diff --git a/b2g/app/Makefile.in b/b2g/app/Makefile.in
index c7b26e6a55a6..c565c0654536 100644
--- a/b2g/app/Makefile.in
+++ b/b2g/app/Makefile.in
@@ -11,6 +11,10 @@ include $(DEPTH)/config/autoconf.mk
 
 PREF_JS_EXPORTS = $(srcdir)/b2g.js
 
+ifdef ENABLE_MARIONETTE
+DEFINES += -DENABLE_MARIONETTE=1
+endif
+
 ifndef LIBXUL_SDK
 PROGRAM=$(MOZ_APP_NAME)$(BIN_SUFFIX)
 
diff --git a/b2g/app/b2g.js b/b2g/app/b2g.js
index f4605c0ee9b5..f3b39ccf46a6 100644
--- a/b2g/app/b2g.js
+++ b/b2g/app/b2g.js
@@ -432,9 +432,11 @@ pref("full-screen-api.ignore-widgets", true);
 
 pref("media.volume.steps", 10);
 
+#ifdef ENABLE_MARIONETTE
 //Enable/disable marionette server, set listening port
 pref("marionette.defaultPrefs.enabled", true);
 pref("marionette.defaultPrefs.port", 2828);
+#endif
 
 #ifdef MOZ_UPDATER
 pref("app.update.enabled", true);
diff --git a/b2g/config/mozconfigs/gb_armv7a_gecko/debug b/b2g/config/mozconfigs/gb_armv7a_gecko/debug
index 2f2fc761a52f..5f14adf3c180 100644
--- a/b2g/config/mozconfigs/gb_armv7a_gecko/debug
+++ b/b2g/config/mozconfigs/gb_armv7a_gecko/debug
@@ -11,7 +11,7 @@ ac_add_options --disable-elf-hack
 ac_add_options --enable-debug-symbols
 ac_add_options --enable-debug
 ac_add_options --with-ccache
-ac_add_options --enable-marionette
+ENABLE_MARIONETTE=1
 
 # Enable dump() from JS.
 export CXXFLAGS=-DMOZ_ENABLE_JS_DUMP
diff --git a/b2g/config/mozconfigs/gb_armv7a_gecko/nightly b/b2g/config/mozconfigs/gb_armv7a_gecko/nightly
index 5ae933314dd4..31cd349250b2 100644
--- a/b2g/config/mozconfigs/gb_armv7a_gecko/nightly
+++ b/b2g/config/mozconfigs/gb_armv7a_gecko/nightly
@@ -11,7 +11,7 @@ ac_add_options --disable-elf-hack
 ac_add_options --enable-debug-symbols
 ac_add_options --enable-profiling
 ac_add_options --with-ccache
-ac_add_options --enable-marionette
+ENABLE_MARIONETTE=1
 
 # Enable dump() from JS.
 export CXXFLAGS=-DMOZ_ENABLE_JS_DUMP
diff --git a/b2g/config/mozconfigs/ics_armv7a_gecko/debug b/b2g/config/mozconfigs/ics_armv7a_gecko/debug
index 73e866a12023..64e0fa88a3f2 100644
--- a/b2g/config/mozconfigs/ics_armv7a_gecko/debug
+++ b/b2g/config/mozconfigs/ics_armv7a_gecko/debug
@@ -14,7 +14,7 @@ ac_add_options --disable-elf-hack
 ac_add_options --enable-debug-symbols
 ac_add_options --enable-debug
 #ac_add_options --with-ccache
-ac_add_options --enable-marionette
+ENABLE_MARIONETTE=1
 
 # Enable dump() from JS.
 export CXXFLAGS="-DMOZ_ENABLE_JS_DUMP -include $topsrcdir/gonk-toolchain/gonk-misc/Unicode.h -include $topsrcdir/gonk-toolchain/system/vold/ResponseCode.h"
diff --git a/b2g/config/mozconfigs/ics_armv7a_gecko/nightly b/b2g/config/mozconfigs/ics_armv7a_gecko/nightly
index 6bf1ba700afe..583b3a94d36a 100644
--- a/b2g/config/mozconfigs/ics_armv7a_gecko/nightly
+++ b/b2g/config/mozconfigs/ics_armv7a_gecko/nightly
@@ -14,7 +14,7 @@ ac_add_options --disable-elf-hack
 ac_add_options --enable-debug-symbols
 ac_add_options --enable-profiling
 #ac_add_options --with-ccache
-ac_add_options --enable-marionette
+ENABLE_MARIONETTE=1
 
 # Enable dump() from JS.
 export CXXFLAGS="-DMOZ_ENABLE_JS_DUMP -include $topsrcdir/gonk-toolchain/gonk-misc/Unicode.h -include $topsrcdir/gonk-toolchain/system/vold/ResponseCode.h"
diff --git a/b2g/config/mozconfigs/linux32_gecko/nightly b/b2g/config/mozconfigs/linux32_gecko/nightly
index aaa7464b1667..3b7a2e833d5d 100644
--- a/b2g/config/mozconfigs/linux32_gecko/nightly
+++ b/b2g/config/mozconfigs/linux32_gecko/nightly
@@ -33,6 +33,6 @@ ac_add_options --with-ccache=/usr/bin/ccache
 
 #B2G options
 ac_add_options --enable-application=b2g
-ac_add_options --enable-marionette
+ENABLE_MARIONETTE=1
 ac_add_options --disable-elf-hack
 export CXXFLAGS=-DMOZ_ENABLE_JS_DUMP
diff --git a/b2g/config/mozconfigs/linux64_gecko/nightly b/b2g/config/mozconfigs/linux64_gecko/nightly
index 305d4087634c..fd23729b96df 100644
--- a/b2g/config/mozconfigs/linux64_gecko/nightly
+++ b/b2g/config/mozconfigs/linux64_gecko/nightly
@@ -35,6 +35,6 @@ ac_add_options --with-ccache=/usr/bin/ccache
 
 #B2G options
 ac_add_options --enable-application=b2g
-ac_add_options --enable-marionette
+ENABLE_MARIONETTE=1
 ac_add_options --disable-elf-hack
 export CXXFLAGS=-DMOZ_ENABLE_JS_DUMP
diff --git a/b2g/config/mozconfigs/macosx64_gecko/nightly b/b2g/config/mozconfigs/macosx64_gecko/nightly
index 62aabf060740..348edf231803 100644
--- a/b2g/config/mozconfigs/macosx64_gecko/nightly
+++ b/b2g/config/mozconfigs/macosx64_gecko/nightly
@@ -23,6 +23,6 @@ ac_add_options --enable-warnings-as-errors
 ac_add_options --enable-application=b2g
 ac_add_options --enable-debug-symbols
 ac_add_options --with-ccache
-ac_add_options --enable-marionette
+ENABLE_MARIONETTE=1
 
 export CXXFLAGS=-DMOZ_ENABLE_JS_DUMP
diff --git a/b2g/config/mozconfigs/win32_gecko/nightly b/b2g/config/mozconfigs/win32_gecko/nightly
index 56d8dc7c9a83..affb7f1b1984 100644
--- a/b2g/config/mozconfigs/win32_gecko/nightly
+++ b/b2g/config/mozconfigs/win32_gecko/nightly
@@ -24,6 +24,6 @@ fi
 
 # B2G Options
 ac_add_options --enable-application=b2g
-ac_add_options --enable-marionette
+ENABLE_MARIONETTE=1
 
 export CXXFLAGS=-DMOZ_ENABLE_JS_DUMP
diff --git a/b2g/confvars.sh b/b2g/confvars.sh
index aa9c25e98d36..82d209858424 100755
--- a/b2g/confvars.sh
+++ b/b2g/confvars.sh
@@ -38,6 +38,5 @@ fi
 
 MOZ_APP_ID={3c2e2abc-06d4-11e1-ac3b-374f68613e61}
 MOZ_EXTENSION_MANAGER=1
-ENABLE_MARIONETTE=1
 
 MOZ_SYS_MSG=1
diff --git a/b2g/installer/Makefile.in b/b2g/installer/Makefile.in
index 9bb1de88f527..ecd50bc58d4b 100644
--- a/b2g/installer/Makefile.in
+++ b/b2g/installer/Makefile.in
@@ -38,6 +38,10 @@ DEFINES += -DJAREXT=$(JAREXT)
 include $(topsrcdir)/ipc/app/defs.mk
 DEFINES += -DMOZ_CHILD_PROCESS_NAME=$(MOZ_CHILD_PROCESS_NAME)
 
+ifdef ENABLE_MARIONETTE
+DEFINES += -DENABLE_MARIONETTE=1
+endif
+
 ifdef MOZ_PKG_MANIFEST_P
 MOZ_PKG_MANIFEST = package-manifest
 endif
diff --git a/b2g/installer/package-manifest.in b/b2g/installer/package-manifest.in
index b9f21164ac4b..5de776e9f370 100644
--- a/b2g/installer/package-manifest.in
+++ b/b2g/installer/package-manifest.in
@@ -675,10 +675,12 @@ bin/components/@DLL_PREFIX@nkgnomevfs@DLL_SUFFIX@
 @BINPATH@/components/B2GComponents.xpt
 @BINPATH@/components/CameraContent.js
 @BINPATH@/@DLL_PREFIX@omxplugin@DLL_SUFFIX@
+#ifdef ENABLE_MARIONETTE
 @BINPATH@/chrome/marionette@JAREXT@
 @BINPATH@/chrome/marionette.manifest
 @BINPATH@/components/MarionetteComponents.manifest
 @BINPATH@/components/marionettecomponent.js
+#endif
 @BINPATH@/components/AlertsService.js
 @BINPATH@/components/ContentPermissionPrompt.js
 #ifdef MOZ_UPDATER
diff --git a/browser/app/Makefile.in b/browser/app/Makefile.in
index 0d3ab5e4af25..5f891caa3596 100644
--- a/browser/app/Makefile.in
+++ b/browser/app/Makefile.in
@@ -12,6 +12,10 @@ include $(DEPTH)/config/autoconf.mk
 DIRS        = profile/extensions
 dist_dest   = $(DIST)/$(MOZ_MACBUNDLE_NAME)
 
+ifdef ENABLE_MARIONETTE
+DEFINES += -DENABLE_MARIONETTE=1
+endif
+
 PREF_JS_EXPORTS = $(srcdir)/profile/firefox.js \
 		  $(NULL)
 
diff --git a/browser/base/content/browser-social.js b/browser/base/content/browser-social.js
index 2f204f6d8e19..686095d7b741 100644
--- a/browser/base/content/browser-social.js
+++ b/browser/base/content/browser-social.js
@@ -282,14 +282,6 @@ var SocialToolbar = {
   init: function SocialToolbar_init() {
     document.getElementById("social-provider-image").setAttribute("image", Social.provider.iconURL);
 
-    let removeItem = document.getElementById("social-remove-menuitem");
-    let brandShortName = document.getElementById("bundle_brand").getString("brandShortName");
-    let label = gNavigatorBundle.getFormattedString("social.remove.label",
-                                                    [brandShortName]);
-    let accesskey = gNavigatorBundle.getString("social.remove.accesskey");
-    removeItem.setAttribute("label", label);
-    removeItem.setAttribute("accesskey", accesskey);
-
     let statusAreaPopup = document.getElementById("social-statusarea-popup");
     statusAreaPopup.addEventListener("popupshown", function(e) {
       this.button.setAttribute("open", "true");
@@ -344,23 +336,24 @@ var SocialToolbar = {
     let iconNames = Object.keys(provider.ambientNotificationIcons);
     let iconBox = document.getElementById("social-status-iconbox");
     let notifBox = document.getElementById("social-notification-box");
-    let notifBrowsers = document.createDocumentFragment();
+    let notificationFrames = document.createDocumentFragment();
     let iconContainers = document.createDocumentFragment();
 
     for each(let name in iconNames) {
       let icon = provider.ambientNotificationIcons[name];
 
-      let notifBrowserId = "social-status-" + icon.name;
-      let notifBrowser = document.getElementById(notifBrowserId);
-      if (!notifBrowser) {
-        notifBrowser = document.createElement("iframe");
-        notifBrowser.setAttribute("type", "content");
-        notifBrowser.setAttribute("id", notifBrowserId);
-        notifBrowsers.appendChild(notifBrowser);
+      let notificationFrameId = "social-status-" + icon.name;
+      let notificationFrame = document.getElementById(notificationFrameId);
+      if (!notificationFrame) {
+        notificationFrame = document.createElement("iframe");
+        notificationFrame.setAttribute("type", "content");
+        notificationFrame.setAttribute("id", notificationFrameId);
+        notificationFrame.setAttribute("mozbrowser", "true");
+        notificationFrames.appendChild(notificationFrame);
       }
-      notifBrowser.setAttribute("origin", provider.origin);
-      if (notifBrowser.getAttribute("src") != icon.contentPanel)
-        notifBrowser.setAttribute("src", icon.contentPanel);
+      notificationFrame.setAttribute("origin", provider.origin);
+      if (notificationFrame.getAttribute("src") != icon.contentPanel)
+        notificationFrame.setAttribute("src", icon.contentPanel);
 
       let iconId = "social-notification-icon-" + icon.name;
       let iconContainer = document.getElementById(iconId);
@@ -387,33 +380,27 @@ var SocialToolbar = {
       }
       if (iconImage.getAttribute("src") != icon.iconURL)
         iconImage.setAttribute("src", icon.iconURL);
-      iconImage.setAttribute("notifBrowserId", notifBrowserId);
+      iconImage.setAttribute("notificationFrameId", notificationFrameId);
 
       iconCounter.collapsed = !icon.counter;
       iconCounter.firstChild.textContent = icon.counter || "";
     }
-    notifBox.appendChild(notifBrowsers);
+    notifBox.appendChild(notificationFrames);
     iconBox.appendChild(iconContainers);
-
-    let browserIter = notifBox.firstElementChild;
-    while (browserIter) {
-      browserIter.docShell.isAppTab = true;
-      browserIter = browserIter.nextElementSibling;
-    }
   },
 
   showAmbientPopup: function SocialToolbar_showAmbientPopup(iconContainer) {
     let iconImage = iconContainer.firstChild;
     let panel = document.getElementById("social-notification-panel");
     let notifBox = document.getElementById("social-notification-box");
-    let notifBrowser = document.getElementById(iconImage.getAttribute("notifBrowserId"));
+    let notificationFrame = document.getElementById(iconImage.getAttribute("notificationFrameId"));
 
     panel.hidden = false;
 
     function sizePanelToContent() {
       // FIXME: bug 764787: Maybe we can use nsIDOMWindowUtils.getRootBounds() here?
       // Need to handle dynamic sizing
-      let doc = notifBrowser.contentDocument;
+      let doc = notificationFrame.contentDocument;
       if (!doc) {
         return;
       }
@@ -426,23 +413,23 @@ var SocialToolbar = {
 
       // Clear dimensions on all browsers so the panel size will
       // only use the selected browser.
-      let browserIter = notifBox.firstElementChild;
-      while (browserIter) {
-        browserIter.hidden = (browserIter != notifBrowser);
-        browserIter = browserIter.nextElementSibling;
+      let frameIter = notifBox.firstElementChild;
+      while (frameIter) {
+        frameIter.hidden = (frameIter != notificationFrame);
+        frameIter = frameIter.nextElementSibling;
       }
 
       let [height, width] = [body.firstChild.offsetHeight || 300, 330];
-      notifBrowser.style.width = width + "px";
-      notifBrowser.style.height = height + "px";
+      notificationFrame.style.width = width + "px";
+      notificationFrame.style.height = height + "px";
     }
 
     sizePanelToContent();
 
     function dispatchPanelEvent(name) {
-      let evt = notifBrowser.contentDocument.createEvent("CustomEvent");
+      let evt = notificationFrame.contentDocument.createEvent("CustomEvent");
       evt.initCustomEvent(name, true, true, {});
-      notifBrowser.contentDocument.documentElement.dispatchEvent(evt);
+      notificationFrame.contentDocument.documentElement.dispatchEvent(evt);
     }
 
     panel.addEventListener("popuphiding", function onpopuphiding() {
@@ -454,12 +441,13 @@ var SocialToolbar = {
     panel.addEventListener("popupshown", function onpopupshown() {
       panel.removeEventListener("popupshown", onpopupshown);
       SocialToolbar.button.setAttribute("open", "true");
-      if (notifBrowser.contentDocument.readyState == "complete") {
+      notificationFrame.docShell.isAppTab = true;
+      if (notificationFrame.contentDocument.readyState == "complete") {
         dispatchPanelEvent("socialFrameShow");
       } else {
         // first time load, wait for load and dispatch after load
-        notifBrowser.addEventListener("load", function panelBrowserOnload(e) {
-          notifBrowser.removeEventListener("load", panelBrowserOnload, true);
+        notificationFrame.addEventListener("load", function panelBrowserOnload(e) {
+          notificationFrame.removeEventListener("load", panelBrowserOnload, true);
           setTimeout(function() {
             dispatchPanelEvent("socialFrameShow");
           }, 0);
diff --git a/browser/base/content/browser.js b/browser/base/content/browser.js
index 3d018dc07f47..f14f649baa94 100644
--- a/browser/base/content/browser.js
+++ b/browser/base/content/browser.js
@@ -1286,9 +1286,7 @@ var gBrowserInit = {
 
     UpdateUrlbarSearchSplitterState();
 
-    if (isLoadingBlank && gURLBar)
-      gURLBar.focus();
-    if (!isLoadingBlank || !gURLBar || !gURLBar.focused)
+    if (!isLoadingBlank || !focusAndSelectUrlBar())
       gBrowser.selectedBrowser.focus();
 
     gNavToolbox.customizeDone = BrowserToolboxCustomizeDone;
@@ -1990,7 +1988,7 @@ function focusAndSelectUrlBar() {
       FullScreen.mouseoverToggle(true);
 
     gURLBar.focus();
-    if (gURLBar.focused) {
+    if (document.activeElement == gURLBar.inputField) {
       gURLBar.select();
       return true;
     }
@@ -3350,7 +3348,7 @@ const BrowserSearch = {
       FullScreen.mouseoverToggle(true);
     if (searchBar)
       searchBar.focus();
-    if (searchBar && searchBar.textbox.focused) {
+    if (searchBar && document.activeElement == searchBar.textbox.inputField) {
       searchBar.select();
     } else {
       openUILinkIn(Services.search.defaultEngine.searchForm, "current");
diff --git a/browser/base/content/browser.xul b/browser/base/content/browser.xul
index 9573c0867801..764543abc9e4 100644
--- a/browser/base/content/browser.xul
+++ b/browser/base/content/browser.xul
@@ -674,8 +674,6 @@
                           oncommand="SocialUI.showProfile(); document.getElementById('social-statusarea-popup').hidePopup();"/>
                 </vbox>
               </hbox>
-              <menuitem id="social-remove-menuitem"
-                        oncommand="Social.active = false;"/>
               <menuitem id="social-toggle-sidebar-menuitem"
                         type="checkbox"
                         autocheck="false"
diff --git a/browser/locales/en-US/chrome/browser/browser.properties b/browser/locales/en-US/chrome/browser/browser.properties
index e89f11db0419..9b943a4836de 100644
--- a/browser/locales/en-US/chrome/browser/browser.properties
+++ b/browser/locales/en-US/chrome/browser/browser.properties
@@ -380,10 +380,6 @@ social.pageShared.label=Page shared
 social.enable.label=%S integration
 social.enable.accesskey=n
 
-# LOCALIZATION NOTE (social.remove.label): %S = brandShortName
-social.remove.label=Remove from %S
-social.remove.accesskey=R
-
 # LOCALIZATION NOTE (social.enabled.message): %1$S is the name of the social provider, %2$S is brandShortName (e.g. Firefox)
 social.activated.message=%1$S integration with %2$S has been activated.
 
diff --git a/browser/themes/pinstripe/Secure-Glyph-White.png b/browser/themes/pinstripe/Secure-Glyph-White.png
deleted file mode 100644
index fc35217a7b77..000000000000
Binary files a/browser/themes/pinstripe/Secure-Glyph-White.png and /dev/null differ
diff --git a/browser/themes/pinstripe/Secure-Glyph.png b/browser/themes/pinstripe/Secure-Glyph.png
new file mode 100644
index 000000000000..60a106d9042c
Binary files /dev/null and b/browser/themes/pinstripe/Secure-Glyph.png differ
diff --git a/browser/themes/pinstripe/browser.css b/browser/themes/pinstripe/browser.css
index 844826f137be..45f3e69db9c5 100644
--- a/browser/themes/pinstripe/browser.css
+++ b/browser/themes/pinstripe/browser.css
@@ -1327,13 +1327,42 @@ window[tabsontop="false"] richlistitem[type~="action"][actiontype="switchtab"][s
   font-weight: bold;
 }
 
+#editBMPanel_rows > row {
+  margin-bottom: 8px;
+}
+
+#editBMPanel_rows > row:last-of-type {
+  margin-bottom: 0;
+}
+
+/**** Input elements ****/
+
+#editBMPanel_rows > row > textbox,
+#editBMPanel_rows > row > hbox > textbox {
+  -moz-appearance: none;
+  background: linear-gradient(#fafafa, #fff);
+  background-clip: padding-box;
+  border-radius: 3px;
+  border: 1px solid rgba(0,0,0,.3) !important;
+  box-shadow: inset 0 1px 1px 1px rgba(0,0,0,.05),
+              0 1px rgba(255,255,255,.3);
+  margin: 0;
+  padding: 3px 6px;
+}
+
+#editBMPanel_rows > row > textbox[focused="true"],
+#editBMPanel_rows > row > hbox > textbox[focused="true"] {
+  border-color: -moz-mac-focusring !important;
+  box-shadow: @focusRingShadow@;
+}
+
 /**** HUD style buttons ****/
 
 .editBookmarkPanelHeaderButton,
 .editBookmarkPanelBottomButton {
   @hudButton@
-  margin: 6px;
-  min-width: 79px;
+  margin: 0;
+  min-width: 82px;
   min-height: 22px;
 }
 
@@ -1355,47 +1384,45 @@ window[tabsontop="false"] richlistitem[type~="action"][actiontype="switchtab"][s
   margin-bottom: 6px;
 }
 
+.editBookmarkPanelBottomButton:last-child {
+  -moz-margin-start: 8px;
+}
+
 /* The following elements come from editBookmarkOverlay.xul. Styling that's
    specific to the editBookmarkPanel should be in browser.css. Styling that
    should be shared by all editBookmarkOverlay.xul consumers should be in
    editBookmarkOverlay.css. */
 
 #editBMPanel_newFolderBox {
-  background-image: -moz-linear-gradient(rgb(90,90,90), rgb(40,40,40));
+  background: linear-gradient(#fff, #f2f2f2);
   background-origin: padding-box;
   background-clip: padding-box;
   border-radius: 0 0 3px 3px;
-  border: 1px solid rgba(0,0,0,.3);
-  border-top: none;
-  box-shadow: inset 0 -1px 2px rgba(0,0,0,.2),
-              inset 0 1px 0 rgba(255,255,255,.15),
-              0 1px 0 rgba(255,255,255,.15);
+  border: 1px solid #a5a5a5;
+  box-shadow: inset 0 1px rgba(255,255,255,.8),
+              inset 0 0 1px rgba(255,255, 255,.25),
+              0 1px rgba(255,255,255,.3);
+  margin: 0;
   padding: 0;
-  margin-left: 4px;
-  margin-right: 4px;
-  margin-bottom: 8px;
   height:  20px;
 }
 
 #editBMPanel_newFolderButton {
   -moz-appearance: none;
-  border: 0;
-  -moz-border-end-width: 3px;
-  border-style: solid;
-  -moz-border-right-colors: rgba(255,255,255,.1) rgba(0,0,0,.5) rgba(255,255,255,.1);
-  -moz-border-left-colors: rgba(255,255,255,.1) rgba(0,0,0,.5) rgba(255,255,255,.1);
+  border: 0 solid #a5a5a5;
+  -moz-border-end-width: 1px;
   padding: 0 9px;
   margin: 0;
   min-width: 21px;
   min-height: 20px;
   height:  20px;
   color: #fff;
-  list-style-image: url("chrome://browser/skin/hud-style-new-folder-plus-sign.png");
+  list-style-image: url("chrome://browser/skin/panel-plus-sign.png");
   position: relative;
 }
 
 #editBMPanel_newFolderButton:hover:active {
-  background: -moz-linear-gradient(rgba(40,40,40,.9), rgba(70,70,70,.9));
+  background: linear-gradient(rgba(40,40,40,.9), rgba(70,70,70,.9));
   box-shadow: inset 0 0 3px rgba(0,0,0,.2), inset 0 1px 7px rgba(0,0,0,.4);
 }
 
@@ -1409,10 +1436,13 @@ window[tabsontop="false"] richlistitem[type~="action"][actiontype="switchtab"][s
 
 #editBMPanel_folderMenuList {
   @hudButton@
-  border-radius: 3px;
+  background-clip: padding-box;
+  margin: 0;
   min-height: 22px;
-  -moz-padding-start: 4px;
-  -moz-padding-end: 0;
+  padding-top: 2px;
+  padding-bottom: 1px;
+  -moz-padding-start: 8px;
+  -moz-padding-end: 4px;
 }
 
 #editBMPanel_folderMenuList:-moz-focusring {
@@ -1431,101 +1461,42 @@ window[tabsontop="false"] richlistitem[type~="action"][actiontype="switchtab"][s
   border: 0;
   margin: 0;
   padding: 0;
+  -moz-padding-end: 4px;
+  width: 7px;
 }
 
 #editBMPanel_folderMenuList > .menulist-dropmarker > .dropmarker-icon {
-  list-style-image: url("chrome://browser/skin/hud-style-dropmarker-double-arrows.png");
+  list-style-image: url("chrome://global/skin/icons/panel-dropmarker.png");
 }
 
-/**** folder tree ****/
-
-#editBMPanel_folderTree {
-  -moz-appearance: none;
-  border-radius: 2px 2px 0 0;
-  background-color: rgba(50,50,50,.9);
-  border: 1px solid rgba(0,0,0,.3);
-  border-bottom: none;
-  box-shadow: inset 0 1px 2px rgba(0,0,0,.15);
-  color: #fff;
-  /* Implements editBookmarkPanel resizing on folderTree un-collapse. */
-  min-width: 27em;
-  position: relative;
-}
-
-#editBMPanel_folderTree:-moz-focusring {
-  box-shadow: 0 0 4px 1px -moz-mac-focusring,
-              0 0 2px 1px -moz-mac-focusring;
-}
-
-#editBMPanel_folderTree > treechildren::-moz-tree-twisty {
-  -moz-appearance: none;
-  list-style-image: url("chrome://browser/skin/hud-style-twisties.png");
-  -moz-image-region: rect(0px, 10px, 10px, 0px);
-  margin-top: 1px;
-  -moz-margin-end: 1px;
-}
-
-#editBMPanel_folderTree > treechildren::-moz-tree-twisty(open) {
-  -moz-image-region: rect(0px, 20px, 10px, 10px);
-}
-
-#editBMPanel_folderTree > treechildren::-moz-tree-twisty(selected) {
-  -moz-image-region: rect(0px, 30px, 10px, 20px);
-}
-
-#editBMPanel_folderTree > treechildren::-moz-tree-twisty(selected, open) {
-  -moz-image-region: rect(0px, 40px, 10px, 30px);
-}
+/**** folder tree and tag selector ****/
 
+#editBMPanel_folderTree,
 #editBMPanel_tagsSelector {
   -moz-appearance: none;
-  border-radius: 2px;
-  background-color: rgba(50,50,50,1);
+  background: linear-gradient(#fafafa, #fff);
+  background-clip: padding-box;
+  border-radius: 3px;
   border: 1px solid rgba(0,0,0,.3);
-  border-bottom: none;
-  box-shadow: inset 0 1px 2px rgba(0,0,0,.15),
-              0 1px 0 rgba(255,255,255,.15);
-  color: #fff;
+  box-shadow: inset 0 1px 1px 1px rgba(0,0,0,.05),
+              0 1px rgba(255,255,255,.3);
+  margin: 0;
 }
 
+#editBMPanel_folderTree:-moz-focusring,
 #editBMPanel_tagsSelector:-moz-focusring {
-  @hudButtonFocused@
+  border-color: -moz-mac-focusring;
+  box-shadow: @focusRingShadow@;
 }
 
-#editBMPanel_tagsSelector .listcell-check {
-  -moz-appearance: none;
-  border: 0;
-  background: url("chrome://browser/skin/hud-style-check-box-empty.png") no-repeat 50% 50%;
-  min-height: 14px;
-  min-width: 14px;
-}
-
-#editBMPanel_tagsSelector .listcell-check[checked="true"] {
-  background-image: url("chrome://browser/skin/hud-style-check-box-checked.png");
-}
-
-#editBMPanel_folderTree > treechildren::-moz-tree-row {
-  color: #fff;
-  background-color: transparent;
-  border: none;
-}
-
-#editBMPanel_folderTree > treechildren::-moz-tree-row(selected) {
-  background-color: #b3b3b3;
-}
-
-#editBMPanel_folderTree > treechildren::-moz-tree-cell-text(selected),
-#editBMPanel_folderTree > treechildren::-moz-tree-cell-text(selected, focus) {
-  color: #222222;
-}
-
-#editBMPanel_folderTree > treechildren::-moz-tree-row(selected, focus) {
-  background-color: #b3b3b3;
-}
-
-#editBMPanel_tagsSelector > listitem[selected="true"] {
-  color: #222222;
-  background-color: #b3b3b3;
+#editBMPanel_folderTree {
+  border-bottom: none;
+  border-bottom-left-radius: 0;
+  border-bottom-right-radius: 0;
+  /* Implements editBookmarkPanel resizing on folderTree un-collapse. */
+  margin: 0 !important;
+  min-width: 27em;
+  position: relative;
 }
 
 /**** expanders ****/
@@ -1533,13 +1504,10 @@ window[tabsontop="false"] richlistitem[type~="action"][actiontype="switchtab"][s
 #editBookmarkPanel .expander-up,
 #editBookmarkPanel .expander-down {
   @hudButton@
-  border-radius: 3px;
+  margin: 0;
   -moz-margin-start: 4px;
-  -moz-margin-end: 2px;
-  padding: 0;
-  -moz-padding-start: 4px;
-  min-width: 10px;
-  min-height: 20px;
+  min-width: 27px;
+  min-height: 22px;
 }
 
 #editBookmarkPanel .expander-up:-moz-focusring,
@@ -1553,36 +1521,27 @@ window[tabsontop="false"] richlistitem[type~="action"][actiontype="switchtab"][s
 }
 
 #editBookmarkPanel .expander-up {
-  list-style-image: url("chrome://browser/skin/hud-style-expander-open.png");
+  list-style-image: url("chrome://browser/skin/panel-expander-open.png");
 }
 
 #editBookmarkPanel .expander-down {
-  list-style-image: url("chrome://browser/skin/hud-style-expander-closed.png");
+  list-style-image: url("chrome://browser/skin/panel-expander-closed.png");
 }
 
-#editBMPanel_tagsField {
-  -moz-appearance: none !important;
-  -moz-padding-start: 3px !important;
-  margin: 2px !important;
-  border: 1px solid rgba(0,0,0,.5) !important;
-  box-shadow: inset 0 1px 0 rgba(0,0,0,.3);
-  background-color: #666 !important;
-  background-clip: padding-box;
-  background-origin: padding-box;
-  color: #fff !important;
-  min-height: 20px;
+#editBookmarkPanel .expander-up .button-icon,
+#editBookmarkPanel .expander-down .button-icon {
+  margin: 1px 0 0;
+}
+
+#editBookmarkPanel .expander-up .button-text,
+#editBookmarkPanel .expander-down .button-text {
+  display: none;
 }
 
 #editBMPanel_tagsField > .autocomplete-textbox-container > .textbox-input-box > html|*.textbox-input:-moz-placeholder {
   color: #bbb;
 }
 
-#editBMPanel_tagsField[focused="true"] {
-  @hudButtonFocused@
-  background-color: #eee !important;
-  color: #000 !important;
-}
-
 .editBMPanel_rowLabel {
   text-align: end;
 }
@@ -1590,16 +1549,11 @@ window[tabsontop="false"] richlistitem[type~="action"][actiontype="switchtab"][s
 .panel-promo-box {
   margin: 8px -16px -16px -16px;
   padding: 8px 16px;
-  background-color: hsla(0,0%,7%,.3);
-  border-top: 1px solid hsla(0,0%,100%,.1);
-  border-bottom-left-radius: 6px;
-  border-bottom-right-radius: 6px;
-  box-shadow: 0 1px 1px hsla(0,0%,0%,.25) inset;
-  color: hsl(0,0%,60%);
-}
-
-.panel-promo-message > .text-link {
-  color: hsl(210,100%,75%);
+  background: #e5e5e5;
+  border-top: 1px solid hsla(0,0%,0%,.1);
+  border-radius: 0 0 5px 5px;
+  box-shadow: 0 -1px hsla(0,0%,100%,.5) inset, 0 1px 1px hsla(0,0%,0%,.03) inset;
+  color: #808080;
 }
 
 .panel-promo-icon {
@@ -1609,7 +1563,7 @@ window[tabsontop="false"] richlistitem[type~="action"][actiontype="switchtab"][s
 }
 
 .panel-promo-closebutton {
-  list-style-image: url("chrome://global/skin/notification/close.png");
+  list-style-image: url("chrome://global/skin/icons/close.png");
   -moz-image-region: rect(0, 16px, 16px, 0);
   border: none;
   -moz-margin-end: -14px;
@@ -2330,7 +2284,7 @@ toolbarbutton.chevron > .toolbarbutton-menu-dropmarker {
 #identity-popup-content-box.verifiedIdentity > #identity-popup-encryption > vbox > #identity-popup-encryption-icon ,
 #identity-popup-content-box.verifiedDomain > #identity-popup-encryption > vbox > #identity-popup-encryption-icon {
   margin-top: 5px;
-  list-style-image: url("chrome://browser/skin/Secure-Glyph-White.png");
+  list-style-image: url("chrome://browser/skin/Secure-Glyph.png");
 }
 
 #notification-popup-box {
@@ -2377,18 +2331,15 @@ toolbarbutton.chevron > .toolbarbutton-menu-dropmarker {
   list-style-image: url(chrome://browser/skin/Geolocation-16.png);
 }
 
-#notification-popup .text-link {
-  color: #fff;
+#notification-popup .text-link, .panel-arrowcontent .text-link {
+  color: #0073e6;
+  text-decoration: none;
 }
 
 .geolocation-text-link {
   -moz-margin-start: 0; /* override default label margin to match description margin */
 }
 
-.telemetry-text-link {
-  color: #fff;
-}
-
 #addons-notification-icon {
   list-style-image: url(chrome://mozapps/skin/extensions/extensionGeneric-16.png);
 }
diff --git a/browser/themes/pinstripe/downloads/buttons.png b/browser/themes/pinstripe/downloads/buttons.png
index 0fdb1b4c138e..0b5161ff01e3 100644
Binary files a/browser/themes/pinstripe/downloads/buttons.png and b/browser/themes/pinstripe/downloads/buttons.png differ
diff --git a/browser/themes/pinstripe/downloads/downloads.css b/browser/themes/pinstripe/downloads/downloads.css
index a9d5e8edb6bd..146f89c8aeaa 100644
--- a/browser/themes/pinstripe/downloads/downloads.css
+++ b/browser/themes/pinstripe/downloads/downloads.css
@@ -32,12 +32,13 @@
 }
 
 #downloadsPanel[hasdownloads] > #downloadsHistory {
-  border-top: 1px solid hsla(0,0%,100%,.1);
-  background-color: hsla(0,0%,7%,.3);
-  box-shadow: 0 1px 1px hsla(0,0%,0%,.25) inset;
+  background: #e5e5e5;
+  border-top: 1px solid hsla(0,0%,0%,.1);
+  box-shadow: 0 -1px hsla(0,0%,100%,.5) inset, 0 1px 1px hsla(0,0%,0%,.03) inset;
 }
 
 #downloadsHistory > .button-box {
+  color: #808080;
   margin: 1em;
 }
 
@@ -78,7 +79,6 @@ richlistitem[type="download"]:last-child {
 }
 
 .downloadInfo {
-  color: white;
   padding: 8px;
   -moz-padding-end: 0;
 }
diff --git a/browser/themes/pinstripe/hud-style-check-box-checked.png b/browser/themes/pinstripe/hud-style-check-box-checked.png
deleted file mode 100644
index 3328a5bf0b9e..000000000000
Binary files a/browser/themes/pinstripe/hud-style-check-box-checked.png and /dev/null differ
diff --git a/browser/themes/pinstripe/hud-style-check-box-empty.png b/browser/themes/pinstripe/hud-style-check-box-empty.png
deleted file mode 100644
index d8a55bd3fe4f..000000000000
Binary files a/browser/themes/pinstripe/hud-style-check-box-empty.png and /dev/null differ
diff --git a/browser/themes/pinstripe/hud-style-dropmarker-double-arrows.png b/browser/themes/pinstripe/hud-style-dropmarker-double-arrows.png
deleted file mode 100644
index ecf5ee24eb6e..000000000000
Binary files a/browser/themes/pinstripe/hud-style-dropmarker-double-arrows.png and /dev/null differ
diff --git a/browser/themes/pinstripe/hud-style-expander-closed.png b/browser/themes/pinstripe/hud-style-expander-closed.png
deleted file mode 100644
index 25219fea2257..000000000000
Binary files a/browser/themes/pinstripe/hud-style-expander-closed.png and /dev/null differ
diff --git a/browser/themes/pinstripe/hud-style-expander-open.png b/browser/themes/pinstripe/hud-style-expander-open.png
deleted file mode 100644
index 168b53a5e8b9..000000000000
Binary files a/browser/themes/pinstripe/hud-style-expander-open.png and /dev/null differ
diff --git a/browser/themes/pinstripe/hud-style-new-folder-plus-sign.png b/browser/themes/pinstripe/hud-style-new-folder-plus-sign.png
deleted file mode 100644
index 5d3e60d3e840..000000000000
Binary files a/browser/themes/pinstripe/hud-style-new-folder-plus-sign.png and /dev/null differ
diff --git a/browser/themes/pinstripe/hud-style-twisties.png b/browser/themes/pinstripe/hud-style-twisties.png
deleted file mode 100644
index 6d668c2b8e9e..000000000000
Binary files a/browser/themes/pinstripe/hud-style-twisties.png and /dev/null differ
diff --git a/browser/themes/pinstripe/jar.mn b/browser/themes/pinstripe/jar.mn
index 0e3b645a1fd9..04167bc0723a 100644
--- a/browser/themes/pinstripe/jar.mn
+++ b/browser/themes/pinstripe/jar.mn
@@ -21,13 +21,6 @@ browser.jar:
   skin/classic/browser/Geolocation-16.png
   skin/classic/browser/Geolocation-64.png
   skin/classic/browser/home.png
-  skin/classic/browser/hud-style-check-box-checked.png
-  skin/classic/browser/hud-style-check-box-empty.png
-  skin/classic/browser/hud-style-dropmarker-double-arrows.png
-  skin/classic/browser/hud-style-expander-closed.png
-  skin/classic/browser/hud-style-expander-open.png
-  skin/classic/browser/hud-style-new-folder-plus-sign.png
-  skin/classic/browser/hud-style-twisties.png
   skin/classic/browser/identity.png
   skin/classic/browser/identity-icons-generic.png
   skin/classic/browser/identity-icons-https.png
@@ -37,6 +30,9 @@ browser.jar:
   skin/classic/browser/KUI-close.png
   skin/classic/browser/menu-back.png
   skin/classic/browser/menu-forward.png
+  skin/classic/browser/panel-expander-closed.png
+  skin/classic/browser/panel-expander-open.png
+  skin/classic/browser/panel-plus-sign.png
   skin/classic/browser/page-livemarks.png
   skin/classic/browser/pageInfo.css
   skin/classic/browser/Privacy-16.png
@@ -45,7 +41,7 @@ browser.jar:
   skin/classic/browser/searchbar-dropmarker.png
   skin/classic/browser/searchbar.css
   skin/classic/browser/Search.png
-  skin/classic/browser/Secure-Glyph-White.png
+  skin/classic/browser/Secure-Glyph.png
   skin/classic/browser/keyhole-circle.png
   skin/classic/browser/Toolbar.png
   skin/classic/browser/toolbarbutton-dropmarker.png
diff --git a/browser/themes/pinstripe/panel-expander-closed.png b/browser/themes/pinstripe/panel-expander-closed.png
new file mode 100644
index 000000000000..f0e97b22e161
Binary files /dev/null and b/browser/themes/pinstripe/panel-expander-closed.png differ
diff --git a/browser/themes/pinstripe/panel-expander-open.png b/browser/themes/pinstripe/panel-expander-open.png
new file mode 100644
index 000000000000..e3febf4ffb85
Binary files /dev/null and b/browser/themes/pinstripe/panel-expander-open.png differ
diff --git a/browser/themes/pinstripe/panel-plus-sign.png b/browser/themes/pinstripe/panel-plus-sign.png
new file mode 100644
index 000000000000..375601e680c3
Binary files /dev/null and b/browser/themes/pinstripe/panel-plus-sign.png differ
diff --git a/browser/themes/pinstripe/shared.inc b/browser/themes/pinstripe/shared.inc
index f42d6838d245..490c1c7756af 100644
--- a/browser/themes/pinstripe/shared.inc
+++ b/browser/themes/pinstripe/shared.inc
@@ -1,6 +1,6 @@
 %include ../../../toolkit/themes/pinstripe/global/shared.inc
 %include ../browserShared.inc
 
-%define hudButton -moz-appearance: none; color: #fff; text-shadow: 0 -1px 0 rgba(0,0,0,.5); border-radius: 12px; border: 1px solid rgba(0,0,0,.65); background: -moz-linear-gradient(rgba(110,110,110,.9), rgba(70,70,70,.9) 49%, rgba(50,50,50,.9) 51%, rgba(40,40,40,.9)); box-shadow: inset 0 1px 0 rgba(255,255,255,.2), inset 0 0 1px rgba(255,255,255,.1), 0 1px 0 rgba(255,255,255,.1); background-clip: padding-box; background-origin: padding-box; padding: 2px 9px;
-%define hudButtonPressed background: -moz-linear-gradient(rgba(40,40,40,.9), rgba(70,70,70,.9)); box-shadow: inset 0 0 3px rgba(0,0,0,.2), inset 0 1px 7px rgba(0,0,0,.4), 0 1px 0 rgba(255,255,255,.1);
+%define hudButton -moz-appearance: none; color: #434343; border-radius: 4px; border: 1px solid #b5b5b5; background: -moz-linear-gradient(#fff, #f2f2f2); box-shadow: inset 0 1px rgba(255,255,255,.8), inset 0 0 1px rgba(255,255, 255,.25), 0 1px rgba(255,255,255,.3); background-clip: padding-box; background-origin: padding-box; padding: 2px 6px;
+%define hudButtonPressed box-shadow: inset 0 1px 4px -3px #000, 0 1px rgba(255,255,255,.3);
 %define hudButtonFocused box-shadow: 0 0 1px -moz-mac-focusring inset, 0 0 4px 1px -moz-mac-focusring, 0 0 2px 1px -moz-mac-focusring;
diff --git a/browser/themes/pinstripe/sync-notification-24.png b/browser/themes/pinstripe/sync-notification-24.png
index 77f973f91f18..8d2ec8fa8ebd 100644
Binary files a/browser/themes/pinstripe/sync-notification-24.png and b/browser/themes/pinstripe/sync-notification-24.png differ
diff --git a/configure.in b/configure.in
index 2cd8e3e7deb8..4f86389c9f54 100644
--- a/configure.in
+++ b/configure.in
@@ -5774,6 +5774,10 @@ if test -n "$MOZ_ANGLE_RENDERER"; then
   MOZ_D3DX9_CAB=`find "$MOZ_DIRECTX_SDK_PATH"/Redist -name *d3dx9_${MOZ_D3DX9_VERSION}_${MOZ_DIRECTX_SDK_CPU_SUFFIX}.cab | head -n1`
   MOZ_D3DCOMPILER_CAB=`find "$MOZ_DIRECTX_SDK_PATH"/Redist -name *D3DCompiler_${MOZ_D3DX9_VERSION}_${MOZ_DIRECTX_SDK_CPU_SUFFIX}.cab | head -n1`
 
+  if test -z "$MOZ_D3DX9_CAB" -o -z "$MOZ_D3DCOMPILER_CAB"; then
+    AC_MSG_ERROR([Couldn't find the DirectX redistributable files. Either reinstall the DirectX SDK (making sure the "DirectX Redistributable Files" option is selected), or reconfigure with --disable-webgl.])
+  fi
+
   MOZ_D3DX9_DLL=d3dx9_$MOZ_D3DX9_VERSION.dll
   MOZ_D3DCOMPILER_DLL=D3DCompiler_$MOZ_D3DX9_VERSION.dll
 fi
diff --git a/content/base/public/nsContentUtils.h b/content/base/public/nsContentUtils.h
index c24c6c06adb0..3beee8ed00e7 100644
--- a/content/base/public/nsContentUtils.h
+++ b/content/base/public/nsContentUtils.h
@@ -174,14 +174,6 @@ struct ViewportInfo
 
     // Whether or not the user can zoom in and out on the page. Default is true.
     bool allowZoom;
-
-    // This is a holdover from e10s fennec, and might be removed in the future.
-    // It's a hack to work around bugs that didn't allow zooming of documents
-    // from within the parent process. It is still used in native Fennec for XUL
-    // documents, but it should probably be removed.
-    // Currently, from, within GetViewportInfo(), This is only set to false
-    // if the document is a XUL document.
-    bool autoScale;
 };
 
 struct EventNameMapping
diff --git a/content/base/src/nsContentUtils.cpp b/content/base/src/nsContentUtils.cpp
index 28cf0595ac0e..241c1a89cc94 100644
--- a/content/base/src/nsContentUtils.cpp
+++ b/content/base/src/nsContentUtils.cpp
@@ -5055,42 +5055,37 @@ nsContentUtils::GetViewportInfo(nsIDocument *aDocument)
   ret.defaultZoom = 1.0;
   ret.autoSize = true;
   ret.allowZoom = true;
-  ret.autoScale = true;
 
-  // If the docType specifies that we are on a site optimized for mobile,
-  // then we want to return specially crafted defaults for the viewport info.
-  nsCOMPtr<nsIDOMDocument>
-    domDoc(do_QueryInterface(aDocument));
-
-  nsCOMPtr<nsIDOMDocumentType> docType;
-  nsresult rv = domDoc->GetDoctype(getter_AddRefs(docType));
-  if (NS_SUCCEEDED(rv) && docType) {
-    nsAutoString docId;
-    rv = docType->GetPublicId(docId);
-    if (NS_SUCCEEDED(rv)) {
-      if ((docId.Find("WAP") != -1) ||
-          (docId.Find("Mobile") != -1) ||
-          (docId.Find("WML") != -1))
-      {
-        return ret;
+  nsAutoString viewport;
+  aDocument->GetHeaderData(nsGkAtoms::viewport, viewport);
+  if (viewport.IsEmpty()) {
+    // If the docType specifies that we are on a site optimized for mobile,
+    // then we want to return specially crafted defaults for the viewport info.
+    nsCOMPtr<nsIDOMDocument> domDoc(do_QueryInterface(aDocument));
+    nsCOMPtr<nsIDOMDocumentType> docType;
+    nsresult rv = domDoc->GetDoctype(getter_AddRefs(docType));
+    if (NS_SUCCEEDED(rv) && docType) {
+      nsAutoString docId;
+      rv = docType->GetPublicId(docId);
+      if (NS_SUCCEEDED(rv)) {
+        if ((docId.Find("WAP") != -1) ||
+            (docId.Find("Mobile") != -1) ||
+            (docId.Find("WML") != -1))
+        {
+          return ret;
+        }
       }
     }
+
+    nsAutoString handheldFriendly;
+    aDocument->GetHeaderData(nsGkAtoms::handheldFriendly, handheldFriendly);
+    if (handheldFriendly.EqualsLiteral("true")) {
+      return ret;
+    }
   }
 
-  if (aDocument->IsXUL()) {
-    ret.autoScale = false;
-    return ret;
-  }
-
-  nsAutoString handheldFriendly;
-  aDocument->GetHeaderData(nsGkAtoms::handheldFriendly, handheldFriendly);
-
-  if (handheldFriendly.EqualsLiteral("true")) {
-    return ret;
-  }
-
   nsAutoString minScaleStr;
-  aDocument->GetHeaderData(nsGkAtoms::minimum_scale, minScaleStr);
+  aDocument->GetHeaderData(nsGkAtoms::viewport_minimum_scale, minScaleStr);
 
   nsresult errorCode;
   float scaleMinFloat = minScaleStr.ToFloat(&errorCode);
@@ -5103,7 +5098,7 @@ nsContentUtils::GetViewportInfo(nsIDocument *aDocument)
   scaleMinFloat = NS_MAX(scaleMinFloat, kViewportMinScale);
 
   nsAutoString maxScaleStr;
-  aDocument->GetHeaderData(nsGkAtoms::maximum_scale, maxScaleStr);
+  aDocument->GetHeaderData(nsGkAtoms::viewport_maximum_scale, maxScaleStr);
 
   // We define a special error code variable for the scale and max scale,
   // because they are used later (see the width calculations).
@@ -5239,6 +5234,8 @@ nsContentUtils::ProcessViewportInfo(nsIDocument *aDocument,
   /* We never fail. */
   nsresult rv = NS_OK;
 
+  aDocument->SetHeaderData(nsGkAtoms::viewport, viewportInfo);
+
   /* Iterators. */
   nsAString::const_iterator tip, tail, end;
   viewportInfo.BeginReading(tip);
diff --git a/content/base/src/nsDocument.cpp b/content/base/src/nsDocument.cpp
index 6f9b3ea8bbce..54e72f14cc46 100644
--- a/content/base/src/nsDocument.cpp
+++ b/content/base/src/nsDocument.cpp
@@ -8599,9 +8599,7 @@ HasCrossProcessParent(nsIDocument* aDocument)
   if (!docShell) {
     return false;
   }
-  bool isBrowserElement = false;
-  docShell->GetIsBrowserElement(&isBrowserElement);
-  return isBrowserElement;
+  return docShell->GetIsBrowserElement();
 }
 
 static bool
diff --git a/content/base/src/nsFrameLoader.cpp b/content/base/src/nsFrameLoader.cpp
index 4897b2a9356f..cc7c52021fe9 100644
--- a/content/base/src/nsFrameLoader.cpp
+++ b/content/base/src/nsFrameLoader.cpp
@@ -1142,27 +1142,10 @@ nsFrameLoader::SwapWithOtherLoader(nsFrameLoader* aOther,
     return NS_ERROR_NOT_IMPLEMENTED;
   }
 
-  bool ourContentBoundary, otherContentBoundary;
-  ourDocshell->GetIsContentBoundary(&ourContentBoundary);
-  otherDocshell->GetIsContentBoundary(&otherContentBoundary);
-  if (ourContentBoundary != otherContentBoundary) {
-    return NS_ERROR_NOT_IMPLEMENTED;
-  }
-
-  if (ourContentBoundary) {
-    bool ourIsBrowser, otherIsBrowser;
-    ourDocshell->GetIsBrowserElement(&ourIsBrowser);
-    otherDocshell->GetIsBrowserElement(&otherIsBrowser);
-    if (ourIsBrowser != otherIsBrowser) {
+  if (ourDocshell->GetIsBrowserElement() !=
+      otherDocshell->GetIsBrowserElement() ||
+      ourDocshell->GetIsApp() != otherDocshell->GetIsApp()) {
       return NS_ERROR_NOT_IMPLEMENTED;
-    }
-
-    bool ourIsApp, otherIsApp;
-    ourDocshell->GetIsApp(&ourIsApp);
-    otherDocshell->GetIsApp(&otherIsApp);
-    if (ourIsApp != otherIsApp) {
-      return NS_ERROR_NOT_IMPLEMENTED;
-    }
   }
 
   if (mInSwap || aOther->mInSwap) {
diff --git a/docshell/base/nsDSURIContentListener.cpp b/docshell/base/nsDSURIContentListener.cpp
index fcea8befd23f..450464f739d1 100644
--- a/docshell/base/nsDSURIContentListener.cpp
+++ b/docshell/base/nsDSURIContentListener.cpp
@@ -311,9 +311,7 @@ bool nsDSURIContentListener::CheckOneFrameOptionsPolicy(nsIRequest *request,
                parentDocShellItem) {
 
             nsCOMPtr<nsIDocShell> curDocShell = do_QueryInterface(curDocShellItem);
-            bool isContentBoundary;
-            curDocShell->GetIsContentBoundary(&isContentBoundary);
-            if (isContentBoundary) {
+            if (curDocShell && curDocShell->GetIsContentBoundary()) {
               break;
             }
 
diff --git a/docshell/base/nsDocShell.cpp b/docshell/base/nsDocShell.cpp
index 25ca55c14646..0fb6bab4a626 100644
--- a/docshell/base/nsDocShell.cpp
+++ b/docshell/base/nsDocShell.cpp
@@ -5135,9 +5135,7 @@ nsDocShell::SetIsActive(bool aIsActive)
           continue;
       }
 
-      bool isContentBoundary = false;
-      docshell->GetIsContentBoundary(&isContentBoundary);
-      if (!isContentBoundary) {
+      if (!docshell->GetIsContentBoundary()) {
           docshell->SetIsActive(aIsActive);
       }
   }
@@ -12268,22 +12266,21 @@ nsDocShell::GetFrameType()
     return mIsBrowserFrame ? eFrameTypeBrowser : eFrameTypeRegular;
 }
 
-NS_IMETHODIMP
+/* [infallible] */ NS_IMETHODIMP
 nsDocShell::GetIsBrowserElement(bool* aIsBrowser)
 {
     *aIsBrowser = (GetFrameType() == eFrameTypeBrowser);
-
     return NS_OK;
 }
 
-NS_IMETHODIMP
+/* [infallible] */ NS_IMETHODIMP
 nsDocShell::GetIsApp(bool* aIsApp)
 {
     *aIsApp = (GetFrameType() == eFrameTypeApp);
     return NS_OK;
 }
 
-NS_IMETHODIMP
+/* [infallible] */ NS_IMETHODIMP
 nsDocShell::GetIsContentBoundary(bool* aIsContentBoundary)
 {
     switch (GetFrameType()) {
@@ -12299,21 +12296,21 @@ nsDocShell::GetIsContentBoundary(bool* aIsContentBoundary)
     return NS_OK;
 }
 
-NS_IMETHODIMP
+/* [infallible] */ NS_IMETHODIMP
 nsDocShell::GetIsInBrowserElement(bool* aIsInBrowserElement)
 {
     *aIsInBrowserElement = (GetInheritedFrameType() == eFrameTypeBrowser);
     return NS_OK;
 }
 
-NS_IMETHODIMP
+/* [infallible] */ NS_IMETHODIMP
 nsDocShell::GetIsInApp(bool* aIsInApp)
 {
     *aIsInApp = (GetInheritedFrameType() == eFrameTypeApp);
     return NS_OK;
 }
 
-NS_IMETHODIMP
+/* [infallible] */ NS_IMETHODIMP
 nsDocShell::GetIsBelowContentBoundary(bool* aIsInContentBoundary)
 {
     switch (GetInheritedFrameType()) {
@@ -12339,7 +12336,7 @@ nsDocShell::SetAppId(uint32_t aAppId)
     return NS_OK;
 }
 
-NS_IMETHODIMP
+/* [infallible] */ NS_IMETHODIMP
 nsDocShell::GetAppId(uint32_t* aAppId)
 {
     if (mAppId != nsIScriptSecurityManager::NO_APP_ID) {
diff --git a/docshell/base/nsIDocShell.idl b/docshell/base/nsIDocShell.idl
index 0f309a07b0c5..986f4b4f0d82 100644
--- a/docshell/base/nsIDocShell.idl
+++ b/docshell/base/nsIDocShell.idl
@@ -589,23 +589,23 @@ interface nsIDocShell : nsISupports
   /**
    * Returns true iff the docshell is marked as a browser frame.
    */
-  readonly attribute boolean isBrowserElement;
+  [infallible] readonly attribute boolean isBrowserElement;
 
   /**
    * Returns true iif the docshell is marked as an app frame.
    */
-  readonly attribute boolean isApp;
+  [infallible] readonly attribute boolean isApp;
 
   /**
    * Returns true iif the docshell is marked as a type that behaves like a
    * content boundary.
    */
-  readonly attribute boolean isContentBoundary;
+  [infallible] readonly attribute boolean isContentBoundary;
 
   /**
    * Returns true iif the docshell is inside a browser element.
    */
-  readonly attribute boolean isInBrowserElement;
+  [infallible] readonly attribute boolean isInBrowserElement;
 
   /**
    * Returns true iif the docshell is inside an application.  However, it will
@@ -625,13 +625,13 @@ interface nsIDocShell : nsISupports
    * If you're doing a security check, use the content's principal instead of
    * this method.
    */
-  readonly attribute boolean isInApp;
+  [infallible] readonly attribute boolean isInApp;
 
   /**
    * Returns if the docshell has a docshell that behaves as a content boundary
    * in his parent hierarchy.
    */
-  readonly attribute boolean isBelowContentBoundary;
+  [infallible] readonly attribute boolean isBelowContentBoundary;
 
   /**
    * Set the app id this docshell is associated with. The id has to be a valid
@@ -650,7 +650,7 @@ interface nsIDocShell : nsISupports
    * Returns the app id of the app the docshell is in. Returns
    * nsIScriptSecurityManager::NO_APP_ID if the docshell is not in an app.
    */
-  readonly attribute unsigned long appId;
+  [infallible] readonly attribute unsigned long appId;
 
   /** 
    * True iff asynchronous panning and zooming is enabled for this
diff --git a/dom/activities/src/ActivityRequestHandler.js b/dom/activities/src/ActivityRequestHandler.js
index de6da1c3ac46..337badaf8c62 100644
--- a/dom/activities/src/ActivityRequestHandler.js
+++ b/dom/activities/src/ActivityRequestHandler.js
@@ -7,7 +7,7 @@
 const Cc = Components.classes;
 const Ci = Components.interfaces;
 const Cu = Components.utils;
- 
+
 Cu.import("resource://gre/modules/XPCOMUtils.jsm");
 
 XPCOMUtils.defineLazyGetter(this, "cpmm", function() {
@@ -31,7 +31,7 @@ function ActivityRequestHandler() {
   // When a system message of type 'activity' is emitted, it forces the
   // creation of an ActivityWrapper which in turns replace the default
   // system message callback. The newly created wrapper then create a
-  // nsIDOMActivityRequestHandler object and fills up the properties of 
+  // nsIDOMActivityRequestHandler object and fills up the properties of
   // this object as well as the properties of the nsIDOMActivityOptions
   // object contains by the request handler.
   this._id = null;
@@ -40,6 +40,12 @@ function ActivityRequestHandler() {
 }
 
 ActivityRequestHandler.prototype = {
+  __exposedProps__: {
+                      source: "r",
+                      postResult: "r",
+                      postError: "r"
+                    },
+
   get source() {
     return this._options;
   },
diff --git a/dom/alarm/AlarmService.jsm b/dom/alarm/AlarmService.jsm
index 6ef17ca80045..2c873c6ad4d8 100644
--- a/dom/alarm/AlarmService.jsm
+++ b/dom/alarm/AlarmService.jsm
@@ -305,12 +305,16 @@ let AlarmService = {
         let alarmQueue = this._alarmQueue;
         alarmQueue.length = 0;
         this._currentAlarm = null;
-        
-        // only add the alarm that is valid
-        let nowTime = Date.now();
+
+        // Only restore the alarm that's not yet expired; otherwise,
+        // fire a system message for it and remove it from database.
         aAlarms.forEach(function addAlarm(aAlarm) {
-          if (this._getAlarmTime(aAlarm) > nowTime)
+          if (this._getAlarmTime(aAlarm) > Date.now()) {
             alarmQueue.push(aAlarm);
+          } else {
+            this._fireSystemMessage(aAlarm);
+            this._removeAlarmFromDb(aAlarm.id, null);
+          }
         }.bind(this));
 
         // set the next alarm from queue
@@ -329,7 +333,7 @@ let AlarmService = {
 
   _getAlarmTime: function _getAlarmTime(aAlarm) {
     let alarmTime = (new Date(aAlarm.date)).getTime();
-    
+
     // For an alarm specified with "ignoreTimezone",
     // it must be fired respect to the user's timezone.
     // Supposing an alarm was set at 7:00pm at Tokyo,
diff --git a/dom/base/Navigator.cpp b/dom/base/Navigator.cpp
index 9d6eadda1486..45a46305cc00 100644
--- a/dom/base/Navigator.cpp
+++ b/dom/base/Navigator.cpp
@@ -56,6 +56,7 @@
 #include "nsIDOMGlobalPropertyInitializer.h"
 
 using namespace mozilla::dom::power;
+using namespace mozilla::dom::sms;
 
 // This should not be in the namespace.
 DOMCI_DATA(Navigator, mozilla::dom::Navigator)
@@ -1064,61 +1065,6 @@ Navigator::RequestWakeLock(const nsAString &aTopic, nsIDOMMozWakeLock **aWakeLoc
 //    Navigator::nsIDOMNavigatorSms
 //*****************************************************************************
 
-bool
-Navigator::IsSmsAllowed() const
-{
-  static const bool defaultSmsPermission = false;
-
-  // First of all, the general pref has to be turned on.
-  if (!Preferences::GetBool("dom.sms.enabled", defaultSmsPermission)) {
-    return false;
-  }
-
-  // In addition of having 'dom.sms.enabled' set to true, we require the
-  // website to be whitelisted. This is a temporary 'security model'.
-  // 'dom.sms.whitelist' has to contain comma-separated values of URI prepath.
-  // For local files, "file://" must be listed.
-  // For data-urls: "moz-nullprincipal:".
-  // Chrome files also have to be whitelisted for the moment.
-  nsCOMPtr<nsPIDOMWindow> win(do_QueryReferent(mWindow));
-
-  if (!win || !win->GetDocShell()) {
-    return defaultSmsPermission;
-  }
-
-  nsCOMPtr<nsIDocument> doc = do_QueryInterface(win->GetExtantDocument());
-  if (!doc) {
-    return defaultSmsPermission;
-  }
-
-  nsCOMPtr<nsIURI> uri;
-  doc->NodePrincipal()->GetURI(getter_AddRefs(uri));
-
-  if (!uri) {
-    return defaultSmsPermission;
-  }
-
-  nsCAutoString uriPrePath;
-  uri->GetPrePath(uriPrePath);
-
-  const nsAdoptingString& whitelist =
-    Preferences::GetString("dom.sms.whitelist");
-
-  nsCharSeparatedTokenizer tokenizer(whitelist, ',',
-                                     nsCharSeparatedTokenizerTemplate<>::SEPARATOR_OPTIONAL);
-
-  while (tokenizer.hasMoreTokens()) {
-    const nsSubstring& whitelistItem = tokenizer.nextToken();
-
-    if (NS_ConvertUTF16toUTF8(whitelistItem).Equals(uriPrePath)) {
-      return true;
-    }
-  }
-
-  // The current page hasn't been whitelisted.
-  return false;
-}
-
 bool
 Navigator::IsSmsSupported() const
 {
@@ -1141,15 +1087,15 @@ Navigator::GetMozSms(nsIDOMMozSmsManager** aSmsManager)
   *aSmsManager = nullptr;
 
   if (!mSmsManager) {
-    if (!IsSmsSupported() || !IsSmsAllowed()) {
+    if (!IsSmsSupported()) {
       return NS_OK;
     }
 
     nsCOMPtr<nsPIDOMWindow> window = do_QueryReferent(mWindow);
     NS_ENSURE_TRUE(window && window->GetDocShell(), NS_OK);
 
-    mSmsManager = new sms::SmsManager();
-    mSmsManager->Init(window);
+    mSmsManager = SmsManager::CheckPermissionAndCreateInstance(window);
+    NS_ENSURE_TRUE(mSmsManager, NS_OK);
   }
 
   NS_ADDREF(*aSmsManager = mSmsManager);
diff --git a/dom/base/Navigator.h b/dom/base/Navigator.h
index df12a3c021f0..ef3a8e1a387f 100644
--- a/dom/base/Navigator.h
+++ b/dom/base/Navigator.h
@@ -142,7 +142,6 @@ public:
   NS_DECL_NSIDOMNAVIGATORCAMERA
 
 private:
-  bool IsSmsAllowed() const;
   bool IsSmsSupported() const;
 
   nsRefPtr<nsMimeTypeArray> mMimeTypes;
diff --git a/dom/base/nsDOMClassInfo.cpp b/dom/base/nsDOMClassInfo.cpp
index 92cb1fc01dea..a449ca419c21 100644
--- a/dom/base/nsDOMClassInfo.cpp
+++ b/dom/base/nsDOMClassInfo.cpp
@@ -518,7 +518,6 @@ using mozilla::dom::indexedDB::IDBWrapperCache;
 #include "BluetoothAdapter.h"
 #include "BluetoothDevice.h"
 #include "BluetoothPropertyEvent.h"
-#include "BluetoothPairingEvent.h"
 #endif
 
 #include "nsIDOMNavigatorSystemMessages.h"
@@ -1679,8 +1678,6 @@ static nsDOMClassInfoData sClassInfoData[] = {
                            EVENTTARGET_SCRIPTABLE_FLAGS)
   NS_DEFINE_CLASSINFO_DATA(BluetoothPropertyEvent, nsDOMGenericSH,
                            DOM_DEFAULT_SCRIPTABLE_FLAGS)
-  NS_DEFINE_CLASSINFO_DATA(BluetoothPairingEvent, nsDOMGenericSH,
-                           DOM_DEFAULT_SCRIPTABLE_FLAGS)
 #endif
 
   NS_DEFINE_CLASSINFO_DATA(CameraManager, nsDOMGenericSH,
@@ -4475,12 +4472,6 @@ nsDOMClassInfo::Init()
     DOM_CLASSINFO_MAP_ENTRY(nsIDOMBluetoothPropertyEvent)
     DOM_CLASSINFO_MAP_ENTRY(nsIDOMEvent)
   DOM_CLASSINFO_MAP_END
-
-  DOM_CLASSINFO_MAP_BEGIN(BluetoothPairingEvent, nsIDOMBluetoothPairingEvent)
-    DOM_CLASSINFO_MAP_ENTRY(nsIDOMBluetoothPairingEvent)
-    DOM_CLASSINFO_MAP_ENTRY(nsIDOMEvent)
-  DOM_CLASSINFO_MAP_END
-
 #endif
 
   DOM_CLASSINFO_MAP_BEGIN(CameraManager, nsIDOMCameraManager)
diff --git a/dom/base/nsDOMClassInfoClasses.h b/dom/base/nsDOMClassInfoClasses.h
index a131fc23d053..604f30d855e3 100644
--- a/dom/base/nsDOMClassInfoClasses.h
+++ b/dom/base/nsDOMClassInfoClasses.h
@@ -524,7 +524,6 @@ DOMCI_CLASS(BluetoothManager)
 DOMCI_CLASS(BluetoothAdapter)
 DOMCI_CLASS(BluetoothDevice)
 DOMCI_CLASS(BluetoothPropertyEvent)
-DOMCI_CLASS(BluetoothPairingEvent)
 #endif
 
 DOMCI_CLASS(CameraManager)
diff --git a/dom/base/nsDOMWindowUtils.cpp b/dom/base/nsDOMWindowUtils.cpp
index d5298bccf931..ceeb4dd2dc2c 100644
--- a/dom/base/nsDOMWindowUtils.cpp
+++ b/dom/base/nsDOMWindowUtils.cpp
@@ -328,12 +328,6 @@ nsDOMWindowUtils::SetDisplayPortForElement(float aXPx, float aYPx,
     return NS_ERROR_INVALID_ARG;
   }
 
-  nsRect lastDisplayPort;
-  if (nsLayoutUtils::GetDisplayPort(content, &lastDisplayPort) &&
-      displayport.IsEqualInterior(lastDisplayPort)) {
-    return NS_OK;
-  }
-
   content->SetProperty(nsGkAtoms::DisplayPort, new nsRect(displayport),
                        DestroyNsRect);
 
diff --git a/dom/base/nsGlobalWindow.cpp b/dom/base/nsGlobalWindow.cpp
index aca141ffae0d..a7670e18186a 100644
--- a/dom/base/nsGlobalWindow.cpp
+++ b/dom/base/nsGlobalWindow.cpp
@@ -2973,9 +2973,7 @@ nsGlobalWindow::GetScriptableParent(nsIDOMWindow** aParent)
     return NS_OK;
   }
 
-  bool isContentBoundary = false;
-  mDocShell->GetIsContentBoundary(&isContentBoundary);
-  if (isContentBoundary) {
+  if (mDocShell->GetIsContentBoundary()) {
     nsCOMPtr<nsIDOMWindow> parent = static_cast<nsIDOMWindow*>(this);
     parent.swap(*aParent);
     return NS_OK;
@@ -3082,12 +3080,8 @@ nsGlobalWindow::GetContent(nsIDOMWindow** aContent)
 
   // If we're contained in <iframe mozbrowser>, then GetContent is the same as
   // window.top.
-  if (mDocShell) {
-    bool belowContentBoundary = false;
-    mDocShell->GetIsBelowContentBoundary(&belowContentBoundary);
-    if (belowContentBoundary) {
-      return GetScriptableTop(aContent);
-    }
+  if (mDocShell && mDocShell->GetIsBelowContentBoundary()) {
+    return GetScriptableTop(aContent);
   }
 
   nsCOMPtr<nsIDocShellTreeItem> primaryContent;
@@ -6490,13 +6484,8 @@ nsGlobalWindow::Close()
 {
   FORWARD_TO_OUTER(Close, (), NS_ERROR_NOT_INITIALIZED);
 
-  bool isContentBoundary = false;
-  if (mDocShell) {
-    mDocShell->GetIsContentBoundary(&isContentBoundary);
-  }
-
-  if ((!isContentBoundary && IsFrame()) ||
-      !mDocShell || IsInModalState()) {
+  if (!mDocShell || IsInModalState() ||
+      (IsFrame() && !mDocShell->GetIsContentBoundary())) {
     // window.close() is called on a frame in a frameset, on a window
     // that's already closed, or on a window for which there's
     // currently a modal dialog open. Ignore such calls.
@@ -7021,13 +7010,7 @@ nsGlobalWindow::GetScriptableFrameElement(nsIDOMElement** aFrameElement)
   FORWARD_TO_OUTER(GetScriptableFrameElement, (aFrameElement), NS_ERROR_NOT_INITIALIZED);
   *aFrameElement = NULL;
 
-  if (!mDocShell) {
-    return NS_OK;
-  }
-
-  bool isContentBoundary = false;
-  mDocShell->GetIsContentBoundary(&isContentBoundary);
-  if (isContentBoundary) {
+  if (!mDocShell || mDocShell->GetIsContentBoundary()) {
     return NS_OK;
   }
 
diff --git a/dom/base/nsJSEnvironment.cpp b/dom/base/nsJSEnvironment.cpp
index eb956b82e906..8a8e33bf54ae 100644
--- a/dom/base/nsJSEnvironment.cpp
+++ b/dom/base/nsJSEnvironment.cpp
@@ -147,6 +147,7 @@ static bool sCCLockedOut;
 static PRTime sCCLockedOutTime;
 
 static js::GCSliceCallback sPrevGCSliceCallback;
+static js::AnalysisPurgeCallback sPrevAnalysisPurgeCallback;
 
 // The number of currently pending document loads. This count isn't
 // guaranteed to always reflect reality and can't easily as we don't
@@ -199,6 +200,17 @@ static nsIScriptSecurityManager *sSecurityManager;
 
 static bool sGCOnMemoryPressure;
 
+static PRTime
+GetCollectionTimeDelta()
+{
+  PRTime now = PR_Now();
+  if (sFirstCollectionTime) {
+    return now - sFirstCollectionTime;
+  }
+  sFirstCollectionTime = now;
+  return 0;
+}
+
 class nsMemoryPressureObserver MOZ_FINAL : public nsIObserver
 {
 public:
@@ -3117,12 +3129,7 @@ nsJSContext::CycleCollectNow(nsICycleCollectorListener *aListener,
   Telemetry::Accumulate(Telemetry::FORGET_SKIPPABLE_MAX,
                         sMaxForgetSkippableTime / PR_USEC_PER_MSEC);
 
-  PRTime delta = 0;
-  if (sFirstCollectionTime) {
-    delta = now - sFirstCollectionTime;
-  } else {
-    sFirstCollectionTime = now;
-  }
+  PRTime delta = GetCollectionTimeDelta();
 
   uint32_t cleanups = sForgetSkippableBeforeCC ? sForgetSkippableBeforeCC : 1;
   uint32_t minForgetSkippableTime = (sMinForgetSkippableTime == PR_UINT32_MAX)
@@ -3508,13 +3515,7 @@ DOMGCSliceCallback(JSRuntime *aRt, js::GCProgress aProgress, const js::GCDescrip
   NS_ASSERTION(NS_IsMainThread(), "GCs must run on the main thread");
 
   if (aProgress == js::GC_CYCLE_END) {
-    PRTime now = PR_Now();
-    PRTime delta = 0;
-    if (sFirstCollectionTime) {
-      delta = now - sFirstCollectionTime;
-    } else {
-      sFirstCollectionTime = now;
-    }
+    PRTime delta = GetCollectionTimeDelta();
 
     if (sPostGCEventsToConsole) {
       NS_NAMED_LITERAL_STRING(kFmt, "GC(T+%.1f) ");
@@ -3531,7 +3532,7 @@ DOMGCSliceCallback(JSRuntime *aRt, js::GCProgress aProgress, const js::GCDescrip
 
     if (sPostGCEventsToConsole || sPostGCEventsToObserver) {
       nsString json;
-      json.Adopt(aDesc.formatJSON(aRt, now));
+      json.Adopt(aDesc.formatJSON(aRt, PR_Now()));
       nsRefPtr<NotifyGCEndRunnable> notify = new NotifyGCEndRunnable(json);
       NS_DispatchToMainThread(notify);
     }
@@ -3588,6 +3589,32 @@ DOMGCSliceCallback(JSRuntime *aRt, js::GCProgress aProgress, const js::GCDescrip
     (*sPrevGCSliceCallback)(aRt, aProgress, aDesc);
 }
 
+static void
+DOMAnalysisPurgeCallback(JSRuntime *aRt, JSFlatString *aDesc)
+{
+  NS_ASSERTION(NS_IsMainThread(), "GCs must run on the main thread");
+
+  PRTime delta = GetCollectionTimeDelta();
+
+  if (sPostGCEventsToConsole) {
+    NS_NAMED_LITERAL_STRING(kFmt, "Analysis Purge (T+%.1f) ");
+    nsString prefix;
+    prefix.Adopt(nsTextFormatter::smprintf(kFmt.get(),
+                                           double(delta) / PR_USEC_PER_SEC));
+
+    nsDependentJSString stats(aDesc);
+    nsString msg = prefix + stats;
+
+    nsCOMPtr<nsIConsoleService> cs = do_GetService(NS_CONSOLESERVICE_CONTRACTID);
+    if (cs) {
+      cs->LogStringMessage(msg.get());
+    }
+  }
+
+  if (sPrevAnalysisPurgeCallback)
+    (*sPrevAnalysisPurgeCallback)(aRt, aDesc);
+}
+
 // Script object mananagement - note duplicate implementation
 // in nsJSRuntime below...
 nsresult
@@ -4004,6 +4031,7 @@ nsJSRuntime::Init()
   NS_ASSERTION(NS_IsMainThread(), "bad");
 
   sPrevGCSliceCallback = js::SetGCSliceCallback(sRuntime, DOMGCSliceCallback);
+  sPrevAnalysisPurgeCallback = js::SetAnalysisPurgeCallback(sRuntime, DOMAnalysisPurgeCallback);
 
   // Set up the structured clone callbacks.
   static JSStructuredCloneCallbacks cloneCallbacks = {
@@ -4098,6 +4126,12 @@ nsJSRuntime::Init()
   SetMemoryGCPrefChangedCallback("javascript.options.mem.gc_high_frequency_high_limit_mb",
                                  (void *)JSGC_HIGH_FREQUENCY_HIGH_LIMIT);
 
+  Preferences::RegisterCallback(SetMemoryGCPrefChangedCallback,
+                                "javascript.options.mem.analysis_purge_mb",
+                                (void *)JSGC_ANALYSIS_PURGE_TRIGGER);
+  SetMemoryGCPrefChangedCallback("javascript.options.mem.analysis_purge_mb",
+                                 (void *)JSGC_ANALYSIS_PURGE_TRIGGER);
+
   nsCOMPtr<nsIObserverService> obs = mozilla::services::GetObserverService();
   if (!obs)
     return NS_ERROR_FAILURE;
diff --git a/dom/bindings/test/Makefile.in b/dom/bindings/test/Makefile.in
index 5acc1acb2344..9f8d1b1980c8 100644
--- a/dom/bindings/test/Makefile.in
+++ b/dom/bindings/test/Makefile.in
@@ -60,6 +60,11 @@ MOCHITEST_FILES := \
   test_forOf.html \
   forOf_iframe.html \
   test_sequence_wrapping.html \
+  file_bug775543.html \
+  $(NULL)
+
+MOCHITEST_CHROME_FILES = \
+  test_bug775543.html \
   $(NULL)
 
 # Include rules.mk before any of our targets so our first target is coming from
diff --git a/dom/bindings/test/file_bug775543.html b/dom/bindings/test/file_bug775543.html
new file mode 100644
index 000000000000..ee8c14c4d9cc
--- /dev/null
+++ b/dom/bindings/test/file_bug775543.html
@@ -0,0 +1,5 @@
+<body>
+<script>
+worker = new Worker("a");
+</script>
+</body>
diff --git a/dom/bindings/test/test_bug775543.html b/dom/bindings/test/test_bug775543.html
new file mode 100644
index 000000000000..d8df05f630fc
--- /dev/null
+++ b/dom/bindings/test/test_bug775543.html
@@ -0,0 +1,37 @@
+<!DOCTYPE HTML>
+<html>
+<!--
+https://bugzilla.mozilla.org/show_bug.cgi?id=775543
+-->
+<head>
+  <meta charset="utf-8">
+  <title>Test for Bug 775543</title>
+  <script type="application/javascript" src="chrome://mochikit/content/tests/SimpleTest/SimpleTest.js"></script>
+  <link rel="stylesheet" type="text/css" href="chrome://mochikit/content/tests/SimpleTest/test.css"/>
+</head>
+<body>
+<a target="_blank" href="https://bugzilla.mozilla.org/show_bug.cgi?id=775543">Mozilla Bug 775543</a>
+<p id="display"></p>
+<div id="content" style="display: none">
+<iframe id="t" src="http://example.org/tests/dom/bindings/test/file_bug775543.html" onload="test();"></iframe>  
+</div>
+<pre id="test">
+<script type="application/javascript">
+
+/** Test for Bug 775543 **/
+
+function test()
+{
+  var a = XPCNativeWrapper(document.getElementById("t").contentWindow.wrappedJSObject.worker);
+  isnot(XPCNativeWrapper.unwrap(a), a, "XPCNativeWrapper(Worker) should be an Xray wrapper");
+  a.toString();
+  ok(true, "Shouldn't crash when calling a method on an Xray wrapper around a worker");
+  SimpleTest.finish();
+}
+
+SimpleTest.waitForExplicitFinish();
+
+</script>
+</pre>
+</body>
+</html>
diff --git a/dom/bluetooth/BluetoothAdapter.cpp b/dom/bluetooth/BluetoothAdapter.cpp
index 94533fff92e2..d8fe48a39f10 100644
--- a/dom/bluetooth/BluetoothAdapter.cpp
+++ b/dom/bluetooth/BluetoothAdapter.cpp
@@ -8,21 +8,22 @@
 #include "BluetoothAdapter.h"
 #include "BluetoothDevice.h"
 #include "BluetoothPropertyEvent.h"
-#include "BluetoothPairingEvent.h"
 #include "BluetoothService.h"
 #include "BluetoothTypes.h"
 #include "BluetoothReplyRunnable.h"
 #include "BluetoothUtils.h"
 #include "GeneratedEvents.h"
 
+#include "nsContentUtils.h"
 #include "nsDOMClassInfo.h"
 #include "nsDOMEvent.h"
-#include "nsThreadUtils.h"
-#include "nsXPCOMCIDInternal.h"
-#include "nsIDOMDOMRequest.h"
+#include "nsIDOMBluetoothAuthorizeEvent.h"
 #include "nsIDOMBluetoothDeviceEvent.h"
 #include "nsIDOMBluetoothDeviceAddressEvent.h"
-#include "nsContentUtils.h"
+#include "nsIDOMBluetoothPairingEvent.h"
+#include "nsIDOMDOMRequest.h"
+#include "nsThreadUtils.h"
+#include "nsXPCOMCIDInternal.h"
 
 #include "mozilla/LazyIdleThread.h"
 #include "mozilla/Util.h"
@@ -322,66 +323,100 @@ BluetoothAdapter::Notify(const BluetoothSignal& aData)
   } else if (aData.name().EqualsLiteral("PropertyChanged")) {
     // Get BluetoothNamedValue, make sure array length is 1
     arr = aData.value().get_ArrayOfBluetoothNamedValue();
-    if(arr.Length() != 1) {
-      // This really should not happen
-      NS_ERROR("Got more than one property in a change message!");
-      return;
-    }
+
+    NS_ASSERTION(arr.Length() == 1, "Got more than one property in a change message!");
+    NS_ASSERTION(arr[0].value().type() == BluetoothValue::TArrayOfBluetoothNamedValue,
+                 "PropertyChanged: Invalid value type");
+
     BluetoothNamedValue v = arr[0];
     SetPropertyByValue(v);
     nsRefPtr<BluetoothPropertyEvent> e = BluetoothPropertyEvent::Create(v.name());
     e->Dispatch(ToIDOMEventTarget(), NS_LITERAL_STRING("propertychanged"));
   } else if (aData.name().EqualsLiteral("RequestConfirmation")) {
     arr = aData.value().get_ArrayOfBluetoothNamedValue();
-    if(arr.Length() != 2) {
-      NS_ERROR("RequestConfirmation: Length of parameters is wrong");
-      return;
-    }
 
-    nsString deviceAddress = arr[0].value().get_nsString();
-    uint32_t passkey = arr[1].value().get_uint32_t();
+    NS_ASSERTION(arr.Length() == 2, "RequestConfirmation: Wrong length of parameters");
+    NS_ASSERTION(arr[0].value().type() == BluetoothValue::TnsString,
+                 "RequestConfirmation: Invalid value type");
+    NS_ASSERTION(arr[1].value().type() == BluetoothValue::Tuint32_t,
+                 "RequestConfirmation: Invalid value type");
 
-    nsRefPtr<BluetoothPairingEvent> e = BluetoothPairingEvent::Create(deviceAddress, passkey);
-    e->Dispatch(ToIDOMEventTarget(), NS_LITERAL_STRING("requestconfirmation"));
+    nsCOMPtr<nsIDOMEvent> event;
+    NS_NewDOMBluetoothPairingEvent(getter_AddRefs(event), nullptr, nullptr);
+
+    nsCOMPtr<nsIDOMBluetoothPairingEvent> e = do_QueryInterface(event);
+    e->InitBluetoothPairingEvent(NS_LITERAL_STRING("requestconfirmation"),
+                                 false,
+                                 false,
+                                 arr[0].value().get_nsString(),
+                                 arr[1].value().get_uint32_t());
+    e->SetTrusted(true);
+    bool dummy;
+    DispatchEvent(event, &dummy);
   } else if (aData.name().EqualsLiteral("RequestPinCode")) {
     arr = aData.value().get_ArrayOfBluetoothNamedValue();
-    if(arr.Length() != 1) {
-      NS_ERROR("RequestPinCode: Length of parameters is wrong");
-      return;
-    }
 
-    nsString deviceAddress = arr[0].value().get_nsString();
+    NS_ASSERTION(arr.Length() == 1, "RequestPinCode: Wrong length of parameters");
+    NS_ASSERTION(arr[0].value().type() == BluetoothValue::TnsString,
+                 "RequestPinCode: Invalid value type");
 
-    nsRefPtr<BluetoothPairingEvent> e = BluetoothPairingEvent::Create(deviceAddress, 0);
-    e->Dispatch(ToIDOMEventTarget(), NS_LITERAL_STRING("requestpincode"));
+    nsCOMPtr<nsIDOMEvent> event;
+    NS_NewDOMBluetoothDeviceAddressEvent(getter_AddRefs(event), nullptr, nullptr);
+
+    nsCOMPtr<nsIDOMBluetoothDeviceAddressEvent> e = do_QueryInterface(event);
+    e->InitBluetoothDeviceAddressEvent(NS_LITERAL_STRING("requestpincode"),
+                                       false, false, arr[0].value().get_nsString());
+    e->SetTrusted(true);
+    bool dummy;
+    DispatchEvent(event, &dummy);
   } else if (aData.name().EqualsLiteral("RequestPasskey")) {
     arr = aData.value().get_ArrayOfBluetoothNamedValue();
-    if(arr.Length() != 1) {
-      NS_ERROR("RequestPasskey: Length of parameters is wrong");
-      return;
-    }
 
-    nsString deviceAddress = arr[0].value().get_nsString();
+    NS_ASSERTION(arr.Length() == 1, "RequestPasskey: Wrong length of parameters");
+    NS_ASSERTION(arr[0].value().type() == BluetoothValue::TnsString,
+                 "RequestPasskey: Invalid value type");
 
-    nsRefPtr<BluetoothPairingEvent> e = BluetoothPairingEvent::Create(deviceAddress, 0);
-    e->Dispatch(ToIDOMEventTarget(), NS_LITERAL_STRING("requestpasskey"));
+    nsCOMPtr<nsIDOMEvent> event;
+    NS_NewDOMBluetoothDeviceAddressEvent(getter_AddRefs(event), nullptr, nullptr);
+
+    nsCOMPtr<nsIDOMBluetoothDeviceAddressEvent> e = do_QueryInterface(event);
+    e->InitBluetoothDeviceAddressEvent(NS_LITERAL_STRING("requestpasskey"),
+                                       false, false, arr[0].value().get_nsString());
+    e->SetTrusted(true);
+    bool dummy;
+    DispatchEvent(event, &dummy);
   } else if (aData.name().EqualsLiteral("Authorize")) {
     arr = aData.value().get_ArrayOfBluetoothNamedValue();
-    if(arr.Length() != 2) {
-      NS_ERROR("Authorize: Length of parameters is wrong");
-      return;
-    }
 
-    nsString deviceAddress = arr[0].value().get_nsString();
-    nsString serviceUuid = arr[1].value().get_nsString();
+    NS_ASSERTION(arr.Length() == 2, "Authorize: Wrong length of parameters");
+    NS_ASSERTION(arr[0].value().type() == BluetoothValue::TnsString,
+                 "Authorize: Invalid value type");
+    NS_ASSERTION(arr[1].value().type() == BluetoothValue::TnsString,
+                 "Authorize: Invalid value type");
 
-    nsRefPtr<BluetoothPairingEvent> e = BluetoothPairingEvent::Create(deviceAddress, serviceUuid);
-    e->Dispatch(ToIDOMEventTarget(), NS_LITERAL_STRING("authorize"));
+    nsCOMPtr<nsIDOMEvent> event;
+    NS_NewDOMBluetoothAuthorizeEvent(getter_AddRefs(event), nullptr, nullptr);
+
+    nsCOMPtr<nsIDOMBluetoothAuthorizeEvent> e = do_QueryInterface(event);
+    e->InitBluetoothAuthorizeEvent(NS_LITERAL_STRING("authorize"),
+                                   false,
+                                   false,
+                                   arr[0].value().get_nsString(),
+                                   arr[1].value().get_nsString());
+    e->SetTrusted(true);
+    bool dummy;
+    DispatchEvent(event, &dummy);
   } else if (aData.name().EqualsLiteral("Cancel")) {
+    nsCOMPtr<nsIDOMEvent> event;
+    NS_NewDOMBluetoothDeviceAddressEvent(getter_AddRefs(event), nullptr, nullptr);
+
+    nsCOMPtr<nsIDOMBluetoothDeviceAddressEvent> e = do_QueryInterface(event);
     // Just send a null nsString, won't be used
-    nsString deviceObjectPath = EmptyString();
-    nsRefPtr<BluetoothPairingEvent> e = BluetoothPairingEvent::Create(deviceObjectPath, 0);
-    e->Dispatch(ToIDOMEventTarget(), NS_LITERAL_STRING("cancel"));
+    e->InitBluetoothDeviceAddressEvent(NS_LITERAL_STRING("cancel"),
+                                       false, false, EmptyString());
+    e->SetTrusted(true);
+    bool dummy;
+    DispatchEvent(event, &dummy);
   } else {
 #ifdef DEBUG
     nsCString warningMsg;
diff --git a/dom/bluetooth/Makefile.in b/dom/bluetooth/Makefile.in
index b8c4b12717ef..6350f9be5228 100644
--- a/dom/bluetooth/Makefile.in
+++ b/dom/bluetooth/Makefile.in
@@ -33,7 +33,6 @@ CPPSRCS += \
   BluetoothAdapter.cpp \
   BluetoothDevice.cpp \
   BluetoothPropertyEvent.cpp \
-  BluetoothPairingEvent.cpp \
   BluetoothReplyRunnable.cpp \
   BluetoothPropertyContainer.cpp \
   BluetoothUtils.cpp \
@@ -48,6 +47,7 @@ XPIDLSRCS = \
   nsIDOMBluetoothDeviceAddressEvent.idl \
   nsIDOMBluetoothPropertyEvent.idl \
   nsIDOMBluetoothPairingEvent.idl \
+  nsIDOMBluetoothAuthorizeEvent.idl \
   $(NULL)
 
 ifeq (gonk,$(MOZ_WIDGET_TOOLKIT))
diff --git a/dom/bluetooth/nsIDOMBluetoothAuthorizeEvent.idl b/dom/bluetooth/nsIDOMBluetoothAuthorizeEvent.idl
new file mode 100644
index 000000000000..771e071a4353
--- /dev/null
+++ b/dom/bluetooth/nsIDOMBluetoothAuthorizeEvent.idl
@@ -0,0 +1,26 @@
+/* -*- Mode: c++; c-basic-offset: 2; indent-tabs-mode: nil; tab-width: 40 -*- */
+/* vim: set ts=2 et sw=2 tw=80: */
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this file,
+ * You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+#include "nsIDOMEvent.idl"
+
+[scriptable, builtinclass, uuid(1cfe7854-31a6-4a41-add6-b4ed35869a6d)]
+interface nsIDOMBluetoothAuthorizeEvent : nsIDOMEvent
+{
+  readonly attribute DOMString deviceAddress;
+  readonly attribute DOMString uuid;
+
+  [noscript] void initBluetoothAuthorizeEvent(in DOMString aType,
+                                              in boolean aCanBubble,
+                                              in boolean aCancelable,
+                                              in DOMString aDeviceAddress,
+                                              in DOMString aUuid);
+};
+
+dictionary BluetoothAuthorizeEventInit : EventInit
+{
+  DOMString deviceAddress;
+  DOMString uuid;
+};
diff --git a/dom/bluetooth/nsIDOMBluetoothPairingEvent.idl b/dom/bluetooth/nsIDOMBluetoothPairingEvent.idl
index aad93f753050..c48502bb29f2 100644
--- a/dom/bluetooth/nsIDOMBluetoothPairingEvent.idl
+++ b/dom/bluetooth/nsIDOMBluetoothPairingEvent.idl
@@ -6,10 +6,21 @@
 
 #include "nsIDOMEvent.idl"
 
-[scriptable, builtinclass, uuid(b905b05e-2141-444c-a90d-525b6c0daff1)]
+[scriptable, builtinclass, uuid(333022b8-a7e5-4fff-8588-36f2eedff17e)]
 interface nsIDOMBluetoothPairingEvent : nsIDOMEvent
 {
   readonly attribute DOMString deviceAddress;
-  readonly attribute DOMString uuid;
   readonly attribute unsigned long passkey;
+
+  [noscript] void initBluetoothPairingEvent(in DOMString aType,
+                                            in boolean aCanBubble,
+                                            in boolean aCancelable,
+                                            in DOMString aDeviceAddress,
+                                            in unsigned long aPasskey);
+};
+
+dictionary BluetoothPairingEventInit : EventInit
+{
+  DOMString deviceAddress;
+  unsigned long passkey;
 };
diff --git a/dom/contacts/ContactManager.js b/dom/contacts/ContactManager.js
index 0b89db471039..4396f6214e8b 100644
--- a/dom/contacts/ContactManager.js
+++ b/dom/contacts/ContactManager.js
@@ -4,12 +4,8 @@
 
 "use strict";
 
-/* static functions */
-let DEBUG = 0;
-if (DEBUG)
-  debug = function (s) { dump("-*- ContactManager: " + s + "\n"); }
-else
-  debug = function (s) {}
+const DEBUG = false;
+function debug(s) { dump("-*- ContactManager: " + s + "\n"); }
 
 const Cc = Components.classes;
 const Ci = Components.interfaces;
@@ -37,7 +33,7 @@ const nsIDOMContactProperties = Ci.nsIDOMContactProperties;
 
 // ContactProperties is not directly instantiated. It is used as interface.
 
-function ContactProperties(aProp) { debug("ContactProperties Constructor"); }
+function ContactProperties(aProp) { if (DEBUG) debug("ContactProperties Constructor"); }
 
 ContactProperties.prototype = {
 
@@ -67,6 +63,14 @@ function ContactAddress(aType, aStreetAddress, aLocality, aRegion, aPostalCode,
 };
 
 ContactAddress.prototype = {
+  __exposedProps__: {
+                      type: 'rw',
+                      streetAddress: 'rw',
+                      locality: 'rw',
+                      region: 'rw',
+                      postalCode: 'rw',
+                      countryName: 'rw'
+                     },
 
   classID : CONTACTADDRESS_CID,
   classInfo : XPCOMUtils.generateCI({classID: CONTACTADDRESS_CID,
@@ -90,6 +94,10 @@ function ContactField(aType, aValue) {
 };
 
 ContactField.prototype = {
+  __exposedProps__: {
+                      type: 'rw',
+                      value: 'rw'
+                     },
 
   classID : CONTACTFIELD_CID,
   classInfo : XPCOMUtils.generateCI({classID: CONTACTFIELD_CID,
@@ -114,6 +122,11 @@ function ContactTelField(aType, aValue, aCarrier) {
 };
 
 ContactTelField.prototype = {
+  __exposedProps__: {
+                      type: 'rw',
+                      value: 'rw',
+                      carrier: 'rw'
+                     },
 
   classID : CONTACTTELFIELD_CID,
   classInfo : XPCOMUtils.generateCI({classID: CONTACTTELFIELD_CID,
@@ -151,13 +164,38 @@ const CONTACT_CONTRACTID = "@mozilla.org/contact;1";
 const CONTACT_CID        = Components.ID("{da0f7040-388b-11e1-b86c-0800200c9a66}");
 const nsIDOMContact      = Components.interfaces.nsIDOMContact;
 
-// The wrappedJSObject magic here allows callers to get at the underlying JS object
-// of the XPCOM component. We use this below to modify properties that are read-only
-// per-idl. See https://developer.mozilla.org/en-US/docs/wrappedJSObject.
-function Contact() { debug("Contact constr: "); this.wrappedJSObject = this; };
+function Contact() {
+  if (DEBUG) debug("Contact constr: ");
+};
 
 Contact.prototype = {
-  
+  __exposedProps__: {
+                      id: 'rw',
+                      updated: 'rw',
+                      published:  'rw',
+                      name: 'rw',
+                      honorificPrefix: 'rw',
+                      givenName: 'rw',
+                      additionalName: 'rw',
+                      familyName: 'rw',
+                      honorificSuffix: 'rw',
+                      nickname: 'rw',
+                      email: 'rw',
+                      photo: 'rw',
+                      url: 'rw',
+                      category: 'rw',
+                      adr: 'rw',
+                      tel: 'rw',
+                      org: 'rw',
+                      jobTitle: 'rw',
+                      bday: 'rw',
+                      note: 'rw',
+                      impp: 'rw',
+                      anniversary: 'rw',
+                      sex: 'rw',
+                      genderIdentity: 'rw'
+                     },
+
   init: function init(aProp) {
     // Accept non-array strings for DOMString[] properties and convert them.
     function _create(aField) {   
@@ -290,7 +328,7 @@ const nsIDOMContactManager      = Components.interfaces.nsIDOMContactManager;
 
 function ContactManager()
 {
-  debug("Constructor");
+  if (DEBUG) debug("Constructor");
 }
 
 ContactManager.prototype = {
@@ -298,7 +336,7 @@ ContactManager.prototype = {
   _oncontactchange: null,
 
   set oncontactchange(aCallback) {
-    debug("set oncontactchange");
+    if (DEBUG) debug("set oncontactchange");
     let allowCallback = function() {
       this._oncontactchange = aCallback;
     }.bind(this);
@@ -321,16 +359,16 @@ ContactManager.prototype = {
   _convertContactsArray: function(aContacts) {
     let contacts = new Array();
     for (let i in aContacts) {
-      let newContact = Components.classes['@mozilla.org/contact;1'].createInstance();
+      let newContact = new Contact();
       newContact.init(aContacts[i].properties);
-      this._setMetaData(newContact.wrappedJSObject, aContacts[i]);
+      this._setMetaData(newContact, aContacts[i]);
       contacts.push(newContact);
     }
     return contacts;
   },
 
   receiveMessage: function(aMessage) {
-    debug("Contactmanager::receiveMessage: " + aMessage.name);
+    if (DEBUG) debug("Contactmanager::receiveMessage: " + aMessage.name);
     let msg = aMessage.json;
     let contacts = msg.contacts;
 
@@ -339,10 +377,9 @@ ContactManager.prototype = {
         let req = this.getRequest(msg.requestID);
         if (req) {
           let result = this._convertContactsArray(contacts);
-          debug("result: " + JSON.stringify(result));
           Services.DOMRequest.fireSuccess(req.request, result);
         } else {
-          debug("no request stored!" + msg.requestID);
+          if (DEBUG) debug("no request stored!" + msg.requestID);
         }
         break;
       case "Contact:Save:Return:OK":
@@ -370,7 +407,7 @@ ContactManager.prototype = {
           Services.DOMRequest.fireError(req.request, msg.errorMsg);
         break;
       case "PermissionPromptHelper:AskPermission:OK":
-        debug("id: " + msg.requestID);
+        if (DEBUG) debug("id: " + msg.requestID);
         req = this.getRequest(msg.requestID);
         if (!req) {
           break;
@@ -383,13 +420,13 @@ ContactManager.prototype = {
         }
         break;
       default: 
-        debug("Wrong message: " + aMessage.name);
+        if (DEBUG) debug("Wrong message: " + aMessage.name);
     }
     this.removeRequest(msg.requestID);
   },
 
   askPermission: function (aAccess, aReqeust, aAllowCallback, aCancelCallback) {
-    debug("askPermission for contacts");
+    if (DEBUG) debug("askPermission for contacts");
     let requestID = this.getRequestId({
       request: aReqeust,
       allow: function() {
@@ -417,7 +454,7 @@ ContactManager.prototype = {
 
   save: function save(aContact) {
     let request;
-    debug("save: " + JSON.stringify(aContact) + " :" + aContact.id);
+    if (DEBUG) debug("save: " + JSON.stringify(aContact) + " :" + aContact.id);
     let newContact = {};
     newContact.properties = {
       name:            [],
@@ -457,7 +494,7 @@ ContactManager.prototype = {
     }
 
     this._setMetaData(newContact, aContact);
-    debug("send: " + JSON.stringify(newContact));
+    if (DEBUG) debug("send: " + JSON.stringify(newContact));
     request = this.createRequest();
     let options = { contact: newContact };
     let allowCallback = function() {
@@ -468,7 +505,7 @@ ContactManager.prototype = {
   },
 
   find: function(aOptions) {
-    debug("find! " + JSON.stringify(aOptions));
+    if (DEBUG) debug("find! " + JSON.stringify(aOptions));
     let request;
     request = this.createRequest();
     let options = { findOptions: aOptions };
@@ -491,7 +528,7 @@ ContactManager.prototype = {
   },
 
   clear: function() {
-    debug("clear");
+    if (DEBUG) debug("clear");
     let request;
     request = this.createRequest();
     let options = {};
@@ -508,16 +545,16 @@ ContactManager.prototype = {
 
     let allowCallback = function() {
       let callback = function(aType, aContacts) {
-        debug("got SIM contacts: " + aType + " " + JSON.stringify(aContacts));
+        if (DEBUG) debug("got SIM contacts: " + aType + " " + JSON.stringify(aContacts));
         let result = aContacts.map(function(c) {
           var contact = new Contact();
           contact.init( { name: [c.alphaId], tel: [ { number: c.number } ] } );
           return contact;
         });
-        debug("result: " + JSON.stringify(result));
+        if (DEBUG) debug("result: " + JSON.stringify(result));
         Services.DOMRequest.fireSuccess(request, result);
       };
-      debug("getSimContacts " + aType);
+      if (DEBUG) debug("getSimContacts " + aType);
 
       mRIL.getICCContacts(aType, callback);
     }.bind(this);
@@ -543,7 +580,7 @@ ContactManager.prototype = {
 
   // Called from DOMRequestIpcHelper
   uninit: function uninit() {
-    debug("uninit call");
+    if (DEBUG) debug("uninit call");
     if (this._oncontactchange)
       this._oncontactchange = null;
   },
diff --git a/dom/contacts/fallback/ContactDB.jsm b/dom/contacts/fallback/ContactDB.jsm
index 5acabfe75628..c13065557141 100644
--- a/dom/contacts/fallback/ContactDB.jsm
+++ b/dom/contacts/fallback/ContactDB.jsm
@@ -6,13 +6,8 @@
 
 const EXPORTED_SYMBOLS = ['ContactDB'];
 
-let DEBUG = 0;
-/* static functions */
-if (DEBUG) {
-  debug = function (s) { dump("-*- ContactDB component: " + s + "\n"); }
-} else {
-  debug = function (s) {}
-}
+const DEBUG = false;
+function debug(s) { dump("-*- ContactDB component: " + s + "\n"); }
 
 const Cu = Components.utils;
 const Cc = Components.classes;
@@ -26,7 +21,7 @@ const DB_VERSION = 4;
 const STORE_NAME = "contacts";
 
 function ContactDB(aGlobal) {
-  debug("Constructor");
+  if (DEBUG) debug("Constructor");
   this._global = aGlobal;
 }
 
@@ -34,7 +29,7 @@ ContactDB.prototype = {
   __proto__: IndexedDBHelper.prototype,
 
   upgradeSchema: function upgradeSchema(aTransaction, aDb, aOldVersion, aNewVersion) {
-    debug("upgrade schema from: " + aOldVersion + " to " + aNewVersion + " called!");
+    if (DEBUG) debug("upgrade schema from: " + aOldVersion + " to " + aNewVersion + " called!");
     let db = aDb;
     let objectStore;
     for (let currVersion = aOldVersion; currVersion < aNewVersion; currVersion++) {
@@ -50,7 +45,7 @@ ContactDB.prototype = {
          *  properties:    {...}        // Object holding the ContactProperties
          * }
          */
-        debug("create schema");
+        if (DEBUG) debug("create schema");
         objectStore = db.createObjectStore(this.dbStoreName, {keyPath: "id"});
 
         // Metadata indexes
@@ -74,7 +69,7 @@ ContactDB.prototype = {
         objectStore.createIndex("emailLowerCase",      "search.email",      { unique: false, multiEntry: true });
         objectStore.createIndex("noteLowerCase",       "search.note",       { unique: false, multiEntry: true });
       } else if (currVersion == 1) {
-        debug("upgrade 1");
+        if (DEBUG) debug("upgrade 1");
 
         // Create a new scheme for the tel field. We move from an array of tel-numbers to an array of
         // ContactTelephone.
@@ -88,12 +83,12 @@ ContactDB.prototype = {
         objectStore.openCursor().onsuccess = function(event) {
           let cursor = event.target.result;
           if (cursor) {
-            debug("upgrade tel1: " + JSON.stringify(cursor.value));
+            if (DEBUG) debug("upgrade tel1: " + JSON.stringify(cursor.value));
             for (let number in cursor.value.properties.tel) {
               cursor.value.properties.tel[number] = {number: number};
             }
             cursor.update(cursor.value);
-            debug("upgrade tel2: " + JSON.stringify(cursor.value));
+            if (DEBUG) debug("upgrade tel2: " + JSON.stringify(cursor.value));
             cursor.continue();
           }
         };
@@ -102,7 +97,7 @@ ContactDB.prototype = {
         objectStore.createIndex("tel", "search.tel", { unique: false, multiEntry: true });
         objectStore.createIndex("category", "properties.category", { unique: false, multiEntry: true });
       } else if (currVersion == 2) {
-        debug("upgrade 2");
+        if (DEBUG) debug("upgrade 2");
         // Create a new scheme for the email field. We move from an array of emailaddresses to an array of 
         // ContactEmail.
         if (!objectStore) {
@@ -115,11 +110,11 @@ ContactDB.prototype = {
         objectStore.openCursor().onsuccess = function(event) {
           let cursor = event.target.result;
           if (cursor) {
-            debug("upgrade email1: " + JSON.stringify(cursor.value));
+            if (DEBUG) debug("upgrade email1: " + JSON.stringify(cursor.value));
             cursor.value.properties.email =
               cursor.value.properties.email.map(function(address) { return { address: address }; });
             cursor.update(cursor.value);
-            debug("upgrade email2: " + JSON.stringify(cursor.value));
+            if (DEBUG) debug("upgrade email2: " + JSON.stringify(cursor.value));
             cursor.continue();
           }
         };
@@ -127,7 +122,7 @@ ContactDB.prototype = {
         // Create new searchable indexes.
         objectStore.createIndex("email", "search.email", { unique: false, multiEntry: true });
       } else if (currVersion == 3) {
-        debug("upgrade 3");
+        if (DEBUG) debug("upgrade 3");
 
         if (!objectStore) {
           objectStore = aTransaction.objectStore(STORE_NAME);
@@ -137,11 +132,11 @@ ContactDB.prototype = {
         objectStore.openCursor().onsuccess = function(event) {
           let cursor = event.target.result;
           if (cursor) {
-            debug("upgrade impp1: " + JSON.stringify(cursor.value));
+            if (DEBUG) debug("upgrade impp1: " + JSON.stringify(cursor.value));
             cursor.value.properties.impp =
               cursor.value.properties.impp.map(function(value) { return { value: value }; });
             cursor.update(cursor.value);
-            debug("upgrade impp2: " + JSON.stringify(cursor.value));
+            if (DEBUG) debug("upgrade impp2: " + JSON.stringify(cursor.value));
             cursor.continue();
           }
         };
@@ -149,11 +144,11 @@ ContactDB.prototype = {
         objectStore.openCursor().onsuccess = function(event) {
           let cursor = event.target.result;
           if (cursor) {
-            debug("upgrade url1: " + JSON.stringify(cursor.value));
+            if (DEBUG) debug("upgrade url1: " + JSON.stringify(cursor.value));
             cursor.value.properties.url =
               cursor.value.properties.url.map(function(value) { return { value: value }; });
             cursor.update(cursor.value);
-            debug("upgrade impp2: " + JSON.stringify(cursor.value));
+            if (DEBUG) debug("upgrade impp2: " + JSON.stringify(cursor.value));
             cursor.continue();
           }
         };
@@ -228,7 +223,7 @@ ContactDB.prototype = {
                     contact.search[field].push(digits.substring(i, digits.length));
                   }
                 }
-              debug("lookup: " + JSON.stringify(contact.search[field]));
+              if (DEBUG) debug("lookup: " + JSON.stringify(contact.search[field]));
               }
             } else if (field == "email") {
               let address = aContact.properties[field][i].value;
@@ -250,7 +245,7 @@ ContactDB.prototype = {
         }
       }
     }
-    debug("contact:" + JSON.stringify(contact));
+    if (DEBUG) debug("contact:" + JSON.stringify(contact));
 
     contact.updated = aContact.updated;
     contact.published = aContact.published;
@@ -285,24 +280,24 @@ ContactDB.prototype = {
   saveContact: function saveContact(aContact, successCb, errorCb) {
     let contact = this.makeImport(aContact);
     this.newTxn("readwrite", function (txn, store) {
-      debug("Going to update" + JSON.stringify(contact));
+      if (DEBUG) debug("Going to update" + JSON.stringify(contact));
 
       // Look up the existing record and compare the update timestamp.
       // If no record exists, just add the new entry.
       let newRequest = store.get(contact.id);
       newRequest.onsuccess = function (event) {
         if (!event.target.result) {
-          debug("new record!")
+          if (DEBUG) debug("new record!")
           this.updateRecordMetadata(contact);
           store.put(contact);
         } else {
-          debug("old record!")
+          if (DEBUG) debug("old record!")
           if (new Date(typeof contact.updated === "undefined" ? 0 : contact.updated) < new Date(event.target.result.updated)) {
-            debug("rev check fail!");
+            if (DEBUG) debug("rev check fail!");
             txn.abort();
             return;
           } else {
-            debug("rev check OK");
+            if (DEBUG) debug("rev check OK");
             contact.published = event.target.result.published;
             contact.updated = new Date();
             store.put(contact);
@@ -314,14 +309,14 @@ ContactDB.prototype = {
 
   removeContact: function removeContact(aId, aSuccessCb, aErrorCb) {
     this.newTxn("readwrite", function (txn, store) {
-      debug("Going to delete" + aId);
+      if (DEBUG) debug("Going to delete" + aId);
       store.delete(aId);
     }, aSuccessCb, aErrorCb);
   },
 
   clear: function clear(aSuccessCb, aErrorCb) {
     this.newTxn("readwrite", function (txn, store) {
-      debug("Going to clear all!");
+      if (DEBUG) debug("Going to clear all!");
       store.clear();
     }, aSuccessCb, aErrorCb);
   },
@@ -339,7 +334,7 @@ ContactDB.prototype = {
    *        - count
    */
   find: function find(aSuccessCb, aFailureCb, aOptions) {
-    debug("ContactDB:find val:" + aOptions.filterValue + " by: " + aOptions.filterBy + " op: " + aOptions.filterOp + "\n");
+    if (DEBUG) debug("ContactDB:find val:" + aOptions.filterValue + " by: " + aOptions.filterBy + " op: " + aOptions.filterOp + "\n");
     let self = this;
     this.newTxn("readonly", function (txn, store) {
       if (aOptions && (aOptions.filterOp == "equals" || aOptions.filterOp == "contains")) {
@@ -351,12 +346,12 @@ ContactDB.prototype = {
   },
 
   _findWithIndex: function _findWithIndex(txn, store, options) {
-    debug("_findWithIndex: " + options.filterValue +" " + options.filterOp + " " + options.filterBy + " ");
+    if (DEBUG) debug("_findWithIndex: " + options.filterValue +" " + options.filterOp + " " + options.filterBy + " ");
     let fields = options.filterBy;
     for (let key in fields) {
-      debug("key: " + fields[key]);
+      if (DEBUG) debug("key: " + fields[key]);
       if (!store.indexNames.contains(fields[key]) && !fields[key] == "id") {
-        debug("Key not valid!" + fields[key] + ", " + store.indexNames);
+        if (DEBUG) debug("Key not valid!" + fields[key] + ", " + store.indexNames);
         txn.abort();
         return;
       }
@@ -364,7 +359,7 @@ ContactDB.prototype = {
 
     // lookup for all keys
     if (options.filterBy.length == 0) {
-      debug("search in all fields!" + JSON.stringify(store.indexNames));
+      if (DEBUG) debug("search in all fields!" + JSON.stringify(store.indexNames));
       for(let myIndex = 0; myIndex < store.indexNames.length; myIndex++) {
         fields = Array.concat(fields, store.indexNames[myIndex])
       }
@@ -383,7 +378,7 @@ ContactDB.prototype = {
         let index = store.index(key);
         request = index.mozGetAll(options.filterValue, limit);
       } else if (options.filterOp == "equals") {
-        debug("Getting index: " + key);
+        if (DEBUG) debug("Getting index: " + key);
         // case sensitive
         let index = store.index(key);
         request = index.mozGetAll(options.filterValue, limit);
@@ -400,7 +395,7 @@ ContactDB.prototype = {
         txn.result = {};
 
       request.onsuccess = function (event) {
-        debug("Request successful. Record count:" + event.target.result.length);
+        if (DEBUG) debug("Request successful. Record count:" + event.target.result.length);
         for (let i in event.target.result)
           txn.result[event.target.result[i].id] = this.makeExport(event.target.result[i]);
       }.bind(this);
@@ -408,13 +403,13 @@ ContactDB.prototype = {
   },
 
   _findAll: function _findAll(txn, store, options) {
-    debug("ContactDB:_findAll:  " + JSON.stringify(options));
+    if (DEBUG) debug("ContactDB:_findAll:  " + JSON.stringify(options));
     if (!txn.result)
       txn.result = {};
     // Sorting functions takes care of limit if set.
     let limit = options.sortBy === 'undefined' ? options.filterLimit : null;
     store.mozGetAll(null, limit).onsuccess = function (event) {
-      debug("Request successful. Record count:", event.target.result.length);
+      if (DEBUG) debug("Request successful. Record count:", event.target.result.length);
       for (let i in event.target.result)
         txn.result[event.target.result[i].id] = this.makeExport(event.target.result[i]);
     }.bind(this);
diff --git a/dom/contacts/fallback/ContactService.jsm b/dom/contacts/fallback/ContactService.jsm
index c4f2450c31f4..c8615958647a 100644
--- a/dom/contacts/fallback/ContactService.jsm
+++ b/dom/contacts/fallback/ContactService.jsm
@@ -4,11 +4,8 @@
 
 "use strict";
 
-let DEBUG = 0;
-if (DEBUG)
-  debug = function (s) { dump("-*- Fallback ContactService component: " + s + "\n"); }
-else
-  debug = function (s) {}
+const DEBUG = false;
+function debug(s) { dump("-*- Fallback ContactService component: " + s + "\n"); }
 
 const Cu = Components.utils; 
 const Cc = Components.classes;
@@ -28,7 +25,7 @@ let myGlobal = this;
 
 let DOMContactManager = {
   init: function() {
-    debug("Init");
+    if (DEBUG) debug("Init");
     this._messages = ["Contacts:Find", "Contacts:Clear", "Contact:Save", "Contact:Remove"];
     this._messages.forEach((function(msgName) {
       ppmm.addMessageListener(msgName, this);
@@ -56,7 +53,7 @@ let DOMContactManager = {
   },
 
   receiveMessage: function(aMessage) {
-    debug("Fallback DOMContactManager::receiveMessage " + aMessage.name);
+    if (DEBUG) debug("Fallback DOMContactManager::receiveMessage " + aMessage.name);
     let mm = aMessage.target.QueryInterface(Ci.nsIFrameMessageManager);
     let msg = aMessage.data;
 
@@ -112,14 +109,14 @@ let DOMContactManager = {
             if (msg.options && msg.options.findOptions) {
               let findOptions = msg.options.findOptions;
               if (findOptions.sortOrder !== 'undefined' && findOptions.sortBy !== 'undefined') {
-                debug('sortBy: ' + findOptions.sortBy + ', sortOrder: ' + findOptions.sortOrder );
+                if (DEBUG) debug('sortBy: ' + findOptions.sortBy + ', sortOrder: ' + findOptions.sortOrder );
                 result.sort(sortfunction);
                 if (findOptions.filterLimit)
                   result = result.slice(0, findOptions.filterLimit);
               }
             }
 
-            debug("result:" + JSON.stringify(result));
+            if (DEBUG) debug("result:" + JSON.stringify(result));
             mm.sendAsyncMessage("Contacts:Find:Return:OK", {requestID: msg.requestID, contacts: result});
           }.bind(this),
           function(aErrorMsg) { mm.sendAsyncMessage("Contacts:Find:Return:KO", { requestID: msg.requestID, errorMsg: aErrorMsg }) }.bind(this),
@@ -145,7 +142,7 @@ let DOMContactManager = {
           function(aErrorMsg) { mm.sendAsyncMessage("Contacts:Clear:Return:KO", { requestID: msg.requestID, errorMsg: aErrorMsg }); }.bind(this)
         );
       default:
-        debug("WRONG MESSAGE NAME: " + aMessage.name);
+        if (DEBUG) debug("WRONG MESSAGE NAME: " + aMessage.name);
     }
   }
 }
diff --git a/dom/contacts/tests/test_contacts_basics.html b/dom/contacts/tests/test_contacts_basics.html
index ea41a4e3b20b..3bda1254727c 100644
--- a/dom/contacts/tests/test_contacts_basics.html
+++ b/dom/contacts/tests/test_contacts_basics.html
@@ -92,7 +92,7 @@ var properties2 = {
   honorificSuffix: "dummyHonorificSuffix",
   additionalName: "dummyadditionalName",
   nickname: "dummyNickname",
-  tel: [{type: ["test"], value: "123456789"},{type: ["home", "custom"], value: "234567890"}],
+  tel: [{type: ["test"], value: "123456789", carrier: "myCarrier"},{type: ["home", "custom"], value: "234567890"}],
   email: [{type: ["test"], value: "a@b.c"}, {value: "b@c.d"}],
   adr: [adr1, adr2],
   impp: [{type: ["aim"], value:"im1"}, {value: "im2"}],
@@ -154,8 +154,8 @@ function checkTel(tel1, tel2) {
 }
 
 function checkField(field1, field2) {
-  checkStr(field1.type, field1.type, "Same type");
-  checkStr(field1.value, field1.value, "Same value");
+  checkStr(field1.type, field2.type, "Same type");
+  checkStr(field1.value, field2.value, "Same value");
 }
 
 function checkContacts(contact1, contact2) {
@@ -312,6 +312,20 @@ var steps = [
       findResult1 = req.result[0];
       ok(findResult1.id == sample_id1, "Same ID");
       checkContacts(createResult1, properties1);
+      dump("findResult: " + JSON.stringify(findResult1) + "\n");
+      // Some manual testing. Testint the testfunctions
+      // tel: [{type: ["work"], value: "123456", carrier: "testCarrier"} , {type: ["home", "fax"], value: "+9-876-5432"}],
+      is(findResult1.tel[0].carrier, "testCarrier", "Same Carrier");
+      is(findResult1.tel[0].type, "work", "Same type");
+      is(findResult1.tel[0].value, "123456", "Same Value");
+      is(findResult1.tel[1].type[1], "fax", "Same type");
+      is(findResult1.tel[1].value, "+9-876-5432", "Same Value");
+
+      is(findResult1.adr[0].countryName, "country 1", "Same country");
+
+      // email: [{type: ["work"], value: "x@y.com"}]
+      is(findResult1.email[0].type, "work", "Same Type");
+      is(findResult1.email[0].value, "x@y.com", "Same Value");
       next();
     };
     req.onerror = onFailure;
diff --git a/dom/interfaces/base/nsIDOMWindowUtils.idl b/dom/interfaces/base/nsIDOMWindowUtils.idl
index bb33d348a37b..616e3a4a6485 100644
--- a/dom/interfaces/base/nsIDOMWindowUtils.idl
+++ b/dom/interfaces/base/nsIDOMWindowUtils.idl
@@ -121,12 +121,17 @@ interface nsIDOMWindowUtils : nsISupports {
    *
    * It's legal to set a displayport that extends beyond the overflow
    * area in any direction (left/right/top/bottom).
-   * 
+   *
    * It's also legal to set a displayport that extends beyond the
    * area's bounds.  No pixels are rendered outside the area bounds.
    *
    * The caller of this method must have UniversalXPConnect
    * privileges.
+   *
+   * Calling this will always force a recomposite, so it should be
+   * avoided if at all possible. Client code should do checks before
+   * calling this so that duplicate sets are not made with the same
+   * displayport.
    */
   void setDisplayPortForElement(in float aXPx, in float aYPx,
                                 in float aWidthPx, in float aHeightPx,
diff --git a/dom/ipc/ContentChild.cpp b/dom/ipc/ContentChild.cpp
index 5e33abe36b45..db30f9c54979 100644
--- a/dom/ipc/ContentChild.cpp
+++ b/dom/ipc/ContentChild.cpp
@@ -757,16 +757,9 @@ ContentChild::AddRemoteAlertObserver(const nsString& aData,
 }
 
 bool
-ContentChild::RecvPreferenceUpdate(const PrefTuple& aPref)
+ContentChild::RecvPreferenceUpdate(const PrefSetting& aPref)
 {
-    Preferences::SetPreference(&aPref);
-    return true;
-}
-
-bool
-ContentChild::RecvClearUserPreference(const nsCString& aPrefName)
-{
-    Preferences::ClearContentPref(aPrefName.get());
+    Preferences::SetPreference(aPref);
     return true;
 }
 
diff --git a/dom/ipc/ContentChild.h b/dom/ipc/ContentChild.h
index 7435fb310483..8d74ae474736 100644
--- a/dom/ipc/ContentChild.h
+++ b/dom/ipc/ContentChild.h
@@ -136,8 +136,7 @@ public:
     // auto remove when alertfinished is received.
     nsresult AddRemoteAlertObserver(const nsString& aData, nsIObserver* aObserver);
 
-    virtual bool RecvPreferenceUpdate(const PrefTuple& aPref);
-    virtual bool RecvClearUserPreference(const nsCString& aPrefName);
+    virtual bool RecvPreferenceUpdate(const PrefSetting& aPref);
 
     virtual bool RecvNotifyAlertsObserver(const nsCString& aType, const nsString& aData);
 
diff --git a/dom/ipc/ContentParent.cpp b/dom/ipc/ContentParent.cpp
index c636f5a7a925..02293abe3286 100644
--- a/dom/ipc/ContentParent.cpp
+++ b/dom/ipc/ContentParent.cpp
@@ -732,9 +732,9 @@ ContentParent::IsForApp()
 }
 
 bool
-ContentParent::RecvReadPrefsArray(InfallibleTArray<PrefTuple> *prefs)
+ContentParent::RecvReadPrefsArray(InfallibleTArray<PrefSetting>* aPrefs)
 {
-    Preferences::MirrorPreferences(prefs);
+    Preferences::GetPreferences(aPrefs);
     return true;
 }
 
@@ -954,17 +954,10 @@ ContentParent::Observe(nsISupports* aSubject,
         // We know prefs are ASCII here.
         NS_LossyConvertUTF16toASCII strData(aData);
 
-        PrefTuple pref;
-        bool prefNeedUpdate = Preferences::MirrorPreference(strData.get(), &pref);
-        if (prefNeedUpdate) {
-          if (!SendPreferenceUpdate(pref)) {
-              return NS_ERROR_NOT_AVAILABLE;
-          }
-        } else {
-          // Pref wasn't found.  It was probably removed.
-          if (!SendClearUserPreference(strData)) {
-              return NS_ERROR_NOT_AVAILABLE;
-          }
+        PrefSetting pref(strData, null_t(), null_t());
+        Preferences::GetPreference(&pref);
+        if (!SendPreferenceUpdate(pref)) {
+            return NS_ERROR_NOT_AVAILABLE;
         }
     }
     else if (!strcmp(aTopic, NS_IPC_IOSERVICE_SET_OFFLINE_TOPIC)) {
diff --git a/dom/ipc/ContentParent.h b/dom/ipc/ContentParent.h
index 55af5d0dcef0..15578f926d57 100644
--- a/dom/ipc/ContentParent.h
+++ b/dom/ipc/ContentParent.h
@@ -212,7 +212,7 @@ private:
     virtual PStorageParent* AllocPStorage(const StorageConstructData& aData);
     virtual bool DeallocPStorage(PStorageParent* aActor);
 
-    virtual bool RecvReadPrefsArray(InfallibleTArray<PrefTuple> *retValue);
+    virtual bool RecvReadPrefsArray(InfallibleTArray<PrefSetting>* aPrefs);
     virtual bool RecvReadFontList(InfallibleTArray<FontListEntry>* retValue);
 
     virtual bool RecvReadPermissions(InfallibleTArray<IPC::Permission>* aPermissions);
diff --git a/dom/ipc/PBrowser.ipdl b/dom/ipc/PBrowser.ipdl
index 1fe4b94b711a..5c36c6eff3d4 100644
--- a/dom/ipc/PBrowser.ipdl
+++ b/dom/ipc/PBrowser.ipdl
@@ -251,14 +251,21 @@ parent:
                                 nsString aName, nsString aFeatures)
       returns (bool windowOpened);
 
-    NotifyDOMTouchListenerAdded();
-
     /**
      * Instructs the TabParent to forward a request to zoom to a rect given in
      * CSS pixels. This rect is relative to the document.
      */
     ZoomToRect(gfxRect aRect);
 
+    /**
+     * We know for sure that content has either preventDefaulted or not
+     * preventDefaulted. This applies to an entire batch of touch events. It is
+     * expected that, if there are any DOM touch listeners, touch events will be
+     * batched and only processed for panning and zooming if content does not
+     * preventDefault.
+     */
+    ContentReceivedTouch(bool aPreventDefault);
+
     __delete__();
 
 child:
diff --git a/dom/ipc/PContent.ipdl b/dom/ipc/PContent.ipdl
index 0a0379f29a31..e5499ef86c86 100644
--- a/dom/ipc/PContent.ipdl
+++ b/dom/ipc/PContent.ipdl
@@ -24,7 +24,6 @@ include "mozilla/net/NeckoMessageUtils.h";
 include "mozilla/dom/TabMessageUtils.h";
 
 include "nsGeoPositionIPCSerialiser.h";
-include "PPrefTuple.h";
 
 include DOMTypes;
 
@@ -135,6 +134,23 @@ union AppId {
   nullable PBrowser;
 };
 
+union PrefValue {
+  nsCString;
+  int32_t;
+  bool;
+};
+
+union MaybePrefValue {
+  PrefValue;
+  null_t;
+};
+
+struct PrefSetting {
+  nsCString name;
+  MaybePrefValue defaultValue;
+  MaybePrefValue userValue;
+};
+
 rpc protocol PContent
 {
     parent opens PCompositor;
@@ -183,8 +199,7 @@ child:
 
     async NotifyVisited(URI uri);
 
-    PreferenceUpdate(PrefTuple pref);
-    ClearUserPreference(nsCString prefName);
+    PreferenceUpdate(PrefSetting pref);
 
     NotifyAlertsObserver(nsCString topic, nsString data);
 
@@ -248,7 +263,7 @@ parent:
     async LoadURIExternal(URI uri);
 
     // PrefService message
-    sync ReadPrefsArray() returns (PrefTuple[] retValue);
+    sync ReadPrefsArray() returns (PrefSetting[] prefs);
 
     sync ReadFontList() returns (FontListEntry[] retValue);
 
diff --git a/dom/ipc/TabChild.cpp b/dom/ipc/TabChild.cpp
index 6faf2efb726e..10f260852b6a 100644
--- a/dom/ipc/TabChild.cpp
+++ b/dom/ipc/TabChild.cpp
@@ -114,15 +114,7 @@ TabChild::Observe(nsISupports *aSubject,
                   const char *aTopic,
                   const PRUnichar *aData)
 {
-  if (!strcmp(aTopic, "dom-touch-listener-added")) {
-    nsCOMPtr<nsIDOMWindow> subject(do_QueryInterface(aSubject));
-    nsCOMPtr<nsIDOMWindow> win(do_GetInterface(mWebNav));
-    nsCOMPtr<nsIDOMWindow> topSubject;
-    subject->GetTop(getter_AddRefs(topSubject));
-    if (win == topSubject) {
-      SendNotifyDOMTouchListenerAdded();
-    }
-  } else if (!strcmp(aTopic, "cancel-default-pan-zoom")) {
+  if (!strcmp(aTopic, "cancel-default-pan-zoom")) {
     nsCOMPtr<nsIDocShell> docShell(do_QueryInterface(aSubject));
     nsCOMPtr<nsITabChild> tabChild(GetTabChildFrom(docShell));
     if (tabChild == this) {
@@ -163,9 +155,6 @@ TabChild::Init()
     do_GetService(NS_OBSERVERSERVICE_CONTRACTID);
 
   if (observerService) {
-    observerService->AddObserver(this,
-                                 "dom-touch-listener-added",
-                                 false);
     observerService->AddObserver(this,
                                  "cancel-default-pan-zoom",
                                  false);
@@ -397,12 +386,7 @@ TabChild::ProvideWindow(nsIDOMWindow* aParent, uint32_t aChromeFlags,
     // open a modal-type window, we're going to create a new <iframe mozbrowser>
     // and return its window here.
     nsCOMPtr<nsIDocShell> docshell = do_GetInterface(aParent);
-    bool isInContentBoundary = false;
-    if (docshell) {
-      docshell->GetIsBelowContentBoundary(&isInContentBoundary);
-    }
-
-    if (isInContentBoundary &&
+    if (docshell && docshell->GetIsBelowContentBoundary() &&
         !(aChromeFlags & (nsIWebBrowserChrome::CHROME_MODAL |
                           nsIWebBrowserChrome::CHROME_OPENAS_DIALOG |
                           nsIWebBrowserChrome::CHROME_OPENAS_CHROME))) {
@@ -737,8 +721,8 @@ TabChild::RecvUpdateFrame(const FrameMetrics& aFrameMetrics)
     }
 
     nsCString data;
-    data += nsPrintfCString("{ \"x\" : %d", aFrameMetrics.mViewportScrollOffset.x);
-    data += nsPrintfCString(", \"y\" : %d", aFrameMetrics.mViewportScrollOffset.y);
+    data += nsPrintfCString("{ \"x\" : %d", NS_lround(aFrameMetrics.mViewportScrollOffset.x));
+    data += nsPrintfCString(", \"y\" : %d", NS_lround(aFrameMetrics.mViewportScrollOffset.y));
     // We don't treat the x and y scales any differently for this
     // semi-platform-specific code.
     data += nsPrintfCString(", \"zoom\" : %f", aFrameMetrics.mResolution.width);
@@ -836,6 +820,13 @@ TabChild::RecvRealTouchEvent(const nsTouchEvent& aEvent)
 {
     nsTouchEvent localEvent(aEvent);
     nsEventStatus status = DispatchWidgetEvent(localEvent);
+
+    nsCOMPtr<nsPIDOMWindow> outerWindow = do_GetInterface(mWebNav);
+    nsCOMPtr<nsPIDOMWindow> innerWindow = outerWindow->GetCurrentInnerWindow();
+    if (innerWindow && innerWindow->HasTouchEventListeners()) {
+      SendContentReceivedTouch(nsIPresShell::gPreventMouseEvents);
+    }
+
     if (status == nsEventStatus_eConsumeNoDefault) {
         return true;
     }
diff --git a/dom/ipc/TabParent.cpp b/dom/ipc/TabParent.cpp
index 402fd594f516..4226e51b0840 100644
--- a/dom/ipc/TabParent.cpp
+++ b/dom/ipc/TabParent.cpp
@@ -1098,15 +1098,6 @@ TabParent::RecvBrowserFrameOpenWindow(PBrowserParent* aOpener,
   return true;
 }
 
-bool
-TabParent::RecvNotifyDOMTouchListenerAdded()
-{
-  if (RenderFrameParent* rfp = GetRenderFrame()) {
-    rfp->NotifyDOMTouchListenerAdded();
-  }
-  return true;
-}
-
 bool
 TabParent::RecvZoomToRect(const gfxRect& aRect)
 {
@@ -1116,5 +1107,14 @@ TabParent::RecvZoomToRect(const gfxRect& aRect)
   return true;
 }
 
+bool
+TabParent::RecvContentReceivedTouch(const bool& aPreventDefault)
+{
+  if (RenderFrameParent* rfp = GetRenderFrame()) {
+    rfp->ContentReceivedTouch(aPreventDefault);
+  }
+  return true;
+}
+
 } // namespace tabs
 } // namespace mozilla
diff --git a/dom/ipc/TabParent.h b/dom/ipc/TabParent.h
index d946ae2d6abc..e07ff03f2e70 100644
--- a/dom/ipc/TabParent.h
+++ b/dom/ipc/TabParent.h
@@ -105,8 +105,8 @@ public:
     virtual bool RecvSetBackgroundColor(const nscolor& aValue);
     virtual bool RecvGetDPI(float* aValue);
     virtual bool RecvGetWidgetNativeData(WindowsHandle* aValue);
-    virtual bool RecvNotifyDOMTouchListenerAdded();
     virtual bool RecvZoomToRect(const gfxRect& aRect);
+    virtual bool RecvContentReceivedTouch(const bool& aPreventDefault);
     virtual PContentDialogParent* AllocPContentDialog(const uint32_t& aType,
                                                       const nsCString& aName,
                                                       const nsCString& aFeatures,
diff --git a/dom/sms/src/SmsManager.cpp b/dom/sms/src/SmsManager.cpp
index 0172ae2a678e..37ed8153fb1d 100644
--- a/dom/sms/src/SmsManager.cpp
+++ b/dom/sms/src/SmsManager.cpp
@@ -8,6 +8,7 @@
 #include "nsIDOMClassInfo.h"
 #include "nsISmsService.h"
 #include "nsIObserverService.h"
+#include "mozilla/Preferences.h"
 #include "mozilla/Services.h"
 #include "Constants.h"
 #include "SmsEvent.h"
@@ -18,6 +19,7 @@
 #include "nsContentUtils.h"
 #include "nsISmsDatabaseService.h"
 #include "nsIXPConnect.h"
+#include "nsIPermissionManager.h"
 
 /**
  * We have to use macros here because our leak analysis tool things we are
@@ -59,6 +61,45 @@ NS_INTERFACE_MAP_END_INHERITING(nsDOMEventTargetHelper)
 NS_IMPL_ADDREF_INHERITED(SmsManager, nsDOMEventTargetHelper)
 NS_IMPL_RELEASE_INHERITED(SmsManager, nsDOMEventTargetHelper)
 
+/* static */already_AddRefed<SmsManager>
+SmsManager::CheckPermissionAndCreateInstance(nsPIDOMWindow* aWindow)
+{
+  NS_ASSERTION(aWindow, "Null pointer!");
+
+  // First of all, the general pref has to be turned on.
+  bool enabled = false;
+  Preferences::GetBool("dom.sms.enabled", &enabled);
+  NS_ENSURE_TRUE(enabled, nullptr);
+
+  nsPIDOMWindow* innerWindow = aWindow->IsInnerWindow() ?
+    aWindow :
+    aWindow->GetCurrentInnerWindow();
+
+  // Need the document for security check.
+  nsCOMPtr<nsIDocument> document =
+    do_QueryInterface(innerWindow->GetExtantDocument());
+  NS_ENSURE_TRUE(document, nullptr);
+
+  nsCOMPtr<nsIPrincipal> principal = document->NodePrincipal();
+  NS_ENSURE_TRUE(principal, nullptr);
+
+  nsCOMPtr<nsIPermissionManager> permMgr =
+    do_GetService(NS_PERMISSIONMANAGER_CONTRACTID);
+  NS_ENSURE_TRUE(permMgr, nullptr);
+
+  PRUint32 permission = nsIPermissionManager::DENY_ACTION;
+  permMgr->TestPermissionFromPrincipal(principal, "sms", &permission);
+
+  if (permission != nsIPermissionManager::ALLOW_ACTION) {
+    return nullptr;
+  }
+
+  nsRefPtr<SmsManager> smsMgr = new SmsManager();
+  smsMgr->Init(aWindow);
+
+  return smsMgr.forget();
+}
+
 void
 SmsManager::Init(nsPIDOMWindow *aWindow)
 {
diff --git a/dom/sms/src/SmsManager.h b/dom/sms/src/SmsManager.h
index 4f7815845058..2affe878b7b6 100644
--- a/dom/sms/src/SmsManager.h
+++ b/dom/sms/src/SmsManager.h
@@ -30,6 +30,9 @@ public:
   NS_DECL_CYCLE_COLLECTION_CLASS_INHERITED(SmsManager,
                                            nsDOMEventTargetHelper)
 
+  static already_AddRefed<SmsManager>
+  CheckPermissionAndCreateInstance(nsPIDOMWindow *aWindow);
+
   void Init(nsPIDOMWindow *aWindow);
   void Shutdown();
 
diff --git a/dom/sms/tests/marionette/test_between_emulators.py b/dom/sms/tests/marionette/test_between_emulators.py
index 5f892ef10017..f28314057ed9 100644
--- a/dom/sms/tests/marionette/test_between_emulators.py
+++ b/dom/sms/tests/marionette/test_between_emulators.py
@@ -11,8 +11,8 @@ class SMSTest(MarionetteTestCase):
         sender = self.get_new_emulator()
         receiver = self.marionette
 
-        self.set_up_test_page(sender, "test.html", ["dom.sms.whitelist"])
-        self.set_up_test_page(receiver, "test.html", ["dom.sms.whitelist"])
+        self.set_up_test_page(sender, "test.html", ["sms"])
+        self.set_up_test_page(receiver, "test.html", ["sms"])
 
         # Setup the event listsener on the receiver, which should store
         # a global variable when an SMS is received.
@@ -21,7 +21,7 @@ class SMSTest(MarionetteTestCase):
         receiver.execute_script("""
 global.smsreceived = null;
 window.navigator.mozSms.addEventListener("received", function(e) {
-    global.smsreceived = e.message;
+    global.smsreceived = e.message.body;
 });
 """, new_sandbox=False)
 
diff --git a/dom/sms/tests/marionette/test_incoming.js b/dom/sms/tests/marionette/test_incoming.js
index 72a4167c416c..a6f6a0193a9d 100644
--- a/dom/sms/tests/marionette/test_incoming.js
+++ b/dom/sms/tests/marionette/test_incoming.js
@@ -3,9 +3,8 @@
 
 MARIONETTE_TIMEOUT = 10000;
 
-const WHITELIST_PREF = "dom.sms.whitelist";
-let uriPrePath = window.location.protocol + "//" + window.location.host;
-SpecialPowers.setCharPref(WHITELIST_PREF, uriPrePath);
+SpecialPowers.setBoolPref("dom.sms.enabled", true);
+SpecialPowers.addPermission("sms", true, document);
 
 let sms = window.navigator.mozSms;
 let sender = "5555552368";
@@ -42,6 +41,6 @@ function cleanUp() {
     return;
   }
 
-  SpecialPowers.clearUserPref(WHITELIST_PREF);
+  SpecialPowers.removePermission("sms", document);
   finish();
 }
diff --git a/dom/sms/tests/test_sms_basics.html b/dom/sms/tests/test_sms_basics.html
index aadfeb0ba0e9..b9b55de05636 100644
--- a/dom/sms/tests/test_sms_basics.html
+++ b/dom/sms/tests/test_sms_basics.html
@@ -17,11 +17,11 @@
 
 function checkSmsDisabled() {
   ok('mozSms' in frames[0].navigator, "navigator.mozSms should exist");
-  is(navigator.mozSms, null, "navigator.mozSms should return null");
+  is(frames[0].navigator.mozSms, null, "navigator.mozSms should return null");
 }
 
 function checkSmsEnabled() {
-  // WebSms is disabled on all platforms except Android for the moment.
+  // Bug 784617: WebSms is disabled on all platforms except Android for the moment.
   if (navigator.appVersion.indexOf("Android") == -1) {
     checkSmsDisabled();
     return;
@@ -39,7 +39,6 @@ function checkInterface(aInterface) {
 
 function test() {
   var gSmsEnabled = SpecialPowers.getBoolPref("dom.sms.enabled");
-  var gSmsWhiteList = SpecialPowers.getCharPref("dom.sms.whitelist");
 
   checkInterface("SmsManager");
   checkInterface("NavigatorSms");
@@ -49,32 +48,24 @@ function test() {
   checkInterface("SmsFilter");
   checkInterface("SmsCursor");
 
-  // If sms are disabled and whitelist is empty, sms is disabled.
+  // If sms is disabled and permission is removed, sms is disabled.
   SpecialPowers.setBoolPref("dom.sms.enabled", false);
-  SpecialPowers.setCharPref("dom.sms.whitelist", "");
+  SpecialPowers.removePermission("sms", document);
   checkSmsDisabled();
 
-  // If sms are enabled and whitelist is empty, sms are disabled.
+  // If sms is enabled and permission is removed, sms is disabled.
   SpecialPowers.setBoolPref("dom.sms.enabled", true);
-  SpecialPowers.setCharPref("dom.sms.whitelist", "");
+  SpecialPowers.removePermission("sms", document);
   checkSmsDisabled();
 
-  // If sms are disabled and whitelist contains the current URL prepath,
-  // sms are disabled.
+  // If sms is disabled and permission is granted, sms is disabled.
   SpecialPowers.setBoolPref("dom.sms.enabled", false);
-  SpecialPowers.setCharPref("dom.sms.whitelist", "http://mochi.test:8888");
+  SpecialPowers.addPermission("sms", true, document);
   checkSmsDisabled();
 
-  // If sms are enabled and whitelist contains something else than the current
-  // URL prepath, sms are disabled.
+  // If sms is enabled and permission is granted, sms is enabled.
   SpecialPowers.setBoolPref("dom.sms.enabled", true);
-  SpecialPowers.setCharPref("dom.sms.whitelist", "http://foo.mochi.test:8888");
-  checkSmsDisabled();
-
-  // If sms are enabled and whitelist contains the current URL prepath,
-  // sms are enabled.
-  SpecialPowers.setBoolPref("dom.sms.enabled", true);
-  SpecialPowers.setCharPref("dom.sms.whitelist", "http://mochi.test:8888");
+  SpecialPowers.addPermission("sms", true, document);
   checkSmsEnabled();
 
   // Now, if sms are disabled with the pref, they will still be enabled.
@@ -96,15 +87,13 @@ function test() {
 
       // Cleanup and quit.
       SpecialPowers.setBoolPref("dom.sms.enabled", gSmsEnabled);
-      SpecialPowers.setCharPref("dom.sms.whitelist", gSmsWhiteList);
+      SpecialPowers.removePermission("sms", document);
       SimpleTest.finish();
     });
     frames[0].location.reload();
   });
 
-  // Having more than one item in the whitelist should work.
   SpecialPowers.setBoolPref("dom.sms.enabled", true);
-  SpecialPowers.setCharPref("dom.sms.whitelist", "http://mochi.test:8888, http://foo.com");
   frames[0].location.reload();
 }
 
diff --git a/dom/system/OSFileConstants.cpp b/dom/system/OSFileConstants.cpp
index fc0ba823ffa3..424293432b18 100644
--- a/dom/system/OSFileConstants.cpp
+++ b/dom/system/OSFileConstants.cpp
@@ -33,6 +33,9 @@
 #include "nsXPCOMCIDInternal.h"
 #include "nsServiceManagerUtils.h"
 #include "nsString.h"
+#include "nsAutoPtr.h"
+#include "nsDirectoryServiceDefs.h"
+#include "nsAppDirectoryServiceDefs.h"
 
 #include "OSFileConstants.h"
 #include "nsIOSFileConstantsService.h"
@@ -53,10 +56,42 @@ namespace {
  */
 bool gInitialized = false;
 
+typedef struct {
+  /**
+   * The name of the directory holding all the libraries (libxpcom, libnss, etc.)
+   */
+  nsString libDir;
+  nsString tmpDir;
+  nsString profileDir;
+} Paths;
+
 /**
- * The name of the directory holding all the libraries (libxpcom, libnss, etc.)
+ * System directories.
  */
-nsString* gLibDirectory;
+Paths* gPaths = NULL;
+
+}
+
+/**
+ * Return the path to one of the special directories.
+ *
+ * @param aKey The key to the special directory (e.g. "TmpD", "ProfD", ...)
+ * @param aOutPath The path to the special directory. In case of error,
+ * the string is set to void.
+ */
+nsresult GetPathToSpecialDir(const char *aKey, nsString& aOutPath)
+{
+  nsCOMPtr<nsIFile> file;
+  nsresult rv = NS_GetSpecialDirectory(aKey, getter_AddRefs(file));
+  if (NS_FAILED(rv) || !file) {
+    return rv;
+  }
+
+  rv = file->GetPath(aOutPath);
+  if (NS_FAILED(rv)) {
+    aOutPath.SetIsVoid(true);
+  }
+  return rv;
 }
 
 /**
@@ -72,23 +107,39 @@ nsresult InitOSFileConstants()
 
   gInitialized = true;
 
-  // Initialize gLibDirectory
-  nsCOMPtr<nsIFile> xpcomLib;
-  nsresult rv = NS_GetSpecialDirectory("XpcomLib", getter_AddRefs(xpcomLib));
-  if (NS_FAILED(rv) || !xpcomLib) {
-    return rv;
-  }
+  nsAutoPtr<Paths> paths(new Paths);
 
-  nsCOMPtr<nsIFile> libDir;
-  rv = xpcomLib->GetParent(getter_AddRefs(libDir));
+  // Initialize paths->libDir
+  nsCOMPtr<nsIFile> file;
+  nsresult rv = NS_GetSpecialDirectory("XpcomLib", getter_AddRefs(file));
   if (NS_FAILED(rv)) {
     return rv;
   }
 
-  gLibDirectory = new nsString();
-  return libDir->GetPath(*gLibDirectory);
+  nsCOMPtr<nsIFile> libDir;
+  rv = file->GetParent(getter_AddRefs(libDir));
+  if (NS_FAILED(rv)) {
+    return rv;
+  }
+
+  rv = libDir->GetPath(paths->libDir);
+  if (NS_FAILED(rv)) {
+    return rv;
+  }
+
+  // For other directories, ignore errors (they may be undefined on
+  // some platforms or in non-Firefox embeddings of Gecko).
+
+  GetPathToSpecialDir(NS_OS_TEMP_DIR, paths->tmpDir);
+  GetPathToSpecialDir(NS_APP_USER_PROFILE_50_DIR, paths->profileDir);
+
+  gPaths = paths.forget();
+  return NS_OK;
 }
 
+/**
+ * Perform the cleaning up that can only be executed on the main thread.
+ */
 void CleanupOSFileConstants()
 {
   MOZ_ASSERT(NS_IsMainThread());
@@ -97,7 +148,7 @@ void CleanupOSFileConstants()
   }
 
   gInitialized = false;
-  delete gLibDirectory;
+  delete gPaths;
 }
 
 
@@ -478,6 +529,22 @@ JSObject *GetOrCreateObjectProperty(JSContext *cx, JSObject *aObject,
   return JS_DefineObject(cx, aObject, aProperty, NULL, NULL, JSPROP_ENUMERATE);
 }
 
+/**
+ * Set a property of an object from a nsString.
+ *
+ * If the nsString is void (i.e. IsVoid is true), do nothing.
+ */
+bool SetStringProperty(JSContext *cx, JSObject *aObject, const char *aProperty,
+                       const nsString aValue)
+{
+  if (aValue.IsVoid()) {
+    return true;
+  }
+  JSString* strValue = JS_NewUCStringCopyZ(cx, aValue.get());
+  jsval valValue = STRING_TO_JSVAL(strValue);
+  return JS_SetProperty(cx, aObject, aProperty, &valValue);
+}
+
 /**
  * Define OS-specific constants.
  *
@@ -488,6 +555,16 @@ bool DefineOSFileConstants(JSContext *cx, JSObject *global)
 {
   MOZ_ASSERT(gInitialized);
 
+  if (gPaths == NULL) {
+    // If an initialization error was ignored, we may end up with
+    // |gInitialized == true| but |gPaths == NULL|. We cannot
+    // |MOZ_ASSERT| this, as this would kill precompile_cache.js,
+    // so we simply return an error.
+    JS_ReportErrorNumber(cx, js_GetErrorMessage, NULL,
+      JSMSG_CANT_OPEN, "OSFileConstants", "initialization has failed");
+    return false;
+  }
+
   JSObject *objOS;
   if (!(objOS = GetOrCreateObjectProperty(cx, global, "OS"))) {
     return false;
@@ -550,10 +627,9 @@ bool DefineOSFileConstants(JSContext *cx, JSObject *global)
     return false;
   }
 
-
   // Locate libxul
   {
-    nsAutoString xulPath(*gLibDirectory);
+    nsAutoString xulPath(gPaths->libDir);
 
     xulPath.Append(PR_GetDirectorySeparator());
 
@@ -568,13 +644,23 @@ bool DefineOSFileConstants(JSContext *cx, JSObject *global)
     xulPath.Append(NS_LITERAL_STRING(DLL_SUFFIX));
 #endif // defined(XP_MACOSX)
 
-    JSString* strPathToLibXUL = JS_NewUCStringCopyZ(cx, xulPath.get());
-    jsval valXul = STRING_TO_JSVAL(strPathToLibXUL);
-    if (!JS_SetProperty(cx, objPath, "libxul", &valXul)) {
+    if (!SetStringProperty(cx, objPath, "libxul", xulPath)) {
       return false;
     }
   }
 
+  if (!SetStringProperty(cx, objPath, "libDir", gPaths->libDir)) {
+    return false;
+  }
+
+  if (!SetStringProperty(cx, objPath, "tmpDir", gPaths->tmpDir)) {
+    return false;
+  }
+
+  if (!SetStringProperty(cx, objPath, "profileDir", gPaths->profileDir)) {
+    return false;
+  }
+
   return true;
 }
 
diff --git a/dom/workers/Worker.cpp b/dom/workers/Worker.cpp
index d07db062c7ba..0ff9d7634827 100644
--- a/dom/workers/Worker.cpp
+++ b/dom/workers/Worker.cpp
@@ -25,6 +25,22 @@ USING_WORKERS_NAMESPACE
 using namespace mozilla::dom;
 using mozilla::ErrorResult;
 
+// These are temporary until these classes are moved to be codegenerated.
+bool
+WorkerResolveProperty(JSContext* cx, JSObject* wrapper, jsid id, bool set,
+                      JSPropertyDescriptor* desc)
+{
+  return true;
+}
+bool
+WorkerEnumerateProperties(JS::AutoIdVector& props)
+{
+  return true;
+}
+NativePropertyHooks mozilla::dom::workers::sNativePropertyHooks =
+  { WorkerResolveProperty, WorkerEnumerateProperties, NULL };
+
+
 namespace {
 
 class Worker
@@ -276,6 +292,8 @@ private:
 MOZ_STATIC_ASSERT(prototypes::MaxProtoChainLength == 3,
                   "The MaxProtoChainLength must match our manual DOMJSClasses");
 
+// When this DOMJSClass is removed and it's the last consumer of
+// sNativePropertyHooks then sNativePropertyHooks should be removed too.
 DOMJSClass Worker::sClass = {
   {
     "Worker",
@@ -287,7 +305,7 @@ DOMJSClass Worker::sClass = {
   },
   { prototypes::id::EventTarget_workers, prototypes::id::_ID_Count,
     prototypes::id::_ID_Count },
-  -1, false, NULL
+  -1, false, &sNativePropertyHooks
 };
 
 JSPropertySpec Worker::sProperties[] = {
@@ -395,6 +413,8 @@ private:
 MOZ_STATIC_ASSERT(prototypes::MaxProtoChainLength == 3,
                   "The MaxProtoChainLength must match our manual DOMJSClasses");
 
+// When this DOMJSClass is removed and it's the last consumer of
+// sNativePropertyHooks then sNativePropertyHooks should be removed too.
 DOMJSClass ChromeWorker::sClass = {
   { "ChromeWorker",
     JSCLASS_IS_DOMJSCLASS | JSCLASS_HAS_RESERVED_SLOTS(1) |
@@ -405,7 +425,7 @@ DOMJSClass ChromeWorker::sClass = {
   },
   { prototypes::id::EventTarget_workers, prototypes::id::_ID_Count,
     prototypes::id::_ID_Count },
-  -1, false, NULL
+  -1, false, &sNativePropertyHooks
 };
 
 WorkerPrivate*
diff --git a/dom/workers/Worker.h b/dom/workers/Worker.h
index 8a32ca04aa6a..9629c8ca2159 100644
--- a/dom/workers/Worker.h
+++ b/dom/workers/Worker.h
@@ -9,9 +9,12 @@
 #include "Workers.h"
 
 #include "jspubtd.h"
+#include "mozilla/dom/DOMJSClass.h"
 
 BEGIN_WORKERS_NAMESPACE
 
+extern mozilla::dom::NativePropertyHooks sNativePropertyHooks;
+
 namespace worker {
 
 JSObject*
diff --git a/dom/workers/WorkerScope.cpp b/dom/workers/WorkerScope.cpp
index 68496d069654..cf61a1a2bda7 100644
--- a/dom/workers/WorkerScope.cpp
+++ b/dom/workers/WorkerScope.cpp
@@ -848,6 +848,8 @@ private:
 MOZ_STATIC_ASSERT(prototypes::MaxProtoChainLength == 3,
                   "The MaxProtoChainLength must match our manual DOMJSClasses");
 
+// When this DOMJSClass is removed and it's the last consumer of
+// sNativePropertyHooks then sNativePropertyHooks should be removed too.
 DOMJSClass DedicatedWorkerGlobalScope::sClass = {
   {
     "DedicatedWorkerGlobalScope",
@@ -859,7 +861,7 @@ DOMJSClass DedicatedWorkerGlobalScope::sClass = {
   },
   { prototypes::id::EventTarget_workers, prototypes::id::_ID_Count,
     prototypes::id::_ID_Count },
-  -1, false, NULL
+  -1, false, &sNativePropertyHooks
 };
 
 JSPropertySpec DedicatedWorkerGlobalScope::sProperties[] = {
diff --git a/extensions/permissions/nsContentBlocker.cpp b/extensions/permissions/nsContentBlocker.cpp
index d23412ec9353..aecacf8d9090 100644
--- a/extensions/permissions/nsContentBlocker.cpp
+++ b/extensions/permissions/nsContentBlocker.cpp
@@ -207,13 +207,13 @@ nsContentBlocker::ShouldProcess(uint32_t          aContentType,
 
     bool shouldLoad, fromPrefs;
     nsresult rv = TestPermission(aContentLocation, aRequestingLocation,
-				 aContentType, &shouldLoad, &fromPrefs);
+                                 aContentType, &shouldLoad, &fromPrefs);
     NS_ENSURE_SUCCESS(rv, rv);
     if (!shouldLoad) {
       if (fromPrefs) {
-	*aDecision = nsIContentPolicy::REJECT_TYPE;
+        *aDecision = nsIContentPolicy::REJECT_TYPE;
       } else {
-	*aDecision = nsIContentPolicy::REJECT_SERVER;
+        *aDecision = nsIContentPolicy::REJECT_SERVER;
       }
     }
     return NS_OK;
diff --git a/gfx/2d/DrawTargetCairo.cpp b/gfx/2d/DrawTargetCairo.cpp
index 09b017b1067d..39d738c79ff7 100644
--- a/gfx/2d/DrawTargetCairo.cpp
+++ b/gfx/2d/DrawTargetCairo.cpp
@@ -151,6 +151,10 @@ GetCairoSurfaceForSourceSurface(SourceSurface *aSurface)
   }
 
   RefPtr<DataSourceSurface> data = aSurface->GetDataSurface();
+  if (!data) {
+    return nullptr;
+  }
+
   cairo_surface_t* surf =
     cairo_image_surface_create_for_data(data->GetData(),
                                         GfxFormatToCairoFormat(data->GetFormat()),
diff --git a/gfx/2d/DrawTargetD2D.cpp b/gfx/2d/DrawTargetD2D.cpp
index d2c511b83299..8c3c6add7cb5 100644
--- a/gfx/2d/DrawTargetD2D.cpp
+++ b/gfx/2d/DrawTargetD2D.cpp
@@ -2090,19 +2090,20 @@ DrawTargetD2D::CreateBrushForPattern(const Pattern &aPattern, Float aAlpha)
         AddDependencyOnSource(surf);
       }
       break;
-    case SURFACE_DATA:
+    default:
       {
-        DataSourceSurface *dataSurf =
-          static_cast<DataSourceSurface*>(pat->mSurface.get());
-        bitmap = CreatePartialBitmapForSurface(dataSurf, mat, pat->mExtendMode);
-        
+        RefPtr<DataSourceSurface> dataSurf = pat->mSurface->GetDataSurface();
+        if (!dataSurf) {
+          gfxWarning() << "Invalid surface type.";
+          return nullptr;
+        }
+
+        bitmap = CreatePartialBitmapForSurface(dataSurf, mat, pat->mExtendMode); 
         if (!bitmap) {
           return nullptr;
         }
       }
       break;
-    default:
-      break;
     }
     
     mRT->CreateBitmapBrush(bitmap,
diff --git a/gfx/layers/FrameMetrics.h b/gfx/layers/FrameMetrics.h
index 96971f567e3c..d5a09bfc8a67 100644
--- a/gfx/layers/FrameMetrics.h
+++ b/gfx/layers/FrameMetrics.h
@@ -36,6 +36,7 @@ public:
     , mScrollId(NULL_SCROLL_ID)
     , mCSSContentRect(0, 0, 0, 0)
     , mResolution(1, 1)
+    , mMayHaveTouchListeners(false)
   {}
 
   // Default copy ctor and operator= are fine
@@ -70,7 +71,7 @@ public:
   // These are all in layer coordinate space.
   nsIntRect mViewport;
   nsIntRect mContentRect;
-  nsIntPoint mViewportScrollOffset;
+  gfx::Point mViewportScrollOffset;
   nsIntRect mDisplayPort;
   ViewID mScrollId;
 
@@ -81,6 +82,9 @@ public:
   // This represents the resolution at which the associated layer
   // will been rendered.
   gfxSize mResolution;
+
+  // Whether or not this frame may have touch listeners.
+  bool mMayHaveTouchListeners;
 };
 
 }
diff --git a/gfx/layers/ImageContainer.cpp b/gfx/layers/ImageContainer.cpp
index 64a8ee4b9db0..587ca1a7d284 100644
--- a/gfx/layers/ImageContainer.cpp
+++ b/gfx/layers/ImageContainer.cpp
@@ -39,6 +39,8 @@ using mozilla::gfx::SourceSurface;
 namespace mozilla {
 namespace layers {
 
+int32_t Image::sSerialCounter = 0;
+
 already_AddRefed<Image>
 ImageFactory::CreateImage(const ImageFormat *aFormats,
                           uint32_t aNumFormats,
diff --git a/gfx/layers/ImageContainer.h b/gfx/layers/ImageContainer.h
index 6beccd05bc96..cf0c1e93e187 100644
--- a/gfx/layers/ImageContainer.h
+++ b/gfx/layers/ImageContainer.h
@@ -80,16 +80,21 @@ public:
   void SetBackendData(LayersBackend aBackend, ImageBackendData* aData)
   { mBackendData[aBackend] = aData; }
 
+  int32_t GetSerial() { return mSerial; }
+
 protected:
   Image(void* aImplData, ImageFormat aFormat) :
     mImplData(aImplData),
+    mSerial(PR_ATOMIC_INCREMENT(&sSerialCounter)),
     mFormat(aFormat)
   {}
 
   nsAutoPtr<ImageBackendData> mBackendData[mozilla::layers::LAYERS_LAST];
 
   void* mImplData;
+  int32_t mSerial;
   ImageFormat mFormat;
+  static int32_t sSerialCounter;
 };
 
 /**
diff --git a/gfx/layers/Layers.cpp b/gfx/layers/Layers.cpp
index 63171f7a1269..2a33ce94f986 100644
--- a/gfx/layers/Layers.cpp
+++ b/gfx/layers/Layers.cpp
@@ -123,6 +123,15 @@ AppendToString(nsACString& s, const nsIntPoint& p,
   return s += sfx;
 }
 
+nsACString&
+AppendToString(nsACString& s, const Point& p,
+               const char* pfx="", const char* sfx="")
+{
+  s += pfx;
+  s += nsPrintfCString("(x=%f, y=%f)", p.x, p.y);
+  return s += sfx;
+}
+
 nsACString&
 AppendToString(nsACString& s, const nsIntRect& r,
                const char* pfx="", const char* sfx="")
diff --git a/gfx/layers/basic/BasicImageLayer.cpp b/gfx/layers/basic/BasicImageLayer.cpp
index 7c476fd670d9..f6d35a0512bb 100644
--- a/gfx/layers/basic/BasicImageLayer.cpp
+++ b/gfx/layers/basic/BasicImageLayer.cpp
@@ -177,7 +177,8 @@ class BasicShadowableImageLayer : public BasicImageLayer,
 public:
   BasicShadowableImageLayer(BasicShadowLayerManager* aManager) :
     BasicImageLayer(aManager),
-    mBufferIsOpaque(false)
+    mBufferIsOpaque(false),
+    mLastPaintedImageSerial(0)
   {
     MOZ_COUNT_CTOR(BasicShadowableImageLayer);
   }
@@ -246,6 +247,7 @@ private:
   SurfaceDescriptor mBackBufferU;
   SurfaceDescriptor mBackBufferV;
   gfxIntSize mCbCrSize;
+  int32_t mLastPaintedImageSerial;
 };
  
 void
@@ -374,6 +376,8 @@ BasicShadowableImageLayer::Paint(gfxContext* aContext, Layer* aMaskLayer)
 
     if (!BasicManager()->AllocBuffer(mSize, type, &mBackBuffer))
       NS_RUNTIMEABORT("creating ImageLayer 'front buffer' failed!");
+  } else if (mLastPaintedImageSerial == image->GetSerial()) {
+    return;
   }
 
   AutoOpenSurface backSurface(OPEN_READ_WRITE, mBackBuffer);
@@ -385,6 +389,7 @@ BasicShadowableImageLayer::Paint(gfxContext* aContext, Layer* aMaskLayer)
 
   BasicManager()->PaintedImage(BasicManager()->Hold(this),
                                mBackBuffer);
+  mLastPaintedImageSerial = image->GetSerial();
 }
 
 class BasicShadowImageLayer : public ShadowImageLayer, public BasicImplData {
diff --git a/gfx/layers/ipc/AsyncPanZoomController.cpp b/gfx/layers/ipc/AsyncPanZoomController.cpp
index d87890be7292..0dd610b3a74d 100644
--- a/gfx/layers/ipc/AsyncPanZoomController.cpp
+++ b/gfx/layers/ipc/AsyncPanZoomController.cpp
@@ -71,9 +71,18 @@ static const double MAX_ZOOM = 8.0;
  */
 static const double MIN_ZOOM = 0.125;
 
+/**
+ * Amount of time before we timeout touch event listeners. For example, if
+ * content is being unruly/slow and we don't get a response back within this
+ * time, we will just pretend that content did not preventDefault any touch
+ * events we dispatched to it.
+ */
+static const int TOUCH_LISTENER_TIMEOUT = 300;
+
 AsyncPanZoomController::AsyncPanZoomController(GeckoContentController* aGeckoContentController,
                                                GestureBehavior aGestures)
   :  mGeckoContentController(aGeckoContentController),
+     mTouchListenerTimeoutTask(nullptr),
      mX(this),
      mY(this),
      mMonitor("AsyncPanZoomController"),
@@ -81,8 +90,8 @@ AsyncPanZoomController::AsyncPanZoomController(GeckoContentController* aGeckoCon
      mState(NOTHING),
      mDPI(72),
      mContentPainterStatus(CONTENT_IDLE),
-     mMayHaveTouchListeners(false),
-     mDisableNextTouchBatch(false)
+     mDisableNextTouchBatch(false),
+     mHandlingTouchQueue(false)
 {
   if (aGestures == USE_GESTURE_DETECTOR) {
     mGestureEventListener = new GestureEventListener(this);
@@ -121,8 +130,8 @@ WidgetSpaceToCompensatedViewportSpace(const gfx::Point& aPoint,
 }
 
 nsEventStatus
-AsyncPanZoomController::HandleInputEvent(const nsInputEvent& aEvent,
-                                         nsInputEvent* aOutEvent)
+AsyncPanZoomController::ReceiveInputEvent(const nsInputEvent& aEvent,
+                                          nsInputEvent* aOutEvent)
 {
   float currentZoom;
   gfx::Point currentScrollOffset, lastScrollOffset;
@@ -139,12 +148,12 @@ AsyncPanZoomController::HandleInputEvent(const nsInputEvent& aEvent,
   switch (aEvent.eventStructType) {
   case NS_TOUCH_EVENT: {
     MultiTouchInput event(static_cast<const nsTouchEvent&>(aEvent));
-    status = HandleInputEvent(event);
+    status = ReceiveInputEvent(event);
     break;
   }
   case NS_MOUSE_EVENT: {
     MultiTouchInput event(static_cast<const nsMouseEvent&>(aEvent));
-    status = HandleInputEvent(event);
+    status = ReceiveInputEvent(event);
     break;
   }
   default:
@@ -179,11 +188,47 @@ AsyncPanZoomController::HandleInputEvent(const nsInputEvent& aEvent,
   return status;
 }
 
+nsEventStatus AsyncPanZoomController::ReceiveInputEvent(const InputData& aEvent) {
+  // If we may have touch listeners, we enable the machinery that allows touch
+  // listeners to preventDefault any touch inputs. This should not happen unless
+  // there are actually touch listeners as it introduces potentially unbounded
+  // lag because it causes a round-trip through content.  Usually, if content is
+  // responding in a timely fashion, this only introduces a nearly constant few
+  // hundred ms of lag.
+  if (mFrameMetrics.mMayHaveTouchListeners && aEvent.mInputType == MULTITOUCH_INPUT &&
+      (mState == NOTHING || mState == TOUCHING || mState == PANNING)) {
+    const MultiTouchInput& multiTouchInput = aEvent.AsMultiTouchInput();
+    if (multiTouchInput.mType == MultiTouchInput::MULTITOUCH_START) {
+      SetState(WAITING_LISTENERS);
+    }
+  }
+
+  if (mState == WAITING_LISTENERS || mHandlingTouchQueue) {
+    if (aEvent.mInputType == MULTITOUCH_INPUT) {
+      const MultiTouchInput& multiTouchInput = aEvent.AsMultiTouchInput();
+      mTouchQueue.AppendElement(multiTouchInput);
+
+      if (!mTouchListenerTimeoutTask) {
+        mTouchListenerTimeoutTask =
+          NewRunnableMethod(this, &AsyncPanZoomController::TimeoutTouchListeners);
+
+        MessageLoop::current()->PostDelayedTask(
+          FROM_HERE,
+          mTouchListenerTimeoutTask,
+          TOUCH_LISTENER_TIMEOUT);
+      }
+    }
+    return nsEventStatus_eConsumeNoDefault;
+  }
+
+  return HandleInputEvent(aEvent);
+}
+
 nsEventStatus AsyncPanZoomController::HandleInputEvent(const InputData& aEvent) {
   nsEventStatus rv = nsEventStatus_eIgnore;
 
   if (mGestureEventListener && !mDisableNextTouchBatch) {
-    nsEventStatus rv = mGestureEventListener->HandleInputEvent(aEvent);
+    rv = mGestureEventListener->HandleInputEvent(aEvent);
     if (rv == nsEventStatus_eConsumeNoDefault)
       return rv;
   }
@@ -253,6 +298,7 @@ nsEventStatus AsyncPanZoomController::OnTouchStart(const MultiTouchInput& aEvent
     case TOUCHING:
     case PANNING:
     case PINCHING:
+    case WAITING_LISTENERS:
       NS_WARNING("Received impossible touch in OnTouchStart");
       break;
     default:
@@ -297,6 +343,10 @@ nsEventStatus AsyncPanZoomController::OnTouchMove(const MultiTouchInput& aEvent)
       // The scale gesture listener should have handled this.
       NS_WARNING("Gesture listener should have handled pinching in OnTouchMove.");
       return nsEventStatus_eIgnore;
+
+    case WAITING_LISTENERS:
+      NS_WARNING("Received impossible touch in OnTouchMove");
+      break;
   }
 
   return nsEventStatus_eConsumeNoDefault;
@@ -333,11 +383,16 @@ nsEventStatus AsyncPanZoomController::OnTouchEnd(const MultiTouchInput& aEvent)
     mY.EndTouch();
     SetState(FLING);
     return nsEventStatus_eConsumeNoDefault;
+
   case PINCHING:
     SetState(NOTHING);
     // Scale gesture listener should have handled this.
     NS_WARNING("Gesture listener should have handled pinching in OnTouchEnd.");
     return nsEventStatus_eIgnore;
+
+  case WAITING_LISTENERS:
+    NS_WARNING("Received impossible touch in OnTouchEnd");
+    break;
   }
 
   return nsEventStatus_eConsumeNoDefault;
@@ -370,7 +425,7 @@ nsEventStatus AsyncPanZoomController::OnScale(const PinchGestureInput& aEvent) {
     float scale = mFrameMetrics.mResolution.width;
 
     nsIntPoint focusPoint = aEvent.mFocusPoint;
-    int32_t xFocusChange = (mLastZoomFocus.x - focusPoint.x) / scale, yFocusChange = (mLastZoomFocus.y - focusPoint.y) / scale;
+    float xFocusChange = (mLastZoomFocus.x - focusPoint.x) / scale, yFocusChange = (mLastZoomFocus.y - focusPoint.y) / scale;
     // If displacing by the change in focus point will take us off page bounds,
     // then reduce the displacement such that it doesn't.
     if (mX.DisplacementWillOverscroll(xFocusChange) != Axis::OVERSCROLL_NONE) {
@@ -379,12 +434,12 @@ nsEventStatus AsyncPanZoomController::OnScale(const PinchGestureInput& aEvent) {
     if (mY.DisplacementWillOverscroll(yFocusChange) != Axis::OVERSCROLL_NONE) {
       yFocusChange -= mY.DisplacementWillOverscrollAmount(yFocusChange);
     }
-    ScrollBy(nsIntPoint(xFocusChange, yFocusChange));
+    ScrollBy(gfx::Point(xFocusChange, yFocusChange));
 
     // When we zoom in with focus, we can zoom too much towards the boundaries
     // that we actually go over them. These are the needed displacements along
     // either axis such that we don't overscroll the boundaries when zooming.
-    int32_t neededDisplacementX = 0, neededDisplacementY = 0;
+    float neededDisplacementX = 0, neededDisplacementY = 0;
 
     // Only do the scaling if we won't go over 8x zoom in or out.
     bool doScale = (scale < MAX_ZOOM && spanRatio > 1.0f) || (scale > MIN_ZOOM && spanRatio < 1.0f);
@@ -436,7 +491,7 @@ nsEventStatus AsyncPanZoomController::OnScale(const PinchGestureInput& aEvent) {
                      focusPoint);
 
       if (neededDisplacementX != 0 || neededDisplacementY != 0) {
-        ScrollBy(nsIntPoint(neededDisplacementX, neededDisplacementY));
+        ScrollBy(gfx::Point(neededDisplacementX, neededDisplacementY));
       }
 
       ScheduleComposite();
@@ -559,7 +614,7 @@ void AsyncPanZoomController::TrackTouch(const MultiTouchInput& aEvent) {
       return;
     }
 
-    ScrollBy(nsIntPoint(xDisplacement, yDisplacement));
+    ScrollBy(gfx::Point(xDisplacement, yDisplacement));
     ScheduleComposite();
 
     RequestContentRepaint();
@@ -588,7 +643,7 @@ bool AsyncPanZoomController::DoFling(const TimeDuration& aDelta) {
   // larger swipe should move you a shorter distance.
   float inverseScale = 1 / mFrameMetrics.mResolution.width;
 
-  ScrollBy(nsIntPoint(
+  ScrollBy(gfx::Point(
     mX.GetDisplacementForDuration(inverseScale, aDelta),
     mY.GetDisplacementForDuration(inverseScale, aDelta)
   ));
@@ -605,8 +660,8 @@ void AsyncPanZoomController::SetCompositorParent(CompositorParent* aCompositorPa
   mCompositorParent = aCompositorParent;
 }
 
-void AsyncPanZoomController::ScrollBy(const nsIntPoint& aOffset) {
-  nsIntPoint newOffset(mFrameMetrics.mViewportScrollOffset.x + aOffset.x,
+void AsyncPanZoomController::ScrollBy(const gfx::Point& aOffset) {
+  gfx::Point newOffset(mFrameMetrics.mViewportScrollOffset.x + aOffset.x,
                        mFrameMetrics.mViewportScrollOffset.y + aOffset.y);
   FrameMetrics metrics(mFrameMetrics);
   metrics.mViewportScrollOffset = newOffset;
@@ -642,10 +697,10 @@ void AsyncPanZoomController::ScaleWithFocus(float aScale, const nsIntPoint& aFoc
   // current CSS page rect (which is unchanged since it's not affected by zoom).
   SetPageRect(mFrameMetrics.mCSSContentRect);
 
-  nsIntPoint scrollOffset = metrics.mViewportScrollOffset;
+  gfx::Point scrollOffset = metrics.mViewportScrollOffset;
 
-  scrollOffset.x += NS_lround(float(aFocus.x) * (scaleFactor - 1.0f) / oldScale);
-  scrollOffset.y += NS_lround(float(aFocus.y) * (scaleFactor - 1.0f) / oldScale);
+  scrollOffset.x += float(aFocus.x) * (scaleFactor - 1.0f) / oldScale;
+  scrollOffset.y += float(aFocus.y) * (scaleFactor - 1.0f) / oldScale;
 
   metrics.mViewportScrollOffset = scrollOffset;
 
@@ -674,7 +729,7 @@ const nsIntRect AsyncPanZoomController::CalculatePendingDisplayPort() {
   nsIntRect viewport = mFrameMetrics.mViewport;
   viewport.ScaleRoundIn(1 / scale);
 
-  nsIntPoint scrollOffset = mFrameMetrics.mViewportScrollOffset;
+  gfx::Point scrollOffset = mFrameMetrics.mViewportScrollOffset;
   gfx::Point velocity = GetVelocityVector();
 
   // The displayport is relative to the current scroll offset. Here's a little
@@ -751,14 +806,30 @@ void AsyncPanZoomController::ScheduleComposite() {
 void AsyncPanZoomController::RequestContentRepaint() {
   mFrameMetrics.mDisplayPort = CalculatePendingDisplayPort();
 
+  gfx::Point oldScrollOffset = mLastPaintRequestMetrics.mViewportScrollOffset,
+             newScrollOffset = mFrameMetrics.mViewportScrollOffset;
+
   // If we're trying to paint what we already think is painted, discard this
   // request since it's a pointless paint.
-  nsIntRect oldDisplayPort = mLastPaintRequestMetrics.mDisplayPort,
-            newDisplayPort = mFrameMetrics.mDisplayPort;
-  oldDisplayPort.MoveBy(mLastPaintRequestMetrics.mViewportScrollOffset);
-  newDisplayPort.MoveBy(mFrameMetrics.mViewportScrollOffset);
+  nsRect oldDisplayPort = nsRect(
+    mLastPaintRequestMetrics.mDisplayPort.x,
+    mLastPaintRequestMetrics.mDisplayPort.y,
+    mLastPaintRequestMetrics.mDisplayPort.width,
+    mLastPaintRequestMetrics.mDisplayPort.height);
 
-  if (oldDisplayPort.IsEqualEdges(newDisplayPort) &&
+  gfx::Rect newDisplayPort = gfx::Rect(
+    mFrameMetrics.mDisplayPort.x,
+    mFrameMetrics.mDisplayPort.y,
+    mFrameMetrics.mDisplayPort.width,
+    mFrameMetrics.mDisplayPort.height);
+
+  oldDisplayPort.MoveBy(oldScrollOffset.x, oldScrollOffset.y);
+  newDisplayPort.MoveBy(newScrollOffset.x, newScrollOffset.y);
+
+  if (fabsf(oldDisplayPort.x - newDisplayPort.x) < EPSILON &&
+      fabsf(oldDisplayPort.y - newDisplayPort.y) < EPSILON &&
+      fabsf(oldDisplayPort.width - newDisplayPort.width) < EPSILON &&
+      fabsf(oldDisplayPort.height - newDisplayPort.height) < EPSILON &&
       mFrameMetrics.mResolution.width == mLastPaintRequestMetrics.mResolution.width) {
     return;
   }
@@ -788,8 +859,8 @@ bool AsyncPanZoomController::SampleContentTransformForFrame(const TimeStamp& aSa
   float rootScaleX = currentTransform.GetXScale(),
         rootScaleY = currentTransform.GetYScale();
 
-  nsIntPoint metricsScrollOffset(0, 0);
-  nsIntPoint scrollOffset;
+  gfx::Point metricsScrollOffset(0, 0);
+  gfx::Point scrollOffset;
   float localScaleX, localScaleY;
   const FrameMetrics& frame = aLayer->GetFrameMetrics();
   {
@@ -813,7 +884,7 @@ bool AsyncPanZoomController::SampleContentTransformForFrame(const TimeStamp& aSa
         mEndZoomToMetrics.mResolution.width * sampledPosition +
           mStartZoomToMetrics.mResolution.width * (1 - sampledPosition);
 
-      mFrameMetrics.mViewportScrollOffset = nsIntPoint(
+      mFrameMetrics.mViewportScrollOffset = gfx::Point(
         mEndZoomToMetrics.mViewportScrollOffset.x * sampledPosition +
           mStartZoomToMetrics.mViewportScrollOffset.x * (1 - sampledPosition),
         mEndZoomToMetrics.mViewportScrollOffset.y * sampledPosition +
@@ -848,8 +919,8 @@ bool AsyncPanZoomController::SampleContentTransformForFrame(const TimeStamp& aSa
   }
 
   nsIntPoint scrollCompensation(
-    (scrollOffset.x / rootScaleX - metricsScrollOffset.x) * localScaleX,
-    (scrollOffset.y / rootScaleY - metricsScrollOffset.y) * localScaleY);
+    NS_lround((scrollOffset.x / rootScaleX - metricsScrollOffset.x) * localScaleX),
+    NS_lround((scrollOffset.y / rootScaleY - metricsScrollOffset.y) * localScaleY));
 
   ViewTransform treeTransform(-scrollCompensation, localScaleX, localScaleY);
   *aNewTransform = gfx3DMatrix(treeTransform) * currentTransform;
@@ -897,10 +968,6 @@ void AsyncPanZoomController::NotifyLayersUpdated(const FrameMetrics& aViewportFr
     // we get a larger displayport. This is very bad because we're wasting a
     // paint and not initializating the displayport correctly.
     RequestContentRepaint();
-
-    // Assuming a first paint means a new page has been loaded, clear the flag
-    // indicating that we may have touch listeners.
-    mMayHaveTouchListeners = false;
   } else if (!mFrameMetrics.mCSSContentRect.IsEqualEdges(aViewportFrame.mCSSContentRect)) {
     mFrameMetrics.mCSSContentRect = aViewportFrame.mCSSContentRect;
     SetPageRect(mFrameMetrics.mCSSContentRect);
@@ -919,10 +986,6 @@ void AsyncPanZoomController::UpdateViewportSize(int aWidth, int aHeight) {
   mFrameMetrics = metrics;
 }
 
-void AsyncPanZoomController::NotifyDOMTouchListenerAdded() {
-  mMayHaveTouchListeners = true;
-}
-
 void AsyncPanZoomController::CancelDefaultPanZoom() {
   mDisableNextTouchBatch = true;
   if (mGestureEventListener) {
@@ -932,7 +995,6 @@ void AsyncPanZoomController::CancelDefaultPanZoom() {
 
 void AsyncPanZoomController::ZoomToRect(const gfxRect& aRect) {
   gfx::Rect zoomToRect(gfx::Rect(aRect.x, aRect.y, aRect.width, aRect.height));
-  gfx::Rect cssPageRect = mFrameMetrics.mCSSContentRect;
 
   SetState(ANIMATING_ZOOM);
 
@@ -940,13 +1002,15 @@ void AsyncPanZoomController::ZoomToRect(const gfxRect& aRect) {
     MonitorAutoLock mon(mMonitor);
 
     nsIntRect viewport = mFrameMetrics.mViewport;
+    gfx::Rect cssPageRect = mFrameMetrics.mCSSContentRect;
+    gfx::Point scrollOffset = mFrameMetrics.mViewportScrollOffset;
 
     // If the rect is empty, treat it as a request to zoom out to the full page
     // size.
     if (zoomToRect.IsEmpty()) {
       nsIntRect cssViewport = viewport;
       cssViewport.ScaleRoundIn(1 / mFrameMetrics.mResolution.width);
-      cssViewport.MoveBy(mFrameMetrics.mViewportScrollOffset);
+      cssViewport.MoveBy(nsIntPoint(NS_lround(scrollOffset.x), NS_lround(scrollOffset.y)));
 
       float y = mFrameMetrics.mViewportScrollOffset.y;
       float newHeight = cssViewport.height * cssPageRect.width / cssViewport.width;
@@ -996,7 +1060,7 @@ void AsyncPanZoomController::ZoomToRect(const gfxRect& aRect) {
 
     mStartZoomToMetrics = mFrameMetrics;
     mEndZoomToMetrics.mViewportScrollOffset =
-      nsIntPoint(NS_lround(zoomToRect.x), NS_lround(zoomToRect.y));
+      gfx::Point(zoomToRect.x, zoomToRect.y);
 
     mAnimationStartTime = TimeStamp::Now();
 
@@ -1004,10 +1068,50 @@ void AsyncPanZoomController::ZoomToRect(const gfxRect& aRect) {
   }
 }
 
+void AsyncPanZoomController::ContentReceivedTouch(bool aPreventDefault) {
+  if (!mFrameMetrics.mMayHaveTouchListeners) {
+    mTouchQueue.Clear();
+    return;
+  }
+
+  if (mTouchListenerTimeoutTask) {
+    mTouchListenerTimeoutTask->Cancel();
+    mTouchListenerTimeoutTask = nullptr;
+  }
+
+  if (mState == WAITING_LISTENERS) {
+    if (!aPreventDefault) {
+      SetState(NOTHING);
+    }
+
+    mHandlingTouchQueue = true;
+
+    while (!mTouchQueue.IsEmpty()) {
+      if (!aPreventDefault) {
+        HandleInputEvent(mTouchQueue[0]);
+      }
+
+      if (mTouchQueue[0].mType == MultiTouchInput::MULTITOUCH_END ||
+          mTouchQueue[0].mType == MultiTouchInput::MULTITOUCH_CANCEL) {
+        mTouchQueue.RemoveElementAt(0);
+        break;
+      }
+
+      mTouchQueue.RemoveElementAt(0);
+    }
+
+    mHandlingTouchQueue = false;
+  }
+}
+
 void AsyncPanZoomController::SetState(PanZoomState aState) {
   MonitorAutoLock monitor(mMonitor);
   mState = aState;
 }
 
+void AsyncPanZoomController::TimeoutTouchListeners() {
+  ContentReceivedTouch(false);
+}
+
 }
 }
diff --git a/gfx/layers/ipc/AsyncPanZoomController.h b/gfx/layers/ipc/AsyncPanZoomController.h
index 2d2724845e2c..ab130771deb2 100644
--- a/gfx/layers/ipc/AsyncPanZoomController.h
+++ b/gfx/layers/ipc/AsyncPanZoomController.h
@@ -15,6 +15,8 @@
 #include "InputData.h"
 #include "Axis.h"
 
+#include "base/message_loop.h"
+
 namespace mozilla {
 namespace layers {
 
@@ -76,10 +78,10 @@ public:
   /**
    * General handler for incoming input events. Manipulates the frame metrics
    * basde on what type of input it is. For example, a PinchGestureEvent will
-   * cause scaling.
+   * cause scaling. This should only be called externally to this class.
+   * HandleInputEvent() should be used internally.
    */
-
-  nsEventStatus HandleInputEvent(const InputData& aEvent);
+  nsEventStatus ReceiveInputEvent(const InputData& aEvent);
 
   /**
    * Special handler for nsInputEvents. Also sets |aOutEvent| (which is assumed
@@ -91,8 +93,8 @@ public:
    * called on the main thread. See widget/InputData.h for more information on
    * why we have InputData and nsInputEvent separated.
    */
-  nsEventStatus HandleInputEvent(const nsInputEvent& aEvent,
-                                 nsInputEvent* aOutEvent);
+  nsEventStatus ReceiveInputEvent(const nsInputEvent& aEvent,
+                                  nsInputEvent* aOutEvent);
 
   /**
    * Updates the viewport size, i.e. the dimensions of the frame (not
@@ -107,16 +109,6 @@ public:
    */
   void UpdateViewportSize(int aWidth, int aHeight);
 
-  /**
-   * A DOM touch listener has been added. When called, we enable the machinery
-   * that allows touch listeners to preventDefault any touch inputs. This should
-   * not be called unless there are actually touch listeners as it introduces
-   * potentially unbounded lag because it causes a round-trip through content.
-   * Usually, if content is responding in a timely fashion, this only introduces
-   * a nearly constant few hundred ms of lag.
-   */
-  void NotifyDOMTouchListenerAdded();
-
   /**
    * We have found a scrollable subframe, so disable our machinery until we hit
    * a touch end or a new touch start. This prevents us from accidentally
@@ -134,6 +126,14 @@ public:
    */
   void ZoomToRect(const gfxRect& aRect);
 
+  /**
+   * If we have touch listeners, this should always be called when we know
+   * definitively whether or not content has preventDefaulted any touch events
+   * that have come in. If |aPreventDefault| is true, any touch events in the
+   * queue will be discarded.
+   */
+  void ContentReceivedTouch(bool aPreventDefault);
+
   // --------------------------------------------------------------------------
   // These methods must only be called on the compositor thread.
   //
@@ -194,6 +194,11 @@ public:
   int GetDPI();
 
 protected:
+  /**
+   * Internal handler for ReceiveInputEvent(). Does all the actual work.
+   */
+  nsEventStatus HandleInputEvent(const InputData& aEvent);
+
   /**
    * Helper method for touches beginning. Sets everything up for panning and any
    * multitouch gestures.
@@ -275,7 +280,7 @@ protected:
   /**
    * Scrolls the viewport by an X,Y offset.
    */
-  void ScrollBy(const nsIntPoint& aOffset);
+  void ScrollBy(const gfx::Point& aOffset);
 
   /**
    * Scales the viewport by an amount (note that it multiplies this scale in to
@@ -382,6 +387,15 @@ protected:
    */
   const FrameMetrics& GetFrameMetrics();
 
+  /**
+   * Timeout function for touch listeners. This should be called on a timer
+   * after we get our first touch event in a batch, under the condition that we
+   * have touch listeners. If a notification comes indicating whether or not
+   * content preventDefaulted a series of touch events before the timeout, the
+   * timeout should be cancelled.
+   */
+  void TimeoutTouchListeners();
+
 private:
   enum PanZoomState {
     NOTHING,        /* no touch-start events received */
@@ -389,7 +403,10 @@ private:
     TOUCHING,       /* one touch-start event received */
     PANNING,        /* panning without axis lock */
     PINCHING,       /* nth touch-start, where n > 1. this mode allows pan and zoom */
-    ANIMATING_ZOOM  /* animated zoom to a new rect */
+    ANIMATING_ZOOM, /* animated zoom to a new rect */
+    WAITING_LISTENERS, /* a state halfway between NOTHING and TOUCHING - the user has
+                    put a finger down, but we don't yet know if a touch listener has
+                    prevented the default actions yet. we still need to abort animations. */
   };
 
   enum ContentPainterStatus {
@@ -443,6 +460,10 @@ private:
   // |mResolution| fields on this.
   FrameMetrics mEndZoomToMetrics;
 
+  nsTArray<MultiTouchInput> mTouchQueue;
+
+  CancelableTask* mTouchListenerTimeoutTask;
+
   AxisX mX;
   AxisY mY;
 
@@ -478,14 +499,16 @@ private:
   // requests a repaint.
   ContentPainterStatus mContentPainterStatus;
 
-  // Whether or not we might have touch listeners. This is a conservative
-  // approximation and may not be accurate.
-  bool mMayHaveTouchListeners;
-
   // Flag used to determine whether or not we should disable handling of the
   // next batch of touch events. This is used for sync scrolling of subframes.
   bool mDisableNextTouchBatch;
 
+  // Flag used to determine whether or not we should try to enter the
+  // WAITING_LISTENERS state. This is used in the case that we are processing a
+  // queued up event block. If set, this means that we are handling this queue
+  // and we don't want to queue the events back up again.
+  bool mHandlingTouchQueue;
+
   friend class Axis;
 };
 
diff --git a/gfx/layers/ipc/Axis.cpp b/gfx/layers/ipc/Axis.cpp
index 8da7c3000608..9046998f63df 100644
--- a/gfx/layers/ipc/Axis.cpp
+++ b/gfx/layers/ipc/Axis.cpp
@@ -23,13 +23,13 @@ static const float MAX_EVENT_ACCELERATION = 0.5f;
 /**
  * Amount of friction applied during flings.
  */
-static const float FLING_FRICTION = 0.013f;
+static const float FLING_FRICTION = 0.007f;
 
 /**
  * Threshold for velocity beneath which we turn off any acceleration we had
  * during repeated flings.
  */
-static const float VELOCITY_THRESHOLD = 0.1f;
+static const float VELOCITY_THRESHOLD = 0.14f;
 
 /**
  * Amount of acceleration we multiply in each time the user flings in one
@@ -94,10 +94,10 @@ void Axis::StartTouch(int32_t aPos) {
   mLockPanning = false;
 }
 
-int32_t Axis::GetDisplacementForDuration(float aScale, const TimeDuration& aDelta) {
+float Axis::GetDisplacementForDuration(float aScale, const TimeDuration& aDelta) {
   float velocityFactor = powf(ACCELERATION_MULTIPLIER,
                               NS_MAX(0, (mAcceleration - 4) * 3));
-  int32_t displacement = NS_lround(mVelocity * aScale * aDelta.ToMilliseconds() * velocityFactor);
+  float displacement = mVelocity * aScale * aDelta.ToMilliseconds() * velocityFactor;
   // If this displacement will cause an overscroll, throttle it. Can potentially
   // bring it to 0 even if the velocity is high.
   if (DisplacementWillOverscroll(displacement) != OVERSCROLL_NONE) {
@@ -158,7 +158,7 @@ Axis::Overscroll Axis::GetOverscroll() {
   return OVERSCROLL_NONE;
 }
 
-int32_t Axis::GetExcess() {
+float Axis::GetExcess() {
   switch (GetOverscroll()) {
   case OVERSCROLL_MINUS: return GetOrigin() - GetPageStart();
   case OVERSCROLL_PLUS: return GetViewportEnd() - GetPageEnd();
@@ -186,7 +186,7 @@ Axis::Overscroll Axis::DisplacementWillOverscroll(int32_t aDisplacement) {
   return OVERSCROLL_NONE;
 }
 
-int32_t Axis::DisplacementWillOverscrollAmount(int32_t aDisplacement) {
+float Axis::DisplacementWillOverscrollAmount(int32_t aDisplacement) {
   switch (DisplacementWillOverscroll(aDisplacement)) {
   case OVERSCROLL_MINUS: return (GetOrigin() + aDisplacement) - GetPageStart();
   case OVERSCROLL_PLUS: return (GetViewportEnd() + aDisplacement) - GetPageEnd();
@@ -197,11 +197,11 @@ int32_t Axis::DisplacementWillOverscrollAmount(int32_t aDisplacement) {
 }
 
 Axis::Overscroll Axis::ScaleWillOverscroll(float aScale, int32_t aFocus) {
-  int32_t originAfterScale = NS_lround((GetOrigin() + aFocus) * aScale - aFocus);
+  float originAfterScale = (GetOrigin() + aFocus) * aScale - aFocus;
 
   bool both = ScaleWillOverscrollBothSides(aScale);
-  bool minus = originAfterScale < NS_lround(GetPageStart() * aScale);
-  bool plus = (originAfterScale + GetViewportLength()) > NS_lround(GetPageEnd() * aScale);
+  bool minus = originAfterScale < GetPageStart() * aScale;
+  bool plus = (originAfterScale + GetViewportLength()) > GetPageEnd() * aScale;
 
   if ((minus && plus) || both) {
     return OVERSCROLL_BOTH;
@@ -215,11 +215,11 @@ Axis::Overscroll Axis::ScaleWillOverscroll(float aScale, int32_t aFocus) {
   return OVERSCROLL_NONE;
 }
 
-int32_t Axis::ScaleWillOverscrollAmount(float aScale, int32_t aFocus) {
-  int32_t originAfterScale = NS_lround((GetOrigin() + aFocus) * aScale - aFocus);
+float Axis::ScaleWillOverscrollAmount(float aScale, int32_t aFocus) {
+  float originAfterScale = (GetOrigin() + aFocus) * aScale - aFocus;
   switch (ScaleWillOverscroll(aScale, aFocus)) {
-  case OVERSCROLL_MINUS: return originAfterScale - NS_lround(GetPageStart() * aScale);
-  case OVERSCROLL_PLUS: return (originAfterScale + GetViewportLength()) - NS_lround(GetPageEnd() * aScale);
+  case OVERSCROLL_MINUS: return originAfterScale - GetPageStart() * aScale;
+  case OVERSCROLL_PLUS: return (originAfterScale + GetViewportLength()) - GetPageEnd() * aScale;
   // Don't handle OVERSCROLL_BOTH. Client code is expected to deal with it.
   default: return 0;
   }
@@ -229,32 +229,32 @@ float Axis::GetVelocity() {
   return mVelocity;
 }
 
-int32_t Axis::GetViewportEnd() {
+float Axis::GetViewportEnd() {
   return GetOrigin() + GetViewportLength();
 }
 
-int32_t Axis::GetPageEnd() {
+float Axis::GetPageEnd() {
   return GetPageStart() + GetPageLength();
 }
 
-int32_t Axis::GetOrigin() {
-  nsIntPoint origin = mAsyncPanZoomController->GetFrameMetrics().mViewportScrollOffset;
+float Axis::GetOrigin() {
+  gfx::Point origin = mAsyncPanZoomController->GetFrameMetrics().mViewportScrollOffset;
   return GetPointOffset(origin);
 }
 
-int32_t Axis::GetViewportLength() {
+float Axis::GetViewportLength() {
   nsIntRect viewport = mAsyncPanZoomController->GetFrameMetrics().mViewport;
   gfx::Rect scaledViewport = gfx::Rect(viewport.x, viewport.y, viewport.width, viewport.height);
   scaledViewport.ScaleRoundIn(1 / mAsyncPanZoomController->GetFrameMetrics().mResolution.width);
   return GetRectLength(scaledViewport);
 }
 
-int32_t Axis::GetPageStart() {
+float Axis::GetPageStart() {
   gfx::Rect pageRect = mAsyncPanZoomController->GetFrameMetrics().mCSSContentRect;
   return GetRectOffset(pageRect);
 }
 
-int32_t Axis::GetPageLength() {
+float Axis::GetPageLength() {
   gfx::Rect pageRect = mAsyncPanZoomController->GetFrameMetrics().mCSSContentRect;
   return GetRectLength(pageRect);
 }
@@ -280,19 +280,19 @@ AxisX::AxisX(AsyncPanZoomController* aAsyncPanZoomController)
 
 }
 
-int32_t AxisX::GetPointOffset(const nsIntPoint& aPoint)
+float AxisX::GetPointOffset(const gfx::Point& aPoint)
 {
   return aPoint.x;
 }
 
-int32_t AxisX::GetRectLength(const gfx::Rect& aRect)
+float AxisX::GetRectLength(const gfx::Rect& aRect)
 {
-  return NS_lround(aRect.width);
+  return aRect.width;
 }
 
-int32_t AxisX::GetRectOffset(const gfx::Rect& aRect)
+float AxisX::GetRectOffset(const gfx::Rect& aRect)
 {
-  return NS_lround(aRect.x);
+  return aRect.x;
 }
 
 AxisY::AxisY(AsyncPanZoomController* aAsyncPanZoomController)
@@ -301,19 +301,19 @@ AxisY::AxisY(AsyncPanZoomController* aAsyncPanZoomController)
 
 }
 
-int32_t AxisY::GetPointOffset(const nsIntPoint& aPoint)
+float AxisY::GetPointOffset(const gfx::Point& aPoint)
 {
   return aPoint.y;
 }
 
-int32_t AxisY::GetRectLength(const gfx::Rect& aRect)
+float AxisY::GetRectLength(const gfx::Rect& aRect)
 {
-  return NS_lround(aRect.height);
+  return aRect.height;
 }
 
-int32_t AxisY::GetRectOffset(const gfx::Rect& aRect)
+float AxisY::GetRectOffset(const gfx::Rect& aRect)
 {
-  return NS_lround(aRect.y);
+  return aRect.y;
 }
 
 }
diff --git a/gfx/layers/ipc/Axis.h b/gfx/layers/ipc/Axis.h
index b23c099d3d42..9a9cbe32383b 100644
--- a/gfx/layers/ipc/Axis.h
+++ b/gfx/layers/ipc/Axis.h
@@ -84,7 +84,7 @@ public:
    * apply a displacement that takes you to the boundary of the page, then call
    * it again. The result will be different in this case.
    */
-  int32_t GetDisplacementForDuration(float aScale, const TimeDuration& aDelta);
+  float GetDisplacementForDuration(float aScale, const TimeDuration& aDelta);
 
   /**
    * Gets the distance between the starting position of the touch supplied in
@@ -114,7 +114,7 @@ public:
    * in both directions, this returns 0; it assumes that you check
    * GetOverscroll() first.
    */
-  int32_t GetExcess();
+  float GetExcess();
 
   /**
    * Gets the raw velocity of this axis at this moment.
@@ -132,7 +132,7 @@ public:
    * If a displacement will overscroll the axis, this returns the amount and in
    * what direction. Similar to getExcess() but takes a displacement to apply.
    */
-  int32_t DisplacementWillOverscrollAmount(int32_t aDisplacement);
+  float DisplacementWillOverscrollAmount(int32_t aDisplacement);
 
   /**
    * Gets the overscroll state of the axis given a scaling of the page. That is
@@ -153,7 +153,7 @@ public:
    * scroll offset in such a way that it remains in the same place on the page
    * relative.
    */
-  int32_t ScaleWillOverscrollAmount(float aScale, int32_t aFocus);
+  float ScaleWillOverscrollAmount(float aScale, int32_t aFocus);
 
   /**
    * Checks if an axis will overscroll in both directions by computing the
@@ -164,16 +164,16 @@ public:
    */
   bool ScaleWillOverscrollBothSides(float aScale);
 
-  int32_t GetOrigin();
-  int32_t GetViewportLength();
-  int32_t GetPageStart();
-  int32_t GetPageLength();
-  int32_t GetViewportEnd();
-  int32_t GetPageEnd();
+  float GetOrigin();
+  float GetViewportLength();
+  float GetPageStart();
+  float GetPageLength();
+  float GetViewportEnd();
+  float GetPageEnd();
 
-  virtual int32_t GetPointOffset(const nsIntPoint& aPoint) = 0;
-  virtual int32_t GetRectLength(const gfx::Rect& aRect) = 0;
-  virtual int32_t GetRectOffset(const gfx::Rect& aRect) = 0;
+  virtual float GetPointOffset(const gfx::Point& aPoint) = 0;
+  virtual float GetRectLength(const gfx::Rect& aRect) = 0;
+  virtual float GetRectOffset(const gfx::Rect& aRect) = 0;
 
 protected:
   int32_t mPos;
@@ -192,17 +192,17 @@ protected:
 class AxisX : public Axis {
 public:
   AxisX(AsyncPanZoomController* mAsyncPanZoomController);
-  virtual int32_t GetPointOffset(const nsIntPoint& aPoint);
-  virtual int32_t GetRectLength(const gfx::Rect& aRect);
-  virtual int32_t GetRectOffset(const gfx::Rect& aRect);
+  virtual float GetPointOffset(const gfx::Point& aPoint);
+  virtual float GetRectLength(const gfx::Rect& aRect);
+  virtual float GetRectOffset(const gfx::Rect& aRect);
 };
 
 class AxisY : public Axis {
 public:
   AxisY(AsyncPanZoomController* mAsyncPanZoomController);
-  virtual int32_t GetPointOffset(const nsIntPoint& aPoint);
-  virtual int32_t GetRectLength(const gfx::Rect& aRect);
-  virtual int32_t GetRectOffset(const gfx::Rect& aRect);
+  virtual float GetPointOffset(const gfx::Point& aPoint);
+  virtual float GetRectLength(const gfx::Rect& aRect);
+  virtual float GetRectOffset(const gfx::Rect& aRect);
 };
 
 }
diff --git a/gfx/layers/ipc/CompositorParent.cpp b/gfx/layers/ipc/CompositorParent.cpp
index 82d4ea323f34..c705d1132c37 100644
--- a/gfx/layers/ipc/CompositorParent.cpp
+++ b/gfx/layers/ipc/CompositorParent.cpp
@@ -761,7 +761,9 @@ CompositorParent::TransformShadowTree(TimeStamp aCurrentFrame)
 
     if (mIsFirstPaint) {
       mContentRect = metrics.mContentRect;
-      SetFirstPaintViewport(metrics.mViewportScrollOffset,
+      const gfx::Point& scrollOffset = metrics.mViewportScrollOffset;
+      SetFirstPaintViewport(nsIntPoint(NS_lround(scrollOffset.x),
+                                       NS_lround(scrollOffset.y)),
                             1/rootScaleX,
                             mContentRect,
                             metrics.mCSSContentRect);
@@ -775,9 +777,9 @@ CompositorParent::TransformShadowTree(TimeStamp aCurrentFrame)
     // notifications, so that Java can take these into account in its response.
     // Calculate the absolute display port to send to Java
     nsIntRect displayPort = metrics.mDisplayPort;
-    nsIntPoint scrollOffset = metrics.mViewportScrollOffset;
-    displayPort.x += scrollOffset.x;
-    displayPort.y += scrollOffset.y;
+    gfx::Point scrollOffset = metrics.mViewportScrollOffset;
+    displayPort.x += NS_lround(scrollOffset.x);
+    displayPort.y += NS_lround(scrollOffset.y);
 
     SyncViewportInfo(displayPort, 1/rootScaleX, mLayersUpdated,
                      mScrollOffset, mXScale, mYScale);
@@ -794,7 +796,8 @@ CompositorParent::TransformShadowTree(TimeStamp aCurrentFrame)
 
     nsIntPoint metricsScrollOffset(0, 0);
     if (metrics.IsScrollable()) {
-      metricsScrollOffset = metrics.mViewportScrollOffset;
+      metricsScrollOffset =
+        nsIntPoint(NS_lround(scrollOffset.x), NS_lround(scrollOffset.y));
     }
 
     nsIntPoint scrollCompensation(
diff --git a/gfx/layers/ipc/GestureEventListener.cpp b/gfx/layers/ipc/GestureEventListener.cpp
index c0e45721943c..b30237dff0ea 100644
--- a/gfx/layers/ipc/GestureEventListener.cpp
+++ b/gfx/layers/ipc/GestureEventListener.cpp
@@ -202,7 +202,7 @@ nsEventStatus GestureEventListener::HandlePinchGestureEvent(const MultiTouchInpu
                                      currentSpan,
                                      currentSpan);
 
-        mAsyncPanZoomController->HandleInputEvent(pinchEvent);
+        mAsyncPanZoomController->ReceiveInputEvent(pinchEvent);
 
         mState = GESTURE_PINCH;
       }
@@ -216,7 +216,7 @@ nsEventStatus GestureEventListener::HandlePinchGestureEvent(const MultiTouchInpu
                                    currentSpan,
                                    mPreviousSpan);
 
-      mAsyncPanZoomController->HandleInputEvent(pinchEvent);
+      mAsyncPanZoomController->ReceiveInputEvent(pinchEvent);
       break;
     }
     default:
@@ -234,7 +234,7 @@ nsEventStatus GestureEventListener::HandlePinchGestureEvent(const MultiTouchInpu
                                  1.0f,
                                  1.0f);
 
-    mAsyncPanZoomController->HandleInputEvent(pinchEvent);
+    mAsyncPanZoomController->ReceiveInputEvent(pinchEvent);
 
     mState = GESTURE_NONE;
 
@@ -251,13 +251,13 @@ nsEventStatus GestureEventListener::HandlePinchGestureEvent(const MultiTouchInpu
 nsEventStatus GestureEventListener::HandleSingleTapUpEvent(const MultiTouchInput& aEvent)
 {
   TapGestureInput tapEvent(TapGestureInput::TAPGESTURE_UP, aEvent.mTime, aEvent.mTouches[0].mScreenPoint);
-  return mAsyncPanZoomController->HandleInputEvent(tapEvent);
+  return mAsyncPanZoomController->ReceiveInputEvent(tapEvent);
 }
 
 nsEventStatus GestureEventListener::HandleSingleTapConfirmedEvent(const MultiTouchInput& aEvent)
 {
   TapGestureInput tapEvent(TapGestureInput::TAPGESTURE_CONFIRMED, aEvent.mTime, aEvent.mTouches[0].mScreenPoint);
-  return mAsyncPanZoomController->HandleInputEvent(tapEvent);
+  return mAsyncPanZoomController->ReceiveInputEvent(tapEvent);
 }
 
 nsEventStatus GestureEventListener::HandleTapCancel(const MultiTouchInput& aEvent)
@@ -280,7 +280,7 @@ nsEventStatus GestureEventListener::HandleTapCancel(const MultiTouchInput& aEven
 nsEventStatus GestureEventListener::HandleDoubleTap(const MultiTouchInput& aEvent)
 {
   TapGestureInput tapEvent(TapGestureInput::TAPGESTURE_DOUBLE, aEvent.mTime, aEvent.mTouches[0].mScreenPoint);
-  return mAsyncPanZoomController->HandleInputEvent(tapEvent);
+  return mAsyncPanZoomController->ReceiveInputEvent(tapEvent);
 }
 
 void GestureEventListener::TimeoutDoubleTap()
diff --git a/gfx/layers/ipc/GestureEventListener.h b/gfx/layers/ipc/GestureEventListener.h
index dd1b9ec15552..2a6d527da242 100644
--- a/gfx/layers/ipc/GestureEventListener.h
+++ b/gfx/layers/ipc/GestureEventListener.h
@@ -8,6 +8,8 @@
 #include "InputData.h"
 #include "Axis.h"
 
+#include "base/message_loop.h"
+
 namespace mozilla {
 namespace layers {
 
diff --git a/gfx/layers/opengl/ReusableTileStoreOGL.cpp b/gfx/layers/opengl/ReusableTileStoreOGL.cpp
index 3919e871c1b7..e153a58919ab 100644
--- a/gfx/layers/opengl/ReusableTileStoreOGL.cpp
+++ b/gfx/layers/opengl/ReusableTileStoreOGL.cpp
@@ -220,7 +220,9 @@ ReusableTileStoreOGL::DrawTiles(TiledThebesLayerOGL* aLayer,
             TransformBounds(gfxRect(parentMetrics.mDisplayPort));
           const FrameMetrics& metrics = scrollableLayer->GetFrameMetrics();
           const nsIntSize& contentSize = metrics.mContentRect.Size();
-          const nsIntPoint& contentOrigin = metrics.mContentRect.TopLeft() - metrics.mViewportScrollOffset;
+          const gfx::Point& scrollOffset = metrics.mViewportScrollOffset;
+          const nsIntPoint& contentOrigin = metrics.mContentRect.TopLeft() -
+            nsIntPoint(NS_lround(scrollOffset.x), NS_lround(scrollOffset.y));
           gfxRect contentRect = gfxRect(contentOrigin.x, contentOrigin.y,
                                         contentSize.width, contentSize.height);
           contentBounds = scrollableLayer->GetEffectiveTransform().TransformBounds(contentRect);
diff --git a/ipc/glue/GeckoChildProcessHost.cpp b/ipc/glue/GeckoChildProcessHost.cpp
index bd7ed538f6f6..210602355e6b 100644
--- a/ipc/glue/GeckoChildProcessHost.cpp
+++ b/ipc/glue/GeckoChildProcessHost.cpp
@@ -535,6 +535,12 @@ GeckoChildProcessHost::PerformAsyncLaunchInternal(std::vector<std::string>& aExt
   }
 #endif  // ANDROID
 
+#ifdef MOZ_WIDGET_GONK
+  if (const char *ldPreloadPath = getenv("LD_PRELOAD")) {
+    newEnvVars["LD_PRELOAD"] = ldPreloadPath;
+  }
+#endif // MOZ_WIDGET_GONK
+
   // remap the IPC socket fd to a well-known int, as the OS does for
   // STDOUT_FILENO, for example
   int srcChannelFd, dstChannelFd;
diff --git a/ipc/glue/IPCMessageUtils.h b/ipc/glue/IPCMessageUtils.h
index 571c3f47dc01..bfeb77ab4696 100644
--- a/ipc/glue/IPCMessageUtils.h
+++ b/ipc/glue/IPCMessageUtils.h
@@ -762,6 +762,24 @@ struct ParamTraits<nsIntSize>
   }
 };
 
+template<>
+struct ParamTraits<mozilla::gfx::Point>
+{
+  typedef mozilla::gfx::Point paramType;
+
+  static void Write(Message* msg, const paramType& param)
+  {
+    WriteParam(msg, param.x);
+    WriteParam(msg, param.y);
+  }
+
+  static bool Read(const Message* msg, void** iter, paramType* result)
+  {
+    return (ReadParam(msg, iter, &result->x) &&
+            ReadParam(msg, iter, &result->y));
+  }
+};
+
 template<>
 struct ParamTraits<mozilla::gfx::Size>
 {
@@ -949,6 +967,7 @@ struct ParamTraits<mozilla::layers::FrameMetrics>
     WriteParam(aMsg, aParam.mDisplayPort);
     WriteParam(aMsg, aParam.mScrollId);
     WriteParam(aMsg, aParam.mResolution);
+    WriteParam(aMsg, aParam.mMayHaveTouchListeners);
   }
 
   static bool Read(const Message* aMsg, void** aIter, paramType* aResult)
@@ -959,7 +978,8 @@ struct ParamTraits<mozilla::layers::FrameMetrics>
             ReadParam(aMsg, aIter, &aResult->mViewportScrollOffset) &&
             ReadParam(aMsg, aIter, &aResult->mDisplayPort) &&
             ReadParam(aMsg, aIter, &aResult->mScrollId) &&
-            ReadParam(aMsg, aIter, &aResult->mResolution));
+            ReadParam(aMsg, aIter, &aResult->mResolution) &&
+            ReadParam(aMsg, aIter, &aResult->mMayHaveTouchListeners));
   }
 };
 
diff --git a/js/src/Makefile.in b/js/src/Makefile.in
index 8eb385ffbe4a..2d3ee7e83bde 100644
--- a/js/src/Makefile.in
+++ b/js/src/Makefile.in
@@ -120,6 +120,7 @@ CPPSRCS		= \
 		BytecodeCompiler.cpp \
 		BytecodeEmitter.cpp \
 		FoldConstants.cpp \
+		NameFunctions.cpp \
 		ParallelArray.cpp \
 		ParseMaps.cpp \
 		ParseNode.cpp \
@@ -323,6 +324,7 @@ endif
 
 ifneq (,$(filter arm% sparc %86 x86_64 mips%,$(TARGET_CPU)))
 ENABLE_YARR_JIT = 1
+DEFINES += -DENABLE_YARR_JIT=1
 
 VPATH += 	$(srcdir)/assembler/assembler \
 		$(srcdir)/methodjit \
diff --git a/js/src/assembler/wtf/Platform.h b/js/src/assembler/wtf/Platform.h
index 6570f2d9e1ed..0c84896f092a 100644
--- a/js/src/assembler/wtf/Platform.h
+++ b/js/src/assembler/wtf/Platform.h
@@ -1102,9 +1102,7 @@
 #if WTF_PLATFORM_CHROMIUM
 #define ENABLE_YARR_JIT 0
 
-#elif ENABLE_JIT && !defined(ENABLE_YARR_JIT)
-#define ENABLE_YARR_JIT 1
-
+#elif ENABLE_YARR_JIT
 /* Setting this flag compares JIT results with interpreter results. */
 #define ENABLE_YARR_JIT_DEBUG 0
 #endif
diff --git a/js/src/builtin/ParallelArray.cpp b/js/src/builtin/ParallelArray.cpp
index 663e0a413095..f72a3c0a8c68 100644
--- a/js/src/builtin/ParallelArray.cpp
+++ b/js/src/builtin/ParallelArray.cpp
@@ -963,8 +963,8 @@ ParallelArrayObject::create(JSContext *cx, HandleObject buffer, uint32_t offset,
         TypeObject *bufferType = buffer->getType(cx);
         TypeObject *resultType = result->getType(cx);
         if (!bufferType->unknownProperties() && !resultType->unknownProperties()) {
-            TypeSet *bufferIndexTypes = bufferType->getProperty(cx, JSID_VOID, false);
-            TypeSet *resultIndexTypes = resultType->getProperty(cx, JSID_VOID, true);
+            HeapTypeSet *bufferIndexTypes = bufferType->getProperty(cx, JSID_VOID, false);
+            HeapTypeSet *resultIndexTypes = resultType->getProperty(cx, JSID_VOID, true);
             bufferIndexTypes->addSubset(cx, resultIndexTypes);
         }
     }
diff --git a/js/src/builtin/TestingFunctions.cpp b/js/src/builtin/TestingFunctions.cpp
index 17cd8a873e35..f0a53342b7f8 100644
--- a/js/src/builtin/TestingFunctions.cpp
+++ b/js/src/builtin/TestingFunctions.cpp
@@ -755,6 +755,22 @@ EnableSPSProfilingAssertions(JSContext *cx, unsigned argc, jsval *vp)
     return true;
 }
 
+static JSBool
+DisplayName(JSContext *cx, unsigned argc, jsval *vp)
+{
+    CallArgs args = CallArgsFromVp(argc, vp);
+    if (argc == 0 || !args[0].isObject() || !args[0].toObject().isFunction()) {
+        RootedObject arg(cx, &args.callee());
+        ReportUsageError(cx, arg, "Must have one function argument");
+        return false;
+    }
+
+    JSFunction *fun = args[0].toObject().toFunction();
+    JSString *str = fun->displayAtom();
+    vp->setString(str == NULL ? cx->runtime->emptyString : str);
+    return true;
+}
+
 static JSFunctionSpecWithHelp TestingFunctions[] = {
     JS_FN_HELP("gc", ::GC, 0, 0,
 "gc([obj] | 'compartment')",
@@ -806,6 +822,7 @@ static JSFunctionSpecWithHelp TestingFunctions[] = {
 "   10: Incremental GC in multiple slices\n"
 "   11: Verify post write barriers between instructions\n"
 "   12: Verify post write barriers between paints\n"
+"   13: Purge analysis state when memory is allocated\n"
 "  Period specifies that collection happens every n allocations.\n"),
 
     JS_FN_HELP("schedulegc", ScheduleGC, 1, 0,
@@ -867,6 +884,12 @@ static JSFunctionSpecWithHelp TestingFunctions[] = {
 "  When 'slow' is false, then instrumentation is enabled, but the slow\n"
 "  assertions are disabled."),
 
+    JS_FN_HELP("displayName", DisplayName, 1, 0,
+"displayName(fn)",
+"  Gets the display name for a function, which can possibly be a guessed or\n"
+"  inferred name based on where the function was defined. This can be\n"
+"  different from the 'name' property on the function."),
+
     JS_FS_HELP_END
 };
 
diff --git a/js/src/configure.in b/js/src/configure.in
index c142eb76eee9..34f98b969003 100644
--- a/js/src/configure.in
+++ b/js/src/configure.in
@@ -3347,7 +3347,10 @@ MOZ_ARG_ENABLE_STRING(debug,
                            (using compiler flags DBG)],
 [ if test "$enableval" != "no"; then
     MOZ_DEBUG=1
-    ENABLE_METHODJIT_SPEW=1
+    if test "$ENABLE_METHODJIT"; then
+         # needs MethodJIT or YarrJIT
+         ENABLE_METHODJIT_SPEW=1
+    fi
     if test -n "$enableval" -a "$enableval" != "yes"; then
         MOZ_DEBUG_FLAGS=`echo $enableval | sed -e 's|\\\ | |g'`
         _MOZ_DEBUG_FLAGS_SET=1
diff --git a/js/src/ds/LifoAlloc.h b/js/src/ds/LifoAlloc.h
index 3a5779412690..697afd0c6ab1 100644
--- a/js/src/ds/LifoAlloc.h
+++ b/js/src/ds/LifoAlloc.h
@@ -263,12 +263,21 @@ class LifoAlloc
         latest->release(mark);
     }
 
+    void releaseAll() {
+        JS_ASSERT(!markCount);
+        latest = first;
+        if (latest)
+            latest->resetBump();
+    }
+
     /* Get the total "used" (occupied bytes) count for the arena chunks. */
     size_t used() const {
         size_t accum = 0;
         BumpChunk *it = first;
         while (it) {
             accum += it->used();
+            if (it == latest)
+                break;
             it = it->next();
         }
         return accum;
diff --git a/js/src/frontend/BytecodeCompiler.cpp b/js/src/frontend/BytecodeCompiler.cpp
index 5e2f6b926656..066dbd11ee1d 100644
--- a/js/src/frontend/BytecodeCompiler.cpp
+++ b/js/src/frontend/BytecodeCompiler.cpp
@@ -11,6 +11,7 @@
 
 #include "frontend/BytecodeEmitter.h"
 #include "frontend/FoldConstants.h"
+#include "frontend/NameFunctions.h"
 #include "vm/GlobalObject.h"
 
 #include "jsinferinlines.h"
@@ -191,6 +192,8 @@ frontend::CompileScript(JSContext *cx, HandleObject scopeChain, StackFrame *call
 
         if (!FoldConstants(cx, pn, &parser))
             return NULL;
+        if (!NameFunctions(cx, pn))
+            return NULL;
 
         pc.functionList = NULL;
 
@@ -331,6 +334,9 @@ frontend::CompileFunctionBody(JSContext *cx, HandleFunction fun, CompileOptions
     if (!funbce.init())
         return false;
 
+    if (!NameFunctions(cx, pn))
+        return NULL;
+
     if (fn->pn_body) {
         JS_ASSERT(fn->pn_body->isKind(PNK_ARGSBODY));
         fn->pn_body->append(pn);
diff --git a/js/src/frontend/BytecodeEmitter.cpp b/js/src/frontend/BytecodeEmitter.cpp
index 2aad5981c372..565677169ced 100644
--- a/js/src/frontend/BytecodeEmitter.cpp
+++ b/js/src/frontend/BytecodeEmitter.cpp
@@ -386,41 +386,58 @@ EmitBackPatchOp(JSContext *cx, BytecodeEmitter *bce, JSOp op, ptrdiff_t *lastp)
     return EmitJump(cx, bce, op, delta);
 }
 
-/* A macro for inlining at the top of EmitTree (whence it came). */
-#define UPDATE_LINE_NUMBER_NOTES(cx, bce, line)                               \
-    JS_BEGIN_MACRO                                                            \
-        unsigned line_ = (line);                                                 \
-        unsigned delta_ = line_ - bce->currentLine();                            \
-        if (delta_ != 0) {                                                    \
-            /*                                                                \
-             * Encode any change in the current source line number by using   \
-             * either several SRC_NEWLINE notes or just one SRC_SETLINE note, \
-             * whichever consumes less space.                                 \
-             *                                                                \
-             * NB: We handle backward line number deltas (possible with for   \
-             * loops where the update part is emitted after the body, but its \
-             * line number is <= any line number in the body) here by letting \
-             * unsigned delta_ wrap to a very large number, which triggers a  \
-             * SRC_SETLINE.                                                   \
-             */                                                               \
-            bce->current->currentLine = line_;                                \
-            if (delta_ >= (unsigned)(2 + ((line_ > SN_3BYTE_OFFSET_MASK)<<1))) { \
-                if (NewSrcNote2(cx, bce, SRC_SETLINE, (ptrdiff_t)line_) < 0)  \
-                    return false;                                             \
-            } else {                                                          \
-                do {                                                          \
-                    if (NewSrcNote(cx, bce, SRC_NEWLINE) < 0)                 \
-                        return false;                                         \
-                } while (--delta_ != 0);                                      \
-            }                                                                 \
-        }                                                                     \
-    JS_END_MACRO
+/* Updates line number notes, not column notes. */
+static inline bool
+UpdateLineNumberNotes(JSContext *cx, BytecodeEmitter *bce, unsigned line)
+{
+    unsigned delta = line - bce->currentLine();
+    if (delta != 0) {
+        /*
+         * Encode any change in the current source line number by using
+         * either several SRC_NEWLINE notes or just one SRC_SETLINE note,
+         * whichever consumes less space.
+         *
+         * NB: We handle backward line number deltas (possible with for
+         * loops where the update part is emitted after the body, but its
+         * line number is <= any line number in the body) here by letting
+         * unsigned delta_ wrap to a very large number, which triggers a
+         * SRC_SETLINE.
+         */
+        bce->current->currentLine = line;
+        bce->current->lastColumn  = 0;
+        if (delta >= (unsigned)(2 + ((line > SN_3BYTE_OFFSET_MASK)<<1))) {
+            if (NewSrcNote2(cx, bce, SRC_SETLINE, (ptrdiff_t)line) < 0)
+                return false;
+        } else {
+            do {
+                if (NewSrcNote(cx, bce, SRC_NEWLINE) < 0)
+                    return false;
+            } while (--delta != 0);
+        }
+    }
+    return true;
+}
 
 /* A function, so that we avoid macro-bloating all the other callsites. */
 static bool
-UpdateLineNumberNotes(JSContext *cx, BytecodeEmitter *bce, unsigned line)
+UpdateSourceCoordNotes(JSContext *cx, BytecodeEmitter *bce, TokenPtr pos)
 {
-    UPDATE_LINE_NUMBER_NOTES(cx, bce, line);
+    if (!UpdateLineNumberNotes(cx, bce, pos.lineno))
+        return false;
+
+    ptrdiff_t colspan = ptrdiff_t(pos.index) -
+                        ptrdiff_t(bce->current->lastColumn);
+    if (colspan != 0) {
+        if (colspan < 0) {
+            colspan += SN_COLSPAN_DOMAIN;
+        } else if (colspan >= SN_COLSPAN_DOMAIN / 2) {
+            ReportStatementTooLarge(cx, bce->topStmt);
+            return false;
+        }
+        if (NewSrcNote2(cx, bce, SRC_COLSPAN, colspan) < 0)
+            return false;
+        bce->current->lastColumn = pos.index;
+    }
     return true;
 }
 
@@ -436,7 +453,7 @@ EmitLoopHead(JSContext *cx, BytecodeEmitter *bce, ParseNode *nextpn)
         JS_ASSERT_IF(nextpn->isKind(PNK_STATEMENTLIST), nextpn->isArity(PN_LIST));
         if (nextpn->isKind(PNK_STATEMENTLIST) && nextpn->pn_head)
             nextpn = nextpn->pn_head;
-        if (!UpdateLineNumberNotes(cx, bce, nextpn->pn_pos.begin.lineno))
+        if (!UpdateSourceCoordNotes(cx, bce, nextpn->pn_pos.begin))
             return -1;
     }
 
@@ -451,7 +468,7 @@ EmitLoopEntry(JSContext *cx, BytecodeEmitter *bce, ParseNode *nextpn)
         JS_ASSERT_IF(nextpn->isKind(PNK_STATEMENTLIST), nextpn->isArity(PN_LIST));
         if (nextpn->isKind(PNK_STATEMENTLIST) && nextpn->pn_head)
             nextpn = nextpn->pn_head;
-        if (!UpdateLineNumberNotes(cx, bce, nextpn->pn_pos.begin.lineno))
+        if (!UpdateSourceCoordNotes(cx, bce, nextpn->pn_pos.begin))
             return false;
     }
 
@@ -1379,7 +1396,7 @@ BindNameToSlot(JSContext *cx, BytecodeEmitter *bce, ParseNode *pn)
             return true;
 
         JS_ASSERT(bce->sc->fun()->flags & JSFUN_LAMBDA);
-        JS_ASSERT(pn->pn_atom == bce->sc->fun()->atom);
+        JS_ASSERT(pn->pn_atom == bce->sc->fun()->atom());
 
         /*
          * Leave pn->isOp(JSOP_NAME) if bce->fun is heavyweight to
@@ -2642,7 +2659,11 @@ frontend::EmitFunctionScript(JSContext *cx, BytecodeEmitter *bce, ParseNode *bod
 
     if (!EmitTree(cx, bce, body))
         return false;
-        
+
+    /*
+     * Always end the script with a JSOP_STOP. Some other parts of the codebase
+     * depend on this opcode, e.g. js_InternalInterpret.
+     */
     if (Emit1(cx, bce, JSOP_STOP) < 0)
         return false;
 
@@ -2686,7 +2707,7 @@ MaybeEmitVarDecl(JSContext *cx, BytecodeEmitter *bce, JSOp prologOp, ParseNode *
         (!bce->sc->inFunction() || bce->sc->fun()->isHeavyweight()))
     {
         bce->switchToProlog();
-        if (!UpdateLineNumberNotes(cx, bce, pn->pn_pos.begin.lineno))
+        if (!UpdateSourceCoordNotes(cx, bce, pn->pn_pos.begin))
             return false;
         if (!EmitIndexOp(cx, prologOp, atomIndex, bce))
             return false;
@@ -4101,7 +4122,7 @@ EmitTry(JSContext *cx, BytecodeEmitter *bce, ParseNode *pn)
 
         /* Indicate that we're emitting a subroutine body. */
         stmtInfo.type = STMT_SUBROUTINE;
-        if (!UpdateLineNumberNotes(cx, bce, pn->pn_kid3->pn_pos.begin.lineno))
+        if (!UpdateSourceCoordNotes(cx, bce, pn->pn_kid3->pn_pos.begin))
             return false;
         if (Emit1(cx, bce, JSOP_FINALLY) < 0 ||
             !EmitTree(cx, bce, pn->pn_kid3) ||
@@ -4695,6 +4716,8 @@ EmitNormalFor(JSContext *cx, BytecodeEmitter *bce, ParseNode *pn, ptrdiff_t top)
         }
 #endif
         if (op == JSOP_POP) {
+            if (!UpdateSourceCoordNotes(cx, bce, pn3->pn_pos.begin))
+                return false;
             if (!EmitTree(cx, bce, pn3))
                 return false;
             if (pn3->isKind(PNK_VAR) || pn3->isKind(PNK_CONST) || pn3->isKind(PNK_LET)) {
@@ -4758,6 +4781,8 @@ EmitNormalFor(JSContext *cx, BytecodeEmitter *bce, ParseNode *pn, ptrdiff_t top)
     /* Check for update code to do before the condition (if any). */
     pn3 = forHead->pn_kid3;
     if (pn3) {
+        if (!UpdateSourceCoordNotes(cx, bce, pn3->pn_pos.begin))
+            return false;
         op = JSOP_POP;
 #if JS_HAS_DESTRUCTURING
         if (pn3->isKind(PNK_ASSIGN)) {
@@ -4906,7 +4931,7 @@ EmitFunc(JSContext *cx, BytecodeEmitter *bce, ParseNode *pn)
         bce->switchToProlog();
         if (!EmitIndex32(cx, JSOP_DEFFUN, index, bce))
             return false;
-        if (!UpdateLineNumberNotes(cx, bce, pn->pn_pos.begin.lineno))
+        if (!UpdateSourceCoordNotes(cx, bce, pn->pn_pos.begin))
             return false;
         bce->switchToMain();
 
@@ -4916,7 +4941,7 @@ EmitFunc(JSContext *cx, BytecodeEmitter *bce, ParseNode *pn)
     } else {
 #ifdef DEBUG
         BindingIter bi(bce->script->bindings);
-        while (bi->name() != fun->atom)
+        while (bi->name() != fun->atom())
             bi++;
         JS_ASSERT(bi->kind() == VARIABLE || bi->kind() == CONSTANT || bi->kind() == ARGUMENT);
         JS_ASSERT(bi.frameIndex() < JS_BIT(20));
@@ -5098,6 +5123,9 @@ EmitContinue(JSContext *cx, BytecodeEmitter *bce, PropertyName *label)
 static bool
 EmitReturn(JSContext *cx, BytecodeEmitter *bce, ParseNode *pn)
 {
+    if (!UpdateSourceCoordNotes(cx, bce, pn->pn_pos.begin))
+        return false;
+
     /* Push a return value */
     if (ParseNode *pn2 = pn->pn_kid) {
         if (!EmitTree(cx, bce, pn2))
@@ -5175,6 +5203,9 @@ EmitStatement(JSContext *cx, BytecodeEmitter *bce, ParseNode *pn)
     if (!pn2)
         return true;
 
+    if (!UpdateSourceCoordNotes(cx, bce, pn->pn_pos.begin))
+        return false;
+
     /*
      * Top-level or called-from-a-native JS_Execute/EvaluateScript,
      * debugger, and eval frames may need the value of the ultimate
@@ -5923,6 +5954,8 @@ EmitArray(JSContext *cx, BytecodeEmitter *bce, ParseNode *pn)
 static bool
 EmitUnary(JSContext *cx, BytecodeEmitter *bce, ParseNode *pn)
 {
+    if (!UpdateSourceCoordNotes(cx, bce, pn->pn_pos.begin))
+        return false;
     /* Unary op, including unary +/-. */
     JSOp op = pn->getOp();
     ParseNode *pn2 = pn->pn_kid;
@@ -6024,7 +6057,8 @@ frontend::EmitTree(JSContext *cx, BytecodeEmitter *bce, ParseNode *pn)
     pn->pn_offset = top;
 
     /* Emit notes to tell the current bytecode's source line number. */
-    UPDATE_LINE_NUMBER_NOTES(cx, bce, pn->pn_pos.begin.lineno);
+    if (!UpdateLineNumberNotes(cx, bce, pn->pn_pos.begin.lineno))
+        return false;
 
     switch (pn->getKind()) {
       case PNK_FUNCTION:
@@ -6623,7 +6657,7 @@ frontend::EmitTree(JSContext *cx, BytecodeEmitter *bce, ParseNode *pn)
 
     /* bce->emitLevel == 1 means we're last on the stack, so finish up. */
     if (ok && bce->emitLevel == 1) {
-        if (!UpdateLineNumberNotes(cx, bce, pn->pn_pos.end.lineno))
+        if (!UpdateSourceCoordNotes(cx, bce, pn->pn_pos.end))
             return false;
     }
 
@@ -7088,7 +7122,7 @@ JS_FRIEND_DATA(JSSrcNoteSpec) js_SrcNoteSpec[] = {
     {"switch",          2},
     {"funcdef",         1},
     {"catch",           1},
-    {"unused",         -1},
+    {"colspan",         1},
     {"newline",         0},
     {"setline",         1},
     {"xdelta",          0},
diff --git a/js/src/frontend/BytecodeEmitter.h b/js/src/frontend/BytecodeEmitter.h
index 78f9d43491a7..7a6c4f5fdfef 100644
--- a/js/src/frontend/BytecodeEmitter.h
+++ b/js/src/frontend/BytecodeEmitter.h
@@ -73,6 +73,8 @@ struct BytecodeEmitter
         unsigned    noteLimit;      /* limit number for source notes in notePool */
         ptrdiff_t   lastNoteOffset; /* code offset for last source note */
         unsigned    currentLine;    /* line number for tree-based srcnote gen */
+        unsigned    lastColumn;     /* zero-based column index on currentLine of
+                                       last SRC_COLSPAN-annotated opcode */
     } prolog, main, *current;
 
     Parser          *const parser;  /* the parser */
@@ -174,6 +176,7 @@ struct BytecodeEmitter
     unsigned noteLimit() const { return current->noteLimit; }
     ptrdiff_t lastNoteOffset() const { return current->lastNoteOffset; }
     unsigned currentLine() const { return current->currentLine; }
+    unsigned lastColumn() const { return current->lastColumn; }
 
     inline ptrdiff_t countFinalSourceNotes();
 
@@ -249,7 +252,7 @@ EmitFunctionScript(JSContext *cx, BytecodeEmitter *bce, ParseNode *body);
  *              +---------+-----+           +---+-----------+
  *
  * At most one "gettable" note (i.e., a note of type other than SRC_NEWLINE,
- * SRC_SETLINE, and SRC_XDELTA) applies to a given bytecode.
+ * SRC_COLSPAN, SRC_SETLINE, and SRC_XDELTA) applies to a given bytecode.
  *
  * NB: the js_SrcNoteSpec array in BytecodeEmitter.cpp is indexed by this
  * enum, so its initializers need to match the order here.
@@ -310,7 +313,7 @@ enum SrcNoteType {
     SRC_SWITCHBREAK = 18,       /* JSOP_GOTO is a break in a switch */
     SRC_FUNCDEF     = 19,       /* JSOP_NOP for function f() with atomid */
     SRC_CATCH       = 20,       /* catch block has guard */
-                                /* 21 is unused */
+    SRC_COLSPAN     = 21,       /* number of columns this opcode spans */
     SRC_NEWLINE     = 22,       /* bytecode follows a source newline */
     SRC_SETLINE     = 23,       /* a file-absolute source line number note */
     SRC_XDELTA      = 24        /* 24-31 are for extended delta notes */
@@ -346,7 +349,7 @@ enum SrcNoteType {
                                                    ? SRC_XDELTA               \
                                                    : *(sn) >> SN_DELTA_BITS))
 #define SN_SET_TYPE(sn,type)    SN_MAKE_NOTE(sn, type, SN_DELTA(sn))
-#define SN_IS_GETTABLE(sn)      (SN_TYPE(sn) < SRC_NEWLINE)
+#define SN_IS_GETTABLE(sn)      (SN_TYPE(sn) < SRC_COLSPAN)
 
 #define SN_DELTA(sn)            ((ptrdiff_t)(SN_IS_XDELTA(sn)                 \
                                              ? *(sn) & SN_XDELTA_MASK         \
@@ -366,6 +369,19 @@ enum SrcNoteType {
 #define SN_3BYTE_OFFSET_FLAG    0x80
 #define SN_3BYTE_OFFSET_MASK    0x7f
 
+/*
+ * Negative SRC_COLSPAN offsets are rare, but can arise with for(;;) loops and
+ * other constructs that generate code in non-source order. They can also arise
+ * due to failure to update pn->pn_pos.end to be the last child's end -- such
+ * failures are bugs to fix.
+ *
+ * Source note offsets in general must be non-negative and less than 0x800000,
+ * per the above SN_3BYTE_* definitions. To encode negative colspans, we bias
+ * them by the offset domain size and restrict non-negative colspans to less
+ * than half this domain.
+ */
+#define SN_COLSPAN_DOMAIN       ptrdiff_t(SN_3BYTE_OFFSET_FLAG << 16)
+
 #define SN_MAX_OFFSET ((size_t)((ptrdiff_t)SN_3BYTE_OFFSET_FLAG << 16) - 1)
 
 #define SN_LENGTH(sn)           ((js_SrcNoteSpec[SN_TYPE(sn)].arity == 0) ? 1 \
diff --git a/js/src/frontend/NameFunctions.cpp b/js/src/frontend/NameFunctions.cpp
new file mode 100644
index 000000000000..ecef78442a7b
--- /dev/null
+++ b/js/src/frontend/NameFunctions.cpp
@@ -0,0 +1,310 @@
+/* -*- Mode: C++; tab-width: 8; indent-tabs-mode: nil; c-basic-offset: 4 -*-
+ * vim: set ts=8 sw=4 et tw=99:
+ *
+ * This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+#include "frontend/NameFunctions.h"
+#include "frontend/ParseNode.h"
+#include "frontend/SharedContext.h"
+
+#include "jsfun.h"
+#include "jsprf.h"
+
+#include "vm/String-inl.h"
+#include "vm/StringBuffer.h"
+
+using namespace js;
+using namespace js::frontend;
+
+class NameResolver
+{
+    static const size_t MaxParents = 100;
+
+    JSContext *cx;
+    size_t nparents;                /* number of parents in the parents array */
+    ParseNode *parents[MaxParents]; /* history of ParseNodes we've been looking at */
+    StringBuffer *buf;              /* when resolving, buffer to append to */
+
+    /* Test whether a ParseNode represents a function invocation */
+    bool call(ParseNode *pn) {
+        return pn && pn->isKind(PNK_LP);
+    }
+
+    /*
+     * Some special atoms like 'prototype' and '__proto__' aren't useful to show
+     * up in function names.
+     */
+    bool special(JSAtom *atom) {
+        return cx->runtime->atomState.protoAtom == atom ||
+               cx->runtime->atomState.classPrototypeAtom == atom;
+    }
+
+    /*
+     * Walk over the given ParseNode, converting it to a stringified name that
+     * respresents where the function is being assigned to.
+     */
+    bool nameExpression(ParseNode *n) {
+        switch (n->getKind()) {
+            case PNK_DOT:
+                return nameExpression(n->expr()) &&
+                       (special(n->pn_atom) ||
+                        (buf->append(".") && buf->append(n->pn_atom)));
+
+            case PNK_NAME:
+                return buf->append(n->pn_atom);
+
+            case PNK_LB:
+                return nameExpression(n->pn_left) &&
+                       buf->append("[") &&
+                       nameExpression(n->pn_right) &&
+                       buf->append("]");
+
+            case PNK_NUMBER: {
+                char number[30];
+                int digits = JS_snprintf(number, sizeof(number), "%g", n->pn_dval);
+                return buf->appendInflated(number, digits);
+            }
+
+            /*
+             * Technically this isn't an "abort" situation, we're just confused
+             * on what to call this function, but failures in naming aren't
+             * treated as fatal.
+             */
+            default:
+                return false;
+        }
+    }
+
+    /*
+     * When naming an anonymous function, the process works loosely by walking
+     * up the AST and then translating that to a string. The stringification
+     * happens from some far-up assignment and then going back down the parse
+     * tree to the function definition point.
+     *
+     * This function will walk up the parse tree, gathering relevant nodes used
+     * for naming, and return the assignment node if there is one. The provided
+     * array and size will be filled in, and the returned node could be NULL if
+     * no assignment is found. The first element of the array will be the
+     * innermost node relevant to naming, and the last element will be the
+     * outermost node.
+     */
+    ParseNode *gatherNameable(ParseNode **nameable, size_t *size) {
+        *size = 0;
+
+        for (int pos = nparents - 1; pos >= 0; pos--) {
+            ParseNode *cur = parents[pos];
+            if (cur->isAssignment())
+                return cur;
+
+            switch (cur->getKind()) {
+                case PNK_NAME:     return cur;  /* found the initialized declaration */
+                case PNK_FUNCTION: return NULL; /* won't find an assignment or declaration */
+                default:           break;       /* move on, nothing relevant */
+
+                /* These nodes are relevant to the naming process, so append */
+                case PNK_COLON:
+                case PNK_LP:
+                case PNK_NEW:
+                    JS_ASSERT(*size < MaxParents);
+                    nameable[(*size)++] = cur;
+                    break;
+            }
+
+            /*
+             * Normally the relevant parent of a node is its direct parent, but
+             * sometimes with code like:
+             *
+             *    var foo = (function() { return function() {}; })();
+             *
+             * the outer function is just a helper to create a scope for the
+             * returned function. Hence the name of the returned function should
+             * actually be 'foo'.  This loop sees if the current node is a
+             * PNK_RETURN, and if there is a direct function call we skip to
+             * that.
+             */
+            if (cur->isKind(PNK_RETURN)) {
+                for (int tmp = pos - 1; tmp > 0; tmp--) {
+                    if (isDirectCall(tmp, cur)) {
+                        pos = tmp;
+                        break;
+                    } else if (call(cur)) {
+                        /* Don't skip too high in the tree */
+                        break;
+                    }
+                    cur = parents[tmp];
+                }
+            }
+        }
+
+        return NULL;
+    }
+
+    /*
+     * Resolve the name of a function. If the function already has a name
+     * listed, then it is skipped. Otherwise an intelligent name is guessed to
+     * assign to the function's displayAtom field
+     */
+    JSAtom *resolveFun(ParseNode *pn, JSAtom *prefix) {
+        JS_ASSERT(pn != NULL && pn->isKind(PNK_FUNCTION));
+        JSFunction *fun = pn->pn_funbox->function();
+        if (nparents == 0)
+            return NULL;
+
+        StringBuffer buf(cx);
+        this->buf = &buf;
+
+        /* If the function already has a name, use that */
+        if (fun->displayAtom() != NULL) {
+            if (prefix == NULL)
+                return fun->atom();
+            if (!buf.append(prefix) ||
+                !buf.append("/") ||
+                !buf.append(fun->displayAtom()))
+                return NULL;
+            return buf.finishAtom();
+        }
+
+        /* If a prefix is specified, then it is a form of namespace */
+        if (prefix != NULL && (!buf.append(prefix) || !buf.append("/")))
+            return NULL;
+
+        /* Gather all nodes relevant to naming */
+        ParseNode *toName[MaxParents];
+        size_t size;
+        ParseNode *assignment = gatherNameable(toName, &size);
+
+        /* If the function is assigned to something, then that is very relevant */
+        if (assignment) {
+            if (assignment->isAssignment())
+                assignment = assignment->pn_left;
+            if (!nameExpression(assignment))
+                return NULL;
+        }
+
+        /*
+         * Other than the actual assignment, other relevant nodes to naming are
+         * those in object initializers and then particular nodes marking a
+         * contribution.
+         */
+        for (int pos = size - 1; pos >= 0; pos--) {
+            ParseNode *node = toName[pos];
+
+            if (node->isKind(PNK_COLON)) {
+                if (node->pn_left->isKind(PNK_NAME)) {
+                    /* special atoms are skipped, but others are dot-appended */
+                    if (!special(node->pn_left->pn_atom)) {
+                        if (!buf.append(".") || !buf.append(node->pn_left->pn_atom))
+                            return NULL;
+                    }
+                } else if (node->pn_left->isKind(PNK_STRING)) {
+                    /* If a string is explicitly specified, don't see if its special */
+                    if (!buf.append(".") || !buf.append(node->pn_left->pn_atom))
+                        return NULL;
+                }
+            } else {
+                /*
+                 * Don't have consecutive '<' characters, and also don't start
+                 * with a '<' character.
+                 */
+                if (!buf.empty() && *(buf.end() - 1) != '<' && !buf.append("<"))
+                    return NULL;
+            }
+        }
+
+        /*
+         * functions which are "genuinely anonymous" but are contained in some
+         * other namespace are rather considered as "contributing" to the outer
+         * function, so give them a contribution symbol here.
+         */
+        if (!buf.empty() && *(buf.end() - 1) == '/' && !buf.append("<"))
+            return NULL;
+        if (buf.empty())
+            return NULL;
+
+        fun->setGuessedAtom(buf.finishAtom());
+        return fun->displayAtom();
+    }
+
+    /*
+     * Tests whether parents[pos] is a function call whose callee is cur.
+     * This is the case for functions which do things like simply create a scope
+     * for new variables and then return an anonymous function using this scope.
+     */
+    bool isDirectCall(int pos, ParseNode *cur) {
+        return pos >= 0 && call(parents[pos]) && parents[pos]->pn_head == cur;
+    }
+
+  public:
+    NameResolver(JSContext *cx) : cx(cx), nparents(0), buf(NULL) {}
+
+    /*
+     * Resolve all names for anonymous functions recursively within the
+     * ParseNode instance given. The prefix is for each subsequent name, and
+     * should initially be NULL.
+     */
+    void resolve(ParseNode *cur, JSAtom *prefix = NULL) {
+        if (cur == NULL)
+            return;
+
+        if (cur->isKind(PNK_FUNCTION) && cur->isArity(PN_FUNC)) {
+            JSAtom *prefix2 = resolveFun(cur, prefix);
+            /*
+             * If a function looks like (function(){})() where the parent node
+             * of the definition of the function is a call, then it shouldn't
+             * contribute anything to the namespace, so don't bother updating
+             * the prefix to whatever was returned.
+             */
+            if (!isDirectCall(nparents - 1, cur))
+                prefix = prefix2;
+        }
+        if (nparents >= MaxParents)
+            return;
+        parents[nparents++] = cur;
+
+        switch (cur->getArity()) {
+            case PN_NULLARY:
+                break;
+            case PN_NAME:
+                resolve(cur->maybeExpr(), prefix);
+                break;
+            case PN_UNARY:
+                resolve(cur->pn_kid, prefix);
+                break;
+            case PN_BINARY:
+                resolve(cur->pn_left, prefix);
+                /*
+                 * Occasionally pn_left == pn_right for something like
+                 * destructuring assignment in (function({foo}){}), so skip the
+                 * duplicate here if this is the case because we want to
+                 * traverse everything at most once.
+                 */
+                if (cur->pn_left != cur->pn_right)
+                    resolve(cur->pn_right, prefix);
+                break;
+            case PN_TERNARY:
+                resolve(cur->pn_kid1, prefix);
+                resolve(cur->pn_kid2, prefix);
+                resolve(cur->pn_kid3, prefix);
+                break;
+            case PN_FUNC:
+                JS_ASSERT(cur->isKind(PNK_FUNCTION));
+                resolve(cur->pn_body, prefix);
+                break;
+            case PN_LIST:
+                for (ParseNode *nxt = cur->pn_head; nxt; nxt = nxt->pn_next)
+                    resolve(nxt, prefix);
+                break;
+        }
+        nparents--;
+    }
+};
+
+bool
+frontend::NameFunctions(JSContext *cx, ParseNode *pn)
+{
+    NameResolver nr(cx);
+    nr.resolve(pn);
+    return true;
+}
diff --git a/js/src/frontend/NameFunctions.h b/js/src/frontend/NameFunctions.h
new file mode 100644
index 000000000000..d2f9437cd191
--- /dev/null
+++ b/js/src/frontend/NameFunctions.h
@@ -0,0 +1,24 @@
+/* -*- Mode: C++; tab-width: 8; indent-tabs-mode: nil; c-basic-offset: 4 -*-
+ * vim: set ts=8 sw=4 et tw=99:
+ *
+ * This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+#ifndef NameFunctions_h__
+#define NameFunctions_h__
+
+struct JSContext;
+
+namespace js {
+namespace frontend {
+
+struct ParseNode;
+
+bool
+NameFunctions(JSContext *cx, ParseNode *pn);
+
+} /* namespace frontend */
+} /* namespace js */
+
+#endif /* NameFunctions_h__ */
diff --git a/js/src/frontend/ParseNode-inl.h b/js/src/frontend/ParseNode-inl.h
index 9a07d2de9fa9..2abb5bf55f4c 100644
--- a/js/src/frontend/ParseNode-inl.h
+++ b/js/src/frontend/ParseNode-inl.h
@@ -32,7 +32,7 @@ inline PropertyName *
 ParseNode::name() const
 {
     JS_ASSERT(isKind(PNK_FUNCTION) || isKind(PNK_NAME) || isKind(PNK_INTRINSICNAME));
-    JSAtom *atom = isKind(PNK_FUNCTION) ? pn_funbox->function()->atom : pn_atom;
+    JSAtom *atom = isKind(PNK_FUNCTION) ? pn_funbox->function()->atom() : pn_atom;
     return atom->asPropertyName();
 }
 
diff --git a/js/src/frontend/ParseNode.h b/js/src/frontend/ParseNode.h
index 36c39b39e03c..3cffeca0859c 100644
--- a/js/src/frontend/ParseNode.h
+++ b/js/src/frontend/ParseNode.h
@@ -850,6 +850,9 @@ struct ParseNode {
 
     void initList(ParseNode *pn) {
         JS_ASSERT(pn_arity == PN_LIST);
+        if (pn->pn_pos.begin < pn_pos.begin)
+            pn_pos.begin = pn->pn_pos.begin;
+        pn_pos.end = pn->pn_pos.end;
         pn_head = pn;
         pn_tail = &pn->pn_next;
         pn_count = 1;
@@ -859,6 +862,8 @@ struct ParseNode {
 
     void append(ParseNode *pn) {
         JS_ASSERT(pn_arity == PN_LIST);
+        JS_ASSERT(pn->pn_pos.begin >= pn_pos.begin);
+        pn_pos.end = pn->pn_pos.end;
         *pn_tail = pn;
         pn_tail = &pn->pn_next;
         pn_count++;
diff --git a/js/src/frontend/Parser.cpp b/js/src/frontend/Parser.cpp
index 88828e8cb220..6edebe8364df 100644
--- a/js/src/frontend/Parser.cpp
+++ b/js/src/frontend/Parser.cpp
@@ -635,8 +635,8 @@ ReportBadReturn(JSContext *cx, Parser *parser, ParseNode *pn, Parser::Reporter r
                 unsigned errnum, unsigned anonerrnum)
 {
     JSAutoByteString name;
-    if (parser->pc->sc->fun()->atom) {
-        if (!js_AtomToPrintableString(cx, parser->pc->sc->fun()->atom, &name))
+    if (parser->pc->sc->fun()->atom()) {
+        if (!js_AtomToPrintableString(cx, parser->pc->sc->fun()->atom(), &name))
             return false;
     } else {
         errnum = anonerrnum;
@@ -916,6 +916,7 @@ MakeAssignment(ParseNode *pn, ParseNode *rhs, Parser *parser)
     pn->setDefn(false);
     pn->pn_left = lhs;
     pn->pn_right = rhs;
+    pn->pn_pos.end = rhs->pn_pos.end;
     return lhs;
 }
 
@@ -1136,7 +1137,19 @@ LeaveFunction(ParseNode *fn, Parser *parser, PropertyName *funName = NULL,
                     return false;
                 dn->pn_dflags |= PND_BOUND;
                 JS_ASSERT(dn->kind() == Definition::NAMED_LAMBDA);
-                if (dn->isClosed())
+
+                /*
+                 * Since 'dn' is a placeholder, it has not been defined in the
+                 * ParseContext and hence we must manually flag a closed-over
+                 * callee name as needing a dynamic scope (this is done for all
+                 * definitions in the ParseContext by generateFunctionBindings).
+                 *
+                 * If 'dn' has been assigned to, then we also flag the function
+                 * scope has needing a dynamic scope so that dynamic scope
+                 * setter can either ignore the set (in non-strict mode) or
+                 * produce an error (in strict mode).
+                 */
+                if (dn->isClosed() || dn->isAssigned())
                     funpc->sc->fun()->flags |= JSFUN_HEAVYWEIGHT;
                 continue;
             }
@@ -1387,14 +1400,15 @@ Parser::functionArguments(ParseNode **listp, bool &hasRest)
                 ParseNode *item = new_<BinaryNode>(PNK_ASSIGN, JSOP_NOP, lhs->pn_pos, lhs, rhs);
                 if (!item)
                     return false;
-                if (!list) {
+                if (list) {
+                    list->append(item);
+                } else {
                     list = ListNode::create(PNK_VAR, this);
                     if (!list)
                         return false;
-                    list->makeEmpty();
+                    list->initList(item);
                     *listp = list;
                 }
-                list->append(item);
                 break;
               }
 #endif /* JS_HAS_DESTRUCTURING */
@@ -2222,17 +2236,6 @@ NoteLValue(JSContext *cx, ParseNode *pn, SharedContext *sc)
         pn->pn_lexdef->pn_dflags |= PND_ASSIGNED;
 
     pn->pn_dflags |= PND_ASSIGNED;
-
-    /*
-     * An enclosing function's name is an immutable binding in ES5, so
-     * assignments to them must do nothing or throw a TypeError depending on
-     * code strictness. Outside strict mode, we optimize away assignment to
-     * the function name. For assignment to function name to fail in strict
-     * mode, we must have a binding for it in the scope chain; we ensure this
-     * happens by making such functions heavyweight.
-     */
-    if (sc->inFunction() && pn->pn_atom == sc->fun()->atom)
-        sc->setBindingsAccessedDynamically();
 }
 
 static bool
@@ -2721,6 +2724,7 @@ Parser::letBlock(LetContext letContext)
             return NULL;
 
         semi->pn_kid = pnlet;
+        semi->pn_pos = pnlet->pn_pos;
 
         letContext = LetExpresion;
         ret = semi;
@@ -2742,6 +2746,9 @@ Parser::letBlock(LetContext letContext)
             return NULL;
     }
 
+    ret->pn_pos.begin = pnlet->pn_pos.begin = pnlet->pn_left->pn_pos.begin;
+    ret->pn_pos.end = pnlet->pn_pos.end = pnlet->pn_right->pn_pos.end;
+
     PopStatementPC(context, pc);
     return ret;
 }
@@ -2774,6 +2781,7 @@ NewBindingNode(JSAtom *atom, Parser *parser, VarContext varContext = HoistVars)
             if (lexdep->pn_blockid >= pc->blockid()) {
                 lexdep->pn_blockid = pc->blockid();
                 pc->lexdeps->remove(p);
+                lexdep->pn_pos = parser->tokenStream.currentToken().pos;
                 return lexdep;
             }
         }
@@ -2939,6 +2947,7 @@ Parser::forStatement()
             tokenStream.ungetToken();
     }
 
+    TokenPos lp_pos = tokenStream.currentToken().pos;
     MUST_MATCH_TOKEN(TOK_LP, JSMSG_PAREN_AFTER_FOR);
 
     /*
@@ -3132,6 +3141,7 @@ Parser::forStatement()
                               pn2->isKind(PNK_NAME));
                 }
 #endif
+                pnseq->pn_pos.begin = pn->pn_pos.begin;
                 pnseq->append(pn);
                 forParent = pnseq;
             }
@@ -3161,6 +3171,7 @@ Parser::forStatement()
                 return NULL;
             letStmt.isForLetBlock = true;
             block->pn_expr = pn1;
+            block->pn_pos = pn1->pn_pos;
             pn1 = block;
         }
 
@@ -3261,6 +3272,8 @@ Parser::forStatement()
     forHead->pn_kid1 = pn1;
     forHead->pn_kid2 = pn2;
     forHead->pn_kid3 = pn3;
+    forHead->pn_pos.begin = lp_pos.begin;
+    forHead->pn_pos.end   = tokenStream.currentToken().pos.end;
     pn->pn_left = forHead;
 
     MUST_MATCH_TOKEN(TOK_RP, JSMSG_PAREN_AFTER_FOR_CTRL);
@@ -3425,6 +3438,8 @@ Parser::tryStatement()
             MUST_MATCH_TOKEN(TOK_RC, JSMSG_CURLY_AFTER_CATCH);
             PopStatementPC(context, pc);
 
+            pnblock->pn_pos.end = pn2->pn_pos.end = tokenStream.currentToken().pos.end;
+
             catchList->append(pnblock);
             lastCatch = pn2;
             tt = tokenStream.getToken(TSF_OPERAND);
@@ -3448,6 +3463,7 @@ Parser::tryStatement()
         reportError(NULL, JSMSG_CATCH_OR_FINALLY);
         return NULL;
     }
+    pn->pn_pos.end = (pn->pn_kid3 ? pn->pn_kid3 : catchList)->pn_pos.end;
     return pn;
 }
 
@@ -5882,6 +5898,7 @@ Parser::attributeIdentifier()
     if (!pn2)
         return NULL;
     pn->pn_kid = pn2;
+    pn->pn_pos.end = pn2->pn_pos.end;
     return pn;
 }
 
@@ -5914,6 +5931,7 @@ Parser::xmlExpr(bool inTag)
     tokenStream.setXMLTagMode(oldflag);
     pn->pn_kid = pn2;
     pn->setOp(inTag ? JSOP_XMLTAGEXPR : JSOP_XMLELTEXPR);
+    pn->pn_pos.end = pn2->pn_pos.end;
     return pn;
 }
 
@@ -6051,7 +6069,6 @@ Parser::xmlTagContent(ParseNodeKind tagkind, JSAtom **namep)
         }
         if (!pn2)
             return NULL;
-        pn->pn_pos.end = pn2->pn_pos.end;
         pn->append(pn2);
     }
 
@@ -6091,7 +6108,6 @@ Parser::xmlElementContent(ParseNode *pn)
                                       JSOP_STRING);
             if (!pn2)
                 return false;
-            pn->pn_pos.end = pn2->pn_pos.end;
             pn->append(pn2);
         }
 
@@ -6124,7 +6140,6 @@ Parser::xmlElementContent(ParseNode *pn)
             if (!pn2)
                 return false;
         }
-        pn->pn_pos.end = pn2->pn_pos.end;
         pn->append(pn2);
     }
     tokenStream.setXMLTagMode(true);
@@ -6198,6 +6213,7 @@ Parser::xmlElementOrList(bool allowList)
                 pn = ListNode::create(PNK_XMLTAGC, this);
                 if (!pn)
                     return NULL;
+                pn->pn_pos = pn2->pn_pos;
             }
 
             /* Now make pn a nominal-root TOK_XMLELEM list containing pn2. */
diff --git a/js/src/frontend/TokenStream.h b/js/src/frontend/TokenStream.h
index 5492d2a24e10..b00dacde6d01 100644
--- a/js/src/frontend/TokenStream.h
+++ b/js/src/frontend/TokenStream.h
@@ -267,6 +267,10 @@ struct TokenPos {
     bool operator >=(const TokenPos& bpos) const {
         return !(*this < bpos);
     }
+
+    bool encloses(const TokenPos& pos) const {
+        return begin <= pos.begin && pos.end <= end;
+    }
 };
 
 struct Token {
diff --git a/js/src/gc/Marking.cpp b/js/src/gc/Marking.cpp
index 571ccfabf3da..38993aa79ead 100644
--- a/js/src/gc/Marking.cpp
+++ b/js/src/gc/Marking.cpp
@@ -1160,11 +1160,14 @@ GCMarker::processMarkStackTop(SliceBudget &budget)
         if (v.isString()) {
             JSString *str = v.toString();
             JS_COMPARTMENT_ASSERT_STR(runtime, str);
-            if (str->markIfUnmarked())
+            JS_ASSERT(str->compartment() == runtime->atomsCompartment ||
+                      str->compartment() == obj->compartment());
+    if (str->markIfUnmarked())
                 ScanString(this, str);
         } else if (v.isObject()) {
             JSObject *obj2 = &v.toObject();
             JS_COMPARTMENT_ASSERT(runtime, obj2);
+            JS_ASSERT(obj->compartment() == obj2->compartment());
             if (obj2->markIfUnmarked(getMarkColor())) {
                 pushValueArray(obj, vp, end);
                 obj = obj2;
diff --git a/js/src/jit-test/jit_test.py b/js/src/jit-test/jit_test.py
index 3c5326f9299e..97d1f033b2db 100755
--- a/js/src/jit-test/jit_test.py
+++ b/js/src/jit-test/jit_test.py
@@ -259,7 +259,7 @@ def check_output(out, err, rc, test):
     if rc != test.expect_status:
         # Allow a non-zero exit code if we want to allow OOM, but only if we
         # actually got OOM.
-        return test.allow_oom and ': out of memory' in err and 'Assertion failure' not in err
+        return test.allow_oom and 'out of memory' in err and 'Assertion failure' not in err
 
     return True
 
diff --git a/js/src/jit-test/tests/basic/functionnames.js b/js/src/jit-test/tests/basic/functionnames.js
new file mode 100644
index 000000000000..cbb5809c3876
--- /dev/null
+++ b/js/src/jit-test/tests/basic/functionnames.js
@@ -0,0 +1,119 @@
+/*
+ * Most of these test cases are adapted from:
+ * http://johnjbarton.github.com/nonymous/index.html
+ */
+
+function assertName(fn, name) {
+    assertEq(displayName(fn), name)
+}
+
+/* simple names */
+var a = function b() {};
+function c() {};
+assertName(a, 'b');
+assertName(c, 'c');
+
+var a = function(){},
+    b = function(){};
+assertName(a, 'a');
+assertName(b, 'b');
+
+/* nested names */
+var main = function() {
+    function Foo(a) { assertName(a, 'main/foo<') }
+    var foo = new Foo(function() {});
+};
+assertName(main, 'main')
+main();
+
+/* duplicated */
+var Baz = Bar = function(){}
+assertName(Baz, 'Bar');
+assertName(Bar, 'Bar');
+
+/* returned from an immediate function */
+var Foo = function (){
+    assertName(arguments.callee, 'Foo<')
+    return function(){};
+}();
+assertName(Foo, 'Foo');
+
+/* various properties and such */
+var x = {fox: { bax: function(){} } };
+assertName(x.fox.bax, 'x.fox.bax');
+var foo = {foo: {foo: {}}};
+foo.foo.foo = function(){};
+assertName(foo.foo.foo, 'foo.foo.foo');
+var z = {
+    foz: function() {
+             var baz = function() {
+                 var y = {bay: function() {}};
+                 assertName(y.bay, 'z.foz/baz/y.bay');
+             };
+             assertName(baz, 'z.foz/baz');
+             baz();
+         }
+};
+assertName(z.foz, 'z.foz');
+z.foz();
+
+var outer = function() {
+    x.fox.bax.nx = function(){};
+    var w = {fow: { baw: function(){} } };
+    assertName(x.fox.bax.nx, 'outer/x.fox.bax.nx')
+    assertName(w.fow.baw, 'outer/w.fow.baw');
+};
+assertName(outer, 'outer');
+outer();
+function Fuz(){};
+Fuz.prototype = {
+  add: function() {}
+}
+assertName(Fuz.prototype.add, 'Fuz.add');
+
+var x = 1;
+x = function(){};
+assertName(x, 'x');
+
+var a = {b: {}};
+a.b.c = (function() {
+    assertName(arguments.callee, 'a.b.c<')
+}());
+
+a.b = function() {
+    function foo(f) { assertName(f, 'a.b/<'); };
+    return foo(function(){});
+}
+a.b();
+
+var bar = 'bar';
+a.b[bar] = function(){};
+assertName(a.b.bar, 'a.b[bar]');
+
+a.b = function() {
+    assertName(arguments.callee, 'a.b<');
+    return { a: function() {} }
+}();
+assertName(a.b.a, 'a.b.a');
+
+a = {
+    b: function(a) {
+        if (a)
+            return function() {};
+        else
+            return function() {};
+    }
+};
+assertName(a.b, 'a.b');
+assertName(a.b(true), 'a.b/<')
+assertName(a.b(false), 'a.b/<')
+
+function f(g) {
+    assertName(g, 'x<');
+    return g();
+}
+var x = f(function () { return function() {}; });
+assertName(x, 'x</<');
+
+var a = {'b': function(){}};
+assertName(a.b, 'a.b');
diff --git a/js/src/jit-test/tests/basic/testBug784639.js b/js/src/jit-test/tests/basic/testBug784639.js
new file mode 100644
index 000000000000..1380ae6ed29d
--- /dev/null
+++ b/js/src/jit-test/tests/basic/testBug784639.js
@@ -0,0 +1,17 @@
+evalcx("\
+  Object.defineProperty(this, \"a\", {});\
+  f = (function(j) {\
+	  a = Proxy\
+  });\
+  Object.defineProperty(this, \"g\", {\
+	  get: function() {\
+		  return ({\
+			  r: function() {},\
+			  t: function() {}\
+		  })\
+	  }\
+  });\
+  for (p in g) {\
+	  f(1)\
+  }\
+", newGlobal())
diff --git a/js/src/jit-test/tests/debug/Object-displayName-01.js b/js/src/jit-test/tests/debug/Object-displayName-01.js
new file mode 100644
index 000000000000..fe5f965ca2fa
--- /dev/null
+++ b/js/src/jit-test/tests/debug/Object-displayName-01.js
@@ -0,0 +1,17 @@
+// Debugger.Object.prototype.displayName
+
+var g = newGlobal('new-compartment');
+var dbg = Debugger(g);
+var name;
+dbg.onDebuggerStatement = function (frame) { name = frame.callee.displayName; };
+
+g.eval("(function f() { debugger; })();");
+assertEq(name, "f");
+g.eval("(function () { debugger; })();");
+assertEq(name, undefined);
+g.eval("Function('debugger;')();");
+assertEq(name, "anonymous");
+g.eval("var f = function() { debugger; }; f()");
+assertEq(name, "f");
+g.eval("var a = {}; a.f = function() { debugger; }; a.f()");
+assertEq(name, "a.f");
diff --git a/js/src/jsanalyze.cpp b/js/src/jsanalyze.cpp
index 9d0c09bc8636..7add1ecc9183 100644
--- a/js/src/jsanalyze.cpp
+++ b/js/src/jsanalyze.cpp
@@ -47,7 +47,7 @@ ScriptAnalysis::addJump(JSContext *cx, unsigned offset,
 
     Bytecode *&code = codeArray[offset];
     if (!code) {
-        code = cx->typeLifoAlloc().new_<Bytecode>();
+        code = cx->analysisLifoAlloc().new_<Bytecode>();
         if (!code) {
             setOOM(cx);
             return false;
@@ -96,13 +96,13 @@ ScriptAnalysis::analyzeBytecode(JSContext *cx)
 {
     JS_ASSERT(cx->compartment->activeAnalysis);
     JS_ASSERT(!ranBytecode());
-    LifoAlloc &tla = cx->typeLifoAlloc();
+    LifoAlloc &alloc = cx->analysisLifoAlloc();
 
     numSlots = TotalSlots(script);
 
     unsigned length = script->length;
-    codeArray = tla.newArray<Bytecode*>(length);
-    escapedSlots = tla.newArray<bool>(numSlots);
+    codeArray = alloc.newArray<Bytecode*>(length);
+    escapedSlots = alloc.newArray<bool>(numSlots);
 
     if (!codeArray || !escapedSlots) {
         setOOM(cx);
@@ -173,7 +173,7 @@ ScriptAnalysis::analyzeBytecode(JSContext *cx)
     unsigned forwardCatch = 0;
 
     /* Fill in stack depth and definitions at initial bytecode. */
-    Bytecode *startcode = tla.new_<Bytecode>();
+    Bytecode *startcode = alloc.new_<Bytecode>();
     if (!startcode) {
         setOOM(cx);
         return;
@@ -270,10 +270,10 @@ ScriptAnalysis::analyzeBytecode(JSContext *cx)
          */
         if ((js_CodeSpec[op].format & JOF_TYPESET) && cx->typeInferenceEnabled()) {
             if (nTypeSets < script->nTypeSets) {
-                code->observedTypes = &typeArray[nTypeSets++];
+                code->observedTypes = typeArray[nTypeSets++].toStackTypeSet();
             } else {
                 JS_ASSERT(nTypeSets == UINT16_MAX);
-                code->observedTypes = &typeArray[nTypeSets - 1];
+                code->observedTypes = typeArray[nTypeSets - 1].toStackTypeSet();
             }
         }
 
@@ -460,6 +460,14 @@ ScriptAnalysis::analyzeBytecode(JSContext *cx)
             isInlineable = false;
             break;
 
+          case JSOP_GETPROP:
+          case JSOP_CALLPROP:
+          case JSOP_LENGTH:
+          case JSOP_GETELEM:
+          case JSOP_CALLELEM:
+            numPropertyReads_++;
+            break;
+
           /* Additional opcodes which can be compiled but which can't be inlined. */
           case JSOP_ARGUMENTS:
           case JSOP_THROW:
@@ -509,11 +517,6 @@ ScriptAnalysis::analyzeBytecode(JSContext *cx)
           case JSOP_TYPEOF:
           case JSOP_TYPEOFEXPR:
           case JSOP_VOID:
-          case JSOP_GETPROP:
-          case JSOP_CALLPROP:
-          case JSOP_LENGTH:
-          case JSOP_GETELEM:
-          case JSOP_CALLELEM:
           case JSOP_TOID:
           case JSOP_SETELEM:
           case JSOP_IMPLICITTHIS:
@@ -602,7 +605,7 @@ ScriptAnalysis::analyzeBytecode(JSContext *cx)
             Bytecode *&nextcode = codeArray[successorOffset];
 
             if (!nextcode) {
-                nextcode = tla.new_<Bytecode>();
+                nextcode = alloc.new_<Bytecode>();
                 if (!nextcode) {
                     setOOM(cx);
                     return;
@@ -634,6 +637,25 @@ ScriptAnalysis::analyzeBytecode(JSContext *cx)
      */
     if (!script->analyzedArgsUsage())
         analyzeSSA(cx);
+
+    /*
+     * If the script has JIT information (we are reanalyzing the script after
+     * a purge), add safepoints for the targets of any cross chunk edges in
+     * the script. These safepoints are normally added when the JITScript is
+     * constructed, but will have been lost during the purge.
+     */
+#ifdef JS_METHODJIT
+    mjit::JITScript *jit = NULL;
+    for (int constructing = 0; constructing <= 1 && !jit; constructing++) {
+        for (int barriers = 0; barriers <= 1 && !jit; barriers++)
+            jit = script->getJIT((bool) constructing, (bool) barriers);
+    }
+    if (jit) {
+        mjit::CrossChunkEdge *edges = jit->edges();
+        for (size_t i = 0; i < jit->nedges; i++)
+            getCode(edges[i].target).safePoint = true;
+    }
+#endif
 }
 
 /////////////////////////////////////////////////////////////////////
@@ -651,9 +673,9 @@ ScriptAnalysis::analyzeLifetimes(JSContext *cx)
             return;
     }
 
-    LifoAlloc &tla = cx->typeLifoAlloc();
+    LifoAlloc &alloc = cx->analysisLifoAlloc();
 
-    lifetimes = tla.newArray<LifetimeVariable>(numSlots);
+    lifetimes = alloc.newArray<LifetimeVariable>(numSlots);
     if (!lifetimes) {
         setOOM(cx);
         return;
@@ -775,7 +797,7 @@ ScriptAnalysis::analyzeLifetimes(JSContext *cx)
             /* Restore all saved variables. :FIXME: maybe do this precisely. */
             for (unsigned i = 0; i < savedCount; i++) {
                 LifetimeVariable &var = *saved[i];
-                var.lifetime = tla.new_<Lifetime>(offset, var.savedEnd, var.saved);
+                var.lifetime = alloc.new_<Lifetime>(offset, var.savedEnd, var.saved);
                 if (!var.lifetime) {
                     cx->free_(saved);
                     setOOM(cx);
@@ -842,7 +864,7 @@ ScriptAnalysis::analyzeLifetimes(JSContext *cx)
                 if (loop && loop->entry > loop->lastBlock)
                     loop->lastBlock = loop->entry;
 
-                LoopAnalysis *nloop = tla.new_<LoopAnalysis>();
+                LoopAnalysis *nloop = alloc.new_<LoopAnalysis>();
                 if (!nloop) {
                     cx->free_(saved);
                     setOOM(cx);
@@ -892,7 +914,7 @@ ScriptAnalysis::analyzeLifetimes(JSContext *cx)
                          * Jumping to a place where this variable is live. Make a new
                          * lifetime segment for the variable.
                          */
-                        var.lifetime = tla.new_<Lifetime>(offset, var.savedEnd, var.saved);
+                        var.lifetime = alloc.new_<Lifetime>(offset, var.savedEnd, var.saved);
                         if (!var.lifetime) {
                             cx->free_(saved);
                             setOOM(cx);
@@ -956,7 +978,7 @@ ScriptAnalysis::addVariable(JSContext *cx, LifetimeVariable &var, unsigned offse
                 }
             }
         }
-        var.lifetime = cx->typeLifoAlloc().new_<Lifetime>(offset, var.savedEnd, var.saved);
+        var.lifetime = cx->analysisLifoAlloc().new_<Lifetime>(offset, var.savedEnd, var.saved);
         if (!var.lifetime) {
             setOOM(cx);
             return;
@@ -971,7 +993,7 @@ ScriptAnalysis::killVariable(JSContext *cx, LifetimeVariable &var, unsigned offs
 {
     if (!var.lifetime) {
         /* Make a point lifetime indicating the write. */
-        Lifetime *lifetime = cx->typeLifoAlloc().new_<Lifetime>(offset, var.savedEnd, var.saved);
+        Lifetime *lifetime = cx->analysisLifoAlloc().new_<Lifetime>(offset, var.savedEnd, var.saved);
         if (!lifetime) {
             setOOM(cx);
             return;
@@ -1002,7 +1024,7 @@ ScriptAnalysis::killVariable(JSContext *cx, LifetimeVariable &var, unsigned offs
          * We set the new interval's savedEnd to 0, since it will always be
          * adjacent to the old interval, so it never needs to be extended.
          */
-        var.lifetime = cx->typeLifoAlloc().new_<Lifetime>(start, 0, var.lifetime);
+        var.lifetime = cx->analysisLifoAlloc().new_<Lifetime>(start, 0, var.lifetime);
         if (!var.lifetime) {
             setOOM(cx);
             return;
@@ -1091,7 +1113,7 @@ ScriptAnalysis::extendVariable(JSContext *cx, LifetimeVariable &var,
         }
         JS_ASSERT(savedEnd <= end);
         if (savedEnd > segment->end) {
-            Lifetime *tail = cx->typeLifoAlloc().new_<Lifetime>(savedEnd, 0, segment->next);
+            Lifetime *tail = cx->analysisLifoAlloc().new_<Lifetime>(savedEnd, 0, segment->next);
             if (!tail) {
                 setOOM(cx);
                 return;
@@ -1168,7 +1190,7 @@ ScriptAnalysis::analyzeSSA(JSContext *cx)
             return;
     }
 
-    LifoAlloc &tla = cx->typeLifoAlloc();
+    LifoAlloc &alloc = cx->analysisLifoAlloc();
     unsigned maxDepth = script->nslots - script->nfixed;
 
     /*
@@ -1352,7 +1374,7 @@ ScriptAnalysis::analyzeSSA(JSContext *cx)
         unsigned xuses = ExtendedUse(pc) ? nuses + 1 : nuses;
 
         if (xuses) {
-            code->poppedValues = tla.newArray<SSAValue>(xuses);
+            code->poppedValues = alloc.newArray<SSAValue>(xuses);
             if (!code->poppedValues) {
                 setOOM(cx);
                 return;
@@ -1375,7 +1397,7 @@ ScriptAnalysis::analyzeSSA(JSContext *cx)
             }
 
             if (xuses) {
-                SSAUseChain *useChains = tla.newArray<SSAUseChain>(xuses);
+                SSAUseChain *useChains = alloc.newArray<SSAUseChain>(xuses);
                 if (!useChains) {
                     setOOM(cx);
                     return;
@@ -1402,7 +1424,7 @@ ScriptAnalysis::analyzeSSA(JSContext *cx)
 
         unsigned xdefs = ExtendedDef(pc) ? ndefs + 1 : ndefs;
         if (xdefs) {
-            code->pushedUses = tla.newArray<SSAUseChain *>(xdefs);
+            code->pushedUses = alloc.newArray<SSAUseChain *>(xdefs);
             if (!code->pushedUses) {
                 setOOM(cx);
                 return;
@@ -1583,8 +1605,8 @@ PhiNodeCapacity(unsigned length)
 bool
 ScriptAnalysis::makePhi(JSContext *cx, uint32_t slot, uint32_t offset, SSAValue *pv)
 {
-    SSAPhiNode *node = cx->typeLifoAlloc().new_<SSAPhiNode>();
-    SSAValue *options = cx->typeLifoAlloc().newArray<SSAValue>(PhiNodeCapacity(0));
+    SSAPhiNode *node = cx->analysisLifoAlloc().new_<SSAPhiNode>();
+    SSAValue *options = cx->analysisLifoAlloc().newArray<SSAValue>(PhiNodeCapacity(0));
     if (!node || !options) {
         setOOM(cx);
         return false;
@@ -1616,7 +1638,7 @@ ScriptAnalysis::insertPhi(JSContext *cx, SSAValue &phi, const SSAValue &v)
     if (trackUseChain(v)) {
         SSAUseChain *&uses = useChain(v);
 
-        SSAUseChain *use = cx->typeLifoAlloc().new_<SSAUseChain>();
+        SSAUseChain *use = cx->analysisLifoAlloc().new_<SSAUseChain>();
         if (!use) {
             setOOM(cx);
             return;
@@ -1635,7 +1657,7 @@ ScriptAnalysis::insertPhi(JSContext *cx, SSAValue &phi, const SSAValue &v)
     }
 
     SSAValue *newOptions =
-        cx->typeLifoAlloc().newArray<SSAValue>(PhiNodeCapacity(node->length + 1));
+        cx->analysisLifoAlloc().newArray<SSAValue>(PhiNodeCapacity(node->length + 1));
     if (!newOptions) {
         setOOM(cx);
         return;
@@ -1835,7 +1857,7 @@ ScriptAnalysis::freezeNewValues(JSContext *cx, uint32_t offset)
         return;
     }
 
-    code.newValues = cx->typeLifoAlloc().newArray<SlotValue>(count + 1);
+    code.newValues = cx->analysisLifoAlloc().newArray<SlotValue>(count + 1);
     if (!code.newValues) {
         setOOM(cx);
         return;
@@ -2014,7 +2036,7 @@ CrossScriptSSA::foldValue(const CrossSSAValue &cv)
              */
             ScriptAnalysis *analysis = frame.script->analysis();
             SSAValue toidv = analysis->poppedValue(pc, 0);
-            if (analysis->getValueTypes(toidv)->getKnownTypeTag(cx) == JSVAL_TYPE_INT32)
+            if (analysis->getValueTypes(toidv)->getKnownTypeTag() == JSVAL_TYPE_INT32)
                 return foldValue(CrossSSAValue(cv.frame, toidv));
             break;
           }
diff --git a/js/src/jsanalyze.h b/js/src/jsanalyze.h
index 869912e04d8f..8fc5e6732967 100644
--- a/js/src/jsanalyze.h
+++ b/js/src/jsanalyze.h
@@ -122,7 +122,7 @@ class Bytecode
 
     union {
         /* If this is a JOF_TYPESET opcode, index into the observed types for the op. */
-        types::TypeSet *observedTypes;
+        types::StackTypeSet *observedTypes;
 
         /* If this is a loop head (TRACE or NOTRACE), information about the loop. */
         LoopAnalysis *loop;
@@ -164,7 +164,7 @@ class Bytecode
     /* --------- Type inference --------- */
 
     /* Types for all values pushed by this bytecode. */
-    types::TypeSet *pushedTypes;
+    types::StackTypeSet *pushedTypes;
 
     /* Any type barriers in place at this bytecode. */
     types::TypeBarrier *typeBarriers;
@@ -739,7 +739,7 @@ class SSAValue
  */
 struct SSAPhiNode
 {
-    types::TypeSet types;
+    types::StackTypeSet types;
     uint32_t slot;
     uint32_t length;
     SSAValue *options;
@@ -809,6 +809,7 @@ class ScriptAnalysis
     Bytecode **codeArray;
 
     uint32_t numSlots;
+    uint32_t numPropertyReads_;
 
     bool outOfMemory;
     bool hadFailure;
@@ -872,6 +873,9 @@ class ScriptAnalysis
     bool inlineable(uint32_t argc) { return isInlineable && argc == script->function()->nargs; }
     bool jaegerCompileable() { return isJaegerCompileable; }
 
+    /* Number of property read opcodes in the script. */
+    uint32_t numPropertyReads() const { return numPropertyReads_; }
+
     /* Whether there are POPV/SETRVAL bytecodes which can write to the frame's rval. */
     bool usesReturnValue() const { return usesReturnValue_; }
 
@@ -925,7 +929,7 @@ class ScriptAnalysis
         return (cs->format & JOF_POST) && !popGuaranteed(pc);
     }
 
-    types::TypeSet *bytecodeTypes(const jsbytecode *pc) {
+    types::StackTypeSet *bytecodeTypes(const jsbytecode *pc) {
         JS_ASSERT(js_CodeSpec[*pc].format & JOF_TYPESET);
         return getCode(pc).observedTypes;
     }
@@ -946,15 +950,15 @@ class ScriptAnalysis
     }
     const SlotValue *newValues(const jsbytecode *pc) { return newValues(pc - script->code); }
 
-    types::TypeSet *pushedTypes(uint32_t offset, uint32_t which = 0) {
+    types::StackTypeSet *pushedTypes(uint32_t offset, uint32_t which = 0) {
         JS_ASSERT(offset < script->length);
         JS_ASSERT(which < GetDefCount(script, offset) +
                   (ExtendedDef(script->code + offset) ? 1 : 0));
-        types::TypeSet *array = getCode(offset).pushedTypes;
+        types::StackTypeSet *array = getCode(offset).pushedTypes;
         JS_ASSERT(array);
         return array + which;
     }
-    types::TypeSet *pushedTypes(const jsbytecode *pc, uint32_t which) {
+    types::StackTypeSet *pushedTypes(const jsbytecode *pc, uint32_t which) {
         return pushedTypes(pc - script->code, which);
     }
 
@@ -988,7 +992,7 @@ class ScriptAnalysis
 
     inline void addPushedType(JSContext *cx, uint32_t offset, uint32_t which, types::Type type);
 
-    types::TypeSet *getValueTypes(const SSAValue &v) {
+    types::StackTypeSet *getValueTypes(const SSAValue &v) {
         switch (v.kind()) {
           case SSAValue::PUSHED:
             return pushedTypes(v.pushedOffset(), v.pushedIndex());
@@ -1014,10 +1018,10 @@ class ScriptAnalysis
         }
     }
 
-    types::TypeSet *poppedTypes(uint32_t offset, uint32_t which) {
+    types::StackTypeSet *poppedTypes(uint32_t offset, uint32_t which) {
         return getValueTypes(poppedValue(offset, which));
     }
-    types::TypeSet *poppedTypes(const jsbytecode *pc, uint32_t which) {
+    types::StackTypeSet *poppedTypes(const jsbytecode *pc, uint32_t which) {
         return getValueTypes(poppedValue(pc, which));
     }
 
@@ -1157,9 +1161,12 @@ class ScriptAnalysis
         Vector<SSAPhiNode *> phiNodes;
         bool hasGetSet;
         bool hasHole;
-        types::TypeSet *forTypes;
+        types::StackTypeSet *forTypes;
+        bool hasPropertyReadTypes;
+        uint32_t propertyReadIndex;
         TypeInferenceState(JSContext *cx)
-            : phiNodes(cx), hasGetSet(false), hasHole(false), forTypes(NULL)
+            : phiNodes(cx), hasGetSet(false), hasHole(false), forTypes(NULL),
+              hasPropertyReadTypes(false), propertyReadIndex(0)
         {}
     };
 
@@ -1269,7 +1276,7 @@ class CrossScriptSSA
         return res;
     }
 
-    types::TypeSet *getValueTypes(const CrossSSAValue &cv) {
+    types::StackTypeSet *getValueTypes(const CrossSSAValue &cv) {
         return getFrame(cv.frame).script->analysis()->getValueTypes(cv.v);
     }
 
diff --git a/js/src/jsapi-tests/Makefile.in b/js/src/jsapi-tests/Makefile.in
index c4bcc09a7d5f..9a2927989ef3 100644
--- a/js/src/jsapi-tests/Makefile.in
+++ b/js/src/jsapi-tests/Makefile.in
@@ -65,6 +65,7 @@ CPPSRCS = \
   testXDR.cpp \
   testProfileStrings.cpp \
   testJSEvaluateScript.cpp \
+  testErrorCopying.cpp \
   $(NULL)
 
 CSRCS = \
diff --git a/js/src/jsapi-tests/testErrorCopying.cpp b/js/src/jsapi-tests/testErrorCopying.cpp
new file mode 100644
index 000000000000..1923879d2763
--- /dev/null
+++ b/js/src/jsapi-tests/testErrorCopying.cpp
@@ -0,0 +1,35 @@
+/* -*- Mode: C++; tab-width: 8; indent-tabs-mode: nil; c-basic-offset: 4 -*-
+ * vim: set ts=8 sw=4 et tw=99:
+ *
+ * Tests that the column number of error reports is properly copied over from
+ * other reports when invoked from the C++ api.
+ */
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+
+#include "tests.h"
+#include "jscntxt.h"
+
+static uint32_t column = 0;
+
+static void
+my_ErrorReporter(JSContext *cx, const char *message, JSErrorReport *report)
+{
+    column = report->column;
+}
+
+BEGIN_TEST(testErrorCopying_columnCopied)
+{
+        //0         1         2
+        //0123456789012345678901234567
+    EXEC("function check() { Object; foo; }");
+
+    JS::RootedValue rval(cx);
+    JS_SetErrorReporter(cx, my_ErrorReporter);
+    CHECK(!JS_CallFunctionName(cx, global, "check", 0, NULL, rval.address()));
+    CHECK(column == 27);
+    return true;
+}
+END_TEST(testErrorCopying_columnCopied)
diff --git a/js/src/jsapi-tests/testScriptInfo.cpp b/js/src/jsapi-tests/testScriptInfo.cpp
index 84dd5ec5fd3f..f3bfe183cc01 100644
--- a/js/src/jsapi-tests/testScriptInfo.cpp
+++ b/js/src/jsapi-tests/testScriptInfo.cpp
@@ -45,7 +45,7 @@ BEGIN_TEST(testScriptInfo)
     jsbytecode *start = JS_LineNumberToPC(cx, script, startLine);
     CHECK_EQUAL(JS_GetScriptBaseLineNumber(cx, script), startLine);
     CHECK_EQUAL(JS_PCToLineNumber(cx, script, start), startLine);
-    CHECK_EQUAL(JS_GetScriptLineExtent(cx, script), 10);
+    CHECK_EQUAL(JS_GetScriptLineExtent(cx, script), 11);
     CHECK(strcmp(JS_GetScriptFilename(cx, script), __FILE__) == 0);
     const jschar *sourceMap = JS_GetScriptSourceMap(cx, script);
     CHECK(sourceMap);
diff --git a/js/src/jsapi.cpp b/js/src/jsapi.cpp
index 9d9ac679855b..5571fc05e37e 100644
--- a/js/src/jsapi.cpp
+++ b/js/src/jsapi.cpp
@@ -807,6 +807,8 @@ JSRuntime::JSRuntime()
     gcCallback(NULL),
     gcSliceCallback(NULL),
     gcFinalizeCallback(NULL),
+    analysisPurgeCallback(NULL),
+    analysisPurgeTriggerBytes(0),
     gcMallocBytes(0),
     gcBlackRootsTraceOp(NULL),
     gcBlackRootsData(NULL),
@@ -2678,10 +2680,10 @@ JS_GetTraceThingInfo(char *buf, size_t bufsize, JSTracer *trc, void *thing,
                 } else if (fun != obj) {
                     JS_snprintf(buf, bufsize, " %p", fun);
                 } else {
-                    if (fun->atom) {
+                    if (fun->displayAtom()) {
                         *buf++ = ' ';
                         bufsize--;
-                        PutEscapedString(buf, bufsize, fun->atom, 0);
+                        PutEscapedString(buf, bufsize, fun->displayAtom(), 0);
                     }
                 }
             } else if (clasp->flags & JSCLASS_HAS_PRIVATE) {
@@ -3062,6 +3064,9 @@ JS_SetGCParameter(JSRuntime *rt, JSGCParamKey key, uint32_t value)
       case JSGC_DYNAMIC_MARK_SLICE:
         rt->gcDynamicMarkSlice = value;
         break;
+      case JSGC_ANALYSIS_PURGE_TRIGGER:
+        rt->analysisPurgeTriggerBytes = value * 1024 * 1024;
+        break;
       default:
         JS_ASSERT(key == JSGC_MODE);
         rt->gcMode = JSGCMode(value);
@@ -3108,6 +3113,8 @@ JS_GetGCParameter(JSRuntime *rt, JSGCParamKey key)
         return rt->gcDynamicHeapGrowth;
       case JSGC_DYNAMIC_MARK_SLICE:
         return rt->gcDynamicMarkSlice;
+      case JSGC_ANALYSIS_PURGE_TRIGGER:
+        return rt->analysisPurgeTriggerBytes / 1024 / 1024;
       default:
         JS_ASSERT(key == JSGC_NUMBER);
         return uint32_t(rt->gcNumber);
@@ -4914,7 +4921,13 @@ JS_GetFunctionObject(JSFunction *fun)
 JS_PUBLIC_API(JSString *)
 JS_GetFunctionId(JSFunction *fun)
 {
-    return fun->atom;
+    return fun->atom();
+}
+
+JS_PUBLIC_API(JSString *)
+JS_GetFunctionDisplayId(JSFunction *fun)
+{
+    return fun->displayAtom();
 }
 
 JS_PUBLIC_API(unsigned)
@@ -7101,7 +7114,8 @@ JS_SetGCZeal(JSContext *cx, uint8_t zeal, uint32_t frequency)
                    "  9: Incremental GC in two slices: 1) mark all 2) new marking and finish\n"
                    " 10: Incremental GC in multiple slices\n"
                    " 11: Verify post write barriers between instructions\n"
-                   " 12: Verify post write barriers between paints\n");
+                   " 12: Verify post write barriers between paints\n"
+                   " 13: Purge analysis state every F allocations (default: 100)\n");
         }
         const char *p = strchr(env, ',');
         zeal = atoi(env);
diff --git a/js/src/jsapi.h b/js/src/jsapi.h
index f6dad795590b..c8ab0f09c61b 100644
--- a/js/src/jsapi.h
+++ b/js/src/jsapi.h
@@ -4096,7 +4096,10 @@ typedef enum JSGCParamKey {
     JSGC_DYNAMIC_HEAP_GROWTH = 17,
 
     /* If true, high-frequency GCs will use a longer mark slice. */
-    JSGC_DYNAMIC_MARK_SLICE = 18
+    JSGC_DYNAMIC_MARK_SLICE = 18,
+
+    /* Number of megabytes of analysis data to allocate before purging. */
+    JSGC_ANALYSIS_PURGE_TRIGGER = 19
 } JSGCParamKey;
 
 typedef enum JSGCMode {
@@ -4971,6 +4974,16 @@ JS_GetFunctionObject(JSFunction *fun);
 extern JS_PUBLIC_API(JSString *)
 JS_GetFunctionId(JSFunction *fun);
 
+/*
+ * Return a function's display name. This is the defined name if one was given
+ * where the function was defined, or it could be an inferred name by the JS
+ * engine in the case that the function was defined to be anonymous. This can
+ * still return NULL if a useful display name could not be inferred. The same
+ * restrictions on rooting as those in JS_GetFunctionId apply.
+ */
+extern JS_PUBLIC_API(JSString *)
+JS_GetFunctionDisplayId(JSFunction *fun);
+
 /*
  * Return JSFUN_* flags for fun.
  */
@@ -6036,6 +6049,7 @@ struct JSErrorReport {
     const jschar    *ucmessage;     /* the (default) error message */
     const jschar    **messageArgs;  /* arguments for the error message */
     int16_t         exnType;        /* One of the JSExnType constants */
+    unsigned           column;         /* zero-based column index in line */
 };
 
 /*
diff --git a/js/src/jsatom.tbl b/js/src/jsatom.tbl
index 90887fb653ef..969790f0478d 100644
--- a/js/src/jsatom.tbl
+++ b/js/src/jsatom.tbl
@@ -43,6 +43,7 @@ DEFINE_ATOM(call, "call")
 DEFINE_ATOM(callee, "callee")
 DEFINE_ATOM(caller, "caller")
 DEFINE_ATOM(classPrototype, "prototype")
+DEFINE_ATOM(columnNumber, "columnNumber")
 DEFINE_ATOM(constructor, "constructor")
 DEFINE_ATOM(each, "each")
 DEFINE_ATOM(eval, "eval")
diff --git a/js/src/jscntxt.cpp b/js/src/jscntxt.cpp
index 73513529d933..51a9fd5f23ad 100644
--- a/js/src/jscntxt.cpp
+++ b/js/src/jscntxt.cpp
@@ -474,7 +474,7 @@ PopulateReportBlame(JSContext *cx, JSErrorReport *report)
         return;
 
     report->filename = iter.script()->filename;
-    report->lineno = PCToLineNumber(iter.script(), iter.pc());
+    report->lineno = PCToLineNumber(iter.script(), iter.pc(), &report->column);
     report->originPrincipals = iter.script()->originPrincipals;
 }
 
@@ -935,7 +935,7 @@ js_ReportMissingArg(JSContext *cx, HandleValue v, unsigned arg)
     JS_snprintf(argbuf, sizeof argbuf, "%u", arg);
     bytes = NULL;
     if (IsFunctionObject(v)) {
-        atom = v.toObject().toFunction()->atom;
+        atom = v.toObject().toFunction()->atom();
         bytes = DecompileValueGenerator(cx, JSDVG_SEARCH_STACK,
                                         v, atom);
         if (!bytes)
diff --git a/js/src/jscntxt.h b/js/src/jscntxt.h
index 0c710fa775b9..0bb6d1c9722e 100644
--- a/js/src/jscntxt.h
+++ b/js/src/jscntxt.h
@@ -566,8 +566,8 @@ struct JSRuntime : js::RuntimeFriendFields
     uintptr_t           gcDisableStrictProxyCheckingCount;
 
     /*
-     * The current incremental GC phase. During non-incremental GC, this is
-     * always NO_INCREMENTAL.
+     * The current incremental GC phase. This is also used internally in
+     * non-incremental GC.
      */
     js::gc::State       gcIncrementalState;
 
@@ -687,6 +687,7 @@ struct JSRuntime : js::RuntimeFriendFields
     bool needZealousGC() {
         if (gcNextScheduled > 0 && --gcNextScheduled == 0) {
             if (gcZeal() == js::gc::ZealAllocValue ||
+                gcZeal() == js::gc::ZealPurgeAnalysisValue ||
                 (gcZeal() >= js::gc::ZealIncrementalRootsThenFinish &&
                  gcZeal() <= js::gc::ZealIncrementalMultipleSlices))
             {
@@ -707,6 +708,9 @@ struct JSRuntime : js::RuntimeFriendFields
     js::GCSliceCallback gcSliceCallback;
     JSFinalizeCallback  gcFinalizeCallback;
 
+    js::AnalysisPurgeCallback analysisPurgeCallback;
+    uint64_t            analysisPurgeTriggerBytes;
+
   private:
     /*
      * Malloc counter to measure memory pressure for GC scheduling. It runs
@@ -1292,6 +1296,7 @@ struct JSContext : js::ContextFriendFields
     bool hasAtLineOption() const { return hasRunOption(JSOPTION_ATLINE); }
 
     js::LifoAlloc &tempLifoAlloc() { return runtime->tempLifoAlloc; }
+    inline js::LifoAlloc &analysisLifoAlloc();
     inline js::LifoAlloc &typeLifoAlloc();
 
     inline js::PropertyTree &propertyTree();
diff --git a/js/src/jscntxtinlines.h b/js/src/jscntxtinlines.h
index 784430e964c0..6acd4f3e8711 100644
--- a/js/src/jscntxtinlines.h
+++ b/js/src/jscntxtinlines.h
@@ -549,6 +549,11 @@ JSContext::setCompileOptions(unsigned newcopts)
     maybeOverrideVersion(newVersion);
 }
 
+inline js::LifoAlloc &
+JSContext::analysisLifoAlloc()
+{
+    return compartment->analysisLifoAlloc;
+}
 
 inline js::LifoAlloc &
 JSContext::typeLifoAlloc()
diff --git a/js/src/jscompartment.cpp b/js/src/jscompartment.cpp
index 1e846eb6b3aa..ea10c30530c1 100644
--- a/js/src/jscompartment.cpp
+++ b/js/src/jscompartment.cpp
@@ -55,7 +55,8 @@ JSCompartment::JSCompartment(JSRuntime *rt)
     hold(false),
     isSystemCompartment(false),
     lastCodeRelease(0),
-    typeLifoAlloc(TYPE_LIFO_ALLOC_PRIMARY_CHUNK_SIZE),
+    analysisLifoAlloc(LIFO_ALLOC_PRIMARY_CHUNK_SIZE),
+    typeLifoAlloc(LIFO_ALLOC_PRIMARY_CHUNK_SIZE),
     data(NULL),
     active(false),
     lastAnimationTime(0),
@@ -445,7 +446,7 @@ JSCompartment::markTypes(JSTracer *trc)
 }
 
 void
-JSCompartment::discardJitCode(FreeOp *fop)
+JSCompartment::discardJitCode(FreeOp *fop, bool discardConstraints)
 {
 #ifdef JS_METHODJIT
 
@@ -483,7 +484,7 @@ JSCompartment::discardJitCode(FreeOp *fop)
             script->resetUseCount();
         }
 
-        types.sweepCompilerOutputs(fop);
+        types.sweepCompilerOutputs(fop, discardConstraints);
     }
 
 #endif /* JS_METHODJIT */
@@ -503,7 +504,7 @@ JSCompartment::sweep(FreeOp *fop, bool releaseTypes)
 {
     {
         gcstats::AutoPhase ap(rt->gcStats, gcstats::PHASE_SWEEP_DISCARD_CODE);
-        discardJitCode(fop);
+        discardJitCode(fop, !activeAnalysis && !gcPreserveCode);
     }
 
     /* This function includes itself in PHASE_SWEEP_TABLES. */
@@ -532,6 +533,7 @@ JSCompartment::sweep(FreeOp *fop, bool releaseTypes)
     }
 
     if (!activeAnalysis && !gcPreserveCode) {
+        JS_ASSERT(!types.constrainedOutputs);
         gcstats::AutoPhase ap(rt->gcStats, gcstats::PHASE_DISCARD_ANALYSIS);
 
         /*
@@ -579,11 +581,13 @@ JSCompartment::sweep(FreeOp *fop, bool releaseTypes)
             for (CellIterUnderGC i(this, FINALIZE_SCRIPT); !i.done(); i.next()) {
                 JSScript *script = i.get<JSScript>();
                 script->clearAnalysis();
+                script->clearPropertyReadTypes();
             }
         }
 
         {
             gcstats::AutoPhase ap2(rt->gcStats, gcstats::PHASE_FREE_TI_ARENA);
+            rt->freeLifoAlloc.transferFrom(&analysisLifoAlloc);
             rt->freeLifoAlloc.transferFrom(&oldAlloc);
         }
     }
diff --git a/js/src/jscompartment.h b/js/src/jscompartment.h
index 673eb3f1f308..2623275303bb 100644
--- a/js/src/jscompartment.h
+++ b/js/src/jscompartment.h
@@ -170,12 +170,14 @@ struct JSCompartment
         return &rt->gcMarker;
     }
 
-  private:
+  public:
     enum CompartmentGCState {
         NoGC,
-        Collecting
+        Mark,
+        Sweep
     };
 
+  private:
     bool                         gcScheduled;
     CompartmentGCState           gcState;
     bool                         gcPreserveCode;
@@ -201,9 +203,9 @@ struct JSCompartment
         return rt->isHeapCollecting() && gcState != NoGC;
     }
 
-    void setCollecting(bool collecting) {
+    void setGCState(CompartmentGCState state) {
         JS_ASSERT(rt->isHeapBusy());
-        gcState = collecting ? Collecting : NoGC;
+        gcState = state;
     }
 
     void scheduleGC() {
@@ -227,8 +229,12 @@ struct JSCompartment
         return gcState != NoGC;
     }
 
+    bool isGCMarking() {
+        return gcState == Mark;
+    }
+
     bool isGCSweeping() {
-        return gcState != NoGC && rt->gcIncrementalState == js::gc::SWEEP;
+        return gcState == Sweep;
     }
 
     size_t                       gcBytes;
@@ -242,13 +248,11 @@ struct JSCompartment
 
     int64_t                      lastCodeRelease;
 
-    /*
-     * Pool for analysis and intermediate type information in this compartment.
-     * Cleared on every GC, unless the GC happens during analysis (indicated
-     * by activeAnalysis, which is implied by activeInference).
-     */
-    static const size_t TYPE_LIFO_ALLOC_PRIMARY_CHUNK_SIZE = 128 * 1024;
+    /* Pools for analysis and type information in this compartment. */
+    static const size_t LIFO_ALLOC_PRIMARY_CHUNK_SIZE = 128 * 1024;
+    js::LifoAlloc                analysisLifoAlloc;
     js::LifoAlloc                typeLifoAlloc;
+
     bool                         activeAnalysis;
     bool                         activeInference;
 
@@ -336,7 +340,7 @@ struct JSCompartment
     bool wrap(JSContext *cx, js::AutoIdVector &props);
 
     void markTypes(JSTracer *trc);
-    void discardJitCode(js::FreeOp *fop);
+    void discardJitCode(js::FreeOp *fop, bool discardConstraints);
     bool isDiscardingJitCode(JSTracer *trc);
     void sweep(js::FreeOp *fop, bool releaseTypes);
     void sweepCrossCompartmentWrappers();
diff --git a/js/src/jsdbgapi.cpp b/js/src/jsdbgapi.cpp
index ba7d7f0aed5e..1d584b8a9739 100644
--- a/js/src/jsdbgapi.cpp
+++ b/js/src/jsdbgapi.cpp
@@ -1004,8 +1004,8 @@ JS_GetFunctionTotalSize(JSContext *cx, JSFunction *fun)
     nbytes += JS_GetObjectTotalSize(cx, fun);
     if (fun->isInterpreted())
         nbytes += JS_GetScriptTotalSize(cx, fun->script());
-    if (fun->atom)
-        nbytes += GetAtomTotalSize(cx, fun->atom);
+    if (fun->displayAtom())
+        nbytes += GetAtomTotalSize(cx, fun->displayAtom());
     return nbytes;
 }
 
diff --git a/js/src/jsexn.cpp b/js/src/jsexn.cpp
index 8fd412c3589e..bf7fcf9b9313 100644
--- a/js/src/jsexn.cpp
+++ b/js/src/jsexn.cpp
@@ -96,6 +96,7 @@ struct JSExnPrivate
     js::HeapPtrString   message;
     js::HeapPtrString   filename;
     unsigned            lineno;
+    unsigned            column;
     size_t              stackDepth;
     int                 exnType;
     JSStackTraceElem    stackElems[1];
@@ -216,6 +217,7 @@ CopyErrorReport(JSContext *cx, JSErrorReport *report)
 
     /* Copy non-pointer members. */
     copy->lineno = report->lineno;
+    copy->column = report->column;
     copy->errorNumber = report->errorNumber;
     copy->exnType = report->exnType;
 
@@ -250,7 +252,8 @@ SetExnPrivate(JSContext *cx, JSObject *exnObject, JSExnPrivate *priv);
 
 static bool
 InitExnPrivate(JSContext *cx, HandleObject exnObject, HandleString message,
-               HandleString filename, unsigned lineno, JSErrorReport *report, int exnType)
+               HandleString filename, unsigned lineno, unsigned column,
+               JSErrorReport *report, int exnType)
 {
     JS_ASSERT(exnObject->isError());
     JS_ASSERT(!exnObject->getPrivate());
@@ -279,7 +282,9 @@ InitExnPrivate(JSContext *cx, HandleObject exnObject, HandleString message,
                 return false;
             JSStackTraceStackElem &frame = frames.back();
             if (i.isNonEvalFunctionFrame()) {
-                JSAtom *atom = fp->fun()->atom ? fp->fun()->atom : cx->runtime->emptyString;
+                JSAtom *atom = fp->fun()->displayAtom();
+                if (atom == NULL)
+                    atom = cx->runtime->emptyString;
                 frame.funName = atom;
             } else {
                 frame.funName = NULL;
@@ -326,6 +331,7 @@ InitExnPrivate(JSContext *cx, HandleObject exnObject, HandleString message,
     priv->message.init(message);
     priv->filename.init(filename);
     priv->lineno = lineno;
+    priv->column = column;
     priv->stackDepth = frames.length();
     priv->exnType = exnType;
     for (size_t i = 0; i < frames.length(); ++i) {
@@ -436,7 +442,15 @@ exn_resolve(JSContext *cx, HandleObject obj, HandleId id, unsigned flags,
         atom = cx->runtime->atomState.lineNumberAtom;
         if (str == atom) {
             prop = js_lineNumber_str;
-            v = INT_TO_JSVAL(priv->lineno);
+            v = UINT_TO_JSVAL(priv->lineno);
+            attrs = JSPROP_ENUMERATE;
+            goto define;
+        }
+
+        atom = cx->runtime->atomState.columnNumberAtom;
+        if (str == atom) {
+            prop = js_columnNumber_str;
+            v = UINT_TO_JSVAL(priv->column);
             attrs = JSPROP_ENUMERATE;
             goto define;
         }
@@ -585,16 +599,16 @@ Exception(JSContext *cx, unsigned argc, Value *vp)
     }
 
     /* Set the 'lineNumber' property. */
-    uint32_t lineno;
+    uint32_t lineno, column = 0;
     if (args.length() > 2) {
         if (!ToUint32(cx, args[2], &lineno))
             return false;
     } else {
-        lineno = iter.done() ? 0 : PCToLineNumber(iter.script(), iter.pc());
+        lineno = iter.done() ? 0 : PCToLineNumber(iter.script(), iter.pc(), &column);
     }
 
     int exnType = args.callee().toFunction()->getExtendedSlot(0).toInt32();
-    if (!InitExnPrivate(cx, obj, message, filename, lineno, NULL, exnType))
+    if (!InitExnPrivate(cx, obj, message, filename, lineno, column, NULL, exnType))
         return false;
 
     args.rval().setObject(*obj);
@@ -791,6 +805,7 @@ InitErrorClass(JSContext *cx, Handle<GlobalObject*> global, int type, HandleObje
     RootedId messageId(cx, NameToId(cx->runtime->atomState.messageAtom));
     RootedId fileNameId(cx, NameToId(cx->runtime->atomState.fileNameAtom));
     RootedId lineNumberId(cx, NameToId(cx->runtime->atomState.lineNumberAtom));
+    RootedId columnNumberId(cx, NameToId(cx->runtime->atomState.columnNumberAtom));
     if (!DefineNativeProperty(cx, errorProto, nameId, nameValue,
                               JS_PropertyStub, JS_StrictPropertyStub, 0, 0, 0) ||
         !DefineNativeProperty(cx, errorProto, messageId, empty,
@@ -798,6 +813,8 @@ InitErrorClass(JSContext *cx, Handle<GlobalObject*> global, int type, HandleObje
         !DefineNativeProperty(cx, errorProto, fileNameId, empty,
                               JS_PropertyStub, JS_StrictPropertyStub, JSPROP_ENUMERATE, 0, 0) ||
         !DefineNativeProperty(cx, errorProto, lineNumberId, zeroValue,
+                              JS_PropertyStub, JS_StrictPropertyStub, JSPROP_ENUMERATE, 0, 0) ||
+        !DefineNativeProperty(cx, errorProto, columnNumberId, zeroValue,
                               JS_PropertyStub, JS_StrictPropertyStub, JSPROP_ENUMERATE, 0, 0))
     {
         return NULL;
@@ -988,7 +1005,7 @@ js_ErrorToException(JSContext *cx, const char *message, JSErrorReport *reportp,
     tv[3] = STRING_TO_JSVAL(filenameStr);
 
     if (!InitExnPrivate(cx, errObject, messageStr, filenameStr,
-                        reportp->lineno, reportp, exn)) {
+                        reportp->lineno, reportp->column, reportp, exn)) {
         return false;
     }
 
@@ -1108,11 +1125,19 @@ js_ReportUncaughtException(JSContext *cx)
             lineno = 0;
         }
 
+        uint32_t column;
+        if (!JS_GetProperty(cx, exnObject, js_columnNumber_str, &roots[5]) ||
+            !ToUint32(cx, roots[5], &column))
+        {
+            column = 0;
+        }
+
         reportp = &report;
         PodZero(&report);
         report.filename = filename.ptr();
         report.lineno = (unsigned) lineno;
         report.exnType = int16_t(JSEXN_NONE);
+        report.column = (unsigned) column;
         if (str) {
             if (JSFixedString *fixed = str->ensureFixed(cx))
                 report.ucmessage = fixed->chars();
@@ -1183,6 +1208,7 @@ js_CopyErrorObject(JSContext *cx, HandleObject errobj, HandleObject scope)
         return NULL;
     JS::Anchor<JSString *> filenameAnchor(copy->filename);
     copy->lineno = priv->lineno;
+    copy->column = priv->column;
     copy->stackDepth = 0;
     copy->exnType = priv->exnType;
 
diff --git a/js/src/jsfriendapi.cpp b/js/src/jsfriendapi.cpp
index 46b6b1985100..9c0a1db22aa0 100644
--- a/js/src/jsfriendapi.cpp
+++ b/js/src/jsfriendapi.cpp
@@ -798,6 +798,14 @@ GCDescription::formatJSON(JSRuntime *rt, uint64_t timestamp) const
     return rt->gcStats.formatJSON(timestamp);
 }
 
+JS_FRIEND_API(AnalysisPurgeCallback)
+SetAnalysisPurgeCallback(JSRuntime *rt, AnalysisPurgeCallback callback)
+{
+    AnalysisPurgeCallback old = rt->analysisPurgeCallback;
+    rt->analysisPurgeCallback = callback;
+    return old;
+}
+
 JS_FRIEND_API(void)
 NotifyDidPaint(JSRuntime *rt)
 {
diff --git a/js/src/jsfriendapi.h b/js/src/jsfriendapi.h
index 1b11b6853a4c..f755238a2c28 100644
--- a/js/src/jsfriendapi.h
+++ b/js/src/jsfriendapi.h
@@ -799,6 +799,12 @@ typedef void
 extern JS_FRIEND_API(GCSliceCallback)
 SetGCSliceCallback(JSRuntime *rt, GCSliceCallback callback);
 
+typedef void
+(* AnalysisPurgeCallback)(JSRuntime *rt, JSFlatString *desc);
+
+extern JS_FRIEND_API(AnalysisPurgeCallback)
+SetAnalysisPurgeCallback(JSRuntime *rt, AnalysisPurgeCallback callback);
+
 /* Was the most recent GC run incrementally? */
 extern JS_FRIEND_API(bool)
 WasIncrementalGC(JSRuntime *rt);
@@ -806,7 +812,6 @@ WasIncrementalGC(JSRuntime *rt);
 typedef JSBool
 (* DOMInstanceClassMatchesProto)(JSHandleObject protoObject, uint32_t protoID,
                                  uint32_t depth);
-
 struct JSDOMCallbacks {
     DOMInstanceClassMatchesProto instanceClassMatchesProto;
 };
diff --git a/js/src/jsfun.cpp b/js/src/jsfun.cpp
index 7ec8df761f23..39871b59e302 100644
--- a/js/src/jsfun.cpp
+++ b/js/src/jsfun.cpp
@@ -296,7 +296,7 @@ fun_resolve(JSContext *cx, HandleObject obj, HandleId id, unsigned flags,
         if (JSID_IS_ATOM(id, cx->runtime->atomState.lengthAtom))
             v.setInt32(fun->nargs - fun->hasRest());
         else
-            v.setString(fun->atom ? fun->atom : cx->runtime->emptyString);
+            v.setString(fun->atom() == NULL ?  cx->runtime->emptyString : fun->atom());
 
         if (!DefineNativeProperty(cx, fun, id, v, JS_PropertyStub, JS_StrictPropertyStub,
                                   JSPROP_PERMANENT | JSPROP_READONLY, 0, 0)) {
@@ -364,9 +364,9 @@ js::XDRInterpretedFunction(XDRState<mode> *xdr, HandleObject enclosingScope, Han
             }
             return false;
         }
-        firstword = !!fun->atom;
+        firstword = !!fun->atom();
         flagsword = (fun->nargs << 16) | fun->flags;
-        atom = fun->atom;
+        atom = fun->atom();
         script = fun->script();
     } else {
         RootedObject parent(cx, NULL);
@@ -394,7 +394,7 @@ js::XDRInterpretedFunction(XDRState<mode> *xdr, HandleObject enclosingScope, Han
     if (mode == XDR_DECODE) {
         fun->nargs = flagsword >> 16;
         fun->flags = uint16_t(flagsword);
-        fun->atom.init(atom);
+        fun->initAtom(atom);
         fun->initScript(script);
         script->setFunction(fun);
         if (!JSFunction::setTypeForScriptedFunction(cx, fun))
@@ -434,7 +434,7 @@ js::CloneInterpretedFunction(JSContext *cx, HandleObject enclosingScope, HandleF
 
     clone->nargs = srcFun->nargs;
     clone->flags = srcFun->flags;
-    clone->atom.init(srcFun->atom);
+    clone->initAtom(srcFun->displayAtom());
     clone->initScript(clonedScript);
     clonedScript->setFunction(clone);
     if (!JSFunction::setTypeForScriptedFunction(cx, clone))
@@ -486,8 +486,8 @@ JSFunction::trace(JSTracer *trc)
                        toExtended()->extendedSlots, "nativeReserved");
     }
 
-    if (atom)
-        MarkString(trc, &atom, "atom");
+    if (atom_)
+        MarkString(trc, &atom_, "atom");
 
     if (isInterpreted()) {
         if (u.i.script_)
@@ -601,8 +601,8 @@ js::FunctionToString(JSContext *cx, HandleFunction fun, bool bodyOnly, bool lamb
         }
         if (!out.append("function "))
             return NULL;
-        if (fun->atom) {
-            if (!out.append(fun->atom))
+        if (fun->atom()) {
+            if (!out.append(fun->atom()))
                 return NULL;
         }
     }
@@ -1105,7 +1105,7 @@ js_fun_bind(JSContext *cx, HandleObject target, HandleValue thisArg,
     }
 
     /* Step 4-6, 10-11. */
-    JSAtom *name = target->isFunction() ? target->toFunction()->atom.get() : NULL;
+    JSAtom *name = target->isFunction() ? target->toFunction()->atom() : NULL;
 
     RootedObject funobj(cx, js_NewFunction(cx, NULL, CallOrConstructBoundFunction, length,
                                            JSFUN_CONSTRUCTOR, target, name));
@@ -1392,7 +1392,7 @@ js_NewFunction(JSContext *cx, JSObject *funobj, Native native, unsigned nargs,
         fun->flags |= JSFUN_EXTENDED;
         fun->initializeExtended();
     }
-    fun->atom.init(atom);
+    fun->initAtom(atom);
 
     if (native && !JSObject::setSingletonType(cx, fun))
         return NULL;
@@ -1421,7 +1421,7 @@ js_CloneFunctionObject(JSContext *cx, HandleFunction fun, HandleObject parent,
     } else {
         clone->initNative(fun->native(), fun->jitInfo());
     }
-    clone->atom.init(fun->atom);
+    clone->initAtom(fun->displayAtom());
 
     if (kind == JSFunction::ExtendedFinalizeKind) {
         clone->flags |= JSFUN_EXTENDED;
@@ -1515,7 +1515,7 @@ js_DefineFunction(JSContext *cx, HandleObject obj, HandleId id, Native native,
     } else {
         JS_ASSERT(attrs & JSFUN_INTERPRETED);
         fun = cx->runtime->getSelfHostedFunction(cx, selfHostedName);
-        fun->atom = JSID_TO_ATOM(id);
+        fun->initAtom(JSID_TO_ATOM(id));
     }
     if (!fun)
         return NULL;
diff --git a/js/src/jsfun.h b/js/src/jsfun.h
index e4d9c6f23ed5..53d191957a73 100644
--- a/js/src/jsfun.h
+++ b/js/src/jsfun.h
@@ -45,6 +45,9 @@
  */
 #define JSFUN_INTERPRETED   0x4000  /* use u.i if kind >= this value else u.native */
 
+#define JSFUN_HAS_GUESSED_ATOM  0x8000  /* function had no explicit name, but a
+                                           name was guessed for it anyway */
+
 namespace js { class FunctionExtended; }
 
 struct JSFunction : public JSObject
@@ -68,10 +71,13 @@ struct JSFunction : public JSObject
         } i;
         void            *nativeOrScript;
     } u;
-    js::HeapPtrAtom  atom;        /* name for diagnostics and decompiling */
+  private:
+    js::HeapPtrAtom  atom_;       /* name for diagnostics and decompiling */
+  public:
 
     bool hasDefaults()       const { return flags & JSFUN_HAS_DEFAULTS; }
     bool hasRest()           const { return flags & JSFUN_HAS_REST; }
+    bool hasGuessedAtom()    const { return flags & JSFUN_HAS_GUESSED_ATOM; }
     bool isInterpreted()     const { return flags & JSFUN_INTERPRETED; }
     bool isNative()          const { return !isInterpreted(); }
     bool isSelfHostedBuiltin()  const { return flags & JSFUN_SELF_HOSTED; }
@@ -81,7 +87,9 @@ struct JSFunction : public JSObject
     bool isInterpretedConstructor() const {
         return isInterpreted() && !isFunctionPrototype() && !isSelfHostedBuiltin();
     }
-    bool isNamedLambda()     const { return (flags & JSFUN_LAMBDA) && atom; }
+    bool isNamedLambda()     const {
+        return (flags & JSFUN_LAMBDA) && atom_ && !hasGuessedAtom();
+    }
 
     /* Returns the strictness of this function, which must be interpreted. */
     inline bool inStrictMode() const;
@@ -101,6 +109,18 @@ struct JSFunction : public JSObject
         this->flags |= JSFUN_HAS_DEFAULTS;
     }
 
+    JSAtom *atom() { return hasGuessedAtom() ? NULL : atom_.get(); }
+    void initAtom(JSAtom *atom) { atom_.init(atom); }
+    JSAtom *displayAtom() { return atom_; }
+
+    void setGuessedAtom(JSAtom *atom) {
+        JS_ASSERT(this->atom_ == NULL);
+        JS_ASSERT(atom != NULL);
+        JS_ASSERT(!hasGuessedAtom());
+        this->atom_ = atom;
+        this->flags |= JSFUN_HAS_GUESSED_ATOM;
+    }
+
     /* uint16_t representation bounds number of call object dynamic slots. */
     enum { MAX_ARGS_AND_VARS = 2 * ((1U << 16) - 1) };
 
diff --git a/js/src/jsfuninlines.h b/js/src/jsfuninlines.h
index 766c92bad76f..729638d347de 100644
--- a/js/src/jsfuninlines.h
+++ b/js/src/jsfuninlines.h
@@ -182,8 +182,9 @@ IsConstructing(CallReceiver call)
 inline const char *
 GetFunctionNameBytes(JSContext *cx, JSFunction *fun, JSAutoByteString *bytes)
 {
-    if (fun->atom)
-        return bytes->encode(cx, fun->atom);
+    JSAtom *atom = fun->atom();
+    if (atom)
+        return bytes->encode(cx, atom);
     return js_anonymous_str;
 }
 
diff --git a/js/src/jsgc.cpp b/js/src/jsgc.cpp
index 24bb10aab440..f5cbc62cdd12 100644
--- a/js/src/jsgc.cpp
+++ b/js/src/jsgc.cpp
@@ -2842,8 +2842,9 @@ SweepBackgroundThings(JSRuntime* rt, bool onBackgroundThread)
     }
 }
 
+#ifdef JS_THREADSAFE
 static void
-AssertBackgroundSweepingFinshed(JSRuntime *rt)
+AssertBackgroundSweepingFinished(JSRuntime *rt)
 {
     for (CompartmentsIter c(rt); !c.done(); c.next()) {
         JS_ASSERT(!c->gcNextCompartment);
@@ -2854,7 +2855,6 @@ AssertBackgroundSweepingFinshed(JSRuntime *rt)
     }
 }
 
-#ifdef JS_THREADSAFE
 static unsigned
 GetCPUCount()
 {
@@ -3040,7 +3040,7 @@ GCHelperThread::waitBackgroundSweepEnd()
     while (state == SWEEPING)
         PR_WaitCondVar(done, PR_INTERVAL_NO_TIMEOUT);
     if (rt->gcIncrementalState == NO_INCREMENTAL)
-        AssertBackgroundSweepingFinshed(rt);
+        AssertBackgroundSweepingFinished(rt);
 #else
     JS_ASSERT(state == IDLE);
 #endif /* JS_THREADSAFE */
@@ -3056,7 +3056,7 @@ GCHelperThread::waitBackgroundSweepOrAllocEnd()
     while (state == SWEEPING || state == CANCEL_ALLOCATION)
         PR_WaitCondVar(done, PR_INTERVAL_NO_TIMEOUT);
     if (rt->gcIncrementalState == NO_INCREMENTAL)
-        AssertBackgroundSweepingFinshed(rt);
+        AssertBackgroundSweepingFinished(rt);
 #else
     JS_ASSERT(state == IDLE);
 #endif /* JS_THREADSAFE */
@@ -3241,8 +3241,8 @@ BeginMarkPhase(JSRuntime *rt)
         /* Set up which compartments will be collected. */
         if (c->isGCScheduled()) {
             any = true;
-            if (c.get() != rt->atomsCompartment)
-                c->setCollecting(true);
+            if (c != rt->atomsCompartment)
+                c->setGCState(JSCompartment::Mark);
         } else {
             rt->gcIsFull = false;
         }
@@ -3260,7 +3260,7 @@ BeginMarkPhase(JSRuntime *rt)
      * to atoms that we would miss.
      */
     if (rt->atomsCompartment->isGCScheduled() && rt->gcIsFull && !rt->gcKeepAtoms)
-        rt->atomsCompartment->setCollecting(true);
+        rt->atomsCompartment->setGCState(JSCompartment::Mark);
 
     /*
      * At the end of each incremental slice, we call prepareForIncrementalGC,
@@ -3282,7 +3282,7 @@ BeginMarkPhase(JSRuntime *rt)
     if (rt->gcIsIncremental) {
         for (GCCompartmentsIter c(rt); !c.done(); c.next()) {
             gcstats::AutoPhase ap(rt->gcStats, gcstats::PHASE_MARK_DISCARD_CODE);
-            c->discardJitCode(rt->defaultFreeOp());
+            c->discardJitCode(rt->defaultFreeOp(), false);
         }
     }
 
@@ -3418,8 +3418,6 @@ EndMarkPhase(JSRuntime *rt)
         }
     }
 
-    rt->gcMarker.stop();
-
     /* We do not discard JIT here code as the following sweeping does that. */
 }
 
@@ -3678,8 +3676,12 @@ BeginSweepPhase(JSRuntime *rt)
      */
     bool isFull = true;
     for (CompartmentsIter c(rt); !c.done(); c.next()) {
-        if (!c->isCollecting())
+        if (c->isCollecting()) {
+            if (c != rt->atomsCompartment)
+                c->setGCState(JSCompartment::Sweep);
+        } else {
             isFull = false;
+        }
     }
     JS_ASSERT_IF(isFull, rt->gcIsFull);
 
@@ -3688,8 +3690,10 @@ BeginSweepPhase(JSRuntime *rt)
 #endif
 
     /* Purge the ArenaLists before sweeping. */
-    for (GCCompartmentsIter c(rt); !c.done(); c.next())
-        c->arenas.purge();
+    for (GCCompartmentsIter c(rt); !c.done(); c.next()) {
+        if (c->isGCSweeping())
+            c->arenas.purge();
+    }
 
     FreeOp fop(rt, rt->gcSweepOnBackgroundThread);
 
@@ -3703,11 +3707,6 @@ BeginSweepPhase(JSRuntime *rt)
     WeakMapBase::sweepAll(&rt->gcMarker);
     rt->debugScopes->sweep();
 
-    if (rt->atomsCompartment->wasGCStarted()) {
-        gcstats::AutoPhase ap2(rt->gcStats, gcstats::PHASE_SWEEP_ATOMS);
-        SweepAtomState(rt);
-    }
-
     /* Collect watch points associated with unreachable objects. */
     WatchpointMap::sweepAll(rt);
 
@@ -3746,20 +3745,28 @@ BeginSweepPhase(JSRuntime *rt)
      * Objects are finalized immediately but this may change in the future.
      */
     for (GCCompartmentsIter c(rt); !c.done(); c.next()) {
-        gcstats::AutoSCC scc(rt->gcStats, partition.getSCC(c));
-        c->arenas.queueObjectsForSweep(&fop);
+        if (c->isGCSweeping()) {
+            gcstats::AutoSCC scc(rt->gcStats, partition.getSCC(c));
+            c->arenas.queueObjectsForSweep(&fop);
+        }
     }
     for (GCCompartmentsIter c(rt); !c.done(); c.next()) {
-        gcstats::AutoSCC scc(rt->gcStats, partition.getSCC(c));
-        c->arenas.queueStringsForSweep(&fop);
+        if (c->isGCSweeping()) {
+            gcstats::AutoSCC scc(rt->gcStats, partition.getSCC(c));
+            c->arenas.queueStringsForSweep(&fop);
+        }
     }
     for (GCCompartmentsIter c(rt); !c.done(); c.next()) {
-        gcstats::AutoSCC scc(rt->gcStats, partition.getSCC(c));
-        c->arenas.queueScriptsForSweep(&fop);
+        if (c->isGCSweeping()) {
+            gcstats::AutoSCC scc(rt->gcStats, partition.getSCC(c));
+            c->arenas.queueScriptsForSweep(&fop);
+        }
     }
     for (GCCompartmentsIter c(rt); !c.done(); c.next()) {
-        gcstats::AutoSCC scc(rt->gcStats, partition.getSCC(c));
-        c->arenas.queueShapesForSweep(&fop);
+        if (c->isGCSweeping()) {
+            gcstats::AutoSCC scc(rt->gcStats, partition.getSCC(c));
+            c->arenas.queueShapesForSweep(&fop);
+        }
     }
 
     rt->gcSweepPhase = 0;
@@ -3813,12 +3820,37 @@ SweepPhase(JSRuntime *rt, SliceBudget &sliceBudget)
     return true;
 }
 
+static void
+SweepAtomsCompartment(JSRuntime *rt)
+{
+    JSCompartment *c = rt->atomsCompartment;
+
+    JS_ASSERT(rt->gcMarker.isDrained());
+
+    JS_ASSERT(c->isGCMarking());
+    c->setGCState(JSCompartment::Sweep);
+
+    c->arenas.purge();
+
+    {
+        gcstats::AutoPhase ap2(rt->gcStats, gcstats::PHASE_SWEEP_ATOMS);
+        SweepAtomState(rt);
+    }
+
+    FreeOp fop(rt, rt->gcSweepOnBackgroundThread);
+
+    c->arenas.queueStringsForSweep(&fop);
+}
+
 static void
 EndSweepPhase(JSRuntime *rt, JSGCInvocationKind gckind, gcreason::Reason gcReason)
 {
     gcstats::AutoPhase ap(rt->gcStats, gcstats::PHASE_SWEEP);
     FreeOp fop(rt, rt->gcSweepOnBackgroundThread);
 
+    JS_ASSERT(rt->gcMarker.isDrained());
+    rt->gcMarker.stop();
+
 #ifdef DEBUG
     PropertyTree::dumpShapes(rt);
 #endif
@@ -3876,7 +3908,7 @@ EndSweepPhase(JSRuntime *rt, JSGCInvocationKind gckind, gcreason::Reason gcReaso
     for (CompartmentsIter c(rt); !c.done(); c.next()) {
         c->setGCLastBytes(c->gcBytes, c->gcMallocAndFreeBytes, gckind);
         if (c->wasGCStarted())
-            c->setCollecting(false);
+            c->setGCState(JSCompartment::NoGC);
 
         JS_ASSERT(!c->isCollecting());
         JS_ASSERT(!c->wasGCStarted());
@@ -3973,32 +4005,44 @@ ResetIncrementalGC(JSRuntime *rt, const char *reason)
     if (rt->gcIncrementalState == NO_INCREMENTAL)
         return;
 
-    if (rt->gcIncrementalState == SWEEP) {
-        /* If we've finished marking then sweep to completion here. */
+    /* Cancel and ongoing marking. */
+    bool wasMarking = false;
+    for (GCCompartmentsIter c(rt); !c.done(); c.next()) {
+        if (c->isGCMarking()) {
+            c->setNeedsBarrier(false);
+            c->setGCState(JSCompartment::NoGC);
+            wasMarking = true;
+        }
+    }
+
+    if (wasMarking)
+        rt->gcMarker.reset();
+
+    if (rt->gcIncrementalState >= SWEEP) {
+        /* If we had started sweeping then sweep to completion here. */
         IncrementalCollectSlice(rt, SliceBudget::Unlimited, gcreason::RESET, GC_NORMAL);
         gcstats::AutoPhase ap(rt->gcStats, gcstats::PHASE_WAIT_BACKGROUND_THREAD);
         rt->gcHelperThread.waitBackgroundSweepOrAllocEnd();
-        return;
+    } else {
+        JS_ASSERT(rt->gcIncrementalState == MARK);
+        rt->gcIncrementalState = NO_INCREMENTAL;
+
+        rt->gcMarker.stop();
+
+        JS_ASSERT(!rt->gcStrictCompartmentChecking);
+
+        rt->gcStats.reset(reason);
     }
 
-    JS_ASSERT(rt->gcIncrementalState == MARK);
-
-    for (CompartmentsIter c(rt); !c.done(); c.next()) {
-        c->setNeedsBarrier(false);
-        c->setCollecting(false);
+#ifdef DEBUG
+    for (GCCompartmentsIter c(rt); !c.done(); c.next()) {
+        JS_ASSERT(c->isCollecting());
+        JS_ASSERT(!c->needsBarrier());
         JS_ASSERT(!c->gcNextCompartment);
         for (unsigned i = 0 ; i < FINALIZE_LIMIT ; ++i)
             JS_ASSERT(!c->arenas.arenaListsToSweep[i]);
     }
-
-    rt->gcMarker.reset();
-    rt->gcMarker.stop();
-
-    rt->gcIncrementalState = NO_INCREMENTAL;
-
-    JS_ASSERT(!rt->gcStrictCompartmentChecking);
-
-    rt->gcStats.reset(reason);
+#endif
 }
 
 class AutoGCSlice {
@@ -4023,7 +4067,7 @@ AutoGCSlice::AutoGCSlice(JSRuntime *rt)
 
     for (GCCompartmentsIter c(rt); !c.done(); c.next()) {
         /* Clear this early so we don't do any write barriers during GC. */
-        if (rt->gcIncrementalState == MARK) {
+        if (c->isGCMarking()) {
             JS_ASSERT(c->needsBarrier());
             c->setNeedsBarrier(false);
         } else {
@@ -4035,12 +4079,11 @@ AutoGCSlice::AutoGCSlice(JSRuntime *rt)
 AutoGCSlice::~AutoGCSlice()
 {
     for (GCCompartmentsIter c(runtime); !c.done(); c.next()) {
-        if (runtime->gcIncrementalState == MARK) {
+        if (c->isGCMarking()) {
             c->setNeedsBarrier(true);
             c->arenas.prepareForIncrementalGC(runtime);
         } else {
-            JS_ASSERT(runtime->gcIncrementalState == NO_INCREMENTAL ||
-                      runtime->gcIncrementalState == SWEEP);
+            JS_ASSERT(c->isGCSweeping());
             c->setNeedsBarrier(false);
         }
     }
@@ -4107,8 +4150,7 @@ IncrementalCollectSlice(JSRuntime *rt,
     }
 #endif
 
-    rt->gcIsIncremental = rt->gcIncrementalState != NO_INCREMENTAL ||
-                          budget != SliceBudget::Unlimited;
+    rt->gcIsIncremental = budget != SliceBudget::Unlimited;
 
     if (zeal == ZealIncrementalRootsThenFinish || zeal == ZealIncrementalMarkAllThenFinish) {
         /*
@@ -4184,14 +4226,25 @@ IncrementalCollectSlice(JSRuntime *rt,
       }
 
       case SWEEP: {
-#ifdef DEBUG
-        for (CompartmentsIter c(rt); !c.done(); c.next())
-            JS_ASSERT(!c->needsBarrier());
-#endif
-
         bool finished = SweepPhase(rt, sliceBudget);
         if (!finished)
             break;
+        rt->gcIncrementalState = SWEEP_END;
+
+        if (rt->gcIsIncremental)
+            break;
+      }
+
+      case SWEEP_END:
+        if (rt->atomsCompartment->isGCMarking()) {
+            bool finished = DrainMarkStack(rt, sliceBudget);
+            if (!finished)
+                break;
+
+            SweepAtomsCompartment(rt);
+            if (rt->gcIsIncremental)
+                break;
+        }
 
         EndSweepPhase(rt, gckind, reason);
 
@@ -4200,7 +4253,6 @@ IncrementalCollectSlice(JSRuntime *rt,
 
         rt->gcIncrementalState = NO_INCREMENTAL;
         break;
-      }
 
       default:
         JS_ASSERT(false);
@@ -4741,6 +4793,9 @@ RunDebugGC(JSContext *cx)
         {
             rt->gcIncrementalLimit = rt->gcZealFrequency / 2;
         }
+    } else if (type == ZealPurgeAnalysisValue) {
+        if (!cx->compartment->activeAnalysis)
+            cx->compartment->types.maybePurgeAnalysis(cx, /* force = */ true);
     } else {
         Collect(rt, false, SliceBudget::Unlimited, GC_NORMAL, gcreason::DEBUG_GC);
     }
diff --git a/js/src/jsgc.h b/js/src/jsgc.h
index 4bf3183c4392..0f421fa840dd 100644
--- a/js/src/jsgc.h
+++ b/js/src/jsgc.h
@@ -50,6 +50,7 @@ enum State {
     MARK_ROOTS,
     MARK,
     SWEEP,
+    SWEEP_END,
     INVALID
 };
 
@@ -1164,6 +1165,7 @@ const int ZealIncrementalMarkAllThenFinish = 9;
 const int ZealIncrementalMultipleSlices = 10;
 const int ZealVerifierPostValue = 11;
 const int ZealFrameVerifierPostValue = 12;
+const int ZealPurgeAnalysisValue = 13;
 
 enum VerifierType {
     PreBarrierVerifier,
diff --git a/js/src/jsinfer.cpp b/js/src/jsinfer.cpp
index 733bdac81039..0beb22aefa7a 100644
--- a/js/src/jsinfer.cpp
+++ b/js/src/jsinfer.cpp
@@ -330,22 +330,48 @@ types::TypeFailure(JSContext *cx, const char *fmt, ...)
 // TypeSet
 /////////////////////////////////////////////////////////////////////
 
-TypeSet *
-TypeSet::make(JSContext *cx, const char *name)
+inline void
+TypeSet::addTypesToConstraint(JSContext *cx, TypeConstraint *constraint)
 {
-    JS_ASSERT(cx->compartment->activeInference);
+    /*
+     * Build all types in the set into a vector before triggering the
+     * constraint, as doing so may modify this type set.
+     */
+    Vector<Type> types(cx);
 
-    TypeSet *res = cx->typeLifoAlloc().new_<TypeSet>();
-    if (!res) {
-        cx->compartment->types.setPendingNukeTypes(cx);
-        return NULL;
+    /* If any type is possible, there's no need to worry about specifics. */
+    if (flags & TYPE_FLAG_UNKNOWN) {
+        if (!types.append(Type::UnknownType()))
+            cx->compartment->types.setPendingNukeTypes(cx);
+    } else {
+        /* Enqueue type set members stored as bits. */
+        for (TypeFlags flag = 1; flag < TYPE_FLAG_ANYOBJECT; flag <<= 1) {
+            if (flags & flag) {
+                Type type = Type::PrimitiveType(TypeFlagPrimitive(flag));
+                if (!types.append(type))
+                    cx->compartment->types.setPendingNukeTypes(cx);
+            }
+        }
+
+        /* If any object is possible, skip specifics. */
+        if (flags & TYPE_FLAG_ANYOBJECT) {
+            if (!types.append(Type::AnyObjectType()))
+                cx->compartment->types.setPendingNukeTypes(cx);
+        } else {
+            /* Enqueue specific object types. */
+            unsigned count = getObjectCount();
+            for (unsigned i = 0; i < count; i++) {
+                TypeObjectKey *object = getObject(i);
+                if (object) {
+                    if (!types.append(Type::ObjectType(object)))
+                        cx->compartment->types.setPendingNukeTypes(cx);
+                }
+            }
+        }
     }
 
-    InferSpew(ISpewOps, "typeSet: %sT%p%s intermediate %s",
-              InferSpewColor(res), res, InferSpewColorReset(),
-              name);
-
-    return res;
+    for (unsigned i = 0; i < types.length(); i++)
+        constraint->newType(cx, this, types[i]);
 }
 
 inline void
@@ -368,37 +394,8 @@ TypeSet::add(JSContext *cx, TypeConstraint *constraint, bool callExisting)
     constraint->next = constraintList;
     constraintList = constraint;
 
-    if (!callExisting)
-        return;
-
-    /* If any type is possible, there's no need to worry about specifics. */
-    if (flags & TYPE_FLAG_UNKNOWN) {
-        cx->compartment->types.addPending(cx, constraint, this, Type::UnknownType());
-    } else {
-        /* Enqueue type set members stored as bits. */
-        for (TypeFlags flag = 1; flag < TYPE_FLAG_ANYOBJECT; flag <<= 1) {
-            if (flags & flag) {
-                Type type = Type::PrimitiveType(TypeFlagPrimitive(flag));
-                cx->compartment->types.addPending(cx, constraint, this, type);
-            }
-        }
-
-        /* If any object is possible, skip specifics. */
-        if (flags & TYPE_FLAG_ANYOBJECT) {
-            cx->compartment->types.addPending(cx, constraint, this, Type::AnyObjectType());
-        } else {
-            /* Enqueue specific object types. */
-            unsigned count = getObjectCount();
-            for (unsigned i = 0; i < count; i++) {
-                TypeObjectKey *object = getObject(i);
-                if (object)
-                    cx->compartment->types.addPending(cx, constraint, this,
-                                                      Type::ObjectType(object));
-            }
-        }
-    }
-
-    cx->compartment->types.resolvePending(cx);
+    if (callExisting)
+        addTypesToConstraint(cx, constraint);
 }
 
 void
@@ -409,7 +406,7 @@ TypeSet::print(JSContext *cx)
     if (flags & TYPE_FLAG_CONFIGURED_PROPERTY)
         printf(" [configured]");
 
-    if (isDefiniteProperty())
+    if (definiteProperty())
         printf(" [definite:%d]", definiteSlot());
 
     if (baseFlags() == 0 && !baseObjectCount()) {
@@ -450,31 +447,23 @@ TypeSet::print(JSContext *cx)
     }
 }
 
-bool
-TypeSet::propertyNeedsBarrier(JSContext *cx, jsid id)
+StackTypeSet *
+StackTypeSet::make(JSContext *cx, const char *name)
 {
-    id = MakeTypeId(cx, id);
+    JS_ASSERT(cx->compartment->activeInference);
 
-    if (unknownObject())
-        return true;
-
-    for (unsigned i = 0; i < getObjectCount(); i++) {
-        if (getSingleObject(i))
-            return true;
-
-        if (types::TypeObject *otype = getTypeObject(i)) {
-            if (otype->unknownProperties())
-                return true;
-
-            if (types::TypeSet *propTypes = otype->maybeGetProperty(cx, id)) {
-                if (propTypes->needsBarrier(cx))
-                    return true;
-            }
-        }
+    StackTypeSet *res = cx->analysisLifoAlloc().new_<StackTypeSet>();
+    if (!res) {
+        cx->compartment->types.setPendingNukeTypes(cx);
+        return NULL;
     }
 
-    addFreeze(cx);
-    return false;
+    InferSpew(ISpewOps, "typeSet: %sT%p%s intermediate %s",
+              InferSpewColor(res), res, InferSpewColorReset(),
+              name);
+    res->setPurged();
+
+    return res;
 }
 
 /////////////////////////////////////////////////////////////////////
@@ -488,11 +477,13 @@ public:
     TypeSet *target;
 
     TypeConstraintSubset(TypeSet *target)
-        : TypeConstraint("subset"), target(target)
+        : target(target)
     {
         JS_ASSERT(target);
     }
 
+    const char *kind() { return "subset"; }
+
     void newType(JSContext *cx, TypeSet *source, Type type)
     {
         /* Basic subset constraint, move all types to the target. */
@@ -501,12 +492,26 @@ public:
 };
 
 void
-TypeSet::addSubset(JSContext *cx, TypeSet *target)
+StackTypeSet::addSubset(JSContext *cx, TypeSet *target)
 {
+    add(cx, cx->analysisLifoAlloc().new_<TypeConstraintSubset>(target));
+}
+
+void
+HeapTypeSet::addSubset(JSContext *cx, TypeSet *target)
+{
+    JS_ASSERT(!target->purged());
     add(cx, cx->typeLifoAlloc().new_<TypeConstraintSubset>(target));
 }
 
+enum PropertyAccessKind {
+    PROPERTY_WRITE,
+    PROPERTY_READ,
+    PROPERTY_READ_EXISTING
+};
+
 /* Constraints for reads/writes on object properties. */
+template <PropertyAccessKind access>
 class TypeConstraintProp : public TypeConstraint
 {
 public:
@@ -517,35 +522,52 @@ public:
      * If assign is true, the target is used to update a property of the object.
      * If assign is false, the target is assigned the value of the property.
      */
-    bool assign;
-    TypeSet *target;
+    StackTypeSet *target;
 
     /* Property being accessed. */
     jsid id;
 
-    TypeConstraintProp(JSScript *script, jsbytecode *pc,
-                       TypeSet *target, jsid id, bool assign)
-        : TypeConstraint("prop"), script(script), pc(pc),
-          assign(assign), target(target), id(id)
+    TypeConstraintProp(JSScript *script, jsbytecode *pc, StackTypeSet *target, jsid id)
+        : script(script), pc(pc), target(target), id(id)
     {
         JS_ASSERT(script && pc && target);
     }
 
+    const char *kind() { return "prop"; }
+
     void newType(JSContext *cx, TypeSet *source, Type type);
 };
 
+typedef TypeConstraintProp<PROPERTY_WRITE> TypeConstraintSetProperty;
+typedef TypeConstraintProp<PROPERTY_READ>  TypeConstraintGetProperty;
+typedef TypeConstraintProp<PROPERTY_READ_EXISTING> TypeConstraintGetPropertyExisting;
+
 void
-TypeSet::addGetProperty(JSContext *cx, JSScript *script, jsbytecode *pc,
-                        TypeSet *target, jsid id)
+StackTypeSet::addGetProperty(JSContext *cx, JSScript *script, jsbytecode *pc,
+                             StackTypeSet *target, jsid id)
 {
-    add(cx, cx->typeLifoAlloc().new_<TypeConstraintProp>(script, pc, target, id, false));
+    /*
+     * GetProperty constraints are normally used with property read input type
+     * sets, except for array_pop/array_shift special casing.
+     */
+    JS_ASSERT(js_CodeSpec[*pc].format & JOF_INVOKE);
+
+    add(cx, cx->analysisLifoAlloc().new_<TypeConstraintGetProperty>(script, pc, target, id));
 }
 
 void
-TypeSet::addSetProperty(JSContext *cx, JSScript *script, jsbytecode *pc,
-                        TypeSet *target, jsid id)
+StackTypeSet::addSetProperty(JSContext *cx, JSScript *script, jsbytecode *pc,
+                             StackTypeSet *target, jsid id)
 {
-    add(cx, cx->typeLifoAlloc().new_<TypeConstraintProp>(script, pc, target, id, true));
+    add(cx, cx->analysisLifoAlloc().new_<TypeConstraintSetProperty>(script, pc, target, id));
+}
+
+void
+HeapTypeSet::addGetProperty(JSContext *cx, JSScript *script, jsbytecode *pc,
+                            StackTypeSet *target, jsid id)
+{
+    JS_ASSERT(!target->purged());
+    add(cx, cx->typeLifoAlloc().new_<TypeConstraintGetProperty>(script, pc, target, id));
 }
 
 /*
@@ -555,6 +577,7 @@ TypeSet::addSetProperty(JSContext *cx, JSScript *script, jsbytecode *pc,
  * correlations between the type of the 'this' object and the associated
  * callee scripts at polymorphic call sites.
  */
+template <PropertyAccessKind access>
 class TypeConstraintCallProp : public TypeConstraint
 {
 public:
@@ -565,16 +588,21 @@ public:
     jsid id;
 
     TypeConstraintCallProp(JSScript *script, jsbytecode *callpc, jsid id)
-        : TypeConstraint("callprop"), script(script), callpc(callpc), id(id)
+        : script(script), callpc(callpc), id(id)
     {
         JS_ASSERT(script && callpc);
     }
 
+    const char *kind() { return "callprop"; }
+
     void newType(JSContext *cx, TypeSet *source, Type type);
 };
 
+typedef TypeConstraintCallProp<PROPERTY_READ> TypeConstraintCallProperty;
+typedef TypeConstraintCallProp<PROPERTY_READ_EXISTING> TypeConstraintCallPropertyExisting;
+
 void
-TypeSet::addCallProperty(JSContext *cx, JSScript *script, jsbytecode *pc, jsid id)
+HeapTypeSet::addCallProperty(JSContext *cx, JSScript *script, jsbytecode *pc, jsid id)
 {
     /*
      * For calls which will go through JSOP_NEW, don't add any constraints to
@@ -585,7 +613,7 @@ TypeSet::addCallProperty(JSContext *cx, JSScript *script, jsbytecode *pc, jsid i
     if (JSOp(*callpc) == JSOP_NEW)
         return;
 
-    add(cx, cx->typeLifoAlloc().new_<TypeConstraintCallProp>(script, callpc, id));
+    add(cx, cx->typeLifoAlloc().new_<TypeConstraintCallProperty>(script, callpc, id));
 }
 
 /*
@@ -600,26 +628,28 @@ public:
     JSScript *script;
     jsbytecode *pc;
 
-    TypeSet *objectTypes;
-    TypeSet *valueTypes;
+    StackTypeSet *objectTypes;
+    StackTypeSet *valueTypes;
 
     TypeConstraintSetElement(JSScript *script, jsbytecode *pc,
-                             TypeSet *objectTypes, TypeSet *valueTypes)
-        : TypeConstraint("setelement"), script(script), pc(pc),
+                             StackTypeSet *objectTypes, StackTypeSet *valueTypes)
+        : script(script), pc(pc),
           objectTypes(objectTypes), valueTypes(valueTypes)
     {
         JS_ASSERT(script && pc);
     }
 
+    const char *kind() { return "setelement"; }
+
     void newType(JSContext *cx, TypeSet *source, Type type);
 };
 
 void
-TypeSet::addSetElement(JSContext *cx, JSScript *script, jsbytecode *pc,
-                       TypeSet *objectTypes, TypeSet *valueTypes)
+StackTypeSet::addSetElement(JSContext *cx, JSScript *script, jsbytecode *pc,
+                            StackTypeSet *objectTypes, StackTypeSet *valueTypes)
 {
-    add(cx, cx->typeLifoAlloc().new_<TypeConstraintSetElement>(script, pc, objectTypes,
-                                                               valueTypes));
+    add(cx, cx->analysisLifoAlloc().new_<TypeConstraintSetElement>(script, pc, objectTypes,
+                                                                   valueTypes));
 }
 
 /*
@@ -634,16 +664,18 @@ public:
     TypeCallsite *callsite;
 
     TypeConstraintCall(TypeCallsite *callsite)
-        : TypeConstraint("call"), callsite(callsite)
+        : callsite(callsite)
     {}
 
+    const char *kind() { return "call"; }
+
     void newType(JSContext *cx, TypeSet *source, Type type);
 };
 
 void
-TypeSet::addCall(JSContext *cx, TypeCallsite *site)
+StackTypeSet::addCall(JSContext *cx, TypeCallsite *site)
 {
-    add(cx, cx->typeLifoAlloc().new_<TypeConstraintCall>(site));
+    add(cx, cx->analysisLifoAlloc().new_<TypeConstraintCall>(site));
 }
 
 /* Constraints for arithmetic operations. */
@@ -660,18 +692,20 @@ public:
     TypeSet *other;
 
     TypeConstraintArith(JSScript *script, jsbytecode *pc, TypeSet *target, TypeSet *other)
-        : TypeConstraint("arith"), script(script), pc(pc), target(target), other(other)
+        : script(script), pc(pc), target(target), other(other)
     {
         JS_ASSERT(target);
     }
 
+    const char *kind() { return "arith"; }
+
     void newType(JSContext *cx, TypeSet *source, Type type);
 };
 
 void
-TypeSet::addArith(JSContext *cx, JSScript *script, jsbytecode *pc, TypeSet *target, TypeSet *other)
+StackTypeSet::addArith(JSContext *cx, JSScript *script, jsbytecode *pc, TypeSet *target, TypeSet *other)
 {
-    add(cx, cx->typeLifoAlloc().new_<TypeConstraintArith>(script, pc, target, other));
+    add(cx, cx->analysisLifoAlloc().new_<TypeConstraintArith>(script, pc, target, other));
 }
 
 /* Subset constraint which transforms primitive values into appropriate objects. */
@@ -682,16 +716,18 @@ public:
     TypeSet *target;
 
     TypeConstraintTransformThis(JSScript *script, TypeSet *target)
-        : TypeConstraint("transformthis"), script(script), target(target)
+        : script(script), target(target)
     {}
 
+    const char *kind() { return "transformthis"; }
+
     void newType(JSContext *cx, TypeSet *source, Type type);
 };
 
 void
-TypeSet::addTransformThis(JSContext *cx, JSScript *script, TypeSet *target)
+StackTypeSet::addTransformThis(JSContext *cx, JSScript *script, TypeSet *target)
 {
-    add(cx, cx->typeLifoAlloc().new_<TypeConstraintTransformThis>(script, target));
+    add(cx, cx->analysisLifoAlloc().new_<TypeConstraintTransformThis>(script, target));
 }
 
 /*
@@ -704,24 +740,27 @@ public:
     JSScript *script;
     jsbytecode *callpc;
     Type type;
-    TypeSet *types;
+    StackTypeSet *types;
 
-    TypeConstraintPropagateThis(JSScript *script, jsbytecode *callpc, Type type, TypeSet *types)
-        : TypeConstraint("propagatethis"), script(script), callpc(callpc), type(type), types(types)
+    TypeConstraintPropagateThis(JSScript *script, jsbytecode *callpc, Type type, StackTypeSet *types)
+        : script(script), callpc(callpc), type(type), types(types)
     {}
 
+    const char *kind() { return "propagatethis"; }
+
     void newType(JSContext *cx, TypeSet *source, Type type);
 };
 
 void
-TypeSet::addPropagateThis(JSContext *cx, JSScript *script, jsbytecode *pc, Type type, TypeSet *types)
+StackTypeSet::addPropagateThis(JSContext *cx, JSScript *script, jsbytecode *pc,
+                               Type type, StackTypeSet *types)
 {
     /* Don't add constraints when the call will be 'new' (see addCallProperty). */
     jsbytecode *callpc = script->analysis()->getCallPC(pc);
     if (JSOp(*callpc) == JSOP_NEW)
         return;
 
-    add(cx, cx->typeLifoAlloc().new_<TypeConstraintPropagateThis>(script, callpc, type, types));
+    add(cx, cx->analysisLifoAlloc().new_<TypeConstraintPropagateThis>(script, callpc, type, types));
 }
 
 /* Subset constraint which filters out primitive types. */
@@ -729,42 +768,26 @@ class TypeConstraintFilterPrimitive : public TypeConstraint
 {
 public:
     TypeSet *target;
-    TypeSet::FilterKind filter;
 
-    TypeConstraintFilterPrimitive(TypeSet *target, TypeSet::FilterKind filter)
-        : TypeConstraint("filter"), target(target), filter(filter)
+    TypeConstraintFilterPrimitive(TypeSet *target)
+        : target(target)
     {}
 
+    const char *kind() { return "filter"; }
+
     void newType(JSContext *cx, TypeSet *source, Type type)
     {
-        switch (filter) {
-          case TypeSet::FILTER_ALL_PRIMITIVES:
-            if (type.isPrimitive())
-                return;
-            break;
-
-          case TypeSet::FILTER_NULL_VOID:
-            if (type.isPrimitive(JSVAL_TYPE_NULL) || type.isPrimitive(JSVAL_TYPE_UNDEFINED))
-                return;
-            break;
-
-          case TypeSet::FILTER_VOID:
-            if (type.isPrimitive(JSVAL_TYPE_UNDEFINED))
-                return;
-            break;
-
-          default:
-            JS_NOT_REACHED("Bad filter");
-        }
+        if (type.isPrimitive())
+            return;
 
         target->addType(cx, type);
     }
 };
 
 void
-TypeSet::addFilterPrimitives(JSContext *cx, TypeSet *target, FilterKind filter)
+HeapTypeSet::addFilterPrimitives(JSContext *cx, TypeSet *target)
 {
-    add(cx, cx->typeLifoAlloc().new_<TypeConstraintFilterPrimitive>(target, filter));
+    add(cx, cx->typeLifoAlloc().new_<TypeConstraintFilterPrimitive>(target));
 }
 
 /* If id is a normal slotful 'own' property of an object, get its shape. */
@@ -882,19 +905,31 @@ public:
     TypeSet *target;
 
     TypeConstraintSubsetBarrier(JSScript *script, jsbytecode *pc, TypeSet *target)
-        : TypeConstraint("subsetBarrier"), script(script), pc(pc), target(target)
+        : script(script), pc(pc), target(target)
     {}
 
+    const char *kind() { return "subsetBarrier"; }
+
     void newType(JSContext *cx, TypeSet *source, Type type)
     {
-        if (!target->hasType(type))
+        if (!target->hasType(type)) {
+            if (!script->ensureRanAnalysis(cx))
+                return;
             script->analysis()->addTypeBarrier(cx, pc, target, type);
+        }
     }
 };
 
 void
-TypeSet::addSubsetBarrier(JSContext *cx, JSScript *script, jsbytecode *pc, TypeSet *target)
+StackTypeSet::addSubsetBarrier(JSContext *cx, JSScript *script, jsbytecode *pc, TypeSet *target)
 {
+    add(cx, cx->analysisLifoAlloc().new_<TypeConstraintSubsetBarrier>(script, pc, target));
+}
+
+void
+HeapTypeSet::addSubsetBarrier(JSContext *cx, JSScript *script, jsbytecode *pc, TypeSet *target)
+{
+    JS_ASSERT(!target->purged());
     add(cx, cx->typeLifoAlloc().new_<TypeConstraintSubsetBarrier>(script, pc, target));
 }
 
@@ -963,35 +998,114 @@ MarkPropertyAccessUnknown(JSContext *cx, JSScript *script, jsbytecode *pc, TypeS
         target->addType(cx, Type::UnknownType());
 }
 
+/*
+ * Get a value for reading id from obj or its prototypes according to the
+ * current VM state, returning the unknown type on failure or an undefined
+ * property.
+ */
+static inline Type
+GetSingletonPropertyType(JSContext *cx, JSObject *objArg, jsid id)
+{
+    JS_ASSERT(id == MakeTypeId(cx, id));
+
+    RootedObject obj(cx, objArg);
+
+    if (JSID_IS_VOID(id))
+        return Type::UnknownType();
+
+    if (obj->isTypedArray()) {
+        if (id == id_length(cx))
+            return Type::Int32Type();
+        obj = obj->getProto();
+    }
+
+    while (obj) {
+        if (!obj->isNative())
+            return Type::UnknownType();
+
+        Value v;
+        if (HasDataProperty(cx, obj, id, &v)) {
+            if (v.isUndefined())
+                return Type::UnknownType();
+            return GetValueType(cx, v);
+        }
+
+        obj = obj->getProto();
+    }
+
+    return Type::UnknownType();
+}
+
 /*
  * Handle a property access on a specific object. All property accesses go through
  * here, whether via x.f, x[f], or global name accesses.
  */
+template <PropertyAccessKind access>
 static inline void
-PropertyAccess(JSContext *cx, JSScript *script_, jsbytecode *pc, TypeObject *object_,
-               bool assign, TypeSet *target, jsid id)
+PropertyAccess(JSContext *cx, JSScript *script, jsbytecode *pc, TypeObject *object,
+               StackTypeSet *target, jsid id)
 {
-    RootedScript script(cx, script_);
-    Rooted<TypeObject*> object(cx, object_);
-
     /* Reads from objects with unknown properties are unknown, writes to such objects are ignored. */
     if (object->unknownProperties()) {
-        if (!assign)
+        if (access != PROPERTY_WRITE)
             MarkPropertyAccessUnknown(cx, script, pc, target);
         return;
     }
 
+    /*
+     * Short circuit indexed accesses on objects which are definitely typed
+     * arrays. Inference only covers the behavior of indexed accesses when
+     * getting integer properties, and the types for these are known ahead of
+     * time for typed arrays. Propagate the possible element types of the array
+     * to sites reading from it.
+     */
+    if (object->singleton && object->singleton->isTypedArray() && JSID_IS_VOID(id)) {
+        if (access != PROPERTY_WRITE) {
+            int arrayKind = object->proto->getClass() - TypedArray::protoClasses;
+            JS_ASSERT(arrayKind >= 0 && arrayKind < TypedArray::TYPE_MAX);
+
+            bool maybeDouble = (arrayKind == TypedArray::TYPE_UINT32 ||
+                                arrayKind == TypedArray::TYPE_FLOAT32 ||
+                                arrayKind == TypedArray::TYPE_FLOAT64);
+            target->addType(cx, maybeDouble ? Type::DoubleType() : Type::Int32Type());
+        }
+        return;
+    }
+
+    /*
+     * Try to resolve reads from the VM state ahead of time, e.g. for reads
+     * of defined global variables or from the prototype of the object. This
+     * reduces the need to monitor cold code as it first executes.
+     *
+     * This is speculating that the type of a defined property in a singleton
+     * object or prototype will not change between analysis and execution.
+     */
+    if (access != PROPERTY_WRITE) {
+        if (JSObject *singleton = object->singleton ? object->singleton : object->proto) {
+            Type type = GetSingletonPropertyType(cx, singleton, id);
+            if (!type.isUnknown())
+                target->addType(cx, type);
+        }
+    }
+
     /* Capture the effects of a standard property access. */
-    TypeSet *types = object->getProperty(cx, id, assign);
+    HeapTypeSet *types = object->getProperty(cx, id, access == PROPERTY_WRITE);
     if (!types)
         return;
-    if (assign) {
+    if (access == PROPERTY_WRITE) {
         target->addSubset(cx, types);
     } else {
+        JS_ASSERT_IF(script->hasAnalysis(),
+                     target == script->analysis()->bytecodeTypes(pc));
         if (!types->hasPropagatedProperty())
             object->getFromPrototypes(cx, id, types);
         if (UsePropertyTypeBarrier(pc)) {
-            types->addSubsetBarrier(cx, script, pc, target);
+            if (access == PROPERTY_READ) {
+                types->addSubsetBarrier(cx, script, pc, target);
+            } else {
+                TypeConstraintSubsetBarrier constraint(script, pc, target);
+                types->addTypesToConstraint(cx, &constraint);
+            }
             if (object->singleton && !JSID_IS_VOID(id)) {
                 /*
                  * Add a singleton type barrier on the object if it has an
@@ -1004,6 +1118,7 @@ PropertyAccess(JSContext *cx, JSScript *script_, jsbytecode *pc, TypeObject *obj
                     script->analysis()->addSingletonTypeBarrier(cx, pc, target, object->singleton, id);
             }
         } else {
+            JS_ASSERT(access == PROPERTY_READ);
             types->addSubset(cx, target);
         }
     }
@@ -1018,15 +1133,16 @@ UnknownPropertyAccess(JSScript *script, Type type)
         || (!type.isObject() && !script->hasGlobal());
 }
 
+template <PropertyAccessKind access>
 void
-TypeConstraintProp::newType(JSContext *cx, TypeSet *source, Type type)
+TypeConstraintProp<access>::newType(JSContext *cx, TypeSet *source, Type type)
 {
     if (UnknownPropertyAccess(script, type)) {
         /*
          * Access on an unknown object. Reads produce an unknown result, writes
          * need to be monitored.
          */
-        if (assign)
+        if (access == PROPERTY_WRITE)
             cx->compartment->types.monitorBytecode(cx, script, pc - script->code);
         else
             MarkPropertyAccessUnknown(cx, script, pc, target);
@@ -1035,7 +1151,7 @@ TypeConstraintProp::newType(JSContext *cx, TypeSet *source, Type type)
 
     if (type.isPrimitive(JSVAL_TYPE_MAGIC)) {
         /* Ignore cases which will be accounted for by the followEscapingArguments analysis. */
-        if (assign || (id != JSID_VOID && id != id_length(cx)))
+        if (access == PROPERTY_WRITE || (id != JSID_VOID && id != id_length(cx)))
             return;
 
         if (id == JSID_VOID)
@@ -1047,11 +1163,12 @@ TypeConstraintProp::newType(JSContext *cx, TypeSet *source, Type type)
 
     TypeObject *object = GetPropertyObject(cx, script, type);
     if (object)
-        PropertyAccess(cx, script, pc, object, assign, target, id);
+        PropertyAccess<access>(cx, script, pc, object, target, id);
 }
 
+template <PropertyAccessKind access>
 void
-TypeConstraintCallProp::newType(JSContext *cx, TypeSet *source, Type type)
+TypeConstraintCallProp<access>::newType(JSContext *cx, TypeSet *source, Type type)
 {
     /*
      * For CALLPROP, we need to update not just the pushed types but also the
@@ -1076,8 +1193,13 @@ TypeConstraintCallProp::newType(JSContext *cx, TypeSet *source, Type type)
             if (!types->hasPropagatedProperty())
                 object->getFromPrototypes(cx, id, types);
             /* Bypass addPropagateThis, we already have the callpc. */
-            types->add(cx, cx->typeLifoAlloc().new_<TypeConstraintPropagateThis>(
-                            script, callpc, type, (TypeSet *) NULL));
+            if (access == PROPERTY_READ) {
+                types->add(cx, cx->typeLifoAlloc().new_<TypeConstraintPropagateThis>(
+                                script, callpc, type, (StackTypeSet *) NULL));
+            } else {
+                TypeConstraintPropagateThis constraint(script, callpc, type, NULL);
+                types->addTypesToConstraint(cx, &constraint);
+            }
         }
     }
 }
@@ -1098,6 +1220,9 @@ TypeConstraintCall::newType(JSContext *cx, TypeSet *source, Type type)
     JSScript *script = callsite->script;
     jsbytecode *pc = callsite->pc;
 
+    JS_ASSERT_IF(script->hasAnalysis(),
+                 callsite->returnTypes == script->analysis()->bytecodeTypes(pc));
+
     if (type.isUnknown() || type.isAnyObject()) {
         /* Monitor calls on unknown functions. */
         cx->compartment->types.monitorBytecode(cx, script, pc - script->code);
@@ -1151,8 +1276,8 @@ TypeConstraintCall::newType(JSContext *cx, TypeSet *source, Type type)
 
                 if (callsite->argumentCount >= 2) {
                     for (unsigned i = 0; i < callsite->argumentCount; i++) {
-                        PropertyAccess(cx, script, pc, res, true,
-                                       callsite->argumentTypes[i], JSID_VOID);
+                        PropertyAccess<PROPERTY_WRITE>(cx, script, pc, res,
+                                                       callsite->argumentTypes[i], JSID_VOID);
                     }
                 }
             }
@@ -1177,8 +1302,8 @@ TypeConstraintCall::newType(JSContext *cx, TypeSet *source, Type type)
 
     /* Add bindings for the arguments of the call. */
     for (unsigned i = 0; i < callsite->argumentCount && i < nargs; i++) {
-        TypeSet *argTypes = callsite->argumentTypes[i];
-        TypeSet *types = TypeScript::ArgTypes(callee->script(), i);
+        StackTypeSet *argTypes = callsite->argumentTypes[i];
+        StackTypeSet *types = TypeScript::ArgTypes(callee->script(), i);
         argTypes->addSubsetBarrier(cx, script, pc, types);
     }
 
@@ -1188,8 +1313,8 @@ TypeConstraintCall::newType(JSContext *cx, TypeSet *source, Type type)
         types->addType(cx, Type::UndefinedType());
     }
 
-    TypeSet *thisTypes = TypeScript::ThisTypes(callee->script());
-    TypeSet *returnTypes = TypeScript::ReturnTypes(callee->script());
+    StackTypeSet *thisTypes = TypeScript::ThisTypes(callee->script());
+    HeapTypeSet *returnTypes = TypeScript::ReturnTypes(callee->script());
 
     if (callsite->isNew) {
         /*
@@ -1198,9 +1323,8 @@ TypeConstraintCall::newType(JSContext *cx, TypeSet *source, Type type)
          * the new value, which is done dynamically; we don't keep track of the
          * possible 'new' types for a given prototype type object.
          */
-        thisTypes->addSubset(cx, callsite->returnTypes);
-        returnTypes->addFilterPrimitives(cx, callsite->returnTypes,
-                                         TypeSet::FILTER_ALL_PRIMITIVES);
+        thisTypes->addSubset(cx, returnTypes);
+        returnTypes->addFilterPrimitives(cx, callsite->returnTypes);
     } else {
         /*
          * Add a binding for the return value of the call. We don't add a
@@ -1364,9 +1488,11 @@ public:
     bool typeAdded;
 
     TypeConstraintFreeze(RecompileInfo info)
-        : TypeConstraint("freeze"), info(info), typeAdded(false)
+        : info(info), typeAdded(false)
     {}
 
+    const char *kind() { return "freeze"; }
+
     void newType(JSContext *cx, TypeSet *source, Type type)
     {
         if (typeAdded)
@@ -1378,47 +1504,12 @@ public:
 };
 
 void
-TypeSet::addFreeze(JSContext *cx)
+HeapTypeSet::addFreeze(JSContext *cx)
 {
     add(cx, cx->typeLifoAlloc().new_<TypeConstraintFreeze>(
                 cx->compartment->types.compiledInfo), false);
 }
 
-/*
- * Constraint which triggers recompilation of a script if a possible new JSValueType
- * tag is realized for a type set.
- */
-class TypeConstraintFreezeTypeTag : public TypeConstraint
-{
-public:
-    RecompileInfo info;
-
-    /*
-     * Whether the type tag has been marked unknown due to a type change which
-     * occurred after this constraint was generated (and which triggered recompilation).
-     */
-    bool typeUnknown;
-
-    TypeConstraintFreezeTypeTag(RecompileInfo info)
-        : TypeConstraint("freezeTypeTag"), info(info), typeUnknown(false)
-    {}
-
-    void newType(JSContext *cx, TypeSet *source, Type type)
-    {
-        if (typeUnknown)
-            return;
-
-        if (!type.isUnknown() && !type.isAnyObject() && type.isObject()) {
-            /* Ignore new objects when the type set already has other objects. */
-            if (source->getObjectCount() >= 2)
-                return;
-        }
-
-        typeUnknown = true;
-        cx->compartment->types.addPendingRecompile(cx, info);
-    }
-};
-
 static inline JSValueType
 GetValueTypeFromTypeFlags(TypeFlags flags)
 {
@@ -1445,7 +1536,7 @@ GetValueTypeFromTypeFlags(TypeFlags flags)
 }
 
 JSValueType
-TypeSet::getKnownTypeTag(JSContext *cx)
+StackTypeSet::getKnownTypeTag()
 {
     TypeFlags flags = baseFlags();
     JSValueType type;
@@ -1462,16 +1553,9 @@ TypeSet::getKnownTypeTag(JSContext *cx)
      * that the exact tag is unknown, as it will stay unknown as more types are
      * added to the set.
      */
-    bool empty = flags == 0 && baseObjectCount() == 0;
+    DebugOnly<bool> empty = flags == 0 && baseObjectCount() == 0;
     JS_ASSERT_IF(empty, type == JSVAL_TYPE_UNKNOWN);
 
-    if (cx->compartment->types.compiledInfo.compilerOutput(cx)->script &&
-        (empty || type != JSVAL_TYPE_UNKNOWN))
-    {
-        add(cx, cx->typeLifoAlloc().new_<TypeConstraintFreezeTypeTag>(
-                  cx->compartment->types.compiledInfo), false);
-    }
-
     return type;
 }
 
@@ -1485,84 +1569,28 @@ public:
     TypeObjectFlags flags;
 
     /* Whether the object has already been marked as having one of the flags. */
-    bool *pmarked;
-    bool localMarked;
-
-    TypeConstraintFreezeObjectFlags(RecompileInfo info, TypeObjectFlags flags, bool *pmarked)
-        : TypeConstraint("freezeObjectFlags"), info(info), flags(flags),
-          pmarked(pmarked), localMarked(false)
-    {}
+    bool marked;
 
     TypeConstraintFreezeObjectFlags(RecompileInfo info, TypeObjectFlags flags)
-        : TypeConstraint("freezeObjectFlags"), info(info), flags(flags),
-          pmarked(&localMarked), localMarked(false)
+        : info(info), flags(flags),
+          marked(false)
     {}
 
+    const char *kind() { return "freezeObjectFlags"; }
+
     void newType(JSContext *cx, TypeSet *source, Type type) {}
 
     void newObjectState(JSContext *cx, TypeObject *object, bool force)
     {
-        if (object->hasAnyFlags(flags) && !*pmarked) {
-            *pmarked = true;
-            cx->compartment->types.addPendingRecompile(cx, info);
-        } else if (force) {
+        if (!marked && (object->hasAnyFlags(flags) || (!flags && force))) {
+            marked = true;
             cx->compartment->types.addPendingRecompile(cx, info);
         }
     }
 };
 
-/*
- * Constraint which triggers recompilation if any object in a type set acquire
- * particular flags.
- */
-class TypeConstraintFreezeObjectFlagsSet : public TypeConstraint
-{
-public:
-    RecompileInfo info;
-
-    TypeObjectFlags flags;
-    bool marked;
-
-    TypeConstraintFreezeObjectFlagsSet(RecompileInfo info, TypeObjectFlags flags)
-        : TypeConstraint("freezeObjectKindSet"), info(info), flags(flags), marked(false)
-    {}
-
-    void newType(JSContext *cx, TypeSet *source, Type type)
-    {
-        if (marked) {
-            /* Despecialized the kind we were interested in due to recompilation. */
-            return;
-        }
-
-        if (type.isUnknown() || type.isAnyObject()) {
-            /* Fallthrough and recompile. */
-        } else if (type.isObject()) {
-            TypeObject *object = type.isSingleObject()
-                ? type.singleObject()->getType(cx)
-                : type.typeObject();
-            if (!object->hasAnyFlags(flags)) {
-                /*
-                 * Add a constraint on the the object to pick up changes in the
-                 * object's properties.
-                 */
-                TypeSet *types = object->getProperty(cx, JSID_EMPTY, false);
-                if (!types)
-                    return;
-                types->add(cx, cx->typeLifoAlloc().new_<TypeConstraintFreezeObjectFlags>(
-                                  info, flags, &marked), false);
-                return;
-            }
-        } else {
-            return;
-        }
-
-        marked = true;
-        cx->compartment->types.addPendingRecompile(cx, info);
-    }
-};
-
 bool
-TypeSet::hasObjectFlags(JSContext *cx, TypeObjectFlags flags)
+StackTypeSet::hasObjectFlags(JSContext *cx, TypeObjectFlags flags)
 {
     if (unknownObject())
         return true;
@@ -1579,30 +1607,34 @@ TypeSet::hasObjectFlags(JSContext *cx, TypeObjectFlags flags)
         TypeObject *object = getTypeObject(i);
         if (!object) {
             JSObject *obj = getSingleObject(i);
-            if (obj)
-                object = obj->getType(cx);
+            if (!obj)
+                continue;
+            object = obj->getType(cx);
         }
-        if (object && object->hasAnyFlags(flags))
+        if (object->hasAnyFlags(flags))
             return true;
-    }
 
-    /*
-     * Watch for new objects of different kind, and re-traverse existing types
-     * in this set to add any needed FreezeArray constraints.
-     */
-    add(cx, cx->typeLifoAlloc().new_<TypeConstraintFreezeObjectFlagsSet>(
-                 cx->compartment->types.compiledInfo, flags));
+        /*
+         * Add a constraint on the the object to pick up changes in the
+         * object's properties.
+         */
+        TypeSet *types = object->getProperty(cx, JSID_EMPTY, false);
+        if (!types)
+            return true;
+        types->add(cx, cx->typeLifoAlloc().new_<TypeConstraintFreezeObjectFlags>(
+                          cx->compartment->types.compiledInfo, flags), false);
+    }
 
     return false;
 }
 
 bool
-TypeSet::HasObjectFlags(JSContext *cx, TypeObject *object, TypeObjectFlags flags)
+HeapTypeSet::HasObjectFlags(JSContext *cx, TypeObject *object, TypeObjectFlags flags)
 {
     if (object->hasAnyFlags(flags))
         return true;
 
-    TypeSet *types = object->getProperty(cx, JSID_EMPTY, false);
+    HeapTypeSet *types = object->getProperty(cx, JSID_EMPTY, false);
     if (!types)
         return true;
     types->add(cx, cx->typeLifoAlloc().new_<TypeConstraintFreezeObjectFlags>(
@@ -1633,10 +1665,10 @@ ObjectStateChange(JSContext *cx, TypeObject *object, bool markingUnknown, bool f
 }
 
 void
-TypeSet::WatchObjectStateChange(JSContext *cx, TypeObject *obj)
+HeapTypeSet::WatchObjectStateChange(JSContext *cx, TypeObject *obj)
 {
     JS_ASSERT(!obj->unknownProperties());
-    TypeSet *types = obj->getProperty(cx, JSID_EMPTY, false);
+    HeapTypeSet *types = obj->getProperty(cx, JSID_EMPTY, false);
     if (!types)
         return;
 
@@ -1658,17 +1690,18 @@ public:
     bool configurable;
 
     TypeConstraintFreezeOwnProperty(RecompileInfo info, bool configurable)
-        : TypeConstraint("freezeOwnProperty"),
-          info(info), updated(false), configurable(configurable)
+        : info(info), updated(false), configurable(configurable)
     {}
 
+    const char *kind() { return "freezeOwnProperty"; }
+
     void newType(JSContext *cx, TypeSet *source, Type type) {}
 
     void newPropertyState(JSContext *cx, TypeSet *source)
     {
         if (updated)
             return;
-        if (source->isOwnProperty(configurable)) {
+        if (source->ownProperty(configurable)) {
             updated = true;
             cx->compartment->types.addPendingRecompile(cx, info);
         }
@@ -1679,7 +1712,7 @@ static void
 CheckNewScriptProperties(JSContext *cx, HandleTypeObject type, JSFunction *fun);
 
 bool
-TypeSet::isOwnProperty(JSContext *cx, TypeObject *object, bool configurable)
+HeapTypeSet::isOwnProperty(JSContext *cx, TypeObject *object, bool configurable)
 {
     /*
      * Everywhere compiled code depends on definite properties associated with
@@ -1697,7 +1730,7 @@ TypeSet::isOwnProperty(JSContext *cx, TypeObject *object, bool configurable)
         }
     }
 
-    if (isOwnProperty(configurable))
+    if (ownProperty(configurable))
         return true;
 
     add(cx, cx->typeLifoAlloc().new_<TypeConstraintFreezeOwnProperty>(
@@ -1707,7 +1740,7 @@ TypeSet::isOwnProperty(JSContext *cx, TypeObject *object, bool configurable)
 }
 
 bool
-TypeSet::knownNonEmpty(JSContext *cx)
+HeapTypeSet::knownNonEmpty(JSContext *cx)
 {
     if (baseFlags() != 0 || baseObjectCount() != 0)
         return true;
@@ -1718,8 +1751,10 @@ TypeSet::knownNonEmpty(JSContext *cx)
 }
 
 bool
-TypeSet::knownSubset(JSContext *cx, TypeSet *other)
+HeapTypeSet::knownSubset(JSContext *cx, TypeSet *other)
 {
+    JS_ASSERT(!other->constraintsPurged());
+
     if ((baseFlags() & other->baseFlags()) != baseFlags())
         return false;
 
@@ -1741,7 +1776,7 @@ TypeSet::knownSubset(JSContext *cx, TypeSet *other)
 }
 
 int
-TypeSet::getTypedArrayType(JSContext *cx)
+StackTypeSet::getTypedArrayType()
 {
     int arrayType = TypedArray::TYPE_MAX;
     unsigned count = getObjectCount();
@@ -1777,32 +1812,34 @@ TypeSet::getTypedArrayType(JSContext *cx)
      */
     JS_ASSERT(arrayType != TypedArray::TYPE_MAX);
 
-    /* Recompile when another typed array is added to this set. */
-    addFreeze(cx);
-
     return arrayType;
 }
 
 JSObject *
-TypeSet::getSingleton(JSContext *cx, bool freeze)
+StackTypeSet::getSingleton()
+{
+    if (baseFlags() != 0 || baseObjectCount() != 1)
+        return NULL;
+
+    return getSingleObject(0);
+}
+
+JSObject *
+HeapTypeSet::getSingleton(JSContext *cx)
 {
     if (baseFlags() != 0 || baseObjectCount() != 1)
         return NULL;
 
     JSObject *obj = getSingleObject(0);
-    if (!obj)
-        return NULL;
 
-    if (freeze) {
-        add(cx, cx->typeLifoAlloc().new_<TypeConstraintFreeze>(
-                                               cx->compartment->types.compiledInfo), false);
-    }
+    if (obj)
+        addFreeze(cx);
 
     return obj;
 }
 
 bool
-TypeSet::needsBarrier(JSContext *cx)
+HeapTypeSet::needsBarrier(JSContext *cx)
 {
     bool result = unknownObject()
                || getObjectCount() > 0
@@ -1812,6 +1849,130 @@ TypeSet::needsBarrier(JSContext *cx)
     return result;
 }
 
+bool
+StackTypeSet::propertyNeedsBarrier(JSContext *cx, jsid id)
+{
+    id = MakeTypeId(cx, id);
+
+    if (unknownObject())
+        return true;
+
+    for (unsigned i = 0; i < getObjectCount(); i++) {
+        if (getSingleObject(i))
+            return true;
+
+        if (types::TypeObject *otype = getTypeObject(i)) {
+            if (otype->unknownProperties())
+                return true;
+
+            if (types::HeapTypeSet *propTypes = otype->maybeGetProperty(cx, id)) {
+                if (propTypes->needsBarrier(cx))
+                    return true;
+            }
+        }
+    }
+
+    return false;
+}
+
+enum RecompileKind {
+    RECOMPILE_CHECK_MONITORED,
+    RECOMPILE_CHECK_BARRIERS,
+    RECOMPILE_NONE
+};
+
+/*
+ * Whether all jitcode for a given pc was compiled with monitoring or barriers.
+ * If we reanalyze the script after generating jitcode, new monitoring and
+ * barriers will be added which may be duplicating information available when
+ * the script was originally compiled, and which should not invalidate that
+ * compilation.
+ */
+static inline bool
+JITCodeHasCheck(JSScript *script, jsbytecode *pc, RecompileKind kind)
+{
+    if (kind == RECOMPILE_NONE)
+        return false;
+
+#ifdef JS_METHODJIT
+    for (int constructing = 0; constructing <= 1; constructing++) {
+        for (int barriers = 0; barriers <= 1; barriers++) {
+            mjit::JITScript *jit = script->getJIT((bool) constructing, (bool) barriers);
+            if (!jit)
+                continue;
+            mjit::JITChunk *chunk = jit->chunk(pc);
+            if (!chunk)
+                continue;
+            bool found = false;
+            uint32_t count = (kind == RECOMPILE_CHECK_MONITORED)
+                             ? chunk->nMonitoredBytecodes
+                             : chunk->nTypeBarrierBytecodes;
+            uint32_t *bytecodes = (kind == RECOMPILE_CHECK_MONITORED)
+                                  ? chunk->monitoredBytecodes()
+                                  : chunk->typeBarrierBytecodes();
+            for (size_t i = 0; i < count; i++) {
+                if (bytecodes[i] == uint32_t(pc - script->code))
+                    found = true;
+            }
+            if (!found)
+                return false;
+        }
+    }
+#endif
+
+    return true;
+}
+
+/*
+ * Force recompilation of any jitcode for script at pc, or of any other script
+ * which this script was inlined into.
+ */
+static inline void
+AddPendingRecompile(JSContext *cx, JSScript *script, jsbytecode *pc,
+                    RecompileKind kind = RECOMPILE_NONE)
+{
+    /*
+     * Trigger recompilation of the script itself, if code was not previously
+     * compiled with the specified information.
+     */
+    if (!JITCodeHasCheck(script, pc, kind))
+        cx->compartment->types.addPendingRecompile(cx, script, pc);
+
+    /*
+     * When one script is inlined into another the caller listens to state
+     * changes on the callee's script, so trigger these to force recompilation
+     * of any such callers.
+     */
+    if (script->function() && !script->function()->hasLazyType())
+        ObjectStateChange(cx, script->function()->type(), false, true);
+}
+
+/*
+ * As for TypeConstraintFreeze, but describes an implicit freeze constraint
+ * added for stack types within a script. Applies to all compilations of the
+ * script, not just a single one.
+ */
+class TypeConstraintFreezeStack : public TypeConstraint
+{
+public:
+    JSScript *script;
+
+    TypeConstraintFreezeStack(JSScript *script)
+        : script(script)
+    {}
+
+    const char *kind() { return "freezeStack"; }
+
+    void newType(JSContext *cx, TypeSet *source, Type type)
+    {
+        /*
+         * Unlike TypeConstraintFreeze, triggering this constraint once does
+         * not disable it on future changes to the type set.
+         */
+        AddPendingRecompile(cx, script, NULL);
+    }
+};
+
 /////////////////////////////////////////////////////////////////////
 // TypeCompartment
 /////////////////////////////////////////////////////////////////////
@@ -1987,7 +2148,7 @@ types::ArrayPrototypeHasIndexedProperty(JSContext *cx, JSScript *script)
         TypeObject *type = proto->getType(cx);
         if (type->unknownProperties())
             return true;
-        TypeSet *indexTypes = type->getProperty(cx, JSID_VOID, false);
+        HeapTypeSet *indexTypes = type->getProperty(cx, JSID_VOID, false);
         if (!indexTypes || indexTypes->isOwnProperty(cx, type, true) || indexTypes->knownNonEmpty(cx))
             return true;
         proto = proto->getProto();
@@ -2161,12 +2322,18 @@ TypeCompartment::addPendingRecompile(JSContext *cx, JSScript *script, jsbytecode
             if (!jit)
                 continue;
 
-            unsigned int chunkIndex = jit->chunkIndex(pc);
-            mjit::JITChunk *chunk = jit->chunkDescriptor(chunkIndex).chunk;
-            if (!chunk)
-                continue;
-
-            addPendingRecompile(cx, chunk->recompileInfo);
+            if (pc) {
+                unsigned int chunkIndex = jit->chunkIndex(pc);
+                mjit::JITChunk *chunk = jit->chunkDescriptor(chunkIndex).chunk;
+                if (chunk)
+                    addPendingRecompile(cx, chunk->recompileInfo);
+            } else {
+                for (size_t chunkIndex = 0; chunkIndex < jit->nchunks; chunkIndex++) {
+                    mjit::JITChunk *chunk = jit->chunkDescriptor(chunkIndex).chunk;
+                    if (chunk)
+                        addPendingRecompile(cx, chunk->recompileInfo);
+                }
+            }
         }
     }
 #endif
@@ -2176,9 +2343,10 @@ void
 TypeCompartment::monitorBytecode(JSContext *cx, JSScript *script, uint32_t offset,
                                  bool returnOnly)
 {
-    ScriptAnalysis *analysis = script->analysis();
-    JS_ASSERT(analysis->ranInference());
+    if (!script->ensureRanInference(cx))
+        return;
 
+    ScriptAnalysis *analysis = script->analysis();
     jsbytecode *pc = script->code + offset;
 
     JS_ASSERT_IF(returnOnly, js_CodeSpec[*pc].format & JOF_INVOKE);
@@ -2195,14 +2363,12 @@ TypeCompartment::monitorBytecode(JSContext *cx, JSScript *script, uint32_t offse
     if (js_CodeSpec[*pc].format & JOF_INVOKE)
         code.monitoredTypesReturn = true;
 
-    if (!returnOnly)
-        code.monitoredTypes = true;
+    if (returnOnly)
+        return;
 
-    cx->compartment->types.addPendingRecompile(cx, script, pc);
+    code.monitoredTypes = true;
 
-    /* Trigger recompilation of any inline callers. */
-    if (script->function() && !script->function()->hasLazyType())
-        ObjectStateChange(cx, script->function()->type(), false, true);
+    AddPendingRecompile(cx, script, pc, RECOMPILE_CHECK_MONITORED);
 }
 
 void
@@ -2292,11 +2458,7 @@ ScriptAnalysis::addTypeBarrier(JSContext *cx, const jsbytecode *pc, TypeSet *tar
          * however, do not trigger recompilation (the script will be recompiled
          * if any of the barriers is ever violated).
          */
-        cx->compartment->types.addPendingRecompile(cx, script, const_cast<jsbytecode*>(pc));
-
-        /* Trigger recompilation of any inline callers. */
-        if (script->function() && !script->function()->hasLazyType())
-            ObjectStateChange(cx, script->function()->type(), false, true);
+        AddPendingRecompile(cx, script, const_cast<jsbytecode*>(pc), RECOMPILE_CHECK_BARRIERS);
     }
 
     /* Ignore duplicate barriers. */
@@ -2312,7 +2474,7 @@ ScriptAnalysis::addTypeBarrier(JSContext *cx, const jsbytecode *pc, TypeSet *tar
               InferSpewColor(target), target, InferSpewColorReset(),
               TypeString(type));
 
-    barrier = cx->typeLifoAlloc().new_<TypeBarrier>(target, type, (JSObject *) NULL, JSID_VOID);
+    barrier = cx->analysisLifoAlloc().new_<TypeBarrier>(target, type, (JSObject *) NULL, JSID_VOID);
 
     if (!barrier) {
         cx->compartment->types.setPendingNukeTypes(cx);
@@ -2332,9 +2494,7 @@ ScriptAnalysis::addSingletonTypeBarrier(JSContext *cx, const jsbytecode *pc, Typ
 
     if (!code.typeBarriers) {
         /* Trigger recompilation as for normal type barriers. */
-        cx->compartment->types.addPendingRecompile(cx, script, const_cast<jsbytecode*>(pc));
-        if (script->function() && !script->function()->hasLazyType())
-            ObjectStateChange(cx, script->function()->type(), false, true);
+        AddPendingRecompile(cx, script, const_cast<jsbytecode*>(pc), RECOMPILE_CHECK_BARRIERS);
     }
 
     InferSpew(ISpewOps, "singletonTypeBarrier: #%u:%05u: %sT%p%s %p %s",
@@ -2342,7 +2502,7 @@ ScriptAnalysis::addSingletonTypeBarrier(JSContext *cx, const jsbytecode *pc, Typ
               InferSpewColor(target), target, InferSpewColorReset(),
               (void *) singleton, TypeIdString(singletonId));
 
-    TypeBarrier *barrier = cx->typeLifoAlloc().new_<TypeBarrier>(target, Type::UndefinedType(),
+    TypeBarrier *barrier = cx->analysisLifoAlloc().new_<TypeBarrier>(target, Type::UndefinedType(),
                               singleton, singletonId);
 
     if (!barrier) {
@@ -2687,19 +2847,18 @@ TypeObject::getFromPrototypes(JSContext *cx, jsid id, TypeSet *types, bool force
     if (!proto)
         return;
 
-    RootedTypeObject self(cx, this);
     if (proto->getType(cx)->unknownProperties()) {
         types->addType(cx, Type::UnknownType());
         return;
     }
 
-    TypeSet *protoTypes = self->proto->getType(cx)->getProperty(cx, id, false);
+    HeapTypeSet *protoTypes = proto->getType(cx)->getProperty(cx, id, false);
     if (!protoTypes)
         return;
 
     protoTypes->addSubset(cx, types);
 
-    self->proto->getType(cx)->getFromPrototypes(cx, id, protoTypes);
+    proto->getType(cx)->getFromPrototypes(cx, id, protoTypes);
 }
 
 static inline void
@@ -2810,7 +2969,7 @@ TypeObject::matchDefiniteProperties(JSObject *obj)
         Property *prop = getProperty(i);
         if (!prop)
             continue;
-        if (prop->types.isDefiniteProperty()) {
+        if (prop->types.definiteProperty()) {
             unsigned slot = prop->types.definiteSlot();
 
             bool found = false;
@@ -2998,7 +3157,7 @@ TypeObject::clearNewScript(JSContext *cx)
         Property *prop = getProperty(i);
         if (!prop)
             continue;
-        if (prop->types.isDefiniteProperty())
+        if (prop->types.definiteProperty())
             prop->types.setOwnProperty(cx, true);
     }
 
@@ -3172,6 +3331,16 @@ GetInitializerType(JSContext *cx, JSScript *script, jsbytecode *pc)
     return TypeScript::InitObject(cx, script, pc, key);
 }
 
+static inline Type
+GetCalleeThisType(jsbytecode *pc)
+{
+    pc += GetBytecodeLength(pc);
+    if (*pc == JSOP_UNDEFINED)
+        return Type::UndefinedType();
+    JS_ASSERT(*pc == JSOP_IMPLICITTHIS);
+    return Type::UnknownType();
+}
+
 /* Analyze type information for a single bytecode. */
 bool
 ScriptAnalysis::analyzeTypesBytecode(JSContext *cx, unsigned offset,
@@ -3189,7 +3358,7 @@ ScriptAnalysis::analyzeTypesBytecode(JSContext *cx, unsigned offset,
     if (ExtendedDef(pc))
         defCount++;
 
-    TypeSet *pushed = cx->typeLifoAlloc().newArrayUninitialized<TypeSet>(defCount);
+    StackTypeSet *pushed = cx->analysisLifoAlloc().newArrayUninitialized<StackTypeSet>(defCount);
     if (!pushed)
         return false;
     PodZero(pushed, defCount);
@@ -3219,6 +3388,8 @@ ScriptAnalysis::analyzeTypesBytecode(JSContext *cx, unsigned offset,
             InferSpew(ISpewOps, "typeSet: %sT%p%s phi #%u:%05u:%u",
                       InferSpewColor(&types), &types, InferSpewColorReset(),
                       script->id(), offset, newv->slot);
+            types.setPurged();
+
             newv++;
         }
     }
@@ -3234,6 +3405,7 @@ ScriptAnalysis::analyzeTypesBytecode(JSContext *cx, unsigned offset,
         InferSpew(ISpewOps, "typeSet: %sT%p%s pushed%u #%u:%05u",
                   InferSpewColor(&pushed[i]), &pushed[i], InferSpewColorReset(),
                   i, script->id(), offset);
+        pushed[i].setPurged();
     }
 
     /* Add type constraints for the various opcodes. */
@@ -3381,7 +3553,7 @@ ScriptAnalysis::analyzeTypesBytecode(JSContext *cx, unsigned offset,
       case JSOP_CALLGNAME: {
         jsid id = GetAtomId(cx, script, pc, 0);
 
-        TypeSet *seen = bytecodeTypes(pc);
+        StackTypeSet *seen = bytecodeTypes(pc);
         seen->addSubset(cx, &pushed[0]);
 
         /*
@@ -3396,11 +3568,16 @@ ScriptAnalysis::analyzeTypesBytecode(JSContext *cx, unsigned offset,
         if (id == NameToId(cx->runtime->atomState.InfinityAtom))
             seen->addType(cx, Type::DoubleType());
 
+        TypeObject *global = script->global().getType(cx);
+
         /* Handle as a property access. */
-        PropertyAccess(cx, script, pc, script->global().getType(cx), false, seen, id);
+        if (state.hasPropertyReadTypes)
+            PropertyAccess<PROPERTY_READ_EXISTING>(cx, script, pc, global, seen, id);
+        else
+            PropertyAccess<PROPERTY_READ>(cx, script, pc, global, seen, id);
 
         if (op == JSOP_CALLGNAME)
-            pushed[0].addPropagateThis(cx, script, pc, Type::UnknownType());
+            pushed[0].addPropagateThis(cx, script, pc, GetCalleeThisType(pc));
 
         if (CheckNextTest(pc))
             pushed[0].addType(cx, Type::UndefinedType());
@@ -3411,11 +3588,11 @@ ScriptAnalysis::analyzeTypesBytecode(JSContext *cx, unsigned offset,
       case JSOP_INTRINSICNAME:
       case JSOP_CALLNAME:
       case JSOP_CALLINTRINSIC: {
-        TypeSet *seen = bytecodeTypes(pc);
+        StackTypeSet *seen = bytecodeTypes(pc);
         addTypeBarrier(cx, pc, seen, Type::UnknownType());
         seen->addSubset(cx, &pushed[0]);
         if (op == JSOP_CALLNAME || op == JSOP_CALLINTRINSIC)
-            pushed[0].addPropagateThis(cx, script, pc, Type::UnknownType());
+            pushed[0].addPropagateThis(cx, script, pc, GetCalleeThisType(pc));
         break;
       }
 
@@ -3425,8 +3602,8 @@ ScriptAnalysis::analyzeTypesBytecode(JSContext *cx, unsigned offset,
 
       case JSOP_SETGNAME: {
         jsid id = GetAtomId(cx, script, pc, 0);
-        PropertyAccess(cx, script, pc, script->global().getType(cx),
-                       true, poppedTypes(pc, 0), id);
+        TypeObject *global = script->global().getType(cx);
+        PropertyAccess<PROPERTY_WRITE>(cx, script, pc, global, poppedTypes(pc, 0), id);
         poppedTypes(pc, 0)->addSubset(cx, &pushed[0]);
         break;
       }
@@ -3438,7 +3615,7 @@ ScriptAnalysis::analyzeTypesBytecode(JSContext *cx, unsigned offset,
         break;
 
       case JSOP_GETXPROP: {
-        TypeSet *seen = bytecodeTypes(pc);
+        StackTypeSet *seen = bytecodeTypes(pc);
         addTypeBarrier(cx, pc, seen, Type::UnknownType());
         seen->addSubset(cx, &pushed[0]);
         break;
@@ -3457,7 +3634,7 @@ ScriptAnalysis::analyzeTypesBytecode(JSContext *cx, unsigned offset,
              */
             poppedTypes(pc, 0)->addSubset(cx, &pushed[0]);
         } else if (slot < TotalSlots(script)) {
-            TypeSet *types = TypeScript::SlotTypes(script, slot);
+            StackTypeSet *types = TypeScript::SlotTypes(script, slot);
             types->addSubset(cx, &pushed[0]);
         } else {
             /* Local 'let' variable. Punt on types for these, for now. */
@@ -3515,7 +3692,7 @@ ScriptAnalysis::analyzeTypesBytecode(JSContext *cx, unsigned offset,
         if (trackSlot(slot)) {
             poppedTypes(pc, 0)->addArith(cx, script, pc, &pushed[0]);
         } else if (slot < TotalSlots(script)) {
-            TypeSet *types = TypeScript::SlotTypes(script, slot);
+            StackTypeSet *types = TypeScript::SlotTypes(script, slot);
             types->addArith(cx, script, pc, types);
             types->addSubset(cx, &pushed[0]);
         } else {
@@ -3533,7 +3710,7 @@ ScriptAnalysis::analyzeTypesBytecode(JSContext *cx, unsigned offset,
         break;
 
       case JSOP_REST: {
-        TypeSet *types = script->analysis()->bytecodeTypes(pc);
+        StackTypeSet *types = script->analysis()->bytecodeTypes(pc);
         if (script->hasGlobal()) {
             TypeObject *rest = TypeScript::InitObject(cx, script, pc, JSProto_Array);
             if (!rest)
@@ -3541,7 +3718,7 @@ ScriptAnalysis::analyzeTypesBytecode(JSContext *cx, unsigned offset,
             types->addType(cx, Type::ObjectType(rest));
 
             // Simulate setting a element.
-            TypeSet *propTypes = rest->getProperty(cx, JSID_VOID, true);
+            HeapTypeSet *propTypes = rest->getProperty(cx, JSID_VOID, true);
             if (!propTypes)
                 return false;
             propTypes->addType(cx, Type::UnknownType());
@@ -3564,11 +3741,23 @@ ScriptAnalysis::analyzeTypesBytecode(JSContext *cx, unsigned offset,
       case JSOP_GETPROP:
       case JSOP_CALLPROP: {
         jsid id = GetAtomId(cx, script, pc, 0);
-        TypeSet *seen = script->analysis()->bytecodeTypes(pc);
+        StackTypeSet *seen = script->analysis()->bytecodeTypes(pc);
 
-        poppedTypes(pc, 0)->addGetProperty(cx, script, pc, seen, id);
-        if (op == JSOP_CALLPROP)
-            poppedTypes(pc, 0)->addCallProperty(cx, script, pc, id);
+        HeapTypeSet *input = &script->types->propertyReadTypes[state.propertyReadIndex++];
+        poppedTypes(pc, 0)->addSubset(cx, input);
+
+        if (state.hasPropertyReadTypes) {
+            TypeConstraintGetPropertyExisting getProp(script, pc, seen, id);
+            input->addTypesToConstraint(cx, &getProp);
+            if (op == JSOP_CALLPROP) {
+                TypeConstraintCallPropertyExisting callProp(script, pc, id);
+                input->addTypesToConstraint(cx, &callProp);
+            }
+        } else {
+            input->addGetProperty(cx, script, pc, seen, id);
+            if (op == JSOP_CALLPROP)
+                input->addCallProperty(cx, script, pc, id);
+        }
 
         seen->addSubset(cx, &pushed[0]);
         if (CheckNextTest(pc))
@@ -3583,9 +3772,21 @@ ScriptAnalysis::analyzeTypesBytecode(JSContext *cx, unsigned offset,
 
       case JSOP_GETELEM:
       case JSOP_CALLELEM: {
-        TypeSet *seen = script->analysis()->bytecodeTypes(pc);
+        StackTypeSet *seen = script->analysis()->bytecodeTypes(pc);
 
-        poppedTypes(pc, 1)->addGetProperty(cx, script, pc, seen, JSID_VOID);
+        /* Don't try to compute a precise callee for CALLELEM. */
+        if (op == JSOP_CALLELEM)
+            seen->addType(cx, Type::AnyObjectType());
+
+        HeapTypeSet *input = &script->types->propertyReadTypes[state.propertyReadIndex++];
+        poppedTypes(pc, 1)->addSubset(cx, input);
+
+        if (state.hasPropertyReadTypes) {
+            TypeConstraintGetPropertyExisting getProp(script, pc, seen, JSID_VOID);
+            input->addTypesToConstraint(cx, &getProp);
+        } else {
+            input->addGetProperty(cx, script, pc, seen, JSID_VOID);
+        }
 
         seen->addSubset(cx, &pushed[0]);
         if (op == JSOP_CALLELEM)
@@ -3663,12 +3864,12 @@ ScriptAnalysis::analyzeTypesBytecode(JSContext *cx, unsigned offset,
       case JSOP_FUNCALL:
       case JSOP_FUNAPPLY:
       case JSOP_NEW: {
-        TypeSet *seen = script->analysis()->bytecodeTypes(pc);
+        StackTypeSet *seen = script->analysis()->bytecodeTypes(pc);
         seen->addSubset(cx, &pushed[0]);
 
         /* Construct the base call information about this site. */
         unsigned argCount = GetUseCount(script, offset) - 2;
-        TypeCallsite *callsite = cx->typeLifoAlloc().new_<TypeCallsite>(
+        TypeCallsite *callsite = cx->analysisLifoAlloc().new_<TypeCallsite>(
                                                         cx, script, pc, op == JSOP_NEW, argCount);
         if (!callsite || (argCount && !callsite->argumentTypes)) {
             cx->compartment->types.setPendingNukeTypes(cx);
@@ -3688,6 +3889,10 @@ ScriptAnalysis::analyzeTypesBytecode(JSContext *cx, unsigned offset,
         if (op == JSOP_FUNCALL || op == JSOP_FUNAPPLY)
             cx->compartment->types.monitorBytecode(cx, script, pc - script->code);
 
+        /* Speculate that calls whose result is ignored may return undefined. */
+        if (JSOP_POP == *(pc + GetBytecodeLength(pc)))
+            seen->addType(cx, Type::UndefinedType());
+
         poppedTypes(pc, argCount + 1)->addCall(cx, callsite);
         break;
       }
@@ -3695,7 +3900,7 @@ ScriptAnalysis::analyzeTypesBytecode(JSContext *cx, unsigned offset,
       case JSOP_NEWINIT:
       case JSOP_NEWARRAY:
       case JSOP_NEWOBJECT: {
-        TypeSet *types = script->analysis()->bytecodeTypes(pc);
+        StackTypeSet *types = script->analysis()->bytecodeTypes(pc);
         types->addSubset(cx, &pushed[0]);
 
         bool isArray = (op == JSOP_NEWARRAY || (op == JSOP_NEWINIT && GET_UINT8(pc) == JSProto_Array));
@@ -3833,7 +4038,7 @@ ScriptAnalysis::analyzeTypesBytecode(JSContext *cx, unsigned offset,
          * 'for each' loops together, oh well.
          */
         if (!state.forTypes) {
-          state.forTypes = TypeSet::make(cx, "forTypes");
+          state.forTypes = StackTypeSet::make(cx, "forTypes");
           if (!state.forTypes)
               return false;
         }
@@ -3999,6 +4204,34 @@ ScriptAnalysis::analyzeTypes(JSContext *cx)
 
     TypeInferenceState state(cx);
 
+    /*
+     * Generate type sets for the inputs to property reads in the script,
+     * unless it already has them. If we purge analysis information and end up
+     * reanalyzing types in the script, we don't want to regenerate constraints
+     * on these property inputs as they will be duplicating information on the
+     * property type sets previously added.
+     */
+    if (script->types->propertyReadTypes) {
+        state.hasPropertyReadTypes = true;
+    } else {
+        HeapTypeSet *typeArray =
+            (HeapTypeSet*) cx->typeLifoAlloc().alloc(sizeof(HeapTypeSet) * numPropertyReads());
+        if (!typeArray) {
+            cx->compartment->types.setPendingNukeTypes(cx);
+            return;
+        }
+        script->types->propertyReadTypes = typeArray;
+        PodZero(typeArray, numPropertyReads());
+
+#ifdef DEBUG
+        for (unsigned i = 0; i < numPropertyReads(); i++) {
+            InferSpew(ISpewOps, "typeSet: %sT%p%s propertyRead%u #%u",
+                      InferSpewColor(&typeArray[i]), &typeArray[i], InferSpewColorReset(),
+                      i, script->id());
+        }
+#endif
+    }
+
     unsigned offset = 0;
     while (offset < script->length) {
         Bytecode *code = maybeCode(offset);
@@ -4013,6 +4246,8 @@ ScriptAnalysis::analyzeTypes(JSContext *cx)
         offset += GetBytecodeLength(pc);
     }
 
+    JS_ASSERT(state.propertyReadIndex == numPropertyReads());
+
     for (unsigned i = 0; i < state.phiNodes.length(); i++) {
         SSAPhiNode *node = state.phiNodes[i];
         for (unsigned j = 0; j < node->length; j++) {
@@ -4036,6 +4271,11 @@ ScriptAnalysis::analyzeTypes(JSContext *cx)
         }
         result = result->next;
     }
+
+    if (!script->hasFreezeConstraints) {
+        TypeScript::AddFreezeConstraints(cx, script);
+        script->hasFreezeConstraints = true;
+    }
 }
 
 bool
@@ -4053,11 +4293,11 @@ ScriptAnalysis::integerOperation(JSContext *cx, jsbytecode *pc)
       case JSOP_DECLOCAL:
       case JSOP_LOCALINC:
       case JSOP_LOCALDEC: {
-        if (pushedTypes(pc, 0)->getKnownTypeTag(cx) != JSVAL_TYPE_INT32)
+        if (pushedTypes(pc, 0)->getKnownTypeTag() != JSVAL_TYPE_INT32)
             return false;
         uint32_t slot = GetBytecodeSlot(script, pc);
         if (trackSlot(slot)) {
-            if (poppedTypes(pc, 0)->getKnownTypeTag(cx) != JSVAL_TYPE_INT32)
+            if (poppedTypes(pc, 0)->getKnownTypeTag() != JSVAL_TYPE_INT32)
                 return false;
         }
         return true;
@@ -4067,11 +4307,11 @@ ScriptAnalysis::integerOperation(JSContext *cx, jsbytecode *pc)
       case JSOP_SUB:
       case JSOP_MUL:
       case JSOP_DIV:
-        if (pushedTypes(pc, 0)->getKnownTypeTag(cx) != JSVAL_TYPE_INT32)
+        if (pushedTypes(pc, 0)->getKnownTypeTag() != JSVAL_TYPE_INT32)
             return false;
-        if (poppedTypes(pc, 0)->getKnownTypeTag(cx) != JSVAL_TYPE_INT32)
+        if (poppedTypes(pc, 0)->getKnownTypeTag() != JSVAL_TYPE_INT32)
             return false;
-        if (poppedTypes(pc, 1)->getKnownTypeTag(cx) != JSVAL_TYPE_INT32)
+        if (poppedTypes(pc, 1)->getKnownTypeTag() != JSVAL_TYPE_INT32)
             return false;
         return true;
 
@@ -4090,9 +4330,11 @@ public:
     TypeObject *object;
 
     TypeConstraintClearDefiniteSetter(TypeObject *object)
-        : TypeConstraint("clearDefiniteSetter"), object(object)
+        : object(object)
     {}
 
+    const char *kind() { return "clearDefiniteSetter"; }
+
     void newPropertyState(JSContext *cx, TypeSet *source)
     {
         if (!object->newScript)
@@ -4103,7 +4345,7 @@ public:
          * non-writable, both of which are indicated by the source type set
          * being marked as configured.
          */
-        if (!(object->flags & OBJECT_FLAG_NEW_SCRIPT_CLEARED) && source->isOwnProperty(true))
+        if (!(object->flags & OBJECT_FLAG_NEW_SCRIPT_CLEARED) && source->ownProperty(true))
             object->clearNewScript(cx);
     }
 
@@ -4120,9 +4362,11 @@ public:
     TypeObject *object;
 
     TypeConstraintClearDefiniteSingle(TypeObject *object)
-        : TypeConstraint("clearDefiniteSingle"), object(object)
+        : object(object)
     {}
 
+    const char *kind() { return "clearDefiniteSingle"; }
+
     void newType(JSContext *cx, TypeSet *source, Type type) {
         if (object->flags & OBJECT_FLAG_NEW_SCRIPT_CLEARED)
             return;
@@ -4334,8 +4578,8 @@ AnalyzePoppedThis(JSContext *cx, Vector<SSAUseChain *> *pendingPoppedThis,
                 TypeObject *parentObject = parent->getType(cx);
                 if (parentObject->unknownProperties())
                     return false;
-                TypeSet *parentTypes = parentObject->getProperty(cx, id, false);
-                if (!parentTypes || parentTypes->isOwnProperty(true))
+                HeapTypeSet *parentTypes = parentObject->getProperty(cx, id, false);
+                if (!parentTypes || parentTypes->ownProperty(true))
                     return false;
                 parentTypes->add(cx, cx->typeLifoAlloc().new_<TypeConstraintClearDefiniteSetter>(type));
                 parent = parent->getProto();
@@ -4399,12 +4643,12 @@ AnalyzePoppedThis(JSContext *cx, Vector<SSAUseChain *> *pendingPoppedThis,
             analysis->breakTypeBarriersSSA(cx, analysis->poppedValue(calleepc, 0));
             analysis->breakTypeBarriers(cx, calleepc - script->code, true);
 
-            TypeSet *funcallTypes = analysis->poppedTypes(pc, GET_ARGC(pc) + 1);
-            TypeSet *scriptTypes = analysis->poppedTypes(pc, GET_ARGC(pc));
+            StackTypeSet *funcallTypes = analysis->poppedTypes(pc, GET_ARGC(pc) + 1);
+            StackTypeSet *scriptTypes = analysis->poppedTypes(pc, GET_ARGC(pc));
 
             /* Need to definitely be calling Function.call on a specific script. */
-            JSObject *funcallObj = funcallTypes->getSingleton(cx, false);
-            JSObject *scriptObj = scriptTypes->getSingleton(cx, false);
+            JSObject *funcallObj = funcallTypes->getSingleton();
+            JSObject *scriptObj = scriptTypes->getSingleton();
             if (!funcallObj || !scriptObj || !scriptObj->isFunction() ||
                 !scriptObj->toFunction()->isInterpreted()) {
                 return false;
@@ -4417,9 +4661,9 @@ AnalyzePoppedThis(JSContext *cx, Vector<SSAUseChain *> *pendingPoppedThis,
              * should the Function.call or callee itself change in the future.
              */
             funcallTypes->add(cx,
-                cx->typeLifoAlloc().new_<TypeConstraintClearDefiniteSingle>(type));
+                cx->analysisLifoAlloc().new_<TypeConstraintClearDefiniteSingle>(type));
             scriptTypes->add(cx,
-                cx->typeLifoAlloc().new_<TypeConstraintClearDefiniteSingle>(type));
+                cx->analysisLifoAlloc().new_<TypeConstraintClearDefiniteSingle>(type));
 
             TypeNewScript::Initializer pushframe(TypeNewScript::Initializer::FRAME_PUSH, uses->offset);
             if (!initializerList->append(pushframe)) {
@@ -4717,6 +4961,8 @@ MarkIteratorUnknownSlow(JSContext *cx)
     result->next = script->types->dynamicList;
     script->types->dynamicList = result;
 
+    AddPendingRecompile(cx, script, NULL);
+
     if (!script->hasAnalysis() || !script->analysis()->ranInference())
         return;
 
@@ -4729,10 +4975,6 @@ MarkIteratorUnknownSlow(JSContext *cx)
         if (JSOp(*pc) == JSOP_ITERNEXT)
             analysis->pushedTypes(pc, 0)->addType(cx, Type::UnknownType());
     }
-
-    /* Trigger recompilation of any inline callers. */
-    if (script->function() && !script->function()->hasLazyType())
-        ObjectStateChange(cx, script->function()->type(), false, true);
 }
 
 void
@@ -4864,14 +5106,45 @@ TypeDynamicResult(JSContext *cx, JSScript *script, jsbytecode *pc, Type type)
     result->next = script->types->dynamicList;
     script->types->dynamicList = result;
 
+    /*
+     * New type information normally requires all code in the entire script to
+     * be recompiled, as changes to types can flow through variables etc. into
+     * other chunks in the compiled script.
+     *
+     * We can do better than this, though, when we can prove the new type will
+     * only be visible at certain points in the script. Namely, for arithmetic
+     * operations which might produce doubles and are then passed to an
+     * expression that cancels out integer overflow, i.e.'OP & -1' or 'OP | 0',
+     * the new type will only affect OP and the bitwise operation.
+     *
+     * This can prevent a significant amount of recompilation in scripts which
+     * use these operations extensively, principally autotranslated code.
+     */
+
+    jsbytecode *ignorePC = pc + GetBytecodeLength(pc);
+    if (*ignorePC == JSOP_INT8 && GET_INT8(ignorePC) == -1) {
+        ignorePC += JSOP_INT8_LENGTH;
+        if (*ignorePC != JSOP_BITAND)
+            ignorePC = NULL;
+    } else if (*ignorePC == JSOP_ZERO) {
+        ignorePC += JSOP_ZERO_LENGTH;
+        if (*ignorePC != JSOP_BITOR)
+            ignorePC = NULL;
+    } else {
+        ignorePC = NULL;
+    }
+
+    if (ignorePC) {
+        AddPendingRecompile(cx, script, pc);
+        AddPendingRecompile(cx, script, ignorePC);
+    } else {
+        AddPendingRecompile(cx, script, NULL);
+    }
+
     if (script->hasAnalysis() && script->analysis()->ranInference()) {
         TypeSet *pushed = script->analysis()->pushedTypes(pc, 0);
         pushed->addType(cx, type);
     }
-
-    /* Trigger recompilation of any inline callers. */
-    if (script->function() && !script->function()->hasLazyType())
-        ObjectStateChange(cx, script->function()->type(), false, true);
 }
 
 void
@@ -5005,13 +5278,20 @@ JSScript::makeTypes(JSContext *cx)
 
     new(types) TypeScript();
 
-#ifdef DEBUG
     TypeSet *typeArray = types->typeArray();
+    TypeSet *returnTypes = TypeScript::ReturnTypes(this);
+
+    for (unsigned i = 0; i < count; i++) {
+        TypeSet *types = &typeArray[i];
+        if (types != returnTypes)
+            types->setConstraintsPurged();
+    }
+
+#ifdef DEBUG
     for (unsigned i = 0; i < nTypeSets; i++)
         InferSpew(ISpewOps, "typeSet: %sT%p%s bytecode%u #%u",
                   InferSpewColor(&typeArray[i]), &typeArray[i], InferSpewColorReset(),
                   i, id());
-    TypeSet *returnTypes = TypeScript::ReturnTypes(this);
     InferSpew(ISpewOps, "typeSet: %sT%p%s return #%u",
               InferSpewColor(returnTypes), returnTypes, InferSpewColorReset(),
               id());
@@ -5044,7 +5324,7 @@ JSScript::makeAnalysis(JSContext *cx)
 
     AutoEnterAnalysis enter(cx);
 
-    types->analysis = cx->typeLifoAlloc().new_<ScriptAnalysis>(this);
+    types->analysis = cx->analysisLifoAlloc().new_<ScriptAnalysis>(this);
 
     if (!types->analysis)
         return false;
@@ -5443,6 +5723,8 @@ JSCompartment::getLazyType(JSContext *cx, JSObject *proto_)
 void
 TypeSet::sweep(JSCompartment *compartment)
 {
+    JS_ASSERT(!purged());
+
     /*
      * Purge references to type objects that are no longer live. Type sets hold
      * only weak references. For type sets containing more than one object,
@@ -5461,7 +5743,7 @@ TypeSet::sweep(JSCompartment *compartment)
             if (object && !IsAboutToBeFinalized(object)) {
                 TypeObjectKey **pentry =
                     HashSetInsert<TypeObjectKey *,TypeObjectKey,TypeObjectKey>
-                        (compartment, objectSet, objectCount, object);
+                        (compartment->typeLifoAlloc, objectSet, objectCount, object);
                 if (pentry)
                     *pentry = object;
                 else
@@ -5543,12 +5825,12 @@ TypeObject::sweep(FreeOp *fop)
         propertyCount = 0;
         for (unsigned i = 0; i < oldCapacity; i++) {
             Property *prop = oldArray[i];
-            if (prop && prop->types.isOwnProperty(false)) {
+            if (prop && prop->types.ownProperty(false)) {
                 Property *newProp = compartment->typeLifoAlloc.new_<Property>(*prop);
                 if (newProp) {
                     Property **pentry =
                         HashSetInsert<jsid,Property,Property>
-                            (compartment, propertySet, propertyCount, prop->id);
+                            (compartment->typeLifoAlloc, propertySet, propertyCount, prop->id);
                     if (pentry) {
                         *pentry = newProp;
                         newProp->types.sweep(compartment);
@@ -5563,7 +5845,7 @@ TypeObject::sweep(FreeOp *fop)
         setBasePropertyCount(propertyCount);
     } else if (propertyCount == 1) {
         Property *prop = (Property *) propertySet;
-        if (prop->types.isOwnProperty(false)) {
+        if (prop->types.ownProperty(false)) {
             Property *newProp = compartment->typeLifoAlloc.new_<Property>(*prop);
             if (newProp) {
                 propertySet = (Property **) newProp;
@@ -5689,17 +5971,16 @@ TypeCompartment::sweep(FreeOp *fop)
     pendingArray = NULL;
     pendingCapacity = 0;
 
-    sweepCompilerOutputs(fop);
+    sweepCompilerOutputs(fop, true);
 }
 
 void
-TypeCompartment::sweepCompilerOutputs(FreeOp *fop)
+TypeCompartment::sweepCompilerOutputs(FreeOp *fop, bool discardConstraints)
 {
-
     if (constrainedOutputs) {
         bool isCompiling = compiledInfo.outputIndex != RecompileInfo::NoCompilerRunning;
-        if (isCompiling && !compartment()->activeAnalysis)
-        {
+        if (discardConstraints) {
+            JS_ASSERT(!isCompiling);
 #if DEBUG
             for (unsigned i = 0; i < constrainedOutputs->length(); i++) {
                 CompilerOutput &co = (*constrainedOutputs)[i];
@@ -5709,10 +5990,9 @@ TypeCompartment::sweepCompilerOutputs(FreeOp *fop)
             fop->delete_(constrainedOutputs);
             constrainedOutputs = NULL;
         } else {
-            // A Compilation is running and the AutoEnterCompilation class has
-            // captured an index into the constrained outputs vector and
-            // potentially created multiple types with this index.  Instead, we
-            // invalidate all compilations except the one running now.
+            // Constraints have captured an index to the constrained outputs
+            // vector.  Thus, we invalidate all compilations except the one
+            // which is potentially running now.
             size_t len = constrainedOutputs->length();
             if (isCompiling) {
                 len--;
@@ -5786,6 +6066,12 @@ TypeScript::Sweep(FreeOp *fop, JSScript *script)
             presult = &result->next;
         }
     }
+
+    /*
+     * Freeze constraints on stack type sets need to be regenerated the next
+     * time the script is analyzed.
+     */
+    script->hasFreezeConstraints = false;
 }
 
 void
@@ -5800,6 +6086,133 @@ TypeScript::destroy()
     Foreground::free_(this);
 }
 
+/* static */ void
+TypeScript::AddFreezeConstraints(JSContext *cx, JSScript *script)
+{
+    /*
+     * Adding freeze constraints to a script ensures that code for the script
+     * will be recompiled any time any type set for stack values in the script
+     * change: these type sets are implicitly frozen during compilation.
+     *
+     * To ensure this occurs, we don't need to add freeze constraints to the
+     * type sets for every stack value, but rather only the input type sets
+     * to analysis of the stack in a script. The contents of the stack sets
+     * are completely determined by these input sets and by any dynamic types
+     * in the script (for which TypeDynamicResult will trigger recompilation).
+     *
+     * Add freeze constraints to each input type set, which includes sets for
+     * all arguments, locals, and monitored type sets in the script. This
+     * includes all type sets in the TypeScript except the script's return
+     * value types.
+     */
+
+    size_t count = TypeScript::NumTypeSets(script);
+    TypeSet *returnTypes = TypeScript::ReturnTypes(script);
+
+    TypeSet *array = script->types->typeArray();
+    for (size_t i = 0; i < count; i++) {
+        TypeSet *types = &array[i];
+        if (types == returnTypes)
+            continue;
+        JS_ASSERT(types->constraintsPurged());
+        types->add(cx, cx->analysisLifoAlloc().new_<TypeConstraintFreezeStack>(script), false);
+    }
+}
+
+/* static */ void
+TypeScript::Purge(JSContext *cx, JSScript *script)
+{
+    if (!script->types)
+        return;
+
+    unsigned num = NumTypeSets(script);
+    TypeSet *typeArray = script->types->typeArray();
+    TypeSet *returnTypes = ReturnTypes(script);
+
+    bool ranInference = script->hasAnalysis() && script->analysis()->ranInference();
+
+    script->clearAnalysis();
+
+    if (!ranInference && !script->hasFreezeConstraints) {
+        /*
+         * Even if the script hasn't been analyzed by TI, TypeConstraintCall
+         * can still add constraints on 'this' for 'new' calls.
+         */
+        ThisTypes(script)->constraintList = NULL;
+#ifdef DEBUG
+        for (size_t i = 0; i < num; i++) {
+            TypeSet *types = &typeArray[i];
+            JS_ASSERT_IF(types != returnTypes, !types->constraintList);
+        }
+#endif
+        return;
+    }
+
+    for (size_t i = 0; i < num; i++) {
+        TypeSet *types = &typeArray[i];
+        if (types != returnTypes)
+            types->constraintList = NULL;
+    }
+
+    if (script->hasFreezeConstraints)
+        TypeScript::AddFreezeConstraints(cx, script);
+}
+
+void
+TypeCompartment::maybePurgeAnalysis(JSContext *cx, bool force)
+{
+    // FIXME bug 781657
+    return;
+
+    JS_ASSERT(this == &cx->compartment->types);
+    JS_ASSERT(!cx->compartment->activeAnalysis);
+
+    if (!cx->typeInferenceEnabled())
+        return;
+
+    size_t triggerBytes = cx->runtime->analysisPurgeTriggerBytes;
+    size_t beforeUsed = cx->compartment->analysisLifoAlloc.used();
+
+    if (!force) {
+        if (!triggerBytes || triggerBytes >= beforeUsed)
+            return;
+    }
+
+    AutoEnterTypeInference enter(cx);
+
+    /* Reset the analysis pool, making its memory available for reuse. */
+    cx->compartment->analysisLifoAlloc.releaseAll();
+
+    uint64_t start = PRMJ_Now();
+
+    for (gc::CellIter i(cx->compartment, gc::FINALIZE_SCRIPT); !i.done(); i.next()) {
+        JSScript *script = i.get<JSScript>();
+        TypeScript::Purge(cx, script);
+    }
+
+    uint64_t done = PRMJ_Now();
+
+    if (cx->runtime->analysisPurgeCallback) {
+        size_t afterUsed = cx->compartment->analysisLifoAlloc.used();
+        size_t typeUsed = cx->compartment->typeLifoAlloc.used();
+
+        char buf[1000];
+        JS_snprintf(buf, sizeof(buf),
+                    "Total Time %.2f ms, %d bytes before, %d bytes after\n",
+                    (done - start) / double(PRMJ_USEC_PER_MSEC),
+                    (int) (beforeUsed + typeUsed),
+                    (int) (afterUsed + typeUsed));
+
+        JSString *desc = JS_NewStringCopyZ(cx, buf);
+        if (!desc) {
+            cx->clearPendingException();
+            return;
+        }
+
+        cx->runtime->analysisPurgeCallback(cx->runtime, &desc->asFlat());
+    }
+}
+
 inline size_t
 TypeSet::computedSizeOfExcludingThis()
 {
@@ -5881,6 +6294,7 @@ JSCompartment::sizeOfTypeInferenceData(TypeInferenceSizes *sizes, JSMallocSizeOf
      * by being copied to the replacement pool. This memory will be counted
      * elsewhere and deducted from the amount of temporary data.
      */
+    sizes->temporary += analysisLifoAlloc.sizeOfExcludingThis(mallocSizeOf);
     sizes->temporary += typeLifoAlloc.sizeOfExcludingThis(mallocSizeOf);
 
     /* Pending arrays are cleared on GC along with the analysis pool. */
diff --git a/js/src/jsinfer.h b/js/src/jsinfer.h
index 85a10e56176e..3b5ad0251f4d 100644
--- a/js/src/jsinfer.h
+++ b/js/src/jsinfer.h
@@ -29,7 +29,6 @@ namespace js {
 
 class CallObject;
 
-
 namespace mjit {
     struct JITScript;
 }
@@ -135,17 +134,35 @@ inline Type GetValueType(JSContext *cx, const Value &val);
  * Inference constructs a global web of constraints relating the contents of
  * type sets particular to various scripts and type objects within a
  * compartment. This data can consume a significant amount of memory, and to
- * avoid this building up we try to clear it with some regularity. On each GC
- * which occurs while we are not actively working with inference or other
- * analysis information, we clear out all generated constraints, all type sets
- * describing stack types within scripts, and (normally) all data describing
- * type objects for particular JS objects (see the lazy type objects overview
- * below). JIT code depends on this data and is cleared as well.
+ * avoid this building up we try to clear it with some regularity.
  *
- * All this data is allocated into compartment->pool. Some type inference data
- * lives across GCs: type sets for scripts and non-singleton type objects, and
- * propeties for such type objects. This data is also allocated into
- * compartment->pool, but everything still live is copied to a new arena on GC.
+ * There are two operations which can clear inference and analysis data.
+ *
+ * - Analysis purges clear analysis information while retaining jitcode.
+ *
+ * - GCs may clear both analysis information and jitcode. Sometimes GCs will
+ *   preserve all information and code, and will not collect any scripts,
+ *   type objects or singleton JS objects.
+ *
+ * There are several categories of data affected differently by the above
+ * operations.
+ *
+ * - Data cleared by every analysis purge and non-preserving GC. This includes
+ *   the ScriptAnalysis for each analyzed script and data from each analysis
+ *   pass performed, type sets for stack values, and all type constraints for
+ *   such type sets and for observed/argument/local type sets on scripts
+ *   (TypeSet::constraintsPurged, aka StackTypeSet). This is exactly the data
+ *   allocated using compartment->analysisLifoAlloc.
+ *
+ * - Data cleared by non-preserving GCs. This includes property type sets for
+ *   singleton JS objects, property read input type sets, type constraints on
+ *   all type sets, and dead references in all type sets. This data is all
+ *   allocated using compartment->typeLifoAlloc; the GC copies live data into a
+ *   new allocator and clears the old one.
+ *
+ * - Data cleared occasionally by non-preserving GCs. TypeScripts and the data
+ *   in their sets are occasionally destroyed during GC. When a JSScript or
+ *   TypeObject is swept, type information for its contents is destroyed.
  */
 
 /*
@@ -155,23 +172,15 @@ inline Type GetValueType(JSContext *cx, const Value &val);
 class TypeConstraint
 {
 public:
-#ifdef DEBUG
-    const char *kind_;
-    const char *kind() const { return kind_; }
-#else
-    const char *kind() const { return NULL; }
-#endif
-
     /* Next constraint listening to the same type set. */
     TypeConstraint *next;
 
-    TypeConstraint(const char *kind)
+    TypeConstraint()
         : next(NULL)
-    {
-#ifdef DEBUG
-        this->kind_ = kind;
-#endif
-    }
+    {}
+
+    /* Debugging name for this kind of constraint. */
+    virtual const char *kind() = 0;
 
     /* Register a new type for the set this constraint is listening to. */
     virtual void newType(JSContext *cx, TypeSet *source, Type type) = 0;
@@ -213,30 +222,45 @@ enum {
     /* Mask of normal type flags on a type set. */
     TYPE_FLAG_BASE_MASK           = 0x000100ff,
 
+    /* Flags describing the kind of type set this is. */
+
+    /*
+     * Flag for type sets which describe stack values and are cleared on
+     * analysis purges.
+     */
+    TYPE_FLAG_PURGED              = 0x00020000,
+
+    /*
+     * Flag for type sets whose constraints are cleared on analysis purges.
+     * This includes all temporary type sets, as well as sets in TypeScript
+     * which propagate into temporary type sets.
+     */
+    TYPE_FLAG_CONSTRAINTS_PURGED  = 0x00040000,
+
     /* Flags for type sets which are on object properties. */
 
     /*
      * Whether there are subset constraints propagating the possible types
      * for this property inherited from the object's prototypes. Reset on GC.
      */
-    TYPE_FLAG_PROPAGATED_PROPERTY = 0x00020000,
+    TYPE_FLAG_PROPAGATED_PROPERTY = 0x00080000,
 
     /* Whether this property has ever been directly written. */
-    TYPE_FLAG_OWN_PROPERTY        = 0x00040000,
+    TYPE_FLAG_OWN_PROPERTY        = 0x00100000,
 
     /*
      * Whether the property has ever been deleted or reconfigured to behave
      * differently from a normal native property (e.g. made non-writable or
      * given a scripted getter or setter).
      */
-    TYPE_FLAG_CONFIGURED_PROPERTY = 0x00080000,
+    TYPE_FLAG_CONFIGURED_PROPERTY = 0x00200000,
 
     /*
      * Whether the property is definitely in a particular inline slot on all
      * objects from which it has not been deleted or reconfigured. Implies
      * OWN_PROPERTY and unlike OWN/CONFIGURED property, this cannot change.
      */
-    TYPE_FLAG_DEFINITE_PROPERTY   = 0x00100000,
+    TYPE_FLAG_DEFINITE_PROPERTY   = 0x00400000,
 
     /* If the property is definite, mask and shift storing the slot. */
     TYPE_FLAG_DEFINITE_MASK       = 0x0f000000,
@@ -315,6 +339,9 @@ enum {
 };
 typedef uint32_t TypeObjectFlags;
 
+class StackTypeSet;
+class HeapTypeSet;
+
 /* Information about the set of types associated with an lvalue. */
 class TypeSet
 {
@@ -352,12 +379,12 @@ class TypeSet
         return !!(baseFlags() & flags);
     }
 
-    bool isOwnProperty(bool configurable) const {
+    bool ownProperty(bool configurable) const {
         return flags & (configurable ? TYPE_FLAG_CONFIGURED_PROPERTY : TYPE_FLAG_OWN_PROPERTY);
     }
-    bool isDefiniteProperty() const { return flags & TYPE_FLAG_DEFINITE_PROPERTY; }
+    bool definiteProperty() const { return flags & TYPE_FLAG_DEFINITE_PROPERTY; }
     unsigned definiteSlot() const {
-        JS_ASSERT(isDefiniteProperty());
+        JS_ASSERT(definiteProperty());
         return flags >> TYPE_FLAG_DEFINITE_SHIFT;
     }
 
@@ -393,55 +420,115 @@ class TypeSet
     bool hasPropagatedProperty() { return !!(flags & TYPE_FLAG_PROPAGATED_PROPERTY); }
     void setPropagatedProperty() { flags |= TYPE_FLAG_PROPAGATED_PROPERTY; }
 
-    enum FilterKind {
-        FILTER_ALL_PRIMITIVES,
-        FILTER_NULL_VOID,
-        FILTER_VOID
-    };
+    bool constraintsPurged() { return !!(flags & TYPE_FLAG_CONSTRAINTS_PURGED); }
+    void setConstraintsPurged() { flags |= TYPE_FLAG_CONSTRAINTS_PURGED; }
 
-    /* Add specific kinds of constraints to this set. */
+    bool purged() { return !!(flags & TYPE_FLAG_PURGED); }
+    void setPurged() { flags |= TYPE_FLAG_PURGED | TYPE_FLAG_CONSTRAINTS_PURGED; }
+
+    inline StackTypeSet *toStackTypeSet();
+    inline HeapTypeSet *toHeapTypeSet();
+
+    inline void addTypesToConstraint(JSContext *cx, TypeConstraint *constraint);
     inline void add(JSContext *cx, TypeConstraint *constraint, bool callExisting = true);
+
+  protected:
+    uint32_t baseObjectCount() const {
+        return (flags & TYPE_FLAG_OBJECT_COUNT_MASK) >> TYPE_FLAG_OBJECT_COUNT_SHIFT;
+    }
+    inline void setBaseObjectCount(uint32_t count);
+
+    inline void clearObjects();
+};
+
+/*
+ * Type set for a stack value manipulated in a script, or the argument or
+ * local types of said script. Constraints on these type sets are cleared
+ * during analysis purges; the contents of the sets are implicitly frozen
+ * during compilation to ensure that changes to the sets trigger recompilation
+ * of the associated script.
+ */
+class StackTypeSet : public TypeSet
+{
+  public:
+
+    /*
+     * Make a type set with the specified debugging name, not embedded in
+     * another structure.
+     */
+    static StackTypeSet *make(JSContext *cx, const char *name);
+
+    /* Constraints for type inference. */
+
     void addSubset(JSContext *cx, TypeSet *target);
     void addGetProperty(JSContext *cx, JSScript *script, jsbytecode *pc,
-                        TypeSet *target, jsid id);
+                        StackTypeSet *target, jsid id);
     void addSetProperty(JSContext *cx, JSScript *script, jsbytecode *pc,
-                        TypeSet *target, jsid id);
-    void addCallProperty(JSContext *cx, JSScript *script, jsbytecode *pc, jsid id);
+                        StackTypeSet *target, jsid id);
     void addSetElement(JSContext *cx, JSScript *script, jsbytecode *pc,
-                       TypeSet *objectTypes, TypeSet *valueTypes);
+                       StackTypeSet *objectTypes, StackTypeSet *valueTypes);
     void addCall(JSContext *cx, TypeCallsite *site);
     void addArith(JSContext *cx, JSScript *script, jsbytecode *pc,
                   TypeSet *target, TypeSet *other = NULL);
     void addTransformThis(JSContext *cx, JSScript *script, TypeSet *target);
     void addPropagateThis(JSContext *cx, JSScript *script, jsbytecode *pc,
-                          Type type, TypeSet *types = NULL);
-    void addFilterPrimitives(JSContext *cx, TypeSet *target, FilterKind filter);
+                          Type type, StackTypeSet *types = NULL);
     void addSubsetBarrier(JSContext *cx, JSScript *script, jsbytecode *pc, TypeSet *target);
 
     /*
-     * Make an type set with the specified debugging name, not embedded in
-     * another structure.
+     * Constraints for JIT compilation.
+     *
+     * Methods for JIT compilation. These must be used when a script is
+     * currently being compiled (see AutoEnterCompilation) and will add
+     * constraints ensuring that if the return value change in the future due
+     * to new type information, the script's jitcode will be discarded.
      */
-    static TypeSet *make(JSContext *cx, const char *name);
+
+    /* Get any type tag which all values in this set must have. */
+    JSValueType getKnownTypeTag();
+
+    bool isMagicArguments() { return getKnownTypeTag() == JSVAL_TYPE_MAGIC; }
+
+    /* Whether the type set contains objects with any of a set of flags. */
+    bool hasObjectFlags(JSContext *cx, TypeObjectFlags flags);
 
     /*
-     * Methods for JIT compilation. If a script is currently being compiled
-     * (see AutoEnterCompilation) these will add constraints ensuring that if
-     * the return value change in the future due to new type information, the
-     * currently compiled script will be marked for recompilation.
+     * Get the typed array type of all objects in this set. Returns
+     * TypedArray::TYPE_MAX if the set contains different array types.
      */
+    int getTypedArrayType();
+
+    /* Get the single value which can appear in this type set, otherwise NULL. */
+    JSObject *getSingleton();
+
+    /* Whether any objects in the type set needs a barrier on id. */
+    bool propertyNeedsBarrier(JSContext *cx, jsid id);
+};
+
+/*
+ * Type set for a property of a TypeObject, or for the return value or property
+ * read inputs of a script. In contrast with stack type sets, constraints on
+ * these sets are not cleared during analysis purges, and are not implicitly
+ * frozen during compilation.
+ */
+class HeapTypeSet : public TypeSet
+{
+  public:
+
+    /* Constraints for type inference. */
+
+    void addSubset(JSContext *cx, TypeSet *target);
+    void addGetProperty(JSContext *cx, JSScript *script, jsbytecode *pc,
+                        StackTypeSet *target, jsid id);
+    void addCallProperty(JSContext *cx, JSScript *script, jsbytecode *pc, jsid id);
+    void addFilterPrimitives(JSContext *cx, TypeSet *target);
+    void addSubsetBarrier(JSContext *cx, JSScript *script, jsbytecode *pc, TypeSet *target);
+
+    /* Constraints for JIT compilation. */
 
     /* Completely freeze the contents of this type set. */
     void addFreeze(JSContext *cx);
 
-    /* Get any type tag which all values in this set must have. */
-    JSValueType getKnownTypeTag(JSContext *cx);
-
-    bool isMagicArguments(JSContext *cx) { return getKnownTypeTag(cx) == JSVAL_TYPE_MAGIC; }
-
-    /* Whether the type set or a particular object has any of a set of flags. */
-    bool hasObjectFlags(JSContext *cx, TypeObjectFlags flags);
-    static bool HasObjectFlags(JSContext *cx, TypeObject *object, TypeObjectFlags flags);
 
     /*
      * Watch for a generic object state change on a type object. This currently
@@ -450,6 +537,9 @@ class TypeSet
      */
     static void WatchObjectStateChange(JSContext *cx, TypeObject *object);
 
+    /* Whether an object has any of a set of flags. */
+    static bool HasObjectFlags(JSContext *cx, TypeObject *object, TypeObjectFlags flags);
+
     /*
      * For type sets on a property, return true if the property has any 'own'
      * values assigned. If configurable is set, return 'true' if the property
@@ -465,33 +555,30 @@ class TypeSet
     /* Get whether this type set is known to be a subset of other. */
     bool knownSubset(JSContext *cx, TypeSet *other);
 
-    /*
-     * Get the typed array type of all objects in this set. Returns
-     * TypedArray::TYPE_MAX if the set contains different array types.
-     */
-    int getTypedArrayType(JSContext *cx);
-
     /* Get the single value which can appear in this type set, otherwise NULL. */
-    JSObject *getSingleton(JSContext *cx, bool freeze = true);
-
-    inline void clearObjects();
+    JSObject *getSingleton(JSContext *cx);
 
     /*
      * Whether a location with this TypeSet needs a write barrier (i.e., whether
      * it can hold GC things). The type set is frozen if no barrier is needed.
      */
     bool needsBarrier(JSContext *cx);
-
-    /* The type set is frozen if no barrier is needed. */
-    bool propertyNeedsBarrier(JSContext *cx, jsid id);
-
-  private:
-    uint32_t baseObjectCount() const {
-        return (flags & TYPE_FLAG_OBJECT_COUNT_MASK) >> TYPE_FLAG_OBJECT_COUNT_SHIFT;
-    }
-    inline void setBaseObjectCount(uint32_t count);
 };
 
+inline StackTypeSet *
+TypeSet::toStackTypeSet()
+{
+    JS_ASSERT(constraintsPurged());
+    return (StackTypeSet *) this;
+}
+
+inline HeapTypeSet *
+TypeSet::toHeapTypeSet()
+{
+    JS_ASSERT(!constraintsPurged());
+    return (HeapTypeSet *) this;
+}
+
 /*
  * Handler which persists information about dynamic types pushed within a
  * script which can affect its behavior and are not covered by JOF_TYPESET ops,
@@ -601,7 +688,7 @@ struct Property
     HeapId id;
 
     /* Possible types for this property, including types inherited from prototypes. */
-    TypeSet types;
+    HeapTypeSet types;
 
     inline Property(jsid id);
     inline Property(const Property &o);
@@ -793,10 +880,10 @@ struct TypeObject : gc::Cell
      * assignment, and the own types of the property will be used instead of
      * aggregate types.
      */
-    inline TypeSet *getProperty(JSContext *cx, jsid id, bool assign);
+    inline HeapTypeSet *getProperty(JSContext *cx, jsid id, bool assign);
 
     /* Get a property only if it already exists. */
-    inline TypeSet *maybeGetProperty(JSContext *cx, jsid id);
+    inline HeapTypeSet *maybeGetProperty(JSContext *cx, jsid id);
 
     inline unsigned getPropertyCount();
     inline Property *getProperty(unsigned i);
@@ -901,13 +988,13 @@ struct TypeCallsite
 
     /* Types of each argument to the call. */
     unsigned argumentCount;
-    TypeSet **argumentTypes;
+    StackTypeSet **argumentTypes;
 
     /* Types of the this variable. */
-    TypeSet *thisTypes;
+    StackTypeSet *thisTypes;
 
     /* Type set receiving the return value of this call. */
-    TypeSet *returnTypes;
+    StackTypeSet *returnTypes;
 
     inline TypeCallsite(JSContext *cx, JSScript *script, jsbytecode *pc,
                         bool isNew, unsigned argumentCount);
@@ -925,18 +1012,25 @@ class TypeScript
     /* Dynamic types generated at points within this script. */
     TypeResult *dynamicList;
 
+    /*
+     * Array of type sets storing the possible inputs to property reads.
+     * Generated the first time the script is analyzed by inference and kept
+     * after analysis purges.
+     */
+    HeapTypeSet *propertyReadTypes;
+
     /* Array of type type sets for variables and JOF_TYPESET ops. */
     TypeSet *typeArray() { return (TypeSet *) (uintptr_t(this) + sizeof(TypeScript)); }
 
     static inline unsigned NumTypeSets(JSScript *script);
 
-    static inline TypeSet *ReturnTypes(JSScript *script);
-    static inline TypeSet *ThisTypes(JSScript *script);
-    static inline TypeSet *ArgTypes(JSScript *script, unsigned i);
-    static inline TypeSet *LocalTypes(JSScript *script, unsigned i);
+    static inline HeapTypeSet  *ReturnTypes(JSScript *script);
+    static inline StackTypeSet *ThisTypes(JSScript *script);
+    static inline StackTypeSet *ArgTypes(JSScript *script, unsigned i);
+    static inline StackTypeSet *LocalTypes(JSScript *script, unsigned i);
 
     /* Follows slot layout in jsanalyze.h, can get this/arg/local type sets. */
-    static inline TypeSet *SlotTypes(JSScript *script, unsigned slot);
+    static inline StackTypeSet *SlotTypes(JSScript *script, unsigned slot);
 
 #ifdef DEBUG
     /* Check that correct types were inferred for the values pushed by this bytecode. */
@@ -984,6 +1078,9 @@ class TypeScript
     static inline void SetArgument(JSContext *cx, JSScript *script, unsigned arg, Type type);
     static inline void SetArgument(JSContext *cx, JSScript *script, unsigned arg, const js::Value &value);
 
+    static void AddFreezeConstraints(JSContext *cx, JSScript *script);
+    static void Purge(JSContext *cx, JSScript *script);
+
     static void Sweep(FreeOp *fop, JSScript *script);
     void destroy();
 };
@@ -1165,7 +1262,10 @@ struct TypeCompartment
     void markSetsUnknown(JSContext *cx, TypeObject *obj);
 
     void sweep(FreeOp *fop);
-    void sweepCompilerOutputs(FreeOp *fop);
+    void sweepCompilerOutputs(FreeOp *fop, bool discardConstraints);
+
+    void maybePurgeAnalysis(JSContext *cx, bool force = false);
+
     void finalizeObjects();
 };
 
diff --git a/js/src/jsinferinlines.h b/js/src/jsinferinlines.h
index d681cc6f0ecd..15c7a8353654 100644
--- a/js/src/jsinferinlines.h
+++ b/js/src/jsinferinlines.h
@@ -291,6 +291,7 @@ struct AutoEnterCompilation
       : cx(cx),
         info(cx->compartment->types.compiledInfo)
     {
+        JS_ASSERT(cx->compartment->activeAnalysis);
         JS_ASSERT(info.outputIndex == RecompileInfo::NoCompilerRunning);
     }
 
@@ -602,16 +603,18 @@ TypeScript::NumTypeSets(JSScript *script)
     return script->nTypeSets + analyze::TotalSlots(script);
 }
 
-/* static */ inline TypeSet *
+/* static */ inline HeapTypeSet *
 TypeScript::ReturnTypes(JSScript *script)
 {
-    return script->types->typeArray() + script->nTypeSets + js::analyze::CalleeSlot();
+    TypeSet *types = script->types->typeArray() + script->nTypeSets + js::analyze::CalleeSlot();
+    return types->toHeapTypeSet();
 }
 
-/* static */ inline TypeSet *
+/* static */ inline StackTypeSet *
 TypeScript::ThisTypes(JSScript *script)
 {
-    return script->types->typeArray() + script->nTypeSets + js::analyze::ThisSlot();
+    TypeSet *types = script->types->typeArray() + script->nTypeSets + js::analyze::ThisSlot();
+    return types->toStackTypeSet();
 }
 
 /*
@@ -620,25 +623,28 @@ TypeScript::ThisTypes(JSScript *script)
  * or undefined for localTypes) and not types from subsequent assignments.
  */
 
-/* static */ inline TypeSet *
+/* static */ inline StackTypeSet *
 TypeScript::ArgTypes(JSScript *script, unsigned i)
 {
     JS_ASSERT(i < script->function()->nargs);
-    return script->types->typeArray() + script->nTypeSets + js::analyze::ArgSlot(i);
+    TypeSet *types = script->types->typeArray() + script->nTypeSets + js::analyze::ArgSlot(i);
+    return types->toStackTypeSet();
 }
 
-/* static */ inline TypeSet *
+/* static */ inline StackTypeSet *
 TypeScript::LocalTypes(JSScript *script, unsigned i)
 {
     JS_ASSERT(i < script->nfixed);
-    return script->types->typeArray() + script->nTypeSets + js::analyze::LocalSlot(script, i);
+    TypeSet *types = script->types->typeArray() + script->nTypeSets + js::analyze::LocalSlot(script, i);
+    return types->toStackTypeSet();
 }
 
-/* static */ inline TypeSet *
+/* static */ inline StackTypeSet *
 TypeScript::SlotTypes(JSScript *script, unsigned slot)
 {
     JS_ASSERT(slot < js::analyze::TotalSlots(script));
-    return script->types->typeArray() + script->nTypeSets + slot;
+    TypeSet *types = script->types->typeArray() + script->nTypeSets + slot;
+    return types->toStackTypeSet();
 }
 
 /* static */ inline TypeObject *
@@ -997,7 +1003,7 @@ HashKey(T v)
  */
 template <class T, class U, class KEY>
 static U **
-HashSetInsertTry(JSCompartment *compartment, U **&values, unsigned &count, T key)
+HashSetInsertTry(LifoAlloc &alloc, U **&values, unsigned &count, T key)
 {
     unsigned capacity = HashSetCapacity(count);
     unsigned insertpos = HashKey<T,KEY>(key) & (capacity - 1);
@@ -1021,7 +1027,7 @@ HashSetInsertTry(JSCompartment *compartment, U **&values, unsigned &count, T key
         return &values[insertpos];
     }
 
-    U **newValues = compartment->typeLifoAlloc.newArray<U*>(newCapacity);
+    U **newValues = alloc.newArray<U*>(newCapacity);
     if (!newValues)
         return NULL;
     PodZero(newValues, newCapacity);
@@ -1049,7 +1055,7 @@ HashSetInsertTry(JSCompartment *compartment, U **&values, unsigned &count, T key
  */
 template <class T, class U, class KEY>
 static inline U **
-HashSetInsert(JSCompartment *compartment, U **&values, unsigned &count, T key)
+HashSetInsert(LifoAlloc &alloc, U **&values, unsigned &count, T key)
 {
     if (count == 0) {
         JS_ASSERT(values == NULL);
@@ -1062,7 +1068,7 @@ HashSetInsert(JSCompartment *compartment, U **&values, unsigned &count, T key)
         if (KEY::getKey(oldData) == key)
             return (U **) &values;
 
-        values = compartment->typeLifoAlloc.newArray<U*>(SET_ARRAY_SIZE);
+        values = alloc.newArray<U*>(SET_ARRAY_SIZE);
         if (!values) {
             values = (U **) oldData;
             return NULL;
@@ -1086,7 +1092,7 @@ HashSetInsert(JSCompartment *compartment, U **&values, unsigned &count, T key)
         }
     }
 
-    return HashSetInsertTry<T,U,KEY>(compartment, values, count, key);
+    return HashSetInsertTry<T,U,KEY>(alloc, values, count, key);
 }
 
 /* Lookup an entry in a hash set, return NULL if it does not exist. */
@@ -1208,10 +1214,14 @@ TypeSet::addType(JSContext *cx, Type type)
             return;
         if (type.isAnyObject())
             goto unknownObject;
+
+        LifoAlloc &alloc =
+            purged() ? cx->compartment->analysisLifoAlloc : cx->compartment->typeLifoAlloc;
+
         uint32_t objectCount = baseObjectCount();
         TypeObjectKey *object = type.objectKey();
         TypeObjectKey **pentry = HashSetInsert<TypeObjectKey *,TypeObjectKey,TypeObjectKey>
-                                     (cx->compartment, objectSet, objectCount, object);
+                                     (alloc, objectSet, objectCount, object);
         if (!pentry) {
             cx->compartment->types.setPendingNukeTypes(cx);
             return;
@@ -1326,7 +1336,7 @@ TypeCallsite::TypeCallsite(JSContext *cx, JSScript *script, jsbytecode *pc,
       thisTypes(NULL), returnTypes(NULL)
 {
     /* Caller must check for failure. */
-    argumentTypes = cx->typeLifoAlloc().newArray<TypeSet*>(argumentCount);
+    argumentTypes = cx->analysisLifoAlloc().newArray<StackTypeSet*>(argumentCount);
 }
 
 /////////////////////////////////////////////////////////////////////
@@ -1364,7 +1374,7 @@ TypeObject::setBasePropertyCount(uint32_t count)
           | (count << OBJECT_FLAG_PROPERTY_COUNT_SHIFT);
 }
 
-inline TypeSet *
+inline HeapTypeSet *
 TypeObject::getProperty(JSContext *cx, jsid id, bool assign)
 {
     JS_ASSERT(cx->compartment->activeInference);
@@ -1374,7 +1384,7 @@ TypeObject::getProperty(JSContext *cx, jsid id, bool assign)
 
     uint32_t propertyCount = basePropertyCount();
     Property **pprop = HashSetInsert<jsid,Property,Property>
-                           (cx->compartment, propertySet, propertyCount, id);
+                           (cx->compartment->typeLifoAlloc, propertySet, propertyCount, id);
     if (!pprop) {
         cx->compartment->types.setPendingNukeTypes(cx);
         return NULL;
@@ -1389,15 +1399,25 @@ TypeObject::getProperty(JSContext *cx, jsid id, bool assign)
         }
         if (propertyCount == OBJECT_FLAG_PROPERTY_COUNT_LIMIT) {
             markUnknown(cx);
-            TypeSet *types = TypeSet::make(cx, "propertyOverflow");
-            types->addType(cx, Type::UnknownType());
-            return types;
+
+            /*
+             * Return an arbitrary property in the object, as all have unknown
+             * type and are treated as configured.
+             */
+            unsigned count = getPropertyCount();
+            for (unsigned i = 0; i < count; i++) {
+                if (Property *prop = getProperty(i))
+                    return &prop->types;
+            }
+
+            JS_NOT_REACHED("Missing property");
+            return NULL;
         }
     }
 
-    TypeSet *types = &(*pprop)->types;
+    HeapTypeSet *types = &(*pprop)->types;
 
-    if (assign && !types->isOwnProperty(false)) {
+    if (assign && !types->ownProperty(false)) {
         /*
          * Normally, we just want to set the property as being an own property
          * when we got a set to it. The exception is when the set is actually
@@ -1431,7 +1451,7 @@ TypeObject::getProperty(JSContext *cx, jsid id, bool assign)
     return types;
 }
 
-inline TypeSet *
+inline HeapTypeSet *
 TypeObject::maybeGetProperty(JSContext *cx, jsid id)
 {
     JS_ASSERT(JSID_IS_VOID(id) || JSID_IS_EMPTY(id) || JSID_IS_STRING(id));
@@ -1624,6 +1644,13 @@ JSScript::clearAnalysis()
         types->analysis = NULL;
 }
 
+inline void
+JSScript::clearPropertyReadTypes()
+{
+    if (types && types->propertyReadTypes)
+        types->propertyReadTypes = NULL;
+}
+
 inline void
 js::analyze::ScriptAnalysis::addPushedType(JSContext *cx, uint32_t offset, uint32_t which,
                                            js::types::Type type)
diff --git a/js/src/jsinterp.cpp b/js/src/jsinterp.cpp
index f5e417c5d550..68a9cd87cac6 100644
--- a/js/src/jsinterp.cpp
+++ b/js/src/jsinterp.cpp
@@ -2307,7 +2307,7 @@ BEGIN_CASE(JSOP_SETNAME)
 
     HandleValue value = HandleValue::fromMarkedLocation(&regs.sp[-1]);
 
-    if (!SetNameOperation(cx, regs.pc, scope, value))
+    if (!SetNameOperation(cx, script, regs.pc, scope, value))
         goto error;
 
     regs.sp[-2] = regs.sp[-1];
@@ -2871,7 +2871,7 @@ BEGIN_CASE(JSOP_DEFFUN)
 
     /* ES5 10.5 (NB: with subsequent errata). */
     RootedPropertyName &name = rootName0;
-    name = fun->atom->asPropertyName();
+    name = fun->atom()->asPropertyName();
     RootedShape &shape = rootShape0;
     RootedObject &pobj = rootObject1;
     if (!JSObject::lookupProperty(cx, parent, name, &pobj, &shape))
diff --git a/js/src/jsinterpinlines.h b/js/src/jsinterpinlines.h
index 9a6acf710b91..42b68f1e30d2 100644
--- a/js/src/jsinterpinlines.h
+++ b/js/src/jsinterpinlines.h
@@ -422,12 +422,12 @@ NameOperation(JSContext *cx, JSScript *script, jsbytecode *pc, Value *vp)
 }
 
 inline bool
-SetNameOperation(JSContext *cx, jsbytecode *pc, HandleObject scope, HandleValue val)
+SetNameOperation(JSContext *cx, JSScript *script, jsbytecode *pc, HandleObject scope,
+                 HandleValue val)
 {
     JS_ASSERT(*pc == JSOP_SETNAME || *pc == JSOP_SETGNAME);
     JS_ASSERT_IF(*pc == JSOP_SETGNAME, scope == cx->global());
 
-    JSScript *script = cx->fp()->script();
     bool strict = script->strictModeCode;
     RootedPropertyName name(cx, script->getName(pc));
     RootedValue valCopy(cx, val);
diff --git a/js/src/jsobj.cpp b/js/src/jsobj.cpp
index 285f57dfadc5..6663af05dfd7 100644
--- a/js/src/jsobj.cpp
+++ b/js/src/jsobj.cpp
@@ -5563,9 +5563,9 @@ dumpValue(const Value &v)
         v.toString()->dump();
     else if (v.isObject() && v.toObject().isFunction()) {
         JSFunction *fun = v.toObject().toFunction();
-        if (fun->atom) {
+        if (fun->displayAtom()) {
             fputs("<function ", stderr);
-            FileEscapedString(stderr, fun->atom, 0);
+            FileEscapedString(stderr, fun->displayAtom(), 0);
         } else {
             fputs("<unnamed function", stderr);
         }
diff --git a/js/src/jsobjinlines.h b/js/src/jsobjinlines.h
index 72b6bb0461b9..e86caf0af9e7 100644
--- a/js/src/jsobjinlines.h
+++ b/js/src/jsobjinlines.h
@@ -525,7 +525,7 @@ namespace js {
 static inline JSAtom *
 CallObjectLambdaName(JSFunction &fun)
 {
-    return (fun.flags & JSFUN_LAMBDA) ? fun.atom.get() : NULL;
+    return fun.isNamedLambda() ? fun.atom() : NULL;
 }
 
 } /* namespace js */
diff --git a/js/src/jsopcode.cpp b/js/src/jsopcode.cpp
index 932441a2792d..5ab68c81e718 100644
--- a/js/src/jsopcode.cpp
+++ b/js/src/jsopcode.cpp
@@ -3619,7 +3619,7 @@ Decompile(SprintStack *ss, jsbytecode *pc, int nb)
                         js_printf(jp, "(");
                     SprintOpcodePermanent(jp, rval, rvalpc);
                     js_printf(jp, parens ? ")%s" : "%s",
-                              ((fun->flags & JSFUN_LAMBDA) || !fun->atom)
+                              ((fun->flags & JSFUN_LAMBDA) || !fun->atom())
                               ? ""
                               : ";");
                     todo = -2;
@@ -4850,8 +4850,8 @@ Decompile(SprintStack *ss, jsbytecode *pc, int nb)
                 break;
 
               case JSOP_CALLEE:
-                JS_ASSERT(jp->fun && jp->fun->atom);
-                todo = ss->sprinter.putString(jp->fun->atom);
+                JS_ASSERT(jp->fun && jp->fun->atom());
+                todo = ss->sprinter.putString(jp->fun->atom());
                 break;
 
               case JSOP_OBJECT:
@@ -5600,7 +5600,7 @@ js_DecompileFunction(JSPrinter *jp)
     }
 
     js_printf(jp, "%s ", js_function_str);
-    if (fun->atom && !QuoteString(&jp->sprinter, fun->atom, 0))
+    if (fun->atom() && !QuoteString(&jp->sprinter, fun->atom(), 0))
         return JS_FALSE;
     js_puts(jp, "(");
 
@@ -6570,7 +6570,7 @@ GetPCCountScriptSummary(JSContext *cx, size_t index)
     NumberValueToStringBuffer(cx, Int32Value(script->lineno), buf);
 
     if (script->function()) {
-        JSAtom *atom = script->function()->atom;
+        JSAtom *atom = script->function()->displayAtom();
         if (atom) {
             AppendJSONProperty(buf, "name");
             if (!(str = JS_ValueToSource(cx, StringValue(atom))))
diff --git a/js/src/jsreflect.cpp b/js/src/jsreflect.cpp
index 6138cb8121f4..e6137701420f 100644
--- a/js/src/jsreflect.cpp
+++ b/js/src/jsreflect.cpp
@@ -1820,6 +1820,8 @@ ASTSerializer::statements(ParseNode *pn, NodeVector &elts)
         return false;
 
     for (ParseNode *next = pn->pn_head; next; next = next->pn_next) {
+        JS_ASSERT(pn->pn_pos.encloses(next->pn_pos));
+
         Value elt;
         if (!sourceElement(next, &elt))
             return false;
@@ -1836,6 +1838,8 @@ ASTSerializer::expressions(ParseNode *pn, NodeVector &elts)
         return false;
 
     for (ParseNode *next = pn->pn_head; next; next = next->pn_next) {
+        JS_ASSERT(pn->pn_pos.encloses(next->pn_pos));
+
         Value elt;
         if (!expression(next, &elt))
             return false;
@@ -1852,6 +1856,8 @@ ASTSerializer::xmls(ParseNode *pn, NodeVector &elts)
         return false;
 
     for (ParseNode *next = pn->pn_head; next; next = next->pn_next) {
+        JS_ASSERT(pn->pn_pos.encloses(next->pn_pos));
+
         Value elt;
         if (!xml(next, &elt))
             return false;
@@ -1953,10 +1959,13 @@ ASTSerializer::variableDeclarator(ParseNode *pn, VarDeclKind *pkind, Value *dst)
     if (pn->isKind(PNK_NAME)) {
         pnleft = pn;
         pnright = pn->isUsed() ? NULL : pn->pn_expr;
+        JS_ASSERT_IF(pnright, pn->pn_pos.encloses(pnright->pn_pos));
     } else {
         JS_ASSERT(pn->isKind(PNK_ASSIGN));
         pnleft = pn->pn_left;
         pnright = pn->pn_right;
+        JS_ASSERT(pn->pn_pos.encloses(pnleft->pn_pos));
+        JS_ASSERT(pn->pn_pos.encloses(pnright->pn_pos));
     }
 
     Value left, right;
@@ -1968,6 +1977,9 @@ ASTSerializer::variableDeclarator(ParseNode *pn, VarDeclKind *pkind, Value *dst)
 bool
 ASTSerializer::let(ParseNode *pn, bool expr, Value *dst)
 {
+    JS_ASSERT(pn->pn_pos.encloses(pn->pn_left->pn_pos));
+    JS_ASSERT(pn->pn_pos.encloses(pn->pn_right->pn_pos));
+
     ParseNode *letHead = pn->pn_left;
     LOCAL_ASSERT(letHead->isArity(PN_LIST));
 
@@ -2002,6 +2014,9 @@ ASTSerializer::let(ParseNode *pn, bool expr, Value *dst)
 bool
 ASTSerializer::switchCase(ParseNode *pn, Value *dst)
 {
+    JS_ASSERT_IF(pn->pn_left, pn->pn_pos.encloses(pn->pn_left->pn_pos));
+    JS_ASSERT(pn->pn_pos.encloses(pn->pn_right->pn_pos));
+
     NodeVector stmts(cx);
 
     Value expr;
@@ -2014,6 +2029,9 @@ ASTSerializer::switchCase(ParseNode *pn, Value *dst)
 bool
 ASTSerializer::switchStatement(ParseNode *pn, Value *dst)
 {
+    JS_ASSERT(pn->pn_pos.encloses(pn->pn_left->pn_pos));
+    JS_ASSERT(pn->pn_pos.encloses(pn->pn_right->pn_pos));
+
     Value disc;
 
     if (!expression(pn->pn_left, &disc))
@@ -2050,6 +2068,10 @@ ASTSerializer::switchStatement(ParseNode *pn, Value *dst)
 bool
 ASTSerializer::catchClause(ParseNode *pn, Value *dst)
 {
+    JS_ASSERT(pn->pn_pos.encloses(pn->pn_kid1->pn_pos));
+    JS_ASSERT_IF(pn->pn_kid2, pn->pn_pos.encloses(pn->pn_kid2->pn_pos));
+    JS_ASSERT(pn->pn_pos.encloses(pn->pn_kid3->pn_pos));
+
     Value var, guard, body;
 
     return pattern(pn->pn_kid1, NULL, &var) &&
@@ -2061,6 +2083,10 @@ ASTSerializer::catchClause(ParseNode *pn, Value *dst)
 bool
 ASTSerializer::tryStatement(ParseNode *pn, Value *dst)
 {
+    JS_ASSERT(pn->pn_pos.encloses(pn->pn_kid1->pn_pos));
+    JS_ASSERT_IF(pn->pn_kid2, pn->pn_pos.encloses(pn->pn_kid2->pn_pos));
+    JS_ASSERT_IF(pn->pn_kid3, pn->pn_pos.encloses(pn->pn_kid3->pn_pos));
+
     Value body;
     if (!statement(pn->pn_kid1, &body))
         return false;
@@ -2147,6 +2173,10 @@ ASTSerializer::statement(ParseNode *pn, Value *dst)
 
       case PNK_IF:
       {
+        JS_ASSERT(pn->pn_pos.encloses(pn->pn_kid1->pn_pos));
+        JS_ASSERT(pn->pn_pos.encloses(pn->pn_kid2->pn_pos));
+        JS_ASSERT_IF(pn->pn_kid3, pn->pn_pos.encloses(pn->pn_kid3->pn_pos));
+
         Value test, cons, alt;
 
         return expression(pn->pn_kid1, &test) &&
@@ -2164,6 +2194,9 @@ ASTSerializer::statement(ParseNode *pn, Value *dst)
       case PNK_WITH:
       case PNK_WHILE:
       {
+        JS_ASSERT(pn->pn_pos.encloses(pn->pn_left->pn_pos));
+        JS_ASSERT(pn->pn_pos.encloses(pn->pn_right->pn_pos));
+
         Value expr, stmt;
 
         return expression(pn->pn_left, &expr) &&
@@ -2175,6 +2208,9 @@ ASTSerializer::statement(ParseNode *pn, Value *dst)
 
       case PNK_DOWHILE:
       {
+        JS_ASSERT(pn->pn_pos.encloses(pn->pn_left->pn_pos));
+        JS_ASSERT(pn->pn_pos.encloses(pn->pn_right->pn_pos));
+
         Value stmt, test;
 
         return statement(pn->pn_left, &stmt) &&
@@ -2184,8 +2220,15 @@ ASTSerializer::statement(ParseNode *pn, Value *dst)
 
       case PNK_FOR:
       {
+        JS_ASSERT(pn->pn_pos.encloses(pn->pn_left->pn_pos));
+        JS_ASSERT(pn->pn_pos.encloses(pn->pn_right->pn_pos));
+
         ParseNode *head = pn->pn_left;
 
+        JS_ASSERT_IF(head->pn_kid1, head->pn_pos.encloses(head->pn_kid1->pn_pos));
+        JS_ASSERT_IF(head->pn_kid2, head->pn_pos.encloses(head->pn_kid2->pn_pos));
+        JS_ASSERT_IF(head->pn_kid3, head->pn_pos.encloses(head->pn_kid3->pn_pos));
+
         Value stmt;
         if (!statement(pn->pn_right, &stmt))
             return false;
@@ -2243,6 +2286,8 @@ ASTSerializer::statement(ParseNode *pn, Value *dst)
 
       case PNK_COLON:
       {
+        JS_ASSERT(pn->pn_pos.encloses(pn->pn_expr->pn_pos));
+
         Value label, stmt;
 
         return identifier(pn->pn_atom, NULL, &label) &&
@@ -2253,6 +2298,8 @@ ASTSerializer::statement(ParseNode *pn, Value *dst)
       case PNK_THROW:
       case PNK_RETURN:
       {
+        JS_ASSERT_IF(pn->pn_kid, pn->pn_pos.encloses(pn->pn_kid->pn_pos));
+
         Value arg;
 
         return optExpression(pn->pn_kid, &arg) &&
@@ -2267,6 +2314,8 @@ ASTSerializer::statement(ParseNode *pn, Value *dst)
 #if JS_HAS_XML_SUPPORT
       case PNK_DEFXMLNS:
       {
+        JS_ASSERT(pn->pn_pos.encloses(pn->pn_kid->pn_pos));
+
         LOCAL_ASSERT(pn->isArity(PN_UNARY));
 
         Value ns;
@@ -2423,6 +2472,10 @@ ASTSerializer::expression(ParseNode *pn, Value *dst)
 
       case PNK_CONDITIONAL:
       {
+        JS_ASSERT(pn->pn_pos.encloses(pn->pn_kid1->pn_pos));
+        JS_ASSERT(pn->pn_pos.encloses(pn->pn_kid2->pn_pos));
+        JS_ASSERT(pn->pn_pos.encloses(pn->pn_kid3->pn_pos));
+
         Value test, cons, alt;
 
         return expression(pn->pn_kid1, &test) &&
@@ -2435,6 +2488,9 @@ ASTSerializer::expression(ParseNode *pn, Value *dst)
       case PNK_AND:
       {
         if (pn->isArity(PN_BINARY)) {
+            JS_ASSERT(pn->pn_pos.encloses(pn->pn_left->pn_pos));
+            JS_ASSERT(pn->pn_pos.encloses(pn->pn_right->pn_pos));
+
             Value left, right;
             return expression(pn->pn_left, &left) &&
                    expression(pn->pn_right, &right) &&
@@ -2446,6 +2502,8 @@ ASTSerializer::expression(ParseNode *pn, Value *dst)
       case PNK_PREINCREMENT:
       case PNK_PREDECREMENT:
       {
+        JS_ASSERT(pn->pn_pos.encloses(pn->pn_kid->pn_pos));
+
         bool inc = pn->isKind(PNK_PREINCREMENT);
         Value expr;
         return expression(pn->pn_kid, &expr) &&
@@ -2455,6 +2513,8 @@ ASTSerializer::expression(ParseNode *pn, Value *dst)
       case PNK_POSTINCREMENT:
       case PNK_POSTDECREMENT:
       {
+        JS_ASSERT(pn->pn_pos.encloses(pn->pn_kid->pn_pos));
+
         bool inc = pn->isKind(PNK_POSTINCREMENT);
         Value expr;
         return expression(pn->pn_kid, &expr) &&
@@ -2474,6 +2534,9 @@ ASTSerializer::expression(ParseNode *pn, Value *dst)
       case PNK_DIVASSIGN:
       case PNK_MODASSIGN:
       {
+        JS_ASSERT(pn->pn_pos.encloses(pn->pn_left->pn_pos));
+        JS_ASSERT(pn->pn_pos.encloses(pn->pn_right->pn_pos));
+
         AssignmentOperator op = aop(pn->getOp());
         LOCAL_ASSERT(op > AOP_ERR && op < AOP_LIMIT);
 
@@ -2506,6 +2569,9 @@ ASTSerializer::expression(ParseNode *pn, Value *dst)
       case PNK_INSTANCEOF:
       case PNK_DBLDOT:
         if (pn->isArity(PN_BINARY)) {
+            JS_ASSERT(pn->pn_pos.encloses(pn->pn_left->pn_pos));
+            JS_ASSERT(pn->pn_pos.encloses(pn->pn_right->pn_pos));
+
             BinaryOperator op = binop(pn->getKind(), pn->getOp());
             LOCAL_ASSERT(op > BINOP_ERR && op < BINOP_LIMIT);
 
@@ -2523,6 +2589,8 @@ ASTSerializer::expression(ParseNode *pn, Value *dst)
       case PNK_BITNOT:
       case PNK_POS:
       case PNK_NEG: {
+        JS_ASSERT(pn->pn_pos.encloses(pn->pn_kid->pn_pos));
+
         UnaryOperator op = unop(pn->getKind(), pn->getOp());
         LOCAL_ASSERT(op > UNOP_ERR && op < UNOP_LIMIT);
 
@@ -2540,6 +2608,7 @@ ASTSerializer::expression(ParseNode *pn, Value *dst)
 #endif
 
         ParseNode *next = pn->pn_head;
+        JS_ASSERT(pn->pn_pos.encloses(next->pn_pos));
 
         Value callee;
         if (!expression(next, &callee))
@@ -2550,6 +2619,8 @@ ASTSerializer::expression(ParseNode *pn, Value *dst)
             return false;
 
         for (next = next->pn_next; next; next = next->pn_next) {
+            JS_ASSERT(pn->pn_pos.encloses(next->pn_pos));
+
             Value arg;
             if (!expression(next, &arg))
                 return false;
@@ -2564,6 +2635,8 @@ ASTSerializer::expression(ParseNode *pn, Value *dst)
 
       case PNK_DOT:
       {
+        JS_ASSERT(pn->pn_pos.encloses(pn->pn_expr->pn_pos));
+
         Value expr, id;
         return expression(pn->pn_expr, &expr) &&
                identifier(pn->pn_atom, NULL, &id) &&
@@ -2572,6 +2645,9 @@ ASTSerializer::expression(ParseNode *pn, Value *dst)
 
       case PNK_LB:
       {
+        JS_ASSERT(pn->pn_pos.encloses(pn->pn_left->pn_pos));
+        JS_ASSERT(pn->pn_pos.encloses(pn->pn_right->pn_pos));
+
         Value left, right;
         return expression(pn->pn_left, &left) &&
                expression(pn->pn_right, &right) &&
@@ -2585,6 +2661,8 @@ ASTSerializer::expression(ParseNode *pn, Value *dst)
             return false;
 
         for (ParseNode *next = pn->pn_head; next; next = next->pn_next) {
+            JS_ASSERT(pn->pn_pos.encloses(next->pn_pos));
+
             if (next->isKind(PNK_COMMA)) {
                 elts.infallibleAppend(MagicValue(JS_SERIALIZE_NO_NODE));
             } else {
@@ -2617,6 +2695,8 @@ ASTSerializer::expression(ParseNode *pn, Value *dst)
             return false;
 
         for (ParseNode *next = pn->pn_head; next; next = next->pn_next) {
+            JS_ASSERT(pn->pn_pos.encloses(next->pn_pos));
+
             Value prop;
             if (!property(next, &prop))
                 return false;
@@ -2642,12 +2722,16 @@ ASTSerializer::expression(ParseNode *pn, Value *dst)
 
       case PNK_YIELD:
       {
+        JS_ASSERT_IF(pn->pn_kid, pn->pn_pos.encloses(pn->pn_kid->pn_pos));
+
         Value arg;
         return optExpression(pn->pn_kid, &arg) &&
                builder.yieldExpression(arg, &pn->pn_pos, dst);
       }
 
       case PNK_ARRAYCOMP:
+        JS_ASSERT(pn->pn_pos.encloses(pn->pn_head->pn_pos));
+
         /* NB: it's no longer the case that pn_count could be 2. */
         LOCAL_ASSERT(pn->pn_count == 1);
         LOCAL_ASSERT(pn->pn_head->isKind(PNK_LEXICALSCOPE));
@@ -2677,12 +2761,17 @@ ASTSerializer::expression(ParseNode *pn, Value *dst)
         bool computed;
 
         if (pn->isArity(PN_BINARY)) {
+            JS_ASSERT(pn->pn_pos.encloses(pn->pn_left->pn_pos));
+            JS_ASSERT(pn->pn_pos.encloses(pn->pn_right->pn_pos));
+
             computed = true;
             pnleft = pn->pn_left;
             if (!expression(pn->pn_right, &right))
                 return false;
         } else {
             JS_ASSERT(pn->isArity(PN_NAME));
+            JS_ASSERT(pn->pn_pos.encloses(pn->pn_expr->pn_pos));
+
             computed = false;
             pnleft = pn->pn_expr;
             if (!identifier(pn->pn_atom, NULL, &right))
@@ -2699,6 +2788,8 @@ ASTSerializer::expression(ParseNode *pn, Value *dst)
 
       case PNK_AT:
       {
+        JS_ASSERT(pn->pn_pos.encloses(pn->pn_kid->pn_pos));
+
         Value expr;
         ParseNode *kid = pn->pn_kid;
         bool computed = ((!kid->isKind(PNK_NAME) || !kid->isOp(JSOP_QNAMEPART)) &&
@@ -2710,6 +2801,9 @@ ASTSerializer::expression(ParseNode *pn, Value *dst)
 
       case PNK_FILTER:
       {
+        JS_ASSERT(pn->pn_pos.encloses(pn->pn_left->pn_pos));
+        JS_ASSERT(pn->pn_pos.encloses(pn->pn_right->pn_pos));
+
         Value left, right;
         return expression(pn->pn_left, &left) &&
                expression(pn->pn_right, &right) &&
@@ -2734,6 +2828,8 @@ ASTSerializer::xml(ParseNode *pn, Value *dst)
 #if JS_HAS_XML_SUPPORT
       case PNK_XMLCURLYEXPR:
       {
+        JS_ASSERT(pn->pn_pos.encloses(pn->pn_kid->pn_pos));
+
         Value expr;
         return expression(pn->pn_kid, &expr) &&
                builder.xmlEscapeExpression(expr, &pn->pn_pos, dst);
@@ -3009,7 +3105,7 @@ ASTSerializer::function(ParseNode *pn, ASTType type, Value *dst)
 #endif
 
     Value id;
-    if (!optIdentifier(func->atom, NULL, &id))
+    if (!optIdentifier(func->atom(), NULL, &id))
         return false;
 
     NodeVector args(cx);
diff --git a/js/src/jsscript.cpp b/js/src/jsscript.cpp
index e39a3a9041af..a46b5fc885ea 100644
--- a/js/src/jsscript.cpp
+++ b/js/src/jsscript.cpp
@@ -1881,9 +1881,11 @@ js_GetSrcNoteCached(JSContext *cx, JSScript *script, jsbytecode *pc)
 }
 
 unsigned
-js::PCToLineNumber(unsigned startLine, jssrcnote *notes, jsbytecode *code, jsbytecode *pc)
+js::PCToLineNumber(unsigned startLine, jssrcnote *notes, jsbytecode *code, jsbytecode *pc,
+                   unsigned *columnp)
 {
     unsigned lineno = startLine;
+    unsigned column = 0;
 
     /*
      * Walk through source notes accumulating their deltas, keeping track of
@@ -1898,25 +1900,41 @@ js::PCToLineNumber(unsigned startLine, jssrcnote *notes, jsbytecode *code, jsbyt
         if (type == SRC_SETLINE) {
             if (offset <= target)
                 lineno = (unsigned) js_GetSrcNoteOffset(sn, 0);
+            column = 0;
         } else if (type == SRC_NEWLINE) {
             if (offset <= target)
                 lineno++;
+            column = 0;
         }
+
         if (offset > target)
             break;
+
+        if (type == SRC_COLSPAN) {
+            ptrdiff_t colspan = js_GetSrcNoteOffset(sn, 0);
+
+            if (colspan >= SN_COLSPAN_DOMAIN / 2)
+                colspan -= SN_COLSPAN_DOMAIN;
+            JS_ASSERT(ptrdiff_t(column) + colspan >= 0);
+            column += colspan;
+        }
     }
 
+    if (columnp)
+        *columnp = column;
+
     return lineno;
 }
 
 unsigned
-js::PCToLineNumber(JSScript *script, jsbytecode *pc)
+js::PCToLineNumber(JSScript *script, jsbytecode *pc, unsigned *columnp)
 {
     /* Cope with StackFrame.pc value prior to entering js_Interpret. */
     if (!pc)
         return 0;
 
-    return PCToLineNumber(script->lineno, script->notes(), script->code, pc);
+    return PCToLineNumber(script->lineno, script->notes(), script->code, pc,
+                          columnp);
 }
 
 /* The line number limit is the same as the jssrcnote offset limit. */
diff --git a/js/src/jsscript.h b/js/src/jsscript.h
index 13c4fb8b8a3a..7e572fdc883d 100644
--- a/js/src/jsscript.h
+++ b/js/src/jsscript.h
@@ -469,6 +469,9 @@ struct JSScript : public js::gc::Cell
                                          JSCompartment::scriptCountsMap */
     bool            hasDebugScript:1; /* script has an entry in
                                          JSCompartment::debugScriptMap */
+    bool            hasFreezeConstraints:1; /* freeze constraints for stack
+                                             * type sets have been generated */
+
   private:
     /* See comments below. */
     bool            argsHasVarBinding_:1;
@@ -575,6 +578,8 @@ struct JSScript : public js::gc::Cell
     inline void clearAnalysis();
     inline js::analyze::ScriptAnalysis *analysis();
 
+    inline void clearPropertyReadTypes();
+
     inline bool hasGlobal() const;
     inline bool hasClearedGlobal() const;
 
@@ -1175,10 +1180,11 @@ js_GetScriptLineExtent(JSScript *script);
 namespace js {
 
 extern unsigned
-PCToLineNumber(JSScript *script, jsbytecode *pc);
+PCToLineNumber(JSScript *script, jsbytecode *pc, unsigned *columnp = NULL);
 
 extern unsigned
-PCToLineNumber(unsigned startLine, jssrcnote *notes, jsbytecode *code, jsbytecode *pc);
+PCToLineNumber(unsigned startLine, jssrcnote *notes, jsbytecode *code, jsbytecode *pc,
+               unsigned *columnp = NULL);
 
 extern unsigned
 CurrentLine(JSContext *cx);
diff --git a/js/src/methodjit/BaseAssembler.h b/js/src/methodjit/BaseAssembler.h
index 018a6439b87b..cadc32076c8b 100644
--- a/js/src/methodjit/BaseAssembler.h
+++ b/js/src/methodjit/BaseAssembler.h
@@ -536,6 +536,9 @@ static const JSC::MacroAssembler::RegisterID JSParamReg_Argc  = JSC::MIPSRegiste
     // a register, is asking for breaking on some platform or some situation.
     // Be careful to limit to storeArg() during setupABICall.
     void setupABICall(Registers::CallConvention convention, uint32_t generalArgs) {
+        if (sps && sps->enabled())
+            leaveBeforeCall();
+
         JS_ASSERT(!callIsAligned);
 
         uint32_t numArgRegs = Registers::numArgRegs(convention);
@@ -679,6 +682,33 @@ static const JSC::MacroAssembler::RegisterID JSParamReg_Argc  = JSC::MIPSRegiste
         }
     }
 
+  private:
+    // When profiling is enabled, we need to run an epilogue and a prologue to
+    // every call. These two functions manage this code generation and are
+    // called from callWithABI below.
+    void leaveBeforeCall() {
+        if (availInCall.empty()) {
+            RegisterID reg = Registers(Registers::TempRegs).peekReg().reg();
+            saveReg(reg);
+            sps->leave(*this, reg);
+            restoreReg(reg);
+        } else {
+            sps->leave(*this, availInCall.peekReg().reg());
+        }
+    }
+
+    void reenterAfterCall() {
+        if (availInCall.empty()) {
+            RegisterID reg = Registers(Registers::TempRegs).peekReg().reg();
+            saveReg(reg);
+            sps->reenter(*this, reg);
+            restoreReg(reg);
+        } else {
+            sps->reenter(*this, availInCall.peekReg().reg());
+        }
+    }
+
+  public:
     // High-level call helper, given an optional function pointer and a
     // calling convention. setupABICall() must have been called beforehand,
     // as well as each numbered argument stored with storeArg().
@@ -707,21 +737,15 @@ static const JSC::MacroAssembler::RegisterID JSParamReg_Argc  = JSC::MIPSRegiste
 
         JS_ASSERT(callIsAligned);
 
-        Call cl;
-        if (sps && sps->enabled()) {
-            RegisterID reg = availInCall.takeAnyReg().reg();
-            sps->leave(*this, reg);
-            cl = call();
-            sps->reenter(*this, reg);
-            availInCall.putReg(reg);
-        } else {
-            cl = call();
-        }
+        Call cl = call();
 
         callPatches.append(CallPatch(cl, fun));
+
 #ifdef JS_CPU_ARM
         JS_ASSERT(initFlushCount == flushCount());
 #endif
+        if (sps && sps->enabled())
+            reenterAfterCall();
         if (stackAdjust)
             addPtr(Imm32(stackAdjust), stackPointerRegister);
 
diff --git a/js/src/methodjit/Compiler.cpp b/js/src/methodjit/Compiler.cpp
index 69f12a64e8a9..bc914f842f39 100644
--- a/js/src/methodjit/Compiler.cpp
+++ b/js/src/methodjit/Compiler.cpp
@@ -83,6 +83,8 @@ mjit::Compiler::Compiler(JSContext *cx, JSScript *outerScript,
     doubleList(CompilerAllocPolicy(cx, *thisFromCtor())),
     rootedTemplates(CompilerAllocPolicy(cx, *thisFromCtor())),
     rootedRegExps(CompilerAllocPolicy(cx, *thisFromCtor())),
+    monitoredBytecodes(CompilerAllocPolicy(cx, *thisFromCtor())),
+    typeBarrierBytecodes(CompilerAllocPolicy(cx, *thisFromCtor())),
     fixedIntToDoubleEntries(CompilerAllocPolicy(cx, *thisFromCtor())),
     fixedDoubleToAnyEntries(CompilerAllocPolicy(cx, *thisFromCtor())),
     jumpTables(CompilerAllocPolicy(cx, *thisFromCtor())),
@@ -225,9 +227,9 @@ mjit::Compiler::scanInlineCalls(uint32_t index, uint32_t depth)
             continue;
 
         uint32_t argc = GET_ARGC(pc);
-        types::TypeSet *calleeTypes = analysis->poppedTypes(pc, argc + 1);
+        types::StackTypeSet *calleeTypes = analysis->poppedTypes(pc, argc + 1);
 
-        if (calleeTypes->getKnownTypeTag(cx) != JSVAL_TYPE_OBJECT)
+        if (calleeTypes->getKnownTypeTag() != JSVAL_TYPE_OBJECT)
             continue;
 
         if (calleeTypes->getObjectCount() >= INLINE_SITE_LIMIT)
@@ -332,12 +334,19 @@ mjit::Compiler::scanInlineCalls(uint32_t index, uint32_t depth)
                 break;
             }
 
-            if (types::TypeSet::HasObjectFlags(cx, fun->getType(cx),
-                                               types::OBJECT_FLAG_UNINLINEABLE)) {
+            if (types::HeapTypeSet::HasObjectFlags(cx, fun->getType(cx),
+                                                   types::OBJECT_FLAG_UNINLINEABLE)) {
                 okay = false;
                 break;
             }
 
+            /*
+             * Watch for a generic state change in the callee's type, so that
+             * the outer script will be recompiled if any type information
+             * changes in stack values within the callee.
+             */
+            types::HeapTypeSet::WatchObjectStateChange(cx, fun->getType(cx));
+
             /*
              * Don't inline scripts which use 'this' if it is possible they
              * could be called with a 'this' value requiring wrapping. During
@@ -345,7 +354,7 @@ mjit::Compiler::scanInlineCalls(uint32_t index, uint32_t depth)
              * caller.
              */
             if (script->analysis()->usesThisValue() &&
-                types::TypeScript::ThisTypes(script)->getKnownTypeTag(cx) != JSVAL_TYPE_OBJECT) {
+                types::TypeScript::ThisTypes(script)->getKnownTypeTag() != JSVAL_TYPE_OBJECT) {
                 okay = false;
                 break;
             }
@@ -353,8 +362,6 @@ mjit::Compiler::scanInlineCalls(uint32_t index, uint32_t depth)
         if (!okay)
             continue;
 
-        calleeTypes->addFreeze(cx);
-
         /*
          * Add the inline frames to the cross script SSA. We will pick these
          * back up when compiling the call site.
@@ -1008,6 +1015,13 @@ mjit::CanMethodJIT(JSContext *cx, JSScript *script, jsbytecode *pc,
         status = cc.compile();
     }
 
+    /*
+     * Check if we have hit the threshold for purging analysis data. This is
+     * done after compilation, rather than after another analysis stage, to
+     * ensure we don't throw away the work just performed.
+     */
+    cx->compartment->types.maybePurgeAnalysis(cx);
+
     if (status == Compile_Okay) {
         /*
          * Compiling a script can occasionally trigger its own recompilation,
@@ -1183,7 +1197,7 @@ mjit::Compiler::ensureDoubleArguments()
     /* Convert integer arguments which were inferred as (int|double) to doubles. */
     for (uint32_t i = 0; script->function() && i < script->function()->nargs; i++) {
         uint32_t slot = ArgSlot(i);
-        if (a->varTypes[slot].getTypeTag(cx) == JSVAL_TYPE_DOUBLE && analysis->trackSlot(slot))
+        if (a->varTypes[slot].getTypeTag() == JSVAL_TYPE_DOUBLE && analysis->trackSlot(slot))
             frame.ensureDouble(frame.getArg(i));
     }
 }
@@ -1331,6 +1345,8 @@ mjit::Compiler::finishThisUp()
                       sizeof(CallSite) * callSites.length() +
                       sizeof(JSObject*) * rootedTemplates.length() +
                       sizeof(RegExpShared*) * rootedRegExps.length() +
+                      sizeof(uint32_t) * monitoredBytecodes.length() +
+                      sizeof(uint32_t) * typeBarrierBytecodes.length() +
 #if defined JS_MONOIC
                       sizeof(ic::GetGlobalNameIC) * getGlobalNames.length() +
                       sizeof(ic::SetGlobalNameIC) * setGlobalNames.length() +
@@ -1474,6 +1490,18 @@ mjit::Compiler::finishThisUp()
         jitRootedRegExps[i]->incRef();
     }
 
+    uint32_t *jitMonitoredBytecodes = (uint32_t *)cursor;
+    chunk->nMonitoredBytecodes = monitoredBytecodes.length();
+    cursor += sizeof(uint32_t) * chunk->nMonitoredBytecodes;
+    for (size_t i = 0; i < chunk->nMonitoredBytecodes; i++)
+        jitMonitoredBytecodes[i] = monitoredBytecodes[i];
+
+    uint32_t *jitTypeBarrierBytecodes = (uint32_t *)cursor;
+    chunk->nTypeBarrierBytecodes = typeBarrierBytecodes.length();
+    cursor += sizeof(uint32_t) * chunk->nTypeBarrierBytecodes;
+    for (size_t i = 0; i < chunk->nTypeBarrierBytecodes; i++)
+        jitTypeBarrierBytecodes[i] = typeBarrierBytecodes[i];
+
 #if defined JS_MONOIC
     if (chunkIndex == 0 && script->function()) {
         JS_ASSERT(jit->argsCheckPool == NULL);
@@ -2091,7 +2119,7 @@ mjit::Compiler::generateMethod()
                     if (newv->value.kind() == SSAValue::PHI &&
                         newv->value.phiOffset() == uint32_t(PC - script->code) &&
                         analysis->trackSlot(newv->slot) &&
-                        a->varTypes[newv->slot].getTypeTag(cx) == JSVAL_TYPE_DOUBLE) {
+                        a->varTypes[newv->slot].getTypeTag() == JSVAL_TYPE_DOUBLE) {
                         FrameEntry *fe = frame.getSlotEntry(newv->slot);
                         masm.ensureInMemoryDouble(frame.addressOf(fe));
                     }
@@ -2113,7 +2141,7 @@ mjit::Compiler::generateMethod()
             jsbytecode *backedge = script->code + analysis->getLoop(PC)->backedge;
             if (!bytecodeInChunk(backedge)){
                 for (uint32_t slot = ArgSlot(0); slot < TotalSlots(script); slot++) {
-                    if (a->varTypes[slot].getTypeTag(cx) == JSVAL_TYPE_DOUBLE) {
+                    if (a->varTypes[slot].getTypeTag() == JSVAL_TYPE_DOUBLE) {
                         FrameEntry *fe = frame.getSlotEntry(slot);
                         masm.ensureInMemoryDouble(frame.addressOf(fe));
                     }
@@ -3506,9 +3534,9 @@ mjit::Compiler::updateElemCounts(jsbytecode *pc, FrameEntry *obj, FrameEntry *id
     masm.bumpCount(&counts.get(count), reg);
 
     if (obj->mightBeType(JSVAL_TYPE_OBJECT)) {
-        types::TypeSet *types = frame.extra(obj).types;
+        types::StackTypeSet *types = frame.extra(obj).types;
         if (types && !types->hasObjectFlags(cx, types::OBJECT_FLAG_NON_TYPED_ARRAY) &&
-            types->getTypedArrayType(cx) != TypedArray::TYPE_MAX) {
+            types->getTypedArrayType() != TypedArray::TYPE_MAX) {
             count = PCCounts::ELEM_OBJECT_TYPED;
         } else if (types && !types->hasObjectFlags(cx, types::OBJECT_FLAG_NON_DENSE_ARRAY)) {
             if (!types->hasObjectFlags(cx, types::OBJECT_FLAG_NON_PACKED_ARRAY))
@@ -4230,6 +4258,13 @@ mjit::Compiler::inlineCallHelper(uint32_t argc, bool callingNew, FrameSize &call
 
     callIC.typeMonitored = monitored(PC) || hasTypeBarriers(PC);
 
+    if (script == outerScript) {
+        if (monitored(PC))
+            monitoredBytecodes.append(PC - script->code);
+        if (hasTypeBarriers(PC))
+            typeBarrierBytecodes.append(PC - script->code);
+    }
+
     /* Test the type if necessary. Failing this always takes a really slow path. */
     MaybeJump notObjectJump;
     if (icCalleeType.isSet())
@@ -4844,7 +4879,7 @@ mjit::Compiler::jsop_getprop(PropertyName *name, JSValueType knownType,
     /* Handle lenth accesses of optimize 'arguments'. */
     if (name == cx->runtime->atomState.lengthAtom &&
         cx->typeInferenceEnabled() &&
-        analysis->poppedTypes(PC, 0)->isMagicArguments(cx) &&
+        analysis->poppedTypes(PC, 0)->isMagicArguments() &&
         knownPushedType(0) == JSVAL_TYPE_INT32)
     {
         frame.pop();
@@ -4873,7 +4908,7 @@ mjit::Compiler::jsop_getprop(PropertyName *name, JSValueType knownType,
             }
         }
 
-        types::TypeSet *types = analysis->poppedTypes(PC, 0);
+        types::StackTypeSet *types = analysis->poppedTypes(PC, 0);
 
         /*
          * Check if we are accessing the 'length' property of a known dense array.
@@ -5003,12 +5038,11 @@ mjit::Compiler::jsop_getprop(PropertyName *name, JSValueType knownType,
         id == types::MakeTypeId(cx, id)) {
         JS_ASSERT(!forPrototype);
         types::TypeObject *object = types->getTypeObject(0);
-        types::TypeSet *propertyTypes = object->getProperty(cx, id, false);
+        types::HeapTypeSet *propertyTypes = object->getProperty(cx, id, false);
         if (!propertyTypes)
             return false;
-        if (propertyTypes->isDefiniteProperty() &&
+        if (propertyTypes->definiteProperty() &&
             !propertyTypes->isOwnProperty(cx, object, true)) {
-            types->addFreeze(cx);
             uint32_t slot = propertyTypes->definiteSlot();
             bool isObject = top->isTypeKnown();
             if (!isObject) {
@@ -5207,11 +5241,11 @@ mjit::Compiler::testSingletonPropertyTypes(FrameEntry *top, HandleId id, bool *t
 {
     *testObject = false;
 
-    types::TypeSet *types = frame.extra(top).types;
+    types::StackTypeSet *types = frame.extra(top).types;
     if (!types || types->unknownObject())
         return false;
 
-    RootedObject singleton(cx, types->getSingleton(cx));
+    RootedObject singleton(cx, types->getSingleton());
     if (singleton)
         return testSingletonProperty(singleton, id);
 
@@ -5219,7 +5253,7 @@ mjit::Compiler::testSingletonPropertyTypes(FrameEntry *top, HandleId id, bool *t
         return false;
 
     JSProtoKey key;
-    JSValueType type = types->getKnownTypeTag(cx);
+    JSValueType type = types->getKnownTypeTag();
     switch (type) {
       case JSVAL_TYPE_STRING:
         key = JSProto_String;
@@ -5243,7 +5277,6 @@ mjit::Compiler::testSingletonPropertyTypes(FrameEntry *top, HandleId id, bool *t
                 Rooted<JSObject*> proto(cx, object->proto);
                 if (!testSingletonProperty(proto, id))
                     return false;
-                types->addFreeze(cx);
 
                 /* If we don't know this is an object, we will need a test. */
                 *testObject = (type != JSVAL_TYPE_OBJECT) && !top->isTypeKnown();
@@ -5294,8 +5327,6 @@ mjit::Compiler::jsop_getprop_dispatch(PropertyName *name)
     if (objTypes->unknownObject() || objTypes->getObjectCount() == 0)
         return false;
 
-    pushedTypes->addFreeze(cx);
-
     /* Map each type in the object to the resulting pushed value. */
     Vector<JSObject *> results(CompilerAllocPolicy(cx, *this));
 
@@ -5314,7 +5345,7 @@ mjit::Compiler::jsop_getprop_dispatch(PropertyName *name)
         }
         if (object->unknownProperties() || !object->proto)
             return false;
-        types::TypeSet *ownTypes = object->getProperty(cx, id, false);
+        types::HeapTypeSet *ownTypes = object->getProperty(cx, id, false);
         if (ownTypes->isOwnProperty(cx, object, false))
             return false;
 
@@ -5324,7 +5355,7 @@ mjit::Compiler::jsop_getprop_dispatch(PropertyName *name)
 
         if (proto->getType(cx)->unknownProperties())
             return false;
-        types::TypeSet *protoTypes = proto->type()->getProperty(cx, id, false);
+        types::HeapTypeSet *protoTypes = proto->type()->getProperty(cx, id, false);
         if (!protoTypes)
             return false;
         JSObject *singleton = protoTypes->getSingleton(cx);
@@ -5338,8 +5369,6 @@ mjit::Compiler::jsop_getprop_dispatch(PropertyName *name)
     if (oomInVector)
         return false;
 
-    objTypes->addFreeze(cx);
-
     /* Done filtering, now generate code which dispatches on the type. */
 
     frame.forgetMismatchedObject(top);
@@ -5430,7 +5459,7 @@ mjit::Compiler::jsop_setprop(PropertyName *name, bool popGuaranteed)
      * always has the property in a particular inline slot.
      */
     jsid id = NameToId(name);
-    types::TypeSet *types = frame.extra(lhs).types;
+    types::StackTypeSet *types = frame.extra(lhs).types;
     if (JSOp(*PC) == JSOP_SETPROP && id == types::MakeTypeId(cx, id) &&
         types && !types->unknownObject() &&
         types->getObjectCount() == 1 &&
@@ -5438,12 +5467,11 @@ mjit::Compiler::jsop_setprop(PropertyName *name, bool popGuaranteed)
         !types->getTypeObject(0)->unknownProperties())
     {
         types::TypeObject *object = types->getTypeObject(0);
-        types::TypeSet *propertyTypes = object->getProperty(cx, id, false);
+        types::HeapTypeSet *propertyTypes = object->getProperty(cx, id, false);
         if (!propertyTypes)
             return false;
-        if (propertyTypes->isDefiniteProperty() &&
+        if (propertyTypes->definiteProperty() &&
             !propertyTypes->isOwnProperty(cx, object, true)) {
-            types->addFreeze(cx);
             uint32_t slot = propertyTypes->definiteSlot();
             RegisterID reg = frame.tempRegForData(lhs);
             frame.pinReg(reg);
@@ -5497,19 +5525,11 @@ mjit::Compiler::jsop_setprop(PropertyName *name, bool popGuaranteed)
     pic.name = name;
 
     if (monitored(PC)) {
+        if (script == outerScript)
+            monitoredBytecodes.append(PC - script->code);
         pic.typeMonitored = true;
-        types::TypeSet *types = frame.extra(rhs).types;
-        if (!types) {
-            /* Handle FORNAME and other compound opcodes. Yuck. */
-            types = types::TypeSet::make(cx, "unknownRHS");
-            if (!types)
-                return false;
-            types->addType(cx, types::Type::UnknownType());
-        }
-        pic.rhsTypes = types;
     } else {
         pic.typeMonitored = false;
-        pic.rhsTypes = NULL;
     }
 
     RESERVE_IC_SPACE(masm);
@@ -5945,7 +5965,7 @@ mjit::Compiler::jsop_this()
             }
 
             JSValueType type = cx->typeInferenceEnabled()
-                ? types::TypeScript::ThisTypes(script)->getKnownTypeTag(cx)
+                ? types::TypeScript::ThisTypes(script)->getKnownTypeTag()
                 : JSVAL_TYPE_UNKNOWN;
             if (type != JSVAL_TYPE_OBJECT) {
                 Jump notObj = frame.testObject(Assembler::NotEqual, thisFe);
@@ -6292,7 +6312,7 @@ mjit::Compiler::jsop_getgname(uint32_t index)
     JSValueType type = knownPushedType(0);
     if (cx->typeInferenceEnabled() && globalObj->isGlobal() && id == types::MakeTypeId(cx, id) &&
         !globalObj->getType(cx)->unknownProperties()) {
-        types::TypeSet *propertyTypes = globalObj->getType(cx)->getProperty(cx, id, false);
+        types::HeapTypeSet *propertyTypes = globalObj->getType(cx)->getProperty(cx, id, false);
         if (!propertyTypes)
             return false;
 
@@ -6407,6 +6427,9 @@ bool
 mjit::Compiler::jsop_setgname(PropertyName *name, bool popGuaranteed)
 {
     if (monitored(PC)) {
+        if (script == outerScript)
+            monitoredBytecodes.append(PC - script->code);
+
         /* Global accesses are monitored only for a few names like __proto__. */
         jsop_setgname_slow(name);
         return true;
@@ -6421,7 +6444,7 @@ mjit::Compiler::jsop_setgname(PropertyName *name, bool popGuaranteed)
          * can't get a function later and cause the global object to become
          * branded, requiring a shape change if it changes again.
          */
-        types::TypeSet *types = globalObj->getType(cx)->getProperty(cx, id, false);
+        types::HeapTypeSet *types = globalObj->getType(cx)->getProperty(cx, id, false);
         if (!types)
             return false;
         js::Shape *shape = globalObj->nativeLookup(cx, NameToId(name));
@@ -6777,8 +6800,8 @@ mjit::Compiler::jsop_regexp()
         &obj->global() != globalObj ||
         !cx->typeInferenceEnabled() ||
         analysis->localsAliasStack() ||
-        types::TypeSet::HasObjectFlags(cx, globalObj->getType(cx),
-                                       types::OBJECT_FLAG_REGEXP_FLAGS_SET))
+        types::HeapTypeSet::HasObjectFlags(cx, globalObj->getType(cx),
+                                           types::OBJECT_FLAG_REGEXP_FLAGS_SET))
     {
         prepareStubCall(Uses(0));
         masm.move(ImmPtr(obj), Registers::ArgReg1);
@@ -6808,7 +6831,7 @@ mjit::Compiler::jsop_regexp()
         jsbytecode *use = script->code + uses->offset;
         uint32_t which = uses->u.which;
         if (JSOp(*use) == JSOP_CALLPROP) {
-            JSObject *callee = analysis->pushedTypes(use, 0)->getSingleton(cx);
+            JSObject *callee = analysis->pushedTypes(use, 0)->getSingleton();
             if (callee && callee->isFunction()) {
                 Native native = callee->toFunction()->maybeNative();
                 if (native == js::regexp_exec || native == js::regexp_test) {
@@ -6818,7 +6841,7 @@ mjit::Compiler::jsop_regexp()
             }
         } else if (JSOp(*use) == JSOP_CALL && which == 0) {
             uint32_t argc = GET_ARGC(use);
-            JSObject *callee = analysis->poppedTypes(use, argc + 1)->getSingleton(cx);
+            JSObject *callee = analysis->poppedTypes(use, argc + 1)->getSingleton();
             if (callee && callee->isFunction() && argc >= 1 && which == argc - 1) {
                 Native native = callee->toFunction()->maybeNative();
                 if (native == js::str_match ||
@@ -6973,7 +6996,7 @@ mjit::Compiler::finishLoop(jsbytecode *head)
          * variables are coherent in such cases.
          */
         for (uint32_t slot = ArgSlot(0); slot < TotalSlots(script); slot++) {
-            if (a->varTypes[slot].getTypeTag(cx) == JSVAL_TYPE_DOUBLE) {
+            if (a->varTypes[slot].getTypeTag() == JSVAL_TYPE_DOUBLE) {
                 FrameEntry *fe = frame.getSlotEntry(slot);
                 stubcc.masm.ensureInMemoryDouble(frame.addressOf(fe));
             }
@@ -6991,8 +7014,8 @@ mjit::Compiler::finishLoop(jsbytecode *head)
                     analysis->trackSlot(newv->slot))
                 {
                     JS_ASSERT(newv->slot < TotalSlots(script));
-                    types::TypeSet *targetTypes = analysis->getValueTypes(newv->value);
-                    if (targetTypes->getKnownTypeTag(cx) == JSVAL_TYPE_DOUBLE) {
+                    types::StackTypeSet *targetTypes = analysis->getValueTypes(newv->value);
+                    if (targetTypes->getKnownTypeTag() == JSVAL_TYPE_DOUBLE) {
                         FrameEntry *fe = frame.getSlotEntry(newv->slot);
                         stubcc.masm.ensureInMemoryDouble(frame.addressOf(fe));
                     }
@@ -7077,7 +7100,7 @@ mjit::Compiler::jumpAndRun(Jump j, jsbytecode *target, Jump *slow, bool *trampol
     if (cx->typeInferenceEnabled()) {
         RegisterAllocation *&alloc = analysis->getAllocation(target);
         if (!alloc) {
-            alloc = cx->typeLifoAlloc().new_<RegisterAllocation>(false);
+            alloc = cx->analysisLifoAlloc().new_<RegisterAllocation>(false);
             if (!alloc) {
                 js_ReportOutOfMemory(cx);
                 return false;
@@ -7181,9 +7204,9 @@ mjit::Compiler::constructThis()
         }
 
         jsid id = NameToId(cx->runtime->atomState.classPrototypeAtom);
-        types::TypeSet *protoTypes = fun->getType(cx)->getProperty(cx, id, false);
+        types::HeapTypeSet *protoTypes = fun->getType(cx)->getProperty(cx, id, false);
 
-        JSObject *proto = protoTypes->getSingleton(cx, true);
+        JSObject *proto = protoTypes->getSingleton(cx);
         if (!proto)
             break;
 
@@ -7208,7 +7231,7 @@ mjit::Compiler::constructThis()
          * should this information change later.
          */
         if (templateObject->type()->newScript)
-            types::TypeSet::WatchObjectStateChange(cx, templateObject->type());
+            types::HeapTypeSet::WatchObjectStateChange(cx, templateObject->type());
 
         RegisterID result = frame.allocReg();
         Jump emptyFreeList = getNewObject(cx, result, templateObject);
@@ -7217,7 +7240,7 @@ mjit::Compiler::constructThis()
         stubcc.leave();
 
         stubcc.masm.move(ImmPtr(proto), Registers::ArgReg1);
-        OOL_STUBCALL(stubs::CreateThis, REJOIN_RESUME);
+        OOL_STUBCALL(stubs::CreateThis, REJOIN_THIS_CREATED);
 
         frame.setThis(result);
 
@@ -7251,7 +7274,7 @@ mjit::Compiler::constructThis()
     prepareStubCall(Uses(0));
     if (protoReg != Registers::ArgReg1)
         masm.move(protoReg, Registers::ArgReg1);
-    INLINE_STUBCALL(stubs::CreateThis, REJOIN_RESUME);
+    INLINE_STUBCALL(stubs::CreateThis, REJOIN_THIS_CREATED);
     frame.freeReg(protoReg);
     return true;
 }
@@ -7376,7 +7399,7 @@ mjit::Compiler::jsop_in()
     FrameEntry *id = frame.peek(-2);
 
     if (cx->typeInferenceEnabled() && id->isType(JSVAL_TYPE_INT32)) {
-        types::TypeSet *types = analysis->poppedTypes(PC, 0);
+        types::StackTypeSet *types = analysis->poppedTypes(PC, 0);
 
         if (obj->mightBeType(JSVAL_TYPE_OBJECT) &&
             !types->hasObjectFlags(cx, types::OBJECT_FLAG_NON_DENSE_ARRAY) &&
@@ -7478,11 +7501,11 @@ mjit::Compiler::fixDoubleTypes(jsbytecode *target)
                 continue;
             }
             JS_ASSERT(newv->slot < TotalSlots(script));
-            types::TypeSet *targetTypes = analysis->getValueTypes(newv->value);
+            types::StackTypeSet *targetTypes = analysis->getValueTypes(newv->value);
             FrameEntry *fe = frame.getSlotEntry(newv->slot);
             VarType &vt = a->varTypes[newv->slot];
-            JSValueType type = vt.getTypeTag(cx);
-            if (targetTypes->getKnownTypeTag(cx) == JSVAL_TYPE_DOUBLE) {
+            JSValueType type = vt.getTypeTag();
+            if (targetTypes->getKnownTypeTag() == JSVAL_TYPE_DOUBLE) {
                 if (type == JSVAL_TYPE_INT32) {
                     fixedIntToDoubleEntries.append(newv->slot);
                     frame.ensureDouble(fe);
@@ -7514,7 +7537,7 @@ mjit::Compiler::watchGlobalReallocation()
     JS_ASSERT(cx->typeInferenceEnabled());
     if (hasGlobalReallocation)
         return;
-    types::TypeSet::WatchObjectStateChange(cx, globalObj->getType(cx));
+    types::HeapTypeSet::WatchObjectStateChange(cx, globalObj->getType(cx));
     hasGlobalReallocation = true;
 }
 
@@ -7531,7 +7554,7 @@ mjit::Compiler::updateVarType()
      * (see prepareInferenceTypes).
      */
 
-    types::TypeSet *types = pushedTypeSet(0);
+    types::StackTypeSet *types = pushedTypeSet(0);
     uint32_t slot = GetBytecodeSlot(script, PC);
 
     if (analysis->trackSlot(slot)) {
@@ -7543,7 +7566,7 @@ mjit::Compiler::updateVarType()
          * maintained by the frame as a double. We might forget the exact
          * representation used by the next call to fixDoubleTypes, fix it now.
          */
-        if (vt.getTypeTag(cx) == JSVAL_TYPE_DOUBLE)
+        if (vt.getTypeTag() == JSVAL_TYPE_DOUBLE)
             frame.ensureDouble(frame.getSlotEntry(slot));
     }
 }
@@ -7560,9 +7583,9 @@ mjit::Compiler::updateJoinVarTypes()
         while (newv->slot) {
             if (newv->slot < TotalSlots(script)) {
                 VarType &vt = a->varTypes[newv->slot];
-                JSValueType type = vt.getTypeTag(cx);
+                JSValueType type = vt.getTypeTag();
                 vt.setTypes(analysis->getValueTypes(newv->value));
-                if (vt.getTypeTag(cx) != type) {
+                if (vt.getTypeTag() != type) {
                     /*
                      * If the known type of a variable changes (even if the
                      * variable itself has not been reassigned) then we can't
@@ -7593,7 +7616,7 @@ mjit::Compiler::restoreVarType()
      * of tracked variables match their inferred type (as tracked in varTypes),
      * but may have forgotten it due to a branch or syncAndForgetEverything.
      */
-    JSValueType type = a->varTypes[slot].getTypeTag(cx);
+    JSValueType type = a->varTypes[slot].getTypeTag();
     if (type != JSVAL_TYPE_UNKNOWN &&
         (type != JSVAL_TYPE_DOUBLE || analysis->trackSlot(slot))) {
         FrameEntry *fe = frame.getSlotEntry(slot);
@@ -7608,8 +7631,8 @@ mjit::Compiler::knownPushedType(uint32_t pushed)
 {
     if (!cx->typeInferenceEnabled())
         return JSVAL_TYPE_UNKNOWN;
-    types::TypeSet *types = analysis->pushedTypes(PC, pushed);
-    return types->getKnownTypeTag(cx);
+    types::StackTypeSet *types = analysis->pushedTypes(PC, pushed);
+    return types->getKnownTypeTag();
 }
 
 bool
@@ -7627,7 +7650,7 @@ mjit::Compiler::mayPushUndefined(uint32_t pushed)
     return types->hasType(types::Type::UndefinedType());
 }
 
-types::TypeSet *
+types::StackTypeSet *
 mjit::Compiler::pushedTypeSet(uint32_t pushed)
 {
     if (!cx->typeInferenceEnabled())
@@ -7664,8 +7687,8 @@ mjit::Compiler::pushedSingleton(unsigned pushed)
     if (!cx->typeInferenceEnabled())
         return NULL;
 
-    types::TypeSet *types = analysis->pushedTypes(PC, pushed);
-    return types->getSingleton(cx);
+    types::StackTypeSet *types = analysis->pushedTypes(PC, pushed);
+    return types->getSingleton();
 }
 
 /*
@@ -7719,7 +7742,7 @@ mjit::Compiler::pushAddressMaybeBarrier(Address address, JSValueType type, bool
 }
 
 MaybeJump
-mjit::Compiler::trySingleTypeTest(types::TypeSet *types, RegisterID typeReg)
+mjit::Compiler::trySingleTypeTest(types::StackTypeSet *types, RegisterID typeReg)
 {
     /*
      * If a type set we have a barrier on is monomorphic, generate a single
@@ -7729,7 +7752,7 @@ mjit::Compiler::trySingleTypeTest(types::TypeSet *types, RegisterID typeReg)
      */
     MaybeJump res;
 
-    switch (types->getKnownTypeTag(cx)) {
+    switch (types->getKnownTypeTag()) {
       case JSVAL_TYPE_INT32:
         res.setJump(masm.testInt32(Assembler::NotEqual, typeReg));
         return res;
@@ -7752,7 +7775,7 @@ mjit::Compiler::trySingleTypeTest(types::TypeSet *types, RegisterID typeReg)
 }
 
 JSC::MacroAssembler::Jump
-mjit::Compiler::addTypeTest(types::TypeSet *types, RegisterID typeReg, RegisterID dataReg)
+mjit::Compiler::addTypeTest(types::StackTypeSet *types, RegisterID typeReg, RegisterID dataReg)
 {
     /*
      * :TODO: It would be good to merge this with GenerateTypeCheck, but the
@@ -7822,7 +7845,7 @@ mjit::Compiler::testBarrier(RegisterID typeReg, RegisterID dataReg,
     if (!cx->typeInferenceEnabled() || !(js_CodeSpec[*PC].format & JOF_TYPESET))
         return state;
 
-    types::TypeSet *types = analysis->bytecodeTypes(PC);
+    types::StackTypeSet *types = analysis->bytecodeTypes(PC);
     if (types->unknown()) {
         /*
          * If the result of this opcode is already unknown, there is no way for
@@ -7841,7 +7864,8 @@ mjit::Compiler::testBarrier(RegisterID typeReg, RegisterID dataReg,
         return state;
     }
 
-    types->addFreeze(cx);
+    if (hasTypeBarriers(PC))
+        typeBarrierBytecodes.append(PC - script->code);
 
     /* Cannot have type barriers when the result of the operation is already unknown. */
     JS_ASSERT(!types->unknown());
diff --git a/js/src/methodjit/Compiler.h b/js/src/methodjit/Compiler.h
index 16dab2dea960..ae38de59d73b 100644
--- a/js/src/methodjit/Compiler.h
+++ b/js/src/methodjit/Compiler.h
@@ -209,7 +209,6 @@ class Compiler : public BaseCompiler
         bool hasTypeCheck;
         bool typeMonitored;
         bool cached;
-        types::TypeSet *rhsTypes;
         ValueRemat vr;
         union {
             ic::GetPropLabels getPropLabels_;
@@ -249,7 +248,6 @@ class Compiler : public BaseCompiler
             }
             ic.typeMonitored = typeMonitored;
             ic.cached = cached;
-            ic.rhsTypes = rhsTypes;
             if (ic.isGet())
                 ic.setLabels(getPropLabels());
             else if (ic.isSet())
@@ -321,19 +319,19 @@ class Compiler : public BaseCompiler
      */
     class VarType {
         JSValueType type;
-        types::TypeSet *types;
+        types::StackTypeSet *types;
 
       public:
-        void setTypes(types::TypeSet *types) {
+        void setTypes(types::StackTypeSet *types) {
             this->types = types;
             this->type = JSVAL_TYPE_MISSING;
         }
 
         types::TypeSet *getTypes() { return types; }
 
-        JSValueType getTypeTag(JSContext *cx) {
+        JSValueType getTypeTag() {
             if (type == JSVAL_TYPE_MISSING)
-                type = types ? types->getKnownTypeTag(cx) : JSVAL_TYPE_UNKNOWN;
+                type = types ? types->getKnownTypeTag() : JSVAL_TYPE_UNKNOWN;
             return type;
         }
     };
@@ -433,6 +431,8 @@ private:
     js::Vector<DoublePatch, 16, CompilerAllocPolicy> doubleList;
     js::Vector<JSObject*, 0, CompilerAllocPolicy> rootedTemplates;
     js::Vector<RegExpShared*, 0, CompilerAllocPolicy> rootedRegExps;
+    js::Vector<uint32_t> monitoredBytecodes;
+    js::Vector<uint32_t> typeBarrierBytecodes;
     js::Vector<uint32_t> fixedIntToDoubleEntries;
     js::Vector<uint32_t> fixedDoubleToAnyEntries;
     js::Vector<JumpTable, 16> jumpTables;
@@ -547,7 +547,7 @@ private:
     void restoreVarType();
     JSValueType knownPushedType(uint32_t pushed);
     bool mayPushUndefined(uint32_t pushed);
-    types::TypeSet *pushedTypeSet(uint32_t which);
+    types::StackTypeSet *pushedTypeSet(uint32_t which);
     bool monitored(jsbytecode *pc);
     bool hasTypeBarriers(jsbytecode *pc);
     bool testSingletonProperty(HandleObject obj, HandleId id);
@@ -562,8 +562,8 @@ private:
         RegisterID dataReg;
     };
 
-    MaybeJump trySingleTypeTest(types::TypeSet *types, RegisterID typeReg);
-    Jump addTypeTest(types::TypeSet *types, RegisterID typeReg, RegisterID dataReg);
+    MaybeJump trySingleTypeTest(types::StackTypeSet *types, RegisterID typeReg);
+    Jump addTypeTest(types::StackTypeSet *types, RegisterID typeReg, RegisterID dataReg);
     BarrierState pushAddressMaybeBarrier(Address address, JSValueType type, bool reuseBase,
                                          bool testUndefined = false);
     BarrierState testBarrier(RegisterID typeReg, RegisterID dataReg,
diff --git a/js/src/methodjit/FastBuiltins.cpp b/js/src/methodjit/FastBuiltins.cpp
index 363188968564..9de38edd23e9 100644
--- a/js/src/methodjit/FastBuiltins.cpp
+++ b/js/src/methodjit/FastBuiltins.cpp
@@ -615,9 +615,7 @@ mjit::Compiler::compileArrayConcat(types::TypeSet *thisTypes, types::TypeSet *ar
      * so check that type information already reflects possible side effects of
      * this call.
      */
-    thisTypes->addFreeze(cx);
-    argTypes->addFreeze(cx);
-    types::TypeSet *thisElemTypes = thisType->getProperty(cx, JSID_VOID, false);
+    types::HeapTypeSet *thisElemTypes = thisType->getProperty(cx, JSID_VOID, false);
     if (!thisElemTypes)
         return Compile_Error;
     if (!pushedTypeSet(0)->hasType(types::Type::ObjectType(thisType)))
@@ -628,7 +626,7 @@ mjit::Compiler::compileArrayConcat(types::TypeSet *thisTypes, types::TypeSet *ar
         types::TypeObject *argType = argTypes->getTypeObject(i);
         if (!argType)
             continue;
-        types::TypeSet *elemTypes = argType->getProperty(cx, JSID_VOID, false);
+        types::HeapTypeSet *elemTypes = argType->getProperty(cx, JSID_VOID, false);
         if (!elemTypes)
             return Compile_Error;
         if (!elemTypes->knownSubset(cx, thisElemTypes))
@@ -875,7 +873,7 @@ mjit::Compiler::inlineNativeFunction(uint32_t argc, bool callingNew)
 
     FrameEntry *origCallee = frame.peek(-((int)argc + 2));
     FrameEntry *thisValue = frame.peek(-((int)argc + 1));
-    types::TypeSet *thisTypes = analysis->poppedTypes(PC, argc);
+    types::StackTypeSet *thisTypes = analysis->poppedTypes(PC, argc);
 
     if (!origCallee->isConstant() || !origCallee->isType(JSVAL_TYPE_OBJECT))
         return Compile_InlineAbort;
@@ -947,7 +945,7 @@ mjit::Compiler::inlineNativeFunction(uint32_t argc, bool callingNew)
         }
     } else if (argc == 1) {
         FrameEntry *arg = frame.peek(-1);
-        types::TypeSet *argTypes = frame.extra(arg).types;
+        types::StackTypeSet *argTypes = frame.extra(arg).types;
         if (!argTypes)
             return Compile_InlineAbort;
         JSValueType argType = arg->isTypeKnown() ? arg->getKnownType() : JSVAL_TYPE_UNKNOWN;
diff --git a/js/src/methodjit/FastOps.cpp b/js/src/methodjit/FastOps.cpp
index 3e6f5e207e57..b7970e81681e 100644
--- a/js/src/methodjit/FastOps.cpp
+++ b/js/src/methodjit/FastOps.cpp
@@ -387,8 +387,8 @@ mjit::Compiler::jsop_equality_obj_obj(JSOp op, jsbytecode *target, JSOp fused)
      * special equality operator on either object, if that passes then
      * this is a pointer comparison.
      */
-    types::TypeSet *lhsTypes = analysis->poppedTypes(PC, 1);
-    types::TypeSet *rhsTypes = analysis->poppedTypes(PC, 0);
+    types::StackTypeSet *lhsTypes = analysis->poppedTypes(PC, 1);
+    types::StackTypeSet *rhsTypes = analysis->poppedTypes(PC, 0);
     if (!lhsTypes->hasObjectFlags(cx, types::OBJECT_FLAG_SPECIAL_EQUALITY) &&
         !rhsTypes->hasObjectFlags(cx, types::OBJECT_FLAG_SPECIAL_EQUALITY)) {
         /* :TODO: Merge with jsop_relational_int? */
@@ -896,8 +896,8 @@ mjit::Compiler::jsop_localinc(JSOp op, uint32_t slot)
 {
     restoreVarType();
 
-    types::TypeSet *types = pushedTypeSet(0);
-    JSValueType type = types ? types->getKnownTypeTag(cx) : JSVAL_TYPE_UNKNOWN;
+    types::StackTypeSet *types = pushedTypeSet(0);
+    JSValueType type = types ? types->getKnownTypeTag() : JSVAL_TYPE_UNKNOWN;
 
     int amt = (op == JSOP_LOCALINC || op == JSOP_INCLOCAL) ? 1 : -1;
 
@@ -959,8 +959,8 @@ mjit::Compiler::jsop_arginc(JSOp op, uint32_t slot)
 {
     restoreVarType();
 
-    types::TypeSet *types = pushedTypeSet(0);
-    JSValueType type = types ? types->getKnownTypeTag(cx) : JSVAL_TYPE_UNKNOWN;
+    types::StackTypeSet *types = pushedTypeSet(0);
+    JSValueType type = types ? types->getKnownTypeTag() : JSVAL_TYPE_UNKNOWN;
 
     int amt = (op == JSOP_ARGINC || op == JSOP_INCARG) ? 1 : -1;
 
@@ -1169,7 +1169,7 @@ mjit::Compiler::jsop_setelem_dense()
      * because in that case the slot we're overwriting was previously
      * undefined.
      */
-    types::TypeSet *types = frame.extra(obj).types;
+    types::StackTypeSet *types = frame.extra(obj).types;
     if (cx->compartment->compileBarriers() && (!types || types->propertyNeedsBarrier(cx, JSID_VOID))) {
         Label barrierStart = stubcc.masm.label();
         stubcc.linkExitDirect(masm.jump(), barrierStart);
@@ -1538,6 +1538,9 @@ mjit::Compiler::jsop_setelem(bool popGuaranteed)
     FrameEntry *value = frame.peek(-1);
 
     if (!IsCacheableSetElem(obj, id, value) || monitored(PC)) {
+        if (monitored(PC) && script == outerScript)
+            monitoredBytecodes.append(PC - script->code);
+
         jsop_setelem_slow();
         return true;
     }
@@ -1545,7 +1548,7 @@ mjit::Compiler::jsop_setelem(bool popGuaranteed)
     // If the object is definitely a dense array or a typed array we can generate
     // code directly without using an inline cache.
     if (cx->typeInferenceEnabled()) {
-        types::TypeSet *types = analysis->poppedTypes(PC, 2);
+        types::StackTypeSet *types = analysis->poppedTypes(PC, 2);
 
         if (!types->hasObjectFlags(cx, types::OBJECT_FLAG_NON_DENSE_ARRAY) &&
             !types::ArrayPrototypeHasIndexedProperty(cx, outerScript)) {
@@ -1558,7 +1561,7 @@ mjit::Compiler::jsop_setelem(bool popGuaranteed)
         if ((value->mightBeType(JSVAL_TYPE_INT32) || value->mightBeType(JSVAL_TYPE_DOUBLE)) &&
             !types->hasObjectFlags(cx, types::OBJECT_FLAG_NON_TYPED_ARRAY)) {
             // Inline typed array path.
-            int atype = types->getTypedArrayType(cx);
+            int atype = types->getTypedArrayType();
             if (atype != TypedArray::TYPE_MAX) {
                 jsop_setelem_typed(atype);
                 return true;
@@ -2145,8 +2148,8 @@ mjit::Compiler::jsop_getelem()
     // If the object is definitely an arguments object, a dense array or a typed array
     // we can generate code directly without using an inline cache.
     if (cx->typeInferenceEnabled() && !id->isType(JSVAL_TYPE_STRING)) {
-        types::TypeSet *types = analysis->poppedTypes(PC, 1);
-        if (types->isMagicArguments(cx) && !outerScript->analysis()->modifiesArguments()) {
+        types::StackTypeSet *types = analysis->poppedTypes(PC, 1);
+        if (types->isMagicArguments() && !outerScript->analysis()->modifiesArguments()) {
             // Inline arguments path.
             jsop_getelem_args();
             return true;
@@ -2165,7 +2168,7 @@ mjit::Compiler::jsop_getelem()
         if (obj->mightBeType(JSVAL_TYPE_OBJECT) &&
             !types->hasObjectFlags(cx, types::OBJECT_FLAG_NON_TYPED_ARRAY)) {
             // Inline typed array path.
-            int atype = types->getTypedArrayType(cx);
+            int atype = types->getTypedArrayType();
             if (atype != TypedArray::TYPE_MAX) {
                 if (jsop_getelem_typed(atype))
                     return true;
@@ -2686,6 +2689,9 @@ mjit::Compiler::jsop_initprop()
     RootedObject baseobj(cx, frame.extra(obj).initObject);
 
     if (!baseobj || monitored(PC) || cx->compartment->compileBarriers()) {
+        if (monitored(PC) && script == outerScript)
+            monitoredBytecodes.append(PC - script->code);
+
         prepareStubCall(Uses(2));
         masm.move(ImmPtr(name), Registers::ArgReg1);
         INLINE_STUBCALL(stubs::InitProp, REJOIN_FALLTHROUGH);
diff --git a/js/src/methodjit/FrameState.cpp b/js/src/methodjit/FrameState.cpp
index f4a20f831e5a..3a86257b322f 100644
--- a/js/src/methodjit/FrameState.cpp
+++ b/js/src/methodjit/FrameState.cpp
@@ -29,7 +29,8 @@ FrameState::~FrameState()
 {
     while (a) {
         ActiveFrame *parent = a->parent;
-        a->script->analysis()->clearAllocations();
+        if (a->script->hasAnalysis())
+            a->script->analysis()->clearAllocations();
         cx->free_(a);
         a = parent;
     }
@@ -542,7 +543,7 @@ RegisterAllocation *
 FrameState::computeAllocation(jsbytecode *target)
 {
     JS_ASSERT(cx->typeInferenceEnabled());
-    RegisterAllocation *alloc = cx->typeLifoAlloc().new_<RegisterAllocation>(false);
+    RegisterAllocation *alloc = cx->analysisLifoAlloc().new_<RegisterAllocation>(false);
     if (!alloc) {
         js_ReportOutOfMemory(cx);
         return NULL;
@@ -592,8 +593,8 @@ FrameState::computeAllocation(jsbytecode *target)
                     if (newv->value.kind() == SSAValue::PHI &&
                         newv->value.phiOffset() == uint32_t(target - a->script->code) &&
                         newv->slot == entrySlot(fe)) {
-                        types::TypeSet *types = a->analysis->getValueTypes(newv->value);
-                        if (types->getKnownTypeTag(cx) != JSVAL_TYPE_DOUBLE)
+                        types::StackTypeSet *types = a->analysis->getValueTypes(newv->value);
+                        if (types->getKnownTypeTag() != JSVAL_TYPE_DOUBLE)
                             nonDoubleTarget = true;
                     }
                     newv++;
@@ -825,7 +826,7 @@ FrameState::discardForJoin(RegisterAllocation *&alloc, uint32_t stackDepth)
          * This shows up for loop entries which are not reachable from the
          * loop head, and for exception, switch target and trap safe points.
          */
-        alloc = cx->typeLifoAlloc().new_<RegisterAllocation>(false);
+        alloc = cx->analysisLifoAlloc().new_<RegisterAllocation>(false);
         if (!alloc) {
             js_ReportOutOfMemory(cx);
             return false;
diff --git a/js/src/methodjit/FrameState.h b/js/src/methodjit/FrameState.h
index 0481f3d8a2a2..7e482b936363 100644
--- a/js/src/methodjit/FrameState.h
+++ b/js/src/methodjit/FrameState.h
@@ -698,7 +698,7 @@ class FrameState
     struct StackEntryExtra {
         bool initArray;
         JSObject *initObject;
-        types::TypeSet *types;
+        types::StackTypeSet *types;
         JSAtom *name;
         void reset() { PodZero(this); }
     };
diff --git a/js/src/methodjit/InvokeHelpers.cpp b/js/src/methodjit/InvokeHelpers.cpp
index 1fe71923b78c..100c547848d7 100644
--- a/js/src/methodjit/InvokeHelpers.cpp
+++ b/js/src/methodjit/InvokeHelpers.cpp
@@ -867,7 +867,10 @@ js_InternalInterpret(void *returnData, void *returnType, void *returnReg, js::VM
         if (!obj)
             return js_InternalThrow(f);
         fp->thisValue() = ObjectValue(*obj);
+        /* FALLTHROUGH */
+      }
 
+      case REJOIN_THIS_CREATED: {
         Probes::enterScript(f.cx, f.script(), f.script()->function(), fp);
 
         if (script->debugMode) {
@@ -875,9 +878,13 @@ js_InternalInterpret(void *returnData, void *returnType, void *returnReg, js::VM
             switch (status) {
               case JSTRAP_CONTINUE:
                 break;
-              case JSTRAP_RETURN:
-                *f.returnAddressLocation() = f.cx->jaegerRuntime().forceReturnFromExternC();
-                return NULL;
+              case JSTRAP_RETURN: {
+                /* Advance to the JSOP_STOP at the end of the script. */
+                f.regs.pc = script->code + script->length - 1;
+                nextDepth = 0;
+                JS_ASSERT(*f.regs.pc == JSOP_STOP);
+                break;
+              }
               case JSTRAP_THROW:
               case JSTRAP_ERROR:
                 return js_InternalThrow(f);
diff --git a/js/src/methodjit/LoopState.cpp b/js/src/methodjit/LoopState.cpp
index 414215c952fa..728800a8bb39 100644
--- a/js/src/methodjit/LoopState.cpp
+++ b/js/src/methodjit/LoopState.cpp
@@ -126,7 +126,7 @@ LoopState::init(jsbytecode *head, Jump entry, jsbytecode *entryTarget)
     RegisterAllocation *&alloc = outerAnalysis->getAllocation(head);
     JS_ASSERT(!alloc);
 
-    alloc = cx->typeLifoAlloc().new_<RegisterAllocation>(true);
+    alloc = cx->analysisLifoAlloc().new_<RegisterAllocation>(true);
     if (!alloc) {
         js_ReportOutOfMemory(cx);
         return false;
@@ -140,7 +140,7 @@ LoopState::init(jsbytecode *head, Jump entry, jsbytecode *entryTarget)
      * had indirect modification of their arguments.
      */
     if (outerScript->function()) {
-        if (TypeSet::HasObjectFlags(cx, outerScript->function()->getType(cx), OBJECT_FLAG_UNINLINEABLE))
+        if (HeapTypeSet::HasObjectFlags(cx, outerScript->function()->getType(cx), OBJECT_FLAG_UNINLINEABLE))
             this->skipAnalysis = true;
     }
 
@@ -778,10 +778,10 @@ LoopState::invariantLength(const CrossSSAValue &obj)
     int32_t objConstant;
     if (!getEntryValue(obj, &objSlot, &objConstant) || objSlot == UNASSIGNED || objConstant != 0)
         return NULL;
-    TypeSet *objTypes = ssa->getValueTypes(obj);
+    StackTypeSet *objTypes = ssa->getValueTypes(obj);
 
     /* Check for 'length' on the lazy arguments for the current frame. */
-    if (objTypes->isMagicArguments(cx)) {
+    if (objTypes->isMagicArguments()) {
         JS_ASSERT(obj.frame == CrossScriptSSA::OUTER_FRAME);
 
         for (unsigned i = 0; i < invariantEntries.length(); i++) {
@@ -824,9 +824,6 @@ LoopState::invariantLength(const CrossSSAValue &obj)
 
     /* Hoist 'length' access on typed arrays. */
     if (!objTypes->hasObjectFlags(cx, OBJECT_FLAG_NON_TYPED_ARRAY)) {
-        /* Recompile if object type changes. */
-        objTypes->addFreeze(cx);
-
         uint32_t which = frame.allocTemporary();
         if (which == UINT32_MAX)
             return NULL;
@@ -861,7 +858,6 @@ LoopState::invariantLength(const CrossSSAValue &obj)
         if (object && hasModifiedProperty(object, JSID_VOID))
             return NULL;
     }
-    objTypes->addFreeze(cx);
 
     uint32_t which = frame.allocTemporary();
     if (which == UINT32_MAX)
@@ -913,12 +909,11 @@ LoopState::invariantProperty(const CrossSSAValue &obj, jsid id)
     TypeObject *object = objTypes->getTypeObject(0);
     if (!object || object->unknownProperties() || hasModifiedProperty(object, id) || id != MakeTypeId(cx, id))
         return NULL;
-    TypeSet *propertyTypes = object->getProperty(cx, id, false);
+    HeapTypeSet *propertyTypes = object->getProperty(cx, id, false);
     if (!propertyTypes)
         return NULL;
-    if (!propertyTypes->isDefiniteProperty() || propertyTypes->isOwnProperty(cx, object, true))
+    if (!propertyTypes->definiteProperty() || propertyTypes->isOwnProperty(cx, object, true))
         return NULL;
-    objTypes->addFreeze(cx);
 
     uint32_t which = frame.allocTemporary();
     if (which == UINT32_MAX)
@@ -1178,8 +1173,8 @@ LoopState::ignoreIntegerOverflow(const CrossSSAValue &pushed)
             return false;
         }
 
-        TypeSet *lhsTypes = outerAnalysis->poppedTypes(use->offset, 1);
-        if (lhsTypes->getKnownTypeTag(cx) != JSVAL_TYPE_INT32)
+        StackTypeSet *lhsTypes = outerAnalysis->poppedTypes(use->offset, 1);
+        if (lhsTypes->getKnownTypeTag() != JSVAL_TYPE_INT32)
             return false;
 
         JaegerSpew(JSpew_Analysis, "Integer result is RHS in integer addition\n");
@@ -1571,8 +1566,8 @@ LoopState::analyzeLoopTest()
     SSAValue two = outerAnalysis->poppedValue(test.pushedOffset(), 0);
 
     /* The test must be comparing known integers. */
-    if (outerAnalysis->getValueTypes(one)->getKnownTypeTag(cx) != JSVAL_TYPE_INT32 ||
-        outerAnalysis->getValueTypes(two)->getKnownTypeTag(cx) != JSVAL_TYPE_INT32) {
+    if (outerAnalysis->getValueTypes(one)->getKnownTypeTag() != JSVAL_TYPE_INT32 ||
+        outerAnalysis->getValueTypes(two)->getKnownTypeTag() != JSVAL_TYPE_INT32) {
         return;
     }
 
@@ -1675,11 +1670,11 @@ LoopState::definiteArrayAccess(const SSAValue &obj, const SSAValue &index)
      * other value by which the overflow could be observed.
      */
 
-    TypeSet *objTypes = outerAnalysis->getValueTypes(obj);
-    TypeSet *elemTypes = outerAnalysis->getValueTypes(index);
+    StackTypeSet *objTypes = outerAnalysis->getValueTypes(obj);
+    StackTypeSet *elemTypes = outerAnalysis->getValueTypes(index);
 
-    if (objTypes->getKnownTypeTag(cx) != JSVAL_TYPE_OBJECT ||
-        elemTypes->getKnownTypeTag(cx) != JSVAL_TYPE_INT32) {
+    if (objTypes->getKnownTypeTag() != JSVAL_TYPE_OBJECT ||
+        elemTypes->getKnownTypeTag() != JSVAL_TYPE_INT32) {
         return false;
     }
 
@@ -1801,19 +1796,18 @@ LoopState::analyzeLoopBody(unsigned frame)
             SSAValue objValue = analysis->poppedValue(pc, 2);
             SSAValue elemValue = analysis->poppedValue(pc, 1);
 
-            TypeSet *objTypes = analysis->getValueTypes(objValue);
-            TypeSet *elemTypes = analysis->getValueTypes(elemValue);
+            StackTypeSet *objTypes = analysis->getValueTypes(objValue);
+            StackTypeSet *elemTypes = analysis->getValueTypes(elemValue);
 
             /*
              * Mark the modset as unknown if the index might be non-integer,
              * we don't want to consider the SETELEM PIC here.
              */
-            if (objTypes->unknownObject() || elemTypes->getKnownTypeTag(cx) != JSVAL_TYPE_INT32) {
+            if (objTypes->unknownObject() || elemTypes->getKnownTypeTag() != JSVAL_TYPE_INT32) {
                 unknownModset = true;
                 break;
             }
 
-            objTypes->addFreeze(cx);
             for (unsigned i = 0; i < objTypes->getObjectCount(); i++) {
                 TypeObject *object = objTypes->getTypeObject(i);
                 if (!object)
@@ -1848,7 +1842,6 @@ LoopState::analyzeLoopBody(unsigned frame)
                 break;
             }
 
-            objTypes->addFreeze(cx);
             for (unsigned i = 0; i < objTypes->getObjectCount(); i++) {
                 TypeObject *object = objTypes->getTypeObject(i);
                 if (!object)
@@ -1916,7 +1909,7 @@ LoopState::analyzeLoopBody(unsigned frame)
           case JSOP_GE:
           case JSOP_STRICTEQ:
           case JSOP_STRICTNE: {
-            JSValueType type = analysis->poppedTypes(pc, 1)->getKnownTypeTag(cx);
+            JSValueType type = analysis->poppedTypes(pc, 1)->getKnownTypeTag();
             if (type != JSVAL_TYPE_INT32 && type != JSVAL_TYPE_DOUBLE)
                 constrainedLoop = false;
           }
@@ -1925,7 +1918,7 @@ LoopState::analyzeLoopBody(unsigned frame)
           case JSOP_POS:
           case JSOP_NEG:
           case JSOP_BITNOT: {
-            JSValueType type = analysis->poppedTypes(pc, 0)->getKnownTypeTag(cx);
+            JSValueType type = analysis->poppedTypes(pc, 0)->getKnownTypeTag();
             if (type != JSVAL_TYPE_INT32 && type != JSVAL_TYPE_DOUBLE)
                 constrainedLoop = false;
             break;
diff --git a/js/src/methodjit/MethodJIT.cpp b/js/src/methodjit/MethodJIT.cpp
index 8cbeca855e32..64664f9e000a 100644
--- a/js/src/methodjit/MethodJIT.cpp
+++ b/js/src/methodjit/MethodJIT.cpp
@@ -1122,10 +1122,22 @@ JITChunk::rootedRegExps() const
     return (RegExpShared **)&rootedTemplates()[nRootedTemplates];
 }
 
+uint32_t *
+JITChunk::monitoredBytecodes() const
+{
+    return (uint32_t *)&rootedRegExps()[nRootedRegExps];
+}
+
+uint32_t *
+JITChunk::typeBarrierBytecodes() const
+{
+    return (uint32_t *)&monitoredBytecodes()[nMonitoredBytecodes];
+}
+
 char *
 JITChunk::commonSectionLimit() const
 {
-    return (char *)&rootedRegExps()[nRootedRegExps];
+    return (char *)&typeBarrierBytecodes()[nTypeBarrierBytecodes];
 }
 
 #ifdef JS_MONOIC
@@ -1257,6 +1269,9 @@ JITScript::destroy(FreeOp *fop)
     for (unsigned i = 0; i < nchunks; i++)
         destroyChunk(fop, i);
 
+    if (liveness)
+        fop->free_(liveness);
+
     if (shimPool)
         shimPool->release();
 }
@@ -1384,6 +1399,8 @@ size_t
 mjit::JITScript::sizeOfIncludingThis(JSMallocSizeOfFun mallocSizeOf)
 {
     size_t n = mallocSizeOf(this);
+    if (liveness)
+        n += mallocSizeOf(liveness);
     for (unsigned i = 0; i < nchunks; i++) {
         const ChunkDescriptor &desc = chunkDescriptor(i);
         if (desc.chunk)
@@ -1402,6 +1419,8 @@ mjit::JITChunk::computedSizeOfIncludingThis()
            sizeof(CallSite) * nCallSites +
            sizeof(JSObject*) * nRootedTemplates +
            sizeof(RegExpShared*) * nRootedRegExps +
+           sizeof(uint32_t) * nMonitoredBytecodes +
+           sizeof(uint32_t) * nTypeBarrierBytecodes +
 #if defined JS_MONOIC
            sizeof(ic::GetGlobalNameIC) * nGetGlobalNames +
            sizeof(ic::SetGlobalNameIC) * nSetGlobalNames +
diff --git a/js/src/methodjit/MethodJIT.h b/js/src/methodjit/MethodJIT.h
index f015bc60fc49..93444f2e3a7a 100644
--- a/js/src/methodjit/MethodJIT.h
+++ b/js/src/methodjit/MethodJIT.h
@@ -37,6 +37,10 @@ namespace mjit {
     struct JITScript;
 }
 
+namespace analyze {
+    struct ScriptLiveness;
+}
+
 struct VMFrame
 {
 #if defined(JS_CPU_SPARC)
@@ -300,6 +304,9 @@ enum RejoinState {
      */
     REJOIN_THIS_PROTOTYPE,
 
+    /* As above, after the 'this' object has been created. */
+    REJOIN_THIS_CREATED,
+
     /*
      * Type check on arguments failed during prologue, need stack check and
      * the rest of the JIT prologue before the script can execute.
@@ -649,6 +656,8 @@ struct JITChunk
     uint32_t        nCallSites;
     uint32_t        nRootedTemplates;
     uint32_t        nRootedRegExps;
+    uint32_t        nMonitoredBytecodes;
+    uint32_t        nTypeBarrierBytecodes;
 #ifdef JS_MONOIC
     uint32_t        nGetGlobalNames;
     uint32_t        nSetGlobalNames;
@@ -677,6 +686,15 @@ struct JITChunk
     js::mjit::CallSite *callSites() const;
     JSObject **rootedTemplates() const;
     RegExpShared **rootedRegExps() const;
+
+    /*
+     * Offsets of bytecodes which were monitored or had type barriers at the
+     * point of compilation. Used to avoid unnecessary recompilation after
+     * analysis purges.
+     */
+    uint32_t *monitoredBytecodes() const;
+    uint32_t *typeBarrierBytecodes() const;
+
 #ifdef JS_MONOIC
     ic::GetGlobalNameIC *getGlobalNames() const;
     ic::SetGlobalNameIC *setGlobalNames() const;
@@ -786,6 +804,12 @@ struct JITScript
      */
     JSC::ExecutablePool *shimPool;
 
+    /*
+     * Optional liveness information attached to the JITScript if the analysis
+     * information is purged while retaining JIT info.
+     */
+    analyze::ScriptLiveness *liveness;
+
 #ifdef JS_MONOIC
     /* Inline cache at function entry for checking this/argument types. */
     JSC::CodeLocationLabel argsCheckStub;
diff --git a/js/src/methodjit/PolyIC.cpp b/js/src/methodjit/PolyIC.cpp
index 729c070bf880..c7aa1962b76e 100644
--- a/js/src/methodjit/PolyIC.cpp
+++ b/js/src/methodjit/PolyIC.cpp
@@ -410,7 +410,17 @@ class SetPropCompiler : public PICStubCompiler
             types::TypeSet *types = type->getProperty(cx, types::MakeTypeId(cx, id), true);
             if (!types)
                 return false;
-            pic.rhsTypes->addSubset(cx, types);
+
+            jsbytecode *pc;
+            JSScript *script = cx->stack.currentScript(&pc);
+
+            if (!script->ensureRanInference(cx) || monitor.recompiled())
+                return false;
+
+            JS_ASSERT(*pc == JSOP_SETPROP || *pc == JSOP_SETNAME);
+
+            types::StackTypeSet *rhsTypes = script->analysis()->poppedTypes(pc, 0);
+            rhsTypes->addSubset(cx, types);
         }
 
         return !monitor.recompiled();
diff --git a/js/src/methodjit/PolyIC.h b/js/src/methodjit/PolyIC.h
index 55f1fb8c6b8a..fa010ab36ea7 100644
--- a/js/src/methodjit/PolyIC.h
+++ b/js/src/methodjit/PolyIC.h
@@ -409,9 +409,6 @@ struct PICInfo : public BasePolyIC {
     // Offset from start of fast path to initial shape guard.
     uint32_t shapeGuard;
 
-    // Possible types of the RHS, for monitored SETPROP PICs.
-    types::TypeSet *rhsTypes;
-
     inline bool isSet() const {
         return kind == SET;
     }
diff --git a/js/src/methodjit/StubCalls.cpp b/js/src/methodjit/StubCalls.cpp
index b440d73db5a7..d6435965a731 100644
--- a/js/src/methodjit/StubCalls.cpp
+++ b/js/src/methodjit/StubCalls.cpp
@@ -74,7 +74,7 @@ stubs::SetName(VMFrame &f, PropertyName *name)
     RootedObject scope(cx, &f.regs.sp[-2].toObject());
     HandleValue value = HandleValue::fromMarkedLocation(&f.regs.sp[-1]);
 
-    if (!SetNameOperation(cx, f.pc(), scope, value))
+    if (!SetNameOperation(cx, f.script(), f.pc(), scope, value))
         THROW();
 
     f.regs.sp[-2] = f.regs.sp[-1];
@@ -326,7 +326,7 @@ stubs::DefFun(VMFrame &f, JSFunction *fun_)
     Rooted<JSObject*> parent(cx, &fp->varObj());
 
     /* ES5 10.5 (NB: with subsequent errata). */
-    RootedPropertyName name(cx, fun->atom->asPropertyName());
+    RootedPropertyName name(cx, fun->atom()->asPropertyName());
     RootedShape shape(cx);
     RootedObject pobj(cx);
     if (!JSObject::lookupProperty(cx, parent, name, &pobj, &shape))
diff --git a/js/src/shell/js.cpp b/js/src/shell/js.cpp
index 7b9c7232c81f..146c6e9e40ad 100644
--- a/js/src/shell/js.cpp
+++ b/js/src/shell/js.cpp
@@ -1583,6 +1583,7 @@ SrcNotes(JSContext *cx, JSScript *script, Sprinter *sp)
            "ofs", "line", "pc", "delta", "desc", "args");
     Sprint(sp, "---- ---- ----- ------ -------- ------\n");
     unsigned offset = 0;
+    unsigned colspan = 0;
     unsigned lineno = script->lineno;
     jssrcnote *notes = script->notes();
     unsigned switchTableEnd = 0, switchTableStart = 0;
@@ -1598,6 +1599,12 @@ SrcNotes(JSContext *cx, JSScript *script, Sprinter *sp)
         }
         Sprint(sp, "%3u: %4u %5u [%4u] %-8s", unsigned(sn - notes), lineno, offset, delta, name);
         switch (type) {
+          case SRC_COLSPAN:
+            colspan = js_GetSrcNoteOffset(sn, 0);
+            if (colspan >= SN_COLSPAN_DOMAIN / 2)
+                colspan -= SN_COLSPAN_DOMAIN;
+            Sprint(sp, "%d", colspan);
+            break;
           case SRC_SETLINE:
             lineno = js_GetSrcNoteOffset(sn, 0);
             Sprint(sp, " lineno %u", lineno);
@@ -4290,7 +4297,7 @@ my_ErrorReporter(JSContext *cx, const char *message, JSErrorReport *report)
         prefix = JS_smprintf("%s:", report->filename);
     if (report->lineno) {
         tmp = prefix;
-        prefix = JS_smprintf("%s%u: ", tmp ? tmp : "", report->lineno);
+        prefix = JS_smprintf("%s%u:%u ", tmp ? tmp : "", report->lineno, report->column);
         JS_free(cx, tmp);
     }
     if (JSREPORT_IS_WARNING(report->flags)) {
diff --git a/js/src/tests/ecma/extensions/errorcolumnblame.js b/js/src/tests/ecma/extensions/errorcolumnblame.js
new file mode 100644
index 000000000000..f15804bcd76a
--- /dev/null
+++ b/js/src/tests/ecma/extensions/errorcolumnblame.js
@@ -0,0 +1,73 @@
+/*
+ * Any copyright is dedicated to the Public Domain.
+ * http://creativecommons.org/licenses/publicdomain/
+ */
+
+var BUGNUMBER = 568142;
+var summary = 'error reporting blames column as well as line';
+
+function test(f, col) {
+    var caught = false;
+    try {
+        f();
+    } catch (e) {
+        caught = true;
+        assertEq(e.columnNumber, col);
+    }
+    assertEq(caught, true);
+}
+
+/* Note single hard tab before return! */
+function foo(o) {
+	return o.p;
+}
+test(foo, 1);
+
+//234567890123456789
+test(function(f) { return f.bar; }, 19);
+test(function(f) { return f(); }, 19);
+/* Cover negative colspan case using for(;;) loop with error in update part. */
+test(function(){
+        //0         1         2         3         4
+        //012345678901234567890123456789012345678901
+    eval("function baz() { for (var i = 0; i < 10; i += a.b); assertEq(i !== i, true); }");
+    baz();
+}, 41);
+
+//        1         2         3
+//234567890123456789012345678901234
+test(function() { var tmp = null; tmp(); }, 34)
+test(function() { var tmp = null;  tmp.foo; }, 35)
+
+/* Just a generic 'throw'. */
+test(function() {
+//234567890123
+    foo({}); throw new Error('a');
+}, 13);
+
+/* Be sure to report the right statement */
+test(function() {
+    function f() { return true; }
+    function g() { return false; }
+//234567890123456789012345678
+    f(); g(); f(); if (f()) a += e;
+}, 28);
+
+//2345678901234567890
+test(function() { e++; }, 18);
+test(function() {print += e; }, 17);
+test(function(){e += 1 }, 16);
+test(function() {  print[e]; }, 19);
+test(function() { e[1]; }, 18);
+test(function() { e(); }, 18);
+test(function() { 1(); }, 18);
+test(function() { Object.defineProperty() }, 18);
+
+test(function() {
+//23456789012345678901
+    function foo() { asdf; } foo()
+}, 21);
+
+reportCompare(0, 0, "ok");
+
+printStatus("All tests passed!");
diff --git a/js/src/tests/js1_5/Exceptions/errstack-001.js b/js/src/tests/js1_5/Exceptions/errstack-001.js
index 08d22d605825..d9c46ced8f17 100644
--- a/js/src/tests/js1_5/Exceptions/errstack-001.js
+++ b/js/src/tests/js1_5/Exceptions/errstack-001.js
@@ -136,8 +136,8 @@ expect = '@';
 addThis();
 
 status = inSection(12);
-actual = stackFrames[1].substring(0,1);
-expect = '@';
+actual = stackFrames[1].substring(0,7);
+expect = 'myErr<@';
 addThis();
 
 status = inSection(13);
diff --git a/js/src/vm/Debugger.cpp b/js/src/vm/Debugger.cpp
index 5d3fd06a1cb6..23f273e94e9a 100644
--- a/js/src/vm/Debugger.cpp
+++ b/js/src/vm/Debugger.cpp
@@ -3708,7 +3708,29 @@ DebuggerObject_getName(JSContext *cx, unsigned argc, Value *vp)
         return true;
     }
 
-    JSString *name = obj->toFunction()->atom;
+    JSString *name = obj->toFunction()->atom();
+    if (!name) {
+        args.rval().setUndefined();
+        return true;
+    }
+
+    Value namev = StringValue(name);
+    if (!dbg->wrapDebuggeeValue(cx, &namev))
+        return false;
+    args.rval().set(namev);
+    return true;
+}
+
+static JSBool
+DebuggerObject_getDisplayName(JSContext *cx, unsigned argc, Value *vp)
+{
+    THIS_DEBUGOBJECT_OWNER_REFERENT(cx, argc, vp, "get display name", args, dbg, obj);
+    if (!obj->isFunction()) {
+        args.rval().setUndefined();
+        return true;
+    }
+
+    JSString *name = obj->toFunction()->displayAtom();
     if (!name) {
         args.rval().setUndefined();
         return true;
@@ -4222,6 +4244,7 @@ static JSPropertySpec DebuggerObject_properties[] = {
     JS_PSG("class", DebuggerObject_getClass, 0),
     JS_PSG("callable", DebuggerObject_getCallable, 0),
     JS_PSG("name", DebuggerObject_getName, 0),
+    JS_PSG("displayName", DebuggerObject_getDisplayName, 0),
     JS_PSG("parameterNames", DebuggerObject_getParameterNames, 0),
     JS_PSG("script", DebuggerObject_getScript, 0),
     JS_PSG("environment", DebuggerObject_getEnvironment, 0),
diff --git a/js/src/vm/SPSProfiler.cpp b/js/src/vm/SPSProfiler.cpp
index 2d0b5b0217fb..abd68876d5e1 100644
--- a/js/src/vm/SPSProfiler.cpp
+++ b/js/src/vm/SPSProfiler.cpp
@@ -170,9 +170,9 @@ SPSProfiler::allocProfileString(JSContext *cx, JSScript *script, JSFunction *may
 {
     DebugOnly<uint64_t> gcBefore = cx->runtime->gcNumber;
     StringBuffer buf(cx);
-    bool hasAtom = maybeFun != NULL && maybeFun->atom != NULL;
+    bool hasAtom = maybeFun != NULL && maybeFun->displayAtom() != NULL;
     if (hasAtom) {
-        if (!buf.append(maybeFun->atom))
+        if (!buf.append(maybeFun->displayAtom()))
             return NULL;
         if (!buf.append(" ("))
             return NULL;
diff --git a/js/src/vm/ScopeObject.cpp b/js/src/vm/ScopeObject.cpp
index a35da755130f..4c7d97fdc705 100644
--- a/js/src/vm/ScopeObject.cpp
+++ b/js/src/vm/ScopeObject.cpp
@@ -256,7 +256,7 @@ DeclEnvObject::create(JSContext *cx, StackFrame *fp)
     if (!obj->asScope().setEnclosingScope(cx, fp->scopeChain()))
         return NULL;
 
-    Rooted<jsid> id(cx, AtomToId(fp->fun()->atom));
+    Rooted<jsid> id(cx, AtomToId(fp->fun()->atom()));
     RootedValue value(cx, ObjectValue(fp->callee()));
     if (!DefineNativeProperty(cx, obj, id, value, NULL, NULL,
                               JSPROP_ENUMERATE | JSPROP_PERMANENT | JSPROP_READONLY,
diff --git a/js/xpconnect/src/XPCJSID.cpp b/js/xpconnect/src/XPCJSID.cpp
index aa549d2e092c..8e9d31ab077c 100644
--- a/js/xpconnect/src/XPCJSID.cpp
+++ b/js/xpconnect/src/XPCJSID.cpp
@@ -485,10 +485,9 @@ nsJSIID::HasInstance(nsIXPConnectWrappedNative *wrapper,
         if (mozilla::dom::binding::instanceIsProxy(obj)) {
             identity =
                 static_cast<nsISupports*>(js::GetProxyPrivate(obj).toPrivate());
-        } else if (mozilla::dom::IsDOMClass(js::GetObjectJSClass(obj))) {
-            NS_ASSERTION(mozilla::dom::DOMJSClass::FromJSClass(
-                              js::GetObjectJSClass(obj))->mDOMObjectIsISupports,
-                         "This only works on nsISupports classes!");
+        } else if (mozilla::dom::IsDOMClass(js::GetObjectJSClass(obj)) &&
+                   mozilla::dom::DOMJSClass::FromJSClass(
+                        js::GetObjectJSClass(obj))->mDOMObjectIsISupports) {
             identity =
                 mozilla::dom::UnwrapDOMObject<nsISupports>(obj);
         } else {
diff --git a/js/xpconnect/src/event_impl_gen.conf.in b/js/xpconnect/src/event_impl_gen.conf.in
index 506adfa3a850..1a5ac3392058 100644
--- a/js/xpconnect/src/event_impl_gen.conf.in
+++ b/js/xpconnect/src/event_impl_gen.conf.in
@@ -22,8 +22,10 @@ simple_events = [
     'DeviceLightEvent',
     'MozApplicationEvent',
 #ifdef MOZ_B2G_BT
-    'BluetoothDeviceAddressEvent',
+    'BluetoothAuthorizeEvent',
     'BluetoothDeviceEvent',
+    'BluetoothDeviceAddressEvent',
+    'BluetoothPairingEvent',
 #endif
     'DeviceStorageChangeEvent',
     'PopupBlockedEvent'
diff --git a/layout/base/nsDisplayList.cpp b/layout/base/nsDisplayList.cpp
index 8e5894b1c484..49d196e91eb2 100644
--- a/layout/base/nsDisplayList.cpp
+++ b/layout/base/nsDisplayList.cpp
@@ -557,7 +557,8 @@ static void RecordFrameMetrics(nsIFrame* aForFrame,
                                const nsRect& aViewport,
                                nsRect* aDisplayPort,
                                ViewID aScrollId,
-                               const nsDisplayItem::ContainerParameters& aContainerParameters) {
+                               const nsDisplayItem::ContainerParameters& aContainerParameters,
+                               bool aMayHaveTouchListeners) {
   nsPresContext* presContext = aForFrame->PresContext();
   int32_t auPerDevPixel = presContext->AppUnitsPerDevPixel();
 
@@ -590,8 +591,10 @@ static void RecordFrameMetrics(nsIFrame* aForFrame,
                          nsPresContext::AppUnitsToFloatCSSPixels(contentBounds.height));
     metrics.mContentRect = contentBounds.ScaleToNearestPixels(
       aContainerParameters.mXScale, aContainerParameters.mYScale, auPerDevPixel);
-    metrics.mViewportScrollOffset = scrollableFrame->GetScrollPosition().ScaleToNearestPixels(
-      aContainerParameters.mXScale, aContainerParameters.mYScale, auPerDevPixel);
+    nsPoint scrollPosition = scrollableFrame->GetScrollPosition();
+    metrics.mViewportScrollOffset = mozilla::gfx::Point(
+      NSAppUnitsToDoublePixels(scrollPosition.x, auPerDevPixel) * aContainerParameters.mXScale,
+      NSAppUnitsToDoublePixels(scrollPosition.y, auPerDevPixel) * aContainerParameters.mYScale);
   }
   else {
     nsRect contentBounds = aForFrame->GetRect();
@@ -609,6 +612,8 @@ static void RecordFrameMetrics(nsIFrame* aForFrame,
   nsIPresShell* presShell = presContext->GetPresShell();
   metrics.mResolution = gfxSize(presShell->GetXResolution(), presShell->GetYResolution());
 
+  metrics.mMayHaveTouchListeners = aMayHaveTouchListeners;
+
   aRoot->SetFrameMetrics(metrics);
 }
 
@@ -1020,10 +1025,22 @@ void nsDisplayList::PaintForFrame(nsDisplayListBuilder* aBuilder,
       usingDisplayport = nsLayoutUtils::GetDisplayPort(content, &displayport);
     }
   }
+
+  bool mayHaveTouchListeners = false;
+  if (presShell) {
+    nsIDocument* document = presShell->GetDocument();
+    if (document) {
+      nsCOMPtr<nsPIDOMWindow> innerWin(document->GetInnerWindow());
+      if (innerWin) {
+        mayHaveTouchListeners = innerWin->HasTouchEventListeners();
+      }
+    }
+  }
+
   RecordFrameMetrics(aForFrame, rootScrollFrame,
                      root, mVisibleRect, mVisibleRect,
                      (usingDisplayport ? &displayport : nullptr), id,
-                     containerParameters);
+                     containerParameters, mayHaveTouchListeners);
   if (usingDisplayport &&
       !(root->GetContentFlags() & Layer::CONTENT_OPAQUE)) {
     // See bug 693938, attachment 567017
@@ -2624,7 +2641,7 @@ nsDisplayScrollLayer::BuildLayer(nsDisplayListBuilder* aBuilder,
   }
   RecordFrameMetrics(mScrolledFrame, mScrollFrame, layer, mVisibleRect, viewport,
                      (usingDisplayport ? &displayport : nullptr), scrollId,
-                     aContainerParameters);
+                     aContainerParameters, false);
 
   return layer.forget();
 }
diff --git a/layout/generic/nsHTMLReflowState.cpp b/layout/generic/nsHTMLReflowState.cpp
index bf3bf1b3d68b..64a91664af13 100644
--- a/layout/generic/nsHTMLReflowState.cpp
+++ b/layout/generic/nsHTMLReflowState.cpp
@@ -2105,6 +2105,7 @@ nsCSSOffsetState::InitOffsets(nscoord aContainingBlockWidth,
   }
   else if (frame->GetStateBits() & NS_FRAME_IS_SVG_TEXT) {
     mComputedPadding.SizeTo(0, 0, 0, 0);
+    needPaddingProp = false;
   }
   else if (aPadding) { // padding is an input arg
     mComputedPadding = *aPadding;
diff --git a/layout/ipc/RenderFrameParent.cpp b/layout/ipc/RenderFrameParent.cpp
index bb1f58243cbf..70a0f5c0ffed 100644
--- a/layout/ipc/RenderFrameParent.cpp
+++ b/layout/ipc/RenderFrameParent.cpp
@@ -158,7 +158,9 @@ ComputeShadowTreeTransform(nsIFrame* aContainerFrame,
   nsIntPoint scrollOffset =
     aConfig.mScrollOffset.ToNearestPixels(auPerDevPixel);
   // metricsScrollOffset is in layer coordinates.
-  nsIntPoint metricsScrollOffset = aMetrics->mViewportScrollOffset;
+  gfx::Point metricsScrollOffset = aMetrics->mViewportScrollOffset;
+  nsIntPoint roundedMetricsScrollOffset =
+    nsIntPoint(NS_lround(metricsScrollOffset.x), NS_lround(metricsScrollOffset.y));
 
   if (aRootFrameLoader->AsyncScrollEnabled() && !aMetrics->mDisplayPort.IsEmpty()) {
     // Only use asynchronous scrolling if it is enabled and there is a
@@ -166,8 +168,8 @@ ComputeShadowTreeTransform(nsIFrame* aContainerFrame,
     // synchronously scrolled for identifying a scroll area before it is
     // being actively scrolled.
     nsIntPoint scrollCompensation(
-      (scrollOffset.x / aTempScaleX - metricsScrollOffset.x) * aConfig.mXScale,
-      (scrollOffset.y / aTempScaleY - metricsScrollOffset.y) * aConfig.mYScale);
+      (scrollOffset.x / aTempScaleX - roundedMetricsScrollOffset.x) * aConfig.mXScale,
+      (scrollOffset.y / aTempScaleY - roundedMetricsScrollOffset.y) * aConfig.mYScale);
 
     return ViewTransform(-scrollCompensation, aConfig.mXScale, aConfig.mYScale);
   } else {
@@ -699,7 +701,7 @@ RenderFrameParent::NotifyInputEvent(const nsInputEvent& aEvent,
                                     nsInputEvent* aOutEvent)
 {
   if (mPanZoomController) {
-    mPanZoomController->HandleInputEvent(aEvent, aOutEvent);
+    mPanZoomController->ReceiveInputEvent(aEvent, aOutEvent);
   }
 }
 
@@ -882,14 +884,6 @@ RenderFrameParent::BuildDisplayList(nsDisplayListBuilder* aBuilder,
                                  bounds));
 }
 
-void
-RenderFrameParent::NotifyDOMTouchListenerAdded()
-{
-  if (mPanZoomController) {
-    mPanZoomController->NotifyDOMTouchListenerAdded();
-  }
-}
-
 void
 RenderFrameParent::ZoomToRect(const gfxRect& aRect)
 {
@@ -898,6 +892,14 @@ RenderFrameParent::ZoomToRect(const gfxRect& aRect)
   }
 }
 
+void
+RenderFrameParent::ContentReceivedTouch(bool aPreventDefault)
+{
+  if (mPanZoomController) {
+    mPanZoomController->ContentReceivedTouch(aPreventDefault);
+  }
+}
+
 }  // namespace layout
 }  // namespace mozilla
 
diff --git a/layout/ipc/RenderFrameParent.h b/layout/ipc/RenderFrameParent.h
index 60ee3bb14c53..5adbf371e2ff 100644
--- a/layout/ipc/RenderFrameParent.h
+++ b/layout/ipc/RenderFrameParent.h
@@ -94,10 +94,10 @@ public:
 
   void NotifyDimensionsChanged(int width, int height);
 
-  void NotifyDOMTouchListenerAdded();
-
   void ZoomToRect(const gfxRect& aRect);
 
+  void ContentReceivedTouch(bool aPreventDefault);
+
 protected:
   void ActorDestroy(ActorDestroyReason why) MOZ_OVERRIDE;
 
diff --git a/layout/reftests/font-inflation/disable-fontinfl-on-mobile-5.html b/layout/reftests/font-inflation/disable-fontinfl-on-mobile-5.html
new file mode 100644
index 000000000000..40149c9b5800
--- /dev/null
+++ b/layout/reftests/font-inflation/disable-fontinfl-on-mobile-5.html
@@ -0,0 +1,18 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE html PUBLIC "-//WAPFORUM//DTD XHTML Mobile 1.0//EN" "http://www.wapforum.org/DTD/xhtml-mobile10.dtd">
+
+<!--
+The <meta name="viewport"> tag takes precedence over the doctype, so this
+should *not* be treated as a "mobile" site (bug 783565).
+-->
+<html>
+  <head>
+    <meta name="viewport" content="width=10000">
+    <style>
+      p { font-size: 12px; line-height: 1.0;}
+    </style>
+    <body>
+      <p>Some uninflated text.</p>
+    </body>
+  </head>
+</html>
diff --git a/layout/reftests/font-inflation/reftest.list b/layout/reftests/font-inflation/reftest.list
index 4ca6e3a072d4..c7b0f3d461a7 100644
--- a/layout/reftests/font-inflation/reftest.list
+++ b/layout/reftests/font-inflation/reftest.list
@@ -55,6 +55,7 @@ test-pref(font.size.inflation.emPerLine,15) test-pref(font.size.inflation.lineTh
 test-pref(font.size.inflation.emPerLine,15) test-pref(font.size.inflation.lineThreshold,0) == disable-fontinfl-on-mobile-2.html disable-fontinfl-on-mobile-ref.html
 test-pref(font.size.inflation.emPerLine,15) test-pref(font.size.inflation.lineThreshold,0) == disable-fontinfl-on-mobile-3.html disable-fontinfl-on-mobile-ref.html
 test-pref(font.size.inflation.emPerLine,15) test-pref(font.size.inflation.lineThreshold,0) == disable-fontinfl-on-mobile-4.html disable-fontinfl-on-mobile-ref.html
+test-pref(font.size.inflation.emPerLine,15) test-pref(font.size.inflation.lineThreshold,0) != disable-fontinfl-on-mobile-5.html disable-fontinfl-on-mobile-ref.html
 test-pref(font.size.inflation.emPerLine,15) test-pref(font.size.inflation.lineThreshold,0) == preformatted-text.html preformatted-text-ref.html
 test-pref(font.size.inflation.emPerLine,15) test-pref(font.size.inflation.lineThreshold,0) == fixed-height-body.html fixed-height-body-ref.html
 test-pref(font.size.inflation.emPerLine,15) test-pref(font.size.inflation.lineThreshold,0) == fixed-height-body-child.html fixed-height-body-child-ref.html
diff --git a/layout/reftests/w3c-css/submitted/conditional3/css-supports-001.xht b/layout/reftests/w3c-css/submitted/conditional3/css-supports-001.xht
index 2276557c871f..3f8782580168 100644
--- a/layout/reftests/w3c-css/submitted/conditional3/css-supports-001.xht
+++ b/layout/reftests/w3c-css/submitted/conditional3/css-supports-001.xht
@@ -3,10 +3,10 @@
  <head>
   <title>CSS Test: An @supports rule with valid syntax and a passing condition must apply rules inside it</title>
   <link rel="author" title="Cameron McCormack" href="mailto:cam@mcc.id.au" />
-  <link rel="help" href="http://www.w3.org/TR/#at-supports" />
+  <link rel="help" href="http://www.w3.org/TR/css3-conditional/#at-supports" />
   <meta name="flags" content="" />
   <meta name="assert" content="An @supports rule condition with a single, valid property declaration for a supported property must cause the rules inside the @supports rule to apply."/>
-  <link rel="match" href="pass.html" />
+  <link rel="match" href="support/pass.xht" />
   <style type="text/css"><![CDATA[
     @supports (color: green) {
       html { background-color: green }
diff --git a/layout/reftests/w3c-css/submitted/conditional3/css-supports-002.xht b/layout/reftests/w3c-css/submitted/conditional3/css-supports-002.xht
index dbe152a76e2d..48326acb7eed 100644
--- a/layout/reftests/w3c-css/submitted/conditional3/css-supports-002.xht
+++ b/layout/reftests/w3c-css/submitted/conditional3/css-supports-002.xht
@@ -3,10 +3,10 @@
  <head>
   <title>CSS Test: An @supports rule with invalid syntax must not apply rules inside it</title>
   <link rel="author" title="Cameron McCormack" href="mailto:cam@mcc.id.au" />
-  <link rel="help" href="http://www.w3.org/TR/#at-supports" />
-  <meta name="flags" content="" />
+  <link rel="help" href="http://www.w3.org/TR/css3-conditional/#at-supports" />
+  <meta name="flags" content="invalid" />
   <meta name="assert" content="Property declarations in an @supports rule condition must be surrounded by parentheses."/>
-  <link rel="match" href="pass.html" />
+  <link rel="match" href="support/pass.xht" />
   <style type="text/css"><![CDATA[
     html { background-color: green }
     @supports color: green {
diff --git a/layout/reftests/w3c-css/submitted/conditional3/css-supports-003.xht b/layout/reftests/w3c-css/submitted/conditional3/css-supports-003.xht
index 70a87906abe2..4e01f5369944 100644
--- a/layout/reftests/w3c-css/submitted/conditional3/css-supports-003.xht
+++ b/layout/reftests/w3c-css/submitted/conditional3/css-supports-003.xht
@@ -3,10 +3,10 @@
  <head>
   <title>CSS Test: An @supports rule with valid syntax and a passing condition must apply rules inside it</title>
   <link rel="author" title="Cameron McCormack" href="mailto:cam@mcc.id.au" />
-  <link rel="help" href="http://www.w3.org/TR/#at-supports" />
+  <link rel="help" href="http://www.w3.org/TR/css3-conditional/#at-supports" />
   <meta name="flags" content="" />
   <meta name="assert" content="Any subexpression in an @supports rule condition can be surrounded by an extra pair of parentheses."/>
-  <link rel="match" href="pass.html" />
+  <link rel="match" href="support/pass.xht" />
   <style type="text/css"><![CDATA[
     @supports ((color: green)) {
       html { background-color: green }
diff --git a/layout/reftests/w3c-css/submitted/conditional3/css-supports-004.xht b/layout/reftests/w3c-css/submitted/conditional3/css-supports-004.xht
index c5def52be7e1..7c4ad818b4f7 100644
--- a/layout/reftests/w3c-css/submitted/conditional3/css-supports-004.xht
+++ b/layout/reftests/w3c-css/submitted/conditional3/css-supports-004.xht
@@ -3,10 +3,10 @@
  <head>
   <title>CSS Test: An @supports rule with valid syntax and a passing condition must apply rules inside it</title>
   <link rel="author" title="Cameron McCormack" href="mailto:cam@mcc.id.au" />
-  <link rel="help" href="http://www.w3.org/TR/#at-supports" />
+  <link rel="help" href="http://www.w3.org/TR/css3-conditional/#at-supports" />
   <meta name="flags" content="" />
   <meta name="assert" content="Property declarations in an @supports rule can have !important specified."/>
-  <link rel="match" href="pass.html" />
+  <link rel="match" href="support/pass.xht" />
   <style type="text/css"><![CDATA[
     @supports (color: green !important) {
       html { background-color: green }
diff --git a/layout/reftests/w3c-css/submitted/conditional3/css-supports-005.xht b/layout/reftests/w3c-css/submitted/conditional3/css-supports-005.xht
index 0fa36f180933..c184d70df7c0 100644
--- a/layout/reftests/w3c-css/submitted/conditional3/css-supports-005.xht
+++ b/layout/reftests/w3c-css/submitted/conditional3/css-supports-005.xht
@@ -3,10 +3,10 @@
  <head>
   <title>CSS Test: An @supports rule with valid syntax but a failing condition must not apply rules inside it</title>
   <link rel="author" title="Cameron McCormack" href="mailto:cam@mcc.id.au" />
-  <link rel="help" href="http://www.w3.org/TR/#at-supports" />
+  <link rel="help" href="http://www.w3.org/TR/css3-conditional/#at-supports" />
   <meta name="flags" content="" />
   <meta name="assert" content="A supported property with an unsupported value must cause the @supports condition to fail."/>
-  <link rel="match" href="pass.html" />
+  <link rel="match" href="support/pass.xht" />
   <style type="text/css"><![CDATA[
     html { background-color: green }
     @supports (color: rainbow) {
diff --git a/layout/reftests/w3c-css/submitted/conditional3/css-supports-006.xht b/layout/reftests/w3c-css/submitted/conditional3/css-supports-006.xht
index f6a8aaaf3b98..faf8f68f6433 100644
--- a/layout/reftests/w3c-css/submitted/conditional3/css-supports-006.xht
+++ b/layout/reftests/w3c-css/submitted/conditional3/css-supports-006.xht
@@ -3,10 +3,10 @@
  <head>
   <title>CSS Test: An @supports rule with valid syntax and a passing condition must apply rules inside it</title>
   <link rel="author" title="Cameron McCormack" href="mailto:cam@mcc.id.au" />
-  <link rel="help" href="http://www.w3.org/TR/#at-supports" />
+  <link rel="help" href="http://www.w3.org/TR/css3-conditional/#at-supports" />
   <meta name="flags" content="" />
   <meta name="assert" content="A disjunction of two @supports conditions must cause the @supports condition to pass if the left condition passes."/>
-  <link rel="match" href="pass.html" />
+  <link rel="match" href="support/pass.xht" />
   <style type="text/css"><![CDATA[
     @supports (color: rainbow) or (color: green) {
       html { background-color: green }
diff --git a/layout/reftests/w3c-css/submitted/conditional3/css-supports-007.xht b/layout/reftests/w3c-css/submitted/conditional3/css-supports-007.xht
index c0bc03e0aaaa..716b15232b98 100644
--- a/layout/reftests/w3c-css/submitted/conditional3/css-supports-007.xht
+++ b/layout/reftests/w3c-css/submitted/conditional3/css-supports-007.xht
@@ -3,10 +3,10 @@
  <head>
   <title>CSS Test: An @supports rule with valid syntax and a passing condition must apply rules inside it</title>
   <link rel="author" title="Cameron McCormack" href="mailto:cam@mcc.id.au" />
-  <link rel="help" href="http://www.w3.org/TR/#at-supports" />
+  <link rel="help" href="http://www.w3.org/TR/css3-conditional/#at-supports" />
   <meta name="flags" content="" />
   <meta name="assert" content="A disjunction of two @supports conditions must cause the @supports condition to pass if the right condition passes."/>
-  <link rel="match" href="pass.html" />
+  <link rel="match" href="support/pass.xht" />
   <style type="text/css"><![CDATA[
     @supports (color: green) or (color: rainbow) {
       html { background-color: green }
diff --git a/layout/reftests/w3c-css/submitted/conditional3/css-supports-008.xht b/layout/reftests/w3c-css/submitted/conditional3/css-supports-008.xht
index ca31e171694c..80596a9d466b 100644
--- a/layout/reftests/w3c-css/submitted/conditional3/css-supports-008.xht
+++ b/layout/reftests/w3c-css/submitted/conditional3/css-supports-008.xht
@@ -3,10 +3,10 @@
  <head>
   <title>CSS Test: An @supports rule with valid syntax and a passing condition must apply rules inside it</title>
   <link rel="author" title="Cameron McCormack" href="mailto:cam@mcc.id.au" />
-  <link rel="help" href="http://www.w3.org/TR/#at-supports" />
+  <link rel="help" href="http://www.w3.org/TR/css3-conditional/#at-supports" />
   <meta name="flags" content="" />
   <meta name="assert" content="A conjunction of two @supports conditions must cause the @supports condition to pass if both sub-conditions pass."/>
-  <link rel="match" href="pass.html" />
+  <link rel="match" href="support/pass.xht" />
   <style type="text/css"><![CDATA[
     @supports (color: green) and (color: blue) {
       html { background-color: green }
diff --git a/layout/reftests/w3c-css/submitted/conditional3/css-supports-009.xht b/layout/reftests/w3c-css/submitted/conditional3/css-supports-009.xht
index 9e01be44a9a6..31fffbe7146d 100644
--- a/layout/reftests/w3c-css/submitted/conditional3/css-supports-009.xht
+++ b/layout/reftests/w3c-css/submitted/conditional3/css-supports-009.xht
@@ -3,10 +3,10 @@
  <head>
   <title>CSS Test: An @supports rule with valid syntax but a failing condition must not apply rules inside it</title>
   <link rel="author" title="Cameron McCormack" href="mailto:cam@mcc.id.au" />
-  <link rel="help" href="http://www.w3.org/TR/#at-supports" />
+  <link rel="help" href="http://www.w3.org/TR/css3-conditional/#at-supports" />
   <meta name="flags" content="" />
   <meta name="assert" content="A conjunction of two @supports conditions must cause the @supports condition to fail if the left sub-condition passes."/>
-  <link rel="match" href="pass.html" />
+  <link rel="match" href="support/pass.xht" />
   <style type="text/css"><![CDATA[
     html { background-color: green }
     @supports (color: rainbow) and (color: blue) {
diff --git a/layout/reftests/w3c-css/submitted/conditional3/css-supports-010.xht b/layout/reftests/w3c-css/submitted/conditional3/css-supports-010.xht
index 1b3d62c690f7..17b8810f1409 100644
--- a/layout/reftests/w3c-css/submitted/conditional3/css-supports-010.xht
+++ b/layout/reftests/w3c-css/submitted/conditional3/css-supports-010.xht
@@ -3,10 +3,10 @@
  <head>
   <title>CSS Test: An @supports rule with valid syntax but a failing condition must not apply rules inside it</title>
   <link rel="author" title="Cameron McCormack" href="mailto:cam@mcc.id.au" />
-  <link rel="help" href="http://www.w3.org/TR/#at-supports" />
+  <link rel="help" href="http://www.w3.org/TR/css3-conditional/#at-supports" />
   <meta name="flags" content="" />
   <meta name="assert" content="A conjunction of two @supports conditions must cause the @supports condition to fail if the right sub-condition passes."/>
-  <link rel="match" href="pass.html" />
+  <link rel="match" href="support/pass.xht" />
   <style type="text/css"><![CDATA[
     html { background-color: green }
     @supports (color: blue) and (color: rainbow) {
diff --git a/layout/reftests/w3c-css/submitted/conditional3/css-supports-011.xht b/layout/reftests/w3c-css/submitted/conditional3/css-supports-011.xht
index 4f0728c10756..d70cc0054233 100644
--- a/layout/reftests/w3c-css/submitted/conditional3/css-supports-011.xht
+++ b/layout/reftests/w3c-css/submitted/conditional3/css-supports-011.xht
@@ -3,10 +3,10 @@
  <head>
   <title>CSS Test: An @supports rule with valid syntax and a passing condition must apply rules inside it</title>
   <link rel="author" title="Cameron McCormack" href="mailto:cam@mcc.id.au" />
-  <link rel="help" href="http://www.w3.org/TR/#at-supports" />
+  <link rel="help" href="http://www.w3.org/TR/css3-conditional/#at-supports" />
   <meta name="flags" content="" />
   <meta name="assert" content="A disjunction of three @supports conditions must cause the @supports condition to pass if at least one of the sub-conditions passes."/>
-  <link rel="match" href="pass.html" />
+  <link rel="match" href="support/pass.xht" />
   <style type="text/css"><![CDATA[
     @supports (color: rainbow) or (color: iridescent) or (color: green) {
       html { background-color: green }
diff --git a/layout/reftests/w3c-css/submitted/conditional3/css-supports-012.xht b/layout/reftests/w3c-css/submitted/conditional3/css-supports-012.xht
index e0dccf5ce1bf..c9ff483a51df 100644
--- a/layout/reftests/w3c-css/submitted/conditional3/css-supports-012.xht
+++ b/layout/reftests/w3c-css/submitted/conditional3/css-supports-012.xht
@@ -3,10 +3,10 @@
  <head>
   <title>CSS Test: An @supports rule with valid syntax and a passing condition must apply rules inside it</title>
   <link rel="author" title="Cameron McCormack" href="mailto:cam@mcc.id.au" />
-  <link rel="help" href="http://www.w3.org/TR/#at-supports" />
+  <link rel="help" href="http://www.w3.org/TR/css3-conditional/#at-supports" />
   <meta name="flags" content="" />
   <meta name="assert" content="A conjunction of three @supports conditions must cause the @supports condition to pass if all three sub-conditions pass."/>
-  <link rel="match" href="pass.html" />
+  <link rel="match" href="support/pass.xht" />
   <style type="text/css"><![CDATA[
     @supports (color: red) and (color: green) and (color: blue) {
       html { background-color: green }
diff --git a/layout/reftests/w3c-css/submitted/conditional3/css-supports-013.xht b/layout/reftests/w3c-css/submitted/conditional3/css-supports-013.xht
index 145c7adb3d9d..2c0b62e61640 100644
--- a/layout/reftests/w3c-css/submitted/conditional3/css-supports-013.xht
+++ b/layout/reftests/w3c-css/submitted/conditional3/css-supports-013.xht
@@ -3,10 +3,10 @@
  <head>
   <title>CSS Test: An @supports rule with invalid syntax must not apply rules inside it</title>
   <link rel="author" title="Cameron McCormack" href="mailto:cam@mcc.id.au" />
-  <link rel="help" href="http://www.w3.org/TR/#at-supports" />
-  <meta name="flags" content="" />
+  <link rel="help" href="http://www.w3.org/TR/css3-conditional/#at-supports" />
+  <meta name="flags" content="invalid" />
   <meta name="assert" content="A disjunction and a conjunction of @supports conditions must not be combined unless one of the two is surrounded by parentheses."/>
-  <link rel="match" href="pass.html" />
+  <link rel="match" href="support/pass.xht" />
   <style type="text/css"><![CDATA[
     html { background-color: green }
     @supports (color: green) and (color: green) or (color: green) {
diff --git a/layout/reftests/w3c-css/submitted/conditional3/css-supports-014.xht b/layout/reftests/w3c-css/submitted/conditional3/css-supports-014.xht
index 9713d04fa70d..90c3bb4e33e0 100644
--- a/layout/reftests/w3c-css/submitted/conditional3/css-supports-014.xht
+++ b/layout/reftests/w3c-css/submitted/conditional3/css-supports-014.xht
@@ -3,10 +3,10 @@
  <head>
   <title>CSS Test: An @supports rule with invalid syntax must not apply rules inside it</title>
   <link rel="author" title="Cameron McCormack" href="mailto:cam@mcc.id.au" />
-  <link rel="help" href="http://www.w3.org/TR/#at-supports" />
-  <meta name="flags" content="" />
+  <link rel="help" href="http://www.w3.org/TR/css3-conditional/#at-supports" />
+  <meta name="flags" content="invalid" />
   <meta name="assert" content="A disjunction and a conjunction of @supports conditions must not be combined unless one of the two is surrounded by parentheses."/>
-  <link rel="match" href="pass.html" />
+  <link rel="match" href="support/pass.xht" />
   <style type="text/css"><![CDATA[
     html { background-color: green }
     @supports (color: green) or (color: green) and (color: green) {
diff --git a/layout/reftests/w3c-css/submitted/conditional3/css-supports-015.xht b/layout/reftests/w3c-css/submitted/conditional3/css-supports-015.xht
index 8bef7b2698db..8a696fdff8d2 100644
--- a/layout/reftests/w3c-css/submitted/conditional3/css-supports-015.xht
+++ b/layout/reftests/w3c-css/submitted/conditional3/css-supports-015.xht
@@ -3,10 +3,10 @@
  <head>
   <title>CSS Test: An @supports rule with valid syntax and a passing condition must apply rules inside it</title>
   <link rel="author" title="Cameron McCormack" href="mailto:cam@mcc.id.au" />
-  <link rel="help" href="http://www.w3.org/TR/#at-supports" />
+  <link rel="help" href="http://www.w3.org/TR/css3-conditional/#at-supports" />
   <meta name="flags" content="" />
   <meta name="assert" content="There need not be any white space between the '@supports' and open brace of the rule set, not between a declaration's property name and value."/>
-  <link rel="match" href="pass.html" />
+  <link rel="match" href="support/pass.xht" />
   <style type="text/css"><![CDATA[
     @supports(color:green){
       html { background-color: green }
diff --git a/layout/reftests/w3c-css/submitted/conditional3/css-supports-016.xht b/layout/reftests/w3c-css/submitted/conditional3/css-supports-016.xht
index bc903a071c6b..bad6053133ae 100644
--- a/layout/reftests/w3c-css/submitted/conditional3/css-supports-016.xht
+++ b/layout/reftests/w3c-css/submitted/conditional3/css-supports-016.xht
@@ -3,10 +3,10 @@
  <head>
   <title>CSS Test: An @supports rule with valid syntax and a passing condition must apply rules inside it</title>
   <link rel="author" title="Cameron McCormack" href="mailto:cam@mcc.id.au" />
-  <link rel="help" href="http://www.w3.org/TR/#at-supports" />
+  <link rel="help" href="http://www.w3.org/TR/css3-conditional/#at-supports" />
   <meta name="flags" content="" />
   <meta name="assert" content="A negation of an @supports condition must pass if and only if the sub-condition fails.  The sub-condition here is a supported property name with an unsupported value."/>
-  <link rel="match" href="pass.html" />
+  <link rel="match" href="support/pass.xht" />
   <style type="text/css"><![CDATA[
     @supports not (color: rainbow) {
       html { background-color: green }
diff --git a/layout/reftests/w3c-css/submitted/conditional3/css-supports-017.xht b/layout/reftests/w3c-css/submitted/conditional3/css-supports-017.xht
index e80fef44c637..92b8d04e7f24 100644
--- a/layout/reftests/w3c-css/submitted/conditional3/css-supports-017.xht
+++ b/layout/reftests/w3c-css/submitted/conditional3/css-supports-017.xht
@@ -3,10 +3,10 @@
  <head>
   <title>CSS Test: An @supports rule with invalid syntax must not apply rules inside it</title>
   <link rel="author" title="Cameron McCormack" href="mailto:cam@mcc.id.au" />
-  <link rel="help" href="http://www.w3.org/TR/#at-supports" />
-  <meta name="flags" content="" />
+  <link rel="help" href="http://www.w3.org/TR/css3-conditional/#at-supports" />
+  <meta name="flags" content="invalid" />
   <meta name="assert" content="The sub-condition of a negation in an @supports condition must be in parentheses."/>
-  <link rel="match" href="pass.html" />
+  <link rel="match" href="support/pass.xht" />
   <style type="text/css"><![CDATA[
     html { background-color: green }
     @supports not not (color: green) {
diff --git a/layout/reftests/w3c-css/submitted/conditional3/css-supports-018.xht b/layout/reftests/w3c-css/submitted/conditional3/css-supports-018.xht
index b8b4b6a32e3e..2019a2a7cb1b 100644
--- a/layout/reftests/w3c-css/submitted/conditional3/css-supports-018.xht
+++ b/layout/reftests/w3c-css/submitted/conditional3/css-supports-018.xht
@@ -3,10 +3,10 @@
  <head>
   <title>CSS Test: An @supports rule with valid syntax and a passing condition must apply rules inside it</title>
   <link rel="author" title="Cameron McCormack" href="mailto:cam@mcc.id.au" />
-  <link rel="help" href="http://www.w3.org/TR/#at-supports" />
+  <link rel="help" href="http://www.w3.org/TR/css3-conditional/#at-supports" />
   <meta name="flags" content="" />
   <meta name="assert" content="The sub-condition of a negation in an @supports condition must be in parentheses."/>
-  <link rel="match" href="pass.html" />
+  <link rel="match" href="support/pass.xht" />
   <style type="text/css"><![CDATA[
     @supports not (not (color: green)) {
       html { background-color: green }
diff --git a/layout/reftests/w3c-css/submitted/conditional3/css-supports-019.xht b/layout/reftests/w3c-css/submitted/conditional3/css-supports-019.xht
index 583c7496e99f..109c8528ba54 100644
--- a/layout/reftests/w3c-css/submitted/conditional3/css-supports-019.xht
+++ b/layout/reftests/w3c-css/submitted/conditional3/css-supports-019.xht
@@ -3,10 +3,10 @@
  <head>
   <title>CSS Test: An @supports rule with invalid syntax must not apply rules inside it</title>
   <link rel="author" title="Cameron McCormack" href="mailto:cam@mcc.id.au" />
-  <link rel="help" href="http://www.w3.org/TR/#at-supports" />
-  <meta name="flags" content="" />
+  <link rel="help" href="http://www.w3.org/TR/css3-conditional/#at-supports" />
+  <meta name="flags" content="invalid" />
   <meta name="assert" content="A conjunction in an @supports condition must have both sub-conditions enclosed in parentheses."/>
-  <link rel="match" href="pass.html" />
+  <link rel="match" href="support/pass.xht" />
   <style type="text/css"><![CDATA[
     html { background-color: green }
     @supports not (color: rainbow) and not (color: iridescent) {
diff --git a/layout/reftests/w3c-css/submitted/conditional3/css-supports-020.xht b/layout/reftests/w3c-css/submitted/conditional3/css-supports-020.xht
index 075b39be3065..e6d5a1111d22 100644
--- a/layout/reftests/w3c-css/submitted/conditional3/css-supports-020.xht
+++ b/layout/reftests/w3c-css/submitted/conditional3/css-supports-020.xht
@@ -3,10 +3,10 @@
  <head>
   <title>CSS Test: An @supports rule with valid syntax but a failing condition must not apply rules inside it</title>
   <link rel="author" title="Cameron McCormack" href="mailto:cam@mcc.id.au" />
-  <link rel="help" href="http://www.w3.org/TR/#at-supports" />
+  <link rel="help" href="http://www.w3.org/TR/css3-conditional/#at-supports" />
   <meta name="flags" content="" />
   <meta name="assert" content="An @supports condition that is a declaration with a supported property name with an unsupported value must fail."/>
-  <link rel="match" href="pass.html" />
+  <link rel="match" href="support/pass.xht" />
   <style type="text/css"><![CDATA[
     html { background-color: green }
     @supports (unknown: green) {
diff --git a/layout/reftests/w3c-css/submitted/conditional3/css-supports-021.xht b/layout/reftests/w3c-css/submitted/conditional3/css-supports-021.xht
index 5796507b7691..df98d12068ee 100644
--- a/layout/reftests/w3c-css/submitted/conditional3/css-supports-021.xht
+++ b/layout/reftests/w3c-css/submitted/conditional3/css-supports-021.xht
@@ -3,10 +3,10 @@
  <head>
   <title>CSS Test: An @supports rule with valid syntax but a failing condition must not apply rules inside it</title>
   <link rel="author" title="Cameron McCormack" href="mailto:cam@mcc.id.au" />
-  <link rel="help" href="http://www.w3.org/TR/#at-supports" />
+  <link rel="help" href="http://www.w3.org/TR/css3-conditional/#at-supports" />
   <meta name="flags" content="" />
   <meta name="assert" content="A disjunction of two @supports conditions must cause the @supports condition to pass if one condition passes and the other fails due to being an unsupported property."/>
-  <link rel="match" href="pass.html" />
+  <link rel="match" href="support/pass.xht" />
   <style type="text/css"><![CDATA[
     @supports (unknown: green) or (color: green) {
       html { background-color: green }
diff --git a/layout/reftests/w3c-css/submitted/conditional3/css-supports-022.xht b/layout/reftests/w3c-css/submitted/conditional3/css-supports-022.xht
index 3cdb63515609..a451cd9fd1ec 100644
--- a/layout/reftests/w3c-css/submitted/conditional3/css-supports-022.xht
+++ b/layout/reftests/w3c-css/submitted/conditional3/css-supports-022.xht
@@ -3,10 +3,10 @@
  <head>
   <title>CSS Test: An @supports rule with invalid syntax must not apply rules inside it</title>
   <link rel="author" title="Cameron McCormack" href="mailto:cam@mcc.id.au" />
-  <link rel="help" href="http://www.w3.org/TR/#at-supports" />
-  <meta name="flags" content="" />
+  <link rel="help" href="http://www.w3.org/TR/css3-conditional/#at-supports" />
+  <meta name="flags" content="invalid" />
   <meta name="assert" content="An @supports conditions must fail to parse if a declaration has an empy property value."/>
-  <link rel="match" href="pass.html" />
+  <link rel="match" href="support/pass.xht" />
   <style type="text/css"><![CDATA[
     html { background-color: green }
     @supports (unknown:) or (color: green) {
diff --git a/layout/reftests/w3c-css/submitted/conditional3/css-supports-023.xht b/layout/reftests/w3c-css/submitted/conditional3/css-supports-023.xht
index 82279f441ce9..b620b109c90f 100644
--- a/layout/reftests/w3c-css/submitted/conditional3/css-supports-023.xht
+++ b/layout/reftests/w3c-css/submitted/conditional3/css-supports-023.xht
@@ -3,10 +3,10 @@
  <head>
   <title>CSS Test: An @supports rule with invalid syntax must not apply rules inside it</title>
   <link rel="author" title="Cameron McCormack" href="mailto:cam@mcc.id.au" />
-  <link rel="help" href="http://www.w3.org/TR/#at-supports" />
-  <meta name="flags" content="" />
+  <link rel="help" href="http://www.w3.org/TR/css3-conditional/#at-supports" />
+  <meta name="flags" content="invalid" />
   <meta name="assert" content="A property declaration in an @supports declaration must not omit the colon between the property name and value."/>
-  <link rel="match" href="pass.html" />
+  <link rel="match" href="support/pass.xht" />
   <style type="text/css"><![CDATA[
     html { background-color: green }
     @supports (unknown) or (color: green) {
diff --git a/layout/reftests/w3c-css/submitted/conditional3/css-supports-024.xht b/layout/reftests/w3c-css/submitted/conditional3/css-supports-024.xht
index 8c7ad4917040..de2baf3953fe 100644
--- a/layout/reftests/w3c-css/submitted/conditional3/css-supports-024.xht
+++ b/layout/reftests/w3c-css/submitted/conditional3/css-supports-024.xht
@@ -3,10 +3,10 @@
  <head>
   <title>CSS Test: An @supports rule with valid syntax and a passing condition must apply rules inside it</title>
   <link rel="author" title="Cameron McCormack" href="mailto:cam@mcc.id.au" />
-  <link rel="help" href="http://www.w3.org/TR/#at-supports" />
+  <link rel="help" href="http://www.w3.org/TR/css3-conditional/#at-supports" />
   <meta name="flags" content="" />
   <meta name="assert" content="A supported shorthand property declaration must be considered to pass."/>
-  <link rel="match" href="pass.html" />
+  <link rel="match" href="support/pass.xht" />
   <style type="text/css"><![CDATA[
     @supports (font: 16px serif) {
       html { background-color: green }
diff --git a/layout/reftests/w3c-css/submitted/conditional3/css-supports-025.xht b/layout/reftests/w3c-css/submitted/conditional3/css-supports-025.xht
index 7a27916b110d..7a766146e556 100644
--- a/layout/reftests/w3c-css/submitted/conditional3/css-supports-025.xht
+++ b/layout/reftests/w3c-css/submitted/conditional3/css-supports-025.xht
@@ -3,10 +3,10 @@
  <head>
   <title>CSS Test: A nested @supports rule with valid syntax and a passing condition must apply rules inside it</title>
   <link rel="author" title="Cameron McCormack" href="mailto:cam@mcc.id.au" />
-  <link rel="help" href="http://www.w3.org/TR/#at-supports" />
+  <link rel="help" href="http://www.w3.org/TR/css3-conditional/#at-supports" />
   <meta name="flags" content="" />
   <meta name="assert" content="An inner @supports rule inside an outer @supports must apply its child rules only if both @supports conditions succeeded."/>
-  <link rel="match" href="pass.html" />
+  <link rel="match" href="support/pass.xht" />
   <style type="text/css"><![CDATA[
     @supports (color: green) {
       @supports (color: blue) {
diff --git a/layout/reftests/w3c-css/submitted/conditional3/css-supports-026.xht b/layout/reftests/w3c-css/submitted/conditional3/css-supports-026.xht
index 643cdcd3c73d..920143e79766 100644
--- a/layout/reftests/w3c-css/submitted/conditional3/css-supports-026.xht
+++ b/layout/reftests/w3c-css/submitted/conditional3/css-supports-026.xht
@@ -3,11 +3,11 @@
  <head>
   <title>CSS Test: A nested @supports rule with valid syntax and a passing condition must apply rules inside it</title>
   <link rel="author" title="Cameron McCormack" href="mailto:cam@mcc.id.au" />
-  <link rel="help" href="http://www.w3.org/TR/#at-supports" />
+  <link rel="help" href="http://www.w3.org/TR/css3-conditional/#at-supports" />
   <link rel="help" href="http://www.w3.org/TR/css3-conditional/#at-media" />
   <meta name="flags" content="" />
   <meta name="assert" content="An outer @supports rule with an inner @media rule must apply the rules inside the @media only if both the @supports and @media conditions pass."/>
-  <link rel="match" href="pass.html" />
+  <link rel="match" href="support/pass.xht" />
   <style type="text/css"><![CDATA[
     @supports (color: green) {
       @media all {
diff --git a/layout/reftests/w3c-css/submitted/conditional3/css-supports-027.xht b/layout/reftests/w3c-css/submitted/conditional3/css-supports-027.xht
index 58dcd3755263..b3d8349e9720 100644
--- a/layout/reftests/w3c-css/submitted/conditional3/css-supports-027.xht
+++ b/layout/reftests/w3c-css/submitted/conditional3/css-supports-027.xht
@@ -3,11 +3,11 @@
  <head>
   <title>CSS Test: A nested @supports rule with valid syntax and a passing condition must apply rules inside it</title>
   <link rel="author" title="Cameron McCormack" href="mailto:cam@mcc.id.au" />
-  <link rel="help" href="http://www.w3.org/TR/#at-supports" />
+  <link rel="help" href="http://www.w3.org/TR/css3-conditional/#at-supports" />
   <link rel="help" href="http://www.w3.org/TR/css3-conditional/#at-document" />
   <meta name="flags" content="" />
   <meta name="assert" content="An outer @document rule with an inner @supports rule must apply the rules inside the @supports only if both the @supports and @document conditions pass."/>
-  <link rel="match" href="pass.html" />
+  <link rel="match" href="support/pass.xht" />
   <style type="text/css"><![CDATA[
     @-moz-document url-prefix("") {
       @supports (color: green) {
diff --git a/layout/reftests/w3c-css/submitted/conditional3/css-supports-028.xht b/layout/reftests/w3c-css/submitted/conditional3/css-supports-028.xht
index f72793b5ec4d..dd506dfcdab3 100644
--- a/layout/reftests/w3c-css/submitted/conditional3/css-supports-028.xht
+++ b/layout/reftests/w3c-css/submitted/conditional3/css-supports-028.xht
@@ -3,10 +3,10 @@
  <head>
   <title>CSS Test: A nested @supports rule with valid syntax and a passing condition must apply rules inside it</title>
   <link rel="author" title="Cameron McCormack" href="mailto:cam@mcc.id.au" />
-  <link rel="help" href="http://www.w3.org/TR/#at-supports" />
+  <link rel="help" href="http://www.w3.org/TR/css3-conditional/#at-supports" />
   <meta name="flags" content="" />
   <meta name="assert" content="An inner @document rule with an outer @supports rule must apply the rules inside the @document only if both the @supports and @document conditions pass."/>
-  <link rel="match" href="pass.html" />
+  <link rel="match" href="support/pass.xht" />
   <style type="text/css"><![CDATA[
     @supports (color: green) {
       @-moz-document url-prefix("") {
diff --git a/layout/reftests/w3c-css/submitted/conditional3/css-supports-029.xht b/layout/reftests/w3c-css/submitted/conditional3/css-supports-029.xht
index a63bfb6811a3..0d1bb589afc4 100644
--- a/layout/reftests/w3c-css/submitted/conditional3/css-supports-029.xht
+++ b/layout/reftests/w3c-css/submitted/conditional3/css-supports-029.xht
@@ -3,10 +3,10 @@
  <head>
   <title>CSS Test: An @supports rule with valid syntax and a passing condition must apply rules inside it</title>
   <link rel="author" title="Cameron McCormack" href="mailto:cam@mcc.id.au" />
-  <link rel="help" href="http://www.w3.org/TR/#at-supports" />
+  <link rel="help" href="http://www.w3.org/TR/css3-conditional/#at-supports" />
   <meta name="flags" content="" />
   <meta name="assert" content="A disjunction in an @supports condition must have both sub-conditions enclosed in parentheses." />
-  <link rel="match" href="pass.html" />
+  <link rel="match" href="support/pass.xht" />
   <style type="text/css"><![CDATA[
     html { background-color: green }
     @supports not (color: rainbow) or (color: green) {
diff --git a/layout/reftests/w3c-css/submitted/conditional3/css-supports-030.xht b/layout/reftests/w3c-css/submitted/conditional3/css-supports-030.xht
index e5aebaf966b5..6c087b8b0ac6 100644
--- a/layout/reftests/w3c-css/submitted/conditional3/css-supports-030.xht
+++ b/layout/reftests/w3c-css/submitted/conditional3/css-supports-030.xht
@@ -3,10 +3,10 @@
  <head>
   <title>CSS Test: An @supports rule with valid syntax and a passing condition must apply rules inside it</title>
   <link rel="author" title="Cameron McCormack" href="mailto:cam@mcc.id.au" />
-  <link rel="help" href="http://www.w3.org/TR/#at-supports" />
+  <link rel="help" href="http://www.w3.org/TR/css3-conditional/#at-supports" />
   <meta name="flags" content="" />
   <meta name="assert" content="A disjunction in an @supports condition must have both sub-conditions enclosed in parentheses." />
-  <link rel="match" href="pass.html" />
+  <link rel="match" href="support/pass.xht" />
   <style type="text/css"><![CDATA[
     html { background-color: green }
     @supports (not (color: rainbow) or (color: green)) {
diff --git a/layout/reftests/w3c-css/submitted/conditional3/css-supports-031.xht b/layout/reftests/w3c-css/submitted/conditional3/css-supports-031.xht
index 1df87995aaf6..85c582536944 100644
--- a/layout/reftests/w3c-css/submitted/conditional3/css-supports-031.xht
+++ b/layout/reftests/w3c-css/submitted/conditional3/css-supports-031.xht
@@ -3,10 +3,10 @@
  <head>
   <title>CSS Test: An @supports rule with invalid syntax must not apply rules inside it</title>
   <link rel="author" title="Cameron McCormack" href="mailto:cam@mcc.id.au" />
-  <link rel="help" href="http://www.w3.org/TR/#at-supports" />
-  <meta name="flags" content="" />
+  <link rel="help" href="http://www.w3.org/TR/css3-conditional/#at-supports" />
+  <meta name="flags" content="invalid" />
   <meta name="assert" content="An @supports conditions must fail to parse if a declaration has an empy property value."/>
-  <link rel="match" href="pass.html" />
+  <link rel="match" href="support/pass.xht" />
   <style type="text/css"><![CDATA[
     html { background-color: green }
     @supports (color:) or (color: green) {
diff --git a/layout/reftests/w3c-css/submitted/conditional3/pass.html b/layout/reftests/w3c-css/submitted/conditional3/pass.html
deleted file mode 100644
index 683938b40a68..000000000000
--- a/layout/reftests/w3c-css/submitted/conditional3/pass.html
+++ /dev/null
@@ -1,4 +0,0 @@
-<!DOCTYPE html>
-<style>
-html { background-color: green }
-</style>
diff --git a/layout/reftests/w3c-css/submitted/conditional3/reftest.list b/layout/reftests/w3c-css/submitted/conditional3/reftest.list
index bf22315fc069..cdf0e2dbbf41 100644
--- a/layout/reftests/w3c-css/submitted/conditional3/reftest.list
+++ b/layout/reftests/w3c-css/submitted/conditional3/reftest.list
@@ -1,31 +1,31 @@
-== css-supports-001.xht pass.html
-== css-supports-002.xht pass.html
-== css-supports-003.xht pass.html
-== css-supports-004.xht pass.html
-== css-supports-005.xht pass.html
-== css-supports-006.xht pass.html
-== css-supports-007.xht pass.html
-== css-supports-008.xht pass.html
-== css-supports-009.xht pass.html
-== css-supports-010.xht pass.html
-== css-supports-011.xht pass.html
-== css-supports-012.xht pass.html
-== css-supports-013.xht pass.html
-== css-supports-014.xht pass.html
-== css-supports-015.xht pass.html
-== css-supports-016.xht pass.html
-== css-supports-017.xht pass.html
-== css-supports-018.xht pass.html
-== css-supports-019.xht pass.html
-== css-supports-020.xht pass.html
-== css-supports-021.xht pass.html
-== css-supports-022.xht pass.html
-== css-supports-023.xht pass.html
-== css-supports-024.xht pass.html
-== css-supports-025.xht pass.html
-== css-supports-026.xht pass.html
-== css-supports-027.xht pass.html
-== css-supports-028.xht pass.html
-== css-supports-029.xht pass.html
-== css-supports-030.xht pass.html
-== css-supports-031.xht pass.html
+== css-supports-001.xht support/pass.xht
+== css-supports-002.xht support/pass.xht
+== css-supports-003.xht support/pass.xht
+== css-supports-004.xht support/pass.xht
+== css-supports-005.xht support/pass.xht
+== css-supports-006.xht support/pass.xht
+== css-supports-007.xht support/pass.xht
+== css-supports-008.xht support/pass.xht
+== css-supports-009.xht support/pass.xht
+== css-supports-010.xht support/pass.xht
+== css-supports-011.xht support/pass.xht
+== css-supports-012.xht support/pass.xht
+== css-supports-013.xht support/pass.xht
+== css-supports-014.xht support/pass.xht
+== css-supports-015.xht support/pass.xht
+== css-supports-016.xht support/pass.xht
+== css-supports-017.xht support/pass.xht
+== css-supports-018.xht support/pass.xht
+== css-supports-019.xht support/pass.xht
+== css-supports-020.xht support/pass.xht
+== css-supports-021.xht support/pass.xht
+== css-supports-022.xht support/pass.xht
+== css-supports-023.xht support/pass.xht
+== css-supports-024.xht support/pass.xht
+== css-supports-025.xht support/pass.xht
+== css-supports-026.xht support/pass.xht
+== css-supports-027.xht support/pass.xht
+== css-supports-028.xht support/pass.xht
+== css-supports-029.xht support/pass.xht
+== css-supports-030.xht support/pass.xht
+== css-supports-031.xht support/pass.xht
diff --git a/layout/reftests/w3c-css/submitted/conditional3/support/pass.xht b/layout/reftests/w3c-css/submitted/conditional3/support/pass.xht
new file mode 100644
index 000000000000..24dc3107e8b0
--- /dev/null
+++ b/layout/reftests/w3c-css/submitted/conditional3/support/pass.xht
@@ -0,0 +1,12 @@
+<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
+<html xmlns="http://www.w3.org/1999/xhtml">
+ <head>
+  <title>CSS Reftest Reference</title>
+  <link rel="author" title="Cameron McCormack" href="mailto:cam@mcc.id.au"/>
+  <style type="text/css"><![CDATA[
+   html { background-color: green }
+  ]]></style>
+ </head>
+ <body>
+ </body>
+</html>
diff --git a/layout/svg/base/src/nsSVGUtils.cpp b/layout/svg/base/src/nsSVGUtils.cpp
index 64505e0fd866..649e90442c48 100644
--- a/layout/svg/base/src/nsSVGUtils.cpp
+++ b/layout/svg/base/src/nsSVGUtils.cpp
@@ -1083,10 +1083,13 @@ nsSVGUtils::NotifyChildrenOfSVGChange(nsIFrame *aFrame, uint32_t aFlags)
     if (SVGFrame) {
       SVGFrame->NotifySVGChanged(aFlags); 
     } else {
-      NS_ASSERTION(kid->IsFrameOfType(nsIFrame::eSVG), "SVG frame expected");
+      NS_ASSERTION(kid->IsFrameOfType(nsIFrame::eSVG) || kid->IsSVGText(),
+                   "SVG frame expected");
       // recurse into the children of container frames e.g. <clipPath>, <mask>
       // in case they have child frames with transformation matrices
-      NotifyChildrenOfSVGChange(kid, aFlags);
+      if (kid->IsFrameOfType(nsIFrame::eSVG)) {
+        NotifyChildrenOfSVGChange(kid, aFlags);
+      }
     }
     kid = kid->GetNextSibling();
   }
diff --git a/layout/tools/reftest/reftest.js b/layout/tools/reftest/reftest.js
index 74ba393569df..e72bba20179b 100644
--- a/layout/tools/reftest/reftest.js
+++ b/layout/tools/reftest/reftest.js
@@ -1554,6 +1554,7 @@ function FindUnexpectedCrashDumpFiles()
         let path = String(file.path);
         if (path.match(/\.(dmp|extra)$/) && !gUnexpectedCrashDumpFiles[path]) {
             if (!foundCrashDumpFile) {
+                ++gTestResults.UnexpectedFail;
                 foundCrashDumpFile = true;
                 gDumpLog("REFTEST TEST-UNEXPECTED-FAIL | " + gCurrentURL +
                          " | This test left crash dumps behind, but we weren't expecting it to!\n");
diff --git a/layout/tools/reftest/runreftestb2g.py b/layout/tools/reftest/runreftestb2g.py
index 616d73edfad8..28a6a9134c23 100644
--- a/layout/tools/reftest/runreftestb2g.py
+++ b/layout/tools/reftest/runreftestb2g.py
@@ -368,7 +368,7 @@ class B2GReftest(RefTest):
 user_pref("browser.firstrun.show.localepicker", false);
 user_pref("browser.homescreenURL","app://system.gaiamobile.org");\n
 user_pref("browser.manifestURL","app://system.gaiamobile.org/manifest.webapp");\n
-user_pref("browser.tabs.remote", true);\n
+user_pref("browser.tabs.remote", false);\n
 user_pref("dom.ipc.browser_frames.oop_by_default", true);\n
 user_pref("dom.ipc.tabs.disabled", false);\n
 user_pref("dom.mozBrowserFramesEnabled", true);\n
diff --git a/mobile/android/base/AboutHomeContent.java b/mobile/android/base/AboutHomeContent.java
index 8d2e3e51b6a4..32286ecc8243 100644
--- a/mobile/android/base/AboutHomeContent.java
+++ b/mobile/android/base/AboutHomeContent.java
@@ -52,6 +52,7 @@ import java.net.URL;
 import java.util.ArrayList;
 import java.util.EnumSet;
 import java.util.List;
+import java.util.Random;
 import java.util.zip.ZipEntry;
 import java.util.zip.ZipFile;
 
@@ -86,6 +87,7 @@ public class AboutHomeContent extends ScrollView
     protected GridView mTopSitesGrid;
 
     private AboutHomePromoBox mPromoBox;
+    private AboutHomePromoBox.Type mPrelimPromoBoxType;
     protected AboutHomeSection mAddons;
     protected AboutHomeSection mLastTabs;
     protected AboutHomeSection mRemoteTabs;
@@ -137,6 +139,9 @@ public class AboutHomeContent extends ScrollView
                 GeckoAppShell.sendEventToGecko(GeckoEvent.createBroadcastEvent("Tab:Add", args.toString()));
             }
         };
+
+        mPrelimPromoBoxType = (new Random()).nextFloat() < 0.5 ? AboutHomePromoBox.Type.SYNC :
+                AboutHomePromoBox.Type.APPS;
     }
 
     private void inflate() {
@@ -201,15 +206,12 @@ public class AboutHomeContent extends ScrollView
             mLastTabs.hide();
     }
 
-    private void setTopSitesVisibility(boolean visible, boolean hasTopSites) {
-        int visibility = visible ? View.VISIBLE : View.GONE;
-        int visibilityWithTopSites = visible && hasTopSites ? View.VISIBLE : View.GONE;
-        int visibilityWithoutTopSites = visible && !hasTopSites ? View.VISIBLE : View.GONE;
+    private void setTopSitesVisibility(boolean hasTopSites) {
+        int visibility = hasTopSites ? View.VISIBLE : View.GONE;
 
-        findViewById(R.id.top_sites_grid).setVisibility(visibilityWithTopSites);
         findViewById(R.id.top_sites_title).setVisibility(visibility);
-        findViewById(R.id.all_top_sites_text).setVisibility(visibilityWithTopSites);
-        findViewById(R.id.no_top_sites_text).setVisibility(visibilityWithoutTopSites);
+        findViewById(R.id.top_sites_grid).setVisibility(visibility);
+        findViewById(R.id.all_top_sites_text).setVisibility(visibility);
     }
 
     private void setPromoBoxVisibility(boolean visible, AboutHomePromoBox.Type type) {
@@ -219,16 +221,14 @@ public class AboutHomeContent extends ScrollView
             mPromoBox.hide();
     }
 
-    private void updateLayout(GeckoApp.StartupMode startupMode, boolean syncIsSetup) {
-        // The idea here is that we only show the sync invitation
-        // on the very first run. Show sync banner below the top
-        // sites section in all other cases.
-
+    private void updateLayout(boolean syncIsSetup) {
         boolean hasTopSites = mTopSitesAdapter.getCount() > 0;
-        boolean isFirstRun = (startupMode == GeckoApp.StartupMode.NEW_PROFILE);
 
-        setTopSitesVisibility(!isFirstRun || hasTopSites, hasTopSites);
-        setPromoBoxVisibility(!syncIsSetup, AboutHomePromoBox.Type.SYNC);
+        setTopSitesVisibility(hasTopSites);
+        if (!syncIsSetup && mPrelimPromoBoxType == AboutHomePromoBox.Type.SYNC)
+            setPromoBoxVisibility(true, AboutHomePromoBox.Type.SYNC);
+        else
+            setPromoBoxVisibility(true, AboutHomePromoBox.Type.APPS);
     }
 
     private void updateLayoutForSync() {
@@ -241,17 +241,12 @@ public class AboutHomeContent extends ScrollView
                 // In this case, we should simply wait for the initial setup
                 // to happen.
                 if (mTopSitesAdapter != null)
-                    updateLayout(startupMode, syncIsSetup);
+                    updateLayout(syncIsSetup);
             }
         });
     }
 
     private void loadTopSites() {
-        // Ensure we initialize GeckoApp's startup mode in
-        // background thread before we use it when updating
-        // the top sites section layout in main thread.
-        final GeckoApp.StartupMode startupMode = mActivity.getStartupMode();
-
         // The SyncAccounts.syncAccountsExist method should not be called on
         // UI thread as it touches disk to access a sqlite DB.
         final boolean syncIsSetup = SyncAccounts.syncAccountsExist(mActivity);
@@ -277,7 +272,7 @@ public class AboutHomeContent extends ScrollView
                     mTopSitesAdapter.changeCursor(mCursor);
                 }
 
-                updateLayout(startupMode, syncIsSetup);
+                updateLayout(syncIsSetup);
 
                 // Free the old Cursor in the right thread now.
                 if (oldCursor != null && !oldCursor.isClosed())
diff --git a/mobile/android/base/AboutHomePromoBox.java b/mobile/android/base/AboutHomePromoBox.java
index 6e50f087ac88..2347339e9fa1 100644
--- a/mobile/android/base/AboutHomePromoBox.java
+++ b/mobile/android/base/AboutHomePromoBox.java
@@ -6,8 +6,11 @@ package org.mozilla.gecko;
 
 import org.mozilla.gecko.sync.setup.activities.SetupSyncActivity;
 
+import org.json.JSONObject;
+
 import android.content.Context;
 import android.content.Intent;
+import android.os.SystemClock;
 import android.text.SpannableString;
 import android.text.style.StyleSpan;
 import android.util.AttributeSet;
@@ -27,7 +30,7 @@ import android.widget.TextView;
 public class AboutHomePromoBox extends LinearLayout implements View.OnClickListener {
     private static final String LOGTAG = "AboutHomePromoBox";
 
-    public enum Type { SYNC };
+    public enum Type { SYNC, APPS };
 
     private Type mType;
 
@@ -61,6 +64,20 @@ public class AboutHomePromoBox extends LinearLayout implements View.OnClickListe
                 context.startActivity(intent);
                 break;
 
+            case APPS:
+                final String url = "https://marketplace.mozilla.org";
+                final JSONObject args = new JSONObject();
+                try {
+                    args.put("url", url);
+                    args.put("engine", null);
+                    args.put("userEntered", false);
+                } catch (Exception e) {
+                    Log.e(LOGTAG, "error building JSON arguments");
+                }
+                Log.d(LOGTAG, "Sending message to Gecko: " + SystemClock.uptimeMillis() + " - Tab:Add");
+                GeckoAppShell.sendEventToGecko(GeckoEvent.createBroadcastEvent("Tab:Add", args.toString()));
+                break;
+
             default:
                 Log.e(LOGTAG, "Invalid type was set when promo box was clicked.");
                 break;
@@ -78,8 +95,12 @@ public class AboutHomePromoBox extends LinearLayout implements View.OnClickListe
                 setSyncResources();
                 break;
 
+            case APPS:
+                setAppsResources();
+                break;
+
             default:
-                Log.e(LOGTAG, "Invalid PromoBoxType specified.");
+                Log.e(LOGTAG, "show() - Invalid AboutHomePromoBox.Type specified.");
                 break;
         }
         updateViewResources();
@@ -103,8 +124,7 @@ public class AboutHomePromoBox extends LinearLayout implements View.OnClickListe
     }
 
     private void updateTextViewResources() {
-        final String promoText = mContext.getResources().getString(mTextResource) + " \u00BB";
-
+        final String promoText = mContext.getResources().getString(mTextResource);
         final String boldName = mContext.getResources().getString(mBoldTextResource);
         final int styleIndex = promoText.indexOf(boldName);
         if (styleIndex < 0)
@@ -120,6 +140,12 @@ public class AboutHomePromoBox extends LinearLayout implements View.OnClickListe
     // Type.SYNC: Setup Firefox sync.
     private void setSyncResources() {
         setResources(R.string.abouthome_about_sync, R.string.abouthome_sync_bold_name,
-                R.drawable.abouthome_sync_logo);
+                R.drawable.abouthome_promo_logo_sync);
+    }
+
+    // Types.APPS: Visit the Marketplace.
+    private void setAppsResources() {
+        setResources(R.string.abouthome_about_apps, R.string.abouthome_apps_bold_name,
+                R.drawable.abouthome_promo_logo_apps);
     }
 }
diff --git a/mobile/android/base/AndroidManifest.xml.in b/mobile/android/base/AndroidManifest.xml.in
index de4717212ac9..dd2e0a843b8e 100644
--- a/mobile/android/base/AndroidManifest.xml.in
+++ b/mobile/android/base/AndroidManifest.xml.in
@@ -67,6 +67,10 @@
                 <action android:name="android.intent.action.MAIN" />
                 <category android:name="android.intent.category.LAUNCHER" />
             </intent-filter>
+            <intent-filter>
+                <action android:name="org.mozilla.gecko.ACTION_ALERT_CALLBACK" />
+            </intent-filter>
+
             <intent-filter>
                 <action android:name="org.mozilla.gecko.UPDATE"/>
                 <category android:name="android.intent.category.DEFAULT" />
@@ -93,6 +97,7 @@
                 <data android:mimeType="text/plain"/>
                 <data android:mimeType="application/xhtml+xml"/>
             </intent-filter>
+
             <intent-filter>
                 <action android:name="android.intent.action.WEB_SEARCH" />
                 <category android:name="android.intent.category.DEFAULT" />
@@ -111,6 +116,25 @@
 
 #include @OBJDIR@/WebAppManifestFragment.xml.in
 
+        <activity android:name=".MarketplaceApp"
+                  android:label="Mozilla Marketplace"
+                  android:configChanges="keyboard|keyboardHidden|mcc|mnc|orientation|screenSize"
+                  android:windowSoftInputMode="stateUnspecified|adjustResize"
+                  android:icon="@drawable/marketplace"
+                  android:launchMode="singleTask"
+                  android:theme="@style/Gecko.NoActionBar"
+                  android:noHistory="true">
+
+            <intent-filter>
+                <action android:name="android.intent.action.VIEW" />
+                <category android:name="android.intent.category.DEFAULT" />
+                <category android:name="android.intent.category.BROWSABLE" />
+                <data android:scheme="http" android:host="marketplace.mozilla.org"/>
+                <data android:scheme="https" android:host="marketplace.mozilla.org"/>
+            </intent-filter>
+
+        </activity>
+
         <!-- Masquerade as the Resolver so that we can be opened from the Marketplace. -->
         <activity-alias
             android:name="com.android.internal.app.ResolverActivity"
diff --git a/mobile/android/base/GeckoApp.java b/mobile/android/base/GeckoApp.java
index 63b133f30593..67b66debbdb7 100644
--- a/mobile/android/base/GeckoApp.java
+++ b/mobile/android/base/GeckoApp.java
@@ -122,6 +122,7 @@ abstract public class GeckoApp
 
     public static final String ACTION_ALERT_CLICK   = "org.mozilla.gecko.ACTION_ALERT_CLICK";
     public static final String ACTION_ALERT_CLEAR   = "org.mozilla.gecko.ACTION_ALERT_CLEAR";
+    public static final String ACTION_ALERT_CALLBACK = "org.mozilla.gecko.ACTION_ALERT_CALLBACK";
     public static final String ACTION_WEBAPP_PREFIX = "org.mozilla.gecko.WEBAPP";
     public static final String ACTION_DEBUG         = "org.mozilla.gecko.DEBUG";
     public static final String ACTION_BOOKMARK      = "org.mozilla.gecko.BOOKMARK";
@@ -171,7 +172,7 @@ abstract public class GeckoApp
     private HashMap<String, PowerManager.WakeLock> mWakeLocks = new HashMap<String, PowerManager.WakeLock>();
 
     protected int mRestoreMode = GeckoAppShell.RESTORE_NONE;
-    private boolean mInitialized = false;
+    protected boolean mInitialized = false;
 
     public enum LaunchState {Launching, WaitForDebugger,
                              Launched, GeckoRunning, GeckoExiting};
@@ -1915,13 +1916,27 @@ abstract public class GeckoApp
             GeckoAppShell.sendEventToGecko(GeckoEvent.createBookmarkLoadEvent(uri));
             Log.i(LOGTAG,"Intent : BOOKMARK - " + uri);
         }
+        else if (ACTION_ALERT_CALLBACK.equals(action)) {
+            String alertName = "";
+            String alertCookie = "";
+            Uri data = intent.getData();
+            if (data != null) {
+                alertName = data.getQueryParameter("name");
+                if (alertName == null)
+                    alertName = "";
+                alertCookie = data.getQueryParameter("cookie");
+                if (alertCookie == null)
+                    alertCookie = "";
+            }
+            handleNotification(ACTION_ALERT_CALLBACK, alertName, alertCookie);
+        }
     }
 
     /*
      * Handles getting a uri from and intent in a way that is backwards
      * compatable with our previous implementations
      */
-    private String getURIFromIntent(Intent intent) {
+    protected String getURIFromIntent(Intent intent) {
         String uri = intent.getDataString();
         if (uri != null)
             return uri;
@@ -2252,7 +2267,7 @@ abstract public class GeckoApp
             GeckoAppShell.killAnyZombies();
             startActivity(intent);
         } catch (Exception e) {
-            Log.i(LOGTAG, "error doing restart", e);
+            Log.e(LOGTAG, "error doing restart", e);
         }
         finish();
         // Give the restart process time to start before we die
diff --git a/mobile/android/base/GeckoAppShell.java b/mobile/android/base/GeckoAppShell.java
index e09589ca412e..c5ac19b5df6e 100644
--- a/mobile/android/base/GeckoAppShell.java
+++ b/mobile/android/base/GeckoAppShell.java
@@ -131,6 +131,8 @@ public class GeckoAppShell
     public static final String SHORTCUT_TYPE_WEBAPP = "webapp";
     public static final String SHORTCUT_TYPE_BOOKMARK = "bookmark";
 
+    static private final boolean LOGGING = false;
+
     static public final int RESTORE_NONE = 0;
     static public final int RESTORE_OOM = 1;
     static public final int RESTORE_CRASH = 2;
@@ -817,10 +819,14 @@ public class GeckoAppShell
         if (index == -1)
             return null;
 
+        return getWebAppIntent(index, aURI);
+    }
+
+    public static Intent getWebAppIntent(int aIndex, String aURI) {
         Intent intent = new Intent();
-        intent.setAction(GeckoApp.ACTION_WEBAPP_PREFIX + index);
+        intent.setAction(GeckoApp.ACTION_WEBAPP_PREFIX + aIndex);
         intent.setData(Uri.parse(aURI));
-        intent.setClassName(GeckoApp.mAppContext, GeckoApp.mAppContext.getPackageName() + ".WebApps$WebApp" + index);
+        intent.setClassName(GeckoApp.mAppContext, GeckoApp.mAppContext.getPackageName() + ".WebApps$WebApp" + aIndex);
         return intent;
     }
 
@@ -1328,8 +1334,15 @@ public class GeckoAppShell
         notificationIntent.setClassName(GeckoApp.mAppContext,
             GeckoApp.mAppContext.getPackageName() + ".NotificationHandler");
 
-        // Put the strings into the intent as an URI "alert:<name>#<cookie>"
-        Uri dataUri = Uri.fromParts("alert", aAlertName, aAlertCookie);
+        // Put the strings into the intent as an URI "alert:?name=<alertName>&app=<appName>&cookie=<cookie>"
+        Uri.Builder b = new Uri.Builder();
+        String app = GeckoApp.mAppContext.getClass().getName();
+        Uri dataUri = b.scheme("alert")
+                                 .path(Integer.toString(notificationID))
+                                 .appendQueryParameter("name", aAlertName)
+                                 .appendQueryParameter("app", app)
+                                 .appendQueryParameter("cookie", aAlertCookie)
+                                 .build();
         notificationIntent.setData(dataUri);
 
         PendingIntent contentIntent = PendingIntent.getBroadcast(GeckoApp.mAppContext, 0, notificationIntent, 0);
@@ -1376,10 +1389,11 @@ public class GeckoAppShell
     }
 
     public static void handleNotification(String aAction, String aAlertName, String aAlertCookie) {
+        if (LOGGING) Log.i(LOGTAG, "handleNotification " + aAction + " " + aAlertName + " " + aAlertCookie);
         int notificationID = aAlertName.hashCode();
 
-        if (GeckoApp.ACTION_ALERT_CLICK.equals(aAction)) {
-            Log.i(LOGTAG, "GeckoAppShell.handleNotification: callObserver(alertclickcallback)");
+        if (GeckoApp.ACTION_ALERT_CALLBACK.equals(aAction)) {
+            if (LOGGING) Log.i(LOGTAG, "GeckoAppShell.handleNotification: callObserver(alertclickcallback)");
             callObserver(aAlertName, "alertclickcallback", aAlertCookie);
 
             AlertNotification notification = mAlertNotifications.get(notificationID);
@@ -1390,7 +1404,11 @@ public class GeckoAppShell
         }
 
         callObserver(aAlertName, "alertfinished", aAlertCookie);
-
+        // Also send a notification to the observer service
+        // New listeners should register for these notifications since they will be called even if
+        // Gecko has been killed and restared between when your notification was shown and when the
+        // user clicked on it.
+        sendEventToGecko(GeckoEvent.createBroadcastEvent("Notification:Clicked", aAlertCookie));
         removeObserver(aAlertName);
 
         removeNotification(notificationID);
diff --git a/mobile/android/base/Makefile.in b/mobile/android/base/Makefile.in
index d855d6336891..70231da326de 100644
--- a/mobile/android/base/Makefile.in
+++ b/mobile/android/base/Makefile.in
@@ -169,6 +169,7 @@ endif
 
 FENNEC_PP_JAVA_FILES = \
   App.java \
+  MarketplaceApp.java \
   WebApp.java \
   WebApps.java \
   GeckoActivity.java \
@@ -423,8 +424,9 @@ RES_DRAWABLE_BASE = \
   res/drawable/abouthome_icon.png \
   res/drawable/abouthome_logo.png \
   res/drawable/abouthome_promo_box_bg.9.png \
-  res/drawable/abouthome_sync_logo.png \
   res/drawable/abouthome_promo_box_pressed_bg.9.png \
+  res/drawable/abouthome_promo_logo_apps.png \
+  res/drawable/abouthome_promo_logo_sync.png \
   res/drawable/abouthome_thumbnail.png \
   res/drawable/address_bar_bg_shadow.png \
   res/drawable/alert_addon.png \
@@ -507,8 +509,9 @@ RES_DRAWABLE_HDPI = \
   res/drawable-hdpi/abouthome_icon.png \
   res/drawable-hdpi/abouthome_logo.png \
   res/drawable-hdpi/abouthome_promo_box_bg.9.png \
-  res/drawable-hdpi/abouthome_sync_logo.png \
   res/drawable-hdpi/abouthome_promo_box_pressed_bg.9.png \
+  res/drawable-hdpi/abouthome_promo_logo_apps.png \
+  res/drawable-hdpi/abouthome_promo_logo_sync.png \
   res/drawable-hdpi/abouthome_thumbnail.png \
   res/drawable-hdpi/address_bar_bg_shadow.png \
   res/drawable-hdpi/alert_addon.png \
@@ -573,8 +576,9 @@ RES_DRAWABLE_XHDPI = \
   res/drawable-xhdpi/abouthome_icon.png \
   res/drawable-xhdpi/abouthome_logo.png \
   res/drawable-xhdpi/abouthome_promo_box_bg.9.png \
-  res/drawable-xhdpi/abouthome_sync_logo.png \
   res/drawable-xhdpi/abouthome_promo_box_pressed_bg.9.png \
+  res/drawable-xhdpi/abouthome_promo_logo_apps.png \
+  res/drawable-xhdpi/abouthome_promo_logo_sync.png \
   res/drawable-xhdpi/abouthome_thumbnail.png \
   res/drawable-xhdpi/address_bar_bg_curve.png \
   res/drawable-xhdpi/address_bar_bg_shadow.png \
@@ -1001,6 +1005,7 @@ MOZ_ANDROID_DRAWABLES += \
   mobile/android/base/resources/drawable/tabs_tray_list_divider.xml             \
   mobile/android/base/resources/drawable/tabs_shadow.xml                        \
   mobile/android/base/resources/drawable/shadow.png                             \
+  mobile/android/base/resources/drawable/marketplace.png                        \
   $(NULL)
 
 MOZ_ANDROID_DRAWABLES += $(shell if test -e $(topsrcdir)/$(MOZ_BRANDING_DIRECTORY)/android-resources.mn; then cat $(topsrcdir)/$(MOZ_BRANDING_DIRECTORY)/android-resources.mn | tr '\n' ' ';  fi)
diff --git a/mobile/android/base/MarketplaceApp.java.in b/mobile/android/base/MarketplaceApp.java.in
new file mode 100644
index 000000000000..4578025e0a6f
--- /dev/null
+++ b/mobile/android/base/MarketplaceApp.java.in
@@ -0,0 +1,114 @@
+/* -*- Mode: Java; c-basic-offset: 4; tab-width: 20; indent-tabs-mode: nil; -*-
+ * This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+#filter substitution
+package @ANDROID_PACKAGE_NAME@;
+
+import android.content.Intent;
+import android.net.Uri;
+import android.os.Bundle;
+import android.os.SystemClock;
+import android.util.Log;
+import android.view.MenuItem;
+
+import org.json.JSONObject;
+
+import org.mozilla.gecko.GeckoApp;
+import org.mozilla.gecko.GeckoAppShell;
+import org.mozilla.gecko.GeckoEvent;
+import org.mozilla.gecko.WebAppAllocator;
+
+/*
+* This is a stub activity, meant to just install the marketplace WebApp
+* and then launch it
+*/
+public class MarketplaceApp extends WebApp {
+    protected int mWebAppIndex;
+    private static final String LOGTAG = "GeckoMarketplaceApp";
+    public static final String MARKETPLACE_HOST = "marketplace.mozilla.org";
+    public static final String MARKETPLACE_URI = "https://marketplace.mozilla.org";
+
+    @Override
+    public void onCreate(Bundle savedInstanceState)
+    {
+        super.onCreate(savedInstanceState);
+
+        // Check that the uri being requested is a marketplace uri
+        String passedUri = null;
+        String uri = getURIFromIntent(getIntent());
+        if (uri != null && uri.length() > 0) {
+            passedUri = uri;
+        }
+
+        if (passedUri != null)
+            handleMarketplaceLink(passedUri);
+    }
+
+    // Use the default profile in order to ensure this is installed in the Fennec
+    // webapp registry. The marketplace WEBapp will have its own profile
+    @Override
+    protected String getDefaultProfileName() {
+        return "default";
+    }
+
+    @Override
+    protected void onNewIntent(Intent intent) {
+        Log.w(LOGTAG, "zerdatime " + SystemClock.uptimeMillis() + " - onNewIntent");
+
+        if (checkLaunchState(LaunchState.GeckoExiting)) {
+            // We're exiting and shouldn't try to do anything else just incase
+            // we're hung for some reason we'll force the process to exit
+            System.exit(0);
+            return;
+        }
+
+        // if we were previously OOM killed, we can end up here when launching
+        // from external shortcuts, so set this as the intent for initialization
+        if (!mInitialized) {
+            setIntent(intent);
+            return;
+        }
+
+        final String action = intent.getAction();
+        if (Intent.ACTION_VIEW.equals(action)) {
+            String uri = intent.getDataString();
+            if (Uri.parse(uri).getHost().equals(MARKETPLACE_HOST)) {
+                handleMarketplaceLink(uri);
+                return;
+            }
+            GeckoAppShell.sendEventToGecko(GeckoEvent.createURILoadEvent(uri));
+            Log.i(LOGTAG,"onNewIntent: " + uri);
+        }
+    }
+
+    // All marketplace links from the system will come to the receiver first. It will determine if the
+    // marketplace app is installed. If the marketplace is not installed it will install it and send the link
+    // to the marketplace app
+    private void handleMarketplaceLink(final String url) {
+        // see if the marketplace app is registered, if its not, install it
+        int index = WebAppAllocator.getInstance(this).getIndexForApp(MARKETPLACE_URI);
+        if (index < 0) {
+            // If the app isn't installed, we send gecko a message to install it and then launch it with this url
+            JSONObject args = new JSONObject();
+            try {
+                args.put("url", url);
+            } catch (Exception e) {
+                Log.e(LOGTAG, "error building JSON arguments");
+            }
+
+            GeckoAppShell.sendEventToGecko(GeckoEvent.createBroadcastEvent("WebApps:InstallMarketplace", args.toString()));
+        } else {
+            // otherwise just launch the webapp with this url
+            Intent webappIntent = GeckoAppShell.getWebAppIntent(index, url);
+            if (webappIntent == null) {
+                Log.i(LOGTAG, "bounce launch");
+                return;
+            }
+            Log.i(LOGTAG, "Open " + url + " in marketplace app");
+            startActivity(webappIntent);
+        }
+    }
+};
+
diff --git a/mobile/android/base/NotificationHandler.java.in b/mobile/android/base/NotificationHandler.java.in
index 44f9fe693b8c..cfe06961913e 100644
--- a/mobile/android/base/NotificationHandler.java.in
+++ b/mobile/android/base/NotificationHandler.java.in
@@ -6,14 +6,22 @@
 #filter substitution
 package @ANDROID_PACKAGE_NAME@;
 
+import android.app.ActivityManager;
+import android.app.ActivityManager.RunningAppProcessInfo;
 import android.app.NotificationManager;
 import android.content.ActivityNotFoundException;
 import android.content.BroadcastReceiver;
 import android.content.Context;
 import android.content.Intent;
 import android.net.Uri;
+import android.os.Process;
+import android.text.TextUtils;
 import android.util.Log;
 
+import java.util.List;
+
+import org.mozilla.gecko.GeckoAppShell;
+
 public class NotificationHandler extends BroadcastReceiver {
     private static final String LOGTAG = "GeckoNotificationHandler";
 
@@ -24,50 +32,38 @@ public class NotificationHandler extends BroadcastReceiver {
     }
 
     protected void handleIntent(Context context, Intent notificationIntent) {
-        String action = notificationIntent.getAction();
-        String alertName = "";
-        String alertCookie = "";
+        String appName = "";
         Uri data = notificationIntent.getData();
         if (data != null) {
-            alertName = data.getSchemeSpecificPart();
-            alertCookie = data.getFragment();
-            if (alertCookie == null)
-                alertCookie = "";
+            appName = data.getQueryParameter("app");
+            if (appName == null)
+              appName = "@ANDROID_PACKAGE_NAME@.App";
         }
 
-        Log.i(LOGTAG, "NotificationHandler.handleIntent\n" +
-              "- action = '" + action + "'\n" +
-              "- alertName = '" + alertName + "'\n" +
-              "- alertCookie = '" + alertCookie + "'");
+        sendIntent(context, App.ACTION_ALERT_CALLBACK,
+                            appName,
+                            data);
+    }
 
-        int notificationID = alertName.hashCode();
+    private void sendIntent(Context context, String action, String className, Uri data) {
+        Intent appIntent = new Intent(action);
 
-        Log.i(LOGTAG, "Handle notification ID " + notificationID);
+        if (TextUtils.isEmpty(className))
+          appIntent.setClassName(context, "@ANDROID_PACKAGE_NAME@.App");
+        else
+          appIntent.setClassName(context, className);
 
-        if (App.ACTION_ALERT_CLICK.equals(action)) {
-            // Start or bring to front the main activity
-            Intent appIntent = new Intent(Intent.ACTION_MAIN);
-            appIntent.setClassName(context, "@ANDROID_PACKAGE_NAME@.App");
-            appIntent.setFlags(Intent.FLAG_ACTIVITY_NEW_TASK);
-            appIntent.putExtra("args", "-alert " + alertName + (alertCookie.length() > 0 ? "#" + alertCookie : ""));
-            try {
-                Log.i(LOGTAG, "startActivity with intent: Action='" + appIntent.getAction() + "'" +
-                      ", args='" + appIntent.getStringExtra("args") + "'" );
-                context.startActivity(appIntent);
-            } catch (ActivityNotFoundException e) {
-                Log.e(LOGTAG, "NotificationHandler Exception: ", e);
-            }
-        }
+        appIntent.setFlags(Intent.FLAG_ACTIVITY_NEW_TASK);
 
-        // Call observers after we open the app in order to avoid race conditions with
-        // notification handlers that launch third party apps or webapps
-        if (App.mAppContext != null) {
-            // This should call the observer, if any
-            App.mAppContext.handleNotification(action, alertName, alertCookie);
-        } else {
-            // The app is not running, just cancel this notification
-            NotificationManager notificationManager = (NotificationManager) context.getSystemService(Context.NOTIFICATION_SERVICE);
-            notificationManager.cancel(notificationID);
+        if (data != null)
+            appIntent.setData(data);
+
+        try {
+            Log.i(LOGTAG, "startActivity with intent: Action='" + appIntent.getAction() +
+                          " appName='" + className + "'");
+            context.startActivity(appIntent);
+        } catch (ActivityNotFoundException e) {
+            Log.e(LOGTAG, "NotificationHandler Exception: ", e);
         }
     }
 }
diff --git a/mobile/android/base/WebAppAllocator.java b/mobile/android/base/WebAppAllocator.java
index a4fa90261cb0..b5bf5313b1db 100644
--- a/mobile/android/base/WebAppAllocator.java
+++ b/mobile/android/base/WebAppAllocator.java
@@ -22,13 +22,18 @@ public class WebAppAllocator {
         if (sInstance == null) {
             if (!(cx instanceof GeckoApp))
                 throw new RuntimeException("Context needs to be a GeckoApp");
-                
+
             sContext = (GeckoApp) cx;
             sInstance = new WebAppAllocator(cx);
         }
 
-        if (cx != sContext)
-            throw new RuntimeException("Tried to get WebAppAllocator instance for different context than it was created for");
+        // The marketplaceApp will run in this same process, but has a different context
+        // Rather than just failing, we want to create a new Allocator instead
+        if (cx != sContext) {
+            sInstance = null;
+            sContext = (GeckoApp) cx;
+            sInstance = new WebAppAllocator(cx);
+        }
 
         return sInstance;
     }
diff --git a/mobile/android/base/WebAppManifestFragment.xml.frag b/mobile/android/base/WebAppManifestFragment.xml.frag
index 71221b02214b..eee83dcc4f6d 100644
--- a/mobile/android/base/WebAppManifestFragment.xml.frag
+++ b/mobile/android/base/WebAppManifestFragment.xml.frag
@@ -8,5 +8,8 @@
             <intent-filter>
                 <action android:name="org.mozilla.gecko.WEBAPP@APPNUM@" />
             </intent-filter>
+            <intent-filter>
+                <action android:name="org.mozilla.gecko.ACTION_ALERT_CALLBACK" />
+            </intent-filter>
         </activity>
 
diff --git a/mobile/android/base/locales/en-US/android_strings.dtd b/mobile/android/base/locales/en-US/android_strings.dtd
index 66e8b1b1c59e..445a107153fb 100644
--- a/mobile/android/base/locales/en-US/android_strings.dtd
+++ b/mobile/android/base/locales/en-US/android_strings.dtd
@@ -177,9 +177,19 @@ size. -->
 <!ENTITY abouthome_last_tabs_open "Open all tabs from last time">
 <!ENTITY abouthome_top_sites_title "Top sites">
 <!ENTITY abouthome_top_sites_browse "Browse all your top sites">
-<!ENTITY abouthome_no_top_sites "You do not have any top sites yet. Tap the Title Bar to start browsing.">
-<!ENTITY abouthome_about_sync "Set up Firefox Sync to access bookmarks, history and tabs from your other devices">
+<!-- Localization note (abouthome_about_sync2, abouthome_about_apps): The
+     chevron (ex: "»"; unicode= U+00BB) is used as an arrow to show that
+     clicking this text in the promotions box will perform some action. Note
+     that a non-breaking space (unicode= U+00A0) should be used between this
+     character and the remainder of the string to prevent word wrap. -->
+<!ENTITY abouthome_about_sync2 "Set up Firefox Sync to access bookmarks, history and tabs from your other devices »">
+<!ENTITY abouthome_about_apps "Get apps from the Mozilla Marketplace and discover the best the Web has to offer »">
+<!-- Localization note (abouthome_sync_bold_name, abouthome_apps_bold_name):
+     These strings are accentuated as bold text in the "abouthome_about_..."
+     strings above. These strings should be a subset of the strings above and
+     generally be the name of the product the string describes. -->
 <!ENTITY abouthome_sync_bold_name "Firefox Sync">
+<!ENTITY abouthome_apps_bold_name "Mozilla Marketplace">
 
 <!ENTITY filepicker_title "Choose File">
 <!ENTITY filepicker_audio_title "Choose or record a sound">
diff --git a/mobile/android/base/resources/drawable-hdpi/abouthome_promo_logo_apps.png b/mobile/android/base/resources/drawable-hdpi/abouthome_promo_logo_apps.png
new file mode 100644
index 000000000000..ad52006d223a
Binary files /dev/null and b/mobile/android/base/resources/drawable-hdpi/abouthome_promo_logo_apps.png differ
diff --git a/mobile/android/base/resources/drawable-hdpi/abouthome_sync_logo.png b/mobile/android/base/resources/drawable-hdpi/abouthome_promo_logo_sync.png
similarity index 100%
rename from mobile/android/base/resources/drawable-hdpi/abouthome_sync_logo.png
rename to mobile/android/base/resources/drawable-hdpi/abouthome_promo_logo_sync.png
diff --git a/mobile/android/base/resources/drawable-xhdpi/abouthome_promo_logo_apps.png b/mobile/android/base/resources/drawable-xhdpi/abouthome_promo_logo_apps.png
new file mode 100644
index 000000000000..7edf146defb8
Binary files /dev/null and b/mobile/android/base/resources/drawable-xhdpi/abouthome_promo_logo_apps.png differ
diff --git a/mobile/android/base/resources/drawable-xhdpi/abouthome_sync_logo.png b/mobile/android/base/resources/drawable-xhdpi/abouthome_promo_logo_sync.png
similarity index 100%
rename from mobile/android/base/resources/drawable-xhdpi/abouthome_sync_logo.png
rename to mobile/android/base/resources/drawable-xhdpi/abouthome_promo_logo_sync.png
diff --git a/mobile/android/base/resources/drawable/abouthome_promo_logo_apps.png b/mobile/android/base/resources/drawable/abouthome_promo_logo_apps.png
new file mode 100644
index 000000000000..8db8846a255e
Binary files /dev/null and b/mobile/android/base/resources/drawable/abouthome_promo_logo_apps.png differ
diff --git a/mobile/android/base/resources/drawable/abouthome_sync_logo.png b/mobile/android/base/resources/drawable/abouthome_promo_logo_sync.png
similarity index 100%
rename from mobile/android/base/resources/drawable/abouthome_sync_logo.png
rename to mobile/android/base/resources/drawable/abouthome_promo_logo_sync.png
diff --git a/mobile/android/base/resources/drawable/marketplace.png b/mobile/android/base/resources/drawable/marketplace.png
new file mode 100644
index 000000000000..a30095135d4d
Binary files /dev/null and b/mobile/android/base/resources/drawable/marketplace.png differ
diff --git a/mobile/android/base/resources/layout-xlarge-land-v11/abouthome_content.xml.in b/mobile/android/base/resources/layout-xlarge-land-v11/abouthome_content.xml.in
index 7b68e363b657..3aae76c403bb 100644
--- a/mobile/android/base/resources/layout-xlarge-land-v11/abouthome_content.xml.in
+++ b/mobile/android/base/resources/layout-xlarge-land-v11/abouthome_content.xml.in
@@ -36,19 +36,6 @@
                       android:textStyle="bold"
                       android:gravity="left|center_vertical"/>
 
-            <TextView android:id="@+id/no_top_sites_text"
-                      android:text="@string/abouthome_no_top_sites"
-                      android:layout_width="fill_parent"
-                      android:layout_height="wrap_content"
-                      android:paddingTop="47dp"
-                      android:paddingBottom="47dp"
-                      android:paddingLeft="60dp"
-                      android:paddingRight="60dp"
-                      android:gravity="center"
-                      android:textSize="12sp"
-                      android:textColor="#666666"
-                      android:visibility="gone"/>
-
             <view class="org.mozilla.gecko.AboutHomeContent$TopSitesGridView"
                   android:id="@+id/top_sites_grid"
                   android:layout_width="fill_parent"
diff --git a/mobile/android/base/resources/layout/abouthome_content.xml.in b/mobile/android/base/resources/layout/abouthome_content.xml.in
index b44d64a2c230..e6535371fbe4 100644
--- a/mobile/android/base/resources/layout/abouthome_content.xml.in
+++ b/mobile/android/base/resources/layout/abouthome_content.xml.in
@@ -47,19 +47,6 @@
                       android:layout_height="fill_parent"
                       android:layout_below="@id/top_sites_title">
 
-            <TextView android:id="@+id/no_top_sites_text"
-                      android:text="@string/abouthome_no_top_sites"
-                      android:layout_width="fill_parent"
-                      android:layout_height="wrap_content"
-                      android:paddingTop="47dp"
-                      android:paddingBottom="47dp"
-                      android:paddingLeft="60dp"
-                      android:paddingRight="60dp"
-                      android:gravity="center"
-                      android:textSize="12sp"
-                      android:textColor="#666666"
-                      android:visibility="gone"/>
-
             <view class="org.mozilla.gecko.AboutHomeContent$TopSitesGridView"
                   android:id="@+id/top_sites_grid"
                   android:layout_width="fill_parent"
diff --git a/mobile/android/base/strings.xml.in b/mobile/android/base/strings.xml.in
index d159998b220b..005ff84347bf 100644
--- a/mobile/android/base/strings.xml.in
+++ b/mobile/android/base/strings.xml.in
@@ -170,9 +170,10 @@
   <string name="abouthome_last_tabs_open">&abouthome_last_tabs_open;</string>
   <string name="abouthome_top_sites_title">&abouthome_top_sites_title;</string>
   <string name="abouthome_top_sites_browse">&abouthome_top_sites_browse;</string>
-  <string name="abouthome_no_top_sites">&abouthome_no_top_sites;</string>
-  <string name="abouthome_about_sync">&abouthome_about_sync;</string>
+  <string name="abouthome_about_sync">&abouthome_about_sync2;</string>
+  <string name="abouthome_about_apps">&abouthome_about_apps;</string>
   <string name="abouthome_sync_bold_name">&abouthome_sync_bold_name;</string>
+  <string name="abouthome_apps_bold_name">&abouthome_apps_bold_name;</string>
 
   <string name="filepicker_title">&filepicker_title;</string>
   <string name="filepicker_audio_title">&filepicker_audio_title;</string>
diff --git a/mobile/android/base/sync/net/BaseResource.java b/mobile/android/base/sync/net/BaseResource.java
index 9827cf267604..01e1ccc2f972 100644
--- a/mobile/android/base/sync/net/BaseResource.java
+++ b/mobile/android/base/sync/net/BaseResource.java
@@ -267,7 +267,10 @@ public class BaseResource implements Resource {
       // Bug 740731: Don't let an exception fall through. Wrapping isn't
       // optimal, but often the exception is treated as an Exception anyway.
       if (!retryOnFailedRequest) {
-        delegate.handleHttpIOException(new IOException(e));
+        // Bug 769671: IOException(Throwable cause) was added only in API level 9.
+        final IOException ex = new IOException();
+        ex.initCause(e);
+        delegate.handleHttpIOException(ex);
       } else {
         retryRequest();
       }
diff --git a/mobile/android/base/sync/repositories/RepositorySession.java b/mobile/android/base/sync/repositories/RepositorySession.java
index 890de773111b..648f317b27bd 100644
--- a/mobile/android/base/sync/repositories/RepositorySession.java
+++ b/mobile/android/base/sync/repositories/RepositorySession.java
@@ -240,9 +240,7 @@ public abstract class RepositorySession {
       delegate.deferredFinishDelegate(delegateQueue).onFinishSucceeded(this, this.getBundle(null));
     } catch (InvalidSessionTransitionException e) {
       Logger.error(LOG_TAG, "Tried to finish() an unstarted or already finished session");
-      InactiveSessionException ex = new InactiveSessionException(null);
-      ex.initCause(e);
-      throw ex;
+      throw new InactiveSessionException(e);
     }
 
     Logger.trace(LOG_TAG, "Shutting down work queues.");
diff --git a/mobile/android/chrome/content/HelperApps.js b/mobile/android/chrome/content/HelperApps.js
index 6b7f642b21a7..7c78d50a22b1 100644
--- a/mobile/android/chrome/content/HelperApps.js
+++ b/mobile/android/chrome/content/HelperApps.js
@@ -48,7 +48,7 @@ var HelperApps =  {
     return found;
   },
   
-  openUriInApp: function openUriInApp(uri) { 
+  openUriInApp: function openUriInApp(uri) {
     var possibleHandlers = this.getAppsForUri(uri);
     if (possibleHandlers.length == 1) {
       possibleHandlers[0].launchWithURI(uri);
@@ -56,5 +56,50 @@ var HelperApps =  {
       let handlerInfoProto = this.urlHandlerService.getURLHandlerInfoFromOS(uri, {});
       handlerInfoProto.preferredApplicationHandler.launchWithURI(uri);
     }
+  },
+
+  showDoorhanger: function showDoorhanger(aUri, aCallback) {
+    let permValue = Services.perms.testPermission(aUri, "native-intent");
+    if (permValue != Services.perms.UNKNOWN_ACTION) {
+      if (permValue == Services.perms.ALLOW_ACTION) {
+        if (aCallback)
+          aCallback(aUri);
+
+        this.openUriInApp(aUri);
+      } else if (permValue == Services.perms.DENY_ACTION) {
+        // do nothing
+      }
+      return;
+    }
+
+    let apps = this.getAppsForUri(aUri);
+    let strings = Strings.browser;
+
+    let message = "";
+    if (apps.length == 1)
+      message = strings.formatStringFromName("helperapps.openWithApp2", [apps[0].name], 1);
+    else
+      message = strings.GetStringFromName("helperapps.openWithList2");
+  
+    let buttons = [{
+      label: strings.GetStringFromName("helperapps.open"),
+      callback: function(aChecked) {
+        if (aChecked)
+          Services.perms.add(aUri, "native-intent", Ci.nsIPermissionManager.ALLOW_ACTION);
+        if (aCallback)
+          aCallback(aUri);
+        else
+          this.openUriInApp(aUri);
+      }
+    }, {
+      label: strings.GetStringFromName("helperapps.ignore"),
+      callback: function(aChecked) {
+        if (aChecked)
+          Services.perms.add(aUri, "native-intent", Ci.nsIPermissionManager.DENY_ACTION);
+      }
+    }];
+
+    let options = { checkbox: Strings.browser.GetStringFromName("helperapps.dontAskAgain") };
+    NativeWindow.doorhanger.show(message, "helperapps-open", buttons, BrowserApp.selectedTab.id, options);
   }
 };
diff --git a/mobile/android/chrome/content/JSDOMParser.js b/mobile/android/chrome/content/JSDOMParser.js
index abeffa8d82f9..6ac60a7bf283 100644
--- a/mobile/android/chrome/content/JSDOMParser.js
+++ b/mobile/android/chrome/content/JSDOMParser.js
@@ -496,7 +496,12 @@
       }
     },
 
-    set textContext(text) {
+    set textContent(text) {
+      // clear parentNodes for existing children
+      for (let i = this.childNodes.length; --i >= 0;) {
+        this.childNodes[i].parentNode = null;
+      }
+
       let node = new Text();
       this.childNodes = [ node ];
       node.textContent = text;
diff --git a/mobile/android/chrome/content/Readability.js b/mobile/android/chrome/content/Readability.js
index 9612fc87ea0b..ef6e79154e0d 100644
--- a/mobile/android/chrome/content/Readability.js
+++ b/mobile/android/chrome/content/Readability.js
@@ -179,10 +179,7 @@ Readability.prototype = {
     if (curTitle.split(' ').length <= 4)
       curTitle = origTitle;
 
-    let articleTitle = doc.createElement("H1");
-    articleTitle.innerHTML = curTitle;
-
-    return articleTitle;
+    return curTitle;
   },
 
   /**
@@ -1355,7 +1352,7 @@ Readability.prototype = {
     //   }).bind(this), 500);
     // }
 
-    return { title: this._getInnerText(articleTitle),
+    return { title: articleTitle,
              byline: this._articleByline,
              content: articleContent.innerHTML };
   }
diff --git a/mobile/android/chrome/content/WebAppRT.js b/mobile/android/chrome/content/WebAppRT.js
index c6a96e3929ac..a25ea57cc10b 100644
--- a/mobile/android/chrome/content/WebAppRT.js
+++ b/mobile/android/chrome/content/WebAppRT.js
@@ -38,6 +38,11 @@ var WebAppRT = {
     if (isUpdate == "new") {
       this.getDefaultPrefs().forEach(this.addPref);
 
+      // prevent offering to use helper apps for things that this app handles
+      // i.e. don't show the "Open in market?" popup when we're showing the market app
+      let uri = Services.io.newURI(url, null, null);
+      Services.perms.add(uri, "native-intent", Ci.nsIPermissionManager.DENY_ACTION);
+
       // update the blocklist url to use a different app id
       let blocklist = Services.prefs.getCharPref("extensions.blocklist.url");
       blocklist = blocklist.replace(/%APP_ID%/g, "webapprt-mobile@mozilla.org");
diff --git a/mobile/android/chrome/content/aboutAddons.xhtml b/mobile/android/chrome/content/aboutAddons.xhtml
index 20332bce7f79..518d65b3ef2b 100644
--- a/mobile/android/chrome/content/aboutAddons.xhtml
+++ b/mobile/android/chrome/content/aboutAddons.xhtml
@@ -16,7 +16,7 @@
 
 <html xmlns="http://www.w3.org/1999/xhtml">
 <head>
-  <title>&aboutAddons.title;</title>
+  <title>&aboutAddons.title2;</title>
   <meta name="viewport" content="width=480; initial-scale=.6667; user-scalable=0" />
   <link rel="icon" type="image/png" href="chrome://branding/content/favicon32.png" />
   <link rel="stylesheet" href="chrome://browser/skin/aboutAddons.css" type="text/css"/>
diff --git a/mobile/android/chrome/content/aboutApps.xhtml b/mobile/android/chrome/content/aboutApps.xhtml
index 073f9406bfc7..161f2c6631dd 100644
--- a/mobile/android/chrome/content/aboutApps.xhtml
+++ b/mobile/android/chrome/content/aboutApps.xhtml
@@ -23,7 +23,7 @@
 
 <html xmlns="http://www.w3.org/1999/xhtml">
   <head>
-    <title>&aboutApps.title;</title>
+    <title>&aboutApps.title2;</title>
     <meta name="viewport" content="width=480; initial-scale=.6667; user-scalable=0" />
     <link rel="icon" type="image/png" href="chrome://branding/content/favicon32.png" />
     <link rel="stylesheet" type="text/css" href="chrome://browser/skin/aboutApps.css" media="all" />
@@ -32,7 +32,7 @@
 
   <body dir="&locale.dir;" onload="onLoad(event)" onunload="onUnload(event)">
     <div class="header">
-      <div>&aboutApps.title;</div>
+      <div>&aboutApps.header;</div>
       <img src="chrome://browser/skin/images/addons-amo-hdpi.png" class="icon" pref="app.marketplaceURL" onclick="openLink(this);"/>
     </div>
     <div id="main-container">
diff --git a/mobile/android/chrome/content/browser.js b/mobile/android/chrome/content/browser.js
index 12f247adbb12..bd4e62e1965c 100644
--- a/mobile/android/chrome/content/browser.js
+++ b/mobile/android/chrome/content/browser.js
@@ -247,7 +247,7 @@ var BrowserApp = {
 
     let updated = this.isAppUpdated();
     if (pinned) {
-      WebAppRT.init(updated);
+      WebAppRT.init(updated, url);
     } else {
       SearchEngines.init();
       this.initContextMenu();
@@ -375,7 +375,7 @@ var BrowserApp = {
       });
 
     NativeWindow.contextmenus.add(Strings.browser.GetStringFromName("contextmenu.copyEmailAddress"),
-      NativeWindow.contextmenus.emailLinkCopyableContext,
+      NativeWindow.contextmenus.emailLinkContext,
       function(aTarget) {
         let url = NativeWindow.contextmenus._getLinkURL(aTarget);
         let emailAddr = NativeWindow.contextmenus._stripScheme(url);
@@ -383,20 +383,37 @@ var BrowserApp = {
       });
 
     NativeWindow.contextmenus.add(Strings.browser.GetStringFromName("contextmenu.copyPhoneNumber"),
-      NativeWindow.contextmenus.phoneNumberLinkCopyableContext,
+      NativeWindow.contextmenus.phoneNumberLinkContext,
       function(aTarget) {
         let url = NativeWindow.contextmenus._getLinkURL(aTarget);
         let phoneNumber = NativeWindow.contextmenus._stripScheme(url);
         NativeWindow.contextmenus._copyStringToDefaultClipboard(phoneNumber);
-    });
+      });
 
     NativeWindow.contextmenus.add(Strings.browser.GetStringFromName("contextmenu.shareLink"),
       NativeWindow.contextmenus.linkShareableContext,
       function(aTarget) {
         let url = NativeWindow.contextmenus._getLinkURL(aTarget);
         let title = aTarget.textContent || aTarget.title;
-        let sharing = Cc["@mozilla.org/uriloader/external-sharing-app-service;1"].getService(Ci.nsIExternalSharingAppService);
-        sharing.shareWithDefault(url, "text/plain", title);
+        NativeWindow.contextmenus._shareStringWithDefault(url, title);
+      });
+
+    NativeWindow.contextmenus.add(Strings.browser.GetStringFromName("contextmenu.shareEmailAddress"),
+      NativeWindow.contextmenus.emailLinkContext,
+      function(aTarget) {
+        let url = NativeWindow.contextmenus._getLinkURL(aTarget);
+        let emailAddr = NativeWindow.contextmenus._stripScheme(url);
+        let title = aTarget.textContent || aTarget.title;
+        NativeWindow.contextmenus._shareStringWithDefault(emailAddr, title);
+      });
+
+    NativeWindow.contextmenus.add(Strings.browser.GetStringFromName("contextmenu.sharePhoneNumber"),
+      NativeWindow.contextmenus.phoneNumberLinkContext,
+      function(aTarget) {
+        let url = NativeWindow.contextmenus._getLinkURL(aTarget);
+        let phoneNumber = NativeWindow.contextmenus._stripScheme(url);
+        let title = aTarget.textContent || aTarget.title;
+        NativeWindow.contextmenus._shareStringWithDefault(phoneNumber, title);
       });
 
     NativeWindow.contextmenus.add(Strings.browser.GetStringFromName("contextmenu.bookmarkLink"),
@@ -1274,7 +1291,7 @@ var NativeWindow = {
         let uri = NativeWindow.contextmenus._getLink(aElement);
         if (uri) {
           let scheme = uri.scheme;
-          let dontOpen = /^(mailto|javascript|news|snews)$/;
+          let dontOpen = /^(javascript|mailto|news|snews|tel)$/;
           return (scheme && !dontOpen.test(scheme));
         }
         return false;
@@ -1293,32 +1310,12 @@ var NativeWindow = {
       }
     },
 
-    emailLinkCopyableContext: {
-      matches: function emailLinkCopyableContextMatches(aElement) {
-        let uri = NativeWindow.contextmenus._getLink(aElement);
-        if (uri) {
-          return uri.schemeIs("mailto");
-        }
-        return false;
-      }
-    },
-
-    phoneNumberLinkCopyableContext: {
-      matches: function phoneNumberLinkCopyableContextMatches(aElement) {
-        let uri = NativeWindow.contextmenus._getLink(aElement);
-        if (uri) {
-          return uri.schemeIs("tel");
-        }
-        return false;
-      }
-    },
-
     linkShareableContext: {
       matches: function linkShareableContextMatches(aElement) {
         let uri = NativeWindow.contextmenus._getLink(aElement);
         if (uri) {
           let scheme = uri.scheme;
-          let dontShare = /^(chrome|about|file|javascript|resource)$/;
+          let dontShare = /^(about|chrome|file|javascript|mailto|resource|tel)$/;
           return (scheme && !dontShare.test(scheme));
         }
         return false;
@@ -1330,13 +1327,31 @@ var NativeWindow = {
         let uri = NativeWindow.contextmenus._getLink(aElement);
         if (uri) {
           let scheme = uri.scheme;
-          let dontBookmark = /^(mailto)$/;
+          let dontBookmark = /^(mailto|tel)$/;
           return (scheme && !dontBookmark.test(scheme));
         }
         return false;
       }
     },
 
+    emailLinkContext: {
+      matches: function emailLinkContextMatches(aElement) {
+        let uri = NativeWindow.contextmenus._getLink(aElement);
+        if (uri)
+          return uri.schemeIs("mailto");
+        return false;
+      }
+    },
+
+    phoneNumberLinkContext: {
+      matches: function phoneNumberLinkContextMatches(aElement) {
+        let uri = NativeWindow.contextmenus._getLink(aElement);
+        if (uri)
+          return uri.schemeIs("tel");
+        return false;
+      }
+    },
+
     textContext: {
       matches: function textContext(aElement) {
         return ((aElement instanceof Ci.nsIDOMHTMLInputElement && aElement.mozIsTextField(false))
@@ -1369,7 +1384,7 @@ var NativeWindow = {
 
       while (element) {
         for each (let item in this.items) {
-          if (!this.menuitems[item.id] && item.matches(element)) {
+          if (!this.menuitems[item.id] && item.matches(element, aX, aY)) {
             this.menuitems[item.id] = item;
             menuitemsSet = true;
           }
@@ -1497,6 +1512,11 @@ var NativeWindow = {
       clipboard.copyString(aString);
     },
 
+    _shareStringWithDefault: function(aSharedString, aTitle) {
+      let sharing = Cc["@mozilla.org/uriloader/external-sharing-app-service;1"].getService(Ci.nsIExternalSharingAppService);
+      sharing.shareWithDefault(aSharedString, "text/plain", aTitle);
+    },
+
     _stripScheme: function(aString) {
       return aString.slice(aString.indexOf(":") + 1);
     }
@@ -2338,11 +2358,24 @@ Tab.prototype = {
     aDisplayPort = this._dirtiestHackEverToWorkAroundGeckoRounding(aDisplayPort, geckoScrollX, geckoScrollY);
 
     cwu = this.browser.contentWindow.QueryInterface(Ci.nsIInterfaceRequestor).getInterface(Ci.nsIDOMWindowUtils);
-    cwu.setDisplayPortForElement((aDisplayPort.left / resolution) - geckoScrollX,
-                                 (aDisplayPort.top / resolution) - geckoScrollY,
-                                 (aDisplayPort.right - aDisplayPort.left) / resolution,
-                                 (aDisplayPort.bottom - aDisplayPort.top) / resolution,
-                                 element);
+
+    let displayPort = {
+      x: (aDisplayPort.left / resolution) - geckoScrollX,
+      y: (aDisplayPort.top / resolution) - geckoScrollY,
+      width: (aDisplayPort.right - aDisplayPort.left) / resolution,
+      height: (aDisplayPort.bottom - aDisplayPort.top) / resolution
+    };
+
+    let epsilon = 0.001;
+    if (this._oldDisplayPort == null ||
+        Math.abs(displayPort.x - this._oldDisplayPort.x) > epsilon ||
+        Math.abs(displayPort.y - this._oldDisplayPort.y) > epsilon ||
+        Math.abs(displayPort.width - this._oldDisplayPort.width) > epsilon ||
+        Math.abs(displayPort.height - this._oldDisplayPort.height) > epsilon) {
+      cwu.setDisplayPortForElement(displayPort.x, displayPort.y, displayPort.width, displayPort.height, element);
+    }
+
+    this._oldDisplayPort = displayPort;
   },
 
   /*
@@ -2926,7 +2959,7 @@ Tab.prototype = {
 
     let documentURI = contentWin.document.documentURIObject.spec;
     let contentType = contentWin.document.contentType;
-    
+
     // If fixedURI matches browser.lastURI, we assume this isn't a real location
     // change but rather a spurious addition like a wyciwyg URI prefix. See Bug 747883.
     // Note that we have to ensure fixedURI is not the same as aLocationURI so we
@@ -2941,6 +2974,18 @@ Tab.prototype = {
     this.shouldShowPluginDoorhanger = true;
     this.clickToPlayPluginsActivated = false;
 
+    // This is where we might check for helper apps.
+    // For now it is special cased to only check for the marketplace urls
+    if (WebappsUI.isMarketplace(aLocationURI)) {
+      // the marketplace app may not actually be installed, so instead we use a custom
+      // callback that will install and launch it for us if necessary
+      HelperApps.showDoorhanger(aLocationURI, function() {
+        WebappsUI.installAndLaunchMarketplace(aLocationURI.spec);
+        if (aRequest)
+          aRequest.cancel(Cr.NS_OK);
+      });
+    }
+
     let message = {
       gecko: {
         type: "Content:LocationChange",
@@ -3054,16 +3099,16 @@ Tab.prototype = {
       aMetadata.allowZoom = true;
       aMetadata.minZoom = aMetadata.maxZoom = NaN;
     }
-    if (aMetadata && aMetadata.autoScale) {
-      let scaleRatio = aMetadata.scaleRatio = ViewportHandler.getScaleRatio();
 
-      if ("defaultZoom" in aMetadata && aMetadata.defaultZoom > 0)
-        aMetadata.defaultZoom *= scaleRatio;
-      if ("minZoom" in aMetadata && aMetadata.minZoom > 0)
-        aMetadata.minZoom *= scaleRatio;
-      if ("maxZoom" in aMetadata && aMetadata.maxZoom > 0)
-        aMetadata.maxZoom *= scaleRatio;
-    }
+    let scaleRatio = aMetadata.scaleRatio = ViewportHandler.getScaleRatio();
+
+    if ("defaultZoom" in aMetadata && aMetadata.defaultZoom > 0)
+      aMetadata.defaultZoom *= scaleRatio;
+    if ("minZoom" in aMetadata && aMetadata.minZoom > 0)
+      aMetadata.minZoom *= scaleRatio;
+    if ("maxZoom" in aMetadata && aMetadata.maxZoom > 0)
+      aMetadata.maxZoom *= scaleRatio;
+
     ViewportHandler.setMetadataForDocument(this.browser.contentDocument, aMetadata);
     this.updateViewportSize(gScreenWidth);
     this.sendViewportMetadata();
@@ -4522,12 +4567,8 @@ var ViewportHandler = {
    *   height (optional int): The CSS viewport height in px.
    *   autoSize (boolean): Resize the CSS viewport when the window resizes.
    *   allowZoom (boolean): Let the user zoom in or out.
-   *   autoScale (boolean): Adjust the viewport properties to account for display density.
    */
   getViewportMetadata: function getViewportMetadata(aWindow) {
-    if (aWindow.document instanceof XULDocument)
-      return { defaultZoom: 1, autoSize: true, allowZoom: false, autoScale: false };
-
     let windowUtils = aWindow.QueryInterface(Ci.nsIInterfaceRequestor).getInterface(Ci.nsIDOMWindowUtils);
 
     // viewport details found here
@@ -4552,11 +4593,11 @@ var ViewportHandler = {
       // Only check for HandheldFriendly if we don't have a viewport meta tag
       let handheldFriendly = windowUtils.getDocumentMetadata("HandheldFriendly");
       if (handheldFriendly == "true")
-        return { defaultZoom: 1, autoSize: true, allowZoom: true, autoScale: true };
+        return { defaultZoom: 1, autoSize: true, allowZoom: true };
 
       let doctype = aWindow.document.doctype;
       if (doctype && /(WAP|WML|Mobile)/.test(doctype.publicId))
-        return { defaultZoom: 1, autoSize: true, allowZoom: true, autoScale: true };
+        return { defaultZoom: 1, autoSize: true, allowZoom: true };
     }
 
     scale = this.clamp(scale, kViewportMinScale, kViewportMaxScale);
@@ -4574,8 +4615,7 @@ var ViewportHandler = {
       width: width,
       height: height,
       autoSize: autoSize,
-      allowZoom: allowZoom,
-      autoScale: true
+      allowZoom: allowZoom
     };
   },
 
@@ -4628,7 +4668,6 @@ var ViewportHandler = {
     return {
       autoSize: false,
       allowZoom: true,
-      autoScale: true,
       scaleRatio: ViewportHandler.getScaleRatio()
     };
   }
@@ -5951,6 +5990,7 @@ var WebappsUI = {
     Services.obs.addObserver(this, "webapps-sync-install", false);
     Services.obs.addObserver(this, "webapps-sync-uninstall", false);
     Services.obs.addObserver(this, "webapps-install-error", false);
+    Services.obs.addObserver(this, "WebApps:InstallMarketplace", false);
   },
   
   uninit: function unint() {
@@ -5959,6 +5999,7 @@ var WebappsUI = {
     Services.obs.removeObserver(this, "webapps-sync-install");
     Services.obs.removeObserver(this, "webapps-sync-uninstall");
     Services.obs.removeObserver(this, "webapps-install-error", false);
+    Services.obs.removeObserver(this, "WebApps:InstallMarketplace", false);
   },
 
   DEFAULT_PREFS_FILENAME: "default-prefs.js",
@@ -6024,6 +6065,61 @@ var WebappsUI = {
           }
         });
         break;
+      case "WebApps:InstallMarketplace":
+        this.installAndLaunchMarketplace(data.url);
+        break;
+    }
+  },
+
+  MARKETPLACE: {
+      MANIFEST: "https://marketplace.mozilla.org/manifest.webapp",
+      get URI() {
+        delete this.URI;
+        return this.URI = Services.io.newURI(this.MANIFEST, null, null);
+      }
+  },
+
+  isMarketplace: function isMarketplace(aUri) {
+    try {
+      return aUri.host == this.MARKETPLACE.URI.host;
+    } catch(ex) {
+      // this can fail for uri's that don't have a host (i.e. about urls)
+      console.log("could not find host for " + aUri.spec + ", " + ex);
+    }
+    return false;
+  },
+
+  // installs the marketplace, if a url is passed in, will launch it when the install
+  // is complete
+  installAndLaunchMarketplace: function installAndLaunchMarketplace(aLaunchUrl) {
+    // TODO: Add a flag to hide other install prompt dialogs. This should be silent if possible
+    let request = navigator.mozApps.getInstalled();
+    request.onsuccess = function() {
+      let foundMarket = false;
+      for (let i = 0; i < request.result.length; i++) {
+        if (request.result[i].origin == this.MARKETPLACE.URI.prePath)
+          foundMarket = true;
+      }
+
+      let launchFun = (function() {
+        if (aLaunchUrl)
+          WebappsUI.openURL(aLaunchUrl || WebappsUI.MARKETPLACE.URI.prePath, WebappsUI.MARKETPLACE.URI.prePath);
+      }).bind(this);
+
+      if (foundMarket) {
+        launchFun();
+      } else {
+        let r = navigator.mozApps.install(WebappsUI.MARKETPLACE.MANIFEST);
+        r.onsuccess = function() {
+          launchFun();
+        };
+        r.onerror = function() {
+          console.log("error installing market " + this.error.name);
+        };
+      }
+    };
+    request.onerror = function() {
+      console.log("error getting installed " + this.error.name);
     }
   },
 
@@ -6063,7 +6159,13 @@ var WebappsUI = {
   doInstall: function doInstall(aData) {
     let manifest = new DOMApplicationManifest(aData.app.manifest, aData.app.origin);
     let name = manifest.name ? manifest.name : manifest.fullLaunchPath();
-    if (Services.prompt.confirm(null, Strings.browser.GetStringFromName("webapps.installTitle"), name)) {
+    let showPrompt = true;
+
+    // skip showing the prompt if this is for the marketplace app
+    if (aData.app.origin == this.MARKETPLACE.URI.prePath)
+      showPrompt = false;
+
+    if (!showPrompt || Services.prompt.confirm(null, Strings.browser.GetStringFromName("webapps.installTitle"), name)) {
       // Add a homescreen shortcut -- we can't use createShortcut, since we need to pass
       // a unique ID for Android webapp allocation
       this.makeBase64Icon(this.getBiggestIcon(manifest.icons, Services.io.newURI(aData.app.origin, null, null)),
diff --git a/mobile/android/locales/en-US/chrome/aboutAddons.dtd b/mobile/android/locales/en-US/chrome/aboutAddons.dtd
index e83114720b74..05405bbb2ccc 100644
--- a/mobile/android/locales/en-US/chrome/aboutAddons.dtd
+++ b/mobile/android/locales/en-US/chrome/aboutAddons.dtd
@@ -2,7 +2,7 @@
    - License, v. 2.0. If a copy of the MPL was not distributed with this
    - file, You can obtain one at http://mozilla.org/MPL/2.0/. -->
 
-<!ENTITY aboutAddons.title                      "Add-ons Manager">
+<!ENTITY aboutAddons.title2                     "Add-ons">
 <!ENTITY aboutAddons.header2                    "Your Add-ons">
 <!ENTITY aboutAddons.options                    "Options">
 
diff --git a/mobile/android/locales/en-US/chrome/aboutApps.dtd b/mobile/android/locales/en-US/chrome/aboutApps.dtd
index 59427c0316a8..77add0c301b7 100644
--- a/mobile/android/locales/en-US/chrome/aboutApps.dtd
+++ b/mobile/android/locales/en-US/chrome/aboutApps.dtd
@@ -2,7 +2,8 @@
    - License, v. 2.0. If a copy of the MPL was not distributed with this
    - file, You can obtain one at http://mozilla.org/MPL/2.0/. -->
 
-<!ENTITY aboutApps.title "Your Apps">
+<!ENTITY aboutApps.title2                          "Apps">
+<!ENTITY aboutApps.header                          "Your Apps">
 
 <!-- LOCALIZATION NOTE (aboutApps.noApps.pre): include a trailing space as needed -->
 <!-- LOCALIZATION NOTE (aboutApps.noApps.middle): avoid leading/trailing spaces, this text is a link -->
diff --git a/mobile/android/locales/en-US/chrome/browser.properties b/mobile/android/locales/en-US/chrome/browser.properties
index bbab3f324409..31ee11bb0da4 100644
--- a/mobile/android/locales/en-US/chrome/browser.properties
+++ b/mobile/android/locales/en-US/chrome/browser.properties
@@ -213,7 +213,9 @@ contextmenu.copyLink=Copy Link
 contextmenu.shareLink=Share Link
 contextmenu.bookmarkLink=Bookmark Link
 contextmenu.copyEmailAddress=Copy Email Address
+contextmenu.shareEmailAddress=Share Email Address
 contextmenu.copyPhoneNumber=Copy Phone Number
+contextmenu.sharePhoneNumber=Share Phone Number
 contextmenu.changeInputMethod=Select Input Method
 contextmenu.fullScreen=Full Screen
 contextmenu.shareImage=Share Image
@@ -278,5 +280,8 @@ remoteIncomingPromptMessage=An incoming request to permit remote debugging conne
 remoteIncomingPromptDisable=Disable
 
 # Helper apps
+helperapps.open=Open
+helperapps.ignore=Ignore
+helperapps.dontAskAgain=Don't ask again for this site
 helperapps.openWithApp2=Open With %S App
 helperapps.openWithList2=Open With an App
diff --git a/modules/libpref/public/Makefile.in b/modules/libpref/public/Makefile.in
index e1064ac322d0..e32dad16459a 100644
--- a/modules/libpref/public/Makefile.in
+++ b/modules/libpref/public/Makefile.in
@@ -27,11 +27,6 @@ XPIDLSRCS	= \
               nsIRelativeFilePref.idl \
               $(NULL)
 
-EXPORTS     = \
-              PPrefTuple.h \
-              PrefTuple.h \
-              $(NULL)
-
 EXPORTS_mozilla = \
               Preferences.h \
               $(NULL)
diff --git a/modules/libpref/public/PPrefTuple.h b/modules/libpref/public/PPrefTuple.h
deleted file mode 100644
index 257eef372905..000000000000
--- a/modules/libpref/public/PPrefTuple.h
+++ /dev/null
@@ -1,74 +0,0 @@
-/* This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
-
-#ifndef dom_pref_hash_entry_array_IPC_serialiser
-#define dom_pref_hash_entry_array_IPC_serialiser
-
-#include "IPC/IPCMessageUtils.h"
-#include "nsTArray.h"
-#include "pldhash.h"
-#include "nsIPrefService.h"
-#include "PrefTuple.h"
-
-
-namespace IPC {
-
-template <>
-struct ParamTraits<PrefTuple>
-{
-  typedef PrefTuple paramType;
-
-  // Function to serialize a PrefTuple
-  static void Write(Message *aMsg, const paramType& aParam)
-  {
-    WriteParam(aMsg, aParam.key);
-    WriteParam(aMsg, (uint32_t)aParam.type);
-    switch (aParam.type) {
-      case PrefTuple::PREF_STRING:
-        WriteParam(aMsg, aParam.stringVal);
-        break;
-      case PrefTuple::PREF_INT:
-        WriteParam(aMsg, aParam.intVal);
-        break;
-      case PrefTuple::PREF_BOOL:
-        WriteParam(aMsg, aParam.boolVal);
-        break;
-    }
-  }
-
-  // Function to de-serialize a PrefTuple
-  static bool Read(const Message* aMsg, void **aIter, paramType* aResult)
-  {
-    uint32_t type;
-
-    if (!ReadParam(aMsg, aIter, &(aResult->key)))
-      return false;
-
-    if (!ReadParam(aMsg, aIter, &type))
-      return false;
-
-    switch (type) {
-      case PrefTuple::PREF_STRING:
-        aResult->type = PrefTuple::PREF_STRING;
-        if (!ReadParam(aMsg, aIter, &(aResult->stringVal)))
-          return false;
-        break;
-      case PrefTuple::PREF_INT:
-        aResult->type = PrefTuple::PREF_INT;
-        if (!ReadParam(aMsg, aIter, &(aResult->intVal)))
-          return false;
-        break;
-      case PrefTuple::PREF_BOOL:
-        aResult->type = PrefTuple::PREF_BOOL;
-        if (!ReadParam(aMsg, aIter, &(aResult->boolVal)))
-          return false;
-        break;
-    }
-    return true;
-  }
-} ;
-
-}
-#endif
-
diff --git a/modules/libpref/public/PrefTuple.h b/modules/libpref/public/PrefTuple.h
deleted file mode 100644
index 886450401440..000000000000
--- a/modules/libpref/public/PrefTuple.h
+++ /dev/null
@@ -1,30 +0,0 @@
-/* This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
-
-#ifndef preftuple_included
-#define preftuple_included
-
-#include "nsTArray.h"
-#include "nsString.h"
-
-struct PrefTuple
-{
-  nsCAutoString key;
-
-  // We don't use a union to avoid allocations when using the string component
-  // NOTE: Only one field will be valid at any given time, as indicated by the type enum
-  nsCAutoString stringVal;
-  int32_t       intVal;
-  bool          boolVal;
-
-  enum {
-    PREF_STRING,
-    PREF_INT,
-    PREF_BOOL
-  } type;
-
-};
-
-#endif
-
diff --git a/modules/libpref/public/Preferences.h b/modules/libpref/public/Preferences.h
index 11b401424bae..ed9f3c2db892 100644
--- a/modules/libpref/public/Preferences.h
+++ b/modules/libpref/public/Preferences.h
@@ -15,6 +15,7 @@
 #include "nsIPrefBranchInternal.h"
 #include "nsIObserver.h"
 #include "nsCOMPtr.h"
+#include "nsTArray.h"
 #include "nsWeakReference.h"
 
 class nsIFile;
@@ -30,12 +31,18 @@ typedef int (*PR_CALLBACK PrefChangedFunc)(const char *, void *);
 
 namespace mozilla {
 
+namespace dom {
+class PrefSetting;
+}
+
 class Preferences : public nsIPrefService,
                     public nsIObserver,
                     public nsIPrefBranchInternal,
                     public nsSupportsWeakReference
 {
 public:
+  typedef mozilla::dom::PrefSetting PrefSetting;
+
   NS_DECL_ISUPPORTS
   NS_DECL_NSIPREFSERVICE
   NS_FORWARD_NSIPREFBRANCH(sRootBranch->)
@@ -320,11 +327,9 @@ public:
   static int32_t GetDefaultType(const char* aPref);
 
   // Used to synchronise preferences between chrome and content processes.
-  static void MirrorPreferences(nsTArray<PrefTuple,
-                                nsTArrayInfallibleAllocator> *aArray);
-  static bool MirrorPreference(const char *aPref, PrefTuple *aTuple);
-  static void ClearContentPref(const char *aPref);
-  static void SetPreference(const PrefTuple *aTuple);
+  static void GetPreferences(InfallibleTArray<PrefSetting>* aPrefs);
+  static void GetPreference(PrefSetting* aPref);
+  static void SetPreference(const PrefSetting& aPref);
 
 protected:
   nsresult NotifyServiceObservers(const char *aSubject);
diff --git a/modules/libpref/src/Preferences.cpp b/modules/libpref/src/Preferences.cpp
index ad16e992e0e6..e401e42ddf78 100644
--- a/modules/libpref/src/Preferences.cpp
+++ b/modules/libpref/src/Preferences.cpp
@@ -36,7 +36,6 @@
 #include "prefapi.h"
 #include "prefread.h"
 #include "prefapi_private_data.h"
-#include "PrefTuple.h"
 
 #include "mozilla/Omnijar.h"
 #include "nsZipArchive.h"
@@ -285,13 +284,12 @@ Preferences::Init()
 
   using mozilla::dom::ContentChild;
   if (XRE_GetProcessType() == GeckoProcessType_Content) {
-    InfallibleTArray<PrefTuple> array;
-    ContentChild::GetSingleton()->SendReadPrefsArray(&array);
+    InfallibleTArray<PrefSetting> prefs;
+    ContentChild::GetSingleton()->SendReadPrefsArray(&prefs);
 
     // Store the array
-    nsTArray<PrefTuple>::size_type index = array.Length();
-    while (index-- > 0) {
-      pref_SetPrefTuple(array[index], true);
+    for (uint32_t i = 0; i < prefs.Length(); ++i) {
+      pref_SetPref(prefs[i]);
     }
     return NS_OK;
   }
@@ -470,34 +468,26 @@ ReadExtensionPrefs(nsIFile *aFile)
 }
 
 void
-Preferences::SetPreference(const PrefTuple *aPref)
+Preferences::SetPreference(const PrefSetting& aPref)
 {
-  pref_SetPrefTuple(*aPref, true);
+  pref_SetPref(aPref);
 }
 
 void
-Preferences::ClearContentPref(const char *aPref)
+Preferences::GetPreference(PrefSetting* aPref)
 {
-  PREF_ClearUserPref(aPref);
-}
-
-bool
-Preferences::MirrorPreference(const char *aPref, PrefTuple *aTuple)
-{
-  PrefHashEntry *entry = pref_HashTableLookup(aPref);
+  PrefHashEntry *entry = pref_HashTableLookup(aPref->name().get());
   if (!entry)
-    return false;
+    return;
 
-  pref_GetTupleFromEntry(entry, aTuple);
-  return true;
+  pref_GetPrefFromEntry(entry, aPref);
 }
 
 void
-Preferences::MirrorPreferences(nsTArray<PrefTuple,
-                                        nsTArrayInfallibleAllocator> *aArray)
+Preferences::GetPreferences(InfallibleTArray<PrefSetting>* aPrefs)
 {
-  aArray->SetCapacity(PL_DHASH_TABLE_SIZE(&gHashTable));
-  PL_DHashTableEnumerate(&gHashTable, pref_MirrorPrefs, aArray);
+  aPrefs->SetCapacity(PL_DHASH_TABLE_SIZE(&gHashTable));
+  PL_DHashTableEnumerate(&gHashTable, pref_GetPrefs, aPrefs);
 }
 
 NS_IMETHODIMP
diff --git a/modules/libpref/src/init/all.js b/modules/libpref/src/init/all.js
index f71bc56cf470..4e35bcc1fad1 100644
--- a/modules/libpref/src/init/all.js
+++ b/modules/libpref/src/init/all.js
@@ -725,6 +725,8 @@ pref("javascript.options.mem.gc_low_frequency_heap_growth", 150);
 pref("javascript.options.mem.gc_dynamic_heap_growth", true);
 pref("javascript.options.mem.gc_dynamic_mark_slice", true);
 
+pref("javascript.options.mem.analysis_purge_mb", 100);
+
 // advanced prefs
 pref("advanced.mailftp",                    false);
 pref("image.animation_mode",                "normal");
@@ -3635,7 +3637,6 @@ pref("dom.battery.enabled", true);
 
 // WebSMS
 pref("dom.sms.enabled", false);
-pref("dom.sms.whitelist", "");
 
 // WebContacts
 pref("dom.mozContacts.enabled", false);
diff --git a/modules/libpref/src/prefapi.cpp b/modules/libpref/src/prefapi.cpp
index d878d8e74918..18354b93679d 100644
--- a/modules/libpref/src/prefapi.cpp
+++ b/modules/libpref/src/prefapi.cpp
@@ -1,11 +1,12 @@
-/* -*- Mode: C; tab-width: 4; indent-tabs-mode: nil; c-basic-offset: 4 -*- */
+/* -*- Mode: C++; tab-width: 4; indent-tabs-mode: nil; c-basic-offset: 4 -*- */
 /* This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
 
+#include "base/basictypes.h"
+
 #include "prefapi.h"
 #include "prefapi_private_data.h"
-#include "PrefTuple.h"
 #include "prefread.h"
 #include "nsReadableUtils.h"
 #include "nsCRT.h"
@@ -26,6 +27,7 @@
 #include "prlog.h"
 #include "prmem.h"
 #include "prprf.h"
+#include "mozilla/dom/PContent.h"
 #include "nsQuickSort.h"
 #include "nsString.h"
 #include "nsPrintfCString.h"
@@ -36,6 +38,8 @@
 #include <os2.h>
 #endif
 
+using namespace mozilla;
+
 static void
 clearPrefEntry(PLDHashTable *table, PLDHashEntryHdr *entry)
 {
@@ -121,6 +125,7 @@ static char *ArenaStrDup(const char* str, PLArenaPool* aArena)
 /*---------------------------------------------------------------------------*/
 
 #define PREF_IS_LOCKED(pref)            ((pref)->flags & PREF_LOCKED)
+#define PREF_HAS_DEFAULT_VALUE(pref)    ((pref)->flags & PREF_HAS_DEFAULT)
 #define PREF_HAS_USER_VALUE(pref)       ((pref)->flags & PREF_USERSET)
 #define PREF_TYPE(pref)                 (PrefType)((pref)->flags & PREF_VALUETYPE_MASK)
 
@@ -271,22 +276,53 @@ PREF_SetBoolPref(const char *pref_name, bool value, bool set_default)
     return pref_HashPref(pref_name, pref, PREF_BOOL, set_default ? kPrefSetDefault : 0);
 }
 
-nsresult
-pref_SetPrefTuple(const PrefTuple &aPref, bool set_default)
+enum WhichValue { DEFAULT_VALUE, USER_VALUE };
+static nsresult
+SetPrefValue(const char* aPrefName, const dom::PrefValue& aValue,
+             WhichValue aWhich)
 {
-    switch (aPref.type) {
-        case PrefTuple::PREF_STRING:
-            return PREF_SetCharPref(aPref.key.get(), aPref.stringVal.get(), set_default);
+    bool setDefault = (aWhich == DEFAULT_VALUE);
+    switch (aValue.type()) {
+    case dom::PrefValue::TnsCString:
+        return PREF_SetCharPref(aPrefName, aValue.get_nsCString().get(),
+                                setDefault);
+    case dom::PrefValue::Tint32_t:
+        return PREF_SetIntPref(aPrefName, aValue.get_int32_t(),
+                               setDefault);
+    case dom::PrefValue::Tbool:
+        return PREF_SetBoolPref(aPrefName, aValue.get_bool(),
+                                setDefault);
+    default:
+        MOZ_NOT_REACHED();
+        return NS_ERROR_FAILURE;
+    }
+}
 
-        case PrefTuple::PREF_INT:
-            return PREF_SetIntPref(aPref.key.get(), aPref.intVal, set_default);
+nsresult
+pref_SetPref(const dom::PrefSetting& aPref)
+{
+    const char* prefName = aPref.name().get();
+    const dom::MaybePrefValue& defaultValue = aPref.defaultValue();
+    const dom::MaybePrefValue& userValue = aPref.userValue();
 
-        case PrefTuple::PREF_BOOL:
-            return PREF_SetBoolPref(aPref.key.get(), aPref.boolVal, set_default);
+    nsresult rv;
+    if (defaultValue.type() == dom::MaybePrefValue::TPrefValue) {
+        rv = SetPrefValue(prefName, defaultValue.get_PrefValue(), DEFAULT_VALUE);
+        if (NS_FAILED(rv)) {
+            return rv;
+        }
     }
 
-    NS_NOTREACHED("Unknown type");
-    return NS_ERROR_INVALID_ARG;
+    if (userValue.type() == dom::MaybePrefValue::TPrefValue) {
+        rv = SetPrefValue(prefName, userValue.get_PrefValue(), USER_VALUE);
+    } else {
+        rv = PREF_ClearUserPref(prefName);      
+    }
+
+    // NB: we should never try to clear a default value, that doesn't
+    // make sense
+
+    return rv;
 }
 
 PLDHashOperator
@@ -348,47 +384,73 @@ pref_savePref(PLDHashTable *table, PLDHashEntryHdr *heh, uint32_t i, void *arg)
 }
 
 PLDHashOperator
-pref_MirrorPrefs(PLDHashTable *table,
-                 PLDHashEntryHdr *heh,
-                 uint32_t i,
-                 void *arg)
+pref_GetPrefs(PLDHashTable *table,
+              PLDHashEntryHdr *heh,
+              uint32_t i,
+              void *arg)
 {
     if (heh) {
         PrefHashEntry *entry = static_cast<PrefHashEntry *>(heh);
-        PrefTuple *newEntry =
-            static_cast<nsTArray<PrefTuple> *>(arg)->AppendElement();
+        dom::PrefSetting *pref =
+            static_cast<InfallibleTArray<dom::PrefSetting>*>(arg)->AppendElement();
 
-        pref_GetTupleFromEntry(entry, newEntry);
+        pref_GetPrefFromEntry(entry, pref);
     }
     return PL_DHASH_NEXT;
 }
 
-void
-pref_GetTupleFromEntry(PrefHashEntry *aHashEntry, PrefTuple *aTuple)
+static void
+GetPrefValueFromEntry(PrefHashEntry *aHashEntry, dom::PrefSetting* aPref,
+                      WhichValue aWhich)
 {
-    aTuple->key = aHashEntry->key;
-
-    PrefValue *value = PREF_HAS_USER_VALUE(aHashEntry) ?
-        &(aHashEntry->userPref) : &(aHashEntry->defaultPref);
+    PrefValue* value;
+    dom::PrefValue* settingValue;
+    if (aWhich == USER_VALUE) {
+        value = &aHashEntry->userPref;
+        aPref->userValue() = dom::PrefValue();
+        settingValue = &aPref->userValue().get_PrefValue();
+    } else {
+        value = &aHashEntry->defaultPref;
+        aPref->defaultValue() = dom::PrefValue();
+        settingValue = &aPref->defaultValue().get_PrefValue();
+    }
 
     switch (aHashEntry->flags & PREF_VALUETYPE_MASK) {
-        case PREF_STRING:
-            aTuple->stringVal = value->stringVal;
-            aTuple->type = PrefTuple::PREF_STRING;
-            return;
-
-        case PREF_INT:
-            aTuple->intVal = value->intVal;
-            aTuple->type = PrefTuple::PREF_INT;
-            return;
-
-        case PREF_BOOL:
-            aTuple->boolVal = !!value->boolVal;
-            aTuple->type = PrefTuple::PREF_BOOL;
-            return;
+    case PREF_STRING:
+        *settingValue = nsDependentCString(value->stringVal);
+        return;
+    case PREF_INT:
+        *settingValue = value->intVal;
+        return;
+    case PREF_BOOL:
+        *settingValue = !!value->boolVal;
+        return;
+    default:
+        MOZ_NOT_REACHED();
     }
 }
 
+void
+pref_GetPrefFromEntry(PrefHashEntry *aHashEntry, dom::PrefSetting* aPref)
+{
+    aPref->name() = aHashEntry->key;
+    if (PREF_HAS_DEFAULT_VALUE(aHashEntry)) {
+        GetPrefValueFromEntry(aHashEntry, aPref, DEFAULT_VALUE);
+    } else {
+        aPref->defaultValue() = null_t();
+    }
+    if (PREF_HAS_USER_VALUE(aHashEntry)) {
+        GetPrefValueFromEntry(aHashEntry, aPref, USER_VALUE);
+    } else {
+        aPref->userValue() = null_t();
+    }
+
+    MOZ_ASSERT(aPref->defaultValue().type() == dom::MaybePrefValue::Tnull_t ||
+               aPref->userValue().type() == dom::MaybePrefValue::Tnull_t ||
+               (aPref->defaultValue().get_PrefValue().type() ==
+                aPref->userValue().get_PrefValue().type()));
+}
+
 
 int
 pref_CompareStrings(const void *v1, const void *v2, void *unused)
diff --git a/modules/libpref/src/prefapi_private_data.h b/modules/libpref/src/prefapi_private_data.h
index 56a92eaf7410..3567395dc004 100644
--- a/modules/libpref/src/prefapi_private_data.h
+++ b/modules/libpref/src/prefapi_private_data.h
@@ -8,7 +8,11 @@
 extern PLDHashTable			gHashTable;
 extern bool                 gDirty;
 
-struct PrefTuple;
+namespace mozilla {
+namespace dom {
+class PrefSetting;
+}
+}
 
 enum pref_SaveTypes { SAVE_NONSHARED, SAVE_SHARED, SAVE_ALL, SAVE_ALL_AND_DEFAULTS };
 
@@ -22,12 +26,14 @@ PLDHashOperator
 pref_savePref(PLDHashTable *table, PLDHashEntryHdr *heh, uint32_t i, void *arg);
 
 PLDHashOperator
-pref_MirrorPrefs(PLDHashTable *table, PLDHashEntryHdr *heh, uint32_t i, void *arg);
+pref_GetPrefs(PLDHashTable *table,
+              PLDHashEntryHdr *heh, uint32_t i, void *arg);
 
 nsresult
-pref_SetPrefTuple(const PrefTuple &aPref,bool set_default = false);
+pref_SetPref(const mozilla::dom::PrefSetting& aPref);
 
 int pref_CompareStrings(const void *v1, const void *v2, void* unused);
 PrefHashEntry* pref_HashTableLookup(const void *key);
 
-void pref_GetTupleFromEntry(PrefHashEntry *aHashEntry, PrefTuple *aTuple);
+void pref_GetPrefFromEntry(PrefHashEntry *aHashEntry,
+                           mozilla::dom::PrefSetting* aPref);
diff --git a/modules/libpref/test/unit_ipc/test_user_default_prefs.js b/modules/libpref/test/unit_ipc/test_user_default_prefs.js
new file mode 100644
index 000000000000..016c8318279c
--- /dev/null
+++ b/modules/libpref/test/unit_ipc/test_user_default_prefs.js
@@ -0,0 +1,76 @@
+const Ci = Components.interfaces;
+const Cc = Components.classes;
+
+let pb = Cc["@mozilla.org/preferences-service;1"].getService(Ci.nsIPrefBranch);
+
+// This pref is chosen somewhat arbitrarily --- we just need one
+// that's guaranteed to have a default value.
+const kPrefName = 'intl.accept_languages'; // of type char, which we
+                                           // assume below
+let initialValue = null;
+
+function check_child_pref_info_eq(continuation) {
+    sendCommand(
+        'var pb = Components.classes["@mozilla.org/preferences-service;1"].getService(Components.interfaces.nsIPrefBranch);\n'+
+        // Returns concatenation "[value],[isUser]"
+        'pb.getCharPref("'+ kPrefName +'")+ "," +'+
+        'pb.prefHasUserValue("'+ kPrefName +'");',
+        function (info) {
+            let [ value, isUser ] = info.split(',');
+            do_check_eq(pb.getCharPref(kPrefName), value);
+            do_check_eq(pb.prefHasUserValue(kPrefName), isUser == "true");
+            continuation();
+        });
+}
+
+function run_test() {
+    // We finish in clean_up()
+    do_test_pending();
+
+    try {
+        if (pb.getCharPref('dom.ipc.processPrelauch.enabled')) {
+            dump('WARNING: Content process may already have launched, so this test may not be meaningful.');
+        }
+    } catch(e) { }
+
+    initialValue = pb.getCharPref(kPrefName);
+
+    test_user_setting();
+}
+
+function test_user_setting() {
+    // We rely on setting this before the content process starts up.
+    // When it starts up, it should recognize this as a user pref, not
+    // a default pref.
+    pb.setCharPref(kPrefName, 'i-imaginarylanguage');
+    // NB: processing of the value-change notification in the child
+    // process triggered by the above set happens-before the remaining
+    // code here
+    check_child_pref_info_eq(function () {
+            do_check_eq(pb.prefHasUserValue(kPrefName), true);
+
+            test_cleared_is_default();
+        });
+}
+
+function test_cleared_is_default() {
+    pb.clearUserPref(kPrefName);
+    // NB: processing of the value-change notification in the child
+    // process triggered by the above set happens-before the remaining
+    // code here
+    check_child_pref_info_eq(function () {
+            do_check_eq(pb.prefHasUserValue(kPrefName), false);
+
+            clean_up();
+        });
+}
+
+function clean_up() {
+    pb.setCharPref(kPrefName, initialValue);
+    // NB: processing of the value-change notification in the child
+    // process triggered by the above set happens-before the remaining
+    // code here
+    check_child_pref_info_eq(function () {
+            do_test_finished();
+        });
+}
\ No newline at end of file
diff --git a/modules/libpref/test/unit_ipc/xpcshell.ini b/modules/libpref/test/unit_ipc/xpcshell.ini
index 8e122e574fdc..6223d2342efd 100644
--- a/modules/libpref/test/unit_ipc/xpcshell.ini
+++ b/modules/libpref/test/unit_ipc/xpcshell.ini
@@ -6,3 +6,4 @@ tail =
 [test_initial_prefs.js]
 [test_observed_prefs.js]
 [test_update_prefs.js]
+[test_user_default_prefs.js]
diff --git a/netwerk/protocol/data/nsDataHandler.cpp b/netwerk/protocol/data/nsDataHandler.cpp
index e61933279f61..ac46964a2f16 100644
--- a/netwerk/protocol/data/nsDataHandler.cpp
+++ b/netwerk/protocol/data/nsDataHandler.cpp
@@ -163,9 +163,16 @@ nsDataHandler::ParseURI(nsCString& spec,
 
     // determine if the data is base64 encoded.
     char *base64 = PL_strcasestr(buffer, BASE64_EXTENSION);
-    if (base64 && *(base64 + strlen(BASE64_EXTENSION))==0) {
-        isBase64 = true;
-        *base64 = '\0';
+    if (base64) {
+        char *beyond = base64 + strlen(BASE64_EXTENSION);
+        // per the RFC 2397 grammar, "base64" MUST be followed by a comma
+        // previously substituted by '\0', but we also allow it in between
+        // parameters so a subsequent ";" is ok as well (this deals with
+        // *broken* data URIs, see bug 781693 for an example)
+        if (*beyond == '\0' || *beyond == ';') {
+            isBase64 = true;
+            *base64 = '\0';
+        }
     }
 
     if (comma == buffer) {
diff --git a/netwerk/test/unit/test_data_protocol.js b/netwerk/test/unit/test_data_protocol.js
index 7e6237fba694..a4f3e478735d 100644
--- a/netwerk/test/unit/test_data_protocol.js
+++ b/netwerk/test/unit/test_data_protocol.js
@@ -11,13 +11,16 @@ const Cr = Components.results;
 var urls = [
   ["data:,foo",                                     "text/plain",               "foo"],
   ["data:application/octet-stream,foo bar",         "application/octet-stream", "foobar"],
-  ["data:application/octet-stream;base64=y,foobar",         "application/octet-stream", "foobar"],
   ["data:application/octet-stream,foo%20bar",       "application/octet-stream", "foo bar"],
   ["data:application/xhtml+xml,foo bar",            "application/xhtml+xml",    "foo bar"],
   ["data:application/xhtml+xml,foo%20bar",          "application/xhtml+xml",    "foo bar"],
   ["data:text/plain,foo%00 bar",                    "text/plain",               "foo\x00 bar"],
   ["data:text/plain;base64,Zm9 vI%20GJ%0Dhc%0Ag==", "text/plain",               "foo bar"],
-  ["DATA:TEXT/PLAIN;BASE64,Zm9 vI%20GJ%0Dhc%0Ag==", "text/plain",               "foo bar"]
+  ["DATA:TEXT/PLAIN;BASE64,Zm9 vI%20GJ%0Dhc%0Ag==", "text/plain",               "foo bar"],
+  // Bug 774240
+  ["data:application/octet-stream;base64=y,foobar", "application/octet-stream", "foobar"],
+  // Bug 781693
+  ["data:text/plain;base64;x=y,dGVzdA==",           "text/plain",               "test"]
 ];
 
 function run_test() {
@@ -31,7 +34,7 @@ function run_test() {
 
     /* read completed successfully.  now compare the data. */
     if (data != urls[idx][2])
-      do_throw("Stream contents do not match with direct read!");
+      do_throw("Stream contents do not match with direct read! Is <" + data + ">, should be <" + urls[idx][2] + ">");
     do_test_finished();
   }
 
diff --git a/testing/marionette/client/marionette/marionette_test.py b/testing/marionette/client/marionette/marionette_test.py
index 619f8c7d2b40..969ded6ca583 100644
--- a/testing/marionette/client/marionette/marionette_test.py
+++ b/testing/marionette/client/marionette/marionette_test.py
@@ -53,39 +53,23 @@ window.addEventListener('message', function frameload(e) {
         self.assertTrue(isinstance(frame, HTMLElement))
         return frame
 
-    def set_up_test_page(self, emulator, url="test.html", whitelist_prefs=None):
+    def set_up_test_page(self, emulator, url="test.html", permissions=None):
         emulator.set_context("content")
         url = emulator.absolute_url(url)
         emulator.navigate(url)
 
-        if not whitelist_prefs:
+        if not permissions:
             return
 
         emulator.set_context("chrome")
         emulator.execute_script("""
 Components.utils.import("resource://gre/modules/Services.jsm");
-let [url, whitelist_prefs] = arguments;
-let host = Services.io.newURI(url, null, null).prePath;
-whitelist_prefs.forEach(function (pref) {
-  let value;
-  try {
-    value = Services.prefs.getCharPref(pref);
-    log(pref + " has initial value " + value);
-  } catch(ex) {
-    log(pref + " has no initial value.");
-    // Ignore.
-  }
-  let list = value ? value.split(",") : [];
-  if (list.indexOf(host) != -1) {
-    return;
-  }
-  // Some whitelists expect scheme://host, some expect the full URI...
-  list.push(host);
-  list.push(url);
-  Services.prefs.setCharPref(pref, list.join(","))
-  log("Added " + host + " to " + pref);
+let [url, permissions] = arguments;
+let uri = Services.io.newURI(url, null, null);
+permissions.forEach(function (perm) {
+    Services.perms.add(uri, "sms", Components.interfaces.nsIPermissionManager.ALLOW_ACTION);
 });
-        """, [url, whitelist_prefs])
+        """, [url, permissions])
         emulator.set_context("content")
 
     def setUp(self):
diff --git a/toolkit/components/alerts/mac/Makefile.in b/toolkit/components/alerts/mac/Makefile.in
index 9b3e0b8538fd..6f2bb1b872de 100644
--- a/toolkit/components/alerts/mac/Makefile.in
+++ b/toolkit/components/alerts/mac/Makefile.in
@@ -15,10 +15,12 @@ IS_COMPONENT = 1
 FORCE_SHARED_LIB = 1
 
 CMMSRCS = \
-  nsGrowlAlertsService.mm \
+  nsMacAlertsService.mm \
   mozGrowlDelegate.mm \
+  mozNotificationCenterDelegate.mm \
   nsAlertsImageLoadListener.mm \
   nsNotificationsList.mm \
+  ObserverPair.mm \
   $(NULL)
 
 CPPSRCS = \
@@ -31,7 +33,7 @@ LOCAL_INCLUDES += \
   $(NULL)
 
 EXPORTS = \
-  nsGrowlAlertsService.h \
+  nsMacAlertsService.h \
   $(NULL)
 
 SHARED_LIBRARY_LIBS = \
diff --git a/toolkit/components/alerts/mac/ObserverPair.h b/toolkit/components/alerts/mac/ObserverPair.h
new file mode 100644
index 000000000000..487434a16aeb
--- /dev/null
+++ b/toolkit/components/alerts/mac/ObserverPair.h
@@ -0,0 +1,73 @@
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+#import <Cocoa/Cocoa.h>
+
+#include "nsIXPConnect.h"
+#include "nsIObserver.h"
+#include "nsIDOMWindow.h"
+#include "nsIJSContextStack.h"
+#include "nsServiceManagerUtils.h"
+
+@interface ObserverPair : NSObject
+{
+@public
+  nsIObserver *observer;
+  nsIDOMWindow *window;
+}
+
+- (id) initWithObserver:(nsIObserver *)aObserver window:(nsIDOMWindow *)aWindow;
+- (void) dealloc;
+
+@end
+
+/**
+ * Returns the DOM window that owns the given observer in the case that the
+ * observer is implemented in JS and was created in a DOM window's scope.
+ *
+ * We need this so that we can properly clean up in cases where the window gets
+ * closed before the growl timeout/click notifications have fired. Otherwise we
+ * leak those windows.
+ */
+static already_AddRefed<nsIDOMWindow> __attribute__((unused))
+GetWindowOfObserver(nsIObserver* aObserver)
+{
+  nsCOMPtr<nsIXPConnectWrappedJS> wrappedJS(do_QueryInterface(aObserver));
+  if (!wrappedJS) {
+    // We can't do anything with objects that aren't implemented in JS...
+    return nullptr;
+  }
+
+  JSObject* obj;
+  nsresult rv = wrappedJS->GetJSObject(&obj);
+  NS_ENSURE_SUCCESS(rv, nullptr);
+
+  nsCOMPtr<nsIThreadJSContextStack> stack =
+    do_GetService("@mozilla.org/js/xpc/ContextStack;1", &rv);
+  NS_ENSURE_SUCCESS(rv, nullptr);
+
+  JSContext* cx = stack->GetSafeJSContext();
+  NS_ENSURE_TRUE(cx, nullptr);
+
+  JSAutoRequest ar(cx);
+  JSAutoEnterCompartment ac;
+  if (!ac.enter(cx, obj)) {
+    return nullptr;
+  }
+
+  JSObject* global = JS_GetGlobalForObject(cx, obj);
+  NS_ENSURE_TRUE(global, nullptr);
+
+  nsCOMPtr<nsIXPConnect> xpc(do_GetService(nsIXPConnect::GetCID()));
+  NS_ENSURE_TRUE(xpc, nullptr);
+
+  nsCOMPtr<nsIXPConnectWrappedNative> wrapper;
+  rv = xpc->GetWrappedNativeOfJSObject(cx, global, getter_AddRefs(wrapper));
+  NS_ENSURE_SUCCESS(rv, nullptr);
+
+  nsCOMPtr<nsIDOMWindow> window = do_QueryWrappedNative(wrapper);
+  NS_ENSURE_TRUE(window, nullptr);
+
+  return window.forget();
+}
diff --git a/toolkit/components/alerts/mac/ObserverPair.mm b/toolkit/components/alerts/mac/ObserverPair.mm
new file mode 100644
index 000000000000..c8191b32dfd6
--- /dev/null
+++ b/toolkit/components/alerts/mac/ObserverPair.mm
@@ -0,0 +1,36 @@
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+#import "ObserverPair.h"
+
+#include "nsObjCExceptions.h"
+
+@implementation ObserverPair
+
+- (id) initWithObserver:(nsIObserver *)aObserver window:(nsIDOMWindow *)aWindow
+{
+  NS_OBJC_BEGIN_TRY_ABORT_BLOCK_NIL;
+
+  if ((self = [super init])) {
+    NS_ADDREF(observer = aObserver);
+    NS_IF_ADDREF(window = aWindow);
+  }
+
+  return self;
+
+  NS_OBJC_END_TRY_ABORT_BLOCK_NIL;
+}
+
+- (void) dealloc
+{
+  NS_OBJC_BEGIN_TRY_ABORT_BLOCK;
+
+  NS_IF_RELEASE(observer);
+  NS_IF_RELEASE(window);
+  [super dealloc];
+
+  NS_OBJC_END_TRY_ABORT_BLOCK;
+}
+
+@end
diff --git a/toolkit/components/alerts/mac/mozGrowlDelegate.mm b/toolkit/components/alerts/mac/mozGrowlDelegate.mm
index 13af9d6cf0e1..6171feaa4994 100644
--- a/toolkit/components/alerts/mac/mozGrowlDelegate.mm
+++ b/toolkit/components/alerts/mac/mozGrowlDelegate.mm
@@ -3,115 +3,14 @@
  * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
 
 #import "mozGrowlDelegate.h"
+#import "ObserverPair.h"
 
 #include "nsIObserver.h"
-#include "nsIXPConnect.h"
 #include "nsIXULAppInfo.h"
 #include "nsIStringBundle.h"
-#include "nsIJSContextStack.h"
 #include "nsIDOMWindow.h"
 
-#include "jsapi.h"
-#include "nsCOMPtr.h"
 #include "nsObjCExceptions.h"
-#include "nsServiceManagerUtils.h"
-#include "nsWeakReference.h"
-
-/**
- * Returns the DOM window that owns the given observer in the case that the
- * observer is implemented in JS and was created in a DOM window's scope.
- *
- * We need this so that we can properly clean up in cases where the window gets
- * closed before the growl timeout/click notifications have fired. Otherwise we
- * leak those windows.
- */
-static already_AddRefed<nsIDOMWindow>
-GetWindowOfObserver(nsIObserver* aObserver)
-{
-  nsCOMPtr<nsIXPConnectWrappedJS> wrappedJS(do_QueryInterface(aObserver));
-  if (!wrappedJS) {
-    // We can't do anything with objects that aren't implemented in JS...
-    return nullptr;
-  }
-
-  JSObject* obj;
-  nsresult rv = wrappedJS->GetJSObject(&obj);
-  NS_ENSURE_SUCCESS(rv, nullptr);
-
-  nsCOMPtr<nsIThreadJSContextStack> stack =
-    do_GetService("@mozilla.org/js/xpc/ContextStack;1", &rv);
-  NS_ENSURE_SUCCESS(rv, nullptr);
-
-  JSContext* cx = stack->GetSafeJSContext();
-  NS_ENSURE_TRUE(cx, nullptr);
-
-  JSAutoRequest ar(cx);
-  JSAutoEnterCompartment ac;
-  if (!ac.enter(cx, obj)) {
-    return nullptr;
-  }
-
-  JSObject* global = JS_GetGlobalForObject(cx, obj);
-  NS_ENSURE_TRUE(global, nullptr);
-
-  nsCOMPtr<nsIXPConnect> xpc(do_GetService(nsIXPConnect::GetCID()));
-  NS_ENSURE_TRUE(xpc, nullptr);
-
-  nsCOMPtr<nsIXPConnectWrappedNative> wrapper;
-  rv = xpc->GetWrappedNativeOfJSObject(cx, global, getter_AddRefs(wrapper));
-  NS_ENSURE_SUCCESS(rv, nullptr);
-
-  nsCOMPtr<nsIDOMWindow> window = do_QueryWrappedNative(wrapper);
-  NS_ENSURE_TRUE(window, nullptr);
-
-  return window.forget();
-}
-
-@interface ObserverPair : NSObject
-{
-@public
-  nsIObserver *observer;
-  nsIDOMWindow *window;
-}
-
-- (id) initWithObserver:(nsIObserver *)aObserver window:(nsIDOMWindow *)aWindow;
-- (void) dealloc;
-
-@end
-
-@implementation ObserverPair
-
-- (id) initWithObserver:(nsIObserver *)aObserver window:(nsIDOMWindow *)aWindow
-{
-  NS_OBJC_BEGIN_TRY_ABORT_BLOCK_NIL;
-
-  if ((self = [super init])) {
-    NS_ADDREF(observer = aObserver);
-    NS_IF_ADDREF(window = aWindow);
-    return self;
-  }
-
-  // Safeguard against calling NS_RELEASE on uninitialized memory.
-  observer = nullptr;
-  window = nullptr;
-
-  return nil;
-
-  NS_OBJC_END_TRY_ABORT_BLOCK_NIL;
-}
-
-- (void) dealloc
-{
-  NS_OBJC_BEGIN_TRY_ABORT_BLOCK;
-
-  NS_IF_RELEASE(observer);
-  NS_IF_RELEASE(window);
-  [super dealloc];
-
-  NS_OBJC_END_TRY_ABORT_BLOCK;
-}
-
-@end
 
 @implementation mozGrowlDelegate
 
diff --git a/toolkit/components/alerts/mac/mozNotificationCenterDelegate.h b/toolkit/components/alerts/mac/mozNotificationCenterDelegate.h
new file mode 100644
index 000000000000..dd6fbb4ccf80
--- /dev/null
+++ b/toolkit/components/alerts/mac/mozNotificationCenterDelegate.h
@@ -0,0 +1,58 @@
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+#import <Cocoa/Cocoa.h>
+
+#include "nscore.h"
+#include "nsStringGlue.h"
+#include "nsNotificationCenterCompat.h"
+
+#define OBSERVER_KEY @"ALERT_OBSERVER"
+#define COOKIE_KEY   @"ALERT_COOKIE"
+
+class nsIObserver;
+class nsIDOMWindow;
+
+@interface mozNotificationCenterDelegate : NSObject <NSUserNotificationCenterDelegate>
+{
+@private
+  PRUint32 mKey;
+  NSMutableDictionary *mObserverDict;
+  id<FakeNSUserNotificationCenter> mCenter;
+}
+
+/**
+ * Dispatches a notification to Notification Center
+ *
+ * @param aTitle  The title of the notification
+ * @param aText   The body of the notification
+ * @param aKey    The observer key to use as a lookup (or 0 if no observer)
+ * @param aCookie The string to be used as a cookie if there is an observer
+ */
+- (void)notifyWithTitle:(const nsAString&)aTitle
+            description:(const nsAString&)aText
+                    key:(PRUint32)aKey
+                 cookie:(const nsAString&)aCookie;
+
+/**
+ * Adds an nsIObserver that we can query later for dispatching obsevers.
+ *
+ * @param aObserver The observer we are adding.
+ * @return The key it was stored in.
+ */
+- (PRUint32)addObserver:(nsIObserver*)aObserver;
+
+/**
+ * Called when a window was closed and the observers are no longer valid.
+ *
+ * @param window The window that was closed.
+ */
+- (void)forgetObserversForWindow:(nsIDOMWindow*)window;
+
+/**
+ * Called when all observers should be released.
+ */
+- (void)forgetObservers;
+
+@end
diff --git a/toolkit/components/alerts/mac/mozNotificationCenterDelegate.mm b/toolkit/components/alerts/mac/mozNotificationCenterDelegate.mm
new file mode 100644
index 000000000000..cd861ff6ab57
--- /dev/null
+++ b/toolkit/components/alerts/mac/mozNotificationCenterDelegate.mm
@@ -0,0 +1,193 @@
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this file,
+ * You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+#import "mozNotificationCenterDelegate.h"
+#import "ObserverPair.h"
+
+#include "nsIObserver.h"
+#include "nsIXULAppInfo.h"
+#include "nsIStringBundle.h"
+#include "nsIDOMWindow.h"
+#include "nsObjCExceptions.h"
+
+// Note that all calls to the Notification Center API are not made normally.
+// We do this to maintain backwards compatibility.
+
+id<FakeNSUserNotificationCenter> GetNotificationCenter() {
+  Class c = NSClassFromString(@"NSUserNotificationCenter");
+  return [c performSelector:@selector(defaultUserNotificationCenter)];
+}
+
+@implementation mozNotificationCenterDelegate
+
+- (id)init
+{
+  NS_OBJC_BEGIN_TRY_ABORT_BLOCK_NIL;
+
+  if ((self = [super init])) {
+    mCenter = [GetNotificationCenter() retain];
+    mKey = 0;
+    mObserverDict = [[NSMutableDictionary dictionaryWithCapacity:8] retain];
+  }
+
+  return self;
+
+  NS_OBJC_END_TRY_ABORT_BLOCK_NIL;
+}
+
+- (void)dealloc
+{
+  NS_OBJC_BEGIN_TRY_ABORT_BLOCK;
+
+  [mObserverDict release];
+  [mCenter release];
+
+  [super dealloc];
+
+  NS_OBJC_END_TRY_ABORT_BLOCK;
+}
+
+-(void) notifyWithTitle:(const nsAString&)aTitle
+            description:(const nsAString&)aText
+                    key:(PRUint32)aKey
+                 cookie:(const nsAString&)aCookie;
+{
+  NS_OBJC_BEGIN_TRY_ABORT_BLOCK;
+
+  Class unClass = NSClassFromString(@"NSUserNotification");
+  id<FakeNSUserNotification> notification = [[unClass alloc] init];
+  notification.title = [NSString stringWithCharacters:aTitle.BeginReading()
+                                               length:aTitle.Length()];
+  notification.informativeText = [NSString stringWithCharacters:aText.BeginReading()
+                                                         length:aText.Length()];
+  NSDictionary* clickContext = nil;
+  if (aKey) {
+    clickContext = [NSDictionary dictionaryWithObjectsAndKeys:
+                    [NSNumber numberWithUnsignedInt:aKey],
+                    OBSERVER_KEY,
+                    [NSArray arrayWithObject:
+                     [NSString stringWithCharacters:aCookie.BeginReading()
+                                             length:aCookie.Length()]],
+                    COOKIE_KEY,
+                    nil];
+  }
+  notification.userInfo = clickContext;
+  notification.soundName = NSUserNotificationDefaultSoundName;
+  notification.hasActionButton = NO;
+
+  [GetNotificationCenter() deliverNotification:notification];
+
+  NS_OBJC_END_TRY_ABORT_BLOCK;
+}
+
+- (PRUint32) addObserver:(nsIObserver *)aObserver
+{
+  NS_OBJC_BEGIN_TRY_ABORT_BLOCK_RETURN;
+
+  nsCOMPtr<nsIDOMWindow> parentWindow = GetWindowOfObserver(aObserver);
+
+  ObserverPair* pair = [[ObserverPair alloc] initWithObserver:aObserver
+                                                       window:parentWindow];
+
+  [mObserverDict setObject:pair forKey:[NSNumber numberWithUnsignedInt:++mKey]];
+
+  [pair release];
+
+  return mKey;
+
+  NS_OBJC_END_TRY_ABORT_BLOCK_RETURN(0);
+}
+
+- (void) forgetObserversForWindow:(nsIDOMWindow*)window
+{
+  NS_OBJC_BEGIN_TRY_ABORT_BLOCK;
+
+  NS_ASSERTION(window, "No window!");
+
+  NSMutableArray *keysToRemove = [NSMutableArray array];
+
+  NSEnumerator *keyEnumerator = [[mObserverDict allKeys] objectEnumerator];
+  NSNumber *key;
+  while ((key = [keyEnumerator nextObject])) {
+    ObserverPair *pair = [mObserverDict objectForKey:key];
+    if (pair && pair->window == window)
+      [keysToRemove addObject:key];
+  }
+
+  [mObserverDict removeObjectsForKeys:keysToRemove];
+
+  NS_OBJC_END_TRY_ABORT_BLOCK;
+}
+
+- (void) forgetObservers
+{
+  NS_OBJC_BEGIN_TRY_ABORT_BLOCK;
+
+  [mObserverDict removeAllObjects];
+
+  NS_OBJC_END_TRY_ABORT_BLOCK;
+}
+
+// Implement NSUserNotificationCenterDelegate
+
+- (void)userNotificationCenter:(id<FakeNSUserNotificationCenter>)center
+        didDeliverNotification:(id<FakeNSUserNotification>)notification
+{
+  NS_OBJC_BEGIN_TRY_ABORT_BLOCK;
+
+  // Internally we have two notifications, "alertclickcallback" and "alertfinished".
+  // Notification Center does not tell us when the alert finished, but we always need
+  // to send alert finished, or otherwise consider it finished in order to free up
+  // observers. This is a conundrum. For now we'll do the unfortunately conservative
+  // thing and not support actions so that we can consistently end alerts when they
+  // are shown.
+
+  NSDictionary* userInfo = notification.userInfo;
+
+  NS_ASSERTION([userInfo valueForKey:OBSERVER_KEY] != nil,
+               "OBSERVER_KEY not found!");
+  NS_ASSERTION([userInfo valueForKey:COOKIE_KEY] != nil,
+               "COOKIE_KEY not found!");
+
+  ObserverPair* pair = [mObserverDict objectForKey:[userInfo valueForKey:OBSERVER_KEY]];
+  nsCOMPtr<nsIObserver> observer = pair ? pair->observer : nullptr;
+  [mObserverDict removeObjectForKey:[userInfo valueForKey:OBSERVER_KEY]];
+
+  if (observer) {
+    NSString* cookie = [[userInfo valueForKey:COOKIE_KEY] objectAtIndex:0];
+
+    nsAutoString tmp;
+    tmp.SetLength([cookie length]);
+    [cookie getCharacters:tmp.BeginWriting()];
+
+    observer->Observe(nullptr, "alertfinished", tmp.get());
+  }
+
+  // We don't want alerts to persist in the notification center because they
+  // are likely to refer to potentially disappearing contexts like a download.
+  //
+  // However, since we don't react to clicks right now, it is OK to let them
+  // persist.
+  //[mCenter removeDeliveredNotification:notification];
+
+  NS_OBJC_END_TRY_ABORT_BLOCK;
+}
+
+- (void)userNotificationCenter:(id<FakeNSUserNotificationCenter>)center
+       didActivateNotification:(id<FakeNSUserNotification>)notification
+{
+  // We don't support activation right now because it'd be sent after
+  // we send 'alertfinished' to observers. This is unfortunate but necessary
+  // because we can't reliably know when a notification is finished, we
+  // can only know when it is shown or activated.
+}
+
+- (BOOL)userNotificationCenter:(id<FakeNSUserNotificationCenter>)center
+     shouldPresentNotification:(id<FakeNSUserNotification>)notification
+{
+  // Respect OS choice.
+  return NO;
+}
+
+@end
diff --git a/toolkit/components/alerts/mac/nsAlertsServiceModule.cpp b/toolkit/components/alerts/mac/nsAlertsServiceModule.cpp
index 81cfc828d591..208e17513ccc 100644
--- a/toolkit/components/alerts/mac/nsAlertsServiceModule.cpp
+++ b/toolkit/components/alerts/mac/nsAlertsServiceModule.cpp
@@ -2,7 +2,7 @@
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
 
-#include "nsGrowlAlertsService.h"
+#include "nsMacAlertsService.h"
 #include "nsToolkitCompsCID.h"
 #include "mozilla/ModuleUtils.h"
 #include "nsCOMPtr.h"
@@ -11,11 +11,11 @@
 #include "nsICategoryManager.h"
 #include "nsMemory.h"
 
-NS_GENERIC_FACTORY_CONSTRUCTOR_INIT(nsGrowlAlertsService, Init)
+NS_GENERIC_FACTORY_CONSTRUCTOR_INIT(nsMacAlertsService, Init)
 NS_DEFINE_NAMED_CID(NS_SYSTEMALERTSSERVICE_CID);
 
 static const mozilla::Module::CIDEntry kAlertsCIDs[] = {
-  { &kNS_SYSTEMALERTSSERVICE_CID, false, NULL, nsGrowlAlertsServiceConstructor },
+  { &kNS_SYSTEMALERTSSERVICE_CID, false, NULL, nsMacAlertsServiceConstructor },
   { NULL }
 };
 
diff --git a/toolkit/components/alerts/mac/nsGrowlAlertsService.mm b/toolkit/components/alerts/mac/nsGrowlAlertsService.mm
deleted file mode 100644
index c579c04e9902..000000000000
--- a/toolkit/components/alerts/mac/nsGrowlAlertsService.mm
+++ /dev/null
@@ -1,222 +0,0 @@
-/* -*- Mode: C++; tab-width: 2; indent-tabs-mode: nil; c-basic-offset: 2 -*-
- * vim: sw=2 ts=2 sts=2 expandtab
- * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
-
-#include "nsGrowlAlertsService.h"
-#include "nsStringAPI.h"
-#include "nsAlertsImageLoadListener.h"
-#include "nsIURI.h"
-#include "nsIStreamLoader.h"
-#include "nsNetUtil.h"
-#include "nsCOMPtr.h"
-#include "nsIStringBundle.h"
-#include "nsIObserverService.h"
-#include "nsAutoPtr.h"
-#include "nsNotificationsList.h"
-#include "nsObjCExceptions.h"
-#include "nsPIDOMWindow.h"
-
-#import "mozGrowlDelegate.h"
-#import "GrowlApplicationBridge.h"
-
-////////////////////////////////////////////////////////////////////////////////
-//// GrowlDelegateWrapper
-
-struct GrowlDelegateWrapper
-{
-  mozGrowlDelegate* delegate;
-
-  GrowlDelegateWrapper()
-  {
-    NS_OBJC_BEGIN_TRY_ABORT_BLOCK;
-
-    delegate = [[mozGrowlDelegate alloc] init];
-
-    NS_OBJC_END_TRY_ABORT_BLOCK;
-  }
-
-  ~GrowlDelegateWrapper()
-  {
-    NS_OBJC_BEGIN_TRY_ABORT_BLOCK;
-
-    [delegate release];
-
-    NS_OBJC_END_TRY_ABORT_BLOCK;
-  }
-};
-
-/**
- * Helper function to dispatch a notification to Growl
- */
-static nsresult
-DispatchNamedNotification(const nsAString &aName,
-                          const nsAString &aImage,
-                          const nsAString &aTitle,
-                          const nsAString &aMessage,
-                          const nsAString &aCookie,
-                          nsIObserver *aListener)
-{
-  NS_OBJC_BEGIN_TRY_ABORT_BLOCK_NSRESULT;
-
-  if ([GrowlApplicationBridge isGrowlRunning] == NO)
-    return NS_ERROR_NOT_AVAILABLE;
-
-  mozGrowlDelegate *delegate =
-    static_cast<mozGrowlDelegate *>([GrowlApplicationBridge growlDelegate]);
-  if (!delegate)
-    return NS_ERROR_NOT_AVAILABLE;
-
-  uint32_t ind = 0;
-  if (aListener)
-    ind = [delegate addObserver: aListener];
-
-  nsCOMPtr<nsIURI> uri;
-  nsresult rv = NS_NewURI(getter_AddRefs(uri), aImage);
-  if (NS_FAILED(rv)) {
-    // image uri failed to resolve, so dispatch to growl with no image
-    [mozGrowlDelegate notifyWithName: aName
-                               title: aTitle
-                         description: aMessage
-                            iconData: [NSData data]
-                                 key: ind
-                              cookie: aCookie];
-    return NS_OK;
-  }
-
-  nsCOMPtr<nsAlertsImageLoadListener> listener =
-    new nsAlertsImageLoadListener(aName, aTitle, aMessage, aCookie, ind);
-  if (!listener)
-    return NS_ERROR_OUT_OF_MEMORY;
-
-  nsCOMPtr<nsIStreamLoader> loader;
-  return NS_NewStreamLoader(getter_AddRefs(loader), uri, listener);
-
-  NS_OBJC_END_TRY_ABORT_BLOCK_NSRESULT;
-}
-
-////////////////////////////////////////////////////////////////////////////////
-//// nsGrowlAlertsService
-
-NS_IMPL_THREADSAFE_ADDREF(nsGrowlAlertsService)
-NS_IMPL_THREADSAFE_RELEASE(nsGrowlAlertsService)
-
-NS_INTERFACE_MAP_BEGIN(nsGrowlAlertsService)
-  NS_INTERFACE_MAP_ENTRY_AMBIGUOUS(nsISupports, nsIAlertsService)
-  NS_INTERFACE_MAP_ENTRY(nsIObserver)
-  NS_INTERFACE_MAP_ENTRY(nsIAlertsService)
-NS_INTERFACE_MAP_END_THREADSAFE
-
-nsresult
-nsGrowlAlertsService::Init()
-{
-  NS_OBJC_BEGIN_TRY_ABORT_BLOCK_NSRESULT;
-
-  NS_ASSERTION([GrowlApplicationBridge growlDelegate] == nil,
-               "We already registered with Growl!");
-
-  nsresult rv;
-  nsCOMPtr<nsIObserverService> os =
-    do_GetService("@mozilla.org/observer-service;1", &rv);
-  NS_ENSURE_SUCCESS(rv, rv);
-
-  nsRefPtr<nsNotificationsList> notifications = new nsNotificationsList();
-
-  if (notifications)
-    (void)os->NotifyObservers(notifications, "before-growl-registration", nullptr);
-
-  mDelegate = new GrowlDelegateWrapper();
-
-  if (notifications)
-    notifications->informController(mDelegate->delegate);
-
-  // registers with Growl
-  [GrowlApplicationBridge setGrowlDelegate: mDelegate->delegate];
-
-  (void)os->AddObserver(this, DOM_WINDOW_DESTROYED_TOPIC, false);
-  (void)os->AddObserver(this, "profile-before-change", false);
-
-  return NS_OK;
-
-  NS_OBJC_END_TRY_ABORT_BLOCK_NSRESULT;
-}
-
-nsGrowlAlertsService::nsGrowlAlertsService() : mDelegate(nullptr) {}
-
-nsGrowlAlertsService::~nsGrowlAlertsService()
-{
-  delete mDelegate;
-}
-
-////////////////////////////////////////////////////////////////////////////////
-//// nsIAlertsService
-
-NS_IMETHODIMP
-nsGrowlAlertsService::ShowAlertNotification(const nsAString& aImageUrl,
-                                            const nsAString& aAlertTitle,
-                                            const nsAString& aAlertText,
-                                            bool aAlertClickable,
-                                            const nsAString& aAlertCookie,
-                                            nsIObserver* aAlertListener,
-                                            const nsAString& aAlertName)
-{
-  NS_OBJC_BEGIN_TRY_ABORT_BLOCK_NSRESULT;
-
-  NS_ASSERTION(mDelegate->delegate == [GrowlApplicationBridge growlDelegate],
-               "Growl Delegate was not registered properly.");
-
-  if (!aAlertName.IsEmpty()) {
-    return DispatchNamedNotification(aAlertName, aImageUrl, aAlertTitle,
-                                     aAlertText, aAlertCookie, aAlertListener);
-  }
-
-  nsresult rv;
-  nsCOMPtr<nsIStringBundleService> bundleService =
-    do_GetService("@mozilla.org/intl/stringbundle;1", &rv);
-
-  // We don't want to fail just yet if we can't get the alert name
-  nsString name = NS_LITERAL_STRING("General Notification");
-  if (NS_SUCCEEDED(rv)) {
-    nsCOMPtr<nsIStringBundle> bundle;
-    rv = bundleService->CreateBundle(GROWL_STRING_BUNDLE_LOCATION,
-                                     getter_AddRefs(bundle));
-    if (NS_SUCCEEDED(rv)) {
-      rv = bundle->GetStringFromName(NS_LITERAL_STRING("general").get(),
-                                     getter_Copies(name));
-      if (NS_FAILED(rv))
-        name = NS_LITERAL_STRING("General Notification");
-    }
-  }
-
-  return DispatchNamedNotification(name, aImageUrl, aAlertTitle,
-                                   aAlertText, aAlertCookie, aAlertListener);
-
-  NS_OBJC_END_TRY_ABORT_BLOCK_NSRESULT;
-}
-
-////////////////////////////////////////////////////////////////////////////////
-//// nsIObserver
-
-NS_IMETHODIMP
-nsGrowlAlertsService::Observe(nsISupports* aSubject, const char* aTopic,
-                              const PRUnichar* aData)
-{
-  NS_OBJC_BEGIN_TRY_ABORT_BLOCK_NSRESULT;
-
-  if (!mDelegate)
-    return NS_OK;
-
-  if (strcmp(aTopic, DOM_WINDOW_DESTROYED_TOPIC) == 0) {
-    nsCOMPtr<nsIDOMWindow> window(do_QueryInterface(aSubject));
-    if (window)
-      [mDelegate->delegate forgetObserversForWindow:window];
-  }
-  else if (strcmp(aTopic, "profile-before-change") == 0) {
-    [mDelegate->delegate forgetObservers];
-  }
-
-  return NS_OK;
-
-  NS_OBJC_END_TRY_ABORT_BLOCK_NSRESULT;
-}
diff --git a/toolkit/components/alerts/mac/nsGrowlAlertsService.h b/toolkit/components/alerts/mac/nsMacAlertsService.h
similarity index 58%
rename from toolkit/components/alerts/mac/nsGrowlAlertsService.h
rename to toolkit/components/alerts/mac/nsMacAlertsService.h
index 02bcead38c4b..e5290ff9735e 100644
--- a/toolkit/components/alerts/mac/nsGrowlAlertsService.h
+++ b/toolkit/components/alerts/mac/nsMacAlertsService.h
@@ -9,20 +9,26 @@
 #include "nsIObserver.h"
 
 struct GrowlDelegateWrapper;
+struct NotificationCenterDelegateWrapper;
 
-class nsGrowlAlertsService : public nsIAlertsService,
-                             public nsIObserver
+class nsMacAlertsService : public nsIAlertsService,
+                           public nsIObserver
 {
 public:
   NS_DECL_ISUPPORTS
   NS_DECL_NSIALERTSSERVICE
   NS_DECL_NSIOBSERVER
 
-  nsGrowlAlertsService();
+  nsMacAlertsService();
   nsresult Init();
+
 private:
-  GrowlDelegateWrapper* mDelegate;
-  virtual ~nsGrowlAlertsService();
+  virtual ~nsMacAlertsService();
+  nsresult InitGrowl();
+  nsresult InitNotificationCenter();
+
+  GrowlDelegateWrapper* mGrowlDelegate;
+  NotificationCenterDelegateWrapper* mNCDelegate;
 };
 
 #endif // nsGrowlAlertsService_h_
diff --git a/toolkit/components/alerts/mac/nsMacAlertsService.mm b/toolkit/components/alerts/mac/nsMacAlertsService.mm
new file mode 100644
index 000000000000..840552d0dae3
--- /dev/null
+++ b/toolkit/components/alerts/mac/nsMacAlertsService.mm
@@ -0,0 +1,344 @@
+/* -*- Mode: C++; tab-width: 2; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
+/* vim: sw=2 ts=2 sts=2 expandtab */
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+#import <CoreServices/CoreServices.h>
+
+#include "nsMacAlertsService.h"
+#include "nsStringAPI.h"
+#include "nsAlertsImageLoadListener.h"
+#include "nsIURI.h"
+#include "nsIStreamLoader.h"
+#include "nsNetUtil.h"
+#include "nsCOMPtr.h"
+#include "nsIStringBundle.h"
+#include "nsIObserverService.h"
+#include "nsAutoPtr.h"
+#include "nsNotificationsList.h"
+#include "nsObjCExceptions.h"
+#include "nsPIDOMWindow.h"
+
+#import "mozGrowlDelegate.h"
+#import "mozNotificationCenterDelegate.h"
+#import "GrowlApplicationBridge.h"
+#import "nsNotificationCenterCompat.h"
+
+////////////////////////////////////////////////////////////////////////////////
+//// GrowlDelegateWrapper
+
+struct GrowlDelegateWrapper
+{
+  mozGrowlDelegate* mDelegate;
+
+  GrowlDelegateWrapper()
+  {
+    NS_OBJC_BEGIN_TRY_ABORT_BLOCK;
+
+    mDelegate = [[mozGrowlDelegate alloc] init];
+
+    NS_OBJC_END_TRY_ABORT_BLOCK;
+  }
+
+  ~GrowlDelegateWrapper()
+  {
+    NS_OBJC_BEGIN_TRY_ABORT_BLOCK;
+
+    [mDelegate release];
+
+    NS_OBJC_END_TRY_ABORT_BLOCK;
+  }
+};
+
+/**
+ * Helper function to dispatch a notification to Growl
+ */
+static nsresult
+DispatchGrowlNotification(const nsAString &aName,
+                          const nsAString &aImage,
+                          const nsAString &aTitle,
+                          const nsAString &aMessage,
+                          const nsAString &aCookie,
+                          nsIObserver *aListener)
+{
+  NS_OBJC_BEGIN_TRY_ABORT_BLOCK_NSRESULT;
+
+  if ([GrowlApplicationBridge isGrowlRunning] == NO) {
+    return NS_ERROR_NOT_AVAILABLE;
+  }
+
+  mozGrowlDelegate *delegate =
+    static_cast<mozGrowlDelegate *>([GrowlApplicationBridge growlDelegate]);
+  if (!delegate) {
+    return NS_ERROR_NOT_AVAILABLE;
+  }
+
+  uint32_t ind = 0;
+  if (aListener) {
+    ind = [delegate addObserver: aListener];
+  }
+
+  nsCOMPtr<nsIURI> uri;
+  nsresult rv = NS_NewURI(getter_AddRefs(uri), aImage);
+  if (NS_FAILED(rv)) {
+    // image uri failed to resolve, so dispatch to growl with no image
+    [mozGrowlDelegate notifyWithName: aName
+                               title: aTitle
+                         description: aMessage
+                            iconData: [NSData data]
+                                 key: ind
+                              cookie: aCookie];
+    return NS_OK;
+  }
+
+  nsCOMPtr<nsAlertsImageLoadListener> listener =
+    new nsAlertsImageLoadListener(aName, aTitle, aMessage, aCookie, ind);
+  if (!listener) {
+    return NS_ERROR_OUT_OF_MEMORY;
+  }
+
+  nsCOMPtr<nsIStreamLoader> loader;
+  return NS_NewStreamLoader(getter_AddRefs(loader), uri, listener);
+
+  NS_OBJC_END_TRY_ABORT_BLOCK_NSRESULT;
+}
+
+////////////////////////////////////////////////////////////////////////////////
+//// NotificationCenterDelegateWrapper
+
+struct NotificationCenterDelegateWrapper
+{
+  mozNotificationCenterDelegate* mDelegate;
+
+  NotificationCenterDelegateWrapper()
+  {
+    NS_OBJC_BEGIN_TRY_ABORT_BLOCK;
+
+    mDelegate = [[mozNotificationCenterDelegate alloc] init];
+    
+    Class c = NSClassFromString(@"NSUserNotificationCenter");
+    id<FakeNSUserNotificationCenter> nc = [c performSelector:@selector(defaultUserNotificationCenter)];
+    nc.delegate = mDelegate;
+
+    NS_OBJC_END_TRY_ABORT_BLOCK;
+  }
+
+  ~NotificationCenterDelegateWrapper()
+  {
+    NS_OBJC_BEGIN_TRY_ABORT_BLOCK;
+
+    Class c = NSClassFromString(@"NSUserNotificationCenter");
+    id<FakeNSUserNotificationCenter> nc = [c performSelector:@selector(defaultUserNotificationCenter)];
+    nc.delegate = nil;
+
+    [mDelegate release];
+
+    NS_OBJC_END_TRY_ABORT_BLOCK;
+  }
+};
+
+static nsresult
+DispatchNCNotification(NotificationCenterDelegateWrapper* aDelegateWrapper,
+                       const nsAString &aTitle,
+                       const nsAString &aMessage,
+                       const nsAString &aCookie,
+                       nsIObserver *aListener)
+{
+  NS_OBJC_BEGIN_TRY_ABORT_BLOCK_NSRESULT;
+
+  mozNotificationCenterDelegate* delegate = aDelegateWrapper->mDelegate;
+
+  if (!delegate) {
+    return NS_ERROR_NOT_AVAILABLE;
+  }
+
+  uint32_t ind = 0;
+  if (aListener) {
+    ind = [delegate addObserver:aListener];
+  }
+
+  // Notification Center doesn't allow images so we'll just drop that
+  [delegate notifyWithTitle:aTitle
+                description:aMessage
+                        key:ind
+                     cookie:aCookie];
+
+  return NS_OK;
+
+  NS_OBJC_END_TRY_ABORT_BLOCK_NSRESULT;
+}
+
+////////////////////////////////////////////////////////////////////////////////
+//// nsMacAlertsService
+
+NS_IMPL_THREADSAFE_ADDREF(nsMacAlertsService)
+NS_IMPL_THREADSAFE_RELEASE(nsMacAlertsService)
+
+NS_INTERFACE_MAP_BEGIN(nsMacAlertsService)
+  NS_INTERFACE_MAP_ENTRY_AMBIGUOUS(nsISupports, nsIAlertsService)
+  NS_INTERFACE_MAP_ENTRY(nsIObserver)
+  NS_INTERFACE_MAP_ENTRY(nsIAlertsService)
+NS_INTERFACE_MAP_END_THREADSAFE
+
+nsresult
+nsMacAlertsService::Init()
+{
+  NS_OBJC_BEGIN_TRY_ABORT_BLOCK_NSRESULT;
+
+  nsresult rv;
+  nsCOMPtr<nsIObserverService> os =
+    do_GetService("@mozilla.org/observer-service;1", &rv);
+  NS_ENSURE_SUCCESS(rv, rv);
+
+  // Only use Growl with OS version < 10.8.
+  SInt32 osVersion = 0;
+  OSErr err = ::Gestalt (gestaltSystemVersion, &osVersion);
+  osVersion &= 0xFFFF; // The system version is in the low order word
+  if ((err != noErr) || (osVersion < 0x00001080)) {
+    rv = InitGrowl();
+  }
+  else {
+    rv = InitNotificationCenter();
+  }
+
+  (void)os->AddObserver(this, DOM_WINDOW_DESTROYED_TOPIC, false);
+  (void)os->AddObserver(this, "profile-before-change", false);
+
+  return NS_OK;
+
+  NS_OBJC_END_TRY_ABORT_BLOCK_NSRESULT;
+}
+
+nsresult
+nsMacAlertsService::InitGrowl() {
+  NS_OBJC_BEGIN_TRY_ABORT_BLOCK_NSRESULT;
+
+  NS_ASSERTION([GrowlApplicationBridge growlDelegate] == nil,
+               "We already registered with Growl!");
+
+  nsresult rv;
+  nsCOMPtr<nsIObserverService> os =
+    do_GetService("@mozilla.org/observer-service;1", &rv);
+  NS_ENSURE_SUCCESS(rv, rv);
+
+  nsRefPtr<nsNotificationsList> notifications = new nsNotificationsList();
+
+  if (notifications) {
+    (void)os->NotifyObservers(notifications, "before-growl-registration", nullptr);
+  }
+
+  mGrowlDelegate = new GrowlDelegateWrapper();
+
+  if (notifications) {
+    notifications->informController(mGrowlDelegate->mDelegate);
+  }
+
+  [GrowlApplicationBridge setGrowlDelegate: mGrowlDelegate->mDelegate];
+
+  return NS_OK;
+
+  NS_OBJC_END_TRY_ABORT_BLOCK_NSRESULT;
+}
+
+nsresult
+nsMacAlertsService::InitNotificationCenter() {
+  mNCDelegate = new NotificationCenterDelegateWrapper();
+  return NS_OK;
+}
+
+nsMacAlertsService::nsMacAlertsService()
+: mGrowlDelegate(nullptr)
+, mNCDelegate(nullptr)
+{}
+
+nsMacAlertsService::~nsMacAlertsService()
+{
+  delete mGrowlDelegate;
+  delete mNCDelegate;
+}
+
+////////////////////////////////////////////////////////////////////////////////
+//// nsIAlertsService
+
+NS_IMETHODIMP
+nsMacAlertsService::ShowAlertNotification(const nsAString& aImageUrl,
+                                            const nsAString& aAlertTitle,
+                                            const nsAString& aAlertText,
+                                            bool aAlertClickable,
+                                            const nsAString& aAlertCookie,
+                                            nsIObserver* aAlertListener,
+                                            const nsAString& aAlertName)
+{
+  NS_OBJC_BEGIN_TRY_ABORT_BLOCK_NSRESULT;
+
+  // Growl requires a few extra steps, like checking that it's registered and
+  // the alert has a name.
+  if (mGrowlDelegate) {
+    NS_ASSERTION(mGrowlDelegate->mDelegate == [GrowlApplicationBridge growlDelegate],
+                 "Growl Delegate was not registered properly.");
+
+    if (!aAlertName.IsEmpty()) {
+      return DispatchGrowlNotification(aAlertName, aImageUrl, aAlertTitle,
+                                       aAlertText, aAlertCookie, aAlertListener);
+    }
+
+    nsresult rv;
+    nsCOMPtr<nsIStringBundleService> bundleService =
+      do_GetService("@mozilla.org/intl/stringbundle;1", &rv);
+
+    // We don't want to fail just yet if we can't get the alert name
+    nsString name = NS_LITERAL_STRING("General Notification");
+    if (NS_SUCCEEDED(rv)) {
+      nsCOMPtr<nsIStringBundle> bundle;
+      rv = bundleService->CreateBundle(GROWL_STRING_BUNDLE_LOCATION,
+                                       getter_AddRefs(bundle));
+      if (NS_SUCCEEDED(rv)) {
+        rv = bundle->GetStringFromName(NS_LITERAL_STRING("general").get(),
+                                       getter_Copies(name));
+        if (NS_FAILED(rv)) {
+          name = NS_LITERAL_STRING("General Notification");
+        }
+      }
+    }
+
+    return DispatchGrowlNotification(name, aImageUrl, aAlertTitle,
+                                     aAlertText, aAlertCookie, aAlertListener);
+  } else {
+    // Notification Center is easy: no image, no name.
+    return DispatchNCNotification(mNCDelegate, aAlertTitle, aAlertText,
+                                  aAlertCookie, aAlertListener);
+  }
+
+  NS_OBJC_END_TRY_ABORT_BLOCK_NSRESULT;
+}
+
+////////////////////////////////////////////////////////////////////////////////
+//// nsIObserver
+
+NS_IMETHODIMP
+nsMacAlertsService::Observe(nsISupports* aSubject, const char* aTopic,
+                              const PRUnichar* aData)
+{
+  NS_OBJC_BEGIN_TRY_ABORT_BLOCK_NSRESULT;
+
+  if (!mGrowlDelegate && !mNCDelegate) {
+    return NS_OK;
+  }
+
+  if (strcmp(aTopic, DOM_WINDOW_DESTROYED_TOPIC) == 0) {
+    nsCOMPtr<nsIDOMWindow> window(do_QueryInterface(aSubject));
+    if (window) {
+      mGrowlDelegate ? [mGrowlDelegate->mDelegate forgetObserversForWindow:window]
+                     : [mNCDelegate->mDelegate forgetObserversForWindow:window];
+    }
+  }
+  else if (strcmp(aTopic, "profile-before-change") == 0) {
+    mGrowlDelegate ? [mGrowlDelegate->mDelegate forgetObservers]
+                   : [mNCDelegate->mDelegate forgetObservers];
+  }
+
+  return NS_OK;
+
+  NS_OBJC_END_TRY_ABORT_BLOCK_NSRESULT;
+}
diff --git a/toolkit/components/alerts/mac/nsNotificationCenterCompat.h b/toolkit/components/alerts/mac/nsNotificationCenterCompat.h
new file mode 100644
index 000000000000..1d3a8c32a2f2
--- /dev/null
+++ b/toolkit/components/alerts/mac/nsNotificationCenterCompat.h
@@ -0,0 +1,54 @@
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this file,
+ * You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+#ifndef NS_NOTIFICATION_CENTER_COMPAT_H
+#define NS_NOTIFICATION_CENTER_COMPAT_H
+
+#import <Cocoa/Cocoa.h>
+
+#if !defined(MAC_OS_X_VERSION_10_8) || (MAC_OS_X_VERSION_MAX_ALLOWED < MAC_OS_X_VERSION_10_8)
+@protocol NSUserNotificationCenterDelegate
+@end
+
+static NSString * const NSUserNotificationDefaultSoundName = @"DefaultSoundName";
+
+enum {
+  NSUserNotificationActivationTypeNone = 0,
+  NSUserNotificationActivationTypeContentsClicked = 1,
+  NSUserNotificationActivationTypeActionButtonClicked = 2
+};
+typedef NSInteger NSUserNotificationActivationType;
+#endif
+
+@protocol FakeNSUserNotification <NSObject>
+@property (copy) NSString* title;
+@property (copy) NSString* subtitle;
+@property (copy) NSString* informativeText;
+@property (copy) NSString* actionButtonTitle;
+@property (copy) NSDictionary* userInfo;
+@property (copy) NSDate* deliveryDate;
+@property (copy) NSTimeZone* deliveryTimeZone;
+@property (copy) NSDateComponents* deliveryRepeatInterval;
+@property (readonly) NSDate* actualDeliveryDate;
+@property (readonly, getter=isPresented) BOOL presented;
+@property (readonly, getter=isRemote) BOOL remote;
+@property (copy) NSString* soundName;
+@property BOOL hasActionButton;
+@property (readonly) NSUserNotificationActivationType activationType;
+@property (copy) NSString *otherButtonTitle;
+@end
+
+@protocol FakeNSUserNotificationCenter <NSObject>
++ (id<FakeNSUserNotificationCenter>)defaultUserNotificationCenter;
+@property (assign) id <NSUserNotificationCenterDelegate> delegate;
+@property (copy) NSArray *scheduledNotifications;
+- (void)scheduleNotification:(id<FakeNSUserNotification>)notification;
+- (void)removeScheduledNotification:(id<FakeNSUserNotification>)notification;
+@property (readonly) NSArray *deliveredNotifications;
+- (void)deliverNotification:(id<FakeNSUserNotification>)notification;
+- (void)removeDeliveredNotification:(id<FakeNSUserNotification>)notification;
+- (void)removeAllDeliveredNotifications;
+@end
+
+#endif
diff --git a/toolkit/components/osfile/tests/mochi/test_osfile_front.xul b/toolkit/components/osfile/tests/mochi/test_osfile_front.xul
index 56b5529d85ec..6cf60592a9df 100644
--- a/toolkit/components/osfile/tests/mochi/test_osfile_front.xul
+++ b/toolkit/components/osfile/tests/mochi/test_osfile_front.xul
@@ -15,9 +15,23 @@
   <![CDATA[
 
 let worker;
+let main = this;
 
 function test() {
   ok(true, "test_osfile_front.xul: Starting test");
+
+  // Test OS.Constants.Path
+
+  Components.classes["@mozilla.org/net/osfileconstantsservice;1"].
+    getService(Components.interfaces.nsIOSFileConstantsService).
+    init();
+  Components.utils.import("resource://gre/modules/Services.jsm");
+
+  is(OS.Constants.Path.tmpDir, Services.dirsvc.get("TmpD", Components.interfaces.nsIFile).path, "OS.Constants.Path.tmpDir is correct");
+  is(OS.Constants.Path.profileDir, Services.dirsvc.get("ProfD", Components.interfaces.nsIFile).path, "OS.Constants.Path.profileDir is correct");
+
+  // Test the OS.File worker
+
   worker = new ChromeWorker("worker_test_osfile_front.js");
   SimpleTest.waitForExplicitFinish();
   ok(true, "test_osfile_front.xul: Chrome worker created");
diff --git a/toolkit/themes/pinstripe/global/arrow/arrow-dn-white.png b/toolkit/themes/pinstripe/global/arrow/arrow-dn-white.png
deleted file mode 100644
index 8a8580779718..000000000000
Binary files a/toolkit/themes/pinstripe/global/arrow/arrow-dn-white.png and /dev/null differ
diff --git a/toolkit/themes/pinstripe/global/arrow/panelarrow-down.png b/toolkit/themes/pinstripe/global/arrow/panelarrow-down.png
deleted file mode 100644
index b56193da15e3..000000000000
Binary files a/toolkit/themes/pinstripe/global/arrow/panelarrow-down.png and /dev/null differ
diff --git a/toolkit/themes/pinstripe/global/arrow/panelarrow-horiz.png b/toolkit/themes/pinstripe/global/arrow/panelarrow-horiz.png
deleted file mode 100644
index 8f783c05d330..000000000000
Binary files a/toolkit/themes/pinstripe/global/arrow/panelarrow-horiz.png and /dev/null differ
diff --git a/toolkit/themes/pinstripe/global/arrow/panelarrow-horizontal.png b/toolkit/themes/pinstripe/global/arrow/panelarrow-horizontal.png
new file mode 100644
index 000000000000..5050ec169f10
Binary files /dev/null and b/toolkit/themes/pinstripe/global/arrow/panelarrow-horizontal.png differ
diff --git a/toolkit/themes/pinstripe/global/arrow/panelarrow-up.png b/toolkit/themes/pinstripe/global/arrow/panelarrow-up.png
deleted file mode 100644
index b30a75f2334d..000000000000
Binary files a/toolkit/themes/pinstripe/global/arrow/panelarrow-up.png and /dev/null differ
diff --git a/toolkit/themes/pinstripe/global/arrow/panelarrow-vertical.png b/toolkit/themes/pinstripe/global/arrow/panelarrow-vertical.png
new file mode 100644
index 000000000000..ea4fb2d0f44a
Binary files /dev/null and b/toolkit/themes/pinstripe/global/arrow/panelarrow-vertical.png differ
diff --git a/toolkit/themes/pinstripe/global/icons/panel-dropmarker.png b/toolkit/themes/pinstripe/global/icons/panel-dropmarker.png
new file mode 100644
index 000000000000..e605e835c75a
Binary files /dev/null and b/toolkit/themes/pinstripe/global/icons/panel-dropmarker.png differ
diff --git a/toolkit/themes/pinstripe/global/jar.mn b/toolkit/themes/pinstripe/global/jar.mn
index 832f22f523ab..8f0612132e97 100644
--- a/toolkit/themes/pinstripe/global/jar.mn
+++ b/toolkit/themes/pinstripe/global/jar.mn
@@ -62,7 +62,6 @@ toolkit.jar:
   skin/classic/global/arrow/arrow-dn-dis.gif                         (arrow/arrow-dn-dis.gif)
   skin/classic/global/arrow/arrow-dn-dis.png                         (arrow/arrow-dn-dis.png)
   skin/classic/global/arrow/arrow-dn-sharp.gif                       (arrow/arrow-dn-sharp.gif)
-  skin/classic/global/arrow/arrow-dn-white.png                       (arrow/arrow-dn-white.png)
   skin/classic/global/arrow/arrow-dn.gif                             (arrow/arrow-dn.gif)
   skin/classic/global/arrow/arrow-dn.png                             (arrow/arrow-dn.png)
   skin/classic/global/arrow/arrow-lft-dis.gif                        (arrow/arrow-lft-dis.gif)
@@ -78,9 +77,8 @@ toolkit.jar:
   skin/classic/global/arrow/arrow-up-dis.gif                         (arrow/arrow-up-dis.gif)
   skin/classic/global/arrow/arrow-up-sharp.gif                       (arrow/arrow-up-sharp.gif)
   skin/classic/global/arrow/arrow-up.gif                             (arrow/arrow-up.gif)
-  skin/classic/global/arrow/panelarrow-up.png                        (arrow/panelarrow-up.png)
-  skin/classic/global/arrow/panelarrow-down.png                      (arrow/panelarrow-down.png)
-  skin/classic/global/arrow/panelarrow-horiz.png                     (arrow/panelarrow-horiz.png)
+  skin/classic/global/arrow/panelarrow-horizontal.png                (arrow/panelarrow-horizontal.png)
+  skin/classic/global/arrow/panelarrow-vertical.png                  (arrow/panelarrow-vertical.png)
   skin/classic/global/checkbox/cbox-check.gif                        (checkbox/cbox-check.gif)
   skin/classic/global/checkbox/cbox-check-dis.gif                    (checkbox/cbox-check-dis.gif)
   skin/classic/global/console/console-error-caret.gif                (console/console-error-caret.gif)
@@ -110,6 +108,7 @@ toolkit.jar:
   skin/classic/global/icons/notfound.png                             (icons/notfound.png)
   skin/classic/global/icons/panebutton-active.png                    (icons/panebutton-active.png)
   skin/classic/global/icons/panebutton-inactive.png                  (icons/panebutton-inactive.png)
+  skin/classic/global/icons/panel-dropmarker.png                     (icons/panel-dropmarker.png)
   skin/classic/global/icons/question-mark.png                        (icons/question-mark.png)
   skin/classic/global/icons/resizer.png                              (icons/resizer.png)
   skin/classic/global/icons/resizer-rtl.png                          (icons/resizer-rtl.png)
diff --git a/toolkit/themes/pinstripe/global/notification.css b/toolkit/themes/pinstripe/global/notification.css
index 293e985b8cdc..89a5ad677ac2 100644
--- a/toolkit/themes/pinstripe/global/notification.css
+++ b/toolkit/themes/pinstripe/global/notification.css
@@ -65,15 +65,11 @@ notification[type="critical"] {
   -moz-appearance: none;
   padding: 0;
   margin: 0 2px;
-  list-style-image: url("chrome://global/skin/notification/close.png");
+  list-style-image: url("chrome://global/skin/icons/close.png");
   border: none;
   -moz-image-region: rect(0, 16px, 16px, 0);
 }
 
-notification[type="warning"] .messageCloseButton {
-  list-style-image: url("chrome://global/skin/icons/close.png");
-}
-
 .messageCloseButton > .toolbarbutton-text {
   display: none;
 }
@@ -115,17 +111,17 @@ notification[type="warning"] .messageCloseButton {
 .popup-notification-menubutton:not([type="menu-button"]),
 .popup-notification-menubutton > .button-menubutton-button,
 .popup-notification-menubutton > .button-menubutton-dropmarker {
-  color: #fff;
-  text-shadow: 0 -1px 0 rgba(0,0,0,.5);
-  border-radius: 12px;
-  border: 1px solid rgba(0,0,0,.65);
-  background: -moz-linear-gradient(rgba(110,110,110,.9), rgba(70,70,70,.9) 49%,
-                                   rgba(50,50,50,.9) 51%, rgba(40,40,40,.9));
-  box-shadow: inset 0 1px 0 rgba(255,255,255,.2),
-              inset 0 0 1px rgba(255,255,255,.1),
-              0 1px 0 rgba(255,255,255,.1);
+  -moz-appearance: none;
+  color: #434343;
+  border-radius: 4px;
+  border: 1px solid #b5b5b5;
+  background: linear-gradient(#fff, #f2f2f2);
+  box-shadow: inset 0 1px rgba(255,255,255,.8),
+              inset 0 0 1px rgba(255,255,255,.25),
+              0 1px rgba(255,255,255,.3);
   background-clip: padding-box;
   background-origin: padding-box;
+  padding: 2px 6px;
 }
 
 .popup-notification-menubutton:not([type="menu-button"]) {
@@ -143,14 +139,11 @@ notification[type="warning"] .messageCloseButton {
 }
 
 .popup-notification-menubutton > .button-menubutton-dropmarker {
-  padding-top: 7px;
-  padding-bottom: 7px;
-  -moz-padding-start: 5px;
-  -moz-padding-end: 8px;
+  padding: 7px 8px;
   margin-top: 0;
   margin-bottom: 0;
   -moz-margin-start: -1px;
-  list-style-image: url("chrome://global/skin/arrow/arrow-dn-white.png");
+  list-style-image: url("chrome://global/skin/icons/panel-dropmarker.png");
 }
 
 .popup-notification-menubutton > .button-menubutton-button:-moz-locale-dir(ltr),
@@ -168,10 +161,7 @@ notification[type="warning"] .messageCloseButton {
 .popup-notification-menubutton:not([type="menu-button"]):hover:active,
 .popup-notification-menubutton > .button-menubutton-button:hover:active,
 .popup-notification-menubutton[open="true"] > .button-menubutton-dropmarker {
-  background: -moz-linear-gradient(rgba(40,40,40,.9), rgba(70,70,70,.9));
-  box-shadow: inset 0 0 3px rgba(0,0,0,.2),
-              inset 0 1px 7px rgba(0,0,0,.4),
-              0 1px 0 rgba(255,255,255,.1);
+  box-shadow: inset 0 1px 4px -3px #000, 0 1px rgba(255, 255, 255, 0.3);
 }
 
 .popup-notification-closebutton {
diff --git a/toolkit/themes/pinstripe/global/popup.css b/toolkit/themes/pinstripe/global/popup.css
index 5164a9b33bca..096ef6f47d8f 100644
--- a/toolkit/themes/pinstripe/global/popup.css
+++ b/toolkit/themes/pinstripe/global/popup.css
@@ -68,43 +68,40 @@ panel[type="arrow"][side="right"] {
 
 .panel-arrowcontent {
   -moz-appearance: none;
-  color: white;
-  background: -moz-linear-gradient(rgba(85,85,85,1), rgba(75,75,75,.97) 5px, rgba(58,58,58,.97) 17px, rgba(43,43,43,.97) 40px, rgba(40,40,40,.97) 80px, rgba(40,40,40,.97));
-  border-radius: 6px;
-  box-shadow: 0 0 0 1px rgba(255,255,255,.15) inset,
+  background: #ededed;
+  border-radius: 5px;
+  box-shadow: 0 0 0 1px rgba(255,255,255,.5) inset,
               0 1px 0 rgba(255,255,255,.05) inset,
               0 0 0 1px rgba(0,0,0,.25);
+  color: #333;
   padding: 16px;
   margin: 1px;
 }
 
-.panel-arrow {
-  opacity: 0.97;
-}
-
 .panel-arrow[side="top"] {
-  list-style-image: url("chrome://global/skin/arrow/panelarrow-up.png");
+  list-style-image: url("chrome://global/skin/arrow/panelarrow-vertical.png");
   margin-left: 6px;
   margin-right: 6px;
   margin-bottom: -2px;
 }
 
 .panel-arrow[side="bottom"] {
-  list-style-image: url("chrome://global/skin/arrow/panelarrow-down.png");
+  list-style-image: url("chrome://global/skin/arrow/panelarrow-vertical.png");
+  -moz-transform: scaleY(-1);
   margin-left: 6px;
   margin-right: 6px;
   margin-top: -2px;
 }
 
 .panel-arrow[side="left"] {
-  list-style-image: url("chrome://global/skin/arrow/panelarrow-horiz.png");
+  list-style-image: url("chrome://global/skin/arrow/panelarrow-horizontal.png");
   margin-top: 6px;
   margin-bottom: 6px;
   margin-right: -2px;
 }
 
 .panel-arrow[side="right"] {
-  list-style-image: url("chrome://global/skin/arrow/panelarrow-horiz.png");
+  list-style-image: url("chrome://global/skin/arrow/panelarrow-horizontal.png");
   transform: scaleX(-1);
   margin-top: 6px;
   margin-bottom: 6px;
diff --git a/toolkit/themes/pinstripe/global/shared.inc b/toolkit/themes/pinstripe/global/shared.inc
index 50b5761aba52..b249489ba8c5 100644
--- a/toolkit/themes/pinstripe/global/shared.inc
+++ b/toolkit/themes/pinstripe/global/shared.inc
@@ -3,11 +3,11 @@
 %define loweredShadow 0 1px rgba(255, 255, 255, .4)
 %define focusRingShadow 0 0 1px -moz-mac-focusring inset, 0 0 4px 1px -moz-mac-focusring, 0 0 1.5px 1px -moz-mac-focusring
 
-%define roundButtonBorder 1px solid rgba(0, 0, 0, .4)
-%define roundButtonBackground -moz-linear-gradient(top, #FFF, #CACACA) repeat-x
-%define roundButtonShadow 0 1px rgba(255, 255, 255, .4)
-%define roundButtonPressedBackground #CCC
-%define roundButtonPressedShadow inset 0 1px 3px rgba(0, 0, 0, .2), 0 1px rgba(255, 255, 255, .4)
+%define roundButtonBorder 1px solid rgba(0,0,0,.35)
+%define roundButtonBackground linear-gradient(#f6f6f6, #e9e9e9)
+%define roundButtonShadow 0 1px rgba(255,255,255,.5), inset 0 1px 1px rgba(255,255,255,.5)
+%define roundButtonPressedBackground #dadada
+%define roundButtonPressedShadow 0 1px rgba(255,255,255,.4), inset 0 1px 3px rgba(0,0,0,.2)
 
 %define scopeBarBackground -moz-linear-gradient(top, #E8E8E8, #D0D0D0) repeat-x
 %define scopeBarSeparatorBorder 1px solid #888
diff --git a/widget/gtk2/nsFilePicker.cpp b/widget/gtk2/nsFilePicker.cpp
index 95456b102034..579d454adf5d 100644
--- a/widget/gtk2/nsFilePicker.cpp
+++ b/widget/gtk2/nsFilePicker.cpp
@@ -35,6 +35,17 @@ using namespace mozilla;
 
 nsIFile *nsFilePicker::mPrevDisplayDirectory = nullptr;
 
+// Some GObject functions expect functions for gpointer arguments.
+// gpointer is void* but C++ doesn't like casting functions to void*.
+template<class T> static inline gpointer
+FuncToGpointer(T aFunction)
+{
+    return reinterpret_cast<gpointer>
+        (reinterpret_cast<uintptr_t>
+         // This cast just provides a warning if T is not a function.
+         (reinterpret_cast<void (*)()>(aFunction)));
+}
+
 // XXXdholbert -- this function is duplicated in nsPrintDialogGTK.cpp
 // and needs to be unified in some generic utility class.
 static GtkWindow *
@@ -177,6 +188,7 @@ NS_IMPL_ISUPPORTS1(nsFilePicker, nsIFilePicker)
 nsFilePicker::nsFilePicker()
   : mMode(nsIFilePicker::modeOpen),
     mSelectedType(0),
+    mRunning(false),
     mAllowURLs(false)
 {
 }
@@ -362,6 +374,25 @@ nsFilePicker::Show(int16_t *aReturn)
 {
   NS_ENSURE_ARG_POINTER(aReturn);
 
+  nsresult rv = Open(nullptr);
+  if (NS_FAILED(rv))
+    return rv;
+
+  while (mRunning) {
+    g_main_context_iteration(nullptr, TRUE);
+  }
+
+  *aReturn = mResult;
+  return NS_OK;
+}
+
+NS_IMETHODIMP
+nsFilePicker::Open(nsIFilePickerShownCallback *aCallback)
+{
+  // Can't show two dialogs concurrently with the same filepicker
+  if (mRunning)
+    return NS_ERROR_NOT_AVAILABLE;
+
   nsXPIDLCString title;
   title.Adopt(ToNewUTF8String(mTitle));
 
@@ -398,8 +429,13 @@ nsFilePicker::Show(int16_t *aReturn)
     g_signal_connect(file_chooser, "update-preview", G_CALLBACK(UpdateFilePreviewWidget), img_preview);
   }
 
-  if (parent_widget && parent_widget->group) {
-    gtk_window_group_add_window(parent_widget->group, GTK_WINDOW(file_chooser));
+  GtkWindow *window = GTK_WINDOW(file_chooser);
+  gtk_window_set_modal(window, TRUE);
+  if (parent_widget) {
+    gtk_window_set_destroy_with_parent(window, TRUE);
+    if (parent_widget->group) {
+      gtk_window_group_add_window(parent_widget->group, window);
+    }
   }
 
   NS_ConvertUTF16toUTF8 defaultName(mDefault);
@@ -475,13 +511,43 @@ nsFilePicker::Show(int16_t *aReturn)
   }
 
   gtk_file_chooser_set_do_overwrite_confirmation(GTK_FILE_CHOOSER(file_chooser), TRUE);
-  gint response = gtk_dialog_run(GTK_DIALOG(file_chooser));
 
+  mRunning = true;
+  mCallback = aCallback;
+  NS_ADDREF_THIS();
+  g_signal_connect(file_chooser, "response", G_CALLBACK(OnResponse), this);
+  g_signal_connect(file_chooser, "destroy", G_CALLBACK(OnDestroy), this);
+  gtk_widget_show(file_chooser);
+
+  return NS_OK;
+}
+
+/* static */ void
+nsFilePicker::OnResponse(GtkWidget* file_chooser, gint response_id,
+                         gpointer user_data)
+{
+  static_cast<nsFilePicker*>(user_data)->
+    Done(file_chooser, response_id);
+}
+
+/* static */ void
+nsFilePicker::OnDestroy(GtkWidget* file_chooser, gpointer user_data)
+{
+  static_cast<nsFilePicker*>(user_data)->
+    Done(file_chooser, GTK_RESPONSE_CANCEL);
+}
+
+void
+nsFilePicker::Done(GtkWidget* file_chooser, gint response)
+{
+  mRunning = false;
+
+  int16_t result;
   switch (response) {
     case GTK_RESPONSE_OK:
     case GTK_RESPONSE_ACCEPT:
     ReadValuesFromFileChooser(file_chooser);
-    *aReturn = nsIFilePicker::returnOK;
+    result = nsIFilePicker::returnOK;
     if (mMode == nsIFilePicker::modeSave) {
       nsCOMPtr<nsIFile> file;
       GetFile(getter_AddRefs(file));
@@ -489,7 +555,7 @@ nsFilePicker::Show(int16_t *aReturn)
         bool exists = false;
         file->Exists(&exists);
         if (exists)
-          *aReturn = nsIFilePicker::returnReplace;
+          result = nsIFilePicker::returnReplace;
       }
     }
     break;
@@ -497,16 +563,32 @@ nsFilePicker::Show(int16_t *aReturn)
     case GTK_RESPONSE_CANCEL:
     case GTK_RESPONSE_CLOSE:
     case GTK_RESPONSE_DELETE_EVENT:
-    *aReturn = nsIFilePicker::returnCancel;
+    result = nsIFilePicker::returnCancel;
     break;
 
     default:
     NS_WARNING("Unexpected response");
-    *aReturn = nsIFilePicker::returnCancel;
+    result = nsIFilePicker::returnCancel;
     break;
   }
 
+  // A "response" signal won't be sent again but "destroy" will be.
+  g_signal_handlers_disconnect_by_func(file_chooser,
+                                       FuncToGpointer(OnDestroy), this);
+
+  // When response_id is GTK_RESPONSE_DELETE_EVENT or when called from
+  // OnDestroy, the widget would be destroyed anyway but it is fine if
+  // gtk_widget_destroy is called more than once.  gtk_widget_destroy has
+  // requests that any remaining references be released, but the reference
+  // count will not be decremented again if GtkWindow's reference has already
+  // been released.
   gtk_widget_destroy(file_chooser);
 
-  return NS_OK;
+  if (mCallback) {
+    mCallback->Done(result);
+    mCallback = nullptr;
+  } else {
+    mResult = result;
+  }
+  NS_RELEASE_THIS();
 }
diff --git a/widget/gtk2/nsFilePicker.h b/widget/gtk2/nsFilePicker.h
index 128487c2d947..be9d8ef721a6 100644
--- a/widget/gtk2/nsFilePicker.h
+++ b/widget/gtk2/nsFilePicker.h
@@ -25,6 +25,7 @@ public:
   NS_DECL_ISUPPORTS
 
   // nsIFilePicker (less what's in nsBaseFilePicker)
+  NS_IMETHOD Open(nsIFilePickerShownCallback *aCallback);
   NS_IMETHODIMP AppendFilters(int32_t aFilterMask);
   NS_IMETHODIMP AppendFilter(const nsAString& aTitle, const nsAString& aFilter);
   NS_IMETHODIMP SetDefaultString(const nsAString& aString);
@@ -38,6 +39,7 @@ public:
   NS_IMETHODIMP GetFiles(nsISimpleEnumerator **aFiles);
   NS_IMETHODIMP Show(int16_t *aReturn);
 
+  // nsBaseFilePicker
   virtual void InitNative(nsIWidget *aParent, const nsAString& aTitle, int16_t aMode);
 
   static void Shutdown();
@@ -46,11 +48,19 @@ protected:
 
   void ReadValuesFromFileChooser(GtkWidget *file_chooser);
 
+  static void OnResponse(GtkWidget* dialog, gint response_id,
+                         gpointer user_data);
+  static void OnDestroy(GtkWidget* dialog, gpointer user_data);
+  void Done(GtkWidget* dialog, gint response_id);
+
   nsCOMPtr<nsIWidget>    mParentWidget;
+  nsCOMPtr<nsIFilePickerShownCallback> mCallback;
   nsCOMArray<nsIFile> mFiles;
 
   int16_t   mMode;
   int16_t   mSelectedType;
+  int16_t   mResult;
+  bool      mRunning;
   bool      mAllowURLs;
   nsCString mFileURL;
   nsString  mTitle;
diff --git a/widget/qt/nsNativeThemeQt.cpp b/widget/qt/nsNativeThemeQt.cpp
index 574661bef169..d0dc560a62a8 100644
--- a/widget/qt/nsNativeThemeQt.cpp
+++ b/widget/qt/nsNativeThemeQt.cpp
@@ -25,7 +25,6 @@
 #include "nsThemeConstants.h"
 #include "nsIServiceManager.h"
 #include "nsIDOMHTMLInputElement.h"
-#include <malloc.h>
 
 
 #include "gfxASurface.h"
diff --git a/widget/qt/nsSound.cpp b/widget/qt/nsSound.cpp
index 3e9ccb7997b4..7b770cc75bc5 100644
--- a/widget/qt/nsSound.cpp
+++ b/widget/qt/nsSound.cpp
@@ -7,6 +7,7 @@
 #include <QApplication>
 
 #include <string.h>
+#include <unistd.h>
 
 #include "nscore.h"
 #include "plstr.h"
diff --git a/xpcom/idl-parser/header.py b/xpcom/idl-parser/header.py
index 5ce29d6d7d62..fbf824bab0e9 100644
--- a/xpcom/idl-parser/header.py
+++ b/xpcom/idl-parser/header.py
@@ -138,6 +138,11 @@ jspubtd_include = """
 #include "jspubtd.h"
 """
 
+infallible_includes = """
+#include "mozilla/Assertions.h"
+#include "mozilla/Util.h"
+"""
+
 header_end = """/* For IDL files that don't want to include root IDL files. */
 #ifndef NS_NO_VTABLE
 #define NS_NO_VTABLE
@@ -170,6 +175,13 @@ def print_header(idl, fd, filename):
     if idl.needsJSTypes():
         fd.write(jspubtd_include)
 
+    # Include some extra files if any attributes are infallible.
+    for iface in [p for p in idl.productions if p.kind == 'interface']:
+        for attr in [m for m in iface.members if isinstance(m, xpidl.Attribute)]:
+            if attr.infallible:
+                fd.write(infallible_includes)
+                break
+
     fd.write('\n')
     fd.write(header_end)
 
@@ -280,6 +292,16 @@ iface_template_epilog = """/* End of implementation class template. */
 
 """
 
+attr_infallible_tmpl = """\
+  inline %(realtype)s%(nativename)s(%(args)s)
+  {
+    %(realtype)sresult;
+    mozilla::DebugOnly<nsresult> rv = %(nativename)s(%(argnames)s&result);
+    MOZ_ASSERT(NS_SUCCEEDED(rv));
+    return result;
+  }
+"""
+
 def write_interface(iface, fd):
     if iface.namemap is None:
         raise Exception("Interface was not resolved.")
@@ -310,6 +332,13 @@ def write_interface(iface, fd):
         fd.write("  /* %s */\n" % a.toIDL());
 
         fd.write("  %s = 0;\n" % attributeAsNative(a, True))
+        if a.infallible:
+            fd.write(attr_infallible_tmpl %
+                     {'realtype': a.realtype.nativeType('in'),
+                      'nativename': attributeNativeName(a, getter=True),
+                      'args': '' if not a.implicit_jscontext else 'JSContext* cx',
+                      'argnames': '' if not a.implicit_jscontext else 'cx, '})
+
         if not a.readonly:
             fd.write("  %s = 0;\n" % attributeAsNative(a, False))
         fd.write("\n")
diff --git a/xpcom/idl-parser/xpidl.py b/xpcom/idl-parser/xpidl.py
index 867d1f72744e..25d19f475ae9 100644
--- a/xpcom/idl-parser/xpidl.py
+++ b/xpcom/idl-parser/xpidl.py
@@ -715,6 +715,7 @@ class Attribute(object):
     undefined = None
     deprecated = False
     nullable = False
+    infallible = False
     defvalue = None
 
     def __init__(self, type, name, attlist, readonly, nullable, defvalue, location, doccomments):
@@ -770,6 +771,8 @@ class Attribute(object):
                     self.deprecated = True
                 elif name == 'nostdcall':
                     self.nostdcall = True
+                elif name == 'infallible':
+                    self.infallible = True
                 else:
                     raise IDLError("Unexpected attribute '%s'" % name, aloc)
 
@@ -788,6 +791,15 @@ class Attribute(object):
             getBuiltinOrNativeTypeName(self.realtype) != '[domstring]'):
             raise IDLError("Nullable types (T?) is supported only for DOMString",
                            self.location)
+        if self.infallible and not self.realtype.kind == 'builtin':
+            raise IDLError('[infallible] only works on builtin types '
+                           '(numbers, bool, and raw char types)',
+                           self.location)
+        if self.infallible and not iface.attributes.builtinclass:
+            raise IDLError('[infallible] attributes are only allowed on '
+                           '[builtinclass] interfaces',
+                           self.location)
+
 
     def toIDL(self):
         attribs = attlistToIDL(self.attlist)
diff --git a/xpfe/appshell/src/nsContentTreeOwner.cpp b/xpfe/appshell/src/nsContentTreeOwner.cpp
index a7b6be4827b4..f325cf10aa4d 100644
--- a/xpfe/appshell/src/nsContentTreeOwner.cpp
+++ b/xpfe/appshell/src/nsContentTreeOwner.cpp
@@ -848,12 +848,7 @@ nsContentTreeOwner::ProvideWindow(nsIDOMWindow* aParent,
   // open a modal-type window, we're going to create a new <iframe mozbrowser>
   // and return its window here.
   nsCOMPtr<nsIDocShell> docshell = do_GetInterface(aParent);
-  bool isInContentBoundary = false;
-  if (docshell) {
-    docshell->GetIsBelowContentBoundary(&isInContentBoundary);
-  }
-
-  if (isInContentBoundary &&
+  if (docshell && docshell->GetIsBelowContentBoundary() &&
       !(aChromeFlags & (nsIWebBrowserChrome::CHROME_MODAL |
                         nsIWebBrowserChrome::CHROME_OPENAS_DIALOG |
                         nsIWebBrowserChrome::CHROME_OPENAS_CHROME))) {