Merge mozilla-central to tracemonkey.

2024-10-28 12:45:27 +00:00 · 2009-12-24 08:57:39 -08:00 · 2009-12-24 08:57:39 -08:00 · a0733c70a0
commit a0733c70a0
parent 4c3dc32196 5c2887c20a
262 changed files with 4269 additions and 1511 deletions
--- a/accessible/src/base/nsAccessible.cpp
+++ b/accessible/src/base/nsAccessible.cpp
@ -3312,7 +3312,9 @@ nsAccessible::ComputeGroupAttributes(PRUint32 aRole,
      aRole != nsIAccessibleRole::ROLE_RADIOBUTTON &&
      aRole != nsIAccessibleRole::ROLE_PAGETAB &&
      aRole != nsIAccessibleRole::ROLE_OPTION &&
-      aRole != nsIAccessibleRole::ROLE_OUTLINEITEM)
+      aRole != nsIAccessibleRole::ROLE_OUTLINEITEM &&
+      aRole != nsIAccessibleRole::ROLE_ROW &&
+      aRole != nsIAccessibleRole::ROLE_GRID_CELL)
    return NS_OK;

  PRUint32 baseRole = aRole;
@ -3424,6 +3426,12 @@ nsAccessible::ComputeGroupAttributes(PRUint32 aRole,
      }
    } else
      groupLevel++; // level is 1-index based
+
+  } else if (aRole == nsIAccessibleRole::ROLE_ROW &&
+             nsAccUtils::Role(GetParent()) == nsIAccessibleRole::ROLE_TREE_TABLE) {
+    // It is a row inside flatten treegrid. Group level is always 1 until it is
+    // overriden by aria-level attribute.
+    groupLevel = 1;
  }

  nsAccUtils::SetAccGroupAttrs(aAttributes, groupLevel, positionInGroup,
--- a/accessible/tests/mochitest/Makefile.in
+++ b/accessible/tests/mochitest/Makefile.in
@ -42,7 +42,7 @@ srcdir		= @srcdir@
 VPATH		= @srcdir@
 relativesrcdir  = accessible

-DIRS	= tree selectable
+DIRS	= attributes selectable tree

 include $(DEPTH)/config/autoconf.mk
 include $(topsrcdir)/config/rules.mk
@ -84,11 +84,9 @@ _TEST_FILES =\
 		test_aria_roles.html \
 		test_aria_roles.xul \
 		test_aria_token_attrs.html \
-		test_attrs_elm_tree.xul \
 		test_bug420863.html \
 	$(warning   test_childAtPoint.html temporarily disabled) \
 	$(warning	test_childAtPoint.xul temporarily disabled) \
-		test_cssattrs.html \
 		test_descr.html \
 		test_elm_listbox.xul \
 	$(warning   test_elm_media.html temporarily disabled) \
@ -105,8 +103,6 @@ _TEST_FILES =\
 		test_events_scroll.xul \
 		test_events_tree.xul \
 		test_events_valuechange.html \
-		test_groupattrs.xul \
-		test_groupattrs.html \
 		test_invalidate_accessnode.html \
 		test_name.html \
 		test_name.xul \
@ -126,7 +122,6 @@ _TEST_FILES =\
 		test_nsIAccessibleImage.html \
 		test_nsIAccessNode_utils.html \
 		test_nsOuterDocAccessible.html \
- 		test_objectattrs.html \
 		test_relations.html \
 		test_relations.xul \
 		test_relations_tree.xul \
@ -159,7 +154,6 @@ _TEST_FILES =\
 		test_table_struct_ariatreegrid.html \
 		test_table_struct_listbox.xul \
 		test_table_struct_tree.xul \
-		test_textattrs.html \
 		test_textboxes.html \
 		test_textboxes.xul \
 		test_value.html \
--- a/accessible/tests/mochitest/attributes/Makefile.in
+++ b/accessible/tests/mochitest/attributes/Makefile.in
@ -0,0 +1,58 @@
+#
+# ***** BEGIN LICENSE BLOCK *****
+# Version: MPL 1.1/GPL 2.0/LGPL 2.1
+#
+# The contents of this file are subject to the Mozilla Public License Version
+# 1.1 (the "License"); you may not use this file except in compliance with
+# the License. You may obtain a copy of the License at
+# http://www.mozilla.org/MPL/
+#
+# Software distributed under the License is distributed on an "AS IS" basis,
+# WITHOUT WARRANTY OF ANY KIND, either express or implied. See the License
+# for the specific language governing rights and limitations under the
+# License.
+#
+# The Original Code is mozilla.org code.
+#
+# The Initial Developer of the Original Code is
+# Mozilla Corporation.
+# Portions created by the Initial Developer are Copyright (C) 2009
+# the Initial Developer. All Rights Reserved.
+#
+# Contributor(s):
+#   Alexander Surkov <surkov.alexander@gmail.com> (original author)
+#
+# Alternatively, the contents of this file may be used under the terms of
+# either of the GNU General Public License Version 2 or later (the "GPL"),
+# or the GNU Lesser General Public License Version 2.1 or later (the "LGPL"),
+# in which case the provisions of the GPL or the LGPL are applicable instead
+# of those above. If you wish to allow use of your version of this file only
+# under the terms of either the GPL or the LGPL, and not to allow others to
+# use your version of this file under the terms of the MPL, indicate your
+# decision by deleting the provisions above and replace them with the notice
+# and other provisions required by the GPL or the LGPL. If you do not delete
+# the provisions above, a recipient may use your version of this file under
+# the terms of any one of the MPL, the GPL or the LGPL.
+#
+# ***** END LICENSE BLOCK *****
+
+DEPTH		= ../../../..
+topsrcdir	= @top_srcdir@
+srcdir		= @srcdir@
+VPATH		= @srcdir@
+relativesrcdir  = accessible/attributes
+
+include $(DEPTH)/config/autoconf.mk
+include $(topsrcdir)/config/rules.mk
+
+_TEST_FILES =\
+		test_obj.html \
+		test_obj_css.html \
+		test_obj_group.html \
+		test_obj_group.xul \
+		test_obj_group_tree.xul \
+		test_text.html \
+		$(NULL)
+
+libs:: $(_TEST_FILES)
+	$(INSTALL) $(foreach f,$^,"$f") $(DEPTH)/_tests/testing/mochitest/a11y/$(relativesrcdir)
--- a/accessible/tests/mochitest/attributes/test_obj.html
+++ b/accessible/tests/mochitest/attributes/test_obj.html
--- a/accessible/tests/mochitest/attributes/test_obj_css.html
+++ b/accessible/tests/mochitest/attributes/test_obj_css.html
--- a/accessible/tests/mochitest/attributes/test_obj_group.html
+++ b/accessible/tests/mochitest/attributes/test_obj_group.html
@ -56,6 +56,30 @@
      testGroupAttrs("n_li11", 2, 3, 2);
      testGroupAttrs("n_li12", 3, 3, 2);

+      //////////////////////////////////////////////////////////////////////////
+      // ARIA grid
+      testGroupAttrs("grid_row1", 1, 2);
+      testGroupAttrs("grid_cell1", 1, 2);
+      testGroupAttrs("grid_cell2", 2, 2);
+
+      testGroupAttrs("grid_row2", 2, 2);
+      testGroupAttrs("grid_cell3", 1, 2);
+      testGroupAttrs("grid_cell4", 2, 2);
+
+      //////////////////////////////////////////////////////////////////////////
+      // ARIA treegrid
+      testGroupAttrs("treegrid_row1", 1, 3, 1);
+      testGroupAttrs("treegrid_cell1", 1, 2);
+      testGroupAttrs("treegrid_cell2", 2, 2);
+
+      testGroupAttrs("treegrid_row2", 2, 3, 2);
+      testGroupAttrs("treegrid_cell3", 1, 2);
+      testGroupAttrs("treegrid_cell4", 2, 2);
+
+      testGroupAttrs("treegrid_row3", 3, 3, 1);
+      testGroupAttrs("treegrid_cell5", 1, 2);
+      testGroupAttrs("treegrid_cell6", 2, 2);
+
      SimpleTest.finish();
    }

@ -116,5 +140,31 @@
      </span>
    </span>
  </span>
+
+  <table role="grid">
+    <tr role="row" id="grid_row1">
+      <td role="gridcell" id="grid_cell1">cell1</td>
+      <td role="gridcell" id="grid_cell2">cell2</td>
+    </tr>
+    <tr role="row" id="grid_row2">
+      <td role="gridcell" id="grid_cell3">cell3</td>
+      <td role="gridcell" id="grid_cell4">cell4</td>
+    </tr>
+  </table>
+
+  <div role="treegrid">
+    <div role="row" aria-level="1" id="treegrid_row1">
+      <div role="gridcell" id="treegrid_cell1">cell1</div>
+      <div role="gridcell" id="treegrid_cell2">cell2</div>
+    </div>
+    <div role="row" aria-level="2" id="treegrid_row2">
+      <div role="gridcell" id="treegrid_cell3">cell1</div>
+      <div role="gridcell" id="treegrid_cell4">cell2</div>
+    </div>
+    <div role="row" id="treegrid_row3">
+      <div role="gridcell" id="treegrid_cell5">cell1</div>
+      <div role="gridcell" id="treegrid_cell6">cell2</div>
+    </div>
+  </div>
 </body>
 </html>
--- a/accessible/tests/mochitest/attributes/test_obj_group.xul
+++ b/accessible/tests/mochitest/attributes/test_obj_group.xul
--- a/accessible/tests/mochitest/attributes/test_obj_group_tree.xul
+++ b/accessible/tests/mochitest/attributes/test_obj_group_tree.xul
--- a/accessible/tests/mochitest/attributes/test_text.html
+++ b/accessible/tests/mochitest/attributes/test_text.html
--- a/accessible/tests/mochitest/test_nsIAccessibleHyperLink.html
+++ b/accessible/tests/mochitest/test_nsIAccessibleHyperLink.html
@ -280,28 +280,27 @@ https://bugzilla.mozilla.org/show_bug.cgi?id=418368
  ><img width="447" id="imgmap"
        height="15"
        usemap="#atoz_map"
-        src="letters.gif"></img
-  ><br>Empty link:<br
-  ><a id="emptyLink" href=""><img src=""></img></a
+        src="letters.gif"><br>Empty link:<br
+  ><a id="emptyLink" href=""><img src=""></a
  ><br>Link with embedded span<br
  ><a id="LinkWithSpan" href="http://www.heise.de/"><span lang="de">Heise Online</span></a
  ><br>Named anchor, must not have "linked" state for it to be exposed correctly:<br
  ><a id="namedAnchor" name="named_anchor">This should never be of state_linked</a
-  ><br>Link having no attributes, must not have "linked" state:</br
-  ><a id="noLink">This should never be of state_linked</a
-  ><br>Link with registered 'click' event: </br
-  ><a id="linkWithClick" onclick="var clicked = true;">This should have state_linked</a
-  ><br>Link with title attribute (no name from subtree): </br
-  ><a id="linkWithTitleNoNameFromSubtree" href="http://www.heise.de/"
+  ><br>Link having no attributes, must not have "linked" state:<a id="noLink"
+  >This should never be of state_linked</a
+  ><br>Link with registered 'click' event: <a id="linkWithClick" onclick="var clicked = true;"
+  >This should have state_linked</a
+  ><br>Link with title attribute (no name from subtree): <a 
+      id="linkWithTitleNoNameFromSubtree" href="http://www.heise.de/"
      title="Link with title"><img src=""/></a
-  ><br>Link with title attribute (name from subtree): </br
-  ><a id="linkWithTitleNameFromSubtree" href="http://www.heise.de/"
+  ><br>Link with title attribute (name from subtree): <a 
+      id="linkWithTitleNameFromSubtree" href="http://www.heise.de/"
      title="Link with title">the name from subtree</a
-  ><br>Link with title attribute (name from nested image): </br
-  ><a id="linkWithTitleNameFromImg" href="http://www.heise.de/"
+  ><br>Link with title attribute (name from nested image): <a 
+      id="linkWithTitleNameFromImg" href="http://www.heise.de/"
      title="Link with title"><img src="" alt="The title for link"/></a
-  ><br><label for="linkWithLabelNoNameFromSubtree">Link with label and nested image: </label></br
-  ><a id="linkWithLabelNoNameFromSubtree"
+  ><br><label for="linkWithLabelNoNameFromSubtree">Link with label and nested image: </label><a 
+      id="linkWithLabelNoNameFromSubtree"
      href="http://www.heise.de/"><img src=""/></a
  ><br>Map that is used to group links (www.w3.org/TR/WCAG10-HTML-TECHS/#group-bypass), also see the bug 431615:<br
  ><map id="linksmap" title="Site navigation"><ul
--- a/browser/app/Makefile.in
+++ b/browser/app/Makefile.in
@ -221,12 +221,6 @@ endif

 include $(topsrcdir)/config/rules.mk

-DEFINES += -DFIREFOX_ICO=\"$(DIST)/branding/firefox.ico\" -DDOCUMENT_ICO=\"$(DIST)/branding/document.ico\"
-
-ifdef MOZILLA_OFFICIAL
-DEFINES += -DMOZILLA_OFFICIAL
-endif
-
 ifdef BUILD_STATIC_LIBS
 include $(topsrcdir)/config/static-rules.mk

@ -275,6 +269,12 @@ endif

 endif # LIBXUL_SDK

+DEFINES += -DFIREFOX_ICO=\"$(DIST)/branding/firefox.ico\" -DDOCUMENT_ICO=\"$(DIST)/branding/document.ico\"
+
+ifdef MOZILLA_OFFICIAL
+DEFINES += -DMOZILLA_OFFICIAL
+endif
+
 ifeq ($(MOZ_WIDGET_TOOLKIT),gtk2)
 libs::
 	$(INSTALL) $(IFLAGS1) $(DIST)/branding/mozicon128.png $(DIST)/bin/icons
--- a/browser/app/application.ini
+++ b/browser/app/application.ini
@ -47,7 +47,7 @@ SourceRepository=@MOZ_SOURCE_REPO@
 #ifdef MOZ_SOURCE_STAMP
 SourceStamp=@MOZ_SOURCE_STAMP@
 #endif
-Copyright=Copyright (c) 1998 - 2009 mozilla.org
+Copyright=Copyright (c) 1998 - 2010 mozilla.org
 ID={ec8030f7-c20a-464f-9b0e-13a3a9e97384}

 [Gecko]
--- a/browser/app/macbuild/Contents/Info.plist.in
+++ b/browser/app/macbuild/Contents/Info.plist.in
@ -74,7 +74,7 @@
 	<key>CFBundleExecutable</key>
 	<string>firefox-bin</string>
 	<key>CFBundleGetInfoString</key>
-	<string>%APP_NAME% %APP_VERSION%, © 1998-2009 Contributors</string>
+	<string>%APP_NAME% %APP_VERSION%, © 1998-2010 Contributors</string>
 	<key>CFBundleIconFile</key>
 	<string>firefox</string>
 	<key>CFBundleIdentifier</key>
--- a/browser/app/macbuild/Contents/Resources/English.lproj/InfoPlist.strings.in
+++ b/browser/app/macbuild/Contents/Resources/English.lproj/InfoPlist.strings.in
@ -1,2 +1,2 @@
 CFBundleName = "%APP_NAME%";
-NSHumanReadableCopyright = "Copyright © 1998-2009 Contributors";
+NSHumanReadableCopyright = "Copyright © 1998-2010 Contributors";
--- a/browser/base/content/credits.xhtml
+++ b/browser/base/content/credits.xhtml
@ -622,7 +622,7 @@
        <p id="gecko" class="center" dir="&locale.dir;">&credit.poweredByGeckoReg;</p>

        <p class="footnote" dir="&locale.dir;">
-          &brandFullName;&trade; &license.part0; &copy;1998-2009 &license.part1;
+          &brandFullName;&trade; &license.part0; &copy;1998-2010 &license.part1;
          <a href="" link="about:credits" onclick="visitLink(event);">&license.contrib;</a>,
          &license.part2;
          <a href="" link="about:license" onclick="visitLink(event);">about:license</a>
--- a/browser/branding/nightly/pref/firefox-branding.js
+++ b/browser/branding/nightly/pref/firefox-branding.js
@ -18,5 +18,6 @@ pref("app.releaseNotesURL", "http://www.mozilla.org/projects/%APP%/%VERSION%/rel

 // Search codes belong only in builds with official branding
 pref("browser.search.param.yahoo-fr", "");
-pref("browser.search.param.yahoo-fr-cjkt", "");
+pref("browser.search.param.yahoo-fr-cjkt", ""); // now unused
+pref("browser.search.param.yahoo-fr-ja", "");
 pref("browser.search.param.yahoo-f-CN", "");
--- a/browser/branding/unofficial/pref/firefox-branding.js
+++ b/browser/branding/unofficial/pref/firefox-branding.js
@ -18,5 +18,6 @@ pref("app.releaseNotesURL", "http://www.mozilla.org/projects/%APP%/%VERSION%/rel

 // Search codes belong only in builds with official branding
 pref("browser.search.param.yahoo-fr", "");
-pref("browser.search.param.yahoo-fr-cjkt", "");
+pref("browser.search.param.yahoo-fr-cjkt", ""); // now unused
+pref("browser.search.param.yahoo-fr-ja", "");
 pref("browser.search.param.yahoo-f-CN", "");
--- a/browser/components/places/tests/unit/head_bookmarks.js
+++ b/browser/components/places/tests/unit/head_bookmarks.js
@ -333,7 +333,6 @@ function flush_main_thread_events()
 // These tests are known to randomly fail due to bug 507790 when database
 // flushes are active, so we turn off syncing for them.
 let randomFailingSyncTests = [
-  "test_browserGlue_smartBookmarks.js",
 ];
 let currentTestFilename = do_get_file(_TEST_FILE[0], true).leafName;
 if (randomFailingSyncTests.indexOf(currentTestFilename) != -1) {
--- a/browser/components/safebrowsing/content/blockedSite.xhtml
+++ b/browser/components/safebrowsing/content/blockedSite.xhtml
@ -78,23 +78,32 @@
      function getURL()
      {
        var url = document.documentURI;
-        var index = url.search(/u\=/);
+        var match = url.match(/&u=([^&]+)&/);

-        // index == -1 if not found; if so, return an empty string
+        // match == null if not found; if so, return an empty string
        // instead of what would turn out to be portions of the URI
-        if (index == -1)
+        if (!match)
          return "";

-        return decodeURIComponent(url.slice(index + 2));
+        url = decodeURIComponent(match[1]);
+
+        // If this is a view-source page, then get then real URI of the page
+        if (/^view-source\:/.test(url))
+          url = url.slice(12);
+        return url;
      }
      
      /**
-       * Attempt to parse the result of getURL and extract a hostname.  Fail back
+       * Attempt to get the hostname via document.location.  Fail back
       * to getURL so that we always return something meaningful.
       */
      function getHostString()
      {
-        return document.location.hostname;
+        try {
+          return document.location.hostname;
+        } catch (e) {
+          return getURL();
+        }
      }
      
      function initPage()
--- a/browser/locales/en-US/chrome/browser/aboutDialog.dtd
+++ b/browser/locales/en-US/chrome/browser/aboutDialog.dtd
@ -7,7 +7,7 @@
 <!ENTITY aboutVersion               "version">
 <!ENTITY closeCmdGNOME.label        "Close">  
 <!ENTITY closeCmdGNOME.accesskey    "C">
-<!ENTITY copyrightInfo1             "&#169;1998-2009 Contributors. All rights reserved. (">
+<!ENTITY copyrightInfo1             "&#169;1998-2010 Contributors. All rights reserved. (">
 <!ENTITY licenseLink                "about:license">
 <!ENTITY licenseLinkText            "Licensing information">
 <!ENTITY copyrightInfo2             ").">
--- a/build/automation.py.in
+++ b/build/automation.py.in
@ -451,6 +451,7 @@ def environment(env = None, xrePath = DIST_BIN, crashreporter = True):
    env['MOZ_CRASHREPORTER_DISABLE'] = '1'

  env['GNOME_DISABLE_CRASH_DIALOG'] = "1"
+  env['XRE_NO_WINDOWS_CRASH_DIALOG'] = '1'
  return env

 if IS_WIN32:
@ -681,7 +682,6 @@ def runApp(testURL, env, app, profileDir, extraArgs,
      if m:
        processList.append(int(m.group(1)))
    processLogFD.close()
-    os.unlink(processLog)

    for processPID in processList:
      log.info("INFO | automation.py | Checking for orphan process with PID: %d", processPID)
@ -692,6 +692,9 @@ def runApp(testURL, env, app, profileDir, extraArgs,
  if checkForCrashes(os.path.join(profileDir, "minidumps"), symbolsPath):
    status = -1

+  if os.path.exists(processLog):
+    os.unlink(processLog)
+
  if IS_TEST_BUILD and runSSLTunnel:
    ssltunnelProcess.kill()

--- a/configure.in
+++ b/configure.in
@ -5088,7 +5088,7 @@ then
 fi

 dnl ========================================================
-dnl = GnomeVFS support module
+dnl = GnomeVFS, GIO and GConf support module
 dnl ========================================================

 if test "$MOZ_X11"
@ -5101,6 +5101,9 @@ then
        MOZ_ENABLE_GCONF=1
    fi

+    dnl ========================================================
+    dnl = GnomeVFS support module
+    dnl ========================================================
    MOZ_ARG_DISABLE_BOOL(gnomevfs,
    [  --disable-gnomevfs      Disable GnomeVFS support ],
        MOZ_ENABLE_GNOMEVFS=,
@ -5119,30 +5122,18 @@ then
            fi
            MOZ_ENABLE_GNOMEVFS=
        ])
+    else
+        if test `echo "$MOZ_EXTENSIONS" | grep -c gnomevfs` -ne 0; then
+            PKG_CHECK_MODULES(MOZ_GNOMEVFS, gnome-vfs-2.0 >= $GNOMEVFS_VERSION gnome-vfs-module-2.0 >= $GNOMEVFS_VERSION,[
+              MOZ_GNOMEVFS_LIBS=`echo $MOZ_GNOMEVFS_LIBS | sed 's/-llinc\>//'`
+            ])
+        fi
    fi

    AC_SUBST(MOZ_ENABLE_GNOMEVFS)
    AC_SUBST(MOZ_GNOMEVFS_CFLAGS)
    AC_SUBST(MOZ_GNOMEVFS_LIBS)

-    if test "$MOZ_ENABLE_GCONF"
-    then
-        PKG_CHECK_MODULES(MOZ_GCONF, gconf-2.0 >= $GCONF_VERSION,[
-            MOZ_GCONF_LIBS=`echo $MOZ_GCONF_LIBS | sed 's/-llinc\>//'`
-            MOZ_ENABLE_GCONF=1
-        ],[
-            MOZ_ENABLE_GCONF=
-        ])
-    fi
-
-    if test "$MOZ_ENABLE_GCONF"; then
-        AC_DEFINE(MOZ_ENABLE_GCONF)
-    fi
-
-    AC_SUBST(MOZ_ENABLE_GCONF)
-    AC_SUBST(MOZ_GCONF_CFLAGS)
-    AC_SUBST(MOZ_GCONF_LIBS)
-
    dnl ========================================================
    dnl = GIO support module
    dnl ========================================================
@ -5169,78 +5160,32 @@ then
    AC_SUBST(MOZ_ENABLE_GIO)
    AC_SUBST(MOZ_GIO_CFLAGS)
    AC_SUBST(MOZ_GIO_LIBS)
-fi
-
-dnl ========================================================
-dnl = libgnomeui support module
-dnl ========================================================
-
-if test "$MOZ_ENABLE_GTK2"
-then
-    MOZ_ENABLE_GNOMEUI=1
-
-    MOZ_ARG_DISABLE_BOOL(gnomeui,
-    [  --disable-gnomeui       Disable libgnomeui support (default: auto, optional at runtime) ],
-        MOZ_ENABLE_GNOMEUI=,
-        MOZ_ENABLE_GNOMEUI=force)
-
-    if test "$MOZ_ENABLE_GNOMEUI"
+   
+    dnl ========================================================
+    dnl = GConf support module
+    dnl ========================================================
+    if test "$MOZ_ENABLE_GCONF"
    then
-        PKG_CHECK_MODULES(MOZ_GNOMEUI, libgnomeui-2.0 >= $GNOMEUI_VERSION,
-        [
-            MOZ_GNOMEUI_LIBS=`echo $MOZ_GNOMEUI_LIBS | sed 's/-llinc\>//'`
-            MOZ_ENABLE_GNOMEUI=1
+        PKG_CHECK_MODULES(MOZ_GCONF, gconf-2.0 >= $GCONF_VERSION gobject-2.0 ,[
+            MOZ_GCONF_LIBS=`echo $MOZ_GCONF_LIBS | sed 's/-llinc\>//'`
+            MOZ_ENABLE_GCONF=1
        ],[
-            if test "$MOZ_ENABLE_GNOMEUI" = "force"
+            if test "$MOZ_ENABLE_GCONF" = "force"
            then
-                AC_MSG_ERROR([* * * Could not find libgnomeui-2.0 >= $GNOMEUI_VERSION])
+                AC_MSG_ERROR([* * * Could not find gconf-2.0 ])
            fi
-            MOZ_ENABLE_GNOMEUI=
+            MOZ_ENABLE_GCONF=
        ])
    fi

-    if test "$MOZ_ENABLE_GNOMEUI"; then
-        AC_DEFINE(MOZ_ENABLE_GNOMEUI)
+    if test "$MOZ_ENABLE_GCONF"; then
+        AC_DEFINE(MOZ_ENABLE_GCONF)
    fi

-    # The GNOME component is built if gtk2, gconf and gnome-vfs
-    # are all available.
-
-    if test "$MOZ_ENABLE_GTK2" -a "$MOZ_ENABLE_GCONF" && \
-            (test "$MOZ_ENABLE_GNOMEVFS" || test "$MOZ_ENABLE_GIO"); then
-      MOZ_ENABLE_GNOME_COMPONENT=1
-    else
-      MOZ_ENABLE_GNOME_COMPONENT=
-    fi
-
-    AC_SUBST(MOZ_ENABLE_GNOME_COMPONENT)
+    AC_SUBST(MOZ_ENABLE_GCONF)
+    AC_SUBST(MOZ_GCONF_CFLAGS)
+    AC_SUBST(MOZ_GCONF_LIBS)
 fi
-AC_SUBST(MOZ_ENABLE_GNOMEUI)
-AC_SUBST(MOZ_GNOMEUI_CFLAGS)
-AC_SUBST(MOZ_GNOMEUI_LIBS)
-
-dnl ========================================================
-dnl = dbus support
-dnl ========================================================
-
-if test "$MOZ_ENABLE_GTK2" || test "$MOZ_ENABLE_QT"
-then
-    MOZ_ENABLE_DBUS=1
-
-    MOZ_ARG_DISABLE_BOOL(dbus,
-    [  --disable-dbus       Disable dbus support ],
-        MOZ_ENABLE_DBUS=,
-        MOZ_ENABLE_DBUS=1)
-
-    if test "$MOZ_ENABLE_DBUS"
-    then
-        PKG_CHECK_MODULES(MOZ_DBUS_GLIB, dbus-glib-1 >= $DBUS_VERSION)
-        AC_DEFINE(MOZ_ENABLE_DBUS)
-    fi
-fi
-AC_SUBST(MOZ_ENABLE_DBUS)
-AC_SUBST(MOZ_DBUS_GLIB_CFLAGS)
-AC_SUBST(MOZ_DBUS_GLIB_LIBS)

 dnl ========================================================
 dnl = libnotify support
@ -5275,6 +5220,82 @@ AC_SUBST(MOZ_ENABLE_LIBNOTIFY)
 AC_SUBST(MOZ_LIBNOTIFY_CFLAGS)
 AC_SUBST(MOZ_LIBNOTIFY_LIBS)

+dnl ========================================================
+dnl = GNOME component (mozgnome)
+dnl ========================================================
+
+# The GNOME component is built if one of 
+# gnome-vfs, gio, gconf or libnotify is available.
+if test "$MOZ_ENABLE_GCONF" || \
+   test "$MOZ_ENABLE_GNOMEVFS" || \
+   test "$MOZ_ENABLE_GIO" || \
+   test "$MOZ_ENABLE_LIBNOTIFY"; then
+    MOZ_ENABLE_GNOME_COMPONENT=1
+else
+    MOZ_ENABLE_GNOME_COMPONENT=
+fi
+AC_SUBST(MOZ_ENABLE_GNOME_COMPONENT)
+
+dnl ========================================================
+dnl = libgnomeui support module
+dnl ========================================================
+
+if test "$MOZ_ENABLE_GTK2"
+then
+    MOZ_ENABLE_GNOMEUI=1
+
+    MOZ_ARG_DISABLE_BOOL(gnomeui,
+    [  --disable-gnomeui       Disable libgnomeui support (default: auto, optional at runtime) ],
+        MOZ_ENABLE_GNOMEUI=,
+        MOZ_ENABLE_GNOMEUI=force)
+
+    if test "$MOZ_ENABLE_GNOMEUI"
+    then
+        PKG_CHECK_MODULES(MOZ_GNOMEUI, libgnomeui-2.0 >= $GNOMEUI_VERSION,
+        [
+            MOZ_GNOMEUI_LIBS=`echo $MOZ_GNOMEUI_LIBS | sed 's/-llinc\>//'`
+            MOZ_ENABLE_GNOMEUI=1
+        ],[
+            if test "$MOZ_ENABLE_GNOMEUI" = "force"
+            then
+                AC_MSG_ERROR([* * * Could not find libgnomeui-2.0 >= $GNOMEUI_VERSION])
+            fi
+            MOZ_ENABLE_GNOMEUI=
+        ])
+    fi
+
+    if test "$MOZ_ENABLE_GNOMEUI"; then
+        AC_DEFINE(MOZ_ENABLE_GNOMEUI)
+    fi
+fi
+
+AC_SUBST(MOZ_ENABLE_GNOMEUI)
+AC_SUBST(MOZ_GNOMEUI_CFLAGS)
+AC_SUBST(MOZ_GNOMEUI_LIBS)
+
+dnl ========================================================
+dnl = dbus support
+dnl ========================================================
+
+if test "$MOZ_ENABLE_GTK2" || test "$MOZ_ENABLE_QT"
+then
+    MOZ_ENABLE_DBUS=1
+
+    MOZ_ARG_DISABLE_BOOL(dbus,
+    [  --disable-dbus       Disable dbus support ],
+        MOZ_ENABLE_DBUS=,
+        MOZ_ENABLE_DBUS=1)
+
+    if test "$MOZ_ENABLE_DBUS"
+    then
+        PKG_CHECK_MODULES(MOZ_DBUS_GLIB, dbus-glib-1 >= $DBUS_VERSION)
+        AC_DEFINE(MOZ_ENABLE_DBUS)
+    fi
+fi
+AC_SUBST(MOZ_ENABLE_DBUS)
+AC_SUBST(MOZ_DBUS_GLIB_CFLAGS)
+AC_SUBST(MOZ_DBUS_GLIB_LIBS)
+
 dnl ========================================================
 dnl = Build Personal Security Manager
 dnl ========================================================
@ -5740,7 +5761,7 @@ MOZ_ARG_ENABLE_STRING(extensions,
 done],
    MOZ_EXTENSIONS="$MOZ_EXTENSIONS_DEFAULT")

-if test -z "$MOZ_ENABLE_GNOMEVFS" && test `echo "$MOZ_EXTENSIONS" | grep -c gnomevfs` -ne 0; then
+if test -z "$MOZ_ENABLE_GNOMEVFS" && test -z "$MOZ_GNOMEVFS_LIBS" && test `echo "$MOZ_EXTENSIONS" | grep -c gnomevfs` -ne 0; then
    # Suppress warning on non-X11 platforms
    if test -n "$MOZ_X11"; then
        AC_MSG_WARN([Cannot build gnomevfs without required libraries. Removing gnomevfs from MOZ_EXTENSIONS.])
--- a/content/base/src/nsContentUtils.cpp
+++ b/content/base/src/nsContentUtils.cpp
@ -505,6 +505,8 @@ nsContentUtils::InitializeEventTable() {
    { &nsGkAtoms::onMozRotateGesture,            { NS_SIMPLE_GESTURE_ROTATE, EventNameType_None } },
    { &nsGkAtoms::onMozTapGesture,               { NS_SIMPLE_GESTURE_TAP, EventNameType_None } },
    { &nsGkAtoms::onMozPressTapGesture,          { NS_SIMPLE_GESTURE_PRESSTAP, EventNameType_None } },
+
+    { &nsGkAtoms::ontransitionend,               { NS_TRANSITION_END, EventNameType_None }},
  };

  sEventTable = new nsDataHashtable<nsISupportsHashKey, EventNameMapping>;
--- a/content/base/src/nsGkAtomList.h
+++ b/content/base/src/nsGkAtomList.h
@ -678,6 +678,7 @@ GK_ATOM(onselect, "onselect")
 GK_ATOM(onset, "onset")
 GK_ATOM(onsubmit, "onsubmit")
 GK_ATOM(ontext, "ontext")
+GK_ATOM(ontransitionend, "ontransitionend")
 GK_ATOM(onunderflow, "onunderflow")
 GK_ATOM(onunload, "onunload")
 GK_ATOM(open, "open")
--- a/content/base/test/test_range_bounds.html
+++ b/content/base/test/test_range_bounds.html
@ -5,6 +5,7 @@ https://bugzilla.mozilla.org/show_bug.cgi?id=421640
 -->
 <head>
  <title>Test for Bug 396392</title>
+  <meta http-equiv="content-type" content="text/html; charset=UTF-8">
  <script type="text/javascript" src="/MochiKit/packed.js"></script>
  <script type="text/javascript" src="/tests/SimpleTest/SimpleTest.js"></script>
  <script type="text/javascript" src="/tests/SimpleTest/EventUtils.js"></script>
@ -15,10 +16,13 @@ https://bugzilla.mozilla.org/show_bug.cgi?id=421640
 <div id="content" style="font-face:monospace;font-size:12px;width:100px">
 <p>000000<span>0</span></p><div>00000<span>0</span></div><p>0000<span>0000</span>0000</p>
 </div>
+<div id="mixeddir" style="font-face:monospace;font-size:12px;width:100px"><span>english <bdo dir="rtl">rtl-overide english</bdo> word</span></div>
 <pre id="test">
 <script class="testbody" type="text/javascript">

+var isLTR=true;
 function isEmptyRect(rect, name) {
+  name = (isLTR ? 'isLTR ' : 'isRTL ') + name;
  is(rect.left, 0, name+'empty rect should have left = 0');
  is(rect.right, 0, name+'empty rect should have right = 0');
  is(rect.top, 0, name+'empty rect should have top = 0');
@ -28,6 +32,7 @@ function isEmptyRect(rect, name) {
 }

 function isEmptyRectList(rectlist, name) {
+  name = (isLTR ? 'isLTR ' : 'isRTL ') + name;
  is(rectlist.length, 0, name + 'empty rectlist should have zero rects');
 }

@ -49,7 +54,8 @@ function runATest(obj) {
    }
    //test getBoundingClientRect()
    var rect = range.getBoundingClientRect();
-    var testname = 'range.getBoundingClientRect for ' + obj.name;
+    var testname = (isLTR ? 'isLTR ' : 'isRTL ') + 
+      'range.getBoundingClientRect for ' + obj.name;
    if (obj.rect) {
      is(_getRect(rect),_getRect(obj.rect), testname);
    } else {
@ -57,7 +63,8 @@ function runATest(obj) {
    }
    //test getClientRects()
    var rectlist = range.getClientRects();
-    testname = 'range.getClientRects for '+obj.name;
+    testname = (isLTR ? 'isLTR ' : 'isRTL ') +
+      'range.getClientRects for '+obj.name;
    if (!obj.rectList) {
      //rectList is not specified, use obj.rect to figure out rectList
      obj.rectList = obj.rect?[obj.rect]:[];
@ -66,6 +73,10 @@ function runATest(obj) {
      isEmptyRectList(rectlist, testname+": ");
    } else {
      is(rectlist.length, obj.rectList.length, testname+' should return '+obj.rectList.length+' rects.');
+      if(!obj.rectList.forEach){
+        //convert RectList to a real array
+        obj.rectList=Array.prototype.slice.call(obj.rectList, 0);
+      }
      obj.rectList.forEach(function(rect,i) {
        is(_getRect(rectlist[i]),_getRect(rect),testname+": item at "+i);
      });
@ -75,7 +86,7 @@ function runATest(obj) {
  }
 }
 /** Test for Bug 396392 **/
-function test() {
+function doTest(){
  var root = document.getElementById('content');
  var firstP = root.firstElementChild, spanInFirstP = firstP.childNodes[1],
    firstDiv = root.childNodes[2], spanInFirstDiv = firstDiv.childNodes[1],
@ -92,13 +103,15 @@ function test() {
      rect:null},
    {name:'collapsedInBlockNode', range:[firstP, 2], rect:null},
    {name:'collapsedAtBeginningOfTextNode', range:[firstP.firstChild, 0],
-      rect:[firstPRect.left, firstPRect.left, spanInFirstPRect.top, 
+      rect:[spanInFirstPRect.left - 6 * widthPerchar, 
+      spanInFirstPRect.left - 6 * widthPerchar, spanInFirstPRect.top, 
      spanInFirstPRect.bottom, 0, spanInFirstPRect.height]},
    {name:'collapsedWithinTextNode', range:[firstP.firstChild, 1], 
-      rect:[firstPRect.left+widthPerchar, firstPRect.left+widthPerchar,
+      rect:[spanInFirstPRect.left  - 5 * widthPerchar, 
+        spanInFirstPRect.left  - 5 * widthPerchar,
        spanInFirstPRect.top, spanInFirstPRect.bottom, 0, spanInFirstPRect.height]},
    {name:'collapsedAtEndOfTextNode', range:[firstP.firstChild, 6], 
-      rect:[firstPRect.left + 6*widthPerchar, firstPRect.left + 6*widthPerchar,
+      rect:[spanInFirstPRect.left, spanInFirstPRect.left,
        spanInFirstPRect.top, spanInFirstPRect.bottom, 0, spanInFirstPRect.height]},
    {name:'singleBlockNode', range:[root, 1, root, 2], rect:firstPRect},
    {name:'twoBlockNodes', range:[root, 1, root, 3],
@ -108,7 +121,7 @@ function test() {
      rectList:[firstPRect, firstDivRect]},
    {name:'endOfTextNodeToEndOfAnotherTextNodeInAnotherBlock',
      range:[spanInFirstP.firstChild, 1, firstDiv.firstChild, 5],
-      rect:[firstDivRect.left, firstDivRect.left + 5*widthPerchar,
+      rect:[spanInFirstDivRect.left - 5*widthPerchar, spanInFirstDivRect.left,
        spanInFirstDivRect.top, spanInFirstDivRect.bottom, 5 * widthPerchar, 
        spanInFirstDivRect.height]},
    {name:'startOfTextNodeToStartOfAnotherTextNodeInAnotherBlock', 
@ -117,17 +130,18 @@ function test() {
        spanInFirstPRect.bottom, widthPerchar, spanInFirstPRect.height]},
    {name:'endPortionOfATextNode', range:[firstP.firstChild, 3, 
        firstP.firstChild, 6],
-      rect:[firstPRect.left + 3*widthPerchar, firstPRect.left + 6*widthPerchar,
+      rect:[spanInFirstPRect.left - 3*widthPerchar, spanInFirstPRect.left,
        spanInFirstPRect.top, spanInFirstPRect.bottom, 3*widthPerchar, spanInFirstPRect.height]},
    {name:'startPortionOfATextNode', range:[firstP.firstChild, 0, 
        firstP.firstChild, 3],
-      rect:[firstPRect.left, firstPRect.left + 3*widthPerchar, spanInFirstPRect.top,
+      rect:[spanInFirstPRect.left - 6*widthPerchar, 
+        spanInFirstPRect.left - 3*widthPerchar, spanInFirstPRect.top,
        spanInFirstPRect.bottom, 3 * widthPerchar, spanInFirstPRect.height]},
    {name:'spanTextNodes', range:[secondP.firstChild, 1, secondP.lastChild, 1],
-      rect:[secondPRect.left + widthPerchar, spanInSecondPRect.right + 
+      rect:[spanInSecondPRect.left - 3*widthPerchar, spanInSecondPRect.right + 
        widthPerchar, spanInSecondPRect.top, spanInSecondPRect.bottom,
        spanInSecondPRect.width + 4*widthPerchar, spanInSecondPRect.height],
-      rectList:[[secondPRect.left + widthPerchar, spanInSecondPRect.left,
+      rectList:[[spanInSecondPRect.left - 3*widthPerchar, spanInSecondPRect.left,
        spanInSecondPRect.top, spanInSecondPRect.bottom, 3 * widthPerchar,
        spanInSecondPRect.height],
 	spanInSecondPRect,
@ -135,10 +149,27 @@ function test() {
          spanInSecondPRect.top, spanInSecondPRect.bottom, widthPerchar,
          spanInSecondPRect.height]]}
  ];
-  testcases.forEach(function(tc) {
-    runATest(tc);
-  });
-  //alert(_getRect(rect));
+  testcases.forEach(runATest);
+}
+function testMixedDir(){
+  var root = document.getElementById('mixeddir');
+  var firstSpan = root.firstElementChild, firstSpanRect=firstSpan.getBoundingClientRect(),
+      firstSpanRectList = firstSpan.getClientRects();
+  runATest({name:'mixeddir',range:[firstSpan.firstChild,0,firstSpan.lastChild,firstSpan.lastChild.length],
+             rect: firstSpanRect, rectList:firstSpanRectList});
+}
+function test(){
+  //test ltr
+  doTest();
+  testMixedDir();
+
+  isLTR = false;
+  var root = document.getElementById('content');
+  root.dir = 'rtl';
+
+  //test rtl
+  doTest();
+  testMixedDir();

  SimpleTest.finish();
 }
--- a/content/events/public/nsIPrivateDOMEvent.h
+++ b/content/events/public/nsIPrivateDOMEvent.h
@ -115,4 +115,6 @@ nsresult
 NS_NewDOMSimpleGestureEvent(nsIDOMEvent** aInstancePtrResult, nsPresContext* aPresContext, class nsSimpleGestureEvent* aEvent);
 nsresult
 NS_NewDOMScrollAreaEvent(nsIDOMEvent** aInstancePtrResult, nsPresContext* aPresContext, class nsScrollAreaEvent* aEvent);
+nsresult
+NS_NewDOMTransitionEvent(nsIDOMEvent** aInstancePtrResult, nsPresContext* aPresContext, class nsTransitionEvent* aEvent);
 #endif // nsIPrivateDOMEvent_h__
--- a/content/events/src/Makefile.in
+++ b/content/events/src/Makefile.in
@ -81,6 +81,7 @@ CPPSRCS		= \
 		nsDOMSimpleGestureEvent.cpp \
 		nsDOMEventTargetHelper.cpp \
 		nsDOMScrollAreaEvent.cpp \
+		nsDOMTransitionEvent.cpp \
 		$(NULL)

 # we don't want the shared lib, but we want to force the creation of a static lib.
--- a/content/events/src/nsDOMEvent.cpp
+++ b/content/events/src/nsDOMEvent.cpp
@ -92,7 +92,8 @@ static const char* const sEventNames[] = {
  "MozRotateGesture",
  "MozTapGesture",
  "MozPressTapGesture",
-  "MozScrolledAreaChanged"
+  "MozScrolledAreaChanged",
+  "transitionend"
 };

 static char *sPopupAllowedEvents;
@ -705,6 +706,10 @@ nsDOMEvent::SetEventType(const nsAString& aEventTypeArg)
    else if (atom == nsGkAtoms::onMozTapGesture)
      mEvent->message = NS_SIMPLE_GESTURE_TAP;
  }
+  else if (mEvent->eventStructType == NS_TRANSITION_EVENT) {
+    if (atom == nsGkAtoms::ontransitionend)
+      mEvent->message = NS_TRANSITION_END;
+  }

  if (mEvent->message == NS_USER_DEFINED_EVENT)
    mEvent->userType = atom;
@ -1007,6 +1012,16 @@ NS_METHOD nsDOMEvent::DuplicatePrivateData()
      newEvent = simpleGestureEvent;
      break;
    }
+    case NS_TRANSITION_EVENT:
+    {
+      nsTransitionEvent* oldTransitionEvent =
+        static_cast<nsTransitionEvent*>(mEvent);
+      newEvent = new nsTransitionEvent(PR_FALSE, msg,
+                                       oldTransitionEvent->propertyName,
+                                       oldTransitionEvent->elapsedTime);
+      NS_ENSURE_TRUE(newEvent, NS_ERROR_OUT_OF_MEMORY);
+      break;
+    }
    default:
    {
      NS_WARNING("Unknown event type!!!");
@ -1495,6 +1510,8 @@ const char* nsDOMEvent::GetEventName(PRUint32 aEventType)
    return sEventNames[eDOMEvents_MozPressTapGesture];
  case NS_SCROLLEDAREACHANGED:
    return sEventNames[eDOMEvents_MozScrolledAreaChanged];
+  case NS_TRANSITION_END:
+    return sEventNames[eDOMEvents_transitionend];
  default:
    break;
  }
--- a/content/events/src/nsDOMEvent.h
+++ b/content/events/src/nsDOMEvent.h
@ -171,7 +171,8 @@ public:
    eDOMEvents_MozRotateGesture,
    eDOMEvents_MozTapGesture,
    eDOMEvents_MozPressTapGesture,
-    eDOMEvents_MozScrolledAreaChanged
+    eDOMEvents_MozScrolledAreaChanged,
+    eDOMEvents_transitionend
  };

  nsDOMEvent(nsPresContext* aPresContext, nsEvent* aEvent);
--- a/content/events/src/nsDOMTransitionEvent.cpp
+++ b/content/events/src/nsDOMTransitionEvent.cpp
@ -0,0 +1,114 @@
+/* vim: set shiftwidth=2 tabstop=8 autoindent cindent expandtab: */
+/* ***** BEGIN LICENSE BLOCK *****
+ * Version: MPL 1.1/GPL 2.0/LGPL 2.1
+ *
+ * The contents of this file are subject to the Mozilla Public License Version
+ * 1.1 (the "License"); you may not use this file except in compliance with
+ * the License. You may obtain a copy of the License at
+ * http://www.mozilla.org/MPL/
+ *
+ * Software distributed under the License is distributed on an "AS IS" basis,
+ * WITHOUT WARRANTY OF ANY KIND, either express or implied. See the License
+ * for the specific language governing rights and limitations under the
+ * License.
+ *
+ * The Original Code is nsDOMTransitionEvent.
+ *
+ * The Initial Developer of the Original Code is the Mozilla Foundation.
+ * Portions created by the Initial Developer are Copyright (C) 2009
+ * the Initial Developer. All Rights Reserved.
+ *
+ * Contributor(s):
+ *   L. David Baron <dbaron@dbaron.org>, Mozilla Corporation (original author)
+ *
+ * Alternatively, the contents of this file may be used under the terms of
+ * either the GNU General Public License Version 2 or later (the "GPL"), or
+ * the GNU Lesser General Public License Version 2.1 or later (the "LGPL"),
+ * in which case the provisions of the GPL or the LGPL are applicable instead
+ * of those above. If you wish to allow use of your version of this file only
+ * under the terms of either the GPL or the LGPL, and not to allow others to
+ * use your version of this file under the terms of the MPL, indicate your
+ * decision by deleting the provisions above and replace them with the notice
+ * and other provisions required by the GPL or the LGPL. If you do not delete
+ * the provisions above, a recipient may use your version of this file under
+ * the terms of any one of the MPL, the GPL or the LGPL.
+ *
+ * ***** END LICENSE BLOCK ***** */
+
+#include "nsDOMTransitionEvent.h"
+#include "nsGUIEvent.h"
+
+nsDOMTransitionEvent::nsDOMTransitionEvent(nsPresContext *aPresContext,
+                                           nsTransitionEvent *aEvent)
+  : nsDOMEvent(aPresContext, aEvent ? aEvent
+                                    : new nsTransitionEvent(PR_FALSE, 0,
+                                                            EmptyString(),
+                                                            0.0))
+{
+  if (aEvent) {
+    mEventIsInternal = PR_FALSE;
+  }
+  else {
+    mEventIsInternal = PR_TRUE;
+    mEvent->time = PR_Now();
+  }
+}
+
+nsDOMTransitionEvent::~nsDOMTransitionEvent()
+{
+  if (mEventIsInternal) {
+    delete TransitionEvent();
+    mEvent = nsnull;
+  }
+}
+
+NS_INTERFACE_MAP_BEGIN(nsDOMTransitionEvent)
+  NS_INTERFACE_MAP_ENTRY(nsIDOMTransitionEvent)
+  NS_INTERFACE_MAP_ENTRY_CONTENT_CLASSINFO(TransitionEvent)
+NS_INTERFACE_MAP_END_INHERITING(nsDOMEvent)
+
+NS_IMPL_ADDREF_INHERITED(nsDOMTransitionEvent, nsDOMEvent)
+NS_IMPL_RELEASE_INHERITED(nsDOMTransitionEvent, nsDOMEvent)
+
+NS_IMETHODIMP
+nsDOMTransitionEvent::GetPropertyName(nsAString & aPropertyName)
+{
+  aPropertyName = TransitionEvent()->propertyName;
+  return NS_OK;
+}
+
+NS_IMETHODIMP
+nsDOMTransitionEvent::GetElapsedTime(float *aElapsedTime)
+{
+  *aElapsedTime = TransitionEvent()->elapsedTime;
+  return NS_OK;
+}
+
+NS_IMETHODIMP
+nsDOMTransitionEvent::InitTransitionEvent(const nsAString & typeArg,
+                                          PRBool canBubbleArg,
+                                          PRBool cancelableArg,
+                                          const nsAString & propertyNameArg,
+                                          float elapsedTimeArg)
+{
+  nsresult rv = nsDOMEvent::InitEvent(typeArg, canBubbleArg, cancelableArg);
+  NS_ENSURE_SUCCESS(rv, rv);
+
+  TransitionEvent()->propertyName = propertyNameArg;
+  TransitionEvent()->elapsedTime = elapsedTimeArg;
+
+  return NS_OK;
+}
+
+nsresult
+NS_NewDOMTransitionEvent(nsIDOMEvent **aInstancePtrResult,
+                         nsPresContext *aPresContext,
+                         nsTransitionEvent *aEvent)
+{
+  nsDOMTransitionEvent *it = new nsDOMTransitionEvent(aPresContext, aEvent);
+  if (!it) {
+    return NS_ERROR_OUT_OF_MEMORY;
+  }
+
+  return CallQueryInterface(it, aInstancePtrResult);
+}
--- a/content/events/src/nsDOMTransitionEvent.h
+++ b/content/events/src/nsDOMTransitionEvent.h
@ -0,0 +1,66 @@
+/* vim: set shiftwidth=2 tabstop=8 autoindent cindent expandtab: */
+/* ***** BEGIN LICENSE BLOCK *****
+ * Version: MPL 1.1/GPL 2.0/LGPL 2.1
+ *
+ * The contents of this file are subject to the Mozilla Public License Version
+ * 1.1 (the "License"); you may not use this file except in compliance with
+ * the License. You may obtain a copy of the License at
+ * http://www.mozilla.org/MPL/
+ *
+ * Software distributed under the License is distributed on an "AS IS" basis,
+ * WITHOUT WARRANTY OF ANY KIND, either express or implied. See the License
+ * for the specific language governing rights and limitations under the
+ * License.
+ *
+ * The Original Code is nsDOMTransitionEvent.
+ *
+ * The Initial Developer of the Original Code is the Mozilla Foundation.
+ * Portions created by the Initial Developer are Copyright (C) 2009
+ * the Initial Developer. All Rights Reserved.
+ *
+ * Contributor(s):
+ *   L. David Baron <dbaron@dbaron.org>, Mozilla Corporation (original author)
+ *
+ * Alternatively, the contents of this file may be used under the terms of
+ * either the GNU General Public License Version 2 or later (the "GPL"), or
+ * the GNU Lesser General Public License Version 2.1 or later (the "LGPL"),
+ * in which case the provisions of the GPL or the LGPL are applicable instead
+ * of those above. If you wish to allow use of your version of this file only
+ * under the terms of either the GPL or the LGPL, and not to allow others to
+ * use your version of this file under the terms of the MPL, indicate your
+ * decision by deleting the provisions above and replace them with the notice
+ * and other provisions required by the GPL or the LGPL. If you do not delete
+ * the provisions above, a recipient may use your version of this file under
+ * the terms of any one of the MPL, the GPL or the LGPL.
+ *
+ * ***** END LICENSE BLOCK ***** */
+#ifndef nsDOMTransitionEvent_h_
+#define nsDOMTransitionEvent_h_
+
+#include "nsDOMEvent.h"
+#include "nsIDOMTransitionEvent.h"
+#include "nsString.h"
+
+class nsTransitionEvent;
+
+class nsDOMTransitionEvent : public nsDOMEvent,
+                             public nsIDOMTransitionEvent
+{
+public:
+  nsDOMTransitionEvent(nsPresContext *aPresContext,
+                       nsTransitionEvent *aEvent);
+  ~nsDOMTransitionEvent();
+
+  NS_DECL_ISUPPORTS_INHERITED
+  NS_FORWARD_TO_NSDOMEVENT
+  NS_DECL_NSIDOMTRANSITIONEVENT
+
+private:
+  nsTransitionEvent* TransitionEvent() {
+    NS_ABORT_IF_FALSE(mEvent->eventStructType == NS_TRANSITION_EVENT,
+                      "unexpected struct type");
+    return static_cast<nsTransitionEvent*>(mEvent);
+  }
+};
+
+#endif /* !defined(nsDOMTransitionEvent_h_) */
--- a/content/events/src/nsEventDispatcher.cpp
+++ b/content/events/src/nsEventDispatcher.cpp
@ -721,6 +721,9 @@ nsEventDispatcher::CreateEvent(nsPresContext* aPresContext,
    case NS_SIMPLE_GESTURE_EVENT:
      return NS_NewDOMSimpleGestureEvent(aDOMEvent, aPresContext,
                                         static_cast<nsSimpleGestureEvent*>(aEvent));
+    case NS_TRANSITION_EVENT:
+      return NS_NewDOMTransitionEvent(aDOMEvent, aPresContext,
+                                      static_cast<nsTransitionEvent*>(aEvent));
    }

    // For all other types of events, create a vanilla event object.
@ -789,6 +792,10 @@ nsEventDispatcher::CreateEvent(nsPresContext* aPresContext,
    return NS_NewDOMPageTransitionEvent(aDOMEvent, aPresContext, nsnull);
  if (aEventType.LowerCaseEqualsLiteral("scrollareaevent"))
    return NS_NewDOMScrollAreaEvent(aDOMEvent, aPresContext, nsnull);
+  // FIXME: Should get spec to say what the right string is here!  This
+  // is probably wrong!
+  if (aEventType.LowerCaseEqualsLiteral("transitionevent"))
+    return NS_NewDOMTransitionEvent(aDOMEvent, aPresContext, nsnull);

  return NS_ERROR_DOM_NOT_SUPPORTED_ERR;
 }
--- a/content/html/content/src/nsHTMLDNSPrefetch.cpp
+++ b/content/html/content/src/nsHTMLDNSPrefetch.cpp
@ -238,7 +238,7 @@ nsHTMLDNSPrefetch::nsDeferrals::Add(PRUint16 flags, nsGenericHTMLElement *aEleme
    return NS_ERROR_DNS_LOOKUP_QUEUE_FULL;
    
  mEntries[mHead].mFlags = flags;
-  mEntries[mHead].mElement = aElement;
+  mEntries[mHead].mElement = do_GetWeakReference(aElement);
  mHead = (mHead + 1) & sMaxDeferredMask;

  if (!mActiveLoaderCount && !mTimerArmed && mTimer) {
@ -257,10 +257,11 @@ nsHTMLDNSPrefetch::nsDeferrals::SubmitQueue()
  if (!sDNSService) return;

  while (mHead != mTail) {
-
-    if (mEntries[mTail].mElement->GetOwnerDoc()) {
+    nsCOMPtr<nsIContent> content = do_QueryReferent(mEntries[mTail].mElement);
+    if (content && content->GetOwnerDoc()) {
      nsCOMPtr<nsIURI> hrefURI;
-      hrefURI = mEntries[mTail].mElement->GetHrefURIForAnchors();
+      hrefURI =
+        nsGenericHTMLElement::FromContent(content)->GetHrefURIForAnchors();
      if (hrefURI)
        hrefURI->GetAsciiHost(hostName);
      
--- a/content/html/content/src/nsHTMLDNSPrefetch.h
+++ b/content/html/content/src/nsHTMLDNSPrefetch.h
@ -129,7 +129,7 @@ public:
    struct deferred_entry
    {
      PRUint16                         mFlags;
-      nsRefPtr<nsGenericHTMLElement>   mElement;
+      nsWeakPtr                        mElement;
    } mEntries[sMaxDeferred];
  };
 };
--- a/content/smil/nsSMILCSSProperty.cpp
+++ b/content/smil/nsSMILCSSProperty.cpp
@ -55,8 +55,12 @@ GetCSSComputedValue(nsIContent* aElem,
                 PR_FALSE);

  nsIDocument* doc = aElem->GetCurrentDoc();
-  NS_ABORT_IF_FALSE(doc,"any target element that's actively being animated "
-                    "must be in a document");
+  if (!doc) {
+    // This can happen if we process certain types of restyles mid-sample
+    // and remove anonymous animated content from the document as a result.
+    // See bug 534975.
+    return PR_FALSE;
+  }

  nsPIDOMWindow* win = doc->GetWindow();
  NS_ABORT_IF_FALSE(win, "actively animated document w/ no window");
--- a/content/smil/nsSMILCSSValueType.cpp
+++ b/content/smil/nsSMILCSSValueType.cpp
@ -293,8 +293,12 @@ static nsPresContext*
 GetPresContextForElement(nsIContent* aElem)
 {
  nsIDocument* doc = aElem->GetCurrentDoc();
-  NS_ABORT_IF_FALSE(doc, "active animations should only be able to "
-                    "target elements that are in a document");
+  if (!doc) {
+    // This can happen if we process certain types of restyles mid-sample
+    // and remove anonymous animated content from the document as a result.
+    // See bug 534975.
+    return nsnull;
+  }
  nsIPresShell* shell = doc->GetPrimaryShell();
  return shell ? shell->GetPresContext() : nsnull;
 }
--- a/docshell/base/nsDocShell.cpp
+++ b/docshell/base/nsDocShell.cpp
@ -6709,8 +6709,14 @@ nsDocShell::RestoreFromHistory()
        viewer->SetPreviousViewer(mContentViewer);
    }

+    // Order the mContentViewer setup just like Embed does.
+    mContentViewer = nsnull;
+
+    // Now that we're about to switch documents, forget all of our children.
+    // Note that we cached them as needed up in CaptureState above.
+    DestroyChildren();
+
    mContentViewer.swap(viewer);
-    viewer = nsnull; // force a release to complete ownership transfer

    // Grab all of the related presentation from the SHEntry now.
    // Clearing the viewer from the SHEntry will clear all of this state.
@ -6764,8 +6770,6 @@ nsDocShell::RestoreFromHistory()
    // to avoid teardown of the presentation.
    mContentViewer->SetSticky(sticky);

-    // Now that we have switched documents, forget all of our children.
-    DestroyChildren();
    NS_ENSURE_SUCCESS(rv, rv);

    // mLSHE is now our currently-loaded document.
@ -7311,6 +7315,10 @@ nsDocShell::SetupNewViewer(nsIContentViewer * aNewViewer)
        mContentViewer = nsnull;
    }

+    // Now that we're about to switch documents, forget all of our children.
+    // Note that we cached them as needed up in CaptureState above.
+    DestroyChildren();
+
    mContentViewer = aNewViewer;

    nsCOMPtr<nsIWidget> widget;
@ -7367,9 +7375,6 @@ nsDocShell::SetupNewViewer(nsIContentViewer * aNewViewer)
    // until we have enough of the new page to show.  Just return with the new
    // viewer still set to hidden.

-    // Now that we have switched documents, forget all of our children
-    DestroyChildren();
-
    return NS_OK;
 }

--- a/dom/base/nsDOMClassInfo.cpp
+++ b/dom/base/nsDOMClassInfo.cpp
@ -234,6 +234,7 @@
 #include "nsPaintRequest.h"
 #include "nsIDOMNotifyPaintEvent.h"
 #include "nsIDOMScrollAreaEvent.h"
+#include "nsIDOMTransitionEvent.h"
 #include "nsIDOMNSDocumentStyle.h"
 #include "nsIDOMDocumentRange.h"
 #include "nsIDOMDocumentTraversal.h"
@ -1366,6 +1367,8 @@ static nsDOMClassInfoData sClassInfoData[] = {
                           DOM_DEFAULT_SCRIPTABLE_FLAGS)
  NS_DEFINE_CLASSINFO_DATA(EventListenerInfo, nsDOMGenericSH,
                           DOM_DEFAULT_SCRIPTABLE_FLAGS)
+  NS_DEFINE_CLASSINFO_DATA(TransitionEvent, nsDOMGenericSH,
+                           DOM_DEFAULT_SCRIPTABLE_FLAGS)
 };

 // Objects that shuld be constructable through |new Name();|
@ -3787,6 +3790,11 @@ nsDOMClassInfo::Init()
    DOM_CLASSINFO_MAP_ENTRY(nsIEventListenerInfo)
  DOM_CLASSINFO_MAP_END

+  DOM_CLASSINFO_MAP_BEGIN(TransitionEvent, nsIDOMTransitionEvent)
+    DOM_CLASSINFO_MAP_ENTRY(nsIDOMTransitionEvent)
+    DOM_CLASSINFO_EVENT_MAP_ENTRIES
+  DOM_CLASSINFO_MAP_END
+
 #ifdef NS_DEBUG
  {
    PRUint32 i = NS_ARRAY_LENGTH(sClassInfoData);
@ -7415,8 +7423,6 @@ nsEventReceiverSH::AddEventListenerHelper(JSContext *cx, JSObject *obj,
    return JS_FALSE;
  }

-  OBJ_TO_INNER_OBJECT(cx, obj);
-
  nsresult rv = sXPConnect->GetJSObjectOfWrapper(cx, obj, &obj);
  if (NS_FAILED(rv)) {
    nsDOMClassInfo::ThrowJSException(cx, rv);
@ -7424,6 +7430,11 @@ nsEventReceiverSH::AddEventListenerHelper(JSContext *cx, JSObject *obj,
    return JS_FALSE;
  }

+  OBJ_TO_INNER_OBJECT(cx, obj);
+  if (!obj) {
+    return JS_FALSE;
+  }
+
  // Check that the caller has permission to call obj's addEventListener.
  if (NS_FAILED(sSecMan->CheckPropertyAccess(cx, obj,
                                             JS_GET_CLASS(cx, obj)->name,
--- a/dom/base/nsDOMClassInfoID.h
+++ b/dom/base/nsDOMClassInfoID.h
@ -489,6 +489,8 @@ enum nsDOMClassInfoID {

  eDOMClassInfo_EventListenerInfo_id,

+  eDOMClassInfo_TransitionEvent_id,
+
  // This one better be the last one in this list
  eDOMClassInfoIDCount
 };
--- a/dom/base/nsDOMWindowUtils.cpp
+++ b/dom/base/nsDOMWindowUtils.cpp
@ -866,11 +866,7 @@ nsDOMWindowUtils::GetCOWForObject()
      || !hasCap)
    return NS_ERROR_DOM_SECURITY_ERR;

-  nsresult rv = NS_OK;
-  nsCOMPtr<nsIXPConnect> xpc = do_GetService("@mozilla.org/js/xpc/XPConnect;1",
-                                             &rv);
-  if (NS_FAILED(rv))
-    return NS_ERROR_FAILURE;
+  nsCOMPtr<nsIXPConnect> xpc = nsContentUtils::XPConnect();

  // get the xpconnect native call context
  nsAXPCNativeCallContext *cc = nsnull;
@ -880,7 +876,7 @@ nsDOMWindowUtils::GetCOWForObject()

  // Get JSContext of current call
  JSContext* cx;
-  rv = cc->GetJSContext(&cx);
+  nsresult rv = cc->GetJSContext(&cx);
  if(NS_FAILED(rv) || !cx)
    return NS_ERROR_FAILURE;

@ -949,3 +945,44 @@ nsDOMWindowUtils::DispatchDOMEventViaPresShell(nsIDOMNode* aTarget,
  *aRetVal = (status != nsEventStatus_eConsumeNoDefault);
  return NS_OK;
 }
+
+NS_IMETHODIMP
+nsDOMWindowUtils::GetClassName(char **aName)
+{
+  if (!nsContentUtils::IsCallerTrustedForRead()) {
+    return NS_ERROR_DOM_SECURITY_ERR;
+  }
+
+  // get the xpconnect native call context
+  nsAXPCNativeCallContext *cc = nsnull;
+  nsContentUtils::XPConnect()->GetCurrentNativeCallContext(&cc);
+  if(!cc)
+    return NS_ERROR_FAILURE;
+
+  // Get JSContext of current call
+  JSContext* cx;
+  nsresult rv = cc->GetJSContext(&cx);
+  if(NS_FAILED(rv) || !cx)
+    return NS_ERROR_FAILURE;
+
+  // get argc and argv and verify arg count
+  PRUint32 argc;
+  rv = cc->GetArgc(&argc);
+  if(NS_FAILED(rv))
+    return NS_ERROR_FAILURE;
+
+  if(argc < 1)
+    return NS_ERROR_XPC_NOT_ENOUGH_ARGS;
+
+  jsval* argv;
+  rv = cc->GetArgvPtr(&argv);
+  if(NS_FAILED(rv) || !argv)
+    return NS_ERROR_FAILURE;
+
+  // Our argument must be a non-null object.
+  if(JSVAL_IS_PRIMITIVE(argv[0]))
+    return NS_ERROR_XPC_BAD_CONVERT_JS;
+
+  *aName = NS_strdup(JS_GET_CLASS(cx, JSVAL_TO_OBJECT(argv[0]))->name);
+  return *aName ? NS_OK : NS_ERROR_OUT_OF_MEMORY;
+}
--- a/dom/base/nsJSEnvironment.cpp
+++ b/dom/base/nsJSEnvironment.cpp
@ -1264,6 +1264,9 @@ nsJSContext::LeaveModalState()

 static const char js_options_dot_str[]   = JS_OPTIONS_DOT_STR;
 static const char js_strict_option_str[] = JS_OPTIONS_DOT_STR "strict";
+#ifdef DEBUG
+static const char js_strict_debug_option_str[] = JS_OPTIONS_DOT_STR "strict.debug";
+#endif
 static const char js_werror_option_str[] = JS_OPTIONS_DOT_STR "werror";
 static const char js_relimit_option_str[]= JS_OPTIONS_DOT_STR "relimit";
 #ifdef JS_GC_ZEAL
@ -1307,10 +1310,11 @@ nsJSContext::JSOptionChangedCallback(const char *pref, void *data)
    newDefaultJSOptions &= ~JSOPTION_JIT;

 #ifdef DEBUG
-  // In debug builds, warnings are always enabled in chrome context
+  // In debug builds, warnings are enabled in chrome context if javascript.options.strict.debug is true
+  PRBool strictDebug = nsContentUtils::GetBoolPref(js_strict_debug_option_str);
  // Note this callback is also called from context's InitClasses thus we don't
  // need to enable this directly from InitContext
-  if ((newDefaultJSOptions & JSOPTION_STRICT) == 0) {
+  if (strictDebug && (newDefaultJSOptions & JSOPTION_STRICT) == 0) {
    if (chromeWindow)
      newDefaultJSOptions |= JSOPTION_STRICT;
  }
--- a/dom/interfaces/base/Makefile.in
+++ b/dom/interfaces/base/Makefile.in
@ -57,6 +57,7 @@ SDK_XPIDLSRCS =                                 \

 XPIDLSRCS =					\
 	nsIBrowserDOMWindow.idl			\
+	nsIContentPrefService.idl		\
 	nsIDOMClientInformation.idl		\
 	nsIDOMConstructor.idl			\
 	nsIDOMCRMFObject.idl			\
--- a/toolkit/components/contentprefs/public/nsIContentPrefService.idl
+++ b/toolkit/components/contentprefs/public/nsIContentPrefService.idl
@ -200,3 +200,8 @@ interface nsIContentPrefService : nsISupports
   */
  readonly attribute mozIStorageConnection DBConnection;
 };
+
+%{C++
+// The contractID for the generic implementation built in to xpcom.
+#define NS_CONTENT_PREF_SERVICE_CONTRACTID "@mozilla.org/content-pref/service;1"
+%}
--- a/dom/interfaces/base/nsIDOMWindowUtils.idl
+++ b/dom/interfaces/base/nsIDOMWindowUtils.idl
@ -50,7 +50,7 @@ interface nsIDOMElement;
 interface nsIDOMHTMLCanvasElement;
 interface nsIDOMEvent;

-[scriptable, uuid(4775e623-d596-4364-8637-0968a5ce5e3d)]
+[scriptable, uuid(0e13d9a6-bcd1-4d61-9986-c32f78f99d1a)]
 interface nsIDOMWindowUtils : nsISupports {

  /**
@ -421,4 +421,10 @@ interface nsIDOMWindowUtils : nsISupports {
  boolean dispatchDOMEventViaPresShell(in nsIDOMNode aTarget,
                                       in nsIDOMEvent aEvent,
                                       in boolean aTrusted);
+
+  /**
+   * Returns the real classname (possibly of the mostly-transparent security
+   * wrapper) of aObj.
+   */
+  string getClassName(/*in JSObjectPtr aObj*/);
 };
--- a/dom/interfaces/events/Makefile.in
+++ b/dom/interfaces/events/Makefile.in
@ -82,6 +82,7 @@ XPIDLSRCS =					\
 	nsIDOMNSMouseEvent.idl			\
 	nsIDOMOrientationEvent.idl              \
 	nsIDOMScrollAreaEvent.idl		\
+	nsIDOMTransitionEvent.idl		\
 	$(NULL)

 include $(topsrcdir)/config/rules.mk
--- a/dom/interfaces/events/nsIDOMTransitionEvent.idl
+++ b/dom/interfaces/events/nsIDOMTransitionEvent.idl
@ -0,0 +1,55 @@
+/* vim: set shiftwidth=2 tabstop=8 autoindent cindent expandtab: */
+/* ***** BEGIN LICENSE BLOCK *****
+ * Version: MPL 1.1/GPL 2.0/LGPL 2.1
+ *
+ * The contents of this file are subject to the Mozilla Public License Version
+ * 1.1 (the "License"); you may not use this file except in compliance with
+ * the License. You may obtain a copy of the License at
+ * http://www.mozilla.org/MPL/
+ *
+ * Software distributed under the License is distributed on an "AS IS" basis,
+ * WITHOUT WARRANTY OF ANY KIND, either express or implied. See the License
+ * for the specific language governing rights and limitations under the
+ * License.
+ *
+ * The Original Code is nsIDOMTransitionEvent.
+ *
+ * The Initial Developer of the Original Code is the Mozilla Foundation.
+ * Portions created by the Initial Developer are Copyright (C) 2009
+ * the Initial Developer. All Rights Reserved.
+ *
+ * Contributor(s):
+ *   L. David Baron <dbaron@dbaron.org>, Mozilla Corporation (original author)
+ *
+ * Alternatively, the contents of this file may be used under the terms of
+ * either the GNU General Public License Version 2 or later (the "GPL"), or
+ * the GNU Lesser General Public License Version 2.1 or later (the "LGPL"),
+ * in which case the provisions of the GPL or the LGPL are applicable instead
+ * of those above. If you wish to allow use of your version of this file only
+ * under the terms of either the GPL or the LGPL, and not to allow others to
+ * use your version of this file under the terms of the MPL, indicate your
+ * decision by deleting the provisions above and replace them with the notice
+ * and other provisions required by the GPL or the LGPL. If you do not delete
+ * the provisions above, a recipient may use your version of this file under
+ * the terms of any one of the MPL, the GPL or the LGPL.
+ *
+ * ***** END LICENSE BLOCK ***** */
+
+#include "nsIDOMEvent.idl"
+
+/**
+ * Transition events are defined in:
+ * http://www.w3.org/TR/css3-transitions/#transition-events-
+ * http://dev.w3.org/csswg/css3-transitions/#transition-events-
+ */
+
+[scriptable, uuid(3e49ea4c-6f23-4aff-bd8f-e587edf514ec)]
+interface nsIDOMTransitionEvent : nsIDOMEvent {
+  readonly attribute DOMString           propertyName;
+  readonly attribute float               elapsedTime;
+  void               initTransitionEvent(in DOMString typeArg, 
+                                         in boolean canBubbleArg, 
+                                         in boolean cancelableArg, 
+                                         in DOMString propertyNameArg,
+                                         in float elapsedTimeArg);
+};
--- a/dom/interfaces/xul/nsIDOMXULButtonElement.idl
+++ b/dom/interfaces/xul/nsIDOMXULButtonElement.idl
@ -38,7 +38,7 @@

 #include "nsIDOMXULLabeledControlEl.idl"

-[scriptable, uuid(6852d9a6-1dd2-11b2-a29d-cd7977a91b1b)]
+[scriptable, uuid(761e4742-e1c2-4d0d-91fe-cc11c4e6b1ad)]
 interface nsIDOMXULButtonElement : nsIDOMXULLabeledControlElement {
  const short CHECKSTATE_UNCHECKED = 0;
  const short CHECKSTATE_CHECKED = 1;
--- a/dom/interfaces/xul/nsIDOMXULCheckboxElement.idl
+++ b/dom/interfaces/xul/nsIDOMXULCheckboxElement.idl
@ -40,7 +40,7 @@
 #include "nsIDOMElement.idl"
 #include "nsIDOMXULLabeledControlEl.idl"

-[scriptable, uuid(5afaba88-1dd2-11b2-9249-dd65a129d0e4)]
+[scriptable, uuid(6713cd76-65ef-4883-bb58-31b2e400bb78)]
 interface nsIDOMXULCheckboxElement : nsIDOMXULLabeledControlElement {
  const short CHECKSTATE_UNCHECKED = 0;
  const short CHECKSTATE_CHECKED = 1;
--- a/dom/interfaces/xul/nsIDOMXULControlElement.idl
+++ b/dom/interfaces/xul/nsIDOMXULControlElement.idl
@ -42,7 +42,7 @@

 interface nsIControllers;

-[scriptable, uuid(007b8358-1dd2-11b2-8924-d209efc3f124)]
+[scriptable, uuid(eb90ef16-4d66-4fbe-941d-814a183a0e88)]
 interface nsIDOMXULControlElement : nsIDOMXULElement {
  attribute boolean disabled;
  attribute long tabIndex;
--- a/dom/interfaces/xul/nsIDOMXULDescriptionElement.idl
+++ b/dom/interfaces/xul/nsIDOMXULDescriptionElement.idl
@ -40,7 +40,7 @@

 #include "nsIDOMXULElement.idl"

-[scriptable, uuid(c7b0b43c-1dd1-11b2-9e1c-ce5f6a660630)]
+[scriptable, uuid(de87d3ef-8780-40e9-8af1-593bc7a24d77)]
 interface nsIDOMXULDescriptionElement : nsIDOMXULElement {
  attribute boolean disabled;
  attribute boolean crop;
--- a/dom/interfaces/xul/nsIDOMXULImageElement.idl
+++ b/dom/interfaces/xul/nsIDOMXULImageElement.idl
@ -37,7 +37,7 @@
 #include "nsIDOMElement.idl"
 #include "nsIDOMXULElement.idl"

-[scriptable, uuid(f73f4d77-a6fb-4ab5-b41e-15045a0cc6ff)]
+[scriptable, uuid(02faa23e-71f3-436a-8a13-9dc709af9997)]
 interface nsIDOMXULImageElement : nsIDOMXULElement {
  attribute DOMString src;
 };
--- a/dom/interfaces/xul/nsIDOMXULLabelElement.idl
+++ b/dom/interfaces/xul/nsIDOMXULLabelElement.idl
@ -39,7 +39,7 @@

 #include "nsIDOMXULDescriptionElement.idl"

-[scriptable, uuid(c987629e-6370-45f5-86ec-aa765fa861cd)]
+[scriptable, uuid(db431786-d23a-4ee2-a8b4-f952c6f2fa6e)]
 interface nsIDOMXULLabelElement : nsIDOMXULDescriptionElement {
  attribute DOMString accessKey;
  attribute DOMString control;
--- a/dom/interfaces/xul/nsIDOMXULLabeledControlEl.idl
+++ b/dom/interfaces/xul/nsIDOMXULLabeledControlEl.idl
@ -40,7 +40,7 @@
 #include "nsIDOMElement.idl"
 #include "nsIDOMXULControlElement.idl"

-[scriptable, uuid(a457ea70-1dd1-11b2-9089-8fd894122084)]
+[scriptable, uuid(bbdbd28d-dc31-4933-be99-de33569ed7d9)]
 interface nsIDOMXULLabeledControlElement : nsIDOMXULControlElement {
  attribute DOMString crop;
  attribute DOMString image;
--- a/dom/interfaces/xul/nsIDOMXULMenuListElement.idl
+++ b/dom/interfaces/xul/nsIDOMXULMenuListElement.idl
@ -40,7 +40,7 @@
 #include "nsIDOMXULSelectCntrlEl.idl"
 interface nsIDOMXULTextBoxElement;

-[scriptable, uuid(3D49950E-04F9-4e35-A9A0-FFD51356A674)]
+[scriptable, uuid(8be387a6-ac10-4cd9-acac-bd61c78e7513)]
 interface nsIDOMXULMenuListElement : nsIDOMXULSelectControlElement {
  attribute boolean editable;
  attribute boolean open;
--- a/dom/interfaces/xul/nsIDOMXULMultSelectCntrlEl.idl
+++ b/dom/interfaces/xul/nsIDOMXULMultSelectCntrlEl.idl
@ -39,7 +39,7 @@

 #include "nsIDOMXULSelectCntrlEl.idl"

-[scriptable, uuid(82c72eca-9886-473e-94cd-9de5694b3f88)]
+[scriptable, uuid(a197ad4e-127d-477a-a069-400b3b32fee9)]
 interface nsIDOMXULMultiSelectControlElement : nsIDOMXULSelectControlElement
 {
  attribute DOMString selType;
--- a/dom/interfaces/xul/nsIDOMXULPopupElement.idl
+++ b/dom/interfaces/xul/nsIDOMXULPopupElement.idl
@ -39,7 +39,7 @@
 #include "nsIDOMElement.idl"
 #include "nsIDOMXULElement.idl"

-[scriptable, uuid(c32390a8-2bd8-4d1b-bf9f-1b1d0a944d19)]
+[scriptable, uuid(d647cb9a-aa67-4549-9219-b0345fcefe67)]
 interface nsIDOMXULPopupElement : nsIDOMXULElement {
  const unsigned short      BEFORE_START                   = 1;
  const unsigned short      BEFORE_END                     = 2;
--- a/dom/interfaces/xul/nsIDOMXULSelectCntrlItemEl.idl
+++ b/dom/interfaces/xul/nsIDOMXULSelectCntrlItemEl.idl
@ -39,7 +39,7 @@
 #include "nsIDOMXULElement.idl"
 interface nsIDOMXULSelectControlElement;

-[scriptable, uuid(6AAAA30D-54AB-434a-8AE8-6D29A566D870)]
+[scriptable, uuid(79585939-115c-4727-9743-a42baf7173b0)]
 interface nsIDOMXULSelectControlItemElement : nsIDOMXULElement {
  attribute boolean disabled;
  attribute DOMString crop;
--- a/dom/interfaces/xul/nsIDOMXULTextboxElement.idl
+++ b/dom/interfaces/xul/nsIDOMXULTextboxElement.idl
@ -39,7 +39,7 @@
 #include "nsIDOMXULLabeledControlEl.idl"
 interface nsIDOMHTMLInputElement;

-[scriptable, uuid(71135B6C-294E-4634-A8E4-A72398F1E72A)]
+[scriptable, uuid(806a706e-2bae-4aec-a53e-5432eb4a7025)]
 interface nsIDOMXULTextBoxElement : nsIDOMXULControlElement
 {
  // inputField may be any type of editable field, such as an
--- a/dom/interfaces/xul/nsIDOMXULTreeElement.idl
+++ b/dom/interfaces/xul/nsIDOMXULTreeElement.idl
@ -45,7 +45,7 @@ interface nsIDOMXULTextBoxElement;
 * @status UNDER_DEVELOPMENT
 */

-[scriptable, uuid(1f8111b2-d44d-4d11-845a-a70ae06b7d04)]
+[scriptable, uuid(2f7d124f-eb51-4baa-baba-eeed051b4da0)]
 interface nsIDOMXULTreeElement : nsIDOMXULElement
 {

--- a/extensions/spellcheck/locales/en-US/hunspell/en-US.dic
+++ b/extensions/spellcheck/locales/en-US/hunspell/en-US.dic
@ -1427,6 +1427,7 @@ Baptist/SM
 Baptiste/M
 Bar/H
 Barabbas
+Barack/M
 Barb/MR
 Barbabas/M
 Barbabra/M
@ -1836,6 +1837,7 @@ Bic/M
 Biddie/M
 Biddle
 Biddy/M
+Biden/MS
 Bidget/M
 Bierce
 Bigfoot/M
@ -11167,6 +11169,7 @@ Oaxaca/M
 Ob/MD
 Obadiah
 Obadias/M
+Obama/MS
 Obed/M
 Obediah/M
 Oberlin/M
@ -11509,6 +11512,7 @@ Palestinian/SM
 Palestrina
 Paley
 Palikir/M
+Palin/MS
 Palisades/M
 Pall/M
 Palladio
@ -45011,6 +45015,7 @@ receive/DRSZGB
 received/U
 receiver/M
 receivership/M
+recency
 recension
 recent/YTP
 recentness/M
--- a/extensions/spellcheck/locales/en-US/hunspell/mozilla_words.diff
+++ b/extensions/spellcheck/locales/en-US/hunspell/mozilla_words.diff
@ -1,6 +1,95 @@
--- en-US.dic	Sun Feb 17 08:05:55 2008
-+++ en-US.dic	Sat Jan 19 13:49:14 2008
-@@ -6422,9 +6422,9 @@ Haney/M
+--- en-US.aff	Sat Nov 24 21:50:56 2007
+++ en-US.aff	Sat Nov 29 11:02:17 2008
+@@ -109,15 +109,19 @@ SFX B   e     able       [^aeiou]e
+ 
+ SFX L Y 1
+ SFX L   0     ment       .
+ 
+-REP 88
+SFX i N 1
+SFX i   us    i          us
+
+REP 90
+ REP a ei
+ REP ei a
+ REP a ey
+ REP ey a
+ REP ai ie
+ REP ie ai
+REP alot a_lot
+ REP are air
+ REP are ear
+ REP are eir
+ REP air are
+@@ -198,4 +202,5 @@ REP z ss
+ REP ss z
+ REP shun tion
+ REP shun sion
+ REP shun cion
+REP sitted sat
+--- en-US.dic	Sat Nov 24 21:50:56 2007
+++ en-US.dic	Sat Nov 29 11:03:25 2008
+@@ -1426,8 +1426,9 @@ Baotou/M
+ Baptist/SM
+ Baptiste/M
+ Bar/H
+ Barabbas
+Barack/M
+ Barb/MR
+ Barbabas/M
+ Barbabra/M
+ Barbadian/SM
+@@ -1835,8 +1836,9 @@ Bible/MS
+ Bic/M
+ Biddie/M
+ Biddle
+ Biddy/M
+Biden/MS
+ Bidget/M
+ Bierce
+ Bigfoot/M
+ Biggles/M
+@@ -2300,8 +2302,9 @@ Budweiser/M
+ Buffalo/M
+ Buffy/M
+ Buford/M
+ Bugatti/M
+Bugzilla/M
+ Buick/M
+ Buiron/M
+ Bujumbura/M
+ Bukhara
+@@ -2503,8 +2506,9 @@ Cami/M
+ Camila/M
+ Camile/M
+ Camilla/M
+ Camille/M
+Camino/M
+ Cammi/M
+ Cammie/M
+ Cammy/M
+ Camoens/M
+@@ -2942,8 +2946,9 @@ Chateaubriand/M
+ Chattahoochee/M
+ Chattanooga/M
+ Chatterley/M
+ Chatterton
+ChatZilla/M
+ Chaucer/M
+ Chaunce/M
+ Chauncey/M
+ Chautauqua
+@@ -6325,8 +6330,9 @@ HS
+ HST
+ HT
+ HTML/M
+ HTTP
+HTTPS
+ HUD/M
+ Ha
+ Haas/M
+ Habakkuk
+@@ -6418,9 +6424,9 @@ Haney/M
 Hangul/M
 Hangzhou/M
 Hank/M
@ -11,7 +100,17 @@
 Hannibal/M
 Hannie/M
 Hanny/M
-@@ -7363,9 +7363,9 @@ Jamaican/SM
+@@ -6945,8 +6951,9 @@ Hun/SM
+ Hunfredo/M
+ Hung
+ Hungarian/SM
+ Hungary/M
+Hunspell/M
+ Hunt/R
+ Hunter/M
+ Huntington/M
+ Huntlee/M
+@@ -7358,9 +7365,9 @@ Jamaican/SM
 Jamal/M
 Jamar/M
 Jame/SM
@ -22,7 +121,7 @@
 Jamestown
 Jamesy/M
 Jamey/M
-@@ -7382,9 +7382,9 @@ Jana/M
+@@ -7377,9 +7384,9 @@ Jana/M
 Janacek/M
 Janaya/M
 Janaye/M
@ -33,7 +132,7 @@
 Janeczka/M
 Janeen/M
 Janek/M
-@@ -7395,9 +7395,9 @@ Janella/M
+@@ -7390,9 +7397,9 @@ Janella/M
 Janelle/M
 Janene/M
 Janenna/M
@ -44,7 +143,67 @@
 Janetta/M
 Janette/M
 Janeva/M
-@@ -14433,9 +14433,9 @@ Thieu/M
+@@ -9504,8 +9511,9 @@ Mandela
+ Mandelbrot
+ Mandi/M
+ Mandie/M
+ Mandingo
+Mandriva/M
+ Mandy/M
+ Manet
+ Manfred/M
+ Manhattan/SM
+@@ -10619,8 +10627,9 @@ Myrtie/M
+ Myrtle/M
+ Myrvyn/M
+ Myrwyn/M
+ Mysore
+MySpell/M
+ Myst/M
+ N'Djamena
+ N/MD
+ NAACP
+@@ -11159,8 +11168,9 @@ Oates
+ Oaxaca/M
+ Ob/MD
+ Obadiah
+ Obadias/M
+Obama/MS
+ Obed/M
+ Obediah/M
+ Oberlin/M
+ Oberon
+@@ -11501,8 +11511,9 @@ Palestine/M
+ Palestinian/SM
+ Palestrina
+ Paley
+ Palikir/M
+Palin/MS
+ Palisades/M
+ Pall/M
+ Palladio
+ Palm/MR
+@@ -13240,8 +13251,9 @@ Scythia
+ Scythian
+ Se/MH
+ Seaborg
+ Seagram/M
+SeaMonkey/M
+ Seamus/M
+ Sean/M
+ Seana/M
+ Sears/M
+@@ -13979,8 +13991,9 @@ Sumner/M
+ Sumter
+ Sun/SM
+ Sunbeam/M
+ Sunbelt/M
+Sunbird/M
+ Sundanese/M
+ Sundas
+ Sunday/MS
+ Sung
+@@ -14424,9 +14437,9 @@ Thieu/M
 Thimbu
 Thimphu
 Thom/M
@ -55,7 +214,7 @@
 Thomasin/M
 Thomasina/M
 Thomasine/M
-@@ -14904,9 +14904,8 @@ Unitarian/MS
+@@ -14895,9 +14908,8 @@ Unitarian/MS
 Unitarianism/MS
 Unitas/M
 Unix/S
@ -65,7 +224,7 @@
 Updike
 Upjohn/M
 Upton/M
-@@ -15446,8 +15445,9 @@ Wiemar/M
+@@ -15437,8 +15449,9 @@ Wiemar/M
 Wiesel/M
 Wiesenthal/M
 Wiggins
@ -75,7 +234,7 @@
 Wilbert/M
 Wilbur/M
 Wilburn/M
-@@ -17637,8 +17637,9 @@ arcana
+@@ -17628,8 +17641,9 @@ arcana
 arcane/PY
 arch/PZTGVMDRSY
 archaeological/Y
@ -85,7 +244,7 @@
 archaically
 archaism/MS
 archaist/MS
-@@ -17651,8 +17652,10 @@ archdiocesan
+@@ -17642,8 +17656,10 @@ archdiocesan
 archdiocese/SM
 archduchess/MS
 archduke/MS
@ -96,7 +255,7 @@
 archeopteryx
 archer/M
 archery/M
-@@ -18318,8 +18321,9 @@ awning/M
+@@ -18309,8 +18325,9 @@ awning/M
 awoke
 awoken
 awry
@ -106,7 +265,7 @@
 axeman
 axial/Y
 axillary
-@@ -20709,10 +20713,9 @@ cachet/MS
+@@ -20700,10 +20717,9 @@ cachet/MS
 cackle/MZGDRS
 cackler/M
 cacophonous
@ -118,7 +277,7 @@
 cadaver/SM
 cadaverous
 caddish/YP
-@@ -25536,9 +25539,10 @@ dialectic/SM
+@@ -25527,9 +25543,10 @@ dialectic/SM
 dialectical/Y
 dialectics/M
 dialer
@ -130,7 +289,7 @@
 dialyzes
 diam
 diamante
-@@ -27393,8 +27397,9 @@ encumber/EGSD
+@@ -27384,8 +27401,9 @@ encumber/EGSD
 encumbered/U
 encumbrance/SM
 ency
@ -140,7 +299,7 @@
 encyclopedic
 encyst/LSGD
 encystment/M
-@@ -29502,11 +29507,10 @@ foamy/RTP
+@@ -29493,11 +29511,10 @@ foamy/RTP
 fob/SM
 fobbed
 fobbing
@ -154,7 +313,7 @@
 foe/SM
 foetid
 fog's
-@@ -36332,9 +36336,8 @@ locatable/A
+@@ -36323,9 +36340,8 @@ locatable/A
 locate/EAGNVDS
 location's/A
 location/ESM
@ -164,7 +323,7 @@
 locked/A
 locker/M
 locket/MS
-@@ -36348,9 +36351,9 @@ loco/S
+@@ -36339,9 +36355,9 @@ loco/S
 locomotion/M
 locomotive/MS
 locoweed/SM
@ -175,7 +334,7 @@
 locution/MS
 lode/MS
 lodestar/MS
-@@ -37414,8 +37417,9 @@ megalomania/M
+@@ -37405,8 +37421,9 @@ megalomania/M
 megalomaniac/SM
 megalopolis/MS
 megaparsec
@ -185,7 +344,7 @@
 megaton/SM
 megawatt/MS
 meiosis/M
-@@ -40149,9 +40153,9 @@ octant
+@@ -40140,9 +40157,9 @@ octant
 octave/MS
 octavo/MS
 octet/SM
@ -196,7 +355,18 @@
 oculist/SM
 odalisque/SM
 odd/STRYLP
-@@ -43411,10 +43415,11 @@ predominant/Y
+@@ -42230,8 +42247,10 @@ philosophical/Y
+ philosophize/ZGDRS
+ philosophizer/M
+ philosophy/SM
+ philter/MS
+phish/DGS
+phisher/MS
+ phlebitis/M
+ phlebotomy
+ phlegm/M
+ phlegmatic
+@@ -43400,10 +43419,11 @@ predominant/Y
 predominate/DSYG
 preemie/SM
 preeminence/M
@ -209,7 +379,61 @@
 preexist/DGS
 preexistence/M
 pref
-@@ -55327,8 +55332,9 @@ wiglet/SM
+@@ -44994,8 +45014,9 @@ receivables/M
+ receive/DRSZGB
+ received/U
+ receiver/M
+ receivership/M
+recency
+ recension
+ recent/YTP
+ recentness/M
+ receptacle/MS
+@@ -49102,8 +49123,9 @@ spaghetti/M
+ spake
+ spam/S
+ spamblock/S
+ spammed
+spammer/MS
+ spamming
+ span/MS
+ spandex/M
+ spandrels
+@@ -53649,8 +53671,10 @@ unilateralist
+ unimportance
+ unimportant
+ unimpressive
+ uninhibited/Y
+uninstall/GSBD
+uninstaller/MS
+ uninsured
+ unintellectual
+ unintelligent
+ unintended
+@@ -53811,8 +53835,10 @@ unstamped
+ unsteady/PTR
+ unstinting/Y
+ unstoppably
+ unstrapping
+unsubscribe/DGS
+unsubscriber/MS
+ unsubstantial
+ unsubtle
+ unsure/P
+ unsuspecting/Y
+@@ -54984,9 +55010,10 @@ web/SM
+ webbed
+ webbing/M
+ webfeet
+ webfoot/M
+-webmaster/S
+webmaster/MS
+webmistress/S
+ website/SM
+ wed/AS
+ wedded/A
+ wedder
+@@ -55310,8 +55337,9 @@ wiglet/SM
 wigwag/SM
 wigwagged
 wigwagging
@ -219,25 +443,3 @@
 wildcat/MS
 wildcatted
 wildcatter/MS
--- en-US.aff	Sun Feb 17 08:06:10 2008
-+++ en-US.aff	Tue Jan 22 20:32:39 2008
-@@ -109,9 +109,12 @@ SFX B   e     able       [^aeiou]e
- 
- SFX L Y 1
- SFX L   0     ment       .
- 
-REP 89
-+SFX i N 1
-+SFX i   us    i          us
-+
-+REP 90
- REP a ei
- REP ei a
- REP a ey
- REP ey a
-@@ -199,4 +202,5 @@ REP z ss
- REP ss z
- REP shun tion
- REP shun sion
- REP shun cion
-+REP sitted sat
--- a/gfx/cairo/README
+++ b/gfx/cairo/README
@ -62,6 +62,8 @@ quartz-minimze-gradient-repeat.patch: reduce the number of gradient stop repetit

 quartz-first-stop.patch: return the first stop for negative positions on the gradient line of a nonrepeating linear gradient

+quartz-glyph-extents.patch: bug 534260; work around incorrect glyph extents returned by quartz for anomalous empty glyphs
+
 ==== pixman patches ====

 pixman-neon.patch: add ARM NEON optimized compositing functions
--- a/gfx/cairo/cairo/src/cairo-quartz-font.c
+++ b/gfx/cairo/cairo/src/cairo-quartz-font.c
@ -420,6 +420,16 @@ _cairo_quartz_init_glyph_metrics (cairo_quartz_scaled_font_t *font,
 	!CGFontGetGlyphBBoxesPtr (font_face->cgFont, &glyph, 1, &bbox))
 	goto FAIL;

+    /* broken fonts like Al Bayan return incorrect bounds for some null characters,
+       see https://bugzilla.mozilla.org/show_bug.cgi?id=534260 */
+    if (unlikely (bbox.origin.x == -32767 &&
+                  bbox.origin.y == -32767 &&
+                  bbox.size.width == 65534 &&
+                  bbox.size.height == 65534)) {
+        bbox.origin.x = bbox.origin.y = 0;
+        bbox.size.width = bbox.size.height = 0;
+    }
+
    status = _cairo_matrix_compute_basis_scale_factors (&font->base.scale,
 						  &xscale, &yscale, 1);
    if (status)
--- a/gfx/cairo/quartz-glyph-extents.patch
+++ b/gfx/cairo/quartz-glyph-extents.patch
@ -0,0 +1,19 @@
+--- a/gfx/cairo/cairo/src/cairo-quartz-font.c	Wed Dec 23 14:17:44 2009 -0500
+++ b/gfx/cairo/cairo/src/cairo-quartz-font.c	Wed Dec 23 20:45:00 2009 +0000
+@@ -420,6 +420,16 @@ _cairo_quartz_init_glyph_metrics (cairo_
+ 	!CGFontGetGlyphBBoxesPtr (font_face->cgFont, &glyph, 1, &bbox))
+ 	goto FAIL;
+ 
+    /* broken fonts like Al Bayan return incorrect bounds for some null characters,
+       see https://bugzilla.mozilla.org/show_bug.cgi?id=534260 */
+    if (unlikely (bbox.origin.x == -32767 &&
+                  bbox.origin.y == -32767 &&
+                  bbox.size.width == 65534 &&
+                  bbox.size.height == 65534)) {
+        bbox.origin.x = bbox.origin.y = 0;
+        bbox.size.width = bbox.size.height = 0;
+    }
+
+     status = _cairo_matrix_compute_basis_scale_factors (&font->base.scale,
+ 						  &xscale, &yscale, 1);
+     if (status)
--- a/ipc/glue/AsyncChannel.cpp
+++ b/ipc/glue/AsyncChannel.cpp
@ -64,7 +64,8 @@ AsyncChannel::AsyncChannel(AsyncListener* aListener)
    mMutex("mozilla.ipc.AsyncChannel.mMutex"),
    mCvar(mMutex, "mozilla.ipc.AsyncChannel.mCvar"),
    mIOLoop(),
-    mWorkerLoop()
+    mWorkerLoop(),
+    mChannelErrorTask(NULL)
 {
    MOZ_COUNT_CTOR(AsyncChannel);
 }
@ -129,6 +130,9 @@ AsyncChannel::Close()
    {
        MutexAutoLock lock(mMutex);

+        if (ChannelError == mChannelState)
+            return;
+
        if (ChannelConnected != mChannelState)
            // XXX be strict about this until there's a compelling reason
            // to relax
@ -295,6 +299,10 @@ AsyncChannel::Clear()
        // by GeckoChildProcess/GeckoThread
        mTransport = 0;
    }
+    if (mChannelErrorTask) {
+        mChannelErrorTask->Cancel();
+        mChannelErrorTask = NULL;
+    }
 }

 bool
@ -398,9 +406,11 @@ AsyncChannel::OnChannelError()
    if (ChannelClosing != mChannelState)
        mChannelState = ChannelError;

-    mWorkerLoop->PostTask(
-        FROM_HERE,
-        NewRunnableMethod(this, &AsyncChannel::NotifyMaybeChannelError));
+    NS_ASSERTION(!mChannelErrorTask, "OnChannelError called twice?");
+
+    mChannelErrorTask =
+        NewRunnableMethod(this, &AsyncChannel::NotifyMaybeChannelError);
+    mWorkerLoop->PostTask(FROM_HERE, mChannelErrorTask);
 }

 void
--- a/ipc/glue/AsyncChannel.h
+++ b/ipc/glue/AsyncChannel.h
@ -176,6 +176,7 @@ protected:
    MessageLoop* mIOLoop;       // thread where IO happens
    MessageLoop* mWorkerLoop;   // thread where work is done
    bool mChild;                // am I the child or parent?
+    CancelableTask* mChannelErrorTask; // NotifyMaybeChannelError runnable
 };


--- a/ipc/glue/GeckoChildProcessHost.cpp
+++ b/ipc/glue/GeckoChildProcessHost.cpp
@ -78,11 +78,14 @@ GeckoChildProcessHost::GeckoChildProcessHost(GeckoProcessType aProcessType,
 }

 GeckoChildProcessHost::~GeckoChildProcessHost()
-{
-    MOZ_COUNT_DTOR(GeckoChildProcessHost);

-    if (mChildProcessHandle > 0)
-      ProcessWatcher::EnsureProcessTerminated(mChildProcessHandle);
+{
+  AssertIOThread();
+
+  MOZ_COUNT_DTOR(GeckoChildProcessHost);
+
+  if (mChildProcessHandle > 0)
+    ProcessWatcher::EnsureProcessTerminated(mChildProcessHandle);
 }

 bool
--- a/ipc/glue/GeckoThread.h
+++ b/ipc/glue/GeckoThread.h
@ -43,6 +43,8 @@

 #include "chrome/common/child_thread.h"

+#include "nsDebug.h"
+
 #include "mozilla/ipc/ScopedXREEmbed.h"

 class NotificationService;
@ -50,6 +52,12 @@ class NotificationService;
 namespace mozilla {
 namespace ipc {

+inline void AssertIOThread()
+{
+    NS_ASSERTION(MessageLoop::TYPE_IO == MessageLoop::current()->type(),
+                 "should be on the IO thread!");
+}
+
 class GeckoThread : public ChildThread
 {
 public:
--- a/ipc/ipdl/ipdl/lower.py
+++ b/ipc/ipdl/ipdl/lower.py
@ -3353,11 +3353,11 @@ class _GenerateProtocolActorCode(ipdl.ast.Visitor):
        failif.addifstmts(
            self.unregisterActor(actorvar)
            + [ StmtExpr(ExprCall(_deallocMethod(md.decl.type.constructedType()), args=[actorvar])),
-                StmtReturn(ExprLiteral.NULL),
                StmtExpr(_callCxxArrayRemoveSorted(
                    self.protocol.managedVar(
                        md.decl.type.constructedType(), self.side),
-                    actorvar))
+                    actorvar)),
+                StmtReturn(ExprLiteral.NULL),
            ])
        return [ failif ]

--- a/ipc/ipdl/test/cxx/IPDLUnitTests.h
+++ b/ipc/ipdl/test/cxx/IPDLUnitTests.h
@ -100,6 +100,11 @@ inline void passed(const char* fmt, ...)
 //-----------------------------------------------------------------------------
 // parent process only

+class IPDLUnitTestSubprocess;
+
+extern void* gParentActor;
+extern IPDLUnitTestSubprocess* gSubprocess;
+
 void IPDLUnitTestMain(void* aData);

 void QuitParent();
@ -107,6 +112,8 @@ void QuitParent();
 //-----------------------------------------------------------------------------
 // child process only

+extern void* gChildActor;
+
 void IPDLUnitTestChildInit(IPC::Channel* transport,
                           base::ProcessHandle parent,
                           MessageLoop* worker);
--- a/ipc/ipdl/test/cxx/IPDLUnitTests.template.cpp
+++ b/ipc/ipdl/test/cxx/IPDLUnitTests.template.cpp
@ -21,6 +21,11 @@ ${INCLUDES}
 using mozilla::_ipdltest::IPDLUnitTestSubprocess;
 using mozilla::_ipdltest::IPDLUnitTestThreadChild;

+void* mozilla::_ipdltest::gParentActor;
+IPDLUnitTestSubprocess* mozilla::_ipdltest::gSubprocess;
+
+void* mozilla::_ipdltest::gChildActor;
+
 //-----------------------------------------------------------------------------
 // data/functions accessed by both parent and child processes

@ -111,10 +116,46 @@ IPDLUnitTest()
 //-----------------------------------------------------------------------------
 // parent process only

-namespace {
+namespace mozilla {
+namespace _ipdltest {

-void* gParentActor = NULL;
-IPDLUnitTestSubprocess* gSubprocess;
+void
+IPDLUnitTestMain(void* aData)
+{
+    char* testString = reinterpret_cast<char*>(aData);
+    IPDLUnitTestType test = IPDLUnitTestFromString(testString);
+    if (!test) {
+        // use this instead of |fail()| because we don't know what the test is
+        fprintf(stderr, MOZ_IPDL_TESTFAIL_LABEL "| %s | unknown unit test %s\\n",
+                "<--->", testString);
+        NS_RUNTIMEABORT("can't continue");
+    }
+    gIPDLUnitTestName = testString;
+
+    std::vector<std::string> testCaseArgs;
+    testCaseArgs.push_back(testString);
+
+    gSubprocess = new IPDLUnitTestSubprocess();
+    if (!gSubprocess->SyncLaunch(testCaseArgs))
+        fail("problem launching subprocess");
+
+    IPC::Channel* transport = gSubprocess->GetChannel();
+    if (!transport)
+        fail("no transport");
+
+    base::ProcessHandle child = gSubprocess->GetChildProcessHandle();
+
+    switch (test) {
+//-----------------------------------------------------------------------------
+//===== TEMPLATED =====
+${PARENT_MAIN_CASES}
+//-----------------------------------------------------------------------------
+
+    default:
+        fail("not reached");
+        return;                 // unreached
+    }
+}

 void
 DeleteParentActor()
@ -158,50 +199,6 @@ DeferredParentShutdown()
      NewRunnableFunction(DeleteSubprocess, MessageLoop::current()));
 }

-}
-
-
-namespace mozilla {
-namespace _ipdltest {
-
-void
-IPDLUnitTestMain(void* aData)
-{
-    char* testString = reinterpret_cast<char*>(aData);
-    IPDLUnitTestType test = IPDLUnitTestFromString(testString);
-    if (!test) {
-        // use this instead of |fail()| because we don't know what the test is
-        fprintf(stderr, MOZ_IPDL_TESTFAIL_LABEL "| %s | unknown unit test %s\\n",
-                "<--->", testString);
-        NS_RUNTIMEABORT("can't continue");
-    }
-    gIPDLUnitTestName = testString;
-
-    std::vector<std::string> testCaseArgs;
-    testCaseArgs.push_back(testString);
-
-    gSubprocess = new IPDLUnitTestSubprocess();
-    if (!gSubprocess->SyncLaunch(testCaseArgs))
-        fail("problem launching subprocess");
-
-    IPC::Channel* transport = gSubprocess->GetChannel();
-    if (!transport)
-        fail("no transport");
-
-    base::ProcessHandle child = gSubprocess->GetChildProcessHandle();
-
-    switch (test) {
-//-----------------------------------------------------------------------------
-//===== TEMPLATED =====
-${PARENT_MAIN_CASES}
-//-----------------------------------------------------------------------------
-
-    default:
-        fail("not reached");
-        return;                 // unreached
-    }
-}
-
 void
 QuitParent()
 {
@ -218,9 +215,8 @@ QuitParent()
 //-----------------------------------------------------------------------------
 // child process only

-namespace {
-
-void* gChildActor = NULL;
+namespace mozilla {
+namespace _ipdltest {

 void
 DeleteChildActor()
@ -237,12 +233,6 @@ ${CHILD_DELETE_CASES}
    }
 }

-}
-
-
-namespace mozilla {
-namespace _ipdltest {
-
 void
 IPDLUnitTestChildInit(IPC::Channel* transport,
                      base::ProcessHandle parent,
--- a/ipc/ipdl/test/cxx/Makefile.in
+++ b/ipc/ipdl/test/cxx/Makefile.in
@ -60,6 +60,7 @@ EXPORT_LIBRARY = 1
 # Please keep these organized in the order "easy"-to-"hard"
 IPDLTESTS = \
  TestSanity  \
+  TestRPCErrorCleanup \
  TestLatency \
  TestRPCRaces \
  TestManyChildAllocs  \
--- a/ipc/ipdl/test/cxx/PTestRPCErrorCleanup.ipdl
+++ b/ipc/ipdl/test/cxx/PTestRPCErrorCleanup.ipdl
@ -0,0 +1,11 @@
+namespace mozilla {
+namespace _ipdltest {
+
+rpc protocol PTestRPCErrorCleanup {
+child:
+    rpc Error();
+    rpc __delete__();
+};
+
+} // namespace _ipdltest
+} // namespace mozilla
--- a/ipc/ipdl/test/cxx/TestRPCErrorCleanup.cpp
+++ b/ipc/ipdl/test/cxx/TestRPCErrorCleanup.cpp
@ -0,0 +1,140 @@
+#include "TestRPCErrorCleanup.h"
+
+#include "mozilla/CondVar.h"
+#include "mozilla/Mutex.h"
+
+#include "IPDLUnitTests.h"      // fail etc.
+#include "IPDLUnitTestSubprocess.h"
+
+using mozilla::CondVar;
+using mozilla::Mutex;
+using mozilla::MutexAutoLock;
+
+namespace mozilla {
+namespace _ipdltest {
+
+//-----------------------------------------------------------------------------
+// parent
+
+// NB: this test does its own shutdown, rather than going through
+// QuitParent(), because it's testing degenerate edge cases
+
+void DeleteSubprocess(Mutex* mutex, CondVar* cvar)
+{
+    MutexAutoLock lock(*mutex);
+
+    delete gSubprocess;
+    gSubprocess = NULL;
+
+    cvar->Notify();
+}
+
+void DeleteTheWorld()
+{
+    delete static_cast<TestRPCErrorCleanupParent*>(gParentActor);
+    gParentActor = NULL;
+
+    // needs to be synchronous to avoid affecting event ordering on
+    // the main thread
+    Mutex mutex("TestRPCErrorCleanup.DeleteTheWorld.mutex");
+    CondVar cvar(mutex, "TestRPCErrorCleanup.DeleteTheWorld.cvar");
+
+    MutexAutoLock lock(mutex);
+
+    XRE_GetIOMessageLoop()->PostTask(
+      FROM_HERE,
+      NewRunnableFunction(DeleteSubprocess, &mutex, &cvar));
+
+    cvar.Wait();
+}
+
+void Done()
+{
+  static NS_DEFINE_CID(kAppShellCID, NS_APPSHELL_CID);
+  nsCOMPtr<nsIAppShell> appShell (do_GetService(kAppShellCID));
+  appShell->Exit();
+
+  passed(__FILE__);
+}
+
+TestRPCErrorCleanupParent::TestRPCErrorCleanupParent()
+{
+    MOZ_COUNT_CTOR(TestRPCErrorCleanupParent);
+}
+
+TestRPCErrorCleanupParent::~TestRPCErrorCleanupParent()
+{
+    MOZ_COUNT_DTOR(TestRPCErrorCleanupParent);
+}
+
+void
+TestRPCErrorCleanupParent::Main()
+{
+    // This test models the following sequence of events
+    //
+    // (1) Parent: RPC out-call
+    // (2) Child: crash
+    // --[Parent-only hereafter]--
+    // (3) RPC out-call return false
+    // (4) Close()
+    // --[event loop]--
+    // (5) delete parentActor
+    // (6) delete childProcess
+    // --[event loop]--
+    // (7) Channel::OnError notification
+    // --[event loop]--
+    // (8) Done, quit
+    //
+    // See bug 535298 and friends; this seqeunce of events captures
+    // three differnent potential errors
+    //  - Close()-after-error (semantic error previously)
+    //  - use-after-free of parentActor
+    //  - use-after-free of channel
+    //
+    // Because of legacy constraints related to nsNPAPI* code, we need
+    // to ensure that this sequence of events can occur without
+    // errors/crashes.
+
+    MessageLoop::current()->PostTask(
+        FROM_HERE, NewRunnableFunction(DeleteTheWorld));
+
+    // it's a failure if this *succeeds*
+    if (CallError())
+        fail("expected an error!");
+
+    // it's OK to Close() a channel after an error, because nsNPAPI*
+    // wants to do this
+    Close();
+
+    // we know that this event *must* be after the MaybeError
+    // notification enqueued by AsyncChannel, because that event is
+    // enqueued within the same mutex that ends up signaling the
+    // wakeup-on-error of |CallError()| above
+    MessageLoop::current()->PostTask(FROM_HERE, NewRunnableFunction(Done));
+}
+
+
+//-----------------------------------------------------------------------------
+// child
+
+TestRPCErrorCleanupChild::TestRPCErrorCleanupChild()
+{
+    MOZ_COUNT_CTOR(TestRPCErrorCleanupChild);
+}
+
+TestRPCErrorCleanupChild::~TestRPCErrorCleanupChild()
+{
+    MOZ_COUNT_DTOR(TestRPCErrorCleanupChild);
+}
+
+bool
+TestRPCErrorCleanupChild::AnswerError()
+{
+    _exit(0);
+    NS_RUNTIMEABORT("unreached");
+    return false;
+}
+
+
+} // namespace _ipdltest
+} // namespace mozilla
--- a/ipc/ipdl/test/cxx/TestRPCErrorCleanup.h
+++ b/ipc/ipdl/test/cxx/TestRPCErrorCleanup.h
@ -0,0 +1,55 @@
+#ifndef mozilla__ipdltest_TestRPCErrorCleanup_h
+#define mozilla__ipdltest_TestRPCErrorCleanup_h 1
+
+#include "mozilla/_ipdltest/IPDLUnitTests.h"
+
+#include "mozilla/_ipdltest/PTestRPCErrorCleanupParent.h"
+#include "mozilla/_ipdltest/PTestRPCErrorCleanupChild.h"
+
+namespace mozilla {
+namespace _ipdltest {
+
+
+class TestRPCErrorCleanupParent :
+    public PTestRPCErrorCleanupParent
+{
+public:
+    TestRPCErrorCleanupParent();
+    virtual ~TestRPCErrorCleanupParent();
+
+    void Main();
+
+protected:    
+    NS_OVERRIDE
+    virtual void ActorDestroy(ActorDestroyReason why)
+    {
+        if (AbnormalShutdown != why)
+            fail("unexpected destruction!");  
+    }
+};
+
+
+class TestRPCErrorCleanupChild :
+    public PTestRPCErrorCleanupChild
+{
+public:
+    TestRPCErrorCleanupChild();
+    virtual ~TestRPCErrorCleanupChild();
+
+protected:
+    NS_OVERRIDE
+    virtual bool AnswerError();
+
+    NS_OVERRIDE
+    virtual void ActorDestroy(ActorDestroyReason why)
+    {
+        fail("should have 'crashed'!");
+    }
+};
+
+
+} // namespace _ipdltest
+} // namespace mozilla
+
+
+#endif // ifndef mozilla__ipdltest_TestRPCErrorCleanup_h
--- a/ipc/ipdl/test/cxx/ipdl.mk
+++ b/ipc/ipdl/test/cxx/ipdl.mk
@ -7,6 +7,7 @@ IPDLSRCS =					\
  PTestLatency.ipdl				\
  PTestManyChildAllocs.ipdl			\
  PTestManyChildAllocsSub.ipdl			\
+  PTestRPCErrorCleanup.ipdl			\
  PTestRPCRaces.ipdl				\
  PTestSanity.ipdl				\
  PTestShmem.ipdl				\
--- a/js/src/jsobj.cpp
+++ b/js/src/jsobj.cpp
@ -5539,7 +5539,7 @@ js_IsDelegate(JSContext *cx, JSObject *obj, jsval v, JSBool *bp)
    *bp = JS_FALSE;
    if (JSVAL_IS_PRIMITIVE(v))
        return JS_TRUE;
-    obj2 = JSVAL_TO_OBJECT(v);
+    obj2 = js_GetWrappedObject(cx, JSVAL_TO_OBJECT(v));
    while ((obj2 = OBJ_GET_PROTO(cx, obj2)) != NULL) {
        if (obj2 == obj) {
            *bp = JS_TRUE;
--- a/js/src/jsregexp.cpp
+++ b/js/src/jsregexp.cpp
@ -375,17 +375,15 @@ upcase(uintN ch)
    return (cu < 128) ? ch : cu;
 }

-static JS_ALWAYS_INLINE uintN
-downcase(uintN ch)
+/*
+ * Return the 'canonical' inverse upcase of |ch|. That is the character
+ * |lch| such that |upcase(lch) == ch| and (|lch| is the lower-case form
+ * of |ch| or is |ch|).
+ */
+static inline jschar inverse_upcase(jschar ch)
 {
-    JS_ASSERT((uintN) (jschar) ch == ch);
-    if (ch < 128) {
-        if (ch - (uintN) 'A' <= (uintN) ('Z' - 'A'))
-            ch += (uintN) ('a' - 'A');
-        return ch;
-    }
-
-    return JS_TOLOWER(ch);
+    jschar lch = JS_TOLOWER(ch);
+    return (upcase(lch) == ch) ? lch : ch;       
 }

 /* Construct and initialize an RENode, returning NULL for out-of-memory */
@ -1090,7 +1088,7 @@ lexHex:
                jschar uch, dch;

                uch = upcase(i);
-                dch = downcase(i);
+                dch = inverse_upcase(i);
                maxch = JS_MAX(maxch, uch);
                maxch = JS_MAX(maxch, dch);
            }
@ -2360,7 +2358,7 @@ class RegExpNativeCompiler {

        if (cs->flags & JSREG_FOLD) {
            ch = JS_TOUPPER(ch);
-            jschar lch = JS_TOLOWER(ch);
+            jschar lch = inverse_upcase(ch);

            if (ch != lch) {
                if (L'A' <= ch && ch <= L'Z') {
@ -3884,7 +3882,7 @@ ProcessCharSet(JSContext *cx, JSRegExp *re, RECharSet *charSet)

                    AddCharacterToCharSet(charSet, i);
                    uch = upcase(i);
-                    dch = downcase(i);
+                    dch = inverse_upcase(i);
                    if (i != uch)
                        AddCharacterToCharSet(charSet, uch);
                    if (i != dch)
@ -3897,7 +3895,7 @@ ProcessCharSet(JSContext *cx, JSRegExp *re, RECharSet *charSet)
        } else {
            if (re->flags & JSREG_FOLD) {
                AddCharacterToCharSet(charSet, upcase(thisCh));
-                AddCharacterToCharSet(charSet, downcase(thisCh));
+                AddCharacterToCharSet(charSet, inverse_upcase(thisCh));
            } else {
                AddCharacterToCharSet(charSet, thisCh);
            }
--- a/js/src/tests/js1_5/Regress/jstests.list
+++ b/js/src/tests/js1_5/Regress/jstests.list
@ -250,6 +250,7 @@ script regress-426827.js
 script regress-428366.js
 script regress-438415-01.js
 script regress-438415-02.js
+script regress-440926.js
 script regress-449627.js
 script regress-449666.js
 script regress-450369.js
--- a/js/src/tests/js1_5/Regress/regress-440926.js
+++ b/js/src/tests/js1_5/Regress/regress-440926.js
@ -0,0 +1,67 @@
+/* -*- Mode: C++; tab-width: 2; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
+/* ***** BEGIN LICENSE BLOCK *****
+ * Version: MPL 1.1/GPL 2.0/LGPL 2.1
+ *
+ * The contents of this file are subject to the Mozilla Public License Version
+ * 1.1 (the "License"); you may not use this file except in compliance with
+ * the License. You may obtain a copy of the License at
+ * http://www.mozilla.org/MPL/
+ *
+ * Software distributed under the License is distributed on an "AS IS" basis,
+ * WITHOUT WARRANTY OF ANY KIND, either express or implied. See the License
+ * for the specific language governing rights and limitations under the
+ * License.
+ *
+ * The Original Code is JavaScript Engine testing utilities.
+ *
+ * The Initial Developer of the Original Code is
+ * Mozilla Foundation.
+ * Portions created by the Initial Developer are Copyright (C) 2008
+ * the Initial Developer. All Rights Reserved.
+ *
+ * Contributor(s): Dave Mandelin
+ *
+ * Alternatively, the contents of this file may be used under the terms of
+ * either the GNU General Public License Version 2 or later (the "GPL"), or
+ * the GNU Lesser General Public License Version 2.1 or later (the "LGPL"),
+ * in which case the provisions of the GPL or the LGPL are applicable instead
+ * of those above. If you wish to allow use of your version of this file only
+ * under the terms of either the GPL or the LGPL, and not to allow others to
+ * use your version of this file under the terms of the MPL, indicate your
+ * decision by deleting the provisions above and replace them with the notice
+ * and other provisions required by the GPL or the LGPL. If you do not delete
+ * the provisions above, a recipient may use your version of this file under
+ * the terms of any one of the MPL, the GPL or the LGPL.
+ *
+ * ***** END LICENSE BLOCK ***** */
+
+var gTestfile = 'regress-440926.js';
+//-----------------------------------------------------------------------------
+var BUGNUMBER = 440926;
+var summary = 'Correctly match regexps with special "i" characters';
+var actual = '';
+var expect = 'iI#,iI#;iI#,iI#';
+
+
+//-----------------------------------------------------------------------------
+test();
+//-----------------------------------------------------------------------------
+
+function test()
+{
+  enterFunc ('test');
+  printBugNumber(BUGNUMBER);
+  printStatus (summary);
+
+  actual += 'iI\u0130'.replace(/[\u0130]/gi, '#');
+  actual += ',' + 'iI\u0130'.replace(/\u0130/gi, '#');
+
+  jit(true);
+  actual += ';' + 'iI\u0130'.replace(/[\u0130]/gi, '#');
+  actual += ',' + 'iI\u0130'.replace(/\u0130/gi, '#');
+  jit(false);
+
+  reportCompare(expect, actual, summary);
+
+  exitFunc ('test');
+}
--- a/js/src/xpconnect/src/XPCCrossOriginWrapper.cpp
+++ b/js/src/xpconnect/src/XPCCrossOriginWrapper.cpp
@ -352,7 +352,7 @@ WrapObject(JSContext *cx, JSObject *parent, jsval *vp, XPCWrappedNative* wn)
  // Our argument should be a wrapped native object, but the caller may have
  // passed it in as an optimization.
  JSObject *wrappedObj;
-  if (!JSVAL_IS_OBJECT(*vp) ||
+  if (JSVAL_IS_PRIMITIVE(*vp) ||
      !(wrappedObj = JSVAL_TO_OBJECT(*vp)) ||
      STOBJ_GET_CLASS(wrappedObj) == &XOWClass.base) {
    return JS_TRUE;
@ -558,6 +558,17 @@ XPC_XOW_AddProperty(JSContext *cx, JSObject *obj, jsval id, jsval *vp)
    return JS_FALSE;
  }

+  if (!JSVAL_IS_PRIMITIVE(*vp)) {
+    JSObject *addedObj = JSVAL_TO_OBJECT(*vp);
+    if (STOBJ_GET_CLASS(addedObj) == &XOWClass.base &&
+        STOBJ_GET_PARENT(addedObj) != STOBJ_GET_PARENT(obj)) {
+      *vp = OBJECT_TO_JSVAL(GetWrappedObject(cx, addedObj));
+      if (!WrapObject(cx, STOBJ_GET_PARENT(obj), vp, nsnull)) {
+        return JS_FALSE;
+      }
+    }
+  }
+
  if (HAS_FLAGS(resolving, FLAG_RESOLVING)) {
    // Allow us to define a property on ourselves.
    return JS_TRUE;
--- a/js/src/xpconnect/src/XPCNativeWrapper.cpp
+++ b/js/src/xpconnect/src/XPCNativeWrapper.cpp
@ -561,6 +561,31 @@ XPC_NW_FunctionWrapper(JSContext *cx, JSObject *obj, uintN argc, jsval *argv,
  return RewrapIfDeepWrapper(cx, obj, v, rval);
 }

+static JSBool
+GetwrappedJSObject(JSContext *cx, JSObject *obj, jsval *vp)
+{
+  // If we're wrapping an untrusted content wrapper, then we should
+  // return a safe wrapper for the underlying native object. Otherwise,
+  // such a wrapper would be superfluous.
+
+  nsIScriptSecurityManager *ssm = GetSecurityManager();
+  nsCOMPtr<nsIPrincipal> prin;
+  nsresult rv = ssm->GetObjectPrincipal(cx, obj, getter_AddRefs(prin));
+  if (NS_FAILED(rv)) {
+    return ThrowException(rv, cx);
+  }
+
+  jsval v = OBJECT_TO_JSVAL(obj);
+
+  PRBool isSystem;
+  if (NS_SUCCEEDED(ssm->IsSystemPrincipal(prin, &isSystem)) && isSystem) {
+    *vp = v;
+    return JS_TRUE;
+  }
+
+  return XPCSafeJSObjectWrapper::WrapObject(cx, JS_GetScopeChain(cx), v, vp);
+}
+
 static JSBool
 XPC_NW_GetOrSetProperty(JSContext *cx, JSObject *obj, jsval id, jsval *vp,
                        JSBool aIsSet)
@ -611,27 +636,7 @@ XPC_NW_GetOrSetProperty(JSContext *cx, JSObject *obj, jsval id, jsval *vp,

  if (!aIsSet &&
      id == GetRTStringByIndex(cx, XPCJSRuntime::IDX_WRAPPED_JSOBJECT)) {
-    // If we're wrapping an untrusted content wrapper, then we should
-    // return a safe wrapper for the underlying native object. Otherwise,
-    // such a wrapper would be superfluous.
-
-    jsval nativeVal = OBJECT_TO_JSVAL(nativeObj);
-
-    nsIScriptSecurityManager *ssm = GetSecurityManager();
-    nsCOMPtr<nsIPrincipal> prin;
-    nsresult rv = ssm->GetObjectPrincipal(cx, nativeObj,
-                                          getter_AddRefs(prin));
-    if (NS_FAILED(rv)) {
-      return ThrowException(rv, cx);
-    }
-
-    PRBool isSystem;
-    if (NS_SUCCEEDED(ssm->IsSystemPrincipal(prin, &isSystem)) && isSystem) {
-      *vp = nativeVal;
-      return JS_TRUE;
-    }
-
-    return XPCSafeJSObjectWrapper::WrapObject(cx, nsnull, nativeVal, vp);
+    return GetwrappedJSObject(cx, nativeObj, vp);
  }

  return GetOrSetNativeProperty(cx, obj, wrappedNative, id, vp, aIsSet,
@ -1158,6 +1163,31 @@ XPC_NW_toString(JSContext *cx, JSObject *obj, uintN argc, jsval *argv,
  return NativeToString(cx, wrappedNative, argc, argv, rval, JS_TRUE);
 }

+static JSBool
+UnwrapNW(JSContext *cx, uintN argc, jsval *vp)
+{
+  if (argc != 1) {
+    return ThrowException(NS_ERROR_XPC_NOT_ENOUGH_ARGS, cx);
+  }
+
+  jsval v = JS_ARGV(cx, vp)[0];
+  if (JSVAL_IS_PRIMITIVE(v)) {
+    return ThrowException(NS_ERROR_INVALID_ARG, cx);
+  }
+
+  if (!IsNativeWrapper(JSVAL_TO_OBJECT(v))) {
+    JS_SET_RVAL(cx, vp, v);
+    return JS_TRUE;
+  }
+
+  return GetwrappedJSObject(cx, JSVAL_TO_OBJECT(v), vp);
+}
+
+static JSFunctionSpec static_functions[] = {
+  JS_FN("unwrap", UnwrapNW, 1, 0),
+  JS_FS_END
+};
+
 // static
 PRBool
 XPCNativeWrapper::AttachNewConstructorObject(XPCCallContext &ccx,
@ -1166,7 +1196,7 @@ XPCNativeWrapper::AttachNewConstructorObject(XPCCallContext &ccx,
  JSObject *class_obj =
    ::JS_InitClass(ccx, aGlobalObject, nsnull, &internal::NWClass.base,
                   XPCNativeWrapperCtor, 0, nsnull, nsnull,
-                   nsnull, nsnull);
+                   nsnull, static_functions);
  if (!class_obj) {
    NS_WARNING("can't initialize the XPCNativeWrapper class");
    return PR_FALSE;
--- a/js/src/xpconnect/src/XPCSystemOnlyWrapper.cpp
+++ b/js/src/xpconnect/src/XPCSystemOnlyWrapper.cpp
@ -218,10 +218,6 @@ AllowedToAct(JSContext *cx, jsval idval)

 using namespace SystemOnlyWrapper;

-static JSBool
-XPC_SOW_toString(JSContext *cx, JSObject *obj, uintN argc, jsval *argv,
-                 jsval *rval);
-
 // Like GetWrappedObject, but works on other types of wrappers, too.
 // TODO Move to XPCWrapper?
 static inline JSObject *
@ -432,10 +428,6 @@ static JSBool
 XPC_SOW_GetOrSetProperty(JSContext *cx, JSObject *obj, jsval id, jsval *vp,
                         JSBool isSet)
 {
-  if (id == GetRTStringByIndex(cx, XPCJSRuntime::IDX_TO_STRING)) {
-    return JS_TRUE;
-  }
-
  obj = GetWrapper(obj);
  if (!obj) {
    return ThrowException(NS_ERROR_ILLEGAL_VALUE, cx);
@ -518,27 +510,6 @@ XPC_SOW_NewResolve(JSContext *cx, JSObject *obj, jsval id, uintN flags,
    return JS_FALSE;
  }

-  if (id == GetRTStringByIndex(cx, XPCJSRuntime::IDX_TO_STRING)) {
-    jsval oldSlotVal;
-    if (!JS_GetReservedSlot(cx, obj, sFlagsSlot, &oldSlotVal) ||
-        !JS_SetReservedSlot(cx, obj, sFlagsSlot,
-                            INT_TO_JSVAL(JSVAL_TO_INT(oldSlotVal) |
-                                         FLAG_RESOLVING))) {
-      return JS_FALSE;
-    }
-
-    JSBool ok = JS_DefineFunction(cx, obj, "toString",
-                                  XPC_SOW_toString, 0, 0) != nsnull;
-
-    JS_SetReservedSlot(cx, obj, sFlagsSlot, oldSlotVal);
-
-    if (ok) {
-      *objp = obj;
-    }
-
-    return ok;
-  }
-
  return NewResolve(cx, obj, JS_TRUE, wrappedObj, id, flags, objp);
 }

@ -558,12 +529,7 @@ XPC_SOW_Convert(JSContext *cx, JSObject *obj, JSType type, jsval *vp)
  JSObject *wrappedObj = GetWrappedObject(cx, obj);
  if (!wrappedObj) {
    // Converting the prototype to something.
-
-    if (type == JSTYPE_STRING || type == JSTYPE_VOID) {
-      return XPC_SOW_toString(cx, obj, 0, nsnull, vp);
-    }
-
-    *vp = OBJECT_TO_JSVAL(obj);
+    // XXX Can this happen?
    return JS_TRUE;
  }

@ -700,34 +666,3 @@ XPC_SOW_WrappedObject(JSContext *cx, JSObject *obj)
 {
  return GetWrappedObject(cx, obj);
 }
-
-static JSBool
-XPC_SOW_toString(JSContext *cx, JSObject *obj, uintN argc, jsval *argv,
-                 jsval *rval)
-{
-  if (!AllowedToAct(cx, JSVAL_VOID)) {
-    return JS_FALSE;
-  }
-
-  obj = GetWrapper(obj);
-  if (!obj) {
-    return ThrowException(NS_ERROR_UNEXPECTED, cx);
-  }
-
-  JSObject *wrappedObj = GetWrappedObject(cx, obj);
-  if (!wrappedObj) {
-    // Someone's calling toString on our prototype.
-    NS_NAMED_LITERAL_CSTRING(protoString, "[object XPCCrossOriginWrapper]");
-    JSString *str =
-      JS_NewStringCopyN(cx, protoString.get(), protoString.Length());
-    if (!str) {
-      return JS_FALSE;
-    }
-    *rval = STRING_TO_JSVAL(str);
-    return JS_TRUE;
-  }
-
-  XPCWrappedNative *wn =
-    XPCWrappedNative::GetWrappedNativeOfJSObject(cx, wrappedObj);
-  return NativeToString(cx, wn, argc, argv, rval, JS_FALSE);
-}
--- a/js/src/xpconnect/src/xpcwrappedjsclass.cpp
+++ b/js/src/xpconnect/src/xpcwrappedjsclass.cpp
@ -1574,7 +1574,7 @@ nsXPCWrappedJSClass::CallMethod(nsXPCWrappedJS* wrapper, uint16 methodIndex,
            }
        }

-        if(param.IsOut())
+        if(param.IsOut() || param.IsDipper())
        {
            // create an 'out' object
            JSObject* out_obj = NewOutObject(cx, obj);
--- a/js/src/xpconnect/tests/chrome/Makefile.in
+++ b/js/src/xpconnect/tests/chrome/Makefile.in
@ -47,6 +47,7 @@ _CHROME_FILES = \
 		test_bug500931.xul \
 		bug503926.xul \
 		test_bug503926.xul \
+		test_bug533596.xul \
 		$(NULL)

 libs:: $(_CHROME_FILES)
--- a/js/src/xpconnect/tests/chrome/test_bug533596.xul
+++ b/js/src/xpconnect/tests/chrome/test_bug533596.xul
@ -0,0 +1,56 @@
+<?xml version="1.0"?>
+<?xml-stylesheet href="chrome://global/skin" type="text/css"?>
+<?xml-stylesheet href="chrome://mochikit/content/tests/SimpleTest/test.css"
+                 type="text/css"?>
+<!--
+https://bugzilla.mozilla.org/show_bug.cgi?id=500931
+-->
+<window title="Mozilla Bug 500931"
+  xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul">
+  <script type="application/javascript"
+          src="chrome://mochikit/content/MochiKit/packed.js"></script>
+  <script type="application/javascript"
+          src="chrome://mochikit/content/tests/SimpleTest/SimpleTest.js"></script>
+
+  <!-- test results are displayed in the html:body -->
+  <body xmlns="http://www.w3.org/1999/xhtml">
+  <a href="https://bugzilla.mozilla.org/show_bug.cgi?id=533596"
+     target="_blank">Mozilla Bug 533596</a>
+  </body>
+
+  <!-- test code goes here -->
+  <script type="application/javascript"><![CDATA[
+
+  /** Test for Bug 533596 **/
+
+  function go() {
+    try { XPCNativeWrapper.unwrap(); } catch (e) {}
+    try { XPCNativeWrapper.unwrap(0); } catch (e) {}
+    try { XPCNativeWrapper.unwrap(null); } catch (e) {}
+
+    var o = {};
+    is(o, XPCNativeWrapper.unwrap(o), "unwrap on a random object returns it");
+
+    var win = $('ifr').contentWindow;
+    var utils = window.getInterface(Components.interfaces.nsIDOMWindowUtils);
+    is(utils.getClassName(win), "XPCNativeWrapper", "win is an XPCNW");
+    is(utils.getClassName(XPCNativeWrapper.unwrap(win)), "XPCSafeJSObjectWrapper",
+       "unwrap on an NW returns the same object");
+    is(utils.getClassName(XPCNativeWrapper.unwrap(new XPCNativeWrapper(win))), "XPCSafeJSObjectWrapper",
+       "unwrap on an explicit NW works too");
+
+    ok(utils.getClassName(window) !== "XPCNativeWrapper", "window is not a native wrapper");
+    ok(utils.getClassName(XPCNativeWrapper.unwrap(new XPCNativeWrapper(window))) !== "XPCSafeJSObjectWrapper",
+       "unwrapping a chrome object returns the object itself");
+    SimpleTest.finish();
+  }
+
+  SimpleTest.waitForExplicitFinish();
+
+  ]]></script>
+  <iframe type="content"
+          src="http://example.org/tests/js/src/xpconnect/tests/mochitest/bug500931_helper.html"
+          onload="go()"
+          id="ifr">
+  </iframe>
+</window>
--- a/js/src/xpconnect/tests/mochitest/test_wrappers.html
+++ b/js/src/xpconnect/tests/mochitest/test_wrappers.html
@ -7,6 +7,8 @@
 </head>
 <body>
    <script class="testbody" type="text/javascript;version=1.7">
+    ok(window instanceof Object, "window is instanceof Object");
+
    location.foopy = 3;

    var xow_answer = [];
--- a/layout/base/crashtests/535721-1.xhtml
+++ b/layout/base/crashtests/535721-1.xhtml
@ -0,0 +1,17 @@
+<html xmlns="http://www.w3.org/1999/xhtml">
+<head>
+<script>
+function boom()
+{
+
+  document.getElementById("i").appendChild(document.createElementNS("http://www.w3.org/1999/xhtml", "div"));
+
+}
+</script>
+</head>
+<body onload="boom();">
+
+<div><span><span id="i"><div></div></span></span></div>
+
+</body>
+</html>
--- a/layout/base/crashtests/535911-1.xhtml
+++ b/layout/base/crashtests/535911-1.xhtml
@ -0,0 +1,16 @@
+<html xmlns="http://www.w3.org/1999/xhtml">
+<head>
+<script>
+
+function boom()
+{
+    var s = document.createElementNS("http://www.w3.org/1999/xhtml", "span");
+    var b = document.createElementNS("http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul", "box");
+    s.appendChild(b);
+    document.getElementById("a").appendChild(s); 
+}
+
+</script>
+</head>
+<body onload="boom();" style="-moz-column-width: 1px;"><span id="a"><box xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul"/></span><div>Hello</div></body>
+</html>
--- a/layout/base/crashtests/crashtests.list
+++ b/layout/base/crashtests/crashtests.list
@ -266,3 +266,5 @@ load 500467-1.html
 load 501878-1.html
 load 503936-1.html
 load 526378-1.xul
+load 535721-1.xhtml
+load 535911-1.xhtml
--- a/layout/base/nsCSSFrameConstructor.cpp
+++ b/layout/base/nsCSSFrameConstructor.cpp
@ -366,10 +366,6 @@ static PRInt32 FFWC_recursions=0;
 static PRInt32 FFWC_nextInFlows=0;
 #endif

-static nsresult
-DeletingFrameSubtree(nsFrameManager* aFrameManager,
-                     nsIFrame*       aFrame);
-
 static inline nsIFrame*
 GetFieldSetBlockFrame(nsIFrame* aFieldsetFrame)
 {
@ -621,60 +617,6 @@ IsOutOfFlowList(nsIAtom* aListName)
    aListName == nsGkAtoms::fixedList;
 }

-// Helper function that recursively removes content to frame mappings and
-// undisplayed content mappings.
-// This differs from DeletingFrameSubtree() because the frames have not yet been
-// added to the frame hierarchy.
-// XXXbz it would really help if we merged the two methods somehow... :(
-static void
-DoCleanupFrameReferences(nsFrameManager*  aFrameManager,
-                         nsIFrame*        aFrameIn)
-{
-  nsIContent* content = aFrameIn->GetContent();
-
-  if (aFrameIn->GetType() == nsGkAtoms::placeholderFrame) {
-    nsPlaceholderFrame* placeholder = static_cast<nsPlaceholderFrame*>
-                                                 (aFrameIn);
-    // if the frame is a placeholder use the out of flow frame
-    aFrameIn = nsPlaceholderFrame::GetRealFrameForPlaceholder(placeholder);
-
-    // And don't forget to unregister the placeholder mapping.  Note that this
-    // means it's the caller's responsibility to actually destroy the
-    // out-of-flow pointed to by the placeholder, since after this point the
-    // out-of-flow is not reachable via the placeholder.
-    aFrameManager->UnregisterPlaceholderFrame(placeholder);
-  }
-
-  // Remove the mapping from the content object to its frame
-  aFrameManager->RemoveAsPrimaryFrame(content, aFrameIn);
-  aFrameManager->ClearAllUndisplayedContentIn(content);
-
-  // Recursively walk the child frames.
-  nsIAtom* childListName = nsnull;
-  PRInt32 childListIndex = 0;
-  do {
-    nsIFrame* childFrame = aFrameIn->GetFirstChild(childListName);
-    while (childFrame) {
-      DoCleanupFrameReferences(aFrameManager, childFrame);
-    
-      // Get the next sibling child frame
-      childFrame = childFrame->GetNextSibling();
-    }
-
-    childListName = aFrameIn->GetAdditionalChildListName(childListIndex++);
-  } while (childListName);
-}
-
-// Helper function that walks a frame list and calls DoCleanupFrameReference()
-static void
-CleanupFrameReferences(nsFrameManager*  aFrameManager,
-                       const nsFrameList& aFrameList)
-{
-  for (nsFrameList::Enumerator e(aFrameList); !e.AtEnd(); e.Next()) {
-    DoCleanupFrameReferences(aFrameManager, e.get());
-  }
-}
-
 // -----------------------------------------------------------

 // Structure used when constructing formatting object trees.
@ -877,8 +819,7 @@ public:
   * @throws NS_ERROR_OUT_OF_MEMORY if it happens.
   * @note If this method throws, that means that aNewFrame was not inserted
   *       into any frame lists.  Furthermore, this method will handle cleanup
-   *       of aNewFrame (via calling CleanupFrameReferences() and Destroy() on
-   *       it).
+   *       of aNewFrame (via calling Destroy() on it).
   */
  nsresult AddChild(nsIFrame* aNewFrame,
                    nsFrameItems& aFrameItems,
@ -1227,7 +1168,6 @@ nsFrameConstructorState::AddChild(nsIFrame* aNewFrame,
      // hence already set as the primary frame.  So we have to clean up here.
      // But it shouldn't have any out-of-flow kids.
      // XXXbz Maybe add a utility function to assert that?
-      DoCleanupFrameReferences(mFrameManager, aNewFrame);
      aNewFrame->Destroy();
      return rv;
    }
@ -1396,10 +1336,9 @@ MoveChildrenTo(nsPresContext* aPresContext,
               nsIFrame* aNewParent,
               nsFrameList& aFrameList)
 {
-  NS_PRECONDITION(aOldParent->GetParent() == aNewParent->GetParent(),
-                  "Unexpected old and new parents");
+  PRBool sameGrandParent = aOldParent->GetParent() == aNewParent->GetParent();

-  if (aNewParent->HasView() || aOldParent->HasView()) {
+  if (aNewParent->HasView() || aOldParent->HasView() || !sameGrandParent) {
    // Move the frames into the new view
    nsHTMLContainerFrame::ReparentFrameViewList(aPresContext, aFrameList,
                                                aOldParent, aNewParent);
@ -1419,6 +1358,12 @@ MoveChildrenTo(nsPresContext* aPresContext,

  if (setHasChildWithView) {
    aNewParent->AddStateBits(NS_FRAME_HAS_CHILD_WITH_VIEW);
+    if (!sameGrandParent) {
+      for (nsIFrame* ancestor = aNewParent->GetParent();
+           ancestor; ancestor = ancestor->GetParent()) {
+        ancestor->AddStateBits(NS_FRAME_HAS_CHILD_WITH_VIEW);
+      }
+    }
  }

  if (aNewParent->GetChildList(nsnull).IsEmpty() &&
@ -1429,78 +1374,6 @@ MoveChildrenTo(nsPresContext* aPresContext,
  }
 }

-// -----------------------------------------------------------
-
-// Helper function that determines the child list name that aChildFrame
-// is contained in
-static nsIAtom*
-GetChildListNameFor(nsIFrame*       aChildFrame)
-{
-  nsIAtom*      listName;
-
-  if (aChildFrame->GetStateBits() & NS_FRAME_IS_OVERFLOW_CONTAINER) {
-    listName = nsGkAtoms::overflowContainersList;
-  }
-  // See if the frame is moved out of the flow
-  else if (aChildFrame->GetStateBits() & NS_FRAME_OUT_OF_FLOW) {
-    // Look at the style information to tell
-    const nsStyleDisplay* disp = aChildFrame->GetStyleDisplay();
-    
-    if (NS_STYLE_POSITION_ABSOLUTE == disp->mPosition) {
-      listName = nsGkAtoms::absoluteList;
-    } else if (NS_STYLE_POSITION_FIXED == disp->mPosition) {
-      if (nsLayoutUtils::IsReallyFixedPos(aChildFrame)) {
-        listName = nsGkAtoms::fixedList;
-      } else {
-        listName = nsGkAtoms::absoluteList;
-      }
-#ifdef MOZ_XUL
-    } else if (NS_STYLE_DISPLAY_POPUP == disp->mDisplay) {
-      // Out-of-flows that are DISPLAY_POPUP must be kids of the root popup set
-#ifdef DEBUG
-      nsIFrame* parent = aChildFrame->GetParent();
-      NS_ASSERTION(parent && parent->GetType() == nsGkAtoms::popupSetFrame,
-                   "Unexpected parent");
-#endif // DEBUG
-
-      // XXX FIXME: Bug 350740
-      // Return here, because the postcondition for this function actually
-      // fails for this case, since the popups are not in a "real" frame list
-      // in the popup set.
-      return nsGkAtoms::popupList;      
-#endif // MOZ_XUL
-    } else {
-      NS_ASSERTION(aChildFrame->GetStyleDisplay()->IsFloating(),
-                   "not a floated frame");
-      listName = nsGkAtoms::floatList;
-    }
-
-  } else {
-    listName = nsnull;
-  }
-
-#ifdef NS_DEBUG
-  // Verify that the frame is actually in that child list or in the
-  // corresponding overflow list.
-  nsIFrame* parent = aChildFrame->GetParent();
-  PRBool found = parent->GetChildList(listName).ContainsFrame(aChildFrame);
-  if (!found) {
-    if (!(aChildFrame->GetStateBits() & NS_FRAME_OUT_OF_FLOW)) {
-      found = parent->GetChildList(nsGkAtoms::overflowList)
-                .ContainsFrame(aChildFrame);
-    }
-    else if (aChildFrame->GetStyleDisplay()->IsFloating()) {
-      found = parent->GetChildList(nsGkAtoms::overflowOutOfFlowList)
-                .ContainsFrame(aChildFrame);
-    }
-    // else it's positioned and should have been on the 'listName' child list.
-    NS_POSTCONDITION(found, "not in child list");
-  }
-#endif
-
-  return listName;
-}
-
 //----------------------------------------------------------------------

 nsCSSFrameConstructor::nsCSSFrameConstructor(nsIDocument *aDocument,
@ -3965,7 +3838,6 @@ nsCSSFrameConstructor::ConstructFrameFromItemInternal(FrameConstructionItem& aIt

      if (childItems.NotEmpty()) {
        // an error must have occurred, delete unprocessed frames
-        CleanupFrameReferences(aState.mFrameManager, childItems);
        childItems.DestroyFrames();
      }

@ -5775,7 +5647,8 @@ nsresult
 nsCSSFrameConstructor::AppendFrames(nsFrameConstructorState&       aState,
                                    nsIFrame*                      aParentFrame,
                                    nsFrameItems&                  aFrameList,
-                                    nsIFrame*                      aPrevSibling)
+                                    nsIFrame*                      aPrevSibling,
+                                    PRBool                         aIsRecursiveCall)
 {
  NS_PRECONDITION(!IsFrameSpecial(aParentFrame) ||
                  !GetSpecialSibling(aParentFrame) ||
@ -5788,13 +5661,15 @@ nsCSSFrameConstructor::AppendFrames(nsFrameConstructorState&       aState,

  NS_ASSERTION(nextSibling ||
               !aParentFrame->GetNextContinuation() ||
-               !aParentFrame->GetNextContinuation()->GetFirstChild(nsnull),
+               !aParentFrame->GetNextContinuation()->GetFirstChild(nsnull) ||
+               aIsRecursiveCall,
               "aParentFrame has later continuations with kids?");
  NS_ASSERTION(nextSibling ||
               !IsFrameSpecial(aParentFrame) ||
               (IsInlineFrame(aParentFrame) &&
                !GetSpecialSibling(aParentFrame) &&
-                !aParentFrame->GetNextContinuation()),
+                !aParentFrame->GetNextContinuation()) ||
+               aIsRecursiveCall,
               "aParentFrame is not last?");

  // If we're inserting a list of frames at the end of the trailing inline
@ -5809,7 +5684,7 @@ nsCSSFrameConstructor::AppendFrames(nsFrameConstructorState&       aState,
    // initial parent, because that could screw up float parenting; it's easier
    // to do this little fixup here instead.
    if (aFrameList.NotEmpty() && !IsInlineOutside(aFrameList.FirstChild())) {
-      // See whether out trailing inline is empty
+      // See whether our trailing inline is empty
      nsIFrame* firstContinuation = aParentFrame->GetFirstContinuation();
      if (firstContinuation->GetChildList(nsnull).IsEmpty()) {
        // Our trailing inline is empty.  Collect our starting blocks from
@ -5854,13 +5729,13 @@ nsCSSFrameConstructor::AppendFrames(nsFrameConstructorState&       aState,

      // Recurse so we create new ib siblings as needed for aParentFrame's parent
      return AppendFrames(aState, aParentFrame->GetParent(), ibSiblings,
-                          aParentFrame);
+                          aParentFrame, PR_TRUE);
    }

    return NS_OK;
  }
  
-  // Insert the frames after out aPrevSibling
+  // Insert the frames after our aPrevSibling
  return aState.mFrameManager->InsertFrames(aParentFrame, nsnull, aPrevSibling,
                                            aFrameList);
 }
@ -6995,215 +6870,6 @@ nsCSSFrameConstructor::ContentInserted(nsIContent*            aContainer,
  return NS_OK;
 }

-static void
-DoDeletingFrameSubtree(nsFrameManager*      aFrameManager,
-                       nsTArray<nsIFrame*>& aDestroyQueue,
-                       nsIFrame*            aRemovedFrame,
-                       nsIFrame*            aFrame);
-
-static void
-DoDeletingOverflowContainers(nsFrameManager*      aFrameManager,
-                             nsTArray<nsIFrame*>& aDestroyQueue,
-                             nsIFrame*            aRemovedFrame,
-                             nsIFrame*            aFrame)
-{
-  // The invariant that "continuing frames should be found as part of the
-  // walk over the top-most frame's continuing frames" does not hold for
-  // out-of-flow overflow containers, so we need to walk them too.
-  // Note that DoDeletingFrameSubtree() skips the child lists where
-  // overflow containers live so we won't process them twice.
-  const PRBool orphanSubtree = aRemovedFrame == aFrame;
-  for (nsIFrame* next = aFrame->GetNextContinuation();
-       next && (next->GetStateBits() & NS_FRAME_IS_OVERFLOW_CONTAINER);
-       next = next->GetNextContinuation()) {
-    DoDeletingFrameSubtree(aFrameManager, aDestroyQueue,
-                           orphanSubtree ? next : aRemovedFrame,
-                           next);
-  }
-}
-
-/**
- * Called when a frame subtree is about to be deleted. Two important
- * things happen:
- *
- * 1. For each frame in the subtree, we remove the mapping from the
- *    content object to its frame
- *
- * 2. For child frames that have been moved out of the flow, we enqueue
- *    the out-of-flow frame for deletion *if* the out-of-flow frame's
- *    geometric parent is not in |aRemovedFrame|'s hierarchy (e.g., an
- *    absolutely positioned element that has been promoted to be a direct
- *    descendant of an area frame).
- *
- * Note: this function should only be called by DeletingFrameSubtree()
- *
- * @param   aRemovedFrame this is the frame that was removed from the
- *            content model. As we recurse we need to remember this so we
- *            can check if out-of-flow frames are a descendant of the frame
- *            being removed
- * @param   aFrame the local subtree that is being deleted. This is initially
- *            the same as aRemovedFrame, but as we recurse down the tree
- *            this changes
- */
-static void
-DoDeletingFrameSubtree(nsFrameManager*      aFrameManager,
-                       nsTArray<nsIFrame*>& aDestroyQueue,
-                       nsIFrame*            aRemovedFrame,
-                       nsIFrame*            aFrame)
-{
-#undef RECURSE
-#define RECURSE(top, child)                                                  \
-  DoDeletingFrameSubtree(aFrameManager, aDestroyQueue, (top), (child));      \
-  DoDeletingOverflowContainers(aFrameManager, aDestroyQueue, (top), (child));
-
-  // Remove the mapping from the content object to its frame.
-  nsIContent* content = aFrame->GetContent();
-  if (content) {
-    aFrameManager->RemoveAsPrimaryFrame(content, aFrame);
-    aFrameManager->ClearAllUndisplayedContentIn(content);
-  }
-
-  nsIAtom* childListName = nsnull;
-  PRInt32 childListIndex = 0;
-
-  do {
-    // Walk aFrame's normal flow child frames looking for placeholder frames.
-    nsIFrame* childFrame = aFrame->GetFirstChild(childListName);
-    for (; childFrame; childFrame = childFrame->GetNextSibling()) {
-      NS_ASSERTION(!(childFrame->GetStateBits() & NS_FRAME_OUT_OF_FLOW),
-                   "out-of-flow on wrong child list");
-      if (NS_LIKELY(nsGkAtoms::placeholderFrame != childFrame->GetType())) {
-        RECURSE(aRemovedFrame, childFrame);
-      } else {
-        nsIFrame* outOfFlowFrame =
-          nsPlaceholderFrame::GetRealFrameForPlaceholder(childFrame);
-  
-        // Don't SetOutOfFlowFrame(nsnull) here because the float cache depends
-        // on it when the float is removed later on, see bug 348688 comment 6.
-        
-        // Queue the out-of-flow frame to be destroyed only if aRemovedFrame is _not_
-        // one of its ancestor frames or if it is a popup frame. 
-        // If aRemovedFrame is an ancestor of the out-of-flow frame, then 
-        // the out-of-flow frame will be destroyed by aRemovedFrame.
-        if (outOfFlowFrame->GetStyleDisplay()->mDisplay == NS_STYLE_DISPLAY_POPUP ||
-            !nsLayoutUtils::IsProperAncestorFrame(aRemovedFrame, outOfFlowFrame)) {
-          NS_ASSERTION(!aDestroyQueue.Contains(outOfFlowFrame),
-                       "out-of-flow is already in the destroy queue");
-          aDestroyQueue.AppendElement(outOfFlowFrame);
-          // Recurse into the out-of-flow, it is now the aRemovedFrame.
-          RECURSE(outOfFlowFrame, outOfFlowFrame);
-        }
-        else {
-          // Also recurse into the out-of-flow when it's a descendant of aRemovedFrame
-          // since we don't walk those lists, see |childListName| increment below.
-          RECURSE(aRemovedFrame, outOfFlowFrame);
-        }
-      }
-    }
-
-    // Move to next child list but skip lists with frames we should have
-    // a placeholder for or that contains only next-in-flow overflow containers
-    // (which we walk explicitly above).
-    do {
-      childListName = aFrame->GetAdditionalChildListName(childListIndex++);
-    } while (IsOutOfFlowList(childListName) ||
-             childListName == nsGkAtoms::overflowContainersList ||
-             childListName == nsGkAtoms::excessOverflowContainersList);
-  } while (childListName);
-}
-
-/**
- * Called when a frame is about to be deleted. Calls DoDeletingFrameSubtree()
- * for aFrame and each of its continuing frames
- */
-static nsresult
-DeletingFrameSubtree(nsFrameManager* aFrameManager,
-                     nsIFrame*       aFrame)
-{
-  NS_ENSURE_TRUE(aFrame, NS_OK); // XXXldb Remove this sometime in the future.
-
-  // If there's no frame manager it's probably because the pres shell is
-  // being destroyed.
-  if (NS_UNLIKELY(!aFrameManager)) {
-    return NS_OK;
-  }
-
-  nsAutoTArray<nsIFrame*, 8> destroyQueue;
-
-  // If it's a "special" block-in-inline frame, then we can't really deal.
-  // That really shouldn't be happening.
-  NS_ASSERTION(!IsFrameSpecial(aFrame),
-               "DeletingFrameSubtree on a special frame.  Prepare to crash.");
-
-  do {
-    DoDeletingFrameSubtree(aFrameManager, destroyQueue, aFrame, aFrame);
-
-    // If it's split, then get the continuing frame. Note that we only do
-    // this for the top-most frame being deleted. Don't do it if we're
-    // recursing over a subtree, because those continuing frames should be
-    // found as part of the walk over the top-most frame's continuing frames.
-    // Walking them again will make this an N^2/2 algorithm.
-    // The above is true for normal child next-in-flows but not overflow
-    // containers which we do walk because they *can* escape the subtree
-    // we're deleting.  We skip [excess]overflowContainersList where
-    // they live to avoid processing them more than once.
-    aFrame = aFrame->GetNextContinuation();
-  } while (aFrame);
-
-  // Now destroy any out-of-flow frames that have been enqueued for
-  // destruction.
-  for (PRInt32 i = destroyQueue.Length() - 1; i >= 0; --i) {
-    nsIFrame* outOfFlowFrame = destroyQueue[i];
-
-    // Ask the out-of-flow's parent to delete the out-of-flow
-    // frame from the right list.
-    aFrameManager->RemoveFrame(outOfFlowFrame->GetParent(),
-                               GetChildListNameFor(outOfFlowFrame),
-                               outOfFlowFrame);
-  }
-
-  return NS_OK;
-}
-
-nsresult
-nsCSSFrameConstructor::RemoveMappingsForFrameSubtree(nsIFrame* aRemovedFrame)
-{
-  NS_ASSERTION(!(aRemovedFrame->GetStateBits() & NS_FRAME_OUT_OF_FLOW),
-               "RemoveMappingsForFrameSubtree doesn't handle out-of-flows");
-
-  if (NS_UNLIKELY(mIsDestroyingFrameTree)) {
-    // The frame tree might not be in a consistent state after
-    // WillDestroyFrameTree() has been called. Most likely we're destroying
-    // the pres shell which means the frame manager takes care of clearing all
-    // mappings so there is no need to walk the frame tree here, bug 372576.
-    return NS_OK;
-  }
-
-  nsFrameManager *frameManager = mPresShell->FrameManager();
-  if (nsGkAtoms::placeholderFrame == aRemovedFrame->GetType()) {
-    nsIFrame *placeholderFrame = aRemovedFrame;
-    do {
-      NS_ASSERTION(placeholderFrame->GetType() == nsGkAtoms::placeholderFrame,
-                   "continuation must be of same type");
-      nsIFrame* outOfFlowFrame =
-        nsPlaceholderFrame::GetRealFrameForPlaceholder(placeholderFrame);
-      // Remove the mapping from the out-of-flow frame to its placeholder.
-      frameManager->UnregisterPlaceholderFrame(
-        static_cast<nsPlaceholderFrame*>(placeholderFrame));
-      ::DeletingFrameSubtree(frameManager, outOfFlowFrame);
-      frameManager->RemoveFrame(outOfFlowFrame->GetParent(),
-                                GetChildListNameFor(outOfFlowFrame),
-                                outOfFlowFrame);
-      placeholderFrame = placeholderFrame->GetNextContinuation();
-    } while (placeholderFrame);
-  }
-
-  // Save the frame tree's state before deleting it
-  CaptureStateFor(aRemovedFrame, mTempFrameTreeState);
-
-  return ::DeletingFrameSubtree(frameManager, aRemovedFrame);
-}
-
 nsresult
 nsCSSFrameConstructor::ContentRemoved(nsIContent* aContainer,
                                      nsIContent* aChild,
@ -7385,45 +7051,16 @@ nsCSSFrameConstructor::ContentRemoved(nsIContent* aContainer,
    }
 #endif

-    // Walk the frame subtree deleting any out-of-flow frames, and
-    // remove the mapping from content objects to frames
-    ::DeletingFrameSubtree(frameManager, childFrame);

-    // See if the child frame is an out-of-flow
+    // Notify the parent frame that it should delete the frame
    if (childFrame->GetStateBits() & NS_FRAME_OUT_OF_FLOW) {
-      nsPlaceholderFrame* placeholderFrame =
-        frameManager->GetPlaceholderFrameFor(childFrame);
-      NS_ASSERTION(placeholderFrame, "No placeholder for out-of-flow?");
-
-      // Now we remove the out-of-flow frame
-      // XXX has to be done first for now: for floats, the block's line list
-      // contains an array of pointers to the placeholder - we have to
-      // remove the float first (which gets rid of the lines
-      // reference to the placeholder and float) and then remove the
-      // placeholder
-      rv = frameManager->RemoveFrame(parentFrame,
-                                     GetChildListNameFor(childFrame),
-                                     childFrame);
-
-      // Remove the placeholder frame first (XXX second for now) (so
-      // that it doesn't retain a dangling pointer to memory)
-      nsIFrame* placeholderParent = placeholderFrame->GetParent();
-      ::DeletingFrameSubtree(frameManager, placeholderFrame);
-      rv |= frameManager->RemoveFrame(placeholderParent,
-                                      nsnull, placeholderFrame);
-    } else {
-      // Notify the parent frame that it should delete the frame
-      // check for a table caption which goes on an additional child list with a different parent
-      nsIFrame* outerTableFrame; 
-      if (GetCaptionAdjustedParent(parentFrame, childFrame, &outerTableFrame)) {
-        rv = frameManager->RemoveFrame(outerTableFrame,
-                                       nsGkAtoms::captionList,
-                                       childFrame);
-      }
-      else {
-        rv = frameManager->RemoveFrame(parentFrame, nsnull, childFrame);
-      }
+      childFrame = frameManager->GetPlaceholderFrameFor(childFrame);
+      NS_ASSERTION(childFrame, "Missing placeholder frame for out of flow.");
+      parentFrame = childFrame->GetParent();
    }
+    rv = frameManager->RemoveFrame(nsLayoutUtils::GetChildListNameFor(childFrame),
+                                   childFrame);
+    //XXXfr NS_ENSURE_SUCCESS(rv, rv) ?

    if (isRoot) {
      mRootElementFrame = nsnull;
@ -10306,8 +9943,7 @@ nsCSSFrameConstructor::WrapFramesInFirstLetterFrame(
    }
    else {
      // Take the old textFrame out of the inline parent's child list
-      ::DeletingFrameSubtree(mPresShell->FrameManager(), textFrame);
-      parentFrame->RemoveFrame(nsnull, textFrame);
+      mPresShell->FrameManager()->RemoveFrame(nsnull, textFrame);

      // Insert in the letter frame(s)
      parentFrame->InsertFrames(nsnull, prevFrame, letterFrames);
@ -10453,12 +10089,8 @@ nsCSSFrameConstructor::RemoveFloatingFirstLetterFrames(
  // will be destroyed when its letter frame is destroyed).
  nsIFrame* frameToDelete = textFrame->GetLastContinuation();
  while (frameToDelete != textFrame) {
-    nsIFrame* frameToDeleteParent = frameToDelete->GetParent();
    nsIFrame* nextFrameToDelete = frameToDelete->GetPrevContinuation();
-    if (frameToDeleteParent) {
-      ::DeletingFrameSubtree(aFrameManager, frameToDelete);
-      aFrameManager->RemoveFrame(frameToDeleteParent, nsnull, frameToDelete);
-    }
+    aFrameManager->RemoveFrame(nsnull, frameToDelete);
    frameToDelete = nextFrameToDelete;
  }

@ -10470,14 +10102,8 @@ nsCSSFrameConstructor::RemoveFloatingFirstLetterFrames(
         textContent.get(), textFrame, newTextFrame);
 #endif

-  // Remove the float frame
-  ::DeletingFrameSubtree(aFrameManager, floatFrame);
-  aFrameManager->RemoveFrame(aBlockFrame, nsGkAtoms::floatList,
-                             floatFrame);
-
-  // Remove placeholder frame
-  ::DeletingFrameSubtree(aFrameManager, placeholderFrame);
-  aFrameManager->RemoveFrame(parentFrame, nsnull, placeholderFrame);
+  // Remove placeholder frame and the float
+  aFrameManager->RemoveFrame(nsnull, placeholderFrame);

  // Insert text frame in its place
  nsFrameList textList(newTextFrame, newTextFrame);
@ -10522,8 +10148,7 @@ nsCSSFrameConstructor::RemoveFirstLetterFrames(nsPresContext* aPresContext,
      textFrame->Init(textContent, aFrame, nsnull);

      // Next rip out the kid and replace it with the text frame
-      ::DeletingFrameSubtree(aFrameManager, kid);
-      aFrameManager->RemoveFrame(aFrame, nsnull, kid);
+      aFrameManager->RemoveFrame(nsnull, kid);

      // Insert text frame in its place
      nsFrameList textList(textFrame, textFrame);
@ -10604,8 +10229,7 @@ nsCSSFrameConstructor::RecoverLetterFrames(nsIFrame* aBlockFrame)

  if (parentFrame) {
    // Take the old textFrame out of the parents child list
-    ::DeletingFrameSubtree(mPresShell->FrameManager(), textFrame);
-    parentFrame->RemoveFrame(nsnull, textFrame);
+    mPresShell->FrameManager()->RemoveFrame(nsnull, textFrame);

    // Insert in the letter frame(s)
    parentFrame->InsertFrames(nsnull, prevFrame, letterFrames);
--- a/layout/base/nsCSSFrameConstructor.h
+++ b/layout/base/nsCSSFrameConstructor.h
@ -103,6 +103,7 @@ public:
  static void GetAlternateTextFor(nsIContent*    aContent,
                                  nsIAtom*       aTag,  // content object's tag
                                  nsXPIDLString& aAltText);
+
 private: 
  // These are not supported and are not implemented! 
  nsCSSFrameConstructor(const nsCSSFrameConstructor& aCopy); 
@ -308,8 +309,6 @@ public:
                                PRBool          aIsScrollbar,
                                nsILayoutHistoryState* aFrameState);

-  nsresult RemoveMappingsForFrameSubtree(nsIFrame* aRemovedFrame);
-
  // GetInitialContainingBlock() is deprecated in favor of GetRootElementFrame();
  // nsIFrame* GetInitialContainingBlock() { return mRootElementFrame; }
  // This returns the outermost frame for the root element
@ -452,7 +451,8 @@ private:
  nsresult AppendFrames(nsFrameConstructorState&       aState,
                        nsIFrame*                      aParentFrame,
                        nsFrameItems&                  aFrameList,
-                        nsIFrame*                      aPrevSibling);
+                        nsIFrame*                      aPrevSibling,
+                        PRBool                         aIsRecursiveCall = PR_FALSE);

  // BEGIN TABLE SECTION
  /**
--- a/layout/base/nsFrameManager.cpp
+++ b/layout/base/nsFrameManager.cpp
@ -471,8 +471,6 @@ nsFrameManager::RemoveAsPrimaryFrame(nsIContent* aContent,
      PL_DHashTableOperate(&mPrimaryFrameMap, aContent, PL_DHASH_REMOVE);
    }
  }
-
-  aPrimaryFrame->RemovedAsPrimaryFrame();
 }

 void
@ -718,8 +716,7 @@ nsFrameManager::InsertFrames(nsIFrame*       aParentFrame,
 }

 nsresult
-nsFrameManager::RemoveFrame(nsIFrame*       aParentFrame,
-                            nsIAtom*        aListName,
+nsFrameManager::RemoveFrame(nsIAtom*        aListName,
                            nsIFrame*       aOldFrame)
 {
  PRBool wasDestroyingFrames = mIsDestroyingFrames;
@ -733,7 +730,14 @@ nsFrameManager::RemoveFrame(nsIFrame*       aParentFrame,
  // is important in the presence of absolute positioning
  aOldFrame->Invalidate(aOldFrame->GetOverflowRect());

-  nsresult rv = aParentFrame->RemoveFrame(aListName, aOldFrame);
+  NS_ASSERTION(!aOldFrame->GetPrevContinuation() ||
+               // exception for nsCSSFrameConstructor::RemoveFloatingFirstLetterFrames
+               aOldFrame->GetType() == nsGkAtoms::textFrame,
+               "Must remove first continuation.");
+  NS_ASSERTION(!(aOldFrame->GetStateBits() & NS_FRAME_OUT_OF_FLOW &&
+                 GetPlaceholderFrameFor(aOldFrame)),
+               "Must call RemoveFrame on placeholder for out-of-flows.");
+  nsresult rv = aOldFrame->GetParent()->RemoveFrame(aListName, aOldFrame);

  mIsDestroyingFrames = wasDestroyingFrames;

@ -745,17 +749,13 @@ nsFrameManager::RemoveFrame(nsIFrame*       aParentFrame,
 void
 nsFrameManager::NotifyDestroyingFrame(nsIFrame* aFrame)
 {
-  // We've already removed from the primary frame map once, but we're
-  // going to try to do it again here to fix callers of GetPrimaryFrameFor
-  // during frame destruction, since this problem keeps coming back to
-  // bite us.  We may want to remove the previous caller.
-  if (mPrimaryFrameMap.ops) {
-    PrimaryFrameMapEntry *entry = static_cast<PrimaryFrameMapEntry*>
-                                             (PL_DHashTableOperate(&mPrimaryFrameMap, aFrame->GetContent(), PL_DHASH_LOOKUP));
-    if (PL_DHASH_ENTRY_IS_BUSY(entry) && entry->frame == aFrame) {
-      NS_NOTREACHED("frame was not removed from primary frame map before "
-                    "destruction or was readded to map after being removed");
-      PL_DHashTableRawRemove(&mPrimaryFrameMap, entry);
+  //XXXfr Because we destroy most continuation chains starting from the FIF
+  // this does excess work by triggering on every continuation in the chain
+  nsIContent* content = aFrame->GetContent();
+  if (!aFrame->GetPrevContinuation() && content) {
+    RemoveAsPrimaryFrame(content, aFrame);
+    if (content != aFrame->GetParent()->GetContent()) { // first-letter
+      ClearAllUndisplayedContentIn(content);
    }
  }
 }
--- a/layout/base/nsFrameManager.h
+++ b/layout/base/nsFrameManager.h
@ -120,8 +120,7 @@ public:
                                           nsIFrame* aPrimaryFrame);
  // If aPrimaryFrame is the current primary frame for aContent, remove the
  // relevant hashtable entry.  If the current primary frame for aContent is
-  // null, this does nothing.  aPrimaryFrame must not be null, and this method
-  // handles calling RemovedAsPrimaryFrame on aPrimaryFrame.
+  // null, this does nothing.  aPrimaryFrame must not be null.
  NS_HIDDEN_(void)      RemoveAsPrimaryFrame(nsIContent* aContent,
                                             nsIFrame* aPrimaryFrame);
  NS_HIDDEN_(void)      ClearPrimaryFrameMap();
@ -160,8 +159,7 @@ public:
                                    nsIFrame*       aPrevFrame,
                                    nsFrameList&    aFrameList);

-  NS_HIDDEN_(nsresult) RemoveFrame(nsIFrame*       aParentFrame,
-                                   nsIAtom*        aListName,
+  NS_HIDDEN_(nsresult) RemoveFrame(nsIAtom*        aListName,
                                   nsIFrame*       aOldFrame);

  /*
--- a/layout/base/nsLayoutUtils.cpp
+++ b/layout/base/nsLayoutUtils.cpp
@ -180,6 +180,98 @@ GetLastChildFrame(nsIFrame*       aFrame,
  return nsnull;
 }

+//static
+nsIAtom*
+nsLayoutUtils::GetChildListNameFor(nsIFrame* aChildFrame)
+{
+  nsIAtom*      listName;
+
+  if (aChildFrame->GetStateBits() & NS_FRAME_IS_OVERFLOW_CONTAINER) {
+    nsIFrame* pif = aChildFrame->GetPrevInFlow();
+    if (pif->GetParent() == aChildFrame->GetParent()) {
+      listName = nsGkAtoms::excessOverflowContainersList;
+    }
+    else {
+      listName = nsGkAtoms::overflowContainersList;
+    }
+  }
+  // See if the frame is moved out of the flow
+  else if (aChildFrame->GetStateBits() & NS_FRAME_OUT_OF_FLOW) {
+    // Look at the style information to tell
+    const nsStyleDisplay* disp = aChildFrame->GetStyleDisplay();
+
+    if (NS_STYLE_POSITION_ABSOLUTE == disp->mPosition) {
+      listName = nsGkAtoms::absoluteList;
+    } else if (NS_STYLE_POSITION_FIXED == disp->mPosition) {
+      if (nsLayoutUtils::IsReallyFixedPos(aChildFrame)) {
+        listName = nsGkAtoms::fixedList;
+      } else {
+        listName = nsGkAtoms::absoluteList;
+      }
+#ifdef MOZ_XUL
+    } else if (NS_STYLE_DISPLAY_POPUP == disp->mDisplay) {
+      // Out-of-flows that are DISPLAY_POPUP must be kids of the root popup set
+#ifdef DEBUG
+      nsIFrame* parent = aChildFrame->GetParent();
+      NS_ASSERTION(parent && parent->GetType() == nsGkAtoms::popupSetFrame,
+                   "Unexpected parent");
+#endif // DEBUG
+
+      // XXX FIXME: Bug 350740
+      // Return here, because the postcondition for this function actually
+      // fails for this case, since the popups are not in a "real" frame list
+      // in the popup set.
+      return nsGkAtoms::popupList;
+#endif // MOZ_XUL
+    } else {
+      NS_ASSERTION(aChildFrame->GetStyleDisplay()->IsFloating(),
+                   "not a floated frame");
+      listName = nsGkAtoms::floatList;
+    }
+
+  } else {
+    nsIAtom* childType = aChildFrame->GetType();
+    if (nsGkAtoms::menuPopupFrame == childType) {
+      nsIFrame* parent = aChildFrame->GetParent();
+      nsIFrame* firstPopup = (parent)
+                             ? parent->GetFirstChild(nsGkAtoms::popupList)
+                             : nsnull;
+      NS_ASSERTION(!firstPopup || !firstPopup->GetNextSibling(),
+                   "We assume popupList only has one child, but it has more.");
+      listName = (!firstPopup || firstPopup == aChildFrame)
+                 ? nsGkAtoms::popupList
+                 : nsnull;
+    } else if (nsGkAtoms::tableColGroupFrame == childType) {
+      listName = nsGkAtoms::colGroupList;
+    } else if (nsGkAtoms::tableCaptionFrame == aChildFrame->GetType()) {
+      listName = nsGkAtoms::captionList;
+    } else {
+      listName = nsnull;
+    }
+  }
+
+#ifdef NS_DEBUG
+  // Verify that the frame is actually in that child list or in the
+  // corresponding overflow list.
+  nsIFrame* parent = aChildFrame->GetParent();
+  PRBool found = parent->GetChildList(listName).ContainsFrame(aChildFrame);
+  if (!found) {
+    if (!(aChildFrame->GetStateBits() & NS_FRAME_OUT_OF_FLOW)) {
+      found = parent->GetChildList(nsGkAtoms::overflowList)
+                .ContainsFrame(aChildFrame);
+    }
+    else if (aChildFrame->GetStyleDisplay()->IsFloating()) {
+      found = parent->GetChildList(nsGkAtoms::overflowOutOfFlowList)
+                .ContainsFrame(aChildFrame);
+    }
+    // else it's positioned and should have been on the 'listName' child list.
+    NS_POSTCONDITION(found, "not in child list");
+  }
+#endif
+
+  return listName;
+}
+
 // static
 nsIFrame*
 nsLayoutUtils::GetBeforeFrame(nsIFrame* aFrame)
--- a/layout/base/nsLayoutUtils.h
+++ b/layout/base/nsLayoutUtils.h
@ -76,6 +76,13 @@ class nsBlockFrame;
 class nsLayoutUtils
 {
 public:
+
+  /**
+   * Uses heuristics to figure out the appropriate child list name
+   * for aChildFrame.
+   */
+  static nsIAtom* GetChildListNameFor(nsIFrame* aChildFrame);
+
  /**
   * GetBeforeFrame returns the outermost :before frame of the given frame, if
   * one exists.  This is typically O(1).  The frame passed in must be
--- a/layout/base/nsPresContext.cpp
+++ b/layout/base/nsPresContext.cpp
@ -259,14 +259,16 @@ nsPresContext::~nsPresContext()
  NS_PRECONDITION(!mShell, "Presshell forgot to clear our mShell pointer");
  SetShell(nsnull);

-  if (mRefreshDriver) {
-    mRefreshDriver->Disconnect();
-  }
-
  if (mTransitionManager) {
    mTransitionManager->Disconnect();
  }

+  // Disconnect the refresh driver *after* the transition manager, which
+  // needs it.
+  if (mRefreshDriver) {
+    mRefreshDriver->Disconnect();
+  }
+
  if (mEventManager) {
    // unclear if these are needed, but can't hurt
    mEventManager->NotifyDestroyPresContext(this);
--- a/layout/forms/nsComboboxControlFrame.cpp
+++ b/layout/forms/nsComboboxControlFrame.cpp
@ -1210,7 +1210,7 @@ nsComboboxControlFrame::CreateFrameFor(nsIContent*      aContent)
 }

 void
-nsComboboxControlFrame::Destroy()
+nsComboboxControlFrame::DestroyFrom(nsIFrame* aDestructRoot)
 {
  // Revoke any pending RedisplayTextEvent
  mRedisplayTextEvent.Revoke();
@ -1232,10 +1232,10 @@ nsComboboxControlFrame::Destroy()
  }

  // Cleanup frames in popup child list
-  mPopupFrames.DestroyFrames();
+  mPopupFrames.DestroyFramesFrom(aDestructRoot);
  nsContentUtils::DestroyAnonymousContent(&mDisplayContent);
  nsContentUtils::DestroyAnonymousContent(&mButtonContent);
-  nsBlockFrame::Destroy();
+  nsBlockFrame::DestroyFrom(aDestructRoot);
 }


--- a/layout/forms/nsComboboxControlFrame.h
+++ b/layout/forms/nsComboboxControlFrame.h
@ -141,7 +141,7 @@ public:
 #ifdef NS_DEBUG
  NS_IMETHOD GetFrameName(nsAString& aResult) const;
 #endif
-  virtual void Destroy();
+  virtual void DestroyFrom(nsIFrame* aDestructRoot);
  virtual nsFrameList GetChildList(nsIAtom* aListName) const;
  NS_IMETHOD SetInitialChildList(nsIAtom*        aListName,
                                 nsFrameList&    aChildList);
--- a/layout/forms/nsFileControlFrame.cpp
+++ b/layout/forms/nsFileControlFrame.cpp
@ -77,6 +77,8 @@
 #ifdef ACCESSIBILITY
 #include "nsIAccessibilityService.h"
 #endif
+#include "nsIVariant.h"
+#include "nsIContentPrefService.h"

 #define SYNC_TEXT 0x1
 #define SYNC_BUTTON 0x2
@ -121,7 +123,7 @@ nsFileControlFrame::Init(nsIContent* aContent,
 }

 void
-nsFileControlFrame::Destroy()
+nsFileControlFrame::DestroyFrom(nsIFrame* aDestructRoot)
 {
  mTextFrame = nsnull;
  ENSURE_TRUE(mContent);
@ -147,7 +149,7 @@ nsFileControlFrame::Destroy()
  }

  mMouseListener->ForgetFrame();
-  nsBlockFrame::Destroy();
+  nsBlockFrame::DestroyFrom(aDestructRoot);
 }

 nsresult
@ -343,6 +345,13 @@ nsFileControlFrame::MouseListener::MouseClick(nsIDOMEvent* aMouseEvent)
        filePicker->SetDefaultString(leafName);
      }
    }
+  } else {
+    // Attempt to retrieve the last used directory from the content pref service
+    nsCOMPtr<nsILocalFile> localFile = do_CreateInstance(NS_LOCAL_FILE_CONTRACTID);
+    if (!localFile)
+      return NS_ERROR_OUT_OF_MEMORY;
+    if (NS_SUCCEEDED(FetchLastUsedDirectory(doc->GetDocumentURI(), localFile)))
+      filePicker->SetDisplayDirectory(localFile);
  }

  // Tell our textframe to remember the currently focused value
@ -372,6 +381,7 @@ nsFileControlFrame::MouseListener::MouseClick(nsIDOMEvent* aMouseEvent)
    NS_ENSURE_SUCCESS(result, result);

    nsCOMPtr<nsISupports> tmp;
+    PRBool prefSaved = PR_FALSE;
    while (NS_SUCCEEDED(iter->GetNext(getter_AddRefs(tmp)))) {
      nsCOMPtr<nsIFile> file = do_QueryInterface(tmp);
      if (file) {
@ -380,6 +390,11 @@ nsFileControlFrame::MouseListener::MouseClick(nsIDOMEvent* aMouseEvent)
        if (!unicodePath.IsEmpty()) {
          newFileNames.AppendElement(unicodePath);
        }
+        if (!prefSaved) {
+          // Store the last used directory using the content pref service
+          StoreLastUsedDirectory(doc->GetDocumentURI(), file);
+          prefSaved = PR_TRUE;
+        }
      }
    }
  }
@ -392,6 +407,8 @@ nsFileControlFrame::MouseListener::MouseClick(nsIDOMEvent* aMouseEvent)
      if (!unicodePath.IsEmpty()) {
        newFileNames.AppendElement(unicodePath);
      }
+      // Store the last used directory using the content pref service
+      StoreLastUsedDirectory(doc->GetDocumentURI(), localFile);
    }
  }

@ -412,6 +429,60 @@ nsFileControlFrame::MouseListener::MouseClick(nsIDOMEvent* aMouseEvent)
  return NS_OK;
 }

+nsresult
+nsFileControlFrame::FetchLastUsedDirectory(nsIURI* aURI, nsILocalFile* aFile)
+{
+  // Attempt to get the CPS, if it's not present we'll just return
+  nsCOMPtr<nsIContentPrefService> contentPrefService =
+    do_GetService(NS_CONTENT_PREF_SERVICE_CONTRACTID);
+  if (!contentPrefService)
+    return NS_ERROR_NOT_AVAILABLE;
+  nsCOMPtr<nsIWritableVariant> uri = do_CreateInstance(NS_VARIANT_CONTRACTID);
+  if (!uri)
+    return NS_ERROR_OUT_OF_MEMORY;
+  uri->SetAsISupports(aURI);
+  NS_NAMED_LITERAL_STRING(prefName, "lastUploadDirectory");
+
+  // Get the last used directory, if it is stored
+  PRBool hasPref;
+  if (NS_SUCCEEDED(contentPrefService->HasPref(uri, prefName, &hasPref)) && hasPref) {
+    nsCOMPtr<nsIVariant> pref;
+    contentPrefService->GetPref(uri, prefName, getter_AddRefs(pref));
+    nsString prefStr;
+    pref->GetAsAString(prefStr);
+    return aFile->InitWithPath(prefStr);
+  }
+  return NS_OK;
+}
+
+void
+nsFileControlFrame::StoreLastUsedDirectory(nsIURI* aURI, nsIFile* aFile)
+{
+  // Attempt to get the CPS, if it's not present we'll just return
+  nsCOMPtr<nsIContentPrefService> contentPrefService =
+    do_GetService(NS_CONTENT_PREF_SERVICE_CONTRACTID);
+  if (!contentPrefService)
+    return;
+  nsCOMPtr<nsIWritableVariant> uri = do_CreateInstance(NS_VARIANT_CONTRACTID);
+  if (!uri)
+    return;
+  uri->SetAsISupports(aURI);
+  NS_NAMED_LITERAL_STRING(prefName, "lastUploadDirectory");
+
+  // Find the parent of aFile, and store it
+  nsCOMPtr<nsIFile> parentFile;
+  nsString unicodePath;
+  aFile->GetParent(getter_AddRefs(parentFile));
+  parentFile->GetPath(unicodePath);
+  if (!unicodePath.IsEmpty()) {
+    nsCOMPtr<nsIWritableVariant> prefValue = do_CreateInstance(NS_VARIANT_CONTRACTID);
+    if (!prefValue)
+      return;
+    prefValue->SetAsAString(unicodePath);
+    contentPrefService->SetPref(uri, prefName, prefValue);
+  }
+}
+
 nscoord
 nsFileControlFrame::GetMinWidth(nsIRenderingContext *aRenderingContext)
 {
--- a/Show More
+++ b/Show More