
+    ANPBitmapFormat format;
+    int32_t         width;
+    int32_t         height;
+    int32_t         rowBytes;
+};
+
+struct ANPRectF {
+    float   left;
+    float   top;
+    float   right;
+    float   bottom;
+};
+
+struct ANPRectI {
+    int32_t left;
+    int32_t top;
+    int32_t right;
+    int32_t bottom;
+};
+
+struct ANPCanvas;
+struct ANPMatrix;
+struct ANPPaint;
+struct ANPPath;
+struct ANPRegion;
+struct ANPTypeface;
+
+enum ANPMatrixFlags {
+    kIdentity_ANPMatrixFlag     = 0,
+    kTranslate_ANPMatrixFlag    = 0x01,
+    kScale_ANPMatrixFlag        = 0x02,
+    kAffine_ANPMatrixFlag       = 0x04,
+    kPerspective_ANPMatrixFlag  = 0x08,
+};
+typedef uint32_t ANPMatrixFlag;
+
+///////////////////////////////////////////////////////////////////////////////
+// NPN_GetValue
+
+/** queries for a specific ANPInterface.
+
+    Maybe called with NULL for the NPP instance
+
+    NPN_GetValue(inst, interface_enum, ANPInterface*)
+ */
+#define kLogInterfaceV0_ANPGetValue         ((NPNVariable)1000)
+#define kAudioTrackInterfaceV0_ANPGetValue  ((NPNVariable)1001)
+#define kCanvasInterfaceV0_ANPGetValue      ((NPNVariable)1002)
+#define kMatrixInterfaceV0_ANPGetValue      ((NPNVariable)1003)
+#define kPaintInterfaceV0_ANPGetValue       ((NPNVariable)1004)
+#define kPathInterfaceV0_ANPGetValue        ((NPNVariable)1005)
+#define kTypefaceInterfaceV0_ANPGetValue    ((NPNVariable)1006)
+#define kWindowInterfaceV0_ANPGetValue      ((NPNVariable)1007)
+#define kBitmapInterfaceV0_ANPGetValue      ((NPNVariable)1008)
+#define kSurfaceInterfaceV0_ANPGetValue     ((NPNVariable)1009)
+#define kSystemInterfaceV0_ANPGetValue      ((NPNVariable)1010)
+#define kEventInterfaceV0_ANPGetValue       ((NPNVariable)1011)
+
+/** queries for the drawing models supported on this device.
+
+    NPN_GetValue(inst, kSupportedDrawingModel_ANPGetValue, uint32_t* bits)
+ */
+#define kSupportedDrawingModel_ANPGetValue  ((NPNVariable)2000)
+
+/** queries for the context (android.content.Context) of the plugin. If no
+    instance is specified the application's context is returned. If the instance
+    is given then the context returned is identical to the context used to
+    create the webview in which that instance resides.
+
+    NOTE: Holding onto a non-application context after your instance has been
+    destroyed will cause a memory leak.  Refer to the android documentation to
+    determine what context is best suited for your particular scenario.
+
+    NPN_GetValue(inst, kJavaContext_ANPGetValue, jobject context)
+ */
+#define kJavaContext_ANPGetValue            ((NPNVariable)2001)
+
+///////////////////////////////////////////////////////////////////////////////
+// NPN_SetValue
+
+/** Request to set the drawing model. SetValue will return false if the drawing
+    model is not supported or has insufficient information for configuration.
+
+    NPN_SetValue(inst, kRequestDrawingModel_ANPSetValue, (void*)foo_ANPDrawingModel)
+ */
+#define kRequestDrawingModel_ANPSetValue    ((NPPVariable)1000)
+
+/** These are used as bitfields in ANPSupportedDrawingModels_EnumValue,
+    and as-is in ANPRequestDrawingModel_EnumValue. The drawing model determines
+    how to interpret the ANPDrawingContext provided in the Draw event and how
+    to interpret the NPWindow->window field.
+ */
+enum ANPDrawingModels {
+    /** Draw into a bitmap from the browser thread in response to a Draw event.
+        NPWindow->window is reserved (ignore)
+     */
+    kBitmap_ANPDrawingModel  = 1 << 0,
+    /** Draw into a surface (e.g. raster, openGL, etc.) using the Java surface
+        interface. When this model is used the browser will invoke the Java
+        class specified in the plugin's apk manifest. From that class the browser
+        will invoke the appropriate method to return an an instance of a android
+        Java View. The instance is then embedded in the html. The plugin can then
+        manipulate the view as it would any normal Java View in android.
+
+        Unlike the bitmap model, a surface model is opaque so no html content
+        behind the plugin will be  visible. Unless the plugin needs to be
+        transparent the surface model should be chosen over the bitmap model as
+        it will have better performance.
+
+        Further, a plugin can manipulate some surfaces in native code using the
+        ANPSurfaceInterface.  This interface can be used to manipulate Java
+        objects that extend Surface.class by allowing them to access the
+        surface's underlying bitmap in native code.  For instance, if a raster
+        surface is used the plugin can lock, draw directly into the bitmap, and
+        unlock the surface in native code without making JNI calls to the Java
+        surface object.
+     */
+    kSurface_ANPDrawingModel = 1 << 1,
+};
+typedef int32_t ANPDrawingModel;
+
+/** Request to receive/disable events. If the pointer is NULL then all flags will
+    be disabled. Otherwise, the event type will be enabled iff its corresponding
+    bit in the EventFlags bit field is set.
+
+    NPN_SetValue(inst, ANPAcceptEvents, (void*)EventFlags)
+ */
+#define kAcceptEvents_ANPSetValue           ((NPPVariable)1001)
+
+/** The EventFlags are a set of bits used to determine which types of events the
+    plugin wishes to receive. For example, if the value is 0x03 then both key
+    and touch events will be provided to the plugin.
+ */
+enum ANPEventFlag {
+    kKey_ANPEventFlag               = 0x01,
+    kTouch_ANPEventFlag             = 0x02,
+};
+typedef uint32_t ANPEventFlags;
+
+///////////////////////////////////////////////////////////////////////////////
+// NPP_GetValue
+
+/** Requests that the plugin return a java surface to be displayed. This will
+    only be used if the plugin has choosen the kSurface_ANPDrawingModel.
+
+    NPP_GetValue(inst, kJavaSurface_ANPGetValue, jobject surface)
+ */
+#define kJavaSurface_ANPGetValue            ((NPPVariable)2000)
+
+
+///////////////////////////////////////////////////////////////////////////////
+// ANDROID INTERFACE DEFINITIONS
+
+/** Interfaces provide additional functionality to the plugin via function ptrs.
+    Once an interface is retrieved, it is valid for the lifetime of the plugin
+    (just like browserfuncs).
+
+    All ANPInterfaces begin with an inSize field, which must be set by the
+    caller (plugin) with the number of bytes allocated for the interface.
+    e.g. SomeInterface si; si.inSize = sizeof(si); browser->getvalue(..., &si);
+ */
+struct ANPInterface {
+    uint32_t    inSize;     // size (in bytes) of this struct
+};
+
+enum ANPLogTypes {
+    kError_ANPLogType   = 0,    // error
+    kWarning_ANPLogType = 1,    // warning
+    kDebug_ANPLogType   = 2     // debug only (informational)
+};
+typedef int32_t ANPLogType;
+
+struct ANPLogInterfaceV0 : ANPInterface {
+    /** dumps printf messages to the log file
+        e.g. interface->log(instance, kWarning_ANPLogType, "value is %d", value);
+     */
+    void (*log)(ANPLogType, const char format[], ...);
+};
+
+struct ANPBitmapInterfaceV0 : ANPInterface {
+    /** Returns true if the specified bitmap format is supported, and if packing
+        is non-null, sets it to the packing info for that format.
+     */
+    bool (*getPixelPacking)(ANPBitmapFormat, ANPPixelPacking* packing);
+};
+
+struct ANPMatrixInterfaceV0 : ANPInterface {
+    /** Return a new identity matrix
+     */
+    ANPMatrix*  (*newMatrix)();
+    /** Delete a matrix previously allocated by newMatrix()
+     */
+    void        (*deleteMatrix)(ANPMatrix*);
+
+    ANPMatrixFlag (*getFlags)(const ANPMatrix*);
+
+    void        (*copy)(ANPMatrix* dst, const ANPMatrix* src);
+
+    /** Return the matrix values in a float array (allcoated by the caller),
+        where the values are treated as follows:
+        w  = x * [6] + y * [7] + [8];
+        x' = (x * [0] + y * [1] + [2]) / w;
+        y' = (x * [3] + y * [4] + [5]) / w;
+     */
+    void        (*get3x3)(const ANPMatrix*, float[9]);
+    /** Initialize the matrix from values in a float array,
+        where the values are treated as follows:
+         w  = x * [6] + y * [7] + [8];
+         x' = (x * [0] + y * [1] + [2]) / w;
+         y' = (x * [3] + y * [4] + [5]) / w;
+     */
+    void        (*set3x3)(ANPMatrix*, const float[9]);
+
+    void        (*setIdentity)(ANPMatrix*);
+    void        (*preTranslate)(ANPMatrix*, float tx, float ty);
+    void        (*postTranslate)(ANPMatrix*, float tx, float ty);
+    void        (*preScale)(ANPMatrix*, float sx, float sy);
+    void        (*postScale)(ANPMatrix*, float sx, float sy);
+    void        (*preSkew)(ANPMatrix*, float kx, float ky);
+    void        (*postSkew)(ANPMatrix*, float kx, float ky);
+    void        (*preRotate)(ANPMatrix*, float degrees);
+    void        (*postRotate)(ANPMatrix*, float degrees);
+    void        (*preConcat)(ANPMatrix*, const ANPMatrix*);
+    void        (*postConcat)(ANPMatrix*, const ANPMatrix*);
+
+    /** Return true if src is invertible, and if so, return its inverse in dst.
+        If src is not invertible, return false and ignore dst.
+     */
+    bool        (*invert)(ANPMatrix* dst, const ANPMatrix* src);
+
+    /** Transform the x,y pairs in src[] by this matrix, and store the results
+        in dst[]. The count parameter is treated as the number of pairs in the
+        array. It is legal for src and dst to point to the same memory, but
+        illegal for the two arrays to partially overlap.
+     */
+    void        (*mapPoints)(ANPMatrix*, float dst[], const float src[],
+                             int32_t count);
+};
+
+struct ANPPathInterfaceV0 : ANPInterface {
+    /** Return a new path */
+    ANPPath* (*newPath)();
+
+    /** Delete a path previously allocated by ANPPath() */
+    void (*deletePath)(ANPPath*);
+
+    /** Make a deep copy of the src path, into the dst path (already allocated
+        by the caller).
+     */
+    void (*copy)(ANPPath* dst, const ANPPath* src);
+
+    /** Returns true if the two paths are the same (i.e. have the same points)
+     */
+    bool (*equal)(const ANPPath* path0, const ANPPath* path1);
+
+    /** Remove any previous points, initializing the path back to empty. */
+    void (*reset)(ANPPath*);
+
+    /** Return true if the path is empty (has no lines, quads or cubics). */
+    bool (*isEmpty)(const ANPPath*);
+
+    /** Return the path's bounds in bounds. */
+    void (*getBounds)(const ANPPath*, ANPRectF* bounds);
+
+    void (*moveTo)(ANPPath*, float x, float y);
+    void (*lineTo)(ANPPath*, float x, float y);
+    void (*quadTo)(ANPPath*, float x0, float y0, float x1, float y1);
+    void (*cubicTo)(ANPPath*, float x0, float y0, float x1, float y1,
+                    float x2, float y2);
+    void (*close)(ANPPath*);
+
+    /** Offset the src path by [dx, dy]. If dst is null, apply the
+        change directly to the src path. If dst is not null, write the
+        changed path into dst, and leave the src path unchanged. In that case
+        dst must have been previously allocated by the caller.
+     */
+    void (*offset)(ANPPath* src, float dx, float dy, ANPPath* dst);
+
+    /** Transform the path by the matrix. If dst is null, apply the
+        change directly to the src path. If dst is not null, write the
+        changed path into dst, and leave the src path unchanged. In that case
+        dst must have been previously allocated by the caller.
+     */
+    void (*transform)(ANPPath* src, const ANPMatrix*, ANPPath* dst);
+};
+
+/** ANPColor is always defined to have the same packing on all platforms, and
+    it is always unpremultiplied.
+
+    This is in contrast to 32bit format(s) in bitmaps, which are premultiplied,
+    and their packing may vary depending on the platform, hence the need for
+    ANPBitmapInterface::getPixelPacking()
+ */
+typedef uint32_t ANPColor;
+#define ANPColor_ASHIFT     24
+#define ANPColor_RSHIFT     16
+#define ANPColor_GSHIFT     8
+#define ANPColor_BSHIFT     0
+#define ANP_MAKE_COLOR(a, r, g, b)  \
+                   (((a) << ANPColor_ASHIFT) |  \
+                    ((r) << ANPColor_RSHIFT) |  \
+                    ((g) << ANPColor_GSHIFT) |  \
+                    ((b) << ANPColor_BSHIFT))
+
+enum ANPPaintFlag {
+    kAntiAlias_ANPPaintFlag         = 1 << 0,
+    kFilterBitmap_ANPPaintFlag      = 1 << 1,
+    kDither_ANPPaintFlag            = 1 << 2,
+    kUnderlineText_ANPPaintFlag     = 1 << 3,
+    kStrikeThruText_ANPPaintFlag    = 1 << 4,
+    kFakeBoldText_ANPPaintFlag      = 1 << 5,
+};
+typedef uint32_t ANPPaintFlags;
+
+enum ANPPaintStyles {
+    kFill_ANPPaintStyle             = 0,
+    kStroke_ANPPaintStyle           = 1,
+    kFillAndStroke_ANPPaintStyle    = 2
+};
+typedef int32_t ANPPaintStyle;
+
+enum ANPPaintCaps {
+    kButt_ANPPaintCap   = 0,
+    kRound_ANPPaintCap  = 1,
+    kSquare_ANPPaintCap = 2
+};
+typedef int32_t ANPPaintCap;
+
+enum ANPPaintJoins {
+    kMiter_ANPPaintJoin = 0,
+    kRound_ANPPaintJoin = 1,
+    kBevel_ANPPaintJoin = 2
+};
+typedef int32_t ANPPaintJoin;
+
+enum ANPPaintAligns {
+    kLeft_ANPPaintAlign     = 0,
+    kCenter_ANPPaintAlign   = 1,
+    kRight_ANPPaintAlign    = 2
+};
+typedef int32_t ANPPaintAlign;
+
+enum ANPTextEncodings {
+    kUTF8_ANPTextEncoding   = 0,
+    kUTF16_ANPTextEncoding  = 1,
+};
+typedef int32_t ANPTextEncoding;
+
+enum ANPTypefaceStyles {
+    kBold_ANPTypefaceStyle      = 1 << 0,
+    kItalic_ANPTypefaceStyle    = 1 << 1
+};
+typedef uint32_t ANPTypefaceStyle;
+
+typedef uint32_t ANPFontTableTag;
+
+struct ANPFontMetrics {
+    /** The greatest distance above the baseline for any glyph (will be <= 0) */
+    float   fTop;
+    /** The recommended distance above the baseline (will be <= 0) */
+    float   fAscent;
+    /** The recommended distance below the baseline (will be >= 0) */
+    float   fDescent;
+    /** The greatest distance below the baseline for any glyph (will be >= 0) */
+    float   fBottom;
+    /** The recommended distance to add between lines of text (will be >= 0) */
+    float   fLeading;
+};
+
+struct ANPTypefaceInterfaceV0 : ANPInterface {
+    /** Return a new reference to the typeface that most closely matches the
+        requested name and style. Pass null as the name to return
+        the default font for the requested style. Will never return null
+
+        The 5 generic font names "serif", "sans-serif", "monospace", "cursive",
+        "fantasy" are recognized, and will be mapped to their logical font
+        automatically by this call.
+
+        @param name     May be NULL. The name of the font family.
+        @param style    The style (normal, bold, italic) of the typeface.
+        @return reference to the closest-matching typeface. Caller must call
+                unref() when they are done with the typeface.
+     */
+    ANPTypeface* (*createFromName)(const char name[], ANPTypefaceStyle);
+
+    /** Return a new reference to the typeface that most closely matches the
+        requested typeface and specified Style. Use this call if you want to
+        pick a new style from the same family of the existing typeface.
+        If family is NULL, this selects from the default font's family.
+
+        @param family  May be NULL. The name of the existing type face.
+        @param s       The style (normal, bold, italic) of the type face.
+        @return reference to the closest-matching typeface. Call must call
+                unref() when they are done.
+     */
+    ANPTypeface* (*createFromTypeface)(const ANPTypeface* family,
+                                       ANPTypefaceStyle);
+
+    /** Return the owner count of the typeface. A newly created typeface has an
+        owner count of 1. When the owner count is reaches 0, the typeface is
+        deleted.
+     */
+    int32_t (*getRefCount)(const ANPTypeface*);
+
+    /** Increment the owner count on the typeface
+     */
+    void (*ref)(ANPTypeface*);
+
+    /** Decrement the owner count on the typeface. When the count goes to 0,
+        the typeface is deleted.
+     */
+    void (*unref)(ANPTypeface*);
+
+    /** Return the style bits for the specified typeface
+     */
+    ANPTypefaceStyle (*getStyle)(const ANPTypeface*);
+
+    /** Some fonts are stored in files. If that is true for the fontID, then
+        this returns the byte length of the full file path. If path is not null,
+        then the full path is copied into path (allocated by the caller), up to
+        length bytes. If index is not null, then it is set to the truetype
+        collection index for this font, or 0 if the font is not in a collection.
+
+        Note: getFontPath does not assume that path is a null-terminated string,
+        so when it succeeds, it only copies the bytes of the file name and
+        nothing else (i.e. it copies exactly the number of bytes returned by the
+        function. If the caller wants to treat path[] as a C string, it must be
+        sure that it is allocated at least 1 byte larger than the returned size,
+        and it must copy in the terminating 0.
+
+        If the fontID does not correspond to a file, then the function returns
+        0, and the path and index parameters are ignored.
+
+        @param fontID  The font whose file name is being queried
+        @param path    Either NULL, or storage for receiving up to length bytes
+                       of the font's file name. Allocated by the caller.
+        @param length  The maximum space allocated in path (by the caller).
+                       Ignored if path is NULL.
+        @param index   Either NULL, or receives the TTC index for this font.
+                       If the font is not a TTC, then will be set to 0.
+        @return The byte length of th font's file name, or 0 if the font is not
+                baked by a file.
+     */
+    int32_t (*getFontPath)(const ANPTypeface*, char path[], int32_t length,
+                           int32_t* index);
+
+    /** Return a UTF8 encoded path name for the font directory, or NULL if not
+        supported. If returned, this string address will be valid for the life
+        of the plugin instance. It will always end with a '/' character.
+     */
+    const char* (*getFontDirectoryPath)();
+};
+
+struct ANPPaintInterfaceV0 : ANPInterface {
+    /** Return a new paint object, which holds all of the color and style
+        attributes that affect how things (geometry, text, bitmaps) are drawn
+        in a ANPCanvas.
+
+        The paint that is returned is not tied to any particular plugin
+        instance, but it must only be accessed from one thread at a time.
+     */
+    ANPPaint*   (*newPaint)();
+    void        (*deletePaint)(ANPPaint*);
+
+    ANPPaintFlags (*getFlags)(const ANPPaint*);
+    void        (*setFlags)(ANPPaint*, ANPPaintFlags);
+
+    ANPColor    (*getColor)(const ANPPaint*);
+    void        (*setColor)(ANPPaint*, ANPColor);
+
+    ANPPaintStyle (*getStyle)(const ANPPaint*);
+    void        (*setStyle)(ANPPaint*, ANPPaintStyle);
+
+    float       (*getStrokeWidth)(const ANPPaint*);
+    float       (*getStrokeMiter)(const ANPPaint*);
+    ANPPaintCap (*getStrokeCap)(const ANPPaint*);
+    ANPPaintJoin (*getStrokeJoin)(const ANPPaint*);
+    void        (*setStrokeWidth)(ANPPaint*, float);
+    void        (*setStrokeMiter)(ANPPaint*, float);
+    void        (*setStrokeCap)(ANPPaint*, ANPPaintCap);
+    void        (*setStrokeJoin)(ANPPaint*, ANPPaintJoin);
+
+    ANPTextEncoding (*getTextEncoding)(const ANPPaint*);
+    ANPPaintAlign (*getTextAlign)(const ANPPaint*);
+    float       (*getTextSize)(const ANPPaint*);
+    float       (*getTextScaleX)(const ANPPaint*);
+    float       (*getTextSkewX)(const ANPPaint*);
+    void        (*setTextEncoding)(ANPPaint*, ANPTextEncoding);
+    void        (*setTextAlign)(ANPPaint*, ANPPaintAlign);
+    void        (*setTextSize)(ANPPaint*, float);
+    void        (*setTextScaleX)(ANPPaint*, float);
+    void        (*setTextSkewX)(ANPPaint*, float);
+
+    /** Return the typeface ine paint, or null if there is none. This does not
+        modify the owner count of the returned typeface.
+     */
+    ANPTypeface* (*getTypeface)(const ANPPaint*);
+
+    /** Set the paint's typeface. If the paint already had a non-null typeface,
+        its owner count is decremented. If the new typeface is non-null, its
+        owner count is incremented.
+     */
+    void (*setTypeface)(ANPPaint*, ANPTypeface*);
+
+    /** Return the width of the text. If bounds is not null, return the bounds
+        of the text in that rectangle.
+     */
+    float (*measureText)(ANPPaint*, const void* text, uint32_t byteLength,
+                         ANPRectF* bounds);
+
+    /** Return the number of unichars specifed by the text.
+        If widths is not null, returns the array of advance widths for each
+            unichar.
+        If bounds is not null, returns the array of bounds for each unichar.
+     */
+    int (*getTextWidths)(ANPPaint*, const void* text, uint32_t byteLength,
+                         float widths[], ANPRectF bounds[]);
+
+    /** Return in metrics the spacing values for text, respecting the paint's
+        typeface and pointsize, and return the spacing between lines
+        (descent - ascent + leading). If metrics is NULL, it will be ignored.
+     */
+    float (*getFontMetrics)(ANPPaint*, ANPFontMetrics* metrics);
+};
+
+struct ANPCanvasInterfaceV0 : ANPInterface {
+    /** Return a canvas that will draw into the specified bitmap. Note: the
+        canvas copies the fields of the bitmap, so it need not persist after
+        this call, but the canvas DOES point to the same pixel memory that the
+        bitmap did, so the canvas should not be used after that pixel memory
+        goes out of scope. In the case of creating a canvas to draw into the
+        pixels provided by kDraw_ANPEventType, those pixels are only while
+        handling that event.
+
+        The canvas that is returned is not tied to any particular plugin
+        instance, but it must only be accessed from one thread at a time.
+     */
+    ANPCanvas*  (*newCanvas)(const ANPBitmap*);
+    void        (*deleteCanvas)(ANPCanvas*);
+
+    void        (*save)(ANPCanvas*);
+    void        (*restore)(ANPCanvas*);
+    void        (*translate)(ANPCanvas*, float tx, float ty);
+    void        (*scale)(ANPCanvas*, float sx, float sy);
+    void        (*rotate)(ANPCanvas*, float degrees);
+    void        (*skew)(ANPCanvas*, float kx, float ky);
+    void        (*concat)(ANPCanvas*, const ANPMatrix*);
+    void        (*clipRect)(ANPCanvas*, const ANPRectF*);
+    void        (*clipPath)(ANPCanvas*, const ANPPath*);
+
+    /** Return the current matrix on the canvas
+     */
+    void        (*getTotalMatrix)(ANPCanvas*, ANPMatrix*);
+    /** Return the current clip bounds in local coordinates, expanding it to
+        account for antialiasing edge effects if aa is true. If the
+        current clip is empty, return false and ignore the bounds argument.
+     */
+    bool        (*getLocalClipBounds)(ANPCanvas*, ANPRectF* bounds, bool aa);
+    /** Return the current clip bounds in device coordinates in bounds. If the
+        current clip is empty, return false and ignore the bounds argument.
+     */
+    bool        (*getDeviceClipBounds)(ANPCanvas*, ANPRectI* bounds);
+
+    void        (*drawColor)(ANPCanvas*, ANPColor);
+    void        (*drawPaint)(ANPCanvas*, const ANPPaint*);
+    void        (*drawLine)(ANPCanvas*, float x0, float y0, float x1, float y1,
+                            const ANPPaint*);
+    void        (*drawRect)(ANPCanvas*, const ANPRectF*, const ANPPaint*);
+    void        (*drawOval)(ANPCanvas*, const ANPRectF*, const ANPPaint*);
+    void        (*drawPath)(ANPCanvas*, const ANPPath*, const ANPPaint*);
+    void        (*drawText)(ANPCanvas*, const void* text, uint32_t byteLength,
+                            float x, float y, const ANPPaint*);
+    void       (*drawPosText)(ANPCanvas*, const void* text, uint32_t byteLength,
+                               const float xy[], const ANPPaint*);
+    void        (*drawBitmap)(ANPCanvas*, const ANPBitmap*, float x, float y,
+                              const ANPPaint*);
+    void        (*drawBitmapRect)(ANPCanvas*, const ANPBitmap*,
+                                  const ANPRectI* src, const ANPRectF* dst,
+                                  const ANPPaint*);
+};
+
+struct ANPWindowInterfaceV0 : ANPInterface {
+    /** Registers a set of rectangles that the plugin would like to keep on
+        screen. The rectangles are listed in order of priority with the highest
+        priority rectangle in location rects[0].  The browser will attempt to keep
+        as many of the rectangles on screen as possible and will scroll them into
+        view in response to the invocation of this method and other various events.
+        The count specifies how many rectangles are in the array. If the count is
+        zero it signals the browser that any existing rectangles should be cleared
+        and no rectangles will be tracked.
+     */
+    void (*setVisibleRects)(NPP instance, const ANPRectI rects[], int32_t count);
+    /** Clears any rectangles that are being tracked as a result of a call to
+        setVisibleRects. This call is equivalent to setVisibleRect(inst, NULL, 0).
+     */
+    void    (*clearVisibleRects)(NPP instance);
+    /** Given a boolean value of true the device will be requested to provide
+        a keyboard. A value of false will result in a request to hide the
+        keyboard. Further, the on-screen keyboard will not be displayed if a
+        physical keyboard is active.
+     */
+    void    (*showKeyboard)(NPP instance, bool value);
+    /** Called when a plugin wishes to enter into full screen mode. The plugin's
+        Java class (defined in the plugin's apk manifest) will be called
+        asynchronously to provide a View object to be displayed full screen.
+     */
+    void    (*requestFullScreen)(NPP instance);
+    /** Called when a plugin wishes to exit from full screen mode. As a result,
+        the plugin's full screen view will be discarded by the view system.
+     */
+    void    (*exitFullScreen)(NPP instance);
+    /** Called when a plugin wishes to be zoomed and centered in the current view.
+     */
+    void    (*requestCenterFitZoom)(NPP instance);
+};
+
+///////////////////////////////////////////////////////////////////////////////
+
+enum ANPSampleFormats {
+    kUnknown_ANPSamleFormat     = 0,
+    kPCM16Bit_ANPSampleFormat   = 1,
+    kPCM8Bit_ANPSampleFormat    = 2
+};
+typedef int32_t ANPSampleFormat;
+
+/** The audio buffer is passed to the callback proc to request more samples.
+    It is owned by the system, and the callback may read it, but should not
+    maintain a pointer to it outside of the scope of the callback proc.
+ */
+struct ANPAudioBuffer {
+    // RO - repeat what was specified in newTrack()
+    int32_t     channelCount;
+    // RO - repeat what was specified in newTrack()
+    ANPSampleFormat  format;
+    /** This buffer is owned by the caller. Inside the callback proc, up to
+        "size" bytes of sample data should be written into this buffer. The
+        address is only valid for the scope of a single invocation of the
+        callback proc.
+     */
+    void*       bufferData;
+    /** On input, specifies the maximum number of bytes that can be written
+        to "bufferData". On output, specifies the actual number of bytes that
+        the callback proc wrote into "bufferData".
+     */
+    uint32_t    size;
+};
+
+enum ANPAudioEvents {
+    /** This event is passed to the callback proc when the audio-track needs
+        more sample data written to the provided buffer parameter.
+     */
+    kMoreData_ANPAudioEvent = 0,
+    /** This event is passed to the callback proc if the audio system runs out
+        of sample data. In this event, no buffer parameter will be specified
+        (i.e. NULL will be passed to the 3rd parameter).
+     */
+    kUnderRun_ANPAudioEvent = 1
+};
+typedef int32_t ANPAudioEvent;
+
+/** Called to feed sample data to the track. This will be called in a separate
+    thread. However, you may call trackStop() from the callback (but you
+    cannot delete the track).
+
+    For example, when you have written the last chunk of sample data, you can
+    immediately call trackStop(). This will take effect after the current
+    buffer has been played.
+
+    The "user" parameter is the same value that was passed to newTrack()
+ */
+typedef void (*ANPAudioCallbackProc)(ANPAudioEvent event, void* user,
+                                     ANPAudioBuffer* buffer);
+
+struct ANPAudioTrack;   // abstract type for audio tracks
+
+struct ANPAudioTrackInterfaceV0 : ANPInterface {
+    /** Create a new audio track, or NULL on failure. The track is initially in
+        the stopped state and therefore ANPAudioCallbackProc will not be called
+        until the track is started.
+     */
+    ANPAudioTrack*  (*newTrack)(uint32_t sampleRate,    // sampling rate in Hz
+                                ANPSampleFormat,
+                                int channelCount,       // MONO=1, STEREO=2
+                                ANPAudioCallbackProc,
+                                void* user);
+    /** Deletes a track that was created using newTrack.  The track can be
+        deleted in any state and it waits for the ANPAudioCallbackProc thread
+        to exit before returning.
+     */
+    void (*deleteTrack)(ANPAudioTrack*);
+
+    void (*start)(ANPAudioTrack*);
+    void (*pause)(ANPAudioTrack*);
+    void (*stop)(ANPAudioTrack*);
+    /** Returns true if the track is not playing (e.g. pause or stop was called,
+        or start was never called.
+     */
+    bool (*isStopped)(ANPAudioTrack*);
+};
+
+///////////////////////////////////////////////////////////////////////////////
+// DEFINITION OF VALUES PASSED THROUGH NPP_HandleEvent
+
+enum ANPEventTypes {
+    kNull_ANPEventType          = 0,
+    kKey_ANPEventType           = 1,
+    /** Mouse events are triggered by either clicking with the navigational pad
+        or by tapping the touchscreen (if the kDown_ANPTouchAction is handled by
+        the plugin then no mouse event is generated).  The kKey_ANPEventFlag has
+        to be set to true in order to receive these events.
+     */
+    kMouse_ANPEventType         = 2,
+    /** Touch events are generated when the user touches on the screen. The
+        kTouch_ANPEventFlag has to be set to true in order to receive these
+        events.
+     */
+    kTouch_ANPEventType         = 3,
+    /** Only triggered by a plugin using the kBitmap_ANPDrawingModel. This event
+        signals that the plugin needs to redraw itself into the provided bitmap.
+     */
+    kDraw_ANPEventType          = 4,
+    kLifecycle_ANPEventType     = 5,
+
+    /** This event type is completely defined by the plugin.
+        When creating an event, the caller must always set the first
+        two fields, the remaining data is optional.
+            ANPEvent evt;
+            evt.inSize = sizeof(ANPEvent);
+            evt.eventType = kCustom_ANPEventType
+            // other data slots are optional
+            evt.other[] = ...;
+        To post a copy of the event, call
+            eventInterface->postEvent(myNPPInstance, &evt);
+        That call makes a copy of the event struct, and post that on the event
+        queue for the plugin.
+     */
+    kCustom_ANPEventType   = 6,
+};
+typedef int32_t ANPEventType;
+
+enum ANPKeyActions {
+    kDown_ANPKeyAction  = 0,
+    kUp_ANPKeyAction    = 1,
+};
+typedef int32_t ANPKeyAction;
+
+#include "ANPKeyCodes.h"
+typedef int32_t ANPKeyCode;
+
+enum ANPKeyModifiers {
+    kAlt_ANPKeyModifier     = 1 << 0,
+    kShift_ANPKeyModifier   = 1 << 1,
+};
+// bit-field containing some number of ANPKeyModifier bits
+typedef uint32_t ANPKeyModifier;
+
+enum ANPMouseActions {
+    kDown_ANPMouseAction  = 0,
+    kUp_ANPMouseAction    = 1,
+};
+typedef int32_t ANPMouseAction;
+
+enum ANPTouchActions {
+    /** This occurs when the user first touches on the screen. As such, this
+        action will always occur prior to any of the other touch actions. If
+        the plugin chooses to not handle this action then no other events
+        related to that particular touch gesture will be generated.
+     */
+    kDown_ANPTouchAction        = 0,
+    kUp_ANPTouchAction          = 1,
+    kMove_ANPTouchAction        = 2,
+    kCancel_ANPTouchAction      = 3,
+    // The web view will ignore the return value from the following actions
+    kLongPress_ANPTouchAction   = 4,
+    kDoubleTap_ANPTouchAction   = 5,
+};
+typedef int32_t ANPTouchAction;
+
+enum ANPLifecycleActions {
+    /** The web view containing this plugin has been paused.  See documentation
+        on the android activity lifecycle for more information.
+     */
+    kPause_ANPLifecycleAction           = 0,
+    /** The web view containing this plugin has been resumed. See documentation
+        on the android activity lifecycle for more information.
+     */
+    kResume_ANPLifecycleAction          = 1,
+    /** The plugin has focus and is now the recipient of input events (e.g. key,
+        touch, etc.)
+     */
+    kGainFocus_ANPLifecycleAction       = 2,
+    /** The plugin has lost focus and will not receive any input events until it
+        regains focus. This event is always preceded by a GainFocus action.
+     */
+    kLoseFocus_ANPLifecycleAction       = 3,
+    /** The browser is running low on available memory and is requesting that
+        the plugin free any unused/inactive resources to prevent a performance
+        degradation.
+     */
+    kFreeMemory_ANPLifecycleAction      = 4,
+    /** The page has finished loading. This happens when the page's top level
+        frame reports that it has completed loading.
+     */
+    kOnLoad_ANPLifecycleAction          = 5,
+    /** The browser is honoring the plugin's request to go full screen. Upon
+        returning from this event the browser will resize the plugin's java
+        surface to full-screen coordinates.
+     */
+    kEnterFullScreen_ANPLifecycleAction = 6,
+    /** The browser has exited from full screen mode. Immediately prior to
+        sending this event the browser has resized the plugin's java surface to
+        its original coordinates.
+     */
+    kExitFullScreen_ANPLifecycleAction  = 7,
+    /** The plugin is visible to the user on the screen. This event will always
+        occur after a kOffScreen_ANPLifecycleAction event.
+     */
+    kOnScreen_ANPLifecycleAction        = 8,
+    /** The plugin is no longer visible to the user on the screen. This event
+        will always occur prior to an kOnScreen_ANPLifecycleAction event.
+     */
+    kOffScreen_ANPLifecycleAction       = 9,
+};
+typedef uint32_t ANPLifecycleAction;
+
+/* This is what is passed to NPP_HandleEvent() */
+struct ANPEvent {
+    uint32_t        inSize;  // size of this struct in bytes
+    ANPEventType    eventType;
+    // use based on the value in eventType
+    union {
+        struct {
+            ANPKeyAction    action;
+            ANPKeyCode      nativeCode;
+            int32_t         virtualCode;    // windows virtual key code
+            ANPKeyModifier  modifiers;
+            int32_t         repeatCount;    // 0 for initial down (or up)
+            int32_t         unichar;        // 0 if there is no value
+        } key;
+        struct {
+            ANPMouseAction  action;
+            int32_t         x;  // relative to your "window" (0...width)
+            int32_t         y;  // relative to your "window" (0...height)
+        } mouse;
+        struct {
+            ANPTouchAction  action;
+            ANPKeyModifier  modifiers;
+            int32_t         x;  // relative to your "window" (0...width)
+            int32_t         y;  // relative to your "window" (0...height)
+        } touch;
+        struct {
+            ANPLifecycleAction  action;
+        } lifecycle;
+        struct {
+            ANPDrawingModel model;
+            // relative to (0,0) in top-left of your plugin
+            ANPRectI        clip;
+            // use based on the value in model
+            union {
+                ANPBitmap   bitmap;
+            } data;
+        } draw;
+        int32_t     other[8];
+    } data;
+};
+
+struct ANPEventInterfaceV0 : ANPInterface {
+    /** Post a copy of the specified event to the plugin. The event will be
+        delivered to the plugin in its main thread (the thread that receives
+        other ANPEvents). If, after posting before delivery, the NPP instance
+        is torn down, the event will be discarded.
+     */
+    void (*postEvent)(NPP inst, const ANPEvent* event);
+};
+
+struct ANPSystemInterfaceV0 : ANPInterface {
+    /** Return the path name for the current Application's plugin data directory,
+        or NULL if not supported
+     */
+    const char* (*getApplicationDataDirectory)();
+
+    /** A helper function to load java classes from the plugin's apk.  The
+        function looks for a class given the fully qualified and null terminated
+        string representing the className. For example,
+
+        const char* className = "com.android.mypackage.MyClass";
+
+        If the class cannot be found or there is a problem loading the class
+        NULL will be returned.
+     */
+    jclass (*loadJavaClass)(NPP instance, const char* className);
+};
+
+struct ANPSurfaceInterfaceV0 : ANPInterface {
+  /** Locks the surface from manipulation by other threads and provides a bitmap
+        to be written to.  The dirtyRect param specifies which portion of the
+        bitmap will be written to.  If the dirtyRect is NULL then the entire
+        surface will be considered dirty.  If the lock was successful the function
+        will return true and the bitmap will be set to point to a valid bitmap.
+        If not the function will return false and the bitmap will be set to NULL.
+  */
+  bool (*lock)(JNIEnv* env, jobject surface, ANPBitmap* bitmap, ANPRectI* dirtyRect);
+  /** Given a locked surface handle (i.e. result of a successful call to lock)
+        the surface is unlocked and the contents of the bitmap, specifically
+        those inside the dirtyRect are written to the screen.
+  */
+  void (*unlock)(JNIEnv* env, jobject surface);
+};
+
+typedef int32_t   int32;
+typedef uint32_t uint32;
+typedef int16_t   int16;
+typedef uint16_t uint16;
+
+#endif
diff --git a/dom/plugins/base/android_npapi.h b/dom/plugins/base/android_npapi.h
new file mode 100644
index 000000000000..e69de29bb2d1
diff --git a/dom/plugins/base/npfunctions.h b/dom/plugins/base/npfunctions.h
index 3b70a39419df..fe32ce557ee2 100644
--- a/dom/plugins/base/npfunctions.h
+++ b/dom/plugins/base/npfunctions.h
@@ -48,6 +48,10 @@
 #include "npapi.h"
 #include "npruntime.h"
 
+#ifdef ANDROID
+#include <jni.h>
+#endif
+
 typedef NPError      (* NP_LOADDS NPP_NewProcPtr)(NPMIMEType pluginType, NPP instance, uint16_t mode, int16_t argc, char* argn[], char* argv[], NPSavedData* saved);
 typedef NPError      (* NP_LOADDS NPP_DestroyProcPtr)(NPP instance, NPSavedData** save);
 typedef NPError      (* NP_LOADDS NPP_SetWindowProcPtr)(NPP instance, NPWindow* window);
@@ -307,8 +311,13 @@ NP_EXPORT(NPError)     NP_Initialize(NPNetscapeFuncs* bFuncs);
 typedef NPError        (*NP_GetEntryPointsFunc)(NPPluginFuncs*);
 NP_EXPORT(NPError)     NP_GetEntryPoints(NPPluginFuncs* pFuncs);
 #else
-typedef NPError        (*NP_InitializeFunc)(NPNetscapeFuncs*, NPPluginFuncs*);
-NP_EXPORT(NPError)     NP_Initialize(NPNetscapeFuncs* bFuncs, NPPluginFuncs* pFuncs);
+#ifdef ANDROID
+typedef NPError    (*NP_InitializeFunc)(NPNetscapeFuncs*, NPPluginFuncs*, JNIEnv* pEnv);
+NP_EXPORT(NPError) NP_Initialize(NPNetscapeFuncs* bFuncs, NPPluginFuncs* pFuncs, JNIEnv* pEnv);
+#else
+typedef NPError    (*NP_InitializeFunc)(NPNetscapeFuncs*, NPPluginFuncs*);
+NP_EXPORT(NPError) NP_Initialize(NPNetscapeFuncs* bFuncs, NPPluginFuncs* pFuncs);
+#endif
 #endif
 typedef NPError        (*NP_ShutdownFunc)(void);
 NP_EXPORT(NPError)     NP_Shutdown(void);
diff --git a/dom/plugins/base/nsNPAPIPlugin.cpp b/dom/plugins/base/nsNPAPIPlugin.cpp
index fc6788d6d9ac..a360f29b7039 100644
--- a/dom/plugins/base/nsNPAPIPlugin.cpp
+++ b/dom/plugins/base/nsNPAPIPlugin.cpp
@@ -127,6 +127,13 @@ using mozilla::plugins::PluginModuleParent;
 #include <windows.h>
 #endif
 
+#ifdef ANDROID
+#include "ANPBase.h"
+#include "AndroidBridge.h"
+#include <android/log.h>
+#define LOG(args...)  __android_log_print(ANDROID_LOG_INFO, "GeckoPlugins" , ## args)
+#endif
+
 using namespace mozilla;
 using namespace mozilla::plugins::parent;
 
@@ -477,7 +484,7 @@ nsNPAPIPlugin::CreatePlugin(nsPluginTag *aPluginTag, nsNPAPIPlugin** aResult)
     return NS_ERROR_FAILURE;
   }
 
-#ifdef XP_MACOSX
+#if defined(XP_MACOSX) || defined(ANDROID)
   if (!pluginLib->HasRequiredFunctions()) {
     NS_WARNING("Not all necessary functions exposed by plugin, it will not load.");
     return NS_ERROR_FAILURE;
@@ -2264,6 +2271,112 @@ _getvalue(NPP npp, NPNVariable variable, void *result)
   }
 #endif
 
+#ifdef ANDROID
+    case kLogInterfaceV0_ANPGetValue: {
+      LOG("get log interface");
+      ANPLogInterfaceV0 *i = (ANPLogInterfaceV0 *) result;
+      InitLogInterface(i);
+      return NPERR_NO_ERROR;
+    }
+
+    case kBitmapInterfaceV0_ANPGetValue: {
+      LOG("get bitmap interface");
+      ANPBitmapInterfaceV0 *i = (ANPBitmapInterfaceV0 *) result;
+      InitBitmapInterface(i);
+      return NPERR_NO_ERROR;
+    }
+
+    case kMatrixInterfaceV0_ANPGetValue: {
+      LOG("get matrix interface");
+      ANPMatrixInterfaceV0 *i = (ANPMatrixInterfaceV0 *) result;
+      InitMatrixInterface(i);
+      return NPERR_NO_ERROR;
+    }
+      
+    case kPathInterfaceV0_ANPGetValue: {
+      LOG("get path interface");
+      ANPPathInterfaceV0 *i = (ANPPathInterfaceV0 *) result;
+      InitPathInterface(i);
+      return NPERR_NO_ERROR;
+    }
+      
+    case kTypefaceInterfaceV0_ANPGetValue: {
+      LOG("get typeface interface");
+      ANPTypefaceInterfaceV0 *i = (ANPTypefaceInterfaceV0 *) result;
+      InitTypeFaceInterface(i);
+      return NPERR_NO_ERROR;
+    }
+
+    case kPaintInterfaceV0_ANPGetValue: {
+      LOG("get paint interface");
+      ANPPaintInterfaceV0 *i = (ANPPaintInterfaceV0 *) result;
+      InitPaintInterface(i);
+      return NPERR_NO_ERROR;
+    }
+
+    case kCanvasInterfaceV0_ANPGetValue: {
+      LOG("get canvas interface");
+      ANPCanvasInterfaceV0 *i = (ANPCanvasInterfaceV0 *) result;
+      InitCanvasInterface(i);
+      return NPERR_NO_ERROR;
+    }
+
+    case kWindowInterfaceV0_ANPGetValue: {
+      LOG("get window interface");
+      ANPWindowInterfaceV0 *i = (ANPWindowInterfaceV0 *) result;
+      InitWindowInterface(i);
+      return NPERR_NO_ERROR;
+    }
+
+    case kAudioTrackInterfaceV0_ANPGetValue: {
+      LOG("get audio interface");
+      ANPAudioTrackInterfaceV0 *i = (ANPAudioTrackInterfaceV0 *) result;
+      InitAudioTrackInterface(i);
+      return NPERR_NO_ERROR;
+    }
+
+    case kEventInterfaceV0_ANPGetValue: {
+      LOG("get event interface");
+      ANPEventInterfaceV0 *i = (ANPEventInterfaceV0 *) result;
+      InitEventInterface(i);
+      return NPERR_NO_ERROR;
+    }
+
+    case kSystemInterfaceV0_ANPGetValue: {
+      LOG("get system interface");
+      ANPSystemInterfaceV0* i = reinterpret_cast<ANPSystemInterfaceV0*>(result);
+      InitSystemInterface(i);
+      LOG("done system interface");
+      return NPERR_NO_ERROR;
+    }
+
+    case kSurfaceInterfaceV0_ANPGetValue: {
+      LOG("get surface interface");
+      ANPSurfaceInterfaceV0 *i = (ANPSurfaceInterfaceV0 *) result;
+      InitSurfaceInterface(i);
+      return NPERR_NO_ERROR;
+    }
+      
+    case kSupportedDrawingModel_ANPGetValue: {
+      LOG("get supported drawing model");
+      uint32_t* bits = reinterpret_cast<uint32_t*>(result);
+      *bits = kBitmap_ANPDrawingModel && kSurface_ANPDrawingModel;
+      return NPERR_NO_ERROR;
+    }  
+
+    case kJavaContext_ANPGetValue: {
+      LOG("get context");
+      JNIEnv* env    = GetJNIForThread();
+      jclass cls     = env->FindClass("org/mozilla/gecko/GeckoApp");
+      jfieldID field = env->GetStaticFieldID(cls, "mAppContext",
+                                             "Lorg/mozilla/gecko/GeckoApp;");
+      jobject ret = env->GetStaticObjectField(cls, field);
+      int32_t* i  = reinterpret_cast<int32_t*>(result);
+      *i = reinterpret_cast<int32_t>(ret);
+      return NPERR_NO_ERROR;
+    }
+#endif
+
   // we no longer hand out any XPCOM objects
   case NPNVDOMElement:
     // fall through
@@ -2275,6 +2388,7 @@ _getvalue(NPP npp, NPNVariable variable, void *result)
     *(nsISupports**)result = nsnull;
     // fall through
   default:
+    NPN_PLUGIN_LOG(PLUGIN_LOG_NORMAL, ("NPN_getvalue unhandled get value: %d\n", variable));
     return NPERR_GENERIC_ERROR;
   }
 }
@@ -2374,7 +2488,14 @@ _setvalue(NPP npp, NPPVariable variable, void *result)
       }
     }
 #endif
-
+#ifdef ANDROID
+  case kRequestDrawingModel_ANPSetValue:
+    if (inst)
+      inst->SetDrawingModel(NS_PTR_TO_INT32(result));
+    return NPERR_NO_ERROR;
+  case kAcceptEvents_ANPSetValue:
+    return NPERR_NO_ERROR;
+#endif
     default:
       return NPERR_GENERIC_ERROR;
   }
diff --git a/dom/plugins/base/nsNPAPIPluginInstance.cpp b/dom/plugins/base/nsNPAPIPluginInstance.cpp
index e104f07fc782..aa3f398acbaf 100644
--- a/dom/plugins/base/nsNPAPIPluginInstance.cpp
+++ b/dom/plugins/base/nsNPAPIPluginInstance.cpp
@@ -61,13 +61,22 @@
 #include "nsNetCID.h"
 #include "nsIContent.h"
 
+#ifdef ANDROID
+#include "ANPBase.h"
+#include <android/log.h>
+#include "android_npapi.h"
+#include "mozilla/Mutex.h"
+#include "mozilla/CondVar.h"
+#include "AndroidBridge.h"
+#endif
+
 using namespace mozilla;
 using namespace mozilla::plugins::parent;
 
 static NS_DEFINE_IID(kIOutputStreamIID, NS_IOUTPUTSTREAM_IID);
 static NS_DEFINE_IID(kIPluginStreamListenerIID, NS_IPLUGINSTREAMLISTENER_IID);
 
-NS_IMPL_ISUPPORTS0(nsNPAPIPluginInstance)
+NS_IMPL_THREADSAFE_ISUPPORTS0(nsNPAPIPluginInstance)
 
 nsNPAPIPluginInstance::nsNPAPIPluginInstance(nsNPAPIPlugin* plugin)
   :
@@ -77,6 +86,10 @@ nsNPAPIPluginInstance::nsNPAPIPluginInstance(nsNPAPIPlugin* plugin)
 #else
     mDrawingModel(NPDrawingModelQuickDraw),
 #endif
+#endif
+#ifdef ANDROID
+    mSurface(nsnull),
+    mDrawingModel(0),
 #endif
     mRunning(NOT_STARTED),
     mWindowless(PR_FALSE),
@@ -684,7 +697,7 @@ nsNPAPIPluginInstance::UsesDOMForCursor()
   return mUsesDOMForCursor;
 }
 
-#ifdef XP_MACOSX
+#if defined(XP_MACOSX)
 void nsNPAPIPluginInstance::SetDrawingModel(NPDrawingModel aModel)
 {
   mDrawingModel = aModel;
@@ -702,12 +715,69 @@ void nsNPAPIPluginInstance::SetEventModel(NPEventModel aModel)
 
   owner->SetEventModel(aModel);
 }
+#endif
+
+#if defined(ANDROID)
+void nsNPAPIPluginInstance::SetDrawingModel(PRUint32 aModel)
+{
+  mDrawingModel = aModel;
+}
+
+class SurfaceGetter : public nsRunnable {
+public:
+  SurfaceGetter(NPPluginFuncs* aPluginFunctions, NPP_t aNPP) : 
+    mHaveSurface(PR_FALSE), mPluginFunctions(aPluginFunctions), mNPP(aNPP) {
+    mLock = new Mutex("SurfaceGetter::Lock");
+    mCondVar = new CondVar(*mLock, "SurfaceGetter::CondVar");
+    
+  }
+  ~SurfaceGetter() {
+    delete mLock;
+    delete mCondVar;
+  }
+  nsresult Run() {
+    MutexAutoLock lock(*mLock);
+    (*mPluginFunctions->getvalue)(&mNPP, kJavaSurface_ANPGetValue, &mSurface);
+    mHaveSurface = PR_TRUE;
+    mCondVar->Notify();
+    return NS_OK;
+  }
+  void* GetSurface() {
+    MutexAutoLock lock(*mLock);
+    mHaveSurface = PR_FALSE;
+    AndroidBridge::Bridge()->PostToJavaThread(this);
+    while (!mHaveSurface)
+      mCondVar->Wait();
+    return mSurface;
+  }
+private:
+  NPP_t mNPP;
+  void* mSurface;
+  Mutex* mLock;
+  CondVar* mCondVar;
+  PRBool mHaveSurface;
+  NPPluginFuncs* mPluginFunctions;
+};
+
+
+void* nsNPAPIPluginInstance::GetJavaSurface()
+{
+  if (mDrawingModel != kSurface_ANPDrawingModel)
+    return nsnull;
+  
+  if (mSurface)
+    return mSurface;
+
+  nsCOMPtr<SurfaceGetter> sg = new SurfaceGetter(mPlugin->PluginFuncs(), mNPP);
+  mSurface = sg->GetSurface();
+  return mSurface;
+}
 
 #endif
 
 nsresult nsNPAPIPluginInstance::GetDrawingModel(PRInt32* aModel)
 {
-#ifdef XP_MACOSX
+#if defined(XP_MACOSX) || defined(ANDROID)
   *aModel = (PRInt32)mDrawingModel;
   return NS_OK;
 #else
@@ -806,7 +876,12 @@ nsNPAPIPluginInstance::DefineJavaProperties()
 nsresult
 nsNPAPIPluginInstance::IsWindowless(PRBool* isWindowless)
 {
+#ifdef ANDROID
+  // On android, pre-honeycomb, all plugins are treated as windowless.
+  *isWindowless = PR_TRUE;
+#else
   *isWindowless = mWindowless;
+#endif
   return NS_OK;
 }
 
@@ -1066,6 +1141,28 @@ nsNPAPIPluginInstance::PrivateModeStateChanged()
   return NS_ERROR_FAILURE;
 }
 
+class DelayUnscheduleEvent : public nsRunnable {
+public:
+  nsRefPtr<nsNPAPIPluginInstance> mInstance;
+  uint32_t mTimerID;
+  DelayUnscheduleEvent(nsNPAPIPluginInstance* aInstance, uint32_t aTimerId)
+    : mInstance(aInstance)
+    , mTimerID(aTimerId)
+  {}
+
+  ~DelayUnscheduleEvent() {}
+
+  NS_IMETHOD Run();
+};
+
+NS_IMETHODIMP
+DelayUnscheduleEvent::Run()
+{
+  mInstance->UnscheduleTimer(mTimerID);
+  return NS_OK;
+}
+
+
 static void
 PluginTimerCallback(nsITimer *aTimer, void *aClosure)
 {
@@ -1073,7 +1170,11 @@ PluginTimerCallback(nsITimer *aTimer, void *aClosure)
   NPP npp = t->npp;
   uint32_t id = t->id;
 
+  // Some plugins (Flash on Android) calls unscheduletimer
+  // from this callback.
+  t->inCallback = PR_TRUE;
   (*(t->callback))(npp, id);
+  t->inCallback = PR_FALSE;
 
   // Make sure we still have an instance and the timer is still alive
   // after the callback.
@@ -1107,6 +1208,7 @@ nsNPAPIPluginInstance::ScheduleTimer(uint32_t interval, NPBool repeat, void (*ti
 {
   nsNPAPITimer *newTimer = new nsNPAPITimer();
 
+  newTimer->inCallback = PR_FALSE;
   newTimer->npp = &mNPP;
 
   // generate ID that is unique to this instance
@@ -1144,6 +1246,12 @@ nsNPAPIPluginInstance::UnscheduleTimer(uint32_t timerID)
   if (!t)
     return;
 
+  if (t->inCallback) {
+    nsCOMPtr<nsIRunnable> e = new DelayUnscheduleEvent(this, timerID);
+    NS_DispatchToCurrentThread(e);
+    return;
+  }
+
   // cancel the timer
   t->timer->Cancel();
 
diff --git a/dom/plugins/base/nsNPAPIPluginInstance.h b/dom/plugins/base/nsNPAPIPluginInstance.h
index 555ef755718b..ef7cedd4e1a5 100644
--- a/dom/plugins/base/nsNPAPIPluginInstance.h
+++ b/dom/plugins/base/nsNPAPIPluginInstance.h
@@ -68,6 +68,7 @@ public:
   uint32_t id;
   nsCOMPtr<nsITimer> timer;
   void (*callback)(NPP npp, uint32_t timerID);
+  PRBool inCallback;
 };
 
 class nsNPAPIPluginInstance : public nsISupports
@@ -85,6 +86,9 @@ public:
   nsresult NewStreamToPlugin(nsIPluginStreamListener** listener);
   nsresult NewStreamFromPlugin(const char* type, const char* target, nsIOutputStream* *result);
   nsresult Print(NPPrint* platformPrint);
+#ifdef ANDROID
+  nsresult PostEvent(void* event) { return 0; };
+#endif
   nsresult HandleEvent(void* event, PRInt16* result);
   nsresult GetValueFromPlugin(NPPVariable variable, void* value);
   nsresult GetDrawingModel(PRInt32* aModel);
@@ -141,6 +145,11 @@ public:
   void SetEventModel(NPEventModel aModel);
 #endif
 
+#ifdef ANDROID
+  void SetDrawingModel(PRUint32 aModel);
+  void* GetJavaSurface();
+#endif
+
   nsresult NewStreamListener(const char* aURL, void* notifyData,
                              nsIPluginStreamListener** listener);
 
@@ -207,6 +216,10 @@ protected:
   NPDrawingModel mDrawingModel;
 #endif
 
+#ifdef ANDROID
+  PRUint32 mDrawingModel;
+#endif
+
   enum {
     NOT_STARTED,
     RUNNING,
@@ -250,6 +263,9 @@ private:
   nsCOMPtr<nsIURI> mURI;
 
   PRPackedBool mUsePluginLayersPref;
+#ifdef ANDROID
+  void* mSurface;
+#endif
 };
 
 #endif // nsNPAPIPluginInstance_h_
diff --git a/dom/plugins/base/nsPluginHost.cpp b/dom/plugins/base/nsPluginHost.cpp
index 7c2c5d13f454..689e01b68743 100644
--- a/dom/plugins/base/nsPluginHost.cpp
+++ b/dom/plugins/base/nsPluginHost.cpp
@@ -159,6 +159,11 @@
 #include "winbase.h"
 #endif
 
+#ifdef ANDROID
+#include <android/log.h>
+#define LOG(args...)  __android_log_print(ANDROID_LOG_INFO, "GeckoPlugins" , ## args)
+#endif
+
 using namespace mozilla;
 using mozilla::TimeStamp;
 
@@ -2229,7 +2234,7 @@ nsresult nsPluginHost::ScanPluginsDirectoryList(nsISimpleEnumerator *dirEnum,
       nsCOMPtr<nsIFile> nextDir(do_QueryInterface(supports, &rv));
       if (NS_FAILED(rv))
         continue;
-
+      
       // don't pass aPluginsChanged directly to prevent it from been reset
       PRBool pluginschanged = PR_FALSE;
       ScanPluginsDirectory(nextDir, aCreatePluginList, &pluginschanged);
@@ -2324,6 +2329,10 @@ nsresult nsPluginHost::FindPlugins(PRBool aCreatePluginList, PRBool * aPluginsCh
       NS_ITERATIVE_UNREF_LIST(nsRefPtr<nsInvalidPluginTag>, mInvalidPlugins, mNext);
       return NS_OK;
     }
+  } else {
+#ifdef ANDROID
+    LOG("getting plugins dir failed");
+#endif
   }
 
   mPluginsLoaded = PR_TRUE; // at this point 'some' plugins have been loaded,
diff --git a/dom/plugins/base/nsPluginInstanceOwner.cpp b/dom/plugins/base/nsPluginInstanceOwner.cpp
index 54d98a6df3bc..89d6df61165b 100644
--- a/dom/plugins/base/nsPluginInstanceOwner.cpp
+++ b/dom/plugins/base/nsPluginInstanceOwner.cpp
@@ -44,6 +44,8 @@
  *
  * ***** END LICENSE BLOCK ***** */
 
+#include "base/basictypes.h"
+
 #ifdef MOZ_WIDGET_QT
 #include <QWidget>
 #include <QKeyEvent>
@@ -118,6 +120,16 @@ static NS_DEFINE_CID(kAppShellCID, NS_APPSHELL_CID);
 #include "gfxXlibNativeRenderer.h"
 #endif
 
+#ifdef ANDROID
+#include "ANPBase.h"
+#include "android_npapi.h"
+#include "AndroidBridge.h"
+using namespace mozilla::dom;
+
+#include <android/log.h>
+#define LOG(args...)  __android_log_print(ANDROID_LOG_INFO, "GeckoPlugins" , ## args)
+#endif
+
 using namespace mozilla;
 
 // special class for handeling DOM context menu events because for
@@ -1255,7 +1267,7 @@ nsresult nsPluginInstanceOwner::EnsureCachedAttrParamArrays()
 
   // Add PARAM and null separator.
   mCachedAttrParamNames [nextAttrParamIndex] = ToNewUTF8String(NS_LITERAL_STRING("PARAM"));
-  mCachedAttrParamValues[nextAttrParamIndex] = nsnull;
+  mCachedAttrParamValues[nextAttrParamIndex] = ToNewUTF8String(NS_LITERAL_STRING(""));
   nextAttrParamIndex++;
 
   // Add PARAM name/value pairs.
@@ -1640,8 +1652,48 @@ void nsPluginInstanceOwner::ScrollPositionDidChange(nscoord aX, nscoord aY)
 #endif
 }
 
+#ifdef ANDROID
+void nsPluginInstanceOwner::RemovePluginView()
+{
+  if (mInstance && mObjectFrame) {
+    void* surface = mInstance->GetJavaSurface();
+    if (surface) {
+      JNIEnv* env = GetJNIForThread();
+      if (env) {
+        jclass cls = env->FindClass("org/mozilla/gecko/GeckoAppShell");
+        jmethodID method = env->GetStaticMethodID(cls,
+                                                  "removePluginView",
+                                                  "(Landroid/view/View;)V");
+        env->CallStaticVoidMethod(cls, method, surface);
+      }
+    }
+  }
+}
+#endif
+
 nsresult nsPluginInstanceOwner::DispatchFocusToPlugin(nsIDOMEvent* aFocusEvent)
 {
+#ifdef ANDROID
+  {
+    ANPEvent event;
+    event.inSize = sizeof(ANPEvent);
+    event.eventType = kLifecycle_ANPEventType;
+
+    nsAutoString eventType;
+    aFocusEvent->GetType(eventType);
+    if (eventType.EqualsLiteral("focus")) {
+      event.data.lifecycle.action = kGainFocus_ANPLifecycleAction;
+    }
+    else if (eventType.EqualsLiteral("blur")) {
+      event.data.lifecycle.action = kLoseFocus_ANPLifecycleAction;
+    }
+    else {
+      NS_ASSERTION(PR_FALSE, "nsPluginInstanceOwner::DispatchFocusToPlugin, wierd eventType");   
+    }
+    mInstance->HandleEvent(&event, nsnull);
+  }
+#endif
+
 #ifndef XP_MACOSX
   if (!mPluginWindow || (mPluginWindow->type == NPWindowTypeWindow)) {
     // continue only for cases without child window
@@ -1912,8 +1964,6 @@ static unsigned int XInputEventState(const nsInputEvent& anEvent)
 
 nsEventStatus nsPluginInstanceOwner::ProcessEvent(const nsGUIEvent& anEvent)
 {
-  // printf("nsGUIEvent.message: %d\n", anEvent.message);
-
   nsEventStatus rv = nsEventStatus_eIgnore;
 
   if (!mInstance || !mObjectFrame)   // if mInstance is null, we shouldn't be here
@@ -2436,6 +2486,107 @@ nsEventStatus nsPluginInstanceOwner::ProcessEvent(const nsGUIEvent& anEvent)
     rv = nsEventStatus_eConsumeNoDefault;
 #endif
 
+#ifdef ANDROID
+  // this code supports windowless plugins
+  {
+    // The plugin needs focus to receive keyboard and touch events
+    nsIFocusManager* fm = nsFocusManager::GetFocusManager();
+    if (fm) {
+      nsCOMPtr<nsIDOMElement> elem = do_QueryInterface(mContent);
+      fm->SetFocus(elem, 0);
+    }
+  }
+  switch(anEvent.eventStructType)
+    {
+    case NS_MOUSE_EVENT:
+      {
+        switch (anEvent.message)
+          {
+          case NS_MOUSE_CLICK:
+          case NS_MOUSE_DOUBLECLICK:
+            // Button up/down events sent instead.
+            return rv;
+          }
+
+        // Get reference point relative to plugin origin.
+        const nsPresContext* presContext = mObjectFrame->PresContext();
+        nsPoint appPoint =
+          nsLayoutUtils::GetEventCoordinatesRelativeTo(&anEvent, mObjectFrame) -
+          mObjectFrame->GetContentRectRelativeToSelf().TopLeft();
+        nsIntPoint pluginPoint(presContext->AppUnitsToDevPixels(appPoint.x),
+                               presContext->AppUnitsToDevPixels(appPoint.y));
+
+        switch (anEvent.message)
+          {
+          case NS_MOUSE_MOVE:
+            {
+              // are these going to be touch events?
+              // pluginPoint.x;
+              // pluginPoint.y;
+            }
+            break;
+          case NS_MOUSE_BUTTON_DOWN:
+            {
+              ANPEvent event;
+              event.inSize = sizeof(ANPEvent);
+              event.eventType = kMouse_ANPEventType;
+              event.data.mouse.action = kDown_ANPMouseAction;
+              event.data.mouse.x = pluginPoint.x;
+              event.data.mouse.y = pluginPoint.y;
+              mInstance->HandleEvent(&event, nsnull);
+            }
+            break;
+          case NS_MOUSE_BUTTON_UP:
+            {
+              ANPEvent event;
+              event.inSize = sizeof(ANPEvent);
+              event.eventType = kMouse_ANPEventType;
+              event.data.mouse.action = kUp_ANPMouseAction;
+              event.data.mouse.x = pluginPoint.x;
+              event.data.mouse.y = pluginPoint.y;
+              mInstance->HandleEvent(&event, nsnull);
+            }
+            break;
+          }
+      }
+      break;
+
+    case NS_KEY_EVENT:
+     {
+       const nsKeyEvent& keyEvent = static_cast<const nsKeyEvent&>(anEvent);
+       LOG("Firing NS_KEY_EVENT %d %d\n", keyEvent.keyCode, keyEvent.charCode);
+       
+       int modifiers = 0;
+       if (keyEvent.isShift)
+         modifiers |= kShift_ANPKeyModifier;
+       if (keyEvent.isAlt)
+         modifiers |= kAlt_ANPKeyModifier;
+
+       ANPEvent event;
+       event.inSize = sizeof(ANPEvent);
+       event.eventType = kKey_ANPEventType;
+       event.data.key.nativeCode = keyEvent.keyCode;
+       event.data.key.virtualCode = keyEvent.charCode;
+       event.data.key.modifiers = modifiers;
+       event.data.key.repeatCount = 0;
+       event.data.key.unichar = 0;
+       switch (anEvent.message)
+         {
+         case NS_KEY_DOWN:
+           event.data.key.action = kDown_ANPKeyAction;
+           mInstance->HandleEvent(&event, nsnull);
+           break;
+           
+         case NS_KEY_UP:
+           event.data.key.action = kUp_ANPKeyAction;
+           mInstance->HandleEvent(&event, nsnull);
+           break;
+         }
+     }
+    }
+    rv = nsEventStatus_eConsumeNoDefault;
+#endif
+ 
   return rv;
 }
 
@@ -2541,6 +2692,10 @@ nsPluginInstanceOwner::PrepareToStop(PRBool aDelayedStop)
   }
 #endif
 
+#ifdef ANDROID
+  RemovePluginView();
+#endif
+
   // Unregister scroll position listeners
   for (nsIFrame* f = mObjectFrame; f; f = nsLayoutUtils::GetCrossDocParentFrame(f)) {
     nsIScrollableFrame* sf = do_QueryFrame(f);
@@ -2637,6 +2792,138 @@ void nsPluginInstanceOwner::Paint(const nsRect& aDirtyRect, HPS aHPS)
 }
 #endif
 
+#ifdef ANDROID
+
+class AndroidPaintEventRunnable : public nsRunnable
+{
+public:
+  AndroidPaintEventRunnable(void* aSurface, nsNPAPIPluginInstance* inst, const gfxRect& aFrameRect)
+    : mSurface(aSurface), mInstance(inst), mFrameRect(aFrameRect) {
+  }
+
+  ~AndroidPaintEventRunnable() {
+  }
+
+  NS_IMETHOD Run()
+  {
+    LOG("%p - AndroidPaintEventRunnable::Run\n", this);
+
+    if (!mInstance || !mSurface)
+      return NS_OK;
+
+    // This needs to happen on the gecko main thread.
+    JNIEnv* env = GetJNIForThread();
+    jclass cls = env->FindClass("org/mozilla/gecko/GeckoAppShell");
+    jmethodID method = env->GetStaticMethodID(cls,
+                                              "addPluginView",
+                                              "(Landroid/view/View;DDDD)V");
+    env->CallStaticVoidMethod(cls,
+                              method,
+                              mSurface,
+                              mFrameRect.x,
+                              mFrameRect.y,
+                              mFrameRect.width,
+                              mFrameRect.height);
+    return NS_OK;
+  }
+private:
+  void* mSurface;
+  nsCOMPtr<nsNPAPIPluginInstance> mInstance;
+  gfxRect mFrameRect;
+};
+
+
+void nsPluginInstanceOwner::Paint(gfxContext* aContext,
+                                  const gfxRect& aFrameRect,
+                                  const gfxRect& aDirtyRect)
+{
+  if (!mInstance || !mObjectFrame)
+    return;
+
+  PRInt32 model;
+  mInstance->GetDrawingModel(&model);
+
+  if (model == kSurface_ANPDrawingModel) {
+
+    {
+      ANPEvent event;
+      event.inSize = sizeof(ANPEvent);
+      event.eventType = kLifecycle_ANPEventType;
+      event.data.lifecycle.action = kOnScreen_ANPLifecycleAction;
+      mInstance->HandleEvent(&event, nsnull);
+    }
+
+    /*
+    gfxMatrix currentMatrix = aContext->CurrentMatrix();
+    gfxSize scale = currentMatrix.ScaleFactors(PR_TRUE);
+    printf_stderr("!!!!!!!! scale!!:  %f x %f\n", scale.width, scale.height);
+    */
+
+    JNIEnv* env = GetJNIForThread();
+    jclass cls = env->FindClass("org/mozilla/gecko/GeckoAppShell");
+    jmethodID method = env->GetStaticMethodID(cls,
+                                              "addPluginView",
+                                              "(Landroid/view/View;DDDD)V");
+    env->CallStaticVoidMethod(cls,
+                              method,
+                              mInstance->GetJavaSurface(),
+                              aFrameRect.x,
+                              aFrameRect.y,
+                              aFrameRect.width,
+                              aFrameRect.height);
+    return;
+  }
+
+  if (model != kBitmap_ANPDrawingModel)
+    return;
+
+#ifdef ANP_BITMAP_DRAWING_MODEL
+  static nsRefPtr<gfxImageSurface> pluginSurface;
+
+  if (pluginSurface == nsnull ||
+      aFrameRect.width  != pluginSurface->Width() ||
+      aFrameRect.height != pluginSurface->Height()) {
+
+    pluginSurface = new gfxImageSurface(gfxIntSize(aFrameRect.width, aFrameRect.height), 
+                                        gfxImageSurface::ImageFormatARGB32);
+    if (!pluginSurface)
+      return;
+  }
+
+  // Clears buffer.  I think this is needed.
+  nsRefPtr<gfxContext> ctx = new gfxContext(pluginSurface);
+  ctx->SetOperator(gfxContext::OPERATOR_CLEAR);
+  ctx->Paint();
+  
+  ANPEvent event;
+  event.inSize = sizeof(ANPEvent);
+  event.eventType = 4;
+  event.data.draw.model = 1;
+  
+  event.data.draw.clip.top     = 0;
+  event.data.draw.clip.left    = 0;
+  event.data.draw.clip.bottom  = aFrameRect.width;
+  event.data.draw.clip.right   = aFrameRect.height;
+  
+  event.data.draw.data.bitmap.format   = kRGBA_8888_ANPBitmapFormat;
+  event.data.draw.data.bitmap.width    = aFrameRect.width;
+  event.data.draw.data.bitmap.height   = aFrameRect.height;
+  event.data.draw.data.bitmap.baseAddr = pluginSurface->Data();
+  event.data.draw.data.bitmap.rowBytes = aFrameRect.width * 4;
+  
+  if (!mInstance)
+    return;
+    
+  mInstance->HandleEvent(&event, nsnull);
+
+  aContext->SetOperator(gfxContext::OPERATOR_SOURCE);
+  aContext->SetSource(pluginSurface, gfxPoint(aFrameRect.x, aFrameRect.y));
+  aContext->Clip(aFrameRect);
+  aContext->Paint();
+#endif
+}
+#endif
+
 #if defined(MOZ_X11)
 void nsPluginInstanceOwner::Paint(gfxContext* aContext,
                                   const gfxRect& aFrameRect,
@@ -3274,9 +3561,28 @@ void nsPluginInstanceOwner::UpdateWindowPositionAndClipRect(PRBool aSetWindow)
   if (mPluginWindowVisible && mPluginDocumentActiveState) {
     mPluginWindow->clipRect.right = mPluginWindow->width;
     mPluginWindow->clipRect.bottom = mPluginWindow->height;
+#ifdef ANDROID
+    if (mInstance) {
+      ANPEvent event;
+      event.inSize = sizeof(ANPEvent);
+      event.eventType = kLifecycle_ANPEventType;
+      event.data.lifecycle.action = kOnScreen_ANPLifecycleAction;
+      mInstance->HandleEvent(&event, nsnull);
+    }
+#endif
   } else {
     mPluginWindow->clipRect.right = 0;
     mPluginWindow->clipRect.bottom = 0;
+#ifdef ANDROID
+    if (mInstance) {
+      ANPEvent event;
+      event.inSize = sizeof(ANPEvent);
+      event.eventType = kLifecycle_ANPEventType;
+      event.data.lifecycle.action = kOffScreen_ANPLifecycleAction;
+      mInstance->HandleEvent(&event, nsnull);
+    }
+    RemovePluginView();
+#endif
   }
 
   if (!aSetWindow)
diff --git a/dom/plugins/base/nsPluginInstanceOwner.h b/dom/plugins/base/nsPluginInstanceOwner.h
index 682087105d97..f5f23ddb07f8 100644
--- a/dom/plugins/base/nsPluginInstanceOwner.h
+++ b/dom/plugins/base/nsPluginInstanceOwner.h
@@ -144,7 +144,7 @@ public:
   void Paint(const gfxRect& aDirtyRect, CGContextRef cgContext);  
   void RenderCoreAnimation(CGContextRef aCGContext, int aWidth, int aHeight);
   void DoCocoaEventDrawRect(const gfxRect& aDrawRect, CGContextRef cgContext);
-#elif defined(MOZ_X11)
+#elif defined(MOZ_X11) || defined(ANDROID)
   void Paint(gfxContext* aContext,
              const gfxRect& aFrameRect,
              const gfxRect& aDirtyRect);
@@ -308,7 +308,10 @@ private:
   }
   
   void FixUpURLS(const nsString &name, nsAString &value);
-  
+#ifdef ANDROID
+  void RemovePluginView();
+#endif 
+ 
   nsPluginNativeWindow       *mPluginWindow;
   nsRefPtr<nsNPAPIPluginInstance> mInstance;
   nsObjectFrame              *mObjectFrame; // owns nsPluginInstanceOwner
diff --git a/dom/plugins/base/nsPluginsDirUnix.cpp b/dom/plugins/base/nsPluginsDirUnix.cpp
index ea8170a938bf..f761d1d2a157 100644
--- a/dom/plugins/base/nsPluginsDirUnix.cpp
+++ b/dom/plugins/base/nsPluginsDirUnix.cpp
@@ -247,6 +247,16 @@ PRBool nsPluginsDir::IsPluginFile(nsIFile* file)
     if (NS_FAILED(file->GetNativeLeafName(filename)))
         return PR_FALSE;
 
+#ifdef ANDROID
+    // It appears that if you load
+    // 'libstagefright_honeycomb.so' on froyo, or
+    // 'libstagefright_froyo.so' on honeycomb, we will abort.
+    // Since these are just helper libs, we can ignore.
+    const char *cFile = filename.get();
+    if (strstr(cFile, "libstagefright") != NULL)
+        return PR_FALSE;
+#endif
+
     NS_NAMED_LITERAL_CSTRING(dllSuffix, LOCAL_PLUGIN_DLL_SUFFIX);
     if (filename.Length() > dllSuffix.Length() &&
         StringEndsWith(filename, dllSuffix))
diff --git a/embedding/android/AndroidManifest.xml.in b/embedding/android/AndroidManifest.xml.in
index 3b7eb3661968..240f516be1d6 100644
--- a/embedding/android/AndroidManifest.xml.in
+++ b/embedding/android/AndroidManifest.xml.in
@@ -19,6 +19,13 @@
     <uses-permission android:name="android.permission.READ_PHONE_STATE"/>
     <uses-permission android:name="com.android.launcher.permission.INSTALL_SHORTCUT"/>
 
+    <uses-permission android:name="android.permission.READ_LOGS"/>
+    <uses-permission android:name="android.permission.WAKE_LOCK"/>
+    <uses-permission android:name="android.permission.ACCESS_WIFI_STATE"/>
+    <uses-permission android:name="android.permission.CHANGE_NETWORK_STATE"/> 
+    <uses-permission android:name="android.permission.ACCESS_NETWORK_STATE"/>
+    <uses-permission android:name="android.permission.CHANGE_NETWORK_STATE"/>
+
     <uses-feature android:name="android.hardware.location" android:required="false"/>
     <uses-feature android:name="android.hardware.location.gps" android:required="false"/>
     <uses-feature android:name="android.hardware.touchscreen"/>
diff --git a/embedding/android/GeckoApp.java b/embedding/android/GeckoApp.java
index d4b1c5c9f982..02765866361b 100644
--- a/embedding/android/GeckoApp.java
+++ b/embedding/android/GeckoApp.java
@@ -45,6 +45,7 @@ import java.util.zip.*;
 import java.nio.*;
 import java.nio.channels.FileChannel;
 import java.util.concurrent.*;
+import java.lang.reflect.*;
 
 import android.os.*;
 import android.app.*;
@@ -62,6 +63,9 @@ import android.net.*;
 import android.database.*;
 import android.provider.*;
 import android.telephony.*;
+import android.content.pm.*;
+import android.content.pm.PackageManager.*;
+import dalvik.system.*;
 
 abstract public class GeckoApp
     extends Activity
@@ -74,7 +78,7 @@ abstract public class GeckoApp
     public static final String ACTION_DEBUG       = "org.mozilla.gecko.DEBUG";
     public static final String ACTION_BOOKMARK    = "org.mozilla.gecko.BOOKMARK";
 
-    public static FrameLayout mainLayout;
+    public static AbsoluteLayout mainLayout;
     public static GeckoSurfaceView surfaceView;
     public static GeckoApp mAppContext;
     public static boolean mFullscreen = false;
@@ -130,6 +134,151 @@ abstract public class GeckoApp
                                }).show();
     }
 
+    public static final String PLUGIN_ACTION = "android.webkit.PLUGIN";
+
+    /**
+     * A plugin that wish to be loaded in the WebView must provide this permission
+     * in their AndroidManifest.xml.
+     */
+    public static final String PLUGIN_PERMISSION = "android.webkit.permission.PLUGIN";
+
+    private static final String LOGTAG = "PluginManager";
+
+    private static final String PLUGIN_SYSTEM_LIB = "/system/lib/plugins/";
+
+    private static final String PLUGIN_TYPE = "type";
+    private static final String TYPE_NATIVE = "native";
+    public ArrayList<PackageInfo> mPackageInfoCache = new ArrayList<PackageInfo>();
+
+    String[] getPluginDirectories() {
+
+        ArrayList<String> directories = new ArrayList<String>();
+        PackageManager pm = this.mAppContext.getPackageManager();
+        List<ResolveInfo> plugins = pm.queryIntentServices(new Intent(PLUGIN_ACTION),
+                PackageManager.GET_SERVICES | PackageManager.GET_META_DATA);
+
+        synchronized(mPackageInfoCache) {
+
+            // clear the list of existing packageInfo objects
+            mPackageInfoCache.clear();
+
+
+            for (ResolveInfo info : plugins) {
+
+                // retrieve the plugin's service information
+                ServiceInfo serviceInfo = info.serviceInfo;
+                if (serviceInfo == null) {
+                    Log.w(LOGTAG, "Ignore bad plugin");
+                    continue;
+                }
+
+                Log.w(LOGTAG, "Loading plugin: " + serviceInfo.packageName);
+
+
+                // retrieve information from the plugin's manifest
+                PackageInfo pkgInfo;
+                try {
+                    pkgInfo = pm.getPackageInfo(serviceInfo.packageName,
+                                    PackageManager.GET_PERMISSIONS
+                                    | PackageManager.GET_SIGNATURES);
+                } catch (Exception e) {
+                    Log.w(LOGTAG, "Can't find plugin: " + serviceInfo.packageName);
+                    continue;
+                }
+                if (pkgInfo == null) {
+                    Log.w(LOGTAG, "Loading plugin: " + serviceInfo.packageName + ". Could not load package information.");
+                    continue;
+                }
+
+                /*
+                 * find the location of the plugin's shared library. The default
+                 * is to assume the app is either a user installed app or an
+                 * updated system app. In both of these cases the library is
+                 * stored in the app's data directory.
+                 */
+                String directory = pkgInfo.applicationInfo.dataDir + "/lib";
+                final int appFlags = pkgInfo.applicationInfo.flags;
+                final int updatedSystemFlags = ApplicationInfo.FLAG_SYSTEM |
+                                               ApplicationInfo.FLAG_UPDATED_SYSTEM_APP;
+                // preloaded system app with no user updates
+                if ((appFlags & updatedSystemFlags) == ApplicationInfo.FLAG_SYSTEM) {
+                    directory = PLUGIN_SYSTEM_LIB + pkgInfo.packageName;
+                }
+
+                // check if the plugin has the required permissions
+                String permissions[] = pkgInfo.requestedPermissions;
+                if (permissions == null) {
+                    Log.w(LOGTAG, "Loading plugin: " + serviceInfo.packageName + ". Does not have required permission.");
+                    continue;
+                }
+                boolean permissionOk = false;
+                for (String permit : permissions) {
+                    if (PLUGIN_PERMISSION.equals(permit)) {
+                        permissionOk = true;
+                        break;
+                    }
+                }
+                if (!permissionOk) {
+                    Log.w(LOGTAG, "Loading plugin: " + serviceInfo.packageName + ". Does not have required permission (2).");
+                    continue;
+                }
+
+                // check to ensure the plugin is properly signed
+                Signature signatures[] = pkgInfo.signatures;
+                if (signatures == null) {
+                    Log.w(LOGTAG, "Loading plugin: " + serviceInfo.packageName + ". Not signed.");
+                    continue;
+                }
+
+                // determine the type of plugin from the manifest
+                if (serviceInfo.metaData == null) {
+                    Log.e(LOGTAG, "The plugin '" + serviceInfo.name + "' has no type defined");
+                    continue;
+                }
+
+                String pluginType = serviceInfo.metaData.getString(PLUGIN_TYPE);
+                if (!TYPE_NATIVE.equals(pluginType)) {
+                    Log.e(LOGTAG, "Unrecognized plugin type: " + pluginType);
+                    continue;
+                }
+
+                try {
+                    Class<?> cls = getPluginClass(serviceInfo.packageName, serviceInfo.name);
+
+                    //TODO implement any requirements of the plugin class here!
+                    boolean classFound = true;
+
+                    if (!classFound) {
+                        Log.e(LOGTAG, "The plugin's class' " + serviceInfo.name + "' does not extend the appropriate class.");
+                        continue;
+                    }
+
+                } catch (NameNotFoundException e) {
+                    Log.e(LOGTAG, "Can't find plugin: " + serviceInfo.packageName);
+                    continue;
+                } catch (ClassNotFoundException e) {
+                    Log.e(LOGTAG, "Can't find plugin's class: " + serviceInfo.name);
+                    continue;
+                }
+
+                // if all checks have passed then make the plugin available
+                mPackageInfoCache.add(pkgInfo);
+                directories.add(directory);
+            }
+        }
+
+        return directories.toArray(new String[directories.size()]);
+    }
+
+    Class<?> getPluginClass(String packageName, String className)
+            throws NameNotFoundException, ClassNotFoundException {
+        Context pluginContext = this.mAppContext.createPackageContext(packageName,
+                Context.CONTEXT_INCLUDE_CODE |
+                Context.CONTEXT_IGNORE_SECURITY);
+        ClassLoader pluginCL = pluginContext.getClassLoader();
+        return pluginCL.loadClass(className);
+    }
+
     // Returns true when the intent is going to be handled by gecko launch
     boolean launch(Intent intent)
     {
@@ -229,13 +378,14 @@ abstract public class GeckoApp
         if (surfaceView == null)
             surfaceView = new GeckoSurfaceView(this);
         else
-            mainLayout.removeView(surfaceView);
+            mainLayout.removeAllViews();
 
-        mainLayout = new FrameLayout(this);
+        mainLayout = new AbsoluteLayout(this);
         mainLayout.addView(surfaceView,
-                           new FrameLayout.LayoutParams(FrameLayout.LayoutParams.FILL_PARENT,
-                                                        FrameLayout.LayoutParams.FILL_PARENT));
-
+                           new AbsoluteLayout.LayoutParams(AbsoluteLayout.LayoutParams.MATCH_PARENT, // level 8
+                                                           AbsoluteLayout.LayoutParams.MATCH_PARENT,
+                                                           0,
+                                                           0));
         setContentView(mainLayout,
                        new ViewGroup.LayoutParams(ViewGroup.LayoutParams.FILL_PARENT,
                                                   ViewGroup.LayoutParams.FILL_PARENT));
diff --git a/embedding/android/GeckoAppShell.java b/embedding/android/GeckoAppShell.java
index e0957678c427..7625e9d0dc10 100644
--- a/embedding/android/GeckoAppShell.java
+++ b/embedding/android/GeckoAppShell.java
@@ -308,6 +308,19 @@ public class GeckoAppShell
             if (intHome != null && intProf != null && intProf.exists())
                 moveDir(intProf, profileDir);
         }
+        try {
+            String[] dirs = GeckoApp.mAppContext.getPluginDirectories();
+            StringBuffer pluginSearchPath = new StringBuffer();
+            for (int i = 0; i < dirs.length; i++) {
+                Log.i("GeckoPlugins", "dir: " + dirs[i]);
+                pluginSearchPath.append(dirs[i]);
+                pluginSearchPath.append(":");
+            }
+            GeckoAppShell.putenv("MOZ_PLUGIN_PATH="+pluginSearchPath);
+        } catch (Exception ex) {
+            Log.i("GeckoPlugins", "exception getting plugin dirs", ex);
+        }
+
         GeckoAppShell.putenv("HOME=" + homeDir);
         GeckoAppShell.putenv("GRE_HOME=" + GeckoApp.sGREDir.getPath());
         Intent i = geckoApp.getIntent();
@@ -395,6 +408,7 @@ public class GeckoAppShell
             combinedArgs += " " + args;
         if (url != null)
             combinedArgs += " " + url;
+
         // and go
         GeckoAppShell.nativeRun(combinedArgs);
     }
@@ -1385,4 +1399,187 @@ public class GeckoAppShell
             return false;
         }
     }
+    public static void addPluginView(final View view,
+                                     final double x, final double y,
+                                     final double w, final double h) {
+
+        Log.i("GeckoAppShell", "addPluginView:" + view + " @ x:" + x + " y:" + y + " w:" + w + " h:" + h ) ;
+
+        getMainHandler().post(new Runnable() { 
+                public void run() {
+                    AbsoluteLayout.LayoutParams lp = new AbsoluteLayout.LayoutParams((int)w,
+                                                                                     (int)h,
+                                                                                     (int)x,
+                                                                                     (int)y);
+
+                    if (GeckoApp.mainLayout.indexOfChild(view) == -1) {
+                        view.setWillNotDraw(false);
+                        if(view instanceof SurfaceView)
+                            ((SurfaceView)view).setZOrderOnTop(true);
+
+                        GeckoApp.mainLayout.addView(view, lp);
+                    }
+                    else
+                    {
+                        try {
+                            GeckoApp.mainLayout.updateViewLayout(view, lp);
+                        } catch (IllegalArgumentException e) {
+                            Log.i("updateViewLayout - IllegalArgumentException", "e:" + e);
+                            // it can be the case where we
+                            // get an update before the view
+                            // is actually attached.
+                        }
+                    }
+                }
+            });
+    }
+
+    public static void removePluginView(final View view) {
+        Log.i("GeckoAppShell", "remove view:" + view);
+        getMainHandler().post(new Runnable() { 
+                public void run() {
+                    try {
+                        GeckoApp.mainLayout.removeView(view);
+                    } catch (Exception e) {}
+                }
+            });
+    }
+
+    public static Class<?> loadPluginClass(String className, String libName) {
+        Log.i("GeckoAppShell", "in loadPluginClass... attempting to access className, then libName.....");
+        Log.i("GeckoAppShell", "className: " + className);
+        Log.i("GeckoAppShell", "libName: " + libName);
+
+        try {
+            String[] split = libName.split("/");
+            String packageName = split[split.length - 3];
+            Log.i("GeckoAppShell", "load \"" + className + "\" from \"" + packageName + 
+                  "\" for \"" + libName + "\"");
+            Context pluginContext = 
+                GeckoApp.mAppContext.createPackageContext(packageName,
+                                                          Context.CONTEXT_INCLUDE_CODE |
+                                                      Context.CONTEXT_IGNORE_SECURITY);
+            ClassLoader pluginCL = pluginContext.getClassLoader();
+            return pluginCL.loadClass(className);
+        } catch (java.lang.ClassNotFoundException cnfe) {
+            Log.i("GeckoAppShell", "class not found", cnfe);
+        } catch (android.content.pm.PackageManager.NameNotFoundException nnfe) {
+            Log.i("GeckoAppShell", "package not found", nnfe);
+        }
+        Log.e("GeckoAppShell", "couldn't find class");
+        return null;
+    }
+
+    static HashMap<SurfaceView, SurfaceLockInfo> sSufaceMap = new HashMap<SurfaceView, SurfaceLockInfo>();
+
+    public static void lockSurfaceANP()
+    {
+         Log.i("GeckoAppShell", "other lockSurfaceANP");
+    }
+
+    public static org.mozilla.gecko.SurfaceLockInfo lockSurfaceANP(android.view.SurfaceView sview, int top, int left, int bottom, int right)
+    {
+        Log.i("GeckoAppShell", "real lockSurfaceANP " + sview + ", " + top + ",  " + left + ", " + bottom + ", " + right);
+        if (sview == null)
+            return null;
+
+        int format = -1;
+        try {
+            Field privateFormatField = SurfaceView.class.getDeclaredField("mFormat");
+            privateFormatField.setAccessible(true);
+            format = privateFormatField.getInt(sview);
+        } catch (Exception e) {
+            Log.i("GeckoAppShell", "mFormat is not a field of sview: ", e);
+        }
+
+        int n = 0;
+        if (format == PixelFormat.RGB_565)
+            n = 2;
+        else if (format == PixelFormat.RGBA_8888)
+            n = 4;
+
+        if (n == 0)
+            return null;
+
+        SurfaceLockInfo info = sSufaceMap.get(sview);
+        if (info == null) {
+            info = new SurfaceLockInfo();
+            sSufaceMap.put(sview, info);
+        }
+
+        Rect r = new Rect(left, top, right, bottom);
+
+        info.canvas = sview.getHolder().lockCanvas(r);
+        int bufSizeRequired = info.canvas.getWidth() * info.canvas.getHeight() * n;
+        Log.i("GeckoAppShell", "lockSurfaceANP - bufSizeRequired: " + n + " " + info.canvas.getHeight() + " " + info.canvas.getWidth());
+
+        if (info.width != info.canvas.getWidth() || info.height != info.canvas.getHeight() || info.buffer == null || info.buffer.capacity() < bufSizeRequired) {
+            info.width = info.canvas.getWidth();
+            info.height = info.canvas.getHeight();
+
+            // XXX Bitmaps instead of ByteBuffer
+            info.buffer = ByteBuffer.allocateDirect(bufSizeRequired);  //leak
+            Log.i("GeckoAppShell", "!!!!!!!!!!!  lockSurfaceANP - Allocating buffer! " + bufSizeRequired);
+
+        }
+
+        info.canvas.drawColor(Color.WHITE, PorterDuff.Mode.CLEAR);
+
+        info.format = format;
+        info.dirtyTop = top;
+        info.dirtyBottom = bottom;
+        info.dirtyLeft = left;
+        info.dirtyRight = right;
+
+        return info;
+    }
+
+    public static void unlockSurfaceANP(SurfaceView sview) {
+        SurfaceLockInfo info = sSufaceMap.get(sview);
+
+        int n = 0;
+        Bitmap.Config config;
+        if (info.format == PixelFormat.RGB_565) {
+            n = 2;
+            config = Bitmap.Config.RGB_565;
+        } else {
+            n = 4;
+            config = Bitmap.Config.ARGB_8888;
+        }
+
+        Log.i("GeckoAppShell", "unlockSurfaceANP: " + (info.width * info.height * n));
+
+        Bitmap bm = Bitmap.createBitmap(info.width, info.height, config);
+        bm.copyPixelsFromBuffer(info.buffer);
+        info.canvas.drawBitmap(bm, 0, 0, null);
+        sview.getHolder().unlockCanvasAndPost(info.canvas);
+    }
+
+    public static Class getSurfaceLockInfoClass() {
+        Log.i("GeckoAppShell", "class name: " + SurfaceLockInfo.class.getName());
+        return SurfaceLockInfo.class;
+    }
+
+    public static Method getSurfaceLockMethod() {
+        Method[] m = GeckoAppShell.class.getMethods();
+        for (int i = 0; i < m.length; i++) {
+            if (m[i].getName().equals("lockSurfaceANP"))
+                return m[i];
+        }
+        return null;
+    }
+
+    static native void executeNextRunnable();
+
+    static class GeckoRunnableCallback implements Runnable {
+        public void run() {
+            Log.i("GeckoShell", "run GeckoRunnableCallback");
+            GeckoAppShell.executeNextRunnable();
+        }
+    }
+
+    public static void postToJavaThread(boolean mainThread) {
+        Log.i("GeckoShell", "post to " + (mainThread ? "main " : "") + "java thread");
+        getMainHandler().post(new GeckoRunnableCallback());
+    }
 }
diff --git a/embedding/android/Makefile.in b/embedding/android/Makefile.in
index ebda01b067b0..c6a4101e37f5 100644
--- a/embedding/android/Makefile.in
+++ b/embedding/android/Makefile.in
@@ -54,6 +54,7 @@ JAVAFILES = \
   GeckoInputConnection.java \
   GeckoPhoneStateListener.java \
   AlertNotification.java \
+  SurfaceLockInfo.java \
   $(NULL)
 
 PROCESSEDJAVAFILES = \
diff --git a/embedding/android/SurfaceLockInfo.java b/embedding/android/SurfaceLockInfo.java
new file mode 100644
index 000000000000..4dcb7dc2b6a3
--- /dev/null
+++ b/embedding/android/SurfaceLockInfo.java
@@ -0,0 +1,18 @@
+package org.mozilla.gecko;
+
+import android.graphics.Canvas;
+import java.nio.Buffer;
+
+public class SurfaceLockInfo {
+    public int dirtyTop;
+    public int dirtyLeft;
+    public int dirtyRight;
+    public int dirtyBottom;
+
+    public int bpr;
+    public int format;
+    public int width;
+    public int height;
+    public Buffer buffer;
+    public Canvas canvas;
+}
diff --git a/layout/build/Makefile.in b/layout/build/Makefile.in
index 03fc6bfb757c..4da911a5725f 100644
--- a/layout/build/Makefile.in
+++ b/layout/build/Makefile.in
@@ -135,6 +135,7 @@ LOCAL_INCLUDES	+= \
 else ifneq (,$(filter android,$(MOZ_WIDGET_TOOLKIT)))
 SHARED_LIBRARY_LIBS += \
 	$(DEPTH)/dom/system/android/$(LIB_PREFIX)domsystemandroid_s.$(LIB_SUFFIX) \
+	$(DEPTH)/dom/plugins/base/android/$(LIB_PREFIX)gkpluginandroid_s.$(LIB_SUFFIX) \
 	$(NULL)
 LOCAL_INCLUDES	+= \
 	-I$(topsrcdir)/dom/system/android \
diff --git a/layout/generic/nsObjectFrame.cpp b/layout/generic/nsObjectFrame.cpp
index ad1503ae984d..09e3b6f654c3 100644
--- a/layout/generic/nsObjectFrame.cpp
+++ b/layout/generic/nsObjectFrame.cpp
@@ -1683,6 +1683,22 @@ nsObjectFrame::PaintPlugin(nsDisplayListBuilder* aBuilder,
                            nsRenderingContext& aRenderingContext,
                            const nsRect& aDirtyRect, const nsRect& aPluginRect)
 {
+#if defined(ANDROID)
+  if (mInstanceOwner) {
+    NPWindow *window;
+    mInstanceOwner->GetWindow(window);
+
+    gfxRect frameGfxRect =
+      PresContext()->AppUnitsToGfxUnits(aPluginRect);
+    gfxRect dirtyGfxRect =
+      PresContext()->AppUnitsToGfxUnits(aDirtyRect);
+    gfxContext* ctx = aRenderingContext.ThebesContext();
+
+    mInstanceOwner->Paint(ctx, frameGfxRect, dirtyGfxRect);
+    return;
+  }
+#endif
+
   // Screen painting code
 #if defined(XP_MACOSX)
   // delegate all painting to the plugin instance.
diff --git a/other-licenses/android/APKOpen.cpp b/other-licenses/android/APKOpen.cpp
index a917703a7511..d70efc306333 100644
--- a/other-licenses/android/APKOpen.cpp
+++ b/other-licenses/android/APKOpen.cpp
@@ -241,6 +241,7 @@ SHELL_WRAPPER3(callObserver, jstring, jstring, jstring)
 SHELL_WRAPPER1(removeObserver, jstring)
 SHELL_WRAPPER2(onChangeNetworkLinkStatus, jstring, jstring)
 SHELL_WRAPPER1(reportJavaCrash, jstring)
+SHELL_WRAPPER0(executeNextRunnable)
 
 static void * xul_handle = NULL;
 static time_t apk_mtime = 0;
@@ -667,6 +668,7 @@ loadLibs(const char *apkName)
   GETFUNC(removeObserver);
   GETFUNC(onChangeNetworkLinkStatus);
   GETFUNC(reportJavaCrash);
+  GETFUNC(executeNextRunnable);
 #undef GETFUNC
   gettimeofday(&t1, 0);
   struct rusage usage2;
diff --git a/widget/src/android/AndroidBridge.cpp b/widget/src/android/AndroidBridge.cpp
index 972bd4bb0f01..b1b6a638a1b1 100644
--- a/widget/src/android/AndroidBridge.cpp
+++ b/widget/src/android/AndroidBridge.cpp
@@ -149,6 +149,7 @@ AndroidBridge::Init(JNIEnv *jEnv,
     jGetIconForExtension = (jmethodID) jEnv->GetStaticMethodID(jGeckoAppShellClass, "getIconForExtension", "(Ljava/lang/String;I)[B");
     jCreateShortcut = (jmethodID) jEnv->GetStaticMethodID(jGeckoAppShellClass, "createShortcut", "(Ljava/lang/String;Ljava/lang/String;Ljava/lang/String;Ljava/lang/String;)V");
     jGetShowPasswordSetting = (jmethodID) jEnv->GetStaticMethodID(jGeckoAppShellClass, "getShowPasswordSetting", "()Z");
+    jPostToJavaThread = (jmethodID) jEnv->GetStaticMethodID(jGeckoAppShellClass, "postToJavaThread", "(Z)V");
 
     jEGLContextClass = (jclass) jEnv->NewGlobalRef(jEnv->FindClass("javax/microedition/khronos/egl/EGLContext"));
     jEGL10Class = (jclass) jEnv->NewGlobalRef(jEnv->FindClass("javax/microedition/khronos/egl/EGL10"));
@@ -169,8 +170,14 @@ AndroidBridge::Init(JNIEnv *jEnv,
 JNIEnv *
 AndroidBridge::AttachThread(PRBool asDaemon)
 {
+    // If we already have a env, return it
+    JNIEnv *jEnv = NULL;
+    mJavaVM->GetEnv((void**) &jEnv, JNI_VERSION_1_2);
+    if (jEnv)
+        return jEnv;
+
     ALOG_BRIDGE("AndroidBridge::AttachThread");
-    JNIEnv *jEnv = (JNIEnv*) PR_GetThreadPrivate(sJavaEnvThreadIndex);
+    jEnv = (JNIEnv*) PR_GetThreadPrivate(sJavaEnvThreadIndex);
     if (jEnv)
         return jEnv;
 
@@ -195,6 +202,8 @@ AndroidBridge::AttachThread(PRBool asDaemon)
 
     PR_SetThreadPrivate(sJavaEnvThreadIndex, jEnv);
 
+    PR_NewThreadPrivateIndex(&sJavaEnvThreadIndex, JavaThreadDetachFunc);
+
     return jEnv;
 }
 
@@ -926,6 +935,45 @@ AndroidBridge::CreateShortcut(const nsAString& aTitle, const nsAString& aURI, co
   mJNIEnv->CallStaticVoidMethod(mGeckoAppShellClass, jCreateShortcut, jstrTitle, jstrURI, jstrIconData, jstrIntent);
 }
 
+void
+AndroidBridge::PostToJavaThread(nsIRunnable* aRunnable, PRBool aMainThread)
+{
+    __android_log_print(ANDROID_LOG_INFO, "GeckoBridge", "%s", __PRETTY_FUNCTION__);
+    JNIEnv* env = AndroidBridge::AttachThread(false);
+    if (!env) {
+        __android_log_print(ANDROID_LOG_INFO, "GeckoBridge", "no jni env in %s!!", __PRETTY_FUNCTION__);
+        return;
+    }
+    mRunnableQueue.AppendObject(aRunnable);
+    env->CallStaticVoidMethod(mGeckoAppShellClass, jPostToJavaThread, (jboolean)aMainThread);
+
+    jthrowable ex = env->ExceptionOccurred();
+    if (ex) {
+        env->ExceptionDescribe();
+        env->ExceptionClear();
+    }
+    __android_log_print(ANDROID_LOG_INFO, "GeckoBridge", "leaving %s", __PRETTY_FUNCTION__);
+}
+
+void
+AndroidBridge::ExecuteNextRunnable()
+{
+    __android_log_print(ANDROID_LOG_INFO, "GeckoBridge", "%s", __PRETTY_FUNCTION__);
+
+    JNIEnv* env = AndroidBridge::AttachThread(false);
+    if (!env) {
+        __android_log_print(ANDROID_LOG_INFO, "GeckoBridge", "no jni env in %s!!", __PRETTY_FUNCTION__);
+        return;
+    }
+
+    if (mRunnableQueue.Count() > 0) {
+        nsIRunnable* r = mRunnableQueue[0];
+        __android_log_print(ANDROID_LOG_INFO, "GeckoBridge", "going to run %p", r);
+        r->Run();
+        mRunnableQueue.RemoveObjectAt(0);
+    }
+    __android_log_print(ANDROID_LOG_INFO, "GeckoBridge", "leaving %s", __PRETTY_FUNCTION__);
+}
 bool
 AndroidBridge::HasNativeBitmapAccess()
 {
diff --git a/widget/src/android/AndroidBridge.h b/widget/src/android/AndroidBridge.h
index cfb79eae1d9b..4de9750482c6 100644
--- a/widget/src/android/AndroidBridge.h
+++ b/widget/src/android/AndroidBridge.h
@@ -42,6 +42,7 @@
 #include <android/log.h>
 
 #include "nsCOMPtr.h"
+#include "nsCOMArray.h"
 #include "nsIRunnable.h"
 #include "nsIObserver.h"
 
@@ -262,6 +263,10 @@ public:
 
     void UnlockBitmap(jobject bitmap);
 
+    void PostToJavaThread(nsIRunnable* aRunnable, PRBool aMainThread = PR_FALSE);
+
+    void ExecuteNextRunnable();
+
 protected:
     static AndroidBridge *sBridge;
 
@@ -286,6 +291,8 @@ protected:
     bool mOpenedBitmapLibrary;
     bool mHasNativeBitmapAccess;
 
+    nsCOMArray<nsIRunnable> mRunnableQueue;
+
     // other things
     jmethodID jNotifyIME;
     jmethodID jNotifyIMEEnabled;
@@ -325,6 +332,7 @@ protected:
     jmethodID jGetIconForExtension;
     jmethodID jCreateShortcut;
     jmethodID jGetShowPasswordSetting;
+    jmethodID jPostToJavaThread;
 
     // stuff we need for CallEglCreateWindowSurface
     jclass jEGLSurfaceImplClass;
diff --git a/widget/src/android/AndroidJNI.cpp b/widget/src/android/AndroidJNI.cpp
index 6aadc8e85e9a..4bce698eed47 100644
--- a/widget/src/android/AndroidJNI.cpp
+++ b/widget/src/android/AndroidJNI.cpp
@@ -72,6 +72,7 @@ extern "C" {
     NS_EXPORT void JNICALL Java_org_mozilla_gecko_GeckoAppShell_removeObserver(JNIEnv *jenv, jclass, jstring jObserverKey);
     NS_EXPORT void JNICALL Java_org_mozilla_gecko_GeckoAppShell_onChangeNetworkLinkStatus(JNIEnv *, jclass, jstring status, jstring type);
     NS_EXPORT void JNICALL Java_org_mozilla_gecko_GeckoAppShell_reportJavaCrash(JNIEnv *, jclass, jstring stack);
+    NS_EXPORT void JNICALL Java_org_mozilla_gecko_GeckoAppShell_executeNextRunnable(JNIEnv *, jclass);
 }
 
 
@@ -179,3 +180,15 @@ Java_org_mozilla_gecko_GeckoAppShell_reportJavaCrash(JNIEnv *jenv, jclass, jstri
 #endif
     abort();
 }
+
+NS_EXPORT void JNICALL
+Java_org_mozilla_gecko_GeckoAppShell_executeNextRunnable(JNIEnv *, jclass)
+{
+    __android_log_print(ANDROID_LOG_INFO, "GeckoJNI", "%s", __PRETTY_FUNCTION__);
+    if (!AndroidBridge::Bridge()) {
+        __android_log_print(ANDROID_LOG_INFO, "GeckoJNI", "no bridge in %s!!!!", __PRETTY_FUNCTION__);
+        return;
+    }
+    AndroidBridge::Bridge()->ExecuteNextRunnable();
+    __android_log_print(ANDROID_LOG_INFO, "GeckoJNI", "leaving %s", __PRETTY_FUNCTION__);
+}

From a7981da69cc6c27875af0124b4df9081f4a015ab Mon Sep 17 00:00:00 2001
From: Gian-Carlo Pascutto <gpascutto@mozilla.com>
Date: Fri, 16 Sep 2011 14:34:05 -0700
Subject: [PATCH 175/209] Bug 669410 - Add copyright header to PrefixSet IDL
 file. DONTBUILD (NPOTB)

--HG--
extra : rebase_source : 3205a7b2e39c6d0a37ef38755902061a025edd15
---
 .../nsIUrlClassifierPrefixSet.idl             | 38 +++++++++++++++++++
 1 file changed, 38 insertions(+)

diff --git a/toolkit/components/url-classifier/nsIUrlClassifierPrefixSet.idl b/toolkit/components/url-classifier/nsIUrlClassifierPrefixSet.idl
index 4a1fbf59d350..489fa1ba7103 100644
--- a/toolkit/components/url-classifier/nsIUrlClassifierPrefixSet.idl
+++ b/toolkit/components/url-classifier/nsIUrlClassifierPrefixSet.idl
@@ -1,3 +1,41 @@
+/* -*- Mode: IDL; tab-width: 2; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
+/* ***** BEGIN LICENSE BLOCK *****
+ * Version: MPL 1.1/GPL 2.0/LGPL 2.1
+ *
+ * The contents of this file are subject to the Mozilla Public License Version
+ * 1.1 (the "License"); you may not use this file except in compliance with
+ * the License. You may obtain a copy of the License at
+ * http://www.mozilla.org/MPL/
+ *
+ * Software distributed under the License is distributed on an "AS IS" basis,
+ * WITHOUT WARRANTY OF ANY KIND, either express or implied. See the License
+ * for the specific language governing rights and limitations under the
+ * License.
+ *
+ * The Original Code is Url Classifier code
+ *
+ * The Initial Developer of the Original Code is
+ * the Mozilla Foundation.
+ * Portions created by the Initial Developer are Copyright (C) 2011
+ * the Initial Developer. All Rights Reserved.
+ *
+ * Contributor(s):
+ *   Gian-Carlo Pascutto <gpascutto@mozilla.com>
+ *
+ * Alternatively, the contents of this file may be used under the terms of
+ * either the GNU General Public License Version 2 or later (the "GPL"), or
+ * the GNU Lesser General Public License Version 2.1 or later (the "LGPL"),
+ * in which case the provisions of the GPL or the LGPL are applicable instead
+ * of those above. If you wish to allow use of your version of this file only
+ * under the terms of either the GPL or the LGPL, and not to allow others to
+ * use your version of this file under the terms of the MPL, indicate your
+ * decision by deleting the provisions above and replace them with the notice
+ * and other provisions required by the GPL or the LGPL. If you do not delete
+ * the provisions above, a recipient may use your version of this file under
+ * the terms of any one of the MPL, the GPL or the LGPL.
+ *
+ * ***** END LICENSE BLOCK ***** */
+
 #include "nsISupports.idl"
 #include "nsIFile.idl"
 

From 7c62c3c039b5bfd432b6ba2ae81658673bc219cb Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Rafael=20=C3=81vila=20de=20Esp=C3=ADndola?=
 <respindola@mozilla.com>
Date: Fri, 16 Sep 2011 14:34:09 -0700
Subject: [PATCH 176/209] Bug 684659 - Remove xptcinvoke_unixish_x86.cpp.
 r=bsmedberg.

This patch:
* Modifies the linux version so that both calls are aligned and can be used by the OS X assembler.
* Removes KEEP_STACK_16_BYTE_ALIGNED, since it is cheap to do it always and the linux implementation was already doing.
* Define MOZ_NEED_LEADING_UNDERSCOR on OS X
* Move users of xptcinvoke_unixish_x86.cpp to xptcinvoke_gcc_x86_unix.cpp (and the stubs file too)

--HG--
extra : rebase_source : 11eac139b33ddfe60af96690e0c54aec77db82c9
---
 xpcom/reflect/xptcall/src/md/unix/Makefile.in |  24 +--
 .../src/md/unix/xptcinvoke_gcc_x86_unix.cpp   |  25 +--
 .../src/md/unix/xptcinvoke_unixish_x86.cpp    | 176 ------------------
 .../src/md/unix/xptcstubs_gcc_x86_unix.cpp    |  36 +++-
 .../src/md/unix/xptcstubs_unixish_x86.cpp     | 169 -----------------
 5 files changed, 43 insertions(+), 387 deletions(-)
 delete mode 100644 xpcom/reflect/xptcall/src/md/unix/xptcinvoke_unixish_x86.cpp
 delete mode 100644 xpcom/reflect/xptcall/src/md/unix/xptcstubs_unixish_x86.cpp

diff --git a/xpcom/reflect/xptcall/src/md/unix/Makefile.in b/xpcom/reflect/xptcall/src/md/unix/Makefile.in
index c98555fb247b..ccaeae7a1175 100644
--- a/xpcom/reflect/xptcall/src/md/unix/Makefile.in
+++ b/xpcom/reflect/xptcall/src/md/unix/Makefile.in
@@ -64,22 +64,6 @@ NO_PROFILE_GUIDED_OPTIMIZE = 1
 endif
 endif
 
-ifeq (Darwin,$(OS_ARCH))
-ifeq (86,$(findstring 86,$(OS_TEST)))
-ifneq (x86_64,$(OS_TEST))
-# If we compile xptcinvoke_unixish_x86.cpp with -fomit-frame-pointer
-# we end up crashing on startup. This is because
-# "movl  %5, %%eax\n\t"   /* function index */
-# becomes
-# mov    0x1c(%esp),%eax
-# but we have modified esp.
-# NOTE: MOZ_FRAMEPTR_FLAGS must be set before including config.mk
-# FIXME: change the file instead of using this hack.
-MOZ_FRAMEPTR_FLAGS=-fno-omit-frame-pointer
-endif
-endif
-endif
-
 include $(topsrcdir)/config/config.mk
 
 ######################################################################
@@ -94,15 +78,15 @@ ifeq (86,$(findstring 86,$(OS_TEST)))
 ifeq (x86_64,$(OS_TEST))
 CPPSRCS		:= xptcinvoke_x86_64_unix.cpp xptcstubs_x86_64_darwin.cpp
 else
-DEFINES		+= -DKEEP_STACK_16_BYTE_ALIGNED
-CPPSRCS		:= xptcinvoke_unixish_x86.cpp xptcstubs_unixish_x86.cpp
+DEFINES		+= -DMOZ_NEED_LEADING_UNDERSCORE
+CPPSRCS		:= xptcinvoke_gcc_x86_unix.cpp xptcstubs_gcc_x86_unix.cpp
 endif
 endif
 endif
 
 ifneq (,$(filter NetBSD OpenBSD BSD_OS GNU,$(OS_ARCH)))
 ifeq (86,$(findstring 86,$(OS_TEST)))
-CPPSRCS		:= xptcinvoke_unixish_x86.cpp xptcstubs_unixish_x86.cpp
+CPPSRCS		:= xptcinvoke_gcc_x86_unix.cpp xptcstubs_gcc_x86_unix.cpp
 endif
 endif
 #
@@ -137,7 +121,7 @@ endif
 #
 ifeq ($(OS_TARGET),NTO)
 ifeq ($(OS_TEST),x86)
-CPPSRCS		:= xptcinvoke_unixish_x86.cpp xptcstubs_unixish_x86.cpp
+CPPSRCS		:= xptcinvoke_gcc_x86_unix.cpp xptcstubs_gcc_x86_unix.cpp
 endif
 ifeq ($(OS_TEST),arm)
 CPPSRCS		:= xptcinvoke_nto_arm.cpp xptcstubs_nto_arm.cpp
diff --git a/xpcom/reflect/xptcall/src/md/unix/xptcinvoke_gcc_x86_unix.cpp b/xpcom/reflect/xptcall/src/md/unix/xptcinvoke_gcc_x86_unix.cpp
index 96f8f3415517..ae2c86bb7fa9 100644
--- a/xpcom/reflect/xptcall/src/md/unix/xptcinvoke_gcc_x86_unix.cpp
+++ b/xpcom/reflect/xptcall/src/md/unix/xptcinvoke_gcc_x86_unix.cpp
@@ -20,6 +20,7 @@
  * the Initial Developer. All Rights Reserved.
  *
  * Contributor(s):
+ *   Mark Mentovai <mark@moxienet.com>
  *
  * Alternatively, the contents of this file may be used under the terms of
  * either of the GNU General Public License Version 2 or later (the "GPL"),
@@ -103,25 +104,23 @@ __asm__ (
 /* alignment here seems unimportant here; this was 16, now it's 2 which
    is what xptcstubs uses. */
 	".align 2\n\t"
-#if defined(XP_WIN32) || defined(XP_OS2)
-	".globl " SYMBOL_UNDERSCORE "_NS_InvokeByIndex_P\n\t"
-	SYMBOL_UNDERSCORE "_NS_InvokeByIndex_P:\n\t"
-#else
 	".globl " SYMBOL_UNDERSCORE "NS_InvokeByIndex_P\n\t"
+#if !defined(XP_WIN32) && !defined(XP_OS2) && !defined(XP_MACOSX)
 	".type  " SYMBOL_UNDERSCORE "NS_InvokeByIndex_P,@function\n"
-	SYMBOL_UNDERSCORE "NS_InvokeByIndex_P:\n\t"
 #endif
+	SYMBOL_UNDERSCORE "NS_InvokeByIndex_P:\n\t"
 	"pushl %ebp\n\t"
 	"movl  %esp, %ebp\n\t"
 	"movl  0x10(%ebp), %eax\n\t"
 	"leal  0(,%eax,8),%edx\n\t"
-	"movl  %esp, %ecx\n\t"
-	"subl  %edx, %ecx\n\t"
+
+        /* set up call frame for method. */
+	"subl  %edx, %esp\n\t"       /* make room for params. */
 /* Align to maximum x86 data size: 128 bits == 16 bytes == XMM register size.
  * This is to avoid protection faults where SSE+ alignment of stack pointer
  * is assumed and required, e.g. by GCC4's -ftree-vectorize option.
  */
-	"andl  $0xfffffff0, %ecx\n\t"   /* drop(?) stack ptr to 128-bit align */
+	"andl  $0xfffffff0, %esp\n\t"   /* drop(?) stack ptr to 128-bit align */
 /* $esp should be aligned to a 16-byte boundary here (note we include an 
  * additional 4 bytes in a later push instruction). This will ensure $ebp 
  * in the function called below is aligned to a 0x8 boundary. SSE instructions 
@@ -129,12 +128,14 @@ __asm__ (
  * boundary. The GCC compiler will generate the memory operand using $ebp
  * with an 8-byte offset.
  */
-	"subl  $0xc, %ecx\n\t"          /* lower again; push/call below will re-align */
-	"movl  %ecx, %esp\n\t"          /* make stack space */
+	"subl  $0xc, %esp\n\t"          /* lower again; push/call below will re-align */
+	"movl  %esp, %ecx\n\t"          /* ecx = d */
+	"movl  8(%ebp), %edx\n\t"       /* edx = this */
+	"pushl %edx\n\t"                /* push this. esp % 16 == 0 */
+
 	"movl  0x14(%ebp), %edx\n\t"
 	"call  " SYMBOL_UNDERSCORE "invoke_copy_to_stack\n\t"
 	"movl  0x08(%ebp), %ecx\n\t"	/* 'that' */
-	"pushl %ecx\n\t"
 	"movl  (%ecx), %edx\n\t"
 	"movl  0x0c(%ebp), %eax\n\t"    /* function index */
 	"leal  (%edx,%eax,4), %edx\n\t"
@@ -142,7 +143,7 @@ __asm__ (
 	"movl  %ebp, %esp\n\t"
 	"popl  %ebp\n\t"
 	"ret\n"
-#if !defined(XP_WIN32) && !defined(XP_OS2)
+#if !defined(XP_WIN32) && !defined(XP_OS2) && !defined(XP_MACOSX)
 	".size " SYMBOL_UNDERSCORE "NS_InvokeByIndex_P, . -" SYMBOL_UNDERSCORE "NS_InvokeByIndex_P\n\t"
 #endif
 );
diff --git a/xpcom/reflect/xptcall/src/md/unix/xptcinvoke_unixish_x86.cpp b/xpcom/reflect/xptcall/src/md/unix/xptcinvoke_unixish_x86.cpp
deleted file mode 100644
index a5236458431e..000000000000
--- a/xpcom/reflect/xptcall/src/md/unix/xptcinvoke_unixish_x86.cpp
+++ /dev/null
@@ -1,176 +0,0 @@
-/* -*- Mode: C; tab-width: 8; indent-tabs-mode: nil; c-basic-offset: 4 -*- */
-/* ***** BEGIN LICENSE BLOCK *****
- * Version: MPL 1.1/GPL 2.0/LGPL 2.1
- *
- * The contents of this file are subject to the Mozilla Public License Version
- * 1.1 (the "License"); you may not use this file except in compliance with
- * the License. You may obtain a copy of the License at
- * http://www.mozilla.org/MPL/
- *
- * Software distributed under the License is distributed on an "AS IS" basis,
- * WITHOUT WARRANTY OF ANY KIND, either express or implied. See the License
- * for the specific language governing rights and limitations under the
- * License.
- *
- * The Original Code is mozilla.org code.
- *
- * The Initial Developer of the Original Code is
- * Netscape Communications Corporation.
- * Portions created by the Initial Developer are Copyright (C) 1998
- * the Initial Developer. All Rights Reserved.
- *
- * Contributor(s):
- *   Mark Mentovai <mark@moxienet.com>
- *
- * Alternatively, the contents of this file may be used under the terms of
- * either of the GNU General Public License Version 2 or later (the "GPL"),
- * or the GNU Lesser General Public License Version 2.1 or later (the "LGPL"),
- * in which case the provisions of the GPL or the LGPL are applicable instead
- * of those above. If you wish to allow use of your version of this file only
- * under the terms of either the GPL or the LGPL, and not to allow others to
- * use your version of this file under the terms of the MPL, indicate your
- * decision by deleting the provisions above and replace them with the notice
- * and other provisions required by the GPL or the LGPL. If you do not delete
- * the provisions above, a recipient may use your version of this file under
- * the terms of any one of the MPL, the GPL or the LGPL.
- *
- * ***** END LICENSE BLOCK ***** */
-
-/* Platform specific code to invoke XPCOM methods on native objects */
-
-#include "xptcprivate.h"
-
-extern "C" {
-
-static void
-invoke_copy_to_stack(PRUint32 paramCount, nsXPTCVariant* s, PRUint32* d)
-{
-    for(PRUint32 i = paramCount; i >0; i--, d++, s++)
-    {
-        if(s->IsPtrData())
-        {
-            *((void**)d) = s->ptr;
-            continue;
-        }
-
-/* XXX: the following line is here (rather than as the default clause in
- *      the following switch statement) so that the Sun native compiler
- *      will generate the correct assembly code on the Solaris Intel
- *      platform. See the comments in bug #28817 for more details.
- */
-
-        *((void**)d) = s->val.p;
-
-        switch(s->type)
-        {
-        case nsXPTType::T_I64    : *((PRInt64*) d) = s->val.i64; d++;    break;
-        case nsXPTType::T_U64    : *((PRUint64*)d) = s->val.u64; d++;    break;
-        case nsXPTType::T_DOUBLE : *((double*)  d) = s->val.d;   d++;    break;
-        }
-    }
-}
-
-}
-
-EXPORT_XPCOM_API(nsresult)
-NS_InvokeByIndex_P(nsISupports* that, PRUint32 methodIndex,
-                 PRUint32 paramCount, nsXPTCVariant* params)
-{
-  PRUint32 result;
-  /* Each param takes at most 2, 4-byte words
-     It doesn't matter if we push too many words, and calculating the exact
-     amount takes time. */
-  PRUint32 n = paramCount << 3;
-  void (*fn_copy) (unsigned int, nsXPTCVariant *, PRUint32 *) = invoke_copy_to_stack;
-  int temp1, temp2;
- 
-  /* These are only significant when KEEP_STACK_16_BYTE_ALIGNED is
-     defined.  Otherwise, they're just placeholders to keep the parameter
-     indices the same for aligned and unaligned users in the inline asm
-     block. */
-  unsigned int saved_esp;
-  
- __asm__ __volatile__(
-#ifdef KEEP_STACK_16_BYTE_ALIGNED
-    "movl  %%esp, %3\n\t"
-#endif
-    "subl  %8, %%esp\n\t" /* make room for params */
-#ifdef KEEP_STACK_16_BYTE_ALIGNED
-    /* For the second CALL, there will be one parameter before the ones
-       copied by invoke_copy_to_stack.  Make sure that the stack will be
-       aligned for that CALL. */
-    "subl  $4, %%esp\n\t"
-    "andl  $0xfffffff0, %%esp\n\t"
-    /* For the first CALL, there are three parameters.  Leave padding to
-       ensure alignment. */
-    "subl  $4, %%esp\n\t"
-    /* The third parameter to invoke_copy_to_stack is the destination pointer.
-       It needs to point into the parameter area prepared for the second CALL,
-       leaving room for the |that| parameter.  This reuses |n|, which was
-       the stack space to reserve, but that's OK because it's no longer needed
-       if the stack is being kept aligned. */
-    "leal  8(%%esp), %8\n\t"
-    "pushl %8\n\t"
-#else
-    "pushl %%esp\n\t"
-#endif
-    "pushl %7\n\t"
-    "pushl %6\n\t"
-    "call  *%9\n\t"       /* copy params */
-#ifdef KEEP_STACK_16_BYTE_ALIGNED
-    /* The stack is still aligned from the first CALL.  Keep it aligned for
-       the next one by popping past the parameters from the first CALL and
-       leaving space for the first (|that|) parameter for the second CALL. */
-    "addl  $0x14, %%esp\n\t"
-#else
-    "addl  $0xc, %%esp\n\t"
-#endif
-    "movl  %4, %%ecx\n\t"
-#ifdef CFRONT_STYLE_THIS_ADJUST
-    "movl  (%%ecx), %%edx\n\t"
-    "movl  %5, %%eax\n\t"   /* function index */
-    "shl   $3, %%eax\n\t"   /* *= 8 */
-    "addl  $8, %%eax\n\t"   /* += 8 skip first entry */
-    "addl  %%eax, %%edx\n\t"
-    "movswl (%%edx), %%eax\n\t" /* 'this' offset */
-    "addl  %%eax, %%ecx\n\t"
-    "pushl %%ecx\n\t"
-    "addl  $4, %%edx\n\t"   /* += 4, method pointer */
-#else /* THUNK_BASED_THIS_ADJUST */
-    "pushl %%ecx\n\t"
-    "movl  (%%ecx), %%edx\n\t"
-    "movl  %5, %%eax\n\t"   /* function index */
-    "leal  (%%edx,%%eax,4), %%edx\n\t"
-#endif
-    "call  *(%%edx)\n\t"    /* safe to not cleanup esp */
-#ifdef KEEP_STACK_16_BYTE_ALIGNED
-    "movl  %3, %%esp\n\t"
-#else
-    "addl  $4, %%esp\n\t"
-    "addl  %8, %%esp"
-#endif
-    : "=a" (result),        /* %0 */
-      "=c" (temp1),         /* %1 */
-      "=d" (temp2),         /* %2 */
-#ifdef KEEP_STACK_16_BYTE_ALIGNED
-      "=&g" (saved_esp)     /* %3 */
-#else
-      /* Don't waste a register, this isn't used if alignment is unimportant */
-      "=m" (saved_esp)      /* %3 */
-#endif
-    : "g" (that),           /* %4 */
-      "g" (methodIndex),    /* %5 */
-      "1" (paramCount),     /* %6 */
-      "2" (params),         /* %7 */
-#ifdef KEEP_STACK_16_BYTE_ALIGNED
-      /* Must be in a register, it's the target of an LEA instruction */
-      "r" (n),              /* %8 */
-#else
-      "g" (n),              /* %8 */
-#endif
-      "0" (fn_copy)         /* %9 */
-    : "memory"
-    );
-    
-  return result;
-}    
diff --git a/xpcom/reflect/xptcall/src/md/unix/xptcstubs_gcc_x86_unix.cpp b/xpcom/reflect/xptcall/src/md/unix/xptcstubs_gcc_x86_unix.cpp
index 9135ce9a8d22..de622d75261f 100644
--- a/xpcom/reflect/xptcall/src/md/unix/xptcstubs_gcc_x86_unix.cpp
+++ b/xpcom/reflect/xptcall/src/md/unix/xptcstubs_gcc_x86_unix.cpp
@@ -98,24 +98,35 @@ PrepareAndDispatch(uint32 methodIndex, nsXPTCStubBase* self, PRUint32* args)
 }
 } // extern "C"
 
+#if !defined(XP_MACOSX)
+
+#define STUB_HEADER(a, b) ".hidden " SYMBOL_UNDERSCORE "_ZN14nsXPTCStubBase" #a "Stub" #b "Ev\n\t" \
+                          ".type   " SYMBOL_UNDERSCORE "_ZN14nsXPTCStubBase" #a "Stub" #b "Ev,@function\n"
+
+#define STUB_SIZE(a, b)  ".size        " SYMBOL_UNDERSCORE "_ZN14nsXPTCStubBase" #a "Stub" #b "Ev,.-" SYMBOL_UNDERSCORE "_ZN14nsXPTCStubBase" #a "Stub" #b "Ev\n\t"
+
+#else
+
+#define STUB_HEADER(a, b)
+#define STUB_SIZE(a, b)
+
+#endif
+
 // gcc3 mangling tends to insert the length of the method name
 #define STUB_ENTRY(n) \
 asm(".text\n\t" \
     ".align	2\n\t" \
     ".if	" #n " < 10\n\t" \
     ".globl	" SYMBOL_UNDERSCORE "_ZN14nsXPTCStubBase5Stub" #n "Ev\n\t" \
-    ".hidden	" SYMBOL_UNDERSCORE "_ZN14nsXPTCStubBase5Stub" #n "Ev\n\t" \
-    ".type	" SYMBOL_UNDERSCORE "_ZN14nsXPTCStubBase5Stub" #n "Ev,@function\n" \
+    STUB_HEADER(5, n)                                                   \
     SYMBOL_UNDERSCORE "_ZN14nsXPTCStubBase5Stub" #n "Ev:\n\t" \
     ".elseif	" #n " < 100\n\t" \
     ".globl	" SYMBOL_UNDERSCORE "_ZN14nsXPTCStubBase6Stub" #n "Ev\n\t" \
-    ".hidden	" SYMBOL_UNDERSCORE "_ZN14nsXPTCStubBase6Stub" #n "Ev\n\t" \
-    ".type	" SYMBOL_UNDERSCORE "_ZN14nsXPTCStubBase6Stub" #n "Ev,@function\n" \
+    STUB_HEADER(6, n)                                                   \
     SYMBOL_UNDERSCORE "_ZN14nsXPTCStubBase6Stub" #n "Ev:\n\t" \
     ".elseif    " #n " < 1000\n\t" \
     ".globl     " SYMBOL_UNDERSCORE "_ZN14nsXPTCStubBase7Stub" #n "Ev\n\t" \
-    ".hidden    " SYMBOL_UNDERSCORE "_ZN14nsXPTCStubBase7Stub" #n "Ev\n\t" \
-    ".type      " SYMBOL_UNDERSCORE "_ZN14nsXPTCStubBase7Stub" #n "Ev,@function\n" \
+    STUB_HEADER(7, n)                                                   \
     SYMBOL_UNDERSCORE "_ZN14nsXPTCStubBase7Stub" #n "Ev:\n\t" \
     ".else\n\t" \
     ".err	\"stub number " #n " >= 1000 not yet supported\"\n\t" \
@@ -123,22 +134,27 @@ asm(".text\n\t" \
     "movl	$" #n ", %eax\n\t" \
     "jmp	" SYMBOL_UNDERSCORE "SharedStub\n\t" \
     ".if	" #n " < 10\n\t" \
-    ".size	" SYMBOL_UNDERSCORE "_ZN14nsXPTCStubBase5Stub" #n "Ev,.-" SYMBOL_UNDERSCORE "_ZN14nsXPTCStubBase5Stub" #n "Ev\n\t" \
+    STUB_SIZE(5, n) \
     ".elseif	" #n " < 100\n\t" \
-    ".size	" SYMBOL_UNDERSCORE "_ZN14nsXPTCStubBase6Stub" #n "Ev,.-" SYMBOL_UNDERSCORE "_ZN14nsXPTCStubBase6Stub" #n "Ev\n\t" \
+    STUB_SIZE(6, n) \
     ".else\n\t" \
-    ".size	" SYMBOL_UNDERSCORE "_ZN14nsXPTCStubBase7Stub" #n "Ev,.-" SYMBOL_UNDERSCORE "_ZN14nsXPTCStubBase7Stub" #n "Ev\n\t" \
+    STUB_SIZE(7, n) \
     ".endif");
 
 // static nsresult SharedStub(PRUint32 methodIndex) __attribute__((regparm(1)))
 asm(".text\n\t"
     ".align	2\n\t"
+#if !defined(XP_MACOSX)
     ".type	" SYMBOL_UNDERSCORE "SharedStub,@function\n\t"
+#endif
     SYMBOL_UNDERSCORE "SharedStub:\n\t"
     "leal	0x08(%esp), %ecx\n\t"
     "movl	0x04(%esp), %edx\n\t"
     "jmp	" SYMBOL_UNDERSCORE "PrepareAndDispatch\n\t"
-    ".size	" SYMBOL_UNDERSCORE "SharedStub,.-" SYMBOL_UNDERSCORE "SharedStub");
+#if !defined(XP_MACOSX)
+    ".size	" SYMBOL_UNDERSCORE "SharedStub,.-" SYMBOL_UNDERSCORE "SharedStub"
+#endif
+);
 
 #define SENTINEL_ENTRY(n) \
 nsresult nsXPTCStubBase::Sentinel##n() \
diff --git a/xpcom/reflect/xptcall/src/md/unix/xptcstubs_unixish_x86.cpp b/xpcom/reflect/xptcall/src/md/unix/xptcstubs_unixish_x86.cpp
deleted file mode 100644
index 24b60a9c3d94..000000000000
--- a/xpcom/reflect/xptcall/src/md/unix/xptcstubs_unixish_x86.cpp
+++ /dev/null
@@ -1,169 +0,0 @@
-/* -*- Mode: C; tab-width: 8; indent-tabs-mode: nil; c-basic-offset: 4 -*- */
-/* ***** BEGIN LICENSE BLOCK *****
- * Version: MPL 1.1/GPL 2.0/LGPL 2.1
- *
- * The contents of this file are subject to the Mozilla Public License Version
- * 1.1 (the "License"); you may not use this file except in compliance with
- * the License. You may obtain a copy of the License at
- * http://www.mozilla.org/MPL/
- *
- * Software distributed under the License is distributed on an "AS IS" basis,
- * WITHOUT WARRANTY OF ANY KIND, either express or implied. See the License
- * for the specific language governing rights and limitations under the
- * License.
- *
- * The Original Code is mozilla.org code.
- *
- * The Initial Developer of the Original Code is
- * Netscape Communications Corporation.
- * Portions created by the Initial Developer are Copyright (C) 1999
- * the Initial Developer. All Rights Reserved.
- *
- * Contributor(s):
- *
- * Alternatively, the contents of this file may be used under the terms of
- * either of the GNU General Public License Version 2 or later (the "GPL"),
- * or the GNU Lesser General Public License Version 2.1 or later (the "LGPL"),
- * in which case the provisions of the GPL or the LGPL are applicable instead
- * of those above. If you wish to allow use of your version of this file only
- * under the terms of either the GPL or the LGPL, and not to allow others to
- * use your version of this file under the terms of the MPL, indicate your
- * decision by deleting the provisions above and replace them with the notice
- * and other provisions required by the GPL or the LGPL. If you do not delete
- * the provisions above, a recipient may use your version of this file under
- * the terms of any one of the MPL, the GPL or the LGPL.
- *
- * ***** END LICENSE BLOCK ***** */
-
-/* Implement shared vtbl methods. */
-
-#include "xptcprivate.h"
-#include "xptiprivate.h"
-
-static nsresult
-PrepareAndDispatch(nsXPTCStubBase* self, uint32 methodIndex, PRUint32* args)
-{
-#define PARAM_BUFFER_COUNT     16
-
-    nsXPTCMiniVariant paramBuffer[PARAM_BUFFER_COUNT];
-    nsXPTCMiniVariant* dispatchParams = NULL;
-    const nsXPTMethodInfo* info;
-    PRUint8 paramCount;
-    PRUint8 i;
-    nsresult result = NS_ERROR_FAILURE;
-
-    NS_ASSERTION(self,"no self");
-
-    self->mEntry->GetMethodInfo(PRUint16(methodIndex), &info);
-    NS_ASSERTION(info,"no interface info");
-
-    paramCount = info->GetParamCount();
-
-    // setup variant array pointer
-    if(paramCount > PARAM_BUFFER_COUNT)
-        dispatchParams = new nsXPTCMiniVariant[paramCount];
-    else
-        dispatchParams = paramBuffer;
-    NS_ASSERTION(dispatchParams,"no place for params");
-
-    PRUint32* ap = args;
-    for(i = 0; i < paramCount; i++, ap++)
-    {
-        const nsXPTParamInfo& param = info->GetParam(i);
-        const nsXPTType& type = param.GetType();
-        nsXPTCMiniVariant* dp = &dispatchParams[i];
-
-        if(param.IsOut() || !type.IsArithmetic())
-        {
-            dp->val.p = (void*) *ap;
-            continue;
-        }
-        // else
-	    dp->val.p = (void*) *ap;
-        switch(type)
-        {
-        case nsXPTType::T_I64    : dp->val.i64 = *((PRInt64*) ap); ap++; break;
-        case nsXPTType::T_U64    : dp->val.u64 = *((PRUint64*)ap); ap++; break;
-        case nsXPTType::T_DOUBLE : dp->val.d   = *((double*)  ap); ap++; break;
-        }
-    }
-
-    result = self->mOuter->
-        CallMethod((PRUint16)methodIndex, info, dispatchParams);
-
-    if(dispatchParams != paramBuffer)
-        delete [] dispatchParams;
-
-    return result;
-}
-
-#ifdef KEEP_STACK_16_BYTE_ALIGNED
-/* Make sure the stack is 16-byte aligned.  Do that by aligning to 16 bytes and
- * then subtracting 4 so the three subsequent pushes result in a 16-byte aligned
- * stack. */
-#define ALIGN_STACK_DECL \
-  unsigned int saved_esp;
-
-#define ALIGN_STACK_SAVE \
-  "movl %%esp, %3\n\t"
-
-#define ALIGN_STACK_ALIGN \
-  "addl $0x4, %%esp\n\t" \
-  "andl $0xfffffff0, %%esp\n\t" \
-  "subl $0x4, %%esp\n\t"
-
-#define STACK_RESTORE \
-  "movl %3, %%esp\n"
-
-#define ALIGN_STACK_REGS_IN \
-  , "=r"(saved_esp) /* 3 */
-
-#define ALIGN_STACK_REGS_OUT \
-  , "3"(saved_esp)
-
-#else
-#define ALIGN_STACK_DECL
-#define ALIGN_STACK_SAVE
-#define ALIGN_STACK_ALIGN
-#define STACK_RESTORE \
-  "addl $12, %%esp\n"
-#define ALIGN_STACK_REGS_IN
-#define ALIGN_STACK_REGS_OUT
-#endif
-
-#define STUB_ENTRY(n) \
-nsresult nsXPTCStubBase::Stub##n() \
-{ \
-  register nsresult (*method) (nsXPTCStubBase *, uint32, PRUint32 *) = PrepareAndDispatch; \
-  int temp0, temp1; \
-  register nsresult result; \
-  ALIGN_STACK_DECL \
-  __asm__ __volatile__( \
-    ALIGN_STACK_SAVE \
-    ALIGN_STACK_ALIGN \
-    "leal   0x0c(%%ebp), %%ecx\n\t"    /* args */ \
-    "pushl  %%ecx\n\t" \
-    "pushl  $"#n"\n\t"                 /* method index */ \
-    "movl   0x08(%%ebp), %%ecx\n\t"    /* this */ \
-    "pushl  %%ecx\n\t" \
-    "call   *%%edx\n\t"                /* PrepareAndDispatch */ \
-    STACK_RESTORE                      /* "addl $12, %%esp" or restore saved */ \
-    : "=a" (result),    /* %0 */ \
-      "=&c" (temp0),    /* %1 */ \
-      "=d" (temp1)      /* %2 */ \
-      ALIGN_STACK_REGS_IN \
-    : "2" (method)      /* %2 */ \
-      ALIGN_STACK_REGS_OUT \
-    : "memory" \
-	); \
-    return result; \
-}
-
-#define SENTINEL_ENTRY(n) \
-nsresult nsXPTCStubBase::Sentinel##n() \
-{ \
-    NS_ERROR("nsXPTCStubBase::Sentinel called"); \
-    return NS_ERROR_NOT_IMPLEMENTED; \
-}
-
-#include "xptcstubsdef.inc"

From c938f47ba68e6c84b9ccce20b0f2ad202432bf84 Mon Sep 17 00:00:00 2001
From: Doug Turner <dougt@dougt.org>
Date: Fri, 16 Sep 2011 14:34:31 -0700
Subject: [PATCH 177/209] Bug 630007 - Minimal support NPAPI on ANDROID.
 Pre-Honeycomb inproccess support only.  r=josh.

---
 dom/plugins/base/Makefile.in               |   7 +-
 dom/plugins/base/PluginPRLibrary.cpp       |  34 +-
 dom/plugins/base/PluginPRLibrary.h         |   8 +-
 dom/plugins/base/android/ANPAudio.cpp      | 361 ++++++++
 dom/plugins/base/android/ANPBase.h         |  90 ++
 dom/plugins/base/android/ANPBitmap.cpp     | 118 +++
 dom/plugins/base/android/ANPCanvas.cpp     | 373 ++++++++
 dom/plugins/base/android/ANPEvent.cpp      |  84 ++
 dom/plugins/base/android/ANPKeyCodes.h     | 152 ++++
 dom/plugins/base/android/ANPLog.cpp        |  59 ++
 dom/plugins/base/android/ANPMatrix.cpp     | 197 +++++
 dom/plugins/base/android/ANPPaint.cpp      | 454 ++++++++++
 dom/plugins/base/android/ANPPath.cpp       | 171 ++++
 dom/plugins/base/android/ANPSurface.cpp    | 189 ++++
 dom/plugins/base/android/ANPSystem.cpp     |  86 ++
 dom/plugins/base/android/ANPTypeface.cpp   | 151 ++++
 dom/plugins/base/android/ANPWindow.cpp     |  91 ++
 dom/plugins/base/android/Makefile.in       |  81 ++
 dom/plugins/base/android/android_npapi.h   | 979 +++++++++++++++++++++
 dom/plugins/base/android_npapi.h           |   0
 dom/plugins/base/npfunctions.h             |  13 +-
 dom/plugins/base/nsNPAPIPlugin.cpp         | 125 ++-
 dom/plugins/base/nsNPAPIPluginInstance.cpp | 114 ++-
 dom/plugins/base/nsNPAPIPluginInstance.h   |  16 +
 dom/plugins/base/nsPluginHost.cpp          |  11 +-
 dom/plugins/base/nsPluginInstanceOwner.cpp | 313 ++++++-
 dom/plugins/base/nsPluginInstanceOwner.h   |   7 +-
 dom/plugins/base/nsPluginsDirUnix.cpp      |  10 +
 embedding/android/AndroidManifest.xml.in   |   7 +
 embedding/android/GeckoApp.java            | 162 +++-
 embedding/android/GeckoAppShell.java       | 197 +++++
 embedding/android/Makefile.in              |   1 +
 embedding/android/SurfaceLockInfo.java     |  18 +
 layout/build/Makefile.in                   |   1 +
 layout/generic/nsObjectFrame.cpp           |  16 +
 other-licenses/android/APKOpen.cpp         |   2 +
 widget/src/android/AndroidBridge.cpp       |  50 +-
 widget/src/android/AndroidBridge.h         |   8 +
 widget/src/android/AndroidJNI.cpp          |  13 +
 39 files changed, 4745 insertions(+), 24 deletions(-)
 create mode 100644 dom/plugins/base/android/ANPAudio.cpp
 create mode 100644 dom/plugins/base/android/ANPBase.h
 create mode 100644 dom/plugins/base/android/ANPBitmap.cpp
 create mode 100644 dom/plugins/base/android/ANPCanvas.cpp
 create mode 100644 dom/plugins/base/android/ANPEvent.cpp
 create mode 100644 dom/plugins/base/android/ANPKeyCodes.h
 create mode 100644 dom/plugins/base/android/ANPLog.cpp
 create mode 100644 dom/plugins/base/android/ANPMatrix.cpp
 create mode 100644 dom/plugins/base/android/ANPPaint.cpp
 create mode 100644 dom/plugins/base/android/ANPPath.cpp
 create mode 100644 dom/plugins/base/android/ANPSurface.cpp
 create mode 100644 dom/plugins/base/android/ANPSystem.cpp
 create mode 100644 dom/plugins/base/android/ANPTypeface.cpp
 create mode 100644 dom/plugins/base/android/ANPWindow.cpp
 create mode 100644 dom/plugins/base/android/Makefile.in
 create mode 100644 dom/plugins/base/android/android_npapi.h
 create mode 100644 dom/plugins/base/android_npapi.h
 create mode 100644 embedding/android/SurfaceLockInfo.java

diff --git a/dom/plugins/base/Makefile.in b/dom/plugins/base/Makefile.in
index 4c7a50e0ba0b..402fe7765545 100644
--- a/dom/plugins/base/Makefile.in
+++ b/dom/plugins/base/Makefile.in
@@ -99,6 +99,11 @@ CPPSRCS		= \
 		nsPluginInstanceOwner.cpp \
 		$(NULL)
 
+ifeq ($(MOZ_WIDGET_TOOLKIT),android)
+DIRS += android
+LOCAL_INCLUDES += -I$(topsrcdir)/dom/plugins/base/android
+endif
+
 ifeq ($(OS_ARCH),WINNT)
 	CPPSRCS += nsPluginsDirWin.cpp
 	CPPSRCS += nsPluginNativeWindowWin.cpp
@@ -127,7 +132,7 @@ endif
 endif
 endif
 
-LOCAL_INCLUDES = \
+LOCAL_INCLUDES += \
   -I$(topsrcdir)/xpcom/base/ \
   $(MOZ_CAIRO_CFLAGS) \
   $(NULL)
diff --git a/dom/plugins/base/PluginPRLibrary.cpp b/dom/plugins/base/PluginPRLibrary.cpp
index 2eeeb53bec11..8fbbb3c345aa 100644
--- a/dom/plugins/base/PluginPRLibrary.cpp
+++ b/dom/plugins/base/PluginPRLibrary.cpp
@@ -37,7 +37,6 @@
  * ***** END LICENSE BLOCK ***** */
 
 #include "mozilla/PluginPRLibrary.h"
-
 // Some plugins on Windows, notably Quake Live, implement NP_Initialize using
 // cdecl instead of the documented stdcall. In order to work around this,
 // we force the caller to use a frame pointer.
@@ -52,9 +51,38 @@ static int gNotOptimized;
 #define CALLING_CONVENTION_HACK
 #endif
 
-namespace mozilla {
+#ifdef ANDROID
+#include "AndroidBridge.h"
+#include "android_npapi.h"
+#include <android/log.h>
+#define ALOG(args...) __android_log_print(ANDROID_LOG_INFO, "GeckoJavaEnv", ## args)
+#endif
 
-#if defined(XP_UNIX) && !defined(XP_MACOSX)
+namespace mozilla {
+#ifdef ANDROID
+nsresult
+PluginPRLibrary::NP_Initialize(NPNetscapeFuncs* bFuncs,
+			       NPPluginFuncs* pFuncs, NPError* error)
+{
+  if (mNP_Initialize) {
+    *error = mNP_Initialize(bFuncs, pFuncs, GetJNIForThread());
+  } else {
+    NP_InitializeFunc pfNP_Initialize = (NP_InitializeFunc)
+      PR_FindFunctionSymbol(mLibrary, "NP_Initialize");
+    if (!pfNP_Initialize)
+      return NS_ERROR_FAILURE;
+    *error = pfNP_Initialize(bFuncs, pFuncs, GetJNIForThread());
+  }
+
+
+  // Save pointers to functions that get called through PluginLibrary itself.
+  mNPP_New = pFuncs->newp;
+  mNPP_GetValue = pFuncs->getvalue;
+  mNPP_ClearSiteData = pFuncs->clearsitedata;
+  mNPP_GetSitesWithData = pFuncs->getsiteswithdata;
+  return NS_OK;
+}
+#elif defined(XP_UNIX) && !defined(XP_MACOSX)
 nsresult
 PluginPRLibrary::NP_Initialize(NPNetscapeFuncs* bFuncs,
 			       NPPluginFuncs* pFuncs, NPError* error)
diff --git a/dom/plugins/base/PluginPRLibrary.h b/dom/plugins/base/PluginPRLibrary.h
index 250d1ac92bb7..2dbcb5ec2df1 100644
--- a/dom/plugins/base/PluginPRLibrary.h
+++ b/dom/plugins/base/PluginPRLibrary.h
@@ -63,9 +63,11 @@ public:
         mNP_GetEntryPoints(nsnull),
 #endif
         mNPP_New(nsnull),
+        mNPP_GetValue(nsnull),
         mNPP_ClearSiteData(nsnull),
         mNPP_GetSitesWithData(nsnull),
-        mLibrary(aLibrary)
+        mLibrary(aLibrary),
+        mFilePath(aFilePath)
     {
         NS_ASSERTION(mLibrary, "need non-null lib");
         // addref here??
@@ -159,6 +161,8 @@ public:
                                     const nsGUIEvent& anEvent, bool* handled);
 #endif
 
+    virtual void GetLibraryPath(nsACString& aPath) { aPath.Assign(mFilePath); }
+
 private:
     NP_InitializeFunc mNP_Initialize;
     NP_ShutdownFunc mNP_Shutdown;
@@ -170,9 +174,11 @@ private:
     NP_GetEntryPointsFunc mNP_GetEntryPoints;
 #endif
     NPP_NewProcPtr mNPP_New;
+    NPP_GetValueProcPtr mNPP_GetValue;
     NPP_ClearSiteDataPtr mNPP_ClearSiteData;
     NPP_GetSitesWithDataPtr mNPP_GetSitesWithData;
     PRLibrary* mLibrary;
+    nsCString mFilePath;
 };
 
 
diff --git a/dom/plugins/base/android/ANPAudio.cpp b/dom/plugins/base/android/ANPAudio.cpp
new file mode 100644
index 000000000000..d8f84ef46528
--- /dev/null
+++ b/dom/plugins/base/android/ANPAudio.cpp
@@ -0,0 +1,361 @@
+/* -*- Mode: IDL; tab-width: 2; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
+/* ***** BEGIN LICENSE BLOCK *****
+ * Version: MPL 1.1/GPL 2.0/LGPL 2.1
+ *
+ * The contents of this file are subject to the Mozilla Public License Version
+ * 1.1 (the "License"); you may not use this file except in compliance with
+ * the License. You may obtain a copy of the License at
+ * http://www.mozilla.org/MPL/
+ *
+ * Software distributed under the License is distributed on an "AS IS" basis,
+ * WITHOUT WARRANTY OF ANY KIND, either express or implied. See the License
+ * for the specific language governing rights and limitations under the
+ * License.
+ *
+ * The Original Code is Android NPAPI support code
+ *
+ * The Initial Developer of the Original Code is
+ * the Mozilla Foundation.
+ * Portions created by the Initial Developer are Copyright (C) 2011
+ * the Initial Developer. All Rights Reserved.
+ *
+ * Contributor(s):
+ *   Doug Turner <dougt@mozilla.com>
+ *
+ * Alternatively, the contents of this file may be used under the terms of
+ * either the GNU General Public License Version 2 or later (the "GPL"), or
+ * the GNU Lesser General Public License Version 2.1 or later (the "LGPL"),
+ * in which case the provisions of the GPL or the LGPL are applicable instead
+ * of those above. If you wish to allow use of your version of this file only
+ * under the terms of either the GPL or the LGPL, and not to allow others to
+ * use your version of this file under the terms of the MPL, indicate your
+ * decision by deleting the provisions above and replace them with the notice
+ * and other provisions required by the GPL or the LGPL. If you do not delete
+ * the provisions above, a recipient may use your version of this file under
+ * the terms of any one of the MPL, the GPL or the LGPL.
+ *
+ * ***** END LICENSE BLOCK ***** */
+
+#include "base/basictypes.h"
+#include "AndroidBridge.h"
+
+#include <android/log.h>
+#include <stdlib.h>
+#include <time.h>
+
+#include "assert.h"
+#include "ANPBase.h"
+#include "nsIThread.h"
+#include "nsThreadUtils.h"
+
+#define LOG(args...)  __android_log_print(ANDROID_LOG_INFO, "GeckoPluginsAudio" , ## args)
+#define ASSIGN(obj, name)   (obj)->name = anp_audio_##name
+
+/* android.media.AudioTrack */
+struct AudioTrack {
+  jclass    at_class;
+  jmethodID constructor;
+  jmethodID flush;
+  jmethodID pause;
+  jmethodID play;
+  jmethodID setvol;
+  jmethodID stop;
+  jmethodID write;
+  jmethodID getpos;
+};
+
+enum AudioTrackMode {
+  MODE_STATIC = 0,
+  MODE_STREAM = 1
+};
+
+/* android.media.AudioManager */
+enum AudioManagerStream {
+  STREAM_VOICE_CALL = 0,
+  STREAM_SYSTEM = 1,
+  STREAM_RING = 2,
+  STREAM_MUSIC = 3,
+  STREAM_ALARM = 4,
+  STREAM_NOTIFICATION = 5,
+  STREAM_DTMF = 8
+};
+
+/* android.media.AudioFormat */
+enum AudioFormatChannel {
+  CHANNEL_OUT_MONO = 4,
+  CHANNEL_OUT_STEREO = 12
+};
+
+enum AudioFormatEncoding {
+  ENCODING_PCM_16BIT = 2,
+  ENCODING_PCM_8BIT = 3
+};
+
+static struct AudioTrack at;
+
+static jclass
+init_jni_bindings(JNIEnv *jenv) {
+  jclass jc = jenv->FindClass("android/media/AudioTrack");
+
+  at.constructor = jenv->GetMethodID(jc, "<init>", "(IIIIII)V");
+  at.flush       = jenv->GetMethodID(jc, "flush", "()V");
+  at.pause       = jenv->GetMethodID(jc, "pause", "()V");
+  at.play        = jenv->GetMethodID(jc, "play",  "()V");
+  at.setvol      = jenv->GetMethodID(jc, "setStereoVolume",  "(FF)I");
+  at.stop        = jenv->GetMethodID(jc, "stop",  "()V");
+  at.write       = jenv->GetMethodID(jc, "write", "([BII)I");
+  at.getpos      = jenv->GetMethodID(jc, "getPlaybackHeadPosition", "()I");
+
+  return jc;
+}
+
+struct ANPAudioTrack {
+  jobject output_unit;
+  jclass at_class;
+
+  unsigned int rate;
+  unsigned int channels;
+  unsigned int bufferSize;
+  unsigned int isStopped;
+  unsigned int keepGoing;
+
+  void* user;
+  ANPAudioCallbackProc proc;
+  ANPSampleFormat format;
+};
+
+class AudioRunnable : public nsRunnable
+{
+public:
+  NS_DECL_NSIRUNNABLE
+
+  AudioRunnable(ANPAudioTrack* aAudioTrack) {
+    mTrack = aAudioTrack;
+  }
+
+  ANPAudioTrack* mTrack;
+};
+
+NS_IMETHODIMP
+AudioRunnable::Run()
+{
+  JNIEnv* jenv = GetJNIForThread();
+
+  if (jenv->PushLocalFrame(128)) {
+    return NS_ERROR_FAILURE;
+  }
+
+  jbyteArray bytearray = jenv->NewByteArray(mTrack->bufferSize);
+  if (!bytearray) {
+    LOG("AudioRunnable:: Run.  Could not create bytearray");
+    return NS_ERROR_FAILURE;
+  }
+
+  jbyte *byte = jenv->GetByteArrayElements(bytearray, NULL);
+  if (!byte) {
+    LOG("AudioRunnable:: Run.  Could not create bytearray");
+    return NS_ERROR_FAILURE;
+  }
+
+  ANPAudioBuffer buffer;
+  buffer.channelCount = mTrack->channels;
+  buffer.format = mTrack->format;
+  buffer.bufferData = (void*) byte;
+
+  while (mTrack->keepGoing)
+  {
+    // reset the buffer size
+    buffer.size = mTrack->bufferSize;
+
+    // Get data from the plugin
+    mTrack->proc(kMoreData_ANPAudioEvent, mTrack->user, &buffer);
+
+    if (buffer.size == 0) {
+      LOG("%p - kMoreData_ANPAudioEvent", mTrack);
+      continue;
+    }
+
+    size_t wroteSoFar = 0;
+    jint retval;
+    do {
+      retval = jenv->CallIntMethod(mTrack->output_unit,
+                                   at.write,
+                                   bytearray,
+                                   wroteSoFar,
+                                   buffer.size - wroteSoFar);
+      if (retval < 0) {
+        LOG("%p - Write failed %d", mTrack, retval);
+        break;
+      }
+
+      wroteSoFar += retval;
+
+    } while(wroteSoFar < buffer.size);
+  }
+
+  jenv->DeleteGlobalRef(mTrack->output_unit);
+  jenv->DeleteGlobalRef(mTrack->at_class);
+
+  free(mTrack);
+
+  jenv->ReleaseByteArrayElements(bytearray, byte, 0);
+  jenv->PopLocalFrame(NULL);
+
+  return NS_OK;
+}
+
+ANPAudioTrack*
+anp_audio_newTrack(uint32_t sampleRate,    // sampling rate in Hz
+                   ANPSampleFormat format,
+                   int channelCount,       // MONO=1, STEREO=2
+                   ANPAudioCallbackProc proc,
+                   void* user)
+{
+  ANPAudioTrack *s = (ANPAudioTrack*) malloc(sizeof(ANPAudioTrack));
+  if (s == NULL) {
+    return NULL;
+  }
+
+  JNIEnv *jenv = GetJNIForThread();
+  if (!jenv)
+    return NULL;
+
+  s->at_class = init_jni_bindings(jenv);
+  s->rate = sampleRate;
+  s->channels = channelCount;
+  s->bufferSize = s->rate * s->channels;
+  s->isStopped = true;
+  s->keepGoing = false;
+  s->user = user;
+  s->proc = proc;
+  s->format = format;
+
+  int jformat;
+  switch (format) {
+  case kPCM16Bit_ANPSampleFormat:
+    jformat = ENCODING_PCM_16BIT;
+    break;
+  case kPCM8Bit_ANPSampleFormat:
+    jformat = ENCODING_PCM_8BIT;
+    break;
+  default:
+    LOG("Unknown audio format.  defaulting to 16bit.");
+    jformat = ENCODING_PCM_16BIT;
+    break;
+  }
+
+  int jChannels;
+  switch (channelCount) {
+  case 1:
+    jChannels = CHANNEL_OUT_MONO;
+    break;
+  case 2:
+    jChannels = CHANNEL_OUT_STEREO;
+    break;
+  default:
+    LOG("Unknown channel count.  defaulting to mono.");
+    jChannels = CHANNEL_OUT_MONO;
+    break;
+  }
+
+  jobject obj = jenv->NewObject(s->at_class,
+                                at.constructor,
+                                STREAM_MUSIC,
+                                s->rate,
+                                jChannels,
+                                jformat,
+                                s->bufferSize,
+                                MODE_STREAM);
+
+  jthrowable exception = jenv->ExceptionOccurred();
+  if (exception) {
+    LOG("%s fAILED  ", __PRETTY_FUNCTION__);
+    jenv->ExceptionDescribe();
+    jenv->ExceptionClear();
+    jenv->DeleteGlobalRef(s->at_class);
+    free(s);
+    return NULL;
+  }
+
+  s->output_unit = jenv->NewGlobalRef(obj);
+  return s;
+}
+
+void
+anp_audio_deleteTrack(ANPAudioTrack* s)
+{
+  if (s == NULL) {
+    return;
+  }
+
+  s->keepGoing = false;
+
+  // deallocation happens in the AudioThread.  There is a
+  // potential leak if anp_audio_start is never called, but
+  // we do not see that from flash.
+}
+
+void
+anp_audio_start(ANPAudioTrack* s)
+{
+  if (s == NULL || s->output_unit == NULL) {
+    return;
+  }
+  
+  if (s->keepGoing) {
+    // we are already playing.  Ignore.
+    LOG("anp_audio_start called twice!");
+    return;
+  }
+
+  JNIEnv *jenv = GetJNIForThread();
+  jenv->CallVoidMethod(s->output_unit, at.play);
+
+  s->isStopped = false;
+  s->keepGoing = true;
+
+  // AudioRunnable now owns the ANPAudioTrack
+  nsRefPtr<AudioRunnable> runnable = new AudioRunnable(s);
+
+  nsCOMPtr<nsIThread> thread;
+  NS_NewThread(getter_AddRefs(thread), runnable);
+}
+
+void
+anp_audio_pause(ANPAudioTrack* s)
+{
+  if (s == NULL || s->output_unit == NULL) {
+    return;
+  }
+
+  JNIEnv *jenv = GetJNIForThread();
+  jenv->CallVoidMethod(s->output_unit, at.pause);
+}
+
+void
+anp_audio_stop(ANPAudioTrack* s)
+{
+  if (s == NULL || s->output_unit == NULL) {
+    return;
+  }
+
+  s->isStopped = true;
+  JNIEnv *jenv = GetJNIForThread();
+  jenv->CallVoidMethod(s->output_unit, at.stop);
+}
+
+bool
+anp_audio_isStopped(ANPAudioTrack* s)
+{
+  return s->isStopped;
+}
+
+void InitAudioTrackInterface(ANPAudioTrackInterfaceV0 *i) {
+  _assert(i->inSize == sizeof(*i));
+  ASSIGN(i, newTrack);
+  ASSIGN(i, deleteTrack);
+  ASSIGN(i, start);
+  ASSIGN(i, pause);
+  ASSIGN(i, stop);
+  ASSIGN(i, isStopped);
+}
diff --git a/dom/plugins/base/android/ANPBase.h b/dom/plugins/base/android/ANPBase.h
new file mode 100644
index 000000000000..ebbde892df5b
--- /dev/null
+++ b/dom/plugins/base/android/ANPBase.h
@@ -0,0 +1,90 @@
+/* -*- Mode: IDL; tab-width: 2; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
+/* ***** BEGIN LICENSE BLOCK *****
+ * Version: MPL 1.1/GPL 2.0/LGPL 2.1
+ *
+ * The contents of this file are subject to the Mozilla Public License Version
+ * 1.1 (the "License"); you may not use this file except in compliance with
+ * the License. You may obtain a copy of the License at
+ * http://www.mozilla.org/MPL/
+ *
+ * Software distributed under the License is distributed on an "AS IS" basis,
+ * WITHOUT WARRANTY OF ANY KIND, either express or implied. See the License
+ * for the specific language governing rights and limitations under the
+ * License.
+ *
+ * The Original Code is Android NPAPI support code
+ *
+ * The Initial Developer of the Original Code is
+ * the Mozilla Foundation.
+ * Portions created by the Initial Developer are Copyright (C) 2011
+ * the Initial Developer. All Rights Reserved.
+ *
+ * Contributor(s):
+ *   Doug Turner <dougt@mozilla.com>
+ *
+ * Alternatively, the contents of this file may be used under the terms of
+ * either the GNU General Public License Version 2 or later (the "GPL"), or
+ * the GNU Lesser General Public License Version 2.1 or later (the "LGPL"),
+ * in which case the provisions of the GPL or the LGPL are applicable instead
+ * of those above. If you wish to allow use of your version of this file only
+ * under the terms of either the GPL or the LGPL, and not to allow others to
+ * use your version of this file under the terms of the MPL, indicate your
+ * decision by deleting the provisions above and replace them with the notice
+ * and other provisions required by the GPL or the LGPL. If you do not delete
+ * the provisions above, a recipient may use your version of this file under
+ * the terms of any one of the MPL, the GPL or the LGPL.
+ *
+ * ***** END LICENSE BLOCK ***** */
+
+#include "android_npapi.h"
+#include <stdlib.h>
+#include "nsAutoPtr.h"
+#include "gfxFont.h"
+
+#define NOT_IMPLEMENTED_FATAL() do {                                    \
+    __android_log_print(ANDROID_LOG_ERROR, "GeckoPlugins",              \
+                        "%s not implemented %s, %d",                    \
+                        __PRETTY_FUNCTION__, __FILE__, __LINE__);       \
+    abort();                                                            \
+  } while(0)
+
+#define NOT_IMPLEMENTED()                                               \
+    __android_log_print(ANDROID_LOG_ERROR, "GeckoPlugins",              \
+                        "!!!!!!!!!!!!!!  %s not implemented %s, %d",    \
+                        __PRETTY_FUNCTION__, __FILE__, __LINE__);       \
+
+class gfxFont;
+
+void InitAudioTrackInterface(ANPAudioTrackInterfaceV0 *i);
+void InitBitmapInterface(ANPBitmapInterfaceV0 *i);
+void InitCanvasInterface(ANPCanvasInterfaceV0 *i);
+void InitEventInterface(ANPEventInterfaceV0 *i);
+void InitLogInterface(ANPLogInterfaceV0 *i);
+void InitMatrixInterface(ANPMatrixInterfaceV0 *i);
+void InitPaintInterface(ANPPaintInterfaceV0 *i);
+void InitPathInterface(ANPPathInterfaceV0 *i);
+void InitSurfaceInterface(ANPSurfaceInterfaceV0 *i);
+void InitSystemInterface(ANPSystemInterfaceV0 *i);
+void InitTypeFaceInterface(ANPTypefaceInterfaceV0 *i);
+void InitWindowInterface(ANPWindowInterfaceV0 *i);
+
+struct ANPTypeface {
+  nsRefPtr<gfxFont> mFont;
+};
+
+
+typedef struct {
+  ANPMatrixFlag flags;
+  ANPColor color;
+  ANPPaintStyle style;
+  float strokeWidth;
+  float strokeMiter;
+  ANPPaintCap paintCap;
+  ANPPaintJoin paintJoin;
+  ANPTextEncoding textEncoding;
+  ANPPaintAlign paintAlign;
+  float textSize;
+  float textScaleX;
+  float textSkewX;
+  ANPTypeface typeface;
+} ANPPaintPrivate;
diff --git a/dom/plugins/base/android/ANPBitmap.cpp b/dom/plugins/base/android/ANPBitmap.cpp
new file mode 100644
index 000000000000..f398fe76b922
--- /dev/null
+++ b/dom/plugins/base/android/ANPBitmap.cpp
@@ -0,0 +1,118 @@
+/* -*- Mode: IDL; tab-width: 2; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
+/* ***** BEGIN LICENSE BLOCK *****
+ * Version: MPL 1.1/GPL 2.0/LGPL 2.1
+ *
+ * The contents of this file are subject to the Mozilla Public License Version
+ * 1.1 (the "License"); you may not use this file except in compliance with
+ * the License. You may obtain a copy of the License at
+ * http://www.mozilla.org/MPL/
+ *
+ * Software distributed under the License is distributed on an "AS IS" basis,
+ * WITHOUT WARRANTY OF ANY KIND, either express or implied. See the License
+ * for the specific language governing rights and limitations under the
+ * License.
+ *
+ * The Original Code is Android NPAPI support code
+ *
+ * The Initial Developer of the Original Code is
+ * the Mozilla Foundation.
+ * Portions created by the Initial Developer are Copyright (C) 2011
+ * the Initial Developer. All Rights Reserved.
+ *
+ * Contributor(s):
+ *   Doug Turner <dougt@mozilla.com>
+ *
+ * Alternatively, the contents of this file may be used under the terms of
+ * either the GNU General Public License Version 2 or later (the "GPL"), or
+ * the GNU Lesser General Public License Version 2.1 or later (the "LGPL"),
+ * in which case the provisions of the GPL or the LGPL are applicable instead
+ * of those above. If you wish to allow use of your version of this file only
+ * under the terms of either the GPL or the LGPL, and not to allow others to
+ * use your version of this file under the terms of the MPL, indicate your
+ * decision by deleting the provisions above and replace them with the notice
+ * and other provisions required by the GPL or the LGPL. If you do not delete
+ * the provisions above, a recipient may use your version of this file under
+ * the terms of any one of the MPL, the GPL or the LGPL.
+ *
+ * ***** END LICENSE BLOCK ***** */
+
+#include "assert.h"
+#include "ANPBase.h"
+#include <android/log.h>
+
+#define LOG(args...)  __android_log_print(ANDROID_LOG_INFO, "GeckoPlugins" , ## args)
+#define ASSIGN(obj, name)   (obj)->name = anp_bitmap_##name
+
+
+#define SK_A32_BITS     8
+#define SK_R32_BITS     8
+#define SK_G32_BITS     8
+#define SK_B32_BITS     8
+
+#ifdef IS_BIG_ENDIAN
+#define SK_R32_SHIFT    24
+#define SK_G32_SHIFT    16
+#define SK_B32_SHIFT    8
+#define SK_A32_SHIFT    0
+#else
+#define SK_R32_SHIFT    0
+#define SK_G32_SHIFT    8
+#define SK_B32_SHIFT    16
+#define SK_A32_SHIFT    24
+#endif
+
+#define SK_A32_MASK     ((1 << SK_A32_BITS) - 1)
+#define SK_R32_MASK     ((1 << SK_R32_BITS) - 1)
+#define SK_G32_MASK     ((1 << SK_G32_BITS) - 1)
+#define SK_B32_MASK     ((1 << SK_B32_BITS) - 1)
+
+#define SK_R16_BITS     5
+#define SK_G16_BITS     6
+#define SK_B16_BITS     5
+
+#define SK_R16_SHIFT    (SK_B16_BITS + SK_G16_BITS)
+#define SK_G16_SHIFT    (SK_B16_BITS)
+#define SK_B16_SHIFT    0
+
+#define SK_R16_MASK     ((1 << SK_R16_BITS) - 1)
+#define SK_G16_MASK     ((1 << SK_G16_BITS) - 1)
+#define SK_B16_MASK     ((1 << SK_B16_BITS) - 1)
+
+bool
+anp_bitmap_getPixelPacking(ANPBitmapFormat fmt, ANPPixelPacking* packing) {
+  LOG("%s", __PRETTY_FUNCTION__);
+  switch (fmt) {
+    case kRGBA_8888_ANPBitmapFormat:
+      if (packing) {
+        packing->AShift = SK_A32_SHIFT;
+        packing->ABits  = SK_A32_BITS;
+        packing->RShift = SK_R32_SHIFT;
+        packing->RBits  = SK_R32_BITS;
+        packing->GShift = SK_G32_SHIFT;
+        packing->GBits  = SK_G32_BITS;
+        packing->BShift = SK_B32_SHIFT;
+        packing->BBits  = SK_B32_BITS;
+      }
+      return true;
+    case kRGB_565_ANPBitmapFormat:
+      if (packing) {
+        packing->AShift = 0;
+        packing->ABits  = 0;
+        packing->RShift = SK_R16_SHIFT;
+        packing->RBits  = SK_R16_BITS;
+        packing->GShift = SK_G16_SHIFT;
+        packing->GBits  = SK_G16_BITS;
+        packing->BShift = SK_B16_SHIFT;
+        packing->BBits  = SK_B16_BITS;
+      }
+      return true;
+  default:
+    break;
+  }
+  return false;
+}
+
+void InitBitmapInterface(ANPBitmapInterfaceV0 *i) {
+  _assert(i->inSize == sizeof(*i));
+  ASSIGN(i, getPixelPacking);
+}
diff --git a/dom/plugins/base/android/ANPCanvas.cpp b/dom/plugins/base/android/ANPCanvas.cpp
new file mode 100644
index 000000000000..30c953e46355
--- /dev/null
+++ b/dom/plugins/base/android/ANPCanvas.cpp
@@ -0,0 +1,373 @@
+/* -*- Mode: IDL; tab-width: 2; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
+/* ***** BEGIN LICENSE BLOCK *****
+ * Version: MPL 1.1/GPL 2.0/LGPL 2.1
+ *
+ * The contents of this file are subject to the Mozilla Public License Version
+ * 1.1 (the "License"); you may not use this file except in compliance with
+ * the License. You may obtain a copy of the License at
+ * http://www.mozilla.org/MPL/
+ *
+ * Software distributed under the License is distributed on an "AS IS" basis,
+ * WITHOUT WARRANTY OF ANY KIND, either express or implied. See the License
+ * for the specific language governing rights and limitations under the
+ * License.
+ *
+ * The Original Code is Android NPAPI support code
+ *
+ * The Initial Developer of the Original Code is
+ * the Mozilla Foundation.
+ * Portions created by the Initial Developer are Copyright (C) 2011
+ * the Initial Developer. All Rights Reserved.
+ *
+ * Contributor(s):
+ *   Doug Turner <dougt@mozilla.com>
+ *
+ * Alternatively, the contents of this file may be used under the terms of
+ * either the GNU General Public License Version 2 or later (the "GPL"), or
+ * the GNU Lesser General Public License Version 2.1 or later (the "LGPL"),
+ * in which case the provisions of the GPL or the LGPL are applicable instead
+ * of those above. If you wish to allow use of your version of this file only
+ * under the terms of either the GPL or the LGPL, and not to allow others to
+ * use your version of this file under the terms of the MPL, indicate your
+ * decision by deleting the provisions above and replace them with the notice
+ * and other provisions required by the GPL or the LGPL. If you do not delete
+ * the provisions above, a recipient may use your version of this file under
+ * the terms of any one of the MPL, the GPL or the LGPL.
+ *
+ * ***** END LICENSE BLOCK ***** */
+
+#include "assert.h"
+#include "ANPBase.h"
+#include <android/log.h>
+
+#include "cairo.h"
+#include "gfxPlatform.h"
+#include "gfxASurface.h"
+#include "gfxImageSurface.h"
+#include "gfxUtils.h"
+#include "gfxContext.h"
+
+#define LOG(args...)  __android_log_print(ANDROID_LOG_INFO, "GeckoPlugins" , ## args)
+#define ASSIGN(obj, name)   (obj)->name = anp_canvas_##name
+
+
+ANPCanvas*
+anp_canvas_newCanvas(const ANPBitmap* bitmap)
+{
+  PRUint32 stride;
+  gfxASurface::gfxImageFormat  format;
+
+  if (bitmap->format == ANPBitmapFormats::kRGBA_8888_ANPBitmapFormat) {
+    stride = bitmap->width * 4;
+    format = gfxImageSurface::ImageFormatARGB32;
+  }
+  else if (bitmap->format == ANPBitmapFormats::kRGB_565_ANPBitmapFormat) {
+    stride = bitmap->width * 2;
+    format = gfxImageSurface::ImageFormatRGB16_565;
+  }
+  else {
+    LOG("%s -- Unknown format", __PRETTY_FUNCTION__);
+    return nsnull;
+  }
+
+  gfxImageSurface* pluginSurface = new gfxImageSurface(static_cast<unsigned char*>(bitmap->baseAddr),
+                                                       gfxIntSize(bitmap->width,  bitmap->height), 
+                                                       stride,
+                                                       format);
+  if (pluginSurface->CairoStatus()) {
+    LOG("%s -- %d x %d FAILED to create gfxImageSurface", __PRETTY_FUNCTION__, bitmap->width, bitmap->height);
+    return nsnull;
+  }
+
+  gfxContext *pluginContext = new gfxContext(pluginSurface);
+  NS_ADDREF(pluginContext);
+  return (ANPCanvas*) pluginContext;
+}
+
+void
+anp_canvas_deleteCanvas(ANPCanvas* canvas)
+{
+  if (!canvas)
+    return;
+  gfxContext *ctx = (gfxContext*)canvas;
+  NS_RELEASE( ctx );
+}
+
+void
+anp_canvas_save(ANPCanvas* canvas)
+{
+  if (!canvas)
+    return;
+
+  gfxContext* ctx = (gfxContext*)canvas;
+  ctx->Save();
+}
+
+void
+anp_canvas_restore(ANPCanvas* canvas)
+{
+  if (!canvas)
+    return;
+
+  gfxContext* ctx = (gfxContext*)canvas;
+  ctx->Restore();
+}
+
+void
+anp_canvas_translate(ANPCanvas* canvas, float tx, float ty)
+{
+  if (!canvas)
+    return;
+
+  gfxContext* ctx = (gfxContext*)canvas;
+  ctx->Translate(gfxPoint(tx,ty));
+}
+
+void
+anp_canvas_scale(ANPCanvas* canvas, float sx, float sy)
+{
+  if (!canvas)
+    return;
+
+  gfxContext* ctx = (gfxContext*)canvas;
+  ctx->Scale(sx, sy);
+}
+
+void
+anp_canvas_rotate(ANPCanvas* canvas, float degrees)
+{
+  if (!canvas)
+    return;
+
+  gfxContext* ctx = (gfxContext*)canvas;
+  ctx->Rotate(degrees);
+}
+
+void
+anp_canvas_skew(ANPCanvas* canvas, float kx, float ky)
+{
+  if (!canvas)
+    return;
+
+  gfxContext* ctx = (gfxContext*)canvas;
+  LOG("%s is not impl.", __PRETTY_FUNCTION__);
+}
+
+void
+anp_canvas_concat(ANPCanvas* canvas, const ANPMatrix*)
+{
+  if (!canvas)
+    return;
+
+  gfxContext* ctx = (gfxContext*)canvas;
+  LOG("%s is not impl.", __PRETTY_FUNCTION__);
+}
+
+void
+anp_canvas_clipRect(ANPCanvas* canvas, const ANPRectF* r)
+{
+  if (!canvas)
+    return;
+
+  gfxContext* ctx = (gfxContext*)canvas;
+  ctx->Clip(gfxRect(r->left,
+                    r->top,
+                    r->right - r->left,
+                    r->bottom - r->top));
+}
+
+void
+anp_canvas_clipPath(ANPCanvas* canvas, const ANPPath*)
+{
+  if (!canvas)
+    return;
+
+  gfxContext* ctx = (gfxContext*)canvas;
+  LOG("%s is not impl.", __PRETTY_FUNCTION__);
+}
+
+void
+anp_canvas_getTotalMatrix(ANPCanvas* canvas, ANPMatrix*)
+{
+  if (!canvas)
+    return;
+
+  gfxContext* ctx = (gfxContext*)canvas;
+  LOG("%s is not impl.", __PRETTY_FUNCTION__);
+}
+
+bool
+anp_canvas_getLocalClipBounds(ANPCanvas* canvas, ANPRectF* bounds, bool aa)
+{
+  if (!canvas)
+    return false;
+
+  gfxContext* ctx = (gfxContext*)canvas;
+  LOG("%s is not impl.", __PRETTY_FUNCTION__);
+  return false;
+}
+
+bool
+anp_canvas_getDeviceClipBounds(ANPCanvas* canvas, ANPRectI* bounds)
+{
+  if (!canvas)
+    return false;
+
+  gfxContext* ctx = (gfxContext*)canvas;
+  LOG("%s is not impl.", __PRETTY_FUNCTION__);
+  return false;
+}
+
+void
+anp_canvas_drawColor(ANPCanvas* canvas, ANPColor c)
+{
+  if (!canvas)
+    return;
+
+  gfxContext* ctx = (gfxContext*)canvas;
+  ctx->SetDeviceColor(gfxRGBA(c, gfxRGBA::PACKED_ARGB));
+  LOG("returning from %s", __PRETTY_FUNCTION__);
+}
+
+void
+anp_canvas_drawPaint(ANPCanvas* canvas, const ANPPaint* paint)
+{
+  if (!canvas)
+    return;
+
+  gfxContext* ctx = (gfxContext*)canvas;
+  LOG("%s", "                    **************   NOT IMPLEMENTED!!!");
+}
+
+void
+anp_canvas_drawLine(ANPCanvas* canvas, float x0, float y0, float x1, float y1,
+                    const ANPPaint* paint)
+{
+  if (!canvas)
+    return;
+
+  gfxContext* ctx = (gfxContext*)canvas;
+  ctx->NewPath();
+  ctx->SetColor(((ANPPaintPrivate*)paint)->color);
+  ctx->Line(gfxPoint(x0, y0), gfxPoint(x1, y1));
+  ctx->Fill();
+}
+
+void
+anp_canvas_drawRect(ANPCanvas* canvas, const ANPRectF* r, const ANPPaint* paint)
+{
+  if (!canvas)
+    return;
+
+  gfxContext* ctx = (gfxContext*)canvas;
+
+  ctx->NewPath();
+  ctx->SetColor(((ANPPaintPrivate*)paint)->color);
+  ctx->Rectangle(gfxRect(r->left,
+                         r->top,
+                         r->right - r->left,
+                         r->bottom - r->top));
+  ctx->Fill();
+}
+
+void
+anp_canvas_drawOval(ANPCanvas* canvas, const ANPRectF* r, const ANPPaint* paint)
+{
+  if (!canvas)
+    return;
+
+  gfxContext* ctx = (gfxContext*)canvas;
+   
+  ctx->NewPath();
+  ctx->SetColor(((ANPPaintPrivate*)paint)->color);
+
+  float sizeX = (r->right   - r->left);
+  float sizeY = (r->bottom  - r->top);
+
+  ctx->Ellipse(gfxPoint(r->left + ( sizeX / 2), r->top  + ( sizeY  / 2)),
+               gfxSize(sizeX, sizeY));
+  ctx->Fill();
+}
+
+void
+anp_canvas_drawPath(ANPCanvas* canvas, const ANPPath*, const ANPPaint* paint)
+{
+  if (!canvas)
+    return;
+
+  gfxContext* ctx = (gfxContext*)canvas;
+  LOG("%s is not impl.", __PRETTY_FUNCTION__);
+}
+
+void
+anp_canvas_drawText(ANPCanvas* canvas, const void* text, uint32_t byteLength,
+                                float x, float y, const ANPPaint* paint)
+{
+  if (!canvas)
+    return;
+
+  gfxContext* ctx = (gfxContext*)canvas;
+  LOG("%s is not impl.", __PRETTY_FUNCTION__);
+}
+
+void
+anp_canvas_drawPosText(ANPCanvas* canvas, const void* text, uint32_t byteLength,
+                       const float xy[], const ANPPaint* paint)
+{
+  if (!canvas)
+    return;
+
+  gfxContext* ctx = (gfxContext*)canvas;
+  LOG("%s is not impl.", __PRETTY_FUNCTION__);
+}
+
+void
+anp_canvas_drawBitmap(ANPCanvas* canvas, const ANPBitmap*, float x, float y,
+                      const ANPPaint* paint)
+{
+  if (!canvas)
+    return;
+
+  gfxContext* ctx = (gfxContext*)canvas;
+  LOG("%s is not impl.", __PRETTY_FUNCTION__);
+}
+
+void
+anp_canvas_drawBitmapRect(ANPCanvas* canvas, const ANPBitmap*,
+                          const ANPRectI* src, const ANPRectF* dst,
+                          const ANPPaint* paint)
+{
+  if (!canvas)
+    return;
+
+  gfxContext* ctx = (gfxContext*)canvas;
+  LOG("%s is not impl.", __PRETTY_FUNCTION__);
+}
+
+void InitCanvasInterface(ANPCanvasInterfaceV0 *i) {
+  _assert(i->inSize == sizeof(*i));
+  ASSIGN(i, newCanvas);
+  ASSIGN(i, deleteCanvas);
+  ASSIGN(i, save);
+  ASSIGN(i, restore);
+  ASSIGN(i, translate);
+  ASSIGN(i, scale);
+  ASSIGN(i, rotate);
+  ASSIGN(i, skew);
+  ASSIGN(i, concat);
+  ASSIGN(i, clipRect);
+  ASSIGN(i, clipPath);
+  ASSIGN(i, getTotalMatrix);
+  ASSIGN(i, getLocalClipBounds);
+  ASSIGN(i, getDeviceClipBounds);
+  ASSIGN(i, drawColor);
+  ASSIGN(i, drawPaint);
+  ASSIGN(i, drawLine);
+  ASSIGN(i, drawRect);
+  ASSIGN(i, drawOval);
+  ASSIGN(i, drawPath);
+  ASSIGN(i, drawText);
+  ASSIGN(i, drawPosText);
+  ASSIGN(i, drawBitmap);
+  ASSIGN(i, drawBitmapRect);
+}
diff --git a/dom/plugins/base/android/ANPEvent.cpp b/dom/plugins/base/android/ANPEvent.cpp
new file mode 100644
index 000000000000..44998ffcb51b
--- /dev/null
+++ b/dom/plugins/base/android/ANPEvent.cpp
@@ -0,0 +1,84 @@
+/* -*- Mode: IDL; tab-width: 2; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
+/* ***** BEGIN LICENSE BLOCK *****
+ * Version: MPL 1.1/GPL 2.0/LGPL 2.1
+ *
+ * The contents of this file are subject to the Mozilla Public License Version
+ * 1.1 (the "License"); you may not use this file except in compliance with
+ * the License. You may obtain a copy of the License at
+ * http://www.mozilla.org/MPL/
+ *
+ * Software distributed under the License is distributed on an "AS IS" basis,
+ * WITHOUT WARRANTY OF ANY KIND, either express or implied. See the License
+ * for the specific language governing rights and limitations under the
+ * License.
+ *
+ * The Original Code is Android NPAPI support code
+ *
+ * The Initial Developer of the Original Code is
+ * the Mozilla Foundation.
+ * Portions created by the Initial Developer are Copyright (C) 2011
+ * the Initial Developer. All Rights Reserved.
+ *
+ * Contributor(s):
+ *   Doug Turner <dougt@mozilla.com>
+ *
+ * Alternatively, the contents of this file may be used under the terms of
+ * either the GNU General Public License Version 2 or later (the "GPL"), or
+ * the GNU Lesser General Public License Version 2.1 or later (the "LGPL"),
+ * in which case the provisions of the GPL or the LGPL are applicable instead
+ * of those above. If you wish to allow use of your version of this file only
+ * under the terms of either the GPL or the LGPL, and not to allow others to
+ * use your version of this file under the terms of the MPL, indicate your
+ * decision by deleting the provisions above and replace them with the notice
+ * and other provisions required by the GPL or the LGPL. If you do not delete
+ * the provisions above, a recipient may use your version of this file under
+ * the terms of any one of the MPL, the GPL or the LGPL.
+ *
+ * ***** END LICENSE BLOCK ***** */
+
+#include "assert.h"
+#include "ANPBase.h"
+#include <android/log.h>
+#include "nsThreadUtils.h"
+#include "nsNPAPIPluginInstance.h"
+#include "AndroidBridge.h"
+#include "nsNPAPIPlugin.h"
+
+#define LOG(args...)  __android_log_print(ANDROID_LOG_INFO, "GeckoPlugins" , ## args)
+#define ASSIGN(obj, name)   (obj)->name = anp_event_##name
+
+class PluginEventRunnable : public nsRunnable
+{
+public:
+  PluginEventRunnable(NPP inst, ANPEvent* event, NPPluginFuncs* aFuncs)
+    : mInstance(inst), mEvent(*event), mFuncs(aFuncs) {}
+  virtual nsresult Run() {
+    (*mFuncs->event)(mInstance, &mEvent);
+    return NS_OK;
+  }
+private:
+  NPP mInstance;
+  ANPEvent mEvent;
+  NPPluginFuncs* mFuncs;
+};
+
+void
+anp_event_postEvent(NPP inst, const ANPEvent* event)
+{
+  LOG("%s", __PRETTY_FUNCTION__);
+  if (!mozilla::AndroidBridge::Bridge()) {
+    LOG("no bridge in %s!!!!", __PRETTY_FUNCTION__);
+    return;
+  }
+  nsNPAPIPluginInstance* pinst = static_cast<nsNPAPIPluginInstance*>(inst->ndata);
+  NPPluginFuncs* pluginFunctions = pinst->GetPlugin()->PluginFuncs();
+  mozilla::AndroidBridge::Bridge()->PostToJavaThread(
+    new PluginEventRunnable(inst, const_cast<ANPEvent*>(event), pluginFunctions), PR_TRUE);
+  LOG("returning from %s", __PRETTY_FUNCTION__);
+}
+
+
+void InitEventInterface(ANPEventInterfaceV0 *i) {
+  _assert(i->inSize == sizeof(*i));
+  ASSIGN(i, postEvent);
+}
diff --git a/dom/plugins/base/android/ANPKeyCodes.h b/dom/plugins/base/android/ANPKeyCodes.h
new file mode 100644
index 000000000000..edfe2b95cdba
--- /dev/null
+++ b/dom/plugins/base/android/ANPKeyCodes.h
@@ -0,0 +1,152 @@
+/*
+ * Copyright 2008, The Android Open Source Project
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *  * Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ *  * Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE COPYRIGHT OWNER OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef ANPKeyCodes_DEFINED
+#define ANPKeyCodes_DEFINED
+
+/*  List the key codes that are set to a plugin in the ANPKeyEvent.
+ 
+    These exactly match the values in android/view/KeyEvent.java and the
+    corresponding .h file android/keycodes.h.
+*/
+enum ANPKeyCodes {
+    kUnknown_ANPKeyCode = 0,
+
+    kSoftLeft_ANPKeyCode = 1,
+    kSoftRight_ANPKeyCode = 2,
+    kHome_ANPKeyCode = 3,
+    kBack_ANPKeyCode = 4,
+    kCall_ANPKeyCode = 5,
+    kEndCall_ANPKeyCode = 6,
+    k0_ANPKeyCode = 7,
+    k1_ANPKeyCode = 8,
+    k2_ANPKeyCode = 9,
+    k3_ANPKeyCode = 10,
+    k4_ANPKeyCode = 11,
+    k5_ANPKeyCode = 12,
+    k6_ANPKeyCode = 13,
+    k7_ANPKeyCode = 14,
+    k8_ANPKeyCode = 15,
+    k9_ANPKeyCode = 16,
+    kStar_ANPKeyCode = 17,
+    kPound_ANPKeyCode = 18,
+    kDpadUp_ANPKeyCode = 19,
+    kDpadDown_ANPKeyCode = 20,
+    kDpadLeft_ANPKeyCode = 21,
+    kDpadRight_ANPKeyCode = 22,
+    kDpadCenter_ANPKeyCode = 23,
+    kVolumeUp_ANPKeyCode = 24,
+    kVolumeDown_ANPKeyCode = 25,
+    kPower_ANPKeyCode = 26,
+    kCamera_ANPKeyCode = 27,
+    kClear_ANPKeyCode = 28,
+    kA_ANPKeyCode = 29,
+    kB_ANPKeyCode = 30,
+    kC_ANPKeyCode = 31,
+    kD_ANPKeyCode = 32,
+    kE_ANPKeyCode = 33,
+    kF_ANPKeyCode = 34,
+    kG_ANPKeyCode = 35,
+    kH_ANPKeyCode = 36,
+    kI_ANPKeyCode = 37,
+    kJ_ANPKeyCode = 38,
+    kK_ANPKeyCode = 39,
+    kL_ANPKeyCode = 40,
+    kM_ANPKeyCode = 41,
+    kN_ANPKeyCode = 42,
+    kO_ANPKeyCode = 43,
+    kP_ANPKeyCode = 44,
+    kQ_ANPKeyCode = 45,
+    kR_ANPKeyCode = 46,
+    kS_ANPKeyCode = 47,
+    kT_ANPKeyCode = 48,
+    kU_ANPKeyCode = 49,
+    kV_ANPKeyCode = 50,
+    kW_ANPKeyCode = 51,
+    kX_ANPKeyCode = 52,
+    kY_ANPKeyCode = 53,
+    kZ_ANPKeyCode = 54,
+    kComma_ANPKeyCode = 55,
+    kPeriod_ANPKeyCode = 56,
+    kAltLeft_ANPKeyCode = 57,
+    kAltRight_ANPKeyCode = 58,
+    kShiftLeft_ANPKeyCode = 59,
+    kShiftRight_ANPKeyCode = 60,
+    kTab_ANPKeyCode = 61,
+    kSpace_ANPKeyCode = 62,
+    kSym_ANPKeyCode = 63,
+    kExplorer_ANPKeyCode = 64,
+    kEnvelope_ANPKeyCode = 65,
+    kNewline_ANPKeyCode = 66,
+    kDel_ANPKeyCode = 67,
+    kGrave_ANPKeyCode = 68,
+    kMinus_ANPKeyCode = 69,
+    kEquals_ANPKeyCode = 70,
+    kLeftBracket_ANPKeyCode = 71,
+    kRightBracket_ANPKeyCode = 72,
+    kBackslash_ANPKeyCode = 73,
+    kSemicolon_ANPKeyCode = 74,
+    kApostrophe_ANPKeyCode = 75,
+    kSlash_ANPKeyCode = 76,
+    kAt_ANPKeyCode = 77,
+    kNum_ANPKeyCode = 78,
+    kHeadSetHook_ANPKeyCode = 79,
+    kFocus_ANPKeyCode = 80,
+    kPlus_ANPKeyCode = 81,
+    kMenu_ANPKeyCode = 82,
+    kNotification_ANPKeyCode = 83,
+    kSearch_ANPKeyCode = 84,
+    kMediaPlayPause_ANPKeyCode = 85,
+    kMediaStop_ANPKeyCode = 86,
+    kMediaNext_ANPKeyCode = 87,
+    kMediaPrevious_ANPKeyCode = 88,
+    kMediaRewind_ANPKeyCode = 89,
+    kMediaFastForward_ANPKeyCode = 90,
+    kMute_ANPKeyCode = 91,
+    kPageUp_ANPKeyCode = 92,
+    kPageDown_ANPKeyCode = 93,
+    kPictsymbols_ANPKeyCode = 94,
+    kSwitchCharset_ANPKeyCode = 95,
+    kButtonA_ANPKeyCode = 96,
+    kButtonB_ANPKeyCode = 97,
+    kButtonC_ANPKeyCode = 98,
+    kButtonX_ANPKeyCode = 99,
+    kButtonY_ANPKeyCode = 100,
+    kButtonZ_ANPKeyCode = 101,
+    kButtonL1_ANPKeyCode = 102,
+    kButtonR1_ANPKeyCode = 103,
+    kButtonL2_ANPKeyCode = 104,
+    kButtonR2_ANPKeyCode = 105,
+    kButtonThumbL_ANPKeyCode = 106,
+    kButtonThumbR_ANPKeyCode = 107,
+    kButtonStart_ANPKeyCode = 108,
+    kButtonSelect_ANPKeyCode = 109,
+    kButtonMode_ANPKeyCode = 110,
+
+    // NOTE: If you add a new keycode here you must also add it to several other files.
+    //       Refer to frameworks/base/core/java/android/view/KeyEvent.java for the full list.
+};
+
+#endif
diff --git a/dom/plugins/base/android/ANPLog.cpp b/dom/plugins/base/android/ANPLog.cpp
new file mode 100644
index 000000000000..68c9ad91cb67
--- /dev/null
+++ b/dom/plugins/base/android/ANPLog.cpp
@@ -0,0 +1,59 @@
+/* -*- Mode: IDL; tab-width: 2; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
+/* ***** BEGIN LICENSE BLOCK *****
+ * Version: MPL 1.1/GPL 2.0/LGPL 2.1
+ *
+ * The contents of this file are subject to the Mozilla Public License Version
+ * 1.1 (the "License"); you may not use this file except in compliance with
+ * the License. You may obtain a copy of the License at
+ * http://www.mozilla.org/MPL/
+ *
+ * Software distributed under the License is distributed on an "AS IS" basis,
+ * WITHOUT WARRANTY OF ANY KIND, either express or implied. See the License
+ * for the specific language governing rights and limitations under the
+ * License.
+ *
+ * The Original Code is Android NPAPI support code
+ *
+ * The Initial Developer of the Original Code is
+ * the Mozilla Foundation.
+ * Portions created by the Initial Developer are Copyright (C) 2011
+ * the Initial Developer. All Rights Reserved.
+ *
+ * Contributor(s):
+ *   Doug Turner <dougt@mozilla.com>
+ *
+ * Alternatively, the contents of this file may be used under the terms of
+ * either the GNU General Public License Version 2 or later (the "GPL"), or
+ * the GNU Lesser General Public License Version 2.1 or later (the "LGPL"),
+ * in which case the provisions of the GPL or the LGPL are applicable instead
+ * of those above. If you wish to allow use of your version of this file only
+ * under the terms of either the GPL or the LGPL, and not to allow others to
+ * use your version of this file under the terms of the MPL, indicate your
+ * decision by deleting the provisions above and replace them with the notice
+ * and other provisions required by the GPL or the LGPL. If you do not delete
+ * the provisions above, a recipient may use your version of this file under
+ * the terms of any one of the MPL, the GPL or the LGPL.
+ *
+ * ***** END LICENSE BLOCK ***** */
+
+#include "assert.h"
+#include "ANPBase.h"
+#include <android/log.h>
+
+#define LOG(args...)  __android_log_print(ANDROID_LOG_INFO, "GeckoPlugins" , ## args)
+#define ASSIGN(obj, name)   (obj)->name = anp_log_##name
+
+void
+anp_log_log(ANPLogType type, const char format[], ...) {
+
+  va_list argp;
+  va_start(argp,format);
+  __android_log_vprint(type == kError_ANPLogType ? ANDROID_LOG_ERROR : type == kWarning_ANPLogType ?
+                       ANDROID_LOG_WARN : ANDROID_LOG_INFO, "GeckoPluginLog", format, argp);
+  va_end(argp);
+}
+
+void InitLogInterface(ANPLogInterfaceV0 *i) {
+      _assert(i->inSize == sizeof(*i));
+      ASSIGN(i, log);
+}
diff --git a/dom/plugins/base/android/ANPMatrix.cpp b/dom/plugins/base/android/ANPMatrix.cpp
new file mode 100644
index 000000000000..b1274d853ed0
--- /dev/null
+++ b/dom/plugins/base/android/ANPMatrix.cpp
@@ -0,0 +1,197 @@
+/* -*- Mode: IDL; tab-width: 2; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
+/* ***** BEGIN LICENSE BLOCK *****
+ * Version: MPL 1.1/GPL 2.0/LGPL 2.1
+ *
+ * The contents of this file are subject to the Mozilla Public License Version
+ * 1.1 (the "License"); you may not use this file except in compliance with
+ * the License. You may obtain a copy of the License at
+ * http://www.mozilla.org/MPL/
+ *
+ * Software distributed under the License is distributed on an "AS IS" basis,
+ * WITHOUT WARRANTY OF ANY KIND, either express or implied. See the License
+ * for the specific language governing rights and limitations under the
+ * License.
+ *
+ * The Original Code is Android NPAPI support code
+ *
+ * The Initial Developer of the Original Code is
+ * the Mozilla Foundation.
+ * Portions created by the Initial Developer are Copyright (C) 2011
+ * the Initial Developer. All Rights Reserved.
+ *
+ * Contributor(s):
+ *   Doug Turner <dougt@mozilla.com>
+ *
+ * Alternatively, the contents of this file may be used under the terms of
+ * either the GNU General Public License Version 2 or later (the "GPL"), or
+ * the GNU Lesser General Public License Version 2.1 or later (the "LGPL"),
+ * in which case the provisions of the GPL or the LGPL are applicable instead
+ * of those above. If you wish to allow use of your version of this file only
+ * under the terms of either the GPL or the LGPL, and not to allow others to
+ * use your version of this file under the terms of the MPL, indicate your
+ * decision by deleting the provisions above and replace them with the notice
+ * and other provisions required by the GPL or the LGPL. If you do not delete
+ * the provisions above, a recipient may use your version of this file under
+ * the terms of any one of the MPL, the GPL or the LGPL.
+ *
+ * ***** END LICENSE BLOCK ***** */
+
+#include "assert.h"
+#include "ANPBase.h"
+#include <android/log.h>
+
+#define LOG(args...)  __android_log_print(ANDROID_LOG_INFO, "GeckoPlugins" , ## args)
+#define ASSIGN(obj, name)   (obj)->name = anp_matrix_##name
+
+/** Return a new identity matrix
+ */
+ANPMatrix*
+anp_matrix_newMatrix()
+{
+  NOT_IMPLEMENTED();
+  return 0;
+}
+
+/** Delete a matrix previously allocated by newMatrix()
+ */
+void
+anp_matrix_deleteMatrix(ANPMatrix*)
+{
+  NOT_IMPLEMENTED();
+}
+
+
+ANPMatrixFlag
+anp_matrix_getFlags(const ANPMatrix*)
+{
+  NOT_IMPLEMENTED();
+  return 0;
+}
+
+
+void
+anp_matrix_copy(ANPMatrix* dst, const ANPMatrix* src)
+{
+  NOT_IMPLEMENTED();
+}
+
+
+void
+anp_matrix_get3x3(const ANPMatrix*, float[9])
+{
+  NOT_IMPLEMENTED();
+}
+
+void
+anp_matrix_set3x3(ANPMatrix*, const float[9])
+{
+  NOT_IMPLEMENTED();
+}
+
+
+void
+anp_matrix_setIdentity(ANPMatrix*)
+{
+  NOT_IMPLEMENTED();
+}
+
+void
+anp_matrix_preTranslate(ANPMatrix*, float tx, float ty)
+{
+  NOT_IMPLEMENTED();
+}
+
+void
+anp_matrix_postTranslate(ANPMatrix*, float tx, float ty)
+{
+  NOT_IMPLEMENTED();
+}
+
+void
+anp_matrix_preScale(ANPMatrix*, float sx, float sy)
+{
+  NOT_IMPLEMENTED();
+}
+
+void
+anp_matrix_postScale(ANPMatrix*, float sx, float sy)
+{
+  NOT_IMPLEMENTED();
+}
+
+void
+anp_matrix_preSkew(ANPMatrix*, float kx, float ky)
+{
+  NOT_IMPLEMENTED();
+}
+
+void
+anp_matrix_postSkew(ANPMatrix*, float kx, float ky)
+{
+  NOT_IMPLEMENTED();
+}
+
+void
+anp_matrix_preRotate(ANPMatrix*, float degrees)
+{
+  NOT_IMPLEMENTED();
+}
+
+void
+anp_matrix_postRotate(ANPMatrix*, float degrees)
+{
+  NOT_IMPLEMENTED();
+}
+
+void
+anp_matrix_preConcat(ANPMatrix*, const ANPMatrix*)
+{
+  NOT_IMPLEMENTED();
+}
+
+void
+anp_matrix_postConcat(ANPMatrix*, const ANPMatrix*)
+{
+  NOT_IMPLEMENTED();
+}
+
+
+bool
+anp_matrix_invert(ANPMatrix* dst, const ANPMatrix* src)
+{
+  NOT_IMPLEMENTED();
+  return false;
+}
+
+void
+anp_matrix_mapPoints(ANPMatrix*, float dst[], const float src[],
+                                 int32_t count)
+{
+  NOT_IMPLEMENTED();
+}
+
+
+void InitMatrixInterface(ANPMatrixInterfaceV0 *i) {
+  _assert(i->inSize == sizeof(*i));
+  ASSIGN(i, newMatrix);
+  ASSIGN(i, deleteMatrix);
+  ASSIGN(i, getFlags);
+  ASSIGN(i, copy);
+  ASSIGN(i, get3x3);
+  ASSIGN(i, set3x3);
+  ASSIGN(i, setIdentity);
+  ASSIGN(i, preTranslate);
+  ASSIGN(i, postTranslate);
+  ASSIGN(i, preScale);
+  ASSIGN(i, postScale);
+  ASSIGN(i, preSkew);
+  ASSIGN(i, postSkew);
+  ASSIGN(i, preRotate);
+  ASSIGN(i, postRotate);
+  ASSIGN(i, preConcat);
+  ASSIGN(i, postConcat);
+  ASSIGN(i, invert);
+  ASSIGN(i, mapPoints);
+}
+
+
diff --git a/dom/plugins/base/android/ANPPaint.cpp b/dom/plugins/base/android/ANPPaint.cpp
new file mode 100644
index 000000000000..9dc5d4c271b4
--- /dev/null
+++ b/dom/plugins/base/android/ANPPaint.cpp
@@ -0,0 +1,454 @@
+/* -*- Mode: IDL; tab-width: 2; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
+/* ***** BEGIN LICENSE BLOCK *****
+ * Version: MPL 1.1/GPL 2.0/LGPL 2.1
+ *
+ * The contents of this file are subject to the Mozilla Public License Version
+ * 1.1 (the "License"); you may not use this file except in compliance with
+ * the License. You may obtain a copy of the License at
+ * http://www.mozilla.org/MPL/
+ *
+ * Software distributed under the License is distributed on an "AS IS" basis,
+ * WITHOUT WARRANTY OF ANY KIND, either express or implied. See the License
+ * for the specific language governing rights and limitations under the
+ * License.
+ *
+ * The Original Code is Android NPAPI support code
+ *
+ * The Initial Developer of the Original Code is
+ * the Mozilla Foundation.
+ * Portions created by the Initial Developer are Copyright (C) 2011
+ * the Initial Developer. All Rights Reserved.
+ *
+ * Contributor(s):
+ *   Doug Turner <dougt@mozilla.com>
+ *
+ * Alternatively, the contents of this file may be used under the terms of
+ * either the GNU General Public License Version 2 or later (the "GPL"), or
+ * the GNU Lesser General Public License Version 2.1 or later (the "LGPL"),
+ * in which case the provisions of the GPL or the LGPL are applicable instead
+ * of those above. If you wish to allow use of your version of this file only
+ * under the terms of either the GPL or the LGPL, and not to allow others to
+ * use your version of this file under the terms of the MPL, indicate your
+ * decision by deleting the provisions above and replace them with the notice
+ * and other provisions required by the GPL or the LGPL. If you do not delete
+ * the provisions above, a recipient may use your version of this file under
+ * the terms of any one of the MPL, the GPL or the LGPL.
+ *
+ * ***** END LICENSE BLOCK ***** */
+
+#include <stdlib.h>
+#include <assert.h>
+#include <android/log.h>
+#include "ANPBase.h"
+
+#define LOG(args...)  
+//__android_log_print(ANDROID_LOG_INFO, "GeckoPlugins" , ## args)
+#define ASSIGN(obj, name)   (obj)->name = anp_paint_##name
+
+ANPPaint*
+anp_paint_newPaint()
+{
+  LOG("%s", __PRETTY_FUNCTION__);
+
+  ANPPaintPrivate* p = (ANPPaintPrivate*) calloc(1, sizeof(ANPPaintPrivate));
+  return (ANPPaint*) p;
+}
+
+void
+anp_paint_deletePaint(ANPPaint* paint)
+{
+  LOG("%s", __PRETTY_FUNCTION__);
+  if (!paint)
+    return;
+
+  ANPPaintPrivate* p = (ANPPaintPrivate*) paint;
+  free((void*)p);
+}
+
+
+ANPPaintFlags
+anp_paint_getFlags(const ANPPaint* paint)
+{
+  LOG("%s", __PRETTY_FUNCTION__);
+  if (!paint)
+    return kAntiAlias_ANPPaintFlag;
+
+  ANPPaintPrivate* p = (ANPPaintPrivate*) paint;
+  return p->flags;
+}
+
+void
+anp_paint_setFlags(ANPPaint* paint, ANPPaintFlags flags)
+{
+  LOG("%s", __PRETTY_FUNCTION__);
+  if (!paint)
+    return;
+
+  ANPPaintPrivate* p = (ANPPaintPrivate*) paint;  
+  p->flags = flags;
+}
+
+
+ANPColor
+anp_paint_getColor(const ANPPaint* paint)
+{
+  LOG("%s", __PRETTY_FUNCTION__);
+  if (!paint)
+    return ANP_MAKE_COLOR(1, 255, 255, 255);
+
+  ANPPaintPrivate* p = (ANPPaintPrivate*) paint;
+  return p->color;
+}
+
+void
+anp_paint_setColor(ANPPaint* paint, ANPColor color)
+{
+  LOG("%s", __PRETTY_FUNCTION__);
+  if (!paint)
+    return;
+
+  ANPPaintPrivate* p = (ANPPaintPrivate*) paint;
+  p->color = color;
+}
+
+
+ANPPaintStyle
+anp_paint_getStyle(const ANPPaint* paint)
+{
+  LOG("%s", __PRETTY_FUNCTION__);
+  if (!paint)
+    return kFill_ANPPaintStyle;
+
+  ANPPaintPrivate* p = (ANPPaintPrivate*) paint;
+  return p->style;
+}
+
+void
+anp_paint_setStyle(ANPPaint* paint, ANPPaintStyle style)
+{
+  LOG("%s", __PRETTY_FUNCTION__);
+  if (!paint)
+    return;
+
+  ANPPaintPrivate* p = (ANPPaintPrivate*) paint;
+  p->style = style;
+}
+
+float
+anp_paint_getStrokeWidth(const ANPPaint* paint)
+{
+  LOG("%s", __PRETTY_FUNCTION__);
+  if (!paint)
+    return 0;
+
+  ANPPaintPrivate* p = (ANPPaintPrivate*) paint;
+  return p->strokeWidth;
+}
+
+float
+anp_paint_getStrokeMiter(const ANPPaint* paint)
+{
+  LOG("%s", __PRETTY_FUNCTION__);
+  if (!paint)
+    return 0;
+
+  ANPPaintPrivate* p = (ANPPaintPrivate*) paint;
+  return p->strokeMiter;
+}
+
+ANPPaintCap
+anp_paint_getStrokeCap(const ANPPaint* paint)
+{
+  LOG("%s", __PRETTY_FUNCTION__);
+  if (!paint)
+    return kButt_ANPPaintCap;
+
+  ANPPaintPrivate* p = (ANPPaintPrivate*) paint;
+  return p->paintCap;
+}
+
+ANPPaintJoin
+anp_paint_getStrokeJoin(const ANPPaint* paint)
+{
+  LOG("%s", __PRETTY_FUNCTION__);
+  if (!paint)
+    return kMiter_ANPPaintJoin;
+
+  ANPPaintPrivate* p = (ANPPaintPrivate*) paint;
+  return p->paintJoin;
+}
+
+void
+anp_paint_setStrokeWidth(ANPPaint* paint, float width)
+{
+  LOG("%s", __PRETTY_FUNCTION__);
+  if (!paint)
+    return;
+
+  ANPPaintPrivate* p = (ANPPaintPrivate*) paint;
+  p->strokeWidth = width;
+}
+
+void
+anp_paint_setStrokeMiter(ANPPaint* paint, float miter)
+{
+  LOG("%s", __PRETTY_FUNCTION__);
+  if (!paint)
+    return;
+
+  ANPPaintPrivate* p = (ANPPaintPrivate*) paint;
+  p->strokeMiter = miter;
+}
+
+void
+anp_paint_setStrokeCap(ANPPaint* paint, ANPPaintCap cap)
+{
+  LOG("%s", __PRETTY_FUNCTION__);
+  if (!paint)
+    return;
+
+  ANPPaintPrivate* p = (ANPPaintPrivate*) paint;
+  p->paintCap = cap;
+}
+
+void
+anp_paint_setStrokeJoin(ANPPaint* paint, ANPPaintJoin join)
+{
+  LOG("%s", __PRETTY_FUNCTION__);
+  if (!paint)
+    return;
+
+  ANPPaintPrivate* p = (ANPPaintPrivate*) paint;
+  p->paintJoin = join;
+}
+
+
+ANPTextEncoding
+anp_paint_getTextEncoding(const ANPPaint* paint)
+{
+  LOG("%s", __PRETTY_FUNCTION__);
+  if (!paint)
+    return kUTF8_ANPTextEncoding;
+
+  ANPPaintPrivate* p = (ANPPaintPrivate*) paint;
+  return p->textEncoding;
+}
+
+ANPPaintAlign
+anp_paint_getTextAlign(const ANPPaint* paint)
+{
+  LOG("%s", __PRETTY_FUNCTION__);
+  if (!paint)
+    return kLeft_ANPPaintAlign;
+
+  ANPPaintPrivate* p = (ANPPaintPrivate*) paint;
+  return p->paintAlign;
+}
+
+float
+anp_paint_getTextSize(const ANPPaint* paint)
+{
+  LOG("%s", __PRETTY_FUNCTION__);
+  if (!paint)
+    return 0;
+
+  ANPPaintPrivate* p = (ANPPaintPrivate*) paint;
+  return p->textSize;
+}
+
+float
+anp_paint_getTextScaleX(const ANPPaint* paint)
+{
+  LOG("%s", __PRETTY_FUNCTION__);
+  if (!paint)
+    return 0;
+
+  ANPPaintPrivate* p = (ANPPaintPrivate*) paint;
+  return p->textScaleX;
+}
+
+float
+anp_paint_getTextSkewX(const ANPPaint* paint)
+{
+  LOG("%s", __PRETTY_FUNCTION__);
+  if (!paint)
+    return 0;
+
+  ANPPaintPrivate* p = (ANPPaintPrivate*) paint;
+  return p->textSkewX;
+}
+
+void
+anp_paint_setTextEncoding(ANPPaint* paint, ANPTextEncoding encoding)
+{
+  LOG("%s", __PRETTY_FUNCTION__);
+  if (!paint)
+    return;
+
+  ANPPaintPrivate* p = (ANPPaintPrivate*) paint;
+  p->textEncoding = encoding;
+}
+
+void
+anp_paint_setTextAlign(ANPPaint* paint, ANPPaintAlign align)
+{
+  LOG("%s", __PRETTY_FUNCTION__);
+  if (!paint)
+    return;
+
+  ANPPaintPrivate* p = (ANPPaintPrivate*) paint;
+  p->paintAlign = align;  
+}
+
+void
+anp_paint_setTextSize(ANPPaint* paint, float size)
+{
+  LOG("%s", __PRETTY_FUNCTION__);
+  if (!paint)
+    return;
+
+  ANPPaintPrivate* p = (ANPPaintPrivate*) paint;
+  p->textSize = size;
+}
+
+void
+anp_paint_setTextScaleX(ANPPaint* paint, float scale)
+{
+  LOG("%s", __PRETTY_FUNCTION__);
+  if (!paint)
+    return;
+
+  ANPPaintPrivate* p = (ANPPaintPrivate*) paint;
+  p->textScaleX = scale;
+}
+
+void
+anp_paint_setTextSkewX(ANPPaint* paint, float skew)
+{
+  LOG("%s", __PRETTY_FUNCTION__);
+  if (!paint)
+    return;
+
+  ANPPaintPrivate* p = (ANPPaintPrivate*) paint;
+  p->textSkewX = skew;
+}
+
+
+/** Return the typeface in paint, or null if there is none. This does not
+    modify the owner count of the returned typeface.
+*/
+ANPTypeface*
+anp_paint_getTypeface(const ANPPaint* paint)
+{
+  LOG("%s", __PRETTY_FUNCTION__);
+  if (!paint)
+    return NULL;
+
+  ANPPaintPrivate* p = (ANPPaintPrivate*) paint;
+  return &p->typeface;
+}
+
+
+/** Set the paint's typeface. If the paint already had a non-null typeface,
+    its owner count is decremented. If the new typeface is non-null, its
+    owner count is incremented.
+*/
+void
+anp_paint_setTypeface(ANPPaint* paint, ANPTypeface* typeface)
+{
+  LOG("%s", __PRETTY_FUNCTION__);
+  if (!paint)
+    return;
+
+  ANPPaintPrivate* p = (ANPPaintPrivate*) paint;
+  LOG("%s is not impl.", __PRETTY_FUNCTION__);
+}
+
+/** Return the width of the text. If bounds is not null, return the bounds
+    of the text in that rectangle.
+*/
+float
+anp_paint_measureText(ANPPaint* paint, const void* text, uint32_t byteLength,
+                      ANPRectF* bounds)
+{
+  LOG("%s", __PRETTY_FUNCTION__);
+  if (!paint)
+    return 0;
+
+  ANPPaintPrivate* p = (ANPPaintPrivate*) paint;
+
+  LOG("%s is not impl.", __PRETTY_FUNCTION__);
+  return 0;
+}
+
+
+/** Return the number of unichars specifed by the text.
+    If widths is not null, returns the array of advance widths for each
+    unichar.
+    If bounds is not null, returns the array of bounds for each unichar.
+*/
+int
+anp_paint_getTextWidths(ANPPaint* paint, const void* text, uint32_t byteLength,
+                        float widths[], ANPRectF bounds[])
+{
+  LOG("%s", __PRETTY_FUNCTION__);
+  if (!paint)
+    return 0;
+
+  ANPPaintPrivate* p = (ANPPaintPrivate*) paint;
+  LOG("%s is not impl.", __PRETTY_FUNCTION__);
+  return 0;
+}
+
+
+/** Return in metrics the spacing values for text, respecting the paint's
+    typeface and pointsize, and return the spacing between lines
+    (descent - ascent + leading). If metrics is NULL, it will be ignored.
+*/
+float
+anp_paint_getFontMetrics(ANPPaint* paint, ANPFontMetrics* metrics)
+{
+  LOG("%s", __PRETTY_FUNCTION__);
+  if (!paint)
+    return 0;
+
+  ANPPaintPrivate* p = (ANPPaintPrivate*) paint;
+  LOG("%s is not impl.", __PRETTY_FUNCTION__);
+  return 0;
+}
+
+
+void InitPaintInterface(ANPPaintInterfaceV0 *i) {
+  _assert(i->inSize == sizeof(*i));
+  ASSIGN(i, newPaint);
+  ASSIGN(i, deletePaint);
+  ASSIGN(i, getFlags);
+  ASSIGN(i, setFlags);
+  ASSIGN(i, getColor);
+  ASSIGN(i, setColor);
+  ASSIGN(i, getStyle);
+  ASSIGN(i, setStyle);
+  ASSIGN(i, getStrokeWidth);
+  ASSIGN(i, getStrokeMiter);
+  ASSIGN(i, getStrokeCap);
+  ASSIGN(i, getStrokeJoin);
+  ASSIGN(i, setStrokeWidth);
+  ASSIGN(i, setStrokeMiter);
+  ASSIGN(i, setStrokeCap);
+  ASSIGN(i, setStrokeJoin);
+  ASSIGN(i, getTextEncoding);
+  ASSIGN(i, getTextAlign);
+  ASSIGN(i, getTextSize);
+  ASSIGN(i, getTextScaleX);
+  ASSIGN(i, getTextSkewX);
+  ASSIGN(i, setTextEncoding);
+  ASSIGN(i, setTextAlign);
+  ASSIGN(i, setTextSize);
+  ASSIGN(i, setTextScaleX);
+  ASSIGN(i, setTextSkewX);
+  ASSIGN(i, getTypeface);
+  ASSIGN(i, setTypeface);
+  ASSIGN(i, measureText);
+  ASSIGN(i, getTextWidths);
+  ASSIGN(i, getFontMetrics);
+}
diff --git a/dom/plugins/base/android/ANPPath.cpp b/dom/plugins/base/android/ANPPath.cpp
new file mode 100644
index 000000000000..ca1dbe9d48d0
--- /dev/null
+++ b/dom/plugins/base/android/ANPPath.cpp
@@ -0,0 +1,171 @@
+/* -*- Mode: IDL; tab-width: 2; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
+/* ***** BEGIN LICENSE BLOCK *****
+ * Version: MPL 1.1/GPL 2.0/LGPL 2.1
+ *
+ * The contents of this file are subject to the Mozilla Public License Version
+ * 1.1 (the "License"); you may not use this file except in compliance with
+ * the License. You may obtain a copy of the License at
+ * http://www.mozilla.org/MPL/
+ *
+ * Software distributed under the License is distributed on an "AS IS" basis,
+ * WITHOUT WARRANTY OF ANY KIND, either express or implied. See the License
+ * for the specific language governing rights and limitations under the
+ * License.
+ *
+ * The Original Code is Android NPAPI support code
+ *
+ * The Initial Developer of the Original Code is
+ * the Mozilla Foundation.
+ * Portions created by the Initial Developer are Copyright (C) 2011
+ * the Initial Developer. All Rights Reserved.
+ *
+ * Contributor(s):
+ *   Doug Turner <dougt@mozilla.com>
+ *
+ * Alternatively, the contents of this file may be used under the terms of
+ * either the GNU General Public License Version 2 or later (the "GPL"), or
+ * the GNU Lesser General Public License Version 2.1 or later (the "LGPL"),
+ * in which case the provisions of the GPL or the LGPL are applicable instead
+ * of those above. If you wish to allow use of your version of this file only
+ * under the terms of either the GPL or the LGPL, and not to allow others to
+ * use your version of this file under the terms of the MPL, indicate your
+ * decision by deleting the provisions above and replace them with the notice
+ * and other provisions required by the GPL or the LGPL. If you do not delete
+ * the provisions above, a recipient may use your version of this file under
+ * the terms of any one of the MPL, the GPL or the LGPL.
+ *
+ * ***** END LICENSE BLOCK ***** */
+
+#include "assert.h"
+#include "ANPBase.h"
+#include <android/log.h>
+
+#define LOG(args...)  __android_log_print(ANDROID_LOG_INFO, "GeckoPlugins" , ## args)
+#define ASSIGN(obj, name)   (obj)->name = anp_path_##name
+
+
+// maybe this should store a list of actions (lineTo,
+// moveTo), and when canvas_drawPath() we apply all of these
+// actions to the gfxContext.
+
+ANPPath*
+anp_path_newPath()
+{
+  LOG("%s - NOT IMPL.", __PRETTY_FUNCTION__);
+  return 0;
+}
+
+
+void
+anp_path_deletePath(ANPPath* p)
+{
+  LOG("%s - NOT IMPL.", __PRETTY_FUNCTION__);
+}
+
+
+void
+anp_path_copy(ANPPath* dst, const ANPPath* src)
+{
+  LOG("%s - NOT IMPL.", __PRETTY_FUNCTION__);
+}
+
+
+bool
+anp_path_equal(const ANPPath* path0, const ANPPath* path1)
+{
+  LOG("%s - NOT IMPL.", __PRETTY_FUNCTION__);
+  return false;
+}
+
+
+void
+anp_path_reset(ANPPath* p)
+{
+  LOG("%s - NOT IMPL.", __PRETTY_FUNCTION__);
+}
+
+
+bool
+anp_path_isEmpty(const ANPPath* p)
+{
+  LOG("%s - NOT IMPL.", __PRETTY_FUNCTION__);
+  return false;
+}
+
+
+void
+anp_path_getBounds(const ANPPath* p, ANPRectF* bounds)
+{
+  LOG("%s - NOT IMPL.", __PRETTY_FUNCTION__);
+
+  bounds->left = 0;
+  bounds->top = 0;
+  bounds->right = 1000;
+  bounds->left = 1000;
+}
+
+
+void
+anp_path_moveTo(ANPPath* p, float x, float y)
+{
+  LOG("%s - NOT IMPL.", __PRETTY_FUNCTION__);
+}
+
+void
+anp_path_lineTo(ANPPath* p, float x, float y)
+{
+  LOG("%s - NOT IMPL.", __PRETTY_FUNCTION__);
+}
+
+void
+anp_path_quadTo(ANPPath* p, float x0, float y0, float x1, float y1)
+{
+  LOG("%s - NOT IMPL.", __PRETTY_FUNCTION__);
+}
+
+void
+anp_path_cubicTo(ANPPath* p, float x0, float y0, float x1, float y1,
+                      float x2, float y2)
+{
+  LOG("%s - NOT IMPL.", __PRETTY_FUNCTION__);
+}
+
+void
+anp_path_close(ANPPath* p)
+{
+  LOG("%s - NOT IMPL.", __PRETTY_FUNCTION__);
+}
+
+
+void
+anp_path_offset(ANPPath* src, float dx, float dy, ANPPath* dst)
+{
+  LOG("%s - NOT IMPL.", __PRETTY_FUNCTION__);
+}
+
+
+void
+anp_path_transform(ANPPath* src, const ANPMatrix*, ANPPath* dst)
+{
+  LOG("%s - NOT IMPL.", __PRETTY_FUNCTION__);
+}
+
+
+
+void InitPathInterface(ANPPathInterfaceV0 *i) {
+  _assert(i->inSize == sizeof(*i));
+  ASSIGN(i, newPath);
+  ASSIGN(i, deletePath);
+  ASSIGN(i, copy);
+  ASSIGN(i, equal);
+  ASSIGN(i, reset);
+  ASSIGN(i, isEmpty);
+  ASSIGN(i, getBounds);
+  ASSIGN(i, moveTo);
+  ASSIGN(i, lineTo);
+  ASSIGN(i, quadTo);
+  ASSIGN(i, cubicTo);
+  ASSIGN(i, close);
+  ASSIGN(i, offset);
+  ASSIGN(i, transform);
+}
diff --git a/dom/plugins/base/android/ANPSurface.cpp b/dom/plugins/base/android/ANPSurface.cpp
new file mode 100644
index 000000000000..f4984b1d286e
--- /dev/null
+++ b/dom/plugins/base/android/ANPSurface.cpp
@@ -0,0 +1,189 @@
+/* -*- Mode: IDL; tab-width: 2; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
+/* ***** BEGIN LICENSE BLOCK *****
+ * Version: MPL 1.1/GPL 2.0/LGPL 2.1
+ *
+ * The contents of this file are subject to the Mozilla Public License Version
+ * 1.1 (the "License"); you may not use this file except in compliance with
+ * the License. You may obtain a copy of the License at
+ * http://www.mozilla.org/MPL/
+ *
+ * Software distributed under the License is distributed on an "AS IS" basis,
+ * WITHOUT WARRANTY OF ANY KIND, either express or implied. See the License
+ * for the specific language governing rights and limitations under the
+ * License.
+ *
+ * The Original Code is Android NPAPI support code
+ *
+ * The Initial Developer of the Original Code is
+ * the Mozilla Foundation.
+ * Portions created by the Initial Developer are Copyright (C) 2011
+ * the Initial Developer. All Rights Reserved.
+ *
+ * Contributor(s):
+ *   Doug Turner <dougt@mozilla.com>
+ *
+ * Alternatively, the contents of this file may be used under the terms of
+ * either the GNU General Public License Version 2 or later (the "GPL"), or
+ * the GNU Lesser General Public License Version 2.1 or later (the "LGPL"),
+ * in which case the provisions of the GPL or the LGPL are applicable instead
+ * of those above. If you wish to allow use of your version of this file only
+ * under the terms of either the GPL or the LGPL, and not to allow others to
+ * use your version of this file under the terms of the MPL, indicate your
+ * decision by deleting the provisions above and replace them with the notice
+ * and other provisions required by the GPL or the LGPL. If you do not delete
+ * the provisions above, a recipient may use your version of this file under
+ * the terms of any one of the MPL, the GPL or the LGPL.
+ *
+ * ***** END LICENSE BLOCK ***** */
+
+#include "assert.h"
+#include "ANPBase.h"
+#include <android/log.h>
+#include "AndroidBridge.h"
+#include "gfxImageSurface.h"
+#include "gfxContext.h"
+
+#define LOG(args...)  __android_log_print(ANDROID_LOG_INFO, "GeckoPlugins" , ## args)
+#define ASSIGN(obj, name)   (obj)->name = anp_surface_##name
+
+
+// used to cache JNI method and field IDs for Surface Objects
+static struct ANPSurfaceInterfaceJavaGlue {
+  bool        initialized;
+  jclass geckoAppShellClass;
+  jclass lockInfoCls;
+  jmethodID lockSurfaceANP;
+  jmethodID jUnlockSurfaceANP;
+  jfieldID jDirtyTop;
+  jfieldID jDirtyLeft;
+  jfieldID jDirtyBottom;
+  jfieldID jDirtyRight;
+  jfieldID jFormat;
+  jfieldID jWidth ;
+  jfieldID jHeight;
+  jfieldID jBuffer;
+} gSurfaceJavaGlue;
+
+#define getClassGlobalRef(env, cname)                                    \
+     (jClass = jclass(env->NewGlobalRef(env->FindClass(cname))))
+
+static void init(JNIEnv* env) {
+  if (gSurfaceJavaGlue.initialized)
+    return;
+  
+  gSurfaceJavaGlue.geckoAppShellClass = mozilla::AndroidBridge::GetGeckoAppShellClass();
+  
+  jmethodID getClass = env->GetStaticMethodID(gSurfaceJavaGlue.geckoAppShellClass, 
+                                              "getSurfaceLockInfoClass",
+                                              "()Ljava/lang/Class;");
+
+  gSurfaceJavaGlue.lockInfoCls = (jclass) env->NewGlobalRef(env->CallStaticObjectMethod(gSurfaceJavaGlue.geckoAppShellClass, getClass));
+
+  gSurfaceJavaGlue.jDirtyTop = env->GetFieldID(gSurfaceJavaGlue.lockInfoCls, "dirtyTop", "I");
+  gSurfaceJavaGlue.jDirtyLeft = env->GetFieldID(gSurfaceJavaGlue.lockInfoCls, "dirtyLeft", "I");
+  gSurfaceJavaGlue.jDirtyBottom = env->GetFieldID(gSurfaceJavaGlue.lockInfoCls, "dirtyBottom", "I");
+  gSurfaceJavaGlue.jDirtyRight = env->GetFieldID(gSurfaceJavaGlue.lockInfoCls, "dirtyRight", "I");
+
+  gSurfaceJavaGlue.jFormat = env->GetFieldID(gSurfaceJavaGlue.lockInfoCls, "format", "I");
+  gSurfaceJavaGlue.jWidth = env->GetFieldID(gSurfaceJavaGlue.lockInfoCls, "width", "I");
+  gSurfaceJavaGlue.jHeight = env->GetFieldID(gSurfaceJavaGlue.lockInfoCls, "height", "I");
+
+  gSurfaceJavaGlue.jBuffer = env->GetFieldID(gSurfaceJavaGlue.lockInfoCls, "buffer", "Ljava/nio/Buffer;");
+  gSurfaceJavaGlue.lockSurfaceANP = env->GetStaticMethodID(gSurfaceJavaGlue.geckoAppShellClass, "lockSurfaceANP", "(Landroid/view/SurfaceView;IIII)Lorg/mozilla/gecko/SurfaceLockInfo;");
+  gSurfaceJavaGlue.jUnlockSurfaceANP = env->GetStaticMethodID(gSurfaceJavaGlue.geckoAppShellClass, "unlockSurfaceANP", "(Landroid/view/SurfaceView;)V");
+  gSurfaceJavaGlue.initialized = true;
+}
+
+static bool anp_lock(JNIEnv* env, jobject surfaceView, ANPBitmap* bitmap, ANPRectI* dirtyRect) {
+  LOG("%s", __PRETTY_FUNCTION__);
+  if (!bitmap || !surfaceView) {
+    LOG("%s, null bitmap or surface, exiting", __PRETTY_FUNCTION__);
+    return false;
+  }
+
+  init(env);
+
+  jvalue args[5];
+  args[0].l = surfaceView;
+  if (dirtyRect) {
+    args[1].i = dirtyRect->top;
+    args[2].i = dirtyRect->left;
+    args[3].i = dirtyRect->bottom;
+    args[4].i = dirtyRect->right;
+    LOG("dirty rect: %d, %d, %d, %d", dirtyRect->top, dirtyRect->left, dirtyRect->bottom, dirtyRect->right);
+  } else {
+    args[1].i = args[2].i = args[3].i = args[4].i = 0;
+  }
+  
+  jobject info = env->CallStaticObjectMethod(gSurfaceJavaGlue.geckoAppShellClass,
+                                             gSurfaceJavaGlue.lockSurfaceANP, 
+                                             surfaceView, args[1].i, args[2].i, args[3].i, args[4].i);
+
+  LOG("info: %p", info);
+  if (!info)
+    return false;
+
+  // the surface may have expanded the dirty region so we must to pass that
+  // information back to the plugin.
+  if (dirtyRect) {
+    dirtyRect->left   = env->GetIntField(info, gSurfaceJavaGlue.jDirtyLeft);
+    dirtyRect->right  = env->GetIntField(info, gSurfaceJavaGlue.jDirtyRight);
+    dirtyRect->top    = env->GetIntField(info, gSurfaceJavaGlue.jDirtyTop);
+    dirtyRect->bottom = env->GetIntField(info, gSurfaceJavaGlue.jDirtyBottom);
+    LOG("dirty rect: %d, %d, %d, %d", dirtyRect->top, dirtyRect->left, dirtyRect->bottom, dirtyRect->right);
+  }
+
+  bitmap->width  = env->GetIntField(info, gSurfaceJavaGlue.jWidth);
+  bitmap->height = env->GetIntField(info, gSurfaceJavaGlue.jHeight);
+
+  int format = env->GetIntField(info, gSurfaceJavaGlue.jFormat);
+
+  // format is PixelFormat
+  if (format & 0x00000001) {
+    bitmap->format = kRGBA_8888_ANPBitmapFormat;
+    bitmap->rowBytes = bitmap->width * 4;
+  }
+  else if (format & 0x00000004) {
+    bitmap->format = kRGB_565_ANPBitmapFormat;
+    bitmap->rowBytes = bitmap->width * 2;
+  }
+  else {
+    LOG("format from glue is unknown %d\n", format);
+    return false;
+  }
+
+  jobject buf = env->GetObjectField(info, gSurfaceJavaGlue.jBuffer);
+  bitmap->baseAddr = env->GetDirectBufferAddress(buf);
+  
+  LOG("format: %d, width: %d, height: %d",  bitmap->format,  bitmap->width,  bitmap->height);
+  env->DeleteLocalRef(info);
+  env->DeleteLocalRef(buf);
+  return ( bitmap->width > 0 && bitmap->height > 0 );
+}
+
+static void anp_unlock(JNIEnv* env, jobject surfaceView) {
+  LOG("%s", __PRETTY_FUNCTION__);
+
+  if (!surfaceView) {
+    LOG("null surface, exiting %s", __PRETTY_FUNCTION__);
+    return;
+  }
+
+  init(env);
+  env->CallStaticVoidMethod(gSurfaceJavaGlue.geckoAppShellClass, gSurfaceJavaGlue.jUnlockSurfaceANP, surfaceView);
+  LOG("returning from %s", __PRETTY_FUNCTION__);
+
+}
+
+///////////////////////////////////////////////////////////////////////////////
+
+#define ASSIGN(obj, name)   (obj)->name = anp_##name
+
+void InitSurfaceInterface(ANPSurfaceInterfaceV0 *i) {
+
+  ASSIGN(i, lock);
+  ASSIGN(i, unlock);
+
+  // setup the java glue struct
+  gSurfaceJavaGlue.initialized = false;
+}
diff --git a/dom/plugins/base/android/ANPSystem.cpp b/dom/plugins/base/android/ANPSystem.cpp
new file mode 100644
index 000000000000..70085217328c
--- /dev/null
+++ b/dom/plugins/base/android/ANPSystem.cpp
@@ -0,0 +1,86 @@
+/* -*- Mode: IDL; tab-width: 2; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
+/* ***** BEGIN LICENSE BLOCK *****
+ * Version: MPL 1.1/GPL 2.0/LGPL 2.1
+ *
+ * The contents of this file are subject to the Mozilla Public License Version
+ * 1.1 (the "License"); you may not use this file except in compliance with
+ * the License. You may obtain a copy of the License at
+ * http://www.mozilla.org/MPL/
+ *
+ * Software distributed under the License is distributed on an "AS IS" basis,
+ * WITHOUT WARRANTY OF ANY KIND, either express or implied. See the License
+ * for the specific language governing rights and limitations under the
+ * License.
+ *
+ * The Original Code is Android NPAPI support code
+ *
+ * The Initial Developer of the Original Code is
+ * the Mozilla Foundation.
+ * Portions created by the Initial Developer are Copyright (C) 2011
+ * the Initial Developer. All Rights Reserved.
+ *
+ * Contributor(s):
+ *   Doug Turner <dougt@mozilla.com>
+ *
+ * Alternatively, the contents of this file may be used under the terms of
+ * either the GNU General Public License Version 2 or later (the "GPL"), or
+ * the GNU Lesser General Public License Version 2.1 or later (the "LGPL"),
+ * in which case the provisions of the GPL or the LGPL are applicable instead
+ * of those above. If you wish to allow use of your version of this file only
+ * under the terms of either the GPL or the LGPL, and not to allow others to
+ * use your version of this file under the terms of the MPL, indicate your
+ * decision by deleting the provisions above and replace them with the notice
+ * and other provisions required by the GPL or the LGPL. If you do not delete
+ * the provisions above, a recipient may use your version of this file under
+ * the terms of any one of the MPL, the GPL or the LGPL.
+ *
+ * ***** END LICENSE BLOCK ***** */
+
+#include "base/basictypes.h"
+
+#include "assert.h"
+#include "ANPBase.h"
+#include <android/log.h>
+#include "nsNPAPIPluginInstance.h"
+#include "AndroidBridge.h"
+#include "nsNPAPIPlugin.h"
+#include "PluginPRLibrary.h"
+
+#define LOG(args...)  __android_log_print(ANDROID_LOG_INFO, "GeckoPlugins" , ## args)
+#define ASSIGN(obj, name)   (obj)->name = anp_system_##name
+
+const char*
+anp_system_getApplicationDataDirectory()
+{
+  LOG("getApplicationDataDirectory return /data/data/org.mozilla.%s", MOZ_APP_NAME);
+  return "/data/data/org.mozilla." MOZ_APP_NAME;
+}
+
+jclass anp_system_loadJavaClass(NPP instance, const char* className)
+{
+  LOG("%s", __PRETTY_FUNCTION__);
+
+  JNIEnv* env = GetJNIForThread();
+  jclass cls = env->FindClass("org/mozilla/gecko/GeckoAppShell");
+  jmethodID method = env->GetStaticMethodID(cls,
+                                            "loadPluginClass",
+                                            "(Ljava/lang/String;Ljava/lang/String;)Ljava/lang/Class;");
+
+  // pass libname and classname, gotta create java strings
+  nsNPAPIPluginInstance* pinst = static_cast<nsNPAPIPluginInstance*>(instance->ndata);
+  mozilla::PluginPRLibrary* lib = static_cast<mozilla::PluginPRLibrary*>(pinst->GetPlugin()->GetLibrary());
+
+  nsCString libName;
+  lib->GetLibraryPath(libName);
+
+  jstring jclassName = env->NewStringUTF(className);
+  jstring jlibName = env->NewStringUTF(libName.get());
+  jobject obj = env->CallStaticObjectMethod(cls, method, jclassName, jlibName);
+  return reinterpret_cast<jclass>(obj);
+}
+
+void InitSystemInterface(ANPSystemInterfaceV0 *i) {
+  _assert(i->inSize == sizeof(*i));
+  ASSIGN(i, getApplicationDataDirectory);
+  ASSIGN(i, loadJavaClass);
+}
diff --git a/dom/plugins/base/android/ANPTypeface.cpp b/dom/plugins/base/android/ANPTypeface.cpp
new file mode 100644
index 000000000000..85b8d7b8fe97
--- /dev/null
+++ b/dom/plugins/base/android/ANPTypeface.cpp
@@ -0,0 +1,151 @@
+/* -*- Mode: IDL; tab-width: 2; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
+/* ***** BEGIN LICENSE BLOCK *****
+ * Version: MPL 1.1/GPL 2.0/LGPL 2.1
+ *
+ * The contents of this file are subject to the Mozilla Public License Version
+ * 1.1 (the "License"); you may not use this file except in compliance with
+ * the License. You may obtain a copy of the License at
+ * http://www.mozilla.org/MPL/
+ *
+ * Software distributed under the License is distributed on an "AS IS" basis,
+ * WITHOUT WARRANTY OF ANY KIND, either express or implied. See the License
+ * for the specific language governing rights and limitations under the
+ * License.
+ *
+ * The Original Code is Android NPAPI support code
+ *
+ * The Initial Developer of the Original Code is
+ * the Mozilla Foundation.
+ * Portions created by the Initial Developer are Copyright (C) 2011
+ * the Initial Developer. All Rights Reserved.
+ *
+ * Contributor(s):
+ *   Doug Turner <dougt@mozilla.com>
+ *
+ * Alternatively, the contents of this file may be used under the terms of
+ * either the GNU General Public License Version 2 or later (the "GPL"), or
+ * the GNU Lesser General Public License Version 2.1 or later (the "LGPL"),
+ * in which case the provisions of the GPL or the LGPL are applicable instead
+ * of those above. If you wish to allow use of your version of this file only
+ * under the terms of either the GPL or the LGPL, and not to allow others to
+ * use your version of this file under the terms of the MPL, indicate your
+ * decision by deleting the provisions above and replace them with the notice
+ * and other provisions required by the GPL or the LGPL. If you do not delete
+ * the provisions above, a recipient may use your version of this file under
+ * the terms of any one of the MPL, the GPL or the LGPL.
+ *
+ * ***** END LICENSE BLOCK ***** */
+
+#include "assert.h"
+#include "ANPBase.h"
+#include <android/log.h>
+#include "gfxAndroidPlatform.h"
+
+#define LOG(args...)  __android_log_print(ANDROID_LOG_INFO, "GeckoPlugins" , ## args)
+#define ASSIGN(obj, name)   (obj)->name = anp_typeface_##name
+
+ANPTypeface*
+anp_typeface_createFromName(const char name[], ANPTypefaceStyle aStyle)
+{
+  LOG("%s - %s\n", __PRETTY_FUNCTION__, name);
+
+  gfxFontStyle style (aStyle == kItalic_ANPTypefaceStyle ? FONT_STYLE_ITALIC :
+                      FONT_STYLE_NORMAL,
+                      NS_FONT_STRETCH_NORMAL,
+                      aStyle == kBold_ANPTypefaceStyle ? 700 : 400,
+                      16.0,
+                      NS_NewPermanentAtom(NS_LITERAL_STRING("en")),
+                      0.0,
+                      PR_FALSE, PR_FALSE,
+                      NS_LITERAL_STRING(""),
+                      NS_LITERAL_STRING(""));
+  ANPTypeface* tf = new ANPTypeface;
+  gfxAndroidPlatform * p = (gfxAndroidPlatform*)gfxPlatform::GetPlatform();
+  tf->mFont = gfxFT2Font::GetOrMakeFont(NS_ConvertASCIItoUTF16(name), &style);
+  return tf;
+}
+
+ANPTypeface*
+anp_typeface_createFromTypeface(const ANPTypeface* family,
+                                ANPTypefaceStyle)
+{
+  NOT_IMPLEMENTED();
+  return 0;
+}
+
+int32_t
+anp_typeface_getRefCount(const ANPTypeface*)
+{
+  NOT_IMPLEMENTED();
+  return 0;
+}
+
+void
+anp_typeface_ref(ANPTypeface* tf)
+{
+  LOG("%s\n", __PRETTY_FUNCTION__);
+  if (tf->mFont)
+    tf->mFont->AddRef();
+
+}
+
+void
+anp_typeface_unref(ANPTypeface* tf)
+{
+  LOG("%s\n", __PRETTY_FUNCTION__);
+  if (tf->mFont)
+    tf->mFont->Release();
+}
+
+ANPTypefaceStyle
+anp_typeface_getStyle(const ANPTypeface* ft)
+{
+  LOG("%s\n", __PRETTY_FUNCTION__);
+  return kBold_ANPTypefaceStyle;
+}
+
+int32_t
+anp_typeface_getFontPath(const ANPTypeface*, char path[], int32_t length,
+                         int32_t* index)
+{
+  NOT_IMPLEMENTED();
+  return 0;
+}
+
+static const char* gFontDir;
+#define FONT_DIR_SUFFIX     "/fonts/"
+
+const char*
+anp_typeface_getFontDirectoryPath()
+{
+  LOG("%s\n", __PRETTY_FUNCTION__);
+  if (NULL == gFontDir) {
+    const char* root = getenv("ANDROID_ROOT");
+    size_t len = strlen(root);
+    char* storage = (char*)malloc(len + sizeof(FONT_DIR_SUFFIX));
+    if (NULL == storage) {
+      return NULL;
+    }
+    memcpy(storage, root, len);
+    memcpy(storage + len, FONT_DIR_SUFFIX, sizeof(FONT_DIR_SUFFIX));
+    // save this assignment for last, so that if multiple threads call us
+    // (which should never happen), we never return an incomplete global.
+    // At worst, we would allocate storage for the path twice.
+    gFontDir = storage;
+  }
+
+  return 0;
+}
+
+void InitTypeFaceInterface(ANPTypefaceInterfaceV0 *i) {
+  _assert(i->inSize == sizeof(*i));
+  ASSIGN(i, createFromName);
+  ASSIGN(i, createFromTypeface);
+  ASSIGN(i, getRefCount);
+  ASSIGN(i, ref);
+  ASSIGN(i, unref);
+  ASSIGN(i, getStyle);
+  ASSIGN(i, getFontPath);
+  ASSIGN(i, getFontDirectoryPath);
+}
+
diff --git a/dom/plugins/base/android/ANPWindow.cpp b/dom/plugins/base/android/ANPWindow.cpp
new file mode 100644
index 000000000000..c26790054b2c
--- /dev/null
+++ b/dom/plugins/base/android/ANPWindow.cpp
@@ -0,0 +1,91 @@
+/* -*- Mode: IDL; tab-width: 2; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
+/* ***** BEGIN LICENSE BLOCK *****
+ * Version: MPL 1.1/GPL 2.0/LGPL 2.1
+ *
+ * The contents of this file are subject to the Mozilla Public License Version
+ * 1.1 (the "License"); you may not use this file except in compliance with
+ * the License. You may obtain a copy of the License at
+ * http://www.mozilla.org/MPL/
+ *
+ * Software distributed under the License is distributed on an "AS IS" basis,
+ * WITHOUT WARRANTY OF ANY KIND, either express or implied. See the License
+ * for the specific language governing rights and limitations under the
+ * License.
+ *
+ * The Original Code is Android NPAPI support code
+ *
+ * The Initial Developer of the Original Code is
+ * the Mozilla Foundation.
+ * Portions created by the Initial Developer are Copyright (C) 2011
+ * the Initial Developer. All Rights Reserved.
+ *
+ * Contributor(s):
+ *   Doug Turner <dougt@mozilla.com>
+ *
+ * Alternatively, the contents of this file may be used under the terms of
+ * either the GNU General Public License Version 2 or later (the "GPL"), or
+ * the GNU Lesser General Public License Version 2.1 or later (the "LGPL"),
+ * in which case the provisions of the GPL or the LGPL are applicable instead
+ * of those above. If you wish to allow use of your version of this file only
+ * under the terms of either the GPL or the LGPL, and not to allow others to
+ * use your version of this file under the terms of the MPL, indicate your
+ * decision by deleting the provisions above and replace them with the notice
+ * and other provisions required by the GPL or the LGPL. If you do not delete
+ * the provisions above, a recipient may use your version of this file under
+ * the terms of any one of the MPL, the GPL or the LGPL.
+ *
+ * ***** END LICENSE BLOCK ***** */
+
+#include "assert.h"
+#include "ANPBase.h"
+#include <android/log.h>
+
+#define LOG(args...)  __android_log_print(ANDROID_LOG_INFO, "GeckoPlugins" , ## args)
+#define ASSIGN(obj, name)   (obj)->name = anp_window_##name
+
+void
+anp_window_setVisibleRects(NPP instance, const ANPRectI rects[], int32_t count)
+{
+  NOT_IMPLEMENTED();
+}
+
+void
+anp_window_clearVisibleRects(NPP instance)
+{
+  NOT_IMPLEMENTED();
+}
+
+void
+anp_window_showKeyboard(NPP instance, bool value)
+{
+  NOT_IMPLEMENTED();
+}
+
+void
+anp_window_requestFullScreen(NPP instance)
+{
+  NOT_IMPLEMENTED();
+}
+
+void
+anp_window_exitFullScreen(NPP instance)
+{
+  NOT_IMPLEMENTED();
+}
+
+void
+anp_window_requestCenterFitZoom(NPP instance)
+{
+  NOT_IMPLEMENTED();
+}
+
+void InitWindowInterface(ANPWindowInterfaceV0 *i) {
+  _assert(i->inSize == sizeof(*i));
+  ASSIGN(i, setVisibleRects);
+  ASSIGN(i, clearVisibleRects);
+  ASSIGN(i, showKeyboard);
+  ASSIGN(i, requestFullScreen);
+  ASSIGN(i, exitFullScreen);
+  ASSIGN(i, requestCenterFitZoom);
+}
+
diff --git a/dom/plugins/base/android/Makefile.in b/dom/plugins/base/android/Makefile.in
new file mode 100644
index 000000000000..42e5067f3aed
--- /dev/null
+++ b/dom/plugins/base/android/Makefile.in
@@ -0,0 +1,81 @@
+#
+# ***** BEGIN LICENSE BLOCK *****
+# Version: MPL 1.1/GPL 2.0/LGPL 2.1
+#
+# The contents of this file are subject to the Mozilla Public License Version
+# 1.1 (the "License"); you may not use this file except in compliance with
+# the License. You may obtain a copy of the License at
+# http://www.mozilla.org/MPL/
+#
+# Software distributed under the License is distributed on an "AS IS" basis,
+# WITHOUT WARRANTY OF ANY KIND, either express or implied. See the License
+# for the specific language governing rights and limitations under the
+# License.
+#
+# The Original Code is mozilla.org code.
+#
+# The Initial Developer of the Original Code is
+# Netscape Communications Corporation.
+# Portions created by the Initial Developer are Copyright (C) 1998
+# the Initial Developer. All Rights Reserved.
+#
+# Contributor(s):
+#
+# Alternatively, the contents of this file may be used under the terms of
+# either the GNU General Public License Version 2 or later (the "GPL"), or
+# the GNU Lesser General Public License Version 2.1 or later (the "LGPL"),
+# in which case the provisions of the GPL or the LGPL are applicable instead
+# of those above. If you wish to allow use of your version of this file only
+# under the terms of either the GPL or the LGPL, and not to allow others to
+# use your version of this file under the terms of the MPL, indicate your
+# decision by deleting the provisions above and replace them with the notice
+# and other provisions required by the GPL or the LGPL. If you do not delete
+# the provisions above, a recipient may use your version of this file under
+# the terms of any one of the MPL, the GPL or the LGPL.
+#
+# ***** END LICENSE BLOCK *****
+
+DEPTH		= ../../../..
+topsrcdir	= @top_srcdir@
+srcdir		= @srcdir@
+VPATH		= @srcdir@
+
+include $(DEPTH)/config/autoconf.mk
+
+MODULE		= plugin
+LIBRARY_NAME	= gkpluginandroid_s
+
+LIBXUL_LIBRARY   = 1
+FORCE_STATIC_LIB = 1
+EXPORT_LIBRARY = 1
+
+include $(topsrcdir)/config/config.mk
+include $(topsrcdir)/ipc/chromium/chromium-config.mk
+
+EXPORTS = \
+  android_npapi.h \
+  $(NULL)
+
+CPPSRCS += ANPAudio.cpp    \
+           ANPCanvas.cpp   \
+           ANPEvent.cpp    \
+           ANPMatrix.cpp   \
+           ANPPath.cpp     \
+           ANPSystem.cpp   \
+           ANPWindow.cpp   \
+           ANPBitmap.cpp   \
+           ANPLog.cpp      \
+           ANPPaint.cpp    \
+           ANPSurface.cpp  \
+           ANPTypeface.cpp \
+           $(NULL)
+
+LOCAL_INCLUDES += \
+  -I$(topsrcdir)/dom/plugins/base \
+  $(MOZ_CAIRO_CFLAGS) \
+  $(NULL)
+
+DEFINES += -DMOZ_APP_NAME='"$(MOZ_APP_NAME)"'
+
+include $(topsrcdir)/config/rules.mk
+
diff --git a/dom/plugins/base/android/android_npapi.h b/dom/plugins/base/android/android_npapi.h
new file mode 100644
index 000000000000..27b0c0c9fab3
--- /dev/null
+++ b/dom/plugins/base/android/android_npapi.h
@@ -0,0 +1,979 @@
+/*
+ * Copyright 2009, The Android Open Source Project
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *  * Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ *  * Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE COPYRIGHT OWNER OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+/*  Defines the android-specific types and functions as part of npapi
+
+    In particular, defines the window and event types that are passed to
+    NPN_GetValue, NPP_SetWindow and NPP_HandleEvent.
+
+    To minimize what native libraries the plugin links against, some
+    functionality is provided via function-ptrs (e.g. time, sound)
+ */
+
+#ifndef android_npapi_H
+#define android_npapi_H
+
+#include <stdint.h>
+#include "npapi.h"
+#include <jni.h>
+
+///////////////////////////////////////////////////////////////////////////////
+// General types
+
+enum ANPBitmapFormats {
+    kUnknown_ANPBitmapFormat    = 0,
+    kRGBA_8888_ANPBitmapFormat  = 1,
+    kRGB_565_ANPBitmapFormat    = 2
+};
+typedef int32_t ANPBitmapFormat;
+
+struct ANPPixelPacking {
+    uint8_t AShift;
+    uint8_t ABits;
+    uint8_t RShift;
+    uint8_t RBits;
+    uint8_t GShift;
+    uint8_t GBits;
+    uint8_t BShift;
+    uint8_t BBits;
+};
+
+struct ANPBitmap {
+    void*           baseAddr;
+    ANPBitmapFormat format;
+    int32_t         width;
+    int32_t         height;
+    int32_t         rowBytes;
+};
+
+struct ANPRectF {
+    float   left;
+    float   top;
+    float   right;
+    float   bottom;
+};
+
+struct ANPRectI {
+    int32_t left;
+    int32_t top;
+    int32_t right;
+    int32_t bottom;
+};
+
+struct ANPCanvas;
+struct ANPMatrix;
+struct ANPPaint;
+struct ANPPath;
+struct ANPRegion;
+struct ANPTypeface;
+
+enum ANPMatrixFlags {
+    kIdentity_ANPMatrixFlag     = 0,
+    kTranslate_ANPMatrixFlag    = 0x01,
+    kScale_ANPMatrixFlag        = 0x02,
+    kAffine_ANPMatrixFlag       = 0x04,
+    kPerspective_ANPMatrixFlag  = 0x08,
+};
+typedef uint32_t ANPMatrixFlag;
+
+///////////////////////////////////////////////////////////////////////////////
+// NPN_GetValue
+
+/** queries for a specific ANPInterface.
+
+    Maybe called with NULL for the NPP instance
+
+    NPN_GetValue(inst, interface_enum, ANPInterface*)
+ */
+#define kLogInterfaceV0_ANPGetValue         ((NPNVariable)1000)
+#define kAudioTrackInterfaceV0_ANPGetValue  ((NPNVariable)1001)
+#define kCanvasInterfaceV0_ANPGetValue      ((NPNVariable)1002)
+#define kMatrixInterfaceV0_ANPGetValue      ((NPNVariable)1003)
+#define kPaintInterfaceV0_ANPGetValue       ((NPNVariable)1004)
+#define kPathInterfaceV0_ANPGetValue        ((NPNVariable)1005)
+#define kTypefaceInterfaceV0_ANPGetValue    ((NPNVariable)1006)
+#define kWindowInterfaceV0_ANPGetValue      ((NPNVariable)1007)
+#define kBitmapInterfaceV0_ANPGetValue      ((NPNVariable)1008)
+#define kSurfaceInterfaceV0_ANPGetValue     ((NPNVariable)1009)
+#define kSystemInterfaceV0_ANPGetValue      ((NPNVariable)1010)
+#define kEventInterfaceV0_ANPGetValue       ((NPNVariable)1011)
+
+/** queries for the drawing models supported on this device.
+
+    NPN_GetValue(inst, kSupportedDrawingModel_ANPGetValue, uint32_t* bits)
+ */
+#define kSupportedDrawingModel_ANPGetValue  ((NPNVariable)2000)
+
+/** queries for the context (android.content.Context) of the plugin. If no
+    instance is specified the application's context is returned. If the instance
+    is given then the context returned is identical to the context used to
+    create the webview in which that instance resides.
+
+    NOTE: Holding onto a non-application context after your instance has been
+    destroyed will cause a memory leak.  Refer to the android documentation to
+    determine what context is best suited for your particular scenario.
+
+    NPN_GetValue(inst, kJavaContext_ANPGetValue, jobject context)
+ */
+#define kJavaContext_ANPGetValue            ((NPNVariable)2001)
+
+///////////////////////////////////////////////////////////////////////////////
+// NPN_SetValue
+
+/** Request to set the drawing model. SetValue will return false if the drawing
+    model is not supported or has insufficient information for configuration.
+
+    NPN_SetValue(inst, kRequestDrawingModel_ANPSetValue, (void*)foo_ANPDrawingModel)
+ */
+#define kRequestDrawingModel_ANPSetValue    ((NPPVariable)1000)
+
+/** These are used as bitfields in ANPSupportedDrawingModels_EnumValue,
+    and as-is in ANPRequestDrawingModel_EnumValue. The drawing model determines
+    how to interpret the ANPDrawingContext provided in the Draw event and how
+    to interpret the NPWindow->window field.
+ */
+enum ANPDrawingModels {
+    /** Draw into a bitmap from the browser thread in response to a Draw event.
+        NPWindow->window is reserved (ignore)
+     */
+    kBitmap_ANPDrawingModel  = 1 << 0,
+    /** Draw into a surface (e.g. raster, openGL, etc.) using the Java surface
+        interface. When this model is used the browser will invoke the Java
+        class specified in the plugin's apk manifest. From that class the browser
+        will invoke the appropriate method to return an an instance of a android
+        Java View. The instance is then embedded in the html. The plugin can then
+        manipulate the view as it would any normal Java View in android.
+
+        Unlike the bitmap model, a surface model is opaque so no html content
+        behind the plugin will be  visible. Unless the plugin needs to be
+        transparent the surface model should be chosen over the bitmap model as
+        it will have better performance.
+
+        Further, a plugin can manipulate some surfaces in native code using the
+        ANPSurfaceInterface.  This interface can be used to manipulate Java
+        objects that extend Surface.class by allowing them to access the
+        surface's underlying bitmap in native code.  For instance, if a raster
+        surface is used the plugin can lock, draw directly into the bitmap, and
+        unlock the surface in native code without making JNI calls to the Java
+        surface object.
+     */
+    kSurface_ANPDrawingModel = 1 << 1,
+};
+typedef int32_t ANPDrawingModel;
+
+/** Request to receive/disable events. If the pointer is NULL then all flags will
+    be disabled. Otherwise, the event type will be enabled iff its corresponding
+    bit in the EventFlags bit field is set.
+
+    NPN_SetValue(inst, ANPAcceptEvents, (void*)EventFlags)
+ */
+#define kAcceptEvents_ANPSetValue           ((NPPVariable)1001)
+
+/** The EventFlags are a set of bits used to determine which types of events the
+    plugin wishes to receive. For example, if the value is 0x03 then both key
+    and touch events will be provided to the plugin.
+ */
+enum ANPEventFlag {
+    kKey_ANPEventFlag               = 0x01,
+    kTouch_ANPEventFlag             = 0x02,
+};
+typedef uint32_t ANPEventFlags;
+
+///////////////////////////////////////////////////////////////////////////////
+// NPP_GetValue
+
+/** Requests that the plugin return a java surface to be displayed. This will
+    only be used if the plugin has choosen the kSurface_ANPDrawingModel.
+
+    NPP_GetValue(inst, kJavaSurface_ANPGetValue, jobject surface)
+ */
+#define kJavaSurface_ANPGetValue            ((NPPVariable)2000)
+
+
+///////////////////////////////////////////////////////////////////////////////
+// ANDROID INTERFACE DEFINITIONS
+
+/** Interfaces provide additional functionality to the plugin via function ptrs.
+    Once an interface is retrieved, it is valid for the lifetime of the plugin
+    (just like browserfuncs).
+
+    All ANPInterfaces begin with an inSize field, which must be set by the
+    caller (plugin) with the number of bytes allocated for the interface.
+    e.g. SomeInterface si; si.inSize = sizeof(si); browser->getvalue(..., &si);
+ */
+struct ANPInterface {
+    uint32_t    inSize;     // size (in bytes) of this struct
+};
+
+enum ANPLogTypes {
+    kError_ANPLogType   = 0,    // error
+    kWarning_ANPLogType = 1,    // warning
+    kDebug_ANPLogType   = 2     // debug only (informational)
+};
+typedef int32_t ANPLogType;
+
+struct ANPLogInterfaceV0 : ANPInterface {
+    /** dumps printf messages to the log file
+        e.g. interface->log(instance, kWarning_ANPLogType, "value is %d", value);
+     */
+    void (*log)(ANPLogType, const char format[], ...);
+};
+
+struct ANPBitmapInterfaceV0 : ANPInterface {
+    /** Returns true if the specified bitmap format is supported, and if packing
+        is non-null, sets it to the packing info for that format.
+     */
+    bool (*getPixelPacking)(ANPBitmapFormat, ANPPixelPacking* packing);
+};
+
+struct ANPMatrixInterfaceV0 : ANPInterface {
+    /** Return a new identity matrix
+     */
+    ANPMatrix*  (*newMatrix)();
+    /** Delete a matrix previously allocated by newMatrix()
+     */
+    void        (*deleteMatrix)(ANPMatrix*);
+
+    ANPMatrixFlag (*getFlags)(const ANPMatrix*);
+
+    void        (*copy)(ANPMatrix* dst, const ANPMatrix* src);
+
+    /** Return the matrix values in a float array (allcoated by the caller),
+        where the values are treated as follows:
+        w  = x * [6] + y * [7] + [8];
+        x' = (x * [0] + y * [1] + [2]) / w;
+        y' = (x * [3] + y * [4] + [5]) / w;
+     */
+    void        (*get3x3)(const ANPMatrix*, float[9]);
+    /** Initialize the matrix from values in a float array,
+        where the values are treated as follows:
+         w  = x * [6] + y * [7] + [8];
+         x' = (x * [0] + y * [1] + [2]) / w;
+         y' = (x * [3] + y * [4] + [5]) / w;
+     */
+    void        (*set3x3)(ANPMatrix*, const float[9]);
+
+    void        (*setIdentity)(ANPMatrix*);
+    void        (*preTranslate)(ANPMatrix*, float tx, float ty);
+    void        (*postTranslate)(ANPMatrix*, float tx, float ty);
+    void        (*preScale)(ANPMatrix*, float sx, float sy);
+    void        (*postScale)(ANPMatrix*, float sx, float sy);
+    void        (*preSkew)(ANPMatrix*, float kx, float ky);
+    void        (*postSkew)(ANPMatrix*, float kx, float ky);
+    void        (*preRotate)(ANPMatrix*, float degrees);
+    void        (*postRotate)(ANPMatrix*, float degrees);
+    void        (*preConcat)(ANPMatrix*, const ANPMatrix*);
+    void        (*postConcat)(ANPMatrix*, const ANPMatrix*);
+
+    /** Return true if src is invertible, and if so, return its inverse in dst.
+        If src is not invertible, return false and ignore dst.
+     */
+    bool        (*invert)(ANPMatrix* dst, const ANPMatrix* src);
+
+    /** Transform the x,y pairs in src[] by this matrix, and store the results
+        in dst[]. The count parameter is treated as the number of pairs in the
+        array. It is legal for src and dst to point to the same memory, but
+        illegal for the two arrays to partially overlap.
+     */
+    void        (*mapPoints)(ANPMatrix*, float dst[], const float src[],
+                             int32_t count);
+};
+
+struct ANPPathInterfaceV0 : ANPInterface {
+    /** Return a new path */
+    ANPPath* (*newPath)();
+
+    /** Delete a path previously allocated by ANPPath() */
+    void (*deletePath)(ANPPath*);
+
+    /** Make a deep copy of the src path, into the dst path (already allocated
+        by the caller).
+     */
+    void (*copy)(ANPPath* dst, const ANPPath* src);
+
+    /** Returns true if the two paths are the same (i.e. have the same points)
+     */
+    bool (*equal)(const ANPPath* path0, const ANPPath* path1);
+
+    /** Remove any previous points, initializing the path back to empty. */
+    void (*reset)(ANPPath*);
+
+    /** Return true if the path is empty (has no lines, quads or cubics). */
+    bool (*isEmpty)(const ANPPath*);
+
+    /** Return the path's bounds in bounds. */
+    void (*getBounds)(const ANPPath*, ANPRectF* bounds);
+
+    void (*moveTo)(ANPPath*, float x, float y);
+    void (*lineTo)(ANPPath*, float x, float y);
+    void (*quadTo)(ANPPath*, float x0, float y0, float x1, float y1);
+    void (*cubicTo)(ANPPath*, float x0, float y0, float x1, float y1,
+                    float x2, float y2);
+    void (*close)(ANPPath*);
+
+    /** Offset the src path by [dx, dy]. If dst is null, apply the
+        change directly to the src path. If dst is not null, write the
+        changed path into dst, and leave the src path unchanged. In that case
+        dst must have been previously allocated by the caller.
+     */
+    void (*offset)(ANPPath* src, float dx, float dy, ANPPath* dst);
+
+    /** Transform the path by the matrix. If dst is null, apply the
+        change directly to the src path. If dst is not null, write the
+        changed path into dst, and leave the src path unchanged. In that case
+        dst must have been previously allocated by the caller.
+     */
+    void (*transform)(ANPPath* src, const ANPMatrix*, ANPPath* dst);
+};
+
+/** ANPColor is always defined to have the same packing on all platforms, and
+    it is always unpremultiplied.
+
+    This is in contrast to 32bit format(s) in bitmaps, which are premultiplied,
+    and their packing may vary depending on the platform, hence the need for
+    ANPBitmapInterface::getPixelPacking()
+ */
+typedef uint32_t ANPColor;
+#define ANPColor_ASHIFT     24
+#define ANPColor_RSHIFT     16
+#define ANPColor_GSHIFT     8
+#define ANPColor_BSHIFT     0
+#define ANP_MAKE_COLOR(a, r, g, b)  \
+                   (((a) << ANPColor_ASHIFT) |  \
+                    ((r) << ANPColor_RSHIFT) |  \
+                    ((g) << ANPColor_GSHIFT) |  \
+                    ((b) << ANPColor_BSHIFT))
+
+enum ANPPaintFlag {
+    kAntiAlias_ANPPaintFlag         = 1 << 0,
+    kFilterBitmap_ANPPaintFlag      = 1 << 1,
+    kDither_ANPPaintFlag            = 1 << 2,
+    kUnderlineText_ANPPaintFlag     = 1 << 3,
+    kStrikeThruText_ANPPaintFlag    = 1 << 4,
+    kFakeBoldText_ANPPaintFlag      = 1 << 5,
+};
+typedef uint32_t ANPPaintFlags;
+
+enum ANPPaintStyles {
+    kFill_ANPPaintStyle             = 0,
+    kStroke_ANPPaintStyle           = 1,
+    kFillAndStroke_ANPPaintStyle    = 2
+};
+typedef int32_t ANPPaintStyle;
+
+enum ANPPaintCaps {
+    kButt_ANPPaintCap   = 0,
+    kRound_ANPPaintCap  = 1,
+    kSquare_ANPPaintCap = 2
+};
+typedef int32_t ANPPaintCap;
+
+enum ANPPaintJoins {
+    kMiter_ANPPaintJoin = 0,
+    kRound_ANPPaintJoin = 1,
+    kBevel_ANPPaintJoin = 2
+};
+typedef int32_t ANPPaintJoin;
+
+enum ANPPaintAligns {
+    kLeft_ANPPaintAlign     = 0,
+    kCenter_ANPPaintAlign   = 1,
+    kRight_ANPPaintAlign    = 2
+};
+typedef int32_t ANPPaintAlign;
+
+enum ANPTextEncodings {
+    kUTF8_ANPTextEncoding   = 0,
+    kUTF16_ANPTextEncoding  = 1,
+};
+typedef int32_t ANPTextEncoding;
+
+enum ANPTypefaceStyles {
+    kBold_ANPTypefaceStyle      = 1 << 0,
+    kItalic_ANPTypefaceStyle    = 1 << 1
+};
+typedef uint32_t ANPTypefaceStyle;
+
+typedef uint32_t ANPFontTableTag;
+
+struct ANPFontMetrics {
+    /** The greatest distance above the baseline for any glyph (will be <= 0) */
+    float   fTop;
+    /** The recommended distance above the baseline (will be <= 0) */
+    float   fAscent;
+    /** The recommended distance below the baseline (will be >= 0) */
+    float   fDescent;
+    /** The greatest distance below the baseline for any glyph (will be >= 0) */
+    float   fBottom;
+    /** The recommended distance to add between lines of text (will be >= 0) */
+    float   fLeading;
+};
+
+struct ANPTypefaceInterfaceV0 : ANPInterface {
+    /** Return a new reference to the typeface that most closely matches the
+        requested name and style. Pass null as the name to return
+        the default font for the requested style. Will never return null
+
+        The 5 generic font names "serif", "sans-serif", "monospace", "cursive",
+        "fantasy" are recognized, and will be mapped to their logical font
+        automatically by this call.
+
+        @param name     May be NULL. The name of the font family.
+        @param style    The style (normal, bold, italic) of the typeface.
+        @return reference to the closest-matching typeface. Caller must call
+                unref() when they are done with the typeface.
+     */
+    ANPTypeface* (*createFromName)(const char name[], ANPTypefaceStyle);
+
+    /** Return a new reference to the typeface that most closely matches the
+        requested typeface and specified Style. Use this call if you want to
+        pick a new style from the same family of the existing typeface.
+        If family is NULL, this selects from the default font's family.
+
+        @param family  May be NULL. The name of the existing type face.
+        @param s       The style (normal, bold, italic) of the type face.
+        @return reference to the closest-matching typeface. Call must call
+                unref() when they are done.
+     */
+    ANPTypeface* (*createFromTypeface)(const ANPTypeface* family,
+                                       ANPTypefaceStyle);
+
+    /** Return the owner count of the typeface. A newly created typeface has an
+        owner count of 1. When the owner count is reaches 0, the typeface is
+        deleted.
+     */
+    int32_t (*getRefCount)(const ANPTypeface*);
+
+    /** Increment the owner count on the typeface
+     */
+    void (*ref)(ANPTypeface*);
+
+    /** Decrement the owner count on the typeface. When the count goes to 0,
+        the typeface is deleted.
+     */
+    void (*unref)(ANPTypeface*);
+
+    /** Return the style bits for the specified typeface
+     */
+    ANPTypefaceStyle (*getStyle)(const ANPTypeface*);
+
+    /** Some fonts are stored in files. If that is true for the fontID, then
+        this returns the byte length of the full file path. If path is not null,
+        then the full path is copied into path (allocated by the caller), up to
+        length bytes. If index is not null, then it is set to the truetype
+        collection index for this font, or 0 if the font is not in a collection.
+
+        Note: getFontPath does not assume that path is a null-terminated string,
+        so when it succeeds, it only copies the bytes of the file name and
+        nothing else (i.e. it copies exactly the number of bytes returned by the
+        function. If the caller wants to treat path[] as a C string, it must be
+        sure that it is allocated at least 1 byte larger than the returned size,
+        and it must copy in the terminating 0.
+
+        If the fontID does not correspond to a file, then the function returns
+        0, and the path and index parameters are ignored.
+
+        @param fontID  The font whose file name is being queried
+        @param path    Either NULL, or storage for receiving up to length bytes
+                       of the font's file name. Allocated by the caller.
+        @param length  The maximum space allocated in path (by the caller).
+                       Ignored if path is NULL.
+        @param index   Either NULL, or receives the TTC index for this font.
+                       If the font is not a TTC, then will be set to 0.
+        @return The byte length of th font's file name, or 0 if the font is not
+                baked by a file.
+     */
+    int32_t (*getFontPath)(const ANPTypeface*, char path[], int32_t length,
+                           int32_t* index);
+
+    /** Return a UTF8 encoded path name for the font directory, or NULL if not
+        supported. If returned, this string address will be valid for the life
+        of the plugin instance. It will always end with a '/' character.
+     */
+    const char* (*getFontDirectoryPath)();
+};
+
+struct ANPPaintInterfaceV0 : ANPInterface {
+    /** Return a new paint object, which holds all of the color and style
+        attributes that affect how things (geometry, text, bitmaps) are drawn
+        in a ANPCanvas.
+
+        The paint that is returned is not tied to any particular plugin
+        instance, but it must only be accessed from one thread at a time.
+     */
+    ANPPaint*   (*newPaint)();
+    void        (*deletePaint)(ANPPaint*);
+
+    ANPPaintFlags (*getFlags)(const ANPPaint*);
+    void        (*setFlags)(ANPPaint*, ANPPaintFlags);
+
+    ANPColor    (*getColor)(const ANPPaint*);
+    void        (*setColor)(ANPPaint*, ANPColor);
+
+    ANPPaintStyle (*getStyle)(const ANPPaint*);
+    void        (*setStyle)(ANPPaint*, ANPPaintStyle);
+
+    float       (*getStrokeWidth)(const ANPPaint*);
+    float       (*getStrokeMiter)(const ANPPaint*);
+    ANPPaintCap (*getStrokeCap)(const ANPPaint*);
+    ANPPaintJoin (*getStrokeJoin)(const ANPPaint*);
+    void        (*setStrokeWidth)(ANPPaint*, float);
+    void        (*setStrokeMiter)(ANPPaint*, float);
+    void        (*setStrokeCap)(ANPPaint*, ANPPaintCap);
+    void        (*setStrokeJoin)(ANPPaint*, ANPPaintJoin);
+
+    ANPTextEncoding (*getTextEncoding)(const ANPPaint*);
+    ANPPaintAlign (*getTextAlign)(const ANPPaint*);
+    float       (*getTextSize)(const ANPPaint*);
+    float       (*getTextScaleX)(const ANPPaint*);
+    float       (*getTextSkewX)(const ANPPaint*);
+    void        (*setTextEncoding)(ANPPaint*, ANPTextEncoding);
+    void        (*setTextAlign)(ANPPaint*, ANPPaintAlign);
+    void        (*setTextSize)(ANPPaint*, float);
+    void        (*setTextScaleX)(ANPPaint*, float);
+    void        (*setTextSkewX)(ANPPaint*, float);
+
+    /** Return the typeface ine paint, or null if there is none. This does not
+        modify the owner count of the returned typeface.
+     */
+    ANPTypeface* (*getTypeface)(const ANPPaint*);
+
+    /** Set the paint's typeface. If the paint already had a non-null typeface,
+        its owner count is decremented. If the new typeface is non-null, its
+        owner count is incremented.
+     */
+    void (*setTypeface)(ANPPaint*, ANPTypeface*);
+
+    /** Return the width of the text. If bounds is not null, return the bounds
+        of the text in that rectangle.
+     */
+    float (*measureText)(ANPPaint*, const void* text, uint32_t byteLength,
+                         ANPRectF* bounds);
+
+    /** Return the number of unichars specifed by the text.
+        If widths is not null, returns the array of advance widths for each
+            unichar.
+        If bounds is not null, returns the array of bounds for each unichar.
+     */
+    int (*getTextWidths)(ANPPaint*, const void* text, uint32_t byteLength,
+                         float widths[], ANPRectF bounds[]);
+
+    /** Return in metrics the spacing values for text, respecting the paint's
+        typeface and pointsize, and return the spacing between lines
+        (descent - ascent + leading). If metrics is NULL, it will be ignored.
+     */
+    float (*getFontMetrics)(ANPPaint*, ANPFontMetrics* metrics);
+};
+
+struct ANPCanvasInterfaceV0 : ANPInterface {
+    /** Return a canvas that will draw into the specified bitmap. Note: the
+        canvas copies the fields of the bitmap, so it need not persist after
+        this call, but the canvas DOES point to the same pixel memory that the
+        bitmap did, so the canvas should not be used after that pixel memory
+        goes out of scope. In the case of creating a canvas to draw into the
+        pixels provided by kDraw_ANPEventType, those pixels are only while
+        handling that event.
+
+        The canvas that is returned is not tied to any particular plugin
+        instance, but it must only be accessed from one thread at a time.
+     */
+    ANPCanvas*  (*newCanvas)(const ANPBitmap*);
+    void        (*deleteCanvas)(ANPCanvas*);
+
+    void        (*save)(ANPCanvas*);
+    void        (*restore)(ANPCanvas*);
+    void        (*translate)(ANPCanvas*, float tx, float ty);
+    void        (*scale)(ANPCanvas*, float sx, float sy);
+    void        (*rotate)(ANPCanvas*, float degrees);
+    void        (*skew)(ANPCanvas*, float kx, float ky);
+    void        (*concat)(ANPCanvas*, const ANPMatrix*);
+    void        (*clipRect)(ANPCanvas*, const ANPRectF*);
+    void        (*clipPath)(ANPCanvas*, const ANPPath*);
+
+    /** Return the current matrix on the canvas
+     */
+    void        (*getTotalMatrix)(ANPCanvas*, ANPMatrix*);
+    /** Return the current clip bounds in local coordinates, expanding it to
+        account for antialiasing edge effects if aa is true. If the
+        current clip is empty, return false and ignore the bounds argument.
+     */
+    bool        (*getLocalClipBounds)(ANPCanvas*, ANPRectF* bounds, bool aa);
+    /** Return the current clip bounds in device coordinates in bounds. If the
+        current clip is empty, return false and ignore the bounds argument.
+     */
+    bool        (*getDeviceClipBounds)(ANPCanvas*, ANPRectI* bounds);
+
+    void        (*drawColor)(ANPCanvas*, ANPColor);
+    void        (*drawPaint)(ANPCanvas*, const ANPPaint*);
+    void        (*drawLine)(ANPCanvas*, float x0, float y0, float x1, float y1,
+                            const ANPPaint*);
+    void        (*drawRect)(ANPCanvas*, const ANPRectF*, const ANPPaint*);
+    void        (*drawOval)(ANPCanvas*, const ANPRectF*, const ANPPaint*);
+    void        (*drawPath)(ANPCanvas*, const ANPPath*, const ANPPaint*);
+    void        (*drawText)(ANPCanvas*, const void* text, uint32_t byteLength,
+                            float x, float y, const ANPPaint*);
+    void       (*drawPosText)(ANPCanvas*, const void* text, uint32_t byteLength,
+                               const float xy[], const ANPPaint*);
+    void        (*drawBitmap)(ANPCanvas*, const ANPBitmap*, float x, float y,
+                              const ANPPaint*);
+    void        (*drawBitmapRect)(ANPCanvas*, const ANPBitmap*,
+                                  const ANPRectI* src, const ANPRectF* dst,
+                                  const ANPPaint*);
+};
+
+struct ANPWindowInterfaceV0 : ANPInterface {
+    /** Registers a set of rectangles that the plugin would like to keep on
+        screen. The rectangles are listed in order of priority with the highest
+        priority rectangle in location rects[0].  The browser will attempt to keep
+        as many of the rectangles on screen as possible and will scroll them into
+        view in response to the invocation of this method and other various events.
+        The count specifies how many rectangles are in the array. If the count is
+        zero it signals the browser that any existing rectangles should be cleared
+        and no rectangles will be tracked.
+     */
+    void (*setVisibleRects)(NPP instance, const ANPRectI rects[], int32_t count);
+    /** Clears any rectangles that are being tracked as a result of a call to
+        setVisibleRects. This call is equivalent to setVisibleRect(inst, NULL, 0).
+     */
+    void    (*clearVisibleRects)(NPP instance);
+    /** Given a boolean value of true the device will be requested to provide
+        a keyboard. A value of false will result in a request to hide the
+        keyboard. Further, the on-screen keyboard will not be displayed if a
+        physical keyboard is active.
+     */
+    void    (*showKeyboard)(NPP instance, bool value);
+    /** Called when a plugin wishes to enter into full screen mode. The plugin's
+        Java class (defined in the plugin's apk manifest) will be called
+        asynchronously to provide a View object to be displayed full screen.
+     */
+    void    (*requestFullScreen)(NPP instance);
+    /** Called when a plugin wishes to exit from full screen mode. As a result,
+        the plugin's full screen view will be discarded by the view system.
+     */
+    void    (*exitFullScreen)(NPP instance);
+    /** Called when a plugin wishes to be zoomed and centered in the current view.
+     */
+    void    (*requestCenterFitZoom)(NPP instance);
+};
+
+///////////////////////////////////////////////////////////////////////////////
+
+enum ANPSampleFormats {
+    kUnknown_ANPSamleFormat     = 0,
+    kPCM16Bit_ANPSampleFormat   = 1,
+    kPCM8Bit_ANPSampleFormat    = 2
+};
+typedef int32_t ANPSampleFormat;
+
+/** The audio buffer is passed to the callback proc to request more samples.
+    It is owned by the system, and the callback may read it, but should not
+    maintain a pointer to it outside of the scope of the callback proc.
+ */
+struct ANPAudioBuffer {
+    // RO - repeat what was specified in newTrack()
+    int32_t     channelCount;
+    // RO - repeat what was specified in newTrack()
+    ANPSampleFormat  format;
+    /** This buffer is owned by the caller. Inside the callback proc, up to
+        "size" bytes of sample data should be written into this buffer. The
+        address is only valid for the scope of a single invocation of the
+        callback proc.
+     */
+    void*       bufferData;
+    /** On input, specifies the maximum number of bytes that can be written
+        to "bufferData". On output, specifies the actual number of bytes that
+        the callback proc wrote into "bufferData".
+     */
+    uint32_t    size;
+};
+
+enum ANPAudioEvents {
+    /** This event is passed to the callback proc when the audio-track needs
+        more sample data written to the provided buffer parameter.
+     */
+    kMoreData_ANPAudioEvent = 0,
+    /** This event is passed to the callback proc if the audio system runs out
+        of sample data. In this event, no buffer parameter will be specified
+        (i.e. NULL will be passed to the 3rd parameter).
+     */
+    kUnderRun_ANPAudioEvent = 1
+};
+typedef int32_t ANPAudioEvent;
+
+/** Called to feed sample data to the track. This will be called in a separate
+    thread. However, you may call trackStop() from the callback (but you
+    cannot delete the track).
+
+    For example, when you have written the last chunk of sample data, you can
+    immediately call trackStop(). This will take effect after the current
+    buffer has been played.
+
+    The "user" parameter is the same value that was passed to newTrack()
+ */
+typedef void (*ANPAudioCallbackProc)(ANPAudioEvent event, void* user,
+                                     ANPAudioBuffer* buffer);
+
+struct ANPAudioTrack;   // abstract type for audio tracks
+
+struct ANPAudioTrackInterfaceV0 : ANPInterface {
+    /** Create a new audio track, or NULL on failure. The track is initially in
+        the stopped state and therefore ANPAudioCallbackProc will not be called
+        until the track is started.
+     */
+    ANPAudioTrack*  (*newTrack)(uint32_t sampleRate,    // sampling rate in Hz
+                                ANPSampleFormat,
+                                int channelCount,       // MONO=1, STEREO=2
+                                ANPAudioCallbackProc,
+                                void* user);
+    /** Deletes a track that was created using newTrack.  The track can be
+        deleted in any state and it waits for the ANPAudioCallbackProc thread
+        to exit before returning.
+     */
+    void (*deleteTrack)(ANPAudioTrack*);
+
+    void (*start)(ANPAudioTrack*);
+    void (*pause)(ANPAudioTrack*);
+    void (*stop)(ANPAudioTrack*);
+    /** Returns true if the track is not playing (e.g. pause or stop was called,
+        or start was never called.
+     */
+    bool (*isStopped)(ANPAudioTrack*);
+};
+
+///////////////////////////////////////////////////////////////////////////////
+// DEFINITION OF VALUES PASSED THROUGH NPP_HandleEvent
+
+enum ANPEventTypes {
+    kNull_ANPEventType          = 0,
+    kKey_ANPEventType           = 1,
+    /** Mouse events are triggered by either clicking with the navigational pad
+        or by tapping the touchscreen (if the kDown_ANPTouchAction is handled by
+        the plugin then no mouse event is generated).  The kKey_ANPEventFlag has
+        to be set to true in order to receive these events.
+     */
+    kMouse_ANPEventType         = 2,
+    /** Touch events are generated when the user touches on the screen. The
+        kTouch_ANPEventFlag has to be set to true in order to receive these
+        events.
+     */
+    kTouch_ANPEventType         = 3,
+    /** Only triggered by a plugin using the kBitmap_ANPDrawingModel. This event
+        signals that the plugin needs to redraw itself into the provided bitmap.
+     */
+    kDraw_ANPEventType          = 4,
+    kLifecycle_ANPEventType     = 5,
+
+    /** This event type is completely defined by the plugin.
+        When creating an event, the caller must always set the first
+        two fields, the remaining data is optional.
+            ANPEvent evt;
+            evt.inSize = sizeof(ANPEvent);
+            evt.eventType = kCustom_ANPEventType
+            // other data slots are optional
+            evt.other[] = ...;
+        To post a copy of the event, call
+            eventInterface->postEvent(myNPPInstance, &evt);
+        That call makes a copy of the event struct, and post that on the event
+        queue for the plugin.
+     */
+    kCustom_ANPEventType   = 6,
+};
+typedef int32_t ANPEventType;
+
+enum ANPKeyActions {
+    kDown_ANPKeyAction  = 0,
+    kUp_ANPKeyAction    = 1,
+};
+typedef int32_t ANPKeyAction;
+
+#include "ANPKeyCodes.h"
+typedef int32_t ANPKeyCode;
+
+enum ANPKeyModifiers {
+    kAlt_ANPKeyModifier     = 1 << 0,
+    kShift_ANPKeyModifier   = 1 << 1,
+};
+// bit-field containing some number of ANPKeyModifier bits
+typedef uint32_t ANPKeyModifier;
+
+enum ANPMouseActions {
+    kDown_ANPMouseAction  = 0,
+    kUp_ANPMouseAction    = 1,
+};
+typedef int32_t ANPMouseAction;
+
+enum ANPTouchActions {
+    /** This occurs when the user first touches on the screen. As such, this
+        action will always occur prior to any of the other touch actions. If
+        the plugin chooses to not handle this action then no other events
+        related to that particular touch gesture will be generated.
+     */
+    kDown_ANPTouchAction        = 0,
+    kUp_ANPTouchAction          = 1,
+    kMove_ANPTouchAction        = 2,
+    kCancel_ANPTouchAction      = 3,
+    // The web view will ignore the return value from the following actions
+    kLongPress_ANPTouchAction   = 4,
+    kDoubleTap_ANPTouchAction   = 5,
+};
+typedef int32_t ANPTouchAction;
+
+enum ANPLifecycleActions {
+    /** The web view containing this plugin has been paused.  See documentation
+        on the android activity lifecycle for more information.
+     */
+    kPause_ANPLifecycleAction           = 0,
+    /** The web view containing this plugin has been resumed. See documentation
+        on the android activity lifecycle for more information.
+     */
+    kResume_ANPLifecycleAction          = 1,
+    /** The plugin has focus and is now the recipient of input events (e.g. key,
+        touch, etc.)
+     */
+    kGainFocus_ANPLifecycleAction       = 2,
+    /** The plugin has lost focus and will not receive any input events until it
+        regains focus. This event is always preceded by a GainFocus action.
+     */
+    kLoseFocus_ANPLifecycleAction       = 3,
+    /** The browser is running low on available memory and is requesting that
+        the plugin free any unused/inactive resources to prevent a performance
+        degradation.
+     */
+    kFreeMemory_ANPLifecycleAction      = 4,
+    /** The page has finished loading. This happens when the page's top level
+        frame reports that it has completed loading.
+     */
+    kOnLoad_ANPLifecycleAction          = 5,
+    /** The browser is honoring the plugin's request to go full screen. Upon
+        returning from this event the browser will resize the plugin's java
+        surface to full-screen coordinates.
+     */
+    kEnterFullScreen_ANPLifecycleAction = 6,
+    /** The browser has exited from full screen mode. Immediately prior to
+        sending this event the browser has resized the plugin's java surface to
+        its original coordinates.
+     */
+    kExitFullScreen_ANPLifecycleAction  = 7,
+    /** The plugin is visible to the user on the screen. This event will always
+        occur after a kOffScreen_ANPLifecycleAction event.
+     */
+    kOnScreen_ANPLifecycleAction        = 8,
+    /** The plugin is no longer visible to the user on the screen. This event
+        will always occur prior to an kOnScreen_ANPLifecycleAction event.
+     */
+    kOffScreen_ANPLifecycleAction       = 9,
+};
+typedef uint32_t ANPLifecycleAction;
+
+/* This is what is passed to NPP_HandleEvent() */
+struct ANPEvent {
+    uint32_t        inSize;  // size of this struct in bytes
+    ANPEventType    eventType;
+    // use based on the value in eventType
+    union {
+        struct {
+            ANPKeyAction    action;
+            ANPKeyCode      nativeCode;
+            int32_t         virtualCode;    // windows virtual key code
+            ANPKeyModifier  modifiers;
+            int32_t         repeatCount;    // 0 for initial down (or up)
+            int32_t         unichar;        // 0 if there is no value
+        } key;
+        struct {
+            ANPMouseAction  action;
+            int32_t         x;  // relative to your "window" (0...width)
+            int32_t         y;  // relative to your "window" (0...height)
+        } mouse;
+        struct {
+            ANPTouchAction  action;
+            ANPKeyModifier  modifiers;
+            int32_t         x;  // relative to your "window" (0...width)
+            int32_t         y;  // relative to your "window" (0...height)
+        } touch;
+        struct {
+            ANPLifecycleAction  action;
+        } lifecycle;
+        struct {
+            ANPDrawingModel model;
+            // relative to (0,0) in top-left of your plugin
+            ANPRectI        clip;
+            // use based on the value in model
+            union {
+                ANPBitmap   bitmap;
+            } data;
+        } draw;
+        int32_t     other[8];
+    } data;
+};
+
+struct ANPEventInterfaceV0 : ANPInterface {
+    /** Post a copy of the specified event to the plugin. The event will be
+        delivered to the plugin in its main thread (the thread that receives
+        other ANPEvents). If, after posting before delivery, the NPP instance
+        is torn down, the event will be discarded.
+     */
+    void (*postEvent)(NPP inst, const ANPEvent* event);
+};
+
+struct ANPSystemInterfaceV0 : ANPInterface {
+    /** Return the path name for the current Application's plugin data directory,
+        or NULL if not supported
+     */
+    const char* (*getApplicationDataDirectory)();
+
+    /** A helper function to load java classes from the plugin's apk.  The
+        function looks for a class given the fully qualified and null terminated
+        string representing the className. For example,
+
+        const char* className = "com.android.mypackage.MyClass";
+
+        If the class cannot be found or there is a problem loading the class
+        NULL will be returned.
+     */
+    jclass (*loadJavaClass)(NPP instance, const char* className);
+};
+
+struct ANPSurfaceInterfaceV0 : ANPInterface {
+  /** Locks the surface from manipulation by other threads and provides a bitmap
+        to be written to.  The dirtyRect param specifies which portion of the
+        bitmap will be written to.  If the dirtyRect is NULL then the entire
+        surface will be considered dirty.  If the lock was successful the function
+        will return true and the bitmap will be set to point to a valid bitmap.
+        If not the function will return false and the bitmap will be set to NULL.
+  */
+  bool (*lock)(JNIEnv* env, jobject surface, ANPBitmap* bitmap, ANPRectI* dirtyRect);
+  /** Given a locked surface handle (i.e. result of a successful call to lock)
+        the surface is unlocked and the contents of the bitmap, specifically
+        those inside the dirtyRect are written to the screen.
+  */
+  void (*unlock)(JNIEnv* env, jobject surface);
+};
+
+typedef int32_t   int32;
+typedef uint32_t uint32;
+typedef int16_t   int16;
+typedef uint16_t uint16;
+
+#endif
diff --git a/dom/plugins/base/android_npapi.h b/dom/plugins/base/android_npapi.h
new file mode 100644
index 000000000000..e69de29bb2d1
diff --git a/dom/plugins/base/npfunctions.h b/dom/plugins/base/npfunctions.h
index 3b70a39419df..fe32ce557ee2 100644
--- a/dom/plugins/base/npfunctions.h
+++ b/dom/plugins/base/npfunctions.h
@@ -48,6 +48,10 @@
 #include "npapi.h"
 #include "npruntime.h"
 
+#ifdef ANDROID
+#include <jni.h>
+#endif
+
 typedef NPError      (* NP_LOADDS NPP_NewProcPtr)(NPMIMEType pluginType, NPP instance, uint16_t mode, int16_t argc, char* argn[], char* argv[], NPSavedData* saved);
 typedef NPError      (* NP_LOADDS NPP_DestroyProcPtr)(NPP instance, NPSavedData** save);
 typedef NPError      (* NP_LOADDS NPP_SetWindowProcPtr)(NPP instance, NPWindow* window);
@@ -307,8 +311,13 @@ NP_EXPORT(NPError)     NP_Initialize(NPNetscapeFuncs* bFuncs);
 typedef NPError        (*NP_GetEntryPointsFunc)(NPPluginFuncs*);
 NP_EXPORT(NPError)     NP_GetEntryPoints(NPPluginFuncs* pFuncs);
 #else
-typedef NPError        (*NP_InitializeFunc)(NPNetscapeFuncs*, NPPluginFuncs*);
-NP_EXPORT(NPError)     NP_Initialize(NPNetscapeFuncs* bFuncs, NPPluginFuncs* pFuncs);
+#ifdef ANDROID
+typedef NPError    (*NP_InitializeFunc)(NPNetscapeFuncs*, NPPluginFuncs*, JNIEnv* pEnv);
+NP_EXPORT(NPError) NP_Initialize(NPNetscapeFuncs* bFuncs, NPPluginFuncs* pFuncs, JNIEnv* pEnv);
+#else
+typedef NPError    (*NP_InitializeFunc)(NPNetscapeFuncs*, NPPluginFuncs*);
+NP_EXPORT(NPError) NP_Initialize(NPNetscapeFuncs* bFuncs, NPPluginFuncs* pFuncs);
+#endif
 #endif
 typedef NPError        (*NP_ShutdownFunc)(void);
 NP_EXPORT(NPError)     NP_Shutdown(void);
diff --git a/dom/plugins/base/nsNPAPIPlugin.cpp b/dom/plugins/base/nsNPAPIPlugin.cpp
index fc6788d6d9ac..a360f29b7039 100644
--- a/dom/plugins/base/nsNPAPIPlugin.cpp
+++ b/dom/plugins/base/nsNPAPIPlugin.cpp
@@ -127,6 +127,13 @@ using mozilla::plugins::PluginModuleParent;
 #include <windows.h>
 #endif
 
+#ifdef ANDROID
+#include "ANPBase.h"
+#include "AndroidBridge.h"
+#include <android/log.h>
+#define LOG(args...)  __android_log_print(ANDROID_LOG_INFO, "GeckoPlugins" , ## args)
+#endif
+
 using namespace mozilla;
 using namespace mozilla::plugins::parent;
 
@@ -477,7 +484,7 @@ nsNPAPIPlugin::CreatePlugin(nsPluginTag *aPluginTag, nsNPAPIPlugin** aResult)
     return NS_ERROR_FAILURE;
   }
 
-#ifdef XP_MACOSX
+#if defined(XP_MACOSX) || defined(ANDROID)
   if (!pluginLib->HasRequiredFunctions()) {
     NS_WARNING("Not all necessary functions exposed by plugin, it will not load.");
     return NS_ERROR_FAILURE;
@@ -2264,6 +2271,112 @@ _getvalue(NPP npp, NPNVariable variable, void *result)
   }
 #endif
 
+#ifdef ANDROID
+    case kLogInterfaceV0_ANPGetValue: {
+      LOG("get log interface");
+      ANPLogInterfaceV0 *i = (ANPLogInterfaceV0 *) result;
+      InitLogInterface(i);
+      return NPERR_NO_ERROR;
+    }
+
+    case kBitmapInterfaceV0_ANPGetValue: {
+      LOG("get bitmap interface");
+      ANPBitmapInterfaceV0 *i = (ANPBitmapInterfaceV0 *) result;
+      InitBitmapInterface(i);
+      return NPERR_NO_ERROR;
+    }
+
+    case kMatrixInterfaceV0_ANPGetValue: {
+      LOG("get matrix interface");
+      ANPMatrixInterfaceV0 *i = (ANPMatrixInterfaceV0 *) result;
+      InitMatrixInterface(i);
+      return NPERR_NO_ERROR;
+    }
+      
+    case kPathInterfaceV0_ANPGetValue: {
+      LOG("get path interface");
+      ANPPathInterfaceV0 *i = (ANPPathInterfaceV0 *) result;
+      InitPathInterface(i);
+      return NPERR_NO_ERROR;
+    }
+      
+    case kTypefaceInterfaceV0_ANPGetValue: {
+      LOG("get typeface interface");
+      ANPTypefaceInterfaceV0 *i = (ANPTypefaceInterfaceV0 *) result;
+      InitTypeFaceInterface(i);
+      return NPERR_NO_ERROR;
+    }
+
+    case kPaintInterfaceV0_ANPGetValue: {
+      LOG("get paint interface");
+      ANPPaintInterfaceV0 *i = (ANPPaintInterfaceV0 *) result;
+      InitPaintInterface(i);
+      return NPERR_NO_ERROR;
+    }
+
+    case kCanvasInterfaceV0_ANPGetValue: {
+      LOG("get canvas interface");
+      ANPCanvasInterfaceV0 *i = (ANPCanvasInterfaceV0 *) result;
+      InitCanvasInterface(i);
+      return NPERR_NO_ERROR;
+    }
+
+    case kWindowInterfaceV0_ANPGetValue: {
+      LOG("get window interface");
+      ANPWindowInterfaceV0 *i = (ANPWindowInterfaceV0 *) result;
+      InitWindowInterface(i);
+      return NPERR_NO_ERROR;
+    }
+
+    case kAudioTrackInterfaceV0_ANPGetValue: {
+      LOG("get audio interface");
+      ANPAudioTrackInterfaceV0 *i = (ANPAudioTrackInterfaceV0 *) result;
+      InitAudioTrackInterface(i);
+      return NPERR_NO_ERROR;
+    }
+
+    case kEventInterfaceV0_ANPGetValue: {
+      LOG("get event interface");
+      ANPEventInterfaceV0 *i = (ANPEventInterfaceV0 *) result;
+      InitEventInterface(i);
+      return NPERR_NO_ERROR;
+    }
+
+    case kSystemInterfaceV0_ANPGetValue: {
+      LOG("get system interface");
+      ANPSystemInterfaceV0* i = reinterpret_cast<ANPSystemInterfaceV0*>(result);
+      InitSystemInterface(i);
+      LOG("done system interface");
+      return NPERR_NO_ERROR;
+    }
+
+    case kSurfaceInterfaceV0_ANPGetValue: {
+      LOG("get surface interface");
+      ANPSurfaceInterfaceV0 *i = (ANPSurfaceInterfaceV0 *) result;
+      InitSurfaceInterface(i);
+      return NPERR_NO_ERROR;
+    }
+      
+    case kSupportedDrawingModel_ANPGetValue: {
+      LOG("get supported drawing model");
+      uint32_t* bits = reinterpret_cast<uint32_t*>(result);
+      *bits = kBitmap_ANPDrawingModel && kSurface_ANPDrawingModel;
+      return NPERR_NO_ERROR;
+    }  
+
+    case kJavaContext_ANPGetValue: {
+      LOG("get context");
+      JNIEnv* env    = GetJNIForThread();
+      jclass cls     = env->FindClass("org/mozilla/gecko/GeckoApp");
+      jfieldID field = env->GetStaticFieldID(cls, "mAppContext",
+                                             "Lorg/mozilla/gecko/GeckoApp;");
+      jobject ret = env->GetStaticObjectField(cls, field);
+      int32_t* i  = reinterpret_cast<int32_t*>(result);
+      *i = reinterpret_cast<int32_t>(ret);
+      return NPERR_NO_ERROR;
+    }
+#endif
+
   // we no longer hand out any XPCOM objects
   case NPNVDOMElement:
     // fall through
@@ -2275,6 +2388,7 @@ _getvalue(NPP npp, NPNVariable variable, void *result)
     *(nsISupports**)result = nsnull;
     // fall through
   default:
+    NPN_PLUGIN_LOG(PLUGIN_LOG_NORMAL, ("NPN_getvalue unhandled get value: %d\n", variable));
     return NPERR_GENERIC_ERROR;
   }
 }
@@ -2374,7 +2488,14 @@ _setvalue(NPP npp, NPPVariable variable, void *result)
       }
     }
 #endif
-
+#ifdef ANDROID
+  case kRequestDrawingModel_ANPSetValue:
+    if (inst)
+      inst->SetDrawingModel(NS_PTR_TO_INT32(result));
+    return NPERR_NO_ERROR;
+  case kAcceptEvents_ANPSetValue:
+    return NPERR_NO_ERROR;
+#endif
     default:
       return NPERR_GENERIC_ERROR;
   }
diff --git a/dom/plugins/base/nsNPAPIPluginInstance.cpp b/dom/plugins/base/nsNPAPIPluginInstance.cpp
index e104f07fc782..aa3f398acbaf 100644
--- a/dom/plugins/base/nsNPAPIPluginInstance.cpp
+++ b/dom/plugins/base/nsNPAPIPluginInstance.cpp
@@ -61,13 +61,22 @@
 #include "nsNetCID.h"
 #include "nsIContent.h"
 
+#ifdef ANDROID
+#include "ANPBase.h"
+#include <android/log.h>
+#include "android_npapi.h"
+#include "mozilla/Mutex.h"
+#include "mozilla/CondVar.h"
+#include "AndroidBridge.h"
+#endif
+
 using namespace mozilla;
 using namespace mozilla::plugins::parent;
 
 static NS_DEFINE_IID(kIOutputStreamIID, NS_IOUTPUTSTREAM_IID);
 static NS_DEFINE_IID(kIPluginStreamListenerIID, NS_IPLUGINSTREAMLISTENER_IID);
 
-NS_IMPL_ISUPPORTS0(nsNPAPIPluginInstance)
+NS_IMPL_THREADSAFE_ISUPPORTS0(nsNPAPIPluginInstance)
 
 nsNPAPIPluginInstance::nsNPAPIPluginInstance(nsNPAPIPlugin* plugin)
   :
@@ -77,6 +86,10 @@ nsNPAPIPluginInstance::nsNPAPIPluginInstance(nsNPAPIPlugin* plugin)
 #else
     mDrawingModel(NPDrawingModelQuickDraw),
 #endif
+#endif
+#ifdef ANDROID
+    mSurface(nsnull),
+    mDrawingModel(0),
 #endif
     mRunning(NOT_STARTED),
     mWindowless(PR_FALSE),
@@ -684,7 +697,7 @@ nsNPAPIPluginInstance::UsesDOMForCursor()
   return mUsesDOMForCursor;
 }
 
-#ifdef XP_MACOSX
+#if defined(XP_MACOSX)
 void nsNPAPIPluginInstance::SetDrawingModel(NPDrawingModel aModel)
 {
   mDrawingModel = aModel;
@@ -702,12 +715,69 @@ void nsNPAPIPluginInstance::SetEventModel(NPEventModel aModel)
 
   owner->SetEventModel(aModel);
 }
+#endif
+
+#if defined(ANDROID)
+void nsNPAPIPluginInstance::SetDrawingModel(PRUint32 aModel)
+{
+  mDrawingModel = aModel;
+}
+
+class SurfaceGetter : public nsRunnable {
+public:
+  SurfaceGetter(NPPluginFuncs* aPluginFunctions, NPP_t aNPP) : 
+    mHaveSurface(PR_FALSE), mPluginFunctions(aPluginFunctions), mNPP(aNPP) {
+    mLock = new Mutex("SurfaceGetter::Lock");
+    mCondVar = new CondVar(*mLock, "SurfaceGetter::CondVar");
+    
+  }
+  ~SurfaceGetter() {
+    delete mLock;
+    delete mCondVar;
+  }
+  nsresult Run() {
+    MutexAutoLock lock(*mLock);
+    (*mPluginFunctions->getvalue)(&mNPP, kJavaSurface_ANPGetValue, &mSurface);
+    mHaveSurface = PR_TRUE;
+    mCondVar->Notify();
+    return NS_OK;
+  }
+  void* GetSurface() {
+    MutexAutoLock lock(*mLock);
+    mHaveSurface = PR_FALSE;
+    AndroidBridge::Bridge()->PostToJavaThread(this);
+    while (!mHaveSurface)
+      mCondVar->Wait();
+    return mSurface;
+  }
+private:
+  NPP_t mNPP;
+  void* mSurface;
+  Mutex* mLock;
+  CondVar* mCondVar;
+  PRBool mHaveSurface;
+  NPPluginFuncs* mPluginFunctions;
+};
+
+
+void* nsNPAPIPluginInstance::GetJavaSurface()
+{
+  if (mDrawingModel != kSurface_ANPDrawingModel)
+    return nsnull;
+  
+  if (mSurface)
+    return mSurface;
+
+  nsCOMPtr<SurfaceGetter> sg = new SurfaceGetter(mPlugin->PluginFuncs(), mNPP);
+  mSurface = sg->GetSurface();
+  return mSurface;
+}
 
 #endif
 
 nsresult nsNPAPIPluginInstance::GetDrawingModel(PRInt32* aModel)
 {
-#ifdef XP_MACOSX
+#if defined(XP_MACOSX) || defined(ANDROID)
   *aModel = (PRInt32)mDrawingModel;
   return NS_OK;
 #else
@@ -806,7 +876,12 @@ nsNPAPIPluginInstance::DefineJavaProperties()
 nsresult
 nsNPAPIPluginInstance::IsWindowless(PRBool* isWindowless)
 {
+#ifdef ANDROID
+  // On android, pre-honeycomb, all plugins are treated as windowless.
+  *isWindowless = PR_TRUE;
+#else
   *isWindowless = mWindowless;
+#endif
   return NS_OK;
 }
 
@@ -1066,6 +1141,28 @@ nsNPAPIPluginInstance::PrivateModeStateChanged()
   return NS_ERROR_FAILURE;
 }
 
+class DelayUnscheduleEvent : public nsRunnable {
+public:
+  nsRefPtr<nsNPAPIPluginInstance> mInstance;
+  uint32_t mTimerID;
+  DelayUnscheduleEvent(nsNPAPIPluginInstance* aInstance, uint32_t aTimerId)
+    : mInstance(aInstance)
+    , mTimerID(aTimerId)
+  {}
+
+  ~DelayUnscheduleEvent() {}
+
+  NS_IMETHOD Run();
+};
+
+NS_IMETHODIMP
+DelayUnscheduleEvent::Run()
+{
+  mInstance->UnscheduleTimer(mTimerID);
+  return NS_OK;
+}
+
+
 static void
 PluginTimerCallback(nsITimer *aTimer, void *aClosure)
 {
@@ -1073,7 +1170,11 @@ PluginTimerCallback(nsITimer *aTimer, void *aClosure)
   NPP npp = t->npp;
   uint32_t id = t->id;
 
+  // Some plugins (Flash on Android) calls unscheduletimer
+  // from this callback.
+  t->inCallback = PR_TRUE;
   (*(t->callback))(npp, id);
+  t->inCallback = PR_FALSE;
 
   // Make sure we still have an instance and the timer is still alive
   // after the callback.
@@ -1107,6 +1208,7 @@ nsNPAPIPluginInstance::ScheduleTimer(uint32_t interval, NPBool repeat, void (*ti
 {
   nsNPAPITimer *newTimer = new nsNPAPITimer();
 
+  newTimer->inCallback = PR_FALSE;
   newTimer->npp = &mNPP;
 
   // generate ID that is unique to this instance
@@ -1144,6 +1246,12 @@ nsNPAPIPluginInstance::UnscheduleTimer(uint32_t timerID)
   if (!t)
     return;
 
+  if (t->inCallback) {
+    nsCOMPtr<nsIRunnable> e = new DelayUnscheduleEvent(this, timerID);
+    NS_DispatchToCurrentThread(e);
+    return;
+  }
+
   // cancel the timer
   t->timer->Cancel();
 
diff --git a/dom/plugins/base/nsNPAPIPluginInstance.h b/dom/plugins/base/nsNPAPIPluginInstance.h
index 555ef755718b..ef7cedd4e1a5 100644
--- a/dom/plugins/base/nsNPAPIPluginInstance.h
+++ b/dom/plugins/base/nsNPAPIPluginInstance.h
@@ -68,6 +68,7 @@ public:
   uint32_t id;
   nsCOMPtr<nsITimer> timer;
   void (*callback)(NPP npp, uint32_t timerID);
+  PRBool inCallback;
 };
 
 class nsNPAPIPluginInstance : public nsISupports
@@ -85,6 +86,9 @@ public:
   nsresult NewStreamToPlugin(nsIPluginStreamListener** listener);
   nsresult NewStreamFromPlugin(const char* type, const char* target, nsIOutputStream* *result);
   nsresult Print(NPPrint* platformPrint);
+#ifdef ANDROID
+  nsresult PostEvent(void* event) { return 0; };
+#endif
   nsresult HandleEvent(void* event, PRInt16* result);
   nsresult GetValueFromPlugin(NPPVariable variable, void* value);
   nsresult GetDrawingModel(PRInt32* aModel);
@@ -141,6 +145,11 @@ public:
   void SetEventModel(NPEventModel aModel);
 #endif
 
+#ifdef ANDROID
+  void SetDrawingModel(PRUint32 aModel);
+  void* GetJavaSurface();
+#endif
+
   nsresult NewStreamListener(const char* aURL, void* notifyData,
                              nsIPluginStreamListener** listener);
 
@@ -207,6 +216,10 @@ protected:
   NPDrawingModel mDrawingModel;
 #endif
 
+#ifdef ANDROID
+  PRUint32 mDrawingModel;
+#endif
+
   enum {
     NOT_STARTED,
     RUNNING,
@@ -250,6 +263,9 @@ private:
   nsCOMPtr<nsIURI> mURI;
 
   PRPackedBool mUsePluginLayersPref;
+#ifdef ANDROID
+  void* mSurface;
+#endif
 };
 
 #endif // nsNPAPIPluginInstance_h_
diff --git a/dom/plugins/base/nsPluginHost.cpp b/dom/plugins/base/nsPluginHost.cpp
index 7c2c5d13f454..689e01b68743 100644
--- a/dom/plugins/base/nsPluginHost.cpp
+++ b/dom/plugins/base/nsPluginHost.cpp
@@ -159,6 +159,11 @@
 #include "winbase.h"
 #endif
 
+#ifdef ANDROID
+#include <android/log.h>
+#define LOG(args...)  __android_log_print(ANDROID_LOG_INFO, "GeckoPlugins" , ## args)
+#endif
+
 using namespace mozilla;
 using mozilla::TimeStamp;
 
@@ -2229,7 +2234,7 @@ nsresult nsPluginHost::ScanPluginsDirectoryList(nsISimpleEnumerator *dirEnum,
       nsCOMPtr<nsIFile> nextDir(do_QueryInterface(supports, &rv));
       if (NS_FAILED(rv))
         continue;
-
+      
       // don't pass aPluginsChanged directly to prevent it from been reset
       PRBool pluginschanged = PR_FALSE;
       ScanPluginsDirectory(nextDir, aCreatePluginList, &pluginschanged);
@@ -2324,6 +2329,10 @@ nsresult nsPluginHost::FindPlugins(PRBool aCreatePluginList, PRBool * aPluginsCh
       NS_ITERATIVE_UNREF_LIST(nsRefPtr<nsInvalidPluginTag>, mInvalidPlugins, mNext);
       return NS_OK;
     }
+  } else {
+#ifdef ANDROID
+    LOG("getting plugins dir failed");
+#endif
   }
 
   mPluginsLoaded = PR_TRUE; // at this point 'some' plugins have been loaded,
diff --git a/dom/plugins/base/nsPluginInstanceOwner.cpp b/dom/plugins/base/nsPluginInstanceOwner.cpp
index 54d98a6df3bc..a41d4909d9ca 100644
--- a/dom/plugins/base/nsPluginInstanceOwner.cpp
+++ b/dom/plugins/base/nsPluginInstanceOwner.cpp
@@ -118,6 +118,16 @@ static NS_DEFINE_CID(kAppShellCID, NS_APPSHELL_CID);
 #include "gfxXlibNativeRenderer.h"
 #endif
 
+#ifdef ANDROID
+#include "ANPBase.h"
+#include "android_npapi.h"
+#include "AndroidBridge.h"
+using namespace mozilla::dom;
+
+#include <android/log.h>
+#define LOG(args...)  __android_log_print(ANDROID_LOG_INFO, "GeckoPlugins" , ## args)
+#endif
+
 using namespace mozilla;
 
 // special class for handeling DOM context menu events because for
@@ -1255,7 +1265,12 @@ nsresult nsPluginInstanceOwner::EnsureCachedAttrParamArrays()
 
   // Add PARAM and null separator.
   mCachedAttrParamNames [nextAttrParamIndex] = ToNewUTF8String(NS_LITERAL_STRING("PARAM"));
+#ifdef ANDROID
+  // Flash expects an empty string on android
+  mCachedAttrParamValues[nextAttrParamIndex] = ToNewUTF8String(NS_LITERAL_STRING(""));
+#else
   mCachedAttrParamValues[nextAttrParamIndex] = nsnull;
+#endif
   nextAttrParamIndex++;
 
   // Add PARAM name/value pairs.
@@ -1640,8 +1655,48 @@ void nsPluginInstanceOwner::ScrollPositionDidChange(nscoord aX, nscoord aY)
 #endif
 }
 
+#ifdef ANDROID
+void nsPluginInstanceOwner::RemovePluginView()
+{
+  if (mInstance && mObjectFrame) {
+    void* surface = mInstance->GetJavaSurface();
+    if (surface) {
+      JNIEnv* env = GetJNIForThread();
+      if (env) {
+        jclass cls = env->FindClass("org/mozilla/gecko/GeckoAppShell");
+        jmethodID method = env->GetStaticMethodID(cls,
+                                                  "removePluginView",
+                                                  "(Landroid/view/View;)V");
+        env->CallStaticVoidMethod(cls, method, surface);
+      }
+    }
+  }
+}
+#endif
+
 nsresult nsPluginInstanceOwner::DispatchFocusToPlugin(nsIDOMEvent* aFocusEvent)
 {
+#ifdef ANDROID
+  {
+    ANPEvent event;
+    event.inSize = sizeof(ANPEvent);
+    event.eventType = kLifecycle_ANPEventType;
+
+    nsAutoString eventType;
+    aFocusEvent->GetType(eventType);
+    if (eventType.EqualsLiteral("focus")) {
+      event.data.lifecycle.action = kGainFocus_ANPLifecycleAction;
+    }
+    else if (eventType.EqualsLiteral("blur")) {
+      event.data.lifecycle.action = kLoseFocus_ANPLifecycleAction;
+    }
+    else {
+      NS_ASSERTION(PR_FALSE, "nsPluginInstanceOwner::DispatchFocusToPlugin, wierd eventType");   
+    }
+    mInstance->HandleEvent(&event, nsnull);
+  }
+#endif
+
 #ifndef XP_MACOSX
   if (!mPluginWindow || (mPluginWindow->type == NPWindowTypeWindow)) {
     // continue only for cases without child window
@@ -1912,8 +1967,6 @@ static unsigned int XInputEventState(const nsInputEvent& anEvent)
 
 nsEventStatus nsPluginInstanceOwner::ProcessEvent(const nsGUIEvent& anEvent)
 {
-  // printf("nsGUIEvent.message: %d\n", anEvent.message);
-
   nsEventStatus rv = nsEventStatus_eIgnore;
 
   if (!mInstance || !mObjectFrame)   // if mInstance is null, we shouldn't be here
@@ -2436,6 +2489,107 @@ nsEventStatus nsPluginInstanceOwner::ProcessEvent(const nsGUIEvent& anEvent)
     rv = nsEventStatus_eConsumeNoDefault;
 #endif
 
+#ifdef ANDROID
+  // this code supports windowless plugins
+  {
+    // The plugin needs focus to receive keyboard and touch events
+    nsIFocusManager* fm = nsFocusManager::GetFocusManager();
+    if (fm) {
+      nsCOMPtr<nsIDOMElement> elem = do_QueryInterface(mContent);
+      fm->SetFocus(elem, 0);
+    }
+  }
+  switch(anEvent.eventStructType)
+    {
+    case NS_MOUSE_EVENT:
+      {
+        switch (anEvent.message)
+          {
+          case NS_MOUSE_CLICK:
+          case NS_MOUSE_DOUBLECLICK:
+            // Button up/down events sent instead.
+            return rv;
+          }
+
+        // Get reference point relative to plugin origin.
+        const nsPresContext* presContext = mObjectFrame->PresContext();
+        nsPoint appPoint =
+          nsLayoutUtils::GetEventCoordinatesRelativeTo(&anEvent, mObjectFrame) -
+          mObjectFrame->GetContentRectRelativeToSelf().TopLeft();
+        nsIntPoint pluginPoint(presContext->AppUnitsToDevPixels(appPoint.x),
+                               presContext->AppUnitsToDevPixels(appPoint.y));
+
+        switch (anEvent.message)
+          {
+          case NS_MOUSE_MOVE:
+            {
+              // are these going to be touch events?
+              // pluginPoint.x;
+              // pluginPoint.y;
+            }
+            break;
+          case NS_MOUSE_BUTTON_DOWN:
+            {
+              ANPEvent event;
+              event.inSize = sizeof(ANPEvent);
+              event.eventType = kMouse_ANPEventType;
+              event.data.mouse.action = kDown_ANPMouseAction;
+              event.data.mouse.x = pluginPoint.x;
+              event.data.mouse.y = pluginPoint.y;
+              mInstance->HandleEvent(&event, nsnull);
+            }
+            break;
+          case NS_MOUSE_BUTTON_UP:
+            {
+              ANPEvent event;
+              event.inSize = sizeof(ANPEvent);
+              event.eventType = kMouse_ANPEventType;
+              event.data.mouse.action = kUp_ANPMouseAction;
+              event.data.mouse.x = pluginPoint.x;
+              event.data.mouse.y = pluginPoint.y;
+              mInstance->HandleEvent(&event, nsnull);
+            }
+            break;
+          }
+      }
+      break;
+
+    case NS_KEY_EVENT:
+     {
+       const nsKeyEvent& keyEvent = static_cast<const nsKeyEvent&>(anEvent);
+       LOG("Firing NS_KEY_EVENT %d %d\n", keyEvent.keyCode, keyEvent.charCode);
+       
+       int modifiers = 0;
+       if (keyEvent.isShift)
+         modifiers |= kShift_ANPKeyModifier;
+       if (keyEvent.isAlt)
+         modifiers |= kAlt_ANPKeyModifier;
+
+       ANPEvent event;
+       event.inSize = sizeof(ANPEvent);
+       event.eventType = kKey_ANPEventType;
+       event.data.key.nativeCode = keyEvent.keyCode;
+       event.data.key.virtualCode = keyEvent.charCode;
+       event.data.key.modifiers = modifiers;
+       event.data.key.repeatCount = 0;
+       event.data.key.unichar = 0;
+       switch (anEvent.message)
+         {
+         case NS_KEY_DOWN:
+           event.data.key.action = kDown_ANPKeyAction;
+           mInstance->HandleEvent(&event, nsnull);
+           break;
+           
+         case NS_KEY_UP:
+           event.data.key.action = kUp_ANPKeyAction;
+           mInstance->HandleEvent(&event, nsnull);
+           break;
+         }
+     }
+    }
+    rv = nsEventStatus_eConsumeNoDefault;
+#endif
+ 
   return rv;
 }
 
@@ -2541,6 +2695,10 @@ nsPluginInstanceOwner::PrepareToStop(PRBool aDelayedStop)
   }
 #endif
 
+#ifdef ANDROID
+  RemovePluginView();
+#endif
+
   // Unregister scroll position listeners
   for (nsIFrame* f = mObjectFrame; f; f = nsLayoutUtils::GetCrossDocParentFrame(f)) {
     nsIScrollableFrame* sf = do_QueryFrame(f);
@@ -2637,6 +2795,138 @@ void nsPluginInstanceOwner::Paint(const nsRect& aDirtyRect, HPS aHPS)
 }
 #endif
 
+#ifdef ANDROID
+
+class AndroidPaintEventRunnable : public nsRunnable
+{
+public:
+  AndroidPaintEventRunnable(void* aSurface, nsNPAPIPluginInstance* inst, const gfxRect& aFrameRect)
+    : mSurface(aSurface), mInstance(inst), mFrameRect(aFrameRect) {
+  }
+
+  ~AndroidPaintEventRunnable() {
+  }
+
+  NS_IMETHOD Run()
+  {
+    LOG("%p - AndroidPaintEventRunnable::Run\n", this);
+
+    if (!mInstance || !mSurface)
+      return NS_OK;
+
+    // This needs to happen on the gecko main thread.
+    JNIEnv* env = GetJNIForThread();
+    jclass cls = env->FindClass("org/mozilla/gecko/GeckoAppShell");
+    jmethodID method = env->GetStaticMethodID(cls,
+                                              "addPluginView",
+                                              "(Landroid/view/View;DDDD)V");
+    env->CallStaticVoidMethod(cls,
+                              method,
+                              mSurface,
+                              mFrameRect.x,
+                              mFrameRect.y,
+                              mFrameRect.width,
+                              mFrameRect.height);
+    return NS_OK;
+  }
+private:
+  void* mSurface;
+  nsCOMPtr<nsNPAPIPluginInstance> mInstance;
+  gfxRect mFrameRect;
+};
+
+
+void nsPluginInstanceOwner::Paint(gfxContext* aContext,
+                                  const gfxRect& aFrameRect,
+                                  const gfxRect& aDirtyRect)
+{
+  if (!mInstance || !mObjectFrame)
+    return;
+
+  PRInt32 model;
+  mInstance->GetDrawingModel(&model);
+
+  if (model == kSurface_ANPDrawingModel) {
+
+    {
+      ANPEvent event;
+      event.inSize = sizeof(ANPEvent);
+      event.eventType = kLifecycle_ANPEventType;
+      event.data.lifecycle.action = kOnScreen_ANPLifecycleAction;
+      mInstance->HandleEvent(&event, nsnull);
+    }
+
+    /*
+    gfxMatrix currentMatrix = aContext->CurrentMatrix();
+    gfxSize scale = currentMatrix.ScaleFactors(PR_TRUE);
+    printf_stderr("!!!!!!!! scale!!:  %f x %f\n", scale.width, scale.height);
+    */
+
+    JNIEnv* env = GetJNIForThread();
+    jclass cls = env->FindClass("org/mozilla/gecko/GeckoAppShell");
+    jmethodID method = env->GetStaticMethodID(cls,
+                                              "addPluginView",
+                                              "(Landroid/view/View;DDDD)V");
+    env->CallStaticVoidMethod(cls,
+                              method,
+                              mInstance->GetJavaSurface(),
+                              aFrameRect.x,
+                              aFrameRect.y,
+                              aFrameRect.width,
+                              aFrameRect.height);
+    return;
+  }
+
+  if (model != kBitmap_ANPDrawingModel)
+    return;
+
+#ifdef ANP_BITMAP_DRAWING_MODEL
+  static nsRefPtr<gfxImageSurface> pluginSurface;
+
+  if (pluginSurface == nsnull ||
+      aFrameRect.width  != pluginSurface->Width() ||
+      aFrameRect.height != pluginSurface->Height()) {
+
+    pluginSurface = new gfxImageSurface(gfxIntSize(aFrameRect.width, aFrameRect.height), 
+                                        gfxImageSurface::ImageFormatARGB32);
+    if (!pluginSurface)
+      return;
+  }
+
+  // Clears buffer.  I think this is needed.
+  nsRefPtr<gfxContext> ctx = new gfxContext(pluginSurface);
+  ctx->SetOperator(gfxContext::OPERATOR_CLEAR);
+  ctx->Paint();
+  
+  ANPEvent event;
+  event.inSize = sizeof(ANPEvent);
+  event.eventType = 4;
+  event.data.draw.model = 1;
+  
+  event.data.draw.clip.top     = 0;
+  event.data.draw.clip.left    = 0;
+  event.data.draw.clip.bottom  = aFrameRect.width;
+  event.data.draw.clip.right   = aFrameRect.height;
+  
+  event.data.draw.data.bitmap.format   = kRGBA_8888_ANPBitmapFormat;
+  event.data.draw.data.bitmap.width    = aFrameRect.width;
+  event.data.draw.data.bitmap.height   = aFrameRect.height;
+  event.data.draw.data.bitmap.baseAddr = pluginSurface->Data();
+  event.data.draw.data.bitmap.rowBytes = aFrameRect.width * 4;
+  
+  if (!mInstance)
+    return;
+    
+  mInstance->HandleEvent(&event, nsnull);
+
+  aContext->SetOperator(gfxContext::OPERATOR_SOURCE);
+  aContext->SetSource(pluginSurface, gfxPoint(aFrameRect.x, aFrameRect.y));
+  aContext->Clip(aFrameRect);
+  aContext->Paint();
+#endif
+}
+#endif
+
 #if defined(MOZ_X11)
 void nsPluginInstanceOwner::Paint(gfxContext* aContext,
                                   const gfxRect& aFrameRect,
@@ -3274,9 +3564,28 @@ void nsPluginInstanceOwner::UpdateWindowPositionAndClipRect(PRBool aSetWindow)
   if (mPluginWindowVisible && mPluginDocumentActiveState) {
     mPluginWindow->clipRect.right = mPluginWindow->width;
     mPluginWindow->clipRect.bottom = mPluginWindow->height;
+#ifdef ANDROID
+    if (mInstance) {
+      ANPEvent event;
+      event.inSize = sizeof(ANPEvent);
+      event.eventType = kLifecycle_ANPEventType;
+      event.data.lifecycle.action = kOnScreen_ANPLifecycleAction;
+      mInstance->HandleEvent(&event, nsnull);
+    }
+#endif
   } else {
     mPluginWindow->clipRect.right = 0;
     mPluginWindow->clipRect.bottom = 0;
+#ifdef ANDROID
+    if (mInstance) {
+      ANPEvent event;
+      event.inSize = sizeof(ANPEvent);
+      event.eventType = kLifecycle_ANPEventType;
+      event.data.lifecycle.action = kOffScreen_ANPLifecycleAction;
+      mInstance->HandleEvent(&event, nsnull);
+    }
+    RemovePluginView();
+#endif
   }
 
   if (!aSetWindow)
diff --git a/dom/plugins/base/nsPluginInstanceOwner.h b/dom/plugins/base/nsPluginInstanceOwner.h
index 682087105d97..f5f23ddb07f8 100644
--- a/dom/plugins/base/nsPluginInstanceOwner.h
+++ b/dom/plugins/base/nsPluginInstanceOwner.h
@@ -144,7 +144,7 @@ public:
   void Paint(const gfxRect& aDirtyRect, CGContextRef cgContext);  
   void RenderCoreAnimation(CGContextRef aCGContext, int aWidth, int aHeight);
   void DoCocoaEventDrawRect(const gfxRect& aDrawRect, CGContextRef cgContext);
-#elif defined(MOZ_X11)
+#elif defined(MOZ_X11) || defined(ANDROID)
   void Paint(gfxContext* aContext,
              const gfxRect& aFrameRect,
              const gfxRect& aDirtyRect);
@@ -308,7 +308,10 @@ private:
   }
   
   void FixUpURLS(const nsString &name, nsAString &value);
-  
+#ifdef ANDROID
+  void RemovePluginView();
+#endif 
+ 
   nsPluginNativeWindow       *mPluginWindow;
   nsRefPtr<nsNPAPIPluginInstance> mInstance;
   nsObjectFrame              *mObjectFrame; // owns nsPluginInstanceOwner
diff --git a/dom/plugins/base/nsPluginsDirUnix.cpp b/dom/plugins/base/nsPluginsDirUnix.cpp
index ea8170a938bf..f761d1d2a157 100644
--- a/dom/plugins/base/nsPluginsDirUnix.cpp
+++ b/dom/plugins/base/nsPluginsDirUnix.cpp
@@ -247,6 +247,16 @@ PRBool nsPluginsDir::IsPluginFile(nsIFile* file)
     if (NS_FAILED(file->GetNativeLeafName(filename)))
         return PR_FALSE;
 
+#ifdef ANDROID
+    // It appears that if you load
+    // 'libstagefright_honeycomb.so' on froyo, or
+    // 'libstagefright_froyo.so' on honeycomb, we will abort.
+    // Since these are just helper libs, we can ignore.
+    const char *cFile = filename.get();
+    if (strstr(cFile, "libstagefright") != NULL)
+        return PR_FALSE;
+#endif
+
     NS_NAMED_LITERAL_CSTRING(dllSuffix, LOCAL_PLUGIN_DLL_SUFFIX);
     if (filename.Length() > dllSuffix.Length() &&
         StringEndsWith(filename, dllSuffix))
diff --git a/embedding/android/AndroidManifest.xml.in b/embedding/android/AndroidManifest.xml.in
index 3b7eb3661968..240f516be1d6 100644
--- a/embedding/android/AndroidManifest.xml.in
+++ b/embedding/android/AndroidManifest.xml.in
@@ -19,6 +19,13 @@
     <uses-permission android:name="android.permission.READ_PHONE_STATE"/>
     <uses-permission android:name="com.android.launcher.permission.INSTALL_SHORTCUT"/>
 
+    <uses-permission android:name="android.permission.READ_LOGS"/>
+    <uses-permission android:name="android.permission.WAKE_LOCK"/>
+    <uses-permission android:name="android.permission.ACCESS_WIFI_STATE"/>
+    <uses-permission android:name="android.permission.CHANGE_NETWORK_STATE"/> 
+    <uses-permission android:name="android.permission.ACCESS_NETWORK_STATE"/>
+    <uses-permission android:name="android.permission.CHANGE_NETWORK_STATE"/>
+
     <uses-feature android:name="android.hardware.location" android:required="false"/>
     <uses-feature android:name="android.hardware.location.gps" android:required="false"/>
     <uses-feature android:name="android.hardware.touchscreen"/>
diff --git a/embedding/android/GeckoApp.java b/embedding/android/GeckoApp.java
index d4b1c5c9f982..02765866361b 100644
--- a/embedding/android/GeckoApp.java
+++ b/embedding/android/GeckoApp.java
@@ -45,6 +45,7 @@ import java.util.zip.*;
 import java.nio.*;
 import java.nio.channels.FileChannel;
 import java.util.concurrent.*;
+import java.lang.reflect.*;
 
 import android.os.*;
 import android.app.*;
@@ -62,6 +63,9 @@ import android.net.*;
 import android.database.*;
 import android.provider.*;
 import android.telephony.*;
+import android.content.pm.*;
+import android.content.pm.PackageManager.*;
+import dalvik.system.*;
 
 abstract public class GeckoApp
     extends Activity
@@ -74,7 +78,7 @@ abstract public class GeckoApp
     public static final String ACTION_DEBUG       = "org.mozilla.gecko.DEBUG";
     public static final String ACTION_BOOKMARK    = "org.mozilla.gecko.BOOKMARK";
 
-    public static FrameLayout mainLayout;
+    public static AbsoluteLayout mainLayout;
     public static GeckoSurfaceView surfaceView;
     public static GeckoApp mAppContext;
     public static boolean mFullscreen = false;
@@ -130,6 +134,151 @@ abstract public class GeckoApp
                                }).show();
     }
 
+    public static final String PLUGIN_ACTION = "android.webkit.PLUGIN";
+
+    /**
+     * A plugin that wish to be loaded in the WebView must provide this permission
+     * in their AndroidManifest.xml.
+     */
+    public static final String PLUGIN_PERMISSION = "android.webkit.permission.PLUGIN";
+
+    private static final String LOGTAG = "PluginManager";
+
+    private static final String PLUGIN_SYSTEM_LIB = "/system/lib/plugins/";
+
+    private static final String PLUGIN_TYPE = "type";
+    private static final String TYPE_NATIVE = "native";
+    public ArrayList<PackageInfo> mPackageInfoCache = new ArrayList<PackageInfo>();
+
+    String[] getPluginDirectories() {
+
+        ArrayList<String> directories = new ArrayList<String>();
+        PackageManager pm = this.mAppContext.getPackageManager();
+        List<ResolveInfo> plugins = pm.queryIntentServices(new Intent(PLUGIN_ACTION),
+                PackageManager.GET_SERVICES | PackageManager.GET_META_DATA);
+
+        synchronized(mPackageInfoCache) {
+
+            // clear the list of existing packageInfo objects
+            mPackageInfoCache.clear();
+
+
+            for (ResolveInfo info : plugins) {
+
+                // retrieve the plugin's service information
+                ServiceInfo serviceInfo = info.serviceInfo;
+                if (serviceInfo == null) {
+                    Log.w(LOGTAG, "Ignore bad plugin");
+                    continue;
+                }
+
+                Log.w(LOGTAG, "Loading plugin: " + serviceInfo.packageName);
+
+
+                // retrieve information from the plugin's manifest
+                PackageInfo pkgInfo;
+                try {
+                    pkgInfo = pm.getPackageInfo(serviceInfo.packageName,
+                                    PackageManager.GET_PERMISSIONS
+                                    | PackageManager.GET_SIGNATURES);
+                } catch (Exception e) {
+                    Log.w(LOGTAG, "Can't find plugin: " + serviceInfo.packageName);
+                    continue;
+                }
+                if (pkgInfo == null) {
+                    Log.w(LOGTAG, "Loading plugin: " + serviceInfo.packageName + ". Could not load package information.");
+                    continue;
+                }
+
+                /*
+                 * find the location of the plugin's shared library. The default
+                 * is to assume the app is either a user installed app or an
+                 * updated system app. In both of these cases the library is
+                 * stored in the app's data directory.
+                 */
+                String directory = pkgInfo.applicationInfo.dataDir + "/lib";
+                final int appFlags = pkgInfo.applicationInfo.flags;
+                final int updatedSystemFlags = ApplicationInfo.FLAG_SYSTEM |
+                                               ApplicationInfo.FLAG_UPDATED_SYSTEM_APP;
+                // preloaded system app with no user updates
+                if ((appFlags & updatedSystemFlags) == ApplicationInfo.FLAG_SYSTEM) {
+                    directory = PLUGIN_SYSTEM_LIB + pkgInfo.packageName;
+                }
+
+                // check if the plugin has the required permissions
+                String permissions[] = pkgInfo.requestedPermissions;
+                if (permissions == null) {
+                    Log.w(LOGTAG, "Loading plugin: " + serviceInfo.packageName + ". Does not have required permission.");
+                    continue;
+                }
+                boolean permissionOk = false;
+                for (String permit : permissions) {
+                    if (PLUGIN_PERMISSION.equals(permit)) {
+                        permissionOk = true;
+                        break;
+                    }
+                }
+                if (!permissionOk) {
+                    Log.w(LOGTAG, "Loading plugin: " + serviceInfo.packageName + ". Does not have required permission (2).");
+                    continue;
+                }
+
+                // check to ensure the plugin is properly signed
+                Signature signatures[] = pkgInfo.signatures;
+                if (signatures == null) {
+                    Log.w(LOGTAG, "Loading plugin: " + serviceInfo.packageName + ". Not signed.");
+                    continue;
+                }
+
+                // determine the type of plugin from the manifest
+                if (serviceInfo.metaData == null) {
+                    Log.e(LOGTAG, "The plugin '" + serviceInfo.name + "' has no type defined");
+                    continue;
+                }
+
+                String pluginType = serviceInfo.metaData.getString(PLUGIN_TYPE);
+                if (!TYPE_NATIVE.equals(pluginType)) {
+                    Log.e(LOGTAG, "Unrecognized plugin type: " + pluginType);
+                    continue;
+                }
+
+                try {
+                    Class<?> cls = getPluginClass(serviceInfo.packageName, serviceInfo.name);
+
+                    //TODO implement any requirements of the plugin class here!
+                    boolean classFound = true;
+
+                    if (!classFound) {
+                        Log.e(LOGTAG, "The plugin's class' " + serviceInfo.name + "' does not extend the appropriate class.");
+                        continue;
+                    }
+
+                } catch (NameNotFoundException e) {
+                    Log.e(LOGTAG, "Can't find plugin: " + serviceInfo.packageName);
+                    continue;
+                } catch (ClassNotFoundException e) {
+                    Log.e(LOGTAG, "Can't find plugin's class: " + serviceInfo.name);
+                    continue;
+                }
+
+                // if all checks have passed then make the plugin available
+                mPackageInfoCache.add(pkgInfo);
+                directories.add(directory);
+            }
+        }
+
+        return directories.toArray(new String[directories.size()]);
+    }
+
+    Class<?> getPluginClass(String packageName, String className)
+            throws NameNotFoundException, ClassNotFoundException {
+        Context pluginContext = this.mAppContext.createPackageContext(packageName,
+                Context.CONTEXT_INCLUDE_CODE |
+                Context.CONTEXT_IGNORE_SECURITY);
+        ClassLoader pluginCL = pluginContext.getClassLoader();
+        return pluginCL.loadClass(className);
+    }
+
     // Returns true when the intent is going to be handled by gecko launch
     boolean launch(Intent intent)
     {
@@ -229,13 +378,14 @@ abstract public class GeckoApp
         if (surfaceView == null)
             surfaceView = new GeckoSurfaceView(this);
         else
-            mainLayout.removeView(surfaceView);
+            mainLayout.removeAllViews();
 
-        mainLayout = new FrameLayout(this);
+        mainLayout = new AbsoluteLayout(this);
         mainLayout.addView(surfaceView,
-                           new FrameLayout.LayoutParams(FrameLayout.LayoutParams.FILL_PARENT,
-                                                        FrameLayout.LayoutParams.FILL_PARENT));
-
+                           new AbsoluteLayout.LayoutParams(AbsoluteLayout.LayoutParams.MATCH_PARENT, // level 8
+                                                           AbsoluteLayout.LayoutParams.MATCH_PARENT,
+                                                           0,
+                                                           0));
         setContentView(mainLayout,
                        new ViewGroup.LayoutParams(ViewGroup.LayoutParams.FILL_PARENT,
                                                   ViewGroup.LayoutParams.FILL_PARENT));
diff --git a/embedding/android/GeckoAppShell.java b/embedding/android/GeckoAppShell.java
index e0957678c427..7625e9d0dc10 100644
--- a/embedding/android/GeckoAppShell.java
+++ b/embedding/android/GeckoAppShell.java
@@ -308,6 +308,19 @@ public class GeckoAppShell
             if (intHome != null && intProf != null && intProf.exists())
                 moveDir(intProf, profileDir);
         }
+        try {
+            String[] dirs = GeckoApp.mAppContext.getPluginDirectories();
+            StringBuffer pluginSearchPath = new StringBuffer();
+            for (int i = 0; i < dirs.length; i++) {
+                Log.i("GeckoPlugins", "dir: " + dirs[i]);
+                pluginSearchPath.append(dirs[i]);
+                pluginSearchPath.append(":");
+            }
+            GeckoAppShell.putenv("MOZ_PLUGIN_PATH="+pluginSearchPath);
+        } catch (Exception ex) {
+            Log.i("GeckoPlugins", "exception getting plugin dirs", ex);
+        }
+
         GeckoAppShell.putenv("HOME=" + homeDir);
         GeckoAppShell.putenv("GRE_HOME=" + GeckoApp.sGREDir.getPath());
         Intent i = geckoApp.getIntent();
@@ -395,6 +408,7 @@ public class GeckoAppShell
             combinedArgs += " " + args;
         if (url != null)
             combinedArgs += " " + url;
+
         // and go
         GeckoAppShell.nativeRun(combinedArgs);
     }
@@ -1385,4 +1399,187 @@ public class GeckoAppShell
             return false;
         }
     }
+    public static void addPluginView(final View view,
+                                     final double x, final double y,
+                                     final double w, final double h) {
+
+        Log.i("GeckoAppShell", "addPluginView:" + view + " @ x:" + x + " y:" + y + " w:" + w + " h:" + h ) ;
+
+        getMainHandler().post(new Runnable() { 
+                public void run() {
+                    AbsoluteLayout.LayoutParams lp = new AbsoluteLayout.LayoutParams((int)w,
+                                                                                     (int)h,
+                                                                                     (int)x,
+                                                                                     (int)y);
+
+                    if (GeckoApp.mainLayout.indexOfChild(view) == -1) {
+                        view.setWillNotDraw(false);
+                        if(view instanceof SurfaceView)
+                            ((SurfaceView)view).setZOrderOnTop(true);
+
+                        GeckoApp.mainLayout.addView(view, lp);
+                    }
+                    else
+                    {
+                        try {
+                            GeckoApp.mainLayout.updateViewLayout(view, lp);
+                        } catch (IllegalArgumentException e) {
+                            Log.i("updateViewLayout - IllegalArgumentException", "e:" + e);
+                            // it can be the case where we
+                            // get an update before the view
+                            // is actually attached.
+                        }
+                    }
+                }
+            });
+    }
+
+    public static void removePluginView(final View view) {
+        Log.i("GeckoAppShell", "remove view:" + view);
+        getMainHandler().post(new Runnable() { 
+                public void run() {
+                    try {
+                        GeckoApp.mainLayout.removeView(view);
+                    } catch (Exception e) {}
+                }
+            });
+    }
+
+    public static Class<?> loadPluginClass(String className, String libName) {
+        Log.i("GeckoAppShell", "in loadPluginClass... attempting to access className, then libName.....");
+        Log.i("GeckoAppShell", "className: " + className);
+        Log.i("GeckoAppShell", "libName: " + libName);
+
+        try {
+            String[] split = libName.split("/");
+            String packageName = split[split.length - 3];
+            Log.i("GeckoAppShell", "load \"" + className + "\" from \"" + packageName + 
+                  "\" for \"" + libName + "\"");
+            Context pluginContext = 
+                GeckoApp.mAppContext.createPackageContext(packageName,
+                                                          Context.CONTEXT_INCLUDE_CODE |
+                                                      Context.CONTEXT_IGNORE_SECURITY);
+            ClassLoader pluginCL = pluginContext.getClassLoader();
+            return pluginCL.loadClass(className);
+        } catch (java.lang.ClassNotFoundException cnfe) {
+            Log.i("GeckoAppShell", "class not found", cnfe);
+        } catch (android.content.pm.PackageManager.NameNotFoundException nnfe) {
+            Log.i("GeckoAppShell", "package not found", nnfe);
+        }
+        Log.e("GeckoAppShell", "couldn't find class");
+        return null;
+    }
+
+    static HashMap<SurfaceView, SurfaceLockInfo> sSufaceMap = new HashMap<SurfaceView, SurfaceLockInfo>();
+
+    public static void lockSurfaceANP()
+    {
+         Log.i("GeckoAppShell", "other lockSurfaceANP");
+    }
+
+    public static org.mozilla.gecko.SurfaceLockInfo lockSurfaceANP(android.view.SurfaceView sview, int top, int left, int bottom, int right)
+    {
+        Log.i("GeckoAppShell", "real lockSurfaceANP " + sview + ", " + top + ",  " + left + ", " + bottom + ", " + right);
+        if (sview == null)
+            return null;
+
+        int format = -1;
+        try {
+            Field privateFormatField = SurfaceView.class.getDeclaredField("mFormat");
+            privateFormatField.setAccessible(true);
+            format = privateFormatField.getInt(sview);
+        } catch (Exception e) {
+            Log.i("GeckoAppShell", "mFormat is not a field of sview: ", e);
+        }
+
+        int n = 0;
+        if (format == PixelFormat.RGB_565)
+            n = 2;
+        else if (format == PixelFormat.RGBA_8888)
+            n = 4;
+
+        if (n == 0)
+            return null;
+
+        SurfaceLockInfo info = sSufaceMap.get(sview);
+        if (info == null) {
+            info = new SurfaceLockInfo();
+            sSufaceMap.put(sview, info);
+        }
+
+        Rect r = new Rect(left, top, right, bottom);
+
+        info.canvas = sview.getHolder().lockCanvas(r);
+        int bufSizeRequired = info.canvas.getWidth() * info.canvas.getHeight() * n;
+        Log.i("GeckoAppShell", "lockSurfaceANP - bufSizeRequired: " + n + " " + info.canvas.getHeight() + " " + info.canvas.getWidth());
+
+        if (info.width != info.canvas.getWidth() || info.height != info.canvas.getHeight() || info.buffer == null || info.buffer.capacity() < bufSizeRequired) {
+            info.width = info.canvas.getWidth();
+            info.height = info.canvas.getHeight();
+
+            // XXX Bitmaps instead of ByteBuffer
+            info.buffer = ByteBuffer.allocateDirect(bufSizeRequired);  //leak
+            Log.i("GeckoAppShell", "!!!!!!!!!!!  lockSurfaceANP - Allocating buffer! " + bufSizeRequired);
+
+        }
+
+        info.canvas.drawColor(Color.WHITE, PorterDuff.Mode.CLEAR);
+
+        info.format = format;
+        info.dirtyTop = top;
+        info.dirtyBottom = bottom;
+        info.dirtyLeft = left;
+        info.dirtyRight = right;
+
+        return info;
+    }
+
+    public static void unlockSurfaceANP(SurfaceView sview) {
+        SurfaceLockInfo info = sSufaceMap.get(sview);
+
+        int n = 0;
+        Bitmap.Config config;
+        if (info.format == PixelFormat.RGB_565) {
+            n = 2;
+            config = Bitmap.Config.RGB_565;
+        } else {
+            n = 4;
+            config = Bitmap.Config.ARGB_8888;
+        }
+
+        Log.i("GeckoAppShell", "unlockSurfaceANP: " + (info.width * info.height * n));
+
+        Bitmap bm = Bitmap.createBitmap(info.width, info.height, config);
+        bm.copyPixelsFromBuffer(info.buffer);
+        info.canvas.drawBitmap(bm, 0, 0, null);
+        sview.getHolder().unlockCanvasAndPost(info.canvas);
+    }
+
+    public static Class getSurfaceLockInfoClass() {
+        Log.i("GeckoAppShell", "class name: " + SurfaceLockInfo.class.getName());
+        return SurfaceLockInfo.class;
+    }
+
+    public static Method getSurfaceLockMethod() {
+        Method[] m = GeckoAppShell.class.getMethods();
+        for (int i = 0; i < m.length; i++) {
+            if (m[i].getName().equals("lockSurfaceANP"))
+                return m[i];
+        }
+        return null;
+    }
+
+    static native void executeNextRunnable();
+
+    static class GeckoRunnableCallback implements Runnable {
+        public void run() {
+            Log.i("GeckoShell", "run GeckoRunnableCallback");
+            GeckoAppShell.executeNextRunnable();
+        }
+    }
+
+    public static void postToJavaThread(boolean mainThread) {
+        Log.i("GeckoShell", "post to " + (mainThread ? "main " : "") + "java thread");
+        getMainHandler().post(new GeckoRunnableCallback());
+    }
 }
diff --git a/embedding/android/Makefile.in b/embedding/android/Makefile.in
index ebda01b067b0..c6a4101e37f5 100644
--- a/embedding/android/Makefile.in
+++ b/embedding/android/Makefile.in
@@ -54,6 +54,7 @@ JAVAFILES = \
   GeckoInputConnection.java \
   GeckoPhoneStateListener.java \
   AlertNotification.java \
+  SurfaceLockInfo.java \
   $(NULL)
 
 PROCESSEDJAVAFILES = \
diff --git a/embedding/android/SurfaceLockInfo.java b/embedding/android/SurfaceLockInfo.java
new file mode 100644
index 000000000000..4dcb7dc2b6a3
--- /dev/null
+++ b/embedding/android/SurfaceLockInfo.java
@@ -0,0 +1,18 @@
+package org.mozilla.gecko;
+
+import android.graphics.Canvas;
+import java.nio.Buffer;
+
+public class SurfaceLockInfo {
+    public int dirtyTop;
+    public int dirtyLeft;
+    public int dirtyRight;
+    public int dirtyBottom;
+
+    public int bpr;
+    public int format;
+    public int width;
+    public int height;
+    public Buffer buffer;
+    public Canvas canvas;
+}
diff --git a/layout/build/Makefile.in b/layout/build/Makefile.in
index 03fc6bfb757c..4da911a5725f 100644
--- a/layout/build/Makefile.in
+++ b/layout/build/Makefile.in
@@ -135,6 +135,7 @@ LOCAL_INCLUDES	+= \
 else ifneq (,$(filter android,$(MOZ_WIDGET_TOOLKIT)))
 SHARED_LIBRARY_LIBS += \
 	$(DEPTH)/dom/system/android/$(LIB_PREFIX)domsystemandroid_s.$(LIB_SUFFIX) \
+	$(DEPTH)/dom/plugins/base/android/$(LIB_PREFIX)gkpluginandroid_s.$(LIB_SUFFIX) \
 	$(NULL)
 LOCAL_INCLUDES	+= \
 	-I$(topsrcdir)/dom/system/android \
diff --git a/layout/generic/nsObjectFrame.cpp b/layout/generic/nsObjectFrame.cpp
index ad1503ae984d..09e3b6f654c3 100644
--- a/layout/generic/nsObjectFrame.cpp
+++ b/layout/generic/nsObjectFrame.cpp
@@ -1683,6 +1683,22 @@ nsObjectFrame::PaintPlugin(nsDisplayListBuilder* aBuilder,
                            nsRenderingContext& aRenderingContext,
                            const nsRect& aDirtyRect, const nsRect& aPluginRect)
 {
+#if defined(ANDROID)
+  if (mInstanceOwner) {
+    NPWindow *window;
+    mInstanceOwner->GetWindow(window);
+
+    gfxRect frameGfxRect =
+      PresContext()->AppUnitsToGfxUnits(aPluginRect);
+    gfxRect dirtyGfxRect =
+      PresContext()->AppUnitsToGfxUnits(aDirtyRect);
+    gfxContext* ctx = aRenderingContext.ThebesContext();
+
+    mInstanceOwner->Paint(ctx, frameGfxRect, dirtyGfxRect);
+    return;
+  }
+#endif
+
   // Screen painting code
 #if defined(XP_MACOSX)
   // delegate all painting to the plugin instance.
diff --git a/other-licenses/android/APKOpen.cpp b/other-licenses/android/APKOpen.cpp
index a917703a7511..d70efc306333 100644
--- a/other-licenses/android/APKOpen.cpp
+++ b/other-licenses/android/APKOpen.cpp
@@ -241,6 +241,7 @@ SHELL_WRAPPER3(callObserver, jstring, jstring, jstring)
 SHELL_WRAPPER1(removeObserver, jstring)
 SHELL_WRAPPER2(onChangeNetworkLinkStatus, jstring, jstring)
 SHELL_WRAPPER1(reportJavaCrash, jstring)
+SHELL_WRAPPER0(executeNextRunnable)
 
 static void * xul_handle = NULL;
 static time_t apk_mtime = 0;
@@ -667,6 +668,7 @@ loadLibs(const char *apkName)
   GETFUNC(removeObserver);
   GETFUNC(onChangeNetworkLinkStatus);
   GETFUNC(reportJavaCrash);
+  GETFUNC(executeNextRunnable);
 #undef GETFUNC
   gettimeofday(&t1, 0);
   struct rusage usage2;
diff --git a/widget/src/android/AndroidBridge.cpp b/widget/src/android/AndroidBridge.cpp
index 972bd4bb0f01..b1b6a638a1b1 100644
--- a/widget/src/android/AndroidBridge.cpp
+++ b/widget/src/android/AndroidBridge.cpp
@@ -149,6 +149,7 @@ AndroidBridge::Init(JNIEnv *jEnv,
     jGetIconForExtension = (jmethodID) jEnv->GetStaticMethodID(jGeckoAppShellClass, "getIconForExtension", "(Ljava/lang/String;I)[B");
     jCreateShortcut = (jmethodID) jEnv->GetStaticMethodID(jGeckoAppShellClass, "createShortcut", "(Ljava/lang/String;Ljava/lang/String;Ljava/lang/String;Ljava/lang/String;)V");
     jGetShowPasswordSetting = (jmethodID) jEnv->GetStaticMethodID(jGeckoAppShellClass, "getShowPasswordSetting", "()Z");
+    jPostToJavaThread = (jmethodID) jEnv->GetStaticMethodID(jGeckoAppShellClass, "postToJavaThread", "(Z)V");
 
     jEGLContextClass = (jclass) jEnv->NewGlobalRef(jEnv->FindClass("javax/microedition/khronos/egl/EGLContext"));
     jEGL10Class = (jclass) jEnv->NewGlobalRef(jEnv->FindClass("javax/microedition/khronos/egl/EGL10"));
@@ -169,8 +170,14 @@ AndroidBridge::Init(JNIEnv *jEnv,
 JNIEnv *
 AndroidBridge::AttachThread(PRBool asDaemon)
 {
+    // If we already have a env, return it
+    JNIEnv *jEnv = NULL;
+    mJavaVM->GetEnv((void**) &jEnv, JNI_VERSION_1_2);
+    if (jEnv)
+        return jEnv;
+
     ALOG_BRIDGE("AndroidBridge::AttachThread");
-    JNIEnv *jEnv = (JNIEnv*) PR_GetThreadPrivate(sJavaEnvThreadIndex);
+    jEnv = (JNIEnv*) PR_GetThreadPrivate(sJavaEnvThreadIndex);
     if (jEnv)
         return jEnv;
 
@@ -195,6 +202,8 @@ AndroidBridge::AttachThread(PRBool asDaemon)
 
     PR_SetThreadPrivate(sJavaEnvThreadIndex, jEnv);
 
+    PR_NewThreadPrivateIndex(&sJavaEnvThreadIndex, JavaThreadDetachFunc);
+
     return jEnv;
 }
 
@@ -926,6 +935,45 @@ AndroidBridge::CreateShortcut(const nsAString& aTitle, const nsAString& aURI, co
   mJNIEnv->CallStaticVoidMethod(mGeckoAppShellClass, jCreateShortcut, jstrTitle, jstrURI, jstrIconData, jstrIntent);
 }
 
+void
+AndroidBridge::PostToJavaThread(nsIRunnable* aRunnable, PRBool aMainThread)
+{
+    __android_log_print(ANDROID_LOG_INFO, "GeckoBridge", "%s", __PRETTY_FUNCTION__);
+    JNIEnv* env = AndroidBridge::AttachThread(false);
+    if (!env) {
+        __android_log_print(ANDROID_LOG_INFO, "GeckoBridge", "no jni env in %s!!", __PRETTY_FUNCTION__);
+        return;
+    }
+    mRunnableQueue.AppendObject(aRunnable);
+    env->CallStaticVoidMethod(mGeckoAppShellClass, jPostToJavaThread, (jboolean)aMainThread);
+
+    jthrowable ex = env->ExceptionOccurred();
+    if (ex) {
+        env->ExceptionDescribe();
+        env->ExceptionClear();
+    }
+    __android_log_print(ANDROID_LOG_INFO, "GeckoBridge", "leaving %s", __PRETTY_FUNCTION__);
+}
+
+void
+AndroidBridge::ExecuteNextRunnable()
+{
+    __android_log_print(ANDROID_LOG_INFO, "GeckoBridge", "%s", __PRETTY_FUNCTION__);
+
+    JNIEnv* env = AndroidBridge::AttachThread(false);
+    if (!env) {
+        __android_log_print(ANDROID_LOG_INFO, "GeckoBridge", "no jni env in %s!!", __PRETTY_FUNCTION__);
+        return;
+    }
+
+    if (mRunnableQueue.Count() > 0) {
+        nsIRunnable* r = mRunnableQueue[0];
+        __android_log_print(ANDROID_LOG_INFO, "GeckoBridge", "going to run %p", r);
+        r->Run();
+        mRunnableQueue.RemoveObjectAt(0);
+    }
+    __android_log_print(ANDROID_LOG_INFO, "GeckoBridge", "leaving %s", __PRETTY_FUNCTION__);
+}
 bool
 AndroidBridge::HasNativeBitmapAccess()
 {
diff --git a/widget/src/android/AndroidBridge.h b/widget/src/android/AndroidBridge.h
index cfb79eae1d9b..4de9750482c6 100644
--- a/widget/src/android/AndroidBridge.h
+++ b/widget/src/android/AndroidBridge.h
@@ -42,6 +42,7 @@
 #include <android/log.h>
 
 #include "nsCOMPtr.h"
+#include "nsCOMArray.h"
 #include "nsIRunnable.h"
 #include "nsIObserver.h"
 
@@ -262,6 +263,10 @@ public:
 
     void UnlockBitmap(jobject bitmap);
 
+    void PostToJavaThread(nsIRunnable* aRunnable, PRBool aMainThread = PR_FALSE);
+
+    void ExecuteNextRunnable();
+
 protected:
     static AndroidBridge *sBridge;
 
@@ -286,6 +291,8 @@ protected:
     bool mOpenedBitmapLibrary;
     bool mHasNativeBitmapAccess;
 
+    nsCOMArray<nsIRunnable> mRunnableQueue;
+
     // other things
     jmethodID jNotifyIME;
     jmethodID jNotifyIMEEnabled;
@@ -325,6 +332,7 @@ protected:
     jmethodID jGetIconForExtension;
     jmethodID jCreateShortcut;
     jmethodID jGetShowPasswordSetting;
+    jmethodID jPostToJavaThread;
 
     // stuff we need for CallEglCreateWindowSurface
     jclass jEGLSurfaceImplClass;
diff --git a/widget/src/android/AndroidJNI.cpp b/widget/src/android/AndroidJNI.cpp
index 6aadc8e85e9a..4bce698eed47 100644
--- a/widget/src/android/AndroidJNI.cpp
+++ b/widget/src/android/AndroidJNI.cpp
@@ -72,6 +72,7 @@ extern "C" {
     NS_EXPORT void JNICALL Java_org_mozilla_gecko_GeckoAppShell_removeObserver(JNIEnv *jenv, jclass, jstring jObserverKey);
     NS_EXPORT void JNICALL Java_org_mozilla_gecko_GeckoAppShell_onChangeNetworkLinkStatus(JNIEnv *, jclass, jstring status, jstring type);
     NS_EXPORT void JNICALL Java_org_mozilla_gecko_GeckoAppShell_reportJavaCrash(JNIEnv *, jclass, jstring stack);
+    NS_EXPORT void JNICALL Java_org_mozilla_gecko_GeckoAppShell_executeNextRunnable(JNIEnv *, jclass);
 }
 
 
@@ -179,3 +180,15 @@ Java_org_mozilla_gecko_GeckoAppShell_reportJavaCrash(JNIEnv *jenv, jclass, jstri
 #endif
     abort();
 }
+
+NS_EXPORT void JNICALL
+Java_org_mozilla_gecko_GeckoAppShell_executeNextRunnable(JNIEnv *, jclass)
+{
+    __android_log_print(ANDROID_LOG_INFO, "GeckoJNI", "%s", __PRETTY_FUNCTION__);
+    if (!AndroidBridge::Bridge()) {
+        __android_log_print(ANDROID_LOG_INFO, "GeckoJNI", "no bridge in %s!!!!", __PRETTY_FUNCTION__);
+        return;
+    }
+    AndroidBridge::Bridge()->ExecuteNextRunnable();
+    __android_log_print(ANDROID_LOG_INFO, "GeckoJNI", "leaving %s", __PRETTY_FUNCTION__);
+}

From 502e8de807711bcf4c3c70a8d543675fcb5767e8 Mon Sep 17 00:00:00 2001
From: "Brian R. Bondy" <netzen@gmail.com>
Date: Fri, 16 Sep 2011 15:46:38 -0700
Subject: [PATCH 178/209] Bug 617052 - Formatting fix for previous push. r=jimm

---
 widget/src/windows/WinTaskbar.cpp | 16 ++++++++--------
 1 file changed, 8 insertions(+), 8 deletions(-)

diff --git a/widget/src/windows/WinTaskbar.cpp b/widget/src/windows/WinTaskbar.cpp
index 24f635ef9e69..eef10bb54521 100644
--- a/widget/src/windows/WinTaskbar.cpp
+++ b/widget/src/windows/WinTaskbar.cpp
@@ -459,17 +459,17 @@ WinTaskbar::PrepareFullScreenHWND(void *aHWND, PRBool aFullScreen) {
   if (!Initialize())
     return NS_ERROR_NOT_AVAILABLE;
 
-    NS_ENSURE_ARG_POINTER(aHWND);
+  NS_ENSURE_ARG_POINTER(aHWND);
 
-    if (!::IsWindow((HWND)aHWND)) 
-      return NS_ERROR_INVALID_ARG;
+  if (!::IsWindow((HWND)aHWND)) 
+    return NS_ERROR_INVALID_ARG;
 
-    HRESULT hr = mTaskbar->MarkFullscreenWindow((HWND)aHWND, aFullScreen);
-    if (FAILED(hr)) {
-      return NS_ERROR_UNEXPECTED;
-    }
+  HRESULT hr = mTaskbar->MarkFullscreenWindow((HWND)aHWND, aFullScreen);
+  if (FAILED(hr)) {
+    return NS_ERROR_UNEXPECTED;
+  }
 
-    return NS_OK;
+  return NS_OK;
 }
 
 } // namespace widget

From 9c6e88d2d6459fdecd847a94008faf6b4a4c8d76 Mon Sep 17 00:00:00 2001
From: Ed Morley <bmo@edmorley.co.uk>
Date: Sat, 17 Sep 2011 00:27:55 +0100
Subject: [PATCH 179/209] Backout d4bdab069bbc (bug 630007) for qt build
 bustage and various oranges on other platforms

---
 dom/plugins/base/Makefile.in               |   7 +-
 dom/plugins/base/PluginPRLibrary.cpp       |  32 +-
 dom/plugins/base/PluginPRLibrary.h         |   8 +-
 dom/plugins/base/android/ANPAudio.cpp      | 323 -------
 dom/plugins/base/android/ANPBase.h         |  52 --
 dom/plugins/base/android/ANPBitmap.cpp     |  80 --
 dom/plugins/base/android/ANPCanvas.cpp     | 335 -------
 dom/plugins/base/android/ANPEvent.cpp      |  46 -
 dom/plugins/base/android/ANPKeyCodes.h     | 152 ----
 dom/plugins/base/android/ANPLog.cpp        |  21 -
 dom/plugins/base/android/ANPMatrix.cpp     | 159 ----
 dom/plugins/base/android/ANPPaint.cpp      | 416 ---------
 dom/plugins/base/android/ANPPath.cpp       | 133 ---
 dom/plugins/base/android/ANPSurface.cpp    | 151 ----
 dom/plugins/base/android/ANPSystem.cpp     |  49 --
 dom/plugins/base/android/ANPTypeface.cpp   | 113 ---
 dom/plugins/base/android/ANPWindow.cpp     |  53 --
 dom/plugins/base/android/Makefile.in       |  81 --
 dom/plugins/base/android/android_npapi.h   | 979 ---------------------
 dom/plugins/base/android_npapi.h           |   0
 dom/plugins/base/npfunctions.h             |  13 +-
 dom/plugins/base/nsNPAPIPlugin.cpp         | 125 +--
 dom/plugins/base/nsNPAPIPluginInstance.cpp | 114 +--
 dom/plugins/base/nsNPAPIPluginInstance.h   |  16 -
 dom/plugins/base/nsPluginHost.cpp          |  11 +-
 dom/plugins/base/nsPluginInstanceOwner.cpp | 312 +------
 dom/plugins/base/nsPluginInstanceOwner.h   |   7 +-
 dom/plugins/base/nsPluginsDirUnix.cpp      |  10 -
 embedding/android/AndroidManifest.xml.in   |   7 -
 embedding/android/GeckoApp.java            | 162 +---
 embedding/android/GeckoAppShell.java       | 197 -----
 embedding/android/Makefile.in              |   1 -
 embedding/android/SurfaceLockInfo.java     |  18 -
 layout/build/Makefile.in                   |   1 -
 layout/generic/nsObjectFrame.cpp           |  16 -
 other-licenses/android/APKOpen.cpp         |   2 -
 widget/src/android/AndroidBridge.cpp       |  50 +-
 widget/src/android/AndroidBridge.h         |   8 -
 widget/src/android/AndroidJNI.cpp          |  13 -
 39 files changed, 24 insertions(+), 4249 deletions(-)
 delete mode 100644 dom/plugins/base/android/ANPAudio.cpp
 delete mode 100644 dom/plugins/base/android/ANPBase.h
 delete mode 100644 dom/plugins/base/android/ANPBitmap.cpp
 delete mode 100644 dom/plugins/base/android/ANPCanvas.cpp
 delete mode 100644 dom/plugins/base/android/ANPEvent.cpp
 delete mode 100644 dom/plugins/base/android/ANPKeyCodes.h
 delete mode 100644 dom/plugins/base/android/ANPLog.cpp
 delete mode 100644 dom/plugins/base/android/ANPMatrix.cpp
 delete mode 100644 dom/plugins/base/android/ANPPaint.cpp
 delete mode 100644 dom/plugins/base/android/ANPPath.cpp
 delete mode 100644 dom/plugins/base/android/ANPSurface.cpp
 delete mode 100644 dom/plugins/base/android/ANPSystem.cpp
 delete mode 100644 dom/plugins/base/android/ANPTypeface.cpp
 delete mode 100644 dom/plugins/base/android/ANPWindow.cpp
 delete mode 100644 dom/plugins/base/android/Makefile.in
 delete mode 100644 dom/plugins/base/android/android_npapi.h
 delete mode 100644 dom/plugins/base/android_npapi.h
 delete mode 100644 embedding/android/SurfaceLockInfo.java

diff --git a/dom/plugins/base/Makefile.in b/dom/plugins/base/Makefile.in
index 402fe7765545..4c7a50e0ba0b 100644
--- a/dom/plugins/base/Makefile.in
+++ b/dom/plugins/base/Makefile.in
@@ -99,11 +99,6 @@ CPPSRCS		= \
 		nsPluginInstanceOwner.cpp \
 		$(NULL)
 
-ifeq ($(MOZ_WIDGET_TOOLKIT),android)
-DIRS += android
-LOCAL_INCLUDES += -I$(topsrcdir)/dom/plugins/base/android
-endif
-
 ifeq ($(OS_ARCH),WINNT)
 	CPPSRCS += nsPluginsDirWin.cpp
 	CPPSRCS += nsPluginNativeWindowWin.cpp
@@ -132,7 +127,7 @@ endif
 endif
 endif
 
-LOCAL_INCLUDES += \
+LOCAL_INCLUDES = \
   -I$(topsrcdir)/xpcom/base/ \
   $(MOZ_CAIRO_CFLAGS) \
   $(NULL)
diff --git a/dom/plugins/base/PluginPRLibrary.cpp b/dom/plugins/base/PluginPRLibrary.cpp
index 8fbbb3c345aa..2eeeb53bec11 100644
--- a/dom/plugins/base/PluginPRLibrary.cpp
+++ b/dom/plugins/base/PluginPRLibrary.cpp
@@ -37,6 +37,7 @@
  * ***** END LICENSE BLOCK ***** */
 
 #include "mozilla/PluginPRLibrary.h"
+
 // Some plugins on Windows, notably Quake Live, implement NP_Initialize using
 // cdecl instead of the documented stdcall. In order to work around this,
 // we force the caller to use a frame pointer.
@@ -51,38 +52,9 @@ static int gNotOptimized;
 #define CALLING_CONVENTION_HACK
 #endif
 
-#ifdef ANDROID
-#include "AndroidBridge.h"
-#include "android_npapi.h"
-#include <android/log.h>
-#define ALOG(args...) __android_log_print(ANDROID_LOG_INFO, "GeckoJavaEnv", ## args)
-#endif
-
 namespace mozilla {
-#ifdef ANDROID
-nsresult
-PluginPRLibrary::NP_Initialize(NPNetscapeFuncs* bFuncs,
-			       NPPluginFuncs* pFuncs, NPError* error)
-{
-  if (mNP_Initialize) {
-    *error = mNP_Initialize(bFuncs, pFuncs, GetJNIForThread());
-  } else {
-    NP_InitializeFunc pfNP_Initialize = (NP_InitializeFunc)
-      PR_FindFunctionSymbol(mLibrary, "NP_Initialize");
-    if (!pfNP_Initialize)
-      return NS_ERROR_FAILURE;
-    *error = pfNP_Initialize(bFuncs, pFuncs, GetJNIForThread());
-  }
 
-
-  // Save pointers to functions that get called through PluginLibrary itself.
-  mNPP_New = pFuncs->newp;
-  mNPP_GetValue = pFuncs->getvalue;
-  mNPP_ClearSiteData = pFuncs->clearsitedata;
-  mNPP_GetSitesWithData = pFuncs->getsiteswithdata;
-  return NS_OK;
-}
-#elif defined(XP_UNIX) && !defined(XP_MACOSX)
+#if defined(XP_UNIX) && !defined(XP_MACOSX)
 nsresult
 PluginPRLibrary::NP_Initialize(NPNetscapeFuncs* bFuncs,
 			       NPPluginFuncs* pFuncs, NPError* error)
diff --git a/dom/plugins/base/PluginPRLibrary.h b/dom/plugins/base/PluginPRLibrary.h
index 2dbcb5ec2df1..250d1ac92bb7 100644
--- a/dom/plugins/base/PluginPRLibrary.h
+++ b/dom/plugins/base/PluginPRLibrary.h
@@ -63,11 +63,9 @@ public:
         mNP_GetEntryPoints(nsnull),
 #endif
         mNPP_New(nsnull),
-        mNPP_GetValue(nsnull),
         mNPP_ClearSiteData(nsnull),
         mNPP_GetSitesWithData(nsnull),
-        mLibrary(aLibrary),
-        mFilePath(aFilePath)
+        mLibrary(aLibrary)
     {
         NS_ASSERTION(mLibrary, "need non-null lib");
         // addref here??
@@ -161,8 +159,6 @@ public:
                                     const nsGUIEvent& anEvent, bool* handled);
 #endif
 
-    virtual void GetLibraryPath(nsACString& aPath) { aPath.Assign(mFilePath); }
-
 private:
     NP_InitializeFunc mNP_Initialize;
     NP_ShutdownFunc mNP_Shutdown;
@@ -174,11 +170,9 @@ private:
     NP_GetEntryPointsFunc mNP_GetEntryPoints;
 #endif
     NPP_NewProcPtr mNPP_New;
-    NPP_GetValueProcPtr mNPP_GetValue;
     NPP_ClearSiteDataPtr mNPP_ClearSiteData;
     NPP_GetSitesWithDataPtr mNPP_GetSitesWithData;
     PRLibrary* mLibrary;
-    nsCString mFilePath;
 };
 
 
diff --git a/dom/plugins/base/android/ANPAudio.cpp b/dom/plugins/base/android/ANPAudio.cpp
deleted file mode 100644
index 1a681701533a..000000000000
--- a/dom/plugins/base/android/ANPAudio.cpp
+++ /dev/null
@@ -1,323 +0,0 @@
-#include "base/basictypes.h"
-#include "AndroidBridge.h"
-
-#include <android/log.h>
-#include <stdlib.h>
-#include <time.h>
-
-#include "assert.h"
-#include "ANPBase.h"
-#include "nsIThread.h"
-#include "nsThreadUtils.h"
-
-#define LOG(args...)  __android_log_print(ANDROID_LOG_INFO, "GeckoPluginsAudio" , ## args)
-#define ASSIGN(obj, name)   (obj)->name = anp_audio_##name
-
-/* android.media.AudioTrack */
-struct AudioTrack {
-  jclass    at_class;
-  jmethodID constructor;
-  jmethodID flush;
-  jmethodID pause;
-  jmethodID play;
-  jmethodID setvol;
-  jmethodID stop;
-  jmethodID write;
-  jmethodID getpos;
-};
-
-enum AudioTrackMode {
-  MODE_STATIC = 0,
-  MODE_STREAM = 1
-};
-
-/* android.media.AudioManager */
-enum AudioManagerStream {
-  STREAM_VOICE_CALL = 0,
-  STREAM_SYSTEM = 1,
-  STREAM_RING = 2,
-  STREAM_MUSIC = 3,
-  STREAM_ALARM = 4,
-  STREAM_NOTIFICATION = 5,
-  STREAM_DTMF = 8
-};
-
-/* android.media.AudioFormat */
-enum AudioFormatChannel {
-  CHANNEL_OUT_MONO = 4,
-  CHANNEL_OUT_STEREO = 12
-};
-
-enum AudioFormatEncoding {
-  ENCODING_PCM_16BIT = 2,
-  ENCODING_PCM_8BIT = 3
-};
-
-static struct AudioTrack at;
-
-static jclass
-init_jni_bindings(JNIEnv *jenv) {
-  jclass jc = jenv->FindClass("android/media/AudioTrack");
-
-  at.constructor = jenv->GetMethodID(jc, "<init>", "(IIIIII)V");
-  at.flush       = jenv->GetMethodID(jc, "flush", "()V");
-  at.pause       = jenv->GetMethodID(jc, "pause", "()V");
-  at.play        = jenv->GetMethodID(jc, "play",  "()V");
-  at.setvol      = jenv->GetMethodID(jc, "setStereoVolume",  "(FF)I");
-  at.stop        = jenv->GetMethodID(jc, "stop",  "()V");
-  at.write       = jenv->GetMethodID(jc, "write", "([BII)I");
-  at.getpos      = jenv->GetMethodID(jc, "getPlaybackHeadPosition", "()I");
-
-  return jc;
-}
-
-struct ANPAudioTrack {
-  jobject output_unit;
-  jclass at_class;
-
-  unsigned int rate;
-  unsigned int channels;
-  unsigned int bufferSize;
-  unsigned int isStopped;
-  unsigned int keepGoing;
-
-  void* user;
-  ANPAudioCallbackProc proc;
-  ANPSampleFormat format;
-};
-
-class AudioRunnable : public nsRunnable
-{
-public:
-  NS_DECL_NSIRUNNABLE
-
-  AudioRunnable(ANPAudioTrack* aAudioTrack) {
-    mTrack = aAudioTrack;
-  }
-
-  ANPAudioTrack* mTrack;
-};
-
-NS_IMETHODIMP
-AudioRunnable::Run()
-{
-  JNIEnv* jenv = GetJNIForThread();
-
-  if (jenv->PushLocalFrame(128)) {
-    return NS_ERROR_FAILURE;
-  }
-
-  jbyteArray bytearray = jenv->NewByteArray(mTrack->bufferSize);
-  if (!bytearray) {
-    LOG("AudioRunnable:: Run.  Could not create bytearray");
-    return NS_ERROR_FAILURE;
-  }
-
-  jbyte *byte = jenv->GetByteArrayElements(bytearray, NULL);
-  if (!byte) {
-    LOG("AudioRunnable:: Run.  Could not create bytearray");
-    return NS_ERROR_FAILURE;
-  }
-
-  ANPAudioBuffer buffer;
-  buffer.channelCount = mTrack->channels;
-  buffer.format = mTrack->format;
-  buffer.bufferData = (void*) byte;
-
-  while (mTrack->keepGoing)
-  {
-    // reset the buffer size
-    buffer.size = mTrack->bufferSize;
-
-    // Get data from the plugin
-    mTrack->proc(kMoreData_ANPAudioEvent, mTrack->user, &buffer);
-
-    if (buffer.size == 0) {
-      LOG("%p - kMoreData_ANPAudioEvent", mTrack);
-      continue;
-    }
-
-    size_t wroteSoFar = 0;
-    jint retval;
-    do {
-      retval = jenv->CallIntMethod(mTrack->output_unit,
-                                   at.write,
-                                   bytearray,
-                                   wroteSoFar,
-                                   buffer.size - wroteSoFar);
-      if (retval < 0) {
-        LOG("%p - Write failed %d", mTrack, retval);
-        break;
-      }
-
-      wroteSoFar += retval;
-
-    } while(wroteSoFar < buffer.size);
-  }
-
-  jenv->DeleteGlobalRef(mTrack->output_unit);
-  jenv->DeleteGlobalRef(mTrack->at_class);
-
-  free(mTrack);
-
-  jenv->ReleaseByteArrayElements(bytearray, byte, 0);
-  jenv->PopLocalFrame(NULL);
-
-  return NS_OK;
-}
-
-ANPAudioTrack*
-anp_audio_newTrack(uint32_t sampleRate,    // sampling rate in Hz
-                   ANPSampleFormat format,
-                   int channelCount,       // MONO=1, STEREO=2
-                   ANPAudioCallbackProc proc,
-                   void* user)
-{
-  ANPAudioTrack *s = (ANPAudioTrack*) malloc(sizeof(ANPAudioTrack));
-  if (s == NULL) {
-    return NULL;
-  }
-
-  JNIEnv *jenv = GetJNIForThread();
-  if (!jenv)
-    return NULL;
-
-  s->at_class = init_jni_bindings(jenv);
-  s->rate = sampleRate;
-  s->channels = channelCount;
-  s->bufferSize = s->rate * s->channels;
-  s->isStopped = true;
-  s->keepGoing = false;
-  s->user = user;
-  s->proc = proc;
-  s->format = format;
-
-  int jformat;
-  switch (format) {
-  case kPCM16Bit_ANPSampleFormat:
-    jformat = ENCODING_PCM_16BIT;
-    break;
-  case kPCM8Bit_ANPSampleFormat:
-    jformat = ENCODING_PCM_8BIT;
-    break;
-  default:
-    LOG("Unknown audio format.  defaulting to 16bit.");
-    jformat = ENCODING_PCM_16BIT;
-    break;
-  }
-
-  int jChannels;
-  switch (channelCount) {
-  case 1:
-    jChannels = CHANNEL_OUT_MONO;
-    break;
-  case 2:
-    jChannels = CHANNEL_OUT_STEREO;
-    break;
-  default:
-    LOG("Unknown channel count.  defaulting to mono.");
-    jChannels = CHANNEL_OUT_MONO;
-    break;
-  }
-
-  jobject obj = jenv->NewObject(s->at_class,
-                                at.constructor,
-                                STREAM_MUSIC,
-                                s->rate,
-                                jChannels,
-                                jformat,
-                                s->bufferSize,
-                                MODE_STREAM);
-
-  jthrowable exception = jenv->ExceptionOccurred();
-  if (exception) {
-    LOG("%s fAILED  ", __PRETTY_FUNCTION__);
-    jenv->ExceptionDescribe();
-    jenv->ExceptionClear();
-    jenv->DeleteGlobalRef(s->at_class);
-    free(s);
-    return NULL;
-  }
-
-  s->output_unit = jenv->NewGlobalRef(obj);
-  return s;
-}
-
-void
-anp_audio_deleteTrack(ANPAudioTrack* s)
-{
-  if (s == NULL) {
-    return;
-  }
-
-  s->keepGoing = false;
-
-  // deallocation happens in the AudioThread.  There is a
-  // potential leak if anp_audio_start is never called, but
-  // we do not see that from flash.
-}
-
-void
-anp_audio_start(ANPAudioTrack* s)
-{
-  if (s == NULL || s->output_unit == NULL) {
-    return;
-  }
-  
-  if (s->keepGoing) {
-    // we are already playing.  Ignore.
-    LOG("anp_audio_start called twice!");
-    return;
-  }
-
-  JNIEnv *jenv = GetJNIForThread();
-  jenv->CallVoidMethod(s->output_unit, at.play);
-
-  s->isStopped = false;
-  s->keepGoing = true;
-
-  // AudioRunnable now owns the ANPAudioTrack
-  nsRefPtr<AudioRunnable> runnable = new AudioRunnable(s);
-
-  nsCOMPtr<nsIThread> thread;
-  NS_NewThread(getter_AddRefs(thread), runnable);
-}
-
-void
-anp_audio_pause(ANPAudioTrack* s)
-{
-  if (s == NULL || s->output_unit == NULL) {
-    return;
-  }
-
-  JNIEnv *jenv = GetJNIForThread();
-  jenv->CallVoidMethod(s->output_unit, at.pause);
-}
-
-void
-anp_audio_stop(ANPAudioTrack* s)
-{
-  if (s == NULL || s->output_unit == NULL) {
-    return;
-  }
-
-  s->isStopped = true;
-  JNIEnv *jenv = GetJNIForThread();
-  jenv->CallVoidMethod(s->output_unit, at.stop);
-}
-
-bool
-anp_audio_isStopped(ANPAudioTrack* s)
-{
-  return s->isStopped;
-}
-
-void InitAudioTrackInterface(ANPAudioTrackInterfaceV0 *i) {
-  _assert(i->inSize == sizeof(*i));
-  ASSIGN(i, newTrack);
-  ASSIGN(i, deleteTrack);
-  ASSIGN(i, start);
-  ASSIGN(i, pause);
-  ASSIGN(i, stop);
-  ASSIGN(i, isStopped);
-}
diff --git a/dom/plugins/base/android/ANPBase.h b/dom/plugins/base/android/ANPBase.h
deleted file mode 100644
index 5fcbf596ca1f..000000000000
--- a/dom/plugins/base/android/ANPBase.h
+++ /dev/null
@@ -1,52 +0,0 @@
-#include "android_npapi.h"
-#include <stdlib.h>
-#include "nsAutoPtr.h"
-#include "gfxFont.h"
-
-#define NOT_IMPLEMENTED_FATAL() do {                                    \
-    __android_log_print(ANDROID_LOG_ERROR, "GeckoPlugins",              \
-                        "%s not implemented %s, %d",                    \
-                        __PRETTY_FUNCTION__, __FILE__, __LINE__);       \
-    abort();                                                            \
-  } while(0)
-
-#define NOT_IMPLEMENTED()                                               \
-    __android_log_print(ANDROID_LOG_ERROR, "GeckoPlugins",              \
-                        "!!!!!!!!!!!!!!  %s not implemented %s, %d",    \
-                        __PRETTY_FUNCTION__, __FILE__, __LINE__);       \
-
-class gfxFont;
-
-void InitAudioTrackInterface(ANPAudioTrackInterfaceV0 *i);
-void InitBitmapInterface(ANPBitmapInterfaceV0 *i);
-void InitCanvasInterface(ANPCanvasInterfaceV0 *i);
-void InitEventInterface(ANPEventInterfaceV0 *i);
-void InitLogInterface(ANPLogInterfaceV0 *i);
-void InitMatrixInterface(ANPMatrixInterfaceV0 *i);
-void InitPaintInterface(ANPPaintInterfaceV0 *i);
-void InitPathInterface(ANPPathInterfaceV0 *i);
-void InitSurfaceInterface(ANPSurfaceInterfaceV0 *i);
-void InitSystemInterface(ANPSystemInterfaceV0 *i);
-void InitTypeFaceInterface(ANPTypefaceInterfaceV0 *i);
-void InitWindowInterface(ANPWindowInterfaceV0 *i);
-
-struct ANPTypeface {
-  nsRefPtr<gfxFont> mFont;
-};
-
-
-typedef struct {
-  ANPMatrixFlag flags;
-  ANPColor color;
-  ANPPaintStyle style;
-  float strokeWidth;
-  float strokeMiter;
-  ANPPaintCap paintCap;
-  ANPPaintJoin paintJoin;
-  ANPTextEncoding textEncoding;
-  ANPPaintAlign paintAlign;
-  float textSize;
-  float textScaleX;
-  float textSkewX;
-  ANPTypeface typeface;
-} ANPPaintPrivate;
diff --git a/dom/plugins/base/android/ANPBitmap.cpp b/dom/plugins/base/android/ANPBitmap.cpp
deleted file mode 100644
index f06143dfc53f..000000000000
--- a/dom/plugins/base/android/ANPBitmap.cpp
+++ /dev/null
@@ -1,80 +0,0 @@
-#include "assert.h"
-#include "ANPBase.h"
-#include <android/log.h>
-
-#define LOG(args...)  __android_log_print(ANDROID_LOG_INFO, "GeckoPlugins" , ## args)
-#define ASSIGN(obj, name)   (obj)->name = anp_bitmap_##name
-
-
-#define SK_A32_BITS     8
-#define SK_R32_BITS     8
-#define SK_G32_BITS     8
-#define SK_B32_BITS     8
-
-#ifdef IS_BIG_ENDIAN
-#define SK_R32_SHIFT    24
-#define SK_G32_SHIFT    16
-#define SK_B32_SHIFT    8
-#define SK_A32_SHIFT    0
-#else
-#define SK_R32_SHIFT    0
-#define SK_G32_SHIFT    8
-#define SK_B32_SHIFT    16
-#define SK_A32_SHIFT    24
-#endif
-
-#define SK_A32_MASK     ((1 << SK_A32_BITS) - 1)
-#define SK_R32_MASK     ((1 << SK_R32_BITS) - 1)
-#define SK_G32_MASK     ((1 << SK_G32_BITS) - 1)
-#define SK_B32_MASK     ((1 << SK_B32_BITS) - 1)
-
-#define SK_R16_BITS     5
-#define SK_G16_BITS     6
-#define SK_B16_BITS     5
-
-#define SK_R16_SHIFT    (SK_B16_BITS + SK_G16_BITS)
-#define SK_G16_SHIFT    (SK_B16_BITS)
-#define SK_B16_SHIFT    0
-
-#define SK_R16_MASK     ((1 << SK_R16_BITS) - 1)
-#define SK_G16_MASK     ((1 << SK_G16_BITS) - 1)
-#define SK_B16_MASK     ((1 << SK_B16_BITS) - 1)
-
-bool
-anp_bitmap_getPixelPacking(ANPBitmapFormat fmt, ANPPixelPacking* packing) {
-  LOG("%s", __PRETTY_FUNCTION__);
-  switch (fmt) {
-    case kRGBA_8888_ANPBitmapFormat:
-      if (packing) {
-        packing->AShift = SK_A32_SHIFT;
-        packing->ABits  = SK_A32_BITS;
-        packing->RShift = SK_R32_SHIFT;
-        packing->RBits  = SK_R32_BITS;
-        packing->GShift = SK_G32_SHIFT;
-        packing->GBits  = SK_G32_BITS;
-        packing->BShift = SK_B32_SHIFT;
-        packing->BBits  = SK_B32_BITS;
-      }
-      return true;
-    case kRGB_565_ANPBitmapFormat:
-      if (packing) {
-        packing->AShift = 0;
-        packing->ABits  = 0;
-        packing->RShift = SK_R16_SHIFT;
-        packing->RBits  = SK_R16_BITS;
-        packing->GShift = SK_G16_SHIFT;
-        packing->GBits  = SK_G16_BITS;
-        packing->BShift = SK_B16_SHIFT;
-        packing->BBits  = SK_B16_BITS;
-      }
-      return true;
-  default:
-    break;
-  }
-  return false;
-}
-
-void InitBitmapInterface(ANPBitmapInterfaceV0 *i) {
-  _assert(i->inSize == sizeof(*i));
-  ASSIGN(i, getPixelPacking);
-}
diff --git a/dom/plugins/base/android/ANPCanvas.cpp b/dom/plugins/base/android/ANPCanvas.cpp
deleted file mode 100644
index fafac968685d..000000000000
--- a/dom/plugins/base/android/ANPCanvas.cpp
+++ /dev/null
@@ -1,335 +0,0 @@
-#include "assert.h"
-#include "ANPBase.h"
-#include <android/log.h>
-
-#include "cairo.h"
-#include "gfxPlatform.h"
-#include "gfxASurface.h"
-#include "gfxImageSurface.h"
-#include "gfxUtils.h"
-#include "gfxContext.h"
-
-#define LOG(args...)  __android_log_print(ANDROID_LOG_INFO, "GeckoPlugins" , ## args)
-#define ASSIGN(obj, name)   (obj)->name = anp_canvas_##name
-
-
-ANPCanvas*
-anp_canvas_newCanvas(const ANPBitmap* bitmap)
-{
-  PRUint32 stride;
-  gfxASurface::gfxImageFormat  format;
-
-  if (bitmap->format == ANPBitmapFormats::kRGBA_8888_ANPBitmapFormat) {
-    stride = bitmap->width * 4;
-    format = gfxImageSurface::ImageFormatARGB32;
-  }
-  else if (bitmap->format == ANPBitmapFormats::kRGB_565_ANPBitmapFormat) {
-    stride = bitmap->width * 2;
-    format = gfxImageSurface::ImageFormatRGB16_565;
-  }
-  else {
-    LOG("%s -- Unknown format", __PRETTY_FUNCTION__);
-    return nsnull;
-  }
-
-  gfxImageSurface* pluginSurface = new gfxImageSurface(static_cast<unsigned char*>(bitmap->baseAddr),
-                                                       gfxIntSize(bitmap->width,  bitmap->height), 
-                                                       stride,
-                                                       format);
-  if (pluginSurface->CairoStatus()) {
-    LOG("%s -- %d x %d FAILED to create gfxImageSurface", __PRETTY_FUNCTION__, bitmap->width, bitmap->height);
-    return nsnull;
-  }
-
-  gfxContext *pluginContext = new gfxContext(pluginSurface);
-  NS_ADDREF(pluginContext);
-  return (ANPCanvas*) pluginContext;
-}
-
-void
-anp_canvas_deleteCanvas(ANPCanvas* canvas)
-{
-  if (!canvas)
-    return;
-  gfxContext *ctx = (gfxContext*)canvas;
-  NS_RELEASE( ctx );
-}
-
-void
-anp_canvas_save(ANPCanvas* canvas)
-{
-  if (!canvas)
-    return;
-
-  gfxContext* ctx = (gfxContext*)canvas;
-  ctx->Save();
-}
-
-void
-anp_canvas_restore(ANPCanvas* canvas)
-{
-  if (!canvas)
-    return;
-
-  gfxContext* ctx = (gfxContext*)canvas;
-  ctx->Restore();
-}
-
-void
-anp_canvas_translate(ANPCanvas* canvas, float tx, float ty)
-{
-  if (!canvas)
-    return;
-
-  gfxContext* ctx = (gfxContext*)canvas;
-  ctx->Translate(gfxPoint(tx,ty));
-}
-
-void
-anp_canvas_scale(ANPCanvas* canvas, float sx, float sy)
-{
-  if (!canvas)
-    return;
-
-  gfxContext* ctx = (gfxContext*)canvas;
-  ctx->Scale(sx, sy);
-}
-
-void
-anp_canvas_rotate(ANPCanvas* canvas, float degrees)
-{
-  if (!canvas)
-    return;
-
-  gfxContext* ctx = (gfxContext*)canvas;
-  ctx->Rotate(degrees);
-}
-
-void
-anp_canvas_skew(ANPCanvas* canvas, float kx, float ky)
-{
-  if (!canvas)
-    return;
-
-  gfxContext* ctx = (gfxContext*)canvas;
-  LOG("%s is not impl.", __PRETTY_FUNCTION__);
-}
-
-void
-anp_canvas_concat(ANPCanvas* canvas, const ANPMatrix*)
-{
-  if (!canvas)
-    return;
-
-  gfxContext* ctx = (gfxContext*)canvas;
-  LOG("%s is not impl.", __PRETTY_FUNCTION__);
-}
-
-void
-anp_canvas_clipRect(ANPCanvas* canvas, const ANPRectF* r)
-{
-  if (!canvas)
-    return;
-
-  gfxContext* ctx = (gfxContext*)canvas;
-  ctx->Clip(gfxRect(r->left,
-                    r->top,
-                    r->right - r->left,
-                    r->bottom - r->top));
-}
-
-void
-anp_canvas_clipPath(ANPCanvas* canvas, const ANPPath*)
-{
-  if (!canvas)
-    return;
-
-  gfxContext* ctx = (gfxContext*)canvas;
-  LOG("%s is not impl.", __PRETTY_FUNCTION__);
-}
-
-void
-anp_canvas_getTotalMatrix(ANPCanvas* canvas, ANPMatrix*)
-{
-  if (!canvas)
-    return;
-
-  gfxContext* ctx = (gfxContext*)canvas;
-  LOG("%s is not impl.", __PRETTY_FUNCTION__);
-}
-
-bool
-anp_canvas_getLocalClipBounds(ANPCanvas* canvas, ANPRectF* bounds, bool aa)
-{
-  if (!canvas)
-    return false;
-
-  gfxContext* ctx = (gfxContext*)canvas;
-  LOG("%s is not impl.", __PRETTY_FUNCTION__);
-  return false;
-}
-
-bool
-anp_canvas_getDeviceClipBounds(ANPCanvas* canvas, ANPRectI* bounds)
-{
-  if (!canvas)
-    return false;
-
-  gfxContext* ctx = (gfxContext*)canvas;
-  LOG("%s is not impl.", __PRETTY_FUNCTION__);
-  return false;
-}
-
-void
-anp_canvas_drawColor(ANPCanvas* canvas, ANPColor c)
-{
-  if (!canvas)
-    return;
-
-  gfxContext* ctx = (gfxContext*)canvas;
-  ctx->SetDeviceColor(gfxRGBA(c, gfxRGBA::PACKED_ARGB));
-  LOG("returning from %s", __PRETTY_FUNCTION__);
-}
-
-void
-anp_canvas_drawPaint(ANPCanvas* canvas, const ANPPaint* paint)
-{
-  if (!canvas)
-    return;
-
-  gfxContext* ctx = (gfxContext*)canvas;
-  LOG("%s", "                    **************   NOT IMPLEMENTED!!!");
-}
-
-void
-anp_canvas_drawLine(ANPCanvas* canvas, float x0, float y0, float x1, float y1,
-                    const ANPPaint* paint)
-{
-  if (!canvas)
-    return;
-
-  gfxContext* ctx = (gfxContext*)canvas;
-  ctx->NewPath();
-  ctx->SetColor(((ANPPaintPrivate*)paint)->color);
-  ctx->Line(gfxPoint(x0, y0), gfxPoint(x1, y1));
-  ctx->Fill();
-}
-
-void
-anp_canvas_drawRect(ANPCanvas* canvas, const ANPRectF* r, const ANPPaint* paint)
-{
-  if (!canvas)
-    return;
-
-  gfxContext* ctx = (gfxContext*)canvas;
-
-  ctx->NewPath();
-  ctx->SetColor(((ANPPaintPrivate*)paint)->color);
-  ctx->Rectangle(gfxRect(r->left,
-                         r->top,
-                         r->right - r->left,
-                         r->bottom - r->top));
-  ctx->Fill();
-}
-
-void
-anp_canvas_drawOval(ANPCanvas* canvas, const ANPRectF* r, const ANPPaint* paint)
-{
-  if (!canvas)
-    return;
-
-  gfxContext* ctx = (gfxContext*)canvas;
-   
-  ctx->NewPath();
-  ctx->SetColor(((ANPPaintPrivate*)paint)->color);
-
-  float sizeX = (r->right   - r->left);
-  float sizeY = (r->bottom  - r->top);
-
-  ctx->Ellipse(gfxPoint(r->left + ( sizeX / 2), r->top  + ( sizeY  / 2)),
-               gfxSize(sizeX, sizeY));
-  ctx->Fill();
-}
-
-void
-anp_canvas_drawPath(ANPCanvas* canvas, const ANPPath*, const ANPPaint* paint)
-{
-  if (!canvas)
-    return;
-
-  gfxContext* ctx = (gfxContext*)canvas;
-  LOG("%s is not impl.", __PRETTY_FUNCTION__);
-}
-
-void
-anp_canvas_drawText(ANPCanvas* canvas, const void* text, uint32_t byteLength,
-                                float x, float y, const ANPPaint* paint)
-{
-  if (!canvas)
-    return;
-
-  gfxContext* ctx = (gfxContext*)canvas;
-  LOG("%s is not impl.", __PRETTY_FUNCTION__);
-}
-
-void
-anp_canvas_drawPosText(ANPCanvas* canvas, const void* text, uint32_t byteLength,
-                       const float xy[], const ANPPaint* paint)
-{
-  if (!canvas)
-    return;
-
-  gfxContext* ctx = (gfxContext*)canvas;
-  LOG("%s is not impl.", __PRETTY_FUNCTION__);
-}
-
-void
-anp_canvas_drawBitmap(ANPCanvas* canvas, const ANPBitmap*, float x, float y,
-                      const ANPPaint* paint)
-{
-  if (!canvas)
-    return;
-
-  gfxContext* ctx = (gfxContext*)canvas;
-  LOG("%s is not impl.", __PRETTY_FUNCTION__);
-}
-
-void
-anp_canvas_drawBitmapRect(ANPCanvas* canvas, const ANPBitmap*,
-                          const ANPRectI* src, const ANPRectF* dst,
-                          const ANPPaint* paint)
-{
-  if (!canvas)
-    return;
-
-  gfxContext* ctx = (gfxContext*)canvas;
-  LOG("%s is not impl.", __PRETTY_FUNCTION__);
-}
-
-void InitCanvasInterface(ANPCanvasInterfaceV0 *i) {
-  _assert(i->inSize == sizeof(*i));
-  ASSIGN(i, newCanvas);
-  ASSIGN(i, deleteCanvas);
-  ASSIGN(i, save);
-  ASSIGN(i, restore);
-  ASSIGN(i, translate);
-  ASSIGN(i, scale);
-  ASSIGN(i, rotate);
-  ASSIGN(i, skew);
-  ASSIGN(i, concat);
-  ASSIGN(i, clipRect);
-  ASSIGN(i, clipPath);
-  ASSIGN(i, getTotalMatrix);
-  ASSIGN(i, getLocalClipBounds);
-  ASSIGN(i, getDeviceClipBounds);
-  ASSIGN(i, drawColor);
-  ASSIGN(i, drawPaint);
-  ASSIGN(i, drawLine);
-  ASSIGN(i, drawRect);
-  ASSIGN(i, drawOval);
-  ASSIGN(i, drawPath);
-  ASSIGN(i, drawText);
-  ASSIGN(i, drawPosText);
-  ASSIGN(i, drawBitmap);
-  ASSIGN(i, drawBitmapRect);
-}
diff --git a/dom/plugins/base/android/ANPEvent.cpp b/dom/plugins/base/android/ANPEvent.cpp
deleted file mode 100644
index 05ff0c946740..000000000000
--- a/dom/plugins/base/android/ANPEvent.cpp
+++ /dev/null
@@ -1,46 +0,0 @@
-#include "assert.h"
-#include "ANPBase.h"
-#include <android/log.h>
-#include "nsThreadUtils.h"
-#include "nsNPAPIPluginInstance.h"
-#include "AndroidBridge.h"
-#include "nsNPAPIPlugin.h"
-
-#define LOG(args...)  __android_log_print(ANDROID_LOG_INFO, "GeckoPlugins" , ## args)
-#define ASSIGN(obj, name)   (obj)->name = anp_event_##name
-
-class PluginEventRunnable : public nsRunnable
-{
-public:
-  PluginEventRunnable(NPP inst, ANPEvent* event, NPPluginFuncs* aFuncs)
-    : mInstance(inst), mEvent(*event), mFuncs(aFuncs) {}
-  virtual nsresult Run() {
-    (*mFuncs->event)(mInstance, &mEvent);
-    return NS_OK;
-  }
-private:
-  NPP mInstance;
-  ANPEvent mEvent;
-  NPPluginFuncs* mFuncs;
-};
-
-void
-anp_event_postEvent(NPP inst, const ANPEvent* event)
-{
-  LOG("%s", __PRETTY_FUNCTION__);
-  if (!mozilla::AndroidBridge::Bridge()) {
-    LOG("no bridge in %s!!!!", __PRETTY_FUNCTION__);
-    return;
-  }
-  nsNPAPIPluginInstance* pinst = static_cast<nsNPAPIPluginInstance*>(inst->ndata);
-  NPPluginFuncs* pluginFunctions = pinst->GetPlugin()->PluginFuncs();
-  mozilla::AndroidBridge::Bridge()->PostToJavaThread(
-    new PluginEventRunnable(inst, const_cast<ANPEvent*>(event), pluginFunctions), PR_TRUE);
-  LOG("returning from %s", __PRETTY_FUNCTION__);
-}
-
-
-void InitEventInterface(ANPEventInterfaceV0 *i) {
-  _assert(i->inSize == sizeof(*i));
-  ASSIGN(i, postEvent);
-}
diff --git a/dom/plugins/base/android/ANPKeyCodes.h b/dom/plugins/base/android/ANPKeyCodes.h
deleted file mode 100644
index edfe2b95cdba..000000000000
--- a/dom/plugins/base/android/ANPKeyCodes.h
+++ /dev/null
@@ -1,152 +0,0 @@
-/*
- * Copyright 2008, The Android Open Source Project
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- *  * Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- *  * Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- *
- * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS ``AS IS'' AND ANY
- * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
- * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE COPYRIGHT OWNER OR
- * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
- * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
- * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
- * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
- * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
- * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
- * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
- */
-
-#ifndef ANPKeyCodes_DEFINED
-#define ANPKeyCodes_DEFINED
-
-/*  List the key codes that are set to a plugin in the ANPKeyEvent.
- 
-    These exactly match the values in android/view/KeyEvent.java and the
-    corresponding .h file android/keycodes.h.
-*/
-enum ANPKeyCodes {
-    kUnknown_ANPKeyCode = 0,
-
-    kSoftLeft_ANPKeyCode = 1,
-    kSoftRight_ANPKeyCode = 2,
-    kHome_ANPKeyCode = 3,
-    kBack_ANPKeyCode = 4,
-    kCall_ANPKeyCode = 5,
-    kEndCall_ANPKeyCode = 6,
-    k0_ANPKeyCode = 7,
-    k1_ANPKeyCode = 8,
-    k2_ANPKeyCode = 9,
-    k3_ANPKeyCode = 10,
-    k4_ANPKeyCode = 11,
-    k5_ANPKeyCode = 12,
-    k6_ANPKeyCode = 13,
-    k7_ANPKeyCode = 14,
-    k8_ANPKeyCode = 15,
-    k9_ANPKeyCode = 16,
-    kStar_ANPKeyCode = 17,
-    kPound_ANPKeyCode = 18,
-    kDpadUp_ANPKeyCode = 19,
-    kDpadDown_ANPKeyCode = 20,
-    kDpadLeft_ANPKeyCode = 21,
-    kDpadRight_ANPKeyCode = 22,
-    kDpadCenter_ANPKeyCode = 23,
-    kVolumeUp_ANPKeyCode = 24,
-    kVolumeDown_ANPKeyCode = 25,
-    kPower_ANPKeyCode = 26,
-    kCamera_ANPKeyCode = 27,
-    kClear_ANPKeyCode = 28,
-    kA_ANPKeyCode = 29,
-    kB_ANPKeyCode = 30,
-    kC_ANPKeyCode = 31,
-    kD_ANPKeyCode = 32,
-    kE_ANPKeyCode = 33,
-    kF_ANPKeyCode = 34,
-    kG_ANPKeyCode = 35,
-    kH_ANPKeyCode = 36,
-    kI_ANPKeyCode = 37,
-    kJ_ANPKeyCode = 38,
-    kK_ANPKeyCode = 39,
-    kL_ANPKeyCode = 40,
-    kM_ANPKeyCode = 41,
-    kN_ANPKeyCode = 42,
-    kO_ANPKeyCode = 43,
-    kP_ANPKeyCode = 44,
-    kQ_ANPKeyCode = 45,
-    kR_ANPKeyCode = 46,
-    kS_ANPKeyCode = 47,
-    kT_ANPKeyCode = 48,
-    kU_ANPKeyCode = 49,
-    kV_ANPKeyCode = 50,
-    kW_ANPKeyCode = 51,
-    kX_ANPKeyCode = 52,
-    kY_ANPKeyCode = 53,
-    kZ_ANPKeyCode = 54,
-    kComma_ANPKeyCode = 55,
-    kPeriod_ANPKeyCode = 56,
-    kAltLeft_ANPKeyCode = 57,
-    kAltRight_ANPKeyCode = 58,
-    kShiftLeft_ANPKeyCode = 59,
-    kShiftRight_ANPKeyCode = 60,
-    kTab_ANPKeyCode = 61,
-    kSpace_ANPKeyCode = 62,
-    kSym_ANPKeyCode = 63,
-    kExplorer_ANPKeyCode = 64,
-    kEnvelope_ANPKeyCode = 65,
-    kNewline_ANPKeyCode = 66,
-    kDel_ANPKeyCode = 67,
-    kGrave_ANPKeyCode = 68,
-    kMinus_ANPKeyCode = 69,
-    kEquals_ANPKeyCode = 70,
-    kLeftBracket_ANPKeyCode = 71,
-    kRightBracket_ANPKeyCode = 72,
-    kBackslash_ANPKeyCode = 73,
-    kSemicolon_ANPKeyCode = 74,
-    kApostrophe_ANPKeyCode = 75,
-    kSlash_ANPKeyCode = 76,
-    kAt_ANPKeyCode = 77,
-    kNum_ANPKeyCode = 78,
-    kHeadSetHook_ANPKeyCode = 79,
-    kFocus_ANPKeyCode = 80,
-    kPlus_ANPKeyCode = 81,
-    kMenu_ANPKeyCode = 82,
-    kNotification_ANPKeyCode = 83,
-    kSearch_ANPKeyCode = 84,
-    kMediaPlayPause_ANPKeyCode = 85,
-    kMediaStop_ANPKeyCode = 86,
-    kMediaNext_ANPKeyCode = 87,
-    kMediaPrevious_ANPKeyCode = 88,
-    kMediaRewind_ANPKeyCode = 89,
-    kMediaFastForward_ANPKeyCode = 90,
-    kMute_ANPKeyCode = 91,
-    kPageUp_ANPKeyCode = 92,
-    kPageDown_ANPKeyCode = 93,
-    kPictsymbols_ANPKeyCode = 94,
-    kSwitchCharset_ANPKeyCode = 95,
-    kButtonA_ANPKeyCode = 96,
-    kButtonB_ANPKeyCode = 97,
-    kButtonC_ANPKeyCode = 98,
-    kButtonX_ANPKeyCode = 99,
-    kButtonY_ANPKeyCode = 100,
-    kButtonZ_ANPKeyCode = 101,
-    kButtonL1_ANPKeyCode = 102,
-    kButtonR1_ANPKeyCode = 103,
-    kButtonL2_ANPKeyCode = 104,
-    kButtonR2_ANPKeyCode = 105,
-    kButtonThumbL_ANPKeyCode = 106,
-    kButtonThumbR_ANPKeyCode = 107,
-    kButtonStart_ANPKeyCode = 108,
-    kButtonSelect_ANPKeyCode = 109,
-    kButtonMode_ANPKeyCode = 110,
-
-    // NOTE: If you add a new keycode here you must also add it to several other files.
-    //       Refer to frameworks/base/core/java/android/view/KeyEvent.java for the full list.
-};
-
-#endif
diff --git a/dom/plugins/base/android/ANPLog.cpp b/dom/plugins/base/android/ANPLog.cpp
deleted file mode 100644
index 8ae222d7e5a2..000000000000
--- a/dom/plugins/base/android/ANPLog.cpp
+++ /dev/null
@@ -1,21 +0,0 @@
-#include "assert.h"
-#include "ANPBase.h"
-#include <android/log.h>
-
-#define LOG(args...)  __android_log_print(ANDROID_LOG_INFO, "GeckoPlugins" , ## args)
-#define ASSIGN(obj, name)   (obj)->name = anp_log_##name
-
-void
-anp_log_log(ANPLogType type, const char format[], ...) {
-
-  va_list argp;
-  va_start(argp,format);
-  __android_log_vprint(type == kError_ANPLogType ? ANDROID_LOG_ERROR : type == kWarning_ANPLogType ?
-                       ANDROID_LOG_WARN : ANDROID_LOG_INFO, "GeckoPluginLog", format, argp);
-  va_end(argp);
-}
-
-void InitLogInterface(ANPLogInterfaceV0 *i) {
-      _assert(i->inSize == sizeof(*i));
-      ASSIGN(i, log);
-}
diff --git a/dom/plugins/base/android/ANPMatrix.cpp b/dom/plugins/base/android/ANPMatrix.cpp
deleted file mode 100644
index f278911dea36..000000000000
--- a/dom/plugins/base/android/ANPMatrix.cpp
+++ /dev/null
@@ -1,159 +0,0 @@
-#include "assert.h"
-#include "ANPBase.h"
-#include <android/log.h>
-
-#define LOG(args...)  __android_log_print(ANDROID_LOG_INFO, "GeckoPlugins" , ## args)
-#define ASSIGN(obj, name)   (obj)->name = anp_matrix_##name
-
-/** Return a new identity matrix
- */
-ANPMatrix*
-anp_matrix_newMatrix()
-{
-  NOT_IMPLEMENTED();
-  return 0;
-}
-
-/** Delete a matrix previously allocated by newMatrix()
- */
-void
-anp_matrix_deleteMatrix(ANPMatrix*)
-{
-  NOT_IMPLEMENTED();
-}
-
-
-ANPMatrixFlag
-anp_matrix_getFlags(const ANPMatrix*)
-{
-  NOT_IMPLEMENTED();
-  return 0;
-}
-
-
-void
-anp_matrix_copy(ANPMatrix* dst, const ANPMatrix* src)
-{
-  NOT_IMPLEMENTED();
-}
-
-
-void
-anp_matrix_get3x3(const ANPMatrix*, float[9])
-{
-  NOT_IMPLEMENTED();
-}
-
-void
-anp_matrix_set3x3(ANPMatrix*, const float[9])
-{
-  NOT_IMPLEMENTED();
-}
-
-
-void
-anp_matrix_setIdentity(ANPMatrix*)
-{
-  NOT_IMPLEMENTED();
-}
-
-void
-anp_matrix_preTranslate(ANPMatrix*, float tx, float ty)
-{
-  NOT_IMPLEMENTED();
-}
-
-void
-anp_matrix_postTranslate(ANPMatrix*, float tx, float ty)
-{
-  NOT_IMPLEMENTED();
-}
-
-void
-anp_matrix_preScale(ANPMatrix*, float sx, float sy)
-{
-  NOT_IMPLEMENTED();
-}
-
-void
-anp_matrix_postScale(ANPMatrix*, float sx, float sy)
-{
-  NOT_IMPLEMENTED();
-}
-
-void
-anp_matrix_preSkew(ANPMatrix*, float kx, float ky)
-{
-  NOT_IMPLEMENTED();
-}
-
-void
-anp_matrix_postSkew(ANPMatrix*, float kx, float ky)
-{
-  NOT_IMPLEMENTED();
-}
-
-void
-anp_matrix_preRotate(ANPMatrix*, float degrees)
-{
-  NOT_IMPLEMENTED();
-}
-
-void
-anp_matrix_postRotate(ANPMatrix*, float degrees)
-{
-  NOT_IMPLEMENTED();
-}
-
-void
-anp_matrix_preConcat(ANPMatrix*, const ANPMatrix*)
-{
-  NOT_IMPLEMENTED();
-}
-
-void
-anp_matrix_postConcat(ANPMatrix*, const ANPMatrix*)
-{
-  NOT_IMPLEMENTED();
-}
-
-
-bool
-anp_matrix_invert(ANPMatrix* dst, const ANPMatrix* src)
-{
-  NOT_IMPLEMENTED();
-  return false;
-}
-
-void
-anp_matrix_mapPoints(ANPMatrix*, float dst[], const float src[],
-                                 int32_t count)
-{
-  NOT_IMPLEMENTED();
-}
-
-
-void InitMatrixInterface(ANPMatrixInterfaceV0 *i) {
-  _assert(i->inSize == sizeof(*i));
-  ASSIGN(i, newMatrix);
-  ASSIGN(i, deleteMatrix);
-  ASSIGN(i, getFlags);
-  ASSIGN(i, copy);
-  ASSIGN(i, get3x3);
-  ASSIGN(i, set3x3);
-  ASSIGN(i, setIdentity);
-  ASSIGN(i, preTranslate);
-  ASSIGN(i, postTranslate);
-  ASSIGN(i, preScale);
-  ASSIGN(i, postScale);
-  ASSIGN(i, preSkew);
-  ASSIGN(i, postSkew);
-  ASSIGN(i, preRotate);
-  ASSIGN(i, postRotate);
-  ASSIGN(i, preConcat);
-  ASSIGN(i, postConcat);
-  ASSIGN(i, invert);
-  ASSIGN(i, mapPoints);
-}
-
-
diff --git a/dom/plugins/base/android/ANPPaint.cpp b/dom/plugins/base/android/ANPPaint.cpp
deleted file mode 100644
index 30e4f9ffe90b..000000000000
--- a/dom/plugins/base/android/ANPPaint.cpp
+++ /dev/null
@@ -1,416 +0,0 @@
-#include <stdlib.h>
-#include <assert.h>
-#include <android/log.h>
-#include "ANPBase.h"
-
-#define LOG(args...)  
-//__android_log_print(ANDROID_LOG_INFO, "GeckoPlugins" , ## args)
-#define ASSIGN(obj, name)   (obj)->name = anp_paint_##name
-
-ANPPaint*
-anp_paint_newPaint()
-{
-  LOG("%s", __PRETTY_FUNCTION__);
-
-  ANPPaintPrivate* p = (ANPPaintPrivate*) calloc(1, sizeof(ANPPaintPrivate));
-  return (ANPPaint*) p;
-}
-
-void
-anp_paint_deletePaint(ANPPaint* paint)
-{
-  LOG("%s", __PRETTY_FUNCTION__);
-  if (!paint)
-    return;
-
-  ANPPaintPrivate* p = (ANPPaintPrivate*) paint;
-  free((void*)p);
-}
-
-
-ANPPaintFlags
-anp_paint_getFlags(const ANPPaint* paint)
-{
-  LOG("%s", __PRETTY_FUNCTION__);
-  if (!paint)
-    return kAntiAlias_ANPPaintFlag;
-
-  ANPPaintPrivate* p = (ANPPaintPrivate*) paint;
-  return p->flags;
-}
-
-void
-anp_paint_setFlags(ANPPaint* paint, ANPPaintFlags flags)
-{
-  LOG("%s", __PRETTY_FUNCTION__);
-  if (!paint)
-    return;
-
-  ANPPaintPrivate* p = (ANPPaintPrivate*) paint;  
-  p->flags = flags;
-}
-
-
-ANPColor
-anp_paint_getColor(const ANPPaint* paint)
-{
-  LOG("%s", __PRETTY_FUNCTION__);
-  if (!paint)
-    return ANP_MAKE_COLOR(1, 255, 255, 255);
-
-  ANPPaintPrivate* p = (ANPPaintPrivate*) paint;
-  return p->color;
-}
-
-void
-anp_paint_setColor(ANPPaint* paint, ANPColor color)
-{
-  LOG("%s", __PRETTY_FUNCTION__);
-  if (!paint)
-    return;
-
-  ANPPaintPrivate* p = (ANPPaintPrivate*) paint;
-  p->color = color;
-}
-
-
-ANPPaintStyle
-anp_paint_getStyle(const ANPPaint* paint)
-{
-  LOG("%s", __PRETTY_FUNCTION__);
-  if (!paint)
-    return kFill_ANPPaintStyle;
-
-  ANPPaintPrivate* p = (ANPPaintPrivate*) paint;
-  return p->style;
-}
-
-void
-anp_paint_setStyle(ANPPaint* paint, ANPPaintStyle style)
-{
-  LOG("%s", __PRETTY_FUNCTION__);
-  if (!paint)
-    return;
-
-  ANPPaintPrivate* p = (ANPPaintPrivate*) paint;
-  p->style = style;
-}
-
-float
-anp_paint_getStrokeWidth(const ANPPaint* paint)
-{
-  LOG("%s", __PRETTY_FUNCTION__);
-  if (!paint)
-    return 0;
-
-  ANPPaintPrivate* p = (ANPPaintPrivate*) paint;
-  return p->strokeWidth;
-}
-
-float
-anp_paint_getStrokeMiter(const ANPPaint* paint)
-{
-  LOG("%s", __PRETTY_FUNCTION__);
-  if (!paint)
-    return 0;
-
-  ANPPaintPrivate* p = (ANPPaintPrivate*) paint;
-  return p->strokeMiter;
-}
-
-ANPPaintCap
-anp_paint_getStrokeCap(const ANPPaint* paint)
-{
-  LOG("%s", __PRETTY_FUNCTION__);
-  if (!paint)
-    return kButt_ANPPaintCap;
-
-  ANPPaintPrivate* p = (ANPPaintPrivate*) paint;
-  return p->paintCap;
-}
-
-ANPPaintJoin
-anp_paint_getStrokeJoin(const ANPPaint* paint)
-{
-  LOG("%s", __PRETTY_FUNCTION__);
-  if (!paint)
-    return kMiter_ANPPaintJoin;
-
-  ANPPaintPrivate* p = (ANPPaintPrivate*) paint;
-  return p->paintJoin;
-}
-
-void
-anp_paint_setStrokeWidth(ANPPaint* paint, float width)
-{
-  LOG("%s", __PRETTY_FUNCTION__);
-  if (!paint)
-    return;
-
-  ANPPaintPrivate* p = (ANPPaintPrivate*) paint;
-  p->strokeWidth = width;
-}
-
-void
-anp_paint_setStrokeMiter(ANPPaint* paint, float miter)
-{
-  LOG("%s", __PRETTY_FUNCTION__);
-  if (!paint)
-    return;
-
-  ANPPaintPrivate* p = (ANPPaintPrivate*) paint;
-  p->strokeMiter = miter;
-}
-
-void
-anp_paint_setStrokeCap(ANPPaint* paint, ANPPaintCap cap)
-{
-  LOG("%s", __PRETTY_FUNCTION__);
-  if (!paint)
-    return;
-
-  ANPPaintPrivate* p = (ANPPaintPrivate*) paint;
-  p->paintCap = cap;
-}
-
-void
-anp_paint_setStrokeJoin(ANPPaint* paint, ANPPaintJoin join)
-{
-  LOG("%s", __PRETTY_FUNCTION__);
-  if (!paint)
-    return;
-
-  ANPPaintPrivate* p = (ANPPaintPrivate*) paint;
-  p->paintJoin = join;
-}
-
-
-ANPTextEncoding
-anp_paint_getTextEncoding(const ANPPaint* paint)
-{
-  LOG("%s", __PRETTY_FUNCTION__);
-  if (!paint)
-    return kUTF8_ANPTextEncoding;
-
-  ANPPaintPrivate* p = (ANPPaintPrivate*) paint;
-  return p->textEncoding;
-}
-
-ANPPaintAlign
-anp_paint_getTextAlign(const ANPPaint* paint)
-{
-  LOG("%s", __PRETTY_FUNCTION__);
-  if (!paint)
-    return kLeft_ANPPaintAlign;
-
-  ANPPaintPrivate* p = (ANPPaintPrivate*) paint;
-  return p->paintAlign;
-}
-
-float
-anp_paint_getTextSize(const ANPPaint* paint)
-{
-  LOG("%s", __PRETTY_FUNCTION__);
-  if (!paint)
-    return 0;
-
-  ANPPaintPrivate* p = (ANPPaintPrivate*) paint;
-  return p->textSize;
-}
-
-float
-anp_paint_getTextScaleX(const ANPPaint* paint)
-{
-  LOG("%s", __PRETTY_FUNCTION__);
-  if (!paint)
-    return 0;
-
-  ANPPaintPrivate* p = (ANPPaintPrivate*) paint;
-  return p->textScaleX;
-}
-
-float
-anp_paint_getTextSkewX(const ANPPaint* paint)
-{
-  LOG("%s", __PRETTY_FUNCTION__);
-  if (!paint)
-    return 0;
-
-  ANPPaintPrivate* p = (ANPPaintPrivate*) paint;
-  return p->textSkewX;
-}
-
-void
-anp_paint_setTextEncoding(ANPPaint* paint, ANPTextEncoding encoding)
-{
-  LOG("%s", __PRETTY_FUNCTION__);
-  if (!paint)
-    return;
-
-  ANPPaintPrivate* p = (ANPPaintPrivate*) paint;
-  p->textEncoding = encoding;
-}
-
-void
-anp_paint_setTextAlign(ANPPaint* paint, ANPPaintAlign align)
-{
-  LOG("%s", __PRETTY_FUNCTION__);
-  if (!paint)
-    return;
-
-  ANPPaintPrivate* p = (ANPPaintPrivate*) paint;
-  p->paintAlign = align;  
-}
-
-void
-anp_paint_setTextSize(ANPPaint* paint, float size)
-{
-  LOG("%s", __PRETTY_FUNCTION__);
-  if (!paint)
-    return;
-
-  ANPPaintPrivate* p = (ANPPaintPrivate*) paint;
-  p->textSize = size;
-}
-
-void
-anp_paint_setTextScaleX(ANPPaint* paint, float scale)
-{
-  LOG("%s", __PRETTY_FUNCTION__);
-  if (!paint)
-    return;
-
-  ANPPaintPrivate* p = (ANPPaintPrivate*) paint;
-  p->textScaleX = scale;
-}
-
-void
-anp_paint_setTextSkewX(ANPPaint* paint, float skew)
-{
-  LOG("%s", __PRETTY_FUNCTION__);
-  if (!paint)
-    return;
-
-  ANPPaintPrivate* p = (ANPPaintPrivate*) paint;
-  p->textSkewX = skew;
-}
-
-
-/** Return the typeface in paint, or null if there is none. This does not
-    modify the owner count of the returned typeface.
-*/
-ANPTypeface*
-anp_paint_getTypeface(const ANPPaint* paint)
-{
-  LOG("%s", __PRETTY_FUNCTION__);
-  if (!paint)
-    return NULL;
-
-  ANPPaintPrivate* p = (ANPPaintPrivate*) paint;
-  return &p->typeface;
-}
-
-
-/** Set the paint's typeface. If the paint already had a non-null typeface,
-    its owner count is decremented. If the new typeface is non-null, its
-    owner count is incremented.
-*/
-void
-anp_paint_setTypeface(ANPPaint* paint, ANPTypeface* typeface)
-{
-  LOG("%s", __PRETTY_FUNCTION__);
-  if (!paint)
-    return;
-
-  ANPPaintPrivate* p = (ANPPaintPrivate*) paint;
-  LOG("%s is not impl.", __PRETTY_FUNCTION__);
-}
-
-/** Return the width of the text. If bounds is not null, return the bounds
-    of the text in that rectangle.
-*/
-float
-anp_paint_measureText(ANPPaint* paint, const void* text, uint32_t byteLength,
-                      ANPRectF* bounds)
-{
-  LOG("%s", __PRETTY_FUNCTION__);
-  if (!paint)
-    return 0;
-
-  ANPPaintPrivate* p = (ANPPaintPrivate*) paint;
-
-  LOG("%s is not impl.", __PRETTY_FUNCTION__);
-  return 0;
-}
-
-
-/** Return the number of unichars specifed by the text.
-    If widths is not null, returns the array of advance widths for each
-    unichar.
-    If bounds is not null, returns the array of bounds for each unichar.
-*/
-int
-anp_paint_getTextWidths(ANPPaint* paint, const void* text, uint32_t byteLength,
-                        float widths[], ANPRectF bounds[])
-{
-  LOG("%s", __PRETTY_FUNCTION__);
-  if (!paint)
-    return 0;
-
-  ANPPaintPrivate* p = (ANPPaintPrivate*) paint;
-  LOG("%s is not impl.", __PRETTY_FUNCTION__);
-  return 0;
-}
-
-
-/** Return in metrics the spacing values for text, respecting the paint's
-    typeface and pointsize, and return the spacing between lines
-    (descent - ascent + leading). If metrics is NULL, it will be ignored.
-*/
-float
-anp_paint_getFontMetrics(ANPPaint* paint, ANPFontMetrics* metrics)
-{
-  LOG("%s", __PRETTY_FUNCTION__);
-  if (!paint)
-    return 0;
-
-  ANPPaintPrivate* p = (ANPPaintPrivate*) paint;
-  LOG("%s is not impl.", __PRETTY_FUNCTION__);
-  return 0;
-}
-
-
-void InitPaintInterface(ANPPaintInterfaceV0 *i) {
-  _assert(i->inSize == sizeof(*i));
-  ASSIGN(i, newPaint);
-  ASSIGN(i, deletePaint);
-  ASSIGN(i, getFlags);
-  ASSIGN(i, setFlags);
-  ASSIGN(i, getColor);
-  ASSIGN(i, setColor);
-  ASSIGN(i, getStyle);
-  ASSIGN(i, setStyle);
-  ASSIGN(i, getStrokeWidth);
-  ASSIGN(i, getStrokeMiter);
-  ASSIGN(i, getStrokeCap);
-  ASSIGN(i, getStrokeJoin);
-  ASSIGN(i, setStrokeWidth);
-  ASSIGN(i, setStrokeMiter);
-  ASSIGN(i, setStrokeCap);
-  ASSIGN(i, setStrokeJoin);
-  ASSIGN(i, getTextEncoding);
-  ASSIGN(i, getTextAlign);
-  ASSIGN(i, getTextSize);
-  ASSIGN(i, getTextScaleX);
-  ASSIGN(i, getTextSkewX);
-  ASSIGN(i, setTextEncoding);
-  ASSIGN(i, setTextAlign);
-  ASSIGN(i, setTextSize);
-  ASSIGN(i, setTextScaleX);
-  ASSIGN(i, setTextSkewX);
-  ASSIGN(i, getTypeface);
-  ASSIGN(i, setTypeface);
-  ASSIGN(i, measureText);
-  ASSIGN(i, getTextWidths);
-  ASSIGN(i, getFontMetrics);
-}
diff --git a/dom/plugins/base/android/ANPPath.cpp b/dom/plugins/base/android/ANPPath.cpp
deleted file mode 100644
index 1ea17b2e97bb..000000000000
--- a/dom/plugins/base/android/ANPPath.cpp
+++ /dev/null
@@ -1,133 +0,0 @@
-#include "assert.h"
-#include "ANPBase.h"
-#include <android/log.h>
-
-#define LOG(args...)  __android_log_print(ANDROID_LOG_INFO, "GeckoPlugins" , ## args)
-#define ASSIGN(obj, name)   (obj)->name = anp_path_##name
-
-
-// maybe this should store a list of actions (lineTo,
-// moveTo), and when canvas_drawPath() we apply all of these
-// actions to the gfxContext.
-
-ANPPath*
-anp_path_newPath()
-{
-  LOG("%s - NOT IMPL.", __PRETTY_FUNCTION__);
-  return 0;
-}
-
-
-void
-anp_path_deletePath(ANPPath* p)
-{
-  LOG("%s - NOT IMPL.", __PRETTY_FUNCTION__);
-}
-
-
-void
-anp_path_copy(ANPPath* dst, const ANPPath* src)
-{
-  LOG("%s - NOT IMPL.", __PRETTY_FUNCTION__);
-}
-
-
-bool
-anp_path_equal(const ANPPath* path0, const ANPPath* path1)
-{
-  LOG("%s - NOT IMPL.", __PRETTY_FUNCTION__);
-  return false;
-}
-
-
-void
-anp_path_reset(ANPPath* p)
-{
-  LOG("%s - NOT IMPL.", __PRETTY_FUNCTION__);
-}
-
-
-bool
-anp_path_isEmpty(const ANPPath* p)
-{
-  LOG("%s - NOT IMPL.", __PRETTY_FUNCTION__);
-  return false;
-}
-
-
-void
-anp_path_getBounds(const ANPPath* p, ANPRectF* bounds)
-{
-  LOG("%s - NOT IMPL.", __PRETTY_FUNCTION__);
-
-  bounds->left = 0;
-  bounds->top = 0;
-  bounds->right = 1000;
-  bounds->left = 1000;
-}
-
-
-void
-anp_path_moveTo(ANPPath* p, float x, float y)
-{
-  LOG("%s - NOT IMPL.", __PRETTY_FUNCTION__);
-}
-
-void
-anp_path_lineTo(ANPPath* p, float x, float y)
-{
-  LOG("%s - NOT IMPL.", __PRETTY_FUNCTION__);
-}
-
-void
-anp_path_quadTo(ANPPath* p, float x0, float y0, float x1, float y1)
-{
-  LOG("%s - NOT IMPL.", __PRETTY_FUNCTION__);
-}
-
-void
-anp_path_cubicTo(ANPPath* p, float x0, float y0, float x1, float y1,
-                      float x2, float y2)
-{
-  LOG("%s - NOT IMPL.", __PRETTY_FUNCTION__);
-}
-
-void
-anp_path_close(ANPPath* p)
-{
-  LOG("%s - NOT IMPL.", __PRETTY_FUNCTION__);
-}
-
-
-void
-anp_path_offset(ANPPath* src, float dx, float dy, ANPPath* dst)
-{
-  LOG("%s - NOT IMPL.", __PRETTY_FUNCTION__);
-}
-
-
-void
-anp_path_transform(ANPPath* src, const ANPMatrix*, ANPPath* dst)
-{
-  LOG("%s - NOT IMPL.", __PRETTY_FUNCTION__);
-}
-
-
-
-void InitPathInterface(ANPPathInterfaceV0 *i) {
-  _assert(i->inSize == sizeof(*i));
-  ASSIGN(i, newPath);
-  ASSIGN(i, deletePath);
-  ASSIGN(i, copy);
-  ASSIGN(i, equal);
-  ASSIGN(i, reset);
-  ASSIGN(i, isEmpty);
-  ASSIGN(i, getBounds);
-  ASSIGN(i, moveTo);
-  ASSIGN(i, lineTo);
-  ASSIGN(i, quadTo);
-  ASSIGN(i, cubicTo);
-  ASSIGN(i, close);
-  ASSIGN(i, offset);
-  ASSIGN(i, transform);
-}
diff --git a/dom/plugins/base/android/ANPSurface.cpp b/dom/plugins/base/android/ANPSurface.cpp
deleted file mode 100644
index 91400af1f2db..000000000000
--- a/dom/plugins/base/android/ANPSurface.cpp
+++ /dev/null
@@ -1,151 +0,0 @@
-#include "assert.h"
-#include "ANPBase.h"
-#include <android/log.h>
-#include "AndroidBridge.h"
-#include "gfxImageSurface.h"
-#include "gfxContext.h"
-
-#define LOG(args...)  __android_log_print(ANDROID_LOG_INFO, "GeckoPlugins" , ## args)
-#define ASSIGN(obj, name)   (obj)->name = anp_surface_##name
-
-
-// used to cache JNI method and field IDs for Surface Objects
-static struct ANPSurfaceInterfaceJavaGlue {
-  bool        initialized;
-  jclass geckoAppShellClass;
-  jclass lockInfoCls;
-  jmethodID lockSurfaceANP;
-  jmethodID jUnlockSurfaceANP;
-  jfieldID jDirtyTop;
-  jfieldID jDirtyLeft;
-  jfieldID jDirtyBottom;
-  jfieldID jDirtyRight;
-  jfieldID jFormat;
-  jfieldID jWidth ;
-  jfieldID jHeight;
-  jfieldID jBuffer;
-} gSurfaceJavaGlue;
-
-#define getClassGlobalRef(env, cname)                                    \
-     (jClass = jclass(env->NewGlobalRef(env->FindClass(cname))))
-
-static void init(JNIEnv* env) {
-  if (gSurfaceJavaGlue.initialized)
-    return;
-  
-  gSurfaceJavaGlue.geckoAppShellClass = mozilla::AndroidBridge::GetGeckoAppShellClass();
-  
-  jmethodID getClass = env->GetStaticMethodID(gSurfaceJavaGlue.geckoAppShellClass, 
-                                              "getSurfaceLockInfoClass",
-                                              "()Ljava/lang/Class;");
-
-  gSurfaceJavaGlue.lockInfoCls = (jclass) env->NewGlobalRef(env->CallStaticObjectMethod(gSurfaceJavaGlue.geckoAppShellClass, getClass));
-
-  gSurfaceJavaGlue.jDirtyTop = env->GetFieldID(gSurfaceJavaGlue.lockInfoCls, "dirtyTop", "I");
-  gSurfaceJavaGlue.jDirtyLeft = env->GetFieldID(gSurfaceJavaGlue.lockInfoCls, "dirtyLeft", "I");
-  gSurfaceJavaGlue.jDirtyBottom = env->GetFieldID(gSurfaceJavaGlue.lockInfoCls, "dirtyBottom", "I");
-  gSurfaceJavaGlue.jDirtyRight = env->GetFieldID(gSurfaceJavaGlue.lockInfoCls, "dirtyRight", "I");
-
-  gSurfaceJavaGlue.jFormat = env->GetFieldID(gSurfaceJavaGlue.lockInfoCls, "format", "I");
-  gSurfaceJavaGlue.jWidth = env->GetFieldID(gSurfaceJavaGlue.lockInfoCls, "width", "I");
-  gSurfaceJavaGlue.jHeight = env->GetFieldID(gSurfaceJavaGlue.lockInfoCls, "height", "I");
-
-  gSurfaceJavaGlue.jBuffer = env->GetFieldID(gSurfaceJavaGlue.lockInfoCls, "buffer", "Ljava/nio/Buffer;");
-  gSurfaceJavaGlue.lockSurfaceANP = env->GetStaticMethodID(gSurfaceJavaGlue.geckoAppShellClass, "lockSurfaceANP", "(Landroid/view/SurfaceView;IIII)Lorg/mozilla/gecko/SurfaceLockInfo;");
-  gSurfaceJavaGlue.jUnlockSurfaceANP = env->GetStaticMethodID(gSurfaceJavaGlue.geckoAppShellClass, "unlockSurfaceANP", "(Landroid/view/SurfaceView;)V");
-  gSurfaceJavaGlue.initialized = true;
-}
-
-static bool anp_lock(JNIEnv* env, jobject surfaceView, ANPBitmap* bitmap, ANPRectI* dirtyRect) {
-  LOG("%s", __PRETTY_FUNCTION__);
-  if (!bitmap || !surfaceView) {
-    LOG("%s, null bitmap or surface, exiting", __PRETTY_FUNCTION__);
-    return false;
-  }
-
-  init(env);
-
-  jvalue args[5];
-  args[0].l = surfaceView;
-  if (dirtyRect) {
-    args[1].i = dirtyRect->top;
-    args[2].i = dirtyRect->left;
-    args[3].i = dirtyRect->bottom;
-    args[4].i = dirtyRect->right;
-    LOG("dirty rect: %d, %d, %d, %d", dirtyRect->top, dirtyRect->left, dirtyRect->bottom, dirtyRect->right);
-  } else {
-    args[1].i = args[2].i = args[3].i = args[4].i = 0;
-  }
-  
-  jobject info = env->CallStaticObjectMethod(gSurfaceJavaGlue.geckoAppShellClass,
-                                             gSurfaceJavaGlue.lockSurfaceANP, 
-                                             surfaceView, args[1].i, args[2].i, args[3].i, args[4].i);
-
-  LOG("info: %p", info);
-  if (!info)
-    return false;
-
-  // the surface may have expanded the dirty region so we must to pass that
-  // information back to the plugin.
-  if (dirtyRect) {
-    dirtyRect->left   = env->GetIntField(info, gSurfaceJavaGlue.jDirtyLeft);
-    dirtyRect->right  = env->GetIntField(info, gSurfaceJavaGlue.jDirtyRight);
-    dirtyRect->top    = env->GetIntField(info, gSurfaceJavaGlue.jDirtyTop);
-    dirtyRect->bottom = env->GetIntField(info, gSurfaceJavaGlue.jDirtyBottom);
-    LOG("dirty rect: %d, %d, %d, %d", dirtyRect->top, dirtyRect->left, dirtyRect->bottom, dirtyRect->right);
-  }
-
-  bitmap->width  = env->GetIntField(info, gSurfaceJavaGlue.jWidth);
-  bitmap->height = env->GetIntField(info, gSurfaceJavaGlue.jHeight);
-
-  int format = env->GetIntField(info, gSurfaceJavaGlue.jFormat);
-
-  // format is PixelFormat
-  if (format & 0x00000001) {
-    bitmap->format = kRGBA_8888_ANPBitmapFormat;
-    bitmap->rowBytes = bitmap->width * 4;
-  }
-  else if (format & 0x00000004) {
-    bitmap->format = kRGB_565_ANPBitmapFormat;
-    bitmap->rowBytes = bitmap->width * 2;
-  }
-  else {
-    LOG("format from glue is unknown %d\n", format);
-    return false;
-  }
-
-  jobject buf = env->GetObjectField(info, gSurfaceJavaGlue.jBuffer);
-  bitmap->baseAddr = env->GetDirectBufferAddress(buf);
-  
-  LOG("format: %d, width: %d, height: %d",  bitmap->format,  bitmap->width,  bitmap->height);
-  env->DeleteLocalRef(info);
-  env->DeleteLocalRef(buf);
-  return ( bitmap->width > 0 && bitmap->height > 0 );
-}
-
-static void anp_unlock(JNIEnv* env, jobject surfaceView) {
-  LOG("%s", __PRETTY_FUNCTION__);
-
-  if (!surfaceView) {
-    LOG("null surface, exiting %s", __PRETTY_FUNCTION__);
-    return;
-  }
-
-  init(env);
-  env->CallStaticVoidMethod(gSurfaceJavaGlue.geckoAppShellClass, gSurfaceJavaGlue.jUnlockSurfaceANP, surfaceView);
-  LOG("returning from %s", __PRETTY_FUNCTION__);
-
-}
-
-///////////////////////////////////////////////////////////////////////////////
-
-#define ASSIGN(obj, name)   (obj)->name = anp_##name
-
-void InitSurfaceInterface(ANPSurfaceInterfaceV0 *i) {
-
-  ASSIGN(i, lock);
-  ASSIGN(i, unlock);
-
-  // setup the java glue struct
-  gSurfaceJavaGlue.initialized = false;
-}
diff --git a/dom/plugins/base/android/ANPSystem.cpp b/dom/plugins/base/android/ANPSystem.cpp
deleted file mode 100644
index ccca3eaed348..000000000000
--- a/dom/plugins/base/android/ANPSystem.cpp
+++ /dev/null
@@ -1,49 +0,0 @@
-#include "base/basictypes.h"
-
-
-#include "assert.h"
-#include "ANPBase.h"
-#include <android/log.h>
-#include "nsNPAPIPluginInstance.h"
-#include "AndroidBridge.h"
-#include "nsNPAPIPlugin.h"
-#include "PluginPRLibrary.h"
-
-#define LOG(args...)  __android_log_print(ANDROID_LOG_INFO, "GeckoPlugins" , ## args)
-#define ASSIGN(obj, name)   (obj)->name = anp_system_##name
-
-const char*
-anp_system_getApplicationDataDirectory()
-{
-  LOG("getApplicationDataDirectory return /data/data/org.mozilla.%s", MOZ_APP_NAME);
-  return "/data/data/org.mozilla." MOZ_APP_NAME;
-}
-
-jclass anp_system_loadJavaClass(NPP instance, const char* className)
-{
-  LOG("%s", __PRETTY_FUNCTION__);
-
-  JNIEnv* env = GetJNIForThread();
-  jclass cls = env->FindClass("org/mozilla/gecko/GeckoAppShell");
-  jmethodID method = env->GetStaticMethodID(cls,
-                                            "loadPluginClass",
-                                            "(Ljava/lang/String;Ljava/lang/String;)Ljava/lang/Class;");
-
-  // pass libname and classname, gotta create java strings
-  nsNPAPIPluginInstance* pinst = static_cast<nsNPAPIPluginInstance*>(instance->ndata);
-  mozilla::PluginPRLibrary* lib = static_cast<mozilla::PluginPRLibrary*>(pinst->GetPlugin()->GetLibrary());
-
-  nsCString libName;
-  lib->GetLibraryPath(libName);
-
-  jstring jclassName = env->NewStringUTF(className);
-  jstring jlibName = env->NewStringUTF(libName.get());
-  jobject obj = env->CallStaticObjectMethod(cls, method, jclassName, jlibName);
-  return reinterpret_cast<jclass>(obj);
-}
-
-void InitSystemInterface(ANPSystemInterfaceV0 *i) {
-  _assert(i->inSize == sizeof(*i));
-  ASSIGN(i, getApplicationDataDirectory);
-  ASSIGN(i, loadJavaClass);
-}
diff --git a/dom/plugins/base/android/ANPTypeface.cpp b/dom/plugins/base/android/ANPTypeface.cpp
deleted file mode 100644
index a3cf75a88d4b..000000000000
--- a/dom/plugins/base/android/ANPTypeface.cpp
+++ /dev/null
@@ -1,113 +0,0 @@
-#include "assert.h"
-#include "ANPBase.h"
-#include <android/log.h>
-#include "gfxAndroidPlatform.h"
-
-#define LOG(args...)  __android_log_print(ANDROID_LOG_INFO, "GeckoPlugins" , ## args)
-#define ASSIGN(obj, name)   (obj)->name = anp_typeface_##name
-
-ANPTypeface*
-anp_typeface_createFromName(const char name[], ANPTypefaceStyle aStyle)
-{
-  LOG("%s - %s\n", __PRETTY_FUNCTION__, name);
-
-  gfxFontStyle style (aStyle == kItalic_ANPTypefaceStyle ? FONT_STYLE_ITALIC :
-                      FONT_STYLE_NORMAL,
-                      NS_FONT_STRETCH_NORMAL,
-                      aStyle == kBold_ANPTypefaceStyle ? 700 : 400,
-                      16.0,
-                      NS_NewPermanentAtom(NS_LITERAL_STRING("en")),
-                      0.0,
-                      PR_FALSE, PR_FALSE,
-                      NS_LITERAL_STRING(""),
-                      NS_LITERAL_STRING(""));
-  ANPTypeface* tf = new ANPTypeface;
-  gfxAndroidPlatform * p = (gfxAndroidPlatform*)gfxPlatform::GetPlatform();
-  tf->mFont = gfxFT2Font::GetOrMakeFont(NS_ConvertASCIItoUTF16(name), &style);
-  return tf;
-}
-
-ANPTypeface*
-anp_typeface_createFromTypeface(const ANPTypeface* family,
-                                ANPTypefaceStyle)
-{
-  NOT_IMPLEMENTED();
-  return 0;
-}
-
-int32_t
-anp_typeface_getRefCount(const ANPTypeface*)
-{
-  NOT_IMPLEMENTED();
-  return 0;
-}
-
-void
-anp_typeface_ref(ANPTypeface* tf)
-{
-  LOG("%s\n", __PRETTY_FUNCTION__);
-  if (tf->mFont)
-    tf->mFont->AddRef();
-
-}
-
-void
-anp_typeface_unref(ANPTypeface* tf)
-{
-  LOG("%s\n", __PRETTY_FUNCTION__);
-  if (tf->mFont)
-    tf->mFont->Release();
-}
-
-ANPTypefaceStyle
-anp_typeface_getStyle(const ANPTypeface* ft)
-{
-  LOG("%s\n", __PRETTY_FUNCTION__);
-  return kBold_ANPTypefaceStyle;
-}
-
-int32_t
-anp_typeface_getFontPath(const ANPTypeface*, char path[], int32_t length,
-                         int32_t* index)
-{
-  NOT_IMPLEMENTED();
-  return 0;
-}
-
-static const char* gFontDir;
-#define FONT_DIR_SUFFIX     "/fonts/"
-
-const char*
-anp_typeface_getFontDirectoryPath()
-{
-  LOG("%s\n", __PRETTY_FUNCTION__);
-  if (NULL == gFontDir) {
-    const char* root = getenv("ANDROID_ROOT");
-    size_t len = strlen(root);
-    char* storage = (char*)malloc(len + sizeof(FONT_DIR_SUFFIX));
-    if (NULL == storage) {
-      return NULL;
-    }
-    memcpy(storage, root, len);
-    memcpy(storage + len, FONT_DIR_SUFFIX, sizeof(FONT_DIR_SUFFIX));
-    // save this assignment for last, so that if multiple threads call us
-    // (which should never happen), we never return an incomplete global.
-    // At worst, we would allocate storage for the path twice.
-    gFontDir = storage;
-  }
-
-  return 0;
-}
-
-void InitTypeFaceInterface(ANPTypefaceInterfaceV0 *i) {
-  _assert(i->inSize == sizeof(*i));
-  ASSIGN(i, createFromName);
-  ASSIGN(i, createFromTypeface);
-  ASSIGN(i, getRefCount);
-  ASSIGN(i, ref);
-  ASSIGN(i, unref);
-  ASSIGN(i, getStyle);
-  ASSIGN(i, getFontPath);
-  ASSIGN(i, getFontDirectoryPath);
-}
-
diff --git a/dom/plugins/base/android/ANPWindow.cpp b/dom/plugins/base/android/ANPWindow.cpp
deleted file mode 100644
index 64ab95dc31f5..000000000000
--- a/dom/plugins/base/android/ANPWindow.cpp
+++ /dev/null
@@ -1,53 +0,0 @@
-#include "assert.h"
-#include "ANPBase.h"
-#include <android/log.h>
-
-#define LOG(args...)  __android_log_print(ANDROID_LOG_INFO, "GeckoPlugins" , ## args)
-#define ASSIGN(obj, name)   (obj)->name = anp_window_##name
-
-void
-anp_window_setVisibleRects(NPP instance, const ANPRectI rects[], int32_t count)
-{
-  NOT_IMPLEMENTED();
-}
-
-void
-anp_window_clearVisibleRects(NPP instance)
-{
-  NOT_IMPLEMENTED();
-}
-
-void
-anp_window_showKeyboard(NPP instance, bool value)
-{
-  NOT_IMPLEMENTED();
-}
-
-void
-anp_window_requestFullScreen(NPP instance)
-{
-  NOT_IMPLEMENTED();
-}
-
-void
-anp_window_exitFullScreen(NPP instance)
-{
-  NOT_IMPLEMENTED();
-}
-
-void
-anp_window_requestCenterFitZoom(NPP instance)
-{
-  NOT_IMPLEMENTED();
-}
-
-void InitWindowInterface(ANPWindowInterfaceV0 *i) {
-  _assert(i->inSize == sizeof(*i));
-  ASSIGN(i, setVisibleRects);
-  ASSIGN(i, clearVisibleRects);
-  ASSIGN(i, showKeyboard);
-  ASSIGN(i, requestFullScreen);
-  ASSIGN(i, exitFullScreen);
-  ASSIGN(i, requestCenterFitZoom);
-}
-
diff --git a/dom/plugins/base/android/Makefile.in b/dom/plugins/base/android/Makefile.in
deleted file mode 100644
index 42e5067f3aed..000000000000
--- a/dom/plugins/base/android/Makefile.in
+++ /dev/null
@@ -1,81 +0,0 @@
-#
-# ***** BEGIN LICENSE BLOCK *****
-# Version: MPL 1.1/GPL 2.0/LGPL 2.1
-#
-# The contents of this file are subject to the Mozilla Public License Version
-# 1.1 (the "License"); you may not use this file except in compliance with
-# the License. You may obtain a copy of the License at
-# http://www.mozilla.org/MPL/
-#
-# Software distributed under the License is distributed on an "AS IS" basis,
-# WITHOUT WARRANTY OF ANY KIND, either express or implied. See the License
-# for the specific language governing rights and limitations under the
-# License.
-#
-# The Original Code is mozilla.org code.
-#
-# The Initial Developer of the Original Code is
-# Netscape Communications Corporation.
-# Portions created by the Initial Developer are Copyright (C) 1998
-# the Initial Developer. All Rights Reserved.
-#
-# Contributor(s):
-#
-# Alternatively, the contents of this file may be used under the terms of
-# either the GNU General Public License Version 2 or later (the "GPL"), or
-# the GNU Lesser General Public License Version 2.1 or later (the "LGPL"),
-# in which case the provisions of the GPL or the LGPL are applicable instead
-# of those above. If you wish to allow use of your version of this file only
-# under the terms of either the GPL or the LGPL, and not to allow others to
-# use your version of this file under the terms of the MPL, indicate your
-# decision by deleting the provisions above and replace them with the notice
-# and other provisions required by the GPL or the LGPL. If you do not delete
-# the provisions above, a recipient may use your version of this file under
-# the terms of any one of the MPL, the GPL or the LGPL.
-#
-# ***** END LICENSE BLOCK *****
-
-DEPTH		= ../../../..
-topsrcdir	= @top_srcdir@
-srcdir		= @srcdir@
-VPATH		= @srcdir@
-
-include $(DEPTH)/config/autoconf.mk
-
-MODULE		= plugin
-LIBRARY_NAME	= gkpluginandroid_s
-
-LIBXUL_LIBRARY   = 1
-FORCE_STATIC_LIB = 1
-EXPORT_LIBRARY = 1
-
-include $(topsrcdir)/config/config.mk
-include $(topsrcdir)/ipc/chromium/chromium-config.mk
-
-EXPORTS = \
-  android_npapi.h \
-  $(NULL)
-
-CPPSRCS += ANPAudio.cpp    \
-           ANPCanvas.cpp   \
-           ANPEvent.cpp    \
-           ANPMatrix.cpp   \
-           ANPPath.cpp     \
-           ANPSystem.cpp   \
-           ANPWindow.cpp   \
-           ANPBitmap.cpp   \
-           ANPLog.cpp      \
-           ANPPaint.cpp    \
-           ANPSurface.cpp  \
-           ANPTypeface.cpp \
-           $(NULL)
-
-LOCAL_INCLUDES += \
-  -I$(topsrcdir)/dom/plugins/base \
-  $(MOZ_CAIRO_CFLAGS) \
-  $(NULL)
-
-DEFINES += -DMOZ_APP_NAME='"$(MOZ_APP_NAME)"'
-
-include $(topsrcdir)/config/rules.mk
-
diff --git a/dom/plugins/base/android/android_npapi.h b/dom/plugins/base/android/android_npapi.h
deleted file mode 100644
index 27b0c0c9fab3..000000000000
--- a/dom/plugins/base/android/android_npapi.h
+++ /dev/null
@@ -1,979 +0,0 @@
-/*
- * Copyright 2009, The Android Open Source Project
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- *  * Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- *  * Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- *
- * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS ``AS IS'' AND ANY
- * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
- * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE COPYRIGHT OWNER OR
- * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
- * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
- * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
- * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
- * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
- * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
- * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
- */
-
-/*  Defines the android-specific types and functions as part of npapi
-
-    In particular, defines the window and event types that are passed to
-    NPN_GetValue, NPP_SetWindow and NPP_HandleEvent.
-
-    To minimize what native libraries the plugin links against, some
-    functionality is provided via function-ptrs (e.g. time, sound)
- */
-
-#ifndef android_npapi_H
-#define android_npapi_H
-
-#include <stdint.h>
-#include "npapi.h"
-#include <jni.h>
-
-///////////////////////////////////////////////////////////////////////////////
-// General types
-
-enum ANPBitmapFormats {
-    kUnknown_ANPBitmapFormat    = 0,
-    kRGBA_8888_ANPBitmapFormat  = 1,
-    kRGB_565_ANPBitmapFormat    = 2
-};
-typedef int32_t ANPBitmapFormat;
-
-struct ANPPixelPacking {
-    uint8_t AShift;
-    uint8_t ABits;
-    uint8_t RShift;
-    uint8_t RBits;
-    uint8_t GShift;
-    uint8_t GBits;
-    uint8_t BShift;
-    uint8_t BBits;
-};
-
-struct ANPBitmap {
-    void*           baseAddr;
-    ANPBitmapFormat format;
-    int32_t         width;
-    int32_t         height;
-    int32_t         rowBytes;
-};
-
-struct ANPRectF {
-    float   left;
-    float   top;
-    float   right;
-    float   bottom;
-};
-
-struct ANPRectI {
-    int32_t left;
-    int32_t top;
-    int32_t right;
-    int32_t bottom;
-};
-
-struct ANPCanvas;
-struct ANPMatrix;
-struct ANPPaint;
-struct ANPPath;
-struct ANPRegion;
-struct ANPTypeface;
-
-enum ANPMatrixFlags {
-    kIdentity_ANPMatrixFlag     = 0,
-    kTranslate_ANPMatrixFlag    = 0x01,
-    kScale_ANPMatrixFlag        = 0x02,
-    kAffine_ANPMatrixFlag       = 0x04,
-    kPerspective_ANPMatrixFlag  = 0x08,
-};
-typedef uint32_t ANPMatrixFlag;
-
-///////////////////////////////////////////////////////////////////////////////
-// NPN_GetValue
-
-/** queries for a specific ANPInterface.
-
-    Maybe called with NULL for the NPP instance
-
-    NPN_GetValue(inst, interface_enum, ANPInterface*)
- */
-#define kLogInterfaceV0_ANPGetValue         ((NPNVariable)1000)
-#define kAudioTrackInterfaceV0_ANPGetValue  ((NPNVariable)1001)
-#define kCanvasInterfaceV0_ANPGetValue      ((NPNVariable)1002)
-#define kMatrixInterfaceV0_ANPGetValue      ((NPNVariable)1003)
-#define kPaintInterfaceV0_ANPGetValue       ((NPNVariable)1004)
-#define kPathInterfaceV0_ANPGetValue        ((NPNVariable)1005)
-#define kTypefaceInterfaceV0_ANPGetValue    ((NPNVariable)1006)
-#define kWindowInterfaceV0_ANPGetValue      ((NPNVariable)1007)
-#define kBitmapInterfaceV0_ANPGetValue      ((NPNVariable)1008)
-#define kSurfaceInterfaceV0_ANPGetValue     ((NPNVariable)1009)
-#define kSystemInterfaceV0_ANPGetValue      ((NPNVariable)1010)
-#define kEventInterfaceV0_ANPGetValue       ((NPNVariable)1011)
-
-/** queries for the drawing models supported on this device.
-
-    NPN_GetValue(inst, kSupportedDrawingModel_ANPGetValue, uint32_t* bits)
- */
-#define kSupportedDrawingModel_ANPGetValue  ((NPNVariable)2000)
-
-/** queries for the context (android.content.Context) of the plugin. If no
-    instance is specified the application's context is returned. If the instance
-    is given then the context returned is identical to the context used to
-    create the webview in which that instance resides.
-
-    NOTE: Holding onto a non-application context after your instance has been
-    destroyed will cause a memory leak.  Refer to the android documentation to
-    determine what context is best suited for your particular scenario.
-
-    NPN_GetValue(inst, kJavaContext_ANPGetValue, jobject context)
- */
-#define kJavaContext_ANPGetValue            ((NPNVariable)2001)
-
-///////////////////////////////////////////////////////////////////////////////
-// NPN_SetValue
-
-/** Request to set the drawing model. SetValue will return false if the drawing
-    model is not supported or has insufficient information for configuration.
-
-    NPN_SetValue(inst, kRequestDrawingModel_ANPSetValue, (void*)foo_ANPDrawingModel)
- */
-#define kRequestDrawingModel_ANPSetValue    ((NPPVariable)1000)
-
-/** These are used as bitfields in ANPSupportedDrawingModels_EnumValue,
-    and as-is in ANPRequestDrawingModel_EnumValue. The drawing model determines
-    how to interpret the ANPDrawingContext provided in the Draw event and how
-    to interpret the NPWindow->window field.
- */
-enum ANPDrawingModels {
-    /** Draw into a bitmap from the browser thread in response to a Draw event.
-        NPWindow->window is reserved (ignore)
-     */
-    kBitmap_ANPDrawingModel  = 1 << 0,
-    /** Draw into a surface (e.g. raster, openGL, etc.) using the Java surface
-        interface. When this model is used the browser will invoke the Java
-        class specified in the plugin's apk manifest. From that class the browser
-        will invoke the appropriate method to return an an instance of a android
-        Java View. The instance is then embedded in the html. The plugin can then
-        manipulate the view as it would any normal Java View in android.
-
-        Unlike the bitmap model, a surface model is opaque so no html content
-        behind the plugin will be  visible. Unless the plugin needs to be
-        transparent the surface model should be chosen over the bitmap model as
-        it will have better performance.
-
-        Further, a plugin can manipulate some surfaces in native code using the
-        ANPSurfaceInterface.  This interface can be used to manipulate Java
-        objects that extend Surface.class by allowing them to access the
-        surface's underlying bitmap in native code.  For instance, if a raster
-        surface is used the plugin can lock, draw directly into the bitmap, and
-        unlock the surface in native code without making JNI calls to the Java
-        surface object.
-     */
-    kSurface_ANPDrawingModel = 1 << 1,
-};
-typedef int32_t ANPDrawingModel;
-
-/** Request to receive/disable events. If the pointer is NULL then all flags will
-    be disabled. Otherwise, the event type will be enabled iff its corresponding
-    bit in the EventFlags bit field is set.
-
-    NPN_SetValue(inst, ANPAcceptEvents, (void*)EventFlags)
- */
-#define kAcceptEvents_ANPSetValue           ((NPPVariable)1001)
-
-/** The EventFlags are a set of bits used to determine which types of events the
-    plugin wishes to receive. For example, if the value is 0x03 then both key
-    and touch events will be provided to the plugin.
- */
-enum ANPEventFlag {
-    kKey_ANPEventFlag               = 0x01,
-    kTouch_ANPEventFlag             = 0x02,
-};
-typedef uint32_t ANPEventFlags;
-
-///////////////////////////////////////////////////////////////////////////////
-// NPP_GetValue
-
-/** Requests that the plugin return a java surface to be displayed. This will
-    only be used if the plugin has choosen the kSurface_ANPDrawingModel.
-
-    NPP_GetValue(inst, kJavaSurface_ANPGetValue, jobject surface)
- */
-#define kJavaSurface_ANPGetValue            ((NPPVariable)2000)
-
-
-///////////////////////////////////////////////////////////////////////////////
-// ANDROID INTERFACE DEFINITIONS
-
-/** Interfaces provide additional functionality to the plugin via function ptrs.
-    Once an interface is retrieved, it is valid for the lifetime of the plugin
-    (just like browserfuncs).
-
-    All ANPInterfaces begin with an inSize field, which must be set by the
-    caller (plugin) with the number of bytes allocated for the interface.
-    e.g. SomeInterface si; si.inSize = sizeof(si); browser->getvalue(..., &si);
- */
-struct ANPInterface {
-    uint32_t    inSize;     // size (in bytes) of this struct
-};
-
-enum ANPLogTypes {
-    kError_ANPLogType   = 0,    // error
-    kWarning_ANPLogType = 1,    // warning
-    kDebug_ANPLogType   = 2     // debug only (informational)
-};
-typedef int32_t ANPLogType;
-
-struct ANPLogInterfaceV0 : ANPInterface {
-    /** dumps printf messages to the log file
-        e.g. interface->log(instance, kWarning_ANPLogType, "value is %d", value);
-     */
-    void (*log)(ANPLogType, const char format[], ...);
-};
-
-struct ANPBitmapInterfaceV0 : ANPInterface {
-    /** Returns true if the specified bitmap format is supported, and if packing
-        is non-null, sets it to the packing info for that format.
-     */
-    bool (*getPixelPacking)(ANPBitmapFormat, ANPPixelPacking* packing);
-};
-
-struct ANPMatrixInterfaceV0 : ANPInterface {
-    /** Return a new identity matrix
-     */
-    ANPMatrix*  (*newMatrix)();
-    /** Delete a matrix previously allocated by newMatrix()
-     */
-    void        (*deleteMatrix)(ANPMatrix*);
-
-    ANPMatrixFlag (*getFlags)(const ANPMatrix*);
-
-    void        (*copy)(ANPMatrix* dst, const ANPMatrix* src);
-
-    /** Return the matrix values in a float array (allcoated by the caller),
-        where the values are treated as follows:
-        w  = x * [6] + y * [7] + [8];
-        x' = (x * [0] + y * [1] + [2]) / w;
-        y' = (x * [3] + y * [4] + [5]) / w;
-     */
-    void        (*get3x3)(const ANPMatrix*, float[9]);
-    /** Initialize the matrix from values in a float array,
-        where the values are treated as follows:
-         w  = x * [6] + y * [7] + [8];
-         x' = (x * [0] + y * [1] + [2]) / w;
-         y' = (x * [3] + y * [4] + [5]) / w;
-     */
-    void        (*set3x3)(ANPMatrix*, const float[9]);
-
-    void        (*setIdentity)(ANPMatrix*);
-    void        (*preTranslate)(ANPMatrix*, float tx, float ty);
-    void        (*postTranslate)(ANPMatrix*, float tx, float ty);
-    void        (*preScale)(ANPMatrix*, float sx, float sy);
-    void        (*postScale)(ANPMatrix*, float sx, float sy);
-    void        (*preSkew)(ANPMatrix*, float kx, float ky);
-    void        (*postSkew)(ANPMatrix*, float kx, float ky);
-    void        (*preRotate)(ANPMatrix*, float degrees);
-    void        (*postRotate)(ANPMatrix*, float degrees);
-    void        (*preConcat)(ANPMatrix*, const ANPMatrix*);
-    void        (*postConcat)(ANPMatrix*, const ANPMatrix*);
-
-    /** Return true if src is invertible, and if so, return its inverse in dst.
-        If src is not invertible, return false and ignore dst.
-     */
-    bool        (*invert)(ANPMatrix* dst, const ANPMatrix* src);
-
-    /** Transform the x,y pairs in src[] by this matrix, and store the results
-        in dst[]. The count parameter is treated as the number of pairs in the
-        array. It is legal for src and dst to point to the same memory, but
-        illegal for the two arrays to partially overlap.
-     */
-    void        (*mapPoints)(ANPMatrix*, float dst[], const float src[],
-                             int32_t count);
-};
-
-struct ANPPathInterfaceV0 : ANPInterface {
-    /** Return a new path */
-    ANPPath* (*newPath)();
-
-    /** Delete a path previously allocated by ANPPath() */
-    void (*deletePath)(ANPPath*);
-
-    /** Make a deep copy of the src path, into the dst path (already allocated
-        by the caller).
-     */
-    void (*copy)(ANPPath* dst, const ANPPath* src);
-
-    /** Returns true if the two paths are the same (i.e. have the same points)
-     */
-    bool (*equal)(const ANPPath* path0, const ANPPath* path1);
-
-    /** Remove any previous points, initializing the path back to empty. */
-    void (*reset)(ANPPath*);
-
-    /** Return true if the path is empty (has no lines, quads or cubics). */
-    bool (*isEmpty)(const ANPPath*);
-
-    /** Return the path's bounds in bounds. */
-    void (*getBounds)(const ANPPath*, ANPRectF* bounds);
-
-    void (*moveTo)(ANPPath*, float x, float y);
-    void (*lineTo)(ANPPath*, float x, float y);
-    void (*quadTo)(ANPPath*, float x0, float y0, float x1, float y1);
-    void (*cubicTo)(ANPPath*, float x0, float y0, float x1, float y1,
-                    float x2, float y2);
-    void (*close)(ANPPath*);
-
-    /** Offset the src path by [dx, dy]. If dst is null, apply the
-        change directly to the src path. If dst is not null, write the
-        changed path into dst, and leave the src path unchanged. In that case
-        dst must have been previously allocated by the caller.
-     */
-    void (*offset)(ANPPath* src, float dx, float dy, ANPPath* dst);
-
-    /** Transform the path by the matrix. If dst is null, apply the
-        change directly to the src path. If dst is not null, write the
-        changed path into dst, and leave the src path unchanged. In that case
-        dst must have been previously allocated by the caller.
-     */
-    void (*transform)(ANPPath* src, const ANPMatrix*, ANPPath* dst);
-};
-
-/** ANPColor is always defined to have the same packing on all platforms, and
-    it is always unpremultiplied.
-
-    This is in contrast to 32bit format(s) in bitmaps, which are premultiplied,
-    and their packing may vary depending on the platform, hence the need for
-    ANPBitmapInterface::getPixelPacking()
- */
-typedef uint32_t ANPColor;
-#define ANPColor_ASHIFT     24
-#define ANPColor_RSHIFT     16
-#define ANPColor_GSHIFT     8
-#define ANPColor_BSHIFT     0
-#define ANP_MAKE_COLOR(a, r, g, b)  \
-                   (((a) << ANPColor_ASHIFT) |  \
-                    ((r) << ANPColor_RSHIFT) |  \
-                    ((g) << ANPColor_GSHIFT) |  \
-                    ((b) << ANPColor_BSHIFT))
-
-enum ANPPaintFlag {
-    kAntiAlias_ANPPaintFlag         = 1 << 0,
-    kFilterBitmap_ANPPaintFlag      = 1 << 1,
-    kDither_ANPPaintFlag            = 1 << 2,
-    kUnderlineText_ANPPaintFlag     = 1 << 3,
-    kStrikeThruText_ANPPaintFlag    = 1 << 4,
-    kFakeBoldText_ANPPaintFlag      = 1 << 5,
-};
-typedef uint32_t ANPPaintFlags;
-
-enum ANPPaintStyles {
-    kFill_ANPPaintStyle             = 0,
-    kStroke_ANPPaintStyle           = 1,
-    kFillAndStroke_ANPPaintStyle    = 2
-};
-typedef int32_t ANPPaintStyle;
-
-enum ANPPaintCaps {
-    kButt_ANPPaintCap   = 0,
-    kRound_ANPPaintCap  = 1,
-    kSquare_ANPPaintCap = 2
-};
-typedef int32_t ANPPaintCap;
-
-enum ANPPaintJoins {
-    kMiter_ANPPaintJoin = 0,
-    kRound_ANPPaintJoin = 1,
-    kBevel_ANPPaintJoin = 2
-};
-typedef int32_t ANPPaintJoin;
-
-enum ANPPaintAligns {
-    kLeft_ANPPaintAlign     = 0,
-    kCenter_ANPPaintAlign   = 1,
-    kRight_ANPPaintAlign    = 2
-};
-typedef int32_t ANPPaintAlign;
-
-enum ANPTextEncodings {
-    kUTF8_ANPTextEncoding   = 0,
-    kUTF16_ANPTextEncoding  = 1,
-};
-typedef int32_t ANPTextEncoding;
-
-enum ANPTypefaceStyles {
-    kBold_ANPTypefaceStyle      = 1 << 0,
-    kItalic_ANPTypefaceStyle    = 1 << 1
-};
-typedef uint32_t ANPTypefaceStyle;
-
-typedef uint32_t ANPFontTableTag;
-
-struct ANPFontMetrics {
-    /** The greatest distance above the baseline for any glyph (will be <= 0) */
-    float   fTop;
-    /** The recommended distance above the baseline (will be <= 0) */
-    float   fAscent;
-    /** The recommended distance below the baseline (will be >= 0) */
-    float   fDescent;
-    /** The greatest distance below the baseline for any glyph (will be >= 0) */
-    float   fBottom;
-    /** The recommended distance to add between lines of text (will be >= 0) */
-    float   fLeading;
-};
-
-struct ANPTypefaceInterfaceV0 : ANPInterface {
-    /** Return a new reference to the typeface that most closely matches the
-        requested name and style. Pass null as the name to return
-        the default font for the requested style. Will never return null
-
-        The 5 generic font names "serif", "sans-serif", "monospace", "cursive",
-        "fantasy" are recognized, and will be mapped to their logical font
-        automatically by this call.
-
-        @param name     May be NULL. The name of the font family.
-        @param style    The style (normal, bold, italic) of the typeface.
-        @return reference to the closest-matching typeface. Caller must call
-                unref() when they are done with the typeface.
-     */
-    ANPTypeface* (*createFromName)(const char name[], ANPTypefaceStyle);
-
-    /** Return a new reference to the typeface that most closely matches the
-        requested typeface and specified Style. Use this call if you want to
-        pick a new style from the same family of the existing typeface.
-        If family is NULL, this selects from the default font's family.
-
-        @param family  May be NULL. The name of the existing type face.
-        @param s       The style (normal, bold, italic) of the type face.
-        @return reference to the closest-matching typeface. Call must call
-                unref() when they are done.
-     */
-    ANPTypeface* (*createFromTypeface)(const ANPTypeface* family,
-                                       ANPTypefaceStyle);
-
-    /** Return the owner count of the typeface. A newly created typeface has an
-        owner count of 1. When the owner count is reaches 0, the typeface is
-        deleted.
-     */
-    int32_t (*getRefCount)(const ANPTypeface*);
-
-    /** Increment the owner count on the typeface
-     */
-    void (*ref)(ANPTypeface*);
-
-    /** Decrement the owner count on the typeface. When the count goes to 0,
-        the typeface is deleted.
-     */
-    void (*unref)(ANPTypeface*);
-
-    /** Return the style bits for the specified typeface
-     */
-    ANPTypefaceStyle (*getStyle)(const ANPTypeface*);
-
-    /** Some fonts are stored in files. If that is true for the fontID, then
-        this returns the byte length of the full file path. If path is not null,
-        then the full path is copied into path (allocated by the caller), up to
-        length bytes. If index is not null, then it is set to the truetype
-        collection index for this font, or 0 if the font is not in a collection.
-
-        Note: getFontPath does not assume that path is a null-terminated string,
-        so when it succeeds, it only copies the bytes of the file name and
-        nothing else (i.e. it copies exactly the number of bytes returned by the
-        function. If the caller wants to treat path[] as a C string, it must be
-        sure that it is allocated at least 1 byte larger than the returned size,
-        and it must copy in the terminating 0.
-
-        If the fontID does not correspond to a file, then the function returns
-        0, and the path and index parameters are ignored.
-
-        @param fontID  The font whose file name is being queried
-        @param path    Either NULL, or storage for receiving up to length bytes
-                       of the font's file name. Allocated by the caller.
-        @param length  The maximum space allocated in path (by the caller).
-                       Ignored if path is NULL.
-        @param index   Either NULL, or receives the TTC index for this font.
-                       If the font is not a TTC, then will be set to 0.
-        @return The byte length of th font's file name, or 0 if the font is not
-                baked by a file.
-     */
-    int32_t (*getFontPath)(const ANPTypeface*, char path[], int32_t length,
-                           int32_t* index);
-
-    /** Return a UTF8 encoded path name for the font directory, or NULL if not
-        supported. If returned, this string address will be valid for the life
-        of the plugin instance. It will always end with a '/' character.
-     */
-    const char* (*getFontDirectoryPath)();
-};
-
-struct ANPPaintInterfaceV0 : ANPInterface {
-    /** Return a new paint object, which holds all of the color and style
-        attributes that affect how things (geometry, text, bitmaps) are drawn
-        in a ANPCanvas.
-
-        The paint that is returned is not tied to any particular plugin
-        instance, but it must only be accessed from one thread at a time.
-     */
-    ANPPaint*   (*newPaint)();
-    void        (*deletePaint)(ANPPaint*);
-
-    ANPPaintFlags (*getFlags)(const ANPPaint*);
-    void        (*setFlags)(ANPPaint*, ANPPaintFlags);
-
-    ANPColor    (*getColor)(const ANPPaint*);
-    void        (*setColor)(ANPPaint*, ANPColor);
-
-    ANPPaintStyle (*getStyle)(const ANPPaint*);
-    void        (*setStyle)(ANPPaint*, ANPPaintStyle);
-
-    float       (*getStrokeWidth)(const ANPPaint*);
-    float       (*getStrokeMiter)(const ANPPaint*);
-    ANPPaintCap (*getStrokeCap)(const ANPPaint*);
-    ANPPaintJoin (*getStrokeJoin)(const ANPPaint*);
-    void        (*setStrokeWidth)(ANPPaint*, float);
-    void        (*setStrokeMiter)(ANPPaint*, float);
-    void        (*setStrokeCap)(ANPPaint*, ANPPaintCap);
-    void        (*setStrokeJoin)(ANPPaint*, ANPPaintJoin);
-
-    ANPTextEncoding (*getTextEncoding)(const ANPPaint*);
-    ANPPaintAlign (*getTextAlign)(const ANPPaint*);
-    float       (*getTextSize)(const ANPPaint*);
-    float       (*getTextScaleX)(const ANPPaint*);
-    float       (*getTextSkewX)(const ANPPaint*);
-    void        (*setTextEncoding)(ANPPaint*, ANPTextEncoding);
-    void        (*setTextAlign)(ANPPaint*, ANPPaintAlign);
-    void        (*setTextSize)(ANPPaint*, float);
-    void        (*setTextScaleX)(ANPPaint*, float);
-    void        (*setTextSkewX)(ANPPaint*, float);
-
-    /** Return the typeface ine paint, or null if there is none. This does not
-        modify the owner count of the returned typeface.
-     */
-    ANPTypeface* (*getTypeface)(const ANPPaint*);
-
-    /** Set the paint's typeface. If the paint already had a non-null typeface,
-        its owner count is decremented. If the new typeface is non-null, its
-        owner count is incremented.
-     */
-    void (*setTypeface)(ANPPaint*, ANPTypeface*);
-
-    /** Return the width of the text. If bounds is not null, return the bounds
-        of the text in that rectangle.
-     */
-    float (*measureText)(ANPPaint*, const void* text, uint32_t byteLength,
-                         ANPRectF* bounds);
-
-    /** Return the number of unichars specifed by the text.
-        If widths is not null, returns the array of advance widths for each
-            unichar.
-        If bounds is not null, returns the array of bounds for each unichar.
-     */
-    int (*getTextWidths)(ANPPaint*, const void* text, uint32_t byteLength,
-                         float widths[], ANPRectF bounds[]);
-
-    /** Return in metrics the spacing values for text, respecting the paint's
-        typeface and pointsize, and return the spacing between lines
-        (descent - ascent + leading). If metrics is NULL, it will be ignored.
-     */
-    float (*getFontMetrics)(ANPPaint*, ANPFontMetrics* metrics);
-};
-
-struct ANPCanvasInterfaceV0 : ANPInterface {
-    /** Return a canvas that will draw into the specified bitmap. Note: the
-        canvas copies the fields of the bitmap, so it need not persist after
-        this call, but the canvas DOES point to the same pixel memory that the
-        bitmap did, so the canvas should not be used after that pixel memory
-        goes out of scope. In the case of creating a canvas to draw into the
-        pixels provided by kDraw_ANPEventType, those pixels are only while
-        handling that event.
-
-        The canvas that is returned is not tied to any particular plugin
-        instance, but it must only be accessed from one thread at a time.
-     */
-    ANPCanvas*  (*newCanvas)(const ANPBitmap*);
-    void        (*deleteCanvas)(ANPCanvas*);
-
-    void        (*save)(ANPCanvas*);
-    void        (*restore)(ANPCanvas*);
-    void        (*translate)(ANPCanvas*, float tx, float ty);
-    void        (*scale)(ANPCanvas*, float sx, float sy);
-    void        (*rotate)(ANPCanvas*, float degrees);
-    void        (*skew)(ANPCanvas*, float kx, float ky);
-    void        (*concat)(ANPCanvas*, const ANPMatrix*);
-    void        (*clipRect)(ANPCanvas*, const ANPRectF*);
-    void        (*clipPath)(ANPCanvas*, const ANPPath*);
-
-    /** Return the current matrix on the canvas
-     */
-    void        (*getTotalMatrix)(ANPCanvas*, ANPMatrix*);
-    /** Return the current clip bounds in local coordinates, expanding it to
-        account for antialiasing edge effects if aa is true. If the
-        current clip is empty, return false and ignore the bounds argument.
-     */
-    bool        (*getLocalClipBounds)(ANPCanvas*, ANPRectF* bounds, bool aa);
-    /** Return the current clip bounds in device coordinates in bounds. If the
-        current clip is empty, return false and ignore the bounds argument.
-     */
-    bool        (*getDeviceClipBounds)(ANPCanvas*, ANPRectI* bounds);
-
-    void        (*drawColor)(ANPCanvas*, ANPColor);
-    void        (*drawPaint)(ANPCanvas*, const ANPPaint*);
-    void        (*drawLine)(ANPCanvas*, float x0, float y0, float x1, float y1,
-                            const ANPPaint*);
-    void        (*drawRect)(ANPCanvas*, const ANPRectF*, const ANPPaint*);
-    void        (*drawOval)(ANPCanvas*, const ANPRectF*, const ANPPaint*);
-    void        (*drawPath)(ANPCanvas*, const ANPPath*, const ANPPaint*);
-    void        (*drawText)(ANPCanvas*, const void* text, uint32_t byteLength,
-                            float x, float y, const ANPPaint*);
-    void       (*drawPosText)(ANPCanvas*, const void* text, uint32_t byteLength,
-                               const float xy[], const ANPPaint*);
-    void        (*drawBitmap)(ANPCanvas*, const ANPBitmap*, float x, float y,
-                              const ANPPaint*);
-    void        (*drawBitmapRect)(ANPCanvas*, const ANPBitmap*,
-                                  const ANPRectI* src, const ANPRectF* dst,
-                                  const ANPPaint*);
-};
-
-struct ANPWindowInterfaceV0 : ANPInterface {
-    /** Registers a set of rectangles that the plugin would like to keep on
-        screen. The rectangles are listed in order of priority with the highest
-        priority rectangle in location rects[0].  The browser will attempt to keep
-        as many of the rectangles on screen as possible and will scroll them into
-        view in response to the invocation of this method and other various events.
-        The count specifies how many rectangles are in the array. If the count is
-        zero it signals the browser that any existing rectangles should be cleared
-        and no rectangles will be tracked.
-     */
-    void (*setVisibleRects)(NPP instance, const ANPRectI rects[], int32_t count);
-    /** Clears any rectangles that are being tracked as a result of a call to
-        setVisibleRects. This call is equivalent to setVisibleRect(inst, NULL, 0).
-     */
-    void    (*clearVisibleRects)(NPP instance);
-    /** Given a boolean value of true the device will be requested to provide
-        a keyboard. A value of false will result in a request to hide the
-        keyboard. Further, the on-screen keyboard will not be displayed if a
-        physical keyboard is active.
-     */
-    void    (*showKeyboard)(NPP instance, bool value);
-    /** Called when a plugin wishes to enter into full screen mode. The plugin's
-        Java class (defined in the plugin's apk manifest) will be called
-        asynchronously to provide a View object to be displayed full screen.
-     */
-    void    (*requestFullScreen)(NPP instance);
-    /** Called when a plugin wishes to exit from full screen mode. As a result,
-        the plugin's full screen view will be discarded by the view system.
-     */
-    void    (*exitFullScreen)(NPP instance);
-    /** Called when a plugin wishes to be zoomed and centered in the current view.
-     */
-    void    (*requestCenterFitZoom)(NPP instance);
-};
-
-///////////////////////////////////////////////////////////////////////////////
-
-enum ANPSampleFormats {
-    kUnknown_ANPSamleFormat     = 0,
-    kPCM16Bit_ANPSampleFormat   = 1,
-    kPCM8Bit_ANPSampleFormat    = 2
-};
-typedef int32_t ANPSampleFormat;
-
-/** The audio buffer is passed to the callback proc to request more samples.
-    It is owned by the system, and the callback may read it, but should not
-    maintain a pointer to it outside of the scope of the callback proc.
- */
-struct ANPAudioBuffer {
-    // RO - repeat what was specified in newTrack()
-    int32_t     channelCount;
-    // RO - repeat what was specified in newTrack()
-    ANPSampleFormat  format;
-    /** This buffer is owned by the caller. Inside the callback proc, up to
-        "size" bytes of sample data should be written into this buffer. The
-        address is only valid for the scope of a single invocation of the
-        callback proc.
-     */
-    void*       bufferData;
-    /** On input, specifies the maximum number of bytes that can be written
-        to "bufferData". On output, specifies the actual number of bytes that
-        the callback proc wrote into "bufferData".
-     */
-    uint32_t    size;
-};
-
-enum ANPAudioEvents {
-    /** This event is passed to the callback proc when the audio-track needs
-        more sample data written to the provided buffer parameter.
-     */
-    kMoreData_ANPAudioEvent = 0,
-    /** This event is passed to the callback proc if the audio system runs out
-        of sample data. In this event, no buffer parameter will be specified
-        (i.e. NULL will be passed to the 3rd parameter).
-     */
-    kUnderRun_ANPAudioEvent = 1
-};
-typedef int32_t ANPAudioEvent;
-
-/** Called to feed sample data to the track. This will be called in a separate
-    thread. However, you may call trackStop() from the callback (but you
-    cannot delete the track).
-
-    For example, when you have written the last chunk of sample data, you can
-    immediately call trackStop(). This will take effect after the current
-    buffer has been played.
-
-    The "user" parameter is the same value that was passed to newTrack()
- */
-typedef void (*ANPAudioCallbackProc)(ANPAudioEvent event, void* user,
-                                     ANPAudioBuffer* buffer);
-
-struct ANPAudioTrack;   // abstract type for audio tracks
-
-struct ANPAudioTrackInterfaceV0 : ANPInterface {
-    /** Create a new audio track, or NULL on failure. The track is initially in
-        the stopped state and therefore ANPAudioCallbackProc will not be called
-        until the track is started.
-     */
-    ANPAudioTrack*  (*newTrack)(uint32_t sampleRate,    // sampling rate in Hz
-                                ANPSampleFormat,
-                                int channelCount,       // MONO=1, STEREO=2
-                                ANPAudioCallbackProc,
-                                void* user);
-    /** Deletes a track that was created using newTrack.  The track can be
-        deleted in any state and it waits for the ANPAudioCallbackProc thread
-        to exit before returning.
-     */
-    void (*deleteTrack)(ANPAudioTrack*);
-
-    void (*start)(ANPAudioTrack*);
-    void (*pause)(ANPAudioTrack*);
-    void (*stop)(ANPAudioTrack*);
-    /** Returns true if the track is not playing (e.g. pause or stop was called,
-        or start was never called.
-     */
-    bool (*isStopped)(ANPAudioTrack*);
-};
-
-///////////////////////////////////////////////////////////////////////////////
-// DEFINITION OF VALUES PASSED THROUGH NPP_HandleEvent
-
-enum ANPEventTypes {
-    kNull_ANPEventType          = 0,
-    kKey_ANPEventType           = 1,
-    /** Mouse events are triggered by either clicking with the navigational pad
-        or by tapping the touchscreen (if the kDown_ANPTouchAction is handled by
-        the plugin then no mouse event is generated).  The kKey_ANPEventFlag has
-        to be set to true in order to receive these events.
-     */
-    kMouse_ANPEventType         = 2,
-    /** Touch events are generated when the user touches on the screen. The
-        kTouch_ANPEventFlag has to be set to true in order to receive these
-        events.
-     */
-    kTouch_ANPEventType         = 3,
-    /** Only triggered by a plugin using the kBitmap_ANPDrawingModel. This event
-        signals that the plugin needs to redraw itself into the provided bitmap.
-     */
-    kDraw_ANPEventType          = 4,
-    kLifecycle_ANPEventType     = 5,
-
-    /** This event type is completely defined by the plugin.
-        When creating an event, the caller must always set the first
-        two fields, the remaining data is optional.
-            ANPEvent evt;
-            evt.inSize = sizeof(ANPEvent);
-            evt.eventType = kCustom_ANPEventType
-            // other data slots are optional
-            evt.other[] = ...;
-        To post a copy of the event, call
-            eventInterface->postEvent(myNPPInstance, &evt);
-        That call makes a copy of the event struct, and post that on the event
-        queue for the plugin.
-     */
-    kCustom_ANPEventType   = 6,
-};
-typedef int32_t ANPEventType;
-
-enum ANPKeyActions {
-    kDown_ANPKeyAction  = 0,
-    kUp_ANPKeyAction    = 1,
-};
-typedef int32_t ANPKeyAction;
-
-#include "ANPKeyCodes.h"
-typedef int32_t ANPKeyCode;
-
-enum ANPKeyModifiers {
-    kAlt_ANPKeyModifier     = 1 << 0,
-    kShift_ANPKeyModifier   = 1 << 1,
-};
-// bit-field containing some number of ANPKeyModifier bits
-typedef uint32_t ANPKeyModifier;
-
-enum ANPMouseActions {
-    kDown_ANPMouseAction  = 0,
-    kUp_ANPMouseAction    = 1,
-};
-typedef int32_t ANPMouseAction;
-
-enum ANPTouchActions {
-    /** This occurs when the user first touches on the screen. As such, this
-        action will always occur prior to any of the other touch actions. If
-        the plugin chooses to not handle this action then no other events
-        related to that particular touch gesture will be generated.
-     */
-    kDown_ANPTouchAction        = 0,
-    kUp_ANPTouchAction          = 1,
-    kMove_ANPTouchAction        = 2,
-    kCancel_ANPTouchAction      = 3,
-    // The web view will ignore the return value from the following actions
-    kLongPress_ANPTouchAction   = 4,
-    kDoubleTap_ANPTouchAction   = 5,
-};
-typedef int32_t ANPTouchAction;
-
-enum ANPLifecycleActions {
-    /** The web view containing this plugin has been paused.  See documentation
-        on the android activity lifecycle for more information.
-     */
-    kPause_ANPLifecycleAction           = 0,
-    /** The web view containing this plugin has been resumed. See documentation
-        on the android activity lifecycle for more information.
-     */
-    kResume_ANPLifecycleAction          = 1,
-    /** The plugin has focus and is now the recipient of input events (e.g. key,
-        touch, etc.)
-     */
-    kGainFocus_ANPLifecycleAction       = 2,
-    /** The plugin has lost focus and will not receive any input events until it
-        regains focus. This event is always preceded by a GainFocus action.
-     */
-    kLoseFocus_ANPLifecycleAction       = 3,
-    /** The browser is running low on available memory and is requesting that
-        the plugin free any unused/inactive resources to prevent a performance
-        degradation.
-     */
-    kFreeMemory_ANPLifecycleAction      = 4,
-    /** The page has finished loading. This happens when the page's top level
-        frame reports that it has completed loading.
-     */
-    kOnLoad_ANPLifecycleAction          = 5,
-    /** The browser is honoring the plugin's request to go full screen. Upon
-        returning from this event the browser will resize the plugin's java
-        surface to full-screen coordinates.
-     */
-    kEnterFullScreen_ANPLifecycleAction = 6,
-    /** The browser has exited from full screen mode. Immediately prior to
-        sending this event the browser has resized the plugin's java surface to
-        its original coordinates.
-     */
-    kExitFullScreen_ANPLifecycleAction  = 7,
-    /** The plugin is visible to the user on the screen. This event will always
-        occur after a kOffScreen_ANPLifecycleAction event.
-     */
-    kOnScreen_ANPLifecycleAction        = 8,
-    /** The plugin is no longer visible to the user on the screen. This event
-        will always occur prior to an kOnScreen_ANPLifecycleAction event.
-     */
-    kOffScreen_ANPLifecycleAction       = 9,
-};
-typedef uint32_t ANPLifecycleAction;
-
-/* This is what is passed to NPP_HandleEvent() */
-struct ANPEvent {
-    uint32_t        inSize;  // size of this struct in bytes
-    ANPEventType    eventType;
-    // use based on the value in eventType
-    union {
-        struct {
-            ANPKeyAction    action;
-            ANPKeyCode      nativeCode;
-            int32_t         virtualCode;    // windows virtual key code
-            ANPKeyModifier  modifiers;
-            int32_t         repeatCount;    // 0 for initial down (or up)
-            int32_t         unichar;        // 0 if there is no value
-        } key;
-        struct {
-            ANPMouseAction  action;
-            int32_t         x;  // relative to your "window" (0...width)
-            int32_t         y;  // relative to your "window" (0...height)
-        } mouse;
-        struct {
-            ANPTouchAction  action;
-            ANPKeyModifier  modifiers;
-            int32_t         x;  // relative to your "window" (0...width)
-            int32_t         y;  // relative to your "window" (0...height)
-        } touch;
-        struct {
-            ANPLifecycleAction  action;
-        } lifecycle;
-        struct {
-            ANPDrawingModel model;
-            // relative to (0,0) in top-left of your plugin
-            ANPRectI        clip;
-            // use based on the value in model
-            union {
-                ANPBitmap   bitmap;
-            } data;
-        } draw;
-        int32_t     other[8];
-    } data;
-};
-
-struct ANPEventInterfaceV0 : ANPInterface {
-    /** Post a copy of the specified event to the plugin. The event will be
-        delivered to the plugin in its main thread (the thread that receives
-        other ANPEvents). If, after posting before delivery, the NPP instance
-        is torn down, the event will be discarded.
-     */
-    void (*postEvent)(NPP inst, const ANPEvent* event);
-};
-
-struct ANPSystemInterfaceV0 : ANPInterface {
-    /** Return the path name for the current Application's plugin data directory,
-        or NULL if not supported
-     */
-    const char* (*getApplicationDataDirectory)();
-
-    /** A helper function to load java classes from the plugin's apk.  The
-        function looks for a class given the fully qualified and null terminated
-        string representing the className. For example,
-
-        const char* className = "com.android.mypackage.MyClass";
-
-        If the class cannot be found or there is a problem loading the class
-        NULL will be returned.
-     */
-    jclass (*loadJavaClass)(NPP instance, const char* className);
-};
-
-struct ANPSurfaceInterfaceV0 : ANPInterface {
-  /** Locks the surface from manipulation by other threads and provides a bitmap
-        to be written to.  The dirtyRect param specifies which portion of the
-        bitmap will be written to.  If the dirtyRect is NULL then the entire
-        surface will be considered dirty.  If the lock was successful the function
-        will return true and the bitmap will be set to point to a valid bitmap.
-        If not the function will return false and the bitmap will be set to NULL.
-  */
-  bool (*lock)(JNIEnv* env, jobject surface, ANPBitmap* bitmap, ANPRectI* dirtyRect);
-  /** Given a locked surface handle (i.e. result of a successful call to lock)
-        the surface is unlocked and the contents of the bitmap, specifically
-        those inside the dirtyRect are written to the screen.
-  */
-  void (*unlock)(JNIEnv* env, jobject surface);
-};
-
-typedef int32_t   int32;
-typedef uint32_t uint32;
-typedef int16_t   int16;
-typedef uint16_t uint16;
-
-#endif
diff --git a/dom/plugins/base/android_npapi.h b/dom/plugins/base/android_npapi.h
deleted file mode 100644
index e69de29bb2d1..000000000000
diff --git a/dom/plugins/base/npfunctions.h b/dom/plugins/base/npfunctions.h
index fe32ce557ee2..3b70a39419df 100644
--- a/dom/plugins/base/npfunctions.h
+++ b/dom/plugins/base/npfunctions.h
@@ -48,10 +48,6 @@
 #include "npapi.h"
 #include "npruntime.h"
 
-#ifdef ANDROID
-#include <jni.h>
-#endif
-
 typedef NPError      (* NP_LOADDS NPP_NewProcPtr)(NPMIMEType pluginType, NPP instance, uint16_t mode, int16_t argc, char* argn[], char* argv[], NPSavedData* saved);
 typedef NPError      (* NP_LOADDS NPP_DestroyProcPtr)(NPP instance, NPSavedData** save);
 typedef NPError      (* NP_LOADDS NPP_SetWindowProcPtr)(NPP instance, NPWindow* window);
@@ -311,13 +307,8 @@ NP_EXPORT(NPError)     NP_Initialize(NPNetscapeFuncs* bFuncs);
 typedef NPError        (*NP_GetEntryPointsFunc)(NPPluginFuncs*);
 NP_EXPORT(NPError)     NP_GetEntryPoints(NPPluginFuncs* pFuncs);
 #else
-#ifdef ANDROID
-typedef NPError    (*NP_InitializeFunc)(NPNetscapeFuncs*, NPPluginFuncs*, JNIEnv* pEnv);
-NP_EXPORT(NPError) NP_Initialize(NPNetscapeFuncs* bFuncs, NPPluginFuncs* pFuncs, JNIEnv* pEnv);
-#else
-typedef NPError    (*NP_InitializeFunc)(NPNetscapeFuncs*, NPPluginFuncs*);
-NP_EXPORT(NPError) NP_Initialize(NPNetscapeFuncs* bFuncs, NPPluginFuncs* pFuncs);
-#endif
+typedef NPError        (*NP_InitializeFunc)(NPNetscapeFuncs*, NPPluginFuncs*);
+NP_EXPORT(NPError)     NP_Initialize(NPNetscapeFuncs* bFuncs, NPPluginFuncs* pFuncs);
 #endif
 typedef NPError        (*NP_ShutdownFunc)(void);
 NP_EXPORT(NPError)     NP_Shutdown(void);
diff --git a/dom/plugins/base/nsNPAPIPlugin.cpp b/dom/plugins/base/nsNPAPIPlugin.cpp
index a360f29b7039..fc6788d6d9ac 100644
--- a/dom/plugins/base/nsNPAPIPlugin.cpp
+++ b/dom/plugins/base/nsNPAPIPlugin.cpp
@@ -127,13 +127,6 @@ using mozilla::plugins::PluginModuleParent;
 #include <windows.h>
 #endif
 
-#ifdef ANDROID
-#include "ANPBase.h"
-#include "AndroidBridge.h"
-#include <android/log.h>
-#define LOG(args...)  __android_log_print(ANDROID_LOG_INFO, "GeckoPlugins" , ## args)
-#endif
-
 using namespace mozilla;
 using namespace mozilla::plugins::parent;
 
@@ -484,7 +477,7 @@ nsNPAPIPlugin::CreatePlugin(nsPluginTag *aPluginTag, nsNPAPIPlugin** aResult)
     return NS_ERROR_FAILURE;
   }
 
-#if defined(XP_MACOSX) || defined(ANDROID)
+#ifdef XP_MACOSX
   if (!pluginLib->HasRequiredFunctions()) {
     NS_WARNING("Not all necessary functions exposed by plugin, it will not load.");
     return NS_ERROR_FAILURE;
@@ -2271,112 +2264,6 @@ _getvalue(NPP npp, NPNVariable variable, void *result)
   }
 #endif
 
-#ifdef ANDROID
-    case kLogInterfaceV0_ANPGetValue: {
-      LOG("get log interface");
-      ANPLogInterfaceV0 *i = (ANPLogInterfaceV0 *) result;
-      InitLogInterface(i);
-      return NPERR_NO_ERROR;
-    }
-
-    case kBitmapInterfaceV0_ANPGetValue: {
-      LOG("get bitmap interface");
-      ANPBitmapInterfaceV0 *i = (ANPBitmapInterfaceV0 *) result;
-      InitBitmapInterface(i);
-      return NPERR_NO_ERROR;
-    }
-
-    case kMatrixInterfaceV0_ANPGetValue: {
-      LOG("get matrix interface");
-      ANPMatrixInterfaceV0 *i = (ANPMatrixInterfaceV0 *) result;
-      InitMatrixInterface(i);
-      return NPERR_NO_ERROR;
-    }
-      
-    case kPathInterfaceV0_ANPGetValue: {
-      LOG("get path interface");
-      ANPPathInterfaceV0 *i = (ANPPathInterfaceV0 *) result;
-      InitPathInterface(i);
-      return NPERR_NO_ERROR;
-    }
-      
-    case kTypefaceInterfaceV0_ANPGetValue: {
-      LOG("get typeface interface");
-      ANPTypefaceInterfaceV0 *i = (ANPTypefaceInterfaceV0 *) result;
-      InitTypeFaceInterface(i);
-      return NPERR_NO_ERROR;
-    }
-
-    case kPaintInterfaceV0_ANPGetValue: {
-      LOG("get paint interface");
-      ANPPaintInterfaceV0 *i = (ANPPaintInterfaceV0 *) result;
-      InitPaintInterface(i);
-      return NPERR_NO_ERROR;
-    }
-
-    case kCanvasInterfaceV0_ANPGetValue: {
-      LOG("get canvas interface");
-      ANPCanvasInterfaceV0 *i = (ANPCanvasInterfaceV0 *) result;
-      InitCanvasInterface(i);
-      return NPERR_NO_ERROR;
-    }
-
-    case kWindowInterfaceV0_ANPGetValue: {
-      LOG("get window interface");
-      ANPWindowInterfaceV0 *i = (ANPWindowInterfaceV0 *) result;
-      InitWindowInterface(i);
-      return NPERR_NO_ERROR;
-    }
-
-    case kAudioTrackInterfaceV0_ANPGetValue: {
-      LOG("get audio interface");
-      ANPAudioTrackInterfaceV0 *i = (ANPAudioTrackInterfaceV0 *) result;
-      InitAudioTrackInterface(i);
-      return NPERR_NO_ERROR;
-    }
-
-    case kEventInterfaceV0_ANPGetValue: {
-      LOG("get event interface");
-      ANPEventInterfaceV0 *i = (ANPEventInterfaceV0 *) result;
-      InitEventInterface(i);
-      return NPERR_NO_ERROR;
-    }
-
-    case kSystemInterfaceV0_ANPGetValue: {
-      LOG("get system interface");
-      ANPSystemInterfaceV0* i = reinterpret_cast<ANPSystemInterfaceV0*>(result);
-      InitSystemInterface(i);
-      LOG("done system interface");
-      return NPERR_NO_ERROR;
-    }
-
-    case kSurfaceInterfaceV0_ANPGetValue: {
-      LOG("get surface interface");
-      ANPSurfaceInterfaceV0 *i = (ANPSurfaceInterfaceV0 *) result;
-      InitSurfaceInterface(i);
-      return NPERR_NO_ERROR;
-    }
-      
-    case kSupportedDrawingModel_ANPGetValue: {
-      LOG("get supported drawing model");
-      uint32_t* bits = reinterpret_cast<uint32_t*>(result);
-      *bits = kBitmap_ANPDrawingModel && kSurface_ANPDrawingModel;
-      return NPERR_NO_ERROR;
-    }  
-
-    case kJavaContext_ANPGetValue: {
-      LOG("get context");
-      JNIEnv* env    = GetJNIForThread();
-      jclass cls     = env->FindClass("org/mozilla/gecko/GeckoApp");
-      jfieldID field = env->GetStaticFieldID(cls, "mAppContext",
-                                             "Lorg/mozilla/gecko/GeckoApp;");
-      jobject ret = env->GetStaticObjectField(cls, field);
-      int32_t* i  = reinterpret_cast<int32_t*>(result);
-      *i = reinterpret_cast<int32_t>(ret);
-      return NPERR_NO_ERROR;
-    }
-#endif
-
   // we no longer hand out any XPCOM objects
   case NPNVDOMElement:
     // fall through
@@ -2388,7 +2275,6 @@ _getvalue(NPP npp, NPNVariable variable, void *result)
     *(nsISupports**)result = nsnull;
     // fall through
   default:
-    NPN_PLUGIN_LOG(PLUGIN_LOG_NORMAL, ("NPN_getvalue unhandled get value: %d\n", variable));
     return NPERR_GENERIC_ERROR;
   }
 }
@@ -2488,14 +2374,7 @@ _setvalue(NPP npp, NPPVariable variable, void *result)
       }
     }
 #endif
-#ifdef ANDROID
-  case kRequestDrawingModel_ANPSetValue:
-    if (inst)
-      inst->SetDrawingModel(NS_PTR_TO_INT32(result));
-    return NPERR_NO_ERROR;
-  case kAcceptEvents_ANPSetValue:
-    return NPERR_NO_ERROR;
-#endif
+
     default:
       return NPERR_GENERIC_ERROR;
   }
diff --git a/dom/plugins/base/nsNPAPIPluginInstance.cpp b/dom/plugins/base/nsNPAPIPluginInstance.cpp
index aa3f398acbaf..e104f07fc782 100644
--- a/dom/plugins/base/nsNPAPIPluginInstance.cpp
+++ b/dom/plugins/base/nsNPAPIPluginInstance.cpp
@@ -61,22 +61,13 @@
 #include "nsNetCID.h"
 #include "nsIContent.h"
 
-#ifdef ANDROID
-#include "ANPBase.h"
-#include <android/log.h>
-#include "android_npapi.h"
-#include "mozilla/Mutex.h"
-#include "mozilla/CondVar.h"
-#include "AndroidBridge.h"
-#endif
-
 using namespace mozilla;
 using namespace mozilla::plugins::parent;
 
 static NS_DEFINE_IID(kIOutputStreamIID, NS_IOUTPUTSTREAM_IID);
 static NS_DEFINE_IID(kIPluginStreamListenerIID, NS_IPLUGINSTREAMLISTENER_IID);
 
-NS_IMPL_THREADSAFE_ISUPPORTS0(nsNPAPIPluginInstance)
+NS_IMPL_ISUPPORTS0(nsNPAPIPluginInstance)
 
 nsNPAPIPluginInstance::nsNPAPIPluginInstance(nsNPAPIPlugin* plugin)
   :
@@ -86,10 +77,6 @@ nsNPAPIPluginInstance::nsNPAPIPluginInstance(nsNPAPIPlugin* plugin)
 #else
     mDrawingModel(NPDrawingModelQuickDraw),
 #endif
-#endif
-#ifdef ANDROID
-    mSurface(nsnull),
-    mDrawingModel(0),
 #endif
     mRunning(NOT_STARTED),
     mWindowless(PR_FALSE),
@@ -697,7 +684,7 @@ nsNPAPIPluginInstance::UsesDOMForCursor()
   return mUsesDOMForCursor;
 }
 
-#if defined(XP_MACOSX)
+#ifdef XP_MACOSX
 void nsNPAPIPluginInstance::SetDrawingModel(NPDrawingModel aModel)
 {
   mDrawingModel = aModel;
@@ -715,69 +702,12 @@ void nsNPAPIPluginInstance::SetEventModel(NPEventModel aModel)
 
   owner->SetEventModel(aModel);
 }
-#endif
-
-#if defined(ANDROID)
-void nsNPAPIPluginInstance::SetDrawingModel(PRUint32 aModel)
-{
-  mDrawingModel = aModel;
-}
-
-class SurfaceGetter : public nsRunnable {
-public:
-  SurfaceGetter(NPPluginFuncs* aPluginFunctions, NPP_t aNPP) : 
-    mHaveSurface(PR_FALSE), mPluginFunctions(aPluginFunctions), mNPP(aNPP) {
-    mLock = new Mutex("SurfaceGetter::Lock");
-    mCondVar = new CondVar(*mLock, "SurfaceGetter::CondVar");
-    
-  }
-  ~SurfaceGetter() {
-    delete mLock;
-    delete mCondVar;
-  }
-  nsresult Run() {
-    MutexAutoLock lock(*mLock);
-    (*mPluginFunctions->getvalue)(&mNPP, kJavaSurface_ANPGetValue, &mSurface);
-    mHaveSurface = PR_TRUE;
-    mCondVar->Notify();
-    return NS_OK;
-  }
-  void* GetSurface() {
-    MutexAutoLock lock(*mLock);
-    mHaveSurface = PR_FALSE;
-    AndroidBridge::Bridge()->PostToJavaThread(this);
-    while (!mHaveSurface)
-      mCondVar->Wait();
-    return mSurface;
-  }
-private:
-  NPP_t mNPP;
-  void* mSurface;
-  Mutex* mLock;
-  CondVar* mCondVar;
-  PRBool mHaveSurface;
-  NPPluginFuncs* mPluginFunctions;
-};
-
-
-void* nsNPAPIPluginInstance::GetJavaSurface()
-{
-  if (mDrawingModel != kSurface_ANPDrawingModel)
-    return nsnull;
-  
-  if (mSurface)
-    return mSurface;
-
-  nsCOMPtr<SurfaceGetter> sg = new SurfaceGetter(mPlugin->PluginFuncs(), mNPP);
-  mSurface = sg->GetSurface();
-  return mSurface;
-}
 
 #endif
 
 nsresult nsNPAPIPluginInstance::GetDrawingModel(PRInt32* aModel)
 {
-#if defined(XP_MACOSX) || defined(ANDROID)
+#ifdef XP_MACOSX
   *aModel = (PRInt32)mDrawingModel;
   return NS_OK;
 #else
@@ -876,12 +806,7 @@ nsNPAPIPluginInstance::DefineJavaProperties()
 nsresult
 nsNPAPIPluginInstance::IsWindowless(PRBool* isWindowless)
 {
-#ifdef ANDROID
-  // On android, pre-honeycomb, all plugins are treated as windowless.
-  *isWindowless = PR_TRUE;
-#else
   *isWindowless = mWindowless;
-#endif
   return NS_OK;
 }
 
@@ -1141,28 +1066,6 @@ nsNPAPIPluginInstance::PrivateModeStateChanged()
   return NS_ERROR_FAILURE;
 }
 
-class DelayUnscheduleEvent : public nsRunnable {
-public:
-  nsRefPtr<nsNPAPIPluginInstance> mInstance;
-  uint32_t mTimerID;
-  DelayUnscheduleEvent(nsNPAPIPluginInstance* aInstance, uint32_t aTimerId)
-    : mInstance(aInstance)
-    , mTimerID(aTimerId)
-  {}
-
-  ~DelayUnscheduleEvent() {}
-
-  NS_IMETHOD Run();
-};
-
-NS_IMETHODIMP
-DelayUnscheduleEvent::Run()
-{
-  mInstance->UnscheduleTimer(mTimerID);
-  return NS_OK;
-}
-
-
 static void
 PluginTimerCallback(nsITimer *aTimer, void *aClosure)
 {
@@ -1170,11 +1073,7 @@ PluginTimerCallback(nsITimer *aTimer, void *aClosure)
   NPP npp = t->npp;
   uint32_t id = t->id;
 
-  // Some plugins (Flash on Android) calls unscheduletimer
-  // from this callback.
-  t->inCallback = PR_TRUE;
   (*(t->callback))(npp, id);
-  t->inCallback = PR_FALSE;
 
   // Make sure we still have an instance and the timer is still alive
   // after the callback.
@@ -1208,7 +1107,6 @@ nsNPAPIPluginInstance::ScheduleTimer(uint32_t interval, NPBool repeat, void (*ti
 {
   nsNPAPITimer *newTimer = new nsNPAPITimer();
 
-  newTimer->inCallback = PR_FALSE;
   newTimer->npp = &mNPP;
 
   // generate ID that is unique to this instance
@@ -1246,12 +1144,6 @@ nsNPAPIPluginInstance::UnscheduleTimer(uint32_t timerID)
   if (!t)
     return;
 
-  if (t->inCallback) {
-    nsCOMPtr<nsIRunnable> e = new DelayUnscheduleEvent(this, timerID);
-    NS_DispatchToCurrentThread(e);
-    return;
-  }
-
   // cancel the timer
   t->timer->Cancel();
 
diff --git a/dom/plugins/base/nsNPAPIPluginInstance.h b/dom/plugins/base/nsNPAPIPluginInstance.h
index ef7cedd4e1a5..555ef755718b 100644
--- a/dom/plugins/base/nsNPAPIPluginInstance.h
+++ b/dom/plugins/base/nsNPAPIPluginInstance.h
@@ -68,7 +68,6 @@ public:
   uint32_t id;
   nsCOMPtr<nsITimer> timer;
   void (*callback)(NPP npp, uint32_t timerID);
-  PRBool inCallback;
 };
 
 class nsNPAPIPluginInstance : public nsISupports
@@ -86,9 +85,6 @@ public:
   nsresult NewStreamToPlugin(nsIPluginStreamListener** listener);
   nsresult NewStreamFromPlugin(const char* type, const char* target, nsIOutputStream* *result);
   nsresult Print(NPPrint* platformPrint);
-#ifdef ANDROID
-  nsresult PostEvent(void* event) { return 0; };
-#endif
   nsresult HandleEvent(void* event, PRInt16* result);
   nsresult GetValueFromPlugin(NPPVariable variable, void* value);
   nsresult GetDrawingModel(PRInt32* aModel);
@@ -145,11 +141,6 @@ public:
   void SetEventModel(NPEventModel aModel);
 #endif
 
-#ifdef ANDROID
-  void SetDrawingModel(PRUint32 aModel);
-  void* GetJavaSurface();
-#endif
-
   nsresult NewStreamListener(const char* aURL, void* notifyData,
                              nsIPluginStreamListener** listener);
 
@@ -216,10 +207,6 @@ protected:
   NPDrawingModel mDrawingModel;
 #endif
 
-#ifdef ANDROID
-  PRUint32 mDrawingModel;
-#endif
-
   enum {
     NOT_STARTED,
     RUNNING,
@@ -263,9 +250,6 @@ private:
   nsCOMPtr<nsIURI> mURI;
 
   PRPackedBool mUsePluginLayersPref;
-#ifdef ANDROID
-  void* mSurface;
-#endif
 };
 
 #endif // nsNPAPIPluginInstance_h_
diff --git a/dom/plugins/base/nsPluginHost.cpp b/dom/plugins/base/nsPluginHost.cpp
index 689e01b68743..7c2c5d13f454 100644
--- a/dom/plugins/base/nsPluginHost.cpp
+++ b/dom/plugins/base/nsPluginHost.cpp
@@ -159,11 +159,6 @@
 #include "winbase.h"
 #endif
 
-#ifdef ANDROID
-#include <android/log.h>
-#define LOG(args...)  __android_log_print(ANDROID_LOG_INFO, "GeckoPlugins" , ## args)
-#endif
-
 using namespace mozilla;
 using mozilla::TimeStamp;
 
@@ -2234,7 +2229,7 @@ nsresult nsPluginHost::ScanPluginsDirectoryList(nsISimpleEnumerator *dirEnum,
       nsCOMPtr<nsIFile> nextDir(do_QueryInterface(supports, &rv));
       if (NS_FAILED(rv))
         continue;
-      
+
       // don't pass aPluginsChanged directly to prevent it from been reset
       PRBool pluginschanged = PR_FALSE;
       ScanPluginsDirectory(nextDir, aCreatePluginList, &pluginschanged);
@@ -2329,10 +2324,6 @@ nsresult nsPluginHost::FindPlugins(PRBool aCreatePluginList, PRBool * aPluginsCh
       NS_ITERATIVE_UNREF_LIST(nsRefPtr<nsInvalidPluginTag>, mInvalidPlugins, mNext);
       return NS_OK;
     }
-  } else {
-#ifdef ANDROID
-    LOG("getting plugins dir failed");
-#endif
   }
 
   mPluginsLoaded = PR_TRUE; // at this point 'some' plugins have been loaded,
diff --git a/dom/plugins/base/nsPluginInstanceOwner.cpp b/dom/plugins/base/nsPluginInstanceOwner.cpp
index 89d6df61165b..54d98a6df3bc 100644
--- a/dom/plugins/base/nsPluginInstanceOwner.cpp
+++ b/dom/plugins/base/nsPluginInstanceOwner.cpp
@@ -44,8 +44,6 @@
  *
  * ***** END LICENSE BLOCK ***** */
 
-#include "base/basictypes.h"
-
 #ifdef MOZ_WIDGET_QT
 #include <QWidget>
 #include <QKeyEvent>
@@ -120,16 +118,6 @@ static NS_DEFINE_CID(kAppShellCID, NS_APPSHELL_CID);
 #include "gfxXlibNativeRenderer.h"
 #endif
 
-#ifdef ANDROID
-#include "ANPBase.h"
-#include "android_npapi.h"
-#include "AndroidBridge.h"
-using namespace mozilla::dom;
-
-#include <android/log.h>
-#define LOG(args...)  __android_log_print(ANDROID_LOG_INFO, "GeckoPlugins" , ## args)
-#endif
-
 using namespace mozilla;
 
 // special class for handeling DOM context menu events because for
@@ -1267,7 +1255,7 @@ nsresult nsPluginInstanceOwner::EnsureCachedAttrParamArrays()
 
   // Add PARAM and null separator.
   mCachedAttrParamNames [nextAttrParamIndex] = ToNewUTF8String(NS_LITERAL_STRING("PARAM"));
-  mCachedAttrParamValues[nextAttrParamIndex] = ToNewUTF8String(NS_LITERAL_STRING(""));
+  mCachedAttrParamValues[nextAttrParamIndex] = nsnull;
   nextAttrParamIndex++;
 
   // Add PARAM name/value pairs.
@@ -1652,48 +1640,8 @@ void nsPluginInstanceOwner::ScrollPositionDidChange(nscoord aX, nscoord aY)
 #endif
 }
 
-#ifdef ANDROID
-void nsPluginInstanceOwner::RemovePluginView()
-{
-  if (mInstance && mObjectFrame) {
-    void* surface = mInstance->GetJavaSurface();
-    if (surface) {
-      JNIEnv* env = GetJNIForThread();
-      if (env) {
-        jclass cls = env->FindClass("org/mozilla/gecko/GeckoAppShell");
-        jmethodID method = env->GetStaticMethodID(cls,
-                                                  "removePluginView",
-                                                  "(Landroid/view/View;)V");
-        env->CallStaticVoidMethod(cls, method, surface);
-      }
-    }
-  }
-}
-#endif
-
 nsresult nsPluginInstanceOwner::DispatchFocusToPlugin(nsIDOMEvent* aFocusEvent)
 {
-#ifdef ANDROID
-  {
-    ANPEvent event;
-    event.inSize = sizeof(ANPEvent);
-    event.eventType = kLifecycle_ANPEventType;
-
-    nsAutoString eventType;
-    aFocusEvent->GetType(eventType);
-    if (eventType.EqualsLiteral("focus")) {
-      event.data.lifecycle.action = kGainFocus_ANPLifecycleAction;
-    }
-    else if (eventType.EqualsLiteral("blur")) {
-      event.data.lifecycle.action = kLoseFocus_ANPLifecycleAction;
-    }
-    else {
-      NS_ASSERTION(PR_FALSE, "nsPluginInstanceOwner::DispatchFocusToPlugin, wierd eventType");   
-    }
-    mInstance->HandleEvent(&event, nsnull);
-  }
-#endif
-
 #ifndef XP_MACOSX
   if (!mPluginWindow || (mPluginWindow->type == NPWindowTypeWindow)) {
     // continue only for cases without child window
@@ -1964,6 +1912,8 @@ static unsigned int XInputEventState(const nsInputEvent& anEvent)
 
 nsEventStatus nsPluginInstanceOwner::ProcessEvent(const nsGUIEvent& anEvent)
 {
+  // printf("nsGUIEvent.message: %d\n", anEvent.message);
+
   nsEventStatus rv = nsEventStatus_eIgnore;
 
   if (!mInstance || !mObjectFrame)   // if mInstance is null, we shouldn't be here
@@ -2486,107 +2436,6 @@ nsEventStatus nsPluginInstanceOwner::ProcessEvent(const nsGUIEvent& anEvent)
     rv = nsEventStatus_eConsumeNoDefault;
 #endif
 
-#ifdef ANDROID
-  // this code supports windowless plugins
-  {
-    // The plugin needs focus to receive keyboard and touch events
-    nsIFocusManager* fm = nsFocusManager::GetFocusManager();
-    if (fm) {
-      nsCOMPtr<nsIDOMElement> elem = do_QueryInterface(mContent);
-      fm->SetFocus(elem, 0);
-    }
-  }
-  switch(anEvent.eventStructType)
-    {
-    case NS_MOUSE_EVENT:
-      {
-        switch (anEvent.message)
-          {
-          case NS_MOUSE_CLICK:
-          case NS_MOUSE_DOUBLECLICK:
-            // Button up/down events sent instead.
-            return rv;
-          }
-
-        // Get reference point relative to plugin origin.
-        const nsPresContext* presContext = mObjectFrame->PresContext();
-        nsPoint appPoint =
-          nsLayoutUtils::GetEventCoordinatesRelativeTo(&anEvent, mObjectFrame) -
-          mObjectFrame->GetContentRectRelativeToSelf().TopLeft();
-        nsIntPoint pluginPoint(presContext->AppUnitsToDevPixels(appPoint.x),
-                               presContext->AppUnitsToDevPixels(appPoint.y));
-
-        switch (anEvent.message)
-          {
-          case NS_MOUSE_MOVE:
-            {
-              // are these going to be touch events?
-              // pluginPoint.x;
-              // pluginPoint.y;
-            }
-            break;
-          case NS_MOUSE_BUTTON_DOWN:
-            {
-              ANPEvent event;
-              event.inSize = sizeof(ANPEvent);
-              event.eventType = kMouse_ANPEventType;
-              event.data.mouse.action = kDown_ANPMouseAction;
-              event.data.mouse.x = pluginPoint.x;
-              event.data.mouse.y = pluginPoint.y;
-              mInstance->HandleEvent(&event, nsnull);
-            }
-            break;
-          case NS_MOUSE_BUTTON_UP:
-            {
-              ANPEvent event;
-              event.inSize = sizeof(ANPEvent);
-              event.eventType = kMouse_ANPEventType;
-              event.data.mouse.action = kUp_ANPMouseAction;
-              event.data.mouse.x = pluginPoint.x;
-              event.data.mouse.y = pluginPoint.y;
-              mInstance->HandleEvent(&event, nsnull);
-            }
-            break;
-          }
-      }
-      break;
-
-    case NS_KEY_EVENT:
-     {
-       const nsKeyEvent& keyEvent = static_cast<const nsKeyEvent&>(anEvent);
-       LOG("Firing NS_KEY_EVENT %d %d\n", keyEvent.keyCode, keyEvent.charCode);
-       
-       int modifiers = 0;
-       if (keyEvent.isShift)
-         modifiers |= kShift_ANPKeyModifier;
-       if (keyEvent.isAlt)
-         modifiers |= kAlt_ANPKeyModifier;
-
-       ANPEvent event;
-       event.inSize = sizeof(ANPEvent);
-       event.eventType = kKey_ANPEventType;
-       event.data.key.nativeCode = keyEvent.keyCode;
-       event.data.key.virtualCode = keyEvent.charCode;
-       event.data.key.modifiers = modifiers;
-       event.data.key.repeatCount = 0;
-       event.data.key.unichar = 0;
-       switch (anEvent.message)
-         {
-         case NS_KEY_DOWN:
-           event.data.key.action = kDown_ANPKeyAction;
-           mInstance->HandleEvent(&event, nsnull);
-           break;
-           
-         case NS_KEY_UP:
-           event.data.key.action = kUp_ANPKeyAction;
-           mInstance->HandleEvent(&event, nsnull);
-           break;
-         }
-     }
-    }
-    rv = nsEventStatus_eConsumeNoDefault;
-#endif
- 
   return rv;
 }
 
@@ -2692,10 +2541,6 @@ nsPluginInstanceOwner::PrepareToStop(PRBool aDelayedStop)
   }
 #endif
 
-#ifdef ANDROID
-  RemovePluginView();
-#endif
-
   // Unregister scroll position listeners
   for (nsIFrame* f = mObjectFrame; f; f = nsLayoutUtils::GetCrossDocParentFrame(f)) {
     nsIScrollableFrame* sf = do_QueryFrame(f);
@@ -2792,138 +2637,6 @@ void nsPluginInstanceOwner::Paint(const nsRect& aDirtyRect, HPS aHPS)
 }
 #endif
 
-#ifdef ANDROID
-
-class AndroidPaintEventRunnable : public nsRunnable
-{
-public:
-  AndroidPaintEventRunnable(void* aSurface, nsNPAPIPluginInstance* inst, const gfxRect& aFrameRect)
-    : mSurface(aSurface), mInstance(inst), mFrameRect(aFrameRect) {
-  }
-
-  ~AndroidPaintEventRunnable() {
-  }
-
-  NS_IMETHOD Run()
-  {
-    LOG("%p - AndroidPaintEventRunnable::Run\n", this);
-
-    if (!mInstance || !mSurface)
-      return NS_OK;
-
-    // This needs to happen on the gecko main thread.
-    JNIEnv* env = GetJNIForThread();
-    jclass cls = env->FindClass("org/mozilla/gecko/GeckoAppShell");
-    jmethodID method = env->GetStaticMethodID(cls,
-                                              "addPluginView",
-                                              "(Landroid/view/View;DDDD)V");
-    env->CallStaticVoidMethod(cls,
-                              method,
-                              mSurface,
-                              mFrameRect.x,
-                              mFrameRect.y,
-                              mFrameRect.width,
-                              mFrameRect.height);
-    return NS_OK;
-  }
-private:
-  void* mSurface;
-  nsCOMPtr<nsNPAPIPluginInstance> mInstance;
-  gfxRect mFrameRect;
-};
-
-
-void nsPluginInstanceOwner::Paint(gfxContext* aContext,
-                                  const gfxRect& aFrameRect,
-                                  const gfxRect& aDirtyRect)
-{
-  if (!mInstance || !mObjectFrame)
-    return;
-
-  PRInt32 model;
-  mInstance->GetDrawingModel(&model);
-
-  if (model == kSurface_ANPDrawingModel) {
-
-    {
-      ANPEvent event;
-      event.inSize = sizeof(ANPEvent);
-      event.eventType = kLifecycle_ANPEventType;
-      event.data.lifecycle.action = kOnScreen_ANPLifecycleAction;
-      mInstance->HandleEvent(&event, nsnull);
-    }
-
-    /*
-    gfxMatrix currentMatrix = aContext->CurrentMatrix();
-    gfxSize scale = currentMatrix.ScaleFactors(PR_TRUE);
-    printf_stderr("!!!!!!!! scale!!:  %f x %f\n", scale.width, scale.height);
-    */
-
-    JNIEnv* env = GetJNIForThread();
-    jclass cls = env->FindClass("org/mozilla/gecko/GeckoAppShell");
-    jmethodID method = env->GetStaticMethodID(cls,
-                                              "addPluginView",
-                                              "(Landroid/view/View;DDDD)V");
-    env->CallStaticVoidMethod(cls,
-                              method,
-                              mInstance->GetJavaSurface(),
-                              aFrameRect.x,
-                              aFrameRect.y,
-                              aFrameRect.width,
-                              aFrameRect.height);
-    return;
-  }
-
-  if (model != kBitmap_ANPDrawingModel)
-    return;
-
-#ifdef ANP_BITMAP_DRAWING_MODEL
-  static nsRefPtr<gfxImageSurface> pluginSurface;
-
-  if (pluginSurface == nsnull ||
-      aFrameRect.width  != pluginSurface->Width() ||
-      aFrameRect.height != pluginSurface->Height()) {
-
-    pluginSurface = new gfxImageSurface(gfxIntSize(aFrameRect.width, aFrameRect.height), 
-                                        gfxImageSurface::ImageFormatARGB32);
-    if (!pluginSurface)
-      return;
-  }
-
-  // Clears buffer.  I think this is needed.
-  nsRefPtr<gfxContext> ctx = new gfxContext(pluginSurface);
-  ctx->SetOperator(gfxContext::OPERATOR_CLEAR);
-  ctx->Paint();
-  
-  ANPEvent event;
-  event.inSize = sizeof(ANPEvent);
-  event.eventType = 4;
-  event.data.draw.model = 1;
-  
-  event.data.draw.clip.top     = 0;
-  event.data.draw.clip.left    = 0;
-  event.data.draw.clip.bottom  = aFrameRect.width;
-  event.data.draw.clip.right   = aFrameRect.height;
-  
-  event.data.draw.data.bitmap.format   = kRGBA_8888_ANPBitmapFormat;
-  event.data.draw.data.bitmap.width    = aFrameRect.width;
-  event.data.draw.data.bitmap.height   = aFrameRect.height;
-  event.data.draw.data.bitmap.baseAddr = pluginSurface->Data();
-  event.data.draw.data.bitmap.rowBytes = aFrameRect.width * 4;
-  
-  if (!mInstance)
-    return;
-    
-  mInstance->HandleEvent(&event, nsnull);
-
-  aContext->SetOperator(gfxContext::OPERATOR_SOURCE);
-  aContext->SetSource(pluginSurface, gfxPoint(aFrameRect.x, aFrameRect.y));
-  aContext->Clip(aFrameRect);
-  aContext->Paint();
-#endif
-}
-#endif
-
 #if defined(MOZ_X11)
 void nsPluginInstanceOwner::Paint(gfxContext* aContext,
                                   const gfxRect& aFrameRect,
@@ -3561,28 +3274,9 @@ void nsPluginInstanceOwner::UpdateWindowPositionAndClipRect(PRBool aSetWindow)
   if (mPluginWindowVisible && mPluginDocumentActiveState) {
     mPluginWindow->clipRect.right = mPluginWindow->width;
     mPluginWindow->clipRect.bottom = mPluginWindow->height;
-#ifdef ANDROID
-    if (mInstance) {
-      ANPEvent event;
-      event.inSize = sizeof(ANPEvent);
-      event.eventType = kLifecycle_ANPEventType;
-      event.data.lifecycle.action = kOnScreen_ANPLifecycleAction;
-      mInstance->HandleEvent(&event, nsnull);
-    }
-#endif
   } else {
     mPluginWindow->clipRect.right = 0;
     mPluginWindow->clipRect.bottom = 0;
-#ifdef ANDROID
-    if (mInstance) {
-      ANPEvent event;
-      event.inSize = sizeof(ANPEvent);
-      event.eventType = kLifecycle_ANPEventType;
-      event.data.lifecycle.action = kOffScreen_ANPLifecycleAction;
-      mInstance->HandleEvent(&event, nsnull);
-    }
-    RemovePluginView();
-#endif
   }
 
   if (!aSetWindow)
diff --git a/dom/plugins/base/nsPluginInstanceOwner.h b/dom/plugins/base/nsPluginInstanceOwner.h
index f5f23ddb07f8..682087105d97 100644
--- a/dom/plugins/base/nsPluginInstanceOwner.h
+++ b/dom/plugins/base/nsPluginInstanceOwner.h
@@ -144,7 +144,7 @@ public:
   void Paint(const gfxRect& aDirtyRect, CGContextRef cgContext);  
   void RenderCoreAnimation(CGContextRef aCGContext, int aWidth, int aHeight);
   void DoCocoaEventDrawRect(const gfxRect& aDrawRect, CGContextRef cgContext);
-#elif defined(MOZ_X11) || defined(ANDROID)
+#elif defined(MOZ_X11)
   void Paint(gfxContext* aContext,
              const gfxRect& aFrameRect,
              const gfxRect& aDirtyRect);
@@ -308,10 +308,7 @@ private:
   }
   
   void FixUpURLS(const nsString &name, nsAString &value);
-#ifdef ANDROID
-  void RemovePluginView();
-#endif 
- 
+  
   nsPluginNativeWindow       *mPluginWindow;
   nsRefPtr<nsNPAPIPluginInstance> mInstance;
   nsObjectFrame              *mObjectFrame; // owns nsPluginInstanceOwner
diff --git a/dom/plugins/base/nsPluginsDirUnix.cpp b/dom/plugins/base/nsPluginsDirUnix.cpp
index f761d1d2a157..ea8170a938bf 100644
--- a/dom/plugins/base/nsPluginsDirUnix.cpp
+++ b/dom/plugins/base/nsPluginsDirUnix.cpp
@@ -247,16 +247,6 @@ PRBool nsPluginsDir::IsPluginFile(nsIFile* file)
     if (NS_FAILED(file->GetNativeLeafName(filename)))
         return PR_FALSE;
 
-#ifdef ANDROID
-    // It appears that if you load
-    // 'libstagefright_honeycomb.so' on froyo, or
-    // 'libstagefright_froyo.so' on honeycomb, we will abort.
-    // Since these are just helper libs, we can ignore.
-    const char *cFile = filename.get();
-    if (strstr(cFile, "libstagefright") != NULL)
-        return PR_FALSE;
-#endif
-
     NS_NAMED_LITERAL_CSTRING(dllSuffix, LOCAL_PLUGIN_DLL_SUFFIX);
     if (filename.Length() > dllSuffix.Length() &&
         StringEndsWith(filename, dllSuffix))
diff --git a/embedding/android/AndroidManifest.xml.in b/embedding/android/AndroidManifest.xml.in
index 240f516be1d6..3b7eb3661968 100644
--- a/embedding/android/AndroidManifest.xml.in
+++ b/embedding/android/AndroidManifest.xml.in
@@ -19,13 +19,6 @@
     <uses-permission android:name="android.permission.READ_PHONE_STATE"/>
     <uses-permission android:name="com.android.launcher.permission.INSTALL_SHORTCUT"/>
 
-    <uses-permission android:name="android.permission.READ_LOGS"/>
-    <uses-permission android:name="android.permission.WAKE_LOCK"/>
-    <uses-permission android:name="android.permission.ACCESS_WIFI_STATE"/>
-    <uses-permission android:name="android.permission.CHANGE_NETWORK_STATE"/> 
-    <uses-permission android:name="android.permission.ACCESS_NETWORK_STATE"/>
-    <uses-permission android:name="android.permission.CHANGE_NETWORK_STATE"/>
-
     <uses-feature android:name="android.hardware.location" android:required="false"/>
     <uses-feature android:name="android.hardware.location.gps" android:required="false"/>
     <uses-feature android:name="android.hardware.touchscreen"/>
diff --git a/embedding/android/GeckoApp.java b/embedding/android/GeckoApp.java
index 02765866361b..d4b1c5c9f982 100644
--- a/embedding/android/GeckoApp.java
+++ b/embedding/android/GeckoApp.java
@@ -45,7 +45,6 @@ import java.util.zip.*;
 import java.nio.*;
 import java.nio.channels.FileChannel;
 import java.util.concurrent.*;
-import java.lang.reflect.*;
 
 import android.os.*;
 import android.app.*;
@@ -63,9 +62,6 @@ import android.net.*;
 import android.database.*;
 import android.provider.*;
 import android.telephony.*;
-import android.content.pm.*;
-import android.content.pm.PackageManager.*;
-import dalvik.system.*;
 
 abstract public class GeckoApp
     extends Activity
@@ -78,7 +74,7 @@ abstract public class GeckoApp
     public static final String ACTION_DEBUG       = "org.mozilla.gecko.DEBUG";
     public static final String ACTION_BOOKMARK    = "org.mozilla.gecko.BOOKMARK";
 
-    public static AbsoluteLayout mainLayout;
+    public static FrameLayout mainLayout;
     public static GeckoSurfaceView surfaceView;
     public static GeckoApp mAppContext;
     public static boolean mFullscreen = false;
@@ -134,151 +130,6 @@ abstract public class GeckoApp
                                }).show();
     }
 
-    public static final String PLUGIN_ACTION = "android.webkit.PLUGIN";
-
-    /**
-     * A plugin that wish to be loaded in the WebView must provide this permission
-     * in their AndroidManifest.xml.
-     */
-    public static final String PLUGIN_PERMISSION = "android.webkit.permission.PLUGIN";
-
-    private static final String LOGTAG = "PluginManager";
-
-    private static final String PLUGIN_SYSTEM_LIB = "/system/lib/plugins/";
-
-    private static final String PLUGIN_TYPE = "type";
-    private static final String TYPE_NATIVE = "native";
-    public ArrayList<PackageInfo> mPackageInfoCache = new ArrayList<PackageInfo>();
-
-    String[] getPluginDirectories() {
-
-        ArrayList<String> directories = new ArrayList<String>();
-        PackageManager pm = this.mAppContext.getPackageManager();
-        List<ResolveInfo> plugins = pm.queryIntentServices(new Intent(PLUGIN_ACTION),
-                PackageManager.GET_SERVICES | PackageManager.GET_META_DATA);
-
-        synchronized(mPackageInfoCache) {
-
-            // clear the list of existing packageInfo objects
-            mPackageInfoCache.clear();
-
-
-            for (ResolveInfo info : plugins) {
-
-                // retrieve the plugin's service information
-                ServiceInfo serviceInfo = info.serviceInfo;
-                if (serviceInfo == null) {
-                    Log.w(LOGTAG, "Ignore bad plugin");
-                    continue;
-                }
-
-                Log.w(LOGTAG, "Loading plugin: " + serviceInfo.packageName);
-
-
-                // retrieve information from the plugin's manifest
-                PackageInfo pkgInfo;
-                try {
-                    pkgInfo = pm.getPackageInfo(serviceInfo.packageName,
-                                    PackageManager.GET_PERMISSIONS
-                                    | PackageManager.GET_SIGNATURES);
-                } catch (Exception e) {
-                    Log.w(LOGTAG, "Can't find plugin: " + serviceInfo.packageName);
-                    continue;
-                }
-                if (pkgInfo == null) {
-                    Log.w(LOGTAG, "Loading plugin: " + serviceInfo.packageName + ". Could not load package information.");
-                    continue;
-                }
-
-                /*
-                 * find the location of the plugin's shared library. The default
-                 * is to assume the app is either a user installed app or an
-                 * updated system app. In both of these cases the library is
-                 * stored in the app's data directory.
-                 */
-                String directory = pkgInfo.applicationInfo.dataDir + "/lib";
-                final int appFlags = pkgInfo.applicationInfo.flags;
-                final int updatedSystemFlags = ApplicationInfo.FLAG_SYSTEM |
-                                               ApplicationInfo.FLAG_UPDATED_SYSTEM_APP;
-                // preloaded system app with no user updates
-                if ((appFlags & updatedSystemFlags) == ApplicationInfo.FLAG_SYSTEM) {
-                    directory = PLUGIN_SYSTEM_LIB + pkgInfo.packageName;
-                }
-
-                // check if the plugin has the required permissions
-                String permissions[] = pkgInfo.requestedPermissions;
-                if (permissions == null) {
-                    Log.w(LOGTAG, "Loading plugin: " + serviceInfo.packageName + ". Does not have required permission.");
-                    continue;
-                }
-                boolean permissionOk = false;
-                for (String permit : permissions) {
-                    if (PLUGIN_PERMISSION.equals(permit)) {
-                        permissionOk = true;
-                        break;
-                    }
-                }
-                if (!permissionOk) {
-                    Log.w(LOGTAG, "Loading plugin: " + serviceInfo.packageName + ". Does not have required permission (2).");
-                    continue;
-                }
-
-                // check to ensure the plugin is properly signed
-                Signature signatures[] = pkgInfo.signatures;
-                if (signatures == null) {
-                    Log.w(LOGTAG, "Loading plugin: " + serviceInfo.packageName + ". Not signed.");
-                    continue;
-                }
-
-                // determine the type of plugin from the manifest
-                if (serviceInfo.metaData == null) {
-                    Log.e(LOGTAG, "The plugin '" + serviceInfo.name + "' has no type defined");
-                    continue;
-                }
-
-                String pluginType = serviceInfo.metaData.getString(PLUGIN_TYPE);
-                if (!TYPE_NATIVE.equals(pluginType)) {
-                    Log.e(LOGTAG, "Unrecognized plugin type: " + pluginType);
-                    continue;
-                }
-
-                try {
-                    Class<?> cls = getPluginClass(serviceInfo.packageName, serviceInfo.name);
-
-                    //TODO implement any requirements of the plugin class here!
-                    boolean classFound = true;
-
-                    if (!classFound) {
-                        Log.e(LOGTAG, "The plugin's class' " + serviceInfo.name + "' does not extend the appropriate class.");
-                        continue;
-                    }
-
-                } catch (NameNotFoundException e) {
-                    Log.e(LOGTAG, "Can't find plugin: " + serviceInfo.packageName);
-                    continue;
-                } catch (ClassNotFoundException e) {
-                    Log.e(LOGTAG, "Can't find plugin's class: " + serviceInfo.name);
-                    continue;
-                }
-
-                // if all checks have passed then make the plugin available
-                mPackageInfoCache.add(pkgInfo);
-                directories.add(directory);
-            }
-        }
-
-        return directories.toArray(new String[directories.size()]);
-    }
-
-    Class<?> getPluginClass(String packageName, String className)
-            throws NameNotFoundException, ClassNotFoundException {
-        Context pluginContext = this.mAppContext.createPackageContext(packageName,
-                Context.CONTEXT_INCLUDE_CODE |
-                Context.CONTEXT_IGNORE_SECURITY);
-        ClassLoader pluginCL = pluginContext.getClassLoader();
-        return pluginCL.loadClass(className);
-    }
-
     // Returns true when the intent is going to be handled by gecko launch
     boolean launch(Intent intent)
     {
@@ -378,14 +229,13 @@ abstract public class GeckoApp
         if (surfaceView == null)
             surfaceView = new GeckoSurfaceView(this);
         else
-            mainLayout.removeAllViews();
+            mainLayout.removeView(surfaceView);
 
-        mainLayout = new AbsoluteLayout(this);
+        mainLayout = new FrameLayout(this);
         mainLayout.addView(surfaceView,
-                           new AbsoluteLayout.LayoutParams(AbsoluteLayout.LayoutParams.MATCH_PARENT, // level 8
-                                                           AbsoluteLayout.LayoutParams.MATCH_PARENT,
-                                                           0,
-                                                           0));
+                           new FrameLayout.LayoutParams(FrameLayout.LayoutParams.FILL_PARENT,
+                                                        FrameLayout.LayoutParams.FILL_PARENT));
+
         setContentView(mainLayout,
                        new ViewGroup.LayoutParams(ViewGroup.LayoutParams.FILL_PARENT,
                                                   ViewGroup.LayoutParams.FILL_PARENT));
diff --git a/embedding/android/GeckoAppShell.java b/embedding/android/GeckoAppShell.java
index 7625e9d0dc10..e0957678c427 100644
--- a/embedding/android/GeckoAppShell.java
+++ b/embedding/android/GeckoAppShell.java
@@ -308,19 +308,6 @@ public class GeckoAppShell
             if (intHome != null && intProf != null && intProf.exists())
                 moveDir(intProf, profileDir);
         }
-        try {
-            String[] dirs = GeckoApp.mAppContext.getPluginDirectories();
-            StringBuffer pluginSearchPath = new StringBuffer();
-            for (int i = 0; i < dirs.length; i++) {
-                Log.i("GeckoPlugins", "dir: " + dirs[i]);
-                pluginSearchPath.append(dirs[i]);
-                pluginSearchPath.append(":");
-            }
-            GeckoAppShell.putenv("MOZ_PLUGIN_PATH="+pluginSearchPath);
-        } catch (Exception ex) {
-            Log.i("GeckoPlugins", "exception getting plugin dirs", ex);
-        }
-
         GeckoAppShell.putenv("HOME=" + homeDir);
         GeckoAppShell.putenv("GRE_HOME=" + GeckoApp.sGREDir.getPath());
         Intent i = geckoApp.getIntent();
@@ -408,7 +395,6 @@ public class GeckoAppShell
             combinedArgs += " " + args;
         if (url != null)
             combinedArgs += " " + url;
-
         // and go
         GeckoAppShell.nativeRun(combinedArgs);
     }
@@ -1399,187 +1385,4 @@ public class GeckoAppShell
             return false;
         }
     }
-    public static void addPluginView(final View view,
-                                     final double x, final double y,
-                                     final double w, final double h) {
-
-        Log.i("GeckoAppShell", "addPluginView:" + view + " @ x:" + x + " y:" + y + " w:" + w + " h:" + h ) ;
-
-        getMainHandler().post(new Runnable() { 
-                public void run() {
-                    AbsoluteLayout.LayoutParams lp = new AbsoluteLayout.LayoutParams((int)w,
-                                                                                     (int)h,
-                                                                                     (int)x,
-                                                                                     (int)y);
-
-                    if (GeckoApp.mainLayout.indexOfChild(view) == -1) {
-                        view.setWillNotDraw(false);
-                        if(view instanceof SurfaceView)
-                            ((SurfaceView)view).setZOrderOnTop(true);
-
-                        GeckoApp.mainLayout.addView(view, lp);
-                    }
-                    else
-                    {
-                        try {
-                            GeckoApp.mainLayout.updateViewLayout(view, lp);
-                        } catch (IllegalArgumentException e) {
-                            Log.i("updateViewLayout - IllegalArgumentException", "e:" + e);
-                            // it can be the case where we
-                            // get an update before the view
-                            // is actually attached.
-                        }
-                    }
-                }
-            });
-    }
-
-    public static void removePluginView(final View view) {
-        Log.i("GeckoAppShell", "remove view:" + view);
-        getMainHandler().post(new Runnable() { 
-                public void run() {
-                    try {
-                        GeckoApp.mainLayout.removeView(view);
-                    } catch (Exception e) {}
-                }
-            });
-    }
-
-    public static Class<?> loadPluginClass(String className, String libName) {
-        Log.i("GeckoAppShell", "in loadPluginClass... attempting to access className, then libName.....");
-        Log.i("GeckoAppShell", "className: " + className);
-        Log.i("GeckoAppShell", "libName: " + libName);
-
-        try {
-            String[] split = libName.split("/");
-            String packageName = split[split.length - 3];
-            Log.i("GeckoAppShell", "load \"" + className + "\" from \"" + packageName + 
-                  "\" for \"" + libName + "\"");
-            Context pluginContext = 
-                GeckoApp.mAppContext.createPackageContext(packageName,
-                                                          Context.CONTEXT_INCLUDE_CODE |
-                                                      Context.CONTEXT_IGNORE_SECURITY);
-            ClassLoader pluginCL = pluginContext.getClassLoader();
-            return pluginCL.loadClass(className);
-        } catch (java.lang.ClassNotFoundException cnfe) {
-            Log.i("GeckoAppShell", "class not found", cnfe);
-        } catch (android.content.pm.PackageManager.NameNotFoundException nnfe) {
-            Log.i("GeckoAppShell", "package not found", nnfe);
-        }
-        Log.e("GeckoAppShell", "couldn't find class");
-        return null;
-    }
-
-    static HashMap<SurfaceView, SurfaceLockInfo> sSufaceMap = new HashMap<SurfaceView, SurfaceLockInfo>();
-
-    public static void lockSurfaceANP()
-    {
-         Log.i("GeckoAppShell", "other lockSurfaceANP");
-    }
-
-    public static org.mozilla.gecko.SurfaceLockInfo lockSurfaceANP(android.view.SurfaceView sview, int top, int left, int bottom, int right)
-    {
-        Log.i("GeckoAppShell", "real lockSurfaceANP " + sview + ", " + top + ",  " + left + ", " + bottom + ", " + right);
-        if (sview == null)
-            return null;
-
-        int format = -1;
-        try {
-            Field privateFormatField = SurfaceView.class.getDeclaredField("mFormat");
-            privateFormatField.setAccessible(true);
-            format = privateFormatField.getInt(sview);
-        } catch (Exception e) {
-            Log.i("GeckoAppShell", "mFormat is not a field of sview: ", e);
-        }
-
-        int n = 0;
-        if (format == PixelFormat.RGB_565)
-            n = 2;
-        else if (format == PixelFormat.RGBA_8888)
-            n = 4;
-
-        if (n == 0)
-            return null;
-
-        SurfaceLockInfo info = sSufaceMap.get(sview);
-        if (info == null) {
-            info = new SurfaceLockInfo();
-            sSufaceMap.put(sview, info);
-        }
-
-        Rect r = new Rect(left, top, right, bottom);
-
-        info.canvas = sview.getHolder().lockCanvas(r);
-        int bufSizeRequired = info.canvas.getWidth() * info.canvas.getHeight() * n;
-        Log.i("GeckoAppShell", "lockSurfaceANP - bufSizeRequired: " + n + " " + info.canvas.getHeight() + " " + info.canvas.getWidth());
-
-        if (info.width != info.canvas.getWidth() || info.height != info.canvas.getHeight() || info.buffer == null || info.buffer.capacity() < bufSizeRequired) {
-            info.width = info.canvas.getWidth();
-            info.height = info.canvas.getHeight();
-
-            // XXX Bitmaps instead of ByteBuffer
-            info.buffer = ByteBuffer.allocateDirect(bufSizeRequired);  //leak
-            Log.i("GeckoAppShell", "!!!!!!!!!!!  lockSurfaceANP - Allocating buffer! " + bufSizeRequired);
-
-        }
-
-        info.canvas.drawColor(Color.WHITE, PorterDuff.Mode.CLEAR);
-
-        info.format = format;
-        info.dirtyTop = top;
-        info.dirtyBottom = bottom;
-        info.dirtyLeft = left;
-        info.dirtyRight = right;
-
-        return info;
-    }
-
-    public static void unlockSurfaceANP(SurfaceView sview) {
-        SurfaceLockInfo info = sSufaceMap.get(sview);
-
-        int n = 0;
-        Bitmap.Config config;
-        if (info.format == PixelFormat.RGB_565) {
-            n = 2;
-            config = Bitmap.Config.RGB_565;
-        } else {
-            n = 4;
-            config = Bitmap.Config.ARGB_8888;
-        }
-
-        Log.i("GeckoAppShell", "unlockSurfaceANP: " + (info.width * info.height * n));
-
-        Bitmap bm = Bitmap.createBitmap(info.width, info.height, config);
-        bm.copyPixelsFromBuffer(info.buffer);
-        info.canvas.drawBitmap(bm, 0, 0, null);
-        sview.getHolder().unlockCanvasAndPost(info.canvas);
-    }
-
-    public static Class getSurfaceLockInfoClass() {
-        Log.i("GeckoAppShell", "class name: " + SurfaceLockInfo.class.getName());
-        return SurfaceLockInfo.class;
-    }
-
-    public static Method getSurfaceLockMethod() {
-        Method[] m = GeckoAppShell.class.getMethods();
-        for (int i = 0; i < m.length; i++) {
-            if (m[i].getName().equals("lockSurfaceANP"))
-                return m[i];
-        }
-        return null;
-    }
-
-    static native void executeNextRunnable();
-
-    static class GeckoRunnableCallback implements Runnable {
-        public void run() {
-            Log.i("GeckoShell", "run GeckoRunnableCallback");
-            GeckoAppShell.executeNextRunnable();
-        }
-    }
-
-    public static void postToJavaThread(boolean mainThread) {
-        Log.i("GeckoShell", "post to " + (mainThread ? "main " : "") + "java thread");
-        getMainHandler().post(new GeckoRunnableCallback());
-    }
 }
diff --git a/embedding/android/Makefile.in b/embedding/android/Makefile.in
index c6a4101e37f5..ebda01b067b0 100644
--- a/embedding/android/Makefile.in
+++ b/embedding/android/Makefile.in
@@ -54,7 +54,6 @@ JAVAFILES = \
   GeckoInputConnection.java \
   GeckoPhoneStateListener.java \
   AlertNotification.java \
-  SurfaceLockInfo.java \
   $(NULL)
 
 PROCESSEDJAVAFILES = \
diff --git a/embedding/android/SurfaceLockInfo.java b/embedding/android/SurfaceLockInfo.java
deleted file mode 100644
index 4dcb7dc2b6a3..000000000000
--- a/embedding/android/SurfaceLockInfo.java
+++ /dev/null
@@ -1,18 +0,0 @@
-package org.mozilla.gecko;
-
-import android.graphics.Canvas;
-import java.nio.Buffer;
-
-public class SurfaceLockInfo {
-    public int dirtyTop;
-    public int dirtyLeft;
-    public int dirtyRight;
-    public int dirtyBottom;
-
-    public int bpr;
-    public int format;
-    public int width;
-    public int height;
-    public Buffer buffer;
-    public Canvas canvas;
-}
diff --git a/layout/build/Makefile.in b/layout/build/Makefile.in
index 4da911a5725f..03fc6bfb757c 100644
--- a/layout/build/Makefile.in
+++ b/layout/build/Makefile.in
@@ -135,7 +135,6 @@ LOCAL_INCLUDES	+= \
 else ifneq (,$(filter android,$(MOZ_WIDGET_TOOLKIT)))
 SHARED_LIBRARY_LIBS += \
 	$(DEPTH)/dom/system/android/$(LIB_PREFIX)domsystemandroid_s.$(LIB_SUFFIX) \
-	$(DEPTH)/dom/plugins/base/android/$(LIB_PREFIX)gkpluginandroid_s.$(LIB_SUFFIX) \
 	$(NULL)
 LOCAL_INCLUDES	+= \
 	-I$(topsrcdir)/dom/system/android \
diff --git a/layout/generic/nsObjectFrame.cpp b/layout/generic/nsObjectFrame.cpp
index 09e3b6f654c3..ad1503ae984d 100644
--- a/layout/generic/nsObjectFrame.cpp
+++ b/layout/generic/nsObjectFrame.cpp
@@ -1683,22 +1683,6 @@ nsObjectFrame::PaintPlugin(nsDisplayListBuilder* aBuilder,
                            nsRenderingContext& aRenderingContext,
                            const nsRect& aDirtyRect, const nsRect& aPluginRect)
 {
-#if defined(ANDROID)
-  if (mInstanceOwner) {
-    NPWindow *window;
-    mInstanceOwner->GetWindow(window);
-
-    gfxRect frameGfxRect =
-      PresContext()->AppUnitsToGfxUnits(aPluginRect);
-    gfxRect dirtyGfxRect =
-      PresContext()->AppUnitsToGfxUnits(aDirtyRect);
-    gfxContext* ctx = aRenderingContext.ThebesContext();
-
-    mInstanceOwner->Paint(ctx, frameGfxRect, dirtyGfxRect);
-    return;
-  }
-#endif
-
   // Screen painting code
 #if defined(XP_MACOSX)
   // delegate all painting to the plugin instance.
diff --git a/other-licenses/android/APKOpen.cpp b/other-licenses/android/APKOpen.cpp
index d70efc306333..a917703a7511 100644
--- a/other-licenses/android/APKOpen.cpp
+++ b/other-licenses/android/APKOpen.cpp
@@ -241,7 +241,6 @@ SHELL_WRAPPER3(callObserver, jstring, jstring, jstring)
 SHELL_WRAPPER1(removeObserver, jstring)
 SHELL_WRAPPER2(onChangeNetworkLinkStatus, jstring, jstring)
 SHELL_WRAPPER1(reportJavaCrash, jstring)
-SHELL_WRAPPER0(executeNextRunnable)
 
 static void * xul_handle = NULL;
 static time_t apk_mtime = 0;
@@ -668,7 +667,6 @@ loadLibs(const char *apkName)
   GETFUNC(removeObserver);
   GETFUNC(onChangeNetworkLinkStatus);
   GETFUNC(reportJavaCrash);
-  GETFUNC(executeNextRunnable);
 #undef GETFUNC
   gettimeofday(&t1, 0);
   struct rusage usage2;
diff --git a/widget/src/android/AndroidBridge.cpp b/widget/src/android/AndroidBridge.cpp
index b1b6a638a1b1..972bd4bb0f01 100644
--- a/widget/src/android/AndroidBridge.cpp
+++ b/widget/src/android/AndroidBridge.cpp
@@ -149,7 +149,6 @@ AndroidBridge::Init(JNIEnv *jEnv,
     jGetIconForExtension = (jmethodID) jEnv->GetStaticMethodID(jGeckoAppShellClass, "getIconForExtension", "(Ljava/lang/String;I)[B");
     jCreateShortcut = (jmethodID) jEnv->GetStaticMethodID(jGeckoAppShellClass, "createShortcut", "(Ljava/lang/String;Ljava/lang/String;Ljava/lang/String;Ljava/lang/String;)V");
     jGetShowPasswordSetting = (jmethodID) jEnv->GetStaticMethodID(jGeckoAppShellClass, "getShowPasswordSetting", "()Z");
-    jPostToJavaThread = (jmethodID) jEnv->GetStaticMethodID(jGeckoAppShellClass, "postToJavaThread", "(Z)V");
 
     jEGLContextClass = (jclass) jEnv->NewGlobalRef(jEnv->FindClass("javax/microedition/khronos/egl/EGLContext"));
     jEGL10Class = (jclass) jEnv->NewGlobalRef(jEnv->FindClass("javax/microedition/khronos/egl/EGL10"));
@@ -170,14 +169,8 @@ AndroidBridge::Init(JNIEnv *jEnv,
 JNIEnv *
 AndroidBridge::AttachThread(PRBool asDaemon)
 {
-    // If we already have a env, return it
-    JNIEnv *jEnv = NULL;
-    mJavaVM->GetEnv((void**) &jEnv, JNI_VERSION_1_2);
-    if (jEnv)
-        return jEnv;
-
     ALOG_BRIDGE("AndroidBridge::AttachThread");
-    jEnv = (JNIEnv*) PR_GetThreadPrivate(sJavaEnvThreadIndex);
+    JNIEnv *jEnv = (JNIEnv*) PR_GetThreadPrivate(sJavaEnvThreadIndex);
     if (jEnv)
         return jEnv;
 
@@ -202,8 +195,6 @@ AndroidBridge::AttachThread(PRBool asDaemon)
 
     PR_SetThreadPrivate(sJavaEnvThreadIndex, jEnv);
 
-    PR_NewThreadPrivateIndex(&sJavaEnvThreadIndex, JavaThreadDetachFunc);
-
     return jEnv;
 }
 
@@ -935,45 +926,6 @@ AndroidBridge::CreateShortcut(const nsAString& aTitle, const nsAString& aURI, co
   mJNIEnv->CallStaticVoidMethod(mGeckoAppShellClass, jCreateShortcut, jstrTitle, jstrURI, jstrIconData, jstrIntent);
 }
 
-void
-AndroidBridge::PostToJavaThread(nsIRunnable* aRunnable, PRBool aMainThread)
-{
-    __android_log_print(ANDROID_LOG_INFO, "GeckoBridge", "%s", __PRETTY_FUNCTION__);
-    JNIEnv* env = AndroidBridge::AttachThread(false);
-    if (!env) {
-        __android_log_print(ANDROID_LOG_INFO, "GeckoBridge", "no jni env in %s!!", __PRETTY_FUNCTION__);
-        return;
-    }
-    mRunnableQueue.AppendObject(aRunnable);
-    env->CallStaticVoidMethod(mGeckoAppShellClass, jPostToJavaThread, (jboolean)aMainThread);
-
-    jthrowable ex = env->ExceptionOccurred();
-    if (ex) {
-        env->ExceptionDescribe();
-        env->ExceptionClear();
-    }
-    __android_log_print(ANDROID_LOG_INFO, "GeckoBridge", "leaving %s", __PRETTY_FUNCTION__);
-}
-
-void
-AndroidBridge::ExecuteNextRunnable()
-{
-    __android_log_print(ANDROID_LOG_INFO, "GeckoBridge", "%s", __PRETTY_FUNCTION__);
-
-    JNIEnv* env = AndroidBridge::AttachThread(false);
-    if (!env) {
-        __android_log_print(ANDROID_LOG_INFO, "GeckoBridge", "no jni env in %s!!", __PRETTY_FUNCTION__);
-        return;
-    }
-
-    if (mRunnableQueue.Count() > 0) {
-        nsIRunnable* r = mRunnableQueue[0];
-        __android_log_print(ANDROID_LOG_INFO, "GeckoBridge", "going to run %p", r);
-        r->Run();
-        mRunnableQueue.RemoveObjectAt(0);
-    }
-    __android_log_print(ANDROID_LOG_INFO, "GeckoBridge", "leaving %s", __PRETTY_FUNCTION__);
-}
 bool
 AndroidBridge::HasNativeBitmapAccess()
 {
diff --git a/widget/src/android/AndroidBridge.h b/widget/src/android/AndroidBridge.h
index 4de9750482c6..cfb79eae1d9b 100644
--- a/widget/src/android/AndroidBridge.h
+++ b/widget/src/android/AndroidBridge.h
@@ -42,7 +42,6 @@
 #include <android/log.h>
 
 #include "nsCOMPtr.h"
-#include "nsCOMArray.h"
 #include "nsIRunnable.h"
 #include "nsIObserver.h"
 
@@ -263,10 +262,6 @@ public:
 
     void UnlockBitmap(jobject bitmap);
 
-    void PostToJavaThread(nsIRunnable* aRunnable, PRBool aMainThread = PR_FALSE);
-
-    void ExecuteNextRunnable();
-
 protected:
     static AndroidBridge *sBridge;
 
@@ -291,8 +286,6 @@ protected:
     bool mOpenedBitmapLibrary;
     bool mHasNativeBitmapAccess;
 
-    nsCOMArray<nsIRunnable> mRunnableQueue;
-
     // other things
     jmethodID jNotifyIME;
     jmethodID jNotifyIMEEnabled;
@@ -332,7 +325,6 @@ protected:
     jmethodID jGetIconForExtension;
     jmethodID jCreateShortcut;
     jmethodID jGetShowPasswordSetting;
-    jmethodID jPostToJavaThread;
 
     // stuff we need for CallEglCreateWindowSurface
     jclass jEGLSurfaceImplClass;
diff --git a/widget/src/android/AndroidJNI.cpp b/widget/src/android/AndroidJNI.cpp
index 4bce698eed47..6aadc8e85e9a 100644
--- a/widget/src/android/AndroidJNI.cpp
+++ b/widget/src/android/AndroidJNI.cpp
@@ -72,7 +72,6 @@ extern "C" {
     NS_EXPORT void JNICALL Java_org_mozilla_gecko_GeckoAppShell_removeObserver(JNIEnv *jenv, jclass, jstring jObserverKey);
     NS_EXPORT void JNICALL Java_org_mozilla_gecko_GeckoAppShell_onChangeNetworkLinkStatus(JNIEnv *, jclass, jstring status, jstring type);
     NS_EXPORT void JNICALL Java_org_mozilla_gecko_GeckoAppShell_reportJavaCrash(JNIEnv *, jclass, jstring stack);
-    NS_EXPORT void JNICALL Java_org_mozilla_gecko_GeckoAppShell_executeNextRunnable(JNIEnv *, jclass);
 }
 
 
@@ -180,15 +179,3 @@ Java_org_mozilla_gecko_GeckoAppShell_reportJavaCrash(JNIEnv *jenv, jclass, jstri
 #endif
     abort();
 }
-
-NS_EXPORT void JNICALL
-Java_org_mozilla_gecko_GeckoAppShell_executeNextRunnable(JNIEnv *, jclass)
-{
-    __android_log_print(ANDROID_LOG_INFO, "GeckoJNI", "%s", __PRETTY_FUNCTION__);
-    if (!AndroidBridge::Bridge()) {
-        __android_log_print(ANDROID_LOG_INFO, "GeckoJNI", "no bridge in %s!!!!", __PRETTY_FUNCTION__);
-        return;
-    }
-    AndroidBridge::Bridge()->ExecuteNextRunnable();
-    __android_log_print(ANDROID_LOG_INFO, "GeckoJNI", "leaving %s", __PRETTY_FUNCTION__);
-}

From c9e7d1eacbda77be2d18d0bf82e1abf49ef51e80 Mon Sep 17 00:00:00 2001
From: Lucas Rocha <lucasr@mozilla.com>
Date: Sat, 17 Sep 2011 00:38:36 +0100
Subject: [PATCH 180/209] Bug 686530 - Fix padding on icons to not cover urlbar
 line (r=wesj)

---
 mobile/themes/core/honeycomb/browser.css | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/mobile/themes/core/honeycomb/browser.css b/mobile/themes/core/honeycomb/browser.css
index 2195b934b515..9a745fa8e657 100644
--- a/mobile/themes/core/honeycomb/browser.css
+++ b/mobile/themes/core/honeycomb/browser.css
@@ -260,6 +260,8 @@ toolbarbutton.urlbar-button {
   background-position: bottom right;
   background-repeat: no-repeat,
                      repeat-x;
+  padding-bottom: 1px;
+  -moz-padding-end: 1px;
 }
 
 #urlbar-icons:-moz-locale-dir(rtl) {

From 4fadb0aefdb9d657d5e012784a4125930010ffb8 Mon Sep 17 00:00:00 2001
From: Brian Hackett <bhackett1024@gmail.com>
Date: Fri, 16 Sep 2011 20:31:54 -0700
Subject: [PATCH 181/209] [INFER] Backout 3a8b5e4a286b for suspected M-oth
 orange.

---
 js/src/jit-test/tests/basic/bug683140.js | 13 -------
 js/src/jsarray.cpp                       | 47 ++++++++++++++----------
 2 files changed, 28 insertions(+), 32 deletions(-)
 delete mode 100644 js/src/jit-test/tests/basic/bug683140.js

diff --git a/js/src/jit-test/tests/basic/bug683140.js b/js/src/jit-test/tests/basic/bug683140.js
deleted file mode 100644
index 4920ea5359e6..000000000000
--- a/js/src/jit-test/tests/basic/bug683140.js
+++ /dev/null
@@ -1,13 +0,0 @@
-
-var g = newGlobal("same-compartment");
-g.eval("this.f = function(a) {" +
-       "assertEq(a instanceof Array, false);" +
-       "a = Array.prototype.slice.call(a);" +
-       "assertEq(a instanceof Array, true); }");
-g.f([1, 2, 3]);
-
-var g2 = newGlobal("new-compartment");
-g2.a = g2.Array(10);
-assertEq(g2.a instanceof Array, false);
-g2.a = Array.prototype.slice(g2.a);
-assertEq(g2.a instanceof Array, true);
diff --git a/js/src/jsarray.cpp b/js/src/jsarray.cpp
index 6e15277ab464..a3525978eeee 100644
--- a/js/src/jsarray.cpp
+++ b/js/src/jsarray.cpp
@@ -2615,21 +2615,6 @@ array_unshift(JSContext *cx, uintN argc, Value *vp)
     return JS_TRUE;
 }
 
-static inline void
-TryReuseArrayType(JSObject *obj, JSObject *nobj)
-{
-    /*
-     * Try to change the type of a newly created array nobj to the same type
-     * as obj. This can only be performed if the original object is an array
-     * and has the same prototype.
-     */
-    JS_ASSERT(nobj->isDenseArray());
-    JS_ASSERT(nobj->type() == nobj->getProto()->newType);
-
-    if (obj->isArray() && !obj->hasSingletonType() && obj->getProto() == nobj->getProto())
-        nobj->setType(obj->type());
-}
-
 static JSBool
 array_splice(JSContext *cx, uintN argc, Value *vp)
 {
@@ -2640,11 +2625,24 @@ array_splice(JSContext *cx, uintN argc, Value *vp)
     jsuint length, begin, end, count, delta, last;
     JSBool hole;
 
+    /*
+     * Get the type of the result object: the original type when splicing an
+     * array, a generic array type otherwise.
+     */
+    TypeObject *type;
+    if (obj->isArray() && !obj->hasSingletonType()) {
+        type = obj->type();
+    } else {
+        type = GetTypeNewObject(cx, JSProto_Array);
+        if (!type)
+            return false;
+    }
+
     /* Create a new array value to return. */
     JSObject *obj2 = NewDenseEmptyArray(cx);
     if (!obj2)
         return JS_FALSE;
-    TryReuseArrayType(obj, obj2);
+    obj2->setType(type);
     vp->setObject(*obj2);
 
     /* Nothing to do if no args.  Otherwise get length. */
@@ -2803,7 +2801,8 @@ array_concat(JSContext *cx, uintN argc, Value *vp)
         nobj = NewDenseCopiedArray(cx, initlen, vector);
         if (!nobj)
             return JS_FALSE;
-        TryReuseArrayType(aobj, nobj);
+        if (nobj->getProto() == aobj->getProto() && !aobj->hasSingletonType())
+            nobj->setType(aobj->type());
         nobj->setArrayLength(cx, length);
         if (!aobj->isPackedDenseArray())
             nobj->markDenseArrayNotPacked(cx);
@@ -2906,12 +2905,22 @@ array_slice(JSContext *cx, uintN argc, Value *vp)
     if (begin > end)
         begin = end;
 
+    /* Get the type object for the returned array, as for array_splice. */
+    TypeObject *type;
+    if (obj->isArray() && !obj->hasSingletonType()) {
+        type = obj->type();
+    } else {
+        type = GetTypeNewObject(cx, JSProto_Array);
+        if (!type)
+            return false;
+    }
+
     if (obj->isDenseArray() && end <= obj->getDenseArrayInitializedLength() &&
         !js_PrototypeHasIndexedProperties(cx, obj)) {
         nobj = NewDenseCopiedArray(cx, end - begin, obj->getDenseArrayElements() + begin);
         if (!nobj)
             return JS_FALSE;
-        TryReuseArrayType(obj, nobj);
+        nobj->setType(type);
         if (!obj->isPackedDenseArray())
             nobj->markDenseArrayNotPacked(cx);
         vp->setObject(*nobj);
@@ -2922,7 +2931,7 @@ array_slice(JSContext *cx, uintN argc, Value *vp)
     nobj = NewDenseAllocatedArray(cx, end - begin);
     if (!nobj)
         return JS_FALSE;
-    TryReuseArrayType(obj, nobj);
+    nobj->setType(type);
     vp->setObject(*nobj);
 
     AutoValueRooter tvr(cx);

From a251f5c8b6bf287a28484b4b7fa4dc0ef44b1a71 Mon Sep 17 00:00:00 2001
From: Mike Hommey <mh+mozilla@glandium.org>
Date: Sat, 17 Sep 2011 08:55:45 +0200
Subject: [PATCH 182/209] Bug 687139 - Avoid linking the updater against
 libmozutils. r=khuey

---
 toolkit/mozapps/update/updater/Makefile.in | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/toolkit/mozapps/update/updater/Makefile.in b/toolkit/mozapps/update/updater/Makefile.in
index f5cdae054493..92790719f8fc 100644
--- a/toolkit/mozapps/update/updater/Makefile.in
+++ b/toolkit/mozapps/update/updater/Makefile.in
@@ -51,6 +51,10 @@ CPPSRCS = \
 
 PROGRAM = updater$(BIN_SUFFIX)
 
+# Don't link the updater against libmozutils. See bug 687139
+MOZ_UTILS_LDFLAGS =
+MOZ_UTILS_PROGRAM_LDFLAGS =
+
 LOCAL_INCLUDES += -I$(srcdir)/../../readstrings
 
 LIBS += \

From c5804fbce1654c59df4cbe64e340bbf9374e0d6a Mon Sep 17 00:00:00 2001
From: "Robert O'Callahan ext:(.)" <roc@ocallahan.org>
Date: Sat, 17 Sep 2011 09:29:51 +0100
Subject: [PATCH 183/209] Bug 647687 - Fix filter SourceImage bounds.
 r=longsonr

---
 layout/reftests/svg/filter-bounds-01.svg    | 24 ++++++++++++++++++++
 layout/reftests/svg/filter-bounds-02.svg    | 25 +++++++++++++++++++++
 layout/reftests/svg/reftest.list            |  2 ++
 layout/svg/base/src/nsSVGFilterFrame.cpp    | 10 ++++++++-
 layout/svg/base/src/nsSVGFilterInstance.cpp |  1 +
 layout/svg/base/src/nsSVGFilterInstance.h   |  4 ++++
 6 files changed, 65 insertions(+), 1 deletion(-)
 create mode 100644 layout/reftests/svg/filter-bounds-01.svg
 create mode 100644 layout/reftests/svg/filter-bounds-02.svg

diff --git a/layout/reftests/svg/filter-bounds-01.svg b/layout/reftests/svg/filter-bounds-01.svg
new file mode 100644
index 000000000000..17bfeb60c1e4
--- /dev/null
+++ b/layout/reftests/svg/filter-bounds-01.svg
@@ -0,0 +1,24 @@
+<!--
+     Any copyright is dedicated to the Public Domain.
+     http://creativecommons.org/publicdomain/zero/1.0/
+-->
+<svg xmlns="http://www.w3.org/2000/svg" version="1.1"
+     xmlns:xlink="http://www.w3.org/1999/xlink">
+
+  <title>Testcase for checking that filter bounds include stroke width</title>
+
+  <!-- From https://bugzilla.mozilla.org/show_bug.cgi?id=647687 -->
+
+  <defs>
+    <filter id="f1" filterUnits="userSpaceOnUse" x="150" y="150" width="200" height="200">
+      <feOffset in="SourceGraphic"/>
+    </filter>
+  </defs>
+
+  <rect height="100%" width="100%" fill="lime"/>
+
+  <rect x="150" y="150" height="200" width="200" fill="red"/>
+
+  <rect x="200" y="200" height="100" width="100" stroke-width="100"
+            fill="none" stroke="lime" filter="url(#f1)"/>
+</svg>
diff --git a/layout/reftests/svg/filter-bounds-02.svg b/layout/reftests/svg/filter-bounds-02.svg
new file mode 100644
index 000000000000..d9c0d474c9c8
--- /dev/null
+++ b/layout/reftests/svg/filter-bounds-02.svg
@@ -0,0 +1,25 @@
+<!--
+     Any copyright is dedicated to the Public Domain.
+     http://creativecommons.org/publicdomain/zero/1.0/
+-->
+<svg xmlns="http://www.w3.org/2000/svg" version="1.1"
+     xmlns:xlink="http://www.w3.org/1999/xlink">
+
+  <title>Testcase for checking that filter bounds include stroke width</title>
+
+  <!-- From https://bugzilla.mozilla.org/show_bug.cgi?id=647687 -->
+
+  <defs>
+    <filter id="f1" filterUnits="objectBoundingBox">
+      <feFlood flood-color="red"/>
+    </filter>
+  </defs>
+
+  <rect height="100%" width="100%" fill="lime"/>
+
+  <polygon points="200,200 300,200 300,300 200,300" stroke-width="100"
+            fill="none" stroke="lime" filter="url(#f1)"/>
+
+  <rect x="150" y="150" height="200" width="200" fill="lime"/>
+
+</svg>
diff --git a/layout/reftests/svg/reftest.list b/layout/reftests/svg/reftest.list
index 2a424a1e858b..e7c4c3b46c97 100644
--- a/layout/reftests/svg/reftest.list
+++ b/layout/reftests/svg/reftest.list
@@ -111,6 +111,8 @@ random == dynamic-use-nested-01.svg dynamic-use-nested-01-ref.svg # bug 467498
 == filter-basic-01.svg pass.svg
 == filter-basic-02.svg pass.svg
 == filter-basic-03.svg pass.svg
+== filter-bounds-01.svg pass.svg
+== filter-bounds-02.svg pass.svg
 == filter-foreignObject-01.svg pass.svg
 == filter-invalidation-01.svg pass.svg
 == filter-scaled-01.svg pass.svg
diff --git a/layout/svg/base/src/nsSVGFilterFrame.cpp b/layout/svg/base/src/nsSVGFilterFrame.cpp
index 214b3bd80e5c..4d0efabff205 100644
--- a/layout/svg/base/src/nsSVGFilterFrame.cpp
+++ b/layout/svg/base/src/nsSVGFilterFrame.cpp
@@ -206,11 +206,19 @@ nsAutoFilterInstance::nsAutoFilterInstance(nsIFrame *aTarget,
     MapDeviceRectToFilterSpace(deviceToFilterSpace, filterRes, aDirtyOutputRect);
   nsIntRect dirtyInputRect =
     MapDeviceRectToFilterSpace(deviceToFilterSpace, filterRes, aDirtyInputRect);
+  nsIntRect targetBoundsDeviceSpace;
+  nsISVGChildFrame* svgTarget = do_QueryFrame(aTarget);
+  if (svgTarget) {
+    targetBoundsDeviceSpace.UnionRect(targetBoundsDeviceSpace,
+      svgTarget->GetCoveredRegion().ToOutsidePixels(aTarget->PresContext()->AppUnitsPerDevPixel()));
+  }
+  nsIntRect targetBoundsFilterSpace =
+    MapDeviceRectToFilterSpace(deviceToFilterSpace, filterRes, &targetBoundsDeviceSpace);
 
   // Setup instance data
   mInstance = new nsSVGFilterInstance(aTarget, aPaint, filter, bbox, filterRegion,
                                       nsIntSize(filterRes.width, filterRes.height),
-                                      filterToDeviceSpace,
+                                      filterToDeviceSpace, targetBoundsFilterSpace,
                                       dirtyOutputRect, dirtyInputRect,
                                       primitiveUnits);
 }
diff --git a/layout/svg/base/src/nsSVGFilterInstance.cpp b/layout/svg/base/src/nsSVGFilterInstance.cpp
index 84477da69ba9..c91af0b5a4f1 100644
--- a/layout/svg/base/src/nsSVGFilterInstance.cpp
+++ b/layout/svg/base/src/nsSVGFilterInstance.cpp
@@ -189,6 +189,7 @@ nsSVGFilterInstance::BuildSources()
   // Detect possible float->int overflow
   if (!gfxUtils::GfxRectToIntRect(sourceBounds, &sourceBoundsInt))
     return NS_ERROR_FAILURE;
+  sourceBoundsInt.UnionRect(sourceBoundsInt, mTargetBounds);
 
   mSourceColorAlpha.mResultBoundingBox = sourceBoundsInt;
   mSourceAlpha.mResultBoundingBox = sourceBoundsInt;
diff --git a/layout/svg/base/src/nsSVGFilterInstance.h b/layout/svg/base/src/nsSVGFilterInstance.h
index b45708f6305d..2d80d8376723 100644
--- a/layout/svg/base/src/nsSVGFilterInstance.h
+++ b/layout/svg/base/src/nsSVGFilterInstance.h
@@ -70,6 +70,7 @@ public:
                       const gfxRect& aFilterRect,
                       const nsIntSize& aFilterSpaceSize,
                       const gfxMatrix &aFilterSpaceToDeviceSpaceTransform,
+                      const nsIntRect& aTargetBounds,
                       const nsIntRect& aDirtyOutputRect,
                       const nsIntRect& aDirtyInputRect,
                       PRUint16 aPrimitiveUnits) :
@@ -80,6 +81,7 @@ public:
     mFilterSpaceToDeviceSpaceTransform(aFilterSpaceToDeviceSpaceTransform),
     mFilterRect(aFilterRect),
     mFilterSpaceSize(aFilterSpaceSize),
+    mTargetBounds(aTargetBounds),
     mDirtyOutputRect(aDirtyOutputRect),
     mDirtyInputRect(aDirtyInputRect),
     mSurfaceRect(nsIntPoint(0, 0), aFilterSpaceSize),
@@ -209,6 +211,8 @@ private:
   gfxMatrix               mFilterSpaceToDeviceSpaceTransform;
   gfxRect                 mFilterRect;
   nsIntSize               mFilterSpaceSize;
+  // Filter-space bounds of the target image (SourceAlpha/SourceGraphic)
+  nsIntRect               mTargetBounds;
   nsIntRect               mDirtyOutputRect;
   nsIntRect               mDirtyInputRect;
   nsIntRect               mSurfaceRect;

From d5d803ecae044291991f03eecccfafaa5816e6fd Mon Sep 17 00:00:00 2001
From: Ed Morley <bmo@edmorley.co.uk>
Date: Sat, 17 Sep 2011 10:22:09 +0100
Subject: [PATCH 184/209] Bug 685084 - Remove unused variable 'lm' in
 mozilla::widget::PuppetWidget::DispatchPaintEvent(); r=roc

---
 widget/src/xpwidgets/PuppetWidget.cpp | 1 -
 1 file changed, 1 deletion(-)

diff --git a/widget/src/xpwidgets/PuppetWidget.cpp b/widget/src/xpwidgets/PuppetWidget.cpp
index dc3f33464710..b9282c8bc0ca 100644
--- a/widget/src/xpwidgets/PuppetWidget.cpp
+++ b/widget/src/xpwidgets/PuppetWidget.cpp
@@ -558,7 +558,6 @@ PuppetWidget::DispatchPaintEvent()
                          nsCAutoString("PuppetWidget"), nsnull);
 #endif
 
-    LayerManager* lm = GetLayerManager();
     if (LayerManager::LAYERS_D3D10 == mLayerManager->GetBackendType()) {
       DispatchEvent(&event, status);
     } else {

From fd8a1a0f754e048e6f83d030ed4d9d5ad352afbb Mon Sep 17 00:00:00 2001
From: Nick Hurley <hurley@todesschaf.org>
Date: Sat, 17 Sep 2011 10:22:09 +0100
Subject: [PATCH 185/209] Bug 686948 - Add telemetry for cache hit/miss
 with/without revalidation. r=mcmanus

---
 netwerk/protocol/http/nsHttpChannel.cpp       | 21 +++++++++++++++++++
 netwerk/protocol/http/nsHttpChannel.h         |  9 ++++++++
 .../telemetry/TelemetryHistograms.h           |  3 +++
 3 files changed, 33 insertions(+)

diff --git a/netwerk/protocol/http/nsHttpChannel.cpp b/netwerk/protocol/http/nsHttpChannel.cpp
index bf0c6591191a..d0594dd741de 100644
--- a/netwerk/protocol/http/nsHttpChannel.cpp
+++ b/netwerk/protocol/http/nsHttpChannel.cpp
@@ -66,6 +66,7 @@
 #include "nsChannelClassifier.h"
 #include "nsIRedirectResultListener.h"
 #include "mozilla/TimeStamp.h"
+#include "mozilla/Telemetry.h"
 
 // True if the local cache should be bypassed when processing a request.
 #define BYPASS_LOCAL_CACHE(loadFlags) \
@@ -128,6 +129,7 @@ nsHttpChannel::nsHttpChannel()
     , mFallingBack(PR_FALSE)
     , mWaitingForRedirectCallback(PR_FALSE)
     , mRequestTimeInitialized(PR_FALSE)
+    , mDidReval(false)
 {
     LOG(("Creating nsHttpChannel [this=%p]\n", this));
     mChannelCreationTime = PR_Now();
@@ -267,6 +269,8 @@ nsHttpChannel::Connect(PRBool firstTime)
             if (NS_FAILED(rv) && event) {
                 event->Revoke();
             }
+            mozilla::Telemetry::Accumulate(
+                    mozilla::Telemetry::HTTP_CACHE_DISPOSITION, kCacheHit);
             return rv;
         }
         else if (mLoadFlags & LOAD_ONLY_FROM_CACHE) {
@@ -974,6 +978,8 @@ nsHttpChannel::ProcessResponse()
         LOG(("  continuation state has been reset"));
     }
 
+    bool successfulReval = false;
+
     // handle different server response categories.  Note that we handle
     // caching or not caching of error pages in
     // nsHttpResponseHead::MustValidate; if you change this switch, update that
@@ -1025,6 +1031,9 @@ nsHttpChannel::ProcessResponse()
             LOG(("ProcessNotModified failed [rv=%x]\n", rv));
             rv = ProcessNormal();
         }
+        else {
+            successfulReval = true;
+        }
         break;
     case 401:
     case 407:
@@ -1060,6 +1069,17 @@ nsHttpChannel::ProcessResponse()
         break;
     }
 
+    if (!mDidReval)
+        mozilla::Telemetry::Accumulate(
+                mozilla::Telemetry::HTTP_CACHE_DISPOSITION, kCacheMissed);
+    else if (successfulReval)
+        mozilla::Telemetry::Accumulate(
+                mozilla::Telemetry::HTTP_CACHE_DISPOSITION, kCacheHitViaReval);
+    else
+        mozilla::Telemetry::Accumulate(
+                mozilla::Telemetry::HTTP_CACHE_DISPOSITION,
+                kCacheMissedViaReval);
+
     return rv;
 }
 
@@ -2666,6 +2686,7 @@ nsHttpChannel::CheckCache()
             if (val)
                 mRequestHead.SetHeader(nsHttp::If_None_Match,
                                        nsDependentCString(val));
+            mDidReval = true;
         }
     }
 
diff --git a/netwerk/protocol/http/nsHttpChannel.h b/netwerk/protocol/http/nsHttpChannel.h
index a64ec07f3836..6e0f36008072 100644
--- a/netwerk/protocol/http/nsHttpChannel.h
+++ b/netwerk/protocol/http/nsHttpChannel.h
@@ -366,6 +366,15 @@ private:
 
 protected:
     virtual void DoNotifyListenerCleanup();
+
+private: // cache telemetry
+    enum {
+        kCacheHit = 1,
+        kCacheHitViaReval = 2,
+        kCacheMissedViaReval = 3,
+        kCacheMissed = 4
+    };
+    bool mDidReval;
 };
 
 #endif // nsHttpChannel_h__
diff --git a/toolkit/components/telemetry/TelemetryHistograms.h b/toolkit/components/telemetry/TelemetryHistograms.h
index a16c373cbf7d..0f4cdf1cecfe 100644
--- a/toolkit/components/telemetry/TelemetryHistograms.h
+++ b/toolkit/components/telemetry/TelemetryHistograms.h
@@ -132,6 +132,9 @@ HTTP_HISTOGRAMS(SUB, "subitem: ")
 
 #undef _HTTP_HIST
 #undef HTTP_HISTOGRAMS
+
+HISTOGRAM(HTTP_CACHE_DISPOSITION, 1, 5, 5, LINEAR, "HTTP Cache Hit, Reval, Failed-Reval, Miss")
+
 HISTOGRAM(FIND_PLUGINS, 1, 3000, 10, EXPONENTIAL, "Time spent scanning filesystem for plugins (ms)")
 HISTOGRAM(CHECK_JAVA_ENABLED, 1, 3000, 10, EXPONENTIAL, "Time spent checking if Java is enabled (ms)")
 

From 2400305c37051ff7563203a42e140648aab69e4e Mon Sep 17 00:00:00 2001
From: Daniel Holbert <dholbert@cs.stanford.edu>
Date: Sat, 17 Sep 2011 09:18:13 -0700
Subject: [PATCH 186/209] Back out cset c3bf76213a6c (bug 665392) for breaking
 a testcase from the w3c svg testsuite, 'full-animate-elem-24-t.html'.

---
 .../svg/content/src/nsSVGGraphicElement.cpp   | 14 ++++-----
 .../smil/motion/animateMotion-rotate-3.svg    | 30 -------------------
 layout/reftests/svg/smil/motion/reftest.list  |  1 -
 3 files changed, 7 insertions(+), 38 deletions(-)
 delete mode 100644 layout/reftests/svg/smil/motion/animateMotion-rotate-3.svg

diff --git a/content/svg/content/src/nsSVGGraphicElement.cpp b/content/svg/content/src/nsSVGGraphicElement.cpp
index ba4c9a580817..ae4d95b3a183 100644
--- a/content/svg/content/src/nsSVGGraphicElement.cpp
+++ b/content/svg/content/src/nsSVGGraphicElement.cpp
@@ -189,6 +189,13 @@ nsSVGGraphicElement::PrependLocalTransformTo(const gfxMatrix &aMatrix) const
 {
   gfxMatrix result(aMatrix);
 
+  // animateMotion's resulting transform is supposed to apply *on top of*
+  // any transformations from the |transform| attribute. So since we're
+  // PRE-multiplying, we need to apply the animateMotion transform *first*.
+  if (mAnimateMotionTransform) {
+    result.PreMultiply(*mAnimateMotionTransform);
+  }
+
   if (mTransforms) {
     nsresult rv;
     nsCOMPtr<nsIDOMSVGTransformList> transforms;
@@ -203,13 +210,6 @@ nsSVGGraphicElement::PrependLocalTransformTo(const gfxMatrix &aMatrix) const
     }
   }
 
-  // <animateMotion>'s transformation is *supplemental* to the |transform|
-  // attribute and any transformations on ancestors.  So, we apply it
-  // (pre-multiply it) last.
-  if (mAnimateMotionTransform) {
-    result.PreMultiply(*mAnimateMotionTransform);
-  }
-
   return result;
 }
 
diff --git a/layout/reftests/svg/smil/motion/animateMotion-rotate-3.svg b/layout/reftests/svg/smil/motion/animateMotion-rotate-3.svg
deleted file mode 100644
index ad5d31cba2ff..000000000000
--- a/layout/reftests/svg/smil/motion/animateMotion-rotate-3.svg
+++ /dev/null
@@ -1,30 +0,0 @@
-<svg xmlns="http://www.w3.org/2000/svg"
-     xmlns:xlink="http://www.w3.org/1999/xlink"
-     class="reftest-wait">
-  <!-- Tests for "rotate" interacting with the transform attribute. -->
-  <script xlink:href="../smil-util.js" type="text/javascript"/>
-  <script type="text/javascript">
-    function doTest() {
-      setTimeAndSnapshot(1, false);
-    }
-    window.addEventListener("MozReftestInvalidate", doTest, false);
-  </script>
-
-  <!-- Big green background to match lime.svg -->
-  <rect height="100%" width="100%" fill="lime"/>
-
-  <!-- A "shadow" rect (should be covered up by green rect). The only difference
-       between this rect and the other one is that this rect has the
-       |transform| attr set on its <g> parent instead of on it directly. -->
-  <g transform="translate(0, 50)">
-    <rect width="50" height="50" fill="red">
-     <animateMotion begin="0s" dur="1s" fill="freeze" rotate="90"
-                    path="M50 0 h50"/>
-    </rect>
-  </g>
-
-  <rect width="50" height="50" fill="lime" transform="translate(0, 50)">
-    <animateMotion begin="0s" dur="1s" fill="freeze" rotate="90"
-                   path="M50 0 h50"/>
-  </rect>
-</svg>
diff --git a/layout/reftests/svg/smil/motion/reftest.list b/layout/reftests/svg/smil/motion/reftest.list
index 66f25c495a48..b9ca38d62ad4 100644
--- a/layout/reftests/svg/smil/motion/reftest.list
+++ b/layout/reftests/svg/smil/motion/reftest.list
@@ -8,7 +8,6 @@
 == animateMotion-rotate-1a.svg lime.svg
 == animateMotion-rotate-1b.svg lime.svg
 == animateMotion-rotate-2.svg  lime.svg
-== animateMotion-rotate-3.svg  lime.svg
 == animateMotion-to-overridden-1.svg lime.svg
 == animateMotion-values-linear-1.svg animateMotion-values-linear-1-ref.svg
 == animateMotion-values-paced-1a.svg animateMotion-values-paced-1-ref.svg

From 09c97f4a3845344c7ab9b94f4d3bc12176005818 Mon Sep 17 00:00:00 2001
From: Ms2ger <ms2ger@gmail.com>
Date: Sun, 18 Sep 2011 11:22:17 +0200
Subject: [PATCH 187/209] Bug 649603 - Make nsIScriptContext::GetNativeContext
 return JSContext; r=jst

---
 caps/src/nsSecurityManagerFactory.cpp         |  4 ++--
 content/base/src/nsContentUtils.cpp           | 12 ++++------
 content/base/src/nsDocument.cpp               |  4 ++--
 content/base/src/nsEventSource.cpp            |  2 +-
 content/base/src/nsFrameLoader.cpp            |  2 +-
 content/base/src/nsScriptLoader.cpp           |  2 +-
 content/base/src/nsWebSocket.cpp              |  2 +-
 content/events/src/nsEventListenerManager.cpp |  3 +--
 .../html/document/src/nsHTMLContentSink.cpp   |  2 +-
 content/xbl/src/nsBindingManager.cpp          |  2 +-
 content/xbl/src/nsXBLBinding.cpp              |  4 ++--
 content/xbl/src/nsXBLDocumentInfo.cpp         |  5 ++--
 content/xbl/src/nsXBLProtoImpl.cpp            |  6 ++---
 content/xbl/src/nsXBLProtoImplField.cpp       |  2 +-
 content/xbl/src/nsXBLProtoImplMethod.cpp      |  4 ++--
 content/xbl/src/nsXBLProtoImplProperty.cpp    |  2 +-
 content/xul/content/src/nsXULElement.cpp      |  2 +-
 .../document/src/nsXULPrototypeDocument.cpp   |  2 +-
 .../templates/src/nsXULTemplateBuilder.cpp    |  2 +-
 dom/base/nsDOMClassInfo.cpp                   |  4 ++--
 dom/base/nsGlobalWindow.cpp                   | 24 +++++++------------
 dom/base/nsIScriptContext.h                   | 10 ++++----
 dom/base/nsJSEnvironment.cpp                  |  2 +-
 dom/base/nsJSEnvironment.h                    |  8 +++----
 dom/indexedDB/IDBRequest.cpp                  |  2 +-
 dom/plugins/base/nsJSNPRuntime.cpp            |  2 +-
 dom/plugins/base/nsNPAPIPlugin.cpp            |  2 +-
 dom/plugins/base/nsNPAPIPluginInstance.cpp    |  2 +-
 dom/src/jsurl/nsJSProtocolHandler.cpp         |  6 ++---
 dom/workers/WorkerPrivate.cpp                 |  6 ++---
 .../windowwatcher/src/nsWindowWatcher.cpp     |  2 +-
 layout/generic/nsObjectFrame.cpp              |  2 +-
 parser/html/nsHtml5TreeOpExecutor.cpp         |  2 +-
 xpfe/appshell/src/nsAppShellService.cpp       |  2 +-
 .../directory/nsDirectoryViewer.cpp           |  6 ++---
 xpinstall/src/nsJSInstallTriggerGlobal.cpp    |  4 ++--
 36 files changed, 67 insertions(+), 83 deletions(-)

diff --git a/caps/src/nsSecurityManagerFactory.cpp b/caps/src/nsSecurityManagerFactory.cpp
index d416d486e446..b1a07d57fd16 100644
--- a/caps/src/nsSecurityManagerFactory.cpp
+++ b/caps/src/nsSecurityManagerFactory.cpp
@@ -320,12 +320,12 @@ static JSFunctionSpec PrivilegeManager_static_methods[] = {
 
 /*
  * "Steal" calls to netscape.security.PrivilegeManager.enablePrivilege,
- * et. al. so that code that worked with 4.0 can still work.
+ * et al. so that code that worked with 4.0 can still work.
  */
 NS_IMETHODIMP 
 nsSecurityNameSet::InitializeNameSet(nsIScriptContext* aScriptContext)
 {
-    JSContext *cx = (JSContext *) aScriptContext->GetNativeContext();
+    JSContext* cx = aScriptContext->GetNativeContext();
     JSObject *global = JS_GetGlobalObject(cx);
     OBJ_TO_INNER_OBJECT(cx, global);
 
diff --git a/content/base/src/nsContentUtils.cpp b/content/base/src/nsContentUtils.cpp
index 676f548fe455..74540f879158 100644
--- a/content/base/src/nsContentUtils.cpp
+++ b/content/base/src/nsContentUtils.cpp
@@ -1,7 +1,6 @@
-/* -*- Mode: C++; tab-width: 2; indent-tabs-mode: nil; c-basic-offset: 2 -*-
- * vim: set ts=2 sw=2 et tw=78:
- *
- * ***** BEGIN LICENSE BLOCK *****
+/* -*- Mode: C++; tab-width: 2; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
+/* vim: set ts=2 sw=2 et tw=78: */
+/* ***** BEGIN LICENSE BLOCK *****
  * Version: MPL 1.1/GPL 2.0/LGPL 2.1
  *
  * The contents of this file are subject to the Mozilla Public License Version
@@ -1286,11 +1285,10 @@ nsContentUtils::GetContextFromDocument(nsIDocument *aDocument)
   nsIScriptContext *scx = sgo->GetContext();
   if (!scx) {
     // No context left in the scope...
-
     return nsnull;
   }
 
-  return (JSContext *)scx->GetNativeContext();
+  return scx->GetNativeContext();
 }
 
 // static
@@ -2559,7 +2557,7 @@ nsCxPusher::Push(nsIDOMEventTarget *aCurrentTarget)
   JSContext* cx = nsnull;
 
   if (scx) {
-    cx = static_cast<JSContext*>(scx->GetNativeContext());
+    cx = scx->GetNativeContext();
     // Bad, no JSContext from script context!
     NS_ENSURE_TRUE(cx, PR_FALSE);
   }
diff --git a/content/base/src/nsDocument.cpp b/content/base/src/nsDocument.cpp
index 3cde0977fedb..eab6e6b0daca 100644
--- a/content/base/src/nsDocument.cpp
+++ b/content/base/src/nsDocument.cpp
@@ -3813,7 +3813,7 @@ nsDocument::SetScriptGlobalObject(nsIScriptGlobalObject *aScriptGlobalObject)
       if (obj) {
         JSObject *newScope = aScriptGlobalObject->GetGlobalJSObject();
         nsIScriptContext *scx = aScriptGlobalObject->GetContext();
-        JSContext *cx = scx ? (JSContext *)scx->GetNativeContext() : nsnull;
+        JSContext *cx = scx ? scx->GetNativeContext() : nsnull;
         if (!cx) {
           nsContentUtils::ThreadJSContextStack()->Peek(&cx);
           if (!cx) {
@@ -6423,7 +6423,7 @@ nsDocument::IsScriptEnabled()
   nsIScriptContext *scriptContext = globalObject->GetContext();
   NS_ENSURE_TRUE(scriptContext, PR_FALSE);
 
-  JSContext* cx = (JSContext *) scriptContext->GetNativeContext();
+  JSContext* cx = scriptContext->GetNativeContext();
   NS_ENSURE_TRUE(cx, PR_FALSE);
 
   PRBool enabled;
diff --git a/content/base/src/nsEventSource.cpp b/content/base/src/nsEventSource.cpp
index 16d46d3a2bf7..756973d69095 100644
--- a/content/base/src/nsEventSource.cpp
+++ b/content/base/src/nsEventSource.cpp
@@ -1350,7 +1350,7 @@ nsEventSource::DispatchAllMessageEvents()
   nsIScriptContext* scriptContext = sgo->GetContext();
   NS_ENSURE_TRUE(scriptContext,);
 
-  JSContext* cx = (JSContext*)scriptContext->GetNativeContext();
+  JSContext* cx = scriptContext->GetNativeContext();
   NS_ENSURE_TRUE(cx,);
 
   while (mMessagesToDispatch.GetSize() > 0) {
diff --git a/content/base/src/nsFrameLoader.cpp b/content/base/src/nsFrameLoader.cpp
index 89721ddd7e85..62ac4e9334af 100644
--- a/content/base/src/nsFrameLoader.cpp
+++ b/content/base/src/nsFrameLoader.cpp
@@ -2070,7 +2070,7 @@ nsFrameLoader::EnsureMessageManager()
   nsIScriptContext* sctx = mOwnerContent->GetContextForEventHandlers(&rv);
   NS_ENSURE_SUCCESS(rv, rv);
   NS_ENSURE_STATE(sctx);
-  JSContext* cx = static_cast<JSContext*>(sctx->GetNativeContext());
+  JSContext* cx = sctx->GetNativeContext();
   NS_ENSURE_STATE(cx);
 
   nsCOMPtr<nsIDOMChromeWindow> chromeWindow =
diff --git a/content/base/src/nsScriptLoader.cpp b/content/base/src/nsScriptLoader.cpp
index 54784e0f051a..5cd7a666db47 100644
--- a/content/base/src/nsScriptLoader.cpp
+++ b/content/base/src/nsScriptLoader.cpp
@@ -910,7 +910,7 @@ nsScriptLoader::EvaluateScript(nsScriptLoadRequest* aRequest,
 
   JSContext *cx = nsnull; // Initialize this to keep GCC happy.
   if (stid == nsIProgrammingLanguage::JAVASCRIPT) {
-    cx = (JSContext *)context->GetNativeContext();
+    cx = context->GetNativeContext();
     ::JS_BeginRequest(cx);
     NS_ASSERTION(!::JS_IsExceptionPending(cx),
                  "JS_ReportPendingException wasn't called in EvaluateString");
diff --git a/content/base/src/nsWebSocket.cpp b/content/base/src/nsWebSocket.cpp
index 8b3a5d912c84..e675d0dd2439 100644
--- a/content/base/src/nsWebSocket.cpp
+++ b/content/base/src/nsWebSocket.cpp
@@ -901,7 +901,7 @@ nsWebSocket::CreateAndDispatchMessageEvent(const nsACString& aData)
   nsIScriptContext* scriptContext = sgo->GetContext();
   NS_ENSURE_TRUE(scriptContext, NS_ERROR_FAILURE);
 
-  JSContext* cx = (JSContext*)scriptContext->GetNativeContext();
+  JSContext* cx = scriptContext->GetNativeContext();
   NS_ENSURE_TRUE(cx, NS_ERROR_FAILURE);
 
   // Now we can turn our string into a jsval
diff --git a/content/events/src/nsEventListenerManager.cpp b/content/events/src/nsEventListenerManager.cpp
index deb6db05e72e..f05fe43f8b16 100644
--- a/content/events/src/nsEventListenerManager.cpp
+++ b/content/events/src/nsEventListenerManager.cpp
@@ -644,8 +644,7 @@ nsEventListenerManager::CompileEventHandlerInternal(nsListenerStruct *aListenerS
     }
 
     nsCxPusher pusher;
-    if (aNeedsCxPush &&
-        !pusher.Push((JSContext*)context->GetNativeContext())) {
+    if (aNeedsCxPush && !pusher.Push(context->GetNativeContext())) {
       return NS_ERROR_FAILURE;
     }
 
diff --git a/content/html/document/src/nsHTMLContentSink.cpp b/content/html/document/src/nsHTMLContentSink.cpp
index b16ee3aeb621..77b480037ce5 100644
--- a/content/html/document/src/nsHTMLContentSink.cpp
+++ b/content/html/document/src/nsHTMLContentSink.cpp
@@ -1544,7 +1544,7 @@ IsScriptEnabled(nsIDocument *aDoc, nsIDocShell *aContainer)
   nsIScriptContext *scriptContext = globalObject->GetContext();
   NS_ENSURE_TRUE(scriptContext, PR_TRUE);
 
-  JSContext* cx = (JSContext *) scriptContext->GetNativeContext();
+  JSContext* cx = scriptContext->GetNativeContext();
   NS_ENSURE_TRUE(cx, PR_TRUE);
 
   PRBool enabled = PR_TRUE;
diff --git a/content/xbl/src/nsBindingManager.cpp b/content/xbl/src/nsBindingManager.cpp
index cf21dc85782b..df4502ae600e 100644
--- a/content/xbl/src/nsBindingManager.cpp
+++ b/content/xbl/src/nsBindingManager.cpp
@@ -1248,7 +1248,7 @@ nsBindingManager::GetBindingImplementation(nsIContent* aContent, REFNSIID aIID,
       if (!context)
         return NS_NOINTERFACE;
 
-      JSContext* jscontext = (JSContext*)context->GetNativeContext();
+      JSContext* jscontext = context->GetNativeContext();
       if (!jscontext)
         return NS_NOINTERFACE;
 
diff --git a/content/xbl/src/nsXBLBinding.cpp b/content/xbl/src/nsXBLBinding.cpp
index 46ac75498056..f37aac2709b8 100644
--- a/content/xbl/src/nsXBLBinding.cpp
+++ b/content/xbl/src/nsXBLBinding.cpp
@@ -1062,7 +1062,7 @@ nsXBLBinding::ChangeDocument(nsIDocument* aOldDocument, nsIDocument* aNewDocumen
 
           nsCOMPtr<nsIScriptContext> context = global->GetContext();
           if (context && scope) {
-            JSContext *cx = (JSContext *)context->GetNativeContext();
+            JSContext *cx = context->GetNativeContext();
  
             nsCxPusher pusher;
             pusher.Push(cx);
@@ -1395,7 +1395,7 @@ nsXBLBinding::AllowScripts()
     return PR_FALSE;
   }
   
-  JSContext* cx = (JSContext*) context->GetNativeContext();
+  JSContext* cx = context->GetNativeContext();
 
   nsCOMPtr<nsIDocument> ourDocument =
     mPrototypeBinding->XBLDocumentInfo()->GetDocument();
diff --git a/content/xbl/src/nsXBLDocumentInfo.cpp b/content/xbl/src/nsXBLDocumentInfo.cpp
index e6e1a842fa74..ecd7838cb1e9 100644
--- a/content/xbl/src/nsXBLDocumentInfo.cpp
+++ b/content/xbl/src/nsXBLDocumentInfo.cpp
@@ -318,7 +318,7 @@ nsXBLDocGlobalObject::EnsureScriptEnvironment(PRUint32 aLangID)
   NS_ENSURE_SUCCESS(rv, rv);
   rv = SetScriptContext(aLangID, newCtx);
 
-  JSContext *cx = (JSContext *)mScriptContext->GetNativeContext();
+  JSContext *cx = mScriptContext->GetNativeContext();
   JSAutoRequest ar(cx);
 
   // nsJSEnvironment set the error reporter to NS_ScriptErrorReporter so
@@ -372,8 +372,7 @@ nsXBLDocGlobalObject::GetGlobalJSObject()
   if (!mScriptContext)
     return nsnull;
 
-  JSContext* cx = static_cast<JSContext*>
-                             (mScriptContext->GetNativeContext());
+  JSContext* cx = mScriptContext->GetNativeContext();
   if (!cx)
     return nsnull;
 
diff --git a/content/xbl/src/nsXBLProtoImpl.cpp b/content/xbl/src/nsXBLProtoImpl.cpp
index f1984d8e047e..aef99145e653 100644
--- a/content/xbl/src/nsXBLProtoImpl.cpp
+++ b/content/xbl/src/nsXBLProtoImpl.cpp
@@ -103,7 +103,7 @@ nsXBLProtoImpl::InstallImplementation(nsXBLPrototypeBinding* aBinding, nsIConten
   JSObject * targetScriptObject;
   holder->GetJSObject(&targetScriptObject);
 
-  JSContext *cx = (JSContext *)context->GetNativeContext();
+  JSContext *cx = context->GetNativeContext();
 
   AutoVersionChecker avc(cx);
   
@@ -147,7 +147,7 @@ nsXBLProtoImpl::InitTargetObjects(nsXBLPrototypeBinding* aBinding,
 
   // Because our prototype implementation has a class, we need to build up a corresponding
   // class for the concrete implementation in the bound document.
-  JSContext* jscontext = (JSContext*)aContext->GetNativeContext();
+  JSContext* jscontext = aContext->GetNativeContext();
   JSObject* global = sgo->GetGlobalJSObject();
   nsCOMPtr<nsIXPConnectJSObjectHolder> wrapper;
   jsval v;
@@ -185,7 +185,7 @@ nsXBLProtoImpl::CompilePrototypeMembers(nsXBLPrototypeBinding* aBinding)
   nsIScriptContext *context = globalObject->GetContext();
   NS_ENSURE_TRUE(context, NS_ERROR_OUT_OF_MEMORY);
 
-  JSContext *cx = (JSContext *)context->GetNativeContext();
+  JSContext *cx = context->GetNativeContext();
   JSObject *global = globalObject->GetGlobalJSObject();
   
 
diff --git a/content/xbl/src/nsXBLProtoImplField.cpp b/content/xbl/src/nsXBLProtoImplField.cpp
index 4aee61c6cf09..a0b85faf3a00 100644
--- a/content/xbl/src/nsXBLProtoImplField.cpp
+++ b/content/xbl/src/nsXBLProtoImplField.cpp
@@ -117,7 +117,7 @@ nsXBLProtoImplField::InstallField(nsIScriptContext* aContext,
   nsCAutoString uriSpec;
   aBindingDocURI->GetSpec(uriSpec);
   
-  JSContext* cx = (JSContext*) aContext->GetNativeContext();
+  JSContext* cx = aContext->GetNativeContext();
   NS_ASSERTION(!::JS_IsExceptionPending(cx),
                "Shouldn't get here when an exception is pending!");
   
diff --git a/content/xbl/src/nsXBLProtoImplMethod.cpp b/content/xbl/src/nsXBLProtoImplMethod.cpp
index 16f50f7ac930..dc2a65abb232 100644
--- a/content/xbl/src/nsXBLProtoImplMethod.cpp
+++ b/content/xbl/src/nsXBLProtoImplMethod.cpp
@@ -128,7 +128,7 @@ nsXBLProtoImplMethod::InstallMember(nsIScriptContext* aContext,
 {
   NS_PRECONDITION(IsCompiled(),
                   "Should not be installing an uncompiled method");
-  JSContext* cx = (JSContext*) aContext->GetNativeContext();
+  JSContext* cx = aContext->GetNativeContext();
 
   nsIDocument *ownerDoc = aBoundElement->GetOwnerDoc();
   nsIScriptGlobalObject *sgo;
@@ -294,7 +294,7 @@ nsXBLProtoImplAnonymousMethod::Execute(nsIContent* aBoundElement)
     return NS_OK;
   }
   
-  JSContext* cx = (JSContext*) context->GetNativeContext();
+  JSContext* cx = context->GetNativeContext();
 
   JSObject* globalObject = global->GetGlobalJSObject();
 
diff --git a/content/xbl/src/nsXBLProtoImplProperty.cpp b/content/xbl/src/nsXBLProtoImplProperty.cpp
index 5b9ce8d67c7d..f7318ef2040e 100644
--- a/content/xbl/src/nsXBLProtoImplProperty.cpp
+++ b/content/xbl/src/nsXBLProtoImplProperty.cpp
@@ -155,7 +155,7 @@ nsXBLProtoImplProperty::InstallMember(nsIScriptContext* aContext,
 {
   NS_PRECONDITION(mIsCompiled,
                   "Should not be installing an uncompiled property");
-  JSContext* cx = (JSContext*) aContext->GetNativeContext();
+  JSContext* cx = aContext->GetNativeContext();
 
   nsIDocument *ownerDoc = aBoundElement->GetOwnerDoc();
   nsIScriptGlobalObject *sgo;
diff --git a/content/xul/content/src/nsXULElement.cpp b/content/xul/content/src/nsXULElement.cpp
index 5dce59212d58..5b8acd7f6618 100644
--- a/content/xul/content/src/nsXULElement.cpp
+++ b/content/xul/content/src/nsXULElement.cpp
@@ -797,7 +797,7 @@ nsScriptEventHandlerOwnerTearoff::CompileEventHandler(
                                      &argNames);
 
     nsCxPusher pusher;
-    if (!pusher.Push((JSContext*)context->GetNativeContext())) {
+    if (!pusher.Push(context->GetNativeContext())) {
       return NS_ERROR_FAILURE;
     }
 
diff --git a/content/xul/document/src/nsXULPrototypeDocument.cpp b/content/xul/document/src/nsXULPrototypeDocument.cpp
index 41086fde5c05..57f43d6e0bb4 100644
--- a/content/xul/document/src/nsXULPrototypeDocument.cpp
+++ b/content/xul/document/src/nsXULPrototypeDocument.cpp
@@ -728,7 +728,7 @@ nsXULPDGlobalObject::EnsureScriptEnvironment(PRUint32 lang_id)
   // attach it as the global for this context.  Then, ::SetScriptContext
   // will re-fetch the global and set it up in our language globals array.
   {
-    JSContext *cx = (JSContext *)ctxNew->GetNativeContext();
+    JSContext *cx = ctxNew->GetNativeContext();
     JSAutoRequest ar(cx);
 
     nsIPrincipal *principal = GetPrincipal();
diff --git a/content/xul/templates/src/nsXULTemplateBuilder.cpp b/content/xul/templates/src/nsXULTemplateBuilder.cpp
index 54fab0d91979..49257b2b16a7 100644
--- a/content/xul/templates/src/nsXULTemplateBuilder.cpp
+++ b/content/xul/templates/src/nsXULTemplateBuilder.cpp
@@ -1420,7 +1420,7 @@ nsXULTemplateBuilder::InitHTMLTemplateRoot()
     if (! context)
         return NS_ERROR_UNEXPECTED;
 
-    JSContext* jscontext = reinterpret_cast<JSContext*>(context->GetNativeContext());
+    JSContext* jscontext = context->GetNativeContext();
     NS_ASSERTION(context != nsnull, "no jscontext");
     if (! jscontext)
         return NS_ERROR_UNEXPECTED;
diff --git a/dom/base/nsDOMClassInfo.cpp b/dom/base/nsDOMClassInfo.cpp
index 43c80b78a217..15f0378f60a9 100644
--- a/dom/base/nsDOMClassInfo.cpp
+++ b/dom/base/nsDOMClassInfo.cpp
@@ -6492,7 +6492,7 @@ nsWindowSH::NewResolve(nsIXPConnectWrappedNative *wrapper, JSContext *cx,
     if (!my_context) {
       my_cx = cx;
     } else {
-      my_cx = (JSContext *)my_context->GetNativeContext();
+      my_cx = my_context->GetNativeContext();
 
       if (my_cx != cx) {
         if (!ac.enter(my_cx, obj)) {
@@ -9340,7 +9340,7 @@ public:
   {
     JSContext* cx = nsnull;
     if (mContext) {
-      cx = (JSContext*)mContext->GetNativeContext();
+      cx = mContext->GetNativeContext();
     } else {
       nsCOMPtr<nsIThreadJSContextStack> stack =
         do_GetService("@mozilla.org/js/xpc/ContextStack;1");
diff --git a/dom/base/nsGlobalWindow.cpp b/dom/base/nsGlobalWindow.cpp
index 6ba4cfdd1e52..7d5c08fb5ae9 100644
--- a/dom/base/nsGlobalWindow.cpp
+++ b/dom/base/nsGlobalWindow.cpp
@@ -1261,9 +1261,7 @@ nsGlobalWindow::FreeInnerObjects(PRBool aClearScope)
 
   // Kill all of the workers for this window.
   nsIScriptContext *scx = GetContextInternal();
-  JSContext *cx = scx ?
-                  static_cast<JSContext*>(scx->GetNativeContext()) :
-                  nsnull;
+  JSContext *cx = scx ? scx->GetNativeContext() : nsnull;
   mozilla::dom::workers::CancelWorkersForWindow(cx, this);
 
   // Close all IndexedDB databases for this window.
@@ -1864,7 +1862,7 @@ nsGlobalWindow::SetNewDocument(nsIDocument* aDocument,
   nsIScriptContext *scx = GetContextInternal();
   NS_ENSURE_TRUE(scx, NS_ERROR_NOT_INITIALIZED);
 
-  JSContext *cx = (JSContext *)scx->GetNativeContext();
+  JSContext *cx = scx->GetNativeContext();
 #ifndef MOZ_DISABLE_DOMCRYPTO
   // clear smartcard events, our document has gone away.
   if (mCrypto) {
@@ -2860,7 +2858,7 @@ nsGlobalWindow::DefineArgumentsProperty(nsIArray *aArguments)
   JSContext *cx;
   nsIScriptContext *ctx = GetOuterWindowInternal()->mContext;
   NS_ENSURE_TRUE(aArguments && ctx &&
-                 (cx = (JSContext *)ctx->GetNativeContext()),
+                 (cx = ctx->GetNativeContext()),
                  NS_ERROR_NOT_INITIALIZED);
 
   if (mIsModalContentWindow) {
@@ -6101,7 +6099,7 @@ PostMessageEvent::Run()
   JSContext* cx = nsnull;
   nsIScriptContext* scriptContext = mTargetWindow->GetContext();
   if (scriptContext) {
-    cx = (JSContext*)scriptContext->GetNativeContext();
+    cx = scriptContext->GetNativeContext();
   }
 
   if (!cx) {
@@ -9805,7 +9803,7 @@ nsGlobalWindow::BuildURIfromBase(const char *aURL, nsIURI **aBuiltURI,
     // such a way. This also makes us get the appropriate base URI for
     // the below URI resolution code.
 
-    cx = (JSContext *)scx->GetNativeContext();
+    cx = scx->GetNativeContext();
   } else {
     // get the JSContext from the call stack
     nsCOMPtr<nsIThreadJSContextStack> stack(do_GetService(sJSStackContractID));
@@ -9908,7 +9906,7 @@ nsGlobalWindow::SaveWindowState(nsISupports **aState)
   inner->Freeze();
 
   // Remember the outer window's prototype.
-  JSContext *cx = (JSContext *)mContext->GetNativeContext();
+  JSContext *cx = mContext->GetNativeContext();
   JSAutoRequest req(cx);
 
   nsIXPConnect *xpc = nsContentUtils::XPConnect();
@@ -10001,9 +9999,7 @@ nsGlobalWindow::SuspendTimeouts(PRUint32 aIncrease,
 
     // Suspend all of the workers for this window.
     nsIScriptContext *scx = GetContextInternal();
-    JSContext *cx = scx ?
-                    static_cast<JSContext*>(scx->GetNativeContext()) :
-                    nsnull;
+    JSContext *cx = scx ? scx->GetNativeContext() : nsnull;
     mozilla::dom::workers::SuspendWorkersForWindow(cx, this);
 
     TimeStamp now = TimeStamp::Now();
@@ -10079,9 +10075,7 @@ nsGlobalWindow::ResumeTimeouts(PRBool aThawChildren)
 
     // Resume all of the workers for this window.
     nsIScriptContext *scx = GetContextInternal();
-    JSContext *cx = scx ?
-                    static_cast<JSContext*>(scx->GetNativeContext()) :
-                    nsnull;
+    JSContext *cx = scx ? scx->GetNativeContext() : nsnull;
     mozilla::dom::workers::ResumeWorkersForWindow(cx, this);
 
     // Restore all of the timeouts, using the stored time remaining
@@ -10529,7 +10523,7 @@ nsGlobalChromeWindow::GetMessageManager(nsIChromeFrameMessageManager** aManager)
   if (!mMessageManager) {
     nsIScriptContext* scx = GetContextInternal();
     NS_ENSURE_STATE(scx);
-    JSContext* cx = (JSContext *)scx->GetNativeContext();
+    JSContext* cx = scx->GetNativeContext();
     NS_ENSURE_STATE(cx);
     nsCOMPtr<nsIChromeFrameMessageManager> globalMM =
       do_GetService("@mozilla.org/globalmessagemanager;1");
diff --git a/dom/base/nsIScriptContext.h b/dom/base/nsIScriptContext.h
index f334b17cee31..b65a0dfd3e06 100644
--- a/dom/base/nsIScriptContext.h
+++ b/dom/base/nsIScriptContext.h
@@ -43,6 +43,7 @@
 #include "nsISupports.h"
 #include "nsCOMPtr.h"
 #include "nsIProgrammingLanguage.h"
+#include "jspubtd.h"
 
 class nsIScriptGlobalObject;
 class nsIScriptSecurityManager;
@@ -73,8 +74,8 @@ NS_DEFINE_STATIC_IID_ACCESSOR(nsIScriptContextPrincipal,
                               NS_ISCRIPTCONTEXTPRINCIPAL_IID)
 
 #define NS_ISCRIPTCONTEXT_IID \
-  { 0xad76079b, 0xd408, 0x4159, \
-    {0xb7, 0x3f, 0x41, 0x08, 0x77, 0xff, 0x9b, 0x47 } }
+{ 0x827d1e82, 0x5aab, 0x4e3a, \
+  { 0x88, 0x76, 0x53, 0xf7, 0xed, 0x1e, 0x3f, 0xbe } }
 
 /* This MUST match JSVERSION_DEFAULT.  This version stuff if we don't
    know what language we have is a little silly... */
@@ -83,9 +84,6 @@ NS_DEFINE_STATIC_IID_ACCESSOR(nsIScriptContextPrincipal,
 /**
  * It is used by the application to initialize a runtime and run scripts.
  * A script runtime would implement this interface.
- * <P><I>It does have a bit too much java script information now, that
- * should be removed in a short time. Ideally this interface will be
- * language neutral</I>
  */
 class nsIScriptContext : public nsIScriptContextPrincipal
 {
@@ -292,7 +290,7 @@ public:
    * Return the native script context
    *
    **/
-  virtual void *GetNativeContext() = 0;
+  virtual JSContext* GetNativeContext() = 0;
 
   /**
    * Return the native global object for this context.
diff --git a/dom/base/nsJSEnvironment.cpp b/dom/base/nsJSEnvironment.cpp
index 2ce9b50a7a29..91c017105f2d 100644
--- a/dom/base/nsJSEnvironment.cpp
+++ b/dom/base/nsJSEnvironment.cpp
@@ -2242,7 +2242,7 @@ nsJSContext::ConnectToInner(nsIScriptGlobalObject *aNewInner, void *aOuterGlobal
   return NS_OK;
 }
 
-void *
+JSContext*
 nsJSContext::GetNativeContext()
 {
   return mContext;
diff --git a/dom/base/nsJSEnvironment.h b/dom/base/nsJSEnvironment.h
index 7753ebdbe394..54434ee0dfed 100644
--- a/dom/base/nsJSEnvironment.h
+++ b/dom/base/nsJSEnvironment.h
@@ -34,8 +34,8 @@
  * the terms of any one of the MPL, the GPL or the LGPL.
  *
  * ***** END LICENSE BLOCK ***** */
-#ifndef nsJSEnvironment_h___
-#define nsJSEnvironment_h___
+#ifndef nsJSEnvironment_h
+#define nsJSEnvironment_h
 
 #include "nsIScriptContext.h"
 #include "nsIScriptRuntime.h"
@@ -129,7 +129,7 @@ public:
 
   virtual void SetDefaultLanguageVersion(PRUint32 aVersion);
   virtual nsIScriptGlobalObject *GetGlobalObject();
-  virtual void *GetNativeContext();
+  virtual JSContext* GetNativeContext();
   virtual void *GetNativeGlobal();
   virtual nsresult CreateNativeGlobalForInner(
                                       nsIScriptGlobalObject *aGlobal,
@@ -370,4 +370,4 @@ JSBool NS_DOMWriteStructuredClone(JSContext* cx,
 
 void NS_DOMStructuredCloneError(JSContext* cx, uint32 errorid);
 
-#endif /* nsJSEnvironment_h___ */
+#endif /* nsJSEnvironment_h */
diff --git a/dom/indexedDB/IDBRequest.cpp b/dom/indexedDB/IDBRequest.cpp
index b4bef1abc722..5b9ed0f8a905 100644
--- a/dom/indexedDB/IDBRequest.cpp
+++ b/dom/indexedDB/IDBRequest.cpp
@@ -143,7 +143,7 @@ IDBRequest::SetDone(AsyncConnectionHelper* aHelper)
   }
 
   // Otherwise we need to get the result from the helper.
-  JSContext* cx = static_cast<JSContext*>(mScriptContext->GetNativeContext());
+  JSContext* cx = mScriptContext->GetNativeContext();
   NS_ASSERTION(cx, "Failed to get a context!");
 
   JSObject* global = static_cast<JSObject*>(mScriptContext->GetNativeGlobal());
diff --git a/dom/plugins/base/nsJSNPRuntime.cpp b/dom/plugins/base/nsJSNPRuntime.cpp
index 5830e6f04e4d..78d048d8fc72 100644
--- a/dom/plugins/base/nsJSNPRuntime.cpp
+++ b/dom/plugins/base/nsJSNPRuntime.cpp
@@ -361,7 +361,7 @@ GetJSContext(NPP npp)
   nsIScriptContext *scx = sgo->GetContext();
   NS_ENSURE_TRUE(scx, nsnull);
 
-  return (JSContext *)scx->GetNativeContext();
+  return scx->GetNativeContext();
 }
 
 }
diff --git a/dom/plugins/base/nsNPAPIPlugin.cpp b/dom/plugins/base/nsNPAPIPlugin.cpp
index fc6788d6d9ac..979c3f49a79f 100644
--- a/dom/plugins/base/nsNPAPIPlugin.cpp
+++ b/dom/plugins/base/nsNPAPIPlugin.cpp
@@ -718,7 +718,7 @@ GetJSContextFromDoc(nsIDocument *doc)
   nsIScriptContext *scx = sgo->GetContext();
   NS_ENSURE_TRUE(scx, nsnull);
 
-  return (JSContext *)scx->GetNativeContext();
+  return scx->GetNativeContext();
 }
 
 static JSContext *
diff --git a/dom/plugins/base/nsNPAPIPluginInstance.cpp b/dom/plugins/base/nsNPAPIPluginInstance.cpp
index e104f07fc782..30595af2c5f7 100644
--- a/dom/plugins/base/nsNPAPIPluginInstance.cpp
+++ b/dom/plugins/base/nsNPAPIPluginInstance.cpp
@@ -1263,7 +1263,7 @@ nsNPAPIPluginInstance::GetJSContext(JSContext* *outContext)
       nsIScriptContext *context = global->GetContext();
 
       if (context) {
-        *outContext = (JSContext*) context->GetNativeContext();
+        *outContext = context->GetNativeContext();
       }
     }
   }
diff --git a/dom/src/jsurl/nsJSProtocolHandler.cpp b/dom/src/jsurl/nsJSProtocolHandler.cpp
index e8382a643fe6..a73fec9752ef 100644
--- a/dom/src/jsurl/nsJSProtocolHandler.cpp
+++ b/dom/src/jsurl/nsJSProtocolHandler.cpp
@@ -267,7 +267,7 @@ nsresult nsJSThunk::EvaluateScript(nsIChannel *aChannel,
         //   principal of the context.
         nsCOMPtr<nsIPrincipal> objectPrincipal;
         rv = securityManager->
-            GetObjectPrincipal((JSContext*)scriptContext->GetNativeContext(),
+            GetObjectPrincipal(scriptContext->GetNativeContext(),
                                globalJSObject,
                                getter_AddRefs(objectPrincipal));
         if (NS_FAILED(rv))
@@ -294,7 +294,7 @@ nsresult nsJSThunk::EvaluateScript(nsIChannel *aChannel,
 
         // First check to make sure it's OK to evaluate this script to
         // start with.  For example, script could be disabled.
-        JSContext *cx = (JSContext*)scriptContext->GetNativeContext();
+        JSContext *cx = scriptContext->GetNativeContext();
         JSAutoRequest ar(cx);
 
         PRBool ok;
@@ -373,7 +373,7 @@ nsresult nsJSThunk::EvaluateScript(nsIChannel *aChannel,
         // lose the error), or it might be JS that then proceeds to
         // cause an error of its own (which will also make us lose
         // this error).
-        JSContext *cx = (JSContext*)scriptContext->GetNativeContext();
+        JSContext *cx = scriptContext->GetNativeContext();
         JSAutoRequest ar(cx);
         ::JS_ReportPendingException(cx);
     }
diff --git a/dom/workers/WorkerPrivate.cpp b/dom/workers/WorkerPrivate.cpp
index 07d0d0afb724..a1be1707b09c 100644
--- a/dom/workers/WorkerPrivate.cpp
+++ b/dom/workers/WorkerPrivate.cpp
@@ -2176,8 +2176,7 @@ WorkerPrivateParent<Derived>::ParentJSContext() const
       return RuntimeService::AutoSafeJSContext::GetSafeContext();
     }
 
-    NS_ASSERTION(mParentJSContext ==
-                 static_cast<JSContext*>(mScriptContext->GetNativeContext()),
+    NS_ASSERTION(mParentJSContext == mScriptContext->GetNativeContext(),
                  "Native context has changed!");
   }
 
@@ -2289,8 +2288,7 @@ WorkerPrivate::Create(JSContext* aCx, JSObject* aObj, WorkerPrivate* aParent,
         return nsnull;
       }
 
-      parentContext =
-        static_cast<JSContext*>(scriptContext->GetNativeContext());
+      parentContext = scriptContext->GetNativeContext();
 
       // If we're called from a window then we can dig out the principal and URI
       // from the document.
diff --git a/embedding/components/windowwatcher/src/nsWindowWatcher.cpp b/embedding/components/windowwatcher/src/nsWindowWatcher.cpp
index 96e6441c93d5..33b722d99baf 100644
--- a/embedding/components/windowwatcher/src/nsWindowWatcher.cpp
+++ b/embedding/components/windowwatcher/src/nsWindowWatcher.cpp
@@ -2116,7 +2116,7 @@ nsWindowWatcher::GetJSContextFromWindow(nsIDOMWindow *aWindow)
     if (sgo) {
       nsIScriptContext *scx = sgo->GetContext();
       if (scx)
-        cx = (JSContext *) scx->GetNativeContext();
+        cx = scx->GetNativeContext();
     }
     /* (off-topic note:) the nsIScriptContext can be retrieved by
     nsCOMPtr<nsIScriptContext> scx;
diff --git a/layout/generic/nsObjectFrame.cpp b/layout/generic/nsObjectFrame.cpp
index ad1503ae984d..dea6c16bbae9 100644
--- a/layout/generic/nsObjectFrame.cpp
+++ b/layout/generic/nsObjectFrame.cpp
@@ -2519,7 +2519,7 @@ nsObjectFrame::NotifyContentObjectWrapper()
   if (!scx)
     return;
 
-  JSContext *cx = (JSContext *)scx->GetNativeContext();
+  JSContext *cx = scx->GetNativeContext();
 
   nsCOMPtr<nsIXPConnectWrappedNative> wrapper;
   nsContentUtils::XPConnect()->
diff --git a/parser/html/nsHtml5TreeOpExecutor.cpp b/parser/html/nsHtml5TreeOpExecutor.cpp
index d672e088dc49..96a0fb3657a9 100644
--- a/parser/html/nsHtml5TreeOpExecutor.cpp
+++ b/parser/html/nsHtml5TreeOpExecutor.cpp
@@ -630,7 +630,7 @@ nsHtml5TreeOpExecutor::IsScriptEnabled()
   }
   nsIScriptContext *scriptContext = globalObject->GetContext();
   NS_ENSURE_TRUE(scriptContext, PR_TRUE);
-  JSContext* cx = (JSContext *) scriptContext->GetNativeContext();
+  JSContext* cx = scriptContext->GetNativeContext();
   NS_ENSURE_TRUE(cx, PR_TRUE);
   PRBool enabled = PR_TRUE;
   nsContentUtils::GetSecurityManager()->
diff --git a/xpfe/appshell/src/nsAppShellService.cpp b/xpfe/appshell/src/nsAppShellService.cpp
index 3f975ef50778..0c943f59b686 100644
--- a/xpfe/appshell/src/nsAppShellService.cpp
+++ b/xpfe/appshell/src/nsAppShellService.cpp
@@ -451,7 +451,7 @@ nsAppShellService::GetHiddenWindowAndJSContext(nsIDOMWindow **aWindow,
                 if (!scriptContext) { rv = NS_ERROR_FAILURE; break; }
 
                 // 5. Get JSContext from the script context.
-                JSContext *jsContext = (JSContext*)scriptContext->GetNativeContext();
+                JSContext *jsContext = scriptContext->GetNativeContext();
                 if (!jsContext) { rv = NS_ERROR_FAILURE; break; }
 
                 // Now, give results to caller.
diff --git a/xpfe/components/directory/nsDirectoryViewer.cpp b/xpfe/components/directory/nsDirectoryViewer.cpp
index 079f37042194..e2f0750bfdcd 100644
--- a/xpfe/components/directory/nsDirectoryViewer.cpp
+++ b/xpfe/components/directory/nsDirectoryViewer.cpp
@@ -198,8 +198,7 @@ nsHTTPIndex::OnFTPControlLog(PRBool server, const char *msg)
     nsIScriptContext *context = scriptGlobal->GetContext();
     NS_ENSURE_TRUE(context, NS_OK);
 
-    JSContext* cx = reinterpret_cast<JSContext*>
-                                    (context->GetNativeContext());
+    JSContext* cx = context->GetNativeContext();
     NS_ENSURE_TRUE(cx, NS_OK);
 
     JSObject* global = JS_GetGlobalObject(cx);
@@ -276,8 +275,7 @@ nsHTTPIndex::OnStartRequest(nsIRequest *request, nsISupports* aContext)
     nsIScriptContext *context = scriptGlobal->GetContext();
     NS_ENSURE_TRUE(context, NS_ERROR_FAILURE);
 
-    JSContext* cx = reinterpret_cast<JSContext*>
-                                    (context->GetNativeContext());
+    JSContext* cx = context->GetNativeContext();
     JSObject* global = JS_GetGlobalObject(cx);
 
     // Using XPConnect, wrap the HTTP index object...
diff --git a/xpinstall/src/nsJSInstallTriggerGlobal.cpp b/xpinstall/src/nsJSInstallTriggerGlobal.cpp
index 5b3e7dcb7174..360bb034eec7 100644
--- a/xpinstall/src/nsJSInstallTriggerGlobal.cpp
+++ b/xpinstall/src/nsJSInstallTriggerGlobal.cpp
@@ -744,7 +744,7 @@ nsresult InitInstallTriggerGlobalClass(JSContext *jscontext, JSObject *global, v
 //
 nsresult NS_InitInstallTriggerGlobalClass(nsIScriptContext *aContext, void **aPrototype)
 {
-  JSContext *jscontext = (JSContext *)aContext->GetNativeContext();
+  JSContext *jscontext = aContext->GetNativeContext();
   JSObject *proto = nsnull;
   JSObject *constructor = nsnull;
   JSObject *global = JS_GetGlobalObject(jscontext);
@@ -789,7 +789,7 @@ NS_NewScriptInstallTriggerGlobal(nsIScriptContext *aContext,
 
   JSObject *proto;
   JSObject *parent = nsnull;
-  JSContext *jscontext = (JSContext *)aContext->GetNativeContext();
+  JSContext *jscontext = aContext->GetNativeContext();
   nsresult result = NS_OK;
   nsIDOMInstallTriggerGlobal *installTriggerGlobal;
 

From 4542f418784678b855f89fe12132a5d051494e77 Mon Sep 17 00:00:00 2001
From: Ms2ger <ms2ger@gmail.com>
Date: Sun, 18 Sep 2011 11:22:18 +0200
Subject: [PATCH 188/209] Bug 684471 - Make nsGenericHTMLFormElement::mFieldSet
 a nsHTMLFieldSetElement*; r=peterv

---
 .../html/content/src/nsGenericHTMLElement.cpp | 54 ++++++++++++-------
 .../html/content/src/nsGenericHTMLElement.h   | 15 ++----
 .../html/content/src/nsHTMLFieldSetElement.h  |  9 ++++
 3 files changed, 48 insertions(+), 30 deletions(-)

diff --git a/content/html/content/src/nsGenericHTMLElement.cpp b/content/html/content/src/nsGenericHTMLElement.cpp
index 5073207fe628..e88523336a98 100644
--- a/content/html/content/src/nsGenericHTMLElement.cpp
+++ b/content/html/content/src/nsGenericHTMLElement.cpp
@@ -2505,7 +2505,7 @@ nsGenericHTMLFormElement::nsGenericHTMLFormElement(already_AddRefed<nsINodeInfo>
 nsGenericHTMLFormElement::~nsGenericHTMLFormElement()
 {
   if (mFieldSet) {
-    static_cast<nsHTMLFieldSetElement*>(mFieldSet)->RemoveElement(this);
+    mFieldSet->RemoveElement(this);
   }
 
   // Check that this element doesn't know anything about its form at this point.
@@ -2842,6 +2842,22 @@ nsGenericHTMLFormElement::PreHandleEvent(nsEventChainPreVisitor& aVisitor)
   return nsGenericHTMLElement::PreHandleEvent(aVisitor);
 }
 
+/* virtual */
+bool
+nsGenericHTMLFormElement::IsDisabled() const
+{
+  return HasAttr(kNameSpaceID_None, nsGkAtoms::disabled) ||
+         (mFieldSet && mFieldSet->IsDisabled());
+}
+
+void
+nsGenericHTMLFormElement::ForgetFieldSet(nsIContent* aFieldset)
+{
+  if (mFieldSet == aFieldset) {
+    mFieldSet = nsnull;
+  }
+}
+
 PRBool
 nsGenericHTMLFormElement::CanBeDisabled() const
 {
@@ -3092,32 +3108,30 @@ nsGenericHTMLFormElement::UpdateFieldSet(PRBool aNotify)
 
   for (parent = GetParent(); parent;
        prev = parent, parent = parent->GetParent()) {
-    if (parent->IsHTML(nsGkAtoms::fieldset)) {
-      nsHTMLFieldSetElement* fieldset =
-        static_cast<nsHTMLFieldSetElement*>(parent);
-
-      if (!prev || fieldset->GetFirstLegend() != prev) {
-        if (mFieldSet == fieldset) {
-          // We already have the right fieldset;
-          return;
-        }
-
-        if (mFieldSet) {
-          static_cast<nsHTMLFieldSetElement*>(mFieldSet)->RemoveElement(this);
-        }
-        mFieldSet = fieldset;
-        fieldset->AddElement(this);
-
-        // The disabled state may have changed
-        FieldSetDisabledChanged(aNotify);
+    nsHTMLFieldSetElement* fieldset =
+      nsHTMLFieldSetElement::FromContent(parent);
+    if (fieldset &&
+        (!prev || fieldset->GetFirstLegend() != prev)) {
+      if (mFieldSet == fieldset) {
+        // We already have the right fieldset;
         return;
       }
+
+      if (mFieldSet) {
+        mFieldSet->RemoveElement(this);
+      }
+      mFieldSet = fieldset;
+      fieldset->AddElement(this);
+
+      // The disabled state may have changed
+      FieldSetDisabledChanged(aNotify);
+      return;
     }
   }
 
   // No fieldset found.
   if (mFieldSet) {
-    static_cast<nsHTMLFieldSetElement*>(mFieldSet)->RemoveElement(this);
+    mFieldSet->RemoveElement(this);
     mFieldSet = nsnull;
     // The disabled state may have changed
     FieldSetDisabledChanged(aNotify);
diff --git a/content/html/content/src/nsGenericHTMLElement.h b/content/html/content/src/nsGenericHTMLElement.h
index 2ee9b362d914..f152e1df360f 100644
--- a/content/html/content/src/nsGenericHTMLElement.h
+++ b/content/html/content/src/nsGenericHTMLElement.h
@@ -835,6 +835,8 @@ private:
 
 //----------------------------------------------------------------------
 
+class nsHTMLFieldSetElement;
+
 /**
  * A helper class for form elements that can contain children
  */
@@ -885,10 +887,7 @@ public:
 
   virtual nsresult PreHandleEvent(nsEventChainPreVisitor& aVisitor);
 
-  virtual bool IsDisabled() const {
-    return HasAttr(kNameSpaceID_None, nsGkAtoms::disabled) ||
-           (mFieldSet && mFieldSet->IsDisabled());
-  }
+  virtual bool IsDisabled() const;
 
   /**
    * This callback is called by a fieldest on all its elements whenever its
@@ -912,11 +911,7 @@ public:
    *
    * @param aFieldSet The fieldset being removed.
    */
-  void ForgetFieldSet(nsIContent* aFieldset) {
-    if (mFieldSet == aFieldset) {
-      mFieldSet = nsnull;
-    }
-  }
+  void ForgetFieldSet(nsIContent* aFieldset);
 
   /**
    * Returns if the control can be disabled.
@@ -994,7 +989,7 @@ protected:
   nsHTMLFormElement* mForm;
 
   /* This is a pointer to our closest fieldset parent if any */
-  nsGenericHTMLFormElement* mFieldSet;
+  nsHTMLFieldSetElement* mFieldSet;
 };
 
 // If this flag is set on an nsGenericHTMLFormElement, that means that we have
diff --git a/content/html/content/src/nsHTMLFieldSetElement.h b/content/html/content/src/nsHTMLFieldSetElement.h
index 3196606c1d23..4c44db1f8cbd 100644
--- a/content/html/content/src/nsHTMLFieldSetElement.h
+++ b/content/html/content/src/nsHTMLFieldSetElement.h
@@ -53,6 +53,15 @@ public:
   nsHTMLFieldSetElement(already_AddRefed<nsINodeInfo> aNodeInfo);
   virtual ~nsHTMLFieldSetElement();
 
+  /** Typesafe, non-refcounting cast from nsIContent.  Cheaper than QI. **/
+  static nsHTMLFieldSetElement* FromContent(nsIContent* aContent)
+  {
+    if (!aContent || !aContent->IsHTML(nsGkAtoms::fieldset)) {
+      return nsnull;
+    }
+    return static_cast<nsHTMLFieldSetElement*>(aContent);
+  }
+
   // nsISupports
   NS_DECL_ISUPPORTS_INHERITED
 

From 3fdd2706832531fb7ef1a503966488aaeb26b065 Mon Sep 17 00:00:00 2001
From: Ms2ger <ms2ger@gmail.com>
Date: Sun, 18 Sep 2011 11:22:18 +0200
Subject: [PATCH 189/209] Bug 684470 - Remove the FromParser argument from
 nsHTMLMediaElement and subclasses' constructors; r=jst

---
 content/html/content/public/nsHTMLAudioElement.h | 3 +--
 content/html/content/public/nsHTMLMediaElement.h | 3 +--
 content/html/content/public/nsHTMLVideoElement.h | 3 +--
 content/html/content/src/nsHTMLAudioElement.cpp  | 7 +++----
 content/html/content/src/nsHTMLMediaElement.cpp  | 7 +------
 content/html/content/src/nsHTMLVideoElement.cpp  | 7 +++----
 6 files changed, 10 insertions(+), 20 deletions(-)

diff --git a/content/html/content/public/nsHTMLAudioElement.h b/content/html/content/public/nsHTMLAudioElement.h
index 2ba6666ea3e0..76e80cf5bb2c 100644
--- a/content/html/content/public/nsHTMLAudioElement.h
+++ b/content/html/content/public/nsHTMLAudioElement.h
@@ -50,8 +50,7 @@ class nsHTMLAudioElement : public nsHTMLMediaElement,
                            public nsIJSNativeInitializer
 {
 public:
-  nsHTMLAudioElement(already_AddRefed<nsINodeInfo> aNodeInfo,
-                     mozilla::dom::FromParser aFromParser = mozilla::dom::NOT_FROM_PARSER);
+  nsHTMLAudioElement(already_AddRefed<nsINodeInfo> aNodeInfo);
   virtual ~nsHTMLAudioElement();
 
   // nsISupports
diff --git a/content/html/content/public/nsHTMLMediaElement.h b/content/html/content/public/nsHTMLMediaElement.h
index 76bcf2a960f5..9885a388cf4b 100644
--- a/content/html/content/public/nsHTMLMediaElement.h
+++ b/content/html/content/public/nsHTMLMediaElement.h
@@ -73,8 +73,7 @@ public:
     CANPLAY_YES
   };
 
-  nsHTMLMediaElement(already_AddRefed<nsINodeInfo> aNodeInfo,
-                     mozilla::dom::FromParser aFromParser = mozilla::dom::NOT_FROM_PARSER);
+  nsHTMLMediaElement(already_AddRefed<nsINodeInfo> aNodeInfo);
   virtual ~nsHTMLMediaElement();
 
   /**
diff --git a/content/html/content/public/nsHTMLVideoElement.h b/content/html/content/public/nsHTMLVideoElement.h
index 56507b89f890..1475ace6ee7b 100644
--- a/content/html/content/public/nsHTMLVideoElement.h
+++ b/content/html/content/public/nsHTMLVideoElement.h
@@ -45,8 +45,7 @@ class nsHTMLVideoElement : public nsHTMLMediaElement,
                            public nsIDOMHTMLVideoElement
 {
 public:
-  nsHTMLVideoElement(already_AddRefed<nsINodeInfo> aNodeInfo,
-                     mozilla::dom::FromParser aFromParser = mozilla::dom::NOT_FROM_PARSER);
+  nsHTMLVideoElement(already_AddRefed<nsINodeInfo> aNodeInfo);
   virtual ~nsHTMLVideoElement();
 
   // nsISupports
diff --git a/content/html/content/src/nsHTMLAudioElement.cpp b/content/html/content/src/nsHTMLAudioElement.cpp
index 32e08a92b8ff..9096499037c2 100644
--- a/content/html/content/src/nsHTMLAudioElement.cpp
+++ b/content/html/content/src/nsHTMLAudioElement.cpp
@@ -90,7 +90,7 @@ NS_NewHTMLAudioElement(already_AddRefed<nsINodeInfo> aNodeInfo,
     NS_ENSURE_TRUE(nodeInfo, nsnull);
   }
 
-  return new nsHTMLAudioElement(nodeInfo.forget(), aFromParser);
+  return new nsHTMLAudioElement(nodeInfo.forget());
 }
 
 NS_IMPL_ADDREF_INHERITED(nsHTMLAudioElement, nsHTMLMediaElement)
@@ -108,9 +108,8 @@ NS_HTML_CONTENT_INTERFACE_TABLE_TAIL_CLASSINFO(HTMLAudioElement)
 NS_IMPL_ELEMENT_CLONE(nsHTMLAudioElement)
 
 
-nsHTMLAudioElement::nsHTMLAudioElement(already_AddRefed<nsINodeInfo> aNodeInfo,
-                                       FromParser aFromParser)
-  : nsHTMLMediaElement(aNodeInfo, aFromParser)
+nsHTMLAudioElement::nsHTMLAudioElement(already_AddRefed<nsINodeInfo> aNodeInfo)
+  : nsHTMLMediaElement(aNodeInfo)
 {
 }
 
diff --git a/content/html/content/src/nsHTMLMediaElement.cpp b/content/html/content/src/nsHTMLMediaElement.cpp
index 2e8e4316c7db..8f4f46ac0871 100644
--- a/content/html/content/src/nsHTMLMediaElement.cpp
+++ b/content/html/content/src/nsHTMLMediaElement.cpp
@@ -50,12 +50,8 @@
 #include "nsIDOMDocument.h"
 #include "nsDOMError.h"
 #include "nsNodeInfoManager.h"
-#include "plbase64.h"
-#include "nsNetUtil.h"
-#include "prmem.h"
 #include "nsNetUtil.h"
 #include "nsXPCOMStrings.h"
-#include "prlock.h"
 #include "nsThreadUtils.h"
 #include "nsIThreadInternal.h"
 #include "nsContentUtils.h"
@@ -1269,8 +1265,7 @@ NS_IMETHODIMP nsHTMLMediaElement::SetMuted(PRBool aMuted)
   return NS_OK;
 }
 
-nsHTMLMediaElement::nsHTMLMediaElement(already_AddRefed<nsINodeInfo> aNodeInfo,
-                                       FromParser aFromParser)
+nsHTMLMediaElement::nsHTMLMediaElement(already_AddRefed<nsINodeInfo> aNodeInfo)
   : nsGenericHTMLElement(aNodeInfo),
     mCurrentLoadID(0),
     mNetworkState(nsIDOMHTMLMediaElement::NETWORK_EMPTY),
diff --git a/content/html/content/src/nsHTMLVideoElement.cpp b/content/html/content/src/nsHTMLVideoElement.cpp
index 508a25d8e121..be39985065c5 100644
--- a/content/html/content/src/nsHTMLVideoElement.cpp
+++ b/content/html/content/src/nsHTMLVideoElement.cpp
@@ -66,7 +66,7 @@
 
 using namespace mozilla::dom;
 
-NS_IMPL_NS_NEW_HTML_ELEMENT_CHECK_PARSER(Video)
+NS_IMPL_NS_NEW_HTML_ELEMENT(Video)
 
 NS_IMPL_ADDREF_INHERITED(nsHTMLVideoElement, nsHTMLMediaElement)
 NS_IMPL_RELEASE_INHERITED(nsHTMLVideoElement, nsHTMLMediaElement)
@@ -100,9 +100,8 @@ NS_IMETHODIMP nsHTMLVideoElement::GetVideoHeight(PRUint32 *aVideoHeight)
   return NS_OK;
 }
 
-nsHTMLVideoElement::nsHTMLVideoElement(already_AddRefed<nsINodeInfo> aNodeInfo,
-                                       FromParser aFromParser)
-  : nsHTMLMediaElement(aNodeInfo, aFromParser)
+nsHTMLVideoElement::nsHTMLVideoElement(already_AddRefed<nsINodeInfo> aNodeInfo)
+  : nsHTMLMediaElement(aNodeInfo)
 {
 }
 

From 19eb2d5178a5fcb2e6f00c6f69fdf2234f1b7909 Mon Sep 17 00:00:00 2001
From: Ms2ger <ms2ger@gmail.com>
Date: Sun, 18 Sep 2011 11:22:18 +0200
Subject: [PATCH 190/209] Bug 687070 - Remove unused variable 'result' in
 nsDisplaySelectionOverlay::Paint; r=masayuki

---
 layout/generic/nsFrame.cpp | 1 -
 1 file changed, 1 deletion(-)

diff --git a/layout/generic/nsFrame.cpp b/layout/generic/nsFrame.cpp
index cdf7758dd1ca..0c78fa61da08 100644
--- a/layout/generic/nsFrame.cpp
+++ b/layout/generic/nsFrame.cpp
@@ -1059,7 +1059,6 @@ void nsDisplaySelectionOverlay::Paint(nsDisplayListBuilder* aBuilder,
                                       nsRenderingContext* aCtx)
 {
   LookAndFeel::ColorID colorID;
-  nsresult result;
   if (mSelectionValue == nsISelectionController::SELECTION_ON) {
     colorID = LookAndFeel::eColorID_TextSelectBackground;
   } else if (mSelectionValue == nsISelectionController::SELECTION_ATTENTION) {

From 90a3810d3afbcc5f0ba8063886e2e8e1e7103f7a Mon Sep 17 00:00:00 2001
From: Ms2ger <ms2ger@gmail.com>
Date: Sun, 18 Sep 2011 11:22:18 +0200
Subject: [PATCH 191/209] Bug 687096 - Remove entries for removed folders from
 LOCAL_INCLUDES; r=khuey

---
 accessible/src/xul/Makefile.in | 3 ---
 content/xtf/src/Makefile.in    | 5 +----
 2 files changed, 1 insertion(+), 7 deletions(-)

diff --git a/accessible/src/xul/Makefile.in b/accessible/src/xul/Makefile.in
index c4e95903431e..f8381b64c529 100644
--- a/accessible/src/xul/Makefile.in
+++ b/accessible/src/xul/Makefile.in
@@ -72,7 +72,4 @@ LOCAL_INCLUDES = \
   -I$(srcdir) \
   -I$(srcdir)/../base \
   -I$(srcdir)/../html \
-  -I$(srcdir)/../../../layout/html/base/src \
-  -I$(srcdir)/../../../layout/html/forms/src \
-  -I$(srcdir)/../../../layout/html/forms/public \
   $(NULL)
diff --git a/content/xtf/src/Makefile.in b/content/xtf/src/Makefile.in
index de0c295de830..1c4045236102 100644
--- a/content/xtf/src/Makefile.in
+++ b/content/xtf/src/Makefile.in
@@ -67,12 +67,9 @@ EXPORTS 	=  \
 include $(topsrcdir)/config/rules.mk
 
 INCLUDES += 	\
-		-I$(srcdir)/../../shared/public \
-		-I$(srcdir)/../../html/base/src \
 		-I$(srcdir)/../../xml/content/src \
-		-I$(srcdir)/../../../dom \
 		-I$(srcdir)/../../base/src \
-		-I$(srcdir)/../../../layout/html/base/src \
+		-I$(topsrcdir)/dom \
 		$(NULL)
 
 DEFINES += -D_IMPL_NS_LAYOUT

From a0dd8e028a0c4ef4ff020f1e59a3cc5fe134a957 Mon Sep 17 00:00:00 2001
From: Ms2ger <ms2ger@gmail.com>
Date: Sun, 18 Sep 2011 11:22:18 +0200
Subject: [PATCH 192/209] Bug 684472 - Reduce QIs in nsPrintingPromptService;
 r=bsmedberg

---
 .../src/os2/nsPrintingPromptService.cpp       | 40 ++++++++-----------
 .../unixshared/nsPrintingPromptService.cpp    | 37 +++++++----------
 .../src/win/nsPrintingPromptService.cpp       | 40 ++++++++-----------
 3 files changed, 48 insertions(+), 69 deletions(-)

diff --git a/embedding/components/printingui/src/os2/nsPrintingPromptService.cpp b/embedding/components/printingui/src/os2/nsPrintingPromptService.cpp
index 5ecfb1673653..19cee3fd1675 100644
--- a/embedding/components/printingui/src/os2/nsPrintingPromptService.cpp
+++ b/embedding/components/printingui/src/os2/nsPrintingPromptService.cpp
@@ -141,34 +141,28 @@ nsPrintingPromptService::ShowProgress(nsIDOMWindow*            parent,
     *notifyOnOpen = PR_FALSE;
 
     nsPrintProgress* prtProgress = new nsPrintProgress();
-    nsresult rv = prtProgress->QueryInterface(NS_GET_IID(nsIPrintProgress), (void**)getter_AddRefs(mPrintProgress));
-    NS_ENSURE_SUCCESS(rv, rv);
+    mPrintProgress = prtProgress;
+    mWebProgressListener = prtProgress;
 
-    rv = prtProgress->QueryInterface(NS_GET_IID(nsIWebProgressListener), (void**)getter_AddRefs(mWebProgressListener));
-    NS_ENSURE_SUCCESS(rv, rv);
+    nsCOMPtr<nsIPrintProgressParams> prtProgressParams = new nsPrintProgressParams();
+      
+    nsCOMPtr<nsIDOMWindow> parentWindow = parent;
 
-    nsPrintProgressParams* prtProgressParams = new nsPrintProgressParams();
-    rv = prtProgressParams->QueryInterface(NS_GET_IID(nsIPrintProgressParams), (void**)printProgressParams);
-    NS_ENSURE_SUCCESS(rv, rv);
-
-    if (printProgressParams) {
-        nsCOMPtr<nsIDOMWindow> parentDOMIntl = parent;
-
-        if (mWatcher && !parentDOMIntl) {
-            mWatcher->GetActiveWindow(getter_AddRefs(parentDOMIntl));
-        }
-
-        if (parentDOMIntl) {
-            mPrintProgress->OpenProgressDialog(parentDOMIntl,
-                                               isForPrinting?kPrintProgressDialogURL:kPrtPrvProgressDialogURL,
-                                               *printProgressParams, openDialogObserver, notifyOnOpen);
-        }
+    if (mWatcher && !parentWindow) {
+        mWatcher->GetActiveWindow(getter_AddRefs(parentWindow));
     }
 
-    *webProgressListener = static_cast<nsIWebProgressListener*>(this);
-    NS_ADDREF(*webProgressListener);
+    if (parentWindow) {
+        mPrintProgress->OpenProgressDialog(parentWindow,
+                                           isForPrinting ? kPrintProgressDialogURL : kPrtPrvProgressDialogURL,
+                                           prtProgressParams, openDialogObserver, notifyOnOpen);
+    }
 
-    return rv;
+    prtProgressParams.forget(printProgressParams);
+    nsCOMPtr<nsIWebProgressListener> myWebProgressListener = this;
+    myWebProgressListener.forget(webProgressListener);
+
+    return NS_OK;
 }
 
 /* void showPageSetup (in nsIDOMWindow parent, in nsIPrintSettings printSettings); */
diff --git a/embedding/components/printingui/src/unixshared/nsPrintingPromptService.cpp b/embedding/components/printingui/src/unixshared/nsPrintingPromptService.cpp
index ec50ce3514c1..b35bd32b20cd 100644
--- a/embedding/components/printingui/src/unixshared/nsPrintingPromptService.cpp
+++ b/embedding/components/printingui/src/unixshared/nsPrintingPromptService.cpp
@@ -144,34 +144,27 @@ nsPrintingPromptService::ShowProgress(nsIDOMWindow*            parent,
     *notifyOnOpen = PR_FALSE;
 
     nsPrintProgress* prtProgress = new nsPrintProgress(printSettings);
-    nsresult rv = prtProgress->QueryInterface(NS_GET_IID(nsIPrintProgress), (void**)getter_AddRefs(mPrintProgress));
-    NS_ENSURE_SUCCESS(rv, rv);
+    mPrintProgress = prtProgress;
+    mWebProgressListener = prtProgress;
 
-    rv = prtProgress->QueryInterface(NS_GET_IID(nsIWebProgressListener), (void**)getter_AddRefs(mWebProgressListener));
-    NS_ENSURE_SUCCESS(rv, rv);
+    nsCOMPtr<nsIPrintProgressParams> prtProgressParams = new nsPrintProgressParams();
 
-    nsPrintProgressParams* prtProgressParams = new nsPrintProgressParams();
-    rv = prtProgressParams->QueryInterface(NS_GET_IID(nsIPrintProgressParams), (void**)printProgressParams);
-    NS_ENSURE_SUCCESS(rv, rv);
+    nsCOMPtr<nsIDOMWindow> parentWindow = parent;
 
-    if (printProgressParams) {
-        nsCOMPtr<nsIDOMWindow> parentDOMIntl = parent;
-
-        if (mWatcher && !parentDOMIntl) {
-            mWatcher->GetActiveWindow(getter_AddRefs(parentDOMIntl));
-        }
-
-        if (parentDOMIntl) {
-            mPrintProgress->OpenProgressDialog(parentDOMIntl,
-                                               isForPrinting?kPrintProgressDialogURL:kPrtPrvProgressDialogURL,
-                                               *printProgressParams, openDialogObserver, notifyOnOpen);
-        }
+    if (mWatcher && !parentWindow) {
+        mWatcher->GetActiveWindow(getter_AddRefs(parentWindow));
     }
 
-    *webProgressListener = static_cast<nsIWebProgressListener*>(this);
-    NS_ADDREF(*webProgressListener);
+    if (parentWindow) {
+        mPrintProgress->OpenProgressDialog(parentWindow,
+                                           isForPrinting ? kPrintProgressDialogURL : kPrtPrvProgressDialogURL,
+                                           prtProgressParams, openDialogObserver, notifyOnOpen);
+    }
 
-    return rv;
+    prtProgressParams.forget(printProgressParams);
+    NS_ADDREF(*webProgressListener = this);
+
+    return NS_OK;
 }
 
 /* void showPageSetup (in nsIDOMWindow parent, in nsIPrintSettings printSettings); */
diff --git a/embedding/components/printingui/src/win/nsPrintingPromptService.cpp b/embedding/components/printingui/src/win/nsPrintingPromptService.cpp
index 79dce2b94cf1..0839010fdf0d 100644
--- a/embedding/components/printingui/src/win/nsPrintingPromptService.cpp
+++ b/embedding/components/printingui/src/win/nsPrintingPromptService.cpp
@@ -209,42 +209,34 @@ nsPrintingPromptService::ShowProgress(nsIDOMWindow*            parent,
     NS_ENSURE_ARG(notifyOnOpen);
 
     *notifyOnOpen = PR_FALSE;
-    if (mPrintProgress) 
-    {
+    if (mPrintProgress) {
         *webProgressListener = nsnull;
         *printProgressParams = nsnull;
         return NS_ERROR_FAILURE;
     }
 
     nsPrintProgress* prtProgress = new nsPrintProgress();
-    nsresult rv = prtProgress->QueryInterface(NS_GET_IID(nsIPrintProgress), (void**)getter_AddRefs(mPrintProgress));
-    NS_ENSURE_SUCCESS(rv, rv);
+    mPrintProgress = prtProgress;
+    mWebProgressListener = prtProgress;
 
-    rv = prtProgress->QueryInterface(NS_GET_IID(nsIWebProgressListener), (void**)getter_AddRefs(mWebProgressListener));
-    NS_ENSURE_SUCCESS(rv, rv);
+    nsCOMPtr<nsIPrintProgressParams> prtProgressParams = new nsPrintProgressParams();
 
-    nsPrintProgressParams* prtProgressParams = new nsPrintProgressParams();
-    rv = prtProgressParams->QueryInterface(NS_GET_IID(nsIPrintProgressParams), (void**)printProgressParams);
-    NS_ENSURE_SUCCESS(rv, rv);
+    nsCOMPtr<nsIDOMWindow> parentWindow = parent;
 
-    if (printProgressParams) {
-        nsCOMPtr<nsIDOMWindow> parentDOMIntl = parent;
-
-        if (mWatcher && !parentDOMIntl) {
-            mWatcher->GetActiveWindow(getter_AddRefs(parentDOMIntl));
-        }
-
-        if (parentDOMIntl) {
-            mPrintProgress->OpenProgressDialog(parentDOMIntl,
-                                               isForPrinting?kPrintProgressDialogURL:kPrtPrvProgressDialogURL,
-                                               *printProgressParams, openDialogObserver, notifyOnOpen);
-        }
+    if (mWatcher && !parentWindow) {
+        mWatcher->GetActiveWindow(getter_AddRefs(parentWindow));
     }
 
-    *webProgressListener = static_cast<nsIWebProgressListener*>(this);
-    NS_ADDREF(*webProgressListener);
+    if (parentWindow) {
+        mPrintProgress->OpenProgressDialog(parentWindow,
+                                           isForPrinting ? kPrintProgressDialogURL : kPrtPrvProgressDialogURL,
+                                           prtProgressParams, openDialogObserver, notifyOnOpen);
+    }
 
-    return rv;
+    prtProgressParams.forget(printProgressParams);
+    NS_ADDREF(*webProgressListener = this);
+
+    return NS_OK;
 }
 
 /* void showPageSetup (in nsIDOMWindow parent, in nsIPrintSettings printSettings); */

From 3e3400ebbc9a0cbe56ba34aade6961a57785d15c Mon Sep 17 00:00:00 2001
From: Olli Pettay <Olli.Pettay@helsinki.fi>
Date: Sat, 17 Sep 2011 06:32:32 -0700
Subject: [PATCH 193/209] Bug 675166 - Make DocumentTypeNode to use
 NodeInfoManager of the document, r=sicking

--HG--
extra : rebase_source : c05867591dc394695c35de92a0c62ca5df9db1d6
---
 content/base/public/nsContentCID.h            |  4 -
 content/base/public/nsIDocument.h             |  3 +-
 .../base/public/nsIPrivateDOMImplementation.h | 69 ----------------
 content/base/src/nsContentUtils.cpp           |  3 +-
 content/base/src/nsDOMDocumentType.cpp        | 79 +------------------
 content/base/src/nsDOMDocumentType.h          |  6 +-
 content/base/src/nsDocument.cpp               | 74 +++++++----------
 content/base/src/nsGenericElement.cpp         | 14 +---
 content/base/src/nsNodeInfoManager.h          |  1 -
 content/base/test/Makefile.in                 |  1 +
 content/base/test/test_bug450160.html         |  6 +-
 content/base/test/test_bug675166.html         | 57 +++++++++++++
 .../html/document/src/nsHTMLContentSink.cpp   |  2 +-
 content/xml/document/src/nsXMLContentSink.cpp |  2 +-
 content/xml/document/src/nsXMLDocument.cpp    |  5 +-
 content/xslt/src/xslt/txMozillaXMLOutput.cpp  |  2 +-
 .../test_createDocument03.html                |  7 +-
 .../test_createDocument04.html                |  7 +-
 .../test_documentimportnode07.html            |  7 +-
 .../test_documentimportnode08.html            |  7 +-
 ...domimplementationcreatedocumenttype01.html |  4 +-
 ...domimplementationcreatedocumenttype02.html |  4 +-
 .../dom-level2-core/test_importNode16.html    |  7 +-
 .../test_nodegetownerdocument01.html          |  4 +-
 layout/build/nsLayoutModule.cpp               |  6 --
 parser/html/nsHtml5TreeOperation.cpp          |  1 -
 26 files changed, 142 insertions(+), 240 deletions(-)
 delete mode 100644 content/base/public/nsIPrivateDOMImplementation.h
 create mode 100644 content/base/test/test_bug675166.html

diff --git a/content/base/public/nsContentCID.h b/content/base/public/nsContentCID.h
index a65f781f07fb..aa48b81da6fd 100644
--- a/content/base/public/nsContentCID.h
+++ b/content/base/public/nsContentCID.h
@@ -121,10 +121,6 @@
 #define NS_XBLSERVICE_CID \
 { 0x64f300a1, 0xc88c, 0x11d3, { 0x97, 0xfb, 0x0, 0x40, 0x5, 0x53, 0xee, 0xf0 } }
 
-// 3a9cd622-264d-11d4-ba06-0060b0fc76dd
-#define NS_DOM_IMPLEMENTATION_CID \
-{ 0x3a9cd622, 0x264d, 0x11d4, {0xba, 0x06, 0x00, 0x60, 0xb0, 0xfc, 0x76, 0xdd } }
-
 // {4aef38b7-6364-4e23-a5e7-12f837fbbd9c}
 #define NS_XMLCONTENTSERIALIZER_CID \
 { 0x4aef38b7, 0x6364, 0x4e23, { 0xa5, 0xe7, 0x12, 0xf8, 0x37, 0xfb, 0xbd, 0x9c } }
diff --git a/content/base/public/nsIDocument.h b/content/base/public/nsIDocument.h
index 00a1309f2c89..2a176b857222 100644
--- a/content/base/public/nsIDocument.h
+++ b/content/base/public/nsIDocument.h
@@ -1884,7 +1884,8 @@ NS_NewDOMDocument(nsIDOMDocument** aInstancePtrResult,
                   nsIURI* aDocumentURI,
                   nsIURI* aBaseURI,
                   nsIPrincipal* aPrincipal,
-                  PRBool aLoadedAsData);
+                  PRBool aLoadedAsData,
+                  nsIScriptGlobalObject* aEventObject);
 nsresult
 NS_NewPluginDocument(nsIDocument** aInstancePtrResult);
 
diff --git a/content/base/public/nsIPrivateDOMImplementation.h b/content/base/public/nsIPrivateDOMImplementation.h
deleted file mode 100644
index 56a5bb343014..000000000000
--- a/content/base/public/nsIPrivateDOMImplementation.h
+++ /dev/null
@@ -1,69 +0,0 @@
-/* -*- Mode: C++; tab-width: 2; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
-/* ***** BEGIN LICENSE BLOCK *****
- * Version: MPL 1.1/GPL 2.0/LGPL 2.1
- *
- * The contents of this file are subject to the Mozilla Public License Version
- * 1.1 (the "License"); you may not use this file except in compliance with
- * the License. You may obtain a copy of the License at
- * http://www.mozilla.org/MPL/
- *
- * Software distributed under the License is distributed on an "AS IS" basis,
- * WITHOUT WARRANTY OF ANY KIND, either express or implied. See the License
- * for the specific language governing rights and limitations under the
- * License.
- *
- * The Original Code is mozilla.org code.
- *
- * The Initial Developer of the Original Code is
- * Netscape Communications Corporation.
- * Portions created by the Initial Developer are Copyright (C) 1998
- * the Initial Developer. All Rights Reserved.
- *
- * Contributor(s):
- *
- * Alternatively, the contents of this file may be used under the terms of
- * either of the GNU General Public License Version 2 or later (the "GPL"),
- * or the GNU Lesser General Public License Version 2.1 or later (the "LGPL"),
- * in which case the provisions of the GPL or the LGPL are applicable instead
- * of those above. If you wish to allow use of your version of this file only
- * under the terms of either the GPL or the LGPL, and not to allow others to
- * use your version of this file under the terms of the MPL, indicate your
- * decision by deleting the provisions above and replace them with the notice
- * and other provisions required by the GPL or the LGPL. If you do not delete
- * the provisions above, a recipient may use your version of this file under
- * the terms of any one of the MPL, the GPL or the LGPL.
- *
- * ***** END LICENSE BLOCK ***** */
-
-#ifndef nsIPrivateDOMImplementation_h__
-#define nsIPrivateDOMImplementation_h__
-
-#include "nsISupports.h"
-
-class nsIURI;
-class nsIPrincipal;
-
-/*
- * Event listener manager interface.
- */
-#define NS_IPRIVATEDOMIMPLEMENTATION_IID \
-{ /* 87c20441-8b0d-4383-a189-52fef1dd5d8a */ \
-0x87c20441, 0x8b0d, 0x4383, \
- { 0xa1, 0x89, 0x52, 0xfe, 0xf1, 0xdd, 0x5d, 0x8a } }
-
-class nsIPrivateDOMImplementation : public nsISupports {
-
-public:
-  NS_DECLARE_STATIC_IID_ACCESSOR(NS_IPRIVATEDOMIMPLEMENTATION_IID)
-
-  NS_IMETHOD Init(nsIURI* aDocumentURI, nsIURI* aBaseURI,
-                  nsIPrincipal* aPrincipal) = 0;
-};
-
-NS_DEFINE_STATIC_IID_ACCESSOR(nsIPrivateDOMImplementation,
-                              NS_IPRIVATEDOMIMPLEMENTATION_IID)
-
-nsresult
-NS_NewDOMImplementation(nsIDOMDOMImplementation** aInstancePtrResult);
-
-#endif // nsIPrivateDOMImplementation_h__
diff --git a/content/base/src/nsContentUtils.cpp b/content/base/src/nsContentUtils.cpp
index 74540f879158..0ab0ef512cf0 100644
--- a/content/base/src/nsContentUtils.cpp
+++ b/content/base/src/nsContentUtils.cpp
@@ -3686,11 +3686,10 @@ nsContentUtils::CreateDocument(const nsAString& aNamespaceURI,
 {
   nsresult rv = NS_NewDOMDocument(aResult, aNamespaceURI, aQualifiedName,
                                   aDoctype, aDocumentURI, aBaseURI, aPrincipal,
-                                  PR_TRUE);
+                                  PR_TRUE, aEventObject);
   NS_ENSURE_SUCCESS(rv, rv);
 
   nsCOMPtr<nsIDocument> document = do_QueryInterface(*aResult);
-  document->SetScriptHandlingObject(aEventObject);
   
   // created documents are immediately "complete" (ready to use)
   document->SetReadyStateInternal(nsIDocument::READYSTATE_COMPLETE);
diff --git a/content/base/src/nsDOMDocumentType.cpp b/content/base/src/nsDOMDocumentType.cpp
index 1c1ef068e162..9ea33e863d26 100644
--- a/content/base/src/nsDOMDocumentType.cpp
+++ b/content/base/src/nsDOMDocumentType.cpp
@@ -55,34 +55,19 @@
 nsresult
 NS_NewDOMDocumentType(nsIDOMDocumentType** aDocType,
                       nsNodeInfoManager *aNodeInfoManager,
-                      nsIPrincipal *aPrincipal,
                       nsIAtom *aName,
                       const nsAString& aPublicId,
                       const nsAString& aSystemId,
                       const nsAString& aInternalSubset)
 {
-  NS_PRECONDITION(aNodeInfoManager || aPrincipal,
-                  "Must have a principal if no nodeinfo manager.");
   NS_ENSURE_ARG_POINTER(aDocType);
   NS_ENSURE_ARG_POINTER(aName);
 
-  nsRefPtr<nsNodeInfoManager> nimgr;
-  if (aNodeInfoManager) {
-    nimgr = aNodeInfoManager;
-  }
-  else {
-    nimgr = new nsNodeInfoManager();
-    nsresult rv = nimgr->Init(nsnull);
-    NS_ENSURE_SUCCESS(rv, rv);
-
-    nimgr->SetDocumentPrincipal(aPrincipal);
-  }
-
   nsCOMPtr<nsINodeInfo> ni =
-    nimgr->GetNodeInfo(nsGkAtoms::documentTypeNodeName, nsnull,
-                       kNameSpaceID_None,
-                       nsIDOMNode::DOCUMENT_TYPE_NODE,
-                       aName);
+    aNodeInfoManager->GetNodeInfo(nsGkAtoms::documentTypeNodeName, nsnull,
+                                  kNameSpaceID_None,
+                                  nsIDOMNode::DOCUMENT_TYPE_NODE,
+                                  aName);
   NS_ENSURE_TRUE(ni, NS_ERROR_OUT_OF_MEMORY);
 
   *aDocType = new nsDOMDocumentType(ni.forget(), aPublicId, aSystemId,
@@ -176,59 +161,3 @@ nsDOMDocumentType::CloneDataNode(nsINodeInfo *aNodeInfo, PRBool aCloneText) cons
                                mInternalSubset);
 }
 
-nsresult
-nsDOMDocumentType::BindToTree(nsIDocument *aDocument, nsIContent *aParent,
-                              nsIContent *aBindingParent,
-                              PRBool aCompileEventHandlers)
-{
-  if (!HasSameOwnerDoc(NODE_FROM(aParent, aDocument))) {
-    NS_ASSERTION(!GetOwnerDoc(), "Need to adopt or import first!");
-
-    // DocumentType nodes are the only nodes that can have a null ownerDocument
-    // according to the DOM spec, so we need to give them a new nodeinfo in that
-    // case.
-    // XXX We may want to move this to nsDOMImplementation::CreateDocument if
-    //     we want to rely on the nodeinfo and wrappers being right before
-    //     getting into ReplaceOrInsertBefore or doInsertChildAt. That would
-    //     break inserting DOMDocumentType nodes through other DOM methods
-    //     though.
-    nsNodeInfoManager *nimgr = aParent ?
-      aParent->NodeInfo()->NodeInfoManager() :
-      aDocument->NodeInfoManager();
-    nsCOMPtr<nsINodeInfo> newNodeInfo;
-    newNodeInfo = nimgr->GetNodeInfo(mNodeInfo->NameAtom(),
-                                     mNodeInfo->GetPrefixAtom(),
-                                     mNodeInfo->NamespaceID(),
-                                     nsIDOMNode::DOCUMENT_TYPE_NODE,
-                                     mNodeInfo->GetExtraName());
-    NS_ENSURE_TRUE(newNodeInfo, NS_ERROR_OUT_OF_MEMORY);
-
-    mNodeInfo.swap(newNodeInfo);
-
-    JSObject *oldScope = GetWrapper();
-    if (oldScope) {
-      nsIXPConnect *xpc = nsContentUtils::XPConnect();
-
-      JSContext *cx = nsnull;
-      JSObject *newScope = nsnull;
-      nsresult rv = nsContentUtils::GetContextAndScope(nsnull,
-                                                       nimgr->GetDocument(),
-                                                       &cx, &newScope);
-      if (cx && xpc) {
-        nsISupports *node = NS_ISUPPORTS_CAST(nsIContent*, this);
-        nsCOMPtr<nsIXPConnectJSObjectHolder> oldWrapper;
-        rv = xpc->ReparentWrappedNativeIfFound(cx, oldScope, newScope, node,
-                                               getter_AddRefs(oldWrapper));
-      }
-
-      if (NS_FAILED(rv)) {
-        mNodeInfo.swap(newNodeInfo);
-
-        return rv;
-      }
-    }
-  }
-
-  return nsGenericDOMDataNode::BindToTree(aDocument, aParent, aBindingParent,
-                                          aCompileEventHandlers);
-}
diff --git a/content/base/src/nsDOMDocumentType.h b/content/base/src/nsDOMDocumentType.h
index 49e9f93d190b..8989fffd0fb1 100644
--- a/content/base/src/nsDOMDocumentType.h
+++ b/content/base/src/nsDOMDocumentType.h
@@ -101,9 +101,6 @@ public:
 
   // nsIContent overrides
   virtual const nsTextFragment* GetText();
-  virtual nsresult BindToTree(nsIDocument *aDocument, nsIContent *aParent,
-                              nsIContent *aBindingParent,
-                              PRBool aCompileEventHandlers);
 
   virtual nsGenericDOMDataNode* CloneDataNode(nsINodeInfo *aNodeInfo,
                                               PRBool aCloneText) const;
@@ -117,8 +114,7 @@ protected:
 
 nsresult
 NS_NewDOMDocumentType(nsIDOMDocumentType** aDocType,
-                      nsNodeInfoManager *aOwnerDoc,
-                      nsIPrincipal *aPrincipal,
+                      nsNodeInfoManager* aNodeInfoManager,
                       nsIAtom *aName,
                       const nsAString& aPublicId,
                       const nsAString& aSystemId,
diff --git a/content/base/src/nsDocument.cpp b/content/base/src/nsDocument.cpp
index eab6e6b0daca..66018f3f5142 100644
--- a/content/base/src/nsDocument.cpp
+++ b/content/base/src/nsDocument.cpp
@@ -1321,46 +1321,33 @@ nsDOMStyleSheetSetList::GetSets(nsTArray<nsString>& aStyleSets)
 class nsDOMImplementation : public nsIDOMDOMImplementation
 {
 public:
-  nsDOMImplementation(nsIScriptGlobalObject* aScriptObject,
+  nsDOMImplementation(nsIDocument* aOwner,
+                      nsIScriptGlobalObject* aScriptObject,
                       nsIURI* aDocumentURI,
-                      nsIURI* aBaseURI,
-                      nsIPrincipal* aPrincipal);
+                      nsIURI* aBaseURI);
   virtual ~nsDOMImplementation();
 
-  NS_DECL_ISUPPORTS
+  NS_DECL_CYCLE_COLLECTING_ISUPPORTS
+  NS_DECL_CYCLE_COLLECTION_CLASS(nsDOMImplementation)
 
   // nsIDOMDOMImplementation
   NS_DECL_NSIDOMDOMIMPLEMENTATION
 
 protected:
+  nsCOMPtr<nsIDocument> mOwner;
   nsWeakPtr mScriptObject;
   nsCOMPtr<nsIURI> mDocumentURI;
   nsCOMPtr<nsIURI> mBaseURI;
-  nsCOMPtr<nsIPrincipal> mPrincipal;
 };
 
-
-nsresult
-NS_NewDOMImplementation(nsIDOMDOMImplementation** aInstancePtrResult)
-{
-  *aInstancePtrResult = new nsDOMImplementation(nsnull, nsnull, nsnull, nsnull);
-  if (!*aInstancePtrResult) {
-    return NS_ERROR_OUT_OF_MEMORY;
-  }
-
-  NS_ADDREF(*aInstancePtrResult);
-
-  return NS_OK;
-}
-
-nsDOMImplementation::nsDOMImplementation(nsIScriptGlobalObject* aScriptObject,
+nsDOMImplementation::nsDOMImplementation(nsIDocument* aOwner,
+                                         nsIScriptGlobalObject* aScriptObject,
                                          nsIURI* aDocumentURI,
-                                         nsIURI* aBaseURI,
-                                         nsIPrincipal* aPrincipal)
-  : mScriptObject(do_GetWeakReference(aScriptObject)),
+                                         nsIURI* aBaseURI)
+  : mOwner(aOwner),
+    mScriptObject(do_GetWeakReference(aScriptObject)),
     mDocumentURI(aDocumentURI),
-    mBaseURI(aBaseURI),
-    mPrincipal(aPrincipal)
+    mBaseURI(aBaseURI)
 {
 }
 
@@ -1371,15 +1358,16 @@ nsDOMImplementation::~nsDOMImplementation()
 DOMCI_DATA(DOMImplementation, nsDOMImplementation)
 
 // QueryInterface implementation for nsDOMImplementation
-NS_INTERFACE_MAP_BEGIN(nsDOMImplementation)
+NS_INTERFACE_MAP_BEGIN_CYCLE_COLLECTION(nsDOMImplementation)
   NS_INTERFACE_MAP_ENTRY(nsIDOMDOMImplementation)
   NS_INTERFACE_MAP_ENTRY_AMBIGUOUS(nsISupports, nsIDOMDOMImplementation)
   NS_DOM_INTERFACE_MAP_ENTRY_CLASSINFO(DOMImplementation)
 NS_INTERFACE_MAP_END
 
+NS_IMPL_CYCLE_COLLECTION_1(nsDOMImplementation, mOwner)
 
-NS_IMPL_ADDREF(nsDOMImplementation)
-NS_IMPL_RELEASE(nsDOMImplementation)
+NS_IMPL_CYCLE_COLLECTING_ADDREF(nsDOMImplementation)
+NS_IMPL_CYCLE_COLLECTING_RELEASE(nsDOMImplementation)
 
 
 NS_IMETHODIMP
@@ -1399,6 +1387,7 @@ nsDOMImplementation::CreateDocumentType(const nsAString& aQualifiedName,
                                         nsIDOMDocumentType** aReturn)
 {
   *aReturn = nsnull;
+  NS_ENSURE_STATE(mOwner);
 
   nsresult rv = nsContentUtils::CheckQName(aQualifiedName);
   NS_ENSURE_SUCCESS(rv, rv);
@@ -1409,7 +1398,8 @@ nsDOMImplementation::CreateDocumentType(const nsAString& aQualifiedName,
   // Indicate that there is no internal subset (not just an empty one)
   nsAutoString voidString;
   voidString.SetIsVoid(PR_TRUE);
-  return NS_NewDOMDocumentType(aReturn, nsnull, mPrincipal, name, aPublicId,
+  return NS_NewDOMDocumentType(aReturn, mOwner->NodeInfoManager(),
+                               name, aPublicId,
                                aSystemId, voidString);
 }
 
@@ -1443,21 +1433,14 @@ nsDOMImplementation::CreateDocument(const nsAString& aNamespaceURI,
     return NS_ERROR_DOM_NAMESPACE_ERR;
   }
 
-  if (aDoctype) {
-    nsCOMPtr<nsIDOMDocument> owner;
-    aDoctype->GetOwnerDocument(getter_AddRefs(owner));
-    if (owner) {
-      return NS_ERROR_DOM_WRONG_DOCUMENT_ERR;
-    }
-  }
-
   nsCOMPtr<nsIScriptGlobalObject> scriptHandlingObject =
     do_QueryReferent(mScriptObject);
   
   NS_ENSURE_STATE(!mScriptObject || scriptHandlingObject);
 
   return nsContentUtils::CreateDocument(aNamespaceURI, aQualifiedName, aDoctype,
-                                        mDocumentURI, mBaseURI, mPrincipal,
+                                        mDocumentURI, mBaseURI,
+                                        mOwner->NodePrincipal(),
                                         scriptHandlingObject, aReturn);
 }
 
@@ -1465,15 +1448,15 @@ NS_IMETHODIMP
 nsDOMImplementation::CreateHTMLDocument(const nsAString& aTitle,
                                         nsIDOMDocument** aReturn)
 {
-  *aReturn = NULL;
+  *aReturn = nsnull;
+  NS_ENSURE_STATE(mOwner);
 
   nsCOMPtr<nsIDOMDocumentType> doctype;
   // Indicate that there is no internal subset (not just an empty one)
   nsAutoString voidString;
   voidString.SetIsVoid(true);
   nsresult rv = NS_NewDOMDocumentType(getter_AddRefs(doctype),
-                                      NULL, // aNodeInfoManager
-                                      mPrincipal, // aPrincipal
+                                      mOwner->NodeInfoManager(),
                                       nsGkAtoms::html, // aName
                                       EmptyString(), // aPublicId
                                       EmptyString(), // aSystemId
@@ -1489,7 +1472,8 @@ nsDOMImplementation::CreateHTMLDocument(const nsAString& aTitle,
   nsCOMPtr<nsIDOMDocument> document;
   rv = nsContentUtils::CreateDocument(EmptyString(), EmptyString(),
                                       doctype, mDocumentURI, mBaseURI,
-                                      mPrincipal, scriptHandlingObject,
+                                      mOwner->NodePrincipal(),
+                                      scriptHandlingObject,
                                       getter_AddRefs(document));
   NS_ENSURE_SUCCESS(rv, rv);
   nsCOMPtr<nsIDocument> doc = do_QueryInterface(document);
@@ -4315,8 +4299,7 @@ nsDocument::GetImplementation(nsIDOMDOMImplementation** aImplementation)
     nsIScriptGlobalObject* scriptObject =
       GetScriptHandlingObject(hasHadScriptObject);
     NS_ENSURE_STATE(scriptObject || !hasHadScriptObject);
-    mDOMImplementation = new nsDOMImplementation(scriptObject, uri, uri,
-                                                 NodePrincipal());
+    mDOMImplementation = new nsDOMImplementation(this, scriptObject, uri, uri);
     if (!mDOMImplementation) {
       return NS_ERROR_OUT_OF_MEMORY;
     }
@@ -4806,6 +4789,7 @@ nsDocument::ImportNode(nsIDOMNode* aImportedNode,
     case nsIDOMNode::TEXT_NODE:
     case nsIDOMNode::CDATA_SECTION_NODE:
     case nsIDOMNode::COMMENT_NODE:
+    case nsIDOMNode::DOCUMENT_TYPE_NODE:
     {
       nsCOMPtr<nsINode> imported = do_QueryInterface(aImportedNode);
       NS_ENSURE_TRUE(imported, NS_ERROR_FAILURE);
@@ -6119,6 +6103,7 @@ nsDocument::AdoptNode(nsIDOMNode *aAdoptedNode, nsIDOMNode **aResult)
     case nsIDOMNode::TEXT_NODE:
     case nsIDOMNode::CDATA_SECTION_NODE:
     case nsIDOMNode::COMMENT_NODE:
+    case nsIDOMNode::DOCUMENT_TYPE_NODE:
     {
       // We don't want to adopt an element into its own contentDocument or into
       // a descendant contentDocument, so we check if the frameElement of this
@@ -6151,7 +6136,6 @@ nsDocument::AdoptNode(nsIDOMNode *aAdoptedNode, nsIDOMNode **aResult)
       return NS_ERROR_NOT_IMPLEMENTED;
     }
     case nsIDOMNode::DOCUMENT_NODE:
-    case nsIDOMNode::DOCUMENT_TYPE_NODE:
     case nsIDOMNode::ENTITY_NODE:
     case nsIDOMNode::NOTATION_NODE:
     {
diff --git a/content/base/src/nsGenericElement.cpp b/content/base/src/nsGenericElement.cpp
index 48790b8c1a19..351647305fbb 100644
--- a/content/base/src/nsGenericElement.cpp
+++ b/content/base/src/nsGenericElement.cpp
@@ -3594,14 +3594,8 @@ nsINode::doInsertChildAt(nsIContent* aKid, PRUint32 aIndex,
   mozAutoDocUpdate updateBatch(doc, UPDATE_CONTENT_MODEL, aNotify);
 
   if (!HasSameOwnerDoc(aKid)) {
-    // DocumentType nodes are the only nodes that can have a null
-    // ownerDocument according to the DOM spec, and we need to allow
-    // inserting them w/o calling AdoptNode().
-    if (aKid->NodeType() != nsIDOMNode::DOCUMENT_TYPE_NODE ||
-        aKid->GetOwnerDoc()) {
-      rv = AdoptNodeIntoOwnerDoc(this, aKid);
-      NS_ENSURE_SUCCESS(rv, rv);
-    }
+    rv = AdoptNodeIntoOwnerDoc(this, aKid);
+    NS_ENSURE_SUCCESS(rv, rv);
   }
 
   PRUint32 childCount = aChildArray.ChildCount();
@@ -4113,9 +4107,7 @@ nsINode::ReplaceOrInsertBefore(PRBool aReplace, nsINode* aNewChild,
   // DocumentType nodes are the only nodes that can have a null
   // ownerDocument according to the DOM spec, and we need to allow
   // inserting them w/o calling AdoptNode().
-  if (!HasSameOwnerDoc(newContent) &&
-      (nodeType != nsIDOMNode::DOCUMENT_TYPE_NODE ||
-       newContent->GetOwnerDoc())) {
+  if (!HasSameOwnerDoc(newContent)) {
     res = AdoptNodeIntoOwnerDoc(this, aNewChild);
     NS_ENSURE_SUCCESS(res, res);
   }
diff --git a/content/base/src/nsNodeInfoManager.h b/content/base/src/nsNodeInfoManager.h
index a2e0b8c94cb2..eab63158bf6f 100644
--- a/content/base/src/nsNodeInfoManager.h
+++ b/content/base/src/nsNodeInfoManager.h
@@ -139,7 +139,6 @@ protected:
   friend class nsXULPrototypeDocument;
   friend nsresult NS_NewDOMDocumentType(nsIDOMDocumentType** ,
                                         nsNodeInfoManager *,
-                                        nsIPrincipal *,
                                         nsIAtom *,
                                         const nsAString& ,
                                         const nsAString& ,
diff --git a/content/base/test/Makefile.in b/content/base/test/Makefile.in
index 6aa5b7b22b17..58b8d38f15a7 100644
--- a/content/base/test/Makefile.in
+++ b/content/base/test/Makefile.in
@@ -506,6 +506,7 @@ _TEST_FILES2 = \
 		test_bug675121.html \
 		file_bug675121.sjs \
 		test_bug654352.html \
+		test_bug675166.html \
 		test_bug682592.html \
 		bug682592-subframe.html \
 		bug682592-subframe-ref.html \
diff --git a/content/base/test/test_bug450160.html b/content/base/test/test_bug450160.html
index 86d6c5a61a0a..116cf9bca74f 100644
--- a/content/base/test/test_bug450160.html
+++ b/content/base/test/test_bug450160.html
@@ -27,7 +27,7 @@ function testHTMLDocuments(ids, isXHTML) {
                                                  ids[i],
                                                  null);
     ok(docType1, "No doctype?");
-    ok(!docType1.ownerDocument, "docType shouldn't have ownerDocument!");
+    ok(docType1.ownerDocument, "docType should have ownerDocument!");
     var doc1 = document.implementation.createDocument(null, null, docType1);
     is(docType1.ownerDocument, doc1, "docType should have ownerDocument!");
     ok(!doc1.documentElement, "Document shouldn't have document element!");
@@ -64,7 +64,7 @@ function testSVGDocument() {
                                                  "-//W3C//DTD SVG 1.1//EN",
                                                  null);
   ok(docType1, "No doctype?");
-  ok(!docType1.ownerDocument, "docType shouldn't have ownerDocument!");
+  ok(docType1.ownerDocument, "docType should have ownerDocument!");
   var doc1 = document.implementation.createDocument(null, null, docType1);
   is(docType1.ownerDocument, doc1, "docType should have ownerDocument!");
   ok(!doc1.documentElement, "Document shouldn't have document element!");
@@ -91,7 +91,7 @@ function testFooBarDocument() {
   var docType1 =
       document.implementation.createDocumentType("FooBar", "FooBar", null);
   ok(docType1, "No doctype?");
-  ok(!docType1.ownerDocument, "docType shouldn't have ownerDocument!");
+  ok(docType1.ownerDocument, "docType should have ownerDocument!");
   var doc1 = document.implementation.createDocument(null, null, docType1);
   is(docType1.ownerDocument, doc1, "docType should have ownerDocument!");
   ok(!doc1.documentElement, "Document shouldn't have document element!");
diff --git a/content/base/test/test_bug675166.html b/content/base/test/test_bug675166.html
new file mode 100644
index 000000000000..cef5ff5600a6
--- /dev/null
+++ b/content/base/test/test_bug675166.html
@@ -0,0 +1,57 @@
+<!DOCTYPE HTML>
+<html>
+<!--
+https://bugzilla.mozilla.org/show_bug.cgi?id=675166
+-->
+<head>
+  <title>Test for Bug 675166</title>
+  <script type="application/javascript" src="/tests/SimpleTest/SimpleTest.js"></script>
+  <link rel="stylesheet" type="text/css" href="/tests/SimpleTest/test.css"/>
+</head>
+<body>
+<a target="_blank" href="https://bugzilla.mozilla.org/show_bug.cgi?id=675166">Mozilla Bug 675166</a>
+<p id="display"></p>
+<div id="content" style="display: none">
+  
+</div>
+<pre id="test">
+<script type="application/javascript">
+
+/** Test for Bug 675166 **/
+
+
+var dt = document.implementation.createDocumentType("html", null, null);
+isnot(dt.ownerDocument, null, "DocumentType should have ownerDocument");
+
+var d = document.implementation.createDocument(null, null, dt);
+is(dt.ownerDocument, d, "DocumentType shouldn't have null ownerDocument");
+
+try {
+  document.implementation.createDocument(null, null, dt);
+  ok(true, "Creating document using already bound document type shouldn't throw!");
+} catch(ex) {
+  ok(false, "Creating document using already bound document type shouldn't throw!");
+}
+
+var d2 = document.implementation.createDocument(null, null, null);
+var dt2 = document.implementation.createDocumentType("html", null, null);
+d2.appendChild(dt2);
+is(dt2.ownerDocument, d2, "DocumentType shouldn't have null ownerDocument");
+
+is(document.ownerDocument, null, "Document's ownerDocument should be null!");
+is(document.documentElement.ownerDocument, document,
+   "Element should have ownerDocument!")
+
+is(dt2.parentNode, d2, "parentNode should be document!");
+d2.removeChild(dt2);
+is(dt2.parentNode, null, "parentNode should be null!");
+
+d.adoptNode(dt2);
+d2.adoptNode(dt2);
+d2.appendChild(dt2);
+is(dt2.parentNode, d2, "parentNode should be document!");
+
+</script>
+</pre>
+</body>
+</html>
diff --git a/content/html/document/src/nsHTMLContentSink.cpp b/content/html/document/src/nsHTMLContentSink.cpp
index 77b480037ce5..509636e608e2 100644
--- a/content/html/document/src/nsHTMLContentSink.cpp
+++ b/content/html/document/src/nsHTMLContentSink.cpp
@@ -2452,7 +2452,7 @@ HTMLContentSink::AddDocTypeDecl(const nsIParserNode& aNode)
     nsAutoString voidString;
     voidString.SetIsVoid(PR_TRUE);
     rv = NS_NewDOMDocumentType(getter_AddRefs(docType),
-                               mDocument->NodeInfoManager(), nsnull, nameAtom,
+                               mDocument->NodeInfoManager(), nameAtom,
                                publicId, systemId, voidString);
     NS_ENSURE_SUCCESS(rv, rv);
 
diff --git a/content/xml/document/src/nsXMLContentSink.cpp b/content/xml/document/src/nsXMLContentSink.cpp
index 2eb88dc5718d..8c06ed675bff 100644
--- a/content/xml/document/src/nsXMLContentSink.cpp
+++ b/content/xml/document/src/nsXMLContentSink.cpp
@@ -1245,7 +1245,7 @@ nsXMLContentSink::HandleDoctypeDecl(const nsAString & aSubset,
 
   // Create a new doctype node
   nsCOMPtr<nsIDOMDocumentType> docType;
-  rv = NS_NewDOMDocumentType(getter_AddRefs(docType), mNodeInfoManager, nsnull,
+  rv = NS_NewDOMDocumentType(getter_AddRefs(docType), mNodeInfoManager,
                              name, aPublicId, aSystemId, aSubset);
   if (NS_FAILED(rv) || !docType) {
     return rv;
diff --git a/content/xml/document/src/nsXMLDocument.cpp b/content/xml/document/src/nsXMLDocument.cpp
index 4bdb55f49bde..c43fec859e1d 100644
--- a/content/xml/document/src/nsXMLDocument.cpp
+++ b/content/xml/document/src/nsXMLDocument.cpp
@@ -103,7 +103,8 @@ NS_NewDOMDocument(nsIDOMDocument** aInstancePtrResult,
                   nsIURI* aDocumentURI,
                   nsIURI* aBaseURI,
                   nsIPrincipal* aPrincipal,
-                  PRBool aLoadedAsData)
+                  PRBool aLoadedAsData,
+                  nsIScriptGlobalObject* aEventObject)
 {
   // Note: can't require that aDocumentURI/aBaseURI/aPrincipal be non-null,
   // since at least one caller (XMLHttpRequest) doesn't have decent args to
@@ -153,6 +154,8 @@ NS_NewDOMDocument(nsIDOMDocument** aInstancePtrResult,
     return rv;
   }
 
+  d->SetScriptHandlingObject(aEventObject);
+  
   if (isHTML) {
     nsCOMPtr<nsIHTMLDocument> htmlDoc = do_QueryInterface(d);
     NS_ASSERTION(htmlDoc, "HTML Document doesn't implement nsIHTMLDocument?");
diff --git a/content/xslt/src/xslt/txMozillaXMLOutput.cpp b/content/xslt/src/xslt/txMozillaXMLOutput.cpp
index 35140ab8dc5a..2350b2229919 100644
--- a/content/xslt/src/xslt/txMozillaXMLOutput.cpp
+++ b/content/xslt/src/xslt/txMozillaXMLOutput.cpp
@@ -943,7 +943,7 @@ txMozillaXMLOutput::createResultDocument(const nsSubstring& aName, PRInt32 aNsID
             nsAutoString voidString;
             voidString.SetIsVoid(PR_TRUE);
             rv = NS_NewDOMDocumentType(getter_AddRefs(documentType),
-                                       mNodeInfoManager, nsnull,
+                                       mNodeInfoManager,
                                        doctypeName,
                                        mOutputFormat.mPublicId,
                                        mOutputFormat.mSystemId,
diff --git a/dom/tests/mochitest/dom-level2-core/test_createDocument03.html b/dom/tests/mochitest/dom-level2-core/test_createDocument03.html
index 27a97f20ef9f..ddb815cfa10b 100644
--- a/dom/tests/mochitest/dom-level2-core/test_createDocument03.html
+++ b/dom/tests/mochitest/dom-level2-core/test_createDocument03.html
@@ -77,6 +77,8 @@ var docName = 'createDocument03';
    DOMImplementation should raise WRONG_DOCUMENT_ERR DOMException
    if parameter doctype has been used with a different document.
    
+   The specification has changed! No exception should be thrown.
+   
    Invoke method createDocument(namespaceURI,qualifiedName,doctype) on
    this domimplementation where doctype is the type of this document.
    Method should raise WRONG_DOCUMENT_ERR DOMException.
@@ -110,11 +112,12 @@ function createDocument03() {
 		success = false;
 		try {
             aNewDoc = domImpl.createDocument(namespaceURI,qualifiedName,docType);
+            success = true;
         }
 		catch(ex) {
-      success = (typeof(ex.code) != 'undefined' && ex.code == 4);
+      success = false;
 		}
-		assertTrue("throw_WRONG_DOCUMENT_ERR",success);
+		//assertTrue("no_throw_WRONG_DOCUMENT_ERR",success);
 	}
 
 }
diff --git a/dom/tests/mochitest/dom-level2-core/test_createDocument04.html b/dom/tests/mochitest/dom-level2-core/test_createDocument04.html
index 0bcc44a1a9c2..cb5e7dabc12d 100644
--- a/dom/tests/mochitest/dom-level2-core/test_createDocument04.html
+++ b/dom/tests/mochitest/dom-level2-core/test_createDocument04.html
@@ -83,6 +83,8 @@ var docName = 'createDocument04';
    DOMImplementation should raise WRONG_DOCUMENT_ERR DOMException
    if parameter doctype was created from a different implementation.
    
+   The specification has changed! No exception should be thrown.
+   
    Invoke method createDocument(namespaceURI,qualifiedName,doctype) on
    a domimplementation that is different from this domimplementation.
    Doctype is the type of this document.
@@ -123,11 +125,12 @@ function createDocument04() {
 		success = false;
 		try {
             aNewDoc = domImpl.createDocument(namespaceURI,qualifiedName,docType);
+            success = true;
         }
 		catch(ex) {
-      success = (typeof(ex.code) != 'undefined' && ex.code == 4);
+      success = false;
 		}
-		assertTrue("throw_WRONG_DOCUMENT_ERR",success);
+		assertTrue("no_throw_WRONG_DOCUMENT_ERR",success);
 	}
 
 }
diff --git a/dom/tests/mochitest/dom-level2-core/test_documentimportnode07.html b/dom/tests/mochitest/dom-level2-core/test_documentimportnode07.html
index 9e2772f10a4f..f77c6155a754 100644
--- a/dom/tests/mochitest/dom-level2-core/test_documentimportnode07.html
+++ b/dom/tests/mochitest/dom-level2-core/test_documentimportnode07.html
@@ -82,6 +82,8 @@ var docName = 'documentimportnode07';
 	DocumentType object. Since DocumentType nodes cannot be imported, a 
 	NOT_SUPPORTED_ERR should be raised.
 
+	The specification has changed! No exception should be thrown.
+
 * @author IBM
 * @author Neil Delima
 * @see http://www.w3.org/TR/DOM-Level-2-Core/core
@@ -106,11 +108,12 @@ function documentimportnode07() {
 		success = false;
 		try {
             imported = doc.importNode(docType,true);
+            success = true;
         }
 		catch(ex) {
-      success = (typeof(ex.code) != 'undefined' && ex.code == 9);
+      success = false;
 		}
-		assertTrue("throw_NOT_SUPPORTED_ERR",success);
+		assertTrue("no_throw_NOT_SUPPORTED_ERR",success);
 	}
 
 }
diff --git a/dom/tests/mochitest/dom-level2-core/test_documentimportnode08.html b/dom/tests/mochitest/dom-level2-core/test_documentimportnode08.html
index 0773d1245a8f..fe6978556e22 100644
--- a/dom/tests/mochitest/dom-level2-core/test_documentimportnode08.html
+++ b/dom/tests/mochitest/dom-level2-core/test_documentimportnode08.html
@@ -81,6 +81,8 @@ var docName = 'documentimportnode08';
 	Using the method importNode with deep=true, try to import a newly created DOcumentType
 	node. Since DocumentType nodes cannot be imported, a NOT_SUPPORTED_ERR should be raised.
 
+	The specification has changed! No exception should be thrown.
+
 * @author IBM
 * @author Neil Delima
 * @see http://www.w3.org/TR/DOM-Level-2-Core/core
@@ -109,11 +111,12 @@ docType = domImpl.createDocumentType("test:root",nullNS,nullNS);
 		success = false;
 		try {
             imported = doc.importNode(docType,true);
+            success = true;
         }
 		catch(ex) {
-      success = (typeof(ex.code) != 'undefined' && ex.code == 9);
+      success = false;
 		}
-		assertTrue("throw_NOT_SUPPORTED_ERR",success);
+		assertTrue("no_throw_NOT_SUPPORTED_ERR",success);
 	}
 
 }
diff --git a/dom/tests/mochitest/dom-level2-core/test_domimplementationcreatedocumenttype01.html b/dom/tests/mochitest/dom-level2-core/test_domimplementationcreatedocumenttype01.html
index f498e2019dc4..76f8afacd39b 100644
--- a/dom/tests/mochitest/dom-level2-core/test_domimplementationcreatedocumenttype01.html
+++ b/dom/tests/mochitest/dom-level2-core/test_domimplementationcreatedocumenttype01.html
@@ -80,6 +80,8 @@ var docName = 'domimplementationcreatedocumenttype01';
 	publicIds and systemIds.  Check if the the DocumentType node was created with its 
 	ownerDocument attribute set to null.
 
+	The specification has changed! ownerDocument should not be null.
+
 * @author IBM
 * @author Neil Delima
 * @see http://www.w3.org/TR/DOM-Level-2-Core/core#Level-2-Core-DOM-createDocument
@@ -117,7 +119,7 @@ for(var indexN65629 = 0;indexN65629 < publicIds.length; indexN65629++) {
       assertNotNull("domimplementationcreatedocumenttype01_newDocType",newDocType);
 ownerDocument = newDocType.ownerDocument;
 
-      assertNull("domimplementationcreatedocumenttype01_ownerDocument",ownerDocument);
+      assertNotNull("domimplementationcreatedocumenttype01_ownerDocument",ownerDocument);
     
 	}
    
diff --git a/dom/tests/mochitest/dom-level2-core/test_domimplementationcreatedocumenttype02.html b/dom/tests/mochitest/dom-level2-core/test_domimplementationcreatedocumenttype02.html
index 040fb3946d65..88c02d32a218 100644
--- a/dom/tests/mochitest/dom-level2-core/test_domimplementationcreatedocumenttype02.html
+++ b/dom/tests/mochitest/dom-level2-core/test_domimplementationcreatedocumenttype02.html
@@ -80,6 +80,8 @@ var docName = 'domimplementationcreatedocumenttype02';
 	and a valid publicId and systemId.  Check if the the DocumentType node was created 
 	with its ownerDocument attribute set to null.
 
+	The specification has changed! ownerDocument should not be null.
+
 * @author IBM
 * @author Neil Delima
 * @see http://www.w3.org/TR/DOM-Level-2-Core/core#Level-2-Core-DOM-createDocType
@@ -123,7 +125,7 @@ for(var indexN65655 = 0;indexN65655 < qualifiedNames.length; indexN65655++) {
       assertNotNull("domimplementationcreatedocumenttype02_newDocType",newDocType);
 ownerDocument = newDocType.ownerDocument;
 
-      assertNull("domimplementationcreatedocumenttype02_ownerDocument",ownerDocument);
+      assertNotNull("domimplementationcreatedocumenttype02_ownerDocument",ownerDocument);
     
 	}
    
diff --git a/dom/tests/mochitest/dom-level2-core/test_importNode16.html b/dom/tests/mochitest/dom-level2-core/test_importNode16.html
index ec5b0b9712dc..6873bcee08cf 100644
--- a/dom/tests/mochitest/dom-level2-core/test_importNode16.html
+++ b/dom/tests/mochitest/dom-level2-core/test_importNode16.html
@@ -82,6 +82,8 @@ var docName = 'importNode16';
     The "importNode(importedNode,deep)" method for a 
    Document should raise NOT_SUPPORTED_ERR DOMException if
    the type of node being imported is DocumentType.
+
+   The specification has changed! No exception should be thrown.
    
    Retrieve document staff.xml and get its type.
    Invoke method importNode(importedNode,deep) where importedNode
@@ -120,11 +122,12 @@ function importNode16() {
 		success = false;
 		try {
             node = doc.importNode(docType,false);
+            success = true;
         }
 		catch(ex) {
-      success = (typeof(ex.code) != 'undefined' && ex.code == 9);
+      success = false;
 		}
-		assertTrue("throw_NOT_SUPPORTED_ERR",success);
+		assertTrue("no_throw_NOT_SUPPORTED_ERR",success);
 	}
 
 }
diff --git a/dom/tests/mochitest/dom-level2-core/test_nodegetownerdocument01.html b/dom/tests/mochitest/dom-level2-core/test_nodegetownerdocument01.html
index c3c9846a9983..640aeabf5d4d 100644
--- a/dom/tests/mochitest/dom-level2-core/test_nodegetownerdocument01.html
+++ b/dom/tests/mochitest/dom-level2-core/test_nodegetownerdocument01.html
@@ -79,6 +79,8 @@ var docName = 'nodegetownerdocument01';
 	Create a new DocumentType node.  Since this node is not used with any Document yet
 	verify if the ownerDocument is null.
 
+	The specification has changed! ownerDocument should not be null.
+
 * @author IBM
 * @author Neil Delima
 * @see http://www.w3.org/TR/DOM-Level-2-Core/core#node-ownerDoc
@@ -103,7 +105,7 @@ function nodegetownerdocument01() {
 docType = domImpl.createDocumentType("mydoc",nullID,nullID);
       ownerDoc = docType.ownerDocument;
 
-      assertNull("nodegetownerdocument01",ownerDoc);
+      assertNotNull("nodegetownerdocument01",ownerDoc);
     
 }
 
diff --git a/layout/build/nsLayoutModule.cpp b/layout/build/nsLayoutModule.cpp
index 78b831b75dc4..be5cf87cda32 100644
--- a/layout/build/nsLayoutModule.cpp
+++ b/layout/build/nsLayoutModule.cpp
@@ -269,9 +269,6 @@ nsresult
 NS_NewXULTreeBuilder(nsISupports* aOuter, REFNSIID aIID, void** aResult);
 #endif
 
-nsresult
-NS_NewDOMImplementation(nsIDOMDOMImplementation**);
-
 static void Shutdown();
 
 #ifdef MOZ_XTF
@@ -510,7 +507,6 @@ NS_GENERIC_FACTORY_CONSTRUCTOR(inDOMUtils)
 MAKE_CTOR(CreateNameSpaceManager,         nsINameSpaceManager,         NS_GetNameSpaceManager)
 MAKE_CTOR(CreateDocumentViewer,           nsIDocumentViewer,           NS_NewDocumentViewer)
 MAKE_CTOR(CreateHTMLDocument,             nsIDocument,                 NS_NewHTMLDocument)
-MAKE_CTOR(CreateDOMImplementation,        nsIDOMDOMImplementation,     NS_NewDOMImplementation)
 MAKE_CTOR(CreateXMLDocument,              nsIDocument,                 NS_NewXMLDocument)
 MAKE_CTOR(CreateSVGDocument,              nsIDocument,                 NS_NewSVGDocument)
 MAKE_CTOR(CreateImageDocument,            nsIDocument,                 NS_NewImageDocument)
@@ -746,7 +742,6 @@ NS_DEFINE_NAMED_CID(IN_DOMUTILS_CID);
 NS_DEFINE_NAMED_CID(NS_NAMESPACEMANAGER_CID);
 NS_DEFINE_NAMED_CID(NS_DOCUMENT_VIEWER_CID);
 NS_DEFINE_NAMED_CID(NS_HTMLDOCUMENT_CID);
-NS_DEFINE_NAMED_CID(NS_DOM_IMPLEMENTATION_CID);
 NS_DEFINE_NAMED_CID(NS_XMLDOCUMENT_CID);
 NS_DEFINE_NAMED_CID(NS_SVGDOCUMENT_CID);
 NS_DEFINE_NAMED_CID(NS_IMAGEDOCUMENT_CID);
@@ -881,7 +876,6 @@ static const mozilla::Module::CIDEntry kLayoutCIDs[] = {
   { &kNS_NAMESPACEMANAGER_CID, false, NULL, CreateNameSpaceManager },
   { &kNS_DOCUMENT_VIEWER_CID, false, NULL, CreateDocumentViewer },
   { &kNS_HTMLDOCUMENT_CID, false, NULL, CreateHTMLDocument },
-  { &kNS_DOM_IMPLEMENTATION_CID, false, NULL, CreateDOMImplementation },
   { &kNS_XMLDOCUMENT_CID, false, NULL, CreateXMLDocument },
   { &kNS_SVGDOCUMENT_CID, false, NULL, CreateSVGDocument },
   { &kNS_IMAGEDOCUMENT_CID, false, NULL, CreateImageDocument },
diff --git a/parser/html/nsHtml5TreeOperation.cpp b/parser/html/nsHtml5TreeOperation.cpp
index e9dfadcc6a92..df7fe4eecc07 100644
--- a/parser/html/nsHtml5TreeOperation.cpp
+++ b/parser/html/nsHtml5TreeOperation.cpp
@@ -592,7 +592,6 @@ nsHtml5TreeOperation::Perform(nsHtml5TreeOpExecutor* aBuilder,
       voidString.SetIsVoid(PR_TRUE);
       NS_NewDOMDocumentType(getter_AddRefs(docType),
                             aBuilder->GetNodeInfoManager(),
-                            nsnull,
                             name,
                             publicId,
                             systemId,

From 5acc65b28b4b8b73de8237d753207d865019e5fa Mon Sep 17 00:00:00 2001
From: Ed Morley <bmo@edmorley.co.uk>
Date: Sat, 17 Sep 2011 16:32:43 +0100
Subject: [PATCH 194/209] Backout latest JM merge for OSX 10.5 M-oth
 permaorange (see bug 687257) on a CLOSED TREE

---
 js/src/assembler/assembler/ARMAssembler.h     |  48 ++-
 .../AssemblerBufferWithConstantPool.h         |  31 +-
 .../assembler/assembler/MacroAssemblerARM.h   |  24 +-
 js/src/jit-test/tests/basic/bug685313.js      |  11 -
 js/src/jit-test/tests/basic/bug686396.js      |  16 -
 .../tests/basic/wrap-primitive-this.js        |   3 +-
 js/src/jit-test/tests/jaeger/bug684084-2.js   |   8 -
 js/src/jit-test/tests/jaeger/bug684824.js     |   7 -
 js/src/jit-test/tests/jaeger/bug684943.js     |   7 -
 .../jit-test/tests/jaeger/getelem-sanity-8.js |  13 -
 js/src/jit-test/tests/jaeger/getter-hook-1.js |  18 -
 js/src/jit-test/tests/jaeger/getter-hook-2.js |  19 -
 js/src/jsanalyze.h                            |  10 +-
 js/src/jscompartment.cpp                      | 112 ++++-
 js/src/jscompartment.h                        |   2 +-
 js/src/jsdbgapi.cpp                           |   2 +
 js/src/jsfriendapi.cpp                        |   9 -
 js/src/jsfun.cpp                              |   2 +-
 js/src/jsfun.h                                |  18 -
 js/src/jsgc.cpp                               |  28 +-
 js/src/jsinfer.cpp                            |  54 +--
 js/src/jsinfer.h                              |   3 +-
 js/src/jsinterp.cpp                           |  29 +-
 js/src/jsobj.cpp                              |  15 +-
 js/src/jsobjinlines.h                         |   4 +-
 js/src/jsopcode.cpp                           |   1 +
 js/src/jsopcode.tbl                           |   5 +-
 js/src/jstracer.cpp                           |  13 +-
 js/src/methodjit/BaseAssembler.h              |  60 ++-
 js/src/methodjit/BaseCompiler.h               |  79 ++--
 js/src/methodjit/Compiler.cpp                 | 252 +++---------
 js/src/methodjit/Compiler.h                   |  29 +-
 js/src/methodjit/FastOps.cpp                  |  25 +-
 js/src/methodjit/FrameState.cpp               |  89 +---
 js/src/methodjit/FrameState.h                 |  17 +-
 js/src/methodjit/InvokeHelpers.cpp            | 116 +++---
 js/src/methodjit/LoopState.cpp                |   9 +-
 js/src/methodjit/LoopState.h                  |   2 +-
 js/src/methodjit/MachineRegs.h                |  32 +-
 js/src/methodjit/MethodJIT.cpp                |  62 +--
 js/src/methodjit/MethodJIT.h                  |  39 +-
 js/src/methodjit/MonoIC.cpp                   | 384 +++++++++++-------
 js/src/methodjit/MonoIC.h                     |  20 +-
 js/src/methodjit/PolyIC.cpp                   | 219 +++-------
 js/src/methodjit/PolyIC.h                     |   8 +-
 js/src/methodjit/Retcon.cpp                   | 158 ++++---
 js/src/methodjit/Retcon.h                     |   2 +-
 js/src/methodjit/StubCalls.cpp                |  90 ++--
 js/src/methodjit/StubCalls.h                  |   5 +-
 js/src/methodjit/StubCompiler.cpp             |  10 +-
 js/src/methodjit/StubCompiler.h               |   4 +-
 js/src/methodjit/TrampolineCompiler.cpp       |   2 +-
 52 files changed, 874 insertions(+), 1351 deletions(-)
 delete mode 100644 js/src/jit-test/tests/basic/bug685313.js
 delete mode 100644 js/src/jit-test/tests/basic/bug686396.js
 delete mode 100644 js/src/jit-test/tests/jaeger/bug684084-2.js
 delete mode 100644 js/src/jit-test/tests/jaeger/bug684824.js
 delete mode 100644 js/src/jit-test/tests/jaeger/bug684943.js
 delete mode 100644 js/src/jit-test/tests/jaeger/getelem-sanity-8.js
 delete mode 100644 js/src/jit-test/tests/jaeger/getter-hook-1.js
 delete mode 100644 js/src/jit-test/tests/jaeger/getter-hook-2.js

diff --git a/js/src/assembler/assembler/ARMAssembler.h b/js/src/assembler/assembler/ARMAssembler.h
index 7a512a1c7f1f..d72c6f377bc1 100644
--- a/js/src/assembler/assembler/ARMAssembler.h
+++ b/js/src/assembler/assembler/ARMAssembler.h
@@ -947,10 +947,12 @@ namespace JSC {
             return m_buffer.sizeOfConstantPool();
         }
 
-        int flushCount()
+#ifdef DEBUG
+        void allowPoolFlush(bool allowFlush)
         {
-            return m_buffer.flushCount();
+            m_buffer.allowPoolFlush(allowFlush);
         }
+#endif
 
         JmpDst label()
         {
@@ -1454,12 +1456,7 @@ namespace JSC {
             // Encoded as bits [5,3:0].
             return ((reg << 5) & 0x20) | ((reg >> 1) & 0xf);
         }
-        ARMWord SN(int reg)
-        {
-            ASSERT(reg <= ARMRegisters::d31);
-            // Encoded as bits [19:16,7].
-            return ((reg << 15) & 0xf0000) | ((reg & 1) << 7);
-        }
+
         static ARMWord getConditionalField(ARMWord i)
         {
             return i & 0xf0000000;
@@ -1603,6 +1600,7 @@ namespace JSC {
             emitVFPInst(static_cast<ARMWord>(cc) | VFP_DXFER | VFP_MOV |
                         (fromFP ? DT_LOAD : 0) |
                         (isDbl ? VFP_DBL : 0), RD(r1), RN(r2), isDbl ? DM(rFP) : SM(rFP));
+            
         }
 
         void fcpyd_r(int dd, int dm, Condition cc = AL)
@@ -1612,7 +1610,7 @@ namespace JSC {
                            nameFpRegD(dd), nameFpRegD(dm));
             // TODO: emitInst doesn't work for VFP instructions, though it
             // seems to work for current usage.
-            emitVFPInst(static_cast<ARMWord>(cc) | FCPYD, DD(dd), DM(dm), 0);
+            emitInst(static_cast<ARMWord>(cc) | FCPYD, dd, dd, dm);
         }
 
         void faddd_r(int dd, int dn, int dm, Condition cc = AL)
@@ -1621,7 +1619,7 @@ namespace JSC {
                     IPFX   "%-15s %s, %s, %s\n", MAYBE_PAD, "vadd.f64", nameFpRegD(dd), nameFpRegD(dn), nameFpRegD(dm));
             // TODO: emitInst doesn't work for VFP instructions, though it
             // seems to work for current usage.
-            emitVFPInst(static_cast<ARMWord>(cc) | FADDD, DD(dd), DN(dn), DM(dm));
+            emitInst(static_cast<ARMWord>(cc) | FADDD, dd, dn, dm);
         }
 
         void fnegd_r(int dd, int dm, Condition cc = AL)
@@ -1637,7 +1635,7 @@ namespace JSC {
                     IPFX   "%-15s %s, %s, %s\n", MAYBE_PAD, "vdiv.f64", nameFpRegD(dd), nameFpRegD(dn), nameFpRegD(dm));
             // TODO: emitInst doesn't work for VFP instructions, though it
             // seems to work for current usage.
-            emitVFPInst(static_cast<ARMWord>(cc) | FDIVD, DD(dd), DN(dn), DM(dm));
+            emitInst(static_cast<ARMWord>(cc) | FDIVD, dd, dn, dm);
         }
 
         void fsubd_r(int dd, int dn, int dm, Condition cc = AL)
@@ -1646,7 +1644,7 @@ namespace JSC {
                     IPFX   "%-15s %s, %s, %s\n", MAYBE_PAD, "vsub.f64", nameFpRegD(dd), nameFpRegD(dn), nameFpRegD(dm));
             // TODO: emitInst doesn't work for VFP instructions, though it
             // seems to work for current usage.
-            emitVFPInst(static_cast<ARMWord>(cc) | FSUBD, DD(dd), DN(dn), DM(dm));
+            emitInst(static_cast<ARMWord>(cc) | FSUBD, dd, dn, dm);
         }
 
         void fabsd_r(int dd, int dm, Condition cc = AL)
@@ -1662,7 +1660,7 @@ namespace JSC {
                     IPFX   "%-15s %s, %s, %s\n", MAYBE_PAD, "vmul.f64", nameFpRegD(dd), nameFpRegD(dn), nameFpRegD(dm));
             // TODO: emitInst doesn't work for VFP instructions, though it
             // seems to work for current usage.
-            emitVFPInst(static_cast<ARMWord>(cc) | FMULD, DD(dd), DN(dn), DM(dm));
+            emitInst(static_cast<ARMWord>(cc) | FMULD, dd, dn, dm);
         }
 
         void fcmpd_r(int dd, int dm, Condition cc = AL)
@@ -1671,7 +1669,7 @@ namespace JSC {
                     IPFX   "%-15s %s, %s\n", MAYBE_PAD, "vcmp.f64", nameFpRegD(dd), nameFpRegD(dm));
             // TODO: emitInst doesn't work for VFP instructions, though it
             // seems to work for current usage.
-            emitVFPInst(static_cast<ARMWord>(cc) | FCMPD, DD(dd), 0, DM(dm));
+            emitInst(static_cast<ARMWord>(cc) | FCMPD, dd, 0, dm);
         }
 
         void fsqrtd_r(int dd, int dm, Condition cc = AL)
@@ -1680,49 +1678,49 @@ namespace JSC {
                     IPFX   "%-15s %s, %s\n", MAYBE_PAD, "vsqrt.f64", nameFpRegD(dd), nameFpRegD(dm));
             // TODO: emitInst doesn't work for VFP instructions, though it
             // seems to work for current usage.
-            emitVFPInst(static_cast<ARMWord>(cc) | FSQRTD, DD(dd), 0, DM(dm));
+            emitInst(static_cast<ARMWord>(cc) | FSQRTD, dd, 0, dm);
         }
 
         void fmsr_r(int dd, int rn, Condition cc = AL)
         {
             // TODO: emitInst doesn't work for VFP instructions, though it
             // seems to work for current usage.
-            emitVFPInst(static_cast<ARMWord>(cc) | FMSR, RD(rn), SN(dd), 0);
+            emitInst(static_cast<ARMWord>(cc) | FMSR, rn, dd, 0);
         }
 
         void fmrs_r(int rd, int dn, Condition cc = AL)
         {
             // TODO: emitInst doesn't work for VFP instructions, though it
             // seems to work for current usage.
-            emitVFPInst(static_cast<ARMWord>(cc) | FMRS, RD(rd), SN(dn), 0);
+            emitInst(static_cast<ARMWord>(cc) | FMRS, rd, dn, 0);
         }
 
-        // dear god :(
-        // integer registers ar encoded the same as single registers
         void fsitod_r(int dd, int dm, Condition cc = AL)
         {
             // TODO: emitInst doesn't work for VFP instructions, though it
             // seems to work for current usage.
-            emitVFPInst(static_cast<ARMWord>(cc) | FSITOD, DD(dd), 0, SM(dm));
+            emitInst(static_cast<ARMWord>(cc) | FSITOD, dd, 0, dm);
         }
 
         void fuitod_r(int dd, int dm, Condition cc = AL)
         {
             // TODO: emitInst doesn't work for VFP instructions, though it
             // seems to work for current usage.
-            emitVFPInst(static_cast<ARMWord>(cc) | FUITOD, DD(dd), 0, SM(dm));
+            emitInst(static_cast<ARMWord>(cc) | FUITOD, dd, 0, dm);
         }
 
         void ftosid_r(int fd, int dm, Condition cc = AL)
         {
-            // TODO: I don't actually know what the encoding is i'm guessing SD and DM.
-            emitVFPInst(static_cast<ARMWord>(cc) | FTOSID, SD(fd), 0, DM(dm));
+            // TODO: emitInst doesn't work for VFP instructions, though it
+            // seems to work for current usage.
+            emitInst(static_cast<ARMWord>(cc) | FTOSID, fd, 0, dm);
         }
 
         void ftosizd_r(int fd, int dm, Condition cc = AL)
         {
-            // TODO: I don't actually know what the encoding is i'm guessing SD and DM.
-            emitVFPInst(static_cast<ARMWord>(cc) | FTOSIZD, SD(fd), 0, DM(dm));
+            // TODO: emitInst doesn't work for VFP instructions, though it
+            // seems to work for current usage.
+            emitInst(static_cast<ARMWord>(cc) | FTOSIZD, fd, 0, dm);
         }
 
         void fmstat(Condition cc = AL)
diff --git a/js/src/assembler/assembler/AssemblerBufferWithConstantPool.h b/js/src/assembler/assembler/AssemblerBufferWithConstantPool.h
index 0d87bbeb09e1..ab51196fda77 100644
--- a/js/src/assembler/assembler/AssemblerBufferWithConstantPool.h
+++ b/js/src/assembler/assembler/AssemblerBufferWithConstantPool.h
@@ -106,7 +106,9 @@ public:
         , m_numConsts(0)
         , m_maxDistance(maxPoolSize)
         , m_lastConstDelta(0)
-        , m_flushCount(0)
+#ifdef DEBUG
+        , m_allowFlush(true)
+#endif
     {
         m_pool = static_cast<uint32_t*>(malloc(maxPoolSize));
         m_mask = static_cast<char*>(malloc(maxPoolSize / sizeof(uint32_t)));
@@ -239,16 +241,19 @@ public:
         return m_numConsts;
     }
 
-    int flushCount()
+#ifdef DEBUG
+    // Guard constant pool flushes to ensure that they don't occur during
+    // regions where offsets into the code have to be maintained (such as PICs).
+    void allowPoolFlush(bool allowFlush)
     {
-        return m_flushCount;
+        m_allowFlush = allowFlush;
     }
+#endif
 
 private:
     void correctDeltas(int insnSize)
     {
         m_maxDistance -= insnSize;
-        ASSERT(m_maxDistance >= 0);
         m_lastConstDelta -= insnSize;
         if (m_lastConstDelta < 0)
             m_lastConstDelta = 0;
@@ -259,7 +264,6 @@ private:
         correctDeltas(insnSize);
 
         m_maxDistance -= m_lastConstDelta;
-        ASSERT(m_maxDistance >= 0);
         m_lastConstDelta = constSize;
     }
 
@@ -267,9 +271,9 @@ private:
     {
         js::JaegerSpew(js::JSpew_Insns, " -- FLUSHING CONSTANT POOL WITH %d CONSTANTS --\n",
                        m_numConsts);
+        ASSERT(m_allowFlush);
         if (m_numConsts == 0)
             return;
-        m_flushCount++;
         int alignPool = (AssemblerBuffer::size() + (useBarrier ? barrierSize : 0)) & (sizeof(uint64_t) - 1);
 
         if (alignPool)
@@ -300,16 +304,12 @@ private:
         m_loadOffsets.clear();
         m_numConsts = 0;
         m_maxDistance = maxPoolSize;
-        ASSERT(m_maxDistance >= 0);
-
     }
 
     void flushIfNoSpaceFor(int nextInsnSize)
     {
-        if (m_numConsts == 0) {
-            m_maxDistance = maxPoolSize;
+        if (m_numConsts == 0)
             return;
-        }
         int lastConstDelta = m_lastConstDelta > nextInsnSize ? m_lastConstDelta - nextInsnSize : 0;
         if ((m_maxDistance < nextInsnSize + lastConstDelta + barrierSize + (int)sizeof(uint32_t)))
             flushConstantPool();
@@ -317,10 +317,8 @@ private:
 
     void flushIfNoSpaceFor(int nextInsnSize, int nextConstSize)
     {
-        if (m_numConsts == 0) {
-            m_maxDistance = maxPoolSize;
+        if (m_numConsts == 0)
             return;
-        }
         if ((m_maxDistance < nextInsnSize + m_lastConstDelta + nextConstSize + barrierSize + (int)sizeof(uint32_t)) ||
             (m_numConsts * sizeof(uint32_t) + nextConstSize >= maxPoolSize))
             flushConstantPool();
@@ -333,7 +331,10 @@ private:
     int m_numConsts;
     int m_maxDistance;
     int m_lastConstDelta;
-    int m_flushCount;
+
+#ifdef DEBUG
+    bool    m_allowFlush;
+#endif
 };
 
 } // namespace JSC
diff --git a/js/src/assembler/assembler/MacroAssemblerARM.h b/js/src/assembler/assembler/MacroAssemblerARM.h
index 2ab019c5da3b..0a51350a7ae6 100644
--- a/js/src/assembler/assembler/MacroAssemblerARM.h
+++ b/js/src/assembler/assembler/MacroAssemblerARM.h
@@ -1292,14 +1292,14 @@ public:
 
     void convertInt32ToDouble(RegisterID src, FPRegisterID dest)
     {
-        m_assembler.fmsr_r(floatShadow(dest), src);
-        m_assembler.fsitod_r(dest, floatShadow(dest));
+        m_assembler.fmsr_r(dest, src);
+        m_assembler.fsitod_r(dest, dest);
     }
 
     void convertUInt32ToDouble(RegisterID src, FPRegisterID dest)
     {
-        m_assembler.fmsr_r(floatShadow(dest), src);
-        m_assembler.fuitod_r(dest, floatShadow(dest));
+        m_assembler.fmsr_r(dest, src);
+        m_assembler.fuitod_r(dest, dest);
     }
 
     void convertInt32ToDouble(Address src, FPRegisterID dest)
@@ -1337,11 +1337,11 @@ public:
     // May also branch for some values that are representable in 32 bits
     Jump branchTruncateDoubleToInt32(FPRegisterID src, RegisterID dest)
     {
-        m_assembler.ftosizd_r(floatShadow(ARMRegisters::SD0), src);
+        m_assembler.ftosizd_r(ARMRegisters::SD0, src);
         // If FTOSIZD (VCVT.S32.F64) can't fit the result into a 32-bit
         // integer, it saturates at INT_MAX or INT_MIN. Testing this is
         // probably quicker than testing FPSCR for exception.
-        m_assembler.fmrs_r(dest, floatShadow(ARMRegisters::SD0));
+        m_assembler.fmrs_r(dest, ARMRegisters::SD0);
         m_assembler.cmn_r(dest, ARMAssembler::getOp2(-0x7fffffff));
         m_assembler.cmp_r(dest, ARMAssembler::getOp2(0x80000000), ARMCondition(NonZero));
         return Jump(m_assembler.jmp(ARMCondition(Zero)));
@@ -1353,11 +1353,11 @@ public:
     // (specifically, in this case, 0).
     void branchConvertDoubleToInt32(FPRegisterID src, RegisterID dest, JumpList& failureCases, FPRegisterID fpTemp)
     {
-        m_assembler.ftosid_r(floatShadow(ARMRegisters::SD0), src);
-        m_assembler.fmrs_r(dest, floatShadow(ARMRegisters::SD0));
+        m_assembler.ftosid_r(ARMRegisters::SD0, src);
+        m_assembler.fmrs_r(dest, ARMRegisters::SD0);
 
         // Convert the integer result back to float & compare to the original value - if not equal or unordered (NaN) then jump.
-        m_assembler.fsitod_r(ARMRegisters::SD0, floatShadow(ARMRegisters::SD0));
+        m_assembler.fsitod_r(ARMRegisters::SD0, ARMRegisters::SD0);
         failureCases.append(branchDouble(DoubleNotEqualOrUnordered, src, ARMRegisters::SD0));
 
         // If the result is zero, it might have been -0.0, and 0.0 equals to -0.0
@@ -1380,10 +1380,12 @@ public:
         m_assembler.forceFlushConstantPool();
     }
 
-    int flushCount()
+#ifdef DEBUG
+    void allowPoolFlush(bool allowFlush)
     {
-        return m_assembler.flushCount();
+        m_assembler.allowPoolFlush(allowFlush);
     }
+#endif
 
 protected:
     ARMAssembler::Condition ARMCondition(Condition cond)
diff --git a/js/src/jit-test/tests/basic/bug685313.js b/js/src/jit-test/tests/basic/bug685313.js
deleted file mode 100644
index f791e5e66bd6..000000000000
--- a/js/src/jit-test/tests/basic/bug685313.js
+++ /dev/null
@@ -1,11 +0,0 @@
-
-function foo() {
-    function D(){}
-    arr = [
-	   new (function D   (  ) { 
-		   D += '' + foo; 
-	       }), 
-        new D
-	   ];
-}
-foo();
diff --git a/js/src/jit-test/tests/basic/bug686396.js b/js/src/jit-test/tests/basic/bug686396.js
deleted file mode 100644
index 8123fc99c3e7..000000000000
--- a/js/src/jit-test/tests/basic/bug686396.js
+++ /dev/null
@@ -1,16 +0,0 @@
-
-(function () { 
-  assertEquals = function assertEquals(expected, found, name_opt) {  };
-})();
-function testOne(receiver, key, result) {
-  for(var i = 0; i != 10; i++ ) {
-    assertEquals(result, receiver[key]());
-  }
-}
-function TypeOfThis() { return typeof this; }
-Number.prototype.type = TypeOfThis;
-String.prototype.type = TypeOfThis;
-Boolean.prototype.type = TypeOfThis;
-testOne(2.3, 'type', 'object');
-testOne('x', 'type', 'object');
-testOne(true, 'type', 'object');
diff --git a/js/src/jit-test/tests/basic/wrap-primitive-this.js b/js/src/jit-test/tests/basic/wrap-primitive-this.js
index dd8d4adfba01..5c9db8085c4a 100644
--- a/js/src/jit-test/tests/basic/wrap-primitive-this.js
+++ b/js/src/jit-test/tests/basic/wrap-primitive-this.js
@@ -15,10 +15,9 @@
 var HOTLOOP = this.tracemonkey ? tracemonkey.HOTLOOP : 8;
 var a;
 function f(n) {
-  for (var i = 0; i < HOTLOOP; i++) {
+    for (var i = 0; i < HOTLOOP; i++)
         if (i == HOTLOOP - 2)
             a = this;
-  }
 }
 
 /*
diff --git a/js/src/jit-test/tests/jaeger/bug684084-2.js b/js/src/jit-test/tests/jaeger/bug684084-2.js
deleted file mode 100644
index 34ddae320a66..000000000000
--- a/js/src/jit-test/tests/jaeger/bug684084-2.js
+++ /dev/null
@@ -1,8 +0,0 @@
-function Function() {
-    try {
-    var g = this;
-    g.c("evil", eval);
-    } catch(b) {}
-}
-var o0 = Function.prototype;
-var f = new Function( (null ) );
diff --git a/js/src/jit-test/tests/jaeger/bug684824.js b/js/src/jit-test/tests/jaeger/bug684824.js
deleted file mode 100644
index 9e8ad9c7ee7a..000000000000
--- a/js/src/jit-test/tests/jaeger/bug684824.js
+++ /dev/null
@@ -1,7 +0,0 @@
-
-function X(n) {
-    while ('' + (n--)) {
-        break;
-    }
-}
-X();
diff --git a/js/src/jit-test/tests/jaeger/bug684943.js b/js/src/jit-test/tests/jaeger/bug684943.js
deleted file mode 100644
index 69ec5ca2bd6e..000000000000
--- a/js/src/jit-test/tests/jaeger/bug684943.js
+++ /dev/null
@@ -1,7 +0,0 @@
-
-function foo(x) {
-  for (var i = 0; i < 100; i++) {
-    x.f === i;
-  }
-}
-foo({f:"three"});
diff --git a/js/src/jit-test/tests/jaeger/getelem-sanity-8.js b/js/src/jit-test/tests/jaeger/getelem-sanity-8.js
deleted file mode 100644
index f203216ac2cc..000000000000
--- a/js/src/jit-test/tests/jaeger/getelem-sanity-8.js
+++ /dev/null
@@ -1,13 +0,0 @@
-
-// TI does not account for GETELEM accessing strings, so the GETELEM PIC must
-// update type constraints according to generated stubs.
-function foo(a, b) {
-  for (var j = 0; j < 5; j++)
-    a[b[j]] + " what";
-}
-var a = {a:"zero", b:"one", c:"two", d:"three", e:"four"};
-var b = ["a", "b", "c", "d", "e"];
-foo(a, b);
-foo(a, b);
-a.e = 4;
-foo(a, b);
diff --git a/js/src/jit-test/tests/jaeger/getter-hook-1.js b/js/src/jit-test/tests/jaeger/getter-hook-1.js
deleted file mode 100644
index 29ab9552ebee..000000000000
--- a/js/src/jit-test/tests/jaeger/getter-hook-1.js
+++ /dev/null
@@ -1,18 +0,0 @@
-// GETPROP PIC with multiple stubs containing getter hooks.
-
-function foo(arr) {
-  for (var i = 0; i < 100; i++)
-    arr[i].caller;
-}
-arr = Object.create(Object.prototype);
-first = Object.create({});
-first.caller = null;
-second = Object.create({});
-second.caller = null;
-for (var i = 0; i < 100; ) {
-  arr[i++] = first;
-  arr[i++] = foo;
-  arr[i++] = second;
-}
-foo.caller;
-foo(arr);
diff --git a/js/src/jit-test/tests/jaeger/getter-hook-2.js b/js/src/jit-test/tests/jaeger/getter-hook-2.js
deleted file mode 100644
index 4361ce1262dc..000000000000
--- a/js/src/jit-test/tests/jaeger/getter-hook-2.js
+++ /dev/null
@@ -1,19 +0,0 @@
-// PIC on CALLPROP invoking getter hook.
-
-function foo(arr) {
-  for (var i = 0; i < 100; i++)
-    arr[i].caller(false);
-}
-arr = Object.create(Object.prototype);
-first = Object.create({});
-first.caller = bar;
-second = Object.create({});
-second.caller = bar;
-for (var i = 0; i < 100; )
-  arr[i++] = foo;
-foo.caller;
-function bar(x) {
-  if (x)
-    foo(arr);
-}
-bar(true);
diff --git a/js/src/jsanalyze.h b/js/src/jsanalyze.h
index 9bbcb09ca906..5b7ac478dc45 100644
--- a/js/src/jsanalyze.h
+++ b/js/src/jsanalyze.h
@@ -140,14 +140,6 @@ class Bytecode
     /* Call whose result should be monitored. */
     bool monitoredTypesReturn : 1;
 
-    /*
-     * Dynamically observed state about the execution of this opcode. These are
-     * hints about the script for use during compilation.
-     */
-    bool arrayWriteHole: 1;  /* SETELEM which has written to an array hole. */
-    bool getStringElement:1; /* GETELEM which has accessed string properties. */
-    bool accessGetter: 1;    /* Property read on a shape with a getter hook. */
-
     /* Stack depth before this opcode. */
     uint32 stackDepth;
 
@@ -972,6 +964,7 @@ class ScriptAnalysis
     /* Accessors for bytecode information. */
 
     Bytecode& getCode(uint32 offset) {
+        JS_ASSERT(script->compartment()->activeAnalysis);
         JS_ASSERT(offset < script->length);
         JS_ASSERT(codeArray[offset]);
         return *codeArray[offset];
@@ -979,6 +972,7 @@ class ScriptAnalysis
     Bytecode& getCode(const jsbytecode *pc) { return getCode(pc - script->code); }
 
     Bytecode* maybeCode(uint32 offset) {
+        JS_ASSERT(script->compartment()->activeAnalysis);
         JS_ASSERT(offset < script->length);
         return codeArray[offset];
     }
diff --git a/js/src/jscompartment.cpp b/js/src/jscompartment.cpp
index d165ff79d308..51a407988d48 100644
--- a/js/src/jscompartment.cpp
+++ b/js/src/jscompartment.cpp
@@ -426,6 +426,42 @@ JSCompartment::wrap(JSContext *cx, AutoIdVector &props)
     return true;
 }
 
+#if defined JS_METHODJIT && defined JS_MONOIC
+/*
+ * Check if the pool containing the code for jit should be destroyed, per the
+ * heuristics in JSCompartment::sweep.
+ */
+static inline bool
+ScriptPoolDestroyed(JSContext *cx, mjit::JITScript *jit,
+                    uint32 releaseInterval, uint32 &counter)
+{
+    JSC::ExecutablePool *pool = jit->code.m_executablePool;
+    if (pool->m_gcNumber != cx->runtime->gcNumber) {
+        /*
+         * The m_destroy flag may have been set in a previous GC for a pool which had
+         * references we did not remove (e.g. from the compartment's ExecutableAllocator)
+         * and is still around. Forget we tried to destroy it in such cases.
+         */
+        pool->m_destroy = false;
+        pool->m_gcNumber = cx->runtime->gcNumber;
+        if (--counter == 0) {
+            pool->m_destroy = true;
+            counter = releaseInterval;
+        }
+    }
+    return pool->m_destroy;
+}
+
+static inline void
+ScriptTryDestroyCode(JSContext *cx, JSScript *script, bool normal,
+                     uint32 releaseInterval, uint32 &counter)
+{
+    mjit::JITScript *jit = normal ? script->jitNormal : script->jitCtor;
+    if (jit && ScriptPoolDestroyed(cx, jit, releaseInterval, counter))
+        mjit::ReleaseScriptCode(cx, script, !normal);
+}
+#endif // JS_METHODJIT && JS_MONOIC
+
 /*
  * This method marks pointers that cross compartment boundaries. It should be
  * called only for per-compartment GCs, since full GCs naturally follow pointers
@@ -470,7 +506,7 @@ JSCompartment::markTypes(JSTracer *trc)
 }
 
 void
-JSCompartment::sweep(JSContext *cx, bool releaseTypes)
+JSCompartment::sweep(JSContext *cx, uint32 releaseInterval)
 {
     /* Remove dead wrappers from the table. */
     for (WrapperMap::Enum e(crossCompartmentWrappers); !e.empty(); e.popFront()) {
@@ -509,13 +545,47 @@ JSCompartment::sweep(JSContext *cx, bool releaseTypes)
         traceMonitor()->sweep(cx);
 #endif
 
-#ifdef JS_METHODJIT
-    /* Purge ICs in the compartment. These can reference GC things. */
+# if defined JS_METHODJIT && defined JS_POLYIC
+    /*
+     * Purge all PICs in the compartment. These can reference type data and
+     * need to know which types are pending collection.
+     */
     for (CellIterUnderGC i(this, FINALIZE_SCRIPT); !i.done(); i.next()) {
         JSScript *script = i.get<JSScript>();
-        mjit::PurgeICs(cx, script);
+        if (script->hasJITCode())
+            mjit::ic::PurgePICs(cx, script);
+    }
+# endif
+
+    bool discardScripts = !active && (releaseInterval != 0 || hasDebugModeCodeToDrop);
+
+#if defined JS_METHODJIT && defined JS_MONOIC
+
+    /*
+     * The release interval is the frequency with which we should try to destroy
+     * executable pools by releasing all JIT code in them, zero to never destroy pools.
+     * Initialize counter so that the first pool will be destroyed, and eventually drive
+     * the amount of JIT code in never-used compartments to zero. Don't discard anything
+     * for compartments which currently have active stack frames.
+     */
+    uint32 counter = 1;
+    if (discardScripts)
+        hasDebugModeCodeToDrop = false;
+
+    for (CellIterUnderGC i(this, FINALIZE_SCRIPT); !i.done(); i.next()) {
+        JSScript *script = i.get<JSScript>();
+        if (script->hasJITCode()) {
+            mjit::ic::SweepCallICs(cx, script, discardScripts);
+            if (discardScripts) {
+                ScriptTryDestroyCode(cx, script, true, releaseInterval, counter);
+                ScriptTryDestroyCode(cx, script, false, releaseInterval, counter);
+            }
+        }
     }
 
+#endif
+
+#ifdef JS_METHODJIT
     if (types.inferenceEnabled)
         mjit::ClearAllFrames(this);
 #endif
@@ -548,35 +618,23 @@ JSCompartment::sweep(JSContext *cx, bool releaseTypes)
          * enabled in the compartment.
          */
         if (types.inferenceEnabled) {
-            if (active)
-                releaseTypes = false;
             for (CellIterUnderGC i(this, FINALIZE_SCRIPT); !i.done(); i.next()) {
                 JSScript *script = i.get<JSScript>();
                 if (script->types) {
                     types::TypeScript::Sweep(cx, script);
 
                     /*
-                     * Periodically release observed types for all scripts.
-                     * This is always safe to do when there are no frames for
-                     * the compartment on the stack.
+                     * On each 1/8 lifetime, release observed types for all scripts.
+                     * This is always safe to do when there are no frames for the
+                     * compartment on the stack.
                      */
-                    if (releaseTypes) {
+                    if (discardScripts) {
                         script->types->destroy();
                         script->types = NULL;
                         script->typesPurged = true;
                     }
                 }
             }
-        } else {
-#ifdef JS_METHODJIT
-            /* :XXX: bug 685358 only releasing jitcode if there are no frames on the stack */
-            if (!active) {
-                for (CellIterUnderGC i(this, FINALIZE_SCRIPT); !i.done(); i.next()) {
-                    JSScript *script = i.get<JSScript>();
-                    mjit::ReleaseScriptCode(cx, script);
-                }
-            }
-#endif
         }
 
         types.sweep(cx);
@@ -626,6 +684,20 @@ JSCompartment::purge(JSContext *cx)
         if (hasTraceMonitor())
             traceMonitor()->needFlush = JS_TRUE;
 #endif
+
+#if defined JS_METHODJIT && defined JS_MONOIC
+    /*
+     * MICs do not refer to data which can be GC'ed and do not generate stubs
+     * which might need to be discarded, but are sensitive to shape regeneration.
+     */
+    if (cx->runtime->gcRegenShapes) {
+        for (CellIterUnderGC i(this, FINALIZE_SCRIPT); !i.done(); i.next()) {
+            JSScript *script = i.get<JSScript>();
+            if (script->hasJITCode())
+                mjit::ic::PurgeMICs(cx, script);
+        }
+    }
+#endif
 }
 
 MathCache *
diff --git a/js/src/jscompartment.h b/js/src/jscompartment.h
index 32398e426165..cfd240ac3969 100644
--- a/js/src/jscompartment.h
+++ b/js/src/jscompartment.h
@@ -532,7 +532,7 @@ struct JS_FRIEND_API(JSCompartment) {
     bool wrap(JSContext *cx, js::AutoIdVector &props);
 
     void markTypes(JSTracer *trc);
-    void sweep(JSContext *cx, bool releaseTypes);
+    void sweep(JSContext *cx, uint32 releaseInterval);
     void purge(JSContext *cx);
 
     void setGCLastBytes(size_t lastBytes, JSGCInvocationKind gckind);
diff --git a/js/src/jsdbgapi.cpp b/js/src/jsdbgapi.cpp
index a4c343b091d5..36f7322413a5 100644
--- a/js/src/jsdbgapi.cpp
+++ b/js/src/jsdbgapi.cpp
@@ -2166,6 +2166,8 @@ JS_GetFunctionCallback(JSContext *cx)
 JS_PUBLIC_API(void)
 JS_DumpBytecode(JSContext *cx, JSScript *script)
 {
+    JS_ASSERT(!cx->runtime->gcRunning);
+
 #if defined(DEBUG)
     AutoArenaAllocator mark(&cx->tempPool);
     Sprinter sprinter;
diff --git a/js/src/jsfriendapi.cpp b/js/src/jsfriendapi.cpp
index 56ba8d05f5c6..6bdcb72d515c 100644
--- a/js/src/jsfriendapi.cpp
+++ b/js/src/jsfriendapi.cpp
@@ -93,15 +93,6 @@ JS_SplicePrototype(JSContext *cx, JSObject *obj, JSObject *proto)
      * does not nuke type information for the object.
      */
     CHECK_REQUEST(cx);
-
-    if (!obj->hasSingletonType()) {
-        /*
-         * We can see non-singleton objects when trying to splice prototypes
-         * due to mutable __proto__ (ugh).
-         */
-        return JS_SetPrototype(cx, obj, proto);
-    }
-
     return obj->splicePrototype(cx, proto);
 }
 
diff --git a/js/src/jsfun.cpp b/js/src/jsfun.cpp
index 213adf638a38..f73abb9ca3f7 100644
--- a/js/src/jsfun.cpp
+++ b/js/src/jsfun.cpp
@@ -1266,7 +1266,7 @@ StackFrame::getValidCalleeObject(JSContext *cx, Value *vp)
              * track of the method, so we associate it with the first barriered
              * object found starting from thisp on the prototype chain.
              */
-            JSObject *newfunobj = CloneFunctionObject(cx, fun);
+            JSObject *newfunobj = CloneFunctionObject(cx, fun, fun->getParent(), true);
             if (!newfunobj)
                 return false;
             newfunobj->setMethodObj(*first_barriered_thisp);
diff --git a/js/src/jsfun.h b/js/src/jsfun.h
index 6b5b00e9ff24..e7cebc450b37 100644
--- a/js/src/jsfun.h
+++ b/js/src/jsfun.h
@@ -463,24 +463,6 @@ CloneFunctionObject(JSContext *cx, JSFunction *fun, JSObject *parent,
     return js_CloneFunctionObject(cx, fun, parent, proto);
 }
 
-inline JSObject *
-CloneFunctionObject(JSContext *cx, JSFunction *fun)
-{
-    /*
-     * Variant which makes an exact clone of fun, preserving parent and proto.
-     * Calling the above version CloneFunctionObject(cx, fun, fun->getParent())
-     * is not equivalent: API clients, including XPConnect, can reparent
-     * objects so that fun->getGlobal() != fun->getProto()->getGlobal().
-     * See ReparentWrapperIfFound.
-     */
-    JS_ASSERT(fun->getParent() && fun->getProto());
-
-    if (fun->hasSingletonType())
-        return fun;
-
-    return js_CloneFunctionObject(cx, fun, fun->getParent(), fun->getProto());
-}
-
 extern JSObject * JS_FASTCALL
 js_AllocFlatClosure(JSContext *cx, JSFunction *fun, JSObject *scopeChain);
 
diff --git a/js/src/jsgc.cpp b/js/src/jsgc.cpp
index faefb7872636..4079daa62104 100644
--- a/js/src/jsgc.cpp
+++ b/js/src/jsgc.cpp
@@ -647,8 +647,12 @@ js_GCThingIsMarked(void *thing, uintN color = BLACK)
     return reinterpret_cast<Cell *>(thing)->isMarked(color);
 }
 
-/* Lifetime for type sets attached to scripts containing observed types. */
-static const int64 JIT_SCRIPT_RELEASE_TYPES_INTERVAL = 60 * 1000 * 1000;
+/*
+ * 1/8 life for JIT code. After this number of microseconds have passed, 1/8 of all
+ * JIT code is discarded in inactive compartments, regardless of how often that
+ * code runs.
+ */
+static const int64 JIT_SCRIPT_EIGHTH_LIFETIME = 60 * 1000 * 1000;
 
 JSBool
 js_InitGC(JSRuntime *rt, uint32 maxbytes)
@@ -690,7 +694,7 @@ js_InitGC(JSRuntime *rt, uint32 maxbytes)
      */
     rt->setGCLastBytes(8192, GC_NORMAL);
 
-    rt->gcJitReleaseTime = PRMJ_Now() + JIT_SCRIPT_RELEASE_TYPES_INTERVAL;
+    rt->gcJitReleaseTime = PRMJ_Now() + JIT_SCRIPT_EIGHTH_LIFETIME;
     return true;
 }
 
@@ -2124,12 +2128,20 @@ static void
 SweepCrossCompartmentWrappers(JSContext *cx)
 {
     JSRuntime *rt = cx->runtime;
-
-    bool releaseTypes = false;
+    /*
+     * Figure out how much JIT code should be released from inactive compartments.
+     * If multiple eighth-lives have passed, compound the release interval linearly;
+     * if enough time has passed, all inactive JIT code will be released.
+     */
+    uint32 releaseInterval = 0;
     int64 now = PRMJ_Now();
     if (now >= rt->gcJitReleaseTime) {
-        releaseTypes = true;
-        rt->gcJitReleaseTime = now + JIT_SCRIPT_RELEASE_TYPES_INTERVAL;
+        releaseInterval = 8;
+        while (now >= rt->gcJitReleaseTime) {
+            if (--releaseInterval == 1)
+                rt->gcJitReleaseTime = now;
+            rt->gcJitReleaseTime += JIT_SCRIPT_EIGHTH_LIFETIME;
+        }
     }
 
     /*
@@ -2140,7 +2152,7 @@ SweepCrossCompartmentWrappers(JSContext *cx)
      * (4) Sweep the method JIT ICs and release infrequently used JIT code.
      */
     for (JSCompartment **c = rt->compartments.begin(); c != rt->compartments.end(); ++c)
-        (*c)->sweep(cx, releaseTypes);
+        (*c)->sweep(cx, releaseInterval);
 }
 
 static void
diff --git a/js/src/jsinfer.cpp b/js/src/jsinfer.cpp
index 1ab4dc37aab2..8dcb0367950f 100644
--- a/js/src/jsinfer.cpp
+++ b/js/src/jsinfer.cpp
@@ -691,17 +691,16 @@ public:
     JSScript *script;
     jsbytecode *callpc;
     Type type;
-    TypeSet *types;
 
-    TypeConstraintPropagateThis(JSScript *script, jsbytecode *callpc, Type type, TypeSet *types)
-        : TypeConstraint("propagatethis"), script(script), callpc(callpc), type(type), types(types)
+    TypeConstraintPropagateThis(JSScript *script, jsbytecode *callpc, Type type)
+        : TypeConstraint("propagatethis"), script(script), callpc(callpc), type(type)
     {}
 
     void newType(JSContext *cx, TypeSet *source, Type type);
 };
 
 void
-TypeSet::addPropagateThis(JSContext *cx, JSScript *script, jsbytecode *pc, Type type, TypeSet *types)
+TypeSet::addPropagateThis(JSContext *cx, JSScript *script, jsbytecode *pc, Type type)
 {
     /* Don't add constraints when the call will be 'new' (see addCallProperty). */
     jsbytecode *callpc = script->analysis()->getCallPC(pc);
@@ -709,7 +708,7 @@ TypeSet::addPropagateThis(JSContext *cx, JSScript *script, jsbytecode *pc, Type
     if (JSOp(*callpc) == JSOP_NEW)
         return;
 
-    add(cx, ArenaNew<TypeConstraintPropagateThis>(cx->compartment->pool, script, callpc, type, types));
+    add(cx, ArenaNew<TypeConstraintPropagateThis>(cx->compartment->pool, script, callpc, type));
 }
 
 /* Subset constraint which filters out primitive types. */
@@ -1064,10 +1063,10 @@ TypeConstraintCallProp::newType(JSContext *cx, TypeSet *source, Type type)
     UntrapOpcode untrap(cx, script, callpc);
 
     /*
-     * For CALLPROP, we need to update not just the pushed types but also the
-     * 'this' types of possible callees. If we can't figure out that set of
-     * callees, monitor the call to make sure discovered callees get their
-     * 'this' types updated.
+     * For CALLPROP and CALLELEM, we need to update not just the pushed types
+     * but also the 'this' types of possible callees. If we can't figure out
+     * that set of callees, monitor the call to make sure discovered callees
+     * get their 'this' types updated.
      */
 
     if (UnknownPropertyAccess(script, type)) {
@@ -1087,8 +1086,7 @@ TypeConstraintCallProp::newType(JSContext *cx, TypeSet *source, Type type)
                 object->getFromPrototypes(cx, id, types);
             /* Bypass addPropagateThis, we already have the callpc. */
             types->add(cx, ArenaNew<TypeConstraintPropagateThis>(cx->compartment->pool,
-                                                                 script, callpc, type,
-                                                                 (TypeSet *) NULL));
+                                                                 script, callpc, type));
         }
     }
 }
@@ -1232,8 +1230,8 @@ TypeConstraintPropagateThis::newType(JSContext *cx, TypeSet *source, Type type)
         /*
          * The callee is unknown, make sure the call is monitored so we pick up
          * possible this/callee correlations. This only comes into play for
-         * CALLPROP, for other calls we are past the type barrier and a
-         * TypeConstraintCall will also monitor the call.
+         * CALLPROP and CALLELEM, for other calls we are past the type barrier
+         * already and a TypeConstraintCall will also monitor the call.
          */
         cx->compartment->types.monitorBytecode(cx, script, callpc - script->code);
         return;
@@ -1260,11 +1258,7 @@ TypeConstraintPropagateThis::newType(JSContext *cx, TypeSet *source, Type type)
     if (!callee->script()->ensureHasTypes(cx, callee))
         return;
 
-    TypeSet *thisTypes = TypeScript::ThisTypes(callee->script());
-    if (this->types)
-        this->types->addSubset(cx, thisTypes);
-    else
-        thisTypes->addType(cx, this->type);
+    TypeScript::ThisTypes(callee->script())->addType(cx, this->type);
 }
 
 void
@@ -1897,8 +1891,10 @@ TypeCompartment::init(JSContext *cx)
 {
     PodZero(this);
 
+#ifndef JS_CPU_ARM
     if (cx && cx->getRunOptions() & JSOPTION_TYPE_INFERENCE)
         inferenceEnabled = true;
+#endif
 }
 
 TypeObject *
@@ -3225,14 +3221,6 @@ ScriptAnalysis::resolveNameAccess(JSContext *cx, jsid id, bool addDependency)
             return access;
         }
 
-        /*
-         * The script's bindings do not contain a name for the function itself,
-         * don't resolve name accesses on lambdas in DeclEnv objects on the
-         * scope chain.
-         */
-        if (atom == CallObjectLambdaName(script->function()))
-            return access;
-
         if (!script->nesting()->parent)
             return access;
         script = script->nesting()->parent;
@@ -3688,18 +3676,19 @@ ScriptAnalysis::analyzeTypesBytecode(JSContext *cx, unsigned offset,
         TypeSet *seen = script->analysis()->bytecodeTypes(pc);
 
         poppedTypes(pc, 1)->addGetProperty(cx, script, pc, seen, JSID_VOID);
+        if (op == JSOP_CALLELEM)
+            poppedTypes(pc, 1)->addCallProperty(cx, script, pc, JSID_VOID);
 
         seen->addSubset(cx, &pushed[0]);
-        if (op == JSOP_CALLELEM) {
+        if (op == JSOP_CALLELEM)
             poppedTypes(pc, 1)->addFilterPrimitives(cx, &pushed[1], TypeSet::FILTER_NULL_VOID);
-            pushed[0].addPropagateThis(cx, script, pc, Type::UndefinedType(), &pushed[1]);
-        }
         if (CheckNextTest(pc))
             pushed[0].addType(cx, Type::UndefinedType());
         break;
       }
 
       case JSOP_SETELEM:
+      case JSOP_SETHOLE:
         poppedTypes(pc, 1)->addSetElement(cx, script, pc, poppedTypes(pc, 2), poppedTypes(pc, 0));
         poppedTypes(pc, 0)->addSubset(cx, &pushed[0]);
         break;
@@ -6032,13 +6021,6 @@ TypeScript::Sweep(JSContext *cx, JSScript *script)
 #ifdef JS_METHODJIT
     mjit::ReleaseScriptCode(cx, script);
 #endif
-
-    /*
-     * Use counts for scripts are reset on GC. After discarding code we need to
-     * let it warm back up to get information like which opcodes are setting
-     * array holes or accessing getter properties.
-     */
-    script->resetUseCount();
 }
 
 void
diff --git a/js/src/jsinfer.h b/js/src/jsinfer.h
index 86f4795e3d23..81d95ca028b7 100644
--- a/js/src/jsinfer.h
+++ b/js/src/jsinfer.h
@@ -452,8 +452,7 @@ class TypeSet
     void addCall(JSContext *cx, TypeCallsite *site);
     void addArith(JSContext *cx, TypeSet *target, TypeSet *other = NULL);
     void addTransformThis(JSContext *cx, JSScript *script, TypeSet *target);
-    void addPropagateThis(JSContext *cx, JSScript *script, jsbytecode *pc,
-                          Type type, TypeSet *types = NULL);
+    void addPropagateThis(JSContext *cx, JSScript *script, jsbytecode *pc, Type type);
     void addFilterPrimitives(JSContext *cx, TypeSet *target, FilterKind filter);
     void addSubsetBarrier(JSContext *cx, JSScript *script, jsbytecode *pc, TypeSet *target);
     void addLazyArguments(JSContext *cx, TypeSet *target);
diff --git a/js/src/jsinterp.cpp b/js/src/jsinterp.cpp
index 5a4bac4cb594..fd701806a1a6 100644
--- a/js/src/jsinterp.cpp
+++ b/js/src/jsinterp.cpp
@@ -1599,14 +1599,10 @@ static inline void
 TypeCheckNextBytecode(JSContext *cx, JSScript *script, unsigned n, const FrameRegs &regs)
 {
 #ifdef DEBUG
-    if (*regs.pc != JSOP_TRAP &&
+    if (cx->typeInferenceEnabled() &&
+        *regs.pc != JSOP_TRAP &&
         n == analyze::GetBytecodeLength(regs.pc)) {
-        if (script->hasAnalysis() && !regs.fp()->hasImacropc()) {
-            jsbytecode *nextpc = regs.pc + GetBytecodeLength(cx, script, regs.pc);
-            JS_ASSERT(regs.sp == regs.fp()->base() + script->analysis()->getCode(nextpc).stackDepth);
-        }
-        if (cx->typeInferenceEnabled())
-            TypeScript::CheckBytecode(cx, script, regs.pc, regs.sp);
+        TypeScript::CheckBytecode(cx, script, regs.pc, regs.sp);
     }
 #endif
 }
@@ -3907,13 +3903,13 @@ BEGIN_CASE(JSOP_GETELEM)
         }
     }
 
-    if (JSID_IS_STRING(id) && script->hasAnalysis() && !regs.fp()->hasImacropc())
-        script->analysis()->getCode(regs.pc).getStringElement = true;
-
     if (!obj->getProperty(cx, id, &rval))
         goto error;
     copyFrom = &rval;
 
+    if (!JSID_IS_INT(id))
+        TypeScript::MonitorUnknown(cx, script, regs.pc);
+
   end_getelem:
     regs.sp--;
     regs.sp[-1] = *copyFrom;
@@ -3951,11 +3947,14 @@ BEGIN_CASE(JSOP_CALLELEM)
         regs.sp[-1] = thisv;
     }
 
+    if (!JSID_IS_INT(id))
+        TypeScript::MonitorUnknown(cx, script, regs.pc);
     TypeScript::Monitor(cx, script, regs.pc, regs.sp[-2]);
 }
 END_CASE(JSOP_CALLELEM)
 
 BEGIN_CASE(JSOP_SETELEM)
+BEGIN_CASE(JSOP_SETHOLE)
 {
     JSObject *obj;
     FETCH_OBJECT(cx, -3, obj);
@@ -3973,12 +3972,12 @@ BEGIN_CASE(JSOP_SETELEM)
                         break;
                     if ((jsuint)i >= obj->getArrayLength())
                         obj->setArrayLength(cx, i + 1);
+                    *regs.pc = JSOP_SETHOLE;
                 }
                 obj->setDenseArrayElementWithType(cx, i, regs.sp[-1]);
                 goto end_setelem;
             } else {
-                if (script->hasAnalysis() && !regs.fp()->hasImacropc())
-                    script->analysis()->getCode(regs.pc).arrayWriteHole = true;
+                *regs.pc = JSOP_SETHOLE;
             }
         }
     } while (0);
@@ -4687,7 +4686,6 @@ BEGIN_CASE(JSOP_DEFFUN)
         obj = CloneFunctionObject(cx, fun, obj2, true);
         if (!obj)
             goto error;
-        JS_ASSERT_IF(script->hasGlobal(), obj->getProto() == fun->getProto());
     }
 
     /*
@@ -4821,8 +4819,6 @@ BEGIN_CASE(JSOP_DEFLOCALFUN)
         }
     }
 
-    JS_ASSERT_IF(script->hasGlobal(), obj->getProto() == fun->getProto());
-
     uint32 slot = GET_SLOTNO(regs.pc);
     TRACE_2(DefLocalFunSetSlot, slot, obj);
 
@@ -4941,8 +4937,6 @@ BEGIN_CASE(JSOP_LAMBDA)
     } while (0);
 
     JS_ASSERT(obj->getProto());
-    JS_ASSERT_IF(script->hasGlobal(), obj->getProto() == fun->getProto());
-
     PUSH_OBJECT(*obj);
 }
 END_CASE(JSOP_LAMBDA)
@@ -4955,7 +4949,6 @@ BEGIN_CASE(JSOP_LAMBDA_FC)
     JSObject *obj = js_NewFlatClosure(cx, fun, JSOP_LAMBDA_FC, JSOP_LAMBDA_FC_LENGTH);
     if (!obj)
         goto error;
-    JS_ASSERT_IF(script->hasGlobal(), obj->getProto() == fun->getProto());
 
     PUSH_OBJECT(*obj);
 }
diff --git a/js/src/jsobj.cpp b/js/src/jsobj.cpp
index f45f18b328f8..b7ddfaea0b8a 100644
--- a/js/src/jsobj.cpp
+++ b/js/src/jsobj.cpp
@@ -5688,8 +5688,6 @@ js_NativeGetInline(JSContext *cx, JSObject *receiver, JSObject *obj, JSObject *p
     if (slot != SHAPE_INVALID_SLOT) {
         *vp = pobj->nativeGetSlot(slot);
         JS_ASSERT(!vp->isMagic());
-        JS_ASSERT_IF(!pobj->hasSingletonType() && shape->hasDefaultGetterOrIsMethod(),
-                     js::types::TypeHasProperty(cx, pobj->type(), shape->propid, *vp));
     } else {
         vp->setUndefined();
     }
@@ -5701,14 +5699,6 @@ js_NativeGetInline(JSContext *cx, JSObject *receiver, JSObject *obj, JSObject *p
         return true;
     }
 
-    jsbytecode *pc;
-    JSScript *script = cx->stack.currentScript(&pc);
-    if (script && script->hasAnalysis() && !cx->fp()->hasImacropc()) {
-        analyze::Bytecode *code = script->analysis()->maybeCode(pc);
-        if (code)
-            code->accessGetter = true;
-    }
-
     sample = cx->runtime->propertyRemovals;
     if (!shape->get(cx, receiver, obj, pobj, vp))
         return false;
@@ -5721,6 +5711,9 @@ js_NativeGetInline(JSContext *cx, JSObject *receiver, JSObject *obj, JSObject *p
         pobj->nativeSetSlot(slot, *vp);
     }
 
+    /* Record values produced by shapes without a default getter. */
+    AddTypePropertyId(cx, obj, shape->propid, *vp);
+
     return true;
 }
 
@@ -6021,7 +6014,7 @@ CloneFunctionForSetMethod(JSContext *cx, Value *vp)
      * need to be cloned again.
      */
     if (fun == funobj) {
-        funobj = CloneFunctionObject(cx, fun);
+        funobj = CloneFunctionObject(cx, fun, fun->parent, true);
         if (!funobj)
             return false;
         vp->setObject(*funobj);
diff --git a/js/src/jsobjinlines.h b/js/src/jsobjinlines.h
index 5196d7f7e8fa..9fe81ea1af05 100644
--- a/js/src/jsobjinlines.h
+++ b/js/src/jsobjinlines.h
@@ -144,6 +144,8 @@ JSObject::getProperty(JSContext *cx, JSObject *receiver, jsid id, js::Value *vp)
     } else {
         if (!js_GetProperty(cx, this, receiver, id, vp))
             return false;
+        JS_ASSERT_IF(!hasSingletonType() && nativeContains(cx, js_CheckForStringIndex(id)),
+                     js::types::TypeHasProperty(cx, type(), id, *vp));
     }
     return true;
 }
@@ -265,7 +267,7 @@ JSObject::methodReadBarrier(JSContext *cx, const js::Shape &shape, js::Value *vp
     JS_ASSERT(fun == funobj);
     JS_ASSERT(fun->isNullClosure());
 
-    funobj = CloneFunctionObject(cx, fun);
+    funobj = CloneFunctionObject(cx, fun, funobj->getParent(), true);
     if (!funobj)
         return NULL;
     funobj->setMethodObj(*this);
diff --git a/js/src/jsopcode.cpp b/js/src/jsopcode.cpp
index 028773e37c3a..67c93a21416e 100644
--- a/js/src/jsopcode.cpp
+++ b/js/src/jsopcode.cpp
@@ -3966,6 +3966,7 @@ Decompile(SprintStack *ss, jsbytecode *pc, intN nb, JSOp nextop)
                 break;
 
               case JSOP_SETELEM:
+              case JSOP_SETHOLE:
                 rval = POP_STR();
                 op = JSOP_NOP;          /* turn off parens */
                 xval = POP_STR();
diff --git a/js/src/jsopcode.tbl b/js/src/jsopcode.tbl
index a6320ac7bfb4..cb9c52712e18 100644
--- a/js/src/jsopcode.tbl
+++ b/js/src/jsopcode.tbl
@@ -592,5 +592,8 @@ OPDEF(JSOP_UNBRANDTHIS,   229,"unbrandthis",   NULL,  1,  0,  0,  0,  JOF_BYTE)
 
 OPDEF(JSOP_SHARPINIT,     230,"sharpinit",     NULL,  3,  0,  0,  0,  JOF_UINT16|JOF_SHARPSLOT)
 
+/* Substituted for JSOP_SETELEM to indicate opcodes which have written holes in dense arrays. */
+OPDEF(JSOP_SETHOLE,       231, "sethole",      NULL,  1,  3,  1,  3,  JOF_BYTE |JOF_ELEM|JOF_SET|JOF_DETECTING)
+
 /* Pop the stack, convert to a jsid (int or string), and push back. */
-OPDEF(JSOP_TOID,          231, "toid",         NULL,  1,  1,  1,  0,  JOF_BYTE)
+OPDEF(JSOP_TOID,          232, "toid",         NULL,  1,  1,  1,  0,  JOF_BYTE)
diff --git a/js/src/jstracer.cpp b/js/src/jstracer.cpp
index 5490ded79733..3ab75e654cb8 100644
--- a/js/src/jstracer.cpp
+++ b/js/src/jstracer.cpp
@@ -6875,7 +6875,8 @@ LeaveTree(TraceMonitor *tm, TracerState& state, VMSideExit* lr)
              * Since this doesn't re-enter the recorder, the post-state snapshot
              * is invalid. Fix it up here.
              */
-            if (op == JSOP_SETELEM && JSOp(regs->pc[JSOP_SETELEM_LENGTH]) == JSOP_POP) {
+            if ((op == JSOP_SETELEM || op == JSOP_SETHOLE) &&
+                JSOp(regs->pc[JSOP_SETELEM_LENGTH]) == JSOP_POP) {
                 regs->sp -= js_CodeSpec[JSOP_SETELEM].nuses;
                 regs->sp += js_CodeSpec[JSOP_SETELEM].ndefs;
                 regs->pc += JSOP_SETELEM_LENGTH;
@@ -13427,7 +13428,7 @@ TraceRecorder::setElem(int lval_spindex, int idx_spindex, int v_spindex)
     }
 
     jsbytecode* pc = cx->regs().pc;
-    if (*pc == JSOP_SETELEM && pc[JSOP_SETELEM_LENGTH] != JSOP_POP)
+    if ((*pc == JSOP_SETELEM || *pc == JSOP_SETHOLE) && pc[JSOP_SETELEM_LENGTH] != JSOP_POP)
         set(&lval, v_ins);
 
     return ARECORD_CONTINUE;
@@ -13439,6 +13440,12 @@ TraceRecorder::record_JSOP_SETELEM()
     return setElem(-3, -2, -1);
 }
 
+JS_REQUIRES_STACK AbortableRecordingStatus
+TraceRecorder::record_JSOP_SETHOLE()
+{
+    return setElem(-3, -2, -1);
+}
+
 static JSBool FASTCALL
 CheckSameGlobal(JSObject *obj, JSObject *globalObj)
 {
@@ -17065,7 +17072,7 @@ LoopProfile::profileOperation(JSContext* cx, JSOp op)
     if (op == JSOP_NEW)
         increment(OP_NEW);
 
-    if (op == JSOP_GETELEM || op == JSOP_SETELEM) {
+    if (op == JSOP_GETELEM || op == JSOP_SETELEM || op == JSOP_SETHOLE) {
         Value& lval = cx->regs().sp[op == JSOP_GETELEM ? -2 : -3];
         if (lval.isObject() && js_IsTypedArray(&lval.toObject()))
             increment(OP_TYPED_ARRAY);
diff --git a/js/src/methodjit/BaseAssembler.h b/js/src/methodjit/BaseAssembler.h
index fd24e44c00c6..d0cdc10d22ec 100644
--- a/js/src/methodjit/BaseAssembler.h
+++ b/js/src/methodjit/BaseAssembler.h
@@ -125,6 +125,15 @@ class Assembler : public ValueAssembler
         DataLabelPtr label;
     };
 
+    /* Need a temp reg that is not ArgReg1. */
+#if defined(JS_CPU_X86) || defined(JS_CPU_X64)
+    static const RegisterID ClobberInCall = JSC::X86Registers::ecx;
+#elif defined(JS_CPU_ARM)
+    static const RegisterID ClobberInCall = JSC::ARMRegisters::r2;
+#elif defined(JS_CPU_SPARC)
+    static const RegisterID ClobberInCall = JSC::SparcRegisters::l1;
+#endif
+
     /* :TODO: OOM */
     Label startLabel;
     Vector<CallPatch, 64, SystemAllocPolicy> callPatches;
@@ -544,14 +553,14 @@ static const JSC::MacroAssembler::RegisterID JSParamReg_Argc  = JSC::SparcRegist
         }
     }
 
-    void storeArg(uint32 i, ImmPtr imm) {
+    void storeArg(uint32 i, Imm32 imm) {
         JS_ASSERT(callIsAligned);
         RegisterID to;
         if (Registers::regForArg(callConvention, i, &to)) {
             move(imm, to);
             availInCall.takeRegUnchecked(to);
         } else {
-            storePtr(imm, addressOfArg(i));
+            store32(imm, addressOfArg(i));
         }
     }
 
@@ -606,7 +615,7 @@ static const JSC::MacroAssembler::RegisterID JSParamReg_Argc  = JSC::SparcRegist
     Call callWithVMFrame(bool inlining, type stub, jsbytecode *pc,                       \
                          DataLabelPtr *pinlined, uint32 fd) {                            \
         return fallibleVMCall(inlining, JS_FUNC_TO_DATA_PTR(void *, stub),               \
-                              pc, NULL, pinlined, fd);                                   \
+                              pc, pinlined, fd);                                         \
     }
 
     STUB_CALL_TYPE(JSObjStub);
@@ -616,7 +625,7 @@ static const JSC::MacroAssembler::RegisterID JSParamReg_Argc  = JSC::SparcRegist
 
 #undef STUB_CALL_TYPE
 
-    void setupFrameDepth(int32 frameDepth) {
+    void setupInfallibleVMFrame(int32 frameDepth) {
         // |frameDepth < 0| implies ic::SplatApplyArgs has been called which
         // means regs.sp has already been set in the VMFrame.
         if (frameDepth >= 0) {
@@ -624,13 +633,9 @@ static const JSC::MacroAssembler::RegisterID JSParamReg_Argc  = JSC::SparcRegist
             // regs->sp = sp
             addPtr(Imm32(sizeof(StackFrame) + frameDepth * sizeof(jsval)),
                    JSFrameReg,
-                   Registers::ClobberInCall);
-            storePtr(Registers::ClobberInCall, FrameAddress(offsetof(VMFrame, regs.sp)));
+                   ClobberInCall);
+            storePtr(ClobberInCall, FrameAddress(offsetof(VMFrame, regs.sp)));
         }
-    }
-
-    void setupInfallibleVMFrame(int32 frameDepth) {
-        setupFrameDepth(frameDepth);
 
         // The JIT has moved Arg1 already, and we've guaranteed to not clobber
         // it. Move ArgReg0 into place now. setupFallibleVMFrame will not
@@ -638,7 +643,7 @@ static const JSC::MacroAssembler::RegisterID JSParamReg_Argc  = JSC::SparcRegist
         move(MacroAssembler::stackPointerRegister, Registers::ArgReg0);
     }
 
-    void setupFallibleVMFrame(bool inlining, jsbytecode *pc, CallSite *inlined,
+    void setupFallibleVMFrame(bool inlining, jsbytecode *pc,
                               DataLabelPtr *pinlined, int32 frameDepth) {
         setupInfallibleVMFrame(frameDepth);
 
@@ -650,30 +655,15 @@ static const JSC::MacroAssembler::RegisterID JSParamReg_Argc  = JSC::SparcRegist
 
         if (inlining) {
             /* inlined -> regs->inlined :( */
-            if (inlined) {
-                storePtr(ImmPtr(inlined), FrameAddress(VMFrame::offsetOfInlined));
-            } else {
-                DataLabelPtr ptr = storePtrWithPatch(ImmPtr(NULL),
-                                                     FrameAddress(VMFrame::offsetOfInlined));
-                if (pinlined)
-                    *pinlined = ptr;
-            }
+            DataLabelPtr ptr = storePtrWithPatch(ImmPtr(NULL),
+                                                 FrameAddress(VMFrame::offsetOfInlined));
+            if (pinlined)
+                *pinlined = ptr;
         }
 
         restoreStackBase();
     }
 
-    void setupFallibleABICall(bool inlining, jsbytecode *pc, CallSite *inlined, int32 frameDepth) {
-        setupFrameDepth(frameDepth);
-
-        /* Store fp/pc/inlined */
-        storePtr(JSFrameReg, FrameAddress(VMFrame::offsetOfFp));
-        storePtr(ImmPtr(pc), FrameAddress(offsetof(VMFrame, regs.pc)));
-
-        if (inlining)
-            storePtr(ImmPtr(inlined), FrameAddress(VMFrame::offsetOfInlined));
-    }
-
     void restoreStackBase() {
 #if defined(JS_CPU_X86)
         /*
@@ -699,8 +689,8 @@ static const JSC::MacroAssembler::RegisterID JSParamReg_Argc  = JSC::SparcRegist
     // parameter) that needs the entire VMFrame to be coherent, meaning that
     // |pc|, |inlined| and |fp| are guaranteed to be up-to-date.
     Call fallibleVMCall(bool inlining, void *ptr, jsbytecode *pc,
-                        CallSite *inlined, DataLabelPtr *pinlined, int32 frameDepth) {
-        setupFallibleVMFrame(inlining, pc, inlined, pinlined, frameDepth);
+                        DataLabelPtr *pinlined, int32 frameDepth) {
+        setupFallibleVMFrame(inlining, pc, pinlined, frameDepth);
         Call call = wrapVMCall(ptr);
 
         // Restore the frame pointer from the VM.
@@ -877,7 +867,6 @@ static const JSC::MacroAssembler::RegisterID JSParamReg_Argc  = JSC::SparcRegist
                      const js::Shape *shape,
                      RegisterID typeReg, RegisterID dataReg)
     {
-        JS_ASSERT(shape->hasSlot());
         if (shape->isMethod())
             loadValueAsComponents(ObjectValue(shape->methodObject()), typeReg, dataReg);
         else if (obj->isFixedSlot(shape->slot))
@@ -1152,7 +1141,7 @@ static const JSC::MacroAssembler::RegisterID JSParamReg_Argc  = JSC::SparcRegist
      * in the specified set. Updates mismatches with any failure jumps. Assumes
      * no data registers are live.
      */
-    bool generateTypeCheck(JSContext *cx, Address address, RegisterID reg,
+    bool generateTypeCheck(JSContext *cx, Address address,
                            types::TypeSet *types, Vector<Jump> *mismatches)
     {
         if (types->unknown())
@@ -1200,6 +1189,9 @@ static const JSC::MacroAssembler::RegisterID JSParamReg_Argc  = JSC::SparcRegist
         if (count != 0) {
             if (!mismatches->append(testObject(Assembler::NotEqual, address)))
                 return false;
+            Registers tempRegs(Registers::AvailRegs);
+            RegisterID reg = tempRegs.takeAnyReg().reg();
+
             loadPayload(address, reg);
 
             Jump notSingleton = branchTest32(Assembler::Zero,
diff --git a/js/src/methodjit/BaseCompiler.h b/js/src/methodjit/BaseCompiler.h
index 31cbb2091d03..2f4976e24995 100644
--- a/js/src/methodjit/BaseCompiler.h
+++ b/js/src/methodjit/BaseCompiler.h
@@ -175,41 +175,6 @@ class LinkerHelper : public JSC::LinkBuffer
     }
 };
 
-class NativeStubLinker : public LinkerHelper
-{
-  public:
-#ifdef JS_CPU_X64
-    typedef JSC::MacroAssembler::DataLabelPtr FinalJump;
-#else
-    typedef JSC::MacroAssembler::Jump FinalJump;
-#endif
-
-    NativeStubLinker(Assembler &masm, JITScript *jit, jsbytecode *pc, CallSite *inlined, FinalJump done)
-        : LinkerHelper(masm, JSC::METHOD_CODE), jit(jit), pc(pc), inlined(inlined), done(done)
-    {}
-
-    bool init(JSContext *cx);
-
-    void patchJump(JSC::CodeLocationLabel target) {
-#ifdef JS_CPU_X64
-        patch(done, target);
-#else
-        link(done, target);
-#endif
-    }
-
-  private:
-    JITScript *jit;
-    jsbytecode *pc;
-    CallSite *inlined;
-    FinalJump done;
-};
-
-bool
-NativeStubEpilogue(VMFrame &f, Assembler &masm, NativeStubLinker::FinalJump *result,
-                   int32 initialFrameDepth, int32 vpOffset,
-                   MaybeRegisterID typeReg, MaybeRegisterID dataReg);
-
 /*
  * On ARM, we periodically flush a constant pool into the instruction stream
  * where constants are found using PC-relative addressing. This is necessary
@@ -228,43 +193,67 @@ class AutoReserveICSpace {
     typedef Assembler::Label Label;
 
     Assembler           &masm;
+#ifdef DEBUG
+    Label               startLabel;
     bool                didCheck;
-    bool                *overflowSpace;
-    int                 flushCount;
+#endif
 
   public:
-    AutoReserveICSpace(Assembler &masm, bool *overflowSpace)
-        : masm(masm), didCheck(false), overflowSpace(overflowSpace)
-    {
+    AutoReserveICSpace(Assembler &masm) : masm(masm) {
         masm.ensureSpace(reservedSpace);
-        flushCount = masm.flushCount();
+#ifdef DEBUG
+        didCheck = false;
+
+        startLabel = masm.label();
+
+        /* Assert that the constant pool is not flushed until we reach a safe point. */
+        masm.allowPoolFlush(false);
+
+        JaegerSpew(JSpew_Insns, " -- BEGIN CONSTANT-POOL-FREE REGION -- \n");
+#endif
     }
 
     /* Allow manual IC space checks so that non-patchable code at the end of an IC section can be
      * free to use constant pools. */
     void check() {
+#ifdef DEBUG
         JS_ASSERT(!didCheck);
         didCheck = true;
 
-        if (masm.flushCount() != flushCount)
-            *overflowSpace = true;
+        Label endLabel = masm.label();
+        int spaceUsed = masm.differenceBetween(startLabel, endLabel);
+
+        /* Spew the space used, to help tuning of reservedSpace. */
+        JaegerSpew(JSpew_Insns,
+                   " -- END CONSTANT-POOL-FREE REGION: %u bytes used of %u reserved. -- \n",
+                   spaceUsed, reservedSpace);
+
+        /* Assert that we didn't emit more code than we protected. */
+        JS_ASSERT(spaceUsed >= 0);
+        JS_ASSERT(size_t(spaceUsed) <= reservedSpace);
+
+        /* Allow the pool to be flushed. */
+        masm.allowPoolFlush(true);
+#endif
     }
 
     ~AutoReserveICSpace() {
+#ifdef DEBUG
         /* Automatically check the IC space if we didn't already do it manually. */
         if (!didCheck) {
             check();
         }
+#endif
     }
 };
 
-# define RESERVE_IC_SPACE(__masm)       AutoReserveICSpace<256> arics(__masm, &this->overflowICSpace)
+# define RESERVE_IC_SPACE(__masm)       AutoReserveICSpace<128> arics(__masm)
 # define CHECK_IC_SPACE()               arics.check()
 
 /* The OOL path can need a lot of space because we save and restore a lot of registers. The actual
  * sequene varies. However, dumping the literal pool before an OOL block is probably a good idea
  * anyway, as we branch directly to the start of the block from the fast path. */
-# define RESERVE_OOL_SPACE(__masm)      AutoReserveICSpace<2048> arics_ool(__masm, &this->overflowICSpace)
+# define RESERVE_OOL_SPACE(__masm)      AutoReserveICSpace<256> arics_ool(__masm)
 
 /* Allow the OOL patch to be checked before object destruction. Often, non-patchable epilogues or
  * rejoining sequences are emitted, and it isn't necessary to protect these from literal pools. */
diff --git a/js/src/methodjit/Compiler.cpp b/js/src/methodjit/Compiler.cpp
index 013d8165cd86..11caaf1a18da 100644
--- a/js/src/methodjit/Compiler.cpp
+++ b/js/src/methodjit/Compiler.cpp
@@ -133,7 +133,6 @@ mjit::Compiler::Compiler(JSContext *cx, JSScript *outerScript, bool isConstructi
     inlining_(false),
     hasGlobalReallocation(false),
     oomInVector(false),
-    overflowICSpace(false),
     gcNumber(cx->runtime->gcNumber),
     applyTricks(NoApplyTricks),
     pcLengths(NULL)
@@ -895,11 +894,6 @@ mjit::Compiler::finishThisUp(JITScript **jitp)
     if (cx->runtime->gcNumber != gcNumber)
         return Compile_Retry;
 
-    if (overflowICSpace) {
-        JaegerSpew(JSpew_Scripts, "dumped a constant pool while generating an IC\n");
-        return Compile_Abort;
-    }
-
     for (size_t i = 0; i < branchPatches.length(); i++) {
         Label label = labelOf(branchPatches[i].pc, branchPatches[i].inlineIndex);
         branchPatches[i].jump.linkTo(label, &masm);
@@ -2033,10 +2027,8 @@ mjit::Compiler::generateMethod()
           END_CASE(JSOP_TOID)
 
           BEGIN_CASE(JSOP_SETELEM)
+          BEGIN_CASE(JSOP_SETHOLE)
           {
-            typeCheckPopped(0);
-            typeCheckPopped(1);
-            typeCheckPopped(2);
             jsbytecode *next = &PC[JSOP_SETELEM_LENGTH];
             bool pop = (JSOp(*next) == JSOP_POP && !analysis->jumpTarget(next));
             if (!jsop_setelem(pop))
@@ -2387,13 +2379,18 @@ mjit::Compiler::generateMethod()
           END_CASE(JSOP_BINDNAME)
 
           BEGIN_CASE(JSOP_SETPROP)
+          {
+            jsbytecode *next = &PC[JSOP_SETPROP_LENGTH];
+            bool pop = JSOp(*next) == JSOP_POP && !analysis->jumpTarget(next);
+            if (!jsop_setprop(script->getAtom(fullAtomIndex(PC)), true, pop))
+                return Compile_Error;
+          }
+          END_CASE(JSOP_SETPROP)
+
           BEGIN_CASE(JSOP_SETNAME)
           BEGIN_CASE(JSOP_SETMETHOD)
           {
-            typeCheckPopped(0);
-            if (op != JSOP_SETNAME)
-                typeCheckPopped(1);
-            jsbytecode *next = &PC[JSOP_SETPROP_LENGTH];
+            jsbytecode *next = &PC[JSOP_SETNAME_LENGTH];
             bool pop = JSOp(*next) == JSOP_POP && !analysis->jumpTarget(next);
             if (!jsop_setprop(script->getAtom(fullAtomIndex(PC)), true, pop))
                 return Compile_Error;
@@ -2791,22 +2788,6 @@ mjit::Compiler::generateMethod()
                     frame.extra(fe).types = analysis->pushedTypes(lastPC - script->code, i);
                 }
             }
-
-#ifdef DEBUG
-            if ((js_CodeSpec[op].format & JOF_TYPESET) &&
-                js_GetOpcode(cx, script, PC) != JSOP_POP) {
-                FrameEntry *fe = frame.getStack(opinfo->stackDepth - nuses);
-                Jump j = frame.typeCheckEntry(fe, frame.extra(fe).types);
-                stubcc.linkExit(j, Uses(0));
-                stubcc.leave();
-
-                jsbytecode *oldPC = PC;
-                PC = lastPC;
-                OOL_STUBCALL(stubs::TypeCheckPushed, REJOIN_FALLTHROUGH);
-                PC = oldPC;
-                stubcc.rejoin(Changes(0));
-            }
-#endif
         }
 
         if (script->pcCounters) {
@@ -3233,7 +3214,7 @@ mjit::Compiler::emitStubCall(void *ptr, DataLabelPtr *pinline)
     masm.bumpStubCounter(script, PC, Registers::tempCallReg());
 
     Call cl = masm.fallibleVMCall(cx->typeInferenceEnabled(),
-                                  ptr, outerPC(), NULL, pinline, frame.totalDepth());
+                                  ptr, outerPC(), pinline, frame.totalDepth());
     JaegerSpew(JSpew_Insns, " ---- END STUB CALL ---- \n");
     return cl;
 }
@@ -4076,7 +4057,7 @@ mjit::Compiler::addCallSite(const InternalCallSite &site)
 }
 
 void
-mjit::Compiler::inlineStubCall(void *stub, RejoinState rejoin, Uses uses)
+mjit::Compiler::inlineStubCall(void *stub, RejoinState rejoin)
 {
     DataLabelPtr inlinePatch;
     Call cl = emitStubCall(stub, &inlinePatch);
@@ -4086,7 +4067,7 @@ mjit::Compiler::inlineStubCall(void *stub, RejoinState rejoin, Uses uses)
     if (loop && loop->generatingInvariants()) {
         Jump j = masm.jump();
         Label l = masm.label();
-        loop->addInvariantCall(j, l, false, false, callSites.length(), uses);
+        loop->addInvariantCall(j, l, false, false, callSites.length());
     }
     addCallSite(site);
 }
@@ -4219,7 +4200,6 @@ mjit::Compiler::jsop_getprop_slow(JSAtom *atom, bool usePropCache)
     prepareStubCall(Uses(1));
     if (usePropCache) {
         INLINE_STUBCALL(stubs::GetProp, rejoin);
-        testPushedType(rejoin, -1, /* ool = */ false);
     } else {
         masm.move(ImmPtr(atom), Registers::ArgReg1);
         INLINE_STUBCALL(stubs::GetPropNoCache, rejoin);
@@ -4235,7 +4215,6 @@ mjit::Compiler::jsop_callprop_slow(JSAtom *atom)
     prepareStubCall(Uses(1));
     masm.move(ImmPtr(atom), Registers::ArgReg1);
     INLINE_STUBCALL(stubs::CallProp, REJOIN_FALLTHROUGH);
-    testPushedType(REJOIN_FALLTHROUGH, -1, /* ool = */ false);
     frame.pop();
     pushSyncedEntry(0);
     pushSyncedEntry(1);
@@ -4331,8 +4310,6 @@ mjit::Compiler::jsop_getprop(JSAtom *atom, JSValueType knownType,
                 stubcc.linkExit(notObject, Uses(1));
                 stubcc.leave();
                 OOL_STUBCALL(stubs::GetProp, rejoin);
-                if (rejoin == REJOIN_GETTER)
-                    testPushedType(rejoin, -1);
             }
             RegisterID reg = frame.tempRegForData(top);
             frame.pop();
@@ -4353,8 +4330,6 @@ mjit::Compiler::jsop_getprop(JSAtom *atom, JSValueType knownType,
                 stubcc.linkExit(notObject, Uses(1));
                 stubcc.leave();
                 OOL_STUBCALL(stubs::GetProp, rejoin);
-                if (rejoin == REJOIN_GETTER)
-                    testPushedType(rejoin, -1);
             }
             RegisterID reg = frame.copyDataIntoReg(top);
             frame.pop();
@@ -4417,8 +4392,6 @@ mjit::Compiler::jsop_getprop(JSAtom *atom, JSValueType knownType,
                 stubcc.linkExit(notObject, Uses(1));
                 stubcc.leave();
                 OOL_STUBCALL(stubs::GetProp, rejoin);
-                if (rejoin == REJOIN_GETTER)
-                    testPushedType(rejoin, -1);
             }
             RegisterID reg = frame.tempRegForData(top);
             frame.pop();
@@ -4474,19 +4447,6 @@ mjit::Compiler::jsop_getprop(JSAtom *atom, JSValueType knownType,
         shapeReg = frame.allocReg();
     }
 
-    /*
-     * If this access has been on a shape with a getter hook, make preparations
-     * so that we can generate a stub to call the hook directly (rather than be
-     * forced to make a stub call). Sync the stack up front and kill all
-     * registers so that PIC stubs can contain calls, and always generate a
-     * type barrier if inference is enabled (known property types do not
-     * reflect properties with getter hooks).
-     */
-    pic.canCallHook = pic.forcedTypeBarrier =
-        usePropCache && JSOp(*PC) == JSOP_GETPROP && analysis->getCode(PC).accessGetter;
-    if (pic.canCallHook)
-        frame.syncAndKillEverything();
-
     pic.shapeReg = shapeReg;
     pic.atom = atom;
 
@@ -4507,8 +4467,6 @@ mjit::Compiler::jsop_getprop(JSAtom *atom, JSValueType knownType,
     passICAddress(&pic);
     pic.slowPathCall = OOL_STUBCALL(usePropCache ? ic::GetProp : ic::GetPropNoCache, rejoin);
     CHECK_OOL_SPACE();
-    if (rejoin == REJOIN_GETTER)
-        testPushedType(rejoin, -1);
 
     /* Load the base slot address. */
     Label dslotsLoadLabel = masm.loadPtrWithPatchToLEA(Address(objReg, offsetof(JSObject, slots)),
@@ -4537,12 +4495,9 @@ mjit::Compiler::jsop_getprop(JSAtom *atom, JSValueType knownType,
     labels.setInlineShapeJump(masm, pic.shapeGuard, inlineShapeJump);
 #endif
 
-    CHECK_IC_SPACE();
-
     pic.objReg = objReg;
     frame.pushRegs(shapeReg, objReg, knownType);
-    BarrierState barrier = testBarrier(pic.shapeReg, pic.objReg, false, false,
-                                       /* force = */ pic.canCallHook);
+    BarrierState barrier = testBarrier(pic.shapeReg, pic.objReg);
 
     stubcc.rejoin(Changes(1));
     pics.append(pic);
@@ -4592,10 +4547,6 @@ mjit::Compiler::jsop_callprop_generic(JSAtom *atom)
     pic.shapeReg = shapeReg;
     pic.atom = atom;
 
-    pic.canCallHook = pic.forcedTypeBarrier = analysis->getCode(PC).accessGetter;
-    if (pic.canCallHook)
-        frame.syncAndKillEverything();
-
     /*
      * Store the type and object back. Don't bother keeping them in registers,
      * since a sync will be needed for the upcoming call.
@@ -4630,8 +4581,6 @@ mjit::Compiler::jsop_callprop_generic(JSAtom *atom)
     pic.slowPathCall = OOL_STUBCALL(ic::CallProp, REJOIN_FALLTHROUGH);
     CHECK_OOL_SPACE();
 
-    testPushedType(REJOIN_FALLTHROUGH, -1);
-
     /* Load the base slot address. */
     Label dslotsLoadLabel = masm.loadPtrWithPatchToLEA(Address(objReg, offsetof(JSObject, slots)),
                                                                objReg);
@@ -4659,13 +4608,10 @@ mjit::Compiler::jsop_callprop_generic(JSAtom *atom)
     labels.setInlineShapeJump(masm, pic.shapeGuard, inlineShapeJump);
 #endif
 
-    CHECK_IC_SPACE();
-
     /* Adjust the frame. */
     frame.pop();
     frame.pushRegs(shapeReg, objReg, knownPushedType(0));
-    BarrierState barrier = testBarrier(pic.shapeReg, pic.objReg, false, false,
-                                       /* force = */ pic.canCallHook);
+    BarrierState barrier = testBarrier(pic.shapeReg, pic.objReg);
 
     pushSyncedEntry(1);
 
@@ -4764,10 +4710,6 @@ mjit::Compiler::jsop_callprop_obj(JSAtom *atom)
         objReg = frame.copyDataIntoReg(top);
     }
 
-    pic.canCallHook = pic.forcedTypeBarrier = analysis->getCode(PC).accessGetter;
-    if (pic.canCallHook)
-        frame.syncAndKillEverything();
-
     /* Guard on shape. */
     masm.loadShape(objReg, shapeReg);
     pic.shapeGuard = masm.label();
@@ -4786,8 +4728,6 @@ mjit::Compiler::jsop_callprop_obj(JSAtom *atom)
     pic.slowPathCall = OOL_STUBCALL(ic::CallProp, REJOIN_FALLTHROUGH);
     CHECK_OOL_SPACE();
 
-    testPushedType(REJOIN_FALLTHROUGH, -1);
-
     /* Load the base slot address. */
     Label dslotsLoadLabel = masm.loadPtrWithPatchToLEA(Address(objReg, offsetof(JSObject, slots)),
                                                                objReg);
@@ -4800,8 +4740,6 @@ mjit::Compiler::jsop_callprop_obj(JSAtom *atom)
     pic.fastPathRejoin = masm.label();
     pic.objReg = objReg;
 
-    CHECK_IC_SPACE();
-
     /*
      * 1) Dup the |this| object.
      * 2) Store the property value below the |this| value.
@@ -4811,8 +4749,7 @@ mjit::Compiler::jsop_callprop_obj(JSAtom *atom)
      */
     frame.dup();
     frame.storeRegs(-2, shapeReg, objReg, knownPushedType(0));
-    BarrierState barrier = testBarrier(shapeReg, objReg, false, false,
-                                       /* force = */ pic.canCallHook);
+    BarrierState barrier = testBarrier(shapeReg, objReg);
 
     /*
      * Assert correctness of hardcoded offsets.
@@ -5079,7 +5016,6 @@ mjit::Compiler::jsop_callprop_dispatch(JSAtom *atom)
     stubcc.leave();
     stubcc.masm.move(ImmPtr(atom), Registers::ArgReg1);
     OOL_STUBCALL(stubs::CallProp, REJOIN_FALLTHROUGH);
-    testPushedType(REJOIN_FALLTHROUGH, -1);
 
     frame.dup();
     // THIS THIS
@@ -5110,7 +5046,6 @@ mjit::Compiler::jsop_callprop(JSAtom *atom)
             stubcc.leave();
             stubcc.masm.move(ImmPtr(atom), Registers::ArgReg1);
             OOL_STUBCALL(stubs::CallProp, REJOIN_FALLTHROUGH);
-            testPushedType(REJOIN_FALLTHROUGH, -1);
         }
 
         // THIS
@@ -5381,7 +5316,6 @@ mjit::Compiler::jsop_name(JSAtom *atom, JSValueType type, bool isCall)
         passICAddress(&pic);
         pic.slowPathCall = OOL_STUBCALL(isCall ? ic::CallName : ic::Name, rejoin);
         CHECK_OOL_SPACE();
-        testPushedType(rejoin, 0);
     }
     pic.fastPathRejoin = masm.label();
 
@@ -5389,8 +5323,6 @@ mjit::Compiler::jsop_name(JSAtom *atom, JSValueType type, bool isCall)
     ScopeNameLabels &labels = pic.scopeNameLabels();
     labels.setInlineJump(masm, pic.fastPathStart, inlineJump);
 
-    CHECK_IC_SPACE();
-
     /*
      * We can't optimize away the PIC for the NAME access itself, but if we've
      * only seen a single value pushed by this access, mark it as such and
@@ -5469,7 +5401,6 @@ mjit::Compiler::jsop_xname(JSAtom *atom)
         passICAddress(&pic);
         pic.slowPathCall = OOL_STUBCALL(ic::XName, REJOIN_GETTER);
         CHECK_OOL_SPACE();
-        testPushedType(REJOIN_GETTER, -1);
     }
 
     pic.fastPathRejoin = masm.label();
@@ -5480,8 +5411,6 @@ mjit::Compiler::jsop_xname(JSAtom *atom)
     ScopeNameLabels &labels = pic.scopeNameLabels();
     labels.setInlineJumpOffset(masm.differenceBetween(pic.fastPathStart, inlineJump));
 
-    CHECK_IC_SPACE();
-
     frame.pop();
     frame.pushRegs(pic.shapeReg, pic.objReg, knownPushedType(0));
 
@@ -5566,8 +5495,7 @@ void
 mjit::Compiler::jsop_name(JSAtom *atom, JSValueType type, bool isCall)
 {
     prepareStubCall(Uses(0));
-    INLINE_STUBCALL(isCall ? stubs::CallName : stubs::Name, REJOIN_FALLTHROUGH);
-    testPushedType(REJOIN_FALLTHROUGH, 0, /* ool = */ false);
+        INLINE_STUBCALL(isCall ? stubs::CallName : stubs::Name, REJOIN_FALLTHROUGH);
     frame.pushSynced(type);
     if (isCall)
         frame.pushSynced(JSVAL_TYPE_UNKNOWN);
@@ -5943,7 +5871,6 @@ mjit::Compiler::jsop_getgname_slow(uint32 index)
 {
     prepareStubCall(Uses(0));
     INLINE_STUBCALL(stubs::GetGlobalName, REJOIN_GETTER);
-    testPushedType(REJOIN_GETTER, 0, /* ool = */ false);
     frame.pushSynced(JSVAL_TYPE_UNKNOWN);
 }
 
@@ -6057,10 +5984,6 @@ mjit::Compiler::jsop_getgname(uint32 index)
     passMICAddress(ic);
     ic.slowPathCall = OOL_STUBCALL(ic::GetGlobalName, REJOIN_GETTER);
 
-    CHECK_IC_SPACE();
-
-    testPushedType(REJOIN_GETTER, 0);
-
     /* Garbage value. */
     uint32 slot = 1 << 24;
 
@@ -6332,7 +6255,6 @@ mjit::Compiler::jsop_getelem_slow()
 {
     prepareStubCall(Uses(2));
     INLINE_STUBCALL(stubs::GetElem, REJOIN_FALLTHROUGH);
-    testPushedType(REJOIN_FALLTHROUGH, -2, /* ool = */ false);
     frame.popn(2);
     pushSyncedEntry(0);
 }
@@ -6917,54 +6839,39 @@ mjit::Compiler::constructThis()
 
     JSFunction *fun = script->function();
 
-    do {
-        if (!cx->typeInferenceEnabled() || fun->getType(cx)->unknownProperties())
-            break;
-
+    if (cx->typeInferenceEnabled() && !fun->getType(cx)->unknownProperties()) {
         jsid id = ATOM_TO_JSID(cx->runtime->atomState.classPrototypeAtom);
         types::TypeSet *protoTypes = fun->getType(cx)->getProperty(cx, id, false);
 
         JSObject *proto = protoTypes->getSingleton(cx, true);
-        if (!proto)
-            break;
+        if (proto) {
+            JSObject *templateObject = js_CreateThisForFunctionWithProto(cx, fun, proto);
+            if (!templateObject)
+                return false;
 
-        /*
-         * Generate an inline path to create a 'this' object with the given
-         * prototype. Only do this if the type is actually known as a possible
-         * 'this' type of the script.
-         */
-        types::TypeObject *type = proto->getNewType(cx, fun);
-        if (!type)
-            return false;
-        if (!types::TypeScript::ThisTypes(script)->hasType(types::Type::ObjectType(type)))
-            break;
+            /*
+             * The template incorporates a shape and/or fixed slots from any
+             * newScript on its type, so make sure recompilation is triggered
+             * should this information change later.
+             */
+            if (templateObject->type()->newScript)
+                types::TypeSet::WatchObjectStateChange(cx, templateObject->type());
 
-        JSObject *templateObject = js_CreateThisForFunctionWithProto(cx, fun, proto);
-        if (!templateObject)
-            return false;
+            RegisterID result = frame.allocReg();
+            Jump emptyFreeList = masm.getNewObject(cx, result, templateObject);
 
-        /*
-         * The template incorporates a shape and/or fixed slots from any
-         * newScript on its type, so make sure recompilation is triggered
-         * should this information change later.
-         */
-        if (templateObject->type()->newScript)
-            types::TypeSet::WatchObjectStateChange(cx, templateObject->type());
+            stubcc.linkExit(emptyFreeList, Uses(0));
+            stubcc.leave();
 
-        RegisterID result = frame.allocReg();
-        Jump emptyFreeList = masm.getNewObject(cx, result, templateObject);
+            stubcc.masm.move(ImmPtr(proto), Registers::ArgReg1);
+            OOL_STUBCALL(stubs::CreateThis, REJOIN_RESUME);
 
-        stubcc.linkExit(emptyFreeList, Uses(0));
-        stubcc.leave();
+            frame.setThis(result);
 
-        stubcc.masm.move(ImmPtr(proto), Registers::ArgReg1);
-        OOL_STUBCALL(stubs::CreateThis, REJOIN_RESUME);
-
-        frame.setThis(result);
-
-        stubcc.rejoin(Changes(1));
-        return true;
-    } while (false);
+            stubcc.rejoin(Changes(1));
+            return true;
+        }
+    }
 
     // Load the callee.
     frame.pushCallee();
@@ -7092,7 +6999,6 @@ mjit::Compiler::jsop_callelem_slow()
 {
     prepareStubCall(Uses(2));
     INLINE_STUBCALL(stubs::CallElem, REJOIN_FALLTHROUGH);
-    testPushedType(REJOIN_FALLTHROUGH, -2, /* ool = */ false);
     frame.popn(2);
     pushSyncedEntry(0);
     pushSyncedEntry(1);
@@ -7251,12 +7157,7 @@ mjit::Compiler::updateJoinVarTypes()
             if (newv->slot < TotalSlots(script)) {
                 VarType &vt = a->varTypes[newv->slot];
                 vt.types = analysis->getValueTypes(newv->value);
-                JSValueType newType = vt.types->getKnownTypeTag(cx);
-                if (newType != vt.type) {
-                    FrameEntry *fe = frame.getSlotEntry(newv->slot);
-                    frame.forgetLoopReg(fe);
-                }
-                vt.type = newType;
+                vt.type = vt.types->getKnownTypeTag(cx);
             }
             newv++;
         }
@@ -7335,6 +7236,11 @@ mjit::Compiler::hasTypeBarriers(jsbytecode *pc)
     if (!cx->typeInferenceEnabled())
         return false;
 
+#if 0
+    /* Stress test. */
+    return js_CodeSpec[*pc].format & JOF_TYPESET;
+#endif
+
     return analysis->typeBarriers(cx, pc) != NULL;
 }
 
@@ -7534,7 +7440,7 @@ mjit::Compiler::addTypeTest(types::TypeSet *types, RegisterID typeReg, RegisterI
 
 mjit::Compiler::BarrierState
 mjit::Compiler::testBarrier(RegisterID typeReg, RegisterID dataReg,
-                            bool testUndefined, bool testReturn, bool force)
+                            bool testUndefined, bool testReturn)
 {
     BarrierState state;
     state.typeReg = typeReg;
@@ -7556,12 +7462,18 @@ mjit::Compiler::testBarrier(RegisterID typeReg, RegisterID dataReg,
         JS_ASSERT(!testUndefined);
         if (!analysis->getCode(PC).monitoredTypesReturn)
             return state;
-    } else if (!hasTypeBarriers(PC) && !force) {
+    } else if (!hasTypeBarriers(PC)) {
         if (testUndefined && !types->hasType(types::Type::UndefinedType()))
             state.jump.setJump(masm.testUndefined(Assembler::Equal, typeReg));
         return state;
     }
 
+#if 0
+    /* Stress test. */
+    state.jump.setJump(masm.testInt32(Assembler::NotEqual, typeReg));
+    return state;
+#endif
+
     types->addFreeze(cx);
 
     /* Cannot have type barriers when the result of the operation is already unknown. */
@@ -7600,59 +7512,3 @@ mjit::Compiler::finishBarrier(const BarrierState &barrier, RejoinState rejoin, u
     OOL_STUBCALL(stubs::TypeBarrierHelper, rejoin);
     stubcc.rejoin(Changes(0));
 }
-
-void
-mjit::Compiler::testPushedType(RejoinState rejoin, int which, bool ool)
-{
-    if (!cx->typeInferenceEnabled() || !(js_CodeSpec[*PC].format & JOF_TYPESET))
-        return;
-
-    types::TypeSet *types = analysis->bytecodeTypes(PC);
-    if (types->unknown())
-        return;
-
-    Assembler &masm = ool ? stubcc.masm : this->masm;
-
-    JS_ASSERT(which <= 0);
-    Address address = (which == 0) ? frame.addressOfTop() : frame.addressOf(frame.peek(which));
-
-    Registers tempRegs(Registers::AvailRegs);
-    RegisterID scratch = tempRegs.takeAnyReg().reg();
-
-    Vector<Jump> mismatches(cx);
-    if (!masm.generateTypeCheck(cx, address, scratch, types, &mismatches)) {
-        oomInVector = true;
-        return;
-    }
-
-    Jump j = masm.jump();
-
-    for (unsigned i = 0; i < mismatches.length(); i++)
-        mismatches[i].linkTo(masm.label(), &masm);
-
-    masm.move(Imm32(which), Registers::ArgReg1);
-    if (ool)
-        OOL_STUBCALL(stubs::StubTypeHelper, rejoin);
-    else
-        INLINE_STUBCALL(stubs::StubTypeHelper, rejoin);
-
-    j.linkTo(masm.label(), &masm);
-}
-
-#ifdef DEBUG
-void
-mjit::Compiler::typeCheckPopped(int which)
-{
-    if (!cx->typeInferenceEnabled())
-        return;
-
-    FrameEntry *fe = frame.peek(-1 - which);
-    Jump j = frame.typeCheckEntry(fe, analysis->poppedTypes(PC, which));
-    stubcc.linkExit(j, Uses(0));
-    stubcc.leave();
-
-    stubcc.masm.move(Imm32(which), Registers::ArgReg1);
-    OOL_STUBCALL(stubs::TypeCheckPopped, REJOIN_RESUME);
-    stubcc.rejoin(Changes(0));
-}
-#endif /* DEBUG */
diff --git a/js/src/methodjit/Compiler.h b/js/src/methodjit/Compiler.h
index 6a3872ac54dc..39e0e98c58de 100644
--- a/js/src/methodjit/Compiler.h
+++ b/js/src/methodjit/Compiler.h
@@ -184,7 +184,7 @@ class Compiler : public BaseCompiler
     };
 
     struct BaseICInfo {
-        BaseICInfo(JSOp op) : op(op), canCallHook(false), forcedTypeBarrier(false)
+        BaseICInfo(JSOp op) : op(op)
         { }
         Label fastPathStart;
         Label fastPathRejoin;
@@ -192,16 +192,12 @@ class Compiler : public BaseCompiler
         Call slowPathCall;
         DataLabelPtr paramAddr;
         JSOp op;
-        bool canCallHook;
-        bool forcedTypeBarrier;
 
         void copyTo(ic::BaseIC &to, JSC::LinkBuffer &full, JSC::LinkBuffer &stub) {
             to.fastPathStart = full.locationOf(fastPathStart);
             to.fastPathRejoin = full.locationOf(fastPathRejoin);
             to.slowPathStart = stub.locationOf(slowPathStart);
             to.slowPathCall = stub.locationOf(slowPathCall);
-            to.canCallHook = canCallHook;
-            to.forcedTypeBarrier = forcedTypeBarrier;
             to.op = op;
             JS_ASSERT(to.op == op);
         }
@@ -472,7 +468,6 @@ class Compiler : public BaseCompiler
     bool inlining_;
     bool hasGlobalReallocation;
     bool oomInVector;       // True if we have OOM'd appending to a vector. 
-    bool overflowICSpace;   // True if we added a constant pool in a reserved space.
     uint32 gcNumber;
     enum { NoApplyTricks, LazyArgsObj } applyTricks;
     PCLengthEntry *pcLengths;
@@ -491,7 +486,7 @@ class Compiler : public BaseCompiler
     Label labelOf(jsbytecode *target, uint32 inlineIndex);
     void addCallSite(const InternalCallSite &callSite);
     void addReturnSite();
-    void inlineStubCall(void *stub, RejoinState rejoin, Uses uses);
+    void inlineStubCall(void *stub, RejoinState rejoin);
 
     bool debugMode() { return debugMode_; }
     bool inlining() { return inlining_; }
@@ -558,11 +553,6 @@ class Compiler : public BaseCompiler
     CompileStatus addInlineFrame(JSScript *script, uint32 depth, uint32 parent, jsbytecode *parentpc);
     CompileStatus scanInlineCalls(uint32 index, uint32 depth);
     CompileStatus checkAnalysis(JSScript *script);
-#ifdef DEBUG
-    void typeCheckPopped(int which);
-#else
-    void typeCheckPopped(int which) {}
-#endif
 
     struct BarrierState {
         MaybeJump jump;
@@ -575,12 +565,9 @@ class Compiler : public BaseCompiler
     BarrierState pushAddressMaybeBarrier(Address address, JSValueType type, bool reuseBase,
                                          bool testUndefined = false);
     BarrierState testBarrier(RegisterID typeReg, RegisterID dataReg,
-                             bool testUndefined = false, bool testReturn = false,
-                             bool force = false);
+                             bool testUndefined = false, bool testReturn = false);
     void finishBarrier(const BarrierState &barrier, RejoinState rejoin, uint32 which);
 
-    void testPushedType(RejoinState rejoin, int which, bool ool = true);
-
     /* Non-emitting helpers. */
     void pushSyncedEntry(uint32 pushed);
     uint32 fullAtomIndex(jsbytecode *pc);
@@ -788,20 +775,16 @@ class Compiler : public BaseCompiler
 // Given a stub call, emits the call into the inline assembly path. rejoin
 // indicates how to rejoin should this call trigger expansion/discarding.
 #define INLINE_STUBCALL(stub, rejoin)                                       \
-    inlineStubCall(JS_FUNC_TO_DATA_PTR(void *, (stub)), rejoin, Uses(0))
-#define INLINE_STUBCALL_USES(stub, rejoin, uses)                            \
-    inlineStubCall(JS_FUNC_TO_DATA_PTR(void *, (stub)), rejoin, uses)
+    inlineStubCall(JS_FUNC_TO_DATA_PTR(void *, (stub)), rejoin)
 
 // Given a stub call, emits the call into the out-of-line assembly path.
 // Unlike the INLINE_STUBCALL variant, this returns the Call offset.
 #define OOL_STUBCALL(stub, rejoin)                                          \
-    stubcc.emitStubCall(JS_FUNC_TO_DATA_PTR(void *, (stub)), rejoin, Uses(0))
-#define OOL_STUBCALL_USES(stub, rejoin, uses)                               \
-    stubcc.emitStubCall(JS_FUNC_TO_DATA_PTR(void *, (stub)), rejoin, uses)
+    stubcc.emitStubCall(JS_FUNC_TO_DATA_PTR(void *, (stub)), rejoin)
 
 // Same as OOL_STUBCALL, but specifies a slot depth.
 #define OOL_STUBCALL_LOCAL_SLOTS(stub, rejoin, slots)                       \
-    stubcc.emitStubCall(JS_FUNC_TO_DATA_PTR(void *, (stub)), rejoin, Uses(0), (slots))
+    stubcc.emitStubCall(JS_FUNC_TO_DATA_PTR(void *, (stub)), rejoin, (slots))
 
 } /* namespace js */
 } /* namespace mjit */
diff --git a/js/src/methodjit/FastOps.cpp b/js/src/methodjit/FastOps.cpp
index f7f9ac2c19ef..91c8fda2d9bd 100644
--- a/js/src/methodjit/FastOps.cpp
+++ b/js/src/methodjit/FastOps.cpp
@@ -634,7 +634,7 @@ mjit::Compiler::jsop_not()
           default:
           {
             prepareStubCall(Uses(1));
-            INLINE_STUBCALL_USES(stubs::ValueToBoolean, REJOIN_NONE, Uses(1));
+            INLINE_STUBCALL(stubs::ValueToBoolean, REJOIN_NONE);
 
             RegisterID reg = Registers::ReturnReg;
             frame.takeReg(reg);
@@ -1746,7 +1746,6 @@ mjit::Compiler::jsop_getelem_dense(bool isPacked)
 
     stubcc.leave();
     OOL_STUBCALL(stubs::GetElem, REJOIN_FALLTHROUGH);
-    testPushedType(REJOIN_FALLTHROUGH, -2);
 
     frame.popn(2);
 
@@ -1838,7 +1837,6 @@ mjit::Compiler::jsop_getelem_args()
 
     stubcc.leave();
     OOL_STUBCALL(stubs::GetElem, REJOIN_FALLTHROUGH);
-    testPushedType(REJOIN_FALLTHROUGH, -2);
 
     frame.popn(2);
     frame.pushRegs(typeReg, dataReg, knownPushedType(0));
@@ -1970,7 +1968,6 @@ mjit::Compiler::jsop_getelem_typed(int atype)
 
     stubcc.leave();
     OOL_STUBCALL(stubs::GetElem, REJOIN_FALLTHROUGH);
-    testPushedType(REJOIN_FALLTHROUGH, -2);
 
     frame.popn(2);
 
@@ -2152,17 +2149,11 @@ mjit::Compiler::jsop_getelem(bool isCall)
         ic.slowPathCall = OOL_STUBCALL(stubs::GetElem, REJOIN_FALLTHROUGH);
 #endif
 
-    testPushedType(REJOIN_FALLTHROUGH, -2);
-
     ic.fastPathRejoin = masm.label();
-    ic.forcedTypeBarrier = analysis->getCode(PC).getStringElement;
-
-    CHECK_IC_SPACE();
 
     frame.popn(2);
     frame.pushRegs(ic.typeReg, ic.objReg, knownPushedType(0));
-    BarrierState barrier = testBarrier(ic.typeReg, ic.objReg, false, false,
-                                       /* force = */ ic.forcedTypeBarrier);
+    BarrierState barrier = testBarrier(ic.typeReg, ic.objReg, false);
     if (isCall)
         frame.pushSynced(knownPushedType(1));
 
@@ -2353,9 +2344,9 @@ mjit::Compiler::jsop_stricteq(JSOp op)
         prepareStubCall(Uses(2));
 
         if (op == JSOP_STRICTEQ)
-            INLINE_STUBCALL_USES(stubs::StrictEq, REJOIN_NONE, Uses(2));
+            INLINE_STUBCALL(stubs::StrictEq, REJOIN_NONE);
         else
-            INLINE_STUBCALL_USES(stubs::StrictNe, REJOIN_NONE, Uses(2));
+            INLINE_STUBCALL(stubs::StrictNe, REJOIN_NONE);
 
         frame.popn(2);
         frame.pushSynced(JSVAL_TYPE_BOOLEAN);
@@ -2407,9 +2398,9 @@ mjit::Compiler::jsop_stricteq(JSOp op)
     if (needStub) {
         stubcc.leave();
         if (op == JSOP_STRICTEQ)
-            OOL_STUBCALL_USES(stubs::StrictEq, REJOIN_NONE, Uses(2));
+            OOL_STUBCALL(stubs::StrictEq, REJOIN_NONE);
         else
-            OOL_STUBCALL_USES(stubs::StrictNe, REJOIN_NONE, Uses(2));
+            OOL_STUBCALL(stubs::StrictNe, REJOIN_NONE);
     }
 
     frame.popn(2);
@@ -2422,9 +2413,9 @@ mjit::Compiler::jsop_stricteq(JSOp op)
     prepareStubCall(Uses(2));
 
     if (op == JSOP_STRICTEQ)
-        INLINE_STUBCALL_USES(stubs::StrictEq, REJOIN_NONE, Uses(2));
+        INLINE_STUBCALL(stubs::StrictEq, REJOIN_NONE);
     else
-        INLINE_STUBCALL_USES(stubs::StrictNe, REJOIN_NONE, Uses(2));
+        INLINE_STUBCALL(stubs::StrictNe, REJOIN_NONE);
 
     frame.popn(2);
     frame.pushSynced(JSVAL_TYPE_BOOLEAN);
diff --git a/js/src/methodjit/FrameState.cpp b/js/src/methodjit/FrameState.cpp
index 5b1b016a1825..65ceb02b14ff 100644
--- a/js/src/methodjit/FrameState.cpp
+++ b/js/src/methodjit/FrameState.cpp
@@ -1107,77 +1107,6 @@ FrameState::storeTo(FrameEntry *fe, Address address, bool popped)
         unpinReg(address.base);
 }
 
-#ifdef DEBUG
-JSC::MacroAssembler::Jump
-FrameState::typeCheckEntry(const FrameEntry *fe, types::TypeSet *types) const
-{
-    if (fe->isCopy())
-        fe = fe->copyOf();
-
-    Address addr1 = addressOfTop();
-    Address addr2 = Address(JSFrameReg, addr1.offset + sizeof(Value));
-
-    Registers tempRegs(Registers::AvailRegs);
-    RegisterID scratch = tempRegs.takeAnyReg().reg();
-    masm.storePtr(scratch, addr1);
-
-    do {
-        if (fe->isConstant()) {
-            masm.storeValue(fe->getValue(), addr2);
-            break;
-        }
-
-        if (fe->data.inFPRegister()) {
-            masm.storeDouble(fe->data.fpreg(), addr2);
-            break;
-        }
-
-        if (fe->isType(JSVAL_TYPE_DOUBLE)) {
-            JS_ASSERT(fe->data.inMemory());
-            masm.loadDouble(addressOf(fe), Registers::FPConversionTemp);
-            masm.storeDouble(Registers::FPConversionTemp, addr2);
-            break;
-        }
-
-        if (fe->data.inRegister())
-            masm.storePayload(fe->data.reg(), addr2);
-        else
-            JS_ASSERT(fe->data.inMemory());
-
-        if (fe->isTypeKnown())
-            masm.storeTypeTag(ImmType(fe->getKnownType()), addr2);
-        else if (fe->type.inRegister())
-            masm.storeTypeTag(fe->type.reg(), addr2);
-        else
-            JS_ASSERT(fe->type.inMemory());
-
-        if (fe->data.inMemory()) {
-            masm.loadPayload(addressOf(fe), scratch);
-            masm.storePayload(scratch, addr2);
-        }
-        if (fe->type.inMemory()) {
-            masm.loadTypeTag(addressOf(fe), scratch);
-            masm.storeTypeTag(scratch, addr2);
-        }
-    } while (false);
-
-    Vector<Jump> mismatches(cx);
-    masm.generateTypeCheck(cx, addr2, scratch, types, &mismatches);
-
-    masm.loadPtr(addr1, scratch);
-    Jump j = masm.jump();
-
-    for (unsigned i = 0; i < mismatches.length(); i++)
-        mismatches[i].linkTo(masm.label(), &masm);
-    masm.loadPtr(addr1, scratch);
-    Jump mismatch = masm.jump();
-
-    j.linkTo(masm.label(), &masm);
-
-    return mismatch;
-}
-#endif /* DEBUG */
-
 void
 FrameState::loadThisForReturn(RegisterID typeReg, RegisterID dataReg, RegisterID tempReg)
 {
@@ -1395,7 +1324,11 @@ FrameState::sync(Assembler &masm, Uses uses) const
     Registers avail(freeRegs.freeMask & Registers::AvailRegs);
     Registers temp(Registers::TempAnyRegs);
 
-    for (FrameEntry *fe = a->sp - 1; fe >= entries; fe--) {
+    FrameEntry *bottom = (cx->typeInferenceEnabled() || cx->compartment->debugMode())
+        ? entries
+        : a->sp - uses.nuses;
+
+    for (FrameEntry *fe = a->sp - 1; fe >= bottom; fe--) {
         if (!fe->isTracked())
             continue;
 
@@ -1445,7 +1378,7 @@ FrameState::sync(Assembler &masm, Uses uses) const
             /* Fall back to a slower sync algorithm if load required. */
             if ((!fe->type.synced() && backing->type.inMemory()) ||
                 (!fe->data.synced() && backing->data.inMemory())) {
-                syncFancy(masm, avail, fe, entries);
+                syncFancy(masm, avail, fe, bottom);
                 return;
             }
 #endif
@@ -1526,7 +1459,11 @@ FrameState::syncAndKill(Registers kill, Uses uses, Uses ignore)
 
     uint32 maxvisits = tracker.nentries;
 
-    for (FrameEntry *fe = a->sp - 1; fe >= entries && maxvisits; fe--) {
+    FrameEntry *bottom = (cx->typeInferenceEnabled() || cx->compartment->debugMode())
+        ? entries
+        : a->sp - uses.nuses;
+
+    for (FrameEntry *fe = a->sp - 1; fe >= bottom && maxvisits; fe--) {
         if (!fe->isTracked())
             continue;
 
@@ -2935,7 +2872,7 @@ FrameState::clearTemporaries()
 }
 
 Vector<TemporaryCopy> *
-FrameState::getTemporaryCopies(Uses uses)
+FrameState::getTemporaryCopies()
 {
     /* :XXX: handle OOM */
     Vector<TemporaryCopy> *res = NULL;
@@ -2946,7 +2883,7 @@ FrameState::getTemporaryCopies(Uses uses)
         if (fe->isCopied()) {
             for (uint32 i = fe->trackerIndex() + 1; i < tracker.nentries; i++) {
                 FrameEntry *nfe = tracker[i];
-                if (!deadEntry(nfe, uses.nuses) && nfe->isCopy() && nfe->copyOf() == fe) {
+                if (!deadEntry(nfe) && nfe->isCopy() && nfe->copyOf() == fe) {
                     if (!res)
                         res = cx->new_< Vector<TemporaryCopy> >(cx);
                     res->append(TemporaryCopy(addressOf(nfe), addressOf(fe)));
diff --git a/js/src/methodjit/FrameState.h b/js/src/methodjit/FrameState.h
index 4e4d8fd62a77..dd4f19c44d78 100644
--- a/js/src/methodjit/FrameState.h
+++ b/js/src/methodjit/FrameState.h
@@ -618,19 +618,9 @@ class FrameState
      */
     inline FrameEntry *peek(int32 depth);
 
-#ifdef DEBUG
-    /*
-     * Check that a frame entry matches a type, returning a jump taken on
-     * mismatch. Does not affect register state or sync state of any entries.
-     */
-    Jump typeCheckEntry(const FrameEntry *fe, types::TypeSet *types) const;
-#endif
-
     /*
      * Fully stores a FrameEntry at an arbitrary address. popHint specifies
      * how hard the register allocator should try to keep the FE in registers.
-     * If scratchData and scratchType are specified, the frame entry and
-     * register state will not be modified.
      */
     void storeTo(FrameEntry *fe, Address address, bool popHint = false);
 
@@ -957,11 +947,8 @@ class FrameState
     void clearTemporaries();
     inline FrameEntry *getTemporary(uint32 which);
 
-    /*
-     * Return NULL or a new vector with all current copies of temporaries,
-     * excluding those about to be popped per 'uses'.
-     */
-    Vector<TemporaryCopy> *getTemporaryCopies(Uses uses);
+    /* Return NULL or a new vector with all current copies of temporaries. */
+    Vector<TemporaryCopy> *getTemporaryCopies();
 
     inline void syncAndForgetFe(FrameEntry *fe, bool markSynced = false);
     inline void forgetLoopReg(FrameEntry *fe);
diff --git a/js/src/methodjit/InvokeHelpers.cpp b/js/src/methodjit/InvokeHelpers.cpp
index c3a48ce9bf25..d45001f21ab0 100644
--- a/js/src/methodjit/InvokeHelpers.cpp
+++ b/js/src/methodjit/InvokeHelpers.cpp
@@ -617,46 +617,50 @@ js_InternalThrow(VMFrame &f)
     StackFrame *fp = cx->fp();
     JSScript *script = fp->script();
 
-    /*
-     * Fall back to EnterMethodJIT and finish the frame in the interpreter.
-     * We may wipe out all JIT code on the stack without patching ncode values
-     * to jump to the interpreter, and thus can only enter JIT code via
-     * EnterMethodJIT (which overwrites its entry frame's ncode).
-     * See ClearAllFrames.
-     */
-    cx->compartment->jaegerCompartment()->setLastUnfinished(Jaeger_Unfinished);
+    if (cx->typeInferenceEnabled() || !fp->jit()) {
+        /*
+         * Fall back to EnterMethodJIT and finish the frame in the interpreter.
+         * With type inference enabled, we may wipe out all JIT code on the
+         * stack without patching ncode values to jump to the interpreter, and
+         * thus can only enter JIT code via EnterMethodJIT (which overwrites
+         * its entry frame's ncode). See ClearAllFrames.
+         */
+        cx->compartment->jaegerCompartment()->setLastUnfinished(Jaeger_Unfinished);
+
+        if (!script->ensureRanAnalysis(cx)) {
+            js_ReportOutOfMemory(cx);
+            return NULL;
+        }
+
+        analyze::AutoEnterAnalysis enter(cx);
+
+        cx->regs().pc = pc;
+        cx->regs().sp = fp->base() + script->analysis()->getCode(pc).stackDepth;
+
+        /*
+         * Interpret the ENTERBLOCK and EXCEPTION opcodes, so that we don't go
+         * back into the interpreter with a pending exception. This will cause
+         * it to immediately rethrow.
+         */
+        if (cx->isExceptionPending()) {
+            JS_ASSERT(js_GetOpcode(cx, script, pc) == JSOP_ENTERBLOCK);
+            JSObject *obj = script->getObject(GET_SLOTNO(pc));
+            Value *vp = cx->regs().sp + OBJ_BLOCK_COUNT(cx, obj);
+            SetValueRangeToUndefined(cx->regs().sp, vp);
+            cx->regs().sp = vp;
+            JS_ASSERT(js_GetOpcode(cx, script, pc + JSOP_ENTERBLOCK_LENGTH) == JSOP_EXCEPTION);
+            cx->regs().sp[0] = cx->getPendingException();
+            cx->clearPendingException();
+            cx->regs().sp++;
+            cx->regs().pc = pc + JSOP_ENTERBLOCK_LENGTH + JSOP_EXCEPTION_LENGTH;
+        }
+
+        *f.oldregs = f.regs;
 
-    if (!script->ensureRanAnalysis(cx)) {
-        js_ReportOutOfMemory(cx);
         return NULL;
     }
 
-    analyze::AutoEnterAnalysis enter(cx);
-
-    cx->regs().pc = pc;
-    cx->regs().sp = fp->base() + script->analysis()->getCode(pc).stackDepth;
-
-    /*
-     * Interpret the ENTERBLOCK and EXCEPTION opcodes, so that we don't go
-     * back into the interpreter with a pending exception. This will cause
-     * it to immediately rethrow.
-     */
-    if (cx->isExceptionPending()) {
-        JS_ASSERT(js_GetOpcode(cx, script, pc) == JSOP_ENTERBLOCK);
-        JSObject *obj = script->getObject(GET_SLOTNO(pc));
-        Value *vp = cx->regs().sp + OBJ_BLOCK_COUNT(cx, obj);
-        SetValueRangeToUndefined(cx->regs().sp, vp);
-        cx->regs().sp = vp;
-        JS_ASSERT(js_GetOpcode(cx, script, pc + JSOP_ENTERBLOCK_LENGTH) == JSOP_EXCEPTION);
-        cx->regs().sp[0] = cx->getPendingException();
-        cx->clearPendingException();
-        cx->regs().sp++;
-        cx->regs().pc = pc + JSOP_ENTERBLOCK_LENGTH + JSOP_EXCEPTION_LENGTH;
-    }
-
-    *f.oldregs = f.regs;
-
-    return NULL;
+    return script->nativeCodeForPC(fp->isConstructing(), pc);
 }
 
 void JS_FASTCALL
@@ -1157,7 +1161,7 @@ RunTracer(VMFrame &f)
 
 #if defined JS_TRACER
 # if defined JS_MONOIC
-void * JS_FASTCALL
+void *JS_FASTCALL
 stubs::InvokeTracer(VMFrame &f, ic::TraceICInfo *ic)
 {
     return RunTracer(f, *ic);
@@ -1165,7 +1169,7 @@ stubs::InvokeTracer(VMFrame &f, ic::TraceICInfo *ic)
 
 # else
 
-void * JS_FASTCALL
+void *JS_FASTCALL
 stubs::InvokeTracer(VMFrame &f)
 {
     return RunTracer(f);
@@ -1328,34 +1332,22 @@ js_InternalInterpret(void *returnData, void *returnType, void *returnReg, js::VM
         break;
 
       case REJOIN_NATIVE:
-      case REJOIN_NATIVE_LOWERED:
-      case REJOIN_NATIVE_GETTER: {
+      case REJOIN_NATIVE_LOWERED: {
         /*
          * We don't rejoin until after the native stub finishes execution, in
          * which case the return value will be in memory. For lowered natives,
-         * the return value will be in the 'this' value's slot. For getters,
-         * the result is at nextsp[0] (see ic::CallProp).
+         * the return value will be in the 'this' value's slot.
          */
-        if (rejoin == REJOIN_NATIVE_LOWERED) {
+        if (rejoin == REJOIN_NATIVE_LOWERED)
             nextsp[-1] = nextsp[0];
-        } else if (rejoin == REJOIN_NATIVE_GETTER) {
-            if (js_CodeSpec[op].format & JOF_CALLOP) {
-                /*
-                 * If we went through jsop_callprop_obj then the 'this' value
-                 * is still in its original slot and hasn't been shifted yet,
-                 * so fix that now. Yuck.
-                 */
-                if (nextsp[-2].isObject())
-                    nextsp[-1] = nextsp[-2];
-                nextsp[-2] = nextsp[0];
-            } else {
-                nextsp[-1] = nextsp[0];
-            }
-        }
 
         /* Release this reference on the orphaned native stub. */
         RemoveOrphanedNative(cx, fp);
 
+        /*
+         * Note: there is no need to monitor the result of the native, the
+         * native stub will always do a type check before finishing.
+         */
         f.regs.pc = nextpc;
         break;
       }
@@ -1574,16 +1566,6 @@ js_InternalInterpret(void *returnData, void *returnType, void *returnReg, js::VM
         nextDepth = analysis->getCode(f.regs.pc).stackDepth;
     f.regs.sp = fp->base() + nextDepth;
 
-    /*
-     * Monitor the result of the previous op when finishing a JOF_TYPESET op.
-     * The result may not have been marked if we bailed out while inside a stub
-     * for the op.
-     */
-    if (f.regs.pc == nextpc && (js_CodeSpec[op].format & JOF_TYPESET)) {
-        int which = (js_CodeSpec[op].format & JOF_CALLOP) ? -2 : -1;  /* Yuck. */
-        types::TypeScript::Monitor(cx, script, pc, f.regs.sp[which]);
-    }
-
     /* Mark the entry frame as unfinished, and update the regs to resume at. */
     JaegerStatus status = skipTrap ? Jaeger_UnfinishedAtTrap : Jaeger_Unfinished;
     cx->compartment->jaegerCompartment()->setLastUnfinished(status);
diff --git a/js/src/methodjit/LoopState.cpp b/js/src/methodjit/LoopState.cpp
index c1ca54f09fa6..c14b92ef8686 100644
--- a/js/src/methodjit/LoopState.cpp
+++ b/js/src/methodjit/LoopState.cpp
@@ -195,7 +195,7 @@ LoopState::addJoin(unsigned index, bool script)
 }
 
 void
-LoopState::addInvariantCall(Jump jump, Label label, bool ool, bool entry, unsigned patchIndex, Uses uses)
+LoopState::addInvariantCall(Jump jump, Label label, bool ool, bool entry, unsigned patchIndex)
 {
     RestoreInvariantCall call;
     call.jump = jump;
@@ -203,7 +203,7 @@ LoopState::addInvariantCall(Jump jump, Label label, bool ool, bool entry, unsign
     call.ool = ool;
     call.entry = entry;
     call.patchIndex = patchIndex;
-    call.temporaryCopies = frame.getTemporaryCopies(uses);
+    call.temporaryCopies = frame.getTemporaryCopies();
 
     restoreInvariantCalls.append(call);
 }
@@ -259,7 +259,7 @@ LoopState::flushLoop(StubCompiler &stubcc)
 
                 if (call.entry) {
                     masm.fallibleVMCall(true, JS_FUNC_TO_DATA_PTR(void *, stubs::InvariantFailure),
-                                        pc, NULL, NULL, 0);
+                                        pc, NULL, 0);
                 } else {
                     /* f.regs are already coherent, don't write new values to them. */
                     masm.infallibleVMCall(JS_FUNC_TO_DATA_PTR(void *, stubs::InvariantFailure), -1);
@@ -1820,6 +1820,7 @@ LoopState::analyzeLoopBody(unsigned frame)
             skipAnalysis = true;
             break;
 
+          case JSOP_SETHOLE:
           case JSOP_SETELEM: {
             SSAValue objValue = analysis->poppedValue(pc, 2);
             SSAValue elemValue = analysis->poppedValue(pc, 1);
@@ -1843,7 +1844,7 @@ LoopState::analyzeLoopBody(unsigned frame)
                     continue;
                 if (!addModifiedProperty(object, JSID_VOID))
                     return;
-                if (analysis->getCode(pc).arrayWriteHole && !addGrowArray(object))
+                if (op == JSOP_SETHOLE && !addGrowArray(object))
                     return;
             }
 
diff --git a/js/src/methodjit/LoopState.h b/js/src/methodjit/LoopState.h
index 71d6ae8216ea..baf1fcde0255 100644
--- a/js/src/methodjit/LoopState.h
+++ b/js/src/methodjit/LoopState.h
@@ -253,7 +253,7 @@ class LoopState : public MacroAssemblerTypedefs
     bool generatingInvariants() { return !skipAnalysis; }
 
     /* Add a call with trailing jump/label, after which invariants need to be restored. */
-    void addInvariantCall(Jump jump, Label label, bool ool, bool entry, unsigned patchIndex, Uses uses);
+    void addInvariantCall(Jump jump, Label label, bool ool, bool entry, unsigned patchIndex);
 
     uint32 headOffset() { return lifetime->head; }
     uint32 getLoopRegs() { return loopRegs.freeMask; }
diff --git a/js/src/methodjit/MachineRegs.h b/js/src/methodjit/MachineRegs.h
index a6648d8bc924..3452c6d95a10 100644
--- a/js/src/methodjit/MachineRegs.h
+++ b/js/src/methodjit/MachineRegs.h
@@ -118,7 +118,7 @@ struct Registers {
 #elif defined(JS_CPU_X64)
     static const RegisterID JSFrameReg = JSC::X86Registers::ebx;
 #elif defined(JS_CPU_ARM)
-    static const RegisterID JSFrameReg = JSC::ARMRegisters::r10;
+    static const RegisterID JSFrameReg = JSC::ARMRegisters::r11;
 #elif defined(JS_CPU_SPARC)
     static const RegisterID JSFrameReg = JSC::SparcRegisters::l0;
 #endif
@@ -130,13 +130,11 @@ struct Registers {
     static const RegisterID ArgReg1 = JSC::X86Registers::edx;
 #  if defined(JS_CPU_X64)
     static const RegisterID ArgReg2 = JSC::X86Registers::r8;
-    static const RegisterID ArgReg3 = JSC::X86Registers::r9;
 #  endif
 # else
     static const RegisterID ArgReg0 = JSC::X86Registers::edi;
     static const RegisterID ArgReg1 = JSC::X86Registers::esi;
     static const RegisterID ArgReg2 = JSC::X86Registers::edx;
-    static const RegisterID ArgReg3 = JSC::X86Registers::ecx;
 # endif
 #elif JS_CPU_ARM
     static const RegisterID ReturnReg = JSC::ARMRegisters::r0;
@@ -227,8 +225,9 @@ struct Registers {
         | (1 << JSC::ARMRegisters::r6)
         | (1 << JSC::ARMRegisters::r7)
     // r8 is reserved as a scratch register for the assembler.
-        | (1 << JSC::ARMRegisters::r9);
-    // r10 is reserved for JSFrameReg.
+        | (1 << JSC::ARMRegisters::r9)
+        | (1 << JSC::ARMRegisters::r10);
+    // r11 is reserved for JSFrameReg.
     // r13 is SP and must always point to VMFrame whilst in generated code.
     // r14 is LR and is used for return sequences.
     // r15 is PC (program counter).
@@ -389,15 +388,6 @@ struct Registers {
 # error "Unsupported platform"
 #endif
 
-    /* Temp reg that can be clobbered when setting up a fallible fast or ABI call. */
-#if defined(JS_CPU_X86) || defined(JS_CPU_X64)
-    static const RegisterID ClobberInCall = JSC::X86Registers::ecx;
-#elif defined(JS_CPU_ARM)
-    static const RegisterID ClobberInCall = JSC::ARMRegisters::r2;
-#elif defined(JS_CPU_SPARC)
-    static const RegisterID ClobberInCall = JSC::SparcRegisters::l1;
-#endif
-
     static const uint32 AvailFPRegs = TempFPRegs;
 
     static inline uint32 maskReg(FPRegisterID reg) {
@@ -422,20 +412,6 @@ struct Registers {
         return regs.takeAnyReg().reg();
     }
 
-    /* Get a register which is not live before a normal ABI call with at most four args. */
-    static inline Registers tempCallRegMask() {
-        Registers regs(AvailRegs);
-#ifndef JS_CPU_X86
-        regs.takeReg(ArgReg0);
-        regs.takeReg(ArgReg1);
-        regs.takeReg(ArgReg2);
-#if defined(JS_CPU_SPARC) || defined(JS_CPU_X64)
-        regs.takeReg(ArgReg3);
-#endif
-#endif
-        return regs;
-    }
-
     Registers(uint32 freeMask)
       : freeMask(freeMask)
     { }
diff --git a/js/src/methodjit/MethodJIT.cpp b/js/src/methodjit/MethodJIT.cpp
index 3be8da7703c6..424a8a87b1e8 100644
--- a/js/src/methodjit/MethodJIT.cpp
+++ b/js/src/methodjit/MethodJIT.cpp
@@ -482,7 +482,7 @@ JS_STATIC_ASSERT(VMFrame::offsetOfFp ==                 (4*7));
 JS_STATIC_ASSERT(offsetof(VMFrame, scratch) ==          (4*3));
 JS_STATIC_ASSERT(offsetof(VMFrame, previous) ==         (4*2));
 
-JS_STATIC_ASSERT(JSFrameReg == JSC::ARMRegisters::r10);
+JS_STATIC_ASSERT(JSFrameReg == JSC::ARMRegisters::r11);
 JS_STATIC_ASSERT(JSReturnReg_Type == JSC::ARMRegisters::r5);
 JS_STATIC_ASSERT(JSReturnReg_Data == JSC::ARMRegisters::r4);
 
@@ -547,8 +547,8 @@ SYMBOL_STRING(JaegerTrampoline) ":"         "\n"
 
     /* Preserve 'code' (r2) in an arbitrary callee-saved register. */
 "   mov     r4, r2"                             "\n"
-    /* Preserve 'fp' (r1) in r10 (JSFrameReg). */
-"   mov     r10, r1"                            "\n"
+    /* Preserve 'fp' (r1) in r11 (JSFrameReg). */
+"   mov     r11, r1"                            "\n"
 
 "   mov     r0, sp"                             "\n"
 "   blx  " SYMBOL_STRING_VMFRAME(SetVMFrameRegs)   "\n"
@@ -564,7 +564,7 @@ asm (
 FUNCTION_HEADER_EXTRA
 ".globl " SYMBOL_STRING(JaegerTrampolineReturn)   "\n"
 SYMBOL_STRING(JaegerTrampolineReturn) ":"         "\n"
-"   strd    r4, r5, [r10, #24]"             "\n" /* fp->rval type,data */
+"   strd    r4, r5, [r11, #24]"             "\n" /* fp->rval type,data */
 
     /* Tidy up. */
 "   mov     r0, sp"                         "\n"
@@ -610,8 +610,8 @@ FUNCTION_HEADER_EXTRA
 SYMBOL_STRING(JaegerInterpolineScripted) ":"        "\n"
     /* The only difference between JaegerInterpoline and JaegerInpolineScripted is that the
      * scripted variant has to walk up to the previous StackFrame first. */
-"   ldr     r10, [r10, #(4*4)]"             "\n"    /* Load f->prev_ */
-"   str     r10, [sp, #(4*7)]"              "\n"    /* Update f->regs->fp_ */
+"   ldr     r11, [r11, #(4*4)]"             "\n"    /* Load f->prev_ */
+"   str     r11, [sp, #(4*7)]"              "\n"    /* Update f->regs->fp_ */
     /* Fall through into JaegerInterpoline. */
 
 FUNCTION_HEADER_EXTRA
@@ -623,8 +623,8 @@ SYMBOL_STRING(JaegerInterpoline) ":"        "\n"
 "   mov     r0, r4"                         "\n"    /* returnData */
 "   blx  " SYMBOL_STRING_RELOC(js_InternalInterpret) "\n"
 "   cmp     r0, #0"                         "\n"
-"   ldr     r10, [sp, #(4*7)]"              "\n"    /* Load (StackFrame*)f->regs->fp_ */
-"   ldrd    r4, r5, [r10, #(4*6)]"          "\n"    /* Load rval payload and type. */
+"   ldr     ip, [sp, #(4*7)]"               "\n"    /* Load (StackFrame*)f->regs->fp_ */
+"   ldrd    r4, r5, [ip, #(4*6)]"           "\n"    /* Load rval payload and type. */
 "   ldr     r1, [sp, #(4*3)]"               "\n"    /* Load scratch. */
 "   it      ne"                             "\n"
 "   bxne    r0"                             "\n"
@@ -1087,6 +1087,8 @@ static inline void Destroy(T &t)
 
 mjit::JITScript::~JITScript()
 {
+    code.release();
+
     if (pcLengths)
         Foreground::free_(pcLengths);
 
@@ -1113,25 +1115,26 @@ mjit::JITScript::~JITScript()
         (*pExecPool)->release();
     }
 
-    for (unsigned i = 0; i < nativeCallStubs.length(); i++) {
-        JSC::ExecutablePool *pool = nativeCallStubs[i].pool;
-        if (pool)
-            pool->release();
-    }
-
     ic::CallICInfo *callICs_ = callICs();
-    for (uint32 i = 0; i < nCallICs; i++)
-        callICs_[i].purge();
+    for (uint32 i = 0; i < nCallICs; i++) {
+        callICs_[i].releasePools();
+        if (callICs_[i].fastGuardedObject)
+            callICs_[i].purgeGuardedObject();
+    }
 
     // Fixup any ICs still referring to this JIT.
     while (!JS_CLIST_IS_EMPTY(&callers)) {
         JS_STATIC_ASSERT(offsetof(ic::CallICInfo, links) == 0);
         ic::CallICInfo *ic = (ic::CallICInfo *) callers.next;
-        ic->purge();
+
+        uint8 *start = (uint8 *)ic->funGuard.executableAddress();
+        JSC::RepatchBuffer repatch(JSC::JITCode(start - 32, 64));
+
+        repatch.repatch(ic->funGuard, NULL);
+        repatch.relink(ic->funJump, ic->slowPathStart);
+        ic->purgeGuardedObject();
     }
 #endif
-
-    code.release();
 }
 
 size_t
@@ -1311,25 +1314,4 @@ JITScript::trace(JSTracer *trc)
         MarkObject(trc, *rootedObjects()[i], "mjit rooted object");
 }
 
-void
-mjit::PurgeICs(JSContext *cx, JSScript *script)
-{
-#ifdef JS_MONOIC
-    if (script->jitNormal) {
-        script->jitNormal->purgeMICs();
-        script->jitNormal->sweepCallICs(cx);
-    }
-    if (script->jitCtor) {
-        script->jitCtor->purgeMICs();
-        script->jitCtor->sweepCallICs(cx);
-    }
-#endif
-#ifdef JS_POLYIC
-    if (script->jitNormal)
-        script->jitNormal->purgePICs();
-    if (script->jitCtor)
-        script->jitCtor->purgePICs();
-#endif
-}
-
 /* static */ const double mjit::Assembler::oneDouble = 1.0;
diff --git a/js/src/methodjit/MethodJIT.h b/js/src/methodjit/MethodJIT.h
index 07466d0a9b48..4b7337927853 100644
--- a/js/src/methodjit/MethodJIT.h
+++ b/js/src/methodjit/MethodJIT.h
@@ -258,12 +258,10 @@ enum RejoinState {
     /*
      * As for REJOIN_FALLTHROUGH, but holds a reference on the compartment's
      * orphaned native pools which needs to be reclaimed by InternalInterpret.
-     * The return value needs to be adjusted if REJOIN_NATIVE_LOWERED, and
-     * REJOIN_NATIVE_GETTER is for ABI calls made for property accesses.
+     * The return value needs to be adjusted if REJOIN_NATIVE_LOWERED.
      */
     REJOIN_NATIVE,
     REJOIN_NATIVE_LOWERED,
-    REJOIN_NATIVE_GETTER,
 
     /*
      * Dummy rejoin stored in VMFrames to indicate they return into a native
@@ -555,31 +553,6 @@ struct PCLengthEntry {
     double          picsLength; /* amount of PIC stub code generated */
 };
 
-/*
- * Pools and patch locations for managing stubs for non-FASTCALL C++ calls made
- * from native call and PropertyOp stubs. Ownership of these may be transferred
- * into the orphanedNativePools for the compartment.
- */
-struct NativeCallStub {
-    /* pc/inlined location of the stub. */
-    jsbytecode *pc;
-    CallSite *inlined;
-
-    /* Pool for the stub, NULL if it has been removed from the script. */
-    JSC::ExecutablePool *pool;
-
-    /*
-     * Fallthrough jump returning to jitcode which may be patched during
-     * recompilation. On x64 this is an indirect jump to avoid issues with far
-     * jumps on relative branches.
-     */
-#ifdef JS_CPU_X64
-    JSC::CodeLocationDataLabelPtr jump;
-#else
-    JSC::CodeLocationJump jump;
-#endif
-};
-
 struct JITScript {
     typedef JSC::MacroAssemblerCodeRef CodeRef;
     CodeRef         code;       /* pool & code addresses */
@@ -638,9 +611,6 @@ struct JITScript {
     ExecPoolVector execPools;
 #endif
 
-    // Additional ExecutablePools for native call and getter stubs.
-    Vector<NativeCallStub, 0, SystemAllocPolicy> nativeCallStubs;
-
     NativeMapEntry *nmap() const;
     js::mjit::InlineFrame *inlineFrames() const;
     js::mjit::CallSite *callSites() const;
@@ -666,9 +636,8 @@ struct JITScript {
         return jcheck >= jitcode && jcheck < jitcode + code.m_size;
     }
 
-    void purgeGetterPICs();
-
-    void sweepCallICs(JSContext *cx);
+    void nukeScriptDependentICs();
+    void sweepCallICs(JSContext *cx, bool purgeAll);
     void purgeMICs();
     void purgePICs();
 
@@ -686,8 +655,6 @@ struct JITScript {
     char *polyICSectionsLimit() const;
 };
 
-void PurgeICs(JSContext *cx, JSScript *script);
-
 /*
  * Execute the given mjit code. This is a low-level call and callers must
  * provide the same guarantees as JaegerShot/CheckStackAndEnterMethodJIT.
diff --git a/js/src/methodjit/MonoIC.cpp b/js/src/methodjit/MonoIC.cpp
index faffd001ccbf..bd46a9827448 100644
--- a/js/src/methodjit/MonoIC.cpp
+++ b/js/src/methodjit/MonoIC.cpp
@@ -555,120 +555,6 @@ SlowNewFromIC(VMFrame &f, ic::CallICInfo *ic)
     return NULL;
 }
 
-void
-CallICInfo::purge()
-{
-    uint8 *start = (uint8 *)funGuard.executableAddress();
-    JSC::RepatchBuffer repatch(JSC::JITCode(start - 32, 64));
-
-    repatch.repatch(funGuard, NULL);
-    repatch.relink(funJump, slowPathStart);
-
-    releasePools();
-    fastGuardedNative = NULL;
-
-    if (fastGuardedObject) {
-        hasJsFunCheck = false;
-        fastGuardedObject = NULL;
-        JS_REMOVE_LINK(&links);
-    }
-}
-
-bool
-NativeStubLinker::init(JSContext *cx)
-{
-    JSC::ExecutablePool *pool = LinkerHelper::init(cx);
-    if (!pool)
-        return false;
-
-    NativeCallStub stub;
-    stub.pc = pc;
-    stub.inlined = inlined;
-    stub.pool = pool;
-    stub.jump = locationOf(done);
-    if (!jit->nativeCallStubs.append(stub)) {
-        pool->release();
-        return false;
-    }
-
-    return true;
-}
-
-/*
- * Generate epilogue code to run after a stub ABI call to a native or getter.
- * This checks for an exception, and either type checks the result against the
- * observed types for the opcode or loads the result into a register pair
- * (it will go through a type barrier afterwards).
- */
-bool
-mjit::NativeStubEpilogue(VMFrame &f, Assembler &masm, NativeStubLinker::FinalJump *result,
-                         int32 initialFrameDepth, int32 vpOffset,
-                         MaybeRegisterID typeReg, MaybeRegisterID dataReg)
-{
-    /* Reload fp, which may have been clobbered by restoreStackBase(). */
-    masm.loadPtr(FrameAddress(VMFrame::offsetOfFp), JSFrameReg);
-
-    Jump hasException = masm.branchTest32(Assembler::Zero, Registers::ReturnReg,
-                                          Registers::ReturnReg);
-
-    Address resultAddress(JSFrameReg, vpOffset);
-
-    Vector<Jump> mismatches(f.cx);
-    if (f.cx->typeInferenceEnabled()) {
-        if (!typeReg.isSet()) {
-            /*
-             * Test the result of this native against the known result type set
-             * for the call. We don't assume knowledge about the types that
-             * natives can return, except when generating specialized paths in
-             * FastBuiltins.
-             */
-            types::TypeSet *types = f.script()->analysis()->bytecodeTypes(f.pc());
-            if (!masm.generateTypeCheck(f.cx, resultAddress, Registers::ReturnReg, types, &mismatches))
-                THROWV(false);
-        }
-    }
-
-    /*
-     * Can no longer trigger recompilation in this stub, clear the stub
-     * rejoin on the VMFrame.
-     */
-    masm.storePtr(ImmPtr(NULL), FrameAddress(offsetof(VMFrame, stubRejoin)));
-
-    if (typeReg.isSet())
-        masm.loadValueAsComponents(resultAddress, typeReg.reg(), dataReg.reg());
-
-    /*
-     * The final jump is a indirect on x64, so that we'll always be able
-     * to repatch it to the interpoline later.
-     */
-    Label finished = masm.label();
-#ifdef JS_CPU_X64
-    JSC::MacroAssembler::DataLabelPtr done = masm.moveWithPatch(ImmPtr(NULL), Registers::ValueReg);
-    masm.jump(Registers::ValueReg);
-#else
-    Jump done = masm.jump();
-#endif
-
-    /* Generate a call for type check failures on the native result. */
-    if (!mismatches.empty()) {
-        for (unsigned i = 0; i < mismatches.length(); i++)
-            mismatches[i].linkTo(masm.label(), &masm);
-        masm.addPtr(Imm32(vpOffset), JSFrameReg, Registers::ArgReg1);
-        masm.fallibleVMCall(true, JS_FUNC_TO_DATA_PTR(void *, stubs::TypeBarrierReturn),
-                            f.regs.pc, f.regs.inlined(), NULL, initialFrameDepth);
-        masm.storePtr(ImmPtr(NULL), FrameAddress(offsetof(VMFrame, stubRejoin)));
-        masm.jump().linkTo(finished, &masm);
-    }
-
-    /* Move JaegerThrowpoline into register for very far jump on x64. */
-    hasException.linkTo(masm.label(), &masm);
-    masm.storePtr(ImmPtr(NULL), FrameAddress(offsetof(VMFrame, stubRejoin)));
-    masm.throwInJIT();
-
-    *result = done;
-    return true;
-}
-
 /*
  * Calls have an inline path and an out-of-line path. The inline path is used
  * in the fastest case: the method has JIT'd code, and |argc == nargs|.
@@ -771,27 +657,29 @@ class CallCompiler : public BaseCompiler
         masm.loadPtr(Address(t0, offset), t0);
         Jump hasCode = masm.branchPtr(Assembler::Above, t0, ImmPtr(JS_UNJITTABLE_SCRIPT));
 
-        /*
-         * Write the rejoin state to indicate this is a compilation call
-         * made from an IC (the recompiler cannot detect calls made from
-         * ICs automatically).
-         */
-        masm.storePtr(ImmPtr((void *) ic.frameSize.rejoinState(f.pc(), false)),
-                      FrameAddress(offsetof(VMFrame, stubRejoin)));
+        if (cx->typeInferenceEnabled()) {
+            /*
+             * Write the rejoin state to indicate this is a compilation call
+             * made from an IC (the recompiler cannot detect calls made from
+             * ICs automatically).
+             */
+            masm.storePtr(ImmPtr((void *) ic.frameSize.rejoinState(f.pc(), false)),
+                          FrameAddress(offsetof(VMFrame, stubRejoin)));
+        }
 
         masm.bumpStubCounter(f.script(), f.pc(), Registers::tempCallReg());
 
         /* Try and compile. On success we get back the nmap pointer. */
         void *compilePtr = JS_FUNC_TO_DATA_PTR(void *, stubs::CompileFunction);
+        DataLabelPtr inlined;
         if (ic.frameSize.isStatic()) {
             masm.move(Imm32(ic.frameSize.staticArgc()), Registers::ArgReg1);
             masm.fallibleVMCall(cx->typeInferenceEnabled(),
-                                compilePtr, f.regs.pc, f.regs.inlined(), NULL,
-                                ic.frameSize.staticLocalSlots());
+                                compilePtr, f.regs.pc, &inlined, ic.frameSize.staticLocalSlots());
         } else {
             masm.load32(FrameAddress(offsetof(VMFrame, u.call.dynamicArgc)), Registers::ArgReg1);
             masm.fallibleVMCall(cx->typeInferenceEnabled(),
-                                compilePtr, f.regs.pc, f.regs.inlined(), NULL, -1);
+                                compilePtr, f.regs.pc, &inlined, -1);
         }
 
         Jump notCompiled = masm.branchTestPtr(Assembler::Zero, Registers::ReturnReg,
@@ -829,6 +717,11 @@ class CallCompiler : public BaseCompiler
         JaegerSpew(JSpew_PICs, "generated CALL stub %p (%lu bytes)\n", cs.executableAddress(),
                    (unsigned long) masm.size());
 
+        if (f.regs.inlined()) {
+            JSC::LinkBuffer code((uint8 *) cs.executableAddress(), masm.size(), JSC::METHOD_CODE);
+            code.patch(inlined, f.regs.inlined());
+        }
+
         Repatcher repatch(from);
         JSC::CodeLocationJump oolJump = ic.slowPathStart.jumpAtOffset(ic.oolJumpOffset);
         repatch.relink(oolJump, cs);
@@ -965,6 +858,10 @@ class CallCompiler : public BaseCompiler
         if (ic.fastGuardedNative || ic.hasJsFunCheck)
             return true;
 
+        /* Don't generate native MICs within inlined frames, we can't recompile them yet. */
+        if (f.regs.inlined())
+            return true;
+
         /* Native MIC needs to warm up first. */
         if (!ic.hit) {
             ic.hit = true;
@@ -977,29 +874,51 @@ class CallCompiler : public BaseCompiler
         /* Guard on the function object identity, for now. */
         Jump funGuard = masm.branchPtr(Assembler::NotEqual, ic.funObjReg, ImmPtr(obj));
 
-        /*
-         * Write the rejoin state for the recompiler to use if this call
-         * triggers recompilation. Natives use a different stack address to
-         * store the return value than FASTCALLs, and without additional
-         * information we cannot tell which one is active on a VMFrame.
-         */
-        masm.storePtr(ImmPtr((void *) ic.frameSize.rejoinState(f.pc(), true)),
-                      FrameAddress(offsetof(VMFrame, stubRejoin)));
+        if (cx->typeInferenceEnabled()) {
+            /*
+             * Write the rejoin state for the recompiler to use if this call
+             * triggers recompilation. Natives use a different stack address to
+             * store the return value than FASTCALLs, and without additional
+             * information we cannot tell which one is active on a VMFrame.
+             */
+            masm.storePtr(ImmPtr((void *) ic.frameSize.rejoinState(f.pc(), true)),
+                          FrameAddress(offsetof(VMFrame, stubRejoin)));
+        }
 
         /* N.B. After this call, the frame will have a dynamic frame size. */
         if (ic.frameSize.isDynamic()) {
             masm.bumpStubCounter(f.script(), f.pc(), Registers::tempCallReg());
             masm.fallibleVMCall(cx->typeInferenceEnabled(),
                                 JS_FUNC_TO_DATA_PTR(void *, ic::SplatApplyArgs),
-                                f.pc(), NULL, NULL, initialFrameDepth);
+                                f.regs.pc, NULL, initialFrameDepth);
         }
 
-        Registers tempRegs = Registers::tempCallRegMask();
+        Registers tempRegs(Registers::AvailRegs);
+#ifndef JS_CPU_X86
+        tempRegs.takeReg(Registers::ArgReg0);
+        tempRegs.takeReg(Registers::ArgReg1);
+        tempRegs.takeReg(Registers::ArgReg2);
+#endif
         RegisterID t0 = tempRegs.takeAnyReg().reg();
         masm.bumpStubCounter(f.script(), f.pc(), t0);
 
-        int32 storeFrameDepth = ic.frameSize.isStatic() ? initialFrameDepth : -1;
-        masm.setupFallibleABICall(cx->typeInferenceEnabled(), f.pc(), f.regs.inlined(), storeFrameDepth);
+        /* Store pc. */
+        masm.storePtr(ImmPtr(f.regs.pc),
+                      FrameAddress(offsetof(VMFrame, regs.pc)));
+
+        /* Store inlined. */
+        masm.storePtr(ImmPtr(f.regs.inlined()),
+                      FrameAddress(VMFrame::offsetOfInlined));
+
+        /* Store sp (if not already set by ic::SplatApplyArgs). */
+        if (ic.frameSize.isStatic()) {
+            uint32 spOffset = sizeof(StackFrame) + initialFrameDepth * sizeof(Value);
+            masm.addPtr(Imm32(spOffset), JSFrameReg, t0);
+            masm.storePtr(t0, FrameAddress(offsetof(VMFrame, regs.sp)));
+        }
+
+        /* Store fp. */
+        masm.storePtr(JSFrameReg, FrameAddress(VMFrame::offsetOfFp));
 
         /* Grab cx. */
 #ifdef JS_CPU_X86
@@ -1040,7 +959,7 @@ class CallCompiler : public BaseCompiler
         masm.setupABICall(Registers::NormalCall, 3);
         masm.storeArg(2, vpReg);
         if (ic.frameSize.isStatic())
-            masm.storeArg(1, ImmPtr((void *) ic.frameSize.staticArgc()));
+            masm.storeArg(1, Imm32(ic.frameSize.staticArgc()));
         else
             masm.storeArg(1, argcReg.reg());
         masm.storeArg(0, cxReg);
@@ -1058,21 +977,83 @@ class CallCompiler : public BaseCompiler
 
         masm.callWithABI(JS_FUNC_TO_DATA_PTR(void *, native), false);
 
-        NativeStubLinker::FinalJump done;
-        if (!NativeStubEpilogue(f, masm, &done, initialFrameDepth, vpOffset, MaybeRegisterID(), MaybeRegisterID()))
-            return false;
-        NativeStubLinker linker(masm, f.jit(), f.pc(), f.regs.inlined(), done);
-        if (!linker.init(f.cx))
+        /* Reload fp, which may have been clobbered by restoreStackBase(). */
+        masm.loadPtr(FrameAddress(VMFrame::offsetOfFp), JSFrameReg);
+
+        Jump hasException = masm.branchTest32(Assembler::Zero, Registers::ReturnReg,
+                                              Registers::ReturnReg);
+
+        Vector<Jump> mismatches(f.cx);
+        if (cx->typeInferenceEnabled()) {
+            types::AutoEnterTypeInference enter(f.cx);
+
+            /*
+             * Test the result of this native against the known result type
+             * set for the call. We don't assume knowledge about the types that
+             * natives can return, except when generating specialized paths in
+             * FastBuiltins. We don't need to record dependencies on the result
+             * type set, as the compiler will already have done so when making
+             * the call IC.
+             */
+            Address address(JSFrameReg, vpOffset);
+            types::TypeSet *types = f.script()->analysis()->bytecodeTypes(f.pc());
+            if (!masm.generateTypeCheck(f.cx, address, types, &mismatches))
+                THROWV(true);
+
+            /*
+             * Can no longer trigger recompilation in this stub, clear the stub
+             * rejoin on the VMFrame.
+             */
+            masm.storePtr(ImmPtr(NULL), FrameAddress(offsetof(VMFrame, stubRejoin)));
+        }
+
+        /*
+         * The final jump is a indirect on x64, so that we'll always be able
+         * to repatch it to the interpoline later.
+         */
+        Label finished = masm.label();
+#ifdef JS_CPU_X64
+        void *slowJoin = ic.slowPathStart.labelAtOffset(ic.slowJoinOffset).executableAddress();
+        DataLabelPtr done = masm.moveWithPatch(ImmPtr(slowJoin), Registers::ValueReg);
+        masm.jump(Registers::ValueReg);
+#else
+        Jump done = masm.jump();
+#endif
+
+        /* Generate a call for type check failures on the native result. */
+        if (!mismatches.empty()) {
+            for (unsigned i = 0; i < mismatches.length(); i++)
+                mismatches[i].linkTo(masm.label(), &masm);
+            masm.addPtr(Imm32(vpOffset), JSFrameReg, Registers::ArgReg1);
+            masm.fallibleVMCall(true, JS_FUNC_TO_DATA_PTR(void *, stubs::TypeBarrierReturn),
+                                f.regs.pc, NULL, initialFrameDepth);
+            masm.storePtr(ImmPtr(NULL), FrameAddress(offsetof(VMFrame, stubRejoin)));
+            masm.jump().linkTo(finished, &masm);
+        }
+
+        /* Move JaegerThrowpoline into register for very far jump on x64. */
+        hasException.linkTo(masm.label(), &masm);
+        if (cx->typeInferenceEnabled())
+            masm.storePtr(ImmPtr(NULL), FrameAddress(offsetof(VMFrame, stubRejoin)));
+        masm.throwInJIT();
+
+        LinkerHelper linker(masm, JSC::METHOD_CODE);
+        JSC::ExecutablePool *ep = poolForSize(linker, CallICInfo::Pool_NativeStub);
+        if (!ep)
             THROWV(true);
 
+        ic.fastGuardedNative = obj;
+
         if (!linker.verifyRange(jit)) {
             disable(jit);
             return true;
         }
 
-        linker.patchJump(ic.slowPathStart.labelAtOffset(ic.slowJoinOffset));
+        ic.nativeJump = linker.locationOf(done);
 
-        ic.fastGuardedNative = obj;
+#ifndef JS_CPU_X64
+        linker.link(done, ic.slowPathStart.labelAtOffset(ic.slowJoinOffset));
+#endif
 
         linker.link(funGuard, ic.slowPathStart);
         JSC::CodeLocationLabel start = linker.finalize();
@@ -1339,20 +1320,17 @@ ic::GenerateArgumentCheckStub(VMFrame &f)
     Assembler masm;
     Vector<Jump> mismatches(f.cx);
 
-    Registers tempRegs(Registers::AvailRegs);
-    RegisterID scratch = tempRegs.takeAnyReg().reg();
-
     if (!f.fp()->isConstructing()) {
         types::TypeSet *types = types::TypeScript::ThisTypes(script);
         Address address(JSFrameReg, StackFrame::offsetOfThis(fun));
-        if (!masm.generateTypeCheck(f.cx, address, scratch, types, &mismatches))
+        if (!masm.generateTypeCheck(f.cx, address, types, &mismatches))
             return;
     }
 
     for (unsigned i = 0; i < fun->nargs; i++) {
         types::TypeSet *types = types::TypeScript::ArgTypes(script, i);
         Address address(JSFrameReg, StackFrame::offsetOfFormalArg(fun, i));
-        if (!masm.generateTypeCheck(f.cx, address, scratch, types, &mismatches))
+        if (!masm.generateTypeCheck(f.cx, address, types, &mismatches))
             return;
     }
 
@@ -1420,10 +1398,49 @@ JITScript::purgeMICs()
 }
 
 void
-JITScript::sweepCallICs(JSContext *cx)
+ic::PurgeMICs(JSContext *cx, JSScript *script)
+{
+    /* MICs are purged during GC to handle changing shapes. */
+    JS_ASSERT(cx->runtime->gcRegenShapes);
+
+    if (script->jitNormal)
+        script->jitNormal->purgeMICs();
+    if (script->jitCtor)
+        script->jitCtor->purgeMICs();
+}
+
+void
+JITScript::nukeScriptDependentICs()
+{
+    if (!nCallICs)
+        return;
+
+    Repatcher repatcher(this);
+
+    ic::CallICInfo *callICs_ = callICs();
+    for (uint32 i = 0; i < nCallICs; i++) {
+        ic::CallICInfo &ic = callICs_[i];
+        if (!ic.fastGuardedObject)
+            continue;
+        repatcher.repatch(ic.funGuard, NULL);
+        repatcher.relink(ic.funJump, ic.slowPathStart);
+        ic.releasePool(CallICInfo::Pool_ClosureStub);
+        ic.fastGuardedObject = NULL;
+        ic.hasJsFunCheck = false;
+    }
+}
+
+void
+JITScript::sweepCallICs(JSContext *cx, bool purgeAll)
 {
     Repatcher repatcher(this);
 
+    /*
+     * If purgeAll is set, purge stubs in the script except those covered by PurgePICs
+     * (which is always called during GC). We want to remove references which can keep
+     * alive pools that we are trying to destroy (see JSCompartment::sweep).
+     */
+
     ic::CallICInfo *callICs_ = callICs();
     for (uint32 i = 0; i < nCallICs; i++) {
         ic::CallICInfo &ic = callICs_[i];
@@ -1434,19 +1451,20 @@ JITScript::sweepCallICs(JSContext *cx)
          * precisely GC call ICs while keeping the identity guard safe.
          */
         bool fastFunDead = ic.fastGuardedObject &&
-            IsAboutToBeFinalized(cx, ic.fastGuardedObject);
+            (purgeAll || IsAboutToBeFinalized(cx, ic.fastGuardedObject));
         bool nativeDead = ic.fastGuardedNative &&
-            IsAboutToBeFinalized(cx, ic.fastGuardedNative);
+            (purgeAll || IsAboutToBeFinalized(cx, ic.fastGuardedNative));
 
         /*
-         * There are two conditions where we need to relink:
-         * (1) The native is dead, since it always has a stub.
-         * (2) The fastFun is dead *and* there is a closure stub.
+         * There are three conditions where we need to relink:
+         * (1) purgeAll is true.
+         * (2) The native is dead, since it always has a stub.
+         * (3) The fastFun is dead *and* there is a closure stub.
          *
          * Note although both objects can be non-NULL, there can only be one
          * of [closure, native] stub per call IC.
          */
-        if (nativeDead || (fastFunDead && ic.hasJsFunCheck)) {
+        if (purgeAll || nativeDead || (fastFunDead && ic.hasJsFunCheck)) {
             repatcher.relink(ic.funJump, ic.slowPathStart);
             ic.hit = false;
         }
@@ -1456,13 +1474,65 @@ JITScript::sweepCallICs(JSContext *cx)
             ic.purgeGuardedObject();
         }
 
-        if (nativeDead)
+        if (nativeDead) {
+            ic.releasePool(CallICInfo::Pool_NativeStub);
             ic.fastGuardedNative = NULL;
+        }
+
+        if (purgeAll) {
+            ic.releasePool(CallICInfo::Pool_ScriptStub);
+            JSC::CodeLocationJump oolJump = ic.slowPathStart.jumpAtOffset(ic.oolJumpOffset);
+            JSC::CodeLocationLabel icCall = ic.slowPathStart.labelAtOffset(ic.icCallOffset);
+            repatcher.relink(oolJump, icCall);
+        }
     }
 
     /* The arguments type check IC can refer to type objects which might be swept. */
     if (argsCheckPool)
         resetArgsCheck();
+
+    if (purgeAll) {
+        /* Purge ICs generating stubs into execPools. */
+        uint32 released = 0;
+
+        ic::EqualityICInfo *equalityICs_ = equalityICs();
+        for (uint32 i = 0; i < nEqualityICs; i++) {
+            ic::EqualityICInfo &ic = equalityICs_[i];
+            if (!ic.generated)
+                continue;
+
+            JSC::FunctionPtr fptr(JS_FUNC_TO_DATA_PTR(void *, ic::Equality));
+            repatcher.relink(ic.stubCall, fptr);
+            repatcher.relink(ic.jumpToStub, ic.stubEntry);
+
+            ic.generated = false;
+            released++;
+        }
+
+        ic::SetGlobalNameIC *setGlobalNames_ = setGlobalNames();
+        for (uint32 i = 0; i < nSetGlobalNames; i ++) {
+            ic::SetGlobalNameIC &ic = setGlobalNames_[i];
+            if (!ic.hasExtraStub)
+                continue;
+            repatcher.relink(ic.fastPathStart.jumpAtOffset(ic.inlineShapeJump), ic.slowPathStart);
+            ic.hasExtraStub = false;
+            released++;
+        }
+
+        JS_ASSERT(released == execPools.length());
+        for (uint32 i = 0; i < released; i++)
+            execPools[i]->release();
+        execPools.clear();
+    }
+}
+
+void
+ic::SweepCallICs(JSContext *cx, JSScript *script, bool purgeAll)
+{
+    if (script->jitNormal)
+        script->jitNormal->sweepCallICs(cx, purgeAll);
+    if (script->jitCtor)
+        script->jitCtor->sweepCallICs(cx, purgeAll);
 }
 
 #endif /* JS_MONOIC */
diff --git a/js/src/methodjit/MonoIC.h b/js/src/methodjit/MonoIC.h
index 7a52db92f097..7043db8b026e 100644
--- a/js/src/methodjit/MonoIC.h
+++ b/js/src/methodjit/MonoIC.h
@@ -216,6 +216,7 @@ struct CallICInfo {
     enum PoolIndex {
         Pool_ScriptStub,
         Pool_ClosureStub,
+        Pool_NativeStub,
         Total_Pools
     };
 
@@ -239,6 +240,17 @@ struct CallICInfo {
     /* Inline to OOL jump, redirected by stubs. */
     JSC::CodeLocationJump funJump;
 
+    /*
+     * Native stub fallthrough jump which may be patched during recompilation.
+     * On x64 this is an indirect jump to avoid issues with far jumps on
+     * relative branches.
+     */
+#ifdef JS_CPU_X64
+    JSC::CodeLocationDataLabelPtr nativeJump;
+#else
+    JSC::CodeLocationJump nativeJump;
+#endif
+
     /* Offset to inline scripted call, from funGuard. */
     uint32 hotJumpOffset   : 16;
     uint32 joinPointOffset : 16;
@@ -269,12 +281,13 @@ struct CallICInfo {
         fastGuardedNative = NULL;
         hit = false;
         hasJsFunCheck = false;
-        PodArrayZero(pools);
+        pools[0] = pools[1] = pools[2] = NULL;
     }
 
     inline void releasePools() {
         releasePool(Pool_ScriptStub);
         releasePool(Pool_ClosureStub);
+        releasePool(Pool_NativeStub);
     }
 
     inline void releasePool(PoolIndex index) {
@@ -291,8 +304,6 @@ struct CallICInfo {
         fastGuardedObject = NULL;
         JS_REMOVE_LINK(&links);
     }
-
-    void purge();
 };
 
 void * JS_FASTCALL New(VMFrame &f, ic::CallICInfo *ic);
@@ -303,6 +314,9 @@ JSBool JS_FASTCALL SplatApplyArgs(VMFrame &f);
 
 void GenerateArgumentCheckStub(VMFrame &f);
 
+void PurgeMICs(JSContext *cx, JSScript *script);
+void SweepCallICs(JSContext *cx, JSScript *script, bool purgeAll);
+
 } /* namespace ic */
 } /* namespace mjit */
 } /* namespace js */
diff --git a/js/src/methodjit/PolyIC.cpp b/js/src/methodjit/PolyIC.cpp
index 8c38da5955ae..63363d828815 100644
--- a/js/src/methodjit/PolyIC.cpp
+++ b/js/src/methodjit/PolyIC.cpp
@@ -151,11 +151,9 @@ class PICStubCompiler : public BaseCompiler
     uint32 gcNumber;
 
   public:
-    bool canCallHook;
-
     PICStubCompiler(const char *type, VMFrame &f, JSScript *script, ic::PICInfo &pic, void *stub)
       : BaseCompiler(f.cx), type(type), f(f), script(script), pic(pic), stub(stub),
-        gcNumber(f.cx->runtime->gcNumber), canCallHook(pic.canCallHook)
+        gcNumber(f.cx->runtime->gcNumber)
     { }
 
     bool isCallOp() const {
@@ -804,17 +802,10 @@ struct GetPropertyHelper {
 
     LookupStatus testForGet() {
         if (!shape->hasDefaultGetter()) {
-            if (shape->isMethod()) {
-                if (!ic.isCallOp())
-                    return ic.disable(cx, "method valued shape");
-            } else {
-                if (shape->hasGetterValue())
-                    return ic.disable(cx, "getter value shape");
-                if (shape->hasSlot() && holder != obj)
-                    return ic.disable(cx, "slotful getter hook through prototype");
-                if (!ic.canCallHook)
-                    return ic.disable(cx, "can't call getter hook");
-            }
+            if (!shape->isMethod())
+                return ic.disable(cx, "getter");
+            if (!ic.isCallOp())
+                return ic.disable(cx, "method valued shape");
         } else if (!shape->hasSlot()) {
             return ic.disable(cx, "no slot");
         }
@@ -1012,8 +1003,6 @@ class GetPropCompiler : public PICStubCompiler
             return status;
         if (getprop.obj != getprop.holder)
             return disable("proto walk on String.prototype");
-        if (!getprop.shape->hasDefaultGetterOrIsMethod())
-            return disable("getter hook on String.prototype");
         if (hadGC())
             return Lookup_Uncacheable;
 
@@ -1155,91 +1144,6 @@ class GetPropCompiler : public PICStubCompiler
         return Lookup_Cacheable;
     }
 
-    void generateGetterStub(Assembler &masm, const Shape *shape,
-                            Label start, const Vector<Jump, 8> &shapeMismatches)
-    {
-        /*
-         * Getter hook needs to be called from the stub. The state is fully
-         * synced and no registers are live except the result registers.
-         */
-        JS_ASSERT(pic.canCallHook);
-        PropertyOp getter = shape->getterOp();
-
-        masm.storePtr(ImmPtr((void *) REJOIN_NATIVE_GETTER),
-                      FrameAddress(offsetof(VMFrame, stubRejoin)));
-
-        Registers tempRegs = Registers::tempCallRegMask();
-        if (tempRegs.hasReg(Registers::ClobberInCall))
-            tempRegs.takeReg(Registers::ClobberInCall);
-
-        /* Get a register to hold obj while we set up the rest of the frame. */
-        RegisterID holdObjReg = pic.objReg;
-        if (tempRegs.hasReg(pic.objReg)) {
-            tempRegs.takeReg(pic.objReg);
-        } else {
-            holdObjReg = tempRegs.takeAnyReg().reg();
-            masm.move(pic.objReg, holdObjReg);
-        }
-
-        RegisterID t0 = tempRegs.takeAnyReg().reg();
-        masm.bumpStubCounter(f.script(), f.pc(), t0);
-
-        /*
-         * Initialize vp, which is either a slot in the object (the holder,
-         * actually, which must equal the object here) or undefined.
-         * Use vp == sp (which for CALLPROP will actually be the original
-         * sp + 1), to avoid clobbering stack values.
-         */
-        int32 vpOffset = (char *) f.regs.sp - (char *) f.fp();
-        if (shape->hasSlot()) {
-            masm.loadObjProp(obj, holdObjReg, shape,
-                             Registers::ClobberInCall, t0);
-            masm.storeValueFromComponents(Registers::ClobberInCall, t0, Address(JSFrameReg, vpOffset));
-        } else {
-            masm.storeValue(UndefinedValue(), Address(JSFrameReg, vpOffset));
-        }
-
-        int32 initialFrameDepth = f.regs.sp - f.fp()->slots();
-        masm.setupFallibleABICall(cx->typeInferenceEnabled(), f.pc(), f.regs.inlined(), initialFrameDepth);
-
-        /* Grab cx. */
-#ifdef JS_CPU_X86
-        RegisterID cxReg = tempRegs.takeAnyReg().reg();
-#else
-        RegisterID cxReg = Registers::ArgReg0;
-#endif
-        masm.loadPtr(FrameAddress(offsetof(VMFrame, cx)), cxReg);
-
-        /* Grap vp. */
-        RegisterID vpReg = t0;
-        masm.addPtr(Imm32(vpOffset), JSFrameReg, vpReg);
-
-        masm.restoreStackBase();
-        masm.setupABICall(Registers::NormalCall, 4);
-        masm.storeArg(3, vpReg);
-        masm.storeArg(2, ImmPtr((void *) JSID_BITS(SHAPE_USERID(shape))));
-        masm.storeArg(1, holdObjReg);
-        masm.storeArg(0, cxReg);
-
-        masm.callWithABI(JS_FUNC_TO_DATA_PTR(void *, getter), false);
-
-        NativeStubLinker::FinalJump done;
-        if (!NativeStubEpilogue(f, masm, &done, 0, vpOffset, pic.shapeReg, pic.objReg))
-            return;
-        NativeStubLinker linker(masm, f.jit(), f.pc(), f.regs.inlined(), done);
-        if (!linker.init(f.cx))
-            THROW();
-
-        if (!linker.verifyRange(f.jit())) {
-            disable("code memory is out of range");
-            return;
-        }
-
-        linker.patchJump(pic.fastPathRejoin);
-
-        linkerEpilogue(linker, start, shapeMismatches);
-    }
-
     LookupStatus generateStub(JSObject *holder, const Shape *shape)
     {
         Vector<Jump, 8> shapeMismatches(cx);
@@ -1294,13 +1198,6 @@ class GetPropCompiler : public PICStubCompiler
             pic.secondShapeGuard = 0;
         }
 
-        if (!shape->hasDefaultGetterOrIsMethod()) {
-            generateGetterStub(masm, shape, start, shapeMismatches);
-            if (setStubShapeOffset)
-                pic.getPropLabels().setStubShapeJump(masm, start, stubShapeJumpLabel);
-            return Lookup_Cacheable;
-        }
-
         /* Load the value out of the object. */
         masm.loadObjProp(holder, holderReg, shape, pic.shapeReg, pic.objReg);
         Jump done = masm.jump();
@@ -1316,22 +1213,12 @@ class GetPropCompiler : public PICStubCompiler
             return disable("code memory is out of range");
         }
 
-        // The final exit jumps to the store-back in the inline stub.
-        buffer.link(done, pic.fastPathRejoin);
-
-        linkerEpilogue(buffer, start, shapeMismatches);
-
-        if (setStubShapeOffset)
-            pic.getPropLabels().setStubShapeJump(masm, start, stubShapeJumpLabel);
-        return Lookup_Cacheable;
-    }
-
-    void linkerEpilogue(LinkerHelper &buffer, Label start, const Vector<Jump, 8> &shapeMismatches)
-    {
         // The guard exit jumps to the original slow case.
         for (Jump *pj = shapeMismatches.begin(); pj != shapeMismatches.end(); ++pj)
             buffer.link(*pj, pic.slowPathStart);
 
+        // The final exit jumps to the store-back in the inline stub.
+        buffer.link(done, pic.fastPathRejoin);
         CodeLocationLabel cs = buffer.finalize();
         JaegerSpew(JSpew_PICs, "generated %s stub at %p\n", type, cs.executableAddress());
 
@@ -1340,10 +1227,15 @@ class GetPropCompiler : public PICStubCompiler
         pic.stubsGenerated++;
         pic.updateLastPath(buffer, start);
 
+        if (setStubShapeOffset)
+            pic.getPropLabels().setStubShapeJump(masm, start, stubShapeJumpLabel);
+
         if (pic.stubsGenerated == MAX_PIC_STUBS)
             disable("max stubs reached");
         if (obj->isDenseArray())
             disable("dense array");
+
+        return Lookup_Cacheable;
     }
 
     void patchPreviousToHere(CodeLocationLabel cs)
@@ -1359,14 +1251,8 @@ class GetPropCompiler : public PICStubCompiler
             shapeGuardJumpOffset = pic.getPropLabels().getStubShapeJumpOffset();
         else
             shapeGuardJumpOffset = pic.shapeGuard + pic.getPropLabels().getInlineShapeJumpOffset();
-        int secondGuardOffset = getLastStubSecondShapeGuard();
-
-        JaegerSpew(JSpew_PICs, "Patching previous (%d stubs) (start %p) (offset %d) (second %d)\n",
-                   (int) pic.stubsGenerated, label.executableAddress(),
-                   shapeGuardJumpOffset, secondGuardOffset);
-
         repatcher.relink(label.jumpAtOffset(shapeGuardJumpOffset), cs);
-        if (secondGuardOffset)
+        if (int secondGuardOffset = getLastStubSecondShapeGuard())
             repatcher.relink(label.jumpAtOffset(secondGuardOffset), cs);
     }
 
@@ -1381,11 +1267,8 @@ class GetPropCompiler : public PICStubCompiler
         if (hadGC())
             return Lookup_Uncacheable;
 
-        if (obj == getprop.holder &&
-            getprop.shape->hasDefaultGetterOrIsMethod() &&
-            !pic.inlinePathPatched) {
+        if (obj == getprop.holder && !pic.inlinePathPatched)
             return patchInline(getprop.holder, getprop.shape);
-        }
 
         return generateStub(getprop.holder, getprop.shape);
     }
@@ -1936,9 +1819,11 @@ ic::GetProp(VMFrame &f, ic::PICInfo *pic)
                 THROW();
             JSString *str = f.regs.sp[-1].toString();
             f.regs.sp[-1].setInt32(str->length());
+            types::TypeScript::Monitor(f.cx, f.script(), f.pc(), f.regs.sp[-1]);
             return;
         } else if (f.regs.sp[-1].isMagic(JS_LAZY_ARGUMENTS)) {
             f.regs.sp[-1].setInt32(f.regs.fp()->numActualArgs());
+            types::TypeScript::Monitor(f.cx, f.script(), f.pc(), f.regs.sp[-1]);
             return;
         } else if (!f.regs.sp[-1].isPrimitive()) {
             JSObject *obj = &f.regs.sp[-1].toObject();
@@ -1963,12 +1848,15 @@ ic::GetProp(VMFrame &f, ic::PICInfo *pic)
                     JSString *str = obj->getPrimitiveThis().toString();
                     f.regs.sp[-1].setInt32(str->length());
                 }
+                types::TypeScript::Monitor(f.cx, f.script(), f.pc(), f.regs.sp[-1]);
                 return;
             }
         }
         atom = f.cx->runtime->atomState.lengthAtom;
     }
 
+    bool usePropCache = pic->usePropCache;
+
     /*
      * ValueToObject can trigger recompilations if it lazily initializes any
      * of the primitive classes (Boolean, Number, String). :XXX: if these
@@ -1995,6 +1883,16 @@ ic::GetProp(VMFrame &f, ic::PICInfo *pic)
     if (!obj->getProperty(f.cx, ATOM_TO_JSID(atom), &v))
         THROW();
 
+    /*
+     * Ignore undefined reads for the 'prototype' property in constructors,
+     * which will be at the start of the script and are never holes due to fun_resolve.
+     * Any undefined value was explicitly stored here, and is known by inference.
+     * :FIXME: looking under the usePropCache abstraction, which is only unset for
+     * reads of the prototype.
+     */
+    if (usePropCache)
+        types::TypeScript::Monitor(f.cx, f.script(), f.pc(), v);
+
     f.regs.sp[-1] = v;
 }
 
@@ -2119,11 +2017,6 @@ ic::CallProp(VMFrame &f, ic::PICInfo *pic)
             NATIVE_GET(cx, &objv.toObject(), obj2, shape, JSGET_NO_METHOD_BARRIER, &rval,
                        THROW());
         }
-        /*
-         * Adjust the stack to reflect the height after the GETPROP, here and
-         * below. Getter hook ICs depend on this to know which value of sp they
-         * are updating for consistent rejoins, don't modify this!
-         */
         regs.sp++;
         regs.sp[-2] = rval;
         regs.sp[-1] = lval;
@@ -2164,6 +2057,8 @@ ic::CallProp(VMFrame &f, ic::PICInfo *pic)
     }
 #endif
 
+    types::TypeScript::Monitor(f.cx, f.script(), f.pc(), regs.sp[-2]);
+
     if (monitor.recompiled())
         return;
 
@@ -2213,6 +2108,8 @@ ic::XName(VMFrame &f, ic::PICInfo *pic)
     if (!cc.retrieve(&rval, NULL, PICInfo::XNAME))
         THROW();
     f.regs.sp[-1] = rval;
+
+    types::TypeScript::Monitor(f.cx, f.script(), f.pc(), rval);
 }
 
 void JS_FASTCALL
@@ -2230,6 +2127,8 @@ ic::Name(VMFrame &f, ic::PICInfo *pic)
     if (!cc.retrieve(&rval, NULL, PICInfo::NAME))
         THROW();
     f.regs.sp[0] = rval;
+
+    types::TypeScript::Monitor(f.cx, f.script(), f.pc(), rval);
 }
 
 static void JS_FASTCALL
@@ -2255,6 +2154,8 @@ ic::CallName(VMFrame &f, ic::PICInfo *pic)
 
     f.regs.sp[0] = rval;
     f.regs.sp[1] = thisval;
+
+    types::TypeScript::Monitor(f.cx, f.script(), f.pc(), rval);
 }
 
 static void JS_FASTCALL
@@ -2431,12 +2332,6 @@ GetElementIC::attachGetProp(VMFrame &f, JSContext *cx, JSObject *obj, const Valu
     if (status != Lookup_Cacheable)
         return status;
 
-    // With TI enabled, string property stubs can only be added to an opcode if
-    // the value read will go through a type barrier afterwards. TI only
-    // accounts for integer-valued properties accessed by GETELEM/CALLELEM.
-    if (cx->typeInferenceEnabled() && !forcedTypeBarrier)
-        return disable(cx, "string element access may not have type barrier");
-
     Assembler masm;
 
     // Guard on the string's type and identity.
@@ -2900,6 +2795,9 @@ ic::CallElement(VMFrame &f, ic::GetElementIC *ic)
             // If the result can be cached, the value was already retrieved.
             JS_ASSERT(!f.regs.sp[-2].isMagic());
             f.regs.sp[-1].setObject(*thisObj);
+            if (!JSID_IS_INT(id))
+                types::TypeScript::MonitorUnknown(f.cx, f.script(), f.pc());
+            types::TypeScript::Monitor(f.cx, f.script(), f.pc(), f.regs.sp[-2]);
             return;
         }
     }
@@ -2919,6 +2817,9 @@ ic::CallElement(VMFrame &f, ic::GetElementIC *ic)
     {
         f.regs.sp[-1] = thisv;
     }
+    if (!JSID_IS_INT(id))
+        types::TypeScript::MonitorUnknown(f.cx, f.script(), f.pc());
+    types::TypeScript::Monitor(f.cx, f.script(), f.pc(), f.regs.sp[-2]);
 }
 
 void JS_FASTCALL
@@ -2960,12 +2861,18 @@ ic::GetElement(VMFrame &f, ic::GetElementIC *ic)
 
             // If the result can be cached, the value was already retrieved.
             JS_ASSERT(!f.regs.sp[-2].isMagic());
+            if (!JSID_IS_INT(id))
+                types::TypeScript::MonitorUnknown(f.cx, f.script(), f.pc());
+            types::TypeScript::Monitor(f.cx, f.script(), f.pc(), f.regs.sp[-2]);
             return;
         }
     }
 
     if (!obj->getProperty(cx, id, &f.regs.sp[-2]))
         THROW();
+    if (!JSID_IS_INT(id))
+        types::TypeScript::MonitorUnknown(f.cx, f.script(), f.pc());
+    types::TypeScript::Monitor(f.cx, f.script(), f.pc(), f.regs.sp[-2]);
 }
 
 #define APPLY_STRICTNESS(f, s)                          \
@@ -3232,25 +3139,6 @@ ic::SetElement(VMFrame &f, ic::SetElementIC *ic)
 template void JS_FASTCALL ic::SetElement<true>(VMFrame &f, SetElementIC *ic);
 template void JS_FASTCALL ic::SetElement<false>(VMFrame &f, SetElementIC *ic);
 
-void
-JITScript::purgeGetterPICs()
-{
-    Repatcher repatcher(this);
-    PICInfo *pics_ = pics();
-    for (uint32 i = 0; i < nPICs; i++) {
-        PICInfo &pic = pics_[i];
-        switch (pic.kind) {
-          case PICInfo::CALL: /* fall-through */
-          case PICInfo::GET:
-            GetPropCompiler::reset(repatcher, pic);
-            pic.reset();
-            break;
-          default:
-            break;
-        }
-    }
-}
-
 void
 JITScript::purgePICs()
 {
@@ -3294,5 +3182,14 @@ JITScript::purgePICs()
         setElems_[i].purge(repatcher);
 }
 
+void
+ic::PurgePICs(JSContext *cx, JSScript *script)
+{
+    if (script->jitNormal)
+        script->jitNormal->purgePICs();
+    if (script->jitCtor)
+        script->jitCtor->purgePICs();
+}
+
 #endif /* JS_POLYIC */
 
diff --git a/js/src/methodjit/PolyIC.h b/js/src/methodjit/PolyIC.h
index 23bb702d513c..ebe2b20a83e4 100644
--- a/js/src/methodjit/PolyIC.h
+++ b/js/src/methodjit/PolyIC.h
@@ -93,12 +93,6 @@ struct BaseIC : public MacroAssemblerTypedefs {
     bool hit : 1;
     bool slowCallPatched : 1;
 
-    // Whether getter/setter hooks can be called from IC stubs.
-    bool canCallHook : 1;
-
-    // Whether a type barrier is in place for the result of the op.
-    bool forcedTypeBarrier : 1;
-
     // Number of stubs generated.
     uint32 stubsGenerated : 5;
 
@@ -108,7 +102,6 @@ struct BaseIC : public MacroAssemblerTypedefs {
     void reset() {
         hit = false;
         slowCallPatched = false;
-        forcedTypeBarrier = false;
         stubsGenerated = 0;
         secondShapeGuard = 0;
     }
@@ -558,6 +551,7 @@ struct PICInfo : public BasePolyIC {
 };
 
 #ifdef JS_POLYIC
+void PurgePICs(JSContext *cx, JSScript *script);
 void JS_FASTCALL GetProp(VMFrame &f, ic::PICInfo *);
 void JS_FASTCALL GetPropNoCache(VMFrame &f, ic::PICInfo *);
 void JS_FASTCALL SetProp(VMFrame &f, ic::PICInfo *);
diff --git a/js/src/methodjit/Retcon.cpp b/js/src/methodjit/Retcon.cpp
index 90eae9e31e08..6827b1d711b0 100644
--- a/js/src/methodjit/Retcon.cpp
+++ b/js/src/methodjit/Retcon.cpp
@@ -100,20 +100,6 @@ SetRejoinState(StackFrame *fp, const CallSite &site, void **location)
     }
 }
 
-static inline bool
-CallsiteMatches(uint8 *codeStart, const CallSite &site, void *location)
-{
-    if (codeStart + site.codeOffset == location)
-        return true;
-
-#ifdef JS_CPU_ARM
-    if (codeStart + site.codeOffset + 4 == location)
-        return true;
-#endif
-
-    return false;
-}
-
 void
 Recompiler::patchCall(JITScript *jit, StackFrame *fp, void **location)
 {
@@ -121,7 +107,7 @@ Recompiler::patchCall(JITScript *jit, StackFrame *fp, void **location)
 
     CallSite *callSites_ = jit->callSites();
     for (uint32 i = 0; i < jit->nCallSites; i++) {
-        if (CallsiteMatches(codeStart, callSites_[i], *location)) {
+        if (callSites_[i].codeOffset + codeStart == *location) {
             JS_ASSERT(callSites_[i].inlineIndex == analyze::CrossScriptSSA::OUTER_FRAME);
             SetRejoinState(fp, callSites_[i], location);
             return;
@@ -136,73 +122,68 @@ Recompiler::patchNative(JSCompartment *compartment, JITScript *jit, StackFrame *
                         jsbytecode *pc, CallSite *inlined, RejoinState rejoin)
 {
     /*
-     * There is a native call or getter IC at pc which triggered recompilation.
-     * The recompilation could have been triggered either by the native call
-     * itself, or by a SplatApplyArgs preparing for the native call. Either
-     * way, we don't want to patch up the call, but will instead steal the pool
-     * for the IC so it doesn't get freed with the JITScript, and patch up the
-     * jump at the end to go to the interpoline.
+     * There is a native IC at pc which triggered a recompilation. The recompilation
+     * could have been triggered either by the native call itself, or by a SplatApplyArgs
+     * preparing for the native call. Either way, we don't want to patch up the call,
+     * but will instead steal the pool for the native IC so it doesn't get freed
+     * with the old script, and patch up the jump at the end to go to the interpoline.
      */
     fp->setRejoin(StubRejoin(rejoin));
 
     /* :XXX: We might crash later if this fails. */
     compartment->jaegerCompartment()->orphanedNativeFrames.append(fp);
 
-    DebugOnly<bool> found = false;
-
-    /*
-     * Find and patch all native call stubs attached to the given PC. There may
-     * be multiple ones for getter stubs attached to e.g. a GETELEM.
-     */
-    for (unsigned i = 0; i < jit->nativeCallStubs.length(); i++) {
-        NativeCallStub &stub = jit->nativeCallStubs[i];
-        if (stub.pc != pc || stub.inlined != inlined)
-            continue;
-
-        found = true;
-
-        /* Check for pools that were already patched. */
-        if (!stub.pool)
-            continue;
-
-        /* Patch the native fallthrough to go to the interpoline. */
-        {
-#if (defined(JS_NO_FASTCALL) && defined(JS_CPU_X86)) || defined(_WIN64)
-            /* Win64 needs stack adjustment */
-            void *interpoline = JS_FUNC_TO_DATA_PTR(void *, JaegerInterpolinePatched);
-#else
-            void *interpoline = JS_FUNC_TO_DATA_PTR(void *, JaegerInterpoline);
-#endif
-            uint8 *start = (uint8 *)stub.jump.executableAddress();
-            JSC::RepatchBuffer repatch(JSC::JITCode(start - 32, 64));
-#ifdef JS_CPU_X64
-            repatch.repatch(stub.jump, interpoline);
-#else
-            repatch.relink(stub.jump, JSC::CodeLocationLabel(interpoline));
-#endif
+    unsigned i;
+    ic::CallICInfo *callICs = jit->callICs();
+    for (i = 0; i < jit->nCallICs; i++) {
+        CallSite *call = callICs[i].call;
+        if (inlined) {
+            /*
+             * The IC and regs.inlined will have two different call sites for
+             * the same point in the script. The IC site refers to the scripted
+             * return and regs.inlined has the prologue site (which was in use
+             * when the native stub was generated.
+             */
+            if (call->inlineIndex == inlined->inlineIndex && call->pcOffset == inlined->pcOffset)
+                break;
+        } else if (call->inlineIndex == uint32(-1) &&
+                   call->pcOffset == uint32(pc - jit->script->code)) {
+            break;
         }
+    }
+    JS_ASSERT(i < jit->nCallICs);
+    ic::CallICInfo &ic = callICs[i];
+    JS_ASSERT(ic.fastGuardedNative);
 
-        /* :XXX: We leak the pool if this fails. Oh well. */
-        compartment->jaegerCompartment()->orphanedNativePools.append(stub.pool);
+    JSC::ExecutablePool *&pool = ic.pools[ic::CallICInfo::Pool_NativeStub];
 
-        /* Mark as stolen in case there are multiple calls on the stack. */
-        stub.pool = NULL;
+    if (!pool) {
+        /* Already stole this stub. */
+        return;
     }
 
-    JS_ASSERT(found);
-
-    if (inlined) {
-        /*
-         * Purge all ICs in the script which can make native calls, to make
-         * sure the stolen stub is not reentered. This is only necessary if we
-         * are expanding inline frames, as in other circumstances the jitcode
-         * is about to be discarded.
-         */
-        jit->purgeGetterPICs();
-        ic::CallICInfo *callICs_ = jit->callICs();
-        for (uint32 i = 0; i < jit->nCallICs; i++)
-            callICs_[i].purge();
+    /* Patch the native fallthrough to go to the interpoline. */
+    {
+#if (defined(JS_NO_FASTCALL) && defined(JS_CPU_X86)) || defined(_WIN64)
+        /* Win64 needs stack adjustment */
+        void *interpoline = JS_FUNC_TO_DATA_PTR(void *, JaegerInterpolinePatched);
+#else
+        void *interpoline = JS_FUNC_TO_DATA_PTR(void *, JaegerInterpoline);
+#endif
+        uint8 *start = (uint8 *)ic.nativeJump.executableAddress();
+        JSC::RepatchBuffer repatch(JSC::JITCode(start - 32, 64));
+#ifdef JS_CPU_X64
+        repatch.repatch(ic.nativeJump, interpoline);
+#else
+        repatch.relink(ic.nativeJump, JSC::CodeLocationLabel(interpoline));
+#endif
     }
+
+    /* :XXX: We leak the pool if this fails. Oh well. */
+    compartment->jaegerCompartment()->orphanedNativePools.append(pool);
+
+    /* Mark as stolen in case there are multiple calls on the stack. */
+    pool = NULL;
 }
 
 void
@@ -214,16 +195,15 @@ Recompiler::patchFrame(JSCompartment *compartment, VMFrame *f, JSScript *script)
      * where the call occurred, irregardless of any frames which were pushed
      * inside the call.
      */
-    JS_ASSERT(!f->regs.inlined());
     StackFrame *fp = f->fp();
     void **addr = f->returnAddressLocation();
     RejoinState rejoin = (RejoinState) f->stubRejoin;
     if (rejoin == REJOIN_NATIVE ||
-        rejoin == REJOIN_NATIVE_LOWERED ||
-        rejoin == REJOIN_NATIVE_GETTER) {
+        rejoin == REJOIN_NATIVE_LOWERED) {
         /* Native call. */
         if (fp->script() == script) {
-            patchNative(compartment, fp->jit(), fp, f->regs.pc, NULL, rejoin);
+            patchNative(compartment, fp->jit(), fp,
+                        f->regs.pc, NULL, rejoin);
             f->stubRejoin = REJOIN_NATIVE_PATCHED;
         }
     } else if (rejoin == REJOIN_NATIVE_PATCHED) {
@@ -312,22 +292,15 @@ Recompiler::expandInlineFrames(JSCompartment *compartment,
 
     /* Check if the VMFrame returns into the inlined frame. */
     if (f->stubRejoin && f->fp() == fp) {
-        RejoinState rejoin = (RejoinState) f->stubRejoin;
-        JS_ASSERT(rejoin != REJOIN_NATIVE_PATCHED);
-        if (rejoin == REJOIN_NATIVE ||
-            rejoin == REJOIN_NATIVE_LOWERED ||
-            rejoin == REJOIN_NATIVE_GETTER) {
-            /* The VMFrame is calling a native. */
-            patchNative(compartment, fp->jit(), innerfp, innerpc, inlined, rejoin);
-            f->stubRejoin = REJOIN_NATIVE_PATCHED;
-        } else {
-            /* The VMFrame is calling CompileFunction. */
-            innerfp->setRejoin(StubRejoin(rejoin));
-            *frameAddr = JS_FUNC_TO_DATA_PTR(void *, JaegerInterpoline);
-            f->stubRejoin = 0;
-        }
+        /* The VMFrame is calling CompileFunction. */
+        JS_ASSERT(f->stubRejoin != REJOIN_NATIVE &&
+                  f->stubRejoin != REJOIN_NATIVE_LOWERED &&
+                  f->stubRejoin != REJOIN_NATIVE_PATCHED);
+        innerfp->setRejoin(StubRejoin((RejoinState) f->stubRejoin));
+        *frameAddr = JS_FUNC_TO_DATA_PTR(void *, JaegerInterpoline);
+        f->stubRejoin = 0;
     }
-    if (CallsiteMatches(codeStart, *inlined, *frameAddr)) {
+    if (*frameAddr == codeStart + inlined->codeOffset) {
         /* The VMFrame returns directly into the expanded frame. */
         SetRejoinState(innerfp, *inlined, frameAddr);
     }
@@ -524,7 +497,12 @@ Recompiler::cleanup(JITScript *jit)
         JS_STATIC_ASSERT(offsetof(ic::CallICInfo, links) == 0);
         ic::CallICInfo *ic = (ic::CallICInfo *) jit->callers.next;
 
-        ic->purge();
+        uint8 *start = (uint8 *)ic->funGuard.executableAddress();
+        JSC::RepatchBuffer repatch(JSC::JITCode(start - 32, 64));
+
+        repatch.repatch(ic->funGuard, NULL);
+        repatch.relink(ic->funJump, ic->slowPathStart);
+        ic->purgeGuardedObject();
     }
 }
 
diff --git a/js/src/methodjit/Retcon.h b/js/src/methodjit/Retcon.h
index e2f20004a4c0..a9faa1153e31 100644
--- a/js/src/methodjit/Retcon.h
+++ b/js/src/methodjit/Retcon.h
@@ -100,7 +100,7 @@ private:
 
     static void patchCall(JITScript *jit, StackFrame *fp, void **location);
     static void patchNative(JSCompartment *compartment, JITScript *jit, StackFrame *fp,
-                            jsbytecode *pc, CallSite *inlined, RejoinState rejoin);
+                            jsbytecode *pc, CallSite *inline_, RejoinState rejoin);
 
     static StackFrame *
     expandInlineFrameChain(StackFrame *outer, InlineFrame *inner);
diff --git a/js/src/methodjit/StubCalls.cpp b/js/src/methodjit/StubCalls.cpp
index 6a30c9a2c535..bd7dfeeb6a36 100644
--- a/js/src/methodjit/StubCalls.cpp
+++ b/js/src/methodjit/StubCalls.cpp
@@ -375,6 +375,7 @@ NameOp(VMFrame &f, JSObject *obj, bool callname)
             if (op2 == JSOP_TYPEOF) {
                 f.regs.sp++;
                 f.regs.sp[-1].setUndefined();
+                TypeScript::Monitor(cx, f.script(), f.pc(), f.regs.sp[-1]);
                 return obj;
             }
             ReportAtomNotDefined(cx, atom);
@@ -401,6 +402,8 @@ NameOp(VMFrame &f, JSObject *obj, bool callname)
             AddTypePropertyId(cx, obj, id, Type::UndefinedType());
     }
 
+    TypeScript::Monitor(cx, f.script(), f.pc(), rval);
+
     *f.regs.sp++ = rval;
 
     if (callname)
@@ -440,6 +443,7 @@ stubs::GetElem(VMFrame &f)
             if (!str)
                 THROW();
             f.regs.sp[-2].setString(str);
+            TypeScript::Monitor(cx, f.script(), f.pc(), f.regs.sp[-2]);
             return;
         }
     }
@@ -447,6 +451,7 @@ stubs::GetElem(VMFrame &f)
     if (lref.isMagic(JS_LAZY_ARGUMENTS)) {
         if (rref.isInt32() && size_t(rref.toInt32()) < regs.fp()->numActualArgs()) {
             regs.sp[-2] = regs.fp()->canonicalActualArg(rref.toInt32());
+            TypeScript::Monitor(cx, f.script(), f.pc(), regs.sp[-2]);
             return;
         }
         MarkArgumentsCreated(cx, f.script());
@@ -503,8 +508,12 @@ stubs::GetElem(VMFrame &f)
         THROW();
     copyFrom = &rval;
 
+    if (!JSID_IS_INT(id))
+        TypeScript::MonitorUnknown(cx, f.script(), f.pc());
+
   end_getelem:
     f.regs.sp[-2] = *copyFrom;
+    TypeScript::Monitor(cx, f.script(), f.pc(), f.regs.sp[-2]);
 }
 
 static inline bool
@@ -550,6 +559,9 @@ stubs::CallElem(VMFrame &f)
     {
         regs.sp[-1] = thisv;
     }
+    if (!JSID_IS_INT(id))
+        TypeScript::MonitorUnknown(cx, f.script(), f.pc());
+    TypeScript::Monitor(cx, f.script(), f.pc(), regs.sp[-2]);
 }
 
 template<JSBool strict>
@@ -585,12 +597,18 @@ stubs::SetElem(VMFrame &f)
                         break;
                     if ((jsuint)i >= obj->getArrayLength())
                         obj->setArrayLength(cx, i + 1);
+                    /*
+                     * Note: this stub is used for ENUMELEM, so watch out
+                     * before overwriting the op.
+                     */
+                    if (JSOp(*f.pc()) == JSOP_SETELEM)
+                        *f.pc() = JSOP_SETHOLE;
                 }
                 obj->setDenseArrayElementWithType(cx, i, rval);
                 goto end_setelem;
             } else {
-                if (f.script()->hasAnalysis())
-                    f.script()->analysis()->getCode(f.pc()).arrayWriteHole = true;
+                if (JSOp(*f.pc()) == JSOP_SETELEM)
+                    *f.pc() = JSOP_SETHOLE;
             }
         }
     } while (0);
@@ -779,7 +797,6 @@ stubs::DefFun(VMFrame &f, JSFunction *fun)
         obj = CloneFunctionObject(cx, fun, obj2, true);
         if (!obj)
             THROW();
-        JS_ASSERT_IF(f.script()->compileAndGo, obj->getGlobal() == fun->getGlobal());
     }
 
     /*
@@ -1430,8 +1447,6 @@ stubs::DefLocalFun(VMFrame &f, JSFunction *fun)
         }
     }
 
-    JS_ASSERT_IF(f.script()->compileAndGo, obj->getGlobal() == fun->getGlobal());
-
     return obj;
 }
 
@@ -1546,7 +1561,6 @@ stubs::Lambda(VMFrame &f, JSFunction *fun)
     if (!obj)
         THROWV(NULL);
 
-    JS_ASSERT_IF(f.script()->compileAndGo, obj->getGlobal() == fun->getGlobal());
     return obj;
 }
 
@@ -1561,6 +1575,7 @@ InlineGetProp(VMFrame &f)
     if (vp->isMagic(JS_LAZY_ARGUMENTS)) {
         JS_ASSERT(js_GetOpcode(cx, f.script(), f.pc()) == JSOP_LENGTH);
         regs.sp[-1] = Int32Value(regs.fp()->numActualArgs());
+        TypeScript::Monitor(cx, f.script(), f.pc(), regs.sp[-1]);
         return true;
     }
 
@@ -1609,6 +1624,8 @@ InlineGetProp(VMFrame &f)
         }
     } while(0);
 
+    TypeScript::Monitor(cx, f.script(), f.pc(), rval);
+
     regs.sp[-1] = rval;
     return true;
 }
@@ -1727,6 +1744,7 @@ stubs::CallProp(VMFrame &f, JSAtom *origAtom)
             THROW();
     }
 #endif
+    TypeScript::Monitor(cx, f.script(), f.pc(), rval);
 }
 
 void JS_FASTCALL
@@ -2378,19 +2396,6 @@ stubs::TypeBarrierHelper(VMFrame &f, uint32 which)
     TypeScript::Monitor(f.cx, f.script(), f.pc(), result);
 }
 
-void JS_FASTCALL
-stubs::StubTypeHelper(VMFrame &f, int32 which)
-{
-    const Value &result = f.regs.sp[which];
-
-    if (f.script()->hasAnalysis() && f.script()->analysis()->ranInference()) {
-        AutoEnterTypeInference enter(f.cx);
-        f.script()->analysis()->breakTypeBarriers(f.cx, f.pc() - f.script()->code, false);
-    }
-
-    TypeScript::Monitor(f.cx, f.script(), f.pc(), result);
-}
-
 /*
  * Variant of TypeBarrierHelper for checking types after making a native call.
  * The stack is already correct, and no fixup should be performed.
@@ -2408,6 +2413,25 @@ stubs::NegZeroHelper(VMFrame &f)
     TypeScript::MonitorOverflow(f.cx, f.script(), f.pc());
 }
 
+void JS_FASTCALL
+stubs::CallPropSwap(VMFrame &f)
+{
+    /*
+     * CALLPROP operations on strings are implemented in terms of GETPROP.
+     * If we rejoin from such a GETPROP, we come here at the end of the
+     * CALLPROP to fix up the stack. Right now the stack looks like:
+     *
+     * STRING PROP
+     *
+     * We need it to be:
+     *
+     * PROP STRING
+     */
+    Value v = f.regs.sp[-1];
+    f.regs.sp[-1] = f.regs.sp[-2];
+    f.regs.sp[-2] = v;
+}
+
 void JS_FASTCALL
 stubs::CheckArgumentTypes(VMFrame &f)
 {
@@ -2458,34 +2482,6 @@ stubs::AssertArgumentTypes(VMFrame &f)
             TypeFailure(f.cx, "Missing type for arg %d: %s", i, TypeString(type));
     }
 }
-
-void JS_FASTCALL
-stubs::TypeCheckPushed(VMFrame &f)
-{
-    TypeScript::CheckBytecode(f.cx, f.script(), f.pc(), f.regs.sp);
-}
-
-void JS_FASTCALL
-stubs::TypeCheckPopped(VMFrame &f, int32 which)
-{
-    JSScript *script = f.script();
-    jsbytecode *pc = f.pc();
-    if (!script->hasAnalysis() || !script->analysis()->ranInference())
-        return;
-
-    AutoEnterTypeInference enter(f.cx);
-
-    const js::Value &val = f.regs.sp[-1 - which];
-    TypeSet *types = script->analysis()->poppedTypes(pc, which);
-    Type type = GetValueType(f.cx, val);
-
-    if (!types->hasType(type)) {
-        /* Display fine-grained debug information first */
-        fprintf(stderr, "Missing type at #%u:%05u popped %u: %s\n", 
-                script->id(), unsigned(pc - script->code), which, TypeString(type));
-        TypeFailure(f.cx, "Missing type popped %u", which);
-    }
-}
 #endif
 
 /*
diff --git a/js/src/methodjit/StubCalls.h b/js/src/methodjit/StubCalls.h
index a3b82519060e..374ed93d4dd3 100644
--- a/js/src/methodjit/StubCalls.h
+++ b/js/src/methodjit/StubCalls.h
@@ -210,14 +210,11 @@ void JS_FASTCALL TypeBarrierHelper(VMFrame &f, uint32 which);
 void JS_FASTCALL TypeBarrierReturn(VMFrame &f, Value *vp);
 void JS_FASTCALL NegZeroHelper(VMFrame &f);
 
-void JS_FASTCALL StubTypeHelper(VMFrame &f, int32 which);
-
+void JS_FASTCALL CallPropSwap(VMFrame &f);
 void JS_FASTCALL CheckArgumentTypes(VMFrame &f);
 
 #ifdef DEBUG
 void JS_FASTCALL AssertArgumentTypes(VMFrame &f);
-void JS_FASTCALL TypeCheckPushed(VMFrame &f);
-void JS_FASTCALL TypeCheckPopped(VMFrame &f, int32 which);
 #endif
 
 void JS_FASTCALL MissedBoundsCheckEntry(VMFrame &f);
diff --git a/js/src/methodjit/StubCompiler.cpp b/js/src/methodjit/StubCompiler.cpp
index adbacdcc894c..aa0c5dc27bba 100644
--- a/js/src/methodjit/StubCompiler.cpp
+++ b/js/src/methodjit/StubCompiler.cpp
@@ -170,19 +170,19 @@ typedef JSC::MacroAssembler::Imm32 Imm32;
 typedef JSC::MacroAssembler::DataLabelPtr DataLabelPtr;
 
 JSC::MacroAssembler::Call
-StubCompiler::emitStubCall(void *ptr, RejoinState rejoin, Uses uses)
+StubCompiler::emitStubCall(void *ptr, RejoinState rejoin)
 {
-    return emitStubCall(ptr, rejoin, uses, frame.totalDepth());
+    return emitStubCall(ptr, rejoin, frame.totalDepth());
 }
 
 JSC::MacroAssembler::Call
-StubCompiler::emitStubCall(void *ptr, RejoinState rejoin, Uses uses, int32 slots)
+StubCompiler::emitStubCall(void *ptr, RejoinState rejoin, int32 slots)
 {
     JaegerSpew(JSpew_Insns, " ---- BEGIN SLOW CALL CODE ---- \n");
     masm.bumpStubCounter(cc.script, cc.PC, Registers::tempCallReg());
     DataLabelPtr inlinePatch;
     Call cl = masm.fallibleVMCall(cx->typeInferenceEnabled(),
-                                  ptr, cc.outerPC(), NULL, &inlinePatch, slots);
+                                  ptr, cc.outerPC(), &inlinePatch, slots);
     JaegerSpew(JSpew_Insns, " ---- END SLOW CALL CODE ---- \n");
 
     /* Add the call site for debugging and recompilation. */
@@ -199,7 +199,7 @@ StubCompiler::emitStubCall(void *ptr, RejoinState rejoin, Uses uses, int32 slots
         /* MissedBoundsCheck* are not actually called, so f.regs need to be written before InvariantFailure. */
         bool entry = (ptr == JS_FUNC_TO_DATA_PTR(void *, stubs::MissedBoundsCheckEntry))
                   || (ptr == JS_FUNC_TO_DATA_PTR(void *, stubs::MissedBoundsCheckHead));
-        cc.loop->addInvariantCall(j, l, true, entry, cc.callSites.length(), uses);
+        cc.loop->addInvariantCall(j, l, true, entry, cc.callSites.length());
     }
 
     cc.addCallSite(site);
diff --git a/js/src/methodjit/StubCompiler.h b/js/src/methodjit/StubCompiler.h
index cec08c58bf8d..7d34e9ad1037 100644
--- a/js/src/methodjit/StubCompiler.h
+++ b/js/src/methodjit/StubCompiler.h
@@ -137,8 +137,8 @@ class StubCompiler
     bool jumpInScript(Jump j, jsbytecode *target);
     unsigned crossJump(Jump j, Label l);
 
-    Call emitStubCall(void *ptr, RejoinState rejoin, Uses uses);
-    Call emitStubCall(void *ptr, RejoinState rejoin, Uses uses, int32 slots);
+    Call emitStubCall(void *ptr, RejoinState rejoin);
+    Call emitStubCall(void *ptr, RejoinState rejoin, int32 slots);
 
     void patchJoin(unsigned i, bool script, Assembler::Address address, AnyRegisterID reg);
 };
diff --git a/js/src/methodjit/TrampolineCompiler.cpp b/js/src/methodjit/TrampolineCompiler.cpp
index 2e466e6b9d91..d37d79273386 100644
--- a/js/src/methodjit/TrampolineCompiler.cpp
+++ b/js/src/methodjit/TrampolineCompiler.cpp
@@ -122,7 +122,7 @@ TrampolineCompiler::generateForceReturn(Assembler &masm)
     masm.loadPtr(FrameAddress(VMFrame::offsetOfFp), JSFrameReg);
 
     /* Perform the frame epilogue. */
-    masm.fallibleVMCall(true, JS_FUNC_TO_DATA_PTR(void *, stubs::AnyFrameEpilogue), NULL, NULL, NULL, 0);
+    masm.fallibleVMCall(true, JS_FUNC_TO_DATA_PTR(void *, stubs::AnyFrameEpilogue), NULL, NULL, 0);
 
     /* Store any known return value */
     masm.loadValueAsComponents(UndefinedValue(), JSReturnReg_Type, JSReturnReg_Data);

From a724f86af61e21d9e564b9721b332e5af5f5b738 Mon Sep 17 00:00:00 2001
From: Jim Mathies <jmathies@mozilla.com>
Date: Sun, 18 Sep 2011 00:58:37 +0100
Subject: [PATCH 195/209] Bug 654891 - warning C4509: nonstandard extension
 used: 'PluginWindowEvent::Run' uses SEH and 'inst' has destructor;
 r=bsmedberg

---
 dom/plugins/base/nsPluginNativeWindowWin.cpp | 14 ++++++--------
 1 file changed, 6 insertions(+), 8 deletions(-)

diff --git a/dom/plugins/base/nsPluginNativeWindowWin.cpp b/dom/plugins/base/nsPluginNativeWindowWin.cpp
index 47cad546d57f..ef6df824bd0e 100644
--- a/dom/plugins/base/nsPluginNativeWindowWin.cpp
+++ b/dom/plugins/base/nsPluginNativeWindowWin.cpp
@@ -184,8 +184,7 @@ static PRBool ProcessFlashMessageDelayed(nsPluginNativeWindowWin * aWin, nsNPAPI
   if (msg == sWM_FLASHBOUNCEMSG) {
     // See PluginWindowEvent::Run() below.
     NS_ASSERTION((sWM_FLASHBOUNCEMSG != 0), "RegisterWindowMessage failed in flash plugin WM_USER message handling!");
-    NS_TRY_SAFE_CALL_VOID(::CallWindowProc((WNDPROC)aWin->GetWindowProc(), hWnd, WM_USER_FLASH, wParam, lParam),
-                                           aInst);
+    ::CallWindowProc((WNDPROC)aWin->GetWindowProc(), hWnd, WM_USER_FLASH, wParam, lParam);
     return TRUE;
   }
 
@@ -577,12 +576,11 @@ NS_IMETHODIMP PluginWindowEvent::Run()
   else {
     // Currently not used, but added so that processing events here
     // is more generic.
-    NS_TRY_SAFE_CALL_VOID(::CallWindowProc(win->GetWindowProc(), 
-                          hWnd, 
-                          GetMsg(), 
-                          GetWParam(), 
-                          GetLParam()),
-                          inst);
+    ::CallWindowProc(win->GetWindowProc(), 
+                     hWnd, 
+                     GetMsg(), 
+                     GetWParam(), 
+                     GetLParam());
   }
 
   Clear();

From fc75f23bafa935eb19e63845a3f626d377f09187 Mon Sep 17 00:00:00 2001
From: Olli Pettay <Olli.Pettay@helsinki.fi>
Date: Sun, 18 Sep 2011 02:45:14 -0500
Subject: [PATCH 196/209] Bug 432698 - mouseenter and mouseleave, r=masayuki

--HG--
extra : rebase_source : 2664d2655546602edc88bcadc7dd981b01d76820
---
 content/base/src/nsGkAtomList.h               |   2 +
 content/base/src/nsNodeUtils.cpp              |   3 +
 content/events/public/nsEventNameList.h       |   8 +
 content/events/src/nsDOMEvent.cpp             |   6 +-
 content/events/src/nsDOMEvent.h               |   2 +
 content/events/src/nsEventListenerManager.cpp |  14 ++
 content/events/src/nsEventListenerManager.h   |   5 +-
 content/events/src/nsEventStateManager.cpp    |  52 ++++-
 content/events/src/nsEventStateManager.h      |   3 +
 content/events/test/Makefile.in               |   1 +
 content/events/test/test_bug432698.html       | 190 ++++++++++++++++++
 dom/base/nsGlobalWindow.cpp                   |   4 +-
 dom/base/nsPIDOMWindow.h                      |  23 ++-
 .../core/nsIInlineEventHandlers.idl           |   4 +-
 widget/public/nsGUIEvent.h                    |  32 ++-
 15 files changed, 336 insertions(+), 13 deletions(-)
 create mode 100644 content/events/test/test_bug432698.html

diff --git a/content/base/src/nsGkAtomList.h b/content/base/src/nsGkAtomList.h
index 81526645bc4e..d266c1f02506 100644
--- a/content/base/src/nsGkAtomList.h
+++ b/content/base/src/nsGkAtomList.h
@@ -690,6 +690,8 @@ GK_ATOM(onpopstate, "onpopstate")
 GK_ATOM(only, "only")               // this one is not an event
 GK_ATOM(onmessage, "onmessage")
 GK_ATOM(onmousedown, "onmousedown")
+GK_ATOM(onmouseenter, "onmouseenter")
+GK_ATOM(onmouseleave, "onmouseleave")
 GK_ATOM(onmousemove, "onmousemove")
 GK_ATOM(onmouseout, "onmouseout")
 GK_ATOM(onmouseover, "onmouseover")
diff --git a/content/base/src/nsNodeUtils.cpp b/content/base/src/nsNodeUtils.cpp
index f75e08f1cc40..bf3b28083356 100644
--- a/content/base/src/nsNodeUtils.cpp
+++ b/content/base/src/nsNodeUtils.cpp
@@ -571,6 +571,9 @@ nsNodeUtils::CloneAndAdopt(nsINode *aNode, PRBool aClone, PRBool aDeep,
           if (elm->MayHaveTouchEventListener()) {
             window->SetHasTouchEventListeners();
           }
+          if (elm->MayHaveMouseEnterLeaveEventListener()) {
+            window->SetHasMouseEnterLeaveEventListeners();
+          }
         }
       }
     }
diff --git a/content/events/public/nsEventNameList.h b/content/events/public/nsEventNameList.h
index 8c5c4fb971a7..44bf6d3c2ef5 100644
--- a/content/events/public/nsEventNameList.h
+++ b/content/events/public/nsEventNameList.h
@@ -227,6 +227,14 @@ EVENT(mousedown,
       NS_MOUSE_BUTTON_DOWN,
       EventNameType_All,
       NS_MOUSE_EVENT)
+EVENT(mouseenter,
+      NS_MOUSEENTER,
+      EventNameType_All,
+      NS_MOUSE_EVENT)
+EVENT(mouseleave,
+      NS_MOUSELEAVE,
+      EventNameType_All,
+      NS_MOUSE_EVENT)
 EVENT(mousemove,
       NS_MOUSE_MOVE,
       EventNameType_All,
diff --git a/content/events/src/nsDOMEvent.cpp b/content/events/src/nsDOMEvent.cpp
index 8df917f6b581..2f9000a87087 100644
--- a/content/events/src/nsDOMEvent.cpp
+++ b/content/events/src/nsDOMEvent.cpp
@@ -61,7 +61,7 @@
 using namespace mozilla;
 
 static const char* const sEventNames[] = {
-  "mousedown", "mouseup", "click", "dblclick", "mouseover",
+  "mousedown", "mouseup", "click", "dblclick", "mouseenter", "mouseleave", "mouseover",
   "mouseout", "MozMouseHittest", "mousemove", "contextmenu", "keydown", "keyup", "keypress",
   "focus", "blur", "load", "popstate", "beforescriptexecute",
   "afterscriptexecute", "beforeunload", "unload",
@@ -1109,6 +1109,10 @@ const char* nsDOMEvent::GetEventName(PRUint32 aEventType)
     return sEventNames[eDOMEvents_click];
   case NS_MOUSE_DOUBLECLICK:
     return sEventNames[eDOMEvents_dblclick];
+  case NS_MOUSEENTER:
+    return sEventNames[eDOMEvents_mouseenter];
+  case NS_MOUSELEAVE:
+    return sEventNames[eDOMEvents_mouseleave];
   case NS_MOUSE_ENTER_SYNTH:
     return sEventNames[eDOMEvents_mouseover];
   case NS_MOUSE_EXIT_SYNTH:
diff --git a/content/events/src/nsDOMEvent.h b/content/events/src/nsDOMEvent.h
index d5df9854db78..13c7237b2c45 100644
--- a/content/events/src/nsDOMEvent.h
+++ b/content/events/src/nsDOMEvent.h
@@ -65,6 +65,8 @@ public:
     eDOMEvents_mouseup,
     eDOMEvents_click,
     eDOMEvents_dblclick,
+    eDOMEvents_mouseenter,
+    eDOMEvents_mouseleave,
     eDOMEvents_mouseover,
     eDOMEvents_mouseout,
     eDOMEvents_MozMouseHittest,
diff --git a/content/events/src/nsEventListenerManager.cpp b/content/events/src/nsEventListenerManager.cpp
index f05fe43f8b16..0fe3eb21d52a 100644
--- a/content/events/src/nsEventListenerManager.cpp
+++ b/content/events/src/nsEventListenerManager.cpp
@@ -134,6 +134,7 @@ nsEventListenerManager::nsEventListenerManager(nsISupports* aTarget) :
   mMayHaveSystemGroupListeners(PR_FALSE),
   mMayHaveAudioAvailableEventListener(PR_FALSE),
   mMayHaveTouchEventListener(PR_FALSE),
+  mMayHaveMouseEnterLeaveEventListener(PR_FALSE),
   mNoListenerForEvent(0),
   mTarget(aTarget)
 {
@@ -293,6 +294,19 @@ nsEventListenerManager::AddEventListener(nsIDOMEventListener *aListener,
     nsPIDOMWindow* window = GetInnerWindowForTarget();
     if (window)
       window->SetHasTouchEventListeners();
+  } else if (aTypeAtom == nsGkAtoms::onmouseenter ||
+             aTypeAtom == nsGkAtoms::onmouseleave) {
+    mMayHaveMouseEnterLeaveEventListener = PR_TRUE;
+    nsPIDOMWindow* window = GetInnerWindowForTarget();
+    if (window) {
+#ifdef DEBUG
+      nsCOMPtr<nsIDocument> d = do_QueryInterface(window->GetExtantDocument());
+      NS_WARN_IF_FALSE(!nsContentUtils::IsChromeDoc(d),
+                       "Please do not use mouseenter/leave events in chrome. "
+                       "They are slower than mouseover/out!");
+#endif
+      window->SetHasMouseEnterLeaveEventListeners();
+    }
   }
 }
 
diff --git a/content/events/src/nsEventListenerManager.h b/content/events/src/nsEventListenerManager.h
index ffa0dbb51db0..f76292e29f46 100644
--- a/content/events/src/nsEventListenerManager.h
+++ b/content/events/src/nsEventListenerManager.h
@@ -232,6 +232,8 @@ public:
    */
   PRBool MayHaveTouchEventListener() { return mMayHaveTouchEventListener; }
 
+  PRBool MayHaveMouseEnterLeaveEventListener() { return mMayHaveMouseEnterLeaveEventListener; }
+
   PRInt64 SizeOf() const;
 protected:
   nsresult HandleEventSubType(nsListenerStruct* aListenerStruct,
@@ -302,7 +304,8 @@ protected:
   PRUint32 mMayHaveSystemGroupListeners : 1;
   PRUint32 mMayHaveAudioAvailableEventListener : 1;
   PRUint32 mMayHaveTouchEventListener : 1;
-  PRUint32 mNoListenerForEvent : 26;
+  PRUint32 mMayHaveMouseEnterLeaveEventListener : 1;
+  PRUint32 mNoListenerForEvent : 25;
 
   nsAutoTObserverArray<nsListenerStruct, 2> mListeners;
   nsISupports*                              mTarget;  //WEAK
diff --git a/content/events/src/nsEventStateManager.cpp b/content/events/src/nsEventStateManager.cpp
index b5e932de3315..d66915e2506c 100644
--- a/content/events/src/nsEventStateManager.cpp
+++ b/content/events/src/nsEventStateManager.cpp
@@ -3839,6 +3839,50 @@ nsEventStateManager::DispatchMouseEvent(nsGUIEvent* aEvent, PRUint32 aMessage,
   return targetFrame;
 }
 
+class MouseEnterLeaveDispatcher
+{
+public:
+  MouseEnterLeaveDispatcher(nsEventStateManager* aESM,
+                            nsIContent* aTarget, nsIContent* aRelatedTarget,
+                            nsGUIEvent* aEvent, PRUint32 aType)
+  : mESM(aESM), mEvent(aEvent), mType(aType)
+  {
+    nsPIDOMWindow* win =
+      aTarget ? aTarget->GetOwnerDoc()->GetInnerWindow() : nsnull;
+    if (win && win->HasMouseEnterLeaveEventListeners()) {
+      mRelatedTarget = aRelatedTarget ?
+        aRelatedTarget->FindFirstNonNativeAnonymous() : nsnull;
+      nsINode* commonParent = nsnull;
+      if (aTarget && aRelatedTarget) {
+        commonParent =
+          nsContentUtils::GetCommonAncestor(aTarget, aRelatedTarget);
+      }
+      nsIContent* current = aTarget;
+      // Note, it is ok if commonParent is null!
+      while (current && current != commonParent) {
+        if (!current->IsInNativeAnonymousSubtree()) {
+          mTargets.AppendObject(current);
+        }
+        // mouseenter/leave is fired only on elements.
+        current = current->GetParent();
+      }
+    }
+  }
+
+  ~MouseEnterLeaveDispatcher()
+  {
+    for (PRInt32 i = 0; i < mTargets.Count(); ++i) {
+      mESM->DispatchMouseEvent(mEvent, mType, mTargets[i], mRelatedTarget);
+    }
+  }
+
+  nsEventStateManager*   mESM;
+  nsCOMArray<nsIContent> mTargets;
+  nsCOMPtr<nsIContent>   mRelatedTarget;
+  nsGUIEvent*            mEvent;
+  PRUint32               mType;
+};
+
 void
 nsEventStateManager::NotifyMouseOut(nsGUIEvent* aEvent, nsIContent* aMovingInto)
 {
@@ -3884,7 +3928,10 @@ nsEventStateManager::NotifyMouseOut(nsGUIEvent* aEvent, nsIContent* aMovingInto)
     // Unset :hover
     SetContentState(nsnull, NS_EVENT_STATE_HOVER);
   }
-  
+
+  MouseEnterLeaveDispatcher leaveDispatcher(this, mLastMouseOverElement, aMovingInto,
+                                            aEvent, NS_MOUSELEAVE);
+
   // Fire mouseout
   DispatchMouseEvent(aEvent, NS_MOUSE_EXIT_SYNTH,
                      mLastMouseOverElement, aMovingInto);
@@ -3932,6 +3979,9 @@ nsEventStateManager::NotifyMouseOver(nsGUIEvent* aEvent, nsIContent* aContent)
   // DispatchMouseEvent() call below, since NotifyMouseOut() resets it, bug 298477.
   nsCOMPtr<nsIContent> lastMouseOverElement = mLastMouseOverElement;
 
+  MouseEnterLeaveDispatcher enterDispatcher(this, aContent, lastMouseOverElement,
+                                            aEvent, NS_MOUSEENTER);
+  
   NotifyMouseOut(aEvent, aContent);
 
   // Store the first mouseOver event we fire and don't refire mouseOver
diff --git a/content/events/src/nsEventStateManager.h b/content/events/src/nsEventStateManager.h
index 915941638f75..7fc02334660c 100644
--- a/content/events/src/nsEventStateManager.h
+++ b/content/events/src/nsEventStateManager.h
@@ -66,6 +66,7 @@ class nsIDocShellTreeNode;
 class nsIDocShellTreeItem;
 class imgIContainer;
 class nsDOMDataTransfer;
+class MouseEnterLeaveDispatcher;
 
 namespace mozilla {
 namespace dom {
@@ -228,6 +229,8 @@ public:
   static void SetFullScreenState(mozilla::dom::Element* aElement, PRBool aIsFullScreen);
 
 protected:
+  friend class MouseEnterLeaveDispatcher;
+
   void UpdateCursor(nsPresContext* aPresContext, nsEvent* aEvent, nsIFrame* aTargetFrame, nsEventStatus* aStatus);
   /**
    * Turn a GUI mouse event into a mouse event targeted at the specified
diff --git a/content/events/test/Makefile.in b/content/events/test/Makefile.in
index cb5bbecf4a0c..cb95a412c85d 100644
--- a/content/events/test/Makefile.in
+++ b/content/events/test/Makefile.in
@@ -71,6 +71,7 @@ _TEST_FILES = \
 		test_bug412567.html \
 		test_bug426082.html \
 		test_bug427537.html \
+		test_bug432698.html \
 		test_bug443985.html \
 		test_bug447736.html \
 		test_bug450876.html \
diff --git a/content/events/test/test_bug432698.html b/content/events/test/test_bug432698.html
new file mode 100644
index 000000000000..e5889f18f91a
--- /dev/null
+++ b/content/events/test/test_bug432698.html
@@ -0,0 +1,190 @@
+<!DOCTYPE HTML>
+<html>
+<!--
+https://bugzilla.mozilla.org/show_bug.cgi?id=432698
+-->
+<head>
+  <title>Test for Bug 432698</title>
+  <script type="application/javascript" src="/tests/SimpleTest/SimpleTest.js"></script>
+  <script type="application/javascript" src="/tests/SimpleTest/EventUtils.js"></script>
+  <link rel="stylesheet" type="text/css" href="/tests/SimpleTest/test.css"/>
+</head>
+<body>
+<a target="_blank" href="https://bugzilla.mozilla.org/show_bug.cgi?id=432698">Mozilla Bug 432698</a>
+<p id="display"></p>
+<div id="content" style="display: none">
+  
+</div>
+<pre id="test">
+<script type="application/javascript">
+
+/** Test for Bug 432698 **/
+SimpleTest.waitForExplicitFinish();
+SimpleTest.waitForFocus(runTests);
+var outer;
+var middle;
+var inner;
+var outside;
+var container;
+var file;
+var iframe;
+var checkRelatedTarget = false;
+var expectedRelatedEnter = null;
+var expectedRelatedLeave = null;
+var mouseentercount = 0;
+var mouseleavecount = 0;
+var mouseovercount = 0;
+var mouseoutcount = 0;
+
+function sendMouseEvent(t, elem) {
+  var r = elem.getBoundingClientRect();
+  synthesizeMouse(elem, r.width / 2, r.height / 2, {type: t});
+}
+
+function runTests() {
+  outer = document.getElementById("outertest");
+  middle = document.getElementById("middletest");
+  inner = document.getElementById("innertest");
+  outside = document.getElementById("outside");
+  container = document.getElementById("container");
+  file = document.getElementById("file");
+  iframe = document.getElementById("iframe");
+
+  // Make sure ESM thinks mouse is outside the test elements.
+  sendMouseEvent("mousemove", outside);
+
+  mouseentercount = 0;
+  mouseleavecount = 0;
+  mouseovercount = 0;
+  mouseoutcount = 0;
+  checkRelatedTarget = true;
+  expectedRelatedEnter = outside;
+  expectedRelatedLeave = inner;
+  sendMouseEvent("mousemove", inner);
+  is(mouseentercount, 3, "Unexpected mouseenter event count!");
+  is(mouseovercount, 1, "Unexpected mouseover event count!");
+  is(mouseoutcount, 0, "Unexpected mouseout event count!");
+  is(mouseleavecount, 0, "Unexpected mouseleave event count!");
+  expectedRelatedEnter = inner;
+  expectedRelatedLeave = outside;
+  sendMouseEvent("mousemove", outside);
+  is(mouseentercount, 3, "Unexpected mouseenter event count!");
+  is(mouseovercount, 1, "Unexpected mouseover event count!");
+  is(mouseoutcount, 1, "Unexpected mouseout event count!");
+  is(mouseleavecount, 3, "Unexpected mouseleave event count!");
+
+  // Event handling over native anonymous content.
+  var r = file.getBoundingClientRect();
+  expectedRelatedEnter = outside;
+  expectedRelatedLeave = file;
+  synthesizeMouse(file, r.width / 6, r.height / 2, {type: "mousemove"});
+  is(mouseentercount, 4, "Unexpected mouseenter event count!");
+  is(mouseovercount, 2, "Unexpected mouseover event count!");
+  is(mouseoutcount, 1, "Unexpected mouseout event count!");
+  is(mouseleavecount, 3, "Unexpected mouseleave event count!");
+
+  // Moving mouse over type="file" shouldn't cause mouseover/out/enter/leave events
+  synthesizeMouse(file, r.width - (r.width / 6), r.height / 2, {type: "mousemove"});
+  is(mouseentercount, 4, "Unexpected mouseenter event count!");
+  is(mouseovercount, 2, "Unexpected mouseover event count!");
+  is(mouseoutcount, 1, "Unexpected mouseout event count!");
+  is(mouseleavecount, 3, "Unexpected mouseleave event count!");
+
+  expectedRelatedEnter = file;
+  expectedRelatedLeave = outside;
+  sendMouseEvent("mousemove", outside);
+  is(mouseentercount, 4, "Unexpected mouseenter event count!");
+  is(mouseovercount, 2, "Unexpected mouseover event count!");
+  is(mouseoutcount, 2, "Unexpected mouseout event count!");
+  is(mouseleavecount, 4, "Unexpected mouseleave event count!");
+  
+  // Initialize iframe
+  iframe.contentDocument.documentElement.style.overflow = "hidden";
+  iframe.contentDocument.body.style.margin = "0px";
+  iframe.contentDocument.body.style.width = "100%";
+  iframe.contentDocument.body.style.height = "100%";
+  iframe.contentDocument.body.innerHTML =
+    "<div style='width: 100%; height: 50%; border: 1px solid black;'></div>" +
+    "<div style='width: 100%; height: 50%; border: 1px solid black;'></div>";
+  iframe.contentDocument.body.offsetLeft; // flush
+
+  iframe.contentDocument.body.firstChild.onmouseenter = menter;
+  iframe.contentDocument.body.firstChild.onmouseleave = mleave;
+  iframe.contentDocument.body.lastChild.onmouseenter = menter;
+  iframe.contentDocument.body.lastChild.onmouseleave = mleave;
+  r = iframe.getBoundingClientRect();
+  expectedRelatedEnter = outside;
+  expectedRelatedLeave = iframe;
+  // Move mouse inside the iframe.
+  synthesizeMouse(iframe.contentDocument.body, r.width / 2, r.height / 4, {type: "mousemove"},
+                  iframe.contentWindow);
+  synthesizeMouse(iframe.contentDocument.body, r.width / 2, r.height - (r.height / 4), {type: "mousemove"},
+                  iframe.contentWindow);
+  is(mouseentercount, 7, "Unexpected mouseenter event count!");
+  expectedRelatedEnter = iframe;
+  expectedRelatedLeave = outside;
+  sendMouseEvent("mousemove", outside);
+  is(mouseleavecount, 7, "Unexpected mouseleave event count!");
+
+  SimpleTest.finish();
+}
+
+function menter(evt) {
+  ++mouseentercount;
+  evt.stopPropagation();
+  is(evt.bubbles, false, evt.type + " should not bubble!");
+  is(evt.cancelable, false, evt.type + " is not cancelable!");
+  is(evt.target, evt.currentTarget, "Wrong event target!");
+  ok(!evt.relatedTarget || evt.target.ownerDocument == evt.relatedTarget.ownerDocument,
+     "Leaking nodes to another document?");
+  if (checkRelatedTarget && evt.target.ownerDocument == document) {
+    is(evt.relatedTarget, expectedRelatedEnter, "Wrong related target (mouseenter)");
+  }
+}
+
+function mleave(evt) {
+  ++mouseleavecount;
+  evt.stopPropagation();
+  is(evt.bubbles, false, evt.type + " should not bubble!");
+  is(evt.cancelable, false, evt.type + " is not cancelable!");
+  is(evt.target, evt.currentTarget, "Wrong event target!");
+  ok(!evt.relatedTarget || evt.target.ownerDocument == evt.relatedTarget.ownerDocument,
+     "Leaking nodes to another document?");
+  if (checkRelatedTarget && evt.target.ownerDocument == document) {
+    is(evt.relatedTarget, expectedRelatedLeave, "Wrong related target (mouseleave)");
+  }
+}
+
+function mover(evt) {
+  ++mouseovercount;
+  evt.stopPropagation();
+}
+
+function mout(evt) {
+  ++mouseoutcount;
+  evt.stopPropagation();
+}
+
+</script>
+</pre>
+<div id="container" onmouseenter="menter(event)" onmouseleave="mleave(event)"
+                    onmouseout="mout(event)" onmouseover="mover(event)">
+  <div id="outside" onmouseout="event.stopPropagation()" onmouseover="event.stopPropagation()">foo</div>
+  <div id="outertest" onmouseenter="menter(event)" onmouseleave="mleave(event)"
+                      onmouseout="mout(event)" onmouseover="mover(event)">
+    <div id="middletest" onmouseenter="menter(event)" onmouseleave="mleave(event)"
+                         onmouseout="mout(event)" onmouseover="mover(event)">
+      <div id="innertest" onmouseenter="menter(event)" onmouseleave="mleave(event)"
+                          onmouseout="mout(event)" onmouseover="mover(event)">foo</div>
+    </div>
+  </div>
+  <input type="file" id="file"
+         onmouseenter="menter(event)" onmouseleave="mleave(event)"
+         onmouseout="mout(event)" onmouseover="mover(event)">
+  <br>
+  <iframe id="iframe" width="50px" height="50px"
+          onmouseenter="menter(event)" onmouseleave="mleave(event)"
+          onmouseout="mout(event)" onmouseover="mover(event)"></iframe>
+</div>
+</body>
+</html>
diff --git a/dom/base/nsGlobalWindow.cpp b/dom/base/nsGlobalWindow.cpp
index 7d5c08fb5ae9..c1bb83e9f143 100644
--- a/dom/base/nsGlobalWindow.cpp
+++ b/dom/base/nsGlobalWindow.cpp
@@ -774,7 +774,9 @@ nsPIDOMWindow::nsPIDOMWindow(nsPIDOMWindow *aOuterWindow)
   mRunningTimeout(nsnull), mMutationBits(0), mIsDocumentLoaded(PR_FALSE),
   mIsHandlingResizeEvent(PR_FALSE), mIsInnerWindow(aOuterWindow != nsnull),
   mMayHavePaintEventListener(PR_FALSE), mMayHaveTouchEventListener(PR_FALSE),
-  mMayHaveAudioAvailableEventListener(PR_FALSE), mIsModalContentWindow(PR_FALSE),
+  mMayHaveAudioAvailableEventListener(PR_FALSE),
+  mMayHaveMouseEnterLeaveEventListener(PR_FALSE),
+  mIsModalContentWindow(PR_FALSE),
   mIsActive(PR_FALSE), mIsBackground(PR_FALSE),
   mInnerWindow(nsnull), mOuterWindow(aOuterWindow),
   // Make sure no actual window ends up with mWindowID == 0
diff --git a/dom/base/nsPIDOMWindow.h b/dom/base/nsPIDOMWindow.h
index 9409f04c2d65..35d518b83ae7 100644
--- a/dom/base/nsPIDOMWindow.h
+++ b/dom/base/nsPIDOMWindow.h
@@ -80,8 +80,8 @@ class nsIArray;
 class nsPIWindowRoot;
 
 #define NS_PIDOMWINDOW_IID \
-{ 0xeee816d2, 0x2f08, 0x4b34, \
-  { 0x97, 0x47, 0x5e, 0x5a, 0xcd, 0xc3, 0x56, 0xfa } }
+{ 0x8ce567b5, 0xcc8d, 0x410b, \
+  { 0xa2, 0x7b, 0x07, 0xaf, 0x31, 0xc0, 0x33, 0xb8 } }
 
 class nsPIDOMWindow : public nsIDOMWindowInternal
 {
@@ -467,6 +467,24 @@ public:
     mMayHaveAudioAvailableEventListener = PR_TRUE;
   }
 
+  /**
+   * Call this to check whether some node (this window, its document,
+   * or content in that document) has a mouseenter/leave event listener.
+   */
+  PRBool HasMouseEnterLeaveEventListeners()
+  {
+    return mMayHaveMouseEnterLeaveEventListener;
+  }
+
+  /**
+   * Call this to indicate that some node (this window, its document,
+   * or content in that document) has a mouseenter/leave event listener.
+   */
+  void SetHasMouseEnterLeaveEventListeners()
+  {
+    mMayHaveMouseEnterLeaveEventListener = PR_TRUE;
+  }  
+
   /**
    * Initialize window.java and window.Packages.
    */
@@ -627,6 +645,7 @@ protected:
   PRPackedBool           mMayHavePaintEventListener;
   PRPackedBool           mMayHaveTouchEventListener;
   PRPackedBool           mMayHaveAudioAvailableEventListener;
+  PRPackedBool           mMayHaveMouseEnterLeaveEventListener;
 
   // This variable is used on both inner and outer windows (and they
   // should match).
diff --git a/dom/interfaces/core/nsIInlineEventHandlers.idl b/dom/interfaces/core/nsIInlineEventHandlers.idl
index 4c2a416e5843..b30f7eb02653 100644
--- a/dom/interfaces/core/nsIInlineEventHandlers.idl
+++ b/dom/interfaces/core/nsIInlineEventHandlers.idl
@@ -39,7 +39,7 @@
 #include "jspubtd.h"
 %}
 
-[scriptable, uuid(c3cc4504-1eaf-42e9-8b1b-a3020f6d3a28)]
+[scriptable, uuid(790ad9f7-167a-4f5f-a5c1-8cfb3697104d)]
 interface nsIInlineEventHandlers : nsISupports
 {
   [implicit_jscontext] attribute jsval onabort;
@@ -77,6 +77,8 @@ interface nsIInlineEventHandlers : nsISupports
   [implicit_jscontext] attribute jsval onmousemove;
   [implicit_jscontext] attribute jsval onmouseout;
   [implicit_jscontext] attribute jsval onmouseover;
+  [implicit_jscontext] attribute jsval onmouseenter;
+  [implicit_jscontext] attribute jsval onmouseleave;
   [implicit_jscontext] attribute jsval onmouseup;
   // Not supported yet
   // [implicit_jscontext] attribute jsval onmousewheel;
diff --git a/widget/public/nsGUIEvent.h b/widget/public/nsGUIEvent.h
index ca312c2a6a31..a99cafcaac0f 100644
--- a/widget/public/nsGUIEvent.h
+++ b/widget/public/nsGUIEvent.h
@@ -262,6 +262,8 @@ class nsHashKey;
 #define NS_MOUSE_ENTER_SYNTH            (NS_MOUSE_MESSAGE_START + 31)
 #define NS_MOUSE_EXIT_SYNTH             (NS_MOUSE_MESSAGE_START + 32)
 #define NS_MOUSE_MOZHITTEST             (NS_MOUSE_MESSAGE_START + 33)
+#define NS_MOUSEENTER                   (NS_MOUSE_MESSAGE_START + 34)
+#define NS_MOUSELEAVE                   (NS_MOUSE_MESSAGE_START + 35)
 
 #define NS_CONTEXTMENU_MESSAGE_START    500
 #define NS_CONTEXTMENU                  (NS_CONTEXTMENU_MESSAGE_START)
@@ -878,8 +880,16 @@ protected:
       acceptActivation(PR_FALSE), ignoreRootScrollFrame(PR_FALSE),
       reason(aReason), context(eNormal), exit(eChild), clickCount(0)
   {
-    if (msg == NS_MOUSE_MOVE) {
-      flags |= NS_EVENT_FLAG_CANT_CANCEL;
+    switch (msg) {
+      case NS_MOUSE_MOVE:
+        flags |= NS_EVENT_FLAG_CANT_CANCEL;
+        break;
+      case NS_MOUSEENTER:
+      case NS_MOUSELEAVE:
+        flags |= (NS_EVENT_FLAG_CANT_CANCEL & NS_EVENT_FLAG_CANT_BUBBLE);
+        break;
+      default:
+        break;
     }
   }
 
@@ -891,12 +901,22 @@ public:
       acceptActivation(PR_FALSE), ignoreRootScrollFrame(PR_FALSE),
       reason(aReason), context(aContext), exit(eChild), clickCount(0)
   {
-    if (msg == NS_MOUSE_MOVE) {
-      flags |= NS_EVENT_FLAG_CANT_CANCEL;
-    } else if (msg == NS_CONTEXTMENU) {
-      button = (context == eNormal) ? eRightButton : eLeftButton;
+    switch (msg) {
+      case NS_MOUSE_MOVE:
+        flags |= NS_EVENT_FLAG_CANT_CANCEL;
+        break;
+      case NS_MOUSEENTER:
+      case NS_MOUSELEAVE:
+        flags |= (NS_EVENT_FLAG_CANT_CANCEL | NS_EVENT_FLAG_CANT_BUBBLE);
+        break;
+      case NS_CONTEXTMENU:
+        button = (context == eNormal) ? eRightButton : eLeftButton;
+        break;
+      default:
+        break;
     }
   }
+
 #ifdef NS_DEBUG
   ~nsMouseEvent() {
     NS_WARN_IF_FALSE(message != NS_CONTEXTMENU ||

From 9af9af46521395e262e48f4a2564e8456d5b7c03 Mon Sep 17 00:00:00 2001
From: Kyle Huey <khuey@kylehuey.com>
Date: Sun, 18 Sep 2011 13:12:06 -0400
Subject: [PATCH 197/209] Remove some dead makefile entries from
 toolkit-makefiles. r=me (no bug).

---
 toolkit/toolkit-makefiles.sh | 2 --
 1 file changed, 2 deletions(-)

diff --git a/toolkit/toolkit-makefiles.sh b/toolkit/toolkit-makefiles.sh
index 54869535b5ba..50423e005763 100644
--- a/toolkit/toolkit-makefiles.sh
+++ b/toolkit/toolkit-makefiles.sh
@@ -266,7 +266,6 @@ MAKEFILES_content="
   content/xslt/src/xml/Makefile
   content/xslt/src/xpath/Makefile
   content/xslt/src/xslt/Makefile
-  content/xslt/src/main/Makefile
 "
 
 MAKEFILES_layout="
@@ -682,7 +681,6 @@ MAKEFILES_jsreflect="
 MAKEFILES_jsductwork="
   js/ductwork/Makefile
   js/ductwork/debugger/Makefile
-  js/ductwork/debugger/tests/Makefile
 "
 
 MAKEFILES_libpr0n="

From f6a3b24bf2b45f93756d54a58c87778b0fff0871 Mon Sep 17 00:00:00 2001
From: Oleg Romashin <romaxa@gmail.com>
Date: Mon, 19 Sep 2011 12:12:16 +0100
Subject: [PATCH 198/209] Bug 687392 - Use nearest filter for mobile
 video/plugin rendering. r=roc

---
 layout/generic/nsObjectFrame.cpp | 10 +++++++++-
 1 file changed, 9 insertions(+), 1 deletion(-)

diff --git a/layout/generic/nsObjectFrame.cpp b/layout/generic/nsObjectFrame.cpp
index 09e3b6f654c3..0cb4e33f89f3 100644
--- a/layout/generic/nsObjectFrame.cpp
+++ b/layout/generic/nsObjectFrame.cpp
@@ -1631,7 +1631,15 @@ nsObjectFrame::BuildLayer(nsDisplayListBuilder* aBuilder,
     UpdateImageLayer(container, r);
 
     imglayer->SetContainer(container);
-    imglayer->SetFilter(nsLayoutUtils::GetGraphicsFilterForFrame(this));
+    gfxPattern::GraphicsFilter filter =
+      nsLayoutUtils::GetGraphicsFilterForFrame(this);
+#ifdef MOZ_GFX_OPTIMIZE_MOBILE
+    if (!aManager->IsCompositingCheap()) {
+      // Pixman just horrible with bilinear filter scaling
+      filter = gfxPattern::FILTER_NEAREST;
+    }
+#endif
+    imglayer->SetFilter(filter);
 
     layer->SetContentFlags(IsOpaque() ? Layer::CONTENT_OPAQUE : 0);
   } else {

From 4787d54f016e61b29227cd6c2438cadacb3c97ed Mon Sep 17 00:00:00 2001
From: Robert Longson <longsonr@gmail.com>
Date: Mon, 19 Sep 2011 13:59:52 +0100
Subject: [PATCH 199/209] Bug 687340 - Make dynamic changes to mask, clipPath
 and marker attributes work. r=roc

---
 .../src/SVGAnimatedPreserveAspectRatio.cpp    |  4 +-
 content/svg/content/src/nsSVGSVGElement.cpp   |  8 ----
 content/svg/content/src/nsSVGSVGElement.h     |  1 -
 layout/reftests/svg/dynamic-clipPath-02.svg   | 37 +++++++++++++++++
 layout/reftests/svg/dynamic-marker-01.svg     |  6 +--
 layout/reftests/svg/dynamic-marker-03.svg     | 41 +++++++++++++++++++
 layout/reftests/svg/dynamic-mask-01.svg       | 38 +++++++++++++++++
 layout/reftests/svg/reftest.list              |  3 ++
 layout/svg/base/src/nsSVGClipPathFrame.cpp    | 12 ++++--
 layout/svg/base/src/nsSVGMaskFrame.cpp        | 20 +++++++++
 layout/svg/base/src/nsSVGMaskFrame.h          |  4 ++
 11 files changed, 155 insertions(+), 19 deletions(-)
 create mode 100644 layout/reftests/svg/dynamic-clipPath-02.svg
 create mode 100644 layout/reftests/svg/dynamic-marker-03.svg
 create mode 100644 layout/reftests/svg/dynamic-mask-01.svg

diff --git a/content/svg/content/src/SVGAnimatedPreserveAspectRatio.cpp b/content/svg/content/src/SVGAnimatedPreserveAspectRatio.cpp
index 4e6919c40f52..43b37ef9f188 100644
--- a/content/svg/content/src/SVGAnimatedPreserveAspectRatio.cpp
+++ b/content/svg/content/src/SVGAnimatedPreserveAspectRatio.cpp
@@ -247,9 +247,7 @@ SVGAnimatedPreserveAspectRatio::SetBaseValueString(
   }
 #endif
 
-  // We don't need to call DidChange* here - we're only called by
-  // nsSVGElement::ParseAttribute under nsGenericElement::SetAttr,
-  // which takes care of notifying.
+  aSVGElement->DidChangePreserveAspectRatio(aDoSetAttr);
   return NS_OK;
 }
 
diff --git a/content/svg/content/src/nsSVGSVGElement.cpp b/content/svg/content/src/nsSVGSVGElement.cpp
index ccab55c3d87b..1b4839f478e6 100644
--- a/content/svg/content/src/nsSVGSVGElement.cpp
+++ b/content/svg/content/src/nsSVGSVGElement.cpp
@@ -1213,14 +1213,6 @@ nsSVGSVGElement::GetLengthInfo()
                               NS_ARRAY_LENGTH(sLengthInfo));
 }
 
-void
-nsSVGSVGElement::DidChangeEnum(PRUint8 aAttrEnum, PRBool aDoSetAttr)
-{
-  nsSVGSVGElementBase::DidChangeEnum(aAttrEnum, aDoSetAttr);
-
-  InvalidateTransformNotifyFrame();
-}
-
 nsSVGElement::EnumAttributesInfo
 nsSVGSVGElement::GetEnumInfo()
 {
diff --git a/content/svg/content/src/nsSVGSVGElement.h b/content/svg/content/src/nsSVGSVGElement.h
index 4906f0d01475..476d62dc3dd5 100644
--- a/content/svg/content/src/nsSVGSVGElement.h
+++ b/content/svg/content/src/nsSVGSVGElement.h
@@ -194,7 +194,6 @@ public:
   // nsSVGElement specializations:
   virtual gfxMatrix PrependLocalTransformTo(const gfxMatrix &aMatrix) const;
   virtual void DidChangeLength(PRUint8 aAttrEnum, PRBool aDoSetAttr);
-  virtual void DidChangeEnum(PRUint8 aAttrEnum, PRBool aDoSetAttr);
   virtual void DidChangeViewBox(PRBool aDoSetAttr);
   virtual void DidChangePreserveAspectRatio(PRBool aDoSetAttr);
 
diff --git a/layout/reftests/svg/dynamic-clipPath-02.svg b/layout/reftests/svg/dynamic-clipPath-02.svg
new file mode 100644
index 000000000000..b0a3b4d0c9ac
--- /dev/null
+++ b/layout/reftests/svg/dynamic-clipPath-02.svg
@@ -0,0 +1,37 @@
+<!--
+     Any copyright is dedicated to the Public Domain.
+     http://creativecommons.org/publicdomain/zero/1.0/
+-->
+<svg xmlns="http://www.w3.org/2000/svg" version="1.1"
+     class="reftest-wait"
+     onload="startTest()"
+     xmlns:xlink="http://www.w3.org/1999/xlink">
+  <title>Testing that dynamic changes to the clipPathUnits are reflected in the clipPath</title>
+
+  <defs>
+    <clipPath id="clip1" clipPathUnits="objectBoundingBox">
+      <rect width=".1" height=".1"/>
+    </clipPath>
+  </defs>
+
+  <rect width="100%" height="100%" fill="lime"/>
+
+  <g transform="scale(1000)">
+    <rect x=".2" y=".2" width=".6" height=".6" fill="red" clip-path="url(#clip1)"/>
+  </g>
+
+  <script>
+    function startTest() {
+      document.addEventListener("MozReftestInvalidate", doTest, false);
+      // in case we're not gecko
+      setTimeout(doTest, 5000);
+    }
+
+    function doTest() {
+      var clip1 = document.getElementById("clip1");
+      clip1.setAttribute("clipPathUnits", "userSpaceOnUse");
+
+      document.documentElement.removeAttribute("class");
+    }
+  </script>
+</svg>
diff --git a/layout/reftests/svg/dynamic-marker-01.svg b/layout/reftests/svg/dynamic-marker-01.svg
index 2e0bc35ee6af..62d234ab3bd3 100644
--- a/layout/reftests/svg/dynamic-marker-01.svg
+++ b/layout/reftests/svg/dynamic-marker-01.svg
@@ -6,9 +6,9 @@
   <title>Testing that dynamic changes to the element for a given ID are reflected in marker</title>
   <!-- From https://bugzilla.mozilla.org/show_bug.cgi?id=309220 -->
   <defs>
-	  <marker id="x" style="overflow: visible;" orient="auto" markerUnits="strokeWidth">
-		  <rect width="100%" height="100%" fill="lime"/>
-	  </marker>
+    <marker id="x" style="overflow: visible;" orient="auto" markerUnits="strokeWidth">
+      <rect width="100%" height="100%" fill="lime"/>
+    </marker>
   </defs>
 	
   <rect width="100%" height="100%" fill="red"/>
diff --git a/layout/reftests/svg/dynamic-marker-03.svg b/layout/reftests/svg/dynamic-marker-03.svg
new file mode 100644
index 000000000000..f09736d4bad9
--- /dev/null
+++ b/layout/reftests/svg/dynamic-marker-03.svg
@@ -0,0 +1,41 @@
+<?xml version="1.0" encoding="Windows-1252"?>
+<!--
+     Any copyright is dedicated to the Public Domain.
+     http://creativecommons.org/publicdomain/zero/1.0/
+-->
+<svg xmlns="http://www.w3.org/2000/svg" class="reftest-wait"
+  onload="startTest()">
+
+  <title>Testing that dynamic changes to preserveAspectRatio are reflected in the marker</title>
+  <script>
+<![CDATA[
+
+function startTest() {
+  document.addEventListener("MozReftestInvalidate", doTest, false);
+  // in case we're not gecko
+  setTimeout(doTest, 5000);
+}
+
+function doTest() {
+  m = document.getElementById("m1");
+  m.preserveAspectRatio.baseVal.align =
+    SVGPreserveAspectRatio.SVG_PRESERVEASPECTRATIO_NONE;
+  document.documentElement.removeAttribute("class");
+}
+
+]]>
+  </script>
+
+  <defs>
+    <marker id="m1" orient="auto" markerUnits="userSpaceOnUse"
+      preserveAspectRatio="xMidYMid slice" viewBox="0 0 30 40" markerWidth="60" markerHeight="30">
+      <rect width="30" height="40" fill="red"/>
+    </marker>
+  </defs>
+	
+  <rect width="100%" height="100%" fill="lime"/>
+	
+  <line x1="30" x2="30" y1="10" y2="10" stroke="red" stroke-width="3" marker-end="url(#m1)"/>
+
+  <rect x="30" y="10" width="60" height="30" fill="lime"/>
+</svg>
diff --git a/layout/reftests/svg/dynamic-mask-01.svg b/layout/reftests/svg/dynamic-mask-01.svg
new file mode 100644
index 000000000000..5a1dead3995a
--- /dev/null
+++ b/layout/reftests/svg/dynamic-mask-01.svg
@@ -0,0 +1,38 @@
+<?xml version="1.0" encoding="Windows-1252"?>
+<!--
+     Any copyright is dedicated to the Public Domain.
+     http://creativecommons.org/publicdomain/zero/1.0/
+-->
+<svg xmlns="http://www.w3.org/2000/svg" version="1.1"
+     class="reftest-wait"
+     onload="startTest()"
+     xmlns:xlink="http://www.w3.org/1999/xlink">
+  <title>Testing that dynamic changes to mask attributes are reflected in the mask</title>
+
+  <defs>
+    <mask id="mask1" width="1" height="1">
+      <rect width="1" height="1" fill="white"/>
+    </mask>
+  </defs>
+
+  <rect width="100%" height="100%" fill="lime"/>
+
+  <g transform="scale(500)">
+    <rect x=".2" y=".2" width=".2" height=".2" fill="red" mask="url(#mask1)"/>
+  </g>
+
+  <script>
+    function startTest() {
+      document.addEventListener("MozReftestInvalidate", doTest, false);
+      // in case we're not gecko
+      setTimeout(doTest, 5000);
+    }
+
+    function doTest() {
+      var mask1 = document.getElementById("mask1");
+      mask1.maskUnits.baseVal = SVGUnitTypes.SVG_UNIT_TYPE_USERSPACEONUSE;
+
+      document.documentElement.removeAttribute("class");
+    }
+  </script>
+</svg>
diff --git a/layout/reftests/svg/reftest.list b/layout/reftests/svg/reftest.list
index e7c4c3b46c97..fe9be5fbd710 100644
--- a/layout/reftests/svg/reftest.list
+++ b/layout/reftests/svg/reftest.list
@@ -62,6 +62,7 @@ fails-if(Android) == dynamic-conditions-01.svg pass.svg # bug 652050
 == dynamic-conditions-12.svg pass.svg
 == dynamic-conditions-13.svg about:blank
 == dynamic-clipPath-01.svg pass.svg
+== dynamic-clipPath-02.svg pass.svg
 == dynamic-feFlood-01.svg pass.svg
 == dynamic-feImage-01.svg pass.svg
 == dynamic-filter-contents-01a.svg dynamic-filter-contents-01-ref.svg
@@ -72,6 +73,8 @@ fails-if(Android) == dynamic-conditions-01.svg pass.svg # bug 652050
 == dynamic-link-style-01.svg pass.svg
 == dynamic-marker-01.svg pass.svg
 == dynamic-marker-02.svg dynamic-marker-02-ref.svg
+== dynamic-marker-03.svg pass.svg
+== dynamic-mask-01.svg pass.svg
 == dynamic-mask-contents-01.svg pass.svg
 == dynamic-pattern-01.svg pass.svg
 == dynamic-pattern-02.svg pass.svg
diff --git a/layout/svg/base/src/nsSVGClipPathFrame.cpp b/layout/svg/base/src/nsSVGClipPathFrame.cpp
index 27a0766caa51..cd053d7d98af 100644
--- a/layout/svg/base/src/nsSVGClipPathFrame.cpp
+++ b/layout/svg/base/src/nsSVGClipPathFrame.cpp
@@ -280,10 +280,14 @@ nsSVGClipPathFrame::AttributeChanged(PRInt32         aNameSpaceID,
                                      nsIAtom*        aAttribute,
                                      PRInt32         aModType)
 {
-  if (aNameSpaceID == kNameSpaceID_None &&
-      aAttribute == nsGkAtoms::transform) {
-    nsSVGUtils::NotifyChildrenOfSVGChange(this,
-                                          nsISVGChildFrame::TRANSFORM_CHANGED);
+  if (aNameSpaceID == kNameSpaceID_None) {
+    if (aAttribute == nsGkAtoms::transform) {
+      nsSVGUtils::NotifyChildrenOfSVGChange(this,
+                                            nsISVGChildFrame::TRANSFORM_CHANGED);
+    }
+    if (aAttribute == nsGkAtoms::clipPathUnits) {
+      nsSVGEffects::InvalidateRenderingObservers(this);
+    }
   }
 
   return nsSVGClipPathFrameBase::AttributeChanged(aNameSpaceID,
diff --git a/layout/svg/base/src/nsSVGMaskFrame.cpp b/layout/svg/base/src/nsSVGMaskFrame.cpp
index fd186fce5871..e2a0bb46fd16 100644
--- a/layout/svg/base/src/nsSVGMaskFrame.cpp
+++ b/layout/svg/base/src/nsSVGMaskFrame.cpp
@@ -38,6 +38,7 @@
 #include "nsSVGMaskFrame.h"
 #include "nsSVGContainerFrame.h"
 #include "nsSVGMaskElement.h"
+#include "nsSVGEffects.h"
 #include "nsIDOMSVGMatrix.h"
 #include "gfxContext.h"
 #include "gfxImageSurface.h"
@@ -157,6 +158,25 @@ nsSVGMaskFrame::ComputeMaskAlpha(nsSVGRenderState *aContext,
   return retval;
 }
 
+NS_IMETHODIMP
+nsSVGMaskFrame::AttributeChanged(PRInt32  aNameSpaceID,
+                                 nsIAtom* aAttribute,
+                                 PRInt32  aModType)
+{
+  if (aNameSpaceID == kNameSpaceID_None &&
+      (aAttribute == nsGkAtoms::x ||
+       aAttribute == nsGkAtoms::y ||
+       aAttribute == nsGkAtoms::width ||
+       aAttribute == nsGkAtoms::height||
+       aAttribute == nsGkAtoms::maskUnits ||
+       aAttribute == nsGkAtoms::maskContentUnits)) {
+    nsSVGEffects::InvalidateRenderingObservers(this);
+  }
+
+  return nsSVGMaskFrameBase::AttributeChanged(aNameSpaceID,
+                                              aAttribute, aModType);
+}
+
 #ifdef DEBUG
 NS_IMETHODIMP
 nsSVGMaskFrame::Init(nsIContent* aContent,
diff --git a/layout/svg/base/src/nsSVGMaskFrame.h b/layout/svg/base/src/nsSVGMaskFrame.h
index 50a29433d6d7..536e45703839 100644
--- a/layout/svg/base/src/nsSVGMaskFrame.h
+++ b/layout/svg/base/src/nsSVGMaskFrame.h
@@ -64,6 +64,10 @@ public:
                                                 const gfxMatrix &aMatrix,
                                                 float aOpacity = 1.0f);
 
+  NS_IMETHOD AttributeChanged(PRInt32         aNameSpaceID,
+                              nsIAtom*        aAttribute,
+                              PRInt32         aModType);
+
 #ifdef DEBUG
   NS_IMETHOD Init(nsIContent*      aContent,
                   nsIFrame*        aParent,

From db11f1f87fd390b623a5bb905848d2bd5436d2b4 Mon Sep 17 00:00:00 2001
From: Henri Sivonen <hsivonen@iki.fi>
Date: Mon, 19 Sep 2011 17:37:04 +0300
Subject: [PATCH 200/209] Bug 685581 - Do not treat the empty string as a
 speculatively preloadable URL. r=bzbarsky.

---
 parser/html/nsHtml5TreeOpExecutor.cpp | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/parser/html/nsHtml5TreeOpExecutor.cpp b/parser/html/nsHtml5TreeOpExecutor.cpp
index 96a0fb3657a9..4d7ab22dcf74 100644
--- a/parser/html/nsHtml5TreeOpExecutor.cpp
+++ b/parser/html/nsHtml5TreeOpExecutor.cpp
@@ -861,6 +861,9 @@ nsHtml5TreeOpExecutor::InitializeDocWriteParserState(nsAHtml5TreeBuilderState* a
 already_AddRefed<nsIURI>
 nsHtml5TreeOpExecutor::ConvertIfNotPreloadedYet(const nsAString& aURL)
 {
+  if (aURL.IsEmpty()) {
+    return nsnull;
+  }
   // The URL of the document without <base>
   nsIURI* documentURI = mDocument->GetDocumentURI();
   // The URL of the document with non-speculative <base>

From 6d64473cb8592bab7ea2b5b015a663cf61c16b06 Mon Sep 17 00:00:00 2001
From: Alon Zakai <azakai@mozilla.com>
Date: Mon, 19 Sep 2011 09:32:59 -0700
Subject: [PATCH 201/209] Bug 633627 - Fixedpoint division in blur code.
 r=jmuizelaar

---
 gfx/thebes/gfxBlur.cpp | 18 ++++++++++++++----
 1 file changed, 14 insertions(+), 4 deletions(-)

diff --git a/gfx/thebes/gfxBlur.cpp b/gfx/thebes/gfxBlur.cpp
index c9e76c8c8785..8465939e70be 100644
--- a/gfx/thebes/gfxBlur.cpp
+++ b/gfx/thebes/gfxBlur.cpp
@@ -146,6 +146,11 @@ BoxBlurHorizontal(unsigned char* aInput,
     PRInt32 boxSize = aLeftLobe + aRightLobe + 1;
     PRBool skipRectCoversWholeRow = 0 >= aSkipRect.x &&
                                     aWidth <= aSkipRect.XMost();
+    if (boxSize == 1) {
+        memcpy(aOutput, aInput, aWidth*aRows);
+        return;
+    }
+    PRUint32 reciprocal = (PRUint64(1) << 32)/boxSize;
 
     for (PRInt32 y = 0; y < aRows; y++) {
         // Check whether the skip rect intersects this row. If the skip
@@ -158,7 +163,7 @@ BoxBlurHorizontal(unsigned char* aInput,
             continue;
         }
 
-        PRInt32 alphaSum = 0;
+        PRUint32 alphaSum = 0;
         for (PRInt32 i = 0; i < boxSize; i++) {
             PRInt32 pos = i - aLeftLobe;
             // See assertion above; if aWidth is zero, then we would have no
@@ -192,7 +197,7 @@ BoxBlurHorizontal(unsigned char* aInput,
             PRInt32 last = NS_MAX(tmp, 0);
             PRInt32 next = NS_MIN(tmp + boxSize, aWidth - 1);
 
-            aOutput[aWidth * y + x] = alphaSum/boxSize;
+            aOutput[aWidth * y + x] = (PRUint64(alphaSum)*reciprocal) >> 32;
 
             alphaSum += aInput[aWidth * y + next] -
                         aInput[aWidth * y + last];
@@ -219,6 +224,11 @@ BoxBlurVertical(unsigned char* aInput,
     PRInt32 boxSize = aTopLobe + aBottomLobe + 1;
     PRBool skipRectCoversWholeColumn = 0 >= aSkipRect.y &&
                                        aRows <= aSkipRect.YMost();
+    if (boxSize == 1) {
+        memcpy(aOutput, aInput, aWidth*aRows);
+        return;
+    }
+    PRUint32 reciprocal = (PRUint64(1) << 32)/boxSize;
 
     for (PRInt32 x = 0; x < aWidth; x++) {
         PRBool inSkipRectX = x >= aSkipRect.x &&
@@ -228,7 +238,7 @@ BoxBlurVertical(unsigned char* aInput,
             continue;
         }
 
-        PRInt32 alphaSum = 0;
+        PRUint32 alphaSum = 0;
         for (PRInt32 i = 0; i < boxSize; i++) {
             PRInt32 pos = i - aTopLobe;
             // See assertion above; if aRows is zero, then we would have no
@@ -258,7 +268,7 @@ BoxBlurVertical(unsigned char* aInput,
             PRInt32 last = NS_MAX(tmp, 0);
             PRInt32 next = NS_MIN(tmp + boxSize, aRows - 1);
 
-            aOutput[aWidth * y + x] = alphaSum/boxSize;
+            aOutput[aWidth * y + x] = (PRUint64(alphaSum)*reciprocal) >> 32;
 
             alphaSum += aInput[aWidth * next + x] -
                         aInput[aWidth * last + x];

From 096cdc5f6c042e31c9554d319d1e97665061ad69 Mon Sep 17 00:00:00 2001
From: Alon Zakai <azakai@mozilla.com>
Date: Mon, 19 Sep 2011 09:34:32 -0700
Subject: [PATCH 202/209] Bug 633627 - Disable tests that fail with fixedpoint
 blurring. r=roc

---
 layout/reftests/box-shadow/reftest.list | 4 ++--
 layout/reftests/bugs/reftest.list       | 2 +-
 2 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/layout/reftests/box-shadow/reftest.list b/layout/reftests/box-shadow/reftest.list
index ee1d4c33141c..abe0be235474 100644
--- a/layout/reftests/box-shadow/reftest.list
+++ b/layout/reftests/box-shadow/reftest.list
@@ -1,8 +1,8 @@
 == boxshadow-basic.html boxshadow-basic-ref.html
 != boxshadow-blur.html boxshadow-blur-notref.html
 != boxshadow-blur.html boxshadow-blur-notref2.html
-== boxshadow-blur-2.html boxshadow-blur-2-ref.html
-fails-if(Android) != boxshadow-blur-2.html boxshadow-blur-2-notref.html
+random == boxshadow-blur-2.html boxshadow-blur-2-ref.html # fixedpoint division in blur code makes this fail
+random fails-if(Android) != boxshadow-blur-2.html boxshadow-blur-2-notref.html # fixedpoint division in blur code makes this fail
 == boxshadow-multiple.html boxshadow-multiple-ref.html
 == boxshadow-spread.html boxshadow-spread-ref.html
 == tableboxshadow-basic.html tableboxshadow-basic-ref.html
diff --git a/layout/reftests/bugs/reftest.list b/layout/reftests/bugs/reftest.list
index 2eee1aa2f526..824691d7a65e 100644
--- a/layout/reftests/bugs/reftest.list
+++ b/layout/reftests/bugs/reftest.list
@@ -1448,7 +1448,7 @@ asserts(5) == 528038-2.html 528038-2-ref.html # bug 512749
 == 534808-1.html 534808-1-ref.html
 == 534808-2.html 534808-2-ref.html
 == 534919-1.html 534919-1-ref.html
-== 536061.html 536061-ref.html
+random == 536061.html 536061-ref.html # fixedpoint division in blur code makes this fail
 == 537507-1.xul 537507-1-ref.xul
 == 537507-2.html 537507-2-ref.html
 == 537471-1.html 537471-1-ref.html

From 925c9d92d0a57477c41ef4701f1547cbabb95e9f Mon Sep 17 00:00:00 2001
From: Lucas Rocha <lucasr@mozilla.com>
Date: Mon, 19 Sep 2011 09:44:03 -0700
Subject: [PATCH 203/209] Bug 687287 - Fix alignment of close button on
 inactive tabs (r=mfinkle)

Do not force a width on close button container and let the margins define its size. This allows us to have different clickable areas for the close button on both active and inactive tabs.
---
 mobile/chrome/content/tabs.xml | 9 ++-------
 mobile/themes/core/tablet.css  | 8 +++++---
 2 files changed, 7 insertions(+), 10 deletions(-)

diff --git a/mobile/chrome/content/tabs.xml b/mobile/chrome/content/tabs.xml
index 70420436c2bc..add31acfe888 100644
--- a/mobile/chrome/content/tabs.xml
+++ b/mobile/chrome/content/tabs.xml
@@ -39,18 +39,14 @@
         <parameter name="thumbnail"/>
         <body>
           <![CDATA[
-            let tabWidth, tabHeight, closeWidth, closeHeight;
+            let tabWidth, tabHeight;
 
             if (Util.isTablet()) {
               tabWidth = 176;
               tabHeight = 110;
-              closeWidth = 41;
-              closeHeight = 117;
             } else {
               tabWidth = 104;
               tabHeight = 65;
-              closeWidth = 55;
-              closeHeight = 65;
             }
 
             if (tabWidth != thumbnail.width) {
@@ -60,8 +56,7 @@
 
               thumbnail.width = reload.width = title.width = tabWidth;
               thumbnail.height = reload.height = tabHeight;
-              closeContainer.width = closeWidth;
-              closeContainer.height = closeHeight;
+              closeContainer.height = tabHeight;
             }
           ]]>
         </body>
diff --git a/mobile/themes/core/tablet.css b/mobile/themes/core/tablet.css
index b36d1887ee55..7ffe8a2c3434 100644
--- a/mobile/themes/core/tablet.css
+++ b/mobile/themes/core/tablet.css
@@ -68,17 +68,19 @@
 .documenttab-close-container[tablet] {
   left: 0px;
   -moz-margin-end: 0px;
-  -moz-margin-start: 151px;
+  -moz-margin-start: 145px;
   -moz-box-pack: end;
   -moz-box-align: center;
+  -moz-margin-end: -11px;
+  padding-right: 11px;
 }
 
 documenttab[selected="true"] > vbox > stack > .documenttab-close-container[tablet] {
   background: url("chrome://browser/skin/images/close-background-hdpi.png");
   background-repeat: no-repeat;
   background-position: right;
-  -moz-margin-end: -11px;
-  padding-right: 2px;
+  -moz-margin-start: 150px;
+  padding-right: 0px;
 }
 
 .documenttab-close[tablet] {

From 6e045e2b9cc142b026194c87e8bc7c26d9fa819d Mon Sep 17 00:00:00 2001
From: Lucas Rocha <lucasr@mozilla.com>
Date: Mon, 19 Sep 2011 09:45:44 -0700
Subject: [PATCH 204/209] Bug 605365 - Properly update visibility of the
 previously visible popup (r=mfinkle)

ContentPopupHelper is meant to only handle one popup at a time. This means that
if you update the popup (via the popup setter), the previously visible popup
should be properly hidden and released before showing the new popup.
---
 mobile/chrome/content/ContentPopupHelper.js | 40 +++++++++++----------
 1 file changed, 21 insertions(+), 19 deletions(-)

diff --git a/mobile/chrome/content/ContentPopupHelper.js b/mobile/chrome/content/ContentPopupHelper.js
index e3ce131d8aa4..6ea3eefe531e 100644
--- a/mobile/chrome/content/ContentPopupHelper.js
+++ b/mobile/chrome/content/ContentPopupHelper.js
@@ -45,7 +45,27 @@ var ContentPopupHelper = {
     if (!this._popup && !aPopup)
       return;
 
-    if (aPopup) {
+    if (this._popup) {
+      this._popup.hidden = true;
+      this._anchorRect = null;
+
+      window.removeEventListener("TabSelect", this, false);
+      window.removeEventListener("TabClose", this, false);
+      window.removeEventListener("AnimatedZoomBegin", this, false);
+      window.removeEventListener("AnimatedZoomEnd", this, false);
+      window.removeEventListener("MozBeforeResize", this, true);
+      window.removeEventListener("resize", this, false);
+      Elements.browsers.removeEventListener("PanBegin", this, false);
+      Elements.browsers.removeEventListener("PanFinished", this, false);
+
+      let event = document.createEvent("Events");
+      event.initEvent("contentpopuphidden", true, false);
+      this._popup.dispatchEvent(event);
+    }
+
+    this._popup = aPopup;
+
+    if (this._popup) {
       // Keeps the new popup element hidden until it is positioned, but using
       // visibility: 'hidden' instead of display: 'none' will allow to
       // workaround some bugs with arrowscrollbox's arrows that does not
@@ -71,25 +91,7 @@ var ContentPopupHelper = {
       window.addEventListener("resize", this, false);
       Elements.browsers.addEventListener("PanBegin", this, false);
       Elements.browsers.addEventListener("PanFinished", this, false);
-    } else {
-      this._popup.hidden = true;
-      this._anchorRect = null;
-
-      window.removeEventListener("TabSelect", this, false);
-      window.removeEventListener("TabClose", this, false);
-      window.removeEventListener("AnimatedZoomBegin", this, false);
-      window.removeEventListener("AnimatedZoomEnd", this, false);
-      window.removeEventListener("MozBeforeResize", this, true);
-      window.removeEventListener("resize", this, false);
-      Elements.browsers.removeEventListener("PanBegin", this, false);
-      Elements.browsers.removeEventListener("PanFinished", this, false);
-
-      let event = document.createEvent("Events");
-      event.initEvent("contentpopuphidden", true, false);
-      this._popup.dispatchEvent(event);
     }
-
-    this._popup = aPopup;
   },
 
   /**

From ba29cb6bb19a18b3c04f0e13519d05a7f24df8bf Mon Sep 17 00:00:00 2001
From: Lucas Rocha <lucasr@mozilla.com>
Date: Mon, 19 Sep 2011 09:45:52 -0700
Subject: [PATCH 205/209] Bug 605365 - Change Content's formAssistant to be a
 public property (r=mfinkle)

So that we can share the same FormAssistant instance with other components
defined in content.js. Updated chrome tests accordingly.
---
 mobile/chrome/content/content.js           | 12 ++++++------
 mobile/chrome/tests/remote_autocomplete.js |  2 +-
 mobile/chrome/tests/remote_contentpopup.js |  2 +-
 mobile/chrome/tests/remote_forms.js        |  2 +-
 mobile/chrome/tests/remote_formsZoom.js    |  2 +-
 5 files changed, 10 insertions(+), 10 deletions(-)

diff --git a/mobile/chrome/content/content.js b/mobile/chrome/content/content.js
index ff5f3d876965..b47a4fdfbc74 100644
--- a/mobile/chrome/content/content.js
+++ b/mobile/chrome/content/content.js
@@ -254,9 +254,9 @@ function getContentClientRects(aElement) {
 
 
 let Content = {
-  get _formAssistant() {
-    delete this._formAssistant;
-    return this._formAssistant = new FormAssistant();
+  get formAssistant() {
+    delete this.formAssistant;
+    return this.formAssistant = new FormAssistant();
   },
 
   init: function init() {
@@ -490,7 +490,7 @@ let Content = {
       }
 
       case "Browser:MouseClick": {
-        this._formAssistant.focusSync = true;
+        this.formAssistant.focusSync = true;
         let element = elementFromPoint(x, y);
         if (modifiers == Ci.nsIDOMNSEvent.CONTROL_MASK) {
           let uri = Util.getHrefForElement(element);
@@ -500,7 +500,7 @@ let Content = {
           break;
         }
 
-        if (!this._formAssistant.open(element))
+        if (!this.formAssistant.open(element))
           sendAsyncMessage("FindAssist:Hide", { });
 
         if (this._highlightElement) {
@@ -510,7 +510,7 @@ let Content = {
         }
         this._cancelTapHighlight();
         ContextHandler.reset();
-        this._formAssistant.focusSync = false;
+        this.formAssistant.focusSync = false;
         break;
       }
 
diff --git a/mobile/chrome/tests/remote_autocomplete.js b/mobile/chrome/tests/remote_autocomplete.js
index 1b5a6efce299..991671aa6ef4 100644
--- a/mobile/chrome/tests/remote_autocomplete.js
+++ b/mobile/chrome/tests/remote_autocomplete.js
@@ -1,6 +1,6 @@
 dump("====================== Content Script Loaded =======================\n");
 
-let assistant = Content._formAssistant;
+let assistant = Content.formAssistant;
 
 AsyncTests.add("TestRemoteAutocomplete:Click", function(aMessage, aJson) {
   let element = content.document.getElementById(aJson.id);
diff --git a/mobile/chrome/tests/remote_contentpopup.js b/mobile/chrome/tests/remote_contentpopup.js
index a4d816bea2ad..f2156d700c5d 100644
--- a/mobile/chrome/tests/remote_contentpopup.js
+++ b/mobile/chrome/tests/remote_contentpopup.js
@@ -1,6 +1,6 @@
 dump("====================== Content Script Loaded =======================\n");
 
-let assistant = Content._formAssistant;
+let assistant = Content.formAssistant;
 
 AsyncTests.add("TestRemoteAutocomplete:Click", function(aMessage, aJson) {
   let element = content.document.getElementById(aJson.id);
diff --git a/mobile/chrome/tests/remote_forms.js b/mobile/chrome/tests/remote_forms.js
index b3a7349b3e46..36779f5ae150 100644
--- a/mobile/chrome/tests/remote_forms.js
+++ b/mobile/chrome/tests/remote_forms.js
@@ -1,6 +1,6 @@
 dump("====================== Content Script Loaded =======================\n");
 
-let assistant = Content._formAssistant;
+let assistant = Content.formAssistant;
 
 // Copied from http://mxr.mozilla.org/mozilla-central/source/testing/mochitest/tests/SimpleTest/EventUtils.js
 // except the netscape.security.PrivilegeManager.enablePrivilege call
diff --git a/mobile/chrome/tests/remote_formsZoom.js b/mobile/chrome/tests/remote_formsZoom.js
index d8ea0b91be24..74cffac37d9c 100644
--- a/mobile/chrome/tests/remote_formsZoom.js
+++ b/mobile/chrome/tests/remote_formsZoom.js
@@ -1,6 +1,6 @@
 dump("====================== Content Script Loaded =======================\n");
 
-let assistant = Content._formAssistant;
+let assistant = Content.formAssistant;
 
 AsyncTests.add("FormAssist:Show", function(aMessage, aJson) {
   let element = content.document.getElementById(aJson.id);

From ad387e37bc54b03e0b22ff6aae4798205f3e5880 Mon Sep 17 00:00:00 2001
From: Lucas Rocha <lucasr@mozilla.com>
Date: Mon, 19 Sep 2011 09:46:04 -0700
Subject: [PATCH 206/209] Bug 605365 - Show notification for invalid form
 elements (r=mfinkle)

---
 mobile/chrome/content/browser.xul  |  5 ++
 mobile/chrome/content/common-ui.js | 73 ++++++++++++++++++++++++++----
 mobile/chrome/content/content.js   | 31 +++++++++++++
 mobile/chrome/content/forms.js     | 17 +++++++
 4 files changed, 117 insertions(+), 9 deletions(-)

diff --git a/mobile/chrome/content/browser.xul b/mobile/chrome/content/browser.xul
index 9741dcc89045..3073307766e6 100644
--- a/mobile/chrome/content/browser.xul
+++ b/mobile/chrome/content/browser.xul
@@ -548,6 +548,11 @@
 #endif
     </vbox>
 
+    <!-- Form Helper form validation helper popup -->
+    <arrowbox id="form-helper-validation-container" class="arrowbox-dark" flex="1" hidden="true" offset="0" top="0" left="0">
+      <label/>
+    </arrowbox>
+
 #ifdef MOZ_SERVICES_SYNC
     <box id="syncsetup-container" class="perm-modal-block" hidden="true">
       <dialog id="syncsetup-dialog" class="content-dialog" flex="1">
diff --git a/mobile/chrome/content/common-ui.js b/mobile/chrome/content/common-ui.js
index 556c609bae67..07c1f7a8c219 100644
--- a/mobile/chrome/content/common-ui.js
+++ b/mobile/chrome/content/common-ui.js
@@ -671,6 +671,7 @@ var FormHelperUI = {
     messageManager.addMessageListener("FormAssist:Update", this);
     messageManager.addMessageListener("FormAssist:Resize", this);
     messageManager.addMessageListener("FormAssist:AutoComplete", this);
+    messageManager.addMessageListener("FormAssist:ValidationMessage", this);
 
     // Listen for events where form assistant should be closed or updated
     let tabs = Elements.tabList;
@@ -739,12 +740,13 @@ var FormHelperUI = {
       type: aElement.type,
       choices: aElement.choices,
       isAutocomplete: aElement.isAutocomplete,
+      validationMessage: aElement.validationMessage,
       list: aElement.list,
     }
 
     this._updateContainerForSelect(lastElement, this._currentElement);
     this._zoom(Rect.fromRect(aElement.rect), Rect.fromRect(aElement.caretRect));
-    this._updateSuggestionsFor(this._currentElement);
+    this._updatePopupsFor(this._currentElement);
 
     // Prevent the view to scroll automatically while typing
     this._currentBrowser.scrollSync = false;
@@ -828,7 +830,8 @@ var FormHelperUI = {
   },
 
   receiveMessage: function formHelperReceiveMessage(aMessage) {
-    let allowedMessages = ["FormAssist:Show", "FormAssist:Hide", "FormAssist:AutoComplete"];
+    let allowedMessages = ["FormAssist:Show", "FormAssist:Hide",
+                           "FormAssist:AutoComplete", "FormAssist:ValidationMessage"];
     if (!this._open && allowedMessages.indexOf(aMessage.name) == -1)
       return;
 
@@ -845,7 +848,7 @@ var FormHelperUI = {
         } else {
           this._currentElementRect = Rect.fromRect(json.current.rect);
           this._currentBrowser = getBrowser();
-          this._updateSuggestionsFor(json.current);
+          this._updatePopupsFor(json.current);
         }
         break;
 
@@ -866,8 +869,12 @@ var FormHelperUI = {
         this._zoom(Rect.fromRect(element.rect), Rect.fromRect(element.caretRect));
         break;
 
+      case "FormAssist:ValidationMessage":
+        this._updatePopupsFor(json.current, { fromInput: true });
+        break;
+
       case "FormAssist:AutoComplete":
-        this._updateSuggestionsFor(json.current);
+        this._updatePopupsFor(json.current, { fromInput: true });
         break;
 
        case "FormAssist:Update":
@@ -938,12 +945,33 @@ var FormHelperUI = {
     this._container.dispatchEvent(evt);
   },
 
+  _updatePopupsFor: function _formHelperUpdatePopupsFor(aElement, options) {
+    options = options || {};
+
+    let fromInput = 'fromInput' in options && options.fromInput;
+
+    // The order of the updates matters here. If the popup update was
+    // triggered from user input (e.g. key press in an input element),
+    // we first check if there are input suggestions then check for
+    // a validation message. The idea here is that the validation message
+    // will be shown straight away once the invalid element is focused
+    // and suggestions will be shown as user inputs data. Only one popup
+    // is shown at a time. If both are not shown, then we ensure any
+    // previous popups are hidden.
+    let noPopupsShown = fromInput ?
+                        (!this._updateSuggestionsFor(aElement) &&
+                         !this._updateFormValidationFor(aElement)) :
+                        (!this._updateFormValidationFor(aElement) &&
+                         !this._updateSuggestionsFor(aElement));
+
+    if (noPopupsShown)
+      ContentPopupHelper.popup = null;
+  },
+
   _updateSuggestionsFor: function _formHelperUpdateSuggestionsFor(aElement) {
     let suggestions = this._getAutocompleteSuggestions(aElement);
-    if (!suggestions.length) {
-      ContentPopupHelper.popup = null;
-      return;
-    }
+    if (!suggestions.length)
+      return false;
 
     // the scrollX/scrollY position can change because of the animated zoom so
     // delay the suggestions positioning
@@ -952,7 +980,7 @@ var FormHelperUI = {
       this._waitForZoom(function() {
         self._updateSuggestionsFor(aElement);
       });
-      return;
+      return true;
     }
 
     // Declare which box is going to be the inside container of the content popup helper
@@ -974,6 +1002,33 @@ var FormHelperUI = {
 
     ContentPopupHelper.popup = suggestionsContainer;
     ContentPopupHelper.anchorTo(this._currentElementRect);
+
+    return true;
+  },
+
+  _updateFormValidationFor: function _formHelperUpdateFormValidationFor(aElement) {
+    if (!aElement.validationMessage)
+      return false;
+
+    // the scrollX/scrollY position can change because of the animated zoom so
+    // delay the suggestions positioning
+    if (AnimatedZoom.isZooming()) {
+      let self = this;
+      this._waitForZoom(function() {
+        self._updateFormValidationFor(aElement);
+      });
+      return true;
+    }
+
+    let validationContainer = document.getElementById("form-helper-validation-container");
+
+    // Update label with form validation message
+    validationContainer.firstChild.value = aElement.validationMessage;
+
+    ContentPopupHelper.popup = validationContainer;
+    ContentPopupHelper.anchorTo(this._currentElementRect);
+
+    return true;
   },
 
   /** Retrieve the autocomplete list from the autocomplete service for an element */
diff --git a/mobile/chrome/content/content.js b/mobile/chrome/content/content.js
index b47a4fdfbc74..97751e9145a6 100644
--- a/mobile/chrome/content/content.js
+++ b/mobile/chrome/content/content.js
@@ -1047,6 +1047,21 @@ var FormSubmitObserver = {
   init: function init(){
     addMessageListener("Browser:TabOpen", this);
     addMessageListener("Browser:TabClose", this);
+
+    addEventListener("pageshow", this, false);
+
+    Services.obs.addObserver(this, "invalidformsubmit", false);
+  },
+
+  handleEvent: function handleEvent(aEvent) {
+    let target = aEvent.originalTarget;
+    let isRootDocument = (target == content.document || target.ownerDocument == content.document);
+    if (!isRootDocument)
+      return;
+
+    // Reset invalid submit state on each pageshow
+    if (aEvent.type == "pageshow")
+      Content.formAssistant.invalidSubmit = false;
   },
 
   receiveMessage: function findHandlerReceiveMessage(aMessage) {
@@ -1068,6 +1083,22 @@ var FormSubmitObserver = {
       sendAsyncMessage("Browser:FormSubmit", {});
   },
 
+  notifyInvalidSubmit: function notifyInvalidSubmit(aFormElement, aInvalidElements) {
+    if (!aInvalidElements.length)
+      return;
+
+    let element = aInvalidElements.queryElementAt(0, Ci.nsISupports);
+    if (!(element instanceof HTMLInputElement ||
+          element instanceof HTMLTextAreaElement ||
+          element instanceof HTMLSelectElement ||
+          element instanceof HTMLButtonElement)) {
+      return;
+    }
+
+    Content.formAssistant.invalidSubmit = true;
+    Content.formAssistant.open(element);
+  },
+
   QueryInterface : function(aIID) {
     if (!aIID.equals(Ci.nsIFormSubmitObserver) &&
         !aIID.equals(Ci.nsISupportsWeakReference) &&
diff --git a/mobile/chrome/content/forms.js b/mobile/chrome/content/forms.js
index c8c86095f421..1a7a989e12e5 100644
--- a/mobile/chrome/content/forms.js
+++ b/mobile/chrome/content/forms.js
@@ -90,6 +90,8 @@ FormAssistant.prototype = {
   _currentIndex: -1,
   _elements: [],
 
+  invalidSubmit: false,
+
   get currentElement() {
     return this._elements[this._currentIndex];
   },
@@ -353,6 +355,9 @@ FormAssistant.prototype = {
         break;
 
       case "text":
+        if (this._isValidatable(aEvent.target))
+          sendAsyncMessage("FormAssist:ValidationMessage", this._getJSON());
+
         if (this._isAutocomplete(aEvent.target))
           sendAsyncMessage("FormAssist:AutoComplete", this._getJSON());
         break;
@@ -439,6 +444,9 @@ FormAssistant.prototype = {
             break;
 
           default:
+            if (this._isValidatable(aEvent.target))
+              sendAsyncMessage("FormAssist:ValidationMessage", this._getJSON());
+
             if (this._isAutocomplete(aEvent.target))
               sendAsyncMessage("FormAssist:AutoComplete", this._getJSON());
             else if (currentElement && this._isSelectElement(currentElement))
@@ -513,6 +521,14 @@ FormAssistant.prototype = {
     return aElement;
   },
 
+  _isValidatable: function(aElement) {
+    return this.invalidSubmit &&
+           (aElement instanceof HTMLInputElement ||
+            aElement instanceof HTMLTextAreaElement ||
+            aElement instanceof HTMLSelectElement ||
+            aElement instanceof HTMLButtonElement);
+  },
+
   _isAutocomplete: function formHelperIsAutocomplete(aElement) {
     if (aElement instanceof HTMLInputElement) {
       let autocomplete = aElement.getAttribute("autocomplete");
@@ -733,6 +749,7 @@ FormAssistant.prototype = {
         type: (element.getAttribute("type") || "").toLowerCase(),
         choices: choices,
         isAutocomplete: this._isAutocomplete(element),
+        validationMessage: this.invalidSubmit ? element.validationMessage : null,
         list: this._getListSuggestions(element),
         rect: this._getRect(),
         caretRect: this._getCaretRect(),

From 1634ce0ddf9b0a8040ef2df6778e560d608c78c1 Mon Sep 17 00:00:00 2001
From: Lucas Rocha <lucasr@mozilla.com>
Date: Mon, 19 Sep 2011 09:46:11 -0700
Subject: [PATCH 207/209] Bug 605365 - Hide form assistant when focused element
 is blurred (r=mfinkle)

---
 mobile/chrome/content/forms.js | 14 ++++++++++++++
 1 file changed, 14 insertions(+)

diff --git a/mobile/chrome/content/forms.js b/mobile/chrome/content/forms.js
index 1a7a989e12e5..7e74d6f10b61 100644
--- a/mobile/chrome/content/forms.js
+++ b/mobile/chrome/content/forms.js
@@ -77,6 +77,7 @@ function FormAssistant() {
   addEventListener("keypress", this, true);
   addEventListener("keyup", this, false);
   addEventListener("focus", this, true);
+  addEventListener("blur", this, true);
   addEventListener("pageshow", this, false);
   addEventListener("pagehide", this, false);
   addEventListener("submit", this, false);
@@ -354,6 +355,19 @@ FormAssistant.prototype = {
           this.currentIndex = focusedIndex;
         break;
 
+      case "blur":
+        content.setTimeout(function(self) {
+          if (!self._open)
+            return;
+
+          // If the blurring causes focus be in no other element,
+          // we should close the form assistant.
+          let focusedElement = gFocusManager.getFocusedElementForWindow(content, true, {});
+          if (!focusedElement)
+            self.close();
+        }, 0, this);
+        break;
+
       case "text":
         if (this._isValidatable(aEvent.target))
           sendAsyncMessage("FormAssist:ValidationMessage", this._getJSON());

From 2e5703c208e53c799f45fc375be300bbf4150d4e Mon Sep 17 00:00:00 2001
From: Lucas Rocha <lucasr@mozilla.com>
Date: Mon, 19 Sep 2011 09:46:28 -0700
Subject: [PATCH 208/209] Bug 605365 - Use waitForFirstPaint() in content popup
 test (r=mfinkle)

---
 mobile/chrome/tests/browser_contentpopup.js | 9 ++-------
 1 file changed, 2 insertions(+), 7 deletions(-)

diff --git a/mobile/chrome/tests/browser_contentpopup.js b/mobile/chrome/tests/browser_contentpopup.js
index 10cb222cf603..30a4c16a3ad9 100644
--- a/mobile/chrome/tests/browser_contentpopup.js
+++ b/mobile/chrome/tests/browser_contentpopup.js
@@ -20,14 +20,9 @@ function test() {
     }
   });
 
-  let startupInfo = Cc["@mozilla.org/toolkit/app-startup;1"].getService(Ci.nsIAppStartup).getStartupInfo();
-  if (!("firstPaint" in startupInfo))
-    waitFor(function() { newTab = Browser.addTab(testURL, true); }, function() {
-      let startupInfo = Cc["@mozilla.org/toolkit/app-startup;1"].getService(Ci.nsIAppStartup).getStartupInfo();
-      return ("firstPaint" in startupInfo);
-    }, Date.now() + 3000);
-  else
+  waitForFirstPaint(function() {
     newTab = Browser.addTab(testURL, true);
+  });
 }
 
 //------------------------------------------------------------------------------

From 2ee86a1e11624e7e22fd7be495cfa1275046f0e4 Mon Sep 17 00:00:00 2001
From: Lucas Rocha <lucasr@mozilla.com>
Date: Mon, 19 Sep 2011 09:46:35 -0700
Subject: [PATCH 209/209] Bug 605365 - Fix typo in browser_contentpopup.js and
 browser_forms.js (r=mfinkle)

---
 mobile/chrome/tests/browser_contentpopup.js | 2 +-
 mobile/chrome/tests/browser_forms.js        | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/mobile/chrome/tests/browser_contentpopup.js b/mobile/chrome/tests/browser_contentpopup.js
index 30a4c16a3ad9..305a7bf0f78e 100644
--- a/mobile/chrome/tests/browser_contentpopup.js
+++ b/mobile/chrome/tests/browser_contentpopup.js
@@ -43,7 +43,7 @@ function runNextTest() {
       Browser.closeTab(newTab);
     }
     finally {
-      // We must finialize the tests
+      // We must finalize the tests
       finish();
     }
   }
diff --git a/mobile/chrome/tests/browser_forms.js b/mobile/chrome/tests/browser_forms.js
index a956cb825e03..37589eb19b07 100644
--- a/mobile/chrome/tests/browser_forms.js
+++ b/mobile/chrome/tests/browser_forms.js
@@ -27,7 +27,7 @@ function onTabLoaded() {
 function testMouseEvents() {
   // Sending a synthesized event directly on content should not work - we
   // don't want web content to be able to open the form helper without the
-  // user consent, so we have to pass throught the canvas tile-container
+  // user consent, so we have to pass through the canvas tile-container
   AsyncTests.waitFor("Test:Click", {}, function(json) {
     is(json.result, false, "Form Assistant should stay closed");
   });