diff --git a/b2g/app/nsBrowserApp.cpp b/b2g/app/nsBrowserApp.cpp
index b7fcea85f5d9..e7fcc431a5e4 100644
--- a/b2g/app/nsBrowserApp.cpp
+++ b/b2g/app/nsBrowserApp.cpp
@@ -34,7 +34,7 @@
 #endif
 
 #ifdef MOZ_WIDGET_GONK
-#include "GonkDisplay.h"
+#include "BootAnimation.h"
 #endif
 
 #include "BinaryPath.h"
@@ -148,8 +148,8 @@ static int do_main(int argc, char* argv[])
   }
 
 #ifdef MOZ_WIDGET_GONK
-  /* Called to start the boot animation */
-  (void) mozilla::GetGonkDisplay();
+  /* Start boot animation */
+  mozilla::StartBootAnimation();
 #endif
 
   if (appini) {
diff --git a/b2g/components/AboutServiceWorkers.jsm b/b2g/components/AboutServiceWorkers.jsm
index 220d8c69cac7..ff55e7fcbaea 100644
--- a/b2g/components/AboutServiceWorkers.jsm
+++ b/b2g/components/AboutServiceWorkers.jsm
@@ -130,7 +130,16 @@ this.AboutServiceWorkers = {
           self.sendError(message.id, "MissingScope");
           return;
         }
-        gServiceWorkerManager.softUpdate(message.scope);
+
+        if (!message.principal ||
+            !message.principal.originAttributes) {
+          // XXX This will always error until bug 1171915 is fixed.
+          self.sendError(message.id, "MissingOriginAttributes");
+          return;
+        }
+
+        gServiceWorkerManager.propagateSoftUpdate({},
+                                                  message.scope);
         self.sendResult(message.id, true);
         break;
 
@@ -166,9 +175,9 @@ this.AboutServiceWorkers = {
             Ci.nsIServiceWorkerUnregisterCallback
           ])
         };
-        gServiceWorkerManager.unregister(principal,
-                                         serviceWorkerUnregisterCallback,
-                                         message.scope);
+        gServiceWorkerManager.propagateUnregister(principal,
+                                                  serviceWorkerUnregisterCallback,
+                                                  message.scope);
         break;
     }
   }
diff --git a/b2g/components/test/unit/test_aboutserviceworkers.js b/b2g/components/test/unit/test_aboutserviceworkers.js
index c6fbe4462760..56273f1ce27d 100644
--- a/b2g/components/test/unit/test_aboutserviceworkers.js
+++ b/b2g/components/test/unit/test_aboutserviceworkers.js
@@ -128,12 +128,15 @@ add_test(function test_swm() {
                 "SWM.getAllRegistrations exists");
   do_check_true(typeof gServiceWorkerManager.getAllRegistrations == "function",
                 "SWM.getAllRegistrations is a function");
-  do_check_true(gServiceWorkerManager.softUpdate, "SWM.softUpdate exists");
-  do_check_true(typeof gServiceWorkerManager.softUpdate == "function",
-                "SWM.softUpdate is a function");
-  do_check_true(gServiceWorkerManager.unregister, "SWM.unregister exists");
-  do_check_true(typeof gServiceWorkerManager.unregister == "function",
-                "SWM.unregister exists");
+  do_check_true(gServiceWorkerManager.propagateSoftUpdate,
+                "SWM.propagateSoftUpdate exists");
+  do_check_true(typeof gServiceWorkerManager.propagateSoftUpdate == "function",
+
+                "SWM.propagateSoftUpdate is a function");
+  do_check_true(gServiceWorkerManager.propagateUnregister,
+                "SWM.propagateUnregister exists");
+  do_check_true(typeof gServiceWorkerManager.propagateUnregister == "function",
+                "SWM.propagateUnregister exists");
 
   run_next_test();
 });
diff --git a/browser/app/profile/firefox.js b/browser/app/profile/firefox.js
index 5f957ff66bd3..1d81509b584e 100644
--- a/browser/app/profile/firefox.js
+++ b/browser/app/profile/firefox.js
@@ -270,7 +270,7 @@ pref("general.autoScroll", true);
 // At startup, check if we're the default browser and prompt user if not.
 pref("browser.shell.checkDefaultBrowser", true);
 pref("browser.shell.shortcutFavicons",true);
-pref("browser.shell.isSetAsDefaultBrowser", false);
+pref("browser.shell.mostRecentDateSetAsDefault", "");
 
 // 0 = blank, 1 = home (browser.startup.homepage), 2 = last visited page, 3 = resume previous browser session
 // The behavior of option 3 is detailed at: http://wiki.mozilla.org/Session_Restore
@@ -1462,6 +1462,7 @@ pref("devtools.performance.ui.flatten-tree-recursion", true);
 pref("devtools.performance.ui.show-platform-data", false);
 pref("devtools.performance.ui.show-idle-blocks", true);
 pref("devtools.performance.ui.enable-memory", false);
+pref("devtools.performance.ui.enable-allocations", false);
 pref("devtools.performance.ui.enable-framerate", true);
 pref("devtools.performance.ui.show-jit-optimizations", false);
 
@@ -1487,6 +1488,15 @@ pref("devtools.netmonitor.panes-network-details-height", 450);
 pref("devtools.netmonitor.statistics", true);
 pref("devtools.netmonitor.filters", "[\"all\"]");
 
+// The default Network monitor HAR export setting
+pref("devtools.netmonitor.har.defaultLogDir", "");
+pref("devtools.netmonitor.har.defaultFileName", "archive");
+pref("devtools.netmonitor.har.jsonp", false);
+pref("devtools.netmonitor.har.jsonpCallback", "");
+pref("devtools.netmonitor.har.includeResponseBodies", true);
+pref("devtools.netmonitor.har.compress", false);
+pref("devtools.netmonitor.har.forceExport", false);
+
 // Enable the Tilt inspector
 pref("devtools.tilt.enabled", true);
 pref("devtools.tilt.intro_transition", true);
diff --git a/browser/base/content/aboutNetError.xhtml b/browser/base/content/aboutNetError.xhtml
index c061e8cdcdb2..5bac3a79e73e 100644
--- a/browser/base/content/aboutNetError.xhtml
+++ b/browser/base/content/aboutNetError.xhtml
@@ -112,6 +112,12 @@
                 .addEventListener('click', function togglePanelVisibility() {
           var panel = document.getElementById('certificateErrorReportingPanel');
           toggleDisplay(panel);
+
+          if (panel.style.display == "block") {
+            // send event to trigger telemetry ping
+            var event = new CustomEvent("AboutNetErrorUIExpanded", {bubbles:true});
+            document.dispatchEvent(event);
+          }
         });
       }
 
diff --git a/browser/base/content/browser-doctype.inc b/browser/base/content/browser-doctype.inc
index cc1fb950f452..ad08f4b03464 100644
--- a/browser/base/content/browser-doctype.inc
+++ b/browser/base/content/browser-doctype.inc
@@ -3,8 +3,6 @@
 %brandDTD;
 <!ENTITY % browserDTD SYSTEM "chrome://browser/locale/browser.dtd" >
 %browserDTD;
-<!ENTITY % browserPocketDTD SYSTEM "chrome://browser/content/browser-pocket.dtd" >
-%browserPocketDTD;
 <!ENTITY % baseMenuDTD SYSTEM "chrome://browser/locale/baseMenuOverlay.dtd" >
 %baseMenuDTD;
 <!ENTITY % charsetDTD SYSTEM "chrome://global/locale/charsetMenu.dtd" >
diff --git a/browser/base/content/browser-fullScreen.js b/browser/base/content/browser-fullScreen.js
index acbf87902ace..1dce6cba7bf1 100644
--- a/browser/base/content/browser-fullScreen.js
+++ b/browser/base/content/browser-fullScreen.js
@@ -7,14 +7,17 @@ var FullScreen = {
   _XULNS: "http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul",
 
   _MESSAGES: [
-    "DOMFullscreen:Entered",
+    "DOMFullscreen:Request",
     "DOMFullscreen:NewOrigin",
-    "DOMFullscreen:Exited"
+    "DOMFullscreen:Exited",
   ],
 
   init: function() {
     // called when we go into full screen, even if initiated by a web page script
     window.addEventListener("fullscreen", this, true);
+    window.addEventListener("MozDOMFullscreen:Entered", this,
+                            /* useCapture */ true,
+                            /* wantsUntrusted */ false);
     window.addEventListener("MozDOMFullscreen:Exited", this,
                             /* useCapture */ true,
                             /* wantsUntrusted */ false);
@@ -33,13 +36,9 @@ var FullScreen = {
     this.cleanup();
   },
 
-  toggle: function (event) {
+  toggle: function () {
     var enterFS = window.fullScreen;
 
-    // We get the fullscreen event _before_ the window transitions into or out of FS mode.
-    if (event && event.type == "fullscreen")
-      enterFS = !enterFS;
-
     // Toggle the View:FullScreen command, which controls elements like the
     // fullscreen menuitem, and menubars.
     let fullscreenCommand = document.getElementById("View:FullScreen");
@@ -106,12 +105,41 @@ var FullScreen = {
         }
         break;
       case "fullscreen":
-        this.toggle(event);
+        this.toggle();
         break;
       case "transitionend":
         if (event.propertyName == "opacity")
           this.cancelWarning();
         break;
+      case "MozDOMFullscreen:Entered": {
+        // The original target is the element which requested the DOM
+        // fullscreen. If we were entering DOM fullscreen for a remote
+        // browser, this element would be that browser element, which
+        // was the parameter of `remoteFrameFullscreenChanged` call.
+        // If the fullscreen request was initiated from an in-process
+        // browser, we need to get its corresponding browser element.
+        let originalTarget = event.originalTarget;
+        let browser;
+        if (this._isBrowser(originalTarget)) {
+          browser = originalTarget;
+        } else {
+          let topWin = originalTarget.ownerDocument.defaultView.top;
+          browser = gBrowser.getBrowserForContentWindow(topWin);
+          if (!browser) {
+            document.mozCancelFullScreen();
+            break;
+          }
+        }
+        this.enterDomFullscreen(browser);
+        // If it is a remote browser, send a message to ask the content
+        // to enter fullscreen state. We don't need to do so if it is an
+        // in-process browser, since all related document should have
+        // entered fullscreen state at this point.
+        if (this._isRemoteBrowser(browser)) {
+          browser.messageManager.sendAsyncMessage("DOMFullscreen:Entered");
+        }
+        break;
+      }
       case "MozDOMFullscreen:Exited":
         this.cleanupDomFullscreen();
         break;
@@ -121,16 +149,8 @@ var FullScreen = {
   receiveMessage: function(aMessage) {
     let browser = aMessage.target;
     switch (aMessage.name) {
-      case "DOMFullscreen:Entered": {
-        // If we're a multiprocess browser, then the request to enter
-        // fullscreen did not bubble up to the root browser document -
-        // it stopped at the root of the content document. That means
-        // we have to kick off the switch to fullscreen here at the
-        // operating system level in the parent process ourselves.
-        if (this._isRemoteBrowser(browser)) {
-          this._windowUtils.remoteFrameFullscreenChanged(browser);
-        }
-        this.enterDomFullscreen(browser);
+      case "DOMFullscreen:Request": {
+        this._windowUtils.remoteFrameFullscreenChanged(browser);
         break;
       }
       case "DOMFullscreen:NewOrigin": {
@@ -192,7 +212,7 @@ var FullScreen = {
   },
 
   cleanup: function () {
-    if (window.fullScreen) {
+    if (!window.fullScreen) {
       MousePosTracker.removeListener(this);
       document.removeEventListener("keypress", this._keyToggleCallback, false);
       document.removeEventListener("popupshown", this._setPopupOpen, false);
@@ -220,6 +240,13 @@ var FullScreen = {
           .broadcastAsyncMessage("DOMFullscreen:CleanUp");
   },
 
+  _isBrowser: function (aNode) {
+    if (aNode.tagName != "xul:browser") {
+      return false;
+    }
+    let systemPrincipal = Services.scriptSecurityManager.getSystemPrincipal();
+    return aNode.nodePrincipal == systemPrincipal;
+  },
   _isRemoteBrowser: function (aBrowser) {
     return gMultiProcessBrowser && aBrowser.getAttribute("remote") == "true";
   },
diff --git a/browser/base/content/browser-menubar.inc b/browser/base/content/browser-menubar.inc
index 883761c5c3cf..0dccfb835d82 100644
--- a/browser/base/content/browser-menubar.inc
+++ b/browser/base/content/browser-menubar.inc
@@ -543,7 +543,8 @@
                             observes="devtoolsMenuBroadcaster_BrowserToolbox"
                             accesskey="&browserToolboxMenu.accesskey;"/>
                   <menuitem id="menu_browserContentToolbox"
-                            observes="devtoolsMenuBroadcaster_BrowserContentToolbox"/>
+                            observes="devtoolsMenuBroadcaster_BrowserContentToolbox"
+                            accesskey="&browserContentToolboxMenu.accesskey;" />
                   <menuitem id="menu_browserConsole"
                             observes="devtoolsMenuBroadcaster_BrowserConsole"
                             accesskey="&browserConsoleCmd.accesskey;"/>
diff --git a/browser/base/content/browser-places.js b/browser/base/content/browser-places.js
index a8ae76c91a49..d219f9a81fc1 100644
--- a/browser/base/content/browser-places.js
+++ b/browser/base/content/browser-places.js
@@ -1563,25 +1563,6 @@ let BookmarkingUI = {
 
   updatePocketItemVisibility: function BUI_updatePocketItemVisibility(prefix) {
     let hidden = !CustomizableUI.getPlacementOfWidget("pocket-button");
-    if (!hidden) {
-      let locale = Cc["@mozilla.org/chrome/chrome-registry;1"].
-                   getService(Ci.nsIXULChromeRegistry).
-                   getSelectedLocale("browser");
-      if (locale != "en-US") {
-        if (locale == "ja-JP-mac")
-          locale = "ja";
-        let url = "chrome://browser/content/browser-pocket-" + locale + ".properties";
-        let bundle = Services.strings.createBundle(url);
-        let item = document.getElementById(prefix + "pocket");
-        try {
-          item.setAttribute("label", bundle.GetStringFromName("pocketMenuitem.label"));
-        } catch (err) {
-          // GetStringFromName throws when the bundle doesn't exist.  In that
-          // case, the item will retain the browser-pocket.dtd en-US string that
-          // it has in the markup.
-        }
-      }
-    }
     document.getElementById(prefix + "pocket").hidden = hidden;
     document.getElementById(prefix + "pocketSeparator").hidden = hidden;
   },
diff --git a/browser/base/content/browser-pocket-de.properties b/browser/base/content/browser-pocket-de.properties
deleted file mode 100644
index 77f3917b7575..000000000000
--- a/browser/base/content/browser-pocket-de.properties
+++ /dev/null
@@ -1,16 +0,0 @@
-# This Source Code Form is subject to the terms of the Mozilla Public
-# License, v. 2.0. If a copy of the MPL was not distributed with this
-# file, You can obtain one at http://mozilla.org/MPL/2.0/.
-
-# This is a temporary file, later versions of Firefox will use
-# browser.properties in the usual L10N location.
-
-pocket-button.label = Pocket
-pocket-button.tooltiptext = Bei Pocket speichern
-
-# From browser-pocket.dtd
-saveToPocketCmd.label = Seite bei Pocket speichern
-saveToPocketCmd.accesskey = k
-saveLinkToPocketCmd.label = Link bei Pocket speichern
-saveLinkToPocketCmd.accesskey = o
-pocketMenuitem.label = Pocket-Liste anzeigen
diff --git a/browser/base/content/browser-pocket-es-ES.properties b/browser/base/content/browser-pocket-es-ES.properties
deleted file mode 100644
index 419e1cbbfed3..000000000000
--- a/browser/base/content/browser-pocket-es-ES.properties
+++ /dev/null
@@ -1,16 +0,0 @@
-# This Source Code Form is subject to the terms of the Mozilla Public
-# License, v. 2.0. If a copy of the MPL was not distributed with this
-# file, You can obtain one at http://mozilla.org/MPL/2.0/.
-
-# This is a temporary file, later versions of Firefox will use
-# browser.properties in the usual L10N location.
-
-pocket-button.label = Pocket
-pocket-button.tooltiptext = Guardar en Pocket
-
-# From browser-pocket.dtd
-saveToPocketCmd.label = Guardar página en Pocket
-saveToPocketCmd.accesskey = k
-saveLinkToPocketCmd.label = Guardar enlace en Pocket
-saveLinkToPocketCmd.accesskey = k
-pocketMenuitem.label = Ver lista de Pocket
diff --git a/browser/base/content/browser-pocket-ja.properties b/browser/base/content/browser-pocket-ja.properties
deleted file mode 100644
index 94c85ee6114f..000000000000
--- a/browser/base/content/browser-pocket-ja.properties
+++ /dev/null
@@ -1,16 +0,0 @@
-# This Source Code Form is subject to the terms of the Mozilla Public
-# License, v. 2.0. If a copy of the MPL was not distributed with this
-# file, You can obtain one at http://mozilla.org/MPL/2.0/.
-
-# This is a temporary file, later versions of Firefox will use
-# browser.properties in the usual L10N location.
-
-pocket-button.label = Pocket
-pocket-button.tooltiptext = Pocket に保存
-
-# From browser-pocket.dtd
-saveToPocketCmd.label = Pocket にページを保存
-saveToPocketCmd.accesskey = k
-saveLinkToPocketCmd.label = Pocket にリンクを保存
-saveLinkToPocketCmd.accesskey = o
-pocketMenuitem.label = Pocket のマイリストを表示
diff --git a/browser/base/content/browser-pocket-ru.properties b/browser/base/content/browser-pocket-ru.properties
deleted file mode 100644
index 840e6de8c6fe..000000000000
--- a/browser/base/content/browser-pocket-ru.properties
+++ /dev/null
@@ -1,16 +0,0 @@
-# This Source Code Form is subject to the terms of the Mozilla Public
-# License, v. 2.0. If a copy of the MPL was not distributed with this
-# file, You can obtain one at http://mozilla.org/MPL/2.0/.
-
-# This is a temporary file, later versions of Firefox will use
-# browser.properties in the usual L10N location.
-
-pocket-button.label = Pocket
-pocket-button.tooltiptext = Сохранить в Pocket
-
-# From browser-pocket.dtd
-saveToPocketCmd.label = Сохранить страницу в Pocket
-saveToPocketCmd.accesskey = х
-saveLinkToPocketCmd.label = Сохранить ссылку в Pocket
-saveLinkToPocketCmd.accesskey = а
-pocketMenuitem.label = Показать список Pocket
diff --git a/browser/base/content/browser-pocket.dtd b/browser/base/content/browser-pocket.dtd
deleted file mode 100644
index 460866f777ba..000000000000
--- a/browser/base/content/browser-pocket.dtd
+++ /dev/null
@@ -1,12 +0,0 @@
-<!-- This Source Code Form is subject to the terms of the Mozilla Public
-   - License, v. 2.0. If a copy of the MPL was not distributed with this
-   - file, You can obtain one at http://mozilla.org/MPL/2.0/. -->
-
-<!-- This is a temporary file and not meant for localization; later versions
-   - of Firefox include these strings in browser.dtd -->
-
-<!ENTITY saveToPocketCmd.label     "Save Page to Pocket">
-<!ENTITY saveToPocketCmd.accesskey "k">
-<!ENTITY saveLinkToPocketCmd.label     "Save Link to Pocket">
-<!ENTITY saveLinkToPocketCmd.accesskey "o">
-<!ENTITY pocketMenuitem.label      "View Pocket List">
diff --git a/browser/base/content/browser.css b/browser/base/content/browser.css
index 079f1bf56173..7e9bd61cb862 100644
--- a/browser/base/content/browser.css
+++ b/browser/base/content/browser.css
@@ -1291,3 +1291,7 @@ toolbarpaletteitem[place="palette"][hidden] {
 .popup-notification-footer[popupid="bad-content"][trackingblockdisabled] {
   display: block;
 }
+
+#login-fill-doorhanger:not([inDetailView]) > #login-fill-clickcapturer {
+  pointer-events: none;
+}
diff --git a/browser/base/content/browser.js b/browser/base/content/browser.js
index 7628d98f2e97..e920328c2c27 100644
--- a/browser/base/content/browser.js
+++ b/browser/base/content/browser.js
@@ -220,9 +220,6 @@ XPCOMUtils.defineLazyModuleGetter(this, "SitePermissions",
 XPCOMUtils.defineLazyModuleGetter(this, "SessionStore",
   "resource:///modules/sessionstore/SessionStore.jsm");
 
-XPCOMUtils.defineLazyModuleGetter(this, "TabState",
-  "resource:///modules/sessionstore/TabState.jsm");
-
 XPCOMUtils.defineLazyModuleGetter(this, "fxAccounts",
   "resource://gre/modules/FxAccounts.jsm");
 
@@ -921,22 +918,7 @@ function _loadURIWithFlags(browser, uri, params) {
 // process
 function LoadInOtherProcess(browser, loadOptions, historyIndex = -1) {
   let tab = gBrowser.getTabForBrowser(browser);
-  // Flush the tab state before getting it
-  TabState.flush(browser);
-  let tabState = JSON.parse(SessionStore.getTabState(tab));
-
-  if (historyIndex < 0) {
-    tabState.userTypedValue = null;
-    // Tell session history the new page to load
-    SessionStore._restoreTabAndLoad(tab, JSON.stringify(tabState), loadOptions);
-  }
-  else {
-    // Update the history state to point to the requested index
-    tabState.index = historyIndex + 1;
-    // SessionStore takes care of setting the browser remoteness before restoring
-    // history into it.
-    SessionStore.setTabState(tab, JSON.stringify(tabState));
-  }
+  SessionStore.navigateAndRestore(tab, loadOptions, historyIndex);
 }
 
 // Called when a docshell has attempted to load a page in an incorrect process.
@@ -2692,6 +2674,12 @@ let gMenuButtonUpdateBadge = {
   }
 };
 
+// Values for telemtery bins: see TLS_ERROR_REPORT_UI in Histograms.json
+const TLS_ERROR_REPORT_TELEMETRY_AUTO_CHECKED   = 2;
+const TLS_ERROR_REPORT_TELEMETRY_AUTO_UNCHECKED = 3;
+const TLS_ERROR_REPORT_TELEMETRY_MANUAL_SEND    = 4;
+const TLS_ERROR_REPORT_TELEMETRY_AUTO_SEND      = 5;
+
 /**
  * Handle command events bubbling up from error page content
  * or from about:newtab or from remote error pages that invoke
@@ -2705,6 +2693,7 @@ let BrowserOnClick = {
     mm.addMessageListener("Browser:EnableOnlineMode", this);
     mm.addMessageListener("Browser:SendSSLErrorReport", this);
     mm.addMessageListener("Browser:SetSSLErrorReportAuto", this);
+    mm.addMessageListener("Browser:SSLErrorReportTelemetry", this);
   },
 
   uninit: function () {
@@ -2714,6 +2703,7 @@ let BrowserOnClick = {
     mm.removeMessageListener("Browser:EnableOnlineMode", this);
     mm.removeMessageListener("Browser:SendSSLErrorReport", this);
     mm.removeMessageListener("Browser:SetSSLErrorReportAuto", this);
+    mm.removeMessageListener("Browser:SSLErrorReportTelemetry", this);
   },
 
   handleEvent: function (event) {
@@ -2760,6 +2750,16 @@ let BrowserOnClick = {
       break;
       case "Browser:SetSSLErrorReportAuto":
         Services.prefs.setBoolPref("security.ssl.errorReporting.automatic", msg.json.automatic);
+        let bin = TLS_ERROR_REPORT_TELEMETRY_AUTO_UNCHECKED;
+        if (msg.json.automatic) {
+          bin = TLS_ERROR_REPORT_TELEMETRY_AUTO_CHECKED;
+        }
+        Services.telemetry.getHistogramById("TLS_ERROR_REPORT_UI").add(bin);
+      break;
+      case "Browser:SSLErrorReportTelemetry":
+        let reportStatus = msg.data.reportStatus;
+        Services.telemetry.getHistogramById("TLS_ERROR_REPORT_UI")
+          .add(reportStatus);
       break;
     }
   },
@@ -2781,6 +2781,12 @@ let BrowserOnClick = {
       return;
     }
 
+    let bin = TLS_ERROR_REPORT_TELEMETRY_MANUAL_SEND;
+    if (Services.prefs.getBoolPref("security.ssl.errorReporting.automatic")) {
+      bin = TLS_ERROR_REPORT_TELEMETRY_AUTO_SEND;
+    }
+    Services.telemetry.getHistogramById("TLS_ERROR_REPORT_UI").add(bin);
+
     let serhelper = Cc["@mozilla.org/network/serialization-helper;1"]
                            .getService(Ci.nsISerializationHelper);
     let transportSecurityInfo = serhelper.deserializeObject(securityInfo);
@@ -6579,23 +6585,6 @@ var gIdentityHandler = {
   _mode : "unknownIdentity",
 
   // smart getters
-  get _encryptionLabel () {
-    delete this._encryptionLabel;
-    this._encryptionLabel = {};
-    this._encryptionLabel[this.IDENTITY_MODE_DOMAIN_VERIFIED] =
-      gNavigatorBundle.getString("identity.encrypted2");
-    this._encryptionLabel[this.IDENTITY_MODE_IDENTIFIED] =
-      gNavigatorBundle.getString("identity.encrypted2");
-    this._encryptionLabel[this.IDENTITY_MODE_UNKNOWN] =
-      gNavigatorBundle.getString("identity.unencrypted");
-    this._encryptionLabel[this.IDENTITY_MODE_MIXED_DISPLAY_LOADED] =
-      gNavigatorBundle.getString("identity.broken_loaded");
-    this._encryptionLabel[this.IDENTITY_MODE_MIXED_ACTIVE_LOADED] =
-      gNavigatorBundle.getString("identity.mixed_active_loaded2");
-    this._encryptionLabel[this.IDENTITY_MODE_MIXED_DISPLAY_LOADED_ACTIVE_BLOCKED] =
-      gNavigatorBundle.getString("identity.broken_loaded");
-    return this._encryptionLabel;
-  },
   get _identityPopup () {
     delete this._identityPopup;
     return this._identityPopup = document.getElementById("identity-popup");
@@ -6609,11 +6598,6 @@ var gIdentityHandler = {
     return this._identityPopupContentBox =
       document.getElementById("identity-popup-content-box");
   },
-  get _identityPopupChromeLabel () {
-    delete this._identityPopupChromeLabel;
-    return this._identityPopupChromeLabel =
-      document.getElementById("identity-popup-chromeLabel");
-  },
   get _identityPopupContentHost () {
     delete this._identityPopupContentHost;
     return this._identityPopupContentHost =
@@ -6634,11 +6618,6 @@ var gIdentityHandler = {
     return this._identityPopupContentVerif =
       document.getElementById("identity-popup-content-verifier");
   },
-  get _identityPopupEncLabel () {
-    delete this._identityPopupEncLabel;
-    return this._identityPopupEncLabel =
-      document.getElementById("identity-popup-encryption-label");
-  },
   get _identityIconLabel () {
     delete this._identityIconLabel;
     return this._identityIconLabel = document.getElementById("identity-icon-label");
@@ -6956,25 +6935,32 @@ var gIdentityHandler = {
     this._identityPopup.className = newMode;
     this._identityPopupContentBox.className = newMode;
 
-    // Set the static strings up front
-    this._identityPopupEncLabel.textContent = this._encryptionLabel[newMode];
-
     // Initialize the optional strings to empty values
     let supplemental = "";
     let verifier = "";
     let host = "";
     let owner = "";
 
+    if (newMode == this.IDENTITY_MODE_CHROMEUI) {
+      let brandBundle = document.getElementById("bundle_brand");
+      host = brandBundle.getString("brandFullName");
+    } else {
+      try {
+        host = this.getEffectiveHost();
+      } catch (e) {
+        // Some URIs might have no hosts.
+        host = this._lastUri.specIgnoringRef;
+      }
+    }
+
     switch (newMode) {
     case this.IDENTITY_MODE_DOMAIN_VERIFIED:
-      host = this.getEffectiveHost();
       verifier = this._identityBox.tooltipText;
       break;
     case this.IDENTITY_MODE_IDENTIFIED: {
       // If it's identified, then we can populate the dialog with credentials
       let iData = this.getIdentityData();
-      host = this.getEffectiveHost();
-      owner = iData.subjectOrg;
+      host = owner = iData.subjectOrg;
       verifier = this._identityBox.tooltipText;
 
       // Build an appropriate supplemental block out of whatever location data we have
@@ -6987,17 +6973,21 @@ var gIdentityHandler = {
         supplemental += iData.state;
       else if (iData.country) // Country only
         supplemental += iData.country;
-      break; }
-    case this.IDENTITY_MODE_CHROMEUI: {
-      let brandBundle = document.getElementById("bundle_brand");
-      let brandShortName = brandBundle.getString("brandShortName");
-      this._identityPopupChromeLabel.textContent = gNavigatorBundle.getFormattedString("identity.chrome",
-                                                                                       [brandShortName]);
-      break; }
+      break;
+    }
+    case this.IDENTITY_MODE_MIXED_DISPLAY_LOADED:
+    case this.IDENTITY_MODE_MIXED_DISPLAY_LOADED_ACTIVE_BLOCKED:
+      supplemental = gNavigatorBundle.getString("identity.broken_loaded");
+      break;
+    case this.IDENTITY_MODE_MIXED_ACTIVE_LOADED:
+      supplemental = gNavigatorBundle.getString("identity.mixed_active_loaded2");
+      break;
     }
 
-    // Push the appropriate strings out to the UI
-    this._identityPopupContentHost.textContent = host;
+    // Push the appropriate strings out to the UI. Need to use |value| for the
+    // host as it's a <label> that will be cropped if too long. Using
+    // |textContent| would simply wrap the value.
+    this._identityPopupContentHost.value = host;
     this._identityPopupContentOwner.textContent = owner;
     this._identityPopupContentSupp.textContent = supplemental;
     this._identityPopupContentVerif.textContent = verifier;
diff --git a/browser/base/content/content.js b/browser/base/content/content.js
index 61f17691cc3c..e9bbbe886619 100644
--- a/browser/base/content/content.js
+++ b/browser/base/content/content.js
@@ -177,11 +177,18 @@ Cc["@mozilla.org/eventlistenerservice;1"]
   .getService(Ci.nsIEventListenerService)
   .addSystemEventListener(global, "contextmenu", handleContentContextMenu, false);
 
+// Values for telemtery bins: see TLS_ERROR_REPORT_UI in Histograms.json
+const TLS_ERROR_REPORT_TELEMETRY_UI_SHOWN = 0;
+const TLS_ERROR_REPORT_TELEMETRY_EXPANDED = 1;
+const TLS_ERROR_REPORT_TELEMETRY_SUCCESS  = 6;
+const TLS_ERROR_REPORT_TELEMETRY_FAILURE  = 7;
+
 let AboutNetErrorListener = {
   init: function(chromeGlobal) {
     chromeGlobal.addEventListener('AboutNetErrorLoad', this, false, true);
     chromeGlobal.addEventListener('AboutNetErrorSetAutomatic', this, false, true);
     chromeGlobal.addEventListener('AboutNetErrorSendReport', this, false, true);
+    chromeGlobal.addEventListener('AboutNetErrorUIExpanded', this, false, true);
   },
 
   get isAboutNetError() {
@@ -203,6 +210,10 @@ let AboutNetErrorListener = {
     case "AboutNetErrorSendReport":
       this.onSendReport(aEvent);
       break;
+    case "AboutNetErrorUIExpanded":
+      sendAsyncMessage("Browser:SSLErrorReportTelemetry",
+                       {reportStatus: TLS_ERROR_REPORT_TELEMETRY_EXPANDED});
+      break;
     }
   },
 
@@ -215,6 +226,10 @@ let AboutNetErrorListener = {
             })
           }
     ));
+
+    sendAsyncMessage("Browser:SSLErrorReportTelemetry",
+                     {reportStatus: TLS_ERROR_REPORT_TELEMETRY_UI_SHOWN});
+
     if (automatic) {
       this.onSendReport(evt);
     }
@@ -259,11 +274,15 @@ let AboutNetErrorListener = {
           // show the retry button
           retryBtn.style.removeProperty("display");
           reportSendingMsg.style.display = "none";
+          sendAsyncMessage("Browser:SSLErrorReportTelemetry",
+                           {reportStatus: TLS_ERROR_REPORT_TELEMETRY_FAILURE});
           break;
         case "complete":
           // Show a success indicator
           reportSentMsg.style.removeProperty("display");
           reportSendingMsg.style.display = "none";
+          sendAsyncMessage("Browser:SSLErrorReportTelemetry",
+                           {reportStatus: TLS_ERROR_REPORT_TELEMETRY_SUCCESS});
           break;
         }
       }
@@ -284,7 +303,7 @@ let AboutNetErrorListener = {
     sendAsyncMessage("Browser:SendSSLErrorReport", {
         elementId: evt.target.id,
         documentURI: contentDoc.documentURI,
-        location: contentDoc.location,
+        location: {hostname: contentDoc.location.hostname, port: contentDoc.location.port},
         securityInfo: serializedSecurityInfo
       });
   }
diff --git a/browser/base/content/nsContextMenu.js b/browser/base/content/nsContextMenu.js
index 0dd166986cab..ca15a131ffa5 100644
--- a/browser/base/content/nsContextMenu.js
+++ b/browser/base/content/nsContextMenu.js
@@ -198,29 +198,6 @@ nsContextMenu.prototype = {
                               (targetURI.schemeIs("about") && ReaderMode.getOriginalUrl(targetURI.spec)));
     canPocket = canPocket && window.gBrowser && this.browser.getTabBrowser() == window.gBrowser;
 
-    if (canPocket) {
-      let locale = Cc["@mozilla.org/chrome/chrome-registry;1"].
-                   getService(Ci.nsIXULChromeRegistry).
-                   getSelectedLocale("browser");
-      if (locale != "en-US") {
-        if (locale == "ja-JP-mac")
-          locale = "ja";
-        let url = "chrome://browser/content/browser-pocket-" + locale + ".properties";
-        let bundle = Services.strings.createBundle(url);
-        let saveToPocketItem = document.getElementById("context-pocket");
-        let saveLinkToPocketItem = document.getElementById("context-savelinktopocket");
-        try {
-          saveToPocketItem.setAttribute("label", bundle.GetStringFromName("saveToPocketCmd.label"));
-          saveToPocketItem.setAttribute("accesskey", bundle.GetStringFromName("saveToPocketCmd.accesskey"));
-          saveLinkToPocketItem.setAttribute("label", bundle.GetStringFromName("saveLinkToPocketCmd.label"));
-          saveLinkToPocketItem.setAttribute("accesskey", bundle.GetStringFromName("saveLinkToPocketCmd.accesskey"));
-        } catch (err) {
-          // GetStringFromName throws when the bundle doesn't exist.  In that
-          // case, the item will retain the browser-pocket.dtd en-US string that
-          // it has in the markup.
-        }
-      }
-    }
     this.showItem("context-pocket", canPocket && showSaveCurrentPageToPocket);
     let showSaveLinkToPocket = canPocket && !showSaveCurrentPageToPocket &&
                                (this.onSaveableLink || this.onPlainTextLink);
diff --git a/browser/base/content/popup-notifications.inc b/browser/base/content/popup-notifications.inc
index 04c281ff7063..d5bea0637447 100644
--- a/browser/base/content/popup-notifications.inc
+++ b/browser/base/content/popup-notifications.inc
@@ -62,12 +62,22 @@
       </popupnotificationcontent>
     </popupnotification>
 
-    <vbox id="login-fill-doorhanger" hidden="true">
-      <description id="login-fill-testing"
-                   value="Thanks for testing the login fill doorhanger!"/>
-      <textbox id="login-fill-filter"/>
-      <richlistbox id="login-fill-list"/>
-    </vbox>
+    <stack id="login-fill-doorhanger" hidden="true">
+      <vbox id="login-fill-mainview">
+        <description id="login-fill-testing"
+                     value="Thanks for testing the login fill doorhanger!"/>
+        <textbox id="login-fill-filter"/>
+        <richlistbox id="login-fill-list"/>
+      </vbox>
+      <vbox id="login-fill-clickcapturer"/>
+      <vbox id="login-fill-details">
+        <textbox id="login-fill-username" readonly="true"/>
+        <textbox id="login-fill-password" type="password" disabled="true"/>
+        <hbox>
+          <button id="login-fill-use" label="Use in form"/>
+        </hbox>
+      </vbox>
+    </stack>
 
 #ifdef E10S_TESTING_ONLY
     <popupnotification id="enable-e10s-notification" hidden="true">
diff --git a/browser/base/content/sanitize.js b/browser/base/content/sanitize.js
index 99d207176af9..6da116fd3b9d 100644
--- a/browser/base/content/sanitize.js
+++ b/browser/base/content/sanitize.js
@@ -573,20 +573,6 @@ Sanitizer.prototype = {
         let features = "chrome,all,dialog=no," + this.privateStateForNewWindow;
         let newWindow = existingWindow.openDialog("chrome://browser/content/", "_blank",
                                                   features, defaultArgs);
-#ifdef XP_MACOSX
-        function onFullScreen(e) {
-          newWindow.removeEventListener("fullscreen", onFullScreen);
-          let docEl = newWindow.document.documentElement;
-          let sizemode = docEl.getAttribute("sizemode");
-          if (!newWindow.fullScreen && sizemode == "fullscreen") {
-            docEl.setAttribute("sizemode", "normal");
-            e.preventDefault();
-            e.stopPropagation();
-            return false;
-          }
-        }
-        newWindow.addEventListener("fullscreen", onFullScreen);
-#endif
 
         // Window creation and destruction is asynchronous. We need to wait
         // until all existing windows are fully closed, and the new window is
@@ -600,9 +586,6 @@ Sanitizer.prototype = {
             return;
 
           Services.obs.removeObserver(onWindowOpened, "browser-delayed-startup-finished");
-#ifdef XP_MACOSX
-          newWindow.removeEventListener("fullscreen", onFullScreen);
-#endif
           newWindowOpened = true;
           // If we're the last thing to happen, invoke callback.
           if (numWindowsClosing == 0) {
diff --git a/browser/base/content/tab-content.js b/browser/base/content/tab-content.js
index 883850469304..9a55d76c95e7 100644
--- a/browser/base/content/tab-content.js
+++ b/browser/base/content/tab-content.js
@@ -589,15 +589,31 @@ let DOMFullscreenHandler = {
   _fullscreenDoc: null,
 
   init: function() {
+    addMessageListener("DOMFullscreen:Entered", this);
     addMessageListener("DOMFullscreen:Approved", this);
     addMessageListener("DOMFullscreen:CleanUp", this);
-    addEventListener("MozDOMFullscreen:Entered", this);
+    addEventListener("MozDOMFullscreen:Request", this);
     addEventListener("MozDOMFullscreen:NewOrigin", this);
     addEventListener("MozDOMFullscreen:Exited", this);
   },
 
+  get _windowUtils() {
+    return content.QueryInterface(Ci.nsIInterfaceRequestor)
+                  .getInterface(Ci.nsIDOMWindowUtils);
+  },
+
   receiveMessage: function(aMessage) {
     switch(aMessage.name) {
+      case "DOMFullscreen:Entered": {
+        if (!this._windowUtils.handleFullscreenRequests() &&
+            !content.document.mozFullScreen) {
+          // If we don't actually have any pending fullscreen request
+          // to handle, neither we have been in fullscreen, tell the
+          // parent to just exit.
+          sendAsyncMessage("DOMFullscreen:Exited");
+        }
+        break;
+      }
       case "DOMFullscreen:Approved": {
         if (this._fullscreenDoc) {
           Services.obs.notifyObservers(this._fullscreenDoc,
@@ -607,9 +623,7 @@ let DOMFullscreenHandler = {
         break;
       }
       case "DOMFullscreen:CleanUp": {
-        let utils = content.QueryInterface(Ci.nsIInterfaceRequestor)
-                           .getInterface(Ci.nsIDOMWindowUtils);
-        utils.exitFullscreen();
+        this._windowUtils.exitFullscreen();
         this._fullscreenDoc = null;
         break;
       }
@@ -618,8 +632,8 @@ let DOMFullscreenHandler = {
 
   handleEvent: function(aEvent) {
     switch (aEvent.type) {
-      case "MozDOMFullscreen:Entered": {
-        sendAsyncMessage("DOMFullscreen:Entered");
+      case "MozDOMFullscreen:Request": {
+        sendAsyncMessage("DOMFullscreen:Request");
         break;
       }
       case "MozDOMFullscreen:NewOrigin": {
diff --git a/browser/base/content/tabbrowser.xml b/browser/base/content/tabbrowser.xml
index 794f5b6c4754..38595caa5d34 100644
--- a/browser/base/content/tabbrowser.xml
+++ b/browser/base/content/tabbrowser.xml
@@ -1498,6 +1498,9 @@
 
             let wasActive = document.activeElement == aBrowser;
 
+            // Unmap the old outerWindowID.
+            this._outerWindowIDBrowserMap.delete(aBrowser.outerWindowID);
+
             // Unhook our progress listener.
             let tab = this.getTabForBrowser(aBrowser);
             let index = tab._tPos;
@@ -1529,6 +1532,9 @@
               tab.removeAttribute("crashed");
             } else {
               aBrowser.messageManager.sendAsyncMessage("Browser:AppTab", { isAppTab: tab.pinned })
+
+              // Register the new outerWindowID.
+              this._outerWindowIDBrowserMap.set(aBrowser.outerWindowID, aBrowser);
             }
 
             if (wasActive)
@@ -1794,13 +1800,6 @@
               b = this._createBrowser({remote, uriIsAboutBlank});
             }
 
-            // A remote browser doesn't initially have the outerWindowID
-            // set. Once a remote browser initializes, it sends the Browser:Init
-            // message, and we map the browser at that point.
-            if (!remote) {
-              this._outerWindowIDBrowserMap.set(b.outerWindowID, b);
-            }
-
             let notificationbox = this.getNotificationBox(b);
             var position = this.tabs.length - 1;
             var uniqueId = this._generateUniquePanelID();
@@ -1890,6 +1889,19 @@
             // activeness in the tab switcher.
             b.docShellIsActive = false;
 
+            // When addTab() is called with an URL that is not "about:blank" we
+            // set the "nodefaultsrc" attribute that prevents a frameLoader
+            // from being created as soon as the linked <browser> is inserted
+            // into the DOM. We thus have to register the new outerWindowID
+            // for non-remote browsers after we have called browser.loadURI().
+            //
+            // Note: Only do this of we still have a docShell. The TabOpen
+            // event was dispatched above and a gBrowser.removeTab() call from
+            // one of its listeners could cause us to fail here.
+            if (!remote && b.docShell) {
+              this._outerWindowIDBrowserMap.set(b.outerWindowID, b);
+            }
+
             // Check if we're opening a tab related to the current tab and
             // move it to after the current tab.
             // aReferrerURI is null or undefined if the tab is opened from
@@ -2503,9 +2515,29 @@
             // Make sure to unregister any open URIs.
             this._swapRegisteredOpenURIs(ourBrowser, aOtherBrowser);
 
+            // Unmap old outerWindowIDs.
+            this._outerWindowIDBrowserMap.delete(ourBrowser.outerWindowID);
+            let remoteBrowser = aOtherBrowser.ownerDocument.defaultView.gBrowser;
+            if (remoteBrowser) {
+              remoteBrowser._outerWindowIDBrowserMap.delete(aOtherBrowser.outerWindowID);
+            }
+
             // Swap the docshells
             ourBrowser.swapDocShells(aOtherBrowser);
 
+            if (ourBrowser.isRemoteBrowser) {
+              // Switch outerWindowIDs for remote browsers.
+              let ourOuterWindowID = ourBrowser._outerWindowID;
+              ourBrowser._outerWindowID = aOtherBrowser._outerWindowID;
+              aOtherBrowser._outerWindowID = ourOuterWindowID;
+            }
+
+            // Register new outerWindowIDs.
+            this._outerWindowIDBrowserMap.set(ourBrowser.outerWindowID, ourBrowser);
+            if (remoteBrowser) {
+              remoteBrowser._outerWindowIDBrowserMap.set(aOtherBrowser.outerWindowID, aOtherBrowser);
+            }
+
             // Swap permanentKey properties.
             let ourPermanentKey = ourBrowser.permanentKey;
             ourBrowser.permanentKey = aOtherBrowser.permanentKey;
diff --git a/browser/base/content/test/general/browser_devices_get_user_media.js b/browser/base/content/test/general/browser_devices_get_user_media.js
index 41cdb3f8183a..247bd836f5e1 100644
--- a/browser/base/content/test/general/browser_devices_get_user_media.js
+++ b/browser/base/content/test/general/browser_devices_get_user_media.js
@@ -242,6 +242,7 @@ let gTests = [
     is(PopupNotifications.panel.firstChild.getAttribute("popupid"),
        "webRTC-shareDevices", "panel using devices icon");
 
+    let indicator = promiseIndicatorWindow();
     yield promiseMessage("ok", () => {
       PopupNotifications.panel.firstChild.button.click();
     });
@@ -250,6 +251,7 @@ let gTests = [
     is(getMediaCaptureState(), "CameraAndMicrophone",
        "expected camera and microphone to be shared");
 
+    yield indicator;
     yield checkSharingUI({audio: true, video: true});
     yield closeStream();
   }
@@ -270,6 +272,7 @@ let gTests = [
     is(PopupNotifications.panel.firstChild.getAttribute("popupid"),
        "webRTC-shareMicrophone", "panel using microphone icon");
 
+    let indicator = promiseIndicatorWindow();
     yield promiseMessage("ok", () => {
       PopupNotifications.panel.firstChild.button.click();
     });
@@ -277,6 +280,7 @@ let gTests = [
     expectObserverCalled("recording-device-events");
     is(getMediaCaptureState(), "Microphone", "expected microphone to be shared");
 
+    yield indicator;
     yield checkSharingUI({audio: true});
     yield closeStream();
   }
@@ -297,6 +301,7 @@ let gTests = [
     is(PopupNotifications.panel.firstChild.getAttribute("popupid"),
        "webRTC-shareDevices", "panel using devices icon");
 
+    let indicator = promiseIndicatorWindow();
     yield promiseMessage("ok", () => {
       PopupNotifications.panel.firstChild.button.click();
     });
@@ -304,6 +309,7 @@ let gTests = [
     expectObserverCalled("recording-device-events");
     is(getMediaCaptureState(), "Camera", "expected camera to be shared");
 
+    yield indicator;
     yield checkSharingUI({video: true});
     yield closeStream();
   }
@@ -322,6 +328,7 @@ let gTests = [
     // disable the camera
     enableDevice("Camera", false);
 
+    let indicator = promiseIndicatorWindow();
     yield promiseMessage("ok", () => {
       PopupNotifications.panel.firstChild.button.click();
     });
@@ -334,6 +341,7 @@ let gTests = [
     is(getMediaCaptureState(), "Microphone",
        "expected microphone to be shared");
 
+    yield indicator;
     yield checkSharingUI({audio: true});
     yield closeStream();
   }
@@ -352,6 +360,7 @@ let gTests = [
     // disable the microphone
     enableDevice("Microphone", false);
 
+    let indicator = promiseIndicatorWindow();
     yield promiseMessage("ok", () => {
       PopupNotifications.panel.firstChild.button.click();
     });
@@ -364,6 +373,7 @@ let gTests = [
     is(getMediaCaptureState(), "Camera",
        "expected microphone to be shared");
 
+    yield indicator;
     yield checkSharingUI({video: true});
     yield closeStream();
   }
@@ -427,6 +437,7 @@ let gTests = [
     expectObserverCalled("getUserMedia:request");
     checkDeviceSelectors(true, true);
 
+    let indicator = promiseIndicatorWindow();
     yield promiseMessage("ok", () => {
       PopupNotifications.panel.firstChild.button.click();
     });
@@ -435,6 +446,7 @@ let gTests = [
     is(getMediaCaptureState(), "CameraAndMicrophone",
        "expected camera and microphone to be shared");
 
+    yield indicator;
     yield checkSharingUI({video: true, audio: true});
 
     yield promiseNotificationShown(PopupNotifications.getNotification("webRTC-sharingDevices"));
@@ -469,6 +481,7 @@ let gTests = [
     expectObserverCalled("getUserMedia:request");
     checkDeviceSelectors(true, true);
 
+    let indicator = promiseIndicatorWindow();
     yield promiseMessage("ok", () => {
       PopupNotifications.panel.firstChild.button.click();
     });
@@ -477,6 +490,7 @@ let gTests = [
     is(getMediaCaptureState(), "CameraAndMicrophone",
        "expected camera and microphone to be shared");
 
+    yield indicator;
     yield checkSharingUI({video: true, audio: true});
 
     yield promiseNotificationShown(PopupNotifications.getNotification("webRTC-sharingDevices"));
@@ -730,6 +744,7 @@ let gTests = [
       Perms.add(uri, "microphone", Perms.ALLOW_ACTION);
       Perms.add(uri, "camera", Perms.ALLOW_ACTION);
 
+      let indicator = promiseIndicatorWindow();
       // Start sharing what's been requested.
       yield promiseMessage("ok", () => {
         content.wrappedJSObject.requestDevice(aRequestAudio, aRequestVideo);
@@ -737,6 +752,7 @@ let gTests = [
       expectObserverCalled("getUserMedia:request");
       expectObserverCalled("getUserMedia:response:allow");
       expectObserverCalled("recording-device-events");
+      yield indicator;
       yield checkSharingUI({video: aRequestVideo, audio: aRequestAudio});
 
       yield promiseNotificationShown(PopupNotifications.getNotification("webRTC-sharingDevices"));
@@ -801,6 +817,7 @@ let gTests = [
     expectObserverCalled("getUserMedia:request");
     checkDeviceSelectors(false, true);
 
+    let indicator = promiseIndicatorWindow();
     yield promiseMessage("ok", () => {
       PopupNotifications.panel.firstChild.button.click();
     });
@@ -808,6 +825,7 @@ let gTests = [
     expectObserverCalled("recording-device-events");
     is(getMediaCaptureState(), "Camera", "expected camera to be shared");
 
+    yield indicator;
     yield checkSharingUI({video: true});
 
     yield promisePopupNotificationShown("webRTC-sharingDevices", () => {
diff --git a/browser/base/content/test/general/browser_devices_get_user_media_in_frame.js b/browser/base/content/test/general/browser_devices_get_user_media_in_frame.js
index 1bf47d0d2f7d..def150e26a5e 100644
--- a/browser/base/content/test/general/browser_devices_get_user_media_in_frame.js
+++ b/browser/base/content/test/general/browser_devices_get_user_media_in_frame.js
@@ -241,6 +241,7 @@ let gTests = [
     is(PopupNotifications.panel.firstChild.getAttribute("popupid"),
        "webRTC-shareDevices", "panel using devices icon");
 
+    let indicator = promiseIndicatorWindow();
     yield promiseMessage("ok", () => {
       PopupNotifications.panel.firstChild.button.click();
     });
@@ -249,6 +250,7 @@ let gTests = [
     is(getMediaCaptureState(), "CameraAndMicrophone",
        "expected camera and microphone to be shared");
 
+    yield indicator;
     yield checkSharingUI({audio: true, video: true});
     yield closeStream(global);
   }
@@ -265,6 +267,7 @@ let gTests = [
     expectObserverCalled("getUserMedia:request");
     checkDeviceSelectors(true, true);
 
+    let indicator = promiseIndicatorWindow();
     yield promiseMessage("ok", () => {
       PopupNotifications.panel.firstChild.button.click();
     });
@@ -273,6 +276,7 @@ let gTests = [
     is(getMediaCaptureState(), "CameraAndMicrophone",
        "expected camera and microphone to be shared");
 
+    yield indicator;
     yield checkSharingUI({video: true, audio: true});
 
     yield promiseNotificationShown(PopupNotifications.getNotification("webRTC-sharingDevices"));
@@ -308,6 +312,7 @@ let gTests = [
     expectObserverCalled("getUserMedia:request");
     checkDeviceSelectors(true, true);
 
+    let indicator = promiseIndicatorWindow();
     yield promiseMessage("ok", () => {
       PopupNotifications.panel.firstChild.button.click();
     });
@@ -316,6 +321,7 @@ let gTests = [
     is(getMediaCaptureState(), "CameraAndMicrophone",
        "expected camera and microphone to be shared");
 
+    yield indicator;
     yield checkSharingUI({video: true, audio: true});
 
     info("reloading the frame");
@@ -370,6 +376,7 @@ let gTests = [
     expectObserverCalled("getUserMedia:request");
     checkDeviceSelectors(true, false);
 
+    let indicator = promiseIndicatorWindow();
     yield promiseMessage("ok", () => {
       PopupNotifications.panel.firstChild.button.click();
     });
@@ -377,6 +384,7 @@ let gTests = [
     expectObserverCalled("recording-device-events");
     is(getMediaCaptureState(), "Microphone", "microphone to be shared");
 
+    yield indicator;
     yield checkSharingUI({video: false, audio: true});
     expectNoObserverCalled();
 
diff --git a/browser/base/content/test/general/browser_e10s_chrome_process.js b/browser/base/content/test/general/browser_e10s_chrome_process.js
index 64187d3b2919..858cfd8fba94 100644
--- a/browser/base/content/test/general/browser_e10s_chrome_process.js
+++ b/browser/base/content/test/general/browser_e10s_chrome_process.js
@@ -122,7 +122,7 @@ let TRANSITIONS = [
 // Loads the new page by calling browser.loadURI directly
 function* loadURI(browser, uri) {
   info("Calling browser.loadURI");
-  browser.loadURI(uri);
+  yield BrowserTestUtils.loadURI(browser, uri);
   return true;
 },
 
diff --git a/browser/base/content/test/general/browser_e10s_switchbrowser.js b/browser/base/content/test/general/browser_e10s_switchbrowser.js
index cb13411faa47..e88d2fbcbba9 100644
--- a/browser/base/content/test/general/browser_e10s_switchbrowser.js
+++ b/browser/base/content/test/general/browser_e10s_switchbrowser.js
@@ -197,7 +197,7 @@ add_task(function* test_synchronous() {
   info("2");
   // Load another page
   info("Loading about:robots");
-  gBrowser.selectedBrowser.loadURI("about:robots");
+  yield BrowserTestUtils.loadURI(gBrowser.selectedBrowser, "about:robots");
   is(gBrowser.selectedBrowser.isRemoteBrowser, false, "Remote attribute should be correct");
   is(gBrowser.selectedBrowser.permanentKey, permanentKey, "browser.permanentKey is still the same");
 
@@ -208,7 +208,7 @@ add_task(function* test_synchronous() {
   info("3");
   // Load the remote page again
   info("Loading http://example.org/" + DUMMY_PATH);
-  gBrowser.loadURI("http://example.org/" + DUMMY_PATH);
+  yield BrowserTestUtils.loadURI(gBrowser.selectedBrowser, "http://example.org/" + DUMMY_PATH);
   is(gBrowser.selectedBrowser.isRemoteBrowser, expectedRemote, "Remote attribute should be correct");
   is(gBrowser.selectedBrowser.permanentKey, permanentKey, "browser.permanentKey is still the same");
 
diff --git a/browser/base/content/test/general/browser_testOpenNewRemoteTabsFromNonRemoteBrowsers.js b/browser/base/content/test/general/browser_testOpenNewRemoteTabsFromNonRemoteBrowsers.js
index 2c3b5a43cc86..30e1eb98b7b7 100644
--- a/browser/base/content/test/general/browser_testOpenNewRemoteTabsFromNonRemoteBrowsers.js
+++ b/browser/base/content/test/general/browser_testOpenNewRemoteTabsFromNonRemoteBrowsers.js
@@ -26,7 +26,7 @@ function frame_script() {
  */
 function prepareNonRemoteBrowser(aWindow, browser) {
   browser.loadURI(NON_REMOTE_PAGE);
-  return waitForDocLoadComplete(browser);
+  return BrowserTestUtils.browserLoaded(browser);
 }
 
 registerCleanupFunction(() => {
diff --git a/browser/base/content/test/general/head.js b/browser/base/content/test/general/head.js
index 0e83dfe1cda2..44cdd5137cc3 100644
--- a/browser/base/content/test/general/head.js
+++ b/browser/base/content/test/general/head.js
@@ -633,21 +633,33 @@ function waitForNewTabEvent(aTabBrowser) {
  * @resolves to the window
  */
 function promiseWindow(url) {
-  info("waiting for a " + url + " window");
+  info("expecting a " + url + " window");
   return new Promise(resolve => {
     Services.obs.addObserver(function obs(win) {
       win.QueryInterface(Ci.nsIDOMWindow);
-      if (win.location.href !== url) {
-        info("ignoring a window with this url: " + win.location.href);
-        return;
-      }
+      win.addEventListener("load", function loadHandler() {
+        win.removeEventListener("load", loadHandler);
 
-      Services.obs.removeObserver(obs, "domwindowopened");
-      resolve(win);
+        if (win.location.href !== url) {
+          info("ignoring a window with this url: " + win.location.href);
+          return;
+        }
+
+        Services.obs.removeObserver(obs, "domwindowopened");
+        resolve(win);
+      });
     }, "domwindowopened", false);
   });
 }
 
+function promiseIndicatorWindow() {
+  // We don't show the indicator window on Mac.
+  if ("nsISystemStatusBar" in Ci)
+    return Promise.resolve();
+
+  return promiseWindow("chrome://browser/content/webrtcIndicator.xul");
+}
+
 function assertWebRTCIndicatorStatus(expected) {
   let ui = Cu.import("resource:///modules/webrtcUI.jsm", {}).webrtcUI;
   let expectedState = expected ? "visible" : "hidden";
@@ -694,9 +706,6 @@ function assertWebRTCIndicatorStatus(expected) {
         });
       }
     }
-    if (expected &&
-        !Services.wm.getMostRecentWindow("Browser:WebRTCGlobalIndicator"))
-      yield promiseWindow("chrome://browser/content/webrtcIndicator.xul");
     let indicator = Services.wm.getEnumerator("Browser:WebRTCGlobalIndicator");
     let hasWindow = indicator.hasMoreElements();
     is(hasWindow, !!expected, "popup " + msg);
diff --git a/browser/base/content/web-panels.xul b/browser/base/content/web-panels.xul
index 0b1f84e3f877..4a520befe9b2 100644
--- a/browser/base/content/web-panels.xul
+++ b/browser/base/content/web-panels.xul
@@ -12,8 +12,6 @@
 <!DOCTYPE page [
 <!ENTITY % browserDTD SYSTEM "chrome://browser/locale/browser.dtd">
 %browserDTD;
-<!ENTITY % browserPocketDTD SYSTEM "chrome://browser/content/browser-pocket.dtd">
-%browserPocketDTD;
 <!ENTITY % textcontextDTD SYSTEM "chrome://global/locale/textcontext.dtd">
 %textcontextDTD;
 ]>
diff --git a/browser/base/jar.mn b/browser/base/jar.mn
index 0f4d2da3874f..90aaf100dc3e 100644
--- a/browser/base/jar.mn
+++ b/browser/base/jar.mn
@@ -75,12 +75,6 @@ browser.jar:
 *       content/browser/browser.css                   (content/browser.css)
 *       content/browser/browser.js                    (content/browser.js)
 *       content/browser/browser.xul                   (content/browser.xul)
-        content/browser/browser-pocket-en-US.properties (content/browser-pocket-en-US.properties)
-        content/browser/browser-pocket.dtd            (content/browser-pocket.dtd)
-        content/browser/browser-pocket-de.properties  (content/browser-pocket-de.properties)
-        content/browser/browser-pocket-es-ES.properties (content/browser-pocket-es-ES.properties)
-        content/browser/browser-pocket-ja.properties  (content/browser-pocket-ja.properties)
-        content/browser/browser-pocket-ru.properties  (content/browser-pocket-ru.properties)
 *       content/browser/browser-tabPreviews.xml       (content/browser-tabPreviews.xml)
 *       content/browser/chatWindow.xul                (content/chatWindow.xul)
         content/browser/tab-content.js                (content/tab-content.js)
diff --git a/browser/components/controlcenter/content/panel.inc.xul b/browser/components/controlcenter/content/panel.inc.xul
index 9b59b716b979..88ad8284f591 100644
--- a/browser/components/controlcenter/content/panel.inc.xul
+++ b/browser/components/controlcenter/content/panel.inc.xul
@@ -13,37 +13,22 @@
   <hbox id="identity-popup-container" align="top">
     <image id="identity-popup-icon"/>
     <vbox id="identity-popup-content-box">
-      <label id="identity-popup-brandName"
+      <label id="identity-popup-content-host"
+             class="identity-popup-description"
+             crop="end"/>
+      <label id="identity-popup-connection-secure"
              class="identity-popup-label"
-             value="&brandFullName;"/>
-      <label id="identity-popup-chromeLabel"
-             class="identity-popup-label"/>
-      <label id="identity-popup-connectedToLabel"
+             value="&identity.connectionSecure;"/>
+      <label id="identity-popup-connection-not-secure"
              class="identity-popup-label"
-             value="&identity.connectedTo;"/>
-      <label id="identity-popup-connectedToLabel2"
-             class="identity-popup-label"
-             value="&identity.unverifiedsite2;"/>
-      <description id="identity-popup-content-host"
-                   class="identity-popup-description"/>
-      <label id="identity-popup-runByLabel"
-             class="identity-popup-label"
-             value="&identity.runBy;"/>
+             value="&identity.connectionNotSecure;"/>
       <description id="identity-popup-content-owner"
                    class="identity-popup-description"/>
       <description id="identity-popup-content-supplemental"
                    class="identity-popup-description"/>
       <description id="identity-popup-content-verifier"
                    class="identity-popup-description"/>
-      <hbox id="identity-popup-encryption" flex="1">
-        <vbox>
-          <image id="identity-popup-encryption-icon"/>
-        </vbox>
-        <description id="identity-popup-encryption-label" flex="1"
-                     class="identity-popup-description"/>
-      </hbox>
       <vbox id="identity-popup-permissions">
-        <separator class="thin"/>
         <label class="identity-popup-label header"
                value="&identity.permissions;"/>
         <vbox id="identity-popup-permission-list" class="indent"/>
diff --git a/browser/components/customizableui/CustomizableWidgets.jsm b/browser/components/customizableui/CustomizableWidgets.jsm
index a26e592e6ab7..df9ac7a79896 100644
--- a/browser/components/customizableui/CustomizableWidgets.jsm
+++ b/browser/components/customizableui/CustomizableWidgets.jsm
@@ -1065,11 +1065,10 @@ if (Services.prefs.getBoolPref("privacy.panicButton.enabled")) {
 
 if (Services.prefs.getBoolPref("browser.pocket.enabled")) {
   let isEnabledForLocale = true;
-  let browserLocale;
   if (Services.prefs.getBoolPref("browser.pocket.useLocaleList")) {
     let chromeRegistry = Cc["@mozilla.org/chrome/chrome-registry;1"]
                            .getService(Ci.nsIXULChromeRegistry);
-    browserLocale = chromeRegistry.getSelectedLocale("browser");
+    let browserLocale = chromeRegistry.getSelectedLocale("browser");
     let enabledLocales = [];
     try {
       enabledLocales = Services.prefs.getCharPref("browser.pocket.enabledLocales").split(' ');
@@ -1080,32 +1079,12 @@ if (Services.prefs.getBoolPref("browser.pocket.enabled")) {
   }
 
   if (isEnabledForLocale) {
-    if (browserLocale == "ja-JP-mac")
-      browserLocale = "ja";
-    let url = "chrome://browser/content/browser-pocket-" + browserLocale + ".properties";
-    let strings = Services.strings.createBundle(url);
-    let label;
-    let tooltiptext;
-    try {
-      label = strings.GetStringFromName("pocket-button.label");
-      tooltiptext = strings.GetStringFromName("pocket-button.tooltiptext");
-    } catch (err) {
-      // GetStringFromName throws when the bundle doesn't exist.  In that case,
-      // fall back to the en-US browser-pocket.properties.
-      url = "chrome://browser/content/browser-pocket-en-US.properties";
-      strings = Services.strings.createBundle(url);
-      label = strings.GetStringFromName("pocket-button.label");
-      tooltiptext = strings.GetStringFromName("pocket-button.tooltiptext");
-    }
-
     let pocketButton = {
       id: "pocket-button",
       defaultArea: CustomizableUI.AREA_NAVBAR,
       introducedInVersion: "pref",
       type: "view",
       viewId: "PanelUI-pocketView",
-      label: label,
-      tooltiptext: tooltiptext,
       // Use forwarding functions here to avoid loading Pocket.jsm on startup:
       onViewShowing: function() {
         return Pocket.onPanelViewShowing.apply(this, arguments);
diff --git a/browser/components/customizableui/test/browser_934951_zoom_in_toolbar.js b/browser/components/customizableui/test/browser_934951_zoom_in_toolbar.js
index 6eea69c89629..151e1cada771 100644
--- a/browser/components/customizableui/test/browser_934951_zoom_in_toolbar.js
+++ b/browser/components/customizableui/test/browser_934951_zoom_in_toolbar.js
@@ -10,7 +10,9 @@ const kTimeoutInMS = 20000;
 add_task(function() {
   CustomizableUI.addWidgetToArea("zoom-controls", CustomizableUI.AREA_NAVBAR);
   let tab1 = gBrowser.addTab("about:mozilla");
-  let tab2 = gBrowser.addTab("about:newtab");
+  yield BrowserTestUtils.browserLoaded(tab1.linkedBrowser);
+  let tab2 = gBrowser.addTab("about:robots");
+  yield BrowserTestUtils.browserLoaded(tab2.linkedBrowser);
   gBrowser.selectedTab = tab1;
   let zoomResetButton = document.getElementById("zoom-reset-button");
 
@@ -30,7 +32,7 @@ add_task(function() {
   let tabSelectPromise = promiseTabSelect();
   gBrowser.selectedTab = tab2;
   yield tabSelectPromise;
-  is(parseInt(zoomResetButton.label, 10), 100, "Default zoom is 100% for about:newtab");
+  is(parseInt(zoomResetButton.label, 10), 100, "Default zoom is 100% for about:robots");
 
   gBrowser.selectedTab = tab1;
   let zoomResetPromise = promiseObserverNotification("browser-fullZoom:zoomReset");
@@ -52,6 +54,7 @@ add_task(function() {
     return parseInt(zoomResetButton.label, 10) == 110;
   });
   is(parseInt(zoomResetButton.label, 10), 110, "Zoom is still 110% for about:mozilla");
+  FullZoom.reset();
 });
 
 function promiseObserverNotification(aObserver) {
diff --git a/browser/components/loop/content/css/contacts.css b/browser/components/loop/content/css/contacts.css
index 7988c81483e5..4d8579194c2e 100644
--- a/browser/components/loop/content/css/contacts.css
+++ b/browser/components/loop/content/css/contacts.css
@@ -134,7 +134,7 @@
   background-color: #fff;
 }
 
-body[dir="rtl"] .contact > .details > .username > i.icon-google {
+html[dir="rtl"] .contact > .details > .username > i.icon-google {
   left: 1rem;
   right: auto;
 }
@@ -193,7 +193,7 @@ body[dir="rtl"] .contact > .details > .username > i.icon-google {
   left: auto;
 }
 
-body[dir="rtl"] .contact > .dropdown-menu {
+html[dir="rtl"] .contact > .dropdown-menu {
   right: auto;
   left: 3em;
 }
@@ -211,7 +211,7 @@ body[dir="rtl"] .contact > .dropdown-menu {
   margin-top: 3px;
 }
 
-body[dir="rtl"] .contact > .dropdown-menu > .dropdown-menu-item > .icon {
+html[dir="rtl"] .contact > .dropdown-menu > .dropdown-menu-item > .icon {
   background-position: center right;
 }
 
@@ -259,7 +259,7 @@ body[dir="rtl"] .contact > .dropdown-menu > .dropdown-menu-item > .icon {
   word-wrap: break-word;
 }
 
-body[dir=rtl] .contacts-gravatar-promo > p {
+html[dir="rtl"] .contacts-gravatar-promo > p {
   margin-right: 0;
   margin-left: 4px;
 }
@@ -279,7 +279,7 @@ body[dir=rtl] .contacts-gravatar-promo > p {
   right: 8px;
 }
 
-body[dir=rtl] .contacts-gravatar-promo > .button-close {
+html[dir="rtl"] .contacts-gravatar-promo > .button-close {
   right: auto;
   left: 8px;
 }
diff --git a/browser/components/loop/content/css/panel.css b/browser/components/loop/content/css/panel.css
index 7965135ec0f0..15962edfd5a4 100644
--- a/browser/components/loop/content/css/panel.css
+++ b/browser/components/loop/content/css/panel.css
@@ -265,7 +265,7 @@ body {
   flex: 0 1 auto;
 }
 
-body[dir=rtl] .new-room-view > .context > .context-content > .context-preview {
+html[dir="rtl"] .new-room-view > .context > .context-content > .context-preview {
   float: left;
 }
 
@@ -567,7 +567,7 @@ body[dir=rtl] .new-room-view > .context > .context-content > .context-preview {
   right: 4px;
 }
 
-body[dir=rtl] .generate-url-spinner {
+html[dir="rtl"] .generate-url-spinner {
   left: 4px;
   right: auto;
 }
@@ -753,7 +753,7 @@ body[dir=rtl] .generate-url-spinner {
   right: 14px;
 }
 
-body[dir="rtl"] .settings-menu .dropdown-menu {
+html[dir="rtl"] .settings-menu .dropdown-menu {
   /* This is specified separately rather than using -moz-margin-start etc, as
      we need to override .dropdown-menu's values which can't use the gecko
      specific extensions. */
diff --git a/browser/components/loop/content/js/conversation.js b/browser/components/loop/content/js/conversation.js
index 86a14d30cf29..665cae5c684f 100644
--- a/browser/components/loop/content/js/conversation.js
+++ b/browser/components/loop/content/js/conversation.js
@@ -163,7 +163,8 @@ loop.conversation = (function(mozL10n) {
       dispatcher: dispatcher, 
       mozLoop: navigator.mozLoop}), document.querySelector("#main"));
 
-    document.body.setAttribute("dir", mozL10n.getDirection());
+    document.documentElement.setAttribute("lang", mozL10n.getLanguage());
+    document.documentElement.setAttribute("dir", mozL10n.getDirection());
     document.body.setAttribute("platform", loop.shared.utils.getPlatform());
 
     dispatcher.dispatch(new sharedActions.GetWindowData({
diff --git a/browser/components/loop/content/js/conversation.jsx b/browser/components/loop/content/js/conversation.jsx
index d24272c0432c..5d0da75de735 100644
--- a/browser/components/loop/content/js/conversation.jsx
+++ b/browser/components/loop/content/js/conversation.jsx
@@ -163,7 +163,8 @@ loop.conversation = (function(mozL10n) {
       dispatcher={dispatcher}
       mozLoop={navigator.mozLoop} />, document.querySelector("#main"));
 
-    document.body.setAttribute("dir", mozL10n.getDirection());
+    document.documentElement.setAttribute("lang", mozL10n.getLanguage());
+    document.documentElement.setAttribute("dir", mozL10n.getDirection());
     document.body.setAttribute("platform", loop.shared.utils.getPlatform());
 
     dispatcher.dispatch(new sharedActions.GetWindowData({
diff --git a/browser/components/loop/content/js/conversationViews.js b/browser/components/loop/content/js/conversationViews.js
index 947eb7305125..29b2d7fb1148 100644
--- a/browser/components/loop/content/js/conversationViews.js
+++ b/browser/components/loop/content/js/conversationViews.js
@@ -565,13 +565,23 @@ loop.conversationViews = (function(mozL10n) {
 
   var OngoingConversationView = React.createClass({displayName: "OngoingConversationView",
     mixins: [
+      loop.store.StoreMixin("conversationStore"),
       sharedMixins.MediaSetupMixin
     ],
 
     propTypes: {
       dispatcher: React.PropTypes.instanceOf(loop.Dispatcher).isRequired,
+      // local
       video: React.PropTypes.object,
-      audio: React.PropTypes.object
+      // local
+      audio: React.PropTypes.object,
+      remoteVideoEnabled: React.PropTypes.bool,
+      // This is used from the props rather than the state to make it easier for
+      // the ui-showcase.
+      mediaConnected: React.PropTypes.bool,
+      // The poster URLs are for UI-showcase testing and development.
+      localPosterUrl: React.PropTypes.string,
+      remotePosterUrl: React.PropTypes.string
     },
 
     getDefaultProps: function() {
@@ -581,6 +591,10 @@ loop.conversationViews = (function(mozL10n) {
       };
     },
 
+    getInitialState: function() {
+      return this.getStoreState();
+    },
+
     componentDidMount: function() {
       // The SDK needs to know about the configuration and the elements to use
       // for display. So the best way seems to pass the information here - ideally
@@ -588,9 +602,7 @@ loop.conversationViews = (function(mozL10n) {
       this.props.dispatcher.dispatch(new sharedActions.SetupStreamElements({
         publisherConfig: this.getDefaultPublisherConfig({
           publishVideo: this.props.video.enabled
-        }),
-        getLocalElementFunc: this._getElement.bind(this, ".local"),
-        getRemoteElementFunc: this._getElement.bind(this, ".remote")
+        })
       }));
     },
 
@@ -616,6 +628,18 @@ loop.conversationViews = (function(mozL10n) {
         }));
     },
 
+    shouldRenderRemoteVideo: function() {
+      if (this.props.mediaConnected) {
+        // If remote video is not enabled, we're muted, so we'll show an avatar
+        // instead.
+        return this.props.remoteVideoEnabled;
+      }
+
+      // We're not yet connected, but we don't want to show the avatar, and in
+      // the common case, we'll just transition to the video.
+      return true;
+    },
+
     render: function() {
       var localStreamClasses = React.addons.classSet({
         local: true,
@@ -628,11 +652,22 @@ loop.conversationViews = (function(mozL10n) {
           React.createElement("div", {className: "conversation"}, 
             React.createElement("div", {className: "media nested"}, 
               React.createElement("div", {className: "video_wrapper remote_wrapper"}, 
-                React.createElement("div", {className: "video_inner remote focus-stream"})
+                React.createElement("div", {className: "video_inner remote focus-stream"}, 
+                  React.createElement(sharedViews.MediaView, {displayAvatar: !this.shouldRenderRemoteVideo(), 
+                    posterUrl: this.props.remotePosterUrl, 
+                    mediaType: "remote", 
+                    srcVideoObject: this.state.remoteSrcVideoObject})
+                )
               ), 
-              React.createElement("div", {className: localStreamClasses})
+              React.createElement("div", {className: localStreamClasses}, 
+                React.createElement(sharedViews.MediaView, {displayAvatar: !this.props.video.enabled, 
+                  posterUrl: this.props.localPosterUrl, 
+                  mediaType: "local", 
+                  srcVideoObject: this.state.localSrcVideoObject})
+              )
             ), 
             React.createElement(loop.shared.views.ConversationToolbar, {
+              dispatcher: this.props.dispatcher, 
               video: this.props.video, 
               audio: this.props.audio, 
               publishStream: this.publishStream, 
@@ -742,7 +777,10 @@ loop.conversationViews = (function(mozL10n) {
           return (React.createElement(OngoingConversationView, {
             dispatcher: this.props.dispatcher, 
             video: {enabled: !this.state.videoMuted}, 
-            audio: {enabled: !this.state.audioMuted}}
+            audio: {enabled: !this.state.audioMuted}, 
+            remoteVideoEnabled: this.state.remoteVideoEnabled, 
+            mediaConnected: this.state.mediaConnected, 
+            remoteSrcVideoObject: this.state.remoteSrcVideoObject}
             )
           );
         }
diff --git a/browser/components/loop/content/js/conversationViews.jsx b/browser/components/loop/content/js/conversationViews.jsx
index 9f8dd046b104..891b299e4143 100644
--- a/browser/components/loop/content/js/conversationViews.jsx
+++ b/browser/components/loop/content/js/conversationViews.jsx
@@ -565,13 +565,23 @@ loop.conversationViews = (function(mozL10n) {
 
   var OngoingConversationView = React.createClass({
     mixins: [
+      loop.store.StoreMixin("conversationStore"),
       sharedMixins.MediaSetupMixin
     ],
 
     propTypes: {
       dispatcher: React.PropTypes.instanceOf(loop.Dispatcher).isRequired,
+      // local
       video: React.PropTypes.object,
-      audio: React.PropTypes.object
+      // local
+      audio: React.PropTypes.object,
+      remoteVideoEnabled: React.PropTypes.bool,
+      // This is used from the props rather than the state to make it easier for
+      // the ui-showcase.
+      mediaConnected: React.PropTypes.bool,
+      // The poster URLs are for UI-showcase testing and development.
+      localPosterUrl: React.PropTypes.string,
+      remotePosterUrl: React.PropTypes.string
     },
 
     getDefaultProps: function() {
@@ -581,6 +591,10 @@ loop.conversationViews = (function(mozL10n) {
       };
     },
 
+    getInitialState: function() {
+      return this.getStoreState();
+    },
+
     componentDidMount: function() {
       // The SDK needs to know about the configuration and the elements to use
       // for display. So the best way seems to pass the information here - ideally
@@ -588,9 +602,7 @@ loop.conversationViews = (function(mozL10n) {
       this.props.dispatcher.dispatch(new sharedActions.SetupStreamElements({
         publisherConfig: this.getDefaultPublisherConfig({
           publishVideo: this.props.video.enabled
-        }),
-        getLocalElementFunc: this._getElement.bind(this, ".local"),
-        getRemoteElementFunc: this._getElement.bind(this, ".remote")
+        })
       }));
     },
 
@@ -616,6 +628,18 @@ loop.conversationViews = (function(mozL10n) {
         }));
     },
 
+    shouldRenderRemoteVideo: function() {
+      if (this.props.mediaConnected) {
+        // If remote video is not enabled, we're muted, so we'll show an avatar
+        // instead.
+        return this.props.remoteVideoEnabled;
+      }
+
+      // We're not yet connected, but we don't want to show the avatar, and in
+      // the common case, we'll just transition to the video.
+      return true;
+    },
+
     render: function() {
       var localStreamClasses = React.addons.classSet({
         local: true,
@@ -628,11 +652,22 @@ loop.conversationViews = (function(mozL10n) {
           <div className="conversation">
             <div className="media nested">
               <div className="video_wrapper remote_wrapper">
-                <div className="video_inner remote focus-stream"></div>
+                <div className="video_inner remote focus-stream">
+                  <sharedViews.MediaView displayAvatar={!this.shouldRenderRemoteVideo()}
+                    posterUrl={this.props.remotePosterUrl}
+                    mediaType="remote"
+                    srcVideoObject={this.state.remoteSrcVideoObject} />
+                </div>
+              </div>
+              <div className={localStreamClasses}>
+                <sharedViews.MediaView displayAvatar={!this.props.video.enabled}
+                  posterUrl={this.props.localPosterUrl}
+                  mediaType="local"
+                  srcVideoObject={this.state.localSrcVideoObject} />
               </div>
-              <div className={localStreamClasses}></div>
             </div>
             <loop.shared.views.ConversationToolbar
+              dispatcher={this.props.dispatcher}
               video={this.props.video}
               audio={this.props.audio}
               publishStream={this.publishStream}
@@ -743,6 +778,9 @@ loop.conversationViews = (function(mozL10n) {
             dispatcher={this.props.dispatcher}
             video={{enabled: !this.state.videoMuted}}
             audio={{enabled: !this.state.audioMuted}}
+            remoteVideoEnabled={this.state.remoteVideoEnabled}
+            mediaConnected={this.state.mediaConnected}
+            remoteSrcVideoObject={this.state.remoteSrcVideoObject}
             />
           );
         }
diff --git a/browser/components/loop/content/js/panel.js b/browser/components/loop/content/js/panel.js
index 54bad8da39b9..d43204819e1e 100644
--- a/browser/components/loop/content/js/panel.js
+++ b/browser/components/loop/content/js/panel.js
@@ -1002,7 +1002,8 @@ loop.panel = (function(_, mozL10n) {
       mozLoop: navigator.mozLoop, 
       dispatcher: dispatcher}), document.querySelector("#main"));
 
-    document.body.setAttribute("dir", mozL10n.getDirection());
+    document.documentElement.setAttribute("lang", mozL10n.getLanguage());
+    document.documentElement.setAttribute("dir", mozL10n.getDirection());
     document.body.setAttribute("platform", loop.shared.utils.getPlatform());
 
     // Notify the window that we've finished initalization and initial layout
diff --git a/browser/components/loop/content/js/panel.jsx b/browser/components/loop/content/js/panel.jsx
index 8d30578f908b..160a0938f6cb 100644
--- a/browser/components/loop/content/js/panel.jsx
+++ b/browser/components/loop/content/js/panel.jsx
@@ -1002,7 +1002,8 @@ loop.panel = (function(_, mozL10n) {
       mozLoop={navigator.mozLoop}
       dispatcher={dispatcher} />, document.querySelector("#main"));
 
-    document.body.setAttribute("dir", mozL10n.getDirection());
+    document.documentElement.setAttribute("lang", mozL10n.getLanguage());
+    document.documentElement.setAttribute("dir", mozL10n.getDirection());
     document.body.setAttribute("platform", loop.shared.utils.getPlatform());
 
     // Notify the window that we've finished initalization and initial layout
diff --git a/browser/components/loop/content/js/roomStore.js b/browser/components/loop/content/js/roomStore.js
index 8d5954fb6dc6..90c0193ee15b 100644
--- a/browser/components/loop/content/js/roomStore.js
+++ b/browser/components/loop/content/js/roomStore.js
@@ -513,7 +513,11 @@ loop.store = loop.store || {};
         // When no properties have been set on the roomData object, there's nothing
         // to save.
         if (!Object.getOwnPropertyNames(roomData).length) {
-          this.dispatchAction(new sharedActions.UpdateRoomContextDone());
+          // Ensure async actions so that we get separate setStoreState events
+          // that React components won't miss.
+          setTimeout(function() {
+            this.dispatchAction(new sharedActions.UpdateRoomContextDone());
+          }.bind(this), 0);
           return;
         }
 
diff --git a/browser/components/loop/content/js/roomViews.js b/browser/components/loop/content/js/roomViews.js
index 90788eea9fc5..ba5cf743e305 100644
--- a/browser/components/loop/content/js/roomViews.js
+++ b/browser/components/loop/content/js/roomViews.js
@@ -338,6 +338,13 @@ loop.roomViews = (function(mozL10n) {
         }
       }
 
+      // Make sure we do not show the edit-mode when we just successfully saved
+      // context.
+      if (this.props.savingContext && nextProps.savingContext !== this.props.savingContext &&
+        !nextProps.error && this.state.editMode) {
+        newState.editMode = false;
+      }
+
       if (Object.getOwnPropertyNames(newState).length) {
         this.setState(newState);
       }
@@ -345,7 +352,7 @@ loop.roomViews = (function(mozL10n) {
 
     getDefaultProps: function() {
       return { editMode: false };
-     },
+    },
 
     getInitialState: function() {
       var url = this._getURL();
@@ -528,7 +535,7 @@ loop.roomViews = (function(mozL10n) {
             React.createElement("button", {className: "btn btn-info", 
                     disabled: this.props.savingContext, 
                     onClick: this.handleFormSubmit}, 
-              mozL10n.get("context_save_label")
+              mozL10n.get("context_save_label2")
             ), 
             React.createElement("button", {className: "room-context-btn-close", 
                     onClick: this.handleCloseClick, 
@@ -579,7 +586,10 @@ loop.roomViews = (function(mozL10n) {
 
     propTypes: {
       dispatcher: React.PropTypes.instanceOf(loop.Dispatcher).isRequired,
-      mozLoop: React.PropTypes.object.isRequired
+      mozLoop: React.PropTypes.object.isRequired,
+      // The poster URLs are for UI-showcase testing and development.
+      localPosterUrl: React.PropTypes.string,
+      remotePosterUrl: React.PropTypes.string
     },
 
     componentWillUpdate: function(nextProps, nextState) {
@@ -591,10 +601,7 @@ loop.roomViews = (function(mozL10n) {
         this.props.dispatcher.dispatch(new sharedActions.SetupStreamElements({
           publisherConfig: this.getDefaultPublisherConfig({
             publishVideo: !this.state.videoMuted
-          }),
-          getLocalElementFunc: this._getElement.bind(this, ".local"),
-          getScreenShareElementFunc: this._getElement.bind(this, ".screen"),
-          getRemoteElementFunc: this._getElement.bind(this, ".remote")
+          })
         }));
       }
     },
@@ -635,6 +642,40 @@ loop.roomViews = (function(mozL10n) {
       );
     },
 
+    /**
+     * Works out if remote video should be rended or not, depending on the
+     * room state and other flags.
+     *
+     * @return {Boolean} True if remote video should be rended.
+     */
+    shouldRenderRemoteVideo: function() {
+      switch(this.state.roomState) {
+        case ROOM_STATES.HAS_PARTICIPANTS:
+          if (this.state.remoteVideoEnabled) {
+            return true;
+          }
+
+          if (this.state.mediaConnected) {
+            // since the remoteVideo hasn't yet been enabled, if the
+            // media is connected, then we should be displaying an avatar.
+            return false;
+          }
+
+          return true;
+
+        case ROOM_STATES.SESSION_CONNECTED:
+        case ROOM_STATES.JOINED:
+          // this case is so that we don't show an avatar while waiting for
+          // the other party to connect
+          return true;
+
+        default:
+          console.warn("StandaloneRoomView.shouldRenderRemoteVideo:" +
+            " unexpected roomState: ", this.state.roomState);
+          return true;
+      }
+    },
+
     render: function() {
       if (this.state.roomName) {
         this.setTitle(this.state.roomName);
@@ -674,6 +715,7 @@ loop.roomViews = (function(mozL10n) {
           );
         }
         default: {
+
           return (
             React.createElement("div", {className: "room-conversation-wrapper"}, 
               React.createElement(sharedViews.TextChatView, {dispatcher: this.props.dispatcher}), 
@@ -690,10 +732,19 @@ loop.roomViews = (function(mozL10n) {
                 React.createElement("div", {className: "conversation room-conversation"}, 
                   React.createElement("div", {className: "media nested"}, 
                     React.createElement("div", {className: "video_wrapper remote_wrapper"}, 
-                      React.createElement("div", {className: "video_inner remote focus-stream"})
+                      React.createElement("div", {className: "video_inner remote focus-stream"}, 
+                        React.createElement(sharedViews.MediaView, {displayAvatar: !this.shouldRenderRemoteVideo(), 
+                          posterUrl: this.props.remotePosterUrl, 
+                          mediaType: "remote", 
+                          srcVideoObject: this.state.remoteSrcVideoObject})
+                      )
                     ), 
-                    React.createElement("div", {className: localStreamClasses}), 
-                    React.createElement("div", {className: "screen hide"})
+                    React.createElement("div", {className: localStreamClasses}, 
+                      React.createElement(sharedViews.MediaView, {displayAvatar: this.state.videoMuted, 
+                        posterUrl: this.props.localPosterUrl, 
+                        mediaType: "local", 
+                        srcVideoObject: this.state.localSrcVideoObject})
+                    )
                   ), 
                   React.createElement(sharedViews.ConversationToolbar, {
                     dispatcher: this.props.dispatcher, 
diff --git a/browser/components/loop/content/js/roomViews.jsx b/browser/components/loop/content/js/roomViews.jsx
index 213982c03f99..c46fa85fb4bb 100644
--- a/browser/components/loop/content/js/roomViews.jsx
+++ b/browser/components/loop/content/js/roomViews.jsx
@@ -338,6 +338,13 @@ loop.roomViews = (function(mozL10n) {
         }
       }
 
+      // Make sure we do not show the edit-mode when we just successfully saved
+      // context.
+      if (this.props.savingContext && nextProps.savingContext !== this.props.savingContext &&
+        !nextProps.error && this.state.editMode) {
+        newState.editMode = false;
+      }
+
       if (Object.getOwnPropertyNames(newState).length) {
         this.setState(newState);
       }
@@ -345,7 +352,7 @@ loop.roomViews = (function(mozL10n) {
 
     getDefaultProps: function() {
       return { editMode: false };
-     },
+    },
 
     getInitialState: function() {
       var url = this._getURL();
@@ -528,7 +535,7 @@ loop.roomViews = (function(mozL10n) {
             <button className="btn btn-info"
                     disabled={this.props.savingContext}
                     onClick={this.handleFormSubmit}>
-              {mozL10n.get("context_save_label")}
+              {mozL10n.get("context_save_label2")}
             </button>
             <button className="room-context-btn-close"
                     onClick={this.handleCloseClick}
@@ -579,7 +586,10 @@ loop.roomViews = (function(mozL10n) {
 
     propTypes: {
       dispatcher: React.PropTypes.instanceOf(loop.Dispatcher).isRequired,
-      mozLoop: React.PropTypes.object.isRequired
+      mozLoop: React.PropTypes.object.isRequired,
+      // The poster URLs are for UI-showcase testing and development.
+      localPosterUrl: React.PropTypes.string,
+      remotePosterUrl: React.PropTypes.string
     },
 
     componentWillUpdate: function(nextProps, nextState) {
@@ -591,10 +601,7 @@ loop.roomViews = (function(mozL10n) {
         this.props.dispatcher.dispatch(new sharedActions.SetupStreamElements({
           publisherConfig: this.getDefaultPublisherConfig({
             publishVideo: !this.state.videoMuted
-          }),
-          getLocalElementFunc: this._getElement.bind(this, ".local"),
-          getScreenShareElementFunc: this._getElement.bind(this, ".screen"),
-          getRemoteElementFunc: this._getElement.bind(this, ".remote")
+          })
         }));
       }
     },
@@ -635,6 +642,40 @@ loop.roomViews = (function(mozL10n) {
       );
     },
 
+    /**
+     * Works out if remote video should be rended or not, depending on the
+     * room state and other flags.
+     *
+     * @return {Boolean} True if remote video should be rended.
+     */
+    shouldRenderRemoteVideo: function() {
+      switch(this.state.roomState) {
+        case ROOM_STATES.HAS_PARTICIPANTS:
+          if (this.state.remoteVideoEnabled) {
+            return true;
+          }
+
+          if (this.state.mediaConnected) {
+            // since the remoteVideo hasn't yet been enabled, if the
+            // media is connected, then we should be displaying an avatar.
+            return false;
+          }
+
+          return true;
+
+        case ROOM_STATES.SESSION_CONNECTED:
+        case ROOM_STATES.JOINED:
+          // this case is so that we don't show an avatar while waiting for
+          // the other party to connect
+          return true;
+
+        default:
+          console.warn("StandaloneRoomView.shouldRenderRemoteVideo:" +
+            " unexpected roomState: ", this.state.roomState);
+          return true;
+      }
+    },
+
     render: function() {
       if (this.state.roomName) {
         this.setTitle(this.state.roomName);
@@ -674,6 +715,7 @@ loop.roomViews = (function(mozL10n) {
           );
         }
         default: {
+
           return (
             <div className="room-conversation-wrapper">
               <sharedViews.TextChatView dispatcher={this.props.dispatcher} />
@@ -690,10 +732,19 @@ loop.roomViews = (function(mozL10n) {
                 <div className="conversation room-conversation">
                   <div className="media nested">
                     <div className="video_wrapper remote_wrapper">
-                      <div className="video_inner remote focus-stream"></div>
+                      <div className="video_inner remote focus-stream">
+                        <sharedViews.MediaView displayAvatar={!this.shouldRenderRemoteVideo()}
+                          posterUrl={this.props.remotePosterUrl}
+                          mediaType="remote"
+                          srcVideoObject={this.state.remoteSrcVideoObject} />
+                      </div>
+                    </div>
+                    <div className={localStreamClasses}>
+                      <sharedViews.MediaView displayAvatar={this.state.videoMuted}
+                        posterUrl={this.props.localPosterUrl}
+                        mediaType="local"
+                        srcVideoObject={this.state.localSrcVideoObject} />
                     </div>
-                    <div className={localStreamClasses}></div>
-                    <div className="screen hide"></div>
                   </div>
                   <sharedViews.ConversationToolbar
                     dispatcher={this.props.dispatcher}
diff --git a/browser/components/loop/content/libs/l10n.js b/browser/components/loop/content/libs/l10n.js
index 8429fcfaaff0..f33bac91cbbf 100644
--- a/browser/components/loop/content/libs/l10n.js
+++ b/browser/components/loop/content/libs/l10n.js
@@ -38,8 +38,9 @@
 
   // translate a string
   function translateString(key, args, fallback) {
-    if (args && args.num) {
-      var num = args && args.num;
+    var num;
+    if (args && ("num" in args)) {
+      num = args.num;
     }
     var data = getL10nData(key, num);
     if (!data && fallback)
diff --git a/browser/components/loop/content/shared/css/common.css b/browser/components/loop/content/shared/css/common.css
index e6ff7a96218d..fbf317fcda6a 100644
--- a/browser/components/loop/content/shared/css/common.css
+++ b/browser/components/loop/content/shared/css/common.css
@@ -426,7 +426,7 @@ p {
   border-radius: 2px;
 }
 
-body[dir=rtl] .dropdown-menu {
+html[dir="rtl"] .dropdown-menu {
   left: auto;
   right: 0;
 }
@@ -481,7 +481,7 @@ body[dir=rtl] .dropdown-menu {
   background-size: 1em 1em;
 }
 
-body[dir="rtl"] .checkbox {
+html[dir="rtl"] .checkbox {
   float: right;
 }
 
diff --git a/browser/components/loop/content/shared/css/conversation.css b/browser/components/loop/content/shared/css/conversation.css
index 7011c1fb11c3..d4a45c2fc103 100644
--- a/browser/components/loop/content/shared/css/conversation.css
+++ b/browser/components/loop/content/shared/css/conversation.css
@@ -254,6 +254,12 @@
   left: 0px;
 }
 
+.fx-embedded .no-video {
+  background: black none repeat scroll 0% 0%;
+  height: 100%;
+  width: 100%;
+}
+
 .standalone .local-stream,
 .standalone .remote-inset-stream {
   /* required to have it superimposed to the control toolbar */
@@ -512,11 +518,6 @@
   width: 30%;
   height: 28%;
   max-height: 105px;
-  box-shadow: 0px 2px 4px rgba(0,0,0,.5);
-}
-
-.fx-embedded .room-conversation .local-stream {
-  box-shadow: none;
 }
 
 .fx-embedded .local-stream.room-preview {
@@ -540,73 +541,32 @@
   right: 0;
 }
 
-/*
- * XXX this approach is fragile because it makes assumptions
- * about the generated OT markup, any change will break it
- */
-
 /*
  * For any audio-only streams, we want to display our own background
  */
-.OT_audio-only .OT_widget-container .OT_video-poster {
+.avatar {
   background-image: url("../img/audio-call-avatar.svg");
   background-repeat: no-repeat;
   background-color: #4BA6E7;
   background-size: contain;
   background-position: center;
+
+  /*
+   * Expand to fill the available space, since there is no video any
+   * intrinsic width. XXX should really change to an <img> for clarity
+   */
+  height: 100%;
+  width: 100%;
 }
 
-/*
- * Audio-only. For local streams, cancel out the SDK's opacity of 0.25.
- * For remote streams we leave them shaded, as otherwise its too bright.
- */
-.local-stream-audio .OT_publisher .OT_video-poster {
-  opacity: 1
+.local .avatar {
+  position: absolute;
+  z-index: 1;
 }
 
-/*
- * In audio-only mode, don't display the video element, doing so interferes
- * with the background opacity of the video-poster element.
- */
-.OT_audio-only .OT_widget-container .OT_video-element {
-  display: none;
-}
-
-/*
- * Ensure that the publisher (i.e. local) video is never cropped, so that it's
- * not possible for someone to be presented with a picture that displays
- * (for example) a person from the neck up, even though the camera is capturing
- * and transmitting a picture of that person from the waist up.
- *
- * The !importants are necessary to override the SDK attempts to avoid
- * letterboxing entirely.
- *
- * If we could easily use test video streams with the SDK (eg if initPublisher
- * supported something like a "testMediaToStreamURI" parameter that it would
- * use to source the stream rather than the output of gUM, it wouldn't be too
- * hard to generate a video with a 1 pixel border at the edges that one could
- * at least visually see wasn't being cropped.
- *
- * Another less ugly possibility would be to work with Ted Mielczarek to use
- * the fake camera drivers he has for Linux.
- */
-.room-conversation .OT_publisher .OT_widget-container {
-  height: 100% !important;
-  width: 100% !important;
-  top: 0 !important;
-  left: 0 !important;
-  background-color: transparent; /* avoid visually obvious letterboxing */
-}
-
-.room-conversation .OT_publisher .OT_widget-container video {
-  background-color: transparent; /* avoid visually obvious letterboxing */
-}
-
-.fx-embedded .room-conversation .room-preview .OT_publisher .OT_widget-container,
-.fx-embedded .room-conversation .room-preview .OT_publisher .OT_widget-container video {
-  /* Desktop conversation window room preview local stream actually wants
-     a black background */
-  background-color: #000;
+.remote .avatar {
+  /* make visually distinct from local avatar */
+  opacity: 0.25;
 }
 
 .fx-embedded .media.nested {
@@ -712,7 +672,8 @@ html, .fx-embedded, #main,
   margin: auto;
 }
 
-@media screen and (min-width:640px) {
+/* We use 641px rather than 640, as min-width and max-width are inclusive */
+@media screen and (min-width:641px) {
   .standalone .conversation-toolbar {
     position: absolute;
     bottom: 0;
@@ -766,11 +727,6 @@ html, .fx-embedded, #main,
     height: 90%;
   }
 
-  .standalone .OT_subscriber {
-    height: 100%;
-    width: auto;
-  }
-
   .standalone .media.nested {
     min-height: 500px;
   }
@@ -798,7 +754,7 @@ html, .fx-embedded, #main,
 
   .standalone .video_wrapper.remote_wrapper {
     /* Because of OT markup we need to set a high flex value
-     * Flex rule assures remote and local streams stack on top of eachother
+     * Flex rule assures remote and local streams stack on top of each other
      * Computed width is not 100% unless the `width` rule */
     flex: 2;
     width: 100%;
@@ -923,7 +879,7 @@ html, .fx-embedded, #main,
   text-decoration: underline;
 }
 
-body[dir="rtl"] .room-invitation-addcontext {
+html[dir="rtl"] .room-invitation-addcontext {
   padding-left: 0;
   padding-right: 1.5em;
   background-position: right top;
@@ -1152,13 +1108,13 @@ body[platform="win"] .share-service-dropdown.overflow > .dropdown-menu-item {
   background-image: url("../img/icons-10x10.svg#close-active");
 }
 
-body[dir=rtl] .room-context-btn-close,
-body[dir=rtl] .room-context-btn-edit {
+html[dir="rtl"] .room-context-btn-close,
+html[dir="rtl"] .room-context-btn-edit {
   right: auto;
   left: 8px;
 }
 
-body[dir=rtl] .room-context-btn-edit {
+html[dir="rtl"] .room-context-btn-edit {
   left: 20px;
 }
 
@@ -1278,7 +1234,7 @@ body[dir=rtl] .room-context-btn-edit {
 
 .standalone .room-conversation .video_wrapper.remote_wrapper {
   background-color: #4e4e4e;
-  width: 75%;
+  width: calc(75% - 10px); /* Take the left margin into account. */
 }
 
 .standalone .room-conversation .conversation-toolbar {
@@ -1401,7 +1357,7 @@ body[dir=rtl] .room-context-btn-edit {
 @media screen and (max-height:160px) {
 
   /* disable the self view */
-  .standalone .OT_publisher {
+  .standalone .local-video {
     display: none;
   }
 
@@ -1412,3 +1368,36 @@ body[dir=rtl] .room-context-btn-edit {
     top: 90px;
   }
 }
+
+.remote-video {
+  /* Since there is grey stuff behind us, avoid obvious letterboxing, only do
+   * this on remote video as local video has transparent background.
+   */
+  background-color: black;
+}
+
+.standalone .screen.focus-stream {
+  /* Since there is grey stuff behind us, avoid obvious letterboxing */
+  background-color: black;
+}
+
+.local-video {
+  width: 100%;
+  height: 100%;
+  /* Transform is to make the local video act like a mirror, as is the
+     convention in video conferencing systems. */
+  transform: scale(-1, 1);
+  transform-origin: 50% 50% 0;
+}
+
+.remote-video {
+  width: 100%;
+  height: 100%;
+  display: block;
+  position: absolute;
+}
+
+.screen-share-video {
+  width: 100%;
+  height: 100%;
+}
diff --git a/browser/components/loop/content/shared/js/actions.js b/browser/components/loop/content/shared/js/actions.js
index 32ee46980cc3..09afadf53391 100644
--- a/browser/components/loop/content/shared/js/actions.js
+++ b/browser/components/loop/content/shared/js/actions.js
@@ -193,14 +193,7 @@ loop.shared.actions = (function() {
      */
     SetupStreamElements: Action.define("setupStreamElements", {
       // The configuration for the publisher/subscribe options
-      publisherConfig: Object,
-      // The local stream element
-      getLocalElementFunc: Function,
-      // The screen share element; optional until all conversation
-      // types support it.
-      // getScreenShareElementFunc: Function,
-      // The remote stream element
-      getRemoteElementFunc: Function
+      publisherConfig: Object
     }),
 
     /**
@@ -225,6 +218,42 @@ loop.shared.actions = (function() {
       dimensions: Object
     }),
 
+    /**
+     * Video has been enabled from the remote sender.
+     *
+     * XXX somewhat tangled up with remote video muting semantics; see bug
+     * 1171969
+     *
+     * @note if/when we want to untangle this, we'll may want to include the
+     *       reason provided by the SDK and documented hereI:
+     *       https://tokbox.com/opentok/libraries/client/js/reference/VideoEnabledChangedEvent.html
+     */
+    RemoteVideoEnabled: Action.define("remoteVideoEnabled", {
+      /* The SDK video object that the views will be copying the remote
+         stream from. */
+      srcVideoObject: Object
+    }),
+
+    /**
+     * Video has been disabled by the remote sender.
+     *
+     *  @see RemoteVideoEnabled
+     */
+    RemoteVideoDisabled: Action.define("remoteVideoDisabled", {
+    }),
+
+    /**
+     * Video from the local camera has been enabled.
+     *
+     * XXX we should implement a LocalVideoDisabled action to cleanly prevent
+     * leakage; see bug 1171978 for details
+     */
+    LocalVideoEnabled: Action.define("localVideoEnabled", {
+      /* The SDK video object that the views will be copying the remote
+         stream from. */
+      srcVideoObject: Object
+    }),
+
     /**
      * Used to mute or unmute a stream
      */
@@ -250,7 +279,7 @@ loop.shared.actions = (function() {
     }),
 
     /**
-     * Used to notifiy that screen sharing is active or not.
+     * Used to notify that screen sharing is active or not.
      */
     ScreenSharingState: Action.define("screenSharingState", {
       // One of loop.shared.utils.SCREEN_SHARE_STATES.
@@ -259,9 +288,13 @@ loop.shared.actions = (function() {
 
     /**
      * Used to notify that a shared screen is being received (or not).
+     *
+     * XXX this is going to need to be split into two actions so when
+     * can display a spinner when the screen share is pending (bug 1171933)
      */
     ReceivingScreenShare: Action.define("receivingScreenShare", {
       receiving: Boolean
+      // srcVideoObject: Object (only present if receiving is true)
     }),
 
     /**
diff --git a/browser/components/loop/content/shared/js/activeRoomStore.js b/browser/components/loop/content/shared/js/activeRoomStore.js
index 821554ddd2d3..c41977d5d764 100644
--- a/browser/components/loop/content/shared/js/activeRoomStore.js
+++ b/browser/components/loop/content/shared/js/activeRoomStore.js
@@ -77,10 +77,15 @@ loop.store.ActiveRoomStore = (function() {
      */
     _statesToResetOnLeave: [
       "audioMuted",
+      "localSrcVideoObject",
       "localVideoDimensions",
+      "mediaConnected",
       "receivingScreenShare",
+      "remoteSrcVideoObject",
       "remoteVideoDimensions",
+      "remoteVideoEnabled",
       "screenSharingState",
+      "screenShareVideoObject",
       "videoMuted"
     ],
 
@@ -95,6 +100,7 @@ loop.store.ActiveRoomStore = (function() {
         roomState: ROOM_STATES.INIT,
         audioMuted: false,
         videoMuted: false,
+        remoteVideoEnabled: false,
         failureReason: undefined,
         // Tracks if the room has been used during this
         // session. 'Used' means at least one call has been placed
@@ -115,7 +121,10 @@ loop.store.ActiveRoomStore = (function() {
         roomInfoFailure: null,
         // The name of the room.
         roomName: null,
-        socialShareProviders: null
+        // Social API state.
+        socialShareProviders: null,
+        // True if media has been connected both-ways.
+        mediaConnected: false
       };
     },
 
@@ -169,11 +178,15 @@ loop.store.ActiveRoomStore = (function() {
         "windowUnload",
         "leaveRoom",
         "feedbackComplete",
+        "localVideoEnabled",
+        "remoteVideoEnabled",
+        "remoteVideoDisabled",
         "videoDimensionsChanged",
         "startScreenShare",
         "endScreenShare",
         "updateSocialShareInfo",
-        "connectionStatus"
+        "connectionStatus",
+        "mediaConnected"
       ]);
     },
 
@@ -550,6 +563,41 @@ loop.store.ActiveRoomStore = (function() {
       this.setStoreState(muteState);
     },
 
+    /**
+     * Records the local video object for the room.
+     *
+     * @param {sharedActions.LocalVideoEnabled} actionData
+     */
+    localVideoEnabled: function(actionData) {
+      this.setStoreState({localSrcVideoObject: actionData.srcVideoObject});
+    },
+
+    /**
+     * Records the remote video object for the room.
+     *
+     * @param  {sharedActions.RemoteVideoEnabled} actionData
+     */
+    remoteVideoEnabled: function(actionData) {
+      this.setStoreState({
+        remoteVideoEnabled: true,
+        remoteSrcVideoObject: actionData.srcVideoObject
+      });
+    },
+
+    /**
+     * Records when remote video is disabled (e.g. due to mute).
+     */
+    remoteVideoDisabled: function() {
+      this.setStoreState({remoteVideoEnabled: false});
+    },
+
+    /**
+     * Records when the remote media has been connected.
+     */
+    mediaConnected: function() {
+      this.setStoreState({mediaConnected: true});
+    },
+
     /**
      * Used to note the current screensharing state.
      */
@@ -563,6 +611,9 @@ loop.store.ActiveRoomStore = (function() {
 
     /**
      * Used to note the current state of receiving screenshare data.
+     *
+     * XXX this is going to need to be split into two actions so when
+     * can display a spinner when the screen share is pending (bug 1171933)
      */
     receivingScreenShare: function(actionData) {
       if (!actionData.receiving &&
@@ -573,10 +624,15 @@ loop.store.ActiveRoomStore = (function() {
         delete newDimensions.screen;
         this.setStoreState({
           receivingScreenShare: actionData.receiving,
-          remoteVideoDimensions: newDimensions
+          remoteVideoDimensions: newDimensions,
+          screenShareVideoObject: null
         });
       } else {
-        this.setStoreState({receivingScreenShare: actionData.receiving});
+        this.setStoreState({
+          receivingScreenShare: actionData.receiving,
+          screenShareVideoObject: actionData.srcVideoObject ?
+                                  actionData.srcVideoObject : null
+        });
       }
     },
 
@@ -676,7 +732,10 @@ loop.store.ActiveRoomStore = (function() {
      * one participantleaves.
      */
     remotePeerDisconnected: function() {
-      this.setStoreState({roomState: ROOM_STATES.SESSION_CONNECTED});
+      this.setStoreState({
+        roomState: ROOM_STATES.SESSION_CONNECTED,
+        remoteSrcVideoObject: null
+      });
     },
 
     /**
diff --git a/browser/components/loop/content/shared/js/conversationStore.js b/browser/components/loop/content/shared/js/conversationStore.js
index c38c07ef9049..c34d6ea9e030 100644
--- a/browser/components/loop/content/shared/js/conversationStore.js
+++ b/browser/components/loop/content/shared/js/conversationStore.js
@@ -93,6 +93,8 @@ loop.store = loop.store || {};
         callId: undefined,
         // The caller id of the contacting side
         callerId: undefined,
+        // True if media has been connected both-ways.
+        mediaConnected: false,
         // The connection progress url to connect the websocket
         progressURL: undefined,
         // The websocket token that allows connection to the progress url
@@ -103,10 +105,11 @@ loop.store = loop.store || {};
         sessionId: undefined,
         // SDK session token
         sessionToken: undefined,
-        // If the audio is muted
+        // If the local audio is muted
         audioMuted: false,
-        // If the video is muted
-        videoMuted: false
+        // If the local video is muted
+        videoMuted: false,
+        remoteVideoEnabled: false
       };
     },
 
@@ -232,6 +235,9 @@ loop.store = loop.store || {};
         "mediaConnected",
         "setMute",
         "fetchRoomEmailLink",
+        "localVideoEnabled",
+        "remoteVideoDisabled",
+        "remoteVideoEnabled",
         "windowUnload"
       ]);
 
@@ -408,6 +414,7 @@ loop.store = loop.store || {};
      */
     mediaConnected: function() {
       this._websocket.mediaUp();
+      this.setStoreState({mediaConnected: true});
     },
 
     /**
@@ -440,6 +447,44 @@ loop.store = loop.store || {};
       }.bind(this));
     },
 
+    /**
+     * Handles when the remote stream has been enabled and is supplied.
+     *
+     * @param  {sharedActions.RemoteVideoEnabled} actionData
+     */
+    remoteVideoEnabled: function(actionData) {
+      this.setStoreState({
+        remoteVideoEnabled: true,
+        remoteSrcVideoObject: actionData.srcVideoObject
+      });
+    },
+
+    /**
+     * Handles when the remote stream has been disabled, e.g. due to video mute.
+     *
+     * @param {sharedActions.RemoteVideoDisabled} actionData
+     */
+    remoteVideoDisabled: function(actionData) {
+      this.setStoreState({
+        remoteVideoEnabled: false,
+        remoteSrcVideoObject: undefined});
+    },
+
+    /**
+     * Handles when the local stream is supplied.
+     *
+     * XXX should write a localVideoDisabled action in otSdkDriver.js to
+     * positively ensure proper cleanup (handled by window teardown currently)
+     * (see bug 1171978)
+     *
+     * @param  {sharedActions.LocalVideoEnabled} actionData
+     */
+    localVideoEnabled: function(actionData) {
+      this.setStoreState({
+        localSrcVideoObject: actionData.srcVideoObject
+      });
+    },
+
     /**
      * Called when the window is unloaded, either by code, or by the user
      * explicitly closing it.  Expected to do any necessary housekeeping, such
diff --git a/browser/components/loop/content/shared/js/otSdkDriver.js b/browser/components/loop/content/shared/js/otSdkDriver.js
index f7db5325f21e..9c1fdd71a78b 100644
--- a/browser/components/loop/content/shared/js/otSdkDriver.js
+++ b/browser/components/loop/content/shared/js/otSdkDriver.js
@@ -104,9 +104,6 @@ loop.OTSdkDriver = (function() {
      *   with the action. See action.js.
      */
     setupStreamElements: function(actionData) {
-      this.getLocalElement = actionData.getLocalElementFunc;
-      this.getScreenShareElementFunc = actionData.getScreenShareElementFunc;
-      this.getRemoteElement = actionData.getRemoteElementFunc;
       this.publisherConfig = actionData.publisherConfig;
 
       this.sdk.on("exception", this._onOTException.bind(this));
@@ -122,8 +119,13 @@ loop.OTSdkDriver = (function() {
      * XXX This can be simplified when bug 1138851 is actioned.
      */
     _publishLocalStreams: function() {
-      this.publisher = this.sdk.initPublisher(this.getLocalElement(),
+      // We expect the local video to be muted automatically by the SDK. Hence
+      // we don't mute it manually here.
+      this._mockPublisherEl = document.createElement("div");
+
+      this.publisher = this.sdk.initPublisher(this._mockPublisherEl,
         _.extend(this._getDataChannelSettings, this._getCopyPublisherConfig));
+
       this.publisher.on("streamCreated", this._onLocalStreamCreated.bind(this));
       this.publisher.on("streamDestroyed", this._onLocalStreamDestroyed.bind(this));
       this.publisher.on("accessAllowed", this._onPublishComplete.bind(this));
@@ -182,7 +184,9 @@ loop.OTSdkDriver = (function() {
 
       var config = _.extend(this._getCopyPublisherConfig, options);
 
-      this.screenshare = this.sdk.initPublisher(this.getScreenShareElementFunc(),
+      this._mockScreenSharePreviewEl = document.createElement("div");
+
+      this.screenshare = this.sdk.initPublisher(this._mockScreenSharePreviewEl,
         config);
       this.screenshare.on("accessAllowed", this._onScreenShareGranted.bind(this));
       this.screenshare.on("accessDenied", this._onScreenShareDenied.bind(this));
@@ -209,7 +213,7 @@ loop.OTSdkDriver = (function() {
      * Ends an active screenshare session. Return `true` when an active screen-
      * sharing session was ended or `false` when no session is active.
      *
-     * @type {Boolean}
+     * @returns {Boolean}
      */
     endScreenShare: function() {
       if (!this.screenshare) {
@@ -222,6 +226,7 @@ loop.OTSdkDriver = (function() {
       this.screenshare.off("accessAllowed accessDenied streamCreated");
       this.screenshare.destroy();
       delete this.screenshare;
+      delete this._mockScreenSharePreviewEl;
       this._noteSharingState(this._windowId ? "browser" : "window", false);
       delete this._windowId;
       return true;
@@ -289,6 +294,7 @@ loop.OTSdkDriver = (function() {
       delete this._publisherReady;
       delete this._publishedLocalStream;
       delete this._subscribedRemoteStream;
+      delete this._mockPublisherEl;
       this.connections = {};
       this._setTwoWayMediaStartTime(this.CONNECTION_START_TIME_UNINITIALIZED);
     },
@@ -499,19 +505,23 @@ loop.OTSdkDriver = (function() {
      * https://tokbox.com/opentok/libraries/client/js/reference/Stream.html
      */
     _handleRemoteScreenShareCreated: function(stream) {
-      if (!this.getScreenShareElementFunc) {
-        return;
-      }
-
       // Let the stores know first so they can update the display.
-      this.dispatcher.dispatch(new sharedActions.ReceivingScreenShare({
-        receiving: true
-      }));
+      // XXX We do want to do this - we want them to start re-arranging the
+      // display so that we can a) indicate connecting, b) be ready for
+      // when we get the stream. However, we're currently limited by the fact
+      // the view calculations require the remote (aka screen share) element to
+      // be present and laid out. Hence, we need to drop this for the time being,
+      // and let the client know via _onScreenShareSubscribeCompleted.
+      // Bug 1171933 is going to look at fixing this.
+      // this.dispatcher.dispatch(new sharedActions.ReceivingScreenShare({
+      //  receiving: true
+      // }));
 
-      var remoteElement = this.getScreenShareElementFunc();
-
-      this.session.subscribe(stream,
-        remoteElement, this._getCopyPublisherConfig);
+      // There's no audio for screen shares so we don't need to worry about mute.
+      this._mockScreenShareEl = document.createElement("div");
+      this.session.subscribe(stream, this._mockScreenShareEl,
+        this._getCopyPublisherConfig,
+        this._onScreenShareSubscribeCompleted.bind(this));
     },
 
     /**
@@ -536,17 +546,88 @@ loop.OTSdkDriver = (function() {
         return;
       }
 
-      var remoteElement = this.getRemoteElement();
+      // Setting up the subscribe might want to be before the VideoDimensionsChange
+      // dispatch. If so, we might also want to consider moving the dispatch to
+      // _onSubscribeCompleted. However, this seems to work fine at the moment,
+      // so we haven't felt the need to move it.
+
+      // XXX This mock element currently handles playing audio for the session.
+      // We might want to consider making the react tree responsible for playing
+      // the audio, so that the incoming audio could be disable/tracked easly from
+      // the UI (bug 1171896).
+      this._mockSubscribeEl = document.createElement("div");
 
       this.subscriber = this.session.subscribe(event.stream,
-        remoteElement, this._getCopyPublisherConfig,
-        this._onRemoteSessionSubscribed.bind(this, event.stream.connection));
+        this._mockSubscribeEl, this._getCopyPublisherConfig,
+        this._onSubscribeCompleted.bind(this));
+    },
+
+    /**
+     * This method is passed as the "completionHandler" parameter to the SDK's
+     * Session.subscribe.
+     *
+     * @param err {(null|Error)} - null on success, an Error object otherwise
+     * @param sdkSubscriberObject {OT.Subscriber} - undocumented; returned on success
+     * @param subscriberVideo {HTMLVideoElement} - used for unit testing
+     */
+    _onSubscribeCompleted: function(err, sdkSubscriberObject, subscriberVideo) {
+      // XXX test for and handle errors better (bug 1172140)
+      if (err) {
+        console.log("subscribe error:", err);
+        return;
+      }
+
+      var sdkSubscriberVideo = subscriberVideo ? subscriberVideo :
+        this._mockSubscribeEl.querySelector("video");
+      if (!sdkSubscriberVideo) {
+        console.error("sdkSubscriberVideo unexpectedly falsy!");
+      }
+
+      sdkSubscriberObject.on("videoEnabled", this._onVideoEnabled.bind(this));
+      sdkSubscriberObject.on("videoDisabled", this._onVideoDisabled.bind(this));
+
+      // XXX for some reason, the SDK deliberately suppresses sending the
+      // videoEnabled event after subscribe, in spite of docs claiming
+      // otherwise, so we do it ourselves.
+      if (sdkSubscriberObject.stream.hasVideo) {
+        this.dispatcher.dispatch(new sharedActions.RemoteVideoEnabled({
+          srcVideoObject: sdkSubscriberVideo}));
+      }
 
       this._subscribedRemoteStream = true;
       if (this._checkAllStreamsConnected()) {
         this._setTwoWayMediaStartTime(performance.now());
         this.dispatcher.dispatch(new sharedActions.MediaConnected());
       }
+
+      this._setupDataChannelIfNeeded(sdkSubscriberObject.stream.connection);
+    },
+
+    /**
+     * This method is passed as the "completionHandler" parameter to the SDK's
+     * Session.subscribe.
+     *
+     * @param err {(null|Error)} - null on success, an Error object otherwise
+     * @param sdkSubscriberObject {OT.Subscriber} - undocumented; returned on success
+     * @param subscriberVideo {HTMLVideoElement} - used for unit testing
+     */
+    _onScreenShareSubscribeCompleted: function(err, sdkSubscriberObject, subscriberVideo) {
+      // XXX test for and handle errors better
+      if (err) {
+        console.log("subscribe error:", err);
+        return;
+      }
+
+      var sdkSubscriberVideo = subscriberVideo ? subscriberVideo :
+        this._mockScreenShareEl.querySelector("video");
+
+      // XXX no idea why this is necessary in addition to the dispatch in
+      // _handleRemoteScreenShareCreated.  Maybe these should be separate
+      // actions.  But even so, this shouldn't be necessary....
+      this.dispatcher.dispatch(new sharedActions.ReceivingScreenShare({
+        receiving: true, srcVideoObject: sdkSubscriberVideo
+      }));
+
     },
 
     /**
@@ -554,16 +635,11 @@ loop.OTSdkDriver = (function() {
      * channel set-up routines. A data channel cannot be requested before this
      * time as the peer connection is not set up.
      *
-     * @param {OT.Connection} connection The OT connection class object.
-     * @param {OT.Error}      err        Indicates if there's been an error in
-     *                                    completing the subscribe.
+     * @param {OT.Connection} connection The OT connection class object.paul
+     * sched
+     *
      */
-    _onRemoteSessionSubscribed: function(connection, err) {
-      if (err) {
-        console.error(err);
-        return;
-      }
-
+    _setupDataChannelIfNeeded: function(connection) {
       if (this._useDataChannels) {
         this.session.signal({
           type: "readyForDataChannel",
@@ -670,6 +746,12 @@ loop.OTSdkDriver = (function() {
       this._notifyMetricsEvent("Publisher.streamCreated");
 
       if (event.stream[STREAM_PROPERTIES.HAS_VIDEO]) {
+
+        var sdkLocalVideo = this._mockPublisherEl.querySelector("video");
+
+        this.dispatcher.dispatch(new sharedActions.LocalVideoEnabled(
+              {srcVideoObject: sdkLocalVideo}));
+
         this.dispatcher.dispatch(new sharedActions.VideoDimensionsChanged({
           isLocal: true,
           videoType: event.stream.videoType,
@@ -739,6 +821,7 @@ loop.OTSdkDriver = (function() {
       this._notifyMetricsEvent("Session.streamDestroyed");
 
       if (event.stream.videoType !== "screen") {
+        delete this._mockSubscribeEl;
         return;
       }
 
@@ -747,6 +830,8 @@ loop.OTSdkDriver = (function() {
       this.dispatcher.dispatch(new sharedActions.ReceivingScreenShare({
         receiving: false
       }));
+
+      delete this._mockScreenShareEl;
     },
 
     /**
@@ -754,6 +839,7 @@ loop.OTSdkDriver = (function() {
      */
     _onLocalStreamDestroyed: function() {
       this._notifyMetricsEvent("Publisher.streamDestroyed");
+      delete this._mockPublisherEl;
     },
 
     /**
@@ -793,6 +879,8 @@ loop.OTSdkDriver = (function() {
       this.dispatcher.dispatch(new sharedActions.ConnectionFailure({
         reason: FAILURE_DETAILS.MEDIA_DENIED
       }));
+
+      delete this._mockPublisherEl;
     },
 
     _onOTException: function(event) {
@@ -804,6 +892,7 @@ loop.OTSdkDriver = (function() {
           this.publisher.off("accessAllowed accessDenied accessDialogOpened streamCreated");
           this.publisher.destroy();
           delete this.publisher;
+          delete this._mockPublisherEl;
         }
         this.dispatcher.dispatch(new sharedActions.ConnectionFailure({
           reason: FAILURE_DETAILS.UNABLE_TO_PUBLISH_MEDIA
@@ -824,6 +913,42 @@ loop.OTSdkDriver = (function() {
       }
     },
 
+    /**
+     * Handle the (remote) VideoEnabled event from the subscriber object
+     * by dispatching an action with the (hidden) video element from
+     * which to copy the stream when attaching it to visible video element
+     * that the views control directly.
+     *
+     * @param event {OT.VideoEnabledChangedEvent} from the SDK
+     *
+     * @see https://tokbox.com/opentok/libraries/client/js/reference/VideoEnabledChangedEvent.html
+     * @private
+     */
+    _onVideoEnabled: function(event) {
+      var sdkSubscriberVideo = this._mockSubscribeEl.querySelector("video");
+      if (!sdkSubscriberVideo) {
+        console.error("sdkSubscriberVideo unexpectedly falsy!");
+      }
+
+      this.dispatcher.dispatch(
+        new sharedActions.RemoteVideoEnabled(
+          {srcVideoObject: sdkSubscriberVideo}));
+    },
+
+    /**
+     * Handle the SDK disabling of remote video by dispatching the
+     * appropriate event.
+     *
+     * @param event {OT.VideoEnabledChangedEvent) from the SDK
+     *
+     * @see https://tokbox.com/opentok/libraries/client/js/reference/VideoEnabledChangedEvent.html
+     * @private
+     */
+    _onVideoDisabled: function(event) {
+      this.dispatcher.dispatch(
+        new sharedActions.RemoteVideoDisabled());
+    },
+
     /**
      * Publishes the local stream if the session is connected
      * and the publisher is ready.
@@ -868,6 +993,7 @@ loop.OTSdkDriver = (function() {
       this.dispatcher.dispatch(new sharedActions.ScreenSharingState({
         state: SCREEN_SHARE_STATES.INACTIVE
       }));
+      delete this._mockScreenSharePreviewEl;
     },
 
     /**
diff --git a/browser/components/loop/content/shared/js/views.js b/browser/components/loop/content/shared/js/views.js
index 3507ad409947..0366c19f2c44 100644
--- a/browser/components/loop/content/shared/js/views.js
+++ b/browser/components/loop/content/shared/js/views.js
@@ -678,13 +678,132 @@ loop.shared.views = (function(_, l10n) {
     }
   });
 
+  /**
+   * Renders an avatar element for display when video is muted.
+   */
+  var AvatarView = React.createClass({displayName: "AvatarView",
+    mixins: [React.addons.PureRenderMixin],
+
+    render: function() {
+        return React.createElement("div", {className: "avatar"});
+    }
+  });
+
+  /**
+   * Renders a media element for display. This also handles displaying an avatar
+   * instead of the video, and attaching a video stream to the video element.
+   */
+  var MediaView = React.createClass({displayName: "MediaView",
+    // srcVideoObject should be ok for a shallow comparison, so we are safe
+    // to use the pure render mixin here.
+    mixins: [React.addons.PureRenderMixin],
+
+    PropTypes: {
+      displayAvatar: React.PropTypes.bool.isRequired,
+      posterUrl: React.PropTypes.string,
+      // Expecting "local" or "remote".
+      mediaType: React.PropTypes.string.isRequired,
+      srcVideoObject: React.PropTypes.object
+    },
+
+    componentDidMount: function() {
+      if (!this.props.displayAvatar) {
+        this.attachVideo(this.props.srcVideoObject);
+      }
+    },
+
+    componentDidUpdate: function() {
+      if (!this.props.displayAvatar) {
+        this.attachVideo(this.props.srcVideoObject);
+      }
+    },
+
+    /**
+     * Attaches a video stream from a donor video element to this component's
+     * video element if the component is displaying one.
+     *
+     * @param {Object} srcVideoObject The src video object to clone the stream
+     *                                from.
+     *
+     * XXX need to have a corresponding detachVideo or change this to syncVideo
+     * to protect from leaks (bug 1171978)
+     */
+    attachVideo: function(srcVideoObject) {
+      if (!srcVideoObject) {
+        // Not got anything to display.
+        return;
+      }
+
+      var videoElement = this.getDOMNode();
+
+      if (videoElement.tagName.toLowerCase() !== "video") {
+        // Must be displaying the avatar view, so don't try and attach video.
+        return;
+      }
+
+      // Set the src of our video element
+      var attrName = "";
+      if ("srcObject" in videoElement) {
+        // srcObject is according to the standard.
+        attrName = "srcObject";
+      } else if ("mozSrcObject" in videoElement) {
+        // mozSrcObject is for Firefox
+        attrName = "mozSrcObject";
+      } else if ("src" in videoElement) {
+        // src is for Chrome.
+        attrName = "src";
+      } else {
+        console.error("Error attaching stream to element - no supported attribute found");
+        return;
+      }
+
+      // If the object hasn't changed it, then don't reattach it.
+      if (videoElement[attrName] !== srcVideoObject[attrName]) {
+        videoElement[attrName] = srcVideoObject[attrName];
+      }
+      videoElement.play();
+    },
+
+    render: function() {
+      if (this.props.displayAvatar) {
+        return React.createElement(AvatarView, null);
+      }
+
+      if (!this.props.srcVideoObject && !this.props.posterUrl) {
+        return React.createElement("div", {className: "no-video"});
+      }
+
+      var optionalPoster = {};
+      if (this.props.posterUrl) {
+        optionalPoster.poster = this.props.posterUrl;
+      }
+
+      // For now, always mute media. For local media, we should be muted anyway,
+      // as we don't want to hear ourselves speaking.
+      //
+      // For remote media, we would ideally have this live video element in
+      // control of the audio, but due to the current method of not rendering
+      // the element at all when video is muted we have to rely on the hidden
+      // dom element in the sdk driver to play the audio.
+      // We might want to consider changing this if we add UI controls relating
+      // to the remote audio at some stage in the future.
+      return (
+        React.createElement("video", React.__spread({},  optionalPoster, 
+               {className: this.props.mediaType + "-video", 
+               muted: true}))
+      );
+    }
+  });
+
   return {
+    AvatarView: AvatarView,
     Button: Button,
     ButtonGroup: ButtonGroup,
     Checkbox: Checkbox,
     ConversationView: ConversationView,
     ConversationToolbar: ConversationToolbar,
     MediaControlButton: MediaControlButton,
+    MediaView: MediaView,
     ScreenShareControlButton: ScreenShareControlButton,
     NotificationListView: NotificationListView
   };
diff --git a/browser/components/loop/content/shared/js/views.jsx b/browser/components/loop/content/shared/js/views.jsx
index ca97e2ff4487..a15f59313dba 100644
--- a/browser/components/loop/content/shared/js/views.jsx
+++ b/browser/components/loop/content/shared/js/views.jsx
@@ -678,13 +678,132 @@ loop.shared.views = (function(_, l10n) {
     }
   });
 
+  /**
+   * Renders an avatar element for display when video is muted.
+   */
+  var AvatarView = React.createClass({
+    mixins: [React.addons.PureRenderMixin],
+
+    render: function() {
+        return <div className="avatar"/>;
+    }
+  });
+
+  /**
+   * Renders a media element for display. This also handles displaying an avatar
+   * instead of the video, and attaching a video stream to the video element.
+   */
+  var MediaView = React.createClass({
+    // srcVideoObject should be ok for a shallow comparison, so we are safe
+    // to use the pure render mixin here.
+    mixins: [React.addons.PureRenderMixin],
+
+    PropTypes: {
+      displayAvatar: React.PropTypes.bool.isRequired,
+      posterUrl: React.PropTypes.string,
+      // Expecting "local" or "remote".
+      mediaType: React.PropTypes.string.isRequired,
+      srcVideoObject: React.PropTypes.object
+    },
+
+    componentDidMount: function() {
+      if (!this.props.displayAvatar) {
+        this.attachVideo(this.props.srcVideoObject);
+      }
+    },
+
+    componentDidUpdate: function() {
+      if (!this.props.displayAvatar) {
+        this.attachVideo(this.props.srcVideoObject);
+      }
+    },
+
+    /**
+     * Attaches a video stream from a donor video element to this component's
+     * video element if the component is displaying one.
+     *
+     * @param {Object} srcVideoObject The src video object to clone the stream
+     *                                from.
+     *
+     * XXX need to have a corresponding detachVideo or change this to syncVideo
+     * to protect from leaks (bug 1171978)
+     */
+    attachVideo: function(srcVideoObject) {
+      if (!srcVideoObject) {
+        // Not got anything to display.
+        return;
+      }
+
+      var videoElement = this.getDOMNode();
+
+      if (videoElement.tagName.toLowerCase() !== "video") {
+        // Must be displaying the avatar view, so don't try and attach video.
+        return;
+      }
+
+      // Set the src of our video element
+      var attrName = "";
+      if ("srcObject" in videoElement) {
+        // srcObject is according to the standard.
+        attrName = "srcObject";
+      } else if ("mozSrcObject" in videoElement) {
+        // mozSrcObject is for Firefox
+        attrName = "mozSrcObject";
+      } else if ("src" in videoElement) {
+        // src is for Chrome.
+        attrName = "src";
+      } else {
+        console.error("Error attaching stream to element - no supported attribute found");
+        return;
+      }
+
+      // If the object hasn't changed it, then don't reattach it.
+      if (videoElement[attrName] !== srcVideoObject[attrName]) {
+        videoElement[attrName] = srcVideoObject[attrName];
+      }
+      videoElement.play();
+    },
+
+    render: function() {
+      if (this.props.displayAvatar) {
+        return <AvatarView />;
+      }
+
+      if (!this.props.srcVideoObject && !this.props.posterUrl) {
+        return <div className="no-video"/>;
+      }
+
+      var optionalPoster = {};
+      if (this.props.posterUrl) {
+        optionalPoster.poster = this.props.posterUrl;
+      }
+
+      // For now, always mute media. For local media, we should be muted anyway,
+      // as we don't want to hear ourselves speaking.
+      //
+      // For remote media, we would ideally have this live video element in
+      // control of the audio, but due to the current method of not rendering
+      // the element at all when video is muted we have to rely on the hidden
+      // dom element in the sdk driver to play the audio.
+      // We might want to consider changing this if we add UI controls relating
+      // to the remote audio at some stage in the future.
+      return (
+        <video {...optionalPoster}
+               className={this.props.mediaType + "-video"}
+               muted />
+      );
+    }
+  });
+
   return {
+    AvatarView: AvatarView,
     Button: Button,
     ButtonGroup: ButtonGroup,
     Checkbox: Checkbox,
     ConversationView: ConversationView,
     ConversationToolbar: ConversationToolbar,
     MediaControlButton: MediaControlButton,
+    MediaView: MediaView,
     ScreenShareControlButton: ScreenShareControlButton,
     NotificationListView: NotificationListView
   };
diff --git a/browser/components/loop/modules/MozLoopService.jsm b/browser/components/loop/modules/MozLoopService.jsm
index 096a93f8f0c0..5369ee8546b7 100644
--- a/browser/components/loop/modules/MozLoopService.jsm
+++ b/browser/components/loop/modules/MozLoopService.jsm
@@ -122,7 +122,7 @@ XPCOMUtils.defineLazyServiceGetter(this, "gWM",
 XPCOMUtils.defineLazyGetter(this, "log", () => {
   let ConsoleAPI = Cu.import("resource://gre/modules/devtools/Console.jsm", {}).ConsoleAPI;
   let consoleOptions = {
-    maxLogLevel: Services.prefs.getCharPref(PREF_LOG_LEVEL).toLowerCase(),
+    maxLogLevelPref: PREF_LOG_LEVEL,
     prefix: "Loop"
   };
   return new ConsoleAPI(consoleOptions);
diff --git a/browser/components/loop/standalone/content/js/standaloneMozLoop.js b/browser/components/loop/standalone/content/js/standaloneMozLoop.js
index 7a32b426871c..49ae826e8375 100644
--- a/browser/components/loop/standalone/content/js/standaloneMozLoop.js
+++ b/browser/components/loop/standalone/content/js/standaloneMozLoop.js
@@ -131,7 +131,6 @@ loop.StandaloneMozLoop = (function(mozL10n) {
         },
         async: async,
         success: function(responseData) {
-          console.log("done");
           try {
             callback(null, validate(responseData, expectedProps));
           } catch (err) {
diff --git a/browser/components/loop/standalone/content/js/standaloneRoomViews.js b/browser/components/loop/standalone/content/js/standaloneRoomViews.js
index 441ae49d94e6..ff172d2626d1 100644
--- a/browser/components/loop/standalone/content/js/standaloneRoomViews.js
+++ b/browser/components/loop/standalone/content/js/standaloneRoomViews.js
@@ -337,7 +337,11 @@ loop.standaloneRoomViews = (function(mozL10n) {
         React.PropTypes.instanceOf(loop.store.FxOSActiveRoomStore)
       ]).isRequired,
       dispatcher: React.PropTypes.instanceOf(loop.Dispatcher).isRequired,
-      isFirefox: React.PropTypes.bool.isRequired
+      isFirefox: React.PropTypes.bool.isRequired,
+      // The poster URLs are for UI-showcase testing and development
+      localPosterUrl: React.PropTypes.string,
+      remotePosterUrl: React.PropTypes.string,
+      screenSharePosterUrl: React.PropTypes.string
     },
 
     getInitialState: function() {
@@ -385,10 +389,7 @@ loop.standaloneRoomViews = (function(mozL10n) {
       if (this.state.roomState !== ROOM_STATES.MEDIA_WAIT &&
           nextState.roomState === ROOM_STATES.MEDIA_WAIT) {
         this.props.dispatcher.dispatch(new sharedActions.SetupStreamElements({
-          publisherConfig: this.getDefaultPublisherConfig({publishVideo: true}),
-          getLocalElementFunc: this._getElement.bind(this, ".local"),
-          getRemoteElementFunc: this._getElement.bind(this, ".remote"),
-          getScreenShareElementFunc: this._getElement.bind(this, ".screen")
+          publisherConfig: this.getDefaultPublisherConfig({publishVideo: true})
         }));
       }
 
@@ -411,8 +412,10 @@ loop.standaloneRoomViews = (function(mozL10n) {
         // Remove the custom screenshare styles on the remote camera.
         var node = this._getElement(".remote");
         node.removeAttribute("style");
+      }
 
-        // Force the video sizes to update.
+      if (this.state.receivingScreenShare != nextState.receivingScreenShare ||
+          this.state.remoteVideoEnabled != nextState.remoteVideoEnabled) {
         this.updateVideoContainer();
       }
     },
@@ -425,6 +428,32 @@ loop.standaloneRoomViews = (function(mozL10n) {
       this.props.dispatcher.dispatch(new sharedActions.LeaveRoom());
     },
 
+    /**
+     * Wrapper for window.matchMedia so that we use an appropriate version
+     * for the ui-showcase, which puts views inside of their own iframes.
+     *
+     * Currently, we use an icky hack, and the showcase conspires with
+     * react-frame-component to set iframe.contentWindow.matchMedia onto
+     * activeRoomStore.  Once React context matures a bit (somewhere between
+     * 0.14 and 1.0, apparently):
+     *
+     * https://facebook.github.io/react/blog/2015/02/24/streamlining-react-elements.html#solution-make-context-parent-based-instead-of-owner-based
+     *
+     * we should be able to use those to clean this up.
+     *
+     * @param queryString
+     * @returns {MediaQueryList|null}
+     * @private
+     */
+    _matchMedia: function(queryString) {
+      if ("matchMedia" in this.state) {
+        return this.state.matchMedia(queryString);
+      } else if ("matchMedia" in window) {
+        return window.matchMedia(queryString);
+      }
+      return null;
+    },
+
     /**
      * Toggles streaming status for a given stream type.
      *
@@ -458,7 +487,7 @@ loop.standaloneRoomViews = (function(mozL10n) {
       var targetWidth;
 
       node.style.right = "auto";
-      if (window.matchMedia && window.matchMedia("screen and (max-width:640px)").matches) {
+      if (this._matchMedia("screen and (max-width:640px)").matches) {
         // For reduced screen widths, we just go for a fixed size and no overlap.
         targetWidth = 180;
         node.style.width = (targetWidth * ratio.width) + "px";
@@ -470,8 +499,25 @@ loop.standaloneRoomViews = (function(mozL10n) {
 
         // Now position the local camera view correctly with respect to the remote
         // video stream or the screen share stream.
-        var remoteVideoDimensions = this.getRemoteVideoDimensions(
-          this.state.receivingScreenShare ? "screen" : "camera");
+        var remoteVideoDimensions;
+        var isScreenShare = this.state.receivingScreenShare;
+        var videoDisplayed = isScreenShare ?
+          this.state.screenShareVideoObject || this.props.screenSharePosterUrl :
+          this.state.remoteSrcVideoObject || this.props.remotePosterUrl;
+
+        if ((isScreenShare || this.shouldRenderRemoteVideo()) && videoDisplayed) {
+          remoteVideoDimensions = this.getRemoteVideoDimensions(
+            isScreenShare ? "screen" : "camera");
+        } else {
+          var remoteElement = this.getDOMNode().querySelector(".remote.focus-stream");
+          if (!remoteElement) {
+            return;
+          }
+          remoteVideoDimensions = {
+            streamWidth: remoteElement.offsetWidth,
+            offsetX: remoteElement.offsetLeft
+          };
+        }
 
         targetWidth = remoteVideoDimensions.streamWidth * LOCAL_STREAM_SIZE;
 
@@ -515,7 +561,7 @@ loop.standaloneRoomViews = (function(mozL10n) {
       }
       // XXX For the time being, if we're a narrow screen, aka mobile, we don't display
       // the remote media (bug 1133534).
-      if (window.matchMedia && window.matchMedia("screen and (max-width:640px)").matches) {
+      if (this._matchMedia("screen and (max-width:640px)").matches) {
         return;
       }
 
@@ -557,9 +603,51 @@ loop.standaloneRoomViews = (function(mozL10n) {
              this.state.roomState === ROOM_STATES.HAS_PARTICIPANTS;
     },
 
+    /**
+     * Works out if remote video should be rended or not, depending on the
+     * room state and other flags.
+     *
+     * @return {Boolean} True if remote video should be rended.
+     */
+    shouldRenderRemoteVideo: function() {
+      switch(this.state.roomState) {
+        case ROOM_STATES.HAS_PARTICIPANTS:
+          if (this.state.remoteVideoEnabled) {
+            return true;
+          }
+
+          if (this.state.mediaConnected) {
+            // since the remoteVideo hasn't yet been enabled, if the
+            // media is connected, then we should be displaying an avatar.
+            return false;
+          }
+
+          return true;
+
+        case ROOM_STATES.READY:
+        case ROOM_STATES.INIT:
+        case ROOM_STATES.JOINING:
+        case ROOM_STATES.SESSION_CONNECTED:
+        case ROOM_STATES.JOINED:
+        case ROOM_STATES.MEDIA_WAIT:
+          // this case is so that we don't show an avatar while waiting for
+          // the other party to connect
+          return true;
+
+        case ROOM_STATES.CLOSING:
+          // the other person has shown up, so we don't want to show an avatar
+          return true;
+
+        default:
+          console.warn("StandaloneRoomView.shouldRenderRemoteVideo:" +
+            " unexpected roomState: ", this.state.roomState);
+          return true;
+
+      }
+    },
+
     render: function() {
       var localStreamClasses = React.addons.classSet({
-        hide: !this._roomIsActive(),
         local: true,
         "local-stream": true,
         "local-stream-audio": this.state.videoMuted
@@ -602,10 +690,25 @@ loop.standaloneRoomViews = (function(mozL10n) {
                   mozL10n.get("self_view_hidden_message")
                 ), 
                 React.createElement("div", {className: "video_wrapper remote_wrapper"}, 
-                  React.createElement("div", {className: remoteStreamClasses}), 
-                  React.createElement("div", {className: screenShareStreamClasses})
+                  React.createElement("div", {className: remoteStreamClasses}, 
+                    React.createElement(sharedViews.MediaView, {displayAvatar: !this.shouldRenderRemoteVideo(), 
+                      posterUrl: this.props.remotePosterUrl, 
+                      mediaType: "remote", 
+                      srcVideoObject: this.state.remoteSrcVideoObject})
+                  ), 
+                  React.createElement("div", {className: screenShareStreamClasses}, 
+                    React.createElement(sharedViews.MediaView, {displayAvatar: false, 
+                      posterUrl: this.props.screenSharePosterUrl, 
+                      mediaType: "screen-share", 
+                      srcVideoObject: this.state.screenShareVideoObject})
+                  )
                 ), 
-                React.createElement("div", {className: localStreamClasses})
+                React.createElement("div", {className: localStreamClasses}, 
+                  React.createElement(sharedViews.MediaView, {displayAvatar: this.state.videoMuted, 
+                    posterUrl: this.props.localPosterUrl, 
+                    mediaType: "local", 
+                    srcVideoObject: this.state.localSrcVideoObject})
+                )
               ), 
               React.createElement(sharedViews.ConversationToolbar, {
                 dispatcher: this.props.dispatcher, 
diff --git a/browser/components/loop/standalone/content/js/standaloneRoomViews.jsx b/browser/components/loop/standalone/content/js/standaloneRoomViews.jsx
index 3e2ba0e2f7ea..b30db8bc43d5 100644
--- a/browser/components/loop/standalone/content/js/standaloneRoomViews.jsx
+++ b/browser/components/loop/standalone/content/js/standaloneRoomViews.jsx
@@ -337,7 +337,11 @@ loop.standaloneRoomViews = (function(mozL10n) {
         React.PropTypes.instanceOf(loop.store.FxOSActiveRoomStore)
       ]).isRequired,
       dispatcher: React.PropTypes.instanceOf(loop.Dispatcher).isRequired,
-      isFirefox: React.PropTypes.bool.isRequired
+      isFirefox: React.PropTypes.bool.isRequired,
+      // The poster URLs are for UI-showcase testing and development
+      localPosterUrl: React.PropTypes.string,
+      remotePosterUrl: React.PropTypes.string,
+      screenSharePosterUrl: React.PropTypes.string
     },
 
     getInitialState: function() {
@@ -385,10 +389,7 @@ loop.standaloneRoomViews = (function(mozL10n) {
       if (this.state.roomState !== ROOM_STATES.MEDIA_WAIT &&
           nextState.roomState === ROOM_STATES.MEDIA_WAIT) {
         this.props.dispatcher.dispatch(new sharedActions.SetupStreamElements({
-          publisherConfig: this.getDefaultPublisherConfig({publishVideo: true}),
-          getLocalElementFunc: this._getElement.bind(this, ".local"),
-          getRemoteElementFunc: this._getElement.bind(this, ".remote"),
-          getScreenShareElementFunc: this._getElement.bind(this, ".screen")
+          publisherConfig: this.getDefaultPublisherConfig({publishVideo: true})
         }));
       }
 
@@ -411,8 +412,10 @@ loop.standaloneRoomViews = (function(mozL10n) {
         // Remove the custom screenshare styles on the remote camera.
         var node = this._getElement(".remote");
         node.removeAttribute("style");
+      }
 
-        // Force the video sizes to update.
+      if (this.state.receivingScreenShare != nextState.receivingScreenShare ||
+          this.state.remoteVideoEnabled != nextState.remoteVideoEnabled) {
         this.updateVideoContainer();
       }
     },
@@ -425,6 +428,32 @@ loop.standaloneRoomViews = (function(mozL10n) {
       this.props.dispatcher.dispatch(new sharedActions.LeaveRoom());
     },
 
+    /**
+     * Wrapper for window.matchMedia so that we use an appropriate version
+     * for the ui-showcase, which puts views inside of their own iframes.
+     *
+     * Currently, we use an icky hack, and the showcase conspires with
+     * react-frame-component to set iframe.contentWindow.matchMedia onto
+     * activeRoomStore.  Once React context matures a bit (somewhere between
+     * 0.14 and 1.0, apparently):
+     *
+     * https://facebook.github.io/react/blog/2015/02/24/streamlining-react-elements.html#solution-make-context-parent-based-instead-of-owner-based
+     *
+     * we should be able to use those to clean this up.
+     *
+     * @param queryString
+     * @returns {MediaQueryList|null}
+     * @private
+     */
+    _matchMedia: function(queryString) {
+      if ("matchMedia" in this.state) {
+        return this.state.matchMedia(queryString);
+      } else if ("matchMedia" in window) {
+        return window.matchMedia(queryString);
+      }
+      return null;
+    },
+
     /**
      * Toggles streaming status for a given stream type.
      *
@@ -458,7 +487,7 @@ loop.standaloneRoomViews = (function(mozL10n) {
       var targetWidth;
 
       node.style.right = "auto";
-      if (window.matchMedia && window.matchMedia("screen and (max-width:640px)").matches) {
+      if (this._matchMedia("screen and (max-width:640px)").matches) {
         // For reduced screen widths, we just go for a fixed size and no overlap.
         targetWidth = 180;
         node.style.width = (targetWidth * ratio.width) + "px";
@@ -470,8 +499,25 @@ loop.standaloneRoomViews = (function(mozL10n) {
 
         // Now position the local camera view correctly with respect to the remote
         // video stream or the screen share stream.
-        var remoteVideoDimensions = this.getRemoteVideoDimensions(
-          this.state.receivingScreenShare ? "screen" : "camera");
+        var remoteVideoDimensions;
+        var isScreenShare = this.state.receivingScreenShare;
+        var videoDisplayed = isScreenShare ?
+          this.state.screenShareVideoObject || this.props.screenSharePosterUrl :
+          this.state.remoteSrcVideoObject || this.props.remotePosterUrl;
+
+        if ((isScreenShare || this.shouldRenderRemoteVideo()) && videoDisplayed) {
+          remoteVideoDimensions = this.getRemoteVideoDimensions(
+            isScreenShare ? "screen" : "camera");
+        } else {
+          var remoteElement = this.getDOMNode().querySelector(".remote.focus-stream");
+          if (!remoteElement) {
+            return;
+          }
+          remoteVideoDimensions = {
+            streamWidth: remoteElement.offsetWidth,
+            offsetX: remoteElement.offsetLeft
+          };
+        }
 
         targetWidth = remoteVideoDimensions.streamWidth * LOCAL_STREAM_SIZE;
 
@@ -515,7 +561,7 @@ loop.standaloneRoomViews = (function(mozL10n) {
       }
       // XXX For the time being, if we're a narrow screen, aka mobile, we don't display
       // the remote media (bug 1133534).
-      if (window.matchMedia && window.matchMedia("screen and (max-width:640px)").matches) {
+      if (this._matchMedia("screen and (max-width:640px)").matches) {
         return;
       }
 
@@ -557,9 +603,51 @@ loop.standaloneRoomViews = (function(mozL10n) {
              this.state.roomState === ROOM_STATES.HAS_PARTICIPANTS;
     },
 
+    /**
+     * Works out if remote video should be rended or not, depending on the
+     * room state and other flags.
+     *
+     * @return {Boolean} True if remote video should be rended.
+     */
+    shouldRenderRemoteVideo: function() {
+      switch(this.state.roomState) {
+        case ROOM_STATES.HAS_PARTICIPANTS:
+          if (this.state.remoteVideoEnabled) {
+            return true;
+          }
+
+          if (this.state.mediaConnected) {
+            // since the remoteVideo hasn't yet been enabled, if the
+            // media is connected, then we should be displaying an avatar.
+            return false;
+          }
+
+          return true;
+
+        case ROOM_STATES.READY:
+        case ROOM_STATES.INIT:
+        case ROOM_STATES.JOINING:
+        case ROOM_STATES.SESSION_CONNECTED:
+        case ROOM_STATES.JOINED:
+        case ROOM_STATES.MEDIA_WAIT:
+          // this case is so that we don't show an avatar while waiting for
+          // the other party to connect
+          return true;
+
+        case ROOM_STATES.CLOSING:
+          // the other person has shown up, so we don't want to show an avatar
+          return true;
+
+        default:
+          console.warn("StandaloneRoomView.shouldRenderRemoteVideo:" +
+            " unexpected roomState: ", this.state.roomState);
+          return true;
+
+      }
+    },
+
     render: function() {
       var localStreamClasses = React.addons.classSet({
-        hide: !this._roomIsActive(),
         local: true,
         "local-stream": true,
         "local-stream-audio": this.state.videoMuted
@@ -602,10 +690,25 @@ loop.standaloneRoomViews = (function(mozL10n) {
                   {mozL10n.get("self_view_hidden_message")}
                 </span>
                 <div className="video_wrapper remote_wrapper">
-                  <div className={remoteStreamClasses}></div>
-                  <div className={screenShareStreamClasses}></div>
+                  <div className={remoteStreamClasses}>
+                    <sharedViews.MediaView displayAvatar={!this.shouldRenderRemoteVideo()}
+                      posterUrl={this.props.remotePosterUrl}
+                      mediaType="remote"
+                      srcVideoObject={this.state.remoteSrcVideoObject} />
+                  </div>
+                  <div className={screenShareStreamClasses}>
+                    <sharedViews.MediaView displayAvatar={false}
+                      posterUrl={this.props.screenSharePosterUrl}
+                      mediaType="screen-share"
+                      srcVideoObject={this.state.screenShareVideoObject} />
+                  </div>
+                </div>
+                <div className={localStreamClasses}>
+                  <sharedViews.MediaView displayAvatar={this.state.videoMuted}
+                    posterUrl={this.props.localPosterUrl}
+                    mediaType="local"
+                    srcVideoObject={this.state.localSrcVideoObject} />
                 </div>
-                <div className={localStreamClasses}></div>
               </div>
               <sharedViews.ConversationToolbar
                 dispatcher={this.props.dispatcher}
diff --git a/browser/components/loop/test/desktop-local/conversationViews_test.js b/browser/components/loop/test/desktop-local/conversationViews_test.js
index 2dde856da290..bb8c6ff95141 100644
--- a/browser/components/loop/test/desktop-local/conversationViews_test.js
+++ b/browser/components/loop/test/desktop-local/conversationViews_test.js
@@ -8,8 +8,8 @@ describe("loop.conversationViews", function () {
   var TestUtils = React.addons.TestUtils;
   var sharedActions = loop.shared.actions;
   var sharedUtils = loop.shared.utils;
-  var sharedView = loop.shared.views;
-  var sandbox, view, dispatcher, contact, fakeAudioXHR;
+  var sharedViews = loop.shared.views;
+  var sandbox, view, dispatcher, contact, fakeAudioXHR, conversationStore;
   var fakeMozLoop, fakeWindow;
 
   var CALL_STATES = loop.store.CALL_STATES;
@@ -104,6 +104,19 @@ describe("loop.conversationViews", function () {
     };
     loop.shared.mixins.setRootObject(fakeWindow);
 
+    var feedbackStore = new loop.store.FeedbackStore(dispatcher, {
+      feedbackClient: {}
+    });
+    conversationStore = new loop.store.ConversationStore(dispatcher, {
+      client: {},
+      mozLoop: fakeMozLoop,
+      sdkDriver: {}
+    });
+
+    loop.store.StoreMixin.register({
+      conversationStore: conversationStore,
+      feedbackStore: feedbackStore
+    });
   });
 
   afterEach(function() {
@@ -255,7 +268,7 @@ describe("loop.conversationViews", function () {
   });
 
   describe("CallFailedView", function() {
-    var store, fakeAudio;
+    var fakeAudio;
 
     var contact = {email: [{value: "test@test.tld"}]};
 
@@ -269,15 +282,6 @@ describe("loop.conversationViews", function () {
     }
 
     beforeEach(function() {
-      store = new loop.store.ConversationStore(dispatcher, {
-        client: {},
-        mozLoop: navigator.mozLoop,
-        sdkDriver: {}
-      });
-      loop.store.StoreMixin.register({
-        conversationStore: store
-      });
-
       fakeAudio = {
         play: sinon.spy(),
         pause: sinon.spy(),
@@ -357,7 +361,7 @@ describe("loop.conversationViews", function () {
     it("should compose an email once the email link is received", function() {
       var composeCallUrlEmail = sandbox.stub(sharedUtils, "composeCallUrlEmail");
       view = mountTestComponent({contact: contact});
-      store.setStoreState({emailLink: "http://fake.invalid/"});
+      conversationStore.setStoreState({emailLink: "http://fake.invalid/"});
 
       sinon.assert.calledOnce(composeCallUrlEmail);
       sinon.assert.calledWithExactly(composeCallUrlEmail,
@@ -368,7 +372,7 @@ describe("loop.conversationViews", function () {
       function() {
         view = mountTestComponent({contact: contact});
 
-        store.setStoreState({emailLink: "http://fake.invalid/"});
+        conversationStore.setStoreState({emailLink: "http://fake.invalid/"});
 
         sinon.assert.calledOnce(fakeWindow.close);
       });
@@ -377,7 +381,7 @@ describe("loop.conversationViews", function () {
       function() {
         view = mountTestComponent({contact: contact});
 
-        store.trigger("error:emailLink");
+        conversationStore.trigger("error:emailLink");
 
         expect(view.getDOMNode().querySelector(".error")).not.eql(null);
       });
@@ -386,7 +390,7 @@ describe("loop.conversationViews", function () {
       function() {
         view = mountTestComponent({contact: contact});
 
-        store.trigger("error:emailLink");
+        conversationStore.trigger("error:emailLink");
 
         expect(view.getDOMNode().querySelector(".btn-email").disabled).eql(false);
       });
@@ -403,7 +407,7 @@ describe("loop.conversationViews", function () {
 
     it("should show 'something went wrong' when the reason is WEBSOCKET_REASONS.MEDIA_FAIL",
       function () {
-        store.setStoreState({callStateReason: WEBSOCKET_REASONS.MEDIA_FAIL});
+        conversationStore.setStoreState({callStateReason: WEBSOCKET_REASONS.MEDIA_FAIL});
 
         view = mountTestComponent({contact: contact});
 
@@ -412,7 +416,7 @@ describe("loop.conversationViews", function () {
 
     it("should show 'contact unavailable' when the reason is WEBSOCKET_REASONS.REJECT",
       function () {
-        store.setStoreState({callStateReason: WEBSOCKET_REASONS.REJECT});
+        conversationStore.setStoreState({callStateReason: WEBSOCKET_REASONS.REJECT});
 
         view = mountTestComponent({contact: contact});
 
@@ -423,7 +427,7 @@ describe("loop.conversationViews", function () {
 
     it("should show 'contact unavailable' when the reason is WEBSOCKET_REASONS.BUSY",
       function () {
-        store.setStoreState({callStateReason: WEBSOCKET_REASONS.BUSY});
+        conversationStore.setStoreState({callStateReason: WEBSOCKET_REASONS.BUSY});
 
         view = mountTestComponent({contact: contact});
 
@@ -434,7 +438,7 @@ describe("loop.conversationViews", function () {
 
     it("should show 'something went wrong' when the reason is 'setup'",
       function () {
-        store.setStoreState({callStateReason: "setup"});
+        conversationStore.setStoreState({callStateReason: "setup"});
 
         view = mountTestComponent({contact: contact});
 
@@ -444,7 +448,7 @@ describe("loop.conversationViews", function () {
 
     it("should show 'contact unavailable' when the reason is REST_ERRNOS.USER_UNAVAILABLE",
       function () {
-        store.setStoreState({callStateReason: REST_ERRNOS.USER_UNAVAILABLE});
+        conversationStore.setStoreState({callStateReason: REST_ERRNOS.USER_UNAVAILABLE});
 
         view = mountTestComponent({contact: contact});
 
@@ -455,7 +459,7 @@ describe("loop.conversationViews", function () {
 
     it("should show 'no media' when the reason is FAILURE_DETAILS.UNABLE_TO_PUBLISH_MEDIA",
       function () {
-        store.setStoreState({callStateReason: FAILURE_DETAILS.UNABLE_TO_PUBLISH_MEDIA});
+        conversationStore.setStoreState({callStateReason: FAILURE_DETAILS.UNABLE_TO_PUBLISH_MEDIA});
 
         view = mountTestComponent({contact: contact});
 
@@ -464,7 +468,7 @@ describe("loop.conversationViews", function () {
 
     it("should display a generic contact unavailable msg when the reason is" +
        " WEBSOCKET_REASONS.BUSY and no display name is available", function() {
-        store.setStoreState({callStateReason: WEBSOCKET_REASONS.BUSY});
+        conversationStore.setStoreState({callStateReason: WEBSOCKET_REASONS.BUSY});
         var phoneOnlyContact = {
           tel: [{"pref": true, type: "work", value: ""}]
         };
@@ -477,27 +481,72 @@ describe("loop.conversationViews", function () {
   });
 
   describe("OngoingConversationView", function() {
-    function mountTestComponent(props) {
+    function mountTestComponent(extraProps) {
+      var props = _.extend({
+        dispatcher: dispatcher
+      }, extraProps);
       return TestUtils.renderIntoDocument(
         React.createElement(loop.conversationViews.OngoingConversationView, props));
     }
 
     it("should dispatch a setupStreamElements action when the view is created",
       function() {
-        view = mountTestComponent({
-          dispatcher: dispatcher
-        });
+        view = mountTestComponent();
 
         sinon.assert.calledOnce(dispatcher.dispatch);
         sinon.assert.calledWithMatch(dispatcher.dispatch,
           sinon.match.hasOwn("name", "setupStreamElements"));
       });
 
+    it("should display an avatar for remote video when the stream is not enabled", function() {
+      view = mountTestComponent({
+        mediaConnected: true,
+        remoteVideoEnabled: false
+      });
+
+      TestUtils.findRenderedComponentWithType(view, sharedViews.AvatarView);
+    });
+
+    it("should display the remote video when the stream is enabled", function() {
+      conversationStore.setStoreState({
+        remoteSrcVideoObject: { fake: 1 }
+      });
+
+      view = mountTestComponent({
+        mediaConnected: true,
+        remoteVideoEnabled: true
+      });
+
+      expect(view.getDOMNode().querySelector(".remote video")).not.eql(null);
+    });
+
+    it("should display an avatar for local video when the stream is not enabled", function() {
+      view = mountTestComponent({
+        video: {
+          enabled: false
+        }
+      });
+
+      TestUtils.findRenderedComponentWithType(view, sharedViews.AvatarView);
+    });
+
+    it("should display the local video when the stream is enabled", function() {
+      conversationStore.setStoreState({
+        localSrcVideoObject: { fake: 1 }
+      });
+
+      view = mountTestComponent({
+        video: {
+          enabled: true
+        }
+      });
+
+      expect(view.getDOMNode().querySelector(".local video")).not.eql(null);
+    });
+
     it("should dispatch a hangupCall action when the hangup button is pressed",
       function() {
-        view = mountTestComponent({
-          dispatcher: dispatcher
-        });
+        view = mountTestComponent();
 
         var hangupBtn = view.getDOMNode().querySelector(".btn-hangup");
 
@@ -510,7 +559,6 @@ describe("loop.conversationViews", function () {
     it("should dispatch a setMute action when the audio mute button is pressed",
       function() {
         view = mountTestComponent({
-          dispatcher: dispatcher,
           audio: {enabled: false}
         });
 
@@ -529,7 +577,6 @@ describe("loop.conversationViews", function () {
     it("should dispatch a setMute action when the video mute button is pressed",
       function() {
         view = mountTestComponent({
-          dispatcher: dispatcher,
           video: {enabled: true}
         });
 
@@ -547,7 +594,6 @@ describe("loop.conversationViews", function () {
 
     it("should set the mute button as mute off", function() {
       view = mountTestComponent({
-        dispatcher: dispatcher,
         video: {enabled: true}
       });
 
@@ -558,7 +604,6 @@ describe("loop.conversationViews", function () {
 
     it("should set the mute button as mute on", function() {
       view = mountTestComponent({
-        dispatcher: dispatcher,
         audio: {enabled: false}
       });
 
@@ -569,7 +614,7 @@ describe("loop.conversationViews", function () {
   });
 
   describe("CallControllerView", function() {
-    var store, feedbackStore;
+    var feedbackStore;
 
     function mountTestComponent() {
       return TestUtils.renderIntoDocument(
@@ -580,22 +625,13 @@ describe("loop.conversationViews", function () {
     }
 
     beforeEach(function() {
-      store = new loop.store.ConversationStore(dispatcher, {
-        client: {},
-        mozLoop: fakeMozLoop,
-        sdkDriver: {}
-      });
-      loop.store.StoreMixin.register({
-        conversationStore: store
-      });
-
       feedbackStore = new loop.store.FeedbackStore(dispatcher, {
         feedbackClient: {}
       });
     });
 
     it("should set the document title to the callerId", function() {
-      store.setStoreState({
+      conversationStore.setStoreState({
         contact: contact
       });
 
@@ -606,7 +642,7 @@ describe("loop.conversationViews", function () {
 
     it("should fallback to the contact email if the contact name is not defined", function() {
       delete contact.name;
-      store.setStoreState({
+      conversationStore.setStoreState({
         contact: contact
       });
 
@@ -616,7 +652,7 @@ describe("loop.conversationViews", function () {
     });
 
     it("should fallback to the caller id if no contact is defined", function() {
-      store.setStoreState({
+      conversationStore.setStoreState({
         callerId: "fakeId"
       });
 
@@ -627,7 +663,7 @@ describe("loop.conversationViews", function () {
 
     it("should render the CallFailedView when the call state is 'terminated'",
       function() {
-        store.setStoreState({
+        conversationStore.setStoreState({
           callState: CALL_STATES.TERMINATED,
           contact: contact
         });
@@ -640,7 +676,7 @@ describe("loop.conversationViews", function () {
 
     it("should render the PendingConversationView for outgoing calls when the call state is 'gather'",
       function() {
-        store.setStoreState({
+        conversationStore.setStoreState({
           callState: CALL_STATES.GATHER,
           contact: contact,
           outgoing: true
@@ -653,7 +689,7 @@ describe("loop.conversationViews", function () {
     });
 
     it("should render the AcceptCallView for incoming calls when the call state is 'alerting'", function() {
-      store.setStoreState({
+      conversationStore.setStoreState({
         callState: CALL_STATES.ALERTING,
         outgoing: false
       });
@@ -666,7 +702,7 @@ describe("loop.conversationViews", function () {
 
     it("should render the OngoingConversationView when the call state is 'ongoing'",
       function() {
-        store.setStoreState({callState: CALL_STATES.ONGOING});
+        conversationStore.setStoreState({callState: CALL_STATES.ONGOING});
 
         view = mountTestComponent();
 
@@ -676,7 +712,7 @@ describe("loop.conversationViews", function () {
 
     it("should render the FeedbackView when the call state is 'finished'",
       function() {
-        store.setStoreState({callState: CALL_STATES.FINISHED});
+        conversationStore.setStoreState({callState: CALL_STATES.FINISHED});
 
         view = mountTestComponent();
 
@@ -685,7 +721,7 @@ describe("loop.conversationViews", function () {
     });
 
     it("should set the document title to conversation_has_ended when displaying the feedback view", function() {
-      store.setStoreState({callState: CALL_STATES.FINISHED});
+      conversationStore.setStoreState({callState: CALL_STATES.FINISHED});
 
       mountTestComponent();
 
@@ -701,7 +737,7 @@ describe("loop.conversationViews", function () {
         };
         sandbox.stub(window, "Audio").returns(fakeAudio);
 
-        store.setStoreState({callState: CALL_STATES.FINISHED});
+        conversationStore.setStoreState({callState: CALL_STATES.FINISHED});
 
         view = mountTestComponent();
 
@@ -710,7 +746,7 @@ describe("loop.conversationViews", function () {
 
     it("should update the rendered views when the state is changed.",
       function() {
-        store.setStoreState({
+        conversationStore.setStoreState({
           callState: CALL_STATES.GATHER,
           contact: contact,
           outgoing: true
@@ -721,7 +757,7 @@ describe("loop.conversationViews", function () {
         TestUtils.findRenderedComponentWithType(view,
           loop.conversationViews.PendingConversationView);
 
-        store.setStoreState({callState: CALL_STATES.TERMINATED});
+        conversationStore.setStoreState({callState: CALL_STATES.TERMINATED});
 
         TestUtils.findRenderedComponentWithType(view,
           loop.conversationViews.CallFailedView);
diff --git a/browser/components/loop/test/desktop-local/l10n_test.js b/browser/components/loop/test/desktop-local/l10n_test.js
index f76b0a19773e..0f15dbacd0bb 100644
--- a/browser/components/loop/test/desktop-local/l10n_test.js
+++ b/browser/components/loop/test/desktop-local/l10n_test.js
@@ -34,4 +34,8 @@ describe("document.mozL10n", function() {
   it("should get a plural form", function() {
     expect(document.mozL10n.get("plural", {num: 10})).eql("10 plural forms");
   });
+
+  it("should correctly get a plural form for num = 0", function() {
+    expect(document.mozL10n.get("plural", {num: 0})).eql("0 plural form");
+  });
 });
diff --git a/browser/components/loop/test/desktop-local/roomStore_test.js b/browser/components/loop/test/desktop-local/roomStore_test.js
index efa385f5e4b5..a4fd0fb08051 100644
--- a/browser/components/loop/test/desktop-local/roomStore_test.js
+++ b/browser/components/loop/test/desktop-local/roomStore_test.js
@@ -603,9 +603,10 @@ describe("loop.store.RoomStore", function () {
   });
 
   describe("#updateRoomContext", function() {
-    var store, fakeMozLoop;
+    var store, fakeMozLoop, clock;
 
     beforeEach(function() {
+      clock = sinon.useFakeTimers();
       fakeMozLoop = {
         rooms: {
           get: sinon.stub().callsArgWith(1, null, {
@@ -620,6 +621,10 @@ describe("loop.store.RoomStore", function () {
       store = new loop.store.RoomStore(dispatcher, {mozLoop: fakeMozLoop});
     });
 
+    afterEach(function() {
+      clock.restore();
+    });
+
     it("should rename the room via mozLoop", function() {
       fakeMozLoop.rooms.update = sinon.spy();
       dispatcher.dispatch(new sharedActions.UpdateRoomContext({
@@ -674,6 +679,7 @@ describe("loop.store.RoomStore", function () {
         roomToken: "42abc",
         newRoomName: " \t  \t "
       }));
+      clock.tick(1);
 
       sinon.assert.notCalled(fakeMozLoop.rooms.update);
       expect(store.getStoreState().savingContext).to.eql(false);
@@ -731,6 +737,7 @@ describe("loop.store.RoomStore", function () {
           newRoomThumbnail: "",
           newRoomURL: ""
         }));
+        clock.tick(1);
 
         sinon.assert.notCalled(fakeMozLoop.rooms.update);
         expect(store.getStoreState().savingContext).to.eql(false);
diff --git a/browser/components/loop/test/desktop-local/roomViews_test.js b/browser/components/loop/test/desktop-local/roomViews_test.js
index 24c682c1e049..1064416591cb 100644
--- a/browser/components/loop/test/desktop-local/roomViews_test.js
+++ b/browser/components/loop/test/desktop-local/roomViews_test.js
@@ -8,6 +8,7 @@ describe("loop.roomViews", function () {
   var TestUtils = React.addons.TestUtils;
   var sharedActions = loop.shared.actions;
   var sharedUtils = loop.shared.utils;
+  var sharedViews = loop.shared.views;
   var ROOM_STATES = loop.store.ROOM_STATES;
   var SCREEN_SHARE_STATES = loop.shared.utils.SCREEN_SHARE_STATES;
 
@@ -67,6 +68,13 @@ describe("loop.roomViews", function () {
       mozLoop: fakeMozLoop,
       activeRoomStore: activeRoomStore
     });
+    var textChatStore = new loop.store.TextChatStore(dispatcher, {
+      sdkDriver: {}
+    });
+
+    loop.store.StoreMixin.register({
+      textChatStore: textChatStore
+    });
 
     fakeContextURL = {
       description: "An invalid page",
@@ -422,16 +430,6 @@ describe("loop.roomViews", function () {
         sinon.assert.calledOnce(dispatcher.dispatch);
         sinon.assert.calledWithExactly(dispatcher.dispatch,
           sinon.match.instanceOf(sharedActions.SetupStreamElements));
-        sinon.assert.calledWithExactly(dispatcher.dispatch,
-          sinon.match(function(value) {
-            return value.getLocalElementFunc() ===
-                   view.getDOMNode().querySelector(".local");
-          }));
-        sinon.assert.calledWithExactly(dispatcher.dispatch,
-          sinon.match(function(value) {
-            return value.getRemoteElementFunc() ===
-                   view.getDOMNode().querySelector(".remote");
-          }));
       }
 
       it("should dispatch a `SetupStreamElements` action when the MEDIA_WAIT state " +
@@ -516,6 +514,54 @@ describe("loop.roomViews", function () {
           TestUtils.findRenderedComponentWithType(view,
             loop.shared.views.FeedbackView);
         });
+
+      it("should display an avatar for remote video when the room has participants but video is not enabled",
+        function() {
+          activeRoomStore.setStoreState({
+            roomState: ROOM_STATES.HAS_PARTICIPANTS,
+            mediaConnected: true,
+            remoteVideoEnabled: false
+          });
+
+          view = mountTestComponent();
+
+          TestUtils.findRenderedComponentWithType(view, sharedViews.AvatarView);
+        });
+
+      it("should display the remote video when there are participants and video is enabled", function() {
+        activeRoomStore.setStoreState({
+          roomState: ROOM_STATES.HAS_PARTICIPANTS,
+          mediaConnected: true,
+          remoteVideoEnabled: true,
+          remoteSrcVideoObject: { fake: 1 }
+        });
+
+        view = mountTestComponent();
+
+        expect(view.getDOMNode().querySelector(".remote video")).not.eql(null);
+      });
+
+      it("should display an avatar for local video when the stream is muted", function() {
+        activeRoomStore.setStoreState({
+          videoMuted: true
+        });
+
+        view = mountTestComponent();
+
+        TestUtils.findRenderedComponentWithType(view, sharedViews.AvatarView);
+      });
+
+      it("should display the local video when the stream is enabled", function() {
+        activeRoomStore.setStoreState({
+          localSrcVideoObject: { fake: 1 },
+          videoMuted: false
+        });
+
+        view = mountTestComponent();
+
+        expect(view.getDOMNode().querySelector(".local video")).not.eql(null);
+      });
+
     });
 
     describe("Mute", function() {
@@ -641,6 +687,7 @@ describe("loop.roomViews", function () {
       props = _.extend({
         dispatcher: dispatcher,
         mozLoop: fakeMozLoop,
+        savingContext: false,
         show: true,
         roomData: {
           roomToken: "fakeToken"
@@ -726,7 +773,7 @@ describe("loop.roomViews", function () {
         expect(checkbox.classList.contains("disabled")).to.eql(true);
       });
 
-      it("should render the editMode view when the edit button is clicked", function(next) {
+      it("should render the editMode view when the edit button is clicked", function(done) {
         var roomName = "Hello, is it me you're looking for?";
         view = mountTestComponent({
           roomData: {
@@ -749,11 +796,11 @@ describe("loop.roomViews", function () {
           expect(node.querySelector(".room-context-url").value).to.eql(fakeContextURL.location);
           expect(node.querySelector(".room-context-comments").value).to.eql(fakeContextURL.description);
 
-          next();
+          done();
         });
       });
 
-      it("should hide the checkbox when no context data is stored or available", function(next) {
+      it("should hide the checkbox when no context data is stored or available", function(done) {
         view = mountTestComponent({
           roomData: {
             roomToken: "fakeToken",
@@ -771,7 +818,7 @@ describe("loop.roomViews", function () {
           var node = view.getDOMNode();
           expect(node.querySelector(".checkbox-wrapper").classList.contains("hide")).to.eql(true);
 
-          next();
+          done();
         });
       });
     });
@@ -831,6 +878,21 @@ describe("loop.roomViews", function () {
               newRoomThumbnail: fakeContextURL.thumbnail
             }));
         });
+
+      it("should close the edit form when context was saved successfully", function(done) {
+        view.setProps({ savingContext: true }, function() {
+          var node = view.getDOMNode();
+          // The button should show up as disabled.
+          expect(node.querySelector(".btn-info").hasAttribute("disabled")).to.eql(true);
+
+          // Now simulate a successful save.
+          view.setProps({ savingContext: false }, function() {
+            // The editMode flag should be updated.
+            expect(view.state.editMode).to.eql(false);
+            done();
+          });
+        });
+      });
     });
 
     describe("#handleCheckboxChange", function() {
diff --git a/browser/components/loop/test/functional/test_1_browser_call.py b/browser/components/loop/test/functional/test_1_browser_call.py
index abe632345ea7..ab3140e51201 100644
--- a/browser/components/loop/test/functional/test_1_browser_call.py
+++ b/browser/components/loop/test/functional/test_1_browser_call.py
@@ -102,7 +102,7 @@ class Test1BrowserCall(MarionetteTestCase):
         media_container = self.wait_for_element_displayed(By.CLASS_NAME, "media")
         self.assertEqual(media_container.tag_name, "div", "expect a video container")
 
-        self.check_video(".local .OT_publisher .OT_widget-container");
+        self.check_video(".local-video")
 
     def local_get_and_verify_room_url(self):
         self.switch_to_chatbox()
@@ -127,23 +127,20 @@ class Test1BrowserCall(MarionetteTestCase):
                                                       "btn-join")
         join_button.click()
 
-    # Assumes the standlone or the conversation window is selected first.
+    # Assumes the standalone or the conversation window is selected first.
     def check_video(self, selector):
-        video_wrapper = self.wait_for_element_displayed(By.CSS_SELECTOR,
+        video = self.wait_for_element_displayed(By.CSS_SELECTOR,
                                                         selector, 20)
-        video = self.wait_for_subelement_displayed(video_wrapper,
-                                                   By.TAG_NAME, "video")
-
         self.wait_for_element_attribute_to_be_false(video, "paused")
         self.assertEqual(video.get_attribute("ended"), "false")
 
     def standalone_check_remote_video(self):
         self.switch_to_standalone()
-        self.check_video(".remote .OT_subscriber .OT_widget-container")
+        self.check_video(".remote-video")
 
     def local_check_remote_video(self):
         self.switch_to_chatbox()
-        self.check_video(".remote .OT_subscriber .OT_widget-container")
+        self.check_video(".remote-video")
 
     def local_enable_screenshare(self):
         self.switch_to_chatbox()
@@ -153,7 +150,7 @@ class Test1BrowserCall(MarionetteTestCase):
 
     def standalone_check_remote_screenshare(self):
         self.switch_to_standalone()
-        self.check_video(".media .screen .OT_subscriber .OT_widget-container")
+        self.check_video(".screen-share-video")
 
     def remote_leave_room_and_verify_feedback(self):
         self.switch_to_standalone()
diff --git a/browser/components/loop/test/shared/activeRoomStore_test.js b/browser/components/loop/test/shared/activeRoomStore_test.js
index d15c14049c38..8774b6caba80 100644
--- a/browser/components/loop/test/shared/activeRoomStore_test.js
+++ b/browser/components/loop/test/shared/activeRoomStore_test.js
@@ -971,6 +971,61 @@ describe("loop.store.ActiveRoomStore", function () {
     });
   });
 
+  describe("#localVideoEnabled", function() {
+    it("should add a localSrcVideoObject to the store", function() {
+      var fakeVideoElement = {name: "fakeVideoElement"};
+      expect(store.getStoreState()).to.not.have.property("localSrcVideoObject");
+
+      store.localVideoEnabled({srcVideoObject: fakeVideoElement});
+
+      expect(store.getStoreState()).to.have.property("localSrcVideoObject",
+        fakeVideoElement);
+    });
+  });
+
+  describe("#remoteVideoEnabled", function() {
+    var fakeVideoElement;
+
+    beforeEach(function() {
+      fakeVideoElement = {name: "fakeVideoElement"};
+    });
+
+    it("should add a remoteSrcVideoObject to the store", function() {
+      expect(store.getStoreState()).to.not.have.property("remoteSrcVideoObject");
+
+      store.remoteVideoEnabled({srcVideoObject: fakeVideoElement});
+
+      expect(store.getStoreState()).to.have.property("remoteSrcVideoObject",
+        fakeVideoElement);
+    });
+
+    it("should set remoteVideoEnabled", function() {
+      store.remoteVideoEnabled({srcVideoObject: fakeVideoElement});
+
+      expect(store.getStoreState().remoteVideoEnabled).eql(true);
+    });
+  });
+
+  describe("#remoteVideoDisabled", function() {
+    it("should set remoteVideoEnabled to false", function() {
+      store.setStoreState({
+        remoteVideoEnabled: true
+      });
+
+      store.remoteVideoDisabled();
+
+      expect(store.getStoreState().remoteVideoEnabled).eql(false);
+    });
+  });
+
+  describe("#mediaConnected", function() {
+    it("should set mediaConnected to true", function() {
+      store.mediaConnected();
+
+      expect(store.getStoreState().mediaConnected).eql(true);
+    });
+  });
+
   describe("#screenSharingState", function() {
     beforeEach(function() {
       store.setStoreState({windowId: "1234"});
@@ -1012,6 +1067,34 @@ describe("loop.store.ActiveRoomStore", function () {
       expect(store.getStoreState().receivingScreenShare).eql(true);
     });
 
+    it("should add a screenShareVideoObject to the store when sharing is active", function() {
+      var fakeVideoElement = {name: "fakeVideoElement"};
+      expect(store.getStoreState()).to.not.have.property("screenShareVideoObject");
+
+      store.receivingScreenShare(new sharedActions.ReceivingScreenShare({
+        receiving: true,
+        srcVideoObject: fakeVideoElement
+      }));
+
+      expect(store.getStoreState()).to.have.property("screenShareVideoObject",
+        fakeVideoElement);
+    });
+
+    it("should clear the screenShareVideoObject from the store when sharing is inactive", function() {
+      store.setStoreState({
+        screenShareVideoObject: {
+          name: "fakeVideoElement"
+        }
+      });
+
+      store.receivingScreenShare(new sharedActions.ReceivingScreenShare({
+        receiving: false,
+        srcVideoObject: null
+      }));
+
+      expect(store.getStoreState().screenShareVideoObject).eql(null);
+    });
+
     it("should delete the screen remote video dimensions if screen sharing is not active", function() {
       store.setStoreState({
         remoteVideoDimensions: {
@@ -1162,6 +1245,16 @@ describe("loop.store.ActiveRoomStore", function () {
 
       expect(store.getStoreState().roomState).eql(ROOM_STATES.SESSION_CONNECTED);
     });
+
+    it("should clear the remoteSrcVideoObject", function() {
+      store.setStoreState({
+        remoteSrcVideoObject: { name: "fakeVideoElement" }
+      });
+
+      store.remotePeerDisconnected();
+
+      expect(store.getStoreState().remoteSrcVideoObject).eql(null);
+    });
   });
 
   describe("#connectionStatus", function() {
diff --git a/browser/components/loop/test/shared/conversationStore_test.js b/browser/components/loop/test/shared/conversationStore_test.js
index e75227738793..130ce683ffef 100644
--- a/browser/components/loop/test/shared/conversationStore_test.js
+++ b/browser/components/loop/test/shared/conversationStore_test.js
@@ -13,7 +13,7 @@ describe("loop.store.ConversationStore", function () {
   var sharedActions = loop.shared.actions;
   var sharedUtils = loop.shared.utils;
   var sandbox, dispatcher, client, store, fakeSessionData, sdkDriver;
-  var contact, fakeMozLoop;
+  var contact, fakeMozLoop, fakeVideoElement;
   var connectPromise, resolveConnectPromise, rejectConnectPromise;
   var wsCancelSpy, wsCloseSpy, wsDeclineSpy, wsMediaUpSpy, fakeWebsocket;
 
@@ -89,6 +89,8 @@ describe("loop.store.ConversationStore", function () {
       progressURL: "fakeURL"
     };
 
+    fakeVideoElement = { id: "fakeVideoElement" };
+
     var dummySocket = {
       close: sinon.spy(),
       send: sinon.spy()
@@ -927,6 +929,62 @@ describe("loop.store.ConversationStore", function () {
 
       sinon.assert.calledOnce(wsMediaUpSpy);
     });
+
+    it("should set store.mediaConnected to true", function () {
+      store._websocket = fakeWebsocket;
+
+      store.mediaConnected(new sharedActions.MediaConnected());
+
+      expect(store.getStoreState("mediaConnected")).eql(true);
+    });
+  });
+
+  describe("#localVideoEnabled", function() {
+    it("should set store.localSrcVideoObject from the action data", function () {
+      store.localVideoEnabled(
+        new sharedActions.LocalVideoEnabled({srcVideoObject: fakeVideoElement}));
+
+      expect(store.getStoreState("localSrcVideoObject")).eql(fakeVideoElement);
+    });
+  });
+
+  describe("#remoteVideoEnabled", function() {
+    it("should set store.remoteSrcVideoObject from the actionData", function () {
+      store.setStoreState({remoteSrcVideoObject: undefined});
+
+      store.remoteVideoEnabled(
+        new sharedActions.RemoteVideoEnabled({srcVideoObject: fakeVideoElement}));
+
+      expect(store.getStoreState("remoteSrcVideoObject")).eql(fakeVideoElement);
+    });
+
+    it("should set store.remoteVideoEnabled to true", function () {
+      store.setStoreState({remoteVideoEnabled: false});
+
+      store.remoteVideoEnabled(
+        new sharedActions.RemoteVideoEnabled({srcVideoObject: fakeVideoElement}));
+
+      expect(store.getStoreState("remoteVideoEnabled")).to.be.true;
+    });
+  });
+
+  describe("#remoteVideoDisabled", function() {
+    it("should set store.remoteVideoEnabled to false", function () {
+      store.setStoreState({remoteVideoEnabled: true});
+
+      store.remoteVideoDisabled(new sharedActions.RemoteVideoDisabled({}));
+
+      expect(store.getStoreState("remoteVideoEnabled")).to.be.false;
+    });
+
+    it("should set store.remoteSrcVideoObject to undefined", function () {
+      store.setStoreState({remoteSrcVideoObject: fakeVideoElement});
+
+      store.remoteVideoDisabled(new sharedActions.RemoteVideoDisabled({}));
+
+      expect(store.getStoreState("remoteSrcVideoObject")).to.be.undefined;
+    });
+
   });
 
   describe("#setMute", function() {
diff --git a/browser/components/loop/test/shared/mixins_test.js b/browser/components/loop/test/shared/mixins_test.js
index dcc05063acf2..81793697cf24 100644
--- a/browser/components/loop/test/shared/mixins_test.js
+++ b/browser/components/loop/test/shared/mixins_test.js
@@ -368,88 +368,6 @@ describe("loop.shared.mixins", function() {
     });
 
     describe("Events", function() {
-      describe("resize", function() {
-        it("should update the width on the local stream element", function() {
-          localElement = {
-            offsetWidth: 100,
-            offsetHeight: 100,
-            style: { width: "0%" }
-          };
-
-          rootObject.events.resize();
-          sandbox.clock.tick(10);
-
-          expect(localElement.style.width).eql("100%");
-        });
-
-        it("should update the height on the remote stream element", function() {
-          remoteElement = {
-            offsetWidth: 100,
-            offsetHeight: 100,
-            style: { height: "0%" }
-          };
-
-          rootObject.events.resize();
-          sandbox.clock.tick(10);
-
-          expect(remoteElement.style.height).eql("100%");
-        });
-
-        it("should update the height on the screen share stream element", function() {
-          screenShareElement = {
-            offsetWidth: 100,
-            offsetHeight: 100,
-            style: { height: "0%" }
-          };
-
-          rootObject.events.resize();
-          sandbox.clock.tick(10);
-
-          expect(screenShareElement.style.height).eql("100%");
-        });
-      });
-
-      describe("orientationchange", function() {
-        it("should update the width on the local stream element", function() {
-          localElement = {
-            offsetWidth: 100,
-            offsetHeight: 100,
-            style: { width: "0%" }
-          };
-
-          rootObject.events.orientationchange();
-          sandbox.clock.tick(10);
-
-          expect(localElement.style.width).eql("100%");
-        });
-
-        it("should update the height on the remote stream element", function() {
-          remoteElement = {
-            offsetWidth: 100,
-            offsetHeight: 100,
-            style: { height: "0%" }
-          };
-
-          rootObject.events.orientationchange();
-          sandbox.clock.tick(10);
-
-          expect(remoteElement.style.height).eql("100%");
-        });
-
-        it("should update the height on the screen share stream element", function() {
-          screenShareElement = {
-            offsetWidth: 100,
-            offsetHeight: 100,
-            style: { height: "0%" }
-          };
-
-          rootObject.events.orientationchange();
-          sandbox.clock.tick(10);
-
-          expect(screenShareElement.style.height).eql("100%");
-        });
-      });
-
 
       describe("Video stream dimensions", function() {
         var localVideoDimensions = {
diff --git a/browser/components/loop/test/shared/otSdkDriver_test.js b/browser/components/loop/test/shared/otSdkDriver_test.js
index b6bd1fa6e286..2d9147b9248c 100644
--- a/browser/components/loop/test/shared/otSdkDriver_test.js
+++ b/browser/components/loop/test/shared/otSdkDriver_test.js
@@ -13,15 +13,11 @@ describe("loop.OTSdkDriver", function () {
 
   var sandbox;
   var dispatcher, driver, mozLoop, publisher, sdk, session, sessionData, subscriber;
-  var fakeLocalElement, fakeRemoteElement, fakeScreenElement;
   var publisherConfig, fakeEvent;
 
   beforeEach(function() {
     sandbox = sinon.sandbox.create();
 
-    fakeLocalElement = { fake: 1 };
-    fakeRemoteElement = { fake: 2 };
-    fakeScreenElement = { fake: 3 };
     fakeEvent = {
       preventDefault: sinon.stub()
     };
@@ -120,8 +116,6 @@ describe("loop.OTSdkDriver", function () {
   describe("#setupStreamElements", function() {
     it("should call initPublisher", function() {
       driver.setupStreamElements(new sharedActions.SetupStreamElements({
-        getLocalElementFunc: function() { return fakeLocalElement; },
-        getRemoteElementFunc: function() { return fakeRemoteElement; },
         publisherConfig: publisherConfig
       }));
 
@@ -132,7 +126,9 @@ describe("loop.OTSdkDriver", function () {
       }, publisherConfig);
 
       sinon.assert.calledOnce(sdk.initPublisher);
-      sinon.assert.calledWith(sdk.initPublisher, fakeLocalElement, expectedConfig);
+      sinon.assert.calledWith(sdk.initPublisher,
+        sinon.match.instanceOf(HTMLDivElement),
+        expectedConfig);
     });
   });
 
@@ -141,8 +137,6 @@ describe("loop.OTSdkDriver", function () {
       sdk.initPublisher.returns(publisher);
 
       driver.setupStreamElements(new sharedActions.SetupStreamElements({
-        getLocalElementFunc: function() { return fakeLocalElement; },
-        getRemoteElementFunc: function() { return fakeRemoteElement; },
         publisherConfig: publisherConfig
       }));
     });
@@ -169,7 +163,9 @@ describe("loop.OTSdkDriver", function () {
       }, publisherConfig);
 
       sinon.assert.calledTwice(sdk.initPublisher);
-      sinon.assert.calledWith(sdk.initPublisher, fakeLocalElement, expectedConfig);
+      sinon.assert.calledWith(sdk.initPublisher,
+        sinon.match.instanceOf(HTMLDivElement),
+        expectedConfig);
     });
   });
 
@@ -178,8 +174,6 @@ describe("loop.OTSdkDriver", function () {
       sdk.initPublisher.returns(publisher);
 
       driver.setupStreamElements(new sharedActions.SetupStreamElements({
-        getLocalElementFunc: function() { return fakeLocalElement; },
-        getRemoteElementFunc: function() { return fakeRemoteElement; },
         publisherConfig: publisherConfig
       }));
     });
@@ -206,18 +200,8 @@ describe("loop.OTSdkDriver", function () {
   });
 
   describe("#startScreenShare", function() {
-    var fakeElement;
-
     beforeEach(function() {
       sandbox.stub(driver, "_noteSharingState");
-
-      fakeElement = {
-        className: "fakeVideo"
-      };
-
-      driver.getScreenShareElementFunc = function() {
-        return fakeElement;
-      };
     });
 
     it("should initialize a publisher", function() {
@@ -233,7 +217,8 @@ describe("loop.OTSdkDriver", function () {
       driver.startScreenShare(options);
 
       sinon.assert.calledOnce(sdk.initPublisher);
-      sinon.assert.calledWithMatch(sdk.initPublisher, fakeElement, options);
+      sinon.assert.calledWithMatch(sdk.initPublisher,
+        sinon.match.instanceOf(HTMLDivElement), options);
     });
 
     it("should log a telemetry action", function() {
@@ -259,10 +244,6 @@ describe("loop.OTSdkDriver", function () {
           scrollWithPage: true
         }
       };
-      driver.getScreenShareElementFunc = function() {
-        return fakeScreenElement;
-      };
-
       driver.startScreenShare(options);
     });
 
@@ -282,8 +263,6 @@ describe("loop.OTSdkDriver", function () {
 
   describe("#endScreenShare", function() {
     beforeEach(function() {
-      driver.getScreenShareElementFunc = function() {};
-
       sandbox.stub(driver, "_noteSharingState");
     });
 
@@ -638,14 +617,34 @@ describe("loop.OTSdkDriver", function () {
     });
   });
 
-  describe("Events (general media)", function() {
+  describe("Events: general media", function() {
+    var fakeConnection, fakeStream, fakeSubscriberObject,
+      fakeSdkContainerWithVideo, videoElement;
+
     beforeEach(function() {
+      fakeConnection = "fakeConnection";
+      fakeStream = {
+        hasVideo: true,
+        videoType: "camera",
+        videoDimensions: {width: 1, height: 2}
+      };
+
+      fakeSubscriberObject = _.extend({
+        session: { connection: fakeConnection },
+        stream: fakeStream
+      }, Backbone.Events);
+
+      fakeSdkContainerWithVideo = {
+        querySelector: sinon.stub().returns(videoElement)
+      };
+
+      // use a real video element so that these tests correctly reflect
+      // test behavior when run in firefox or chrome
+      videoElement = document.createElement("video");
+
       driver.connectSession(sessionData);
 
       driver.setupStreamElements(new sharedActions.SetupStreamElements({
-        getLocalElementFunc: function() {return fakeLocalElement; },
-        getScreenShareElementFunc: function() {return fakeScreenElement; },
-        getRemoteElementFunc: function() {return fakeRemoteElement; },
         publisherConfig: publisherConfig
       }));
     });
@@ -760,9 +759,13 @@ describe("loop.OTSdkDriver", function () {
     });
 
     describe("streamCreated (publisher/local)", function() {
-      var fakeStream;
+      var fakeStream, fakeMockVideo;
 
       beforeEach(function() {
+        driver._mockPublisherEl = document.createElement("div");
+        fakeMockVideo = document.createElement("video");
+
+        driver._mockPublisherEl.appendChild(fakeMockVideo);
         fakeStream = {
           hasVideo: true,
           videoType: "camera",
@@ -782,6 +785,16 @@ describe("loop.OTSdkDriver", function () {
           }));
       });
 
+      it("should dispatch a LocalVideoEnabled action", function() {
+        publisher.trigger("streamCreated", { stream: fakeStream });
+
+        sinon.assert.called(dispatcher.dispatch);
+        sinon.assert.calledWithExactly(dispatcher.dispatch,
+          new sharedActions.LocalVideoEnabled({
+            srcVideoObject: fakeMockVideo
+          }));
+      });
+
       it("should dispatch a ConnectionStatus action", function() {
         driver._metrics.recvStreams = 1;
         driver._metrics.connections = 2;
@@ -800,16 +813,7 @@ describe("loop.OTSdkDriver", function () {
       });
     });
 
-    describe("streamCreated (session/remote)", function() {
-      var fakeStream;
-
-      beforeEach(function() {
-        fakeStream = {
-          hasVideo: true,
-          videoType: "camera",
-          videoDimensions: {width: 1, height: 2}
-        };
-      });
+    describe("streamCreated: session/remote", function() {
 
       it("should dispatch a VideoDimensionsChanged action", function() {
         session.trigger("streamCreated", { stream: fakeStream });
@@ -843,28 +847,63 @@ describe("loop.OTSdkDriver", function () {
         session.trigger("streamCreated", { stream: fakeStream });
 
         sinon.assert.calledOnce(session.subscribe);
-        sinon.assert.calledWith(session.subscribe,
-          fakeStream, fakeRemoteElement, publisherConfig);
+        sinon.assert.calledWithExactly(session.subscribe,
+          fakeStream, sinon.match.instanceOf(HTMLDivElement), publisherConfig,
+          sinon.match.func);
+      });
+
+      it("should dispatch RemoteVideoEnabled if the stream has video" +
+        " after subscribe is complete", function() {
+        session.subscribe.yieldsOn(driver, null, fakeSubscriberObject,
+          videoElement).returns(this.fakeSubscriberObject);
+        driver.session = session;
+        fakeStream.connection = fakeConnection;
+        fakeStream.hasVideo = true;
+
+        session.trigger("streamCreated", { stream: fakeStream });
+
+        sinon.assert.called(dispatcher.dispatch);
+        sinon.assert.calledWithExactly(dispatcher.dispatch,
+          new sharedActions.RemoteVideoEnabled({
+            srcVideoObject: videoElement
+          }));
+      });
+
+      it("should not dispatch RemoteVideoEnabled if the stream is audio-only", function() {
+        session.subscribe.yieldsOn(driver, null, fakeSubscriberObject,
+          videoElement);
+        fakeStream.connection = fakeConnection;
+        fakeStream.hasVideo = false;
+
+        session.trigger("streamCreated", { stream: fakeStream });
+
+        sinon.assert.called(dispatcher.dispatch);
+        sinon.assert.neverCalledWith(dispatcher.dispatch,
+          new sharedActions.RemoteVideoEnabled({
+            srcVideoObject: videoElement
+          }));
       });
 
       it("should trigger a readyForDataChannel signal after subscribe is complete", function() {
-        session.subscribe.callsArgWith(3, null);
+        session.subscribe.yieldsOn(driver, null, fakeSubscriberObject,
+          document.createElement("video"));
         driver._useDataChannels = true;
-        fakeStream.connection = "fakeID";
+        fakeStream.connection = fakeConnection;
 
         session.trigger("streamCreated", { stream: fakeStream });
 
         sinon.assert.calledOnce(session.signal);
         sinon.assert.calledWith(session.signal, {
           type: "readyForDataChannel",
-          to: "fakeID"
+          to: fakeConnection
         });
       });
 
       it("should not trigger readyForDataChannel signal if data channels are not wanted", function() {
-        session.subscribe.callsArgWith(3, null);
+        session.subscribe.yieldsOn(driver, null, fakeSubscriberObject,
+          document.createElement("video"));
         driver._useDataChannels = false;
-        fakeStream.connection = "fakeID";
+        fakeStream.connection = fakeConnection;
 
         session.trigger("streamCreated", { stream: fakeStream });
 
@@ -878,10 +917,13 @@ describe("loop.OTSdkDriver", function () {
 
         sinon.assert.calledOnce(session.subscribe);
         sinon.assert.calledWithExactly(session.subscribe,
-          fakeStream, fakeScreenElement, publisherConfig);
+          fakeStream, sinon.match.instanceOf(HTMLDivElement), publisherConfig,
+          sinon.match.func);
       });
 
       it("should dispatch a mediaConnected action if both streams are up", function() {
+        session.subscribe.yieldsOn(driver, null, fakeSubscriberObject,
+          videoElement);
         driver._publishedLocalStream = true;
 
         session.trigger("streamCreated", { stream: fakeStream });
@@ -894,6 +936,8 @@ describe("loop.OTSdkDriver", function () {
 
       it("should store the start time when both streams are up and" +
       " driver._sendTwoWayMediaTelemetry is true", function() {
+        session.subscribe.yieldsOn(driver, null, fakeSubscriberObject,
+          videoElement);
         driver._sendTwoWayMediaTelemetry = true;
         driver._publishedLocalStream = true;
         var startTime = 1;
@@ -906,6 +950,8 @@ describe("loop.OTSdkDriver", function () {
 
       it("should not store the start time when both streams are up and" +
          " driver._isDesktop is false", function() {
+        session.subscribe.yieldsOn(driver, null, fakeSubscriberObject,
+          videoElement);
         driver._isDesktop = false;
         driver._publishedLocalStream = true;
         var startTime = 73;
@@ -936,8 +982,10 @@ describe("loop.OTSdkDriver", function () {
             new sharedActions.ReceivingScreenShare({receiving: true}));
         });
 
-      it("should dispatch a ReceivingScreenShare action for screen sharing streams",
-        function() {
+      // XXX See bug 1171933 and the comment in
+      // OtSdkDriver#_handleRemoteScreenShareCreated
+      it.skip("should dispatch a ReceivingScreenShare action for screen" +
+        " sharing streams", function() {
           fakeStream.videoType = "screen";
 
           session.trigger("streamCreated", { stream: fakeStream });
@@ -949,7 +997,7 @@ describe("loop.OTSdkDriver", function () {
         });
     });
 
-    describe("streamDestroyed (publisher/local)", function() {
+    describe("streamDestroyed: publisher/local", function() {
       it("should dispatch a ConnectionStatus action", function() {
         driver._metrics.sendStreams = 1;
         driver._metrics.recvStreams = 1;
@@ -969,7 +1017,7 @@ describe("loop.OTSdkDriver", function () {
       });
     });
 
-    describe("streamDestroyed (session/remote)", function() {
+    describe("streamDestroyed: session/remote", function() {
       var fakeStream;
 
       beforeEach(function() {
@@ -1182,6 +1230,36 @@ describe("loop.OTSdkDriver", function () {
       });
     });
 
+    describe("videoEnabled", function() {
+      it("should dispatch RemoteVideoEnabled", function() {
+        session.subscribe.yieldsOn(driver, null, fakeSubscriberObject,
+          videoElement).returns(this.fakeSubscriberObject);
+        session.trigger("streamCreated", {stream: fakeSubscriberObject.stream});
+        driver._mockSubscribeEl.appendChild(videoElement);
+
+        fakeSubscriberObject.trigger("videoEnabled");
+
+        sinon.assert.called(dispatcher.dispatch);
+        sinon.assert.calledWith(dispatcher.dispatch,
+          new sharedActions.RemoteVideoEnabled({srcVideoObject: videoElement}));
+      });
+    });
+
+    describe("videoDisabled", function() {
+      it("should dispatch RemoteVideoDisabled", function() {
+        session.subscribe.yieldsOn(driver, null, fakeSubscriberObject,
+          videoElement).returns(this.fakeSubscriberObject);
+        session.trigger("streamCreated", {stream: fakeSubscriberObject.stream});
+
+
+        fakeSubscriberObject.trigger("videoDisabled");
+
+        sinon.assert.called(dispatcher.dispatch);
+        sinon.assert.calledWithExactly(dispatcher.dispatch,
+          new sharedActions.RemoteVideoDisabled({}));
+      });
+    });
+
     describe("signal:readyForDataChannel", function() {
       beforeEach(function() {
         driver.subscriber = subscriber;
@@ -1270,15 +1348,19 @@ describe("loop.OTSdkDriver", function () {
     });
   });
 
-  describe("Events (screenshare)", function() {
+  describe("Events: screenshare:", function() {
+    var videoElement;
+
     beforeEach(function() {
       driver.connectSession(sessionData);
 
-      driver.getScreenShareElementFunc = function() {};
-
       driver.startScreenShare({
         videoSource: "window"
       });
+
+      // use a real video element so that these tests correctly reflect
+      // code behavior when run in whatever browser
+      videoElement = document.createElement("video");
     });
 
     describe("accessAllowed", function() {
diff --git a/browser/components/loop/test/shared/views_test.js b/browser/components/loop/test/shared/views_test.js
index 348e1f1bdff8..e03ce19b2949 100644
--- a/browser/components/loop/test/shared/views_test.js
+++ b/browser/components/loop/test/shared/views_test.js
@@ -814,5 +814,125 @@ describe("loop.shared.views", function() {
       });
     });
   });
-});
 
+  describe("MediaView", function() {
+    var view;
+
+    function mountTestComponent(props) {
+      return TestUtils.renderIntoDocument(
+        React.createElement(sharedViews.MediaView, props));
+    }
+
+    it("should display an avatar view", function() {
+      view = mountTestComponent({
+        displayAvatar: true,
+        mediaType: "local"
+      });
+
+      TestUtils.findRenderedComponentWithType(view,
+        sharedViews.AvatarView);
+    });
+
+    it("should display a no-video div if no source object is supplied", function() {
+      view = mountTestComponent({
+        displayAvatar: false,
+        mediaType: "local"
+      });
+
+      var element = view.getDOMNode();
+
+      expect(element.className).eql("no-video");
+    });
+
+    it("should display a video element if a source object is supplied", function() {
+      view = mountTestComponent({
+        displayAvatar: false,
+        mediaType: "local",
+        // This doesn't actually get assigned to the video element, but is enough
+        // for this test to check display of the video element.
+        srcVideoObject: {
+          fake: 1
+        }
+      });
+
+      var element = view.getDOMNode();
+
+      expect(element).not.eql(null);
+      expect(element.className).eql("local-video");
+      expect(element.muted).eql(true);
+    });
+
+    // We test this function by itself, as otherwise we'd be into creating fake
+    // streams etc.
+    describe("#attachVideo", function() {
+      var fakeViewElement;
+
+      beforeEach(function() {
+        fakeViewElement = {
+          play: sinon.stub(),
+          tagName: "VIDEO"
+        };
+
+        view = mountTestComponent({
+          displayAvatar: false,
+          mediaType: "local",
+          srcVideoObject: {
+            fake: 1
+          }
+        });
+      });
+
+      it("should not throw if no source object is specified", function() {
+        expect(function() {
+          view.attachVideo(null);
+        }).to.not.Throw();
+      });
+
+      it("should not throw if the element is not a video object", function() {
+        sinon.stub(view, "getDOMNode").returns({
+          tagName: "DIV"
+        });
+
+        expect(function() {
+          view.attachVideo({});
+        }).to.not.Throw();
+      });
+
+      it("should attach a video object according to the standard", function() {
+        fakeViewElement.srcObject = null;
+
+        sinon.stub(view, "getDOMNode").returns(fakeViewElement);
+
+        view.attachVideo({
+          srcObject: {fake: 1}
+        });
+
+        expect(fakeViewElement.srcObject).eql({fake: 1});
+      });
+
+      it("should attach a video object for Firefox", function() {
+        fakeViewElement.mozSrcObject = null;
+
+        sinon.stub(view, "getDOMNode").returns(fakeViewElement);
+
+        view.attachVideo({
+          mozSrcObject: {fake: 2}
+        });
+
+        expect(fakeViewElement.mozSrcObject).eql({fake: 2});
+      });
+
+      it("should attach a video object for Chrome", function() {
+        fakeViewElement.src = null;
+
+        sinon.stub(view, "getDOMNode").returns(fakeViewElement);
+
+        view.attachVideo({
+          src: {fake: 2}
+        });
+
+        expect(fakeViewElement.src).eql({fake: 2});
+      });
+    });
+  });
+});
diff --git a/browser/components/loop/test/standalone/standaloneRoomViews_test.js b/browser/components/loop/test/standalone/standaloneRoomViews_test.js
index 5d2966af9bcc..fd223fd2a2e7 100644
--- a/browser/components/loop/test/standalone/standaloneRoomViews_test.js
+++ b/browser/components/loop/test/standalone/standaloneRoomViews_test.js
@@ -178,24 +178,16 @@ describe("loop.standaloneRoomViews", function() {
       return TestUtils.renderIntoDocument(
         React.createElement(
           loop.standaloneRoomViews.StandaloneRoomView, {
-            dispatcher: dispatcher,
-            activeRoomStore: activeRoomStore,
-            isFirefox: true
-          }));
+        dispatcher: dispatcher,
+        activeRoomStore: activeRoomStore,
+        isFirefox: true
+      }));
     }
 
     function expectActionDispatched(view) {
       sinon.assert.calledOnce(dispatch);
       sinon.assert.calledWithExactly(dispatch,
         sinon.match.instanceOf(sharedActions.SetupStreamElements));
-      sinon.assert.calledWithExactly(dispatch, sinon.match(function(value) {
-        return value.getLocalElementFunc() ===
-               view.getDOMNode().querySelector(".local");
-      }));
-      sinon.assert.calledWithExactly(dispatch, sinon.match(function(value) {
-        return value.getRemoteElementFunc() ===
-               view.getDOMNode().querySelector(".remote");
-      }));
     }
 
     describe("#componentWillUpdate", function() {
@@ -298,6 +290,10 @@ describe("loop.standaloneRoomViews", function() {
         sandbox.stub(window, "matchMedia").returns({
           matches: false
         });
+        activeRoomStore.setStoreState({
+          remoteSrcVideoObject: {},
+          remoteVideoEnabled: true
+        });
         view = mountTestComponent();
         localElement = view._getElement(".local");
       });
@@ -317,6 +313,34 @@ describe("loop.standaloneRoomViews", function() {
         expect(localElement.style.height).eql("120px");
       });
 
+      it("should be a quarter of the width of the remote view element when there is no stream", function() {
+        activeRoomStore.setStoreState({
+          remoteSrcVideoObject: null,
+          remoteVideoEnabled: false
+        });
+
+        sandbox.stub(view, "getDOMNode").returns({
+          querySelector: function(selector) {
+            if (selector === ".local") {
+              return localElement;
+            }
+
+            return {
+              offsetWidth: 640,
+              offsetLeft: 0
+            };
+          }
+        });
+
+        view.updateLocalCameraPosition({
+          width: 1,
+          height: 0.75
+        });
+
+        expect(localElement.style.width).eql("160px");
+        expect(localElement.style.height).eql("120px");
+      });
+
       it("should be a quarter of the width reduced for aspect ratio", function() {
         sandbox.stub(view, "getRemoteVideoDimensions").returns({
           streamWidth: 640,
@@ -377,6 +401,34 @@ describe("loop.standaloneRoomViews", function() {
         expect(localElement.style.left).eql("600px");
       });
 
+      it("should position the stream to overlap the remote view element when there is no stream", function() {
+        activeRoomStore.setStoreState({
+          remoteSrcVideoObject: null,
+          remoteVideoEnabled: false
+        });
+
+        sandbox.stub(view, "getDOMNode").returns({
+          querySelector: function(selector) {
+            if (selector === ".local") {
+              return localElement;
+            }
+
+            return {
+              offsetWidth: 640,
+              offsetLeft: 0
+            };
+          }
+        });
+
+        view.updateLocalCameraPosition({
+          width: 1,
+          height: 0.75
+        });
+
+        expect(localElement.style.width).eql("160px");
+        expect(localElement.style.left).eql("600px");
+      });
+
       it("should position the stream to overlap the main stream by a quarter when the aspect ratio is vertical", function() {
         sandbox.stub(view, "getRemoteVideoDimensions").returns({
           streamWidth: 640,
@@ -576,6 +628,101 @@ describe("loop.standaloneRoomViews", function() {
         });
       });
 
+      describe("Participants", function() {
+        var videoElement;
+
+        beforeEach(function() {
+          videoElement = document.createElement("video");
+        });
+
+        it("should render local video when video_muted is false", function() {
+          activeRoomStore.setStoreState({
+            roomState: ROOM_STATES.HAS_PARTICIPANTS,
+            localSrcVideoObject: videoElement,
+            videoMuted: false
+          });
+
+          expect(view.getDOMNode().querySelector(".local video")).not.eql(null);
+        });
+
+        it("should not render a local avatar when video_muted is false", function() {
+          activeRoomStore.setStoreState({
+            roomState: ROOM_STATES.HAS_PARTICIPANTS,
+            videoMuted: false
+          });
+
+          expect(view.getDOMNode().querySelector(".local .avatar")).eql(null);
+        });
+
+        it("should render remote video when the room HAS_PARTICIPANTS and" +
+          " remoteVideoEnabled is true", function() {
+          activeRoomStore.setStoreState({
+            roomState: ROOM_STATES.HAS_PARTICIPANTS,
+            remoteSrcVideoObject: videoElement,
+            remoteVideoEnabled: true
+          });
+
+          expect(view.getDOMNode().querySelector(".remote video")).not.eql(null);
+        });
+
+        it("should not render remote video when the room HAS_PARTICIPANTS," +
+          " remoteVideoEnabled is false, and mediaConnected is true", function() {
+          activeRoomStore.setStoreState({
+            roomState: ROOM_STATES.HAS_PARTICIPANTS,
+            remoteSrcVideoObject: videoElement,
+            mediaConnected: true,
+            remoteVideoEnabled: false
+          });
+
+          expect(view.getDOMNode().querySelector(".remote video")).eql(null);
+        });
+
+        it("should render remote video when the room HAS_PARTICIPANTS," +
+          " and both remoteVideoEnabled and mediaConnected are false", function() {
+          activeRoomStore.setStoreState({
+            roomState: ROOM_STATES.HAS_PARTICIPANTS,
+            remoteSrcVideoObject: videoElement,
+            mediaConnected: false,
+            remoteVideoEnabled: false
+          });
+
+          expect(view.getDOMNode().querySelector(".remote video")).not.eql(null);
+        });
+
+        it("should not render a remote avatar when the room is in MEDIA_WAIT", function() {
+          activeRoomStore.setStoreState({
+            roomState: ROOM_STATES.MEDIA_WAIT,
+            remoteSrcVideoObject: videoElement,
+            remoteVideoEnabled: false
+          });
+
+          expect(view.getDOMNode().querySelector(".remote .avatar")).eql(null);
+        });
+
+        it("should not render a remote avatar when the room is CLOSING and" +
+          " remoteVideoEnabled is false", function() {
+          activeRoomStore.setStoreState({
+            roomState: ROOM_STATES.CLOSING,
+            remoteSrcVideoObject: videoElement,
+            remoteVideoEnabled: false
+          });
+
+          expect(view.getDOMNode().querySelector(".remote .avatar")).eql(null);
+        });
+
+        it("should render a remote avatar when the room HAS_PARTICIPANTS, " +
+          "remoteVideoEnabled is false, and mediaConnected is true", function() {
+          activeRoomStore.setStoreState({
+            roomState: ROOM_STATES.HAS_PARTICIPANTS,
+            remoteSrcVideoObject: videoElement,
+            remoteVideoEnabled: false,
+            mediaConnected: true
+          });
+
+          expect(view.getDOMNode().querySelector(".remote .avatar")).not.eql(null);
+        });
+      });
+
       describe("Leave button", function() {
         function getLeaveButton(view) {
           return view.getDOMNode().querySelector(".btn-hangup");
@@ -676,6 +823,18 @@ describe("loop.standaloneRoomViews", function() {
             expect(view.getDOMNode().querySelector(".local-stream-audio"))
               .not.eql(null);
           });
+
+        it("should render a local avatar if the room HAS_PARTICIPANTS and" +
+          " .videoMuted is true",
+          function() {
+            activeRoomStore.setStoreState({
+              roomState: ROOM_STATES.HAS_PARTICIPANTS,
+              videoMuted: true
+            });
+
+            expect(view.getDOMNode().querySelector(".local .avatar")).
+              not.eql(null);
+          });
       });
 
       describe("Marketplace hidden iframe", function() {
diff --git a/browser/components/loop/ui/index.html b/browser/components/loop/ui/index.html
index a29e68e64622..3cbf29507671 100644
--- a/browser/components/loop/ui/index.html
+++ b/browser/components/loop/ui/index.html
@@ -84,6 +84,7 @@
     </script>
     <script src="../content/js/panel.js"></script>
     <script src="../content/js/conversation.js"></script>
+    <script src="react-frame-component.js"></script>
     <script src="ui-showcase.js"></script>
   </body>
 </html>
diff --git a/browser/components/loop/ui/react-frame-component.js b/browser/components/loop/ui/react-frame-component.js
new file mode 100644
index 000000000000..969f34569893
--- /dev/null
+++ b/browser/components/loop/ui/react-frame-component.js
@@ -0,0 +1,138 @@
+/*
+ * Copied from <https://github.com/ryanseddon/react-frame-component> 0.3.2,
+ * by Ryan Seddon, under the MIT license, since that original version requires
+ * a browserify-style loader.
+ */
+
+/**
+ * This is an array of frames that are queued and waiting to be loaded before
+ * their rendering is completed.
+ *
+ * @type {Array}
+ */
+window.queuedFrames = [];
+
+/**
+ * Renders this.props.children inside an <iframe>.
+ *
+ * Works by creating the iframe, waiting for that to finish, and then
+ * rendering the children inside that.  Waits for a while in the hopes that the
+ * contents will have been rendered, and then fires a callback indicating that.
+ *
+ * @see onContentsRendered for the gory details about this.
+ *
+ * @type {ReactComponentFactory<P>}
+ */
+window.Frame = React.createClass({
+  propTypes: {
+    style: React.PropTypes.object,
+    head: React.PropTypes.node,
+    width: React.PropTypes.number,
+    height: React.PropTypes.number,
+    onContentsRendered: React.PropTypes.func
+  },
+  render: function() {
+    return React.createElement("iframe", {
+      style: this.props.style,
+      head: this.props.head,
+      width: this.props.width,
+      height: this.props.height
+    });
+  },
+  componentDidMount: function() {
+    this.renderFrameContents();
+  },
+  renderFrameContents: function() {
+    var doc = this.getDOMNode().contentDocument;
+    if (doc && doc.readyState === "complete") {
+      // Remove this from the queue.
+      window.queuedFrames.splice(window.queuedFrames.indexOf(this), 1);
+
+      var iframeHead = doc.querySelector("head");
+      var parentHeadChildren = document.querySelector("head").children;
+
+      [].forEach.call(parentHeadChildren, function(parentHeadNode) {
+        iframeHead.appendChild(parentHeadNode.cloneNode(true));
+      });
+
+      var contents = React.createElement("div",
+        undefined,
+        this.props.head,
+        this.props.children
+      );
+
+      React.render(contents, doc.body, this.fireOnContentsRendered.bind(this));
+
+      // Set the RTL mode. We assume for now that rtl is the only query parameter.
+      //
+      // See also "ShowCase" in ui-showcase.jsx
+      if (document.location.search === "?rtl=1") {
+        doc.documentElement.setAttribute("lang", "ar");
+        doc.documentElement.setAttribute("dir", "rtl");
+      }
+    } else {
+      // Queue it, only if it isn't already. We do need to set the timeout
+      // regardless, as this function can get re-entered several times.
+      if (window.queuedFrames.indexOf(this) === -1) {
+        window.queuedFrames.push(this);
+      }
+      setTimeout(this.renderFrameContents.bind(this), 0);
+    }
+  },
+  /**
+   * Fires the onContentsRendered callback passed in via this.props,
+   * with the first argument set to the window global used by the iframe.
+   * This is useful in extracting things specific to that iframe (such as
+   * the matchMedia function) for use by code running in that iframe.  Once
+   * React gets a more complete "context" feature:
+   *
+   * https://facebook.github.io/react/blog/2015/02/24/streamlining-react-elements.html#solution-make-context-parent-based-instead-of-owner-based
+   *
+   * we should be able to avoid reaching into the DOM like this.
+   *
+   * XXX wait a little while.  After React has rendered this iframe (eg the
+   * virtual DOM cache gets flushed to the browser), there's still more stuff
+   * that needs to happen before layout completes.  If onContentsRendered fires
+   * before that happens, the wrong sizes (eg remote stream vertical height
+   * of 0) are used to compute the position in the MediaSetupStream, resulting
+   * in everything looking wonky.  One high likelihood candidate for the delay
+   * here involves loading/decode poster images, but even using link
+   * rel=prefetch on those isn't enough to workaround this problem, so there
+   * may be more.
+   *
+   * There doesn't appear to be a good cross-browser way to handle this
+   * at the moment without gross violation of encapsulation (see
+   * http://stackoverflow.com/questions/27241186/how-to-determine-when-document-has-loaded-after-loading-external-csshttp://stackoverflow.com/questions/27241186/how-to-determine-when-document-has-loaded-after-loading-external-css
+   * for discussion of a related problem.
+   *
+   * For now, just wait for multiple seconds.  Yuck.
+   */
+  fireOnContentsRendered: function() {
+    if (!this.props.onContentsRendered) {
+      return;
+    }
+
+    var contentWindow;
+    try {
+      contentWindow = this.getDOMNode().contentWindow;
+      if (!contentWindow) {
+        throw new Error("no content window returned");
+      }
+
+    } catch (ex) {
+      console.error("exception getting content window", ex);
+    }
+
+    // Using bind to construct a "partial function", where |this| is unchanged,
+    // but the first parameter is guaranteed to be set.  Details at
+    // https://developer.mozilla.org/de/docs/Web/JavaScript/Reference/Global_Objects/Function/bind#Example.3A_Partial_Functions
+    setTimeout(this.props.onContentsRendered.bind(undefined, contentWindow),
+               3000);
+  },
+  componentDidUpdate: function() {
+    this.renderFrameContents();
+  },
+  componentWillUnmount: function() {
+    React.unmountComponentAtNode(React.findDOMNode(this).contentDocument.body);
+  }
+});
diff --git a/browser/components/loop/ui/sample-img/video-screen-local.png b/browser/components/loop/ui/sample-img/video-screen-local.png
index 468a842acdf6..becee6b59f96 100644
Binary files a/browser/components/loop/ui/sample-img/video-screen-local.png and b/browser/components/loop/ui/sample-img/video-screen-local.png differ
diff --git a/browser/components/loop/ui/sample-img/video-screen-remote.png b/browser/components/loop/ui/sample-img/video-screen-remote.png
index 94709d2e8f53..aed9150b6031 100644
Binary files a/browser/components/loop/ui/sample-img/video-screen-remote.png and b/browser/components/loop/ui/sample-img/video-screen-remote.png differ
diff --git a/browser/components/loop/ui/sample-img/video-screen-terminal.png b/browser/components/loop/ui/sample-img/video-screen-terminal.png
new file mode 100644
index 000000000000..fa28b5d66051
Binary files /dev/null and b/browser/components/loop/ui/sample-img/video-screen-terminal.png differ
diff --git a/browser/components/loop/ui/ui-showcase.css b/browser/components/loop/ui/ui-showcase.css
index 548bfff4776a..621bfd965ff4 100644
--- a/browser/components/loop/ui/ui-showcase.css
+++ b/browser/components/loop/ui/ui-showcase.css
@@ -3,7 +3,9 @@
  * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
 
 body {
-  /* Override the hidden in common.css */
+  /* Override the hidden in common.css. Very important otherwise you can't
+   * scroll the showcase.
+   */
   overflow: visible;
 }
 
@@ -84,6 +86,14 @@ body {
   color: #555;
 }
 
+.showcase .checkbox-wrapper label {
+  font-weight: bold;
+}
+
+.showcase .checkbox.checked {
+  background-image: url("../content/shared/img/check.svg#check-blue");
+}
+
 .showcase p.note {
   margin: 0;
   padding: 0;
@@ -107,72 +117,12 @@ body {
   font-weight: bold;
 }
 
-/*
- * Switched to using height: 100% in standalone version
- * this mocks it for the ui so that the component has height
- * */
-.standalone .video-layout-wrapper,
-.standalone .remote_wrapper {
-  min-height: 550px;
-}
-
-@media screen and (max-width:640px) {
-
-  .standalone .local-stream {
-    background-size: cover;
-  }
-
-  .standalone .local-stream,
-  .conversation .media.nested .remote {
-    background-size: cover;
-    background-position: center;
-  }
-
-  .standalone .remote_wrapper {
-    width: 100%;
-    background-size: cover;
-    background-position: center;
-  }
-}
-
-.remote_wrapper {
-  background-image: url("sample-img/video-screen-remote.png");
-  background-repeat: no-repeat;
-  background-size: cover;
-}
-
-.local-stream {
-  background-image: url("sample-img/video-screen-local.png");
-  background-repeat: no-repeat;
-}
-
-  .local-stream.local:not(.local-stream-audio) {
-    background-size: cover;
-  }
-
 .call-action-group .btn-group-chevron,
 .call-action-group .btn-group {
   /* Prevent box overflow due to long string */
   max-width: 120px;
 }
 
-.conversation .media.nested .remote {
-  /* Height of obsolute box covers media control buttons. UI showcase only.
-   * When tokbox inserts the markup into the page the problem goes away */
-  bottom: auto;
-}
-
-.standalone .ended-conversation .remote_wrapper,
-.standalone .video-layout-wrapper {
-  /* Removes the fake video image for ended conversations */
-  background: none;
-}
-
-/* Rooms edge cases */
-.standalone .room-conversation .remote_wrapper {
-  background: none;
-}
-
 /* SVG icons showcase */
 
 .svg-icons h3 {
diff --git a/browser/components/loop/ui/ui-showcase.js b/browser/components/loop/ui/ui-showcase.js
index 97d2e0d0f7d7..b519dc29e1cc 100644
--- a/browser/components/loop/ui/ui-showcase.js
+++ b/browser/components/loop/ui/ui-showcase.js
@@ -2,7 +2,7 @@
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
 
-/* global uncaughtError:true */
+/* global Frame:false uncaughtError:true */
 
 (function() {
   "use strict";
@@ -18,6 +18,7 @@
   // 1.2. Conversation Window
   var AcceptCallView = loop.conversationViews.AcceptCallView;
   var DesktopPendingConversationView = loop.conversationViews.PendingConversationView;
+  var OngoingConversationView = loop.conversationViews.OngoingConversationView;
   var CallFailedView = loop.conversationViews.CallFailedView;
   var DesktopRoomConversationView = loop.roomViews.DesktopRoomConversationView;
 
@@ -25,18 +26,12 @@
   var HomeView = loop.webapp.HomeView;
   var UnsupportedBrowserView  = loop.webapp.UnsupportedBrowserView;
   var UnsupportedDeviceView   = loop.webapp.UnsupportedDeviceView;
-  var CallUrlExpiredView      = loop.webapp.CallUrlExpiredView;
-  var GumPromptConversationView = loop.webapp.GumPromptConversationView;
-  var WaitingConversationView = loop.webapp.WaitingConversationView;
-  var StartConversationView   = loop.webapp.StartConversationView;
-  var FailedConversationView  = loop.webapp.FailedConversationView;
-  var EndedConversationView   = loop.webapp.EndedConversationView;
   var StandaloneRoomView      = loop.standaloneRoomViews.StandaloneRoomView;
 
   // 3. Shared components
   var ConversationToolbar = loop.shared.views.ConversationToolbar;
-  var ConversationView = loop.shared.views.ConversationView;
   var FeedbackView = loop.shared.views.FeedbackView;
+  var Checkbox = loop.shared.views.Checkbox;
 
   // Store constants
   var ROOM_STATES = loop.store.ROOM_STATES;
@@ -94,13 +89,154 @@
     }
   }, Backbone.Events);
 
-  var activeRoomStore = new loop.store.ActiveRoomStore(dispatcher, {
-    mozLoop: navigator.mozLoop,
-    sdkDriver: mockSDK
+  /**
+   * Every view that uses an activeRoomStore needs its own; if they shared
+   * an active store, they'd interfere with each other.
+   *
+   * @param options
+   * @returns {loop.store.ActiveRoomStore}
+   */
+  function makeActiveRoomStore(options) {
+    var dispatcher = new loop.Dispatcher();
+
+    var store = new loop.store.ActiveRoomStore(dispatcher, {
+      mozLoop: navigator.mozLoop,
+      sdkDriver: mockSDK
+    });
+
+    if (!("remoteVideoEnabled" in options)) {
+      options.remoteVideoEnabled = true;
+    }
+
+    if (!("mediaConnected" in options)) {
+      options.mediaConnected = true;
+    }
+
+    store.setStoreState({
+      mediaConnected: options.mediaConnected,
+      remoteVideoEnabled: options.remoteVideoEnabled,
+      roomName: "A Very Long Conversation Name",
+      roomState: options.roomState,
+      used: !!options.roomUsed,
+      videoMuted: !!options.videoMuted
+    });
+
+    store.forcedUpdate = function forcedUpdate(contentWindow) {
+
+      // Since this is called by setTimeout, we don't want to lose any
+      // exceptions if there's a problem and we need to debug, so...
+      try {
+        // the dimensions here are taken from the poster images that we're
+        // using, since they give the <video> elements their initial intrinsic
+        // size.  This ensures that the right aspect ratios are calculated.
+        // These are forced to 640x480, because it makes it visually easy to
+        // validate that the showcase looks like the real app on a chine
+        // (eg MacBook Pro) where that is the default camera resolution.
+        var newStoreState = {
+          localVideoDimensions: {
+            camera: {height: 480, orientation: 0, width: 640}
+          },
+          mediaConnected: options.mediaConnected,
+          receivingScreenShare: !!options.receivingScreenShare,
+          remoteVideoDimensions: {
+            camera: {height: 480, orientation: 0, width: 640}
+          },
+          remoteVideoEnabled: options.remoteVideoEnabled,
+          matchMedia: contentWindow.matchMedia.bind(contentWindow),
+          roomState: options.roomState,
+          videoMuted: !!options.videoMuted
+        };
+
+        if (options.receivingScreenShare) {
+          // Note that the image we're using had to be scaled a bit, and
+          // it still ended up a bit narrower than the live thing that
+          // WebRTC sends; presumably a different scaling algorithm.
+          // For showcase purposes, this shouldn't matter much, as the sizes
+          // of things being shared will be fairly arbitrary.
+          newStoreState.remoteVideoDimensions.screen =
+          {height: 456, orientation: 0, width: 641};
+        }
+
+        store.setStoreState(newStoreState);
+      } catch (ex) {
+        console.error("exception in forcedUpdate:", ex);
+      }
+    };
+
+    return store;
+  }
+
+  var activeRoomStore = makeActiveRoomStore({
+    roomState: ROOM_STATES.HAS_PARTICIPANTS
   });
+
+  var joinedRoomStore = makeActiveRoomStore({
+    mediaConnected: false,
+    roomState: ROOM_STATES.JOINED,
+    remoteVideoEnabled: false
+  });
+
+  var readyRoomStore = makeActiveRoomStore({
+    mediaConnected: false,
+    roomState: ROOM_STATES.READY
+  });
+
+  var updatingActiveRoomStore = makeActiveRoomStore({
+    roomState: ROOM_STATES.HAS_PARTICIPANTS
+  });
+
+  var localFaceMuteRoomStore = makeActiveRoomStore({
+    roomState: ROOM_STATES.HAS_PARTICIPANTS,
+    videoMuted: true
+  });
+
+  var remoteFaceMuteRoomStore = makeActiveRoomStore({
+    roomState: ROOM_STATES.HAS_PARTICIPANTS,
+    remoteVideoEnabled: false,
+    mediaConnected: true
+  });
+
+  var updatingSharingRoomStore = makeActiveRoomStore({
+    roomState: ROOM_STATES.HAS_PARTICIPANTS,
+    receivingScreenShare: true
+  });
+
+  var fullActiveRoomStore = makeActiveRoomStore({
+    roomState: ROOM_STATES.FULL
+  });
+
+  var failedRoomStore = makeActiveRoomStore({
+    roomState: ROOM_STATES.FAILED
+  });
+
+  var endedRoomStore = makeActiveRoomStore({
+    roomState: ROOM_STATES.ENDED,
+    roomUsed: true
+  });
+
   var roomStore = new loop.store.RoomStore(dispatcher, {
     mozLoop: navigator.mozLoop
   });
+
+  var desktopLocalFaceMuteActiveRoomStore = makeActiveRoomStore({
+    roomState: ROOM_STATES.HAS_PARTICIPANTS,
+    videoMuted: true
+  });
+  var desktopLocalFaceMuteRoomStore = new loop.store.RoomStore(dispatcher, {
+    mozLoop: navigator.mozLoop,
+    activeRoomStore: desktopLocalFaceMuteActiveRoomStore
+  });
+
+  var desktopRemoteFaceMuteActiveRoomStore = makeActiveRoomStore({
+    roomState: ROOM_STATES.HAS_PARTICIPANTS,
+    remoteVideoEnabled: false,
+    mediaConnected: true
+  });
+  var desktopRemoteFaceMuteRoomStore = new loop.store.RoomStore(dispatcher, {
+    mozLoop: navigator.mozLoop,
+    activeRoomStore: desktopRemoteFaceMuteActiveRoomStore
+  });
+
   var feedbackStore = new loop.store.FeedbackStore(dispatcher, {
     feedbackClient: stageFeedbackApiClient
   });
@@ -216,6 +352,37 @@
     }
   });
 
+  var FramedExample = React.createClass({displayName: "FramedExample",
+    propTypes: {
+      width: React.PropTypes.number,
+      height: React.PropTypes.number,
+      onContentsRendered: React.PropTypes.func
+    },
+
+    makeId: function(prefix) {
+      return (prefix || "") + this.props.summary.toLowerCase().replace(/\s/g, "-");
+    },
+
+    render: function() {
+      var cx = React.addons.classSet;
+      return (
+        React.createElement("div", {className: "example"}, 
+          React.createElement("h3", {id: this.makeId()}, 
+            this.props.summary, 
+            React.createElement("a", {href: this.makeId("#")}, " ¶")
+          ), 
+          React.createElement("div", {className: cx({comp: true, dashed: this.props.dashed}), 
+               style: this.props.style}, 
+            React.createElement(Frame, {width: this.props.width, height: this.props.height, 
+                   onContentsRendered: this.props.onContentsRendered}, 
+              this.props.children
+            )
+          )
+        )
+      );
+    }
+  });
+
   var Example = React.createClass({displayName: "Example",
     makeId: function(prefix) {
       return (prefix || "") + this.props.summary.toLowerCase().replace(/\s/g, "-");
@@ -250,11 +417,42 @@
   });
 
   var ShowCase = React.createClass({displayName: "ShowCase",
+    getInitialState: function() {
+      // We assume for now that rtl is the only query parameter.
+      //
+      // Note: this check is repeated in react-frame-component to save passing
+      // rtlMode down the props tree.
+      var rtlMode = document.location.search === "?rtl=1";
+
+      return {
+        rtlMode: rtlMode
+      };
+    },
+
+    _handleCheckboxChange: function(newState) {
+      var newLocation = "";
+      if (newState.checked) {
+        newLocation = document.location.href.split("#")[0];
+        newLocation += "?rtl=1";
+      } else {
+        newLocation = document.location.href.split("?")[0];
+      }
+      newLocation += document.location.hash;
+      document.location = newLocation;
+    },
+
     render: function() {
+      if (this.state.rtlMode) {
+        document.documentElement.setAttribute("lang", "ar");
+        document.documentElement.setAttribute("dir", "rtl");
+      }
+
       return (
         React.createElement("div", {className: "showcase"}, 
           React.createElement("header", null, 
             React.createElement("h1", null, "Loop UI Components Showcase"), 
+            React.createElement(Checkbox, {label: "RTL mode?", checked: this.state.rtlMode, 
+              onChange: this._handleCheckboxChange}), 
             React.createElement("nav", {className: "showcase-menu"}, 
               React.Children.map(this.props.children, function(section) {
                 return (
@@ -272,6 +470,7 @@
   });
 
   var App = React.createClass({displayName: "App",
+
     render: function() {
       return (
         React.createElement(ShowCase, null, 
@@ -364,19 +563,19 @@
           React.createElement(Section, {name: "ConversationToolbar"}, 
             React.createElement("h2", null, "Desktop Conversation Window"), 
             React.createElement("div", {className: "fx-embedded override-position"}, 
-              React.createElement(Example, {summary: "Default", dashed: "true", style: {width: "300px", height: "272px"}}, 
+              React.createElement(Example, {summary: "Default", style: {width: "300px", height: "26px"}}, 
                 React.createElement(ConversationToolbar, {video: {enabled: true}, 
                                      audio: {enabled: true}, 
                                      hangup: noop, 
                                      publishStream: noop})
               ), 
-              React.createElement(Example, {summary: "Video muted", style: {width: "300px", height: "272px"}}, 
+              React.createElement(Example, {summary: "Video muted", style: {width: "300px", height: "26px"}}, 
                 React.createElement(ConversationToolbar, {video: {enabled: false}, 
                                      audio: {enabled: true}, 
                                      hangup: noop, 
                                      publishStream: noop})
               ), 
-              React.createElement(Example, {summary: "Audio muted", style: {width: "300px", height: "272px"}}, 
+              React.createElement(Example, {summary: "Audio muted", style: {width: "300px", height: "26px"}}, 
                 React.createElement(ConversationToolbar, {video: {enabled: true}, 
                                      audio: {enabled: false}, 
                                      hangup: noop, 
@@ -407,30 +606,6 @@
             )
           ), 
 
-          React.createElement(Section, {name: "GumPromptConversationView"}, 
-            React.createElement(Example, {summary: "Gum Prompt conversation view", dashed: "true"}, 
-              React.createElement("div", {className: "standalone"}, 
-                React.createElement(GumPromptConversationView, null)
-              )
-            )
-          ), 
-
-          React.createElement(Section, {name: "WaitingConversationView"}, 
-            React.createElement(Example, {summary: "Waiting conversation view (connecting)", dashed: "true"}, 
-              React.createElement("div", {className: "standalone"}, 
-                React.createElement(WaitingConversationView, {websocket: mockWebSocket, 
-                                         dispatcher: dispatcher})
-              )
-            ), 
-            React.createElement(Example, {summary: "Waiting conversation view (ringing)", dashed: "true"}, 
-              React.createElement("div", {className: "standalone"}, 
-                React.createElement(WaitingConversationView, {websocket: mockWebSocket, 
-                                         dispatcher: dispatcher, 
-                                         callState: "ringing"})
-              )
-            )
-          ), 
-
           React.createElement(Section, {name: "PendingConversationView (Desktop)"}, 
             React.createElement(Example, {summary: "Connecting", dashed: "true", 
                      style: {width: "300px", height: "272px"}}, 
@@ -469,94 +644,61 @@
             )
           ), 
 
-          React.createElement(Section, {name: "StartConversationView"}, 
-            React.createElement(Example, {summary: "Start conversation view", dashed: "true"}, 
-              React.createElement("div", {className: "standalone"}, 
-                React.createElement(StartConversationView, {conversation: mockConversationModel, 
-                                       client: mockClient, 
-                                       notifications: notifications})
-              )
-            )
-          ), 
-
-          React.createElement(Section, {name: "FailedConversationView"}, 
-            React.createElement(Example, {summary: "Failed conversation view", dashed: "true"}, 
-              React.createElement("div", {className: "standalone"}, 
-                React.createElement(FailedConversationView, {conversation: mockConversationModel, 
-                                        client: mockClient, 
-                                        notifications: notifications})
-              )
-            )
-          ), 
-
-          React.createElement(Section, {name: "ConversationView"}, 
-            React.createElement(Example, {summary: "Desktop conversation window", dashed: "true", 
-                     style: {width: "300px", height: "272px"}}, 
+          React.createElement(Section, {name: "OngoingConversationView"}, 
+            React.createElement(FramedExample, {width: 298, height: 254, 
+                           summary: "Desktop ongoing conversation window"}, 
               React.createElement("div", {className: "fx-embedded"}, 
-                React.createElement(ConversationView, {sdk: mockSDK, 
-                                  model: mockConversationModel, 
-                                  video: {enabled: true}, 
-                                  audio: {enabled: true}})
+                React.createElement(OngoingConversationView, {
+                  dispatcher: dispatcher, 
+                  video: {enabled: true}, 
+                  audio: {enabled: true}, 
+                  localPosterUrl: "sample-img/video-screen-local.png", 
+                  remotePosterUrl: "sample-img/video-screen-remote.png", 
+                  remoteVideoEnabled: true, 
+                  mediaConnected: true})
               )
             ), 
 
-            React.createElement(Example, {summary: "Desktop conversation window large", dashed: "true"}, 
-              React.createElement("div", {className: "breakpoint", "data-breakpoint-width": "800px", 
-                "data-breakpoint-height": "600px"}, 
+            React.createElement(FramedExample, {width: 800, height: 600, 
+                           summary: "Desktop ongoing conversation window large"}, 
                 React.createElement("div", {className: "fx-embedded"}, 
-                  React.createElement(ConversationView, {sdk: mockSDK, 
+                  React.createElement(OngoingConversationView, {
+                    dispatcher: dispatcher, 
                     video: {enabled: true}, 
                     audio: {enabled: true}, 
-                    model: mockConversationModel})
+                    localPosterUrl: "sample-img/video-screen-local.png", 
+                    remotePosterUrl: "sample-img/video-screen-remote.png", 
+                    remoteVideoEnabled: true, 
+                    mediaConnected: true})
                 )
-              )
             ), 
 
-            React.createElement(Example, {summary: "Desktop conversation window local audio stream", 
-                     dashed: "true", style: {width: "300px", height: "272px"}}, 
+            React.createElement(FramedExample, {width: 298, height: 254, 
+              summary: "Desktop ongoing conversation window - local face mute"}, 
               React.createElement("div", {className: "fx-embedded"}, 
-                React.createElement(ConversationView, {sdk: mockSDK, 
-                                  video: {enabled: false}, 
-                                  audio: {enabled: true}, 
-                                  model: mockConversationModel})
+                React.createElement(OngoingConversationView, {
+                  dispatcher: dispatcher, 
+                  video: {enabled: false}, 
+                  audio: {enabled: true}, 
+                  remoteVideoEnabled: true, 
+                  remotePosterUrl: "sample-img/video-screen-remote.png", 
+                  mediaConnected: true})
               )
             ), 
 
-            React.createElement(Example, {summary: "Standalone version"}, 
-              React.createElement("div", {className: "standalone"}, 
-                React.createElement(ConversationView, {sdk: mockSDK, 
-                                  video: {enabled: true}, 
-                                  audio: {enabled: true}, 
-                                  model: mockConversationModel})
+            React.createElement(FramedExample, {width: 298, height: 254, 
+              summary: "Desktop ongoing conversation window - remote face mute"}, 
+              React.createElement("div", {className: "fx-embedded"}, 
+                React.createElement(OngoingConversationView, {
+                  dispatcher: dispatcher, 
+                  video: {enabled: true}, 
+                  audio: {enabled: true}, 
+                  remoteVideoEnabled: false, 
+                  localPosterUrl: "sample-img/video-screen-local.png", 
+                  mediaConnected: true})
               )
             )
-          ), 
 
-          React.createElement(Section, {name: "ConversationView-640"}, 
-            React.createElement(Example, {summary: "640px breakpoint for conversation view"}, 
-              React.createElement("div", {className: "breakpoint", 
-                   style: {"text-align": "center"}, 
-                   "data-breakpoint-width": "400px", 
-                   "data-breakpoint-height": "780px"}, 
-                React.createElement("div", {className: "standalone"}, 
-                  React.createElement(ConversationView, {sdk: mockSDK, 
-                                    video: {enabled: true}, 
-                                    audio: {enabled: true}, 
-                                    model: mockConversationModel})
-                )
-              )
-            )
-          ), 
-
-          React.createElement(Section, {name: "ConversationView-LocalAudio"}, 
-            React.createElement(Example, {summary: "Local stream is audio only"}, 
-              React.createElement("div", {className: "standalone"}, 
-                React.createElement(ConversationView, {sdk: mockSDK, 
-                                  video: {enabled: false}, 
-                                  audio: {enabled: true}, 
-                                  model: mockConversationModel})
-              )
-            )
           ), 
 
           React.createElement(Section, {name: "FeedbackView"}, 
@@ -575,28 +717,6 @@
             )
           ), 
 
-          React.createElement(Section, {name: "CallUrlExpiredView"}, 
-            React.createElement(Example, {summary: "Firefox User"}, 
-              React.createElement(CallUrlExpiredView, {isFirefox: true})
-            ), 
-            React.createElement(Example, {summary: "Non-Firefox User"}, 
-              React.createElement(CallUrlExpiredView, {isFirefox: false})
-            )
-          ), 
-
-          React.createElement(Section, {name: "EndedConversationView"}, 
-            React.createElement(Example, {summary: "Displays the feedback form"}, 
-              React.createElement("div", {className: "standalone"}, 
-                React.createElement(EndedConversationView, {sdk: mockSDK, 
-                                       video: {enabled: true}, 
-                                       audio: {enabled: true}, 
-                                       conversation: mockConversationModel, 
-                                       feedbackStore: feedbackStore, 
-                                       onAfterFeedbackReceived: noop})
-              )
-            )
-          ), 
-
           React.createElement(Section, {name: "AlertMessages"}, 
             React.createElement(Example, {summary: "Various alerts"}, 
               React.createElement("div", {className: "alert alert-warning"}, 
@@ -615,15 +735,6 @@
             )
           ), 
 
-          React.createElement(Section, {name: "HomeView"}, 
-            React.createElement(Example, {summary: "Standalone Home View"}, 
-              React.createElement("div", {className: "standalone"}, 
-                React.createElement(HomeView, null)
-              )
-            )
-          ), 
-
-
           React.createElement(Section, {name: "UnsupportedBrowserView"}, 
             React.createElement(Example, {summary: "Standalone Unsupported Browser"}, 
               React.createElement("div", {className: "standalone"}, 
@@ -641,97 +752,171 @@
           ), 
 
           React.createElement(Section, {name: "DesktopRoomConversationView"}, 
-            React.createElement(Example, {summary: "Desktop room conversation (invitation)", dashed: "true", 
-                     style: {width: "260px", height: "265px"}}, 
+            React.createElement(FramedExample, {width: 298, height: 254, 
+              summary: "Desktop room conversation (invitation)"}, 
               React.createElement("div", {className: "fx-embedded"}, 
                 React.createElement(DesktopRoomConversationView, {
                   roomStore: roomStore, 
                   dispatcher: dispatcher, 
                   mozLoop: navigator.mozLoop, 
+                  localPosterUrl: "sample-img/video-screen-local.png", 
                   roomState: ROOM_STATES.INIT})
               )
             ), 
 
-            React.createElement(Example, {summary: "Desktop room conversation", dashed: "true", 
-                     style: {width: "260px", height: "265px"}}, 
+            React.createElement(FramedExample, {width: 298, height: 254, 
+              summary: "Desktop room conversation"}, 
               React.createElement("div", {className: "fx-embedded"}, 
                 React.createElement(DesktopRoomConversationView, {
                   roomStore: roomStore, 
                   dispatcher: dispatcher, 
                   mozLoop: navigator.mozLoop, 
+                  localPosterUrl: "sample-img/video-screen-local.png", 
+                  remotePosterUrl: "sample-img/video-screen-remote.png", 
                   roomState: ROOM_STATES.HAS_PARTICIPANTS})
               )
+            ), 
+
+            React.createElement(FramedExample, {width: 298, height: 254, 
+                           summary: "Desktop room conversation local face-mute"}, 
+              React.createElement("div", {className: "fx-embedded"}, 
+                React.createElement(DesktopRoomConversationView, {
+                  roomStore: desktopLocalFaceMuteRoomStore, 
+                  dispatcher: dispatcher, 
+                  mozLoop: navigator.mozLoop, 
+                  remotePosterUrl: "sample-img/video-screen-remote.png"})
+              )
+            ), 
+
+            React.createElement(FramedExample, {width: 298, height: 254, 
+                           summary: "Desktop room conversation remote face-mute"}, 
+              React.createElement("div", {className: "fx-embedded"}, 
+                React.createElement(DesktopRoomConversationView, {
+                  roomStore: desktopRemoteFaceMuteRoomStore, 
+                  dispatcher: dispatcher, 
+                  mozLoop: navigator.mozLoop, 
+                  localPosterUrl: "sample-img/video-screen-local.png"})
+              )
             )
           ), 
 
           React.createElement(Section, {name: "StandaloneRoomView"}, 
-            React.createElement(Example, {summary: "Standalone room conversation (ready)"}, 
+            React.createElement(FramedExample, {width: 644, height: 483, 
+              summary: "Standalone room conversation (ready)"}, 
               React.createElement("div", {className: "standalone"}, 
                 React.createElement(StandaloneRoomView, {
                   dispatcher: dispatcher, 
-                  activeRoomStore: activeRoomStore, 
+                  activeRoomStore: readyRoomStore, 
                   roomState: ROOM_STATES.READY, 
                   isFirefox: true})
               )
             ), 
 
-            React.createElement(Example, {summary: "Standalone room conversation (joined)"}, 
+            React.createElement(FramedExample, {width: 644, height: 483, 
+              summary: "Standalone room conversation (joined)", 
+              onContentsRendered: joinedRoomStore.forcedUpdate}, 
               React.createElement("div", {className: "standalone"}, 
                 React.createElement(StandaloneRoomView, {
                   dispatcher: dispatcher, 
-                  activeRoomStore: activeRoomStore, 
-                  roomState: ROOM_STATES.JOINED, 
+                  activeRoomStore: joinedRoomStore, 
+                  localPosterUrl: "sample-img/video-screen-local.png", 
                   isFirefox: true})
               )
             ), 
 
-            React.createElement(Example, {summary: "Standalone room conversation (has-participants)"}, 
+            React.createElement(FramedExample, {width: 644, height: 483, 
+                           onContentsRendered: updatingActiveRoomStore.forcedUpdate, 
+                           summary: "Standalone room conversation (has-participants, 644x483)"}, 
+                React.createElement("div", {className: "standalone"}, 
+                  React.createElement(StandaloneRoomView, {
+                    dispatcher: dispatcher, 
+                    activeRoomStore: updatingActiveRoomStore, 
+                    roomState: ROOM_STATES.HAS_PARTICIPANTS, 
+                    isFirefox: true, 
+                    localPosterUrl: "sample-img/video-screen-local.png", 
+                    remotePosterUrl: "sample-img/video-screen-remote.png"})
+                )
+            ), 
+
+            React.createElement(FramedExample, {width: 644, height: 483, 
+                           onContentsRendered: localFaceMuteRoomStore.forcedUpdate, 
+                           summary: "Standalone room conversation (local face mute, has-participants, 644x483)"}, 
               React.createElement("div", {className: "standalone"}, 
                 React.createElement(StandaloneRoomView, {
                   dispatcher: dispatcher, 
-                  activeRoomStore: activeRoomStore, 
-                  roomState: ROOM_STATES.HAS_PARTICIPANTS, 
+                  activeRoomStore: localFaceMuteRoomStore, 
+                  isFirefox: true, 
+                  localPosterUrl: "sample-img/video-screen-local.png", 
+                  remotePosterUrl: "sample-img/video-screen-remote.png"})
+              )
+            ), 
+
+            React.createElement(FramedExample, {width: 644, height: 483, 
+                           onContentsRendered: remoteFaceMuteRoomStore.forcedUpdate, 
+                           summary: "Standalone room conversation (remote face mute, has-participants, 644x483)"}, 
+              React.createElement("div", {className: "standalone"}, 
+                React.createElement(StandaloneRoomView, {
+                  dispatcher: dispatcher, 
+                  activeRoomStore: remoteFaceMuteRoomStore, 
+                  isFirefox: true, 
+                  localPosterUrl: "sample-img/video-screen-local.png", 
+                  remotePosterUrl: "sample-img/video-screen-remote.png"})
+              )
+            ), 
+
+            React.createElement(FramedExample, {width: 800, height: 660, 
+                           onContentsRendered: updatingSharingRoomStore.forcedUpdate, 
+              summary: "Standalone room convo (has-participants, receivingScreenShare, 800x660)"}, 
+                React.createElement("div", {className: "standalone"}, 
+                  React.createElement(StandaloneRoomView, {
+                    dispatcher: dispatcher, 
+                    activeRoomStore: updatingSharingRoomStore, 
+                    roomState: ROOM_STATES.HAS_PARTICIPANTS, 
+                    isFirefox: true, 
+                    localPosterUrl: "sample-img/video-screen-local.png", 
+                    remotePosterUrl: "sample-img/video-screen-remote.png", 
+                    screenSharePosterUrl: "sample-img/video-screen-terminal.png"}
+                  )
+                )
+            ), 
+
+            React.createElement(FramedExample, {width: 644, height: 483, 
+                           summary: "Standalone room conversation (full - FFx user)"}, 
+              React.createElement("div", {className: "standalone"}, 
+                React.createElement(StandaloneRoomView, {
+                  dispatcher: dispatcher, 
+                  activeRoomStore: fullActiveRoomStore, 
                   isFirefox: true})
               )
             ), 
 
-            React.createElement(Example, {summary: "Standalone room conversation (full - FFx user)"}, 
+            React.createElement(FramedExample, {width: 644, height: 483, 
+              summary: "Standalone room conversation (full - non FFx user)"}, 
               React.createElement("div", {className: "standalone"}, 
                 React.createElement(StandaloneRoomView, {
                   dispatcher: dispatcher, 
-                  activeRoomStore: activeRoomStore, 
-                  roomState: ROOM_STATES.FULL, 
-                  isFirefox: true})
-              )
-            ), 
-
-            React.createElement(Example, {summary: "Standalone room conversation (full - non FFx user)"}, 
-              React.createElement("div", {className: "standalone"}, 
-                React.createElement(StandaloneRoomView, {
-                  dispatcher: dispatcher, 
-                  activeRoomStore: activeRoomStore, 
-                  roomState: ROOM_STATES.FULL, 
+                  activeRoomStore: fullActiveRoomStore, 
                   isFirefox: false})
               )
             ), 
 
-            React.createElement(Example, {summary: "Standalone room conversation (feedback)"}, 
+            React.createElement(FramedExample, {width: 644, height: 483, 
+              summary: "Standalone room conversation (feedback)"}, 
               React.createElement("div", {className: "standalone"}, 
                 React.createElement(StandaloneRoomView, {
                   dispatcher: dispatcher, 
-                  activeRoomStore: activeRoomStore, 
+                  activeRoomStore: endedRoomStore, 
                   feedbackStore: feedbackStore, 
-                  roomState: ROOM_STATES.ENDED, 
                   isFirefox: false})
               )
             ), 
 
-            React.createElement(Example, {summary: "Standalone room conversation (failed)"}, 
+            React.createElement(FramedExample, {width: 644, height: 483, 
+                           summary: "Standalone room conversation (failed)"}, 
               React.createElement("div", {className: "standalone"}, 
                 React.createElement(StandaloneRoomView, {
                   dispatcher: dispatcher, 
-                  activeRoomStore: activeRoomStore, 
-                  roomState: ROOM_STATES.FAILED, 
+                  activeRoomStore: failedRoomStore, 
                   isFirefox: false})
               )
             )
@@ -754,45 +939,6 @@
     }
   });
 
-  /**
-   * Render components that have different styles across
-   * CSS media rules in their own iframe to mimic the viewport
-   * */
-  function _renderComponentsInIframes() {
-    var parents = document.querySelectorAll(".breakpoint");
-    [].forEach.call(parents, appendChildInIframe);
-
-    /**
-     * Extracts the component from the DOM and appends in the an iframe
-     *
-     * @type {HTMLElement} parent - Parent DOM node of a component & iframe
-     * */
-    function appendChildInIframe(parent) {
-      var styles     = document.querySelector("head").children;
-      var component  = parent.children[0];
-      var iframe     = document.createElement("iframe");
-      var width      = parent.dataset.breakpointWidth;
-      var height     = parent.dataset.breakpointHeight;
-
-      iframe.style.width  = width;
-      iframe.style.height = height;
-
-      parent.appendChild(iframe);
-      iframe.src    = "about:blank";
-      // Workaround for bug 297685
-      iframe.onload = function () {
-        var iframeHead = iframe.contentDocument.querySelector("head");
-        iframe.contentDocument.documentElement.querySelector("body")
-                                              .appendChild(component);
-
-        [].forEach.call(styles, function(style) {
-          iframeHead.appendChild(style.cloneNode(true));
-        });
-
-      };
-    }
-  }
-
   window.addEventListener("DOMContentLoaded", function() {
     try {
       React.renderComponent(React.createElement(App, null), document.getElementById("main"));
@@ -805,23 +951,28 @@
       uncaughtError = err;
     }
 
-    _renderComponentsInIframes();
+    // Wait until all the FramedExamples have been fully loaded.
+    setTimeout(function waitForQueuedFrames() {
+      if (window.queuedFrames.length != 0) {
+        setTimeout(waitForQueuedFrames, 500);
+        return;
+      }
+      // Put the title back, in case views changed it.
+      document.title = "Loop UI Components Showcase";
 
-    // Put the title back, in case views changed it.
-    document.title = "Loop UI Components Showcase";
-
-    // This simulates the mocha layout for errors which means we can run
-    // this alongside our other unit tests but use the same harness.
-    if (uncaughtError) {
-      $("#results").append("<div class='failures'><em>1</em></div>");
-      $("#results").append("<li class='test fail'>" +
-        "<h2>Errors rendering UI-Showcase</h2>" +
-        "<pre class='error'>" + uncaughtError + "\n" + uncaughtError.stack + "</pre>" +
-        "</li>");
-    } else {
-      $("#results").append("<div class='failures'><em>0</em></div>");
-    }
-    $("#results").append("<p id='complete'>Complete.</p>");
+      // This simulates the mocha layout for errors which means we can run
+      // this alongside our other unit tests but use the same harness.
+      if (uncaughtError) {
+        $("#results").append("<div class='failures'><em>1</em></div>");
+        $("#results").append("<li class='test fail'>" +
+          "<h2>Errors rendering UI-Showcase</h2>" +
+          "<pre class='error'>" + uncaughtError + "\n" + uncaughtError.stack + "</pre>" +
+          "</li>");
+      } else {
+        $("#results").append("<div class='failures'><em>0</em></div>");
+      }
+      $("#results").append("<p id='complete'>Complete.</p>");
+    }, 1000);
   });
 
 })();
diff --git a/browser/components/loop/ui/ui-showcase.jsx b/browser/components/loop/ui/ui-showcase.jsx
index 01ccc71fcfc0..9fdd6071e03e 100644
--- a/browser/components/loop/ui/ui-showcase.jsx
+++ b/browser/components/loop/ui/ui-showcase.jsx
@@ -2,7 +2,7 @@
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
 
-/* global uncaughtError:true */
+/* global Frame:false uncaughtError:true */
 
 (function() {
   "use strict";
@@ -18,6 +18,7 @@
   // 1.2. Conversation Window
   var AcceptCallView = loop.conversationViews.AcceptCallView;
   var DesktopPendingConversationView = loop.conversationViews.PendingConversationView;
+  var OngoingConversationView = loop.conversationViews.OngoingConversationView;
   var CallFailedView = loop.conversationViews.CallFailedView;
   var DesktopRoomConversationView = loop.roomViews.DesktopRoomConversationView;
 
@@ -25,18 +26,12 @@
   var HomeView = loop.webapp.HomeView;
   var UnsupportedBrowserView  = loop.webapp.UnsupportedBrowserView;
   var UnsupportedDeviceView   = loop.webapp.UnsupportedDeviceView;
-  var CallUrlExpiredView      = loop.webapp.CallUrlExpiredView;
-  var GumPromptConversationView = loop.webapp.GumPromptConversationView;
-  var WaitingConversationView = loop.webapp.WaitingConversationView;
-  var StartConversationView   = loop.webapp.StartConversationView;
-  var FailedConversationView  = loop.webapp.FailedConversationView;
-  var EndedConversationView   = loop.webapp.EndedConversationView;
   var StandaloneRoomView      = loop.standaloneRoomViews.StandaloneRoomView;
 
   // 3. Shared components
   var ConversationToolbar = loop.shared.views.ConversationToolbar;
-  var ConversationView = loop.shared.views.ConversationView;
   var FeedbackView = loop.shared.views.FeedbackView;
+  var Checkbox = loop.shared.views.Checkbox;
 
   // Store constants
   var ROOM_STATES = loop.store.ROOM_STATES;
@@ -94,13 +89,154 @@
     }
   }, Backbone.Events);
 
-  var activeRoomStore = new loop.store.ActiveRoomStore(dispatcher, {
-    mozLoop: navigator.mozLoop,
-    sdkDriver: mockSDK
+  /**
+   * Every view that uses an activeRoomStore needs its own; if they shared
+   * an active store, they'd interfere with each other.
+   *
+   * @param options
+   * @returns {loop.store.ActiveRoomStore}
+   */
+  function makeActiveRoomStore(options) {
+    var dispatcher = new loop.Dispatcher();
+
+    var store = new loop.store.ActiveRoomStore(dispatcher, {
+      mozLoop: navigator.mozLoop,
+      sdkDriver: mockSDK
+    });
+
+    if (!("remoteVideoEnabled" in options)) {
+      options.remoteVideoEnabled = true;
+    }
+
+    if (!("mediaConnected" in options)) {
+      options.mediaConnected = true;
+    }
+
+    store.setStoreState({
+      mediaConnected: options.mediaConnected,
+      remoteVideoEnabled: options.remoteVideoEnabled,
+      roomName: "A Very Long Conversation Name",
+      roomState: options.roomState,
+      used: !!options.roomUsed,
+      videoMuted: !!options.videoMuted
+    });
+
+    store.forcedUpdate = function forcedUpdate(contentWindow) {
+
+      // Since this is called by setTimeout, we don't want to lose any
+      // exceptions if there's a problem and we need to debug, so...
+      try {
+        // the dimensions here are taken from the poster images that we're
+        // using, since they give the <video> elements their initial intrinsic
+        // size.  This ensures that the right aspect ratios are calculated.
+        // These are forced to 640x480, because it makes it visually easy to
+        // validate that the showcase looks like the real app on a chine
+        // (eg MacBook Pro) where that is the default camera resolution.
+        var newStoreState = {
+          localVideoDimensions: {
+            camera: {height: 480, orientation: 0, width: 640}
+          },
+          mediaConnected: options.mediaConnected,
+          receivingScreenShare: !!options.receivingScreenShare,
+          remoteVideoDimensions: {
+            camera: {height: 480, orientation: 0, width: 640}
+          },
+          remoteVideoEnabled: options.remoteVideoEnabled,
+          matchMedia: contentWindow.matchMedia.bind(contentWindow),
+          roomState: options.roomState,
+          videoMuted: !!options.videoMuted
+        };
+
+        if (options.receivingScreenShare) {
+          // Note that the image we're using had to be scaled a bit, and
+          // it still ended up a bit narrower than the live thing that
+          // WebRTC sends; presumably a different scaling algorithm.
+          // For showcase purposes, this shouldn't matter much, as the sizes
+          // of things being shared will be fairly arbitrary.
+          newStoreState.remoteVideoDimensions.screen =
+          {height: 456, orientation: 0, width: 641};
+        }
+
+        store.setStoreState(newStoreState);
+      } catch (ex) {
+        console.error("exception in forcedUpdate:", ex);
+      }
+    };
+
+    return store;
+  }
+
+  var activeRoomStore = makeActiveRoomStore({
+    roomState: ROOM_STATES.HAS_PARTICIPANTS
   });
+
+  var joinedRoomStore = makeActiveRoomStore({
+    mediaConnected: false,
+    roomState: ROOM_STATES.JOINED,
+    remoteVideoEnabled: false
+  });
+
+  var readyRoomStore = makeActiveRoomStore({
+    mediaConnected: false,
+    roomState: ROOM_STATES.READY
+  });
+
+  var updatingActiveRoomStore = makeActiveRoomStore({
+    roomState: ROOM_STATES.HAS_PARTICIPANTS
+  });
+
+  var localFaceMuteRoomStore = makeActiveRoomStore({
+    roomState: ROOM_STATES.HAS_PARTICIPANTS,
+    videoMuted: true
+  });
+
+  var remoteFaceMuteRoomStore = makeActiveRoomStore({
+    roomState: ROOM_STATES.HAS_PARTICIPANTS,
+    remoteVideoEnabled: false,
+    mediaConnected: true
+  });
+
+  var updatingSharingRoomStore = makeActiveRoomStore({
+    roomState: ROOM_STATES.HAS_PARTICIPANTS,
+    receivingScreenShare: true
+  });
+
+  var fullActiveRoomStore = makeActiveRoomStore({
+    roomState: ROOM_STATES.FULL
+  });
+
+  var failedRoomStore = makeActiveRoomStore({
+    roomState: ROOM_STATES.FAILED
+  });
+
+  var endedRoomStore = makeActiveRoomStore({
+    roomState: ROOM_STATES.ENDED,
+    roomUsed: true
+  });
+
   var roomStore = new loop.store.RoomStore(dispatcher, {
     mozLoop: navigator.mozLoop
   });
+
+  var desktopLocalFaceMuteActiveRoomStore = makeActiveRoomStore({
+    roomState: ROOM_STATES.HAS_PARTICIPANTS,
+    videoMuted: true
+  });
+  var desktopLocalFaceMuteRoomStore = new loop.store.RoomStore(dispatcher, {
+    mozLoop: navigator.mozLoop,
+    activeRoomStore: desktopLocalFaceMuteActiveRoomStore
+  });
+
+  var desktopRemoteFaceMuteActiveRoomStore = makeActiveRoomStore({
+    roomState: ROOM_STATES.HAS_PARTICIPANTS,
+    remoteVideoEnabled: false,
+    mediaConnected: true
+  });
+  var desktopRemoteFaceMuteRoomStore = new loop.store.RoomStore(dispatcher, {
+    mozLoop: navigator.mozLoop,
+    activeRoomStore: desktopRemoteFaceMuteActiveRoomStore
+  });
+
   var feedbackStore = new loop.store.FeedbackStore(dispatcher, {
     feedbackClient: stageFeedbackApiClient
   });
@@ -216,6 +352,37 @@
     }
   });
 
+  var FramedExample = React.createClass({
+    propTypes: {
+      width: React.PropTypes.number,
+      height: React.PropTypes.number,
+      onContentsRendered: React.PropTypes.func
+    },
+
+    makeId: function(prefix) {
+      return (prefix || "") + this.props.summary.toLowerCase().replace(/\s/g, "-");
+    },
+
+    render: function() {
+      var cx = React.addons.classSet;
+      return (
+        <div className="example">
+          <h3 id={this.makeId()}>
+            {this.props.summary}
+            <a href={this.makeId("#")}>&nbsp;¶</a>
+          </h3>
+          <div className={cx({comp: true, dashed: this.props.dashed})}
+               style={this.props.style}>
+            <Frame width={this.props.width} height={this.props.height}
+                   onContentsRendered={this.props.onContentsRendered}>
+              {this.props.children}
+            </Frame>
+          </div>
+        </div>
+      );
+    }
+  });
+
   var Example = React.createClass({
     makeId: function(prefix) {
       return (prefix || "") + this.props.summary.toLowerCase().replace(/\s/g, "-");
@@ -250,11 +417,42 @@
   });
 
   var ShowCase = React.createClass({
+    getInitialState: function() {
+      // We assume for now that rtl is the only query parameter.
+      //
+      // Note: this check is repeated in react-frame-component to save passing
+      // rtlMode down the props tree.
+      var rtlMode = document.location.search === "?rtl=1";
+
+      return {
+        rtlMode: rtlMode
+      };
+    },
+
+    _handleCheckboxChange: function(newState) {
+      var newLocation = "";
+      if (newState.checked) {
+        newLocation = document.location.href.split("#")[0];
+        newLocation += "?rtl=1";
+      } else {
+        newLocation = document.location.href.split("?")[0];
+      }
+      newLocation += document.location.hash;
+      document.location = newLocation;
+    },
+
     render: function() {
+      if (this.state.rtlMode) {
+        document.documentElement.setAttribute("lang", "ar");
+        document.documentElement.setAttribute("dir", "rtl");
+      }
+
       return (
         <div className="showcase">
           <header>
             <h1>Loop UI Components Showcase</h1>
+            <Checkbox label="RTL mode?" checked={this.state.rtlMode}
+              onChange={this._handleCheckboxChange} />
             <nav className="showcase-menu">{
               React.Children.map(this.props.children, function(section) {
                 return (
@@ -272,6 +470,7 @@
   });
 
   var App = React.createClass({
+
     render: function() {
       return (
         <ShowCase>
@@ -364,19 +563,19 @@
           <Section name="ConversationToolbar">
             <h2>Desktop Conversation Window</h2>
             <div className="fx-embedded override-position">
-              <Example summary="Default" dashed="true" style={{width: "300px", height: "272px"}}>
+              <Example summary="Default" style={{width: "300px", height: "26px"}}>
                 <ConversationToolbar video={{enabled: true}}
                                      audio={{enabled: true}}
                                      hangup={noop}
                                      publishStream={noop} />
               </Example>
-              <Example summary="Video muted" style={{width: "300px", height: "272px"}}>
+              <Example summary="Video muted" style={{width: "300px", height: "26px"}}>
                 <ConversationToolbar video={{enabled: false}}
                                      audio={{enabled: true}}
                                      hangup={noop}
                                      publishStream={noop} />
               </Example>
-              <Example summary="Audio muted" style={{width: "300px", height: "272px"}}>
+              <Example summary="Audio muted" style={{width: "300px", height: "26px"}}>
                 <ConversationToolbar video={{enabled: true}}
                                      audio={{enabled: false}}
                                      hangup={noop}
@@ -407,30 +606,6 @@
             </div>
           </Section>
 
-          <Section name="GumPromptConversationView">
-            <Example summary="Gum Prompt conversation view" dashed="true">
-              <div className="standalone">
-                <GumPromptConversationView />
-              </div>
-            </Example>
-          </Section>
-
-          <Section name="WaitingConversationView">
-            <Example summary="Waiting conversation view (connecting)" dashed="true">
-              <div className="standalone">
-                <WaitingConversationView websocket={mockWebSocket}
-                                         dispatcher={dispatcher} />
-              </div>
-            </Example>
-            <Example summary="Waiting conversation view (ringing)" dashed="true">
-              <div className="standalone">
-                <WaitingConversationView websocket={mockWebSocket}
-                                         dispatcher={dispatcher}
-                                         callState="ringing"/>
-              </div>
-            </Example>
-          </Section>
-
           <Section name="PendingConversationView (Desktop)">
             <Example summary="Connecting" dashed="true"
                      style={{width: "300px", height: "272px"}}>
@@ -469,94 +644,61 @@
             </Example>
           </Section>
 
-          <Section name="StartConversationView">
-            <Example summary="Start conversation view" dashed="true">
-              <div className="standalone">
-                <StartConversationView conversation={mockConversationModel}
-                                       client={mockClient}
-                                       notifications={notifications} />
-              </div>
-            </Example>
-          </Section>
-
-          <Section name="FailedConversationView">
-            <Example summary="Failed conversation view" dashed="true">
-              <div className="standalone">
-                <FailedConversationView conversation={mockConversationModel}
-                                        client={mockClient}
-                                        notifications={notifications} />
-              </div>
-            </Example>
-          </Section>
-
-          <Section name="ConversationView">
-            <Example summary="Desktop conversation window" dashed="true"
-                     style={{width: "300px", height: "272px"}}>
+          <Section name="OngoingConversationView">
+            <FramedExample width={298} height={254}
+                           summary="Desktop ongoing conversation window">
               <div className="fx-embedded">
-                <ConversationView sdk={mockSDK}
-                                  model={mockConversationModel}
-                                  video={{enabled: true}}
-                                  audio={{enabled: true}} />
+                <OngoingConversationView
+                  dispatcher={dispatcher}
+                  video={{enabled: true}}
+                  audio={{enabled: true}}
+                  localPosterUrl="sample-img/video-screen-local.png"
+                  remotePosterUrl="sample-img/video-screen-remote.png"
+                  remoteVideoEnabled={true}
+                  mediaConnected={true} />
               </div>
-            </Example>
+            </FramedExample>
 
-            <Example summary="Desktop conversation window large" dashed="true">
-              <div className="breakpoint" data-breakpoint-width="800px"
-                data-breakpoint-height="600px">
+            <FramedExample width={800} height={600}
+                           summary="Desktop ongoing conversation window large">
                 <div className="fx-embedded">
-                  <ConversationView sdk={mockSDK}
+                  <OngoingConversationView
+                    dispatcher={dispatcher}
                     video={{enabled: true}}
                     audio={{enabled: true}}
-                    model={mockConversationModel} />
+                    localPosterUrl="sample-img/video-screen-local.png"
+                    remotePosterUrl="sample-img/video-screen-remote.png"
+                    remoteVideoEnabled={true}
+                    mediaConnected={true} />
                 </div>
-              </div>
-            </Example>
+            </FramedExample>
 
-            <Example summary="Desktop conversation window local audio stream"
-                     dashed="true" style={{width: "300px", height: "272px"}}>
+            <FramedExample width={298} height={254}
+              summary="Desktop ongoing conversation window - local face mute">
               <div className="fx-embedded">
-                <ConversationView sdk={mockSDK}
-                                  video={{enabled: false}}
-                                  audio={{enabled: true}}
-                                  model={mockConversationModel} />
+                <OngoingConversationView
+                  dispatcher={dispatcher}
+                  video={{enabled: false}}
+                  audio={{enabled: true}}
+                  remoteVideoEnabled={true}
+                  remotePosterUrl="sample-img/video-screen-remote.png"
+                  mediaConnected={true} />
               </div>
-            </Example>
+            </FramedExample>
 
-            <Example summary="Standalone version">
-              <div className="standalone">
-                <ConversationView sdk={mockSDK}
-                                  video={{enabled: true}}
-                                  audio={{enabled: true}}
-                                  model={mockConversationModel} />
+            <FramedExample width={298} height={254}
+              summary="Desktop ongoing conversation window - remote face mute">
+              <div className="fx-embedded">
+                <OngoingConversationView
+                  dispatcher={dispatcher}
+                  video={{enabled: true}}
+                  audio={{enabled: true}}
+                  remoteVideoEnabled={false}
+                  localPosterUrl="sample-img/video-screen-local.png"
+                  mediaConnected={true} />
               </div>
-            </Example>
-          </Section>
+            </FramedExample>
 
-          <Section name="ConversationView-640">
-            <Example summary="640px breakpoint for conversation view">
-              <div className="breakpoint"
-                   style={{"text-align": "center"}}
-                   data-breakpoint-width="400px"
-                   data-breakpoint-height="780px">
-                <div className="standalone">
-                  <ConversationView sdk={mockSDK}
-                                    video={{enabled: true}}
-                                    audio={{enabled: true}}
-                                    model={mockConversationModel} />
-                </div>
-              </div>
-            </Example>
-          </Section>
-
-          <Section name="ConversationView-LocalAudio">
-            <Example summary="Local stream is audio only">
-              <div className="standalone">
-                <ConversationView sdk={mockSDK}
-                                  video={{enabled: false}}
-                                  audio={{enabled: true}}
-                                  model={mockConversationModel} />
-              </div>
-            </Example>
           </Section>
 
           <Section name="FeedbackView">
@@ -575,28 +717,6 @@
             </Example>
           </Section>
 
-          <Section name="CallUrlExpiredView">
-            <Example summary="Firefox User">
-              <CallUrlExpiredView isFirefox={true} />
-            </Example>
-            <Example summary="Non-Firefox User">
-              <CallUrlExpiredView isFirefox={false} />
-            </Example>
-          </Section>
-
-          <Section name="EndedConversationView">
-            <Example summary="Displays the feedback form">
-              <div className="standalone">
-                <EndedConversationView sdk={mockSDK}
-                                       video={{enabled: true}}
-                                       audio={{enabled: true}}
-                                       conversation={mockConversationModel}
-                                       feedbackStore={feedbackStore}
-                                       onAfterFeedbackReceived={noop} />
-              </div>
-            </Example>
-          </Section>
-
           <Section name="AlertMessages">
             <Example summary="Various alerts">
               <div className="alert alert-warning">
@@ -615,15 +735,6 @@
             </Example>
           </Section>
 
-          <Section name="HomeView">
-            <Example summary="Standalone Home View">
-              <div className="standalone">
-                <HomeView />
-              </div>
-            </Example>
-          </Section>
-
-
           <Section name="UnsupportedBrowserView">
             <Example summary="Standalone Unsupported Browser">
               <div className="standalone">
@@ -641,100 +752,174 @@
           </Section>
 
           <Section name="DesktopRoomConversationView">
-            <Example summary="Desktop room conversation (invitation)" dashed="true"
-                     style={{width: "260px", height: "265px"}}>
+            <FramedExample width={298} height={254}
+              summary="Desktop room conversation (invitation)">
               <div className="fx-embedded">
                 <DesktopRoomConversationView
                   roomStore={roomStore}
                   dispatcher={dispatcher}
                   mozLoop={navigator.mozLoop}
+                  localPosterUrl="sample-img/video-screen-local.png"
                   roomState={ROOM_STATES.INIT} />
               </div>
-            </Example>
+            </FramedExample>
 
-            <Example summary="Desktop room conversation" dashed="true"
-                     style={{width: "260px", height: "265px"}}>
+            <FramedExample width={298} height={254}
+              summary="Desktop room conversation">
               <div className="fx-embedded">
                 <DesktopRoomConversationView
                   roomStore={roomStore}
                   dispatcher={dispatcher}
                   mozLoop={navigator.mozLoop}
+                  localPosterUrl="sample-img/video-screen-local.png"
+                  remotePosterUrl="sample-img/video-screen-remote.png"
                   roomState={ROOM_STATES.HAS_PARTICIPANTS} />
               </div>
-            </Example>
+            </FramedExample>
+
+            <FramedExample width={298} height={254}
+                           summary="Desktop room conversation local face-mute">
+              <div className="fx-embedded">
+                <DesktopRoomConversationView
+                  roomStore={desktopLocalFaceMuteRoomStore}
+                  dispatcher={dispatcher}
+                  mozLoop={navigator.mozLoop}
+                  remotePosterUrl="sample-img/video-screen-remote.png" />
+              </div>
+            </FramedExample>
+
+            <FramedExample width={298} height={254}
+                           summary="Desktop room conversation remote face-mute">
+              <div className="fx-embedded">
+                <DesktopRoomConversationView
+                  roomStore={desktopRemoteFaceMuteRoomStore}
+                  dispatcher={dispatcher}
+                  mozLoop={navigator.mozLoop}
+                  localPosterUrl="sample-img/video-screen-local.png" />
+              </div>
+            </FramedExample>
           </Section>
 
           <Section name="StandaloneRoomView">
-            <Example summary="Standalone room conversation (ready)">
+            <FramedExample width={644} height={483}
+              summary="Standalone room conversation (ready)">
               <div className="standalone">
                 <StandaloneRoomView
                   dispatcher={dispatcher}
-                  activeRoomStore={activeRoomStore}
+                  activeRoomStore={readyRoomStore}
                   roomState={ROOM_STATES.READY}
                   isFirefox={true} />
               </div>
-            </Example>
+            </FramedExample>
 
-            <Example summary="Standalone room conversation (joined)">
+            <FramedExample width={644} height={483}
+              summary="Standalone room conversation (joined)"
+              onContentsRendered={joinedRoomStore.forcedUpdate}>
               <div className="standalone">
                 <StandaloneRoomView
                   dispatcher={dispatcher}
-                  activeRoomStore={activeRoomStore}
-                  roomState={ROOM_STATES.JOINED}
+                  activeRoomStore={joinedRoomStore}
+                  localPosterUrl="sample-img/video-screen-local.png"
                   isFirefox={true} />
               </div>
-            </Example>
+            </FramedExample>
 
-            <Example summary="Standalone room conversation (has-participants)">
+            <FramedExample width={644} height={483}
+                           onContentsRendered={updatingActiveRoomStore.forcedUpdate}
+                           summary="Standalone room conversation (has-participants, 644x483)">
+                <div className="standalone">
+                  <StandaloneRoomView
+                    dispatcher={dispatcher}
+                    activeRoomStore={updatingActiveRoomStore}
+                    roomState={ROOM_STATES.HAS_PARTICIPANTS}
+                    isFirefox={true}
+                    localPosterUrl="sample-img/video-screen-local.png"
+                    remotePosterUrl="sample-img/video-screen-remote.png" />
+                </div>
+            </FramedExample>
+
+            <FramedExample width={644} height={483}
+                           onContentsRendered={localFaceMuteRoomStore.forcedUpdate}
+                           summary="Standalone room conversation (local face mute, has-participants, 644x483)">
               <div className="standalone">
                 <StandaloneRoomView
                   dispatcher={dispatcher}
-                  activeRoomStore={activeRoomStore}
-                  roomState={ROOM_STATES.HAS_PARTICIPANTS}
+                  activeRoomStore={localFaceMuteRoomStore}
+                  isFirefox={true}
+                  localPosterUrl="sample-img/video-screen-local.png"
+                  remotePosterUrl="sample-img/video-screen-remote.png" />
+              </div>
+            </FramedExample>
+
+            <FramedExample width={644} height={483}
+                           onContentsRendered={remoteFaceMuteRoomStore.forcedUpdate}
+                           summary="Standalone room conversation (remote face mute, has-participants, 644x483)">
+              <div className="standalone">
+                <StandaloneRoomView
+                  dispatcher={dispatcher}
+                  activeRoomStore={remoteFaceMuteRoomStore}
+                  isFirefox={true}
+                  localPosterUrl="sample-img/video-screen-local.png"
+                  remotePosterUrl="sample-img/video-screen-remote.png" />
+              </div>
+            </FramedExample>
+
+            <FramedExample width={800} height={660}
+                           onContentsRendered={updatingSharingRoomStore.forcedUpdate}
+              summary="Standalone room convo (has-participants, receivingScreenShare, 800x660)">
+                <div className="standalone">
+                  <StandaloneRoomView
+                    dispatcher={dispatcher}
+                    activeRoomStore={updatingSharingRoomStore}
+                    roomState={ROOM_STATES.HAS_PARTICIPANTS}
+                    isFirefox={true}
+                    localPosterUrl="sample-img/video-screen-local.png"
+                    remotePosterUrl="sample-img/video-screen-remote.png"
+                    screenSharePosterUrl="sample-img/video-screen-terminal.png"
+                  />
+                </div>
+            </FramedExample>
+
+            <FramedExample width={644} height={483}
+                           summary="Standalone room conversation (full - FFx user)">
+              <div className="standalone">
+                <StandaloneRoomView
+                  dispatcher={dispatcher}
+                  activeRoomStore={fullActiveRoomStore}
                   isFirefox={true} />
               </div>
-            </Example>
+            </FramedExample>
 
-            <Example summary="Standalone room conversation (full - FFx user)">
+            <FramedExample width={644} height={483}
+              summary="Standalone room conversation (full - non FFx user)">
               <div className="standalone">
                 <StandaloneRoomView
                   dispatcher={dispatcher}
-                  activeRoomStore={activeRoomStore}
-                  roomState={ROOM_STATES.FULL}
-                  isFirefox={true} />
-              </div>
-            </Example>
-
-            <Example summary="Standalone room conversation (full - non FFx user)">
-              <div className="standalone">
-                <StandaloneRoomView
-                  dispatcher={dispatcher}
-                  activeRoomStore={activeRoomStore}
-                  roomState={ROOM_STATES.FULL}
+                  activeRoomStore={fullActiveRoomStore}
                   isFirefox={false} />
               </div>
-            </Example>
+            </FramedExample>
 
-            <Example summary="Standalone room conversation (feedback)">
+            <FramedExample width={644} height={483}
+              summary="Standalone room conversation (feedback)">
               <div className="standalone">
                 <StandaloneRoomView
                   dispatcher={dispatcher}
-                  activeRoomStore={activeRoomStore}
+                  activeRoomStore={endedRoomStore}
                   feedbackStore={feedbackStore}
-                  roomState={ROOM_STATES.ENDED}
                   isFirefox={false} />
               </div>
-            </Example>
+            </FramedExample>
 
-            <Example summary="Standalone room conversation (failed)">
+            <FramedExample width={644} height={483}
+                           summary="Standalone room conversation (failed)">
               <div className="standalone">
                 <StandaloneRoomView
                   dispatcher={dispatcher}
-                  activeRoomStore={activeRoomStore}
-                  roomState={ROOM_STATES.FAILED}
+                  activeRoomStore={failedRoomStore}
                   isFirefox={false} />
               </div>
-            </Example>
+            </FramedExample>
           </Section>
 
           <Section name="SVG icons preview" className="svg-icons">
@@ -754,45 +939,6 @@
     }
   });
 
-  /**
-   * Render components that have different styles across
-   * CSS media rules in their own iframe to mimic the viewport
-   * */
-  function _renderComponentsInIframes() {
-    var parents = document.querySelectorAll(".breakpoint");
-    [].forEach.call(parents, appendChildInIframe);
-
-    /**
-     * Extracts the component from the DOM and appends in the an iframe
-     *
-     * @type {HTMLElement} parent - Parent DOM node of a component & iframe
-     * */
-    function appendChildInIframe(parent) {
-      var styles     = document.querySelector("head").children;
-      var component  = parent.children[0];
-      var iframe     = document.createElement("iframe");
-      var width      = parent.dataset.breakpointWidth;
-      var height     = parent.dataset.breakpointHeight;
-
-      iframe.style.width  = width;
-      iframe.style.height = height;
-
-      parent.appendChild(iframe);
-      iframe.src    = "about:blank";
-      // Workaround for bug 297685
-      iframe.onload = function () {
-        var iframeHead = iframe.contentDocument.querySelector("head");
-        iframe.contentDocument.documentElement.querySelector("body")
-                                              .appendChild(component);
-
-        [].forEach.call(styles, function(style) {
-          iframeHead.appendChild(style.cloneNode(true));
-        });
-
-      };
-    }
-  }
-
   window.addEventListener("DOMContentLoaded", function() {
     try {
       React.renderComponent(<App />, document.getElementById("main"));
@@ -805,23 +951,28 @@
       uncaughtError = err;
     }
 
-    _renderComponentsInIframes();
+    // Wait until all the FramedExamples have been fully loaded.
+    setTimeout(function waitForQueuedFrames() {
+      if (window.queuedFrames.length != 0) {
+        setTimeout(waitForQueuedFrames, 500);
+        return;
+      }
+      // Put the title back, in case views changed it.
+      document.title = "Loop UI Components Showcase";
 
-    // Put the title back, in case views changed it.
-    document.title = "Loop UI Components Showcase";
-
-    // This simulates the mocha layout for errors which means we can run
-    // this alongside our other unit tests but use the same harness.
-    if (uncaughtError) {
-      $("#results").append("<div class='failures'><em>1</em></div>");
-      $("#results").append("<li class='test fail'>" +
-        "<h2>Errors rendering UI-Showcase</h2>" +
-        "<pre class='error'>" + uncaughtError + "\n" + uncaughtError.stack + "</pre>" +
-        "</li>");
-    } else {
-      $("#results").append("<div class='failures'><em>0</em></div>");
-    }
-    $("#results").append("<p id='complete'>Complete.</p>");
+      // This simulates the mocha layout for errors which means we can run
+      // this alongside our other unit tests but use the same harness.
+      if (uncaughtError) {
+        $("#results").append("<div class='failures'><em>1</em></div>");
+        $("#results").append("<li class='test fail'>" +
+          "<h2>Errors rendering UI-Showcase</h2>" +
+          "<pre class='error'>" + uncaughtError + "\n" + uncaughtError.stack + "</pre>" +
+          "</li>");
+      } else {
+        $("#results").append("<div class='failures'><em>0</em></div>");
+      }
+      $("#results").append("<p id='complete'>Complete.</p>");
+    }, 1000);
   });
 
 })();
diff --git a/browser/components/nsBrowserGlue.js b/browser/components/nsBrowserGlue.js
index 2a5d7b2fea7d..3dac8921055c 100644
--- a/browser/components/nsBrowserGlue.js
+++ b/browser/components/nsBrowserGlue.js
@@ -1113,7 +1113,10 @@ BrowserGlue.prototype = {
       }
       catch (ex) { /* Don't break the default prompt if telemetry is broken. */ }
 
-      Services.prefs.setBoolPref("browser.shell.isSetAsDefaultBrowser", isDefault);
+      if (isDefault) {
+        let now = Date.now().toString().slice(0, -3);
+        Services.prefs.setCharPref("browser.shell.mostRecentDateSetAsDefault", now);
+      }
 
       if (shouldCheck && !isDefault && !willRecoverSession) {
         Services.tm.mainThread.dispatch(function() {
diff --git a/browser/components/pocket/jar.mn b/browser/components/pocket/jar.mn
index f69d31ed65f6..e7fc957b862a 100644
--- a/browser/components/pocket/jar.mn
+++ b/browser/components/pocket/jar.mn
@@ -34,7 +34,6 @@ browser.jar:
   content/browser/pocket/panels/img/tag_close@2x.png               (panels/img/tag_close@2x.png)
   content/browser/pocket/panels/img/tag_closeactive@1x.png         (panels/img/tag_closeactive@1x.png)
   content/browser/pocket/panels/img/tag_closeactive@2x.png         (panels/img/tag_closeactive@2x.png)
-  content/browser/pocket/panels/js/dictionary.js                   (panels/js/dictionary.js)
   content/browser/pocket/panels/js/messages.js                     (panels/js/messages.js)
   content/browser/pocket/panels/js/saved.js                        (panels/js/saved.js)
   content/browser/pocket/panels/js/signup.js                       (panels/js/signup.js)
diff --git a/browser/components/pocket/main.js b/browser/components/pocket/main.js
index 66af96a78cf2..f20e96c41778 100644
--- a/browser/components/pocket/main.js
+++ b/browser/components/pocket/main.js
@@ -611,6 +611,19 @@ var pktUI = (function() {
 				}
 			})
 		});
+
+        var _initL10NMessageId = "initL10N";
+        pktUIMessaging.addMessageListener(_initL10NMessageId, function(panelId, data) {
+            var strings = {};
+            var bundle = Services.strings.createBundle("chrome://browser/locale/browser-pocket.properties");
+            var e = bundle.getSimpleEnumeration();
+            while(e.hasMoreElements()) {
+                var str = e.getNext().QueryInterface(Components.interfaces.nsIPropertyElement);
+                strings[str.key] = str.value;
+            }
+            pktUIMessaging.sendResponseMessageToPanel(panelId, _initL10NMessageId, { strings: strings });
+        });
+
 	}
 
 	// -- Browser Navigation -- //
diff --git a/browser/components/pocket/panels/js/dictionary.js b/browser/components/pocket/panels/js/dictionary.js
deleted file mode 100644
index 936a078253ff..000000000000
--- a/browser/components/pocket/panels/js/dictionary.js
+++ /dev/null
@@ -1,155 +0,0 @@
-Translations = {};
-Translations.en =
-{
-	addtags: "Add Tags",
-	alreadyhaveacct: "Already a Pocket user?",
-	continueff: "Continue with Firefox",
-	errorgeneric: "There was an error when trying to save to Pocket.",
-	learnmore: "Learn More",
-	loginnow: "Log in",
-	maxtaglength: "Tags are limited to 25 characters",
-	mustbeconnected: "You must be connected to the Internet in order to save to Pocket. Please check your connection and try again.",
-	onlylinkssaved: "Only links can be saved",
-	pagenotsaved: "Page Not Saved",
-	pageremoved: "Page Removed",
-	pagesaved: "Saved to Pocket",
-	processingremove: "Removing Page...",
-	processingtags: "Adding tags...",
-	removepage: "Remove Page",
-	save: "Save",
-	saving: "Saving...",
-	signupemail: "Sign up with email",
-	signuptosave: "Sign up for Pocket. It’s free.",
-	suggestedtags: "Suggested Tags",
-	tagline: "Save articles and videos from Firefox to view in Pocket on any device, any time.",
-	taglinestory_one: "Click the Pocket Button to save any article, video or page from Firefox.",
-	taglinestory_two: "View in Pocket on any device, any time.",
-	tagssaved: "Tags Added",
-	signinfirefox: "Sign in with Firefox",
-  signupfirefox: "Sign up with Firefox",
-	viewlist: "View List"
-};
-
-Translations.de =
-{
-  addtags: "Tags hinzufügen",
-  alreadyhaveacct: "Sind Sie bereits Pocket-Nutzer?",
-  continueff: "Mit Firefox fortfahren",
-  errorgeneric: "Beim Speichern des Links bei Pocket ist ein Fehler aufgetreten.",
-  learnmore: "Mehr erfahren",
-  loginnow: "Anmelden",
-  maxtaglength: "Tags dürfen höchsten 25 Zeichen lang sein.",
-  mustbeconnected: "Bitte überprüfen Sie, ob Sie mit dem Internet verbunden sind.",
-  onlylinkssaved: "Es können nur Links gespeichert werden",
-  pagenotsaved: "Seite nicht gespeichert",
-  pageremoved: "Seite entfernt",
-  pagesaved: "Bei Pocket gespeichert",
-  processingremove: "Seite wird entfernt…",
-  processingtags: "Tags werden hinzugefügt…",
-  removepage: "Seite entfernen",
-  save: "Speichern",
-  saving: "Speichern…",
-  signupemail: "Mit E-Mail registrieren",
-  signuptosave: "Registrieren Sie sich bei Pocket. Das ist kostenlos.",
-  suggestedtags: "Vorgeschlagene Tags",
-  tagline: "Speichern Sie Artikel und Videos aus Firefox bei Pocket, um sie jederzeit und auf jedem Gerät ansehen zu können.",
-  taglinestory_one: "Klicken Sie auf die Pocket-Schaltfläche, um beliebige Artikel, Videos und Seiten aus Firefox zu speichern.",
-  taglinestory_two: "Lesen Sie diese mit Pocket, jederzeit und auf jedem Gerät.",
-  tagssaved: "Tags hinzugefügt",
-  signinfirefox: "Mit Firefox anmelden",
-  signupfirefox: "Mit Firefox registrieren",
-  viewlist: "Liste anzeigen"
-};
-
-Translations.es =
-{
-  addtags: "Añadir etiquetas",
-  alreadyhaveacct: "¿Ya tiene cuenta Pocket?",
-  continueff: "Continuar con Firefox",
-  errorgeneric: "Se ha producido un error al guardar el enlace en Pocket.",
-  learnmore: "Saber más",
-  loginnow: "Iniciar sesión",
-  maxtaglength: "Las etiquetas están limitadas a 25 caracteres.",
-  mustbeconnected: "Compruebe que tiene conexión a Internet.",
-  onlylinkssaved: "Solo se pueden guardar enlaces",
-  pagenotsaved: "Página no guardada",
-  pageremoved: "Página eliminada",
-  pagesaved: "Guardada en Pocket",
-  processingremove: "Eliminando página…",
-  processingtags: "Añadiendo etiquetas…",
-  removepage: "Eliminar página",
-  save: "Guardar",
-  saving: "Guardando…",
-  signupemail: "Regístrese con su correo.",
-  signuptosave: "Regístrese en Pocket. Es gratis.",
-  suggestedtags: "Etiquetas sugeridas",
-  tagline: "Guarde artículos y vídeos desde Firefox en Pocket para verlos en cualquier dispositivo y en cualquier momento.",
-  taglinestory_one: "Pulse el botón Pocket para guardar cualquier artículo, vídeo o página desde Firefox.",
-  taglinestory_two: "Véalo en Pocket en cualquier dispositivo y en cualquier momento.",
-  tagssaved: "Etiquetas añadidas",
-  signinfirefox: "Inicie sesión con Firefox",
-  signupfirefox: "Regístrese con Firefox",
-  viewlist: "Ver lista"
-};
-
-Translations.ja =
-{
-  addtags: "タグを追加",
-  alreadyhaveacct: "アカウントをお持ちですか？",
-  continueff: "Firefox で続行",
-  errorgeneric: "Pocket にリンクを保存中に問題が発生しました。",
-  learnmore: "詳細",
-  loginnow: "ログイン",
-  maxtaglength: "タグは 25 文字までです。",
-  mustbeconnected: "インターネットに接続されていることを確認してください。",
-  onlylinkssaved: "リンクのみ保存できます",
-  pagenotsaved: "ページを保存できませんでした",
-  pageremoved: "ページを削除しました",
-  pagesaved: "Pocket に保存しました",
-  processingremove: "ページを削除中...",
-  processingtags: "タグを追加中...",
-  removepage: "ページを削除",
-  save: "保存",
-  saving: "保存中...",
-  signupemail: "メールでアカウント登録",
-  signuptosave: "Pocket にアカウント登録してください。無料です。",
-  suggestedtags: "タグ候補",
-  tagline: "Pocket でいつでもどこでも見られるよう、Firefox から記事や動画を保存できます。",
-  taglinestory_one: "Firefox から記事や動画やページを保存するには、Pocket ボタンをクリックしてください。",
-  taglinestory_two: "Pocket でいつでもどこでも見られます。",
-  tagssaved: "タグを追加しました",
-  signinfirefox: "Firefox でログイン",
-  signupfirefox: "Firefox でアカウント登録",
-  viewlist: "マイリストを表示"
-};
-
-Translations.ru =
-{
-  addtags: "Добавить теги",
-  alreadyhaveacct: "Уже используете Pocket?",
-  continueff: "Продолжить через Firefox",
-  errorgeneric: "Не удалось сохранить в Pocket.",
-  learnmore: "Узнайте больше",
-  loginnow: "Войдите",
-  maxtaglength: "Длина тега не должна превышать 25 символов.",
-  mustbeconnected: "Убедитесь, что вы подключены к Интернет.",
-  onlylinkssaved: "Можно сохранять только ссылки",
-  pagenotsaved: "Страница не сохранена",
-  pageremoved: "Страница удалена",
-  pagesaved: "Сохранено в Pocket",
-  processingremove: "Удаление страницы...",
-  processingtags: "Добавление тегов...",
-  removepage: "Удалить страницу",
-  save: "Сохранить",
-  saving: "Сохранение...",
-  signupemail: "Регистрация по эл. почте",
-  signuptosave: "Зарегистрируйтесь в Pocket. Это бесплатно.",
-  suggestedtags: "Рекомендуемые теги",
-  tagline: "Сохраняйте статьи и видео из Firefox для просмотра в Pocket на любом устройстве, в любой момент.",
-  taglinestory_one: "Щёлкните по кнопке Pocket, чтобы сохранить любую статью, видео или страницу из Firefox.",
-  taglinestory_two: "Просматривайте их в Pocket на любом устройстве, в любой момент.",
-  tagssaved: "Теги добавлены",
-  signinfirefox: "Войти через Firefox",
-  signupfirefox: "Регистрация через Firefox",
-  viewlist: "Просмотреть список"
-};
diff --git a/browser/components/pocket/panels/js/saved.js b/browser/components/pocket/panels/js/saved.js
index 596aaefa01e9..8079df160543 100644
--- a/browser/components/pocket/panels/js/saved.js
+++ b/browser/components/pocket/panels/js/saved.js
@@ -12,7 +12,6 @@ var PKT_SAVED_OVERLAY = function (options)
     this.savedItemId = 0;
     this.savedUrl = '';
     this.premiumStatus = false;
-    this.panelId = 0;
     this.preventCloseTimerCancel = false;
     this.closeValid = true;
     this.mouseInside = false;
@@ -461,89 +460,7 @@ var PKT_SAVED_OVERLAY = function (options)
     }
     this.getTranslations = function()
     {
-        var language = this.locale || '';
-        this.dictJSON = {};
-
-        var dictsuffix = 'en-US';
-
-        if (language.indexOf('en') == 0)
-        {
-            dictsuffix = 'en';
-        }
-        else if (language.indexOf('it') == 0)
-        {
-            dictsuffix = 'it';
-        }
-        else if (language.indexOf('fr-ca') == 0)
-        {
-            dictsuffix = 'fr';
-        }
-        else if (language.indexOf('fr') == 0)
-        {
-            dictsuffix = 'fr';
-        }
-        else if (language.indexOf('de') == 0)
-        {
-            dictsuffix = 'de';
-        }
-        else if (language.indexOf('es-es') == 0)
-        {
-            dictsuffix = 'es';
-        }
-        else if (language.indexOf('es-419') == 0)
-        {
-            dictsuffix = 'es_419';
-        }
-        else if (language.indexOf('es') == 0)
-        {
-            dictsuffix = 'es';
-        }
-        else if (language.indexOf('ja') == 0)
-        {
-            dictsuffix = 'ja';
-        }
-        else if (language.indexOf('nl') == 0)
-        {
-            dictsuffix = 'nl';
-        }
-        else if (language.indexOf('pt-pt') == 0)
-        {
-            dictsuffix = 'pt_PT';
-        }
-        else if (language.indexOf('pt') == 0)
-        {
-            dictsuffix = 'pt_BR';
-        }
-        else if (language.indexOf('ru') == 0)
-        {
-            dictsuffix = 'ru';
-        }
-        else if (language.indexOf('zh-tw') == 0)
-        {
-            dictsuffix = 'zh_TW';
-        }
-        else if (language.indexOf('zh') == 0)
-        {
-            dictsuffix = 'zh_CN';
-        }
-        else if (language.indexOf('ko') == 0)
-        {
-            dictsuffix = 'ko';
-        }
-        else if (language.indexOf('pl') == 0)
-        {
-            dictsuffix = 'pl';
-        }
-
-        this.dictJSON = Translations[dictsuffix];
-        if (typeof this.dictJSON !== 'object')
-        {
-            this.dictJSON = Translations['en'];
-        }
-        if (typeof this.dictJSON !== 'object')
-        {
-            this.dictJSON = {};
-        }
+        this.dictJSON = window.pocketStrings;
     };
 };
 
@@ -607,17 +524,18 @@ PKT_SAVED.prototype = {
         if (this.inited) {
             return;
         }
+        this.panelId = pktPanelMessaging.panelIdFromURL(window.location.href);
         this.overlay = new PKT_SAVED_OVERLAY();
 
         this.inited = true;
     },
 
     addMessageListener: function(messageId, callback) {
-    	pktPanelMessaging.addMessageListener(this.overlay.panelId, messageId, callback);
+    	pktPanelMessaging.addMessageListener(this.panelId, messageId, callback);
     },
 
     sendMessage: function(messageId, payload, callback) {
-    	pktPanelMessaging.sendMessage(this.overlay.panelId, messageId, payload, callback);
+    	pktPanelMessaging.sendMessage(this.panelId, messageId, payload, callback);
     },
 
     create: function() {
@@ -643,8 +561,6 @@ PKT_SAVED.prototype = {
             myself.overlay.locale = locale[1].toLowerCase();
         }
 
-        myself.overlay.panelId = pktPanelMessaging.panelIdFromURL(window.location.href);
-
         myself.overlay.create();
 
         // tell back end we're ready
@@ -686,6 +602,10 @@ $(function()
         thePKT_SAVED.init();
     }
 
-    window.thePKT_SAVED.create();
+    // send an async message to get string data
+    thePKT_SAVED.sendMessage("initL10N", {}, function(resp) {
+        window.pocketStrings = resp.strings;
+        window.thePKT_SAVED.create();
+    });
 });
 
diff --git a/browser/components/pocket/panels/js/signup.js b/browser/components/pocket/panels/js/signup.js
index cd7d5031b28c..ab5b0896bfff 100644
--- a/browser/components/pocket/panels/js/signup.js
+++ b/browser/components/pocket/panels/js/signup.js
@@ -20,7 +20,6 @@ var PKT_SIGNUP_OVERLAY = function (options)
     this.inoverflowmenu = false;
     this.pockethost = "getpocket.com";
     this.fxasignedin = false;
-    this.panelId = 0;
     this.dictJSON = {};
     this.initCloseTabEvents = function() {
         $('.btn,.pkt_ext_learnmore,.alreadyhave > a').click(function(e)
@@ -58,89 +57,7 @@ var PKT_SIGNUP_OVERLAY = function (options)
     };
     this.getTranslations = function()
     {
-        var language = this.locale || '';
-        this.dictJSON = {};
-
-        var dictsuffix = 'en-US';
-
-        if (language.indexOf('en') == 0)
-        {
-            dictsuffix = 'en';
-        }
-        else if (language.indexOf('it') == 0)
-        {
-            dictsuffix = 'it';
-        }
-        else if (language.indexOf('fr-ca') == 0)
-        {
-            dictsuffix = 'fr';
-        }
-        else if (language.indexOf('fr') == 0)
-        {
-            dictsuffix = 'fr';
-        }
-        else if (language.indexOf('de') == 0)
-        {
-            dictsuffix = 'de';
-        }
-        else if (language.indexOf('es-es') == 0)
-        {
-            dictsuffix = 'es';
-        }
-        else if (language.indexOf('es-419') == 0)
-        {
-            dictsuffix = 'es_419';
-        }
-        else if (language.indexOf('es') == 0)
-        {
-            dictsuffix = 'es';
-        }
-        else if (language.indexOf('ja') == 0)
-        {
-            dictsuffix = 'ja';
-        }
-        else if (language.indexOf('nl') == 0)
-        {
-            dictsuffix = 'nl';
-        }
-        else if (language.indexOf('pt-pt') == 0)
-        {
-            dictsuffix = 'pt_PT';
-        }
-        else if (language.indexOf('pt') == 0)
-        {
-            dictsuffix = 'pt_BR';
-        }
-        else if (language.indexOf('ru') == 0)
-        {
-            dictsuffix = 'ru';
-        }
-        else if (language.indexOf('zh-tw') == 0)
-        {
-            dictsuffix = 'zh_TW';
-        }
-        else if (language.indexOf('zh') == 0)
-        {
-            dictsuffix = 'zh_CN';
-        }
-        else if (language.indexOf('ko') == 0)
-        {
-            dictsuffix = 'ko';
-        }
-        else if (language.indexOf('pl') == 0)
-        {
-            dictsuffix = 'pl';
-        }
-
-        this.dictJSON = Translations[dictsuffix];
-        if (typeof this.dictJSON !== 'object')
-        {
-            this.dictJSON = Translations['en'];
-        }
-        if (typeof this.dictJSON !== 'object')
-        {
-            this.dictJSON = {};
-        }
+        this.dictJSON = window.pocketStrings;
     };
 };
 
@@ -175,8 +92,6 @@ PKT_SIGNUP_OVERLAY.prototype = {
            this.locale = locale[1].toLowerCase();
         }
 
-        this.panelId = pktPanelMessaging.panelIdFromURL(window.location.href);
-
         if (this.active)
         {
             return;
@@ -231,17 +146,18 @@ PKT_SIGNUP.prototype = {
         if (this.inited) {
             return;
         }
+        this.panelId = pktPanelMessaging.panelIdFromURL(window.location.href);
         this.overlay = new PKT_SIGNUP_OVERLAY();
 
         this.inited = true;
     },
 
     addMessageListener: function(messageId, callback) {
-        pktPanelMessaging.addMessageListener(this.overlay.panelId, messageId, callback);
+        pktPanelMessaging.addMessageListener(this.panelId, messageId, callback);
     },
 
     sendMessage: function(messageId, payload, callback) {
-        pktPanelMessaging.sendMessage(this.overlay.panelId, messageId, payload, callback);
+        pktPanelMessaging.sendMessage(this.panelId, messageId, payload, callback);
     },
 
     create: function() {
@@ -260,6 +176,10 @@ $(function()
         thePKT_SIGNUP.init();
     }
 
-    window.thePKT_SIGNUP.create();
+    // send an async message to get string data
+    thePKT_SIGNUP.sendMessage("initL10N", {}, function(resp) {
+        window.pocketStrings = resp.strings;
+        window.thePKT_SIGNUP.create();
+    });
 });
 
diff --git a/browser/components/pocket/panels/saved.html b/browser/components/pocket/panels/saved.html
index bd4d863eb6f1..59f0e3d711d8 100644
--- a/browser/components/pocket/panels/saved.html
+++ b/browser/components/pocket/panels/saved.html
@@ -10,9 +10,8 @@
         <script type="text/javascript" src="js/vendor/jquery-2.1.1.min.js"></script>
         <script type="text/javascript" src="js/vendor/handlebars.runtime.js"></script>
         <script type="text/javascript" src="js/vendor/jquery.tokeninput.min.js"></script>
-        <script type="text/javascript" src="js/dictionary.js"></script>
         <script type="text/javascript" src="js/tmpl.js"></script>
         <script type="text/javascript" src="js/messages.js"></script>
         <script type="text/javascript" src="js/saved.js"></script>
     </body>
-</html>
\ No newline at end of file
+</html>
diff --git a/browser/components/pocket/panels/signup.html b/browser/components/pocket/panels/signup.html
index 18b7db5c4f4e..4c54bd6f4af4 100644
--- a/browser/components/pocket/panels/signup.html
+++ b/browser/components/pocket/panels/signup.html
@@ -9,9 +9,8 @@
     <body class="pkt_ext_containersignup" aria-live="polite">
         <script type="text/javascript" src="js/vendor/jquery-2.1.1.min.js"></script>
         <script type="text/javascript" src="js/vendor/handlebars.runtime.js"></script>
-        <script type="text/javascript" src="js/dictionary.js"></script>
         <script type="text/javascript" src="js/tmpl.js"></script>
         <script type="text/javascript" src="js/messages.js"></script>
         <script type="text/javascript" src="js/signup.js"></script>
     </body>
-</html>
\ No newline at end of file
+</html>
diff --git a/browser/components/sessionstore/SessionStore.jsm b/browser/components/sessionstore/SessionStore.jsm
index f73d5cf5e96e..4d6a4a9a4972 100644
--- a/browser/components/sessionstore/SessionStore.jsm
+++ b/browser/components/sessionstore/SessionStore.jsm
@@ -214,16 +214,6 @@ this.SessionStore = {
     SessionStoreInternal.setTabState(aTab, aState);
   },
 
-  // This should not be used by external code, the intention is to remove it
-  // once a better fix is in place for process switching in e10s.
-  // See bug 1075658 for context.
-  _restoreTabAndLoad: function ss_restoreTabAndLoad(aTab, aState, aLoadArguments) {
-    SessionStoreInternal.setTabState(aTab, aState, {
-      restoreImmediately: true,
-      loadArguments: aLoadArguments
-    });
-  },
-
   duplicateTab: function ss_duplicateTab(aWindow, aTab, aDelta = 0) {
     return SessionStoreInternal.duplicateTab(aWindow, aTab, aDelta);
   },
@@ -310,6 +300,10 @@ this.SessionStore = {
 
   reviveCrashedTab(aTab) {
     return SessionStoreInternal.reviveCrashedTab(aTab);
+  },
+
+  navigateAndRestore(tab, loadArguments, historyIndex) {
+    return SessionStoreInternal.navigateAndRestore(tab, loadArguments, historyIndex);
   }
 };
 
@@ -630,12 +624,6 @@ let SessionStoreInternal = {
         TabState.setSyncHandler(browser, aMessage.objects.handler);
         break;
       case "SessionStore:update":
-        // Ignore messages from <browser> elements that have crashed
-        // and not yet been revived.
-        if (this._crashedBrowsers.has(browser.permanentKey)) {
-          return;
-        }
-
         // |browser.frameLoader| might be empty if the browser was already
         // destroyed and its tab removed. In that case we still have the last
         // frameLoader we know about to compare.
@@ -647,12 +635,6 @@ let SessionStoreInternal = {
           return;
         }
 
-        // Record telemetry measurements done in the child and update the tab's
-        // cached state. Mark the window as dirty and trigger a delayed write.
-        this.recordTelemetry(aMessage.data.telemetry);
-        TabState.update(browser, aMessage.data);
-        this.saveStateDelayed(win);
-
         if (aMessage.data.isFinal) {
           // If this the final message we need to resolve all pending flush
           // requests for the given browser as they might have been sent too
@@ -666,6 +648,18 @@ let SessionStoreInternal = {
           TabStateFlusher.resolve(browser, aMessage.data.flushID);
         }
 
+        // Ignore messages from <browser> elements that have crashed
+        // and not yet been revived.
+        if (this._crashedBrowsers.has(browser.permanentKey)) {
+          return;
+        }
+
+        // Record telemetry measurements done in the child and update the tab's
+        // cached state. Mark the window as dirty and trigger a delayed write.
+        this.recordTelemetry(aMessage.data.telemetry);
+        TabState.update(browser, aMessage.data);
+        this.saveStateDelayed(win);
+
         // Handle any updates sent by the child after the tab was closed. This
         // might be the final update as sent by the "unload" handler but also
         // any async update message that was sent before the child unloaded.
@@ -826,6 +820,7 @@ let SessionStoreInternal = {
       case "XULFrameLoaderCreated":
         if (target.tagName == "browser" && target.frameLoader && target.permanentKey) {
           this._lastKnownFrameLoader.set(target.permanentKey, target.frameLoader);
+          this.resetEpoch(target);
         }
         break;
       default:
@@ -1275,13 +1270,11 @@ let SessionStoreInternal = {
     LastSession.clear();
     let openWindows = {};
     this._forEachBrowserWindow(function(aWindow) {
-      let tabs = aWindow.gBrowser.tabs;
-      // Remove pending or restoring tabs instead of just emptying them.
-      for (let i = tabs.length - 1; i >= 0 && tabs.length > 1; i--) {
-        if (tabs[i].linkedBrowser.__SS_restoreState) {
-          aWindow.gBrowser.removeTab(tabs[i], {animate: false});
-        }
-      }
+      Array.forEach(aWindow.gBrowser.tabs, function(aTab) {
+        delete aTab.linkedBrowser.__SS_data;
+        if (aTab.linkedBrowser.__SS_restoreState)
+          this._resetTabRestoringState(aTab);
+      }, this);
       openWindows[aWindow.__SSi] = true;
     });
     // also clear all data about closed tabs and windows
@@ -1292,9 +1285,6 @@ let SessionStoreInternal = {
         delete this._windows[ix];
       }
     }
-    // Remove all pointers so that pending/restoring tabs that were closed
-    // above do not end up in _closedTabs[] again.
-    this._closedTabs.clear();
     // also clear all data about closed windows
     this._closedWindows = [];
     // give the tabbrowsers a chance to clear their histories first
@@ -1762,7 +1752,7 @@ let SessionStoreInternal = {
     return JSON.stringify(tabState);
   },
 
-  setTabState: function ssi_setTabState(aTab, aState, aOptions) {
+  setTabState(aTab, aState) {
     // Remove the tab state from the cache.
     // Note that we cannot simply replace the contents of the cache
     // as |aState| can be an incomplete state that will be completed
@@ -1787,7 +1777,7 @@ let SessionStoreInternal = {
       this._resetTabRestoringState(aTab);
     }
 
-    this.restoreTab(aTab, tabState, aOptions);
+    this.restoreTab(aTab, tabState);
   },
 
   duplicateTab: function ssi_duplicateTab(aWindow, aTab, aDelta = 0) {
@@ -1819,6 +1809,13 @@ let SessionStoreInternal = {
         return;
       }
 
+      let window = newTab.ownerDocument && newTab.ownerDocument.defaultView;
+
+      // The tab or its window might be gone.
+      if (!window || !window.__SSi) {
+        return;
+      }
+
       // Update state with flushed data. We can't use TabState.clone() here as
       // the tab to duplicate may have already been closed. In that case we
       // only have access to the <xul:browser>.
@@ -2167,6 +2164,57 @@ let SessionStoreInternal = {
     this.restoreTab(aTab, data);
   },
 
+  /**
+   * Navigate the given |tab| by first collecting its current state and then
+   * either changing only the index of the currently shown shistory entry,
+   * or restoring the exact same state again and passing the new URL to load
+   * in |loadArguments|. Use this method to seamlessly switch between pages
+   * loaded in the parent and pages loaded in the child process.
+   */
+  navigateAndRestore(tab, loadArguments, historyIndex) {
+    let window = tab.ownerDocument.defaultView;
+    let browser = tab.linkedBrowser;
+
+    // Set tab title to "Connecting..." and start the throbber to pretend we're
+    // doing something while actually waiting for data from the frame script.
+    window.gBrowser.setTabTitleLoading(tab);
+    tab.setAttribute("busy", "true");
+
+    // Flush to get the latest tab state.
+    TabStateFlusher.flush(browser).then(() => {
+      // The tab might have been closed/gone in the meantime.
+      if (tab.closing || !tab.linkedBrowser) {
+        return;
+      }
+
+      let window = tab.ownerDocument && tab.ownerDocument.defaultView;
+
+      // The tab or its window might be gone.
+      if (!window || !window.__SSi) {
+        return;
+      }
+
+      let tabState = TabState.clone(tab);
+      let options = {restoreImmediately: true};
+
+      if (historyIndex >= 0) {
+        tabState.index = historyIndex + 1;
+        tabState.index = Math.max(1, Math.min(tabState.index, tabState.entries.length));
+      } else {
+        tabState.userTypedValue = null;
+        options.loadArguments = loadArguments;
+      }
+
+      // Need to reset restoring tabs.
+      if (tab.linkedBrowser.__SS_restoreState) {
+        this._resetLocalTabRestoringState(tab);
+      }
+
+      // Restore the state into the tab.
+      this.restoreTab(tab, tabState, options);
+    });
+  },
+
   /**
    * See if aWindow is usable for use when restoring a previous session via
    * restoreLastSession. If usable, prepare it for use.
@@ -3676,6 +3724,14 @@ let SessionStoreInternal = {
     return this.getCurrentEpoch(browser) == epoch;
   },
 
+  /**
+   * Resets the epoch for a given <browser>. We need to this every time we
+   * receive a hint that a new docShell has been loaded into the browser as
+   * the frame script starts out with epoch=0.
+   */
+  resetEpoch(browser) {
+    this._browserEpochs.delete(browser.permanentKey);
+  }
 };
 
 /**
diff --git a/browser/components/sessionstore/TabState.jsm b/browser/components/sessionstore/TabState.jsm
index 7042c6010dba..f921af0f5583 100644
--- a/browser/components/sessionstore/TabState.jsm
+++ b/browser/components/sessionstore/TabState.jsm
@@ -35,10 +35,6 @@ this.TabState = Object.freeze({
     TabStateInternal.update(browser, data);
   },
 
-  flush: function (browser) {
-    TabStateInternal.flush(browser);
-  },
-
   flushAsync: function (browser) {
     TabStateInternal.flushAsync(browser);
   },
@@ -91,16 +87,6 @@ let TabStateInternal = {
     }
   },
 
-  /**
-   * Flushes all data currently queued in the given browser's content script.
-   */
-  flush: function (browser) {
-    if (this._syncHandlers.has(browser.permanentKey)) {
-      let lastID = this._latestMessageID.get(browser.permanentKey);
-      this._syncHandlers.get(browser.permanentKey).flush(lastID);
-    }
-  },
-
   /**
    * DO NOT USE - DEBUGGING / TESTING ONLY
    *
@@ -118,7 +104,10 @@ let TabStateInternal = {
    */
   flushWindow: function (window) {
     for (let browser of window.gBrowser.browsers) {
-      this.flush(browser);
+      if (this._syncHandlers.has(browser.permanentKey)) {
+        let lastID = this._latestMessageID.get(browser.permanentKey);
+        this._syncHandlers.get(browser.permanentKey).flush(lastID);
+      }
     }
   },
 
diff --git a/browser/components/sessionstore/test/browser_async_remove_tab.js b/browser/components/sessionstore/test/browser_async_remove_tab.js
index 1628dd02f4d0..20f3463d0406 100644
--- a/browser/components/sessionstore/test/browser_async_remove_tab.js
+++ b/browser/components/sessionstore/test/browser_async_remove_tab.js
@@ -162,7 +162,7 @@ add_task(function* save_worthy_tabs_nonremote_final() {
   ok(browser.isRemoteBrowser, "browser is remote");
 
   // Replace about:blank with a non-remote entry.
-  browser.loadURI("about:robots");
+  yield BrowserTestUtils.loadURI(browser, "about:robots");
   ok(!browser.isRemoteBrowser, "browser is not remote anymore");
 
   // Wait until the new entry replaces about:blank.
diff --git a/browser/components/sessionstore/test/browser_sessionHistory.js b/browser/components/sessionstore/test/browser_sessionHistory.js
index 952408389817..6e5a89878d38 100644
--- a/browser/components/sessionstore/test/browser_sessionHistory.js
+++ b/browser/components/sessionstore/test/browser_sessionHistory.js
@@ -12,8 +12,10 @@ add_task(function test_load_start() {
   let browser = tab.linkedBrowser;
   yield promiseBrowserLoaded(browser);
 
-  // Load a new URI but remove the tab before it has finished loading.
-  browser.loadURI("about:mozilla");
+  // Load a new URI.
+  yield BrowserTestUtils.loadURI(browser, "about:mozilla");
+
+  // Remove the tab before it has finished loading.
   yield promiseContentMessage(browser, "ss-test:OnHistoryReplaceEntry");
   yield promiseRemoveTab(tab);
 
diff --git a/browser/components/sessionstore/test/head.js b/browser/components/sessionstore/test/head.js
index 7182e591f99e..326cf92a70bf 100644
--- a/browser/components/sessionstore/test/head.js
+++ b/browser/components/sessionstore/test/head.js
@@ -282,14 +282,7 @@ let promiseForEachSessionRestoreFile = Task.async(function*(cb) {
 });
 
 function promiseBrowserLoaded(aBrowser, ignoreSubFrames = true) {
-  return new Promise(resolve => {
-    aBrowser.messageManager.addMessageListener("ss-test:loadEvent", function onLoad(msg) {
-      if (!ignoreSubFrames || !msg.data.subframe) {
-        aBrowser.messageManager.removeMessageListener("ss-test:loadEvent", onLoad);
-        resolve();
-      }
-    });
-  });
+  return BrowserTestUtils.browserLoaded(aBrowser, !ignoreSubFrames);
 }
 
 function whenWindowLoaded(aWindow, aCallback = next) {
@@ -435,8 +428,21 @@ function whenNewWindowLoaded(aOptions, aCallback) {
   }
 
   let win = openDialog(getBrowserURL(), "", "chrome,all,dialog=no" + features, url);
-  whenDelayedStartupFinished(win, () => aCallback(win));
-  return win;
+  let delayedStartup = promiseDelayedStartupFinished(win);
+
+  let browserLoaded = new Promise(resolve => {
+    if (url == "about:blank") {
+      resolve();
+      return;
+    }
+
+    win.addEventListener("load", function onLoad() {
+      win.removeEventListener("load", onLoad);
+      resolve(promiseBrowserLoaded(win.gBrowser.selectedBrowser));
+    });
+  });
+
+  Promise.all([delayedStartup, browserLoaded]).then(() => aCallback(win));
 }
 function promiseNewWindowLoaded(aOptions) {
   return new Promise(resolve => whenNewWindowLoaded(aOptions, resolve));
diff --git a/browser/components/uitour/UITour.jsm b/browser/components/uitour/UITour.jsm
index 5738df2c14a2..6083d54e46cc 100644
--- a/browser/components/uitour/UITour.jsm
+++ b/browser/components/uitour/UITour.jsm
@@ -70,8 +70,7 @@ const TARGET_SEARCHENGINE_PREFIX = "searchEngine-";
 XPCOMUtils.defineLazyGetter(this, "log", () => {
   let ConsoleAPI = Cu.import("resource://gre/modules/devtools/Console.jsm", {}).ConsoleAPI;
   let consoleOptions = {
-    // toLowerCase is because the loglevel values use title case to be compatible with Log.jsm.
-    maxLogLevel: Services.prefs.getCharPref(PREF_LOG_LEVEL).toLowerCase(),
+    maxLogLevelPref: PREF_LOG_LEVEL,
     prefix: "UITour",
   };
   return new ConsoleAPI(consoleOptions);
diff --git a/browser/devtools/canvasdebugger/canvasdebugger.js b/browser/devtools/canvasdebugger/canvasdebugger.js
index 7518b6d3bb01..22c9b1b686ed 100644
--- a/browser/devtools/canvasdebugger/canvasdebugger.js
+++ b/browser/devtools/canvasdebugger/canvasdebugger.js
@@ -39,6 +39,10 @@ XPCOMUtils.defineLazyModuleGetter(this, "NetUtil",
 XPCOMUtils.defineLazyModuleGetter(this, "DevToolsUtils",
   "resource://gre/modules/devtools/DevToolsUtils.jsm");
 
+XPCOMUtils.defineLazyGetter(this, "NetworkHelper", function() {
+  return require("devtools/toolkit/webconsole/network-helper");
+});
+
 // The panel's window global is an EventEmitter firing the following events:
 const EVENTS = {
   // When the UI is reset from tab navigation.
@@ -193,27 +197,12 @@ EventEmitter.decorate(this);
 let $ = (selector, target = document) => target.querySelector(selector);
 let $all = (selector, target = document) => target.querySelectorAll(selector);
 
-/**
- * Helper for getting an nsIURL instance out of a string.
- */
-function nsIURL(url, store = nsIURL.store) {
-  if (store.has(url)) {
-    return store.get(url);
-  }
-  let uri = Services.io.newURI(url, null, null).QueryInterface(Ci.nsIURL);
-  store.set(url, uri);
-  return uri;
-}
-
-// The cache used in the `nsIURL` function.
-nsIURL.store = new Map();
-
 /**
  * Gets the fileName part of a string which happens to be an URL.
  */
 function getFileName(url) {
   try {
-    let { fileName } = nsIURL(url);
+    let { fileName } = NetworkHelper.nsIURL(url);
     return fileName || "/";
   } catch (e) {
     // This doesn't look like a url, or nsIURL can't handle it.
diff --git a/browser/devtools/definitions.js b/browser/devtools/definitions.js
index e3102ba496b6..bc0ccd6f7851 100644
--- a/browser/devtools/definitions.js
+++ b/browser/devtools/definitions.js
@@ -88,7 +88,10 @@ Tools.inspector = {
   url: "chrome://browser/content/devtools/inspector/inspector.xul",
   label: l10n("inspector.label", inspectorStrings),
   panelLabel: l10n("inspector.panelLabel", inspectorStrings),
-  tooltip: l10n("inspector.tooltip", inspectorStrings),
+  get tooltip() {
+    return l10n("inspector.tooltip2", inspectorStrings,
+    ( osString == "Darwin" ? "Cmd+Alt" : "Ctrl+Shift+" ) + this.key);
+  },
   inMenu: true,
   commands: [
     "devtools/resize-commands",
@@ -122,7 +125,10 @@ Tools.webConsole = {
   label: l10n("ToolboxTabWebconsole.label", webConsoleStrings),
   menuLabel: l10n("MenuWebconsole.label", webConsoleStrings),
   panelLabel: l10n("ToolboxWebConsole.panelLabel", webConsoleStrings),
-  tooltip: l10n("ToolboxWebconsole.tooltip", webConsoleStrings),
+  get tooltip() {
+    return l10n("ToolboxWebconsole.tooltip2", webConsoleStrings,
+    ( osString == "Darwin" ? "Cmd+Alt" : "Ctrl+Shift+" ) + this.key);
+  },
   inMenu: true,
   commands: "devtools/webconsole/console-commands",
 
@@ -155,7 +161,10 @@ Tools.jsdebugger = {
   url: "chrome://browser/content/devtools/debugger.xul",
   label: l10n("ToolboxDebugger.label", debuggerStrings),
   panelLabel: l10n("ToolboxDebugger.panelLabel", debuggerStrings),
-  tooltip: l10n("ToolboxDebugger.tooltip", debuggerStrings),
+  get tooltip() {
+    return l10n("ToolboxDebugger.tooltip2", debuggerStrings,
+    ( osString == "Darwin" ? "Cmd+Alt" : "Ctrl+Shift+" ) + this.key);
+  },
   inMenu: true,
   commands: "devtools/debugger/debugger-commands",
 
@@ -179,7 +188,10 @@ Tools.styleEditor = {
   url: "chrome://browser/content/devtools/styleeditor.xul",
   label: l10n("ToolboxStyleEditor.label", styleEditorStrings),
   panelLabel: l10n("ToolboxStyleEditor.panelLabel", styleEditorStrings),
-  tooltip: l10n("ToolboxStyleEditor.tooltip2", styleEditorStrings),
+  get tooltip() {
+    return l10n("ToolboxStyleEditor.tooltip3", styleEditorStrings,
+    "Shift+" + functionkey(this.key));
+  },
   inMenu: true,
   commands: "devtools/styleeditor/styleeditor-commands",
 
@@ -244,7 +256,10 @@ Tools.performance = {
   visibilityswitch: "devtools.performance.enabled",
   label: l10n("profiler.label2", profilerStrings),
   panelLabel: l10n("profiler.panelLabel2", profilerStrings),
-  tooltip: l10n("profiler.tooltip2", profilerStrings),
+  get tooltip() {
+    return l10n("profiler.tooltip3", profilerStrings,
+    "Shift+" + functionkey(this.key));
+  },
   accesskey: l10n("profiler.accesskey", profilerStrings),
   key: l10n("profiler.commandkey2", profilerStrings),
   modifiers: "shift",
@@ -271,7 +286,10 @@ Tools.netMonitor = {
   url: "chrome://browser/content/devtools/netmonitor.xul",
   label: l10n("netmonitor.label", netMonitorStrings),
   panelLabel: l10n("netmonitor.panelLabel", netMonitorStrings),
-  tooltip: l10n("netmonitor.tooltip", netMonitorStrings),
+  get tooltip() {
+    return l10n("netmonitor.tooltip2", netMonitorStrings,
+    ( osString == "Darwin" ? "Cmd+Alt" : "Ctrl+Shift+" ) + this.key);
+  },
   inMenu: true,
 
   isTargetSupported: function(target) {
@@ -296,7 +314,10 @@ Tools.storage = {
   label: l10n("storage.label", storageStrings),
   menuLabel: l10n("storage.menuLabel", storageStrings),
   panelLabel: l10n("storage.panelLabel", storageStrings),
-  tooltip: l10n("storage.tooltip2", storageStrings),
+  get tooltip() {
+    return l10n("storage.tooltip3", storageStrings,
+    "Shift+" + functionkey(this.key));
+  },
   inMenu: true,
 
   isTargetSupported: function(target) {
@@ -399,12 +420,18 @@ exports.defaultThemes = [
  *        The key to lookup.
  * @returns A localized version of the given key.
  */
-function l10n(name, bundle)
+function l10n(name, bundle, arg)
 {
   try {
-    return bundle.GetStringFromName(name);
+    return arg ? bundle.formatStringFromName(name, [arg], 1)
+    : bundle.GetStringFromName(name);
   } catch (ex) {
     Services.console.logStringMessage("Error reading '" + name + "'");
     throw new Error("l10n error with " + name);
   }
 }
+
+function functionkey(shortkey)
+{
+  return shortkey.split("_")[1];
+}
diff --git a/browser/devtools/framework/toolbox.js b/browser/devtools/framework/toolbox.js
index 4e6c0e1ed29b..2f8403573f83 100644
--- a/browser/devtools/framework/toolbox.js
+++ b/browser/devtools/framework/toolbox.js
@@ -55,7 +55,7 @@ loader.lazyGetter(this, "toolboxStrings", () => {
 loader.lazyGetter(this, "Selection", () => require("devtools/framework/selection").Selection);
 loader.lazyGetter(this, "InspectorFront", () => require("devtools/server/actors/inspector").InspectorFront);
 loader.lazyRequireGetter(this, "DevToolsUtils", "devtools/toolkit/DevToolsUtils");
-loader.lazyRequireGetter(this, "getPerformanceActorsConnection", "devtools/performance/front", true);
+loader.lazyRequireGetter(this, "getPerformanceFront", "devtools/performance/front", true);
 
 XPCOMUtils.defineLazyGetter(this, "screenManager", () => {
   return Cc["@mozilla.org/gfx/screenmanager;1"].getService(Ci.nsIScreenManager);
@@ -287,6 +287,14 @@ Toolbox.prototype = {
     return this._highlighter;
   },
 
+  /**
+   * Get the toolbox's performance front. Note that it may not always have been
+   * initialized first. Use `initPerformance()` if needed.
+   */
+  get performance() {
+    return this._performance;
+  },
+
   /**
    * Get the toolbox's inspector front. Note that it may not always have been
    * initialized first. Use `initInspector()` if needed.
@@ -398,9 +406,8 @@ Toolbox.prototype = {
       ]);
 
       // Lazily connect to the profiler here and don't wait for it to complete,
-      // used to intercept console.profile calls before the performance tools
-      // are open.
-      let profilerReady = this._connectProfiler();
+      // used to intercept console.profile calls before the performance tools are open.
+      let profilerReady = this.initPerformance();
 
       // However, while testing, we must wait for the performance connection to
       // finish, as most tests shut down without waiting for a toolbox
@@ -1889,7 +1896,7 @@ Toolbox.prototype = {
     }));
 
     // Destroy the profiler connection
-    outstanding.push(this._disconnectProfiler());
+    outstanding.push(this.destroyPerformance());
 
     // We need to grab a reference to win before this._host is destroyed.
     let win = this.frame.ownerGlobal;
@@ -1982,27 +1989,28 @@ Toolbox.prototype = {
      "cmd_copy", "cmd_paste", "cmd_selectAll"].forEach(window.goUpdateCommand);
   },
 
-  getPerformanceActorsConnection: function() {
-    if (!this._performanceConnection) {
-      this._performanceConnection = getPerformanceActorsConnection(this.target);
-    }
-    return this._performanceConnection;
-  },
-
   /**
    * Connects to the SPS profiler when the developer tools are open. This is
    * necessary because of the WebConsole's `profile` and `profileEnd` methods.
    */
-  _connectProfiler: Task.async(function*() {
+  initPerformance: Task.async(function*() {
     // If target does not have profiler actor (addons), do not
     // even register the shared performance connection.
     if (!this.target.hasActor("profiler")) {
       return;
     }
 
-    yield this.getPerformanceActorsConnection().open();
+    if (this.performance) {
+      yield this.performance.open();
+      return this.performance;
+    }
+
+    this._performance = getPerformanceFront(this.target);
+    yield this.performance.open();
     // Emit an event when connected, but don't wait on startup for this.
     this.emit("profiler-connected");
+
+    return this.performance;
   }),
 
   /**
@@ -2010,12 +2018,12 @@ Toolbox.prototype = {
    * has not finished initializing, as opening a toolbox does not wait,
    * the performance connection destroy method will wait for it on its own.
    */
-  _disconnectProfiler: Task.async(function*() {
-    if (!this._performanceConnection) {
+  destroyPerformance: Task.async(function*() {
+    if (!this.performance) {
       return;
     }
-    yield this._performanceConnection.destroy();
-    this._performanceConnection = null;
+    yield this.performance.destroy();
+    this._performance = null;
   }),
 
   /**
diff --git a/browser/devtools/inspector/inspector-panel.js b/browser/devtools/inspector/inspector-panel.js
index ebeb3decdbaf..d8f1010282e0 100644
--- a/browser/devtools/inspector/inspector-panel.js
+++ b/browser/devtools/inspector/inspector-panel.js
@@ -28,6 +28,8 @@ loader.lazyGetter(this, "clipboardHelper", () => {
   return Cc["@mozilla.org/widget/clipboardhelper;1"].getService(Ci.nsIClipboardHelper);
 });
 
+loader.lazyImporter(this, "CommandUtils", "resource:///modules/devtools/DeveloperToolbar.jsm");
+
 const LAYOUT_CHANGE_TIMER = 250;
 
 /**
@@ -652,6 +654,9 @@ InspectorPanel.prototype = {
                              !this.selection.isPseudoElementNode();
     let isEditableElement = isSelectionElement &&
                             !this.selection.isAnonymousNode();
+    let isScreenshotable = isSelectionElement &&
+                           this.canGetUniqueSelector &&
+                           this.selection.nodeFront.isTreeDisplayed;
 
     // Set the pseudo classes
     for (let name of ["hover", "active", "focus"]) {
@@ -675,8 +680,9 @@ InspectorPanel.prototype = {
     }
 
     // Disable / enable "Copy Unique Selector", "Copy inner HTML",
-    // "Copy outer HTML" & "Scroll Into View" as appropriate
+    // "Copy outer HTML", "Scroll Into View" & "Screenshot Node" as appropriate
     let unique = this.panelDoc.getElementById("node-menu-copyuniqueselector");
+    let screenshot = this.panelDoc.getElementById("node-menu-screenshotnode");
     let copyInnerHTML = this.panelDoc.getElementById("node-menu-copyinner");
     let copyOuterHTML = this.panelDoc.getElementById("node-menu-copyouter");
     let scrollIntoView = this.panelDoc.getElementById("node-menu-scrollnodeintoview");
@@ -700,6 +706,12 @@ InspectorPanel.prototype = {
       unique.hidden = true;
     }
 
+    if (isScreenshotable) {
+      screenshot.removeAttribute("disabled");
+    } else {
+      screenshot.setAttribute("disabled", "true");
+    }
+
     // Enable/Disable the link open/copy items.
     this._setupNodeLinkMenu();
 
@@ -1068,6 +1080,17 @@ InspectorPanel.prototype = {
     }).then(null, console.error);
   },
 
+  /**
+   * Initiate gcli screenshot command on selected node
+   */
+  screenshotNode: function() {
+    CommandUtils.createRequisition(this._target, {
+      environment: CommandUtils.createEnvironment(this, '_target')
+    }).then(requisition => {
+      requisition.updateExec("screenshot --selector " + this.selectionCssSelector);
+    });
+  },
+
   /**
    * Scroll the node into view.
    */
diff --git a/browser/devtools/inspector/inspector.xul b/browser/devtools/inspector/inspector.xul
index 46d31b7ff353..b939033e49d4 100644
--- a/browser/devtools/inspector/inspector.xul
+++ b/browser/devtools/inspector/inspector.xul
@@ -91,6 +91,9 @@
         label="&inspectorScrollNodeIntoView.label;"
         accesskey="&inspectorScrollNodeIntoView.accesskey;"
         oncommand="inspector.scrollNodeIntoView()"/>
+      <menuitem id="node-menu-screenshotnode"
+        label="&inspectorScreenshotNode.label;"
+        oncommand="inspector.screenshotNode()" />
       <menuitem id="node-menu-delete"
         label="&inspectorHTMLDelete.label;"
         accesskey="&inspectorHTMLDelete.accesskey;"
diff --git a/browser/devtools/inspector/test/browser_inspector_menu-01-sensitivity.js b/browser/devtools/inspector/test/browser_inspector_menu-01-sensitivity.js
index 9433b0f82611..36ff6548140f 100644
--- a/browser/devtools/inspector/test/browser_inspector_menu-01-sensitivity.js
+++ b/browser/devtools/inspector/test/browser_inspector_menu-01-sensitivity.js
@@ -27,7 +27,8 @@ const ALL_MENU_ITEMS = [
   "node-menu-pseudo-hover",
   "node-menu-pseudo-active",
   "node-menu-pseudo-focus",
-  "node-menu-scrollnodeintoview"
+  "node-menu-scrollnodeintoview",
+  "node-menu-screenshotnode"
 ].concat(PASTE_MENU_ITEMS);
 
 const ITEMS_WITHOUT_SHOWDOMPROPS =
@@ -93,7 +94,16 @@ const TEST_CASES = [
       "node-menu-copyimagedatauri",
       "node-menu-pastebefore",
       "node-menu-pasteafter",
-    ]
+      "node-menu-screenshotnode",
+    ],
+  },
+  {
+    desc: "<head> with no html on clipboard",
+    selector: "head",
+    disabled: PASTE_MENU_ITEMS.concat([
+      "node-menu-copyimagedatauri",
+      "node-menu-screenshotnode",
+    ]),
   },
   {
     desc: "<element> with text on clipboard",
@@ -125,6 +135,22 @@ const TEST_CASES = [
     selector: "#paste-area",
     disabled: PASTE_MENU_ITEMS.concat(["node-menu-copyimagedatauri"]),
   },
+  {
+    desc: "<element> that isn't visible on the page, empty clipboard",
+    selector: "#hiddenElement",
+    disabled: PASTE_MENU_ITEMS.concat([
+      "node-menu-copyimagedatauri",
+      "node-menu-screenshotnode",
+    ]),
+  },
+  {
+    desc: "<element> nested in another hidden element, empty clipboard",
+    selector: "#nestedHiddenElement",
+    disabled: PASTE_MENU_ITEMS.concat([
+      "node-menu-copyimagedatauri",
+      "node-menu-screenshotnode",
+    ]),
+  }
 ];
 
 let clipboard = require("sdk/clipboard");
diff --git a/browser/devtools/inspector/test/doc_inspector_menu.html b/browser/devtools/inspector/test/doc_inspector_menu.html
index 13dbed3131f4..03ede6a5ab3f 100644
--- a/browser/devtools/inspector/test/doc_inspector_menu.html
+++ b/browser/devtools/inspector/test/doc_inspector_menu.html
@@ -17,6 +17,9 @@
       <p id="sensitivity">Paragraph for sensitivity</p>
       <p id="delete">This has to be deleted</p>
       <img id="copyimage" src="data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAAAAAA6fptVAAAACklEQVQYV2P4DwABAQEAWk1v8QAAAABJRU5ErkJggg==" />
+      <div id="hiddenElement" style="display: none;">
+        <p id="nestedHiddenElement">Visible element nested inside a non-visible element</p>
+      </div>
     </div>
   </body>
 </html>
diff --git a/browser/devtools/netmonitor/har/har-builder.js b/browser/devtools/netmonitor/har/har-builder.js
new file mode 100644
index 000000000000..06c6426fd889
--- /dev/null
+++ b/browser/devtools/netmonitor/har/har-builder.js
@@ -0,0 +1,476 @@
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
+"use strict";
+
+const { Cu, Ci, Cc } = require("chrome");
+const { defer, all, resolve } = require("sdk/core/promise");
+const { Services } = Cu.import("resource://gre/modules/Services.jsm", {});
+const { devtools } = Cu.import("resource://gre/modules/devtools/Loader.jsm", {});
+const { XPCOMUtils } = Cu.import("resource://gre/modules/XPCOMUtils.jsm", {});
+
+XPCOMUtils.defineLazyGetter(this, "appInfo", function() {
+  return Cc["@mozilla.org/xre/app-info;1"].getService(Ci.nsIXULAppInfo);
+});
+
+XPCOMUtils.defineLazyModuleGetter(this, "ViewHelpers",
+  "resource:///modules/devtools/ViewHelpers.jsm");
+
+XPCOMUtils.defineLazyGetter(this, "L10N", function() {
+  return new ViewHelpers.L10N("chrome://browser/locale/devtools/har.properties");
+});
+
+XPCOMUtils.defineLazyGetter(this, "NetworkHelper", function() {
+  return devtools.require("devtools/toolkit/webconsole/network-helper");
+});
+
+const HAR_VERSION = "1.1";
+
+/**
+ * This object is responsible for building HAR file. See HAR spec:
+ * https://dvcs.w3.org/hg/webperf/raw-file/tip/specs/HAR/Overview.html
+ * http://www.softwareishard.com/blog/har-12-spec/
+ *
+ * @param {Object} options configuration object
+ *
+ * The following options are supported:
+ *
+ * - items {Array}: List of Network requests to be exported. It is possible
+ *   to use directly: NetMonitorView.RequestsMenu.items
+ *
+ * - id {String}: ID of the exported page.
+ *
+ * - title {String}: Title of the exported page.
+ *
+ * - includeResponseBodies {Boolean}: Set to true to include HTTP response
+ *   bodies in the result data structure.
+ */
+var HarBuilder = function(options) {
+  this._options = options;
+  this._pageMap = [];
+}
+
+HarBuilder.prototype = {
+  // Public API
+
+  /**
+   * This is the main method used to build the entire result HAR data.
+   * The process is asynchronous since it can involve additional RDP
+   * communication (e.g. resolving long strings).
+   *
+   * @returns {Promise} A promise that resolves to the HAR object when
+   * the entire build process is done.
+   */
+  build: function() {
+    this.promises = [];
+
+    // Build basic structure for data.
+    let log = this.buildLog();
+
+    // Build entries.
+    let items = this._options.items;
+    for (let i=0; i<items.length; i++) {
+      let file = items[i].attachment;
+      log.entries.push(this.buildEntry(log, file));
+    }
+
+    // Some data needs to be fetched from the backend during the
+    // build process, so wait till all is done.
+    let { resolve, promise } = defer();
+    all(this.promises).then(results => resolve({ log: log }));
+
+    return promise;
+  },
+
+  // Helpers
+
+  buildLog: function() {
+    return {
+      version: HAR_VERSION,
+      creator: {
+        name: appInfo.name,
+        version: appInfo.version
+      },
+      browser: {
+        name: appInfo.name,
+        version: appInfo.version
+      },
+      pages: [],
+      entries: [],
+    }
+  },
+
+  buildPage: function(file) {
+    let page = {};
+
+    // Page start time is set when the first request is processed
+    // (see buildEntry)
+    page.startedDateTime = 0;
+    page.id = "page_" + this._options.id;
+    page.title = this._options.title;
+
+    return page;
+  },
+
+  getPage: function(log, file) {
+    let id = this._options.id;
+    let page = this._pageMap[id];
+    if (page) {
+      return page;
+    }
+
+    this._pageMap[id] = page = this.buildPage(file);
+    log.pages.push(page);
+
+    return page;
+  },
+
+  buildEntry: function(log, file) {
+    let page = this.getPage(log, file);
+
+    let entry = {};
+    entry.pageref = page.id;
+    entry.startedDateTime = dateToJSON(new Date(file.startedMillis));
+    entry.time = file.endedMillis - file.startedMillis;
+
+    entry.request = this.buildRequest(file);
+    entry.response = this.buildResponse(file);
+    entry.cache = this.buildCache(file);
+    entry.timings = file.eventTimings ? file.eventTimings.timings : {};
+
+    if (file.remoteAddress) {
+      entry.serverIPAddress = file.remoteAddress;
+    }
+
+    if (file.remotePort) {
+      entry.connection = file.remotePort + "";
+    }
+
+    // Compute page load start time according to the first request start time.
+    if (!page.startedDateTime) {
+      page.startedDateTime = entry.startedDateTime;
+      page.pageTimings = this.buildPageTimings(page, file);
+    }
+
+    return entry;
+  },
+
+  buildPageTimings: function(page, file) {
+    // Event timing info isn't available
+    let timings = {
+      onContentLoad: -1,
+      onLoad: -1
+    };
+
+    return timings;
+  },
+
+  buildRequest: function(file) {
+    let request = {
+      bodySize: 0
+    };
+
+    request.method = file.method;
+    request.url = file.url;
+    request.httpVersion = file.httpVersion;
+
+    request.headers = this.buildHeaders(file.requestHeaders);
+    request.cookies = this.buildCookies(file.requestCookies);
+
+    request.queryString = NetworkHelper.parseQueryString(
+      NetworkHelper.nsIURL(file.url).query) || [];
+
+    request.postData = this.buildPostData(file);
+
+    request.headersSize = file.requestHeaders.headersSize;
+
+    // Set request body size, but make sure the body is fetched
+    // from the backend.
+    if (file.requestPostData) {
+      this.fetchData(file.requestPostData.postData.text).then(value => {
+        request.bodySize = value.length;
+      });
+    }
+
+    return request;
+  },
+
+  /**
+   * Fetch all header values from the backend (if necessary) and
+   * build the result HAR structure.
+   *
+   * @param {Object} input Request or response header object.
+   */
+  buildHeaders: function(input) {
+    if (!input) {
+      return [];
+    }
+
+    return this.buildNameValuePairs(input.headers);
+  },
+
+  buildCookies: function(input) {
+    if (!input) {
+      return [];
+    }
+
+    return this.buildNameValuePairs(input.cookies);
+  },
+
+  buildNameValuePairs: function(entries) {
+    let result = [];
+
+    // HAR requires headers array to be presented, so always
+    // return at least an empty array.
+    if (!entries) {
+      return result;
+    }
+
+    // Make sure header values are fully fetched from the server.
+    entries.forEach(entry => {
+      this.fetchData(entry.value).then(value => {
+        result.push({
+          name: entry.name,
+          value: value
+        });
+      });
+    })
+
+    return result;
+  },
+
+  buildPostData: function(file) {
+    let postData = {
+      mimeType: findValue(file.requestHeaders.headers, "content-type"),
+      params: [],
+      text: ""
+    };
+
+    if (!file.requestPostData) {
+      return postData;
+    }
+
+    if (file.requestPostData.postDataDiscarded) {
+      postData.comment = L10N.getStr("har.requestBodyNotIncluded");
+      return postData;
+    }
+
+    // Load request body from the backend.
+    this.fetchData(file.requestPostData.postData.text).then(value => {
+      postData.text = value;
+
+      // If we are dealing with URL encoded body, parse parameters.
+      if (isURLEncodedFile(file, value)) {
+        postData.mimeType = "application/x-www-form-urlencoded";
+
+        // Extract form parameters and produce nice HAR array.
+        this._options.view._getFormDataSections(file.requestHeaders,
+          file.requestHeadersFromUploadStream,
+          file.requestPostData).then(formDataSections => {
+            formDataSections.forEach(section => {
+              let paramsArray = NetworkHelper.parseQueryString(section);
+              if (paramsArray) {
+                postData.params = [...postData.params, ...paramsArray];
+              }
+            });
+          });
+      }
+    });
+
+    return postData;
+  },
+
+  buildResponse: function(file) {
+    let response = {
+      status: 0
+    };
+
+    // Arbitrary value if it's aborted to make sure status has a number
+    if (file.status) {
+      response.status = parseInt(file.status);
+    }
+
+    response.statusText = file.statusText || "";
+    response.httpVersion = file.httpVersion;
+
+    response.headers = this.buildHeaders(file.responseHeaders);
+    response.cookies = this.buildCookies(file.responseCookies);
+
+    response.content = this.buildContent(file);
+    response.redirectURL = findValue(file.responseHeaders.headers, "Location");
+    response.headersSize = file.responseHeaders.headersSize;
+    response.bodySize = file.transferredSize || -1;
+
+    return response;
+  },
+
+  buildContent: function(file) {
+    let content = {
+      mimeType: file.mimeType,
+      size: -1
+    };
+
+    if (file.responseContent && file.responseContent.content) {
+      content.size = file.responseContent.content.size;
+    }
+
+    if (!this._options.includeResponseBodies ||
+        file.responseContent.contentDiscarded) {
+      content.comment = L10N.getStr("har.responseBodyNotIncluded");
+      return content;
+    }
+
+    if (file.responseContent) {
+      let text = file.responseContent.content.text;
+      let promise = this.fetchData(text).then(value => {
+        content.text = value;
+      });
+    }
+
+    return content;
+  },
+
+  buildCache: function(file) {
+    let cache = {};
+
+    if (!file.fromCache) {
+      return cache;
+    }
+
+    // There is no such info yet in the Net panel.
+    // cache.beforeRequest = {};
+
+    if (file.cacheEntry) {
+      cache.afterRequest = this.buildCacheEntry(file.cacheEntry);
+    } else {
+      cache.afterRequest = null;
+    }
+
+    return cache;
+  },
+
+  buildCacheEntry: function(cacheEntry) {
+    let cache = {};
+
+    cache.expires = findValue(cacheEntry, "Expires");
+    cache.lastAccess = findValue(cacheEntry, "Last Fetched");
+    cache.eTag = "";
+    cache.hitCount = findValue(cacheEntry, "Fetch Count");
+
+    return cache;
+  },
+
+  getBlockingEndTime: function(file) {
+    if (file.resolveStarted && file.connectStarted) {
+      return file.resolvingTime;
+    }
+
+    if (file.connectStarted) {
+      return file.connectingTime;
+    }
+
+    if (file.sendStarted) {
+      return file.sendingTime;
+    }
+
+    return (file.sendingTime > file.startTime) ?
+      file.sendingTime : file.waitingForTime;
+  },
+
+  // RDP Helpers
+
+  fetchData: function(string) {
+    let promise = this._options.getString(string).then(value => {
+      return value;
+    });
+
+    // Building HAR is asynchronous and not done till all
+    // collected promises are resolved.
+    this.promises.push(promise);
+
+    return promise;
+  }
+}
+
+// Helpers
+
+/**
+ * Returns true if specified request body is URL encoded.
+ */
+function isURLEncodedFile(file, text) {
+  let contentType = "content-type: application/x-www-form-urlencoded"
+  if (text && text.toLowerCase().indexOf(contentType) != -1) {
+    return true;
+  }
+
+  // The header value doesn't have to be always exactly
+  // "application/x-www-form-urlencoded",
+  // there can be even charset specified. So, use indexOf rather than just
+  // "==".
+  let value = findValue(file.requestHeaders.headers, "content-type");
+  if (value && value.indexOf("application/x-www-form-urlencoded") == 0) {
+    return true;
+  }
+
+  return false;
+}
+
+/**
+ * Find specified value within an array of name-value pairs
+ * (used for headers, cookies and cache entries)
+ */
+function findValue(arr, name) {
+  name = name.toLowerCase();
+  let result = arr.find(entry => entry.name.toLowerCase() == name);
+  return result ? result.value : "";
+}
+
+/**
+ * Generate HAR representation of a date.
+ * (YYYY-MM-DDThh:mm:ss.sTZD, e.g. 2009-07-24T19:20:30.45+01:00)
+ * See also HAR Schema: http://janodvarko.cz/har/viewer/
+ *
+ * Note: it would be great if we could utilize Date.toJSON(), but
+ * it doesn't return proper time zone offset.
+ *
+ * An example:
+ * This helper returns:    2015-05-29T16:10:30.424+02:00
+ * Date.toJSON() returns:  2015-05-29T14:10:30.424Z
+ *
+ * @param date {Date} The date object we want to convert.
+ */
+function dateToJSON(date) {
+  function f(n, c) {
+    if (!c) {
+      c = 2;
+    }
+    let s = new String(n);
+    while (s.length < c) {
+      s = "0" + s;
+    }
+    return s;
+  }
+
+  let result = date.getFullYear() + '-' +
+    f(date.getMonth() + 1) + '-' +
+    f(date.getDate()) + 'T' +
+    f(date.getHours()) + ':' +
+    f(date.getMinutes()) + ':' +
+    f(date.getSeconds()) + '.' +
+    f(date.getMilliseconds(), 3);
+
+  let offset = date.getTimezoneOffset();
+  let positive = offset > 0;
+
+  // Convert to positive number before using Math.floor (see issue 5512)
+  offset = Math.abs(offset);
+  let offsetHours = Math.floor(offset / 60);
+  let offsetMinutes = Math.floor(offset % 60);
+  let prettyOffset = (positive > 0 ? "-" : "+") + f(offsetHours) +
+    ":" + f(offsetMinutes);
+
+  return result + prettyOffset;
+}
+
+// Exports from this module
+exports.HarBuilder = HarBuilder;
diff --git a/browser/devtools/netmonitor/har/har-exporter.js b/browser/devtools/netmonitor/har/har-exporter.js
new file mode 100644
index 000000000000..c47d2edb29d2
--- /dev/null
+++ b/browser/devtools/netmonitor/har/har-exporter.js
@@ -0,0 +1,175 @@
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
+"use strict";
+
+const { Cu, Cc, Ci } = require("chrome");
+const { Services } = Cu.import("resource://gre/modules/Services.jsm", {});
+const { defer, resolve } = require("sdk/core/promise");
+const { HarUtils } = require("./har-utils.js");
+const { HarBuilder } = require("./har-builder.js");
+
+XPCOMUtils.defineLazyGetter(this, "clipboardHelper", function() {
+  return Cc["@mozilla.org/widget/clipboardhelper;1"].
+    getService(Ci.nsIClipboardHelper);
+});
+
+var uid = 1;
+
+/**
+ * This object represents the main public API designed to access
+ * Network export logic. Clients, such as the Network panel itself,
+ * should use this API to export collected HTTP data from the panel.
+ */
+const HarExporter = {
+  // Public API
+
+  /**
+   * Save collected HTTP data from the Network panel into HAR file.
+   *
+   * @param Object options
+   *        Configuration object
+   *
+   * The following options are supported:
+   *
+   * - includeResponseBodies {Boolean}: If set to true, HTTP response bodies
+   *   are also included in the HAR file (can produce significantly bigger
+   *   amount of data).
+   *
+   * - items {Array}: List of Network requests to be exported. It is possible
+   *   to use directly: NetMonitorView.RequestsMenu.items
+   *
+   * - jsonp {Boolean}: If set to true the export format is HARP (support
+   *   for JSONP syntax).
+   *
+   * - jsonpCallback {String}: Default name of JSONP callback (used for
+   *   HARP format).
+   *
+   * - compress {Boolean}: If set to true the final HAR file is zipped.
+   *   This represents great disk-space optimization.
+   *
+   * - defaultFileName {String}: Default name of the target HAR file.
+   *   The default file name supports formatters, see:
+   *   https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Global_Objects/Date/toLocaleFormat
+   *
+   * - defaultLogDir {String}: Default log directory for automated logs.
+   *
+   * - id {String}: ID of the page (used in the HAR file).
+   *
+   * - title {String}: Title of the page (used in the HAR file).
+   *
+   * - forceExport {Boolean}: The result HAR file is created even if
+   *   there are no HTTP entries.
+   */
+  save: function(options) {
+    // Set default options related to save operation.
+    options.defaultFileName = Services.prefs.getCharPref(
+      "devtools.netmonitor.har.defaultFileName");
+    options.compress = Services.prefs.getBoolPref(
+      "devtools.netmonitor.har.compress");
+
+    // Get target file for exported data. Bail out, if the user
+    // presses cancel.
+    let file = HarUtils.getTargetFile(options.defaultFileName,
+      options.jsonp, options.compress);
+
+    if (!file) {
+      return resolve();
+    }
+
+    return this.fetchHarData(options).then(jsonString => {
+      if (!HarUtils.saveToFile(file, jsonString, options.compress)) {
+        let msg = "Failed to save HAR file at: " + options.defaultFileName;
+        Cu.reportError(msg);
+      }
+      return jsonString;
+    });
+  },
+
+  /**
+   * Copy HAR string into the clipboard.
+   *
+   * @param Object options
+   *        Configuration object, see save() for detailed description.
+   */
+  copy: function(options) {
+    return this.fetchHarData(options).then(jsonString => {
+      clipboardHelper.copyString(jsonString);
+      return jsonString;
+    });
+  },
+
+  // Helpers
+
+  fetchHarData: function(options) {
+    // Generate page ID
+    options.id = options.id || uid++;
+
+    // Set default generic HAR export options.
+    options.jsonp = options.jsonp ||
+      Services.prefs.getBoolPref("devtools.netmonitor.har.jsonp");
+    options.includeResponseBodies = options.includeResponseBodies ||
+      Services.prefs.getBoolPref("devtools.netmonitor.har.includeResponseBodies");
+    options.jsonpCallback = options.jsonpCallback ||
+      Services.prefs.getCharPref( "devtools.netmonitor.har.jsonpCallback");
+    options.forceExport = options.forceExport ||
+      Services.prefs.getBoolPref("devtools.netmonitor.har.forceExport");
+
+    // Build HAR object.
+    return this.buildHarData(options).then(har => {
+      // Do not export an empty HAR file, unless the user
+      // explicitly says so (using the forceExport option).
+      if (!har.log.entries.length && !options.forceExport) {
+        return resolve();
+      }
+
+      let jsonString = this.stringify(har);
+      if (!jsonString) {
+        return resolve();
+      }
+
+      // If JSONP is wanted, wrap the string in a function call
+      if (options.jsonp) {
+        // This callback name is also used in HAR Viewer by default.
+        // http://www.softwareishard.com/har/viewer/
+        let callbackName = options.jsonpCallback || "onInputData";
+        jsonString = callbackName + "(" + jsonString + ");";
+      }
+
+      return jsonString;
+    }).then(null, function onError(err) {
+      Cu.reportError(err);
+    });
+  },
+
+  /**
+   * Build HAR data object. This object contains all HTTP data
+   * collected by the Network panel. The process is asynchronous
+   * since it can involve additional RDP communication (e.g. resolving
+   * long strings).
+   */
+  buildHarData: function(options) {
+    // Build HAR object from collected data.
+    let builder = new HarBuilder(options);
+    return builder.build();
+  },
+
+  /**
+   * Build JSON string from the HAR data object.
+   */
+  stringify: function(har) {
+    if (!har) {
+      return null;
+    }
+
+    try {
+      return JSON.stringify(har, null, "  ");
+    }
+    catch (err) {
+      Cu.reportError(err);
+    }
+  },
+};
+
+// Exports from this module
+exports.HarExporter = HarExporter;
diff --git a/browser/devtools/netmonitor/har/har-utils.js b/browser/devtools/netmonitor/har/har-utils.js
new file mode 100644
index 000000000000..421c74d71c51
--- /dev/null
+++ b/browser/devtools/netmonitor/har/har-utils.js
@@ -0,0 +1,185 @@
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
+"use strict";
+
+const { Cu, Ci, Cc, CC } = require("chrome");
+const { Services } = Cu.import("resource://gre/modules/Services.jsm", {});
+
+XPCOMUtils.defineLazyGetter(this, "dirService", function() {
+  return Cc["@mozilla.org/file/directory_service;1"].getService(Ci.nsIProperties);
+});
+
+XPCOMUtils.defineLazyGetter(this, "ZipWriter", function() {
+  return CC("@mozilla.org/zipwriter;1", "nsIZipWriter");
+});
+
+XPCOMUtils.defineLazyGetter(this, "LocalFile", function() {
+  return new CC("@mozilla.org/file/local;1", "nsILocalFile", "initWithPath");
+});
+
+XPCOMUtils.defineLazyGetter(this, "getMostRecentBrowserWindow", function() {
+  return require("sdk/window/utils").getMostRecentBrowserWindow;
+});
+
+const nsIFilePicker = Ci.nsIFilePicker;
+
+const OPEN_FLAGS = {
+  RDONLY: parseInt("0x01"),
+  WRONLY: parseInt("0x02"),
+  CREATE_FILE: parseInt("0x08"),
+  APPEND: parseInt("0x10"),
+  TRUNCATE: parseInt("0x20"),
+  EXCL: parseInt("0x80")
+};
+
+/**
+ * Helper API for HAR export features.
+ */
+var HarUtils = {
+  /**
+   * Open File Save As dialog and let the user pick the proper file
+   * location for generated HAR log.
+   */
+  getTargetFile: function(fileName, jsonp, compress) {
+    let browser = getMostRecentBrowserWindow();
+
+    let fp = Cc["@mozilla.org/filepicker;1"].createInstance(nsIFilePicker);
+    fp.init(browser, null, nsIFilePicker.modeSave);
+    fp.appendFilter("HTTP Archive Files", "*.har; *.harp; *.json; *.jsonp; *.zip");
+    fp.appendFilters(nsIFilePicker.filterAll | nsIFilePicker.filterText);
+    fp.filterIndex = 1;
+
+    fp.defaultString = this.getHarFileName(fileName, jsonp, compress);
+
+    let rv = fp.show();
+    if (rv == nsIFilePicker.returnOK || rv == nsIFilePicker.returnReplace) {
+      return fp.file;
+    }
+
+    return null;
+  },
+
+  getHarFileName: function(defaultFileName, jsonp, compress) {
+    let extension = jsonp ? ".harp" : ".har";
+
+    // Read more about toLocaleFormat & format string.
+    // https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Global_Objects/Date/toLocaleFormat
+    var now = new Date();
+    var name = now.toLocaleFormat(defaultFileName);
+    name = name.replace(/\:/gm, "-", "");
+    name = name.replace(/\//gm, "_", "");
+
+    let fileName = name + extension;
+
+    // Default file extension is zip if compressing is on.
+    if (compress) {
+      fileName += ".zip";
+    }
+
+    return fileName;
+  },
+
+  /**
+   * Save HAR string into a given file. The file might be compressed
+   * if specified in the options.
+   *
+   * @param {File} file Target file where the HAR string (JSON)
+   * should be stored.
+   * @param {String} jsonString HAR data (JSON or JSONP)
+   * @param {Boolean} compress The result file is zipped if set to true.
+   */
+  saveToFile: function(file, jsonString, compress) {
+    let openFlags = OPEN_FLAGS.WRONLY | OPEN_FLAGS.CREATE_FILE |
+      OPEN_FLAGS.TRUNCATE;
+
+    try {
+      let foStream = Cc["@mozilla.org/network/file-output-stream;1"]
+        .createInstance(Ci.nsIFileOutputStream);
+
+      let permFlags = parseInt("0666", 8);
+      foStream.init(file, openFlags, permFlags, 0);
+
+      let convertor = Cc["@mozilla.org/intl/converter-output-stream;1"]
+        .createInstance(Ci.nsIConverterOutputStream);
+      convertor.init(foStream, "UTF-8", 0, 0);
+
+      // The entire jsonString can be huge so, write the data in chunks.
+      let chunkLength = 1024 * 1024;
+      for (let i=0; i<=jsonString.length; i++) {
+        let data = jsonString.substr(i, chunkLength+1);
+        if (data) {
+          convertor.writeString(data);
+        }
+
+        i = i + chunkLength;
+      }
+
+      // this closes foStream
+      convertor.close();
+    } catch (err) {
+      Cu.reportError(err);
+      return false;
+    }
+
+    // If no compressing then bail out.
+    if (!compress) {
+      return true;
+    }
+
+    // Remember name of the original file, it'll be replaced by a zip file.
+    let originalFilePath = file.path;
+    let originalFileName = file.leafName;
+
+    try {
+      // Rename using unique name (the file is going to be removed).
+      file.moveTo(null, "temp" + (new Date()).getTime() + "temphar");
+
+      // Create compressed file with the original file path name.
+      let zipFile = Cc["@mozilla.org/file/local;1"].
+        createInstance(Ci.nsILocalFile);
+      zipFile.initWithPath(originalFilePath);
+
+      // The file within the zipped file doesn't use .zip extension.
+      let fileName = originalFileName;
+      if (fileName.indexOf(".zip") == fileName.length - 4) {
+        fileName = fileName.substr(0, fileName.indexOf(".zip"));
+      }
+
+      let zip = new ZipWriter();
+      zip.open(zipFile, openFlags);
+      zip.addEntryFile(fileName, Ci.nsIZipWriter.COMPRESSION_DEFAULT,
+        file, false);
+      zip.close();
+
+      // Remove the original file (now zipped).
+      file.remove(true);
+      return true;
+    } catch (err) {
+      Cu.reportError(err);
+
+      // Something went wrong (disk space?) rename the original file back.
+      file.moveTo(null, originalFileName);
+    }
+
+    return false;
+  },
+
+  getLocalDirectory: function(path) {
+    let dir;
+
+    if (!path) {
+      dir = dirService.get("ProfD", Ci.nsILocalFile);
+      dir.append("har");
+      dir.append("logs");
+    } else {
+      dir = Cc["@mozilla.org/file/local;1"].createInstance(Ci.nsILocalFile);
+      dir.initWithPath(path);
+    }
+
+    return dir;
+  },
+}
+
+// Exports from this module
+exports.HarUtils = HarUtils;
diff --git a/browser/base/content/browser-pocket-en-US.properties b/browser/devtools/netmonitor/har/moz.build
similarity index 51%
rename from browser/base/content/browser-pocket-en-US.properties
rename to browser/devtools/netmonitor/har/moz.build
index d3f548cb80a0..77e783c154e1 100644
--- a/browser/base/content/browser-pocket-en-US.properties
+++ b/browser/devtools/netmonitor/har/moz.build
@@ -1,9 +1,12 @@
+# vim: set filetype=python:
 # This Source Code Form is subject to the terms of the Mozilla Public
 # License, v. 2.0. If a copy of the MPL was not distributed with this
 # file, You can obtain one at http://mozilla.org/MPL/2.0/.
 
-# This is a temporary file, later versions of Firefox will use
-# browser.properties in the usual L10N location.
+EXTRA_JS_MODULES.devtools.netmonitor.har += [
+    'har-builder.js',
+    'har-exporter.js',
+    'har-utils.js',
+]
 
-pocket-button.label = Pocket
-pocket-button.tooltiptext = Save to Pocket
+BROWSER_CHROME_MANIFESTS += ['test/browser.ini']
diff --git a/browser/devtools/netmonitor/har/test/browser.ini b/browser/devtools/netmonitor/har/test/browser.ini
new file mode 100644
index 000000000000..5f42a16a1f14
--- /dev/null
+++ b/browser/devtools/netmonitor/har/test/browser.ini
@@ -0,0 +1,9 @@
+[DEFAULT]
+tags = devtools
+subsuite = devtools
+support-files =
+  head.js
+  html_har_post-data-test-page.html
+
+[browser_net_har_copy_all_as_har.js]
+[browser_net_har_post_data.js]
diff --git a/browser/devtools/netmonitor/har/test/browser_net_har_copy_all_as_har.js b/browser/devtools/netmonitor/har/test/browser_net_har_copy_all_as_har.js
new file mode 100644
index 000000000000..27321e34a10c
--- /dev/null
+++ b/browser/devtools/netmonitor/har/test/browser_net_har_copy_all_as_har.js
@@ -0,0 +1,44 @@
+/* Any copyright is dedicated to the Public Domain.
+   http://creativecommons.org/publicdomain/zero/1.0/ */
+
+/**
+ * Basic tests for exporting Network panel content into HAR format.
+ */
+add_task(function*() {
+  let [ aTab, aDebuggee, aMonitor ] = yield initNetMonitor(SIMPLE_URL);
+
+  info("Starting test... ");
+
+  let { NetMonitorView } = aMonitor.panelWin;
+  let { RequestsMenu } = NetMonitorView;
+
+  RequestsMenu.lazyUpdate = false;
+
+  aDebuggee.location.reload();
+
+  yield waitForNetworkEvents(aMonitor, 1);
+  yield RequestsMenu.copyAllAsHar();
+
+  let jsonString = SpecialPowers.getClipboardData("text/unicode");
+  let har = JSON.parse(jsonString);
+
+  // Check out HAR log
+  isnot(har.log, null, "The HAR log must exist");
+  is(har.log.creator.name, "Firefox", "The creator field must be set");
+  is(har.log.browser.name, "Firefox", "The browser field must be set");
+  is(har.log.pages.length, 1, "There must be one page");
+  is(har.log.entries.length, 1, "There must be one request");
+
+  let entry = har.log.entries[0];
+  is(entry.request.method, "GET", "Check the method");
+  is(entry.request.url, SIMPLE_URL, "Check the URL");
+  is(entry.request.headers.length, 8, "Check number of request headers");
+  is(entry.response.status, 200, "Check response status");
+  is(entry.response.statusText, "OK", "Check response status text");
+  is(entry.response.headers.length, 6, "Check number of response headers");
+  is(entry.response.content.mimeType, "text/html", "Check response content type");
+  isnot(entry.response.content.text, undefined, "Check response body");
+  isnot(entry.timings, undefined, "Check timings");
+
+  teardown(aMonitor).then(finish);
+});
diff --git a/browser/devtools/netmonitor/har/test/browser_net_har_post_data.js b/browser/devtools/netmonitor/har/test/browser_net_har_post_data.js
new file mode 100644
index 000000000000..9596f26ea1f9
--- /dev/null
+++ b/browser/devtools/netmonitor/har/test/browser_net_har_post_data.js
@@ -0,0 +1,39 @@
+/* Any copyright is dedicated to the Public Domain.
+   http://creativecommons.org/publicdomain/zero/1.0/ */
+
+/**
+ * Tests for exporting POST data into HAR format.
+ */
+add_task(function*() {
+  let [ aTab, aDebuggee, aMonitor ] = yield initNetMonitor(
+    HAR_EXAMPLE_URL + "html_har_post-data-test-page.html");
+
+  info("Starting test... ");
+
+  let { NetMonitorView } = aMonitor.panelWin;
+  let { RequestsMenu } = NetMonitorView;
+
+  RequestsMenu.lazyUpdate = false;
+
+  // Execute one POST request on the page and wait till its done.
+  aDebuggee.executeTest();
+  yield waitForNetworkEvents(aMonitor, 0, 1);
+
+  // Copy HAR into the clipboard (asynchronous).
+  let jsonString = yield RequestsMenu.copyAllAsHar();
+  let har = JSON.parse(jsonString);
+
+  // Check out the HAR log.
+  isnot(har.log, null, "The HAR log must exist");
+  is(har.log.pages.length, 1, "There must be one page");
+  is(har.log.entries.length, 1, "There must be one request");
+
+  let entry = har.log.entries[0];
+  is(entry.request.postData.mimeType, "application/json; charset=UTF-8",
+    "Check post data content type");
+  is(entry.request.postData.text, "{'first': 'John', 'last': 'Doe'}",
+    "Check post data payload");
+
+  // Clean up
+  teardown(aMonitor).then(finish);
+});
diff --git a/browser/devtools/netmonitor/har/test/head.js b/browser/devtools/netmonitor/har/test/head.js
new file mode 100644
index 000000000000..6b578ffca859
--- /dev/null
+++ b/browser/devtools/netmonitor/har/test/head.js
@@ -0,0 +1,12 @@
+/* Any copyright is dedicated to the Public Domain.
+   http://creativecommons.org/publicdomain/zero/1.0/ */
+"use strict";
+
+let { Services } = Cu.import("resource://gre/modules/Services.jsm", {});
+
+// Load the NetMonitor head.js file to share its API.
+let netMonitorHead = "chrome://mochitests/content/browser/browser/devtools/netmonitor/test/head.js";
+Services.scriptloader.loadSubScript(netMonitorHead, this);
+
+// Directory with HAR related test files.
+const HAR_EXAMPLE_URL = "http://example.com/browser/browser/devtools/netmonitor/har/test/";
diff --git a/browser/devtools/netmonitor/har/test/html_har_post-data-test-page.html b/browser/devtools/netmonitor/har/test/html_har_post-data-test-page.html
new file mode 100644
index 000000000000..6cc4efa84ddb
--- /dev/null
+++ b/browser/devtools/netmonitor/har/test/html_har_post-data-test-page.html
@@ -0,0 +1,33 @@
+<!-- Any copyright is dedicated to the Public Domain.
+     http://creativecommons.org/publicdomain/zero/1.0/ -->
+<!doctype html>
+
+<html>
+  <head>
+    <meta charset="utf-8"/>
+    <meta http-equiv="Cache-Control" content="no-cache, no-store, must-revalidate" />
+    <meta http-equiv="Pragma" content="no-cache" />
+    <meta http-equiv="Expires" content="0" />
+    <title>Network Monitor Test Page</title>
+  </head>
+
+  <body>
+    <p>HAR POST data test</p>
+
+    <script type="text/javascript">
+      function post(aAddress, aData) {
+        var xhr = new XMLHttpRequest();
+        xhr.open("POST", aAddress, true);
+        xhr.setRequestHeader("Content-Type", "application/json");
+        xhr.send(aData);
+      }
+
+      function executeTest() {
+        var url = "html_har_post-data-test-page.html";
+        var data = "{'first': 'John', 'last': 'Doe'}";
+        post(url, data);
+      }
+    </script>
+  </body>
+
+</html>
diff --git a/browser/devtools/netmonitor/moz.build b/browser/devtools/netmonitor/moz.build
index addaa6f8b1e2..6ce991c11fc8 100644
--- a/browser/devtools/netmonitor/moz.build
+++ b/browser/devtools/netmonitor/moz.build
@@ -3,6 +3,10 @@
 # License, v. 2.0. If a copy of the MPL was not distributed with this
 # file, You can obtain one at http://mozilla.org/MPL/2.0/.
 
+DIRS += [
+    'har'
+]
+
 EXTRA_JS_MODULES.devtools.netmonitor += [
     'panel.js'
 ]
diff --git a/browser/devtools/netmonitor/netmonitor-view.js b/browser/devtools/netmonitor/netmonitor-view.js
index eab8725e23f6..268aab1b5860 100644
--- a/browser/devtools/netmonitor/netmonitor-view.js
+++ b/browser/devtools/netmonitor/netmonitor-view.js
@@ -5,6 +5,19 @@
  * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
 "use strict";
 
+const { devtools } = Cu.import("resource://gre/modules/devtools/Loader.jsm", {});
+
+XPCOMUtils.defineLazyModuleGetter(this, "DevToolsUtils",
+  "resource://gre/modules/devtools/DevToolsUtils.jsm");
+
+XPCOMUtils.defineLazyGetter(this, "HarExporter", function() {
+  return devtools.require("devtools/netmonitor/har/har-exporter.js").HarExporter;
+});
+
+XPCOMUtils.defineLazyGetter(this, "NetworkHelper", function() {
+  return devtools.require("devtools/toolkit/webconsole/network-helper");
+});
+
 const HTML_NS = "http://www.w3.org/1999/xhtml";
 const EPSILON = 0.001;
 const SOURCE_SYNTAX_HIGHLIGHT_MAX_FILE_SIZE = 102400; // 100 KB in bytes
@@ -571,7 +584,7 @@ RequestsMenuView.prototype = Heritage.extend(WidgetMethods, {
    */
   copyUrlParams: function() {
     let selected = this.selectedItem.attachment;
-    let params = nsIURL(selected.url).query.split("&");
+    let params = NetworkHelper.nsIURL(selected.url).query.split("&");
     let string = params.join(Services.appinfo.OS === "WINNT" ? "\r\n" : "\n");
     clipboardHelper.copyString(string);
   },
@@ -631,7 +644,7 @@ RequestsMenuView.prototype = Heritage.extend(WidgetMethods, {
 
     let params = [];
     formDataSections.forEach(section => {
-      let paramsArray = parseQueryString(section);
+      let paramsArray = NetworkHelper.parseQueryString(section);
       if (paramsArray) {
         params = [...params, ...paramsArray];
       }
@@ -685,6 +698,34 @@ RequestsMenuView.prototype = Heritage.extend(WidgetMethods, {
     });
   },
 
+  /**
+   * Copy HAR from the network panel content to the clipboard.
+   */
+  copyAllAsHar: function() {
+    let options = this.getDefaultHarOptions();
+    return HarExporter.copy(options);
+  },
+
+  /**
+   * Save HAR from the network panel content to a file.
+   */
+  saveAllAsHar: function() {
+    let options = this.getDefaultHarOptions();
+    return HarExporter.save(options);
+  },
+
+  getDefaultHarOptions: function() {
+    let form = NetMonitorController._target.form;
+    let title = form.title || form.url;
+
+    return {
+      getString: gNetwork.getString.bind(gNetwork),
+      view: this,
+      items: NetMonitorView.RequestsMenu.items,
+      title: title
+    };
+  },
+
   /**
    * Copy the raw request headers from the currently selected item.
    */
@@ -1521,7 +1562,7 @@ RequestsMenuView.prototype = Heritage.extend(WidgetMethods, {
       case "url": {
         let uri;
         try {
-          uri = nsIURL(aValue);
+          uri = NetworkHelper.nsIURL(aValue);
         } catch(e) {
           break; // User input may not make a well-formed url yet.
         }
@@ -1944,7 +1985,7 @@ RequestsMenuView.prototype = Heritage.extend(WidgetMethods, {
     copyUrlElement.hidden = !selectedItem;
 
     let copyUrlParamsElement = $("#request-menu-context-copy-url-params");
-    copyUrlParamsElement.hidden = !selectedItem || !nsIURL(selectedItem.attachment.url).query;
+    copyUrlParamsElement.hidden = !selectedItem || !NetworkHelper.nsIURL(selectedItem.attachment.url).query;
 
     let copyPostDataElement = $("#request-menu-context-copy-post-data");
     copyPostDataElement.hidden = !selectedItem || !selectedItem.attachment.requestPostData;
@@ -1972,6 +2013,12 @@ RequestsMenuView.prototype = Heritage.extend(WidgetMethods, {
     let separators = $all(".request-menu-context-separator");
     Array.forEach(separators, separator => separator.hidden = !selectedItem);
 
+    let copyAsHar = $("#request-menu-context-copy-all-as-har");
+    copyAsHar.hidden = !NetMonitorView.RequestsMenu.items.length;
+
+    let saveAsHar = $("#request-menu-context-save-all-as-har");
+    saveAsHar.hidden = !NetMonitorView.RequestsMenu.items.length;
+
     let newTabElement = $("#request-menu-context-newtab");
     newTabElement.hidden = !selectedItem;
   },
@@ -2010,7 +2057,7 @@ RequestsMenuView.prototype = Heritage.extend(WidgetMethods, {
    */
   _getUriNameWithQuery: function(aUrl) {
     if (!(aUrl instanceof Ci.nsIURL)) {
-      aUrl = nsIURL(aUrl);
+      aUrl = NetworkHelper.nsIURL(aUrl);
     }
     let name = NetworkHelper.convertToUnicode(unescape(aUrl.fileName || aUrl.filePath || "/"));
     let query = NetworkHelper.convertToUnicode(unescape(aUrl.query));
@@ -2018,7 +2065,7 @@ RequestsMenuView.prototype = Heritage.extend(WidgetMethods, {
   },
   _getUriHostPort: function(aUrl) {
     if (!(aUrl instanceof Ci.nsIURL)) {
-      aUrl = nsIURL(aUrl);
+      aUrl = NetworkHelper.nsIURL(aUrl);
     }
     return NetworkHelper.convertToUnicode(unescape(aUrl.hostPort));
   },
@@ -2254,7 +2301,7 @@ CustomRequestView.prototype = {
    *        The URL to extract query string from.
    */
   updateCustomQuery: function(aUrl) {
-    let paramsArray = parseQueryString(nsIURL(aUrl).query);
+    let paramsArray = NetworkHelper.parseQueryString(NetworkHelper.nsIURL(aUrl).query);
     if (!paramsArray) {
       $("#custom-query").hidden = true;
       return;
@@ -2274,7 +2321,7 @@ CustomRequestView.prototype = {
     let queryString = writeQueryString(params);
 
     let url = $("#custom-url-value").value;
-    let oldQuery = nsIURL(url).query;
+    let oldQuery = NetworkHelper.nsIURL(url).query;
     let path = url.replace(oldQuery, queryString);
 
     $("#custom-url-value").value = path;
@@ -2687,7 +2734,7 @@ NetworkDetailsView.prototype = {
    *        The request's url.
    */
   _setRequestGetParams: function(aUrl) {
-    let query = nsIURL(aUrl).query;
+    let query = NetworkHelper.nsIURL(aUrl).query;
     if (query) {
       this._addParams(this._paramsQueryString, query);
     }
@@ -2758,7 +2805,7 @@ NetworkDetailsView.prototype = {
    *        A query string of params (e.g. "?foo=bar&baz=42").
    */
   _addParams: function(aName, aQueryString) {
-    let paramsArray = parseQueryString(aQueryString);
+    let paramsArray = NetworkHelper.parseQueryString(aQueryString);
     if (!paramsArray) {
       return;
     }
@@ -2852,7 +2899,7 @@ NetworkDetailsView.prototype = {
 
       // Immediately display additional information about the image:
       // file name, mime type and encoding.
-      $("#response-content-image-name-value").setAttribute("value", nsIURL(aUrl).fileName);
+      $("#response-content-image-name-value").setAttribute("value", NetworkHelper.nsIURL(aUrl).fileName);
       $("#response-content-image-mime-value").setAttribute("value", mimeType);
       $("#response-content-image-encoding-value").setAttribute("value", encoding);
 
@@ -3284,44 +3331,6 @@ PerformanceStatisticsView.prototype = {
 let $ = (aSelector, aTarget = document) => aTarget.querySelector(aSelector);
 let $all = (aSelector, aTarget = document) => aTarget.querySelectorAll(aSelector);
 
-/**
- * Helper for getting an nsIURL instance out of a string.
- */
-function nsIURL(aUrl, aStore = nsIURL.store) {
-  if (aStore.has(aUrl)) {
-    return aStore.get(aUrl);
-  }
-  let uri = Services.io.newURI(aUrl, null, null).QueryInterface(Ci.nsIURL);
-  aStore.set(aUrl, uri);
-  return uri;
-}
-nsIURL.store = new Map();
-
-/**
- * Parse a url's query string into its components
- *
- * @param string aQueryString
- *        The query part of a url
- * @return array
- *         Array of query params {name, value}
- */
-function parseQueryString(aQueryString) {
-  // Make sure there's at least one param available.
-  // Be careful here, params don't necessarily need to have values, so
-  // no need to verify the existence of a "=".
-  if (!aQueryString) {
-    return;
-  }
-  // Turn the params string into an array containing { name: value } tuples.
-  let paramsArray = aQueryString.replace(/^[?&]/, "").split("&").map(e => {
-    let param = e.split("=");
-    return {
-      name: param[0] ? NetworkHelper.convertToUnicode(unescape(param[0])) : "",
-      value: param[1] ? NetworkHelper.convertToUnicode(unescape(param[1])) : ""
-    }});
-  return paramsArray;
-}
-
 /**
  * Parse text representation of multiple HTTP headers.
  *
diff --git a/browser/devtools/netmonitor/netmonitor.xul b/browser/devtools/netmonitor/netmonitor.xul
index 37ef9987bc97..63458710221c 100644
--- a/browser/devtools/netmonitor/netmonitor.xul
+++ b/browser/devtools/netmonitor/netmonitor.xul
@@ -55,6 +55,16 @@
       <menuitem id="request-menu-context-copy-image-as-data-uri"
                 label="&netmonitorUI.context.copyImageAsDataUri;"
                 accesskey="&netmonitorUI.context.copyImageAsDataUri.accesskey;"/>
+      <menuseparator class="request-menu-context-separator"/>
+      <menuitem id="request-menu-context-copy-all-as-har"
+                label="&netmonitorUI.context.copyAllAsHar;"
+                accesskey="&netmonitorUI.context.copyAllAsHar.accesskey;"
+                oncommand="NetMonitorView.RequestsMenu.copyAllAsHar();"/>
+      <menuitem id="request-menu-context-save-all-as-har"
+                label="&netmonitorUI.context.saveAllAsHar;"
+                accesskey="&netmonitorUI.context.saveAllAsHar.accesskey;"
+                oncommand="NetMonitorView.RequestsMenu.saveAllAsHar();"/>
+      <menuseparator class="request-menu-context-separator"/>
       <menuitem id="request-menu-context-resend"
                 label="&netmonitorUI.summary.editAndResend;"
                 accesskey="&netmonitorUI.summary.editAndResend.accesskey;"/>
diff --git a/browser/devtools/netmonitor/test/html_har_post-data-test-page.html b/browser/devtools/netmonitor/test/html_har_post-data-test-page.html
new file mode 100644
index 000000000000..050ea55d1106
--- /dev/null
+++ b/browser/devtools/netmonitor/test/html_har_post-data-test-page.html
@@ -0,0 +1,33 @@
+<!-- Any copyright is dedicated to the Public Domain.
+     http://creativecommons.org/publicdomain/zero/1.0/ -->
+<!doctype html>
+
+<html>
+  <head>
+    <meta charset="utf-8"/>
+    <meta http-equiv="Cache-Control" content="no-cache, no-store, must-revalidate" />
+    <meta http-equiv="Pragma" content="no-cache" />
+    <meta http-equiv="Expires" content="0" />
+    <title>Network Monitor Test Page</title>
+  </head>
+
+  <body>
+    <p>HAR POST data test</p>
+
+    <script type="text/javascript">
+      function post(aAddress, aData) {
+        var xhr = new XMLHttpRequest();
+        xhr.open("POST", aAddress, true);
+        xhr.setRequestHeader("Content-Type", "application/json");
+        xhr.send(aData);
+      }
+
+      function executeTest() {
+        var url = "sjs_simple-test-server.sjs";
+        var data = "{'first': 'John', 'last': 'Doe'}";
+        post(url, data);
+      }
+    </script>
+  </body>
+
+</html>
diff --git a/browser/devtools/performance/modules/logic/front.js b/browser/devtools/performance/modules/logic/front.js
index 621e1d31dc27..b7e0377d9ff9 100644
--- a/browser/devtools/performance/modules/logic/front.js
+++ b/browser/devtools/performance/modules/logic/front.js
@@ -23,21 +23,14 @@ loader.lazyRequireGetter(this, "DevToolsUtils",
 loader.lazyImporter(this, "gDevTools",
   "resource:///modules/devtools/gDevTools.jsm");
 
-// Events to pipe from PerformanceActorsConnection to the PerformanceFront
-const CONNECTION_PIPE_EVENTS = [
-  "timeline-data", "profiler-already-active", "profiler-activated",
-  "recording-starting", "recording-started", "recording-stopping", "recording-stopped",
-  "profiler-status"
-];
-
 /**
- * A cache of all PerformanceActorsConnection instances.
+ * A cache of all PerformanceFront instances.
  * The keys are Target objects.
  */
-let SharedPerformanceActors = new WeakMap();
+let PerformanceFronts = new WeakMap();
 
 /**
- * Instantiates a shared PerformanceActorsConnection for the specified target.
+ * Instantiates a shared PerformanceFront for the specified target.
  * Consumers must yield on `open` to make sure the connection is established.
  *
  * @param Target target
@@ -45,12 +38,12 @@ let SharedPerformanceActors = new WeakMap();
  * @return PerformanceActorsConnection
  *         The shared connection for the specified target.
  */
-SharedPerformanceActors.forTarget = function(target) {
+PerformanceFronts.forTarget = function(target) {
   if (this.has(target)) {
     return this.get(target);
   }
 
-  let instance = new PerformanceActorsConnection(target);
+  let instance = new PerformanceFront(target);
   this.set(target, instance);
   return instance;
 };
@@ -59,13 +52,13 @@ SharedPerformanceActors.forTarget = function(target) {
  * A connection to underlying actors (profiler, memory, framerate, etc.)
  * shared by all tools in a target.
  *
- * Use `SharedPerformanceActors.forTarget` to make sure you get the same
+ * Use `PerformanceFronts.forTarget` to make sure you get the same
  * instance every time, and the `PerformanceFront` to start/stop recordings.
  *
  * @param Target target
  *        The target owning this connection.
  */
-function PerformanceActorsConnection(target) {
+function PerformanceFront (target) {
   EventEmitter.decorate(this);
 
   this._target = target;
@@ -74,17 +67,17 @@ function PerformanceActorsConnection(target) {
   this._sitesPullTimeout = 0;
   this._recordings = [];
 
-  this._pipeToConnection = this._pipeToConnection.bind(this);
+  this._pipeToFront = this._pipeToFront.bind(this);
   this._onTimelineData = this._onTimelineData.bind(this);
   this._onConsoleProfileStart = this._onConsoleProfileStart.bind(this);
   this._onConsoleProfileEnd = this._onConsoleProfileEnd.bind(this);
   this._onProfilerStatus = this._onProfilerStatus.bind(this);
   this._onProfilerUnexpectedlyStopped = this._onProfilerUnexpectedlyStopped.bind(this);
 
-  Services.obs.notifyObservers(null, "performance-actors-connection-created", null);
+  Services.obs.notifyObservers(null, "performance-tools-connection-created", null);
 }
 
-PerformanceActorsConnection.prototype = {
+PerformanceFront.prototype = {
 
   // Properties set based off of server actor support
   _memorySupported: true,
@@ -117,7 +110,7 @@ PerformanceActorsConnection.prototype = {
     yield this._registerListeners();
 
     this._connecting.resolve();
-    Services.obs.notifyObservers(null, "performance-actors-connection-opened", null);
+    Services.obs.notifyObservers(null, "performance-tools-connection-opened", null);
   }),
 
   /**
@@ -172,8 +165,8 @@ PerformanceActorsConnection.prototype = {
     this._profiler.on("console-profile-start", this._onConsoleProfileStart);
     this._profiler.on("console-profile-end", this._onConsoleProfileEnd);
     this._profiler.on("profiler-stopped", this._onProfilerUnexpectedlyStopped);
-    this._profiler.on("profiler-already-active", this._pipeToConnection);
-    this._profiler.on("profiler-activated", this._pipeToConnection);
+    this._profiler.on("profiler-already-active", this._pipeToFront);
+    this._profiler.on("profiler-activated", this._pipeToFront);
     this._profiler.on("profiler-status", this._onProfilerStatus);
   },
 
@@ -186,8 +179,8 @@ PerformanceActorsConnection.prototype = {
     this._profiler.off("console-profile-start", this._onConsoleProfileStart);
     this._profiler.off("console-profile-end", this._onConsoleProfileEnd);
     this._profiler.off("profiler-stopped", this._onProfilerUnexpectedlyStopped);
-    this._profiler.off("profiler-already-active", this._pipeToConnection);
-    this._profiler.off("profiler-activated", this._pipeToConnection);
+    this._profiler.off("profiler-already-active", this._pipeToFront);
+    this._profiler.off("profiler-activated", this._pipeToFront);
     this._profiler.off("profiler-status", this._onProfilerStatus);
   },
 
@@ -413,78 +406,6 @@ PerformanceActorsConnection.prototype = {
     return model;
   }),
 
-  /**
-   * Checks all currently stored recording models and returns a boolean
-   * if there is a session currently being recorded.
-   *
-   * @return Boolean
-   */
-  isRecording: function () {
-    return this._recordings.some(recording => recording.isRecording());
-  },
-
-  /**
-   * An event from an underlying actor that we just want
-   * to pipe to the connection itself.
-   */
-  _pipeToConnection: function (eventName, ...args) {
-    this.emit(eventName, ...args);
-  },
-
-  toString: () => "[object PerformanceActorsConnection]"
-};
-
-/**
- * A thin wrapper around a shared PerformanceActorsConnection for the parent target.
- * Handles manually starting and stopping a recording.
- *
- * @param PerformanceActorsConnection connection
- *        The shared instance for the parent target.
- */
-function PerformanceFront(connection) {
-  EventEmitter.decorate(this);
-
-  this._connection = connection;
-
-  // Set when mocks are being used
-  this._memorySupported = connection._memorySupported;
-  this._timelineSupported = connection._timelineSupported;
-
-  // Pipe the console profile events from the connection
-  // to the front so that the UI can listen.
-  CONNECTION_PIPE_EVENTS.forEach(eventName => this._connection.on(eventName, () => this.emit.apply(this, arguments)));
-}
-
-PerformanceFront.prototype = {
-
-  /**
-   * Manually begins a recording session and creates a RecordingModel.
-   * Calls the underlying PerformanceActorsConnection's startRecording method.
-   *
-   * @param object options
-   *        An options object to pass to the actors. Supported properties are
-   *        `withTicks`, `withMemory` and `withAllocations`,
-   *        `probability` and `maxLogLength`.
-   * @return object
-   *         A promise that is resolved once recording has started.
-   */
-  startRecording: function (options) {
-    return this._connection.startRecording(options);
-  },
-
-  /**
-   * Manually ends the recording session for the corresponding RecordingModel.
-   * Calls the underlying PerformanceActorsConnection's
-   *
-   * @param RecordingModel model
-   *        The corresponding RecordingModel that belongs to the recording session wished to stop.
-   * @return RecordingModel
-   *         Returns the same model, populated with the profiling data.
-   */
-  stopRecording: function (model) {
-    return this._connection.stopRecording(model);
-  },
-
   /**
    * Returns an object indicating what server actors are available and
    * initialized. A falsy value indicates that the server does not support
@@ -498,22 +419,32 @@ PerformanceFront.prototype = {
   },
 
   /**
-   * Returns a boolean indicating whether or not the current performance connection is recording.
+   * Checks all currently stored recording models and returns a boolean
+   * if there is a session currently being recorded.
    *
    * @return Boolean
    */
   isRecording: function () {
-    return this._connection.isRecording();
+    return this._recordings.some(recording => recording.isRecording());
   },
 
   /**
-   * Interacts with the connection's actors. Should only be used in tests.
+   * An event from an underlying actor that we just want
+   * to pipe to the front itself.
+   */
+  _pipeToFront: function (eventName, ...args) {
+    this.emit(eventName, ...args);
+  },
+
+  /**
+   * Helper method to interface with the underlying actors directly.
+   * Used only in tests.
    */
   _request: function (actorName, method, ...args) {
     if (!gDevTools.testing) {
       throw new Error("PerformanceFront._request may only be used in tests.");
     }
-    let actor = this._connection[`_${actorName}`];
+    let actor = this[`_${actorName}`];
     return actor[method].apply(actor, args);
   },
 
@@ -528,11 +459,11 @@ function getRecordingModelPrefs () {
     withMarkers: true,
     withMemory: Services.prefs.getBoolPref("devtools.performance.ui.enable-memory"),
     withTicks: Services.prefs.getBoolPref("devtools.performance.ui.enable-framerate"),
-    withAllocations: Services.prefs.getBoolPref("devtools.performance.ui.enable-memory"),
+    withAllocations: Services.prefs.getBoolPref("devtools.performance.ui.enable-allocations"),
     allocationsSampleProbability: +Services.prefs.getCharPref("devtools.performance.memory.sample-probability"),
     allocationsMaxLogLength: Services.prefs.getIntPref("devtools.performance.memory.max-log-length")
   };
 }
 
-exports.getPerformanceActorsConnection = t => SharedPerformanceActors.forTarget(t);
+exports.getPerformanceFront = t => PerformanceFronts.forTarget(t);
 exports.PerformanceFront = PerformanceFront;
diff --git a/browser/devtools/performance/panel.js b/browser/devtools/performance/panel.js
index ead6533a6698..98ad08fd645e 100644
--- a/browser/devtools/performance/panel.js
+++ b/browser/devtools/performance/panel.js
@@ -36,14 +36,20 @@ PerformancePanel.prototype = {
     this.panelWin.gTarget = this.target;
     this._onRecordingStartOrStop = this._onRecordingStartOrStop.bind(this);
 
-    // Connection is already created in the toolbox; reuse
-    // the same connection.
-    this._connection = this.panelWin.gToolbox.getPerformanceActorsConnection();
-    // The toolbox will also open the connection, but attempt to open it again
-    // incase it's still in the process of opening.
-    yield this._connection.open();
+    // Actor is already created in the toolbox; reuse
+    // the same front, and the toolbox will also initialize the front,
+    // but redo it here so we can hook into the same event to prevent race conditions
+    // in the case of the front still being in the process of opening.
+    let front = yield this.panelWin.gToolbox.initPerformance();
 
-    this.panelWin.gFront = new PerformanceFront(this._connection);
+    // This should only happen if this is completely unsupported (when profiler
+    // does not exist), and in that case, the tool shouldn't be available,
+    // so let's ensure this assertion.
+    if (!front) {
+      Cu.reportError("No PerformanceFront found in toolbox.");
+    }
+
+    this.panelWin.gFront = front;
     this.panelWin.gFront.on("recording-started", this._onRecordingStartOrStop);
     this.panelWin.gFront.on("recording-stopped", this._onRecordingStartOrStop);
 
diff --git a/browser/devtools/performance/performance-controller.js b/browser/devtools/performance/performance-controller.js
index 70d8ceed45ac..feea881ec52f 100644
--- a/browser/devtools/performance/performance-controller.js
+++ b/browser/devtools/performance/performance-controller.js
@@ -154,7 +154,7 @@ const EVENTS = {
 };
 
 /**
- * The current target and the profiler connection, set by this tool's host.
+ * The current target, toolbox and PerformanceFront, set by this tool's host.
  */
 let gToolbox, gTarget, gFront;
 
@@ -297,7 +297,7 @@ let PerformanceController = {
       withMarkers: true,
       withMemory: this.getOption("enable-memory"),
       withTicks: this.getOption("enable-framerate"),
-      withAllocations: this.getOption("enable-memory"),
+      withAllocations: this.getOption("enable-allocations"),
       allocationsSampleProbability: this.getPref("memory-sample-probability"),
       allocationsMaxLogLength: this.getPref("memory-max-log-length"),
       bufferSize: this.getPref("profiler-buffer-size"),
@@ -458,6 +458,7 @@ let PerformanceController = {
     if (state !== "recording-starting" && this.getRecordings().indexOf(model) === -1) {
       return;
     }
+
     switch (state) {
       // Fired when a RecordingModel was just created from the front
       case "recording-starting":
diff --git a/browser/devtools/performance/performance-view.js b/browser/devtools/performance/performance-view.js
index 884e05e96958..ad58f44b33bc 100644
--- a/browser/devtools/performance/performance-view.js
+++ b/browser/devtools/performance/performance-view.js
@@ -49,13 +49,12 @@ let PerformanceView = {
     this._onRecordButtonClick = this._onRecordButtonClick.bind(this);
     this._onImportButtonClick = this._onImportButtonClick.bind(this);
     this._onClearButtonClick = this._onClearButtonClick.bind(this);
-    this._lockRecordButtons = this._lockRecordButtons.bind(this);
-    this._unlockRecordButtons = this._unlockRecordButtons.bind(this);
     this._onRecordingSelected = this._onRecordingSelected.bind(this);
-    this._onRecordingStopped = this._onRecordingStopped.bind(this);
-    this._onRecordingStarted = this._onRecordingStarted.bind(this);
     this._onProfilerStatusUpdated = this._onProfilerStatusUpdated.bind(this);
+    this._onRecordingWillStart = this._onRecordingWillStart.bind(this);
+    this._onRecordingStarted = this._onRecordingStarted.bind(this);
     this._onRecordingWillStop = this._onRecordingWillStop.bind(this);
+    this._onRecordingStopped = this._onRecordingStopped.bind(this);
 
     for (let button of $$(".record-button")) {
       button.addEventListener("click", this._onRecordButtonClick);
@@ -64,11 +63,12 @@ let PerformanceView = {
     this._clearButton.addEventListener("click", this._onClearButtonClick);
 
     // Bind to controller events to unlock the record button
-    PerformanceController.on(EVENTS.RECORDING_STARTED, this._onRecordingStarted);
-    PerformanceController.on(EVENTS.RECORDING_STOPPED, this._onRecordingStopped);
     PerformanceController.on(EVENTS.RECORDING_SELECTED, this._onRecordingSelected);
     PerformanceController.on(EVENTS.PROFILER_STATUS_UPDATED, this._onProfilerStatusUpdated);
+    PerformanceController.on(EVENTS.RECORDING_WILL_START, this._onRecordingWillStart);
+    PerformanceController.on(EVENTS.RECORDING_STARTED, this._onRecordingStarted);
     PerformanceController.on(EVENTS.RECORDING_WILL_STOP, this._onRecordingWillStop);
+    PerformanceController.on(EVENTS.RECORDING_STOPPED, this._onRecordingStopped);
 
     this.setState("empty");
 
@@ -90,11 +90,12 @@ let PerformanceView = {
     this._importButton.removeEventListener("click", this._onImportButtonClick);
     this._clearButton.removeEventListener("click", this._onClearButtonClick);
 
-    PerformanceController.off(EVENTS.RECORDING_STARTED, this._onRecordingStarted);
-    PerformanceController.off(EVENTS.RECORDING_STOPPED, this._onRecordingStopped);
     PerformanceController.off(EVENTS.RECORDING_SELECTED, this._onRecordingSelected);
     PerformanceController.off(EVENTS.PROFILER_STATUS_UPDATED, this._onProfilerStatusUpdated);
+    PerformanceController.off(EVENTS.RECORDING_WILL_START, this._onRecordingWillStart);
+    PerformanceController.off(EVENTS.RECORDING_STARTED, this._onRecordingStarted);
     PerformanceController.off(EVENTS.RECORDING_WILL_STOP, this._onRecordingWillStop);
+    PerformanceController.off(EVENTS.RECORDING_STOPPED, this._onRecordingStopped);
 
     yield ToolbarView.destroy();
     yield RecordingsView.destroy();
@@ -177,21 +178,45 @@ let PerformanceView = {
   },
 
   /**
-   * Adds the `locked` attribute on the record button. This prevents it
-   * from being clicked while recording is started or stopped.
+   * Toggles the `locked` attribute on the record buttons based
+   * on `lock`.
+   *
+   * @param {boolean} lock
    */
-  _lockRecordButtons: function () {
+  _lockRecordButtons: function (lock) {
     for (let button of $$(".record-button")) {
-      button.setAttribute("locked", "true");
+      if (lock) {
+        button.setAttribute("locked", "true");
+      } else {
+        button.removeAttribute("locked");
+      }
+    }
+  },
+
+  /*
+   * Toggles the `checked` attribute on the record buttons based
+   * on `activate`.
+   *
+   * @param {boolean} activate
+   */
+  _activateRecordButtons: function (activate) {
+    for (let button of $$(".record-button")) {
+      if (activate) {
+        button.setAttribute("checked", "true");
+      } else {
+        button.removeAttribute("checked");
+      }
     }
   },
 
   /**
-   * Removes the `locked` attribute on the record button.
+   * Fired when a recording is just starting, but actors may not have
+   * yet started actually recording.
    */
-  _unlockRecordButtons: function () {
-    for (let button of $$(".record-button")) {
-      button.removeAttribute("locked");
+  _onRecordingWillStart: function (_, recording) {
+    if (!recording.isConsole()) {
+      this._lockRecordButtons(true);
+      this._activateRecordButtons(true);
     }
   },
 
@@ -202,13 +227,28 @@ let PerformanceView = {
     // A stopped recording can be from `console.profileEnd` -- only unlock
     // the button if it's the main recording that was started via UI.
     if (!recording.isConsole()) {
-      this._unlockRecordButtons();
+      this._lockRecordButtons(false);
     }
     if (recording.isRecording()) {
       this.updateBufferStatus();
     }
   },
 
+  /**
+   * Fired when a recording is stopping, but not yet completed
+   */
+  _onRecordingWillStop: function (_, recording) {
+    if (!recording.isConsole()) {
+      this._lockRecordButtons(true);
+      this._activateRecordButtons(false);
+    }
+    // Lock the details view while the recording is being loaded in the UI.
+    // Only do this if this is the current recording.
+    if (recording === PerformanceController.getCurrentRecording()) {
+      this.setState("loading");
+    }
+  },
+
   /**
    * When a recording is complete.
    */
@@ -216,7 +256,7 @@ let PerformanceView = {
     // A stopped recording can be from `console.profileEnd` -- only unlock
     // the button if it's the main recording that was started via UI.
     if (!recording.isConsole()) {
-      this._unlockRecordButtons();
+      this._lockRecordButtons(false);
     }
 
     // If the currently selected recording is the one that just stopped,
@@ -226,17 +266,6 @@ let PerformanceView = {
     }
   },
 
-  /**
-   * Fired when a recording is stopping, but not yet completed
-   */
-  _onRecordingWillStop: function (_, recording) {
-    // Lock the details view while the recording is being loaded in the UI.
-    // Only do this if this is the current recording.
-    if (recording === PerformanceController.getCurrentRecording()) {
-      this.setState("loading");
-    }
-  },
-
   /**
    * Handler for clicking the clear button.
    */
@@ -250,15 +279,7 @@ let PerformanceView = {
   _onRecordButtonClick: function (e) {
     if (this._recordButton.hasAttribute("checked")) {
       this.emit(EVENTS.UI_STOP_RECORDING);
-      this._lockRecordButtons();
-      for (let button of $$(".record-button")) {
-        button.removeAttribute("checked");
-      }
     } else {
-      this._lockRecordButtons();
-      for (let button of $$(".record-button")) {
-        button.setAttribute("checked", "true");
-      }
       this.emit(EVENTS.UI_START_RECORDING);
     }
   },
diff --git a/browser/devtools/performance/performance.xul b/browser/devtools/performance/performance.xul
index 0b5226cbb1ef..5efaa81a2e73 100644
--- a/browser/devtools/performance/performance.xul
+++ b/browser/devtools/performance/performance.xul
@@ -43,6 +43,12 @@
                 data-pref="enable-memory"
                 label="&profilerUI.enableMemory;"
                 tooltiptext="&profilerUI.enableMemory.tooltiptext;"/>
+      <menuitem id="option-enable-allocations"
+                class="experimental-option"
+                type="checkbox"
+                data-pref="enable-allocations"
+                label="&profilerUI.enableAllocations;"
+                tooltiptext="&profilerUI.enableAllocations.tooltiptext;"/>
       <menuitem id="option-enable-framerate"
                 type="checkbox"
                 data-pref="enable-framerate"
diff --git a/browser/devtools/performance/test/browser_perf-clear-02.js b/browser/devtools/performance/test/browser_perf-clear-02.js
index f633af0a134e..2eab3ef1794f 100644
--- a/browser/devtools/performance/test/browser_perf-clear-02.js
+++ b/browser/devtools/performance/test/browser_perf-clear-02.js
@@ -3,7 +3,7 @@
 
 /**
  * Tests that clearing recordings empties out the recordings list and stops
- * a current recording if recording.
+ * a current recording if recording and can continue recording after.
  */
 
 let test = Task.async(function*() {
@@ -29,6 +29,10 @@ let test = Task.async(function*() {
   is(PerformanceController.getCurrentRecording(), null,
     "There should be no current recording.");
 
+  // bug 1169146: Try another recording after clearing mid-recording
+  yield startRecording(panel);
+  yield stopRecording(panel);
+
   yield teardown(panel);
   finish();
 });
diff --git a/browser/devtools/performance/test/browser_perf-compatibility-01.js b/browser/devtools/performance/test/browser_perf-compatibility-01.js
index 88549fa7fe9e..dc45184d04cd 100644
--- a/browser/devtools/performance/test/browser_perf-compatibility-01.js
+++ b/browser/devtools/performance/test/browser_perf-compatibility-01.js
@@ -13,6 +13,7 @@ function* spawnTest() {
     TEST_MOCK_TIMELINE_ACTOR: true
   });
   Services.prefs.setBoolPref(MEMORY_PREF, true);
+  Services.prefs.setBoolPref(ALLOCATIONS_PREF, true);
 
   let { memory, timeline } = front.getActorSupport();
   ok(!memory, "memory should be mocked.");
diff --git a/browser/devtools/performance/test/browser_perf-compatibility-03.js b/browser/devtools/performance/test/browser_perf-compatibility-03.js
index 6a14ace41959..e639232565f4 100644
--- a/browser/devtools/performance/test/browser_perf-compatibility-03.js
+++ b/browser/devtools/performance/test/browser_perf-compatibility-03.js
@@ -12,6 +12,7 @@ function* spawnTest() {
     TEST_MOCK_MEMORY_ACTOR: true
   });
   Services.prefs.setBoolPref(MEMORY_PREF, true);
+  Services.prefs.setBoolPref(ALLOCATIONS_PREF, true);
 
   let { memory, timeline } = front.getActorSupport();
   ok(!memory, "memory should be mocked.");
diff --git a/browser/devtools/performance/test/browser_perf-compatibility-05.js b/browser/devtools/performance/test/browser_perf-compatibility-05.js
index 724c00a47617..38dbef9b7ee7 100644
--- a/browser/devtools/performance/test/browser_perf-compatibility-05.js
+++ b/browser/devtools/performance/test/browser_perf-compatibility-05.js
@@ -12,10 +12,9 @@ const WAIT_TIME = 1000; // ms
 function* spawnTest() {
   let { panel } = yield initPerformance(SIMPLE_URL);
   let { gFront: front, gTarget: target } = panel.panelWin;
-  let connection = getPerformanceActorsConnection(target);
 
   // Explicitly override the profiler's trait `filterable`
-  connection._profiler.traits.filterable = false;
+  front._profiler.traits.filterable = false;
 
   // Ugly, but we need to also not send the startTime to the server
   // so we don't filter it both on the server and client
diff --git a/browser/devtools/performance/test/browser_perf-compatibility-06.js b/browser/devtools/performance/test/browser_perf-compatibility-06.js
index 66039b991ded..834ef76b7350 100644
--- a/browser/devtools/performance/test/browser_perf-compatibility-06.js
+++ b/browser/devtools/performance/test/browser_perf-compatibility-06.js
@@ -16,7 +16,7 @@ function* spawnTest() {
   let model = yield front.startRecording();
   let count = 0;
   while (count < 5) {
-    let [_, stats] = yield onceSpread(front._connection._profiler, "profiler-status");
+    let [_, stats] = yield onceSpread(front._profiler, "profiler-status");
     is(stats.generation, void 0, "profiler-status has void `generation`");
     is(stats.totalSize, void 0, "profiler-status has void `totalSize`");
     is(stats.position, void 0, "profiler-status has void `position`");
diff --git a/browser/devtools/performance/test/browser_perf-compatibility-07.js b/browser/devtools/performance/test/browser_perf-compatibility-07.js
index 3a0a02e0e0c8..9e3e10cca649 100644
--- a/browser/devtools/performance/test/browser_perf-compatibility-07.js
+++ b/browser/devtools/performance/test/browser_perf-compatibility-07.js
@@ -14,11 +14,11 @@ function* spawnTest() {
 
   yield startRecording(panel);
 
-  yield once(front._connection._profiler, "profiler-status");
+  yield once(front._profiler, "profiler-status");
   ok(!$("#details-pane-container").getAttribute("buffer-status"),
     "container does not have [buffer-status] attribute when not supported");
 
-  yield once(front._connection._profiler, "profiler-status");
+  yield once(front._profiler, "profiler-status");
   ok(!$("#details-pane-container").getAttribute("buffer-status"),
     "container does not have [buffer-status] attribute when not supported");
 
diff --git a/browser/devtools/performance/test/browser_perf-console-record-01.js b/browser/devtools/performance/test/browser_perf-console-record-01.js
index 529273f5e1c7..512d8a0e06a5 100644
--- a/browser/devtools/performance/test/browser_perf-console-record-01.js
+++ b/browser/devtools/performance/test/browser_perf-console-record-01.js
@@ -6,21 +6,21 @@
  * before it was opened.
  */
 
-let { getPerformanceActorsConnection } = devtools.require("devtools/performance/front");
+let { getPerformanceFront } = devtools.require("devtools/performance/front");
 let WAIT_TIME = 10;
 
 function* spawnTest() {
   let profilerConnected = waitForProfilerConnection();
   let { target, toolbox, console } = yield initConsole(SIMPLE_URL);
   yield profilerConnected;
-  let connection = getPerformanceActorsConnection(target);
+  let front = getPerformanceFront(target);
 
-  let profileStart = once(connection, "recording-started");
+  let profileStart = once(front, "recording-started");
   console.profile("rust");
   yield profileStart;
 
   busyWait(WAIT_TIME);
-  let profileEnd = once(connection, "recording-stopped");
+  let profileEnd = once(front, "recording-stopped");
   console.profileEnd("rust");
   yield profileEnd;
 
diff --git a/browser/devtools/performance/test/browser_perf-console-record-02.js b/browser/devtools/performance/test/browser_perf-console-record-02.js
index 3f04703c5faa..dbf224180586 100644
--- a/browser/devtools/performance/test/browser_perf-console-record-02.js
+++ b/browser/devtools/performance/test/browser_perf-console-record-02.js
@@ -6,19 +6,19 @@
  * when it is opened.
  */
 
-let { getPerformanceActorsConnection } = devtools.require("devtools/performance/front");
+let { getPerformanceFront } = devtools.require("devtools/performance/front");
 let WAIT_TIME = 10;
 
 function* spawnTest() {
   let profilerConnected = waitForProfilerConnection();
   let { target, toolbox, console } = yield initConsole(SIMPLE_URL);
   yield profilerConnected;
-  let connection = getPerformanceActorsConnection(target);
+  let front = getPerformanceFront(target);
 
-  let profileStart = once(connection, "recording-started");
+  let profileStart = once(front, "recording-started");
   console.profile("rust");
   yield profileStart;
-  profileStart = once(connection, "recording-started");
+  profileStart = once(front, "recording-started");
   console.profile("rust2");
   yield profileStart;
 
@@ -38,10 +38,10 @@ function* spawnTest() {
   is(RecordingsView.selectedItem.attachment, recordings[0],
     "The first console recording should be selected.");
 
-  let profileEnd = once(connection, "recording-stopped");
+  let profileEnd = once(front, "recording-stopped");
   console.profileEnd("rust");
   yield profileEnd;
-  profileEnd = once(connection, "recording-stopped");
+  profileEnd = once(front, "recording-stopped");
   console.profileEnd("rust2");
   yield profileEnd;
 
diff --git a/browser/devtools/performance/test/browser_perf-console-record-03.js b/browser/devtools/performance/test/browser_perf-console-record-03.js
index 965630052cdd..d134242df0fe 100644
--- a/browser/devtools/performance/test/browser_perf-console-record-03.js
+++ b/browser/devtools/performance/test/browser_perf-console-record-03.js
@@ -6,24 +6,24 @@
  * also console recordings that have finished before it was opened.
  */
 
-let { getPerformanceActorsConnection } = devtools.require("devtools/performance/front");
+let { getPerformanceFront } = devtools.require("devtools/performance/front");
 let WAIT_TIME = 10;
 
 function* spawnTest() {
   let profilerConnected = waitForProfilerConnection();
   let { target, toolbox, console } = yield initConsole(SIMPLE_URL);
   yield profilerConnected;
-  let connection = getPerformanceActorsConnection(target);
+  let front = getPerformanceFront(target);
 
-  let profileStart = once(connection, "recording-started");
+  let profileStart = once(front, "recording-started");
   console.profile("rust");
   yield profileStart;
 
-  let profileEnd = once(connection, "recording-stopped");
+  let profileEnd = once(front, "recording-stopped");
   console.profileEnd("rust");
   yield profileEnd;
 
-  profileStart = once(connection, "recording-started");
+  profileStart = once(front, "recording-started");
   console.profile("rust2");
   yield profileStart;
 
@@ -43,7 +43,7 @@ function* spawnTest() {
   is(RecordingsView.selectedItem.attachment, recordings[0],
     "The first console recording should be selected.");
 
-  profileEnd = once(connection, "recording-stopped");
+  profileEnd = once(front, "recording-stopped");
   console.profileEnd("rust2");
   yield profileEnd;
 
diff --git a/browser/devtools/performance/test/browser_perf-details-03.js b/browser/devtools/performance/test/browser_perf-details-03.js
index dd1ff3ceb4fe..7b77a43e8581 100644
--- a/browser/devtools/performance/test/browser_perf-details-03.js
+++ b/browser/devtools/performance/test/browser_perf-details-03.js
@@ -8,17 +8,17 @@
  */
 function* spawnTest() {
   let { panel } = yield initPerformance(SIMPLE_URL);
-  let { EVENTS, PerformanceController, OverviewView, DetailsView } = panel.panelWin;
+  let { EVENTS, PerformanceController, DetailsView } = panel.panelWin;
   let { $, RecordingsView, WaterfallView, MemoryCallTreeView, MemoryFlameGraphView } = panel.panelWin;
 
-  Services.prefs.setBoolPref(MEMORY_PREF, false);
+  Services.prefs.setBoolPref(ALLOCATIONS_PREF, false);
   yield startRecording(panel);
   yield stopRecording(panel);
 
   ok(DetailsView.isViewSelected(WaterfallView),
     "The waterfall view is selected by default in the details view.");
 
-  Services.prefs.setBoolPref(MEMORY_PREF, true);
+  Services.prefs.setBoolPref(ALLOCATIONS_PREF, true);
   // The toolbar buttons will always be hidden when a recording isn't available,
   // so make sure we have one that's finished.
   yield startRecording(panel);
diff --git a/browser/devtools/performance/test/browser_perf-details-memory-calltree-render.js b/browser/devtools/performance/test/browser_perf-details-memory-calltree-render.js
index 78d7ea4d355a..be67422352c5 100644
--- a/browser/devtools/performance/test/browser_perf-details-memory-calltree-render.js
+++ b/browser/devtools/performance/test/browser_perf-details-memory-calltree-render.js
@@ -9,7 +9,7 @@ function* spawnTest() {
   let { EVENTS, DetailsView, MemoryCallTreeView } = panel.panelWin;
 
   // Enable memory to test.
-  Services.prefs.setBoolPref(MEMORY_PREF, true);
+  Services.prefs.setBoolPref(ALLOCATIONS_PREF, true);
 
   yield startRecording(panel);
   yield busyWait(100);
diff --git a/browser/devtools/performance/test/browser_perf-details-memory-flamegraph-render.js b/browser/devtools/performance/test/browser_perf-details-memory-flamegraph-render.js
index fafac98b3d1a..a299c627a48c 100644
--- a/browser/devtools/performance/test/browser_perf-details-memory-flamegraph-render.js
+++ b/browser/devtools/performance/test/browser_perf-details-memory-flamegraph-render.js
@@ -9,7 +9,7 @@ function* spawnTest() {
   let { EVENTS, DetailsView, MemoryFlameGraphView } = panel.panelWin;
 
   // Enable memory to test.
-  Services.prefs.setBoolPref(MEMORY_PREF, true);
+  Services.prefs.setBoolPref(ALLOCATIONS_PREF, true);
 
   yield startRecording(panel);
   yield busyWait(100);
diff --git a/browser/devtools/performance/test/browser_perf-front-02.js b/browser/devtools/performance/test/browser_perf-front-02.js
index def219ecd29c..96d23fc61195 100644
--- a/browser/devtools/performance/test/browser_perf-front-02.js
+++ b/browser/devtools/performance/test/browser_perf-front-02.js
@@ -10,7 +10,7 @@ let WAIT_TIME = 1000;
 
 function* spawnTest() {
   let { target, front } = yield initBackend(SIMPLE_URL);
-  let config = { withMarkers: true, withMemory: true, withTicks: true };
+  let config = { withMarkers: true, withAllocations: true, withTicks: true };
 
   yield front._request("memory", "attach");
 
diff --git a/browser/devtools/performance/test/browser_perf-highlighted.js b/browser/devtools/performance/test/browser_perf-highlighted.js
index 7a36081c3ed9..52a212a5cab4 100644
--- a/browser/devtools/performance/test/browser_perf-highlighted.js
+++ b/browser/devtools/performance/test/browser_perf-highlighted.js
@@ -6,23 +6,23 @@
  * whether already loaded, or via console.profile with an unloaded performance tools.
  */
 
-let { getPerformanceActorsConnection } = devtools.require("devtools/performance/front");
+let { getPerformanceFront } = devtools.require("devtools/performance/front");
 
 function* spawnTest() {
   let profilerConnected = waitForProfilerConnection();
   let { target, toolbox, console } = yield initConsole(SIMPLE_URL);
   yield profilerConnected;
-  let connection = getPerformanceActorsConnection(target);
+  let front = getPerformanceFront(target);
   let tab = toolbox.doc.getElementById("toolbox-tab-performance");
 
-  let profileStart = once(connection, "recording-started");
+  let profileStart = once(front, "recording-started");
   console.profile("rust");
   yield profileStart;
 
   ok(tab.hasAttribute("highlighted"),
     "performance tab is highlighted during recording from console.profile when unloaded");
 
-  let profileEnd = once(connection, "recording-stopped");
+  let profileEnd = once(front, "recording-stopped");
   console.profileEnd("rust");
   yield profileEnd;
 
diff --git a/browser/devtools/performance/test/browser_perf-options-allocations.js b/browser/devtools/performance/test/browser_perf-options-allocations.js
index 4cb12a86e388..6a0ef9164242 100644
--- a/browser/devtools/performance/test/browser_perf-options-allocations.js
+++ b/browser/devtools/performance/test/browser_perf-options-allocations.js
@@ -8,7 +8,7 @@
 function* spawnTest() {
   let { panel } = yield initPerformance(SIMPLE_URL);
   let { EVENTS, PerformanceController, $, gFront } = panel.panelWin;
-  Services.prefs.setBoolPref(MEMORY_PREF, true);
+  Services.prefs.setBoolPref(ALLOCATIONS_PREF, true);
 
   let originalProbability = Services.prefs.getCharPref(MEMORY_SAMPLE_PROB_PREF);
   let originalLogLength = Services.prefs.getIntPref(MEMORY_MAX_LOG_LEN_PREF);
@@ -25,7 +25,7 @@ function* spawnTest() {
   is(probability, 0.213, "allocations probability option is set on memory actor");
   is(maxLogLength, 777777, "allocations max log length option is set on memory actor");
 
-  Services.prefs.setBoolPref(MEMORY_PREF, false);
+  Services.prefs.setBoolPref(ALLOCATIONS_PREF, false);
   Services.prefs.setCharPref(MEMORY_SAMPLE_PROB_PREF, originalProbability);
   Services.prefs.setIntPref(MEMORY_MAX_LOG_LEN_PREF, originalLogLength);
   yield teardown(panel);
diff --git a/browser/devtools/performance/test/browser_perf-options-enable-memory-01.js b/browser/devtools/performance/test/browser_perf-options-enable-memory-01.js
index 17802a51ed2f..42373e7cd5e0 100644
--- a/browser/devtools/performance/test/browser_perf-options-enable-memory-01.js
+++ b/browser/devtools/performance/test/browser_perf-options-enable-memory-01.js
@@ -30,8 +30,8 @@ function* spawnTest() {
   ok(!$("#memory-overview").hidden, "memory graph is not hidden when memory enabled before recording");
   is(PerformanceController.getCurrentRecording().getConfiguration().withMemory, true,
     "PerformanceFront started with memory recording.");
-  is(PerformanceController.getCurrentRecording().getConfiguration().withAllocations, true,
-    "PerformanceFront started with allocations recording.");
+  is(PerformanceController.getCurrentRecording().getConfiguration().withAllocations, false,
+    "PerformanceFront did not record with allocations.");
 
   yield teardown(panel);
   finish();
diff --git a/browser/devtools/performance/test/browser_perf-options-enable-memory-02.js b/browser/devtools/performance/test/browser_perf-options-enable-memory-02.js
index dd287dac91f3..6c3a03439590 100644
--- a/browser/devtools/performance/test/browser_perf-options-enable-memory-02.js
+++ b/browser/devtools/performance/test/browser_perf-options-enable-memory-02.js
@@ -28,8 +28,8 @@ function* spawnTest() {
 
   is(PerformanceController.getCurrentRecording().getConfiguration().withMemory, true,
     "The recording finished with tracking memory.");
-  is(PerformanceController.getCurrentRecording().getConfiguration().withAllocations, true,
-    "The recording finished with tracking allocations.");
+  is(PerformanceController.getCurrentRecording().getConfiguration().withAllocations, false,
+    "The recording still is not recording allocations.");
 
   yield teardown(panel);
   finish();
diff --git a/browser/devtools/performance/test/browser_perf-options-flatten-tree-recursion-02.js b/browser/devtools/performance/test/browser_perf-options-flatten-tree-recursion-02.js
index 46a846e3e7f3..d765c541d030 100644
--- a/browser/devtools/performance/test/browser_perf-options-flatten-tree-recursion-02.js
+++ b/browser/devtools/performance/test/browser_perf-options-flatten-tree-recursion-02.js
@@ -9,7 +9,7 @@ function* spawnTest() {
   let { EVENTS, PerformanceController, DetailsView, MemoryFlameGraphView, RecordingUtils, FlameGraphUtils } = panel.panelWin;
 
   // Enable memory to test
-  Services.prefs.setBoolPref(MEMORY_PREF, true);
+  Services.prefs.setBoolPref(ALLOCATIONS_PREF, true);
   Services.prefs.setBoolPref(FLATTEN_PREF, true);
 
   yield startRecording(panel);
diff --git a/browser/devtools/performance/test/browser_perf-options-invert-call-tree-02.js b/browser/devtools/performance/test/browser_perf-options-invert-call-tree-02.js
index e7d8ac2d803c..9247921d5dcd 100644
--- a/browser/devtools/performance/test/browser_perf-options-invert-call-tree-02.js
+++ b/browser/devtools/performance/test/browser_perf-options-invert-call-tree-02.js
@@ -9,7 +9,7 @@ function* spawnTest() {
   let { EVENTS, DetailsView, MemoryCallTreeView } = panel.panelWin;
 
   // Enable memory to test
-  Services.prefs.setBoolPref(MEMORY_PREF, true);
+  Services.prefs.setBoolPref(ALLOCATIONS_PREF, true);
   Services.prefs.setBoolPref(INVERT_PREF, true);
 
   yield startRecording(panel);
diff --git a/browser/devtools/performance/test/browser_perf-options-invert-flame-graph-02.js b/browser/devtools/performance/test/browser_perf-options-invert-flame-graph-02.js
index 12a5a3b41011..60f386b8c819 100644
--- a/browser/devtools/performance/test/browser_perf-options-invert-flame-graph-02.js
+++ b/browser/devtools/performance/test/browser_perf-options-invert-flame-graph-02.js
@@ -8,7 +8,7 @@ function* spawnTest() {
   let { panel } = yield initPerformance(SIMPLE_URL);
   let { EVENTS, DetailsView, MemoryFlameGraphView } = panel.panelWin;
 
-  Services.prefs.setBoolPref(MEMORY_PREF, true);
+  Services.prefs.setBoolPref(ALLOCATIONS_PREF, true);
   Services.prefs.setBoolPref(INVERT_FLAME_PREF, true);
 
   yield startRecording(panel);
diff --git a/browser/devtools/performance/test/browser_perf-options-show-idle-blocks-02.js b/browser/devtools/performance/test/browser_perf-options-show-idle-blocks-02.js
index 019627941240..e50549943271 100644
--- a/browser/devtools/performance/test/browser_perf-options-show-idle-blocks-02.js
+++ b/browser/devtools/performance/test/browser_perf-options-show-idle-blocks-02.js
@@ -9,7 +9,7 @@ function* spawnTest() {
   let { EVENTS, DetailsView, MemoryFlameGraphView } = panel.panelWin;
 
   // Enable memory to test
-  Services.prefs.setBoolPref(MEMORY_PREF, true);
+  Services.prefs.setBoolPref(ALLOCATIONS_PREF, true);
   Services.prefs.setBoolPref(IDLE_PREF, true);
 
   yield startRecording(panel);
diff --git a/browser/devtools/performance/test/browser_perf-recording-selected-04.js b/browser/devtools/performance/test/browser_perf-recording-selected-04.js
index fb3dc71d0fd2..d799b91429c9 100644
--- a/browser/devtools/performance/test/browser_perf-recording-selected-04.js
+++ b/browser/devtools/performance/test/browser_perf-recording-selected-04.js
@@ -10,8 +10,9 @@ let test = Task.async(function*() {
   let { target, panel, toolbox } = yield initPerformance(SIMPLE_URL);
   let { $, EVENTS, PerformanceController, DetailsView, DetailsSubview, RecordingsView } = panel.panelWin;
 
-  // Enable memory to test the memory-calltree and memory-flamegraph.
+  // Enable allocations to test the memory-calltree and memory-flamegraph.
   Services.prefs.setBoolPref(MEMORY_PREF, true);
+  Services.prefs.setBoolPref(ALLOCATIONS_PREF, true);
 
   // Need to allow widgets to be updated while hidden, otherwise we can't use
   // `waitForWidgetsRendered`.
diff --git a/browser/devtools/performance/test/browser_perf-shared-connection-02.js b/browser/devtools/performance/test/browser_perf-shared-connection-02.js
index 9b987dafcab3..6e1b46f33201 100644
--- a/browser/devtools/performance/test/browser_perf-shared-connection-02.js
+++ b/browser/devtools/performance/test/browser_perf-shared-connection-02.js
@@ -6,7 +6,7 @@
  */
 
 let gProfilerConnectionsOpened = 0;
-Services.obs.addObserver(profilerConnectionObserver, "performance-actors-connection-opened", false);
+Services.obs.addObserver(profilerConnectionObserver, "performance-tools-connection-opened", false);
 
 function* spawnTest() {
   let { target, panel } = yield initPerformance(SIMPLE_URL);
@@ -14,14 +14,12 @@ function* spawnTest() {
   is(gProfilerConnectionsOpened, 1,
     "Only one profiler connection was opened.");
 
-  let sharedConnection = getPerformanceActorsConnection(target);
+  let front = getPerformanceFront(target);
 
-  ok(sharedConnection,
-    "A shared profiler connection for the current toolbox was retrieved.");
-  is(panel.panelWin.gFront._connection, sharedConnection,
-    "The same shared profiler connection is used by the panel's front.");
+  ok(front, "A front for the current toolbox was retrieved.");
+  is(panel.panelWin.gFront, front, "The same front is used by the panel's front");
 
-  yield sharedConnection.open();
+  yield front.open();
 
   is(gProfilerConnectionsOpened, 1,
     "No additional profiler connections were opened.");
@@ -31,10 +29,10 @@ function* spawnTest() {
 }
 
 function profilerConnectionObserver(subject, topic, data) {
-  is(topic, "performance-actors-connection-opened", "The correct topic was observed.");
+  is(topic, "performance-tools-connection-opened", "The correct topic was observed.");
   gProfilerConnectionsOpened++;
 }
 
 registerCleanupFunction(() => {
-  Services.obs.removeObserver(profilerConnectionObserver, "performance-actors-connection-opened");
+  Services.obs.removeObserver(profilerConnectionObserver, "performance-tools-connection-opened");
 });
diff --git a/browser/devtools/performance/test/browser_perf-states.js b/browser/devtools/performance/test/browser_perf-states.js
index ec602dff497a..9731381d404c 100644
--- a/browser/devtools/performance/test/browser_perf-states.js
+++ b/browser/devtools/performance/test/browser_perf-states.js
@@ -30,6 +30,7 @@ function* spawnTest() {
     "The memory-flamegraph detail view should not have been created yet.");
 
   Services.prefs.setBoolPref(MEMORY_PREF, true);
+  Services.prefs.setBoolPref(ALLOCATIONS_PREF, true);
 
   ok(!(OverviewView.graphs.get("timeline")),
     "The markers graph should still not have been created yet.");
diff --git a/browser/devtools/performance/test/browser_perf_recordings-io-01.js b/browser/devtools/performance/test/browser_perf_recordings-io-01.js
index bee1bd86b431..0e69e0e28d03 100644
--- a/browser/devtools/performance/test/browser_perf_recordings-io-01.js
+++ b/browser/devtools/performance/test/browser_perf_recordings-io-01.js
@@ -9,7 +9,8 @@ let test = Task.async(function*() {
   var { target, panel, toolbox } = yield initPerformance(SIMPLE_URL);
   var { EVENTS, PerformanceController, DetailsView, DetailsSubview } = panel.panelWin;
 
-  // Enable memory to test the memory-calltree and memory-flamegraph.
+  // Enable allocations to test the memory-calltree and memory-flamegraph.
+  Services.prefs.setBoolPref(ALLOCATIONS_PREF, true);
   Services.prefs.setBoolPref(MEMORY_PREF, true);
   Services.prefs.setBoolPref(FRAMERATE_PREF, true);
 
diff --git a/browser/devtools/performance/test/browser_perf_recordings-io-04.js b/browser/devtools/performance/test/browser_perf_recordings-io-04.js
index cf194c0907f6..6417307cd2c0 100644
--- a/browser/devtools/performance/test/browser_perf_recordings-io-04.js
+++ b/browser/devtools/performance/test/browser_perf_recordings-io-04.js
@@ -75,7 +75,7 @@ let test = Task.async(function*() {
   let { $, EVENTS, PerformanceController, DetailsView, OverviewView, JsCallTreeView } = panel.panelWin;
 
   // Enable memory to test the memory-calltree and memory-flamegraph.
-  Services.prefs.setBoolPref(MEMORY_PREF, true);
+  Services.prefs.setBoolPref(ALLOCATIONS_PREF, true);
 
   // Create a structure from the data that mimics the old profiler's data.
   // Different name for `ticks`, different way of storing time,
diff --git a/browser/devtools/performance/test/browser_timeline-waterfall-rerender.js b/browser/devtools/performance/test/browser_timeline-waterfall-rerender.js
index e0c96a35750a..0fc5f1fca555 100644
--- a/browser/devtools/performance/test/browser_timeline-waterfall-rerender.js
+++ b/browser/devtools/performance/test/browser_timeline-waterfall-rerender.js
@@ -24,6 +24,7 @@ function* spawnTest() {
   ok(true, "Recording has ended.");
 
   let initialBarsCount = $$(".waterfall-marker-bar").length;
+  info("Initial bars count: " + initialBarsCount);
 
   // Select a portion of the overview.
   let timeline = OverviewView.graphs.get("timeline");
@@ -40,6 +41,7 @@ function* spawnTest() {
   WaterfallView._markersRoot.getChild(1).focus();
 
   let beforeResizeBarsCount = $$(".waterfall-marker-bar").length;
+  info("Before resize bars count: " + beforeResizeBarsCount);
   ok(beforeResizeBarsCount < initialBarsCount,
     "A subset of the total markers was selected.");
 
@@ -53,6 +55,7 @@ function* spawnTest() {
   yield rerendered;
 
   let afterResizeBarsCount = $$(".waterfall-marker-bar").length;
+  info("After resize bars count: " + afterResizeBarsCount);
   is(afterResizeBarsCount, beforeResizeBarsCount,
     "The same subset of the total markers remained visible.");
 
diff --git a/browser/devtools/performance/test/head.js b/browser/devtools/performance/test/head.js
index 28d025a713ed..9e39e58683e8 100644
--- a/browser/devtools/performance/test/head.js
+++ b/browser/devtools/performance/test/head.js
@@ -14,7 +14,7 @@ let { DevToolsUtils } = Cu.import("resource://gre/modules/devtools/DevToolsUtils
 let { DebuggerServer } = Cu.import("resource://gre/modules/devtools/dbg-server.jsm", {});
 let { merge } = devtools.require("sdk/util/object");
 let { generateUUID } = Cc["@mozilla.org/uuid-generator;1"].getService(Ci.nsIUUIDGenerator);
-let { getPerformanceActorsConnection, PerformanceFront } = devtools.require("devtools/performance/front");
+let { getPerformanceFront, PerformanceFront } = devtools.require("devtools/performance/front");
 let TargetFactory = devtools.TargetFactory;
 
 let mm = null;
@@ -31,6 +31,7 @@ const PROFILER_SAMPLE_RATE_PREF = "devtools.performance.profiler.sample-frequenc
 
 const FRAMERATE_PREF = "devtools.performance.ui.enable-framerate";
 const MEMORY_PREF = "devtools.performance.ui.enable-memory";
+const ALLOCATIONS_PREF = "devtools.performance.ui.enable-allocations";
 
 const PLATFORM_DATA_PREF = "devtools.performance.ui.show-platform-data";
 const IDLE_PREF = "devtools.performance.ui.show-idle-blocks";
@@ -52,6 +53,7 @@ let DEFAULT_PREFS = [
   "devtools.performance.ui.show-platform-data",
   "devtools.performance.ui.show-idle-blocks",
   "devtools.performance.ui.enable-memory",
+  "devtools.performance.ui.enable-allocations",
   "devtools.performance.ui.enable-framerate",
   "devtools.performance.ui.show-jit-optimizations",
   "devtools.performance.memory.sample-probability",
@@ -192,10 +194,8 @@ function initBackend(aUrl, targetOps={}) {
     // TEST_PROFILER_FILTER_STATUS = array
     merge(target, targetOps);
 
-    let connection = getPerformanceActorsConnection(target);
-    yield connection.open();
-
-    let front = new PerformanceFront(connection);
+    let front = getPerformanceFront(target);
+    yield front.open();
     return { target, front };
   });
 }
@@ -264,9 +264,9 @@ function consoleExecute (console, method, val) {
 
 function waitForProfilerConnection() {
   let { promise, resolve } = Promise.defer();
-  Services.obs.addObserver(resolve, "performance-actors-connection-opened", false);
+  Services.obs.addObserver(resolve, "performance-tools-connection-opened", false);
   return promise.then(() =>
-    Services.obs.removeObserver(resolve, "performance-actors-connection-opened"));
+    Services.obs.removeObserver(resolve, "performance-tools-connection-opened"));
 }
 
 function* teardown(panel) {
@@ -346,12 +346,13 @@ function* startRecording(panel, options = {
   click(win, button);
   yield clicked;
 
+  yield willStart;
+
   ok(button.hasAttribute("checked"),
     "The record button should now be checked.");
   ok(button.hasAttribute("locked"),
     "The record button should be locked.");
 
-  yield willStart;
   let stateChanged = options.waitForStateChanged
     ? once(win.PerformanceView, win.EVENTS.UI_STATE_CHANGED)
     : Promise.resolve();
@@ -393,12 +394,12 @@ function* stopRecording(panel, options = {
   click(win, button);
   yield clicked;
 
+  yield willStop;
   ok(!button.hasAttribute("checked"),
     "The record button should not be checked.");
   ok(button.hasAttribute("locked"),
     "The record button should be locked.");
 
-  yield willStop;
   let stateChanged = options.waitForStateChanged
     ? once(win.PerformanceView, win.EVENTS.UI_STATE_CHANGED)
     : Promise.resolve();
diff --git a/browser/devtools/shared/test/browser_outputparser.js b/browser/devtools/shared/test/browser_outputparser.js
index 61d82ca14c68..315f61a4f87a 100644
--- a/browser/devtools/shared/test/browser_outputparser.js
+++ b/browser/devtools/shared/test/browser_outputparser.js
@@ -1,8 +1,11 @@
 /* Any copyright is dedicated to the Public Domain.
    http://creativecommons.org/publicdomain/zero/1.0/ */
 
+"use strict";
+
 let {Services} = Cu.import("resource://gre/modules/Services.jsm", {});
-let {Loader} = Cu.import("resource://gre/modules/commonjs/toolkit/loader.js", {});
+let {Loader} = Cu.import("resource://gre/modules/commonjs/toolkit/loader.js",
+                         {});
 let {OutputParser} = devtools.require("devtools/output-parser");
 
 add_task(function*() {
@@ -12,7 +15,7 @@ add_task(function*() {
 });
 
 function* performTest() {
-  let [host, win, doc] = yield createHost("bottom", "data:text/html," +
+  let [host, , doc] = yield createHost("bottom", "data:text/html," +
     "<h1>browser_outputParser.js</h1><div></div>");
 
   let parser = new OutputParser();
@@ -23,7 +26,7 @@ function* performTest() {
 }
 
 // Class name used in color swatch.
-let COLOR_TEST_CLASS = 'test-class';
+let COLOR_TEST_CLASS = "test-class";
 
 // Create a new CSS color-parsing test.  |name| is the name of the CSS
 // property.  |value| is the CSS text to use.  |segments| is an array
@@ -42,17 +45,17 @@ function makeColorTest(name, value, segments) {
   let result = {
     name,
     value,
-    expected: ''
+    expected: ""
   };
 
   for (let segment of segments) {
-    if (typeof(segment) === 'string') {
+    if (typeof (segment) === "string") {
       result.expected += segment;
     } else {
-      result.expected += '<span data-color="' + segment.value + '">' +
-        '<span style="background-color:' + segment.name +
-        '" class="' + COLOR_TEST_CLASS + '"></span><span>' +
-        segment.value + '</span></span>';
+      result.expected += "<span data-color=\"" + segment.value + "\">" +
+        "<span style=\"background-color:" + segment.name +
+        "\" class=\"" + COLOR_TEST_CLASS + "\"></span><span>" +
+        segment.value + "</span></span>";
     }
   }
 
@@ -84,19 +87,18 @@ function testParseCssProperty(doc, parser) {
                    ", 2px 2px 0 0 ",
                    {name: "rgba(0,0,0,.5)", value: "rgba(0,0,0,.5)"}]),
 
-    makeColorTest("content", '"red"', ['"red"']),
+    makeColorTest("content", "\"red\"", ["\"red\""]),
 
     // Invalid property names should not cause exceptions.
     makeColorTest("hellothere", "'red'", ["'red'"]),
 
-    // This requires better parsing than we currently have available.
-    // See bug 1158288.
-    // makeColorTest("filter",
-    //               "blur(1px) drop-shadow(0 0 0 blue) url(red.svg#blue)",
-    //               ["blur(1px) drop-shadow(0 0 0 ",
-    //                {name: "blue", value: "#00F"},
-    //                ") url(red.svg#blue)"])
-
+    makeColorTest("filter",
+                  "blur(1px) drop-shadow(0 0 0 blue) url(red.svg#blue)",
+                  ["<span data-filters=\"blur(1px) drop-shadow(0 0 0 blue) ",
+                   "url(red.svg#blue)\"><span>",
+                   "blur(1px) drop-shadow(0 0 0 ",
+                   {name: "blue", value: "#00F"},
+                   ") url(\"red.svg#blue\")</span></span>"])
   ];
 
   let target = doc.querySelector("div");
@@ -127,7 +129,8 @@ function testParseCssVar(doc, parser) {
   ok(target, "captain, we have the div");
   target.appendChild(frag);
 
-  is(target.innerHTML, "var(--some-kind-of-green)", "CSS property correctly parsed");
+  is(target.innerHTML, "var(--some-kind-of-green)",
+     "CSS property correctly parsed");
 
   target.innerHTML = "";
 }
diff --git a/browser/devtools/shared/widgets/Tooltip.js b/browser/devtools/shared/widgets/Tooltip.js
index 98e8eefc9b4d..b96e26b45715 100644
--- a/browser/devtools/shared/widgets/Tooltip.js
+++ b/browser/devtools/shared/widgets/Tooltip.js
@@ -4,12 +4,14 @@
 
 "use strict";
 
-const {Cc, Cu, Ci} = require("chrome");
+/* globals beautify, setNamedTimeout, clearNamedTimeout, VariablesView,
+   VariablesViewController, Task */
+
+const {Cu, Ci} = require("chrome");
 const {Promise: promise} = Cu.import("resource://gre/modules/Promise.jsm", {});
-const IOService = Cc["@mozilla.org/network/io-service;1"]
-  .getService(Ci.nsIIOService);
 const {Spectrum} = require("devtools/shared/widgets/Spectrum");
-const {CubicBezierWidget} = require("devtools/shared/widgets/CubicBezierWidget");
+const {CubicBezierWidget} =
+      require("devtools/shared/widgets/CubicBezierWidget");
 const {MdnDocsWidget} = require("devtools/shared/widgets/MdnDocsWidget");
 const {CSSFilterEditorWidget} = require("devtools/shared/widgets/FilterWidget");
 const EventEmitter = require("devtools/toolkit/event-emitter");
@@ -37,7 +39,8 @@ XPCOMUtils.defineLazyModuleGetter(this, "Task",
 
 const XHTML_NS = "http://www.w3.org/1999/xhtml";
 const SPECTRUM_FRAME = "chrome://browser/content/devtools/spectrum-frame.xhtml";
-const CUBIC_BEZIER_FRAME = "chrome://browser/content/devtools/cubic-bezier-frame.xhtml";
+const CUBIC_BEZIER_FRAME =
+      "chrome://browser/content/devtools/cubic-bezier-frame.xhtml";
 const MDN_DOCS_FRAME = "chrome://browser/content/devtools/mdn-docs-frame.xhtml";
 const FILTER_FRAME = "chrome://browser/content/devtools/filter-frame.xhtml";
 const ESCAPE_KEYCODE = Ci.nsIDOMKeyEvent.DOM_VK_ESCAPE;
@@ -87,9 +90,8 @@ OptionsStore.prototype = {
   get: function(name) {
     if (typeof this.options[name] !== "undefined") {
       return this.options[name];
-    } else {
-      return this.defaults[name];
     }
+    return this.defaults[name];
   }
 };
 
@@ -111,7 +113,8 @@ let PanelFactory = {
     panel.setAttribute("ignorekeys", true);
     panel.setAttribute("animate", false);
 
-    panel.setAttribute("consumeoutsideclicks", options.get("consumeOutsideClick"));
+    panel.setAttribute("consumeoutsideclicks",
+                       options.get("consumeOutsideClick"));
     panel.setAttribute("noautofocus", options.get("noAutoFocus"));
     panel.setAttribute("type", "arrow");
     panel.setAttribute("level", "top");
@@ -152,11 +155,13 @@ let PanelFactory = {
  *        Defaults to false.
  *        - closeOnKeys {Array} An array of key codes that should close the
  *        tooltip. Defaults to [27] (escape key).
- *        - closeOnEvents [{emitter: {Object}, event: {String}, useCapture: {Boolean}}]
+ *        - closeOnEvents [{emitter: {Object}, event: {String},
+ *                          useCapture: {Boolean}}]
  *        Provide an optional list of emitter objects and event names here to
  *        trigger the closing of the tooltip when these events are fired by the
- *        emitters. The emitter objects should either implement on/off(event, cb)
- *        or addEventListener/removeEventListener(event, cb). Defaults to [].
+ *        emitters. The emitter objects should either implement
+ *        on/off(event, cb) or addEventListener/removeEventListener(event, cb).
+ *        Defaults to [].
  *        For instance, the following would close the tooltip whenever the
  *        toolbox selects a new tool and when a DOM node gets scrolled:
  *        new Tooltip(doc, {
@@ -236,9 +241,12 @@ module.exports.Tooltip = Tooltip;
 
 Tooltip.prototype = {
   defaultPosition: "before_start",
-  defaultOffsetX: 0, // px
-  defaultOffsetY: 0, // px
-  defaultShowDelay: 50, // ms
+  // px
+  defaultOffsetX: 0,
+  // px
+  defaultOffsetY: 0,
+  // px
+  defaultShowDelay: 50,
 
   /**
    * Show the tooltip. It might be wise to append some content first if you
@@ -306,7 +314,7 @@ Tooltip.prototype = {
   /**
    * Get rid of references and event listeners
    */
-  destroy: function () {
+  destroy: function() {
     this.hide();
 
     for (let eventName of POPUP_EVENTS) {
@@ -374,7 +382,8 @@ Tooltip.prototype = {
    *        An optional delay that will be observed before showing the tooltip.
    *        Defaults to this.defaultShowDelay.
    */
-  startTogglingOnHover: function(baseNode, targetNodeCb, showDelay=this.defaultShowDelay) {
+  startTogglingOnHover: function(baseNode, targetNodeCb,
+                                 showDelay=this.defaultShowDelay) {
     if (this._basedNode) {
       this.stopTogglingOnHover();
     }
@@ -455,10 +464,9 @@ Tooltip.prototype = {
       return res.then(arg => {
         return arg instanceof Ci.nsIDOMNode ? arg : target;
       });
-    } else {
-      let newTarget = res instanceof Ci.nsIDOMNode ? res : target;
-      return res ? promise.resolve(newTarget) : promise.reject(false);
     }
+    let newTarget = res instanceof Ci.nsIDOMNode ? res : target;
+    return res ? promise.resolve(newTarget) : promise.reject(false);
   },
 
   _onBaseNodeMouseLeave: function() {
@@ -585,14 +593,12 @@ Tooltip.prototype = {
    *        Pass the instance of the current toolbox if you want the variables
    *        view widget to allow highlighting and selection of DOM nodes
    */
-  setVariableContent: function(
-    objectActor,
-    viewOptions = {},
-    controllerOptions = {},
-    relayEvents = {},
-    extraButtons = [],
-    toolbox = null) {
-
+  setVariableContent: function(objectActor,
+                               viewOptions = {},
+                               controllerOptions = {},
+                               relayEvents = {},
+                               extraButtons = [],
+                               toolbox = null) {
     let vbox = this.doc.createElement("vbox");
     vbox.className = "devtools-tooltip-variables-view-box";
     vbox.setAttribute("flex", "1");
@@ -643,13 +649,15 @@ Tooltip.prototype = {
    * @return a promise that resolves when the image is shown in the tooltip or
    * resolves when the broken image tooltip content is ready, but never rejects.
    */
-  setRelativeImageContent: Task.async(function*(imageUrl, inspectorFront, maxDim) {
+  setRelativeImageContent: Task.async(function*(imageUrl, inspectorFront,
+                                                maxDim) {
     if (imageUrl.startsWith("data:")) {
       // If the imageUrl already is a data-url, save ourselves a round-trip
       this.setImageContent(imageUrl, {maxDim: maxDim});
     } else if (inspectorFront) {
       try {
-        let {data, size} = yield inspectorFront.getImageDataFromURL(imageUrl, maxDim);
+        let {data, size} = yield inspectorFront.getImageDataFromURL(imageUrl,
+                                                                    maxDim);
         size.maxDim = maxDim;
         let str = yield data.string();
         this.setImageContent(str, size);
@@ -716,12 +724,13 @@ Tooltip.prototype = {
           options.naturalHeight);
       } else {
         // If no dimensions were provided, load the image to get them
-        label.textContent = l10n.strings.GetStringFromName("previewTooltip.image.brokenImage");
+        label.textContent =
+          l10n.strings.GetStringFromName("previewTooltip.image.brokenImage");
         let imgObj = new this.doc.defaultView.Image();
         imgObj.src = imageUrl;
         imgObj.onload = () => {
           imgObj.onload = null;
-            label.textContent = this._getImageDimensionLabel(imgObj.naturalWidth,
+          label.textContent = this._getImageDimensionLabel(imgObj.naturalWidth,
               imgObj.naturalHeight);
         };
       }
@@ -759,7 +768,6 @@ Tooltip.prototype = {
    * and resolves the promise with the content window.
    */
   setIFrameContent: function({width, height}, url) {
-
     let def = promise.defer();
 
     // Create an iframe
@@ -810,8 +818,7 @@ Tooltip.prototype = {
       // Finalize spectrum's init when the tooltip becomes visible
       if (panel.state == "open") {
         finalizeSpectrum();
-      }
-      else {
+      } else {
         panel.addEventListener("popupshown", function shown() {
           panel.removeEventListener("popupshown", shown, true);
           finalizeSpectrum();
@@ -869,7 +876,7 @@ Tooltip.prototype = {
 
       iframe.height = doc.offsetHeight;
 
-      widget.on("render", e => {
+      widget.on("render", () => {
         iframe.height = doc.offsetHeight;
       });
 
@@ -888,7 +895,8 @@ Tooltip.prototype = {
 
   /**
    * Set the content of the tooltip to display a font family preview.
-   * This is based on Lea Verou's Dablet. See https://github.com/LeaVerou/dabblet
+   * This is based on Lea Verou's Dablet.
+   * See https://github.com/LeaVerou/dabblet
    * for more info.
    * @param {String} font The font family value.
    * @param {object} nodeFront
@@ -899,7 +907,7 @@ Tooltip.prototype = {
    */
   setFontFamilyContent: Task.async(function*(font, nodeFront) {
     if (!font || !nodeFront) {
-      throw "Missing font";
+      throw new Error("Missing font");
     }
 
     if (typeof nodeFront.getFontFamilyDataURL === "function") {
@@ -907,8 +915,9 @@ Tooltip.prototype = {
       font = font.replace("!important", "");
       font = font.trim();
 
-      let fillStyle = (Services.prefs.getCharPref("devtools.theme") === "light") ?
-        "black" : "white";
+      let fillStyle =
+          (Services.prefs.getCharPref("devtools.theme") === "light") ?
+          "black" : "white";
 
       let {data, size} = yield nodeFront.getFontFamilyDataURL(font, fillStyle);
       let str = yield data.string();
@@ -989,7 +998,8 @@ SwatchBasedEditorTooltip.prototype = {
 
       // When the tooltip is closed by clicking outside the panel we want to
       // commit any changes. Because the "hidden" event destroys the tooltip we
-      // need to do this before the tooltip is destroyed (in the "hiding" event).
+      // need to do this before the tooltip is destroyed (in the "hiding"
+      // event).
       this.tooltip.once("hiding", () => {
         if (!this._reverted && !this.eyedropperOpen) {
           this.commit();
@@ -1020,15 +1030,22 @@ SwatchBasedEditorTooltip.prototype = {
    * @param {object} callbacks
    *        Callbacks that will be executed when the editor wants to preview a
    *        value change, or revert a change, or commit a change.
-   *        - onPreview: will be called when one of the sub-classes calls preview
+   *        - onPreview: will be called when one of the sub-classes calls
+   *        preview
    *        - onRevert: will be called when the user ESCapes out of the tooltip
    *        - onCommit: will be called when the user presses ENTER or clicks
    *        outside the tooltip.
    */
   addSwatch: function(swatchEl, callbacks={}) {
-    if (!callbacks.onPreview) callbacks.onPreview = function() {};
-    if (!callbacks.onRevert) callbacks.onRevert = function() {};
-    if (!callbacks.onCommit) callbacks.onCommit = function() {};
+    if (!callbacks.onPreview) {
+      callbacks.onPreview = function() {};
+    }
+    if (!callbacks.onRevert) {
+      callbacks.onRevert = function() {};
+    }
+    if (!callbacks.onCommit) {
+      callbacks.onCommit = function() {};
+    }
 
     this.swatches.set(swatchEl, {
       callbacks: callbacks
@@ -1264,7 +1281,8 @@ EventTooltip.prototype = {
         let debuggerIcon = doc.createElement("image");
         debuggerIcon.className = "event-tooltip-debugger-icon";
         debuggerIcon.setAttribute("src", "chrome://browser/skin/devtools/tool-debugger.svg");
-        let openInDebugger = l10n.strings.GetStringFromName("eventsTooltip.openInDebugger");
+        let openInDebugger =
+            l10n.strings.GetStringFromName("eventsTooltip.openInDebugger");
         debuggerIcon.setAttribute("tooltiptext", openInDebugger);
         header.appendChild(debuggerIcon);
       }
@@ -1287,7 +1305,8 @@ EventTooltip.prototype = {
       }
 
       let attributesContainer = doc.createElement("hbox");
-      attributesContainer.setAttribute("class", "event-tooltip-attributes-container");
+      attributesContainer.setAttribute("class",
+                                       "event-tooltip-attributes-container");
       header.appendChild(attributesContainer);
 
       if (!listener.hide.capturing) {
@@ -1347,7 +1366,8 @@ EventTooltip.prototype = {
     }
 
     this._tooltip.content = container;
-    this._tooltip.panel.setAttribute("clamped-dimensions-no-max-or-min-height", "");
+    this._tooltip.panel.setAttribute("clamped-dimensions-no-max-or-min-height",
+                                     "");
     this._tooltip.panel.setAttribute("wide", "");
 
     this._tooltip.panel.addEventListener("popuphiding", () => {
@@ -1453,11 +1473,11 @@ EventTooltip.prototype = {
               // there is only one possible match in the file.
               if (index !== -1 && index === lastIndex) {
                 text = text.substr(0, index);
-                let matches = text.match(/\n/g);
+                let newlineMatches = text.match(/\n/g);
 
-                if (matches) {
+                if (newlineMatches) {
                   DebuggerView.editor.setCursor({
-                    line: matches.length
+                    line: newlineMatches.length
                   });
                 }
               }
@@ -1479,7 +1499,8 @@ EventTooltip.prototype = {
 
   destroy: function(container) {
     if (this._tooltip) {
-      this._tooltip.panel.removeEventListener("popuphiding", this.destroy, false);
+      this._tooltip.panel.removeEventListener("popuphiding", this.destroy,
+                                              false);
 
       let boxes = container.querySelectorAll(".event-tooltip-content-box");
 
@@ -1498,7 +1519,8 @@ EventTooltip.prototype = {
       node.removeEventListener("click", this._headerClicked);
     }
 
-    let sourceNodes = container.querySelectorAll(".event-tooltip-debugger-icon");
+    let sourceNodes =
+        container.querySelectorAll(".event-tooltip-debugger-icon");
     for (let node of sourceNodes) {
       node.removeEventListener("click", this._debugClicked);
     }
@@ -1538,7 +1560,6 @@ SwatchCubicBezierTooltip.prototype = Heritage.extend(SwatchBasedEditorTooltip.pr
     // Then set the curve and listen to changes to preview them
     if (this.activeSwatch) {
       this.currentBezierValue = this.activeSwatch.nextSibling;
-      let swatch = this.swatches.get(this.activeSwatch);
       this.widget.then(widget => {
         widget.off("updated", this._onUpdate);
         widget.cssCubicBezierValue = this.currentBezierValue.textContent;
@@ -1588,7 +1609,6 @@ CssDocsTooltip.prototype = {
    * then display the tooltip.
    */
   show: function(anchor, propertyName) {
-
     function loadCssDocs(widget) {
       return widget.loadCssDocs(propertyName);
     }
@@ -1607,8 +1627,8 @@ CssDocsTooltip.prototype = {
 };
 
 /**
- * The swatch-based css filter tooltip class is a specific class meant to be used
- * along with rule-view's generated css filter swatches.
+ * The swatch-based css filter tooltip class is a specific class meant to be
+ * used along with rule-view's generated css filter swatches.
  * It extends the parent SwatchBasedEditorTooltip class.
  * It just wraps a standard Tooltip and sets its content with an instance of a
  * CSSFilterEditorWidget.
@@ -1647,7 +1667,14 @@ SwatchFilterTooltip.prototype = Heritage.extend(SwatchBasedEditorTooltip.prototy
       return;
     }
 
-    this.currentFilterValue.textContent = filters;
+    // Remove the old children and reparse the property value to
+    // recompute them.
+    while (this.currentFilterValue.firstChild) {
+      this.currentFilterValue.firstChild.remove();
+    }
+    let node = this._parser.parseCssProperty("filter", filters, this._options);
+    this.currentFilterValue.appendChild(node);
+
     this.preview();
   },
 
@@ -1658,6 +1685,27 @@ SwatchFilterTooltip.prototype = Heritage.extend(SwatchBasedEditorTooltip.prototy
       widget.off("updated", this._onUpdate);
       widget.destroy();
     });
+  },
+
+  /**
+   * Like SwatchBasedEditorTooltip.addSwatch, but accepts a parser object
+   * to use when previewing the updated property value.
+   *
+   * @param {node} swatchEl
+   *        @see SwatchBasedEditorTooltip.addSwatch
+   * @param {object} callbacks
+   *        @see SwatchBasedEditorTooltip.addSwatch
+   * @param {object} parser
+   *        A parser object; @see OutputParser object
+   * @param {object} options
+   *        options to pass to the output parser, with
+   *          the option |filterSwatch| set.
+   */
+  addSwatch: function(swatchEl, callbacks, parser, options) {
+    SwatchBasedEditorTooltip.prototype.addSwatch.call(this, swatchEl,
+                                                      callbacks);
+    this._parser = parser;
+    this._options = options;
   }
 });
 
diff --git a/browser/devtools/styleinspector/rule-view.js b/browser/devtools/styleinspector/rule-view.js
index 3edfa1237ad7..134ce5fe1ec4 100644
--- a/browser/devtools/styleinspector/rule-view.js
+++ b/browser/devtools/styleinspector/rule-view.js
@@ -4,17 +4,21 @@
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
 
+/* globals clipboardHelper, _strings, domUtils, AutocompletePopup */
+
 "use strict";
 
 const {Cc, Ci, Cu} = require("chrome");
 const {Promise: promise} = Cu.import("resource://gre/modules/Promise.jsm", {});
 const {CssLogic} = require("devtools/styleinspector/css-logic");
-const {InplaceEditor, editableField, editableItem} = require("devtools/shared/inplace-editor");
-const {ELEMENT_STYLE, PSEUDO_ELEMENTS} = require("devtools/server/actors/styles");
-const {gDevTools} = Cu.import("resource:///modules/devtools/gDevTools.jsm", {});
+const {InplaceEditor, editableField, editableItem} =
+      require("devtools/shared/inplace-editor");
+const {ELEMENT_STYLE, PSEUDO_ELEMENTS} =
+      require("devtools/server/actors/styles");
 const {OutputParser} = require("devtools/output-parser");
 const {PrefObserver, PREF_ORIG_SOURCES} = require("devtools/styleeditor/utils");
-const {parseSingleValue, parseDeclarations} = require("devtools/styleinspector/css-parsing-utils");
+const {parseSingleValue, parseDeclarations} =
+      require("devtools/styleinspector/css-parsing-utils");
 const overlays = require("devtools/styleinspector/style-inspector-overlays");
 const EventEmitter = require("devtools/toolkit/event-emitter");
 
@@ -25,7 +29,8 @@ const HTML_NS = "http://www.w3.org/1999/xhtml";
 const XUL_NS = "http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul";
 const PREF_UA_STYLES = "devtools.inspector.showUserAgentStyles";
 const PREF_DEFAULT_COLOR_UNIT = "devtools.defaultColorUnit";
-const PREF_ENABLE_MDN_DOCS_TOOLTIP = "devtools.inspector.mdnDocsTooltip.enabled";
+const PREF_ENABLE_MDN_DOCS_TOOLTIP =
+      "devtools.inspector.mdnDocsTooltip.enabled";
 const PROPERTY_NAME_CLASS = "ruleview-propertyname";
 const FILTER_CHANGED_TIMEOUT = 150;
 
@@ -47,7 +52,7 @@ function promiseWarn(err) {
  * This function creates the document in which those dummy elements
  * will be created.
  */
-var gDummyPromise;
+let gDummyPromise;
 function createDummyDocument() {
   if (gDummyPromise) {
     return gDummyPromise;
@@ -63,11 +68,12 @@ function createDummyDocument() {
   });
   let docShell = getDocShell(frame);
   let eventTarget = docShell.chromeEventHandler;
-  docShell.createAboutBlankContentViewer(Cc["@mozilla.org/nullprincipal;1"].createInstance(Ci.nsIPrincipal));
+  docShell.createAboutBlankContentViewer(Cc["@mozilla.org/nullprincipal;1"]
+                                         .createInstance(Ci.nsIPrincipal));
   let window = docShell.contentViewer.DOMDocument.defaultView;
   window.location = "data:text/html,<html></html>";
   let deferred = promise.defer();
-  eventTarget.addEventListener("DOMContentLoaded", function handler(event) {
+  eventTarget.addEventListener("DOMContentLoaded", function handler() {
     eventTarget.removeEventListener("DOMContentLoaded", handler, false);
     deferred.resolve(window.document);
     frame.remove();
@@ -141,19 +147,20 @@ ElementStyle.prototype = {
   // to figure out how shorthand properties will be parsed.
   dummyElement: null,
 
-  init: function()
-  {
+  init: function() {
     // To figure out how shorthand properties are interpreted by the
     // engine, we will set properties on a dummy element and observe
     // how their .style attribute reflects them as computed values.
-    return this.dummyElementPromise = createDummyDocument().then(document => {
+    this.dummyElementPromise = createDummyDocument().then(document => {
       // ::before and ::after do not have a namespaceURI
-      let namespaceURI = this.element.namespaceURI || document.documentElement.namespaceURI;
+      let namespaceURI = this.element.namespaceURI ||
+          document.documentElement.namespaceURI;
       this.dummyElement = document.createElementNS(namespaceURI,
                                                    this.element.tagName);
       document.documentElement.appendChild(this.dummyElement);
       return this.dummyElement;
     }).then(null, promiseWarn);
+    return this.dummyElementPromise;
   },
 
   destroy: function() {
@@ -239,9 +246,9 @@ ElementStyle.prototype = {
    * Put pseudo elements in front of others.
    */
    _sortRulesForPseudoElement: function() {
-      this.rules = this.rules.sort((a, b) => {
-        return (a.pseudoElement || "z") > (b.pseudoElement || "z");
-      });
+     this.rules = this.rules.sort((a, b) => {
+       return (a.pseudoElement || "z") > (b.pseudoElement || "z");
+     });
    },
 
   /**
@@ -457,7 +464,8 @@ Rule.prototype = {
       this._title += ":" + this.ruleLine;
     }
 
-    this._title = this._title + (this.mediaText ? " @media " + this.mediaText : "");
+    this._title = this._title +
+      (this.mediaText ? " @media " + this.mediaText : "");
     return this._title;
   },
 
@@ -472,7 +480,8 @@ Rule.prototype = {
         eltText += "#" + this.inherited.id;
       }
       this._inheritedSource =
-        CssLogic._strings.formatStringFromName("rule.inheritedFrom", [eltText], 1);
+        CssLogic._strings.formatStringFromName("rule.inheritedFrom",
+                                               [eltText], 1);
     }
     return this._inheritedSource;
   },
@@ -484,13 +493,15 @@ Rule.prototype = {
     this._keyframesName = "";
     if (this.keyframes) {
       this._keyframesName =
-        CssLogic._strings.formatStringFromName("rule.keyframe", [this.keyframes.name], 1);
+        CssLogic._strings.formatStringFromName("rule.keyframe",
+                                               [this.keyframes.name], 1);
     }
     return this._keyframesName;
   },
 
   get selectorText() {
-    return this.domRule.selectors ? this.domRule.selectors.join(", ") : CssLogic.l10n("rule.sourceElement");
+    return this.domRule.selectors ? this.domRule.selectors.join(", ") :
+      CssLogic.l10n("rule.sourceElement");
   },
 
   /**
@@ -530,7 +541,8 @@ Rule.prototype = {
       let mediaString = mediaText ? " @" + mediaText : "";
 
       let sourceStrings = {
-        full: (href || CssLogic.l10n("rule.sourceInline")) + ":" + line + mediaString,
+        full: (href || CssLogic.l10n("rule.sourceInline")) + ":" +
+          line + mediaString,
         short: CssLogic.shortSource({href: href}) + ":" + line + mediaString
       };
 
@@ -568,8 +580,7 @@ Rule.prototype = {
     if (aSiblingProp) {
       let ind = this.textProps.indexOf(aSiblingProp);
       this.textProps.splice(ind + 1, 0, prop);
-    }
-    else {
+    } else {
       this.textProps.push(prop);
     }
 
@@ -594,7 +605,6 @@ Rule.prototype = {
       aModifications = this.style.startModifyingProperties();
     }
     let disabledProps = [];
-    let store = this.elementStyle.store;
 
     for (let prop of this.textProps) {
       if (!prop.enabled) {
@@ -760,7 +770,8 @@ Rule.prototype = {
       if (this.inherited && !domUtils.isInheritedProperty(name)) {
         continue;
       }
-      let value = store.userProperties.getProperty(this.style, name, prop.value);
+      let value = store.userProperties.getProperty(this.style, name,
+                                                   prop.value);
       let textProp = new TextProperty(this, name, value, prop.priority);
       textProps.push(textProp);
     }
@@ -783,7 +794,8 @@ Rule.prototype = {
     let textProps = [];
 
     for (let prop of disabledProps) {
-      let value = store.userProperties.getProperty(this.style, prop.name, prop.value);
+      let value = store.userProperties.getProperty(this.style, prop.name,
+                                                   prop.value);
       let textProp = new TextProperty(this, prop.name, value, prop.priority);
       textProp.enabled = false;
       textProps.push(textProp);
@@ -862,8 +874,9 @@ Rule.prototype = {
     let match = { rank: 0, prop: null };
 
     for (let prop of this.textProps) {
-      if (prop.name != aNewProp.name)
+      if (prop.name != aNewProp.name) {
         continue;
+      }
 
       // Mark this property visited.
       prop._visited = true;
@@ -928,8 +941,7 @@ Rule.prototype = {
     if (index === this.textProps.length - 1) {
       index = index - 1;
       previous = true;
-    }
-    else {
+    } else {
       index = index + 1;
     }
 
@@ -1017,7 +1029,7 @@ TextProperty.prototype = {
     } catch(e) {
       // This is a partial property name, probably from cutting and pasting
       // text. At this point don't check for computed properties.
-     }
+    }
   },
 
   /**
@@ -1129,14 +1141,16 @@ function CssRuleView(aInspector, aDoc, aStore, aPageStyle) {
   this._onFilterStyles = this._onFilterStyles.bind(this);
   this._onFilterKeyPress = this._onFilterKeyPress.bind(this);
   this._onClearSearch = this._onClearSearch.bind(this);
-  this._onFilterTextboxContextMenu = this._onFilterTextboxContextMenu.bind(this);
+  this._onFilterTextboxContextMenu =
+    this._onFilterTextboxContextMenu.bind(this);
   this._onTogglePseudoClassPanel = this._onTogglePseudoClassPanel.bind(this);
   this._onTogglePseudoClass = this._onTogglePseudoClass.bind(this);
 
   this.element = this.doc.getElementById("ruleview-container");
   this.addRuleButton = this.doc.getElementById("ruleview-add-rule-button");
   this.searchField = this.doc.getElementById("ruleview-searchbox");
-  this.searchClearButton = this.doc.getElementById("ruleview-searchinput-clear");
+  this.searchClearButton =
+    this.doc.getElementById("ruleview-searchinput-clear");
   this.pseudoClassPanel = this.doc.getElementById("pseudo-class-panel");
   this.pseudoClassToggle = this.doc.getElementById("pseudo-class-panel-toggle");
   this.hoverCheckbox = this.doc.getElementById("pseudo-hover-toggle");
@@ -1150,9 +1164,11 @@ function CssRuleView(aInspector, aDoc, aStore, aPageStyle) {
   this.addRuleButton.addEventListener("click", this._onAddRule);
   this.searchField.addEventListener("input", this._onFilterStyles);
   this.searchField.addEventListener("keypress", this._onFilterKeyPress);
-  this.searchField.addEventListener("contextmenu", this._onFilterTextboxContextMenu);
+  this.searchField.addEventListener("contextmenu",
+                                    this._onFilterTextboxContextMenu);
   this.searchClearButton.addEventListener("click", this._onClearSearch);
-  this.pseudoClassToggle.addEventListener("click", this._onTogglePseudoClassPanel);
+  this.pseudoClassToggle.addEventListener("click",
+                                          this._onTogglePseudoClassPanel);
   this.hoverCheckbox.addEventListener("click", this._onTogglePseudoClass);
   this.activeCheckbox.addEventListener("click", this._onTogglePseudoClass);
   this.focusCheckbox.addEventListener("click", this._onTogglePseudoClass);
@@ -1167,7 +1183,8 @@ function CssRuleView(aInspector, aDoc, aStore, aPageStyle) {
   this._prefObserver.on(PREF_ENABLE_MDN_DOCS_TOOLTIP, this._handlePrefChange);
 
   this.showUserAgentStyles = Services.prefs.getBoolPref(PREF_UA_STYLES);
-  this.enableMdnDocsTooltip = Services.prefs.getBoolPref(PREF_ENABLE_MDN_DOCS_TOOLTIP);
+  this.enableMdnDocsTooltip =
+    Services.prefs.getBoolPref(PREF_ENABLE_MDN_DOCS_TOOLTIP);
 
   let options = {
     autoSelect: true,
@@ -1271,10 +1288,11 @@ CssRuleView.prototype = {
 
     try {
       let h = yield utils.getHighlighterByType("SelectorHighlighter");
-      return this.selectorHighlighter = h;
+      this.selectorHighlighter = h;
+      return h;
     } catch (e) {
-      // The SelectorHighlighter type could not be created in the current target.
-      // It could be an older server, or a XUL page.
+      // The SelectorHighlighter type could not be created in the
+      // current target.  It could be an older server, or a XUL page.
       return null;
     }
   }),
@@ -1368,7 +1386,7 @@ CssRuleView.prototype = {
     this.menuitemCopyImageDataUrl.hidden = !this._isImageUrlPopup();
     this.menuitemCopy.disabled = !copy;
 
-    var showOrig = Services.prefs.getBoolPref(PREF_ORIG_SOURCES);
+    let showOrig = Services.prefs.getBoolPref(PREF_ORIG_SOURCES);
     this.menuitemSources.setAttribute("checked", showOrig);
 
     this.menuitemShowMdnDocs.hidden = !this.enableMdnDocsTooltip ||
@@ -1416,7 +1434,8 @@ CssRuleView.prototype = {
         pseudoElement: prop.rule.pseudoElement,
         sheetHref: prop.rule.domRule.href
       };
-    } else if (classes.contains("theme-link") && !classes.contains("ruleview-rule-source") && prop) {
+    } else if (classes.contains("theme-link") &&
+               !classes.contains("ruleview-rule-source") && prop) {
       type = overlays.VIEW_NODE_IMAGE_URL_TYPE;
       value = {
         property: getPropertyNameAndValue(node).name,
@@ -1445,7 +1464,7 @@ CssRuleView.prototype = {
    * @return {Boolean}
    *         true if click on color opened the popup, false otherwise.
    */
-  _isColorPopup: function () {
+  _isColorPopup: function() {
     this._colorToCopy = "";
 
     let container = this._getPopupNodeContainer();
@@ -1462,7 +1481,7 @@ CssRuleView.prototype = {
       }
     }
 
-    this._colorToCopy = container.dataset["color"];
+    this._colorToCopy = container.dataset.color;
     return true;
   },
 
@@ -1470,7 +1489,7 @@ CssRuleView.prototype = {
    * Check if the context menu popup was opened with a click on an image link
    * If true, save the image url to this._imageUrlToCopy
    */
-  _isImageUrlPopup: function () {
+  _isImageUrlPopup: function() {
     this._imageUrlToCopy = "";
 
     let container = this._getPopupNodeContainer();
@@ -1487,20 +1506,21 @@ CssRuleView.prototype = {
    * @param {DOMNode} node The node which we want information about
    * @return {Boolean} true if the node is an image url
    */
-  _isImageUrlNode: function (node) {
+  _isImageUrlNode: function(node) {
     let nodeInfo = this.getNodeInfo(node);
     if (!nodeInfo) {
-      return false
+      return false;
     }
     return nodeInfo.type == overlays.VIEW_NODE_IMAGE_URL_TYPE;
   },
 
   /**
    * Get the DOM Node container for the current popupNode.
-   * If popupNode is a textNode, return the parent node, otherwise return popupNode itself.
+   * If popupNode is a textNode, return the parent node, otherwise
+  *  return popupNode itself.
    * @return {DOMNode}
    */
-  _getPopupNodeContainer: function () {
+  _getPopupNodeContainer: function() {
     let container = null;
     let node = this.doc.popupNode;
 
@@ -1587,7 +1607,8 @@ CssRuleView.prototype = {
   },
 
   /**
-   * Retrieve the image data for the selected image url and copy it to the clipboard
+   * Retrieve the image data for the selected image url and copy it to
+  *  the clipboard
    */
   _onCopyImageDataUrl: Task.async(function*() {
     let message;
@@ -1596,7 +1617,8 @@ CssRuleView.prototype = {
       let data = yield inspectorFront.getImageDataFromURL(this._imageUrlToCopy);
       message = yield data.data.string();
     } catch (e) {
-      message = _strings.GetStringFromName("styleinspector.copyImageDataUrlError");
+      message =
+        _strings.GetStringFromName("styleinspector.copyImageDataUrlError");
     }
 
     clipboardHelper.copyString(message);
@@ -1628,12 +1650,13 @@ CssRuleView.prototype = {
     let element = elementStyle.element;
     let rules = elementStyle.rules;
     let client = this.inspector.toolbox._target.client;
+    let pseudoClasses = element.pseudoClassLocks;
 
     if (!client.traits.addNewRule) {
       return;
     }
 
-    this.pageStyle.addNewRule(element).then(options => {
+    this.pageStyle.addNewRule(element, pseudoClasses).then(options => {
       let newRule = new Rule(elementStyle, options);
       rules.push(newRule);
       let editor = new RuleEditor(this, newRule);
@@ -1782,7 +1805,8 @@ CssRuleView.prototype = {
     this._prefObserver.off(PREF_ORIG_SOURCES, this._onSourcePrefChanged);
     this._prefObserver.off(PREF_UA_STYLES, this._handlePrefChange);
     this._prefObserver.off(PREF_DEFAULT_COLOR_UNIT, this._handlePrefChange);
-    this._prefObserver.off(PREF_ENABLE_MDN_DOCS_TOOLTIP, this._handlePrefChange);
+    this._prefObserver.off(PREF_ENABLE_MDN_DOCS_TOOLTIP,
+                           this._handlePrefChange);
     this._prefObserver.destroy();
 
     this._outputParser = null;
@@ -1810,11 +1834,13 @@ CssRuleView.prototype = {
       this.menuitemCopyImageDataUrl.removeEventListener("command", this._onCopyImageDataUrl);
       this.menuitemCopyImageDataUrl = null;
 
-      this.menuitemSources.removeEventListener("command", this._onToggleOrigSources);
+      this.menuitemSources.removeEventListener("command",
+                                               this._onToggleOrigSources);
       this.menuitemSources = null;
 
       // Destroy the context menu.
-      this._contextmenu.removeEventListener("popupshowing", this._contextMenuUpdate);
+      this._contextmenu.removeEventListener("popupshowing",
+                                            this._contextMenuUpdate);
       this._contextmenu.parentNode.removeChild(this._contextmenu);
       this._contextmenu = null;
     }
@@ -1973,7 +1999,6 @@ CssRuleView.prototype = {
 
       // Notify anyone that cares that we refreshed.
       this.emit("ruleview-refreshed");
-      return undefined;
     }).then(null, promiseWarn);
   },
 
@@ -2117,7 +2142,8 @@ CssRuleView.prototype = {
 
   _getRuleViewHeaderClassName: function(isPseudo) {
     let baseClassName = "theme-gutter ruleview-header";
-    return isPseudo ? baseClassName + " ruleview-expandable-header" : baseClassName;
+    return isPseudo ? baseClassName + " ruleview-expandable-header" :
+      baseClassName;
   },
 
   /**
@@ -2178,7 +2204,8 @@ CssRuleView.prototype = {
 
       if (!seenPseudoElement && rule.pseudoElement) {
         seenPseudoElement = true;
-        container = this.createExpandableContainer(this.pseudoElementLabel, true);
+        container = this.createExpandableContainer(this.pseudoElementLabel,
+                                                   true);
       }
 
       let keyframes = rule.keyframes;
@@ -2376,7 +2403,7 @@ CssRuleView.prototype = {
   _onTogglePseudoClass: function(event) {
     let target = event.currentTarget;
     this.inspector.togglePseudoClass(target.value);
-   }
+  }
 };
 
 /**
@@ -2462,7 +2489,8 @@ RuleEditor.prototype = {
 
       let selectorHighlighter = createChild(header, "span", {
         class: "ruleview-selectorhighlighter" +
-               (this.ruleView.highlightedSelector === selector ? " highlighted": ""),
+               (this.ruleView.highlightedSelector === selector ?
+                " highlighted" : ""),
         title: CssLogic.l10n("rule.selectorHighlighter.tooltip")
       });
       selectorHighlighter.addEventListener("click", () => {
@@ -2519,14 +2547,13 @@ RuleEditor.prototype = {
       }, false);
 
       // Create a property editor when the close brace is clicked.
-      editableItem({ element: this.closeBrace }, (aElement) => {
+      editableItem({ element: this.closeBrace }, () => {
         this.newProperty();
       });
     }
   },
 
-  updateSourceLink: function RuleEditor_updateSourceLink()
-  {
+  updateSourceLink: function() {
     let sourceLabel = this.element.querySelector(".source-link-label");
     let sourceHref = (this.rule.sheet && this.rule.sheet.href) ?
       this.rule.sheet.href : this.rule.title;
@@ -2554,7 +2581,8 @@ RuleEditor.prototype = {
     }
 
     let showOrig = Services.prefs.getBoolPref(PREF_ORIG_SOURCES);
-    if (showOrig && !this.rule.isSystem && this.rule.domRule.type != ELEMENT_STYLE) {
+    if (showOrig && !this.rule.isSystem &&
+        this.rule.domRule.type != ELEMENT_STYLE) {
       this.rule.getOriginalSourceStrings().then((strings) => {
         sourceLabel.setAttribute("value", strings.short);
         sourceLabel.setAttribute("tooltiptext", strings.full);
@@ -2727,7 +2755,8 @@ RuleEditor.prototype = {
     // parseDeclarations allows for name-less declarations, but in the present
     // case, we're creating a new declaration, it doesn't make sense to accept
     // these entries
-    this.multipleAddedProperties = parseDeclarations(aValue).filter(d => d.name);
+    this.multipleAddedProperties =
+      parseDeclarations(aValue).filter(d => d.name);
 
     // Blur the editor field now and deal with adding declarations later when
     // the field gets destroyed (see _newPropertyDestroy)
@@ -2901,7 +2930,6 @@ TextPropertyEditor.prototype = {
       class: "ruleview-propertyvaluecontainer"
     });
 
-
     // Property value, editable when focused.  Changes to the
     // property value are applied as they are typed, and reverted
     // if the user presses escape.
@@ -2960,7 +2988,7 @@ TextPropertyEditor.prototype = {
         element: this.nameSpan,
         done: this._onNameDone,
         destroy: this.update,
-        advanceChars: ':',
+        advanceChars: ":",
         contentType: InplaceEditor.CONTENT_TYPES.CSS_PROPERTY,
         popup: this.popup
       });
@@ -3093,7 +3121,7 @@ TextPropertyEditor.prototype = {
     const filterSwatchClass = "ruleview-filterswatch";
 
     let outputParser = this.ruleEditor.ruleView._outputParser;
-    let frag = outputParser.parseCssProperty(name, val, {
+    let parserOptions = {
       colorSwatchClass: sharedSwatchClass + colorSwatchClass,
       colorClass: "ruleview-color",
       bezierSwatchClass: sharedSwatchClass + bezierSwatchClass,
@@ -3103,17 +3131,20 @@ TextPropertyEditor.prototype = {
       defaultColorType: !propDirty,
       urlClass: "theme-link",
       baseURI: this.sheetURI
-    });
+    };
+    let frag = outputParser.parseCssProperty(name, val, parserOptions);
     this.valueSpan.innerHTML = "";
     this.valueSpan.appendChild(frag);
 
     // Attach the color picker tooltip to the color swatches
-    this._colorSwatchSpans = this.valueSpan.querySelectorAll("." + colorSwatchClass);
+    this._colorSwatchSpans =
+      this.valueSpan.querySelectorAll("." + colorSwatchClass);
     if (this.ruleEditor.isEditable) {
       for (let span of this._colorSwatchSpans) {
         // Capture the original declaration value to be able to revert later
         let originalValue = this.valueSpan.textContent;
-        // Adding this swatch to the list of swatches our colorpicker knows about
+        // Adding this swatch to the list of swatches our colorpicker
+        // knows about
         this.ruleEditor.ruleView.tooltips.colorPicker.addSwatch(span, {
           onPreview: () => this._previewValue(this.valueSpan.textContent),
           onCommit: () => this._applyNewValue(this.valueSpan.textContent),
@@ -3123,12 +3154,14 @@ TextPropertyEditor.prototype = {
     }
 
     // Attach the cubic-bezier tooltip to the bezier swatches
-    this._bezierSwatchSpans = this.valueSpan.querySelectorAll("." + bezierSwatchClass);
+    this._bezierSwatchSpans =
+      this.valueSpan.querySelectorAll("." + bezierSwatchClass);
     if (this.ruleEditor.isEditable) {
       for (let span of this._bezierSwatchSpans) {
         // Capture the original declaration value to be able to revert later
         let originalValue = this.valueSpan.textContent;
-        // Adding this swatch to the list of swatches our colorpicker knows about
+        // Adding this swatch to the list of swatches our colorpicker
+        // knows about
         this.ruleEditor.ruleView.tooltips.cubicBezier.addSwatch(span, {
           onPreview: () => this._previewValue(this.valueSpan.textContent),
           onCommit: () => this._applyNewValue(this.valueSpan.textContent),
@@ -3140,14 +3173,15 @@ TextPropertyEditor.prototype = {
     // Attach the filter editor tooltip to the filter swatch
     let span = this.valueSpan.querySelector("." + filterSwatchClass);
     if (this.ruleEditor.isEditable) {
-      if(span) {
+      if (span) {
+        parserOptions.filterSwatch = true;
         let originalValue = this.valueSpan.textContent;
 
         this.ruleEditor.ruleView.tooltips.filterEditor.addSwatch(span, {
           onPreview: () => this._previewValue(this.valueSpan.textContent),
           onCommit: () => this._applyNewValue(this.valueSpan.textContent),
           onRevert: () => this._applyNewValue(originalValue, false)
-        });
+        }, outputParser, parserOptions);
       }
     }
 
@@ -3163,7 +3197,7 @@ TextPropertyEditor.prototype = {
   /**
    * Populate the list of computed styles.
    */
-  _updateComputed: function () {
+  _updateComputed: function() {
     // Clear out existing viewers.
     while (this.computed.hasChildNodes()) {
       this.computed.removeChild(this.computed.lastChild);
@@ -3342,18 +3376,19 @@ TextPropertyEditor.prototype = {
    * @param {bool} aCommit
    *        True if the change should be applied.
    */
-   _onValueDone: function(aValue, aCommit) {
+  _onValueDone: function(aValue, aCommit) {
     if (!aCommit && !this.ruleEditor.isEditing) {
-       // A new property should be removed when escape is pressed.
-       if (this.removeOnRevert) {
-         this.remove();
-       } else {
-         this.prop.setValue(this.committed.value, this.committed.priority);
-       }
-       return;
+      // A new property should be removed when escape is pressed.
+      if (this.removeOnRevert) {
+        this.remove();
+      } else {
+        this.prop.setValue(this.committed.value, this.committed.priority);
+      }
+      return;
     }
 
-    let {propertiesToAdd,firstValue} = this._getValueAndExtraProperties(aValue);
+    let {propertiesToAdd, firstValue} =
+        this._getValueAndExtraProperties(aValue);
 
     // First, set this property value (common case, only modified a property)
     let val = parseSingleValue(firstValue);
@@ -3407,14 +3442,15 @@ TextPropertyEditor.prototype = {
 
     // Check to see if the input string can be parsed as multiple properties
     if (properties.length) {
-      // Get the first property value (if any), and any remaining properties (if any)
+      // Get the first property value (if any), and any remaining
+      // properties (if any)
       if (!properties[0].name && properties[0].value) {
         firstValue = properties[0].value;
         propertiesToAdd = properties.slice(1);
-      }
-      // In some cases, the value could be a property:value pair itself.
-      // Join them as one value string and append potentially following properties
-      else if (properties[0].name && properties[0].value) {
+      } else if (properties[0].name && properties[0].value) {
+        // In some cases, the value could be a property:value pair
+        // itself.  Join them as one value string and append
+        // potentially following properties
         firstValue = properties[0].name + ": " + properties[0].value;
         propertiesToAdd = properties.slice(1);
       }
@@ -3464,7 +3500,8 @@ TextPropertyEditor.prototype = {
     }
 
     let val = parseSingleValue(aValue);
-    this.ruleEditor.rule.previewPropertyValue(this.prop, val.value, val.priority);
+    this.ruleEditor.rule.previewPropertyValue(this.prop, val.value,
+                                              val.priority);
   },
 
   /**
@@ -3576,7 +3613,7 @@ function createChild(aParent, aTag, aAttributes) {
     if (aAttributes.hasOwnProperty(attr)) {
       if (attr === "textContent") {
         elt.textContent = aAttributes[attr];
-      } else if(attr === "child") {
+      } else if (attr === "child") {
         elt.appendChild(aAttributes[attr]);
       } else {
         elt.setAttribute(attr, aAttributes[attr]);
@@ -3591,7 +3628,8 @@ function createMenuItem(aMenu, aAttributes) {
   let item = aMenu.ownerDocument.createElementNS(XUL_NS, "menuitem");
 
   item.setAttribute("label", _strings.GetStringFromName(aAttributes.label));
-  item.setAttribute("accesskey", _strings.GetStringFromName(aAttributes.accesskey));
+  item.setAttribute("accesskey",
+                    _strings.GetStringFromName(aAttributes.accesskey));
   item.addEventListener("command", aAttributes.command);
 
   if (aAttributes.type) {
@@ -3614,12 +3652,12 @@ function clearTimeout() {
 }
 
 function throttle(func, wait, scope) {
-  var timer = null;
+  let timer = null;
   return function() {
-    if(timer) {
+    if (timer) {
       clearTimeout(timer);
     }
-    var args = arguments;
+    let args = arguments;
     timer = setTimeout(function() {
       timer = null;
       func.apply(scope, args);
@@ -3732,7 +3770,8 @@ function advanceValidate(aKeyCode, aValue, aInsertionPoint) {
   // end up with a ";" symbol token, then the semicolon terminates the
   // value.  Otherwise it's been inserted in some spot where it has a
   // valid meaning, like a comment or string.
-  aValue = aValue.slice(0, aInsertionPoint) + ';' + aValue.slice(aInsertionPoint);
+  aValue = aValue.slice(0, aInsertionPoint) + ";" +
+    aValue.slice(aInsertionPoint);
   let lexer = domUtils.getCSSLexer(aValue);
   while (true) {
     let token = lexer.nextToken();
@@ -3740,10 +3779,9 @@ function advanceValidate(aKeyCode, aValue, aInsertionPoint) {
       if (token.tokenType === "symbol" && token.text === ";") {
         // The ";" is a terminator.
         return true;
-      } else {
-        // The ";" is not a terminator in this context.
-        break;
       }
+      // The ";" is not a terminator in this context.
+      break;
     }
   }
   return false;
@@ -3753,8 +3791,8 @@ function advanceValidate(aKeyCode, aValue, aInsertionPoint) {
 exports._advanceValidate = advanceValidate;
 
 XPCOMUtils.defineLazyGetter(this, "clipboardHelper", function() {
-  return Cc["@mozilla.org/widget/clipboardhelper;1"].
-    getService(Ci.nsIClipboardHelper);
+  return Cc["@mozilla.org/widget/clipboardhelper;1"]
+    .getService(Ci.nsIClipboardHelper);
 });
 
 XPCOMUtils.defineLazyGetter(this, "_strings", function() {
@@ -3766,4 +3804,6 @@ XPCOMUtils.defineLazyGetter(this, "domUtils", function() {
   return Cc["@mozilla.org/inspector/dom-utils;1"].getService(Ci.inIDOMUtils);
 });
 
-loader.lazyGetter(this, "AutocompletePopup", () => require("devtools/shared/autocomplete-popup").AutocompletePopup);
+loader.lazyGetter(this, "AutocompletePopup", function() {
+  return require("devtools/shared/autocomplete-popup").AutocompletePopup;
+});
diff --git a/browser/devtools/styleinspector/test/browser.ini b/browser/devtools/styleinspector/test/browser.ini
index fb3673b7ba0b..5ed6f6bc0ea9 100644
--- a/browser/devtools/styleinspector/test/browser.ini
+++ b/browser/devtools/styleinspector/test/browser.ini
@@ -55,6 +55,7 @@ support-files =
 [browser_ruleview_add-rule_01.js]
 [browser_ruleview_add-rule_02.js]
 [browser_ruleview_add-rule_03.js]
+[browser_ruleview_add-rule_pseudo_class.js]
 [browser_ruleview_colorpicker-and-image-tooltip_01.js]
 [browser_ruleview_colorpicker-and-image-tooltip_02.js]
 [browser_ruleview_colorpicker-appears-on-swatch-click.js]
diff --git a/browser/devtools/styleinspector/test/browser_ruleview_add-rule_pseudo_class.js b/browser/devtools/styleinspector/test/browser_ruleview_add-rule_pseudo_class.js
new file mode 100644
index 000000000000..67c3d7e01e74
--- /dev/null
+++ b/browser/devtools/styleinspector/test/browser_ruleview_add-rule_pseudo_class.js
@@ -0,0 +1,107 @@
+/* vim: set ft=javascript ts=2 et sw=2 tw=80: */
+/* Any copyright is dedicated to the Public Domain.
+ http://creativecommons.org/publicdomain/zero/1.0/ */
+
+"use strict";
+
+// Tests adding a rule with pseudo class locks on
+
+let PAGE_CONTENT = "<p id='element'>Test element</p>";
+
+const EXPECTED_SELECTOR = "#element";
+const TEST_DATA = [
+  [],
+  [":hover"],
+  [":hover", ":active"],
+  [":hover", ":active", ":focus"],
+  [":active"],
+  [":active", ":focus"],
+  [":focus"]
+];
+
+add_task(function*() {
+  yield addTab("data:text/html;charset=utf-8," + encodeURIComponent(PAGE_CONTENT));
+
+  info("Opening the rule-view");
+  let {toolbox, inspector, view} = yield openRuleView();
+
+  info("Selecting the test element");
+  yield selectNode("#element", inspector);
+
+  info("Iterating over the test data");
+  for (let data of TEST_DATA) {
+    yield runTestData(inspector, view, data);
+  }
+});
+
+function* runTestData(inspector, view, pseudoClasses) {
+  yield setPseudoLocks(inspector, view, pseudoClasses);
+  yield addNewRule(inspector, view);
+  yield testNewRule(view, pseudoClasses, 1);
+  yield resetPseudoLocks(inspector, view);
+}
+
+function* addNewRule(inspector, view) {
+  info("Adding the new rule using the button");
+  view.addRuleButton.click();
+  info("Waiting for rule view to change");
+  let onRuleViewChanged = once(view, "ruleview-changed");
+  yield onRuleViewChanged;
+}
+
+function* testNewRule(view, pseudoClasses, index) {
+  let idRuleEditor = getRuleViewRuleEditor(view, index);
+  let editor = idRuleEditor.selectorText.ownerDocument.activeElement;
+  let expected = EXPECTED_SELECTOR + pseudoClasses.join("");
+
+  is(editor.value, expected,
+      "Selector editor value is as expected: " + expected);
+
+  info("Entering the escape key");
+  EventUtils.synthesizeKey("VK_ESCAPE", {});
+
+  is(idRuleEditor.selectorText.textContent, expected,
+      "Selector text value is as expected: " + expected);
+}
+
+function* setPseudoLocks(inspector, view, pseudoClasses) {
+  if (pseudoClasses.length == 0) {
+    return;
+  }
+  for (var pseudoClass of pseudoClasses) {
+    switch (pseudoClass) {
+      case ":hover":
+        view.hoverCheckbox.click();
+        yield inspector.once("rule-view-refreshed");
+        break;
+      case ":active":
+        view.activeCheckbox.click();
+        yield inspector.once("rule-view-refreshed");
+        break;
+      case ":focus":
+        view.focusCheckbox.click();
+        yield inspector.once("rule-view-refreshed");
+        break;
+    }
+  }
+}
+
+function* resetPseudoLocks(inspector, view) {
+  if (!view.hoverCheckbox.checked &&
+      !view.activeCheckbox.checked &&
+      !view.focusCheckbox.checked) {
+    return;
+  }
+  if (view.hoverCheckbox.checked) {
+    view.hoverCheckbox.click();
+    yield inspector.once("rule-view-refreshed");
+  }
+  if (view.activeCheckbox.checked) {
+    view.activeCheckbox.click();
+    yield inspector.once("rule-view-refreshed");
+  }
+  if (view.focusCheckbox.checked) {
+    view.focusCheckbox.click();
+    yield inspector.once("rule-view-refreshed");
+  }
+}
diff --git a/browser/devtools/styleinspector/test/browser_ruleview_user-agent-styles.js b/browser/devtools/styleinspector/test/browser_ruleview_user-agent-styles.js
index e4142569caa1..8cd5501c208d 100644
--- a/browser/devtools/styleinspector/test/browser_ruleview_user-agent-styles.js
+++ b/browser/devtools/styleinspector/test/browser_ruleview_user-agent-styles.js
@@ -9,12 +9,73 @@
 
 let PREF_UA_STYLES = "devtools.inspector.showUserAgentStyles";
 const { PrefObserver } = devtools.require("devtools/styleeditor/utils");
-const TEST_URI = "data:text/html;charset=utf-8," +
-  "<blockquote type=cite>" +
-  " <pre _moz_quote=true>" +
-  "   inspect <a href='foo' style='color:orange'>user agent</a> styles" +
-  " </pre>" +
-  "</blockquote>";
+
+const TEST_DOC = '<html>                                              \
+                    <head>                                            \
+                      <style>                                         \
+                        pre a {                                       \
+                          color: orange;                              \
+                        }                                             \
+                      </style>                                        \
+                    </head>                                           \
+                    <body>                                            \
+                      <input type=text placeholder=test></input>      \
+                      <input type=color></input>                      \
+                      <input type=range></input>                      \
+                      <input type=number></input>                     \
+                      <progress></progress>                           \
+                      <blockquote type=cite>                          \
+                        <pre _moz_quote=true>                         \
+                          inspect <a href="foo">user agent</a> styles \
+                        </pre>                                        \
+                      </blockquote>                                   \
+                    </body>                                           \
+                  </html>';
+
+const TEST_URI = "data:text/html;charset=utf-8," + encodeURIComponent(TEST_DOC);
+
+const TEST_DATA = [
+  {
+    selector: "blockquote",
+    numUserRules: 1,
+    numUARules: 0
+  },
+  {
+    selector: "pre",
+    numUserRules: 1,
+    numUARules: 0
+  },
+  {
+    selector: "input[type=range]",
+    numUserRules: 1,
+    numUARules: 0
+  },
+  {
+    selector: "input[type=number]",
+    numUserRules: 1,
+    numUARules: 0
+  },
+  {
+    selector: "input[type=color]",
+    numUserRules: 1,
+    numUARules: 0
+  },
+  {
+    selector: "input[type=text]",
+    numUserRules: 1,
+    numUARules: 0
+  },
+  {
+    selector: "progress",
+    numUserRules: 1,
+    numUARules: 0
+  },
+  {
+    selector: "a",
+    numUserRules: 2,
+    numUARules: 0
+  }
+];
 
 add_task(function*() {
   info ("Starting the test with the pref set to true before toolbox is opened");
@@ -55,66 +116,45 @@ function* setUserAgentStylesPref(val) {
 function* userAgentStylesVisible(inspector, view) {
   info ("Making sure that user agent styles are currently visible");
 
-  yield selectNode("blockquote", inspector);
-  yield compareAppliedStylesWithUI(inspector, view, "ua");
+  let userRules;
+  let uaRules;
 
-  let userRules = view._elementStyle.rules.filter(rule=>rule.editor.isEditable);
-  let uaRules = view._elementStyle.rules.filter(rule=>!rule.editor.isEditable);
-  is (userRules.length, 1, "Correct number of user rules");
-  ok (uaRules.length > 0, "Has UA rules");
+  for (let data of TEST_DATA) {
+    yield selectNode(data.selector, inspector);
+    yield compareAppliedStylesWithUI(inspector, view, "ua");
 
-  yield selectNode("pre", inspector);
-  yield compareAppliedStylesWithUI(inspector, view, "ua");
+    userRules = view._elementStyle.rules.filter(rule=>rule.editor.isEditable);
+    uaRules = view._elementStyle.rules.filter(rule=>!rule.editor.isEditable);
+    is (userRules.length, data.numUserRules, "Correct number of user rules");
+    ok (uaRules.length > data.numUARules, "Has UA rules");
+  }
 
-  userRules = view._elementStyle.rules.filter(rule=>rule.editor.isEditable);
-  uaRules = view._elementStyle.rules.filter(rule=>!rule.editor.isEditable);
-  is (userRules.length, 1, "Correct number of user rules");
-  ok (uaRules.length > 0, "Has UA rules");
-
-  yield selectNode("a", inspector);
-  yield compareAppliedStylesWithUI(inspector, view, "ua");
-
-  userRules = view._elementStyle.rules.filter(rule=>rule.editor.isEditable);
-  uaRules = view._elementStyle.rules.filter(rule=>!rule.editor.isEditable);
-  is (userRules.length, 1, "Correct number of user rules");
-
-  ok (userRules.some(rule=> rule.matchedSelectors.length === 0),
+  ok (userRules.some(rule=> rule.matchedSelectors.length === 1),
     "There is an inline style for element in user styles");
 
   ok (uaRules.some(rule=> rule.matchedSelectors.indexOf(":-moz-any-link")),
     "There is a rule for :-moz-any-link");
   ok (uaRules.some(rule=> rule.matchedSelectors.indexOf("*|*:link")),
     "There is a rule for *|*:link");
-  ok (!uaRules.some(rule=> rule.matchedSelectors.length === 0),
-    "No inline styles for ua styles");
+  ok (uaRules.some(rule=> rule.matchedSelectors.length === 1),
+    "Inline styles for ua styles");
 }
 
 function* userAgentStylesNotVisible(inspector, view) {
   info ("Making sure that user agent styles are not currently visible");
 
-  yield selectNode("blockquote", inspector);
-  yield compareAppliedStylesWithUI(inspector, view);
+  let userRules;
+  let uaRules;
 
-  let userRules = view._elementStyle.rules.filter(rule=>rule.editor.isEditable);
-  let uaRules = view._elementStyle.rules.filter(rule=>!rule.editor.isEditable);
-  is (userRules.length, 1, "Correct number of user rules");
-  is (uaRules.length, 0, "No UA rules");
+  for (let data of TEST_DATA) {
+    yield selectNode(data.selector, inspector);
+    yield compareAppliedStylesWithUI(inspector, view);
 
-  yield selectNode("pre", inspector);
-  yield compareAppliedStylesWithUI(inspector, view);
-
-  userRules = view._elementStyle.rules.filter(rule=>rule.editor.isEditable);
-  uaRules = view._elementStyle.rules.filter(rule=>!rule.editor.isEditable);
-  is (userRules.length, 1, "Correct number of user rules");
-  is (uaRules.length, 0, "No UA rules");
-
-  yield selectNode("a", inspector);
-  yield compareAppliedStylesWithUI(inspector, view);
-
-  userRules = view._elementStyle.rules.filter(rule=>rule.editor.isEditable);
-  uaRules = view._elementStyle.rules.filter(rule=>!rule.editor.isEditable);
-  is (userRules.length, 1, "Correct number of user rules");
-  is (uaRules.length, 0, "No UA rules");
+    userRules = view._elementStyle.rules.filter(rule=>rule.editor.isEditable);
+    uaRules = view._elementStyle.rules.filter(rule=>!rule.editor.isEditable);
+    is (userRules.length, data.numUserRules, "Correct number of user rules");
+    is (uaRules.length, data.numUARules, "No UA rules");
+  }
 }
 
 function* compareAppliedStylesWithUI(inspector, view, filter) {
@@ -129,6 +169,10 @@ function* compareAppliedStylesWithUI(inspector, view, filter) {
   let elementStyle = view._elementStyle;
   is(elementStyle.rules.length, entries.length, "Should have correct number of rules (" +  entries.length + ")");
 
+  entries = entries.sort((a, b) => {
+    return (a.pseudoElement || "z") > (b.pseudoElement || "z");
+  });
+
   entries.forEach((entry, i) => {
     let elementStyleRule = elementStyle.rules[i];
     is (elementStyleRule.inherited, entry.inherited, "Same inherited (" +entry.inherited+ ")" );
diff --git a/browser/devtools/webconsole/test/browser_console_consolejsm_output.js b/browser/devtools/webconsole/test/browser_console_consolejsm_output.js
index bbe4742b9fa7..be3de914e1d5 100644
--- a/browser/devtools/webconsole/test/browser_console_consolejsm_output.js
+++ b/browser/devtools/webconsole/test/browser_console_consolejsm_output.js
@@ -7,6 +7,15 @@
 
 "use strict";
 
+function onNewMessage(aEvent, aNewMessages) {
+  for (let msg of aNewMessages) {
+    // Messages that shouldn't be output contain the substring FAIL_TEST
+    if (msg.node.textContent.includes("FAIL_TEST")) {
+      ok(false, "Message shouldn't have been output: " + msg.node.textContent);
+    }
+  }
+};
+
 add_task(function*() {
   let storage = Cc["@mozilla.org/consoleAPI-storage;1"].getService(Ci.nsIConsoleAPIStorage);
   storage.clearEvents();
@@ -149,10 +158,10 @@ add_task(function* test_prefix() {
   };
   let console2 = new ConsoleAPI(consoleOptions);
   console2.error("Testing a prefix");
-  console2.log("Below the maxLogLevel");
+  console2.log("FAIL_TEST: Below the maxLogLevel");
 
   let hud = yield HUDService.toggleBrowserConsole();
-
+  hud.ui.on("new-messages", onNewMessage);
   yield waitForMessages({
     webconsole: hud,
     messages: [{
@@ -164,5 +173,109 @@ add_task(function* test_prefix() {
   });
 
   hud.jsterm.clearOutput(true);
+  hud.ui.off("new-messages", onNewMessage);
+  yield HUDService.toggleBrowserConsole();
+});
+
+add_task(function* test_maxLogLevelPref_missing() {
+  let storage = Cc["@mozilla.org/consoleAPI-storage;1"].getService(Ci.nsIConsoleAPIStorage);
+  storage.clearEvents();
+
+  let {ConsoleAPI} = Cu.import("resource://gre/modules/devtools/Console.jsm", {});
+  let consoleOptions = {
+    maxLogLevel: "error",
+    maxLogLevelPref: "testing.maxLogLevel",
+  };
+  let console = new ConsoleAPI(consoleOptions);
+
+  is(Services.prefs.getPrefType(consoleOptions.maxLogLevelPref),
+     Services.prefs.PREF_INVALID,
+     "Check log level pref is missing");
+
+  // Since the maxLogLevelPref doesn't exist, we should fallback to the passed
+  // maxLogLevel of "error".
+  console.warn("FAIL_TEST: Below the maxLogLevel");
+  console.error("Error should be shown");
+
+  let hud = yield HUDService.toggleBrowserConsole();
+
+  hud.ui.on("new-messages", onNewMessage);
+
+  yield waitForMessages({
+    webconsole: hud,
+    messages: [{
+      name: "defaulting to error level",
+      severity: SEVERITY_ERROR,
+      text: "Error should be shown",
+    }],
+  });
+
+  hud.jsterm.clearOutput(true);
+  hud.ui.off("new-messages", onNewMessage);
+  yield HUDService.toggleBrowserConsole();
+});
+
+add_task(function* test_maxLogLevelPref() {
+  let storage = Cc["@mozilla.org/consoleAPI-storage;1"].getService(Ci.nsIConsoleAPIStorage);
+  storage.clearEvents();
+
+  let {ConsoleAPI} = Cu.import("resource://gre/modules/devtools/Console.jsm", {});
+  let consoleOptions = {
+    maxLogLevel: "error",
+    maxLogLevelPref: "testing.maxLogLevel",
+  };
+
+  info("Setting the pref to warn");
+  Services.prefs.setCharPref(consoleOptions.maxLogLevelPref, "Warn");
+
+  let console = new ConsoleAPI(consoleOptions);
+
+  is(console.maxLogLevel, "warn", "Check pref was read at initialization");
+
+  console.info("FAIL_TEST: info is below the maxLogLevel");
+  console.error("Error should be shown");
+  console.warn("Warn should be shown due to the initial pref value");
+
+  info("Setting the pref to info");
+  Services.prefs.setCharPref(consoleOptions.maxLogLevelPref, "INFO");
+  is(console.maxLogLevel, "info", "Check pref was lowercased");
+
+  console.info("info should be shown due to the pref change being observed");
+
+  info("Clearing the pref");
+  Services.prefs.clearUserPref(consoleOptions.maxLogLevelPref);
+
+  console.warn("FAIL_TEST: Shouldn't be shown due to defaulting to error");
+  console.error("Should be shown due to defaulting to error");
+
+  let hud = yield HUDService.toggleBrowserConsole();
+  hud.ui.on("new-messages", onNewMessage);
+
+  yield waitForMessages({
+    webconsole: hud,
+    messages: [{
+      name: "error > warn",
+      severity: SEVERITY_ERROR,
+      text: "Error should be shown",
+    },
+    {
+      name: "warn is the inital pref value",
+      severity: SEVERITY_WARNING,
+      text: "Warn should be shown due to the initial pref value",
+    },
+    {
+      name: "pref changed to info",
+      severity: SEVERITY_INFO,
+      text: "info should be shown due to the pref change being observed",
+    },
+    {
+      name: "default to intial maxLogLevel if pref is removed",
+      severity: SEVERITY_ERROR,
+      text: "Should be shown due to defaulting to error",
+    }],
+  });
+
+  hud.jsterm.clearOutput(true);
+  hud.ui.off("new-messages", onNewMessage);
   yield HUDService.toggleBrowserConsole();
 });
diff --git a/browser/devtools/webconsole/test/head.js b/browser/devtools/webconsole/test/head.js
index 353d4374b0ec..ba4dc07093eb 100644
--- a/browser/devtools/webconsole/test/head.js
+++ b/browser/devtools/webconsole/test/head.js
@@ -907,6 +907,7 @@ function openDebugger(aOptions = {})
  *            - source: object of the shape { url, line }. This is used to
  *            match the source URL and line number of the error message or
  *            console API call.
+ *            - prefix: prefix text to check for in the prefix element.
  *            - stacktrace: array of objects of the form { file, fn, line } that
  *            can match frames in the stacktrace associated with the message.
  *            - groupDepth: number used to check the depth of the message in
diff --git a/browser/devtools/webide/content/webide.js b/browser/devtools/webide/content/webide.js
index 2dc4056fcbfb..dad3bda28980 100644
--- a/browser/devtools/webide/content/webide.js
+++ b/browser/devtools/webide/content/webide.js
@@ -211,6 +211,9 @@ let UI = {
         this.updateCommands();
         break;
       case "runtime-global-actors":
+        // Check runtime version only on runtime-global-actors,
+        // as we expect to use device actor
+        this.checkRuntimeVersion();
         this.updateCommands();
         break;
       case "runtime-details":
@@ -896,6 +899,20 @@ let UI = {
     this.updateProjectEditorMenusVisibility();
   },
 
+  checkRuntimeVersion: Task.async(function* () {
+    if (AppManager.connected && AppManager.deviceFront) {
+      let desc = yield AppManager.deviceFront.getDescription();
+      // Compare device and firefox build IDs
+      // and only compare by day (strip hours/minutes) to prevent
+      // warning against builds of the same day.
+      let deviceID = desc.appbuildid.substr(0, 8);
+      let localID = Services.appinfo.appBuildID.substr(0, 8);
+      if (deviceID > localID) {
+        this.reportError("error_runtimeVersionTooRecent", deviceID, localID);
+      }
+    }
+  }),
+
   /********** TOOLBOX **********/
 
   onMessage: function(event) {
diff --git a/browser/devtools/webide/modules/simulator-process.js b/browser/devtools/webide/modules/simulator-process.js
index 50a7f53be87f..350ec594961c 100644
--- a/browser/devtools/webide/modules/simulator-process.js
+++ b/browser/devtools/webide/modules/simulator-process.js
@@ -67,8 +67,13 @@ SimulatorProcess.prototype = {
       }
     });
 
-    this.on("stdout", (e, data) => this.log(e, data.trim()));
-    this.on("stderr", (e, data) => this.log(e, data.trim()));
+    let logHandler = (e, data) => this.log(e, data.trim());
+    this.on("stdout", logHandler);
+    this.on("stderr", logHandler);
+    this.once("exit", () => {
+      this.off("stdout", logHandler);
+      this.off("stderr", logHandler);
+    });
 
     let environment;
     if (OS.indexOf("linux") > -1) {
diff --git a/browser/locales/en-US/chrome/browser/browser-pocket.properties b/browser/locales/en-US/chrome/browser/browser-pocket.properties
new file mode 100644
index 000000000000..bddb7fba6be3
--- /dev/null
+++ b/browser/locales/en-US/chrome/browser/browser-pocket.properties
@@ -0,0 +1,31 @@
+# This Source Code Form is subject to the terms of the Mozilla Public
+# License, v. 2.0. If a copy of the MPL was not distributed with this
+# file, You can obtain one at http://mozilla.org/MPL/2.0/.
+
+addtags = Add Tags
+alreadyhaveacct = Already a Pocket user?
+continueff = Continue with Firefox
+errorgeneric = There was an error when trying to save to Pocket.
+learnmore = Learn More
+loginnow = Log in
+maxtaglength = Tags are limited to 25 characters
+mustbeconnected = You must be connected to the Internet in order to save to Pocket. Please check your connection and try again.
+onlylinkssaved = Only links can be saved
+pagenotsaved = Page Not Saved
+pageremoved = Page Removed
+pagesaved = Saved to Pocket
+processingremove = Removing Page…
+processingtags = Adding tags…
+removepage = Remove Page
+save = Save
+saving = Saving…
+signupemail = Sign up with email
+signuptosave = Sign up for Pocket. It’s free.
+suggestedtags = Suggested Tags
+tagline = Save articles and videos from Firefox to view in Pocket on any device, any time.
+taglinestory_one = Click the Pocket Button to save any article, video or page from Firefox.
+taglinestory_two = View in Pocket on any device, any time.
+tagssaved = Tags Added
+signinfirefox = Sign in with Firefox
+signupfirefox = Sign up with Firefox
+viewlist = View List
diff --git a/browser/locales/en-US/chrome/browser/browser.dtd b/browser/locales/en-US/chrome/browser/browser.dtd
index 6660865ae052..e48e40ea04b8 100644
--- a/browser/locales/en-US/chrome/browser/browser.dtd
+++ b/browser/locales/en-US/chrome/browser/browser.dtd
@@ -275,6 +275,7 @@ These should match what Safari and other Apple applications use on OS X Lion. --
   -  application menu item that opens the browser content toolbox UI in the Tools menu.
   -  This toolbox allows to debug the chrome of the content process in multiprocess builds.  -->
 <!ENTITY browserContentToolboxMenu.label     "Browser Content Toolbox">
+<!ENTITY browserContentToolboxMenu.accesskey "x">
 
 <!ENTITY devToolbarCloseButton.tooltiptext "Close Developer Toolbar">
 <!ENTITY devToolbarMenu.label              "Developer Toolbar">
@@ -672,20 +673,8 @@ you can use these alternative items. Otherwise, their values should be empty.  -
 <!ENTITY editBookmark.cancel.label                   "Cancel">
 <!ENTITY editBookmark.removeBookmark.accessKey       "R">
 
-<!ENTITY identity.unverifiedsite2 "This website does not supply identity information.">
-<!ENTITY identity.connectedTo "You are connected to">
-<!-- Localization note (identity.runBy) : This string appears between a
-domain name (above) and an organization name (below). E.g.
-
-example.com
-which is run by
-Example Enterprises, Inc.
-
-The layout of the identity dialog prevents combining this into a single string with
-substitution variables.  If it is difficult to translate the sense of the string
-with that structure, consider a translation which ignores the preceding domain and
-just addresses the organization to follow, e.g. "This site is run by " -->
-<!ENTITY identity.runBy "which is run by">
+<!ENTITY identity.connectionSecure "Secure Connection">
+<!ENTITY identity.connectionNotSecure "Connection is Not Secure">
 
 <!ENTITY identity.moreInfoLinkText2 "More Information">
 
@@ -860,3 +849,10 @@ just addresses the organization to follow, e.g. "This site is run by " -->
 <!-- Pre-landed strings for bug 1123519 -->
 <!ENTITY readingList.sidebar.add.label            "Add to Reading List">
 <!ENTITY readingList.sidebar.add.tooltip          "Add this page to your Reading List">
+
+<!-- LOCALIZATION NOTE (saveToPocketCmd.label, saveLinkToPocketCmd.label, pocketMenuitem.label): Pocket is a brand name -->
+<!ENTITY saveToPocketCmd.label     "Save Page to Pocket">
+<!ENTITY saveToPocketCmd.accesskey "k">
+<!ENTITY saveLinkToPocketCmd.label     "Save Link to Pocket">
+<!ENTITY saveLinkToPocketCmd.accesskey "o">
+<!ENTITY pocketMenuitem.label      "View Pocket List">
diff --git a/browser/locales/en-US/chrome/browser/browser.properties b/browser/locales/en-US/chrome/browser/browser.properties
index e2cf8f7bb45d..11595fa9cfb8 100644
--- a/browser/locales/en-US/chrome/browser/browser.properties
+++ b/browser/locales/en-US/chrome/browser/browser.properties
@@ -329,16 +329,11 @@ identity.identified.verifier=Verified by: %S
 identity.identified.verified_by_you=You have added a security exception for this site.
 identity.identified.state_and_country=%S, %S
 
-identity.encrypted2=The connection to this website is secure.
 identity.broken_loaded=The connection to this website is not fully secure because it contains unencrypted elements (such as images) or the encryption is not strong enough.
 identity.mixed_active_loaded2=This website contains interactive content that isn't encrypted (such as scripts). Other people can view your information or modify the website's behavior.
-identity.unencrypted=Your connection to this website is not encrypted.
 
 identity.unknown.tooltip=This website does not supply identity information.
 
-# LOCALIZATION NOTE (identity.chrome): %S is replaced with the brandShortName.
-identity.chrome=This is a secure %S page.
-
 # Edit Bookmark UI
 editBookmarkPanel.pageBookmarkedTitle=Page Bookmarked
 editBookmarkPanel.pageBookmarkedDescription=%S will always remember this page for you.
diff --git a/browser/locales/en-US/chrome/browser/customizableui/customizableWidgets.properties b/browser/locales/en-US/chrome/browser/customizableui/customizableWidgets.properties
index c16994f0f48f..f61b20c17d89 100644
--- a/browser/locales/en-US/chrome/browser/customizableui/customizableWidgets.properties
+++ b/browser/locales/en-US/chrome/browser/customizableui/customizableWidgets.properties
@@ -113,5 +113,10 @@ web-apps-button.tooltiptext = Discover Apps
 devtools-webide-button2.label = WebIDE
 devtools-webide-button2.tooltiptext = Open WebIDE (%S)
 
+# LOCALIZATION NOTE(pocket-button.label, pocket-button.tooltiptext): "Pocket"
+# is a brand name.
+pocket-button.label = Pocket
+pocket-button.tooltiptext = Save to Pocket
+
 e10s-button.label = New Non-e10s Window
 e10s-button.tooltiptext = Open a new Non-e10s Window
diff --git a/browser/locales/en-US/chrome/browser/devtools/debugger.properties b/browser/locales/en-US/chrome/browser/devtools/debugger.properties
index 292188dfcf50..e327a98b6cf0 100644
--- a/browser/locales/en-US/chrome/browser/devtools/debugger.properties
+++ b/browser/locales/en-US/chrome/browser/devtools/debugger.properties
@@ -27,10 +27,11 @@ DebuggerWindowTitle=Browser Debugger
 # The title displayed for the debugger window when a script is selected.
 DebuggerWindowScriptTitle=Browser Debugger - %S
 
-# LOCALIZATION NOTE (ToolboxDebugger.tooltip):
+# LOCALIZATION NOTE (ToolboxDebugger.tooltip2):
 # This string is displayed in the tooltip of the tab when the debugger is
 # displayed inside the developer tools window..
-ToolboxDebugger.tooltip=JavaScript Debugger
+# A keyboard shortcut for JS Debugger will be shown inside brackets.
+ToolboxDebugger.tooltip2=JavaScript Debugger (%S)
 
 # LOCALIZATION NOTE (debuggerMenu.commandkey, debuggerMenu.accesskey)
 # Used for the menuitem in the tool menu
@@ -319,5 +320,4 @@ resumptionOrderPanelTitle=There are one or more paused debuggers. Please resume
 variablesViewOptimizedOut=(optimized away)
 variablesViewUninitialized=(uninitialized)
 variablesViewMissingArgs=(unavailable)
-
-anonymousSourcesLabel=Anonymous Sources
\ No newline at end of file
+anonymousSourcesLabel=Anonymous Sources
diff --git a/browser/locales/en-US/chrome/browser/devtools/har.properties b/browser/locales/en-US/chrome/browser/devtools/har.properties
new file mode 100644
index 000000000000..8fcb4187164c
--- /dev/null
+++ b/browser/locales/en-US/chrome/browser/devtools/har.properties
@@ -0,0 +1,22 @@
+# This Source Code Form is subject to the terms of the Mozilla Public
+# License, v. 2.0. If a copy of the MPL was not distributed with this
+# file, You can obtain one at http://mozilla.org/MPL/2.0/.
+
+# LOCALIZATION NOTE These strings are used inside the Network Monitor
+# which is available from the Web Developer sub-menu -> 'Network Monitor'.
+# The correct localization of this file might be to keep it in
+# English, or another language commonly spoken among web developers.
+# You want to make that choice consistent across the developer tools.
+# A good criteria is the language in which you'd find the best
+# documentation on web development on the web.
+
+# LOCALIZATION NOTE (har.responseBodyNotIncluded): A label used within
+# HAR file explaining that HTTP response bodies are not includes
+# in exported data.
+har.responseBodyNotIncluded=Response bodies are not included.
+
+# LOCALIZATION NOTE (har.responseBodyNotIncluded): A label used within
+# HAR file explaining that HTTP request bodies are not includes
+# in exported data.
+har.requestBodyNotIncluded=Request bodies are not included.
+
diff --git a/browser/locales/en-US/chrome/browser/devtools/inspector.dtd b/browser/locales/en-US/chrome/browser/devtools/inspector.dtd
index dd24ffb3450e..35848a678fbd 100644
--- a/browser/locales/en-US/chrome/browser/devtools/inspector.dtd
+++ b/browser/locales/en-US/chrome/browser/devtools/inspector.dtd
@@ -104,3 +104,8 @@
      the DOM properties of the current node. When triggered, this item
      opens the split Console and displays the properties in its side panel. -->
 <!ENTITY inspectorShowDOMProperties.label       "Show DOM Properties">
+
+<!-- LOCALIZATION NOTE (inspectorScreenshotNode.label): This is the label
+     shown in the inspector contextual-menu for the item that lets users take
+     a screenshot of the currently selected node. -->
+<!ENTITY inspectorScreenshotNode.label       "Screenshot Node">
diff --git a/browser/locales/en-US/chrome/browser/devtools/inspector.properties b/browser/locales/en-US/chrome/browser/devtools/inspector.properties
index 20ecd43624da..d1f93570ea79 100644
--- a/browser/locales/en-US/chrome/browser/devtools/inspector.properties
+++ b/browser/locales/en-US/chrome/browser/devtools/inspector.properties
@@ -45,9 +45,10 @@ inspector.panelLabel.markupView=Markup View
 # LOCALIZATION NOTE (markupView.more.*)
 # When there are too many nodes to load at once, we will offer to
 # show all the nodes.
+# Keyboard shortcut for DOM and Style Inspector will shown inside brackets.
 markupView.more.showing=Some nodes were hidden.
 markupView.more.showAll=Show All %S Nodes
-inspector.tooltip=DOM and Style Inspector
+inspector.tooltip2=DOM and Style Inspector (%S)
 
 #LOCALIZATION NOTE: Used in the image preview tooltip when the image could not be loaded
 previewTooltip.image.brokenImage=Could not load the image
diff --git a/browser/locales/en-US/chrome/browser/devtools/netmonitor.dtd b/browser/locales/en-US/chrome/browser/devtools/netmonitor.dtd
index cf579fa7e485..b31198290764 100644
--- a/browser/locales/en-US/chrome/browser/devtools/netmonitor.dtd
+++ b/browser/locales/en-US/chrome/browser/devtools/netmonitor.dtd
@@ -314,6 +314,22 @@
   -  for the Copy Image As Data URI menu item displayed in the context menu for a request -->
 <!ENTITY netmonitorUI.context.copyImageAsDataUri.accesskey  "I">
 
+<!-- LOCALIZATION NOTE (netmonitorUI.context.copyAllAsHar): This is the label displayed
+  -  on the context menu that copies all as HAR format -->
+<!ENTITY netmonitorUI.context.copyAllAsHar "Copy All As HAR">
+
+<!-- LOCALIZATION NOTE (netmonitorUI.context.copyAllAsHar.accesskey): This is the access key
+  -  for the Copy All As HAR menu item displayed in the context menu for a network panel -->
+<!ENTITY netmonitorUI.context.copyAllAsHar.accesskey "O">
+
+<!-- LOCALIZATION NOTE (netmonitorUI.context.saveAllAsHar): This is the label displayed
+  -  on the context menu that saves all as HAR format -->
+<!ENTITY netmonitorUI.context.saveAllAsHar "Save All As HAR">
+
+<!-- LOCALIZATION NOTE (netmonitorUI.context.saveAllAsHar.accesskey): This is the access key
+  -  for the Save All As HAR menu item displayed in the context menu for a network panel -->
+<!ENTITY netmonitorUI.context.saveAllAsHar.accesskey "H">
+
 <!-- LOCALIZATION NOTE (netmonitorUI.summary.editAndResend): This is the label displayed
   -  on the button in the headers tab that opens a form to edit and resend the currently
      displayed request -->
diff --git a/browser/locales/en-US/chrome/browser/devtools/netmonitor.properties b/browser/locales/en-US/chrome/browser/devtools/netmonitor.properties
index 889734a3562a..995124c13d47 100644
--- a/browser/locales/en-US/chrome/browser/devtools/netmonitor.properties
+++ b/browser/locales/en-US/chrome/browser/devtools/netmonitor.properties
@@ -24,10 +24,11 @@ netmonitor.panelLabel=Network Panel
 netmonitor.commandkey=Q
 netmonitor.accesskey=N
 
-# LOCALIZATION NOTE (netmonitor.tooltip):
+# LOCALIZATION NOTE (netmonitor.tooltip2):
 # This string is displayed in the tooltip of the tab when the Network Monitor is
 # displayed inside the developer tools window.
-netmonitor.tooltip=Network Monitor
+# Keyboard shortcut for Network Monitor will be shown inside the brackets.
+netmonitor.tooltip2=Network Monitor (%S)
 
 # LOCALIZATION NOTE (netmonitor.security.state.secure)
 # This string is used as an tooltip for request that was performed over secure
diff --git a/browser/locales/en-US/chrome/browser/devtools/profiler.dtd b/browser/locales/en-US/chrome/browser/devtools/profiler.dtd
index 960e191ecf17..fa6e30f8acbf 100644
--- a/browser/locales/en-US/chrome/browser/devtools/profiler.dtd
+++ b/browser/locales/en-US/chrome/browser/devtools/profiler.dtd
@@ -130,6 +130,12 @@
 <!ENTITY profilerUI.enableMemory             "Record Memory">
 <!ENTITY profilerUI.enableMemory.tooltiptext "Record memory consumption while profiling.">
 
+<!-- LOCALIZATION NOTE (profilerUI.enableAllocations): This string
+  -  is displayed next to a checkbox determining whether or not allocation
+  -  measurements are enabled. -->
+<!ENTITY profilerUI.enableAllocations             "Record Allocations">
+<!ENTITY profilerUI.enableAllocations.tooltiptext "Record Object allocations while profiling.">
+
 <!-- LOCALIZATION NOTE (profilerUI.enableFramerate): This string
   -  is displayed next to a checkbox determining whether or not framerate
   -  is recorded. -->
diff --git a/browser/locales/en-US/chrome/browser/devtools/profiler.properties b/browser/locales/en-US/chrome/browser/devtools/profiler.properties
index dd0a16a8d72d..5ab4658f6f7b 100644
--- a/browser/locales/en-US/chrome/browser/devtools/profiler.properties
+++ b/browser/locales/en-US/chrome/browser/devtools/profiler.properties
@@ -24,10 +24,11 @@ profiler.panelLabel2=Performance Panel
 profiler.commandkey2=VK_F5
 profiler.accesskey=P
 
-# LOCALIZATION NOTE (profiler.tooltip2):
+# LOCALIZATION NOTE (profiler.tooltip3):
 # This string is displayed in the tooltip of the tab when the profiler is
 # displayed inside the developer tools window.
-profiler.tooltip2=JavaScript Profiler
+# Keyboard shortcut for JS Profiler will be shown inside brackets.
+profiler.tooltip3=JavaScript Profiler (%S)
 
 # LOCALIZATION NOTE (noRecordingsText): The text to display in the
 # recordings menu when there are no recorded profiles yet.
diff --git a/browser/locales/en-US/chrome/browser/devtools/storage.properties b/browser/locales/en-US/chrome/browser/devtools/storage.properties
index f57b243f5d2f..8319442e2621 100644
--- a/browser/locales/en-US/chrome/browser/devtools/storage.properties
+++ b/browser/locales/en-US/chrome/browser/devtools/storage.properties
@@ -31,10 +31,11 @@ storage.menuLabel=Storage Inspector
 # tool in developer tools toolbox.
 storage.panelLabel=Storage Panel
 
-# LOCALIZATION NOTE (storage.tooltip):
+# LOCALIZATION NOTE (storage.tooltip3):
 # This string is displayed in the tooltip of the tab when the storage editor is
 # displayed inside the developer tools window.
-storage.tooltip2=Storage Inspector (Cookies, Local Storage …)
+# A keyboard shortcut for Storage Inspector will be shown inside the brackets.
+storage.tooltip3=Storage Inspector (Cookies, Local Storage, …) (%S)
 
 # LOCALIZATION NOTE (tree.emptyText):
 # This string is displayed when the Storage Tree is empty. This can happen when
diff --git a/browser/locales/en-US/chrome/browser/devtools/styleeditor.properties b/browser/locales/en-US/chrome/browser/devtools/styleeditor.properties
index bda4af1e680f..b813e5580696 100644
--- a/browser/locales/en-US/chrome/browser/devtools/styleeditor.properties
+++ b/browser/locales/en-US/chrome/browser/devtools/styleeditor.properties
@@ -77,10 +77,11 @@ ToolboxStyleEditor.label=Style Editor
 # This is used as the label for the toolbox panel.
 ToolboxStyleEditor.panelLabel=Style Editor Panel
 
-# LOCALIZATION NOTE (ToolboxStyleEditor.tooltip2):
+# LOCALIZATION NOTE (ToolboxStyleEditor.tooltip3):
 # This string is displayed in the tooltip of the tab when the style editor is
 # displayed inside the developer tools window.
-ToolboxStyleEditor.tooltip2=Stylesheet Editor (CSS)
+# A keyboard shortcut for Stylesheet Editor will be shown inside the latter pair of brackets.
+ToolboxStyleEditor.tooltip3=Stylesheet Editor (CSS) (%S)
 
 # LOCALIZATION NOTE (confirmNavigationAway): Shown in a notification box when
 # the user tries to navigate away from a web page.
diff --git a/browser/locales/en-US/chrome/browser/devtools/webconsole.properties b/browser/locales/en-US/chrome/browser/devtools/webconsole.properties
index aebe8af9e7db..522a5e359f7c 100644
--- a/browser/locales/en-US/chrome/browser/devtools/webconsole.properties
+++ b/browser/locales/en-US/chrome/browser/devtools/webconsole.properties
@@ -32,7 +32,7 @@ close.button=Close
 close.accesskey=C
 update.button=Update
 update.accesskey=U
-cmd.commandkey=k
+cmd.commandkey=K
 webConsoleCmd.accesskey=W
 
 # LOCALIZATION NOTE (timestampFormat): %1$02S = hours (24-hour clock),
@@ -176,10 +176,11 @@ ToolboxTabWebconsole.label=Console
 # label for the toolbox panel.
 ToolboxWebConsole.panelLabel=Console Panel
 
-# LOCALIZATION NOTE (ToolboxWebconsole.tooltip): the string displayed in the
+# LOCALIZATION NOTE (ToolboxWebconsole.tooltip2): the string displayed in the
 # tooltip of the tab when the Web Console is displayed inside the developer
 # tools window.
-ToolboxWebconsole.tooltip=Web Console
+# Keyboard shortcut for Console will be shown inside the brackets.
+ToolboxWebconsole.tooltip2=Web Console (%S)
 
 # LOCALIZATION NOTE (longStringEllipsis): the string displayed after a long
 # string. This string is clickable such that the rest of the string is
diff --git a/browser/locales/en-US/chrome/browser/devtools/webide.properties b/browser/locales/en-US/chrome/browser/devtools/webide.properties
index ed5b4cb8b89c..441e9934f414 100644
--- a/browser/locales/en-US/chrome/browser/devtools/webide.properties
+++ b/browser/locales/en-US/chrome/browser/devtools/webide.properties
@@ -48,6 +48,9 @@ error_cantFetchAddonsJSON=Can't fetch the add-on list: %S
 error_appProjectsLoadFailed=Unable to load project list. This can occur if you've used this profile with a newer version of Firefox.
 error_folderCreationFailed=Unable to create project folder in the selected directory.
 
+# Variable: runtime app build ID (looks like this %Y%M%D format) and firefox build ID (same format)
+error_runtimeVersionTooRecent=The connected runtime has a more recent build date (%1$S) than your desktop Firefox (%2$S) does. This is an unsupported setup and may cause DevTools to fail. Please update Firefox.
+
 addons_stable=stable
 addons_unstable=unstable
 # LOCALIZATION NOTE (addons_simulator_label): This label is shown as the name of
diff --git a/browser/locales/en-US/chrome/browser/loop/loop.properties b/browser/locales/en-US/chrome/browser/loop/loop.properties
index a2568b8aef7f..25e9fc2d93d0 100644
--- a/browser/locales/en-US/chrome/browser/loop/loop.properties
+++ b/browser/locales/en-US/chrome/browser/loop/loop.properties
@@ -351,6 +351,6 @@ context_add_some_label=Add some context
 context_edit_tooltip=Edit Context
 context_hide_tooltip=Hide Context
 context_show_tooltip=Show Context
-context_save_label=Save Context
+context_save_label2=Save
 context_link_modified=This link was modified.
 context_learn_more_link_label=Learn more.
diff --git a/browser/locales/generic/profile/bookmarks.html.in b/browser/locales/generic/profile/bookmarks.html.in
index 4ebdf3cd183c..076ca387a981 100644
--- a/browser/locales/generic/profile/bookmarks.html.in
+++ b/browser/locales/generic/profile/bookmarks.html.in
@@ -15,7 +15,7 @@
     <DT><H3 PERSONAL_TOOLBAR_FOLDER="true" ID="rdf:#$FvPhC3">@bookmarks_toolbarfolder@</H3>
 <DD>@bookmarks_toolbarfolder_description@
     <DL><p>
-        <DT><A HREF="https://www.mozilla.org/@AB_CD@/firefox/central/" ID="rdf:#$GvPhC3">@getting_started@</A>
+        <DT><A HREF="https://www.mozilla.org/@AB_CD@/firefox/central/" ICON="data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAABAAAAAQCAYAAAAf8/9hAAAAGXRFWHRTb2Z0d2FyZQBBZG9iZSBJbWFnZVJlYWR5ccllPAAAAz5JREFUeNpcU0toXFUY/s49596588ikySSmM8rk0UkJEirVTVEjYk1NUdRFFgouXZQI2k2hUCjdiYIuCi4Kuig0DbqQYgU3Yi0iFRuRCBMwaZvMZDTNY95z3/fM8b8jldpzOeeee/i/737n+/+f4ZExf730rkiaZ9NJMx/nmk5HypMqqLr+ZuD4F67N5ZYejmfRsnvhyKsLhSs3zP70SubgYKHSdFENu+gXAprQIGnvBi5ez0m1b6u7M399+PTx+UvtCKtFi2F6195qXK2byir88esy5ksfYND5DhuhRCtUKBNB0Q7w5Z8ee2GgWdjOn250fn5v5j8F5dOHlZD0kWRgAwp3hrKY0S9BJWKIcQ5PShhNG4+1bHx+IocT+RXcrRSDMfFNRvvt3Oyp/icIrRhUl9hoO4kt3F55Bxf3LkLV20jWOohbDjzXxyc/lMH0cRSyCd1xq+dFhu986t7T0CUwIzB8EkW3O5ibhj44ib7NJhiBKRoB/aS4ZWHjbxtjGQYP7nGRTjim1SaQqYiAVAREpHG8vzWJn+6PQ6CF0HPR7nQQczpYeEWHyWMUkwU8MSECGwgJxAWp9xWKNzkuH3oet+JDlIE9Momedh1G4CN0bfhVG9nsS0BQQthJx0V7j3elq7ihqV5ezQTwZmodP9ZGkU/bOPr4Nr53xtDYsaD7Dg4nNqFaH5OCYSSdGhf7daNmuv6wEKqXk/yExKGBHSznFsH6FFpKQ/JAA0ulUejWLt44lkHXsqDaX6C6Nl4Rnq8vK8s/KThDMlJhkI91YOO+iR3XwEelCdTCBLSgijNzd6DLNfhlHfZ6FtWiWBQpq/V2LdSrrNPljBQkoOjuCiPxAMutOIbkPqYSEqeequGZaTLzdhZhS0PlnlB9bvhtr5CuHj3y2Qj8hVQ/kEopxONEEsO/0yATDYXYAdWrE69JEElXq7Hyk0tro+xBU1yZmr4xrIcvptIRCZlJJAYBmRGRkD08aivA7VDvWPqt564Xn41w/AHB1/u7l1/uGxGU8mNcgodUNDIq0JDeLnpzc1uo1Qr76rWbqyf/142PjsXJqdkmN2YDnQ9oGkJNU+t57q7qUv4y9/t64+HYfwQYAN7OczrzUDvGAAAAAElFTkSuQmCC" ID="rdf:#$GvPhC3">@getting_started@</A>
     </DL><p>
     <DT><H3 ID="rdf:#$ZvPhC3">@firefox_heading@</H3>
     <DL><p>
diff --git a/browser/locales/jar.mn b/browser/locales/jar.mn
index cab382b5d4c1..cdedba73520f 100644
--- a/browser/locales/jar.mn
+++ b/browser/locales/jar.mn
@@ -26,6 +26,7 @@
     locale/browser/browser.dtd                     (%chrome/browser/browser.dtd)
     locale/browser/baseMenuOverlay.dtd             (%chrome/browser/baseMenuOverlay.dtd)
     locale/browser/browser.properties              (%chrome/browser/browser.properties)
+    locale/browser/browser-pocket.properties       (%chrome/browser/browser-pocket.properties)
     locale/browser/customizableui/customizableWidgets.properties (%chrome/browser/customizableui/customizableWidgets.properties)
     locale/browser/devtools/animationinspector.dtd    (%chrome/browser/devtools/animationinspector.dtd)
     locale/browser/devtools/animationinspector.properties (%chrome/browser/devtools/animationinspector.properties)
@@ -72,6 +73,7 @@
     locale/browser/devtools/connection-screen.dtd  (%chrome/browser/devtools/connection-screen.dtd)
     locale/browser/devtools/connection-screen.properties (%chrome/browser/devtools/connection-screen.properties)
     locale/browser/devtools/font-inspector.dtd     (%chrome/browser/devtools/font-inspector.dtd)
+    locale/browser/devtools/har.properties         (%chrome/browser/devtools/har.properties)
     locale/browser/devtools/app-manager.dtd        (%chrome/browser/devtools/app-manager.dtd)
     locale/browser/devtools/app-manager.properties (%chrome/browser/devtools/app-manager.properties)
     locale/browser/devtools/webide.dtd             (%chrome/browser/devtools/webide.dtd)
diff --git a/browser/themes/linux/Secure.png b/browser/themes/linux/Secure.png
deleted file mode 100644
index 5ee25e9b9fd4..000000000000
Binary files a/browser/themes/linux/Secure.png and /dev/null differ
diff --git a/browser/themes/linux/controlcenter/panel.css b/browser/themes/linux/controlcenter/panel.css
index 35d0a8a2a4c8..4890add6b3a5 100644
--- a/browser/themes/linux/controlcenter/panel.css
+++ b/browser/themes/linux/controlcenter/panel.css
@@ -20,55 +20,3 @@
 #identity-popup.verifiedIdentity > #identity-popup-container > #identity-popup-icon {
   -moz-image-region: rect(128px, 64px, 192px, 0px);
 }
-
-/* Identity popup body text */
-.identity-popup-description {
-  white-space: pre-wrap;
-  -moz-padding-start: 15px;
-  margin: 2px 0 4px;
-}
-
-.identity-popup-label {
-  white-space: pre-wrap;
-  -moz-padding-start: 15px;
-  margin: 0;
-}
-
-#identity-popup-content-host ,
-#identity-popup-content-owner {
-  font-weight: bold;
-  max-width: 300px;
-}
-
-#identity-popup-content-host ,
-#identity-popup-content-box.verifiedIdentity > #identity-popup-content-owner {
-  font-size: 140%;
-}
-
-#identity-popup-content-owner {
-  margin-bottom: 0 !important;
-}
-
-#identity-popup-content-verifier {
-  margin: 4px 0 2px;
-}
-
-#identity-popup-content-box.verifiedIdentity > #identity-popup-encryption ,
-#identity-popup-content-box.verifiedDomain > #identity-popup-encryption {
-  margin-top: 10px;
-  -moz-margin-start: -18px;
-}
-
-#identity-popup-content-box.verifiedIdentity > #identity-popup-encryption > vbox > #identity-popup-encryption-icon ,
-#identity-popup-content-box.verifiedDomain > #identity-popup-encryption > vbox > #identity-popup-encryption-icon {
-  list-style-image: url("chrome://browser/skin/Secure.png");
-}
-
-#identity-popup > .panel-arrowcontainer > .panel-arrowcontent {
-  padding: 0;
-}
-
-#identity-popup-container {
-  min-width: 280px;
-  padding: 10px;
-}
diff --git a/browser/themes/linux/jar.mn b/browser/themes/linux/jar.mn
index d08b9486ba18..8bed6139aa93 100644
--- a/browser/themes/linux/jar.mn
+++ b/browser/themes/linux/jar.mn
@@ -97,7 +97,6 @@ browser.jar:
   skin/classic/browser/badge-add-engine.png                 (../shared/search/badge-add-engine.png)
   skin/classic/browser/search-indicator-badge-add.png       (../shared/search/search-indicator-badge-add.png)
   skin/classic/browser/search-history-icon.svg              (../shared/search/history-icon.svg)
-  skin/classic/browser/Secure.png
   skin/classic/browser/Security-broken.png
   skin/classic/browser/setDesktopBackground.css
   skin/classic/browser/slowStartup-16.png
@@ -132,8 +131,11 @@ browser.jar:
   skin/classic/browser/webRTC-microphone-white-16.png (../shared/webrtc/microphone-white-16.png)
   skin/classic/browser/webRTC-screen-white-16.png     (../shared/webrtc/screen-white-16.png)
   skin/classic/browser/loop/menuPanel.png             (loop/menuPanel.png)
+  skin/classic/browser/loop/menuPanel@2x.png          (loop/menuPanel@2x.png)
   skin/classic/browser/loop/toolbar.png               (loop/toolbar.png)
+  skin/classic/browser/loop/toolbar@2x.png            (loop/toolbar@2x.png)
   skin/classic/browser/loop/toolbar-inverted.png      (loop/toolbar-inverted.png)
+  skin/classic/browser/loop/toolbar-inverted@2x.png   (loop/toolbar-inverted@2x.png)
 * skin/classic/browser/controlcenter/panel.css        (controlcenter/panel.css)
   skin/classic/browser/customizableui/background-noise-toolbar.png  (customizableui/background-noise-toolbar.png)
   skin/classic/browser/customizableui/customize-illustration.png  (../shared/customizableui/customize-illustration.png)
diff --git a/browser/themes/linux/loop/menuPanel@2x.png b/browser/themes/linux/loop/menuPanel@2x.png
new file mode 100644
index 000000000000..f52cf225fd8f
Binary files /dev/null and b/browser/themes/linux/loop/menuPanel@2x.png differ
diff --git a/browser/themes/linux/loop/toolbar-inverted@2x.png b/browser/themes/linux/loop/toolbar-inverted@2x.png
new file mode 100644
index 000000000000..1178851df126
Binary files /dev/null and b/browser/themes/linux/loop/toolbar-inverted@2x.png differ
diff --git a/browser/themes/linux/loop/toolbar@2x.png b/browser/themes/linux/loop/toolbar@2x.png
new file mode 100644
index 000000000000..c1fc1de1abb6
Binary files /dev/null and b/browser/themes/linux/loop/toolbar@2x.png differ
diff --git a/browser/themes/osx/Secure-Glyph.png b/browser/themes/osx/Secure-Glyph.png
deleted file mode 100644
index 60a106d9042c..000000000000
Binary files a/browser/themes/osx/Secure-Glyph.png and /dev/null differ
diff --git a/browser/themes/osx/Secure-Glyph@2x.png b/browser/themes/osx/Secure-Glyph@2x.png
deleted file mode 100644
index 59d75d1377a3..000000000000
Binary files a/browser/themes/osx/Secure-Glyph@2x.png and /dev/null differ
diff --git a/browser/themes/osx/browser.css b/browser/themes/osx/browser.css
index feaeb5d43036..6bca97327c16 100644
--- a/browser/themes/osx/browser.css
+++ b/browser/themes/osx/browser.css
@@ -1071,76 +1071,6 @@ toolbar .toolbarbutton-1 > .toolbarbutton-menubutton-dropmarker > .dropmarker-ic
     list-style-image: url(chrome://browser/skin/menuPanel-small@2x.png);
     -moz-image-region: rect(0px, 192px, 32px, 160px);
   }
-
-  #loop-button > .toolbarbutton-badge-container {
-    list-style-image: url("chrome://browser/skin/loop/toolbar@2x.png");
-    -moz-image-region: rect(0, 36px, 36px, 0);
-  }
-
-  toolbar[brighttext] #loop-button > .toolbarbutton-badge-container {
-    list-style-image: url("chrome://browser/skin/loop/toolbar-inverted@2x.png");
-  }
-
-  #loop-button[state="disabled"] > .toolbarbutton-badge-container,
-  #loop-button[disabled="true"] > .toolbarbutton-badge-container {
-    -moz-image-region: rect(0, 72px, 36px, 36px);
-  }
-
-  #loop-button:not([disabled="true"])[state="error"] > .toolbarbutton-badge-container {
-    -moz-image-region: rect(0, 108px, 36px, 72px);
-  }
-
-  #loop-button:not([disabled="true"])[state="action"] > .toolbarbutton-badge-container {
-    -moz-image-region: rect(0, 144px, 36px, 108px);
-  }
-
-  #loop-button:not([disabled="true"])[state="action"]:-moz-any(:hover,:hover:active,[open]) > .toolbarbutton-badge-container {
-    -moz-image-region: rect(0, 180px, 36px, 144px);
-  }
-
-  #loop-button:not([disabled="true"])[state="active"] > .toolbarbutton-badge-container {
-    -moz-image-region: rect(0, 216px, 36px, 180px);
-  }
-
-  #loop-button:not([disabled="true"])[state="active"]:-moz-any(:hover,:hover:active,[open]) > .toolbarbutton-badge-container {
-    -moz-image-region: rect(0, 252px, 36px, 216px);
-  }
-
-  #loop-button[cui-areatype="menu-panel"] > .toolbarbutton-badge-container,
-  toolbarpaletteitem[place="palette"] > #loop-button > .toolbarbutton-badge-container {
-    list-style-image: url(chrome://browser/skin/loop/menuPanel@2x.png);
-    -moz-image-region: rect(0, 64px, 64px, 0);
-  }
-
-  /* Make sure that the state icons are not shown in the customization palette. */
-  toolbarpaletteitem[place="palette"] > #loop-button > .toolbarbutton-badge-container {
-    -moz-image-region: rect(0, 64px, 64px, 0) !important;
-  }
-
-  #loop-button[cui-areatype="menu-panel"][state="disabled"] > .toolbarbutton-badge-container,
-  #loop-button[cui-areatype="menu-panel"][disabled="true"] > .toolbarbutton-badge-container {
-    -moz-image-region: rect(0, 128px, 64px, 64px);
-  }
-
-  #loop-button[cui-areatype="menu-panel"]:not([disabled="true"])[state="error"] > .toolbarbutton-badge-container {
-    -moz-image-region: rect(0, 192px, 64px, 128px);
-  }
-
-  #loop-button[cui-areatype="menu-panel"]:not([disabled="true"])[state="action"] > .toolbarbutton-badge-container {
-    -moz-image-region: rect(0, 256px, 64px, 192px);
-  }
-
-  #loop-button[cui-areatype="menu-panel"]:not([disabled="true"])[state="action"]:-moz-any(:hover,:hover:active,[open]) > .toolbarbutton-badge-container {
-    -moz-image-region: rect(0, 320px, 64px, 256px);
-  }
-
-  #loop-button[cui-areatype="menu-panel"]:not([disabled="true"])[state="active"] > .toolbarbutton-badge-container {
-    -moz-image-region: rect(0, 384px, 64px, 320px);
-  }
-
-  #loop-button[cui-areatype="menu-panel"]:not([disabled="true"])[state="active"]:-moz-any(:hover,:hover:active,[open]) > .toolbarbutton-badge-container {
-    -moz-image-region: rect(0, 448px, 64px, 384px);
-  }
 }
 
 toolbar .toolbarbutton-1:not([type="menu-button"]),
diff --git a/browser/themes/osx/controlcenter/panel.css b/browser/themes/osx/controlcenter/panel.css
index 9c2c594aa49e..a93169d749d1 100644
--- a/browser/themes/osx/controlcenter/panel.css
+++ b/browser/themes/osx/controlcenter/panel.css
@@ -4,6 +4,10 @@
 
 %include ../../shared/controlcenter/panel.inc.css
 
+#identity-popup {
+  margin-top: 1px;
+}
+
 /* Popup Icons */
 #identity-popup-icon {
   height: 64px;
@@ -35,67 +39,3 @@
     -moz-image-region: rect(256px, 128px, 384px, 0px);
   }
 }
-
-/* Popup Body Text */
-.identity-popup-description {
-  white-space: pre-wrap;
-  -moz-padding-start: 15px;
-  margin: 2px 0 4px;
-}
-
-.identity-popup-label {
-  white-space: pre-wrap;
-  -moz-padding-start: 15px;
-  margin: 0;
-}
-
-#identity-popup-content-host ,
-#identity-popup-content-owner {
-  font-weight: bold;
-  max-width: 300px;
-}
-
-#identity-popup-content-host ,
-#identity-popup-content-box.verifiedIdentity > #identity-popup-content-owner {
-  font-size: 140%;
-}
-
-#identity-popup-content-owner {
-  margin-bottom: 0 !important;
-}
-
-#identity-popup-content-verifier {
-  margin: 4px 0 2px;
-}
-
-#identity-popup-content-box.verifiedIdentity > #identity-popup-encryption ,
-#identity-popup-content-box.verifiedDomain > #identity-popup-encryption {
-  margin-top: 10px;
-  -moz-margin-start: -24px;
-}
-
-#identity-popup-content-box.verifiedIdentity > #identity-popup-encryption > vbox > #identity-popup-encryption-icon ,
-#identity-popup-content-box.verifiedDomain > #identity-popup-encryption > vbox > #identity-popup-encryption-icon {
-  margin-top: 5px;
-  list-style-image: url("chrome://browser/skin/Secure-Glyph.png");
-}
-
-@media (min-resolution: 2dppx) {
-  #identity-popup-content-box.verifiedIdentity > #identity-popup-encryption > vbox > #identity-popup-encryption-icon ,
-  #identity-popup-content-box.verifiedDomain > #identity-popup-encryption > vbox > #identity-popup-encryption-icon {
-    list-style-image: url("chrome://browser/skin/Secure-Glyph@2x.png");
-    width: 24px;
-  }
-}
-
-#identity-popup {
-  margin-top: 1px;
-}
-
-#identity-popup > .panel-arrowcontainer > .panel-arrowcontent {
-  padding: 0;
-}
-
-#identity-popup-container {
-  padding: 16px;
-}
diff --git a/browser/themes/osx/jar.mn b/browser/themes/osx/jar.mn
index af5be5a64272..3b17ceda5850 100644
--- a/browser/themes/osx/jar.mn
+++ b/browser/themes/osx/jar.mn
@@ -129,8 +129,6 @@ browser.jar:
   skin/classic/browser/search-indicator-badge-add.png          (../shared/search/search-indicator-badge-add.png)
   skin/classic/browser/search-indicator-badge-add@2x.png       (../shared/search/search-indicator-badge-add@2x.png)
   skin/classic/browser/search-history-icon.svg                 (../shared/search/history-icon.svg)
-  skin/classic/browser/Secure-Glyph.png
-  skin/classic/browser/Secure-Glyph@2x.png
   skin/classic/browser/slowStartup-16.png
   skin/classic/browser/theme-switcher-icon.png                 (../shared/theme-switcher-icon.png)
   skin/classic/browser/theme-switcher-icon@2x.png              (../shared/theme-switcher-icon@2x.png)
diff --git a/browser/themes/osx/searchbar.css b/browser/themes/osx/searchbar.css
index f8fb109aea9a..ce1e77ca7786 100644
--- a/browser/themes/osx/searchbar.css
+++ b/browser/themes/osx/searchbar.css
@@ -174,8 +174,8 @@ searchbar[oneoffui] .search-go-button:-moz-locale-dir(rtl) > .toolbarbutton-icon
 }
 
 .search-panel-one-offs {
+  margin: 0 0 !important;
   border-top: 1px solid #ccc;
-  margin-bottom: 0 !important;
 }
 
 .searchbar-engine-one-off-item {
diff --git a/browser/themes/shared/controlcenter/panel.inc.css b/browser/themes/shared/controlcenter/panel.inc.css
index fd45ab104651..485a9278ac14 100644
--- a/browser/themes/shared/controlcenter/panel.inc.css
+++ b/browser/themes/shared/controlcenter/panel.inc.css
@@ -1,32 +1,90 @@
-#identity-popup-content-box:not(.chromeUI) > #identity-popup-brandName,
-#identity-popup-content-box:not(.chromeUI) > #identity-popup-chromeLabel,
-#identity-popup-content-box.chromeUI > .identity-popup-label:not(#identity-popup-brandName):not(#identity-popup-chromeLabel),
-#identity-popup-content-box.chromeUI > .identity-popup-description,
-#identity-popup-content-box.unknownIdentity > #identity-popup-connectedToLabel ,
-#identity-popup-content-box.unknownIdentity > #identity-popup-runByLabel ,
-#identity-popup-content-box.unknownIdentity > #identity-popup-content-host ,
-#identity-popup-content-box.unknownIdentity > #identity-popup-content-owner ,
-#identity-popup-content-box.verifiedIdentity > #identity-popup-connectedToLabel2 ,
-#identity-popup-content-box.verifiedDomain > #identity-popup-connectedToLabel2 ,
-#identity-popup-content-box.verifiedDomain > #identity-popup-runByLabel {
+#identity-popup-content-box:not(.verifiedIdentity) > #identity-popup-content-owner,
+#identity-popup-content-box:not(.verifiedIdentity):not(.verifiedDomain) > #identity-popup-content-verifier,
+#identity-popup-content-box:not(.verifiedIdentity):not(.mixedContent) > #identity-popup-content-supplemental,
+#identity-popup-content-box:not(.verifiedIdentity):not(.verifiedDomain):not(.chromeUI) > #identity-popup-connection-secure,
+#identity-popup-content-box:not(.unknownIdentity) > #identity-popup-connection-not-secure {
   display: none;
 }
 
+/* PANEL */
+
+#identity-popup > .panel-arrowcontainer > .panel-arrowcontent {
+  padding: 0;
+}
+
+#identity-popup-container {
+  min-width: 25em;
+  padding: 10px;
+}
+
+/* ICON */
+
 #identity-popup.chromeUI > #identity-popup-container > #identity-popup-icon {
   list-style-image: url("chrome://branding/content/icon64.png");
 }
 
-#identity-popup-brandName {
-  font-weight: bold;
-  font-size: 1.25em;
-  margin-top: .5em;
-  margin-bottom: .5em;
+@media (min-resolution: 1.1dppx) {
+  #identity-popup.chromeUI > #identity-popup-container > #identity-popup-icon {
+    list-style-image: url("chrome://branding/content/icon128.png");
+  }
+}
+
+/* CONTENT */
+
+.identity-popup-label {
+  font-size: 120%;
+  white-space: pre-wrap;
+  -moz-padding-start: 15px;
+  margin: 0;
+}
+
+.identity-popup-description {
+  white-space: pre-wrap;
+  -moz-padding-start: 15px;
+  margin: 2px 0 4px;
+  font-size: 110%;
 }
 
 #identity-popup-content-box {
-  max-width: 50ch;
+  width: 40ch;
 }
 
+#identity-popup-content-host {
+  font-size: 140%;
+}
+
+#identity-popup-content-owner {
+  margin-bottom: 0;
+  font-weight: 700;
+}
+
+#identity-popup-content-host,
+#identity-popup-content-owner {
+  max-width: 300px;
+}
+
+#identity-popup-connection-secure,
+#identity-popup-connection-not-secure,
+#identity-popup-content-supplemental {
+  margin-bottom: 1em;
+}
+
+#identity-popup-connection-secure {
+  color: #418220;
+}
+
+#identity-popup-connection-not-secure {
+  color: #d74345;
+}
+
+/* PERMISSIONS */
+
+#identity-popup-permissions {
+  margin-top: 1em;
+}
+
+/* FOOTER BUTTONS */
+
 #identity-popup-button-container {
   background-color: hsla(210,4%,10%,.07);
 }
@@ -50,10 +108,3 @@
   background-color: hsla(210,4%,10%,.12);
   box-shadow: 0 1px 0 hsla(210,4%,10%,.05) inset;
 }
-
-@media (min-resolution: 1.1dppx) {
-  #identity-popup.chromeUI > #identity-popup-container > #identity-popup-icon {
-    list-style-image: url("chrome://branding/content/icon128.png");
-    -moz-image-region: rect(0, 128px, 128px, 0);
-  }
-}
diff --git a/browser/themes/shared/customizableui/panelUIOverlay.inc.css b/browser/themes/shared/customizableui/panelUIOverlay.inc.css
index 8123ccde3bc0..948fae708233 100644
--- a/browser/themes/shared/customizableui/panelUIOverlay.inc.css
+++ b/browser/themes/shared/customizableui/panelUIOverlay.inc.css
@@ -461,6 +461,8 @@ toolbaritem[cui-areatype="menu-panel"][sdkstylewidget="true"]:not(.panel-wide-it
 /* has the minimum size we want, but no padding/margin. */
 .panelUI-grid .toolbarbutton-1 > .toolbarbutton-badge-container > .toolbarbutton-icon,
 .customization-palette .toolbarbutton-1 > .toolbarbutton-badge-container > .toolbarbutton-icon {
+  width: 32px;
+  height: 32px;
   min-width: 32px;
   min-height: 32px;
   margin: 0;
diff --git a/browser/themes/shared/login-doorhanger.inc.css b/browser/themes/shared/login-doorhanger.inc.css
index 1b32443a0027..536ff417cafb 100644
--- a/browser/themes/shared/login-doorhanger.inc.css
+++ b/browser/themes/shared/login-doorhanger.inc.css
@@ -1,3 +1,38 @@
+#notification-popup[popupid="login-fill"] > .panel-arrowcontainer > .panel-arrowcontent {
+  /* Since we display a sliding subview that extends to the border, we cannot
+   * keep the default padding of arrow panels. We use the same padding in the
+   * individual content views instead. Since we removed the padding, we also
+   * have to ensure the contents are clipped to the border box. */
+  padding: 0;
+  overflow: hidden;
+}
+
+#login-fill-mainview,
+#login-fill-details {
+  padding: var(--panel-arrowcontent-padding);
+}
+
+#login-fill-doorhanger[inDetailView] > #login-fill-mainview {
+  transform: translateX(-14px);
+}
+
+#login-fill-mainview,
+#login-fill-details {
+  transition: transform 150ms;
+}
+
+#login-fill-doorhanger:not([inDetailView]) > #login-fill-details {
+  transform: translateX(105%);
+}
+
+#login-fill-doorhanger:not([inDetailView]) > #login-fill-details:-moz-locale-dir(rtl) {
+  transform: translateX(-105%);
+}
+
+#login-fill-doorhanger[inDetailView] > #login-fill-clickcapturer {
+  background-color: hsla(210,4%,10%,.1);
+}
+
 #login-fill-testing {
   color: #b33;
   font-weight: bold;
@@ -31,3 +66,14 @@
   margin: 4px;
   color: #888;
 }
+
+#login-fill-details {
+  padding: 4px;
+  background: var(--panel-arrowcontent-background);
+  color: var(--panel-arrowcontent-color);
+  background-clip: padding-box;
+  border-left: 1px solid hsla(210,4%,10%,.3);
+  box-shadow: 0 3px 5px hsla(210,4%,10%,.1),
+              0 0 7px hsla(210,4%,10%,.1);
+  -moz-margin-start: 38px;
+}
diff --git a/browser/themes/shared/menupanel.inc.css b/browser/themes/shared/menupanel.inc.css
index d3d72424e5f3..4d07ff8dd240 100644
--- a/browser/themes/shared/menupanel.inc.css
+++ b/browser/themes/shared/menupanel.inc.css
@@ -375,6 +375,42 @@
     -moz-image-region: rect(64px, 1984px, 128px, 1920px);
   }
 
+  #loop-button[cui-areatype="menu-panel"] > .toolbarbutton-badge-container,
+  toolbarpaletteitem[place="palette"] > #loop-button > .toolbarbutton-badge-container {
+    list-style-image: url(chrome://browser/skin/loop/menuPanel@2x.png);
+    -moz-image-region: rect(0, 64px, 64px, 0);
+  }
+
+  /* Make sure that the state icons are not shown in the customization palette. */
+  toolbarpaletteitem[place="palette"] > #loop-button > .toolbarbutton-badge-container {
+    -moz-image-region: rect(0, 64px, 64px, 0) !important;
+  }
+
+  #loop-button[cui-areatype="menu-panel"][state="disabled"] > .toolbarbutton-badge-container,
+  #loop-button[cui-areatype="menu-panel"][disabled="true"] > .toolbarbutton-badge-container {
+    -moz-image-region: rect(0, 128px, 64px, 64px);
+  }
+
+  #loop-button[cui-areatype="menu-panel"]:not([disabled="true"])[state="error"] > .toolbarbutton-badge-container {
+    -moz-image-region: rect(0, 192px, 64px, 128px);
+  }
+
+  #loop-button[cui-areatype="menu-panel"]:not([disabled="true"])[state="action"] > .toolbarbutton-badge-container {
+    -moz-image-region: rect(0, 256px, 64px, 192px);
+  }
+
+  #loop-button[cui-areatype="menu-panel"]:not([disabled="true"])[state="action"]:-moz-any(:hover,:hover:active,[open]) > .toolbarbutton-badge-container {
+    -moz-image-region: rect(0, 320px, 64px, 256px);
+  }
+
+  #loop-button[cui-areatype="menu-panel"]:not([disabled="true"])[state="active"] > .toolbarbutton-badge-container {
+    -moz-image-region: rect(0, 384px, 64px, 320px);
+  }
+
+  #loop-button[cui-areatype="menu-panel"]:not([disabled="true"])[state="active"]:-moz-any(:hover,:hover:active,[open]) > .toolbarbutton-badge-container {
+    -moz-image-region: rect(0, 448px, 64px, 384px);
+  }
+
   #new-tab-button[cui-areatype="menu-panel"],
   toolbarpaletteitem[place="palette"] > #new-tab-button {
     -moz-image-region: rect(0px, 1088px, 64px, 1024px);
diff --git a/browser/themes/shared/toolbarbuttons.inc.css b/browser/themes/shared/toolbarbuttons.inc.css
index 89559ea287a7..9979bc6b704e 100644
--- a/browser/themes/shared/toolbarbuttons.inc.css
+++ b/browser/themes/shared/toolbarbuttons.inc.css
@@ -430,5 +430,38 @@ toolbar[brighttext] #loop-button > .toolbarbutton-badge-container {
 %endif
   }
 
+  #loop-button > .toolbarbutton-badge-container {
+    list-style-image: url("chrome://browser/skin/loop/toolbar@2x.png");
+    -moz-image-region: rect(0, 36px, 36px, 0);
+  }
+
+  toolbar[brighttext] #loop-button > .toolbarbutton-badge-container {
+    list-style-image: url("chrome://browser/skin/loop/toolbar-inverted@2x.png");
+  }
+
+  #loop-button[state="disabled"] > .toolbarbutton-badge-container,
+  #loop-button[disabled="true"] > .toolbarbutton-badge-container {
+    -moz-image-region: rect(0, 72px, 36px, 36px);
+  }
+
+  #loop-button:not([disabled="true"])[state="error"] > .toolbarbutton-badge-container {
+    -moz-image-region: rect(0, 108px, 36px, 72px);
+  }
+
+  #loop-button:not([disabled="true"])[state="action"] > .toolbarbutton-badge-container {
+    -moz-image-region: rect(0, 144px, 36px, 108px);
+  }
+
+  #loop-button:not([disabled="true"])[state="action"]:-moz-any(:hover,:hover:active,[open]) > .toolbarbutton-badge-container {
+    -moz-image-region: rect(0, 180px, 36px, 144px);
+  }
+
+  #loop-button:not([disabled="true"])[state="active"] > .toolbarbutton-badge-container {
+    -moz-image-region: rect(0, 216px, 36px, 180px);
+  }
+
+  #loop-button:not([disabled="true"])[state="active"]:-moz-any(:hover,:hover:active,[open]) > .toolbarbutton-badge-container {
+    -moz-image-region: rect(0, 252px, 36px, 216px);
+  }
 }
 %endif
diff --git a/browser/themes/windows/Secure24-XP.png b/browser/themes/windows/Secure24-XP.png
deleted file mode 100644
index a8cd26ecb3f0..000000000000
Binary files a/browser/themes/windows/Secure24-XP.png and /dev/null differ
diff --git a/browser/themes/windows/Secure24.png b/browser/themes/windows/Secure24.png
deleted file mode 100644
index 78e69b86356a..000000000000
Binary files a/browser/themes/windows/Secure24.png and /dev/null differ
diff --git a/browser/themes/windows/browser-aero.css b/browser/themes/windows/browser-aero.css
index a4352dbcc093..695138b302ab 100644
--- a/browser/themes/windows/browser-aero.css
+++ b/browser/themes/windows/browser-aero.css
@@ -108,14 +108,36 @@
   }
 
   #main-window {
-    -moz-appearance: -moz-win-borderless-glass;
+    -moz-appearance: -moz-win-glass;
     background: transparent;
   }
 
-  #appcontent {
+  /* On win10, if we don't set this on the entire browser container including
+   * the sidebar, if the sidebar is open the accent color bleeds through in
+   * the titlebar */
+  #browser {
     -moz-appearance: -moz-win-exclude-glass;
   }
 
+  @media (-moz-os-version: windows-vista),
+         (-moz-os-version: windows-win7) {
+    #main-window {
+      -moz-appearance: -moz-win-borderless-glass;
+    }
+
+    /* The borders on the glass frame are ours, and inside #browser, and on
+     * vista and win7 we want to make sure they are "glassy", so we can't use
+     * #browser as the exclude-glass container. We use #appcontent instead. */
+    #browser {
+      -moz-appearance: none;
+    }
+
+    #appcontent {
+      -moz-appearance: -moz-win-exclude-glass;
+    }
+  }
+
+
   /* Artificially draw window borders that are covered by lwtheme, see bug 591930. */
   #main-window[sizemode="normal"] > #tab-view-deck > #browser-panel:-moz-lwtheme {
     border-top: 2px solid;
diff --git a/browser/themes/windows/browser.css b/browser/themes/windows/browser.css
index 190da0556f9e..0a4216e15a63 100644
--- a/browser/themes/windows/browser.css
+++ b/browser/themes/windows/browser.css
@@ -592,6 +592,12 @@ menuitem.bookmark-item {
   }
 }
 
+@media (-moz-windows-theme: luna-silver) and (min-resolution: 1.1dppx) {
+  #loop-button > .toolbarbutton-badge-container {
+    list-style-image: url(chrome://browser/skin/loop/toolbar-lunaSilver@2x.png)
+  }
+}
+
 #main-window:not([customizing]) .toolbarbutton-1[disabled=true] > .toolbarbutton-icon,
 #main-window:not([customizing]) .toolbarbutton-1[disabled=true] > .toolbarbutton-menu-dropmarker,
 #main-window:not([customizing]) .toolbarbutton-1[disabled=true] > .toolbarbutton-menubutton-dropmarker,
diff --git a/browser/themes/windows/controlcenter/panel.css b/browser/themes/windows/controlcenter/panel.css
index 2d16ae9cd967..509dae6dbeac 100644
--- a/browser/themes/windows/controlcenter/panel.css
+++ b/browser/themes/windows/controlcenter/panel.css
@@ -20,63 +20,3 @@
 #identity-popup.verifiedIdentity > #identity-popup-container > #identity-popup-icon {
   -moz-image-region: rect(128px, 64px, 192px, 0px);
 }
-
-/* Popup Body Text */
-.identity-popup-description {
-  white-space: pre-wrap;
-  -moz-padding-start: 15px;
-  margin: 2px 0 4px;
-}
-
-.identity-popup-label {
-  white-space: pre-wrap;
-  -moz-padding-start: 15px;
-  margin: 0;
-}
-
-#identity-popup-content-host,
-#identity-popup-content-box.verifiedIdentity > #identity-popup-content-owner {
-  font-size: 1.2em;
-}
-
-#identity-popup-content-host {
-  margin-top: 3px;
-  margin-bottom: 5px;
-  font-weight: bold;
-  max-width: 300px;
-}
-
-#identity-popup-content-owner {
-  margin-top: 4px;
-  margin-bottom: 0 !important;
-  font-weight: bold;
-  max-width: 300px;
-}
-
-.verifiedDomain > #identity-popup-content-owner {
-  font-weight: normal;
-}
-
-#identity-popup-content-verifier {
-  margin: 4px 0 2px;
-}
-
-#identity-popup-content-box.verifiedIdentity > #identity-popup-encryption ,
-#identity-popup-content-box.verifiedDomain > #identity-popup-encryption {
-  margin-top: 10px;
-  -moz-margin-start: -24px;
-}
-
-#identity-popup-content-box.verifiedIdentity > #identity-popup-encryption > vbox > #identity-popup-encryption-icon ,
-#identity-popup-content-box.verifiedDomain > #identity-popup-encryption > vbox > #identity-popup-encryption-icon {
-  list-style-image: url("chrome://browser/skin/Secure24.png");
-}
-
-#identity-popup > .panel-arrowcontainer > .panel-arrowcontent {
-  padding: 0;
-}
-
-#identity-popup-container {
-  min-width: 280px;
-  padding: 10px;
-}
diff --git a/browser/themes/windows/jar.mn b/browser/themes/windows/jar.mn
index 5567e4be2983..0eda1d7d7088 100644
--- a/browser/themes/windows/jar.mn
+++ b/browser/themes/windows/jar.mn
@@ -121,8 +121,6 @@ browser.jar:
         skin/classic/browser/search-indicator-badge-add.png          (../shared/search/search-indicator-badge-add.png)
         skin/classic/browser/search-indicator-badge-add@2x.png       (../shared/search/search-indicator-badge-add@2x.png)
         skin/classic/browser/search-history-icon.svg                 (../shared/search/history-icon.svg)
-        skin/classic/browser/Secure24.png
-        skin/classic/browser/Secure24-XP.png
         skin/classic/browser/setDesktopBackground.css
         skin/classic/browser/slowStartup-16.png
         skin/classic/browser/theme-switcher-icon.png                 (../shared/theme-switcher-icon.png)
@@ -171,12 +169,19 @@ browser.jar:
         skin/classic/browser/webRTC-microphone-white-16.png          (../shared/webrtc/microphone-white-16.png)
         skin/classic/browser/webRTC-screen-white-16.png              (../shared/webrtc/screen-white-16.png)
         skin/classic/browser/loop/menuPanel.png                      (loop/menuPanel.png)
+        skin/classic/browser/loop/menuPanel@2x.png                   (loop/menuPanel@2x.png)
         skin/classic/browser/loop/menuPanel-aero.png                 (loop/menuPanel-aero.png)
+        skin/classic/browser/loop/menuPanel-aero@2x.png              (loop/menuPanel-aero@2x.png)
         skin/classic/browser/loop/toolbar.png                        (loop/toolbar.png)
+        skin/classic/browser/loop/toolbar@2x.png                     (loop/toolbar@2x.png)
         skin/classic/browser/loop/toolbar-aero.png                   (loop/toolbar-aero.png)
+        skin/classic/browser/loop/toolbar-aero@2x.png                (loop/toolbar-aero@2x.png)
         skin/classic/browser/loop/toolbar-inverted.png               (loop/toolbar-inverted.png)
+        skin/classic/browser/loop/toolbar-inverted@2x.png            (loop/toolbar-inverted@2x.png)
         skin/classic/browser/loop/toolbar-XP.png                     (loop/toolbar-XP.png)
+        skin/classic/browser/loop/toolbar-XP@2x.png                  (loop/toolbar-XP@2x.png)
         skin/classic/browser/loop/toolbar-lunaSilver.png             (loop/toolbar-lunaSilver.png)
+        skin/classic/browser/loop/toolbar-lunaSilver@2x.png          (loop/toolbar-lunaSilver@2x.png)
 *       skin/classic/browser/controlcenter/panel.css                 (controlcenter/panel.css)
         skin/classic/browser/customizableui/background-noise-toolbar.png  (customizableui/background-noise-toolbar.png)
         skin/classic/browser/customizableui/customizeFavicon.ico  (../shared/customizableui/customizeFavicon.ico)
@@ -584,7 +589,6 @@ browser.jar:
 % override chrome://browser/skin/pageInfo.png                         chrome://browser/skin/pageInfo-XP.png                             os=WINNT osversion<6
 % override chrome://browser/skin/Privacy-16.png                       chrome://browser/skin/Privacy-16-XP.png                           os=WINNT osversion<6
 % override chrome://browser/skin/searchbar-dropdown-arrow.png         chrome://browser/skin/searchbar-dropdown-arrow-XP.png             os=WINNT osversion<6
-% override chrome://browser/skin/Secure24.png                         chrome://browser/skin/Secure24-XP.png                             os=WINNT osversion<6
 % override chrome://browser/skin/downloads/buttons.png                chrome://browser/skin/downloads/buttons-XP.png                    os=WINNT osversion<6
 % override chrome://browser/skin/feeds/feedIcon.png                   chrome://browser/skin/feeds/feedIcon-XP.png                       os=WINNT osversion<6
 % override chrome://browser/skin/feeds/feedIcon16.png                 chrome://browser/skin/feeds/feedIcon16-XP.png                     os=WINNT osversion<6
@@ -632,6 +636,8 @@ browser.jar:
 % override chrome://browser/skin/Toolbar@2x.png                       chrome://browser/skin/Toolbar-aero@2x.png                         os=WINNT osversion=6.1
 % override chrome://browser/skin/loop/menuPanel.png                   chrome://browser/skin/loop/menuPanel-aero.png                     os=WINNT osversion=6
 % override chrome://browser/skin/loop/menuPanel.png                   chrome://browser/skin/loop/menuPanel-aero.png                     os=WINNT osversion=6.1
+% override chrome://browser/skin/loop/menuPanel@2x.png                chrome://browser/skin/loop/menuPanel-aero@2x.png                  os=WINNT osversion=6
+% override chrome://browser/skin/loop/menuPanel@2x.png                chrome://browser/skin/loop/menuPanel-aero@2x.png                  os=WINNT osversion=6.1
 
 % override chrome://browser/skin/Toolbar.png                          chrome://browser/skin/Toolbar-aero.png                            os=WINNT osversion=6
 % override chrome://browser/skin/Toolbar.png                          chrome://browser/skin/Toolbar-aero.png                            os=WINNT osversion=6.1
@@ -639,6 +645,9 @@ browser.jar:
 % override chrome://browser/skin/loop/toolbar.png                     chrome://browser/skin/loop/toolbar-aero.png                       os=WINNT osversion=6
 % override chrome://browser/skin/loop/toolbar.png                     chrome://browser/skin/loop/toolbar-aero.png                       os=WINNT osversion=6.1
 % override chrome://browser/skin/loop/toolbar.png                     chrome://browser/skin/loop/toolbar-XP.png                         os=WINNT osversion<6
+% override chrome://browser/skin/loop/toolbar@2x.png                  chrome://browser/skin/loop/toolbar-aero@2x.png                    os=WINNT osversion=6
+% override chrome://browser/skin/loop/toolbar@2x.png                  chrome://browser/skin/loop/toolbar-aero@2x.png                    os=WINNT osversion=6.1
+% override chrome://browser/skin/loop/toolbar@2x.png                  chrome://browser/skin/loop/toolbar-XP@2x.png                      os=WINNT osversion<6
 % override chrome://browser/skin/preferences/checkbox.png             chrome://browser/skin/preferences/checkbox-aero.png               os=WINNT osversion=6
 % override chrome://browser/skin/preferences/checkbox.png             chrome://browser/skin/preferences/checkbox-aero.png               os=WINNT osversion=6.1
 % override chrome://browser/skin/preferences/checkbox.png             chrome://browser/skin/preferences/checkbox-xp.png                 os=WINNT osversion<6
diff --git a/browser/themes/windows/loop/menuPanel-aero@2x.png b/browser/themes/windows/loop/menuPanel-aero@2x.png
new file mode 100644
index 000000000000..90f3bf5a8c9b
Binary files /dev/null and b/browser/themes/windows/loop/menuPanel-aero@2x.png differ
diff --git a/browser/themes/windows/loop/menuPanel@2x.png b/browser/themes/windows/loop/menuPanel@2x.png
new file mode 100644
index 000000000000..f52cf225fd8f
Binary files /dev/null and b/browser/themes/windows/loop/menuPanel@2x.png differ
diff --git a/browser/themes/windows/loop/toolbar-XP@2x.png b/browser/themes/windows/loop/toolbar-XP@2x.png
new file mode 100644
index 000000000000..8372dda3d73a
Binary files /dev/null and b/browser/themes/windows/loop/toolbar-XP@2x.png differ
diff --git a/browser/themes/windows/loop/toolbar-aero@2x.png b/browser/themes/windows/loop/toolbar-aero@2x.png
new file mode 100644
index 000000000000..f4e7e1e7af96
Binary files /dev/null and b/browser/themes/windows/loop/toolbar-aero@2x.png differ
diff --git a/browser/themes/windows/loop/toolbar-inverted@2x.png b/browser/themes/windows/loop/toolbar-inverted@2x.png
new file mode 100644
index 000000000000..1178851df126
Binary files /dev/null and b/browser/themes/windows/loop/toolbar-inverted@2x.png differ
diff --git a/browser/themes/windows/loop/toolbar-lunaSilver@2x.png b/browser/themes/windows/loop/toolbar-lunaSilver@2x.png
new file mode 100644
index 000000000000..0035bc3a5f96
Binary files /dev/null and b/browser/themes/windows/loop/toolbar-lunaSilver@2x.png differ
diff --git a/browser/themes/windows/loop/toolbar@2x.png b/browser/themes/windows/loop/toolbar@2x.png
new file mode 100644
index 000000000000..c1fc1de1abb6
Binary files /dev/null and b/browser/themes/windows/loop/toolbar@2x.png differ
diff --git a/build/mobile/robocop/FennecNativeElement.java b/build/mobile/robocop/FennecNativeElement.java
index dbf076a9bfc9..2a24344fd072 100644
--- a/build/mobile/robocop/FennecNativeElement.java
+++ b/build/mobile/robocop/FennecNativeElement.java
@@ -68,7 +68,6 @@ public class FennecNativeElement implements Element {
                         mText = et.getEditableText();
                     } else if (v instanceof TextSwitcher) {
                         TextSwitcher ts = (TextSwitcher)v;
-                        ts.getNextView();
                         mText = ((TextView)ts.getCurrentView()).getText();
                     } else if (v instanceof ViewGroup) {
                         ViewGroup vg = (ViewGroup)v;
diff --git a/caps/BasePrincipal.cpp b/caps/BasePrincipal.cpp
index b18b402a378f..ae328a8de84b 100644
--- a/caps/BasePrincipal.cpp
+++ b/caps/BasePrincipal.cpp
@@ -17,44 +17,109 @@
 
 #include "mozilla/dom/CSPDictionariesBinding.h"
 #include "mozilla/dom/ToJSValue.h"
+#include "mozilla/dom/URLSearchParams.h"
 
 namespace mozilla {
 
+using dom::URLSearchParams;
+
 void
 OriginAttributes::CreateSuffix(nsACString& aStr) const
 {
-  aStr.Truncate();
   MOZ_RELEASE_ASSERT(mAppId != nsIScriptSecurityManager::UNKNOWN_APP_ID);
-  int attrCount = 0;
+
+  nsRefPtr<URLSearchParams> usp = new URLSearchParams();
+  nsAutoString value;
 
   if (mAppId != nsIScriptSecurityManager::NO_APP_ID) {
-    aStr.Append(attrCount++ ? "&appId=" : "!appId=");
-    aStr.AppendInt(mAppId);
+    value.AppendInt(mAppId);
+    usp->Set(NS_LITERAL_STRING("appId"), value);
   }
 
   if (mInBrowser) {
-    aStr.Append(attrCount++ ? "&inBrowser=1" : "!inBrowser=1");
+    usp->Set(NS_LITERAL_STRING("inBrowser"), NS_LITERAL_STRING("1"));
+  }
+
+  aStr.Truncate();
+
+  usp->Serialize(value);
+  if (!value.IsEmpty()) {
+    aStr.AppendLiteral("!");
+    aStr.Append(NS_ConvertUTF16toUTF8(value));
   }
 }
 
-void
-OriginAttributes::Serialize(nsIObjectOutputStream* aStream) const
+namespace {
+
+class MOZ_STACK_CLASS PopulateFromSuffixIterator final
+  : public URLSearchParams::ForEachIterator
 {
-  aStream->Write32(mAppId);
-  aStream->WriteBoolean(mInBrowser);
+public:
+  explicit PopulateFromSuffixIterator(OriginAttributes* aOriginAttributes)
+    : mOriginAttributes(aOriginAttributes)
+  {
+    MOZ_ASSERT(aOriginAttributes);
+  }
+
+  bool URLSearchParamsIterator(const nsString& aName,
+                               const nsString& aValue) override
+  {
+    if (aName.EqualsLiteral("appId")) {
+      nsresult rv;
+      mOriginAttributes->mAppId = aValue.ToInteger(&rv);
+      if (NS_WARN_IF(NS_FAILED(rv))) {
+        return false;
+      }
+
+      if (mOriginAttributes->mAppId == nsIScriptSecurityManager::UNKNOWN_APP_ID) {
+        return false;
+      }
+
+      return true;
+    }
+
+    if (aName.EqualsLiteral("inBrowser")) {
+      if (!aValue.EqualsLiteral("1")) {
+        return false;
+      }
+
+      mOriginAttributes->mInBrowser = true;
+      return true;
+    }
+
+    // No other attributes are supported.
+    return false;
+  }
+
+private:
+  OriginAttributes* mOriginAttributes;
+};
+
+} // anonymous namespace
+
+bool
+OriginAttributes::PopulateFromSuffix(const nsACString& aStr)
+{
+  if (aStr.IsEmpty()) {
+    return true;
+  }
+
+  if (aStr[0] != '!') {
+    return false;
+  }
+
+  nsRefPtr<URLSearchParams> usp = new URLSearchParams();
+  usp->ParseInput(Substring(aStr, 1, aStr.Length() - 1), nullptr);
+
+  PopulateFromSuffixIterator iterator(this);
+  return usp->ForEach(iterator);
 }
 
-nsresult
-OriginAttributes::Deserialize(nsIObjectInputStream* aStream)
-{
-  nsresult rv = aStream->Read32(&mAppId);
-  NS_ENSURE_SUCCESS(rv, rv);
+BasePrincipal::BasePrincipal()
+{}
 
-  rv = aStream->ReadBoolean(&mInBrowser);
-  NS_ENSURE_SUCCESS(rv, rv);
-
-  return NS_OK;
-}
+BasePrincipal::~BasePrincipal()
+{}
 
 NS_IMETHODIMP
 BasePrincipal::GetOrigin(nsACString& aOrigin)
diff --git a/caps/BasePrincipal.h b/caps/BasePrincipal.h
index d36bbfc940ed..5a5576d33d4f 100644
--- a/caps/BasePrincipal.h
+++ b/caps/BasePrincipal.h
@@ -13,6 +13,7 @@
 
 #include "mozilla/dom/SystemDictionariesBinding.h"
 
+class nsIContentSecurityPolicy;
 class nsIObjectOutputStream;
 class nsIObjectInputStream;
 
@@ -38,13 +39,11 @@ public:
     return !(*this == aOther);
   }
 
-  // Serializes non-default values into the suffix format, i.e.
+  // Serializes/Deserializes non-default values into the suffix format, i.e.
   // |!key1=value1&key2=value2|. If there are no non-default attributes, this
   // returns an empty string.
   void CreateSuffix(nsACString& aStr) const;
-
-  void Serialize(nsIObjectOutputStream* aStream) const;
-  nsresult Deserialize(nsIObjectInputStream* aStream);
+  bool PopulateFromSuffix(const nsACString& aStr);
 };
 
 /*
@@ -57,7 +56,7 @@ public:
 class BasePrincipal : public nsJSPrincipals
 {
 public:
-  BasePrincipal() {}
+  BasePrincipal();
 
   enum DocumentDomainConsideration { DontConsiderDocumentDomain, ConsiderDocumentDomain};
   bool Subsumes(nsIPrincipal* aOther, DocumentDomainConsideration aConsideration);
@@ -93,7 +92,7 @@ public:
   bool IsInBrowserElement() const { return mOriginAttributes.mInBrowser; }
 
 protected:
-  virtual ~BasePrincipal() {}
+  virtual ~BasePrincipal();
 
   virtual nsresult GetOriginInternal(nsACString& aOrigin) = 0;
   virtual bool SubsumesInternal(nsIPrincipal* aOther, DocumentDomainConsideration aConsider) = 0;
diff --git a/caps/nsNullPrincipal.cpp b/caps/nsNullPrincipal.cpp
index b3313f250d7e..5dba6f941c76 100644
--- a/caps/nsNullPrincipal.cpp
+++ b/caps/nsNullPrincipal.cpp
@@ -82,7 +82,7 @@ nsNullPrincipal::GetHashValue(uint32_t *aResult)
   return NS_OK;
 }
 
-NS_IMETHODIMP 
+NS_IMETHODIMP
 nsNullPrincipal::GetURI(nsIURI** aURI)
 {
   return NS_EnsureSafeToReturn(mURI, aURI);
@@ -160,13 +160,25 @@ nsNullPrincipal::Read(nsIObjectInputStream* aStream)
   // that the Init() method has already been invoked by the time we deserialize.
   // This is in contrast to nsPrincipal, which uses NS_GENERIC_FACTORY_CONSTRUCTOR,
   // in which case ::Read needs to invoke Init().
-  return mOriginAttributes.Deserialize(aStream);
+  nsAutoCString suffix;
+  nsresult rv = aStream->ReadCString(suffix);
+  NS_ENSURE_SUCCESS(rv, rv);
+
+  bool ok = mOriginAttributes.PopulateFromSuffix(suffix);
+  NS_ENSURE_TRUE(ok, NS_ERROR_FAILURE);
+
+  return NS_OK;
 }
 
 NS_IMETHODIMP
 nsNullPrincipal::Write(nsIObjectOutputStream* aStream)
 {
-  OriginAttributesRef().Serialize(aStream);
+  nsAutoCString suffix;
+  OriginAttributesRef().CreateSuffix(suffix);
+
+  nsresult rv = aStream->WriteStringZ(suffix.get());
+  NS_ENSURE_SUCCESS(rv, rv);
+
   return NS_OK;
 }
 
diff --git a/caps/nsNullPrincipal.h b/caps/nsNullPrincipal.h
index 56e27a6ed25c..9d267e12fbf0 100644
--- a/caps/nsNullPrincipal.h
+++ b/caps/nsNullPrincipal.h
@@ -23,8 +23,8 @@
 class nsIURI;
 
 #define NS_NULLPRINCIPAL_CID \
-{ 0xa0bd8b42, 0xf6bf, 0x4fb9, \
-  { 0x93, 0x42, 0x90, 0xbf, 0xc9, 0xb7, 0xa1, 0xab } }
+{ 0xe502ffb8, 0x5d95, 0x48e8, \
+  { 0x82, 0x3c, 0x0d, 0x29, 0xd8, 0x3a, 0x59, 0x33 } }
 #define NS_NULLPRINCIPAL_CONTRACTID "@mozilla.org/nullprincipal;1"
 
 #define NS_NULLPRINCIPAL_SCHEME "moz-nullprincipal"
diff --git a/caps/nsPrincipal.cpp b/caps/nsPrincipal.cpp
index 38d11018255e..2cc06e78552b 100644
--- a/caps/nsPrincipal.cpp
+++ b/caps/nsPrincipal.cpp
@@ -360,10 +360,14 @@ nsPrincipal::Read(nsIObjectInputStream* aStream)
 
   domain = do_QueryInterface(supports);
 
-  OriginAttributes attrs;
-  rv = attrs.Deserialize(aStream);
+  nsAutoCString suffix;
+  rv = aStream->ReadCString(suffix);
   NS_ENSURE_SUCCESS(rv, rv);
 
+  OriginAttributes attrs;
+  bool ok = attrs.PopulateFromSuffix(suffix);
+  NS_ENSURE_TRUE(ok, NS_ERROR_FAILURE);
+
   rv = NS_ReadOptionalObject(aStream, true, getter_AddRefs(supports));
   NS_ENSURE_SUCCESS(rv, rv);
 
@@ -404,7 +408,11 @@ nsPrincipal::Write(nsIObjectOutputStream* aStream)
     return rv;
   }
 
-  OriginAttributesRef().Serialize(aStream);
+  nsAutoCString suffix;
+  OriginAttributesRef().CreateSuffix(suffix);
+
+  rv = aStream->WriteStringZ(suffix.get());
+  NS_ENSURE_SUCCESS(rv, rv);
 
   rv = NS_WriteOptionalCompoundObject(aStream, mCSP,
                                       NS_GET_IID(nsIContentSecurityPolicy),
diff --git a/caps/nsPrincipal.h b/caps/nsPrincipal.h
index 728c7104a51e..538031228488 100644
--- a/caps/nsPrincipal.h
+++ b/caps/nsPrincipal.h
@@ -112,12 +112,12 @@ private:
 
 #define NS_PRINCIPAL_CONTRACTID "@mozilla.org/principal;1"
 #define NS_PRINCIPAL_CID \
-  { 0x09b7e598, 0x490d, 0x423f, \
-    { 0xa8, 0xa6, 0x2e, 0x6c, 0x4e, 0xc8, 0x77, 0x50 }}
+  { 0xb7c8505e, 0xc56d, 0x4191, \
+    { 0xa1, 0x5e, 0x5d, 0xcb, 0x88, 0x9b, 0xa0, 0x94 }}
 
 #define NS_EXPANDEDPRINCIPAL_CONTRACTID "@mozilla.org/expandedprincipal;1"
 #define NS_EXPANDEDPRINCIPAL_CID \
-  { 0xb33a3807, 0xb76c, 0x44e5, \
-    { 0xb9, 0x9d, 0x95, 0x7e, 0xe9, 0xba, 0x6e, 0x39 }}
+  { 0x38539471, 0x68cc, 0x4a6f, \
+    { 0x81, 0x20, 0xdb, 0xd5, 0x4a, 0x22, 0x0a, 0x13 }}
 
 #endif // nsPrincipal_h__
diff --git a/docshell/base/nsAboutRedirector.cpp b/docshell/base/nsAboutRedirector.cpp
index 26fe6b222502..fd90e684c102 100644
--- a/docshell/base/nsAboutRedirector.cpp
+++ b/docshell/base/nsAboutRedirector.cpp
@@ -105,6 +105,7 @@ static RedirEntry kRedirMap[] = {
   },
   {
     "serviceworkers", "chrome://global/content/aboutServiceWorkers.xhtml",
+    nsIAboutModule::URI_CAN_LOAD_IN_CHILD |
     nsIAboutModule::ALLOW_SCRIPT
   },
   // about:srcdoc is unresolvable by specification.  It is included here
diff --git a/docshell/test/browser/browser_timelineMarkers-frame-05.js b/docshell/test/browser/browser_timelineMarkers-frame-05.js
index eaa9b4150d29..bca5d882a9f2 100644
--- a/docshell/test/browser/browser_timelineMarkers-frame-05.js
+++ b/docshell/test/browser/browser_timelineMarkers-frame-05.js
@@ -78,24 +78,28 @@ let TESTS = [{
     ok(markers[0].endStack.functionDisplayName == "testConsoleTimeEnd",
        "testConsoleTimeEnd is on the stack");
   }
-}, {
-  desc: "Async stack trace on Promise",
-  searchFor: "ConsoleTime",
-  setup: function(docShell) {
-    let resolver = makePromise();
-    resolvePromise(resolver);
-  },
-  check: function(markers) {
-    markers = markers.filter(m => m.name == "ConsoleTime");
-    ok(markers.length > 0, "Promise marker includes stack");
-
-    let frame = markers[0].endStack;
-    ok(frame.parent.asyncParent !== null, "Parent frame has async parent");
-    is(frame.parent.asyncParent.asyncCause, "Promise",
-       "Async parent has correct cause");
-    is(frame.parent.asyncParent.functionDisplayName, "makePromise",
-       "Async parent has correct function name");
-  }
 }];
 
+if (Services.prefs.getBoolPref("javascript.options.asyncstack")) {
+  TESTS.push({
+    desc: "Async stack trace on Promise",
+    searchFor: "ConsoleTime",
+    setup: function(docShell) {
+      let resolver = makePromise();
+      resolvePromise(resolver);
+    },
+    check: function(markers) {
+      markers = markers.filter(m => m.name == "ConsoleTime");
+      ok(markers.length > 0, "Promise marker includes stack");
+
+      let frame = markers[0].endStack;
+      ok(frame.parent.asyncParent !== null, "Parent frame has async parent");
+      is(frame.parent.asyncParent.asyncCause, "Promise",
+         "Async parent has correct cause");
+      is(frame.parent.asyncParent.functionDisplayName, "makePromise",
+         "Async parent has correct function name");
+    }
+  });
+}
+
 timelineContentTest(TESTS);
diff --git a/dom/base/Element.cpp b/dom/base/Element.cpp
index 1b67f22644c7..4799eff73276 100644
--- a/dom/base/Element.cpp
+++ b/dom/base/Element.cpp
@@ -3151,8 +3151,9 @@ Element::MozRequestFullScreen(JSContext* aCx, JS::Handle<JS::Value> aOptions,
   }
 
   FullScreenOptions opts;
-  RequestFullscreenOptions fsOptions;
+  opts.mIsCallerChrome = nsContentUtils::IsCallerChrome();
 
+  RequestFullscreenOptions fsOptions;
   // We need to check if options is convertible to a dict first before
   // trying to init fsOptions; otherwise Init() would throw, and we want to
   // silently ignore non-dictionary values
diff --git a/dom/base/URLSearchParams.h b/dom/base/URLSearchParams.h
index 3d794344a65c..b2df86067979 100644
--- a/dom/base/URLSearchParams.h
+++ b/dom/base/URLSearchParams.h
@@ -27,6 +27,10 @@ public:
   virtual void URLSearchParamsUpdated(URLSearchParams* aFromThis) = 0;
 };
 
+// This class is used in BasePrincipal and it's _extremely_ important that the
+// attributes are kept in the correct order. If this changes, please, update
+// BasePrincipal code.
+
 class URLSearchParams final : public nsISupports,
                               public nsWrapperCache
 {
@@ -81,15 +85,24 @@ public:
     Serialize(aRetval);
   }
 
-  typedef void (*ParamFunc)(const nsString& aName, const nsString& aValue,
-                            void* aClosure);
+  class ForEachIterator
+  {
+  public:
+    virtual bool
+    URLSearchParamsIterator(const nsString& aName, const nsString& aValue) = 0;
+  };
 
-  void
-  ForEach(ParamFunc aFunc, void* aClosure)
+  bool
+  ForEach(ForEachIterator& aIterator)
   {
     for (uint32_t i = 0; i < mSearchParams.Length(); ++i) {
-      aFunc(mSearchParams[i].mKey, mSearchParams[i].mValue, aClosure);
+      if (!aIterator.URLSearchParamsIterator(mSearchParams[i].mKey,
+                                             mSearchParams[i].mValue)) {
+        return false;
+      }
     }
+
+    return true;
   }
 
 private:
diff --git a/dom/base/nsContentUtils.cpp b/dom/base/nsContentUtils.cpp
index bc885a5b5818..447f5ec099d2 100644
--- a/dom/base/nsContentUtils.cpp
+++ b/dom/base/nsContentUtils.cpp
@@ -7787,16 +7787,3 @@ nsContentUtils::FirePageShowEvent(nsIDocShellTreeItem* aItem,
     doc->OnPageShow(true, aChromeEventHandler);
   }
 }
-
-/* static */
-already_AddRefed<nsPIWindowRoot>
-nsContentUtils::GetWindowRoot(nsIDocument* aDoc)
-{
-  if (aDoc) {
-    nsPIDOMWindow* win = aDoc->GetWindow();
-    if (win) {
-      return win->GetTopWindowRoot();
-    }
-  }
-  return nullptr;
-}
diff --git a/dom/base/nsContentUtils.h b/dom/base/nsContentUtils.h
index 3c294b834959..8a1e68447f62 100644
--- a/dom/base/nsContentUtils.h
+++ b/dom/base/nsContentUtils.h
@@ -99,7 +99,6 @@ class nsViewportInfo;
 class nsWrapperCache;
 class nsAttrValue;
 class nsITransferable;
-class nsPIWindowRoot;
 
 struct JSPropertyDescriptor;
 struct JSRuntime;
@@ -2364,8 +2363,6 @@ public:
   static void FirePageHideEvent(nsIDocShellTreeItem* aItem,
                                 mozilla::dom::EventTarget* aChromeEventHandler);
 
-  static already_AddRefed<nsPIWindowRoot> GetWindowRoot(nsIDocument* aDoc);
-
 private:
   static bool InitializeEventTable();
 
diff --git a/dom/base/nsDOMWindowUtils.cpp b/dom/base/nsDOMWindowUtils.cpp
index 4eab3c81eef8..af5df238102e 100644
--- a/dom/base/nsDOMWindowUtils.cpp
+++ b/dom/base/nsDOMWindowUtils.cpp
@@ -3127,6 +3127,18 @@ nsDOMWindowUtils::RemoteFrameFullscreenReverted()
   return NS_OK;
 }
 
+NS_IMETHODIMP
+nsDOMWindowUtils::HandleFullscreenRequests(bool* aRetVal)
+{
+  MOZ_RELEASE_ASSERT(nsContentUtils::IsCallerChrome());
+
+  nsCOMPtr<nsIDocument> doc = GetDocument();
+  NS_ENSURE_STATE(doc);
+
+  *aRetVal = nsIDocument::HandlePendingFullscreenRequests(doc);
+  return NS_OK;
+}
+
 nsresult
 nsDOMWindowUtils::ExitFullscreen()
 {
diff --git a/dom/base/nsDocument.cpp b/dom/base/nsDocument.cpp
index d8e30570ec50..0a03224f1662 100644
--- a/dom/base/nsDocument.cpp
+++ b/dom/base/nsDocument.cpp
@@ -16,6 +16,8 @@
 #include "mozilla/DebugOnly.h"
 #include "mozilla/MemoryReporting.h"
 #include "mozilla/Likely.h"
+#include "mozilla/LinkedList.h"
+#include "mozilla/UniquePtr.h"
 #include <algorithm>
 
 #include "mozilla/Logging.h"
@@ -10885,9 +10887,9 @@ namespace mozilla {
 // presses the escape key.
 class FullscreenRoots {
 public:
-  // Adds a root to the manager. Adding a root multiple times does not result
-  // in duplicate entries for that item, only one.
-  static void Add(nsIDocument* aRoot);
+  // Adds the root of given document to the manager. Calling this method
+  // with a document whose root is already contained has no effect.
+  static void Add(nsIDocument* aDoc);
 
   // Iterates over every root in the root list, and calls aFunction, passing
   // each root once to aFunction. It is safe to call Add() and Remove() while
@@ -10896,8 +10898,8 @@ public:
   // are added to the manager during traversal are also not traversed.
   static void ForEach(void(*aFunction)(nsIDocument* aDoc));
 
-  // Removes a specific root from the manager.
-  static void Remove(nsIDocument* aRoot);
+  // Removes the root of a specific document from the manager.
+  static void Remove(nsIDocument* aDoc);
 
   // Returns true if all roots added to the list have been removed.
   static bool IsEmpty();
@@ -10960,13 +10962,14 @@ FullscreenRoots::Contains(nsIDocument* aRoot)
 
 /* static */
 void
-FullscreenRoots::Add(nsIDocument* aRoot)
+FullscreenRoots::Add(nsIDocument* aDoc)
 {
-  if (!FullscreenRoots::Contains(aRoot)) {
+  nsCOMPtr<nsIDocument> root = nsContentUtils::GetRootDocument(aDoc);
+  if (!FullscreenRoots::Contains(root)) {
     if (!sInstance) {
       sInstance = new FullscreenRoots();
     }
-    sInstance->mRoots.AppendElement(do_GetWeakReference(aRoot));
+    sInstance->mRoots.AppendElement(do_GetWeakReference(root));
   }
 }
 
@@ -10989,9 +10992,10 @@ FullscreenRoots::Find(nsIDocument* aRoot)
 
 /* static */
 void
-FullscreenRoots::Remove(nsIDocument* aRoot)
+FullscreenRoots::Remove(nsIDocument* aDoc)
 {
-  uint32_t index = Find(aRoot);
+  nsCOMPtr<nsIDocument> root = nsContentUtils::GetRootDocument(aDoc);
+  uint32_t index = Find(root);
   NS_ASSERTION(index != NotFound,
     "Should only try to remove roots which are still added!");
   if (index == NotFound || !sInstance) {
@@ -11067,13 +11071,6 @@ private:
 static void
 SetWindowFullScreen(nsIDocument* aDoc, bool aValue, gfx::VRHMDInfo *aVRHMD = nullptr)
 {
-  // Maintain list of fullscreen root documents.
-  nsCOMPtr<nsIDocument> root = nsContentUtils::GetRootDocument(aDoc);
-  if (aValue) {
-    FullscreenRoots::Add(root);
-  } else {
-    FullscreenRoots::Remove(root);
-  }
   nsContentUtils::AddScriptRunner(new nsSetWindowFullScreen(aDoc, aValue, aVRHMD));
 }
 
@@ -11189,6 +11186,7 @@ ExitFullscreenInDocTree(nsIDocument* aMaybeNotARootDoc)
                              true, true);
   asyncDispatcher->PostDOMEvent();
   // Move the top-level window out of fullscreen mode.
+  FullscreenRoots::Remove(root);
   SetWindowFullScreen(root, false);
 }
 
@@ -11308,6 +11306,7 @@ nsDocument::RestorePreviousFullScreenState()
     nsRefPtr<AsyncEventDispatcher> asyncDispatcher = new AsyncEventDispatcher(
       this, NS_LITERAL_STRING("MozDOMFullscreen:Exited"), true, true);
     asyncDispatcher->PostDOMEvent();
+    FullscreenRoots::Remove(this);
     SetWindowFullScreen(this, false);
   }
 }
@@ -11325,13 +11324,13 @@ FullScreenOptions::FullScreenOptions()
 class nsCallRequestFullScreen : public nsRunnable
 {
 public:
-  explicit nsCallRequestFullScreen(Element* aElement, FullScreenOptions& aOptions)
+  explicit nsCallRequestFullScreen(Element* aElement,
+                                   const FullScreenOptions& aOptions)
     : mElement(aElement),
       mDoc(aElement->OwnerDoc()),
-      mWasCallerChrome(nsContentUtils::IsCallerChrome()),
+      mOptions(aOptions),
       mHadRequestPending(static_cast<nsDocument*>(mDoc.get())->
-                         mAsyncFullscreenPending),
-      mOptions(aOptions)
+                         mAsyncFullscreenPending)
   {
     static_cast<nsDocument*>(mDoc.get())->
       mAsyncFullscreenPending = true;
@@ -11342,18 +11341,14 @@ public:
     static_cast<nsDocument*>(mDoc.get())->
       mAsyncFullscreenPending = mHadRequestPending;
     nsDocument* doc = static_cast<nsDocument*>(mDoc.get());
-    doc->RequestFullScreen(mElement,
-                           mOptions,
-                           mWasCallerChrome,
-                           /* aNotifyOnOriginChange */ true);
+    doc->RequestFullScreen(mElement, mOptions);
     return NS_OK;
   }
 
   nsRefPtr<Element> mElement;
   nsCOMPtr<nsIDocument> mDoc;
-  bool mWasCallerChrome;
-  bool mHadRequestPending;
   FullScreenOptions mOptions;
+  bool mHadRequestPending;
 };
 
 void
@@ -11565,9 +11560,9 @@ nsresult nsDocument::RemoteFrameFullscreenChanged(nsIDOMElement* aFrameElement)
   // this has no effect.
   nsCOMPtr<nsIContent> content(do_QueryInterface(aFrameElement));
   FullScreenOptions opts;
-  RequestFullScreen(content->AsElement(), opts,
-                    /* aWasCallerChrome */ false,
-                    /* aNotifyOnOriginChange */ false);
+  opts.mIsCallerChrome = false;
+  opts.mShouldNotifyNewOrigin = false;
+  RequestFullScreen(content->AsElement(), opts);
 
   return NS_OK;
 }
@@ -11586,49 +11581,47 @@ ReleaseHMDInfoRef(void *, nsIAtom*, void *aPropertyValue, void *)
   }
 }
 
-void
-nsDocument::RequestFullScreen(Element* aElement,
-                              FullScreenOptions& aOptions,
-                              bool aWasCallerChrome,
-                              bool aNotifyOnOriginChange)
+bool
+nsDocument::FullscreenElementReadyCheck(Element* aElement,
+                                        bool aWasCallerChrome)
 {
   NS_ASSERTION(aElement,
     "Must pass non-null element to nsDocument::RequestFullScreen");
   if (!aElement || aElement == GetFullScreenElement()) {
-    return;
+    return false;
   }
   if (!aElement->IsInDoc()) {
     LogFullScreenDenied(true, "FullScreenDeniedNotInDocument", this);
-    return;
+    return false;
   }
   if (aElement->OwnerDoc() != this) {
     LogFullScreenDenied(true, "FullScreenDeniedMovedDocument", this);
-    return;
+    return false;
   }
   if (!GetWindow()) {
     LogFullScreenDenied(true, "FullScreenDeniedLostWindow", this);
-    return;
+    return false;
   }
   if (!IsFullScreenEnabled(aWasCallerChrome, true)) {
     // IsFullScreenEnabled calls LogFullScreenDenied, no need to log.
-    return;
+    return false;
   }
   if (GetFullScreenElement() &&
       !nsContentUtils::ContentIsDescendantOf(aElement, GetFullScreenElement())) {
     // If this document is full-screen, only grant full-screen requests from
     // a descendant of the current full-screen element.
     LogFullScreenDenied(true, "FullScreenDeniedNotDescendant", this);
-    return;
+    return false;
   }
   if (!nsContentUtils::IsChromeDoc(this) && !IsInActiveTab(this)) {
     LogFullScreenDenied(true, "FullScreenDeniedNotFocusedTab", this);
-    return;
+    return false;
   }
   // Deny requests when a windowed plugin is focused.
   nsIFocusManager* fm = nsFocusManager::GetFocusManager();
   if (!fm) {
     NS_WARNING("Failed to retrieve focus manager in full-screen request.");
-    return;
+    return false;
   }
   nsCOMPtr<nsIDOMElement> focusedElement;
   fm->GetFocusedElement(getter_AddRefs(focusedElement));
@@ -11636,9 +11629,137 @@ nsDocument::RequestFullScreen(Element* aElement,
     nsCOMPtr<nsIContent> content = do_QueryInterface(focusedElement);
     if (nsContentUtils::HasPluginWithUncontrolledEventDispatch(content)) {
       LogFullScreenDenied(true, "FullScreenDeniedFocusedPlugin", this);
-      return;
+      return false;
     }
   }
+  return true;
+}
+
+struct FullscreenRequest : public LinkedListElement<FullscreenRequest>
+{
+  FullscreenRequest(Element* aElement, const FullScreenOptions& aOptions)
+    : mElement(aElement), mOptions(aOptions)
+    { MOZ_COUNT_CTOR(FullscreenRequest); }
+  ~FullscreenRequest() { MOZ_COUNT_DTOR(FullscreenRequest); }
+
+  nsRefPtr<Element> mElement;
+  FullScreenOptions mOptions;
+};
+
+// Any fullscreen request waiting for the widget to finish being full-
+// screen is queued here. This is declared static instead of a member
+// of nsDocument because in the majority of time, there would be at most
+// one document requesting fullscreen. We shouldn't waste the space to
+// hold for it in every document.
+static LinkedList<FullscreenRequest> sPendingFullscreenRequests;
+
+static nsCOMPtr<nsPIDOMWindow>
+GetRootWindow(nsIDocument* aDoc)
+{
+  nsIDocShell* docShell = aDoc->GetDocShell();
+  if (!docShell) {
+    return nullptr;
+  }
+  nsCOMPtr<nsIDocShellTreeItem> rootItem;
+  docShell->GetRootTreeItem(getter_AddRefs(rootItem));
+  return rootItem ? rootItem->GetWindow() : nullptr;
+}
+
+void
+nsDocument::RequestFullScreen(Element* aElement,
+                              const FullScreenOptions& aOptions)
+{
+  nsCOMPtr<nsPIDOMWindow> rootWin = GetRootWindow(this);
+  if (!rootWin) {
+    return;
+  }
+
+  // If we have been in fullscreen, apply the new state directly.
+  // Note that we should check both condition, because if we are in
+  // child process, our window may not report to be in fullscreen.
+  if (static_cast<nsGlobalWindow*>(rootWin.get())->FullScreen() ||
+      nsContentUtils::GetRootDocument(this)->IsFullScreenDoc()) {
+    ApplyFullscreen(aElement, aOptions);
+    return;
+  }
+
+  // We don't need to check element ready before this point, because
+  // if we called ApplyFullscreen, it would check that for us.
+  if (!FullscreenElementReadyCheck(aElement, aOptions.mIsCallerChrome)) {
+    return;
+  }
+
+  sPendingFullscreenRequests.insertBack(
+    new FullscreenRequest(aElement, aOptions));
+  if (XRE_GetProcessType() == GeckoProcessType_Content) {
+    // If we are not the top level process, dispatch an event to make
+    // our parent process go fullscreen first.
+    (new AsyncEventDispatcher(
+       this, NS_LITERAL_STRING("MozDOMFullscreen:Request"),
+       /* Bubbles */ true, /* ChromeOnly */ true))->PostDOMEvent();
+  } else {
+    // Make the window fullscreen.
+    SetWindowFullScreen(this, true, aOptions.mVRHMDDevice);
+  }
+}
+
+/* static */ bool
+nsIDocument::HandlePendingFullscreenRequest(const FullscreenRequest& aRequest,
+                                            nsIDocShellTreeItem* aRootShell,
+                                            bool* aHandled)
+{
+  nsRefPtr<nsDocument> doc =
+    static_cast<nsDocument*>(aRequest.mElement->OwnerDoc());
+  nsIDocShellTreeItem* shell = doc->GetDocShell();
+  if (!shell) {
+    return true;
+  }
+  nsCOMPtr<nsIDocShellTreeItem> rootShell;
+  shell->GetRootTreeItem(getter_AddRefs(rootShell));
+  if (rootShell != aRootShell) {
+    return false;
+  }
+
+  doc->ApplyFullscreen(aRequest.mElement, aRequest.mOptions);
+  *aHandled = true;
+  return true;
+}
+
+/* static */ bool
+nsIDocument::HandlePendingFullscreenRequests(nsIDocument* aDoc)
+{
+  if (sPendingFullscreenRequests.isEmpty()) {
+    return false;
+  }
+
+  bool handled = false;
+  nsIDocShellTreeItem* shell = aDoc->GetDocShell();
+  nsCOMPtr<nsIDocShellTreeItem> rootShell;
+  if (shell) {
+    shell->GetRootTreeItem(getter_AddRefs(rootShell));
+  }
+  FullscreenRequest* request = sPendingFullscreenRequests.getFirst();
+  while (request) {
+    if (HandlePendingFullscreenRequest(*request, rootShell, &handled)) {
+      // Drop requests, which either have been detached from document/
+      // document shell, or are handled by HandleFullscreenRequest.
+      FullscreenRequest* thisRequest = request;
+      request = request->getNext();
+      delete thisRequest;
+    } else {
+      request = request->getNext();
+    }
+  }
+  return handled;
+}
+
+void
+nsDocument::ApplyFullscreen(Element* aElement,
+                            const FullScreenOptions& aOptions)
+{
+  if (!FullscreenElementReadyCheck(aElement, aOptions.mIsCallerChrome)) {
+    return;
+  }
 
   // Stash a reference to any existing fullscreen doc, we'll use this later
   // to detect if the origin which is fullscreen has changed.
@@ -11730,7 +11851,7 @@ nsDocument::RequestFullScreen(Element* aElement,
   if (!previousFullscreenDoc) {
     nsRefPtr<AsyncEventDispatcher> asyncDispatcher =
       new AsyncEventDispatcher(
-        this, NS_LITERAL_STRING("MozDOMFullscreen:Entered"),
+        aElement, NS_LITERAL_STRING("MozDOMFullscreen:Entered"),
         /* Bubbles */ true, /* ChromeOnly */ true);
     asyncDispatcher->PostDOMEvent();
   }
@@ -11742,7 +11863,7 @@ nsDocument::RequestFullScreen(Element* aElement,
   // process browser, the code in content process is responsible for
   // sending message with the origin to its parent, and the parent
   // shouldn't rely on this event itself.
-  if (aNotifyOnOriginChange &&
+  if (aOptions.mShouldNotifyNewOrigin &&
       !nsContentUtils::HaveEqualPrincipals(previousFullscreenDoc, this)) {
     nsRefPtr<AsyncEventDispatcher> asyncDispatcher =
       new AsyncEventDispatcher(
@@ -11751,27 +11872,7 @@ nsDocument::RequestFullScreen(Element* aElement,
     asyncDispatcher->PostDOMEvent();
   }
 
-#ifdef DEBUG
-  // Note assertions must run before SetWindowFullScreen() as that does
-  // synchronous event dispatch which can run script which exits full-screen!
-  NS_ASSERTION(GetFullScreenElement() == aElement,
-               "Full-screen element should be the requested element!");
-  NS_ASSERTION(IsFullScreenDoc(), "Should be full-screen doc");
-  nsCOMPtr<nsIDOMElement> fse;
-  GetMozFullScreenElement(getter_AddRefs(fse));
-  nsCOMPtr<nsIContent> c(do_QueryInterface(fse));
-  NS_ASSERTION(c->AsElement() == aElement,
-    "GetMozFullScreenElement should match GetFullScreenElement()");
-#endif
-
-  // Make the window full-screen. Note we must make the state changes above
-  // before making the window full-screen, as then the document reports as
-  // being in full-screen mode when the chrome "fullscreen" event fires,
-  // enabling chrome to distinguish between browser and dom full-screen
-  // modes. Also note that nsGlobalWindow::SetFullScreen() (which
-  // SetWindowFullScreen() calls) proxies to the root window in its hierarchy,
-  // and does not operate on the a per-nsIDOMWindow basis.
-  SetWindowFullScreen(this, true, aOptions.mVRHMDDevice);
+  FullscreenRoots::Add(this);
 }
 
 NS_IMETHODIMP
diff --git a/dom/base/nsDocument.h b/dom/base/nsDocument.h
index f50e997416ac..3bb1ed2f8597 100644
--- a/dom/base/nsDocument.h
+++ b/dom/base/nsDocument.h
@@ -1216,20 +1216,14 @@ public:
 
   static void ExitFullscreen(nsIDocument* aDoc);
 
+  // Do the "fullscreen element ready check" from the fullscreen spec.
+  // It returns true if the given element is allowed to go into fullscreen.
+  bool FullscreenElementReadyCheck(Element* aElement, bool aWasCallerChrome);
+
   // This is called asynchronously by nsIDocument::AsyncRequestFullScreen()
-  // to move this document into full-screen mode if allowed. aWasCallerChrome
-  // should be true when nsIDocument::AsyncRequestFullScreen() was called
-  // by chrome code. aNotifyOnOriginChange denotes whether we should trigger
-  // a MozFullscreenOriginChanged event if requesting fullscreen in this
-  // document causes the origin which is fullscreen to change. We may want to
-  // *not* send this notification if we're calling RequestFullScreen() as part
-  // of a continuation of a request in a subdocument, whereupon the caller will
-  // need to send some notification itself with the origin of the document
-  // which originally requested fullscreen, not *this* document's origin.
+  // to move this document into full-screen mode if allowed.
   void RequestFullScreen(Element* aElement,
-                         mozilla::dom::FullScreenOptions& aOptions,
-                         bool aWasCallerChrome,
-                         bool aNotifyOnOriginChange);
+                         const mozilla::dom::FullScreenOptions& aOptions);
 
   // Removes all elements from the full-screen stack, removing full-scren
   // styles from the top element in the stack.
@@ -1518,6 +1512,10 @@ protected:
 
   void NotifyStyleSheetApplicableStateChanged();
 
+  // Apply the fullscreen state to the document, and trigger related events.
+  void ApplyFullscreen(Element* aElement,
+                       const mozilla::dom::FullScreenOptions& aOptions);
+
   nsTArray<nsIObserver*> mCharSetObservers;
 
   PLDHashTable *mSubDocuments;
diff --git a/dom/base/nsFrameLoader.cpp b/dom/base/nsFrameLoader.cpp
index 826cbe1764ed..215b72805b58 100644
--- a/dom/base/nsFrameLoader.cpp
+++ b/dom/base/nsFrameLoader.cpp
@@ -136,6 +136,9 @@ nsFrameLoader::nsFrameLoader(Element* aOwner, bool aNetworkCreated)
   : mOwnerContent(aOwner)
   , mAppIdSentToPermissionManager(nsIScriptSecurityManager::NO_APP_ID)
   , mDetachedSubdocViews(nullptr)
+  , mRemoteBrowser(nullptr)
+  , mChildID(0)
+  , mEventMode(EVENT_MODE_NORMAL_DISPATCH)
   , mIsPrerendered(false)
   , mDepthTooGreat(false)
   , mIsTopLevelContent(false)
@@ -151,10 +154,6 @@ nsFrameLoader::nsFrameLoader(Element* aOwner, bool aNetworkCreated)
   , mClampScrollPosition(true)
   , mObservingOwnerContent(false)
   , mVisible(true)
-  , mCurrentRemoteFrame(nullptr)
-  , mRemoteBrowser(nullptr)
-  , mChildID(0)
-  , mEventMode(EVENT_MODE_NORMAL_DISPATCH)
 {
   ResetPermissionManagerStatus();
 }
@@ -1489,7 +1488,7 @@ nsFrameLoader::SetOwnerContent(Element* aContent)
     mOwnerContent->RemoveMutationObserver(this);
   }
   mOwnerContent = aContent;
-  if (RenderFrameParent* rfp = GetCurrentRemoteFrame()) {
+  if (RenderFrameParent* rfp = GetCurrentRenderFrame()) {
     rfp->OwnerContentChanged(aContent);
   }
 
@@ -2199,7 +2198,6 @@ nsFrameLoader::TryRemoteBrowser()
     return false;
   }
 
-  mContentParent = mRemoteBrowser->Manager();
   mChildID = mRemoteBrowser->Manager()->ChildID();
 
   nsCOMPtr<nsIDocShellTreeItem> rootItem;
@@ -2224,11 +2222,20 @@ nsFrameLoader::TryRemoteBrowser()
 }
 
 mozilla::dom::PBrowserParent*
-nsFrameLoader::GetRemoteBrowser()
+nsFrameLoader::GetRemoteBrowser() const
 {
   return mRemoteBrowser;
 }
 
+RenderFrameParent*
+nsFrameLoader::GetCurrentRenderFrame() const
+{
+  if (mRemoteBrowser) {
+    return mRemoteBrowser->GetRenderFrame();
+  }
+  return nullptr;
+}
+
 NS_IMETHODIMP
 nsFrameLoader::ActivateRemoteFrame() {
   if (mRemoteBrowser) {
@@ -2531,7 +2538,6 @@ void
 nsFrameLoader::SetRemoteBrowser(nsITabParent* aTabParent)
 {
   MOZ_ASSERT(!mRemoteBrowser);
-  MOZ_ASSERT(!mCurrentRemoteFrame);
   mRemoteFrame = true;
   mRemoteBrowser = TabParent::GetFrom(aTabParent);
   mChildID = mRemoteBrowser ? mRemoteBrowser->Manager()->ChildID() : 0;
diff --git a/dom/base/nsFrameLoader.h b/dom/base/nsFrameLoader.h
index 762619f51281..1fae7cb1acb7 100644
--- a/dom/base/nsFrameLoader.h
+++ b/dom/base/nsFrameLoader.h
@@ -61,11 +61,6 @@ class nsFrameLoader final : public nsIFrameLoader,
   typedef mozilla::dom::TabParent TabParent;
   typedef mozilla::layout::RenderFrameParent RenderFrameParent;
 
-protected:
-  nsFrameLoader(mozilla::dom::Element* aOwner, bool aNetworkCreated);
-
-  ~nsFrameLoader();
-
 public:
   static nsFrameLoader* Create(mozilla::dom::Element* aOwner,
                                bool aNetworkCreated);
@@ -130,9 +125,6 @@ public:
                                      nsRefPtr<nsFrameLoader>& aFirstToSwap,
                                      nsRefPtr<nsFrameLoader>& aSecondToSwap);
 
-  // When IPC is enabled, destroy any associated child process.
-  void DestroyChild();
-
   /**
    * Return the primary frame for our owning content, or null if it
    * can't be found.
@@ -149,7 +141,7 @@ public:
   nsIDocument* GetOwnerDoc() const
   { return mOwnerContent ? mOwnerContent->OwnerDoc() : nullptr; }
 
-  PBrowserParent* GetRemoteBrowser();
+  PBrowserParent* GetRemoteBrowser() const;
 
   /**
    * The "current" render frame is the one on which the most recent
@@ -165,20 +157,8 @@ public:
    * returned.  (In-process <browser> behaves similarly, and this
    * behavior seems desirable.)
    */
-  RenderFrameParent* GetCurrentRemoteFrame() const
-  {
-    return mCurrentRemoteFrame;
-  }
+  RenderFrameParent* GetCurrentRenderFrame() const;
 
-  /**
-   * |aFrame| can be null.  If non-null, it must be the remote frame
-   * on which the most recent layer transaction completed for this's
-   * <browser>.
-   */
-  void SetCurrentRemoteFrame(RenderFrameParent* aFrame)
-  {
-    mCurrentRemoteFrame = aFrame;
-  }
   nsFrameMessageManager* GetFrameMessageManager() { return mMessageManager; }
 
   mozilla::dom::Element* GetOwnerContent() { return mOwnerContent; }
@@ -189,10 +169,10 @@ public:
   /**
    * Tell this FrameLoader to use a particular remote browser.
    *
-   * This will assert if mRemoteBrowser or mCurrentRemoteFrame is non-null.  In
-   * practice, this means you can't have successfully run TryRemoteBrowser() on
-   * this object, which means you can't have called ShowRemoteFrame() or
-   * ReallyStartLoading().
+   * This will assert if mRemoteBrowser is non-null.  In practice,
+   * this means you can't have successfully run TryRemoteBrowser() on
+   * this object, which means you can't have called ShowRemoteFrame()
+   * or ReallyStartLoading().
    */
   void SetRemoteBrowser(nsITabParent* aTabParent);
 
@@ -230,7 +210,13 @@ public:
   // Properly retrieves documentSize of any subdocument type.
   nsresult GetWindowDimensions(nsIntRect& aRect);
 
+  // public because a callback needs these.
+  nsRefPtr<nsFrameMessageManager> mMessageManager;
+  nsCOMPtr<nsIInProcessContentFrameMessageManager> mChildMessageManager;
+
 private:
+  nsFrameLoader(mozilla::dom::Element* aOwner, bool aNetworkCreated);
+  ~nsFrameLoader();
 
   void SetOwnerContent(mozilla::dom::Element* aContent);
 
@@ -327,11 +313,6 @@ private:
   // Note: this variable must be modified only by ResetPermissionManagerStatus()
   uint32_t mAppIdSentToPermissionManager;
 
-public:
-  // public because a callback needs these.
-  nsRefPtr<nsFrameMessageManager> mMessageManager;
-  nsCOMPtr<nsIInProcessContentFrameMessageManager> mChildMessageManager;
-private:
   // Stores the root view of the subdocument while the subdocument is being
   // reframed. Used to restore the presentation after reframing.
   nsView* mDetachedSubdocViews;
@@ -342,6 +323,13 @@ private:
   // a reframe, so that we know not to restore the presentation.
   nsCOMPtr<nsIDocument> mContainerDocWhileDetached;
 
+  TabParent* mRemoteBrowser;
+  uint64_t mChildID;
+
+  // See nsIFrameLoader.idl. EVENT_MODE_NORMAL_DISPATCH automatically
+  // forwards some input events to out-of-process content.
+  uint32_t mEventMode;
+
   bool mIsPrerendered : 1;
   bool mDepthTooGreat : 1;
   bool mIsTopLevelContent : 1;
@@ -365,17 +353,6 @@ private:
   // whether this frameloader's <iframe mozbrowser> is setVisible(true)'ed, and
   // doesn't necessarily correlate with docshell/document visibility.
   bool mVisible : 1;
-
-  // The ContentParent associated with mRemoteBrowser.  This was added as a
-  // strong ref in bug 545237, and we're not sure if we can get rid of it.
-  nsRefPtr<mozilla::dom::nsIContentParent> mContentParent;
-  RenderFrameParent* mCurrentRemoteFrame;
-  TabParent* mRemoteBrowser;
-  uint64_t mChildID;
-
-  // See nsIFrameLoader.idl. EVENT_MODE_NORMAL_DISPATCH automatically
-  // forwards some input events to out-of-process content.
-  uint32_t mEventMode;
 };
 
 #endif
diff --git a/dom/base/nsGlobalWindow.cpp b/dom/base/nsGlobalWindow.cpp
index 9e609e8e7cd6..0d57257c95b5 100644
--- a/dom/base/nsGlobalWindow.cpp
+++ b/dom/base/nsGlobalWindow.cpp
@@ -6119,12 +6119,6 @@ nsGlobalWindow::SetFullScreenInternal(bool aFullScreen, bool aFullscreenMode,
     }
   }
 
-  // dispatch a "fullscreen" DOM event so that XUL apps can
-  // respond visually if we are kicked into full screen mode
-  if (!DispatchCustomEvent(NS_LITERAL_STRING("fullscreen"))) {
-    return NS_OK;
-  }
-
   // Prevent chrome documents which are still loading from resizing
   // the window after we set fullscreen mode.
   nsCOMPtr<nsIBaseWindow> treeOwnerAsWin = GetTreeOwnerWindow();
@@ -6152,9 +6146,51 @@ nsGlobalWindow::SetFullScreenInternal(bool aFullScreen, bool aFullscreenMode,
         widget->PrepareForDOMFullscreenTransition();
       }
       widget->MakeFullScreen(aFullScreen, screen);
+      // The rest of code for switching fullscreen is in nsGlobalWindow::
+      // FinishFullscreenChange() which will be called after sizemodechange
+      // event is dispatched.
+      return NS_OK;
     }
   }
 
+  FinishFullscreenChange(aFullScreen);
+  return NS_OK;
+}
+
+/* virtual */ void
+nsGlobalWindow::FinishFullscreenChange(bool aIsFullscreen)
+{
+  MOZ_ASSERT(IsOuterWindow());
+
+  if (aIsFullscreen != mFullScreen) {
+    NS_WARNING("Failed to toggle fullscreen state of the widget");
+    // We failed to make the widget enter fullscreen.
+    // Stop further changes and restore the state.
+    if (!aIsFullscreen) {
+      mFullScreen = false;
+      mFullscreenMode = false;
+    } else {
+      MOZ_ASSERT_UNREACHABLE("Failed to exit fullscreen?");
+      mFullScreen = true;
+      // We don't know how code can reach here. Not sure
+      // what value should be set for fullscreen mode.
+      mFullscreenMode = false;
+    }
+    return;
+  }
+
+  // Ask the document to handle any pending DOM fullscreen change. Note
+  // we must make the state changes before dispatching the "fullscreen"
+  // event below, so that the chrome can distinguish between browser
+  // fullscreen mode and DOM fullscreen.
+  if (mFullScreen) {
+    nsIDocument::HandlePendingFullscreenRequests(mDoc);
+  }
+
+  // dispatch a "fullscreen" DOM event so that XUL apps can
+  // respond visually if we are kicked into full screen mode
+  DispatchCustomEvent(NS_LITERAL_STRING("fullscreen"));
+
   if (!mFullScreen) {
     // Force exit from DOM full-screen mode. This is so that if we're in
     // DOM full-screen mode and the user exits full-screen mode with
@@ -6166,23 +6202,20 @@ nsGlobalWindow::SetFullScreenInternal(bool aFullScreen, bool aFullscreenMode,
   if (!mWakeLock && mFullScreen) {
     nsRefPtr<power::PowerManagerService> pmService =
       power::PowerManagerService::GetInstance();
-    NS_ENSURE_TRUE(pmService, NS_OK);
+    if (!pmService) {
+      return;
+    }
 
     ErrorResult rv;
     mWakeLock = pmService->NewWakeLock(NS_LITERAL_STRING("DOM_Fullscreen"),
                                        this, rv);
-    if (rv.Failed()) {
-      return rv.StealNSResult();
-    }
-
+    NS_WARN_IF_FALSE(!rv.Failed(), "Failed to lock the wakelock");
   } else if (mWakeLock && !mFullScreen) {
     ErrorResult rv;
     mWakeLock->Unlock(rv);
     NS_WARN_IF_FALSE(!rv.Failed(), "Failed to unlock the wakelock.");
     mWakeLock = nullptr;
   }
-
-  return NS_OK;
 }
 
 bool
diff --git a/dom/base/nsGlobalWindow.h b/dom/base/nsGlobalWindow.h
index 274bd542dbba..15871c2c8ff1 100644
--- a/dom/base/nsGlobalWindow.h
+++ b/dom/base/nsGlobalWindow.h
@@ -491,7 +491,8 @@ public:
 
   // Outer windows only.
   virtual nsresult SetFullScreenInternal(bool aIsFullscreen, bool aFullscreenMode,
-                                         mozilla::gfx::VRHMDInfo *aHMD = nullptr) override;
+                                         mozilla::gfx::VRHMDInfo *aHMD = nullptr) override final;
+  virtual void FinishFullscreenChange(bool aIsFullscreen) override final;
   bool FullScreen() const;
 
   // Inner windows only.
diff --git a/dom/base/nsIDocument.h b/dom/base/nsIDocument.h
index 5e1c25ca43a8..6ab095ed6bdb 100644
--- a/dom/base/nsIDocument.h
+++ b/dom/base/nsIDocument.h
@@ -48,6 +48,7 @@ class nsIChannel;
 class nsIContent;
 class nsIContentSink;
 class nsIDocShell;
+class nsIDocShellTreeItem;
 class nsIDocumentEncoder;
 class nsIDocumentObserver;
 class nsIDOMDocument;
@@ -83,6 +84,7 @@ class nsDOMCaretPosition;
 class nsViewportInfo;
 class nsIGlobalObject;
 struct nsCSSSelectorList;
+struct FullscreenRequest; // For nsIDocument::HandlePendingFullscreenRequest
 
 namespace mozilla {
 class CSSStyleSheet;
@@ -146,6 +148,16 @@ typedef CallbackObjectHolder<NodeFilter, nsIDOMNodeFilter> NodeFilterHolder;
 struct FullScreenOptions {
   FullScreenOptions();
   nsRefPtr<gfx::VRHMDInfo> mVRHMDDevice;
+  // This value should be true if the fullscreen request is
+  // originated from chrome code.
+  bool mIsCallerChrome = false;
+  // This value denotes whether we should trigger a NewOrigin event if
+  // requesting fullscreen in its document causes the origin which is
+  // fullscreen to change. We may want *not* to trigger that event if
+  // we're calling RequestFullScreen() as part of a continuation of a
+  // request in a subdocument in different process, whereupon the caller
+  // need to send some notification itself with the real origin.
+  bool mShouldNotifyNewOrigin = true;
 };
 
 } // namespace dom
@@ -1170,6 +1182,22 @@ public:
    */
   static void ExitFullscreen(nsIDocument* aDocument, bool aRunAsync);
 
+  /**
+   * Handles one single fullscreen request, updates `aHandled` if the request
+   * is handled, and returns whether this request should be removed from the
+   * request queue.
+   */
+  static bool HandlePendingFullscreenRequest(const FullscreenRequest& aRequest,
+                                             nsIDocShellTreeItem* aRootShell,
+                                             bool* aHandled);
+
+  /**
+   * Handles any pending fullscreen in aDocument or its subdocuments.
+   *
+   * Returns whether there is any fullscreen request handled.
+   */
+  static bool HandlePendingFullscreenRequests(nsIDocument* aDocument);
+
   virtual void RequestPointerLock(Element* aElement) = 0;
 
   static void UnlockPointer(nsIDocument* aDoc = nullptr);
diff --git a/dom/base/nsPIDOMWindow.h b/dom/base/nsPIDOMWindow.h
index 939413ea591d..df47f40d1899 100644
--- a/dom/base/nsPIDOMWindow.h
+++ b/dom/base/nsPIDOMWindow.h
@@ -62,8 +62,8 @@ enum UIStateChangeType
 };
 
 #define NS_PIDOMWINDOW_IID \
-{ 0x2485d4d7, 0xf7cb, 0x481e, \
-  { 0x9c, 0x89, 0xb2, 0xa8, 0x12, 0x67, 0x7f, 0x97 } }
+{ 0x0df7578f, 0x31d4, 0x4391, \
+  { 0x98, 0xd4, 0xf3, 0x7d, 0x51, 0x8e, 0xa4, 0x37 } }
 
 class nsPIDOMWindow : public nsIDOMWindowInternal
 {
@@ -475,6 +475,18 @@ public:
   virtual nsresult SetFullScreenInternal(bool aIsFullscreen, bool aFullscreenMode,
                                          mozilla::gfx::VRHMDInfo *aHMD = nullptr) = 0;
 
+  /**
+   * This function should be called when the fullscreen state is flipped.
+   * If no widget is involved the fullscreen change, this method is called
+   * by SetFullScreenInternal, otherwise, it is called when the widget
+   * finishes its change to or from fullscreen.
+   *
+   * @param aIsFullscreen indicates whether the widget is in fullscreen.
+   *
+   * Outer windows only.
+   */
+  virtual void FinishFullscreenChange(bool aIsFullscreen) = 0;
+
   /**
    * Call this to check whether some node (this window, its document,
    * or content in that document) has a mouseenter/leave event listener.
diff --git a/dom/base/nsPIWindowRoot.h b/dom/base/nsPIWindowRoot.h
index f040318384e0..e37802f67f09 100644
--- a/dom/base/nsPIWindowRoot.h
+++ b/dom/base/nsPIWindowRoot.h
@@ -9,21 +9,14 @@
 
 #include "nsISupports.h"
 #include "mozilla/dom/EventTarget.h"
-#include "nsWeakReference.h"
 
 class nsPIDOMWindow;
 class nsIControllers;
 class nsIController;
 
-namespace mozilla {
-namespace dom {
-class TabParent;
-}
-}
-
 #define NS_IWINDOWROOT_IID \
-{ 0x238edca0, 0xb30d, 0x46d3, \
- { 0xb2, 0x6a, 0x17, 0xb6, 0x21, 0x28, 0x89, 0x7e } }
+{ 0x728a2682, 0x55c0, 0x4860, \
+ { 0x82, 0x6b, 0x0c, 0x30, 0x0a, 0xac, 0xaa, 0x60 } }
 
 class nsPIWindowRoot : public mozilla::dom::EventTarget
 {
@@ -45,15 +38,6 @@ public:
 
   virtual void SetParentTarget(mozilla::dom::EventTarget* aTarget) = 0;
   virtual mozilla::dom::EventTarget* GetParentTarget() = 0;
-
-  // Stores a weak reference to the browser.
-  virtual void AddBrowser(mozilla::dom::TabParent* aBrowser) = 0;
-  virtual void RemoveBrowser(mozilla::dom::TabParent* aBrowser) = 0;
-
-  typedef void (*BrowserEnumerator)(mozilla::dom::TabParent* aTab, void* aArg);
-
-  // Enumerate all stored browsers that for which the weak reference is valid.
-  virtual void EnumerateBrowsers(BrowserEnumerator aEnumFunc, void* aArg) = 0;
 };
 
 NS_DEFINE_STATIC_IID_ACCESSOR(nsPIWindowRoot, NS_IWINDOWROOT_IID)
diff --git a/dom/base/nsWindowRoot.cpp b/dom/base/nsWindowRoot.cpp
index c5d7e231b7ac..7b85a089a74b 100644
--- a/dom/base/nsWindowRoot.cpp
+++ b/dom/base/nsWindowRoot.cpp
@@ -24,7 +24,6 @@
 #include "nsIController.h"
 #include "xpcpublic.h"
 #include "nsCycleCollectionParticipant.h"
-#include "mozilla/dom/TabParent.h"
 
 #ifdef MOZ_XUL
 #include "nsIDOMXULElement.h"
@@ -386,46 +385,6 @@ nsWindowRoot::WrapObject(JSContext* aCx, JS::Handle<JSObject*> aGivenProto)
   return mozilla::dom::WindowRootBinding::Wrap(aCx, this, aGivenProto);
 }
 
-void
-nsWindowRoot::AddBrowser(mozilla::dom::TabParent* aBrowser)
-{
-  nsWeakPtr weakBrowser = do_GetWeakReference(static_cast<nsITabParent*>(aBrowser));
-  mWeakBrowsers.PutEntry(weakBrowser);
-}
-
-void
-nsWindowRoot::RemoveBrowser(mozilla::dom::TabParent* aBrowser)
-{
-  nsWeakPtr weakBrowser = do_GetWeakReference(static_cast<nsITabParent*>(aBrowser));
-  mWeakBrowsers.RemoveEntry(weakBrowser);
-}
-
-static PLDHashOperator
-WeakBrowserEnumFunc(nsRefPtrHashKey<nsIWeakReference>* aKey, void* aArg)
-{
-  nsTArray<nsRefPtr<TabParent>>* tabParents =
-    static_cast<nsTArray<nsRefPtr<TabParent>>*>(aArg);
-  nsCOMPtr<nsITabParent> tabParent(do_QueryReferent((*aKey).GetKey()));
-  TabParent* tab = TabParent::GetFrom(tabParent);
-  if (tab) {
-    tabParents->AppendElement(tab);
-  }
-  return PL_DHASH_NEXT;
-}
-
-void
-nsWindowRoot::EnumerateBrowsers(BrowserEnumerator aEnumFunc, void* aArg)
-{
-  // Collect strong references to all browsers in a separate array in
-  // case aEnumFunc alters mWeakBrowsers.
-  nsTArray<nsRefPtr<TabParent>> tabParents;
-  mWeakBrowsers.EnumerateEntries(WeakBrowserEnumFunc, &tabParents);
-
-  for (uint32_t i = 0; i < tabParents.Length(); ++i) {
-    aEnumFunc(tabParents[i], aArg);
-  }
-}
-
 ///////////////////////////////////////////////////////////////////////////////////
 
 already_AddRefed<EventTarget>
diff --git a/dom/base/nsWindowRoot.h b/dom/base/nsWindowRoot.h
index 203ef2c63b9a..49686ad3ee60 100644
--- a/dom/base/nsWindowRoot.h
+++ b/dom/base/nsWindowRoot.h
@@ -69,10 +69,6 @@ public:
   NS_DECL_CYCLE_COLLECTION_SCRIPT_HOLDER_CLASS_AMBIGUOUS(nsWindowRoot,
                                                          nsIDOMEventTarget)
 
-  virtual void AddBrowser(mozilla::dom::TabParent* aBrowser) override;
-  virtual void RemoveBrowser(mozilla::dom::TabParent* aBrowser) override;
-  virtual void EnumerateBrowsers(BrowserEnumerator aEnumFunc, void *aArg) override;
-
 protected:
   virtual ~nsWindowRoot();
 
@@ -88,10 +84,6 @@ protected:
   nsCOMPtr<nsIDOMNode> mPopupNode; // [OWNER]
 
   nsCOMPtr<mozilla::dom::EventTarget> mParent;
-
-  // The TabParents that are currently registered with this top-level window.
-  typedef nsTHashtable<nsRefPtrHashKey<nsIWeakReference>> WeakBrowserTable;
-  WeakBrowserTable mWeakBrowsers;
 };
 
 extern already_AddRefed<mozilla::dom::EventTarget>
diff --git a/dom/base/test/csp/chrome.ini b/dom/base/test/csp/chrome.ini
deleted file mode 100644
index 75359e9464e7..000000000000
--- a/dom/base/test/csp/chrome.ini
+++ /dev/null
@@ -1,5 +0,0 @@
-[DEFAULT]
-skip-if = buildapp == 'b2g'
-
-[test_csp_bug768029.html]
-[test_csp_bug773891.html]
diff --git a/dom/base/test/csp/file_CSP_web_manifest.html b/dom/base/test/csp/file_CSP_web_manifest.html
deleted file mode 100644
index 83223c24af8f..000000000000
--- a/dom/base/test/csp/file_CSP_web_manifest.html
+++ /dev/null
@@ -1,6 +0,0 @@
-<!doctype html>
-<meta charset=utf-8>
-<head>
-<link rel="manifest" href="file_CSP_web_manifest.json">
-</head>
-<h1>Support Page for Web Manifest Tests</h1>
\ No newline at end of file
diff --git a/dom/base/test/csp/file_CSP_web_manifest_https.html b/dom/base/test/csp/file_CSP_web_manifest_https.html
deleted file mode 100644
index 37d6e3eace1d..000000000000
--- a/dom/base/test/csp/file_CSP_web_manifest_https.html
+++ /dev/null
@@ -1,4 +0,0 @@
-<!doctype html>
-<meta charset=utf-8>
-<link rel="manifest" href="https://example.com:443/tests/dom/base/test/csp/file_CSP_web_manifest_https.json">
-<h1>Support Page for Web Manifest Tests</h1>
\ No newline at end of file
diff --git a/dom/base/test/csp/file_bug836922_npolicies.html b/dom/base/test/csp/file_bug836922_npolicies.html
deleted file mode 100644
index 3be43948f28f..000000000000
--- a/dom/base/test/csp/file_bug836922_npolicies.html
+++ /dev/null
@@ -1,15 +0,0 @@
-<html>
-  <head>
-    <link rel='stylesheet' type='text/css'
-          href='/tests/dom/base/test/csp/file_CSP.sjs?testid=css_self&type=text/css' />
-    <link rel='stylesheet' type='text/css'
-          href='http://example.com/tests/dom/base/test/csp/file_CSP.sjs?testid=css_examplecom&type=text/css' />
-
-  </head>
-  <body>
-    <img src="/tests/dom/base/test/csp/file_CSP.sjs?testid=img_self&type=img/png"> </img>
-    <img src="http://example.com/tests/dom/base/test/csp/file_CSP.sjs?testid=img_examplecom&type=img/png"> </img>
-    <script src='/tests/dom/base/test/csp/file_CSP.sjs?testid=script_self&type=text/javascript'></script>
-
-  </body>
-</html>
diff --git a/dom/base/test/csp/file_bug886164.html b/dom/base/test/csp/file_bug886164.html
deleted file mode 100644
index f6d0b439c923..000000000000
--- a/dom/base/test/csp/file_bug886164.html
+++ /dev/null
@@ -1,15 +0,0 @@
-<html>
-<head> <meta charset="utf-8"> </head>
-  <body>
-    <!-- sandbox="allow-same-origin" -->
-    <!-- Content-Security-Policy: default-src 'self' -->
-
-    <!-- these should be stopped by CSP -->
-    <img src="http://example.org/tests/dom/base/test/csp/file_CSP.sjs?testid=img_bad&type=img/png"> </img>
-
-    <!-- these should load ok -->
-    <img src="/tests/dom/base/test/csp/file_CSP.sjs?testid=img_good&type=img/png" />
-    <script src='/tests/dom/base/test/csp/file_CSP.sjs?testid=scripta_bad&type=text/javascript'></script>
-
-  </body>
-</html>
diff --git a/dom/base/test/csp/file_bug886164_3.html b/dom/base/test/csp/file_bug886164_3.html
deleted file mode 100644
index 175a2ff041e9..000000000000
--- a/dom/base/test/csp/file_bug886164_3.html
+++ /dev/null
@@ -1,12 +0,0 @@
-<html>
-<head> <meta charset="utf-8"> </head>
-  <body>
-    <!-- sandbox -->
-    <!-- Content-Security-Policy: default-src 'none' -->
-
-    <!-- these should be stopped by CSP -->
-    <img src="http://example.org/tests/dom/base/test/csp/file_CSP.sjs?testid=img3_bad&type=img/png"> </img>
-    <img src="/tests/dom/base/test/csp/file_CSP.sjs?testid=img3a_bad&type=img/png" />
-
-  </body>
-</html>
diff --git a/dom/base/test/csp/file_bug886164_4.html b/dom/base/test/csp/file_bug886164_4.html
deleted file mode 100644
index abf819441a5f..000000000000
--- a/dom/base/test/csp/file_bug886164_4.html
+++ /dev/null
@@ -1,12 +0,0 @@
-<html>
-<head> <meta charset="utf-8"> </head>
-  <body>
-    <!-- sandbox -->
-    <!-- Content-Security-Policy: default-src 'none' -->
-
-    <!-- these should be stopped by CSP -->
-    <img src="http://example.org/tests/dom/base/test/csp/file_CSP.sjs?testid=img4_bad&type=img/png"> </img>
-    <img src="/tests/dom/base/test/csp/file_CSP.sjs?testid=img4a_bad&type=img/png" />
-
-  </body>
-</html>
diff --git a/dom/base/test/csp/file_csp_allow_https_schemes.html b/dom/base/test/csp/file_csp_allow_https_schemes.html
deleted file mode 100644
index 96dab5013a98..000000000000
--- a/dom/base/test/csp/file_csp_allow_https_schemes.html
+++ /dev/null
@@ -1,14 +0,0 @@
-<!DOCTYPE HTML>
-<html>
-  <head>
-    <title>Bug 826805 - CSP: Allow http and https for scheme-less sources</title>
-  </head>
-  <body>
-  <div id="testdiv">blocked</div>
-  <!--
-    We resue file_csp_path_matching.js which just updates the contents of 'testdiv' to contain allowed.
-    Note, that we are loading the file_csp_path_matchting.js using a scheme of 'https'.
-   -->
-  <script src="https://example.com/tests/dom/base/test/csp/file_csp_path_matching.js#foo"></script>
-</body>
-</html>
diff --git a/dom/base/test/csp/file_csp_bug768029.html b/dom/base/test/csp/file_csp_bug768029.html
deleted file mode 100644
index b2f1fe5bbc76..000000000000
--- a/dom/base/test/csp/file_csp_bug768029.html
+++ /dev/null
@@ -1,25 +0,0 @@
-<!DOCTYPE HTML>
-<html>
-<!--
-  https://bugzilla.mozilla.org/show_bug.cgi?id=768029
--->
-<head>
-  <meta charset="utf-8">
-    <title>This is an app for testing</title>
-
-    <link rel="stylesheet" type="text/css"
-          href="file_csp_bug768029.sjs?type=style&origin=same_origin" />
-    <link rel="stylesheet" type="text/css"
-          href="http://example.com/tests/dom/base/test/csp/file_csp_bug768029.sjs?type=style&origin=cross_origin" />
-  </head>
-  <body>
-
-    <script src="file_csp_bug768029.sjs?type=script&origin=same_origin"></script>
-    <script src="http://example.com/tests/dom/base/test/csp/file_csp_bug768029.sjs?type=script&origin=cross_origin"></script>
-    <img src="file_csp_bug768029.sjs?type=img&origin=same_origin" />
-    <img src="http://example.com/tests/dom/base/test/csp/file_csp_bug768029.sjs?type=img&origin=cross_origin" />
-
-    Test for CSP applied to (simulated) app.
-
-  </body>
-</html>
diff --git a/dom/base/test/csp/file_csp_bug773891.html b/dom/base/test/csp/file_csp_bug773891.html
deleted file mode 100644
index ae2ba8d2fec1..000000000000
--- a/dom/base/test/csp/file_csp_bug773891.html
+++ /dev/null
@@ -1,25 +0,0 @@
-<!DOCTYPE HTML>
-<html>
-<!--
-  https://bugzilla.mozilla.org/show_bug.cgi?id=773891
--->
-<head>
-  <meta charset="utf-8">
-    <title>This is an app for csp testing</title>
-
-    <link rel="stylesheet" type="text/css"
-          href="file_csp_bug773891.sjs?type=style&origin=same_origin" />
-    <link rel="stylesheet" type="text/css"
-          href="http://example.com/tests/dom/base/test/csp/file_csp_bug773891.sjs?type=style&origin=cross_origin" />
-  </head>
-  <body>
-
-    <script src="file_csp_bug773891.sjs?type=script&origin=same_origin"></script>
-    <script src="http://example.com/tests/dom/base/test/csp/file_csp_bug773891.sjs?type=script&origin=cross_origin"></script>
-    <img src="file_csp_bug773891.sjs?type=img&origin=same_origin" />
-    <img src="http://example.com/tests/dom/base/test/csp/file_csp_bug773891.sjs?type=img&origin=cross_origin" />
-
-    Test for CSP applied to (simulated) app.
-
-  </body>
-</html>
diff --git a/dom/base/test/csp/file_policyuri_regression_from_multipolicy.html^headers^ b/dom/base/test/csp/file_policyuri_regression_from_multipolicy.html^headers^
deleted file mode 100644
index b57a8447c626..000000000000
--- a/dom/base/test/csp/file_policyuri_regression_from_multipolicy.html^headers^
+++ /dev/null
@@ -1 +0,0 @@
-content-security-policy-report-only: policy-uri /tests/dom/base/test/csp/file_CSP_policyuri_regression_from_multipolicy_policy
diff --git a/dom/base/test/mixedcontentblocker/mochitest.ini b/dom/base/test/mixedcontentblocker/mochitest.ini
deleted file mode 100644
index c118cf462d88..000000000000
--- a/dom/base/test/mixedcontentblocker/mochitest.ini
+++ /dev/null
@@ -1,20 +0,0 @@
-[DEFAULT]
-support-files =
-  bug803225_test_mailto.html
-  file_mixed_content_frameNavigation.html
-  file_mixed_content_frameNavigation_blankTarget.html
-  file_mixed_content_frameNavigation_grandchild.html
-  file_mixed_content_frameNavigation_innermost.html
-  file_mixed_content_frameNavigation_secure.html
-  file_mixed_content_frameNavigation_secure_grandchild.html
-  file_mixed_content_main.html
-  file_mixed_content_main_bug803225.html
-  file_mixed_content_main_bug803225_websocket_wsh.py
-  file_mixed_content_server.sjs
-
-[test_mixed_content_blocker.html]
-skip-if = buildapp == 'mulet' || buildapp == 'b2g' || toolkit == 'android' || e10s #TIMED_OUT, SSL_REQUIRED # Bug 1141029 Mulet parity with B2G Desktop for TC
-[test_mixed_content_blocker_bug803225.html]
-skip-if = buildapp == 'mulet' || buildapp == 'b2g' || toolkit == 'android' || e10s #TIMED_OUT, SSL_REQUIRED # Bug 1141029 Mulet parity with B2G Desktop for TC
-[test_mixed_content_blocker_frameNavigation.html]
-skip-if = buildapp == 'mulet' || buildapp == 'b2g' || toolkit == 'android' || e10s #TIMED_OUT, SSL_REQUIRED # Bug 1141029 Mulet parity with B2G Desktop for TC
diff --git a/dom/base/test/mochitest.ini b/dom/base/test/mochitest.ini
index 28363f7359ae..cb92be425c36 100644
--- a/dom/base/test/mochitest.ini
+++ b/dom/base/test/mochitest.ini
@@ -66,11 +66,6 @@ support-files =
   eventsource_redirect.resource^headers^
   eventsource_redirect_to.resource
   eventsource_redirect_to.resource^headers^
-  file_CrossSiteXHR_cache_server.sjs
-  file_CrossSiteXHR_inner.html
-  file_CrossSiteXHR_inner.jar
-  file_CrossSiteXHR_inner_data.sjs
-  file_CrossSiteXHR_server.sjs
   file_XHRDocURI.text
   file_XHRDocURI.text^headers^
   file_XHRDocURI.xml
@@ -331,10 +326,6 @@ skip-if = e10s || buildapp == 'b2g'
 [test_window_named_frame_enumeration.html]
 [test_writable-replaceable.html]
 [test_navigatorPrefOverride.html]
-[test_CrossSiteXHR.html]
-[test_CrossSiteXHR_cache.html]
-[test_CrossSiteXHR_origin.html]
-skip-if = buildapp == 'b2g' || e10s # last test fails to trigger onload on e10s/b2g
 [test_EventSource_redirects.html]
 [test_NodeIterator_basics_filters.xhtml]
 [test_NodeIterator_mutations_1.xhtml]
diff --git a/dom/base/test/moz.build b/dom/base/test/moz.build
index e58a41227319..9fdfe9ae432b 100644
--- a/dom/base/test/moz.build
+++ b/dom/base/test/moz.build
@@ -10,7 +10,6 @@ XPCSHELL_TESTS_MANIFESTS += [
 ]
 
 GeckoCppUnitTests([
-    'TestCSPParser',
     'TestGetURL',
     'TestNativeXMLHttpRequest',
     'TestPlainTextSerializer',
@@ -18,8 +17,6 @@ GeckoCppUnitTests([
 
 MOCHITEST_MANIFESTS += [
     'chrome/mochitest.ini',
-    'csp/mochitest.ini',
-    'mixedcontentblocker/mochitest.ini',
     'mochitest.ini',
     'websocket_hybi/mochitest.ini',
 ]
@@ -34,10 +31,8 @@ if CONFIG['MOZ_CHILD_PERMISSIONS']:
 MOCHITEST_CHROME_MANIFESTS += [
     'chrome.ini',
     'chrome/chrome.ini',
-    'csp/chrome.ini',
 ]
 
 BROWSER_CHROME_MANIFESTS += [
     'browser.ini',
-    'csp/browser.ini',
 ]
diff --git a/dom/base/test/test_warning_for_blocked_cross_site_request.html b/dom/base/test/test_warning_for_blocked_cross_site_request.html
index 50e470dfcd82..590506d2ee9a 100644
--- a/dom/base/test/test_warning_for_blocked_cross_site_request.html
+++ b/dom/base/test/test_warning_for_blocked_cross_site_request.html
@@ -13,7 +13,7 @@ https://bugzilla.mozilla.org/show_bug.cgi?id=713980
   <style>
     @font-face {
       font-family: "bad_cross_origin_webfont";
-      src: url('http://example.org/tests/dom/base/test/csp/file_CSP.sjs?testid=font_bad&type=application/octet-stream');
+      src: url('http://example.org/tests/dom/security/test/csp/file_CSP.sjs?testid=font_bad&type=application/octet-stream');
     }
     div#bad_webfont { font-family: "bad_cross_origin_webfont"; }
   </style>
@@ -76,7 +76,7 @@ function cleanup() {
 
 // Send a cross-origin XHR request without CORS
 var xhr = new XMLHttpRequest();
-xhr.open("GET", "http://example.org/tests/dom/base/test/file_CrossSiteXHR_server.sjs?allowOrigin=http://invalid", true);
+xhr.open("GET", "http://example.org/tests/dom/security/test/cors/file_CrossSiteXHR_server.sjs?allowOrigin=http://invalid", true);
 xhr.send(null);
 
 // Create a div that triggers a cross-origin webfont request
diff --git a/dom/base/test/unit/xpcshell.ini b/dom/base/test/unit/xpcshell.ini
index 309ac4483065..287882e565ad 100644
--- a/dom/base/test/unit/xpcshell.ini
+++ b/dom/base/test/unit/xpcshell.ini
@@ -23,8 +23,6 @@ support-files =
 
 [test_bug553888.js]
 [test_bug737966.js]
-[test_cspreports.js]
-skip-if = buildapp == 'mulet'
 [test_error_codes.js]
 run-sequentially = Hardcoded 4444 port.
 # Bug 1018414: hardcoded localhost doesn't work properly on some OS X installs
diff --git a/dom/bindings/Codegen.py b/dom/bindings/Codegen.py
index df703c65709a..8ef745c2f64c 100644
--- a/dom/bindings/Codegen.py
+++ b/dom/bindings/Codegen.py
@@ -10989,7 +10989,7 @@ class CGDOMJSProxyHandler_getElements(ClassMethod):
             'jsvalRef': 'temp',
             'jsvalHandle': '&temp',
             'obj': 'proxy',
-            'successCode': ("adder->append(cx, temp);\n"
+            'successCode': ("if (!adder->append(cx, temp)) return false;\n"
                             "continue;\n")
         }
         get = CGProxyIndexedGetter(self.descriptor, templateValues, False, False).define()
diff --git a/dom/bindings/test/test_promise_rejections_from_jsimplemented.html b/dom/bindings/test/test_promise_rejections_from_jsimplemented.html
index 81a763893d60..d109d5ec8993 100644
--- a/dom/bindings/test/test_promise_rejections_from_jsimplemented.html
+++ b/dom/bindings/test/test_promise_rejections_from_jsimplemented.html
@@ -37,7 +37,7 @@ https://bugzilla.mozilla.org/show_bug.cgi?id=1107592
 
   function doTest() {
     var t = new TestInterfaceJS();
-
+    var asyncStack = SpecialPowers.getBoolPref("javascript.options.asyncstack");
     var ourFile = "http://mochi.test:8888/tests/dom/bindings/test/test_promise_rejections_from_jsimplemented.html";
 
     Promise.all([
@@ -64,7 +64,7 @@ https://bugzilla.mozilla.org/show_bug.cgi?id=1107592
           checkExn.bind(null, 61, "ReferenceError",
                         "thereIsNoSuchContentFunction2 is not defined",
                         undefined, ourFile, 4,
-                        "doTest/<@http://mochi.test:8888/tests/dom/bindings/test/test_promise_rejections_from_jsimplemented.html:61:11\nAsync*doTest@http://mochi.test:8888/tests/dom/bindings/test/test_promise_rejections_from_jsimplemented.html:60:7\n")),
+                        "doTest/<@http://mochi.test:8888/tests/dom/bindings/test/test_promise_rejections_from_jsimplemented.html:61:11\n" + (asyncStack ? "Async*doTest@http://mochi.test:8888/tests/dom/bindings/test/test_promise_rejections_from_jsimplemented.html:60:7\n" : ""))),
       t.testPromiseWithThrowingChromeThenable().then(
           ensurePromiseFail.bind(null, 5),
           checkExn.bind(null, 0, "NS_ERROR_UNEXPECTED", "", undefined, "", 5, "")),
@@ -84,10 +84,10 @@ https://bugzilla.mozilla.org/show_bug.cgi?id=1107592
                         "doTest@http://mochi.test:8888/tests/dom/bindings/test/test_promise_rejections_from_jsimplemented.html:79:7\n")),
       t.testPromiseWithDOMExceptionThrowingThenFunction().then(
           ensurePromiseFail.bind(null, 8),
-          checkExn.bind(null, 85, "NetworkError",
-                        "We are a third DOMException",
-                        DOMException.NETWORK_ERR, ourFile, 8,
-                        "Async*doTest@http://mochi.test:8888/tests/dom/bindings/test/test_promise_rejections_from_jsimplemented.html:85:7\n")),
+          checkExn.bind(null, asyncStack ? 85 : 0, "NetworkError",
+                         "We are a third DOMException",
+                        DOMException.NETWORK_ERR, asyncStack ? ourFile : "", 8,
+                        asyncStack ? "Async*doTest@http://mochi.test:8888/tests/dom/bindings/test/test_promise_rejections_from_jsimplemented.html:85:7\n" : "")),
       t.testPromiseWithDOMExceptionThrowingThenable().then(
           ensurePromiseFail.bind(null, 9),
           checkExn.bind(null, 0, "TypeMismatchError",
diff --git a/dom/browser-element/BrowserElementChildPreload.js b/dom/browser-element/BrowserElementChildPreload.js
index 73272df61bda..e0bf0800ed5e 100644
--- a/dom/browser-element/BrowserElementChildPreload.js
+++ b/dom/browser-element/BrowserElementChildPreload.js
@@ -144,8 +144,8 @@ BrowserElementChild.prototype = {
                      /* useCapture = */ true,
                      /* wantsUntrusted = */ false);
 
-    addEventListener("MozDOMFullscreen:Entered",
-                     this._mozEnteredDomFullscreen.bind(this),
+    addEventListener("MozDOMFullscreen:Request",
+                     this._mozRequestedDOMFullscreen.bind(this),
                      /* useCapture = */ true,
                      /* wantsUntrusted = */ false);
 
@@ -224,6 +224,7 @@ BrowserElementChild.prototype = {
       "unblock-modal-prompt": this._recvStopWaiting,
       "fire-ctx-callback": this._recvFireCtxCallback,
       "owner-visibility-change": this._recvOwnerVisibilityChange,
+      "entered-fullscreen": this._recvEnteredFullscreen,
       "exit-fullscreen": this._recvExitFullscreen.bind(this),
       "activate-next-paint-listener": this._activateNextPaintListener.bind(this),
       "set-input-method-active": this._recvSetInputMethodActive.bind(this),
@@ -291,6 +292,12 @@ BrowserElementChild.prototype = {
     });
   },
 
+  get _windowUtils() {
+    return content.document.defaultView
+                  .QueryInterface(Ci.nsIInterfaceRequestor)
+                  .getInterface(Ci.nsIDOMWindowUtils);
+  },
+
   _tryGetInnerWindowID: function(win) {
     let utils = win.QueryInterface(Ci.nsIInterfaceRequestor)
                    .getInterface(Ci.nsIDOMWindowUtils);
@@ -434,11 +441,18 @@ BrowserElementChild.prototype = {
     win.modalDepth--;
   },
 
+  _recvEnteredFullscreen: function() {
+    if (!this._windowUtils.handleFullscreenRequests() &&
+        !content.document.mozFullScreen) {
+      // If we don't actually have any pending fullscreen request
+      // to handle, neither we have been in fullscreen, tell the
+      // parent to just exit.
+      sendAsyncMsg("exited-dom-fullscreen");
+    }
+  },
+
   _recvExitFullscreen: function() {
-    var utils = content.document.defaultView
-                       .QueryInterface(Ci.nsIInterfaceRequestor)
-                       .getInterface(Ci.nsIDOMWindowUtils);
-    utils.exitFullscreen();
+    this._windowUtils.exitFullscreen();
   },
 
   _titleChangedHandler: function(e) {
@@ -970,8 +984,8 @@ BrowserElementChild.prototype = {
     });
   },
 
-  _mozEnteredDomFullscreen: function(e) {
-    sendAsyncMsg("entered-dom-fullscreen");
+  _mozRequestedDOMFullscreen: function(e) {
+    sendAsyncMsg("requested-dom-fullscreen");
   },
 
   _mozFullscreenOriginChange: function(e) {
diff --git a/dom/browser-element/BrowserElementParent.js b/dom/browser-element/BrowserElementParent.js
index 77283f17790c..9e80ad887a41 100644
--- a/dom/browser-element/BrowserElementParent.js
+++ b/dom/browser-element/BrowserElementParent.js
@@ -84,6 +84,7 @@ function BrowserElementParent() {
   this._pendingDOMRequests = {};
   this._pendingSetInputMethodActive = [];
   this._nextPaintListeners = [];
+  this._pendingDOMFullscreen = false;
 
   Services.obs.addObserver(this, 'oop-frameloader-crashed', /* ownsWeak = */ true);
   Services.obs.addObserver(this, 'copypaste-docommand', /* ownsWeak = */ true);
@@ -196,7 +197,7 @@ BrowserElementParent.prototype = {
       "got-contentdimensions": this._gotDOMRequestResult,
       "got-can-go-back": this._gotDOMRequestResult,
       "got-can-go-forward": this._gotDOMRequestResult,
-      "entered-dom-fullscreen": this._enteredDomFullscreen,
+      "requested-dom-fullscreen": this._requestedDOMFullscreen,
       "fullscreen-origin-change": this._fullscreenOriginChange,
       "exited-dom-fullscreen": this._exitedDomFullscreen,
       "got-visible": this._gotDOMRequestResult,
@@ -970,7 +971,8 @@ BrowserElementParent.prototype = {
     this._fireEventFromMsg(data);
   },
 
-  _enteredDomFullscreen: function() {
+  _requestedDOMFullscreen: function() {
+    this._pendingDOMFullscreen = true;
     this._windowUtils.remoteFrameFullscreenChanged(this._frameElement);
   },
 
@@ -987,6 +989,9 @@ BrowserElementParent.prototype = {
     if (this._isAlive() && evt.target == this._window.document) {
       if (!this._window.document.mozFullScreen) {
         this._sendAsyncMsg("exit-fullscreen");
+      } else if (this._pendingDOMFullscreen) {
+        this._pendingDOMFullscreen = false;
+        this._sendAsyncMsg("entered-fullscreen");
       }
     }
   },
diff --git a/dom/cache/Context.cpp b/dom/cache/Context.cpp
index 6515477890c4..8a09c09a5a0e 100644
--- a/dom/cache/Context.cpp
+++ b/dom/cache/Context.cpp
@@ -112,14 +112,18 @@ public:
 private:
   ~Data()
   {
-    if (mConnection) {
-      NS_ProxyRelease(mTarget, mConnection);
-    }
+    // We could proxy release our data here, but instead just assert.  The
+    // Context code should guarantee that we are destroyed on the target
+    // thread.  If we're not, then QuotaManager might race and try to clear the
+    // origin out from under us.
+    MOZ_ASSERT(mTarget == NS_GetCurrentThread());
   }
 
   nsCOMPtr<nsIThread> mTarget;
   nsCOMPtr<mozIStorageConnection> mConnection;
 
+  // Threadsafe counting because we're created on the PBackground thread
+  // and destroyed on the target IO thread.
   NS_INLINE_DECL_THREADSAFE_REFCOUNTING(Context::Data)
 };
 
@@ -421,6 +425,8 @@ Context::QuotaInitRunnable::Run()
       mInitAction->RunOnTarget(resolver, mQuotaInfo, mData);
       MOZ_ASSERT(resolver->Resolved());
 
+      mData = nullptr;
+
       break;
     }
     // -------------------
@@ -915,6 +921,7 @@ Context::~Context()
 {
   NS_ASSERT_OWNINGTHREAD(Context);
   MOZ_ASSERT(mManager);
+  MOZ_ASSERT(!mData);
 
   if (mThreadsafeHandle) {
     mThreadsafeHandle->ContextDestroyed(this);
diff --git a/dom/canvas/WebGLContextState.cpp b/dom/canvas/WebGLContextState.cpp
index d6f4eae7431e..0ad586978a03 100644
--- a/dom/canvas/WebGLContextState.cpp
+++ b/dom/canvas/WebGLContextState.cpp
@@ -426,15 +426,17 @@ WebGLContext::GetParameter(JSContext* cx, GLenum pname, ErrorResult& rv)
 
         // unsigned int. here we may have to return very large values like 2^32-1 that can't be represented as
         // javascript integer values. We just return them as doubles and javascript doesn't care.
-        case LOCAL_GL_STENCIL_BACK_VALUE_MASK:
-        case LOCAL_GL_STENCIL_BACK_WRITEMASK:
-        case LOCAL_GL_STENCIL_VALUE_MASK:
+        case LOCAL_GL_STENCIL_BACK_VALUE_MASK: {
+            return JS::DoubleValue(mStencilValueMaskBack); // pass as FP value to allow large values such as 2^32-1.
+        }
+        case LOCAL_GL_STENCIL_BACK_WRITEMASK: {
+            return JS::DoubleValue(mStencilWriteMaskBack);
+        }
+        case LOCAL_GL_STENCIL_VALUE_MASK: {
+            return JS::DoubleValue(mStencilValueMaskFront);
+        }
         case LOCAL_GL_STENCIL_WRITEMASK: {
-            GLint i = 0; // the GL api (glGetIntegerv) only does signed ints
-            gl->fGetIntegerv(pname, &i);
-            GLuint i_unsigned(i); // this is where -1 becomes 2^32-1
-            double i_double(i_unsigned); // pass as FP value to allow large values such as 2^32-1.
-            return JS::DoubleValue(i_double);
+            return JS::DoubleValue(mStencilWriteMaskFront);
         }
 
         // float
diff --git a/dom/canvas/WebGLContextUtils.cpp b/dom/canvas/WebGLContextUtils.cpp
index b735dd1b461d..69fda519db96 100644
--- a/dom/canvas/WebGLContextUtils.cpp
+++ b/dom/canvas/WebGLContextUtils.cpp
@@ -1198,12 +1198,11 @@ WebGLContext::AssertCachedState()
     //   supported by the GL implementation.
     const int maxStencilBits = 8;
     const GLuint maxStencilBitsMask = (1 << maxStencilBits) - 1;
-
     AssertMaskedUintParamCorrect(gl, LOCAL_GL_STENCIL_VALUE_MASK,      maxStencilBitsMask, mStencilValueMaskFront);
     AssertMaskedUintParamCorrect(gl, LOCAL_GL_STENCIL_BACK_VALUE_MASK, maxStencilBitsMask, mStencilValueMaskBack);
 
-    AssertUintParamCorrect(gl, LOCAL_GL_STENCIL_WRITEMASK,      mStencilWriteMaskFront);
-    AssertUintParamCorrect(gl, LOCAL_GL_STENCIL_BACK_WRITEMASK, mStencilWriteMaskBack);
+    AssertMaskedUintParamCorrect(gl, LOCAL_GL_STENCIL_WRITEMASK,       maxStencilBitsMask, mStencilWriteMaskFront);
+    AssertMaskedUintParamCorrect(gl, LOCAL_GL_STENCIL_BACK_WRITEMASK,  maxStencilBitsMask, mStencilWriteMaskBack);
 
     // Viewport
     GLint int4[4] = {0, 0, 0, 0};
diff --git a/dom/crypto/CryptoKey.cpp b/dom/crypto/CryptoKey.cpp
index be87903d0766..de9bd0de6b62 100644
--- a/dom/crypto/CryptoKey.cpp
+++ b/dom/crypto/CryptoKey.cpp
@@ -550,7 +550,9 @@ CryptoKey::PrivateKeyToPkcs8(SECKEYPrivateKey* aPrivKey,
   if (!pkcs8Item.get()) {
     return NS_ERROR_DOM_INVALID_ACCESS_ERR;
   }
-  aRetVal.Assign(pkcs8Item.get());
+  if (!aRetVal.Assign(pkcs8Item.get())) {
+    return NS_ERROR_DOM_OPERATION_ERR;
+  }
   return NS_OK;
 }
 
@@ -647,7 +649,9 @@ CryptoKey::PublicKeyToSpki(SECKEYPublicKey* aPubKey,
   const SEC_ASN1Template* tpl = SEC_ASN1_GET(CERT_SubjectPublicKeyInfoTemplate);
   ScopedSECItem spkiItem(SEC_ASN1EncodeItem(nullptr, nullptr, spki, tpl));
 
-  aRetVal.Assign(spkiItem.get());
+  if (!aRetVal.Assign(spkiItem.get())) {
+    return NS_ERROR_DOM_OPERATION_ERR;
+  }
   return NS_OK;
 }
 
@@ -1125,7 +1129,9 @@ CryptoKey::PublicDhKeyToRaw(SECKEYPublicKey* aPubKey,
                             CryptoBuffer& aRetVal,
                             const nsNSSShutDownPreventionLock& /*proofOfLock*/)
 {
-  aRetVal.Assign(&aPubKey->u.dh.publicValue);
+  if (!aRetVal.Assign(&aPubKey->u.dh.publicValue)) {
+    return NS_ERROR_DOM_OPERATION_ERR;
+  }
   return NS_OK;
 }
 
diff --git a/dom/crypto/KeyAlgorithmProxy.h b/dom/crypto/KeyAlgorithmProxy.h
index 396edd893aa5..7f64dd3e64da 100644
--- a/dom/crypto/KeyAlgorithmProxy.h
+++ b/dom/crypto/KeyAlgorithmProxy.h
@@ -109,7 +109,7 @@ struct KeyAlgorithmProxy
     mHmac.mHash.mName = aHashName;
   }
 
-  void
+  bool
   MakeRsa(const nsString& aName, uint32_t aModulusLength,
          const CryptoBuffer& aPublicExponent, const nsString& aHashName)
   {
@@ -118,7 +118,10 @@ struct KeyAlgorithmProxy
     mRsa.mName = aName;
     mRsa.mModulusLength = aModulusLength;
     mRsa.mHash.mName = aHashName;
-    mRsa.mPublicExponent.Assign(aPublicExponent);
+    if (!mRsa.mPublicExponent.Assign(aPublicExponent)) {
+      return false;
+    }
+    return true;
   }
 
   void
@@ -130,15 +133,20 @@ struct KeyAlgorithmProxy
     mEc.mNamedCurve = aNamedCurve;
   }
 
-  void
+  bool
   MakeDh(const nsString& aName, const CryptoBuffer& aPrime,
          const CryptoBuffer& aGenerator)
   {
     mType = DH;
     mName = aName;
     mDh.mName = aName;
-    mDh.mPrime.Assign(aPrime);
-    mDh.mGenerator.Assign(aGenerator);
+    if (!mDh.mPrime.Assign(aPrime)) {
+      return false;
+    }
+    if (!mDh.mGenerator.Assign(aGenerator)) {
+      return false;
+    }
+    return true;
   }
 };
 
diff --git a/dom/crypto/WebCryptoTask.cpp b/dom/crypto/WebCryptoTask.cpp
index 40fad804d941..f9f95a0c6723 100644
--- a/dom/crypto/WebCryptoTask.cpp
+++ b/dom/crypto/WebCryptoTask.cpp
@@ -1603,7 +1603,9 @@ private:
 
     // Extract relevant information from the public key
     mModulusLength = 8 * pubKey->u.rsa.modulus.len;
-    mPublicExponent.Assign(&pubKey->u.rsa.publicExponent);
+    if (!mPublicExponent.Assign(&pubKey->u.rsa.publicExponent)) {
+      return NS_ERROR_DOM_OPERATION_ERR;
+    }
 
     return NS_OK;
   }
@@ -1628,8 +1630,10 @@ private:
     }
 
     // Set an appropriate KeyAlgorithm
-    mKey->Algorithm().MakeRsa(mAlgName, mModulusLength,
-                              mPublicExponent, mHashName);
+    if (!mKey->Algorithm().MakeRsa(mAlgName, mModulusLength,
+                                   mPublicExponent, mHashName)) {
+      return NS_ERROR_DOM_OPERATION_ERR;
+    }
 
     if (mDataIsJwk && !JwkCompatible(mJwk, mKey)) {
       return NS_ERROR_DOM_DATA_ERR;
@@ -1879,7 +1883,9 @@ private:
       return NS_ERROR_DOM_DATA_ERR;
     }
 
-    mKey->Algorithm().MakeDh(mAlgName, mPrime, mGenerator);
+    if (!mKey->Algorithm().MakeDh(mAlgName, mPrime, mGenerator)) {
+      return NS_ERROR_DOM_OPERATION_ERR;
+    }
     return NS_OK;
   }
 };
@@ -2211,14 +2217,20 @@ public:
       }
 
       // Create algorithm
-      mKeyPair.mPublicKey.get()->Algorithm().MakeRsa(algName,
-                                                     modulusLength,
-                                                     publicExponent,
-                                                     hashName);
-      mKeyPair.mPrivateKey.get()->Algorithm().MakeRsa(algName,
-                                                      modulusLength,
-                                                      publicExponent,
-                                                      hashName);
+      if (!mKeyPair.mPublicKey.get()->Algorithm().MakeRsa(algName,
+                                                          modulusLength,
+                                                          publicExponent,
+                                                          hashName)) {
+        mEarlyRv = NS_ERROR_DOM_OPERATION_ERR;
+        return;
+      }
+      if (!mKeyPair.mPrivateKey.get()->Algorithm().MakeRsa(algName,
+                                                           modulusLength,
+                                                           publicExponent,
+                                                           hashName)) {
+        mEarlyRv = NS_ERROR_DOM_OPERATION_ERR;
+        return;
+      }
       mMechanism = CKM_RSA_PKCS_KEY_PAIR_GEN;
 
       // Set up params struct
@@ -2268,8 +2280,18 @@ public:
       }
 
       // Create algorithm.
-      mKeyPair.mPublicKey.get()->Algorithm().MakeDh(algName, prime, generator);
-      mKeyPair.mPrivateKey.get()->Algorithm().MakeDh(algName, prime, generator);
+      if (!mKeyPair.mPublicKey.get()->Algorithm().MakeDh(algName,
+                                                         prime,
+                                                         generator)) {
+        mEarlyRv = NS_ERROR_DOM_OPERATION_ERR;
+        return;
+      }
+      if (!mKeyPair.mPrivateKey.get()->Algorithm().MakeDh(algName,
+                                                          prime,
+                                                          generator)) {
+        mEarlyRv = NS_ERROR_DOM_OPERATION_ERR;
+        return;
+      }
       mMechanism = CKM_DH_PKCS_KEY_PAIR_GEN;
     } else {
       mEarlyRv = NS_ERROR_DOM_NOT_SUPPORTED_ERR;
@@ -2789,7 +2811,9 @@ private:
       }
 
       NS_ConvertUTF16toUTF8 utf8(json);
-      mResult.Assign((const uint8_t*) utf8.BeginReading(), utf8.Length());
+      if (!mResult.Assign((const uint8_t*) utf8.BeginReading(), utf8.Length())) {
+        return NS_ERROR_DOM_OPERATION_ERR;
+      }
     }
 
     return NS_OK;
diff --git a/dom/devicestorage/test/mochitest.ini b/dom/devicestorage/test/mochitest.ini
index 6801df9584cb..fe451147f6d3 100644
--- a/dom/devicestorage/test/mochitest.ini
+++ b/dom/devicestorage/test/mochitest.ini
@@ -25,7 +25,7 @@ support-files = devicestorage_common.js
 [test_watch.html]
 [test_watchOther.html]
 [test_storageAreaListener.html]
-skip-if = toolkit != 'gonk'
+skip-if = (toolkit != 'gonk') || (toolkit == 'gonk' && debug) # Bug 1173484
 
 # FileSystem API tests
 [test_fs_basic.html]
diff --git a/dom/fetch/Fetch.cpp b/dom/fetch/Fetch.cpp
index 884d5afd5c42..df8948397ae1 100644
--- a/dom/fetch/Fetch.cpp
+++ b/dom/fetch/Fetch.cpp
@@ -548,13 +548,26 @@ ExtractFromURLSearchParams(const URLSearchParams& aParams,
   return NS_NewStringInputStream(aStream, serialized);
 }
 
-void
-FillFormData(const nsString& aName, const nsString& aValue, void* aFormData)
+class MOZ_STACK_CLASS FillFormIterator final
+  : public URLSearchParams::ForEachIterator
 {
-  MOZ_ASSERT(aFormData);
-  nsFormData* fd = static_cast<nsFormData*>(aFormData);
-  fd->Append(aName, aValue);
-}
+public:
+  explicit FillFormIterator(nsFormData* aFormData)
+    : mFormData(aFormData)
+  {
+    MOZ_ASSERT(aFormData);
+  }
+
+  bool URLSearchParamsIterator(const nsString& aName,
+                               const nsString& aValue) override
+  {
+    mFormData->Append(aName, aValue);
+    return true;
+  }
+
+private:
+  nsFormData* mFormData;
+};
 
 /**
  * A simple multipart/form-data parser as defined in RFC 2388 and RFC 2046.
@@ -1591,7 +1604,10 @@ FetchBody<Derived>::ContinueConsumeBody(nsresult aStatus, uint32_t aResultLength
           params->ParseInput(data, /* aObserver */ nullptr);
 
           nsRefPtr<nsFormData> fd = new nsFormData(DerivedClass()->GetParentObject());
-          params->ForEach(FillFormData, static_cast<void*>(fd));
+          FillFormIterator iterator(fd);
+          DebugOnly<bool> status = params->ForEach(iterator);
+          MOZ_ASSERT(status);
+
           localPromise->MaybeResolve(fd);
         } else {
           ErrorResult result;
diff --git a/dom/interfaces/base/nsIDOMWindowUtils.idl b/dom/interfaces/base/nsIDOMWindowUtils.idl
index 10b14e18100d..51a136dad003 100644
--- a/dom/interfaces/base/nsIDOMWindowUtils.idl
+++ b/dom/interfaces/base/nsIDOMWindowUtils.idl
@@ -49,7 +49,7 @@ interface nsIJSRAIIHelper;
 interface nsIContentPermissionRequest;
 interface nsIObserver;
 
-[scriptable, uuid(ec176f3b-2886-4090-938e-dded103c5f1c)]
+[scriptable, uuid(a01d5bb4-3e81-4529-b139-2f4ebb78f717)]
 interface nsIDOMWindowUtils : nsISupports {
 
   /**
@@ -1193,6 +1193,15 @@ interface nsIDOMWindowUtils : nsISupports {
    */
   void remoteFrameFullscreenReverted();
 
+  /**
+   * Calls the document to handle any pending fullscreen requests.
+   * It is called when the parent document has entered fullscreen, and
+   * we want to put the current document into fullscreen as well.
+   * The return value indicates whether there is any fullscreen request
+   * handled by this call.
+   */
+  boolean handleFullscreenRequests();
+
   /**
    * Called when the child frame has fully exit fullscreen, so that the parent
    * process can also fully exit.
diff --git a/dom/interfaces/base/nsIServiceWorkerManager.idl b/dom/interfaces/base/nsIServiceWorkerManager.idl
index 644f825ff280..92cbc2db42f2 100644
--- a/dom/interfaces/base/nsIServiceWorkerManager.idl
+++ b/dom/interfaces/base/nsIServiceWorkerManager.idl
@@ -33,7 +33,7 @@ interface nsIServiceWorkerInfo : nsISupports
   readonly attribute DOMString waitingCacheName;
 };
 
-[scriptable, builtinclass, uuid(d130fcbd-1afe-4dd9-b70d-08a4b2373af5)]
+[scriptable, builtinclass, uuid(5e112a42-df4c-4ae9-bc71-e6e681ab5f38)]
 interface nsIServiceWorkerManager : nsISupports
 {
   /**
@@ -96,13 +96,6 @@ interface nsIServiceWorkerManager : nsISupports
    */
   [noscript] nsISupports GetDocumentController(in nsIDOMWindow aWindow);
 
-  /*
-   * This implements the soft update algorithm.
-   * XXXbaku this can be removed when bug 1155153 lands.
-   */
-  [implicit_jscontext] void softUpdate(in jsval aOriginAttributes,
-                                       in DOMString aScope);
-
   /*
    * Clears ServiceWorker registrations from memory and disk for the specified
    * host.
@@ -122,10 +115,22 @@ interface nsIServiceWorkerManager : nsISupports
   // Testing
   DOMString getScopeForUrl(in nsIPrincipal aPrincipal, in DOMString aPath);
 
-  // This is meant to be used only by about:serviceworkers. It returns an array
-  // of nsIServiceWorkerInfo.
+  // Note: This is meant to be used only by about:serviceworkers.
+  //It returns an array of nsIServiceWorkerInfo.
   nsIArray getAllRegistrations();
 
+  // Note: This is meant to be used only by about:serviceworkers.
+  // It calls softUpdate() for each child process.
+  [implicit_jscontext] void propagateSoftUpdate(in jsval aOriginAttributes,
+                                                in DOMString aScope);
+
+  // Note: This is meant to be used only by about:serviceworkers.
+  // It calls unregister() in each child process. The callback is used to
+  // inform when unregister() is completed on the current process.
+  void propagateUnregister(in nsIPrincipal aPrincipal,
+                           in nsIServiceWorkerUnregisterCallback aCallback,
+                           in DOMString aScope);
+
   [implicit_jscontext] void sendPushEvent(in jsval aOriginAttributes,
                                           in ACString aScope,
                                           in DOMString aData);
diff --git a/dom/ipc/PBrowser.ipdl b/dom/ipc/PBrowser.ipdl
index 938176722559..e81e9685a9a1 100644
--- a/dom/ipc/PBrowser.ipdl
+++ b/dom/ipc/PBrowser.ipdl
@@ -25,7 +25,6 @@ using class IPC::Principal from "mozilla/dom/PermissionMessageUtils.h";
 using class mozilla::gfx::Matrix from "mozilla/gfx/Matrix.h";
 using struct gfxSize from "gfxPoint.h";
 using CSSRect from "Units.h";
-using CSSSize from "Units.h";
 using LayoutDeviceIntRect from "Units.h";
 using mozilla::LayoutDeviceIntPoint from "Units.h";
 using ScreenIntSize from "Units.h";
@@ -549,7 +548,7 @@ child:
 
     CacheFileDescriptor(nsString path, FileDescriptor fd);
 
-    UpdateDimensions(CSSRect rect, CSSSize size, ScreenOrientation orientation,
+    UpdateDimensions(IntRect rect, ScreenIntSize size, ScreenOrientation orientation,
                      LayoutDeviceIntPoint chromeDisp) compressall;
 
     UpdateFrame(FrameMetrics frame);
diff --git a/dom/ipc/TabChild.cpp b/dom/ipc/TabChild.cpp
index 7956b6d8dfa2..b17208f8c154 100644
--- a/dom/ipc/TabChild.cpp
+++ b/dom/ipc/TabChild.cpp
@@ -92,7 +92,6 @@
 #include "nsIPermissionManager.h"
 #include "nsIScriptError.h"
 #include "mozilla/EventForwards.h"
-#include "nsDeviceContext.h"
 
 #define BROWSER_ELEMENT_CHILD_SCRIPT \
     NS_LITERAL_STRING("chrome://global/content/BrowserElementChild.js")
@@ -166,6 +165,7 @@ NS_IMPL_ISUPPORTS(TabChild::DelayedFireContextMenuEvent,
 TabChildBase::TabChildBase()
   : mContentDocumentIsDisplayed(false)
   , mTabChildGlobal(nullptr)
+  , mInnerSize(0, 0)
 {
   mozilla::HoldJSObjects(this);
 }
@@ -236,11 +236,9 @@ TabChildBase::InitializeRootMetrics()
   mLastRootMetrics.SetViewport(CSSRect(CSSPoint(), kDefaultViewportSize));
   mLastRootMetrics.SetCompositionBounds(ParentLayerRect(
       ParentLayerPoint(),
-      ParentLayerSize(
-        ViewAs<ParentLayerPixel>(GetInnerSize(),
-                                 PixelCastJustification::ScreenIsParentLayerForRoot))));
+      ParentLayerSize(ViewAs<ParentLayerPixel>(mInnerSize, PixelCastJustification::ScreenIsParentLayerForRoot))));
   mLastRootMetrics.SetZoom(CSSToParentLayerScale2D(
-      ConvertScaleForRoot(CalculateIntrinsicScale(GetInnerSize(), kDefaultViewportSize))));
+      ConvertScaleForRoot(CalculateIntrinsicScale(mInnerSize, kDefaultViewportSize))));
   mLastRootMetrics.SetDevPixelsPerCSSPixel(WebWidget()->GetDefaultScale());
   // We use ParentLayerToLayerScale(1) below in order to turn the
   // async zoom amount into the gecko zoom amount.
@@ -301,14 +299,14 @@ TabChildBase::HandlePossibleViewportChange(const ScreenIntSize& aOldScreenSize)
   }
 
   TABC_LOG("HandlePossibleViewportChange aOldScreenSize=%s mInnerSize=%s\n",
-    Stringify(aOldScreenSize).c_str(), Stringify(GetInnerSize()).c_str());
+    Stringify(aOldScreenSize).c_str(), Stringify(mInnerSize).c_str());
 
   nsCOMPtr<nsIDocument> document(GetDocument());
   if (!document) {
     return false;
   }
 
-  nsViewportInfo viewportInfo = nsContentUtils::GetViewportInfo(document, GetInnerSize());
+  nsViewportInfo viewportInfo = nsContentUtils::GetViewportInfo(document, mInnerSize);
   uint32_t presShellId = 0;
   mozilla::layers::FrameMetrics::ViewID viewId = FrameMetrics::NULL_SCROLL_ID;
   bool scrollIdentifiersValid = APZCCallbackHelper::GetOrCreateScrollIdentifiers(
@@ -325,8 +323,8 @@ TabChildBase::HandlePossibleViewportChange(const ScreenIntSize& aOldScreenSize)
                             constraints);
   }
 
-  float screenW = GetInnerSize().width;
-  float screenH = GetInnerSize().height;
+  float screenW = mInnerSize.width;
+  float screenH = mInnerSize.height;
   CSSSize viewport(viewportInfo.GetSize());
 
   // We're not being displayed in any way; don't bother doing anything because
@@ -360,15 +358,15 @@ TabChildBase::HandlePossibleViewportChange(const ScreenIntSize& aOldScreenSize)
 
   ScreenIntSize oldScreenSize = aOldScreenSize;
   if (oldScreenSize == ScreenIntSize()) {
-    oldScreenSize = GetInnerSize();
+    oldScreenSize = mInnerSize;
   }
 
   FrameMetrics metrics(mLastRootMetrics);
   metrics.SetViewport(CSSRect(CSSPoint(), viewport));
 
-  // Calculate the composition bounds based on the inner size, excluding the sizes
+  // Calculate the composition bounds based on mInnerSize, excluding the sizes
   // of the scrollbars if they are not overlay scrollbars.
-  ScreenSize compositionSize(GetInnerSize());
+  ScreenSize compositionSize(mInnerSize);
   nsCOMPtr<nsIPresShell> shell = GetPresShell();
   if (shell) {
     nsMargin scrollbarsAppUnits =
@@ -382,9 +380,7 @@ TabChildBase::HandlePossibleViewportChange(const ScreenIntSize& aOldScreenSize)
 
   metrics.SetCompositionBounds(ParentLayerRect(
       ParentLayerPoint(),
-      ParentLayerSize(
-        ViewAs<ParentLayerPixel>(GetInnerSize(),
-                                 PixelCastJustification::ScreenIsParentLayerForRoot))));
+      ParentLayerSize(ViewAs<ParentLayerPixel>(compositionSize, PixelCastJustification::ScreenIsParentLayerForRoot))));
   metrics.SetRootCompositionSize(
       ScreenSize(compositionSize) * ScreenToLayoutDeviceScale(1.0f) / metrics.GetDevPixelsPerCSSPixel());
 
@@ -401,7 +397,7 @@ TabChildBase::HandlePossibleViewportChange(const ScreenIntSize& aOldScreenSize)
   // within the screen width. Note that "actual content" may be different with
   // respect to CSS pixels because of the CSS viewport size changing.
   CSSToScreenScale oldIntrinsicScale = CalculateIntrinsicScale(oldScreenSize, oldBrowserSize);
-  CSSToScreenScale newIntrinsicScale = CalculateIntrinsicScale(GetInnerSize(), viewport);
+  CSSToScreenScale newIntrinsicScale = CalculateIntrinsicScale(mInnerSize, viewport);
   metrics.ZoomBy(newIntrinsicScale.scale / oldIntrinsicScale.scale);
 
   // Changing the zoom when we're not doing a first paint will get ignored
@@ -885,6 +881,7 @@ TabChild::TabChild(nsIContentChild* aManager,
   , mManager(aManager)
   , mChromeFlags(aChromeFlags)
   , mLayersId(0)
+  , mOuterRect(0, 0, 0, 0)
   , mActivePointerId(-1)
   , mAppPackageFileDescriptorRecved(false)
   , mLastBackgroundColor(NS_RGB(255, 255, 255))
@@ -925,9 +922,9 @@ TabChild::HandleEvent(nsIDOMEvent* aEvent)
   if (eventType.EqualsLiteral("DOMMetaAdded")) {
     // This meta data may or may not have been a meta viewport tag. If it was,
     // we should handle it immediately.
-    HandlePossibleViewportChange(GetInnerSize());
+    HandlePossibleViewportChange(mInnerSize);
   } else if (eventType.EqualsLiteral("FullZoomChange")) {
-    HandlePossibleViewportChange(GetInnerSize());
+    HandlePossibleViewportChange(mInnerSize);
   }
 
   return NS_OK;
@@ -969,14 +966,14 @@ TabChild::Observe(nsISupports *aSubject,
 
         // In some cases before-first-paint gets called before
         // RecvUpdateDimensions is called and therefore before we have an
-        // inner size value set. In such cases defer initializing the viewport
+        // mInnerSize value set. In such cases defer initializing the viewport
         // until we we get an inner size.
         if (HasValidInnerSize()) {
           InitializeRootMetrics();
           if (shell) {
             nsLayoutUtils::SetResolutionAndScaleTo(shell, mLastRootMetrics.GetPresShellResolution());
           }
-          HandlePossibleViewportChange(GetInnerSize());
+          HandlePossibleViewportChange(mInnerSize);
         }
       }
     }
@@ -1316,18 +1313,17 @@ NS_IMETHODIMP
 TabChild::GetDimensions(uint32_t aFlags, int32_t* aX,
                              int32_t* aY, int32_t* aCx, int32_t* aCy)
 {
-  ScreenIntRect rect = GetOuterRect();
   if (aX) {
-    *aX = rect.x;
+    *aX = mOuterRect.x;
   }
   if (aY) {
-    *aY = rect.y;
+    *aY = mOuterRect.y;
   }
   if (aCx) {
-    *aCx = rect.width;
+    *aCx = mOuterRect.width;
   }
   if (aCy) {
-    *aCy = rect.height;
+    *aCy = mOuterRect.height;
   }
 
   return NS_OK;
@@ -2054,41 +2050,37 @@ TabChild::RecvShow(const ScreenIntSize& aSize,
 }
 
 bool
-TabChild::RecvUpdateDimensions(const CSSRect& rect, const CSSSize& size,
-                               const ScreenOrientation& orientation,
-                               const LayoutDeviceIntPoint& chromeDisp)
+TabChild::RecvUpdateDimensions(const nsIntRect& rect, const ScreenIntSize& size,
+                               const ScreenOrientation& orientation, const LayoutDeviceIntPoint& chromeDisp)
 {
     if (!mRemoteFrame) {
         return true;
     }
 
-    mUnscaledOuterRect = rect;
+    mOuterRect = rect;
     mChromeDisp = chromeDisp;
 
     bool initialSizing = !HasValidInnerSize()
                       && (size.width != 0 && size.height != 0);
-
-    mOrientation = orientation;
-    ScreenIntSize oldScreenSize = GetInnerSize();
-    SetUnscaledInnerSize(size);
-    ScreenIntSize screenSize = GetInnerSize();
     bool sizeChanged = true;
     if (initialSizing) {
       mHasValidInnerSize = true;
-    } else if (screenSize == oldScreenSize) {
+    } else if (mInnerSize == size) {
       sizeChanged = false;
     }
 
-    ScreenIntRect screenRect = GetOuterRect();
-    mWidget->Resize(screenRect.x + chromeDisp.x, screenRect.y + chromeDisp.y,
-                    screenSize.width, screenSize.height, true);
+    mOrientation = orientation;
+    ScreenIntSize oldScreenSize = mInnerSize;
+    mInnerSize = size;
+    mWidget->Resize(rect.x + chromeDisp.x, rect.y + chromeDisp.y, size.width, size.height,
+                     true);
 
     nsCOMPtr<nsIBaseWindow> baseWin = do_QueryInterface(WebNavigation());
-    baseWin->SetPositionAndSize(0, 0, screenSize.width, screenSize.height,
+    baseWin->SetPositionAndSize(0, 0, size.width, size.height,
                                 true);
 
     if (initialSizing && mContentDocumentIsDisplayed) {
-      // If this is the first time we're getting a valid inner size, and the
+      // If this is the first time we're getting a valid mInnerSize, and the
       // before-first-paint event has already been handled, then we need to set
       // up our default viewport here. See the corresponding call to
       // InitializeRootMetrics in the before-first-paint handler.
@@ -3252,7 +3244,6 @@ TabChild::RecvRequestNotifyAfterRemotePaint()
 bool
 TabChild::RecvUIResolutionChanged()
 {
-  ScreenIntSize oldScreenSize = GetInnerSize();
   mDPI = 0;
   mDefaultScale = 0;
   static_cast<PuppetWidget*>(mWidget.get())->ClearBackingScaleCache();
@@ -3261,21 +3252,9 @@ TabChild::RecvUIResolutionChanged()
   if (presShell) {
     nsRefPtr<nsPresContext> presContext = presShell->GetPresContext();
     if (presContext) {
-      presContext->UIResolutionChangedSync();
+      presContext->UIResolutionChanged();
     }
   }
-
-  ScreenIntSize screenSize = GetInnerSize();
-  if (mHasValidInnerSize && oldScreenSize != screenSize) {
-    ScreenIntRect screenRect = GetOuterRect();
-    mWidget->Resize(screenRect.x + mChromeDisp.x, screenRect.y + mChromeDisp.y,
-                    screenSize.width, screenSize.height, true);
-
-    nsCOMPtr<nsIBaseWindow> baseWin = do_QueryInterface(WebNavigation());
-    baseWin->SetPositionAndSize(0, 0, screenSize.width, screenSize.height,
-                                true);
-  }
-
   return true;
 }
 
@@ -3337,22 +3316,6 @@ TabChild::CreatePluginWidget(nsIWidget* aParent, nsIWidget** aOut)
   return rv;
 }
 
-ScreenIntSize
-TabChild::GetInnerSize()
-{
-  LayoutDeviceIntSize innerSize =
-    RoundedToInt(mUnscaledInnerSize * mWidget->GetDefaultScale());
-  return ViewAs<ScreenPixel>(innerSize, PixelCastJustification::LayoutDeviceIsScreenForTabDims);
-};
-
-ScreenIntRect
-TabChild::GetOuterRect()
-{
-  LayoutDeviceIntRect outerRect =
-    RoundedToInt(mUnscaledOuterRect * mWidget->GetDefaultScale());
-  return ViewAs<ScreenPixel>(outerRect, PixelCastJustification::LayoutDeviceIsScreenForTabDims);
-}
-
 TabChildGlobal::TabChildGlobal(TabChildBase* aTabChild)
 : mTabChild(aTabChild)
 {
diff --git a/dom/ipc/TabChild.h b/dom/ipc/TabChild.h
index d980c93b4581..38bc979302a0 100644
--- a/dom/ipc/TabChild.h
+++ b/dom/ipc/TabChild.h
@@ -189,8 +189,6 @@ public:
                                          const bool& aIsRoot,
                                          const mozilla::layers::ZoomConstraints& aConstraints) = 0;
 
-    virtual ScreenIntSize GetInnerSize() = 0;
-
 protected:
     virtual ~TabChildBase();
     CSSSize GetPageSize(nsCOMPtr<nsIDocument> aDocument, const CSSSize& aViewport);
@@ -224,6 +222,7 @@ protected:
     CSSSize mOldViewportSize;
     bool mContentDocumentIsDisplayed;
     nsRefPtr<TabChildGlobal> mTabChildGlobal;
+    ScreenIntSize mInnerSize;
     mozilla::layers::FrameMetrics mLastRootMetrics;
     nsCOMPtr<nsIWebBrowserChrome3> mWebBrowserChrome;
 };
@@ -320,8 +319,8 @@ public:
                           const uint64_t& aLayersId,
                           PRenderFrameChild* aRenderFrame,
                           const bool& aParentIsActive) override;
-    virtual bool RecvUpdateDimensions(const CSSRect& rect,
-                                      const CSSSize& size,
+    virtual bool RecvUpdateDimensions(const nsIntRect& rect,
+                                      const ScreenIntSize& size,
                                       const ScreenOrientation& orientation,
                                       const LayoutDeviceIntPoint& chromeDisp) override;
     virtual bool RecvUpdateFrame(const layers::FrameMetrics& aFrameMetrics) override;
@@ -511,8 +510,6 @@ public:
     }
     bool AsyncPanZoomEnabled() { return mAsyncPanZoomEnabled; }
 
-    virtual ScreenIntSize GetInnerSize() override;
-
 protected:
     virtual ~TabChild();
 
@@ -602,12 +599,6 @@ private:
 
     void SetTabId(const TabId& aTabId);
 
-    ScreenIntRect GetOuterRect();
-
-    void SetUnscaledInnerSize(const CSSSize& aSize) {
-      mUnscaledInnerSize = aSize;
-    }
-
     class CachedFileDescriptorInfo;
     class CachedFileDescriptorCallbackRunnable;
     class DelayedDeleteRunnable;
@@ -620,7 +611,7 @@ private:
     nsRefPtr<nsIContentChild> mManager;
     uint32_t mChromeFlags;
     uint64_t mLayersId;
-    CSSRect mUnscaledOuterRect;
+    nsIntRect mOuterRect;
     // When we're tracking a possible tap gesture, this is the "down"
     // point of the touchstart.
     LayoutDevicePoint mGestureDownPoint;
@@ -655,7 +646,6 @@ private:
     bool mIPCOpen;
     bool mParentIsActive;
     bool mAsyncPanZoomEnabled;
-    CSSSize mUnscaledInnerSize;
 
     DISALLOW_EVIL_CONSTRUCTORS(TabChild);
 };
diff --git a/dom/ipc/TabParent.cpp b/dom/ipc/TabParent.cpp
index 169e20814aec..8482d64d9764 100644
--- a/dom/ipc/TabParent.cpp
+++ b/dom/ipc/TabParent.cpp
@@ -90,7 +90,6 @@
 #include "nsPIWindowRoot.h"
 #include "gfxDrawable.h"
 #include "ImageOps.h"
-#include "UnitTransforms.h"
 #include <algorithm>
 
 using namespace mozilla::dom;
@@ -334,27 +333,9 @@ TabParent::SetOwnerElement(Element* aElement)
   // If we held previous content then unregister for its events.
   RemoveWindowListeners();
 
-  // If we change top-level documents then we need to change our
-  // registration with them.
-  nsRefPtr<nsPIWindowRoot> curTopLevelWin, newTopLevelWin;
-  if (mFrameElement) {
-    curTopLevelWin = nsContentUtils::GetWindowRoot(mFrameElement->OwnerDoc());
-  }
-  if (aElement) {
-    newTopLevelWin = nsContentUtils::GetWindowRoot(aElement->OwnerDoc());
-  }
-  bool isSameTopLevelWin = curTopLevelWin == newTopLevelWin;
-  if (curTopLevelWin && !isSameTopLevelWin) {
-    curTopLevelWin->RemoveBrowser(this);
-  }
-
   // Update to the new content, and register to listen for events from it.
   mFrameElement = aElement;
 
-  if (newTopLevelWin && !isSameTopLevelWin) {
-    newTopLevelWin->AddBrowser(this);
-  }
-
   AddWindowListeners();
   TryCacheDPIAndScale();
 }
@@ -985,21 +966,7 @@ TabParent::UpdateDimensions(const nsIntRect& rect, const ScreenIntSize& size)
     mOrientation = orientation;
     mChromeOffset = chromeOffset;
 
-    CSSToLayoutDeviceScale widgetScale;
-    if (widget) {
-      widgetScale = widget->GetDefaultScale();
-    }
-
-    LayoutDeviceIntRect devicePixelRect =
-      ViewAs<LayoutDevicePixel>(mRect,
-                                PixelCastJustification::LayoutDeviceIsScreenForTabDims);
-    LayoutDeviceIntSize devicePixelSize =
-      ViewAs<LayoutDevicePixel>(mDimensions.ToUnknownSize(),
-                                PixelCastJustification::LayoutDeviceIsScreenForTabDims);
-
-    CSSRect unscaledRect = devicePixelRect / widgetScale;
-    CSSSize unscaledSize = devicePixelSize / widgetScale;
-    unused << SendUpdateDimensions(unscaledRect, unscaledSize, orientation, chromeOffset);
+    unused << SendUpdateDimensions(mRect, mDimensions, mOrientation, mChromeOffset);
   }
 }
 
@@ -1018,7 +985,6 @@ TabParent::UIResolutionChanged()
     // TryCacheDPIAndScale()'s cache is keyed off of
     // mDPI being greater than 0, so this invalidates it.
     mDPI = -1;
-    TryCacheDPIAndScale();
     unused << SendUIResolutionChanged();
   }
 }
diff --git a/dom/ipc/TabParent.h b/dom/ipc/TabParent.h
index 5fe2fa0cd1f0..e4e2d90c2749 100644
--- a/dom/ipc/TabParent.h
+++ b/dom/ipc/TabParent.h
@@ -427,6 +427,7 @@ public:
 
     void TakeDragVisualization(RefPtr<mozilla::gfx::SourceSurface>& aSurface,
                                int32_t& aDragAreaX, int32_t& aDragAreaY);
+    layout::RenderFrameParent* GetRenderFrame();
 protected:
     bool ReceiveMessage(const nsString& aMessage,
                         bool aSync,
@@ -480,7 +481,6 @@ protected:
 
 private:
     already_AddRefed<nsFrameLoader> GetFrameLoader(bool aUseCachedFrameLoaderAfterDestroy = false) const;
-    layout::RenderFrameParent* GetRenderFrame();
     nsRefPtr<nsIContentParent> mManager;
     void TryCacheDPIAndScale();
 
diff --git a/dom/media/fmp4/MP4Demuxer.cpp b/dom/media/fmp4/MP4Demuxer.cpp
index db719d999b30..d9fe1c442fc6 100644
--- a/dom/media/fmp4/MP4Demuxer.cpp
+++ b/dom/media/fmp4/MP4Demuxer.cpp
@@ -158,7 +158,7 @@ MP4TrackDemuxer::MP4TrackDemuxer(MP4Demuxer* aParent,
 
   MOZ_ASSERT(mInfo);
 
-  nsTArray<mp4_demuxer::Index::Indice> indices;
+  FallibleTArray<mp4_demuxer::Index::Indice> indices;
   if (!mParent->mMetadata->ReadTrackIndex(indices, mInfo->mTrackId)) {
     MOZ_ASSERT(false);
   }
diff --git a/dom/media/test/manifest.js b/dom/media/test/manifest.js
index 2e36edc6cdf4..6e664cffac9a 100644
--- a/dom/media/test/manifest.js
+++ b/dom/media/test/manifest.js
@@ -228,7 +228,7 @@ var gPlayTests = [
   { name:"gizmo.mp4", type:"video/mp4", duration:5.56 },
   // Test playback of a MP4 file with a non-zero start time (and audio starting
   // a second later).
-  { name:"bipbop-lateaudio.mp4", type:"video/mp4", duration:2.401 },
+  { name:"bipbop-lateaudio.mp4", type:"video/mp4" },
 
   { name:"small-shot.m4a", type:"audio/mp4", duration:0.29 },
   { name:"small-shot.mp3", type:"audio/mpeg", duration:0.27 },
diff --git a/dom/media/webaudio/test/test_mediaElementAudioSourceNodeCrossOrigin.html b/dom/media/webaudio/test/test_mediaElementAudioSourceNodeCrossOrigin.html
index 7d5b4a206d59..5c00abe7a3eb 100644
--- a/dom/media/webaudio/test/test_mediaElementAudioSourceNodeCrossOrigin.html
+++ b/dom/media/webaudio/test/test_mediaElementAudioSourceNodeCrossOrigin.html
@@ -44,7 +44,7 @@ tests.forEach(function(e) {
   var measn = e.ac.createMediaElementSource(a);
   var sp = e.ac.createScriptProcessor(2048, 1);
   // Set a couple expandos to track the status of the test
-  sp.iterationsLeft = 200;
+  sp.iterationsLeft = 300;
   sp.seenSound = false;
 
   measn.connect(sp);
diff --git a/dom/plugins/ipc/PluginMessageUtils.h b/dom/plugins/ipc/PluginMessageUtils.h
index 2d5c23b9c4f0..af405365b064 100644
--- a/dom/plugins/ipc/PluginMessageUtils.h
+++ b/dom/plugins/ipc/PluginMessageUtils.h
@@ -200,7 +200,7 @@ inline bool IsPluginThread()
 
 inline void AssertPluginThread()
 {
-  NS_ASSERTION(IsPluginThread(), "Should be on the plugin's main thread!");
+  MOZ_RELEASE_ASSERT(IsPluginThread(), "Should be on the plugin's main thread!");
 }
 
 #define ENSURE_PLUGIN_THREAD(retval) \
diff --git a/dom/plugins/ipc/PluginModuleParent.cpp b/dom/plugins/ipc/PluginModuleParent.cpp
index d432781d7a2f..191f0ce08375 100755
--- a/dom/plugins/ipc/PluginModuleParent.cpp
+++ b/dom/plugins/ipc/PluginModuleParent.cpp
@@ -1822,7 +1822,7 @@ PluginModuleParent::StreamCast(NPP instance, NPStream* s,
 
     BrowserStreamParent* sp =
         static_cast<BrowserStreamParent*>(static_cast<AStream*>(s->pdata));
-    if (sp->mNPP != ip || s != sp->mStream) {
+    if (sp && (sp->mNPP != ip || s != sp->mStream)) {
         NS_RUNTIMEABORT("Corrupted plugin stream data.");
     }
     return sp;
diff --git a/dom/plugins/test/mochitest/test_instance_re-parent.html b/dom/plugins/test/mochitest/test_instance_re-parent.html
index a9198ac4da45..0c0561981b10 100644
--- a/dom/plugins/test/mochitest/test_instance_re-parent.html
+++ b/dom/plugins/test/mochitest/test_instance_re-parent.html
@@ -12,6 +12,8 @@
   SimpleTest.waitForExplicitFinish();
   setTestPluginEnabledState(SpecialPowers.Ci.nsIPluginTag.STATE_ENABLED);
 
+  const MAX_CHECK_PLUGIN_STOPPED_ATTEMPTS = 5;
+  var numCheckPluginStoppedAttempts = 0;
   var exceptionThrown = false;
   var p = null;
   var d1 = null;
@@ -38,6 +40,20 @@
     });
   }
 
+  function checkPluginStopped(callback, param) {
+    if (numCheckPluginStoppedAttempts < MAX_CHECK_PLUGIN_STOPPED_ATTEMPTS &&
+        !destroyed) {
+      ++numCheckPluginStoppedAttempts;
+      SimpleTest.executeSoon(function() {
+          checkPluginStopped(callback, param);
+      });
+    } else {
+      info("Number of check plugin stopped attempts: " +
+           numCheckPluginStoppedAttempts);
+      callback(param);
+    }
+  }
+
   function runTests(callback) {
     p = document.getElementById('plugin1');
     d1 = document.getElementById('div1');
@@ -71,22 +87,23 @@
       is(destroyed, false, "No instances should have been destroyed at this point.");
       is(p.getInstanceCount(), 0, "No new instances should have been created at this point.");
 
-      // Removing the instance for a full event loop *should* respawn
       d2.removeChild(p);
-      SimpleTest.executeSoon(function() {
-        d2.appendChild(p);
-        SimpleTest.executeSoon(function() {
-          try {
-            is(p.getInstanceCount(), 1, "One new instance should have been created at this point.");
-          } catch (e) {
-            exceptionThrown = true;
-          }
-          is(exceptionThrown, false, "Testing for exception getting instance count from plugin.");
+      checkPluginStopped(continueTestsAfterPluginDestruction, callback);
+    });
+  }
 
-          p.stopWatchingInstanceCount();
-          callback.apply(null);
-        });
-      });
+  function continueTestsAfterPluginDestruction(callback) {
+    d2.appendChild(p);
+    SimpleTest.executeSoon(function() {
+      try {
+        is(p.getInstanceCount(), 1, "One new instance should have been created at this point.");
+      } catch (e) {
+        exceptionThrown = true;
+      }
+      is(exceptionThrown, false, "Testing for exception getting instance count from plugin.");
+
+      p.stopWatchingInstanceCount();
+      callback.apply(null);
     });
   }
   </script>
diff --git a/dom/security/moz.build b/dom/security/moz.build
index b994949b79b7..5b3118558303 100644
--- a/dom/security/moz.build
+++ b/dom/security/moz.build
@@ -4,6 +4,8 @@
 # License, v. 2.0. If a copy of the MPL was not distributed with this
 # file, You can obtain one at http://mozilla.org/MPL/2.0/.
 
+TEST_DIRS += ['test']
+
 EXPORTS.mozilla.dom += [
     'nsCSPContext.h',
     'nsCSPService.h',
diff --git a/dom/base/test/TestCSPParser.cpp b/dom/security/test/TestCSPParser.cpp
similarity index 100%
rename from dom/base/test/TestCSPParser.cpp
rename to dom/security/test/TestCSPParser.cpp
diff --git a/dom/base/test/file_CrossSiteXHR_cache_server.sjs b/dom/security/test/cors/file_CrossSiteXHR_cache_server.sjs
similarity index 89%
rename from dom/base/test/file_CrossSiteXHR_cache_server.sjs
rename to dom/security/test/cors/file_CrossSiteXHR_cache_server.sjs
index 5da6bf663e2e..f56f512e1552 100644
--- a/dom/base/test/file_CrossSiteXHR_cache_server.sjs
+++ b/dom/security/test/cors/file_CrossSiteXHR_cache_server.sjs
@@ -7,7 +7,7 @@ function handleRequest(request, response)
   });
 
   if ("setState" in query) {
-    setState("test/dom/base/test_CrossSiteXHR_cache:secData",
+    setState("test/dom/security/test_CrossSiteXHR_cache:secData",
              query.setState);
 
     response.setHeader("Cache-Control", "no-cache", false);
@@ -22,7 +22,7 @@ function handleRequest(request, response)
   // Send response
 
   secData =
-    eval(getState("test/dom/base/test_CrossSiteXHR_cache:secData"));
+    eval(getState("test/dom/security/test_CrossSiteXHR_cache:secData"));
 
   if (secData.allowOrigin)
     response.setHeader("Access-Control-Allow-Origin", secData.allowOrigin);
diff --git a/dom/base/test/file_CrossSiteXHR_inner.html b/dom/security/test/cors/file_CrossSiteXHR_inner.html
similarity index 100%
rename from dom/base/test/file_CrossSiteXHR_inner.html
rename to dom/security/test/cors/file_CrossSiteXHR_inner.html
diff --git a/dom/base/test/file_CrossSiteXHR_inner.jar b/dom/security/test/cors/file_CrossSiteXHR_inner.jar
similarity index 100%
rename from dom/base/test/file_CrossSiteXHR_inner.jar
rename to dom/security/test/cors/file_CrossSiteXHR_inner.jar
diff --git a/dom/base/test/file_CrossSiteXHR_inner_data.sjs b/dom/security/test/cors/file_CrossSiteXHR_inner_data.sjs
similarity index 100%
rename from dom/base/test/file_CrossSiteXHR_inner_data.sjs
rename to dom/security/test/cors/file_CrossSiteXHR_inner_data.sjs
diff --git a/dom/base/test/file_CrossSiteXHR_server.sjs b/dom/security/test/cors/file_CrossSiteXHR_server.sjs
similarity index 98%
rename from dom/base/test/file_CrossSiteXHR_server.sjs
rename to dom/security/test/cors/file_CrossSiteXHR_server.sjs
index cbf042040e8a..a2b7cafb3355 100644
--- a/dom/base/test/file_CrossSiteXHR_server.sjs
+++ b/dom/security/test/cors/file_CrossSiteXHR_server.sjs
@@ -138,7 +138,7 @@ function handleRequest(request, response)
 
   if (query.hop && query.hop < hops.length) {
     newURL = hops[query.hop].server +
-             "/tests/dom/base/test/file_CrossSiteXHR_server.sjs?" +
+             "/tests/dom/security/test/cors/file_CrossSiteXHR_server.sjs?" +
              "hop=" + (query.hop + 1) + "&hops=" + query.hops;
     response.setStatusLine(null, 307, "redirect");
     response.setHeader("Location", newURL);
diff --git a/dom/security/test/cors/mochitest.ini b/dom/security/test/cors/mochitest.ini
new file mode 100644
index 000000000000..0dbba8be5202
--- /dev/null
+++ b/dom/security/test/cors/mochitest.ini
@@ -0,0 +1,12 @@
+[DEFAULT]
+support-files =
+  file_CrossSiteXHR_cache_server.sjs
+  file_CrossSiteXHR_inner.html
+  file_CrossSiteXHR_inner.jar
+  file_CrossSiteXHR_inner_data.sjs
+  file_CrossSiteXHR_server.sjs
+
+[test_CrossSiteXHR.html]
+[test_CrossSiteXHR_cache.html]
+[test_CrossSiteXHR_origin.html]
+skip-if = buildapp == 'b2g' || e10s # last test fails to trigger onload on e10s/b2g
diff --git a/dom/base/test/test_CrossSiteXHR.html b/dom/security/test/cors/test_CrossSiteXHR.html
similarity index 99%
rename from dom/base/test/test_CrossSiteXHR.html
rename to dom/security/test/cors/test_CrossSiteXHR.html
index d80d078f984e..fe7bfcfbe6d2 100644
--- a/dom/base/test/test_CrossSiteXHR.html
+++ b/dom/security/test/cors/test_CrossSiteXHR.html
@@ -44,11 +44,11 @@ function runTest() {
   loader.onload = function () { gen.next() };
 
   // Test preflight-less requests
-  basePath = "/tests/dom/base/test/file_CrossSiteXHR_server.sjs?"
+  basePath = "/tests/dom/security/test/cors/file_CrossSiteXHR_server.sjs?"
   baseURL = "http://mochi.test:8888" + basePath;
 
   // Test preflighted requests
-  loader.src = "http://example.org/tests/dom/base/test/file_CrossSiteXHR_inner.html";
+  loader.src = "http://example.org/tests/dom/security/test/cors/file_CrossSiteXHR_inner.html";
   origin = "http://example.org";
   yield undefined;
 
@@ -874,7 +874,7 @@ function runTest() {
 
 
   // Test redirects
-  is(loader.src, "http://example.org/tests/dom/base/test/file_CrossSiteXHR_inner.html");
+  is(loader.src, "http://example.org/tests/dom/security/test/cors/file_CrossSiteXHR_inner.html");
   is(origin, "http://example.org");
 
   tests = [{ pass: 1,
diff --git a/dom/base/test/test_CrossSiteXHR_cache.html b/dom/security/test/cors/test_CrossSiteXHR_cache.html
similarity index 98%
rename from dom/base/test/test_CrossSiteXHR_cache.html
rename to dom/security/test/cors/test_CrossSiteXHR_cache.html
index 77371044f324..bcd74b9d904f 100644
--- a/dom/base/test/test_CrossSiteXHR_cache.html
+++ b/dom/security/test/cors/test_CrossSiteXHR_cache.html
@@ -30,7 +30,7 @@ function runTest() {
   var loaderWindow = loader.contentWindow;
   loader.onload = function () { gen.next() };
 
-  loader.src = "http://example.org/tests/dom/base/test/file_CrossSiteXHR_inner.html";
+  loader.src = "http://example.org/tests/dom/security/test/cors/file_CrossSiteXHR_inner.html";
   origin = "http://example.org";
   yield undefined;
 
@@ -428,7 +428,7 @@ function runTest() {
                });
   }
 
-  baseURL = "http://mochi.test:8888/tests/dom/base/test/" +
+  baseURL = "http://mochi.test:8888/tests/dom/security/test/cors/" +
              "file_CrossSiteXHR_cache_server.sjs?";
   setStateURL = baseURL + "setState=";
 
diff --git a/dom/base/test/test_CrossSiteXHR_origin.html b/dom/security/test/cors/test_CrossSiteXHR_origin.html
similarity index 92%
rename from dom/base/test/test_CrossSiteXHR_origin.html
rename to dom/security/test/cors/test_CrossSiteXHR_origin.html
index 09fd81502b2a..95fe7f21c42f 100644
--- a/dom/base/test/test_CrossSiteXHR_origin.html
+++ b/dom/security/test/cors/test_CrossSiteXHR_origin.html
@@ -39,10 +39,10 @@ var origins =
      origin: 'http://xn--hxajbheg2az3al.xn--jxalpdlp'
    },
    { origin: 'http://example.org',
-     file: 'jar:http://example.org/tests/dom/base/test/file_CrossSiteXHR_inner.jar!/file_CrossSiteXHR_inner.html'
+     file: 'jar:http://example.org/tests/dom/security/test/cors/file_CrossSiteXHR_inner.jar!/file_CrossSiteXHR_inner.html'
    },
    { origin: 'null',
-     file: 'http://example.org/tests/dom/base/test/file_CrossSiteXHR_inner_data.sjs'
+     file: 'http://example.org/tests/dom/security/test/cors/file_CrossSiteXHR_inner_data.sjs'
    },
    ];
 
@@ -61,14 +61,14 @@ function runTest() {
   loader.onload = function () { gen.next() };
 
   // Test preflight-less requests
-  basePath = "/tests/dom/base/test/file_CrossSiteXHR_server.sjs?"
+  basePath = "/tests/dom/security/test/cors/file_CrossSiteXHR_server.sjs?"
   baseURL = "http://mochi.test:8888" + basePath;
 
   for (originEntry of origins) {
     origin = originEntry.origin || originEntry.server;
 
     loader.src = originEntry.file ||
-                 (originEntry.server + "/tests/dom/base/test/file_CrossSiteXHR_inner.html");
+                 (originEntry.server + "/tests/dom/security/test/cors/file_CrossSiteXHR_inner.html");
     yield undefined;
 
     var isNullOrigin = origin == "null";
diff --git a/dom/base/test/csp/browser.ini b/dom/security/test/csp/browser.ini
similarity index 100%
rename from dom/base/test/csp/browser.ini
rename to dom/security/test/csp/browser.ini
diff --git a/dom/base/test/csp/browser_test_web_manifest.js b/dom/security/test/csp/browser_test_web_manifest.js
similarity index 95%
rename from dom/base/test/csp/browser_test_web_manifest.js
rename to dom/security/test/csp/browser_test_web_manifest.js
index ca12d60ad877..118f6fa28fc6 100644
--- a/dom/base/test/csp/browser_test_web_manifest.js
+++ b/dom/security/test/csp/browser_test_web_manifest.js
@@ -11,12 +11,12 @@ requestLongerTimeout(10); // e10s tests take time.
 const {
   ManifestObtainer
 } = Components.utils.import('resource://gre/modules/WebManifest.jsm', {});
-const path = '/tests/dom/base/test/csp/';
-const testFile = `file=${path}file_CSP_web_manifest.html`;
-const remoteFile = `file=${path}file_CSP_web_manifest_remote.html`;
-const httpsManifest = `file=${path}file_CSP_web_manifest_https.html`;
-const mixedContent = `file=${path}file_CSP_web_manifest_mixed_content.html`;
-const server = 'file_csp_testserver.sjs';
+const path = '/tests/dom/security/test/csp/';
+const testFile = `file=${path}file_web_manifest.html`;
+const remoteFile = `file=${path}file_web_manifest_remote.html`;
+const httpsManifest = `file=${path}file_web_manifest_https.html`;
+const mixedContent = `file=${path}file_web_manifest_mixed_content.html`;
+const server = 'file_testserver.sjs';
 const defaultURL = `http://example.org${path}${server}`;
 const remoteURL = `http://mochi.test:8888`;
 const secureURL = `https://example.com${path}${server}`;
diff --git a/dom/base/test/csp/browser_test_web_manifest_mixed_content.js b/dom/security/test/csp/browser_test_web_manifest_mixed_content.js
similarity index 83%
rename from dom/base/test/csp/browser_test_web_manifest_mixed_content.js
rename to dom/security/test/csp/browser_test_web_manifest_mixed_content.js
index c4f3b738b162..b7d1b7b68807 100644
--- a/dom/base/test/csp/browser_test_web_manifest_mixed_content.js
+++ b/dom/security/test/csp/browser_test_web_manifest_mixed_content.js
@@ -7,12 +7,12 @@
 const {
   ManifestObtainer
 } = Components.utils.import('resource://gre/modules/WebManifest.jsm', {});
-const path = '/tests/dom/base/test/csp/';
-const mixedContent = `file=${path}file_CSP_web_manifest_mixed_content.html`;
-const server = 'file_csp_testserver.sjs';
+const path = '/tests/dom/security/test/csp/';
+const mixedContent = `file=${path}file_web_manifest_mixed_content.html`;
+const server = 'file_testserver.sjs';
 const secureURL = `https://example.com${path}${server}`;
 const tests = [
-  // Trying to load mixed content in file_CSP_web_manifest_mixed_content.html
+  // Trying to load mixed content in file_web_manifest_mixed_content.html
   // needs to result in an error.
   {
     expected: `Mixed Content Blocker prevents fetching manifest.`,
diff --git a/dom/security/test/csp/chrome.ini b/dom/security/test/csp/chrome.ini
new file mode 100644
index 000000000000..92862ebd6b7b
--- /dev/null
+++ b/dom/security/test/csp/chrome.ini
@@ -0,0 +1,5 @@
+[DEFAULT]
+skip-if = buildapp == 'b2g'
+
+[test_bug768029.html]
+[test_bug773891.html]
diff --git a/dom/base/test/csp/file_CSP.css b/dom/security/test/csp/file_CSP.css
similarity index 82%
rename from dom/base/test/csp/file_CSP.css
rename to dom/security/test/csp/file_CSP.css
index 35fcd6f5fd1c..6835c4d4ad7b 100644
--- a/dom/base/test/csp/file_CSP.css
+++ b/dom/security/test/csp/file_CSP.css
@@ -12,7 +12,7 @@
 }
 @font-face {
   font-family: "arbitrary_bad";
-  src: url('http://example.org/tests/dom/base/test/csp/file_CSP.sjs?testid=font_bad&type=application/octet-stream');
+  src: url('http://example.org/tests/dom/security/test/csp/file_CSP.sjs?testid=font_bad&type=application/octet-stream');
 }
 
 .div_arbitrary_good { font-family: "arbitrary_good"; }
diff --git a/dom/base/test/csp/file_CSP.sjs b/dom/security/test/csp/file_CSP.sjs
similarity index 100%
rename from dom/base/test/csp/file_CSP.sjs
rename to dom/security/test/csp/file_CSP.sjs
diff --git a/dom/security/test/csp/file_allow_https_schemes.html b/dom/security/test/csp/file_allow_https_schemes.html
new file mode 100644
index 000000000000..787e683e873e
--- /dev/null
+++ b/dom/security/test/csp/file_allow_https_schemes.html
@@ -0,0 +1,14 @@
+<!DOCTYPE HTML>
+<html>
+  <head>
+    <title>Bug 826805 - CSP: Allow http and https for scheme-less sources</title>
+  </head>
+  <body>
+  <div id="testdiv">blocked</div>
+  <!--
+    We resue file_path_matching.js which just updates the contents of 'testdiv' to contain allowed.
+    Note, that we are loading the file_path_matchting.js using a scheme of 'https'.
+   -->
+  <script src="https://example.com/tests/dom/security/test/csp/file_path_matching.js#foo"></script>
+</body>
+</html>
diff --git a/dom/base/test/csp/file_base-uri.html b/dom/security/test/csp/file_base-uri.html
similarity index 100%
rename from dom/base/test/csp/file_base-uri.html
rename to dom/security/test/csp/file_base-uri.html
diff --git a/dom/base/test/csp/file_blob_data_schemes.html b/dom/security/test/csp/file_blob_data_schemes.html
similarity index 100%
rename from dom/base/test/csp/file_blob_data_schemes.html
rename to dom/security/test/csp/file_blob_data_schemes.html
diff --git a/dom/base/test/csp/file_CSP_bug663567.xsl b/dom/security/test/csp/file_bug663567.xsl
similarity index 100%
rename from dom/base/test/csp/file_CSP_bug663567.xsl
rename to dom/security/test/csp/file_bug663567.xsl
diff --git a/dom/base/test/csp/file_CSP_bug663567_allows.xml b/dom/security/test/csp/file_bug663567_allows.xml
similarity index 86%
rename from dom/base/test/csp/file_CSP_bug663567_allows.xml
rename to dom/security/test/csp/file_bug663567_allows.xml
index 8abeb471271a..93d34510383e 100644
--- a/dom/base/test/csp/file_CSP_bug663567_allows.xml
+++ b/dom/security/test/csp/file_bug663567_allows.xml
@@ -1,5 +1,5 @@
 <?xml version="1.0" encoding="ISO-8859-1"?>
-<?xml-stylesheet type="text/xsl" href="file_CSP_bug663567.xsl"?>
+<?xml-stylesheet type="text/xsl" href="file_bug663567.xsl"?>
 <catalog>
 	<cd>
 		<title>Empire Burlesque</title>
diff --git a/dom/base/test/csp/file_CSP_bug663567_allows.xml^headers^ b/dom/security/test/csp/file_bug663567_allows.xml^headers^
similarity index 100%
rename from dom/base/test/csp/file_CSP_bug663567_allows.xml^headers^
rename to dom/security/test/csp/file_bug663567_allows.xml^headers^
diff --git a/dom/base/test/csp/file_CSP_bug663567_blocks.xml b/dom/security/test/csp/file_bug663567_blocks.xml
similarity index 86%
rename from dom/base/test/csp/file_CSP_bug663567_blocks.xml
rename to dom/security/test/csp/file_bug663567_blocks.xml
index 8abeb471271a..93d34510383e 100644
--- a/dom/base/test/csp/file_CSP_bug663567_blocks.xml
+++ b/dom/security/test/csp/file_bug663567_blocks.xml
@@ -1,5 +1,5 @@
 <?xml version="1.0" encoding="ISO-8859-1"?>
-<?xml-stylesheet type="text/xsl" href="file_CSP_bug663567.xsl"?>
+<?xml-stylesheet type="text/xsl" href="file_bug663567.xsl"?>
 <catalog>
 	<cd>
 		<title>Empire Burlesque</title>
diff --git a/dom/base/test/csp/file_CSP_bug663567_blocks.xml^headers^ b/dom/security/test/csp/file_bug663567_blocks.xml^headers^
similarity index 100%
rename from dom/base/test/csp/file_CSP_bug663567_blocks.xml^headers^
rename to dom/security/test/csp/file_bug663567_blocks.xml^headers^
diff --git a/dom/security/test/csp/file_bug768029.html b/dom/security/test/csp/file_bug768029.html
new file mode 100644
index 000000000000..b349d73ee15d
--- /dev/null
+++ b/dom/security/test/csp/file_bug768029.html
@@ -0,0 +1,25 @@
+<!DOCTYPE HTML>
+<html>
+<!--
+  https://bugzilla.mozilla.org/show_bug.cgi?id=768029
+-->
+<head>
+  <meta charset="utf-8">
+    <title>This is an app for testing</title>
+
+    <link rel="stylesheet" type="text/css"
+          href="file_bug768029.sjs?type=style&origin=same_origin" />
+    <link rel="stylesheet" type="text/css"
+          href="http://example.com/tests/dom/security/test/csp/file_bug768029.sjs?type=style&origin=cross_origin" />
+  </head>
+  <body>
+
+    <script src="file_bug768029.sjs?type=script&origin=same_origin"></script>
+    <script src="http://example.com/tests/dom/security/test/csp/file_bug768029.sjs?type=script&origin=cross_origin"></script>
+    <img src="file_bug768029.sjs?type=img&origin=same_origin" />
+    <img src="http://example.com/tests/dom/security/test/csp/file_bug768029.sjs?type=img&origin=cross_origin" />
+
+    Test for CSP applied to (simulated) app.
+
+  </body>
+</html>
diff --git a/dom/base/test/csp/file_csp_bug768029.sjs b/dom/security/test/csp/file_bug768029.sjs
similarity index 100%
rename from dom/base/test/csp/file_csp_bug768029.sjs
rename to dom/security/test/csp/file_bug768029.sjs
diff --git a/dom/security/test/csp/file_bug773891.html b/dom/security/test/csp/file_bug773891.html
new file mode 100644
index 000000000000..748169a20e4a
--- /dev/null
+++ b/dom/security/test/csp/file_bug773891.html
@@ -0,0 +1,25 @@
+<!DOCTYPE HTML>
+<html>
+<!--
+  https://bugzilla.mozilla.org/show_bug.cgi?id=773891
+-->
+<head>
+  <meta charset="utf-8">
+    <title>This is an app for csp testing</title>
+
+    <link rel="stylesheet" type="text/css"
+          href="file_bug773891.sjs?type=style&origin=same_origin" />
+    <link rel="stylesheet" type="text/css"
+          href="http://example.com/tests/dom/security/test/csp/file_bug773891.sjs?type=style&origin=cross_origin" />
+  </head>
+  <body>
+
+    <script src="file_bug773891.sjs?type=script&origin=same_origin"></script>
+    <script src="http://example.com/tests/dom/security/test/csp/file_bug773891.sjs?type=script&origin=cross_origin"></script>
+    <img src="file_bug773891.sjs?type=img&origin=same_origin" />
+    <img src="http://example.com/tests/dom/security/test/csp/file_bug773891.sjs?type=img&origin=cross_origin" />
+
+    Test for CSP applied to (simulated) app.
+
+  </body>
+</html>
diff --git a/dom/base/test/csp/file_csp_bug773891.sjs b/dom/security/test/csp/file_bug773891.sjs
similarity index 100%
rename from dom/base/test/csp/file_csp_bug773891.sjs
rename to dom/security/test/csp/file_bug773891.sjs
diff --git a/dom/base/test/csp/file_CSP_bug802872.html b/dom/security/test/csp/file_bug802872.html
similarity index 83%
rename from dom/base/test/csp/file_CSP_bug802872.html
rename to dom/security/test/csp/file_bug802872.html
index a163adcc484b..dc7129b0cfd1 100644
--- a/dom/base/test/csp/file_CSP_bug802872.html
+++ b/dom/security/test/csp/file_bug802872.html
@@ -7,6 +7,6 @@
   <link rel="stylesheet" type="text/css" href="/tests/SimpleTest/test.css" />
 </head>
 <body>
-  <script src='file_CSP_bug802872.js'></script>
+  <script src='file_bug802872.js'></script>
 </body>
 </html>
diff --git a/dom/base/test/csp/file_CSP_bug802872.html^headers^ b/dom/security/test/csp/file_bug802872.html^headers^
similarity index 100%
rename from dom/base/test/csp/file_CSP_bug802872.html^headers^
rename to dom/security/test/csp/file_bug802872.html^headers^
diff --git a/dom/base/test/csp/file_CSP_bug802872.js b/dom/security/test/csp/file_bug802872.js
similarity index 93%
rename from dom/base/test/csp/file_CSP_bug802872.js
rename to dom/security/test/csp/file_bug802872.js
index febea0c85578..5df8086cc7cc 100644
--- a/dom/base/test/csp/file_CSP_bug802872.js
+++ b/dom/security/test/csp/file_bug802872.js
@@ -8,7 +8,7 @@ function createAllowedEvent() {
    * Creates a new EventSource using 'http://mochi.test:8888'. Since all mochitests run on
    * 'http://mochi.test', a default-src of 'self' allows this request.
    */
-  var src_event = new EventSource("http://mochi.test:8888/tests/dom/base/test/csp/file_CSP_bug802872.sjs");
+  var src_event = new EventSource("http://mochi.test:8888/tests/dom/security/test/csp/file_bug802872.sjs");
 
   src_event.onmessage = function(e) {
     src_event.close();
@@ -26,7 +26,7 @@ function createBlockedEvent() {
    * creates a new EventSource using 'http://example.com'. This domain is not whitelisted by the 
    * CSP of this page, therefore the CSP blocks this request.
    */
-  var src_event = new EventSource("http://example.com/tests/dom/base/test/csp/file_CSP_bug802872.sjs");
+  var src_event = new EventSource("http://example.com/tests/dom/security/test/csp/file_bug802872.sjs");
 
   src_event.onmessage = function(e) {
     src_event.close();
diff --git a/dom/base/test/csp/file_CSP_bug802872.sjs b/dom/security/test/csp/file_bug802872.sjs
similarity index 100%
rename from dom/base/test/csp/file_CSP_bug802872.sjs
rename to dom/security/test/csp/file_bug802872.sjs
diff --git a/dom/security/test/csp/file_bug836922_npolicies.html b/dom/security/test/csp/file_bug836922_npolicies.html
new file mode 100644
index 000000000000..bbb75b1606e2
--- /dev/null
+++ b/dom/security/test/csp/file_bug836922_npolicies.html
@@ -0,0 +1,15 @@
+<html>
+  <head>
+    <link rel='stylesheet' type='text/css'
+          href='/tests/dom/security/test/csp/file_CSP.sjs?testid=css_self&type=text/css' />
+    <link rel='stylesheet' type='text/css'
+          href='http://example.com/tests/dom/security/test/csp/file_CSP.sjs?testid=css_examplecom&type=text/css' />
+
+  </head>
+  <body>
+    <img src="/tests/dom/security/test/csp/file_CSP.sjs?testid=img_self&type=img/png"> </img>
+    <img src="http://example.com/tests/dom/security/test/csp/file_CSP.sjs?testid=img_examplecom&type=img/png"> </img>
+    <script src='/tests/dom/security/test/csp/file_CSP.sjs?testid=script_self&type=text/javascript'></script>
+
+  </body>
+</html>
diff --git a/dom/base/test/csp/file_bug836922_npolicies.html^headers^ b/dom/security/test/csp/file_bug836922_npolicies.html^headers^
similarity index 54%
rename from dom/base/test/csp/file_bug836922_npolicies.html^headers^
rename to dom/security/test/csp/file_bug836922_npolicies.html^headers^
index ecff5ff50d76..ec6ba8c4aeaa 100644
--- a/dom/base/test/csp/file_bug836922_npolicies.html^headers^
+++ b/dom/security/test/csp/file_bug836922_npolicies.html^headers^
@@ -1,2 +1,2 @@
-content-security-policy: default-src 'self'; img-src 'none'; report-uri http://mochi.test:8888/tests/dom/base/test/csp/file_bug836922_npolicies_violation.sjs
-content-security-policy-report-only: default-src *; img-src 'self'; script-src 'none'; report-uri http://mochi.test:8888/tests/dom/base/test/csp/file_bug836922_npolicies_ro_violation.sjs
+content-security-policy: default-src 'self'; img-src 'none'; report-uri http://mochi.test:8888/tests/dom/security/test/csp/file_bug836922_npolicies_violation.sjs
+content-security-policy-report-only: default-src *; img-src 'self'; script-src 'none'; report-uri http://mochi.test:8888/tests/dom/security/test/csp/file_bug836922_npolicies_ro_violation.sjs
diff --git a/dom/base/test/csp/file_bug836922_npolicies_ro_violation.sjs b/dom/security/test/csp/file_bug836922_npolicies_ro_violation.sjs
similarity index 100%
rename from dom/base/test/csp/file_bug836922_npolicies_ro_violation.sjs
rename to dom/security/test/csp/file_bug836922_npolicies_ro_violation.sjs
diff --git a/dom/base/test/csp/file_bug836922_npolicies_violation.sjs b/dom/security/test/csp/file_bug836922_npolicies_violation.sjs
similarity index 100%
rename from dom/base/test/csp/file_bug836922_npolicies_violation.sjs
rename to dom/security/test/csp/file_bug836922_npolicies_violation.sjs
diff --git a/dom/base/test/csp/file_CSP_bug885433_allows.html b/dom/security/test/csp/file_bug885433_allows.html
similarity index 100%
rename from dom/base/test/csp/file_CSP_bug885433_allows.html
rename to dom/security/test/csp/file_bug885433_allows.html
diff --git a/dom/base/test/csp/file_CSP_bug885433_allows.html^headers^ b/dom/security/test/csp/file_bug885433_allows.html^headers^
similarity index 100%
rename from dom/base/test/csp/file_CSP_bug885433_allows.html^headers^
rename to dom/security/test/csp/file_bug885433_allows.html^headers^
diff --git a/dom/base/test/csp/file_CSP_bug885433_blocks.html b/dom/security/test/csp/file_bug885433_blocks.html
similarity index 100%
rename from dom/base/test/csp/file_CSP_bug885433_blocks.html
rename to dom/security/test/csp/file_bug885433_blocks.html
diff --git a/dom/base/test/csp/file_CSP_bug885433_blocks.html^headers^ b/dom/security/test/csp/file_bug885433_blocks.html^headers^
similarity index 100%
rename from dom/base/test/csp/file_CSP_bug885433_blocks.html^headers^
rename to dom/security/test/csp/file_bug885433_blocks.html^headers^
diff --git a/dom/security/test/csp/file_bug886164.html b/dom/security/test/csp/file_bug886164.html
new file mode 100644
index 000000000000..ec8c9e7e92de
--- /dev/null
+++ b/dom/security/test/csp/file_bug886164.html
@@ -0,0 +1,15 @@
+<html>
+<head> <meta charset="utf-8"> </head>
+  <body>
+    <!-- sandbox="allow-same-origin" -->
+    <!-- Content-Security-Policy: default-src 'self' -->
+
+    <!-- these should be stopped by CSP -->
+    <img src="http://example.org/tests/dom/security/test/csp/file_CSP.sjs?testid=img_bad&type=img/png"> </img>
+
+    <!-- these should load ok -->
+    <img src="/tests/dom/security/test/csp/file_CSP.sjs?testid=img_good&type=img/png" />
+    <script src='/tests/dom/security/test/csp/file_CSP.sjs?testid=scripta_bad&type=text/javascript'></script>
+
+  </body>
+</html>
diff --git a/dom/base/test/csp/file_bug886164.html^headers^ b/dom/security/test/csp/file_bug886164.html^headers^
similarity index 100%
rename from dom/base/test/csp/file_bug886164.html^headers^
rename to dom/security/test/csp/file_bug886164.html^headers^
diff --git a/dom/base/test/csp/file_bug886164_2.html b/dom/security/test/csp/file_bug886164_2.html
similarity index 53%
rename from dom/base/test/csp/file_bug886164_2.html
rename to dom/security/test/csp/file_bug886164_2.html
index c94dac814413..83d36c55ae9f 100644
--- a/dom/base/test/csp/file_bug886164_2.html
+++ b/dom/security/test/csp/file_bug886164_2.html
@@ -5,10 +5,10 @@
     <!-- Content-Security-Policy: default-src 'self' -->
 
     <!-- these should be stopped by CSP -->
-    <img src="http://example.org/tests/dom/base/test/csp/file_CSP.sjs?testid=img2_bad&type=img/png"> </img>
+    <img src="http://example.org/tests/dom/security/test/csp/file_CSP.sjs?testid=img2_bad&type=img/png"> </img>
 
     <!-- these should load ok -->
-    <img src="/tests/dom/base/test/csp/file_CSP.sjs?testid=img2a_good&type=img/png" />
+    <img src="/tests/dom/security/test/csp/file_CSP.sjs?testid=img2a_good&type=img/png" />
 
   </body>
 </html>
diff --git a/dom/base/test/csp/file_bug886164_2.html^headers^ b/dom/security/test/csp/file_bug886164_2.html^headers^
similarity index 100%
rename from dom/base/test/csp/file_bug886164_2.html^headers^
rename to dom/security/test/csp/file_bug886164_2.html^headers^
diff --git a/dom/security/test/csp/file_bug886164_3.html b/dom/security/test/csp/file_bug886164_3.html
new file mode 100644
index 000000000000..8b4313000f69
--- /dev/null
+++ b/dom/security/test/csp/file_bug886164_3.html
@@ -0,0 +1,12 @@
+<html>
+<head> <meta charset="utf-8"> </head>
+  <body>
+    <!-- sandbox -->
+    <!-- Content-Security-Policy: default-src 'none' -->
+
+    <!-- these should be stopped by CSP -->
+    <img src="http://example.org/tests/dom/security/test/csp/file_CSP.sjs?testid=img3_bad&type=img/png"> </img>
+    <img src="/tests/dom/security/test/csp/file_CSP.sjs?testid=img3a_bad&type=img/png" />
+
+  </body>
+</html>
diff --git a/dom/base/test/csp/file_bug886164_3.html^headers^ b/dom/security/test/csp/file_bug886164_3.html^headers^
similarity index 100%
rename from dom/base/test/csp/file_bug886164_3.html^headers^
rename to dom/security/test/csp/file_bug886164_3.html^headers^
diff --git a/dom/security/test/csp/file_bug886164_4.html b/dom/security/test/csp/file_bug886164_4.html
new file mode 100644
index 000000000000..41137ea01754
--- /dev/null
+++ b/dom/security/test/csp/file_bug886164_4.html
@@ -0,0 +1,12 @@
+<html>
+<head> <meta charset="utf-8"> </head>
+  <body>
+    <!-- sandbox -->
+    <!-- Content-Security-Policy: default-src 'none' -->
+
+    <!-- these should be stopped by CSP -->
+    <img src="http://example.org/tests/dom/security/test/csp/file_CSP.sjs?testid=img4_bad&type=img/png"> </img>
+    <img src="/tests/dom/security/test/csp/file_CSP.sjs?testid=img4a_bad&type=img/png" />
+
+  </body>
+</html>
diff --git a/dom/base/test/csp/file_bug886164_4.html^headers^ b/dom/security/test/csp/file_bug886164_4.html^headers^
similarity index 100%
rename from dom/base/test/csp/file_bug886164_4.html^headers^
rename to dom/security/test/csp/file_bug886164_4.html^headers^
diff --git a/dom/base/test/csp/file_bug886164_5.html b/dom/security/test/csp/file_bug886164_5.html
similarity index 62%
rename from dom/base/test/csp/file_bug886164_5.html
rename to dom/security/test/csp/file_bug886164_5.html
index daa535e57937..ae65171a5f63 100644
--- a/dom/base/test/csp/file_bug886164_5.html
+++ b/dom/security/test/csp/file_bug886164_5.html
@@ -18,9 +18,9 @@
  <!-- Content-Security-Policy: default-src 'none' 'unsafe-inline'-->
 
  <!-- these should be stopped by CSP -->
- <img src="/tests/dom/base/test/csp/file_CSP.sjs?testid=img5_bad&type=img/png" />
- <img src="http://example.org/tests/dom/base/test/csp/file_CSP.sjs?testid=img5a_bad&type=img/png"> </img>
- <script src='/tests/dom/base/test/csp/file_CSP.sjs?testid=script5_bad&type=text/javascript'></script>
- <script src='http://example.org/tests/dom/base/test/csp/file_CSP.sjs?testid=script5a_bad&type=text/javascript'></script>
+ <img src="/tests/dom/security/test/csp/file_CSP.sjs?testid=img5_bad&type=img/png" />
+ <img src="http://example.org/tests/dom/security/test/csp/file_CSP.sjs?testid=img5a_bad&type=img/png"> </img>
+ <script src='/tests/dom/security/test/csp/file_CSP.sjs?testid=script5_bad&type=text/javascript'></script>
+ <script src='http://example.org/tests/dom/security/test/csp/file_CSP.sjs?testid=script5a_bad&type=text/javascript'></script>
 </body>
 </html>
diff --git a/dom/base/test/csp/file_bug886164_5.html^headers^ b/dom/security/test/csp/file_bug886164_5.html^headers^
similarity index 100%
rename from dom/base/test/csp/file_bug886164_5.html^headers^
rename to dom/security/test/csp/file_bug886164_5.html^headers^
diff --git a/dom/base/test/csp/file_bug886164_6.html b/dom/security/test/csp/file_bug886164_6.html
similarity index 83%
rename from dom/base/test/csp/file_bug886164_6.html
rename to dom/security/test/csp/file_bug886164_6.html
index 9b1d18a9e19c..f985ec8ce69d 100644
--- a/dom/base/test/csp/file_bug886164_6.html
+++ b/dom/security/test/csp/file_bug886164_6.html
@@ -21,8 +21,8 @@
 <script src='file_iframe_sandbox_pass.js'></script>
 <body onLoad='ok(true, "documents sandboxed with allow-scripts should be able to run script from event listeners");doStuff();'>
   I am sandboxed but with "allow-scripts"
-  <img src="http://example.org/tests/dom/base/test/csp/file_CSP.sjs?testid=img6_bad&type=img/png"> </img>
-  <script src='http://example.org/tests/dom/base/test/csp/file_CSP.sjs?testid=script6_bad&type=text/javascript'></script>
+  <img src="http://example.org/tests/dom/security/test/csp/file_CSP.sjs?testid=img6_bad&type=img/png"> </img>
+  <script src='http://example.org/tests/dom/security/test/csp/file_CSP.sjs?testid=script6_bad&type=text/javascript'></script>
 
   <form method="get" action="file_iframe_sandbox_form_fail.html" id="a_form">
     First name: <input type="text" name="firstname">
diff --git a/dom/base/test/csp/file_bug886164_6.html^headers^ b/dom/security/test/csp/file_bug886164_6.html^headers^
similarity index 100%
rename from dom/base/test/csp/file_bug886164_6.html^headers^
rename to dom/security/test/csp/file_bug886164_6.html^headers^
diff --git a/dom/base/test/csp/file_CSP_bug888172.html b/dom/security/test/csp/file_bug888172.html
similarity index 100%
rename from dom/base/test/csp/file_CSP_bug888172.html
rename to dom/security/test/csp/file_bug888172.html
diff --git a/dom/base/test/csp/file_CSP_bug888172.sjs b/dom/security/test/csp/file_bug888172.sjs
similarity index 94%
rename from dom/base/test/csp/file_CSP_bug888172.sjs
rename to dom/security/test/csp/file_bug888172.sjs
index 7427f415b7c8..03309610f76a 100644
--- a/dom/base/test/csp/file_CSP_bug888172.sjs
+++ b/dom/security/test/csp/file_bug888172.sjs
@@ -39,5 +39,5 @@ function handleRequest(request, response)
 
   // Send HTML to test allowed/blocked behaviors
   response.setHeader("Content-Type", "text/html", false);
-  response.write(loadHTMLFromFile("tests/dom/base/test/csp/file_CSP_bug888172.html"));
+  response.write(loadHTMLFromFile("tests/dom/security/test/csp/file_bug888172.html"));
 }
diff --git a/dom/base/test/csp/file_CSP_bug909029_none.html b/dom/security/test/csp/file_bug909029_none.html
similarity index 100%
rename from dom/base/test/csp/file_CSP_bug909029_none.html
rename to dom/security/test/csp/file_bug909029_none.html
diff --git a/dom/base/test/csp/file_CSP_bug909029_none.html^headers^ b/dom/security/test/csp/file_bug909029_none.html^headers^
similarity index 100%
rename from dom/base/test/csp/file_CSP_bug909029_none.html^headers^
rename to dom/security/test/csp/file_bug909029_none.html^headers^
diff --git a/dom/base/test/csp/file_CSP_bug909029_star.html b/dom/security/test/csp/file_bug909029_star.html
similarity index 100%
rename from dom/base/test/csp/file_CSP_bug909029_star.html
rename to dom/security/test/csp/file_bug909029_star.html
diff --git a/dom/base/test/csp/file_CSP_bug909029_star.html^headers^ b/dom/security/test/csp/file_bug909029_star.html^headers^
similarity index 100%
rename from dom/base/test/csp/file_CSP_bug909029_star.html^headers^
rename to dom/security/test/csp/file_bug909029_star.html^headers^
diff --git a/dom/base/test/csp/file_CSP_bug910139.sjs b/dom/security/test/csp/file_bug910139.sjs
similarity index 89%
rename from dom/base/test/csp/file_CSP_bug910139.sjs
rename to dom/security/test/csp/file_bug910139.sjs
index 6ca39ba10633..172cc09c9bbe 100644
--- a/dom/base/test/csp/file_CSP_bug910139.sjs
+++ b/dom/security/test/csp/file_bug910139.sjs
@@ -1,4 +1,4 @@
-// Server side js file for bug 910139, see file test_CSP_bug910139.html for details.
+// Server side js file for bug 910139, see file test_bug910139.html for details.
 
 Components.utils.import("resource://gre/modules/NetUtil.jsm");
 
@@ -48,5 +48,5 @@ function handleRequest(request, response)
   response.setHeader("Content-Security-Policy", getPolicy(), false);
 
   // return the requested XML file.
-  response.write(loadResponseFromFile("tests/dom/base/test/csp/file_CSP_bug910139.xml"));
+  response.write(loadResponseFromFile("tests/dom/security/test/csp/file_bug910139.xml"));
 }
diff --git a/dom/base/test/csp/file_CSP_bug910139.xml b/dom/security/test/csp/file_bug910139.xml
similarity index 89%
rename from dom/base/test/csp/file_CSP_bug910139.xml
rename to dom/security/test/csp/file_bug910139.xml
index b00e064d5f05..29feba94185f 100644
--- a/dom/base/test/csp/file_CSP_bug910139.xml
+++ b/dom/security/test/csp/file_bug910139.xml
@@ -1,5 +1,5 @@
 <?xml version="1.0" encoding="ISO-8859-1"?>
-<?xml-stylesheet type="text/xsl" href="file_CSP_bug910139.xsl"?>
+<?xml-stylesheet type="text/xsl" href="file_bug910139.xsl"?>
 <catalog>
 	<cd>
 		<title>Empire Burlesque</title>
diff --git a/dom/base/test/csp/file_CSP_bug910139.xsl b/dom/security/test/csp/file_bug910139.xsl
similarity index 100%
rename from dom/base/test/csp/file_CSP_bug910139.xsl
rename to dom/security/test/csp/file_bug910139.xsl
diff --git a/dom/base/test/csp/file_CSP_bug941404.html b/dom/security/test/csp/file_bug941404.html
similarity index 64%
rename from dom/base/test/csp/file_CSP_bug941404.html
rename to dom/security/test/csp/file_bug941404.html
index 5f11f233fccb..3a2e636e0b84 100644
--- a/dom/base/test/csp/file_CSP_bug941404.html
+++ b/dom/security/test/csp/file_bug941404.html
@@ -3,7 +3,7 @@
   <body>
 
     <!-- this should be allowed (no CSP)-->
-    <img src="http://example.org/tests/dom/base/test/csp/file_CSP.sjs?testid=img_good&type=img/png"> </img>
+    <img src="http://example.org/tests/dom/security/test/csp/file_CSP.sjs?testid=img_good&type=img/png"> </img>
 
 
     <script type="text/javascript">
@@ -12,13 +12,13 @@
         //this should be allowed (no CSP)
         try {
         var img = document.createElement("img");
-        img.src="http://example.org/tests/dom/base/test/csp/file_CSP.sjs?testid=img2_good&type=img/png";
+        img.src="http://example.org/tests/dom/security/test/csp/file_CSP.sjs?testid=img2_good&type=img/png";
         document.body.appendChild(img);
         } catch(e) {
           console.log("yo: "+e);
         }
       };
-      req.open("get", "file_CSP_bug941404_xhr.html", true);
+      req.open("get", "file_bug941404_xhr.html", true);
       req.responseType = "document";
       req.send();
     </script>
diff --git a/dom/base/test/csp/file_CSP_bug941404_xhr.html b/dom/security/test/csp/file_bug941404_xhr.html
similarity index 100%
rename from dom/base/test/csp/file_CSP_bug941404_xhr.html
rename to dom/security/test/csp/file_bug941404_xhr.html
diff --git a/dom/base/test/csp/file_CSP_bug941404_xhr.html^headers^ b/dom/security/test/csp/file_bug941404_xhr.html^headers^
similarity index 100%
rename from dom/base/test/csp/file_CSP_bug941404_xhr.html^headers^
rename to dom/security/test/csp/file_bug941404_xhr.html^headers^
diff --git a/dom/base/test/csp/file_connect-src-fetch.html b/dom/security/test/csp/file_connect-src-fetch.html
similarity index 71%
rename from dom/base/test/csp/file_connect-src-fetch.html
rename to dom/security/test/csp/file_connect-src-fetch.html
index 832ff8b5b102..ff9b2f740b46 100644
--- a/dom/base/test/csp/file_connect-src-fetch.html
+++ b/dom/security/test/csp/file_connect-src-fetch.html
@@ -6,10 +6,10 @@
   <body>
   <script type="text/javascript">
 
-    // Please note that file_csp_testserver.sjs?foo does not return a response.
+    // Please note that file_testserver.sjs?foo does not return a response.
     // For testing purposes this is not necessary because we only want to check
     // whether CSP allows or blocks the load.
-    fetch( "file_csp_testserver.sjs?foo");
+    fetch( "file_testserver.sjs?foo");
 
   </script>
 </body>
diff --git a/dom/base/test/csp/file_connect-src.html b/dom/security/test/csp/file_connect-src.html
similarity index 74%
rename from dom/base/test/csp/file_connect-src.html
rename to dom/security/test/csp/file_connect-src.html
index 330a69555774..17a940a0e02f 100644
--- a/dom/base/test/csp/file_connect-src.html
+++ b/dom/security/test/csp/file_connect-src.html
@@ -7,11 +7,11 @@
   <script type="text/javascript">
 
     try {
-      // Please note that file_csp_testserver.sjs?foo does not return a response.
+      // Please note that file_testserver.sjs?foo does not return a response.
       // For testing purposes this is not necessary because we only want to check
       // whether CSP allows or blocks the load.
       var xhr = new XMLHttpRequest();
-      xhr.open("GET", "file_csp_testserver.sjs?foo", false);
+      xhr.open("GET", "file_testserver.sjs?foo", false);
       xhr.send(null);
     }
     catch (e) { }
diff --git a/dom/base/test/csp/file_dual_header_testserver.sjs b/dom/security/test/csp/file_dual_header_testserver.sjs
similarity index 100%
rename from dom/base/test/csp/file_dual_header_testserver.sjs
rename to dom/security/test/csp/file_dual_header_testserver.sjs
diff --git a/dom/base/test/csp/file_CSP_evalscript_main.html b/dom/security/test/csp/file_evalscript_main.html
similarity index 72%
rename from dom/base/test/csp/file_CSP_evalscript_main.html
rename to dom/security/test/csp/file_evalscript_main.html
index 15495296109f..e83c1d9ed7a7 100644
--- a/dom/base/test/csp/file_CSP_evalscript_main.html
+++ b/dom/security/test/csp/file_evalscript_main.html
@@ -2,7 +2,7 @@
   <head>
     <title>CSP eval script tests</title>
     <script type="application/javascript"
-             src="file_CSP_evalscript_main.js"></script>
+             src="file_evalscript_main.js"></script>
   </head>
   <body>
 
diff --git a/dom/base/test/csp/file_CSP_evalscript_main.html^headers^ b/dom/security/test/csp/file_evalscript_main.html^headers^
similarity index 100%
rename from dom/base/test/csp/file_CSP_evalscript_main.html^headers^
rename to dom/security/test/csp/file_evalscript_main.html^headers^
diff --git a/dom/base/test/csp/file_CSP_evalscript_main.js b/dom/security/test/csp/file_evalscript_main.js
similarity index 100%
rename from dom/base/test/csp/file_CSP_evalscript_main.js
rename to dom/security/test/csp/file_evalscript_main.js
diff --git a/dom/base/test/csp/file_CSP_evalscript_main_allowed.html b/dom/security/test/csp/file_evalscript_main_allowed.html
similarity index 69%
rename from dom/base/test/csp/file_CSP_evalscript_main_allowed.html
rename to dom/security/test/csp/file_evalscript_main_allowed.html
index 8d18b0816654..274972d9bd7e 100644
--- a/dom/base/test/csp/file_CSP_evalscript_main_allowed.html
+++ b/dom/security/test/csp/file_evalscript_main_allowed.html
@@ -2,7 +2,7 @@
   <head>
     <title>CSP eval script tests</title>
     <script type="application/javascript"
-             src="file_CSP_evalscript_main_allowed.js"></script>
+             src="file_evalscript_main_allowed.js"></script>
   </head>
   <body>
 
diff --git a/dom/base/test/csp/file_CSP_evalscript_main_allowed.html^headers^ b/dom/security/test/csp/file_evalscript_main_allowed.html^headers^
similarity index 100%
rename from dom/base/test/csp/file_CSP_evalscript_main_allowed.html^headers^
rename to dom/security/test/csp/file_evalscript_main_allowed.html^headers^
diff --git a/dom/base/test/csp/file_CSP_evalscript_main_allowed.js b/dom/security/test/csp/file_evalscript_main_allowed.js
similarity index 100%
rename from dom/base/test/csp/file_CSP_evalscript_main_allowed.js
rename to dom/security/test/csp/file_evalscript_main_allowed.js
diff --git a/dom/base/test/csp/file_form-action.html b/dom/security/test/csp/file_form-action.html
similarity index 100%
rename from dom/base/test/csp/file_form-action.html
rename to dom/security/test/csp/file_form-action.html
diff --git a/dom/base/test/csp/file_CSP_frameancestors.sjs b/dom/security/test/csp/file_frameancestors.sjs
similarity index 89%
rename from dom/base/test/csp/file_CSP_frameancestors.sjs
rename to dom/security/test/csp/file_frameancestors.sjs
index 37c296a659f4..d0a77893f720 100644
--- a/dom/base/test/csp/file_CSP_frameancestors.sjs
+++ b/dom/security/test/csp/file_frameancestors.sjs
@@ -30,9 +30,9 @@ function handleRequest(request, response)
     response.setHeader("Content-Type", "text/html", false);
     response.write('<html><head>');
     if (query['double'])
-      response.write('<script src="file_CSP_frameancestors.sjs?double=1&scriptedreport=' + query['testid'] + '"></script>');
+      response.write('<script src="file_frameancestors.sjs?double=1&scriptedreport=' + query['testid'] + '"></script>');
     else
-      response.write('<script src="file_CSP_frameancestors.sjs?scriptedreport=' + query['testid'] + '"></script>');
+      response.write('<script src="file_frameancestors.sjs?scriptedreport=' + query['testid'] + '"></script>');
     response.write('</head><body>');
     response.write(unescape(query['internalframe']));
     response.write('</body></html>');
diff --git a/dom/base/test/csp/file_CSP_frameancestors_main.html b/dom/security/test/csp/file_frameancestors_main.html
similarity index 95%
rename from dom/base/test/csp/file_CSP_frameancestors_main.html
rename to dom/security/test/csp/file_frameancestors_main.html
index d7f835a18744..97f9cb9ac506 100644
--- a/dom/base/test/csp/file_CSP_frameancestors_main.html
+++ b/dom/security/test/csp/file_frameancestors_main.html
@@ -3,7 +3,7 @@
     <title>CSP frame ancestors tests</title>
 
     <!-- this page shouldn't have a CSP, just the sub-pages. -->
-    <script src='file_CSP_frameancestors_main.js'></script>
+    <script src='file_frameancestors_main.js'></script>
 
   </head>
   <body>
diff --git a/dom/base/test/csp/file_CSP_frameancestors_main.js b/dom/security/test/csp/file_frameancestors_main.js
similarity index 93%
rename from dom/base/test/csp/file_CSP_frameancestors_main.js
rename to dom/security/test/csp/file_frameancestors_main.js
index a5b17027c698..caffc7257552 100644
--- a/dom/base/test/csp/file_CSP_frameancestors_main.js
+++ b/dom/security/test/csp/file_frameancestors_main.js
@@ -4,9 +4,9 @@ function setupFrames() {
 
   var $ = function(v) { return document.getElementById(v); }
   var base = {
-        self: '/tests/dom/base/test/csp/file_CSP_frameancestors.sjs',
-        a: 'http://mochi.test:8888/tests/dom/base/test/csp/file_CSP_frameancestors.sjs',
-        b: 'http://example.com/tests/dom/base/test/csp/file_CSP_frameancestors.sjs'
+        self: '/tests/dom/security/test/csp/file_frameancestors.sjs',
+        a: 'http://mochi.test:8888/tests/dom/security/test/csp/file_frameancestors.sjs',
+        b: 'http://example.com/tests/dom/security/test/csp/file_frameancestors.sjs'
   };
 
   var host = { a: 'http://mochi.test:8888', b: 'http://example.com:80' };
diff --git a/dom/base/test/csp/file_hash_source.html b/dom/security/test/csp/file_hash_source.html
similarity index 100%
rename from dom/base/test/csp/file_hash_source.html
rename to dom/security/test/csp/file_hash_source.html
diff --git a/dom/base/test/csp/file_hash_source.html^headers^ b/dom/security/test/csp/file_hash_source.html^headers^
similarity index 100%
rename from dom/base/test/csp/file_hash_source.html^headers^
rename to dom/security/test/csp/file_hash_source.html^headers^
diff --git a/dom/base/test/csp/file_ignore_unsafe_inline.html b/dom/security/test/csp/file_ignore_unsafe_inline.html
similarity index 100%
rename from dom/base/test/csp/file_ignore_unsafe_inline.html
rename to dom/security/test/csp/file_ignore_unsafe_inline.html
diff --git a/dom/base/test/csp/file_CSP_inlinescript_main.html b/dom/security/test/csp/file_inlinescript_main.html
similarity index 100%
rename from dom/base/test/csp/file_CSP_inlinescript_main.html
rename to dom/security/test/csp/file_inlinescript_main.html
diff --git a/dom/base/test/csp/file_CSP_inlinescript_main.html^headers^ b/dom/security/test/csp/file_inlinescript_main.html^headers^
similarity index 100%
rename from dom/base/test/csp/file_CSP_inlinescript_main.html^headers^
rename to dom/security/test/csp/file_inlinescript_main.html^headers^
diff --git a/dom/base/test/csp/file_CSP_inlinescript_main_allowed.html b/dom/security/test/csp/file_inlinescript_main_allowed.html
similarity index 100%
rename from dom/base/test/csp/file_CSP_inlinescript_main_allowed.html
rename to dom/security/test/csp/file_inlinescript_main_allowed.html
diff --git a/dom/base/test/csp/file_CSP_inlinescript_main_allowed.html^headers^ b/dom/security/test/csp/file_inlinescript_main_allowed.html^headers^
similarity index 100%
rename from dom/base/test/csp/file_CSP_inlinescript_main_allowed.html^headers^
rename to dom/security/test/csp/file_inlinescript_main_allowed.html^headers^
diff --git a/dom/base/test/csp/file_CSP_inlinestyle_main.html b/dom/security/test/csp/file_inlinestyle_main.html
similarity index 100%
rename from dom/base/test/csp/file_CSP_inlinestyle_main.html
rename to dom/security/test/csp/file_inlinestyle_main.html
diff --git a/dom/base/test/csp/file_CSP_inlinestyle_main.html^headers^ b/dom/security/test/csp/file_inlinestyle_main.html^headers^
similarity index 100%
rename from dom/base/test/csp/file_CSP_inlinestyle_main.html^headers^
rename to dom/security/test/csp/file_inlinestyle_main.html^headers^
diff --git a/dom/base/test/csp/file_CSP_inlinestyle_main_allowed.html b/dom/security/test/csp/file_inlinestyle_main_allowed.html
similarity index 100%
rename from dom/base/test/csp/file_CSP_inlinestyle_main_allowed.html
rename to dom/security/test/csp/file_inlinestyle_main_allowed.html
diff --git a/dom/base/test/csp/file_CSP_inlinestyle_main_allowed.html^headers^ b/dom/security/test/csp/file_inlinestyle_main_allowed.html^headers^
similarity index 100%
rename from dom/base/test/csp/file_CSP_inlinestyle_main_allowed.html^headers^
rename to dom/security/test/csp/file_inlinestyle_main_allowed.html^headers^
diff --git a/dom/base/test/csp/file_csp_invalid_source_expression.html b/dom/security/test/csp/file_invalid_source_expression.html
similarity index 50%
rename from dom/base/test/csp/file_csp_invalid_source_expression.html
rename to dom/security/test/csp/file_invalid_source_expression.html
index 155e6d0f8b9d..83bb0ec0ca9b 100644
--- a/dom/base/test/csp/file_csp_invalid_source_expression.html
+++ b/dom/security/test/csp/file_invalid_source_expression.html
@@ -5,7 +5,7 @@
   </head>
   <body>
   <div id="testdiv">blocked</div>
-  <!-- Note, we reuse file_csp_path_matching.js which only updates the testdiv to 'allowed' if loaded !-->
-  <script src="http://test1.example.com/tests/dom/base/test/csp/file_csp_path_matching.js"></script>
+  <!-- Note, we reuse file_path_matching.js which only updates the testdiv to 'allowed' if loaded !-->
+  <script src="http://test1.example.com/tests/dom/security/test/csp/file_path_matching.js"></script>
 </body>
 </html>
diff --git a/dom/base/test/csp/file_leading_wildcard.html b/dom/security/test/csp/file_leading_wildcard.html
similarity index 54%
rename from dom/base/test/csp/file_leading_wildcard.html
rename to dom/security/test/csp/file_leading_wildcard.html
index 4270adf78fca..ea5e9934470a 100644
--- a/dom/base/test/csp/file_leading_wildcard.html
+++ b/dom/security/test/csp/file_leading_wildcard.html
@@ -5,7 +5,7 @@
   </head>
   <body>
   <!-- Please note that both scripts do *not* exist in the file system -->
-  <script src="http://test1.example.com/tests/dom/base/test/csp/leading_wildcard_allowed.js" ></script>
-  <script src="http://example.com/tests/dom/base/test/csp/leading_wildcard_blocked.js" ></script>
+  <script src="http://test1.example.com/tests/dom/security/test/csp/leading_wildcard_allowed.js" ></script>
+  <script src="http://example.com/tests/dom/security/test/csp/leading_wildcard_blocked.js" ></script>
 </body>
 </html>
diff --git a/dom/base/test/csp/file_CSP_main.html b/dom/security/test/csp/file_main.html
similarity index 60%
rename from dom/base/test/csp/file_CSP_main.html
rename to dom/security/test/csp/file_main.html
index 7bd4ae7f82d6..ddc838261740 100644
--- a/dom/base/test/csp/file_CSP_main.html
+++ b/dom/security/test/csp/file_main.html
@@ -1,7 +1,7 @@
 <html>
   <head>
     <link rel='stylesheet' type='text/css'
-          href='http://example.org/tests/dom/base/test/csp/file_CSP.sjs?testid=style_bad&type=text/css' />
+          href='http://example.org/tests/dom/security/test/csp/file_CSP.sjs?testid=style_bad&type=text/css' />
     <link rel='stylesheet' type='text/css'
           href='file_CSP.sjs?testid=style_good&type=text/css' />
 
@@ -14,7 +14,7 @@
       }
       @font-face {
         font-family: "arbitrary_bad";
-        src: url('http://example.org/tests/dom/base/test/csp/file_CSP.sjs?testid=font_bad&type=application/octet-stream');
+        src: url('http://example.org/tests/dom/security/test/csp/file_CSP.sjs?testid=font_bad&type=application/octet-stream');
       }
 
       .div_arbitrary_good { font-family: "arbitrary_good"; }
@@ -23,13 +23,13 @@
   </head>
   <body>
     <!-- these should be stopped by CSP.  :) -->
-    <img src="http://example.org/tests/dom/base/test/csp/file_CSP.sjs?testid=img_bad&type=img/png"> </img>
-    <audio src="http://example.org/tests/dom/base/test/csp/file_CSP.sjs?testid=media_bad&type=audio/vorbis"></audio>
-    <script src='http://example.org/tests/dom/base/test/csp/file_CSP.sjs?testid=script_bad&type=text/javascript'></script>
-    <iframe src='http://example.org/tests/dom/base/test/csp/file_CSP.sjs?testid=frame_bad&content=FAIL'></iframe>
+    <img src="http://example.org/tests/dom/security/test/csp/file_CSP.sjs?testid=img_bad&type=img/png"> </img>
+    <audio src="http://example.org/tests/dom/security/test/csp/file_CSP.sjs?testid=media_bad&type=audio/vorbis"></audio>
+    <script src='http://example.org/tests/dom/security/test/csp/file_CSP.sjs?testid=script_bad&type=text/javascript'></script>
+    <iframe src='http://example.org/tests/dom/security/test/csp/file_CSP.sjs?testid=frame_bad&content=FAIL'></iframe>
     <object width="10" height="10">
-      <param name="movie" value="http://example.org/tests/dom/base/test/csp/file_CSP.sjs?testid=object_bad&type=application/x-shockwave-flash">
-      <embed src="http://example.org/tests/dom/base/test/csp/file_CSP.sjs?testid=object_bad&type=application/x-shockwave-flash"></embed>
+      <param name="movie" value="http://example.org/tests/dom/security/test/csp/file_CSP.sjs?testid=object_bad&type=application/x-shockwave-flash">
+      <embed src="http://example.org/tests/dom/security/test/csp/file_CSP.sjs?testid=object_bad&type=application/x-shockwave-flash"></embed>
     </object>
 
     <!-- these should load ok.  :) -->
@@ -46,7 +46,7 @@
     <!-- XHR tests... they're taken care of in this script,
          and since the URI doesn't have any 'testid' values,
          it will just be ignored by the test framework.  -->
-    <script src='file_CSP_main.js'></script>
+    <script src='file_main.js'></script>
 
     <!-- Support elements for the @font-face test -->
     <div class="div_arbitrary_good">arbitrary good</div>
diff --git a/dom/base/test/csp/file_CSP_main.html^headers^ b/dom/security/test/csp/file_main.html^headers^
similarity index 100%
rename from dom/base/test/csp/file_CSP_main.html^headers^
rename to dom/security/test/csp/file_main.html^headers^
diff --git a/dom/base/test/csp/file_CSP_main.js b/dom/security/test/csp/file_main.js
similarity index 59%
rename from dom/base/test/csp/file_CSP_main.js
rename to dom/security/test/csp/file_main.js
index 1da3ddab2116..864a5d230b95 100644
--- a/dom/base/test/csp/file_CSP_main.js
+++ b/dom/security/test/csp/file_main.js
@@ -3,14 +3,14 @@
 
 try {
   var xhr_good = new XMLHttpRequest();
-  var xhr_good_uri ="http://mochi.test:8888/tests/dom/base/test/csp/file_CSP.sjs?testid=xhr_good";
+  var xhr_good_uri ="http://mochi.test:8888/tests/dom/security/test/csp/file_CSP.sjs?testid=xhr_good";
   xhr_good.open("GET", xhr_good_uri, true);
   xhr_good.send(null);
 } catch(e) {}
 
 try {
   var xhr_bad = new XMLHttpRequest();
-  var xhr_bad_uri ="http://example.com/tests/dom/base/test/csp/file_CSP.sjs?testid=xhr_bad";
+  var xhr_bad_uri ="http://example.com/tests/dom/security/test/csp/file_CSP.sjs?testid=xhr_bad";
   xhr_bad.open("GET", xhr_bad_uri, true);
   xhr_bad.send(null);
 } catch(e) {}
diff --git a/dom/base/test/csp/file_multi_policy_injection_bypass.html b/dom/security/test/csp/file_multi_policy_injection_bypass.html
similarity index 61%
rename from dom/base/test/csp/file_multi_policy_injection_bypass.html
rename to dom/security/test/csp/file_multi_policy_injection_bypass.html
index 4932387c742c..a3cb415a9e40 100644
--- a/dom/base/test/csp/file_multi_policy_injection_bypass.html
+++ b/dom/security/test/csp/file_multi_policy_injection_bypass.html
@@ -4,8 +4,8 @@ https://bugzilla.mozilla.org/show_bug.cgi?id=717511
 -->
   <body>
     <!-- these should be stopped by CSP after fixing bug 717511.  :) -->
-    <img src="http://example.org/tests/dom/base/test/file_CSP.sjs?testid=img_bad&type=img/png"> </img>
-    <script src='http://example.org/tests/dom/base/test/file_CSP.sjs?testid=script_bad&type=text/javascript'></script>
+    <img src="http://example.org/tests/dom/security/test/csp/file_CSP.sjs?testid=img_bad&type=img/png"> </img>
+    <script src='http://example.org/tests/dom/security/test/csp/file_CSP.sjs?testid=script_bad&type=text/javascript'></script>
 
     <!-- these should load ok after fixing bug 717511.  :) -->
     <img src="file_CSP.sjs?testid=img_good&type=img/png" />
diff --git a/dom/base/test/csp/file_multi_policy_injection_bypass.html^headers^ b/dom/security/test/csp/file_multi_policy_injection_bypass.html^headers^
similarity index 100%
rename from dom/base/test/csp/file_multi_policy_injection_bypass.html^headers^
rename to dom/security/test/csp/file_multi_policy_injection_bypass.html^headers^
diff --git a/dom/base/test/csp/file_multi_policy_injection_bypass_2.html b/dom/security/test/csp/file_multi_policy_injection_bypass_2.html
similarity index 61%
rename from dom/base/test/csp/file_multi_policy_injection_bypass_2.html
rename to dom/security/test/csp/file_multi_policy_injection_bypass_2.html
index f3696bb85941..3fa6c7ab9133 100644
--- a/dom/base/test/csp/file_multi_policy_injection_bypass_2.html
+++ b/dom/security/test/csp/file_multi_policy_injection_bypass_2.html
@@ -4,8 +4,8 @@ https://bugzilla.mozilla.org/show_bug.cgi?id=717511
 -->
   <body>
     <!-- these should be stopped by CSP after fixing bug 717511.  :) -->
-    <img src="http://example.org/tests/dom/base/test/file_CSP.sjs?testid=img2_bad&type=img/png"> </img>
-    <script src='http://example.org/tests/dom/base/test/file_CSP.sjs?testid=script2_bad&type=text/javascript'></script>
+    <img src="http://example.org/tests/dom/security/test/csp/file_CSP.sjs?testid=img2_bad&type=img/png"> </img>
+    <script src='http://example.org/tests/dom/security/test/csp/file_CSP.sjs?testid=script2_bad&type=text/javascript'></script>
 
     <!-- these should load ok after fixing bug 717511.  :) -->
     <img src="file_CSP.sjs?testid=img2_good&type=img/png" />
diff --git a/dom/base/test/csp/file_multi_policy_injection_bypass_2.html^headers^ b/dom/security/test/csp/file_multi_policy_injection_bypass_2.html^headers^
similarity index 100%
rename from dom/base/test/csp/file_multi_policy_injection_bypass_2.html^headers^
rename to dom/security/test/csp/file_multi_policy_injection_bypass_2.html^headers^
diff --git a/dom/base/test/csp/file_nonce_source.html b/dom/security/test/csp/file_nonce_source.html
similarity index 85%
rename from dom/base/test/csp/file_nonce_source.html
rename to dom/security/test/csp/file_nonce_source.html
index 7892ad9b226a..bf14ffe6410f 100644
--- a/dom/base/test/csp/file_nonce_source.html
+++ b/dom/security/test/csp/file_nonce_source.html
@@ -29,11 +29,11 @@
     </script>
 
     <!-- external scripts -->
-    <script nonce="correctscriptnonce" src="http://example.org/tests/dom/base/test/csp/file_CSP.sjs?testid=external_script_correct_nonce_good&type=text/javascript"></script>
-    <script nonce="anothercorrectscriptnonce" src="http://example.org/tests/dom/base/test/csp/file_CSP.sjs?testid=external_script_another_correct_nonce_good&type=text/javascript"></script>
-    <script nonce="incorrectscriptnonce" src="http://example.org/tests/dom/base/test/csp/file_CSP.sjs?testid=external_script_incorrect_nonce_bad&type=text/javascript"></script>
-    <script nonce="correctstylenonce" src="http://example.org/tests/dom/base/test/csp/file_CSP.sjs?testid=external_script_correct_style_nonce_bad&type=text/javascript"></script>
-    <script src="http://example.org/tests/dom/base/test/csp/file_CSP.sjs?testid=external_script_no_nonce_bad&type=text/javascript"></script>
+    <script nonce="correctscriptnonce" src="http://example.org/tests/dom/security/test/csp/file_CSP.sjs?testid=external_script_correct_nonce_good&type=text/javascript"></script>
+    <script nonce="anothercorrectscriptnonce" src="http://example.org/tests/dom/security/test/csp/file_CSP.sjs?testid=external_script_another_correct_nonce_good&type=text/javascript"></script>
+    <script nonce="incorrectscriptnonce" src="http://example.org/tests/dom/security/test/csp/file_CSP.sjs?testid=external_script_incorrect_nonce_bad&type=text/javascript"></script>
+    <script nonce="correctstylenonce" src="http://example.org/tests/dom/security/test/csp/file_CSP.sjs?testid=external_script_correct_style_nonce_bad&type=text/javascript"></script>
+    <script src="http://example.org/tests/dom/security/test/csp/file_CSP.sjs?testid=external_script_no_nonce_bad&type=text/javascript"></script>
 
     <!-- This external script has the correct nonce and comes from a whitelisted URI. It should be allowed. -->
     <script nonce="correctscriptnonce" src="file_CSP.sjs?testid=external_script_correct_nonce_correct_uri_good&type=text/javascript"></script>
diff --git a/dom/base/test/csp/file_nonce_source.html^headers^ b/dom/security/test/csp/file_nonce_source.html^headers^
similarity index 100%
rename from dom/base/test/csp/file_nonce_source.html^headers^
rename to dom/security/test/csp/file_nonce_source.html^headers^
diff --git a/dom/base/test/csp/file_null_baseuri.html b/dom/security/test/csp/file_null_baseuri.html
similarity index 100%
rename from dom/base/test/csp/file_null_baseuri.html
rename to dom/security/test/csp/file_null_baseuri.html
diff --git a/dom/base/test/csp/file_csp_path_matching.html b/dom/security/test/csp/file_path_matching.html
similarity index 63%
rename from dom/base/test/csp/file_csp_path_matching.html
rename to dom/security/test/csp/file_path_matching.html
index 4126ed58a003..662fbfb8afd9 100644
--- a/dom/base/test/csp/file_csp_path_matching.html
+++ b/dom/security/test/csp/file_path_matching.html
@@ -5,6 +5,6 @@
   </head>
   <body>
   <div id="testdiv">blocked</div>
-  <script src="http://test1.example.com/tests/dom/base/test/csp/file_csp_path_matching.js#foo"></script>
+  <script src="http://test1.example.com/tests/dom/security/test/csp/file_path_matching.js#foo"></script>
 </body>
 </html>
diff --git a/dom/base/test/csp/file_csp_path_matching.js b/dom/security/test/csp/file_path_matching.js
similarity index 100%
rename from dom/base/test/csp/file_csp_path_matching.js
rename to dom/security/test/csp/file_path_matching.js
diff --git a/dom/base/test/csp/file_csp_path_matching_incl_query.html b/dom/security/test/csp/file_path_matching_incl_query.html
similarity index 64%
rename from dom/base/test/csp/file_csp_path_matching_incl_query.html
rename to dom/security/test/csp/file_path_matching_incl_query.html
index 7647ebf2f0d7..50af2b143704 100644
--- a/dom/base/test/csp/file_csp_path_matching_incl_query.html
+++ b/dom/security/test/csp/file_path_matching_incl_query.html
@@ -5,6 +5,6 @@
   </head>
   <body>
   <div id="testdiv">blocked</div>
-  <script src="http://test1.example.com/tests/dom/base/test/csp/file_csp_path_matching.js?val=foo"></script>
+  <script src="http://test1.example.com/tests/dom/security/test/csp/file_path_matching.js?val=foo"></script>
 </body>
 </html>
diff --git a/dom/base/test/csp/file_csp_path_matching_redirect.html b/dom/security/test/csp/file_path_matching_redirect.html
similarity index 61%
rename from dom/base/test/csp/file_csp_path_matching_redirect.html
rename to dom/security/test/csp/file_path_matching_redirect.html
index c1716b45031b..a16cc90ec6da 100644
--- a/dom/base/test/csp/file_csp_path_matching_redirect.html
+++ b/dom/security/test/csp/file_path_matching_redirect.html
@@ -5,6 +5,6 @@
   </head>
   <body>
   <div id="testdiv">blocked</div>
-  <script src="http://example.com/tests/dom/base/test/csp/file_csp_path_matching_redirect_server.sjs"></script>
+  <script src="http://example.com/tests/dom/security/test/csp/file_path_matching_redirect_server.sjs"></script>
 </body>
 </html>
diff --git a/dom/base/test/csp/file_csp_path_matching_redirect_server.sjs b/dom/security/test/csp/file_path_matching_redirect_server.sjs
similarity index 78%
rename from dom/base/test/csp/file_csp_path_matching_redirect_server.sjs
rename to dom/security/test/csp/file_path_matching_redirect_server.sjs
index 41943cbc307e..49a3160f4e17 100644
--- a/dom/base/test/csp/file_csp_path_matching_redirect_server.sjs
+++ b/dom/security/test/csp/file_path_matching_redirect_server.sjs
@@ -5,7 +5,7 @@
 function handleRequest(request, response)
 {
 
-  var newLocation = "http://test1.example.com/tests/dom/base/test/csp/file_csp_path_matching.js";
+  var newLocation = "http://test1.example.com/tests/dom/security/test/csp/file_path_matching.js";
 
   response.setStatusLine("1.1", 302, "Found");
   response.setHeader("Cache-Control", "no-cache", false);
diff --git a/dom/base/test/csp/file_policyuri_regression_from_multipolicy.html b/dom/security/test/csp/file_policyuri_regression_from_multipolicy.html
similarity index 100%
rename from dom/base/test/csp/file_policyuri_regression_from_multipolicy.html
rename to dom/security/test/csp/file_policyuri_regression_from_multipolicy.html
diff --git a/dom/security/test/csp/file_policyuri_regression_from_multipolicy.html^headers^ b/dom/security/test/csp/file_policyuri_regression_from_multipolicy.html^headers^
new file mode 100644
index 000000000000..c4ff8ea9fd31
--- /dev/null
+++ b/dom/security/test/csp/file_policyuri_regression_from_multipolicy.html^headers^
@@ -0,0 +1 @@
+content-security-policy-report-only: policy-uri /tests/dom/security/test/csp/file_policyuri_regression_from_multipolicy_policy
diff --git a/dom/base/test/csp/file_policyuri_regression_from_multipolicy_policy b/dom/security/test/csp/file_policyuri_regression_from_multipolicy_policy
similarity index 100%
rename from dom/base/test/csp/file_policyuri_regression_from_multipolicy_policy
rename to dom/security/test/csp/file_policyuri_regression_from_multipolicy_policy
diff --git a/dom/base/test/csp/file_redirect_content.sjs b/dom/security/test/csp/file_redirect_content.sjs
similarity index 95%
rename from dom/base/test/csp/file_redirect_content.sjs
rename to dom/security/test/csp/file_redirect_content.sjs
index d0e31412f7a3..080f179cd278 100644
--- a/dom/base/test/csp/file_redirect_content.sjs
+++ b/dom/security/test/csp/file_redirect_content.sjs
@@ -23,7 +23,7 @@ function handleRequest(request, response) {
     return;
   }
 
-  var csp = "default-src \'self\';report-uri http://mochi.test:8888/tests/dom/base/test/csp/file_redirect_report.sjs?" + redirect;
+  var csp = "default-src \'self\';report-uri http://mochi.test:8888/tests/dom/security/test/csp/file_redirect_report.sjs?" + redirect;
 
   response.setHeader("Content-Security-Policy", csp, false);
 
diff --git a/dom/base/test/csp/file_redirect_report.sjs b/dom/security/test/csp/file_redirect_report.sjs
similarity index 100%
rename from dom/base/test/csp/file_redirect_report.sjs
rename to dom/security/test/csp/file_redirect_report.sjs
diff --git a/dom/base/test/csp/file_csp_redirects_main.html b/dom/security/test/csp/file_redirects_main.html
similarity index 95%
rename from dom/base/test/csp/file_csp_redirects_main.html
rename to dom/security/test/csp/file_redirects_main.html
index 133da6f05ddb..651f44d38495 100644
--- a/dom/base/test/csp/file_csp_redirects_main.html
+++ b/dom/security/test/csp/file_redirects_main.html
@@ -9,7 +9,7 @@
 <script>
 var thisSite = "http://mochi.test:8888";
 var otherSite = "http://example.com";
-var page = "/tests/dom/base/test/csp/file_csp_redirects_page.sjs";
+var page = "/tests/dom/security/test/csp/file_redirects_page.sjs";
 
 var tests = { "font-src": thisSite+page+"?testid=font-src&csp=1",
               "frame-src": thisSite+page+"?testid=frame-src&csp=1",
diff --git a/dom/base/test/csp/file_csp_redirects_page.sjs b/dom/security/test/csp/file_redirects_page.sjs
similarity index 98%
rename from dom/base/test/csp/file_csp_redirects_page.sjs
rename to dom/security/test/csp/file_redirects_page.sjs
index c0469e5d38da..58eff8af64e5 100644
--- a/dom/base/test/csp/file_csp_redirects_page.sjs
+++ b/dom/security/test/csp/file_redirects_page.sjs
@@ -11,7 +11,7 @@ function handleRequest(request, response)
   response.setHeader("Cache-Control", "no-cache", false);
   response.setHeader("Content-Type", "text/html", false);
 
-  var resource = "/tests/dom/base/test/csp/file_csp_redirects_resource.sjs";
+  var resource = "/tests/dom/security/test/csp/file_redirects_resource.sjs";
 
   // CSP header value
   if (query["csp"] == 1) {
diff --git a/dom/base/test/csp/file_csp_redirects_resource.sjs b/dom/security/test/csp/file_redirects_resource.sjs
similarity index 98%
rename from dom/base/test/csp/file_csp_redirects_resource.sjs
rename to dom/security/test/csp/file_redirects_resource.sjs
index 1fc52bdc16ed..b921bd608be6 100644
--- a/dom/base/test/csp/file_csp_redirects_resource.sjs
+++ b/dom/security/test/csp/file_redirects_resource.sjs
@@ -11,7 +11,7 @@ function handleRequest(request, response)
 
   var thisSite = "http://mochi.test:8888";
   var otherSite = "http://example.com";
-  var resource = "/tests/dom/base/test/csp/file_csp_redirects_resource.sjs";
+  var resource = "/tests/dom/security/test/csp/file_redirects_resource.sjs";
 
   response.setHeader("Cache-Control", "no-cache", false);
 
diff --git a/dom/base/test/csp/file_csp_referrerdirective.html b/dom/security/test/csp/file_referrerdirective.html
similarity index 80%
rename from dom/base/test/csp/file_csp_referrerdirective.html
rename to dom/security/test/csp/file_referrerdirective.html
index 561dadb1d27e..841ffe05872a 100644
--- a/dom/base/test/csp/file_csp_referrerdirective.html
+++ b/dom/security/test/csp/file_referrerdirective.html
@@ -44,11 +44,11 @@ var postResult = function(loadType, referrerLevel, referrer) {
 <body>
 Testing ...
 
-<script src="https://example.com/tests/dom/base/test/csp/referrerdirective.sjs?type=sameorigin&"
+<script src="https://example.com/tests/dom/security/test/csp/referrerdirective.sjs?type=sameorigin&"
         onerror="postResult('sameorigin', 'error');"></script>
-<script src="https://test2.example.com/tests/dom/base/test/csp/referrerdirective.sjs?type=crossorigin&"
+<script src="https://test2.example.com/tests/dom/security/test/csp/referrerdirective.sjs?type=crossorigin&"
         onerror="postResult('crossorigin', 'error');"></script>
-<script src="http://example.com/tests/dom/base/test/csp/referrerdirective.sjs?type=downgrade&"
+<script src="http://example.com/tests/dom/security/test/csp/referrerdirective.sjs?type=downgrade&"
         onerror="postResult('downgrade', 'error');"></script>
 
 </body>
diff --git a/dom/base/test/csp/file_csp_report.html b/dom/security/test/csp/file_report.html
similarity index 100%
rename from dom/base/test/csp/file_csp_report.html
rename to dom/security/test/csp/file_report.html
diff --git a/dom/base/test/csp/file_report_uri_missing_in_report_only_header.html b/dom/security/test/csp/file_report_uri_missing_in_report_only_header.html
similarity index 100%
rename from dom/base/test/csp/file_report_uri_missing_in_report_only_header.html
rename to dom/security/test/csp/file_report_uri_missing_in_report_only_header.html
diff --git a/dom/base/test/csp/file_report_uri_missing_in_report_only_header.html^headers^ b/dom/security/test/csp/file_report_uri_missing_in_report_only_header.html^headers^
similarity index 100%
rename from dom/base/test/csp/file_report_uri_missing_in_report_only_header.html^headers^
rename to dom/security/test/csp/file_report_uri_missing_in_report_only_header.html^headers^
diff --git a/dom/base/test/csp/file_scheme_relative_sources.js b/dom/security/test/csp/file_scheme_relative_sources.js
similarity index 100%
rename from dom/base/test/csp/file_scheme_relative_sources.js
rename to dom/security/test/csp/file_scheme_relative_sources.js
diff --git a/dom/base/test/csp/file_scheme_relative_sources.sjs b/dom/security/test/csp/file_scheme_relative_sources.sjs
similarity index 94%
rename from dom/base/test/csp/file_scheme_relative_sources.sjs
rename to dom/security/test/csp/file_scheme_relative_sources.sjs
index f624cebc4525..8c4d62ca5df4 100644
--- a/dom/base/test/csp/file_scheme_relative_sources.sjs
+++ b/dom/security/test/csp/file_scheme_relative_sources.sjs
@@ -12,7 +12,7 @@ function handleRequest(request, response)
   let policy = query.get("policy");
 
   let linkUrl = scheme +
-  	"://example.com/tests/dom/base/test/csp/file_scheme_relative_sources.js";
+  	"://example.com/tests/dom/security/test/csp/file_scheme_relative_sources.js";
 
   let html = "<!DOCTYPE HTML>" +
              "<html>" +
diff --git a/dom/base/test/csp/file_self_none_as_hostname_confusion.html b/dom/security/test/csp/file_self_none_as_hostname_confusion.html
similarity index 100%
rename from dom/base/test/csp/file_self_none_as_hostname_confusion.html
rename to dom/security/test/csp/file_self_none_as_hostname_confusion.html
diff --git a/dom/base/test/csp/file_self_none_as_hostname_confusion.html^headers^ b/dom/security/test/csp/file_self_none_as_hostname_confusion.html^headers^
similarity index 100%
rename from dom/base/test/csp/file_self_none_as_hostname_confusion.html^headers^
rename to dom/security/test/csp/file_self_none_as_hostname_confusion.html^headers^
diff --git a/dom/base/test/csp/file_subframe_run_js_if_allowed.html b/dom/security/test/csp/file_subframe_run_js_if_allowed.html
similarity index 100%
rename from dom/base/test/csp/file_subframe_run_js_if_allowed.html
rename to dom/security/test/csp/file_subframe_run_js_if_allowed.html
diff --git a/dom/base/test/csp/file_subframe_run_js_if_allowed.html^headers^ b/dom/security/test/csp/file_subframe_run_js_if_allowed.html^headers^
similarity index 100%
rename from dom/base/test/csp/file_subframe_run_js_if_allowed.html^headers^
rename to dom/security/test/csp/file_subframe_run_js_if_allowed.html^headers^
diff --git a/dom/base/test/csp/file_csp_testserver.sjs b/dom/security/test/csp/file_testserver.sjs
similarity index 100%
rename from dom/base/test/csp/file_csp_testserver.sjs
rename to dom/security/test/csp/file_testserver.sjs
diff --git a/dom/security/test/csp/file_web_manifest.html b/dom/security/test/csp/file_web_manifest.html
new file mode 100644
index 000000000000..0f6a67460eed
--- /dev/null
+++ b/dom/security/test/csp/file_web_manifest.html
@@ -0,0 +1,6 @@
+<!doctype html>
+<meta charset=utf-8>
+<head>
+<link rel="manifest" href="file_web_manifest.json">
+</head>
+<h1>Support Page for Web Manifest Tests</h1>
\ No newline at end of file
diff --git a/dom/base/test/csp/file_CSP_web_manifest.json b/dom/security/test/csp/file_web_manifest.json
similarity index 100%
rename from dom/base/test/csp/file_CSP_web_manifest.json
rename to dom/security/test/csp/file_web_manifest.json
diff --git a/dom/base/test/csp/file_CSP_web_manifest.json^headers^ b/dom/security/test/csp/file_web_manifest.json^headers^
similarity index 100%
rename from dom/base/test/csp/file_CSP_web_manifest.json^headers^
rename to dom/security/test/csp/file_web_manifest.json^headers^
diff --git a/dom/security/test/csp/file_web_manifest_https.html b/dom/security/test/csp/file_web_manifest_https.html
new file mode 100644
index 000000000000..b0ff9ef85316
--- /dev/null
+++ b/dom/security/test/csp/file_web_manifest_https.html
@@ -0,0 +1,4 @@
+<!doctype html>
+<meta charset=utf-8>
+<link rel="manifest" href="https://example.com:443/tests/dom/security/test/csp/file_web_manifest_https.json">
+<h1>Support Page for Web Manifest Tests</h1>
\ No newline at end of file
diff --git a/dom/base/test/csp/file_CSP_web_manifest_https.json b/dom/security/test/csp/file_web_manifest_https.json
similarity index 100%
rename from dom/base/test/csp/file_CSP_web_manifest_https.json
rename to dom/security/test/csp/file_web_manifest_https.json
diff --git a/dom/base/test/csp/file_CSP_web_manifest_mixed_content.html b/dom/security/test/csp/file_web_manifest_mixed_content.html
similarity index 54%
rename from dom/base/test/csp/file_CSP_web_manifest_mixed_content.html
rename to dom/security/test/csp/file_web_manifest_mixed_content.html
index 201bfc4963b1..55f17c0f929d 100644
--- a/dom/base/test/csp/file_CSP_web_manifest_mixed_content.html
+++ b/dom/security/test/csp/file_web_manifest_mixed_content.html
@@ -3,7 +3,7 @@
 <head>
 <link
   rel="manifest"
-  href="http://example.org/tests/dom/base/test/csp/file_csp_testserver.sjs?file=/test/dom/base/test/csp/file_CSP_web_manifest.json&amp;cors=*">
+  href="http://example.org/tests/dom/security/test/csp/file_testserver.sjs?file=/test/dom/security/test/csp/file_web_manifest.json&amp;cors=*">
 </head>
 <h1>Support Page for Web Manifest Tests</h1>
 <p>Used to try to load a resource over an insecure connection to trigger mixed content blocking.</p>
\ No newline at end of file
diff --git a/dom/base/test/csp/file_CSP_web_manifest_remote.html b/dom/security/test/csp/file_web_manifest_remote.html
similarity index 60%
rename from dom/base/test/csp/file_CSP_web_manifest_remote.html
rename to dom/security/test/csp/file_web_manifest_remote.html
index 4a3397874bd3..7ecf8eec43dd 100644
--- a/dom/base/test/csp/file_CSP_web_manifest_remote.html
+++ b/dom/security/test/csp/file_web_manifest_remote.html
@@ -2,7 +2,7 @@
 <meta charset=utf-8>
 <link rel="manifest"
       crossorigin
-	  href="//mochi.test:8888/tests/dom/base/test/csp/file_csp_testserver.sjs?file=/tests/dom/base/test/csp/file_CSP_web_manifest.json&amp;cors=*">
+	  href="//mochi.test:8888/tests/dom/security/test/csp/file_testserver.sjs?file=/tests/dom/security/test/csp/file_web_manifest.json&amp;cors=*">
 
 <h1>Support Page for Web Manifest Tests</h1>
 <p>Loads a manifest from mochi.test:8888 with CORS set to "*".</p>
\ No newline at end of file
diff --git a/dom/base/test/csp/file_worker_redirect.html b/dom/security/test/csp/file_worker_redirect.html
similarity index 100%
rename from dom/base/test/csp/file_worker_redirect.html
rename to dom/security/test/csp/file_worker_redirect.html
diff --git a/dom/base/test/csp/file_worker_redirect.sjs b/dom/security/test/csp/file_worker_redirect.sjs
similarity index 91%
rename from dom/base/test/csp/file_worker_redirect.sjs
rename to dom/security/test/csp/file_worker_redirect.sjs
index 52453136784e..6c4acd6e7a27 100644
--- a/dom/base/test/csp/file_worker_redirect.sjs
+++ b/dom/security/test/csp/file_worker_redirect.sjs
@@ -24,7 +24,7 @@ function handleRequest(request, response)
 
   if (query === "stage_2_redirect_imported_script") {
     var newLocation =
-      "http://test1.example.com/tests/dom/base/test/csp/file_worker_redirect.sjs?stage_3_target_script";
+      "http://test1.example.com/tests/dom/security/test/csp/file_worker_redirect.sjs?stage_3_target_script";
     response.setStatusLine("1.1", 302, "Found");
     response.setHeader("Location", newLocation, false);
     return;
diff --git a/dom/base/test/csp/mochitest.ini b/dom/security/test/csp/mochitest.ini
similarity index 54%
rename from dom/base/test/csp/mochitest.ini
rename to dom/security/test/csp/mochitest.ini
index 0c371f8a633f..b04b5c32be83 100644
--- a/dom/base/test/csp/mochitest.ini
+++ b/dom/security/test/csp/mochitest.ini
@@ -6,50 +6,50 @@ support-files =
   file_connect-src-fetch.html
   file_CSP.css
   file_CSP.sjs
-  file_csp_allow_https_schemes.html
-  file_CSP_bug663567.xsl
-  file_CSP_bug663567_allows.xml
-  file_CSP_bug663567_allows.xml^headers^
-  file_CSP_bug663567_blocks.xml
-  file_CSP_bug663567_blocks.xml^headers^
-  file_CSP_bug802872.html
-  file_CSP_bug802872.html^headers^
-  file_CSP_bug802872.js
-  file_CSP_bug802872.sjs
-  file_CSP_bug885433_allows.html
-  file_CSP_bug885433_allows.html^headers^
-  file_CSP_bug885433_blocks.html
-  file_CSP_bug885433_blocks.html^headers^
-  file_CSP_bug888172.html
-  file_CSP_bug888172.sjs
-  file_CSP_evalscript_main.js
-  file_CSP_evalscript_main_allowed.js
-  file_CSP_evalscript_main.html
-  file_CSP_evalscript_main.html^headers^
-  file_CSP_evalscript_main_allowed.html
-  file_CSP_evalscript_main_allowed.html^headers^
-  file_CSP_frameancestors_main.html
-  file_CSP_frameancestors_main.js
-  file_CSP_frameancestors.sjs
-  file_CSP_inlinescript_main.html
-  file_CSP_inlinescript_main.html^headers^
-  file_CSP_inlinescript_main_allowed.html
-  file_CSP_inlinescript_main_allowed.html^headers^
-  file_CSP_inlinestyle_main.html
-  file_CSP_inlinestyle_main.html^headers^
-  file_CSP_inlinestyle_main_allowed.html
-  file_CSP_inlinestyle_main_allowed.html^headers^
-  file_csp_invalid_source_expression.html
-  file_CSP_main.html
-  file_CSP_main.html^headers^
-  file_CSP_main.js
-  file_CSP_web_manifest.html
-  file_CSP_web_manifest_remote.html
-  file_CSP_web_manifest_https.html
-  file_CSP_web_manifest.json
-  file_CSP_web_manifest.json^headers^
-  file_CSP_web_manifest_https.json
-  file_CSP_web_manifest_mixed_content.html
+  file_allow_https_schemes.html
+  file_bug663567.xsl
+  file_bug663567_allows.xml
+  file_bug663567_allows.xml^headers^
+  file_bug663567_blocks.xml
+  file_bug663567_blocks.xml^headers^
+  file_bug802872.html
+  file_bug802872.html^headers^
+  file_bug802872.js
+  file_bug802872.sjs
+  file_bug885433_allows.html
+  file_bug885433_allows.html^headers^
+  file_bug885433_blocks.html
+  file_bug885433_blocks.html^headers^
+  file_bug888172.html
+  file_bug888172.sjs
+  file_evalscript_main.js
+  file_evalscript_main_allowed.js
+  file_evalscript_main.html
+  file_evalscript_main.html^headers^
+  file_evalscript_main_allowed.html
+  file_evalscript_main_allowed.html^headers^
+  file_frameancestors_main.html
+  file_frameancestors_main.js
+  file_frameancestors.sjs
+  file_inlinescript_main.html
+  file_inlinescript_main.html^headers^
+  file_inlinescript_main_allowed.html
+  file_inlinescript_main_allowed.html^headers^
+  file_inlinestyle_main.html
+  file_inlinestyle_main.html^headers^
+  file_inlinestyle_main_allowed.html
+  file_inlinestyle_main_allowed.html^headers^
+  file_invalid_source_expression.html
+  file_main.html
+  file_main.html^headers^
+  file_main.js
+  file_web_manifest.html
+  file_web_manifest_remote.html
+  file_web_manifest_https.html
+  file_web_manifest.json
+  file_web_manifest.json^headers^
+  file_web_manifest_https.json
+  file_web_manifest_mixed_content.html
   file_bug836922_npolicies.html
   file_bug836922_npolicies.html^headers^
   file_bug836922_npolicies_ro_violation.sjs
@@ -66,28 +66,28 @@ support-files =
   file_bug886164_5.html^headers^
   file_bug886164_6.html
   file_bug886164_6.html^headers^
-  file_csp_bug768029.html
-  file_csp_bug768029.sjs
-  file_csp_bug773891.html
-  file_csp_bug773891.sjs
-  file_csp_redirects_main.html
-  file_csp_redirects_page.sjs
-  file_csp_redirects_resource.sjs
-  file_CSP_bug910139.sjs
-  file_CSP_bug910139.xml
-  file_CSP_bug910139.xsl
-  file_CSP_bug909029_star.html
-  file_CSP_bug909029_star.html^headers^
-  file_CSP_bug909029_none.html
-  file_CSP_bug909029_none.html^headers^
+  file_bug768029.html
+  file_bug768029.sjs
+  file_bug773891.html
+  file_bug773891.sjs
+  file_redirects_main.html
+  file_redirects_page.sjs
+  file_redirects_resource.sjs
+  file_bug910139.sjs
+  file_bug910139.xml
+  file_bug910139.xsl
+  file_bug909029_star.html
+  file_bug909029_star.html^headers^
+  file_bug909029_none.html
+  file_bug909029_none.html^headers^
   file_policyuri_regression_from_multipolicy.html
   file_policyuri_regression_from_multipolicy.html^headers^
   file_policyuri_regression_from_multipolicy_policy
   file_nonce_source.html
   file_nonce_source.html^headers^
-  file_CSP_bug941404.html
-  file_CSP_bug941404_xhr.html
-  file_CSP_bug941404_xhr.html^headers^
+  file_bug941404.html
+  file_bug941404_xhr.html
+  file_bug941404_xhr.html^headers^
   file_hash_source.html
   file_dual_header_testserver.sjs
   file_hash_source.html^headers^
@@ -96,15 +96,15 @@ support-files =
   file_ignore_unsafe_inline.html
   file_self_none_as_hostname_confusion.html
   file_self_none_as_hostname_confusion.html^headers^
-  file_csp_path_matching.html
-  file_csp_path_matching_incl_query.html
-  file_csp_path_matching.js
-  file_csp_path_matching_redirect.html
-  file_csp_path_matching_redirect_server.sjs
-  file_csp_testserver.sjs
+  file_path_matching.html
+  file_path_matching_incl_query.html
+  file_path_matching.js
+  file_path_matching_redirect.html
+  file_path_matching_redirect_server.sjs
+  file_testserver.sjs
   file_report_uri_missing_in_report_only_header.html
   file_report_uri_missing_in_report_only_header.html^headers^
-  file_csp_report.html
+  file_report.html
   file_redirect_content.sjs
   file_redirect_report.sjs
   file_subframe_run_js_if_allowed.html
@@ -118,33 +118,33 @@ support-files =
   file_form-action.html
   file_worker_redirect.html
   file_worker_redirect.sjs
-  file_csp_referrerdirective.html
+  file_referrerdirective.html
   referrerdirective.sjs
 
 [test_base-uri.html]
 [test_blob_data_schemes.html]
 [test_connect-src.html]
 [test_CSP.html]
-[test_csp_allow_https_schemes.html]
+[test_allow_https_schemes.html]
 skip-if = buildapp == 'b2g' #no ssl support
-[test_CSP_bug663567.html]
-[test_CSP_bug802872.html]
-[test_CSP_bug885433.html]
-[test_CSP_bug888172.html]
-[test_CSP_evalscript.html]
-[test_CSP_frameancestors.html]
+[test_bug663567.html]
+[test_bug802872.html]
+[test_bug885433.html]
+[test_bug888172.html]
+[test_evalscript.html]
+[test_frameancestors.html]
 skip-if = (buildapp == 'b2g' && (toolkit != 'gonk' || debug)) || toolkit == 'android' # Times out, not sure why (bug 1008445)
-[test_CSP_inlinescript.html]
-[test_CSP_inlinestyle.html]
-[test_csp_invalid_source_expression.html]
+[test_inlinescript.html]
+[test_inlinestyle.html]
+[test_invalid_source_expression.html]
 [test_bug836922_npolicies.html]
 [test_bug886164.html]
-[test_csp_redirects.html]
-[test_CSP_bug910139.html]
-[test_CSP_bug909029.html]
+[test_redirects.html]
+[test_bug910139.html]
+[test_bug909029.html]
 [test_policyuri_regression_from_multipolicy.html]
 [test_nonce_source.html]
-[test_CSP_bug941404.html]
+[test_bug941404.html]
 [test_form-action.html]
 skip-if = e10s || buildapp == 'b2g' # http-on-opening-request observers are not available in child processes
 [test_hash_source.html]
@@ -154,10 +154,10 @@ skip-if = buildapp == 'b2g' #no ssl support
 [test_ignore_unsafe_inline.html]
 [test_self_none_as_hostname_confusion.html]
 [test_bug949549.html]
-[test_csp_path_matching.html]
-[test_csp_path_matching_redirect.html]
+[test_path_matching.html]
+[test_path_matching_redirect.html]
 [test_report_uri_missing_in_report_only_header.html]
-[test_csp_report.html]
+[test_report.html]
 skip-if = e10s || buildapp == 'b2g' # http-on-opening-request observer not supported in child process (bug 1009632)
 [test_301_redirect.html]
 skip-if = buildapp == 'b2g' # intermittent orange (bug 1028490)
@@ -171,7 +171,7 @@ skip-if = buildapp == 'b2g' # intermittent orange (bug 1028490)
 [test_leading_wildcard.html]
 [test_multi_policy_injection_bypass.html]
 [test_null_baseuri.html]
-[test_CSP_referrerdirective.html]
+[test_referrerdirective.html]
 skip-if = buildapp == 'b2g' #no ssl support
 [test_dual_header.html]
 [test_worker_redirect.html]
diff --git a/dom/base/test/csp/referrerdirective.sjs b/dom/security/test/csp/referrerdirective.sjs
similarity index 94%
rename from dom/base/test/csp/referrerdirective.sjs
rename to dom/security/test/csp/referrerdirective.sjs
index 7af65722fe70..f238ab45255e 100644
--- a/dom/base/test/csp/referrerdirective.sjs
+++ b/dom/security/test/csp/referrerdirective.sjs
@@ -17,7 +17,7 @@ function handleRequest(request, response) {
 
   if (request.hasHeader('Referer')) {
     var referrer = request.getHeader('Referer');
-    if (referrer.indexOf("file_csp_testserver.sjs") > -1) {
+    if (referrer.indexOf("file_testserver.sjs") > -1) {
       referrerLevel = "full";
     } else {
       referrerLevel = "origin";
diff --git a/dom/base/test/csp/test_301_redirect.html b/dom/security/test/csp/test_301_redirect.html
similarity index 100%
rename from dom/base/test/csp/test_301_redirect.html
rename to dom/security/test/csp/test_301_redirect.html
diff --git a/dom/base/test/csp/test_302_redirect.html b/dom/security/test/csp/test_302_redirect.html
similarity index 100%
rename from dom/base/test/csp/test_302_redirect.html
rename to dom/security/test/csp/test_302_redirect.html
diff --git a/dom/base/test/csp/test_303_redirect.html b/dom/security/test/csp/test_303_redirect.html
similarity index 100%
rename from dom/base/test/csp/test_303_redirect.html
rename to dom/security/test/csp/test_303_redirect.html
diff --git a/dom/base/test/csp/test_307_redirect.html b/dom/security/test/csp/test_307_redirect.html
similarity index 100%
rename from dom/base/test/csp/test_307_redirect.html
rename to dom/security/test/csp/test_307_redirect.html
diff --git a/dom/base/test/csp/test_CSP.html b/dom/security/test/csp/test_CSP.html
similarity index 98%
rename from dom/base/test/csp/test_CSP.html
rename to dom/security/test/csp/test_CSP.html
index d3a5b53b6532..2b508bd0d19a 100644
--- a/dom/base/test/csp/test_CSP.html
+++ b/dom/security/test/csp/test_CSP.html
@@ -110,7 +110,7 @@ SpecialPowers.pushPrefEnv(
     function() {
       // save this for last so that our listeners are registered.
       // ... this loads the testbed of good and bad requests.
-      document.getElementById('cspframe').src = 'file_CSP_main.html';
+      document.getElementById('cspframe').src = 'file_main.html';
     });
 </script>
 </pre>
diff --git a/dom/base/test/csp/test_csp_allow_https_schemes.html b/dom/security/test/csp/test_allow_https_schemes.html
similarity index 92%
rename from dom/base/test/csp/test_csp_allow_https_schemes.html
rename to dom/security/test/csp/test_allow_https_schemes.html
index a7784f5d2073..454687bc9bc2 100644
--- a/dom/base/test/csp/test_csp_allow_https_schemes.html
+++ b/dom/security/test/csp/test_allow_https_schemes.html
@@ -18,7 +18,7 @@ SimpleTest.waitForExplicitFinish();
 
 /* Description of the test:
  * We are loading the following url (including a fragment portion):
- *   https://example.com/tests/dom/base/test/csp/file_csp_path_matching.js#foo
+ *   https://example.com/tests/dom/security/test/csp/file_path_matching.js#foo
  * using different policies that lack specification of a scheme.
  *
  * Since the file is served over http:, the upgrade to https should be
@@ -40,9 +40,9 @@ function loadNextTest() {
   }
   else {
     policy = policies[counter++];
-    var src = "file_csp_testserver.sjs";
+    var src = "file_testserver.sjs";
     // append the file that should be served
-    src += "?file=" + escape("tests/dom/base/test/csp/file_csp_allow_https_schemes.html");
+    src += "?file=" + escape("tests/dom/security/test/csp/file_allow_https_schemes.html");
     // append the CSP that should be used to serve the file
     src += "&csp=" + escape("default-src 'none'; script-src " + policy[1]);
 
diff --git a/dom/base/test/csp/test_base-uri.html b/dom/security/test/csp/test_base-uri.html
similarity index 93%
rename from dom/base/test/csp/test_base-uri.html
rename to dom/security/test/csp/test_base-uri.html
index a19b759e0f7d..2d39bef9d27e 100644
--- a/dom/base/test/csp/test_base-uri.html
+++ b/dom/security/test/csp/test_base-uri.html
@@ -60,9 +60,9 @@ function loadNextTest() {
     window.BaseURIExaminer.remove();
     SimpleTest.finish();
   }
-  var src = "http://example.com/tests/dom/base/test/csp/file_csp_testserver.sjs";
+  var src = "http://example.com/tests/dom/security/test/csp/file_testserver.sjs";
   // append the file that should be served
-  src += "?file=" + escape("tests/dom/base/test/csp/file_base-uri.html");
+  src += "?file=" + escape("tests/dom/security/test/csp/file_base-uri.html");
   // append the CSP that should be used to serve the file
   src += "&csp=" + escape(testPolicies[counter]);
   document.getElementById("testframe").src = src;
diff --git a/dom/base/test/csp/test_blob_data_schemes.html b/dom/security/test/csp/test_blob_data_schemes.html
similarity index 94%
rename from dom/base/test/csp/test_blob_data_schemes.html
rename to dom/security/test/csp/test_blob_data_schemes.html
index a7820d1c6f33..37b327b102ea 100644
--- a/dom/base/test/csp/test_blob_data_schemes.html
+++ b/dom/security/test/csp/test_blob_data_schemes.html
@@ -72,9 +72,9 @@ function loadNextTest() {
   // reset the messageCounter to make sure we receive all the postMessages from the iframe
   messageCounter = 0;
 
-  var src = "file_csp_testserver.sjs";
+  var src = "file_testserver.sjs";
   // append the file that should be served
-  src += "?file=" + escape("tests/dom/base/test/csp/file_blob_data_schemes.html");
+  src += "?file=" + escape("tests/dom/security/test/csp/file_blob_data_schemes.html");
   // append the CSP that should be used to serve the file
   src += "&csp=" + escape(curTest.policy);
 
diff --git a/dom/base/test/csp/test_CSP_bug663567.html b/dom/security/test/csp/test_bug663567.html
similarity index 88%
rename from dom/base/test/csp/test_CSP_bug663567.html
rename to dom/security/test/csp/test_bug663567.html
index d61854726c19..293aa291492f 100644
--- a/dom/base/test/csp/test_CSP_bug663567.html
+++ b/dom/security/test/csp/test_bug663567.html
@@ -34,7 +34,7 @@ function checkAllowed () {
    *   Content-Security-Policy: default-src 'self'
    *
    *   we load the xsl file using:
-   *   <?xml-stylesheet type="text/xsl" href="file_CSP_bug663467.xsl"?>
+   *   <?xml-stylesheet type="text/xsl" href="file_bug663467.xsl"?>
    */
   try {
     var cspframe = document.getElementById('xsltframe');
@@ -52,7 +52,7 @@ function checkBlocked () {
    *   Content-Security-Policy: default-src *.example.com
    *
    *   we load the xsl file using:
-   *   <?xml-stylesheet type="text/xsl" href="file_CSP_bug663467.xsl"?>
+   *   <?xml-stylesheet type="text/xsl" href="file_bug663467.xsl"?>
    */
   try {
     var cspframe = document.getElementById('xsltframe2');
@@ -66,10 +66,10 @@ function checkBlocked () {
 }
 
 document.getElementById('xsltframe').addEventListener('load', checkAllowed, false);
-document.getElementById('xsltframe').src = 'file_CSP_bug663567_allows.xml';
+document.getElementById('xsltframe').src = 'file_bug663567_allows.xml';
 
 document.getElementById('xsltframe2').addEventListener('load', checkBlocked, false);
-document.getElementById('xsltframe2').src = 'file_CSP_bug663567_blocks.xml';
+document.getElementById('xsltframe2').src = 'file_bug663567_blocks.xml';
 
 </script>
 </body>
diff --git a/dom/base/test/csp/test_csp_bug768029.html b/dom/security/test/csp/test_bug768029.html
similarity index 96%
rename from dom/base/test/csp/test_csp_bug768029.html
rename to dom/security/test/csp/test_bug768029.html
index 3e867076f1d5..a6a7bb277796 100644
--- a/dom/base/test/csp/test_csp_bug768029.html
+++ b/dom/security/test/csp/test_bug768029.html
@@ -35,7 +35,7 @@ var gData = [
     app: "https://example.com/manifest.webapp",
     appStatus: Components.interfaces.nsIPrincipal.APP_STATUS_INSTALLED,
     origin: "https://example.com",
-    uri: "https://example.com/tests/dom/base/test/csp/file_csp_bug768029.html",
+    uri: "https://example.com/tests/dom/security/test/csp/file_bug768029.html",
     statusString: "installed app",
     expectedTestResults: {
       max_tests: 7, /* number of bools below plus one for the status check */
@@ -48,7 +48,7 @@ var gData = [
     app: "https://example.com/manifest_priv.webapp",
     appStatus: Components.interfaces.nsIPrincipal.APP_STATUS_PRIVILEGED,
     origin: "https://example.com",
-    uri: "https://example.com/tests/dom/base/test/csp/file_csp_bug768029.html",
+    uri: "https://example.com/tests/dom/security/test/csp/file_bug768029.html",
     statusString: "privileged app",
     expectedTestResults: {
       max_tests: 7, /* number of bools below plus one for the status check */
@@ -61,7 +61,7 @@ var gData = [
     app: "https://example.com/manifest_cert.webapp",
     appStatus: Components.interfaces.nsIPrincipal.APP_STATUS_CERTIFIED,
     origin: "https://example.com",
-    uri: "https://example.com/tests/dom/base/test/csp/file_csp_bug768029.html",
+    uri: "https://example.com/tests/dom/security/test/csp/file_bug768029.html",
     statusString: "certified app",
     expectedTestResults: {
       max_tests: 7, /* number of bools below plus one for the status check */
@@ -87,7 +87,7 @@ ThingyListener.prototype = {
 
   observe: function(subject, topic, data) {
     // make sure to only observe app-generated calls to the helper for this test.
-    var testpat = new RegExp("file_csp_bug768029\\.sjs");
+    var testpat = new RegExp("file_bug768029\\.sjs");
 
     // used to extract which kind of load this is (img, script, etc).
     var typepat = new RegExp("type=([\\_a-z0-9]+)");
diff --git a/dom/base/test/csp/test_csp_bug773891.html b/dom/security/test/csp/test_bug773891.html
similarity index 97%
rename from dom/base/test/csp/test_csp_bug773891.html
rename to dom/security/test/csp/test_bug773891.html
index beec40a86ef2..206708daca01 100644
--- a/dom/base/test/csp/test_csp_bug773891.html
+++ b/dom/security/test/csp/test_bug773891.html
@@ -41,7 +41,7 @@ var gData = [
     appStatus: Components.interfaces.nsIPrincipal.APP_STATUS_INSTALLED,
     csp: MANIFEST_CSP_INST,
     origin: "https://example.com",
-    uri: "https://example.com/tests/dom/base/test/csp/file_csp_bug773891.html",
+    uri: "https://example.com/tests/dom/security/test/csp/file_bug773891.html",
     statusString: "installed app",
     expectedTestResults: {
       max_tests: 7, /* number of bools below plus one for the status check */
@@ -54,7 +54,7 @@ var gData = [
     appStatus: Components.interfaces.nsIPrincipal.APP_STATUS_CERTIFIED,
     csp: MANIFEST_CSP_CERT,
     origin: "https://example.com",
-    uri: "https://example.com/tests/dom/base/test/csp/file_csp_bug773891.html",
+    uri: "https://example.com/tests/dom/security/test/csp/file_bug773891.html",
     statusString: "certified app",
     expectedTestResults: {
       max_tests: 7, /* number of bools below plus one for the status check */
@@ -67,7 +67,7 @@ var gData = [
     appStatus: Components.interfaces.nsIPrincipal.APP_STATUS_PRIVILEGED,
     csp: MANIFEST_CSP_PRIV,
     origin: "https://example.com",
-    uri: "https://example.com/tests/dom/base/test/csp/file_csp_bug773891.html",
+    uri: "https://example.com/tests/dom/security/test/csp/file_bug773891.html",
     statusString: "privileged app",
     expectedTestResults: {
       max_tests: 7, /* number of bools below plus one for the status check */
@@ -93,7 +93,7 @@ ThingyListener.prototype = {
 
   observe: function(subject, topic, data) {
     // make sure to only observe app-generated calls to the helper for this test.
-    var testpat = new RegExp("file_csp_bug773891\\.sjs");
+    var testpat = new RegExp("file_bug773891\\.sjs");
 
     // used to extract which kind of load this is (img, script, etc).
     var typepat = new RegExp("type=([\\_a-z0-9]+)");
diff --git a/dom/base/test/csp/test_CSP_bug802872.html b/dom/security/test/csp/test_bug802872.html
similarity index 95%
rename from dom/base/test/csp/test_CSP_bug802872.html
rename to dom/security/test/csp/test_bug802872.html
index 802a19ac3fa9..70584c14f343 100644
--- a/dom/base/test/csp/test_CSP_bug802872.html
+++ b/dom/security/test/csp/test_bug802872.html
@@ -46,7 +46,7 @@ addEventListener('blockedEventSrcCallbackFailed', function (e) {
 }, false);
 
 // load it
-document.getElementById('eventframe').src = 'file_CSP_bug802872.html';
+document.getElementById('eventframe').src = 'file_bug802872.html';
 
 </script>
 </body>
diff --git a/dom/base/test/csp/test_bug836922_npolicies.html b/dom/security/test/csp/test_bug836922_npolicies.html
similarity index 99%
rename from dom/base/test/csp/test_bug836922_npolicies.html
rename to dom/security/test/csp/test_bug836922_npolicies.html
index 5e3dbe1f91f9..f9ddfa9d497d 100644
--- a/dom/base/test/csp/test_bug836922_npolicies.html
+++ b/dom/security/test/csp/test_bug836922_npolicies.html
@@ -14,7 +14,7 @@
 <iframe style="width:200px;height:200px;" id='cspframe'></iframe>
 <script class="testbody" type="text/javascript">
 
-var path = "/tests/dom/base/test/csp/";
+var path = "/tests/dom/security/test/csp/";
 
 // These are test results: verified indicates whether or not the test has run.
 // true/false is the pass/fail result.
diff --git a/dom/base/test/csp/test_CSP_bug885433.html b/dom/security/test/csp/test_bug885433.html
similarity index 93%
rename from dom/base/test/csp/test_CSP_bug885433.html
rename to dom/security/test/csp/test_bug885433.html
index d216192f8b10..22db0ed24a5a 100644
--- a/dom/base/test/csp/test_CSP_bug885433.html
+++ b/dom/security/test/csp/test_bug885433.html
@@ -35,7 +35,7 @@ function checkAllowed () {
   color = window.getComputedStyle(cspframe.contentDocument.getElementById('unsafe-inline-style-allowed')).color;
   ok(color === green, "Inline style should be allowed");
 
-  document.getElementById('cspframe2').src = 'file_CSP_bug885433_blocks.html';
+  document.getElementById('cspframe2').src = 'file_bug885433_blocks.html';
   document.getElementById('cspframe2').addEventListener('load', checkBlocked, false);
 }
 
@@ -53,7 +53,7 @@ function checkBlocked () {
   SimpleTest.finish();
 }
 
-document.getElementById('cspframe').src = 'file_CSP_bug885433_allows.html';
+document.getElementById('cspframe').src = 'file_bug885433_allows.html';
 document.getElementById('cspframe').addEventListener('load', checkAllowed, false);
 </script>
 </pre>
diff --git a/dom/base/test/csp/test_bug886164.html b/dom/security/test/csp/test_bug886164.html
similarity index 99%
rename from dom/base/test/csp/test_bug886164.html
rename to dom/security/test/csp/test_bug886164.html
index 2c46f75381b9..74fd98458198 100644
--- a/dom/base/test/csp/test_bug886164.html
+++ b/dom/security/test/csp/test_bug886164.html
@@ -19,7 +19,7 @@
 <script class="testbody" type="text/javascript">
 
 
-var path = "/tests/dom/base/test/csp/";
+var path = "/tests/dom/security/test/csp/";
 
 // These are test results: -1 means it hasn't run,
 // true/false is the pass/fail result.
diff --git a/dom/base/test/csp/test_CSP_bug888172.html b/dom/security/test/csp/test_bug888172.html
similarity index 92%
rename from dom/base/test/csp/test_CSP_bug888172.html
rename to dom/security/test/csp/test_bug888172.html
index b9aa574afe7f..200e8c94238e 100644
--- a/dom/base/test/csp/test_CSP_bug888172.html
+++ b/dom/security/test/csp/test_bug888172.html
@@ -36,7 +36,7 @@ function checkDefaultSrcOnly() {
   ok(getElementColorById(testframe, 'unsafe-eval-script')  === green, "Eval should be allowed");
   ok(getElementColorById(testframe, 'unsafe-inline-style') === green, "Inline style should be allowed");
 
-  document.getElementById('testframe2').src = 'file_CSP_bug888172.sjs?csp=' +
+  document.getElementById('testframe2').src = 'file_bug888172.sjs?csp=' +
     escape("default-src 'self' 'unsafe-inline' 'unsafe-eval'; script-src 'self'");
   document.getElementById('testframe2').addEventListener('load', checkDefaultSrcWithScriptSrc, false);
 }
@@ -48,7 +48,7 @@ function checkDefaultSrcWithScriptSrc() {
   ok(getElementColorById(testframe, 'unsafe-eval-script')  === black, "Eval should be blocked");
   ok(getElementColorById(testframe, 'unsafe-inline-style') === green, "Inline style should be allowed");
 
-  document.getElementById('testframe3').src = 'file_CSP_bug888172.sjs?csp=' +
+  document.getElementById('testframe3').src = 'file_bug888172.sjs?csp=' +
     escape("default-src 'self' 'unsafe-inline' 'unsafe-eval'; style-src 'self'");
   document.getElementById('testframe3').addEventListener('load', checkDefaultSrcWithStyleSrc, false);
 }
@@ -64,7 +64,7 @@ function checkDefaultSrcWithStyleSrc() {
   SimpleTest.finish();
 }
 
-document.getElementById('testframe1').src = 'file_CSP_bug888172.sjs?csp=' +
+document.getElementById('testframe1').src = 'file_bug888172.sjs?csp=' +
   escape("default-src 'self' 'unsafe-inline' 'unsafe-eval'");
 document.getElementById('testframe1').addEventListener('load', checkDefaultSrcOnly, false);
 </script>
diff --git a/dom/base/test/csp/test_CSP_bug909029.html b/dom/security/test/csp/test_bug909029.html
similarity index 96%
rename from dom/base/test/csp/test_CSP_bug909029.html
rename to dom/security/test/csp/test_bug909029.html
index e682a864a4e2..aebfabf48592 100644
--- a/dom/base/test/csp/test_CSP_bug909029.html
+++ b/dom/security/test/csp/test_bug909029.html
@@ -120,9 +120,9 @@ function checkInlineWithNone() {
                     "Inline scripts should be blocked (style-src 'unsafe-inline' with none)");
 }
 
-document.getElementById('testframe1').src = 'file_CSP_bug909029_star.html';
+document.getElementById('testframe1').src = 'file_bug909029_star.html';
 document.getElementById('testframe1').addEventListener('load', checkInlineWithStar, false);
-document.getElementById('testframe2').src = 'file_CSP_bug909029_none.html';
+document.getElementById('testframe2').src = 'file_bug909029_none.html';
 document.getElementById('testframe2').addEventListener('load', checkInlineWithNone, false);
     </script>
   </body>
diff --git a/dom/base/test/csp/test_CSP_bug910139.html b/dom/security/test/csp/test_bug910139.html
similarity index 87%
rename from dom/base/test/csp/test_CSP_bug910139.html
rename to dom/security/test/csp/test_bug910139.html
index b784266dbbbd..63a7f77d1e68 100644
--- a/dom/base/test/csp/test_CSP_bug910139.html
+++ b/dom/security/test/csp/test_bug910139.html
@@ -24,7 +24,7 @@ function checkAllowed () {
    *   Content-Security-Policy: default-src 'self'; script-src 'self'
    *
    *   we load the xsl file using:
-   *   <?xml-stylesheet type="text/xsl" href="file_CSP_bug910139.xsl"?>
+   *   <?xml-stylesheet type="text/xsl" href="file_bug910139.xsl"?>
    */
   try {
     var cspframe = document.getElementById('xsltframe');
@@ -37,7 +37,7 @@ function checkAllowed () {
 
   // continue with the next test
   document.getElementById('xsltframe2').addEventListener('load', checkBlocked, false);
-  document.getElementById('xsltframe2').src = 'file_CSP_bug910139.sjs';
+  document.getElementById('xsltframe2').src = 'file_bug910139.sjs';
 }
 
 function checkBlocked () {
@@ -45,7 +45,7 @@ function checkBlocked () {
    *   Content-Security-Policy: default-src 'self'; script-src *.example.com
    *
    *   we load the xsl file using:
-   *   <?xml-stylesheet type="text/xsl" href="file_CSP_bug910139.xsl"?>
+   *   <?xml-stylesheet type="text/xsl" href="file_bug910139.xsl"?>
    */
   try {
     var cspframe = document.getElementById('xsltframe2');
@@ -59,7 +59,7 @@ function checkBlocked () {
 }
 
 document.getElementById('xsltframe').addEventListener('load', checkAllowed, false);
-document.getElementById('xsltframe').src = 'file_CSP_bug910139.sjs';
+document.getElementById('xsltframe').src = 'file_bug910139.sjs';
 
 </script>
 </body>
diff --git a/dom/base/test/csp/test_CSP_bug941404.html b/dom/security/test/csp/test_bug941404.html
similarity index 96%
rename from dom/base/test/csp/test_CSP_bug941404.html
rename to dom/security/test/csp/test_bug941404.html
index 0735d3a71e89..07f45d176959 100644
--- a/dom/base/test/csp/test_CSP_bug941404.html
+++ b/dom/security/test/csp/test_bug941404.html
@@ -17,7 +17,7 @@
 <script class="testbody" type="text/javascript">
 
 
-var path = "/tests/dom/base/test/csp/";
+var path = "/tests/dom/security/test/csp/";
 
 // These are test results: -1 means it hasn't run,
 // true/false is the pass/fail result.
@@ -99,7 +99,7 @@ SimpleTest.waitForExplicitFinish();
 
 // save this for last so that our listeners are registered.
 // ... this loads the testbed of good and bad requests.
-document.getElementById('cspframe').src = 'file_CSP_bug941404.html';
+document.getElementById('cspframe').src = 'file_bug941404.html';
 
 </script>
 </pre>
diff --git a/dom/base/test/csp/test_bug949549.html b/dom/security/test/csp/test_bug949549.html
similarity index 100%
rename from dom/base/test/csp/test_bug949549.html
rename to dom/security/test/csp/test_bug949549.html
diff --git a/dom/base/test/csp/test_connect-src.html b/dom/security/test/csp/test_connect-src.html
similarity index 94%
rename from dom/base/test/csp/test_connect-src.html
rename to dom/security/test/csp/test_connect-src.html
index 74f101e2ecd8..5e42d9838141 100644
--- a/dom/base/test/csp/test_connect-src.html
+++ b/dom/security/test/csp/test_connect-src.html
@@ -78,7 +78,7 @@ examiner.prototype  = {
    if (topic === "specialpowers-http-notify-request") {
       // making sure we do not bubble a result for something other
       // then the request in question.
-      if (!data.includes("file_csp_testserver.sjs?foo")) {
+      if (!data.includes("file_testserver.sjs?foo")) {
         return;
       }
       checkResult("allowed");
@@ -91,7 +91,7 @@ examiner.prototype  = {
                         SpecialPowers.do_QueryInterface(subject, "nsIURI"),
                         "asciiSpec");
 
-      if (!asciiSpec.includes("file_csp_testserver.sjs?foo")) {
+      if (!asciiSpec.includes("file_testserver.sjs?foo")) {
         return;
       }
       checkResult("blocked");
@@ -112,9 +112,9 @@ function loadNextTest() {
     return;
   }
 
-  var src = "file_csp_testserver.sjs";
+  var src = "file_testserver.sjs";
   // append the file that should be served
-  src += "?file=" + escape("tests/dom/base/test/csp/" + tests[counter].file);
+  src += "?file=" + escape("tests/dom/security/test/csp/" + tests[counter].file);
   // append the CSP that should be used to serve the file
   src += "&csp=" + escape(tests[counter].policy);
 
diff --git a/dom/base/test/csp/test_dual_header.html b/dom/security/test/csp/test_dual_header.html
similarity index 100%
rename from dom/base/test/csp/test_dual_header.html
rename to dom/security/test/csp/test_dual_header.html
diff --git a/dom/base/test/csp/test_CSP_evalscript.html b/dom/security/test/csp/test_evalscript.html
similarity index 91%
rename from dom/base/test/csp/test_CSP_evalscript.html
rename to dom/security/test/csp/test_evalscript.html
index a5c1d6a43616..f0ec3407c9b9 100644
--- a/dom/base/test/csp/test_CSP_evalscript.html
+++ b/dom/security/test/csp/test_evalscript.html
@@ -51,8 +51,8 @@ SimpleTest.waitForExplicitFinish();
 
 // save this for last so that our listeners are registered.
 // ... this loads the testbed of good and bad requests.
-document.getElementById('cspframe').src = 'file_CSP_evalscript_main.html';
-document.getElementById('cspframe2').src = 'file_CSP_evalscript_main_allowed.html';
+document.getElementById('cspframe').src = 'file_evalscript_main.html';
+document.getElementById('cspframe2').src = 'file_evalscript_main_allowed.html';
 </script>
 </pre>
 </body>
diff --git a/dom/base/test/csp/test_form-action.html b/dom/security/test/csp/test_form-action.html
similarity index 96%
rename from dom/base/test/csp/test_form-action.html
rename to dom/security/test/csp/test_form-action.html
index 682e7a8d35f2..b909ca701969 100644
--- a/dom/base/test/csp/test_form-action.html
+++ b/dom/security/test/csp/test_form-action.html
@@ -88,9 +88,9 @@ function loadNextTest() {
     return;
   }
 
-  var src = "file_csp_testserver.sjs";
+  var src = "file_testserver.sjs";
   // append the file that should be served
-  src += "?file=" + escape("tests/dom/base/test/csp/" + tests[counter].page);
+  src += "?file=" + escape("tests/dom/security/test/csp/" + tests[counter].page);
   // append the CSP that should be used to serve the file
   src += "&csp=" + escape(tests[counter].policy);
 
diff --git a/dom/base/test/csp/test_CSP_frameancestors.html b/dom/security/test/csp/test_frameancestors.html
similarity index 97%
rename from dom/base/test/csp/test_CSP_frameancestors.html
rename to dom/security/test/csp/test_frameancestors.html
index 87842f7800cf..8ccbc81566df 100644
--- a/dom/base/test/csp/test_CSP_frameancestors.html
+++ b/dom/security/test/csp/test_frameancestors.html
@@ -73,7 +73,7 @@ examiner.prototype  = {
       // skip checks on the test harness -- can't do this skipping for
       // cross-origin blocking since the observer doesn't get the URI.  This
       // can cause this test to over-succeed (but only in specific cases).
-      if (asciiSpec.includes("test_CSP_frameancestors.html")) {
+      if (asciiSpec.includes("test_frameancestors.html")) {
         return;
       }
     } catch (ex) {
@@ -149,7 +149,7 @@ SimpleTest.waitForExplicitFinish();
 
 // save this for last so that our listeners are registered.
 // ... this loads the testbed of good and bad requests.
-document.getElementById('cspframe').src = 'file_CSP_frameancestors_main.html';
+document.getElementById('cspframe').src = 'file_frameancestors_main.html';
 
 </script>
 </pre>
diff --git a/dom/base/test/csp/test_hash_source.html b/dom/security/test/csp/test_hash_source.html
similarity index 100%
rename from dom/base/test/csp/test_hash_source.html
rename to dom/security/test/csp/test_hash_source.html
diff --git a/dom/base/test/csp/test_ignore_unsafe_inline.html b/dom/security/test/csp/test_ignore_unsafe_inline.html
similarity index 97%
rename from dom/base/test/csp/test_ignore_unsafe_inline.html
rename to dom/security/test/csp/test_ignore_unsafe_inline.html
index 04cb27858f8f..915eba62d836 100644
--- a/dom/base/test/csp/test_ignore_unsafe_inline.html
+++ b/dom/security/test/csp/test_ignore_unsafe_inline.html
@@ -75,9 +75,9 @@ function loadNextTest() {
   }
 
   curTest = tests[counter++];
-  var src = "file_csp_testserver.sjs?file=";
+  var src = "file_testserver.sjs?file=";
   // append the file that should be served
-  src += escape("tests/dom/base/test/csp/" + curTest.file);
+  src += escape("tests/dom/security/test/csp/" + curTest.file);
 
   // append the CSP that should be used to serve the file
   src += "&csp=" + escape(curTest.policy);
diff --git a/dom/base/test/csp/test_CSP_inlinescript.html b/dom/security/test/csp/test_inlinescript.html
similarity index 95%
rename from dom/base/test/csp/test_CSP_inlinescript.html
rename to dom/security/test/csp/test_inlinescript.html
index 746e408477cc..31ddf60d1a6c 100644
--- a/dom/base/test/csp/test_CSP_inlinescript.html
+++ b/dom/security/test/csp/test_inlinescript.html
@@ -103,9 +103,9 @@ function clickit2() {
 
 // save this for last so that our listeners are registered.
 // ... this loads the testbed of good and bad requests.
-document.getElementById('cspframe1').src = 'file_CSP_inlinescript_main.html';
+document.getElementById('cspframe1').src = 'file_inlinescript_main.html';
 document.getElementById('cspframe1').addEventListener('load', clickit1, false);
-document.getElementById('cspframe2').src = 'file_CSP_inlinescript_main_allowed.html';
+document.getElementById('cspframe2').src = 'file_inlinescript_main_allowed.html';
 document.getElementById('cspframe2').addEventListener('load', clickit2, false);
 </script>
 </pre>
diff --git a/dom/base/test/csp/test_CSP_inlinestyle.html b/dom/security/test/csp/test_inlinestyle.html
similarity index 97%
rename from dom/base/test/csp/test_CSP_inlinestyle.html
rename to dom/security/test/csp/test_inlinestyle.html
index 22e9ba35a895..eadcf1e387d4 100644
--- a/dom/base/test/csp/test_CSP_inlinestyle.html
+++ b/dom/security/test/csp/test_inlinestyle.html
@@ -96,9 +96,9 @@ function checkIfDone() {
 
 // save this for last so that our listeners are registered.
 // ... this loads the testbed of good and bad requests.
-document.getElementById('cspframe1').src = 'file_CSP_inlinestyle_main.html';
+document.getElementById('cspframe1').src = 'file_inlinestyle_main.html';
 document.getElementById('cspframe1').addEventListener('load', checkStyles, false);
-document.getElementById('cspframe2').src = 'file_CSP_inlinestyle_main_allowed.html';
+document.getElementById('cspframe2').src = 'file_inlinestyle_main_allowed.html';
 document.getElementById('cspframe2').addEventListener('load', checkStylesAllowed, false);
 
 </script>
diff --git a/dom/base/test/csp/test_csp_invalid_source_expression.html b/dom/security/test/csp/test_invalid_source_expression.html
similarity index 94%
rename from dom/base/test/csp/test_csp_invalid_source_expression.html
rename to dom/security/test/csp/test_invalid_source_expression.html
index 8118d1c9a7f7..ad0b3499985b 100644
--- a/dom/base/test/csp/test_csp_invalid_source_expression.html
+++ b/dom/security/test/csp/test_invalid_source_expression.html
@@ -27,9 +27,9 @@ SimpleTest.waitForExplicitFinish();
 const policy = "script-src bankid:/*";
 
 function runTest() {
-  var src = "file_csp_testserver.sjs";
+  var src = "file_testserver.sjs";
   // append the file that should be served
-  src += "?file=" + escape("tests/dom/base/test/csp/file_csp_invalid_source_expression.html");
+  src += "?file=" + escape("tests/dom/security/test/csp/file_invalid_source_expression.html");
   // append the CSP that should be used to serve the file
   src += "&csp=" + escape(policy);
 
diff --git a/dom/base/test/csp/test_leading_wildcard.html b/dom/security/test/csp/test_leading_wildcard.html
similarity index 96%
rename from dom/base/test/csp/test_leading_wildcard.html
rename to dom/security/test/csp/test_leading_wildcard.html
index 59903d3fbf1e..81c9f58ecedf 100644
--- a/dom/base/test/csp/test_leading_wildcard.html
+++ b/dom/security/test/csp/test_leading_wildcard.html
@@ -84,9 +84,9 @@ examiner.prototype  = {
 window.wildCardExaminer = new examiner();
 
 function runTest() {
-  var src = "file_csp_testserver.sjs";
+  var src = "file_testserver.sjs";
   // append the file that should be served
-  src += "?file=" + escape("tests/dom/base/test/csp/file_leading_wildcard.html");
+  src += "?file=" + escape("tests/dom/security/test/csp/file_leading_wildcard.html");
   // append the CSP that should be used to serve the file
   src += "&csp=" + escape(policy);
 
diff --git a/dom/base/test/csp/test_multi_policy_injection_bypass.html b/dom/security/test/csp/test_multi_policy_injection_bypass.html
similarity index 98%
rename from dom/base/test/csp/test_multi_policy_injection_bypass.html
rename to dom/security/test/csp/test_multi_policy_injection_bypass.html
index 4db4392d466f..83a9fa26506f 100644
--- a/dom/base/test/csp/test_multi_policy_injection_bypass.html
+++ b/dom/security/test/csp/test_multi_policy_injection_bypass.html
@@ -19,7 +19,7 @@ https://bugzilla.mozilla.org/show_bug.cgi?id=717511
 <iframe style="width:200px;height:200px;" id='cspframe2'></iframe>
 <script class="testbody" type="text/javascript">
 
-var path = "/tests/dom/base/test/";
+var path = "/tests/dom/security/test/csp/";
 
 // These are test results: -1 means it hasn't run,
 // true/false is the pass/fail result.
diff --git a/dom/base/test/csp/test_nonce_source.html b/dom/security/test/csp/test_nonce_source.html
similarity index 100%
rename from dom/base/test/csp/test_nonce_source.html
rename to dom/security/test/csp/test_nonce_source.html
diff --git a/dom/base/test/csp/test_null_baseuri.html b/dom/security/test/csp/test_null_baseuri.html
similarity index 94%
rename from dom/base/test/csp/test_null_baseuri.html
rename to dom/security/test/csp/test_null_baseuri.html
index 88cc915f0152..4592d582f4a3 100644
--- a/dom/base/test/csp/test_null_baseuri.html
+++ b/dom/security/test/csp/test_null_baseuri.html
@@ -48,9 +48,9 @@ function receiveMessage(event)
 }
 
 function startTest() {
-  var src = "file_csp_testserver.sjs";
+  var src = "file_testserver.sjs";
   // append the file that should be served
-  src += "?file=" + escape("tests/dom/base/test/csp/file_null_baseuri.html");
+  src += "?file=" + escape("tests/dom/security/test/csp/file_null_baseuri.html");
   // using 'unsafe-inline' since we load the testcase using an inline script
   // within file_null_baseuri.html
   src += "&csp=" + escape("default-src * 'unsafe-inline';");
diff --git a/dom/base/test/csp/test_csp_path_matching.html b/dom/security/test/csp/test_path_matching.html
similarity index 63%
rename from dom/base/test/csp/test_csp_path_matching.html
rename to dom/security/test/csp/test_path_matching.html
index f84a90a4cea7..e02751803cab 100644
--- a/dom/base/test/csp/test_csp_path_matching.html
+++ b/dom/security/test/csp/test_path_matching.html
@@ -18,7 +18,7 @@ SimpleTest.waitForExplicitFinish();
 
 /* Description of the test:
  * We are loading the following url (including a fragment portion):
- * http://test1.example.com/tests/dom/base/test/csp/file_csp_path_matching.js#foo
+ * http://test1.example.com/tests/dom/security/test/csp/file_path_matching.js#foo
  * using different policies and verify that the applied policy is accurately enforced.
  */
 
@@ -27,47 +27,47 @@ var policies = [
   ["allowed", "http://*"], // test for bug 1075230, enforcing scheme and wildcard
   ["allowed", "test1.example.com"],
   ["allowed", "test1.example.com/"],
-  ["allowed", "test1.example.com/tests/dom/base/test/csp/"],
-  ["allowed", "test1.example.com/tests/dom/base/test/csp/file_csp_path_matching.js"],
+  ["allowed", "test1.example.com/tests/dom/security/test/csp/"],
+  ["allowed", "test1.example.com/tests/dom/security/test/csp/file_path_matching.js"],
 
   ["allowed", "test1.example.com?foo=val"],
   ["allowed", "test1.example.com/?foo=val"],
-  ["allowed", "test1.example.com/tests/dom/base/test/csp/?foo=val"],
-  ["allowed", "test1.example.com/tests/dom/base/test/csp/file_csp_path_matching.js?foo=val"],
+  ["allowed", "test1.example.com/tests/dom/security/test/csp/?foo=val"],
+  ["allowed", "test1.example.com/tests/dom/security/test/csp/file_path_matching.js?foo=val"],
 
   ["allowed", "test1.example.com#foo"],
   ["allowed", "test1.example.com/#foo"],
-  ["allowed", "test1.example.com/tests/dom/base/test/csp/#foo"],
-  ["allowed", "test1.example.com/tests/dom/base/test/csp/file_csp_path_matching.js#foo"],
+  ["allowed", "test1.example.com/tests/dom/security/test/csp/#foo"],
+  ["allowed", "test1.example.com/tests/dom/security/test/csp/file_path_matching.js#foo"],
 
   ["allowed", "*.example.com"],
   ["allowed", "*.example.com/"],
-  ["allowed", "*.example.com/tests/dom/base/test/csp/"],
-  ["allowed", "*.example.com/tests/dom/base/test/csp/file_csp_path_matching.js"],
+  ["allowed", "*.example.com/tests/dom/security/test/csp/"],
+  ["allowed", "*.example.com/tests/dom/security/test/csp/file_path_matching.js"],
 
   ["allowed", "test1.example.com:80"],
   ["allowed", "test1.example.com:80/"],
-  ["allowed", "test1.example.com:80/tests/dom/base/test/csp/"],
-  ["allowed", "test1.example.com:80/tests/dom/base/test/csp/file_csp_path_matching.js"],
+  ["allowed", "test1.example.com:80/tests/dom/security/test/csp/"],
+  ["allowed", "test1.example.com:80/tests/dom/security/test/csp/file_path_matching.js"],
 
   ["allowed", "test1.example.com:*"],
   ["allowed", "test1.example.com:*/"],
-  ["allowed", "test1.example.com:*/tests/dom/base/test/csp/"],
-  ["allowed", "test1.example.com:*/tests/dom/base/test/csp/file_csp_path_matching.js"],
+  ["allowed", "test1.example.com:*/tests/dom/security/test/csp/"],
+  ["allowed", "test1.example.com:*/tests/dom/security/test/csp/file_path_matching.js"],
 
   ["blocked", "test1.example.com/tests"],
-  ["blocked", "test1.example.com/tests/dom/base/test/csp"],
-  ["blocked", "test1.example.com/tests/dom/base/test/csp/file_csp_path_matching.py"],
+  ["blocked", "test1.example.com/tests/dom/security/test/csp"],
+  ["blocked", "test1.example.com/tests/dom/security/test/csp/file_path_matching.py"],
 
   ["blocked", "test1.example.com:8888/tests"],
-  ["blocked", "test1.example.com:8888/tests/dom/base/test/csp"],
-  ["blocked", "test1.example.com:8888/tests/dom/base/test/csp/file_csp_path_matching.py"],
+  ["blocked", "test1.example.com:8888/tests/dom/security/test/csp"],
+  ["blocked", "test1.example.com:8888/tests/dom/security/test/csp/file_path_matching.py"],
 
   // case insensitive matching for scheme and host, but case sensitive matching for paths
   ["allowed", "HTTP://test1.EXAMPLE.com/tests/"],
   ["allowed", "test1.EXAMPLE.com/tests/"],
-  ["blocked", "test1.example.com/tests/dom/base/test/CSP/?foo=val"],
-  ["blocked", "test1.example.com/tests/dom/base/test/csp/FILE_csp_path_matching.js?foo=val"],
+  ["blocked", "test1.example.com/tests/dom/security/test/CSP/?foo=val"],
+  ["blocked", "test1.example.com/tests/dom/security/test/csp/FILE_path_matching.js?foo=val"],
 ]
 
 var counter = 0;
@@ -79,13 +79,13 @@ function loadNextTest() {
   }
   else {
     policy = policies[counter++];
-    var src = "file_csp_testserver.sjs?file=";
+    var src = "file_testserver.sjs?file=";
     // append the file that should be served
     src += (counter % 2 == 0)
                // load url including ref: example.com#foo
-             ? escape("tests/dom/base/test/csp/file_csp_path_matching.html")
+             ? escape("tests/dom/security/test/csp/file_path_matching.html")
                // load url including query: example.com?val=foo (bug 1147026)
-             : escape("tests/dom/base/test/csp/file_csp_path_matching_incl_query.html");
+             : escape("tests/dom/security/test/csp/file_path_matching_incl_query.html");
 
     // append the CSP that should be used to serve the file
     src += "&csp=" + escape("default-src 'none'; script-src " + policy[1]);
diff --git a/dom/base/test/csp/test_csp_path_matching_redirect.html b/dom/security/test/csp/test_path_matching_redirect.html
similarity index 88%
rename from dom/base/test/csp/test_csp_path_matching_redirect.html
rename to dom/security/test/csp/test_path_matching_redirect.html
index 18f85c84809d..7d1044052b17 100644
--- a/dom/base/test/csp/test_csp_path_matching_redirect.html
+++ b/dom/security/test/csp/test_path_matching_redirect.html
@@ -31,21 +31,21 @@ var policy = "script-src http://example.com http://test1.example.com/CSPAllowsSc
 
 var tests = [
   {
-    // the script in file_csp_path_matching.html
-    // <script src="http://test1.example.com/tests/dom/base/..">
+    // the script in file_path_matching.html
+    // <script src="http://test1.example.com/tests/dom/security/..">
     // is not within the whitelisted path by the csp-policy
     // hence the script is 'blocked' by CSP.
     expected: "blocked",
-    uri: "tests/dom/base/test/csp/file_csp_path_matching.html"
+    uri: "tests/dom/security/test/csp/file_path_matching.html"
   },
   {
-    // the script in file_csp_path_matching_redirect.html
+    // the script in file_path_matching_redirect.html
     // <script src="http://example.com/tests/dom/..">
     // gets redirected to: http://test1.example.com/tests/dom
     // where after the redirect the path of the policy is not enforced
     // anymore and hence execution of the script is 'allowed'.
     expected: "allowed",
-    uri: "tests/dom/base/test/csp/file_csp_path_matching_redirect.html"
+    uri: "tests/dom/security/test/csp/file_path_matching_redirect.html"
   },
 ];
 
@@ -71,7 +71,7 @@ function loadNextTest() {
   }
   else {
     curTest = tests[counter++];
-    var src = "file_csp_testserver.sjs";
+    var src = "file_testserver.sjs";
     // append the file that should be served
     src += "?file=" + escape(curTest.uri);
     // append the CSP that should be used to serve the file
diff --git a/dom/base/test/csp/test_policyuri_regression_from_multipolicy.html b/dom/security/test/csp/test_policyuri_regression_from_multipolicy.html
similarity index 100%
rename from dom/base/test/csp/test_policyuri_regression_from_multipolicy.html
rename to dom/security/test/csp/test_policyuri_regression_from_multipolicy.html
diff --git a/dom/base/test/csp/test_csp_redirects.html b/dom/security/test/csp/test_redirects.html
similarity index 97%
rename from dom/base/test/csp/test_csp_redirects.html
rename to dom/security/test/csp/test_redirects.html
index 8466b78c00fb..4656dd70deef 100644
--- a/dom/base/test/csp/test_csp_redirects.html
+++ b/dom/security/test/csp/test_redirects.html
@@ -15,7 +15,7 @@
 <pre id="log"></pre>
 <script class="testbody" type="text/javascript">
 
-var path = "/tests/dom/base/test/csp/";
+var path = "/tests/dom/security/test/csp/";
 
 // debugging
 function log(s) {
@@ -124,7 +124,7 @@ SpecialPowers.pushPrefEnv(
   function() {
     // save this for last so that our listeners are registered.
     // ... this loads the testbed of good and bad requests.
-    document.getElementById("harness").src = "file_csp_redirects_main.html";
+    document.getElementById("harness").src = "file_redirects_main.html";
   });
 </script>
 </pre>
diff --git a/dom/base/test/csp/test_CSP_referrerdirective.html b/dom/security/test/csp/test_referrerdirective.html
similarity index 96%
rename from dom/base/test/csp/test_CSP_referrerdirective.html
rename to dom/security/test/csp/test_referrerdirective.html
index df3641631044..497d946acbf3 100644
--- a/dom/base/test/csp/test_CSP_referrerdirective.html
+++ b/dom/security/test/csp/test_referrerdirective.html
@@ -112,10 +112,10 @@ SpecialPowers.pushPrefEnv({
       // one iframe created for each test case
       for (var id in testData) {
         var elt = document.createElement("iframe");
-        elt.src = "https://example.com/tests/dom/base/test/csp/file_csp_testserver.sjs?" +
+        elt.src = "https://example.com/tests/dom/security/test/csp/file_testserver.sjs?" +
                   "id=" + id +
                   "&csp=" + escape(testData[id]['csp']) +
-                  "&file=tests/dom/base/test/csp/file_csp_referrerdirective.html";
+                  "&file=tests/dom/security/test/csp/file_referrerdirective.html";
         document.getElementById("content").appendChild(elt);
       }
     });
diff --git a/dom/base/test/csp/test_csp_report.html b/dom/security/test/csp/test_report.html
similarity index 94%
rename from dom/base/test/csp/test_csp_report.html
rename to dom/security/test/csp/test_report.html
index 72805d4c75e6..2996d73ad863 100644
--- a/dom/base/test/csp/test_csp_report.html
+++ b/dom/security/test/csp/test_report.html
@@ -27,11 +27,11 @@ https://bugzilla.mozilla.org/show_bug.cgi?id=548193
  * observer, we can set the actual report-uri to a foo value.
  */
 
-const testfile = "tests/dom/base/test/csp/file_csp_report.html";
+const testfile = "tests/dom/security/test/csp/file_report.html";
 const reportURI = "http://mochi.test:8888/foo.sjs";
 const policy = "default-src 'none'; report-uri " + reportURI;
-const docUri = "http://mochi.test:8888/tests/dom/base/test/csp/file_csp_testserver.sjs" +
-               "?file=tests/dom/base/test/csp/file_csp_report.html" +
+const docUri = "http://mochi.test:8888/tests/dom/security/test/csp/file_testserver.sjs" +
+               "?file=tests/dom/security/test/csp/file_report.html" +
                "&csp=default-src%20%27none%27%3B%20report-uri%20http%3A//mochi.test%3A8888/foo.sjs";
 
 window.checkResults = function(reportObj) {
@@ -45,7 +45,7 @@ window.checkResults = function(reportObj) {
   is(cspReport["document-uri"], docUri, "Incorrect document-uri");
 
   // we can not test for the whole referrer since it includes platform specific information
-  ok(cspReport["referrer"].startsWith("http://mochi.test:8888/tests/dom/base/test/csp/test_csp_report.html"),
+  ok(cspReport["referrer"].startsWith("http://mochi.test:8888/tests/dom/security/test/csp/test_report.html"),
      "Incorrect referrer");
 
   is(cspReport["blocked-uri"], "self", "Incorrect blocked-uri");
@@ -130,7 +130,7 @@ SimpleTest.waitForExplicitFinish();
 
 // load the resource which will generate a CSP violation report
 // save this for last so that our listeners are registered.
-var src = "file_csp_testserver.sjs";
+var src = "file_testserver.sjs";
 // append the file that should be served
 src += "?file=" + escape(testfile);
 // append the CSP that should be used to serve the file
diff --git a/dom/base/test/csp/test_report_uri_missing_in_report_only_header.html b/dom/security/test/csp/test_report_uri_missing_in_report_only_header.html
similarity index 100%
rename from dom/base/test/csp/test_report_uri_missing_in_report_only_header.html
rename to dom/security/test/csp/test_report_uri_missing_in_report_only_header.html
diff --git a/dom/base/test/csp/test_scheme_relative_sources.html b/dom/security/test/csp/test_scheme_relative_sources.html
similarity index 95%
rename from dom/base/test/csp/test_scheme_relative_sources.html
rename to dom/security/test/csp/test_scheme_relative_sources.html
index 8987aac6cd6a..21271cdd1b4e 100644
--- a/dom/base/test/csp/test_scheme_relative_sources.html
+++ b/dom/security/test/csp/test_scheme_relative_sources.html
@@ -64,7 +64,7 @@ function loadNextTest() {
   curTest = tests[counter++];
 
   var src = curTest.from +
-             "://example.com/tests/dom/base/test/csp/file_scheme_relative_sources.sjs" +
+             "://example.com/tests/dom/security/test/csp/file_scheme_relative_sources.sjs" +
             "?scheme=" + curTest.to +
             "&policy=" + escape(POLICY);
 
diff --git a/dom/base/test/csp/test_self_none_as_hostname_confusion.html b/dom/security/test/csp/test_self_none_as_hostname_confusion.html
similarity index 100%
rename from dom/base/test/csp/test_self_none_as_hostname_confusion.html
rename to dom/security/test/csp/test_self_none_as_hostname_confusion.html
diff --git a/dom/base/test/csp/test_subframe_run_js_if_allowed.html b/dom/security/test/csp/test_subframe_run_js_if_allowed.html
similarity index 100%
rename from dom/base/test/csp/test_subframe_run_js_if_allowed.html
rename to dom/security/test/csp/test_subframe_run_js_if_allowed.html
diff --git a/dom/base/test/csp/test_worker_redirect.html b/dom/security/test/csp/test_worker_redirect.html
similarity index 95%
rename from dom/base/test/csp/test_worker_redirect.html
rename to dom/security/test/csp/test_worker_redirect.html
index a2dde2ebc325..62a43c77b3d1 100644
--- a/dom/base/test/csp/test_worker_redirect.html
+++ b/dom/security/test/csp/test_worker_redirect.html
@@ -60,9 +60,9 @@ function loadNextTest() {
     return;
   }
   curTest = tests[counter++];
-  var src = "file_csp_testserver.sjs";
+  var src = "file_testserver.sjs";
   // append the file that should be served
-  src += "?file=" + escape("tests/dom/base/test/csp/file_worker_redirect.html");
+  src += "?file=" + escape("tests/dom/security/test/csp/file_worker_redirect.html");
   // append the CSP that should be used to serve the file
   src += "&csp=" + escape(curTest.policy);
   document.getElementById("testframe").src = src;
diff --git a/dom/base/test/mixedcontentblocker/bug803225_test_mailto.html b/dom/security/test/mixedcontentblocker/file_bug803225_test_mailto.html
similarity index 100%
rename from dom/base/test/mixedcontentblocker/bug803225_test_mailto.html
rename to dom/security/test/mixedcontentblocker/file_bug803225_test_mailto.html
diff --git a/dom/base/test/mixedcontentblocker/file_mixed_content_frameNavigation.html b/dom/security/test/mixedcontentblocker/file_frameNavigation.html
similarity index 85%
rename from dom/base/test/mixedcontentblocker/file_mixed_content_frameNavigation.html
rename to dom/security/test/mixedcontentblocker/file_frameNavigation.html
index 36761cb190ca..fd9ea23178e1 100644
--- a/dom/base/test/mixedcontentblocker/file_mixed_content_frameNavigation.html
+++ b/dom/security/test/mixedcontentblocker/file_frameNavigation.html
@@ -12,7 +12,7 @@ https://bugzilla.mozilla.org/show_bug.cgi?id=840388
 <div id="testContent"></div>
 
 <script>
-  var baseUrlHttps = "https://example.com/tests/dom/base/test/mixedcontentblocker/file_mixed_content_frameNavigation_innermost.html";
+  var baseUrlHttps = "https://example.com/tests/dom/security/test/mixedcontentblocker/file_frameNavigation_innermost.html";
 
   // For tests that require setTimeout, set the maximum polling time to 50 x 100ms = 5 seconds.
   var MAX_COUNT = 50;
@@ -44,7 +44,7 @@ https://bugzilla.mozilla.org/show_bug.cgi?id=840388
       counter_test1++;
       return;
     }
-    if (loc == "http://example.com/tests/dom/base/test/mixedcontentblocker/file_mixed_content_frameNavigation_innermost.html?insecurePage_navigate_child_response") {
+    if (loc == "http://example.com/tests/dom/security/test/mixedcontentblocker/file_frameNavigation_innermost.html?insecurePage_navigate_child_response") {
       return;
     }
     else {
@@ -63,7 +63,7 @@ https://bugzilla.mozilla.org/show_bug.cgi?id=840388
 
   // Test 2: Navigate secure grandchild iframe to insecure grandchild iframe on a page that has no secure parents
   var iframe_test2 = document.createElement("iframe");
-  iframe_test2.src = "http://example.com/tests/dom/base/test/mixedcontentblocker/file_mixed_content_frameNavigation_grandchild.html"
+  iframe_test2.src = "http://example.com/tests/dom/security/test/mixedcontentblocker/file_frameNavigation_grandchild.html"
   iframe_test2.onerror = function() {
     parent.postMessage({"test": "insecurePage_navigate_grandchild", "msg": "got an on error alert when loading or navigating testing iframe"}, "http://mochi.test:8888");
   };
diff --git a/dom/base/test/mixedcontentblocker/file_mixed_content_frameNavigation_blankTarget.html b/dom/security/test/mixedcontentblocker/file_frameNavigation_blankTarget.html
similarity index 84%
rename from dom/base/test/mixedcontentblocker/file_mixed_content_frameNavigation_blankTarget.html
rename to dom/security/test/mixedcontentblocker/file_frameNavigation_blankTarget.html
index 098fe66a66aa..5cfd95984156 100644
--- a/dom/base/test/mixedcontentblocker/file_mixed_content_frameNavigation_blankTarget.html
+++ b/dom/security/test/mixedcontentblocker/file_frameNavigation_blankTarget.html
@@ -9,7 +9,7 @@ https://bugzilla.mozilla.org/show_bug.cgi?id=841850
   <title>Tests for Mixed Content Frame Navigation</title>
 </head>
 <body>
-<a href="http://example.com/tests/dom/base/test/mixedcontentblocker/file_mixed_content_frameNavigation_innermost.html?blankTarget" id="blankTarget" target="_blank">Go to http site</a>
+<a href="http://example.com/tests/dom/security/test/mixedcontentblocker/file_frameNavigation_innermost.html?blankTarget" id="blankTarget" target="_blank">Go to http site</a>
 
 <script>
   var blankTarget = document.getElementById("blankTarget");
diff --git a/dom/base/test/mixedcontentblocker/file_mixed_content_frameNavigation_grandchild.html b/dom/security/test/mixedcontentblocker/file_frameNavigation_grandchild.html
similarity index 81%
rename from dom/base/test/mixedcontentblocker/file_mixed_content_frameNavigation_grandchild.html
rename to dom/security/test/mixedcontentblocker/file_frameNavigation_grandchild.html
index 3e45093f9d94..c58f08eab290 100644
--- a/dom/base/test/mixedcontentblocker/file_mixed_content_frameNavigation_grandchild.html
+++ b/dom/security/test/mixedcontentblocker/file_frameNavigation_grandchild.html
@@ -9,7 +9,7 @@ https://bugzilla.mozilla.org/show_bug.cgi?id=840388
   <title>Tests for Mixed Content Frame Navigation</title>
 </head>
 <body>
-<iframe src="https://example.com/tests/dom/base/test/mixedcontentblocker/file_mixed_content_frameNavigation_innermost.html?insecurePage_navigate_grandchild" id="child"></iframe>
+<iframe src="https://example.com/tests/dom/security/test/mixedcontentblocker/file_frameNavigation_innermost.html?insecurePage_navigate_grandchild" id="child"></iframe>
 
 <script>
   // For tests that require setTimeout, set the maximum polling time to 50 x 100ms = 5 seconds.
@@ -32,7 +32,7 @@ https://bugzilla.mozilla.org/show_bug.cgi?id=840388
       counter++;
       return;
     }
-    if (loc == "http://example.com/tests/dom/base/test/mixedcontentblocker/file_mixed_content_frameNavigation_innermost.html?insecurePage_navigate_grandchild_response") {
+    if (loc == "http://example.com/tests/dom/security/test/mixedcontentblocker/file_frameNavigation_innermost.html?insecurePage_navigate_grandchild_response") {
       return;
     }
     else {
diff --git a/dom/base/test/mixedcontentblocker/file_mixed_content_frameNavigation_innermost.html b/dom/security/test/mixedcontentblocker/file_frameNavigation_innermost.html
similarity index 76%
rename from dom/base/test/mixedcontentblocker/file_mixed_content_frameNavigation_innermost.html
rename to dom/security/test/mixedcontentblocker/file_frameNavigation_innermost.html
index 782eadac6861..56879b11118f 100644
--- a/dom/base/test/mixedcontentblocker/file_mixed_content_frameNavigation_innermost.html
+++ b/dom/security/test/mixedcontentblocker/file_frameNavigation_innermost.html
@@ -9,7 +9,7 @@
   switch (type) {
     case "insecurePage_navigate_child":
       document.getElementById("content").innerHTML =
-        '<a href="http://example.com/tests/dom/base/test/mixedcontentblocker/file_mixed_content_frameNavigation_innermost.html?insecurePage_navigate_child_response" id="link">Testing\<\/a>';
+        '<a href="http://example.com/tests/dom/security/test/mixedcontentblocker/file_frameNavigation_innermost.html?insecurePage_navigate_child_response" id="link">Testing\<\/a>';
       document.getElementById("link").click();
       break;
 
@@ -20,7 +20,7 @@
 
     case "insecurePage_navigate_grandchild":
       document.getElementById("content").innerHTML =
-        '<a href="http://example.com/tests/dom/base/test/mixedcontentblocker/file_mixed_content_frameNavigation_innermost.html?insecurePage_navigate_grandchild_response" id="link">Testing\<\/a>';
+        '<a href="http://example.com/tests/dom/security/test/mixedcontentblocker/file_frameNavigation_innermost.html?insecurePage_navigate_grandchild_response" id="link">Testing\<\/a>';
       document.getElementById("link").click();
       break;
 
@@ -31,7 +31,7 @@
 
     case "securePage_navigate_child":
       document.getElementById("content").innerHTML =
-        '<a href="http://example.com/tests/dom/base/test/mixedcontentblocker/file_mixed_content_frameNavigation_innermost.html?securePage_navigate_child_response" id="link">Testing\<\/a>';
+        '<a href="http://example.com/tests/dom/security/test/mixedcontentblocker/file_frameNavigation_innermost.html?securePage_navigate_child_response" id="link">Testing\<\/a>';
       document.getElementById("link").click();
       break;
 
@@ -42,7 +42,7 @@
 
     case "securePage_navigate_grandchild":
       document.getElementById("content").innerHTML=
-        '<a href="http://example.com/tests/dom/base/test/mixedcontentblocker/file_mixed_content_frameNavigation_innermost.html?securePage_navigate_grandchild_response" id="link">Testing\<\/a>';
+        '<a href="http://example.com/tests/dom/security/test/mixedcontentblocker/file_frameNavigation_innermost.html?securePage_navigate_grandchild_response" id="link">Testing\<\/a>';
       document.getElementById("link").click();
       break;
 
diff --git a/dom/base/test/mixedcontentblocker/file_mixed_content_frameNavigation_secure.html b/dom/security/test/mixedcontentblocker/file_frameNavigation_secure.html
similarity index 84%
rename from dom/base/test/mixedcontentblocker/file_mixed_content_frameNavigation_secure.html
rename to dom/security/test/mixedcontentblocker/file_frameNavigation_secure.html
index 7cce06584454..ea8462c391a4 100644
--- a/dom/base/test/mixedcontentblocker/file_mixed_content_frameNavigation_secure.html
+++ b/dom/security/test/mixedcontentblocker/file_frameNavigation_secure.html
@@ -12,7 +12,7 @@ https://bugzilla.mozilla.org/show_bug.cgi?id=840388
 <div id="testContent"></div>
 
 <script>
-  var baseUrl = "https://example.com/tests/dom/base/test/mixedcontentblocker/file_mixed_content_frameNavigation_innermost.html";
+  var baseUrl = "https://example.com/tests/dom/security/test/mixedcontentblocker/file_frameNavigation_innermost.html";
 
   // For tests that require setTimeout, set the maximum polling time to 50 x 100ms = 5 seconds.
   var MAX_COUNT = 50;
@@ -44,7 +44,7 @@ https://bugzilla.mozilla.org/show_bug.cgi?id=840388
       counter_test1++;
       return;
     }
-    if (loc == "http://example.com/tests/dom/base/test/mixedcontentblocker/file_mixed_content_frameNavigation_innermost.html?insecurePage_navigate_child_response") {
+    if (loc == "http://example.com/tests/dom/security/test/mixedcontentblocker/file_frameNavigation_innermost.html?insecurePage_navigate_child_response") {
       return;
     } else {
       if(counter_test1 < MAX_COUNT) {
@@ -62,7 +62,7 @@ https://bugzilla.mozilla.org/show_bug.cgi?id=840388
 
   // Test 2: Open an http page in a new tab from a link click with target=_blank.
   var iframe_test3 = document.createElement("iframe");
-  iframe_test3.src = "https://example.com/tests/dom/base/test/mixedcontentblocker/file_mixed_content_frameNavigation_blankTarget.html";
+  iframe_test3.src = "https://example.com/tests/dom/security/test/mixedcontentblocker/file_frameNavigation_blankTarget.html";
   iframe_test3.onerror = function() {
     parent.postMessage({"test": "blankTarget", "msg": "got an onerror event when loading or navigating testing iframe"}, "http://mochi.test:8888");
   };
diff --git a/dom/base/test/mixedcontentblocker/file_mixed_content_frameNavigation_secure_grandchild.html b/dom/security/test/mixedcontentblocker/file_frameNavigation_secure_grandchild.html
similarity index 84%
rename from dom/base/test/mixedcontentblocker/file_mixed_content_frameNavigation_secure_grandchild.html
rename to dom/security/test/mixedcontentblocker/file_frameNavigation_secure_grandchild.html
index 5fc2ad7d7fc3..f7f3c40862c7 100644
--- a/dom/base/test/mixedcontentblocker/file_mixed_content_frameNavigation_secure_grandchild.html
+++ b/dom/security/test/mixedcontentblocker/file_frameNavigation_secure_grandchild.html
@@ -10,7 +10,7 @@ https://bugzilla.mozilla.org/show_bug.cgi?id=840388
 </head>
 <body>
 
-<iframe src="https://example.com/tests/dom/base/test/mixedcontentblocker/file_mixed_content_frameNavigation_innermost.html?securePage_navigate_grandchild" id="child"></iframe>
+<iframe src="https://example.com/tests/dom/security/test/mixedcontentblocker/file_frameNavigation_innermost.html?securePage_navigate_grandchild" id="child"></iframe>
 <script>
   // For tests that require setTimeout, set the maximum polling time to 50 x 100ms = 5 seconds.
   var MAX_COUNT = 50;
@@ -33,7 +33,7 @@ https://bugzilla.mozilla.org/show_bug.cgi?id=840388
       counter++;
       return;
     }
-    if (loc == "http://example.com/tests/dom/base/test/mixedcontentblocker/file_mixed_content_frameNavigation_innermost.html?securePage_navigate_grandchild_response") {
+    if (loc == "http://example.com/tests/dom/security/test/mixedcontentblocker/file_frameNavigation_innermost.html?securePage_navigate_grandchild_response") {
       return;
     }
     else {
diff --git a/dom/base/test/mixedcontentblocker/file_mixed_content_main.html b/dom/security/test/mixedcontentblocker/file_main.html
similarity index 98%
rename from dom/base/test/mixedcontentblocker/file_mixed_content_main.html
rename to dom/security/test/mixedcontentblocker/file_main.html
index 4963a5a14e96..4003ccb05527 100644
--- a/dom/base/test/mixedcontentblocker/file_mixed_content_main.html
+++ b/dom/security/test/mixedcontentblocker/file_main.html
@@ -38,7 +38,7 @@ https://bugzilla.mozilla.org/show_bug.cgi?id=62178
 -->
 
 <script>
-  var baseUrl = "http://example.com/tests/dom/base/test/mixedcontentblocker/file_mixed_content_server.sjs";
+  var baseUrl = "http://example.com/tests/dom/security/test/mixedcontentblocker/file_server.sjs";
 
   //For tests that require setTimeout, set the maximum polling time to 100 x 100ms = 10 seconds.
   var MAX_COUNT = 100;
diff --git a/dom/base/test/mixedcontentblocker/file_mixed_content_main_bug803225.html b/dom/security/test/mixedcontentblocker/file_main_bug803225.html
similarity index 96%
rename from dom/base/test/mixedcontentblocker/file_mixed_content_main_bug803225.html
rename to dom/security/test/mixedcontentblocker/file_main_bug803225.html
index ec2d5582f860..d20791add7d3 100644
--- a/dom/base/test/mixedcontentblocker/file_mixed_content_main_bug803225.html
+++ b/dom/security/test/mixedcontentblocker/file_main_bug803225.html
@@ -112,7 +112,7 @@ https://bugzilla.mozilla.org/show_bug.cgi?id=803225
   var webHandler = SpecialPowers.Cc["@mozilla.org/uriloader/web-handler-app;1"].
                    createInstance(SpecialPowers.Ci.nsIWebHandlerApp);
   webHandler.name = "Web Handler";
-  webHandler.uriTemplate = "http://example.com/tests/dom/base/test/mixedcontentblocker/bug803225_test_mailto.html?s=%";
+  webHandler.uriTemplate = "http://example.com/tests/dom/security/test/mixedcontentblocker/file_bug803225_test_mailto.html?s=%";
 
   var uri = ioService.newURI("mailto:foo@bar.com", null, null);
   webHandler.launchWithURI(uri);
@@ -144,7 +144,7 @@ https://bugzilla.mozilla.org/show_bug.cgi?id=803225
 
   // Test 8: wss protocol
   var wss;
-  wss = new WebSocket("wss://example.com/tests/dom/base/test/mixedcontentblocker/file_mixed_content_main_bug803225_websocket");
+  wss = new WebSocket("wss://example.com/tests/dom/security/test/mixedcontentblocker/file_main_bug803225_websocket");
 
   var status_wss = "started";
   wss.onopen = function(e) {
diff --git a/dom/base/test/mixedcontentblocker/file_mixed_content_main_bug803225_websocket_wsh.py b/dom/security/test/mixedcontentblocker/file_main_bug803225_websocket_wsh.py
similarity index 100%
rename from dom/base/test/mixedcontentblocker/file_mixed_content_main_bug803225_websocket_wsh.py
rename to dom/security/test/mixedcontentblocker/file_main_bug803225_websocket_wsh.py
diff --git a/dom/base/test/mixedcontentblocker/file_mixed_content_server.sjs b/dom/security/test/mixedcontentblocker/file_server.sjs
similarity index 100%
rename from dom/base/test/mixedcontentblocker/file_mixed_content_server.sjs
rename to dom/security/test/mixedcontentblocker/file_server.sjs
diff --git a/dom/security/test/mixedcontentblocker/mochitest.ini b/dom/security/test/mixedcontentblocker/mochitest.ini
new file mode 100644
index 000000000000..f3a16e3e6dcf
--- /dev/null
+++ b/dom/security/test/mixedcontentblocker/mochitest.ini
@@ -0,0 +1,20 @@
+[DEFAULT]
+support-files =
+  file_bug803225_test_mailto.html
+  file_frameNavigation.html
+  file_frameNavigation_blankTarget.html
+  file_frameNavigation_grandchild.html
+  file_frameNavigation_innermost.html
+  file_frameNavigation_secure.html
+  file_frameNavigation_secure_grandchild.html
+  file_main.html
+  file_main_bug803225.html
+  file_main_bug803225_websocket_wsh.py
+  file_server.sjs
+
+[test_main.html]
+skip-if = buildapp == 'mulet' || buildapp == 'b2g' || toolkit == 'android' || e10s #TIMED_OUT, SSL_REQUIRED # Bug 1141029 Mulet parity with B2G Desktop for TC
+[test_bug803225.html]
+skip-if = buildapp == 'mulet' || buildapp == 'b2g' || toolkit == 'android' || e10s #TIMED_OUT, SSL_REQUIRED # Bug 1141029 Mulet parity with B2G Desktop for TC
+[test_frameNavigation.html]
+skip-if = buildapp == 'mulet' || buildapp == 'b2g' || toolkit == 'android' || e10s #TIMED_OUT, SSL_REQUIRED # Bug 1141029 Mulet parity with B2G Desktop for TC
diff --git a/dom/base/test/mixedcontentblocker/test_mixed_content_blocker_bug803225.html b/dom/security/test/mixedcontentblocker/test_bug803225.html
similarity index 95%
rename from dom/base/test/mixedcontentblocker/test_mixed_content_blocker_bug803225.html
rename to dom/security/test/mixedcontentblocker/test_bug803225.html
index 042702584efc..9b6f6af6ca9a 100644
--- a/dom/base/test/mixedcontentblocker/test_mixed_content_blocker_bug803225.html
+++ b/dom/security/test/mixedcontentblocker/test_bug803225.html
@@ -64,7 +64,7 @@ https://bugzilla.mozilla.org/show_bug.cgi?id=803225
       changePrefs(counter);
       counter++;
       log("\nblockDisplay set to "+blockDisplay+", blockActive set to "+blockActive+".");
-      document.getElementById('framediv').innerHTML = '<iframe id="testHarness" src="https://example.com/tests/dom/base/test/mixedcontentblocker/file_mixed_content_main_bug803225.html"></iframe>';
+      document.getElementById('framediv').innerHTML = '<iframe id="testHarness" src="https://example.com/tests/dom/security/test/mixedcontentblocker/file_main_bug803225.html"></iframe>';
     }
     else {
       //set the prefs back to what they were set to originally
@@ -141,7 +141,7 @@ https://bugzilla.mozilla.org/show_bug.cgi?id=803225
 
 <body>
   <div id="framediv">
-    <iframe id="testHarness" src="https://example.com/tests/dom/base/test/mixedcontentblocker/file_mixed_content_main_bug803225.html"></iframe>
+    <iframe id="testHarness" src="https://example.com/tests/dom/security/test/mixedcontentblocker/file_main_bug803225.html"></iframe>
   </div>
   <pre id="log"></pre>
 </body>
diff --git a/dom/base/test/mixedcontentblocker/test_mixed_content_blocker_frameNavigation.html b/dom/security/test/mixedcontentblocker/test_frameNavigation.html
similarity index 91%
rename from dom/base/test/mixedcontentblocker/test_mixed_content_blocker_frameNavigation.html
rename to dom/security/test/mixedcontentblocker/test_frameNavigation.html
index 5eb5b828cab4..3ee7b3876515 100644
--- a/dom/base/test/mixedcontentblocker/test_mixed_content_blocker_frameNavigation.html
+++ b/dom/security/test/mixedcontentblocker/test_frameNavigation.html
@@ -42,7 +42,7 @@ https://bugzilla.mozilla.org/show_bug.cgi?id=840388
     // If we are here, all the insecure tests have run.
     // If we haven't changed the iframe to run the secure tests, change it now.
     if (!secureTestsStarted) {
-      document.getElementById('testing_frame').src = "https://example.com/tests/dom/base/test/mixedcontentblocker/file_mixed_content_frameNavigation_secure.html";
+      document.getElementById('testing_frame').src = "https://example.com/tests/dom/security/test/mixedcontentblocker/file_frameNavigation_secure.html";
       secureTestsStarted = true;
     }
     for (var prop in testsToRunSecure) {
@@ -64,7 +64,7 @@ https://bugzilla.mozilla.org/show_bug.cgi?id=840388
       blockActive = SpecialPowers.getBoolPref("security.mixed_content.block_active_content");
       log("blockActive set to "+blockActive+".");
       secureTestsStarted = false;
-      document.getElementById('framediv').innerHTML = '<iframe src="http://example.com/tests/dom/base/test/mixedcontentblocker/file_mixed_content_frameNavigation.html" id="testing_frame"></iframe>';
+      document.getElementById('framediv').innerHTML = '<iframe src="http://example.com/tests/dom/security/test/mixedcontentblocker/file_frameNavigation.html" id="testing_frame"></iframe>';
     }
     else {
       //set the prefs back to what they were set to originally
@@ -119,7 +119,7 @@ https://bugzilla.mozilla.org/show_bug.cgi?id=840388
 
 <body>
   <div id="framediv">
-    <iframe src="http://example.com/tests/dom/base/test/mixedcontentblocker/file_mixed_content_frameNavigation.html" id="testing_frame"></iframe>
+    <iframe src="http://example.com/tests/dom/security/test/mixedcontentblocker/file_frameNavigation.html" id="testing_frame"></iframe>
   </div>
 
   <pre id="log"></pre>
diff --git a/dom/base/test/mixedcontentblocker/test_mixed_content_blocker.html b/dom/security/test/mixedcontentblocker/test_main.html
similarity index 98%
rename from dom/base/test/mixedcontentblocker/test_mixed_content_blocker.html
rename to dom/security/test/mixedcontentblocker/test_main.html
index 37c4fc6e33de..1ccbfe57d926 100644
--- a/dom/base/test/mixedcontentblocker/test_mixed_content_blocker.html
+++ b/dom/security/test/mixedcontentblocker/test_main.html
@@ -62,7 +62,7 @@ https://bugzilla.mozilla.org/show_bug.cgi?id=62178
   }
 
   function reloadFrame() {
-    document.getElementById('framediv').innerHTML = '<iframe id="testHarness" src="https://example.com/tests/dom/base/test/mixedcontentblocker/file_mixed_content_main.html"></iframe>';
+    document.getElementById('framediv').innerHTML = '<iframe id="testHarness" src="https://example.com/tests/dom/security/test/mixedcontentblocker/file_main.html"></iframe>';
   }
 
   function checkTestsCompleted() {
diff --git a/dom/security/test/moz.build b/dom/security/test/moz.build
new file mode 100644
index 000000000000..8eaba35c9c4b
--- /dev/null
+++ b/dom/security/test/moz.build
@@ -0,0 +1,27 @@
+# -*- Mode: python; c-basic-offset: 4; indent-tabs-mode: nil; tab-width: 40 -*-
+# vim: set filetype=python:
+# This Source Code Form is subject to the terms of the Mozilla Public
+# License, v. 2.0. If a copy of the MPL was not distributed with this
+# file, You can obtain one at http://mozilla.org/MPL/2.0/.
+
+XPCSHELL_TESTS_MANIFESTS += [
+    'unit/xpcshell.ini',
+]
+
+GeckoCppUnitTests([
+     'TestCSPParser',
+])
+
+MOCHITEST_MANIFESTS += [
+    'cors/mochitest.ini',
+    'csp/mochitest.ini',
+    'mixedcontentblocker/mochitest.ini',
+]
+
+MOCHITEST_CHROME_MANIFESTS += [
+    'csp/chrome.ini',
+]
+
+BROWSER_CHROME_MANIFESTS += [
+    'csp/browser.ini',
+]
diff --git a/dom/base/test/unit/test_cspreports.js b/dom/security/test/unit/test_csp_reports.js
similarity index 99%
rename from dom/base/test/unit/test_cspreports.js
rename to dom/security/test/unit/test_csp_reports.js
index 54e42d00dc63..e4627a1dcf84 100644
--- a/dom/base/test/unit/test_cspreports.js
+++ b/dom/security/test/unit/test_csp_reports.js
@@ -9,6 +9,7 @@ const Cr = Components.results;
 
 Cu.import('resource://gre/modules/NetUtil.jsm');
 Cu.import("resource://gre/modules/Services.jsm");
+Cu.import("resource://testing-common/httpd.js");
 
 var httpServer = new HttpServer();
 httpServer.start(-1);
diff --git a/dom/security/test/unit/xpcshell.ini b/dom/security/test/unit/xpcshell.ini
new file mode 100644
index 000000000000..e0a801cb7844
--- /dev/null
+++ b/dom/security/test/unit/xpcshell.ini
@@ -0,0 +1,7 @@
+[DEFAULT]
+head =
+tail =
+skip-if = toolkit == 'gonk'
+
+[test_csp_reports.js]
+skip-if = buildapp == 'mulet'
diff --git a/dom/tests/mochitest/chrome/MozDomFullscreen_chrome.xul b/dom/tests/mochitest/chrome/MozDomFullscreen_chrome.xul
index 8a523cb4d713..358e2c147821 100644
--- a/dom/tests/mochitest/chrome/MozDomFullscreen_chrome.xul
+++ b/dom/tests/mochitest/chrome/MozDomFullscreen_chrome.xul
@@ -43,15 +43,16 @@ function firstEntry(event) {
   if (event.type == "MozDOMFullscreen:Entered") {
     window.removeEventListener("MozDOMFullscreen:Entered", firstEntry, false);
     ok(!gReceivedFullscreenEnteredEvent, "MozDOMFullscreen:Entered shouldn't have been triggered twice");
+    ok(event.target, gOuterDoc.body, "First MozDOMFullscreen:Entered should be targeted at outer body");
     gReceivedFullscreenEnteredEvent = true;
   } else if (event.type == "MozDOMFullscreen:NewOrigin") {
     window.removeEventListener("MozDOMFullscreen:NewOrigin", firstEntry, false);
     ok(!gReceivedNewOriginEvent, "MozDOMFullscreen:NewOrigin shouldn't have been triggered twice");
+    ok(event.target, gOuterDoc, "First MozDOMFullscreen:NewOrigin should be targeted at outer doc");
     gReceivedNewOriginEvent = true;
   } else {
     ok(false, "Unknown event received");
   }
-  is(event.target, gOuterDoc, "First " + event.type + " should be targeted at outer doc");
   if (!gReceivedFullscreenEnteredEvent || !gReceivedNewOriginEvent) {
     return;
   }
diff --git a/dom/tests/mochitest/chrome/chrome.ini b/dom/tests/mochitest/chrome/chrome.ini
index e09f43b9872d..d43f22f32eb8 100644
--- a/dom/tests/mochitest/chrome/chrome.ini
+++ b/dom/tests/mochitest/chrome/chrome.ini
@@ -15,7 +15,6 @@ support-files =
   focus_frameset.html
   focus_window2.xul
   fullscreen.xul
-  fullscreen_preventdefault.xul
   queryCaretRectUnix.html
   queryCaretRectWin.html
   selectAtPoint.html
@@ -45,7 +44,6 @@ skip-if = buildapp == 'mulet'
 [test_fullscreen.xul]
 # disabled on linux for timeouts--bug-867745
 skip-if = os == 'linux'
-[test_fullscreen_preventdefault.xul]
 [test_geolocation.xul]
 [test_indexedSetter.html]
 [test_moving_nodeList.xul]
diff --git a/dom/tests/mochitest/chrome/fullscreen_preventdefault.xul b/dom/tests/mochitest/chrome/fullscreen_preventdefault.xul
deleted file mode 100644
index 658d6b2d51de..000000000000
--- a/dom/tests/mochitest/chrome/fullscreen_preventdefault.xul
+++ /dev/null
@@ -1,27 +0,0 @@
-<?xml version="1.0"?>
-<?xml-stylesheet href="chrome://global/skin" type="text/css"?>
-<?xml-stylesheet href="chrome://mochikit/content/tests/SimpleTest/test.css" type="text/css"?>
-<!--
-  Test for fullscreen sizemode in chrome
-  -->
-<window xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul"
-        sizemode="fullscreen">
-
-<script>
-
-window.addEventListener("fullscreen", onFullScreen, true);
-
-function onFullScreen(event)
-{
-  event.preventDefault();
-  window.opener.wrappedJSObject.done();
-}
-
-</script>
-
-<body xmlns="http://www.w3.org/1999/xhtml">
-
-<button id="find-button" label="Find"/>
-<button id="cancel-button" label="Cancel"/>
-</body>
-</window>
diff --git a/dom/tests/mochitest/chrome/test_fullscreen_preventdefault.xul b/dom/tests/mochitest/chrome/test_fullscreen_preventdefault.xul
deleted file mode 100644
index 45a094e57a7b..000000000000
--- a/dom/tests/mochitest/chrome/test_fullscreen_preventdefault.xul
+++ /dev/null
@@ -1,37 +0,0 @@
-<?xml version="1.0"?>
-<?xml-stylesheet href="chrome://global/skin" type="text/css"?>
-<?xml-stylesheet href="chrome://mochikit/content/tests/SimpleTest/test.css" type="text/css"?>
-<!--
-  Test for fullscreen sizemode in chrome
-  -->
-<window xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul"
-        sizemode="fullscreen">
-
-  <script type="application/javascript" 
-          src="chrome://mochikit/content/tests/SimpleTest/SimpleTest.js"></script>      
-
-<script>
-SimpleTest.waitForExplicitFinish();
-
-newwindow = window.open("fullscreen_preventdefault.xul", "_blank","chrome,resizable=yes");
-
-function done()
-{
-  // because we are cancelling the fullscreen event, it
-  // takes a bit for the fullScreen property to be set
-  setTimeout("complete()", 0);
-}
-
-function complete()
-{
-  ok(!(newwindow.fullScreen), "window.fullScreen is false.");
-  newwindow.close();
-  SimpleTest.finish();
-}
-
-</script>
-
-
-<body xmlns="http://www.w3.org/1999/xhtml" style="height: 300px; overflow: auto;"/>
-
-</window>
diff --git a/dom/tests/mochitest/fetch/mochitest.ini b/dom/tests/mochitest/fetch/mochitest.ini
index a5cacd29f467..9864cd5fbd9d 100644
--- a/dom/tests/mochitest/fetch/mochitest.ini
+++ b/dom/tests/mochitest/fetch/mochitest.ini
@@ -27,10 +27,10 @@ skip-if = buildapp == 'b2g' # Bug 1137683
 skip-if = buildapp == 'b2g' # Bug 1137683
 [test_fetch_basic_http.html]
 [test_fetch_basic_http_sw_reroute.html]
-skip-if = e10s || buildapp == 'b2g' # Bug 1173163 for e10s, bug 1137683 for b2g
+skip-if = e10s || buildapp == 'b2g' # Bug 1093357 for e10s, bug 1137683 for b2g
 [test_fetch_cors.html]
 [test_fetch_cors_sw_reroute.html]
-skip-if = e10s || buildapp == 'b2g' # Bug 1173163 for e10s, bug 1137683 for b2g
+skip-if = e10s || buildapp == 'b2g' # Bug 1093357 for e10s, bug 1137683 for b2g
 [test_formdataparsing.html]
 [test_formdataparsing_sw_reroute.html]
 skip-if = buildapp == 'b2g' # Bug 1137683
diff --git a/dom/tests/mochitest/fetch/test_fetch_cors.js b/dom/tests/mochitest/fetch/test_fetch_cors.js
index aa65d5fa65e8..eec910bc64cb 100644
--- a/dom/tests/mochitest/fetch/test_fetch_cors.js
+++ b/dom/tests/mochitest/fetch/test_fetch_cors.js
@@ -42,7 +42,7 @@ function testNoCorsCtor() {
   ok(!r.headers.has("DNT"), "Appending forbidden header should fail");
 }
 
-var corsServerPath = "/tests/dom/base/test/file_CrossSiteXHR_server.sjs?";
+var corsServerPath = "/tests/dom/security/test/cors/file_CrossSiteXHR_server.sjs?";
 function testModeNoCors() {
   // Fetch spec, section 4, step 4, response tainting should be set opaque, so
   // that fetching leads to an opaque filtered response in step 8.
diff --git a/dom/workers/PServiceWorkerManager.ipdl b/dom/workers/PServiceWorkerManager.ipdl
new file mode 100644
index 000000000000..02ec54d90e1b
--- /dev/null
+++ b/dom/workers/PServiceWorkerManager.ipdl
@@ -0,0 +1,39 @@
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+include protocol PBackground;
+
+include PBackgroundSharedTypes;
+include ServiceWorkerRegistrarTypes;
+
+using mozilla::OriginAttributes from "mozilla/ipc/BackgroundUtils.h";
+
+namespace mozilla {
+namespace dom {
+
+protocol PServiceWorkerManager
+{
+  manager PBackground;
+
+parent:
+  Register(ServiceWorkerRegistrationData data);
+
+  Unregister(PrincipalInfo principalInfo, nsString scope);
+
+  PropagateSoftUpdate(OriginAttributes originAttributes,
+                      nsString scope);
+  PropagateUnregister(PrincipalInfo principalInfo, nsString scope);
+
+  Shutdown();
+
+child:
+  NotifyRegister(ServiceWorkerRegistrationData data);
+  NotifySoftUpdate(OriginAttributes originAttributes, nsString scope);
+  NotifyUnregister(PrincipalInfo principalInfo, nsString scope);
+
+  __delete__();
+};
+
+} // namespace dom
+} // namespace mozilla
diff --git a/dom/workers/RuntimeService.cpp b/dom/workers/RuntimeService.cpp
index cb746d8a6415..010536c552bb 100644
--- a/dom/workers/RuntimeService.cpp
+++ b/dom/workers/RuntimeService.cpp
@@ -343,25 +343,13 @@ LoadRuntimeOptions(const char* aPrefName, void* /* aClosure */)
 
   // Runtime options.
   JS::RuntimeOptions runtimeOptions;
-  if (GetWorkerPref<bool>(NS_LITERAL_CSTRING("asmjs"))) {
-    runtimeOptions.setAsmJS(true);
-  }
-  if (GetWorkerPref<bool>(NS_LITERAL_CSTRING("baselinejit"))) {
-    runtimeOptions.setBaseline(true);
-  }
-  if (GetWorkerPref<bool>(NS_LITERAL_CSTRING("ion"))) {
-    runtimeOptions.setIon(true);
-  }
-  if (GetWorkerPref<bool>(NS_LITERAL_CSTRING("native_regexp"))) {
-    runtimeOptions.setNativeRegExp(true);
-  }
-  if (GetWorkerPref<bool>(NS_LITERAL_CSTRING("werror"))) {
-    runtimeOptions.setWerror(true);
-  }
-
-  if (GetWorkerPref<bool>(NS_LITERAL_CSTRING("strict"))) {
-    runtimeOptions.setExtraWarnings(true);
-  }
+  runtimeOptions.setAsmJS(GetWorkerPref<bool>(NS_LITERAL_CSTRING("asmjs")))
+                .setBaseline(GetWorkerPref<bool>(NS_LITERAL_CSTRING("baselinejit")))
+                .setIon(GetWorkerPref<bool>(NS_LITERAL_CSTRING("ion")))
+                .setNativeRegExp(GetWorkerPref<bool>(NS_LITERAL_CSTRING("native_regexp")))
+                .setAsyncStack(GetWorkerPref<bool>(NS_LITERAL_CSTRING("asyncstack")))
+                .setWerror(GetWorkerPref<bool>(NS_LITERAL_CSTRING("werror")))
+                .setExtraWarnings(GetWorkerPref<bool>(NS_LITERAL_CSTRING("strict")));
 
   RuntimeService::SetDefaultRuntimeOptions(runtimeOptions);
 
diff --git a/dom/workers/ServiceWorkerManager.cpp b/dom/workers/ServiceWorkerManager.cpp
index 09e25276f99c..3092eb144eee 100644
--- a/dom/workers/ServiceWorkerManager.cpp
+++ b/dom/workers/ServiceWorkerManager.cpp
@@ -55,6 +55,7 @@
 #include "ServiceWorker.h"
 #include "ServiceWorkerClient.h"
 #include "ServiceWorkerContainer.h"
+#include "ServiceWorkerManagerChild.h"
 #include "ServiceWorkerRegistrar.h"
 #include "ServiceWorkerRegistration.h"
 #include "ServiceWorkerScriptCache.h"
@@ -257,6 +258,28 @@ PopulateRegistrationData(nsIPrincipal* aPrincipal,
   return NS_OK;
 }
 
+class TeardownRunnable final : public nsRunnable
+{
+public:
+  explicit TeardownRunnable(ServiceWorkerManagerChild* aActor)
+    : mActor(aActor)
+  {
+    MOZ_ASSERT(mActor);
+  }
+
+  NS_IMETHODIMP Run() override
+  {
+    MOZ_ASSERT(mActor);
+    mActor->SendShutdown();
+    return NS_OK;
+  }
+
+private:
+  ~TeardownRunnable() {}
+
+  nsRefPtr<ServiceWorkerManagerChild> mActor;
+};
+
 } // Anonymous namespace
 
 NS_IMPL_ISUPPORTS0(ServiceWorkerJob)
@@ -361,6 +384,14 @@ ServiceWorkerManager::~ServiceWorkerManager()
 {
   // The map will assert if it is not empty when destroyed.
   mRegistrationInfos.Clear();
+
+  if (mActor) {
+    mActor->ManagerShuttingDown();
+
+    nsRefPtr<TeardownRunnable> runnable = new TeardownRunnable(mActor);
+    nsresult rv = NS_DispatchToMainThread(runnable);
+    unused << NS_WARN_IF(NS_FAILED(rv));
+  }
 }
 
 void
@@ -686,6 +717,72 @@ GetRequiredScopeStringPrefix(nsIURI* aScriptURI, nsACString& aPrefix,
   }
   return NS_OK;
 }
+
+class PropagateSoftUpdateRunnable final : public nsRunnable
+{
+public:
+  PropagateSoftUpdateRunnable(const OriginAttributes& aOriginAttributes,
+                              const nsAString& aScope)
+    : mOriginAttributes(aOriginAttributes)
+    , mScope(aScope)
+  {}
+
+  NS_IMETHOD Run() override
+  {
+    MOZ_ASSERT(NS_IsMainThread());
+
+    nsRefPtr<ServiceWorkerManager> swm = ServiceWorkerManager::GetInstance();
+    MOZ_ASSERT(swm);
+
+    swm->PropagateSoftUpdate(mOriginAttributes,mScope);
+    return NS_OK;
+  }
+
+private:
+  ~PropagateSoftUpdateRunnable()
+  {}
+
+  const OriginAttributes mOriginAttributes;
+  const nsString mScope;
+};
+
+class PropagateUnregisterRunnable final : public nsRunnable
+{
+public:
+  PropagateUnregisterRunnable(nsIPrincipal* aPrincipal,
+                              nsIServiceWorkerUnregisterCallback* aCallback,
+                              const nsAString& aScope)
+    : mPrincipal(aPrincipal)
+    , mCallback(aCallback)
+    , mScope(aScope)
+  {
+    MOZ_ASSERT(aPrincipal);
+  }
+
+  NS_IMETHOD Run() override
+  {
+    MOZ_ASSERT(NS_IsMainThread());
+
+    nsRefPtr<ServiceWorkerManager> swm = ServiceWorkerManager::GetInstance();
+    MOZ_ASSERT(swm);
+
+    nsresult rv = swm->PropagateUnregister(mPrincipal, mCallback, mScope);
+    if (NS_WARN_IF(NS_FAILED(rv))) {
+      return rv;
+    }
+
+    return NS_OK;
+  }
+
+private:
+  ~PropagateUnregisterRunnable()
+  {}
+
+  nsCOMPtr<nsIPrincipal> mPrincipal;
+  nsCOMPtr<nsIServiceWorkerUnregisterCallback> mCallback;
+  const nsString mScope;
+};
+
 } // anonymous namespace
 
 class ServiceWorkerRegisterJob final : public ServiceWorkerJob,
@@ -1222,7 +1319,7 @@ ServiceWorkerManager::Register(nsIDOMWindow* aWindow,
   bool serviceWorkersTestingEnabled =
     outerWindow->GetServiceWorkersTestingEnabled();
 
-  nsCOMPtr<nsIURI> documentURI = doc->GetBaseURI();
+  nsCOMPtr<nsIURI> documentURI = doc->GetDocumentURI();
 
   bool authenticatedOrigin = false;
   if (Preferences::GetBool("dom.serviceWorkers.testing.enabled") ||
@@ -2214,8 +2311,7 @@ private:
     }
 
     MOZ_ASSERT(swm->mActor);
-    swm->mActor->SendUnregisterServiceWorker(principalInfo,
-                                             NS_ConvertUTF8toUTF16(mScope));
+    swm->mActor->SendUnregister(principalInfo, NS_ConvertUTF8toUTF16(mScope));
 
     return NS_OK;
   }
@@ -2439,6 +2535,39 @@ ServiceWorkerManager::CreateServiceWorkerForWindow(nsPIDOMWindow* aWindow,
   return rv;
 }
 
+void
+ServiceWorkerManager::LoadRegistration(
+                             const ServiceWorkerRegistrationData& aRegistration)
+{
+  AssertIsOnMainThread();
+
+  nsCOMPtr<nsIPrincipal> principal =
+    PrincipalInfoToPrincipal(aRegistration.principal());
+  if (!principal) {
+    return;
+  }
+
+  nsRefPtr<ServiceWorkerRegistrationInfo> registration =
+    GetRegistration(principal, aRegistration.scope());
+  if (!registration) {
+    registration = CreateNewRegistration(aRegistration.scope(), principal);
+  } else if (registration->mScriptSpec == aRegistration.scriptSpec() &&
+             !!registration->mActiveWorker == aRegistration.currentWorkerURL().IsEmpty()) {
+    // No needs for updates.
+    return;
+  }
+
+  registration->mScriptSpec = aRegistration.scriptSpec();
+
+  const nsCString& currentWorkerURL = aRegistration.currentWorkerURL();
+  if (!currentWorkerURL.IsEmpty()) {
+    registration->mActiveWorker =
+      new ServiceWorkerInfo(registration, currentWorkerURL,
+                            aRegistration.activeCacheName());
+    registration->mActiveWorker->SetActivateStateUncheckedWithoutEvent(ServiceWorkerState::Activated);
+  }
+}
+
 void
 ServiceWorkerManager::LoadRegistrations(
                   const nsTArray<ServiceWorkerRegistrationData>& aRegistrations)
@@ -2446,23 +2575,7 @@ ServiceWorkerManager::LoadRegistrations(
   AssertIsOnMainThread();
 
   for (uint32_t i = 0, len = aRegistrations.Length(); i < len; ++i) {
-    nsCOMPtr<nsIPrincipal> principal =
-      PrincipalInfoToPrincipal(aRegistrations[i].principal());
-    if (!principal) {
-      continue;
-    }
-
-    ServiceWorkerRegistrationInfo* registration =
-      CreateNewRegistration(aRegistrations[i].scope(), principal);
-
-    registration->mScriptSpec = aRegistrations[i].scriptSpec();
-
-    const nsCString& currentWorkerURL = aRegistrations[i].currentWorkerURL();
-    if (!currentWorkerURL.IsEmpty()) {
-      registration->mActiveWorker =
-        new ServiceWorkerInfo(registration, currentWorkerURL, aRegistrations[i].activeCacheName());
-      registration->mActiveWorker->SetActivateStateUncheckedWithoutEvent(ServiceWorkerState::Activated);
-    }
+    LoadRegistration(aRegistrations[i]);
   }
 }
 
@@ -2477,7 +2590,11 @@ ServiceWorkerManager::ActorCreated(mozilla::ipc::PBackgroundChild* aActor)
 {
   MOZ_ASSERT(aActor);
   MOZ_ASSERT(!mActor);
-  mActor = aActor;
+
+  PServiceWorkerManagerChild* actor =
+    aActor->SendPServiceWorkerManagerConstructor();
+
+  mActor = static_cast<ServiceWorkerManagerChild*>(actor);
 
   // Flush the pending requests.
   for (uint32_t i = 0, len = mPendingOperations.Length(); i < len; ++i) {
@@ -2519,7 +2636,7 @@ ServiceWorkerManager::StoreRegistration(
     return;
   }
 
-  mActor->SendRegisterServiceWorker(data);
+  mActor->SendRegister(data);
 }
 
 already_AddRefed<ServiceWorkerRegistrationInfo>
@@ -3467,24 +3584,6 @@ ServiceWorkerManager::InvalidateServiceWorkerRegistrationWorker(ServiceWorkerReg
   }
 }
 
-NS_IMETHODIMP
-ServiceWorkerManager::SoftUpdate(JS::Handle<JS::Value> aOriginAttributes,
-                                 const nsAString& aScope, JSContext* aCx)
-{
-  AssertIsOnMainThread();
-
-  OriginAttributes attrs;
-  if (!aOriginAttributes.isObject() || !attrs.Init(aCx, aOriginAttributes)) {
-    return NS_ERROR_INVALID_ARG;
-  }
-
-  nsAutoCString scopeKey;
-  attrs.CreateSuffix(scopeKey);
-
-  SoftUpdate(scopeKey, NS_ConvertUTF16toUTF8(aScope));
-  return NS_OK;
-}
-
 void
 ServiceWorkerManager::SoftUpdate(nsIPrincipal* aPrincipal,
                                  const nsACString& aScope)
@@ -3500,6 +3599,15 @@ ServiceWorkerManager::SoftUpdate(nsIPrincipal* aPrincipal,
   SoftUpdate(scopeKey, aScope);
 }
 
+void
+ServiceWorkerManager::SoftUpdate(const OriginAttributes& aOriginAttributes,
+                                 const nsACString& aScope)
+{
+  nsAutoCString scopeKey;
+  aOriginAttributes.CreateSuffix(scopeKey);
+  SoftUpdate(scopeKey, aScope);
+}
+
 void
 ServiceWorkerManager::SoftUpdate(const nsACString& aScopeKey,
                                  const nsACString& aScope)
@@ -3789,6 +3897,10 @@ ServiceWorkerManager::CreateNewRegistration(const nsCString& aScope,
   nsCOMPtr<nsIURI> scopeURI;
   nsresult rv = NS_NewURI(getter_AddRefs(scopeURI), aScope, nullptr, nullptr);
   MOZ_ASSERT(NS_SUCCEEDED(rv));
+
+  nsRefPtr<ServiceWorkerRegistrationInfo> tmp =
+    GetRegistration(aPrincipal, aScope);
+  MOZ_ASSERT(!tmp);
 #endif
 
   ServiceWorkerRegistrationInfo* registration = new ServiceWorkerRegistrationInfo(aScope, aPrincipal);
@@ -3831,8 +3943,7 @@ ServiceWorkerManager::RemoveRegistrationInternal(ServiceWorkerRegistrationInfo*
     return;
   }
 
-  mActor->SendUnregisterServiceWorker(principalInfo,
-                                      NS_ConvertUTF8toUTF16(aRegistration->mScope));
+  mActor->SendUnregister(principalInfo, NS_ConvertUTF8toUTF16(aRegistration->mScope));
 }
 
 class ServiceWorkerDataInfo final : public nsIServiceWorkerInfo
@@ -3842,7 +3953,7 @@ public:
   NS_DECL_NSISERVICEWORKERINFO
 
   static already_AddRefed<ServiceWorkerDataInfo>
-  Create(const ServiceWorkerRegistrationData& aData);
+  Create(const ServiceWorkerRegistrationInfo* aData);
 
 private:
   ServiceWorkerDataInfo()
@@ -3858,6 +3969,7 @@ private:
   nsString mActiveCacheName;
   nsString mWaitingCacheName;
 };
+
 void
 ServiceWorkerManager::RemoveRegistration(ServiceWorkerRegistrationInfo* aRegistration)
 {
@@ -3965,26 +4077,61 @@ UnregisterIfMatchesHostPerPrincipal(const nsACString& aKey,
   return PL_DHASH_NEXT;
 }
 
+PLDHashOperator
+GetAllRegistrationsEnumerator(const nsACString& aScope,
+                              ServiceWorkerRegistrationInfo* aReg,
+                              void* aData)
+{
+  nsIMutableArray* array = static_cast<nsIMutableArray*>(aData);
+  MOZ_ASSERT(aReg);
+
+  if (aReg->mPendingUninstall) {
+    return PL_DHASH_NEXT;
+  }
+
+  nsCOMPtr<nsIServiceWorkerInfo> info = ServiceWorkerDataInfo::Create(aReg);
+  if (NS_WARN_IF(!info)) {
+    return PL_DHASH_NEXT;
+  }
+
+  array->AppendElement(info, false);
+  return PL_DHASH_NEXT;
+}
+
+PLDHashOperator
+GetAllRegistrationsPerPrincipalEnumerator(const nsACString& aKey,
+                                          ServiceWorkerManager::RegistrationDataPerPrincipal* aData,
+                                          void* aUserData)
+{
+  aData->mInfos.EnumerateRead(GetAllRegistrationsEnumerator, aUserData);
+  return PL_DHASH_NEXT;
+}
+
 } // anonymous namespace
+
 NS_IMPL_ISUPPORTS(ServiceWorkerDataInfo, nsIServiceWorkerInfo)
 
 /* static */ already_AddRefed<ServiceWorkerDataInfo>
-ServiceWorkerDataInfo::Create(const ServiceWorkerRegistrationData& aData)
+ServiceWorkerDataInfo::Create(const ServiceWorkerRegistrationInfo* aData)
 {
   AssertIsOnMainThread();
+  MOZ_ASSERT(aData);
 
   nsRefPtr<ServiceWorkerDataInfo> info = new ServiceWorkerDataInfo();
 
-  info->mPrincipal = PrincipalInfoToPrincipal(aData.principal());
-  if (!info->mPrincipal) {
-    return nullptr;
+  info->mPrincipal = aData->mPrincipal;
+  CopyUTF8toUTF16(aData->mScope, info->mScope);
+  CopyUTF8toUTF16(aData->mScriptSpec, info->mScriptSpec);
+
+  if (aData->mActiveWorker) {
+    CopyUTF8toUTF16(aData->mActiveWorker->ScriptSpec(),
+                    info->mCurrentWorkerURL);
+    info->mActiveCacheName = aData->mActiveWorker->CacheName();
   }
 
-  CopyUTF8toUTF16(aData.scope(), info->mScope);
-  CopyUTF8toUTF16(aData.scriptSpec(), info->mScriptSpec);
-  CopyUTF8toUTF16(aData.currentWorkerURL(), info->mCurrentWorkerURL);
-  info->mActiveCacheName = aData.activeCacheName();
-  info->mWaitingCacheName = aData.waitingCacheName();
+  if (aData->mWaitingWorker) {
+    info->mWaitingCacheName = aData->mWaitingWorker->CacheName();
+  }
 
   return info.forget();
 }
@@ -4042,26 +4189,12 @@ ServiceWorkerManager::GetAllRegistrations(nsIArray** aResult)
 {
   AssertIsOnMainThread();
 
-  nsRefPtr<ServiceWorkerRegistrar> swr = ServiceWorkerRegistrar::Get();
-  MOZ_ASSERT(swr);
-
-  nsTArray<ServiceWorkerRegistrationData> data;
-  swr->GetRegistrations(data);
-
   nsCOMPtr<nsIMutableArray> array(do_CreateInstance(NS_ARRAY_CONTRACTID));
   if (!array) {
     return NS_ERROR_OUT_OF_MEMORY;
   }
 
-  for (uint32_t i = 0, len = data.Length(); i < len; ++i) {
-    nsCOMPtr<nsIServiceWorkerInfo> info = ServiceWorkerDataInfo::Create(data[i]);
-    if (!info) {
-      return NS_ERROR_FAILURE;
-    }
-
-    array->AppendElement(info, false);
-  }
-
+  mRegistrationInfos.EnumerateRead(GetAllRegistrationsPerPrincipalEnumerator, array);
   array.forget(aResult);
   return NS_OK;
 }
@@ -4167,6 +4300,69 @@ ServiceWorkerManager::Observe(nsISupports* aSubject,
   return NS_OK;
 }
 
+NS_IMETHODIMP
+ServiceWorkerManager::PropagateSoftUpdate(JS::Handle<JS::Value> aOriginAttributes,
+                                          const nsAString& aScope,
+                                          JSContext* aCx)
+{
+  MOZ_ASSERT(NS_IsMainThread());
+
+  OriginAttributes attrs;
+  if (!aOriginAttributes.isObject() || !attrs.Init(aCx, aOriginAttributes)) {
+    return NS_ERROR_INVALID_ARG;
+  }
+
+  PropagateSoftUpdate(attrs, aScope);
+  return NS_OK;
+}
+
+void
+ServiceWorkerManager::PropagateSoftUpdate(const OriginAttributes& aOriginAttributes,
+                                          const nsAString& aScope)
+{
+  MOZ_ASSERT(NS_IsMainThread());
+
+  if (!mActor) {
+    nsRefPtr<nsIRunnable> runnable =
+      new PropagateSoftUpdateRunnable(aOriginAttributes, aScope);
+    AppendPendingOperation(runnable);
+    return;
+  }
+
+  mActor->SendPropagateSoftUpdate(aOriginAttributes, nsString(aScope));
+}
+
+NS_IMETHODIMP
+ServiceWorkerManager::PropagateUnregister(nsIPrincipal* aPrincipal,
+                                          nsIServiceWorkerUnregisterCallback* aCallback,
+                                          const nsAString& aScope)
+{
+  MOZ_ASSERT(NS_IsMainThread());
+  MOZ_ASSERT(aPrincipal);
+
+  if (!mActor) {
+    nsRefPtr<nsIRunnable> runnable =
+      new PropagateUnregisterRunnable(aPrincipal, aCallback, aScope);
+    AppendPendingOperation(runnable);
+    return NS_OK;
+  }
+
+  PrincipalInfo principalInfo;
+  if (NS_WARN_IF(NS_FAILED(PrincipalToPrincipalInfo(aPrincipal,
+                                                    &principalInfo)))) {
+    return NS_ERROR_FAILURE;
+  }
+
+  mActor->SendPropagateUnregister(principalInfo, nsString(aScope));
+
+  nsresult rv = Unregister(aPrincipal, aCallback, aScope);
+  if (NS_WARN_IF(NS_FAILED(rv))) {
+    return rv;
+  }
+
+  return NS_OK;
+}
+
 void
 ServiceWorkerInfo::AppendWorker(ServiceWorker* aWorker)
 {
diff --git a/dom/workers/ServiceWorkerManager.h b/dom/workers/ServiceWorkerManager.h
index aa354f2e2457..fefacd93eb13 100644
--- a/dom/workers/ServiceWorkerManager.h
+++ b/dom/workers/ServiceWorkerManager.h
@@ -35,10 +35,6 @@ namespace mozilla {
 
 class OriginAttributes;
 
-namespace ipc {
-class BackgroundChild;
-}
-
 namespace dom {
 
 class ServiceWorkerRegistrationListener;
@@ -50,6 +46,7 @@ class ServiceWorkerClientInfo;
 class ServiceWorkerInfo;
 class ServiceWorkerJob;
 class ServiceWorkerJobQueue;
+class ServiceWorkerManagerChild;
 
 // Needs to inherit from nsISupports because NS_ProxyRelease() does not support
 // non-ISupports classes.
@@ -304,6 +301,13 @@ public:
   void
   SoftUpdate(nsIPrincipal* aPrincipal, const nsACString& aScope);
 
+  void
+  SoftUpdate(const OriginAttributes& aOriginAttributes, const nsACString& aScope);
+
+  void
+  PropagateSoftUpdate(const OriginAttributes& aOriginAttributes,
+                      const nsAString& aScope);
+
   already_AddRefed<ServiceWorkerRegistrationInfo>
   GetRegistration(nsIPrincipal* aPrincipal, const nsACString& aScope) const;
 
@@ -352,6 +356,9 @@ public:
   static already_AddRefed<ServiceWorkerManager>
   GetInstance();
 
+ void
+ LoadRegistration(const ServiceWorkerRegistrationData& aRegistration);
+
   void
   LoadRegistrations(const nsTArray<ServiceWorkerRegistrationData>& aRegistrations);
 
@@ -525,7 +532,7 @@ private:
   void
   RemoveRegistrationInternal(ServiceWorkerRegistrationInfo* aRegistration);
 
-  mozilla::ipc::PBackgroundChild* mActor;
+  nsRefPtr<ServiceWorkerManagerChild> mActor;
 
   struct PendingOperation;
   nsTArray<PendingOperation> mPendingOperations;
diff --git a/dom/workers/ServiceWorkerManagerChild.cpp b/dom/workers/ServiceWorkerManagerChild.cpp
new file mode 100644
index 000000000000..7b162846f844
--- /dev/null
+++ b/dom/workers/ServiceWorkerManagerChild.cpp
@@ -0,0 +1,72 @@
+/* -*- Mode: C++; tab-width: 8; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
+/* vim: set ts=8 sts=2 et sw=2 tw=80: */
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+#include "ServiceWorkerManagerChild.h"
+#include "ServiceWorkerManager.h"
+#include "mozilla/unused.h"
+
+namespace mozilla {
+
+using namespace ipc;
+
+namespace dom {
+namespace workers {
+
+bool
+ServiceWorkerManagerChild::RecvNotifyRegister(
+                                     const ServiceWorkerRegistrationData& aData)
+{
+  if (mShuttingDown) {
+    return true;
+  }
+
+  nsRefPtr<ServiceWorkerManager> swm = ServiceWorkerManager::GetInstance();
+  MOZ_ASSERT(swm);
+
+  swm->LoadRegistration(aData);
+  return true;
+}
+
+bool
+ServiceWorkerManagerChild::RecvNotifySoftUpdate(
+                                      const OriginAttributes& aOriginAttributes,
+                                      const nsString& aScope)
+{
+  if (mShuttingDown) {
+    return true;
+  }
+
+  nsRefPtr<ServiceWorkerManager> swm = ServiceWorkerManager::GetInstance();
+  MOZ_ASSERT(swm);
+
+  swm->SoftUpdate(aOriginAttributes, NS_ConvertUTF16toUTF8(aScope));
+  return true;
+}
+
+bool
+ServiceWorkerManagerChild::RecvNotifyUnregister(const PrincipalInfo& aPrincipalInfo,
+                                                const nsString& aScope)
+{
+  if (mShuttingDown) {
+    return true;
+  }
+
+  nsRefPtr<ServiceWorkerManager> swm = ServiceWorkerManager::GetInstance();
+  MOZ_ASSERT(swm);
+
+  nsCOMPtr<nsIPrincipal> principal = PrincipalInfoToPrincipal(aPrincipalInfo);
+  if (NS_WARN_IF(!principal)) {
+    return true;
+  }
+
+  nsresult rv = swm->Unregister(principal, nullptr, aScope);
+  unused << NS_WARN_IF(NS_FAILED(rv));
+  return true;
+}
+
+} // workers namespace
+} // dom namespace
+} // mozilla namespace
diff --git a/dom/workers/ServiceWorkerManagerChild.h b/dom/workers/ServiceWorkerManagerChild.h
new file mode 100644
index 000000000000..f6f971d5cd97
--- /dev/null
+++ b/dom/workers/ServiceWorkerManagerChild.h
@@ -0,0 +1,59 @@
+/* -*- Mode: C++; tab-width: 8; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
+/* vim: set ts=8 sts=2 et sw=2 tw=80: */
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this file,
+ * You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+#ifndef mozilla_dom_ServiceWorkerManagerChild_h
+#define mozilla_dom_ServiceWorkerManagerChild_h
+
+#include "mozilla/dom/PServiceWorkerManagerChild.h"
+#include "mozilla/ipc/BackgroundUtils.h"
+
+namespace mozilla {
+
+class OriginAttributes;
+
+namespace ipc {
+class BackgroundChildImpl;
+}
+
+namespace dom {
+namespace workers {
+
+class ServiceWorkerManagerChild final : public PServiceWorkerManagerChild
+{
+  friend class mozilla::ipc::BackgroundChildImpl;
+
+public:
+  NS_INLINE_DECL_REFCOUNTING(ServiceWorkerManagerChild)
+
+  void ManagerShuttingDown()
+  {
+    mShuttingDown = true;
+  }
+
+  virtual bool RecvNotifyRegister(const ServiceWorkerRegistrationData& aData)
+                                                                       override;
+
+  virtual bool RecvNotifySoftUpdate(const OriginAttributes& aOriginAttributes,
+                                    const nsString& aScope) override;
+
+  virtual bool RecvNotifyUnregister(const PrincipalInfo& aPrincipalInfo,
+                                    const nsString& aScope) override;
+
+private:
+  ServiceWorkerManagerChild()
+    : mShuttingDown(false)
+  {}
+
+  ~ServiceWorkerManagerChild() {}
+
+  bool mShuttingDown;
+};
+
+} // workers namespace
+} // dom namespace
+} // mozilla namespace
+
+#endif // mozilla_dom_ServiceWorkerManagerChild_h
diff --git a/dom/workers/ServiceWorkerManagerParent.cpp b/dom/workers/ServiceWorkerManagerParent.cpp
new file mode 100644
index 000000000000..946417182442
--- /dev/null
+++ b/dom/workers/ServiceWorkerManagerParent.cpp
@@ -0,0 +1,289 @@
+/* -*- Mode: C++; tab-width: 8; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
+/* vim: set ts=8 sts=2 et sw=2 tw=80: */
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+#include "ServiceWorkerManagerParent.h"
+#include "ServiceWorkerManagerService.h"
+#include "mozilla/AppProcessChecker.h"
+#include "mozilla/ipc/BackgroundParent.h"
+#include "mozilla/ipc/BackgroundUtils.h"
+#include "mozilla/unused.h"
+
+namespace mozilla {
+
+using namespace ipc;
+
+namespace dom {
+namespace workers {
+
+namespace {
+
+uint64_t sServiceWorkerManagerParentID = 0;
+
+void
+AssertIsInMainProcess()
+{
+  MOZ_ASSERT(XRE_GetProcessType() == GeckoProcessType_Default);
+}
+
+class RegisterServiceWorkerCallback final : public nsRunnable
+{
+public:
+  RegisterServiceWorkerCallback(const ServiceWorkerRegistrationData& aData,
+                                uint64_t aParentID)
+    : mData(aData)
+    , mParentID(aParentID)
+  {
+    AssertIsInMainProcess();
+    AssertIsOnBackgroundThread();
+  }
+
+  NS_IMETHODIMP
+  Run()
+  {
+    AssertIsInMainProcess();
+    AssertIsOnBackgroundThread();
+
+    nsRefPtr<dom::ServiceWorkerRegistrar> service =
+      dom::ServiceWorkerRegistrar::Get();
+    MOZ_ASSERT(service);
+
+    service->RegisterServiceWorker(mData);
+
+    nsRefPtr<ServiceWorkerManagerService> managerService =
+      ServiceWorkerManagerService::Get();
+    if (managerService) {
+      managerService->PropagateRegistration(mParentID, mData);
+    }
+
+    return NS_OK;
+  }
+
+private:
+  ServiceWorkerRegistrationData mData;
+  const uint64_t mParentID;
+};
+
+class UnregisterServiceWorkerCallback final : public nsRunnable
+{
+public:
+  UnregisterServiceWorkerCallback(const PrincipalInfo& aPrincipalInfo,
+                                  const nsString& aScope)
+    : mPrincipalInfo(aPrincipalInfo)
+    , mScope(aScope)
+  {
+    AssertIsInMainProcess();
+    AssertIsOnBackgroundThread();
+  }
+
+  NS_IMETHODIMP
+  Run()
+  {
+    AssertIsInMainProcess();
+    AssertIsOnBackgroundThread();
+
+    nsRefPtr<dom::ServiceWorkerRegistrar> service =
+      dom::ServiceWorkerRegistrar::Get();
+    MOZ_ASSERT(service);
+
+    service->UnregisterServiceWorker(mPrincipalInfo,
+                                     NS_ConvertUTF16toUTF8(mScope));
+    return NS_OK;
+  }
+
+private:
+  const PrincipalInfo mPrincipalInfo;
+  nsString mScope;
+};
+
+class CheckPrincipalWithCallbackRunnable final : public nsRunnable
+{
+public:
+  CheckPrincipalWithCallbackRunnable(already_AddRefed<ContentParent> aParent,
+                                     const PrincipalInfo& aPrincipalInfo,
+                                     nsRunnable* aCallback)
+    : mContentParent(aParent)
+    , mPrincipalInfo(aPrincipalInfo)
+    , mCallback(aCallback)
+    , mBackgroundThread(NS_GetCurrentThread())
+  {
+    AssertIsInMainProcess();
+    AssertIsOnBackgroundThread();
+
+    MOZ_ASSERT(mContentParent);
+    MOZ_ASSERT(mCallback);
+    MOZ_ASSERT(mBackgroundThread);
+  }
+
+  NS_IMETHODIMP Run()
+  {
+    if (NS_IsMainThread()) {
+      nsCOMPtr<nsIPrincipal> principal = PrincipalInfoToPrincipal(mPrincipalInfo);
+      AssertAppPrincipal(mContentParent, principal);
+      mContentParent = nullptr;
+
+      mBackgroundThread->Dispatch(this, NS_DISPATCH_NORMAL);
+      return NS_OK;
+    }
+
+    AssertIsOnBackgroundThread();
+    mCallback->Run();
+    mCallback = nullptr;
+
+    return NS_OK;
+  }
+
+private:
+  nsRefPtr<ContentParent> mContentParent;
+  PrincipalInfo mPrincipalInfo;
+  nsRefPtr<nsRunnable> mCallback;
+  nsCOMPtr<nsIThread> mBackgroundThread;
+};
+
+} // anonymous namespace
+
+ServiceWorkerManagerParent::ServiceWorkerManagerParent()
+  : mService(ServiceWorkerManagerService::GetOrCreate())
+  , mID(++sServiceWorkerManagerParentID)
+{
+  AssertIsOnBackgroundThread();
+  mService->RegisterActor(this);
+}
+
+ServiceWorkerManagerParent::~ServiceWorkerManagerParent()
+{
+  AssertIsOnBackgroundThread();
+}
+
+bool
+ServiceWorkerManagerParent::RecvRegister(
+                                     const ServiceWorkerRegistrationData& aData)
+{
+  AssertIsInMainProcess();
+  AssertIsOnBackgroundThread();
+
+  // Basic validation.
+  if (aData.scope().IsEmpty() ||
+      aData.scriptSpec().IsEmpty() ||
+      aData.principal().type() == PrincipalInfo::TNullPrincipalInfo ||
+      aData.principal().type() == PrincipalInfo::TSystemPrincipalInfo) {
+    return false;
+  }
+
+  nsRefPtr<RegisterServiceWorkerCallback> callback =
+    new RegisterServiceWorkerCallback(aData, mID);
+
+  nsRefPtr<ContentParent> parent =
+    BackgroundParent::GetContentParent(Manager());
+
+  // If the ContentParent is null we are dealing with a same-process actor.
+  if (!parent) {
+    callback->Run();
+    return true;
+  }
+
+  nsRefPtr<CheckPrincipalWithCallbackRunnable> runnable =
+    new CheckPrincipalWithCallbackRunnable(parent.forget(), aData.principal(),
+                                           callback);
+  nsresult rv = NS_DispatchToMainThread(runnable);
+  MOZ_ALWAYS_TRUE(NS_SUCCEEDED(rv));
+
+  return true;
+}
+
+bool
+ServiceWorkerManagerParent::RecvUnregister(const PrincipalInfo& aPrincipalInfo,
+                                           const nsString& aScope)
+{
+  AssertIsInMainProcess();
+  AssertIsOnBackgroundThread();
+
+  // Basic validation.
+  if (aScope.IsEmpty() ||
+      aPrincipalInfo.type() == PrincipalInfo::TNullPrincipalInfo ||
+      aPrincipalInfo.type() == PrincipalInfo::TSystemPrincipalInfo) {
+    return false;
+  }
+
+  nsRefPtr<UnregisterServiceWorkerCallback> callback =
+    new UnregisterServiceWorkerCallback(aPrincipalInfo, aScope);
+
+  nsRefPtr<ContentParent> parent =
+    BackgroundParent::GetContentParent(Manager());
+
+  // If the ContentParent is null we are dealing with a same-process actor.
+  if (!parent) {
+    callback->Run();
+    return true;
+  }
+
+  nsRefPtr<CheckPrincipalWithCallbackRunnable> runnable =
+    new CheckPrincipalWithCallbackRunnable(parent.forget(), aPrincipalInfo,
+                                           callback);
+  nsresult rv = NS_DispatchToMainThread(runnable);
+  MOZ_ALWAYS_TRUE(NS_SUCCEEDED(rv));
+
+  return true;
+}
+
+bool
+ServiceWorkerManagerParent::RecvPropagateSoftUpdate(const OriginAttributes& aOriginAttributes,
+                                                    const nsString& aScope)
+{
+  AssertIsOnBackgroundThread();
+
+  if (NS_WARN_IF(!mService)) {
+    return false;
+  }
+
+  mService->PropagateSoftUpdate(mID, aOriginAttributes, aScope);
+  return true;
+}
+
+bool
+ServiceWorkerManagerParent::RecvPropagateUnregister(const PrincipalInfo& aPrincipalInfo,
+                                                    const nsString& aScope)
+{
+  AssertIsOnBackgroundThread();
+
+  if (NS_WARN_IF(!mService)) {
+    return false;
+  }
+
+  mService->PropagateUnregister(mID, aPrincipalInfo, aScope);
+  return true;
+}
+
+bool
+ServiceWorkerManagerParent::RecvShutdown()
+{
+  AssertIsOnBackgroundThread();
+
+  if (NS_WARN_IF(!mService)) {
+    return false;
+  }
+
+  mService->UnregisterActor(this);
+  mService = nullptr;
+
+  unused << Send__delete__(this);
+  return true;
+}
+
+void
+ServiceWorkerManagerParent::ActorDestroy(ActorDestroyReason aWhy)
+{
+  AssertIsOnBackgroundThread();
+
+  if (mService) {
+    // This object is about to be released and with it, also mService will be
+    // released too.
+    mService->UnregisterActor(this);
+  }
+}
+
+} // workers namespace
+} // dom namespace
+} // mozilla namespace
diff --git a/dom/workers/ServiceWorkerManagerParent.h b/dom/workers/ServiceWorkerManagerParent.h
new file mode 100644
index 000000000000..9261fb367a56
--- /dev/null
+++ b/dom/workers/ServiceWorkerManagerParent.h
@@ -0,0 +1,66 @@
+/* -*- Mode: C++; tab-width: 8; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
+/* vim: set ts=8 sts=2 et sw=2 tw=80: */
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this file,
+ * You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+#ifndef mozilla_dom_ServiceWorkerManagerParent_h
+#define mozilla_dom_ServiceWorkerManagerParent_h
+
+#include "mozilla/dom/PServiceWorkerManagerParent.h"
+
+namespace mozilla {
+
+class OriginAttributes;
+
+namespace ipc {
+class BackgroundParentImpl;
+}
+
+namespace dom {
+namespace workers {
+
+class ServiceWorkerManagerService;
+
+class ServiceWorkerManagerParent final : public PServiceWorkerManagerParent
+{
+  friend class mozilla::ipc::BackgroundParentImpl;
+
+public:
+  uint64_t ID() const
+  {
+    return mID;
+  }
+
+private:
+  ServiceWorkerManagerParent();
+  ~ServiceWorkerManagerParent();
+
+  virtual bool RecvRegister(
+                           const ServiceWorkerRegistrationData& aData) override;
+
+  virtual bool RecvUnregister(const PrincipalInfo& aPrincipalInfo,
+                              const nsString& aScope) override;
+
+  virtual bool RecvPropagateSoftUpdate(const OriginAttributes& aOriginAttributes,
+                                       const nsString& aScope) override;
+
+  virtual bool RecvPropagateUnregister(const PrincipalInfo& aPrincipalInfo,
+                                       const nsString& aScope) override;
+
+  virtual bool RecvShutdown() override;
+
+  virtual void ActorDestroy(ActorDestroyReason aWhy) override;
+
+  nsRefPtr<ServiceWorkerManagerService> mService;
+
+  // We use this ID in the Service in order to avoid the sending of messages to
+  // ourself.
+  uint64_t mID;
+};
+
+} // workers namespace
+} // dom namespace
+} // mozilla namespace
+
+#endif // mozilla_dom_ServiceWorkerManagerParent_h
diff --git a/dom/workers/ServiceWorkerManagerService.cpp b/dom/workers/ServiceWorkerManagerService.cpp
new file mode 100644
index 000000000000..3755eb178f01
--- /dev/null
+++ b/dom/workers/ServiceWorkerManagerService.cpp
@@ -0,0 +1,290 @@
+/* -*- Mode: C++; tab-width: 8; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
+/* vim: set ts=8 sts=2 et sw=2 tw=80: */
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+#include "ServiceWorkerManagerService.h"
+#include "ServiceWorkerManagerParent.h"
+#include "ServiceWorkerRegistrar.h"
+#include "mozilla/ipc/BackgroundParent.h"
+#include "mozilla/unused.h"
+
+namespace mozilla {
+
+using namespace ipc;
+
+namespace dom {
+namespace workers {
+
+namespace {
+
+ServiceWorkerManagerService* sInstance = nullptr;
+
+} // anonymous namespace
+
+ServiceWorkerManagerService::ServiceWorkerManagerService()
+{
+  AssertIsOnBackgroundThread();
+
+  // sInstance is a raw ServiceWorkerManagerService*.
+  MOZ_ASSERT(!sInstance);
+  sInstance = this;
+}
+
+ServiceWorkerManagerService::~ServiceWorkerManagerService()
+{
+  AssertIsOnBackgroundThread();
+  MOZ_ASSERT(sInstance == this);
+  MOZ_ASSERT(mAgents.Count() == 0);
+
+  sInstance = nullptr;
+}
+
+/* static */ already_AddRefed<ServiceWorkerManagerService>
+ServiceWorkerManagerService::Get()
+{
+  AssertIsOnBackgroundThread();
+
+  nsRefPtr<ServiceWorkerManagerService> instance = sInstance;
+  return instance.forget();
+}
+
+/* static */ already_AddRefed<ServiceWorkerManagerService>
+ServiceWorkerManagerService::GetOrCreate()
+{
+  AssertIsOnBackgroundThread();
+
+  nsRefPtr<ServiceWorkerManagerService> instance = sInstance;
+  if (!instance) {
+    instance = new ServiceWorkerManagerService();
+  }
+  return instance.forget();
+}
+
+void
+ServiceWorkerManagerService::RegisterActor(ServiceWorkerManagerParent* aParent)
+{
+  AssertIsOnBackgroundThread();
+  MOZ_ASSERT(aParent);
+  MOZ_ASSERT(!mAgents.Contains(aParent));
+
+  mAgents.PutEntry(aParent);
+}
+
+void
+ServiceWorkerManagerService::UnregisterActor(ServiceWorkerManagerParent* aParent)
+{
+  AssertIsOnBackgroundThread();
+  MOZ_ASSERT(aParent);
+  MOZ_ASSERT(mAgents.Contains(aParent));
+
+  mAgents.RemoveEntry(aParent);
+}
+
+namespace {
+
+struct MOZ_STACK_CLASS RegistrationData final
+{
+  RegistrationData(ServiceWorkerRegistrationData& aData,
+                   uint64_t aParentID)
+    : mData(aData)
+    , mParentID(aParentID)
+#ifdef DEBUG
+    , mParentFound(false)
+#endif
+  {
+    MOZ_COUNT_CTOR(RegistrationData);
+  }
+
+  ~RegistrationData()
+  {
+    MOZ_COUNT_DTOR(RegistrationData);
+  }
+
+  const ServiceWorkerRegistrationData& mData;
+  const uint64_t mParentID;
+#ifdef DEBUG
+  bool mParentFound;
+#endif
+};
+
+PLDHashOperator
+RegistrationEnumerator(nsPtrHashKey<ServiceWorkerManagerParent>* aKey, void* aPtr)
+{
+  AssertIsOnBackgroundThread();
+
+  auto* data = static_cast<RegistrationData*>(aPtr);
+
+  ServiceWorkerManagerParent* parent = aKey->GetKey();
+  MOZ_ASSERT(parent);
+
+  if (parent->ID() != data->mParentID) {
+    unused << parent->SendNotifyRegister(data->mData);
+#ifdef DEBUG
+  } else {
+    data->mParentFound = true;
+#endif
+  }
+
+  return PL_DHASH_NEXT;
+}
+
+struct MOZ_STACK_CLASS SoftUpdateData final
+{
+  SoftUpdateData(const OriginAttributes& aOriginAttributes,
+                 const nsAString& aScope,
+                 uint64_t aParentID)
+    : mOriginAttributes(aOriginAttributes)
+    , mScope(aScope)
+    , mParentID(aParentID)
+#ifdef DEBUG
+    , mParentFound(false)
+#endif
+  {
+    MOZ_COUNT_CTOR(SoftUpdateData);
+  }
+
+  ~SoftUpdateData()
+  {
+    MOZ_COUNT_DTOR(SoftUpdateData);
+  }
+
+  const OriginAttributes& mOriginAttributes;
+  const nsString mScope;
+  const uint64_t mParentID;
+#ifdef DEBUG
+  bool mParentFound;
+#endif
+};
+
+PLDHashOperator
+SoftUpdateEnumerator(nsPtrHashKey<ServiceWorkerManagerParent>* aKey, void* aPtr)
+{
+  AssertIsOnBackgroundThread();
+
+  auto* data = static_cast<SoftUpdateData*>(aPtr);
+  ServiceWorkerManagerParent* parent = aKey->GetKey();
+  MOZ_ASSERT(parent);
+
+  if (parent->ID() != data->mParentID) {
+    unused <<parent->SendNotifySoftUpdate(data->mOriginAttributes,
+                                          data->mScope);
+#ifdef DEBUG
+  } else {
+    data->mParentFound = true;
+#endif
+  }
+
+  return PL_DHASH_NEXT;
+}
+
+struct MOZ_STACK_CLASS UnregisterData final
+{
+  UnregisterData(const PrincipalInfo& aPrincipalInfo,
+                 const nsAString& aScope,
+                 uint64_t aParentID)
+    : mPrincipalInfo(aPrincipalInfo)
+    , mScope(aScope)
+    , mParentID(aParentID)
+#ifdef DEBUG
+    , mParentFound(false)
+#endif
+  {
+    MOZ_COUNT_CTOR(UnregisterData);
+  }
+
+  ~UnregisterData()
+  {
+    MOZ_COUNT_DTOR(UnregisterData);
+  }
+
+  const PrincipalInfo mPrincipalInfo;
+  const nsString mScope;
+  const uint64_t mParentID;
+#ifdef DEBUG
+  bool mParentFound;
+#endif
+};
+
+PLDHashOperator
+UnregisterEnumerator(nsPtrHashKey<ServiceWorkerManagerParent>* aKey, void* aPtr)
+{
+  AssertIsOnBackgroundThread();
+
+  auto* data = static_cast<UnregisterData*>(aPtr);
+  ServiceWorkerManagerParent* parent = aKey->GetKey();
+  MOZ_ASSERT(parent);
+
+  if (parent->ID() != data->mParentID) {
+    unused << parent->SendNotifyUnregister(data->mPrincipalInfo, data->mScope);
+#ifdef DEBUG
+  } else {
+    data->mParentFound = true;
+#endif
+  }
+
+  return PL_DHASH_NEXT;
+}
+
+} // anonymous namespce
+
+void
+ServiceWorkerManagerService::PropagateRegistration(
+                                           uint64_t aParentID,
+                                           ServiceWorkerRegistrationData& aData)
+{
+  AssertIsOnBackgroundThread();
+
+  RegistrationData data(aData, aParentID);
+  mAgents.EnumerateEntries(RegistrationEnumerator, &data);
+
+#ifdef DEBUG
+  MOZ_ASSERT(data.mParentFound);
+#endif
+}
+
+void
+ServiceWorkerManagerService::PropagateSoftUpdate(
+                                      uint64_t aParentID,
+                                      const OriginAttributes& aOriginAttributes,
+                                      const nsAString& aScope)
+{
+  AssertIsOnBackgroundThread();
+
+  SoftUpdateData data(aOriginAttributes, aScope, aParentID);
+  mAgents.EnumerateEntries(SoftUpdateEnumerator, &data);
+
+#ifdef DEBUG
+  MOZ_ASSERT(data.mParentFound);
+#endif
+}
+
+void
+ServiceWorkerManagerService::PropagateUnregister(
+                                            uint64_t aParentID,
+                                            const PrincipalInfo& aPrincipalInfo,
+                                            const nsAString& aScope)
+{
+  AssertIsOnBackgroundThread();
+
+  nsRefPtr<dom::ServiceWorkerRegistrar> service =
+    dom::ServiceWorkerRegistrar::Get();
+  MOZ_ASSERT(service);
+
+  // It's possible that we don't have any ServiceWorkerManager managing this
+  // scope but we still need to unregister it from the ServiceWorkerRegistrar.
+  service->UnregisterServiceWorker(aPrincipalInfo,
+                                   NS_ConvertUTF16toUTF8(aScope));
+
+  UnregisterData data(aPrincipalInfo, aScope, aParentID);
+  mAgents.EnumerateEntries(UnregisterEnumerator, &data);
+
+#ifdef DEBUG
+  MOZ_ASSERT(data.mParentFound);
+#endif
+}
+
+} // workers namespace
+} // dom namespace
+} // mozilla namespace
diff --git a/dom/workers/ServiceWorkerManagerService.h b/dom/workers/ServiceWorkerManagerService.h
new file mode 100644
index 000000000000..d764bd78f4fa
--- /dev/null
+++ b/dom/workers/ServiceWorkerManagerService.h
@@ -0,0 +1,63 @@
+/* -*- Mode: C++; tab-width: 8; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
+/* vim: set ts=8 sts=2 et sw=2 tw=80: */
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this file,
+ * You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+#ifndef mozilla_dom_ServiceWorkerManagerService_h
+#define mozilla_dom_ServiceWorkerManagerService_h
+
+#include "nsISupportsImpl.h"
+#include "nsHashKeys.h"
+#include "nsTHashtable.h"
+
+namespace mozilla {
+
+class OriginAttributes;
+
+namespace ipc {
+class PrincipalInfo;
+}
+
+namespace dom {
+
+class ServiceWorkerRegistrationData;
+
+namespace workers {
+
+class ServiceWorkerManagerParent;
+
+class ServiceWorkerManagerService final
+{
+public:
+  NS_INLINE_DECL_REFCOUNTING(ServiceWorkerManagerService)
+
+  static already_AddRefed<ServiceWorkerManagerService> Get();
+  static already_AddRefed<ServiceWorkerManagerService> GetOrCreate();
+
+  void RegisterActor(ServiceWorkerManagerParent* aParent);
+  void UnregisterActor(ServiceWorkerManagerParent* aParent);
+
+  void PropagateRegistration(uint64_t aParentID,
+                             ServiceWorkerRegistrationData& aData);
+
+  void PropagateSoftUpdate(uint64_t aParentID,
+                           const OriginAttributes& aOriginAttributes,
+                           const nsAString& aScope);
+
+  void PropagateUnregister(uint64_t aParentID,
+                           const mozilla::ipc::PrincipalInfo& aPrincipalInfo,
+                           const nsAString& aScope);
+
+private:
+  ServiceWorkerManagerService();
+  ~ServiceWorkerManagerService();
+
+  nsTHashtable<nsPtrHashKey<ServiceWorkerManagerParent>> mAgents;
+};
+
+} // workers namespace
+} // dom namespace
+} // mozilla namespace
+
+#endif // mozilla_dom_ServiceWorkerManagerService_h
diff --git a/dom/workers/moz.build b/dom/workers/moz.build
index d238bf822d0b..956c6ddddb45 100644
--- a/dom/workers/moz.build
+++ b/dom/workers/moz.build
@@ -69,6 +69,9 @@ UNIFIED_SOURCES += [
     'ServiceWorkerContainer.cpp',
     'ServiceWorkerEvents.cpp',
     'ServiceWorkerManager.cpp',
+    'ServiceWorkerManagerChild.cpp',
+    'ServiceWorkerManagerParent.cpp',
+    'ServiceWorkerManagerService.cpp',
     'ServiceWorkerPeriodicUpdater.cpp',
     'ServiceWorkerRegistrar.cpp',
     'ServiceWorkerRegistration.cpp',
@@ -86,6 +89,7 @@ UNIFIED_SOURCES += [
 ]
 
 IPDL_SOURCES += [
+    'PServiceWorkerManager.ipdl',
     'ServiceWorkerRegistrarTypes.ipdlh',
 ]
 
diff --git a/dom/workers/test/serviceworkers/fetch/fetch_tests.js b/dom/workers/test/serviceworkers/fetch/fetch_tests.js
index 3bc802927d2f..1aeaac8c7387 100644
--- a/dom/workers/test/serviceworkers/fetch/fetch_tests.js
+++ b/dom/workers/test/serviceworkers/fetch/fetch_tests.js
@@ -134,7 +134,7 @@ fetchXHR('hello-after-extracting.gz', function(xhr) {
   finish();
 });
 
-fetchXHR('http://example.com/tests/dom/base/test/file_CrossSiteXHR_server.sjs?status=200&allowOrigin=*', function(xhr) {
+fetchXHR('http://example.com/tests/dom/security/test/cors/file_CrossSiteXHR_server.sjs?status=200&allowOrigin=*', function(xhr) {
   my_ok(xhr.status == 200, "cross origin load with correct headers should be successful");
   my_ok(xhr.getResponseHeader("access-control-allow-origin") == null, "cors headers should be filtered out");
   finish();
@@ -160,7 +160,7 @@ fetchXHR('redirect_serviceworker.sjs', function(xhr) {
 });
 
 expectAsyncResult();
-fetch('http://example.com/tests/dom/base/test/file_CrossSiteXHR_server.sjs?status=200&allowOrigin=*')
+fetch('http://example.com/tests/dom/security/test/cors/file_CrossSiteXHR_server.sjs?status=200&allowOrigin=*')
 .then(function(res) {
   my_ok(res.ok, "Valid CORS request should receive valid response");
   my_ok(res.type == "cors", "Response type should be CORS");
@@ -174,7 +174,7 @@ fetch('http://example.com/tests/dom/base/test/file_CrossSiteXHR_server.sjs?statu
 });
 
 expectAsyncResult();
-fetch('http://example.com/tests/dom/base/test/file_CrossSiteXHR_server.sjs?status=200', { mode: 'no-cors' })
+fetch('http://example.com/tests/dom/security/test/cors/file_CrossSiteXHR_server.sjs?status=200', { mode: 'no-cors' })
 .then(function(res) {
   my_ok(res.type == "opaque", "Response type should be opaque");
   my_ok(res.status == 0, "Status should be 0");
diff --git a/dom/workers/test/serviceworkers/fetch_event_worker.js b/dom/workers/test/serviceworkers/fetch_event_worker.js
index 856c656eedeb..524afa28482d 100644
--- a/dom/workers/test/serviceworkers/fetch_event_worker.js
+++ b/dom/workers/test/serviceworkers/fetch_event_worker.js
@@ -143,7 +143,7 @@ onfetch = function(ev) {
   }
 
   else if (ev.request.url.includes('opaque-on-same-origin')) {
-    var url = 'http://example.com/tests/dom/base/test/file_CrossSiteXHR_server.sjs?status=200';
+    var url = 'http://example.com/tests/dom/security/test/cors/file_CrossSiteXHR_server.sjs?status=200';
     ev.respondWith(fetch(url, { mode: 'no-cors' }));
   }
 
@@ -153,7 +153,7 @@ onfetch = function(ev) {
       return;
     }
 
-    var url = 'http://example.com/tests/dom/base/test/file_CrossSiteXHR_server.sjs?status=200';
+    var url = 'http://example.com/tests/dom/security/test/cors/file_CrossSiteXHR_server.sjs?status=200';
     ev.respondWith(fetch(url, { mode: ev.request.mode }));
   }
 
@@ -163,7 +163,7 @@ onfetch = function(ev) {
       return;
     }
 
-    var url = 'http://example.com/tests/dom/base/test/file_CrossSiteXHR_server.sjs?status=200&allowOrigin=*';
+    var url = 'http://example.com/tests/dom/security/test/cors/file_CrossSiteXHR_server.sjs?status=200&allowOrigin=*';
     ev.respondWith(fetch(url));
   }
 
diff --git a/dom/workers/test/serviceworkers/mochitest.ini b/dom/workers/test/serviceworkers/mochitest.ini
index 68982bf3d532..a0ff08418f4f 100644
--- a/dom/workers/test/serviceworkers/mochitest.ini
+++ b/dom/workers/test/serviceworkers/mochitest.ini
@@ -178,3 +178,4 @@ support-files =
 [test_origin_after_redirect_to_https_cached.html]
 [test_https_origin_after_redirect.html]
 [test_https_origin_after_redirect_cached.html]
+[test_register_base.html]
diff --git a/dom/workers/test/serviceworkers/test_register_base.html b/dom/workers/test/serviceworkers/test_register_base.html
new file mode 100644
index 000000000000..edc819daccaa
--- /dev/null
+++ b/dom/workers/test/serviceworkers/test_register_base.html
@@ -0,0 +1,40 @@
+<!--
+  Any copyright is dedicated to the Public Domain.
+  http://creativecommons.org/publicdomain/zero/1.0/
+-->
+<!DOCTYPE HTML>
+<html>
+<head>
+  <title>Test that registering a service worker uses the docuemnt URI for the secure origin check</title>
+  <script type="text/javascript" src="http://mochi.test:8888/tests/SimpleTest/SimpleTest.js"></script>
+  <link rel="stylesheet" type="text/css" href="http://mochi.test:8888/tests/SimpleTest/test.css" />
+  <base href="https://mozilla.org/">
+</head>
+<body>
+<p id="display"></p>
+<div id="content" style="display: none">
+</div>
+<pre id="test"></pre>
+<script class="testbody" type="text/javascript">
+
+  function runTest() {
+    navigator.serviceWorker.register("http://mochi.test:8888/tests/dom/workers/test/serviceworkers/empty.js")
+      .then(reg => {
+        ok(false, "Register should fail");
+        SimpleTest.finish();
+      }, err => {
+        is(err.name, "SecurityError", "Registration should fail with SecurityError");
+        SimpleTest.finish();
+      });
+  }
+
+  SimpleTest.waitForExplicitFinish();
+  onload = function() {
+    SpecialPowers.pushPrefEnv({"set": [
+      ["dom.serviceWorkers.exemptFromPerDomainMax", true],
+      ["dom.serviceWorkers.enabled", true],
+    ]}, runTest);
+  };
+</script>
+</body>
+</html>
diff --git a/gfx/2d/DrawTargetCairo.cpp b/gfx/2d/DrawTargetCairo.cpp
index 838f8e4abb4b..f13a323527a3 100644
--- a/gfx/2d/DrawTargetCairo.cpp
+++ b/gfx/2d/DrawTargetCairo.cpp
@@ -722,6 +722,27 @@ DrawTargetCairo::GetDummySurface()
   return mDummySurface;
 }
 
+static void
+PaintWithAlpha(cairo_t* aContext, const DrawOptions& aOptions)
+{
+  if (aOptions.mCompositionOp == CompositionOp::OP_SOURCE) {
+    // Cairo treats the source operator like a lerp when alpha is < 1.
+    // Approximate the desired operator by: out = 0; out += src*alpha;
+    if (aOptions.mAlpha == 1) {
+      cairo_set_operator(aContext, CAIRO_OPERATOR_SOURCE);
+      cairo_paint(aContext);
+    } else {
+      cairo_set_operator(aContext, CAIRO_OPERATOR_CLEAR);
+      cairo_paint(aContext);
+      cairo_set_operator(aContext, CAIRO_OPERATOR_ADD);
+      cairo_paint_with_alpha(aContext, aOptions.mAlpha);
+    }
+  } else {
+    cairo_set_operator(aContext, GfxOpToCairoOp(aOptions.mCompositionOp));
+    cairo_paint_with_alpha(aContext, aOptions.mAlpha);
+  }
+}
+
 void
 DrawTargetCairo::DrawSurface(SourceSurface *aSurface,
                              const Rect &aDest,
@@ -770,9 +791,7 @@ DrawTargetCairo::DrawSurface(SourceSurface *aSurface,
     cairo_set_source(mContext, pat);
   }
 
-  cairo_set_operator(mContext, GfxOpToCairoOp(aOptions.mCompositionOp));
-
-  cairo_paint_with_alpha(mContext, aOptions.mAlpha);
+  PaintWithAlpha(mContext, aOptions);
 
   cairo_pattern_destroy(pat);
 }
@@ -904,8 +923,7 @@ DrawTargetCairo::DrawPattern(const Pattern& aPattern,
     cairo_pop_group_to_source(mContext);
 
     // Now draw the content using the desired operator
-    cairo_set_operator(mContext, GfxOpToCairoOp(aOptions.mCompositionOp));
-    cairo_paint_with_alpha(mContext, aOptions.mAlpha);
+    PaintWithAlpha(mContext, aOptions);
   } else {
     cairo_set_operator(mContext, GfxOpToCairoOp(aOptions.mCompositionOp));
 
diff --git a/gfx/layers/TiledLayerBuffer.h b/gfx/layers/TiledLayerBuffer.h
index 2828dd7c1b5a..20548176be7b 100644
--- a/gfx/layers/TiledLayerBuffer.h
+++ b/gfx/layers/TiledLayerBuffer.h
@@ -26,6 +26,10 @@
 #endif
 
 namespace mozilla {
+
+struct TileUnit {};
+template<> struct IsPixel<TileUnit> : mozilla::TrueType {};
+
 namespace layers {
 
 // You can enable all the TILING_LOG print statements by
@@ -38,6 +42,24 @@ namespace layers {
 #  define TILING_LOG(...)
 #endif
 
+// Normal integer division truncates towards zero,
+// we instead want to floor to hangle negative numbers.
+static inline int floor_div(int a, int b)
+{
+  int rem = a % b;
+  int div = a/b;
+  if (rem == 0) {
+    return div;
+  } else {
+    // If the signs are different substract 1.
+    int sub;
+    sub = a ^ b;
+    // The results of this shift is either 0 or -1.
+    sub >>= 8*sizeof(int)-1;
+    return div+sub;
+  }
+}
+
 // An abstract implementation of a tile buffer. This code covers the logic of
 // moving and reusing tiles and leaves the validation up to the implementor. To
 // avoid the overhead of virtual dispatch, we employ the curiously recurring
@@ -89,17 +111,56 @@ namespace layers {
 // should always be a factor of the tile length, to avoid tiles covering
 // non-integer amounts of pixels.
 
+// Size and Point in number of tiles rather than in pixels
+typedef gfx::IntSizeTyped<TileUnit> TileIntSize;
+typedef gfx::IntPointTyped<TileUnit> TileIntPoint;
+
+/**
+ * Stores the origin and size of a tile buffer and handles switching between
+ * tile indices and tile positions.
+ *
+ * Tile positions in TileIntPoint take the first tile offset into account which
+ * means that two TilesPlacement of the same layer and resolution give tile
+ * positions in the same coordinate space (useful when changing the offset and/or
+ * size of a tile buffer).
+ */
+struct TilesPlacement {
+  // in tiles
+  TileIntPoint mFirst;
+  TileIntSize mSize;
+
+  TilesPlacement(int aFirstX, int aFirstY,
+                 int aRetainedWidth, int aRetainedHeight)
+  : mFirst(aFirstX, aFirstY)
+  , mSize(aRetainedWidth, aRetainedHeight)
+  {}
+
+  int TileIndex(TileIntPoint aPosition) const {
+    return (aPosition.x - mFirst.x) * mSize.height + aPosition.y - mFirst.y;
+  }
+
+  TileIntPoint TilePosition(size_t aIndex) const {
+    return TileIntPoint(
+      mFirst.x + aIndex / mSize.height,
+      mFirst.y + aIndex % mSize.height
+    );
+  }
+
+  bool HasTile(TileIntPoint aPosition) {
+    return aPosition.x >= mFirst.x && aPosition.x < mFirst.x + mSize.width &&
+           aPosition.y >= mFirst.y && aPosition.y < mFirst.y + mSize.height;
+  }
+};
+
 template<typename Derived, typename Tile>
 class TiledLayerBuffer
 {
 public:
   TiledLayerBuffer()
-    : mFirstTileX(0)
-    , mFirstTileY(0)
-    , mRetainedWidth(0)
-    , mRetainedHeight(0)
+    : mTiles(0, 0, 0, 0)
     , mResolution(1)
-    , mTileSize(gfxPlatform::GetPlatform()->GetTileWidth(), gfxPlatform::GetPlatform()->GetTileHeight())
+    , mTileSize(gfxPlatform::GetPlatform()->GetTileWidth(),
+                gfxPlatform::GetPlatform()->GetTileHeight())
   {}
 
   ~TiledLayerBuffer() {}
@@ -117,13 +178,23 @@ public:
   //  GetScaledTileSize().width, GetScaledTileSize().height)
   Tile& GetTile(int x, int y);
 
+  Tile& GetTile(size_t i) { return mRetainedTiles[i]; }
+
+  gfx::IntPoint GetTileOffset(TileIntPoint aPosition) const {
+    gfx::IntSize scaledTileSize = GetScaledTileSize();
+    return gfx::IntPoint(aPosition.x * scaledTileSize.width,
+                         aPosition.y * scaledTileSize.height);
+  }
+
+  const TilesPlacement& GetPlacement() const { return mTiles; }
+
   int TileIndex(const gfx::IntPoint& aTileOrigin) const;
-  int TileIndex(int x, int y) const { return x * mRetainedHeight + y; }
+  int TileIndex(int x, int y) const { return x * mTiles.mSize.height + y; }
 
   bool HasTile(int index) const { return index >= 0 && index < (int)mRetainedTiles.Length(); }
   bool HasTile(const gfx::IntPoint& aTileOrigin) const;
   bool HasTile(int x, int y) const {
-    return x >= 0 && x < mRetainedWidth && y >= 0 && y < mRetainedHeight;
+    return x >= 0 && x < mTiles.mSize.width && y >= 0 && y < mTiles.mSize.height;
   }
 
   const gfx::IntSize& GetTileSize() const { return mTileSize; }
@@ -139,8 +210,8 @@ public:
   void ResetPaintedAndValidState() {
     mPaintedRegion.SetEmpty();
     mValidRegion.SetEmpty();
-    mRetainedWidth = 0;
-    mRetainedHeight = 0;
+    mTiles.mSize.width = 0;
+    mTiles.mSize.height = 0;
     for (size_t i = 0; i < mRetainedTiles.Length(); i++) {
       if (!mRetainedTiles[i].IsPlaceholderTile()) {
         AsDerived().ReleaseTile(mRetainedTiles[i]);
@@ -188,7 +259,7 @@ protected:
   nsIntRegion     mPaintedRegion;
 
   /**
-   * mRetainedTiles is a rectangular buffer of mRetainedWidth x mRetainedHeight
+   * mRetainedTiles is a rectangular buffer of mTiles.mSize.width x mTiles.mSize.height
    * stored as column major with the same origin as mValidRegion.GetBounds().
    * Any tile that does not intersect mValidRegion is a PlaceholderTile.
    * Only the region intersecting with mValidRegion should be read from a tile,
@@ -196,10 +267,7 @@ protected:
    * tiles is scaled by mResolution.
    */
   nsTArray<Tile>  mRetainedTiles;
-  int             mFirstTileX;
-  int             mFirstTileY;
-  int             mRetainedWidth;  // in tiles
-  int             mRetainedHeight; // in tiles
+  TilesPlacement  mTiles;
   float           mResolution;
   gfx::IntSize    mTileSize;
 
@@ -239,29 +307,11 @@ public:
   virtual const nsIntRegion& GetValidRegion() const = 0;
 };
 
-// Normal integer division truncates towards zero,
-// we instead want to floor to hangle negative numbers.
-static inline int floor_div(int a, int b)
-{
-  int rem = a % b;
-  int div = a/b;
-  if (rem == 0) {
-    return div;
-  } else {
-    // If the signs are different substract 1.
-    int sub;
-    sub = a ^ b;
-    // The results of this shift is either 0 or -1.
-    sub >>= 8*sizeof(int)-1;
-    return div+sub;
-  }
-}
-
 template<typename Derived, typename Tile> bool
 TiledLayerBuffer<Derived, Tile>::HasTile(const gfx::IntPoint& aTileOrigin) const {
   gfx::IntSize scaledTileSize = GetScaledTileSize();
-  return HasTile(floor_div(aTileOrigin.x, scaledTileSize.width) - mFirstTileX,
-                 floor_div(aTileOrigin.y, scaledTileSize.height) - mFirstTileY);
+  return HasTile(floor_div(aTileOrigin.x, scaledTileSize.width) - mTiles.mFirst.x,
+                 floor_div(aTileOrigin.y, scaledTileSize.height) - mTiles.mFirst.y);
 }
 
 template<typename Derived, typename Tile> Tile&
@@ -279,8 +329,8 @@ TiledLayerBuffer<Derived, Tile>::TileIndex(const gfx::IntPoint& aTileOrigin) con
   // Find the tile x/y of the first tile and the target tile relative to the (0, 0)
   // origin, the difference is the tile x/y relative to the start of the tile buffer.
   gfx::IntSize scaledTileSize = GetScaledTileSize();
-  return TileIndex(floor_div(aTileOrigin.x, scaledTileSize.width) - mFirstTileX,
-                   floor_div(aTileOrigin.y, scaledTileSize.height) - mFirstTileY);
+  return TileIndex(floor_div(aTileOrigin.x, scaledTileSize.width) - mTiles.mFirst.x,
+                   floor_div(aTileOrigin.y, scaledTileSize.height) - mTiles.mFirst.y);
 }
 
 template<typename Derived, typename Tile> Tile&
@@ -342,7 +392,7 @@ TiledLayerBuffer<Derived, Tile>::Update(const nsIntRegion& newValidRegion,
   // This is the reason we break the style guide with newValidRegion instead
   // of aNewValidRegion - so that the names match better and code easier to read
   const nsIntRegion& oldValidRegion = mValidRegion;
-  const int oldRetainedHeight = mRetainedHeight;
+  const int oldRetainedHeight = mTiles.mSize.height;
 
 #ifdef GFX_TILEDLAYER_RETAINING_LOG
   { // scope ss
@@ -426,8 +476,8 @@ TiledLayerBuffer<Derived, Tile>::Update(const nsIntRegion& newValidRegion,
 
   // Keep track of the number of horizontal/vertical tiles
   // in the buffer so that we can easily look up a tile.
-  mRetainedWidth = tileX;
-  mRetainedHeight = tileY;
+  mTiles.mSize.width = tileX;
+  mTiles.mSize.height = tileY;
 
 #ifdef GFX_TILEDLAYER_RETAINING_LOG
   { // scope ss
@@ -621,8 +671,8 @@ TiledLayerBuffer<Derived, Tile>::Update(const nsIntRegion& newValidRegion,
   mRetainedTiles = newRetainedTiles;
   mValidRegion = newValidRegion;
 
-  mFirstTileX = floor_div(mValidRegion.GetBounds().x, scaledTileSize.width);
-  mFirstTileY = floor_div(mValidRegion.GetBounds().y, scaledTileSize.height);
+  mTiles.mFirst.x = floor_div(mValidRegion.GetBounds().x, scaledTileSize.width);
+  mTiles.mFirst.y = floor_div(mValidRegion.GetBounds().y, scaledTileSize.height);
 
   mPaintedRegion.Or(mPaintedRegion, aPaintRegion);
 }
diff --git a/gfx/layers/apz/src/AsyncPanZoomController.cpp b/gfx/layers/apz/src/AsyncPanZoomController.cpp
index c1a658c4f673..b8b3db877446 100644
--- a/gfx/layers/apz/src/AsyncPanZoomController.cpp
+++ b/gfx/layers/apz/src/AsyncPanZoomController.cpp
@@ -1736,8 +1736,8 @@ nsEventStatus AsyncPanZoomController::OnLongPress(const TapGestureInput& aEvent)
   if (controller) {
     CSSPoint geckoScreenPoint;
     if (ConvertToGecko(aEvent.mPoint, &geckoScreenPoint)) {
-      if (CurrentTouchBlock()->IsDuringFastMotion()) {
-        APZC_LOG("%p dropping long-press because of fast motion\n", this);
+      if (CurrentTouchBlock()->IsDuringFastFling()) {
+        APZC_LOG("%p dropping long-press because of fast fling\n", this);
         return nsEventStatus_eIgnore;
       }
       uint64_t blockId = GetInputQueue()->InjectNewTouchBlock(this);
@@ -2471,9 +2471,10 @@ bool AsyncPanZoomController::SnapBackIfOverscrolled() {
   return false;
 }
 
-bool AsyncPanZoomController::IsMovingFast() const {
+bool AsyncPanZoomController::IsFlingingFast() const {
   ReentrantMonitorAutoEnter lock(mMonitor);
-  if (GetVelocityVector().Length() > gfxPrefs::APZFlingStopOnTapThreshold()) {
+  if (mState == FLING &&
+      GetVelocityVector().Length() > gfxPrefs::APZFlingStopOnTapThreshold()) {
     APZC_LOG("%p is moving fast\n", this);
     return true;
   }
diff --git a/gfx/layers/apz/src/AsyncPanZoomController.h b/gfx/layers/apz/src/AsyncPanZoomController.h
index 01ebb1a168f9..afaf3c22a4a1 100644
--- a/gfx/layers/apz/src/AsyncPanZoomController.h
+++ b/gfx/layers/apz/src/AsyncPanZoomController.h
@@ -321,10 +321,10 @@ public:
   bool IsPannable() const;
 
   /**
-   * Returns true if the APZC has a velocity greater than the stop-on-tap
-   * fling velocity threshold (which is pref-controlled).
+   * Returns true if the APZC has been flung with a velocity greater than the
+   * stop-on-tap fling velocity threshold (which is pref-controlled).
    */
-  bool IsMovingFast() const;
+  bool IsFlingingFast() const;
 
   /**
    * Returns the identifier of the touch in the last touch event processed by
diff --git a/gfx/layers/apz/src/InputBlockState.cpp b/gfx/layers/apz/src/InputBlockState.cpp
index 9561b63eae8a..9135248eb8a2 100644
--- a/gfx/layers/apz/src/InputBlockState.cpp
+++ b/gfx/layers/apz/src/InputBlockState.cpp
@@ -421,7 +421,7 @@ TouchBlockState::TouchBlockState(const nsRefPtr<AsyncPanZoomController>& aTarget
                                  bool aTargetConfirmed)
   : CancelableBlockState(aTargetApzc, aTargetConfirmed)
   , mAllowedTouchBehaviorSet(false)
-  , mDuringFastMotion(false)
+  , mDuringFastFling(false)
   , mSingleTapOccurred(false)
 {
   TBS_LOG("Creating %p\n", this);
@@ -475,24 +475,24 @@ TouchBlockState::IsReadyForHandling() const
 }
 
 void
-TouchBlockState::SetDuringFastMotion()
+TouchBlockState::SetDuringFastFling()
 {
   TBS_LOG("%p setting fast-motion flag\n", this);
-  mDuringFastMotion = true;
+  mDuringFastFling = true;
 }
 
 bool
-TouchBlockState::IsDuringFastMotion() const
+TouchBlockState::IsDuringFastFling() const
 {
-  return mDuringFastMotion;
+  return mDuringFastFling;
 }
 
 bool
 TouchBlockState::SetSingleTapOccurred()
 {
   TBS_LOG("%p attempting to set single-tap occurred; disallowed=%d\n",
-    this, mDuringFastMotion);
-  if (!mDuringFastMotion) {
+    this, mDuringFastFling);
+  if (!mDuringFastFling) {
     mSingleTapOccurred = true;
     return true;
   }
diff --git a/gfx/layers/apz/src/InputBlockState.h b/gfx/layers/apz/src/InputBlockState.h
index 787272efc872..95bdd32c965c 100644
--- a/gfx/layers/apz/src/InputBlockState.h
+++ b/gfx/layers/apz/src/InputBlockState.h
@@ -298,19 +298,19 @@ public:
 
   /**
    * Sets a flag that indicates this input block occurred while the APZ was
-   * in a state of fast motion. This affects gestures that may be produced
+   * in a state of fast flinging. This affects gestures that may be produced
    * from input events in this block.
    */
-  void SetDuringFastMotion();
+  void SetDuringFastFling();
   /**
-   * @return true iff SetDuringFastMotion was called on this block.
+   * @return true iff SetDuringFastFling was called on this block.
    */
-  bool IsDuringFastMotion() const;
+  bool IsDuringFastFling() const;
   /**
    * Set the single-tap-occurred flag that indicates that this touch block
    * triggered a single tap event.
    * @return true if the flag was set. This may not happen if, for example,
-   *         SetDuringFastMotion was previously called.
+   *         SetDuringFastFling was previously called.
    */
   bool SetSingleTapOccurred();
   /**
@@ -350,7 +350,7 @@ public:
 private:
   nsTArray<TouchBehaviorFlags> mAllowedTouchBehaviors;
   bool mAllowedTouchBehaviorSet;
-  bool mDuringFastMotion;
+  bool mDuringFastFling;
   bool mSingleTapOccurred;
   nsTArray<MultiTouchInput> mEvents;
 };
diff --git a/gfx/layers/apz/src/InputQueue.cpp b/gfx/layers/apz/src/InputQueue.cpp
index d1928c400e9a..0574c1856dc5 100644
--- a/gfx/layers/apz/src/InputQueue.cpp
+++ b/gfx/layers/apz/src/InputQueue.cpp
@@ -98,14 +98,14 @@ InputQueue::ReceiveTouchInput(const nsRefPtr<AsyncPanZoomController>& aTarget,
     // else. For now assume this is rare enough that it's not an issue.
     if (block == CurrentBlock() &&
         aEvent.mTouches.Length() == 1 &&
-        block->GetOverscrollHandoffChain()->HasFastMovingApzc() &&
+        block->GetOverscrollHandoffChain()->HasFastFlungApzc() &&
         haveBehaviors) {
       // If we're already in a fast fling, and a single finger goes down, then
       // we want special handling for the touch event, because it shouldn't get
       // delivered to content. Note that we don't set this flag when going
       // from a fast fling to a pinch state (i.e. second finger goes down while
       // the first finger is moving).
-      block->SetDuringFastMotion();
+      block->SetDuringFastFling();
       block->SetConfirmedTargetApzc(aTarget);
       if (gfxPrefs::TouchActionEnabled()) {
         block->SetAllowedTouchBehaviors(currentBehaviors);
@@ -144,7 +144,7 @@ InputQueue::ReceiveTouchInput(const nsRefPtr<AsyncPanZoomController>& aTarget,
   // XXX calling ArePointerEventsConsumable on |target| may be wrong here if
   // the target isn't confirmed and the real target turns out to be something
   // else. For now assume this is rare enough that it's not an issue.
-  if (block->IsDuringFastMotion()) {
+  if (block->IsDuringFastFling()) {
     INPQ_LOG("dropping event due to block %p being in fast motion\n", block);
     result = nsEventStatus_eConsumeNoDefault;
   } else if (target && target->ArePointerEventsConsumable(block, aEvent.AsMultiTouchInput().mTouches.Length())) {
diff --git a/gfx/layers/apz/src/OverscrollHandoffState.cpp b/gfx/layers/apz/src/OverscrollHandoffState.cpp
index 5ddb6bad7c2e..6d6088737987 100644
--- a/gfx/layers/apz/src/OverscrollHandoffState.cpp
+++ b/gfx/layers/apz/src/OverscrollHandoffState.cpp
@@ -168,9 +168,9 @@ OverscrollHandoffChain::HasOverscrolledApzc() const
 }
 
 bool
-OverscrollHandoffChain::HasFastMovingApzc() const
+OverscrollHandoffChain::HasFastFlungApzc() const
 {
-  return AnyApzc(&AsyncPanZoomController::IsMovingFast);
+  return AnyApzc(&AsyncPanZoomController::IsFlingingFast);
 }
 
 nsRefPtr<AsyncPanZoomController>
diff --git a/gfx/layers/apz/src/OverscrollHandoffState.h b/gfx/layers/apz/src/OverscrollHandoffState.h
index ecf8752deb9b..a32818a3f24a 100644
--- a/gfx/layers/apz/src/OverscrollHandoffState.h
+++ b/gfx/layers/apz/src/OverscrollHandoffState.h
@@ -116,8 +116,8 @@ public:
   // Determine whether any APZC along this handoff chain is overscrolled.
   bool HasOverscrolledApzc() const;
 
-  // Determine whether any APZC along this handoff chain is moving fast.
-  bool HasFastMovingApzc() const;
+  // Determine whether any APZC along this handoff chain has been flung fast.
+  bool HasFastFlungApzc() const;
 
   nsRefPtr<AsyncPanZoomController> FindFirstScrollable(const ScrollWheelInput& aInput) const;
 
diff --git a/gfx/layers/client/ClientTiledPaintedLayer.cpp b/gfx/layers/client/ClientTiledPaintedLayer.cpp
index ea70921f1cb8..ee46f0b6f1a2 100644
--- a/gfx/layers/client/ClientTiledPaintedLayer.cpp
+++ b/gfx/layers/client/ClientTiledPaintedLayer.cpp
@@ -144,8 +144,8 @@ ClientTiledPaintedLayer::BeginPaint()
 
   if (!displayPortAncestor || !scrollAncestor) {
     // No displayport or scroll ancestor, so we can't do progressive rendering.
-#if defined(MOZ_WIDGET_ANDROID) || defined(MOZ_B2G)
-    // Both Android and b2g are guaranteed to have a displayport set, so this
+#if defined(MOZ_WIDGET_ANDROID) || defined(MOZ_WIDGET_GONK)
+    // Both Android and b2g on phones are guaranteed to have a displayport set, so this
     // should never happen.
     NS_WARNING("Tiled PaintedLayer with no scrollable container ancestor");
 #endif
diff --git a/gfx/layers/client/TiledContentClient.cpp b/gfx/layers/client/TiledContentClient.cpp
index a2c8d8ec5554..a1ce5a16a43d 100644
--- a/gfx/layers/client/TiledContentClient.cpp
+++ b/gfx/layers/client/TiledContentClient.cpp
@@ -874,8 +874,8 @@ ClientTiledLayerBuffer::GetSurfaceDescriptorTiles()
   }
   return SurfaceDescriptorTiles(mValidRegion, mPaintedRegion,
                                 tiles,
-                                mFirstTileX, mFirstTileY,
-                                mRetainedWidth, mRetainedHeight,
+                                mTiles.mFirst.x, mTiles.mFirst.y,
+                                mTiles.mSize.width, mTiles.mSize.height,
                                 mResolution, mFrameResolution.xScale,
                                 mFrameResolution.yScale);
 }
diff --git a/gfx/layers/composite/TiledContentHost.cpp b/gfx/layers/composite/TiledContentHost.cpp
index e8ad8daf7144..54ec0a4a0574 100644
--- a/gfx/layers/composite/TiledContentHost.cpp
+++ b/gfx/layers/composite/TiledContentHost.cpp
@@ -112,31 +112,43 @@ UseTileTexture(CompositableTextureHostRef& aTexture,
                TextureHost* aNewTexture,
                Compositor* aCompositor)
 {
-  if (aTexture && aTexture->GetFormat() != aNewTexture->GetFormat()) {
-    // Only reuse textures if their format match the new texture's.
-    aTextureSource = nullptr;
-    aTexture = nullptr;
+  MOZ_ASSERT(aNewTexture);
+  if (!aNewTexture) {
+    return;
   }
-  aTexture = aNewTexture;
-  if (aTexture) {
-    if (aCompositor) {
-      aTexture->SetCompositor(aCompositor);
-    }
 
-    if (!aUpdateRect.IsEmpty()) {
-#ifdef MOZ_GFX_OPTIMIZE_MOBILE
-      aTexture->Updated(nullptr);
-#else
-      // We possibly upload the entire texture contents here. This is a purposeful
-      // decision, as sub-image upload can often be slow and/or unreliable, but
-      // we may want to reevaluate this in the future.
-      // For !HasInternalBuffer() textures, this is likely a no-op.
-      nsIntRegion region = aUpdateRect;
-      aTexture->Updated(&region);
-#endif
+  if (aTexture) {
+    aTexture->SetCompositor(aCompositor);
+    aNewTexture->SetCompositor(aCompositor);
+
+    if (aTexture->GetFormat() != aNewTexture->GetFormat()) {
+      // Only reuse textures if their format match the new texture's.
+      aTextureSource = nullptr;
+      aTexture = nullptr;
     }
-    aTexture->PrepareTextureSource(aTextureSource);
   }
+
+  aTexture = aNewTexture;
+
+
+  if (aCompositor) {
+    aTexture->SetCompositor(aCompositor);
+  }
+
+  if (!aUpdateRect.IsEmpty()) {
+#ifdef MOZ_GFX_OPTIMIZE_MOBILE
+    aTexture->Updated(nullptr);
+#else
+    // We possibly upload the entire texture contents here. This is a purposeful
+    // decision, as sub-image upload can often be slow and/or unreliable, but
+    // we may want to reevaluate this in the future.
+    // For !HasInternalBuffer() textures, this is likely a no-op.
+    nsIntRegion region = aUpdateRect;
+    aTexture->Updated(&region);
+#endif
+  }
+
+  aTexture->PrepareTextureSource(aTextureSource);
 }
 
 bool
@@ -183,27 +195,22 @@ TiledLayerBufferComposite::UseTiles(const SurfaceDescriptorTiles& aTiles,
     return false;
   }
 
-  int newFirstTileX = aTiles.firstTileX();
-  int newFirstTileY = aTiles.firstTileY();
-  int oldFirstTileX = mFirstTileX;
-  int oldFirstTileY = mFirstTileY;
-  int newRetainedWidth = aTiles.retainedWidth();
-  int newRetainedHeight = aTiles.retainedHeight();
-  int oldRetainedWidth = mRetainedWidth;
-  int oldRetainedHeight = mRetainedHeight;
+  TilesPlacement oldTiles = mTiles;
+  TilesPlacement newTiles(aTiles.firstTileX(), aTiles.firstTileY(),
+                          aTiles.retainedWidth(), aTiles.retainedHeight());
 
   const InfallibleTArray<TileDescriptor>& tileDescriptors = aTiles.tiles();
 
-  nsTArray<TileHost> oldTiles;
-  mRetainedTiles.SwapElements(oldTiles);
+  nsTArray<TileHost> oldRetainedTiles;
+  mRetainedTiles.SwapElements(oldRetainedTiles);
   mRetainedTiles.SetLength(tileDescriptors.Length());
 
   // Step 1, we need to unlock tiles that don't have an internal buffer after the
   // next frame where they are replaced.
   // Since we are about to replace the tiles' textures, we need to keep their locks
   // somewhere (in mPreviousSharedLock) until we composite the layer.
-  for (size_t i = 0; i < oldTiles.Length(); ++i) {
-    TileHost& tile = oldTiles[i];
+  for (size_t i = 0; i < oldRetainedTiles.Length(); ++i) {
+    TileHost& tile = oldRetainedTiles[i];
     // It can happen that we still have a previous lock at this point,
     // if we changed a tile's front buffer (causing mSharedLock to
     // go into mPreviousSharedLock, and then did not composite that tile until
@@ -213,12 +220,8 @@ TiledLayerBufferComposite::UseTiles(const SurfaceDescriptorTiles& aTiles,
 
     if (tile.mTextureHost && !tile.mTextureHost->HasInternalBuffer()) {
       MOZ_ASSERT(tile.mSharedLock);
-      int tileX = i / oldRetainedHeight + oldFirstTileX;
-      int tileY = i % oldRetainedHeight + oldFirstTileY;
-
-      if (tileX >= newFirstTileX && tileY >= newFirstTileY &&
-          tileX < (newFirstTileX + newRetainedWidth) &&
-          tileY < (newFirstTileY + newRetainedHeight)) {
+      const TileIntPoint tilePosition = oldTiles.TilePosition(i);
+      if (newTiles.HasTile(tilePosition)) {
         // This tile still exist in the new buffer
         tile.mPreviousSharedLock = tile.mSharedLock;
         tile.mSharedLock = nullptr;
@@ -237,29 +240,25 @@ TiledLayerBufferComposite::UseTiles(const SurfaceDescriptorTiles& aTiles,
   // they should be with the new retained with and height rather than the
   // old one.
   for (size_t i = 0; i < tileDescriptors.Length(); i++) {
-    int tileX = i / newRetainedHeight + newFirstTileX;
-    int tileY = i % newRetainedHeight + newFirstTileY;
-
+    const TileIntPoint tilePosition = newTiles.TilePosition(i);
     // First, get the already existing tiles to the right place in the array,
     // and use placeholders where there was no tiles.
-    if (tileX < oldFirstTileX || tileY < oldFirstTileY ||
-        tileX >= (oldFirstTileX + oldRetainedWidth) ||
-        tileY >= (oldFirstTileY + oldRetainedHeight)) {
+    if (!oldTiles.HasTile(tilePosition)) {
       mRetainedTiles[i] = GetPlaceholderTile();
     } else {
-      mRetainedTiles[i] = oldTiles[(tileX - oldFirstTileX) * oldRetainedHeight +
-                                   (tileY - oldFirstTileY)];
+      mRetainedTiles[i] = oldRetainedTiles[oldTiles.TileIndex(tilePosition)];
       // If we hit this assertion it means we probably mixed something up in the
       // logic that tries to reuse tiles on the compositor side. It is most likely
       // benign, but we are missing some fast paths so let's try to make it not happen.
-      MOZ_ASSERT(tileX == mRetainedTiles[i].x && tileY == mRetainedTiles[i].y);
+      MOZ_ASSERT(tilePosition.x == mRetainedTiles[i].x &&
+                 tilePosition.y == mRetainedTiles[i].y);
     }
   }
 
   // It is important to remove the duplicated reference to tiles before calling
   // TextureHost::PrepareTextureSource, etc. because depending on the textures
   // ref counts we may or may not get some of the fast paths.
-  oldTiles.Clear();
+  oldRetainedTiles.Clear();
 
   // Step 3, handle the texture updates and release the copy-on-write locks.
   for (size_t i = 0; i < mRetainedTiles.Length(); i++) {
@@ -333,17 +332,13 @@ TiledLayerBufferComposite::UseTiles(const SurfaceDescriptorTiles& aTiles,
         break;
       }
     }
-
-    tile.x = i / newRetainedHeight + newFirstTileX;
-    tile.y = i % newRetainedHeight + newFirstTileY;
+    TileIntPoint tilePosition = newTiles.TilePosition(i);
+    tile.x = tilePosition.x;
+    tile.y = tilePosition.y;
   }
 
-  mFirstTileX = newFirstTileX;
-  mFirstTileY = newFirstTileY;
-  mRetainedWidth = newRetainedWidth;
-  mRetainedHeight = newRetainedHeight;
+  mTiles = newTiles;
   mValidRegion = aTiles.validRegion();
-
   mResolution = aTiles.resolution();
   mFrameResolution = CSSToParentLayerScale2D(aTiles.frameXResolution(),
                                              aTiles.frameYResolution());
@@ -359,10 +354,8 @@ TiledLayerBufferComposite::Clear()
     tile.ReadUnlockPrevious();
   }
   mRetainedTiles.Clear();
-  mFirstTileX = 0;
-  mFirstTileY = 0;
-  mRetainedWidth = 0;
-  mRetainedHeight = 0;
+  mTiles.mFirst = TileIntPoint();
+  mTiles.mSize = TileIntSize();
   mValidRegion = nsIntRegion();
   mPaintedRegion = nsIntRegion();
   mResolution = 1.0;
@@ -427,7 +420,6 @@ TiledContentHost::Composite(EffectChain& aEffectChain,
 
 void
 TiledContentHost::RenderTile(TileHost& aTile,
-                             const gfxRGBA* aBackgroundColor,
                              EffectChain& aEffectChain,
                              float aOpacity,
                              const gfx::Matrix4x4& aTransform,
@@ -438,20 +430,7 @@ TiledContentHost::RenderTile(TileHost& aTile,
                              const IntSize& aTextureBounds,
                              const gfx::Rect& aVisibleRect)
 {
-  if (aTile.IsPlaceholderTile()) {
-    // This shouldn't ever happen, but let's fail semi-gracefully. No need
-    // to warn, the texture update would have already caught this.
-    return;
-  }
-
-  if (aBackgroundColor) {
-    aEffectChain.mPrimaryEffect = new EffectSolidColor(ToColor(*aBackgroundColor));
-    nsIntRegionRectIterator it(aScreenRegion);
-    for (const IntRect* rect = it.Next(); rect != nullptr; rect = it.Next()) {
-      Rect graphicsRect(rect->x, rect->y, rect->width, rect->height);
-      mCompositor->DrawQuad(graphicsRect, aClipRect, aEffectChain, 1.0, aTransform);
-    }
-  }
+  MOZ_ASSERT(!aTile.IsPlaceholderTile());
 
   AutoLockTextureHost autoLock(aTile.mTextureHost);
   AutoLockTextureHost autoLockOnWhite(aTile.mTextureHostOnWhite);
@@ -519,9 +498,9 @@ TiledContentHost::RenderLayerBuffer(TiledLayerBufferComposite& aLayerBuffer,
   float resolution = aLayerBuffer.GetResolution();
   gfx::Size layerScale(1, 1);
 
-  // We assume that the current frame resolution is the one used in our high
-  // precision layer buffer. Compensate for a changing frame resolution when
-  // rendering the low precision buffer.
+  // Make sure we don't render at low resolution where we have valid high
+  // resolution content, to avoid overdraw and artifacts with semi-transparent
+  // layers.
   if (aLayerBuffer.GetFrameResolution() != mTiledBuffer.GetFrameResolution()) {
     const CSSToParentLayerScale2D& layerResolution = aLayerBuffer.GetFrameResolution();
     const CSSToParentLayerScale2D& localResolution = mTiledBuffer.GetFrameResolution();
@@ -548,55 +527,57 @@ TiledContentHost::RenderLayerBuffer(TiledLayerBufferComposite& aLayerBuffer,
 
   DiagnosticFlags componentAlphaDiagnostic = DiagnosticFlags::NO_DIAGNOSTIC;
 
-  uint32_t rowCount = 0;
-  uint32_t tileX = 0;
+  nsIntRegion compositeRegion = aLayerBuffer.GetValidRegion();
+  compositeRegion.AndWith(aVisibleRegion);
+  compositeRegion.SubOut(maskRegion);
+
   IntRect visibleRect = aVisibleRegion.GetBounds();
-  gfx::IntSize scaledTileSize = aLayerBuffer.GetScaledTileSize();
-  for (int32_t x = visibleRect.x; x < visibleRect.x + visibleRect.width;) {
-    rowCount++;
-    int32_t tileStartX = aLayerBuffer.GetTileStart(x, scaledTileSize.width);
-    int32_t w = scaledTileSize.width - tileStartX;
-    if (x + w > visibleRect.x + visibleRect.width) {
-      w = visibleRect.x + visibleRect.width - x;
-    }
-    int tileY = 0;
-    for (int32_t y = visibleRect.y; y < visibleRect.y + visibleRect.height;) {
-      int32_t tileStartY = aLayerBuffer.GetTileStart(y, scaledTileSize.height);
-      int32_t h = scaledTileSize.height - tileStartY;
-      if (y + h > visibleRect.y + visibleRect.height) {
-        h = visibleRect.y + visibleRect.height - y;
-      }
 
-      nsIntPoint tileOrigin = nsIntPoint(aLayerBuffer.RoundDownToTileEdge(x, scaledTileSize.width),
-                                         aLayerBuffer.RoundDownToTileEdge(y, scaledTileSize.height));
-      TileHost& tileTexture = aLayerBuffer.GetTile(tileOrigin);
-      if (!tileTexture.IsPlaceholderTile()) {
-        nsIntRegion tileDrawRegion;
-        tileDrawRegion.And(IntRect(x, y, w, h), aLayerBuffer.GetValidRegion());
-        tileDrawRegion.And(tileDrawRegion, aVisibleRegion);
-        tileDrawRegion.Sub(tileDrawRegion, maskRegion);
-
-        if (!tileDrawRegion.IsEmpty()) {
-          tileDrawRegion.ScaleRoundOut(resolution, resolution);
-          IntPoint tileOffset((x - tileStartX) * resolution,
-                                (y - tileStartY) * resolution);
-          gfx::IntSize tileSize = aLayerBuffer.GetTileSize();
-          RenderTile(tileTexture, aBackgroundColor, aEffectChain, aOpacity, aTransform,
-                     aFilter, aClipRect, tileDrawRegion, tileOffset,
-                     IntSize(tileSize.width, tileSize.height),
-                     gfx::Rect(visibleRect.x, visibleRect.y,
-                               visibleRect.width, visibleRect.height));
-          if (tileTexture.mTextureHostOnWhite) {
-            componentAlphaDiagnostic = DiagnosticFlags::COMPONENT_ALPHA;
-          }
-        }
-      }
-      tileY++;
-      y += h;
-    }
-    tileX++;
-    x += w;
+  if (compositeRegion.IsEmpty()) {
+    return;
   }
+
+  if (aBackgroundColor) {
+    nsIntRegion backgroundRegion = compositeRegion;
+    backgroundRegion.ScaleRoundOut(resolution, resolution);
+    EffectChain effect;
+    effect.mPrimaryEffect = new EffectSolidColor(ToColor(*aBackgroundColor));
+    nsIntRegionRectIterator it(backgroundRegion);
+    for (const IntRect* rect = it.Next(); rect != nullptr; rect = it.Next()) {
+      Rect graphicsRect(rect->x, rect->y, rect->width, rect->height);
+      mCompositor->DrawQuad(graphicsRect, aClipRect, effect, 1.0, aTransform);
+    }
+  }
+
+  for (size_t i = 0; i < aLayerBuffer.GetTileCount(); ++i) {
+    TileHost& tile = aLayerBuffer.GetTile(i);
+    if (tile.IsPlaceholderTile()) {
+      continue;
+    }
+
+    TileIntPoint tilePosition = aLayerBuffer.GetPlacement().TilePosition(i);
+    // A sanity check that catches a lot of mistakes.
+    MOZ_ASSERT(tilePosition.x == tile.x && tilePosition.y == tile.y);
+
+    IntPoint tileOffset = aLayerBuffer.GetTileOffset(tilePosition);
+    nsIntRegion tileDrawRegion = IntRect(tileOffset, aLayerBuffer.GetScaledTileSize());
+    tileDrawRegion.AndWith(compositeRegion);
+
+    if (tileDrawRegion.IsEmpty()) {
+      continue;
+    }
+
+    tileDrawRegion.ScaleRoundOut(resolution, resolution);
+    RenderTile(tile, aEffectChain, aOpacity,
+               aTransform, aFilter, aClipRect, tileDrawRegion,
+               tileOffset * resolution, aLayerBuffer.GetTileSize(),
+               gfx::Rect(visibleRect.x, visibleRect.y,
+                         visibleRect.width, visibleRect.height));
+    if (tile.mTextureHostOnWhite) {
+      componentAlphaDiagnostic = DiagnosticFlags::COMPONENT_ALPHA;
+    }
+  }
+
   gfx::Rect rect(visibleRect.x, visibleRect.y,
                  visibleRect.width, visibleRect.height);
   GetCompositor()->DrawDiagnostics(DiagnosticFlags::CONTENT | componentAlphaDiagnostic,
diff --git a/gfx/layers/composite/TiledContentHost.h b/gfx/layers/composite/TiledContentHost.h
index 2c3bd1cdb1db..27e07ecc64d6 100644
--- a/gfx/layers/composite/TiledContentHost.h
+++ b/gfx/layers/composite/TiledContentHost.h
@@ -275,7 +275,6 @@ private:
 
   // Renders a single given tile.
   void RenderTile(TileHost& aTile,
-                  const gfxRGBA* aBackgroundColor,
                   EffectChain& aEffectChain,
                   float aOpacity,
                   const gfx::Matrix4x4& aTransform,
diff --git a/ipc/glue/BackgroundChildImpl.cpp b/ipc/glue/BackgroundChildImpl.cpp
index dd11bec52cf9..68411a91612b 100644
--- a/ipc/glue/BackgroundChildImpl.cpp
+++ b/ipc/glue/BackgroundChildImpl.cpp
@@ -6,6 +6,7 @@
 
 #include "ActorsChild.h" // IndexedDB
 #include "BroadcastChannelChild.h"
+#include "ServiceWorkerManagerChild.h"
 #include "FileDescriptorSetChild.h"
 #include "mozilla/media/MediaChild.h"
 #include "mozilla/Assertions.h"
@@ -260,6 +261,28 @@ BackgroundChildImpl::DeallocPBroadcastChannelChild(
   return true;
 }
 
+// -----------------------------------------------------------------------------
+// ServiceWorkerManager
+// -----------------------------------------------------------------------------
+
+dom::PServiceWorkerManagerChild*
+BackgroundChildImpl::AllocPServiceWorkerManagerChild()
+{
+  nsRefPtr<dom::workers::ServiceWorkerManagerChild> agent =
+    new dom::workers::ServiceWorkerManagerChild();
+  return agent.forget().take();
+}
+
+bool
+BackgroundChildImpl::DeallocPServiceWorkerManagerChild(
+                                             PServiceWorkerManagerChild* aActor)
+{
+  nsRefPtr<dom::workers::ServiceWorkerManagerChild> child =
+    dont_AddRef(static_cast<dom::workers::ServiceWorkerManagerChild*>(aActor));
+  MOZ_ASSERT(child);
+  return true;
+}
+
 // -----------------------------------------------------------------------------
 // Cache API
 // -----------------------------------------------------------------------------
diff --git a/ipc/glue/BackgroundChildImpl.h b/ipc/glue/BackgroundChildImpl.h
index 37b463d5ef66..9c2e011ed55e 100644
--- a/ipc/glue/BackgroundChildImpl.h
+++ b/ipc/glue/BackgroundChildImpl.h
@@ -98,6 +98,12 @@ protected:
   virtual bool
   DeallocPBroadcastChannelChild(PBroadcastChannelChild* aActor) override;
 
+  virtual PServiceWorkerManagerChild*
+  AllocPServiceWorkerManagerChild() override;
+
+  virtual bool
+  DeallocPServiceWorkerManagerChild(PServiceWorkerManagerChild* aActor) override;
+
   virtual dom::cache::PCacheStorageChild*
   AllocPCacheStorageChild(const dom::cache::Namespace& aNamespace,
                           const PrincipalInfo& aPrincipalInfo) override;
diff --git a/ipc/glue/BackgroundParentImpl.cpp b/ipc/glue/BackgroundParentImpl.cpp
index 87f3c6f9e67c..b5da95cc0931 100644
--- a/ipc/glue/BackgroundParentImpl.cpp
+++ b/ipc/glue/BackgroundParentImpl.cpp
@@ -27,6 +27,7 @@
 #include "nsThreadUtils.h"
 #include "nsTraceRefcnt.h"
 #include "nsXULAppAPI.h"
+#include "ServiceWorkerManagerParent.h"
 
 #ifdef DISABLE_ASSERTS_FOR_FUZZING
 #define ASSERT_UNLESS_FUZZING(...) do { } while (0)
@@ -82,6 +83,7 @@ namespace ipc {
 using mozilla::dom::ContentParent;
 using mozilla::dom::BroadcastChannelParent;
 using mozilla::dom::ServiceWorkerRegistrationData;
+using mozilla::dom::workers::ServiceWorkerManagerParent;
 
 BackgroundParentImpl::BackgroundParentImpl()
 {
@@ -468,6 +470,27 @@ BackgroundParentImpl::DeallocPBroadcastChannelParent(
   return true;
 }
 
+mozilla::dom::PServiceWorkerManagerParent*
+BackgroundParentImpl::AllocPServiceWorkerManagerParent()
+{
+  AssertIsInMainProcess();
+  AssertIsOnBackgroundThread();
+
+  return new ServiceWorkerManagerParent();
+}
+
+bool
+BackgroundParentImpl::DeallocPServiceWorkerManagerParent(
+                                            PServiceWorkerManagerParent* aActor)
+{
+  AssertIsInMainProcess();
+  AssertIsOnBackgroundThread();
+  MOZ_ASSERT(aActor);
+
+  delete static_cast<ServiceWorkerManagerParent*>(aActor);
+  return true;
+}
+
 media::PMediaParent*
 BackgroundParentImpl::AllocPMediaParent()
 {
@@ -480,187 +503,6 @@ BackgroundParentImpl::DeallocPMediaParent(media::PMediaParent *aActor)
   return media::DeallocPMediaParent(aActor);
 }
 
-namespace {
-
-class RegisterServiceWorkerCallback final : public nsRunnable
-{
-public:
-  explicit RegisterServiceWorkerCallback(
-                                     const ServiceWorkerRegistrationData& aData)
-    : mData(aData)
-  {
-    AssertIsInMainProcess();
-    AssertIsOnBackgroundThread();
-  }
-
-  NS_IMETHODIMP
-  Run()
-  {
-    AssertIsInMainProcess();
-    AssertIsOnBackgroundThread();
-
-    nsRefPtr<dom::ServiceWorkerRegistrar> service =
-      dom::ServiceWorkerRegistrar::Get();
-    MOZ_ASSERT(service);
-
-    service->RegisterServiceWorker(mData);
-    return NS_OK;
-  }
-
-private:
-  ServiceWorkerRegistrationData mData;
-};
-
-class UnregisterServiceWorkerCallback final : public nsRunnable
-{
-public:
-  UnregisterServiceWorkerCallback(const PrincipalInfo& aPrincipalInfo,
-                                  const nsString& aScope)
-    : mPrincipalInfo(aPrincipalInfo)
-    , mScope(aScope)
-  {
-    AssertIsInMainProcess();
-    AssertIsOnBackgroundThread();
-  }
-
-  NS_IMETHODIMP
-  Run()
-  {
-    AssertIsInMainProcess();
-    AssertIsOnBackgroundThread();
-
-    nsRefPtr<dom::ServiceWorkerRegistrar> service =
-      dom::ServiceWorkerRegistrar::Get();
-    MOZ_ASSERT(service);
-
-    service->UnregisterServiceWorker(mPrincipalInfo,
-                                     NS_ConvertUTF16toUTF8(mScope));
-    return NS_OK;
-  }
-
-private:
-  const PrincipalInfo mPrincipalInfo;
-  nsString mScope;
-};
-
-class CheckPrincipalWithCallbackRunnable final : public nsRunnable
-{
-public:
-  CheckPrincipalWithCallbackRunnable(already_AddRefed<ContentParent> aParent,
-                                     const PrincipalInfo& aPrincipalInfo,
-                                     nsRunnable* aCallback)
-    : mContentParent(aParent)
-    , mPrincipalInfo(aPrincipalInfo)
-    , mCallback(aCallback)
-    , mBackgroundThread(NS_GetCurrentThread())
-  {
-    AssertIsInMainProcess();
-    AssertIsOnBackgroundThread();
-
-    MOZ_ASSERT(mContentParent);
-    MOZ_ASSERT(mCallback);
-    MOZ_ASSERT(mBackgroundThread);
-  }
-
-  NS_IMETHODIMP Run()
-  {
-    if (NS_IsMainThread()) {
-      nsCOMPtr<nsIPrincipal> principal = PrincipalInfoToPrincipal(mPrincipalInfo);
-      AssertAppPrincipal(mContentParent, principal);
-      mContentParent = nullptr;
-
-      mBackgroundThread->Dispatch(this, NS_DISPATCH_NORMAL);
-      return NS_OK;
-    }
-
-    AssertIsOnBackgroundThread();
-    if (mCallback) {
-      mCallback->Run();
-      mCallback = nullptr;
-    }
-
-    return NS_OK;
-  }
-
-private:
-  nsRefPtr<ContentParent> mContentParent;
-  PrincipalInfo mPrincipalInfo;
-  nsRefPtr<nsRunnable> mCallback;
-  nsCOMPtr<nsIThread> mBackgroundThread;
-};
-
-} // anonymous namespace
-
-bool
-BackgroundParentImpl::RecvRegisterServiceWorker(
-                                     const ServiceWorkerRegistrationData& aData)
-{
-  AssertIsInMainProcess();
-  AssertIsOnBackgroundThread();
-
-  // Basic validation.
-  if (aData.scope().IsEmpty() ||
-      aData.scriptSpec().IsEmpty() ||
-      aData.principal().type() == PrincipalInfo::TNullPrincipalInfo ||
-      aData.principal().type() == PrincipalInfo::TSystemPrincipalInfo) {
-    return false;
-  }
-
-  nsRefPtr<RegisterServiceWorkerCallback> callback =
-    new RegisterServiceWorkerCallback(aData);
-
-  nsRefPtr<ContentParent> parent = BackgroundParent::GetContentParent(this);
-
-  // If the ContentParent is null we are dealing with a same-process actor.
-  if (!parent) {
-    callback->Run();
-    return true;
-  }
-
-  nsRefPtr<CheckPrincipalWithCallbackRunnable> runnable =
-    new CheckPrincipalWithCallbackRunnable(parent.forget(), aData.principal(),
-                                           callback);
-  nsresult rv = NS_DispatchToMainThread(runnable);
-  MOZ_ALWAYS_TRUE(NS_SUCCEEDED(rv));
-
-  return true;
-}
-
-bool
-BackgroundParentImpl::RecvUnregisterServiceWorker(
-                                            const PrincipalInfo& aPrincipalInfo,
-                                            const nsString& aScope)
-{
-  AssertIsInMainProcess();
-  AssertIsOnBackgroundThread();
-
-  // Basic validation.
-  if (aScope.IsEmpty() ||
-      aPrincipalInfo.type() == PrincipalInfo::TNullPrincipalInfo ||
-      aPrincipalInfo.type() == PrincipalInfo::TSystemPrincipalInfo) {
-    return false;
-  }
-
-  nsRefPtr<UnregisterServiceWorkerCallback> callback =
-    new UnregisterServiceWorkerCallback(aPrincipalInfo, aScope);
-
-  nsRefPtr<ContentParent> parent = BackgroundParent::GetContentParent(this);
-
-  // If the ContentParent is null we are dealing with a same-process actor.
-  if (!parent) {
-    callback->Run();
-    return true;
-  }
-
-  nsRefPtr<CheckPrincipalWithCallbackRunnable> runnable =
-    new CheckPrincipalWithCallbackRunnable(parent.forget(), aPrincipalInfo,
-                                           callback);
-  nsresult rv = NS_DispatchToMainThread(runnable);
-  MOZ_ALWAYS_TRUE(NS_SUCCEEDED(rv));
-
-  return true;
-}
-
 bool
 BackgroundParentImpl::RecvShutdownServiceWorkerRegistrar()
 {
diff --git a/ipc/glue/BackgroundParentImpl.h b/ipc/glue/BackgroundParentImpl.h
index c2686f5cba96..5c27512f25d8 100644
--- a/ipc/glue/BackgroundParentImpl.h
+++ b/ipc/glue/BackgroundParentImpl.h
@@ -86,20 +86,18 @@ protected:
   virtual bool
   DeallocPBroadcastChannelParent(PBroadcastChannelParent* aActor) override;
 
+  virtual PServiceWorkerManagerParent*
+  AllocPServiceWorkerManagerParent() override;
+
+  virtual bool
+  DeallocPServiceWorkerManagerParent(PServiceWorkerManagerParent* aActor) override;
+
   virtual PMediaParent*
   AllocPMediaParent() override;
 
   virtual bool
   DeallocPMediaParent(PMediaParent* aActor) override;
 
-  virtual bool
-  RecvRegisterServiceWorker(const ServiceWorkerRegistrationData& aData)
-                            override;
-
-  virtual bool
-  RecvUnregisterServiceWorker(const PrincipalInfo& aPrincipalInfo,
-                              const nsString& aScope) override;
-
   virtual bool
   RecvShutdownServiceWorkerRegistrar() override;
 
diff --git a/ipc/glue/BackgroundUtils.h b/ipc/glue/BackgroundUtils.h
index 2816bad0a142..2a8ed6fb9fa1 100644
--- a/ipc/glue/BackgroundUtils.h
+++ b/ipc/glue/BackgroundUtils.h
@@ -5,12 +5,38 @@
 #ifndef mozilla_ipc_backgroundutils_h__
 #define mozilla_ipc_backgroundutils_h__
 
+#include "ipc/IPCMessageUtils.h"
 #include "mozilla/Attributes.h"
+#include "mozilla/BasePrincipal.h"
 #include "nsCOMPtr.h"
 #include "nscore.h"
 
 class nsIPrincipal;
 
+namespace IPC {
+
+template<>
+struct ParamTraits<mozilla::OriginAttributes>
+{
+  typedef mozilla::OriginAttributes paramType;
+
+  static void Write(Message* aMsg, const paramType& aParam)
+  {
+    nsAutoCString suffix;
+    aParam.CreateSuffix(suffix);
+    WriteParam(aMsg, suffix);
+  }
+
+  static bool Read(const Message* aMsg, void** aIter, paramType* aResult)
+  {
+    nsAutoCString suffix;
+    return ReadParam(aMsg, aIter, &suffix) &&
+           aResult->PopulateFromSuffix(suffix);
+  }
+};
+
+} // IPC namespace
+
 namespace mozilla {
 namespace ipc {
 
diff --git a/ipc/glue/PBackground.ipdl b/ipc/glue/PBackground.ipdl
index 7d2945928dd4..084fe99878ac 100644
--- a/ipc/glue/PBackground.ipdl
+++ b/ipc/glue/PBackground.ipdl
@@ -11,13 +11,13 @@ include protocol PCacheStorage;
 include protocol PCacheStreamControl;
 include protocol PFileDescriptorSet;
 include protocol PMedia;
+include protocol PServiceWorkerManager;
 include protocol PUDPSocket;
 include protocol PVsync;
 
 include DOMTypes;
 include PBackgroundSharedTypes;
 include PBackgroundIDBSharedTypes;
-include ServiceWorkerRegistrarTypes;
 
 using mozilla::dom::cache::Namespace from "mozilla/dom/cache/Types.h";
 include "mozilla/dom/cache/IPCUtils.h";
@@ -36,6 +36,7 @@ sync protocol PBackground
   manages PCacheStreamControl;
   manages PFileDescriptorSet;
   manages PMedia;
+  manages PServiceWorkerManager;
   manages PUDPSocket;
   manages PVsync;
 
@@ -52,9 +53,8 @@ parent:
   PBroadcastChannel(PrincipalInfo pInfo, nsString origin, nsString channel,
                     bool privateBrowsing);
 
-  RegisterServiceWorker(ServiceWorkerRegistrationData data);
-  UnregisterServiceWorker(PrincipalInfo principalInfo,
-                          nsString scope);
+  PServiceWorkerManager();
+
   ShutdownServiceWorkerRegistrar();
 
   PCacheStorage(Namespace aNamespace, PrincipalInfo aPrincipalInfo);
diff --git a/ipc/glue/moz.build b/ipc/glue/moz.build
index 8f75c1fdb7bb..1e42ee25f2ef 100644
--- a/ipc/glue/moz.build
+++ b/ipc/glue/moz.build
@@ -133,6 +133,7 @@ LOCAL_INCLUDES += [
     '/caps',
     '/dom/broadcastchannel',
     '/dom/indexedDB',
+    '/dom/workers',
     '/xpcom/build',
 ]
 
diff --git a/js/public/Class.h b/js/public/Class.h
index 15b5dfd3eea0..7af36784b28f 100644
--- a/js/public/Class.h
+++ b/js/public/Class.h
@@ -406,7 +406,7 @@ class JS_FRIEND_API(ElementAdder)
 
     GetBehavior getBehavior() const { return getBehavior_; }
 
-    void append(JSContext* cx, JS::HandleValue v);
+    bool append(JSContext* cx, JS::HandleValue v);
     void appendHole();
 };
 
diff --git a/js/public/HeapAPI.h b/js/public/HeapAPI.h
index 6235a81faab8..61fdcfc026f6 100644
--- a/js/public/HeapAPI.h
+++ b/js/public/HeapAPI.h
@@ -388,7 +388,7 @@ IsIncrementalBarrierNeededOnTenuredGCThing(JS::shadow::Runtime* rt, const JS::GC
 {
     MOZ_ASSERT(thing);
     MOZ_ASSERT(!js::gc::IsInsideNursery(thing.asCell()));
-    if (!rt->needsIncrementalBarrier())
+    if (rt->isHeapBusy())
         return false;
     JS::Zone* zone = JS::GetTenuredGCThingZone(thing);
     return JS::shadow::Zone::asShadowZone(zone)->needsIncrementalBarrier();
diff --git a/js/src/builtin/Array.js b/js/src/builtin/Array.js
index 94703d253161..230da14adb76 100644
--- a/js/src/builtin/Array.js
+++ b/js/src/builtin/Array.js
@@ -253,8 +253,7 @@ function ArrayMap(callbackfn/*, thisArg*/) {
         if (k in O) {
             /* Step c.i-iii. */
             var mappedValue = callFunction(callbackfn, T, O[k], k, O);
-            // UnsafePutElements doesn't invoke setters, so we can use it here.
-            UnsafePutElements(A, k, mappedValue);
+            _DefineDataProperty(A, k, mappedValue);
         }
     }
 
@@ -718,9 +717,6 @@ function ArrayFrom(items, mapfn=undefined, thisArg=undefined) {
         ThrowTypeError(JSMSG_NOT_FUNCTION, DecompileArg(1, mapfn));
     var T = thisArg;
 
-    // All elements defined by this algorithm have the same attrs:
-    var attrs = ATTR_CONFIGURABLE | ATTR_ENUMERABLE | ATTR_WRITABLE;
-
     // Steps 4-5.
     var usingIterator = GetMethod(items, std_iterator);
 
@@ -757,7 +753,7 @@ function ArrayFrom(items, mapfn=undefined, thisArg=undefined) {
             var mappedValue = mapping ? callFunction(mapfn, thisArg, nextValue, k) : nextValue;
 
             // Steps 6.g.ix-xi.
-            _DefineDataProperty(A, k++, mappedValue, attrs);
+            _DefineDataProperty(A, k++, mappedValue);
         }
     }
 
@@ -782,7 +778,7 @@ function ArrayFrom(items, mapfn=undefined, thisArg=undefined) {
         var mappedValue = mapping ? callFunction(mapfn, thisArg, kValue, k) : kValue;
 
         // Steps 16.f-g.
-        _DefineDataProperty(A, k, mappedValue, attrs);
+        _DefineDataProperty(A, k, mappedValue);
     }
 
     // Steps 17-18.
diff --git a/js/src/builtin/Intl.js b/js/src/builtin/Intl.js
index 06f8f97d3f62..13980d23fd04 100644
--- a/js/src/builtin/Intl.js
+++ b/js/src/builtin/Intl.js
@@ -929,15 +929,6 @@ function GetNumberOption(options, property, minimum, maximum, fallback) {
 /********** Property access for Intl objects **********/
 
 
-/**
- * Set a normal public property p of o to value v, but use Object.defineProperty
- * to avoid interference from setters on Object.prototype.
- */
-function defineProperty(o, p, v) {
-    _DefineDataProperty(o, p, v, ATTR_ENUMERABLE | ATTR_CONFIGURABLE | ATTR_WRITABLE);
-}
-
-
 /**
  * Weak map used to track the initialize-as-Intl status (and, if an object has
  * been so initialized, the Intl-specific internal properties) of all objects.
@@ -1458,7 +1449,7 @@ function Intl_Collator_resolvedOptions() {
     for (var i = 0; i < relevantExtensionKeys.length; i++) {
         var key = relevantExtensionKeys[i];
         var property = (key === "co") ? "collation" : collatorKeyMappings[key].property;
-        defineProperty(result, property, internals[property]);
+        _DefineDataProperty(result, property, internals[property]);
     }
     return result;
 }
@@ -1901,7 +1892,7 @@ function Intl_NumberFormat_resolvedOptions() {
     for (var i = 0; i < optionalProperties.length; i++) {
         var p = optionalProperties[i];
         if (callFunction(std_Object_hasOwnProperty, internals, p))
-            defineProperty(result, p, internals[p]);
+            _DefineDataProperty(result, p, internals[p]);
     }
     return result;
 }
@@ -2366,17 +2357,17 @@ function ToDateTimeOptions(options, required, defaults) {
         // the Throw parameter, while Object.defineProperty uses true. For the
         // calls here, the difference doesn't matter because we're adding
         // properties to a new object.
-        defineProperty(options, "year", "numeric");
-        defineProperty(options, "month", "numeric");
-        defineProperty(options, "day", "numeric");
+        _DefineDataProperty(options, "year", "numeric");
+        _DefineDataProperty(options, "month", "numeric");
+        _DefineDataProperty(options, "day", "numeric");
     }
 
     // Step 8.
     if (needDefaults && (defaults === "time" || defaults === "all")) {
         // See comment for step 7.
-        defineProperty(options, "hour", "numeric");
-        defineProperty(options, "minute", "numeric");
-        defineProperty(options, "second", "numeric");
+        _DefineDataProperty(options, "hour", "numeric");
+        _DefineDataProperty(options, "minute", "numeric");
+        _DefineDataProperty(options, "second", "numeric");
     }
 
     // Step 9.
@@ -2680,11 +2671,11 @@ function resolveICUPattern(pattern, result) {
                 // skip other pattern characters and literal text
             }
             if (callFunction(std_Object_hasOwnProperty, icuPatternCharToComponent, c))
-                defineProperty(result, icuPatternCharToComponent[c], value);
+                _DefineDataProperty(result, icuPatternCharToComponent[c], value);
             if (c === "h" || c === "K")
-                defineProperty(result, "hour12", true);
+                _DefineDataProperty(result, "hour12", true);
             else if (c === "H" || c === "k")
-                defineProperty(result, "hour12", false);
+                _DefineDataProperty(result, "hour12", false);
         }
     }
 }
diff --git a/js/src/builtin/TestingFunctions.cpp b/js/src/builtin/TestingFunctions.cpp
index e38d4bcfb5b2..9883f63486ee 100644
--- a/js/src/builtin/TestingFunctions.cpp
+++ b/js/src/builtin/TestingFunctions.cpp
@@ -1121,6 +1121,8 @@ DumpHeap(JSContext* cx, unsigned argc, Value* vp)
 
     if (i != args.length()) {
         JS_ReportError(cx, "bad arguments passed to dumpHeap");
+        if (dumpFile)
+            fclose(dumpFile);
         return false;
     }
 
diff --git a/js/src/builtin/Utilities.js b/js/src/builtin/Utilities.js
index 4e8ca29ce761..184855a315d0 100644
--- a/js/src/builtin/Utilities.js
+++ b/js/src/builtin/Utilities.js
@@ -14,9 +14,7 @@
          AssertionFailed: false,
          MakeConstructible: false, DecompileArg: false,
          RuntimeDefaultLocale: false,
-         ParallelDo: false, ParallelSlices: false, NewDenseArray: false,
-         UnsafePutElements: false,
-         ParallelTestsShouldPass: false,
+         NewDenseArray: false,
          Dump: false,
          callFunction: false,
          TO_UINT32: false,
diff --git a/js/src/devtools/automation/cgc-jstests-slow.txt b/js/src/devtools/automation/cgc-jstests-slow.txt
index 2cb69816c7d0..244834859966 100644
--- a/js/src/devtools/automation/cgc-jstests-slow.txt
+++ b/js/src/devtools/automation/cgc-jstests-slow.txt
@@ -50,6 +50,7 @@ ecma_6/String/normalize-generateddata-part3.js
 js1_5/GC/regress-203278-2.js
 js1_5/GC/regress-203278-3.js
 js1_5/GC/regress-278725.js
+js1_5/Regress/regress-312588.js
 js1_5/Regress/regress-360969-01.js
 js1_5/Regress/regress-360969-02.js
 js1_5/Regress/regress-360969-03.js
diff --git a/js/src/gc/Barrier.h b/js/src/gc/Barrier.h
index 854fc483f1d9..d212c0cc9331 100644
--- a/js/src/gc/Barrier.h
+++ b/js/src/gc/Barrier.h
@@ -836,20 +836,6 @@ class HeapSlotArray
     }
 };
 
-/*
- * Operations on a Heap thing inside the GC need to strip the barriers from
- * pointer operations. This template helps do that in contexts where the type
- * is templatized.
- */
-template <typename T> struct Unbarriered {};
-template <typename S> struct Unbarriered< PreBarriered<S> > { typedef S* type; };
-template <typename S> struct Unbarriered< RelocatablePtr<S> > { typedef S* type; };
-template <> struct Unbarriered<PreBarrieredValue> { typedef Value type; };
-template <> struct Unbarriered<RelocatableValue> { typedef Value type; };
-template <typename S> struct Unbarriered< DefaultHasher< PreBarriered<S> > > {
-    typedef DefaultHasher<S*> type;
-};
-
 } /* namespace js */
 
 #endif /* gc_Barrier_h */
diff --git a/js/src/gc/Heap.h b/js/src/gc/Heap.h
index acc620c6b5db..140f9f86c818 100644
--- a/js/src/gc/Heap.h
+++ b/js/src/gc/Heap.h
@@ -1432,7 +1432,7 @@ TenuredCell::readBarrier(TenuredCell* thing)
 {
     MOZ_ASSERT(!CurrentThreadIsIonCompiling());
     MOZ_ASSERT(!isNullLike(thing));
-    if (!thing->shadowRuntimeFromAnyThread()->needsIncrementalBarrier())
+    if (thing->shadowRuntimeFromAnyThread()->isHeapBusy())
         return;
 
     JS::shadow::Zone* shadowZone = thing->shadowZoneFromAnyThread();
@@ -1450,7 +1450,7 @@ TenuredCell::readBarrier(TenuredCell* thing)
 TenuredCell::writeBarrierPre(TenuredCell* thing)
 {
     MOZ_ASSERT(!CurrentThreadIsIonCompiling());
-    if (isNullLike(thing) || !thing->shadowRuntimeFromAnyThread()->needsIncrementalBarrier())
+    if (isNullLike(thing) || thing->shadowRuntimeFromAnyThread()->isHeapBusy())
         return;
 
     JS::shadow::Zone* shadowZone = thing->shadowZoneFromAnyThread();
diff --git a/js/src/gc/Nursery.cpp b/js/src/gc/Nursery.cpp
index 91ec9d487788..59f99e41f43f 100644
--- a/js/src/gc/Nursery.cpp
+++ b/js/src/gc/Nursery.cpp
@@ -650,8 +650,10 @@ js::Nursery::sweep()
     {
 #ifdef JS_CRASH_DIAGNOSTICS
         JS_POISON((void*)start(), JS_SWEPT_NURSERY_PATTERN, allocationEnd() - start());
-        for (int i = 0; i < numActiveChunks_; ++i)
+        for (int i = 0; i < numActiveChunks_; ++i) {
+            chunk(i).trailer.location = gc::ChunkLocationBitNursery;
             chunk(i).trailer.runtime = runtime();
+        }
 #endif
         setCurrentChunk(0);
     }
diff --git a/js/src/gc/StoreBuffer.h b/js/src/gc/StoreBuffer.h
index 783f4bb340b4..9f40c782bd74 100644
--- a/js/src/gc/StoreBuffer.h
+++ b/js/src/gc/StoreBuffer.h
@@ -331,6 +331,8 @@ class StoreBuffer
     };
 
     bool isOkayToUseBuffer() const {
+        MOZ_ASSERT(!JS::shadow::Runtime::asShadowRuntime(runtime_)->isHeapBusy());
+
         /*
          * Disabled store buffers may not have a valid state; e.g. when stored
          * inline in the ChunkTrailer.
diff --git a/js/src/gc/Verifier.cpp b/js/src/gc/Verifier.cpp
index 57a3cb8a69c2..0225d9c7f871 100644
--- a/js/src/gc/Verifier.cpp
+++ b/js/src/gc/Verifier.cpp
@@ -98,7 +98,8 @@ class js::VerifyPreTracer : public JS::CallbackTracer
     NodeMap nodemap;
 
     explicit VerifyPreTracer(JSRuntime* rt)
-      : JS::CallbackTracer(rt), noggc(rt), number(rt->gc.gcNumber()), count(0), root(nullptr)
+      : JS::CallbackTracer(rt), noggc(rt), number(rt->gc.gcNumber()), count(0), curnode(nullptr),
+        root(nullptr), edgeptr(nullptr), term(nullptr)
     {}
 
     ~VerifyPreTracer() {
diff --git a/js/src/jit/BaselineIC.cpp b/js/src/jit/BaselineIC.cpp
index 0407d86bd5ca..14f8ca9ef54e 100644
--- a/js/src/jit/BaselineIC.cpp
+++ b/js/src/jit/BaselineIC.cpp
@@ -9306,8 +9306,8 @@ TryAttachFunCallStub(JSContext* cx, ICCall_Fallback* stub, HandleScript script,
 }
 
 static bool
-GetTemplateObjectForNative(JSContext* cx, HandleScript script, jsbytecode* pc,
-                           Native native, const CallArgs& args, MutableHandleObject res)
+GetTemplateObjectForNative(JSContext* cx, Native native, const CallArgs& args,
+                           MutableHandleObject res)
 {
     // Check for natives to which template objects can be attached. This is
     // done to provide templates to Ion for inlining these natives later on.
@@ -9321,27 +9321,16 @@ GetTemplateObjectForNative(JSContext* cx, HandleScript script, jsbytecode* pc,
             count = args.length();
         else if (args.length() == 1 && args[0].isInt32() && args[0].toInt32() >= 0)
             count = args[0].toInt32();
-        res.set(NewDenseUnallocatedArray(cx, count, nullptr, TenuredObject));
-        if (!res)
-            return false;
 
-        ObjectGroup* group = ObjectGroup::allocationSiteGroup(cx, script, pc, JSProto_Array);
-        if (!group)
-            return false;
-        res->setGroup(group);
-        return true;
-    }
-
-    if (native == intrinsic_NewDenseArray) {
-        res.set(NewDenseUnallocatedArray(cx, 0, nullptr, TenuredObject));
-        if (!res)
-            return false;
-
-        ObjectGroup* group = ObjectGroup::allocationSiteGroup(cx, script, pc, JSProto_Array);
-        if (!group)
-            return false;
-        res->setGroup(group);
-        return true;
+        if (count <= ArrayObject::EagerAllocationMaxLength) {
+            // With this and other array templates, set forceAnalyze so that we
+            // don't end up with a template whose structure might change later.
+            res.set(NewFullyAllocatedArrayForCallingAllocationSite(cx, count, TenuredObject,
+                                                                   /* forceAnalyze = */ true));
+            if (!res)
+                return false;
+            return true;
+        }
     }
 
     if (native == js::array_concat || native == js::array_slice) {
@@ -9354,14 +9343,10 @@ GetTemplateObjectForNative(JSContext* cx, HandleScript script, jsbytecode* pc,
     }
 
     if (native == js::str_split && args.length() == 1 && args[0].isString()) {
-        res.set(NewDenseUnallocatedArray(cx, 0, nullptr, TenuredObject));
+        res.set(NewFullyAllocatedArrayForCallingAllocationSite(cx, 0, TenuredObject,
+                                                               /* forceAnalyze = */ true));
         if (!res)
             return false;
-
-        ObjectGroup* group = ObjectGroup::allocationSiteGroup(cx, script, pc, JSProto_Array);
-        if (!group)
-            return false;
-        res->setGroup(group);
         return true;
     }
 
@@ -9655,7 +9640,7 @@ TryAttachCallStub(JSContext* cx, ICCall_Fallback* stub, HandleScript script, jsb
         RootedObject templateObject(cx);
         if (MOZ_LIKELY(!isSpread)) {
             CallArgs args = CallArgsFromVp(argc, vp);
-            if (!GetTemplateObjectForNative(cx, script, pc, fun->native(), args, &templateObject))
+            if (!GetTemplateObjectForNative(cx, fun->native(), args, &templateObject))
                 return false;
         }
 
@@ -9677,24 +9662,16 @@ TryAttachCallStub(JSContext* cx, ICCall_Fallback* stub, HandleScript script, jsb
 }
 
 static bool
-CopyArray(JSContext* cx, HandleArrayObject obj, MutableHandleValue result)
+CopyArray(JSContext* cx, HandleObject obj, MutableHandleValue result)
 {
-    MOZ_ASSERT(obj->is<ArrayObject>());
-    uint32_t length = obj->as<ArrayObject>().length();
-    MOZ_ASSERT(obj->getDenseInitializedLength() == length);
-
-    RootedObjectGroup group(cx, obj->getGroup(cx));
-    if (!group)
+    uint32_t length = GetAnyBoxedOrUnboxedArrayLength(obj);
+    JSObject* nobj = NewFullyAllocatedArrayTryReuseGroup(cx, obj, length, TenuredObject,
+                                                         /* forceAnalyze = */ true);
+    if (!nobj)
         return false;
+    CopyAnyBoxedOrUnboxedDenseElements(cx, nobj, obj, 0, 0, length);
 
-    RootedArrayObject newObj(cx, NewDenseFullyAllocatedArray(cx, length, nullptr, TenuredObject));
-    if (!newObj)
-        return false;
-
-    newObj->setGroup(group);
-    newObj->setDenseInitializedLength(length);
-    newObj->initDenseElements(0, obj->getDenseElements(), length);
-    result.setObject(*newObj);
+    result.setObject(*nobj);
     return true;
 }
 
@@ -9722,7 +9699,7 @@ TryAttachStringSplit(JSContext* cx, ICCall_Fallback* stub, HandleScript script,
 
     RootedString thisString(cx, thisv.toString());
     RootedString argString(cx, args[0].toString());
-    RootedArrayObject obj(cx, &res.toObject().as<ArrayObject>());
+    RootedObject obj(cx, &res.toObject());
     RootedValue arr(cx);
 
     // Copy the array before storing in stub.
@@ -9730,14 +9707,17 @@ TryAttachStringSplit(JSContext* cx, ICCall_Fallback* stub, HandleScript script,
         return false;
 
     // Atomize all elements of the array.
-    RootedArrayObject arrObj(cx, &arr.toObject().as<ArrayObject>());
-    uint32_t initLength = arrObj->length();
+    RootedObject arrObj(cx, &arr.toObject());
+    uint32_t initLength = GetAnyBoxedOrUnboxedArrayLength(arrObj);
     for (uint32_t i = 0; i < initLength; i++) {
-        JSAtom* str = js::AtomizeString(cx, arrObj->getDenseElement(i).toString());
+        JSAtom* str = js::AtomizeString(cx, GetAnyBoxedOrUnboxedDenseElement(arrObj, i).toString());
         if (!str)
             return false;
 
-        arrObj->setDenseElement(i, StringValue(str));
+        if (!SetAnyBoxedOrUnboxedDenseElement(cx, arrObj, i, StringValue(str))) {
+            // The value could not be stored to an unboxed dense element.
+            return true;
+        }
     }
 
     ICCall_StringSplit::Compiler compiler(cx, stub->fallbackMonitorStub()->firstMonitorStub(),
@@ -10595,7 +10575,7 @@ ICCallScriptedCompiler::generateStubCode(MacroAssembler& masm)
     return true;
 }
 
-typedef bool (*CopyArrayFn)(JSContext*, HandleArrayObject, MutableHandleValue);
+typedef bool (*CopyArrayFn)(JSContext*, HandleObject, MutableHandleValue);
 static const VMFunction CopyArrayInfo = FunctionInfo<CopyArrayFn>(CopyArray);
 
 bool
diff --git a/js/src/jit/BaselineIC.h b/js/src/jit/BaselineIC.h
index 5c404728b65a..48e52eda7197 100644
--- a/js/src/jit/BaselineIC.h
+++ b/js/src/jit/BaselineIC.h
@@ -609,6 +609,11 @@ class ICNewArray_Fallback : public ICFallbackStub
     HeapPtrObjectGroup& templateGroup() {
         return templateGroup_;
     }
+
+    void setTemplateGroup(ObjectGroup* group) {
+        templateObject_ = nullptr;
+        templateGroup_ = group;
+    }
 };
 
 class ICNewObject_Fallback : public ICFallbackStub
@@ -4914,10 +4919,10 @@ class ICCall_StringSplit : public ICMonitoredStub
     uint32_t pcOffset_;
     HeapPtrString expectedThis_;
     HeapPtrString expectedArg_;
-    HeapPtrArrayObject templateObject_;
+    HeapPtrObject templateObject_;
 
     ICCall_StringSplit(JitCode* stubCode, ICStub* firstMonitorStub, uint32_t pcOffset, JSString* thisString,
-                       JSString* argString, ArrayObject* templateObject)
+                       JSString* argString, JSObject* templateObject)
       : ICMonitoredStub(ICStub::Call_StringSplit, stubCode, firstMonitorStub),
         pcOffset_(pcOffset), expectedThis_(thisString), expectedArg_(argString),
         templateObject_(templateObject)
@@ -4944,7 +4949,7 @@ class ICCall_StringSplit : public ICMonitoredStub
         return expectedArg_;
     }
 
-    HeapPtrArrayObject& templateObject() {
+    HeapPtrObject& templateObject() {
         return templateObject_;
     }
 
@@ -4954,7 +4959,7 @@ class ICCall_StringSplit : public ICMonitoredStub
         uint32_t pcOffset_;
         RootedString expectedThis_;
         RootedString expectedArg_;
-        RootedArrayObject templateObject_;
+        RootedObject templateObject_;
 
         bool generateStubCode(MacroAssembler& masm);
 
@@ -4971,7 +4976,7 @@ class ICCall_StringSplit : public ICMonitoredStub
             pcOffset_(pcOffset),
             expectedThis_(cx, thisString),
             expectedArg_(cx, argString),
-            templateObject_(cx, &templateObject.toObject().as<ArrayObject>())
+            templateObject_(cx, &templateObject.toObject())
         { }
 
         ICStub* getStub(ICStubSpace* space) {
diff --git a/js/src/jit/BaselineInspector.cpp b/js/src/jit/BaselineInspector.cpp
index 95b93faa165e..90edefe1e034 100644
--- a/js/src/jit/BaselineInspector.cpp
+++ b/js/src/jit/BaselineInspector.cpp
@@ -521,7 +521,7 @@ BaselineInspector::getTemplateObjectForNative(jsbytecode* pc, Native native)
 
 bool
 BaselineInspector::isOptimizableCallStringSplit(jsbytecode* pc, JSString** stringOut, JSString** stringArg,
-                                                NativeObject** objOut)
+                                                JSObject** objOut)
 {
     if (!hasBaselineScript())
         return false;
@@ -733,6 +733,7 @@ BaselineInspector::expectedPropertyAccessInputType(jsbytecode* pc)
             return MIRType_Value;
 
           case ICStub::GetProp_ArrayLength:
+          case ICStub::GetProp_UnboxedArrayLength:
           case ICStub::GetProp_Native:
           case ICStub::GetProp_NativeDoesNotExist:
           case ICStub::GetProp_NativePrototype:
@@ -750,6 +751,7 @@ BaselineInspector::expectedPropertyAccessInputType(jsbytecode* pc)
           case ICStub::GetElem_String:
           case ICStub::GetElem_Dense:
           case ICStub::GetElem_TypedArray:
+          case ICStub::GetElem_UnboxedArray:
             stubType = MIRType_Object;
             break;
 
diff --git a/js/src/jit/BaselineInspector.h b/js/src/jit/BaselineInspector.h
index 10d61d849eac..dacdfe0e3707 100644
--- a/js/src/jit/BaselineInspector.h
+++ b/js/src/jit/BaselineInspector.h
@@ -113,7 +113,7 @@ class BaselineInspector
     bool hasSeenNonStringIterMore(jsbytecode* pc);
 
     bool isOptimizableCallStringSplit(jsbytecode* pc, JSString** stringOut, JSString** stringArg,
-                                      NativeObject** objOut);
+                                      JSObject** objOut);
     JSObject* getTemplateObject(jsbytecode* pc);
     JSObject* getTemplateObjectForNative(jsbytecode* pc, Native native);
     JSObject* getTemplateObjectForClassHook(jsbytecode* pc, const Class* clasp);
diff --git a/js/src/jit/CodeGenerator.cpp b/js/src/jit/CodeGenerator.cpp
index 90a30b8b3d5e..7cf1f090a9d2 100644
--- a/js/src/jit/CodeGenerator.cpp
+++ b/js/src/jit/CodeGenerator.cpp
@@ -4154,9 +4154,20 @@ typedef JSObject* (*NewArrayOperationFn)(JSContext*, HandleScript, jsbytecode*,
 static const VMFunction NewArrayOperationInfo =
     FunctionInfo<NewArrayOperationFn>(NewArrayOperation);
 
-typedef ArrayObject* (*NewDenseArrayFn)(ExclusiveContext*, uint32_t, HandleObjectGroup,
-                                        AllocatingBehaviour, bool);
-static const VMFunction NewDenseArrayInfo = FunctionInfo<NewDenseArrayFn>(NewDenseArray);
+static JSObject*
+NewArrayWithGroup(JSContext* cx, uint32_t length, HandleObjectGroup group,
+                  bool convertDoubleElements)
+{
+    JSObject* res = NewFullyAllocatedArrayTryUseGroup(cx, group, length);
+    if (!res)
+        return nullptr;
+    if (convertDoubleElements)
+        res->as<ArrayObject>().setShouldConvertDoubleElements();
+    return res;
+}
+
+typedef JSObject* (*NewArrayWithGroupFn)(JSContext*, uint32_t, HandleObjectGroup, bool);
+static const VMFunction NewArrayWithGroupInfo = FunctionInfo<NewArrayWithGroupFn>(NewArrayWithGroup);
 
 void
 CodeGenerator::visitNewArrayCallVM(LNewArray* lir)
@@ -4168,13 +4179,12 @@ CodeGenerator::visitNewArrayCallVM(LNewArray* lir)
 
     JSObject* templateObject = lir->mir()->templateObject();
 
-    if (templateObject && !templateObject->is<UnboxedArrayObject>()) {
+    if (templateObject) {
         pushArg(Imm32(lir->mir()->convertDoubleElements()));
-        pushArg(Imm32(lir->mir()->allocatingBehaviour()));
         pushArg(ImmGCPtr(templateObject->group()));
         pushArg(Imm32(lir->mir()->count()));
 
-        callVM(NewDenseArrayInfo, lir);
+        callVM(NewArrayWithGroupInfo, lir);
     } else {
         pushArg(Imm32(GenericObject));
         pushArg(Imm32(lir->mir()->count()));
@@ -4297,7 +4307,7 @@ CodeGenerator::visitNewArrayCopyOnWrite(LNewArrayCopyOnWrite* lir)
     masm.bind(ool->rejoin());
 }
 
-typedef ArrayObject* (*ArrayConstructorOneArgFn)(JSContext*, HandleObjectGroup, int32_t length);
+typedef JSObject* (*ArrayConstructorOneArgFn)(JSContext*, HandleObjectGroup, int32_t length);
 static const VMFunction ArrayConstructorOneArgInfo =
     FunctionInfo<ArrayConstructorOneArgFn>(ArrayConstructorOneArg);
 
@@ -4308,32 +4318,47 @@ CodeGenerator::visitNewArrayDynamicLength(LNewArrayDynamicLength* lir)
     Register objReg = ToRegister(lir->output());
     Register tempReg = ToRegister(lir->temp());
 
-    ArrayObject* templateObject = lir->mir()->templateObject();
+    JSObject* templateObject = lir->mir()->templateObject();
     gc::InitialHeap initialHeap = lir->mir()->initialHeap();
 
     OutOfLineCode* ool = oolCallVM(ArrayConstructorOneArgInfo, lir,
                                    (ArgList(), ImmGCPtr(templateObject->group()), lengthReg),
                                    StoreRegisterTo(objReg));
 
-    size_t numSlots = gc::GetGCKindSlots(templateObject->asTenured().getAllocKind());
-    size_t inlineLength = numSlots >= ObjectElements::VALUES_PER_HEADER
-                        ? numSlots - ObjectElements::VALUES_PER_HEADER
-                        : 0;
+    bool canInline = true;
+    size_t inlineLength = 0;
+    if (templateObject->is<ArrayObject>()) {
+        if (templateObject->as<ArrayObject>().hasFixedElements()) {
+            size_t numSlots = gc::GetGCKindSlots(templateObject->asTenured().getAllocKind());
+            inlineLength = numSlots - ObjectElements::VALUES_PER_HEADER;
+        } else {
+            canInline = false;
+        }
+    } else {
+        if (templateObject->as<UnboxedArrayObject>().hasInlineElements()) {
+            size_t nbytes =
+                templateObject->tenuredSizeOfThis() - UnboxedArrayObject::offsetOfInlineElements();
+            inlineLength = nbytes / templateObject->as<UnboxedArrayObject>().elementSize();
+        } else {
+            canInline = false;
+        }
+    }
 
-    // Try to do the allocation inline if the template object is big enough
-    // for the length in lengthReg. If the length is bigger we could still
-    // use the template object and not allocate the elements, but it's more
-    // efficient to do a single big allocation than (repeatedly) reallocating
-    // the array later on when filling it.
-    if (!templateObject->isSingleton() && templateObject->length() <= inlineLength)
-        masm.branch32(Assembler::Above, lengthReg, Imm32(templateObject->length()), ool->entry());
-    else
+    if (canInline) {
+        // Try to do the allocation inline if the template object is big enough
+        // for the length in lengthReg. If the length is bigger we could still
+        // use the template object and not allocate the elements, but it's more
+        // efficient to do a single big allocation than (repeatedly) reallocating
+        // the array later on when filling it.
+        masm.branch32(Assembler::Above, lengthReg, Imm32(inlineLength), ool->entry());
+
+        masm.createGCObject(objReg, tempReg, templateObject, initialHeap, ool->entry());
+
+        size_t lengthOffset = NativeObject::offsetOfFixedElements() + ObjectElements::offsetOfLength();
+        masm.store32(lengthReg, Address(objReg, lengthOffset));
+    } else {
         masm.jump(ool->entry());
-
-    masm.createGCObject(objReg, tempReg, templateObject, initialHeap, ool->entry());
-
-    size_t lengthOffset = NativeObject::offsetOfFixedElements() + ObjectElements::offsetOfLength();
-    masm.store32(lengthReg, Address(objReg, lengthOffset));
+    }
 
     masm.bind(ool->rejoin());
 }
@@ -6398,6 +6423,25 @@ CodeGenerator::visitIncrementUnboxedArrayInitializedLength(LIncrementUnboxedArra
     masm.add32(Imm32(1), Address(obj, UnboxedArrayObject::offsetOfCapacityIndexAndInitializedLength()));
 }
 
+void
+CodeGenerator::visitSetUnboxedArrayInitializedLength(LSetUnboxedArrayInitializedLength* lir)
+{
+    Register obj = ToRegister(lir->object());
+    Int32Key key = ToInt32Key(lir->length());
+    Register temp = ToRegister(lir->temp());
+
+    Address initLengthAddr(obj, UnboxedArrayObject::offsetOfCapacityIndexAndInitializedLength());
+    masm.load32(initLengthAddr, temp);
+    masm.and32(Imm32(UnboxedArrayObject::CapacityMask), temp);
+
+    if (key.isRegister())
+        masm.or32(key.reg(), temp);
+    else
+        masm.or32(Imm32(key.constant()), temp);
+
+    masm.store32(temp, initLengthAddr);
+}
+
 void
 CodeGenerator::visitNotO(LNotO* lir)
 {
@@ -9360,7 +9404,7 @@ CodeGenerator::visitInArray(LInArray* lir)
         }
 
         masm.branch32(Assembler::BelowOrEqual, initLength, Imm32(index), failedInitLength);
-        if (mir->needsHoleCheck()) {
+        if (mir->needsHoleCheck() && mir->unboxedType() == JSVAL_TYPE_MAGIC) {
             NativeObject::elementsSizeMustNotOverflow();
             Address address = Address(elements, index * sizeof(Value));
             masm.branchTestMagic(Assembler::Equal, address, &falseBranch);
@@ -9373,7 +9417,7 @@ CodeGenerator::visitInArray(LInArray* lir)
             failedInitLength = &negativeIntCheck;
 
         masm.branch32(Assembler::BelowOrEqual, initLength, index, failedInitLength);
-        if (mir->needsHoleCheck()) {
+        if (mir->needsHoleCheck() && mir->unboxedType() == JSVAL_TYPE_MAGIC) {
             BaseIndex address = BaseIndex(elements, ToRegister(lir->index()), TimesEight);
             masm.branchTestMagic(Assembler::Equal, address, &falseBranch);
         }
diff --git a/js/src/jit/CodeGenerator.h b/js/src/jit/CodeGenerator.h
index 45db18f048dc..55d2f97180ee 100644
--- a/js/src/jit/CodeGenerator.h
+++ b/js/src/jit/CodeGenerator.h
@@ -198,6 +198,7 @@ class CodeGenerator : public CodeGeneratorSpecific
     void visitUnboxedArrayLength(LUnboxedArrayLength* lir);
     void visitUnboxedArrayInitializedLength(LUnboxedArrayInitializedLength* lir);
     void visitIncrementUnboxedArrayInitializedLength(LIncrementUnboxedArrayInitializedLength* lir);
+    void visitSetUnboxedArrayInitializedLength(LSetUnboxedArrayInitializedLength* lir);
     void visitNotO(LNotO* ins);
     void visitNotV(LNotV* ins);
     void visitBoundsCheck(LBoundsCheck* lir);
diff --git a/js/src/jit/IonBuilder.cpp b/js/src/jit/IonBuilder.cpp
index 24d9b22b2282..068884a70643 100644
--- a/js/src/jit/IonBuilder.cpp
+++ b/js/src/jit/IonBuilder.cpp
@@ -6504,8 +6504,7 @@ IonBuilder::jsop_newarray(uint32_t count)
     }
     current->add(templateConst);
 
-    MNewArray* ins = MNewArray::New(alloc(), constraints(), count, templateConst,
-                                    heap, NewArray_FullyAllocating, pc);
+    MNewArray* ins = MNewArray::New(alloc(), constraints(), count, templateConst, heap, pc);
     current->add(ins);
     current->push(ins);
 
@@ -6623,7 +6622,15 @@ IonBuilder::jsop_initelem_array()
         return resumeAfter(store);
     }
 
-    MConstant* id = MConstant::New(alloc(), Int32Value(GET_UINT24(pc)));
+    return initializeArrayElement(obj, GET_UINT24(pc), value, unboxedType, /* addResumePoint = */ true);
+}
+
+bool
+IonBuilder::initializeArrayElement(MDefinition* obj, size_t index, MDefinition* value,
+                                   JSValueType unboxedType,
+                                   bool addResumePointAndIncrementInitializedLength)
+{
+    MConstant* id = MConstant::New(alloc(), Int32Value(index));
     current->add(id);
 
     // Get the elements vector.
@@ -6634,11 +6641,13 @@ IonBuilder::jsop_initelem_array()
         // Note: storeUnboxedValue takes care of any post barriers on the value.
         storeUnboxedValue(obj, elements, 0, id, unboxedType, value, /* preBarrier = */ false);
 
-        MInstruction* increment = MIncrementUnboxedArrayInitializedLength::New(alloc(), obj);
-        current->add(increment);
+        if (addResumePointAndIncrementInitializedLength) {
+            MInstruction* increment = MIncrementUnboxedArrayInitializedLength::New(alloc(), obj);
+            current->add(increment);
 
-        if (!resumeAfter(increment))
-            return false;
+            if (!resumeAfter(increment))
+                return false;
+        }
     } else {
         if (NeedsPostBarrier(info(), value))
             current->add(MPostWriteBarrier::New(alloc(), obj, value));
@@ -6654,14 +6663,16 @@ IonBuilder::jsop_initelem_array()
                                                   /* needsHoleCheck = */ false);
         current->add(store);
 
-        // Update the initialized length. (The template object for this array has
-        // the array's ultimate length, so the length field is already correct: no
-        // updating needed.)
-        MSetInitializedLength* initLength = MSetInitializedLength::New(alloc(), elements, id);
-        current->add(initLength);
+        if (addResumePointAndIncrementInitializedLength) {
+            // Update the initialized length. (The template object for this
+            // array has the array's ultimate length, so the length field is
+            // already correct: no updating needed.)
+            MSetInitializedLength* initLength = MSetInitializedLength::New(alloc(), elements, id);
+            current->add(initLength);
 
-        if (!resumeAfter(initLength))
-            return false;
+            if (!resumeAfter(initLength))
+                return false;
+        }
     }
 
     return true;
@@ -8530,12 +8541,7 @@ IonBuilder::jsop_getelem_dense(MDefinition* obj, MDefinition* index, JSValueType
     // Note: to help GVN, use the original MElements instruction and not
     // MConvertElementsToDoubles as operand. This is fine because converting
     // elements to double does not change the initialized length.
-    MInstruction* initLength;
-    if (unboxedType != JSVAL_TYPE_MAGIC)
-        initLength = MUnboxedArrayInitializedLength::New(alloc(), obj);
-    else
-        initLength = MInitializedLength::New(alloc(), elements);
-    current->add(initLength);
+    MInstruction* initLength = initializedLength(obj, elements, unboxedType);
 
     // If we can load the element as a definite double, make sure to check that
     // the array has been converted to homogenous doubles first.
@@ -8825,9 +8831,13 @@ IonBuilder::jsop_setelem()
     if (!setElemTryTypedArray(&emitted, object, index, value) || emitted)
         return emitted;
 
-    trackOptimizationAttempt(TrackedStrategy::SetElem_Dense);
-    if (!setElemTryDense(&emitted, object, index, value) || emitted)
-        return emitted;
+    {
+        trackOptimizationAttempt(TrackedStrategy::SetElem_Dense);
+        SetElemICInspector icInspect(inspector->setElemICInspector(pc));
+        bool writeHole = icInspect.sawOOBDenseWrite();
+        if (!setElemTryDense(&emitted, object, index, value, writeHole) || emitted)
+            return emitted;
+    }
 
     trackOptimizationAttempt(TrackedStrategy::SetElem_Arguments);
     if (!setElemTryArguments(&emitted, object, index, value) || emitted)
@@ -9020,7 +9030,7 @@ IonBuilder::setElemTryTypedArray(bool* emitted, MDefinition* object,
     }
 
     // Emit typed setelem variant.
-    if (!jsop_setelem_typed(arrayType, SetElem_Normal, object, index, value))
+    if (!jsop_setelem_typed(arrayType, object, index, value))
         return false;
 
     trackOptimizationSuccess();
@@ -9030,7 +9040,7 @@ IonBuilder::setElemTryTypedArray(bool* emitted, MDefinition* object,
 
 bool
 IonBuilder::setElemTryDense(bool* emitted, MDefinition* object,
-                            MDefinition* index, MDefinition* value)
+                            MDefinition* index, MDefinition* value, bool writeHole)
 {
     MOZ_ASSERT(*emitted == false);
 
@@ -9073,7 +9083,7 @@ IonBuilder::setElemTryDense(bool* emitted, MDefinition* object,
     }
 
     // Emit dense setelem variant.
-    if (!jsop_setelem_dense(conversion, SetElem_Normal, object, index, value, unboxedType))
+    if (!jsop_setelem_dense(conversion, object, index, value, unboxedType, writeHole))
         return false;
 
     trackOptimizationSuccess();
@@ -9159,9 +9169,8 @@ IonBuilder::setElemTryCache(bool* emitted, MDefinition* object,
 
 bool
 IonBuilder::jsop_setelem_dense(TemporaryTypeSet::DoubleConversion conversion,
-                               SetElemSafety safety,
                                MDefinition* obj, MDefinition* id, MDefinition* value,
-                               JSValueType unboxedType)
+                               JSValueType unboxedType, bool writeHole)
 {
     MIRType elementType = MIRType_None;
     if (unboxedType == JSVAL_TYPE_MAGIC)
@@ -9213,20 +9222,12 @@ IonBuilder::jsop_setelem_dense(TemporaryTypeSet::DoubleConversion conversion,
         MOZ_CRASH("Unknown double conversion");
     }
 
-    bool writeHole = false;
-    if (safety == SetElem_Normal) {
-        SetElemICInspector icInspect(inspector->setElemICInspector(pc));
-        writeHole = icInspect.sawOOBDenseWrite();
-    }
-
     // Use MStoreElementHole if this SETELEM has written to out-of-bounds
     // indexes in the past. Otherwise, use MStoreElement so that we can hoist
     // the initialized length and bounds check.
     MInstruction* store;
     MStoreElementCommon *common = nullptr;
     if (writeHole && writeOutOfBounds) {
-        MOZ_ASSERT(safety == SetElem_Normal);
-
         MStoreElementHole* ins = MStoreElementHole::New(alloc(), obj, elements, id, newValue, unboxedType);
         store = ins;
         common = ins;
@@ -9234,20 +9235,10 @@ IonBuilder::jsop_setelem_dense(TemporaryTypeSet::DoubleConversion conversion,
         current->add(ins);
         current->push(value);
     } else {
-        MInstruction* initLength;
-        if (unboxedType != JSVAL_TYPE_MAGIC)
-            initLength = MUnboxedArrayInitializedLength::New(alloc(), obj);
-        else
-            initLength = MInitializedLength::New(alloc(), elements);
-        current->add(initLength);
+        MInstruction* initLength = initializedLength(obj, elements, unboxedType);
 
-        bool needsHoleCheck;
-        if (safety == SetElem_Normal) {
-            id = addBoundsCheck(id, initLength);
-            needsHoleCheck = !packed && !writeOutOfBounds;
-        } else {
-            needsHoleCheck = false;
-        }
+        id = addBoundsCheck(id, initLength);
+        bool needsHoleCheck = !packed && !writeOutOfBounds;
 
         if (unboxedType != JSVAL_TYPE_MAGIC) {
             store = storeUnboxedValue(obj, elements, 0, id, unboxedType, newValue);
@@ -9259,8 +9250,7 @@ IonBuilder::jsop_setelem_dense(TemporaryTypeSet::DoubleConversion conversion,
             current->add(store);
         }
 
-        if (safety == SetElem_Normal)
-            current->push(value);
+        current->push(value);
     }
 
     if (!resumeAfter(store))
@@ -9280,16 +9270,11 @@ IonBuilder::jsop_setelem_dense(TemporaryTypeSet::DoubleConversion conversion,
 
 
 bool
-IonBuilder::jsop_setelem_typed(Scalar::Type arrayType, SetElemSafety safety,
+IonBuilder::jsop_setelem_typed(Scalar::Type arrayType,
                                MDefinition* obj, MDefinition* id, MDefinition* value)
 {
-    bool expectOOB;
-    if (safety == SetElem_Normal) {
-        SetElemICInspector icInspect(inspector->setElemICInspector(pc));
-        expectOOB = icInspect.sawOOBTypedArrayWrite();
-    } else {
-        expectOOB = false;
-    }
+    SetElemICInspector icInspect(inspector->setElemICInspector(pc));
+    bool expectOOB = icInspect.sawOOBTypedArrayWrite();
 
     if (expectOOB)
         spew("Emitting OOB TypedArray SetElem");
@@ -9302,9 +9287,7 @@ IonBuilder::jsop_setelem_typed(Scalar::Type arrayType, SetElemSafety safety,
     // Get length, bounds-check, then get elements, and add all instructions.
     MInstruction* length;
     MInstruction* elements;
-    BoundsChecking checking = (!expectOOB && safety == SetElem_Normal)
-                              ? DoBoundsCheck
-                              : SkipBoundsCheck;
+    BoundsChecking checking = expectOOB ? SkipBoundsCheck : DoBoundsCheck;
     addTypedArrayLengthAndData(obj, checking, &id, &length, &elements);
 
     // Clamp value to [0, 255] for Uint8ClampedArray.
@@ -9325,31 +9308,11 @@ IonBuilder::jsop_setelem_typed(Scalar::Type arrayType, SetElemSafety safety,
     }
 
     current->add(ins);
-
-    if (safety == SetElem_Normal)
-        current->push(value);
+    current->push(value);
 
     return resumeAfter(ins);
 }
 
-bool
-IonBuilder::jsop_setelem_typed_object(Scalar::Type arrayType, SetElemSafety safety,
-                                      MDefinition* object, MDefinition* index, MDefinition* value)
-{
-    MOZ_ASSERT(safety == SetElem_Unsafe); // Can be fixed, but there's been no reason to as of yet
-
-    MInstruction* intIndex = MToInt32::New(alloc(), index);
-    current->add(intIndex);
-
-    size_t elemSize = ScalarTypeDescr::alignment(arrayType);
-
-    LinearSum byteOffset(alloc());
-    if (!byteOffset.add(intIndex, elemSize))
-        setForceAbort();
-
-    return storeScalarTypedObjectValue(object, byteOffset, arrayType, value);
-}
-
 bool
 IonBuilder::jsop_length()
 {
@@ -9511,8 +9474,7 @@ IonBuilder::jsop_rest()
     current->add(templateConst);
 
     MNewArray* array = MNewArray::New(alloc(), constraints(), numRest, templateConst,
-                                      templateObject->group()->initialHeap(constraints()),
-                                      NewArray_FullyAllocating, pc);
+                                      templateObject->group()->initialHeap(constraints()), pc);
     current->add(array);
 
     if (numRest == 0) {
@@ -12396,12 +12358,21 @@ IonBuilder::jsop_in()
     MDefinition* obj = current->peek(-1);
     MDefinition* id = current->peek(-2);
 
-    if (!shouldAbortOnPreliminaryGroups(obj) &&
-        ElementAccessIsDenseNative(constraints(), obj, id) &&
-        !ElementAccessHasExtraIndexedProperty(constraints(), obj))
-    {
-        return jsop_in_dense();
-    }
+    do {
+        if (shouldAbortOnPreliminaryGroups(obj))
+            break;
+
+        JSValueType unboxedType = UnboxedArrayElementType(constraints(), obj, id);
+        if (unboxedType == JSVAL_TYPE_MAGIC) {
+            if (!ElementAccessIsDenseNative(constraints(), obj, id))
+                break;
+        }
+
+        if (ElementAccessHasExtraIndexedProperty(constraints(), obj))
+            break;
+
+        return jsop_in_dense(unboxedType);
+    } while (false);
 
     current->pop();
     current->pop();
@@ -12414,7 +12385,7 @@ IonBuilder::jsop_in()
 }
 
 bool
-IonBuilder::jsop_in_dense()
+IonBuilder::jsop_in_dense(JSValueType unboxedType)
 {
     MDefinition* obj = current->pop();
     MDefinition* id = current->pop();
@@ -12427,11 +12398,10 @@ IonBuilder::jsop_in_dense()
     id = idInt32;
 
     // Get the elements vector.
-    MElements* elements = MElements::New(alloc(), obj);
+    MElements* elements = MElements::New(alloc(), obj, unboxedType != JSVAL_TYPE_MAGIC);
     current->add(elements);
 
-    MInitializedLength* initLength = MInitializedLength::New(alloc(), elements);
-    current->add(initLength);
+    MInstruction* initLength = initializedLength(obj, elements, unboxedType);
 
     // If there are no holes, speculate the InArray check will not fail.
     if (!needsHoleCheck && !failedBoundsCheck_) {
@@ -12440,7 +12410,8 @@ IonBuilder::jsop_in_dense()
     }
 
     // Check if id < initLength and elem[id] not a hole.
-    MInArray* ins = MInArray::New(alloc(), elements, id, initLength, obj, needsHoleCheck);
+    MInArray* ins = MInArray::New(alloc(), elements, id, initLength, obj, needsHoleCheck,
+                                  unboxedType);
 
     current->add(ins);
     current->push(ins);
@@ -13053,6 +13024,37 @@ IonBuilder::constantInt(int32_t i)
     return constant(Int32Value(i));
 }
 
+MInstruction*
+IonBuilder::initializedLength(MDefinition* obj, MDefinition* elements, JSValueType unboxedType)
+{
+    MInstruction* res;
+    if (unboxedType != JSVAL_TYPE_MAGIC)
+        res = MUnboxedArrayInitializedLength::New(alloc(), obj);
+    else
+        res = MInitializedLength::New(alloc(), elements);
+    current->add(res);
+    return res;
+}
+
+MInstruction*
+IonBuilder::setInitializedLength(MDefinition* obj, JSValueType unboxedType, size_t count)
+{
+    MOZ_ASSERT(count);
+
+    MInstruction* res;
+    if (unboxedType != JSVAL_TYPE_MAGIC) {
+        res = MSetUnboxedArrayInitializedLength::New(alloc(), obj, constant(Int32Value(count)));
+    } else {
+        // MSetInitializedLength takes the index of the last element, rather
+        // than the count itself.
+        MInstruction* elements = MElements::New(alloc(), obj, /* unboxed = */ false);
+        current->add(elements);
+        res = MSetInitializedLength::New(alloc(), elements, constant(Int32Value(count - 1)));
+    }
+    current->add(res);
+    return res;
+}
+
 MDefinition*
 IonBuilder::getCallee()
 {
diff --git a/js/src/jit/IonBuilder.h b/js/src/jit/IonBuilder.h
index 122c39774dbc..0aca0fb31eca 100644
--- a/js/src/jit/IonBuilder.h
+++ b/js/src/jit/IonBuilder.h
@@ -46,16 +46,6 @@ class IonBuilder
         ControlStatus_None          // No control flow.
     };
 
-    enum SetElemSafety {
-        // Normal write like a[b] = c.
-        SetElem_Normal,
-
-        // Write due to UnsafePutElements:
-        // - assumed to be in bounds,
-        // - not checked for data races
-        SetElem_Unsafe,
-    };
-
     struct DeferredEdge : public TempObject
     {
         MBasicBlock* block;
@@ -352,6 +342,9 @@ class IonBuilder
 
     MConstant* constant(const Value& v);
     MConstant* constantInt(int32_t i);
+    MInstruction* initializedLength(MDefinition* obj, MDefinition* elements,
+                                    JSValueType unboxedType);
+    MInstruction* setInitializedLength(MDefinition* obj, JSValueType unboxedType, size_t count);
 
     // Improve the type information at tests
     bool improveTypesAtTest(MDefinition* ins, bool trueBranch, MTest* test);
@@ -548,7 +541,7 @@ class IonBuilder
     bool setElemTryTypedStatic(bool* emitted, MDefinition* object,
                                MDefinition* index, MDefinition* value);
     bool setElemTryDense(bool* emitted, MDefinition* object,
-                         MDefinition* index, MDefinition* value);
+                         MDefinition* index, MDefinition* value, bool writeHole);
     bool setElemTryArguments(bool* emitted, MDefinition* object,
                              MDefinition* index, MDefinition* value);
     bool setElemTryCache(bool* emitted, MDefinition* object,
@@ -566,6 +559,9 @@ class IonBuilder
                                            MDefinition* value,
                                            TypedObjectPrediction elemTypeReprs,
                                            int32_t elemSize);
+    bool initializeArrayElement(MDefinition* obj, size_t index, MDefinition* value,
+                                JSValueType unboxedType,
+                                bool addResumePointAndIncrementInitializedLength);
 
     // jsop_getelem() helpers.
     bool getElemTryDense(bool* emitted, MDefinition* obj, MDefinition* index);
@@ -661,15 +657,10 @@ class IonBuilder
     bool jsop_getelem_typed(MDefinition* obj, MDefinition* index, ScalarTypeDescr::Type arrayType);
     bool jsop_setelem();
     bool jsop_setelem_dense(TemporaryTypeSet::DoubleConversion conversion,
-                            SetElemSafety safety,
                             MDefinition* object, MDefinition* index, MDefinition* value,
-                            JSValueType unboxedType);
+                            JSValueType unboxedType, bool writeHole);
     bool jsop_setelem_typed(ScalarTypeDescr::Type arrayType,
-                            SetElemSafety safety,
                             MDefinition* object, MDefinition* index, MDefinition* value);
-    bool jsop_setelem_typed_object(ScalarTypeDescr::Type arrayType,
-                                   SetElemSafety safety,
-                                   MDefinition* object, MDefinition* index, MDefinition* value);
     bool jsop_length();
     bool jsop_length_fastPath();
     bool jsop_arguments();
@@ -702,7 +693,7 @@ class IonBuilder
     bool jsop_isnoiter();
     bool jsop_iterend();
     bool jsop_in();
-    bool jsop_in_dense();
+    bool jsop_in_dense(JSValueType unboxedType);
     bool jsop_instanceof();
     bool jsop_getaliasedvar(ScopeCoordinate sc);
     bool jsop_setaliasedvar(ScopeCoordinate sc);
@@ -781,8 +772,9 @@ class IonBuilder
     InliningStatus inlineRegExpExec(CallInfo& callInfo);
     InliningStatus inlineRegExpTest(CallInfo& callInfo);
 
-    // Object natives.
+    // Object natives and intrinsics.
     InliningStatus inlineObjectCreate(CallInfo& callInfo);
+    InliningStatus inlineDefineDataProperty(CallInfo& callInfo);
 
     // Atomics natives.
     InliningStatus inlineAtomicsCompareExchange(CallInfo& callInfo);
@@ -791,14 +783,6 @@ class IonBuilder
     InliningStatus inlineAtomicsFence(CallInfo& callInfo);
     InliningStatus inlineAtomicsBinop(CallInfo& callInfo, JSFunction* target);
 
-    // Array intrinsics.
-    InliningStatus inlineUnsafePutElements(CallInfo& callInfo);
-    bool inlineUnsafeSetDenseArrayElement(CallInfo& callInfo, uint32_t base);
-    bool inlineUnsafeSetTypedArrayElement(CallInfo& callInfo, uint32_t base,
-                                          ScalarTypeDescr::Type arrayType);
-    bool inlineUnsafeSetTypedObjectArrayElement(CallInfo& callInfo, uint32_t base,
-                                                ScalarTypeDescr::Type arrayType);
-
     // Slot intrinsics.
     InliningStatus inlineUnsafeSetReservedSlot(CallInfo& callInfo);
     InliningStatus inlineUnsafeGetReservedSlot(CallInfo& callInfo,
@@ -815,8 +799,6 @@ class IonBuilder
     // TypedObject intrinsics and natives.
     InliningStatus inlineObjectIsTypeDescr(CallInfo& callInfo);
     InliningStatus inlineSetTypedObjectOffset(CallInfo& callInfo);
-    bool elementAccessIsTypedObjectArrayOfScalarType(MDefinition* obj, MDefinition* id,
-                                                     ScalarTypeDescr::Type* arrayType);
     InliningStatus inlineConstructTypedObject(CallInfo& callInfo, TypeDescr* target);
 
     // SIMD intrinsics and natives.
diff --git a/js/src/jit/LIR-Common.h b/js/src/jit/LIR-Common.h
index 637e2ad05b80..8b70cdb51aa1 100644
--- a/js/src/jit/LIR-Common.h
+++ b/js/src/jit/LIR-Common.h
@@ -4198,6 +4198,30 @@ class LIncrementUnboxedArrayInitializedLength : public LInstructionHelper<0, 1,
     }
 };
 
+class LSetUnboxedArrayInitializedLength : public LInstructionHelper<0, 2, 1>
+{
+  public:
+    LIR_HEADER(SetUnboxedArrayInitializedLength)
+
+    explicit LSetUnboxedArrayInitializedLength(const LAllocation& object,
+                                               const LAllocation& length,
+                                               const LDefinition& temp) {
+        setOperand(0, object);
+        setOperand(1, length);
+        setTemp(0, temp);
+    }
+
+    const LAllocation* object() {
+        return getOperand(0);
+    }
+    const LAllocation* length() {
+        return getOperand(1);
+    }
+    const LDefinition* temp() {
+        return getTemp(0);
+    }
+};
+
 // Load the length from an elements header.
 class LArrayLength : public LInstructionHelper<1, 1, 0>
 {
diff --git a/js/src/jit/LOpcodes.h b/js/src/jit/LOpcodes.h
index d8b234ef885b..b8e5cdda9e82 100644
--- a/js/src/jit/LOpcodes.h
+++ b/js/src/jit/LOpcodes.h
@@ -217,6 +217,7 @@
     _(UnboxedArrayLength)           \
     _(UnboxedArrayInitializedLength) \
     _(IncrementUnboxedArrayInitializedLength) \
+    _(SetUnboxedArrayInitializedLength) \
     _(BoundsCheck)                  \
     _(BoundsCheckRange)             \
     _(BoundsCheckLower)             \
diff --git a/js/src/jit/Lowering.cpp b/js/src/jit/Lowering.cpp
index e7d8db999160..24748bf4ee1e 100644
--- a/js/src/jit/Lowering.cpp
+++ b/js/src/jit/Lowering.cpp
@@ -2518,6 +2518,14 @@ LIRGenerator::visitIncrementUnboxedArrayInitializedLength(MIncrementUnboxedArray
     add(new(alloc()) LIncrementUnboxedArrayInitializedLength(useRegister(ins->object())), ins);
 }
 
+void
+LIRGenerator::visitSetUnboxedArrayInitializedLength(MSetUnboxedArrayInitializedLength* ins)
+{
+    add(new(alloc()) LSetUnboxedArrayInitializedLength(useRegister(ins->object()),
+                                                       useRegisterOrConstant(ins->length()),
+                                                       temp()), ins);
+}
+
 void
 LIRGenerator::visitNot(MNot* ins)
 {
diff --git a/js/src/jit/Lowering.h b/js/src/jit/Lowering.h
index 20254835383a..ddac1d263201 100644
--- a/js/src/jit/Lowering.h
+++ b/js/src/jit/Lowering.h
@@ -190,6 +190,7 @@ class LIRGenerator : public LIRGeneratorSpecific
     void visitUnboxedArrayLength(MUnboxedArrayLength* ins);
     void visitUnboxedArrayInitializedLength(MUnboxedArrayInitializedLength* ins);
     void visitIncrementUnboxedArrayInitializedLength(MIncrementUnboxedArrayInitializedLength* ins);
+    void visitSetUnboxedArrayInitializedLength(MSetUnboxedArrayInitializedLength* ins);
     void visitNot(MNot* ins);
     void visitBoundsCheck(MBoundsCheck* ins);
     void visitBoundsCheckLower(MBoundsCheckLower* ins);
diff --git a/js/src/jit/MCallOptimize.cpp b/js/src/jit/MCallOptimize.cpp
index ebed56f2992e..459889c98359 100644
--- a/js/src/jit/MCallOptimize.cpp
+++ b/js/src/jit/MCallOptimize.cpp
@@ -21,6 +21,7 @@
 
 #include "vm/NativeObject-inl.h"
 #include "vm/StringObject-inl.h"
+#include "vm/UnboxedObject-inl.h"
 
 using mozilla::ArrayLength;
 
@@ -184,10 +185,8 @@ IonBuilder::inlineNativeCall(CallInfo& callInfo, JSFunction* target)
     // Object natives.
     if (native == obj_create)
         return inlineObjectCreate(callInfo);
-
-    // Array intrinsics.
-    if (native == intrinsic_UnsafePutElements)
-        return inlineUnsafePutElements(callInfo);
+    if (native == intrinsic_DefineDataProperty)
+        return inlineDefineDataProperty(callInfo);
 
     // Slot intrinsics.
     if (native == intrinsic_UnsafeSetReservedSlot)
@@ -524,21 +523,18 @@ IonBuilder::InliningStatus
 IonBuilder::inlineArray(CallInfo& callInfo)
 {
     uint32_t initLength = 0;
-    AllocatingBehaviour allocating = NewArray_Unallocating;
 
     JSObject* templateObject = inspector->getTemplateObjectForNative(pc, ArrayConstructor);
     if (!templateObject) {
         trackOptimizationOutcome(TrackedOutcome::CantInlineNativeNoTemplateObj);
         return InliningStatus_NotInlined;
     }
-    ArrayObject* templateArray = &templateObject->as<ArrayObject>();
 
     // Multiple arguments imply array initialization, not just construction.
     if (callInfo.argc() >= 2) {
         initLength = callInfo.argc();
-        allocating = NewArray_FullyAllocating;
 
-        TypeSet::ObjectKey* key = TypeSet::ObjectKey::get(templateArray);
+        TypeSet::ObjectKey* key = TypeSet::ObjectKey::get(templateObject);
         if (!key->unknownProperties()) {
             HeapTypeSetKey elemTypes = key->property(JSID_VOID);
 
@@ -561,8 +557,8 @@ IonBuilder::inlineArray(CallInfo& callInfo)
         if (!arg->isConstantValue()) {
             callInfo.setImplicitlyUsedUnchecked();
             MNewArrayDynamicLength* ins =
-                MNewArrayDynamicLength::New(alloc(), constraints(), templateArray,
-                                            templateArray->group()->initialHeap(constraints()),
+                MNewArrayDynamicLength::New(alloc(), constraints(), templateObject,
+                                            templateObject->group()->initialHeap(constraints()),
                                             arg);
             current->add(ins);
             current->push(ins);
@@ -580,63 +576,34 @@ IonBuilder::inlineArray(CallInfo& callInfo)
         // Make sure initLength matches the template object's length. This is
         // not guaranteed to be the case, for instance if we're inlining the
         // MConstant may come from an outer script.
-        if (initLength != templateArray->as<ArrayObject>().length())
+        if (initLength != GetAnyBoxedOrUnboxedArrayLength(templateObject))
             return InliningStatus_NotInlined;
 
         // Don't inline large allocations.
         if (initLength > ArrayObject::EagerAllocationMaxLength)
             return InliningStatus_NotInlined;
-
-        allocating = NewArray_FullyAllocating;
     }
 
     callInfo.setImplicitlyUsedUnchecked();
 
-    MConstant* templateConst = MConstant::NewConstraintlessObject(alloc(), templateArray);
+    MConstant* templateConst = MConstant::NewConstraintlessObject(alloc(), templateObject);
     current->add(templateConst);
 
     MNewArray* ins = MNewArray::New(alloc(), constraints(), initLength, templateConst,
-                                    templateArray->group()->initialHeap(constraints()),
-                                    allocating, pc);
+                                    templateObject->group()->initialHeap(constraints()), pc);
     current->add(ins);
     current->push(ins);
 
     if (callInfo.argc() >= 2) {
-        // Get the elements vector.
-        MElements* elements = MElements::New(alloc(), ins);
-        current->add(elements);
-
-        // Store all values, no need to initialize the length after each as
-        // jsop_initelem_array is doing because we do not expect to bailout
-        // because the memory is supposed to be allocated by now.
-        MConstant* id = nullptr;
+        JSValueType unboxedType = GetBoxedOrUnboxedType(templateObject);
         for (uint32_t i = 0; i < initLength; i++) {
-            id = MConstant::New(alloc(), Int32Value(i));
-            current->add(id);
-
             MDefinition* value = callInfo.getArg(i);
-            if (ins->convertDoubleElements()) {
-                MInstruction* valueDouble = MToDouble::New(alloc(), value);
-                current->add(valueDouble);
-                value = valueDouble;
-            }
-
-            // There is normally no need for a post barrier on these writes
-            // because the new array will be in the nursery. However, this
-            // assumption is volated if we specifically requested pre-tenuring.
-            if (ins->initialHeap() == gc::TenuredHeap)
-                current->add(MPostWriteBarrier::New(alloc(), ins, value));
-
-            MStoreElement* store = MStoreElement::New(alloc(), elements, id, value,
-                                                      /* needsHoleCheck = */ false);
-            current->add(store);
+            if (!initializeArrayElement(ins, i, value, unboxedType, /* addResumePoint = */ false))
+                return InliningStatus_Error;
         }
 
-        // Update the length.
-        MSetInitializedLength* length = MSetInitializedLength::New(alloc(), elements, id);
-        current->add(length);
-
-        if (!resumeAfter(length))
+        MInstruction* setLength = setInitializedLength(ins, unboxedType, initLength);
+        if (!resumeAfter(setLength))
             return InliningStatus_Error;
     }
 
@@ -1671,14 +1638,13 @@ IonBuilder::inlineConstantStringSplit(CallInfo& callInfo)
     // Check if exist a template object in stub.
     JSString* stringThis = nullptr;
     JSString* stringArg = nullptr;
-    NativeObject* templateObject = nullptr;
+    JSObject* templateObject = nullptr;
     if (!inspector->isOptimizableCallStringSplit(pc, &stringThis, &stringArg, &templateObject))
         return InliningStatus_NotInlined;
 
     MOZ_ASSERT(stringThis);
     MOZ_ASSERT(stringArg);
     MOZ_ASSERT(templateObject);
-    MOZ_ASSERT(templateObject->is<ArrayObject>());
 
     if (strval->toString() != stringThis)
         return InliningStatus_NotInlined;
@@ -1698,13 +1664,13 @@ IonBuilder::inlineConstantStringSplit(CallInfo& callInfo)
     if (!key.maybeTypes()->hasType(TypeSet::StringType()))
         return InliningStatus_NotInlined;
 
-    uint32_t initLength = templateObject->as<ArrayObject>().length();
-    if (templateObject->getDenseInitializedLength() != initLength)
+    uint32_t initLength = GetAnyBoxedOrUnboxedArrayLength(templateObject);
+    if (GetAnyBoxedOrUnboxedInitializedLength(templateObject) != initLength)
         return InliningStatus_NotInlined;
 
     Vector<MConstant*, 0, SystemAllocPolicy> arrayValues;
     for (uint32_t i = 0; i < initLength; i++) {
-        Value str = templateObject->getDenseElement(i);
+        Value str = GetAnyBoxedOrUnboxedDenseElement(templateObject, i);
         MOZ_ASSERT(str.toString()->isAtom());
         MConstant* value = MConstant::New(alloc(), str, constraints());
         if (!TypeSetIncludes(key.maybeTypes(), value->type(), value->resultTypeSet()))
@@ -1724,8 +1690,7 @@ IonBuilder::inlineConstantStringSplit(CallInfo& callInfo)
     current->add(templateConst);
 
     MNewArray* ins = MNewArray::New(alloc(), constraints(), initLength, templateConst,
-                                    templateObject->group()->initialHeap(constraints()),
-                                    NewArray_FullyAllocating, pc);
+                                    templateObject->group()->initialHeap(constraints()), pc);
 
     current->add(ins);
     current->push(ins);
@@ -1736,37 +1701,21 @@ IonBuilder::inlineConstantStringSplit(CallInfo& callInfo)
         return InliningStatus_Inlined;
     }
 
-    // Get the elements vector.
-    MElements* elements = MElements::New(alloc(), ins);
-    current->add(elements);
+    JSValueType unboxedType = GetBoxedOrUnboxedType(templateObject);
 
     // Store all values, no need to initialize the length after each as
     // jsop_initelem_array is doing because we do not expect to bailout
     // because the memory is supposed to be allocated by now.
-    MConstant* id = nullptr;
     for (uint32_t i = 0; i < initLength; i++) {
-       id = MConstant::New(alloc(), Int32Value(i));
-       current->add(id);
-
        MConstant* value = arrayValues[i];
        current->add(value);
 
-       MStoreElement* store = MStoreElement::New(alloc(), elements, id, value,
-                                                 /* needsHoleCheck = */ false);
-       current->add(store);
-
-       // There is normally no need for a post barrier on these writes
-       // because the new array will be in the nursery. However, this
-       // assumption is volated if we specifically requested pre-tenuring.
-       if (ins->initialHeap() == gc::TenuredHeap)
-           current->add(MPostWriteBarrier::New(alloc(), ins, value));
+       if (!initializeArrayElement(ins, i, value, unboxedType, /* addResumePoint = */ false))
+           return InliningStatus_Error;
     }
 
-    // Update the length.
-    MSetInitializedLength* length = MSetInitializedLength::New(alloc(), elements, id);
-    current->add(length);
-
-    if (!resumeAfter(length))
+    MInstruction* setLength = setInitializedLength(ins, unboxedType, initLength);
+    if (!resumeAfter(setLength))
         return InliningStatus_Error;
 
     return InliningStatus_Inlined;
@@ -1792,7 +1741,6 @@ IonBuilder::inlineStringSplit(CallInfo& callInfo)
     JSObject* templateObject = inspector->getTemplateObjectForNative(pc, js::str_split);
     if (!templateObject)
         return InliningStatus_NotInlined;
-    MOZ_ASSERT(templateObject->is<ArrayObject>());
 
     TypeSet::ObjectKey* retKey = TypeSet::ObjectKey::get(templateObject);
     if (retKey->unknownProperties())
@@ -2147,174 +2095,36 @@ IonBuilder::inlineObjectCreate(CallInfo& callInfo)
 }
 
 IonBuilder::InliningStatus
-IonBuilder::inlineUnsafePutElements(CallInfo& callInfo)
+IonBuilder::inlineDefineDataProperty(CallInfo& callInfo)
 {
-    uint32_t argc = callInfo.argc();
-    if (argc < 3 || (argc % 3) != 0 || callInfo.constructing()) {
-        trackOptimizationOutcome(TrackedOutcome::CantInlineNativeBadForm);
+    MOZ_ASSERT(!callInfo.constructing());
+
+    // Only handle definitions of plain data properties.
+    if (callInfo.argc() != 3)
         return InliningStatus_NotInlined;
-    }
 
-    /* Important:
-     *
-     * Here we inline each of the stores resulting from a call to
-     * UnsafePutElements().  It is essential that these stores occur
-     * atomically and cannot be interrupted by a stack or recursion
-     * check.  If this is not true, race conditions can occur.
-     */
+    MDefinition* obj = callInfo.getArg(0);
+    MDefinition* id = callInfo.getArg(1);
+    MDefinition* value = callInfo.getArg(2);
 
-    for (uint32_t base = 0; base < argc; base += 3) {
-        uint32_t arri = base + 0;
-        uint32_t idxi = base + 1;
-        uint32_t elemi = base + 2;
+    if (ElementAccessHasExtraIndexedProperty(constraints(), obj))
+        return InliningStatus_NotInlined;
 
-        MDefinition* obj = callInfo.getArg(arri);
-        MDefinition* id = callInfo.getArg(idxi);
-        MDefinition* elem = callInfo.getArg(elemi);
+    // setElemTryDense will push the value as the result of the define instead
+    // of |undefined|, but this is fine if the rval is ignored (as it should be
+    // in self hosted code.)
+    MOZ_ASSERT(*GetNextPc(pc) == JSOP_POP);
 
-        bool isDenseNative = ElementAccessIsDenseNative(constraints(), obj, id);
-
-        bool writeNeedsBarrier = false;
-        if (isDenseNative) {
-            writeNeedsBarrier = PropertyWriteNeedsTypeBarrier(alloc(), constraints(), current,
-                                                              &obj, nullptr, &elem,
-                                                              /* canModify = */ false);
-        }
-
-        // We can only inline setelem on dense arrays that do not need type
-        // barriers and on typed arrays and on typed object arrays.
-        Scalar::Type arrayType;
-        if ((!isDenseNative || writeNeedsBarrier) &&
-            !ElementAccessIsAnyTypedArray(constraints(), obj, id, &arrayType) &&
-            !elementAccessIsTypedObjectArrayOfScalarType(obj, id, &arrayType))
-        {
-            return InliningStatus_NotInlined;
-        }
-    }
+    bool emitted = false;
+    if (!setElemTryDense(&emitted, obj, id, value, /* writeHole = */ true))
+        return InliningStatus_Error;
+    if (!emitted)
+        return InliningStatus_NotInlined;
 
     callInfo.setImplicitlyUsedUnchecked();
-
-    // Push the result first so that the stack depth matches up for
-    // the potential bailouts that will occur in the stores below.
-    MConstant* udef = MConstant::New(alloc(), UndefinedValue());
-    current->add(udef);
-    current->push(udef);
-
-    for (uint32_t base = 0; base < argc; base += 3) {
-        uint32_t arri = base + 0;
-        uint32_t idxi = base + 1;
-
-        MDefinition* obj = callInfo.getArg(arri);
-        MDefinition* id = callInfo.getArg(idxi);
-
-        if (ElementAccessIsDenseNative(constraints(), obj, id)) {
-            if (!inlineUnsafeSetDenseArrayElement(callInfo, base))
-                return InliningStatus_Error;
-            continue;
-        }
-
-        Scalar::Type arrayType;
-        if (ElementAccessIsAnyTypedArray(constraints(), obj, id, &arrayType)) {
-            if (!inlineUnsafeSetTypedArrayElement(callInfo, base, arrayType))
-                return InliningStatus_Error;
-            continue;
-        }
-
-        if (elementAccessIsTypedObjectArrayOfScalarType(obj, id, &arrayType)) {
-            if (!inlineUnsafeSetTypedObjectArrayElement(callInfo, base, arrayType))
-                return InliningStatus_Error;
-            continue;
-        }
-
-        MOZ_CRASH("Element access not dense array nor typed array");
-    }
-
     return InliningStatus_Inlined;
 }
 
-bool
-IonBuilder::elementAccessIsTypedObjectArrayOfScalarType(MDefinition* obj, MDefinition* id,
-                                                        Scalar::Type* arrayType)
-{
-    if (obj->type() != MIRType_Object) // lookupTypeDescrSet() tests for TypedObject
-        return false;
-
-    if (id->type() != MIRType_Int32 && id->type() != MIRType_Double)
-        return false;
-
-    TypedObjectPrediction prediction = typedObjectPrediction(obj);
-    if (prediction.isUseless() || !prediction.ofArrayKind())
-        return false;
-
-    TypedObjectPrediction elemPrediction = prediction.arrayElementType();
-    if (elemPrediction.isUseless() || elemPrediction.kind() != type::Scalar)
-        return false;
-
-    *arrayType = elemPrediction.scalarType();
-    return true;
-}
-
-bool
-IonBuilder::inlineUnsafeSetDenseArrayElement(CallInfo& callInfo, uint32_t base)
-{
-    // Note: we do not check the conditions that are asserted as true
-    // in intrinsic_UnsafePutElements():
-    // - arr is a dense array
-    // - idx < initialized length
-    // Furthermore, note that inlineUnsafePutElements ensures the type of the
-    // value is reflected in the JSID_VOID property of the array.
-
-    MDefinition* obj = callInfo.getArg(base + 0);
-    MDefinition* id = callInfo.getArg(base + 1);
-    MDefinition* elem = callInfo.getArg(base + 2);
-
-    TemporaryTypeSet::DoubleConversion conversion =
-        obj->resultTypeSet()->convertDoubleElements(constraints());
-    if (!jsop_setelem_dense(conversion, SetElem_Unsafe, obj, id, elem, JSVAL_TYPE_MAGIC))
-        return false;
-    return true;
-}
-
-bool
-IonBuilder::inlineUnsafeSetTypedArrayElement(CallInfo& callInfo,
-                                             uint32_t base,
-                                             Scalar::Type arrayType)
-{
-    // Note: we do not check the conditions that are asserted as true
-    // in intrinsic_UnsafePutElements():
-    // - arr is a typed array
-    // - idx < length
-
-    MDefinition* obj = callInfo.getArg(base + 0);
-    MDefinition* id = callInfo.getArg(base + 1);
-    MDefinition* elem = callInfo.getArg(base + 2);
-
-    if (!jsop_setelem_typed(arrayType, SetElem_Unsafe, obj, id, elem))
-        return false;
-
-    return true;
-}
-
-bool
-IonBuilder::inlineUnsafeSetTypedObjectArrayElement(CallInfo& callInfo,
-                                                   uint32_t base,
-                                                   Scalar::Type arrayType)
-{
-    // Note: we do not check the conditions that are asserted as true
-    // in intrinsic_UnsafePutElements():
-    // - arr is a typed array
-    // - idx < length
-
-    MDefinition* obj = callInfo.getArg(base + 0);
-    MDefinition* id = callInfo.getArg(base + 1);
-    MDefinition* elem = callInfo.getArg(base + 2);
-
-    if (!jsop_setelem_typed_object(arrayType, SetElem_Unsafe, obj, id, elem))
-        return false;
-
-    return true;
-}
-
 IonBuilder::InliningStatus
 IonBuilder::inlineHasClass(CallInfo& callInfo,
                            const Class* clasp1, const Class* clasp2,
diff --git a/js/src/jit/MIR.cpp b/js/src/jit/MIR.cpp
index 42c3c603cc19..dd3ca8d9b8d2 100644
--- a/js/src/jit/MIR.cpp
+++ b/js/src/jit/MIR.cpp
@@ -4024,11 +4024,10 @@ MArrayState::Copy(TempAllocator& alloc, MArrayState* state)
 }
 
 MNewArray::MNewArray(CompilerConstraintList* constraints, uint32_t count, MConstant* templateConst,
-                     gc::InitialHeap initialHeap, AllocatingBehaviour allocating, jsbytecode* pc)
+                     gc::InitialHeap initialHeap, jsbytecode* pc)
   : MUnaryInstruction(templateConst),
     count_(count),
     initialHeap_(initialHeap),
-    allocating_(allocating),
     convertDoubleElements_(false),
     pc_(pc)
 {
@@ -4047,11 +4046,6 @@ MNewArray::shouldUseVM() const
     if (!templateObject())
         return true;
 
-    // Allocate space using the VMCall when mir hints it needs to get allocated
-    // immediately, but only when data doesn't fit the available array slots.
-    if (allocatingBehaviour() == NewArray_Unallocating)
-        return false;
-
     if (templateObject()->is<UnboxedArrayObject>()) {
         MOZ_ASSERT(templateObject()->as<UnboxedArrayObject>().capacity() >= count());
         return !templateObject()->as<UnboxedArrayObject>().hasInlineElements();
diff --git a/js/src/jit/MIR.h b/js/src/jit/MIR.h
index 5d55ebada357..a2cff67290ab 100644
--- a/js/src/jit/MIR.h
+++ b/js/src/jit/MIR.h
@@ -2915,8 +2915,6 @@ class MNewArray
 
     // Heap where the array should be allocated.
     gc::InitialHeap initialHeap_;
-    // Allocate space at initialization or not
-    AllocatingBehaviour allocating_;
 
     // Whether values written to this array should be converted to double first.
     bool convertDoubleElements_;
@@ -2924,18 +2922,16 @@ class MNewArray
     jsbytecode* pc_;
 
     MNewArray(CompilerConstraintList* constraints, uint32_t count, MConstant* templateConst,
-              gc::InitialHeap initialHeap, AllocatingBehaviour allocating, jsbytecode* pc);
+              gc::InitialHeap initialHeap, jsbytecode* pc);
 
   public:
     INSTRUCTION_HEADER(NewArray)
 
     static MNewArray* New(TempAllocator& alloc, CompilerConstraintList* constraints,
                           uint32_t count, MConstant* templateConst,
-                          gc::InitialHeap initialHeap, AllocatingBehaviour allocating,
-                          jsbytecode* pc)
+                          gc::InitialHeap initialHeap, jsbytecode* pc)
     {
-        return new(alloc) MNewArray(constraints, count, templateConst,
-                                    initialHeap, allocating, pc);
+        return new(alloc) MNewArray(constraints, count, templateConst, initialHeap, pc);
     }
 
     uint32_t count() const {
@@ -2950,10 +2946,6 @@ class MNewArray
         return initialHeap_;
     }
 
-    AllocatingBehaviour allocatingBehaviour() const {
-        return allocating_;
-    }
-
     jsbytecode* pc() const {
         return pc_;
     }
@@ -3027,10 +3019,10 @@ class MNewArrayDynamicLength
   : public MUnaryInstruction,
     public IntPolicy<0>::Data
 {
-    AlwaysTenured<ArrayObject*> templateObject_;
+    AlwaysTenuredObject templateObject_;
     gc::InitialHeap initialHeap_;
 
-    MNewArrayDynamicLength(CompilerConstraintList* constraints, ArrayObject* templateObject,
+    MNewArrayDynamicLength(CompilerConstraintList* constraints, JSObject* templateObject,
                            gc::InitialHeap initialHeap, MDefinition* length)
       : MUnaryInstruction(length),
         templateObject_(templateObject),
@@ -3046,7 +3038,7 @@ class MNewArrayDynamicLength
     INSTRUCTION_HEADER(NewArrayDynamicLength)
 
     static MNewArrayDynamicLength* New(TempAllocator& alloc, CompilerConstraintList* constraints,
-                                       ArrayObject* templateObject, gc::InitialHeap initialHeap,
+                                       JSObject* templateObject, gc::InitialHeap initialHeap,
                                        MDefinition* length)
     {
         return new(alloc) MNewArrayDynamicLength(constraints, templateObject, initialHeap, length);
@@ -3055,7 +3047,7 @@ class MNewArrayDynamicLength
     MDefinition* length() const {
         return getOperand(0);
     }
-    ArrayObject* templateObject() const {
+    JSObject* templateObject() const {
         return templateObject_;
     }
     gc::InitialHeap initialHeap() const {
@@ -7995,6 +7987,36 @@ class MIncrementUnboxedArrayInitializedLength
     ALLOW_CLONE(MIncrementUnboxedArrayInitializedLength)
 };
 
+// Set the initialized length of an unboxed array object.
+class MSetUnboxedArrayInitializedLength
+  : public MBinaryInstruction,
+    public SingleObjectPolicy::Data
+{
+    explicit MSetUnboxedArrayInitializedLength(MDefinition* obj, MDefinition* length)
+      : MBinaryInstruction(obj, length)
+    {}
+
+  public:
+    INSTRUCTION_HEADER(SetUnboxedArrayInitializedLength)
+
+    static MSetUnboxedArrayInitializedLength* New(TempAllocator& alloc, MDefinition* obj,
+                                                  MDefinition* length) {
+        return new(alloc) MSetUnboxedArrayInitializedLength(obj, length);
+    }
+
+    MDefinition* object() const {
+        return getOperand(0);
+    }
+    MDefinition* length() const {
+        return getOperand(1);
+    }
+    AliasSet getAliasSet() const override {
+        return AliasSet::Store(AliasSet::ObjectFields);
+    }
+
+    ALLOW_CLONE(MSetUnboxedArrayInitializedLength)
+};
+
 // Load the array length from an elements header.
 class MArrayLength
   : public MUnaryInstruction,
@@ -11891,13 +11913,15 @@ class MInArray
 {
     bool needsHoleCheck_;
     bool needsNegativeIntCheck_;
+    JSValueType unboxedType_;
 
     MInArray(MDefinition* elements, MDefinition* index,
              MDefinition* initLength, MDefinition* object,
-             bool needsHoleCheck)
+             bool needsHoleCheck, JSValueType unboxedType)
       : MQuaternaryInstruction(elements, index, initLength, object),
         needsHoleCheck_(needsHoleCheck),
-        needsNegativeIntCheck_(true)
+        needsNegativeIntCheck_(true),
+        unboxedType_(unboxedType)
     {
         setResultType(MIRType_Boolean);
         setMovable();
@@ -11911,9 +11935,10 @@ class MInArray
 
     static MInArray* New(TempAllocator& alloc, MDefinition* elements, MDefinition* index,
                          MDefinition* initLength, MDefinition* object,
-                         bool needsHoleCheck)
+                         bool needsHoleCheck, JSValueType unboxedType)
     {
-        return new(alloc) MInArray(elements, index, initLength, object, needsHoleCheck);
+        return new(alloc) MInArray(elements, index, initLength, object, needsHoleCheck,
+                                   unboxedType);
     }
 
     MDefinition* elements() const {
@@ -11934,6 +11959,9 @@ class MInArray
     bool needsNegativeIntCheck() const {
         return needsNegativeIntCheck_;
     }
+    JSValueType unboxedType() const {
+        return unboxedType_;
+    }
     void collectRangeInfoPreTrunc() override;
     AliasSet getAliasSet() const override {
         return AliasSet::Load(AliasSet::Element);
@@ -11946,6 +11974,8 @@ class MInArray
             return false;
         if (needsNegativeIntCheck() != other->needsNegativeIntCheck())
             return false;
+        if (unboxedType() != other->unboxedType())
+            return false;
         return congruentIfOperandsEqual(other);
     }
 };
diff --git a/js/src/jit/MOpcodes.h b/js/src/jit/MOpcodes.h
index c7bb99e11830..2c7429b38deb 100644
--- a/js/src/jit/MOpcodes.h
+++ b/js/src/jit/MOpcodes.h
@@ -182,6 +182,7 @@ namespace jit {
     _(UnboxedArrayLength)                                                   \
     _(UnboxedArrayInitializedLength)                                        \
     _(IncrementUnboxedArrayInitializedLength)                               \
+    _(SetUnboxedArrayInitializedLength)                                     \
     _(Not)                                                                  \
     _(BoundsCheck)                                                          \
     _(BoundsCheckLower)                                                     \
diff --git a/js/src/jit/Recover.cpp b/js/src/jit/Recover.cpp
index ce59771e599e..1c315946fd61 100644
--- a/js/src/jit/Recover.cpp
+++ b/js/src/jit/Recover.cpp
@@ -1197,14 +1197,12 @@ MNewArray::writeRecoverData(CompactBufferWriter& writer) const
     MOZ_ASSERT(canRecoverOnBailout());
     writer.writeUnsigned(uint32_t(RInstruction::Recover_NewArray));
     writer.writeUnsigned(count());
-    writer.writeByte(uint8_t(allocatingBehaviour()));
     return true;
 }
 
 RNewArray::RNewArray(CompactBufferReader& reader)
 {
     count_ = reader.readUnsigned();
-    allocatingBehaviour_ = AllocatingBehaviour(reader.readByte());
 }
 
 bool
@@ -1212,9 +1210,9 @@ RNewArray::recover(JSContext* cx, SnapshotIterator& iter) const
 {
     RootedObject templateObject(cx, &iter.read().toObject());
     RootedValue result(cx);
-    RootedObjectGroup group(cx);
+    RootedObjectGroup group(cx, templateObject->group());
 
-    JSObject* resultObject = NewDenseArray(cx, count_, group, allocatingBehaviour_);
+    JSObject* resultObject = NewFullyAllocatedArrayTryUseGroup(cx, group, count_);
     if (!resultObject)
         return false;
 
diff --git a/js/src/jit/Recover.h b/js/src/jit/Recover.h
index 201d4ac66f94..84e82fe63cc2 100644
--- a/js/src/jit/Recover.h
+++ b/js/src/jit/Recover.h
@@ -635,7 +635,6 @@ class RNewArray final : public RInstruction
 {
   private:
     uint32_t count_;
-    AllocatingBehaviour allocatingBehaviour_;
 
   public:
     RINSTRUCTION_HEADER_(NewArray)
diff --git a/js/src/jit/ScalarReplacement.cpp b/js/src/jit/ScalarReplacement.cpp
index d94d8e8e7027..915b9ad6876d 100644
--- a/js/src/jit/ScalarReplacement.cpp
+++ b/js/src/jit/ScalarReplacement.cpp
@@ -605,13 +605,6 @@ IsArrayEscaped(MInstruction* ins)
     MOZ_ASSERT(ins->isNewArray());
     uint32_t count = ins->toNewArray()->count();
 
-    // The array is probably too large to be represented efficiently with
-    // MArrayState, and we do not want to make huge allocations during bailouts.
-    if (ins->toNewArray()->allocatingBehaviour() == NewArray_Unallocating) {
-        JitSpewDef(JitSpew_Escape, "Array is not allocated\n", ins);
-        return true;
-    }
-
     JSObject* obj = ins->toNewArray()->templateObject();
     if (!obj || obj->is<UnboxedArrayObject>())
         return true;
diff --git a/js/src/jit/arm/MacroAssembler-arm.cpp b/js/src/jit/arm/MacroAssembler-arm.cpp
index 5431514149dc..ec220f70b1ca 100644
--- a/js/src/jit/arm/MacroAssembler-arm.cpp
+++ b/js/src/jit/arm/MacroAssembler-arm.cpp
@@ -2005,6 +2005,12 @@ MacroAssemblerARMCompat::or32(Imm32 imm, Register dest)
     ma_orr(imm, dest);
 }
 
+void
+MacroAssemblerARMCompat::or32(Register src, Register dest)
+{
+    ma_orr(src, dest);
+}
+
 void
 MacroAssemblerARMCompat::xorPtr(Imm32 imm, Register dest)
 {
diff --git a/js/src/jit/arm/MacroAssembler-arm.h b/js/src/jit/arm/MacroAssembler-arm.h
index 56ad14fd32aa..3446c55a4446 100644
--- a/js/src/jit/arm/MacroAssembler-arm.h
+++ b/js/src/jit/arm/MacroAssembler-arm.h
@@ -1277,6 +1277,7 @@ class MacroAssemblerARMCompat : public MacroAssemblerARM
     void and32(Imm32 imm, Register dest);
     void and32(Imm32 imm, const Address& dest);
     void and32(const Address& src, Register dest);
+    void or32(Register src, Register dest);
     void or32(Imm32 imm, Register dest);
     void or32(Imm32 imm, const Address& dest);
     void xorPtr(Imm32 imm, Register dest);
diff --git a/js/src/jit/mips/MacroAssembler-mips.cpp b/js/src/jit/mips/MacroAssembler-mips.cpp
index ed8085a63d47..0087992eb2ae 100644
--- a/js/src/jit/mips/MacroAssembler-mips.cpp
+++ b/js/src/jit/mips/MacroAssembler-mips.cpp
@@ -1673,6 +1673,12 @@ MacroAssemblerMIPSCompat::or32(Imm32 imm, const Address& dest)
     store32(SecondScratchReg, dest);
 }
 
+void
+MacroAssemblerMIPSCompat::or32(Register src, Register dest)
+{
+    ma_or(dest, src);
+}
+
 void
 MacroAssemblerMIPSCompat::xor32(Imm32 imm, Register dest)
 {
diff --git a/js/src/jit/mips/MacroAssembler-mips.h b/js/src/jit/mips/MacroAssembler-mips.h
index aa560a4c1088..f28d8c105ae7 100644
--- a/js/src/jit/mips/MacroAssembler-mips.h
+++ b/js/src/jit/mips/MacroAssembler-mips.h
@@ -1207,6 +1207,7 @@ public:
     void and32(const Address& src, Register dest);
     void or32(Imm32 imm, Register dest);
     void or32(Imm32 imm, const Address& dest);
+    void or32(Register src, Register dest);
     void xor32(Imm32 imm, Register dest);
     void xorPtr(Imm32 imm, Register dest);
     void xorPtr(Register src, Register dest);
diff --git a/js/src/jsapi.cpp b/js/src/jsapi.cpp
index 6ac7c92b179a..b6c00b2ab836 100644
--- a/js/src/jsapi.cpp
+++ b/js/src/jsapi.cpp
@@ -4548,6 +4548,12 @@ JS::AutoSetAsyncStackForNewCalls::AutoSetAsyncStackForNewCalls(
 {
     CHECK_REQUEST(cx);
 
+    // The option determines whether we actually use the new values at this
+    // point. It will not affect restoring the previous values when the object
+    // is destroyed, so if the option changes it won't cause consistency issues.
+    if (!cx->runtime()->options().asyncStack())
+        return;
+
     SavedFrame* asyncStack = &stack->as<SavedFrame>();
     MOZ_ASSERT(!asyncCause->empty());
 
diff --git a/js/src/jsapi.h b/js/src/jsapi.h
index 4ae22afff8ec..7e6566f53021 100644
--- a/js/src/jsapi.h
+++ b/js/src/jsapi.h
@@ -1164,6 +1164,7 @@ class JS_PUBLIC_API(RuntimeOptions) {
         asmJS_(true),
         nativeRegExp_(true),
         unboxedArrays_(false),
+        asyncStack_(true),
         werror_(false),
         strictMode_(false),
         extraWarnings_(false),
@@ -1213,6 +1214,12 @@ class JS_PUBLIC_API(RuntimeOptions) {
         return *this;
     }
 
+    bool asyncStack() const { return asyncStack_; }
+    RuntimeOptions& setAsyncStack(bool flag) {
+        asyncStack_ = flag;
+        return *this;
+    }
+
     bool werror() const { return werror_; }
     RuntimeOptions& setWerror(bool flag) {
         werror_ = flag;
@@ -1259,6 +1266,7 @@ class JS_PUBLIC_API(RuntimeOptions) {
     bool asmJS_ : 1;
     bool nativeRegExp_ : 1;
     bool unboxedArrays_ : 1;
+    bool asyncStack_ : 1;
     bool werror_ : 1;
     bool strictMode_ : 1;
     bool extraWarnings_ : 1;
diff --git a/js/src/jsarray.cpp b/js/src/jsarray.cpp
index 267affed52b0..1eb423c6d011 100644
--- a/js/src/jsarray.cpp
+++ b/js/src/jsarray.cpp
@@ -243,14 +243,25 @@ GetElement(JSContext* cx, HandleObject obj, IndexType index, bool* hole, Mutable
     return GetElement(cx, obj, obj, index, hole, vp);
 }
 
-void
+bool
 ElementAdder::append(JSContext* cx, HandleValue v)
 {
     MOZ_ASSERT(index_ < length_);
-    if (resObj_)
-        resObj_->as<NativeObject>().setDenseElementWithType(cx, index_++, v);
-    else
-        vp_[index_++] = v;
+    if (resObj_) {
+        DenseElementResult result = SetOrExtendAnyBoxedOrUnboxedDenseElements(cx, resObj_, index_,
+                                                                              v.address(), 1,
+                                                                              UpdateTypes);
+        if (result == DenseElementResult::Failure)
+            return false;
+        if (result == DenseElementResult::Incomplete) {
+            if (!DefineElement(cx, resObj_, index_, v))
+                return false;
+        }
+    } else {
+        vp_[index_] = v;
+    }
+    index_++;
+    return true;
 }
 
 void
@@ -258,12 +269,9 @@ ElementAdder::appendHole()
 {
     MOZ_ASSERT(getBehavior_ == ElementAdder::CheckHasElemPreserveHoles);
     MOZ_ASSERT(index_ < length_);
-    if (resObj_) {
-        MOZ_ASSERT(resObj_->as<NativeObject>().getDenseElement(index_).isMagic(JS_ELEMENTS_HOLE));
-        index_++;
-    } else {
-        vp_[index_++].setMagic(JS_ELEMENTS_HOLE);
-    }
+    if (!resObj_)
+        vp_[index_].setMagic(JS_ELEMENTS_HOLE);
+    index_++;
 }
 
 bool
@@ -287,7 +295,8 @@ js::GetElementsWithAdder(JSContext* cx, HandleObject obj, HandleObject receiver,
             if (!GetElement(cx, obj, receiver, i, &val))
                 return false;
         }
-        adder->append(cx, val);
+        if (!adder->append(cx, val))
+            return false;
     }
 
     return true;
@@ -2281,84 +2290,6 @@ js::array_unshift(JSContext* cx, unsigned argc, Value* vp)
     return true;
 }
 
-// Return a new array with the default prototype and specified allocated
-// capacity and length. If possible, try to reuse the group of the input
-// object. The resulting array will have the same boxed/unboxed elements
-// representation as the input object, and will either reuse the input
-// object's group or will have unknown property types.
-JSObject*
-js::NewFullyAllocatedArrayTryReuseGroup(JSContext* cx, JSObject* obj, size_t length,
-                                        NewObjectKind newKind, bool forceAnalyze)
-{
-    if (!obj->is<ArrayObject>() && !obj->is<UnboxedArrayObject>())
-        return NewDenseFullyAllocatedArray(cx, length, nullptr, newKind);
-
-    if (obj->getProto() != cx->global()->maybeGetArrayPrototype())
-        return NewDenseFullyAllocatedArray(cx, length, nullptr, newKind);
-
-    RootedObjectGroup group(cx, obj->getGroup(cx));
-    if (!group)
-        return nullptr;
-
-    if (group->maybePreliminaryObjects())
-        group->maybePreliminaryObjects()->maybeAnalyze(cx, group, forceAnalyze);
-
-    if (group->shouldPreTenure() || group->maybePreliminaryObjects())
-        newKind = TenuredObject;
-
-    if (group->maybeUnboxedLayout()) {
-        if (length > UnboxedArrayObject::MaximumCapacity)
-            return NewDenseFullyAllocatedArray(cx, length, nullptr, newKind);
-
-        return UnboxedArrayObject::create(cx, group, length, newKind);
-    }
-
-    ArrayObject* res = NewDenseFullyAllocatedArray(cx, length, nullptr, newKind);
-    if (!res)
-        return nullptr;
-
-    res->setGroup(group);
-
-    if (PreliminaryObjectArray* preliminaryObjects = group->maybePreliminaryObjects())
-        preliminaryObjects->registerNewObject(res);
-
-    return res;
-}
-
-// As above, except this might not allocate space up to |length| and will
-// definitely return a normal boxed array, instead of an unboxed array. This
-// should be used when the result might need sparse elements.
-static inline ArrayObject*
-NewPartlyAllocatedArrayTryReuseGroup(JSContext* cx, JSObject* obj, size_t length)
-{
-    if (!obj->is<ArrayObject>() && !obj->is<UnboxedArrayObject>())
-        return NewDensePartlyAllocatedArray(cx, length);
-
-    if (obj->getProto() != cx->global()->maybeGetArrayPrototype())
-        return NewDensePartlyAllocatedArray(cx, length);
-
-    RootedObjectGroup group(cx, obj->getGroup(cx));
-    if (!group)
-        return nullptr;
-
-    if (group->maybePreliminaryObjects())
-        group->maybePreliminaryObjects()->maybeAnalyze(cx, group);
-
-    NewObjectKind newKind = GenericObject;
-    if (group->shouldPreTenure() || group->maybePreliminaryObjects())
-        newKind = TenuredObject;
-
-    if (group->maybeUnboxedLayout())
-        return NewDensePartlyAllocatedArray(cx, length, nullptr, newKind);
-
-    ArrayObject* res = NewDensePartlyAllocatedArray(cx, length, nullptr, newKind);
-    if (!res)
-        return nullptr;
-
-    res->setGroup(group);
-    return res;
-}
-
 /*
  * Returns true if this is a dense or unboxed array whose |count| properties
  * starting from |startingIndex| may be accessed (get, set, delete) directly
@@ -2960,28 +2891,17 @@ js::array_slice(JSContext* cx, unsigned argc, Value* vp)
         return true;
     }
 
-    RootedArrayObject narr(cx, NewPartlyAllocatedArrayTryReuseGroup(cx, obj, end - begin));
+    RootedObject narr(cx, NewPartlyAllocatedArrayTryReuseGroup(cx, obj, end - begin));
     if (!narr)
         return false;
 
     if (js::GetElementsOp op = obj->getOps()->getElements) {
-        // Ensure that we have dense elements, so that ElementAdder::append can
-        // use setDenseElementWithType.
-        DenseElementResult result = narr->ensureDenseElements(cx, 0, end - begin);
-        if (result == DenseElementResult::Failure)
+        ElementAdder adder(cx, narr, end - begin, ElementAdder::CheckHasElemPreserveHoles);
+        if (!op(cx, obj, begin, end, &adder))
             return false;
 
-        if (result == DenseElementResult::Success) {
-            ElementAdder adder(cx, narr, end - begin, ElementAdder::CheckHasElemPreserveHoles);
-            if (!op(cx, obj, begin, end, &adder))
-                return false;
-
-            args.rval().setObject(*narr);
-            return true;
-        }
-
-        // Fallthrough
-        MOZ_ASSERT(result == DenseElementResult::Incomplete);
+        args.rval().setObject(*narr);
+        return true;
     }
 
     if (obj->isNative() && obj->isIndexed() && end - begin > 1000) {
@@ -3076,13 +2996,9 @@ array_filter(JSContext* cx, unsigned argc, Value* vp)
     RootedValue thisv(cx, args.length() >= 2 ? args[1] : UndefinedValue());
 
     /* Step 6. */
-    RootedObject arr(cx, NewDenseFullyAllocatedArray(cx, 0));
+    RootedObject arr(cx, NewFullyAllocatedArrayForCallingAllocationSite(cx, 0));
     if (!arr)
         return false;
-    ObjectGroup* newGroup = ObjectGroup::callingAllocationSiteGroup(cx, JSProto_Array);
-    if (!newGroup)
-        return false;
-    arr->setGroup(newGroup);
 
     /* Step 7. */
     uint32_t k = 0;
@@ -3157,19 +3073,11 @@ IsArrayConstructor(const Value& v)
 }
 
 static bool
-ArrayFromCallArgs(JSContext* cx, HandleObjectGroup group, CallArgs& args)
+ArrayFromCallArgs(JSContext* cx, CallArgs& args)
 {
-    JSObject* obj = NewDenseFullyAllocatedArray(cx, args.length());
+    JSObject* obj = NewCopiedArrayForCallingAllocationSite(cx, args.array(), args.length());
     if (!obj)
         return false;
-    obj->setGroup(group);
-
-    DenseElementResult result =
-        SetOrExtendAnyBoxedOrUnboxedDenseElements(cx, obj, 0, args.array(), args.length(),
-                                                  UpdateTypes);
-    if (result == DenseElementResult::Failure)
-        return false;
-    MOZ_ASSERT(result == DenseElementResult::Success);
 
     args.rval().setObject(*obj);
     return true;
@@ -3183,10 +3091,7 @@ array_of(JSContext* cx, unsigned argc, Value* vp)
     if (IsArrayConstructor(args.thisv()) || !IsConstructor(args.thisv())) {
         // IsArrayConstructor(this) will usually be true in practice. This is
         // the most common path.
-        RootedObjectGroup group(cx, ObjectGroup::callingAllocationSiteGroup(cx, JSProto_Array));
-        if (!group)
-            return false;
-        return ArrayFromCallArgs(cx, group, args);
+        return ArrayFromCallArgs(cx, args);
     }
 
     // Step 4.
@@ -3289,16 +3194,12 @@ bool
 js::ArrayConstructor(JSContext* cx, unsigned argc, Value* vp)
 {
     CallArgs args = CallArgsFromVp(argc, vp);
-    
+
     if (args.isConstructing())
         MOZ_ASSERT(args.newTarget().toObject().as<JSFunction>().native() == js::ArrayConstructor);
-    
-    RootedObjectGroup group(cx, ObjectGroup::callingAllocationSiteGroup(cx, JSProto_Array));
-    if (!group)
-        return false;
 
     if (args.length() != 1 || !args[0].isNumber())
-        return ArrayFromCallArgs(cx, group, args);
+        return ArrayFromCallArgs(cx, args);
 
     uint32_t length;
     if (args[0].isInt32()) {
@@ -3317,14 +3218,7 @@ js::ArrayConstructor(JSContext* cx, unsigned argc, Value* vp)
         }
     }
 
-    /*
-     * Allocate up to |EagerAllocationMaxLength| dense elements eagerly, to
-     * avoid reallocating elements when filling the array.
-     */
-    AllocatingBehaviour allocating = (length <= ArrayObject::EagerAllocationMaxLength)
-                                   ? NewArray_FullyAllocating
-                                   : NewArray_PartlyAllocating;
-    RootedObject obj(cx, NewDenseArray(cx, length, group, allocating));
+    JSObject* obj = NewPartlyAllocatedArrayForCallingAllocationSite(cx, length);
     if (!obj)
         return false;
 
@@ -3332,7 +3226,7 @@ js::ArrayConstructor(JSContext* cx, unsigned argc, Value* vp)
     return true;
 }
 
-ArrayObject*
+JSObject*
 js::ArrayConstructorOneArg(JSContext* cx, HandleObjectGroup group, int32_t lengthInt)
 {
     if (lengthInt < 0) {
@@ -3341,10 +3235,7 @@ js::ArrayConstructorOneArg(JSContext* cx, HandleObjectGroup group, int32_t lengt
     }
 
     uint32_t length = uint32_t(lengthInt);
-    AllocatingBehaviour allocating = (length <= ArrayObject::EagerAllocationMaxLength)
-                                   ? NewArray_FullyAllocating
-                                   : NewArray_PartlyAllocating;
-    return NewDenseArray(cx, length, group, allocating);
+    return NewPartlyAllocatedArrayTryUseGroup(cx, group, length);
 }
 
 static JSObject*
@@ -3532,7 +3423,7 @@ js::NewDenseFullyAllocatedArray(ExclusiveContext* cx, uint32_t length,
                                 HandleObject proto /* = nullptr */,
                                 NewObjectKind newKind /* = GenericObject */)
 {
-    return NewArray<NativeObject::NELEMENTS_LIMIT>(cx, length, proto, newKind);
+    return NewArray<UINT32_MAX>(cx, length, proto, newKind);
 }
 
 ArrayObject * JS_FASTCALL
@@ -3551,47 +3442,13 @@ js::NewDenseUnallocatedArray(ExclusiveContext* cx, uint32_t length,
     return NewArray<0>(cx, length, proto, newKind);
 }
 
-ArrayObject*
-js::NewDenseArray(ExclusiveContext* cx, uint32_t length, HandleObjectGroup group,
-                  AllocatingBehaviour allocating, bool convertDoubleElements)
-{
-    NewObjectKind newKind = !group ? SingletonObject : GenericObject;
-    if (group && group->shouldPreTenure())
-        newKind = TenuredObject;
-
-    ArrayObject* arr;
-    if (allocating == NewArray_Unallocating) {
-        arr = NewDenseUnallocatedArray(cx, length, nullptr, newKind);
-    } else if (allocating == NewArray_PartlyAllocating) {
-        arr = NewDensePartlyAllocatedArray(cx, length, nullptr, newKind);
-    } else {
-        MOZ_ASSERT(allocating == NewArray_FullyAllocating);
-        arr = NewDenseFullyAllocatedArray(cx, length, nullptr, newKind);
-    }
-    if (!arr)
-        return nullptr;
-
-    if (group)
-        arr->setGroup(group);
-
-    if (convertDoubleElements)
-        arr->setShouldConvertDoubleElements();
-
-    // If the length calculation overflowed, make sure that is marked for the
-    // new group.
-    if (arr->length() > INT32_MAX)
-        arr->setLength(cx, arr->length());
-
-    return arr;
-}
-
 ArrayObject*
 js::NewDenseCopiedArray(JSContext* cx, uint32_t length, HandleArrayObject src,
                         uint32_t elementOffset, HandleObject proto /* = nullptr */)
 {
     MOZ_ASSERT(!src->isIndexed());
 
-    ArrayObject* arr = NewArray<NativeObject::NELEMENTS_LIMIT>(cx, length, proto);
+    ArrayObject* arr = NewArray<UINT32_MAX>(cx, length, proto);
     if (!arr)
         return nullptr;
 
@@ -3610,7 +3467,7 @@ js::NewDenseCopiedArray(JSContext* cx, uint32_t length, const Value* values,
                         HandleObject proto /* = nullptr */,
                         NewObjectKind newKind /* = GenericObject */)
 {
-    ArrayObject* arr = NewArray<NativeObject::NELEMENTS_LIMIT>(cx, length, proto);
+    ArrayObject* arr = NewArray<UINT32_MAX>(cx, length, proto);
     if (!arr)
         return nullptr;
 
@@ -3636,7 +3493,7 @@ js::NewDenseFullyAllocatedArrayWithTemplate(JSContext* cx, uint32_t length, JSOb
 
     gc::InitialHeap heap = GetInitialHeap(GenericObject, &ArrayObject::class_);
     Rooted<ArrayObject*> arr(cx, ArrayObject::createArray(cx, allocKind,
-                                                           heap, shape, group, length));
+                                                          heap, shape, group, length));
     if (!arr)
         return nullptr;
 
@@ -3661,6 +3518,150 @@ js::NewDenseCopyOnWriteArray(JSContext* cx, HandleArrayObject templateObject, gc
     return arr;
 }
 
+// Return a new boxed or unboxed array with the specified length and allocated
+// capacity (up to maxLength), using the specified group if possible.
+template <uint32_t maxLength>
+static inline JSObject*
+NewArrayTryUseGroup(JSContext* cx, HandleObjectGroup group, size_t length,
+                    NewObjectKind newKind = GenericObject, bool forceAnalyze = false)
+{
+    MOZ_ASSERT(newKind != SingletonObject);
+
+    if (group->maybePreliminaryObjects())
+        group->maybePreliminaryObjects()->maybeAnalyze(cx, group, forceAnalyze);
+
+    if (group->shouldPreTenure() || group->maybePreliminaryObjects())
+        newKind = TenuredObject;
+
+    if (group->maybeUnboxedLayout()) {
+        if (length > UnboxedArrayObject::MaximumCapacity)
+            return NewArray<maxLength>(cx, length, nullptr, newKind);
+
+        return UnboxedArrayObject::create(cx, group, length, newKind, maxLength);
+    }
+
+    ArrayObject* res = NewArray<maxLength>(cx, length, nullptr, newKind);
+    if (!res)
+        return nullptr;
+
+    res->setGroup(group);
+
+    // If the length calculation overflowed, make sure that is marked for the
+    // new group.
+    if (res->length() > INT32_MAX)
+        res->setLength(cx, res->length());
+
+    if (PreliminaryObjectArray* preliminaryObjects = group->maybePreliminaryObjects())
+        preliminaryObjects->registerNewObject(res);
+
+    return res;
+}
+
+JSObject*
+js::NewFullyAllocatedArrayTryUseGroup(JSContext* cx, HandleObjectGroup group, size_t length)
+{
+    return NewArrayTryUseGroup<UINT32_MAX>(cx, group, length);
+}
+
+JSObject*
+js::NewPartlyAllocatedArrayTryUseGroup(JSContext* cx, HandleObjectGroup group, size_t length)
+{
+    return NewArrayTryUseGroup<ArrayObject::EagerAllocationMaxLength>(cx, group, length);
+}
+
+// Return a new array with the default prototype and specified allocated
+// capacity and length. If possible, try to reuse the group of the input
+// object. The resulting array will either reuse the input object's group or
+// will have unknown property types. Additionally, the result will have the
+// same boxed/unboxed elements representation as the input object, unless
+// |length| is larger than the input object's initialized length (in which case
+// UnboxedArrayObject::MaximumCapacity might be exceeded).
+template <uint32_t maxLength>
+static inline JSObject*
+NewArrayTryReuseGroup(JSContext* cx, JSObject* obj, size_t length,
+                      NewObjectKind newKind = GenericObject, bool forceAnalyze = false)
+{
+    if (!obj->is<ArrayObject>() && !obj->is<UnboxedArrayObject>())
+        return NewArray<maxLength>(cx, length, nullptr, newKind);
+
+    if (obj->getProto() != cx->global()->maybeGetArrayPrototype())
+        return NewArray<maxLength>(cx, length, nullptr, newKind);
+
+    RootedObjectGroup group(cx, obj->getGroup(cx));
+    if (!group)
+        return nullptr;
+
+    return NewArrayTryUseGroup<maxLength>(cx, group, length, newKind, forceAnalyze);
+}
+
+JSObject*
+js::NewFullyAllocatedArrayTryReuseGroup(JSContext* cx, JSObject* obj, size_t length,
+                                        NewObjectKind newKind, bool forceAnalyze)
+{
+    return NewArrayTryReuseGroup<UINT32_MAX>(cx, obj, length, newKind, forceAnalyze);
+}
+
+JSObject*
+js::NewPartlyAllocatedArrayTryReuseGroup(JSContext* cx, JSObject* obj, size_t length)
+{
+    return NewArrayTryReuseGroup<ArrayObject::EagerAllocationMaxLength>(cx, obj, length);
+}
+
+JSObject*
+js::NewFullyAllocatedArrayForCallingAllocationSite(JSContext* cx, size_t length,
+                                                   NewObjectKind newKind, bool forceAnalyze)
+{
+    RootedObjectGroup group(cx, ObjectGroup::callingAllocationSiteGroup(cx, JSProto_Array));
+    if (!group)
+        return nullptr;
+    return NewArrayTryUseGroup<UINT32_MAX>(cx, group, length, newKind, forceAnalyze);
+}
+
+JSObject*
+js::NewPartlyAllocatedArrayForCallingAllocationSite(JSContext* cx, size_t length)
+{
+    RootedObjectGroup group(cx, ObjectGroup::callingAllocationSiteGroup(cx, JSProto_Array));
+    if (!group)
+        return nullptr;
+    return NewArrayTryUseGroup<ArrayObject::EagerAllocationMaxLength>(cx, group, length);
+}
+
+JSObject*
+js::NewCopiedArrayTryUseGroup(JSContext* cx, HandleObjectGroup group, const Value* vp, size_t length)
+{
+    JSObject* obj = NewFullyAllocatedArrayTryUseGroup(cx, group, length);
+    if (!obj)
+        return nullptr;
+
+    DenseElementResult result =
+        SetOrExtendAnyBoxedOrUnboxedDenseElements(cx, obj, 0, vp, length, UpdateTypes);
+    if (result == DenseElementResult::Failure)
+        return nullptr;
+    if (result == DenseElementResult::Success)
+        return obj;
+
+    MOZ_ASSERT(obj->is<UnboxedArrayObject>());
+    if (!UnboxedArrayObject::convertToNative(cx, obj))
+        return nullptr;
+
+    result = SetOrExtendBoxedOrUnboxedDenseElements<JSVAL_TYPE_MAGIC>(cx, obj, 0, vp, length,
+                                                                      UpdateTypes);
+    MOZ_ASSERT(result != DenseElementResult::Incomplete);
+    if (result == DenseElementResult::Failure)
+        return nullptr;
+
+    return obj;
+}
+
+JSObject*
+js::NewCopiedArrayForCallingAllocationSite(JSContext* cx, const Value* vp, size_t length)
+{
+    RootedObjectGroup group(cx, ObjectGroup::callingAllocationSiteGroup(cx, JSProto_Array));
+    if (!group)
+        return nullptr;
+    return NewCopiedArrayTryUseGroup(cx, group, vp, length);
+}
+
 #ifdef DEBUG
 bool
 js::ArrayInfo(JSContext* cx, unsigned argc, Value* vp)
diff --git a/js/src/jsarray.h b/js/src/jsarray.h
index 797884a61538..aefa9e83c25a 100644
--- a/js/src/jsarray.h
+++ b/js/src/jsarray.h
@@ -12,6 +12,8 @@
 #include "jsobj.h"
 #include "jspubtd.h"
 
+#include "vm/ArrayObject.h"
+
 namespace js {
 /* 2^32-2, inclusive */
 const uint32_t MAX_ARRAY_INDEX = 4294967294u;
@@ -35,7 +37,7 @@ IdIsIndex(jsid id, uint32_t* indexp)
 extern JSObject*
 InitArrayClass(JSContext* cx, js::HandleObject obj);
 
-class ArrayObject;
+// The methods below only create dense boxed arrays.
 
 /* Create a dense array with no capacity allocated, length set to 0. */
 extern ArrayObject * JS_FASTCALL
@@ -63,20 +65,6 @@ extern ArrayObject * JS_FASTCALL
 NewDenseFullyAllocatedArray(ExclusiveContext* cx, uint32_t length, HandleObject proto = nullptr,
                             NewObjectKind newKind = GenericObject);
 
-enum AllocatingBehaviour {
-    NewArray_Unallocating,
-    NewArray_PartlyAllocating,
-    NewArray_FullyAllocating
-};
-
-/*
- * Create a dense array with a set length, but only allocates space for the
- * contents if the length is not excessive.
- */
-extern ArrayObject*
-NewDenseArray(ExclusiveContext* cx, uint32_t length, HandleObjectGroup group,
-              AllocatingBehaviour allocating, bool convertDoubleElements = false);
-
 /* Create a dense array with a copy of the dense array elements in src. */
 extern ArrayObject*
 NewDenseCopiedArray(JSContext* cx, uint32_t length, HandleArrayObject src,
@@ -95,12 +83,36 @@ NewDenseFullyAllocatedArrayWithTemplate(JSContext* cx, uint32_t length, JSObject
 extern JSObject*
 NewDenseCopyOnWriteArray(JSContext* cx, HandleArrayObject templateObject, gc::InitialHeap heap);
 
-/* Create a dense or unboxed array, using the same group as |obj| if possible. */
+// The methods below can create either boxed or unboxed arrays.
+
+extern JSObject*
+NewFullyAllocatedArrayTryUseGroup(JSContext* cx, HandleObjectGroup group, size_t length);
+
+extern JSObject*
+NewPartlyAllocatedArrayTryUseGroup(JSContext* cx, HandleObjectGroup group, size_t length);
+
 extern JSObject*
 NewFullyAllocatedArrayTryReuseGroup(JSContext* cx, JSObject* obj, size_t length,
                                     NewObjectKind newKind = GenericObject,
                                     bool forceAnalyze = false);
 
+extern JSObject*
+NewPartlyAllocatedArrayTryReuseGroup(JSContext* cx, JSObject* obj, size_t length);
+
+extern JSObject*
+NewFullyAllocatedArrayForCallingAllocationSite(JSContext* cx, size_t length,
+                                               NewObjectKind newKind = GenericObject,
+                                               bool forceAnalyze = false);
+
+extern JSObject*
+NewPartlyAllocatedArrayForCallingAllocationSite(JSContext* cx, size_t length);
+
+extern JSObject*
+NewCopiedArrayTryUseGroup(JSContext* cx, HandleObjectGroup group, const Value* vp, size_t length);
+
+extern JSObject*
+NewCopiedArrayForCallingAllocationSite(JSContext* cx, const Value* vp, size_t length);
+
 /*
  * Determines whether a write to the given element on |obj| should fail because
  * |obj| is an Array with a non-writable length, and writing that element would
@@ -193,7 +205,7 @@ array_slice_dense(JSContext* cx, HandleObject obj, int32_t begin, int32_t end, H
 extern bool
 NewbornArrayPush(JSContext* cx, HandleObject obj, const Value& v);
 
-extern ArrayObject*
+extern JSObject*
 ArrayConstructorOneArg(JSContext* cx, HandleObjectGroup group, int32_t lengthInt);
 
 #ifdef DEBUG
diff --git a/js/src/jscntxt.h b/js/src/jscntxt.h
index 18528a34b834..ae9a4967b16d 100644
--- a/js/src/jscntxt.h
+++ b/js/src/jscntxt.h
@@ -794,7 +794,6 @@ bool intrinsic_NewDenseArray(JSContext* cx, unsigned argc, Value* vp);
 bool intrinsic_IsConstructing(JSContext* cx, unsigned argc, Value* vp);
 bool intrinsic_SubstringKernel(JSContext* cx, unsigned argc, Value* vp);
 
-bool intrinsic_UnsafePutElements(JSContext* cx, unsigned argc, Value* vp);
 bool intrinsic_DefineDataProperty(JSContext* cx, unsigned argc, Value* vp);
 bool intrinsic_UnsafeSetReservedSlot(JSContext* cx, unsigned argc, Value* vp);
 bool intrinsic_UnsafeGetReservedSlot(JSContext* cx, unsigned argc, Value* vp);
diff --git a/js/src/jsgc.cpp b/js/src/jsgc.cpp
index b33d152853db..57c2e356b2e8 100644
--- a/js/src/jsgc.cpp
+++ b/js/src/jsgc.cpp
@@ -3680,7 +3680,9 @@ class CompartmentCheckTracer : public JS::CallbackTracer
     void trace(void** thingp, JS::TraceKind kind) override;
 
   public:
-    explicit CompartmentCheckTracer(JSRuntime* rt) : JS::CallbackTracer(rt) {}
+    explicit CompartmentCheckTracer(JSRuntime* rt)
+      : JS::CallbackTracer(rt), src(nullptr), zone(nullptr), compartment(nullptr)
+    {}
 
     Cell* src;
     JS::TraceKind srcKind;
@@ -4056,6 +4058,25 @@ GCRuntime::markAllGrayReferences(gcstats::Phase phase)
 
 #ifdef DEBUG
 
+struct GCChunkHasher {
+    typedef gc::Chunk* Lookup;
+
+    /*
+     * Strip zeros for better distribution after multiplying by the golden
+     * ratio.
+     */
+    static HashNumber hash(gc::Chunk* chunk) {
+        MOZ_ASSERT(!(uintptr_t(chunk) & gc::ChunkMask));
+        return HashNumber(uintptr_t(chunk) >> gc::ChunkShift);
+    }
+
+    static bool match(gc::Chunk* k, gc::Chunk* l) {
+        MOZ_ASSERT(!(uintptr_t(k) & gc::ChunkMask));
+        MOZ_ASSERT(!(uintptr_t(l) & gc::ChunkMask));
+        return k == l;
+    }
+};
+
 class js::gc::MarkingValidator
 {
   public:
diff --git a/js/src/jsgc.h b/js/src/jsgc.h
index 6b65c48bee26..633ea403cf51 100644
--- a/js/src/jsgc.h
+++ b/js/src/jsgc.h
@@ -1100,27 +1100,6 @@ class GCParallelTask
     virtual void runFromHelperThread();
 };
 
-struct GCChunkHasher {
-    typedef gc::Chunk* Lookup;
-
-    /*
-     * Strip zeros for better distribution after multiplying by the golden
-     * ratio.
-     */
-    static HashNumber hash(gc::Chunk* chunk) {
-        MOZ_ASSERT(!(uintptr_t(chunk) & gc::ChunkMask));
-        return HashNumber(uintptr_t(chunk) >> gc::ChunkShift);
-    }
-
-    static bool match(gc::Chunk* k, gc::Chunk* l) {
-        MOZ_ASSERT(!(uintptr_t(k) & gc::ChunkMask));
-        MOZ_ASSERT(!(uintptr_t(l) & gc::ChunkMask));
-        return k == l;
-    }
-};
-
-typedef HashSet<js::gc::Chunk*, GCChunkHasher, SystemAllocPolicy> GCChunkSet;
-
 typedef void (*IterateChunkCallback)(JSRuntime* rt, void* data, gc::Chunk* chunk);
 typedef void (*IterateZoneCallback)(JSRuntime* rt, void* data, JS::Zone* zone);
 typedef void (*IterateArenaCallback)(JSRuntime* rt, void* data, gc::Arena* arena,
diff --git a/js/src/jsobj.cpp b/js/src/jsobj.cpp
index 6851b330dbe0..048c907c8c21 100644
--- a/js/src/jsobj.cpp
+++ b/js/src/jsobj.cpp
@@ -663,18 +663,15 @@ js::StandardDefineProperty(JSContext* cx, HandleObject obj, HandleId id,
     if (IsAnyTypedArray(obj))
         return DefinePropertyOnTypedArray(cx, obj, id, desc, result);
 
-    if (!MaybeConvertUnboxedObjectToNative(cx, obj))
-        return false;
-
-    if (obj->getOps()->lookupProperty) {
-        if (obj->is<ProxyObject>()) {
-            Rooted<PropertyDescriptor> pd(cx, desc);
-            pd.object().set(obj);
-            return Proxy::defineProperty(cx, obj, id, pd, result);
-        }
-        return result.fail(JSMSG_OBJECT_NOT_EXTENSIBLE);
+    if (obj->is<ProxyObject>()) {
+        Rooted<PropertyDescriptor> pd(cx, desc);
+        pd.object().set(obj);
+        return Proxy::defineProperty(cx, obj, id, pd, result);
     }
 
+    if (obj->getOps()->defineProperty)
+        return obj->getOps()->defineProperty(cx, obj, id, desc, result);
+
     return DefinePropertyOnObject(cx, obj.as<NativeObject>(), id, desc, result);
 }
 
diff --git a/js/src/jspubtd.h b/js/src/jspubtd.h
index 4127ae08084e..ceb7fbf1accc 100644
--- a/js/src/jspubtd.h
+++ b/js/src/jspubtd.h
@@ -163,9 +163,7 @@ struct Runtime
       , gcStoreBufferPtr_(nullptr)
     {}
 
-    bool needsIncrementalBarrier() const {
-        return heapState_ == JS::HeapState::Idle;
-    }
+    bool isHeapBusy() const { return heapState_ != JS::HeapState::Idle; }
 
     js::gc::StoreBuffer* gcStoreBufferPtr() { return gcStoreBufferPtr_; }
 
diff --git a/js/src/jsstr.cpp b/js/src/jsstr.cpp
index d9f2b81f4eea..dd3b7aa17570 100644
--- a/js/src/jsstr.cpp
+++ b/js/src/jsstr.cpp
@@ -3612,7 +3612,7 @@ class SplitMatchResult {
 } /* anonymous namespace */
 
 template<class Matcher>
-static ArrayObject*
+static JSObject*
 SplitHelper(JSContext* cx, HandleLinearString str, uint32_t limit, const Matcher& splitMatch,
             HandleObjectGroup group)
 {
@@ -3635,10 +3635,10 @@ SplitHelper(JSContext* cx, HandleLinearString str, uint32_t limit, const Matcher
          *   assertEq(b.length, 0);
          */
         if (!result.isFailure())
-            return NewDenseEmptyArray(cx);
+            return NewFullyAllocatedArrayTryUseGroup(cx, group, 0);
 
         RootedValue v(cx, StringValue(str));
-        return NewDenseCopiedArray(cx, 1, v.address());
+        return NewCopiedArrayTryUseGroup(cx, group, v.address(), 1);
     }
 
     /* Step 12. */
@@ -3696,7 +3696,7 @@ SplitHelper(JSContext* cx, HandleLinearString str, uint32_t limit, const Matcher
 
         /* Step 13(c)(iii)(4). */
         if (splits.length() == limit)
-            return NewDenseCopiedArray(cx, splits.length(), splits.begin());
+            return NewCopiedArrayTryUseGroup(cx, group, splits.begin(), splits.length());
 
         /* Step 13(c)(iii)(5). */
         lastEndIndex = endIndex;
@@ -3717,15 +3717,13 @@ SplitHelper(JSContext* cx, HandleLinearString str, uint32_t limit, const Matcher
                     if (!sub || !splits.append(StringValue(sub)))
                         return nullptr;
                 } else {
-                    /* Only string entries have been accounted for so far. */
-                    AddTypePropertyId(cx, group, nullptr, JSID_VOID, UndefinedValue());
                     if (!splits.append(UndefinedValue()))
                         return nullptr;
                 }
 
                 /* Step 13(c)(iii)(7)(d). */
                 if (splits.length() == limit)
-                    return NewDenseCopiedArray(cx, splits.length(), splits.begin());
+                    return NewCopiedArrayTryUseGroup(cx, group, splits.begin(), splits.length());
             }
         }
 
@@ -3739,12 +3737,12 @@ SplitHelper(JSContext* cx, HandleLinearString str, uint32_t limit, const Matcher
         return nullptr;
 
     /* Step 16. */
-    return NewDenseCopiedArray(cx, splits.length(), splits.begin());
+    return NewCopiedArrayTryUseGroup(cx, group, splits.begin(), splits.length());
 }
 
 // Fast-path for splitting a string into a character array via split("").
-static ArrayObject*
-CharSplitHelper(JSContext* cx, HandleLinearString str, uint32_t limit)
+static JSObject*
+CharSplitHelper(JSContext* cx, HandleLinearString str, uint32_t limit, HandleObjectGroup group)
 {
     size_t strLength = str->length();
     if (strLength == 0)
@@ -3764,7 +3762,7 @@ CharSplitHelper(JSContext* cx, HandleLinearString str, uint32_t limit)
         splits.infallibleAppend(StringValue(sub));
     }
 
-    return NewDenseCopiedArray(cx, splits.length(), splits.begin());
+    return NewCopiedArrayTryUseGroup(cx, group, splits.begin(), splits.length());
 }
 
 namespace {
@@ -3849,7 +3847,6 @@ js::str_split(JSContext* cx, unsigned argc, Value* vp)
     RootedObjectGroup group(cx, ObjectGroup::callingAllocationSiteGroup(cx, JSProto_Array));
     if (!group)
         return false;
-    AddTypePropertyId(cx, group, nullptr, JSID_VOID, TypeSet::StringType());
 
     /* Step 5: Use the second argument as the split limit, if given. */
     uint32_t limit;
@@ -3880,10 +3877,9 @@ js::str_split(JSContext* cx, unsigned argc, Value* vp)
 
     /* Step 9. */
     if (limit == 0) {
-        JSObject* aobj = NewDenseEmptyArray(cx);
+        JSObject* aobj = NewFullyAllocatedArrayTryUseGroup(cx, group, 0);
         if (!aobj)
             return false;
-        aobj->setGroup(group);
         args.rval().setObject(*aobj);
         return true;
     }
@@ -3891,10 +3887,9 @@ js::str_split(JSContext* cx, unsigned argc, Value* vp)
     /* Step 10. */
     if (!sepDefined) {
         RootedValue v(cx, StringValue(str));
-        JSObject* aobj = NewDenseCopiedArray(cx, 1, v.address());
+        JSObject* aobj = NewCopiedArrayTryUseGroup(cx, group, v.address(), 1);
         if (!aobj)
             return false;
-        aobj->setGroup(group);
         args.rval().setObject(*aobj);
         return true;
     }
@@ -3906,7 +3901,7 @@ js::str_split(JSContext* cx, unsigned argc, Value* vp)
     RootedObject aobj(cx);
     if (!re.initialized()) {
         if (sepstr->length() == 0) {
-            aobj = CharSplitHelper(cx, linearStr, limit);
+            aobj = CharSplitHelper(cx, linearStr, limit, group);
         } else {
             SplitStringMatcher matcher(cx, sepstr);
             aobj = SplitHelper(cx, linearStr, limit, matcher, group);
@@ -3922,7 +3917,6 @@ js::str_split(JSContext* cx, unsigned argc, Value* vp)
         return false;
 
     /* Step 16. */
-    aobj->setGroup(group);
     args.rval().setObject(*aobj);
     return true;
 }
@@ -3940,19 +3934,11 @@ js::str_split_string(JSContext* cx, HandleObjectGroup group, HandleString str, H
 
     uint32_t limit = UINT32_MAX;
 
-    RootedObject aobj(cx);
-    if (linearSep->length() == 0) {
-        aobj = CharSplitHelper(cx, linearStr, limit);
-    } else {
-        SplitStringMatcher matcher(cx, linearSep);
-        aobj = SplitHelper(cx, linearStr, limit, matcher, group);
-    }
+    if (linearSep->length() == 0)
+        return CharSplitHelper(cx, linearStr, limit, group);
 
-    if (!aobj)
-        return nullptr;
-
-    aobj->setGroup(group);
-    return aobj;
+    SplitStringMatcher matcher(cx, linearSep);
+    return SplitHelper(cx, linearStr, limit, matcher, group);
 }
 
 /*
diff --git a/js/src/jsutil.h b/js/src/jsutil.h
index d33f45ad2604..cc4fa9aa76a7 100644
--- a/js/src/jsutil.h
+++ b/js/src/jsutil.h
@@ -305,7 +305,7 @@ Poison(void* ptr, uint8_t value, size_t num)
         uintptr_t obj;
         memset(&obj, value, sizeof(obj));
 #if defined(JS_PUNBOX64)
-        obj >>= JSVAL_TAG_SHIFT;
+        obj = obj & ((uintptr_t(1) << JSVAL_TAG_SHIFT) - 1);
 #endif
         const jsval_layout layout = OBJECT_TO_JSVAL_IMPL((JSObject*)obj);
 
diff --git a/js/src/jsweakmap.cpp b/js/src/jsweakmap.cpp
index 19fbeac44c83..3b599ebcbbe6 100644
--- a/js/src/jsweakmap.cpp
+++ b/js/src/jsweakmap.cpp
@@ -348,7 +348,7 @@ WeakMapPostWriteBarrier(JSRuntime* rt, ObjectValueMap* weakMap, JSObject* key)
     // Strip the barriers from the type before inserting into the store buffer.
     // This will automatically ensure that barriers do not fire during GC.
     if (key && IsInsideNursery(key))
-        rt->gc.storeBuffer.putGeneric(UnbarrieredRef(weakMap, key));
+        rt->gc.storeBuffer.putGeneric(gc::HashKeyRef<ObjectValueMap, JSObject*>(weakMap, key));
 }
 
 static MOZ_ALWAYS_INLINE bool
diff --git a/js/src/jsweakmap.h b/js/src/jsweakmap.h
index 6777a6fcf586..074bf22a72de 100644
--- a/js/src/jsweakmap.h
+++ b/js/src/jsweakmap.h
@@ -258,13 +258,8 @@ class WeakMap : public HashMap<Key, Value, HashPolicy, RuntimeAllocPolicy>, publ
     }
 
     /* Rekey an entry when moved, ensuring we do not trigger barriers. */
-    void entryMoved(Enum& eArg, const Key& k) {
-        typedef typename HashMap<typename Unbarriered<Key>::type,
-                                 typename Unbarriered<Value>::type,
-                                 typename Unbarriered<HashPolicy>::type,
-                                 RuntimeAllocPolicy>::Enum UnbarrieredEnum;
-        UnbarrieredEnum& e = reinterpret_cast<UnbarrieredEnum&>(eArg);
-        e.rekeyFront(reinterpret_cast<const typename Unbarriered<Key>::type&>(k));
+    void entryMoved(Enum& e, const Key& k) {
+        e.rekeyFront(k);
     }
 
 protected:
@@ -280,28 +275,6 @@ protected:
     }
 };
 
-/*
- * At times, you will need to ignore barriers when accessing WeakMap entries.
- * Localize the templatized casting craziness here.
- */
-template <class Key, class Value>
-static inline gc::HashKeyRef<HashMap<Key, Value, DefaultHasher<Key>, RuntimeAllocPolicy>, Key>
-UnbarrieredRef(WeakMap<PreBarriered<Key>, RelocatablePtr<Value>>* map, Key key)
-{
-    /*
-     * Some compilers complain about instantiating the WeakMap class for
-     * unbarriered type arguments, so we cast to a HashMap instead. Because of
-     * WeakMap's multiple inheritance, we need to do this in two stages, first
-     * to the HashMap base class and then to the unbarriered version.
-     */
-
-    typedef typename WeakMap<PreBarriered<Key>, RelocatablePtr<Value>>::Base BaseMap;
-    auto baseMap = static_cast<BaseMap*>(map);
-    typedef HashMap<Key, Value, DefaultHasher<Key>, RuntimeAllocPolicy> UnbarrieredMap;
-    typedef gc::HashKeyRef<UnbarrieredMap, Key> UnbarrieredKeyRef;
-    return UnbarrieredKeyRef(reinterpret_cast<UnbarrieredMap*>(baseMap), key);
-}
-
 /* WeakMap methods exposed so they can be installed in the self-hosting global. */
 
 extern JSObject*
diff --git a/js/src/vm/HelperThreads.cpp b/js/src/vm/HelperThreads.cpp
index 6de84584a997..7974ca49d506 100644
--- a/js/src/vm/HelperThreads.cpp
+++ b/js/src/vm/HelperThreads.cpp
@@ -1017,7 +1017,7 @@ MFBT_API void NuwaMarkCurrentThread(void (*recreate)(void*), void* arg);
 void
 HelperThread::ThreadMain(void* arg)
 {
-    PR_SetCurrentThreadName("Analysis Helper");
+    PR_SetCurrentThreadName("JS Helper");
 
 #ifdef MOZ_NUWA_PROCESS
     if (IsNuwaProcess()) {
diff --git a/js/src/vm/ObjectGroup.cpp b/js/src/vm/ObjectGroup.cpp
index 3851768ca3a7..83f1ebd3fe5b 100644
--- a/js/src/vm/ObjectGroup.cpp
+++ b/js/src/vm/ObjectGroup.cpp
@@ -1174,7 +1174,10 @@ ObjectGroup::allocationSiteGroup(JSContext* cx, JSScript* script, jsbytecode* pc
         }
     }
 
-    if (JSOp(*pc) == JSOP_NEWARRAY && cx->runtime()->options().unboxedArrays()) {
+    if (kind == JSProto_Array &&
+        (JSOp(*pc) == JSOP_NEWARRAY || IsCallPC(pc)) &&
+        cx->runtime()->options().unboxedArrays())
+    {
         PreliminaryObjectArrayWithTemplate* preliminaryObjects =
             cx->new_<PreliminaryObjectArrayWithTemplate>(nullptr);
         if (preliminaryObjects)
diff --git a/js/src/vm/Runtime.h b/js/src/vm/Runtime.h
index 7a41638d5128..bed11c5f89e0 100644
--- a/js/src/vm/Runtime.h
+++ b/js/src/vm/Runtime.h
@@ -1003,7 +1003,6 @@ struct JSRuntime : public JS::shadow::Runtime,
     /* Garbage collector state has been sucessfully initialized. */
     bool                gcInitialized;
 
-    bool isHeapBusy() const { return heapState_ != JS::HeapState::Idle; }
     bool isHeapMajorCollecting() const { return heapState_ == JS::HeapState::MajorCollecting; }
     bool isHeapMinorCollecting() const { return heapState_ == JS::HeapState::MinorCollecting; }
     bool isHeapCollecting() const { return isHeapMinorCollecting() || isHeapMajorCollecting(); }
diff --git a/js/src/vm/SelfHosting.cpp b/js/src/vm/SelfHosting.cpp
index ba33d956db4d..2a9d5343669b 100644
--- a/js/src/vm/SelfHosting.cpp
+++ b/js/src/vm/SelfHosting.cpp
@@ -300,81 +300,11 @@ js::intrinsic_NewDenseArray(JSContext* cx, unsigned argc, Value* vp)
     uint32_t length = args[0].toInt32();
 
     // Make a new buffer and initialize it up to length.
-    RootedArrayObject buffer(cx, NewDenseFullyAllocatedArray(cx, length));
+    RootedObject buffer(cx, NewFullyAllocatedArrayForCallingAllocationSite(cx, length));
     if (!buffer)
         return false;
 
-    ObjectGroup* newgroup = ObjectGroup::callingAllocationSiteGroup(cx, JSProto_Array);
-    if (!newgroup)
-        return false;
-    buffer->setGroup(newgroup);
-
-    DenseElementResult edr = buffer->ensureDenseElements(cx, length, 0);
-    switch (edr) {
-      case DenseElementResult::Success:
-        args.rval().setObject(*buffer);
-        return true;
-
-      case DenseElementResult::Incomplete: // shouldn't happen!
-        MOZ_ASSERT(!"%EnsureDenseArrayElements() would yield sparse array");
-        JS_ReportError(cx, "%EnsureDenseArrayElements() would yield sparse array");
-        break;
-
-      case DenseElementResult::Failure:
-        break;
-    }
-    return false;
-}
-
-/*
- * UnsafePutElements(arr0, idx0, elem0, ..., arrN, idxN, elemN): For each set of
- * (arr, idx, elem) arguments that are passed, performs the assignment
- * |arr[idx] = elem|. |arr| must be either a dense array or a typed array.
- *
- * If |arr| is a dense array, the index must be an int32 less than the
- * initialized length of |arr|. Use |%EnsureDenseResultArrayElements|
- * to ensure that the initialized length is long enough.
- *
- * If |arr| is a typed array, the index must be an int32 less than the
- * length of |arr|.
- */
-bool
-js::intrinsic_UnsafePutElements(JSContext* cx, unsigned argc, Value* vp)
-{
-    CallArgs args = CallArgsFromVp(argc, vp);
-
-    if ((args.length() % 3) != 0) {
-        JS_ReportError(cx, "Incorrect number of arguments, not divisible by 3");
-        return false;
-    }
-
-    for (uint32_t base = 0; base < args.length(); base += 3) {
-        uint32_t arri = base;
-        uint32_t idxi = base+1;
-        uint32_t elemi = base+2;
-
-        MOZ_ASSERT(args[arri].isObject());
-        MOZ_ASSERT(args[arri].toObject().isNative() || IsTypedObjectArray(args[arri].toObject()));
-        MOZ_ASSERT(args[idxi].isInt32());
-
-        RootedObject arrobj(cx, &args[arri].toObject());
-        uint32_t idx = args[idxi].toInt32();
-
-        if (IsAnyTypedArray(arrobj.get()) || arrobj->is<TypedObject>()) {
-            MOZ_ASSERT_IF(IsAnyTypedArray(arrobj.get()), idx < AnyTypedArrayLength(arrobj.get()));
-            MOZ_ASSERT_IF(arrobj->is<TypedObject>(), idx < uint32_t(arrobj->as<TypedObject>().length()));
-            // XXX: Always non-strict.
-            ObjectOpResult ignored;
-            RootedValue receiver(cx, ObjectValue(*arrobj));
-            if (!SetElement(cx, arrobj, idx, args[elemi], receiver, ignored))
-                return false;
-        } else {
-            MOZ_ASSERT(idx < arrobj->as<ArrayObject>().getDenseInitializedLength());
-            arrobj->as<ArrayObject>().setDenseElementWithType(cx, idx, args[elemi]);
-        }
-    }
-
-    args.rval().setUndefined();
+    args.rval().setObject(*buffer);
     return true;
 }
 
@@ -383,38 +313,47 @@ js::intrinsic_DefineDataProperty(JSContext* cx, unsigned argc, Value* vp)
 {
     CallArgs args = CallArgsFromVp(argc, vp);
 
-    MOZ_ASSERT(args.length() == 4);
+    MOZ_ASSERT(args.length() >= 3);
     MOZ_ASSERT(args[0].isObject());
-    MOZ_ASSERT(args[3].isInt32());
 
     RootedObject obj(cx, &args[0].toObject());
     RootedId id(cx);
     if (!ValueToId<CanGC>(cx, args[1], &id))
         return false;
     RootedValue value(cx, args[2]);
-    unsigned attributes = args[3].toInt32();
+
+    unsigned attrs = 0;
+    if (args.length() >= 4) {
+        unsigned attributes = args[3].toInt32();
+
+        MOZ_ASSERT(bool(attributes & ATTR_ENUMERABLE) != bool(attributes & ATTR_NONENUMERABLE),
+                   "_DefineDataProperty must receive either ATTR_ENUMERABLE xor ATTR_NONENUMERABLE");
+        if (attributes & ATTR_ENUMERABLE)
+            attrs |= JSPROP_ENUMERATE;
+
+        MOZ_ASSERT(bool(attributes & ATTR_CONFIGURABLE) != bool(attributes & ATTR_NONCONFIGURABLE),
+                   "_DefineDataProperty must receive either ATTR_CONFIGURABLE xor "
+                   "ATTR_NONCONFIGURABLE");
+        if (attributes & ATTR_NONCONFIGURABLE)
+            attrs |= JSPROP_PERMANENT;
+
+        MOZ_ASSERT(bool(attributes & ATTR_WRITABLE) != bool(attributes & ATTR_NONWRITABLE),
+                   "_DefineDataProperty must receive either ATTR_WRITABLE xor ATTR_NONWRITABLE");
+        if (attributes & ATTR_NONWRITABLE)
+            attrs |= JSPROP_READONLY;
+    } else {
+        // If the fourth argument is unspecified, the attributes are for a
+        // plain data property.
+        attrs = JSPROP_ENUMERATE;
+    }
 
     Rooted<PropertyDescriptor> desc(cx);
-    unsigned attrs = 0;
-
-    MOZ_ASSERT(bool(attributes & ATTR_ENUMERABLE) != bool(attributes & ATTR_NONENUMERABLE),
-               "_DefineDataProperty must receive either ATTR_ENUMERABLE xor ATTR_NONENUMERABLE");
-    if (attributes & ATTR_ENUMERABLE)
-        attrs |= JSPROP_ENUMERATE;
-
-    MOZ_ASSERT(bool(attributes & ATTR_CONFIGURABLE) != bool(attributes & ATTR_NONCONFIGURABLE),
-               "_DefineDataProperty must receive either ATTR_CONFIGURABLE xor "
-               "ATTR_NONCONFIGURABLE");
-    if (attributes & ATTR_NONCONFIGURABLE)
-        attrs |= JSPROP_PERMANENT;
-
-    MOZ_ASSERT(bool(attributes & ATTR_WRITABLE) != bool(attributes & ATTR_NONWRITABLE),
-               "_DefineDataProperty must receive either ATTR_WRITABLE xor ATTR_NONWRITABLE");
-    if (attributes & ATTR_NONWRITABLE)
-        attrs |= JSPROP_READONLY;
-
     desc.setDataDescriptor(value, attrs);
-    return StandardDefineProperty(cx, obj, id, desc);
+    if (!StandardDefineProperty(cx, obj, id, desc))
+        return false;
+
+    args.rval().setUndefined();
+    return true;
 }
 
 bool
@@ -1374,7 +1313,6 @@ static const JSFunctionSpec intrinsic_functions[] = {
     JS_FN("RuntimeDefaultLocale",    intrinsic_RuntimeDefaultLocale,    0,0),
     JS_FN("SubstringKernel",         intrinsic_SubstringKernel,         3,0),
 
-    JS_FN("UnsafePutElements",       intrinsic_UnsafePutElements,       3,0),
     JS_FN("_DefineDataProperty",     intrinsic_DefineDataProperty,      4,0),
     JS_FN("UnsafeSetReservedSlot",   intrinsic_UnsafeSetReservedSlot,   3,0),
     JS_FN("UnsafeGetReservedSlot",   intrinsic_UnsafeGetReservedSlot,   2,0),
diff --git a/js/src/vm/TypeInference.cpp b/js/src/vm/TypeInference.cpp
index 2ce89872c58c..83bb75df5ef4 100644
--- a/js/src/vm/TypeInference.cpp
+++ b/js/src/vm/TypeInference.cpp
@@ -3366,7 +3366,7 @@ PreliminaryObjectArrayWithTemplate::writeBarrierPre(PreliminaryObjectArrayWithTe
 {
     Shape* shape = objects->shape();
 
-    if (!shape || !shape->runtimeFromAnyThread()->needsIncrementalBarrier())
+    if (!shape || shape->runtimeFromAnyThread()->isHeapBusy())
         return;
 
     JS::Zone* zone = shape->zoneFromAnyThread();
@@ -3918,7 +3918,7 @@ TypeNewScript::trace(JSTracer* trc)
 /* static */ void
 TypeNewScript::writeBarrierPre(TypeNewScript* newScript)
 {
-    if (!newScript->function()->runtimeFromAnyThread()->needsIncrementalBarrier())
+    if (newScript->function()->runtimeFromAnyThread()->isHeapBusy())
         return;
 
     JS::Zone* zone = newScript->function()->zoneFromAnyThread();
diff --git a/js/src/vm/UnboxedObject-inl.h b/js/src/vm/UnboxedObject-inl.h
index 7fdf616ae98b..84727dae6e33 100644
--- a/js/src/vm/UnboxedObject-inl.h
+++ b/js/src/vm/UnboxedObject-inl.h
@@ -320,10 +320,28 @@ SetAnyBoxedOrUnboxedArrayLength(JSContext* cx, JSObject* obj, size_t length)
     }
 }
 
+static inline bool
+SetAnyBoxedOrUnboxedDenseElement(JSContext* cx, JSObject* obj, size_t index, const Value& value)
+{
+    if (obj->isNative()) {
+        obj->as<NativeObject>().setDenseElementWithType(cx, index, value);
+        return true;
+    }
+    return obj->as<UnboxedArrayObject>().setElement(cx, index, value);
+}
+
 /////////////////////////////////////////////////////////////////////
 // Template methods for NativeObject and UnboxedArrayObject accesses.
 /////////////////////////////////////////////////////////////////////
 
+static inline JSValueType
+GetBoxedOrUnboxedType(JSObject* obj)
+{
+    if (obj->isNative())
+        return JSVAL_TYPE_MAGIC;
+    return obj->as<UnboxedArrayObject>().elementType();
+}
+
 template <JSValueType Type>
 static inline bool
 HasBoxedOrUnboxedDenseElements(JSObject* obj)
@@ -387,6 +405,17 @@ SetBoxedOrUnboxedDenseElementNoTypeChange(JSObject* obj, size_t index, const Val
         obj->as<UnboxedArrayObject>().setElementNoTypeChangeSpecific<Type>(index, value);
 }
 
+template <JSValueType Type>
+static inline bool
+SetBoxedOrUnboxedDenseElement(JSContext* cx, JSObject* obj, size_t index, const Value& value)
+{
+    if (Type == JSVAL_TYPE_MAGIC) {
+        obj->as<NativeObject>().setDenseElementWithType(cx, index, value);
+        return true;
+    }
+    return obj->as<UnboxedArrayObject>().setElementSpecific<Type>(cx, index, value);
+}
+
 template <JSValueType Type>
 static inline bool
 EnsureBoxedOrUnboxedDenseElements(JSContext* cx, JSObject* obj, size_t count)
@@ -666,6 +695,9 @@ CopyAnyBoxedOrUnboxedDenseElements(JSContext* cx, JSObject* dst, JSObject* src,
 void
 SetAnyBoxedOrUnboxedInitializedLength(JSContext* cx, JSObject* obj, size_t initlen);
 
+bool
+EnsureAnyBoxedOrUnboxedDenseElements(JSContext* cx, JSObject* obj, size_t count);
+
 } // namespace js
 
 #endif // vm_UnboxedObject_inl_h
diff --git a/js/src/vm/UnboxedObject.cpp b/js/src/vm/UnboxedObject.cpp
index aa5540e18674..3e08f3c63c21 100644
--- a/js/src/vm/UnboxedObject.cpp
+++ b/js/src/vm/UnboxedObject.cpp
@@ -416,6 +416,8 @@ UnboxedLayout::makeNativeGroup(JSContext* cx, ObjectGroup* group)
 
     RootedObjectGroup replacementGroup(cx);
 
+    const Class* clasp = layout.isArray() ? &ArrayObject::class_ : &PlainObject::class_;
+
     // Immediately clear any new script on the group. This is done by replacing
     // the existing new script with one for a replacement default new group.
     // This is done so that the size of the replacment group's objects is the
@@ -447,33 +449,33 @@ UnboxedLayout::makeNativeGroup(JSContext* cx, ObjectGroup* group)
     // Similarly, if this group is keyed to an allocation site, replace its
     // entry with a new group that has no unboxed layout.
     if (layout.allocationScript()) {
-        MOZ_ASSERT(!layout.isArray());
-
         RootedScript script(cx, layout.allocationScript());
         jsbytecode* pc = layout.allocationPc();
 
-        replacementGroup = ObjectGroupCompartment::makeGroup(cx, &PlainObject::class_, proto);
+        replacementGroup = ObjectGroupCompartment::makeGroup(cx, clasp, proto);
         if (!replacementGroup)
             return false;
 
         PlainObject* templateObject = &script->getObject(pc)->as<PlainObject>();
         replacementGroup->addDefiniteProperties(cx, templateObject->lastProperty());
 
-        cx->compartment()->objectGroups.replaceAllocationSiteGroup(script, pc,
-                                                                   JSProto_Object,
+        JSProtoKey key = layout.isArray() ? JSProto_Array : JSProto_Object;
+        cx->compartment()->objectGroups.replaceAllocationSiteGroup(script, pc, key,
                                                                    replacementGroup);
 
-        // Clear any baseline information at this opcode.
+        // Clear any baseline information at this opcode which might use the old group.
         if (script->hasBaselineScript()) {
             jit::ICEntry& entry = script->baselineScript()->icEntryFromPCOffset(script->pcToOffset(pc));
             jit::ICFallbackStub* fallback = entry.fallbackStub();
             for (jit::ICStubIterator iter = fallback->beginChain(); !iter.atEnd(); iter++)
                 iter.unlink(cx);
-            fallback->toNewObject_Fallback()->setTemplateObject(nullptr);
+            if (fallback->isNewObject_Fallback())
+                fallback->toNewObject_Fallback()->setTemplateObject(nullptr);
+            else if (fallback->isNewArray_Fallback())
+                fallback->toNewArray_Fallback()->setTemplateGroup(replacementGroup);
         }
     }
 
-    const Class* clasp = layout.isArray() ? &ArrayObject::class_ : &PlainObject::class_;
     size_t nfixed = layout.isArray() ? 0 : gc::GetGCKindSlots(layout.getAllocKind());
 
     if (layout.isArray()) {
@@ -734,7 +736,7 @@ UnboxedPlainObject::obj_defineProperty(JSContext* cx, HandleObject obj, HandleId
         if (!desc.getter() && !desc.setter() && desc.attributes() == JSPROP_ENUMERATE) {
             // This define is equivalent to setting an existing property.
             if (obj->as<UnboxedPlainObject>().setValue(cx, *property, desc.value()))
-                return true;
+                return result.succeed();
         }
 
         // Trying to incompatibly redefine an existing property requires the
@@ -742,8 +744,7 @@ UnboxedPlainObject::obj_defineProperty(JSContext* cx, HandleObject obj, HandleId
         if (!convertToNative(cx, obj))
             return false;
 
-        return DefineProperty(cx, obj, id, desc, result) &&
-               result.checkStrict(cx, obj, id);
+        return DefineProperty(cx, obj, id, desc, result);
     }
 
     // Define the property on the expando object.
@@ -1001,13 +1002,14 @@ UnboxedArrayObject::convertToNative(JSContext* cx, JSObject* obj)
 
 /* static */ UnboxedArrayObject*
 UnboxedArrayObject::create(ExclusiveContext* cx, HandleObjectGroup group, uint32_t length,
-                           NewObjectKind newKind)
+                           NewObjectKind newKind, uint32_t maxLength)
 {
     MOZ_ASSERT(length <= MaximumCapacity);
 
     MOZ_ASSERT(group->clasp() == &class_);
     uint32_t elementSize = UnboxedTypeSize(group->unboxedLayout().elementType());
-    uint32_t nbytes = offsetOfInlineElements() + elementSize * length;
+    uint32_t capacity = Min(length, maxLength);
+    uint32_t nbytes = offsetOfInlineElements() + elementSize * capacity;
 
     UnboxedArrayObject* res;
     if (nbytes <= JSObject::MAX_BYTE_SIZE) {
@@ -1015,7 +1017,7 @@ UnboxedArrayObject::create(ExclusiveContext* cx, HandleObjectGroup group, uint32
 
         // If there was no provided length information, pick an allocation kind
         // to accommodate small arrays (as is done for normal native arrays).
-        if (length == 0)
+        if (capacity == 0)
             allocKind = gc::AllocKind::OBJECT8;
 
         res = NewObjectWithGroup<UnboxedArrayObject>(cx, group, allocKind, newKind);
@@ -1023,14 +1025,20 @@ UnboxedArrayObject::create(ExclusiveContext* cx, HandleObjectGroup group, uint32
             return nullptr;
         res->setInlineElements();
 
-        size_t capacity = (GetGCKindBytes(allocKind) - offsetOfInlineElements()) / elementSize;
-        res->setCapacityIndex(exactCapacityIndex(capacity));
+        size_t actualCapacity = (GetGCKindBytes(allocKind) - offsetOfInlineElements()) / elementSize;
+        MOZ_ASSERT(actualCapacity >= capacity);
+        res->setCapacityIndex(exactCapacityIndex(actualCapacity));
     } else {
         res = NewObjectWithGroup<UnboxedArrayObject>(cx, group, gc::AllocKind::OBJECT0, newKind);
         if (!res)
             return nullptr;
 
-        res->elements_ = AllocateObjectBuffer<uint8_t>(cx, res, length * elementSize);
+        uint32_t capacityIndex = (capacity == length)
+                                 ? CapacityMatchesLengthIndex
+                                 : chooseCapacityIndex(capacity, length);
+        uint32_t actualCapacity = computeCapacity(capacityIndex, length);
+
+        res->elements_ = AllocateObjectBuffer<uint8_t>(cx, res, actualCapacity * elementSize);
         if (!res->elements_) {
             // Make the object safe for GC.
             res->setInlineElements();
@@ -1038,7 +1046,7 @@ UnboxedArrayObject::create(ExclusiveContext* cx, HandleObjectGroup group, uint32
             return nullptr;
         }
 
-        res->setCapacityIndex(CapacityMatchesLengthIndex);
+        res->setCapacityIndex(capacityIndex);
     }
 
     res->setLength(cx, length);
diff --git a/js/src/vm/UnboxedObject.h b/js/src/vm/UnboxedObject.h
index 55f3909b1f9e..0060a662994d 100644
--- a/js/src/vm/UnboxedObject.h
+++ b/js/src/vm/UnboxedObject.h
@@ -416,7 +416,8 @@ class UnboxedArrayObject : public JSObject
 
     static bool convertToNative(JSContext* cx, JSObject* obj);
     static UnboxedArrayObject* create(ExclusiveContext* cx, HandleObjectGroup group,
-                                      uint32_t length, NewObjectKind newKind);
+                                      uint32_t length, NewObjectKind newKind,
+                                      uint32_t maxLength = MaximumCapacity);
 
     void fillAfterConvert(ExclusiveContext* cx,
                           const AutoValueVector& values, size_t* valueCursor);
diff --git a/js/xpconnect/src/XPCJSRuntime.cpp b/js/xpconnect/src/XPCJSRuntime.cpp
index 0bb73af1ad42..1785c47cf12b 100644
--- a/js/xpconnect/src/XPCJSRuntime.cpp
+++ b/js/xpconnect/src/XPCJSRuntime.cpp
@@ -1592,6 +1592,8 @@ ReloadPrefsCallback(const char* pref, void* data)
 
     sDiscardSystemSource = Preferences::GetBool(JS_OPTIONS_DOT_STR "discardSystemSource");
 
+    bool useAsyncStack = Preferences::GetBool(JS_OPTIONS_DOT_STR "asyncstack");
+
     bool werror = Preferences::GetBool(JS_OPTIONS_DOT_STR "werror");
 
     bool extraWarnings = Preferences::GetBool(JS_OPTIONS_DOT_STR "strict");
@@ -1603,6 +1605,7 @@ ReloadPrefsCallback(const char* pref, void* data)
                              .setIon(useIon)
                              .setAsmJS(useAsmJS)
                              .setNativeRegExp(useNativeRegExp)
+                             .setAsyncStack(useAsyncStack)
                              .setWerror(werror)
                              .setExtraWarnings(extraWarnings);
 
diff --git a/js/xpconnect/tests/unit/test_callFunctionWithAsyncStack.js b/js/xpconnect/tests/unit/test_callFunctionWithAsyncStack.js
index 806916c2783d..8423ec3ba20a 100644
--- a/js/xpconnect/tests/unit/test_callFunctionWithAsyncStack.js
+++ b/js/xpconnect/tests/unit/test_callFunctionWithAsyncStack.js
@@ -1,4 +1,11 @@
+Components.utils.import("resource://gre/modules/Services.jsm");
+
 function run_test() {
+  if (!Services.prefs.getBoolPref("javascript.options.asyncstack")) {
+    do_print("Async stacks are disabled.");
+    return;
+  }
+
   function getAsyncStack() {
     return Components.stack;
   }
diff --git a/layout/base/PositionedEventTargeting.cpp b/layout/base/PositionedEventTargeting.cpp
index 409f0f907378..32ee30775c06 100644
--- a/layout/base/PositionedEventTargeting.cpp
+++ b/layout/base/PositionedEventTargeting.cpp
@@ -417,7 +417,8 @@ IsElementClickableAndReadable(nsIFrame* aFrame, WidgetGUIEvent* aEvent, const Ev
   nsLayoutUtils::GetFontMetricsForFrame(aFrame, getter_AddRefs(fm),
     nsLayoutUtils::FontSizeInflationFor(aFrame));
   if (fm) {
-    if ((pc->AppUnitsToGfxUnits(fm->EmHeight()) * cumulativeResolution) < limitReadableSize) {
+    if ((fm->EmHeight() > 0) && // See bug 1171731
+        (pc->AppUnitsToGfxUnits(fm->EmHeight()) * cumulativeResolution) < limitReadableSize) {
       return false;
     }
   }
diff --git a/layout/base/UnitTransforms.h b/layout/base/UnitTransforms.h
index 63f78c4463fb..37485510530f 100644
--- a/layout/base/UnitTransforms.h
+++ b/layout/base/UnitTransforms.h
@@ -37,10 +37,7 @@ enum class PixelCastJustification : uint8_t {
   // technically in screen pixels, as it has not yet accounted for any
   // asynchronous transforms. This justification is for viewing the initial
   // reference point as a screen point.
-  LayoutDeviceToScreenForUntransformedEvent,
-  // Similar to LayoutDeviceToScreenForUntransformedEvent, PBrowser handles
-  // some widget/tab dimension information as the OS does -- in screen units.
-  LayoutDeviceIsScreenForTabDims
+  LayoutDeviceToScreenForUntransformedEvent
 };
 
 template <class TargetUnits, class SourceUnits>
diff --git a/layout/base/nsPresContext.cpp b/layout/base/nsPresContext.cpp
index d1f42fa799e3..ca100444300d 100644
--- a/layout/base/nsPresContext.cpp
+++ b/layout/base/nsPresContext.cpp
@@ -1798,15 +1798,6 @@ nsPresContext::UIResolutionChanged()
   }
 }
 
-void
-nsPresContext::UIResolutionChangedSync()
-{
-  if (!mPendingUIResolutionChanged) {
-    mPendingUIResolutionChanged = true;
-    UIResolutionChangedInternal();
-  }
-}
-
 /*static*/ bool
 nsPresContext::UIResolutionChangedSubdocumentCallback(nsIDocument* aDocument,
                                                       void* aData)
@@ -1822,24 +1813,9 @@ nsPresContext::UIResolutionChangedSubdocumentCallback(nsIDocument* aDocument,
 }
 
 static void
-NotifyTabUIResolutionChanged(TabParent* aTab, void *aArg)
+NotifyUIResolutionChanged(TabParent* aTabParent, void* aArg)
 {
-  aTab->UIResolutionChanged();
-}
-
-static void
-NotifyChildrenUIResolutionChanged(nsIDOMWindow* aWindow)
-{
-  nsCOMPtr<nsPIDOMWindow> piWin = do_QueryInterface(aWindow);
-  if (!piWin) {
-    return;
-  }
-  nsCOMPtr<nsIDocument> doc = piWin->GetExtantDoc();
-  nsRefPtr<nsPIWindowRoot> topLevelWin = nsContentUtils::GetWindowRoot(doc);
-  if (!topLevelWin) {
-    return;
-  }
-  topLevelWin->EnumerateBrowsers(NotifyTabUIResolutionChanged, nullptr);
+  aTabParent->UIResolutionChanged();
 }
 
 void
@@ -1852,8 +1828,10 @@ nsPresContext::UIResolutionChangedInternal()
     AppUnitsPerDevPixelChanged();
   }
 
-  // Recursively notify all remote leaf descendants of the change.
-  NotifyChildrenUIResolutionChanged(mDocument->GetWindow());
+  // Recursively notify all remote leaf descendants that the
+  // resolution of the user interface has changed.
+  nsContentUtils::CallOnAllRemoteChildren(mDocument->GetWindow(),
+                                          NotifyUIResolutionChanged, nullptr);
 
   mDocument->EnumerateSubDocuments(UIResolutionChangedSubdocumentCallback,
                                    nullptr);
diff --git a/layout/base/nsPresContext.h b/layout/base/nsPresContext.h
index a3ede02d9eff..e072c96e9ab3 100644
--- a/layout/base/nsPresContext.h
+++ b/layout/base/nsPresContext.h
@@ -791,15 +791,9 @@ public:
    * Notify the pres context that the resolution of the user interface has
    * changed. This happens if a window is moved between HiDPI and non-HiDPI
    * displays, so that the ratio of points to device pixels changes.
-   * The notification happens asynchronously.
    */
   void UIResolutionChanged();
 
- /*
-  * Like UIResolutionChanged() but invalidates values immediately.
-  */
-  void UIResolutionChangedSync();
-
   /*
    * Notify the pres context that a system color has changed
    */
diff --git a/layout/generic/nsSubDocumentFrame.cpp b/layout/generic/nsSubDocumentFrame.cpp
index f23487314043..b392577fd846 100644
--- a/layout/generic/nsSubDocumentFrame.cpp
+++ b/layout/generic/nsSubDocumentFrame.cpp
@@ -345,7 +345,7 @@ nsSubDocumentFrame::BuildDisplayList(nsDisplayListBuilder*   aBuilder,
   nsFrameLoader* frameLoader = FrameLoader();
   RenderFrameParent* rfp = nullptr;
   if (frameLoader) {
-    rfp = frameLoader->GetCurrentRemoteFrame();
+    rfp = frameLoader->GetCurrentRenderFrame();
   }
 
   // If we are pointer-events:none then we don't need to HitTest background
diff --git a/layout/ipc/RenderFrameParent.cpp b/layout/ipc/RenderFrameParent.cpp
index acc6ecd89264..4e47526d3e49 100644
--- a/layout/ipc/RenderFrameParent.cpp
+++ b/layout/ipc/RenderFrameParent.cpp
@@ -338,8 +338,6 @@ RenderFrameParent::RenderFrameParent(nsFrameLoader* aFrameLoader,
     mLayersId = *aId;
     CompositorChild::Get()->SendNotifyChildCreated(mLayersId);
   }
-  // Set a default RenderFrameParent
-  mFrameLoader->SetCurrentRemoteFrame(this);
   *aSuccess = true;
 }
 
@@ -454,15 +452,6 @@ RenderFrameParent::ActorDestroy(ActorDestroyReason why)
     }
   }
 
-  if (mFrameLoader && mFrameLoader->GetCurrentRemoteFrame() == this) {
-    // XXX this might cause some weird issues ... we'll just not
-    // redraw the part of the window covered by this until the "next"
-    // remote frame has a layer-tree transaction.  For
-    // why==NormalShutdown, we'll definitely want to do something
-    // better, especially as nothing guarantees another Update() from
-    // the "next" remote layer tree.
-    mFrameLoader->SetCurrentRemoteFrame(nullptr);
-  }
   mFrameLoader = nullptr;
 }
 
@@ -490,8 +479,6 @@ RenderFrameParent::RecvUpdateHitRegion(const nsRegion& aRegion)
 void
 RenderFrameParent::TriggerRepaint()
 {
-  mFrameLoader->SetCurrentRemoteFrame(this);
-
   nsIFrame* docFrame = mFrameLoader->GetPrimaryFrameOfOwningContent();
   if (!docFrame) {
     // Bad, but nothing we can do about it (XXX/cjones: or is there?
diff --git a/layout/style/test/test_media_queries.html b/layout/style/test/test_media_queries.html
index 47696bc8f68f..b28fbd2253c1 100644
--- a/layout/style/test/test_media_queries.html
+++ b/layout/style/test/test_media_queries.html
@@ -12,7 +12,7 @@ https://bugzilla.mozilla.org/show_bug.cgi?id=156716
 <a target="_blank" href="https://bugzilla.mozilla.org/show_bug.cgi?id=156716">Mozilla Bug 156716</a>
 <iframe id="subdoc" src="media_queries_iframe.html"></iframe>
 <div id="content" style="display: none">
-  
+
 </div>
 <pre id="test">
 <script class="testbody" type="application/javascript">
@@ -535,8 +535,8 @@ function run() {
     should_not_apply("(resolution: " + (resolution - 1) + "dpi)");
     dpi_high = resolution + 1;
   } else {
-	// We have no way to test resolution applying since it need not be
-	// an integer.
+    // We have no way to test resolution applying since it need not be
+    // an integer.
     should_not_apply("(resolution: " + resolution + "dpi)");
     should_not_apply("(resolution: " + (resolution - 1) + "dpi)");
     dpi_high = resolution;
@@ -696,6 +696,7 @@ function run() {
   expression_should_be_parseable("-moz-os-version: windows-vista");
   expression_should_be_parseable("-moz-os-version: windows-win7");
   expression_should_be_parseable("-moz-os-version: windows-win8");
+  expression_should_be_parseable("-moz-os-version: windows-win10");
   expression_should_not_be_parseable("-moz-os-version: ");
 
   // OpenType SVG media features
diff --git a/media/libstagefright/binding/Box.cpp b/media/libstagefright/binding/Box.cpp
index 71c79ed739f4..e73fc0a6cdad 100644
--- a/media/libstagefright/binding/Box.cpp
+++ b/media/libstagefright/binding/Box.cpp
@@ -71,13 +71,17 @@ Box::Box(BoxContext* aContext, uint64_t aOffset, const Box* aParent)
                                   headerRange.mEnd + sizeof(bigLength));
     if ((mParent && !mParent->mRange.Contains(bigLengthRange)) ||
         !byteRange->Contains(bigLengthRange) ||
-        !mContext->mSource->CachedReadAt(aOffset, bigLength,
+        !mContext->mSource->CachedReadAt(aOffset + 8, bigLength,
                                          sizeof(bigLength), &bytes) ||
         bytes != sizeof(bigLength)) {
       return;
     }
     size = BigEndian::readUint64(bigLength);
     mBodyOffset = bigLengthRange.mEnd;
+  } else if (size == 0) {
+    // box extends to end of file.
+    size = mContext->mByteRanges.LastElement().mEnd - aOffset;
+    mBodyOffset = headerRange.mEnd;
   } else {
     mBodyOffset = headerRange.mEnd;
   }
diff --git a/media/libstagefright/binding/Index.cpp b/media/libstagefright/binding/Index.cpp
index cb66baec61ca..e111dc287ea9 100644
--- a/media/libstagefright/binding/Index.cpp
+++ b/media/libstagefright/binding/Index.cpp
@@ -244,6 +244,10 @@ Index::Index(const nsTArray<Indice>& aIndex,
   if (aIndex.IsEmpty()) {
     mMoofParser = new MoofParser(aSource, aTrackId, aIsAudio, aMonitor);
   } else {
+    if (!mIndex.SetCapacity(aIndex.Length())) {
+      // OOM.
+      return;
+    }
     for (size_t i = 0; i < aIndex.Length(); i++) {
       const Indice& indice = aIndex[i];
       Sample sample;
@@ -252,7 +256,7 @@ Index::Index(const nsTArray<Indice>& aIndex,
       sample.mCompositionRange = Interval<Microseconds>(indice.start_composition,
                                                         indice.end_composition);
       sample.mSync = indice.sync;
-      mIndex.AppendElement(sample);
+      MOZ_ALWAYS_TRUE(mIndex.AppendElement(sample));
     }
   }
 }
@@ -272,7 +276,7 @@ Index::UpdateMoofIndex(const nsTArray<MediaByteRange>& aByteRanges)
 Microseconds
 Index::GetEndCompositionIfBuffered(const nsTArray<MediaByteRange>& aByteRanges)
 {
-  nsTArray<Sample>* index;
+  FallibleTArray<Sample>* index;
   if (mMoofParser) {
     if (!mMoofParser->ReachedEnd() || mMoofParser->Moofs().IsEmpty()) {
       return 0;
@@ -305,7 +309,7 @@ Index::ConvertByteRangesToTimeRanges(
   RangeFinder rangeFinder(aByteRanges);
   nsTArray<Interval<Microseconds>> timeRanges;
 
-  nsTArray<nsTArray<Sample>*> indexes;
+  nsTArray<FallibleTArray<Sample>*> indexes;
   if (mMoofParser) {
     // We take the index out of the moof parser and move it into a local
     // variable so we don't get concurrency issues. It gets freed when we
@@ -328,7 +332,7 @@ Index::ConvertByteRangesToTimeRanges(
 
   bool hasSync = false;
   for (size_t i = 0; i < indexes.Length(); i++) {
-    nsTArray<Sample>* index = indexes[i];
+    FallibleTArray<Sample>* index = indexes[i];
     for (size_t j = 0; j < index->Length(); j++) {
       const Sample& sample = (*index)[j];
       if (!rangeFinder.Contains(sample.mByteRange)) {
diff --git a/media/libstagefright/binding/MP4Metadata.cpp b/media/libstagefright/binding/MP4Metadata.cpp
index f14ea8792f42..db5167cb5a3b 100644
--- a/media/libstagefright/binding/MP4Metadata.cpp
+++ b/media/libstagefright/binding/MP4Metadata.cpp
@@ -66,20 +66,25 @@ private:
   nsRefPtr<Stream> mSource;
 };
 
-static inline void
-ConvertIndex(nsTArray<Index::Indice>& aDest,
-             const stagefright::Vector<stagefright::MediaSource::Indice>& aIndex)
+static inline bool
+ConvertIndex(FallibleTArray<Index::Indice>& aDest,
+             const stagefright::Vector<stagefright::MediaSource::Indice>& aIndex,
+             int64_t aMediaTime)
 {
+  if (!aDest.SetCapacity(aIndex.size())) {
+    return false;
+  }
   for (size_t i = 0; i < aIndex.size(); i++) {
     Index::Indice indice;
     const stagefright::MediaSource::Indice& s_indice = aIndex[i];
     indice.start_offset = s_indice.start_offset;
     indice.end_offset = s_indice.end_offset;
-    indice.start_composition = s_indice.start_composition;
-    indice.end_composition = s_indice.end_composition;
+    indice.start_composition = s_indice.start_composition - aMediaTime;
+    indice.end_composition = s_indice.end_composition - aMediaTime;
     indice.sync = s_indice.sync;
-    aDest.AppendElement(indice);
+    MOZ_ALWAYS_TRUE(aDest.AppendElement(indice));
   }
+  return true;
 }
 
 MP4Metadata::MP4Metadata(Stream* aSource)
@@ -233,7 +238,7 @@ MP4Metadata::UpdateCrypto(const MetaData* aMetaData)
 }
 
 bool
-MP4Metadata::ReadTrackIndex(nsTArray<Index::Indice>& aDest, mozilla::TrackID aTrackID)
+MP4Metadata::ReadTrackIndex(FallibleTArray<Index::Indice>& aDest, mozilla::TrackID aTrackID)
 {
   size_t numTracks = mPrivate->mMetadataExtractor->countTracks();
   int32_t trackNumber = GetTrackNumber(aTrackID);
@@ -244,11 +249,17 @@ MP4Metadata::ReadTrackIndex(nsTArray<Index::Indice>& aDest, mozilla::TrackID aTr
   if (!track.get() || track->start() != OK) {
     return false;
   }
-  ConvertIndex(aDest, track->exportIndex());
+  sp<MetaData> metadata =
+    mPrivate->mMetadataExtractor->getTrackMetaData(trackNumber);
+  int64_t mediaTime;
+  if (!metadata->findInt64(kKeyMediaTime, &mediaTime)) {
+    mediaTime = 0;
+  }
+  bool rv = ConvertIndex(aDest, track->exportIndex(), mediaTime);
 
   track->stop();
 
-  return true;
+  return rv;
 }
 
 int32_t
diff --git a/media/libstagefright/binding/MoofParser.cpp b/media/libstagefright/binding/MoofParser.cpp
index 860e7aba7315..b290ae9a1468 100644
--- a/media/libstagefright/binding/MoofParser.cpp
+++ b/media/libstagefright/binding/MoofParser.cpp
@@ -48,7 +48,7 @@ MoofParser::RebuildFragmentedIndex(BoxContext& aContext)
       mInitRange = MediaByteRange(0, box.Range().mEnd);
       ParseMoov(box);
     } else if (box.IsType("moof")) {
-      Moof moof(box, mTrex, mMdhd, mEdts, mSinf, mIsAudio);
+      Moof moof(box, mTrex, mMvhd, mMdhd, mEdts, mSinf, mIsAudio);
 
       if (!moof.IsValid() && !box.Next().IsAvailable()) {
         // Moof isn't valid abort search for now.
@@ -171,7 +171,9 @@ void
 MoofParser::ParseMoov(Box& aBox)
 {
   for (Box box = aBox.FirstChild(); box.IsAvailable(); box = box.Next()) {
-    if (box.IsType("trak")) {
+    if (box.IsType("mvhd")) {
+      mMvhd = Mvhd(box);
+    } else if (box.IsType("trak")) {
       ParseTrak(box);
     } else if (box.IsType("mvex")) {
       ParseMvex(box);
@@ -190,7 +192,8 @@ MoofParser::ParseTrak(Box& aBox)
       if (!mTrex.mTrackId || tkhd.mTrackId == mTrex.mTrackId) {
         ParseMdia(box, tkhd);
       }
-    } else if (box.IsType("edts")) {
+    } else if (box.IsType("edts") &&
+               (!mTrex.mTrackId || tkhd.mTrackId == mTrex.mTrackId)) {
       mEdts = Edts(box);
     }
   }
@@ -268,13 +271,13 @@ MoofParser::ParseEncrypted(Box& aBox)
   }
 }
 
-Moof::Moof(Box& aBox, Trex& aTrex, Mdhd& aMdhd, Edts& aEdts, Sinf& aSinf, bool aIsAudio)
+Moof::Moof(Box& aBox, Trex& aTrex, Mvhd& aMvhd, Mdhd& aMdhd, Edts& aEdts, Sinf& aSinf, bool aIsAudio)
   : mRange(aBox.Range())
   , mMaxRoundingError(35000)
 {
   for (Box box = aBox.FirstChild(); box.IsAvailable(); box = box.Next()) {
     if (box.IsType("traf")) {
-      ParseTraf(box, aTrex, aMdhd, aEdts, aSinf, aIsAudio);
+      ParseTraf(box, aTrex, aMvhd, aMdhd, aEdts, aSinf, aIsAudio);
     }
   }
   if (IsValid()) {
@@ -347,7 +350,7 @@ Moof::ProcessCenc()
 }
 
 void
-Moof::ParseTraf(Box& aBox, Trex& aTrex, Mdhd& aMdhd, Edts& aEdts, Sinf& aSinf, bool aIsAudio)
+Moof::ParseTraf(Box& aBox, Trex& aTrex, Mvhd& aMvhd, Mdhd& aMdhd, Edts& aEdts, Sinf& aSinf, bool aIsAudio)
 {
   Tfhd tfhd(aTrex);
   Tfdt tfdt;
@@ -375,7 +378,7 @@ Moof::ParseTraf(Box& aBox, Trex& aTrex, Mdhd& aMdhd, Edts& aEdts, Sinf& aSinf, b
   uint64_t decodeTime = tfdt.mBaseMediaDecodeTime;
   for (Box box = aBox.FirstChild(); box.IsAvailable(); box = box.Next()) {
     if (box.IsType("trun")) {
-      if (ParseTrun(box, tfhd, aMdhd, aEdts, &decodeTime, aIsAudio)) {
+      if (ParseTrun(box, tfhd, aMvhd, aMdhd, aEdts, &decodeTime, aIsAudio)) {
         mValid = true;
       } else {
         mValid = false;
@@ -408,11 +411,12 @@ public:
 };
 
 bool
-Moof::ParseTrun(Box& aBox, Tfhd& aTfhd, Mdhd& aMdhd, Edts& aEdts, uint64_t* aDecodeTime, bool aIsAudio)
+Moof::ParseTrun(Box& aBox, Tfhd& aTfhd, Mvhd& aMvhd, Mdhd& aMdhd, Edts& aEdts, uint64_t* aDecodeTime, bool aIsAudio)
 {
-  if (!aTfhd.IsValid() || !aMdhd.IsValid() || !aEdts.IsValid()) {
-    LOG(Moof, "Invalid dependencies: aTfhd(%d) aMdhd(%d) aEdts(%d)",
-        aTfhd.IsValid(), aMdhd.IsValid(), !aEdts.IsValid());
+  if (!aTfhd.IsValid() || !aMvhd.IsValid() || !aMdhd.IsValid() ||
+      !aEdts.IsValid()) {
+    LOG(Moof, "Invalid dependencies: aTfhd(%d) aMvhd(%d) aMdhd(%d) aEdts(%d)",
+        aTfhd.IsValid(), aMvhd.IsValid(), aMdhd.IsValid(), !aEdts.IsValid());
     return false;
   }
 
@@ -458,6 +462,12 @@ Moof::ParseTrun(Box& aBox, Tfhd& aTfhd, Mdhd& aMdhd, Edts& aEdts, uint64_t* aDec
   uint32_t firstSampleFlags = hasFirstSampleFlags ? reader->ReadU32() : 0;
   uint64_t decodeTime = *aDecodeTime;
   nsTArray<Interval<Microseconds>> timeRanges;
+
+  if (!mIndex.SetCapacity(sampleCount)) {
+    LOG(Moof, "Out of Memory");
+    return false;
+  }
+
   for (size_t i = 0; i < sampleCount; i++) {
     uint32_t sampleDuration =
       flags & 0x100 ? reader->ReadU32() : aTfhd.mDefaultSampleDuration;
@@ -476,17 +486,18 @@ Moof::ParseTrun(Box& aBox, Tfhd& aTfhd, Mdhd& aMdhd, Edts& aEdts, uint64_t* aDec
     sample.mByteRange = MediaByteRange(offset, offset + sampleSize);
     offset += sampleSize;
 
-    sample.mDecodeTime = aMdhd.ToMicroseconds(decodeTime);
+    sample.mDecodeTime =
+      aMdhd.ToMicroseconds((int64_t)decodeTime - aEdts.mMediaStart) + aMvhd.ToMicroseconds(aEdts.mEmptyOffset);
     sample.mCompositionRange = Interval<Microseconds>(
-      aMdhd.ToMicroseconds((int64_t)decodeTime + ctsOffset - aEdts.mMediaStart),
-      aMdhd.ToMicroseconds((int64_t)decodeTime + ctsOffset + sampleDuration - aEdts.mMediaStart));
+      aMdhd.ToMicroseconds((int64_t)decodeTime + ctsOffset - aEdts.mMediaStart) + aMvhd.ToMicroseconds(aEdts.mEmptyOffset),
+      aMdhd.ToMicroseconds((int64_t)decodeTime + ctsOffset + sampleDuration - aEdts.mMediaStart) + aMvhd.ToMicroseconds(aEdts.mEmptyOffset));
     decodeTime += sampleDuration;
 
     // Sometimes audio streams don't properly mark their samples as keyframes,
     // because every audio sample is a keyframe.
     sample.mSync = !(sampleFlags & 0x1010000) || aIsAudio;
 
-    mIndex.AppendElement(sample);
+    MOZ_ALWAYS_TRUE(mIndex.AppendElement(sample));
 
     mMdatRange = mMdatRange.Extents(sample.mByteRange);
   }
@@ -545,7 +556,7 @@ Tkhd::Tkhd(Box& aBox)
   mValid = true;
 }
 
-Mdhd::Mdhd(Box& aBox)
+Mvhd::Mvhd(Box& aBox)
 {
   BoxReader reader(aBox);
   if (!reader->CanReadType<uint32_t>()) {
@@ -555,9 +566,9 @@ Mdhd::Mdhd(Box& aBox)
   uint32_t flags = reader->ReadU32();
   uint8_t version = flags >> 24;
   size_t need =
-    3*(version ? sizeof(int64_t) : sizeof(int32_t)) + 2*sizeof(uint32_t);
+    3*(version ? sizeof(int64_t) : sizeof(int32_t)) + sizeof(uint32_t);
   if (reader->Remaining() < need) {
-    LOG(Mdhd, "Incomplete Box (have:%lld need:%lld)",
+    LOG(Mvhd, "Incomplete Box (have:%lld need:%lld)",
         (uint64_t)reader->Remaining(), (uint64_t)need);
     return;
   }
@@ -572,12 +583,18 @@ Mdhd::Mdhd(Box& aBox)
     mModificationTime = reader->ReadU64();
     mTimescale = reader->ReadU32();
     mDuration = reader->ReadU64();
+  } else {
+    reader->DiscardRemaining();
+    return;
   }
-  // language and pre_defined=0
-  reader->ReadU32();
-  if (mTimescale) {
-    mValid = true;
-  }
+  // More stuff that we don't care about
+  reader->DiscardRemaining();
+  mValid = true;
+}
+
+Mdhd::Mdhd(Box& aBox)
+  : Mvhd(aBox)
+{
 }
 
 Trex::Trex(Box& aBox)
@@ -666,6 +683,7 @@ Tfdt::Tfdt(Box& aBox)
 
 Edts::Edts(Box& aBox)
   : mMediaStart(0)
+  , mEmptyOffset(0)
 {
   Box child = aBox.FirstChild();
   if (!child.IsType("elst")) {
@@ -686,22 +704,31 @@ Edts::Edts(Box& aBox)
         (uint64_t)reader->Remaining(), (uint64_t)need);
     return;
   }
+  bool emptyEntry = false;
   uint32_t entryCount = reader->ReadU32();
-  NS_ASSERTION(entryCount == 1, "Can't handle videos with multiple edits");
-  if (entryCount != 1) {
-    reader->DiscardRemaining();
-    return;
+  for (uint32_t i = 0; i < entryCount; i++) {
+    uint64_t segment_duration;
+    int64_t media_time;
+    if (version == 1) {
+      segment_duration = reader->ReadU64();
+      media_time = reader->Read64();
+    } else {
+      segment_duration = reader->ReadU32();
+      media_time = reader->Read32();
+    }
+    if (media_time == -1 && i) {
+      LOG(Edts, "Multiple empty edit, not handled");
+    } else if (media_time == -1) {
+      mEmptyOffset = segment_duration;
+      emptyEntry = true;
+    } else if (i > 1 || (i > 0 && !emptyEntry)) {
+      LOG(Edts, "More than one edit entry, not handled. A/V sync will be wrong");
+      break;
+    } else {
+      mMediaStart = media_time;
+    }
+    reader->ReadU32(); // media_rate_integer and media_rate_fraction
   }
-
-  uint64_t segment_duration;
-  if (version == 1) {
-    segment_duration = reader->ReadU64();
-    mMediaStart = reader->Read64();
-  } else {
-    segment_duration = reader->ReadU32();
-    mMediaStart = reader->Read32();
-  }
-  reader->DiscardRemaining();
 }
 
 Saiz::Saiz(Box& aBox, AtomType aDefaultType)
diff --git a/media/libstagefright/binding/include/mp4_demuxer/Index.h b/media/libstagefright/binding/include/mp4_demuxer/Index.h
index 8ddb48c311f4..b8d27b1d6666 100644
--- a/media/libstagefright/binding/include/mp4_demuxer/Index.h
+++ b/media/libstagefright/binding/include/mp4_demuxer/Index.h
@@ -74,7 +74,7 @@ private:
   ~Index();
 
   Stream* mSource;
-  nsTArray<Sample> mIndex;
+  FallibleTArray<Sample> mIndex;
   nsAutoPtr<MoofParser> mMoofParser;
   mozilla::Monitor* mMonitor;
 };
diff --git a/media/libstagefright/binding/include/mp4_demuxer/MP4Metadata.h b/media/libstagefright/binding/include/mp4_demuxer/MP4Metadata.h
index ec7503eb0133..de9273c2725d 100644
--- a/media/libstagefright/binding/include/mp4_demuxer/MP4Metadata.h
+++ b/media/libstagefright/binding/include/mp4_demuxer/MP4Metadata.h
@@ -41,7 +41,7 @@ public:
     return mCrypto;
   }
 
-  bool ReadTrackIndex(nsTArray<Index::Indice>& aDest, mozilla::TrackID aTrackID);
+  bool ReadTrackIndex(FallibleTArray<Index::Indice>& aDest, mozilla::TrackID aTrackID);
 
 private:
   int32_t GetTrackNumber(mozilla::TrackID aTrackID);
diff --git a/media/libstagefright/binding/include/mp4_demuxer/MoofParser.h b/media/libstagefright/binding/include/mp4_demuxer/MoofParser.h
index 048d8346fd5a..a87703560cba 100644
--- a/media/libstagefright/binding/include/mp4_demuxer/MoofParser.h
+++ b/media/libstagefright/binding/include/mp4_demuxer/MoofParser.h
@@ -18,35 +18,17 @@ class Box;
 class BoxContext;
 class Moof;
 
-class Tkhd : public Atom
+class Mvhd : public Atom
 {
 public:
-  Tkhd()
-    : mCreationTime(0)
-    , mModificationTime(0)
-    , mTrackId(0)
-    , mDuration(0)
-  {
-  }
-  explicit Tkhd(Box& aBox);
-
-  uint64_t mCreationTime;
-  uint64_t mModificationTime;
-  uint32_t mTrackId;
-  uint64_t mDuration;
-};
-
-class Mdhd : public Atom
-{
-public:
-  Mdhd()
+  Mvhd()
     : mCreationTime(0)
     , mModificationTime(0)
     , mTimescale(0)
     , mDuration(0)
   {
   }
-  explicit Mdhd(Box& aBox);
+  explicit Mvhd(Box& aBox);
 
   Microseconds ToMicroseconds(int64_t aTimescaleUnits)
   {
@@ -59,6 +41,25 @@ public:
   uint64_t mDuration;
 };
 
+class Tkhd : public Mvhd
+{
+public:
+  Tkhd()
+    : mTrackId(0)
+  {
+  }
+  explicit Tkhd(Box& aBox);
+
+  uint32_t mTrackId;
+};
+
+class Mdhd : public Mvhd
+{
+public:
+  Mdhd() = default;
+  explicit Mdhd(Box& aBox);
+};
+
 class Trex : public Atom
 {
 public:
@@ -113,6 +114,7 @@ class Edts : public Atom
 public:
   Edts()
     : mMediaStart(0)
+    , mEmptyOffset(0)
   {
   }
   explicit Edts(Box& aBox);
@@ -123,6 +125,7 @@ public:
   }
 
   int64_t mMediaStart;
+  int64_t mEmptyOffset;
 };
 
 struct Sample
@@ -168,22 +171,22 @@ private:
 class Moof : public Atom
 {
 public:
-  Moof(Box& aBox, Trex& aTrex, Mdhd& aMdhd, Edts& aEdts, Sinf& aSinf, bool aIsAudio);
+  Moof(Box& aBox, Trex& aTrex, Mvhd& aMvhd, Mdhd& aMdhd, Edts& aEdts, Sinf& aSinf, bool aIsAudio);
   bool GetAuxInfo(AtomType aType, nsTArray<MediaByteRange>* aByteRanges);
   void FixRounding(const Moof& aMoof);
 
   mozilla::MediaByteRange mRange;
   mozilla::MediaByteRange mMdatRange;
   Interval<Microseconds> mTimeRange;
-  nsTArray<Sample> mIndex;
+  FallibleTArray<Sample> mIndex;
 
   nsTArray<Saiz> mSaizs;
   nsTArray<Saio> mSaios;
 
 private:
-  void ParseTraf(Box& aBox, Trex& aTrex, Mdhd& aMdhd, Edts& aEdts, Sinf& aSinf, bool aIsAudio);
+  void ParseTraf(Box& aBox, Trex& aTrex, Mvhd& aMvhd, Mdhd& aMdhd, Edts& aEdts, Sinf& aSinf, bool aIsAudio);
   // aDecodeTime is updated to the end of the parsed TRUN on return.
-  bool ParseTrun(Box& aBox, Tfhd& aTfhd, Mdhd& aMdhd, Edts& aEdts, uint64_t* aDecodeTime, bool aIsAudio);
+  bool ParseTrun(Box& aBox, Tfhd& aTfhd, Mvhd& aMvhd, Mdhd& aMdhd, Edts& aEdts, uint64_t* aDecodeTime, bool aIsAudio);
   void ParseSaiz(Box& aBox);
   void ParseSaio(Box& aBox);
   bool ProcessCenc();
@@ -227,6 +230,7 @@ public:
   nsRefPtr<Stream> mSource;
   uint64_t mOffset;
   nsTArray<uint64_t> mMoofOffsets;
+  Mvhd mMvhd;
   Mdhd mMdhd;
   Trex mTrex;
   Tfdt mTfdt;
diff --git a/media/libstagefright/binding/mp4_demuxer.cpp b/media/libstagefright/binding/mp4_demuxer.cpp
index 2805de466567..b9ecd1323659 100644
--- a/media/libstagefright/binding/mp4_demuxer.cpp
+++ b/media/libstagefright/binding/mp4_demuxer.cpp
@@ -45,7 +45,7 @@ MP4Demuxer::Init()
   auto audioInfo = mMetadata->GetTrackInfo(mozilla::TrackInfo::kAudioTrack, 0);
   if (audioInfo) {
     mAudioConfig = mozilla::Move(audioInfo);
-    nsTArray<Index::Indice> indices;
+    FallibleTArray<Index::Indice> indices;
     if (!mMetadata->ReadTrackIndex(indices, mAudioConfig->mTrackId)) {
       return false;
     }
@@ -62,7 +62,7 @@ MP4Demuxer::Init()
   auto videoInfo = mMetadata->GetTrackInfo(mozilla::TrackInfo::kVideoTrack, 0);
   if (videoInfo) {
     mVideoConfig = mozilla::Move(videoInfo);
-    nsTArray<Index::Indice> indices;
+    FallibleTArray<Index::Indice> indices;
     if (!mMetadata->ReadTrackIndex(indices, mVideoConfig->mTrackId)) {
       return false;
     }
diff --git a/media/libstagefright/frameworks/av/media/libstagefright/MPEG4Extractor.cpp b/media/libstagefright/frameworks/av/media/libstagefright/MPEG4Extractor.cpp
index ff4530f96fcc..7250a8ef4621 100644
--- a/media/libstagefright/frameworks/av/media/libstagefright/MPEG4Extractor.cpp
+++ b/media/libstagefright/frameworks/av/media/libstagefright/MPEG4Extractor.cpp
@@ -868,6 +868,7 @@ status_t MPEG4Extractor::parseChunk(off64_t *offset, int depth) {
                 track->includes_expensive_metadata = false;
                 track->skipTrack = false;
                 track->timescale = 0;
+                track->empty_duration = 0;
                 track->segment_duration = 0;
                 track->media_time = 0;
                 track->meta->setCString(kKeyMIMEType, "application/octet-stream");
@@ -935,35 +936,54 @@ status_t MPEG4Extractor::parseChunk(off64_t *offset, int depth) {
                 return ERROR_IO;
             }
 
-            if (entry_count != 1) {
-                // we only support a single entry at the moment, for gapless playback
-                ALOGW("ignoring edit list with %d entries", entry_count);
-            } else if (mHeaderTimescale == 0) {
-                ALOGW("ignoring edit list because timescale is 0");
-            } else {
-                off64_t entriesoffset = data_offset + 8;
-
+            off64_t entriesoffset = data_offset + 8;
+            for (uint32_t i = 0; i < entry_count; i++) {
+                if (mHeaderTimescale == 0) {
+                    ALOGW("ignoring edit list because timescale is 0");
+                    break;
+                }
+                if (entriesoffset - data_offset > chunk_size) {
+                    ALOGW("invalid edit list size");
+                    break;
+                }
+                uint64_t segment_duration;
+                int64_t media_time;
                 if (version == 1) {
-                    if (!mDataSource->getUInt64(entriesoffset, &mLastTrack->segment_duration) ||
-                            !mDataSource->getUInt64(entriesoffset + 8, (uint64_t*)&mLastTrack->media_time)) {
+                    if (!mDataSource->getUInt64(entriesoffset, &segment_duration) ||
+                        !mDataSource->getUInt64(entriesoffset + 8, (uint64_t*)&media_time)) {
                         return ERROR_IO;
                     }
+                    entriesoffset += 16;
                 } else if (version == 0) {
                     uint32_t sd;
                     int32_t mt;
                     if (!mDataSource->getUInt32(entriesoffset, &sd) ||
-                            !mDataSource->getUInt32(entriesoffset + 4, (uint32_t*)&mt)) {
+                        !mDataSource->getUInt32(entriesoffset + 4, (uint32_t*)&mt)) {
                         return ERROR_IO;
                     }
-                    mLastTrack->segment_duration = sd;
-                    mLastTrack->media_time = mt;
+                    entriesoffset += 8;
+                    segment_duration = sd;
+                    media_time = mt;
                 } else {
                     return ERROR_IO;
                 }
-
-                storeEditList();
-
+                entriesoffset += 4; // ignore media_rate_integer and media_rate_fraction.
+                if (media_time == -1 && i) {
+                    ALOGW("ignoring invalid empty edit", i);
+                    break;
+                } else if (media_time == -1) {
+                    // Starting offsets for tracks (streams) are represented by an initial empty edit.
+                    mLastTrack->empty_duration = segment_duration;
+                    continue;
+                } else if (i > 1) {
+                    // we only support a single non-empty entry at the moment, for gapless playback
+                    ALOGW("multiple edit list entries, A/V sync will be wrong");
+                    break;
+                }
+                mLastTrack->segment_duration = segment_duration;
+                mLastTrack->media_time = media_time;
             }
+            storeEditList();
             *offset += chunk_size;
             break;
         }
@@ -1947,13 +1967,13 @@ void MPEG4Extractor::storeEditList()
     return;
   }
 
-  uint64_t segment_duration = (mLastTrack->segment_duration * 1000000)/ mHeaderTimescale;
+  uint64_t segment_duration = (mLastTrack->segment_duration * 1000000) / mHeaderTimescale;
   // media_time is measured in media time scale units.
   int64_t media_time = (mLastTrack->media_time * 1000000) / mLastTrack->timescale;
-
-  if (segment_duration == 0) {
-    mLastTrack->meta->setInt64(kKeyMediaTime, media_time);
-  }
+  // empty_duration is in the Movie Header Box's timescale.
+  int64_t empty_duration = (mLastTrack->empty_duration * 1000000) / mHeaderTimescale;
+  media_time -= empty_duration;
+  mLastTrack->meta->setInt64(kKeyMediaTime, media_time);
 
   int64_t duration;
   int32_t samplerate;
diff --git a/media/libstagefright/frameworks/av/media/libstagefright/include/MPEG4Extractor.h b/media/libstagefright/frameworks/av/media/libstagefright/include/MPEG4Extractor.h
index 9fcb99f20063..f70d028d6fe3 100644
--- a/media/libstagefright/frameworks/av/media/libstagefright/include/MPEG4Extractor.h
+++ b/media/libstagefright/frameworks/av/media/libstagefright/include/MPEG4Extractor.h
@@ -88,6 +88,7 @@ private:
         uint32_t timescale;
         // Temporary storage for elst until we've
         // parsed mdhd and can interpret them.
+        uint64_t empty_duration;
         uint64_t segment_duration;
         int64_t media_time;
 
diff --git a/memory/replace/dmd/test/xpcshell.ini b/memory/replace/dmd/test/xpcshell.ini
index bbce645112fa..aeb7bd84cd39 100644
--- a/memory/replace/dmd/test/xpcshell.ini
+++ b/memory/replace/dmd/test/xpcshell.ini
@@ -29,4 +29,4 @@ support-files =
 # Bug 1077230 explains why this test is disabled on Mac 10.6.
 [test_dmd.js]
 dmd = true
-skip-if = !(os=='linux' || os=='win') || (os=='mac' && os_version=='10.6')
+skip-if = !(os=='linux' || os=='win' || (os=='mac' && os_version!='10.6'))
diff --git a/mobile/android/base/BrowserApp.java b/mobile/android/base/BrowserApp.java
index f26db9d75ed4..f65685ae791b 100644
--- a/mobile/android/base/BrowserApp.java
+++ b/mobile/android/base/BrowserApp.java
@@ -5,6 +5,9 @@
 
 package org.mozilla.gecko;
 
+import com.nineoldandroids.animation.Animator;
+import com.nineoldandroids.animation.AnimatorListenerAdapter;
+import com.nineoldandroids.animation.ObjectAnimator;
 import org.mozilla.gecko.AppConstants.Versions;
 import org.mozilla.gecko.DynamicToolbar.PinReason;
 import org.mozilla.gecko.DynamicToolbar.VisibilityTransition;
@@ -154,7 +157,7 @@ public class BrowserApp extends GeckoApp
                                    BrowserSearch.OnEditSuggestionListener,
                                    OnUrlOpenListener,
                                    OnUrlOpenInBackgroundListener,
-                                   AnchoredPopup.OnShowListener,
+                                   AnchoredPopup.OnVisibilityChangeListener,
                                    ActionModeCompat.Presenter,
                                    LayoutInflater.Factory {
     private static final String LOGTAG = "GeckoBrowserApp";
@@ -184,6 +187,7 @@ public class BrowserApp extends GeckoApp
     public ViewFlipper mActionBarFlipper;
     public ActionModeCompatView mActionBar;
     private BrowserToolbar mBrowserToolbar;
+    private View mDoorhangerOverlay;
     // We can't name the TabStrip class because it's not included on API 9.
     private Refreshable mTabStrip;
     private ToolbarProgressView mProgressView;
@@ -771,6 +775,7 @@ public class BrowserApp extends GeckoApp
         EventDispatcher.getInstance().registerGeckoThreadListener((GeckoEventListener)this,
             "Menu:Open",
             "Menu:Update",
+            "LightweightTheme:Update",
             "Search:Keyword",
             "Prompt:ShowTop",
             "Accounts:Exist");
@@ -914,6 +919,11 @@ public class BrowserApp extends GeckoApp
 
     @Override
     public void onAttachedToWindow() {
+        // Gingerbread 2.3 doesn't handle starting alphas correctly, so disable doorhanger overlays for that, and perf.
+        if (!Versions.preHC){
+            mDoorhangerOverlay = findViewById(R.id.doorhanger_overlay);
+            mDoorhangerOverlay.setVisibility(View.VISIBLE);
+        }
         // We can't show the first run experience until Gecko has finished initialization (bug 1077583).
         checkFirstrun(this, new SafeIntent(getIntent()));
     }
@@ -1340,6 +1350,7 @@ public class BrowserApp extends GeckoApp
         EventDispatcher.getInstance().unregisterGeckoThreadListener((GeckoEventListener)this,
             "Menu:Open",
             "Menu:Update",
+            "LightweightTheme:Update",
             "Search:Keyword",
             "Prompt:ShowTop",
             "Accounts:Exist");
@@ -1379,7 +1390,7 @@ public class BrowserApp extends GeckoApp
         super.initializeChrome();
 
         mDoorHangerPopup.setAnchor(mBrowserToolbar.getDoorHangerAnchor());
-        mDoorHangerPopup.setOnShowListener(this);
+        mDoorHangerPopup.setOnVisibilityChangeListener(this);
 
         mDynamicToolbar.setLayerView(mLayerView);
         setDynamicToolbarEnabled(mDynamicToolbar.isEnabled());
@@ -1396,12 +1407,32 @@ public class BrowserApp extends GeckoApp
 
     @Override
     public void onDoorHangerShow() {
-        ThreadUtils.postToUiThread(new Runnable() {
-            @Override
-            public void run() {
-                mDynamicToolbar.setVisible(true, VisibilityTransition.ANIMATE);
-            }
-        });
+        mDynamicToolbar.setVisible(true, VisibilityTransition.ANIMATE);
+
+        if (Versions.preHC) {
+            return;
+        }
+
+        final Animator alphaAnimator = ObjectAnimator.ofFloat(mDoorhangerOverlay, "alpha", 1);
+        alphaAnimator.setDuration(250);
+        TransitionsTracker.track(alphaAnimator);
+
+        alphaAnimator.start();
+
+    }
+
+    @Override
+    public void onDoorHangerHide() {
+        if (Versions.preHC) {
+            return;
+        }
+
+        final Animator alphaAnimator = ObjectAnimator.ofFloat(mDoorhangerOverlay, "alpha", 0);
+        alphaAnimator.setDuration(200);
+
+        TransitionsTracker.track(alphaAnimator);
+
+        alphaAnimator.start();
     }
 
     private void handleClearHistory(final boolean clearSearchHistory) {
@@ -1890,6 +1921,13 @@ public class BrowserApp extends GeckoApp
 
             } else if (event.equals("Search:Keyword")) {
                 storeSearchQuery(message.getString("query"));
+            } else if (event.equals("LightweightTheme:Update")) {
+                ThreadUtils.postToUiThread(new Runnable() {
+                    @Override
+                    public void run() {
+                        mDynamicToolbar.setVisible(true, VisibilityTransition.ANIMATE);
+                    }
+                });
             } else if (event.equals("Prompt:ShowTop")) {
                 // Bring this activity to front so the prompt is visible..
                 Intent bringToFrontIntent = new Intent();
diff --git a/mobile/android/base/GeckoAppShell.java b/mobile/android/base/GeckoAppShell.java
index da16599b454e..70b51f4c9b77 100644
--- a/mobile/android/base/GeckoAppShell.java
+++ b/mobile/android/base/GeckoAppShell.java
@@ -54,6 +54,7 @@ import org.mozilla.gecko.util.NativeJSObject;
 import org.mozilla.gecko.util.ProxySelector;
 import org.mozilla.gecko.util.ThreadUtils;
 
+import android.annotation.TargetApi;
 import android.app.Activity;
 import android.app.ActivityManager;
 import android.app.PendingIntent;
@@ -1199,10 +1200,12 @@ public class GeckoAppShell
                 return null;
             }
 
-            // We only handle explicit Intents at the moment (see bug 851693 comment 20).
-            if (intent.getPackage() == null) {
-                return null;
-            }
+            // Only handle applications which can accept arbitrary data from a browser.
+            intent.addCategory(Intent.CATEGORY_BROWSABLE);
+
+            // Prevent site from explicitly opening our internal activities, which can leak data.
+            intent.setComponent(null);
+            nullIntentSelector(intent);
 
             return intent;
         }
@@ -1281,6 +1284,16 @@ public class GeckoAppShell
         return intent;
     }
 
+    // We create a separate method to better encapsulate the @TargetApi use.
+    @TargetApi(15)
+    private static void nullIntentSelector(final Intent intent) {
+        if (!Versions.feature15Plus) {
+            return;
+        }
+
+        intent.setSelector(null);
+    }
+
     /**
      * Input: vnd:youtube:3MWr19Dp2OU?foo=bar
      * Output: https://www.youtube.com/embed/3MWr19Dp2OU?foo=bar
@@ -2412,17 +2425,6 @@ public class GeckoAppShell
         });
     }
 
-    /**
-     * Decodes a byte array from Base64 format.
-     * No blanks or line breaks are allowed within the Base64 encoded input data.
-     * @param s     A string containing the Base64 encoded data.
-     * @return      An array containing the decoded data bytes.
-     * @throws      IllegalArgumentException If the input is not valid Base64 encoded data.
-     */
-    public static byte[] decodeBase64(String s, int flags) {
-        return Base64.decode(s.getBytes(), flags);
-    }
-
     @WrapElementForJNI(stubName = "GetScreenOrientationWrapper")
     public static short getScreenOrientation() {
         return GeckoScreenOrientation.getInstance().getScreenOrientation().value;
diff --git a/mobile/android/base/gfx/LayerMarginsAnimator.java b/mobile/android/base/gfx/LayerMarginsAnimator.java
index cfc750828d04..970ec05fc698 100644
--- a/mobile/android/base/gfx/LayerMarginsAnimator.java
+++ b/mobile/android/base/gfx/LayerMarginsAnimator.java
@@ -110,11 +110,26 @@ public class LayerMarginsAnimator {
         }
 
         ImmutableViewportMetrics metrics = mTarget.getViewportMetrics();
+        if (!canAnimateMargins(metrics, left, top, right, bottom)) {
+            return;
+        }
 
         mAnimationTask = new LayerMarginsAnimationTask(false, metrics, left, top, right, bottom);
         mTarget.getView().postRenderTask(mAnimationTask);
     }
 
+    /**
+     * Returns true if we can animate the margins from their current position, false otherwise.
+     * We can animate if the given values are not identical (i.e. there is somewhere to animate to).
+     */
+    private static boolean canAnimateMargins(final ImmutableViewportMetrics metrics,
+            final float left, final float top, final float right, final float bottom) {
+        return !(FloatUtils.fuzzyEquals(left, metrics.marginLeft) &&
+                    FloatUtils.fuzzyEquals(top, metrics.marginTop) &&
+                    FloatUtils.fuzzyEquals(right, metrics.marginRight) &&
+                    FloatUtils.fuzzyEquals(bottom, metrics.marginBottom));
+    }
+
     /**
      * Exposes the margin area by growing the margin components of the current
      * metrics to the values set in setMaxMargins.
diff --git a/mobile/android/base/gfx/LayerRenderer.java b/mobile/android/base/gfx/LayerRenderer.java
index 5c932996b343..5cd935b0222d 100644
--- a/mobile/android/base/gfx/LayerRenderer.java
+++ b/mobile/android/base/gfx/LayerRenderer.java
@@ -393,7 +393,7 @@ public class LayerRenderer implements Tabs.OnTabsChangedListener {
 
     class FadeRunnable implements Runnable {
         private boolean mStarted;
-        private long mRunAt;
+        long mRunAt; // Would be private but we need both file access and high performance.
 
         void scheduleStartFade(long delay) {
             mRunAt = SystemClock.elapsedRealtime() + delay;
@@ -504,7 +504,9 @@ public class LayerRenderer implements Tabs.OnTabsChangedListener {
                 mHorizScrollLayer.unfade();
                 mFadeRunnable.scheduleStartFade(ScrollbarLayer.FADE_DELAY);
             } else if (mFadeRunnable.timeToFade()) {
-                boolean stillFading = mVertScrollLayer.fade() | mHorizScrollLayer.fade();
+                final long currentMillis = SystemClock.elapsedRealtime();
+                final boolean stillFading = mVertScrollLayer.fade(mFadeRunnable.mRunAt, currentMillis) |
+                        mHorizScrollLayer.fade(mFadeRunnable.mRunAt, currentMillis);
                 if (stillFading) {
                     mFadeRunnable.scheduleNextFadeFrame();
                 }
diff --git a/mobile/android/base/gfx/ScrollbarLayer.java b/mobile/android/base/gfx/ScrollbarLayer.java
index 7c179aad7d06..ed1dc01e3019 100644
--- a/mobile/android/base/gfx/ScrollbarLayer.java
+++ b/mobile/android/base/gfx/ScrollbarLayer.java
@@ -20,7 +20,7 @@ public class ScrollbarLayer extends Layer {
     private static final String LOGTAG = "GeckoScrollbarLayer";
 
     public static final long FADE_DELAY = 500; // milliseconds before fade-out starts
-    private static final float FADE_AMOUNT = 0.03f; // how much (as a percent) the scrollbar should fade per frame
+    private static final float FADE_MILLIS = 250; // how long the scrollbar should take to fade
 
     private final boolean mVertical;
     private float mOpacity;
@@ -141,16 +141,17 @@ public class ScrollbarLayer extends Layer {
     }
 
     /**
-     * Decrease the opacity of the scrollbar by one frame's worth.
+     * Set the opacity of the scrollbar depending on how much time has
+     * passed from the given start time, current time, and the constant duration.
      * Return true if the opacity was decreased, or false if the scrollbars
      * are already fully faded out.
      */
-    public boolean fade() {
+    public boolean fade(final long startMillis, final long currentMillis) {
         if (FloatUtils.fuzzyEquals(mOpacity, 0.0f)) {
             return false;
         }
         beginTransaction(); // called on compositor thread
-        mOpacity = Math.max(mOpacity - FADE_AMOUNT, 0.0f);
+        mOpacity = Math.max(1 - (currentMillis - startMillis) / FADE_MILLIS, 0.0f);
         endTransaction();
         return true;
     }
diff --git a/mobile/android/base/home/BrowserSearch.java b/mobile/android/base/home/BrowserSearch.java
index 1020bfbf3a6d..aec7836adda4 100644
--- a/mobile/android/base/home/BrowserSearch.java
+++ b/mobile/android/base/home/BrowserSearch.java
@@ -294,7 +294,7 @@ public class BrowserSearch extends HomeFragment
                 }
 
                 // Account for the search engine rows.
-                position -= getSuggestEngineCount();
+                position -= getPrimaryEngineCount();
                 final Cursor c = mAdapter.getCursor(position);
                 final String url = c.getString(c.getColumnIndexOrThrow(URLColumns.URL));
 
@@ -317,7 +317,7 @@ public class BrowserSearch extends HomeFragment
                 }
 
                 // Account for the search engine rows.
-                position -= getSuggestEngineCount();
+                position -= getPrimaryEngineCount();
                 return mList.onItemLongClick(parent, view, position, id);
             }
         });
@@ -345,7 +345,9 @@ public class BrowserSearch extends HomeFragment
         // If the view backed by this Fragment is being recreated, we will not receive
         // a new search engine data event so refresh the new search engine bar's data
         // & Views with the data we have.
-        mSearchEngineBar.setSearchEngines(mSearchEngines);
+        mSearchEngineBar.setSearchEngines(
+                mSearchEngines.subList(getPrimaryEngineCount(), mSearchEngines.size())
+        );
         mSearchEngineBar.setOnSearchBarClickListener(this);
     }
 
@@ -584,7 +586,9 @@ public class BrowserSearch extends HomeFragment
                 mAdapter.notifyDataSetChanged();
             }
 
-            mSearchEngineBar.setSearchEngines(mSearchEngines);
+            mSearchEngineBar.setSearchEngines(
+                    mSearchEngines.subList(getPrimaryEngineCount(), mSearchEngines.size())
+            );
 
             // Show suggestions opt-in prompt only if suggestions are not enabled yet,
             // user hasn't been prompted and we're not on a private browsing tab.
@@ -733,8 +737,8 @@ public class BrowserSearch extends HomeFragment
         mList.startAnimation(shrinkAnimation);
     }
 
-    private int getSuggestEngineCount() {
-        return (TextUtils.isEmpty(mSearchTerm) || mSuggestClient == null || !mSuggestionsEnabled) ? 0 : 1;
+    private int getPrimaryEngineCount() {
+        return mSearchEngines.size() > 0 ? 1 : 0;
     }
 
     private void restartSearchLoader() {
@@ -839,21 +843,20 @@ public class BrowserSearch extends HomeFragment
 
         @Override
         public int getItemViewType(int position) {
-            final int engine = getEngineIndex(position);
+            if (position < getPrimaryEngineCount()) {
+                if (mSuggestionsEnabled && mSearchEngines.get(position).hasSuggestions()) {
+                    // Give suggestion views their own type to prevent them from
+                    // sharing other recycled search result views. Using other
+                    // recycled views for the suggestion row can break animations
+                    // (bug 815937).
 
-            if (engine == -1) {
-                return ROW_STANDARD;
+                    return ROW_SUGGEST;
+                } else {
+                    return ROW_SEARCH;
+                }
             }
 
-            if (engine == 0 && mSuggestionsEnabled) {
-                // Give suggestion views their own type to prevent them from
-                // sharing other recycled search engine views. Using other
-                // recycled views for the suggestion row can break animations
-                // (bug 815937).
-                return ROW_SUGGEST;
-            }
-
-            return ROW_SEARCH;
+            return ROW_STANDARD;
         }
 
         @Override
@@ -868,9 +871,9 @@ public class BrowserSearch extends HomeFragment
             // query), allow the entire row to be clickable; clicking the row
             // has the same effect as clicking the single suggestion. If the
             // row contains multiple items, clicking the row will do nothing.
-            final int index = getEngineIndex(position);
-            if (index != -1) {
-                return !mSearchEngines.get(index).hasSuggestions();
+
+            if (position < getPrimaryEngineCount()) {
+                return !mSearchEngines.get(position).hasSuggestions();
             }
 
             return true;
@@ -886,7 +889,7 @@ public class BrowserSearch extends HomeFragment
                 return resultCount;
             }
 
-            return resultCount + mSearchEngines.size();
+            return resultCount + getPrimaryEngineCount();
         }
 
         @Override
@@ -900,7 +903,7 @@ public class BrowserSearch extends HomeFragment
                 row.setOnEditSuggestionListener(mEditSuggestionListener);
                 row.setSearchTerm(mSearchTerm);
 
-                final SearchEngine engine = mSearchEngines.get(getEngineIndex(position));
+                final SearchEngine engine = mSearchEngines.get(position);
                 final boolean animate = (mAnimateSuggestions && engine.hasSuggestions());
                 row.updateFromSearchEngine(engine, animate);
                 if (animate) {
@@ -909,31 +912,13 @@ public class BrowserSearch extends HomeFragment
                 }
             } else {
                 // Account for the search engines
-                position -= getSuggestEngineCount();
+                position -= getPrimaryEngineCount();
 
                 final Cursor c = getCursor(position);
                 final TwoLinePageRow row = (TwoLinePageRow) view;
                 row.updateFromCursor(c);
             }
         }
-
-        private int getEngineIndex(int position) {
-            final int resultCount = super.getCount();
-            final int suggestEngineCount = getSuggestEngineCount();
-
-            // Return suggest engine index
-            if (position < suggestEngineCount) {
-                return position;
-            }
-
-            // Not an engine
-            if (position - suggestEngineCount < resultCount) {
-                return -1;
-            }
-
-            // Return search engine index
-            return position - resultCount;
-        }
     }
 
     private class CursorLoaderCallbacks implements LoaderCallbacks<Cursor> {
diff --git a/mobile/android/base/home/SearchEngineBar.java b/mobile/android/base/home/SearchEngineBar.java
index 128e80d22b8a..02eecb4d0cdb 100644
--- a/mobile/android/base/home/SearchEngineBar.java
+++ b/mobile/android/base/home/SearchEngineBar.java
@@ -9,16 +9,16 @@ import android.content.Context;
 import android.graphics.Canvas;
 import android.graphics.Paint;
 import android.util.AttributeSet;
+import android.util.DisplayMetrics;
+import android.util.TypedValue;
 import android.view.LayoutInflater;
 import android.view.View;
 import android.view.ViewGroup;
 import android.widget.AdapterView;
 import android.widget.BaseAdapter;
-import android.widget.FrameLayout;
 import android.widget.ImageView;
 
 import org.mozilla.gecko.R;
-import org.mozilla.gecko.widget.FaviconView;
 import org.mozilla.gecko.widget.TwoWayView;
 
 import java.util.ArrayList;
@@ -28,16 +28,34 @@ public class SearchEngineBar extends TwoWayView
                              implements AdapterView.OnItemClickListener {
     private static final String LOGTAG = "Gecko" + SearchEngineBar.class.getSimpleName();
 
+    private static final float ICON_CONTAINER_MIN_WIDTH_DP = 72;
+    private static final float DIVIDER_HEIGHT_DP = 1;
+
     public interface OnSearchBarClickListener {
         public void onSearchBarClickListener(SearchEngine searchEngine);
     }
 
     private final SearchEngineAdapter adapter;
+    private final Paint dividerPaint;
+    private final float minIconContainerWidth;
+    private final float dividerHeight;
+
+    private int iconContainerWidth;
     private OnSearchBarClickListener onSearchBarClickListener;
 
     public SearchEngineBar(final Context context, final AttributeSet attrs) {
         super(context, attrs);
 
+        dividerPaint = new Paint();
+        dividerPaint.setColor(getResources().getColor(R.color.divider_light));
+        dividerPaint.setStyle(Paint.Style.FILL_AND_STROKE);
+
+        final DisplayMetrics displayMetrics = getResources().getDisplayMetrics();
+        minIconContainerWidth = TypedValue.applyDimension(TypedValue.COMPLEX_UNIT_DIP, ICON_CONTAINER_MIN_WIDTH_DP, displayMetrics);
+        dividerHeight = TypedValue.applyDimension(TypedValue.COMPLEX_UNIT_DIP, DIVIDER_HEIGHT_DP, displayMetrics);
+
+        iconContainerWidth =  (int) minIconContainerWidth;
+
         adapter = new SearchEngineAdapter();
         setAdapter(adapter);
         setOnItemClickListener(this);
@@ -63,6 +81,34 @@ public class SearchEngineBar extends TwoWayView
         adapter.setSearchEngines(searchEngines);
     }
 
+    @Override
+    protected void onMeasure(int widthMeasureSpec, int heightMeasureSpec) {
+        super.onMeasure(widthMeasureSpec, heightMeasureSpec);
+
+        final int searchEngineCount = getCount();
+
+        if (searchEngineCount > 0) {
+            final float availableWidthPerContainer = getMeasuredWidth() / searchEngineCount;
+
+            final int desiredIconContainerSize = (int) Math.max(
+                    availableWidthPerContainer,
+                    minIconContainerWidth
+            );
+
+            if (desiredIconContainerSize != iconContainerWidth) {
+                iconContainerWidth = desiredIconContainerSize;
+                adapter.notifyDataSetChanged();
+            }
+        }
+    }
+
+    @Override
+    protected void onDraw(Canvas canvas) {
+        super.onDraw(canvas);
+
+        canvas.drawRect(0, 0, getWidth(), dividerHeight, dividerPaint);
+    }
+
     public class SearchEngineAdapter extends BaseAdapter {
         List<SearchEngine> searchEngines = new ArrayList<>();
 
@@ -95,44 +141,16 @@ public class SearchEngineBar extends TwoWayView
                 view = convertView;
             }
 
+            view.setLayoutParams(new LayoutParams(iconContainerWidth, ViewGroup.LayoutParams.MATCH_PARENT));
+
             final ImageView faviconView = (ImageView) view.findViewById(R.id.search_engine_icon);
             final SearchEngine searchEngine = searchEngines.get(position);
             faviconView.setImageBitmap(searchEngine.getIcon());
 
-            final View container = view.findViewById(R.id.search_engine_icon_container);
             final String desc = getResources().getString(R.string.search_bar_item_desc, searchEngine.getEngineIdentifier());
-            container.setContentDescription(desc);
+            view.setContentDescription(desc);
 
             return view;
         }
     }
-
-    /**
-     * A Container to surround the SearchEngineBar. This is necessary so we can draw
-     * a divider across the entire width of the screen, but have the inner list layout
-     * not take up the full width of the screen so it can be centered within this container
-     * if there aren't enough items that it needs to scroll.
-     *
-     * Note: a better implementation would have this View inflating an inner layout so
-     * the containing layout doesn't need two "SearchEngineBar" Views but it wasn't
-     * worth the refactor time.
-     */
-    @SuppressWarnings("unused") // via XML
-    public static class SearchEngineBarContainer extends FrameLayout {
-        private final Paint dividerPaint;
-
-        public SearchEngineBarContainer(final Context context, final AttributeSet attrs) {
-            super(context, attrs);
-
-            dividerPaint = new Paint();
-            dividerPaint.setColor(getResources().getColor(R.color.divider_light));
-        }
-
-        @Override
-        public void onDraw(final Canvas canvas) {
-            super.onDraw(canvas);
-
-            canvas.drawLine(0, 0, getWidth(), 0, dividerPaint);
-        }
-    }
 }
diff --git a/mobile/android/base/resources/layout/browser_search.xml b/mobile/android/base/resources/layout/browser_search.xml
index 3c24aecf0c11..44ff340cf170 100644
--- a/mobile/android/base/resources/layout/browser_search.xml
+++ b/mobile/android/base/resources/layout/browser_search.xml
@@ -19,31 +19,17 @@
             android:layout_height="0dp"
             android:layout_weight="1" />
 
-    <!-- The window background is set to our desired color, #fff, so
-         reduce overdraw by not drawing the background.
-
-         Note: this needs to be transparent and not null because we
-         draw a divider in onDraw. -->
-    <view class="org.mozilla.gecko.home.SearchEngineBar$SearchEngineBarContainer"
+    <!-- listSelector is too slow for showing pressed state
+         so we set the pressed colors on the child. -->
+    <org.mozilla.gecko.home.SearchEngineBar
+          android:id="@+id/search_engine_bar"
           android:layout_width="match_parent"
-          android:layout_height="wrap_content"
-          android:background="@android:color/transparent">
-
-        <!-- We add a marginTop so the outer container can draw a divider.
-
-             listSelector is too slow for showing pressed state
-             so we set the pressed colors on the child. -->
-        <org.mozilla.gecko.home.SearchEngineBar
-              android:id="@+id/search_engine_bar"
-              android:layout_width="wrap_content"
-              android:layout_height="48dp"
-              android:layout_marginTop="1dp"
-              android:orientation="horizontal"
-              android:layout_gravity="center_horizontal"
-              android:choiceMode="singleChoice"
-              android:listSelector="@android:color/transparent"
-              android:cacheColorHint="@android:color/transparent"/>
-
-   </view>
+          android:layout_height="48dp"
+          android:paddingTop="1dp"
+          android:orientation="horizontal"
+          android:layout_gravity="center_horizontal"
+          android:choiceMode="singleChoice"
+          android:listSelector="@android:color/transparent"
+          android:cacheColorHint="@android:color/transparent" />
 
 </LinearLayout>
diff --git a/mobile/android/base/resources/layout/firstrun_pane.xml b/mobile/android/base/resources/layout/firstrun_pane.xml
index 88d726e682ba..48337616c228 100644
--- a/mobile/android/base/resources/layout/firstrun_pane.xml
+++ b/mobile/android/base/resources/layout/firstrun_pane.xml
@@ -8,7 +8,7 @@
              xmlns:gecko="http://schemas.android.com/apk/res-auto"
              android:layout_height="match_parent"
              android:layout_width="match_parent"
-             android:background="@color/firstrun_background">
+             android:background="@color/dark_transparent_overlay">
 
     <org.mozilla.gecko.firstrun.FirstrunPager
                     android:id="@+id/firstrun_pager"
diff --git a/mobile/android/base/resources/layout/gecko_app.xml b/mobile/android/base/resources/layout/gecko_app.xml
index 2e79e00bf8ef..e001209bf78d 100644
--- a/mobile/android/base/resources/layout/gecko_app.xml
+++ b/mobile/android/base/resources/layout/gecko_app.xml
@@ -57,6 +57,14 @@
 
             </FrameLayout>
 
+            <LinearLayout android:id="@+id/doorhanger_overlay"
+                          android:layout_width="match_parent"
+                          android:layout_height="match_parent"
+                          android:background="@color/dark_transparent_overlay"
+                          android:visibility="gone"
+                          android:alpha="0"
+                          android:layerType="hardware"/>
+
         </RelativeLayout>
 
         <org.mozilla.gecko.FindInPageBar android:id="@+id/find_in_page"
diff --git a/mobile/android/base/resources/layout/login_edit_dialog.xml b/mobile/android/base/resources/layout/login_edit_dialog.xml
index d725a0aa16b2..648456a2757a 100644
--- a/mobile/android/base/resources/layout/login_edit_dialog.xml
+++ b/mobile/android/base/resources/layout/login_edit_dialog.xml
@@ -18,7 +18,7 @@
     <EditText android:id="@+id/password_edit"
               android:layout_width="match_parent"
               android:layout_height="wrap_content"
-              android:password="true"
+              android:inputType="textPassword"
               android:hint="@string/doorhanger_login_edit_password_hint"/>
 
     <CheckBox android:id="@+id/checkbox_toggle_password"
diff --git a/mobile/android/base/resources/layout/search_engine_bar_item.xml b/mobile/android/base/resources/layout/search_engine_bar_item.xml
index 0b4bcc59890c..56d03d156b6e 100644
--- a/mobile/android/base/resources/layout/search_engine_bar_item.xml
+++ b/mobile/android/base/resources/layout/search_engine_bar_item.xml
@@ -8,12 +8,15 @@
      have to surround the main View by a ViewGroup to create a pressable margin.
 
      Note: the layout_height values are shared with the parent
-     View (browser_search at the time of this writing). -->
+     View (browser_search at the time of this writing).
+
+     The actual width of the FrameLayout is calculated at runtime by the
+     SearchEngineBar class to spread the icons across the device's width. -->
 <FrameLayout
     xmlns:android="http://schemas.android.com/apk/res/android"
     android:id="@+id/search_engine_icon_container"
-    android:layout_height="match_parent"
     android:layout_width="72dp"
+    android:layout_height="match_parent"
     android:background="@color/pressed_about_page_header_grey">
 
     <!-- Width & height are set to make the Favicons as sharp as possible
diff --git a/mobile/android/base/resources/values/colors.xml b/mobile/android/base/resources/values/colors.xml
index 6c3ed457d413..8ea8192e98e4 100644
--- a/mobile/android/base/resources/values/colors.xml
+++ b/mobile/android/base/resources/values/colors.xml
@@ -57,8 +57,9 @@
   <!-- highlight-focused on private nav button: 10% white over private_toolbar_grey -->
   <color name="highlight_nav_focused_pb">#FF3F423F</color>
 
+  <color name="dark_transparent_overlay">#99000000</color>
+
   <!-- Firstrun tour-->
-  <color name="firstrun_background">#99000000</color>
   <color name="firstrun_tabstrip">#1193CB</color>
   <color name="firstrun_pager_background">#16A3DF</color>
 
diff --git a/mobile/android/base/toolbar/ToolbarDisplayLayout.java b/mobile/android/base/toolbar/ToolbarDisplayLayout.java
index a455f3e56bb8..6c3cd199c133 100644
--- a/mobile/android/base/toolbar/ToolbarDisplayLayout.java
+++ b/mobile/android/base/toolbar/ToolbarDisplayLayout.java
@@ -173,6 +173,7 @@ public class ToolbarDisplayLayout extends ThemedLinearLayout
 
         mSiteIdentityPopup = new SiteIdentityPopup(mActivity);
         mSiteIdentityPopup.setAnchor(this);
+        mSiteIdentityPopup.setOnVisibilityChangeListener(mActivity);
 
         mStop = (ImageButton) findViewById(R.id.stop);
         mPageActionLayout = (PageActionLayout) findViewById(R.id.page_action_layout);
diff --git a/mobile/android/base/widget/AnchoredPopup.java b/mobile/android/base/widget/AnchoredPopup.java
index 29a0cb62bfd7..c18bdd2817d3 100644
--- a/mobile/android/base/widget/AnchoredPopup.java
+++ b/mobile/android/base/widget/AnchoredPopup.java
@@ -23,12 +23,13 @@ import org.mozilla.gecko.util.HardwareUtils;
  * AnchoredPopup is the base class for doorhanger notifications, and is anchored to the urlbar.
  */
 public abstract class AnchoredPopup extends PopupWindow {
-    public interface OnShowListener {
+    public interface OnVisibilityChangeListener {
         public void onDoorHangerShow();
+        public void onDoorHangerHide();
     }
 
     private View mAnchor;
-    private OnShowListener mOnShowListener;
+    private OnVisibilityChangeListener onVisibilityChangeListener;
 
     protected LinearLayout mContent;
     protected boolean mInflated;
@@ -74,8 +75,8 @@ public abstract class AnchoredPopup extends PopupWindow {
         mAnchor = anchor;
     }
 
-    public void setOnShowListener(OnShowListener listener) {
-        mOnShowListener = listener;
+    public void setOnVisibilityChangeListener(OnVisibilityChangeListener listener) {
+        onVisibilityChangeListener = listener;
     }
 
     /**
@@ -87,8 +88,8 @@ public abstract class AnchoredPopup extends PopupWindow {
             throw new IllegalStateException("ArrowPopup#init() must be called before ArrowPopup#show()");
         }
 
-        if (mOnShowListener != null) {
-            mOnShowListener.onDoorHangerShow();
+        if (onVisibilityChangeListener != null) {
+            onVisibilityChangeListener.onDoorHangerShow();
         }
 
         final int[] anchorLocation = new int[2];
@@ -131,4 +132,12 @@ public abstract class AnchoredPopup extends PopupWindow {
             showAtLocation(anchor, Gravity.TOP | Gravity.CENTER_HORIZONTAL, 0, offsetY);
         }
     }
+
+    @Override
+    public void dismiss() {
+        super.dismiss();
+        if (onVisibilityChangeListener != null) {
+            onVisibilityChangeListener.onDoorHangerHide();
+        }
+    }
 }
diff --git a/mobile/android/chrome/content/aboutPasswords.js b/mobile/android/chrome/content/aboutPasswords.js
index d29a07da08d1..8c34ee0767f9 100644
--- a/mobile/android/chrome/content/aboutPasswords.js
+++ b/mobile/android/chrome/content/aboutPasswords.js
@@ -157,6 +157,7 @@ let Passwords = {
       window: window,
     });
     let menuItems = [
+      { label: gStringBundle.GetStringFromName("passwordsMenu.showPassword") },
       { label: gStringBundle.GetStringFromName("passwordsMenu.copyPassword") },
       { label: gStringBundle.GetStringFromName("passwordsMenu.copyUsername") },
       { label: gStringBundle.GetStringFromName("passwordsMenu.details") },
@@ -168,16 +169,31 @@ let Passwords = {
       // Switch on indices of buttons, as they were added when creating login item.
       switch (data.button) {
         case 0:
-          copyStringAndToast(login.password, gStringBundle.GetStringFromName("passwordsDetails.passwordCopied"));
+          let passwordPrompt = new Prompt({
+            window: window,
+            message: login.password,
+            buttons: [
+              gStringBundle.GetStringFromName("passwordsDialog.copy"),
+              gStringBundle.GetStringFromName("passwordsDialog.cancel") ]
+          }).show((data) => {
+            switch (data.button) {
+              case 0:
+                // Corresponds to "Copy password" button.
+                copyStringAndToast(login.password, gStringBundle.GetStringFromName("passwordsDetails.passwordCopied"));
+            }
+          });
           break;
         case 1:
-          copyStringAndToast(login.username, gStringBundle.GetStringFromName("passwordsDetails.usernameCopied"));
+          copyStringAndToast(login.password, gStringBundle.GetStringFromName("passwordsDetails.passwordCopied"));
           break;
         case 2:
+          copyStringAndToast(login.username, gStringBundle.GetStringFromName("passwordsDetails.usernameCopied"));
+          break;
+        case 3:
           this._showDetails(loginItem);
           history.pushState({ id: login.guid }, document.title);
           break;
-        case 3:
+        case 4:
           let confirmPrompt = new Prompt({
             window: window,
             message: gStringBundle.GetStringFromName("passwordsDialog.confirmDelete"),
diff --git a/mobile/android/chrome/content/browser.js b/mobile/android/chrome/content/browser.js
index 908f378ad1c6..9a3865b9bd4c 100644
--- a/mobile/android/chrome/content/browser.js
+++ b/mobile/android/chrome/content/browser.js
@@ -423,7 +423,7 @@ var BrowserApp = {
 
     window.addEventListener("fullscreen", function() {
       Messaging.sendRequest({
-        type: window.fullScreen ? "ToggleChrome:Show" : "ToggleChrome:Hide"
+        type: window.fullScreen ? "ToggleChrome:Hide" : "ToggleChrome:Show"
       });
     }, false);
 
@@ -5851,7 +5851,7 @@ var FormAssistant = {
 
   // We only want to show autocomplete suggestions for certain elements
   _isAutoComplete: function _isAutoComplete(aElement) {
-    if (!(aElement instanceof HTMLInputElement) || aElement.readOnly ||
+    if (!(aElement instanceof HTMLInputElement) || aElement.readOnly || aElement.disabled ||
         (aElement.getAttribute("type") == "password") ||
         (aElement.hasAttribute("autocomplete") &&
          aElement.getAttribute("autocomplete").toLowerCase() == "off"))
diff --git a/mobile/android/locales/en-US/chrome/aboutPasswords.properties b/mobile/android/locales/en-US/chrome/aboutPasswords.properties
index 630c3e6c7258..e9613a3d4882 100644
--- a/mobile/android/locales/en-US/chrome/aboutPasswords.properties
+++ b/mobile/android/locales/en-US/chrome/aboutPasswords.properties
@@ -2,12 +2,14 @@
 # License, v. 2.0. If a copy of the MPL was not distributed with this
 # file, You can obtain one at http://mozilla.org/MPL/2.0/.
 
+passwordsMenu.showPassword=Show password
 passwordsMenu.copyPassword=Copy password
 passwordsMenu.copyUsername=Copy username
 passwordsMenu.details=Details
 passwordsMenu.delete=Delete
 
 passwordsDialog.confirmDelete=Delete this login?
+passwordsDialog.copy=Copy
 passwordsDialog.confirm=OK
 passwordsDialog.cancel=Cancel
 
diff --git a/mobile/android/tests/browser/robocop/testAddSearchEngine.java b/mobile/android/tests/browser/robocop/testAddSearchEngine.java
index cca1cc37db25..97b6c3708927 100644
--- a/mobile/android/tests/browser/robocop/testAddSearchEngine.java
+++ b/mobile/android/tests/browser/robocop/testAddSearchEngine.java
@@ -13,9 +13,10 @@ import org.json.JSONObject;
 import org.mozilla.gecko.Actions;
 import org.mozilla.gecko.GeckoProfile;
 import org.mozilla.gecko.home.HomePager;
+import org.mozilla.gecko.home.SearchEngineBar;
+import org.mozilla.gecko.R;
 
 import android.widget.ImageView;
-import android.widget.ListAdapter;
 import android.widget.ListView;
 
 import com.jayway.android.robotium.solo.Condition;
@@ -145,15 +146,17 @@ public class testAddSearchEngine extends AboutHomeTest {
         boolean correctNumSearchEnginesDisplayed = waitForCondition(new Condition() {
             @Override
             public boolean isSatisfied() {
-                ListView list = findListViewWithTag(HomePager.LIST_TAG_BROWSER_SEARCH);
-                if (list == null) {
+                ListView searchResultList = findListViewWithTag(HomePager.LIST_TAG_BROWSER_SEARCH);
+                if (searchResultList == null || searchResultList.getAdapter() == null) {
                     return false;
                 }
-                ListAdapter adapter = list.getAdapter();
-                if (adapter == null) {
+
+                SearchEngineBar searchEngineBar = (SearchEngineBar) mSolo.getView(R.id.search_engine_bar);
+                if (searchEngineBar == null || searchEngineBar.getAdapter() == null) {
                     return false;
                 }
-                return (adapter.getCount() == expectedCount);
+
+                return (searchResultList.getAdapter().getCount() + searchEngineBar.getAdapter().getCount() == expectedCount);
             }
         }, MAX_WAIT_TEST_MS);
 
diff --git a/modules/libjar/nsJARChannel.cpp b/modules/libjar/nsJARChannel.cpp
index 7addea33fa1d..304deba2e5c5 100644
--- a/modules/libjar/nsJARChannel.cpp
+++ b/modules/libjar/nsJARChannel.cpp
@@ -213,14 +213,7 @@ nsJARChannel::nsJARChannel()
 
 nsJARChannel::~nsJARChannel()
 {
-    if (mLoadInfo) {
-      nsCOMPtr<nsIThread> mainThread;
-      NS_GetMainThread(getter_AddRefs(mainThread));
-
-      nsILoadInfo *forgetableLoadInfo;
-      mLoadInfo.forget(&forgetableLoadInfo);
-      NS_ProxyRelease(mainThread, forgetableLoadInfo, false);
-    }
+    NS_ReleaseOnMainThread(mLoadInfo);
 
     // release owning reference to the jar handler
     nsJARProtocolHandler *handler = gJarHandler;
diff --git a/modules/libpref/init/all.js b/modules/libpref/init/all.js
index fe1498413430..720a6cac1e2e 100644
--- a/modules/libpref/init/all.js
+++ b/modules/libpref/init/all.js
@@ -791,6 +791,8 @@ pref("toolkit.identity.debug", false);
 
 // AsyncShutdown delay before crashing in case of shutdown freeze
 pref("toolkit.asyncshutdown.timeout.crash", 60000);
+// Extra logging for AsyncShutdown barriers and phases
+pref("toolkit.asyncshutdown.log", false);
 
 // Enable deprecation warnings.
 pref("devtools.errorconsole.deprecation_warnings", true);
@@ -1074,6 +1076,11 @@ pref("javascript.options.ion",              true);
 pref("javascript.options.asmjs",            true);
 pref("javascript.options.native_regexp",    true);
 pref("javascript.options.parallel_parsing", true);
+#if !defined(RELEASE_BUILD) && !defined(ANDROID) && !defined(MOZ_B2G) && !defined(XP_IOS)
+pref("javascript.options.asyncstack",       true);
+#else
+pref("javascript.options.asyncstack",       false);
+#endif
 pref("javascript.options.ion.offthread_compilation", true);
 // This preference instructs the JS engine to discard the
 // source of any privileged JS after compilation. This saves
diff --git a/netwerk/base/nsBaseChannel.cpp b/netwerk/base/nsBaseChannel.cpp
index 342048032283..7baffeedf731 100644
--- a/netwerk/base/nsBaseChannel.cpp
+++ b/netwerk/base/nsBaseChannel.cpp
@@ -69,14 +69,7 @@ nsBaseChannel::nsBaseChannel()
 
 nsBaseChannel::~nsBaseChannel()
 {
-  if (mLoadInfo) {
-    nsCOMPtr<nsIThread> mainThread;
-    NS_GetMainThread(getter_AddRefs(mainThread));
-    
-    nsILoadInfo *forgetableLoadInfo;
-    mLoadInfo.forget(&forgetableLoadInfo);
-    NS_ProxyRelease(mainThread, forgetableLoadInfo, false);
-  }
+  NS_ReleaseOnMainThread(mLoadInfo);
 }
 
 nsresult
diff --git a/netwerk/base/nsIBrowserSearchService.idl b/netwerk/base/nsIBrowserSearchService.idl
index d13f870d1b66..e8539a2021e9 100644
--- a/netwerk/base/nsIBrowserSearchService.idl
+++ b/netwerk/base/nsIBrowserSearchService.idl
@@ -253,7 +253,7 @@ interface nsIBrowserSearchInitObserver : nsISupports
   void onInitComplete(in nsresult aStatus);
 };
 
-[scriptable, uuid(75731859-c7b1-4edf-8d1c-3d4d79a55d1d)]
+[scriptable, uuid(150ef720-bbe2-4169-b9f3-ef7ec0654ced)]
 interface nsIBrowserSearchService : nsISupports
 {
   /**
@@ -450,6 +450,15 @@ interface nsIBrowserSearchService : nsISupports
    */
   attribute nsISearchEngine currentEngine;
 
+  /**
+   * Gets a representation of the default engine in an anonymized JSON
+   * string suitable for recording in the Telemetry environment.
+   *
+   * @return an object containing anonymized info about the default engine:
+   *         name, loadPath, submissionURL (for default engines).
+   */
+  jsval getDefaultEngineInfo();
+
   /**
    * Determines if the provided URL represents results from a search engine, and
    * provides details about the match.
diff --git a/netwerk/protocol/http/HttpBaseChannel.cpp b/netwerk/protocol/http/HttpBaseChannel.cpp
index 454bcd0e2e0a..c53b98b35d37 100644
--- a/netwerk/protocol/http/HttpBaseChannel.cpp
+++ b/netwerk/protocol/http/HttpBaseChannel.cpp
@@ -103,14 +103,7 @@ HttpBaseChannel::~HttpBaseChannel()
 {
   LOG(("Destroying HttpBaseChannel @%x\n", this));
 
-  if (mLoadInfo) {
-    nsCOMPtr<nsIThread> mainThread;
-    NS_GetMainThread(getter_AddRefs(mainThread));
-    
-    nsILoadInfo *forgetableLoadInfo;
-    mLoadInfo.forget(&forgetableLoadInfo);
-    NS_ProxyRelease(mainThread, forgetableLoadInfo, false);
-  }
+  NS_ReleaseOnMainThread(mLoadInfo);
 
   // Make sure we don't leak
   CleanRedirectCacheChainIfNecessary();
diff --git a/netwerk/protocol/websocket/WebSocketChannel.cpp b/netwerk/protocol/websocket/WebSocketChannel.cpp
index 856c397f4082..5016c1ad5704 100644
--- a/netwerk/protocol/websocket/WebSocketChannel.cpp
+++ b/netwerk/protocol/websocket/WebSocketChannel.cpp
@@ -1185,33 +1185,13 @@ WebSocketChannel::~WebSocketChannel()
   while ((mCurrentOut = (OutboundMessage *) mOutgoingMessages.PopFront()))
     delete mCurrentOut;
 
-  nsCOMPtr<nsIThread> mainThread;
-  nsIURI *forgettable;
-  NS_GetMainThread(getter_AddRefs(mainThread));
-
-  if (mURI) {
-    mURI.forget(&forgettable);
-    NS_ProxyRelease(mainThread, forgettable, false);
-  }
-
-  if (mOriginalURI) {
-    mOriginalURI.forget(&forgettable);
-    NS_ProxyRelease(mainThread, forgettable, false);
-  }
+  NS_ReleaseOnMainThread(mURI);
+  NS_ReleaseOnMainThread(mOriginalURI);
 
   mListenerMT = nullptr;
 
-  if (mLoadGroup) {
-    nsILoadGroup *forgettableGroup;
-    mLoadGroup.forget(&forgettableGroup);
-    NS_ProxyRelease(mainThread, forgettableGroup, false);
-  }
-
-  if (mLoadInfo) {
-    nsILoadInfo *forgetableLoadInfo;
-    mLoadInfo.forget(&forgetableLoadInfo);
-    NS_ProxyRelease(mainThread, forgetableLoadInfo, false);
-  }
+  NS_ReleaseOnMainThread(mLoadGroup);
+  NS_ReleaseOnMainThread(mLoadInfo);
 }
 
 NS_IMETHODIMP
diff --git a/netwerk/test/browser/browser_child_resource.js b/netwerk/test/browser/browser_child_resource.js
index c63fb17589cd..0e5ae9e611b1 100644
--- a/netwerk/test/browser/browser_child_resource.js
+++ b/netwerk/test/browser/browser_child_resource.js
@@ -138,7 +138,7 @@ let restart = Task.async(function*() {
 
   browser.reload();
 
-  yield waitForEvent(browser, "load", true);
+  yield BrowserTestUtils.browserLoaded(browser);
   is(browser.getAttribute("remote"), expectedRemote, "Browser should be in the right process");
   browser.messageManager.loadFrameScript("data:,(" + frameScript.toString() + ")();", true);
   return browser;
diff --git a/python/mozboot/mozboot/centos.py b/python/mozboot/mozboot/centos.py
index f2b68fe439a7..a9387845eb52 100644
--- a/python/mozboot/mozboot/centos.py
+++ b/python/mozboot/mozboot/centos.py
@@ -34,6 +34,7 @@ class CentOSBootstrapper(BaseBootstrapper):
         self.browser_packages = [
             'alsa-lib-devel',
             'dbus-glib-devel',
+            'GConf2-devel',
             'glibc-static',
             'gstreamer-devel',
             'gstreamer-plugins-base-devel',
diff --git a/python/mozboot/mozboot/fedora.py b/python/mozboot/mozboot/fedora.py
index beec2c9efb2a..360b6e4ae46e 100644
--- a/python/mozboot/mozboot/fedora.py
+++ b/python/mozboot/mozboot/fedora.py
@@ -29,6 +29,7 @@ class FedoraBootstrapper(BaseBootstrapper):
         self.browser_packages = [
             'alsa-lib-devel',
             'gcc-c++',
+            'GConf2-devel',
             'glibc-static',
             'gstreamer-devel',
             'gstreamer-plugins-base-devel',
diff --git a/security/manager/ssl/nsNSSCertificate.cpp b/security/manager/ssl/nsNSSCertificate.cpp
index 7687b95b56f0..2a10bb32c603 100644
--- a/security/manager/ssl/nsNSSCertificate.cpp
+++ b/security/manager/ssl/nsNSSCertificate.cpp
@@ -180,7 +180,7 @@ void nsNSSCertificate::destructorSafeDestroyNSSReference()
     if (mCertType == nsNSSCertificate::USER_CERT) {
       nsCOMPtr<nsIInterfaceRequestor> cxt = new PipUIContext();
       PK11_DeleteTokenCertAndKey(mCert.get(), cxt);
-    } else if (!PK11_IsReadOnly(mCert->slot)) {
+    } else if (mCert->slot && !PK11_IsReadOnly(mCert->slot)) {
       // If the list of built-ins does contain a non-removable
       // copy of this certificate, our call will not remove
       // the certificate permanently, but rather remove all trust.
@@ -225,12 +225,9 @@ nsNSSCertificate::MarkForPermDeletion()
   // make sure user is logged in to the token
   nsCOMPtr<nsIInterfaceRequestor> ctx = new PipUIContext();
 
-  if (PK11_NeedLogin(mCert->slot)
-      && !PK11_NeedUserInit(mCert->slot)
-      && !PK11_IsInternal(mCert->slot))
-  {
-    if (SECSuccess != PK11_Authenticate(mCert->slot, true, ctx))
-    {
+  if (mCert->slot && PK11_NeedLogin(mCert->slot) &&
+      !PK11_NeedUserInit(mCert->slot) && !PK11_IsInternal(mCert->slot)) {
+    if (SECSuccess != PK11_Authenticate(mCert->slot, true, ctx)) {
       return NS_ERROR_FAILURE;
     }
   }
diff --git a/testing/mochitest/BrowserTestUtils/BrowserTestUtils.jsm b/testing/mochitest/BrowserTestUtils/BrowserTestUtils.jsm
index ed753d36df34..80d3a681096a 100644
--- a/testing/mochitest/BrowserTestUtils/BrowserTestUtils.jsm
+++ b/testing/mochitest/BrowserTestUtils/BrowserTestUtils.jsm
@@ -28,6 +28,9 @@ Cc["@mozilla.org/globalmessagemanager;1"]
   .loadFrameScript(
     "chrome://mochikit/content/tests/BrowserTestUtils/content-utils.js", true);
 
+XPCOMUtils.defineLazyModuleGetter(this, "E10SUtils",
+  "resource:///modules/E10SUtils.jsm");
+
 this.BrowserTestUtils = {
   /**
    * Loads a page in a new tab, executes a Task and closes the tab.
@@ -140,17 +143,50 @@ this.BrowserTestUtils = {
    */
   browserLoaded(browser, includeSubFrames=false) {
     return new Promise(resolve => {
-      browser.messageManager.addMessageListener("browser-test-utils:loadEvent",
-                                                 function onLoad(msg) {
-        if (!msg.data.subframe || includeSubFrames) {
-          browser.messageManager.removeMessageListener(
-            "browser-test-utils:loadEvent", onLoad);
+      let mm = browser.ownerDocument.defaultView.messageManager;
+      mm.addMessageListener("browser-test-utils:loadEvent", function onLoad(msg) {
+        if (msg.target == browser && (!msg.data.subframe || includeSubFrames)) {
+          mm.removeMessageListener("browser-test-utils:loadEvent", onLoad);
           resolve();
         }
       });
     });
   },
 
+  /**
+   * Loads a new URI in the given browser and waits until we really started
+   * loading. In e10s browser.loadURI() can be an asynchronous operation due
+   * to having to switch the browser's remoteness and keep its shistory data.
+   *
+   * @param {xul:browser} browser
+   *        A xul:browser.
+   * @param {string} uri
+   *        The URI to load.
+   *
+   * @return {Promise}
+   * @resolves When we started loading the given URI.
+   */
+  loadURI: Task.async(function* (browser, uri) {
+    // Load the new URI.
+    browser.loadURI(uri);
+
+    // Nothing to do in non-e10s mode.
+    if (!browser.ownerDocument.defaultView.gMultiProcessBrowser) {
+      return;
+    }
+
+    // Retrieve the given browser's current process type.
+    let process = browser.isRemoteBrowser ? Ci.nsIXULRuntime.PROCESS_TYPE_CONTENT
+                                          : Ci.nsIXULRuntime.PROCESS_TYPE_DEFAULT;
+
+    // If the new URI can't load in the browser's current process then we
+    // should wait for the new frameLoader to be created. This will happen
+    // asynchronously when the browser's remoteness changes.
+    if (!E10SUtils.canLoadURIInProcess(uri, process)) {
+      yield this.waitForEvent(browser, "XULFrameLoaderCreated");
+    }
+  }),
+
   /**
    * @return {Promise}
    *         A Promise which resolves when a "domwindowopened" notification
diff --git a/testing/mochitest/browser-test.js b/testing/mochitest/browser-test.js
index 46ca94f4201e..7258f21c4990 100644
--- a/testing/mochitest/browser-test.js
+++ b/testing/mochitest/browser-test.js
@@ -461,7 +461,7 @@ Tester.prototype = {
         if (this._globalProperties.indexOf(prop) == -1) {
           this._globalProperties.push(prop);
           if (this._globalPropertyWhitelist.indexOf(prop) == -1)
-            this.currentTest.addResult(new testResult(false, "leaked window property: " + prop, "", false));
+            this.currentTest.addResult(new testResult(false, "test left unexpected property on window: " + prop, "", false));
         }
       }, this);
 
diff --git a/testing/mozbase/mozdevice/mozdevice/devicemanagerADB.py b/testing/mozbase/mozdevice/mozdevice/devicemanagerADB.py
index a05092fd8fdc..dd6fd4037eb0 100644
--- a/testing/mozbase/mozdevice/mozdevice/devicemanagerADB.py
+++ b/testing/mozbase/mozdevice/mozdevice/devicemanagerADB.py
@@ -134,11 +134,11 @@ class DeviceManagerADB(DeviceManager):
             args.extend(['-s', self._deviceSerial])
         args.extend(["shell", cmdline])
 
-        def _raise():
-            raise DMError("Timeout exceeded for shell call")
+        def _timeout():
+            self._logger.error("Timeout exceeded for shell call '%s'" % ' '.join(args))
 
         self._logger.debug("shell - command: %s" % ' '.join(args))
-        proc = ProcessHandler(args, processOutputLine=self._log, onTimeout=_raise)
+        proc = ProcessHandler(args, processOutputLine=self._log, onTimeout=_timeout)
 
         if not timeout:
             # We are asserting that all commands will complete in this time unless otherwise specified
@@ -591,10 +591,13 @@ class DeviceManagerADB(DeviceManager):
             # time unless otherwise specified
             timeout = self.default_timeout
 
+        def _timeout():
+            self._logger.error("Timeout exceeded for _checkCmd call '%s'" % ' '.join(finalArgs))
+
         timeout = int(timeout)
         retries = 0
         while retries < retryLimit:
-            proc = ProcessHandler(finalArgs, processOutputLine=self._log)
+            proc = ProcessHandler(finalArgs, processOutputLine=self._log, onTimeout=_timeout)
             proc.run(timeout=timeout)
             ret_code = proc.wait()
             if ret_code == None:
diff --git a/testing/mozharness/mozharness.json b/testing/mozharness/mozharness.json
index 6f00dd88b192..2e002bc1820f 100644
--- a/testing/mozharness/mozharness.json
+++ b/testing/mozharness/mozharness.json
@@ -1,4 +1,4 @@
 {
     "repo": "https://hg.mozilla.org/build/mozharness",
-    "revision": "1a041ea00cf3"
+    "revision": "a64e1cbfb998"
 }
diff --git a/toolkit/components/asyncshutdown/AsyncShutdown.jsm b/toolkit/components/asyncshutdown/AsyncShutdown.jsm
index 9e06795141f0..91d250324efe 100644
--- a/toolkit/components/asyncshutdown/AsyncShutdown.jsm
+++ b/toolkit/components/asyncshutdown/AsyncShutdown.jsm
@@ -196,6 +196,22 @@ function log(msg, prefix = "", error = null) {
     }
   }
 }
+const PREF_DEBUG_LOG = "toolkit.asyncshutdown.log";
+let DEBUG_LOG = false;
+try {
+  DEBUG_LOG = Services.prefs.getBoolPref(PREF_DEBUG_LOG);
+} catch (ex) {
+  // Ignore errors
+}
+Services.prefs.addObserver(PREF_DEBUG_LOG, function() {
+  DEBUG_LOG = Services.prefs.getBoolPref(PREF_DEBUG_LOG);
+}, false);
+
+function debug(msg, error=null) {
+  if (DEBUG_LOG) {
+    return log(msg, "DEBUG: ", error);
+  }
+}
 function warn(msg, error = null) {
   return log(msg, "WARNING: ", error);
 }
@@ -511,6 +527,7 @@ Spinner.prototype = {
         Promise.reject(ex);
       }
     }
+    debug(`Finished phase ${ topic }`);
   }
 };
 
@@ -644,6 +661,7 @@ function Barrier(name) {
       if (!this._waitForMe) {
         throw new Error(`Phase "${ this._name } is finished, it is too late to register completion condition "${ name }"`);
       }
+      debug(`Adding blocker ${ name } for phase ${ this._name }`);
 
       // Normalize the details
 
@@ -711,9 +729,10 @@ function Barrier(name) {
       // As conditions may hold lots of memory, we attempt to cleanup
       // as soon as we are done (which might be in the next tick, if
       // we have been passed a resolved promise).
-      promise = promise.then(() =>
-        this._removeBlocker(condition)
-      );
+      promise = promise.then(() => {
+        debug(`Completed blocker ${ name } for phase ${ this._name }`);
+        this._removeBlocker(condition);
+      });
 
       if (this._isStarted) {
         // The wait has already started. The blocker should be
diff --git a/toolkit/components/crashes/CrashManager.jsm b/toolkit/components/crashes/CrashManager.jsm
index 064ef2c4175c..f8fb07264f76 100644
--- a/toolkit/components/crashes/CrashManager.jsm
+++ b/toolkit/components/crashes/CrashManager.jsm
@@ -5,15 +5,17 @@
 "use strict";
 
 const {classes: Cc, interfaces: Ci, utils: Cu} = Components;
+const myScope = this;
 
 Cu.import("resource://gre/modules/Log.jsm", this);
-Cu.import("resource://gre/modules/osfile.jsm", this)
+Cu.import("resource://gre/modules/osfile.jsm", this);
 Cu.import("resource://gre/modules/Promise.jsm", this);
 Cu.import("resource://gre/modules/Services.jsm", this);
 Cu.import("resource://gre/modules/Task.jsm", this);
 Cu.import("resource://gre/modules/Timer.jsm", this);
 Cu.import("resource://gre/modules/XPCOMUtils.jsm", this);
 Cu.import("resource://services-common/utils.js", this);
+Cu.import("resource://gre/modules/TelemetryController.jsm");
 
 this.EXPORTED_SYMBOLS = [
   "CrashManager",
@@ -529,6 +531,32 @@ this.CrashManager.prototype = Object.freeze({
           }
           store.addCrash(this.PROCESS_TYPE_MAIN, this.CRASH_TYPE_CRASH,
                          crashID, date, metadata);
+
+          // If we have a saved environment, use it. Otherwise report
+          // the current environment.
+          let crashEnvironment = null;
+          let reportMeta = Cu.cloneInto(metadata, myScope);
+          if ('TelemetryEnvironment' in reportMeta) {
+            try {
+              crashEnvironment = JSON.parse(reportMeta.TelemetryEnvironment);
+            } catch(e) {
+              Cu.reportError(e);
+            }
+            delete reportMeta.TelemetryEnvironment;
+          }
+          TelemetryController.submitExternalPing("crash",
+            {
+              version: 1,
+              crashDate: date.toISOString().slice(0, 10), // YYYY-MM-DD
+              metadata: reportMeta,
+              hasCrashEnvironment: (crashEnvironment !== null),
+            },
+            {
+              retentionDays: 180,
+              addClientId: true,
+              addEnvironment: true,
+              overrideEnvironment: crashEnvironment,
+            });
           break;
 
         case "crash.submission.1":
@@ -773,14 +801,10 @@ CrashStore.prototype = Object.freeze({
         // with "-submission", we will need to convert the data to be stored
         // as actual submissions.
         //
-        // TODO: The old way of storing submissions was used from FF33 - FF34.
-        // We should drop the conversion code after a few releases. See bug
-        // 1056157.
-        let hasSubmissionsStoredAsCrashes = false;
-
+        // The old way of storing submissions was used from FF33 - FF34. We
+        // drop this old data on the floor.
         for (let id in data.crashes) {
           if (id.endsWith("-submission")) {
-            hasSubmissionsStoredAsCrashes = true;
             continue;
           }
 
@@ -811,32 +835,6 @@ CrashStore.prototype = Object.freeze({
 
         }
 
-        if (hasSubmissionsStoredAsCrashes) {
-          for (let id in data.crashes) {
-            if (!id.endsWith("-submission")) {
-              continue;
-            }
-
-            // This type of record will contain e.g.:
-            // {
-            //   "id": "crash1-submission",
-            //   "type": "main-crash-submission-succeeded",
-            //   "crashDate": "...",
-            // }
-            let submissionData = this._denormalize(data.crashes[id]);
-
-            let crashID = id.replace(/-submission$/, "");
-            let result = submissionData.type.endsWith("-succeeded") ?
-              CrashManager.prototype.SUBMISSION_RESULT_OK :
-              CrashManager.prototype.SUBMISSION_RESULT_FAILED;
-
-            this.addSubmissionAttempt(crashID, "converted",
-                                      submissionData.crashDate);
-            this.addSubmissionResult(crashID, "converted",
-                                     submissionData.crashDate, result);
-          }
-        }
-
         // The validation in this loop is arguably not necessary. We perform
         // it as a defense against unknown bugs.
         for (let dayKey in data.countsByDay) {
@@ -1159,22 +1157,9 @@ CrashStore.prototype = Object.freeze({
     return crashes;
   },
 
-  /**
-   * Obtain a particular crash submission from its ID.
-   *
-   * @return undefined | submission object
-   */
-  getSubmission: function (crashID, submissionID) {
-    let crash = this._data.crashes.get(crashID);
-    if (!crash || !submissionID) {
-      return undefined;
-    }
-
-    return crash.submissions.get(submissionID);
-  },
-
   /**
    * Ensure the submission record is present in storage.
+   * @returns [submission, crash]
    */
   _ensureSubmissionRecord: function (crashID, submissionID) {
     let crash = this._data.crashes.get(crashID);
@@ -1190,19 +1175,22 @@ CrashStore.prototype = Object.freeze({
       });
     }
 
-    return crash.submissions.get(submissionID);
+    return [crash.submissions.get(submissionID), crash];
   },
 
   /**
    * @return boolean True if the attempt was recorded.
    */
   addSubmissionAttempt: function (crashID, submissionID, date) {
-    let submission = this._ensureSubmissionRecord(crashID, submissionID);
+    let [submission, crash] =
+      this._ensureSubmissionRecord(crashID, submissionID);
     if (!submission) {
       return false;
     }
 
     submission.requestDate = date;
+    Services.telemetry.getKeyedHistogramById("PROCESS_CRASH_SUBMIT_ATTEMPT")
+      .add(crash.type, 1);
     return true;
   },
 
@@ -1210,13 +1198,19 @@ CrashStore.prototype = Object.freeze({
    * @return boolean True if the response was recorded.
    */
   addSubmissionResult: function (crashID, submissionID, date, result) {
-    let submission = this.getSubmission(crashID, submissionID);
+    let crash = this._data.crashes.get(crashID);
+    if (!crash || !submissionID) {
+      return false;
+    }
+    let submission = crash.submissions.get(submissionID);
     if (!submission) {
       return false;
     }
 
     submission.responseDate = date;
     submission.result = result;
+    Services.telemetry.getKeyedHistogramById("PROCESS_CRASH_SUBMIT_SUCCESS")
+      .add(crash.type, result == "ok");
     return true;
   },
 
diff --git a/toolkit/components/crashes/tests/xpcshell/test_crash_manager.js b/toolkit/components/crashes/tests/xpcshell/test_crash_manager.js
index 88579210c316..6904b91e132a 100644
--- a/toolkit/components/crashes/tests/xpcshell/test_crash_manager.js
+++ b/toolkit/components/crashes/tests/xpcshell/test_crash_manager.js
@@ -9,8 +9,10 @@ let bsp = Cu.import("resource://gre/modules/CrashManager.jsm", this);
 Cu.import("resource://gre/modules/Promise.jsm", this);
 Cu.import("resource://gre/modules/Task.jsm", this);
 Cu.import("resource://gre/modules/osfile.jsm", this);
+Cu.import("resource://gre/modules/TelemetryEnvironment.jsm", this);
 
 Cu.import("resource://testing-common/CrashManagerTest.jsm", this);
+Cu.import("resource://testing-common/TelemetryArchiveTesting.jsm", this);
 
 const DUMMY_DATE = new Date(Date.now() - 10 * 24 * 60 * 60 * 1000);
 DUMMY_DATE.setMilliseconds(0);
@@ -21,6 +23,7 @@ DUMMY_DATE_2.setMilliseconds(0);
 function run_test() {
   do_get_profile();
   configureLogging();
+  TelemetryArchiveTesting.setup();
   run_next_test();
 }
 
@@ -207,8 +210,12 @@ add_task(function* test_schedule_maintenance() {
 });
 
 add_task(function* test_main_crash_event_file() {
+  let ac = new TelemetryArchiveTesting.Checker();
+  yield ac.promiseInit();
+  let theEnvironment = TelemetryEnvironment.currentEnvironment;
+
   let m = yield getManager();
-  yield m.createEventsFile("1", "crash.main.2", DUMMY_DATE, "id1\nk1=v1\nk2=v2");
+  yield m.createEventsFile("1", "crash.main.2", DUMMY_DATE, "id1\nk1=v1\nk2=v2\nTelemetryEnvironment=" + JSON.stringify(theEnvironment));
   let count = yield m.aggregateEventsFiles();
   Assert.equal(count, 1);
 
@@ -216,9 +223,46 @@ add_task(function* test_main_crash_event_file() {
   Assert.equal(crashes.length, 1);
   Assert.equal(crashes[0].id, "id1");
   Assert.equal(crashes[0].type, "main-crash");
-  Assert.deepEqual(crashes[0].metadata, { k1: "v1", k2: "v2"});
+  Assert.equal(crashes[0].metadata.k1, "v1");
+  Assert.equal(crashes[0].metadata.k2, "v2");
+  Assert.ok(crashes[0].metadata.TelemetryEnvironment);
+  Assert.equal(Object.getOwnPropertyNames(crashes[0].metadata).length, 3);
   Assert.deepEqual(crashes[0].crashDate, DUMMY_DATE);
 
+  let found = yield ac.promiseFindPing("crash", [
+    [["payload", "hasCrashEnvironment"], true],
+    [["payload", "metadata", "k1"], "v1"],
+  ]);
+  Assert.ok(found, "Telemetry ping submitted for found crash");
+  Assert.deepEqual(found.environment, theEnvironment, "The saved environment should be present");
+
+  count = yield m.aggregateEventsFiles();
+  Assert.equal(count, 0);
+});
+
+add_task(function* test_main_crash_event_file_noenv() {
+  let ac = new TelemetryArchiveTesting.Checker();
+  yield ac.promiseInit();
+
+  let m = yield getManager();
+  yield m.createEventsFile("1", "crash.main.2", DUMMY_DATE, "id1\nk1=v3\nk2=v2");
+  let count = yield m.aggregateEventsFiles();
+  Assert.equal(count, 1);
+
+  let crashes = yield m.getCrashes();
+  Assert.equal(crashes.length, 1);
+  Assert.equal(crashes[0].id, "id1");
+  Assert.equal(crashes[0].type, "main-crash");
+  Assert.deepEqual(crashes[0].metadata, { k1: "v3", k2: "v2"});
+  Assert.deepEqual(crashes[0].crashDate, DUMMY_DATE);
+
+  let found = yield ac.promiseFindPing("crash", [
+    [["payload", "hasCrashEnvironment"], false],
+    [["payload", "metadata", "k1"], "v3"],
+  ]);
+  Assert.ok(found, "Telemetry ping submitted for found crash");
+  Assert.ok(found.environment, "There is an environment");
+
   count = yield m.aggregateEventsFiles();
   Assert.equal(count, 0);
 });
diff --git a/toolkit/components/crashes/tests/xpcshell/test_crash_store.js b/toolkit/components/crashes/tests/xpcshell/test_crash_store.js
index 50c2c8669835..8d59119e3740 100644
--- a/toolkit/components/crashes/tests/xpcshell/test_crash_store.js
+++ b/toolkit/components/crashes/tests/xpcshell/test_crash_store.js
@@ -492,17 +492,6 @@ add_task(function* test_high_water() {
                s.HIGH_WATER_DAILY_THRESHOLD + 1);
 });
 
-add_task(function* test_getSubmission() {
-  let s = yield getStore();
-
-  Assert.equal(s.getSubmission("crash1", "sub1"), undefined);
-  Assert.ok(s.addCrash(PROCESS_TYPE_MAIN, CRASH_TYPE_CRASH, "crash1",
-                       DUMMY_DATE));
-  Assert.equal(s.getSubmission("crash1", "sub1"), undefined);
-  Assert.ok(s.addSubmissionAttempt("crash1", "sub1", DUMMY_DATE));
-  Assert.ok(s.getSubmission("crash1", "sub1"));
-});
-
 add_task(function* test_addSubmission() {
   let s = yield getStore();
 
@@ -511,7 +500,8 @@ add_task(function* test_addSubmission() {
 
   Assert.ok(s.addSubmissionAttempt("crash1", "sub1", DUMMY_DATE));
 
-  let submission = s.getSubmission("crash1", "sub1");
+  let crash = s.getCrash("crash1");
+  let submission = crash.submissions.get("sub1");
   Assert.ok(!!submission);
   Assert.equal(submission.requestDate.getTime(), DUMMY_DATE.getTime());
   Assert.equal(submission.responseDate, null);
@@ -520,7 +510,9 @@ add_task(function* test_addSubmission() {
   Assert.ok(s.addSubmissionResult("crash1", "sub1", DUMMY_DATE_2,
                                   SUBMISSION_RESULT_FAILED));
 
-  submission = s.getSubmission("crash1", "sub1");
+  crash = s.getCrash("crash1");
+  Assert.equal(crash.submissions.size, 1);
+  submission = crash.submissions.get("sub1");
   Assert.ok(!!submission);
   Assert.equal(submission.requestDate.getTime(), DUMMY_DATE.getTime());
   Assert.equal(submission.responseDate.getTime(), DUMMY_DATE_2.getTime());
@@ -530,49 +522,12 @@ add_task(function* test_addSubmission() {
   Assert.ok(s.addSubmissionResult("crash1", "sub2", DUMMY_DATE_2,
                                   SUBMISSION_RESULT_OK));
 
-  submission = s.getSubmission("crash1", "sub2");
+  Assert.equal(crash.submissions.size, 2);
+  submission = crash.submissions.get("sub2");
   Assert.ok(!!submission);
   Assert.equal(submission.result, SUBMISSION_RESULT_OK);
 });
 
-add_task(function* test_convertSubmissionsStoredAsCrashes() {
-  let s = yield getStore();
-
-  let addSubmissionAsCrash = (processType, crashType, succeeded, id, date) => {
-    id = id + "-submission";
-    let process = processType + "-" + crashType + "-submission";
-    let submissionType = succeeded ? "succeeded" : "failed";
-    return s.addCrash(process, submissionType, id, date);
-  };
-
-  Assert.ok(s.addCrash(PROCESS_TYPE_MAIN, CRASH_TYPE_CRASH, "crash1",
-                       new Date()));
-  Assert.ok(addSubmissionAsCrash(PROCESS_TYPE_MAIN, CRASH_TYPE_CRASH, true,
-                                 "crash1", DUMMY_DATE));
-
-  Assert.ok(s.addCrash(PROCESS_TYPE_PLUGIN, CRASH_TYPE_HANG, "hang1",
-                       new Date()));
-  Assert.ok(addSubmissionAsCrash(PROCESS_TYPE_PLUGIN, CRASH_TYPE_HANG, false,
-                                 "hang1", DUMMY_DATE_2));
-
-  Assert.equal(s.crashes.length, 4);
-  yield s.save();
-  yield s.load();
-  Assert.equal(s.crashes.length, 2);
-
-  let submission = s.getSubmission("crash1", "converted");
-  Assert.ok(!!submission);
-  Assert.equal(submission.result, SUBMISSION_RESULT_OK);
-  Assert.equal(submission.requestDate.getTime(), DUMMY_DATE.getTime());
-  Assert.equal(submission.responseDate.getTime(), DUMMY_DATE.getTime());
-
-  submission = s.getSubmission("hang1", "converted");
-  Assert.ok(!!submission);
-  Assert.equal(submission.result, SUBMISSION_RESULT_FAILED);
-  Assert.equal(submission.requestDate.getTime(), DUMMY_DATE_2.getTime());
-  Assert.equal(submission.responseDate.getTime(), DUMMY_DATE_2.getTime());
-});
-
 add_task(function* test_setCrashClassification() {
   let s = yield getStore();
 
diff --git a/toolkit/components/passwordmgr/LoginDoorhangers.jsm b/toolkit/components/passwordmgr/LoginDoorhangers.jsm
index 58b420a8619f..1379ca0ce089 100644
--- a/toolkit/components/passwordmgr/LoginDoorhangers.jsm
+++ b/toolkit/components/passwordmgr/LoginDoorhangers.jsm
@@ -15,6 +15,16 @@ Cu.import("resource://gre/modules/LoginManagerParent.jsm");
 
 const XUL_NS = "http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul";
 
+// Helper function needed because the "disabled" property may not be available
+// if the XBL binding of the UI control has not been constructed yet.
+function setDisabled(element, disabled) {
+  if (disabled) {
+    element.setAttribute("disabled", "true");
+  } else {
+    element.removeAttribute("disabled");
+  }
+}
+
 this.LoginDoorhangers = {};
 
 /**
@@ -24,10 +34,20 @@ this.LoginDoorhangers = {};
  *        Properties from this object will be applied to the new instance.
  */
 this.LoginDoorhangers.FillDoorhanger = function (properties) {
-  this.onFilterInput = this.onFilterInput.bind(this);
-  this.onListDblClick = this.onListDblClick.bind(this);
-  this.onListKeyPress = this.onListKeyPress.bind(this);
-
+  // Set up infrastructure to access our elements and listen to events.
+  this.el = new Proxy({}, {
+    get: (target, name) => {
+      return this.chromeDocument.getElementById("login-fill-" + name);
+    },
+  });
+  this.eventHandlers = [];
+  for (let elementName of Object.keys(this.events)) {
+    let handlers = this.events[elementName];
+    for (let eventName of Object.keys(handlers)) {
+      let handler = handlers[eventName];
+      this.eventHandlers.push([elementName, eventName, handler.bind(this)]);
+    }
+  };
   for (let name of Object.getOwnPropertyNames(properties)) {
     this[name] = properties[name];
   }
@@ -52,7 +72,7 @@ this.LoginDoorhangers.FillDoorhanger.prototype = {
     this._browser = browser;
 
     let doorhanger = this;
-    let PopupNotifications = this.chomeDocument.defaultView.PopupNotifications;
+    let PopupNotifications = this.chromeDocument.defaultView.PopupNotifications;
     let notification = PopupNotifications.show(
       browser,
       "login-fill",
@@ -71,8 +91,7 @@ this.LoginDoorhangers.FillDoorhanger.prototype = {
             case "shown":
               // Since we specified the "dismissed" option, this event will only
               // be called after the "show" method returns, so the reference to
-              // "this.notification" will be available at this point.
-              doorhanger.bound = true;
+              // "this.notification" will be available in "bind" at this point.
               doorhanger.promiseHidden =
                          new Promise(resolve => doorhanger.onUnbind = resolve);
               doorhanger.bind();
@@ -109,7 +128,7 @@ this.LoginDoorhangers.FillDoorhanger.prototype = {
    * This may change during the lifetime of the doorhanger, in case the web page
    * is moved to a different chrome window by the swapDocShells method.
    */
-  get chomeDocument() {
+  get chromeDocument() {
     return this.browser.ownerDocument;
   },
 
@@ -117,7 +136,7 @@ this.LoginDoorhangers.FillDoorhanger.prototype = {
    * Hides this notification, if the notification panel is currently open.
    */
   hide() {
-    let PopupNotifications = this.chomeDocument.defaultView.PopupNotifications;
+    let PopupNotifications = this.chromeDocument.defaultView.PopupNotifications;
     if (PopupNotifications.isPanelOpen) {
       PopupNotifications.panel.hidePopup();
     }
@@ -139,36 +158,47 @@ this.LoginDoorhangers.FillDoorhanger.prototype = {
    * Binds this doorhanger to its UI controls.
    */
   bind() {
-    this.element = this.chomeDocument.getElementById("login-fill-doorhanger");
-    this.list = this.chomeDocument.getElementById("login-fill-list");
-    this.filter = this.chomeDocument.getElementById("login-fill-filter");
-
-    this.filter.setAttribute("value", this.filterString);
+    // Since this may ask for the master password, we must do it at bind time.
+    if (this.autoDetailLogin) {
+      let formLogins = Services.logins.findLogins({}, this.loginFormOrigin, "",
+                                                  null);
+      if (formLogins.length == 1) {
+        this.detailLogin = formLogins[0];
+      }
+      this.autoDetailLogin = false;
+    }
 
+    this.el.filter.setAttribute("value", this.filterString);
     this.refreshList();
+    this.refreshDetailView();
 
-    this.filter.addEventListener("input", this.onFilterInput);
-    this.list.addEventListener("dblclick", this.onListDblClick);
-    this.list.addEventListener("keypress", this.onListKeyPress);
+    this.eventHandlers.forEach(([elementName, eventName, handler]) => {
+      this.el[elementName].addEventListener(eventName, handler, true);
+    });
 
     // Move the main element to the notification panel for displaying.
-    this.notification.owner.panel.firstElementChild.appendChild(this.element);
-    this.element.hidden = false;
+    this.notification.owner.panel.firstElementChild.appendChild(this.el.doorhanger);
+    this.el.doorhanger.hidden = false;
+
+    this.bound = true;
   },
 
   /**
    * Unbinds this doorhanger from its UI controls.
    */
   unbind() {
-    this.filter.removeEventListener("input", this.onFilterInput);
-    this.list.removeEventListener("dblclick", this.onListDblClick);
-    this.list.removeEventListener("keypress", this.onListKeyPress);
+    this.bound = false;
+
+    this.eventHandlers.forEach(([elementName, eventName, handler]) => {
+      this.el[elementName].removeEventListener(eventName, handler, true);
+    });
 
     this.clearList();
 
     // Place the element back in the document for the next time we need it.
-    this.element.hidden = true;
-    this.chomeDocument.getElementById("mainPopupSet").appendChild(this.element);
+    this.el.doorhanger.hidden = true;
+    this.chromeDocument.getElementById("mainPopupSet")
+                       .appendChild(this.el.doorhanger);
   },
 
   /**
@@ -189,11 +219,78 @@ this.LoginDoorhangers.FillDoorhanger.prototype = {
   filterString: "",
 
   /**
-   * Handles text changes in the filter textbox.
+   * Show login details automatically when the panel is first opened.
    */
-  onFilterInput() {
-    this.filterString = this.filter.value;
-    this.refreshList();
+  autoDetailLogin: false,
+
+  /**
+   * Indicates which particular login to show in the detail view.
+   */
+  set detailLogin(detailLogin) {
+    this._detailLogin = detailLogin;
+    if (this.bound) {
+      this.refreshDetailView();
+    }
+  },
+  get detailLogin() {
+    return this._detailLogin;
+  },
+  _detailLogin: null,
+
+  /**
+   * Prototype functions for event handling.
+   */
+  events: {
+    mainview: {
+      focus(event) {
+        // If keyboard focus returns to any control in the the main view (for
+        // example using SHIFT+TAB) close the details view.
+        this.detailLogin = null;
+      },
+    },
+    filter: {
+      input(event) {
+        this.filterString = this.el.filter.value;
+        this.refreshList();
+      },
+    },
+    list: {
+      click(event) {
+        if (event.button == 0 && this.el.list.selectedItem) {
+          this.displaySelectedLoginDetails();
+        }
+      },
+      keypress(event) {
+        if (event.keyCode == Ci.nsIDOMKeyEvent.DOM_VK_RETURN &&
+            this.el.list.selectedItem) {
+          this.displaySelectedLoginDetails();
+        }
+      },
+    },
+    clickcapturer: {
+      click(event) {
+        this.detailLogin = null;
+      },
+    },
+    details: {
+      transitionend(event) {
+        // We must set focus to the detail controls only when the transition has
+        // ended, otherwise focus will interfere with the animation. We do this
+        // only when we're showing the detail view, not when leaving.
+        if (event.target == this.el.details && this.detailLogin) {
+          if (this.loginFormPresent) {
+            this.el.use.focus();
+          } else {
+            this.el.username.focus();
+          }
+        }
+      },
+    },
+    use: {
+      command(event) {
+        this.fillLogin();
+      },
+    },
   },
 
   /**
@@ -212,17 +309,14 @@ this.LoginDoorhangers.FillDoorhanger.prototype = {
     }
 
     for (let { hostname, username } of formLogins) {
-      let item = this.chomeDocument.createElementNS(XUL_NS, "richlistitem");
+      let item = this.chromeDocument.createElementNS(XUL_NS, "richlistitem");
       item.classList.add("login-fill-item");
       item.setAttribute("hostname", hostname);
       item.setAttribute("username", username);
       if (hostname != this.loginFormOrigin) {
         item.classList.add("different-hostname");
       }
-      if (!this.loginFormPresent) {
-        item.setAttribute("disabled", "true");
-      }
-      this.list.appendChild(item);
+      this.el.list.appendChild(item);
     }
   },
 
@@ -230,45 +324,51 @@ this.LoginDoorhangers.FillDoorhanger.prototype = {
    * Clears the list of logins.
    */
   clearList() {
-    while (this.list.firstChild) {
-      this.list.removeChild(this.list.firstChild);
+    let list = this.el.list;
+    while (list.firstChild) {
+      list.firstChild.remove();
     }
   },
 
   /**
-   * Handles the action associated to a login item.
+   * Updates all the controls of the detail view based on the chosen login.
    */
-  onListDblClick(event) {
-    if (event.button != 0 || !this.list.selectedItem) {
-      return;
-    }
-    this.fillLogin();
-  },
-  onListKeyPress(event) {
-    if (event.keyCode != Ci.nsIDOMKeyEvent.DOM_VK_RETURN ||
-        !this.list.selectedItem) {
-      return;
-    }
-    this.fillLogin();
-  },
-  fillLogin() {
-    if (this.list.selectedItem.hasAttribute("disabled")) {
-      return;
-    }
-    let formLogins = Services.logins.findLogins({}, "", "", null);
-    let login = formLogins.find(login => {
-      return login.hostname == this.list.selectedItem.getAttribute("hostname") &&
-             login.username == this.list.selectedItem.getAttribute("username");
-    });
-    if (login) {
-      LoginManagerParent.fillForm({
-        browser: this.browser,
-        loginFormOrigin: this.loginFormOrigin,
-        login,
-      }).catch(Cu.reportError);
+  refreshDetailView() {
+    if (this.detailLogin) {
+      this.el.username.setAttribute("value", this.detailLogin.username);
+      this.el.password.setAttribute("value", this.detailLogin.password);
+      this.el.doorhanger.setAttribute("inDetailView", "true");
+      setDisabled(this.el.username, false);
+      setDisabled(this.el.use, !this.loginFormPresent);
     } else {
-      Cu.reportError("The selected login has been removed in the meantime.");
+      this.el.doorhanger.removeAttribute("inDetailView");
+      // We must disable all the detail controls to ensure they cannot be
+      // selected with the keyboard while they are outside the visible area.
+      setDisabled(this.el.username, true);
+      setDisabled(this.el.use, true);
     }
+  },
+
+  displaySelectedLoginDetails() {
+    let selectedItem = this.el.list.selectedItem;
+    let hostLogins = Services.logins.findLogins({},
+                               selectedItem.getAttribute("hostname"), "", null);
+    let login = hostLogins.find(login => {
+      return login.username == selectedItem.getAttribute("username");
+    });
+    if (!login) {
+      Cu.reportError("The selected login has been removed in the meantime.");
+      return;
+    }
+    this.detailLogin = login;
+  },
+
+  fillLogin() {
+    LoginManagerParent.fillForm({
+      browser: this.browser,
+      loginFormOrigin: this.loginFormOrigin,
+      login: this.detailLogin,
+    }).catch(Cu.reportError);
     this.hide();
   },
 };
diff --git a/toolkit/components/passwordmgr/LoginManagerParent.jsm b/toolkit/components/passwordmgr/LoginManagerParent.jsm
index fb68cb0252fb..0e60cb10e786 100644
--- a/toolkit/components/passwordmgr/LoginManagerParent.jsm
+++ b/toolkit/components/passwordmgr/LoginManagerParent.jsm
@@ -607,7 +607,9 @@ var LoginManagerParent = {
       yield fillDoorhanger.promiseHidden;
       fillDoorhanger.loginFormPresent = loginFormPresent;
       fillDoorhanger.loginFormOrigin = loginFormOrigin;
-      fillDoorhanger.filterString = loginFormOrigin;
+      fillDoorhanger.filterString = hasLogins ? loginFormOrigin : "";
+      fillDoorhanger.detailLogin = null;
+      fillDoorhanger.autoDetailLogin = true;
       return;
     }
     if (showLoginAnchor) {
@@ -615,7 +617,8 @@ var LoginManagerParent = {
         browser,
         loginFormPresent,
         loginFormOrigin,
-        filterString: loginFormOrigin,
+        filterString: hasLogins ? loginFormOrigin : "",
+        autoDetailLogin: true,
       });
     }
   }),
diff --git a/toolkit/components/passwordmgr/test/browser/browser_filldoorhanger.js b/toolkit/components/passwordmgr/test/browser/browser_filldoorhanger.js
index 4f183f53e6d5..85f5d667fbe9 100644
--- a/toolkit/components/passwordmgr/test/browser/browser_filldoorhanger.js
+++ b/toolkit/components/passwordmgr/test/browser/browser_filldoorhanger.js
@@ -51,10 +51,20 @@ add_task(function* test_fill() {
     Assert.equal(list.childNodes.length, 1,
                  "list.childNodes.length === 1");
 
+    // The button will be focused after the "transitionend" event.
+    list.focus();
+    yield new Promise(resolve => executeSoon(resolve));
+    let details = document.getElementById("login-fill-details");
+    let promiseSubview = BrowserTestUtils.waitForEvent(details,
+                                                       "transitionend", true,
+                                                       e => e.target == details);
+    EventUtils.sendMouseEvent({ type: "click" }, list.childNodes[0]);
+    yield promiseSubview;
+
+    // Clicking the button will dismiss the panel.
     let promiseHidden = BrowserTestUtils.waitForEvent(PopupNotifications.panel,
                                                       "popuphidden");
-    list.focus();
-    EventUtils.sendMouseEvent({ type: "dblclick" }, list.childNodes[0]);
+    document.getElementById("login-fill-use").click();
     yield promiseHidden;
 
     let result = yield ContentTask.spawn(browser, null, function* () {
diff --git a/toolkit/components/reader/ReaderMode.jsm b/toolkit/components/reader/ReaderMode.jsm
index 23bf45a43c9c..c5e31e72b29a 100644
--- a/toolkit/components/reader/ReaderMode.jsm
+++ b/toolkit/components/reader/ReaderMode.jsm
@@ -290,7 +290,7 @@ this.ReaderMode = {
   ],
 
   _shouldCheckUri: function (uri) {
-    if (!(uri.schemeIs("http") || uri.schemeIs("https") || uri.schemeIs("file"))) {
+    if (!(uri.schemeIs("http") || uri.schemeIs("https"))) {
       this.log("Not parsing URI scheme: " + uri.scheme);
       return false;
     }
diff --git a/toolkit/components/satchel/test/mochitest.ini b/toolkit/components/satchel/test/mochitest.ini
index 29e84e7e397c..c649b9aac721 100644
--- a/toolkit/components/satchel/test/mochitest.ini
+++ b/toolkit/components/satchel/test/mochitest.ini
@@ -11,8 +11,7 @@ skip-if = e10s # bug 1162338 (needs refactoring to talk to the autocomplete popu
 [test_bug_787624.html]
 skip-if = e10s # bug 1162338 (needs refactoring to talk to the autocomplete popup)
 [test_form_autocomplete.html]
-skip-if = true # Test disabled for too many intermittent failures (bug 874429)
-               # XXX Now fails for other reasons (incl. <input type=number>)
+skip-if = e10s # bug 1162329 or bug 1162338
 [test_form_autocomplete_with_list.html]
 skip-if = e10s # bug 1162329 (autocomplete impl. in e10s isn't complete)
 [test_form_submission.html]
diff --git a/toolkit/components/satchel/test/test_form_autocomplete.html b/toolkit/components/satchel/test/test_form_autocomplete.html
index 8d41bd0c5aa2..6299552559db 100644
--- a/toolkit/components/satchel/test/test_form_autocomplete.html
+++ b/toolkit/components/satchel/test/test_form_autocomplete.html
@@ -83,7 +83,7 @@ Form History test: form field autocomplete
 
   <!-- form with input type='number' -->
   <form id="form12" onsubmit="return false;">
-    <input  type="number" name="field10">
+    <input  type="text" name="field10"> <!-- TODO: change back to type=number -->
     <button type="submit">Submit</button>
   </form>
 
@@ -676,7 +676,7 @@ function runTest() {
         input.focus();
         window.scrollTo(0, 0);
         sendChar("q");
-        waitForScroll();
+        waitForMenuChange(0);
         break;
 
     case 210:
@@ -700,9 +700,7 @@ function runTest() {
         checkMenuEntries(["aa a\xe6", "aba\xe6", "a\xe6"], testNum);
         input.focus();
 
-        // for this test, hide the popup first as it contains the same number of menu 
-
-        sendChar("\xc6");
+        sendChar("\xe6");
         waitForMenuChange(3, "a\xe6");
         break;
 
@@ -721,7 +719,7 @@ function runTest() {
         checkMenuEntries(["bc d\xe6"], testNum);
         input.focus();
         sendChar(" ");
-        setTimeout(runTest, 300);
+        waitForMenuChange(1);
         break;
 
     case 253:
@@ -870,6 +868,7 @@ function runTest() {
         } else if (testNum == 402) {
           input = $_(11, "field9");
         } else if (testNum == 403) {
+          todo(false, "Fix input type=number");
           input = $_(12, "field10");
         }
 
@@ -996,7 +995,7 @@ function waitForScroll()
       return;
 
     removeEventListener("scroll", arguments.callee, false);
-    setTimeout(runTest, 50);
+    setTimeout(runTest, 100);
   }, false);
 }
 
@@ -1021,6 +1020,7 @@ function startTest() {
 window.onload = startTest;
 
 SimpleTest.waitForExplicitFinish();
+SimpleTest.requestFlakyTimeout("untriaged");
 </script>
 </pre>
 </body>
diff --git a/toolkit/components/search/nsSearchService.js b/toolkit/components/search/nsSearchService.js
index b65bb9a9d865..113a04a744e1 100644
--- a/toolkit/components/search/nsSearchService.js
+++ b/toolkit/components/search/nsSearchService.js
@@ -2818,6 +2818,75 @@ Engine.prototype = {
     return this.__id = this._file.path;
   },
 
+  // This indicates where we found the .xml file to load the engine,
+  // and attempts to hide user-identifiable data (such as username).
+  get _anonymizedLoadPath() {
+    /* Examples of expected output:
+     *   jar:[app]/omni.ja!browser/engine.xml
+     *     'browser' here is the name of the chrome package, not a folder.
+     *   [profile]/searchplugins/engine.xml
+     *   [distribution]/searchplugins/common/engine.xml
+     *   [other]/engine.xml
+     */
+
+    let leafName = this._getLeafName();
+    if (!leafName)
+      return "null";
+
+    let prefix = "", suffix = "";
+    let file = this._file;
+    if (!file) {
+      let uri = this._uri;
+      if (uri.schemeIs("chrome")) {
+        let packageName = uri.hostPort;
+        uri = gChromeReg.convertChromeURL(uri);
+        if (uri instanceof Ci.nsINestedURI) {
+          prefix = "jar:";
+          suffix = "!" + packageName + "/" + leafName;
+          uri = uri.innermostURI;
+        }
+        uri.QueryInterface(Ci.nsIFileURL)
+        file = uri.file;
+      } else {
+        return "[" + uri.scheme + "]/" + leafName;
+      }
+    }
+
+    let id;
+    let enginePath = file.path;
+
+    const NS_XPCOM_CURRENT_PROCESS_DIR = "XCurProcD";
+    const NS_APP_USER_PROFILE_50_DIR = "ProfD";
+    const XRE_APP_DISTRIBUTION_DIR = "XREAppDist";
+
+    const knownDirs = {
+      app: NS_XPCOM_CURRENT_PROCESS_DIR,
+      profile: NS_APP_USER_PROFILE_50_DIR,
+      distribution: XRE_APP_DISTRIBUTION_DIR
+    };
+
+    for (let key in knownDirs) {
+      let path;
+      try {
+        path = getDir(knownDirs[key]).path;
+      } catch(e) {
+        // Getting XRE_APP_DISTRIBUTION_DIR throws during unit tests.
+        continue;
+      }
+      if (enginePath.startsWith(path)) {
+        id = "[" + key + "]" + enginePath.slice(path.length).replace(/\\/g, "/");
+        break;
+      }
+    }
+
+    // If the folder doesn't have a known ancestor, don't record its path to
+    // avoid leaking user identifiable data.
+    if (!id)
+      id = "[other]/" + file.leafName;
+
+    return prefix + id + suffix;
+  },
+
   get _installLocation() {
     if (this.__installLocation === null) {
       if (!this._file) {
@@ -4597,6 +4666,71 @@ SearchService.prototype = {
     notifyAction(this._currentEngine, SEARCH_ENGINE_CURRENT);
   },
 
+  getDefaultEngineInfo() {
+    let result = {};
+
+    let engine;
+    try {
+      engine = this.defaultEngine;
+    } catch(e) {
+      // The defaultEngine getter will throw if there's no engine at all,
+      // which shouldn't happen unless an add-on or a test deleted all of them.
+      // Our preferences UI doesn't let users do that.
+      Cu.reportError("getDefaultEngineInfo: No default engine");
+    }
+
+    if (!engine) {
+      result.name = "NONE";
+    } else {
+      if (engine.name)
+        result.name = engine.name;
+
+      result.loadPath = engine._anonymizedLoadPath;
+
+      // For privacy, we only collect the submission URL for engines
+      // from the application or distribution folder...
+      let sendSubmissionURL =
+        /^(?:jar:|\[app\]|\[distribution\])/.test(result.loadPath);
+
+      // ... or engines sorted by default near the top of the list.
+      if (!sendSubmissionURL) {
+        let extras =
+          Services.prefs.getChildList(BROWSER_SEARCH_PREF + "order.extra.");
+
+        for (let prefName of extras) {
+          try {
+            if (result.name == Services.prefs.getCharPref(prefName)) {
+              sendSubmissionURL = true;
+              break;
+            }
+          } catch(e) {}
+        }
+
+        let prefNameBase = getGeoSpecificPrefName(BROWSER_SEARCH_PREF + "order");
+        let i = 0;
+        while (!sendSubmissionURL) {
+          let prefName = prefNameBase + "." + (++i);
+          let engineName = getLocalizedPref(prefName);
+          if (!engineName)
+            break;
+          if (result.name == engineName) {
+            sendSubmissionURL = true;
+            break;
+          }
+        }
+      }
+
+      if (sendSubmissionURL) {
+        let uri = engine._getURLOfType("text/html")
+                        .getSubmission("", engine, "searchbar").uri;
+        uri.userPass = ""; // Avoid reporting a username or password.
+        result.submissionURL = uri.spec;
+      }
+    }
+
+    return result;
+  },
+
   /**
    * This map is built lazily after the available search engines change.  It
    * allows quick parsing of an URL representing a search submission into the
diff --git a/toolkit/components/telemetry/Histograms.json b/toolkit/components/telemetry/Histograms.json
index d57f87b54f51..892998622f94 100644
--- a/toolkit/components/telemetry/Histograms.json
+++ b/toolkit/components/telemetry/Histograms.json
@@ -7204,6 +7204,12 @@
     "kind": "flag",
     "description": "a testing histogram; not meant to be touched"
   },
+  "TLS_ERROR_REPORT_UI": {
+    "expires_in_version": "never",
+    "kind": "enumerated",
+    "n_values": 15,
+    "description": "User interaction with the TLS Error Reporter in about:neterror (0=Error seen, 1='auto' checked, 2='auto' unchecked, 3=Sent manually, 4=Sent automatically, 5=Send success, 6=Send failure, 7=Report section expanded)"
+  },
   "CERT_OCSP_ENABLED": {
     "expires_in_version": "never",
     "kind": "boolean",
@@ -7625,6 +7631,20 @@
     "keyed": true,
     "description": "Counts of plugin and content process crashes which are reported with a crash dump."
   },
+  "PROCESS_CRASH_SUBMIT_ATTEMPT": {
+    "expires_in_version": "never",
+    "kind": "count",
+    "keyed": true,
+    "releaseChannelCollection": "opt-out",
+    "description": "An attempt to submit a crash. Keyed on the CrashManager Crash.type."
+  },
+  "PROCESS_CRASH_SUBMIT_SUCCESS": {
+    "expires_in_version": "never",
+    "kind": "boolean",
+    "keyed": true,
+    "releaseChannelCollection": "opt-out",
+    "description": "The submission status when main/plugin/content crashes are submitted. 1 is success, 0 is failure. Keyed on the CrashManager Crash.type."
+  },
   "STUMBLER_TIME_BETWEEN_UPLOADS_SEC": {
     "expires_in_version": "45",
     "kind": "exponential",
diff --git a/toolkit/components/telemetry/TelemetryEnvironment.jsm b/toolkit/components/telemetry/TelemetryEnvironment.jsm
index 9b301c4d9fbf..6825d327fad2 100644
--- a/toolkit/components/telemetry/TelemetryEnvironment.jsm
+++ b/toolkit/components/telemetry/TelemetryEnvironment.jsm
@@ -880,6 +880,8 @@ EnvironmentCache.prototype = {
     this._currentEnvironment.settings = this._currentEnvironment.settings || {};
     // Update the search engine entry in the current environment.
     this._currentEnvironment.settings.defaultSearchEngine = this._getDefaultSearchEngine();
+    this._currentEnvironment.settings.defaultSearchEngineData =
+      Services.search.getDefaultEngineInfo();
   },
 
   /**
@@ -900,13 +902,13 @@ EnvironmentCache.prototype = {
    */
   _getBuild: function () {
     let buildData = {
-      applicationId: Services.appinfo.ID,
-      applicationName: Services.appinfo.name,
+      applicationId: Services.appinfo.ID || null,
+      applicationName: Services.appinfo.name || null,
       architecture: Services.sysinfo.get("arch"),
-      buildId: Services.appinfo.appBuildID,
-      version: Services.appinfo.version,
-      vendor: Services.appinfo.vendor,
-      platformVersion: Services.appinfo.platformVersion,
+      buildId: Services.appinfo.appBuildID || null,
+      version: Services.appinfo.version || null,
+      vendor: Services.appinfo.vendor || null,
+      platformVersion: Services.appinfo.platformVersion || null,
       xpcomAbi: Services.appinfo.XPCOMABI,
       hotfixVersion: Preferences.get(PREF_HOTFIX_LASTVERSION, null),
     };
@@ -1043,11 +1045,9 @@ EnvironmentCache.prototype = {
     // Enumerate the available CPU extensions.
     let availableExts = [];
     for (let ext of CPU_EXTENSIONS) {
-      try {
-        Services.sysinfo.getProperty(ext);
-        // If it doesn't throw, add it to the list.
+      if (getSysinfoProperty(ext, false)) {
         availableExts.push(ext);
-      } catch (e) {}
+      }
     }
 
     cpuData.extensions = availableExts;
diff --git a/toolkit/components/telemetry/docs/crash-ping.rst b/toolkit/components/telemetry/docs/crash-ping.rst
new file mode 100644
index 000000000000..1183adf84960
--- /dev/null
+++ b/toolkit/components/telemetry/docs/crash-ping.rst
@@ -0,0 +1,24 @@
+
+"crash" ping
+============
+
+This ping is captured after the main Firefox process crashes, whether or not the crash report is submitted to crash-stats.mozilla.org. It includes non-identifying metadata about the crash.
+
+The environment block that is sent with this ping varies: if Firefox was running long enough to record the environment block before the crash, then the environment at the time of the crash will be recorded and ``hasCrashEnvironment`` will be true. If Firefox crashed before the environment was recorded, ``hasCrashEnvironment`` will be false and the recorded environment will be the environment at time of submission.
+
+The client ID is submitted with this ping.
+
+Structure::
+
+    {
+      version: 1,
+      type: "crash",
+      ... common ping data
+      clientId: <UUID>,
+      environment: { ... },
+      payload: {
+        crashDate: "YYYY-MM-DD",
+        metadata: {...}, // Annotations saved while Firefox was running. See nsExceptionHandler.cpp for more information
+        hasCrashEnvironment: bool
+      }
+    }
diff --git a/toolkit/components/telemetry/docs/environment.rst b/toolkit/components/telemetry/docs/environment.rst
index 416fb029ba29..8ce36cae5775 100644
--- a/toolkit/components/telemetry/docs/environment.rst
+++ b/toolkit/components/telemetry/docs/environment.rst
@@ -35,6 +35,11 @@ Structure::
         blocklistEnabled: <bool>, // true on failure
         isDefaultBrowser: <bool>, // null on failure, not available on Android
         defaultSearchEngine: <string>, // e.g. "yahoo"
+        defaultSearchEngineData: {, // data about the current default engine
+          name: <string>, // engine name, e.g. "Yahoo"; or "NONE" if no default
+          loadPath: <string>, // where the engine line is located; missing if no default
+          submissionURL: <string> // missing if no default or for user-installed engines
+        },
         e10sEnabled: <bool>, // false on failure
         telemetryEnabled: <bool>, // false on failure
         locale: <string>, // e.g. "it", null on failure
@@ -197,6 +202,8 @@ Settings
 
 defaultSearchEngine
 ~~~~~~~~~~~~~~~~~~~
+Note: Deprecated, use defaultSearchEngineData instead.
+
 Contains the string identifier or name of the default search engine provider. This will not be present in environment data collected before the Search Service initialization.
 
 The special value ``NONE`` could occur if there is no default search engine.
@@ -204,3 +211,24 @@ The special value ``NONE`` could occur if there is no default search engine.
 The special value ``UNDEFINED`` could occur if a default search engine exists but its identifier could not be determined.
 
 This field's contents are ``Services.search.defaultEngine.identifier`` (if defined) or ``"other-"`` + ``Services.search.defaultEngine.name`` if not. In other words, search engines without an ``.identifier`` are prefixed with ``other-``.
+
+defaultSearchEngineData
+~~~~~~~~~~~~~~~~~~~~~~~
+Contains data identifying the engine currently set as the default.
+
+The object contains:
+
+- a ``name`` property with the name of the engine, or ``NONE`` if no
+  engine is currently set as the default.
+
+- a ``loadPath`` property: an anonymized path of the engine xml file, e.g.
+ jar:[app]/omni.ja!browser/engine.xml
+  (where 'browser' is the name of the chrome package, not a folder)
+ [profile]/searchplugins/engine.xml
+ [distribution]/searchplugins/common/engine.xml
+ [other]/engine.xml
+
+- a ``submissionURL`` property with the HTTP url we would use to search.
+  For privacy, we don't record this for user-installed engines.
+
+``loadPath`` and ``submissionURL`` are not present if ``name`` is ``NONE``.
diff --git a/toolkit/components/telemetry/docs/pings.rst b/toolkit/components/telemetry/docs/pings.rst
index 28b5af3b5e14..39148139cc92 100644
--- a/toolkit/components/telemetry/docs/pings.rst
+++ b/toolkit/components/telemetry/docs/pings.rst
@@ -29,7 +29,8 @@ Ping types
 ==========
 
 * :doc:`main <main-ping>` - contains the information collected by Telemetry (Histograms, hang stacks, ...)
-* :doc:`saved-session <main-ping>` - has the same format as a main ping, but it contains the *"classic"* Telemetry payload with measurements covering the whole browser session. This is only a separate type to make storage of saved-session easier server-side.
+* :doc:`saved-session <main-ping>` - has the same format as a main ping, but it contains the *"classic"* Telemetry payload with measurements covering the whole browser session. This is only a separate type to make storage of saved-session easier server-side. This is temporary and will be removed soon.
+* :doc:`crash <crash-ping>` - a ping that is captured and sent after Firefox crashes.
 * ``activation`` - *planned* - sent right after installation or profile creation
 * ``upgrade`` - *planned* - sent right after an upgrade
 * ``deletion`` - *planned* - on opt-out we may have to tell the server to delete user data
diff --git a/toolkit/components/telemetry/moz.build b/toolkit/components/telemetry/moz.build
index 0be892c3ac44..4ab4c1b79906 100644
--- a/toolkit/components/telemetry/moz.build
+++ b/toolkit/components/telemetry/moz.build
@@ -46,6 +46,10 @@ EXTRA_PP_JS_MODULES += [
     'TelemetrySession.jsm',
 ]
 
+TESTING_JS_MODULES += [
+  'tests/unit/TelemetryArchiveTesting.jsm',
+]
+
 FAIL_ON_WARNINGS = True
 
 include('/ipc/chromium/chromium-config.mozbuild')
diff --git a/toolkit/components/telemetry/tests/unit/TelemetryArchiveTesting.jsm b/toolkit/components/telemetry/tests/unit/TelemetryArchiveTesting.jsm
new file mode 100644
index 000000000000..9be82c88354c
--- /dev/null
+++ b/toolkit/components/telemetry/tests/unit/TelemetryArchiveTesting.jsm
@@ -0,0 +1,86 @@
+const {utils: Cu} = Components;
+Cu.import("resource://gre/modules/TelemetryArchive.jsm");
+Cu.import("resource://testing-common/Assert.jsm");
+Cu.import("resource://gre/modules/Task.jsm");
+Cu.import("resource://gre/modules/Services.jsm");
+Cu.import("resource://gre/modules/TelemetryController.jsm");
+
+this.EXPORTED_SYMBOLS = [
+  "TelemetryArchiveTesting",
+];
+
+function checkForProperties(ping, expected) {
+  for (let [props, val] of expected) {
+    let test = ping;
+    for (let prop of props) {
+      test = test[prop];
+      if (test === undefined) {
+        return false;
+      }
+    }
+    if (test !== val) {
+      return false;
+    }
+  }
+  return true;
+}
+
+/**
+ * A helper object that allows test code to check whether a telemetry ping
+ * was properly saved. To use, first initialize to collect the starting pings
+ * and then check for new ping data.
+ */
+function Checker() {
+}
+Checker.prototype = {
+  promiseInit: function() {
+    this._pingMap = new Map();
+    return TelemetryArchive.promiseArchivedPingList().then((plist) => {
+      for (let ping of plist) {
+        this._pingMap.set(ping.id, ping);
+      }
+    });
+  },
+
+  /**
+   * Find and return a new ping with certain properties.
+   *
+   * @param expected: an array of [['prop'...], 'value'] to check
+   * For example:
+   * [
+   *   [['environment', 'build', 'applicationId'], '20150101010101'],
+   *   [['version'], 1],
+   *   [['metadata', 'OOMAllocationSize'], 123456789],
+   * ]
+   * @returns a matching ping if found, or null
+   */
+  promiseFindPing: Task.async(function*(type, expected) {
+    let candidates = [];
+    let plist = yield TelemetryArchive.promiseArchivedPingList();
+    for (let ping of plist) {
+      if (this._pingMap.has(ping.id)) {
+        continue;
+      }
+      if (ping.type == type) {
+        candidates.push(ping);
+      }
+    }
+
+    for (let candidate of candidates) {
+      let ping = yield TelemetryArchive.promiseArchivedPingById(candidate.id);
+      if (checkForProperties(ping, expected)) {
+        return ping;
+      }
+    }
+    return null;
+  }),
+};
+
+const TelemetryArchiveTesting = {
+  setup: function() {
+    Services.prefs.setCharPref("toolkit.telemetry.log.level", "Trace");
+    Services.prefs.setBoolPref("toolkit.telemetry.archive.enabled", true);
+  },
+
+  Checker: Checker,
+};
diff --git a/toolkit/components/telemetry/tests/unit/test_TelemetryController.js b/toolkit/components/telemetry/tests/unit/test_TelemetryController.js
index 4d6b46ae3ee8..1537bf7a6185 100644
--- a/toolkit/components/telemetry/tests/unit/test_TelemetryController.js
+++ b/toolkit/components/telemetry/tests/unit/test_TelemetryController.js
@@ -335,6 +335,23 @@ add_task(function* test_midnightPingSendFuzzing() {
   fakePingSendTimer(() => {}, () => {});
 });
 
+add_task(function* test_changePingAfterSubmission() {
+  // Submit a ping with a custom payload.
+  let payload = { canary: "test" };
+  let pingPromise = TelemetryController.submitExternalPing(TEST_PING_TYPE, payload, options);
+
+  // Change the payload with a predefined value.
+  payload.canary = "changed";
+
+  // Wait for the ping to be archived.
+  const pingId = yield pingPromise;
+
+  // Make sure our changes didn't affect the submitted payload.
+  let archivedCopy = yield TelemetryArchive.promiseArchivedPingById(pingId);
+  Assert.equal(archivedCopy.payload.canary, "test",
+               "The payload must not be changed after being submitted.");
+});
+
 add_task(function* stopServer(){
   gHttpServer.stop(do_test_finished);
 });
diff --git a/toolkit/components/telemetry/tests/unit/test_TelemetryEnvironment.js b/toolkit/components/telemetry/tests/unit/test_TelemetryEnvironment.js
index d7d3fb780b46..7c024591fdc2 100644
--- a/toolkit/components/telemetry/tests/unit/test_TelemetryEnvironment.js
+++ b/toolkit/components/telemetry/tests/unit/test_TelemetryEnvironment.js
@@ -284,6 +284,7 @@ function checkSettingsSection(data) {
   // Check "defaultSearchEngine" separately, as it can either be undefined or string.
   if ("defaultSearchEngine" in data.settings) {
     checkString(data.settings.defaultSearchEngine);
+    Assert.equal(typeof data.settings.defaultSearchEngineData, "object");
   }
 }
 
@@ -994,6 +995,7 @@ add_task(function* test_defaultSearchEngine() {
   let data = TelemetryEnvironment.currentEnvironment;
   checkEnvironmentData(data);
   Assert.ok(!("defaultSearchEngine" in data.settings));
+  Assert.ok(!("defaultSearchEngineData" in data.settings));
 
   // Load the engines definitions from a custom JAR file: that's needed so that
   // the search provider reports an engine identifier.
@@ -1011,6 +1013,12 @@ add_task(function* test_defaultSearchEngine() {
   data = TelemetryEnvironment.currentEnvironment;
   checkEnvironmentData(data);
   Assert.equal(data.settings.defaultSearchEngine, "telemetrySearchIdentifier");
+  let expectedSearchEngineData = {
+    name: "telemetrySearchIdentifier",
+    loadPath: "jar:[other]/searchTest.jar!testsearchplugin/telemetrySearchIdentifier.xml",
+    submissionURL: "http://ar.wikipedia.org/wiki/%D8%AE%D8%A7%D8%B5:%D8%A8%D8%AD%D8%AB?search=&sourceid=Mozilla-search"
+  };
+  Assert.deepEqual(data.settings.defaultSearchEngineData, expectedSearchEngineData);
 
   // Remove all the search engines.
   for (let engine of Services.search.getEngines()) {
@@ -1025,6 +1033,7 @@ add_task(function* test_defaultSearchEngine() {
   data = TelemetryEnvironment.currentEnvironment;
   checkEnvironmentData(data);
   Assert.equal(data.settings.defaultSearchEngine, "NONE");
+  Assert.deepEqual(data.settings.defaultSearchEngineData, {name:"NONE"});
 
   // Add a new search engine (this will have no engine identifier).
   const SEARCH_ENGINE_ID = "telemetry_default";
@@ -1044,6 +1053,12 @@ add_task(function* test_defaultSearchEngine() {
 
   const EXPECTED_SEARCH_ENGINE = "other-" + SEARCH_ENGINE_ID;
   Assert.equal(data.settings.defaultSearchEngine, EXPECTED_SEARCH_ENGINE);
+
+  const EXPECTED_SEARCH_ENGINE_DATA = {
+    name: "telemetry_default",
+    loadPath: "[profile]/searchplugins/telemetrydefault.xml"
+  };
+  Assert.deepEqual(data.settings.defaultSearchEngineData, EXPECTED_SEARCH_ENGINE_DATA);
   TelemetryEnvironment.unregisterChangeListener("testWatch_SearchDefault");
 
   // Define and reset the test preference.
diff --git a/toolkit/content/aboutServiceWorkers.js b/toolkit/content/aboutServiceWorkers.js
index 7f8496fcb013..14ab0ce57dcc 100644
--- a/toolkit/content/aboutServiceWorkers.js
+++ b/toolkit/content/aboutServiceWorkers.js
@@ -132,7 +132,7 @@ function display(info) {
   let updateButton = document.createElement("button");
   updateButton.appendChild(document.createTextNode(bundle.GetStringFromName('update')));
   updateButton.onclick = function() {
-    gSWM.softUpdate(info.principal.originAttributes, info.scope);
+    gSWM.propagateSoftUpdate(info.principal.originAttributes, info.scope);
   };
   div.appendChild(updateButton);
 
@@ -164,7 +164,7 @@ function display(info) {
     };
 
     loadingMessage.classList.remove('inactive');
-    gSWM.unregister(info.principal, cb, info.scope);
+    gSWM.propagateUnregister(info.principal, cb, info.scope);
   };
 
   let sep = document.createElement('hr');
diff --git a/toolkit/content/select-child.js b/toolkit/content/select-child.js
index 510c919b28b5..b2b3a34a922c 100644
--- a/toolkit/content/select-child.js
+++ b/toolkit/content/select-child.js
@@ -2,6 +2,8 @@
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
 
+Components.utils.import("resource://gre/modules/XPCOMUtils.jsm");
+
 XPCOMUtils.defineLazyModuleGetter(this, "SelectContentHelper",
                                   "resource://gre/modules/SelectContentHelper.jsm");
 
diff --git a/toolkit/devtools/Console.jsm b/toolkit/devtools/Console.jsm
index f3fc459d82e9..32d3ffe82ee4 100644
--- a/toolkit/devtools/Console.jsm
+++ b/toolkit/devtools/Console.jsm
@@ -581,6 +581,11 @@ function sendConsoleAPIMessage(aConsole, aLevel, aFrame, aArgs, aOptions = {})
  *                            If falsy value, all messages will be logged.
  *                            If wrong value that doesn't match any key of
  *                            LOG_LEVELS, no message will be logged
+ *        - maxLogLevelPref {string} : String pref name which contains the
+ *                            level to use for maxLogLevel. If the pref doesn't
+ *                            exist or gets removed, the maxLogLevel will default
+ *                            to the value passed to this constructor (or "all"
+ *                            if it wasn't specified).
  *        - dump {function} : An optional function to intercept all strings
  *                            written to stdout
  *        - innerID {string}: An ID representing the source of the message.
@@ -595,10 +600,24 @@ function ConsoleAPI(aConsoleOptions = {}) {
   // in order to avoid runtime checks on each console method call.
   this.dump = aConsoleOptions.dump || dump;
   this.prefix = aConsoleOptions.prefix || "";
-  this.maxLogLevel = aConsoleOptions.maxLogLevel || "all";
+  this.maxLogLevel = aConsoleOptions.maxLogLevel;
   this.innerID = aConsoleOptions.innerID || null;
   this.consoleID = aConsoleOptions.consoleID || "";
 
+  // Setup maxLogLevelPref watching
+  let updateMaxLogLevel = () => {
+    if (Services.prefs.getPrefType(aConsoleOptions.maxLogLevelPref) == Services.prefs.PREF_STRING) {
+      this._maxLogLevel = Services.prefs.getCharPref(aConsoleOptions.maxLogLevelPref).toLowerCase();
+    } else {
+      this._maxLogLevel = this._maxExplicitLogLevel;
+    }
+  };
+
+  if (aConsoleOptions.maxLogLevelPref) {
+    updateMaxLogLevel();
+    Services.prefs.addObserver(aConsoleOptions.maxLogLevelPref, updateMaxLogLevel, false);
+  }
+
   // Bind all the functions to this object.
   for (let prop in this) {
     if (typeof(this[prop]) === "function") {
@@ -608,6 +627,15 @@ function ConsoleAPI(aConsoleOptions = {}) {
 }
 
 ConsoleAPI.prototype = {
+  /**
+   * The last log level that was specified via the constructor or setter. This
+   * is used as a fallback if the pref doesn't exist or is removed.
+   */
+  _maxExplicitLogLevel: null,
+  /**
+   * The current log level via all methods of setting (pref or via the API).
+   */
+  _maxLogLevel: null,
   debug: createMultiLineDumper("debug"),
   log: createDumper("log"),
   info: createDumper("info"),
@@ -655,6 +683,14 @@ ConsoleAPI.prototype = {
     dumpMessage(this, "timeEnd",
                 "'" + timer.name + "' " + timer.duration + "ms");
   },
+
+  get maxLogLevel() {
+    return this._maxLogLevel || "all";
+  },
+
+  set maxLogLevel(aValue) {
+    this._maxLogLevel = this._maxExplicitLogLevel = aValue;
+  },
 };
 
 this.console = new ConsoleAPI();
diff --git a/toolkit/devtools/client/dbg-client.jsm b/toolkit/devtools/client/dbg-client.jsm
index b4a61ca7c855..2f1f0b59eb3e 100644
--- a/toolkit/devtools/client/dbg-client.jsm
+++ b/toolkit/devtools/client/dbg-client.jsm
@@ -2416,6 +2416,21 @@ ObjectClient.prototype = {
       return aPacket;
     },
     telemetry: "SCOPE"
+  }),
+
+  /**
+   * Request the promises directly depending on the current promise.
+   */
+  getDependentPromises: DebuggerClient.requester({
+    type: "dependentPromises"
+  }, {
+    before: function(aPacket) {
+      if (this._grip.class !== "Promise") {
+        throw new Error("getDependentPromises is only valid for promise " +
+          "grips.");
+      }
+      return aPacket;
+    }
   })
 };
 
diff --git a/toolkit/devtools/gcli/commands/tools.js b/toolkit/devtools/gcli/commands/tools.js
index 961a9c96b85d..84bfd951c988 100644
--- a/toolkit/devtools/gcli/commands/tools.js
+++ b/toolkit/devtools/gcli/commands/tools.js
@@ -57,10 +57,10 @@ exports.items = [
                                          Ci.nsISupportsString, str);
           devtools.reload();
 
-          return l10n.lookupFormat("toolsSrcdirReloaded", [ args.srcdir ]);
+          return l10n.lookupFormat("toolsSrcdirReloaded2", [ args.srcdir ]);
         }
 
-        return l10n.lookupFormat("toolsSrcdirNotFound", [ args.srcdir ]);
+        return l10n.lookupFormat("toolsSrcdirNotFound2", [ args.srcdir ]);
       });
     }
   },
diff --git a/toolkit/devtools/output-parser.js b/toolkit/devtools/output-parser.js
index efb7d2b58acd..daac9b73b97b 100644
--- a/toolkit/devtools/output-parser.js
+++ b/toolkit/devtools/output-parser.js
@@ -2,6 +2,8 @@
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
 
+/* globals DOMUtils */
+
 "use strict";
 
 const {Cc, Ci, Cu} = require("chrome");
@@ -12,7 +14,8 @@ const HTML_NS = "http://www.w3.org/1999/xhtml";
 
 const MAX_ITERATIONS = 100;
 
-const BEZIER_KEYWORDS = ["linear", "ease-in-out", "ease-in", "ease-out", "ease"];
+const BEZIER_KEYWORDS = ["linear", "ease-in-out", "ease-in", "ease-out",
+                         "ease"];
 
 // Functions that accept a color argument.
 const COLOR_TAKING_FUNCTIONS = ["linear-gradient",
@@ -22,9 +25,10 @@ const COLOR_TAKING_FUNCTIONS = ["linear-gradient",
                                 "radial-gradient",
                                 "-moz-radial-gradient",
                                 "repeating-radial-gradient",
-                                "-moz-repeating-radial-gradient"];
+                                "-moz-repeating-radial-gradient",
+                                "drop-shadow"];
 
-loader.lazyGetter(this, "DOMUtils", function () {
+loader.lazyGetter(this, "DOMUtils", function() {
   return Cc["@mozilla.org/inspector/dom-utils;1"].getService(Ci.inIDOMUtils);
 });
 
@@ -36,7 +40,8 @@ loader.lazyGetter(this, "DOMUtils", function () {
  * border radius, cubic-bezier etc.).
  *
  * Usage:
- *   const {devtools} = Cu.import("resource://gre/modules/devtools/Loader.jsm", {});
+ *   const {devtools} =
+ *      Cu.import("resource://gre/modules/devtools/Loader.jsm", {});
  *   const {OutputParser} = devtools.require("devtools/output-parser");
  *
  *   let parser = new OutputParser();
@@ -139,93 +144,114 @@ OutputParser.prototype = {
     text = text.trim();
     this.parsed.length = 0;
 
-    if (options.expectFilter) {
-      this._appendFilter(text, options);
-    } else {
-      let tokenStream = DOMUtils.getCSSLexer(text);
-      let i = 0;
-      while (true) {
-        let token = tokenStream.nextToken();
-        if (!token)
-          break;
-        if (token.tokenType === "comment") {
-          continue;
-        }
+    let tokenStream = DOMUtils.getCSSLexer(text);
+    let i = 0;
+    let parenDepth = 0;
+    let outerMostFunctionTakesColor = false;
 
-        // Prevent this loop from slowing down the browser with too
-        // many nodes being appended into output. In practice it is very unlikely
-        // that this will ever happen.
-        i++;
-        if (i > MAX_ITERATIONS) {
-          this._appendTextNode(text.substring(token.startOffset,
-                                              token.endOffset));
-          continue;
-        }
+    let colorOK = function() {
+      return options.supportsColor ||
+        (options.expectFilter && parenDepth === 1 &&
+         outerMostFunctionTakesColor);
+    };
 
-        switch (token.tokenType) {
-          case "function": {
-            if (COLOR_TAKING_FUNCTIONS.indexOf(token.text) >= 0) {
-              // The function can accept a color argument, and we know
-              // it isn't special in some other way.  So, we let it
-              // through to the ordinary parsing loop so that colors
-              // can be handled in a single place.
-              this._appendTextNode(text.substring(token.startOffset,
-                                                  token.endOffset));
-            } else {
-              let functionText = this._collectFunctionText(token, text,
-                                                           tokenStream);
+    while (true) {
+      let token = tokenStream.nextToken();
+      if (!token) {
+        break;
+      }
+      if (token.tokenType === "comment") {
+        continue;
+      }
 
-              if (options.expectCubicBezier && token.text === "cubic-bezier") {
-                this._appendCubicBezier(functionText, options);
-              } else if (options.supportsColor &&
-                         DOMUtils.isValidCSSColor(functionText)) {
-                this._appendColor(functionText, options);
-              } else {
-                this._appendTextNode(functionText);
-              }
-            }
-            break;
-          }
+      // Prevent this loop from slowing down the browser with too
+      // many nodes being appended into output. In practice it is very unlikely
+      // that this will ever happen.
+      i++;
+      if (i > MAX_ITERATIONS) {
+        this._appendTextNode(text.substring(token.startOffset,
+                                            token.endOffset));
+        continue;
+      }
 
-          case "ident":
-            if (options.expectCubicBezier &&
-                BEZIER_KEYWORDS.indexOf(token.text) >= 0) {
-              this._appendCubicBezier(token.text, options);
-            } else if (options.supportsColor &&
-                       DOMUtils.isValidCSSColor(token.text)) {
-              this._appendColor(token.text, options);
-            } else {
-              this._appendTextNode(text.substring(token.startOffset,
-                                                  token.endOffset));
-            }
-            break;
-
-          case "id":
-          case "hash": {
-            let original = text.substring(token.startOffset, token.endOffset);
-            if (options.supportsColor && DOMUtils.isValidCSSColor(original)) {
-              this._appendColor(original, options);
-            } else {
-              this._appendTextNode(original);
-            }
-            break;
-          }
-
-          case "url":
-          case "bad_url":
-            this._appendURL(text.substring(token.startOffset, token.endOffset),
-                            token.text, options);
-            break;
-
-          default:
+      switch (token.tokenType) {
+        case "function": {
+          if (COLOR_TAKING_FUNCTIONS.indexOf(token.text) >= 0) {
+            // The function can accept a color argument, and we know
+            // it isn't special in some other way.  So, we let it
+            // through to the ordinary parsing loop so that colors
+            // can be handled in a single place.
             this._appendTextNode(text.substring(token.startOffset,
                                                 token.endOffset));
-            break;
+            if (parenDepth === 0) {
+              outerMostFunctionTakesColor = true;
+            }
+            ++parenDepth;
+          } else {
+            let functionText = this._collectFunctionText(token, text,
+                                                         tokenStream);
+
+            if (options.expectCubicBezier && token.text === "cubic-bezier") {
+              this._appendCubicBezier(functionText, options);
+            } else if (colorOK() && DOMUtils.isValidCSSColor(functionText)) {
+              this._appendColor(functionText, options);
+            } else {
+              this._appendTextNode(functionText);
+            }
+          }
+          break;
         }
+
+        case "ident":
+          if (options.expectCubicBezier &&
+              BEZIER_KEYWORDS.indexOf(token.text) >= 0) {
+            this._appendCubicBezier(token.text, options);
+          } else if (colorOK() && DOMUtils.isValidCSSColor(token.text)) {
+            this._appendColor(token.text, options);
+          } else {
+            this._appendTextNode(text.substring(token.startOffset,
+                                                token.endOffset));
+          }
+          break;
+
+        case "id":
+        case "hash": {
+          let original = text.substring(token.startOffset, token.endOffset);
+          if (colorOK() && DOMUtils.isValidCSSColor(original)) {
+            this._appendColor(original, options);
+          } else {
+            this._appendTextNode(original);
+          }
+          break;
+        }
+
+        case "url":
+        case "bad_url":
+          this._appendURL(text.substring(token.startOffset, token.endOffset),
+                          token.text, options);
+          break;
+
+        case "symbol":
+          if (token.text === "(") {
+            ++parenDepth;
+          } else if (token.token === ")") {
+            --parenDepth;
+          }
+          // falls through
+        default:
+          this._appendTextNode(text.substring(token.startOffset,
+                                              token.endOffset));
+          break;
       }
     }
 
-    return this._toDOM();
+    let result = this._toDOM();
+
+    if (options.expectFilter && !options.filterSwatch) {
+      result = this._wrapFilter(text, options, result);
+    }
+
+    return result;
   },
 
   /**
@@ -325,7 +351,20 @@ OutputParser.prototype = {
     return false;
   },
 
-  _appendFilter: function(filters, options={}) {
+  /**
+   * Wrap some existing nodes in a filter editor.
+   *
+   * @param {String} filters
+   *        The full text of the "filter" property.
+   * @param {object} options
+   *        The options object passed to parseCssProperty().
+   * @param {object} nodes
+   *        Nodes created by _toDOM().
+   *
+   * @returns {object}
+   *        A new node that supplies a filter swatch and that wraps |nodes|.
+   */
+  _wrapFilter: function(filters, options, nodes) {
     let container = this._createNode("span", {
       "data-filters": filters
     });
@@ -339,10 +378,11 @@ OutputParser.prototype = {
 
     let value = this._createNode("span", {
       class: options.filterClass
-    }, filters);
-
+    });
+    value.appendChild(nodes);
     container.appendChild(value);
-    this.parsed.push(container);
+
+    return container;
   },
 
   _onSwatchMouseDown: function(event) {
@@ -380,7 +420,7 @@ OutputParser.prototype = {
         href = options.baseURI.resolve(url);
       }
 
-      this._appendNode("a",  {
+      this._appendNode("a", {
         target: "_blank",
         class: options.urlClass,
         href: href
@@ -498,6 +538,11 @@ OutputParser.prototype = {
    *           - urlClass: ""           // The class to be used for url() links.
    *           - baseURI: ""            // A string or nsIURI used to resolve
    *                                    // relative links.
+   *           - filterSwatch: false    // A special case for parsing a
+   *                                    // "filter" property, causing the
+   *                                    // parser to skip the call to
+   *                                    // _wrapFilter.  Used only for
+   *                                    // previewing with the filter swatch.
    * @return {Object}
    *         Overridden options object
    */
@@ -510,7 +555,8 @@ OutputParser.prototype = {
       bezierClass: "",
       supportsColor: false,
       urlClass: "",
-      baseURI: ""
+      baseURI: "",
+      filterSwatch: false
     };
 
     if (typeof overrides.baseURI === "string") {
diff --git a/toolkit/devtools/server/actors/actor-registry.js b/toolkit/devtools/server/actors/actor-registry.js
index 4af0c353310a..94b3ecf5278a 100644
--- a/toolkit/devtools/server/actors/actor-registry.js
+++ b/toolkit/devtools/server/actors/actor-registry.js
@@ -11,8 +11,7 @@ const { Cu, CC, components } = require("chrome");
 const { Promise: promise } = Cu.import("resource://gre/modules/Promise.jsm", {});
 const Services = require("Services");
 const { DebuggerServer } = require("devtools/server/main");
-const ActorRegistryUtils = require("devtools/server/actors/utils/actor-registry-utils");
-const { registerActor, unregisterActor } = ActorRegistryUtils;
+const { registerActor, unregisterActor } = require("devtools/server/actors/utils/actor-registry-utils");
 
 loader.lazyImporter(this, "NetUtil", "resource://gre/modules/NetUtil.jsm");
 
diff --git a/toolkit/devtools/server/actors/common.js b/toolkit/devtools/server/actors/common.js
index 1dde19c68a79..2ee6bedbc829 100644
--- a/toolkit/devtools/server/actors/common.js
+++ b/toolkit/devtools/server/actors/common.js
@@ -7,6 +7,7 @@
 "use strict";
 
 const promise = require("promise");
+const { method } = require("devtools/server/protocol");
 
 /**
  * Creates "registered" actors factory meant for creating another kind of
@@ -519,3 +520,19 @@ function expectState(expectedState, method, activity) {
 }
 
 exports.expectState = expectState;
+
+/**
+ * Proxies a call from an actor to an underlying module, stored
+ * as `bridge` on the actor. This allows a module to be defined in one
+ * place, usable by other modules/actors on the server, but a separate
+ * module defining the actor/RDP definition.
+ *
+ * @see Framerate implementation: toolkit/devtools/shared/framerate.js
+ * @see Framerate actor definition: toolkit/devtools/server/actors/framerate.js
+ */
+function actorBridge (methodName, definition={}) {
+  return method(function () {
+    return this.bridge[methodName].apply(this.bridge, arguments);
+  }, definition);
+}
+exports.actorBridge = actorBridge;
diff --git a/toolkit/devtools/server/actors/framerate.js b/toolkit/devtools/server/actors/framerate.js
index 6d5b08e033c9..f0299165bc28 100644
--- a/toolkit/devtools/server/actors/framerate.js
+++ b/toolkit/devtools/server/actors/framerate.js
@@ -3,59 +3,32 @@
  * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
 "use strict";
 
-const {Cc, Ci, Cu, Cr} = require("chrome");
-const Services = require("Services");
-const events = require("sdk/event/core");
 const protocol = require("devtools/server/protocol");
-const DevToolsUtils = require("devtools/toolkit/DevToolsUtils.js");
-
-const {on, once, off, emit} = events;
-const {method, custom, Arg, Option, RetVal} = protocol;
+const { actorBridge } = require("devtools/server/actors/common");
+const { method, custom, Arg, Option, RetVal } = protocol;
+const { on, once, off, emit } = require("sdk/event/core");
+const { Framerate } = require("devtools/toolkit/shared/framerate");
 
 /**
- * A very simple utility for monitoring framerate.
+ * An actor wrapper around Framerate. Uses exposed
+ * methods via bridge and provides RDP definitions.
+ *
+ * @see toolkit/devtools/shared/framerate.js for documentation.
  */
 let FramerateActor = exports.FramerateActor = protocol.ActorClass({
   typeName: "framerate",
-  initialize: function(conn, tabActor) {
+  initialize: function (conn, tabActor) {
     protocol.Actor.prototype.initialize.call(this, conn);
-    this.tabActor = tabActor;
-    this._contentWin = tabActor.window;
-    this._onRefreshDriverTick = this._onRefreshDriverTick.bind(this);
-    this._onGlobalCreated = this._onGlobalCreated.bind(this);
-    on(this.tabActor, "window-ready", this._onGlobalCreated);
+    this.bridge = new Framerate(tabActor);
   },
   destroy: function(conn) {
-    off(this.tabActor, "window-ready", this._onGlobalCreated);
     protocol.Actor.prototype.destroy.call(this, conn);
-    this.stopRecording();
+    this.bridge.destroy();
   },
 
-  /**
-   * Starts monitoring framerate, storing the frames per second.
-   */
-  startRecording: method(function() {
-    if (this._recording) {
-      return;
-    }
-    this._recording = true;
-    this._ticks = [];
-    this._startTime = this.tabActor.docShell.now();
-    this._rafID = this._contentWin.requestAnimationFrame(this._onRefreshDriverTick);
-  }, {
-  }),
+  startRecording: actorBridge("startRecording", {}),
 
-  /**
-   * Stops monitoring framerate, returning the recorded values.
-   */
-  stopRecording: method(function(beginAt = 0, endAt = Number.MAX_SAFE_INTEGER) {
-    if (!this._recording) {
-      return [];
-    }
-    let ticks = this.getPendingTicks(beginAt, endAt);
-    this.cancelRecording();
-    return ticks;
-  }, {
+  stopRecording: actorBridge("stopRecording", {
     request: {
       beginAt: Arg(0, "nullable:number"),
       endAt: Arg(1, "nullable:number")
@@ -63,61 +36,19 @@ let FramerateActor = exports.FramerateActor = protocol.ActorClass({
     response: { ticks: RetVal("array:number") }
   }),
 
-  /**
-   * Stops monitoring framerate, without returning the recorded values.
-   */
-  cancelRecording: method(function() {
-    this._contentWin.cancelAnimationFrame(this._rafID);
-    this._recording = false;
-    this._ticks = null;
-    this._rafID = -1;
-  }, {
-  }),
+  cancelRecording: actorBridge("cancelRecording"),
 
-  /**
-   * Returns whether this actor is currently active.
-   */
-  isRecording: method(function() {
-    return !!this._recording;
-  }, {
+  isRecording: actorBridge("isRecording", {
     response: { recording: RetVal("boolean") }
   }),
 
-  /**
-   * Gets the refresh driver ticks recorded so far.
-   */
-  getPendingTicks: method(function(beginAt = 0, endAt = Number.MAX_SAFE_INTEGER) {
-    if (!this._ticks) {
-      return [];
-    }
-    return this._ticks.filter(e => e >= beginAt && e <= endAt);
-  }, {
+  getPendingTicks: actorBridge("getPendingTicks", {
     request: {
       beginAt: Arg(0, "nullable:number"),
       endAt: Arg(1, "nullable:number")
     },
     response: { ticks: RetVal("array:number") }
   }),
-
-  /**
-   * Function invoked along with the refresh driver.
-   */
-  _onRefreshDriverTick: function() {
-    if (!this._recording) {
-      return;
-    }
-    this._rafID = this._contentWin.requestAnimationFrame(this._onRefreshDriverTick);
-    this._ticks.push(this.tabActor.docShell.now() - this._startTime);
-  },
-
-  /**
-   * When the content window for the tab actor is created.
-   */
-  _onGlobalCreated: function (win) {
-    if (this._recording) {
-      this._rafID = this._contentWin.requestAnimationFrame(this._onRefreshDriverTick);
-    }
-  }
 });
 
 /**
diff --git a/toolkit/devtools/server/actors/inspector.js b/toolkit/devtools/server/actors/inspector.js
index 5959f6230c2c..c9c2525adf7b 100644
--- a/toolkit/devtools/server/actors/inspector.js
+++ b/toolkit/devtools/server/actors/inspector.js
@@ -935,6 +935,17 @@ let NodeFront = protocol.FrontClass(NodeActor, {
     return "isDisplayed" in this._form ? this._form.isDisplayed : true;
   },
 
+  get isTreeDisplayed() {
+    let parent = this;
+    while (parent) {
+      if (!parent.isDisplayed) {
+        return false;
+      }
+      parent = parent.parentNode();
+    }
+    return true;
+  },
+
   getNodeValue: protocol.custom(function() {
     if (!this.incompleteValue) {
       return delayedResolve(new ShortLongString(this.shortValue));
@@ -1295,7 +1306,9 @@ var WalkerActor = protocol.ActorClass({
 
   getDocumentWalker: function(node, whatToShow) {
     // Allow native anon content (like <video> controls) if preffed on
-    let nodeFilter = this.showAllAnonymousContent ? allAnonymousContentTreeWalkerFilter : standardTreeWalkerFilter;
+    let nodeFilter = this.showAllAnonymousContent
+                        ? allAnonymousContentTreeWalkerFilter
+                        : standardTreeWalkerFilter;
     return new DocumentWalker(node, this.rootWin, whatToShow, nodeFilter);
   },
 
@@ -1418,9 +1431,16 @@ var WalkerActor = protocol.ActorClass({
     let nodeActors = [];
     let newParents = new Set();
     for (let node of nodes) {
-      // Be sure we deal with NodeActor only.
-      if (!(node instanceof NodeActor))
+      if (!(node instanceof NodeActor)) {
+        // If an anonymous node was passed in and we aren't supposed to know
+        // about it, then consult with the document walker as the source of
+        // truth about which elements exist.
+        if (!this.showAllAnonymousContent && LayoutHelpers.isAnonymous(node)) {
+          node = this.getDocumentWalker(node).currentNode;
+        }
+
         node = this._ref(node);
+      }
 
       this.ensurePathToRoot(node, newParents);
       // If nodes may be an array of raw nodes, we're sure to only have
@@ -3782,8 +3802,16 @@ function DocumentWalker(node, rootWin, whatToShow=Ci.nsIDOMNodeFilter.SHOW_ALL,
   this.walker.showSubDocuments = true;
   this.walker.showDocumentsAsNodes = true;
   this.walker.init(rootWin.document, whatToShow);
-  this.walker.currentNode = node;
   this.filter = filter;
+
+  // Make sure that the walker knows about the initial node (which could
+  // be skipped due to a filter).  Note that simply calling parentNode()
+  // causes currentNode to be updated.
+  this.walker.currentNode = node;
+  while (node &&
+         this.filter(node) === Ci.nsIDOMNodeFilter.FILTER_SKIP) {
+    node = this.walker.parentNode();
+  }
 }
 
 DocumentWalker.prototype = {
diff --git a/toolkit/devtools/server/actors/memory.js b/toolkit/devtools/server/actors/memory.js
index d60bf1747ddf..78d6b41b4835 100644
--- a/toolkit/devtools/server/actors/memory.js
+++ b/toolkit/devtools/server/actors/memory.js
@@ -6,22 +6,12 @@
 
 const protocol = require("devtools/server/protocol");
 const { method, RetVal, Arg, types } = protocol;
-const { MemoryBridge } = require("./utils/memory-bridge");
+const { Memory } = require("devtools/toolkit/shared/memory");
+const { actorBridge } = require("devtools/server/actors/common");
 loader.lazyRequireGetter(this, "events", "sdk/event/core");
 loader.lazyRequireGetter(this, "StackFrameCache",
                          "devtools/server/actors/utils/stack", true);
 
-/**
- * Proxies a call to the MemoryActor to the underlying MemoryBridge,
- * allowing access to MemoryBridge features by defining the RDP
- * request/response signature.
- */
-function linkBridge (methodName, definition) {
-  return method(function () {
-    return this.bridge[methodName].apply(this.bridge, arguments);
-  }, definition);
-}
-
 types.addDictType("AllocationsRecordingOptions", {
   // The probability we sample any given allocation when recording
   // allocations. Must be between 0.0 and 1.0. Defaults to 1.0, or sampling
@@ -39,8 +29,13 @@ types.addDictType("AllocationsRecordingOptions", {
  * A tab-scoped instance of this actor will measure the memory footprint of its
  * parent tab. A global-scoped instance however, will measure the memory
  * footprint of the chrome window referenced by the root actor.
+ * 
+ * This actor wraps the Memory module at toolkit/devtools/shared/memory.js
+ * and provides RDP definitions.
+ *
+ * @see toolkit/devtools/shared/memory.js for documentation.
  */
-let MemoryActor = protocol.ActorClass({
+let MemoryActor = exports.MemoryActor = protocol.ActorClass({
   typeName: "memory",
 
   /**
@@ -62,7 +57,7 @@ let MemoryActor = protocol.ActorClass({
     protocol.Actor.prototype.initialize.call(this, conn);
 
     this._onGarbageCollection = this._onGarbageCollection.bind(this);
-    this.bridge = new MemoryBridge(parent, frameCache);
+    this.bridge = new Memory(parent, frameCache);
     this.bridge.on("garbage-collection", this._onGarbageCollection);
   },
 
@@ -72,55 +67,32 @@ let MemoryActor = protocol.ActorClass({
     protocol.Actor.prototype.destroy.call(this);
   },
 
-  /**
-   * Attach to this MemoryActor.
-   *
-   * This attaches the MemoryActor's Debugger instance so that you can start
-   * recording allocations or take a census of the heap. In addition, the
-   * MemoryActor will start emitting GC events.
-   */
-  attach: linkBridge("attach", {
+  attach: actorBridge("attach", {
     request: {},
     response: {
       type: "attached"
     }
   }),
 
-  /**
-   * Detach from this MemoryActor.
-   */
-  detach: linkBridge("detach", {
+  detach: actorBridge("detach", {
     request: {},
     response: {
       type: "detached"
     }
   }),
 
-  /**
-   * Gets the current MemoryActor attach/detach state.
-   */
-  getState: linkBridge("getState", {
+  getState: actorBridge("getState", {
     response: {
       state: RetVal(0, "string")
     }
   }),
 
-  /**
-   * Take a census of the heap. See js/src/doc/Debugger/Debugger.Memory.md for
-   * more information.
-   */
-  takeCensus: linkBridge("takeCensus", {
+  takeCensus: actorBridge("takeCensus", {
     request: {},
     response: RetVal("json")
   }),
 
-  /**
-   * Start recording allocation sites.
-   *
-   * @param AllocationsRecordingOptions options
-   *        See the protocol.js definition of AllocationsRecordingOptions above.
-   */
-  startRecordingAllocations: linkBridge("startRecordingAllocations", {
+  startRecordingAllocations: actorBridge("startRecordingAllocations", {
     request: {
       options: Arg(0, "nullable:AllocationsRecordingOptions")
     },
@@ -130,10 +102,7 @@ let MemoryActor = protocol.ActorClass({
     }
   }),
 
-  /**
-   * Stop recording allocation sites.
-   */
-  stopRecordingAllocations: linkBridge("stopRecordingAllocations", {
+  stopRecordingAllocations: actorBridge("stopRecordingAllocations", {
     request: {},
     response: {
       // Accept `nullable` in the case of server Gecko <= 37, handled on the front
@@ -141,67 +110,43 @@ let MemoryActor = protocol.ActorClass({
     }
   }),
 
-  /**
-   * Return settings used in `startRecordingAllocations` for `probability`
-   * and `maxLogLength`. Currently only uses in tests.
-   */
-  getAllocationsSettings: linkBridge("getAllocationsSettings", {
+  getAllocationsSettings: actorBridge("getAllocationsSettings", {
     request: {},
     response: {
       options: RetVal(0, "json")
     }
   }),
 
-  getAllocations: linkBridge("getAllocations", {
+  getAllocations: actorBridge("getAllocations", {
     request: {},
     response: RetVal("json")
   }),
 
-  /*
-   * Force a browser-wide GC.
-   */
-  forceGarbageCollection: linkBridge("forceGarbageCollection", {
+  forceGarbageCollection: actorBridge("forceGarbageCollection", {
     request: {},
     response: {}
   }),
 
-  /**
-   * Force an XPCOM cycle collection. For more information on XPCOM cycle
-   * collection, see
-   * https://developer.mozilla.org/en-US/docs/Interfacing_with_the_XPCOM_cycle_collector#What_the_cycle_collector_does
-   */
-  forceCycleCollection: linkBridge("forceCycleCollection", {
+  forceCycleCollection: actorBridge("forceCycleCollection", {
     request: {},
     response: {}
   }),
 
-  /**
-   * A method that returns a detailed breakdown of the memory consumption of the
-   * associated window.
-   *
-   * @returns object
-   */
-  measure: linkBridge("measure", {
+  measure: actorBridge("measure", {
     request: {},
     response: RetVal("json"),
   }),
 
-  residentUnique: linkBridge("residentUnique", {
+  residentUnique: actorBridge("residentUnique", {
     request: {},
     response: { value: RetVal("number") }
   }),
 
-  /**
-   * Called when the underlying MemoryBridge fires a "garbage-collection" events.
-   * Propagates over RDP.
-   */
   _onGarbageCollection: function (data) {
     events.emit(this, "garbage-collection", data);
   },
 });
 
-exports.MemoryActor = MemoryActor;
-
 exports.MemoryFront = protocol.FrontClass(MemoryActor, {
   initialize: function(client, form) {
     protocol.Front.prototype.initialize.call(this, client, form);
diff --git a/toolkit/devtools/server/actors/object.js b/toolkit/devtools/server/actors/object.js
index d4a3f618d271..e47c9d194787 100644
--- a/toolkit/devtools/server/actors/object.js
+++ b/toolkit/devtools/server/actors/object.js
@@ -84,15 +84,8 @@ ObjectActor.prototype = {
     };
 
     if (this.obj.class != "DeadObject") {
-      // Expose internal Promise state.
       if (this.obj.class == "Promise") {
-        const { state, value, reason } = getPromiseState(this.obj);
-        g.promiseState = { state };
-        if (state == "fulfilled") {
-          g.promiseState.value = this.hooks.createValueGrip(value);
-        } else if (state == "rejected") {
-          g.promiseState.reason = this.hooks.createValueGrip(reason);
-        }
+        g.promiseState = this._createPromiseState();
       }
 
       // FF40+: Allow to know how many properties an object has
@@ -135,6 +128,32 @@ ObjectActor.prototype = {
     return g;
   },
 
+  /**
+   * Returns an object exposing the internal Promise state.
+   */
+  _createPromiseState: function() {
+    const { state, value, reason } = getPromiseState(this.obj);
+    let promiseState = { state };
+    let rawPromise = this.obj.unsafeDereference();
+
+    if (state == "fulfilled") {
+      promiseState.value = this.hooks.createValueGrip(value);
+    } else if (state == "rejected") {
+      promiseState.reason = this.hooks.createValueGrip(reason);
+    }
+
+    promiseState.creationTimestamp = Date.now() -
+      PromiseDebugging.getPromiseLifetime(rawPromise);
+
+    // If the promise is not settled, avoid adding the timeToSettle property
+    // and catch the error thrown by PromiseDebugging.getTimeToSettle.
+    try {
+      promiseState.timeToSettle = PromiseDebugging.getTimeToSettle(rawPromise);
+    } catch(e) {}
+
+    return promiseState;
+  },
+
   /**
    * Releases this actor from the pool.
    */
@@ -499,6 +518,28 @@ ObjectActor.prototype = {
     }
 
     return { from: this.actorID, scope: envActor.form() };
+  },
+
+  /**
+   * Handle a protocol request to get the list of dependent promises of a
+   * promise.
+   *
+   * @return object
+   *         Returns an object containing an array of object grips of the
+   *         dependent promises
+   */
+  onDependentPromises: function() {
+    if (this.obj.class != "Promise") {
+      return { error: "objectNotPromise",
+               message: "'dependentPromises' request is only valid for " +
+                        "object grips with a 'Promise' class." };
+    }
+
+    let rawPromise = this.obj.unsafeDereference();
+    let promises = PromiseDebugging.getDependentPromises(rawPromise).map(p =>
+      this.hooks.createValueGrip(this.obj.makeDebuggeeValue(p)));
+
+    return { promises };
   }
 };
 
@@ -514,6 +555,7 @@ ObjectActor.prototype.requestTypes = {
   "decompile": ObjectActor.prototype.onDecompile,
   "release": ObjectActor.prototype.onRelease,
   "scope": ObjectActor.prototype.onScope,
+  "dependentPromises": ObjectActor.prototype.onDependentPromises
 };
 
 /**
diff --git a/toolkit/devtools/server/actors/styles.js b/toolkit/devtools/server/actors/styles.js
index 49a024b64c1f..33a63d72ab4e 100644
--- a/toolkit/devtools/server/actors/styles.js
+++ b/toolkit/devtools/server/actors/styles.js
@@ -13,7 +13,7 @@ const events = require("sdk/event/core");
 const object = require("sdk/util/object");
 const {Class} = require("sdk/core/heritage");
 const {LongStringActor} = require("devtools/server/actors/string");
-
+const {PSEUDO_ELEMENT_SET} = require("devtools/styleinspector/css-logic");
 
 // This will add the "stylesheet" actor type for protocol.js to recognize
 require("devtools/server/actors/stylesheets");
@@ -27,7 +27,18 @@ loader.lazyGetter(this, "DOMUtils", () => Cc["@mozilla.org/inspector/dom-utils;1
 const ELEMENT_STYLE = 100;
 exports.ELEMENT_STYLE = ELEMENT_STYLE;
 
-const PSEUDO_ELEMENTS = [":first-line", ":first-letter", ":before", ":after", ":-moz-selection"];
+// Not included since these are uneditable by the user.
+// See https://hg.mozilla.org/mozilla-central/file/696a4ad5d011/layout/style/nsCSSPseudoElementList.h#l74
+PSEUDO_ELEMENT_SET.delete(":-moz-meter-bar");
+PSEUDO_ELEMENT_SET.delete(":-moz-list-bullet");
+PSEUDO_ELEMENT_SET.delete(":-moz-list-number");
+PSEUDO_ELEMENT_SET.delete(":-moz-focus-inner");
+PSEUDO_ELEMENT_SET.delete(":-moz-focus-outer");
+PSEUDO_ELEMENT_SET.delete(":-moz-math-anonymous");
+PSEUDO_ELEMENT_SET.delete(":-moz-math-stretchy");
+
+const PSEUDO_ELEMENTS = Array.from(PSEUDO_ELEMENT_SET);
+
 exports.PSEUDO_ELEMENTS = PSEUDO_ELEMENTS;
 
 // When gathering rules to read for pseudo elements, we will skip
@@ -494,7 +505,7 @@ var PageStyleActor = protocol.ActorClass({
    *     'ua': Include properties from user and user-agent sheets.
    *     Default value is 'ua'
    *   `inherited`: Include styles inherited from parent nodes.
-   *   `matchedSeletors`: Include an array of specific selectors that
+   *   `matchedSelectors`: Include an array of specific selectors that
    *     caused this rule to match its node.
    */
   getApplied: method(function(node, options) {
@@ -548,19 +559,22 @@ var PageStyleActor = protocol.ActorClass({
     let showElementStyles = !inherited && !pseudo;
     let showInheritedStyles = inherited && this._hasInheritedProps(bindingElement.style);
 
+    let rule = {
+      rule: elementStyle,
+      pseudoElement: null,
+      isSystem: false,
+      inherited: false
+    };
+
     // First any inline styles
     if (showElementStyles) {
-      rules.push({
-        rule: elementStyle,
-      });
+      rules.push(rule);
     }
 
     // Now any inherited styles
     if (showInheritedStyles) {
-      rules.push({
-        rule: elementStyle,
-        inherited: inherited
-      });
+      rule.inherited = inherited;
+      rules.push(rule);
     }
 
     // Add normal rules.  Typically this is passing in the node passed into the
@@ -862,10 +876,12 @@ var PageStyleActor = protocol.ActorClass({
 
   /**
    * Adds a new rule, and returns the new StyleRuleActor.
-   * @param   NodeActor node
+   * @param NodeActor node
+   * @param [string] pseudoClasses The list of pseudo classes to append to the
+   * new selector.
    * @returns StyleRuleActor of the new rule
    */
-  addNewRule: method(function(node) {
+  addNewRule: method(function(node, pseudoClasses) {
     let style = this.styleElement;
     let sheet = style.sheet;
     let cssRules = sheet.cssRules;
@@ -881,11 +897,16 @@ var PageStyleActor = protocol.ActorClass({
       selector = rawNode.tagName.toLowerCase();
     }
 
+    if (pseudoClasses && pseudoClasses.length > 0) {
+      selector += pseudoClasses.join("");
+    }
+
     let index = sheet.insertRule(selector + " {}", cssRules.length);
     return this.getNewAppliedProps(node, cssRules.item(index));
   }, {
     request: {
-      node: Arg(0, "domnode")
+      node: Arg(0, "domnode"),
+      pseudoClasses: Arg(1, "nullable:array:string")
     },
     response: RetVal("appliedStylesReturn")
   }),
@@ -939,8 +960,8 @@ var PageStyleFront = protocol.FrontClass(PageStyleActor, {
     impl: "_getApplied"
   }),
 
-  addNewRule: protocol.custom(function(node) {
-    return this._addNewRule(node).then(ret => {
+  addNewRule: protocol.custom(function(node, pseudoClasses) {
+    return this._addNewRule(node, pseudoClasses).then(ret => {
       return ret.entries[0];
     });
   }, {
diff --git a/toolkit/devtools/server/actors/timeline.js b/toolkit/devtools/server/actors/timeline.js
index 514588cd1d13..2d2ef01b938e 100644
--- a/toolkit/devtools/server/actors/timeline.js
+++ b/toolkit/devtools/server/actors/timeline.js
@@ -26,7 +26,7 @@ const events = require("sdk/event/core");
 const {setTimeout, clearTimeout} = require("sdk/timers");
 const {Task} = Cu.import("resource://gre/modules/Task.jsm", {});
 
-const {MemoryBridge} = require("devtools/server/actors/utils/memory-bridge");
+const {Memory} = require("devtools/toolkit/shared/memory");
 const {FramerateActor} = require("devtools/server/actors/framerate");
 const {StackFrameCache} = require("devtools/server/actors/utils/stack");
 
@@ -265,7 +265,7 @@ let TimelineActor = exports.TimelineActor = protocol.ActorClass({
       docShell.recordProfileTimelineMarkers = true;
     }
 
-    this._memoryBridge = new MemoryBridge(this.tabActor, this._stackFrames);
+    this._memoryBridge = new Memory(this.tabActor, this._stackFrames);
     this._memoryBridge.attach();
     events.on(this._memoryBridge, "garbage-collection", this._onGarbageCollection);
 
diff --git a/toolkit/devtools/server/moz.build b/toolkit/devtools/server/moz.build
index be7bb2f520eb..5762aa57093b 100644
--- a/toolkit/devtools/server/moz.build
+++ b/toolkit/devtools/server/moz.build
@@ -102,7 +102,6 @@ EXTRA_JS_MODULES.devtools.server.actors.utils += [
     'actors/utils/automation-timeline.js',
     'actors/utils/make-debugger.js',
     'actors/utils/map-uri-to-addon-id.js',
-    'actors/utils/memory-bridge.js',
     'actors/utils/ScriptStore.js',
     'actors/utils/stack.js',
     'actors/utils/TabSources.js'
diff --git a/toolkit/devtools/server/tests/mochitest/test_inspector-anonymous.html b/toolkit/devtools/server/tests/mochitest/test_inspector-anonymous.html
index 061fbb0c7b67..265878802829 100644
--- a/toolkit/devtools/server/tests/mochitest/test_inspector-anonymous.html
+++ b/toolkit/devtools/server/tests/mochitest/test_inspector-anonymous.html
@@ -13,10 +13,13 @@ https://bugzilla.mozilla.org/show_bug.cgi?id=777674
   <script type="application/javascript;version=1.8">
 window.onload = function() {
   Components.utils.import("resource://gre/modules/devtools/Loader.jsm");
+  const Ci = Components.interfaces;
   const {Promise: promise} =
     Components.utils.import("resource://gre/modules/Promise.jsm", {});
   const {InspectorFront} =
     devtools.require("devtools/server/actors/inspector");
+  const {_documentWalker} =
+    devtools.require("devtools/server/actors/inspector");
   const XUL_NS = "http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul";
 
   Services.prefs.setBoolPref("dom.webcomponents.enabled", true);
@@ -69,6 +72,32 @@ window.onload = function() {
     runNextTest();
   });
 
+  addAsyncTest(function* testNativeAnonymousStartingNode() {
+    info ("Tests attaching an element that a walker can't see.");
+
+    let serverConnection = gWalker.conn._transport._serverConnection;
+    let serverWalker = serverConnection.getActor(gWalker.actorID);
+    let docwalker = new _documentWalker(
+      gInspectee.querySelector("select"),
+      gInspectee.defaultView,
+      Ci.nsIDOMNodeFilter.SHOW_ALL,
+      () => {
+        return Ci.nsIDOMNodeFilter.FILTER_ACCEPT
+      }
+    );
+    let scrollbar = docwalker.lastChild();
+    is (scrollbar.tagName, "scrollbar", "An anonymous child has been fetched");
+
+    let node = yield serverWalker.attachElement(scrollbar);
+
+    ok (node, "A response has arrived");
+    ok (node.node, "A node is in the response");
+    is (node.node.rawNode.tagName, "SELECT",
+      "The node has changed to a parent that the walker recognizes");
+
+    runNextTest();
+  });
+
   addAsyncTest(function* testPseudoElements() {
     info ("Testing pseudo elements with walker.");
 
diff --git a/toolkit/devtools/server/tests/mochitest/test_styles-applied.html b/toolkit/devtools/server/tests/mochitest/test_styles-applied.html
index 45b2ac0cbd38..c5f25d838303 100644
--- a/toolkit/devtools/server/tests/mochitest/test_styles-applied.html
+++ b/toolkit/devtools/server/tests/mochitest/test_styles-applied.html
@@ -88,7 +88,7 @@ addTest(function inheritedSystemStyles() {
     ok(!applied[1].rule.parentStyleSheet.system, "Entry 1 should be a system style");
     is(applied[1].rule.type, 1, "Entry 1 should be a rule style");
 
-    is(applied.length, 7, "Should have 7 rules.");
+    is(applied.length, 8, "Should have 8 rules.");
   }).then(runNextTest));
 });
 
diff --git a/toolkit/devtools/server/tests/unit/test_promises_actor_list_promises.js b/toolkit/devtools/server/tests/unit/test_promises_actor_list_promises.js
index a2b115e17c7d..ed971706600f 100644
--- a/toolkit/devtools/server/tests/unit/test_promises_actor_list_promises.js
+++ b/toolkit/devtools/server/tests/unit/test_promises_actor_list_promises.js
@@ -43,6 +43,10 @@ function* testListPromises(client, form, makePromise) {
   for (let p of promises) {
     equal(p.type, "object", "Expect type to be Object");
     equal(p.class, "Promise", "Expect class to be Promise");
+    equal(typeof p.promiseState.creationTimestamp, "number",
+      "Expect creation timestamp to be a number");
+    equal(typeof p.promiseState.timeToSettle, "number",
+      "Expect time to settle to be a number");
 
     if (p.promiseState.state === "fulfilled" &&
         p.promiseState.value === resolution) {
diff --git a/toolkit/devtools/server/tests/unit/test_promises_actor_onnewpromise.js b/toolkit/devtools/server/tests/unit/test_promises_actor_onnewpromise.js
index 8b2401a48151..d53792aff951 100644
--- a/toolkit/devtools/server/tests/unit/test_promises_actor_onnewpromise.js
+++ b/toolkit/devtools/server/tests/unit/test_promises_actor_onnewpromise.js
@@ -46,6 +46,8 @@ function* testNewPromisesEvent(client, form, makePromise) {
       for (let p of promises) {
         equal(p.type, "object", "Expect type to be Object");
         equal(p.class, "Promise", "Expect class to be Promise");
+        equal(typeof p.promiseState.creationTimestamp, "number",
+          "Expect creation timestamp to be a number");
 
         if (p.promiseState.state === "fulfilled" &&
             p.promiseState.value === resolution) {
diff --git a/toolkit/devtools/server/tests/unit/test_promises_actor_onpromisesettled.js b/toolkit/devtools/server/tests/unit/test_promises_actor_onpromisesettled.js
index 75ad134b66ef..5af47f6d837a 100644
--- a/toolkit/devtools/server/tests/unit/test_promises_actor_onpromisesettled.js
+++ b/toolkit/devtools/server/tests/unit/test_promises_actor_onpromisesettled.js
@@ -67,12 +67,20 @@ function oncePromiseSettled(front, resolution, resolveValue, rejectValue) {
       for (let p of promises) {
         equal(p.type, "object", "Expect type to be Object");
         equal(p.class, "Promise", "Expect class to be Promise");
+        equal(typeof p.promiseState.creationTimestamp, "number",
+          "Expect creation timestamp to be a number");
+        equal(typeof p.promiseState.timeToSettle, "number",
+          "Expect time to settle to be a number");
 
         if (p.promiseState.state === "fulfilled" &&
             p.promiseState.value === resolution) {
+          equal(Math.floor(p.promiseState.timeToSettle), 0,
+            "Expect time to settle for resolved promise to be 0.");
           resolve(resolveValue);
         } else if (p.promiseState.state === "rejected" &&
                    p.promiseState.reason === resolution) {
+          equal(Math.floor(p.promiseState.timeToSettle), 0,
+            "Expect time to settle for rejected promise to be 0.");
           resolve(rejectValue);
         } else {
           dump("Found non-target promise\n");
diff --git a/toolkit/devtools/server/tests/unit/test_promises_client_getdependentpromises.js b/toolkit/devtools/server/tests/unit/test_promises_client_getdependentpromises.js
new file mode 100644
index 000000000000..3f4ebcfe8107
--- /dev/null
+++ b/toolkit/devtools/server/tests/unit/test_promises_client_getdependentpromises.js
@@ -0,0 +1,110 @@
+/* Any copyright is dedicated to the Public Domain.
+   http://creativecommons.org/publicdomain/zero/1.0/ */
+
+/**
+ * Test that we can get the list of dependent promises from the ObjectClient.
+ */
+
+"use strict";
+
+const { PromisesFront } = devtools.require("devtools/server/actors/promises");
+
+let events = devtools.require("sdk/event/core");
+
+add_task(function*() {
+  let client = yield startTestDebuggerServer("test-promises-dependentpromises");
+  let chromeActors = yield getChromeActors(client);
+
+  ok(Promise.toString().contains("native code"), "Expect native DOM Promise.");
+
+  yield testGetDependentPromises(client, chromeActors, () => {
+    let p = new Promise(() => {});
+    p.name = "p";
+    let q = p.then();
+    q.name = "q";
+    let r = p.then(null, () => {});
+    r.name = "r";
+
+    return p;
+  });
+
+  let response = yield listTabs(client);
+  let targetTab = findTab(response.tabs, "test-promises-dependentpromises");
+  ok(targetTab, "Found our target tab.");
+
+  yield testGetDependentPromises(client, targetTab, () => {
+    const debuggee =
+      DebuggerServer.getTestGlobal("test-promises-dependentpromises");
+
+    let p = new debuggee.Promise(() => {});
+    p.name = "p";
+    let q = p.then();
+    q.name = "q";
+    let r = p.then(null, () => {});
+    r.name = "r";
+
+    return p;
+  });
+
+  yield close(client);
+});
+
+function* testGetDependentPromises(client, form, makePromises) {
+  let front = PromisesFront(client, form);
+
+  yield front.attach();
+  yield front.listPromises();
+
+  // Get the grip for promise p
+  let onNewPromise = new Promise(resolve => {
+    events.on(front, "new-promises", promises => {
+      for (let p of promises) {
+        if (p.preview.ownProperties.name &&
+            p.preview.ownProperties.name.value === "p") {
+          resolve(p);
+        }
+      }
+    });
+  });
+
+  let promise = makePromises();
+
+  let grip = yield onNewPromise;
+  ok(grip, "Found our promise p.");
+
+  let objectClient = new ObjectClient(client, grip);
+  ok(objectClient, "Got Object Client.");
+
+  // Get the dependent promises for promise p and assert that the list of
+  // dependent promises is correct
+  yield new Promise(resolve => {
+    objectClient.getDependentPromises(response => {
+      let dependentNames = response.promises.map(p =>
+        p.preview.ownProperties.name.value);
+      let expectedDependentNames = ["q", "r"];
+
+      equal(dependentNames.length, expectedDependentNames.length,
+        "Got expected number of dependent promises.");
+
+      for (let i = 0; i < dependentNames.length; i++) {
+        equal(dependentNames[i], expectedDependentNames[i],
+          "Got expected dependent name.");
+      }
+
+      for (let p of response.promises) {
+        equal(p.type, "object", "Expect type to be Object.");
+        equal(p.class, "Promise", "Expect class to be Promise.");
+        equal(typeof p.promiseState.creationTimestamp, "number",
+          "Expect creation timestamp to be a number.");
+        ok(!p.promiseState.timeToSettle,
+          "Expect time to settle to be undefined.");
+      }
+
+      resolve();
+    });
+  });
+
+  yield front.detach();
+  // Appease eslint
+  void promise;
+}
diff --git a/toolkit/devtools/server/tests/unit/test_promises_object_creationtimestamp.js b/toolkit/devtools/server/tests/unit/test_promises_object_creationtimestamp.js
new file mode 100644
index 000000000000..f87e48ad6f95
--- /dev/null
+++ b/toolkit/devtools/server/tests/unit/test_promises_object_creationtimestamp.js
@@ -0,0 +1,69 @@
+/* Any copyright is dedicated to the Public Domain.
+   http://creativecommons.org/publicdomain/zero/1.0/ */
+
+/**
+ * Test that we get the approximate time range for promise creation timestamp.
+ */
+
+"use strict";
+
+const { PromisesFront } = devtools.require("devtools/server/actors/promises");
+
+let events = devtools.require("sdk/event/core");
+
+add_task(function*() {
+  let client = yield startTestDebuggerServer("promises-object-test");
+  let chromeActors = yield getChromeActors(client);
+
+  ok(Promise.toString().contains("native code"), "Expect native DOM Promise.");
+
+  yield testPromiseCreationTimestamp(client, chromeActors, v => {
+    return new Promise(resolve => resolve(v));
+  });
+
+  let response = yield listTabs(client);
+  let targetTab = findTab(response.tabs, "promises-object-test");
+  ok(targetTab, "Found our target tab.");
+
+  yield testPromiseCreationTimestamp(client, targetTab, v => {
+    const debuggee = DebuggerServer.getTestGlobal("promises-object-test");
+    return debuggee.Promise.resolve(v);
+  });
+
+  yield close(client);
+});
+
+function* testPromiseCreationTimestamp(client, form, makePromise) {
+  let front = PromisesFront(client, form);
+  let resolution = "MyLittleSecret" + Math.random();
+
+  yield front.attach();
+  yield front.listPromises();
+
+  let onNewPromise = new Promise(resolve => {
+    events.on(front, "new-promises", promises => {
+      for (let p of promises) {
+        if (p.promiseState.state === "fulfilled" &&
+            p.promiseState.value === resolution) {
+          resolve(p);
+        }
+      }
+    });
+  });
+
+  let start = Date.now();
+  let promise = makePromise(resolution);
+  let end = Date.now();
+
+  let grip = yield onNewPromise;
+  ok(grip, "Found our new promise.");
+
+  let creationTimestamp = grip.promiseState.creationTimestamp;
+
+  ok(start - 1 <= creationTimestamp && creationTimestamp <= end + 1,
+    "Expect promise creation timestamp to be within elapsed time range.");
+
+  yield front.detach();
+  // Appease eslint
+  void promise;
+}
diff --git a/toolkit/devtools/server/tests/unit/test_promises_object_timetosettle-01.js b/toolkit/devtools/server/tests/unit/test_promises_object_timetosettle-01.js
new file mode 100644
index 000000000000..d317783db462
--- /dev/null
+++ b/toolkit/devtools/server/tests/unit/test_promises_object_timetosettle-01.js
@@ -0,0 +1,78 @@
+/* Any copyright is dedicated to the Public Domain.
+   http://creativecommons.org/publicdomain/zero/1.0/ */
+
+/**
+ * Test whether or not we get the time to settle depending on the state of the
+ * promise.
+ */
+
+"use strict";
+
+const { PromisesFront } = devtools.require("devtools/server/actors/promises");
+
+let events = devtools.require("sdk/event/core");
+
+add_task(function*() {
+  let client = yield startTestDebuggerServer("test-promises-timetosettle");
+  let chromeActors = yield getChromeActors(client);
+
+  ok(Promise.toString().contains("native code"), "Expect native DOM Promise.");
+
+  yield testGetTimeToSettle(client, chromeActors, () => {
+    let p = new Promise(() => {});
+    p.name = "p";
+    let q = p.then();
+    q.name = "q";
+
+    return p;
+  });
+
+  let response = yield listTabs(client);
+  let targetTab = findTab(response.tabs, "test-promises-timetosettle");
+  ok(targetTab, "Found our target tab.");
+
+  yield testGetTimeToSettle(client, targetTab, () => {
+    const debuggee =
+      DebuggerServer.getTestGlobal("test-promises-timetosettle");
+
+    let p = new debuggee.Promise(() => {});
+    p.name = "p";
+    let q = p.then();
+    q.name = "q";
+
+    return p;
+  });
+
+  yield close(client);
+});
+
+function* testGetTimeToSettle(client, form, makePromises) {
+  let front = PromisesFront(client, form);
+
+  yield front.attach();
+  yield front.listPromises();
+
+  let onNewPromise = new Promise(resolve => {
+    events.on(front, "new-promises", promises => {
+      for (let p of promises) {
+        if (p.promiseState.state === "pending") {
+          ok(!p.promiseState.timeToSettle,
+            "Expect no time to settle for unsettled promise.");
+        } else {
+          ok(p.promiseState.timeToSettle,
+            "Expect time to settle for settled promise.");
+          equal(typeof p.promiseState.timeToSettle, "number",
+            "Expect time to settle to be a number.");
+        }
+      }
+      resolve();
+    });
+  });
+
+  let promise = makePromises();
+
+  yield onNewPromise;
+  yield front.detach();
+  // Appease eslint
+  void promise;
+}
diff --git a/toolkit/devtools/server/tests/unit/test_promises_object_timetosettle-02.js b/toolkit/devtools/server/tests/unit/test_promises_object_timetosettle-02.js
new file mode 100644
index 000000000000..4d59ebd7da75
--- /dev/null
+++ b/toolkit/devtools/server/tests/unit/test_promises_object_timetosettle-02.js
@@ -0,0 +1,69 @@
+/* Any copyright is dedicated to the Public Domain.
+   http://creativecommons.org/publicdomain/zero/1.0/ */
+
+/**
+ * Test that we get the expected settlement time for promise time to settle.
+ */
+
+"use strict";
+
+const { PromisesFront } = devtools.require("devtools/server/actors/promises");
+const { setTimeout } = devtools.require("sdk/timers");
+
+let events = devtools.require("sdk/event/core");
+
+add_task(function*() {
+  let client = yield startTestDebuggerServer("test-promises-timetosettle");
+  let chromeActors = yield getChromeActors(client);
+
+  ok(Promise.toString().contains("native code"), "Expect native DOM Promise.");
+
+  yield testGetTimeToSettle(client, chromeActors,
+    v => new Promise(resolve => setTimeout(() => resolve(v), 100)));
+
+  let response = yield listTabs(client);
+  let targetTab = findTab(response.tabs, "test-promises-timetosettle");
+  ok(targetTab, "Found our target tab.");
+
+  yield testGetTimeToSettle(client, targetTab, v => {
+    const debuggee =
+      DebuggerServer.getTestGlobal("test-promises-timetosettle");
+    return new debuggee.Promise(resolve => setTimeout(() => resolve(v), 100));
+  });
+
+  yield close(client);
+});
+
+function* testGetTimeToSettle(client, form, makePromise) {
+  let front = PromisesFront(client, form);
+  let resolution = "MyLittleSecret" + Math.random();
+  let found = false;
+
+  yield front.attach();
+  yield front.listPromises();
+
+  let onNewPromise = new Promise(resolve => {
+    events.on(front, "promises-settled", promises => {
+      for (let p of promises) {
+        if (p.promiseState.state === "fulfilled" &&
+            p.promiseState.value === resolution) {
+          equal(Math.floor(p.promiseState.timeToSettle / 100) * 100, 100,
+            "Expect time to settle for resolved promise to be " +
+            "approximately 100ms.");
+          found = true;
+          resolve();
+        } else {
+          dump("Found non-target promise.\n");
+        }
+      }
+    });
+  });
+
+  let promise = makePromise(resolution);
+
+  yield onNewPromise;
+  ok(found, "Found our new promise.");
+  yield front.detach();
+  // Appease eslint
+  void promise;
+}
diff --git a/toolkit/devtools/server/tests/unit/xpcshell.ini b/toolkit/devtools/server/tests/unit/xpcshell.ini
index d237a8f84421..9e92fa92c5da 100644
--- a/toolkit/devtools/server/tests/unit/xpcshell.ini
+++ b/toolkit/devtools/server/tests/unit/xpcshell.ini
@@ -85,6 +85,10 @@ support-files =
 [test_promises_actor_list_promises.js]
 [test_promises_actor_onnewpromise.js]
 [test_promises_actor_onpromisesettled.js]
+[test_promises_client_getdependentpromises.js]
+[test_promises_object_creationtimestamp.js]
+[test_promises_object_timetosettle-01.js]
+[test_promises_object_timetosettle-02.js]
 [test_protocol_abort.js]
 [test_protocol_async.js]
 [test_protocol_children.js]
diff --git a/toolkit/devtools/shared/framerate.js b/toolkit/devtools/shared/framerate.js
new file mode 100644
index 000000000000..3d4fa1ecb7f4
--- /dev/null
+++ b/toolkit/devtools/shared/framerate.js
@@ -0,0 +1,98 @@
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
+"use strict";
+
+const { on, once, off, emit } = require("sdk/event/core");
+const { Class } = require("sdk/core/heritage");
+
+/**
+ * A very simple utility for monitoring framerate. Takes a `tabActor`
+ * and monitors framerate over time. The actor wrapper around this
+ * can be found at toolkit/devtools/server/actors/framerate.js
+ */
+let Framerate = exports.Framerate = Class({
+  initialize: function (tabActor) {
+    this.tabActor = tabActor;
+    this._contentWin = tabActor.window;
+    this._onRefreshDriverTick = this._onRefreshDriverTick.bind(this);
+    this._onGlobalCreated = this._onGlobalCreated.bind(this);
+    on(this.tabActor, "window-ready", this._onGlobalCreated);
+  },
+  destroy: function(conn) {
+    off(this.tabActor, "window-ready", this._onGlobalCreated);
+    this.stopRecording();
+  },
+
+  /**
+   * Starts monitoring framerate, storing the frames per second.
+   */
+  startRecording: function () {
+    if (this._recording) {
+      return;
+    }
+    this._recording = true;
+    this._ticks = [];
+    this._startTime = this.tabActor.docShell.now();
+    this._rafID = this._contentWin.requestAnimationFrame(this._onRefreshDriverTick);
+  },
+
+  /**
+   * Stops monitoring framerate, returning the recorded values.
+   */
+  stopRecording: function (beginAt = 0, endAt = Number.MAX_SAFE_INTEGER) {
+    if (!this._recording) {
+      return [];
+    }
+    let ticks = this.getPendingTicks(beginAt, endAt);
+    this.cancelRecording();
+    return ticks;
+  },
+
+  /**
+   * Stops monitoring framerate, without returning the recorded values.
+   */
+  cancelRecording: function () {
+    this._contentWin.cancelAnimationFrame(this._rafID);
+    this._recording = false;
+    this._ticks = null;
+    this._rafID = -1;
+  },
+
+  /**
+   * Returns whether this instance is currently recording.
+   */
+  isRecording: function () {
+    return !!this._recording;
+  },
+
+  /**
+   * Gets the refresh driver ticks recorded so far.
+   */
+  getPendingTicks: function (beginAt = 0, endAt = Number.MAX_SAFE_INTEGER) {
+    if (!this._ticks) {
+      return [];
+    }
+    return this._ticks.filter(e => e >= beginAt && e <= endAt);
+  },
+
+  /**
+   * Function invoked along with the refresh driver.
+   */
+  _onRefreshDriverTick: function () {
+    if (!this._recording) {
+      return;
+    }
+    this._rafID = this._contentWin.requestAnimationFrame(this._onRefreshDriverTick);
+    this._ticks.push(this.tabActor.docShell.now() - this._startTime);
+  },
+
+  /**
+   * When the content window for the tab actor is created.
+   */
+  _onGlobalCreated: function (win) {
+    if (this._recording) {
+      this._rafID = this._contentWin.requestAnimationFrame(this._onRefreshDriverTick);
+    }
+  }
+});
diff --git a/toolkit/devtools/server/actors/utils/memory-bridge.js b/toolkit/devtools/shared/memory.js
similarity index 98%
rename from toolkit/devtools/server/actors/utils/memory-bridge.js
rename to toolkit/devtools/shared/memory.js
index d4b5af5cdbeb..4409617925bf 100644
--- a/toolkit/devtools/server/actors/utils/memory-bridge.js
+++ b/toolkit/devtools/shared/memory.js
@@ -12,18 +12,17 @@ loader.lazyRequireGetter(this, "events", "sdk/event/core");
 loader.lazyRequireGetter(this, "EventTarget", "sdk/event/target", true);
 loader.lazyRequireGetter(this, "StackFrameCache",
                          "devtools/server/actors/utils/stack", true);
-
 /**
  * A class that returns memory data for a parent actor's window.
  * Using a tab-scoped actor with this instance will measure the memory footprint of its
  * parent tab. Using a global-scoped actor instance however, will measure the memory
  * footprint of the chrome window referenced by its root actor.
  *
- * To be consumed by actor's, like MemoryActor using MemoryBridge to
+ * To be consumed by actor's, like MemoryActor using this module to
  * send information over RDP, and TimelineActor for using more light-weight
  * utilities like GC events and measuring memory consumption.
  */
-let MemoryBridge = Class({
+let Memory = exports.Memory = Class({
   extends: EventTarget,
 
   /**
@@ -335,5 +334,3 @@ let MemoryBridge = Class({
     return this._mgr.residentUnique;
   }
 });
-
-exports.MemoryBridge = MemoryBridge;
diff --git a/toolkit/devtools/shared/moz.build b/toolkit/devtools/shared/moz.build
index 0a612d77b06f..74df470b5002 100644
--- a/toolkit/devtools/shared/moz.build
+++ b/toolkit/devtools/shared/moz.build
@@ -8,6 +8,8 @@ BROWSER_CHROME_MANIFESTS += ['tests/browser/browser.ini']
 
 EXTRA_JS_MODULES.devtools.shared += [
   'async-storage.js',
+  'framerate.js',
+  'memory.js',
   'worker-helper.js',
   'worker.js'
 ]
diff --git a/toolkit/devtools/styleinspector/css-logic.js b/toolkit/devtools/styleinspector/css-logic.js
index 001ae8c25835..16df7fabb667 100644
--- a/toolkit/devtools/styleinspector/css-logic.js
+++ b/toolkit/devtools/styleinspector/css-logic.js
@@ -42,6 +42,36 @@ const { Cc, Ci, Cu } = require("chrome");
 const Services = require("Services");
 const DevToolsUtils = require("devtools/toolkit/DevToolsUtils");
 
+let pseudos = new Set([
+  ":after",
+  ":before",
+  ":first-letter",
+  ":first-line",
+  ":selection",
+  ":-moz-color-swatch",
+  ":-moz-focus-inner",
+  ":-moz-focus-outer",
+  ":-moz-list-bullet",
+  ":-moz-list-number",
+  ":-moz-math-anonymous",
+  ":-moz-math-stretchy",
+  ":-moz-meter-bar",
+  ":-moz-number-spin-box",
+  ":-moz-number-spin-down",
+  ":-moz-number-spin-up",
+  ":-moz-number-text",
+  ":-moz-number-wrapper",
+  ":-moz-placeholder",
+  ":-moz-progress-bar",
+  ":-moz-range-progress",
+  ":-moz-range-thumb",
+  ":-moz-range-track",
+  ":-moz-selection"
+]);
+
+const PSEUDO_ELEMENT_SET = pseudos;
+exports.PSEUDO_ELEMENT_SET = PSEUDO_ELEMENT_SET;
+
 // This should be ok because none of the functions that use this should be used
 // on the worker thread, where Cu is not available.
 if (Cu) {
@@ -1655,21 +1685,7 @@ CssSelector.prototype = {
   get pseudoElements()
   {
     if (!CssSelector._pseudoElements) {
-      let pseudos = CssSelector._pseudoElements = new Set();
-      pseudos.add("after");
-      pseudos.add("before");
-      pseudos.add("first-letter");
-      pseudos.add("first-line");
-      pseudos.add("selection");
-      pseudos.add("-moz-color-swatch");
-      pseudos.add("-moz-focus-inner");
-      pseudos.add("-moz-focus-outer");
-      pseudos.add("-moz-list-bullet");
-      pseudos.add("-moz-list-number");
-      pseudos.add("-moz-math-anonymous");
-      pseudos.add("-moz-math-stretchy");
-      pseudos.add("-moz-progress-bar");
-      pseudos.add("-moz-selection");
+      CssSelector._pseudoElements = PSEUDO_ELEMENT_SET;
     }
     return CssSelector._pseudoElements;
   },
diff --git a/toolkit/devtools/webconsole/network-helper.js b/toolkit/devtools/webconsole/network-helper.js
index cac286661176..f0c46ae5a4d3 100644
--- a/toolkit/devtools/webconsole/network-helper.js
+++ b/toolkit/devtools/webconsole/network-helper.js
@@ -58,6 +58,9 @@ const {components, Cc, Ci, Cu} = require("chrome");
 loader.lazyImporter(this, "NetUtil", "resource://gre/modules/NetUtil.jsm");
 loader.lazyImporter(this, "DevToolsUtils", "resource://gre/modules/devtools/DevToolsUtils.jsm");
 
+// The cache used in the `nsIURL` function.
+const gNSURLStore = new Map();
+
 /**
  * Helper object for networking stuff.
  *
@@ -743,6 +746,46 @@ let NetworkHelper = {
 
     return reasons;
   },
+
+  /**
+   * Parse a url's query string into its components
+   *
+   * @param string aQueryString
+   *        The query part of a url
+   * @return array
+   *         Array of query params {name, value}
+   */
+  parseQueryString: function(aQueryString) {
+    // Make sure there's at least one param available.
+    // Be careful here, params don't necessarily need to have values, so
+    // no need to verify the existence of a "=".
+    if (!aQueryString) {
+      return;
+    }
+
+    // Turn the params string into an array containing { name: value } tuples.
+    let paramsArray = aQueryString.replace(/^[?&]/, "").split("&").map(e => {
+      let param = e.split("=");
+      return {
+        name: param[0] ? NetworkHelper.convertToUnicode(unescape(param[0])) : "",
+        value: param[1] ? NetworkHelper.convertToUnicode(unescape(param[1])) : ""
+      }});
+
+    return paramsArray;
+  },
+
+  /**
+   * Helper for getting an nsIURL instance out of a string.
+   */
+  nsIURL: function(aUrl, aStore = gNSURLStore) {
+    if (aStore.has(aUrl)) {
+      return aStore.get(aUrl);
+    }
+
+    let uri = Services.io.newURI(aUrl, null, null).QueryInterface(Ci.nsIURL);
+    aStore.set(aUrl, uri);
+    return uri;
+  }
 };
 
 for (let prop of Object.getOwnPropertyNames(NetworkHelper)) {
diff --git a/toolkit/locales/en-US/chrome/global/devtools/gclicommands.properties b/toolkit/locales/en-US/chrome/global/devtools/gclicommands.properties
index 2d103bde585d..78c575435f20 100644
--- a/toolkit/locales/en-US/chrome/global/devtools/gclicommands.properties
+++ b/toolkit/locales/en-US/chrome/global/devtools/gclicommands.properties
@@ -961,13 +961,13 @@ toolsManual2=Various commands related to hacking directly on the %1$S Developer
 # command, for pointing your developer tools loader at a mozilla-central source tree.
 toolsSrcdirDesc=Load tools from a mozilla-central checkout
 
-# LOCALIZATION NOTE (toolsSrcdirNotFound) Shown when the 'tools srcdir' command was handed
+# LOCALIZATION NOTE (toolsSrcdirNotFound2) Shown when the 'tools srcdir' command was handed
 # an invalid srcdir.
-toolsSrcdirNotFound=%1$S does not exist or is not a mozilla-central checkout.
+toolsSrcdirNotFound2=%1$S does not exist or is not a mozilla-central checkout.
 
-# LOCALIZATION NOTE (toolsSrcdirReloaded) Displayed when tools have been reloaded by the
+# LOCALIZATION NOTE (toolsSrcdirReloaded2) Displayed when tools have been reloaded by the
 # 'tools srcdir' command.
-toolsSrcdirReloaded=Tools loaded from %1$S.
+toolsSrcdirReloaded2=Tools loaded from %1$S.
 
 # LOCALIZATION NOTE (toolsSrcdirManual2) A full description of the 'tools srcdir'
 # command. The argument (%1$S) is the browser name.
diff --git a/toolkit/mozapps/extensions/internal/XPIProvider.jsm b/toolkit/mozapps/extensions/internal/XPIProvider.jsm
index 511f8a2ffe6c..c554e6c5be8e 100644
--- a/toolkit/mozapps/extensions/internal/XPIProvider.jsm
+++ b/toolkit/mozapps/extensions/internal/XPIProvider.jsm
@@ -2522,7 +2522,8 @@ this.XPIProvider = {
     let addons = XPIDatabase.getAddons();
       for (let addon of addons) {
         if ((startupChanges.indexOf(addon.id) != -1) &&
-            (addon.permissions() & AddonManager.PERM_CAN_UPGRADE)) {
+            (addon.permissions() & AddonManager.PERM_CAN_UPGRADE) &&
+            !addon.isCompatible) {
           logger.debug("shouldForceUpdateCheck: can upgrade disabled add-on " + addon.id);
           forceUpdate.push(addon.id);
         }
diff --git a/toolkit/mozapps/extensions/test/xpcshell/test_signed_migrate.js b/toolkit/mozapps/extensions/test/xpcshell/test_signed_migrate.js
index 41ecacd0962c..7550a72d451f 100644
--- a/toolkit/mozapps/extensions/test/xpcshell/test_signed_migrate.js
+++ b/toolkit/mozapps/extensions/test/xpcshell/test_signed_migrate.js
@@ -2,6 +2,8 @@
 Services.prefs.setBoolPref(PREF_XPI_SIGNATURES_REQUIRED, true);
 // Disable update security
 Services.prefs.setBoolPref(PREF_EM_CHECK_UPDATE_SECURITY, false);
+// Allow attempting to show the compatibility UI which should not happen
+Services.prefs.setBoolPref("extensions.showMismatchUI", true);
 
 const DATA = "data/signing_checks/";
 const ADDONS = {
@@ -21,6 +23,26 @@ const ID = "test@tests.mozilla.org";
 const profileDir = gProfD.clone();
 profileDir.append("extensions");
 
+// Override the window watcher
+var WindowWatcher = {
+  sawAddon: false,
+
+  openWindow: function(parent, url, name, features, arguments) {
+    let ids = arguments.QueryInterface(AM_Ci.nsIVariant);
+    this.sawAddon = ids.indexOf(ID) >= 0;
+  },
+
+  QueryInterface: function(iid) {
+    if (iid.equals(AM_Ci.nsIWindowWatcher)
+        || iid.equals(AM_Ci.nsISupports))
+      return this;
+
+    throw Components.results.NS_ERROR_NO_INTERFACE;
+  }
+}
+
+MockRegistrar.register("@mozilla.org/embedcomp/window-watcher;1", WindowWatcher);
+
 function resetPrefs() {
   Services.prefs.setIntPref("bootstraptest.active_version", -1);
   Services.prefs.setIntPref("bootstraptest.installed_version", -1);
@@ -101,6 +123,10 @@ function* test_breaking_migrate(addons, test, expectedSignedState) {
   do_check_eq(changes.length, 1);
   do_check_eq(changes[0], ID);
 
+  // Shouldn't have checked for updates for the add-on
+  do_check_false(WindowWatcher.sawAddon);
+  WindowWatcher.sawAddon = false;
+
   addon.uninstall();
   // Restart to let non-restartless add-ons uninstall fully
   yield promiseRestartManager();
@@ -141,6 +167,10 @@ function* test_working_migrate(addons, test, expectedSignedState) {
   else
     do_check_true(isExtensionInAddonsList(profileDir, ID));
 
+  // Shouldn't have checked for updates for the add-on
+  do_check_false(WindowWatcher.sawAddon);
+  WindowWatcher.sawAddon = false;
+
   addon.uninstall();
   // Restart to let non-restartless add-ons uninstall fully
   yield promiseRestartManager();
diff --git a/toolkit/mozapps/update/content/updates.js b/toolkit/mozapps/update/content/updates.js
index ac87931bc00a..48f8bad4b8e4 100644
--- a/toolkit/mozapps/update/content/updates.js
+++ b/toolkit/mozapps/update/content/updates.js
@@ -444,8 +444,17 @@ var gUpdates = {
               return;
           }
         }
-        if (this.update.licenseURL)
+
+        let aus = CoC["@mozilla.org/updates/update-service;1"].
+                  getService(CoI.nsIApplicationUpdateService);
+        if (!aus.canApplyUpdates) {
+          aCallback("manualUpdate");
+          return;
+        }
+
+        if (this.update.licenseURL) {
           this.wiz.getPageById(this.updatesFoundPageId).setAttribute("next", "license");
+        }
 
         var self = this;
         this.getShouldCheckAddonCompatibility(function(shouldCheck) {
@@ -453,8 +462,7 @@ var gUpdates = {
             var incompatCheckPage = document.getElementById("incompatibleCheck");
             incompatCheckPage.setAttribute("next", self.updatesFoundPageId);
             aCallback(incompatCheckPage.id);
-          }
-          else {
+          } else {
             aCallback(self.updatesFoundPageId);
           }
         });
diff --git a/toolkit/mozapps/update/nsUpdateService.js b/toolkit/mozapps/update/nsUpdateService.js
index ba28df901e17..abcf93692257 100644
--- a/toolkit/mozapps/update/nsUpdateService.js
+++ b/toolkit/mozapps/update/nsUpdateService.js
@@ -495,25 +495,25 @@ function hasUpdateMutex() {
   return !!gUpdateMutexHandle;
 }
 
-XPCOMUtils.defineLazyGetter(this, "gCanApplyUpdates", function aus_gCanApplyUpdates() {
+function getCanApplyUpdates() {
   let useService = false;
   if (shouldUseService()) {
     // No need to perform directory write checks, the maintenance service will
     // be able to write to all directories.
-    LOG("gCanApplyUpdates - bypass the write checks because we'll use the service");
+    LOG("getCanApplyUpdates - bypass the write checks because we'll use the service");
     useService = true;
   }
 
   if (!useService) {
     try {
       let updateTestFile = getUpdateFile([FILE_PERMS_TEST]);
-      LOG("gCanApplyUpdates - testing write access " + updateTestFile.path);
+      LOG("getCanApplyUpdates - testing write access " + updateTestFile.path);
       testWriteAccess(updateTestFile, false);
       if (AppConstants.platform == "macosx") {
         // Check that the application bundle can be written to.
         let appDirTestFile = getAppBaseDir();
         appDirTestFile.append(FILE_PERMS_TEST);
-        LOG("gCanApplyUpdates - testing write access " + appDirTestFile.path);
+        LOG("getCanApplyUpdates - testing write access " + appDirTestFile.path);
         if (appDirTestFile.exists()) {
           appDirTestFile.remove(false);
         }
@@ -522,7 +522,7 @@ XPCOMUtils.defineLazyGetter(this, "gCanApplyUpdates", function aus_gCanApplyUpda
       } else if (AppConstants.platform == "win") {
         // Example windowsVersion:  Windows XP == 5.1
         let windowsVersion = Services.sysinfo.getProperty("version");
-        LOG("gCanApplyUpdates - windowsVersion = " + windowsVersion);
+        LOG("getCanApplyUpdates - windowsVersion = " + windowsVersion);
 
       /**
        * For Vista, updates can be performed to a location requiring admin
@@ -545,13 +545,13 @@ XPCOMUtils.defineLazyGetter(this, "gCanApplyUpdates", function aus_gCanApplyUpda
             // appDir is under Program Files, so check if the user can elevate
             userCanElevate = Services.appinfo.QueryInterface(Ci.nsIWinAppHelper).
                              userCanElevate;
-            LOG("gCanApplyUpdates - on Vista, userCanElevate: " + userCanElevate);
+            LOG("getCanApplyUpdates - on Vista, userCanElevate: " + userCanElevate);
           }
           catch (ex) {
             // When the installation directory is not under Program Files,
             // fall through to checking if write access to the
             // installation directory is available.
-            LOG("gCanApplyUpdates - on Vista, appDir is not under Program Files");
+            LOG("getCanApplyUpdates - on Vista, appDir is not under Program Files");
           }
         }
 
@@ -579,7 +579,7 @@ XPCOMUtils.defineLazyGetter(this, "gCanApplyUpdates", function aus_gCanApplyUpda
           // if we're unable to create the test file this will throw an exception.
           let appDirTestFile = getAppBaseDir();
           appDirTestFile.append(FILE_PERMS_TEST);
-          LOG("gCanApplyUpdates - testing write access " + appDirTestFile.path);
+          LOG("getCanApplyUpdates - testing write access " + appDirTestFile.path);
           if (appDirTestFile.exists()) {
             appDirTestFile.remove(false);
           }
@@ -588,15 +588,15 @@ XPCOMUtils.defineLazyGetter(this, "gCanApplyUpdates", function aus_gCanApplyUpda
         }
       }
     } catch (e) {
-       LOG("gCanApplyUpdates - unable to apply updates. Exception: " + e);
+       LOG("getCanApplyUpdates - unable to apply updates. Exception: " + e);
       // No write privileges to install directory
       return false;
     }
   } // if (!useService)
 
-  LOG("gCanApplyUpdates - able to apply updates");
+  LOG("getCanApplyUpdates - able to apply updates");
   return true;
-});
+}
 
 /**
  * Whether or not the application can stage an update for the current session.
@@ -2396,7 +2396,7 @@ UpdateService.prototype = {
     // UPDATE_UNABLE_TO_APPLY_EXTERNAL
     // UPDATE_UNABLE_TO_APPLY_NOTIFY
     AUSTLMY.pingGeneric("UPDATE_UNABLE_TO_APPLY_" + this._pingSuffix,
-                        gCanApplyUpdates, true);
+                        getCanApplyUpdates(), true);
     // Histogram IDs:
     // UPDATE_CANNOT_STAGE_EXTERNAL
     // UPDATE_CANNOT_STAGE_NOTIFY
@@ -2646,7 +2646,7 @@ UpdateService.prototype = {
       return;
     }
 
-    if (!gCanApplyUpdates) {
+    if (!getCanApplyUpdates()) {
       LOG("UpdateService:_selectAndInstallUpdate - the user is unable to " +
           "apply updates... prompting");
       this._showPrompt(update);
@@ -2856,7 +2856,7 @@ UpdateService.prototype = {
       return;
     }
 
-    if (this._incompatibleAddons.length > 0 || !gCanApplyUpdates) {
+    if (this._incompatibleAddons.length > 0 || !getCanApplyUpdates()) {
       LOG("UpdateService:onUpdateEnded - prompting because there are " +
           "incompatible add-ons");
       if (this._incompatibleAddons.length > 0) {
@@ -2903,7 +2903,7 @@ UpdateService.prototype = {
    * See nsIUpdateService.idl
    */
   get canApplyUpdates() {
-    return gCanApplyUpdates && hasUpdateMutex();
+    return getCanApplyUpdates() && hasUpdateMutex();
   },
 
   /**
diff --git a/toolkit/mozapps/update/tests/chrome/chrome.ini b/toolkit/mozapps/update/tests/chrome/chrome.ini
index 2903c0d4901d..48945ce97dac 100644
--- a/toolkit/mozapps/update/tests/chrome/chrome.ini
+++ b/toolkit/mozapps/update/tests/chrome/chrome.ini
@@ -87,6 +87,12 @@ reason = only Windows has the maintenance service.
 [test_0151_notify_backgroundCheckError.xul]
 [test_0161_check_unsupported.xul]
 [test_0162_notify_unsupported.xul]
+[test_0171_check_noPerms_manual.xul]
+skip-if = os != 'win'
+reason = test must be able to prevent file deletion.
+[test_0172_notify_noPerms_manual.xul]
+skip-if = os != 'win'
+reason = test must be able to prevent file deletion.
 [test_0900_deprecatedUpdateFormat_minor.xul]
 [test_0901_deprecatedUpdateFormat_major.xul]
 [test_9999_cleanup.xul]
diff --git a/toolkit/mozapps/update/tests/chrome/test_0171_check_noPerms_manual.xul b/toolkit/mozapps/update/tests/chrome/test_0171_check_noPerms_manual.xul
new file mode 100644
index 000000000000..76946ab37c97
--- /dev/null
+++ b/toolkit/mozapps/update/tests/chrome/test_0171_check_noPerms_manual.xul
@@ -0,0 +1,64 @@
+<?xml version="1.0"?>
+<!--
+/* Any copyright is dedicated to the Public Domain.
+ * http://creativecommons.org/publicdomain/zero/1.0/
+ */
+-->
+
+<?xml-stylesheet href="chrome://global/skin" type="text/css"?>
+<?xml-stylesheet href="chrome://mochikit/content/tests/SimpleTest/test.css" type="text/css"?>
+
+<window title="Update Wizard pages: manual"
+        xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul"
+        onload="runTestDefault();">
+<script type="application/javascript"
+        src="chrome://mochikit/content/tests/SimpleTest/SimpleTest.js"/>
+<script type="application/javascript"
+        src="utils.js"/>
+
+<script type="application/javascript">
+<![CDATA[
+
+const TESTS = [ {
+  pageid: PAGEID_CHECKING
+}, {
+  pageid: PAGEID_MANUAL_UPDATE,
+  buttonClick: "finish",
+  extraCheckFunction: getWriteTestFile
+} ];
+
+function runTest() {
+  debugDump("entering");
+
+  let file = getWriteTestFile();
+  file.create(file.NORMAL_FILE_TYPE, 0o444);
+  file.fileAttributesWin |= file.WFA_READONLY;
+  file.fileAttributesWin &= ~file.WFA_READWRITE;
+
+  let url = URL_HTTP_UPDATE_XML + "?showDetails=1" + getVersionParams();
+  setUpdateURLOverride(url);
+
+  gUP.checkForUpdates();
+}
+
+function getWriteTestFile() {
+  let file = getAppBaseDir();
+  file.append(FILE_PERMS_TEST);
+  file.QueryInterface(Ci.nsILocalFileWin);
+  if (file.exists()) {
+    file.fileAttributesWin |= file.WFA_READWRITE;
+    file.fileAttributesWin &= ~file.WFA_READONLY;
+    file.remove(true);
+  }
+  return file;
+}
+
+]]>
+</script>
+
+<body xmlns="http://www.w3.org/1999/xhtml">
+  <p id="display"></p>
+  <div id="content" style="display: none"></div>
+  <pre id="test"></pre>
+</body>
+</window>
diff --git a/toolkit/mozapps/update/tests/chrome/test_0172_notify_noPerms_manual.xul b/toolkit/mozapps/update/tests/chrome/test_0172_notify_noPerms_manual.xul
new file mode 100644
index 000000000000..fdbdc0feb9ca
--- /dev/null
+++ b/toolkit/mozapps/update/tests/chrome/test_0172_notify_noPerms_manual.xul
@@ -0,0 +1,63 @@
+<?xml version="1.0"?>
+<!--
+/* Any copyright is dedicated to the Public Domain.
+ * http://creativecommons.org/publicdomain/zero/1.0/
+ */
+-->
+
+<?xml-stylesheet href="chrome://global/skin" type="text/css"?>
+<?xml-stylesheet href="chrome://mochikit/content/tests/SimpleTest/test.css" type="text/css"?>
+
+<window title="Update Wizard pages: manual"
+        xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul"
+        onload="runTestDefault();">
+<script type="application/javascript"
+        src="chrome://mochikit/content/tests/SimpleTest/SimpleTest.js"/>
+<script type="application/javascript"
+        src="utils.js"/>
+
+<script type="application/javascript">
+<![CDATA[
+
+const TESTS = [ {
+  pageid: PAGEID_MANUAL_UPDATE,
+  buttonClick: "finish",
+  extraCheckFunction: getWriteTestFile
+} ];
+
+function runTest() {
+  debugDump("entering");
+
+  let file = getWriteTestFile();
+  file.create(file.NORMAL_FILE_TYPE, 0o444);
+  file.fileAttributesWin |= file.WFA_READONLY;
+  file.fileAttributesWin &= ~file.WFA_READWRITE;
+
+  let url = URL_HTTP_UPDATE_XML + "?showDetails=1&showPrompt=1" +
+            getVersionParams();
+  setUpdateURLOverride(url);
+
+  gAUS.checkForBackgroundUpdates();
+}
+
+function getWriteTestFile() {
+  let file = getAppBaseDir();
+  file.append(FILE_PERMS_TEST);
+  file.QueryInterface(Ci.nsILocalFileWin);
+  if (file.exists()) {
+    file.fileAttributesWin |= file.WFA_READWRITE;
+    file.fileAttributesWin &= ~file.WFA_READONLY;
+    file.remove(true);
+  }
+  return file;
+}
+
+]]>
+</script>
+
+<body xmlns="http://www.w3.org/1999/xhtml">
+  <p id="display"></p>
+  <div id="content" style="display: none"></div>
+  <pre id="test"></pre>
+</body>
+</window>
diff --git a/toolkit/mozapps/update/tests/chrome/utils.js b/toolkit/mozapps/update/tests/chrome/utils.js
index 83d335a6ada7..b0c00ed33866 100644
--- a/toolkit/mozapps/update/tests/chrome/utils.js
+++ b/toolkit/mozapps/update/tests/chrome/utils.js
@@ -13,7 +13,7 @@
  * overrideCallback (optional)
  *   The function to call for the next test. This is typically called when the
  *   wizard page changes but can also be called for other events by the previous
- *   test. If this property isn't defined then the defailtCallback function will
+ *   test. If this property isn't defined then the defaultCallback function will
  *   be called. If this property is defined then all other properties are
  *   optional.
  *
@@ -137,7 +137,7 @@ const PAGEID_DUMMY            = "dummy";                 // Done
 const PAGEID_CHECKING         = "checking";              // Done
 const PAGEID_PLUGIN_UPDATES   = "pluginupdatesfound";
 const PAGEID_NO_UPDATES_FOUND = "noupdatesfound";        // Done
-const PAGEID_MANUAL_UPDATE    = "manualUpdate"; // Tested on license load failure
+const PAGEID_MANUAL_UPDATE    = "manualUpdate";          // Done
 const PAGEID_UNSUPPORTED      = "unsupported";           // Done
 const PAGEID_INCOMPAT_CHECK   = "incompatibleCheck";     // Done
 const PAGEID_FOUND_BASIC      = "updatesfoundbasic";     // Done
@@ -1277,7 +1277,7 @@ function setupAddons(aCallback) {
       // Start the timout timer before the update window is displayed so it can
       // clean up tests that don't successfully display the update window.
       setupTimer(gTestTimeout);
-      aCallback();
+      SimpleTest.executeSoon(aCallback);
     });
   }
 
@@ -1389,7 +1389,7 @@ function resetAddons(aCallback) {
             aAddon.userDisabled = false;
           }
         });
-        aCallback();
+        SimpleTest.executeSoon(aCallback);
       });
     }
   }
diff --git a/toolkit/mozapps/update/tests/data/shared.js b/toolkit/mozapps/update/tests/data/shared.js
index d6ea47a7a1b7..76b74294e5a1 100644
--- a/toolkit/mozapps/update/tests/data/shared.js
+++ b/toolkit/mozapps/update/tests/data/shared.js
@@ -61,6 +61,7 @@ const DIR_UPDATED      = IS_MACOSX ? "Updated.app" : "updated";
 const FILE_APPLICATION_INI           = "application.ini";
 const FILE_BACKUP_LOG                = "backup-update.log";
 const FILE_LAST_LOG                  = "last-update.log";
+const FILE_PERMS_TEST                = "update.test";
 const FILE_UPDATER_INI               = "updater.ini";
 const FILE_UPDATES_DB                = "updates.xml";
 const FILE_UPDATE_ACTIVE             = "active-update.xml";
diff --git a/toolkit/themes/linux/global/popup.css b/toolkit/themes/linux/global/popup.css
index 1c5bc50c7ba4..63c8d86fdfb4 100644
--- a/toolkit/themes/linux/global/popup.css
+++ b/toolkit/themes/linux/global/popup.css
@@ -4,6 +4,14 @@
 
 @namespace url("http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul");
 
+/* ::::: Variables ::::: */
+.panel-arrowcontent {
+  --panel-arrowcontent-padding: 10px;
+  --panel-arrowcontent-background: -moz-Dialog;
+  --panel-arrowcontent-color: -moz-DialogText;
+  --panel-arrowcontent-border: 1px solid ThreeDShadow;
+}
+
 /* ::::: menupopup ::::: */
 
 menupopup,
@@ -32,10 +40,10 @@ panel[type="arrow"][side="right"] {
 }
 
 .panel-arrowcontent {
-  padding: 10px;
-  color: -moz-DialogText;
-  background: -moz-Dialog;
-  border: 1px solid ThreeDShadow;
+  padding: var(--panel-arrowcontent-padding);
+  color: var(--panel-arrowcontent-color);
+  background: var(--panel-arrowcontent-background);
+  border: var(--panel-arrowcontent-border);
 }
 
 .panel-arrow[side="top"],
diff --git a/toolkit/themes/osx/global/popup.css b/toolkit/themes/osx/global/popup.css
index 4770413f29a6..0eef7345d09c 100644
--- a/toolkit/themes/osx/global/popup.css
+++ b/toolkit/themes/osx/global/popup.css
@@ -5,6 +5,7 @@
 @namespace url("http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul");
 
 .panel-arrowcontent {
+  --panel-arrowcontent-padding: 16px;
   --panel-arrowcontent-background: linear-gradient(hsla(0,0%,99%,1), hsla(0,0%,99%,.975) 10%, hsla(0,0%,98%,.975));
   --panel-arrowcontent-color: hsl(0,0%,10%);
   --panel-arrowcontent-border: none;
@@ -52,7 +53,7 @@ panel[type="arrow"][side="right"] {
   box-shadow: 0 0 0 1px hsla(210,4%,10%,.05);
   color: var(--panel-arrowcontent-color);
   border: var(--panel-arrowcontent-border);
-  padding: 16px;
+  padding: var(--panel-arrowcontent-padding);
   margin: 1px;
 }
 
diff --git a/toolkit/themes/windows/global/popup.css b/toolkit/themes/windows/global/popup.css
index 49dab570dfe6..3fa97af932f4 100644
--- a/toolkit/themes/windows/global/popup.css
+++ b/toolkit/themes/windows/global/popup.css
@@ -6,6 +6,7 @@
 
 /* ::::: Variables ::::: */
 .panel-arrowcontent {
+  --panel-arrowcontent-padding: 10px;
   --panel-arrowcontent-background: -moz-field;
   --panel-arrowcontent-color: -moz-FieldText;
   --panel-arrowcontent-border: 1px solid ThreeDShadow;
@@ -55,7 +56,7 @@ panel[type="arrow"][side="right"] {
 }
 
 .panel-arrowcontent {
-  padding: 10px;
+  padding: var(--panel-arrowcontent-padding);
   color: var(--panel-arrowcontent-color);
   background: var(--panel-arrowcontent-background);
   background-clip: padding-box;
diff --git a/widget/cocoa/nsCocoaWindow.mm b/widget/cocoa/nsCocoaWindow.mm
index 7cc51efd18df..eb9626fa3626 100644
--- a/widget/cocoa/nsCocoaWindow.mm
+++ b/widget/cocoa/nsCocoaWindow.mm
@@ -1279,6 +1279,9 @@ void nsCocoaWindow::EnteredFullScreen(bool aFullScreen, bool aNativeMode)
     mInNativeFullScreenMode = aFullScreen;
   }
   DispatchSizeModeEvent();
+  if (mWidgetListener) {
+    mWidgetListener->FullscreenChanged(aFullScreen);
+  }
 }
 
 inline bool nsCocoaWindow::ShouldToggleNativeFullscreen(bool aFullScreen)
diff --git a/widget/gonk/libdisplay/BootAnimation.cpp b/widget/gonk/libdisplay/BootAnimation.cpp
index b6198ee539ec..e2b68012addd 100644
--- a/widget/gonk/libdisplay/BootAnimation.cpp
+++ b/widget/gonk/libdisplay/BootAnimation.cpp
@@ -692,18 +692,26 @@ AnimationThread(void *)
     return nullptr;
 }
 
+namespace mozilla {
+
+__attribute__ ((visibility ("default")))
 void
 StartBootAnimation()
 {
+    GetGonkDisplay(); // Ensure GonkDisplay exist
     sRunAnimation = true;
     pthread_create(&sAnimationThread, nullptr, AnimationThread, nullptr);
 }
 
+__attribute__ ((visibility ("default")))
 void
 StopBootAnimation()
 {
     if (sRunAnimation) {
         sRunAnimation = false;
         pthread_join(sAnimationThread, nullptr);
+        GetGonkDisplay()->NotifyBootAnimationStopped();
     }
 }
+
+} // namespace mozilla
diff --git a/widget/gonk/libdisplay/BootAnimation.h b/widget/gonk/libdisplay/BootAnimation.h
index d06586c993e5..9fdc20eca950 100644
--- a/widget/gonk/libdisplay/BootAnimation.h
+++ b/widget/gonk/libdisplay/BootAnimation.h
@@ -16,9 +16,15 @@
 #ifndef BOOTANIMATION_H
 #define BOOTANIMATION_H
 
+namespace mozilla {
+
+MOZ_EXPORT __attribute__ ((weak))
 void StartBootAnimation();
 
 /* Stop the boot animation if it's still running. */
+MOZ_EXPORT __attribute__ ((weak))
 void StopBootAnimation();
 
+} // namespace mozilla
+
 #endif /* BOOTANIMATION_H */
diff --git a/widget/gonk/libdisplay/GonkDisplay.h b/widget/gonk/libdisplay/GonkDisplay.h
index 0f703e7450f2..070ac7eac1e4 100644
--- a/widget/gonk/libdisplay/GonkDisplay.h
+++ b/widget/gonk/libdisplay/GonkDisplay.h
@@ -78,6 +78,8 @@ public:
         GonkDisplay::DisplayType aDisplayType,
         android::IGraphicBufferProducer* aProducer = nullptr) = 0;
 
+    virtual void NotifyBootAnimationStopped() = 0;
+
     float xdpi;
     int32_t surfaceformat;
 };
diff --git a/widget/gonk/libdisplay/GonkDisplayICS.cpp b/widget/gonk/libdisplay/GonkDisplayICS.cpp
index 1dbc2b87b139..7c1186ebb8cb 100644
--- a/widget/gonk/libdisplay/GonkDisplayICS.cpp
+++ b/widget/gonk/libdisplay/GonkDisplayICS.cpp
@@ -27,8 +27,6 @@
 #include "mozilla/FileUtils.h"
 #include "mozilla/FileUtils.h"
 
-#include "BootAnimation.h"
-
 using namespace android;
 
 
@@ -105,7 +103,7 @@ GonkDisplayICS::GonkDisplayICS()
             len = read(fd.get(), &buf, 1);
         } while (len < 0 && errno == EINTR);
         if (len < 0) {
-            LOGE("BootAnimation: wait_for_fb_sleep failed errno: %d", errno);
+            LOGE("wait_for_fb_sleep failed errno: %d", errno);
         }
     }
 
@@ -130,8 +128,6 @@ GonkDisplayICS::GonkDisplayICS()
 
     const framebuffer_device_t *fbdev = mFBSurface->getDevice();
     surfaceformat = fbdev->format;
-
-    StartBootAnimation();
 }
 
 GonkDisplayICS::~GonkDisplayICS()
@@ -215,7 +211,6 @@ GonkDisplayICS::GetNativeData(GonkDisplay::DisplayType aDisplayType,
     MOZ_ASSERT(aDisplayType == DISPLAY_PRIMARY, "ICS gonk supports primary display only.");
 
     NativeData data;
-    StopBootAnimation();
     data.mNativeWindow = static_cast<ANativeWindow *>(mFBSurface.get());
     data.mXdpi = xdpi;
 
diff --git a/widget/gonk/libdisplay/GonkDisplayICS.h b/widget/gonk/libdisplay/GonkDisplayICS.h
index e47ad2741c2e..8f3f14138ccc 100644
--- a/widget/gonk/libdisplay/GonkDisplayICS.h
+++ b/widget/gonk/libdisplay/GonkDisplayICS.h
@@ -59,6 +59,8 @@ public:
         GonkDisplay::DisplayType aDisplayType,
         android::IGraphicBufferProducer* aProducer = nullptr);
 
+    virtual void NotifyBootAnimationStopped() {}
+
 private:
     hw_module_t const*        mModule;
     hwc_composer_device_t*    mHwc;
diff --git a/widget/gonk/libdisplay/GonkDisplayJB.cpp b/widget/gonk/libdisplay/GonkDisplayJB.cpp
index fcb7f740f1b5..aa1518ea6cb7 100644
--- a/widget/gonk/libdisplay/GonkDisplayJB.cpp
+++ b/widget/gonk/libdisplay/GonkDisplayJB.cpp
@@ -26,7 +26,6 @@
 #include <hardware/power.h>
 #include <suspend/autosuspend.h>
 
-#include "BootAnimation.h"
 #include "FramebufferSurface.h"
 #if ANDROID_VERSION == 17
 #include "GraphicBufferAlloc.h"
@@ -126,9 +125,6 @@ GonkDisplayJB::GonkDisplayJB()
         // only create this buffer for devices w/ hwc version > 1.0.
         CreateSurface(mBootAnimSTClient, mBootAnimDispSurface, mWidth, mHeight);
     }
-
-    ALOGI("Starting bootanimation with (%d) format framebuffer", surfaceformat);
-    StartBootAnimation();
 }
 
 GonkDisplayJB::~GonkDisplayJB()
@@ -225,8 +221,6 @@ GonkDisplayJB::GetHWCDevice()
 bool
 GonkDisplayJB::SwapBuffers(EGLDisplay dpy, EGLSurface sur)
 {
-    StopBootAnim();
-
     // Should be called when composition rendering is complete for a frame.
     // Only HWC v1.0 needs this call.
     // HWC > v1.0 case, do not call compositionComplete().
@@ -340,15 +334,12 @@ GonkDisplayJB::QueueBuffer(ANativeWindowBuffer* buf)
 void
 GonkDisplayJB::UpdateDispSurface(EGLDisplay dpy, EGLSurface sur)
 {
-    StopBootAnim();
-
     eglSwapBuffers(dpy, sur);
 }
 
 void
-GonkDisplayJB::StopBootAnim()
+GonkDisplayJB::NotifyBootAnimationStopped()
 {
-    StopBootAnimation();
     if (mBootAnimSTClient.get()) {
         mBootAnimSTClient = nullptr;
         mBootAnimDispSurface = nullptr;
@@ -377,7 +368,6 @@ GonkDisplayJB::GetNativeData(GonkDisplay::DisplayType aDisplayType,
     NativeData data;
 
     if (aDisplayType == DISPLAY_PRIMARY) {
-        StopBootAnim();
         data.mNativeWindow = mSTClient;
         data.mDisplaySurface = mDispSurface;
         data.mXdpi = xdpi;
diff --git a/widget/gonk/libdisplay/GonkDisplayJB.h b/widget/gonk/libdisplay/GonkDisplayJB.h
index d8ed9b4d37c2..e71f40d1e7f3 100644
--- a/widget/gonk/libdisplay/GonkDisplayJB.h
+++ b/widget/gonk/libdisplay/GonkDisplayJB.h
@@ -50,6 +50,8 @@ public:
         GonkDisplay::DisplayType aDisplayType,
         android::IGraphicBufferProducer* aProducer = nullptr);
 
+    virtual void NotifyBootAnimationStopped();
+
 private:
     void StopBootAnim();
     void CreateSurface(android::sp<ANativeWindow>& aNativeWindow,
diff --git a/widget/gonk/nsScreenManagerGonk.cpp b/widget/gonk/nsScreenManagerGonk.cpp
index 45dd8eb1c87e..e86e1efbdf8b 100644
--- a/widget/gonk/nsScreenManagerGonk.cpp
+++ b/widget/gonk/nsScreenManagerGonk.cpp
@@ -18,6 +18,7 @@
 #include "mozilla/MouseEvents.h"
 #include "mozilla/TouchEvents.h"
 #include "mozilla/Hal.h"
+#include "libdisplay/BootAnimation.h"
 #include "libdisplay/GonkDisplay.h"
 #include "nsScreenManagerGonk.h"
 #include "nsThreadUtils.h"
@@ -226,6 +227,9 @@ nsScreenGonk::GetSurfaceFormat()
 ANativeWindow*
 nsScreenGonk::GetNativeWindow()
 {
+    if (IsPrimaryScreen()) {
+        StopBootAnimation();
+    }
     return mNativeWindow.get();
 }
 
diff --git a/widget/gonk/nsWindow.cpp b/widget/gonk/nsWindow.cpp
index 3c38d5331dd9..e64672b99052 100644
--- a/widget/gonk/nsWindow.cpp
+++ b/widget/gonk/nsWindow.cpp
@@ -605,6 +605,10 @@ nsWindow::MakeFullScreen(bool aFullScreen, nsIScreen*)
                virtualBounds.width, virtualBounds.height,
                /*repaint*/true);
     }
+
+    if (nsIWidgetListener* listener = GetWidgetListener()) {
+      listener->FullscreenChanged(aFullScreen);
+    }
     return NS_OK;
 }
 
diff --git a/widget/gtk/nsWindow.cpp b/widget/gtk/nsWindow.cpp
index 337e15d0527d..c65271cf57bc 100644
--- a/widget/gtk/nsWindow.cpp
+++ b/widget/gtk/nsWindow.cpp
@@ -3256,6 +3256,7 @@ nsWindow::OnWindowStateEvent(GtkWidget *aWidget, GdkEventWindowState *aEvent)
         return;
     }
 
+    bool wasInFullscreen = mSizeState == nsSizeMode_Fullscreen;
     if (aEvent->new_window_state & GDK_WINDOW_STATE_ICONIFIED) {
         LOG(("\tIconified\n"));
         mSizeState = nsSizeMode_Minimized;
@@ -3282,8 +3283,14 @@ nsWindow::OnWindowStateEvent(GtkWidget *aWidget, GdkEventWindowState *aEvent)
 #endif //ACCESSIBILITY
     }
 
-    if (mWidgetListener)
+    if (mWidgetListener) {
       mWidgetListener->SizeModeChanged(mSizeState);
+
+      bool isInFullscreen = mSizeState == nsSizeMode_Fullscreen;
+      if (isInFullscreen != wasInFullscreen) {
+        mWidgetListener->FullscreenChanged(isInFullscreen);
+      }
+    }
 }
 
 void
diff --git a/widget/nsIWidgetListener.cpp b/widget/nsIWidgetListener.cpp
index 3c0e56030a05..51e88d84cd85 100644
--- a/widget/nsIWidgetListener.cpp
+++ b/widget/nsIWidgetListener.cpp
@@ -54,6 +54,11 @@ nsIWidgetListener::SizeModeChanged(nsSizeMode aSizeMode)
 {
 }
 
+void
+nsIWidgetListener::FullscreenChanged(bool aInFullscreen)
+{
+}
+
 bool
 nsIWidgetListener::ZLevelChanged(bool aImmediate,
                                  nsWindowZ* aPlacement,
diff --git a/widget/nsIWidgetListener.h b/widget/nsIWidgetListener.h
index 4345b80cb46d..11ef193fe213 100644
--- a/widget/nsIWidgetListener.h
+++ b/widget/nsIWidgetListener.h
@@ -86,6 +86,11 @@ public:
                              nsIWidget* aRequestBelow,
                              nsIWidget** aActualBelow);
 
+  /**
+   * Called when the window entered or left the fullscreen state.
+   */
+  virtual void FullscreenChanged(bool aInFullscreen);
+
   /**
    * Called when the window is activated and focused.
    */
diff --git a/widget/windows/nsWindow.cpp b/widget/windows/nsWindow.cpp
index 1c4d5e71602c..e5222777a163 100644
--- a/widget/windows/nsWindow.cpp
+++ b/widget/windows/nsWindow.cpp
@@ -2897,8 +2897,10 @@ nsWindow::MakeFullScreen(bool aFullScreen, nsIScreen* aTargetScreen)
     taskbarInfo->PrepareFullScreenHWND(mWnd, FALSE);
   }
 
-  if (mWidgetListener)
+  if (mWidgetListener) {
     mWidgetListener->SizeModeChanged(mSizeMode);
+    mWidgetListener->FullscreenChanged(aFullScreen);
+  }
 
   return rv;
 }
diff --git a/xpcom/glue/nsProxyRelease.h b/xpcom/glue/nsProxyRelease.h
index 5d95780d226f..6783b313c49d 100644
--- a/xpcom/glue/nsProxyRelease.h
+++ b/xpcom/glue/nsProxyRelease.h
@@ -57,7 +57,7 @@ NS_ProxyRelease(nsIEventTarget* aTarget, nsRefPtr<T>& aDoomed,
  *        the doomed object; the object to be released on the target thread.
  * @param aAlwaysProxy
  *        normally, if NS_ProxyRelease is called on the target thread, then the
- *        doomed object will released directly.  however, if this parameter is
+ *        doomed object will be released directly. However, if this parameter is
  *        true, then an event will always be posted to the target thread for
  *        asynchronous release.
  */
@@ -65,6 +65,62 @@ nsresult
 NS_ProxyRelease(nsIEventTarget* aTarget, nsISupports* aDoomed,
                 bool aAlwaysProxy = false);
 
+/**
+ * Ensure that a nsCOMPtr is released on the main thread.
+ *
+ * @see NS_ReleaseOnMainThread( nsISupports*, bool)
+ */
+template<class T>
+inline NS_HIDDEN_(nsresult)
+NS_ReleaseOnMainThread(nsCOMPtr<T>& aDoomed,
+                       bool aAlwaysProxy = false)
+{
+  T* raw = nullptr;
+  aDoomed.swap(raw);
+  return NS_ReleaseOnMainThread(raw, aAlwaysProxy);
+}
+
+/**
+ * Ensure that a nsRefPtr is released on the main thread.
+ *
+ * @see NS_ReleaseOnMainThread(nsISupports*, bool)
+ */
+template<class T>
+inline NS_HIDDEN_(nsresult)
+NS_ReleaseOnMainThread(nsRefPtr<T>& aDoomed,
+                       bool aAlwaysProxy = false)
+{
+  T* raw = nullptr;
+  aDoomed.swap(raw);
+  return NS_ReleaseOnMainThread(raw, aAlwaysProxy);
+}
+
+/**
+ * Ensures that the delete of a nsISupports object occurs on the main thread.
+ *
+ * @param aDoomed
+ *        the doomed object; the object to be released on the main thread.
+ * @param aAlwaysProxy
+ *        normally, if NS_ReleaseOnMainThread is called on the main thread,
+ *        then the doomed object will be released directly. However, if this
+ *        parameter is true, then an event will always be posted to the main
+ *        thread for asynchronous release.
+ */
+inline nsresult
+NS_ReleaseOnMainThread(nsISupports* aDoomed,
+                       bool aAlwaysProxy = false)
+{
+  // NS_ProxyRelease treats a null event target as "the current thread".  So a
+  // handle on the main thread is only necessary when we're not already on the
+  // main thread or the release must happen asynchronously.
+  nsCOMPtr<nsIThread> mainThread;
+  if (!NS_IsMainThread() || aAlwaysProxy) {
+    NS_GetMainThread(getter_AddRefs(mainThread));
+  }
+
+  return NS_ProxyRelease(mainThread, aDoomed, aAlwaysProxy);
+}
+
 /**
  * Class to safely handle main-thread-only pointers off the main thread.
  *
diff --git a/xpfe/appshell/nsWebShellWindow.cpp b/xpfe/appshell/nsWebShellWindow.cpp
index 6782821cb98d..fd2b99eafc41 100644
--- a/xpfe/appshell/nsWebShellWindow.cpp
+++ b/xpfe/appshell/nsWebShellWindow.cpp
@@ -341,8 +341,8 @@ nsWebShellWindow::SizeModeChanged(nsSizeMode sizeMode)
   if (ourWindow) {
     MOZ_ASSERT(ourWindow->IsOuterWindow());
 
-    // Let the application know if it's in fullscreen mode so it
-    // can update its UI.
+    // Ensure that the fullscreen state is synchronized between
+    // the widget and the outer window object.
     if (sizeMode == nsSizeMode_Fullscreen) {
       ourWindow->SetFullScreen(true);
     }
@@ -361,6 +361,16 @@ nsWebShellWindow::SizeModeChanged(nsSizeMode sizeMode)
   // then need to be different.
 }
 
+void
+nsWebShellWindow::FullscreenChanged(bool aInFullscreen)
+{
+  if (mDocShell) {
+    if (nsCOMPtr<nsPIDOMWindow> ourWindow = mDocShell->GetWindow()) {
+      ourWindow->FinishFullscreenChange(aInFullscreen);
+    }
+  }
+}
+
 void
 nsWebShellWindow::OSToolbarButtonPressed()
 {
diff --git a/xpfe/appshell/nsWebShellWindow.h b/xpfe/appshell/nsWebShellWindow.h
index 65e1d3d3d105..66780a7e09b5 100644
--- a/xpfe/appshell/nsWebShellWindow.h
+++ b/xpfe/appshell/nsWebShellWindow.h
@@ -56,6 +56,7 @@ public:
   virtual bool WindowResized(nsIWidget* aWidget, int32_t aWidth, int32_t aHeight) override;
   virtual bool RequestWindowClose(nsIWidget* aWidget) override;
   virtual void SizeModeChanged(nsSizeMode sizeMode) override;
+  virtual void FullscreenChanged(bool aInFullscreen) override;
   virtual void OSToolbarButtonPressed() override;
   virtual bool ZLevelChanged(bool aImmediate, nsWindowZ *aPlacement,
                              nsIWidget* aRequestBelow, nsIWidget** aActualBelow) override;