Merge m-c to b-s.

2024-11-24 13:21:05 +00:00 · 2011-09-07 10:47:50 -04:00 · 2011-09-07 10:47:50 -04:00 · a0800c6141
commit a0800c6141
parent 6815378be7 b663b676ff
406 changed files with 10229 additions and 4593 deletions
--- a/accessible/public/nsIAccessible.idl
+++ b/accessible/public/nsIAccessible.idl
@ -56,7 +56,7 @@ interface nsIAccessibleRelation;
 * Mozilla creates the implementations of nsIAccessible on demand.
 * See http://www.mozilla.org/projects/ui/accessibility for more information.
 */
-[scriptable, uuid(c7ac764a-b4c5-4479-9fb7-06e3c9f3db34)]
+[scriptable, uuid(3126544c-826c-4694-a2ed-67bfe56a1f37)]
 interface nsIAccessible : nsISupports
 {
  /**
@ -221,26 +221,6 @@ interface nsIAccessible : nsISupports
   */
  nsIAccessible getChildAt(in long aChildIndex);

-  /**
-   * Accessible node geometrically to the right of this one
-   */
-  nsIAccessible getAccessibleToRight();
-
-  /**
-   * Accessible node geometrically to the left of this one
-   */
-  nsIAccessible getAccessibleToLeft();
-
-  /**
-   * Accessible node geometrically above this one
-   */
-  nsIAccessible getAccessibleAbove();
-
-  /**
-   * Accessible node geometrically below this one
-   */
-  nsIAccessible getAccessibleBelow();
-
  /**
   * Return accessible relation by the given relation type (see.
   * constants defined in nsIAccessibleRelation).
--- a/accessible/src/base/nsAccessible.cpp
+++ b/accessible/src/base/nsAccessible.cpp
@ -1974,30 +1974,6 @@ NS_IMETHODIMP nsAccessible::GetHelp(nsAString& _retval)
  return NS_ERROR_NOT_IMPLEMENTED;
 }

-/* nsIAccessible getAccessibleToRight(); */
-NS_IMETHODIMP nsAccessible::GetAccessibleToRight(nsIAccessible **_retval)
-{
-  return NS_ERROR_NOT_IMPLEMENTED;
-}
-
-/* nsIAccessible getAccessibleToLeft(); */
-NS_IMETHODIMP nsAccessible::GetAccessibleToLeft(nsIAccessible **_retval)
-{
-  return NS_ERROR_NOT_IMPLEMENTED;
-}
-
-/* nsIAccessible getAccessibleAbove(); */
-NS_IMETHODIMP nsAccessible::GetAccessibleAbove(nsIAccessible **_retval)
-{
-  return NS_ERROR_NOT_IMPLEMENTED;
-}
-
-/* nsIAccessible getAccessibleBelow(); */
-NS_IMETHODIMP nsAccessible::GetAccessibleBelow(nsIAccessible **_retval)
-{
-  return NS_ERROR_NOT_IMPLEMENTED;
-}
-
 nsIContent*
 nsAccessible::GetAtomicRegion() const
 {
--- a/accessible/src/msaa/nsAccessibleWrap.cpp
+++ b/accessible/src/msaa/nsAccessibleWrap.cpp
@ -810,42 +810,35 @@ __try {
  if (!pvarEndUpAt)
    return E_INVALIDARG;

-  nsAccessible *xpAccessibleStart = GetXPAccessibleFor(varStart);
-  if (!xpAccessibleStart || IsDefunct())
+  nsAccessible* accessible = GetXPAccessibleFor(varStart);
+  if (!accessible || accessible->IsDefunct())
    return E_FAIL;

  VariantInit(pvarEndUpAt);

-  nsCOMPtr<nsIAccessible> xpAccessibleResult;
+  nsAccessible* navAccessible = nsnull;
  PRUint32 xpRelation = 0;

  switch(navDir) {
-    case NAVDIR_DOWN:
-      xpAccessibleStart->GetAccessibleBelow(getter_AddRefs(xpAccessibleResult));
-      break;
    case NAVDIR_FIRSTCHILD:
-      if (!nsAccUtils::MustPrune(xpAccessibleStart))
-        xpAccessibleStart->GetFirstChild(getter_AddRefs(xpAccessibleResult));
+      if (!nsAccUtils::MustPrune(accessible))
+        navAccessible = accessible->FirstChild();
      break;
    case NAVDIR_LASTCHILD:
-      if (!nsAccUtils::MustPrune(xpAccessibleStart))
-        xpAccessibleStart->GetLastChild(getter_AddRefs(xpAccessibleResult));
-      break;
-    case NAVDIR_LEFT:
-      xpAccessibleStart->GetAccessibleToLeft(getter_AddRefs(xpAccessibleResult));
+      if (!nsAccUtils::MustPrune(accessible))
+        navAccessible = accessible->LastChild();
      break;
    case NAVDIR_NEXT:
-      xpAccessibleStart->GetNextSibling(getter_AddRefs(xpAccessibleResult));
+      navAccessible = accessible->NextSibling();
      break;
    case NAVDIR_PREVIOUS:
-      xpAccessibleStart->GetPreviousSibling(getter_AddRefs(xpAccessibleResult));
+      navAccessible = accessible->PrevSibling();
      break;
+    case NAVDIR_DOWN:
+    case NAVDIR_LEFT:
    case NAVDIR_RIGHT:
-      xpAccessibleStart->GetAccessibleToRight(getter_AddRefs(xpAccessibleResult));
-      break;
    case NAVDIR_UP:
-      xpAccessibleStart->GetAccessibleAbove(getter_AddRefs(xpAccessibleResult));
-      break;
+      return E_NOTIMPL;

    // MSAA relationship extensions to accNavigate
    case NAVRELATION_CONTROLLED_BY:
@ -896,17 +889,20 @@ __try {
    case NAVRELATION_DESCRIPTION_FOR:
      xpRelation = nsIAccessibleRelation::RELATION_DESCRIPTION_FOR;
      break;
+
+    default:
+      return E_INVALIDARG;
  }

  pvarEndUpAt->vt = VT_EMPTY;

  if (xpRelation) {
    Relation rel = RelationByType(xpRelation);
-    xpAccessibleResult = rel.Next();
+    navAccessible = rel.Next();
  }

-  if (xpAccessibleResult) {
-    pvarEndUpAt->pdispVal = NativeAccessible(xpAccessibleResult);
+  if (navAccessible) {
+    pvarEndUpAt->pdispVal = NativeAccessible(navAccessible);
    pvarEndUpAt->vt = VT_DISPATCH;
    return S_OK;
  }
--- a/aclocal.m4
+++ b/aclocal.m4
@ -16,6 +16,7 @@ builtin(include, build/autoconf/mozheader.m4)dnl
 builtin(include, build/autoconf/acwinpaths.m4)dnl
 builtin(include, build/autoconf/lto.m4)dnl
 builtin(include, build/autoconf/gcc-pr49911.m4)dnl
+builtin(include, build/autoconf/frameptr.m4)dnl

 MOZ_PROG_CHECKMSYS()

--- a/browser/base/content/tabbrowser.xml
+++ b/browser/base/content/tabbrowser.xml
@ -4039,11 +4039,14 @@
      <handler event="dragstart" phase="capturing">
        this.style.MozUserFocus = '';
      </handler>
-      <handler event="mousedown">
+      <handler event="mousedown" phase="capturing">
      <![CDATA[
        if (this.selected) {
          this.style.MozUserFocus = 'ignore';
          this.clientTop; // just using this to flush style updates
+        } else if (this.mOverCloseButton) {
+          // Prevent tabbox.xml from selecting the tab.
+          event.stopPropagation();
        }
      ]]>
      </handler>
--- a/browser/components/sessionstore/src/nsSessionStore.js
+++ b/browser/components/sessionstore/src/nsSessionStore.js
@ -486,6 +486,11 @@ SessionStoreService.prototype = {
      this._forEachBrowserWindow(function(aWindow) {
        this._collectWindowData(aWindow);
      });
+      // we must cache this because _getMostRecentBrowserWindow will always
+      // return null by the time quit-application occurs
+      var activeWindow = this._getMostRecentBrowserWindow();
+      if (activeWindow)
+        this.activeWindowSSiCache = activeWindow.__SSi || "";
      this._dirtyWindows = [];
      break;
    case "quit-application-granted":
@ -1512,6 +1517,13 @@ SessionStoreService.prototype = {
    let lastWindow = this._getMostRecentBrowserWindow();
    let canUseLastWindow = lastWindow &&
                           !lastWindow.__SS_lastSessionWindowID;
+    let lastSessionFocusedWindow = null;
+    this.windowToFocus = lastWindow;
+
+    // move the last focused window to the start of the array so that we
+    // minimize window movement (see bug 669272)
+    lastSessionState.windows.unshift(
+      lastSessionState.windows.splice(lastSessionState.selectedWindow - 1, 1)[0]);

    // Restore into windows or open new ones as needed.
    for (let i = 0; i < lastSessionState.windows.length; i++) {
@ -1549,9 +1561,18 @@ SessionStoreService.prototype = {
        //        weirdness but we will still merge other extData.
        //        Bug 588217 should make this go away by merging the group data.
        this.restoreWindow(windowToUse, { windows: [winState] }, canOverwriteTabs, true);
+        if (i == 0)
+          lastSessionFocusedWindow = windowToUse;
+
+        // if we overwrote the tabs for our last focused window, we should
+        // give focus to the window that had it in the previous session
+        if (canOverwriteTabs && windowToUse == lastWindow)
+          this.windowToFocus = lastSessionFocusedWindow;
      }
      else {
-        this._openWindowWithState({ windows: [winState] });
+        let win = this._openWindowWithState({ windows: [winState] });
+        if (i == 0)
+          lastSessionFocusedWindow = win;
      }
    }

@ -2544,8 +2565,12 @@ SessionStoreService.prototype = {
      this._closedWindows = root._closedWindows;

    var winData;
-    if (!aState.selectedWindow) {
-      aState.selectedWindow = 0;
+    if (!root.selectedWindow) {
+      root.selectedWindow = 0;
+    } else {
+      // put the selected window at the beginning of the array to ensure that
+      // it gets restored first
+      root.windows.unshift(root.windows.splice(root.selectedWindow - 1, 1)[0]);
    }
    // open new windows for all further window entries of a multi-window session
    // (unless they don't contain any tab data)
@ -2553,9 +2578,6 @@ SessionStoreService.prototype = {
      winData = root.windows[w];
      if (winData && winData.tabs && winData.tabs[0]) {
        var window = this._openWindowWithState({ windows: [winData] });
-        if (w == aState.selectedWindow - 1) {
-          this.windowToFocus = window;
-        }
      }
    }
    winData = root.windows[0];
--- a/browser/components/wintaskbar/WindowsJumpLists.jsm
+++ b/browser/components/wintaskbar/WindowsJumpLists.jsm
@ -22,6 +22,7 @@
 * Contributor(s):
 *   Jim Mathies <jmathies@mozilla.com> (Original author)
 *   Marco Bonardo <mak77@bonardo.net>
+ *   Brian R. Bondy <netzen@gmail.com>
 *
 * Alternatively, the contents of this file may be used under the terms of
 * either the GNU General Public License Version 2 or later (the "GPL"), or
@ -331,7 +332,7 @@ var WinTaskbarJumpList =
      if ((this._shuttingDown && !task.close) || (!this._shuttingDown && !task.open))
        return;
      var item = this._getHandlerAppItem(task.title, task.description,
-                                         task.args, task.iconIndex);
+                                         task.args, task.iconIndex, null);
      items.appendElement(item, false);
    }, this);
    
@ -374,7 +375,9 @@ var WinTaskbarJumpList =
        }

        let title = aResult.title || aResult.uri;
-        let shortcut = this._getHandlerAppItem(title, title, aResult.uri, 1);
+        let faviconPageUri = Services.io.newURI(aResult.uri, null, null);
+        let shortcut = this._getHandlerAppItem(title, title, aResult.uri, 1, 
+                                               faviconPageUri);
        items.appendElement(shortcut, false);
        this._frequentHashList.push(aResult.uri);
      },
@ -417,7 +420,9 @@ var WinTaskbarJumpList =
        }

        let title = aResult.title || aResult.uri;
-        let shortcut = this._getHandlerAppItem(title, title, aResult.uri, 1);
+        let faviconPageUri = Services.io.newURI(aResult.uri, null, null);
+        let shortcut = this._getHandlerAppItem(title, title, aResult.uri, 1,
+                                               faviconPageUri);
        items.appendElement(shortcut, false);
        count++;
      },
@ -433,7 +438,9 @@ var WinTaskbarJumpList =
   * Jump list item creation helpers
   */

-  _getHandlerAppItem: function WTBJL__getHandlerAppItem(name, description, args, icon) {
+  _getHandlerAppItem: function WTBJL__getHandlerAppItem(name, description, 
+                                                        args, iconIndex, 
+                                                        faviconPageUri) {
    var file = Services.dirsvc.get("XCurProcD", Ci.nsILocalFile);

    // XXX where can we grab this from in the build? Do we need to?
@ -451,7 +458,8 @@ var WinTaskbarJumpList =
    var item = Cc["@mozilla.org/windows-jumplistshortcut;1"].
               createInstance(Ci.nsIJumpListShortcut);
    item.app = handlerApp;
-    item.iconIndex = icon;
+    item.iconIndex = iconIndex;
+    item.faviconPageUri = faviconPageUri;
    return item;
  },

--- a/browser/devtools/styleinspector/StyleInspector.jsm
+++ b/browser/devtools/styleinspector/StyleInspector.jsm
@ -55,7 +55,13 @@ var StyleInspector = {
    return Services.prefs.getBoolPref("devtools.styleinspector.enabled");
  },

-  createPanel: function SI_createPanel()
+  /**
+   * Factory method to create the actual style panel
+   * @param {Boolean} aPreserveOnHide Prevents destroy from being called
+   * onpopuphide. USE WITH CAUTION: When this value is set to true then you are
+   * responsible to manually call destroy from outside the style inspector.
+   */
+  createPanel: function SI_createPanel(aPreserveOnHide)
  {
    let win = Services.wm.getMostRecentWindow("navigator:browser");
    let popupSet = win.document.getElementById("mainPopupSet");
@ -98,7 +104,10 @@ var StyleInspector = {
    hbox.appendChild(resizer);
    popupSet.appendChild(panel);

-    panel.addEventListener("popupshown", function SI_popup_shown() {
+    /**
+     * Initialize the popup when it is first shown
+     */
+    function SI_popupShown() {
      if (!this.cssHtmlTree) {
        this.cssLogic = new CssLogic();
        this.cssHtmlTree = new CssHtmlTree(iframe, this.cssLogic, this);
@ -107,12 +116,23 @@ var StyleInspector = {
      this.cssLogic.highlight(this.selectedNode);
      this.cssHtmlTree.highlight(this.selectedNode);
      Services.obs.notifyObservers(null, "StyleInspector-opened", null);
-    }, false);
+    }
+
+    /**
+     * Hide the popup and conditionally destroy it
+     */
+    function SI_popupHidden() {
+      if (panel.preserveOnHide) {
+        Services.obs.notifyObservers(null, "StyleInspector-closed", null);
+      } else {
+        panel.destroy();
+      }
+    }
+
+    panel.addEventListener("popupshown", SI_popupShown);
+    panel.addEventListener("popuphidden", SI_popupHidden);
+    panel.preserveOnHide = !!aPreserveOnHide;

-    panel.addEventListener("popuphidden", function SI_popup_hidden() {
-      Services.obs.notifyObservers(null, "StyleInspector-closed", null);
-    }, false);
-    
    /**
     * Check if the style inspector is open
     */
@ -138,6 +158,19 @@ var StyleInspector = {
      }
    };

+    /**
+     * Destroy the style panel, remove listeners etc.
+     */
+    panel.destroy = function SI_destroy()
+    {
+      this.cssLogic = null;
+      this.cssHtmlTree = null;
+      this.removeEventListener("popupshown", SI_popupShown);
+      this.removeEventListener("popuphidden", SI_popupHidden);
+      this.parentNode.removeChild(this);
+      Services.obs.notifyObservers(null, "StyleInspector-closed", null);
+    };
+
    /**
     * Is the Style Inspector initialized?
     * @returns {Boolean} true or false
--- a/browser/devtools/webconsole/HUDService.jsm
+++ b/browser/devtools/webconsole/HUDService.jsm
@ -1786,7 +1786,6 @@ HUD_SERVICE.prototype =
    panels = popupset.querySelectorAll("panel[hudToolId=" + aHUDId + "]");
    for (let i = 0; i < panels.length; i++) {
      panels[i].hidePopup();
-      popupset.removeChild(panels[i]);
    }

    let id = ConsoleUtils.supString(aHUDId);
--- a/browser/locales/en-US/searchplugins/list.txt
+++ b/browser/locales/en-US/searchplugins/list.txt
@ -2,5 +2,6 @@ amazondotcom
 bing
 eBay
 google
+twitter
 wikipedia
 yahoo
--- a/browser/locales/en-US/searchplugins/twitter.xml
+++ b/browser/locales/en-US/searchplugins/twitter.xml
@ -0,0 +1,11 @@
+<SearchPlugin xmlns="http://www.mozilla.org/2006/browser/search/">
+<ShortName>Twitter</ShortName>
+<Description>Realtime Twitter Search</Description>
+<InputEncoding>UTF-8</InputEncoding>
+<Image width="16" height="16">data:image/x-icon;base64,AAABAAEAEBAAAAEAIABoBAAAFgAAACgAAAAQAAAAIAAAAAEAIAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAD///8A////AP///wD///8A////AP///wD///8A////AP///wD///8A////AP///wD///8A////AP///wD///8A////AP///wD///8A/v7+D/7+/j/+/v5g/v7+YP7+/mD+/v5I/v7+KP///wD///8A////AP///wD///8A////AP///wD+/v4H/v7+UPbv4pHgx47B1K9Y3tWwWN7Ur1je3sKCx+rbuKj+/v5n/v7+GP///wD///8A////AP///wD+/v4Y+fbweM2ycMe2iB7/vI0f/8STIf/KlyL/zJki/8yZIv/LmCL/0ahK5/Hp1JH+/v4Y////AP///wD///8A7OTTaquHN+CujkXPs5ZTv6N6G/+2iB7/xpUh/8yZIv/MmSL/zJki/8yZIv/Kmy738OjUi////wD///8A////AMKtfY7w6+Ef////AP///wD///8A3sqbp8iWIf/MmSL/zJki/8yZIv/MmSL/y5gi/8mePO7+/v4w////AP///wD///8A////AP///wD+/v4H/v7+V9CtWN3KmCL/zJki/8yZIv/MmSL/zJki/8yZIv/JlyH/5tSqp/7+/mD+/v4/////AP///wD///8A+PXvJtGyZdXNnS/3y5gi/8qYIv/LmCL/zJki/8yZIv/MmSL/y5gi/82iPO7LqVfe0byMmf///wD///8A/v7+D/Do1JHKmy73ypci/8KSIP+/jyD/xpQh/8uYIv/MmSL/zJki/8qYIv+/jyD/rIEd/9nKqH7///8A////APPu4TzAlSz3wZEg/7mLH/+sgR3/uZdGz7mLH//JlyH/zJki/8yZIv/GlSH/to0r9eXbxD/Vx6dg////AP7+/h/p38WhtIsq9al/HP+kfyjuybaKgf///wCzjzjlwJAg/8qYIv/JlyH/u4wf/8CkYrn///8A////AP///wDj2sRMnHUa/7meYa7Vx6dg////AP///wD///8A2MmnYK6DHf++jiD/vo4g/62CHf/k2sQ/////AP///wD///8A8OvhH/f07w////8A////AP///wD///8A////AP///wC/p3Cfpnwc/66GKvPg1LZ8////AP///wD///8A////AP///wD///8A////AP///wD///8A////AP///wD///8A////ANXHp2DJtoqByLWKgf///wD///8A////AP///wD///8A////AP///wD///8A////AP///wD///8A////AP///wD///8A////AP///wD///8A////AP///wD///8A////AP///wD///8A////AP///wD///8A////AP///wD///8A////AP///wD///8A////AP///wD///8A//8AAP//AADgPwAAwA8AAIAHAAB4BwAA+AMAAPAAAADgAQAA4AMAAMEDAADPhwAA/48AAP/nAAD//wAA//8AAA==</Image>
+<SearchForm>https://twitter.com/search/</SearchForm>
+<Url type="text/html" method="GET" template="https://twitter.com/search/{searchTerms}">
+  <Param name="partner" value="Firefox"/>
+  <Param name="source" value="desktop-search"/>
+</Url>
+</SearchPlugin>
--- a/browser/themes/pinstripe/browser/browser.css
+++ b/browser/themes/pinstripe/browser/browser.css
@ -811,9 +811,22 @@ toolbar[mode="icons"] #zoom-in-button {
  background-clip: padding-box;
 }

-#urlbar:-moz-window-inactive,
-.searchbar-textbox:-moz-window-inactive {
-  border-color: @toolbarbuttonInactiveBorderColor@;
+@media (-moz-mac-lion-theme) {
+  #urlbar,
+  .searchbar-textbox {
+    background-image: -moz-linear-gradient(hsl(0,0%,97%), hsl(0,0%,100%));
+    border-color: hsla(0,0%,0%,.35) hsla(0,0%,0%,.25) hsla(0,0%,0%,.15);
+    box-shadow: 0 1px 0 hsla(0,0%,100%,.2),
+                inset 0 0 1px hsla(0,0%,0%,.05),
+                inset 0 1px 2px hsla(0,0%,0%,.1);
+  }
+}
+
+@media not all and (-moz-mac-lion-theme) {
+  #urlbar:-moz-window-inactive,
+  .searchbar-textbox:-moz-window-inactive {
+    border-color: @toolbarbuttonInactiveBorderColor@;
+  }
 }

 #urlbar[focused="true"],
--- a/build/autoconf/frameptr.m4
+++ b/build/autoconf/frameptr.m4
@ -0,0 +1,25 @@
+dnl Set MOZ_FRAMEPTR_FLAGS to the flags that should be used for enabling or
+dnl disabling frame pointers in this architecture based on the configure
+dnl options
+
+AC_DEFUN([MOZ_SET_FRAMEPTR_FLAGS], [
+  if test "$GNU_CC"; then
+    MOZ_ENABLE_FRAME_PTR="-fno-omit-frame-pointer"
+    MOZ_DISABLE_FRAME_PTR="-fomit-frame-pointer"
+  else
+    case "$target" in
+    *-mingw*)
+      MOZ_ENABLE_FRAME_PTR="-Oy-"
+      MOZ_DISABLE_FRAME_PTR="-Oy"
+    ;;
+    esac
+  fi
+
+  # if we are debugging or profiling, we want a frame pointer.
+  if test -z "$MOZ_OPTIMIZE" -o \
+          -n "$MOZ_PROFILING" -o -n "$MOZ_DEBUG"; then
+    MOZ_FRAMEPTR_FLAGS="$MOZ_ENABLE_FRAME_PTR"
+  else
+    MOZ_FRAMEPTR_FLAGS="$MOZ_DISABLE_FRAME_PTR"
+  fi
+])
--- a/build/autoconf/mozconfig-find
+++ b/build/autoconf/mozconfig-find
@ -40,8 +40,10 @@
 # mozconfigfind - Loads options from .mozconfig onto configure's
 #    command-line. The .mozconfig file is searched for in the 
 #    order:
-#       if $MOZCONFIG is set, use that.
-#       Otherwise, use $TOPSRCDIR/.mozconfig
+#       If $MOZCONFIG is set, use that.
+#       If one of $TOPSRCDIR/.mozconfig or $TOPSRCDIR/mozconfig exists, use it.
+#       If both exist, or if various legacy locations contain a mozconfig, error.
+#       Otherwise, use the default build options.
 #
 topsrcdir=$1

@ -76,8 +78,14 @@ if [ -n "$MOZ_MYCONFIG" ]; then
  exit 1
 fi

+if [ -z "$MOZCONFIG" ] && [ -f "$topsrcdir/.mozconfig" ] && [ -f "$topsrcdir/mozconfig" ]; then
+  echo "Both \$topsrcdir/.mozconfig and \$topsrcdir/mozconfig are supported, but you must choose only one. Please remove the other."
+  exit 1
+fi
+
 for _config in "$MOZCONFIG" \
-               "$topsrcdir/.mozconfig"
+               "$topsrcdir/.mozconfig" \
+               "$topsrcdir/mozconfig"
 do
  if test -f "$_config"; then
    echo `abspath $_config`
@ -88,8 +96,7 @@ done
 # We used to support a number of other implicit .mozconfig locations. We now
 # detect if we were about to use any of these locations and issue an error if we
 # find any.
-for _config in "$topsrcdir/mozconfig" \
-               "$topsrcdir/mozconfig.sh" \
+for _config in "$topsrcdir/mozconfig.sh" \
               "$topsrcdir/myconfig.sh" \
               "$HOME/.mozconfig" \
               "$HOME/.mozconfig.sh" \
--- a/caps/src/nsScriptSecurityManager.cpp
+++ b/caps/src/nsScriptSecurityManager.cpp
@ -2423,7 +2423,7 @@ nsScriptSecurityManager::doGetObjectPrincipal(JSObject *aObj
    // avoid wasting time checking properties of their classes etc in
    // the loop.

-    if (jsClass == &js_FunctionClass) {
+    if (jsClass == &js::FunctionClass) {
        aObj = aObj->getParent();

        if (!aObj)
@ -2431,7 +2431,7 @@ nsScriptSecurityManager::doGetObjectPrincipal(JSObject *aObj

        jsClass = aObj->getClass();

-        if (jsClass == &js_CallClass) {
+        if (jsClass == &js::CallClass) {
            aObj = aObj->getParent();

            if (!aObj)
--- a/config/autoconf.mk.in
+++ b/config/autoconf.mk.in
@ -302,6 +302,7 @@ ACDEFINES	= @MOZ_DEFINES@
 WARNINGS_AS_ERRORS = @WARNINGS_AS_ERRORS@

 MOZ_OPTIMIZE	= @MOZ_OPTIMIZE@
+MOZ_FRAMEPTR_FLAGS = @MOZ_FRAMEPTR_FLAGS@
 MOZ_OPTIMIZE_FLAGS = @MOZ_OPTIMIZE_FLAGS@
 MOZ_PGO_OPTIMIZE_FLAGS = @MOZ_PGO_OPTIMIZE_FLAGS@
 MOZ_OPTIMIZE_LDFLAGS = @MOZ_OPTIMIZE_LDFLAGS@
--- a/config/config.mk
+++ b/config/config.mk
@ -456,6 +456,9 @@ endif # MOZ_OPTIMIZE == 1
 endif # MOZ_OPTIMIZE
 endif # CROSS_COMPILE

+CFLAGS += $(MOZ_FRAMEPTR_FLAGS)
+CXXFLAGS += $(MOZ_FRAMEPTR_FLAGS)
+
 # Check for FAIL_ON_WARNINGS & FAIL_ON_WARNINGS_DEBUG (Shorthand for Makefiles
 # to request that we use the 'warnings as errors' compile flags)

--- a/config/optimizejars.py
+++ b/config/optimizejars.py
@ -303,6 +303,7 @@ def optimizejar(jar, outjar, inlog = None):
        print("WARNING: Found %d duplicate files taking %d bytes"%(dups_found, dupe_bytes))

    dirend.cdir_size = len(cdir_data)
+    dirend.disk_entries = dirend.cdir_entries
    dirend_data = dirend.pack()
    assert_true(size_of(cdir_end) == len(dirend_data), "Failed to serialize directory end correctly. Serialized size;%d, expected:%d"%(len(dirend_data), size_of(cdir_end)));

--- a/configure.in
+++ b/configure.in
@ -1990,12 +1990,7 @@ case "$target" in
 *-darwin*)
    MKSHLIB='$(CXX) $(CXXFLAGS) $(DSO_PIC_CFLAGS) $(DSO_LDOPTS) -o $@'
    MKCSHLIB='$(CC) $(CFLAGS) $(DSO_PIC_CFLAGS) $(DSO_LDOPTS) -o $@'
-    # If we're building with --enable-profiling, we need a frame pointer.
-    if test -z "$MOZ_PROFILING"; then
-        MOZ_OPTIMIZE_FLAGS="-O3 -fomit-frame-pointer"
-    else
-        MOZ_OPTIMIZE_FLAGS="-O3 -fno-omit-frame-pointer"
-    fi
+    MOZ_OPTIMIZE_FLAGS="-O3"
    _PEDANTIC=
    CFLAGS="$CFLAGS -fno-common"
    CXXFLAGS="$CXXFLAGS -fno-common"
@ -2107,12 +2102,7 @@ ia64*-hpux*)
    TARGET_NSPR_MDCPUCFG='\"md/_linux.cfg\"'

    MOZ_GFX_OPTIMIZE_MOBILE=1
-    # If we're building with --enable-profiling, we need a frame pointer.
-    if test -z "$MOZ_PROFILING"; then
-        MOZ_OPTIMIZE_FLAGS="-Os -freorder-blocks -fno-reorder-functions -fomit-frame-pointer"
-    else
-        MOZ_OPTIMIZE_FLAGS="-Os -freorder-blocks -fno-reorder-functions -fno-omit-frame-pointer"
-    fi
+    MOZ_OPTIMIZE_FLAGS="-Os -freorder-blocks -fno-reorder-functions"
    ;;

 *-*linux*)
@ -2130,14 +2120,8 @@ ia64*-hpux*)
            # -Os is broken on gcc 4.1.x 4.2.x, 4.5.x we need to tweak it to get good results.
            MOZ_OPTIMIZE_SIZE_TWEAK="-finline-limit=50"
        esac
-        # If we're building with --enable-profiling, we need a frame pointer.
-        if test -z "$MOZ_PROFILING"; then
-            MOZ_FRAMEPTR_FLAGS="-fomit-frame-pointer"
-        else
-            MOZ_FRAMEPTR_FLAGS="-fno-omit-frame-pointer"
-        fi
-        MOZ_PGO_OPTIMIZE_FLAGS="-O3 $MOZ_FRAMEPTR_FLAGS"
-        MOZ_OPTIMIZE_FLAGS="-Os -freorder-blocks $MOZ_OPTIMIZE_SIZE_TWEAK $MOZ_FRAMEPTR_FLAGS"
+        MOZ_PGO_OPTIMIZE_FLAGS="-O3"
+        MOZ_OPTIMIZE_FLAGS="-Os -freorder-blocks $MOZ_OPTIMIZE_SIZE_TWEAK"
        MOZ_DEBUG_FLAGS="-g"
    fi

@ -2234,12 +2218,7 @@ ia64*-hpux*)
        MOZ_DEBUG_FLAGS='-Zi'
        MOZ_DEBUG_LDFLAGS='-DEBUG -DEBUGTYPE:CV'
        WARNINGS_AS_ERRORS='-WX'
-        # If we're building with --enable-profiling, we need -Oy-, which forces a frame pointer.
-        if test -z "$MOZ_PROFILING"; then
-            MOZ_OPTIMIZE_FLAGS='-O1'
-        else
-            MOZ_OPTIMIZE_FLAGS='-O1 -Oy-'
-        fi
+        MOZ_OPTIMIZE_FLAGS='-O1'
        MOZ_FIX_LINK_PATHS=
        DYNAMIC_XPCOM_LIBS='$(LIBXUL_DIST)/lib/xpcom.lib $(LIBXUL_DIST)/lib/xpcom_core.lib $(LIBXUL_DIST)/lib/mozalloc.lib'
        XPCOM_FROZEN_LDOPTS='$(LIBXUL_DIST)/lib/xpcom.lib $(LIBXUL_DIST)/lib/mozalloc.lib'
@ -6764,6 +6743,8 @@ else
    MOZ_OPTIMIZE=
 fi ], MOZ_OPTIMIZE=1)

+MOZ_SET_FRAMEPTR_FLAGS
+
 if test "$COMPILE_ENVIRONMENT"; then
 if test -n "$MOZ_OPTIMIZE"; then
    AC_MSG_CHECKING([for valid optimization flags])
@ -6782,6 +6763,7 @@ fi
 fi # COMPILE_ENVIRONMENT

 AC_SUBST(MOZ_OPTIMIZE)
+AC_SUBST(MOZ_FRAMEPTR_FLAGS)
 AC_SUBST(MOZ_OPTIMIZE_FLAGS)
 AC_SUBST(MOZ_OPTIMIZE_LDFLAGS)
 AC_SUBST(MOZ_OPTIMIZE_SIZE_TWEAK)
--- a/content/base/public/nsContentUtils.h
+++ b/content/base/public/nsContentUtils.h
@ -83,6 +83,7 @@ static fp_except_t oldmask = fpsetmask(~allmask);
 #include "nsHtml5Parser.h"
 #include "nsIFragmentContentSink.h"
 #include "nsMathUtils.h"
+#include "mozilla/TimeStamp.h"

 struct nsNativeKeyEvent; // Don't include nsINativeKeyBindings.h here: it will force strange compilation error!

@ -189,6 +190,7 @@ class nsContentUtils
 {
  friend class nsAutoScriptBlockerSuppressNodeRemoved;
  typedef mozilla::dom::Element Element;
+  typedef mozilla::TimeDuration TimeDuration;

 public:
  static nsresult Init();
@ -1700,6 +1702,33 @@ public:
   */
  static PRBool IsFocusedContent(const nsIContent *aContent);

+  /**
+   * Returns PR_TRUE if the DOM full-screen API is enabled.
+   */
+  static PRBool IsFullScreenApiEnabled();
+
+  /**
+   * Returns PR_TRUE if requests for full-screen are allowed in the current
+   * context. Requests are only allowed if the user initiated them (like with
+   * a mouse-click or key press), unless this check has been disabled by
+   * setting the pref "full-screen-api.allow-trusted-requests-only" to false.
+   */
+  static PRBool IsRequestFullScreenAllowed();
+
+  /**
+   * Returns PR_TRUE if key input is restricted in DOM full-screen mode
+   * to non-alpha-numeric key codes only. This mirrors the
+   * "full-screen-api.key-input-restricted" pref.
+   */
+  static PRBool IsFullScreenKeyInputRestricted();
+
+  /**
+   * Returns the time limit on handling user input before
+   * nsEventStateManager::IsHandlingUserInput() stops returning PR_TRUE.
+   * This enables us to detect long running user-generated event handlers.
+   */
+  static TimeDuration HandlingUserInputTimeout();
+
  static void GetShiftText(nsAString& text);
  static void GetControlText(nsAString& text);
  static void GetMetaText(nsAString& text);
@ -1864,6 +1893,10 @@ private:

  static PRBool sIsHandlingKeyBoardEvent;
  static PRBool sAllowXULXBL_for_file;
+  static PRBool sIsFullScreenApiEnabled;
+  static PRBool sTrustedFullScreenOnly;
+  static PRBool sFullScreenKeyInputRestricted;
+  static PRUint32 sHandlingInputTimeout;

  static nsHtml5Parser* sHTMLFragmentParser;
  static nsIParser* sXMLFragmentParser;
--- a/content/base/public/nsIDocument.h
+++ b/content/base/public/nsIDocument.h
@ -125,10 +125,9 @@ class Element;
 } // namespace dom
 } // namespace mozilla

-
 #define NS_IDOCUMENT_IID      \
-{ 0x455e4d79, 0x756b, 0x4f73,  \
- { 0x95, 0xea, 0x3f, 0xf6, 0x0c, 0x6a, 0x8c, 0xa6 } }
+{ 0x170d5a75, 0xff0b, 0x4599,  \
+ { 0x9b, 0x68, 0x18, 0xb7, 0x42, 0xe0, 0xf9, 0xf7 } }

 // Flag for AddStyleSheet().
 #define NS_STYLESHEET_FROM_CATALOG                (1 << 0)
@ -742,6 +741,43 @@ public:
  virtual void AddToNameTable(Element* aElement, nsIAtom* aName) = 0;
  virtual void RemoveFromNameTable(Element* aElement, nsIAtom* aName) = 0;

+  /**
+   * Resets the current full-screen element to nsnull.
+   */
+  virtual void ResetFullScreenElement() = 0;
+
+  /**
+   * Returns the element which either is the full-screen element, or
+   * contains the full-screen element if a child of this document contains
+   * the fullscreen element.
+   */
+  virtual Element* GetFullScreenElement() = 0;
+
+  /**
+   * Requests that the document make aElement the full-screen element,
+   * and move into full-screen mode.
+   */
+  virtual void RequestFullScreen(Element* aElement) = 0;
+
+  /**
+   * Requests that the document, and all documents in its hierarchy exit
+   * from DOM full-screen mode.
+   */
+  virtual void CancelFullScreen() = 0;
+
+  /**
+   * Updates the full-screen status on this document, setting the full-screen
+   * mode to aIsFullScreen. This doesn't affect the window's full-screen mode,
+   * this updates the document's internal state which determines whether the
+   * document reports as being in full-screen mode.
+   */
+  virtual void UpdateFullScreenStatus(PRBool aIsFullScreen) = 0;
+
+  /**
+   * Returns PR_TRUE if this document is in full-screen mode.
+   */
+  virtual PRBool IsFullScreenDoc() = 0;
+
  //----------------------------------------------------------------------

  // Document notification API's
--- a/content/base/src/nsContentUtils.cpp
+++ b/content/base/src/nsContentUtils.cpp
@ -176,6 +176,7 @@ static NS_DEFINE_CID(kXTFServiceCID, NS_XTFSERVICE_CID);
 #include "nsIPluginHost.h"
 #include "nsICategoryManager.h"
 #include "nsIViewManager.h"
+#include "nsEventStateManager.h"

 #ifdef IBMBIDI
 #include "nsIBidiKeyboard.h"
@ -200,6 +201,7 @@ static NS_DEFINE_CID(kXTFServiceCID, NS_XTFSERVICE_CID);
 #endif
 #include "nsDOMTouchEvent.h"
 #include "nsIScriptElement.h"
+#include "prdtoa.h"

 #include "mozilla/Preferences.h"

@ -261,6 +263,11 @@ nsString* nsContentUtils::sAltText = nsnull;
 nsString* nsContentUtils::sModifierSeparator = nsnull;

 PRBool nsContentUtils::sInitialized = PR_FALSE;
+PRBool nsContentUtils::sIsFullScreenApiEnabled = PR_FALSE;
+PRBool nsContentUtils::sTrustedFullScreenOnly = PR_TRUE;
+PRBool nsContentUtils::sFullScreenKeyInputRestricted = PR_TRUE;
+
+PRUint32 nsContentUtils::sHandlingInputTimeout = 1000;

 nsHtml5Parser* nsContentUtils::sHTMLFragmentParser = nsnull;
 nsIParser* nsContentUtils::sXMLFragmentParser = nsnull;
@ -315,6 +322,13 @@ class nsSameOriginChecker : public nsIChannelEventSink,
  NS_DECL_NSIINTERFACEREQUESTOR
 };

+/* static */
+TimeDuration
+nsContentUtils::HandlingUserInputTimeout()
+{
+  return TimeDuration::FromMilliseconds(sHandlingInputTimeout);
+}
+
 // static
 nsresult
 nsContentUtils::Init()
@ -384,6 +398,19 @@ nsContentUtils::Init()
  Preferences::AddBoolVarCache(&sAllowXULXBL_for_file,
                               "dom.allow_XUL_XBL_for_file");

+  Preferences::AddBoolVarCache(&sIsFullScreenApiEnabled,
+                               "full-screen-api.enabled");
+
+  Preferences::AddBoolVarCache(&sTrustedFullScreenOnly,
+                               "full-screen-api.allow-trusted-requests-only");
+
+  Preferences::AddBoolVarCache(&sFullScreenKeyInputRestricted,
+                               "full-screen-api.key-input-restricted");
+
+  Preferences::AddUintVarCache(&sHandlingInputTimeout,
+                               "dom.event.handling-user-input-time-limit",
+                               1000);
+
  sInitialized = PR_TRUE;

  return NS_OK;
@ -5696,3 +5723,20 @@ nsContentUtils::IsPatternMatching(nsAString& aValue, nsAString& aPattern,

  return res == JS_FALSE || rval != JSVAL_NULL;
 }
+
+PRBool
+nsContentUtils::IsFullScreenApiEnabled()
+{
+  return sIsFullScreenApiEnabled;
+}
+
+PRBool nsContentUtils::IsRequestFullScreenAllowed()
+{
+  return !sTrustedFullScreenOnly || nsEventStateManager::IsHandlingUserInput();
+}
+
+PRBool
+nsContentUtils::IsFullScreenKeyInputRestricted()
+{
+  return sFullScreenKeyInputRestricted;
+}
--- a/content/base/src/nsDocument.cpp
+++ b/content/base/src/nsDocument.cpp
@ -181,6 +181,7 @@
 #include "nsGlobalWindow.h"
 #include "mozilla/dom/indexedDB/IndexedDatabaseManager.h"
 #include "nsDOMNavigationTiming.h"
+#include "nsEventStateManager.h"

 #ifdef MOZ_SMIL
 #include "nsSMILAnimationController.h"
@ -1544,6 +1545,7 @@ nsDOMImplementation::CreateHTMLDocument(const nsAString& aTitle,
 nsDocument::nsDocument(const char* aContentType)
  : nsIDocument()
  , mAnimatingImages(PR_TRUE)
+  , mIsFullScreen(PR_FALSE)
 {
  SetContentTypeInternal(nsDependentCString(aContentType));
  
@ -1871,6 +1873,7 @@ NS_IMPL_CYCLE_COLLECTION_TRAVERSE_BEGIN_INTERNAL(nsDocument)
                                                       nsIDOMNodeList)
  NS_IMPL_CYCLE_COLLECTION_TRAVERSE_NSCOMPTR(mOriginalDocument)
  NS_IMPL_CYCLE_COLLECTION_TRAVERSE_NSCOMPTR(mCachedEncoder)
+  NS_IMPL_CYCLE_COLLECTION_TRAVERSE_NSCOMPTR(mFullScreenElement)
  NS_IMPL_CYCLE_COLLECTION_TRAVERSE_NSCOMPTR(mStateObjectCached)

  // Traverse all our nsCOMArrays.
@ -1927,6 +1930,7 @@ NS_IMPL_CYCLE_COLLECTION_UNLINK_BEGIN(nsDocument)
  NS_IMPL_CYCLE_COLLECTION_UNLINK_NSCOMPTR(mImageMaps)
  NS_IMPL_CYCLE_COLLECTION_UNLINK_NSCOMPTR(mOriginalDocument)
  NS_IMPL_CYCLE_COLLECTION_UNLINK_NSCOMPTR(mCachedEncoder)
+  NS_IMPL_CYCLE_COLLECTION_UNLINK_NSCOMPTR(mFullScreenElement)

  tmp->mParentDocument = nsnull;

@ -8465,6 +8469,221 @@ nsIDocument::SizeOf() const
  return size;
 }

+// Returns the root document in a document hierarchy.
+static nsIDocument*
+GetRootDocument(nsIDocument* aDoc)
+{
+  if (!aDoc) {
+    return nsnull;
+  }
+  nsCOMPtr<nsIPresShell> shell = aDoc->GetShell();
+  if (!shell) {
+    return nsnull;
+  }
+  nsPresContext* ctx = shell->GetPresContext();
+  if (!ctx) {
+    return nsnull;
+  }
+  nsRootPresContext* rpc = ctx->GetRootPresContext();
+  if (!rpc) {
+    return nsnull;
+  }
+  return rpc->Document();
+}
+
+class nsDispatchFullScreenChange : public nsRunnable
+{
+public:
+  nsDispatchFullScreenChange(nsIDocument *aDoc)
+    : mDoc(aDoc)
+  {
+    mTarget = aDoc->GetFullScreenElement();
+    if (!mTarget) {
+      mTarget = aDoc;
+    }
+  }
+
+  NS_IMETHOD Run()
+  {
+    nsContentUtils::DispatchTrustedEvent(mDoc,
+                                         mTarget,
+                                         NS_LITERAL_STRING("mozfullscreenchange"),
+                                         PR_TRUE,
+                                         PR_FALSE);
+    return NS_OK;
+  }
+
+  nsCOMPtr<nsIDocument> mDoc;
+  nsCOMPtr<nsISupports> mTarget;
+};
+
+void
+nsDocument::UpdateFullScreenStatus(PRBool aIsFullScreen)
+{
+  if (mIsFullScreen != aIsFullScreen) {
+    nsCOMPtr<nsIRunnable> event(new nsDispatchFullScreenChange(this));
+    NS_DispatchToCurrentThread(event);
+  }
+  mIsFullScreen = aIsFullScreen;
+  if (!mIsFullScreen) {
+    // Full-screen is being turned off. Reset the full-screen element, to
+    // save us from having to traverse the document hierarchy again in
+    // MozCancelFullScreen().
+    ResetFullScreenElement();
+  }
+}
+
+static PRBool
+UpdateFullScreenStatus(nsIDocument* aDocument, void* aData)
+{
+  aDocument->UpdateFullScreenStatus(*static_cast<PRBool*>(aData));
+  aDocument->EnumerateSubDocuments(UpdateFullScreenStatus, aData);
+  return PR_TRUE;
+}
+
+static void
+UpdateFullScreenStatusInDocTree(nsIDocument* aDoc, PRBool aIsFullScreen)
+{
+  nsIDocument* root = GetRootDocument(aDoc);
+  if (root) {
+    UpdateFullScreenStatus(root, static_cast<void*>(&aIsFullScreen));
+  }
+}
+
+void
+nsDocument::ResetFullScreenElement()
+{
+  if (mFullScreenElement) {
+    nsEventStateManager::SetFullScreenState(mFullScreenElement, PR_FALSE);
+  }
+  mFullScreenElement = nsnull;
+}
+
+static PRBool
+ResetFullScreenElement(nsIDocument* aDocument, void* aData)
+{
+  aDocument->ResetFullScreenElement();
+  aDocument->EnumerateSubDocuments(ResetFullScreenElement, aData);
+  return PR_TRUE;
+}
+
+static void
+ResetFullScreenElementInDocTree(nsIDocument* aDoc)
+{
+  nsIDocument* root = GetRootDocument(aDoc);
+  if (root) {
+    ResetFullScreenElement(root, nsnull);
+  }
+}
+
+NS_IMETHODIMP
+nsDocument::MozCancelFullScreen()
+{
+  if (!nsContentUtils::IsRequestFullScreenAllowed()) {
+    return NS_OK;
+  }
+  CancelFullScreen();
+  return NS_OK;
+}
+
+void
+nsDocument::CancelFullScreen()
+{
+  if (!nsContentUtils::IsFullScreenApiEnabled() ||
+      !IsFullScreenDoc() ||
+      !GetWindow()) {
+    return;
+  }
+
+  // Disable full-screen mode in all documents in this hierarchy.
+  UpdateFullScreenStatusInDocTree(this, PR_FALSE);
+
+  // Move the window out of full-screen mode.
+  GetWindow()->SetFullScreen(PR_FALSE);
+
+  return;
+}
+
+PRBool
+nsDocument::IsFullScreenDoc()
+{
+  return nsContentUtils::IsFullScreenApiEnabled() && mIsFullScreen;
+}
+
+void
+nsDocument::RequestFullScreen(Element* aElement)
+{
+  if (!aElement || !nsContentUtils::IsFullScreenApiEnabled() || !GetWindow()) {
+    return;
+  }
+
+  // Reset the full-screen elements of every document in this document
+  // hierarchy.
+  ResetFullScreenElementInDocTree(this);
+  
+  if (aElement->IsInDoc()) {
+    // Propagate up the document hierarchy, setting the full-screen element as
+    // the element's container in ancestor documents. Note we don't propagate
+    // down the document hierarchy, the full-screen element (or its container)
+    // is not visible there.
+    mFullScreenElement = aElement;
+    // Set the full-screen state on the element, so the css-pseudo class
+    // applies to the element.
+    nsEventStateManager::SetFullScreenState(mFullScreenElement, PR_TRUE);
+    nsIDocument* child = this;
+    nsIDocument* parent;
+    while (parent = child->GetParentDocument()) {
+      nsIContent* content = parent->FindContentForSubDocument(child);
+      nsCOMPtr<Element> element(do_QueryInterface(content));
+      // Containing frames also need the css-pseudo class applied.
+      nsEventStateManager::SetFullScreenState(element, PR_TRUE);
+      static_cast<nsDocument*>(parent)->mFullScreenElement = element;
+      child = parent;
+    }
+  }
+
+  // Set all documents in hierarchy to full-screen mode.
+  UpdateFullScreenStatusInDocTree(this, PR_TRUE);
+
+  // Make the window full-screen. Note we must make the state changes above
+  // before making the window full-screen, as then the document reports as
+  // being in full-screen mode when the Chrome "fullscreen" event fires,
+  // enabling browser.js to distinguish between browser and dom full-screen
+  // modes.
+  GetWindow()->SetFullScreen(PR_TRUE);
+}
+
+NS_IMETHODIMP
+nsDocument::GetMozFullScreenElement(nsIDOMHTMLElement **aFullScreenElement)
+{
+  NS_ENSURE_ARG_POINTER(aFullScreenElement);
+  if (!nsContentUtils::IsFullScreenApiEnabled() || !IsFullScreenDoc()) {
+    *aFullScreenElement = nsnull;
+    return NS_OK;
+  }
+  nsCOMPtr<nsIDOMHTMLElement> e(do_QueryInterface(GetFullScreenElement()));
+  NS_IF_ADDREF(*aFullScreenElement = e);
+  return NS_OK;
+}
+
+Element*
+nsDocument::GetFullScreenElement()
+{
+  if (!nsContentUtils::IsFullScreenApiEnabled() ||
+      (mFullScreenElement && !mFullScreenElement->IsInDoc())) {
+    return nsnull;
+  }
+  return mFullScreenElement;
+}
+
+NS_IMETHODIMP
+nsDocument::GetMozFullScreen(PRBool *aFullScreen)
+{
+  NS_ENSURE_ARG_POINTER(aFullScreen);
+  *aFullScreen = nsContentUtils::IsFullScreenApiEnabled() && IsFullScreenDoc();
+  return NS_OK;
+}
+
 PRInt64
 nsDocument::SizeOf() const
 {
--- a/content/base/src/nsDocument.h
+++ b/content/base/src/nsDocument.h
@ -941,6 +941,13 @@ public:

  virtual Element* FindImageMap(const nsAString& aNormalizedMapName);

+  virtual void ResetFullScreenElement();
+  virtual Element* GetFullScreenElement();
+  virtual void RequestFullScreen(Element* aElement);
+  virtual void CancelFullScreen();
+  virtual void UpdateFullScreenStatus(PRBool aIsFullScreen);
+  virtual PRBool IsFullScreenDoc();
+
 protected:
  friend class nsNodeUtils;

@ -1078,6 +1085,9 @@ protected:
  // Recorded time of change to 'loading' state.
  mozilla::TimeStamp mLoadingTimeStamp;

+  // The current full-screen element of this document.
+  nsCOMPtr<Element> mFullScreenElement;
+
  // True if the document has been detached from its content viewer.
  PRPackedBool mIsGoingAway:1;
  // True if the document is being destroyed.
@ -1110,6 +1120,9 @@ protected:
  // Whether we currently require our images to animate
  PRPackedBool mAnimatingImages:1;

+  // Whether we are currently in full-screen mode, as per the DOM API.
+  PRPackedBool mIsFullScreen:1;
+
  PRUint8 mXMLDeclarationBits;

  PRUint8 mDefaultElementType;
--- a/content/base/src/nsGkAtomList.h
+++ b/content/base/src/nsGkAtomList.h
@ -63,6 +63,7 @@

 GK_ATOM(_empty, "")
 GK_ATOM(moz, "_moz")
+GK_ATOM(mozallowfullscreen, "mozallowfullscreen")
 GK_ATOM(moztype, "_moz-type")
 GK_ATOM(mozdirty, "_moz_dirty")
 GK_ATOM(mozdonotsend, "moz-do-not-send")
@ -583,6 +584,7 @@ GK_ATOM(mouseout, "mouseout")
 GK_ATOM(mouseover, "mouseover")
 GK_ATOM(mousethrough, "mousethrough")
 GK_ATOM(mouseup, "mouseup")
+GK_ATOM(mozfullscreenchange, "mozfullscreenchange")
 GK_ATOM(moz_opaque, "moz-opaque")
 GK_ATOM(moz_action_hint, "mozactionhint")
 GK_ATOM(x_moz_errormessage, "x-moz-errormessage")
@ -695,6 +697,7 @@ GK_ATOM(onMozMouseHittest, "onMozMouseHittest")
 GK_ATOM(onmouseup, "onmouseup")
 GK_ATOM(onMozAfterPaint, "onMozAfterPaint")
 GK_ATOM(onMozBeforePaint, "onMozBeforePaint")
+GK_ATOM(onmozfullscreenchange, "onmozfullscreenchange")
 GK_ATOM(onMozMousePixelScroll, "onMozMousePixelScroll")
 GK_ATOM(onMozScrolledAreaChanged, "onMozScrolledAreaChanged")
 GK_ATOM(ononline, "ononline")
--- a/content/base/test/test_bug482935.html
+++ b/content/base/test/test_bug482935.html
@ -38,51 +38,6 @@ function testCancelInPhase4() {

          xhr2.addEventListener("load", function() {
            is(xhr2.responseText, "0", "Received fresh value for second request");
-            testCancelBeforePhase4();
-          }, false);
-
-          xhr2.open("GET", url);
-          xhr2.setRequestHeader("X-Request", "1", false);
-
-          try { xhr2.send(); }
-          catch(e) {
-            is(xhr2.status, "200", "Exception!");
-          }
-        }, 0);
-      }, false);
-
-      xhr.abort();
-    }
-  }, false);
-
-  xhr.open("GET", url, true);
-  xhr.setRequestHeader("X-Request", "0", false);
-  try { xhr.send(); }
-  catch(e) {
-    is("Nothing", "Exception", "Boom: " + e);
-  }
-}
-
-// Tests that response is NOT cached if the request is cancelled
-// before it has reached state 4
-function testCancelBeforePhase4() {
-
-  clearCache();
-
-  // First request - should be loaded from server
-  var xhr = new XMLHttpRequest();
-  xhr.addEventListener("readystatechange", function(e) {
-    if (xhr.readyState == 3) {
-      xhr.addEventListener("abort", function() {
-        setTimeout(function() {
-          // This request was cancelled, so the responseText should be empty string
-          is(xhr.responseText, "", "Expected empty response to cancelled request");
-
-          // Second request - should be found in cache
-          var xhr2 = new XMLHttpRequest();
-
-          xhr2.addEventListener("load", function() {
-            is(xhr2.responseText, "1", "Received cached value for second request");
            SimpleTest.finish();
          }, false);

--- a/content/events/public/nsEventNameList.h
+++ b/content/events/public/nsEventNameList.h
@ -243,6 +243,10 @@ EVENT(mouseup,
      NS_MOUSE_BUTTON_UP,
      EventNameType_All,
      NS_MOUSE_EVENT)
+EVENT(mozfullscreenchange,
+      NS_FULLSCREENCHANGE,
+      EventNameType_HTML,
+      NS_EVENT_NULL)
 // Not supported yet; probably never because "wheel" is a better idea.
 // EVENT(mousewheel)
 EVENT(pause,
--- a/content/events/public/nsEventStates.h
+++ b/content/events/public/nsEventStates.h
@ -261,6 +261,9 @@ private:
 #define NS_EVENT_STATE_MOZ_UI_INVALID NS_DEFINE_EVENT_STATE_MACRO(32)
 // UI friendly version of :valid pseudo-class.
 #define NS_EVENT_STATE_MOZ_UI_VALID NS_DEFINE_EVENT_STATE_MACRO(33)
+// Content is the full screen element, or a frame containing the
+// current full-screen element.
+#define NS_EVENT_STATE_FULL_SCREEN   NS_DEFINE_EVENT_STATE_MACRO(34)

 /**
 * NOTE: do not go over 63 without updating nsEventStates::InternalType!
@ -268,7 +271,8 @@ private:

 #define ESM_MANAGED_STATES (NS_EVENT_STATE_ACTIVE | NS_EVENT_STATE_FOCUS |     \
                            NS_EVENT_STATE_HOVER | NS_EVENT_STATE_DRAGOVER |   \
-                            NS_EVENT_STATE_URLTARGET | NS_EVENT_STATE_FOCUSRING)
+                            NS_EVENT_STATE_URLTARGET | NS_EVENT_STATE_FOCUSRING | \
+                            NS_EVENT_STATE_FULL_SCREEN)

 #define INTRINSIC_STATES (~ESM_MANAGED_STATES)

--- a/content/events/src/nsDOMEvent.cpp
+++ b/content/events/src/nsDOMEvent.cpp
@ -92,6 +92,7 @@ static const char* const sEventNames[] = {
  "MozAfterPaint",
  "MozBeforePaint",
  "MozBeforeResize",
+  "mozfullscreenchange",
  "MozSwipeGesture",
  "MozMagnifyGestureStart",
  "MozMagnifyGestureUpdate",
@ -1366,6 +1367,8 @@ const char* nsDOMEvent::GetEventName(PRUint32 aEventType)
    return sEventNames[eDOMEvents_devicemotion];
  case NS_DEVICE_ORIENTATION:
    return sEventNames[eDOMEvents_deviceorientation];
+  case NS_FULLSCREENCHANGE:
+    return sEventNames[eDOMEvents_mozfullscreenchange];
  default:
    break;
  }
--- a/content/events/src/nsDOMEvent.h
+++ b/content/events/src/nsDOMEvent.h
@ -177,6 +177,7 @@ public:
    eDOMEvents_afterpaint,
    eDOMEvents_beforepaint,
    eDOMEvents_beforeresize,
+    eDOMEvents_mozfullscreenchange,
    eDOMEvents_MozSwipeGesture,
    eDOMEvents_MozMagnifyGestureStart,
    eDOMEvents_MozMagnifyGestureUpdate,
--- a/content/events/src/nsEventStateManager.cpp
+++ b/content/events/src/nsEventStateManager.cpp
@ -175,6 +175,8 @@ static PRUint32 gPixelScrollDeltaTimeout = 0;
 static nscoord
 GetScrollableLineHeight(nsIFrame* aTargetFrame);

+TimeStamp nsEventStateManager::sHandlingInputStart;
+
 static inline PRBool
 IsMouseEventReal(nsEvent* aEvent)
 {
@ -4384,6 +4386,14 @@ static nsIContent* FindCommonAncestor(nsIContent *aNode1, nsIContent *aNode2)
  return nsnull;
 }

+/* static */
+void
+nsEventStateManager::SetFullScreenState(Element* aElement,
+                                        PRBool aIsFullScreen)
+{
+  DoStateChange(aElement, NS_EVENT_STATE_FULL_SCREEN, aIsFullScreen);
+}
+
 /* static */
 inline void
 nsEventStateManager::DoStateChange(Element* aElement, nsEventStates aState,
--- a/content/events/src/nsEventStateManager.h
+++ b/content/events/src/nsEventStateManager.h
@ -57,6 +57,8 @@
 #include "nsFocusManager.h"
 #include "nsIDocument.h"
 #include "nsEventStates.h"
+#include "mozilla/TimeStamp.h"
+#include "nsContentUtils.h"

 class nsIPresShell;
 class nsIDocShell;
@ -80,6 +82,10 @@ class nsEventStateManager : public nsSupportsWeakReference,
 {
  friend class nsMouseWheelTransaction;
 public:
+
+  typedef mozilla::TimeStamp TimeStamp;
+  typedef mozilla::TimeDuration TimeDuration;
+
  nsEventStateManager();
  virtual ~nsEventStateManager();

@ -169,16 +175,27 @@ public:
  static void StartHandlingUserInput()
  {
    ++sUserInputEventDepth;
+    if (sUserInputEventDepth == 1) {
+      sHandlingInputStart = TimeStamp::Now();
+    }
  }

  static void StopHandlingUserInput()
  {
    --sUserInputEventDepth;
+    if (sUserInputEventDepth == 0) {
+      sHandlingInputStart = TimeStamp();
+    }
  }

  static PRBool IsHandlingUserInput()
  {
-    return sUserInputEventDepth > 0;
+    if (sUserInputEventDepth <= 0) {
+      return PR_FALSE;
+    }
+    TimeDuration timeout = nsContentUtils::HandlingUserInputTimeout();
+    return timeout <= TimeDuration(0) ||
+           (TimeStamp::Now() - sHandlingInputStart) <= timeout;
  }

  /**
@ -186,7 +203,10 @@ public:
   * This includes timers or anything else that is initiated from user input.
   * However, mouse hover events are not counted as user input, nor are
   * page load events. If this method is called from asynchronously executed code,
-   * such as during layout reflows, it will return false.
+   * such as during layout reflows, it will return false. If more time has elapsed
+   * since the user input than is specified by the
+   * dom.event.handling-user-input-time-limit pref (default 1 second), this
+   * function also returns false.
   */
  NS_IMETHOD_(PRBool) IsHandlingUserInputExternal() { return IsHandlingUserInput(); }
  
@ -203,6 +223,10 @@ public:
  // if aContent is non-null, marks the object as active.
  static void SetActiveManager(nsEventStateManager* aNewESM,
                               nsIContent* aContent);
+
+  // Sets the full-screen event state on aElement to aIsFullScreen.
+  static void SetFullScreenState(mozilla::dom::Element* aElement, PRBool aIsFullScreen);
+
 protected:
  void UpdateCursor(nsPresContext* aPresContext, nsEvent* aEvent, nsIFrame* aTargetFrame, nsEventStatus* aStatus);
  /**
@ -503,6 +527,8 @@ private:

  PRPackedBool m_haveShutdown;

+  // Time at which we began handling user input.
+  static TimeStamp sHandlingInputStart;

 public:
  static nsresult UpdateUserActivityTimer(void);
--- a/content/html/content/src/nsGenericHTMLElement.cpp
+++ b/content/html/content/src/nsGenericHTMLElement.cpp
@ -3379,6 +3379,50 @@ nsGenericHTMLElement::Focus()
  return fm ? fm->SetFocus(elem, 0) : NS_OK;
 }

+nsresult nsGenericHTMLElement::MozRequestFullScreen()
+{
+  // Only grant full-screen requests if this is called from inside a trusted
+  // event handler (i.e. inside an event handler for a user initiated event).
+  // This stops the full-screen from being abused similar to the popups of old,
+  // and it also makes it harder for bad guys' script to go full-screen and
+  // spoof the browser chrome/window and phish logins etc.
+  if (!nsContentUtils::IsFullScreenApiEnabled() ||
+      !nsContentUtils::IsRequestFullScreenAllowed()) {
+    return NS_OK;
+  }
+
+  // Ensure that all ancestor <iframe> elements have the mozallowfullscreen
+  // boolean attribute set.
+  nsINode* node = static_cast<nsINode*>(this);
+  do {
+    nsIContent* content = static_cast<nsIContent*>(node);
+    if (content->IsHTML(nsGkAtoms::iframe) &&
+        !content->HasAttr(kNameSpaceID_None, nsGkAtoms::mozallowfullscreen)) {
+      // The node requesting fullscreen, or one of its crossdoc ancestors,
+      // is an iframe which doesn't have the "mozalllowfullscreen" attribute.
+      // This request is not authorized by the parent document.
+      return NS_OK;
+    }
+    node = nsContentUtils::GetCrossDocParentNode(node);
+  } while (node);
+
+  nsIDocument* doc = GetOwnerDoc();
+  NS_ENSURE_STATE(doc);
+  doc->RequestFullScreen(this);
+#ifdef DEBUG
+  nsCOMPtr<nsPIDOMWindow> window = do_QueryInterface(doc->GetWindow());
+  NS_ENSURE_STATE(window);
+  PRBool fullscreen;
+  window->GetFullScreen(&fullscreen);
+  NS_ASSERTION(fullscreen, "Windows should report fullscreen");
+  nsCOMPtr<nsIDOMDocument> domDocument(do_QueryInterface(doc));
+  domDocument->GetMozFullScreen(&fullscreen);
+  NS_ASSERTION(fullscreen, "Document should report fullscreen");
+  NS_ASSERTION(doc->IsFullScreenDoc(), "Should be in full screen state!");
+#endif
+  return NS_OK;
+}
+
 nsresult nsGenericHTMLElement::Click()
 {
  if (HasFlag(NODE_HANDLING_CLICK))
--- a/content/html/content/src/nsGenericHTMLElement.h
+++ b/content/html/content/src/nsGenericHTMLElement.h
@ -139,6 +139,7 @@ public:
  virtual nsresult InsertAdjacentHTML(const nsAString& aPosition,
                                      const nsAString& aText);
  nsresult ScrollIntoView(PRBool aTop, PRUint8 optional_argc);
+  nsresult MozRequestFullScreen();
  // Declare Focus(), Blur(), GetTabIndex(), SetTabIndex(), GetHidden(),
  // SetHidden(), GetSpellcheck(), SetSpellcheck(), and GetDraggable() such that
  // classes that inherit interfaces with those methods properly override them.
--- a/content/html/content/src/nsHTMLIFrameElement.cpp
+++ b/content/html/content/src/nsHTMLIFrameElement.cpp
@ -131,6 +131,7 @@ NS_IMPL_STRING_ATTR(nsHTMLIFrameElement, Name, name)
 NS_IMPL_STRING_ATTR(nsHTMLIFrameElement, Scrolling, scrolling)
 NS_IMPL_URI_ATTR(nsHTMLIFrameElement, Src, src)
 NS_IMPL_STRING_ATTR(nsHTMLIFrameElement, Width, width)
+NS_IMPL_BOOL_ATTR(nsHTMLIFrameElement, MozAllowFullScreen, mozallowfullscreen)

 NS_IMETHODIMP
 nsHTMLIFrameElement::GetContentDocument(nsIDOMDocument** aContentDocument)
--- a/content/html/content/test/Makefile.in
+++ b/content/html/content/test/Makefile.in
@ -277,6 +277,9 @@ _TEST_FILES = \
 		test_checked.html \
 		test_bug677658.html \
 		test_bug677463.html \
+		file_fullscreen-api.html \
+		file_fullscreen-api-keys.html \
+		test_fullscreen-api.html \
 		$(NULL)

 libs:: $(_TEST_FILES)
--- a/content/html/content/test/file_fullscreen-api-keys.html
+++ b/content/html/content/test/file_fullscreen-api-keys.html
@ -0,0 +1,250 @@
+ <!DOCTYPE HTML>
+<html>
+<!--
+https://bugzilla.mozilla.org/show_bug.cgi?id=545812
+
+Test that restricted key pressed drop documents out of DOM full-screen mode.
+
+-->
+<head>
+  <title>Test for Bug 545812</title>
+  <script type="application/javascript" src="/tests/SimpleTest/EventUtils.js"></script>
+</head>
+<body onload="document.body.mozRequestFullScreen();">
+
+<script type="application/javascript">
+
+/** Test for Bug 545812 **/
+
+// List of key codes, and whether they're restricted in full-screen mode.
+var keyList = [
+  // Allowed: DOM_VK_CANCEL to DOM_VK_CAPS_LOCK, inclusive
+  { code: "VK_CANCEL",        allowed: true},
+  { code: "VK_HELP",          allowed: true},
+  { code: "VK_BACK_SPACE",    allowed: true},
+  { code: "VK_TAB",           allowed: true},
+  { code: "VK_CLEAR",         allowed: true},
+  { code: "VK_RETURN",        allowed: true},
+  { code: "VK_ENTER",         allowed: true},
+  { code: "VK_SHIFT",         allowed: true},
+  { code: "VK_CONTROL",       allowed: true},
+  { code: "VK_ALT",           allowed: true},
+  { code: "VK_PAUSE",         allowed: true},
+  { code: "VK_CAPS_LOCK",     allowed: true},
+
+  { code: "VK_KANA",          allowed: false},
+  { code: "VK_HANGUL",        allowed: false},
+  { code: "VK_JUNJA",         allowed: false},
+  { code: "VK_FINAL",         allowed: false},
+  { code: "VK_HANJA",         allowed: false},
+  { code: "VK_KANJI",         allowed: false},
+  { code: "VK_ESCAPE",        allowed: false},
+  { code: "VK_CONVERT",       allowed: false},
+  { code: "VK_NONCONVERT",    allowed: false},
+  { code: "VK_ACCEPT",        allowed: false},
+  { code: "VK_MODECHANGE",    allowed: false},
+
+  // Allowed: DOM_VK_SPACE to DOM_VK_DELETE, inclusive
+  { code: "VK_SPACE",         allowed: true},
+  { code: "VK_PAGE_UP",       allowed: true},
+  { code: "VK_PAGE_DOWN",     allowed: true},
+  { code: "VK_END",           allowed: true},
+  { code: "VK_HOME",          allowed: true},
+  { code: "VK_LEFT",          allowed: true},
+  { code: "VK_UP",            allowed: true},
+  { code: "VK_RIGHT",         allowed: true},
+  { code: "VK_DOWN",          allowed: true},
+  { code: "VK_SELECT",        allowed: true},
+  { code: "VK_PRINT",         allowed: true},
+  { code: "VK_EXECUTE",       allowed: true},
+  { code: "VK_PRINTSCREEN",   allowed: true},
+  { code: "VK_INSERT",        allowed: true},
+  { code: "VK_DELETE",        allowed: true},
+
+  { code: "VK_0",             allowed: false},
+  { code: "VK_1",             allowed: false},
+  { code: "VK_2",             allowed: false},
+  { code: "VK_3",             allowed: false},
+  { code: "VK_4",             allowed: false},
+  { code: "VK_5",             allowed: false},
+  { code: "VK_6",             allowed: false},
+  { code: "VK_7",             allowed: false},
+  { code: "VK_8",             allowed: false},
+  { code: "VK_9",             allowed: false},
+
+  // Allowed: DOM_VK_SPACE to DOM_VK_DELETE, inclusive
+  { code: "VK_SEMICOLON",     allowed: true},
+  { code: "VK_EQUALS",        allowed: true},
+
+  { code: "VK_A",             allowed: false},
+  { code: "VK_B",             allowed: false},
+  { code: "VK_C",             allowed: false},
+  { code: "VK_D",             allowed: false},
+  { code: "VK_E",             allowed: false},
+  { code: "VK_F",             allowed: false},
+  { code: "VK_G",             allowed: false},
+  { code: "VK_H",             allowed: false},
+  { code: "VK_I",             allowed: false},
+  { code: "VK_J",             allowed: false},
+  { code: "VK_K",             allowed: false},
+  { code: "VK_L",             allowed: false},
+  { code: "VK_M",             allowed: false},
+  { code: "VK_N",             allowed: false},
+  { code: "VK_O",             allowed: false},
+  { code: "VK_P",             allowed: false},
+  { code: "VK_Q",             allowed: false},
+  { code: "VK_R",             allowed: false},
+  { code: "VK_S",             allowed: false},
+  { code: "VK_T",             allowed: false},
+  { code: "VK_U",             allowed: false},
+  { code: "VK_V",             allowed: false},
+  { code: "VK_W",             allowed: false},
+  { code: "VK_X",             allowed: false},
+  { code: "VK_Y",             allowed: false},
+  { code: "VK_Z",             allowed: false},
+  { code: "VK_CONTEXT_MENU",  allowed: false},
+  { code: "VK_SLEEP",         allowed: false},
+  { code: "VK_NUMPAD0",       allowed: false},
+  { code: "VK_NUMPAD1",       allowed: false},
+  { code: "VK_NUMPAD2",       allowed: false},
+  { code: "VK_NUMPAD3",       allowed: false},
+  { code: "VK_NUMPAD4",       allowed: false},
+  { code: "VK_NUMPAD5",       allowed: false},
+  { code: "VK_NUMPAD6",       allowed: false},
+  { code: "VK_NUMPAD7",       allowed: false},
+  { code: "VK_NUMPAD8",       allowed: false},
+  { code: "VK_NUMPAD9",       allowed: false},
+
+  // Allowed: DOM_VK_MULTIPLY to DOM_VK_META, inclusive
+  { code: "VK_MULTIPLY",      allowed: true},
+  { code: "VK_ADD",           allowed: true},
+  { code: "VK_SEPARATOR",     allowed: true},
+  { code: "VK_SUBTRACT",      allowed: true},
+  { code: "VK_DECIMAL",       allowed: true},
+  { code: "VK_DIVIDE",        allowed: true},
+  { code: "VK_F1",            allowed: true},
+  { code: "VK_F2",            allowed: true},
+  { code: "VK_F3",            allowed: true},
+  { code: "VK_F4",            allowed: true},
+  { code: "VK_F5",            allowed: true},
+  { code: "VK_F6",            allowed: true},
+  { code: "VK_F7",            allowed: true},
+  { code: "VK_F8",            allowed: true},
+  { code: "VK_F9",            allowed: true},
+  { code: "VK_F10",           allowed: true},
+  { code: "VK_F11",           allowed: true},
+  { code: "VK_F12",           allowed: true},
+  { code: "VK_F13",           allowed: true},
+  { code: "VK_F14",           allowed: true},
+  { code: "VK_F15",           allowed: true},
+  { code: "VK_F16",           allowed: true},
+  { code: "VK_F17",           allowed: true},
+  { code: "VK_F18",           allowed: true},
+  { code: "VK_F19",           allowed: true},
+  { code: "VK_F20",           allowed: true},
+  { code: "VK_F21",           allowed: true},
+  { code: "VK_F22",           allowed: true},
+  { code: "VK_F23",           allowed: true},
+  { code: "VK_F24",           allowed: true},
+  { code: "VK_NUM_LOCK",      allowed: true},
+  { code: "VK_SCROLL_LOCK",   allowed: true},
+  { code: "VK_COMMA",         allowed: true},
+  { code: "VK_PERIOD",        allowed: true},
+  { code: "VK_SLASH",         allowed: true},
+  { code: "VK_BACK_QUOTE",    allowed: true},
+  { code: "VK_OPEN_BRACKET",  allowed: true},
+  { code: "VK_BACK_SLASH",    allowed: true},
+  { code: "VK_CLOSE_BRACKET", allowed: true},
+  { code: "VK_QUOTE",         allowed: true},
+  { code: "VK_META",          allowed: true},
+];
+
+function ok(condition, msg) {
+  opener.ok(condition, msg);
+}
+
+function is(a, b, msg) {
+  opener.is(a, b, msg);
+}
+
+var gKeyTestIndex = 0;
+var gKeyName;
+var gKeyCode;
+var gKeyAllowed;
+var gKeyReceived = false;
+
+function keyHandler(event) {
+  event.preventDefault()
+  gKeyReceived = true;
+}
+
+function checkKeyEffect() {
+  is(document.mozFullScreen, gKeyAllowed,
+     (gKeyAllowed ? ("Should remain in full-screen mode for allowed key press " + gKeyName)
+                  : ("Should drop out of full-screen mode for restricted key press " + gKeyName)));
+
+  if (gKeyTestIndex < keyList.length) {
+    setTimeout(testNextKey, 0);
+  } else {
+    opener.keysTestFinished();
+  }
+}
+
+function testTrustedKeyEvents() {
+  document.body.focus();
+  gKeyReceived = false;
+  synthesizeKey(gKeyName, {});
+  setTimeout(checkKeyEffect, 0);
+}
+
+function testScriptInitiatedKeyEvents() {
+  // Script initiated untrusted key events should not be blocked.
+  document.body.focus();
+  gKeyReceived = false;
+  var evt = document.createEvent("KeyEvents");
+  evt.initKeyEvent("keydown", true, true, window,
+                   false, false, false, false,
+                   gKeyCode, 0);
+  document.body.dispatchEvent(evt);
+
+  evt = document.createEvent("KeyEvents");
+  evt.initKeyEvent("keypress", true, true, window,
+                   false, false, false, false,
+                   gKeyCode, 0);
+  document.body.dispatchEvent(evt);
+
+  evt = document.createEvent("KeyEvents");
+  evt.initKeyEvent("keyup", true, true, window,
+                   false, false, false, false,
+                   gKeyCode, 0);
+  document.body.dispatchEvent(evt);
+  
+  ok(gKeyReceived, "dispatchEvent should dispatch events synchronously");
+  ok(document.mozFullScreen,
+     "Should remain in full-screen mode for script initiated key events for " + gKeyName);
+}
+
+function testNextKey() {
+  if (!document.mozFullScreen) {
+    document.body.mozRequestFullScreen();
+  }
+  ok(document.mozFullScreen, "Must be in full-screen mode");
+
+  gKeyName = keyList[gKeyTestIndex].code;
+  gKeyCode = KeyEvent["DOM_" + gKeyName];
+  gKeyAllowed = keyList[gKeyTestIndex].allowed;
+  gKeyTestIndex++;
+
+  testScriptInitiatedKeyEvents();
+  testTrustedKeyEvents();
+}
+
+window.addEventListener("keydown", keyHandler, true);
+window.addEventListener("keyup", keyHandler, true);
+window.addEventListener("keypress", keyHandler, true);
+setTimeout(testNextKey, 0);
+
+</script>
+</pre>
+</body>
+</html>
--- a/content/html/content/test/file_fullscreen-api.html
+++ b/content/html/content/test/file_fullscreen-api.html
@ -0,0 +1,161 @@
+ <!DOCTYPE HTML>
+<html>
+<!--
+https://bugzilla.mozilla.org/show_bug.cgi?id=545812
+
+Test DOM full-screen API.
+
+-->
+<head>
+  <title>Test for Bug 545812</title>
+  <script type="application/javascript" src="/tests/SimpleTest/EventUtils.js"></script>
+  <style>
+  body:-moz-full-screen, div:-moz-full-screen {
+    background-color: red;
+  }
+  </style>
+</head>
+<body onload="document.body.mozRequestFullScreen();">
+
+<script type="application/javascript">
+
+/** Test for Bug 545812 **/
+
+function ok(condition, msg) {
+  opener.ok(condition, msg);
+}
+
+function is(a, b, msg) {
+  opener.is(a, b, msg);
+}
+
+/*
+<html>
+  <body onload='document.body.mozRequestFullScreen();'>
+  </body>
+</html>
+*/
+var iframeContents = "data:text/html;charset=utf-8,<html>%0D%0A  <body onload%3D'document.body.mozRequestFullScreen()%3B'>%0D%0A  <%2Fbody>%0D%0A<%2Fhtml>";
+
+var iframe = null;
+var outOfDocElement = null;
+var inDocElement = null;
+var button = null;
+
+var fullScreenChangeCount = 0;
+
+function sendMouseClick(element) {
+  synthesizeMouseAtCenter(element, {});
+}
+
+function setRequireTrustedContext(value) {
+  opener.SpecialPowers.setBoolPref("full-screen-api.allow-trusted-requests-only", value);
+}
+
+function fullScreenChange(event) {
+  switch (fullScreenChangeCount) {
+    case 0: {
+      ok(document.mozFullScreen, "Should be in full-screen mode (first time)");
+      is(event.target, document.body, "Event target should be full-screen element");
+      is(document.mozFullScreenElement, document.body,
+         "Full-screen element should be body element.");
+      document.mozCancelFullScreen();
+      break;
+    }
+    case 1: {
+      ok(!document.mozFullScreen, "Should have left full-screen mode (first time)");
+      is(event.target, document.body, "Event target should be full-screen element");
+      is(document.mozFullScreenElement, null, "Full-screen element should be null.");
+      iframe = document.createElement("iframe");
+      iframe.mozAllowFullScreen = true;
+      document.body.appendChild(iframe);
+      iframe.src = iframeContents;
+      break;
+    }
+    case 2: {
+      ok(document.mozFullScreen, "Should be back in full-screen mode (second time)");
+      is(event.target, iframe,
+         "Event target should be full-screen element container");
+      is(document.mozFullScreenElement, iframe,
+        "Full-screen element should be iframe element.");
+      document.mozCancelFullScreen();
+      break;
+    }
+    case 3: {
+      ok(!document.mozFullScreen, "Should be back in non-full-screen mode (second time)");
+      is(event.target, iframe,
+         "Event target should be full-screen element container");
+      is(document.mozFullScreenElement, null, "Full-screen element should be null.");
+      document.body.removeChild(iframe);
+      iframe = null;
+      outOfDocElement = document.createElement("div");
+      outOfDocElement.mozRequestFullScreen();
+      break;
+    }
+    case 4: {
+      ok(document.mozFullScreen, "Should be back in full-screen mode (third time)");
+      is(event.target, document, "Event target should be document");
+      is(document.mozFullScreenElement, null,
+        "Should not have a full-screen element when element not in document requests full-screen.");
+       
+      // Set another element to be the full-screen element. It should immediately
+      // become the current full-screen element.
+      inDocElement = document.createElement("div");
+      document.body.appendChild(inDocElement);
+      inDocElement.mozRequestFullScreen();
+       
+      ok(document.mozFullScreen, "Should remain in full-screen mode (third and a half time)");
+      is(document.mozFullScreenElement, inDocElement,
+        "Full-screen element should be in doc again.");
+
+      // Remove full-screen element from document before exiting full screen.
+      document.body.removeChild(inDocElement);
+      ok(document.mozFullScreen,
+         "Should remain in full-screen mode after removing full-screen element from document");
+      is(document.mozFullScreenElement, null,
+        "Should not have a full-screen element again.");
+
+      document.mozCancelFullScreen();
+      break;
+    }
+    case 5: {
+      ok(!document.mozFullScreen, "Should be back in non-full-screen mode (third time)");
+      setRequireTrustedContext(true);
+      document.body.mozRequestFullScreen();
+      ok(!document.mozFullScreen, "Should still be in normal mode, because calling context isn't trusted.");
+
+      button = document.createElement("button");
+      button.onclick = function(){document.body.mozRequestFullScreen();}
+      document.body.appendChild(button);
+      sendMouseClick(button);
+      break;
+    }
+    case 6: {
+      ok(document.mozFullScreen, "Moved to full-screen after mouse click");
+      document.mozCancelFullScreen();
+      ok(document.mozFullScreen, "Should still be in full-screen mode, because calling context isn't trusted.");
+      setRequireTrustedContext(false);
+      document.mozCancelFullScreen();
+      ok(!document.mozFullScreen, "Should have left full-screen mode.");
+      break;
+    }
+    case 7: {
+      ok(!document.mozFullScreen, "Should have left full-screen mode (last time).");      
+      // Set timeout for calling finish(), so that any pending "mozfullscreenchange" events
+      // would have a chance to fire.
+      setTimeout(function(){opener.apiTestFinished();}, 0);
+      break;
+    }
+    default: {
+      ok(false, "Should not receive any more fullscreenchange events!");
+    }
+  }
+  fullScreenChangeCount++;
+}
+
+document.addEventListener("mozfullscreenchange", fullScreenChange, false);
+
+</script>
+</pre>
+</body>
+</html>
--- a/content/html/content/test/test_bug430392.html
+++ b/content/html/content/test/test_bug430392.html
@ -40,7 +40,6 @@ function test() {

 SimpleTest.waitForExplicitFinish();
 addLoadEvent(test);
-addLoadEvent(SimpleTest.finish);

 </script>
 </pre>
--- a/content/html/content/test/test_fullscreen-api.html
+++ b/content/html/content/test/test_fullscreen-api.html
@ -0,0 +1,101 @@
+ <!DOCTYPE HTML>
+<html>
+<head>
+  <title>Test for Bug 545812</title>
+  <script type="application/javascript" src="/MochiKit/packed.js"></script>
+  <script type="application/javascript" src="/tests/SimpleTest/SimpleTest.js"></script>
+  <link rel="stylesheet" type="text/css" href="/tests/SimpleTest/test.css"/>
+  <script type="application/javascript" src="/tests/SimpleTest/EventUtils.js"></script>
+</head>
+<body>
+<a target="_blank" href="https://bugzilla.mozilla.org/show_bug.cgi?id=545812">Mozilla Bug 545812</a>
+<p id="display"></p>
+<div id="content" style="display: none">
+
+</div>
+<pre id="test">
+<script type="application/javascript">
+
+/** Test for Bug 545812 **/
+var testWindow = null;
+
+/*
+<html>
+  <body onload='document.body.mozRequestFullScreen();'>
+  </body>
+</html>
+*/
+var requestFullScreenContents = "data:text/html;charset=utf-8,<html>%0D%0A  <body onload%3D'document.body.mozRequestFullScreen()%3B'>%0D%0A  <%2Fbody>%0D%0A<%2Fhtml>";
+
+var prevTrusted = false;
+var prevEnabled = false;
+
+function run() {
+  document.addEventListener("mozfullscreenchange",
+    function(){ok(false, "Should never receive a mozfullscreenchange event in the main window.");},
+    false);
+
+  // Ensure the full-screen api is enabled, and will be disabled on test exit.
+  prevEnabled = SpecialPowers.getBoolPref("full-screen-api.enabled");
+  SpecialPowers.setBoolPref("full-screen-api.enabled", true);
+
+  // Test requesting full-screen mode in a long-running user-generated event handler.
+  // The request in the key handler should not be granted.
+  window.addEventListener("keypress", keyHandler, false);
+  synthesizeKey("VK_A", {});
+}
+
+function keyHandler(event) {
+  window.removeEventListener("keypress", keyHandler, false);
+  
+  // Busy loop until 2s has passed. We should then be past the 1 second threshold, and so
+  // our request for full-screen mode should be rejected.
+  var end = (new Date()).getTime() + 2000;
+  while ((new Date()).getTime() < end) {
+    ; // Wait...
+  }
+  document.body.mozRequestFullScreen();
+
+  prevTrusted = SpecialPowers.getBoolPref("full-screen-api.allow-trusted-requests-only");
+
+  // Request full-screen from a non trusted context (this script isn't a user
+  // generated event!). We should not receive a "mozfullscreenchange" event.
+  SpecialPowers.setBoolPref("full-screen-api.allow-trusted-requests-only", true);
+  document.body.mozRequestFullScreen();
+
+  // Disable the requirement for trusted contexts only, so the tests are easier
+  // to write.
+  SpecialPowers.setBoolPref("full-screen-api.allow-trusted-requests-only", false);
+
+  // Load an iframe whose contents requests full-screen. This request should
+  // fail, and we should never receive a "mozfullscreenchange" event, because the
+  // iframe doesn't have a mozallowfullscreen attribute.
+  var iframe = document.createElement("iframe");
+  iframe.src = requestFullScreenContents;
+  document.body.appendChild(iframe);
+ 
+  // Run the tests which go full-screen in a new window, as mochitests normally
+  // run in an iframe, which by default will not have the mozallowfullscreen
+  // attribute set, so full-screen won't work.
+  testWindow = window.open("file_fullscreen-api.html", "", "width=500,height=500");
+}
+
+function apiTestFinished() {
+  testWindow.close();
+  testWindow = window.open("file_fullscreen-api-keys.html", "", "width=500,height=500");
+}
+
+function keysTestFinished() {
+  testWindow.close();
+  SpecialPowers.setBoolPref("full-screen-api.enabled", prevEnabled);
+  SpecialPowers.setBoolPref("full-screen-api.allow-trusted-requests-only", prevTrusted);	
+  SimpleTest.finish();
+}
+
+addLoadEvent(run);
+SimpleTest.waitForExplicitFinish();
+
+</script>
+</pre>
+</body>
+</html>
--- a/content/smil/nsSMILAnimationController.cpp
+++ b/content/smil/nsSMILAnimationController.cpp
@ -592,7 +592,7 @@ nsSMILAnimationController::DoMilestoneSamples()

      nsSMILTimeValue containerTimeValue =
        container->ParentToContainerTime(sampleTime);
-      if (!containerTimeValue.IsResolved())
+      if (!containerTimeValue.IsDefinite())
        continue;

      // Clamp the converted container time to non-negative values.
--- a/content/smil/nsSMILAnimationFunction.cpp
+++ b/content/smil/nsSMILAnimationFunction.cpp
@ -252,8 +252,7 @@ nsSMILAnimationFunction::ComposeResult(const nsISMILAttr& aSMILAttr,
  // If this interval is active, we must have a non-negative mSampleTime
  NS_ABORT_IF_FALSE(mSampleTime >= 0 || !mIsActive,
      "Negative sample time for active animation");
-  NS_ABORT_IF_FALSE(mSimpleDuration.IsResolved() ||
-      mSimpleDuration.IsIndefinite() || mLastValue,
+  NS_ABORT_IF_FALSE(mSimpleDuration.IsResolved() || mLastValue,
      "Unresolved simple duration for active or frozen animation");

  // If we want to add but don't have a base value then just fail outright.
@ -408,7 +407,7 @@ nsSMILAnimationFunction::InterpolateResult(const nsSMILValueArray& aValues,
  // its starting point.
  double simpleProgress = 0.0;

-  if (mSimpleDuration.IsResolved()) {
+  if (mSimpleDuration.IsDefinite()) {
    nsSMILTime dur = mSimpleDuration.GetMillis();

    NS_ABORT_IF_FALSE(dur >= 0, "Simple duration should not be negative");
--- a/content/smil/nsSMILInterval.cpp
+++ b/content/smil/nsSMILInterval.cpp
@ -110,8 +110,8 @@ nsSMILInterval::End()
 void
 nsSMILInterval::SetBegin(nsSMILInstanceTime& aBegin)
 {
-  NS_ABORT_IF_FALSE(aBegin.Time().IsResolved(),
-      "Attempting to set unresolved begin time on interval");
+  NS_ABORT_IF_FALSE(aBegin.Time().IsDefinite(),
+      "Attempting to set unresolved or indefinite begin time on interval");
  NS_ABORT_IF_FALSE(!mBeginFixed,
      "Attempting to set begin time but the begin point is fixed");
  // Check that we're not making an instance time dependent on itself. Such an
--- a/content/smil/nsSMILTimeContainer.cpp
+++ b/content/smil/nsSMILTimeContainer.cpp
@ -261,7 +261,7 @@ nsSMILTimeContainer::GetNextMilestoneInParentTime(

  nsSMILTimeValue parentTime =
    ContainerToParentTime(mMilestoneEntries.Top().mMilestone.mTime);
-  if (!parentTime.IsResolved())
+  if (!parentTime.IsDefinite())
    return PR_FALSE;

  aNextMilestone = nsSMILMilestone(parentTime.GetMillis(),
@ -279,7 +279,7 @@ nsSMILTimeContainer::PopMilestoneElementsAtMilestone(
    return PR_FALSE;

  nsSMILTimeValue containerTime = ParentToContainerTime(aMilestone.mTime);
-  if (!containerTime.IsResolved())
+  if (!containerTime.IsDefinite())
    return PR_FALSE;

  nsSMILMilestone containerMilestone(containerTime.GetMillis(),
--- a/content/smil/nsSMILTimeValue.cpp
+++ b/content/smil/nsSMILTimeValue.cpp
@ -53,12 +53,12 @@ nsSMILTimeValue::CompareTo(const nsSMILTimeValue& aOther) const
 {
  PRInt8 result;

-  if (mState == STATE_RESOLVED) {
-    result = (aOther.mState == STATE_RESOLVED)
+  if (mState == STATE_DEFINITE) {
+    result = (aOther.mState == STATE_DEFINITE)
           ? Cmp(mMilliseconds, aOther.mMilliseconds)
           : -1;
  } else if (mState == STATE_INDEFINITE) {
-    if (aOther.mState == STATE_RESOLVED)
+    if (aOther.mState == STATE_DEFINITE)
      result = 1;
    else if (aOther.mState == STATE_INDEFINITE)
      result = 0;
--- a/content/smil/nsSMILTimeValue.h
+++ b/content/smil/nsSMILTimeValue.h
@ -66,35 +66,19 @@
 *
 * Objects of this class may be in one of three states:
 *
- * 1) The time is resolved and has a millisecond value
- * 2) The time is indefinite
- * 3) The time in unresolved
- *
- * There is considerable chance for confusion with regards to the indefinite
- * state. Is it resolved? We adopt the convention that it is NOT resolved (but
- * nor is it unresolved). This simplifies implementation as you can then write:
- *
- * if (time.IsResolved())
- *    x = time.GetMillis()
- *
- * instead of:
- *
- * if (time.IsResolved() && !time.IsIndefinite())
- *    x = time.GetMillis()
- *
- * Testing if a time is unresolved becomes more complicated but this is tested
- * much less often.
+ * 1) The time is resolved and has a definite millisecond value
+ * 2) The time is resolved and indefinite
+ * 3) The time is unresolved
 *
 * In summary:
 *
- * State         |  GetMillis         |  IsResolved        |  IsIndefinite
- * --------------+--------------------+--------------------+-------------------
- * Resolved      |  The millisecond   |  PR_TRUE           |  PR_FALSE
- *               |  time              |                    |
- * --------------+--------------------+--------------------+-------------------
- * Indefinite    |  LL_MAXINT         |  PR_FALSE          |  PR_TRUE
- * --------------+--------------------+--------------------+-------------------
- * Unresolved    |  LL_MAXINT         |  PR_FALSE          |  PR_FALSE
+ * State      | GetMillis       | IsDefinite | IsIndefinite | IsResolved
+ * -----------+-----------------+------------+--------------+------------
+ * Definite   | nsSMILTimeValue | PR_TRUE    | PR_FALSE     | PR_TRUE
+ * -----------+-----------------+------------+--------------+------------
+ * Indefinite | --              | PR_FALSE   | PR_TRUE      | PR_TRUE
+ * -----------+-----------------+------------+--------------+------------
+ * Unresolved | --              | PR_FALSE   | PR_FALSE     | PR_FALSE
 *
 */

@ -110,7 +94,7 @@ public:
  // Creates a resolved time value
  explicit nsSMILTimeValue(nsSMILTime aMillis)
  : mMilliseconds(aMillis),
-    mState(STATE_RESOLVED)
+    mState(STATE_DEFINITE)
  { }

  // Named constructor to create an indefinite time value
@ -128,24 +112,25 @@ public:
    mMilliseconds = kUnresolvedMillis;
  }

-  PRBool IsResolved() const { return mState == STATE_RESOLVED; }
+  PRBool IsResolved() const { return mState != STATE_UNRESOLVED; }
  void SetUnresolved()
  {
    mState = STATE_UNRESOLVED;
    mMilliseconds = kUnresolvedMillis;
  }

+  PRBool IsDefinite() const { return mState == STATE_DEFINITE; }
  nsSMILTime GetMillis() const
  {
-    NS_ABORT_IF_FALSE(mState == STATE_RESOLVED,
-       "GetMillis() called for unresolved time");
+    NS_ABORT_IF_FALSE(mState == STATE_DEFINITE,
+       "GetMillis() called for unresolved or indefinite time");

-    return mState == STATE_RESOLVED ? mMilliseconds : kUnresolvedMillis;
+    return mState == STATE_DEFINITE ? mMilliseconds : kUnresolvedMillis;
  }

  void SetMillis(nsSMILTime aMillis)
  {
-    mState = STATE_RESOLVED;
+    mState = STATE_DEFINITE;
    mMilliseconds = aMillis;
  }

@ -172,9 +157,9 @@ public:
 private:
  static nsSMILTime kUnresolvedMillis;

-  nsSMILTime        mMilliseconds;
+  nsSMILTime mMilliseconds;
  enum {
-    STATE_RESOLVED,
+    STATE_DEFINITE,
    STATE_INDEFINITE,
    STATE_UNRESOLVED
  } mState;
--- a/content/smil/nsSMILTimeValueSpec.cpp
+++ b/content/smil/nsSMILTimeValueSpec.cpp
@ -182,7 +182,7 @@ nsSMILTimeValueSpec::HandleNewInterval(nsSMILInterval& aInterval,
    ConvertBetweenTimeContainers(baseInstance.Time(), aSrcContainer);

  // Apply offset
-  if (newTime.IsResolved()) {
+  if (newTime.IsDefinite()) {
    newTime.SetMillis(newTime.GetMillis() + mParams.mOffset.GetMillis());
  }

@ -218,7 +218,7 @@ nsSMILTimeValueSpec::HandleChangedInstanceTime(
    ConvertBetweenTimeContainers(aBaseTime.Time(), aSrcContainer);

  // Apply offset
-  if (updatedTime.IsResolved()) {
+  if (updatedTime.IsDefinite()) {
    updatedTime.SetMillis(updatedTime.GetMillis() +
                          mParams.mOffset.GetMillis());
  }
@ -509,7 +509,7 @@ nsSMILTimeValueSpec::ConvertBetweenTimeContainers(
 {
  // If the source time is either indefinite or unresolved the result is going
  // to be the same
-  if (!aSrcTime.IsResolved())
+  if (!aSrcTime.IsDefinite())
    return aSrcTime;

  // Convert from source time container to our parent time container
@ -530,8 +530,8 @@ nsSMILTimeValueSpec::ConvertBetweenTimeContainers(
    // time. Just return the indefinite time.
    return docTime;

-   NS_ABORT_IF_FALSE(docTime.IsResolved(),
-       "ContainerToParentTime gave us an unresolved time");
+  NS_ABORT_IF_FALSE(docTime.IsDefinite(),
+    "ContainerToParentTime gave us an unresolved or indefinite time");

  return dstContainer->ParentToContainerTime(docTime.GetMillis());
 }
--- a/content/smil/nsSMILTimedElement.cpp
+++ b/content/smil/nsSMILTimedElement.cpp
@ -918,7 +918,7 @@ nsSMILTimedElement::SetSimpleDuration(const nsAString& aDurSpec)
    return NS_ERROR_FAILURE;
  }

-  if (duration.IsResolved() && duration.GetMillis() == 0L) {
+  if (duration.IsDefinite() && duration.GetMillis() == 0L) {
    mSimpleDur.SetIndefinite();
    return NS_ERROR_FAILURE;
  }
@ -932,7 +932,7 @@ nsSMILTimedElement::SetSimpleDuration(const nsAString& aDurSpec)

  // mSimpleDur should never be unresolved. ParseClockValue will either set
  // duration to resolved/indefinite/media or will return a failure code.
-  NS_ASSERTION(duration.IsResolved() || duration.IsIndefinite(),
+  NS_ABORT_IF_FALSE(duration.IsResolved(),
    "Setting unresolved simple duration");

  mSimpleDur = duration;
@ -961,7 +961,7 @@ nsSMILTimedElement::SetMin(const nsAString& aMinSpec)
    duration.SetMillis(0L);
  }

-  if (NS_FAILED(rv) || !duration.IsResolved()) {
+  if (NS_FAILED(rv) || !duration.IsDefinite()) {
    mMin.SetMillis(0L);
    return NS_ERROR_FAILURE;
  }
@ -997,12 +997,12 @@ nsSMILTimedElement::SetMax(const nsAString& aMaxSpec)
  if (isMedia)
    duration.SetIndefinite();

-  if (NS_FAILED(rv) || (!duration.IsResolved() && !duration.IsIndefinite())) {
+  if (NS_FAILED(rv) || !duration.IsResolved()) {
    mMax.SetIndefinite();
    return NS_ERROR_FAILURE;
  }

-  if (duration.IsResolved() && duration.GetMillis() <= 0L) {
+  if (duration.IsDefinite() && duration.GetMillis() <= 0L) {
    mMax.SetIndefinite();
    return NS_ERROR_FAILURE;
  }
@ -1074,7 +1074,7 @@ nsSMILTimedElement::SetRepeatDur(const nsAString& aRepeatDurSpec)
  rv = nsSMILParserUtils::ParseClockValue(aRepeatDurSpec, &duration,
          nsSMILParserUtils::kClockValueAllowIndefinite);

-  if (NS_FAILED(rv) || (!duration.IsResolved() && !duration.IsIndefinite())) {
+  if (NS_FAILED(rv) || !duration.IsResolved()) {
    mRepeatDur.SetUnresolved();
    return NS_ERROR_FAILURE;
  }
@ -1608,8 +1608,8 @@ nsSMILTimedElement::GetNextInterval(const nsSMILInterval* aPrevInterval,
                                    const nsSMILInstanceTime* aFixedBeginTime,
                                    nsSMILInterval& aResult) const
 {
-  NS_ABORT_IF_FALSE(!aFixedBeginTime || aFixedBeginTime->Time().IsResolved(),
-      "Unresolved begin time specified for interval start");
+  NS_ABORT_IF_FALSE(!aFixedBeginTime || aFixedBeginTime->Time().IsDefinite(),
+      "Unresolved or indefinite begin time specified for interval start");
  static const nsSMILTimeValue zeroTime(0L);

  if (mRestartMode == RESTART_NEVER && aPrevInterval)
@ -1655,13 +1655,13 @@ nsSMILTimedElement::GetNextInterval(const nsSMILInterval* aPrevInterval,
      do {
        tempBegin =
          GetNextGreaterOrEqual(mBeginInstances, beginAfter, beginPos);
-        if (!tempBegin || !tempBegin->Time().IsResolved()) {
+        if (!tempBegin || !tempBegin->Time().IsDefinite()) {
          return PR_FALSE;
        }
      } while (aReplacedInterval &&
               tempBegin->GetBaseTime() == aReplacedInterval->Begin());
    }
-    NS_ABORT_IF_FALSE(tempBegin && tempBegin->Time().IsResolved() &&
+    NS_ABORT_IF_FALSE(tempBegin && tempBegin->Time().IsDefinite() &&
        tempBegin->Time() >= beginAfter,
        "Got a bad begin time while fetching next interval");

@ -1688,15 +1688,14 @@ nsSMILTimedElement::GetNextInterval(const nsSMILInterval* aPrevInterval,
      // a) We never had any end attribute to begin with (and hence we should
      //    just use the active duration after allowing for the possibility of
      //    an end instance provided by a DOM call), OR
-      // b) We have no resolved (not incl. indefinite) end instances
-      //    (SMIL only says "if the instance list is empty"--but if we have
-      //    indefinite/unresolved instance times then there must be a good
-      //    reason we haven't used them (since they'll be >= tempBegin) such as
-      //    avoiding creating a self-referential loop. In any case, the interval
-      //    should be allowed to be open.), OR
+      // b) We have no definite end instances (SMIL only says "if the instance
+      //    list is empty"--but if we have indefinite/unresolved instance times
+      //    then there must be a good reason we haven't used them (since they
+      //    will be >= tempBegin) such as avoiding creating a self-referential
+      //    loop. In any case, the interval should be allowed to be open.), OR
      // c) We have end events which leave the interval open-ended.
      PRBool openEndedIntervalOk = mEndSpecs.IsEmpty() ||
-                                   !HaveResolvedEndTimes() ||
+                                   !HaveDefiniteEndTimes() ||
                                   EndHasEventConditions();
      if (!tempEnd && !openEndedIntervalOk)
        return PR_FALSE; // Bad interval
@ -1714,7 +1713,7 @@ nsSMILTimedElement::GetNextInterval(const nsSMILInterval* aPrevInterval,
    // If we get two zero-length intervals in a row we will potentially have an
    // infinite loop so we break it here by searching for the next begin time
    // greater than tempEnd on the next time around.
-    if (tempEnd->Time().IsResolved() && tempBegin->Time() == tempEnd->Time()) {
+    if (tempEnd->Time().IsDefinite() && tempBegin->Time() == tempEnd->Time()) {
      if (prevIntervalWasZeroDur) {
        beginAfter.SetMillis(tempEnd->Time().GetMillis() + 1);
        prevIntervalWasZeroDur = PR_FALSE;
@ -1781,10 +1780,10 @@ nsSMILTimedElement::CalcActiveEnd(const nsSMILTimeValue& aBegin,
 {
  nsSMILTimeValue result;

-  NS_ABORT_IF_FALSE(mSimpleDur.IsResolved() || mSimpleDur.IsIndefinite(),
+  NS_ABORT_IF_FALSE(mSimpleDur.IsResolved(),
    "Unresolved simple duration in CalcActiveEnd");
-  NS_ABORT_IF_FALSE(aBegin.IsResolved(),
-    "Unresolved begin time in CalcActiveEnd");
+  NS_ABORT_IF_FALSE(aBegin.IsDefinite(),
+    "Indefinite or unresolved begin time in CalcActiveEnd");

  if (mRepeatDur.IsIndefinite()) {
    result.SetIndefinite();
@ -1792,10 +1791,10 @@ nsSMILTimedElement::CalcActiveEnd(const nsSMILTimeValue& aBegin,
    result = GetRepeatDuration();
  }

-  if (aEnd.IsResolved()) {
+  if (aEnd.IsDefinite()) {
    nsSMILTime activeDur = aEnd.GetMillis() - aBegin.GetMillis();

-    if (result.IsResolved()) {
+    if (result.IsDefinite()) {
      result.SetMillis(NS_MIN(result.GetMillis(), activeDur));
    } else {
      result.SetMillis(activeDur);
@ -1804,7 +1803,7 @@ nsSMILTimedElement::CalcActiveEnd(const nsSMILTimeValue& aBegin,

  result = ApplyMinAndMax(result);

-  if (result.IsResolved()) {
+  if (result.IsDefinite()) {
    nsSMILTime activeEnd = result.GetMillis() + aBegin.GetMillis();
    result.SetMillis(activeEnd);
  }
@ -1817,19 +1816,19 @@ nsSMILTimedElement::GetRepeatDuration() const
 {
  nsSMILTimeValue result;

-  if (mRepeatCount.IsDefinite() && mRepeatDur.IsResolved()) {
-    if (mSimpleDur.IsResolved()) {
+  if (mRepeatCount.IsDefinite() && mRepeatDur.IsDefinite()) {
+    if (mSimpleDur.IsDefinite()) {
      nsSMILTime activeDur =
        nsSMILTime(mRepeatCount * double(mSimpleDur.GetMillis()));
      result.SetMillis(NS_MIN(activeDur, mRepeatDur.GetMillis()));
    } else {
      result = mRepeatDur;
    }
-  } else if (mRepeatCount.IsDefinite() && mSimpleDur.IsResolved()) {
+  } else if (mRepeatCount.IsDefinite() && mSimpleDur.IsDefinite()) {
    nsSMILTime activeDur =
      nsSMILTime(mRepeatCount * double(mSimpleDur.GetMillis()));
    result.SetMillis(activeDur);
-  } else if (mRepeatDur.IsResolved()) {
+  } else if (mRepeatDur.IsDefinite()) {
    result = mRepeatDur;
  } else if (mRepeatCount.IsIndefinite()) {
    result.SetIndefinite();
@ -1843,7 +1842,7 @@ nsSMILTimedElement::GetRepeatDuration() const
 nsSMILTimeValue
 nsSMILTimedElement::ApplyMinAndMax(const nsSMILTimeValue& aDuration) const
 {
-  if (!aDuration.IsResolved() && !aDuration.IsIndefinite()) {
+  if (!aDuration.IsResolved()) {
    return aDuration;
  }

@ -1871,7 +1870,7 @@ nsSMILTimedElement::ActiveTimeToSimpleTime(nsSMILTime aActiveTime,
 {
  nsSMILTime result;

-  NS_ASSERTION(mSimpleDur.IsResolved() || mSimpleDur.IsIndefinite(),
+  NS_ASSERTION(mSimpleDur.IsResolved(),
      "Unresolved simple duration in ActiveTimeToSimpleTime");
  NS_ASSERTION(aActiveTime >= 0, "Expecting non-negative active time");
  // Note that a negative aActiveTime will give us a negative value for
@ -2035,7 +2034,7 @@ nsSMILTimedElement::SampleFillValue()
  const nsSMILInterval* prevInterval = GetPreviousInterval();
  NS_ABORT_IF_FALSE(prevInterval,
      "Attempting to sample fill value but there is no previous interval");
-  NS_ABORT_IF_FALSE(prevInterval->End()->Time().IsResolved() &&
+  NS_ABORT_IF_FALSE(prevInterval->End()->Time().IsDefinite() &&
      prevInterval->End()->IsFixedTime(),
      "Attempting to sample fill value but the endpoint of the previous "
      "interval is not resolved and fixed");
@ -2136,7 +2135,7 @@ nsSMILTimedElement::GetNextMilestone(nsSMILMilestone& aNextMilestone) const
    {
      // Work out what comes next: the interval end or the next repeat iteration
      nsSMILTimeValue nextRepeat;
-      if (mSeekState == SEEK_NOT_SEEKING && mSimpleDur.IsResolved()) {
+      if (mSeekState == SEEK_NOT_SEEKING && mSimpleDur.IsDefinite()) {
        nextRepeat.SetMillis(mCurrentInterval->Begin()->Time().GetMillis() +
            (mCurrentRepeatIteration + 1) * mSimpleDur.GetMillis());
      }
@ -2152,7 +2151,7 @@ nsSMILTimedElement::GetNextMilestone(nsSMILMilestone& aNextMilestone) const
      }

      // Apply the previously calculated milestone
-      if (nextMilestone.IsResolved()) {
+      if (nextMilestone.IsDefinite()) {
        aNextMilestone.mIsEnd = nextMilestone != nextRepeat;
        aNextMilestone.mTime = nextMilestone.GetMillis();
        return PR_TRUE;
@ -2254,14 +2253,14 @@ nsSMILTimedElement::GetPreviousInterval() const
 }

 PRBool
-nsSMILTimedElement::HaveResolvedEndTimes() const
+nsSMILTimedElement::HaveDefiniteEndTimes() const
 {
  if (mEndInstances.IsEmpty())
    return PR_FALSE;

-  // mEndInstances is sorted so if the first time is not resolved then none of
+  // mEndInstances is sorted so if the first time is not definite then none of
  // them are
-  return mEndInstances[0]->Time().IsResolved();
+  return mEndInstances[0]->Time().IsDefinite();
 }

 PRBool
--- a/content/smil/nsSMILTimedElement.h
+++ b/content/smil/nsSMILTimedElement.h
@ -525,7 +525,7 @@ protected:
  const nsSMILInstanceTime* GetEffectiveBeginInstance() const;
  const nsSMILInterval* GetPreviousInterval() const;
  PRBool            HasPlayed() const { return !mOldIntervals.IsEmpty(); }
-  PRBool            HaveResolvedEndTimes() const;
+  PRBool            HaveDefiniteEndTimes() const;
  PRBool            EndHasEventConditions() const;

  // Reset the current interval by first passing ownership to a temporary
--- a/content/svg/content/src/SVGMotionSMILAnimationFunction.cpp
+++ b/content/svg/content/src/SVGMotionSMILAnimationFunction.cpp
@ -383,6 +383,18 @@ SVGMotionSMILAnimationFunction::
  CheckKeyPoints();
 }

+PRBool
+SVGMotionSMILAnimationFunction::IsToAnimation() const
+{
+  // Rely on inherited method, but not if we have an <mpath> child or a |path|
+  // attribute, because they'll override any 'to' attr we might have.
+  // NOTE: We can't rely on mPathSourceType, because it might not have been
+  // set to a useful value yet (or it might be stale).
+  return !GetFirstMpathChild(&mAnimationElement->AsElement()) &&
+    !HasAttr(nsGkAtoms::path) &&
+    nsSMILAnimationFunction::IsToAnimation();
+}
+
 void
 SVGMotionSMILAnimationFunction::CheckKeyPoints()
 {
@ -485,15 +497,4 @@ SVGMotionSMILAnimationFunction::UnsetRotate()
  mHasChanged = PR_TRUE;
 }

-PRBool
-SVGMotionSMILAnimationFunction::TreatSingleValueAsStatic() const
-{
-  // <animateMotion> has two more ways that we could be just sampling a single
-  // value -- via path attribute and the <mpath> element, with a path
-  // description that just includes a single "move" command.
-  return (mPathSourceType == ePathSourceType_ValuesAttr ||
-          mPathSourceType == ePathSourceType_PathAttr ||
-          mPathSourceType == ePathSourceType_Mpath);
-}
-
 } // namespace mozilla
--- a/content/svg/content/src/SVGMotionSMILAnimationFunction.h
+++ b/content/svg/content/src/SVGMotionSMILAnimationFunction.h
@ -85,7 +85,8 @@ protected:
  NS_OVERRIDE virtual nsresult GetValues(const nsISMILAttr& aSMILAttr,
                                         nsSMILValueArray& aResult);
  NS_OVERRIDE virtual void CheckValueListDependentAttrs(PRUint32 aNumValues);
-  NS_OVERRIDE virtual PRBool TreatSingleValueAsStatic() const;
+
+  NS_OVERRIDE virtual PRBool IsToAnimation() const;

  void     CheckKeyPoints();
  nsresult SetKeyPoints(const nsAString& aKeyPoints, nsAttrValue& aResult);
--- a/content/svg/content/src/nsSVGAnimationElement.cpp
+++ b/content/svg/content/src/nsSVGAnimationElement.cpp
@ -216,7 +216,7 @@ nsSVGAnimationElement::GetStartTime(float* retval)
  FlushAnimations();

  nsSMILTimeValue startTime = mTimedElement.GetStartTime();
-  if (!startTime.IsResolved())
+  if (!startTime.IsDefinite())
    return NS_ERROR_DOM_INVALID_STATE_ERR;

  *retval = float(double(startTime.GetMillis()) / PR_MSEC_PER_SEC);
@ -246,7 +246,7 @@ nsSVGAnimationElement::GetSimpleDuration(float* retval)
  // Not necessary to call FlushAnimations() for this

  nsSMILTimeValue simpleDur = mTimedElement.GetSimpleDuration();
-  if (!simpleDur.IsResolved()) {
+  if (!simpleDur.IsDefinite()) {
    *retval = 0.f;
    return NS_ERROR_DOM_NOT_SUPPORTED_ERR;
  }
--- a/content/svg/content/src/nsSVGFilters.cpp
+++ b/content/svg/content/src/nsSVGFilters.cpp
@ -5435,7 +5435,7 @@ nsSVGFEImageElement::LoadSVGImage(PRBool aForce, PRBool aNotify)
    NS_MakeAbsoluteURI(href, href, baseURI);

  // Make sure we don't get in a recursive death-spiral
-  nsIDocument* doc = GetOurDocument();
+  nsIDocument* doc = GetOwnerDoc();
  if (doc) {
    nsCOMPtr<nsIURI> hrefAsURI;
    if (NS_SUCCEEDED(StringToURI(href, doc, getter_AddRefs(hrefAsURI)))) {
--- a/content/svg/content/test/Makefile.in
+++ b/content/svg/content/test/Makefile.in
@ -60,6 +60,7 @@ _TEST_FILES = \
 		test_animLengthUnits.xhtml \
 		test_bbox.xhtml \
 		test_bbox-with-invalid-viewBox.xhtml \
+		test_bounds.html \
 		bbox-helper.svg \
 		bounds-helper.svg \
 		test_dataTypes.html \
--- a/content/svg/content/test/bounds-helper.svg
+++ b/content/svg/content/test/bounds-helper.svg
@ -7,24 +7,23 @@ text { font: 20px monospace; }

 <g id="g">
  <text id="text1" x="25" y="25">abc</text>
+  <text id="text1a" x="85" y="25" stroke="black" stroke-width="4">abc</text>
  <rect id="rect1" x="50" y="50" width="50" height="50" fill="green"/>
-  <rect id="rect1a" x="50" y="50" width="50" height="50" fill="none" stroke-width="2" stroke="yellow"/>
+  <rect id="rect1a" x="50" y="50" width="50" height="50" fill="none" stroke-width="4" stroke="yellow"/>
  <text id="text2" x="125" y="25">abc</text>
+  <text id="text2a" x="185" y="25" stroke="black" stroke-width="10">abc</text>
  <g transform="rotate(45 175 75)">
    <rect id="rect2" x="150" y="50" width="50" height="50" fill="yellow"/>
-    <rect id="rect2a" x="150" y="50" width="50" height="50" fill="none" stroke-width="2" stroke="blue"/>
+    <rect id="rect2a" x="150" y="50" width="50" height="50" fill="none" stroke-width="4" stroke="blue"/>
    <text id="text3" x="150" y="50" text-anchor="middle">abc</text>
  </g>
  <g transform="scale(2)">
    <rect id="rect3" x="25" y="80" width="50" height="50" fill="green"/>
-    <rect id="rect3a" x="25" y="80" width="50" height="50" fill="none" stroke-width="2" stroke="blue"/>
+    <rect id="rect3a" x="25" y="80" width="50" height="50" fill="none" stroke-width="4" stroke="blue"/>
  </g>
  <g transform="scale(2) rotate(45 175 75)">
    <rect id="rect4" x="150" y="50" width="50" height="50" fill="yellow"/>
-    <rect id="rect4a" x="150" y="50" width="50" height="50" fill="none" stroke-width="2" stroke="blue"/>
-    <text id="text4" x="125" y="125">abc</text>
+    <rect id="rect4a" x="150" y="50" width="50" height="50" fill="none" stroke-width="4" stroke="blue"/>
  </g>
-  <text id="text1a" x="85" y="25" stroke="black" stroke-width="1">M</text>
-  <text id="text2a" x="185" y="25" stroke="black" stroke-width="10">M</text>
 </g>
 </svg>
--- a/content/svg/content/test/test_bounds.html
+++ b/content/svg/content/test/test_bounds.html
@ -19,101 +19,120 @@ https://bugzilla.mozilla.org/show_bug.cgi?id=463934
 <script class="testbody" type="application/javascript">
 SimpleTest.waitForExplicitFinish();

+function Rect(left, top, width, height)
+{
+  this.left = left;
+  this.top = top;
+  this.width = width;
+  this.height = height;
+}
+
+Rect.prototype.roundOut = function()
+{
+  this.width = Math.ceil(this.left + this.width) - Math.floor(this.left);
+  this.height = Math.ceil(this.top + this.height) - Math.floor(this.top);
+  this.left = Math.floor(this.left);
+  this.top = Math.floor(this.top);
+}
+
+var delta = 1;
+
+function isApproximately(a, b, message)
+{
+  ok(delta >= Math.abs(a - b), message + " - got " + a + ", expected " + b + " ± " + delta);
+}
+
 function runTest()
 {
-  function isRounded(a, b, message) {
-    is (Math.round(a), Math.round(b), message);
-  }
-
  var doc = $("svg").contentWindow.document;
-  
+
  var text1 = doc.getElementById("text1");
-  
-  var len = text1.getComputedTextLength();
-  
+
  var text1Bounds = text1.getBoundingClientRect();
  var text2Bounds = doc.getElementById("text2").getBoundingClientRect();
  var text3Bounds = doc.getElementById("text3").getBoundingClientRect();
-  var text4Bounds = doc.getElementById("text4").getBoundingClientRect();

  var sin45 = Math.sin(Math.PI / 4);

-  isRounded(text1Bounds.left, 25, "text1.getBoundingClientRect().left");
-  isRounded(text1Bounds.width, len, "text1.getBoundingClientRect().width");
+  isApproximately(text1Bounds.left, 24, "text1.getBoundingClientRect().left");

-  isRounded(text2Bounds.left, text1Bounds.left + 100, "text2.getBoundingClientRect().left");
-  isRounded(text2Bounds.top, text1Bounds.top, "text2.getBoundingClientRect().top");
-  isRounded(text2Bounds.width, text1Bounds.width, "text2.getBoundingClientRect().width");
-  isRounded(text2Bounds.height, text1Bounds.height, "text2.getBoundingClientRect().height");
+  is(text2Bounds.left, text1Bounds.left + 100, "text2.getBoundingClientRect().left");
+  is(text2Bounds.top, text1Bounds.top, "text2.getBoundingClientRect().top");
+  is(text2Bounds.width, text1Bounds.width, "text2.getBoundingClientRect().width");
+  is(text2Bounds.height, text1Bounds.height, "text2.getBoundingClientRect().height");

-  isRounded(text3Bounds.width, (text1Bounds.width + text1Bounds.height) * sin45 + .5, "text3.getBoundingClientRect().width");
-  isRounded(text3Bounds.height, (text1Bounds.height  + text1Bounds.width) * sin45 + .5, "text3.getBoundingClientRect().height");
-
-  isRounded(text4Bounds.width, 2 * (text1Bounds.width + text1Bounds.height) * sin45, "text4.getBoundingClientRect().width");
-  isRounded(text4Bounds.height, 2 * ((text1Bounds.height  + text1Bounds.width) * sin45 - .5), "text4.getBoundingClientRect().height");
+  var r = (text1Bounds.width + text1Bounds.height) * sin45;
+  isApproximately(text3Bounds.width, Math.ceil(r), "text3.getBoundingClientRect().width");
+  isApproximately(text3Bounds.height, Math.ceil(r), "text3.getBoundingClientRect().height");

  var rect1Bounds = doc.getElementById("rect1").getBoundingClientRect();
  var rect2Bounds = doc.getElementById("rect2").getBoundingClientRect();
  var rect3Bounds = doc.getElementById("rect3").getBoundingClientRect();
  var rect4Bounds = doc.getElementById("rect4").getBoundingClientRect();
-  
-  isRounded(rect1Bounds.left, 50, "rect1.getBoundingClientRect().left");
-  isRounded(rect1Bounds.top, 50, "rect1.getBoundingClientRect().top");
-  isRounded(rect1Bounds.width, 50, "rect1.getBoundingClientRect().width");
-  isRounded(rect1Bounds.height, 50, "rect1.getBoundingClientRect().height");

-  isRounded(rect2Bounds.left, 175 - 50 * sin45 - .5, "rect2.getBoundingClientRect().left");
-  isRounded(rect2Bounds.top, 75 - 50 * sin45 - .5, "rect2.getBoundingClientRect().top");
-  isRounded(rect2Bounds.width, (50 * sin45 + .5) * 2, "rect2.getBoundingClientRect().width");
-  isRounded(rect2Bounds.height, (50 * sin45 + .5) * 2, "rect2.getBoundingClientRect().height");
+  is(rect1Bounds.left, 50, "rect1.getBoundingClientRect().left");
+  is(rect1Bounds.top, 50, "rect1.getBoundingClientRect().top");
+  is(rect1Bounds.width, 50, "rect1.getBoundingClientRect().width");
+  is(rect1Bounds.height, 50, "rect1.getBoundingClientRect().height");

-  isRounded(rect3Bounds.left, 50, "rect3.getBoundingClientRect().left");
-  isRounded(rect3Bounds.top, 160, "rect3.getBoundingClientRect().top");
-  isRounded(rect3Bounds.width, 100, "rect3.getBoundingClientRect().width");
-  isRounded(rect3Bounds.height, 100, "rect3.getBoundingClientRect().height");
+  rect = new Rect(175 - 50 * sin45, 75 - 50 * sin45, 50 * sin45 * 2, 50 * sin45 * 2);
+  rect.roundOut();
+  is(rect2Bounds.left, rect.left, "rect2.getBoundingClientRect().left");
+  is(rect2Bounds.top, rect.top, "rect2.getBoundingClientRect().top");
+  is(rect2Bounds.width, rect.width, "rect2.getBoundingClientRect().width");
+  is(rect2Bounds.height, rect.height, "rect2.getBoundingClientRect().height");

-  isRounded(rect4Bounds.left, 350 - 100 * sin45 - .5, "rect4.getBoundingClientRect().left");
-  isRounded(rect4Bounds.top, 150 - 100 * sin45 - .5, "rect4.getBoundingClientRect().top");
-  isRounded(rect4Bounds.width, (100 * sin45 + .5) * 2, "rect4.getBoundingClientRect().width");
-  isRounded(rect4Bounds.height, (100 * sin45 + .5) * 2, "rect4.getBoundingClientRect().height");
+  is(rect3Bounds.left, 50, "rect3.getBoundingClientRect().left");
+  is(rect3Bounds.top, 160, "rect3.getBoundingClientRect().top");
+  is(rect3Bounds.width, 100, "rect3.getBoundingClientRect().width");
+  is(rect3Bounds.height, 100, "rect3.getBoundingClientRect().height");
+
+  rect = new Rect(350 - 100 * sin45, 150 - 100 * sin45, 100 * sin45 * 2, 100 * sin45 * 2);
+  rect.roundOut();
+  is(rect4Bounds.left, rect.left, "rect4.getBoundingClientRect().left");
+  is(rect4Bounds.top, rect.top, "rect4.getBoundingClientRect().top");
+  is(rect4Bounds.width, rect.width, "rect4.getBoundingClientRect().width");
+  is(rect4Bounds.height, rect.height, "rect4.getBoundingClientRect().height");

  var rect1aBounds = doc.getElementById("rect1a").getBoundingClientRect();
  var rect2aBounds = doc.getElementById("rect2a").getBoundingClientRect();
  var rect3aBounds = doc.getElementById("rect3a").getBoundingClientRect();
  var rect4aBounds = doc.getElementById("rect4a").getBoundingClientRect();
-  
-  isRounded(rect1aBounds.left, 49, "rect1a.getBoundingClientRect().left");
-  isRounded(rect1aBounds.top, 49, "rect1a.getBoundingClientRect().top");
-  isRounded(rect1aBounds.width, 52, "rect1a.getBoundingClientRect().width");
-  isRounded(rect1aBounds.height, 52, "rect1a.getBoundingClientRect().height");

-  isRounded(rect2aBounds.left, 175 - 52 * sin45 - .5, "rect2a.getBoundingClientRect().left");
-  isRounded(rect2aBounds.top, 75 - 52 * sin45 - .5, "rect2a.getBoundingClientRect().top");
-  isRounded(rect2aBounds.width, 52 * sin45 * 2, "rect2a.getBoundingClientRect().width");
-  isRounded(rect2aBounds.height, 52 * sin45 * 2, "rect2a.getBoundingClientRect().height");
+  is(rect1aBounds.left, 48, "rect1a.getBoundingClientRect().left");
+  is(rect1aBounds.top, 48, "rect1a.getBoundingClientRect().top");
+  is(rect1aBounds.width, 54, "rect1a.getBoundingClientRect().width");
+  is(rect1aBounds.height, 54, "rect1a.getBoundingClientRect().height");

-  isRounded(rect3aBounds.left, 48, "rect3a.getBoundingClientRect().left");
-  isRounded(rect3aBounds.top, 158, "rect3a.getBoundingClientRect().top");
-  isRounded(rect3aBounds.width, 104, "rect3a.getBoundingClientRect().width");
-  isRounded(rect3aBounds.height, 104, "rect3a.getBoundingClientRect().height");
+  rect = new Rect(175 - 54 * sin45, 75 - 54 * sin45, 54 * sin45 * 2, 54 * sin45 * 2);
+  rect.roundOut();
+  is(rect2aBounds.left, rect.left, "rect2a.getBoundingClientRect().left");
+  is(rect2aBounds.top, rect.top, "rect2a.getBoundingClientRect().top");
+  is(rect2aBounds.width, rect.width, "rect2a.getBoundingClientRect().width");
+  is(rect2aBounds.height, rect.height, "rect2a.getBoundingClientRect().height");

-  isRounded(rect4aBounds.left, 350 - 104 * sin45 - .5, "rect4a.getBoundingClientRect().left");
-  isRounded(rect4aBounds.top, 150 - 104 * sin45 - .5, "rect4a.getBoundingClientRect().top");
-  isRounded(rect4aBounds.width, (104 * sin45 + .5) * 2, "rect4a.getBoundingClientRect().width");
-  isRounded(rect4aBounds.height, (104 * sin45 + .5) * 2, "rect4a.getBoundingClientRect().height");
+  is(rect3aBounds.left, 46, "rect3a.getBoundingClientRect().left");
+  is(rect3aBounds.top, 156, "rect3a.getBoundingClientRect().top");
+  is(rect3aBounds.width, 108, "rect3a.getBoundingClientRect().width");
+  is(rect3aBounds.height, 108, "rect3a.getBoundingClientRect().height");
+
+  rect = new Rect(350 - 108 * sin45, 150 - 108 * sin45, 108 * sin45 * 2, 108 * sin45 * 2);
+  rect.roundOut();
+  is(rect4aBounds.left, rect.left, "rect4a.getBoundingClientRect().left");
+  is(rect4aBounds.top, rect.top, "rect4a.getBoundingClientRect().top");
+  is(rect4aBounds.width, rect.width, "rect4a.getBoundingClientRect().width");
+  is(rect4aBounds.height, rect.height, "rect4a.getBoundingClientRect().height");

  var text1a = doc.getElementById("text1a");
-  
+
  var text1aBounds = text1a.getBoundingClientRect();
  var text2aBounds = doc.getElementById("text2a").getBoundingClientRect();

-  var len = text1a.getComputedTextLength();
+  isApproximately(text1aBounds.left, 82, "text1a.getBoundingClientRect().left");
+  is(text1aBounds.width, text1Bounds.width + 4, "text1a.getBoundingClientRect().width");

-  isRounded(text1aBounds.left, 85 - 1, "text1a.getBoundingClientRect().left");
-  isRounded(text1aBounds.width, len + 1, "text1a.getBoundingClientRect().width");
-  
-  isRounded(text2aBounds.left, text1aBounds.left + 100 - 4, "text2a.getBoundingClientRect().left");
-  isRounded(text2aBounds.width, text1aBounds.width + 9, "text2a.getBoundingClientRect().width");
+  is(text2aBounds.left, text1aBounds.left + 100 - 3, "text2a.getBoundingClientRect().left");
+  is(text2aBounds.width, text1aBounds.width + 6, "text2a.getBoundingClientRect().width");

  SimpleTest.finish();
 }
--- a/content/xbl/crashtests/crashtests.list
+++ b/content/xbl/crashtests/crashtests.list
@ -31,7 +31,7 @@ load 464863-1.xhtml
 load 472260-1.xhtml
 load 477878-1.html
 load 492978-1.xul
-load 493123-1.xhtml
+asserts-if(Android,2) load 493123-1.xhtml
 load 495354-1.xhtml
 load 507628-1.xhtml
 load 507991-1.xhtml
--- a/content/xslt/src/xslt/txExecutionState.cpp
+++ b/content/xslt/src/xslt/txExecutionState.cpp
@ -86,7 +86,9 @@ txLoadedDocumentsHash::~txLoadedDocumentsHash()

 txExecutionState::txExecutionState(txStylesheet* aStylesheet,
                                   PRBool aDisableLoads)
-    : mStylesheet(aStylesheet),
+    : mOutputHandler(nsnull),
+      mResultHandler(nsnull),
+      mStylesheet(aStylesheet),
      mNextInstruction(nsnull),
      mLocalVariables(nsnull),
      mRecursionDepth(0),
@ -199,6 +201,9 @@ txExecutionState::end(nsresult aResult)
    if (NS_SUCCEEDED(aResult)) {
        popTemplateRule();
    }
+    else if (!mOutputHandler) {
+        return NS_OK;
+    }
    return mOutputHandler->endDocument(aResult);
 }

--- a/docshell/base/crashtests/crashtests.list
+++ b/docshell/base/crashtests/crashtests.list
@ -5,8 +5,8 @@ load 430124-1.html
 load 430628-1.html
 load 432114-1.html
 load 432114-2.html
-load 436900-1.html
-asserts(0-2) load 436900-2.html # bug 566159
+asserts-if(Android,2) load 436900-1.html
+asserts(0-3) load 436900-2.html # bug 566159
 load 500328-1.html
 load 514779-1.xhtml
 load 614499-1.html
--- a/dom/base/crashtests/crashtests.list
+++ b/dom/base/crashtests/crashtests.list
@ -1,4 +1,4 @@
-load 90613-1.html
+asserts-if(Android,1) load 90613-1.html
 load 244933-1.html
 load 275912-1.html
 load 327571-1.html
@ -21,7 +21,7 @@ load 473284.xul
 load 499006-1.html
 load 499006-2.html
 load 502617.html
-asserts(1) load 504224.html # bug 564098
+asserts(1-2) load 504224.html # bug 564098
 load 603531.html
 load 601247.html
 load 609560-1.xhtml
--- a/dom/base/nsDOMClassInfo.cpp
+++ b/dom/base/nsDOMClassInfo.cpp
@ -48,6 +48,7 @@
 #include "AccessCheck.h"

 #include "xpcprivate.h"
+#include "XPCWrapper.h"

 #include "nscore.h"
 #include "nsDOMClassInfo.h"
@ -516,7 +517,6 @@ static const char kDOMStringBundleURL[] =

 #define WINDOW_SCRIPTABLE_FLAGS                                               \
 (nsIXPCScriptable::WANT_GETPROPERTY |                                        \
-  nsIXPCScriptable::WANT_SETPROPERTY |                                        \
  nsIXPCScriptable::WANT_PRECREATE |                                          \
  nsIXPCScriptable::WANT_FINALIZE |                                           \
  nsIXPCScriptable::WANT_EQUALITY |                                           \
@ -665,7 +665,8 @@ static nsDOMClassInfoData sClassInfoData[] = {

  NS_DEFINE_CLASSINFO_DATA(Navigator, nsNavigatorSH,
                           DOM_DEFAULT_SCRIPTABLE_FLAGS |
-                           nsIXPCScriptable::WANT_PRECREATE)
+                           nsIXPCScriptable::WANT_PRECREATE |
+                           nsIXPCScriptable::WANT_NEWRESOLVE)
  NS_DEFINE_CLASSINFO_DATA(Plugin, nsPluginSH,
                           ARRAY_SCRIPTABLE_FLAGS)
  NS_DEFINE_CLASSINFO_DATA(PluginArray, nsPluginArraySH,
@ -2014,7 +2015,8 @@ CutPrefix(const char *aName) {
 nsresult
 nsDOMClassInfo::RegisterClassName(PRInt32 aClassInfoID)
 {
-  nsScriptNameSpaceManager *nameSpaceManager = nsJSRuntime::GetNameSpaceManager();
+  nsScriptNameSpaceManager *nameSpaceManager =
+    nsJSRuntime::GetNameSpaceManager();
  NS_ENSURE_TRUE(nameSpaceManager, NS_ERROR_NOT_INITIALIZED);

  nameSpaceManager->RegisterClassName(sClassInfoData[aClassInfoID].mName,
@ -2030,7 +2032,8 @@ nsDOMClassInfo::RegisterClassName(PRInt32 aClassInfoID)
 nsresult
 nsDOMClassInfo::RegisterClassProtos(PRInt32 aClassInfoID)
 {
-  nsScriptNameSpaceManager *nameSpaceManager = nsJSRuntime::GetNameSpaceManager();
+  nsScriptNameSpaceManager *nameSpaceManager =
+    nsJSRuntime::GetNameSpaceManager();
  NS_ENSURE_TRUE(nameSpaceManager, NS_ERROR_NOT_INITIALIZED);
  PRBool found_old;

@ -2082,7 +2085,8 @@ nsDOMClassInfo::RegisterClassProtos(PRInt32 aClassInfoID)
 nsresult
 nsDOMClassInfo::RegisterExternalClasses()
 {
-  nsScriptNameSpaceManager *nameSpaceManager = nsJSRuntime::GetNameSpaceManager();
+  nsScriptNameSpaceManager *nameSpaceManager =
+    nsJSRuntime::GetNameSpaceManager();
  NS_ENSURE_TRUE(nameSpaceManager, NS_ERROR_NOT_INITIALIZED);

  nsCOMPtr<nsIComponentRegistrar> registrar;
@ -5269,39 +5273,6 @@ nsWindowSH::GetProperty(nsIXPConnectWrappedNative *wrapper, JSContext *cx,
  return NS_OK;
 }

-NS_IMETHODIMP
-nsWindowSH::SetProperty(nsIXPConnectWrappedNative *wrapper, JSContext *cx,
-                        JSObject *obj, jsid id, jsval *vp, PRBool *_retval)
-{
-  if (id == sLocation_id) {
-    JSAutoRequest ar(cx);
-
-    JSString *val = ::JS_ValueToString(cx, *vp);
-    NS_ENSURE_TRUE(val, NS_ERROR_UNEXPECTED);
-
-    nsCOMPtr<nsIDOMWindow> window = do_QueryWrappedNative(wrapper);
-    NS_ENSURE_TRUE(window, NS_ERROR_UNEXPECTED);
-
-    nsCOMPtr<nsIDOMLocation> location;
-    nsresult rv = window->GetLocation(getter_AddRefs(location));
-    NS_ENSURE_TRUE(NS_SUCCEEDED(rv) && location, rv);
-
-    nsCOMPtr<nsIXPConnectJSObjectHolder> holder;
-    rv = WrapNative(cx, obj, location, &NS_GET_IID(nsIDOMLocation), PR_TRUE,
-                    vp, getter_AddRefs(holder));
-    NS_ENSURE_SUCCESS(rv, rv);
-
-    nsDependentJSString depStr;
-    NS_ENSURE_TRUE(depStr.init(cx, val), NS_ERROR_UNEXPECTED);
-
-    rv = location->SetHref(depStr);
-
-    return NS_FAILED(rv) ? rv : NS_SUCCESS_I_DID_SOMETHING;
-  }
-
-  return NS_OK;
-}
-
 NS_IMETHODIMP
 nsWindowSH::Enumerate(nsIXPConnectWrappedNative *wrapper, JSContext *cx,
                      JSObject *obj, PRBool *_retval)
@ -5564,7 +5535,8 @@ private:
  {
    *aNameStruct = nsnull;

-    nsScriptNameSpaceManager *nameSpaceManager = nsJSRuntime::GetNameSpaceManager();
+    nsScriptNameSpaceManager *nameSpaceManager =
+      nsJSRuntime::GetNameSpaceManager();
    if (!nameSpaceManager) {
      NS_ERROR("Can't get namespace manager.");
      return NS_ERROR_UNEXPECTED;
@ -5772,7 +5744,8 @@ nsDOMConstructor::HasInstance(nsIXPConnectWrappedNative *wrapper,
    return NS_OK;
  }

-  nsScriptNameSpaceManager *nameSpaceManager = nsJSRuntime::GetNameSpaceManager();
+  nsScriptNameSpaceManager *nameSpaceManager =
+    nsJSRuntime::GetNameSpaceManager();
  NS_ASSERTION(nameSpaceManager, "Can't get namespace manager?");

  const nsIID *class_iid;
@ -6125,7 +6098,8 @@ nsWindowSH::GlobalResolve(nsGlobalWindow *aWin, JSContext *cx,
 {
  *did_resolve = PR_FALSE;

-  nsScriptNameSpaceManager *nameSpaceManager = nsJSRuntime::GetNameSpaceManager();
+  nsScriptNameSpaceManager *nameSpaceManager =
+    nsJSRuntime::GetNameSpaceManager();
  NS_ENSURE_TRUE(nameSpaceManager, NS_ERROR_NOT_INITIALIZED);

  nsDependentJSString name(id);
@ -6392,6 +6366,68 @@ static JSNewResolveOp sOtherResolveFuncs[] = {
  mozilla::dom::workers::ResolveWorkerClasses
 };

+template<class Interface>
+static nsresult
+LocationSetterGuts(JSContext *cx, JSObject *obj, jsval *vp)
+{
+  // This function duplicates some of the logic in XPC_WN_HelperSetProperty
+  XPCWrappedNative *wrapper =
+    XPCWrappedNative::GetWrappedNativeOfJSObject(cx, obj);
+
+  // The error checks duplicate code in THROW_AND_RETURN_IF_BAD_WRAPPER
+  NS_ENSURE_TRUE(wrapper, NS_ERROR_XPC_BAD_OP_ON_WN_PROTO);
+  NS_ENSURE_TRUE(wrapper->IsValid(), NS_ERROR_XPC_HAS_BEEN_SHUTDOWN);
+
+  nsCOMPtr<Interface> xpcomObj = do_QueryWrappedNative(wrapper);
+  NS_ENSURE_TRUE(xpcomObj, NS_ERROR_UNEXPECTED);
+
+  nsCOMPtr<nsIDOMLocation> location;
+  nsresult rv = xpcomObj->GetLocation(getter_AddRefs(location));
+  NS_ENSURE_SUCCESS(rv, rv);
+
+  JSString *val = ::JS_ValueToString(cx, *vp);
+  NS_ENSURE_TRUE(val, NS_ERROR_UNEXPECTED);
+
+  nsDependentJSString depStr;
+  NS_ENSURE_TRUE(depStr.init(cx, val), NS_ERROR_UNEXPECTED);
+  
+  rv = location->SetHref(depStr);
+  NS_ENSURE_SUCCESS(rv, rv);
+
+  nsCOMPtr<nsIXPConnectJSObjectHolder> holder;
+  return WrapNative(cx, JS_GetGlobalForScopeChain(cx), location,
+                    &NS_GET_IID(nsIDOMLocation), PR_TRUE, vp,
+                    getter_AddRefs(holder));
+}
+
+template<class Interface>
+static JSBool
+LocationSetter(JSContext *cx, JSObject *obj, jsid id, JSBool strict,
+               jsval *vp)
+{
+  nsresult rv = LocationSetterGuts<Interface>(cx, obj, vp);
+  if (NS_FAILED(rv)) {
+    if (!::JS_IsExceptionPending(cx)) {
+      nsDOMClassInfo::ThrowJSException(cx, rv);
+    }
+    return JS_FALSE;
+  }
+
+  return JS_TRUE;
+}
+
+static JSBool
+LocationSetterUnwrapper(JSContext *cx, JSObject *obj, jsid id, JSBool strict,
+                        jsval *vp)
+{
+  JSObject *wrapped = XPCWrapper::UnsafeUnwrapSecurityWrapper(obj);
+  if (wrapped) {
+    obj = wrapped;
+  }
+
+  return LocationSetter<nsIDOMWindow>(cx, obj, id, strict, vp);
+}
+
 NS_IMETHODIMP
 nsWindowSH::NewResolve(nsIXPConnectWrappedNative *wrapper, JSContext *cx,
                       JSObject *obj, jsid id, PRUint32 flags,
@ -6544,7 +6580,8 @@ nsWindowSH::NewResolve(nsIXPConnectWrappedNative *wrapper, JSContext *cx,
    NS_ENSURE_SUCCESS(rv, rv);

    JSBool ok = JS_WrapValue(cx, &v) &&
-                JS_DefinePropertyById(cx, obj, id, v, nsnull, nsnull,
+                JS_DefinePropertyById(cx, obj, id, v, nsnull,
+                                      LocationSetterUnwrapper,
                                      JSPROP_PERMANENT | JSPROP_ENUMERATE);

    if (!ok) {
@ -6990,6 +7027,77 @@ nsLocationSH::PreCreate(nsISupports *nativeObj, JSContext *cx,
 }

 // DOM Navigator helper
+
+NS_IMETHODIMP
+nsNavigatorSH::NewResolve(nsIXPConnectWrappedNative *wrapper, JSContext *cx,
+                          JSObject *obj, jsid id, PRUint32 flags,
+                          JSObject **objp, PRBool *_retval)
+{
+  if (!JSID_IS_STRING(id) || (flags & JSRESOLVE_ASSIGNING)) {
+    return NS_OK;
+  }
+
+  nsScriptNameSpaceManager *nameSpaceManager =
+    nsJSRuntime::GetNameSpaceManager();
+  NS_ENSURE_TRUE(nameSpaceManager, NS_ERROR_NOT_INITIALIZED);
+
+  nsDependentJSString name(id);
+
+  const nsGlobalNameStruct *name_struct = nsnull;
+
+  nameSpaceManager->LookupNavigatorName(name, &name_struct);
+
+  if (!name_struct) {
+    return NS_OK;
+  }
+  NS_ASSERTION(name_struct->mType == nsGlobalNameStruct::eTypeNavigatorProperty,
+               "unexpected type");
+
+  nsresult rv = NS_OK;
+
+  nsCOMPtr<nsISupports> native(do_CreateInstance(name_struct->mCID, &rv));
+  NS_ENSURE_SUCCESS(rv, rv);
+
+  jsval prop_val = JSVAL_VOID; // Property value.
+
+  nsCOMPtr<nsIDOMGlobalPropertyInitializer> gpi(do_QueryInterface(native));
+
+  if (gpi) {
+    JSObject *global = JS_GetGlobalForObject(cx, obj);
+
+    nsISupports *globalNative = XPConnect()->GetNativeOfWrapper(cx, global);
+    nsCOMPtr<nsIDOMWindow> window = do_QueryInterface(globalNative);
+
+    if (!window) {
+      return NS_ERROR_UNEXPECTED;
+    }
+
+    rv = gpi->Init(window, &prop_val);
+    NS_ENSURE_SUCCESS(rv, rv);
+  }
+
+  if (JSVAL_IS_PRIMITIVE(prop_val)) {
+    nsCOMPtr<nsIXPConnectJSObjectHolder> holder;
+    rv = WrapNative(cx, obj, native, PR_TRUE, &prop_val,
+                    getter_AddRefs(holder));
+
+    NS_ENSURE_SUCCESS(rv, rv);
+  }
+
+  if (!JS_WrapValue(cx, &prop_val)) {
+    return NS_ERROR_UNEXPECTED;
+  }
+
+  JSBool ok = ::JS_DefinePropertyById(cx, obj, id, prop_val, nsnull, nsnull,
+                                      JSPROP_ENUMERATE);
+
+  *_retval = PR_TRUE;
+  *objp = obj;
+
+  return ok ? NS_OK : NS_ERROR_FAILURE;
+}
+
+// static
 nsresult
 nsNavigatorSH::PreCreate(nsISupports *nativeObj, JSContext *cx,
                         JSObject *globalObj, JSObject **parentObj)
@ -8177,7 +8285,8 @@ nsDocumentSH::NewResolve(nsIXPConnectWrappedNative *wrapper, JSContext *cx,

    JSAutoRequest ar(cx);

-    JSBool ok = ::JS_DefinePropertyById(cx, obj, id, v, nsnull, nsnull,
+    JSBool ok = ::JS_DefinePropertyById(cx, obj, id, v, nsnull,
+                                        LocationSetter<nsIDOMDocument>,
                                        JSPROP_PERMANENT | JSPROP_ENUMERATE);

    if (!ok) {
@ -8222,34 +8331,6 @@ NS_IMETHODIMP
 nsDocumentSH::SetProperty(nsIXPConnectWrappedNative *wrapper, JSContext *cx,
                          JSObject *obj, jsid id, jsval *vp, PRBool *_retval)
 {
-  if (id == sLocation_id) {
-    nsCOMPtr<nsIDOMDocument> doc = do_QueryWrappedNative(wrapper);
-    NS_ENSURE_TRUE(doc, NS_ERROR_UNEXPECTED);
-
-    nsCOMPtr<nsIDOMLocation> location;
-    nsresult rv = doc->GetLocation(getter_AddRefs(location));
-    NS_ENSURE_SUCCESS(rv, rv);
-
-    if (location) {
-      JSAutoRequest ar(cx);
-
-      JSString *val = ::JS_ValueToString(cx, *vp);
-      NS_ENSURE_TRUE(val, NS_ERROR_UNEXPECTED);
-
-      nsDependentJSString depStr;
-      NS_ENSURE_TRUE(depStr.init(cx, val), NS_ERROR_UNEXPECTED);
-
-      rv = location->SetHref(depStr);
-      NS_ENSURE_SUCCESS(rv, rv);
-
-      nsCOMPtr<nsIXPConnectJSObjectHolder> holder;
-      rv = WrapNative(cx, JS_GetGlobalForScopeChain(cx), location,
-                      &NS_GET_IID(nsIDOMLocation), PR_TRUE, vp,
-                      getter_AddRefs(holder));
-      return NS_FAILED(rv) ? rv : NS_SUCCESS_I_DID_SOMETHING;
-    }
-  }
-
  if (id == sDocumentURIObject_id && IsPrivilegedScript()) {
    // We don't want privileged script that can read this property to set it,
    // but _do_ want to allow everyone else to set a value they can then read.
--- a/dom/base/nsDOMClassInfo.h
+++ b/dom/base/nsDOMClassInfo.h
@ -407,8 +407,6 @@ public:
 #endif
  NS_IMETHOD GetProperty(nsIXPConnectWrappedNative *wrapper, JSContext *cx,
                         JSObject *obj, jsid id, jsval *vp, PRBool *_retval);
-  NS_IMETHOD SetProperty(nsIXPConnectWrappedNative *wrapper, JSContext *cx,
-                         JSObject *obj, jsid id, jsval *vp, PRBool *_retval);
  NS_IMETHOD Enumerate(nsIXPConnectWrappedNative *wrapper, JSContext *cx,
                       JSObject *obj, PRBool *_retval);
  NS_IMETHOD NewResolve(nsIXPConnectWrappedNative *wrapper, JSContext *cx,
@ -483,6 +481,9 @@ protected:
 public:
  NS_IMETHOD PreCreate(nsISupports *nativeObj, JSContext *cx,
                       JSObject *globalObj, JSObject **parentObj);
+  NS_IMETHOD NewResolve(nsIXPConnectWrappedNative *wrapper, JSContext *cx,
+                        JSObject *obj, jsid id, PRUint32 flags,
+                        JSObject **objp, PRBool *_retval);

  static nsIClassInfo *doCreate(nsDOMClassInfoData* aData)
  {
--- a/dom/base/nsGlobalWindow.cpp
+++ b/dom/base/nsGlobalWindow.cpp
@ -4408,9 +4408,11 @@ nsGlobalWindow::SetFullScreen(PRBool aFullScreen)

  PRBool rootWinFullScreen;
  GetFullScreen(&rootWinFullScreen);
-  // Only chrome can change our fullScreen mode.
-  if (aFullScreen == rootWinFullScreen || 
-      !nsContentUtils::IsCallerTrustedForWrite()) {
+  // Only chrome can change our fullScreen mode, unless the DOM full-screen
+  // API is enabled.
+  if ((aFullScreen == rootWinFullScreen || 
+      !nsContentUtils::IsCallerTrustedForWrite()) &&
+      !nsContentUtils::IsFullScreenApiEnabled()) {
    return NS_OK;
  }

@ -4460,6 +4462,14 @@ nsGlobalWindow::SetFullScreen(PRBool aFullScreen)
  if (widget)
    widget->MakeFullScreen(aFullScreen);

+  if (!mFullScreen && mDocument) {
+    // Notify the document that we've left full-screen mode. This is so that
+    // if we're in full-screen mode and the user exits full-screen mode with
+    // the browser full-screen mode toggle keyboard-shortcut, we detect that
+    // and leave DOM API full-screen mode too.
+    mDocument->MozCancelFullScreen();
+  }
+
  return NS_OK;
 }

--- a/dom/base/nsGlobalWindow.h
+++ b/dom/base/nsGlobalWindow.h
@ -537,11 +537,19 @@ public:
  }

  static nsGlobalWindow* GetOuterWindowWithId(PRUint64 aWindowID) {
+    if (!sWindowsById) {
+      return nsnull;
+    }
+
    nsGlobalWindow* outerWindow = sWindowsById->Get(aWindowID);
    return outerWindow && !outerWindow->IsInnerWindow() ? outerWindow : nsnull;
  }

  static nsGlobalWindow* GetInnerWindowWithId(PRUint64 aInnerWindowID) {
+    if (!sWindowsById) {
+      return nsnull;
+    }
+
    nsGlobalWindow* innerWindow = sWindowsById->Get(aInnerWindowID);
    return innerWindow && innerWindow->IsInnerWindow() ? innerWindow : nsnull;
  }
--- a/dom/base/nsIScriptNameSpaceManager.h
+++ b/dom/base/nsIScriptNameSpaceManager.h
@ -51,6 +51,9 @@
 #define JAVASCRIPT_GLOBAL_PRIVILEGED_PROPERTY_CATEGORY \
  "JavaScript-global-privileged-property"

+#define JAVASCRIPT_NAVIGATOR_PROPERTY_CATEGORY \
+  "JavaScript-navigator-property"
+
 #define JAVASCRIPT_GLOBAL_STATIC_NAMESET_CATEGORY \
  "JavaScript-global-static-nameset"

--- a/dom/base/nsJSEnvironment.cpp
+++ b/dom/base/nsJSEnvironment.cpp
@ -2259,14 +2259,8 @@ nsJSContext::CreateOuterObject(nsIScriptGlobalObject *aGlobalObject,
  mGlobalObjectRef = aGlobalObject;

  nsCOMPtr<nsIDOMChromeWindow> chromeWindow(do_QueryInterface(aGlobalObject));
-  PRUint32 flags = 0;

  if (chromeWindow) {
-    // Flag this window's global object and objects under it as "system",
-    // for optional automated XPCNativeWrapper construction when chrome JS
-    // views a content DOM.
-    flags = nsIXPConnect::FLAG_SYSTEM_GLOBAL_OBJECT;
-
    // Always enable E4X for XUL and other chrome content -- there is no
    // need to preserve the <!-- script hiding hack from JS-in-HTML daze
    // (introduced in 1995 for graceful script degradation in Netscape 1,
--- a/dom/base/nsScriptNameSpaceManager.cpp
+++ b/dom/base/nsScriptNameSpaceManager.cpp
@ -148,18 +148,19 @@ nsScriptNameSpaceManager::~nsScriptNameSpaceManager()
  if (mIsInitialized) {
    // Destroy the hash
    PL_DHashTableFinish(&mGlobalNames);
+    PL_DHashTableFinish(&mNavigatorNames);
  }
  MOZ_COUNT_DTOR(nsScriptNameSpaceManager);
 }

 nsGlobalNameStruct *
-nsScriptNameSpaceManager::AddToHash(const char *aKey,
+nsScriptNameSpaceManager::AddToHash(PLDHashTable *aTable, const char *aKey,
                                    const PRUnichar **aClassName)
 {
  NS_ConvertASCIItoUTF16 key(aKey);
  GlobalNameMapEntry *entry =
    static_cast<GlobalNameMapEntry *>
-               (PL_DHashTableOperate(&mGlobalNames, &key, PL_DHASH_ADD));
+               (PL_DHashTableOperate(aTable, &key, PL_DHASH_ADD));

  if (!entry) {
    return nsnull;
@ -371,7 +372,7 @@ nsScriptNameSpaceManager::RegisterInterface(const char* aIfName,
 {
  *aFoundOld = PR_FALSE;

-  nsGlobalNameStruct *s = AddToHash(aIfName);
+  nsGlobalNameStruct *s = AddToHash(&mGlobalNames, aIfName);
  NS_ENSURE_TRUE(s, NS_ERROR_OUT_OF_MEMORY);

  if (s->mType != nsGlobalNameStruct::eTypeNotInitialized) {
@ -408,6 +409,15 @@ nsScriptNameSpaceManager::Init()
                                     GLOBALNAME_HASHTABLE_INITIAL_SIZE);
  NS_ENSURE_TRUE(mIsInitialized, NS_ERROR_OUT_OF_MEMORY);

+  mIsInitialized = PL_DHashTableInit(&mNavigatorNames, &hash_table_ops, nsnull,
+                                     sizeof(GlobalNameMapEntry), 
+                                     GLOBALNAME_HASHTABLE_INITIAL_SIZE);
+  if (!mIsInitialized) {
+    PL_DHashTableFinish(&mGlobalNames);
+
+    return NS_ERROR_OUT_OF_MEMORY;
+  }
+
  nsresult rv = NS_OK;

  rv = FillHashWithDOMInterfaces();
@ -432,6 +442,9 @@ nsScriptNameSpaceManager::Init()
  rv = FillHash(cm, JAVASCRIPT_GLOBAL_DYNAMIC_NAMESET_CATEGORY);
  NS_ENSURE_SUCCESS(rv, rv);

+  rv = FillHash(cm, JAVASCRIPT_NAVIGATOR_PROPERTY_CATEGORY);
+  NS_ENSURE_SUCCESS(rv, rv);
+
  // Initial filling of the has table has been done.
  // Now, listen for changes.
  nsCOMPtr<nsIObserverService> serv = 
@ -509,6 +522,25 @@ nsScriptNameSpaceManager::LookupName(const nsAString& aName,
  return NS_OK;
 }

+nsresult
+nsScriptNameSpaceManager::LookupNavigatorName(const nsAString& aName,
+                                              const nsGlobalNameStruct **aNameStruct)
+{
+  GlobalNameMapEntry *entry =
+    static_cast<GlobalNameMapEntry *>
+               (PL_DHashTableOperate(&mNavigatorNames, &aName,
+                                     PL_DHASH_LOOKUP));
+
+  if (PL_DHASH_ENTRY_IS_BUSY(entry) &&
+      !((&entry->mGlobalName)->mDisabled)) {
+    *aNameStruct = &entry->mGlobalName;
+  } else {
+    *aNameStruct = nsnull;
+  }
+
+  return NS_OK;
+}
+
 nsresult
 nsScriptNameSpaceManager::RegisterClassName(const char *aClassName,
                                            PRInt32 aDOMClassInfoID,
@ -520,7 +552,7 @@ nsScriptNameSpaceManager::RegisterClassName(const char *aClassName,
    NS_ERROR("Trying to register a non-ASCII class name");
    return NS_OK;
  }
-  nsGlobalNameStruct *s = AddToHash(aClassName, aResult);
+  nsGlobalNameStruct *s = AddToHash(&mGlobalNames, aClassName, aResult);
  NS_ENSURE_TRUE(s, NS_ERROR_OUT_OF_MEMORY);

  if (s->mType == nsGlobalNameStruct::eTypeClassConstructor) {
@ -555,7 +587,7 @@ nsScriptNameSpaceManager::RegisterClassProto(const char *aClassName,

  *aFoundOld = PR_FALSE;

-  nsGlobalNameStruct *s = AddToHash(aClassName);
+  nsGlobalNameStruct *s = AddToHash(&mGlobalNames, aClassName);
  NS_ENSURE_TRUE(s, NS_ERROR_OUT_OF_MEMORY);

  if (s->mType != nsGlobalNameStruct::eTypeNotInitialized &&
@ -575,7 +607,7 @@ nsresult
 nsScriptNameSpaceManager::RegisterExternalClassName(const char *aClassName,
                                                    nsCID& aCID)
 {
-  nsGlobalNameStruct *s = AddToHash(aClassName);
+  nsGlobalNameStruct *s = AddToHash(&mGlobalNames, aClassName);
  NS_ENSURE_TRUE(s, NS_ERROR_OUT_OF_MEMORY);

  // If an external constructor is already defined with aClassName we
@ -605,7 +637,7 @@ nsScriptNameSpaceManager::RegisterDOMCIData(const char *aName,
                                            const nsCID *aConstructorCID)
 {
  const PRUnichar* className;
-  nsGlobalNameStruct *s = AddToHash(aName, &className);
+  nsGlobalNameStruct *s = AddToHash(&mGlobalNames, aName, &className);
  NS_ENSURE_TRUE(s, NS_ERROR_OUT_OF_MEMORY);

  // If an external constructor is already defined with aClassName we
@ -657,6 +689,8 @@ nsScriptNameSpaceManager::AddCategoryEntryToHash(nsICategoryManager* aCategoryMa
  } else if (strcmp(aCategory, JAVASCRIPT_GLOBAL_PROPERTY_CATEGORY) == 0 ||
             strcmp(aCategory, JAVASCRIPT_GLOBAL_PRIVILEGED_PROPERTY_CATEGORY) == 0) {
    type = nsGlobalNameStruct::eTypeProperty;
+  } else if (strcmp(aCategory, JAVASCRIPT_NAVIGATOR_PROPERTY_CATEGORY) == 0) {
+    type = nsGlobalNameStruct::eTypeNavigatorProperty;
  } else if (strcmp(aCategory, JAVASCRIPT_GLOBAL_STATIC_NAMESET_CATEGORY) == 0) {
    type = nsGlobalNameStruct::eTypeStaticNameSet;
  } else if (strcmp(aCategory, JAVASCRIPT_GLOBAL_DYNAMIC_NAMESET_CATEGORY) == 0) {
@ -704,7 +738,7 @@ nsScriptNameSpaceManager::AddCategoryEntryToHash(nsICategoryManager* aCategoryMa
                                            categoryEntry.get(),
                                            getter_Copies(constructorProto));
    if (NS_SUCCEEDED(rv)) {
-      nsGlobalNameStruct *s = AddToHash(categoryEntry.get());
+      nsGlobalNameStruct *s = AddToHash(&mGlobalNames, categoryEntry.get());
      NS_ENSURE_TRUE(s, NS_ERROR_OUT_OF_MEMORY);

      if (s->mType == nsGlobalNameStruct::eTypeNotInitialized) {
@ -722,7 +756,14 @@ nsScriptNameSpaceManager::AddCategoryEntryToHash(nsICategoryManager* aCategoryMa
    }
  }

-  nsGlobalNameStruct *s = AddToHash(categoryEntry.get());
+  PLDHashTable *table;
+  if (type == nsGlobalNameStruct::eTypeNavigatorProperty) {
+    table = &mNavigatorNames;
+  } else {
+    table = &mGlobalNames;
+  }
+
+  nsGlobalNameStruct *s = AddToHash(table, categoryEntry.get());
  NS_ENSURE_TRUE(s, NS_ERROR_OUT_OF_MEMORY);

  if (s->mType == nsGlobalNameStruct::eTypeNotInitialized) {
--- a/dom/base/nsScriptNameSpaceManager.h
+++ b/dom/base/nsScriptNameSpaceManager.h
@ -75,6 +75,7 @@ struct nsGlobalNameStruct
    eTypeNotInitialized,
    eTypeInterface,
    eTypeProperty,
+    eTypeNavigatorProperty,
    eTypeExternalConstructor,
    eTypeStaticNameSet,
    eTypeDynamicNameSet,
@ -128,6 +129,12 @@ public:
  nsresult LookupName(const nsAString& aName,
                      const nsGlobalNameStruct **aNameStruct,
                      const PRUnichar **aClassName = nsnull);
+  // Returns a nsGlobalNameStruct for the navigator property aName, or
+  // null if one is not found. The returned nsGlobalNameStruct is only
+  // guaranteed to be valid until the next call to any of the methods
+  // in this class.
+  nsresult LookupNavigatorName(const nsAString& aName,
+                               const nsGlobalNameStruct **aNameStruct);

  nsresult RegisterClassName(const char *aClassName,
                             PRInt32 aDOMClassInfoID,
@ -161,7 +168,7 @@ protected:
  // that aKey will be mapped to. If mType in the returned
  // nsGlobalNameStruct is != eTypeNotInitialized, an entry for aKey
  // already existed.
-  nsGlobalNameStruct *AddToHash(const char *aKey,
+  nsGlobalNameStruct *AddToHash(PLDHashTable *aTable, const char *aKey,
                                const PRUnichar **aClassName = nsnull);

  nsresult FillHash(nsICategoryManager *aCategoryManager,
@ -184,9 +191,8 @@ protected:
                                  const char* aCategory,
                                  nsISupports* aEntry);

-  // Inline PLDHashTable, init with PL_DHashTableInit() and delete
-  // with PL_DHashTableFinish().
  PLDHashTable mGlobalNames;
+  PLDHashTable mNavigatorNames;

  PRPackedBool mIsInitialized;
 };
--- a/dom/interfaces/core/nsIDOMDocument.idl
+++ b/dom/interfaces/core/nsIDOMDocument.idl
@ -63,7 +63,7 @@ interface nsIDOMCaretPosition;
 * http://dvcs.w3.org/hg/domcore/raw-file/tip/Overview.html
 */

-[scriptable, uuid(d19897dc-948a-42e7-8ac6-d8a0bd141b85)]
+[scriptable, uuid(903493d3-72b6-4416-b930-fbfc17ef1d87)]
 interface nsIDOMDocument : nsIDOMNode
 {
  readonly attribute nsIDOMDocumentType         doctype;
@ -371,4 +371,28 @@ interface nsIDOMDocument : nsIDOMNode
                          in nsIDOMElement aImageElement);

  nsIDOMCaretPosition caretPositionFromPoint(in float x, in float y);
+  
+  /**
+   * Element which is currently the full-screen element as per the DOM
+   * full-screen api.
+   *
+   * @see <https://wiki.mozilla.org/index.php?title=Gecko:FullScreenAPI>
+   */
+  readonly attribute nsIDOMHTMLElement mozFullScreenElement;
+
+  /**
+   * Causes the document to leave DOM full-screen mode, if it's in
+   * full-screen mode, as per the DOM full-screen api.
+   *
+   * @see <https://wiki.mozilla.org/index.php?title=Gecko:FullScreenAPI>
+   */
+  void mozCancelFullScreen();   
+  
+  /**
+   * Denotes whether this document is in DOM full-screen mode, as per the DOM
+   * full-screen api.
+   *
+   * @see <https://wiki.mozilla.org/index.php?title=Gecko:FullScreenAPI>
+   */
+  readonly attribute boolean mozFullScreen;  
 };
--- a/dom/interfaces/core/nsIInlineEventHandlers.idl
+++ b/dom/interfaces/core/nsIInlineEventHandlers.idl
@ -80,6 +80,7 @@ interface nsIInlineEventHandlers : nsISupports
  [implicit_jscontext] attribute jsval onmouseup;
  // Not supported yet
  // [implicit_jscontext] attribute jsval onmousewheel;
+  [implicit_jscontext] attribute jsval onmozfullscreenchange;
  [implicit_jscontext] attribute jsval onpause;
  [implicit_jscontext] attribute jsval onplay;
  [implicit_jscontext] attribute jsval onplaying;
--- a/dom/interfaces/html/nsIDOMHTMLIFrameElement.idl
+++ b/dom/interfaces/html/nsIDOMHTMLIFrameElement.idl
@ -50,7 +50,7 @@
 * http://www.whatwg.org/specs/web-apps/current-work/
 */

-[scriptable, uuid(33dfbcdc-4edf-4e6a-acf4-c6b5bbb61caf)]
+[scriptable, uuid(31969911-36fb-42ee-9a00-018c3ff78cfb)]
 interface nsIDOMHTMLIFrameElement : nsIDOMHTMLElement
 {
           attribute DOMString        align;
@ -65,4 +65,9 @@ interface nsIDOMHTMLIFrameElement : nsIDOMHTMLElement
           attribute DOMString        width;
  // Introduced in DOM Level 2:
  readonly attribute nsIDOMDocument   contentDocument;
+
+  // iframe elements require the mozAllowFullScreen attribute to be present
+  // if they're to allow content in the sub document to go into DOM full-screen
+  // mode. See https://wiki.mozilla.org/index.php?title=Gecko:FullScreenAPI
+           attribute boolean          mozAllowFullScreen;
 };
--- a/dom/interfaces/html/nsIDOMNSHTMLElement.idl
+++ b/dom/interfaces/html/nsIDOMNSHTMLElement.idl
@ -41,7 +41,7 @@
 interface nsIDOMDOMStringMap;
 interface nsIDOMHTMLMenuElement;

-[scriptable, uuid(0c3b4b63-30b2-4c93-906d-f983ee9af584)]
+[scriptable, uuid(38305156-007a-4b68-8592-b1c3625c6f6c)]
 interface nsIDOMNSHTMLElement : nsISupports
 {
  readonly attribute long             offsetTop;
@ -76,4 +76,12 @@ interface nsIDOMNSHTMLElement : nsISupports
           attribute boolean         spellcheck;

  readonly attribute nsIDOMDOMStringMap dataset;
+  
+  /**
+   * Requests that this element be made the full-screen element, as per the DOM
+   * full-screen api.
+   *
+   * @see <https://wiki.mozilla.org/index.php?title=Gecko:FullScreenAPI>
+   */
+           void                       mozRequestFullScreen();  
 };
--- a/dom/plugins/base/nptypes.h
+++ b/dom/plugins/base/nptypes.h
@ -55,7 +55,7 @@
  typedef unsigned int uint32_t;
  typedef long long int64_t;
  typedef unsigned long long uint64_t;
-#elif defined(_AIX) || defined(__sun) || defined(__osf__) || defined(IRIX) || defined(HPUX)
+#elif defined(_AIX) || defined(__sun) || defined(__osf__) || defined(HPUX)
  /*
   * AIX and SunOS ship a inttypes.h header that defines [u]int32_t,
   * but not bool for C.
--- a/dom/plugins/ipc/PluginInstanceChild.cpp
+++ b/dom/plugins/ipc/PluginInstanceChild.cpp
@ -985,7 +985,7 @@ PluginInstanceChild::AnswerNPP_SetWindow(const NPRemoteWindow& aWindow)
 #ifdef MOZ_WIDGET_GTK2
    if (gtk_check_version(2,18,7) != NULL) { // older
        if (aWindow.type == NPWindowTypeWindow) {
-            GdkWindow* socket_window = gdk_window_lookup(aWindow.window);
+            GdkWindow* socket_window = gdk_window_lookup(static_cast<GdkNativeWindow>(aWindow.window));
            if (socket_window) {
                // A GdkWindow for the socket already exists.  Need to
                // workaround https://bugzilla.gnome.org/show_bug.cgi?id=607061
@ -1039,7 +1039,7 @@ PluginInstanceChild::AnswerNPP_SetWindow(const NPRemoteWindow& aWindow)
          if (!CreatePluginWindow())
              return false;

-          ReparentPluginWindow((HWND)aWindow.window);
+          ReparentPluginWindow(reinterpret_cast<HWND>(aWindow.window));
          SizePluginWindow(aWindow.width, aWindow.height);

          mWindow.window = (void*)mPluginWindowHWND;
--- a/dom/plugins/ipc/PluginInstanceParent.cpp
+++ b/dom/plugins/ipc/PluginInstanceParent.cpp
@ -604,7 +604,7 @@ PluginInstanceParent::AsyncSetWindow(NPWindow* aWindow)
 {
    NPRemoteWindow window;
    mWindowType = aWindow->type;
-    window.window = reinterpret_cast<uintptr_t>(aWindow->window);
+    window.window = reinterpret_cast<uint64_t>(aWindow->window);
    window.x = aWindow->x;
    window.y = aWindow->y;
    window.width = aWindow->width;
@ -911,7 +911,7 @@ PluginInstanceParent::NPP_SetWindow(const NPWindow* aWindow)
    else {
        SubclassPluginWindow(reinterpret_cast<HWND>(aWindow->window));

-        window.window = reinterpret_cast<uintptr_t>(aWindow->window);
+        window.window = reinterpret_cast<uint64_t>(aWindow->window);
        window.x = aWindow->x;
        window.y = aWindow->y;
        window.width = aWindow->width;
@ -919,7 +919,7 @@ PluginInstanceParent::NPP_SetWindow(const NPWindow* aWindow)
        window.type = aWindow->type;
    }
 #else
-    window.window = reinterpret_cast<unsigned long>(aWindow->window);
+    window.window = reinterpret_cast<uint64_t>(aWindow->window);
    window.x = aWindow->x;
    window.y = aWindow->y;
    window.width = aWindow->width;
--- a/dom/plugins/ipc/PluginMessageUtils.h
+++ b/dom/plugins/ipc/PluginMessageUtils.h
@ -110,7 +110,7 @@ typedef nsCString Buffer;

 struct NPRemoteWindow
 {
-  unsigned long window;
+  uint64_t window;
  int32_t x;
  int32_t y;
  uint32_t width;
@ -363,7 +363,7 @@ struct ParamTraits<mozilla::plugins::NPRemoteWindow>

  static void Write(Message* aMsg, const paramType& aParam)
  {
-    aMsg->WriteULong(aParam.window);
+    aMsg->WriteUInt64(aParam.window);
    WriteParam(aMsg, aParam.x);
    WriteParam(aMsg, aParam.y);
    WriteParam(aMsg, aParam.width);
@ -381,12 +381,12 @@ struct ParamTraits<mozilla::plugins::NPRemoteWindow>

  static bool Read(const Message* aMsg, void** aIter, paramType* aResult)
  {
-    unsigned long window;
+    uint64_t window;
    int32_t x, y;
    uint32_t width, height;
    NPRect clipRect;
    NPWindowType type;
-    if (!(aMsg->ReadULong(aIter, &window) &&
+    if (!(aMsg->ReadUInt64(aIter, &window) &&
          ReadParam(aMsg, aIter, &x) &&
          ReadParam(aMsg, aIter, &y) &&
          ReadParam(aMsg, aIter, &width) &&
--- a/dom/system/nsDeviceMotion.cpp
+++ b/dom/system/nsDeviceMotion.cpp
@ -236,7 +236,9 @@ nsDeviceMotion::DeviceMotionChanged(PRUint32 type, double x, double y, double z)
    // check to see if this window is in the background.  if
    // it is, don't send any device motion to it.
    nsCOMPtr<nsPIDOMWindow> pwindow = do_QueryInterface(mWindowListeners[i]);
-    if (!pwindow || pwindow->GetOuterWindow()->IsBackground())
+    if (!pwindow ||
+        !pwindow->GetOuterWindow() ||
+        pwindow->GetOuterWindow()->IsBackground())
      continue;

    nsCOMPtr<nsIDOMDocument> domdoc;
--- a/dom/tests/mochitest/bugs/Makefile.in
+++ b/dom/tests/mochitest/bugs/Makefile.in
@ -137,6 +137,7 @@ _TEST_FILES	= \
 		test_bug620947.html \
 		test_bug622361.html \
 		test_bug633133.html \
+		test_bug641552.html \
 		test_bug642026.html \
 		test_bug648465.html \
 		test_bug654137.html \
--- a/dom/tests/mochitest/bugs/test_bug597809.html
+++ b/dom/tests/mochitest/bugs/test_bug597809.html
@ -18,14 +18,11 @@ https://bugzilla.mozilla.org/show_bug.cgi?id=597809

 SimpleTest.waitForExplicitFinish();

-netscape.security.PrivilegeManager.enablePrivilege("UniversalXPConnect");
-var cm = Components.classes["@mozilla.org/categorymanager;1"]
-                   .getService(Components.interfaces.nsICategoryManager);
-cm.addCategoryEntry("JavaScript-global-property", "testSNSM", "@mozilla.org/embedcomp/prompt-service;1",
+SpecialPowers.addCategoryEntry("JavaScript-global-property", "testSNSM", "@mozilla.org/embedcomp/prompt-service;1",
                    false, true);

 SimpleTest.executeSoon(function () {
-  ok(window.testSNSM, "testSNSM should returns an object");
+  ok(window.testSNSM, "testSNSM should return an object");
  SimpleTest.finish();
 });

--- a/dom/tests/mochitest/bugs/test_bug641552.html
+++ b/dom/tests/mochitest/bugs/test_bug641552.html
@ -0,0 +1,42 @@
+<!DOCTYPE HTML>
+<html>
+<!--
+https://bugzilla.mozilla.org/show_bug.cgi?id=641552
+-->
+<head>
+  <title>Test for Bug 641552</title>
+  <script type="application/javascript" src="/MochiKit/packed.js"></script>
+  <script type="application/javascript" src="/tests/SimpleTest/SimpleTest.js"></script>
+  <link rel="stylesheet" type="text/css" href="/tests/SimpleTest/test.css"/>
+</head>
+<body>
+<a target="_blank" href="https://bugzilla.mozilla.org/show_bug.cgi?id=641552">Mozilla Bug 641552</a>
+<p id="display"></p>
+<pre id="test">
+<script type="application/javascript">
+
+/** Test for Bug 641552 **/
+
+SimpleTest.waitForExplicitFinish();
+
+SpecialPowers.addCategoryEntry("JavaScript-global-property", "randomname", "@mozilla.org/embedcomp/prompt-service;1",
+                    false, true);
+
+SpecialPowers.addCategoryEntry("JavaScript-navigator-property", "randomname1", "@mozilla.org/embedcomp/prompt-service;1",
+                    false, true);
+
+SpecialPowers.addCategoryEntry("JavaScript-navigator-property", "randomname2", "@mozilla.org/embedcomp/prompt-service;1",
+                    false, true);
+
+SimpleTest.executeSoon(function () {
+  ok(window.randomname, "window.randomname should return an object");
+  is(typeof(window.navigator.randomname1), 'object', "navigator.randomname1 should return an object");
+  is(typeof(window.navigator.randomname2), 'object', "navigator.randomname1 should return an object");
+  SimpleTest.finish();
+});
+
+
+</script>
+</pre>
+</body>
+</html>
--- a/dom/tests/mochitest/chrome/Makefile.in
+++ b/dom/tests/mochitest/chrome/Makefile.in
@ -69,6 +69,7 @@ _TEST_FILES = \
 		test_cyclecollector.xul \
 		test_resize_move_windows.xul \
 		test_popup_blocker_chrome.xul \
+		test_moving_xhr.xul \
 		$(NULL)

 ifeq (WINNT,$(OS_ARCH))
--- a/dom/tests/mochitest/chrome/test_moving_xhr.xul
+++ b/dom/tests/mochitest/chrome/test_moving_xhr.xul
@ -0,0 +1,41 @@
+<?xml version="1.0"?>
+<?xml-stylesheet href="chrome://global/skin" type="text/css"?>
+<?xml-stylesheet href="chrome://mochikit/content/tests/SimpleTest/test.css"
+                 type="text/css"?>
+<!--
+https://bugzilla.mozilla.org/show_bug.cgi?id=654370
+-->
+<window title="Mozilla Bug 654370"
+  xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul">
+  <script type="application/javascript"
+          src="chrome://mochikit/content/tests/SimpleTest/SimpleTest.js"></script>
+
+  <!-- test results are displayed in the html:body -->
+  <body xmlns="http://www.w3.org/1999/xhtml">
+  <a href="https://bugzilla.mozilla.org/show_bug.cgi?id=654370"
+     target="_blank">Mozilla Bug 654370</a>
+  </body>
+
+  <!-- test code goes here -->
+  <script type="application/javascript"><![CDATA[
+      SimpleTest.waitForExplicitFinish();
+
+      var firstWindow, secondWindow;
+      function iframe_loaded() {
+        if (!firstWindow || !secondWindow)
+          return;
+        var xhr = firstWindow.wrappedJSObject.createXHR();
+        ok(!("expando" in xhr), "shouldn't be able to see expandos on the XHR");
+        is(xhr.readyState, XMLHttpRequest.UNSENT, "can access readyState in chrome");
+        secondWindow.wrappedJSObject.tryToUseXHR(xhr, ok);
+        secondWindow.wrappedJSObject.tryToUseXHR(new XMLHttpRequest(), ok);
+        SimpleTest.finish();
+      }
+
+  ]]></script>
+
+  <iframe id="one" src="http://mochi.test:8888/tests/dom/tests/mochitest/general/file_moving_xhr.html"
+          onload="firstWindow = this.contentWindow; iframe_loaded()" />
+  <iframe id="two" src="http://example.org/tests/dom/tests/mochitest/general/file_moving_xhr.html"
+          onload="secondWindow = this.contentWindow; iframe_loaded()" />
+</window>
--- a/dom/tests/mochitest/dom-level0/Makefile.in
+++ b/dom/tests/mochitest/dom-level0/Makefile.in
@ -55,6 +55,7 @@ _TEST_FILES	= \
 		test_location.html \
 		test_innerWidthHeight_script.html \
 		innerWidthHeight_script.html \
+		test_location_setters.html \
 		$(NULL)

 libs:: 	$(_TEST_FILES)
--- a/dom/tests/mochitest/dom-level0/test_location_setters.html
+++ b/dom/tests/mochitest/dom-level0/test_location_setters.html
@ -0,0 +1,78 @@
+<!DOCTYPE HTML>
+<html>
+<!--
+https://bugzilla.mozilla.org/show_bug.cgi?id=639720
+-->
+<head>
+  <title>Test for Bug 639720</title>
+  <script type="application/javascript" src="/tests/SimpleTest/SimpleTest.js"></script>
+  <link rel="stylesheet" type="text/css" href="/tests/SimpleTest/test.css"/>
+</head>
+<body>
+<a target="_blank" href="https://bugzilla.mozilla.org/show_bug.cgi?id=639720">Mozilla Bug 639720</a>
+<p id="display">
+  <iframe id="f"></iframe>
+</p>
+<div id="content" style="display: none">
+  
+</div>
+<pre id="test">
+<script type="application/javascript">
+
+/** Test for Bug 639720 **/
+SimpleTest.waitForExplicitFinish();
+
+var tests = [
+ { url: "data:text/plain,1" },
+ { url: "data:text/plain,2",
+   useDocument: true },
+ { prepURL: "http://www.example.com",
+   url: "data:text/plain,3" }
+];
+
+var currentTest = 0;
+
+function checkTest() {
+  is($("f").contentWindow.location.href, tests[currentTest].url,
+     "href of content window's location should match url of current test");
+  ++currentTest;
+  runNextTest();
+}
+
+function runCurrentTest() {
+  var test = tests[currentTest];
+  $("f").onload = checkTest;
+  if (test.useDocument) {
+    $("f").contentDocument.location = test.url;
+  } else {
+    $("f").contentWindow.location = test.url;
+  }
+  is(typeof($("f").contentWindow.location), "object",
+     "Location should not have become string");
+}
+
+function prepComplete() {
+  runCurrentTest();
+}
+
+function runNextTest() {
+  if (currentTest == tests.length) {
+    SimpleTest.finish();
+    return;
+  }
+
+  var test = tests[currentTest];
+  if ("prepURL" in test) {
+    $("f").onload = prepComplete;
+    $("f").src = test.prepURL;
+    return;
+  }
+
+  runCurrentTest();
+}
+
+addLoadEvent(runNextTest);
+</script>
+</pre>
+</body>
+</html>
--- a/dom/tests/mochitest/general/Makefile.in
+++ b/dom/tests/mochitest/general/Makefile.in
@ -68,6 +68,7 @@ _TEST_FILES = \
 		test_framedhistoryframes.html \
 		test_windowedhistoryframes.html \
 		test_focusrings.xul \
+		file_moving_xhr.html \
 		$(NULL)

 _CHROME_FILES = \
--- a/dom/tests/mochitest/general/file_moving_xhr.html
+++ b/dom/tests/mochitest/general/file_moving_xhr.html
@ -0,0 +1,26 @@
+<html>
+    <head>
+        <script>
+            function createXHR() {
+                return new XMLHttpRequest();
+            }
+
+            function tryToUseXHR(xhr, ok) {
+                function expectException(op, reason) {
+                    try {
+                        var result = op();
+                        ok(false, "should have thrown an exception, got: " + result);
+                    } catch (e) {
+                        ok(/Permission denied/.test(e.toString()), reason);
+                    }
+                }
+
+                expectException(function() { xhr.open(); }, "should not have access to any functions");
+                expectException(function() { xhr.foo = "foo"; }, "should not be able to add expandos");
+                expectException(function() { xhr.withCredentials = true; }, "should not be able to set attributes");
+            }
+        </script>
+    </head>
+    <body>
+    </body>
+</html>
--- a/editor/composer/src/crashtests/crashtests.list
+++ b/editor/composer/src/crashtests/crashtests.list
@ -1,4 +1,4 @@
-load 351236-1.html
+asserts-if(Android,2) load 351236-1.html
 load 407062-1.html
 load 419563-1.xhtml
 skip-if(winWidget) load 428844-1.html # bug 471185
--- a/editor/composer/src/nsEditorSpellCheck.cpp
+++ b/editor/composer/src/nsEditorSpellCheck.cpp
@ -54,12 +54,8 @@

 #include "nsIComponentManager.h"
 #include "nsIContentPrefService.h"
-#include "nsIObserverService.h"
 #include "nsServiceManagerUtils.h"
 #include "nsIChromeRegistry.h"
-#include "nsIPrivateBrowsingService.h"
-#include "nsIContentURIGrouper.h"
-#include "nsNetCID.h"
 #include "nsString.h"
 #include "nsReadableUtils.h"
 #include "nsITextServicesFilter.h"
@ -87,16 +83,11 @@ class UpdateDictionnaryHolder {

 #define CPS_PREF_NAME NS_LITERAL_STRING("spellcheck.lang")

-class LastDictionary : public nsIObserver, public nsSupportsWeakReference {
+class LastDictionary {
 public:
-  NS_DECL_ISUPPORTS
-  NS_DECL_NSIOBSERVER
-
-  LastDictionary();
-
  /**
   * Store current dictionary for editor document url. Use content pref
-   * service. Or, if in private mode, store this information in memory.
+   * service.
   */
  NS_IMETHOD StoreCurrentDictionary(nsIEditor* aEditor, const nsAString& aDictionary);

@ -115,26 +106,8 @@ public:
   *
   */
  static nsresult GetDocumentURI(nsIEditor* aEditor, nsIURI * *aURI);
-
-  PRBool mInPrivateBrowsing;
-
-  // During private browsing, dictionaries are stored in memory
-  nsDataHashtable<nsStringHashKey, nsString> mMemoryStorage;
 };

-NS_IMPL_ISUPPORTS2(LastDictionary, nsIObserver, nsISupportsWeakReference)
-
-LastDictionary::LastDictionary():
-  mInPrivateBrowsing(PR_FALSE)
-{  
-  nsCOMPtr<nsIPrivateBrowsingService> pbService =
-    do_GetService(NS_PRIVATE_BROWSING_SERVICE_CONTRACTID);
-  if (pbService) {
-    pbService->GetPrivateBrowsingEnabled(&mInPrivateBrowsing);
-    mMemoryStorage.Init();
-  }
-}
-
 // static
 nsresult
 LastDictionary::GetDocumentURI(nsIEditor* aEditor, nsIURI * *aURI)
@ -168,21 +141,6 @@ LastDictionary::FetchLastDictionary(nsIEditor* aEditor, nsAString& aDictionary)
  rv = GetDocumentURI(aEditor, getter_AddRefs(docUri));
  NS_ENSURE_SUCCESS(rv, rv);

-  if (mInPrivateBrowsing) {
-    nsCOMPtr<nsIContentURIGrouper> hostnameGrouperService =
-      do_GetService(NS_HOSTNAME_GROUPER_SERVICE_CONTRACTID);
-    NS_ENSURE_TRUE(hostnameGrouperService, NS_ERROR_NOT_AVAILABLE);
-    nsString group;
-    hostnameGrouperService->Group(docUri, group);
-    nsAutoString lastDict;
-    if (mMemoryStorage.Get(group, &lastDict)) {
-      aDictionary.Assign(lastDict);
-    } else {
-      aDictionary.Truncate();
-    }
-    return NS_OK;
-  }
-
  nsCOMPtr<nsIContentPrefService> contentPrefService =
    do_GetService(NS_CONTENT_PREF_SERVICE_CONTRACTID);
  NS_ENSURE_TRUE(contentPrefService, NS_ERROR_NOT_AVAILABLE);
@ -214,20 +172,6 @@ LastDictionary::StoreCurrentDictionary(nsIEditor* aEditor, const nsAString& aDic
  rv = GetDocumentURI(aEditor, getter_AddRefs(docUri));
  NS_ENSURE_SUCCESS(rv, rv);

- if (mInPrivateBrowsing) {
-    nsCOMPtr<nsIContentURIGrouper> hostnameGrouperService =
-      do_GetService(NS_HOSTNAME_GROUPER_SERVICE_CONTRACTID);
-    NS_ENSURE_TRUE(hostnameGrouperService, NS_ERROR_NOT_AVAILABLE);
-    nsString group;
-    hostnameGrouperService->Group(docUri, group);
-
-    if (mMemoryStorage.Put(group, nsString(aDictionary))) {
-      return NS_OK;
-    } else {
-      return NS_ERROR_FAILURE;
-    }
-  }
-
  nsCOMPtr<nsIWritableVariant> uri = do_CreateInstance(NS_VARIANT_CONTRACTID);
  NS_ENSURE_TRUE(uri, NS_ERROR_OUT_OF_MEMORY);
  uri->SetAsISupports(docUri);
@ -254,18 +198,6 @@ LastDictionary::ClearCurrentDictionary(nsIEditor* aEditor)
  rv = GetDocumentURI(aEditor, getter_AddRefs(docUri));
  NS_ENSURE_SUCCESS(rv, rv);

-  nsCOMPtr<nsIContentURIGrouper> hostnameGrouperService =
-      do_GetService(NS_HOSTNAME_GROUPER_SERVICE_CONTRACTID);
-  NS_ENSURE_TRUE(hostnameGrouperService, NS_ERROR_NOT_AVAILABLE);
-
-  nsString group;
-  hostnameGrouperService->Group(docUri, group);
-  NS_ENSURE_SUCCESS(rv, rv);
-
-  if (mMemoryStorage.IsInitialized()) {
-    mMemoryStorage.Remove(group);
-  }
-
  nsCOMPtr<nsIWritableVariant> uri = do_CreateInstance(NS_VARIANT_CONTRACTID);
  NS_ENSURE_TRUE(uri, NS_ERROR_OUT_OF_MEMORY);
  uri->SetAsISupports(docUri);
@ -277,22 +209,6 @@ LastDictionary::ClearCurrentDictionary(nsIEditor* aEditor)
  return contentPrefService->RemovePref(uri, CPS_PREF_NAME);
 }

-NS_IMETHODIMP
-LastDictionary::Observe(nsISupports *aSubject, char const *aTopic, PRUnichar const *aData)
-{
-  if (strcmp(aTopic, NS_PRIVATE_BROWSING_SWITCH_TOPIC) == 0) {
-    if (NS_LITERAL_STRING(NS_PRIVATE_BROWSING_ENTER).Equals(aData)) {
-      mInPrivateBrowsing = PR_TRUE;
-    } else if (NS_LITERAL_STRING(NS_PRIVATE_BROWSING_LEAVE).Equals(aData)) {
-      mInPrivateBrowsing = PR_FALSE;
-      if (mMemoryStorage.IsInitialized()) {
-        mMemoryStorage.Clear();
-      }
-    }
-  } 
-  return NS_OK;
-}
-
 LastDictionary* nsEditorSpellCheck::gDictionaryStore = nsnull;

 NS_IMPL_CYCLE_COLLECTING_ADDREF(nsEditorSpellCheck)
@ -358,14 +274,6 @@ nsEditorSpellCheck::InitSpellChecker(nsIEditor* aEditor, PRBool aEnableSelection

  if (!gDictionaryStore) {
    gDictionaryStore = new LastDictionary();
-    if (gDictionaryStore) {
-      NS_ADDREF(gDictionaryStore);
-      nsCOMPtr<nsIObserverService> observerService =
-        mozilla::services::GetObserverService();
-      if (observerService) {
-        observerService->AddObserver(gDictionaryStore, NS_PRIVATE_BROWSING_SWITCH_TOPIC, PR_TRUE);
-      }
-    }
  }


@ -729,8 +637,9 @@ nsEditorSpellCheck::UpdateCurrentDictionary()
  }

  // otherwise, get language from preferences
+  nsAutoString preferedDict(Preferences::GetLocalizedString("spellchecker.dictionary"));
  if (dictName.IsEmpty()) {
-    dictName.Assign(Preferences::GetLocalizedString("spellchecker.dictionary"));
+    dictName.Assign(preferedDict);
  }

  if (dictName.IsEmpty())
@ -755,27 +664,50 @@ nsEditorSpellCheck::UpdateCurrentDictionary()
    rv = SetCurrentDictionary(dictName);
    if (NS_FAILED(rv)) {
      // required dictionary was not available. Try to get a dictionary
-      // matching at least language part of dictName: If required dictionary is
-      // "aa-bb", we try "aa", then we try any available dictionary aa-XX
+      // matching at least language part of dictName: 
+
      nsAutoString langCode;
      PRInt32 dashIdx = dictName.FindChar('-');
      if (dashIdx != -1) {
        langCode.Assign(Substring(dictName, 0, dashIdx));
-        // try to use langCode
-        rv = SetCurrentDictionary(langCode);
      } else {
        langCode.Assign(dictName);
      }
+
+      nsDefaultStringComparator comparator;
+
+      // try dictionary.spellchecker preference if it starts with langCode (and
+      // if we haven't tried it already)
+      if (!preferedDict.IsEmpty() && !dictName.Equals(preferedDict) && 
+          nsStyleUtil::DashMatchCompare(preferedDict, langCode, comparator)) {
+        rv = SetCurrentDictionary(preferedDict);
+      }
+
+      // Otherwise, try langCode (if we haven't tried it already)
+      if (NS_FAILED(rv)) {
+        if (!dictName.Equals(langCode) && !preferedDict.Equals(langCode)) {
+          rv = SetCurrentDictionary(langCode);
+        }
+      }
+
+      // Otherwise, try any available dictionary aa-XX
      if (NS_FAILED(rv)) {
        // loop over avaible dictionaries; if we find one with required
        // language, use it
        nsTArray<nsString> dictList;
        rv = mSpellChecker->GetDictionaryList(&dictList);
        NS_ENSURE_SUCCESS(rv, rv);
-        nsDefaultStringComparator comparator;
        PRInt32 i, count = dictList.Length();
        for (i = 0; i < count; i++) {
          nsAutoString dictStr(dictList.ElementAt(i));
+
+          if (dictStr.Equals(dictName) ||
+              dictStr.Equals(preferedDict) ||
+              dictStr.Equals(langCode)) {
+            // We have already tried it
+            continue;
+          }
+
          if (nsStyleUtil::DashMatchCompare(dictStr, langCode, comparator) &&
              NS_SUCCEEDED(SetCurrentDictionary(dictStr))) {
              break;
@ -815,5 +747,5 @@ nsEditorSpellCheck::UpdateCurrentDictionary()

 void 
 nsEditorSpellCheck::ShutDown() {
-  NS_IF_RELEASE(gDictionaryStore);
+  delete gDictionaryStore;
 }
--- a/editor/composer/src/nsEditorSpellCheck.h
+++ b/editor/composer/src/nsEditorSpellCheck.h
@ -43,7 +43,6 @@

 #include "nsIEditorSpellCheck.h"
 #include "nsISpellChecker.h"
-#include "nsIObserver.h"
 #include "nsIURI.h"
 #include "nsWeakReference.h"
 #include "nsCOMPtr.h"
--- a/editor/composer/test/test_bug434998.xul
+++ b/editor/composer/test/test_bug434998.xul
@ -65,6 +65,7 @@ https://bugzilla.mozilla.org/show_bug.cgi?id=434998
            threw = true;
          }
          ok(!threw, "The execCommand API should work on <xul:editor>");
+          progress.removeProgressListener(progressListener, Components.interfaces.nsIWebProgress.NOTIFY_ALL);
          SimpleTest.finish();
        }
      }
--- a/editor/libeditor/base/crashtests/crashtests.list
+++ b/editor/libeditor/base/crashtests/crashtests.list
@ -6,5 +6,5 @@ load 407256-1.html
 load 430624-1.html
 load 459613.html
 load 475132-1.xhtml
-load 633709.xhtml
-asserts(6) load 636074-1.html # Bug 439258, charged to the wrong test due to bug 635550
+asserts-if(Android,6) load 633709.xhtml
+asserts-if(!Android,6) load 636074-1.html # Bug 439258, charged to the wrong test due to bug 635550
--- a/editor/libeditor/html/nsHTMLEditRules.cpp
+++ b/editor/libeditor/html/nsHTMLEditRules.cpp
@ -4047,11 +4047,26 @@ nsHTMLEditRules::WillOutdent(nsISelection *aSelection, PRBool *aCancel, PRBool *
        NS_ENSURE_SUCCESS(res, res);
        continue;
      }
+      // is it a block with a 'margin' property?
+      if (useCSS && IsBlockNode(curNode))
+      {
+        nsIAtom* marginProperty = MarginPropertyAtomForIndent(mHTMLEditor->mHTMLCSSUtils, curNode);
+        nsAutoString value;
+        mHTMLEditor->mHTMLCSSUtils->GetSpecifiedProperty(curNode, marginProperty, value);
+        float f;
+        nsCOMPtr<nsIAtom> unit;
+        mHTMLEditor->mHTMLCSSUtils->ParseLength(value, &f, getter_AddRefs(unit));
+        if (f > 0)
+        {
+          RelativeChangeIndentationOfElementNode(curNode, -1);
+          continue;
+        }
+      }
      // is it a list item?
      if (nsHTMLEditUtils::IsListItem(curNode)) 
      {
        // if it is a list item, that means we are not outdenting whole list.
-        // So we need to finish up dealng with any curBlockQuote, and then
+        // So we need to finish up dealing with any curBlockQuote, and then
        // pop this list item.
        if (curBlockQuote)
        {
@ -4123,7 +4138,7 @@ nsHTMLEditRules::WillOutdent(nsISelection *aSelection, PRBool *aCancel, PRBool *
          float f;
          nsCOMPtr<nsIAtom> unit;
          mHTMLEditor->mHTMLCSSUtils->ParseLength(value, &f, getter_AddRefs(unit));
-          if (f > 0)
+          if (f > 0 && !(nsHTMLEditUtils::IsList(curParent) && nsHTMLEditUtils::IsList(curNode)))
          {
            curBlockQuote = n;
            firstBQChild  = curNode;
--- a/editor/libeditor/html/tests/test_bug290026.html
+++ b/editor/libeditor/html/tests/test_bug290026.html
@ -40,7 +40,7 @@ addLoadEvent(function() {
  var twoindent = '<p></p><ul style="margin-left: 80px;"><li>Item 1</li><li>Item 2</li></ul><p></p>';
  is(editor.innerHTML, twoindent, "a twice indented bulleted list");
  document.execCommand("outdent", false, false);
-  todo_is(editor.innerHTML, oneindent, "outdenting a twice indented bulleted list");
+  is(editor.innerHTML, oneindent, "outdenting a twice indented bulleted list");

  // done
  SimpleTest.finish();
--- a/editor/libeditor/html/tests/test_bug291780.html
+++ b/editor/libeditor/html/tests/test_bug291780.html
@ -38,7 +38,7 @@ addLoadEvent(function() {
  var expected = '<ul style="margin-left: 40px;"><li>Item 1</li><ul><li>Item 2</li><li>Item 3</li></ul><li>Item 4</li></ul>';
  is(editor.innerHTML, expected, "indenting part of an already indented bulleted list");
  document.execCommand("outdent", false, false);
-  todo_is(editor.innerHTML, original, "outdenting the partially indented part of an already indented bulleted list"); 
+  is(editor.innerHTML, original, "outdenting the partially indented part of an already indented bulleted list"); 

  // done
  SimpleTest.finish();
--- a/embedding/android/AndroidManifest.xml.in
+++ b/embedding/android/AndroidManifest.xml.in
@ -10,7 +10,7 @@
 #endif
      >
    <uses-sdk android:minSdkVersion="5"
-              android:targetSdkVersion="11"/>
+              android:targetSdkVersion="5"/>

    <uses-permission android:name="android.permission.ACCESS_FINE_LOCATION"/>
    <uses-permission android:name="android.permission.ACCESS_NETWORK_STATE"/>
--- a/embedding/android/GeckoApp.java
+++ b/embedding/android/GeckoApp.java
@ -467,9 +467,15 @@ abstract public class GeckoApp
        componentsDir.mkdir();
        componentsDir.setLastModified(applicationPackage.lastModified());

+        surfaceView.mSplashStatusMsg =
+                    getResources().getString(R.string.splash_firstrun);
+        surfaceView.drawSplashScreen();
+
+        GeckoAppShell.killAnyZombies();
+
        ZipFile zip = new ZipFile(applicationPackage);

-        byte[] buf = new byte[8192];
+        byte[] buf = new byte[32768];
        try {
            if (unpackFile(zip, buf, null, "removed-files"))
                removeFiles();
@ -520,8 +526,6 @@ abstract public class GeckoApp
        
    }

-    boolean haveKilledZombies = false;
-
    private boolean unpackFile(ZipFile zip, byte[] buf, ZipEntry fileEntry,
                            String name)
        throws IOException, FileNotFoundException
@ -533,22 +537,12 @@ abstract public class GeckoApp
                                            zip.getName());

        File outFile = new File(sGREDir, name);
-        if (outFile.exists() &&
-            outFile.lastModified() == fileEntry.getTime() &&
+        if (outFile.lastModified() == fileEntry.getTime() &&
            outFile.length() == fileEntry.getSize())
            return false;

-        surfaceView.mSplashStatusMsg =
-                    getResources().getString(R.string.splash_firstrun);
-        surfaceView.drawSplashScreen();
-
-        if (!haveKilledZombies) {
-            haveKilledZombies = true;
-            GeckoAppShell.killAnyZombies();
-        }
-
        File dir = outFile.getParentFile();
-        if (!outFile.exists())
+        if (!dir.exists())
            dir.mkdirs();

        InputStream fileStream;
--- a/embedding/android/GeckoSurfaceView.java
+++ b/embedding/android/GeckoSurfaceView.java
@ -597,9 +597,9 @@ class GeckoSurfaceView

        switch (event.getAction()) {
            case KeyEvent.ACTION_DOWN:
-                return onKeyDown(keyCode, event);
+                return processKeyDown(keyCode, event, true);
            case KeyEvent.ACTION_UP:
-                return onKeyUp(keyCode, event);
+                return processKeyUp(keyCode, event, true);
            case KeyEvent.ACTION_MULTIPLE:
                return onKeyMultiple(keyCode, event.getRepeatCount(), event);
        }
@ -608,6 +608,10 @@ class GeckoSurfaceView

    @Override
    public boolean onKeyDown(int keyCode, KeyEvent event) {
+        return processKeyDown(keyCode, event, false);
+    }
+
+    private boolean processKeyDown(int keyCode, KeyEvent event, boolean isPreIme) {
        switch (keyCode) {
            case KeyEvent.KEYCODE_BACK:
                if (event.getRepeatCount() == 0) {
@ -644,6 +648,11 @@ class GeckoSurfaceView
            default:
                break;
        }
+
+        if (isPreIme && mIMEState != IME_STATE_DISABLED)
+            // Let active IME process pre-IME key events
+            return false;
+
        // KeyListener returns true if it handled the event for us.
        if (mIMEState == IME_STATE_DISABLED ||
            keyCode == KeyEvent.KEYCODE_ENTER ||
@ -656,6 +665,10 @@ class GeckoSurfaceView

    @Override
    public boolean onKeyUp(int keyCode, KeyEvent event) {
+        return processKeyUp(keyCode, event, false);
+    }
+
+    private boolean processKeyUp(int keyCode, KeyEvent event, boolean isPreIme) {
        switch (keyCode) {
            case KeyEvent.KEYCODE_BACK:
                if (!event.isTracking() || event.isCanceled())
@ -664,6 +677,11 @@ class GeckoSurfaceView
            default:
                break;
        }
+
+        if (isPreIme && mIMEState != IME_STATE_DISABLED)
+            // Let active IME process pre-IME key events
+            return false;
+
        if (mIMEState == IME_STATE_DISABLED ||
            keyCode == KeyEvent.KEYCODE_ENTER ||
            keyCode == KeyEvent.KEYCODE_DEL ||
--- a/extensions/spellcheck/locales/en-US/hunspell/en-US.aff
+++ b/extensions/spellcheck/locales/en-US/hunspell/en-US.aff
@ -110,13 +110,14 @@ SFX B   e     able       [^aeiou]e
 SFX L Y 1
 SFX L   0     ment       .

-REP 88
+REP 89
 REP a ei
 REP ei a
 REP a ey
 REP ey a
 REP ai ie
 REP ie ai
+REP alot a_lot
 REP are air
 REP are ear
 REP are eir
--- a/gfx/thebes/gfxFT2Fonts.cpp
+++ b/gfx/thebes/gfxFT2Fonts.cpp
@ -697,10 +697,11 @@ gfxFT2Font::InitTextRun(gfxContext *aContext,
    }

    if (!ok) {
-        aTextRun->AdjustAdvancesForSyntheticBold(aRunStart, aRunLength);
        AddRange(aTextRun, aString, aRunStart, aRunLength);
    }

+    aTextRun->AdjustAdvancesForSyntheticBold(aContext, aRunStart, aRunLength);
+
    return PR_TRUE;
 }

@ -809,9 +810,7 @@ gfxFT2Font::gfxFT2Font(cairo_scaled_font_t *aCairoFont,
    : gfxFT2FontBase(aCairoFont, aFontEntry, aFontStyle)
 {
    NS_ASSERTION(mFontEntry, "Unable to find font entry for font.  Something is whack.");
-    if (aNeedsBold) {
-        mSyntheticBoldOffset = 1.0;
-    }
+    mApplySyntheticBold = aNeedsBold;
    mCharGlyphCache.Init(64);
 }

--- a/gfx/thebes/gfxFont.cpp
+++ b/gfx/thebes/gfxFont.cpp
@ -581,12 +581,28 @@ StyleDistance(gfxFontEntry *aFontEntry,
    // and the given fontEntry,
    // considering italicness and font-stretch but not weight.

-    // TODO (refine CSS spec...): discuss priority of italic vs stretch;
-    // whether penalty for stretch mismatch should depend on actual difference in values;
-    // whether a sign mismatch in stretch should increase the effective distance
-
-    return (aFontEntry->IsItalic() != anItalic ? 1 : 0) +
-           (aFontEntry->mStretch != aStretch ? 10 : 0);
+    PRInt32 distance = 0;
+    if (aStretch != aFontEntry->mStretch) {
+        // stretch values are in the range -4 .. +4
+        // if aStretch is positive, we prefer more-positive values;
+        // if zero or negative, prefer more-negative
+        if (aStretch > 0) {
+            distance = (aFontEntry->mStretch - aStretch) * 2;
+        } else {
+            distance = (aStretch - aFontEntry->mStretch) * 2;
+        }
+        // if the computed "distance" here is negative, it means that
+        // aFontEntry lies in the "non-preferred" direction from aStretch,
+        // so we treat that as larger than any preferred-direction distance
+        // (max possible is 8) by adding an extra 10 to the absolute value
+        if (distance < 0) {
+            distance = -distance + 10;
+        }
+    }
+    if (aFontEntry->IsItalic() != anItalic) {
+        distance += 1;
+    }
+    return PRUint32(distance);
 }

 PRBool
@ -609,9 +625,11 @@ gfxFontFamily::FindWeightsForStyle(gfxFontEntry* aFontsForWeights[],
                aFontsForWeights[wt] = fe;
                ++foundWeights;
            } else {
-                PRUint32 prevDistance = StyleDistance(aFontsForWeights[wt], anItalic, aStretch);
+                PRUint32 prevDistance =
+                    StyleDistance(aFontsForWeights[wt], anItalic, aStretch);
                if (prevDistance >= distance) {
-                    // replacing a weight we already found, so don't increment foundWeights
+                    // replacing a weight we already found,
+                    // so don't increment foundWeights
                    aFontsForWeights[wt] = fe;
                }
            }
@ -1035,10 +1053,10 @@ gfxFont::RunMetrics::CombineWith(const RunMetrics& aOther, PRBool aOtherIsOnLeft
 gfxFont::gfxFont(gfxFontEntry *aFontEntry, const gfxFontStyle *aFontStyle,
                 AntialiasOption anAAOption) :
    mFontEntry(aFontEntry), mIsValid(PR_TRUE),
+    mApplySyntheticBold(PR_FALSE),
    mStyle(*aFontStyle),
    mAdjustedSize(0.0),
    mFUnitsConvFactor(0.0f),
-    mSyntheticBoldOffset(0),
    mAntialiasOption(anAAOption),
    mPlatformShaper(nsnull),
    mHarfBuzzShaper(nsnull)
@ -1115,6 +1133,33 @@ struct GlyphBuffer {
 #undef GLYPH_BUFFER_SIZE
 };

+// Bug 674909. When synthetic bolding text by drawing twice, need to
+// render using a pixel offset in device pixels, otherwise text
+// doesn't appear bolded, it appears as if a bad text shadow exists
+// when a non-identity transform exists.  Use an offset factor so that
+// the second draw occurs at a constant offset in device pixels.
+
+static double
+CalcXScale(gfxContext *aContext)
+{
+    // determine magnitude of a 1px x offset in device space
+    gfxSize t = aContext->UserToDevice(gfxSize(1.0, 0.0));
+    if (t.width == 1.0 && t.height == 0.0) {
+        // short-circuit the most common case to avoid sqrt() and division
+        return 1.0;
+    }
+
+    double m = sqrt(t.width * t.width + t.height * t.height);
+
+    NS_ASSERTION(m != 0.0, "degenerate transform while synthetic bolding");
+    if (m == 0.0) {
+        return 0.0; // effectively disables offset
+    }
+
+    // scale factor so that offsets are 1px in device pixels
+    return 1.0 / m;
+}
+
 void
 gfxFont::Draw(gfxTextRun *aTextRun, PRUint32 aStart, PRUint32 aEnd,
              gfxContext *aContext, PRBool aDrawToPath, gfxPoint *aPt,
@ -1128,9 +1173,18 @@ gfxFont::Draw(gfxTextRun *aTextRun, PRUint32 aStart, PRUint32 aEnd,
    const double devUnitsPerAppUnit = 1.0/double(appUnitsPerDevUnit);
    PRBool isRTL = aTextRun->IsRightToLeft();
    double direction = aTextRun->GetDirection();
-    // double-strike in direction of run
-    double synBoldDevUnitOffsetAppUnits =
-      direction * (double) mSyntheticBoldOffset * appUnitsPerDevUnit;
+
+    // synthetic-bold strikes are each offset one device pixel in run direction
+    // (these values are only needed if IsSyntheticBold() is true)
+    double synBoldOnePixelOffset;
+    PRInt32 strikes;
+    if (IsSyntheticBold()) {
+        double xscale = CalcXScale(aContext);
+        synBoldOnePixelOffset = direction * xscale;
+        // use as many strikes as needed for the the increased advance
+        strikes = NS_lroundf(GetSyntheticBoldOffset() / xscale);
+    }
+
    PRUint32 i;
    // Current position in appunits
    double x = aPt->x;
@ -1169,15 +1223,21 @@ gfxFont::Draw(gfxTextRun *aTextRun, PRUint32 aStart, PRUint32 aEnd,
            glyph->x = ToDeviceUnits(glyphX, devUnitsPerAppUnit);
            glyph->y = ToDeviceUnits(y, devUnitsPerAppUnit);
            
-            // synthetic bolding by drawing with a one-pixel offset
-            if (mSyntheticBoldOffset) {
-                cairo_glyph_t *doubleglyph;
-                doubleglyph = glyphs.AppendGlyph();
-                doubleglyph->index = glyph->index;
-                doubleglyph->x =
-                  ToDeviceUnits(glyphX + synBoldDevUnitOffsetAppUnits,
-                                devUnitsPerAppUnit);
-                doubleglyph->y = glyph->y;
+            // synthetic bolding by multi-striking with 1-pixel offsets
+            // at least once, more if there's room (large font sizes)
+            if (IsSyntheticBold()) {
+                double strikeOffset = synBoldOnePixelOffset;
+                PRInt32 strikeCount = strikes;
+                do {
+                    cairo_glyph_t *doubleglyph;
+                    doubleglyph = glyphs.AppendGlyph();
+                    doubleglyph->index = glyph->index;
+                    doubleglyph->x =
+                        ToDeviceUnits(glyphX + strikeOffset * appUnitsPerDevUnit,
+                                      devUnitsPerAppUnit);
+                    doubleglyph->y = glyph->y;
+                    strikeOffset += synBoldOnePixelOffset;
+                } while (--strikeCount > 0);
            }
            
            glyphs.Flush(cr, aDrawToPath, isRTL);
@ -1216,15 +1276,20 @@ gfxFont::Draw(gfxTextRun *aTextRun, PRUint32 aStart, PRUint32 aEnd,
                        glyph->x = ToDeviceUnits(glyphX, devUnitsPerAppUnit);
                        glyph->y = ToDeviceUnits(y + details->mYOffset, devUnitsPerAppUnit);

-                        // synthetic bolding by drawing with a one-pixel offset
-                        if (mSyntheticBoldOffset) {
-                            cairo_glyph_t *doubleglyph;
-                            doubleglyph = glyphs.AppendGlyph();
-                            doubleglyph->index = glyph->index;
-                            doubleglyph->x =
-                                ToDeviceUnits(glyphX + synBoldDevUnitOffsetAppUnits,
-                                              devUnitsPerAppUnit);
-                            doubleglyph->y = glyph->y;
+                        if (IsSyntheticBold()) {
+                            double strikeOffset = synBoldOnePixelOffset;
+                            PRInt32 strikeCount = strikes;
+                            do {
+                                cairo_glyph_t *doubleglyph;
+                                doubleglyph = glyphs.AppendGlyph();
+                                doubleglyph->index = glyph->index;
+                                doubleglyph->x =
+                                    ToDeviceUnits(glyphX + strikeOffset *
+                                                      appUnitsPerDevUnit,
+                                                  devUnitsPerAppUnit);
+                                doubleglyph->y = glyph->y;
+                                strikeOffset += synBoldOnePixelOffset;
+                            } while (--strikeCount > 0);
                        }

                        glyphs.Flush(cr, aDrawToPath, isRTL);
@ -3492,7 +3557,9 @@ struct BufferAlphaColor {
 };

 void
-gfxTextRun::AdjustAdvancesForSyntheticBold(PRUint32 aStart, PRUint32 aLength)
+gfxTextRun::AdjustAdvancesForSyntheticBold(gfxContext *aContext,
+                                           PRUint32 aStart,
+                                           PRUint32 aLength)
 {
    const PRUint32 appUnitsPerDevUnit = GetAppUnitsPerDevUnit();
    PRBool isRTL = IsRightToLeft();
@ -3501,7 +3568,9 @@ gfxTextRun::AdjustAdvancesForSyntheticBold(PRUint32 aStart, PRUint32 aLength)
    while (iter.NextRun()) {
        gfxFont *font = iter.GetGlyphRun()->mFont;
        if (font->IsSyntheticBold()) {
-            PRUint32 synAppUnitOffset = font->GetSyntheticBoldOffset() * appUnitsPerDevUnit;
+            PRUint32 synAppUnitOffset =
+                font->GetSyntheticBoldOffset() *
+                    appUnitsPerDevUnit * CalcXScale(aContext);
            PRUint32 start = iter.GetStringStart();
            PRUint32 end = iter.GetStringEnd();
            PRUint32 i;
--- a/Show More
+++ b/Show More