diff --git a/accessible/jsat/AccessFu.css b/accessible/jsat/AccessFu.css
index 89514de60a1e..10b91a3472c3 100644
--- a/accessible/jsat/AccessFu.css
+++ b/accessible/jsat/AccessFu.css
@@ -9,9 +9,14 @@
   display: none;
   border-radius: 2px;
   box-shadow: 1px 1px 1px #444;
+  display: none;
 }
 
-#virtual-cursor-inset {
+#virtual-cursor-box.show {
+  display: block;
+}
+
+#virtual-cursor-box > div {
   border-radius: 1px;
   box-shadow: inset 1px 1px 1px #444;
   display: block;
diff --git a/accessible/jsat/AccessFu.jsm b/accessible/jsat/AccessFu.jsm
index 8fa83f35df79..3e738863dbba 100644
--- a/accessible/jsat/AccessFu.jsm
+++ b/accessible/jsat/AccessFu.jsm
@@ -394,23 +394,19 @@ this.AccessFu = { // jshint ignore:line
   _processedMessageManagers: [],
 
   /**
-   * Adjusts the given bounds relative to the given browser. Converts from
-   * screen or device pixels to either device or CSS pixels.
+   * Adjusts the given bounds relative to the given browser.
    * @param {Rect} aJsonBounds the bounds to adjust
    * @param {browser} aBrowser the browser we want the bounds relative to
    * @param {bool} aToCSSPixels whether to convert to CSS pixels (as opposed to
    *               device pixels)
-   * @param {bool} aFromDevicePixels whether to convert from device pixels (as
-   *               opposed to screen pixels)
    */
   adjustContentBounds:
-    function(aJsonBounds, aBrowser, aToCSSPixels, aFromDevicePixels) {
+    function(aJsonBounds, aBrowser, aToCSSPixels) {
       let bounds = new Rect(aJsonBounds.left, aJsonBounds.top,
                             aJsonBounds.right - aJsonBounds.left,
                             aJsonBounds.bottom - aJsonBounds.top);
       let win = Utils.win;
       let dpr = win.devicePixelRatio;
-      let vp = Utils.getViewport(win);
       let offset = { left: -win.mozInnerScreenX, top: -win.mozInnerScreenY };
 
       if (!aBrowser.contentWindow) {
@@ -421,16 +417,6 @@ this.AccessFu = { // jshint ignore:line
         offset.left += clientRect.left + win.mozInnerScreenX;
         offset.top += clientRect.top + win.mozInnerScreenY;
       }
-
-      // Here we scale from screen pixels to layout device pixels by dividing by
-      // the resolution (caused by pinch-zooming). The resolution is the
-      // viewport zoom divided by the devicePixelRatio. If there's no viewport,
-      // then we're on a platform without pinch-zooming and we can just ignore
-      // this.
-      if (!aFromDevicePixels && vp) {
-        bounds = bounds.scale(vp.zoom / dpr, vp.zoom / dpr);
-      }
-
       // Add the offset; the offset is in CSS pixels, so multiply the
       // devicePixelRatio back in before adding to preserve unit consistency.
       bounds = bounds.translate(offset.left * dpr, offset.top * dpr);
@@ -545,11 +531,10 @@ var Output = {
           highlightBox.id = 'virtual-cursor-box';
 
           // Add highlight inset for inner shadow
-          let inset = Utils.win.document.
-            createElementNS('http://www.w3.org/1999/xhtml', 'div');
-          inset.id = 'virtual-cursor-inset';
+          highlightBox.appendChild(
+            Utils.win.document.createElementNS(
+              'http://www.w3.org/1999/xhtml', 'div'));
 
-          highlightBox.appendChild(inset);
           this.highlightBox = Cu.getWeakReference(highlightBox);
         } else {
           highlightBox = this.highlightBox.get();
@@ -559,12 +544,12 @@ var Output = {
         let r = AccessFu.adjustContentBounds(aDetail.bounds, aBrowser, true);
 
         // First hide it to avoid flickering when changing the style.
-        highlightBox.style.display = 'none';
+        highlightBox.classList.remove('show');
         highlightBox.style.top = (r.top - padding) + 'px';
         highlightBox.style.left = (r.left - padding) + 'px';
         highlightBox.style.width = (r.width + padding*2) + 'px';
         highlightBox.style.height = (r.height + padding*2) + 'px';
-        highlightBox.style.display = 'block';
+        highlightBox.classList.add('show');
 
         break;
       }
@@ -572,7 +557,7 @@ var Output = {
       {
         let highlightBox = this.highlightBox ? this.highlightBox.get() : null;
         if (highlightBox) {
-          highlightBox.style.display = 'none';
+          highlightBox.classList.remove('show');
         }
         break;
       }
@@ -889,8 +874,7 @@ var Input = {
   activateContextMenu: function activateContextMenu(aDetails) {
     if (Utils.MozBuildApp === 'mobile/android') {
       let p = AccessFu.adjustContentBounds(aDetails.bounds,
-                                           Utils.CurrentBrowser,
-                                           true, true).center();
+                                           Utils.CurrentBrowser, true).center();
       Services.obs.notifyObservers(null, 'Gesture:LongPress',
                                    JSON.stringify({x: p.x, y: p.y}));
     }
@@ -915,8 +899,8 @@ var Input = {
   doScroll: function doScroll(aDetails) {
     let horizontal = aDetails.horizontal;
     let page = aDetails.page;
-    let p = AccessFu.adjustContentBounds(aDetails.bounds, Utils.CurrentBrowser,
-                                         true, true).center();
+    let p = AccessFu.adjustContentBounds(
+      aDetails.bounds, Utils.CurrentBrowser, true).center();
     Utils.winUtils.sendWheelEvent(p.x, p.y,
       horizontal ? page : 0, horizontal ? 0 : page, 0,
       Utils.win.WheelEvent.DOM_DELTA_PAGE, 0, 0, 0, 0);
diff --git a/accessible/jsat/Utils.jsm b/accessible/jsat/Utils.jsm
index 57ab6c5176d3..2ef4a2dfe83a 100644
--- a/accessible/jsat/Utils.jsm
+++ b/accessible/jsat/Utils.jsm
@@ -255,15 +255,6 @@ this.Utils = { // jshint ignore:line
     }
   },
 
-  getViewport: function getViewport(aWindow) {
-    switch (this.MozBuildApp) {
-      case 'mobile/android':
-        return aWindow.BrowserApp.selectedTab.getViewport();
-      default:
-        return null;
-    }
-  },
-
   getState: function getState(aAccessibleOrEvent) {
     if (aAccessibleOrEvent instanceof Ci.nsIAccessibleStateChangeEvent) {
       return new State(
@@ -302,18 +293,37 @@ this.Utils = { // jshint ignore:line
     return doc.QueryInterface(Ci.nsIAccessibleDocument).virtualCursor;
   },
 
-  getBounds: function getBounds(aAccessible) {
-      let objX = {}, objY = {}, objW = {}, objH = {};
-      aAccessible.getBounds(objX, objY, objW, objH);
-      return new Rect(objX.value, objY.value, objW.value, objH.value);
+  getContentResolution: function _getContentResolution(aAccessible) {
+    let resX = { value: 1 }, resY = { value: 1 };
+    aAccessible.document.window.QueryInterface(
+      Ci.nsIInterfaceRequestor).getInterface(
+      Ci.nsIDOMWindowUtils).getResolution(resX, resY);
+    return [resX.value, resY.value];
   },
 
-  getTextBounds: function getTextBounds(aAccessible, aStart, aEnd) {
-      let accText = aAccessible.QueryInterface(Ci.nsIAccessibleText);
-      let objX = {}, objY = {}, objW = {}, objH = {};
-      accText.getRangeExtents(aStart, aEnd, objX, objY, objW, objH,
-        Ci.nsIAccessibleCoordinateType.COORDTYPE_SCREEN_RELATIVE);
-      return new Rect(objX.value, objY.value, objW.value, objH.value);
+  getBounds: function getBounds(aAccessible, aPreserveContentScale) {
+    let objX = {}, objY = {}, objW = {}, objH = {};
+    aAccessible.getBounds(objX, objY, objW, objH);
+
+    let [scaleX, scaleY] = aPreserveContentScale ? [1, 1] :
+      this.getContentResolution(aAccessible);
+
+    return new Rect(objX.value, objY.value, objW.value, objH.value).scale(
+      scaleX, scaleY);
+  },
+
+  getTextBounds: function getTextBounds(aAccessible, aStart, aEnd,
+                                        aPreserveContentScale) {
+    let accText = aAccessible.QueryInterface(Ci.nsIAccessibleText);
+    let objX = {}, objY = {}, objW = {}, objH = {};
+    accText.getRangeExtents(aStart, aEnd, objX, objY, objW, objH,
+      Ci.nsIAccessibleCoordinateType.COORDTYPE_SCREEN_RELATIVE);
+
+    let [scaleX, scaleY] = aPreserveContentScale ? [1, 1] :
+      this.getContentResolution(aAccessible);
+
+    return new Rect(objX.value, objY.value, objW.value, objH.value).scale(
+      scaleX, scaleY);
   },
 
   /**
diff --git a/accessible/jsat/content-script.js b/accessible/jsat/content-script.js
index 1dd0d4cd2b9b..c9a991aa5fd4 100644
--- a/accessible/jsat/content-script.js
+++ b/accessible/jsat/content-script.js
@@ -65,14 +65,10 @@ function forwardToChild(aMessage, aListener, aVCPosition) {
 }
 
 function activateContextMenu(aMessage) {
-  function sendContextMenuCoordinates(aAccessible) {
-    let bounds = Utils.getBounds(aAccessible);
-    sendAsyncMessage('AccessFu:ActivateContextMenu', {bounds: bounds});
-  }
-
   let position = Utils.getVirtualCursor(content.document).position;
   if (!forwardToChild(aMessage, activateContextMenu, position)) {
-    sendContextMenuCoordinates(position);
+    sendAsyncMessage('AccessFu:ActivateContextMenu',
+      { bounds: Utils.getBounds(position, true) });
   }
 }
 
@@ -85,16 +81,12 @@ function presentCaretChange(aText, aOldOffset, aNewOffset) {
 }
 
 function scroll(aMessage) {
-  function sendScrollCoordinates(aAccessible) {
-    let bounds = Utils.getBounds(aAccessible);
-    sendAsyncMessage('AccessFu:DoScroll',
-                     { bounds: bounds,
-                       page: aMessage.json.page,
-                       horizontal: aMessage.json.horizontal });
-  }
-
   let position = Utils.getVirtualCursor(content.document).position;
   if (!forwardToChild(aMessage, scroll, position)) {
+    sendAsyncMessage('AccessFu:DoScroll',
+                     { bounds: Utils.getBounds(position, true),
+                       page: aMessage.json.page,
+                       horizontal: aMessage.json.horizontal });
     sendScrollCoordinates(position);
   }
 }
diff --git a/addon-sdk/source/lib/toolkit/loader.js b/addon-sdk/source/lib/toolkit/loader.js
index d2b17a1ab038..02370f8bdce7 100644
--- a/addon-sdk/source/lib/toolkit/loader.js
+++ b/addon-sdk/source/lib/toolkit/loader.js
@@ -407,18 +407,18 @@ const nodeResolve = iced(function nodeResolve(id, requirer, { rootURI }) {
   let fullId = join(rootURI, id);
 
   let resolvedPath;
-  if (resolvedPath = loadAsFile(fullId))
+  if ((resolvedPath = loadAsFile(fullId)))
     return stripBase(rootURI, resolvedPath);
-  else if (resolvedPath = loadAsDirectory(fullId))
+  else if ((resolvedPath = loadAsDirectory(fullId)))
     return stripBase(rootURI, resolvedPath);
   // If manifest has dependencies, attempt to look up node modules
   // in the `dependencies` list
   else {
     let dirs = getNodeModulePaths(dirname(join(rootURI, requirer))).map(dir => join(dir, id));
     for (let i = 0; i < dirs.length; i++) {
-      if (resolvedPath = loadAsFile(dirs[i]))
+      if ((resolvedPath = loadAsFile(dirs[i])))
         return stripBase(rootURI, resolvedPath);
-      if (resolvedPath = loadAsDirectory(dirs[i]))
+      if ((resolvedPath = loadAsDirectory(dirs[i])))
         return stripBase(rootURI, resolvedPath);
     }
   }
@@ -459,7 +459,7 @@ function loadAsDirectory (path) {
     let main = getManifestMain(JSON.parse(readURI(path + '/package.json')));
     if (main != null) {
       let tmpPath = join(path, main);
-      if (found = loadAsFile(tmpPath))
+      if ((found = loadAsFile(tmpPath)))
         return found
     }
     try {
diff --git a/b2g/chrome/content/shell.js b/b2g/chrome/content/shell.js
index 9eb3444fddce..147326a5034b 100644
--- a/b2g/chrome/content/shell.js
+++ b/b2g/chrome/content/shell.js
@@ -1201,8 +1201,7 @@ const kTransferContractId = "@mozilla.org/transfer;1";
 
 // Override Toolkit's nsITransfer implementation with the one from the
 // JavaScript API for downloads.  This will eventually be removed when
-// nsIDownloadManager will not be available anymore (bug 851471).  The
-// old code in this module will be removed in bug 899110.
+// nsIDownloadManager will not be available anymore (bug 851471).
 Components.manager.QueryInterface(Ci.nsIComponentRegistrar)
                   .registerFactory(kTransferCid, "",
                                    kTransferContractId, null);
diff --git a/browser/app/profile/firefox.js b/browser/app/profile/firefox.js
index a15e38aeaa59..24d083f129ca 100644
--- a/browser/app/profile/firefox.js
+++ b/browser/app/profile/firefox.js
@@ -980,7 +980,11 @@ pref("browser.safebrowsing.reportMalwareURL", "http://%LOCALE%.malware-report.mo
 pref("browser.safebrowsing.reportMalwareErrorURL", "http://%LOCALE%.malware-error.mozilla.com/?hl=%LOCALE%");
 
 pref("browser.safebrowsing.malware.reportURL", "https://safebrowsing.google.com/safebrowsing/diagnostic?client=%NAME%&hl=%LOCALE%&site=");
+
+// Turn off remote lookups in beta and stable channel.
+#ifndef RELEASE_BUILD
 pref("browser.safebrowsing.appRepURL", "https://sb-ssl.google.com/safebrowsing/clientreport/download?key=%GOOGLE_API_KEY%");
+#endif
 
 #ifdef MOZILLA_OFFICIAL
 // Normally the "client ID" sent in updates is appinfo.name, but for
diff --git a/browser/base/content/browser.js b/browser/base/content/browser.js
index de7685e242d5..1f5fecc12faf 100644
--- a/browser/base/content/browser.js
+++ b/browser/base/content/browser.js
@@ -438,6 +438,13 @@ var gPopupBlockerObserver = {
       // Hide the icon in the location bar (if the location bar exists)
       if (gURLBar)
         this._reportButton.hidden = true;
+
+      // Hide the notification box (if it's visible).
+      var notificationBox = gBrowser.getNotificationBox();
+      var notification = notificationBox.getNotificationWithValue("popup-blocked");
+      if (notification) {
+        notificationBox.removeNotification(notification, false);
+      }
       return;
     }
 
diff --git a/browser/devtools/shared/AppCacheUtils.jsm b/browser/devtools/shared/AppCacheUtils.jsm
index 894be888bd6c..49c9630d1f2d 100644
--- a/browser/devtools/shared/AppCacheUtils.jsm
+++ b/browser/devtools/shared/AppCacheUtils.jsm
@@ -293,7 +293,14 @@ AppCacheUtils.prototype = {
   },
 
   clearAll: function ACU_clearAll() {
-    Services.cache.evictEntries(Ci.nsICache.STORE_OFFLINE);
+    if (!Services.prefs.getBoolPref("browser.cache.disk.enable")) {
+      throw new Error(l10n.GetStringFromName("cacheDisabled"));
+    }
+
+    let appCacheStorage = Services.cache2.appCacheStorage(LoadContextInfo.default, null);
+    appCacheStorage.asyncEvictStorage({
+      onCacheEntryDoomed: function(result) {}
+    });
   },
 
   _getManifestURI: function ACU__getManifestURI() {
diff --git a/browser/devtools/styleinspector/test/browser_computedview_select-and-copy-styles.js b/browser/devtools/styleinspector/test/browser_computedview_select-and-copy-styles.js
index 294ee97287d4..b7e030d94314 100644
--- a/browser/devtools/styleinspector/test/browser_computedview_select-and-copy-styles.js
+++ b/browser/devtools/styleinspector/test/browser_computedview_select-and-copy-styles.js
@@ -15,7 +15,7 @@ let test = asyncTest(function*() {
 
   info("Creating the test document");
   content.document.body.innerHTML = '<style type="text/css"> ' +
-    'span { font-variant: small-caps; color: #000000; } ' +
+    'span { font-variant-caps: small-caps; color: #000000; } ' +
     '.nomatches {color: #ff0000;}</style> <div id="first" style="margin: 10em; ' +
     'font-size: 14pt; font-family: helvetica, sans-serif; color: #AAA">\n' +
     '<h1>Some header text</h1>\n' +
@@ -58,7 +58,7 @@ function checkCopySelection(view) {
 
   let expectedPattern = "font-family: helvetica,sans-serif;[\\r\\n]+" +
                         "font-size: 16px;[\\r\\n]+" +
-                        "font-variant: small-caps;[\\r\\n]*";
+                        "font-variant-caps: small-caps;[\\r\\n]*";
 
   return waitForClipboard(() => {
     fireCopyEvent(props[0]);
@@ -80,7 +80,7 @@ function checkSelectAll(view) {
   let expectedPattern = "color: #FF0;[\\r\\n]+" +
                         "font-family: helvetica,sans-serif;[\\r\\n]+" +
                         "font-size: 16px;[\\r\\n]+" +
-                        "font-variant: small-caps;[\\r\\n]*";
+                        "font-variant-caps: small-caps;[\\r\\n]*";
 
   return waitForClipboard(() => {
     fireCopyEvent(prop);
diff --git a/browser/installer/package-manifest.in b/browser/installer/package-manifest.in
index 3eef152bc430..2ec4f3481f73 100644
--- a/browser/installer/package-manifest.in
+++ b/browser/installer/package-manifest.in
@@ -816,6 +816,7 @@ bin/libfreebl_32int64_3.so
 @BINPATH@/webapprt/components/PaymentUIGlue.js
 @BINPATH@/webapprt/components/components.manifest
 @BINPATH@/webapprt/defaults/preferences/prefs.js
+@BINPATH@/webapprt/modules/DownloadView.jsm
 @BINPATH@/webapprt/modules/Startup.jsm
 @BINPATH@/webapprt/modules/WebappRT.jsm
 @BINPATH@/webapprt/modules/WebappManager.jsm
diff --git a/build/sanitizers/lsan_suppressions.txt b/build/sanitizers/lsan_suppressions.txt
index e5e1e381861f..c075a2bfa52c 100644
--- a/build/sanitizers/lsan_suppressions.txt
+++ b/build/sanitizers/lsan_suppressions.txt
@@ -28,12 +28,43 @@ leak:GI___strdup
 
 
 ###
-### Many leaks only affect some test suites.  The suite annotations are not checked.
+### Bug 979928 - WebRTC leaks. m2, m3.
 ###
 
-# Bug 979928 - WebRTC is leaky. m2, m3
-leak:/media/mtransport/
-leak:/media/webrtc/signaling/
+# WebRTC leaks added for Mochitest 2.
+leak:NR_reg_init
+leak:fsmdef_init
+leak:r_log_register
+leak:nr_reg_set
+leak:ccsnap_device_init
+leak:ccsnap_line_init
+leak:media/webrtc/signaling/src/sipcc/core/common/init.c
+leak:cprPostMessage
+leak:mozilla::NrIceStunServer::Create
+
+# Additional WebRTC leak suppressions added for Mochitest 3.
+leak:mozilla::TransportLayerDtls::Setup
+leak:mozilla::NrIceTurnServer::Create
+# There are about 228KB of leaks from the call to |pmsg->sdp = cpr_malloc(sdp_size);|
+# in send_message_helper.
+leak:send_message_helper
+leak:fsmdef_ev_createoffer
+leak:fsmdef_ev_setremotedesc
+leak:fsmdef_ev_setlocaldesc
+leak:fsmdef_ev_createanswer
+# About 70KB of leaks under this stack.
+leak:vcmRxAllocICE_s
+leak:vcmRxStartICE_m
+# About 50KB of leaks under this stack.
+leak:ccsnap_EscapeStrToLocaleStr
+leak:gsmsdp_add_default_audio_formats_to_local_sdp
+leak:gsmsdp_add_default_video_formats_to_local_sdp
+leak:CCAPI_CallInfo_getMediaStreams
+
+
+###
+### Many leaks only affect some test suites.  The suite annotations are not checked.
+###
 
 # Bug 981195 - Small leak in the parser. m4
 leak:TypeCompartment::fixObjectType
diff --git a/content/base/public/Element.h b/content/base/public/Element.h
index 881ec04ce43d..3944913c5d3e 100644
--- a/content/base/public/Element.h
+++ b/content/base/public/Element.h
@@ -728,7 +728,7 @@ public:
   int32_t ScrollTop()
   {
     nsIScrollableFrame* sf = GetScrollFrame();
-    return sf ? sf->GetScrollPositionCSSPixels().y : 0;
+    return sf ? sf->GetScrollPositionCSSPixels().y.value : 0;
   }
   void SetScrollTop(int32_t aScrollTop)
   {
@@ -741,7 +741,7 @@ public:
   int32_t ScrollLeft()
   {
     nsIScrollableFrame* sf = GetScrollFrame();
-    return sf ? sf->GetScrollPositionCSSPixels().x : 0;
+    return sf ? sf->GetScrollPositionCSSPixels().x.value : 0;
   }
   void SetScrollLeft(int32_t aScrollLeft)
   {
diff --git a/content/base/public/nsContentUtils.h b/content/base/public/nsContentUtils.h
index be418e725b86..8297817083ac 100644
--- a/content/base/public/nsContentUtils.h
+++ b/content/base/public/nsContentUtils.h
@@ -405,15 +405,6 @@ public:
   static bool CanCallerAccess(nsPIDOMWindow* aWindow);
 
   /**
-   * Get the window through the JS context that's currently on the stack.
-   * If there's no JS context currently on the stack, returns null.
-   */
-  static nsPIDOMWindow *GetWindowFromCaller();
-
-  /**
-   * The two GetDocumentFrom* functions below allow a caller to get at a
-   * document that is relevant to the currently executing script.
-   *
    * GetDocumentFromCaller gets its document by looking at the last called
    * function and finding the document that the function itself relates to.
    * For example, consider two windows A and B in the same origin. B has a
@@ -421,28 +412,10 @@ public:
    * If a script in window A were to call B's function, GetDocumentFromCaller
    * would find that function (in B) and return B's document.
    *
-   * GetDocumentFromContext gets its document by looking at the currently
-   * executing context's global object and returning its document. Thus,
-   * given the example above, GetDocumentFromCaller would see that the
-   * currently executing script was in window A, and return A's document.
-   */
-  /**
-   * Get the document from the currently executing function. This will return
-   * the document that the currently executing function is in/from.
-   *
    * @return The document or null if no JS Context.
    */
   static nsIDocument* GetDocumentFromCaller();
 
-  /**
-   * Get the document through the JS context that's currently on the stack.
-   * If there's no JS context currently on the stack it will return null.
-   * This will return the document of the calling script.
-   *
-   * @return The document or null if no JS context
-   */
-  static nsIDocument* GetDocumentFromContext();
-
   // Check if a node is in the document prolog, i.e. before the document
   // element.
   static bool InProlog(nsINode *aNode);
@@ -2279,9 +2252,7 @@ private:
 
   static bool sInitialized;
   static uint32_t sScriptBlockerCount;
-#ifdef DEBUG
   static uint32_t sDOMNodeRemovedSuppressCount;
-#endif
   static uint32_t sMicroTaskLevel;
   // Not an nsCOMArray because removing elements from those is slower
   static nsTArray< nsCOMPtr<nsIRunnable> >* sBlockedScriptRunners;
@@ -2338,14 +2309,10 @@ class MOZ_STACK_CLASS nsAutoScriptBlockerSuppressNodeRemoved :
                           public nsAutoScriptBlocker {
 public:
   nsAutoScriptBlockerSuppressNodeRemoved() {
-#ifdef DEBUG
     ++nsContentUtils::sDOMNodeRemovedSuppressCount;
-#endif
   }
   ~nsAutoScriptBlockerSuppressNodeRemoved() {
-#ifdef DEBUG
     --nsContentUtils::sDOMNodeRemovedSuppressCount;
-#endif
   }
 };
 
diff --git a/content/base/src/WebSocket.cpp b/content/base/src/WebSocket.cpp
index 060d51580632..93b2ec62a275 100644
--- a/content/base/src/WebSocket.cpp
+++ b/content/base/src/WebSocket.cpp
@@ -686,7 +686,7 @@ WebSocket::Init(JSContext* aCx,
     // Confirmed we are opening plain ws:// and want to prevent this from a
     // secure context (e.g. https). Check the principal's uri to determine if
     // we were loaded from https.
-    nsCOMPtr<nsIGlobalObject> globalObject(BrokenGetEntryGlobal());
+    nsCOMPtr<nsIGlobalObject> globalObject(GetEntryGlobal());
     if (globalObject) {
       nsCOMPtr<nsIPrincipal> principal(globalObject->PrincipalOrNull());
       if (principal) {
diff --git a/content/base/src/nsContentUtils.cpp b/content/base/src/nsContentUtils.cpp
index 1029a0925826..b1e96b3d1f52 100644
--- a/content/base/src/nsContentUtils.cpp
+++ b/content/base/src/nsContentUtils.cpp
@@ -214,9 +214,7 @@ nsILineBreaker *nsContentUtils::sLineBreaker;
 nsIWordBreaker *nsContentUtils::sWordBreaker;
 nsIBidiKeyboard *nsContentUtils::sBidiKeyboard = nullptr;
 uint32_t nsContentUtils::sScriptBlockerCount = 0;
-#ifdef DEBUG
 uint32_t nsContentUtils::sDOMNodeRemovedSuppressCount = 0;
-#endif
 uint32_t nsContentUtils::sMicroTaskLevel = 0;
 nsTArray< nsCOMPtr<nsIRunnable> >* nsContentUtils::sBlockedScriptRunners = nullptr;
 uint32_t nsContentUtils::sRunnersCountAtFirstBlocker = 0;
@@ -1953,19 +1951,6 @@ nsContentUtils::TraceSafeJSContext(JSTracer* aTrc)
   }
 }
 
-nsPIDOMWindow *
-nsContentUtils::GetWindowFromCaller()
-{
-  JSContext *cx = GetCurrentJSContext();
-  if (cx) {
-    nsCOMPtr<nsPIDOMWindow> win =
-      do_QueryInterface(nsJSUtils::GetDynamicScriptGlobal(cx));
-    return win;
-  }
-
-  return nullptr;
-}
-
 nsIDocument*
 nsContentUtils::GetDocumentFromCaller()
 {
@@ -1980,24 +1965,6 @@ nsContentUtils::GetDocumentFromCaller()
   return win->GetExtantDoc();
 }
 
-nsIDocument*
-nsContentUtils::GetDocumentFromContext()
-{
-  JSContext *cx = GetCurrentJSContext();
-  if (cx) {
-    nsIScriptGlobalObject *sgo = nsJSUtils::GetDynamicScriptGlobal(cx);
-
-    if (sgo) {
-      nsCOMPtr<nsPIDOMWindow> pwin = do_QueryInterface(sgo);
-      if (pwin) {
-        return pwin->GetExtantDoc();
-      }
-    }
-  }
-
-  return nullptr;
-}
-
 bool
 nsContentUtils::IsCallerChrome()
 {
@@ -3920,30 +3887,27 @@ nsContentUtils::MaybeFireNodeRemoved(nsINode* aChild, nsINode* aParent,
   NS_PRECONDITION(aChild->GetParentNode() == aParent, "Wrong parent");
   NS_PRECONDITION(aChild->OwnerDoc() == aOwnerDoc, "Wrong owner-doc");
 
-  // This checks that IsSafeToRunScript is true since we don't want to fire
-  // events when that is false. We can't rely on EventDispatcher to assert
-  // this in this situation since most of the time there are no mutation
-  // event listeners, in which case we won't even attempt to dispatch events.
-  // However this also allows for two exceptions. First off, we don't assert
-  // if the mutation happens to native anonymous content since we never fire
-  // mutation events on such content anyway.
-  // Second, we don't assert if sDOMNodeRemovedSuppressCount is true since
-  // that is a know case when we'd normally fire a mutation event, but can't
-  // make that safe and so we suppress it at this time. Ideally this should
-  // go away eventually.
-  NS_ASSERTION((aChild->IsNodeOfType(nsINode::eCONTENT) &&
-               static_cast<nsIContent*>(aChild)->
-                 IsInNativeAnonymousSubtree()) ||
-               IsSafeToRunScript() ||
-               sDOMNodeRemovedSuppressCount,
-               "Want to fire DOMNodeRemoved event, but it's not safe");
-
   // Having an explicit check here since it's an easy mistake to fall into,
   // and there might be existing code with problems. We'd rather be safe
   // than fire DOMNodeRemoved in all corner cases. We also rely on it for
   // nsAutoScriptBlockerSuppressNodeRemoved.
   if (!IsSafeToRunScript()) {
-    WarnScriptWasIgnored(aOwnerDoc);
+    // This checks that IsSafeToRunScript is true since we don't want to fire
+    // events when that is false. We can't rely on EventDispatcher to assert
+    // this in this situation since most of the time there are no mutation
+    // event listeners, in which case we won't even attempt to dispatch events.
+    // However this also allows for two exceptions. First off, we don't assert
+    // if the mutation happens to native anonymous content since we never fire
+    // mutation events on such content anyway.
+    // Second, we don't assert if sDOMNodeRemovedSuppressCount is true since
+    // that is a know case when we'd normally fire a mutation event, but can't
+    // make that safe and so we suppress it at this time. Ideally this should
+    // go away eventually.
+    if (!(aChild->IsContent() && aChild->AsContent()->IsInNativeAnonymousSubtree()) &&
+        !sDOMNodeRemovedSuppressCount) {
+      NS_ERROR("Want to fire DOMNodeRemoved event, but it's not safe");
+      WarnScriptWasIgnored(aOwnerDoc);
+    }
     return;
   }
 
diff --git a/content/html/document/src/nsHTMLDocument.cpp b/content/html/document/src/nsHTMLDocument.cpp
index 629d55e40252..d49047480262 100644
--- a/content/html/document/src/nsHTMLDocument.cpp
+++ b/content/html/document/src/nsHTMLDocument.cpp
@@ -1429,10 +1429,10 @@ nsHTMLDocument::Open(JSContext* cx,
     return ret.forget();
   }
 
-  // Note: We want to use GetDocumentFromContext here because this document
+  // Note: We want to use GetEntryDocument here because this document
   // should inherit the security information of the document that's opening us,
   // (since if it's secure, then it's presumably trusted).
-  nsCOMPtr<nsIDocument> callerDoc = nsContentUtils::GetDocumentFromContext();
+  nsCOMPtr<nsIDocument> callerDoc = GetEntryDocument();
   if (!callerDoc) {
     // If we're called from C++ or in some other way without an originating
     // document we can't do a document.open w/o changing the principal of the
diff --git a/content/media/gmp/GMPChild.cpp b/content/media/gmp/GMPChild.cpp
index f93ef31bdaf9..344b4b70d63e 100644
--- a/content/media/gmp/GMPChild.cpp
+++ b/content/media/gmp/GMPChild.cpp
@@ -128,14 +128,15 @@ GMPChild::Init(const std::string& aPluginPath,
     return false;
   }
 
+#ifdef MOZ_CRASHREPORTER
+  SendPCrashReporterConstructor(CrashReporter::CurrentThreadId());
+#endif
+
 #if defined(XP_MACOSX) && defined(MOZ_GMP_SANDBOX)
   mPluginPath = aPluginPath;
   return true;
 #endif
 
-#ifdef MOZ_CRASHREPORTER
-  SendPCrashReporterConstructor(CrashReporter::CurrentThreadId());
-#endif
 #if defined(XP_WIN)
   mozilla::SandboxTarget::Instance()->StartSandbox();
 #endif
diff --git a/content/media/mediasource/SourceBufferResource.h b/content/media/mediasource/SourceBufferResource.h
index f7007e4447a5..5ef220dc5a52 100644
--- a/content/media/mediasource/SourceBufferResource.h
+++ b/content/media/mediasource/SourceBufferResource.h
@@ -75,6 +75,7 @@ private:
   public:
     ResourceQueue() :
       nsDeque(new ResourceQueueDeallocator()),
+      mLogicalLength(0),
       mOffset(0)
     {
     }
@@ -87,12 +88,7 @@ private:
     // Returns the length of all items in the queue plus the offset.
     // This is the logical length of the resource.
     inline uint64_t GetLength() {
-      uint64_t s = mOffset;
-      for (uint32_t i = 0; i < GetSize(); ++i) {
-        ResourceItem* item = ResourceAt(i);
-        s += item->mData.Length();
-      }
-      return s;
+      return mLogicalLength;
     }
 
     // Copies aCount bytes from aOffset in the queue into aDest.
@@ -113,6 +109,7 @@ private:
     }
 
     inline void PushBack(ResourceItem* aItem) {
+      mLogicalLength += aItem->mData.Length();
       nsDeque::Push(aItem);
     }
 
@@ -184,8 +181,10 @@ private:
       return static_cast<ResourceItem*>(nsDeque::PopFront());
     }
 
-    // Logical offset into the resource of the first element
-    // in the queue.
+    // Logical length of the resource.
+    uint64_t mLogicalLength;
+
+    // Logical offset into the resource of the first element in the queue.
     uint64_t mOffset;
   };
 
diff --git a/content/media/moz.build b/content/media/moz.build
index 36cda1091ebf..83f40041131e 100644
--- a/content/media/moz.build
+++ b/content/media/moz.build
@@ -67,9 +67,6 @@ EXPORTS += [
     'AudioCompactor.h',
     'AudioEventTimeline.h',
     'AudioMixer.h',
-    'AudioNodeEngine.h',
-    'AudioNodeExternalInputStream.h',
-    'AudioNodeStream.h',
     'AudioSampleFormat.h',
     'AudioSegment.h',
     'AudioStream.h',
@@ -130,9 +127,6 @@ EXPORTS.mozilla.dom += [
 UNIFIED_SOURCES += [
     'AudioChannelFormat.cpp',
     'AudioCompactor.cpp',
-    'AudioNodeEngine.cpp',
-    'AudioNodeExternalInputStream.cpp',
-    'AudioNodeStream.cpp',
     'AudioSegment.cpp',
     'AudioSink.cpp',
     'AudioStream.cpp',
@@ -185,10 +179,6 @@ SOURCES += [
 
 FAIL_ON_WARNINGS = True
 
-if CONFIG['CPU_ARCH'] == 'arm' and CONFIG['BUILD_ARM_NEON']:
-    SOURCES += ['AudioNodeEngineNEON.cpp']
-    SOURCES['AudioNodeEngineNEON.cpp'].flags += ['-mfpu=neon']
-
 MSVC_ENABLE_PGO = True
 
 include('/ipc/chromium/chromium-config.mozbuild')
diff --git a/content/media/AudioNodeEngine.cpp b/content/media/webaudio/AudioNodeEngine.cpp
similarity index 100%
rename from content/media/AudioNodeEngine.cpp
rename to content/media/webaudio/AudioNodeEngine.cpp
diff --git a/content/media/AudioNodeEngine.h b/content/media/webaudio/AudioNodeEngine.h
similarity index 100%
rename from content/media/AudioNodeEngine.h
rename to content/media/webaudio/AudioNodeEngine.h
diff --git a/content/media/AudioNodeEngineNEON.cpp b/content/media/webaudio/AudioNodeEngineNEON.cpp
similarity index 100%
rename from content/media/AudioNodeEngineNEON.cpp
rename to content/media/webaudio/AudioNodeEngineNEON.cpp
diff --git a/content/media/AudioNodeEngineNEON.h b/content/media/webaudio/AudioNodeEngineNEON.h
similarity index 100%
rename from content/media/AudioNodeEngineNEON.h
rename to content/media/webaudio/AudioNodeEngineNEON.h
diff --git a/content/media/AudioNodeExternalInputStream.cpp b/content/media/webaudio/AudioNodeExternalInputStream.cpp
similarity index 100%
rename from content/media/AudioNodeExternalInputStream.cpp
rename to content/media/webaudio/AudioNodeExternalInputStream.cpp
diff --git a/content/media/AudioNodeExternalInputStream.h b/content/media/webaudio/AudioNodeExternalInputStream.h
similarity index 100%
rename from content/media/AudioNodeExternalInputStream.h
rename to content/media/webaudio/AudioNodeExternalInputStream.h
diff --git a/content/media/AudioNodeStream.cpp b/content/media/webaudio/AudioNodeStream.cpp
similarity index 100%
rename from content/media/AudioNodeStream.cpp
rename to content/media/webaudio/AudioNodeStream.cpp
diff --git a/content/media/AudioNodeStream.h b/content/media/webaudio/AudioNodeStream.h
similarity index 100%
rename from content/media/AudioNodeStream.h
rename to content/media/webaudio/AudioNodeStream.h
diff --git a/content/media/webaudio/moz.build b/content/media/webaudio/moz.build
index 42371e593697..6751e377c797 100644
--- a/content/media/webaudio/moz.build
+++ b/content/media/webaudio/moz.build
@@ -19,6 +19,9 @@ BROWSER_CHROME_MANIFESTS += ['test/browser.ini']
 
 EXPORTS += [
     'AudioContext.h',
+    'AudioNodeEngine.h',
+    'AudioNodeExternalInputStream.h',
+    'AudioNodeStream.h',
     'AudioParamTimeline.h',
     'MediaBufferDecoder.h',
     'ThreeDPoint.h',
@@ -65,6 +68,9 @@ UNIFIED_SOURCES += [
     'AudioDestinationNode.cpp',
     'AudioListener.cpp',
     'AudioNode.cpp',
+    'AudioNodeEngine.cpp',
+    'AudioNodeExternalInputStream.cpp',
+    'AudioNodeStream.cpp',
     'AudioParam.cpp',
     'AudioProcessingEvent.cpp',
     'BiquadFilterNode.cpp',
@@ -90,8 +96,15 @@ UNIFIED_SOURCES += [
     'WebAudioUtils.cpp',
 ]
 
+if CONFIG['CPU_ARCH'] == 'arm' and CONFIG['BUILD_ARM_NEON']:
+    SOURCES += ['AudioNodeEngineNEON.cpp']
+    SOURCES['AudioNodeEngineNEON.cpp'].flags += ['-mfpu=neon']
+
 FAIL_ON_WARNINGS = True
 
 include('/ipc/chromium/chromium-config.mozbuild')
 
 FINAL_LIBRARY = 'xul'
+LOCAL_INCLUDES += [
+    '..'
+]
diff --git a/content/media/webaudio/test/mochitest.ini b/content/media/webaudio/test/mochitest.ini
index 22783d98d60c..e66d5661f83c 100644
--- a/content/media/webaudio/test/mochitest.ini
+++ b/content/media/webaudio/test/mochitest.ini
@@ -128,6 +128,7 @@ skip-if = (toolkit == 'gonk' && !debug)
 [test_periodicWave.html]
 [test_scriptProcessorNode.html]
 [test_scriptProcessorNodeChannelCount.html]
+[test_scriptProcessorNodePassThrough.html]
 [test_scriptProcessorNode_playbackTime1.html]
 [test_scriptProcessorNodeZeroInputOutput.html]
 [test_scriptProcessorNodeNotConnected.html]
diff --git a/content/media/webaudio/test/test_scriptProcessorNode.html b/content/media/webaudio/test/test_scriptProcessorNode.html
index 4a5ebeb793dd..7cfb3d96e5a1 100644
--- a/content/media/webaudio/test/test_scriptProcessorNode.html
+++ b/content/media/webaudio/test/test_scriptProcessorNode.html
@@ -26,7 +26,7 @@ addLoadEvent(function() {
     for (var i = 0; i < 2048; ++i) {
       // Make sure our first sample won't be zero
       e.outputBuffer.getChannelData(0)[i] = Math.sin(440 * 2 * Math.PI * (i + 1) / context.sampleRate);
-      e.outputBuffer.getChannelData(0)[i] = Math.sin(880 * 2 * Math.PI * (i + 1) / context.sampleRate);
+      e.outputBuffer.getChannelData(1)[i] = Math.sin(880 * 2 * Math.PI * (i + 1) / context.sampleRate);
     }
     // Remember our generated audio
     buffer = e.outputBuffer;
diff --git a/content/media/webaudio/test/test_scriptProcessorNodePassThrough.html b/content/media/webaudio/test/test_scriptProcessorNodePassThrough.html
new file mode 100644
index 000000000000..8352a331da71
--- /dev/null
+++ b/content/media/webaudio/test/test_scriptProcessorNodePassThrough.html
@@ -0,0 +1,103 @@
+<!DOCTYPE HTML>
+<html>
+<head>
+  <title>Test ScriptProcessorNode with passthrough</title>
+  <script type="text/javascript" src="/tests/SimpleTest/SimpleTest.js"></script>
+  <script type="text/javascript" src="webaudio.js"></script>
+  <link rel="stylesheet" type="text/css" href="/tests/SimpleTest/test.css" />
+</head>
+<body>
+<pre id="test">
+<script class="testbody" type="text/javascript">
+
+// We do not use our generic graph test framework here because
+// the testing logic here is sort of complicated, and would
+// not be easy to map to OfflineAudioContext, as ScriptProcessorNodes
+// can experience delays.
+
+SimpleTest.waitForExplicitFinish();
+addLoadEvent(function() {
+  var context = new AudioContext();
+  var buffer = null;
+
+  var sourceSP = context.createScriptProcessor(2048);
+  sourceSP.addEventListener("audioprocess", function(e) {
+    // generate the audio
+    for (var i = 0; i < 2048; ++i) {
+      // Make sure our first sample won't be zero
+      e.outputBuffer.getChannelData(0)[i] = Math.sin(440 * 2 * Math.PI * (i + 1) / context.sampleRate);
+      e.outputBuffer.getChannelData(1)[i] = Math.sin(880 * 2 * Math.PI * (i + 1) / context.sampleRate);
+    }
+    // Remember our generated audio
+    buffer = e.outputBuffer;
+
+    sourceSP.removeEventListener("audioprocess", arguments.callee);
+  }, false);
+
+  function findFirstNonZeroSample(buffer) {
+    for (var i = 0; i < buffer.length; ++i) {
+      if (buffer.getChannelData(0)[i] != 0) {
+        return i;
+      }
+    }
+    return buffer.length;
+  }
+
+  var sp = context.createScriptProcessor(2048);
+  sourceSP.connect(sp);
+
+  var spWrapped = SpecialPowers.wrap(sp);
+  ok("passThrough" in spWrapped, "ScriptProcessorNode should support the passThrough API");
+  spWrapped.passThrough = true;
+
+  sp.onaudioprocess = function() {
+    ok(false, "The audioprocess event must never be dispatched on the passthrough ScriptProcessorNode");
+  };
+
+  var sp2 = context.createScriptProcessor(2048);
+  sp.connect(sp2);
+  sp2.connect(context.destination);
+
+  var emptyBuffer = context.createBuffer(1, 2048, context.sampleRate);
+
+  sp2.onaudioprocess = function(e) {
+    // Because of the initial latency added by the second script processor node,
+    // we will never see any generated audio frames in the first callback.
+    compareChannels(e.inputBuffer.getChannelData(0), emptyBuffer.getChannelData(0));
+    compareChannels(e.inputBuffer.getChannelData(1), emptyBuffer.getChannelData(0));
+
+    sp2.onaudioprocess = function(e) {
+      var firstNonZero = findFirstNonZeroSample(e.inputBuffer);
+      ok(firstNonZero <= 2048, "First non-zero sample within range");
+
+      compareChannels(e.inputBuffer.getChannelData(0), emptyBuffer.getChannelData(0), firstNonZero);
+      compareChannels(e.inputBuffer.getChannelData(1), emptyBuffer.getChannelData(0), firstNonZero);
+      compareChannels(e.inputBuffer.getChannelData(0), buffer.getChannelData(0), 2048 - firstNonZero, firstNonZero, 0);
+      compareChannels(e.inputBuffer.getChannelData(1), buffer.getChannelData(1), 2048 - firstNonZero, firstNonZero, 0);
+
+      if (firstNonZero == 0) {
+        // If we did not experience any delays, the test is done!
+        sp2.onaudioprocess = null;
+
+        SimpleTest.finish();
+      } else if (firstNonZero != 2048) {
+        // In case we just saw a zero buffer this time, wait one more round
+        sp2.onaudioprocess = function(e) {
+          compareChannels(e.inputBuffer.getChannelData(0), buffer.getChannelData(0), firstNonZero, 0, 2048 - firstNonZero);
+          compareChannels(e.inputBuffer.getChannelData(1), buffer.getChannelData(1), firstNonZero, 0, 2048 - firstNonZero);
+          compareChannels(e.inputBuffer.getChannelData(0), emptyBuffer.getChannelData(0), undefined, firstNonZero);
+          compareChannels(e.inputBuffer.getChannelData(1), emptyBuffer.getChannelData(0), undefined, firstNonZero);
+
+          sp2.onaudioprocess = null;
+
+          SimpleTest.finish();
+        };
+      }
+    };
+  };
+});
+
+</script>
+</pre>
+</body>
+</html>
diff --git a/content/media/webm/WebMBufferedParser.cpp b/content/media/webm/WebMBufferedParser.cpp
index 9a2a4aa9d631..d2ce8b80af4e 100644
--- a/content/media/webm/WebMBufferedParser.cpp
+++ b/content/media/webm/WebMBufferedParser.cpp
@@ -60,7 +60,7 @@ void WebMBufferedParser::Append(const unsigned char* aBuffer, uint32_t aLength,
       // and return to CLUSTER_SYNC.
       if (mClusterIDPos == sizeof(CLUSTER_ID)) {
         mClusterIDPos = 0;
-        mClusterOffset = mCurrentOffset + (p - aBuffer) - 1;
+        mClusterOffset = mCurrentOffset + (p - aBuffer) - sizeof(CLUSTER_ID);
         mState = READ_VINT;
         mNextState = TIMECODE_SYNC;
       }
diff --git a/dom/base/Navigator.cpp b/dom/base/Navigator.cpp
index c39aafc1808d..b8aa1166903c 100644
--- a/dom/base/Navigator.cpp
+++ b/dom/base/Navigator.cpp
@@ -1965,16 +1965,16 @@ Navigator::GetMozCameras(ErrorResult& aRv)
   return mCameraManager;
 }
 
-already_AddRefed<workers::ServiceWorkerContainer>
+already_AddRefed<ServiceWorkerContainer>
 Navigator::ServiceWorker()
 {
   MOZ_ASSERT(mWindow);
 
   if (!mServiceWorkerContainer) {
-    mServiceWorkerContainer = new workers::ServiceWorkerContainer(mWindow);
+    mServiceWorkerContainer = new ServiceWorkerContainer(mWindow);
   }
 
-  nsRefPtr<workers::ServiceWorkerContainer> ref = mServiceWorkerContainer;
+  nsRefPtr<ServiceWorkerContainer> ref = mServiceWorkerContainer;
   return ref.forget();
 }
 
diff --git a/dom/base/Navigator.h b/dom/base/Navigator.h
index c676673e095b..b97259cc9d40 100644
--- a/dom/base/Navigator.h
+++ b/dom/base/Navigator.h
@@ -36,6 +36,7 @@ struct MediaStreamConstraints;
 class WakeLock;
 class ArrayBufferViewOrBlobOrStringOrFormData;
 struct MobileIdOptions;
+class ServiceWorkerContainer;
 }
 }
 
@@ -104,10 +105,6 @@ class AudioChannelManager;
 #endif
 } // namespace system
 
-namespace workers {
-class ServiceWorkerContainer;
-} // namespace workers
-
 class Navigator : public nsIDOMNavigator
                 , public nsIMozNavigatorNetwork
                 , public nsWrapperCache
@@ -262,7 +259,7 @@ public:
                               ErrorResult& aRv);
 #endif // MOZ_MEDIA_NAVIGATOR
 
-  already_AddRefed<workers::ServiceWorkerContainer> ServiceWorker();
+  already_AddRefed<ServiceWorkerContainer> ServiceWorker();
 
   bool DoNewResolve(JSContext* aCx, JS::Handle<JSObject*> aObject,
                     JS::Handle<jsid> aId,
@@ -340,7 +337,7 @@ private:
   nsCOMPtr<nsIDOMNavigatorSystemMessages> mMessagesManager;
   nsTArray<nsRefPtr<nsDOMDeviceStorage> > mDeviceStorageStores;
   nsRefPtr<time::TimeManager> mTimeManager;
-  nsRefPtr<workers::ServiceWorkerContainer> mServiceWorkerContainer;
+  nsRefPtr<ServiceWorkerContainer> mServiceWorkerContainer;
   nsCOMPtr<nsPIDOMWindow> mWindow;
 
   // Hashtable for saving cached objects newresolve created, so we don't create
diff --git a/dom/base/ScriptSettings.cpp b/dom/base/ScriptSettings.cpp
index 5f7657149103..5c0daafb7203 100644
--- a/dom/base/ScriptSettings.cpp
+++ b/dom/base/ScriptSettings.cpp
@@ -122,27 +122,18 @@ ScriptSettingsStackEntry::~ScriptSettingsStackEntry()
   ScriptSettingsStack::Pop(this);
 }
 
-// This mostly gets the entry global, but doesn't entirely match the spec in
-// certain edge cases. It's good enough for some purposes, but not others. If
-// you want to call this function, ping bholley and describe your use-case.
 nsIGlobalObject*
-BrokenGetEntryGlobal()
+GetEntryGlobal()
 {
-  // We need the current JSContext in order to check the JS for
-  // scripted frames that may have appeared since anyone last
-  // manipulated the stack. If it's null, that means that there
-  // must be no entry global on the stack.
-  JSContext *cx = nsContentUtils::GetCurrentJSContextForThread();
-  if (!cx) {
-    MOZ_ASSERT(ScriptSettingsStack::EntryGlobal() == nullptr);
-    return nullptr;
-  }
-
-  return nsJSUtils::GetDynamicScriptGlobal(cx);
+  return ScriptSettingsStack::EntryGlobal();
 }
 
-// Note: When we're ready to expose it, GetEntryGlobal will look similar to
-// GetIncumbentGlobal below.
+nsIDocument*
+GetEntryDocument()
+{
+  nsCOMPtr<nsPIDOMWindow> entryWin = do_QueryInterface(GetEntryGlobal());
+  return entryWin ? entryWin->GetExtantDoc() : nullptr;
+}
 
 nsIGlobalObject*
 GetIncumbentGlobal()
@@ -171,6 +162,22 @@ GetIncumbentGlobal()
   return ScriptSettingsStack::IncumbentGlobal();
 }
 
+nsIGlobalObject*
+GetCurrentGlobal()
+{
+  JSContext *cx = nsContentUtils::GetCurrentJSContextForThread();
+  if (!cx) {
+    return nullptr;
+  }
+
+  JSObject *global = JS::CurrentGlobalOrNull(cx);
+  if (!global) {
+    return nullptr;
+  }
+
+  return xpc::GetNativeForGlobal(global);
+}
+
 nsIPrincipal*
 GetWebIDLCallerPrincipal()
 {
diff --git a/dom/base/ScriptSettings.h b/dom/base/ScriptSettings.h
index 8e5dc63630d4..637aa7436ea4 100644
--- a/dom/base/ScriptSettings.h
+++ b/dom/base/ScriptSettings.h
@@ -20,6 +20,7 @@
 class nsPIDOMWindow;
 class nsGlobalWindow;
 class nsIScriptContext;
+class nsIDocument;
 
 namespace mozilla {
 namespace dom {
@@ -63,17 +64,57 @@ private:
 void InitScriptSettings();
 void DestroyScriptSettings();
 
-// This mostly gets the entry global, but doesn't entirely match the spec in
-// certain edge cases. It's good enough for some purposes, but not others. If
-// you want to call this function, ping bholley and describe your use-case.
-nsIGlobalObject* BrokenGetEntryGlobal();
+// To implement a web-compatible browser, it is often necessary to obtain the
+// global object that is "associated" with the currently-running code. This
+// process is made more complicated by the fact that, historically, different
+// algorithms have operated with different definitions of the "associated"
+// global.
+//
+// HTML5 formalizes this into two concepts: the "incumbent global" and the
+// "entry global". The incumbent global corresponds to the global of the
+// current script being executed, whereas the entry global corresponds to the
+// global of the script where the current JS execution began.
+//
+// There is also a potentially-distinct third global that is determined by the
+// current compartment. This roughly corresponds with the notion of Realms in
+// ECMAScript.
+//
+// Suppose some event triggers an event listener in window |A|, which invokes a
+// scripted function in window |B|, which invokes the |window.location.href|
+// setter in window |C|. The entry global would be |A|, the incumbent global
+// would be |B|, and the current compartment would be that of |C|.
+//
+// In general, it's best to use to use the most-closely-associated global
+// unless the spec says to do otherwise. In 95% of the cases, the global of
+// the current compartment (GetCurrentGlobal()) is the right thing. For
+// example, WebIDL constructors (new C.XMLHttpRequest()) are initialized with
+// the global of the current compartment (i.e. |C|).
+//
+// The incumbent global is very similar, but differs in a few edge cases. For
+// example, if window |B| does |C.location.href = "..."|, the incumbent global
+// used for the navigation algorithm is B, because no script from |C| was ever run.
+//
+// The entry global is used for various things like computing base URIs, mostly
+// for historical reasons.
+//
+// Note that all of these functions return bonafide global objects. This means
+// that, for Windows, they always return the inner.
 
-// Note: We don't yet expose GetEntryGlobal, because in order for it to be
-// correct, we first need to replace a bunch of explicit cx pushing in the
-// browser with AutoEntryScript. But GetIncumbentGlobal is simpler, because it
-// can mostly be inferred from the JS stack.
+// Returns the global associated with the top-most Candidate Entry Point on
+// the Script Settings Stack. See the HTML spec. This may be null.
+nsIGlobalObject* GetEntryGlobal();
+
+// If the entry global is a window, returns its extant document. Otherwise,
+// returns null.
+nsIDocument* GetEntryDocument();
+
+// Returns the global associated with the top-most entry of the the Script
+// Settings Stack. See the HTML spec. This may be null.
 nsIGlobalObject* GetIncumbentGlobal();
 
+// Returns the global associated with the current compartment. This may be null.
+nsIGlobalObject* GetCurrentGlobal();
+
 // JS-implemented WebIDL presents an interesting situation with respect to the
 // subject principal. A regular C++-implemented API can simply examine the
 // compartment of the most-recently-executed script, and use that to infer the
diff --git a/dom/base/nsDOMClassInfo.cpp b/dom/base/nsDOMClassInfo.cpp
index cc3ae9045729..bc21c8409b23 100644
--- a/dom/base/nsDOMClassInfo.cpp
+++ b/dom/base/nsDOMClassInfo.cpp
@@ -2501,11 +2501,6 @@ OldBindingConstructorEnabled(const nsGlobalNameStruct *aStruct,
     }
   }
 
-  // Don't expose CSSFontFeatureValuesRule unless the pref is enabled
-  if (aStruct->mDOMClassInfoID == eDOMClassInfo_CSSFontFeatureValuesRule_id) {
-    return nsCSSFontFeatureValuesRule::PrefEnabled();
-  }
-
   return true;
 }
 
diff --git a/dom/base/nsFocusManager.cpp b/dom/base/nsFocusManager.cpp
index 720114996a5f..3307075ef93f 100644
--- a/dom/base/nsFocusManager.cpp
+++ b/dom/base/nsFocusManager.cpp
@@ -420,7 +420,7 @@ nsFocusManager::GetLastFocusMethod(nsIDOMWindow* aWindow, uint32_t* aLastFocusMe
 {
   // the focus method is stored on the inner window
   nsCOMPtr<nsPIDOMWindow> window(do_QueryInterface(aWindow));
-  if (window)
+  if (window && window->IsOuterWindow())
     window = window->GetCurrentInnerWindow();
   if (!window)
     window = mFocusedWindow;
diff --git a/dom/base/nsGlobalWindow.cpp b/dom/base/nsGlobalWindow.cpp
index 302deea54bb3..4a6cb7b858fc 100644
--- a/dom/base/nsGlobalWindow.cpp
+++ b/dom/base/nsGlobalWindow.cpp
@@ -1482,10 +1482,11 @@ nsGlobalWindow::CleanUp()
   mChromeEventHandler = nullptr; // Forces Release
   mParentTarget = nullptr;
 
-  nsGlobalWindow *inner = GetCurrentInnerWindowInternal();
-
-  if (inner) {
-    inner->CleanUp();
+  if (IsOuterWindow()) {
+    nsGlobalWindow* inner = GetCurrentInnerWindowInternal();
+    if (inner) {
+      inner->CleanUp();
+    }
   }
 
   if (IsInnerWindow()) {
@@ -5915,15 +5916,8 @@ nsGlobalWindow::RefreshCompartmentPrincipal()
 static already_AddRefed<nsIDocShellTreeItem>
 GetCallerDocShellTreeItem()
 {
-  JSContext *cx = nsContentUtils::GetCurrentJSContext();
-  nsCOMPtr<nsIDocShellTreeItem> callerItem;
-
-  if (cx) {
-    nsCOMPtr<nsIWebNavigation> callerWebNav =
-      do_GetInterface(nsJSUtils::GetDynamicScriptGlobal(cx));
-
-    callerItem = do_QueryInterface(callerWebNav);
-  }
+  nsCOMPtr<nsIWebNavigation> callerWebNav = do_GetInterface(GetEntryGlobal());
+  nsCOMPtr<nsIDocShellTreeItem> callerItem = do_QueryInterface(callerWebNav);
 
   return callerItem.forget();
 }
@@ -6557,7 +6551,7 @@ nsGlobalWindow::Focus(ErrorResult& aError)
     return;
   }
 
-  nsIDOMWindow *caller = nsContentUtils::GetWindowFromCaller();
+  nsCOMPtr<nsIDOMWindow> caller = do_QueryInterface(GetEntryGlobal());
   nsCOMPtr<nsIDOMWindow> opener;
   GetOpener(getter_AddRefs(opener));
 
@@ -7535,20 +7529,7 @@ nsGlobalWindow::FireAbuseEvents(bool aBlocked, bool aWindow,
 
   nsIURI *baseURL = nullptr;
 
-  JSContext *cx = nsContentUtils::GetCurrentJSContext();
-  nsCOMPtr<nsPIDOMWindow> contextWindow;
-
-  if (cx) {
-    nsIScriptContext *currentCX = nsJSUtils::GetDynamicScriptContext(cx);
-    if (currentCX) {
-      contextWindow = do_QueryInterface(currentCX->GetGlobalObject());
-    }
-  }
-  if (!contextWindow) {
-    contextWindow = this;
-  }
-
-  nsCOMPtr<nsIDocument> doc = contextWindow->GetDoc();
+  nsCOMPtr<nsIDocument> doc = GetEntryDocument();
   if (doc)
     baseURL = doc->GetDocBaseURI();
 
@@ -8253,7 +8234,7 @@ nsGlobalWindow::PostMessageMoz(JSContext* aCx, JS::Handle<JS::Value> aMessage,
   nsCOMPtr<nsIPrincipal> providedPrincipal;
 
   if (aTargetOrigin.EqualsASCII("/")) {
-    providedPrincipal = BrokenGetEntryGlobal()->PrincipalOrNull();
+    providedPrincipal = GetEntryGlobal()->PrincipalOrNull();
     if (NS_WARN_IF(!providedPrincipal))
       return;
   }
@@ -12803,11 +12784,7 @@ nsGlobalWindow::GetScrollFrame()
 nsresult
 nsGlobalWindow::SecurityCheckURL(const char *aURL)
 {
-  nsCOMPtr<nsPIDOMWindow> sourceWindow;
-  JSContext* topCx = nsContentUtils::GetCurrentJSContext();
-  if (topCx) {
-    sourceWindow = do_QueryInterface(nsJSUtils::GetDynamicScriptGlobal(topCx));
-  }
+  nsCOMPtr<nsPIDOMWindow> sourceWindow = do_QueryInterface(GetEntryGlobal());
   if (!sourceWindow) {
     sourceWindow = this;
   }
diff --git a/dom/base/nsGlobalWindow.h b/dom/base/nsGlobalWindow.h
index 850564da70de..a47dd8b8a0c0 100644
--- a/dom/base/nsGlobalWindow.h
+++ b/dom/base/nsGlobalWindow.h
@@ -599,6 +599,7 @@ public:
 
   nsGlobalWindow *GetCurrentInnerWindowInternal() const
   {
+    MOZ_ASSERT(IsOuterWindow());
     return static_cast<nsGlobalWindow *>(mInnerWindow);
   }
 
diff --git a/dom/base/nsJSEnvironment.cpp b/dom/base/nsJSEnvironment.cpp
index 7ae1c32bb6dc..7f4c0fd37b02 100644
--- a/dom/base/nsJSEnvironment.cpp
+++ b/dom/base/nsJSEnvironment.cpp
@@ -557,46 +557,38 @@ NS_ScriptErrorReporter(JSContext *cx,
     }
   }
 
-  // XXX this means we are not going to get error reports on non DOM contexts
-  nsIScriptContext *context = nsJSUtils::GetDynamicScriptContext(cx);
-
   JS::Rooted<JS::Value> exception(cx);
   ::JS_GetPendingException(cx, &exception);
 
-  // Note: we must do this before running any more code on cx (if cx is the
-  // dynamic script context).
+  // Note: we must do this before running any more code on cx.
   ::JS_ClearPendingException(cx);
 
-  if (context) {
-    nsIScriptGlobalObject *globalObject = context->GetGlobalObject();
+  MOZ_ASSERT(cx == nsContentUtils::GetCurrentJSContext());
+  nsCOMPtr<nsIGlobalObject> globalObject = GetEntryGlobal();
+  if (globalObject) {
 
-    if (globalObject) {
-
-      nsCOMPtr<nsPIDOMWindow> win = do_QueryInterface(globalObject);
-      if (win) {
-        win = win->GetCurrentInnerWindow();
-      }
-      nsCOMPtr<nsIScriptObjectPrincipal> scriptPrincipal =
-        do_QueryInterface(globalObject);
-      NS_ASSERTION(scriptPrincipal, "Global objects must implement "
-                   "nsIScriptObjectPrincipal");
-      nsContentUtils::AddScriptRunner(
-        new ScriptErrorEvent(JS_GetRuntime(cx),
-                             report,
-                             message,
-                             nsJSPrincipals::get(report->originPrincipals),
-                             scriptPrincipal->GetPrincipal(),
-                             win,
-                             exception,
-                             /* We do not try to report Out Of Memory via a dom
-                              * event because the dom event handler would
-                              * encounter an OOM exception trying to process the
-                              * event, and then we'd need to generate a new OOM
-                              * event for that new OOM instance -- this isn't
-                              * pretty.
-                              */
-                             report->errorNumber != JSMSG_OUT_OF_MEMORY));
-    }
+    nsCOMPtr<nsPIDOMWindow> win = do_QueryInterface(globalObject);
+    MOZ_ASSERT_IF(win, win->IsInnerWindow());
+    nsCOMPtr<nsIScriptObjectPrincipal> scriptPrincipal =
+      do_QueryInterface(globalObject);
+    NS_ASSERTION(scriptPrincipal, "Global objects must implement "
+                 "nsIScriptObjectPrincipal");
+    nsContentUtils::AddScriptRunner(
+      new ScriptErrorEvent(JS_GetRuntime(cx),
+                           report,
+                           message,
+                           nsJSPrincipals::get(report->originPrincipals),
+                           scriptPrincipal->GetPrincipal(),
+                           win,
+                           exception,
+                           /* We do not try to report Out Of Memory via a dom
+                            * event because the dom event handler would
+                            * encounter an OOM exception trying to process the
+                            * event, and then we'd need to generate a new OOM
+                            * event for that new OOM instance -- this isn't
+                            * pretty.
+                            */
+                           report->errorNumber != JSMSG_OUT_OF_MEMORY));
   }
 
   if (nsContentUtils::DOMWindowDumpEnabled()) {
diff --git a/dom/base/nsJSUtils.cpp b/dom/base/nsJSUtils.cpp
index d5c47f687a40..acbfa3994548 100644
--- a/dom/base/nsJSUtils.cpp
+++ b/dom/base/nsJSUtils.cpp
@@ -63,21 +63,6 @@ nsJSUtils::GetStaticScriptContext(JSObject* aObj)
   return nativeGlobal->GetScriptContext();
 }
 
-nsIScriptGlobalObject *
-nsJSUtils::GetDynamicScriptGlobal(JSContext* aContext)
-{
-  nsIScriptContext *scriptCX = GetDynamicScriptContext(aContext);
-  if (!scriptCX)
-    return nullptr;
-  return scriptCX->GetGlobalObject();
-}
-
-nsIScriptContext *
-nsJSUtils::GetDynamicScriptContext(JSContext *aContext)
-{
-  return GetScriptContextFromJSContext(aContext);
-}
-
 uint64_t
 nsJSUtils::GetCurrentlyRunningCodeInnerWindowID(JSContext *aContext)
 {
diff --git a/dom/base/nsJSUtils.h b/dom/base/nsJSUtils.h
index d781609446ea..18f7864fa842 100644
--- a/dom/base/nsJSUtils.h
+++ b/dom/base/nsJSUtils.h
@@ -32,10 +32,6 @@ public:
 
   static nsIScriptContext *GetStaticScriptContext(JSObject* aObj);
 
-  static nsIScriptGlobalObject *GetDynamicScriptGlobal(JSContext *aContext);
-
-  static nsIScriptContext *GetDynamicScriptContext(JSContext *aContext);
-
   /**
    * Retrieve the inner window ID based on the given JSContext.
    *
diff --git a/dom/base/nsLocation.cpp b/dom/base/nsLocation.cpp
index d16e6c720804..2c9a92d4f339 100644
--- a/dom/base/nsLocation.cpp
+++ b/dom/base/nsLocation.cpp
@@ -28,6 +28,7 @@
 #include "nsITextToSubURI.h"
 #include "nsJSUtils.h"
 #include "nsContentUtils.h"
+#include "nsGlobalWindow.h"
 #include "mozilla/Likely.h"
 #include "nsCycleCollectionParticipant.h"
 #include "nsNullPrincipal.h"
@@ -42,15 +43,8 @@ GetDocumentCharacterSetForURI(const nsAString& aHref, nsACString& aCharset)
 {
   aCharset.Truncate();
 
-  JSContext *cx = nsContentUtils::GetCurrentJSContext();
-  if (cx) {
-    nsCOMPtr<nsPIDOMWindow> window =
-      do_QueryInterface(nsJSUtils::GetDynamicScriptGlobal(cx));
-    NS_ENSURE_TRUE(window, NS_ERROR_FAILURE);
-
-    if (nsIDocument* doc = window->GetDoc()) {
-      aCharset = doc->GetDocumentCharacterSet();
-    }
+  if (nsIDocument* doc = GetEntryDocument()) {
+    aCharset = doc->GetDocumentCharacterSet();
   }
 
   return NS_OK;
@@ -545,23 +539,23 @@ nsLocation::SetHrefWithBase(const nsAString& aHref, nsIURI* aBase,
      * anywhere else. This is part of solution for bug # 39938, 72197
      * 
      */
-    bool inScriptTag=false;
-    JSContext *cx = nsContentUtils::GetCurrentJSContext();
-    if (cx) {
-      nsIScriptContext *scriptContext =
-        nsJSUtils::GetDynamicScriptContext(cx);
+    bool inScriptTag = false;
+    nsIScriptContext* scriptContext = nullptr;
+    nsCOMPtr<nsPIDOMWindow> win = do_QueryInterface(GetEntryGlobal());
+    if (win) {
+      scriptContext = static_cast<nsGlobalWindow*>(win.get())->GetContextInternal();
+    }
 
-      if (scriptContext) {
-        if (scriptContext->GetProcessingScriptTag()) {
-          // Now check to make sure that the script is running in our window,
-          // since we only want to replace if the location is set by a
-          // <script> tag in the same window.  See bug 178729.
-          nsCOMPtr<nsIScriptGlobalObject> ourGlobal =
-            docShell ? docShell->GetScriptGlobalObject() : nullptr;
-          inScriptTag = (ourGlobal == scriptContext->GetGlobalObject());
-        }
-      }  
-    } //cx
+    if (scriptContext) {
+      if (scriptContext->GetProcessingScriptTag()) {
+        // Now check to make sure that the script is running in our window,
+        // since we only want to replace if the location is set by a
+        // <script> tag in the same window.  See bug 178729.
+        nsCOMPtr<nsIScriptGlobalObject> ourGlobal =
+          docShell ? docShell->GetScriptGlobalObject() : nullptr;
+        inScriptTag = (ourGlobal == scriptContext->GetGlobalObject());
+      }
+    }
 
     return SetURI(newUri, aReplace || inScriptTag);
   }
@@ -1020,22 +1014,20 @@ nsLocation::ValueOf(nsIDOMLocation** aReturn)
 nsresult
 nsLocation::GetSourceBaseURL(JSContext* cx, nsIURI** sourceURL)
 {
-
   *sourceURL = nullptr;
-  nsCOMPtr<nsIScriptGlobalObject> sgo = nsJSUtils::GetDynamicScriptGlobal(cx);
-  // If this JS context doesn't have an associated DOM window, we effectively
-  // have no script entry point stack. This doesn't generally happen with the DOM,
+  nsIDocument* doc = GetEntryDocument();
+  // If there's no entry document, we either have no Script Entry Point or one
+  // that isn't a DOM Window.  This doesn't generally happen with the DOM,
   // but can sometimes happen with extension code in certain IPC configurations.
   // If this happens, try falling back on the current document associated with
   // the docshell. If that fails, just return null and hope that the caller passed
   // an absolute URI.
-  if (!sgo && GetDocShell()) {
-    sgo = GetDocShell()->GetScriptGlobalObject();
+  if (!doc && GetDocShell()) {
+    nsCOMPtr<nsPIDOMWindow> docShellWin = do_QueryInterface(GetDocShell()->GetScriptGlobalObject());
+    if (docShellWin) {
+      doc = docShellWin->GetDoc();
+    }
   }
-  NS_ENSURE_TRUE(sgo, NS_OK);
-  nsCOMPtr<nsPIDOMWindow> window = do_QueryInterface(sgo);
-  NS_ENSURE_TRUE(window, NS_ERROR_UNEXPECTED);
-  nsIDocument* doc = window->GetDoc();
   NS_ENSURE_TRUE(doc, NS_OK);
   *sourceURL = doc->GetBaseURI().take();
   return NS_OK;
diff --git a/dom/base/nsPIDOMWindow.h b/dom/base/nsPIDOMWindow.h
index 739ed560c0be..454721136d35 100644
--- a/dom/base/nsPIDOMWindow.h
+++ b/dom/base/nsPIDOMWindow.h
@@ -192,12 +192,7 @@ public:
 
   bool IsLoadingOrRunningTimeout() const
   {
-    const nsPIDOMWindow *win = GetCurrentInnerWindow();
-
-    if (!win) {
-      win = this;
-    }
-
+    const nsPIDOMWindow* win = IsInnerWindow() ? this : GetCurrentInnerWindow();
     return !win->mIsDocumentLoaded || win->mRunningTimeout;
   }
 
@@ -299,6 +294,7 @@ public:
 
   nsPIDOMWindow *GetCurrentInnerWindow() const
   {
+    MOZ_ASSERT(IsOuterWindow());
     return mInnerWindow;
   }
 
diff --git a/dom/base/nsWindowMemoryReporter.cpp b/dom/base/nsWindowMemoryReporter.cpp
index 3101b33afefa..bc60c49f5606 100644
--- a/dom/base/nsWindowMemoryReporter.cpp
+++ b/dom/base/nsWindowMemoryReporter.cpp
@@ -56,7 +56,8 @@ AddNonJSSizeOfWindowAndItsDescendents(nsGlobalWindow* aWindow,
 
   // Measure the inner window, if there is one.
   nsWindowSizes innerWindowSizes(moz_malloc_size_of);
-  nsGlobalWindow* inner = aWindow->GetCurrentInnerWindowInternal();
+  nsGlobalWindow* inner = aWindow->IsOuterWindow() ? aWindow->GetCurrentInnerWindowInternal()
+                                                   : nullptr;
   if (inner) {
     inner->AddSizeOfIncludingThis(&innerWindowSizes);
     innerWindowSizes.addToTabSizes(aSizes);
diff --git a/dom/bindings/BindingUtils.cpp b/dom/bindings/BindingUtils.cpp
index 38a5dd393261..06e44cace64b 100644
--- a/dom/bindings/BindingUtils.cpp
+++ b/dom/bindings/BindingUtils.cpp
@@ -2645,5 +2645,12 @@ AssertReturnTypeMatchesJitinfo(const JSJitInfo* aJitInfo,
 }
 #endif
 
+bool
+CallerSubsumes(JSObject *aObject)
+{
+  nsIPrincipal* objPrin = nsContentUtils::ObjectPrincipal(js::UncheckedUnwrap(aObject));
+  return nsContentUtils::SubjectPrincipal()->Subsumes(objPrin);
+}
+
 } // namespace dom
 } // namespace mozilla
diff --git a/dom/bindings/BindingUtils.h b/dom/bindings/BindingUtils.h
index 7e0db6a02e44..a56124ac9911 100644
--- a/dom/bindings/BindingUtils.h
+++ b/dom/bindings/BindingUtils.h
@@ -2937,6 +2937,18 @@ AssertReturnTypeMatchesJitinfo(const JSJitInfo* aJitinfo,
 bool
 CheckPermissions(JSContext* aCx, JSObject* aObj, const char* const aPermissions[]);
 
+bool
+CallerSubsumes(JSObject* aObject);
+
+MOZ_ALWAYS_INLINE bool
+CallerSubsumes(JS::Handle<JS::Value> aValue)
+{
+  if (!aValue.isObject()) {
+    return true;
+  }
+  return CallerSubsumes(&aValue.toObject());
+}
+
 } // namespace dom
 } // namespace mozilla
 
diff --git a/dom/bindings/Bindings.conf b/dom/bindings/Bindings.conf
index 5912e794a886..bb0730d70ccc 100644
--- a/dom/bindings/Bindings.conf
+++ b/dom/bindings/Bindings.conf
@@ -1053,11 +1053,6 @@ DOMInterfaces = {
     'headerFile': 'mozilla/dom/workers/bindings/ServiceWorker.h',
 },
 
-'ServiceWorkerContainer': {
-    'nativeType': 'mozilla::dom::workers::ServiceWorkerContainer',
-    'headerFile': 'mozilla/dom/ServiceWorkerContainer.h',
-},
-
 'ServiceWorkerGlobalScope': {
     'headerFile': 'mozilla/dom/WorkerScope.h',
     'workers': True,
diff --git a/dom/bindings/Codegen.py b/dom/bindings/Codegen.py
index b16eb1f21d08..a605807a6169 100644
--- a/dom/bindings/Codegen.py
+++ b/dom/bindings/Codegen.py
@@ -3572,6 +3572,9 @@ class JSToNativeConversionInfo():
                        for whether we have a JS::Value.  Only used when
                        defaultValue is not None or when True is passed for
                        checkForValue to instantiateJSToNativeConversion.
+          ${passedToJSImpl} replaced by an expression that evaluates to a boolean
+                            for whether this value is being passed to a JS-
+                            implemented interface.
 
         declType: A CGThing representing the native C++ type we're converting
                   to.  This is allowed to be None if the conversion code is
@@ -3827,7 +3830,7 @@ def getJSToNativeConversionInfo(type, descriptorProvider, failureCode=None,
         return templateBody
 
     # A helper function for converting things that look like a JSObject*.
-    def handleJSObjectType(type, isMember, failureCode):
+    def handleJSObjectType(type, isMember, failureCode, exceptionCode, sourceDescription):
         if not isMember:
             if isOptional:
                 # We have a specialization of Optional that will use a
@@ -3843,6 +3846,19 @@ def getJSToNativeConversionInfo(type, descriptorProvider, failureCode=None,
             declType = CGGeneric("JSObject*")
             declArgs = None
         templateBody = "${declName} = &${val}.toObject();\n"
+
+        # For JS-implemented APIs, we refuse to allow passing objects that the
+        # API consumer does not subsume.
+        if not isinstance(descriptorProvider, Descriptor) or descriptorProvider.interface.isJSImplemented():
+            templateBody = fill("""
+                            if ($${passedToJSImpl} && !CallerSubsumes($${val})) {
+                              ThrowErrorMessage(cx, MSG_PERMISSION_DENIED_TO_PASS_ARG, "${sourceDescription}");
+                              $*{exceptionCode}
+                            }
+                            """,
+                            sourceDescription=sourceDescription,
+                            exceptionCode=exceptionCode) + templateBody
+
         setToNullCode = "${declName} = nullptr;\n"
         template = wrapObjectTemplate(templateBody, type, setToNullCode,
                                       failureCode)
@@ -3917,7 +3933,8 @@ def getJSToNativeConversionInfo(type, descriptorProvider, failureCode=None,
                 # We only need holderName here to handle isExternal()
                 # interfaces, which use an internal holder for the
                 # conversion even when forceOwningType ends up true.
-                "holderName": "tempHolder"
+                "holderName": "tempHolder",
+                "passedToJSImpl": "${passedToJSImpl}"
             })
 
         # NOTE: Keep this in sync with variadic conversions as needed
@@ -4021,7 +4038,8 @@ def getJSToNativeConversionInfo(type, descriptorProvider, failureCode=None,
                 # We only need holderName here to handle isExternal()
                 # interfaces, which use an internal holder for the
                 # conversion even when forceOwningType ends up true.
-                "holderName": "tempHolder"
+                "holderName": "tempHolder",
+                "passedToJSImpl": "${passedToJSImpl}"
             })
 
         templateBody = fill(
@@ -4114,7 +4132,7 @@ def getJSToNativeConversionInfo(type, descriptorProvider, failureCode=None,
             for memberType in interfaceMemberTypes:
                 name = getUnionMemberName(memberType)
                 interfaceObject.append(
-                    CGGeneric("(failed = !%s.TrySetTo%s(cx, ${val}, tryNext)) || !tryNext" %
+                    CGGeneric("(failed = !%s.TrySetTo%s(cx, ${val}, tryNext, ${passedToJSImpl})) || !tryNext" %
                               (unionArgumentObj, name)))
                 names.append(name)
             interfaceObject = CGWrapper(CGList(interfaceObject, " ||\n"),
@@ -4127,7 +4145,7 @@ def getJSToNativeConversionInfo(type, descriptorProvider, failureCode=None,
             assert len(arrayObjectMemberTypes) == 1
             name = getUnionMemberName(arrayObjectMemberTypes[0])
             arrayObject = CGGeneric(
-                "done = (failed = !%s.TrySetTo%s(cx, ${val}, tryNext)) || !tryNext;\n" %
+                "done = (failed = !%s.TrySetTo%s(cx, ${val}, tryNext, ${passedToJSImpl})) || !tryNext;\n" %
                 (unionArgumentObj, name))
             names.append(name)
         else:
@@ -4151,7 +4169,7 @@ def getJSToNativeConversionInfo(type, descriptorProvider, failureCode=None,
             memberType = callbackMemberTypes[0]
             name = getUnionMemberName(memberType)
             callbackObject = CGGeneric(
-                "done = (failed = !%s.TrySetTo%s(cx, ${val}, tryNext)) || !tryNext;\n" %
+                "done = (failed = !%s.TrySetTo%s(cx, ${val}, tryNext, ${passedToJSImpl})) || !tryNext;\n" %
                 (unionArgumentObj, name))
             names.append(name)
         else:
@@ -4162,7 +4180,7 @@ def getJSToNativeConversionInfo(type, descriptorProvider, failureCode=None,
             assert len(dictionaryMemberTypes) == 1
             name = getUnionMemberName(dictionaryMemberTypes[0])
             setDictionary = CGGeneric(
-                "done = (failed = !%s.TrySetTo%s(cx, ${val}, tryNext)) || !tryNext;\n" %
+                "done = (failed = !%s.TrySetTo%s(cx, ${val}, tryNext, ${passedToJSImpl})) || !tryNext;\n" %
                 (unionArgumentObj, name))
             names.append(name)
         else:
@@ -4173,7 +4191,7 @@ def getJSToNativeConversionInfo(type, descriptorProvider, failureCode=None,
             assert len(mozMapMemberTypes) == 1
             name = getUnionMemberName(mozMapMemberTypes[0])
             mozMapObject = CGGeneric(
-                "done = (failed = !%s.TrySetTo%s(cx, ${val}, tryNext)) || !tryNext;\n" %
+                "done = (failed = !%s.TrySetTo%s(cx, ${val}, tryNext, ${passedToJSImpl})) || !tryNext;\n" %
                 (unionArgumentObj, name))
             names.append(name)
         else:
@@ -4185,8 +4203,10 @@ def getJSToNativeConversionInfo(type, descriptorProvider, failureCode=None,
             # Very important to NOT construct a temporary Rooted here, since the
             # SetToObject call can call a Rooted constructor and we need to keep
             # stack discipline for Rooted.
-            object = CGGeneric("%s.SetToObject(cx, &${val}.toObject());\n"
-                               "done = true;\n" % unionArgumentObj)
+            object = CGGeneric("if (!%s.SetToObject(cx, &${val}.toObject(), ${passedToJSImpl})) {\n"
+                               "%s"
+                               "}\n"
+                               "done = true;\n" % (unionArgumentObj, indent(exceptionCode)))
             names.append(objectMemberTypes[0].name)
         else:
             object = None
@@ -4425,7 +4445,7 @@ def getJSToNativeConversionInfo(type, descriptorProvider, failureCode=None,
         if descriptor.nativeType == 'JSObject':
             # XXXbz Workers code does this sometimes
             assert descriptor.workers
-            return handleJSObjectType(type, isMember, failureCode)
+            return handleJSObjectType(type, isMember, failureCode, exceptionCode, sourceDescription)
 
         if descriptor.interface.isCallback():
             name = descriptor.interface.identifier.name
@@ -4507,7 +4527,7 @@ def getJSToNativeConversionInfo(type, descriptorProvider, failureCode=None,
                     isCallbackReturnValue,
                     firstCap(sourceDescription)))
         elif descriptor.workers:
-            return handleJSObjectType(type, isMember, failureCode)
+            return handleJSObjectType(type, isMember, failureCode, exceptionCode, sourceDescription)
         else:
             # Either external, or new-binding non-castable.  We always have a
             # holder for these, because we don't actually know whether we have
@@ -4826,6 +4846,19 @@ def getJSToNativeConversionInfo(type, descriptorProvider, failureCode=None,
 
         assert not isOptional
         templateBody = "${declName} = ${val};\n"
+
+        # For JS-implemented APIs, we refuse to allow passing objects that the
+        # API consumer does not subsume.
+        if not isinstance(descriptorProvider, Descriptor) or descriptorProvider.interface.isJSImplemented():
+            templateBody = fill("""
+                            if ($${passedToJSImpl} && !CallerSubsumes($${val})) {
+                              ThrowErrorMessage(cx, MSG_PERMISSION_DENIED_TO_PASS_ARG, "${sourceDescription}");
+                              $*{exceptionCode}
+                            }
+                            """,
+                            sourceDescription=sourceDescription,
+                            exceptionCode=exceptionCode) + templateBody
+
         # We may not have a default value if we're being converted for
         # a setter, say.
         if defaultValue:
@@ -4841,7 +4874,7 @@ def getJSToNativeConversionInfo(type, descriptorProvider, failureCode=None,
 
     if type.isObject():
         assert not isEnforceRange and not isClamp
-        return handleJSObjectType(type, isMember, failureCode)
+        return handleJSObjectType(type, isMember, failureCode, exceptionCode, sourceDescription)
 
     if type.isDictionary():
         # There are no nullable dictionaries
@@ -4891,7 +4924,7 @@ def getJSToNativeConversionInfo(type, descriptorProvider, failureCode=None,
         if type.nullable():
             dictLoc += ".SetValue()"
 
-        template += ('if (!%s.Init(cx, %s, "%s")) {\n'
+        template += ('if (!%s.Init(cx, %s, "%s", ${passedToJSImpl})) {\n'
                      "%s"
                      "}\n" % (dictLoc, val, firstCap(sourceDescription),
                               exceptionCodeIndented.define()))
@@ -5167,7 +5200,8 @@ class CGArgumentConverter(CGThing):
         self.replacementVariables = {
             "declName": "arg%d" % index,
             "holderName": ("arg%d" % index) + "_holder",
-            "obj": "obj"
+            "obj": "obj",
+            "passedToJSImpl": toStringBool(isJSImplementedDescriptor(descriptorProvider))
         }
         self.replacementVariables["val"] = string.Template(
             "args[${index}]").substitute(replacer)
@@ -5245,7 +5279,8 @@ class CGArgumentConverter(CGThing):
                 # conversion even when forceOwningType ends up true.
                 "holderName": "tempHolder",
                 # Use the same ${obj} as for the variadic arg itself
-                "obj": replacer["obj"]
+                "obj": replacer["obj"],
+                "passedToJSImpl": toStringBool(isJSImplementedDescriptor(self.descriptorProvider))
             }), 4)
 
         variadicConversion += ("  }\n"
@@ -6741,7 +6776,8 @@ class CGMethodCall(CGThing):
                         "holderName": ("arg%d" % distinguishingIndex) + "_holder",
                         "val": distinguishingArg,
                         "obj": "obj",
-                        "haveValue": "args.hasDefined(%d)" % distinguishingIndex
+                        "haveValue": "args.hasDefined(%d)" % distinguishingIndex,
+                        "passedToJSImpl": toStringBool(isJSImplementedDescriptor(descriptor))
                     },
                     checkForValue=argIsOptional)
                 caseBody.append(CGIndenter(testCode, indent))
@@ -8316,9 +8352,22 @@ def getUnionTypeTemplateVars(unionType, type, descriptorProvider,
                 mUnion.mValue.mObject.SetValue(cx, obj);
                 mUnion.mType = mUnion.eObject;
                 """)
-        setter = ClassMethod("SetToObject", "void",
+
+        # It's a bit sketchy to do the security check after setting the value,
+        # but it keeps the code cleaner and lets us avoid rooting |obj| over the
+        # call to CallerSubsumes().
+        body = body + dedent("""
+            if (passedToJSImpl && !CallerSubsumes(obj)) {
+              ThrowErrorMessage(cx, MSG_PERMISSION_DENIED_TO_PASS_ARG, "%s");
+              return false;
+            }
+            return true;
+            """)
+
+        setter = ClassMethod("SetToObject", "bool",
                              [Argument("JSContext*", "cx"),
-                              Argument("JSObject*", "obj")],
+                              Argument("JSObject*", "obj"),
+                              Argument("bool", "passedToJSImpl", default="false")],
                              inline=True, bodyInHeader=True,
                              body=body)
 
@@ -8338,7 +8387,8 @@ def getUnionTypeTemplateVars(unionType, type, descriptorProvider,
             val="value",
             declName="memberSlot",
             holderName=(holderName if ownsMembers else "%s.ref()" % holderName),
-            destroyHolder=destroyHolder)
+            destroyHolder=destroyHolder,
+            passedToJSImpl="passedToJSImpl")
 
         jsConversion = fill(
             """
@@ -8357,7 +8407,8 @@ def getUnionTypeTemplateVars(unionType, type, descriptorProvider,
         setter = ClassMethod("TrySetTo" + name, "bool",
                              [Argument("JSContext*", "cx"),
                               Argument("JS::Handle<JS::Value>", "value"),
-                              Argument("bool&", "tryNext")],
+                              Argument("bool&", "tryNext"),
+                              Argument("bool", "passedToJSImpl", default="false")],
                              inline=not ownsMembers,
                              bodyInHeader=not ownsMembers,
                              body=jsConversion)
@@ -9463,7 +9514,8 @@ class CGProxySpecialOperation(CGPerSignatureCall):
                 "declName": argument.identifier.name,
                 "holderName": argument.identifier.name + "_holder",
                 "val": argumentMutableValue,
-                "obj": "obj"
+                "obj": "obj",
+                "passedToJSImpl": "false"
             }
             self.cgRoot.prepend(instantiateJSToNativeConversion(info, templateValues))
         elif operation.isGetter() or operation.isDeleter():
@@ -11087,7 +11139,8 @@ class CGDictionary(CGThing):
         return ClassMethod("Init", "bool", [
             Argument('JSContext*', 'cx'),
             Argument('JS::Handle<JS::Value>', 'val'),
-            Argument('const char*', 'sourceDescription', default='"Value"')
+            Argument('const char*', 'sourceDescription', default='"Value"'),
+            Argument('bool', 'passedToJSImpl', default='false')
         ], body=body)
 
     def initFromJSONMethod(self):
@@ -11322,7 +11375,8 @@ class CGDictionary(CGThing):
             # We need a holder name for external interfaces, but
             # it's scoped down to the conversion so we can just use
             # anything we want.
-            "holderName": "holder"
+            "holderName": "holder",
+            "passedToJSImpl": "passedToJSImpl"
         }
         # We can't handle having a holderType here
         assert conversionInfo.holderType is None
@@ -11458,6 +11512,11 @@ class CGDictionary(CGThing):
                 trace = CGGeneric('%s.TraceSelf(trc);\n' % memberData)
             if type.nullable():
                 trace = CGIfWrapper(trace, "!%s.IsNull()" % memberNullable)
+        elif type.isMozMap():
+            # If you implement this, add a MozMap<object> to
+            # TestInterfaceJSDictionary and test it in test_bug1036214.html
+            # to make sure we end up with the correct security properties.
+            assert False
         else:
             assert False  # unknown type
 
@@ -13389,7 +13448,8 @@ class CallbackMember(CGNativeMember):
             # We actually want to pass in a null scope object here, because
             # wrapping things into our current compartment (that of mCallback)
             # is what we want.
-            "obj": "nullptr"
+            "obj": "nullptr",
+            "passedToJSImpl": "false"
         }
 
         if isJSImplementedDescriptor(self.descriptorProvider):
diff --git a/dom/bindings/Errors.msg b/dom/bindings/Errors.msg
index e38188d4e8d8..e4b520ad84bb 100644
--- a/dom/bindings/Errors.msg
+++ b/dom/bindings/Errors.msg
@@ -58,3 +58,4 @@ MSG_DEF(MSG_HEADERS_IMMUTABLE, 0, "Headers are immutable and cannot be modified.
 MSG_DEF(MSG_INVALID_HEADER_NAME, 1, "{0} is an invalid header name.")
 MSG_DEF(MSG_INVALID_HEADER_VALUE, 1, "{0} is an invalid header value.")
 MSG_DEF(MSG_INVALID_HEADER_SEQUENCE, 0, "Headers require name/value tuples when being initialized by a sequence.")
+MSG_DEF(MSG_PERMISSION_DENIED_TO_PASS_ARG, 1, "Permission denied to pass cross-origin object as {0}.")
diff --git a/dom/bindings/test/TestInterfaceJS.js b/dom/bindings/test/TestInterfaceJS.js
index 9be40c29f754..62b7f29bd2d5 100644
--- a/dom/bindings/test/TestInterfaceJS.js
+++ b/dom/bindings/test/TestInterfaceJS.js
@@ -9,17 +9,6 @@ const Ci = Components.interfaces;
 Cu.import("resource://gre/modules/XPCOMUtils.jsm");
 Cu.import("resource://gre/modules/Services.jsm");
 
-var gGlobal = this;
-function checkGlobal(obj) {
-  if (Object(obj) === obj && Cu.getGlobalForObject(obj) != gGlobal) {
-    // This message may not make it to the caller in a useful form, so dump
-    // as well.
-    var msg = "TestInterfaceJS received an object from a different scope!";
-    dump(msg + "\n");
-    throw new Error(msg);
-  }
-}
-
 function TestInterfaceJS(anyArg, objectArg) {}
 
 TestInterfaceJS.prototype = {
@@ -27,23 +16,32 @@ TestInterfaceJS.prototype = {
   contractID: "@mozilla.org/dom/test-interface-js;1",
   QueryInterface: XPCOMUtils.generateQI([Ci.nsISupports]),
 
-  __init: function (anyArg, objectArg) {
+  __init: function (anyArg, objectArg, dictionaryArg) {
     this._anyAttr = undefined;
     this._objectAttr = null;
     this._anyArg = anyArg;
     this._objectArg = objectArg;
-    checkGlobal(anyArg);
-    checkGlobal(objectArg);
+    this._dictionaryArg = dictionaryArg;
   },
 
   get anyArg() { return this._anyArg; },
   get objectArg() { return this._objectArg; },
+  get dictionaryArg() { return this._dictionaryArg; },
   get anyAttr() { return this._anyAttr; },
-  set anyAttr(val) { checkGlobal(val); this._anyAttr = val; },
+  set anyAttr(val) { this._anyAttr = val; },
   get objectAttr() { return this._objectAttr; },
-  set objectAttr(val) { checkGlobal(val); this._objectAttr = val; },
-  pingPongAny: function(any) { checkGlobal(any); return any; },
-  pingPongObject: function(obj) { checkGlobal(obj); return obj; },
+  set objectAttr(val) { this._objectAttr = val; },
+  get dictionaryAttr() { return this._dictionaryAttr; },
+  set dictionaryAttr(val) { this._dictionaryAttr = val; },
+  pingPongAny: function(any) { return any; },
+  pingPongObject: function(obj) { return obj; },
+  pingPongObjectOrString: function(objectOrString) { return objectOrString; },
+  pingPongDictionary: function(dict) { return dict; },
+  pingPongDictionaryOrLong: function(dictOrLong) { return dictOrLong.anyMember || dictOrLong; },
+  pingPongMap: function(map) { return JSON.stringify(map); },
+  objectSequenceLength: function(seq) { return seq.length; },
+  anySequenceLength: function(seq) { return seq.length; },
+
 
   getCallerPrincipal: function() { return Cu.getWebIDLCallerPrincipal().origin; },
 
diff --git a/dom/bindings/test/mochitest.ini b/dom/bindings/test/mochitest.ini
index 5a93ee176968..cff911b69783 100644
--- a/dom/bindings/test/mochitest.ini
+++ b/dom/bindings/test/mochitest.ini
@@ -17,10 +17,8 @@ support-files =
 [test_bug788369.html]
 [test_bug852846.html]
 [test_bug862092.html]
-# When bug 923904 lands, this test can be turned on, but only for debug builds
-# where we have our test component. So this should become skip-if = debug == false.
-[test_bug923904.html]
-skip-if = true
+[test_bug1036214.html]
+skip-if = debug == false
 [test_bug1041646.html]
 [test_barewordGetsWindow.html]
 [test_callback_default_thisval.html]
diff --git a/dom/bindings/test/test_bug1036214.html b/dom/bindings/test/test_bug1036214.html
new file mode 100644
index 000000000000..dd98eb482f9e
--- /dev/null
+++ b/dom/bindings/test/test_bug1036214.html
@@ -0,0 +1,123 @@
+<!DOCTYPE HTML>
+<html>
+<!--
+https://bugzilla.mozilla.org/show_bug.cgi?id=1036214
+-->
+<head>
+  <meta charset="utf-8">
+  <title>Test for Bug 1036214</title>
+  <script type="application/javascript" src="/tests/SimpleTest/SimpleTest.js"></script>
+  <link rel="stylesheet" type="text/css" href="/tests/SimpleTest/test.css"/>
+  <script type="application/javascript">
+
+  /** Test for subsumes-checking |any| and |object| for js-implemented WebIDL. **/
+  SimpleTest.waitForExplicitFinish();
+  var xoObjects = [];
+  function setup() {
+    xoObjects.push(window[0]);
+    xoObjects.push(window[0].location);
+    xoObjects.push(SpecialPowers.unwrap(SpecialPowers.wrap(window[0]).document));
+    xoObjects.push(SpecialPowers);
+    xoObjects.push(SpecialPowers.wrap);
+    SpecialPowers.pushPrefEnv({set: [['dom.expose_test_interfaces', true]]}, go);
+  }
+
+  function checkThrows(f, msg) {
+    try {
+      f();
+      ok(false, "Should have thrown: " + msg);
+    } catch (e) {
+      ok(true, "Threw correctly: " + msg);
+      ok(/denied|insecure/.test(e), "Threw security exception: " + e);
+    }
+  }
+
+  function go() {
+
+    //
+    // Test the basics of the test interface.
+    //
+
+    var any = { a: 11 };
+    var obj = { b: 22, c: "str" };
+    var obj2 = { foo: "baz" };
+    var myDict = { anyMember: 42, objectMember: { answer: 42 }, objectOrStringMember: { answer: "anobject" },
+                   anySequenceMember: [{}, 1, "thirdinsequence"],
+                   innerDictionary: { innerObject: { answer: "rabbithole" } } };
+    var t = new TestInterfaceJS(any, obj, myDict);
+    is(Object.getPrototypeOf(t), TestInterfaceJS.prototype, "Prototype setup works correctly");
+    is(t.anyArg, any, "anyArg is correct");
+    is(t.objectArg, obj, "objectArg is correct");
+    is(t.dictionaryArg.anyMember, 42, "dictionaryArg looks correct");
+    is(t.dictionaryArg.objectMember.answer, 42, "dictionaryArg looks correct");
+    t.anyAttr = 2;
+    is(t.anyAttr, 2, "ping-pong any attribute works");
+    t.objAttr = obj2;
+    is(t.objAttr, obj2, "ping-pong object attribute works");
+    t.dictionaryAttr = myDict;
+    is(t.dictionaryAttr.anyMember, 42, "ping-pong dictionary attribute works");
+    is(t.dictionaryAttr.objectMember.answer, 42, "ping-pong dictionary attribute works");
+
+    is(any, t.pingPongAny(any), "ping-pong works with any");
+    is(obj, t.pingPongObject(obj), "ping-pong works with obj");
+    is(obj, t.pingPongObjectOrString(obj), "ping-pong works with obj or string");
+    is("foo", t.pingPongObjectOrString("foo"), "ping-pong works with obj or string");
+    is(t.pingPongDictionary(myDict).anyMember, 42, "ping pong works with dict");
+    is(t.pingPongDictionary(myDict).objectMember.answer, 42, "ping pong works with dict");
+    is(t.pingPongDictionary(myDict).objectOrStringMember.answer, "anobject", "ping pong works with dict");
+    is(t.pingPongDictionary(myDict).anySequenceMember[2], "thirdinsequence", "ping pong works with dict");
+    is(t.pingPongDictionary(myDict).innerDictionary.innerObject.answer, "rabbithole", "ping pong works with layered dicts");
+    is(t.pingPongDictionaryOrLong({anyMember: 42}), 42, "ping pong (dict or long) works with dict");
+    is(t.pingPongDictionaryOrLong(42), 42, "ping pong (dict or long) works with long");
+    ok(/canary/.test(t.pingPongMap({ someVal: 42, someOtherVal: "canary" })), "ping pong works with mozmap");
+    is(t.objectSequenceLength([{}, {}, {}]), 3, "ping pong works with object sequence");
+    is(t.anySequenceLength([42, 'string', {}, undefined]), 4, "ping pong works with any sequence");
+
+    //
+    // Test that we throw in the cross-origin cases.
+    //
+
+    xoObjects.forEach(function(xoObj) {
+      var blank = new TestInterfaceJS();
+      checkThrows(() => new TestInterfaceJS(xoObj, undefined), "any param for constructor");
+      checkThrows(() => new TestInterfaceJS(undefined, xoObj), "obj param for constructor");
+      checkThrows(() => new TestInterfaceJS(undefined, undefined, { anyMember: xoObj }), "any dict param for constructor");
+      checkThrows(() => new TestInterfaceJS(undefined, undefined, { objectMember: xoObj }), "object dict param for constructor");
+      checkThrows(() => new TestInterfaceJS(undefined, undefined, { objectOrStringMember: xoObj }), "union dict param for constructor");
+      checkThrows(() => new TestInterfaceJS(undefined, undefined, { anySequenceMember: [0, xoObj, 'hi' ] }), "sequence dict param for constructor");
+      checkThrows(() => new TestInterfaceJS(undefined, undefined, { innerDictionary: { innerObject: xoObj } }), "inner dict param for constructor");
+      checkThrows(() => t.anyAttr = xoObj, "anyAttr");
+      checkThrows(() => t.objectAttr = xoObj, "objAttr");
+      checkThrows(() => t.dictionaryAttr = { anyMember: xoObj }, "dictionaryAttr any");
+      checkThrows(() => t.dictionaryAttr = { objectMember: xoObj }, "dictionaryAttr object");
+      checkThrows(() => t.pingPongAny(xoObj), "pingpong any");
+      checkThrows(() => t.pingPongObject(xoObj), "pingpong obj");
+      checkThrows(() => t.pingPongObjectOrString(xoObj), "pingpong union");
+      checkThrows(() => t.pingPongDictionary({ anyMember: xoObj }), "dictionary pingpong any");
+      checkThrows(() => t.pingPongDictionary({ objectMember: xoObj }), "dictionary pingpong object");
+      checkThrows(() => t.pingPongDictionary({ anyMember: xoObj, objectMember: xoObj }), "dictionary pingpong both");
+      checkThrows(() => t.pingPongDictionary({ objectOrStringMember: xoObj }), "dictionary pingpong objectorstring");
+      checkThrows(() => t.pingPongDictionaryOrLong({ objectMember: xoObj }), "unionable dictionary");
+      checkThrows(() => t.pingPongDictionaryOrLong({ anyMember: xoObj }), "unionable dictionary");
+      checkThrows(() => t.pingPongMap({ someMember: 42, someOtherMember: {}, crossOriginMember: xoObj }), "mozmap");
+      checkThrows(() => t.objectSequenceLength([{}, {}, xoObj, {}]), "object sequence");
+      checkThrows(() => t.anySequenceLength([42, 'someString', xoObj, {}]), "any sequence");
+    });
+
+
+    SimpleTest.finish();
+  }
+
+  </script>
+</head>
+<body>
+<a target="_blank" href="https://bugzilla.mozilla.org/show_bug.cgi?id=1036214">Mozilla Bug 1036214</a>
+<p id="display"></p>
+<div id="content" style="display: none">
+
+</div>
+<pre id="test">
+</pre>
+<iframe id="ifr" onload="setup();" src="http://example.org/tests/js/xpconnect/tests/mochitest/file_empty.html"></iframe>
+</body>
+</html>
diff --git a/dom/bindings/test/test_bug923904.html b/dom/bindings/test/test_bug923904.html
deleted file mode 100644
index 6700097ef1b7..000000000000
--- a/dom/bindings/test/test_bug923904.html
+++ /dev/null
@@ -1,66 +0,0 @@
-<!DOCTYPE HTML>
-<html>
-<!--
-https://bugzilla.mozilla.org/show_bug.cgi?id=923904
--->
-<head>
-  <meta charset="utf-8">
-  <title>Test for Bug 923904</title>
-  <script type="application/javascript" src="/tests/SimpleTest/SimpleTest.js"></script>
-  <link rel="stylesheet" type="text/css" href="/tests/SimpleTest/test.css"/>
-  <script type="application/javascript">
-
-  /** Test for cloning of |any| and |object| for JS-Implemented WebIDL. **/
-  SimpleTest.waitForExplicitFinish();
-  SpecialPowers.pushPrefEnv({set: [['dom.expose_test_interfaces', true]]}, go);
-
-  function go() {
-    var someAny = { a: 11 };
-    var someObj = { b: 22, c: "str" };
-    var t = new TestInterfaceJS(someAny, someObj);
-    is(Object.getPrototypeOf(t), TestInterfaceJS.prototype, "Prototype setup works correctly");
-    is(t.anyArg.toSource(), someAny.toSource(), "anyArg comes back looking like what we sent");
-    is(t.objectArg.toSource(), someObj.toSource(), "objectArg comes back looking like what we sent");
-    isnot(t.anyArg, t.anyArg, "get a new anyArg each time");
-    isnot(t.objectArg, t.objectArg, "get a new objectArg each time");
-
-    t.anyAttr = 2;
-    is(t.anyAttr, 2, "ping-pong works");
-    testObjectCloned(t, 'anyAttr');
-    testObjectCloned(t, 'objectAttr');
-
-    is(someAny.toSource(), t.pingPongAny(someAny).toSource(), "ping-pong works with any");
-    is(someObj.toSource(), t.pingPongObject(someObj).toSource(), "ping-pong works with obj");
-    isnot(someAny, t.pingPongAny(someAny), "Clone works for ping-pong any");
-    isnot(someObj, t.pingPongObject(someObj), "Clone works for ping-pong obj");
-
-    SimpleTest.finish();
-  }
-
-  function testObjectCloned(iface, propname) {
-    var obj = { prop: 42 };
-    iface[propname] = obj;
-    is(iface[propname].prop, 42, "objects come back as well");
-    is(iface[propname].__proto__, Object.prototype, "vanilla object");
-    isnot(iface[propname], obj, "Should not be the original object");
-    isnot(iface[propname], iface[propname], "Should get cloned each time");
-    try {
-      iface[propname] = { stringProp: "hi", reflectorProp: document };
-      ok(false, "Should throw when trying to clone reflector");
-    } catch (e) {
-      ok(/cloned/.test(e), "Should throw clone error: " + e);
-    }
-  }
-
-  </script>
-</head>
-<body>
-<a target="_blank" href="https://bugzilla.mozilla.org/show_bug.cgi?id=923904">Mozilla Bug 923904</a>
-<p id="display"></p>
-<div id="content" style="display: none">
-
-</div>
-<pre id="test">
-</pre>
-</body>
-</html>
diff --git a/dom/canvas/CanvasRenderingContext2D.cpp b/dom/canvas/CanvasRenderingContext2D.cpp
index a022ba086dee..19e8e943252a 100644
--- a/dom/canvas/CanvasRenderingContext2D.cpp
+++ b/dom/canvas/CanvasRenderingContext2D.cpp
@@ -1985,7 +1985,7 @@ CanvasRenderingContext2D::ArcTo(double x1, double y1, double x2,
   }
 
   // Check for colinearity
-  dir = (p2.x - p1.x) * (p0.y - p1.y) + (p2.y - p1.y) * (p1.x - p0.x);
+  dir = (p2.x - p1.x).value * (p0.y - p1.y).value + (p2.y - p1.y).value * (p1.x - p0.x).value;
   if (dir == 0) {
     LineTo(p1.x, p1.y);
     return;
@@ -4500,7 +4500,7 @@ CanvasPath::ArcTo(double x1, double y1, double x2, double y2, double radius,
   }
 
   // Check for colinearity
-  dir = (p2.x - p1.x) * (p0.y - p1.y) + (p2.y - p1.y) * (p1.x - p0.x);
+  dir = (p2.x - p1.x).value * (p0.y - p1.y).value + (p2.y - p1.y).value * (p1.x - p0.x).value;
   if (dir == 0) {
     LineTo(p1.x, p1.y);
     return;
diff --git a/dom/canvas/CanvasRenderingContext2D.h b/dom/canvas/CanvasRenderingContext2D.h
index 9f9d784bfedc..f6ae0d13a2c0 100644
--- a/dom/canvas/CanvasRenderingContext2D.h
+++ b/dom/canvas/CanvasRenderingContext2D.h
@@ -790,7 +790,7 @@ protected:
     // The spec says we should not draw shadows if the operator is OVER.
     // If it's over and the alpha value is zero, nothing needs to be drawn.
     return NS_GET_A(state.shadowColor) != 0 &&
-      (state.shadowBlur != 0 || state.shadowOffset.x != 0 || state.shadowOffset.y != 0);
+      (state.shadowBlur != 0.f || state.shadowOffset.x != 0.f || state.shadowOffset.y != 0.f);
   }
 
   mozilla::gfx::CompositionOp UsedOperation()
diff --git a/dom/events/EventStateManager.cpp b/dom/events/EventStateManager.cpp
index 40905adb4225..451e692a8e9a 100644
--- a/dom/events/EventStateManager.cpp
+++ b/dom/events/EventStateManager.cpp
@@ -1595,8 +1595,9 @@ EventStateManager::GenerateDragGesture(nsPresContext* aPresContext,
     // fire drag gesture if mouse has moved enough
     LayoutDeviceIntPoint pt = aEvent->refPoint +
       LayoutDeviceIntPoint::FromUntyped(aEvent->widget->WidgetToScreenOffset());
-    if (DeprecatedAbs(pt.x - mGestureDownPoint.x) > pixelThresholdX ||
-        DeprecatedAbs(pt.y - mGestureDownPoint.y) > pixelThresholdY) {
+    LayoutDeviceIntPoint distance = pt - mGestureDownPoint;
+    if (Abs(distance.x.value) > SafeCast<uint32_t>(pixelThresholdX) ||
+        Abs(distance.y.value) > SafeCast<uint32_t>(pixelThresholdY)) {
       if (Prefs::ClickHoldContextMenu()) {
         // stop the click-hold before we fire off the drag gesture, in case
         // it takes a long time
diff --git a/dom/interfaces/base/nsIServiceWorkerManager.idl b/dom/interfaces/base/nsIServiceWorkerManager.idl
index 09563769dd6e..d47480444e64 100644
--- a/dom/interfaces/base/nsIServiceWorkerManager.idl
+++ b/dom/interfaces/base/nsIServiceWorkerManager.idl
@@ -8,7 +8,7 @@
 interface nsIDocument;
 interface nsIURI;
 
-[uuid(cc539f1e-1ce6-4af5-bf94-195b30bde010)]
+[uuid(9b5acea4-2601-4ac7-8836-4352ceb88178)]
 interface nsIServiceWorkerManager : nsISupports
 {
   // Returns a Promise
@@ -17,9 +17,9 @@ interface nsIServiceWorkerManager : nsISupports
   // Returns a Promise
   nsISupports unregister(in nsIDOMWindow aWindow, in DOMString aScope);
 
-  // aTarget MUST be a ServiceWorkerContainer.
-  [noscript] void AddContainerEventListener(in nsIURI aPageURI, in nsIDOMEventTarget aTarget);
-  [noscript] void RemoveContainerEventListener(in nsIURI aPageURI, in nsIDOMEventTarget aTarget);
+  // aTarget MUST be a ServiceWorkerRegistration.
+  [noscript] void AddRegistrationEventListener(in nsIURI aPageURI, in nsIDOMEventTarget aTarget);
+  [noscript] void RemoveRegistrationEventListener(in nsIURI aPageURI, in nsIDOMEventTarget aTarget);
 
   /**
    * Call this to request that document `aDoc` be controlled by a ServiceWorker
diff --git a/dom/media/MediaManager.cpp b/dom/media/MediaManager.cpp
index 4e6e8af82a1f..92de646b3faf 100644
--- a/dom/media/MediaManager.cpp
+++ b/dom/media/MediaManager.cpp
@@ -2102,12 +2102,12 @@ MediaManager::MediaCaptureWindowStateInternal(nsIDOMWindow* aWindow, bool* aVide
   // results.
   nsCOMPtr<nsPIDOMWindow> piWin = do_QueryInterface(aWindow);
   if (piWin) {
-    if (piWin->GetCurrentInnerWindow() || piWin->IsInnerWindow()) {
+    if (piWin->IsInnerWindow() || piWin->GetCurrentInnerWindow()) {
       uint64_t windowID;
-      if (piWin->GetCurrentInnerWindow()) {
-        windowID = piWin->GetCurrentInnerWindow()->WindowID();
-      } else {
+      if (piWin->IsInnerWindow()) {
         windowID = piWin->WindowID();
+      } else {
+        windowID = piWin->GetCurrentInnerWindow()->WindowID();
       }
       StreamListeners* listeners = GetActiveWindows()->Get(windowID);
       if (listeners) {
diff --git a/dom/smil/test/smilTestUtils.js b/dom/smil/test/smilTestUtils.js
index 02775de7013d..60ff7aaab9bf 100644
--- a/dom/smil/test/smilTestUtils.js
+++ b/dom/smil/test/smilTestUtils.js
@@ -55,14 +55,14 @@ var SMILUtil =
   },
 
   // Smart wrapper for getComputedStyle, which will generate a "fake" computed
-  // style for recognized shorthand properties (font, overflow, marker)
+  // style for recognized shorthand properties (font, font-variant, overflow, marker)
   getComputedStyleWrapper : function(elem, propName)
   {
     // Special cases for shorthand properties (which aren't directly queriable
     // via getComputedStyle)
     var computedStyle;
     if (propName == "font") {
-      var subProps = ["font-style", "font-variant", "font-weight",
+      var subProps = ["font-style", "font-variant-caps", "font-weight",
                       "font-size", "line-height", "font-family"];
       for (var i in subProps) {
         var subPropStyle = SMILUtil.getComputedStyleSimple(elem, subProps[i]);
@@ -78,6 +78,10 @@ var SMILUtil =
           }
         }
       }
+    } else if (propName == "font-variant") {
+      // xxx - this isn't completely correct but it's sufficient for what's
+      //       being tested here
+      computedStyle = SMILUtil.getComputedStyleSimple(elem, "font-variant-caps");
     } else if (propName == "marker") {
       var subProps = ["marker-end", "marker-mid", "marker-start"];
       for (var i in subProps) {
diff --git a/dom/webidl/ServiceWorkerContainer.webidl b/dom/webidl/ServiceWorkerContainer.webidl
index 126db64620ae..9364a059dc0e 100644
--- a/dom/webidl/ServiceWorkerContainer.webidl
+++ b/dom/webidl/ServiceWorkerContainer.webidl
@@ -8,29 +8,27 @@
  *
  */
 
-[Pref="dom.serviceWorkers.enabled"]
-interface ServiceWorkerContainer {
+[Pref="dom.serviceWorkers.enabled",
+ Exposed=Window]
+interface ServiceWorkerContainer : EventTarget {
   // FIXME(nsm):
   // https://github.com/slightlyoff/ServiceWorker/issues/198
   // and discussion at https://etherpad.mozilla.org/serviceworker07apr
-  [Unforgeable] readonly attribute ServiceWorker? installing;
-  [Unforgeable] readonly attribute ServiceWorker? waiting;
-  [Unforgeable] readonly attribute ServiceWorker? active;
   [Unforgeable] readonly attribute ServiceWorker? controller;
 
   [Throws]
-  readonly attribute Promise<any> ready;
+  readonly attribute Promise<ServiceWorkerRegistration> ready;
 
   [Throws]
-  Promise<any> getAll();
+  Promise<ServiceWorkerRegistration> register(ScalarValueString scriptURL,
+                                              optional RegistrationOptionList options);
 
   [Throws]
-  Promise<ServiceWorker> register(DOMString url, optional RegistrationOptionList options);
+  Promise<ServiceWorkerRegistration> getRegistration(optional ScalarValueString documentURL = "");
 
   [Throws]
-  Promise<any> unregister(DOMString? scope);
+   Promise<sequence<ServiceWorkerRegistration>> getRegistrations();
 
-  attribute EventHandler onupdatefound;
   attribute EventHandler oncontrollerchange;
   attribute EventHandler onreloadpage;
   attribute EventHandler onerror;
@@ -49,5 +47,5 @@ partial interface ServiceWorkerContainer {
 };
 
 dictionary RegistrationOptionList {
-  DOMString scope = "/*";
+  ScalarValueString scope = "/*";
 };
diff --git a/dom/webidl/ServiceWorkerRegistration.webidl b/dom/webidl/ServiceWorkerRegistration.webidl
new file mode 100644
index 000000000000..7463765c512f
--- /dev/null
+++ b/dom/webidl/ServiceWorkerRegistration.webidl
@@ -0,0 +1,25 @@
+/* -*- Mode: IDL; tab-width: 2; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this file,
+ * You can obtain one at http://mozilla.org/MPL/2.0/.
+ *
+ * The origin of this IDL file is
+ * http://slightlyoff.github.io/ServiceWorker/spec/service_worker/index.html
+ *
+ */
+
+[Pref="dom.serviceWorkers.enabled",
+ Exposed=Window]
+interface ServiceWorkerRegistration : EventTarget {
+  [Unforgeable] readonly attribute ServiceWorker? installing;
+  [Unforgeable] readonly attribute ServiceWorker? waiting;
+  [Unforgeable] readonly attribute ServiceWorker? active;
+
+  readonly attribute ScalarValueString scope;
+
+  [Throws]
+  Promise<boolean> unregister();
+
+  // event
+  attribute EventHandler onupdatefound;
+};
diff --git a/dom/webidl/TestInterfaceJS.webidl b/dom/webidl/TestInterfaceJS.webidl
index f5e913860b87..77cb253d3344 100644
--- a/dom/webidl/TestInterfaceJS.webidl
+++ b/dom/webidl/TestInterfaceJS.webidl
@@ -4,16 +4,29 @@
  * You can obtain one at http://mozilla.org/MPL/2.0/.
  */
 
+dictionary TestInterfaceJSUnionableDictionary {
+  object objectMember;
+  any anyMember;
+};
+
 [JSImplementation="@mozilla.org/dom/test-interface-js;1",
  Pref="dom.expose_test_interfaces",
- Constructor(optional any anyArg, optional object objectArg)]
+ Constructor(optional any anyArg, optional object objectArg, optional TestInterfaceJSDictionary dictionaryArg)]
 interface TestInterfaceJS {
   readonly attribute any anyArg;
   readonly attribute object objectArg;
+  [Cached, Pure] readonly attribute TestInterfaceJSDictionary dictionaryArg;
   attribute any anyAttr;
   attribute object objectAttr;
+  [Cached, Pure] attribute TestInterfaceJSDictionary dictionaryAttr;
   any pingPongAny(any arg);
-  object pingPongObject(any obj);
+  object pingPongObject(object obj);
+  any pingPongObjectOrString((object or DOMString) objOrString);
+  TestInterfaceJSDictionary pingPongDictionary(optional TestInterfaceJSDictionary dict);
+  long pingPongDictionaryOrLong(optional (TestInterfaceJSUnionableDictionary or long) dictOrLong);
+  DOMString pingPongMap(MozMap<any> map);
+  long objectSequenceLength(sequence<object> seq);
+  long anySequenceLength(sequence<any> seq);
 
   // For testing bug 968335.
   DOMString getCallerPrincipal();
diff --git a/dom/webidl/TestInterfaceJSDictionaries.webidl b/dom/webidl/TestInterfaceJSDictionaries.webidl
new file mode 100644
index 000000000000..366864a8d4f8
--- /dev/null
+++ b/dom/webidl/TestInterfaceJSDictionaries.webidl
@@ -0,0 +1,27 @@
+/* -*- Mode: IDL; tab-width: 2; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this file,
+ * You can obtain one at http://mozilla.org/MPL/2.0/.
+ */
+
+//
+// These dictionaries are in a separate WebIDL file to avoid circular include
+// problems. One of the dictionary includes a union as a member, so that
+// dictionary's header needs to include UnionTypes.h. But the API in
+// TestInterfaceJS also declares a union of dictionaries, so _that_
+// dictionary's header needs to be included _by_ UnionTypes.h. The solution
+// is to separate those two dictionaries into separate header files.
+//
+
+dictionary TestInterfaceJSDictionary2 {
+  object innerObject;
+};
+
+dictionary TestInterfaceJSDictionary {
+  TestInterfaceJSDictionary2 innerDictionary;
+  object objectMember;
+  any anyMember;
+  (object or DOMString) objectOrStringMember;
+  sequence<any> anySequenceMember;
+};
+
diff --git a/dom/webidl/moz.build b/dom/webidl/moz.build
index 8e179f12e6fa..8251b148552b 100644
--- a/dom/webidl/moz.build
+++ b/dom/webidl/moz.build
@@ -326,6 +326,7 @@ WEBIDL_FILES = [
     'ServiceWorker.webidl',
     'ServiceWorkerContainer.webidl',
     'ServiceWorkerGlobalScope.webidl',
+    'ServiceWorkerRegistration.webidl',
     'SettingsManager.webidl',
     'ShadowRoot.webidl',
     'SharedWorker.webidl',
@@ -563,7 +564,7 @@ WEBIDL_FILES += [
 # We only expose our prefable test interfaces in debug builds, just to be on
 # the safe side.
 if CONFIG['MOZ_DEBUG']:
-    WEBIDL_FILES += ['TestInterfaceJS.webidl']
+    WEBIDL_FILES += ['TestInterfaceJS.webidl', 'TestInterfaceJSDictionaries.webidl']
 
 if CONFIG['MOZ_B2G_BT']:
     if CONFIG['MOZ_B2G_BT_API_V2']:
diff --git a/dom/workers/ServiceWorkerCommon.h b/dom/workers/ServiceWorkerCommon.h
new file mode 100644
index 000000000000..e9082bbc651c
--- /dev/null
+++ b/dom/workers/ServiceWorkerCommon.h
@@ -0,0 +1,25 @@
+/* -*- Mode: C++; tab-width: 8; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
+/* vim: set ts=8 sts=2 et sw=2 tw=80: */
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+#ifndef mozilla_dom_ServiceWorkerCommon_h
+#define mozilla_dom_ServiceWorkerCommon_h
+
+namespace mozilla {
+namespace dom {
+
+// Use multiples of 2 since they can be bitwise ORed when calling
+// InvalidateServiceWorkerRegistrationWorker.
+MOZ_BEGIN_ENUM_CLASS(WhichServiceWorker)
+  INSTALLING_WORKER = 1,
+  WAITING_WORKER    = 2,
+  ACTIVE_WORKER     = 4,
+MOZ_END_ENUM_CLASS(WhichServiceWorker)
+MOZ_MAKE_ENUM_CLASS_BITWISE_OPERATORS(WhichServiceWorker)
+
+} // dom namespace
+} // mozilla namespace
+
+#endif // mozilla_dom_ServiceWorkerCommon_h
diff --git a/dom/workers/ServiceWorkerContainer.cpp b/dom/workers/ServiceWorkerContainer.cpp
index 4c49e0f75965..fa80a02ce793 100644
--- a/dom/workers/ServiceWorkerContainer.cpp
+++ b/dom/workers/ServiceWorkerContainer.cpp
@@ -22,7 +22,6 @@
 
 namespace mozilla {
 namespace dom {
-namespace workers {
 
 NS_INTERFACE_MAP_BEGIN_CYCLE_COLLECTION_INHERITED(ServiceWorkerContainer)
 NS_INTERFACE_MAP_END_INHERITING(DOMEventTargetHelper)
@@ -31,21 +30,16 @@ NS_IMPL_ADDREF_INHERITED(ServiceWorkerContainer, DOMEventTargetHelper)
 NS_IMPL_RELEASE_INHERITED(ServiceWorkerContainer, DOMEventTargetHelper)
 
 NS_IMPL_CYCLE_COLLECTION_INHERITED(ServiceWorkerContainer, DOMEventTargetHelper,
-                                   mInstallingWorker,
-                                   mWaitingWorker,
-                                   mActiveWorker,
                                    mControllerWorker)
 
 ServiceWorkerContainer::ServiceWorkerContainer(nsPIDOMWindow* aWindow)
   : mWindow(aWindow)
 {
   SetIsDOMBinding();
-  StartListeningForEvents();
 }
 
 ServiceWorkerContainer::~ServiceWorkerContainer()
 {
-  StopListeningForEvents();
 }
 
 JSObject*
@@ -77,61 +71,6 @@ ServiceWorkerContainer::Register(const nsAString& aScriptURL,
   return ret.forget();
 }
 
-already_AddRefed<Promise>
-ServiceWorkerContainer::Unregister(const nsAString& aScope,
-                                   ErrorResult& aRv)
-{
-  nsCOMPtr<nsISupports> promise;
-
-  nsCOMPtr<nsIServiceWorkerManager> swm = mozilla::services::GetServiceWorkerManager();
-  if (!swm) {
-    aRv.Throw(NS_ERROR_FAILURE);
-    return nullptr;
-  }
-
-  aRv = swm->Unregister(mWindow, aScope, getter_AddRefs(promise));
-  if (aRv.Failed()) {
-    return nullptr;
-  }
-
-  nsRefPtr<Promise> ret = static_cast<Promise*>(promise.get());
-  MOZ_ASSERT(ret);
-  return ret.forget();
-}
-
-already_AddRefed<workers::ServiceWorker>
-ServiceWorkerContainer::GetInstalling()
-{
-  if (!mInstallingWorker) {
-    mInstallingWorker = GetWorkerReference(WhichServiceWorker::INSTALLING_WORKER);
-  }
-
-  nsRefPtr<ServiceWorker> ret = mInstallingWorker;
-  return ret.forget();
-}
-
-already_AddRefed<workers::ServiceWorker>
-ServiceWorkerContainer::GetWaiting()
-{
-  if (!mWaitingWorker) {
-    mWaitingWorker = GetWorkerReference(WhichServiceWorker::WAITING_WORKER);
-  }
-
-  nsRefPtr<ServiceWorker> ret = mWaitingWorker;
-  return ret.forget();
-}
-
-already_AddRefed<workers::ServiceWorker>
-ServiceWorkerContainer::GetActive()
-{
-  if (!mActiveWorker) {
-    mActiveWorker = GetWorkerReference(WhichServiceWorker::ACTIVE_WORKER);
-  }
-
-  nsRefPtr<ServiceWorker> ret = mActiveWorker;
-  return ret.forget();
-}
-
 already_AddRefed<workers::ServiceWorker>
 ServiceWorkerContainer::GetController()
 {
@@ -148,15 +87,25 @@ ServiceWorkerContainer::GetController()
       return nullptr;
     }
 
-    mControllerWorker = static_cast<ServiceWorker*>(serviceWorker.get());
+    mControllerWorker =
+      static_cast<workers::ServiceWorker*>(serviceWorker.get());
   }
 
-  nsRefPtr<ServiceWorker> ref = mControllerWorker;
+  nsRefPtr<workers::ServiceWorker> ref = mControllerWorker;
   return ref.forget();
 }
 
 already_AddRefed<Promise>
-ServiceWorkerContainer::GetAll(ErrorResult& aRv)
+ServiceWorkerContainer::GetRegistrations(ErrorResult& aRv)
+{
+  // FIXME(nsm): Bug 1002571
+  aRv.Throw(NS_ERROR_DOM_NOT_SUPPORTED_ERR);
+  return nullptr;
+}
+
+already_AddRefed<Promise>
+ServiceWorkerContainer::GetRegistration(const nsAString& aDocumentURL,
+                                        ErrorResult& aRv)
 {
   // FIXME(nsm): Bug 1002571
   aRv.Throw(NS_ERROR_DOM_NOT_SUPPORTED_ERR);
@@ -171,74 +120,6 @@ ServiceWorkerContainer::GetReady(ErrorResult& aRv)
   return Promise::Create(global, aRv);
 }
 
-// XXXnsm, maybe this can be optimized to only add when a event handler is
-// registered.
-void
-ServiceWorkerContainer::StartListeningForEvents()
-{
-  nsCOMPtr<nsIServiceWorkerManager> swm = mozilla::services::GetServiceWorkerManager();
-  if (swm) {
-    swm->AddContainerEventListener(mWindow->GetDocumentURI(), this);
-  }
-}
-
-void
-ServiceWorkerContainer::StopListeningForEvents()
-{
-  nsCOMPtr<nsIServiceWorkerManager> swm = mozilla::services::GetServiceWorkerManager();
-  if (swm) {
-    swm->RemoveContainerEventListener(mWindow->GetDocumentURI(), this);
-  }
-}
-
-void
-ServiceWorkerContainer::InvalidateWorkerReference(WhichServiceWorker aWhichOnes)
-{
-  if (aWhichOnes & WhichServiceWorker::INSTALLING_WORKER) {
-    mInstallingWorker = nullptr;
-  }
-
-  if (aWhichOnes & WhichServiceWorker::WAITING_WORKER) {
-    mWaitingWorker = nullptr;
-  }
-
-  if (aWhichOnes & WhichServiceWorker::ACTIVE_WORKER) {
-    mActiveWorker = nullptr;
-  }
-}
-
-already_AddRefed<workers::ServiceWorker>
-ServiceWorkerContainer::GetWorkerReference(WhichServiceWorker aWhichOne)
-{
-  nsresult rv;
-  nsCOMPtr<nsIServiceWorkerManager> swm = mozilla::services::GetServiceWorkerManager();
-  if (!swm) {
-    return nullptr;
-  }
-
-  nsCOMPtr<nsISupports> serviceWorker;
-  switch(aWhichOne) {
-    case WhichServiceWorker::INSTALLING_WORKER:
-      rv = swm->GetInstalling(mWindow, getter_AddRefs(serviceWorker));
-      break;
-    case WhichServiceWorker::WAITING_WORKER:
-      rv = swm->GetWaiting(mWindow, getter_AddRefs(serviceWorker));
-      break;
-    case WhichServiceWorker::ACTIVE_WORKER:
-      rv = swm->GetActive(mWindow, getter_AddRefs(serviceWorker));
-      break;
-    default:
-      MOZ_CRASH("Invalid enum value");
-  }
-
-  if (NS_WARN_IF(NS_FAILED(rv))) {
-    return nullptr;
-  }
-
-  nsRefPtr<ServiceWorker> ref = static_cast<ServiceWorker*>(serviceWorker.get());
-  return ref.forget();
-}
-
 // Testing only.
 already_AddRefed<Promise>
 ServiceWorkerContainer::ClearAllServiceWorkerData(ErrorResult& aRv)
@@ -271,6 +152,5 @@ ServiceWorkerContainer::GetControllingWorkerScriptURLForPath(
 {
   aRv.Throw(NS_ERROR_DOM_NOT_SUPPORTED_ERR);
 }
-} // namespace workers
 } // namespace dom
 } // namespace mozilla
diff --git a/dom/workers/ServiceWorkerContainer.h b/dom/workers/ServiceWorkerContainer.h
index 5fc3ec1603c0..b8b2706b127f 100644
--- a/dom/workers/ServiceWorkerContainer.h
+++ b/dom/workers/ServiceWorkerContainer.h
@@ -4,13 +4,11 @@
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
 
-#ifndef mozilla_dom_workers_serviceworkercontainer_h__
-#define mozilla_dom_workers_serviceworkercontainer_h__
+#ifndef mozilla_dom_serviceworkercontainer_h__
+#define mozilla_dom_serviceworkercontainer_h__
 
 #include "mozilla/DOMEventTargetHelper.h"
 
-#include "ServiceWorkerManager.h"
-
 class nsPIDOMWindow;
 
 namespace mozilla {
@@ -20,8 +18,8 @@ class Promise;
 struct RegistrationOptionList;
 
 namespace workers {
-
 class ServiceWorker;
+}
 
 // Lightweight serviceWorker APIs collection.
 class ServiceWorkerContainer MOZ_FINAL : public DOMEventTargetHelper
@@ -30,7 +28,6 @@ public:
   NS_DECL_ISUPPORTS_INHERITED
   NS_DECL_CYCLE_COLLECTION_CLASS_INHERITED(ServiceWorkerContainer, DOMEventTargetHelper)
 
-  IMPL_EVENT_HANDLER(updatefound)
   IMPL_EVENT_HANDLER(controllerchange)
   IMPL_EVENT_HANDLER(reloadpage)
   IMPL_EVENT_HANDLER(error)
@@ -51,39 +48,19 @@ public:
            const RegistrationOptionList& aOptions,
            ErrorResult& aRv);
 
-  already_AddRefed<Promise>
-  Unregister(const nsAString& scope, ErrorResult& aRv);
-
-  already_AddRefed<ServiceWorker>
-  GetInstalling();
-
-  already_AddRefed<ServiceWorker>
-  GetWaiting();
-
-  already_AddRefed<ServiceWorker>
-  GetActive();
-
-  already_AddRefed<ServiceWorker>
+  already_AddRefed<workers::ServiceWorker>
   GetController();
 
   already_AddRefed<Promise>
-  GetAll(ErrorResult& aRv);
+  GetRegistration(const nsAString& aDocumentURL,
+                  ErrorResult& aRv);
+
+  already_AddRefed<Promise>
+  GetRegistrations(ErrorResult& aRv);
 
   already_AddRefed<Promise>
   GetReady(ErrorResult& aRv);
 
-  nsIURI*
-  GetDocumentURI() const
-  {
-    return mWindow->GetDocumentURI();
-  }
-
-  void
-  InvalidateWorkerReference(WhichServiceWorker aWhichOnes);
-
-  already_AddRefed<workers::ServiceWorker>
-  GetWorkerReference(WhichServiceWorker aWhichOne);
-
   // Testing only.
   already_AddRefed<Promise>
   ClearAllServiceWorkerData(ErrorResult& aRv);
@@ -100,28 +77,14 @@ public:
 private:
   ~ServiceWorkerContainer();
 
-  void
-  StartListeningForEvents();
-
-  void
-  StopListeningForEvents();
-
   nsCOMPtr<nsPIDOMWindow> mWindow;
 
-  // The following properties are cached here to ensure JS equality is satisfied
-  // instead of acquiring a new worker instance from the ServiceWorkerManager
-  // for every access. A null value is considered a cache miss.
-  // These three may change to a new worker at any time.
-  nsRefPtr<ServiceWorker> mInstallingWorker;
-  nsRefPtr<ServiceWorker> mWaitingWorker;
-  nsRefPtr<ServiceWorker> mActiveWorker;
   // This only changes when a worker hijacks everything in its scope by calling
   // replace().
   // FIXME(nsm): Bug 982711. Provide API to let SWM invalidate this.
-  nsRefPtr<ServiceWorker> mControllerWorker;
+  nsRefPtr<workers::ServiceWorker> mControllerWorker;
 };
 
-} // namespace workers
 } // namespace dom
 } // namespace mozilla
 
diff --git a/dom/workers/ServiceWorkerManager.cpp b/dom/workers/ServiceWorkerManager.cpp
index f049d4f3b31a..72129914179c 100644
--- a/dom/workers/ServiceWorkerManager.cpp
+++ b/dom/workers/ServiceWorkerManager.cpp
@@ -24,7 +24,7 @@
 
 #include "RuntimeService.h"
 #include "ServiceWorker.h"
-#include "ServiceWorkerContainer.h"
+#include "ServiceWorkerRegistration.h"
 #include "ServiceWorkerEvents.h"
 #include "WorkerInlines.h"
 #include "WorkerPrivate.h"
@@ -36,7 +36,7 @@ using namespace mozilla::dom;
 
 BEGIN_WORKERS_NAMESPACE
 
-NS_IMPL_ISUPPORTS0(ServiceWorkerRegistration)
+NS_IMPL_ISUPPORTS0(ServiceWorkerRegistrationInfo)
 
 UpdatePromise::UpdatePromise()
   : mState(Pending)
@@ -80,6 +80,7 @@ UpdatePromise::ResolveAllPromises(const nsACString& aScriptSpec, const nsACStrin
 
       GlobalObject domGlobal(cx, global);
 
+      // The service worker is created and kept alive as a SharedWorker.
       nsRefPtr<ServiceWorker> serviceWorker;
       nsresult rv = rs->CreateServiceWorker(domGlobal,
                                             NS_ConvertUTF8toUTF16(aScriptSpec),
@@ -90,7 +91,14 @@ UpdatePromise::ResolveAllPromises(const nsACString& aScriptSpec, const nsACStrin
         continue;
       }
 
-      pendingPromise->MaybeResolve(serviceWorker);
+      // Since ServiceWorkerRegistration is only exposed to windows we can be
+      // certain about this cast.
+      nsCOMPtr<nsPIDOMWindow> window =
+        do_QueryInterface(pendingPromise->GetParentObject());
+      nsRefPtr<ServiceWorkerRegistration> swr =
+        new ServiceWorkerRegistration(window, NS_ConvertUTF8toUTF16(aScope));
+
+      pendingPromise->MaybeResolve(swr);
     }
   }
 }
@@ -107,7 +115,7 @@ UpdatePromise::RejectAllPromises(nsresult aRv)
   for (uint32_t i = 0; i < array.Length(); ++i) {
     WeakPtr<Promise>& pendingPromise = array.ElementAt(i);
     if (pendingPromise) {
-      // Since ServiceWorkerContainer is only exposed to windows we can be
+      // Since ServiceWorkerRegistration is only exposed to windows we can be
       // certain about this cast.
       nsCOMPtr<nsPIDOMWindow> window =
         do_QueryInterface(pendingPromise->GetParentObject());
@@ -129,7 +137,7 @@ UpdatePromise::RejectAllPromises(const ErrorEventInit& aErrorDesc)
   for (uint32_t i = 0; i < array.Length(); ++i) {
     WeakPtr<Promise>& pendingPromise = array.ElementAt(i);
     if (pendingPromise) {
-      // Since ServiceWorkerContainer is only exposed to windows we can be
+      // Since ServiceWorkerRegistration is only exposed to windows we can be
       // certain about this cast.
       nsCOMPtr<nsIGlobalObject> go = do_QueryInterface(pendingPromise->GetParentObject());
       MOZ_ASSERT(go);
@@ -208,7 +216,7 @@ public:
 class ServiceWorkerUpdateInstance MOZ_FINAL : public nsISupports
 {
   // Owner of this instance.
-  ServiceWorkerRegistration* mRegistration;
+  ServiceWorkerRegistrationInfo* mRegistration;
   nsCString mScriptSpec;
   nsCOMPtr<nsPIDOMWindow> mWindow;
 
@@ -219,7 +227,7 @@ class ServiceWorkerUpdateInstance MOZ_FINAL : public nsISupports
 public:
   NS_DECL_ISUPPORTS
 
-  ServiceWorkerUpdateInstance(ServiceWorkerRegistration *aRegistration,
+  ServiceWorkerUpdateInstance(ServiceWorkerRegistrationInfo *aRegistration,
                               nsPIDOMWindow* aWindow)
     : mRegistration(aRegistration),
       // Capture the current script spec in case register() gets called.
@@ -297,13 +305,13 @@ FinishFetchOnMainThreadRunnable::Run()
   return NS_OK;
 }
 
-ServiceWorkerRegistration::ServiceWorkerRegistration(const nsACString& aScope)
+ServiceWorkerRegistrationInfo::ServiceWorkerRegistrationInfo(const nsACString& aScope)
   : mControlledDocumentsCounter(0),
     mScope(aScope),
     mPendingUninstall(false)
 { }
 
-ServiceWorkerRegistration::~ServiceWorkerRegistration()
+ServiceWorkerRegistrationInfo::~ServiceWorkerRegistrationInfo()
 {
   MOZ_ASSERT(!IsControllingDocuments());
 }
@@ -339,7 +347,7 @@ ServiceWorkerManager::CleanupServiceWorkerInformation(const nsACString& aDomain,
                                                       ServiceWorkerDomainInfo* aDomainInfo,
                                                       void *aUnused)
 {
-  aDomainInfo->mServiceWorkerRegistrations.Clear();
+  aDomainInfo->mServiceWorkerRegistrationInfos.Clear();
   return PL_DHASH_NEXT;
 }
 
@@ -376,7 +384,7 @@ public:
       swm->mDomainMap.Put(domain, domainInfo);
     }
 
-    nsRefPtr<ServiceWorkerRegistration> registration =
+    nsRefPtr<ServiceWorkerRegistrationInfo> registration =
       domainInfo->GetRegistration(mScope);
 
     nsCString spec;
@@ -412,7 +420,11 @@ public:
             return NS_ERROR_FAILURE;
           }
 
-          mPromise->MaybeResolve(serviceWorker);
+          nsRefPtr<ServiceWorkerRegistration> swr =
+            new ServiceWorkerRegistration(mWindow,
+                                          NS_ConvertUTF8toUTF16(registration->mScope));
+
+          mPromise->MaybeResolve(swr);
           return NS_OK;
         }
       }
@@ -528,7 +540,7 @@ ServiceWorkerManager::Register(nsIDOMWindow* aWindow, const nsAString& aScope,
 }
 
 void
-ServiceWorkerManager::RejectUpdatePromiseObservers(ServiceWorkerRegistration* aRegistration,
+ServiceWorkerManager::RejectUpdatePromiseObservers(ServiceWorkerRegistrationInfo* aRegistration,
                                                    nsresult aRv)
 {
   AssertIsOnMainThread();
@@ -538,7 +550,7 @@ ServiceWorkerManager::RejectUpdatePromiseObservers(ServiceWorkerRegistration* aR
 }
 
 void
-ServiceWorkerManager::RejectUpdatePromiseObservers(ServiceWorkerRegistration* aRegistration,
+ServiceWorkerManager::RejectUpdatePromiseObservers(ServiceWorkerRegistrationInfo* aRegistration,
                                                    const ErrorEventInit& aErrorDesc)
 {
   AssertIsOnMainThread();
@@ -552,7 +564,7 @@ ServiceWorkerManager::RejectUpdatePromiseObservers(ServiceWorkerRegistration* aR
  * may access the registration's (new) Promise after calling this method.
  */
 NS_IMETHODIMP
-ServiceWorkerManager::Update(ServiceWorkerRegistration* aRegistration,
+ServiceWorkerManager::Update(ServiceWorkerRegistrationInfo* aRegistration,
                              nsPIDOMWindow* aWindow)
 {
   if (aRegistration->HasUpdatePromise()) {
@@ -571,8 +583,8 @@ ServiceWorkerManager::Update(ServiceWorkerRegistration* aRegistration,
     // instance.
     // FIXME(nsm): Fire "statechange" on installing worker instance.
     aRegistration->mInstallingWorker = nullptr;
-    InvalidateServiceWorkerContainerWorker(aRegistration,
-                                           WhichServiceWorker::INSTALLING_WORKER);
+    InvalidateServiceWorkerRegistrationWorker(aRegistration,
+                                              WhichServiceWorker::INSTALLING_WORKER);
   }
 
   aRegistration->mUpdatePromise = new UpdatePromise();
@@ -587,7 +599,7 @@ ServiceWorkerManager::Update(ServiceWorkerRegistration* aRegistration,
   return NS_OK;
 }
 
-// If we return an error, ServiceWorkerContainer will reject the Promise.
+// If we return an error, ServiceWorkerREgistration will reject the Promise.
 NS_IMETHODIMP
 ServiceWorkerManager::Unregister(nsIDOMWindow* aWindow, const nsAString& aScope,
                                  nsISupports** aPromise)
@@ -613,7 +625,7 @@ ServiceWorkerManager::GetInstance()
 }
 
 void
-ServiceWorkerManager::ResolveRegisterPromises(ServiceWorkerRegistration* aRegistration,
+ServiceWorkerManager::ResolveRegisterPromises(ServiceWorkerRegistrationInfo* aRegistration,
                                               const nsACString& aWorkerScriptSpec)
 {
   AssertIsOnMainThread();
@@ -630,7 +642,7 @@ ServiceWorkerManager::ResolveRegisterPromises(ServiceWorkerRegistration* aRegist
 
 // Must NS_Free() aString
 void
-ServiceWorkerManager::FinishFetch(ServiceWorkerRegistration* aRegistration,
+ServiceWorkerManager::FinishFetch(ServiceWorkerRegistrationInfo* aRegistration,
                                   nsPIDOMWindow* aWindow)
 {
   AssertIsOnMainThread();
@@ -688,7 +700,7 @@ ServiceWorkerManager::HandleError(JSContext* aCx,
 
   nsCString scope;
   scope.Assign(aScope);
-  nsRefPtr<ServiceWorkerRegistration> registration = domainInfo->GetRegistration(scope);
+  nsRefPtr<ServiceWorkerRegistrationInfo> registration = domainInfo->GetRegistration(scope);
   MOZ_ASSERT(registration);
 
   RootedDictionary<ErrorEventInit> init(aCx);
@@ -717,11 +729,11 @@ ServiceWorkerManager::HandleError(JSContext* aCx,
 
 class FinishInstallRunnable MOZ_FINAL : public nsRunnable
 {
-  nsMainThreadPtrHandle<ServiceWorkerRegistration> mRegistration;
+  nsMainThreadPtrHandle<ServiceWorkerRegistrationInfo> mRegistration;
 
 public:
   explicit FinishInstallRunnable(
-    const nsMainThreadPtrHandle<ServiceWorkerRegistration>& aRegistration)
+    const nsMainThreadPtrHandle<ServiceWorkerRegistrationInfo>& aRegistration)
     : mRegistration(aRegistration)
   {
     MOZ_ASSERT(!NS_IsMainThread());
@@ -740,10 +752,10 @@ public:
 
 class FinishActivationRunnable : public nsRunnable
 {
-  nsMainThreadPtrHandle<ServiceWorkerRegistration> mRegistration;
+  nsMainThreadPtrHandle<ServiceWorkerRegistrationInfo> mRegistration;
 
 public:
-  FinishActivationRunnable(const nsMainThreadPtrHandle<ServiceWorkerRegistration>& aRegistration)
+  FinishActivationRunnable(const nsMainThreadPtrHandle<ServiceWorkerRegistrationInfo>& aRegistration)
     : mRegistration(aRegistration)
   {
     MOZ_ASSERT(!NS_IsMainThread());
@@ -763,11 +775,11 @@ public:
 
 class CancelServiceWorkerInstallationRunnable MOZ_FINAL : public nsRunnable
 {
-  nsMainThreadPtrHandle<ServiceWorkerRegistration> mRegistration;
+  nsMainThreadPtrHandle<ServiceWorkerRegistrationInfo> mRegistration;
 
 public:
   explicit CancelServiceWorkerInstallationRunnable(
-    const nsMainThreadPtrHandle<ServiceWorkerRegistration>& aRegistration)
+    const nsMainThreadPtrHandle<ServiceWorkerRegistrationInfo>& aRegistration)
     : mRegistration(aRegistration)
   {
   }
@@ -780,8 +792,8 @@ public:
     // FIXME(nsm): Fire statechange.
     mRegistration->mInstallingWorker = nullptr;
     nsRefPtr<ServiceWorkerManager> swm = ServiceWorkerManager::GetInstance();
-    swm->InvalidateServiceWorkerContainerWorker(mRegistration,
-                                                WhichServiceWorker::INSTALLING_WORKER);
+    swm->InvalidateServiceWorkerRegistrationWorker(mRegistration,
+                                                   WhichServiceWorker::INSTALLING_WORKER);
     return NS_OK;
   }
 };
@@ -791,7 +803,7 @@ public:
  */
 class FinishInstallHandler MOZ_FINAL : public PromiseNativeHandler
 {
-  nsMainThreadPtrHandle<ServiceWorkerRegistration> mRegistration;
+  nsMainThreadPtrHandle<ServiceWorkerRegistrationInfo> mRegistration;
 
   virtual
   ~FinishInstallHandler()
@@ -799,7 +811,7 @@ class FinishInstallHandler MOZ_FINAL : public PromiseNativeHandler
 
 public:
   explicit FinishInstallHandler(
-    const nsMainThreadPtrHandle<ServiceWorkerRegistration>& aRegistration)
+    const nsMainThreadPtrHandle<ServiceWorkerRegistrationInfo>& aRegistration)
     : mRegistration(aRegistration)
   {
     MOZ_ASSERT(!NS_IsMainThread());
@@ -827,10 +839,10 @@ public:
 
 class FinishActivateHandler : public PromiseNativeHandler
 {
-  nsMainThreadPtrHandle<ServiceWorkerRegistration> mRegistration;
+  nsMainThreadPtrHandle<ServiceWorkerRegistrationInfo> mRegistration;
 
 public:
-  FinishActivateHandler(const nsMainThreadPtrHandle<ServiceWorkerRegistration>& aRegistration)
+  FinishActivateHandler(const nsMainThreadPtrHandle<ServiceWorkerRegistrationInfo>& aRegistration)
     : mRegistration(aRegistration)
   {
     MOZ_ASSERT(!NS_IsMainThread());
@@ -866,13 +878,13 @@ public:
  */
 class InstallEventRunnable MOZ_FINAL : public WorkerRunnable
 {
-  nsMainThreadPtrHandle<ServiceWorkerRegistration> mRegistration;
+  nsMainThreadPtrHandle<ServiceWorkerRegistrationInfo> mRegistration;
   nsCString mScope;
 
 public:
   InstallEventRunnable(
     WorkerPrivate* aWorkerPrivate,
-    const nsMainThreadPtrHandle<ServiceWorkerRegistration>& aRegistration)
+    const nsMainThreadPtrHandle<ServiceWorkerRegistrationInfo>& aRegistration)
       : WorkerRunnable(aWorkerPrivate, WorkerThreadModifyBusyCount),
         mRegistration(aRegistration),
         mScope(aRegistration.get()->mScope) // copied for access on worker thread.
@@ -935,11 +947,11 @@ private:
 
 class ActivateEventRunnable : public WorkerRunnable
 {
-  nsMainThreadPtrHandle<ServiceWorkerRegistration> mRegistration;
+  nsMainThreadPtrHandle<ServiceWorkerRegistrationInfo> mRegistration;
 
 public:
   ActivateEventRunnable(WorkerPrivate* aWorkerPrivate,
-                        const nsMainThreadPtrHandle<ServiceWorkerRegistration>& aRegistration)
+                        const nsMainThreadPtrHandle<ServiceWorkerRegistrationInfo>& aRegistration)
       : WorkerRunnable(aWorkerPrivate, WorkerThreadModifyBusyCount),
         mRegistration(aRegistration)
   {
@@ -998,17 +1010,17 @@ private:
 };
 
 void
-ServiceWorkerManager::Install(ServiceWorkerRegistration* aRegistration,
+ServiceWorkerManager::Install(ServiceWorkerRegistrationInfo* aRegistration,
                               ServiceWorkerInfo* aServiceWorkerInfo)
 {
   AssertIsOnMainThread();
   aRegistration->mInstallingWorker = aServiceWorkerInfo;
   MOZ_ASSERT(aRegistration->mInstallingWorker);
-  InvalidateServiceWorkerContainerWorker(aRegistration,
-                                         WhichServiceWorker::INSTALLING_WORKER);
+  InvalidateServiceWorkerRegistrationWorker(aRegistration,
+                                            WhichServiceWorker::INSTALLING_WORKER);
 
-  nsMainThreadPtrHandle<ServiceWorkerRegistration> handle(
-    new nsMainThreadPtrHolder<ServiceWorkerRegistration>(aRegistration));
+  nsMainThreadPtrHandle<ServiceWorkerRegistrationInfo> handle(
+    new nsMainThreadPtrHolder<ServiceWorkerRegistrationInfo>(aRegistration));
 
   nsRefPtr<ServiceWorker> serviceWorker;
   nsresult rv =
@@ -1042,15 +1054,15 @@ ServiceWorkerManager::Install(ServiceWorkerRegistration* aRegistration,
   // a wait is likely to be required only when performing networking or storage
   // transactions in the first place.
 
-  FireEventOnServiceWorkerContainers(aRegistration,
-                                     NS_LITERAL_STRING("updatefound"));
+  FireEventOnServiceWorkerRegistrations(aRegistration,
+                                        NS_LITERAL_STRING("updatefound"));
 }
 
 class ActivationRunnable : public nsRunnable
 {
-  nsRefPtr<ServiceWorkerRegistration> mRegistration;
+  nsRefPtr<ServiceWorkerRegistrationInfo> mRegistration;
 public:
-  explicit ActivationRunnable(ServiceWorkerRegistration* aRegistration)
+  explicit ActivationRunnable(ServiceWorkerRegistrationInfo* aRegistration)
     : mRegistration(aRegistration)
   {
   }
@@ -1065,13 +1077,13 @@ public:
     mRegistration->mCurrentWorker = mRegistration->mWaitingWorker.forget();
 
     nsRefPtr<ServiceWorkerManager> swm = ServiceWorkerManager::GetInstance();
-    swm->InvalidateServiceWorkerContainerWorker(mRegistration,
-                                                WhichServiceWorker::ACTIVE_WORKER | WhichServiceWorker::WAITING_WORKER);
+    swm->InvalidateServiceWorkerRegistrationWorker(mRegistration,
+                                                   WhichServiceWorker::ACTIVE_WORKER | WhichServiceWorker::WAITING_WORKER);
 
     // FIXME(nsm): Steps 7 of the algorithm.
 
-    swm->FireEventOnServiceWorkerContainers(mRegistration,
-                                            NS_LITERAL_STRING("controllerchange"));
+    swm->FireEventOnServiceWorkerRegistrations(mRegistration,
+                                               NS_LITERAL_STRING("controllerchange"));
 
     MOZ_ASSERT(mRegistration->mCurrentWorker);
     nsRefPtr<ServiceWorker> serviceWorker;
@@ -1083,8 +1095,8 @@ public:
       return rv;
     }
 
-    nsMainThreadPtrHandle<ServiceWorkerRegistration> handle(
-      new nsMainThreadPtrHolder<ServiceWorkerRegistration>(mRegistration));
+    nsMainThreadPtrHandle<ServiceWorkerRegistrationInfo> handle(
+      new nsMainThreadPtrHolder<ServiceWorkerRegistrationInfo>(mRegistration));
 
     nsRefPtr<ActivateEventRunnable> r =
       new ActivateEventRunnable(serviceWorker->GetWorkerPrivate(), handle);
@@ -1099,7 +1111,7 @@ public:
 };
 
 void
-ServiceWorkerManager::FinishInstall(ServiceWorkerRegistration* aRegistration)
+ServiceWorkerManager::FinishInstall(ServiceWorkerRegistrationInfo* aRegistration)
 {
   AssertIsOnMainThread();
 
@@ -1118,8 +1130,8 @@ ServiceWorkerManager::FinishInstall(ServiceWorkerRegistration* aRegistration)
 
   aRegistration->mWaitingWorker = aRegistration->mInstallingWorker.forget();
   MOZ_ASSERT(aRegistration->mWaitingWorker);
-  InvalidateServiceWorkerContainerWorker(aRegistration,
-                                         WhichServiceWorker::WAITING_WORKER | WhichServiceWorker::INSTALLING_WORKER);
+  InvalidateServiceWorkerRegistrationWorker(aRegistration,
+                                            WhichServiceWorker::WAITING_WORKER | WhichServiceWorker::INSTALLING_WORKER);
 
   // FIXME(nsm): Actually update state of active ServiceWorker instances to
   // installed.
@@ -1140,7 +1152,7 @@ ServiceWorkerManager::FinishInstall(ServiceWorkerRegistration* aRegistration)
 }
 
 void
-ServiceWorkerManager::FinishActivate(ServiceWorkerRegistration* aRegistration)
+ServiceWorkerManager::FinishActivate(ServiceWorkerRegistrationInfo* aRegistration)
 {
   // FIXME(nsm): Set aRegistration->mCurrentWorker state to activated.
   // Fire statechange.
@@ -1178,22 +1190,22 @@ ServiceWorkerManager::CreateServiceWorkerForWindow(nsPIDOMWindow* aWindow,
   return rv;
 }
 
-already_AddRefed<ServiceWorkerRegistration>
-ServiceWorkerManager::GetServiceWorkerRegistration(nsPIDOMWindow* aWindow)
+already_AddRefed<ServiceWorkerRegistrationInfo>
+ServiceWorkerManager::GetServiceWorkerRegistrationInfo(nsPIDOMWindow* aWindow)
 {
   nsCOMPtr<nsIDocument> document = aWindow->GetExtantDoc();
-  return GetServiceWorkerRegistration(document);
+  return GetServiceWorkerRegistrationInfo(document);
 }
 
-already_AddRefed<ServiceWorkerRegistration>
-ServiceWorkerManager::GetServiceWorkerRegistration(nsIDocument* aDoc)
+already_AddRefed<ServiceWorkerRegistrationInfo>
+ServiceWorkerManager::GetServiceWorkerRegistrationInfo(nsIDocument* aDoc)
 {
   nsCOMPtr<nsIURI> documentURI = aDoc->GetDocumentURI();
-  return GetServiceWorkerRegistration(documentURI);
+  return GetServiceWorkerRegistrationInfo(documentURI);
 }
 
-already_AddRefed<ServiceWorkerRegistration>
-ServiceWorkerManager::GetServiceWorkerRegistration(nsIURI* aURI)
+already_AddRefed<ServiceWorkerRegistrationInfo>
+ServiceWorkerManager::GetServiceWorkerRegistrationInfo(nsIURI* aURI)
 {
   nsRefPtr<ServiceWorkerDomainInfo> domainInfo = GetDomainInfo(aURI);
   if (!domainInfo) {
@@ -1211,8 +1223,8 @@ ServiceWorkerManager::GetServiceWorkerRegistration(nsIURI* aURI)
     return nullptr;
   }
 
-  nsRefPtr<ServiceWorkerRegistration> registration;
-  domainInfo->mServiceWorkerRegistrations.Get(scope, getter_AddRefs(registration));
+  nsRefPtr<ServiceWorkerRegistrationInfo> registration;
+  domainInfo->mServiceWorkerRegistrationInfos.Get(scope, getter_AddRefs(registration));
   // ordered scopes and registrations better be in sync.
   MOZ_ASSERT(registration);
 
@@ -1357,8 +1369,8 @@ ServiceWorkerManager::MaybeStartControlling(nsIDocument* aDoc)
     return;
   }
 
-  nsRefPtr<ServiceWorkerRegistration> registration =
-    GetServiceWorkerRegistration(aDoc);
+  nsRefPtr<ServiceWorkerRegistrationInfo> registration =
+    GetServiceWorkerRegistrationInfo(aDoc);
   if (registration && registration->mCurrentWorker) {
     MOZ_ASSERT(!domainInfo->mControlledDocuments.Contains(aDoc));
     registration->StartControllingADocument();
@@ -1381,7 +1393,7 @@ ServiceWorkerManager::MaybeStopControlling(nsIDocument* aDoc)
     return;
   }
 
-  nsRefPtr<ServiceWorkerRegistration> registration;
+  nsRefPtr<ServiceWorkerRegistrationInfo> registration;
   domainInfo->mControlledDocuments.Remove(aDoc, getter_AddRefs(registration));
   // A document which was uncontrolled does not maintain that state itself, so
   // it will always call MaybeStopControlling() even if there isn't an
@@ -1400,7 +1412,7 @@ ServiceWorkerManager::GetScopeForUrl(const nsAString& aUrl, nsAString& aScope)
     return NS_ERROR_FAILURE;
   }
 
-  nsRefPtr<ServiceWorkerRegistration> r = GetServiceWorkerRegistration(uri);
+  nsRefPtr<ServiceWorkerRegistrationInfo> r = GetServiceWorkerRegistrationInfo(uri);
   if (!r) {
       return NS_ERROR_FAILURE;
   }
@@ -1410,7 +1422,7 @@ ServiceWorkerManager::GetScopeForUrl(const nsAString& aUrl, nsAString& aScope)
 }
 
 NS_IMETHODIMP
-ServiceWorkerManager::AddContainerEventListener(nsIURI* aDocumentURI, nsIDOMEventTarget* aListener)
+ServiceWorkerManager::AddRegistrationEventListener(nsIURI* aDocumentURI, nsIDOMEventTarget* aListener)
 {
   MOZ_ASSERT(aDocumentURI);
   nsRefPtr<ServiceWorkerDomainInfo> domainInfo = GetDomainInfo(aDocumentURI);
@@ -1427,13 +1439,14 @@ ServiceWorkerManager::AddContainerEventListener(nsIURI* aDocumentURI, nsIDOMEven
 
   MOZ_ASSERT(domainInfo);
 
-  ServiceWorkerContainer* container = static_cast<ServiceWorkerContainer*>(aListener);
-  domainInfo->mServiceWorkerContainers.AppendElement(container);
+  // TODO: this is very very bad:
+  ServiceWorkerRegistration* registration = static_cast<ServiceWorkerRegistration*>(aListener);
+  domainInfo->mServiceWorkerRegistrations.AppendElement(registration);
   return NS_OK;
 }
 
 NS_IMETHODIMP
-ServiceWorkerManager::RemoveContainerEventListener(nsIURI* aDocumentURI, nsIDOMEventTarget* aListener)
+ServiceWorkerManager::RemoveRegistrationEventListener(nsIURI* aDocumentURI, nsIDOMEventTarget* aListener)
 {
   MOZ_ASSERT(aDocumentURI);
   nsRefPtr<ServiceWorkerDomainInfo> domainInfo = GetDomainInfo(aDocumentURI);
@@ -1441,14 +1454,14 @@ ServiceWorkerManager::RemoveContainerEventListener(nsIURI* aDocumentURI, nsIDOME
     return NS_OK;
   }
 
-  ServiceWorkerContainer* container = static_cast<ServiceWorkerContainer*>(aListener);
-  domainInfo->mServiceWorkerContainers.RemoveElement(container);
+  ServiceWorkerRegistration* registration = static_cast<ServiceWorkerRegistration*>(aListener);
+  domainInfo->mServiceWorkerRegistrations.RemoveElement(registration);
   return NS_OK;
 }
 
 void
-ServiceWorkerManager::FireEventOnServiceWorkerContainers(
-  ServiceWorkerRegistration* aRegistration,
+ServiceWorkerManager::FireEventOnServiceWorkerRegistrations(
+  ServiceWorkerRegistrationInfo* aRegistration,
   const nsAString& aName)
 {
   AssertIsOnMainThread();
@@ -1456,9 +1469,9 @@ ServiceWorkerManager::FireEventOnServiceWorkerContainers(
     GetDomainInfo(aRegistration->mScriptSpec);
 
   if (domainInfo) {
-    nsTObserverArray<ServiceWorkerContainer*>::ForwardIterator it(domainInfo->mServiceWorkerContainers);
+    nsTObserverArray<ServiceWorkerRegistration*>::ForwardIterator it(domainInfo->mServiceWorkerRegistrations);
     while (it.HasMore()) {
-      nsRefPtr<ServiceWorkerContainer> target = it.GetNext();
+      nsRefPtr<ServiceWorkerRegistration> target = it.GetNext();
       nsIURI* targetURI = target->GetDocumentURI();
       if (!targetURI) {
         NS_WARNING("Controlled domain cannot have page with null URI!");
@@ -1494,8 +1507,8 @@ ServiceWorkerManager::GetServiceWorkerForWindow(nsIDOMWindow* aWindow,
   nsCOMPtr<nsPIDOMWindow> window = do_QueryInterface(aWindow);
   MOZ_ASSERT(window);
 
-  nsRefPtr<ServiceWorkerRegistration> registration =
-    GetServiceWorkerRegistration(window);
+  nsRefPtr<ServiceWorkerRegistrationInfo> registration =
+    GetServiceWorkerRegistrationInfo(window);
 
   if (!registration) {
     return NS_ERROR_FAILURE;
@@ -1549,7 +1562,7 @@ ServiceWorkerManager::GetDocumentController(nsIDOMWindow* aWindow, nsISupports**
     return NS_ERROR_FAILURE;
   }
 
-  nsRefPtr<ServiceWorkerRegistration> registration;
+  nsRefPtr<ServiceWorkerRegistrationInfo> registration;
   if (!domainInfo->mControlledDocuments.Get(doc, getter_AddRefs(registration))) {
     return NS_ERROR_FAILURE;
   }
@@ -1615,7 +1628,7 @@ ServiceWorkerManager::CreateServiceWorker(const nsACString& aScriptSpec,
 
   // FIXME(nsm): Create correct principal based on app-ness.
   // Would it make sense to store the nsIPrincipal of the first register() in
-  // the ServiceWorkerRegistration and use that?
+  // the ServiceWorkerRegistrationInfo and use that?
   nsIScriptSecurityManager* ssm = nsContentUtils::GetSecurityManager();
   rv = ssm->GetNoAppCodebasePrincipal(info.mBaseURI, getter_AddRefs(info.mPrincipal));
   if (NS_WARN_IF(NS_FAILED(rv))) {
@@ -1642,17 +1655,17 @@ ServiceWorkerManager::CreateServiceWorker(const nsACString& aScriptSpec,
 }
 
 void
-ServiceWorkerManager::InvalidateServiceWorkerContainerWorker(ServiceWorkerRegistration* aRegistration,
-                                                             WhichServiceWorker aWhichOnes)
+ServiceWorkerManager::InvalidateServiceWorkerRegistrationWorker(ServiceWorkerRegistrationInfo* aRegistration,
+                                                                WhichServiceWorker aWhichOnes)
 {
   AssertIsOnMainThread();
   nsRefPtr<ServiceWorkerDomainInfo> domainInfo =
     GetDomainInfo(aRegistration->mScriptSpec);
 
   if (domainInfo) {
-    nsTObserverArray<ServiceWorkerContainer*>::ForwardIterator it(domainInfo->mServiceWorkerContainers);
+    nsTObserverArray<ServiceWorkerRegistration*>::ForwardIterator it(domainInfo->mServiceWorkerRegistrations);
     while (it.HasMore()) {
-      nsRefPtr<ServiceWorkerContainer> target = it.GetNext();
+      nsRefPtr<ServiceWorkerRegistration> target = it.GetNext();
 
       nsIURI* targetURI = target->GetDocumentURI();
       nsCString path;
diff --git a/dom/workers/ServiceWorkerManager.h b/dom/workers/ServiceWorkerManager.h
index 3693f562dceb..0411eedc51f2 100644
--- a/dom/workers/ServiceWorkerManager.h
+++ b/dom/workers/ServiceWorkerManager.h
@@ -16,6 +16,7 @@
 #include "mozilla/WeakPtr.h"
 #include "mozilla/dom/BindingUtils.h"
 #include "mozilla/dom/Promise.h"
+#include "mozilla/dom/ServiceWorkerCommon.h"
 #include "nsRefPtrHashtable.h"
 #include "nsTArrayForwardDeclare.h"
 #include "nsTObserverArray.h"
@@ -24,10 +25,12 @@ class nsIScriptError;
 
 namespace mozilla {
 namespace dom {
+
+class ServiceWorkerRegistration;
+
 namespace workers {
 
 class ServiceWorker;
-class ServiceWorkerContainer;
 class ServiceWorkerUpdateInstance;
 
 /**
@@ -95,22 +98,13 @@ public:
   { }
 };
 
-// Use multiples of 2 since they can be bitwise ORed when calling
-// InvalidateServiceWorkerContainerWorker.
-MOZ_BEGIN_ENUM_CLASS(WhichServiceWorker)
-  INSTALLING_WORKER = 1,
-  WAITING_WORKER    = 2,
-  ACTIVE_WORKER     = 4,
-MOZ_END_ENUM_CLASS(WhichServiceWorker)
-MOZ_MAKE_ENUM_CLASS_BITWISE_OPERATORS(WhichServiceWorker)
-
 // Needs to inherit from nsISupports because NS_ProxyRelease() does not support
 // non-ISupports classes.
-class ServiceWorkerRegistration MOZ_FINAL : public nsISupports
+class ServiceWorkerRegistrationInfo MOZ_FINAL : public nsISupports
 {
   uint32_t mControlledDocumentsCounter;
 
-  virtual ~ServiceWorkerRegistration();
+  virtual ~ServiceWorkerRegistrationInfo();
 
 public:
   NS_DECL_ISUPPORTS
@@ -145,7 +139,7 @@ public:
   // pendingUninstall and when all controlling documents go away, removed.
   bool mPendingUninstall;
 
-  explicit ServiceWorkerRegistration(const nsACString& aScope);
+  explicit ServiceWorkerRegistrationInfo(const nsACString& aScope);
 
   already_AddRefed<ServiceWorkerInfo>
   Newest()
@@ -236,35 +230,35 @@ public:
     nsTArray<nsCString> mOrderedScopes;
 
     // Scope to registration.
-    nsRefPtrHashtable<nsCStringHashKey, ServiceWorkerRegistration> mServiceWorkerRegistrations;
+    nsRefPtrHashtable<nsCStringHashKey, ServiceWorkerRegistrationInfo> mServiceWorkerRegistrationInfos;
 
     // This array can't be stored in ServiceWorkerRegistration because one may
     // not exist when a certain window is opened, but we still want that
     // window's container to be notified if it's in scope.
     // The containers inform the SWM on creation and destruction.
-    nsTObserverArray<ServiceWorkerContainer*> mServiceWorkerContainers;
+    nsTObserverArray<ServiceWorkerRegistration*> mServiceWorkerRegistrations;
 
-    nsRefPtrHashtable<nsISupportsHashKey, ServiceWorkerRegistration> mControlledDocuments;
+    nsRefPtrHashtable<nsISupportsHashKey, ServiceWorkerRegistrationInfo> mControlledDocuments;
 
     ServiceWorkerDomainInfo()
     { }
 
-    already_AddRefed<ServiceWorkerRegistration>
+    already_AddRefed<ServiceWorkerRegistrationInfo>
     GetRegistration(const nsCString& aScope) const
     {
-      nsRefPtr<ServiceWorkerRegistration> reg;
-      mServiceWorkerRegistrations.Get(aScope, getter_AddRefs(reg));
+      nsRefPtr<ServiceWorkerRegistrationInfo> reg;
+      mServiceWorkerRegistrationInfos.Get(aScope, getter_AddRefs(reg));
       return reg.forget();
     }
 
-    ServiceWorkerRegistration*
+    ServiceWorkerRegistrationInfo*
     CreateNewRegistration(const nsCString& aScope)
     {
-      ServiceWorkerRegistration* registration =
-        new ServiceWorkerRegistration(aScope);
+      ServiceWorkerRegistrationInfo* registration =
+        new ServiceWorkerRegistrationInfo(aScope);
       // From now on ownership of registration is with
-      // mServiceWorkerRegistrations.
-      mServiceWorkerRegistrations.Put(aScope, registration);
+      // mServiceWorkerRegistrationInfos.
+      mServiceWorkerRegistrationInfos.Put(aScope, registration);
       ServiceWorkerManager::AddScope(mOrderedScopes, aScope);
       return registration;
     }
@@ -279,26 +273,26 @@ public:
   nsRefPtrHashtable<nsCStringHashKey, ServiceWorkerDomainInfo> mDomainMap;
 
   void
-  ResolveRegisterPromises(ServiceWorkerRegistration* aRegistration,
+  ResolveRegisterPromises(ServiceWorkerRegistrationInfo* aRegistration,
                           const nsACString& aWorkerScriptSpec);
 
   void
-  RejectUpdatePromiseObservers(ServiceWorkerRegistration* aRegistration,
+  RejectUpdatePromiseObservers(ServiceWorkerRegistrationInfo* aRegistration,
                                nsresult aResult);
 
   void
-  RejectUpdatePromiseObservers(ServiceWorkerRegistration* aRegistration,
+  RejectUpdatePromiseObservers(ServiceWorkerRegistrationInfo* aRegistration,
                                const ErrorEventInit& aErrorDesc);
 
   void
-  FinishFetch(ServiceWorkerRegistration* aRegistration,
+  FinishFetch(ServiceWorkerRegistrationInfo* aRegistration,
               nsPIDOMWindow* aWindow);
 
   void
-  FinishInstall(ServiceWorkerRegistration* aRegistration);
+  FinishInstall(ServiceWorkerRegistrationInfo* aRegistration);
 
   void
-  FinishActivate(ServiceWorkerRegistration* aRegistration);
+  FinishActivate(ServiceWorkerRegistrationInfo* aRegistration);
 
   void
   HandleError(JSContext* aCx,
@@ -319,10 +313,10 @@ private:
   ~ServiceWorkerManager();
 
   NS_IMETHOD
-  Update(ServiceWorkerRegistration* aRegistration, nsPIDOMWindow* aWindow);
+  Update(ServiceWorkerRegistrationInfo* aRegistration, nsPIDOMWindow* aWindow);
 
   void
-  Install(ServiceWorkerRegistration* aRegistration,
+  Install(ServiceWorkerRegistrationInfo* aRegistration,
           ServiceWorkerInfo* aServiceWorkerInfo);
 
   NS_IMETHOD
@@ -356,17 +350,17 @@ private:
                             nsISupports** aServiceWorker);
 
   void
-  InvalidateServiceWorkerContainerWorker(ServiceWorkerRegistration* aRegistration,
-                                         WhichServiceWorker aWhichOnes);
+  InvalidateServiceWorkerRegistrationWorker(ServiceWorkerRegistrationInfo* aRegistration,
+                                            WhichServiceWorker aWhichOnes);
 
-  already_AddRefed<ServiceWorkerRegistration>
-  GetServiceWorkerRegistration(nsPIDOMWindow* aWindow);
+  already_AddRefed<ServiceWorkerRegistrationInfo>
+  GetServiceWorkerRegistrationInfo(nsPIDOMWindow* aWindow);
 
-  already_AddRefed<ServiceWorkerRegistration>
-  GetServiceWorkerRegistration(nsIDocument* aDoc);
+  already_AddRefed<ServiceWorkerRegistrationInfo>
+  GetServiceWorkerRegistrationInfo(nsIDocument* aDoc);
 
-  already_AddRefed<ServiceWorkerRegistration>
-  GetServiceWorkerRegistration(nsIURI* aURI);
+  already_AddRefed<ServiceWorkerRegistrationInfo>
+  GetServiceWorkerRegistrationInfo(nsIURI* aURI);
 
   static void
   AddScope(nsTArray<nsCString>& aList, const nsACString& aScope);
@@ -378,8 +372,8 @@ private:
   RemoveScope(nsTArray<nsCString>& aList, const nsACString& aScope);
 
   void
-  FireEventOnServiceWorkerContainers(ServiceWorkerRegistration* aRegistration,
-                                     const nsAString& aName);
+  FireEventOnServiceWorkerRegistrations(ServiceWorkerRegistrationInfo* aRegistration,
+                                        const nsAString& aName);
 
 };
 
diff --git a/dom/workers/ServiceWorkerRegistration.cpp b/dom/workers/ServiceWorkerRegistration.cpp
new file mode 100644
index 000000000000..14c017156a9d
--- /dev/null
+++ b/dom/workers/ServiceWorkerRegistration.cpp
@@ -0,0 +1,197 @@
+/* -*- Mode: C++; tab-width: 8; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
+/* vim: set ts=8 sts=2 et sw=2 tw=80: */
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+#include "ServiceWorkerRegistration.h"
+
+#include "mozilla/dom/Promise.h"
+#include "mozilla/dom/ServiceWorkerRegistrationBinding.h"
+#include "nsCycleCollectionParticipant.h"
+#include "nsServiceManagerUtils.h"
+#include "ServiceWorker.h"
+
+#include "nsIServiceWorkerManager.h"
+#include "nsPIDOMWindow.h"
+
+using namespace mozilla::dom::workers;
+
+namespace mozilla {
+namespace dom {
+
+NS_INTERFACE_MAP_BEGIN_CYCLE_COLLECTION_INHERITED(ServiceWorkerRegistration)
+NS_INTERFACE_MAP_END_INHERITING(DOMEventTargetHelper)
+
+NS_IMPL_ADDREF_INHERITED(ServiceWorkerRegistration, DOMEventTargetHelper)
+NS_IMPL_RELEASE_INHERITED(ServiceWorkerRegistration, DOMEventTargetHelper)
+
+NS_IMPL_CYCLE_COLLECTION_INHERITED(ServiceWorkerRegistration,
+                                   DOMEventTargetHelper,
+                                   mWindow,
+                                   mInstallingWorker,
+                                   mWaitingWorker,
+                                   mActiveWorker)
+
+ServiceWorkerRegistration::ServiceWorkerRegistration(nsPIDOMWindow* aWindow,
+                                                     const nsAString& aScope)
+  : mWindow(aWindow)
+  , mScope(aScope)
+{
+  MOZ_ASSERT(aWindow);
+
+  SetIsDOMBinding();
+  StartListeningForEvents();
+}
+
+ServiceWorkerRegistration::~ServiceWorkerRegistration()
+{
+  StopListeningForEvents();
+}
+
+JSObject*
+ServiceWorkerRegistration::WrapObject(JSContext* aCx)
+{
+  return ServiceWorkerRegistrationBinding::Wrap(aCx, this);
+}
+
+already_AddRefed<workers::ServiceWorker>
+ServiceWorkerRegistration::GetInstalling()
+{
+  if (!mInstallingWorker) {
+    mInstallingWorker = GetWorkerReference(WhichServiceWorker::INSTALLING_WORKER);
+  }
+
+  nsRefPtr<ServiceWorker> ret = mInstallingWorker;
+  return ret.forget();
+}
+
+already_AddRefed<workers::ServiceWorker>
+ServiceWorkerRegistration::GetWaiting()
+{
+  if (!mWaitingWorker) {
+    mWaitingWorker = GetWorkerReference(WhichServiceWorker::WAITING_WORKER);
+  }
+
+  nsRefPtr<ServiceWorker> ret = mWaitingWorker;
+  return ret.forget();
+}
+
+already_AddRefed<workers::ServiceWorker>
+ServiceWorkerRegistration::GetActive()
+{
+  if (!mActiveWorker) {
+    mActiveWorker = GetWorkerReference(WhichServiceWorker::ACTIVE_WORKER);
+  }
+
+  nsRefPtr<ServiceWorker> ret = mActiveWorker;
+  return ret.forget();
+}
+
+already_AddRefed<Promise>
+ServiceWorkerRegistration::Unregister(ErrorResult& aRv)
+{
+  nsCOMPtr<nsISupports> promise;
+
+  nsresult rv;
+  nsCOMPtr<nsIServiceWorkerManager> swm =
+    do_GetService(SERVICEWORKERMANAGER_CONTRACTID, &rv);
+  if (NS_WARN_IF(NS_FAILED(rv))) {
+    aRv.Throw(rv);
+    return nullptr;
+  }
+
+  aRv = swm->Unregister(mWindow, mScope, getter_AddRefs(promise));
+  if (aRv.Failed()) {
+    return nullptr;
+  }
+
+  nsRefPtr<Promise> ret = static_cast<Promise*>(promise.get());
+  MOZ_ASSERT(ret);
+  return ret.forget();
+}
+
+already_AddRefed<workers::ServiceWorker>
+ServiceWorkerRegistration::GetWorkerReference(WhichServiceWorker aWhichOne)
+{
+  nsresult rv;
+  nsCOMPtr<nsIServiceWorkerManager> swm =
+    do_GetService(SERVICEWORKERMANAGER_CONTRACTID, &rv);
+  if (NS_WARN_IF(NS_FAILED(rv))) {
+    return nullptr;
+  }
+
+  nsCOMPtr<nsISupports> serviceWorker;
+  switch(aWhichOne) {
+    case WhichServiceWorker::INSTALLING_WORKER:
+      rv = swm->GetInstalling(mWindow, getter_AddRefs(serviceWorker));
+      break;
+    case WhichServiceWorker::WAITING_WORKER:
+      rv = swm->GetWaiting(mWindow, getter_AddRefs(serviceWorker));
+      break;
+    case WhichServiceWorker::ACTIVE_WORKER:
+      rv = swm->GetActive(mWindow, getter_AddRefs(serviceWorker));
+      break;
+    default:
+      MOZ_CRASH("Invalid enum value");
+  }
+
+  if (NS_WARN_IF(NS_FAILED(rv))) {
+    return nullptr;
+  }
+
+  nsRefPtr<ServiceWorker> ref =
+    static_cast<ServiceWorker*>(serviceWorker.get());
+  return ref.forget();
+}
+
+void
+ServiceWorkerRegistration::InvalidateWorkerReference(WhichServiceWorker aWhichOnes)
+{
+  if (aWhichOnes & WhichServiceWorker::INSTALLING_WORKER) {
+    mInstallingWorker = nullptr;
+  }
+
+  if (aWhichOnes & WhichServiceWorker::WAITING_WORKER) {
+    mWaitingWorker = nullptr;
+  }
+
+  if (aWhichOnes & WhichServiceWorker::ACTIVE_WORKER) {
+    mActiveWorker = nullptr;
+  }
+}
+
+// XXXnsm, maybe this can be optimized to only add when a event handler is
+// registered.
+void
+ServiceWorkerRegistration::StartListeningForEvents()
+{
+  nsCOMPtr<nsIServiceWorkerManager> swm = do_GetService(SERVICEWORKERMANAGER_CONTRACTID);
+  MOZ_ASSERT(mWindow);
+
+  if (swm) {
+    swm->AddRegistrationEventListener(GetDocumentURI(), this);
+  }
+}
+
+void
+ServiceWorkerRegistration::StopListeningForEvents()
+{
+  nsCOMPtr<nsIServiceWorkerManager> swm = do_GetService(SERVICEWORKERMANAGER_CONTRACTID);
+
+  // StopListeningForEvents is called in the dtor, and it can happen that
+  // SnowWhite had already set to null mWindow.
+  if (swm && mWindow) {
+    swm->RemoveRegistrationEventListener(GetDocumentURI(), this);
+  }
+}
+
+nsIURI*
+ServiceWorkerRegistration::GetDocumentURI() const
+{
+  MOZ_ASSERT(mWindow);
+  return mWindow->GetDocumentURI();
+}
+
+} // dom namespace
+} // mozilla namespace
diff --git a/dom/workers/ServiceWorkerRegistration.h b/dom/workers/ServiceWorkerRegistration.h
new file mode 100644
index 000000000000..2ebfc26c0d05
--- /dev/null
+++ b/dom/workers/ServiceWorkerRegistration.h
@@ -0,0 +1,99 @@
+/* -*- Mode: C++; tab-width: 8; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
+/* vim: set ts=8 sts=2 et sw=2 tw=80: */
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+#ifndef mozilla_dom_ServiceWorkerRegistration_h
+#define mozilla_dom_ServiceWorkerRegistration_h
+
+#include "mozilla/DOMEventTargetHelper.h"
+#include "mozilla/dom/ServiceWorkerCommon.h"
+
+class nsPIDOMWindow;
+
+namespace mozilla {
+namespace dom {
+
+class Promise;
+
+namespace workers {
+class ServiceWorker;
+}
+
+class ServiceWorkerRegistration MOZ_FINAL : public DOMEventTargetHelper
+{
+public:
+  NS_DECL_ISUPPORTS_INHERITED
+  NS_DECL_CYCLE_COLLECTION_CLASS_INHERITED(ServiceWorkerRegistration,
+                                           DOMEventTargetHelper)
+
+  IMPL_EVENT_HANDLER(updatefound)
+
+  ServiceWorkerRegistration(nsPIDOMWindow* aWindow,
+                            const nsAString& aScope);
+
+  nsPIDOMWindow*
+  GetParentObject() const
+  {
+    return mWindow;
+  }
+
+  JSObject*
+  WrapObject(JSContext* aCx);
+
+  already_AddRefed<workers::ServiceWorker>
+  GetInstalling();
+
+  already_AddRefed<workers::ServiceWorker>
+  GetWaiting();
+
+  already_AddRefed<workers::ServiceWorker>
+  GetActive();
+
+  void
+  GetScope(nsAString& aScope) const
+  {
+    aScope = mScope;
+  }
+
+  already_AddRefed<Promise>
+  Unregister(ErrorResult& aRv);
+
+  // Useful methods for ServiceWorkerManager:
+
+  nsIURI*
+  GetDocumentURI() const;
+
+  void
+  InvalidateWorkerReference(WhichServiceWorker aWhichOnes);
+
+private:
+  ~ServiceWorkerRegistration();
+
+  already_AddRefed<workers::ServiceWorker>
+  GetWorkerReference(WhichServiceWorker aWhichOne);
+
+  void
+  StartListeningForEvents();
+
+  void
+  StopListeningForEvents();
+
+  nsCOMPtr<nsPIDOMWindow> mWindow;
+
+  // The following properties are cached here to ensure JS equality is satisfied
+  // instead of acquiring a new worker instance from the ServiceWorkerManager
+  // for every access. A null value is considered a cache miss.
+  // These three may change to a new worker at any time.
+  nsRefPtr<workers::ServiceWorker> mInstallingWorker;
+  nsRefPtr<workers::ServiceWorker> mWaitingWorker;
+  nsRefPtr<workers::ServiceWorker> mActiveWorker;
+
+  const nsString mScope;
+};
+
+} // namespace dom
+} // namespace mozilla
+
+#endif /* mozilla_dom_ServiceWorkerRegistration_h */
diff --git a/dom/workers/moz.build b/dom/workers/moz.build
index eee48316a6a8..1bb0b2dae9f7 100644
--- a/dom/workers/moz.build
+++ b/dom/workers/moz.build
@@ -6,7 +6,9 @@
 
 # Public stuff.
 EXPORTS.mozilla.dom += [
+    'ServiceWorkerCommon.h',
     'ServiceWorkerContainer.h',
+    'ServiceWorkerRegistration.h',
     'WorkerPrivate.h',
     'WorkerRunnable.h',
     'WorkerScope.h',
@@ -50,6 +52,7 @@ SOURCES += [
     'ServiceWorkerContainer.cpp',
     'ServiceWorkerEvents.cpp',
     'ServiceWorkerManager.cpp',
+    'ServiceWorkerRegistration.cpp',
     'SharedWorker.cpp',
     'URL.cpp',
     'WorkerPrivate.cpp',
diff --git a/dom/workers/test/serviceworkers/controller/index.html b/dom/workers/test/serviceworkers/controller/index.html
index da15814e0e18..11907dbc9bad 100644
--- a/dom/workers/test/serviceworkers/controller/index.html
+++ b/dom/workers/test/serviceworkers/controller/index.html
@@ -32,9 +32,21 @@
     // We are controlled.
     // Register a new worker for this sub-scope. After that, controller should still be for upper level, but active should change to be this scope's.
     navigator.serviceWorker.register("../worker2.js", { scope: "./*" }).then(function(e) {
-      my_ok(navigator.serviceWorker.installing &&
-            navigator.serviceWorker.installing.scope.match(/controller\/\*$/),
+      my_ok("installing" in e, "ServiceWorkerRegistration.installing exists.");
+      my_ok(e.installing instanceof ServiceWorker, "ServiceWorkerRegistration.installing is a ServiceWorker.");
+
+      my_ok("waiting" in e, "ServiceWorkerRegistration.waiting exists.");
+      my_ok("active" in e, "ServiceWorkerRegistration.active exists.");
+
+      my_ok(e.installing &&
+            e.installing.scope.match(/controller\/\*$/),
             "Installing is serviceworker/controller/*");
+
+      my_ok("scope" in e, "ServiceWorkerRegistration.scope exists.");
+      my_ok(e.scope.match(/serviceworkers\/controller\/\*$/), "Scope is serviceworker/*: " + e.scope);
+
+      my_ok("unregister" in e, "ServiceWorkerRegistration.unregister exists.");
+
       my_ok(navigator.serviceWorker.controller.scope.match(/serviceworkers\/control\*$/),
             "Controller is still serviceworker/*");
       finish();
diff --git a/dom/workers/test/serviceworkers/test_install_event.html b/dom/workers/test/serviceworkers/test_install_event.html
index dcea3d78adcf..a5f5aec97cd0 100644
--- a/dom/workers/test/serviceworkers/test_install_event.html
+++ b/dom/workers/test/serviceworkers/test_install_event.html
@@ -20,11 +20,11 @@
     return p;
   }
 
-  function nextRegister() {
+  function nextRegister(reg) {
     var p = navigator.serviceWorker.register("install_event_worker.js", { scope: "./*" });
 
     return new Promise(function(resolve, reject) {
-      navigator.serviceWorker.onupdatefound = function(e) {
+      reg.onupdatefound = function(e) {
         ok(true, "Received onupdatefound");
         resolve();
       };
diff --git a/dom/workers/test/serviceworkers/test_installation_simple.html b/dom/workers/test/serviceworkers/test_installation_simple.html
index ed80fcc21d4d..c0721b0a5d13 100644
--- a/dom/workers/test/serviceworkers/test_installation_simple.html
+++ b/dom/workers/test/serviceworkers/test_installation_simple.html
@@ -57,11 +57,12 @@
 
   function realWorker() {
     var p = navigator.serviceWorker.register("worker.js", { scope: "realworker*" });
-    return p.then(function(w) {
-      ok(w instanceof ServiceWorker, "Register a ServiceWorker");
-      info(w.scope);
-      ok(w.scope == (new URL("realworker*", document.baseURI)).href, "Scope should match");
-      ok(w.url == (new URL("worker.js", document.baseURI)).href, "URL should be of the worker");
+    return p.then(function(wr) {
+      ok(wr instanceof ServiceWorkerRegistration, "Register a ServiceWorker");
+
+      info(wr.scope);
+      ok(wr.scope == (new URL("realworker*", document.baseURI)).href, "Scope should match");
+
     }, function(e) {
       info("Error: " + e.name);
       ok(false, "realWorker Registration should have succeeded!");
@@ -73,14 +74,14 @@
     var q = navigator.serviceWorker.register("worker3.js", { scope: "foo/*" });
 
     return Promise.all([
-      p.then(function(w) {
+      p.then(function(wr) {
         ok(false, "First registration should fail with AbortError");
       }, function(e) {
         ok(e.name === "AbortError", "First registration should fail with AbortError");
       }),
 
-      q.then(function(w) {
-        ok(w instanceof ServiceWorker, "Second registration should succeed");
+      q.then(function(wr) {
+        ok(wr instanceof ServiceWorkerRegistration, "Second registration should succeed");
       }, function(e) {
         ok(false, "Second registration should succeed");
       })
@@ -97,7 +98,7 @@
 
   function parseError() {
     var p = navigator.serviceWorker.register("parse_error_worker.js");
-    return p.then(function(w) {
+    return p.then(function(wr) {
       ok(false, "Registration should fail with parse error");
     }, function(e) {
     info("NSM " + e.name);
@@ -107,6 +108,7 @@
 
   // FIXME(nsm): test for parse error when Update step doesn't happen (directly from register).
 
+  /* FIXME bug 1002571 - re-enable this test when GetRegistration is implemented.
   function updatefound() {
     var frame = document.createElement("iframe");
     frame.setAttribute("id", "simpleregister-frame");
@@ -137,6 +139,7 @@
     }
     return p;
   }
+  */
 
   function runTest() {
     simpleRegister()
@@ -147,7 +150,6 @@
       .then(abortPrevious)
       .then(networkError404)
       .then(parseError)
-      .then(updatefound)
       // put more tests here.
       .then(function() {
         SimpleTest.finish();
diff --git a/dom/workers/test/serviceworkers/test_navigator.html b/dom/workers/test/serviceworkers/test_navigator.html
index 0f4c1391deda..cb8936e22bcc 100644
--- a/dom/workers/test/serviceworkers/test_navigator.html
+++ b/dom/workers/test/serviceworkers/test_navigator.html
@@ -18,12 +18,9 @@
   function checkEnabled() {
     ok(navigator.serviceWorker, "navigator.serviceWorker should exist when ServiceWorkers are enabled.");
     ok(typeof navigator.serviceWorker.register === "function", "navigator.serviceWorker.register() should be a function.");
-    ok(typeof navigator.serviceWorker.unregister === "function", "navigator.serviceWorker.unregister() should be a function.");
-    ok(typeof navigator.serviceWorker.getAll === "function", "navigator.serviceWorker.getAll() should be a function.");
+    ok(typeof navigator.serviceWorker.getRegistration === "function", "navigator.serviceWorker.getAll() should be a function.");
+    ok(typeof navigator.serviceWorker.getRegistrations === "function", "navigator.serviceWorker.getAll() should be a function.");
     ok(navigator.serviceWorker.ready instanceof Promise, "navigator.serviceWorker.ready should be a Promise.");
-    ok(navigator.serviceWorker.installing === null, "There should be no installing worker for an uncontrolled scope.");
-    ok(navigator.serviceWorker.waiting === null, "There should be no waiting worker for an uncontrolled scope.");
-    // ok(navigator.serviceWorker.active === null, "There should be no active worker for an uncontrolled scope.");
     ok(navigator.serviceWorker.controller === null, "There should be no controller worker for an uncontrolled document.");
   }
 
diff --git a/dom/xml/XMLDocument.cpp b/dom/xml/XMLDocument.cpp
index 6221c63e0c9f..30d743009223 100644
--- a/dom/xml/XMLDocument.cpp
+++ b/dom/xml/XMLDocument.cpp
@@ -302,8 +302,7 @@ XMLDocument::Load(const nsAString& aUrl, ErrorResult& aRv)
 
   WarnOnceAbout(nsIDocument::eUseOfDOM3LoadMethod);
 
-  nsCOMPtr<nsIDocument> callingDoc = nsContentUtils::GetDocumentFromContext();
-
+  nsCOMPtr<nsIDocument> callingDoc = GetEntryDocument();
   nsIURI *baseURI = mDocumentURI;
   nsAutoCString charset;
 
diff --git a/embedding/components/windowwatcher/src/nsWindowWatcher.cpp b/embedding/components/windowwatcher/src/nsWindowWatcher.cpp
index 5c42e0841ca8..4aa435cd83eb 100644
--- a/embedding/components/windowwatcher/src/nsWindowWatcher.cpp
+++ b/embedding/components/windowwatcher/src/nsWindowWatcher.cpp
@@ -65,6 +65,7 @@
 #endif
 
 using namespace mozilla;
+using namespace mozilla::dom;
 
 /****************************************************************
  ******************** nsWatcherWindowEntry **********************
@@ -886,7 +887,7 @@ nsWindowWatcher::OpenWindowInternal(nsIDOMWindow *aParent,
     }
 
     nsCOMPtr<nsPIDOMWindow> referrerWindow =
-      do_QueryInterface(dom::BrokenGetEntryGlobal());
+      do_QueryInterface(GetEntryGlobal());
     if (!referrerWindow) {
       referrerWindow = do_QueryInterface(aParent);
     }
@@ -1345,18 +1346,8 @@ nsWindowWatcher::URIfromURL(const char *aURL,
                             nsIDOMWindow *aParent,
                             nsIURI **aURI)
 {
-  nsCOMPtr<nsIDOMWindow> baseWindow;
-
-  /* build the URI relative to the calling JS Context, if any.
-     (note this is the same context used to make the security check
-     in nsGlobalWindow.cpp.) */
-  JSContext *cx = nsContentUtils::GetCurrentJSContext();
-  if (cx) {
-    nsIScriptContext *scriptcx = nsJSUtils::GetDynamicScriptContext(cx);
-    if (scriptcx) {
-      baseWindow = do_QueryInterface(scriptcx->GetGlobalObject());
-    }
-  }
+  // Build the URI relative to the entry global.
+  nsCOMPtr<nsIDOMWindow> baseWindow = do_QueryInterface(GetEntryGlobal());
 
   // failing that, build it relative to the parent window, if possible
   if (!baseWindow)
@@ -1726,16 +1717,8 @@ nsWindowWatcher::FindItemWithName(const char16_t* aName,
 already_AddRefed<nsIDocShellTreeItem>
 nsWindowWatcher::GetCallerTreeItem(nsIDocShellTreeItem* aParentItem)
 {
-  JSContext *cx = nsContentUtils::GetCurrentJSContext();
-  nsCOMPtr<nsIDocShellTreeItem> callerItem;
-
-  if (cx) {
-    nsCOMPtr<nsIWebNavigation> callerWebNav =
-      do_GetInterface(nsJSUtils::GetDynamicScriptGlobal(cx));
-
-    callerItem = do_QueryInterface(callerWebNav);
-  }
-
+  nsCOMPtr<nsIWebNavigation> callerWebNav = do_GetInterface(GetEntryGlobal());
+  nsCOMPtr<nsIDocShellTreeItem> callerItem = do_QueryInterface(callerWebNav);
   if (!callerItem) {
     callerItem = aParentItem;
   }
diff --git a/gfx/2d/BaseCoord.h b/gfx/2d/BaseCoord.h
new file mode 100644
index 000000000000..bbccbc7ae64a
--- /dev/null
+++ b/gfx/2d/BaseCoord.h
@@ -0,0 +1,110 @@
+/* -*- Mode: C++; tab-width: 2; indent-tabs-mode: nil; c-basic-offset: 2 -*-
+ * This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+#ifndef MOZILLA_GFX_BASECOORD_H_
+#define MOZILLA_GFX_BASECOORD_H_
+
+#include "mozilla/Attributes.h"
+
+namespace mozilla {
+namespace gfx {
+
+/**
+ * Do not use this class directly. Subclass it, pass that subclass as the
+ * Sub parameter, and only use that subclass. This allows methods to safely
+ * cast 'this' to 'Sub*'.
+ */
+template <class T, class Sub>
+struct BaseCoord {
+  T value;
+
+  // Constructors
+  MOZ_CONSTEXPR BaseCoord() : value(0) {}
+  explicit MOZ_CONSTEXPR BaseCoord(T aValue) : value(aValue) {}
+
+  // Note that '=' isn't defined so we'll get the
+  // compiler generated default assignment operator
+
+  operator T() const { return value; }
+
+  friend bool operator==(Sub aA, Sub aB) {
+    return aA.value == aB.value;
+  }
+  friend bool operator!=(Sub aA, Sub aB) {
+    return aA.value != aB.value;
+  }
+
+  friend Sub operator+(Sub aA, Sub aB) {
+    return Sub(aA.value + aB.value);
+  }
+  friend Sub operator-(Sub aA, Sub aB) {
+    return Sub(aA.value - aB.value);
+  }
+  friend Sub operator*(Sub aCoord, T aScale) {
+    return Sub(aCoord.value * aScale);
+  }
+  friend Sub operator*(T aScale, Sub aCoord) {
+    return Sub(aScale * aCoord.value);
+  }
+  friend Sub operator/(Sub aCoord, T aScale) {
+    return Sub(aCoord.value / aScale);
+  }
+  // 'scale / coord' is intentionally omitted because it doesn't make sense.
+
+  Sub& operator+=(Sub aCoord) {
+    value += aCoord.value;
+    return *static_cast<Sub*>(this);
+  }
+  Sub& operator-=(Sub aCoord) {
+    value -= aCoord.value;
+    return *static_cast<Sub*>(this);
+  }
+  Sub& operator*=(T aScale) {
+    value *= aScale;
+    return *static_cast<Sub*>(this);
+  }
+  Sub& operator/=(T aScale) {
+    value /= aScale;
+    return *static_cast<Sub*>(this);
+  }
+
+  // Since BaseCoord is implicitly convertible to its value type T, we need
+  // mixed-type operator overloads to avoid ambiguities at mixed-type call
+  // sites. As we transition more of our code to strongly-typed classes, we
+  // may be able to remove some or all of these overloads.
+  friend bool operator==(Sub aA, T aB) {
+    return aA.value == aB;
+  }
+  friend bool operator==(T aA, Sub aB) {
+    return aA == aB.value;
+  }
+  friend bool operator!=(Sub aA, T aB) {
+    return aA.value != aB;
+  }
+  friend bool operator!=(T aA, Sub aB) {
+    return aA != aB.value;
+  }
+  friend T operator+(Sub aA, T aB) {
+    return aA.value + aB;
+  }
+  friend T operator+(T aA, Sub aB) {
+    return aA + aB.value;
+  }
+  friend T operator-(Sub aA, T aB) {
+    return aA.value - aB;
+  }
+  friend T operator-(T aA, Sub aB) {
+    return aA - aB.value;
+  }
+
+  Sub operator-() const {
+    return Sub(-value);
+  }
+};
+
+}
+}
+
+#endif /* MOZILLA_GFX_BASECOORD_H_ */
diff --git a/gfx/2d/BasePoint.h b/gfx/2d/BasePoint.h
index 9323c2e4fb2f..d9607a258b92 100644
--- a/gfx/2d/BasePoint.h
+++ b/gfx/2d/BasePoint.h
@@ -17,13 +17,13 @@ namespace gfx {
  * Sub parameter, and only use that subclass. This allows methods to safely
  * cast 'this' to 'Sub*'.
  */
-template <class T, class Sub>
+template <class T, class Sub, class Coord = T>
 struct BasePoint {
-  T x, y;
+  Coord x, y;
 
   // Constructors
   MOZ_CONSTEXPR BasePoint() : x(0), y(0) {}
-  MOZ_CONSTEXPR BasePoint(T aX, T aY) : x(aX), y(aY) {}
+  MOZ_CONSTEXPR BasePoint(Coord aX, Coord aY) : x(aX), y(aY) {}
 
   void MoveTo(T aX, T aY) { x = aX; y = aY; }
   void MoveBy(T aDx, T aDy) { x += aDx; y += aDy; }
@@ -67,15 +67,15 @@ struct BasePoint {
   }
 
   T Length() const {
-    return hypot(x, y);
+    return hypot(x.value, y.value);
   }
 
   // Round() is *not* rounding to nearest integer if the values are negative.
   // They are always rounding as floor(n + 0.5).
   // See https://bugzilla.mozilla.org/show_bug.cgi?id=410748#c14
   Sub& Round() {
-    x = static_cast<T>(floor(x + 0.5));
-    y = static_cast<T>(floor(y + 0.5));
+    x = Coord(floor(T(x) + T(0.5)));
+    y = Coord(floor(T(y) + T(0.5)));
     return *static_cast<Sub*>(this);
   }
 
diff --git a/gfx/2d/Blur.cpp b/gfx/2d/Blur.cpp
index 9b99c1a8389f..82db8dfeb7f8 100644
--- a/gfx/2d/Blur.cpp
+++ b/gfx/2d/Blur.cpp
@@ -734,8 +734,8 @@ static const Float GAUSSIAN_SCALE_FACTOR = Float((3 * sqrt(2 * M_PI) / 4) * 1.5)
 IntSize
 AlphaBoxBlur::CalculateBlurRadius(const Point& aStd)
 {
-    IntSize size(static_cast<int32_t>(floor(aStd.x * GAUSSIAN_SCALE_FACTOR + 0.5)),
-                 static_cast<int32_t>(floor(aStd.y * GAUSSIAN_SCALE_FACTOR + 0.5)));
+    IntSize size(static_cast<int32_t>(floor(aStd.x * GAUSSIAN_SCALE_FACTOR + 0.5f)),
+                 static_cast<int32_t>(floor(aStd.y * GAUSSIAN_SCALE_FACTOR + 0.5f)));
 
     return size;
 }
diff --git a/gfx/2d/Coord.h b/gfx/2d/Coord.h
new file mode 100644
index 000000000000..ac94a73a7f02
--- /dev/null
+++ b/gfx/2d/Coord.h
@@ -0,0 +1,142 @@
+/* -*- Mode: C++; tab-width: 20; indent-tabs-mode: nil; c-basic-offset: 2 -*-
+ * This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+#ifndef MOZILLA_GFX_COORD_H_
+#define MOZILLA_GFX_COORD_H_
+
+#include "mozilla/Attributes.h"
+#include "Types.h"
+#include "BaseCoord.h"
+
+#include <cmath>
+
+namespace mozilla {
+
+template <typename> struct IsPixel;
+
+namespace gfx {
+
+template <class units> struct IntCoordTyped;
+template <class units> struct CoordTyped;
+
+// CommonType<coord, primitive> is a metafunction that returns the type of the
+// result of an arithmetic operation on the underlying type of a strongly-typed
+// coordinate type 'coord', and a primitive type 'primitive'. C++ rules for
+// arithmetic conversions are designed to avoid losing information - for
+// example, the result of adding an int and a float is a float - and we want
+// the same behaviour when mixing our coordinate types with primitive types.
+// We get C++ to compute the desired result type using 'decltype'.
+
+template <class coord, class primitive>
+struct CommonType;
+
+template <class units, class primitive>
+struct CommonType<IntCoordTyped<units>, primitive> {
+    typedef decltype(int32_t() + primitive()) type;
+};
+
+template <class units, class primitive>
+struct CommonType<CoordTyped<units>, primitive> {
+    typedef decltype(Float() + primitive()) type;
+};
+
+// This is a base class that provides mixed-type operator overloads between
+// a strongly-typed Coord and a primitive value. It is needed to avoid
+// ambiguities at mixed-type call sites, because Coord classes are implicitly
+// convertible to their underlying value type. As we transition more of our code
+// to strongly-typed classes, we may be able to remove some or all of these
+// overloads.
+template <class coord, class primitive>
+struct CoordOperatorsHelper {
+  friend bool operator==(coord aA, primitive aB) {
+    return aA.value == aB;
+  }
+  friend bool operator==(primitive aA, coord aB) {
+    return aA == aB.value;
+  }
+  friend bool operator!=(coord aA, primitive aB) {
+    return aA.value != aB;
+  }
+  friend bool operator!=(primitive aA, coord aB) {
+    return aA != aB.value;
+  }
+
+  typedef typename CommonType<coord, primitive>::type result_type;
+
+  friend result_type operator+(coord aA, primitive aB) {
+    return aA.value + aB;
+  }
+  friend result_type operator+(primitive aA, coord aB) {
+    return aA + aB.value;
+  }
+  friend result_type operator-(coord aA, primitive aB) {
+    return aA.value - aB;
+  }
+  friend result_type operator-(primitive aA, coord aB) {
+    return aA - aB.value;
+  }
+  friend result_type operator*(coord aCoord, primitive aScale) {
+    return aCoord.value * aScale;
+  }
+  friend result_type operator*(primitive aScale, coord aCoord) {
+    return aScale * aCoord.value;
+  }
+  friend result_type operator/(coord aCoord, primitive aScale) {
+    return aCoord.value / aScale;
+  }
+  // 'scale / coord' is intentionally omitted because it doesn't make sense.
+};
+
+// Note: 'IntCoordTyped<units>' and 'CoordTyped<units>' do not derive from
+// 'units' to work around https://gcc.gnu.org/bugzilla/show_bug.cgi?id=61959.
+
+template<class units>
+struct IntCoordTyped :
+  public BaseCoord< int32_t, IntCoordTyped<units> >,
+  public CoordOperatorsHelper< IntCoordTyped<units>, float >,
+  public CoordOperatorsHelper< IntCoordTyped<units>, double > {
+  static_assert(IsPixel<units>::value,
+                "'units' must be a coordinate system tag");
+
+  typedef BaseCoord< int32_t, IntCoordTyped<units> > Super;
+
+  MOZ_CONSTEXPR IntCoordTyped() : Super() {}
+  MOZ_CONSTEXPR IntCoordTyped(int32_t aValue) : Super(aValue) {}
+};
+
+template<class units>
+struct CoordTyped :
+  public BaseCoord< Float, CoordTyped<units> >,
+  public CoordOperatorsHelper< CoordTyped<units>, int32_t >,
+  public CoordOperatorsHelper< CoordTyped<units>, uint32_t >,
+  public CoordOperatorsHelper< CoordTyped<units>, double > {
+  static_assert(IsPixel<units>::value,
+                "'units' must be a coordinate system tag");
+
+  typedef BaseCoord< Float, CoordTyped<units> > Super;
+
+  MOZ_CONSTEXPR CoordTyped() : Super() {}
+  MOZ_CONSTEXPR CoordTyped(Float aValue) : Super(aValue) {}
+  explicit MOZ_CONSTEXPR CoordTyped(const IntCoordTyped<units>& aCoord) : Super(float(aCoord.value)) {}
+
+  void Round() {
+    this->value = floor(this->value + 0.5);
+  }
+  void Truncate() {
+    this->value = int32_t(this->value);
+  }
+
+  IntCoordTyped<units> Rounded() const {
+    return IntCoordTyped<units>(int32_t(floor(this->value + 0.5)));
+  }
+  IntCoordTyped<units> Truncated() const {
+    return IntCoordTyped<units>(int32_t(this->value));
+  }
+};
+
+}
+}
+
+#endif /* MOZILLA_GFX_COORD_H_ */
diff --git a/gfx/2d/DrawTargetD2D.cpp b/gfx/2d/DrawTargetD2D.cpp
index 768197a73138..bee062c33347 100644
--- a/gfx/2d/DrawTargetD2D.cpp
+++ b/gfx/2d/DrawTargetD2D.cpp
@@ -2599,7 +2599,7 @@ DrawTargetD2D::SetupEffectForRadialGradient(const RadialGradientPattern *aPatter
   mPrivateData->mEffect->GetVariableByName("DeviceSpaceToUserSpace")->
     AsMatrix()->SetMatrix(matrix);
 
-  float A = dc.x * dc.x + dc.y * dc.y - dr * dr;
+  float A = dc.x.value * dc.x.value + dc.y.value * dc.y.value - dr * dr;
 
   uint32_t offset = 0;
   switch (stops->mStopCollection->GetExtendMode()) {
diff --git a/gfx/2d/DrawTargetTiled.cpp b/gfx/2d/DrawTargetTiled.cpp
index 34370a34b6ac..d4a072431a60 100644
--- a/gfx/2d/DrawTargetTiled.cpp
+++ b/gfx/2d/DrawTargetTiled.cpp
@@ -35,8 +35,8 @@ DrawTargetTiled::Init(const TileSet& aTiles)
                             mTiles[i].mTileOrigin.x + mTiles[i].mDrawTarget->GetSize().width);
     uint32_t newYMost = max(mRect.YMost(),
                             mTiles[i].mTileOrigin.y + mTiles[i].mDrawTarget->GetSize().height);
-    mRect.x = min(mRect.x, mTiles[i].mTileOrigin.x);
-    mRect.y = min(mRect.y, mTiles[i].mTileOrigin.y);
+    mRect.x = min(mRect.x, mTiles[i].mTileOrigin.x.value);
+    mRect.y = min(mRect.y, mTiles[i].mTileOrigin.y.value);
     mRect.width = newXMost - mRect.x;
     mRect.height = newYMost - mRect.y;
   }
diff --git a/gfx/2d/HelpersD2D.h b/gfx/2d/HelpersD2D.h
index ecb792633549..941c92912f43 100644
--- a/gfx/2d/HelpersD2D.h
+++ b/gfx/2d/HelpersD2D.h
@@ -239,7 +239,7 @@ static inline bool IsPatternSupportedByD2D(const Pattern &aPattern)
 
   Point diff = pat->mCenter2 - pat->mCenter1;
 
-  if (sqrt(diff.x * diff.x + diff.y * diff.y) >= pat->mRadius2) {
+  if (sqrt(diff.x.value * diff.x.value + diff.y.value * diff.y.value) >= pat->mRadius2) {
     // Inner point lies outside the circle.
     return false;
   }
diff --git a/gfx/2d/Path.cpp b/gfx/2d/Path.cpp
index 268e8b810110..3540b6f25615 100644
--- a/gfx/2d/Path.cpp
+++ b/gfx/2d/Path.cpp
@@ -107,7 +107,7 @@ FlattenedPath::QuadraticBezierTo(const Point &aCP1,
                                  const Point &aCP2)
 {
   MOZ_ASSERT(!mCalculatedLength);
-  // We need to elevate the degree of this quadratic Bézier to cubic, so we're
+  // We need to elevate the degree of this quadratic B�zier to cubic, so we're
   // going to add an intermediate control point, and recompute control point 1.
   // The first and last control points remain the same.
   // This formula can be found on http://fontforge.sourceforge.net/bezier.html
@@ -250,7 +250,7 @@ FlattenBezierCurveSegment(const BezierControlPoints &aControlPoints,
     Point cp21 = currentCP.mCP2 - currentCP.mCP3;
     Point cp31 = currentCP.mCP3 - currentCP.mCP1;
 
-    Float s3 = (cp31.x * cp21.y - cp31.y * cp21.x) / hypotf(cp21.x, cp21.y);
+    Float s3 = (cp31.x.value * cp21.y.value - cp31.y.value * cp21.x.value) / hypotf(cp21.x, cp21.y);
 
     t = 2 * Float(sqrt(aTolerance / (3. * abs(s3))));
 
@@ -276,7 +276,7 @@ FindInflectionApproximationRange(BezierControlPoints aControlPoints,
     Point cp21 = aControlPoints.mCP2 - aControlPoints.mCP1;
     Point cp41 = aControlPoints.mCP4 - aControlPoints.mCP1;
 
-    if (cp21.x == 0 && cp21.y == 0) {
+    if (cp21.x == 0.f && cp21.y == 0.f) {
       // In this case s3 becomes lim[n->0] (cp41.x * n) / n - (cp41.y * n) / n = cp41.x - cp41.y.
 
       // Use the absolute value so that Min and Max will correspond with the
@@ -286,7 +286,7 @@ FindInflectionApproximationRange(BezierControlPoints aControlPoints,
       return;
     }
 
-    Float s3 = (cp41.x * cp21.y - cp41.y * cp21.x) / hypotf(cp21.x, cp21.y);
+    Float s3 = (cp41.x.value * cp21.y.value - cp41.y.value * cp21.x.value) / hypotf(cp21.x, cp21.y);
 
     if (s3 == 0) {
       // This means within the precision we have it can be approximated
diff --git a/gfx/2d/PathHelpers.h b/gfx/2d/PathHelpers.h
index 56d493e4d315..80963cd1af4f 100644
--- a/gfx/2d/PathHelpers.h
+++ b/gfx/2d/PathHelpers.h
@@ -16,8 +16,8 @@ template <typename T>
 void ArcToBezier(T* aSink, const Point &aOrigin, const Size &aRadius,
                  float aStartAngle, float aEndAngle, bool aAntiClockwise)
 {
-  Point startPoint(aOrigin.x + cos(aStartAngle) * aRadius.width,
-                   aOrigin.y + sin(aStartAngle) * aRadius.height);
+  Point startPoint(aOrigin.x + cosf(aStartAngle) * aRadius.width,
+                   aOrigin.y + sinf(aStartAngle) * aRadius.height);
 
   aSink->LineTo(startPoint);
 
@@ -56,10 +56,10 @@ void ArcToBezier(T* aSink, const Point &aOrigin, const Size &aRadius,
       currentEndAngle = currentStartAngle + arcSweepLeft * sweepDirection;
     }
 
-    Point currentStartPoint(aOrigin.x + cos(currentStartAngle) * aRadius.width,
-                            aOrigin.y + sin(currentStartAngle) * aRadius.height);
-    Point currentEndPoint(aOrigin.x + cos(currentEndAngle) * aRadius.width,
-                          aOrigin.y + sin(currentEndAngle) * aRadius.height);
+    Point currentStartPoint(aOrigin.x + cosf(currentStartAngle) * aRadius.width,
+                            aOrigin.y + sinf(currentStartAngle) * aRadius.height);
+    Point currentEndPoint(aOrigin.x + cosf(currentEndAngle) * aRadius.width,
+                          aOrigin.y + sinf(currentEndAngle) * aRadius.height);
 
     // Calculate kappa constant for partial curve. The sign of angle in the
     // tangent will actually ensure this is negative for a counter clockwise
diff --git a/gfx/2d/PathSkia.cpp b/gfx/2d/PathSkia.cpp
index 83ab501fbae2..efa0c6f56b45 100644
--- a/gfx/2d/PathSkia.cpp
+++ b/gfx/2d/PathSkia.cpp
@@ -141,10 +141,10 @@ PathSkia::ContainsPoint(const Point &aPoint, const Matrix &aTransform) const
   }
 
   SkRegion pointRect;
-  pointRect.setRect(int32_t(SkFloatToScalar(transformed.x - 1)),
-                    int32_t(SkFloatToScalar(transformed.y - 1)),
-                    int32_t(SkFloatToScalar(transformed.x + 1)),
-                    int32_t(SkFloatToScalar(transformed.y + 1)));
+  pointRect.setRect(int32_t(SkFloatToScalar(transformed.x - 1.f)),
+                    int32_t(SkFloatToScalar(transformed.y - 1.f)),
+                    int32_t(SkFloatToScalar(transformed.x + 1.f)),
+                    int32_t(SkFloatToScalar(transformed.y + 1.f)));
 
   SkRegion pathRegion;
   
@@ -174,10 +174,10 @@ PathSkia::StrokeContainsPoint(const StrokeOptions &aStrokeOptions,
   }
 
   SkRegion pointRect;
-  pointRect.setRect(int32_t(SkFloatToScalar(transformed.x - 1)),
-                    int32_t(SkFloatToScalar(transformed.y - 1)),
-                    int32_t(SkFloatToScalar(transformed.x + 1)),
-                    int32_t(SkFloatToScalar(transformed.y + 1)));
+  pointRect.setRect(int32_t(SkFloatToScalar(transformed.x - 1.f)),
+                    int32_t(SkFloatToScalar(transformed.y - 1.f)),
+                    int32_t(SkFloatToScalar(transformed.x + 1.f)),
+                    int32_t(SkFloatToScalar(transformed.y + 1.f)));
 
   SkRegion pathRegion;
   
diff --git a/gfx/2d/Point.h b/gfx/2d/Point.h
index 26e13c4acf6e..423ee7f401ea 100644
--- a/gfx/2d/Point.h
+++ b/gfx/2d/Point.h
@@ -8,6 +8,8 @@
 
 #include "mozilla/Attributes.h"
 #include "Types.h"
+#include "Coord.h"
+#include "BaseCoord.h"
 #include "BasePoint.h"
 #include "BasePoint3D.h"
 #include "BasePoint4D.h"
@@ -33,15 +35,21 @@ namespace gfx {
 
 template<class units>
 struct IntPointTyped :
-  public BasePoint< int32_t, IntPointTyped<units> >,
+  public BasePoint< int32_t, IntPointTyped<units>, IntCoordTyped<units> >,
   public units {
   static_assert(IsPixel<units>::value,
                 "'units' must be a coordinate system tag");
 
-  typedef BasePoint< int32_t, IntPointTyped<units> > Super;
+  typedef IntCoordTyped<units> Coord;
+  typedef BasePoint< int32_t, IntPointTyped<units>, IntCoordTyped<units> > Super;
 
   MOZ_CONSTEXPR IntPointTyped() : Super() {}
-  MOZ_CONSTEXPR IntPointTyped(int32_t aX, int32_t aY) : Super(aX, aY) {}
+  MOZ_CONSTEXPR IntPointTyped(int32_t aX, int32_t aY) : Super(Coord(aX), Coord(aY)) {}
+  // The mixed-type constructors (int, Coord) and (Coord, int) are needed to
+  // avoid ambiguities because Coord is implicitly convertible to int.
+  MOZ_CONSTEXPR IntPointTyped(int32_t aX, Coord aY) : Super(Coord(aX), aY) {}
+  MOZ_CONSTEXPR IntPointTyped(Coord aX, int32_t aY) : Super(aX, Coord(aY)) {}
+  MOZ_CONSTEXPR IntPointTyped(Coord aX, Coord aY) : Super(aX, aY) {}
 
   // XXX When all of the code is ported, the following functions to convert to and from
   // unknown types should be removed.
@@ -58,15 +66,21 @@ typedef IntPointTyped<UnknownUnits> IntPoint;
 
 template<class units>
 struct PointTyped :
-  public BasePoint< Float, PointTyped<units> >,
+  public BasePoint< Float, PointTyped<units>, CoordTyped<units> >,
   public units {
   static_assert(IsPixel<units>::value,
                 "'units' must be a coordinate system tag");
 
-  typedef BasePoint< Float, PointTyped<units> > Super;
+  typedef CoordTyped<units> Coord;
+  typedef BasePoint< Float, PointTyped<units>, CoordTyped<units> > Super;
 
   MOZ_CONSTEXPR PointTyped() : Super() {}
-  MOZ_CONSTEXPR PointTyped(Float aX, Float aY) : Super(aX, aY) {}
+  MOZ_CONSTEXPR PointTyped(Float aX, Float aY) : Super(Coord(aX), Coord(aY)) {}
+  // The mixed-type constructors (Float, Coord) and (Coord, Float) are needed to
+  // avoid ambiguities because Coord is implicitly convertible to Float.
+  MOZ_CONSTEXPR PointTyped(Float aX, Coord aY) : Super(Coord(aX), aY) {}
+  MOZ_CONSTEXPR PointTyped(Coord aX, Float aY) : Super(aX, Coord(aY)) {}
+  MOZ_CONSTEXPR PointTyped(Coord aX, Coord aY) : Super(aX.value, aY.value) {}
   MOZ_CONSTEXPR MOZ_IMPLICIT PointTyped(const IntPointTyped<units>& point) : Super(float(point.x), float(point.y)) {}
 
   // XXX When all of the code is ported, the following functions to convert to and from
@@ -84,8 +98,14 @@ typedef PointTyped<UnknownUnits> Point;
 
 template<class units>
 IntPointTyped<units> RoundedToInt(const PointTyped<units>& aPoint) {
-  return IntPointTyped<units>(int32_t(floorf(aPoint.x + 0.5f)),
-                              int32_t(floorf(aPoint.y + 0.5f)));
+  return IntPointTyped<units>(aPoint.x.Rounded(),
+                              aPoint.y.Rounded());
+}
+
+template<class units>
+IntPointTyped<units> TruncatedToInt(const PointTyped<units>& aPoint) {
+  return IntPointTyped<units>(aPoint.x.Truncated(),
+                              aPoint.y.Truncated());
 }
 
 template<class units>
diff --git a/gfx/2d/SVGTurbulenceRenderer-inl.h b/gfx/2d/SVGTurbulenceRenderer-inl.h
index de3b4e3bd9fe..5a5489e336bf 100644
--- a/gfx/2d/SVGTurbulenceRenderer-inl.h
+++ b/gfx/2d/SVGTurbulenceRenderer-inl.h
@@ -240,15 +240,15 @@ SVGTurbulenceRenderer<Type,Stitch,f32x4_t,i32x4_t,u8x16_t>::Noise2(Point aVec, c
   uint8_t i = mLatticeSelector[b0.x & sBM];
   uint8_t j = mLatticeSelector[b1.x & sBM];
 
-  const f32x4_t* qua = mGradient[(i + b0.y) & sBM];
-  const f32x4_t* qub = mGradient[(i + b1.y) & sBM];
-  const f32x4_t* qva = mGradient[(j + b0.y) & sBM];
-  const f32x4_t* qvb = mGradient[(j + b1.y) & sBM];
+  const f32x4_t* qua = mGradient[(i + b0.y.value) & sBM];
+  const f32x4_t* qub = mGradient[(i + b1.y.value) & sBM];
+  const f32x4_t* qva = mGradient[(j + b0.y.value) & sBM];
+  const f32x4_t* qvb = mGradient[(j + b1.y.value) & sBM];
 
   return BiMix(simd::WSumF32(qua[0], qua[1], r.x, r.y),
-               simd::WSumF32(qva[0], qva[1], r.x - 1, r.y),
-               simd::WSumF32(qub[0], qub[1], r.x, r.y - 1),
-               simd::WSumF32(qvb[0], qvb[1], r.x - 1, r.y - 1),
+               simd::WSumF32(qva[0], qva[1], r.x - 1.f, r.y),
+               simd::WSumF32(qub[0], qub[1], r.x, r.y - 1.f),
+               simd::WSumF32(qvb[0], qvb[1], r.x - 1.f, r.y - 1.f),
                SCurve(r));
 }
 
diff --git a/gfx/2d/moz.build b/gfx/2d/moz.build
index 712085ae5527..6893089db95e 100644
--- a/gfx/2d/moz.build
+++ b/gfx/2d/moz.build
@@ -10,6 +10,7 @@ EXPORTS.mozilla += [
 
 EXPORTS.mozilla.gfx += [
     '2D.h',
+    'BaseCoord.h',
     'BaseMargin.h',
     'BasePoint.h',
     'BasePoint3D.h',
@@ -18,6 +19,7 @@ EXPORTS.mozilla.gfx += [
     'BaseSize.h',
     'Blur.h',
     'BorrowedContext.h',
+    'Coord.h',
     'DataSurfaceHelpers.h',
     'Filters.h',
     'Helpers.h',
diff --git a/gfx/2d/unittest/TestPoint.cpp b/gfx/2d/unittest/TestPoint.cpp
index d16fcb4f2a5e..6aa2b6a35cbd 100644
--- a/gfx/2d/unittest/TestPoint.cpp
+++ b/gfx/2d/unittest/TestPoint.cpp
@@ -26,8 +26,8 @@ TestPoint::Addition()
 
   a += b;
 
-  VERIFY(a.x == 7);
-  VERIFY(a.y == -3);
+  VERIFY(a.x == 7.f);
+  VERIFY(a.y == -3.f);
 }
 
 void
@@ -41,6 +41,6 @@ TestPoint::Subtraction()
 
   a -= b;
 
-  VERIFY(a.x == -3);
-  VERIFY(a.y == 7);
+  VERIFY(a.x == -3.f);
+  VERIFY(a.y == 7.f);
 }
diff --git a/gfx/ipc/GfxMessageUtils.h b/gfx/ipc/GfxMessageUtils.h
index 8a5345d24fb4..64b644c846fa 100644
--- a/gfx/ipc/GfxMessageUtils.h
+++ b/gfx/ipc/GfxMessageUtils.h
@@ -507,6 +507,38 @@ struct ParamTraits<nsIntSize>
   }
 };
 
+template<class T>
+struct ParamTraits< mozilla::gfx::CoordTyped<T> >
+{
+  typedef mozilla::gfx::CoordTyped<T> paramType;
+
+  static void Write(Message* msg, const paramType& param)
+  {
+    WriteParam(msg, param.value);
+  }
+
+  static bool Read(const Message* msg, void** iter, paramType* result)
+  {
+    return (ReadParam(msg, iter, &result->value));
+  }
+};
+
+template<class T>
+struct ParamTraits< mozilla::gfx::IntCoordTyped<T> >
+{
+  typedef mozilla::gfx::IntCoordTyped<T> paramType;
+
+  static void Write(Message* msg, const paramType& param)
+  {
+    WriteParam(msg, param.value);
+  }
+
+  static bool Read(const Message* msg, void** iter, paramType* result)
+  {
+    return (ReadParam(msg, iter, &result->value));
+  }
+};
+
 template<class T, class U>
 struct ParamTraits< mozilla::gfx::ScaleFactor<T, U> >
 {
diff --git a/gfx/layers/Compositor.h b/gfx/layers/Compositor.h
index d3901b9c068b..c9b0aa6ffbe9 100644
--- a/gfx/layers/Compositor.h
+++ b/gfx/layers/Compositor.h
@@ -197,7 +197,7 @@ protected:
 public:
   NS_INLINE_DECL_REFCOUNTING(Compositor)
 
-  Compositor(PCompositorParent* aParent = nullptr)
+  explicit Compositor(PCompositorParent* aParent = nullptr)
     : mCompositorID(0)
     , mDiagnosticTypes(DiagnosticTypes::NO_DIAGNOSTIC)
     , mParent(aParent)
diff --git a/gfx/layers/Effects.h b/gfx/layers/Effects.h
index e52ecdc41f1b..24272b18be74 100644
--- a/gfx/layers/Effects.h
+++ b/gfx/layers/Effects.h
@@ -42,7 +42,7 @@ struct Effect
 {
   NS_INLINE_DECL_REFCOUNTING(Effect)
 
-  Effect(EffectTypes aType) : mType(aType) {}
+  explicit Effect(EffectTypes aType) : mType(aType) {}
 
   EffectTypes mType;
 
@@ -98,7 +98,7 @@ struct EffectMask : public Effect
 
 struct EffectBlendMode : public Effect
 {
-  EffectBlendMode(gfx::CompositionOp aBlendMode)
+  explicit EffectBlendMode(gfx::CompositionOp aBlendMode)
     : Effect(EffectTypes::BLEND_MODE)
     , mBlendMode(aBlendMode)
   { }
@@ -112,7 +112,7 @@ struct EffectBlendMode : public Effect
 // Render to a render target rather than the screen.
 struct EffectRenderTarget : public TexturedEffect
 {
-  EffectRenderTarget(CompositingRenderTarget *aRenderTarget)
+  explicit EffectRenderTarget(CompositingRenderTarget *aRenderTarget)
     : TexturedEffect(EffectTypes::RENDER_TARGET, aRenderTarget, true, gfx::Filter::LINEAR)
     , mRenderTarget(aRenderTarget)
   {}
@@ -183,7 +183,7 @@ struct EffectComponentAlpha : public TexturedEffect
 
 struct EffectSolidColor : public Effect
 {
-  EffectSolidColor(const gfx::Color &aColor)
+  explicit EffectSolidColor(const gfx::Color &aColor)
     : Effect(EffectTypes::SOLID_COLOR)
     , mColor(aColor)
   {}
diff --git a/gfx/layers/FrameMetrics.h b/gfx/layers/FrameMetrics.h
index dec598332083..be0bd2a50763 100644
--- a/gfx/layers/FrameMetrics.h
+++ b/gfx/layers/FrameMetrics.h
@@ -563,6 +563,22 @@ struct ScrollableLayerGuid {
   {
     return !(*this == other);
   }
+
+  bool operator<(const ScrollableLayerGuid& other) const
+  {
+    if (mLayersId < other.mLayersId) {
+      return true;
+    }
+    if (mLayersId == other.mLayersId) {
+      if (mPresShellId < other.mPresShellId) {
+        return true;
+      }
+      if (mPresShellId == other.mPresShellId) {
+        return mScrollId < other.mScrollId;
+      }
+    }
+    return false;
+  }
 };
 
 template <int LogLevel>
diff --git a/gfx/layers/ImageContainer.h b/gfx/layers/ImageContainer.h
index 0be6b5b0c2f5..53f97c8ebd95 100644
--- a/gfx/layers/ImageContainer.h
+++ b/gfx/layers/ImageContainer.h
@@ -57,7 +57,7 @@ public:
    */
   class SurfaceReleaser : public nsRunnable {
   public:
-    SurfaceReleaser(RawRef aRef) : mRef(aRef) {}
+    explicit SurfaceReleaser(RawRef aRef) : mRef(aRef) {}
     NS_IMETHOD Run() {
       mRef->Release();
       return NS_OK;
@@ -350,7 +350,7 @@ public:
 
   enum { DISABLE_ASYNC = 0x0, ENABLE_ASYNC = 0x01 };
 
-  ImageContainer(int flag = 0);
+  explicit ImageContainer(int flag = 0);
 
   /**
    * Create an Image in one of the given formats.
@@ -666,7 +666,7 @@ private:
 class AutoLockImage
 {
 public:
-  AutoLockImage(ImageContainer *aContainer) : mContainer(aContainer) { mImage = mContainer->LockCurrentImage(); }
+  explicit AutoLockImage(ImageContainer *aContainer) : mContainer(aContainer) { mImage = mContainer->LockCurrentImage(); }
   AutoLockImage(ImageContainer *aContainer, RefPtr<gfx::SourceSurface> *aSurface) : mContainer(aContainer) {
     *aSurface = mContainer->LockCurrentAsSourceSurface(&mSize, getter_AddRefs(mImage));
   }
@@ -821,7 +821,7 @@ public:
 
   virtual gfx::IntSize GetSize() { return mSize; }
 
-  PlanarYCbCrImage(BufferRecycleBin *aRecycleBin);
+  explicit PlanarYCbCrImage(BufferRecycleBin *aRecycleBin);
 
   virtual SharedPlanarYCbCrImage *AsSharedPlanarYCbCrImage() { return nullptr; }
 
diff --git a/gfx/layers/LayerScope.cpp b/gfx/layers/LayerScope.cpp
index 461188e6930d..649dbbdf702e 100644
--- a/gfx/layers/LayerScope.cpp
+++ b/gfx/layers/LayerScope.cpp
@@ -366,7 +366,7 @@ StaticAutoPtr<LayerScopeWebSocketManager> WebSocketHelper::sWebSocketManager;
  */
 class DebugGLData: public LinkedListElement<DebugGLData> {
 public:
-    DebugGLData(Packet::DataType aDataType)
+    explicit DebugGLData(Packet::DataType aDataType)
         : mDataType(aDataType)
     { }
 
@@ -399,7 +399,7 @@ public:
           mFrameStamp(aValue)
     { }
 
-    DebugGLFrameStatusData(Packet::DataType aDataType)
+    explicit DebugGLFrameStatusData(Packet::DataType aDataType)
         : DebugGLData(aDataType),
           mFrameStamp(0)
     { }
@@ -547,7 +547,7 @@ protected:
 
 class DebugGLLayersData : public DebugGLData {
 public:
-    DebugGLLayersData(UniquePtr<Packet> aPacket)
+    explicit DebugGLLayersData(UniquePtr<Packet> aPacket)
         : DebugGLData(Packet::LAYERS),
           mPacket(Move(aPacket))
     { }
diff --git a/gfx/layers/LayerScope.h b/gfx/layers/LayerScope.h
index 75af91851525..420370ab714c 100644
--- a/gfx/layers/LayerScope.h
+++ b/gfx/layers/LayerScope.h
@@ -41,7 +41,7 @@ public:
 // Perform BeginFrame and EndFrame automatically
 class LayerScopeAutoFrame {
 public:
-    LayerScopeAutoFrame(int64_t aFrameStamp);
+    explicit LayerScopeAutoFrame(int64_t aFrameStamp);
     ~LayerScopeAutoFrame();
 
 private:
diff --git a/gfx/layers/LayerTreeInvalidation.cpp b/gfx/layers/LayerTreeInvalidation.cpp
index d2bba6b3db30..f5b676a1745f 100644
--- a/gfx/layers/LayerTreeInvalidation.cpp
+++ b/gfx/layers/LayerTreeInvalidation.cpp
@@ -98,7 +98,7 @@ NotifySubdocumentInvalidationRecursive(Layer* aLayer, NotifySubDocInvalidationFu
 
 struct LayerPropertiesBase : public LayerProperties
 {
-  LayerPropertiesBase(Layer* aLayer)
+  explicit LayerPropertiesBase(Layer* aLayer)
     : mLayer(aLayer)
     , mMaskLayer(nullptr)
     , mVisibleRegion(aLayer->GetVisibleRegion())
@@ -212,7 +212,7 @@ struct LayerPropertiesBase : public LayerProperties
 
 struct ContainerLayerProperties : public LayerPropertiesBase
 {
-  ContainerLayerProperties(ContainerLayer* aLayer)
+  explicit ContainerLayerProperties(ContainerLayer* aLayer)
     : LayerPropertiesBase(aLayer)
     , mPreXScale(aLayer->GetPreXScale())
     , mPreYScale(aLayer->GetPreYScale())
@@ -322,7 +322,7 @@ struct ContainerLayerProperties : public LayerPropertiesBase
 
 struct ColorLayerProperties : public LayerPropertiesBase
 {
-  ColorLayerProperties(ColorLayer *aLayer)
+  explicit ColorLayerProperties(ColorLayer *aLayer)
     : LayerPropertiesBase(aLayer)
     , mColor(aLayer->GetColor())
   { }
@@ -345,7 +345,7 @@ struct ColorLayerProperties : public LayerPropertiesBase
 
 struct ImageLayerProperties : public LayerPropertiesBase
 {
-  ImageLayerProperties(ImageLayer* aImage)
+  explicit ImageLayerProperties(ImageLayer* aImage)
     : LayerPropertiesBase(aImage)
     , mContainer(aImage->GetContainer())
     , mFilter(aImage->GetFilter())
diff --git a/gfx/layers/RotatedBuffer.h b/gfx/layers/RotatedBuffer.h
index 0c7c4ba9ade2..c2e098ee6bd2 100644
--- a/gfx/layers/RotatedBuffer.h
+++ b/gfx/layers/RotatedBuffer.h
@@ -190,7 +190,7 @@ public:
     ContainsVisibleBounds
   };
 
-  RotatedContentBuffer(BufferSizePolicy aBufferSizePolicy)
+  explicit RotatedContentBuffer(BufferSizePolicy aBufferSizePolicy)
     : mBufferProvider(nullptr)
     , mBufferProviderOnWhite(nullptr)
     , mBufferSizePolicy(aBufferSizePolicy)
diff --git a/gfx/layers/apz/src/APZCTreeManager.cpp b/gfx/layers/apz/src/APZCTreeManager.cpp
index 022a125bcbde..469b06571d6f 100644
--- a/gfx/layers/apz/src/APZCTreeManager.cpp
+++ b/gfx/layers/apz/src/APZCTreeManager.cpp
@@ -23,6 +23,7 @@
 #include "UnitTransforms.h"             // for ViewAs
 #include "gfxPrefs.h"                   // for gfxPrefs
 #include "OverscrollHandoffChain.h"     // for OverscrollHandoffChain
+#include "LayersLogging.h"              // for Stringify
 
 #define APZCTM_LOG(...)
 // #define APZCTM_LOG(...) printf_stderr("APZCTM: " __VA_ARGS__)
@@ -136,13 +137,15 @@ APZCTreeManager::UpdatePanZoomControllerTree(CompositorParent* aCompositor,
 
   if (aRoot) {
     mApzcTreeLog << "[start]\n";
+    std::map<ScrollableLayerGuid, AsyncPanZoomController*> apzcMap;
     UpdatePanZoomControllerTree(aCompositor,
                                 aRoot,
                                 // aCompositor is null in gtest scenarios
                                 aCompositor ? aCompositor->RootLayerTreeId() : 0,
                                 Matrix4x4(), nullptr, nullptr,
                                 aIsFirstPaint, aOriginatingLayersId,
-                                paintLogger, &apzcsToDestroy, nsIntRegion());
+                                paintLogger, &apzcsToDestroy, apzcMap,
+                                nsIntRegion());
     mApzcTreeLog << "[end]\n";
   }
 
@@ -152,22 +155,52 @@ APZCTreeManager::UpdatePanZoomControllerTree(CompositorParent* aCompositor,
   }
 }
 
+static nsIntRegion
+ComputeTouchSensitiveRegion(GeckoContentController* aController,
+                            const FrameMetrics& aMetrics,
+                            const nsIntRegion& aObscured)
+{
+  // Use the composition bounds as the hit test region.
+  // Optionally, the GeckoContentController can provide a touch-sensitive
+  // region that constrains all frames associated with the controller.
+  // In this case we intersect the composition bounds with that region.
+  ParentLayerRect visible(aMetrics.mCompositionBounds);
+  CSSRect touchSensitiveRegion;
+  if (aController->GetTouchSensitiveRegion(&touchSensitiveRegion)) {
+    // Note: we assume here that touchSensitiveRegion is in the CSS pixels
+    // of our parent layer, which makes this coordinate conversion
+    // correct.
+    visible = visible.Intersect(touchSensitiveRegion
+                                * aMetrics.mDevPixelsPerCSSPixel
+                                * aMetrics.GetParentResolution());
+  }
+
+  // Not sure what rounding option is the most correct here, but if we ever
+  // figure it out we can change this. For now I'm rounding in to minimize
+  // the chances of getting a complex region.
+  ParentLayerIntRect roundedVisible = RoundedIn(visible);
+  nsIntRegion unobscured;
+  unobscured.Sub(nsIntRect(roundedVisible.x, roundedVisible.y,
+                           roundedVisible.width, roundedVisible.height),
+                 aObscured);
+  return unobscured;
+}
+
 AsyncPanZoomController*
 APZCTreeManager::UpdatePanZoomControllerTree(CompositorParent* aCompositor,
                                              Layer* aLayer, uint64_t aLayersId,
-                                             Matrix4x4 aTransform,
+                                             const Matrix4x4& aAncestorTransform,
                                              AsyncPanZoomController* aParent,
                                              AsyncPanZoomController* aNextSibling,
                                              bool aIsFirstPaint,
                                              uint64_t aOriginatingLayersId,
                                              const APZPaintLogHelper& aPaintLogger,
                                              nsTArray< nsRefPtr<AsyncPanZoomController> >* aApzcsToDestroy,
+                                             std::map<ScrollableLayerGuid, AsyncPanZoomController*>& aApzcMap,
                                              const nsIntRegion& aObscured)
 {
   mTreeLock.AssertCurrentThreadOwns();
 
-  Matrix4x4 transform = aLayer->GetTransform();
-
   AsyncPanZoomController* apzc = nullptr;
   mApzcTreeLog << aLayer->Name() << '\t';
 
@@ -179,136 +212,148 @@ APZCTreeManager::UpdatePanZoomControllerTree(CompositorParent* aCompositor,
       // has registered a GeckoContentController for it, so we need to ensure
       // it has an APZC instance to manage its scrolling.
 
-      apzc = aLayer->GetAsyncPanZoomController();
-
-      // If the content represented by the scrollable layer has changed (which may
-      // be possible because of DLBI heuristics) then we don't want to keep using
-      // the same old APZC for the new content. Null it out so we run through the
-      // code to find another one or create one.
+      // aApzcMap allows reusing the exact same APZC instance for different layers
+      // with the same FrameMetrics data. This is needed because in some cases content
+      // that is supposed to scroll together is split into multiple layers because of
+      // e.g. non-scrolling content interleaved in z-index order.
       ScrollableLayerGuid guid(aLayersId, metrics);
-      if (apzc && !apzc->Matches(guid)) {
-        apzc = nullptr;
+      auto insertResult = aApzcMap.insert(std::make_pair(guid, static_cast<AsyncPanZoomController*>(nullptr)));
+      if (!insertResult.second) {
+        apzc = insertResult.first->second;
       }
+      APZCTM_LOG("Found APZC %p for layer %p with identifiers %lld %lld\n", apzc, aLayer, guid.mLayersId, guid.mScrollId);
 
-      // If the layer doesn't have an APZC already, try to find one of our
-      // pre-existing ones that matches. In particular, if we find an APZC whose
-      // ScrollableLayerGuid is the same, then we know what happened is that the
-      // layout of the page changed causing the layer tree to be rebuilt, but the
-      // underlying content for which the APZC was originally created is still
-      // there. So it makes sense to pick up that APZC instance again and use it here.
+      // If we haven't encountered a layer already with the same metrics, then we need to
+      // do the full reuse-or-make-an-APZC algorithm, which is contained inside the block
+      // below.
       if (apzc == nullptr) {
-        for (size_t i = 0; i < aApzcsToDestroy->Length(); i++) {
-          if (aApzcsToDestroy->ElementAt(i)->Matches(guid)) {
-            apzc = aApzcsToDestroy->ElementAt(i);
-            break;
+        apzc = aLayer->GetAsyncPanZoomController();
+
+        // If the content represented by the scrollable layer has changed (which may
+        // be possible because of DLBI heuristics) then we don't want to keep using
+        // the same old APZC for the new content. Null it out so we run through the
+        // code to find another one or create one.
+        if (apzc && !apzc->Matches(guid)) {
+          apzc = nullptr;
+        }
+
+        // If the layer doesn't have an APZC already, try to find one of our
+        // pre-existing ones that matches. In particular, if we find an APZC whose
+        // ScrollableLayerGuid is the same, then we know what happened is that the
+        // layout of the page changed causing the layer tree to be rebuilt, but the
+        // underlying content for which the APZC was originally created is still
+        // there. So it makes sense to pick up that APZC instance again and use it here.
+        if (apzc == nullptr) {
+          for (size_t i = 0; i < aApzcsToDestroy->Length(); i++) {
+            if (aApzcsToDestroy->ElementAt(i)->Matches(guid)) {
+              apzc = aApzcsToDestroy->ElementAt(i);
+              break;
+            }
           }
         }
-      }
 
-      // The APZC we get off the layer may have been destroyed previously if the layer was inactive
-      // or omitted from the layer tree for whatever reason from a layers update. If it later comes
-      // back it will have a reference to a destroyed APZC and so we need to throw that out and make
-      // a new one.
-      bool newApzc = (apzc == nullptr || apzc->IsDestroyed());
-      if (newApzc) {
-        apzc = new AsyncPanZoomController(aLayersId, this, state->mController,
-                                          AsyncPanZoomController::USE_GESTURE_DETECTOR);
-        apzc->SetCompositorParent(aCompositor);
-        if (state->mCrossProcessParent != nullptr) {
-          apzc->ShareFrameMetricsAcrossProcesses();
-        }
-      } else {
-        // If there was already an APZC for the layer clear the tree pointers
-        // so that it doesn't continue pointing to APZCs that should no longer
-        // be in the tree. These pointers will get reset properly as we continue
-        // building the tree. Also remove it from the set of APZCs that are going
-        // to be destroyed, because it's going to remain active.
-        aApzcsToDestroy->RemoveElement(apzc);
-        apzc->SetPrevSibling(nullptr);
-        apzc->SetLastChild(nullptr);
-      }
-      APZCTM_LOG("Using APZC %p for layer %p with identifiers %lld %lld\n", apzc, aLayer, aLayersId, metrics.GetScrollId());
-
-      apzc->NotifyLayersUpdated(metrics,
-                                aIsFirstPaint && (aLayersId == aOriginatingLayersId));
-      apzc->SetScrollHandoffParentId(aLayer->GetScrollHandoffParentId());
-
-      // Use the composition bounds as the hit test region.
-      // Optionally, the GeckoContentController can provide a touch-sensitive
-      // region that constrains all frames associated with the controller.
-      // In this case we intersect the composition bounds with that region.
-      ParentLayerRect visible(metrics.mCompositionBounds);
-      CSSRect touchSensitiveRegion;
-      if (state->mController->GetTouchSensitiveRegion(&touchSensitiveRegion)) {
-        // Note: we assume here that touchSensitiveRegion is in the CSS pixels
-        // of our parent layer, which makes this coordinate conversion
-        // correct.
-        visible = visible.Intersect(touchSensitiveRegion
-                                    * metrics.mDevPixelsPerCSSPixel
-                                    * metrics.GetParentResolution());
-      }
-
-      // Not sure what rounding option is the most correct here, but if we ever
-      // figure it out we can change this. For now I'm rounding in to minimize
-      // the chances of getting a complex region.
-      ParentLayerIntRect roundedVisible = RoundedIn(visible);
-      nsIntRegion unobscured;
-      unobscured.Sub(nsIntRect(roundedVisible.x, roundedVisible.y,
-                               roundedVisible.width, roundedVisible.height),
-                     aObscured);
-
-      apzc->SetLayerHitTestData(unobscured, aTransform, transform);
-      APZCTM_LOG("Setting rect(%f %f %f %f) as visible region for APZC %p\n", visible.x, visible.y,
-                                                                            visible.width, visible.height,
-                                                                            apzc);
-
-      mApzcTreeLog << "APZC " << guid
-                   << "\tcb=" << visible
-                   << "\tsr=" << metrics.mScrollableRect
-                   << (aLayer->GetVisibleRegion().IsEmpty() ? "\tscrollinfo" : "")
-                   << (apzc->HasScrollgrab() ? "\tscrollgrab" : "")
-                   << "\t" << aLayer->GetContentDescription();
-
-      // Bind the APZC instance into the tree of APZCs
-      if (aNextSibling) {
-        aNextSibling->SetPrevSibling(apzc);
-      } else if (aParent) {
-        aParent->SetLastChild(apzc);
-      } else {
-        mRootApzc = apzc;
-        apzc->MakeRoot();
-      }
-
-      // For testing, log the parent scroll id of every APZC that has a
-      // parent. This allows test code to reconstruct the APZC tree.
-      // Note that we currently only do this for APZCs in the layer tree
-      // that originated the update, because the only identifying information
-      // we are logging about APZCs is the scroll id, and otherwise we could
-      // confuse APZCs from different layer trees with the same scroll id.
-      if (aLayersId == aOriginatingLayersId && apzc->GetParent()) {
-        aPaintLogger.LogTestData(metrics.GetScrollId(), "parentScrollId",
-            apzc->GetParent()->GetGuid().mScrollId);
-      }
-
-      // Let this apzc be the parent of other controllers when we recurse downwards
-      aParent = apzc;
-
-      if (newApzc) {
-        if (apzc->IsRootForLayersId()) {
-          // If we just created a new apzc that is the root for its layers ID, then
-          // we need to update its zoom constraints which might have arrived before this
-          // was created
-          ZoomConstraints constraints;
-          if (state->mController->GetRootZoomConstraints(&constraints)) {
-            apzc->UpdateZoomConstraints(constraints);
+        // The APZC we get off the layer may have been destroyed previously if the layer was inactive
+        // or omitted from the layer tree for whatever reason from a layers update. If it later comes
+        // back it will have a reference to a destroyed APZC and so we need to throw that out and make
+        // a new one.
+        bool newApzc = (apzc == nullptr || apzc->IsDestroyed());
+        if (newApzc) {
+          apzc = new AsyncPanZoomController(aLayersId, this, state->mController,
+                                            AsyncPanZoomController::USE_GESTURE_DETECTOR);
+          apzc->SetCompositorParent(aCompositor);
+          if (state->mCrossProcessParent != nullptr) {
+            apzc->ShareFrameMetricsAcrossProcesses();
           }
         } else {
-          // For an apzc that is not the root for its layers ID, we give it the
-          // same zoom constraints as its parent. This ensures that if e.g.
-          // user-scalable=no was specified, none of the APZCs allow double-tap
-          // to zoom.
-          apzc->UpdateZoomConstraints(apzc->GetParent()->GetZoomConstraints());
+          // If there was already an APZC for the layer clear the tree pointers
+          // so that it doesn't continue pointing to APZCs that should no longer
+          // be in the tree. These pointers will get reset properly as we continue
+          // building the tree. Also remove it from the set of APZCs that are going
+          // to be destroyed, because it's going to remain active.
+          aApzcsToDestroy->RemoveElement(apzc);
+          apzc->SetPrevSibling(nullptr);
+          apzc->SetLastChild(nullptr);
         }
+        APZCTM_LOG("Using APZC %p for layer %p with identifiers %lld %lld\n", apzc, aLayer, aLayersId, metrics.GetScrollId());
+
+        apzc->NotifyLayersUpdated(metrics,
+                                  aIsFirstPaint && (aLayersId == aOriginatingLayersId));
+        apzc->SetScrollHandoffParentId(aLayer->GetScrollHandoffParentId());
+
+        nsIntRegion unobscured = ComputeTouchSensitiveRegion(state->mController, metrics, aObscured);
+        apzc->SetLayerHitTestData(unobscured, aAncestorTransform);
+        APZCTM_LOG("Setting region %s as visible region for APZC %p\n",
+            Stringify(unobscured).c_str(), apzc);
+
+        mApzcTreeLog << "APZC " << guid
+                     << "\tcb=" << metrics.mCompositionBounds
+                     << "\tsr=" << metrics.mScrollableRect
+                     << (aLayer->GetVisibleRegion().IsEmpty() ? "\tscrollinfo" : "")
+                     << (apzc->HasScrollgrab() ? "\tscrollgrab" : "")
+                     << "\t" << aLayer->GetContentDescription();
+
+        // Bind the APZC instance into the tree of APZCs
+        if (aNextSibling) {
+          aNextSibling->SetPrevSibling(apzc);
+        } else if (aParent) {
+          aParent->SetLastChild(apzc);
+        } else {
+          mRootApzc = apzc;
+          apzc->MakeRoot();
+        }
+
+        // For testing, log the parent scroll id of every APZC that has a
+        // parent. This allows test code to reconstruct the APZC tree.
+        // Note that we currently only do this for APZCs in the layer tree
+        // that originated the update, because the only identifying information
+        // we are logging about APZCs is the scroll id, and otherwise we could
+        // confuse APZCs from different layer trees with the same scroll id.
+        if (aLayersId == aOriginatingLayersId && apzc->GetParent()) {
+          aPaintLogger.LogTestData(metrics.GetScrollId(), "parentScrollId",
+              apzc->GetParent()->GetGuid().mScrollId);
+        }
+
+        // Let this apzc be the parent of other controllers when we recurse downwards
+        aParent = apzc;
+
+        if (newApzc) {
+          if (apzc->IsRootForLayersId()) {
+            // If we just created a new apzc that is the root for its layers ID, then
+            // we need to update its zoom constraints which might have arrived before this
+            // was created
+            ZoomConstraints constraints;
+            if (state->mController->GetRootZoomConstraints(&constraints)) {
+              apzc->UpdateZoomConstraints(constraints);
+            }
+          } else {
+            // For an apzc that is not the root for its layers ID, we give it the
+            // same zoom constraints as its parent. This ensures that if e.g.
+            // user-scalable=no was specified, none of the APZCs allow double-tap
+            // to zoom.
+            apzc->UpdateZoomConstraints(apzc->GetParent()->GetZoomConstraints());
+          }
+        }
+
+        insertResult.first->second = apzc;
+      } else {
+        // We already built an APZC earlier in this tree walk, but we have another layer
+        // now that will also be using that APZC. The hit-test region on the APZC needs
+        // to be updated to deal with the new layer's hit region.
+        // FIXME: Combining this hit test region to the existing hit test region has a bit
+        // of a problem, because it assumes the z-index of this new region is the same as
+        // the z-index of the old region (from the previous layer with the same scrollid)
+        // when in fact that may not be the case.
+        // Consider the case where we have three layers: A, B, and C. A is at the top in
+        // z-order and C is at the bottom. A and C share a scrollid and scroll together; but
+        // B has a different scrollid and scrolls independently. Depending on how B moves
+        // and the async transform on it, a larger/smaller area of C may be unobscured.
+        // However, when we combine the hit regions of A and C here we are ignoring the async
+        // async transform and so we basically assume the same amount of C is always visible
+        // on top of B. Fixing this doesn't appear to be very easy so I'm leaving it for
+        // now in the hopes that we won't run into this problem a lot.
+        nsIntRegion unobscured = ComputeTouchSensitiveRegion(state->mController, metrics, aObscured);
+        apzc->AddHitTestRegion(unobscured);
+        APZCTM_LOG("Adding region %s to visible region of APZC %p\n", Stringify(unobscured).c_str(), apzc);
       }
     }
   }
@@ -317,13 +362,17 @@ APZCTreeManager::UpdatePanZoomControllerTree(CompositorParent* aCompositor,
 
   mApzcTreeLog << '\n';
 
-  // Accumulate the CSS transform between layers that have an APZC, but exclude any
-  // any layers that do have an APZC, and reset the accumulation at those layers.
-  if (apzc) {
-    aTransform = Matrix4x4();
-  } else {
-    // Multiply child layer transforms on the left so they get applied first
-    aTransform = transform * aTransform;
+  // Accumulate the CSS transform between layers that have an APZC.
+  // In the terminology of the big comment above APZCTreeManager::GetInputTransforms, if
+  // we are at layer M, then aAncestorTransform is NC * OC * PC, and we left-multiply MC and
+  // compute ancestorTransform to be MC * NC * OC * PC. This gets passed down as the ancestor
+  // transform to layer L when we recurse into the children below. If we are at a layer
+  // with an APZC, such as P, then we reset the ancestorTransform to just PC, to start
+  // the new accumulation as we go down.
+  Matrix4x4 transform = aLayer->GetTransform();
+  Matrix4x4 ancestorTransform = transform;
+  if (!apzc) {
+    ancestorTransform = ancestorTransform * aAncestorTransform;
   }
 
   uint64_t childLayersId = (aLayer->AsRefLayer() ? aLayer->AsRefLayer()->GetReferentId() : aLayersId);
@@ -350,9 +399,9 @@ APZCTreeManager::UpdatePanZoomControllerTree(CompositorParent* aCompositor,
   AsyncPanZoomController* next = apzc ? nullptr : aNextSibling;
   for (Layer* child = aLayer->GetLastChild(); child; child = child->GetPrevSibling()) {
     gfx::TreeAutoIndent indent(mApzcTreeLog);
-    next = UpdatePanZoomControllerTree(aCompositor, child, childLayersId, aTransform, aParent, next,
+    next = UpdatePanZoomControllerTree(aCompositor, child, childLayersId, ancestorTransform, aParent, next,
                                        aIsFirstPaint, aOriginatingLayersId,
-                                       aPaintLogger, aApzcsToDestroy, obscured);
+                                       aPaintLogger, aApzcsToDestroy, aApzcMap, obscured);
 
     // Each layer obscures its previous siblings, so we augment the obscured
     // region as we loop backwards through the children.
@@ -382,16 +431,14 @@ APZCTreeManager::UpdatePanZoomControllerTree(CompositorParent* aCompositor,
 ApplyTransform(gfx::PointTyped<T>* aPoint, const Matrix4x4& aMatrix)
 {
   Point result = aMatrix * aPoint->ToUnknownPoint();
-  aPoint->x = result.x;
-  aPoint->y = result.y;
+  *aPoint = ViewAs<T>(result);
 }
 
 /*static*/ template<class T> void
 ApplyTransform(gfx::IntPointTyped<T>* aPoint, const Matrix4x4& aMatrix)
 {
   Point result = aMatrix * aPoint->ToUnknownPoint();
-  aPoint->x = result.x;
-  aPoint->y = result.y;
+  *aPoint = TruncatedToInt(ViewAs<T>(result));
 }
 
 /*static*/ void
@@ -635,9 +682,7 @@ APZCTreeManager::TransformCoordinateToGecko(const ScreenIntPoint& aPoint,
     Matrix4x4 transformToGecko;
     GetInputTransforms(apzc, transformToApzc, transformToGecko);
     Matrix4x4 outTransform = transformToApzc * transformToGecko;
-    aOutTransformedPoint->x = aPoint.x;
-    aOutTransformedPoint->y = aPoint.y;
-    ApplyTransform(aOutTransformedPoint, outTransform);
+    *aOutTransformedPoint = TransformTo<LayoutDevicePixel>(outTransform, aPoint);
   }
 }
 
@@ -1054,10 +1099,10 @@ APZCTreeManager::GetAPZCAtPoint(AsyncPanZoomController* aApzc,
   // comments explain what values are stored in the variables at these two levels. All the comments
   // use standard matrix notation where the leftmost matrix in a multiplication is applied first.
 
-  // ancestorUntransform takes points from aApzc's parent APZC's layer coordinates
+  // ancestorUntransform takes points from aApzc's parent APZC's CSS-transformed layer coordinates
   // to aApzc's parent layer's layer coordinates.
-  // It is OC.Inverse() * NC.Inverse() * MC.Inverse() at recursion level for L,
-  //   and RC.Inverse() * QC.Inverse()                at recursion level for P.
+  // It is PC.Inverse() * OC.Inverse() * NC.Inverse() * MC.Inverse() at recursion level for L,
+  //   and RC.Inverse() * QC.Inverse()                               at recursion level for P.
   Matrix4x4 ancestorUntransform = aApzc->GetAncestorTransform();
   ancestorUntransform.Invert();
 
@@ -1069,15 +1114,13 @@ APZCTreeManager::GetAPZCAtPoint(AsyncPanZoomController* aApzc,
            aHitTestPoint.x, aHitTestPoint.y,
            hitTestPointForThisLayer.x, hitTestPointForThisLayer.y, aApzc);
 
-  // childUntransform takes points from aApzc's parent APZC's layer coordinates
-  // to aApzc's layer coordinates (which are aApzc's children's ParentLayer coordinates).
-  // It is OC.Inverse() * NC.Inverse() * MC.Inverse() * LC.Inverse() * LA.Inverse() at L
-  //   and RC.Inverse() * QC.Inverse() * PC.Inverse() * PA.Inverse()                at P.
-  Matrix4x4 cssUntransform = aApzc->GetCSSTransform();
-  cssUntransform.Invert();
+  // childUntransform takes points from aApzc's parent APZC's CSS-transformed layer coordinates
+  // to aApzc's CSS-transformed layer coordinates.
+  // It is PC.Inverse() * OC.Inverse() * NC.Inverse() * MC.Inverse() * LA.Inverse() at L
+  //   and RC.Inverse() * QC.Inverse() * PA.Inverse()                               at P.
   Matrix4x4 asyncUntransform = aApzc->GetCurrentAsyncTransform();
   asyncUntransform.Invert();
-  Matrix4x4 childUntransform = ancestorUntransform * cssUntransform * asyncUntransform;
+  Matrix4x4 childUntransform = ancestorUntransform * asyncUntransform;
   gfxPointH3D hitTestPointForChildLayers = To3DMatrix(childUntransform).ProjectPoint(aHitTestPoint);
   APZCTM_LOG("Untransformed %f %f to layer coordinates %f %f for APZC %p\n",
            aHitTestPoint.x, aHitTestPoint.y,
@@ -1125,34 +1168,32 @@ APZCTreeManager::GetAPZCAtPoint(AsyncPanZoomController* aApzc,
    When layer L is displayed to the screen by the compositor, the set of transforms that
    are applied to L are (in order from top to bottom):
 
-        L's transient async transform       (hereafter referred to as transform matrix LT)
-        L's nontransient async transform    (hereafter referred to as transform matrix LN)
         L's CSS transform                   (hereafter referred to as transform matrix LC)
-        M's transient async transform       (hereafter referred to as transform matrix MT)
-        M's nontransient async transform    (hereafter referred to as transform matrix MN)
+        L's nontransient async transform    (hereafter referred to as transform matrix LN)
+        L's transient async transform       (hereafter referred to as transform matrix LT)
         M's CSS transform                   (hereafter referred to as transform matrix MC)
+        M's nontransient async transform    (hereafter referred to as transform matrix MN)
+        M's transient async transform       (hereafter referred to as transform matrix MT)
         ...
-        R's transient async transform       (hereafter referred to as transform matrix RT)
-        R's nontransient async transform    (hereafter referred to as transform matrix RN)
         R's CSS transform                   (hereafter referred to as transform matrix RC)
+        R's nontransient async transform    (hereafter referred to as transform matrix RN)
+        R's transient async transform       (hereafter referred to as transform matrix RT)
 
    Also, for any layer, the async transform is the combination of its transient and non-transient
    parts. That is, for any layer L:
-                  LA === LT * LN
-        LA.Inverse() === LN.Inverse() * LT.Inverse()
+                  LA === LN * LT
+        LA.Inverse() === LT.Inverse() * LN.Inverse()
 
    If we want user input to modify L's transient async transform, we have to first convert
    user input from screen space to the coordinate space of L's transient async transform. Doing
    this involves applying the following transforms (in order from top to bottom):
-        RC.Inverse()
-        RN.Inverse()
         RT.Inverse()
+        RN.Inverse()
+        RC.Inverse()
         ...
-        MC.Inverse()
-        MN.Inverse()
         MT.Inverse()
-        LC.Inverse()
-        LN.Inverse()
+        MN.Inverse()
+        MC.Inverse()
    This combined transformation is returned in the aTransformToApzcOut out-parameter.
 
    Next, if we want user inputs sent to gecko for event-dispatching, we will need to strip
@@ -1167,35 +1208,34 @@ APZCTreeManager::GetAPZCAtPoint(AsyncPanZoomController* aApzc,
    transform be represented by LD, MD, ... RD.
    Therefore, given a user input in screen space, the following transforms need to be applied
    (in order from top to bottom):
-        RC.Inverse()
-        RN.Inverse()
         RT.Inverse()
+        RN.Inverse()
+        RC.Inverse()
         ...
-        MC.Inverse()
-        MN.Inverse()
         MT.Inverse()
-        LC.Inverse()
-        LN.Inverse()
+        MN.Inverse()
+        MC.Inverse()
         LT.Inverse()
-        LD
+        LN.Inverse()
+        LC.Inverse()
         LC
-        MD
+        LD
         MC
+        MD
         ...
-        RD
         RC
+        RD
    This sequence can be simplified and refactored to the following:
         aTransformToApzcOut
-        LT.Inverse()
+        LA.Inverse()
         LD
-        LC
-        MD
         MC
+        MD
         ...
-        RD
         RC
+        RD
    Since aTransformToApzcOut is already one of the out-parameters, we set aTransformToGeckoOut
-   to the remaining transforms (LT.Inverse() * LD * ... * RC), so that the caller code can
+   to the remaining transforms (LA.Inverse() * LD * ... * RD), so that the caller code can
    combine it with aTransformToApzcOut to get the final transform required in this case.
 
    Note that for many of these layers, there will be no AsyncPanZoomController attached, and
@@ -1222,25 +1262,17 @@ APZCTreeManager::GetInputTransforms(AsyncPanZoomController *aApzc, Matrix4x4& aT
   // in the variables at these two levels. All the comments use standard matrix notation where the
   // leftmost matrix in a multiplication is applied first.
 
-  // ancestorUntransform is OC.Inverse() * NC.Inverse() * MC.Inverse()
+  // ancestorUntransform is PC.Inverse() * OC.Inverse() * NC.Inverse() * MC.Inverse()
   Matrix4x4 ancestorUntransform = aApzc->GetAncestorTransform();
   ancestorUntransform.Invert();
   // asyncUntransform is LA.Inverse()
   Matrix4x4 asyncUntransform = aApzc->GetCurrentAsyncTransform();
   asyncUntransform.Invert();
-  // nontransientAsyncTransform is LN
-  Matrix4x4 nontransientAsyncTransform = aApzc->GetNontransientAsyncTransform();
-  // transientAsyncUntransform is LT.Inverse()
-  Matrix4x4 transientAsyncUntransform = nontransientAsyncTransform * asyncUntransform;
 
-  // aTransformToApzcOut is initialized to OC.Inverse() * NC.Inverse() * MC.Inverse() * LC.Inverse() * LN.Inverse()
-  Matrix4x4 cssUntransform = aApzc->GetCSSTransform();
-  cssUntransform.Invert();
-  Matrix4x4 nontransientAsyncUntransform = nontransientAsyncTransform;
-  nontransientAsyncUntransform.Invert();
-  aTransformToApzcOut = ancestorUntransform * cssUntransform * nontransientAsyncUntransform;
-  // aTransformToGeckoOut is initialized to LT.Inverse() * LD * LC * MC * NC * OC
-  aTransformToGeckoOut = transientAsyncUntransform * aApzc->GetTransformToLastDispatchedPaint() * aApzc->GetCSSTransform() * aApzc->GetAncestorTransform();
+  // aTransformToApzcOut is initialized to PC.Inverse() * OC.Inverse() * NC.Inverse() * MC.Inverse()
+  aTransformToApzcOut = ancestorUntransform;
+  // aTransformToGeckoOut is initialized to LA.Inverse() * LD * MC * NC * OC * PC
+  aTransformToGeckoOut = asyncUntransform * aApzc->GetTransformToLastDispatchedPaint() * aApzc->GetAncestorTransform();
 
   for (AsyncPanZoomController* parent = aApzc->GetParent(); parent; parent = parent->GetParent()) {
     // ancestorUntransform is updated to RC.Inverse() * QC.Inverse() when parent == P
@@ -1249,15 +1281,13 @@ APZCTreeManager::GetInputTransforms(AsyncPanZoomController *aApzc, Matrix4x4& aT
     // asyncUntransform is updated to PA.Inverse() when parent == P
     asyncUntransform = parent->GetCurrentAsyncTransform();
     asyncUntransform.Invert();
-    // untransformSinceLastApzc is RC.Inverse() * QC.Inverse() * PC.Inverse() * PA.Inverse()
-    cssUntransform = parent->GetCSSTransform();
-    cssUntransform.Invert();
-    Matrix4x4 untransformSinceLastApzc = ancestorUntransform * cssUntransform * asyncUntransform;
+    // untransformSinceLastApzc is RC.Inverse() * QC.Inverse() * PA.Inverse()
+    Matrix4x4 untransformSinceLastApzc = ancestorUntransform * asyncUntransform;
 
-    // aTransformToApzcOut is RC.Inverse() * QC.Inverse() * PC.Inverse() * PA.Inverse() * OC.Inverse() * NC.Inverse() * MC.Inverse() * LC.Inverse() * LN.Inverse()
+    // aTransformToApzcOut is RC.Inverse() * QC.Inverse() * PA.Inverse() * PC.Inverse() * OC.Inverse() * NC.Inverse() * MC.Inverse()
     aTransformToApzcOut = untransformSinceLastApzc * aTransformToApzcOut;
-    // aTransformToGeckoOut is LT.Inverse() * LD * LC * MC * NC * OC * PD * PC * QC * RC
-    aTransformToGeckoOut = aTransformToGeckoOut * parent->GetTransformToLastDispatchedPaint() * parent->GetCSSTransform() * parent->GetAncestorTransform();
+    // aTransformToGeckoOut is LA.Inverse() * LD * MC * NC * OC * PC * PD * QC * RC
+    aTransformToGeckoOut = aTransformToGeckoOut * parent->GetTransformToLastDispatchedPaint() * parent->GetAncestorTransform();
 
     // The above values for aTransformToApzcOut and aTransformToGeckoOut when parent == P match
     // the required output as explained in the comment above this method. Note that any missing
diff --git a/gfx/layers/apz/src/APZCTreeManager.h b/gfx/layers/apz/src/APZCTreeManager.h
index d2afd24dfb47..c29b309d92a0 100644
--- a/gfx/layers/apz/src/APZCTreeManager.h
+++ b/gfx/layers/apz/src/APZCTreeManager.h
@@ -7,6 +7,7 @@
 #define mozilla_layers_APZCTreeManager_h
 
 #include <stdint.h>                     // for uint64_t, uint32_t
+#include <map>                          // for std::map
 #include "FrameMetrics.h"               // for FrameMetrics, etc
 #include "Units.h"                      // for CSSPoint, CSSRect, etc
 #include "gfxPoint.h"                   // for gfxPoint
@@ -277,8 +278,6 @@ public:
    *   handoff chain that should be scrolled.
    *
    * Returns true iff. some APZC accepted the scroll and scrolled.
-   * This is to allow the sending APZC to go into an overscrolled state if
-   * no APZC further up in the handoff chain accepted the overscroll.
    *
    * The way this method works is best illustrated with an example.
    * Consider three nested APZCs, A, B, and C, with C being the innermost one.
@@ -371,13 +370,14 @@ private:
    */
   AsyncPanZoomController* UpdatePanZoomControllerTree(CompositorParent* aCompositor,
                                                       Layer* aLayer, uint64_t aLayersId,
-                                                      gfx::Matrix4x4 aTransform,
+                                                      const gfx::Matrix4x4& aAncestorTransform,
                                                       AsyncPanZoomController* aParent,
                                                       AsyncPanZoomController* aNextSibling,
                                                       bool aIsFirstPaint,
                                                       uint64_t aOriginatingLayersId,
                                                       const APZPaintLogHelper& aPaintLogger,
                                                       nsTArray< nsRefPtr<AsyncPanZoomController> >* aApzcsToDestroy,
+                                                      std::map<ScrollableLayerGuid, AsyncPanZoomController*>& aApzcMap,
                                                       const nsIntRegion& aObscured);
 
 private:
diff --git a/gfx/layers/apz/src/AsyncPanZoomController.cpp b/gfx/layers/apz/src/AsyncPanZoomController.cpp
index 829b78d48009..1af97417d311 100644
--- a/gfx/layers/apz/src/AsyncPanZoomController.cpp
+++ b/gfx/layers/apz/src/AsyncPanZoomController.cpp
@@ -379,8 +379,8 @@ static bool IsCloseToVertical(float aAngle, float aThreshold)
 template <typename Units>
 static bool IsZero(const gfx::PointTyped<Units>& aPoint)
 {
-  return FuzzyEqualsMultiplicative(aPoint.x, 0.0f)
-      && FuzzyEqualsMultiplicative(aPoint.y, 0.0f);
+  return FuzzyEqualsMultiplicative(aPoint.x.value, 0.0f)
+      && FuzzyEqualsMultiplicative(aPoint.y.value, 0.0f);
 }
 
 static inline void LogRendertraceRect(const ScrollableLayerGuid& aGuid, const char* aDesc, const char* aColor, const CSSRect& aRect)
@@ -538,9 +538,9 @@ public:
         // We may have reached the end of the scroll range along one axis but
         // not the other. In such a case we only want to hand off the relevant
         // component of the fling.
-        if (FuzzyEqualsAdditive(overscroll.x, 0.0f, COORDINATE_EPSILON)) {
+        if (FuzzyEqualsAdditive(overscroll.x.value, 0.0f, COORDINATE_EPSILON)) {
           velocity.x = 0;
-        } else if (FuzzyEqualsAdditive(overscroll.y, 0.0f, COORDINATE_EPSILON)) {
+        } else if (FuzzyEqualsAdditive(overscroll.y.value, 0.0f, COORDINATE_EPSILON)) {
           velocity.y = 0;
         }
 
@@ -610,7 +610,7 @@ public:
 
     // Sample the zoom at the current time point.  The sampled zoom
     // will affect the final computed resolution.
-    double sampledPosition = gComputedTimingFunction->GetValue(animPosition);
+    float sampledPosition = gComputedTimingFunction->GetValue(animPosition);
 
     // We scale the scrollOffset linearly with sampledPosition, so the zoom
     // needs to scale inversely to match.
@@ -646,7 +646,7 @@ private:
 
 class OverscrollSnapBackAnimation: public AsyncPanZoomAnimation {
 public:
-  OverscrollSnapBackAnimation(AsyncPanZoomController& aApzc)
+  explicit OverscrollSnapBackAnimation(AsyncPanZoomController& aApzc)
     : mApzc(aApzc)
   {
     // Make sure the initial velocity is zero. This is normally the case
@@ -1337,8 +1337,8 @@ AsyncPanZoomController::ConvertToGecko(const ScreenPoint& aPoint, CSSPoint* aOut
 nsEventStatus AsyncPanZoomController::OnPanMayBegin(const PanGestureInput& aEvent) {
   APZC_LOG("%p got a pan-maybegin in state %d\n", this, mState);
 
-  mX.StartTouch(aEvent.mPanStartPoint.x, aEvent.mTime);
-  mY.StartTouch(aEvent.mPanStartPoint.y, aEvent.mTime);
+  mX.StartTouch(aEvent.mPanStartPoint.x.Truncated(), aEvent.mTime);
+  mY.StartTouch(aEvent.mPanStartPoint.y.Truncated(), aEvent.mTime);
   if (mPanGestureState) {
     mPanGestureState->GetOverscrollHandoffChain()->CancelAnimations();
   } else {
@@ -1363,8 +1363,8 @@ nsEventStatus AsyncPanZoomController::OnPanBegin(const PanGestureInput& aEvent)
 
   mPanGestureState = MakeUnique<InputBlockState>(BuildOverscrollHandoffChain());
 
-  mX.StartTouch(aEvent.mPanStartPoint.x, aEvent.mTime);
-  mY.StartTouch(aEvent.mPanStartPoint.y, aEvent.mTime);
+  mX.StartTouch(aEvent.mPanStartPoint.x.Truncated(), aEvent.mTime);
+  mY.StartTouch(aEvent.mPanStartPoint.y.Truncated(), aEvent.mTime);
 
   if (GetAxisLockMode() == FREE) {
     SetState(PANNING);
@@ -1387,8 +1387,8 @@ nsEventStatus AsyncPanZoomController::OnPan(const PanGestureInput& aEvent, bool
   // size and position. We need to do so even if this is a momentum pan (i.e.
   // aFingersOnTouchpad == false); in that case the "with touch" part is not
   // really appropriate, so we may want to rethink this at some point.
-  mX.UpdateWithTouchAtDevicePoint(aEvent.mPanStartPoint.x, aEvent.mTime);
-  mY.UpdateWithTouchAtDevicePoint(aEvent.mPanStartPoint.y, aEvent.mTime);
+  mX.UpdateWithTouchAtDevicePoint(aEvent.mPanStartPoint.x.Truncated(), aEvent.mTime);
+  mY.UpdateWithTouchAtDevicePoint(aEvent.mPanStartPoint.y.Truncated(), aEvent.mTime);
 
   HandlePanningUpdate(aEvent.mPanDisplacement.x, aEvent.mPanDisplacement.y);
 
@@ -1718,21 +1718,12 @@ bool AsyncPanZoomController::AttemptScroll(const ScreenPoint& aStartPoint,
     return true;
   }
 
-  // If there is overscroll, first try to hand it off to an APZC later
-  // in the handoff chain to consume (either as a normal scroll or as
-  // overscroll).
+  // If there is overscroll, try to hand it off to an APZC later
+  // in the handoff chain to consume.
   // Note: "+ overscroll" rather than "- overscroll" because "overscroll"
   // is what's left of "displacement", and "displacement" is "start - end".
-  if (CallDispatchScroll(aEndPoint + overscroll, aEndPoint,
-                         aOverscrollHandoffChain, aOverscrollHandoffChainIndex + 1)) {
-    return true;
-  }
-
-  // If there is no APZC later in the handoff chain that accepted the
-  // overscroll, try to accept it ourselves. We only accept it if we
-  // are pannable.
-  APZC_LOG("%p taking overscroll during panning\n", this);
-  return OverscrollBy(cssOverscroll);
+  return CallDispatchScroll(aEndPoint + overscroll, aEndPoint, 
+                            aOverscrollHandoffChain, aOverscrollHandoffChainIndex + 1);
 }
 
 bool AsyncPanZoomController::OverscrollBy(const CSSPoint& aOverscroll) {
@@ -2122,8 +2113,18 @@ AsyncPanZoomController::FireAsyncScrollOnTimeout()
 bool AsyncPanZoomController::UpdateAnimation(const TimeStamp& aSampleTime,
                                              Vector<Task*>* aOutDeferredTasks)
 {
+  // This function may get called multiple with the same sample time, because
+  // there may be multiple layers with this APZC, and each layer invokes this
+  // function during composition. However we only want to do one animation step
+  // per composition so we need to deduplicate these calls first.
+  if (mLastSampleTime == aSampleTime) {
+    return false;
+  }
+  TimeDuration sampleTimeDelta = aSampleTime - mLastSampleTime;
+  mLastSampleTime = aSampleTime;
+
   if (mAnimation) {
-    bool continueAnimation = mAnimation->Sample(mFrameMetrics, aSampleTime - mLastSampleTime);
+    bool continueAnimation = mAnimation->Sample(mFrameMetrics, sampleTimeDelta);
     *aOutDeferredTasks = mAnimation->TakeDeferredTasks();
     if (continueAnimation) {
       if (mPaintThrottler.TimeSinceLastRequest(aSampleTime) >
@@ -2137,7 +2138,6 @@ bool AsyncPanZoomController::UpdateAnimation(const TimeStamp& aSampleTime,
       RequestContentRepaint();
     }
     UpdateSharedCompositorFrameMetrics();
-    mLastSampleTime = aSampleTime;
     return true;
   }
   return false;
@@ -2224,20 +2224,13 @@ void AsyncPanZoomController::GetOverscrollTransform(ViewTransform* aTransform) c
 
   float scale = 1 - (kZEffect * spaceProp);
 
-  // In a ViewTransform, the translation is applied before the scale. We want
-  // to apply our translation after our scale, so we compensate for that here.
-  translation.x /= scale;
-  translation.y /= scale;
-
   // Finally, apply the transformations.
   aTransform->mScale.scale *= scale;
-  aTransform->mTranslation += translation * mFrameMetrics.LayersPixelsPerCSSPixel();
+  aTransform->mTranslation += translation * mFrameMetrics.GetZoom();
 }
 
-bool AsyncPanZoomController::SampleContentTransformForFrame(const TimeStamp& aSampleTime,
-                                                            ViewTransform* aOutTransform,
-                                                            ScreenPoint& aScrollOffset,
-                                                            ViewTransform* aOutOverscrollTransform) {
+bool AsyncPanZoomController::AdvanceAnimations(const TimeStamp& aSampleTime)
+{
   // The eventual return value of this function. The compositor needs to know
   // whether or not to advance by a frame as soon as it can. For example, if a
   // fling is happening, it has to keep compositing so that the animation is
@@ -2251,25 +2244,6 @@ bool AsyncPanZoomController::SampleContentTransformForFrame(const TimeStamp& aSa
 
     requestAnimationFrame = UpdateAnimation(aSampleTime, &deferredTasks);
 
-    aScrollOffset = mFrameMetrics.GetScrollOffset() * mFrameMetrics.GetZoom();
-    *aOutTransform = GetCurrentAsyncTransform();
-
-    // If we are overscrolled, we would like the compositor to apply an
-    // additional transform that produces an overscroll effect.
-    if (aOutOverscrollTransform && IsOverscrolled()) {
-      GetOverscrollTransform(aOutOverscrollTransform);
-
-      // Since the caller will apply aOverscrollTransform after aNewTransform,
-      // aOverscrollTransform's translation will be not be scaled by
-      // aNewTransform's scale. Since the resulting transform is then
-      // multiplied by the CSS transform, which cancels out the non-transient
-      // part of aNewTransform->mScale, this results in an overscroll
-      // translation whose magnitude varies with the zoom. To avoid this,
-      // we adjust for that here.
-      aOutOverscrollTransform->mTranslation.x *= aOutTransform->mScale.scale;
-      aOutOverscrollTransform->mTranslation.y *= aOutTransform->mScale.scale;
-    }
-
     LogRendertraceRect(GetGuid(), "viewport", "red",
       CSSRect(mFrameMetrics.GetScrollOffset(),
               mFrameMetrics.CalculateCompositedSizeInCssPixels()));
@@ -2304,8 +2278,7 @@ bool AsyncPanZoomController::SampleContentTransformForFrame(const TimeStamp& aSa
     mLastAsyncScrollTime = aSampleTime;
     mLastAsyncScrollOffset = mCurrentAsyncScrollOffset;
     SendAsyncScrollEvent();
-  }
-  else {
+  } else {
     mAsyncScrollTimeoutTask =
       NewRunnableMethod(this, &AsyncPanZoomController::FireAsyncScrollOnTimeout);
     MessageLoop::current()->PostDelayedTask(FROM_HERE,
@@ -2316,6 +2289,22 @@ bool AsyncPanZoomController::SampleContentTransformForFrame(const TimeStamp& aSa
   return requestAnimationFrame;
 }
 
+void AsyncPanZoomController::SampleContentTransformForFrame(ViewTransform* aOutTransform,
+                                                            ScreenPoint& aScrollOffset,
+                                                            ViewTransform* aOutOverscrollTransform)
+{
+  ReentrantMonitorAutoEnter lock(mMonitor);
+
+  aScrollOffset = mFrameMetrics.GetScrollOffset() * mFrameMetrics.GetZoom();
+  *aOutTransform = GetCurrentAsyncTransform();
+
+  // If we are overscrolled, we would like the compositor to apply an
+  // additional transform that produces an overscroll effect.
+  if (aOutOverscrollTransform && IsOverscrolled()) {
+    GetOverscrollTransform(aOutOverscrollTransform);
+  }
+}
+
 ViewTransform AsyncPanZoomController::GetCurrentAsyncTransform() {
   ReentrantMonitorAutoEnter lock(mMonitor);
 
@@ -2345,13 +2334,13 @@ ViewTransform AsyncPanZoomController::GetCurrentAsyncTransform() {
     }
   }
 
-  LayerPoint translation = (currentScrollOffset - lastPaintScrollOffset)
-                         * mLastContentPaintMetrics.LayersPixelsPerCSSPixel();
+  ParentLayerToScreenScale scale = mFrameMetrics.GetZoom()
+        / mLastContentPaintMetrics.mDevPixelsPerCSSPixel
+        / mFrameMetrics.GetParentResolution();
+  ScreenPoint translation = (currentScrollOffset - lastPaintScrollOffset)
+                          * mFrameMetrics.GetZoom();
 
-  return ViewTransform(-translation,
-                       mFrameMetrics.GetZoom()
-                     / mLastContentPaintMetrics.mDevPixelsPerCSSPixel
-                     / mFrameMetrics.GetParentResolution());
+  return ViewTransform(scale, -translation);
 }
 
 Matrix4x4 AsyncPanZoomController::GetNontransientAsyncTransform() {
@@ -2915,16 +2904,16 @@ void AsyncPanZoomController::ShareCompositorFrameMetrics() {
 
 ParentLayerPoint AsyncPanZoomController::ToParentLayerCoords(const ScreenPoint& aPoint)
 {
-  return TransformTo<ParentLayerPixel>(To3DMatrix(GetNontransientAsyncTransform() * GetCSSTransform()), aPoint);
+  // The parent layer pixel space and the screen space for a given layer are the
+  // same as of bug 1052063. FIXME: Unify these two coordinate systems.
+  return ParentLayerPoint(aPoint.x, aPoint.y);
 }
 
 void AsyncPanZoomController::UpdateTransformScale()
 {
-  Matrix4x4 nontransientTransforms = GetNontransientAsyncTransform() * GetCSSTransform();
-  if (!FuzzyEqualsMultiplicative(nontransientTransforms._11, nontransientTransforms._22)) {
-    NS_WARNING("The x- and y-scales of the nontransient transforms should be equal");
-  }
-  mFrameMetrics.mTransformScale.scale = nontransientTransforms._11;
+  // The parent layer pixel space and the screen space for a given layer are the
+  // same as of bug 1052063. FIXME: Unify these two coordinate systems.
+  mFrameMetrics.mTransformScale.scale = 1;
 }
 
 }
diff --git a/gfx/layers/apz/src/AsyncPanZoomController.h b/gfx/layers/apz/src/AsyncPanZoomController.h
index abd9b65cf89b..3bc6eb857482 100644
--- a/gfx/layers/apz/src/AsyncPanZoomController.h
+++ b/gfx/layers/apz/src/AsyncPanZoomController.h
@@ -149,14 +149,21 @@ public:
   // These methods must only be called on the compositor thread.
   //
 
+  /**
+   * Advances any animations currently running to the given timestamp.
+   * This may be called multiple times with the same timestamp.
+   *
+   * The return value indicates whether or not any currently running animation
+   * should continue. If true, the compositor should schedule another composite.
+   */
+  bool AdvanceAnimations(const TimeStamp& aSampleTime);
+
   bool UpdateAnimation(const TimeStamp& aSampleTime,
                        Vector<Task*>* aOutDeferredTasks);
 
   /**
-   * RQuery the transforms that should be applied to the layer corresponding
+   * Query the transforms that should be applied to the layer corresponding
    * to this APZC due to asynchronous panning and zooming.
-   * |aSampleTime| is the time that this is sampled at; this is used for
-   * interpolating animations.
    * This function returns two transforms via out parameters:
    *   |aOutTransform| is the transform due to regular panning and zooming
    *   |aOverscrollTransform| is the transform due to overscrolling
@@ -165,14 +172,10 @@ public:
    * overscroll transform parameter may be nullptr). Clients who do not want
    * to ignore the overscroll transform should multiply the two transforms
    * together.
-   *
-   * The return value indicates whether or not any currently running animation
-   * should continue. If true, the compositor should schedule another composite.
    */
-  bool SampleContentTransformForFrame(const TimeStamp& aSampleTime,
-                                      ViewTransform* aOutTransform,
+  void SampleContentTransformForFrame(ViewTransform* aOutTransform,
                                       ScreenPoint& aScrollOffset,
-                                      ViewTransform* aOutOverscrollTransform = nullptr);
+                                      ViewTransform* aOutOverscrollTransform);
 
   /**
    * A shadow layer update has arrived. |aLayerMetrics| is the new FrameMetrics
@@ -911,9 +914,7 @@ public:
    * to; this function increments the chain and the index and passes it on to
    * APZCTreeManager::DispatchScroll() in the event of overscroll.
    * Returns true iff. this APZC, or an APZC further down the
-   * handoff chain, accepted the scroll (possibly entering an overscrolled
-   * state). If this return false, the caller APZC knows that it should enter
-   * an overscrolled state itself if it can.
+   * handoff chain, accepted the scroll.
    */
   bool AttemptScroll(const ScreenPoint& aStartPoint, const ScreenPoint& aEndPoint,
                      const OverscrollHandoffChain& aOverscrollHandoffChain,
@@ -975,22 +976,19 @@ private:
    * hit-testing to see which APZC instance should handle touch events.
    */
 public:
-  void SetLayerHitTestData(const nsIntRegion& aRegion, const Matrix4x4& aTransformToLayer,
-                           const Matrix4x4& aTransformForLayer) {
+  void SetLayerHitTestData(const nsIntRegion& aRegion, const Matrix4x4& aTransformToLayer) {
     mVisibleRegion = aRegion;
     mAncestorTransform = aTransformToLayer;
-    mCSSTransform = aTransformForLayer;
-    UpdateTransformScale();
+  }
+
+  void AddHitTestRegion(const nsIntRegion& aRegion) {
+    mVisibleRegion.OrWith(aRegion);
   }
 
   Matrix4x4 GetAncestorTransform() const {
     return mAncestorTransform;
   }
 
-  Matrix4x4 GetCSSTransform() const {
-    return mCSSTransform;
-  }
-
   bool VisibleRegionContains(const ParentLayerPoint& aPoint) const {
     ParentLayerIntPoint point = RoundedToInt(aPoint);
     return mVisibleRegion.Contains(point.x, point.y);
@@ -1001,15 +999,14 @@ public:
   }
 
 private:
-  /* This is the visible region of the layer that this APZC corresponds to, in
-   * that layer's screen pixels (the same coordinate system in which this APZC
-   * receives events in ReceiveInputEvent()). */
+  /* This is the union of the visible regions of the layers that this APZC
+   * corresponds to, in the screen pixels of those layers. (This is the same
+   * coordinate system in which this APZC receives events in
+   * ReceiveInputEvent()). */
   nsIntRegion mVisibleRegion;
-  /* This is the cumulative CSS transform for all the layers between the parent
-   * APZC and this one (not inclusive) */
+  /* This is the cumulative CSS transform for all the layers from (and including)
+   * the parent APZC down to (but excluding) this one. */
   Matrix4x4 mAncestorTransform;
-  /* This is the CSS transform for this APZC's layer. */
-  Matrix4x4 mCSSTransform;
 
 
   /* ===================================================================
@@ -1077,8 +1074,8 @@ class AsyncPanZoomAnimation {
   NS_INLINE_DECL_THREADSAFE_REFCOUNTING(AsyncPanZoomAnimation)
 
 public:
-  AsyncPanZoomAnimation(const TimeDuration& aRepaintInterval =
-                        TimeDuration::Forever())
+  explicit AsyncPanZoomAnimation(const TimeDuration& aRepaintInterval =
+                                 TimeDuration::Forever())
     : mRepaintInterval(aRepaintInterval)
   { }
 
diff --git a/gfx/layers/apz/src/Axis.cpp b/gfx/layers/apz/src/Axis.cpp
index 2173df7a6a15..ed1419fe82ff 100644
--- a/gfx/layers/apz/src/Axis.cpp
+++ b/gfx/layers/apz/src/Axis.cpp
@@ -33,7 +33,7 @@ Axis::Axis(AsyncPanZoomController* aAsyncPanZoomController)
 {
 }
 
-void Axis::UpdateWithTouchAtDevicePoint(int32_t aPos, uint32_t aTimestampMs) {
+void Axis::UpdateWithTouchAtDevicePoint(ScreenIntCoord aPos, uint32_t aTimestampMs) {
   // mVelocityQueue is controller-thread only
   AsyncPanZoomController::AssertOnControllerThread();
 
@@ -62,16 +62,16 @@ void Axis::UpdateWithTouchAtDevicePoint(int32_t aPos, uint32_t aTimestampMs) {
   }
 }
 
-void Axis::StartTouch(int32_t aPos, uint32_t aTimestampMs) {
+void Axis::StartTouch(ScreenIntCoord aPos, uint32_t aTimestampMs) {
   mStartPos = aPos;
   mPos = aPos;
   mPosTimeMs = aTimestampMs;
   mAxisLocked = false;
 }
 
-bool Axis::AdjustDisplacement(float aDisplacement,
-                              float& aDisplacementOut,
-                              float& aOverscrollAmountOut)
+bool Axis::AdjustDisplacement(CSSCoord aDisplacement,
+                              CSSCoord& aDisplacementOut,
+                              CSSCoord& aOverscrollAmountOut)
 {
   if (mAxisLocked) {
     aOverscrollAmountOut = 0;
@@ -79,14 +79,14 @@ bool Axis::AdjustDisplacement(float aDisplacement,
     return false;
   }
 
-  float displacement = aDisplacement;
+  CSSCoord displacement = aDisplacement;
 
   // First consume any overscroll in the opposite direction along this axis.
-  float consumedOverscroll = 0;
+  CSSCoord consumedOverscroll = 0;
   if (mOverscroll > 0 && aDisplacement < 0) {
     consumedOverscroll = std::min(mOverscroll, -aDisplacement);
   } else if (mOverscroll < 0 && aDisplacement > 0) {
-    consumedOverscroll = 0 - std::min(-mOverscroll, aDisplacement);
+    consumedOverscroll = 0.f - std::min(-mOverscroll, aDisplacement);
   }
   mOverscroll -= consumedOverscroll;
   displacement += consumedOverscroll;
@@ -104,7 +104,7 @@ bool Axis::AdjustDisplacement(float aDisplacement,
   return fabsf(consumedOverscroll) > EPSILON;
 }
 
-float Axis::ApplyResistance(float aRequestedOverscroll) const {
+CSSCoord Axis::ApplyResistance(CSSCoord aRequestedOverscroll) const {
   // 'resistanceFactor' is a value between 0 and 1, which:
   //   - tends to 1 as the existing overscroll tends to 0
   //   - tends to 0 as the existing overscroll tends to the composition length
@@ -112,23 +112,23 @@ float Axis::ApplyResistance(float aRequestedOverscroll) const {
   // factor; this should prevent overscrolling by more than the composition
   // length.
   float resistanceFactor = 1 - fabsf(mOverscroll) / GetCompositionLength();
-  return resistanceFactor < 0 ? 0 : aRequestedOverscroll * resistanceFactor;
+  return resistanceFactor < 0 ? CSSCoord(0) : aRequestedOverscroll * resistanceFactor;
 }
 
-void Axis::OverscrollBy(float aOverscroll) {
+void Axis::OverscrollBy(CSSCoord aOverscroll) {
   MOZ_ASSERT(CanScroll());
   aOverscroll = ApplyResistance(aOverscroll);
   if (aOverscroll > 0) {
-    MOZ_ASSERT(FuzzyEqualsAdditive(GetCompositionEnd(), GetPageEnd(), COORDINATE_EPSILON));
+    MOZ_ASSERT(FuzzyEqualsAdditive(GetCompositionEnd().value, GetPageEnd().value, COORDINATE_EPSILON));
     MOZ_ASSERT(mOverscroll >= 0);
   } else if (aOverscroll < 0) {
-    MOZ_ASSERT(FuzzyEqualsAdditive(GetOrigin(), GetPageStart(), COORDINATE_EPSILON));
+    MOZ_ASSERT(FuzzyEqualsAdditive(GetOrigin().value, GetPageStart().value, COORDINATE_EPSILON));
     MOZ_ASSERT(mOverscroll <= 0);
   }
   mOverscroll += aOverscroll;
 }
 
-float Axis::GetOverscroll() const {
+CSSCoord Axis::GetOverscroll() const {
   return mOverscroll;
 }
 
@@ -162,7 +162,7 @@ bool Axis::SampleSnapBack(const TimeDuration& aDelta) {
     }
     mOverscroll = std::max(mOverscroll + cssDisplacement, 0.0f);
     // Overscroll relieved, do not continue animation.
-    if (mOverscroll == 0) {
+    if (mOverscroll == 0.f) {
       mVelocity = 0;
       return false;
     }
@@ -174,7 +174,7 @@ bool Axis::SampleSnapBack(const TimeDuration& aDelta) {
     }
     mOverscroll = std::min(mOverscroll + cssDisplacement, 0.0f);
     // Overscroll relieved, do not continue animation.
-    if (mOverscroll == 0) {
+    if (mOverscroll == 0.f) {
       mVelocity = 0;
       return false;
     }
@@ -185,7 +185,7 @@ bool Axis::SampleSnapBack(const TimeDuration& aDelta) {
 }
 
 bool Axis::IsOverscrolled() const {
-  return mOverscroll != 0;
+  return mOverscroll != 0.f;
 }
 
 void Axis::ClearOverscroll() {
@@ -193,11 +193,11 @@ void Axis::ClearOverscroll() {
 }
 
 float Axis::PanDistance() {
-  return fabsf(mPos - mStartPos);
+  return fabsf((mPos - mStartPos).value);
 }
 
-float Axis::PanDistance(float aPos) {
-  return fabsf(aPos - mStartPos);
+float Axis::PanDistance(ScreenIntCoord aPos) {
+  return fabsf((aPos - mStartPos).value);
 }
 
 void Axis::EndTouch(uint32_t aTimestampMs) {
@@ -252,7 +252,7 @@ bool Axis::FlingApplyFrictionOrCancel(const TimeDuration& aDelta,
   return true;
 }
 
-Axis::Overscroll Axis::DisplacementWillOverscroll(float aDisplacement) {
+Axis::Overscroll Axis::DisplacementWillOverscroll(CSSCoord aDisplacement) {
   // If the current pan plus a displacement takes the window to the left of or
   // above the current page rect.
   bool minus = GetOrigin() + aDisplacement < GetPageStart();
@@ -271,7 +271,7 @@ Axis::Overscroll Axis::DisplacementWillOverscroll(float aDisplacement) {
   return OVERSCROLL_NONE;
 }
 
-float Axis::DisplacementWillOverscrollAmount(float aDisplacement) {
+CSSCoord Axis::DisplacementWillOverscrollAmount(CSSCoord aDisplacement) {
   switch (DisplacementWillOverscroll(aDisplacement)) {
   case OVERSCROLL_MINUS: return (GetOrigin() + aDisplacement) - GetPageStart();
   case OVERSCROLL_PLUS: return (GetCompositionEnd() + aDisplacement) - GetPageEnd();
@@ -281,8 +281,8 @@ float Axis::DisplacementWillOverscrollAmount(float aDisplacement) {
   }
 }
 
-float Axis::ScaleWillOverscrollAmount(float aScale, float aFocus) {
-  float originAfterScale = (GetOrigin() + aFocus) - (aFocus / aScale);
+CSSCoord Axis::ScaleWillOverscrollAmount(float aScale, CSSCoord aFocus) {
+  CSSCoord originAfterScale = (GetOrigin() + aFocus) - (aFocus / aScale);
 
   bool both = ScaleWillOverscrollBothSides(aScale);
   bool minus = GetPageStart() - originAfterScale > COORDINATE_EPSILON;
@@ -310,29 +310,29 @@ void Axis::SetVelocity(float aVelocity) {
   mVelocity = aVelocity;
 }
 
-float Axis::GetCompositionEnd() const {
+CSSCoord Axis::GetCompositionEnd() const {
   return GetOrigin() + GetCompositionLength();
 }
 
-float Axis::GetPageEnd() const {
+CSSCoord Axis::GetPageEnd() const {
   return GetPageStart() + GetPageLength();
 }
 
-float Axis::GetOrigin() const {
+CSSCoord Axis::GetOrigin() const {
   CSSPoint origin = GetFrameMetrics().GetScrollOffset();
   return GetPointOffset(origin);
 }
 
-float Axis::GetCompositionLength() const {
+CSSCoord Axis::GetCompositionLength() const {
   return GetRectLength(GetFrameMetrics().CalculateCompositedRectInCssPixels());
 }
 
-float Axis::GetPageStart() const {
+CSSCoord Axis::GetPageStart() const {
   CSSRect pageRect = GetFrameMetrics().GetExpandedScrollableRect();
   return GetRectOffset(pageRect);
 }
 
-float Axis::GetPageLength() const {
+CSSCoord Axis::GetPageLength() const {
   CSSRect pageRect = GetFrameMetrics().GetExpandedScrollableRect();
   return GetRectLength(pageRect);
 }
@@ -357,17 +357,17 @@ AxisX::AxisX(AsyncPanZoomController* aAsyncPanZoomController)
 
 }
 
-float AxisX::GetPointOffset(const CSSPoint& aPoint) const
+CSSCoord AxisX::GetPointOffset(const CSSPoint& aPoint) const
 {
   return aPoint.x;
 }
 
-float AxisX::GetRectLength(const CSSRect& aRect) const
+CSSCoord AxisX::GetRectLength(const CSSRect& aRect) const
 {
   return aRect.width;
 }
 
-float AxisX::GetRectOffset(const CSSRect& aRect) const
+CSSCoord AxisX::GetRectOffset(const CSSRect& aRect) const
 {
   return aRect.x;
 }
@@ -378,17 +378,17 @@ AxisY::AxisY(AsyncPanZoomController* aAsyncPanZoomController)
 
 }
 
-float AxisY::GetPointOffset(const CSSPoint& aPoint) const
+CSSCoord AxisY::GetPointOffset(const CSSPoint& aPoint) const
 {
   return aPoint.y;
 }
 
-float AxisY::GetRectLength(const CSSRect& aRect) const
+CSSCoord AxisY::GetRectLength(const CSSRect& aRect) const
 {
   return aRect.height;
 }
 
-float AxisY::GetRectOffset(const CSSRect& aRect) const
+CSSCoord AxisY::GetRectOffset(const CSSRect& aRect) const
 {
   return aRect.y;
 }
diff --git a/gfx/layers/apz/src/Axis.h b/gfx/layers/apz/src/Axis.h
index 759e230c5641..d365f754b3a2 100644
--- a/gfx/layers/apz/src/Axis.h
+++ b/gfx/layers/apz/src/Axis.h
@@ -35,7 +35,7 @@ class AsyncPanZoomController;
  */
 class Axis {
 public:
-  Axis(AsyncPanZoomController* aAsyncPanZoomController);
+  explicit Axis(AsyncPanZoomController* aAsyncPanZoomController);
 
   enum Overscroll {
     // Overscroll is not happening at all.
@@ -55,13 +55,13 @@ public:
    * Notify this Axis that a new touch has been received, including a timestamp
    * for when the touch was received. This triggers a recalculation of velocity.
    */
-  void UpdateWithTouchAtDevicePoint(int32_t aPos, uint32_t aTimestampMs);
+  void UpdateWithTouchAtDevicePoint(ScreenIntCoord aPos, uint32_t aTimestampMs);
 
   /**
    * Notify this Axis that a touch has begun, i.e. the user has put their finger
    * on the screen but has not yet tried to pan.
    */
-  void StartTouch(int32_t aPos, uint32_t aTimestampMs);
+  void StartTouch(ScreenIntCoord aPos, uint32_t aTimestampMs);
 
   /**
    * Notify this Axis that a touch has ended gracefully. This may perform
@@ -87,20 +87,20 @@ public:
    * displacement, and the function returns true iff internal overscroll amounts
    * were changed.
    */
-  bool AdjustDisplacement(float aDisplacement,
-                          float& aDisplacementOut,
-                          float& aOverscrollAmountOut);
+  bool AdjustDisplacement(CSSCoord aDisplacement,
+                          CSSCoord& aDisplacementOut,
+                          CSSCoord& aOverscrollAmountOut);
 
   /**
    * Overscrolls this axis by the requested amount in the requested direction.
    * The axis must be at the end of its scroll range in this direction.
    */
-  void OverscrollBy(float aOverscroll);
+  void OverscrollBy(CSSCoord aOverscroll);
 
   /**
    * Return the amount of overscroll on this axis, in CSS pixels.
    */
-  float GetOverscroll() const;
+  CSSCoord GetOverscroll() const;
 
   /**
    * Sample the snap-back animation to relieve overscroll.
@@ -129,7 +129,7 @@ public:
    * Gets the distance between the starting position of the touch supplied in
    * startTouch() and the supplied position.
    */
-  float PanDistance(float aPos);
+  float PanDistance(ScreenIntCoord aPos);
 
   /**
    * Applies friction during a fling, or cancels the fling if the velocity is
@@ -177,13 +177,13 @@ public:
    * That is to say, if the given displacement is applied, this will tell you
    * whether or not it will overscroll, and in what direction.
    */
-  Overscroll DisplacementWillOverscroll(float aDisplacement);
+  Overscroll DisplacementWillOverscroll(CSSCoord aDisplacement);
 
   /**
    * If a displacement will overscroll the axis, this returns the amount and in
    * what direction. Similar to GetExcess() but takes a displacement to apply.
    */
-  float DisplacementWillOverscrollAmount(float aDisplacement);
+  CSSCoord DisplacementWillOverscrollAmount(CSSCoord aDisplacement);
 
   /**
    * If a scale will overscroll the axis, this returns the amount and in what
@@ -193,7 +193,7 @@ public:
    * scroll offset in such a way that it remains in the same place on the page
    * relative.
    */
-  float ScaleWillOverscrollAmount(float aScale, float aFocus);
+  CSSCoord ScaleWillOverscrollAmount(float aScale, CSSCoord aFocus);
 
   /**
    * Checks if an axis will overscroll in both directions by computing the
@@ -204,23 +204,23 @@ public:
    */
   bool ScaleWillOverscrollBothSides(float aScale);
 
-  float GetOrigin() const;
-  float GetCompositionLength() const;
-  float GetPageStart() const;
-  float GetPageLength() const;
-  float GetCompositionEnd() const;
-  float GetPageEnd() const;
+  CSSCoord GetOrigin() const;
+  CSSCoord GetCompositionLength() const;
+  CSSCoord GetPageStart() const;
+  CSSCoord GetPageLength() const;
+  CSSCoord GetCompositionEnd() const;
+  CSSCoord GetPageEnd() const;
 
-  int32_t GetPos() const { return mPos; }
+  ScreenIntCoord GetPos() const { return mPos; }
 
-  virtual float GetPointOffset(const CSSPoint& aPoint) const = 0;
-  virtual float GetRectLength(const CSSRect& aRect) const = 0;
-  virtual float GetRectOffset(const CSSRect& aRect) const = 0;
+  virtual CSSCoord GetPointOffset(const CSSPoint& aPoint) const = 0;
+  virtual CSSCoord GetRectLength(const CSSRect& aRect) const = 0;
+  virtual CSSCoord GetRectOffset(const CSSRect& aRect) const = 0;
 
 protected:
-  int32_t mPos;
+  ScreenIntCoord mPos;
   uint32_t mPosTimeMs;
-  int32_t mStartPos;
+  ScreenIntCoord mStartPos;
   float mVelocity;
   bool mAxisLocked;     // Whether movement on this axis is locked.
   AsyncPanZoomController* mAsyncPanZoomController;
@@ -230,7 +230,7 @@ protected:
   // extreme allowed value in the relevant direction (that is, it must be at
   // its maximum value if mOverscroll is positive, and at its minimum value
   // if mOverscroll is negative).
-  float mOverscroll;
+  CSSCoord mOverscroll;
   // A queue of (timestamp, velocity) pairs; these are the historical
   // velocities at the given timestamps. Timestamps are in milliseconds,
   // velocities are in screen pixels per ms. This member can only be
@@ -241,23 +241,23 @@ protected:
 
   // Adjust a requested overscroll amount for resistance, yielding a smaller
   // actual overscroll amount.
-  float ApplyResistance(float aOverscroll) const;
+  CSSCoord ApplyResistance(CSSCoord aOverscroll) const;
 };
 
 class AxisX : public Axis {
 public:
-  AxisX(AsyncPanZoomController* mAsyncPanZoomController);
-  virtual float GetPointOffset(const CSSPoint& aPoint) const;
-  virtual float GetRectLength(const CSSRect& aRect) const;
-  virtual float GetRectOffset(const CSSRect& aRect) const;
+  explicit AxisX(AsyncPanZoomController* mAsyncPanZoomController);
+  virtual CSSCoord GetPointOffset(const CSSPoint& aPoint) const;
+  virtual CSSCoord GetRectLength(const CSSRect& aRect) const;
+  virtual CSSCoord GetRectOffset(const CSSRect& aRect) const;
 };
 
 class AxisY : public Axis {
 public:
-  AxisY(AsyncPanZoomController* mAsyncPanZoomController);
-  virtual float GetPointOffset(const CSSPoint& aPoint) const;
-  virtual float GetRectLength(const CSSRect& aRect) const;
-  virtual float GetRectOffset(const CSSRect& aRect) const;
+  explicit AxisY(AsyncPanZoomController* mAsyncPanZoomController);
+  virtual CSSCoord GetPointOffset(const CSSPoint& aPoint) const;
+  virtual CSSCoord GetRectLength(const CSSRect& aRect) const;
+  virtual CSSCoord GetRectOffset(const CSSRect& aRect) const;
 };
 
 }
diff --git a/gfx/layers/apz/src/GestureEventListener.h b/gfx/layers/apz/src/GestureEventListener.h
index 5a12417eca67..fc5e31049994 100644
--- a/gfx/layers/apz/src/GestureEventListener.h
+++ b/gfx/layers/apz/src/GestureEventListener.h
@@ -40,7 +40,7 @@ class GestureEventListener MOZ_FINAL {
 public:
   NS_INLINE_DECL_THREADSAFE_REFCOUNTING(GestureEventListener)
 
-  GestureEventListener(AsyncPanZoomController* aAsyncPanZoomController);
+  explicit GestureEventListener(AsyncPanZoomController* aAsyncPanZoomController);
 
   // --------------------------------------------------------------------------
   // These methods must only be called on the controller/UI thread.
diff --git a/gfx/layers/basic/BasicCanvasLayer.h b/gfx/layers/basic/BasicCanvasLayer.h
index d3fb3a7ce187..f76e593912bf 100644
--- a/gfx/layers/basic/BasicCanvasLayer.h
+++ b/gfx/layers/basic/BasicCanvasLayer.h
@@ -22,7 +22,7 @@ class BasicCanvasLayer : public CopyableCanvasLayer,
                          public BasicImplData
 {
 public:
-  BasicCanvasLayer(BasicLayerManager* aLayerManager) :
+  explicit BasicCanvasLayer(BasicLayerManager* aLayerManager) :
     CopyableCanvasLayer(aLayerManager,
                         static_cast<BasicImplData*>(MOZ_THIS_IN_INITIALIZER_LIST()))
   { }
diff --git a/gfx/layers/basic/BasicColorLayer.cpp b/gfx/layers/basic/BasicColorLayer.cpp
index d5633efd717d..bcca4656a712 100644
--- a/gfx/layers/basic/BasicColorLayer.cpp
+++ b/gfx/layers/basic/BasicColorLayer.cpp
@@ -26,7 +26,7 @@ namespace layers {
 
 class BasicColorLayer : public ColorLayer, public BasicImplData {
 public:
-  BasicColorLayer(BasicLayerManager* aLayerManager) :
+  explicit BasicColorLayer(BasicLayerManager* aLayerManager) :
     ColorLayer(aLayerManager,
                static_cast<BasicImplData*>(MOZ_THIS_IN_INITIALIZER_LIST()))
   {
diff --git a/gfx/layers/basic/BasicCompositor.h b/gfx/layers/basic/BasicCompositor.h
index 0c0c5ef25342..f09192ee0294 100644
--- a/gfx/layers/basic/BasicCompositor.h
+++ b/gfx/layers/basic/BasicCompositor.h
@@ -40,7 +40,7 @@ public:
 class BasicCompositor : public Compositor
 {
 public:
-  BasicCompositor(nsIWidget *aWidget);
+  explicit BasicCompositor(nsIWidget *aWidget);
 
 protected:
   virtual ~BasicCompositor();
diff --git a/gfx/layers/basic/BasicContainerLayer.h b/gfx/layers/basic/BasicContainerLayer.h
index f18d635dc363..7cc2f6dbcab8 100644
--- a/gfx/layers/basic/BasicContainerLayer.h
+++ b/gfx/layers/basic/BasicContainerLayer.h
@@ -19,7 +19,7 @@ namespace layers {
 
 class BasicContainerLayer : public ContainerLayer, public BasicImplData {
 public:
-  BasicContainerLayer(BasicLayerManager* aManager) :
+  explicit BasicContainerLayer(BasicLayerManager* aManager) :
     ContainerLayer(aManager,
                    static_cast<BasicImplData*>(MOZ_THIS_IN_INITIALIZER_LIST()))
   {
diff --git a/gfx/layers/basic/BasicImageLayer.cpp b/gfx/layers/basic/BasicImageLayer.cpp
index 32220b35a105..8f027f88fb8f 100644
--- a/gfx/layers/basic/BasicImageLayer.cpp
+++ b/gfx/layers/basic/BasicImageLayer.cpp
@@ -25,7 +25,7 @@ namespace layers {
 
 class BasicImageLayer : public ImageLayer, public BasicImplData {
 public:
-  BasicImageLayer(BasicLayerManager* aLayerManager) :
+  explicit BasicImageLayer(BasicLayerManager* aLayerManager) :
     ImageLayer(aLayerManager,
                static_cast<BasicImplData*>(MOZ_THIS_IN_INITIALIZER_LIST())),
     mSize(-1, -1)
diff --git a/gfx/layers/basic/BasicLayers.h b/gfx/layers/basic/BasicLayers.h
index d95f93fb6fd0..215c8279580d 100644
--- a/gfx/layers/basic/BasicLayers.h
+++ b/gfx/layers/basic/BasicLayers.h
@@ -56,7 +56,7 @@ public:
    * must be called for any rendering to happen. ThebesLayers will not
    * be retained.
    */
-  BasicLayerManager(BasicLayerManagerType aType);
+  explicit BasicLayerManager(BasicLayerManagerType aType);
   /**
    * Construct a BasicLayerManager which will have no default
    * target context. SetDefaultTarget or BeginTransactionWithTarget
@@ -72,7 +72,7 @@ public:
    * must ensure that the widget outlives the layer manager or call
    * ClearWidget before the widget dies.
    */
-  BasicLayerManager(nsIWidget* aWidget);
+  explicit BasicLayerManager(nsIWidget* aWidget);
 
 protected:
   virtual ~BasicLayerManager();
diff --git a/gfx/layers/basic/BasicLayersImpl.h b/gfx/layers/basic/BasicLayersImpl.h
index 2fba7224f738..7a5926b4475e 100644
--- a/gfx/layers/basic/BasicLayersImpl.h
+++ b/gfx/layers/basic/BasicLayersImpl.h
@@ -49,7 +49,7 @@ class BasicReadbackLayer : public ReadbackLayer,
                            public BasicImplData
 {
 public:
-  BasicReadbackLayer(BasicLayerManager* aLayerManager) :
+  explicit BasicReadbackLayer(BasicLayerManager* aLayerManager) :
     ReadbackLayer(aLayerManager,
                   static_cast<BasicImplData*>(MOZ_THIS_IN_INITIALIZER_LIST()))
   {
diff --git a/gfx/layers/basic/BasicThebesLayer.h b/gfx/layers/basic/BasicThebesLayer.h
index 0a2b0a0b85ec..ffbbe8259b27 100644
--- a/gfx/layers/basic/BasicThebesLayer.h
+++ b/gfx/layers/basic/BasicThebesLayer.h
@@ -30,7 +30,7 @@ public:
   typedef RotatedContentBuffer::PaintState PaintState;
   typedef RotatedContentBuffer::ContentType ContentType;
 
-  BasicThebesLayer(BasicLayerManager* aLayerManager) :
+  explicit BasicThebesLayer(BasicLayerManager* aLayerManager) :
     ThebesLayer(aLayerManager,
                 static_cast<BasicImplData*>(MOZ_THIS_IN_INITIALIZER_LIST())),
     mContentClient(nullptr)
diff --git a/gfx/layers/client/ClientCanvasLayer.h b/gfx/layers/client/ClientCanvasLayer.h
index 591319f4bce0..b9de0fce0da7 100644
--- a/gfx/layers/client/ClientCanvasLayer.h
+++ b/gfx/layers/client/ClientCanvasLayer.h
@@ -36,7 +36,7 @@ class ClientCanvasLayer : public CopyableCanvasLayer,
 {
   typedef CanvasClient::CanvasClientType CanvasClientType;
 public:
-  ClientCanvasLayer(ClientLayerManager* aLayerManager) :
+  explicit ClientCanvasLayer(ClientLayerManager* aLayerManager) :
     CopyableCanvasLayer(aLayerManager,
                         static_cast<ClientLayer*>(MOZ_THIS_IN_INITIALIZER_LIST()))
     , mTextureSurface(nullptr)
diff --git a/gfx/layers/client/ClientColorLayer.cpp b/gfx/layers/client/ClientColorLayer.cpp
index 1b49c07f2129..29038de37e7f 100644
--- a/gfx/layers/client/ClientColorLayer.cpp
+++ b/gfx/layers/client/ClientColorLayer.cpp
@@ -21,7 +21,7 @@ using namespace mozilla::gfx;
 class ClientColorLayer : public ColorLayer, 
                          public ClientLayer {
 public:
-  ClientColorLayer(ClientLayerManager* aLayerManager) :
+  explicit ClientColorLayer(ClientLayerManager* aLayerManager) :
     ColorLayer(aLayerManager,
                static_cast<ClientLayer*>(MOZ_THIS_IN_INITIALIZER_LIST()))
   {
diff --git a/gfx/layers/client/ClientContainerLayer.h b/gfx/layers/client/ClientContainerLayer.h
index 23329689c0a2..f82e65f166b6 100644
--- a/gfx/layers/client/ClientContainerLayer.h
+++ b/gfx/layers/client/ClientContainerLayer.h
@@ -27,7 +27,7 @@ class ClientContainerLayer : public ContainerLayer,
                              public ClientLayer
 {
 public:
-  ClientContainerLayer(ClientLayerManager* aManager) :
+  explicit ClientContainerLayer(ClientLayerManager* aManager) :
     ContainerLayer(aManager,
                    static_cast<ClientLayer*>(MOZ_THIS_IN_INITIALIZER_LIST()))
   {
@@ -150,7 +150,7 @@ protected:
 class ClientRefLayer : public RefLayer,
                        public ClientLayer {
 public:
-  ClientRefLayer(ClientLayerManager* aManager) :
+  explicit ClientRefLayer(ClientLayerManager* aManager) :
     RefLayer(aManager,
              static_cast<ClientLayer*>(MOZ_THIS_IN_INITIALIZER_LIST()))
   {
diff --git a/gfx/layers/client/ClientImageLayer.cpp b/gfx/layers/client/ClientImageLayer.cpp
index e016ba521134..2d348d7d3691 100644
--- a/gfx/layers/client/ClientImageLayer.cpp
+++ b/gfx/layers/client/ClientImageLayer.cpp
@@ -26,7 +26,7 @@ using namespace mozilla::gfx;
 class ClientImageLayer : public ImageLayer, 
                          public ClientLayer {
 public:
-  ClientImageLayer(ClientLayerManager* aLayerManager)
+  explicit ClientImageLayer(ClientLayerManager* aLayerManager)
     : ImageLayer(aLayerManager,
                  static_cast<ClientLayer*>(MOZ_THIS_IN_INITIALIZER_LIST()))
     , mImageClientTypeContainer(CompositableType::BUFFER_UNKNOWN)
diff --git a/gfx/layers/client/ClientLayerManager.h b/gfx/layers/client/ClientLayerManager.h
index f5dd326738ae..dfdfa39724f9 100644
--- a/gfx/layers/client/ClientLayerManager.h
+++ b/gfx/layers/client/ClientLayerManager.h
@@ -43,7 +43,7 @@ class ClientLayerManager : public LayerManager
   typedef nsTArray<nsRefPtr<Layer> > LayerRefArray;
 
 public:
-  ClientLayerManager(nsIWidget* aWidget);
+  explicit ClientLayerManager(nsIWidget* aWidget);
 
 protected:
   virtual ~ClientLayerManager();
diff --git a/gfx/layers/client/ClientReadbackLayer.h b/gfx/layers/client/ClientReadbackLayer.h
index f3046fea8115..89e673306088 100644
--- a/gfx/layers/client/ClientReadbackLayer.h
+++ b/gfx/layers/client/ClientReadbackLayer.h
@@ -17,7 +17,7 @@ class ClientReadbackLayer :
   public ClientLayer
 {
 public:
-    ClientReadbackLayer(ClientLayerManager *aManager)
+  explicit ClientReadbackLayer(ClientLayerManager *aManager)
     : ReadbackLayer(aManager, nullptr)
   {
       mImplData = static_cast<ClientLayer*>(this);
diff --git a/gfx/layers/client/ClientThebesLayer.h b/gfx/layers/client/ClientThebesLayer.h
index b5864ef448f4..01b7513973d7 100644
--- a/gfx/layers/client/ClientThebesLayer.h
+++ b/gfx/layers/client/ClientThebesLayer.h
@@ -33,8 +33,8 @@ public:
   typedef RotatedContentBuffer::PaintState PaintState;
   typedef RotatedContentBuffer::ContentType ContentType;
 
-  ClientThebesLayer(ClientLayerManager* aLayerManager,
-                    LayerManager::ThebesLayerCreationHint aCreationHint = LayerManager::NONE) :
+  explicit ClientThebesLayer(ClientLayerManager* aLayerManager,
+                             LayerManager::ThebesLayerCreationHint aCreationHint = LayerManager::NONE) :
     ThebesLayer(aLayerManager,
                 static_cast<ClientLayer*>(MOZ_THIS_IN_INITIALIZER_LIST()),
                 aCreationHint),
diff --git a/gfx/layers/client/ClientTiledThebesLayer.cpp b/gfx/layers/client/ClientTiledThebesLayer.cpp
index 0d98719f13ce..ee40a0d44775 100644
--- a/gfx/layers/client/ClientTiledThebesLayer.cpp
+++ b/gfx/layers/client/ClientTiledThebesLayer.cpp
@@ -59,7 +59,7 @@ ClientTiledThebesLayer::FillSpecificAttributes(SpecificLayerAttributes& aAttrs)
 static LayerRect
 ApplyParentLayerToLayerTransform(const gfx::Matrix4x4& aTransform, const ParentLayerRect& aParentLayerRect)
 {
-  return TransformTo<LayerPixel>(gfx::To3DMatrix(aTransform), aParentLayerRect);
+  return TransformTo<LayerPixel>(aTransform, aParentLayerRect);
 }
 
 static gfx::Matrix4x4
@@ -68,12 +68,11 @@ GetTransformToAncestorsParentLayer(Layer* aStart, Layer* aAncestor)
   gfx::Matrix4x4 transform;
   Layer* ancestorParent = aAncestor->GetParent();
   for (Layer* iter = aStart; iter != ancestorParent; iter = iter->GetParent()) {
+    transform = transform * iter->GetTransform();
     // If the layer has a non-transient async transform then we need to apply it here
     // because it will get applied by the APZ in the compositor as well
     const FrameMetrics& metrics = iter->GetFrameMetrics();
     transform = transform * gfx::Matrix4x4().Scale(metrics.mResolution.scale, metrics.mResolution.scale, 1.f);
-
-    transform = transform * iter->GetTransform();
   }
   return transform;
 }
diff --git a/gfx/layers/client/ClientTiledThebesLayer.h b/gfx/layers/client/ClientTiledThebesLayer.h
index da3fe6a75913..f4539ee3fc49 100644
--- a/gfx/layers/client/ClientTiledThebesLayer.h
+++ b/gfx/layers/client/ClientTiledThebesLayer.h
@@ -41,8 +41,8 @@ class ClientTiledThebesLayer : public ThebesLayer,
   typedef ThebesLayer Base;
 
 public:
-  ClientTiledThebesLayer(ClientLayerManager* const aManager,
-                         ClientLayerManager::ThebesLayerCreationHint aCreationHint = LayerManager::NONE);
+  explicit ClientTiledThebesLayer(ClientLayerManager* const aManager,
+                                  ClientLayerManager::ThebesLayerCreationHint aCreationHint = LayerManager::NONE);
 
 protected:
   ~ClientTiledThebesLayer();
diff --git a/gfx/layers/client/CompositableClient.h b/gfx/layers/client/CompositableClient.h
index 63293c88f66e..9efa601865ef 100644
--- a/gfx/layers/client/CompositableClient.h
+++ b/gfx/layers/client/CompositableClient.h
@@ -123,7 +123,7 @@ protected:
 public:
   NS_INLINE_DECL_THREADSAFE_REFCOUNTING(CompositableClient)
 
-  CompositableClient(CompositableForwarder* aForwarder, TextureFlags aFlags = TextureFlags::NO_FLAGS);
+  explicit CompositableClient(CompositableForwarder* aForwarder, TextureFlags aFlags = TextureFlags::NO_FLAGS);
 
   virtual TextureInfo GetTextureInfo() const = 0;
 
@@ -246,8 +246,8 @@ protected:
  */
 struct AutoRemoveTexture
 {
-  AutoRemoveTexture(CompositableClient* aCompositable,
-                    TextureClient* aTexture = nullptr)
+  explicit AutoRemoveTexture(CompositableClient* aCompositable,
+                             TextureClient* aTexture = nullptr)
     : mTexture(aTexture)
     , mCompositable(aCompositable)
   {}
diff --git a/gfx/layers/client/ContentClient.h b/gfx/layers/client/ContentClient.h
index a31a3eaea474..0fd083c15190 100644
--- a/gfx/layers/client/ContentClient.h
+++ b/gfx/layers/client/ContentClient.h
@@ -83,7 +83,7 @@ public:
    */
   static TemporaryRef<ContentClient> CreateContentClient(CompositableForwarder* aFwd);
 
-  ContentClient(CompositableForwarder* aForwarder)
+  explicit ContentClient(CompositableForwarder* aForwarder)
   : CompositableClient(aForwarder)
   {}
   virtual ~ContentClient()
@@ -113,7 +113,7 @@ public:
 class ContentClientRemote : public ContentClient
 {
 public:
-  ContentClientRemote(CompositableForwarder* aForwarder)
+  explicit ContentClientRemote(CompositableForwarder* aForwarder)
     : ContentClient(aForwarder)
   {}
 
@@ -190,7 +190,7 @@ class ContentClientRemoteBuffer : public ContentClientRemote
   using RotatedContentBuffer::BufferRect;
   using RotatedContentBuffer::BufferRotation;
 public:
-  ContentClientRemoteBuffer(CompositableForwarder* aForwarder)
+  explicit ContentClientRemoteBuffer(CompositableForwarder* aForwarder)
     : ContentClientRemote(aForwarder)
     , RotatedContentBuffer(ContainsVisibleBounds)
     , mIsNewBuffer(false)
@@ -315,7 +315,7 @@ protected:
 class ContentClientDoubleBuffered : public ContentClientRemoteBuffer
 {
 public:
-  ContentClientDoubleBuffered(CompositableForwarder* aFwd)
+  explicit ContentClientDoubleBuffered(CompositableForwarder* aFwd)
     : ContentClientRemoteBuffer(aFwd)
   {
     mTextureInfo.mCompositableType = CompositableType::CONTENT_DOUBLE;
@@ -374,7 +374,7 @@ private:
 class ContentClientSingleBuffered : public ContentClientRemoteBuffer
 {
 public:
-  ContentClientSingleBuffered(CompositableForwarder* aFwd)
+  explicit ContentClientSingleBuffered(CompositableForwarder* aFwd)
     : ContentClientRemoteBuffer(aFwd)
   {
     mTextureInfo.mCompositableType = CompositableType::CONTENT_SINGLE;
@@ -394,7 +394,7 @@ class ContentClientIncremental : public ContentClientRemote
                                , public BorrowDrawTarget
 {
 public:
-  ContentClientIncremental(CompositableForwarder* aFwd)
+  explicit ContentClientIncremental(CompositableForwarder* aFwd)
     : ContentClientRemote(aFwd)
     , mContentType(gfxContentType::COLOR_ALPHA)
     , mHasBuffer(false)
diff --git a/gfx/layers/client/SimpleTiledContentClient.h b/gfx/layers/client/SimpleTiledContentClient.h
index 0eea5458199d..31d43d9f68f9 100644
--- a/gfx/layers/client/SimpleTiledContentClient.h
+++ b/gfx/layers/client/SimpleTiledContentClient.h
@@ -163,8 +163,8 @@ class SimpleClientTiledThebesLayer : public ThebesLayer,
   typedef ThebesLayer Base;
 
 public:
-  SimpleClientTiledThebesLayer(ClientLayerManager* const aManager,
-                               ClientLayerManager::ThebesLayerCreationHint aCreationHint = LayerManager::NONE);
+  explicit SimpleClientTiledThebesLayer(ClientLayerManager* const aManager,
+                                        ClientLayerManager::ThebesLayerCreationHint aCreationHint = LayerManager::NONE);
 protected:
   ~SimpleClientTiledThebesLayer();
 
diff --git a/gfx/layers/client/TextureClient.h b/gfx/layers/client/TextureClient.h
index f87152d57782..5c344caea826 100644
--- a/gfx/layers/client/TextureClient.h
+++ b/gfx/layers/client/TextureClient.h
@@ -137,7 +137,7 @@ class TextureClient
   : public AtomicRefCountedWithFinalize<TextureClient>
 {
 public:
-  TextureClient(TextureFlags aFlags = TextureFlags::DEFAULT);
+  explicit TextureClient(TextureFlags aFlags = TextureFlags::DEFAULT);
   virtual ~TextureClient();
 
   // Creates and allocates a TextureClient usable with Moz2D.
@@ -465,7 +465,7 @@ protected:
 class TextureClientReleaseTask : public Task
 {
 public:
-    TextureClientReleaseTask(TextureClient* aClient)
+    explicit TextureClientReleaseTask(TextureClient* aClient)
         : mTextureClient(aClient) {
     }
 
@@ -620,7 +620,7 @@ protected:
 class StreamTextureClient : public TextureClient
 {
 public:
-  StreamTextureClient(TextureFlags aFlags);
+  explicit StreamTextureClient(TextureFlags aFlags);
 
 protected:
   ~StreamTextureClient();
@@ -669,7 +669,7 @@ struct TextureClientAutoUnlock
 {
   TextureClient* mTexture;
 
-  TextureClientAutoUnlock(TextureClient* aTexture)
+  explicit TextureClientAutoUnlock(TextureClient* aTexture)
   : mTexture(aTexture) {}
 
   ~TextureClientAutoUnlock()
@@ -688,7 +688,7 @@ template<typename T>
 class TKeepAlive : public KeepAlive
 {
 public:
-  TKeepAlive(T* aData) : mData(aData) {}
+  explicit TKeepAlive(T* aData) : mData(aData) {}
 protected:
   RefPtr<T> mData;
 };
diff --git a/gfx/layers/client/TiledContentClient.cpp b/gfx/layers/client/TiledContentClient.cpp
index 5bc89806f06b..6dd26d9fd9c6 100644
--- a/gfx/layers/client/TiledContentClient.cpp
+++ b/gfx/layers/client/TiledContentClient.cpp
@@ -148,12 +148,12 @@ ComputeViewTransform(const FrameMetrics& aContentMetrics, const FrameMetrics& aC
   // but with aContentMetrics used in place of mLastContentPaintMetrics, because they
   // should be equivalent, modulo race conditions while transactions are inflight.
 
-  LayerPoint translation = (aCompositorMetrics.GetScrollOffset() - aContentMetrics.GetScrollOffset())
-                         * aContentMetrics.LayersPixelsPerCSSPixel();
-  return ViewTransform(-translation,
-                       aCompositorMetrics.GetZoom()
+  ParentLayerToScreenScale scale = aCompositorMetrics.GetZoom()
                      / aContentMetrics.mDevPixelsPerCSSPixel
-                     / aCompositorMetrics.GetParentResolution());
+                     / aCompositorMetrics.GetParentResolution();
+  ScreenPoint translation = (aCompositorMetrics.GetScrollOffset() - aContentMetrics.GetScrollOffset())
+                         * aCompositorMetrics.GetZoom();
+  return ViewTransform(scale, -translation);
 }
 
 bool
@@ -1338,22 +1338,16 @@ GetCompositorSideCompositionBounds(Layer* aScrollAncestor,
     1.f);
   nonTransientAPZUntransform.Invert();
 
-  Matrix4x4 layerTransform = aScrollAncestor->GetTransform();
-  Matrix4x4 layerUntransform = layerTransform;
-  layerUntransform.Invert();
+  // Take off the last "term" of aTransformToCompBounds, which
+  // is the APZ's nontransient async transform. Replace it with
+  // the APZ's async transform (this includes the nontransient
+  // component as well).
+  Matrix4x4 transform = aTransformToCompBounds
+                      * nonTransientAPZUntransform
+                      * Matrix4x4(aAPZTransform);
+  transform.Invert();
 
-  // First take off the last two "terms" of aTransformToCompBounds, which
-  // are the scroll ancestor's local transform and the APZ's nontransient async
-  // transform.
-  Matrix4x4 transform = aTransformToCompBounds * layerUntransform * nonTransientAPZUntransform;
-
-  // Next, apply the APZ's async transform (this includes the nontransient component
-  // as well).
-  transform = transform * Matrix4x4(aAPZTransform);
-
-  // Finally, put back the scroll ancestor's local transform.
-  transform = transform * layerTransform;
-  return TransformTo<LayerPixel>(To3DMatrix(transform).Inverse(),
+  return TransformTo<LayerPixel>(transform,
             aScrollAncestor->GetFrameMetrics().mCompositionBounds);
 }
 
diff --git a/gfx/layers/client/TiledContentClient.h b/gfx/layers/client/TiledContentClient.h
index cf62128274a5..dba6a3836ced 100644
--- a/gfx/layers/client/TiledContentClient.h
+++ b/gfx/layers/client/TiledContentClient.h
@@ -97,7 +97,7 @@ private:
   };
 
 public:
-  gfxShmSharedReadLock(ISurfaceAllocator* aAllocator);
+  explicit gfxShmSharedReadLock(ISurfaceAllocator* aAllocator);
 
 protected:
   ~gfxShmSharedReadLock();
diff --git a/gfx/layers/composite/AsyncCompositionManager.cpp b/gfx/layers/composite/AsyncCompositionManager.cpp
index 977e258bb786..24f52f6bc893 100644
--- a/gfx/layers/composite/AsyncCompositionManager.cpp
+++ b/gfx/layers/composite/AsyncCompositionManager.cpp
@@ -505,6 +505,22 @@ SampleAnimations(Layer* aLayer, TimeStamp aPoint)
   return activeAnimations;
 }
 
+static bool
+SampleAPZAnimations(Layer* aLayer, TimeStamp aPoint)
+{
+  bool activeAnimations = false;
+  for (Layer* child = aLayer->GetFirstChild(); child;
+        child = child->GetNextSibling()) {
+    activeAnimations |= SampleAPZAnimations(child, aPoint);
+  }
+
+  if (AsyncPanZoomController* apzc = aLayer->GetAsyncPanZoomController()) {
+    activeAnimations |= apzc->AdvanceAnimations(aPoint);
+  }
+
+  return activeAnimations;
+}
+
 Matrix4x4
 AdjustAndCombineWithCSSTransform(const Matrix4x4& asyncTransform, Layer* aLayer)
 {
@@ -523,20 +539,18 @@ AdjustAndCombineWithCSSTransform(const Matrix4x4& asyncTransform, Layer* aLayer)
   }
 
   // Combine the async transform with the layer's CSS transform.
-  result = result * aLayer->GetTransform();
+  result = aLayer->GetTransform() * result;
   return result;
 }
 
 bool
-AsyncCompositionManager::ApplyAsyncContentTransformToTree(TimeStamp aCurrentFrame,
-                                                          Layer *aLayer,
-                                                          bool* aWantNextFrame)
+AsyncCompositionManager::ApplyAsyncContentTransformToTree(Layer *aLayer)
 {
   bool appliedTransform = false;
   for (Layer* child = aLayer->GetFirstChild();
       child; child = child->GetNextSibling()) {
     appliedTransform |=
-      ApplyAsyncContentTransformToTree(aCurrentFrame, child, aWantNextFrame);
+      ApplyAsyncContentTransformToTree(child);
   }
 
   if (AsyncPanZoomController* controller = aLayer->GetAsyncPanZoomController()) {
@@ -545,11 +559,9 @@ AsyncCompositionManager::ApplyAsyncContentTransformToTree(TimeStamp aCurrentFram
 
     ViewTransform asyncTransformWithoutOverscroll, overscrollTransform;
     ScreenPoint scrollOffset;
-    *aWantNextFrame |=
-      controller->SampleContentTransformForFrame(aCurrentFrame,
-                                                 &asyncTransformWithoutOverscroll,
-                                                 scrollOffset,
-                                                 &overscrollTransform);
+    controller->SampleContentTransformForFrame(&asyncTransformWithoutOverscroll,
+                                               scrollOffset,
+                                               &overscrollTransform);
 
     const FrameMetrics& metrics = aLayer->GetFrameMetrics();
     CSSToLayerScale paintScale = metrics.LayersPixelsPerCSSPixel();
@@ -603,7 +615,7 @@ AsyncCompositionManager::ApplyAsyncContentTransformToTree(TimeStamp aCurrentFram
   }
 
   if (aLayer->AsContainerLayer() && aLayer->GetScrollbarDirection() != Layer::NONE) {
-    ApplyAsyncTransformToScrollbar(aCurrentFrame, aLayer->AsContainerLayer());
+    ApplyAsyncTransformToScrollbar(aLayer->AsContainerLayer());
   }
   return appliedTransform;
 }
@@ -637,7 +649,7 @@ LayerIsScrollbarTarget(Layer* aTarget, ContainerLayer* aScrollbar)
 }
 
 static void
-ApplyAsyncTransformToScrollbarForContent(TimeStamp aCurrentFrame, ContainerLayer* aScrollbar,
+ApplyAsyncTransformToScrollbarForContent(ContainerLayer* aScrollbar,
                                          Layer* aContent, bool aScrollbarIsChild)
 {
   // We only apply the transform if the scroll-target layer has non-container
@@ -653,18 +665,6 @@ ApplyAsyncTransformToScrollbarForContent(TimeStamp aCurrentFrame, ContainerLayer
   const FrameMetrics& metrics = aContent->GetFrameMetrics();
   AsyncPanZoomController* apzc = aContent->GetAsyncPanZoomController();
 
-  if (aScrollbarIsChild) {
-    // Because we try to apply the scrollbar transform before we apply the async transform on
-    // the actual content, we need to ensure that the APZC has updated any pending animations
-    // to the current frame timestamp before we extract the transforms from it. The code in this
-    // block accomplishes that and throws away the temp variables.
-    // TODO: it might be cleaner to do a pass through the layer tree to advance all the APZC
-    // transforms before updating the layer shadow transforms. That will allow removal of this code.
-    ViewTransform asyncTransform;
-    ScreenPoint scrollOffset;
-    apzc->SampleContentTransformForFrame(aCurrentFrame, &asyncTransform, scrollOffset);
-  }
-
   Matrix4x4 asyncTransform = apzc->GetCurrentAsyncTransform();
   Matrix4x4 nontransientTransform = apzc->GetNontransientAsyncTransform();
   Matrix4x4 nontransientUntransform = nontransientTransform;
@@ -751,7 +751,7 @@ FindScrolledLayerForScrollbar(ContainerLayer* aLayer, bool* aOutIsAncestor)
 }
 
 void
-AsyncCompositionManager::ApplyAsyncTransformToScrollbar(TimeStamp aCurrentFrame, ContainerLayer* aLayer)
+AsyncCompositionManager::ApplyAsyncTransformToScrollbar(ContainerLayer* aLayer)
 {
   // If this layer corresponds to a scrollbar, then there should be a layer that
   // is a previous sibling or a parent that has a matching ViewID on its FrameMetrics.
@@ -763,8 +763,7 @@ AsyncCompositionManager::ApplyAsyncTransformToScrollbar(TimeStamp aCurrentFrame,
   bool isAncestor = false;
   Layer* scrollTarget = FindScrolledLayerForScrollbar(aLayer, &isAncestor);
   if (scrollTarget) {
-    ApplyAsyncTransformToScrollbarForContent(aCurrentFrame, aLayer, scrollTarget,
-                                             isAncestor);
+    ApplyAsyncTransformToScrollbarForContent(aLayer, scrollTarget, isAncestor);
   }
 }
 
@@ -827,23 +826,20 @@ AsyncCompositionManager::TransformScrollableLayer(Layer* aLayer)
   // primary scrollable layer. We compare this to the user zoom and scroll
   // offset in the view transform we obtained from Java in order to compute the
   // transformation we need to apply.
-  LayerToScreenScale zoomAdjust = userZoom / geckoZoom;
-
-  LayerPoint geckoScroll(0, 0);
+  ScreenPoint geckoScroll(0, 0);
   if (metrics.IsScrollable()) {
-    geckoScroll = metrics.GetScrollOffset() * geckoZoom;
+    geckoScroll = metrics.GetScrollOffset() * userZoom;
   }
-
-  LayerPoint translation = (userScroll / zoomAdjust) - geckoScroll;
-  Matrix4x4 treeTransform = ViewTransform(-translation,
-                                            userZoom
-                                          / metrics.mDevPixelsPerCSSPixel
-                                          / metrics.GetParentResolution());
+  ParentLayerToScreenScale scale = userZoom
+                                  / metrics.mDevPixelsPerCSSPixel
+                                  / metrics.GetParentResolution();
+  ScreenPoint translation = userScroll - geckoScroll;
+  Matrix4x4 treeTransform = ViewTransform(scale, -translation);
 
   // The transform already takes the resolution scale into account.  Since we
   // will apply the resolution scale again when computing the effective
   // transform, we must apply the inverse resolution scale here.
-  Matrix4x4 computedTransform = treeTransform * oldTransform;
+  Matrix4x4 computedTransform = oldTransform * treeTransform;
   if (ContainerLayer* container = aLayer->AsContainerLayer()) {
     computedTransform.Scale(1.0f/container->GetPreXScale(),
                             1.0f/container->GetPreYScale(),
@@ -944,7 +940,8 @@ AsyncCompositionManager::TransformShadowTree(TimeStamp aCurrentFrame)
   // code also includes Fennec which is rendered async.  Fennec uses
   // its own platform-specific async rendering that is done partially
   // in Gecko and partially in Java.
-  if (!ApplyAsyncContentTransformToTree(aCurrentFrame, root, &wantNextFrame)) {
+  wantNextFrame |= SampleAPZAnimations(root, aCurrentFrame);
+  if (!ApplyAsyncContentTransformToTree(root)) {
     nsAutoTArray<Layer*,1> scrollableLayers;
 #ifdef MOZ_WIDGET_ANDROID
     scrollableLayers.AppendElement(mLayerManager->GetPrimaryScrollableLayer());
diff --git a/gfx/layers/composite/AsyncCompositionManager.h b/gfx/layers/composite/AsyncCompositionManager.h
index becfe0188147..17af6acf27c6 100644
--- a/gfx/layers/composite/AsyncCompositionManager.h
+++ b/gfx/layers/composite/AsyncCompositionManager.h
@@ -6,7 +6,7 @@
 #ifndef GFX_ASYNCCOMPOSITIONMANAGER_H
 #define GFX_ASYNCCOMPOSITIONMANAGER_H
 
-#include "Units.h"                      // for LayerPoint, etc
+#include "Units.h"                      // for ScreenPoint, etc
 #include "mozilla/layers/LayerManagerComposite.h"  // for LayerManagerComposite
 #include "mozilla/Attributes.h"         // for MOZ_DELETE, MOZ_FINAL, etc
 #include "mozilla/RefPtr.h"             // for RefCounted
@@ -28,17 +28,17 @@ class AutoResolveRefLayers;
 
 // Represents (affine) transforms that are calculated from a content view.
 struct ViewTransform {
-  ViewTransform(LayerPoint aTranslation = LayerPoint(),
-                ParentLayerToScreenScale aScale = ParentLayerToScreenScale())
-    : mTranslation(aTranslation)
-    , mScale(aScale)
+  explicit ViewTransform(ParentLayerToScreenScale aScale = ParentLayerToScreenScale(),
+                         ScreenPoint aTranslation = ScreenPoint())
+    : mScale(aScale)
+    , mTranslation(aTranslation)
   {}
 
   operator gfx::Matrix4x4() const
   {
     return
-      gfx::Matrix4x4().Translate(mTranslation.x, mTranslation.y, 0) *
-      gfx::Matrix4x4().Scale(mScale.scale, mScale.scale, 1);
+      gfx::Matrix4x4().Scale(mScale.scale, mScale.scale, 1)
+                      .PostTranslate(mTranslation.x, mTranslation.y, 0);
   }
 
   // For convenience, to avoid writing the cumbersome
@@ -55,8 +55,8 @@ struct ViewTransform {
     return !(*this == rhs);
   }
 
-  LayerPoint mTranslation;
   ParentLayerToScreenScale mScale;
+  ScreenPoint mTranslation;
 };
 
 /**
@@ -76,7 +76,7 @@ class AsyncCompositionManager MOZ_FINAL
 public:
   NS_INLINE_DECL_REFCOUNTING(AsyncCompositionManager)
 
-  AsyncCompositionManager(LayerManagerComposite* aManager)
+  explicit AsyncCompositionManager(LayerManagerComposite* aManager)
     : mLayerManager(aManager)
     , mIsFirstPaint(false)
     , mLayersUpdated(false)
@@ -124,15 +124,13 @@ public:
 private:
   void TransformScrollableLayer(Layer* aLayer);
   // Return true if an AsyncPanZoomController content transform was
-  // applied for |aLayer|.  *aWantNextFrame is set to true if the
-  // controller wants another animation frame.
-  bool ApplyAsyncContentTransformToTree(TimeStamp aCurrentFrame, Layer* aLayer,
-                                        bool* aWantNextFrame);
+  // applied for |aLayer|.
+  bool ApplyAsyncContentTransformToTree(Layer* aLayer);
   /**
    * Update the shadow transform for aLayer assuming that is a scrollbar,
    * so that it stays in sync with the content that is being scrolled by APZ.
    */
-  void ApplyAsyncTransformToScrollbar(TimeStamp aCurrentFrame, ContainerLayer* aLayer);
+  void ApplyAsyncTransformToScrollbar(ContainerLayer* aLayer);
 
   void SetFirstPaintViewport(const LayerIntPoint& aOffset,
                              const CSSToLayerScale& aZoom,
@@ -209,7 +207,7 @@ private:
 
 class MOZ_STACK_CLASS AutoResolveRefLayers {
 public:
-  AutoResolveRefLayers(AsyncCompositionManager* aManager) : mManager(aManager)
+  explicit AutoResolveRefLayers(AsyncCompositionManager* aManager) : mManager(aManager)
   {
     if (mManager) {
       mManager->ResolveRefLayers();
diff --git a/gfx/layers/composite/CanvasLayerComposite.h b/gfx/layers/composite/CanvasLayerComposite.h
index 70f54fa223d4..6051d974ae1f 100644
--- a/gfx/layers/composite/CanvasLayerComposite.h
+++ b/gfx/layers/composite/CanvasLayerComposite.h
@@ -28,7 +28,7 @@ class CanvasLayerComposite : public CanvasLayer,
                              public LayerComposite
 {
 public:
-  CanvasLayerComposite(LayerManagerComposite* aManager);
+  explicit CanvasLayerComposite(LayerManagerComposite* aManager);
 
 protected:
   virtual ~CanvasLayerComposite();
diff --git a/gfx/layers/composite/ColorLayerComposite.h b/gfx/layers/composite/ColorLayerComposite.h
index 31ec0459d709..8414e8a30363 100644
--- a/gfx/layers/composite/ColorLayerComposite.h
+++ b/gfx/layers/composite/ColorLayerComposite.h
@@ -23,7 +23,7 @@ class ColorLayerComposite : public ColorLayer,
                             public LayerComposite
 {
 public:
-  ColorLayerComposite(LayerManagerComposite *aManager)
+  explicit ColorLayerComposite(LayerManagerComposite *aManager)
     : ColorLayer(aManager, nullptr)
     , LayerComposite(aManager)
   {
diff --git a/gfx/layers/composite/CompositableHost.h b/gfx/layers/composite/CompositableHost.h
index 33a2f4b16efe..f4613c3b0c38 100644
--- a/gfx/layers/composite/CompositableHost.h
+++ b/gfx/layers/composite/CompositableHost.h
@@ -88,7 +88,7 @@ protected:
 
 public:
   NS_INLINE_DECL_REFCOUNTING(CompositableHost)
-  CompositableHost(const TextureInfo& aTextureInfo);
+  explicit CompositableHost(const TextureInfo& aTextureInfo);
 
   static TemporaryRef<CompositableHost> Create(const TextureInfo& aTextureInfo);
 
@@ -304,7 +304,7 @@ protected:
 class AutoLockCompositableHost MOZ_FINAL
 {
 public:
-  AutoLockCompositableHost(CompositableHost* aHost)
+  explicit AutoLockCompositableHost(CompositableHost* aHost)
     : mHost(aHost)
   {
     mSucceeded = mHost->Lock();
diff --git a/gfx/layers/composite/ContainerLayerComposite.cpp b/gfx/layers/composite/ContainerLayerComposite.cpp
index cd418c0fa2c7..c3c71a103f9e 100644
--- a/gfx/layers/composite/ContainerLayerComposite.cpp
+++ b/gfx/layers/composite/ContainerLayerComposite.cpp
@@ -227,8 +227,8 @@ static void DrawVelGraph(const nsIntRect& aClipRect,
   for (int32_t i = (int32_t)velocityData->mData.size() - 2; i >= 0; i--) {
     const gfx::Point& p1 = velocityData->mData[i+1].mPoint;
     const gfx::Point& p2 = velocityData->mData[i].mPoint;
-    int vel = sqrt((p1.x - p2.x) * (p1.x - p2.x) +
-                   (p1.y - p2.y) * (p1.y - p2.y));
+    int vel = sqrt((p1.x - p2.x).value * (p1.x - p2.x).value +
+                   (p1.y - p2.y).value * (p1.y - p2.y).value);
     Point next = Point(graphRect.width / circularBufferSize * i,
                        graphRect.height - vel/yScaleFactor);
     if (first) {
@@ -270,11 +270,9 @@ static void PrintUniformityInfo(Layer* aLayer)
     return;
   }
 
-  LayerIntPoint scrollOffset = RoundedToInt(frameMetrics.GetScrollOffsetInLayerPixels());
+  const LayerPoint scrollOffset = frameMetrics.GetScrollOffsetInLayerPixels();
   const gfx::Point layerTransform = GetScrollData(aLayer);
-  gfx::Point layerScroll;
-  layerScroll.x = scrollOffset.x - layerTransform.x;
-  layerScroll.y = scrollOffset.y - layerTransform.y;
+  const gfx::Point layerScroll = scrollOffset.ToUnknownPoint() - layerTransform;
 
   printf_stderr("UniformityInfo Layer_Move %llu %p %f, %f\n",
     TimeStamp::Now(), aLayer, layerScroll.x, layerScroll.y);
diff --git a/gfx/layers/composite/ContainerLayerComposite.h b/gfx/layers/composite/ContainerLayerComposite.h
index c3cbc594f301..15518617de35 100644
--- a/gfx/layers/composite/ContainerLayerComposite.h
+++ b/gfx/layers/composite/ContainerLayerComposite.h
@@ -53,7 +53,7 @@ class ContainerLayerComposite : public ContainerLayer,
                         const nsIntRect& aClipRect);
 
 public:
-  ContainerLayerComposite(LayerManagerComposite *aManager);
+  explicit ContainerLayerComposite(LayerManagerComposite *aManager);
 
 protected:
   ~ContainerLayerComposite();
@@ -117,7 +117,7 @@ class RefLayerComposite : public RefLayer,
                         const nsIntRect& aClipRect);
 
 public:
-  RefLayerComposite(LayerManagerComposite *aManager);
+  explicit RefLayerComposite(LayerManagerComposite *aManager);
 
 protected:
   ~RefLayerComposite();
diff --git a/gfx/layers/composite/ContentHost.h b/gfx/layers/composite/ContentHost.h
index e5aa7156aa9d..8270e79d18f1 100644
--- a/gfx/layers/composite/ContentHost.h
+++ b/gfx/layers/composite/ContentHost.h
@@ -68,7 +68,7 @@ public:
   bool PaintWillResample() { return mPaintWillResample; }
 
 protected:
-  ContentHost(const TextureInfo& aTextureInfo)
+  explicit ContentHost(const TextureInfo& aTextureInfo)
     : CompositableHost(aTextureInfo)
     , mPaintWillResample(false)
   {}
@@ -93,7 +93,7 @@ public:
   typedef RotatedContentBuffer::ContentType ContentType;
   typedef RotatedContentBuffer::PaintState PaintState;
 
-  ContentHostBase(const TextureInfo& aTextureInfo);
+  explicit ContentHostBase(const TextureInfo& aTextureInfo);
   virtual ~ContentHostBase();
 
   virtual void Composite(EffectChain& aEffectChain,
@@ -127,7 +127,7 @@ protected:
 class ContentHostTexture : public ContentHostBase
 {
 public:
-  ContentHostTexture(const TextureInfo& aTextureInfo)
+  explicit ContentHostTexture(const TextureInfo& aTextureInfo)
     : ContentHostBase(aTextureInfo)
     , mLocked(false)
   { }
@@ -201,7 +201,7 @@ protected:
 class ContentHostDoubleBuffered : public ContentHostTexture
 {
 public:
-  ContentHostDoubleBuffered(const TextureInfo& aTextureInfo)
+  explicit ContentHostDoubleBuffered(const TextureInfo& aTextureInfo)
     : ContentHostTexture(aTextureInfo)
   {}
 
@@ -225,7 +225,7 @@ protected:
 class ContentHostSingleBuffered : public ContentHostTexture
 {
 public:
-  ContentHostSingleBuffered(const TextureInfo& aTextureInfo)
+  explicit ContentHostSingleBuffered(const TextureInfo& aTextureInfo)
     : ContentHostTexture(aTextureInfo)
   {}
   virtual ~ContentHostSingleBuffered() {}
@@ -251,7 +251,7 @@ public:
 class ContentHostIncremental : public ContentHostBase
 {
 public:
-  ContentHostIncremental(const TextureInfo& aTextureInfo);
+  explicit ContentHostIncremental(const TextureInfo& aTextureInfo);
   ~ContentHostIncremental();
 
   virtual CompositableType GetType() { return CompositableType::BUFFER_CONTENT_INC; }
diff --git a/gfx/layers/composite/FPSCounter.h b/gfx/layers/composite/FPSCounter.h
index e07b9d6df821..2a493d3e4f01 100644
--- a/gfx/layers/composite/FPSCounter.h
+++ b/gfx/layers/composite/FPSCounter.h
@@ -58,7 +58,7 @@ const int kMaxFrames = 2400;
  */
 class FPSCounter {
 public:
-  FPSCounter(const char* aName);
+  explicit FPSCounter(const char* aName);
   ~FPSCounter();
 
   void AddFrame(TimeStamp aTimestamp);
diff --git a/gfx/layers/composite/ImageHost.h b/gfx/layers/composite/ImageHost.h
index bae8ed772072..79f249b7a90f 100644
--- a/gfx/layers/composite/ImageHost.h
+++ b/gfx/layers/composite/ImageHost.h
@@ -40,7 +40,7 @@ struct EffectChain;
 class ImageHost : public CompositableHost
 {
 public:
-  ImageHost(const TextureInfo& aTextureInfo);
+  explicit ImageHost(const TextureInfo& aTextureInfo);
   ~ImageHost();
 
   virtual CompositableType GetType() { return mTextureInfo.mCompositableType; }
diff --git a/gfx/layers/composite/ImageLayerComposite.h b/gfx/layers/composite/ImageLayerComposite.h
index 50dd30a12b31..faded30bbac2 100644
--- a/gfx/layers/composite/ImageLayerComposite.h
+++ b/gfx/layers/composite/ImageLayerComposite.h
@@ -31,7 +31,7 @@ class ImageLayerComposite : public ImageLayer,
   typedef gl::TextureImage TextureImage;
 
 public:
-  ImageLayerComposite(LayerManagerComposite* aManager);
+  explicit ImageLayerComposite(LayerManagerComposite* aManager);
 
 protected:
   virtual ~ImageLayerComposite();
diff --git a/gfx/layers/composite/LayerManagerComposite.h b/gfx/layers/composite/LayerManagerComposite.h
index b7589c635984..901c8bf6fdda 100644
--- a/gfx/layers/composite/LayerManagerComposite.h
+++ b/gfx/layers/composite/LayerManagerComposite.h
@@ -73,7 +73,7 @@ class LayerManagerComposite : public LayerManager
   typedef mozilla::gfx::SurfaceFormat SurfaceFormat;
 
 public:
-  LayerManagerComposite(Compositor* aCompositor);
+  explicit LayerManagerComposite(Compositor* aCompositor);
   ~LayerManagerComposite();
 
   virtual void Destroy() MOZ_OVERRIDE;
@@ -315,7 +315,7 @@ private:
 class LayerComposite
 {
 public:
-  LayerComposite(LayerManagerComposite* aManager);
+  explicit LayerComposite(LayerManagerComposite* aManager);
 
   virtual ~LayerComposite();
 
diff --git a/gfx/layers/composite/TextRenderer.h b/gfx/layers/composite/TextRenderer.h
index 97031c9ecfb1..30cb22cfccfa 100644
--- a/gfx/layers/composite/TextRenderer.h
+++ b/gfx/layers/composite/TextRenderer.h
@@ -22,7 +22,7 @@ class TextRenderer
 public:
   NS_INLINE_DECL_REFCOUNTING(TextRenderer)
 
-  TextRenderer(Compositor *aCompositor)
+  explicit TextRenderer(Compositor *aCompositor)
     : mCompositor(aCompositor)
   {
   }
diff --git a/gfx/layers/composite/TextureHost.cpp b/gfx/layers/composite/TextureHost.cpp
index ed22f1fa7dab..a0b2044f5770 100644
--- a/gfx/layers/composite/TextureHost.cpp
+++ b/gfx/layers/composite/TextureHost.cpp
@@ -71,7 +71,7 @@ namespace layers {
 class TextureParent : public PTextureParent
 {
 public:
-  TextureParent(CompositableParentManager* aManager);
+  explicit TextureParent(CompositableParentManager* aManager);
 
   ~TextureParent();
 
diff --git a/gfx/layers/composite/TextureHost.h b/gfx/layers/composite/TextureHost.h
index e22f0b2963c8..4cb8455fc7b8 100644
--- a/gfx/layers/composite/TextureHost.h
+++ b/gfx/layers/composite/TextureHost.h
@@ -286,7 +286,7 @@ class TextureHost
 
   friend class AtomicRefCountedWithFinalize<TextureHost>;
 public:
-  TextureHost(TextureFlags aFlags);
+  explicit TextureHost(TextureFlags aFlags);
 
 protected:
   virtual ~TextureHost();
@@ -652,7 +652,7 @@ protected:
 class MOZ_STACK_CLASS AutoLockTextureHost
 {
 public:
-  AutoLockTextureHost(TextureHost* aTexture)
+  explicit AutoLockTextureHost(TextureHost* aTexture)
     : mTexture(aTexture)
   {
     mLocked = mTexture ? mTexture->Lock() : false;
@@ -679,7 +679,7 @@ private:
 class CompositingRenderTarget : public TextureSource
 {
 public:
-  CompositingRenderTarget(const gfx::IntPoint& aOrigin)
+  explicit CompositingRenderTarget(const gfx::IntPoint& aOrigin)
     : mOrigin(aOrigin)
   {}
   virtual ~CompositingRenderTarget() {}
diff --git a/gfx/layers/composite/ThebesLayerComposite.h b/gfx/layers/composite/ThebesLayerComposite.h
index 0a09112cf82a..5d64fbc4c863 100644
--- a/gfx/layers/composite/ThebesLayerComposite.h
+++ b/gfx/layers/composite/ThebesLayerComposite.h
@@ -37,7 +37,7 @@ class ThebesLayerComposite : public ThebesLayer,
                              public LayerComposite
 {
 public:
-  ThebesLayerComposite(LayerManagerComposite *aManager);
+  explicit ThebesLayerComposite(LayerManagerComposite *aManager);
 
 protected:
   virtual ~ThebesLayerComposite();
diff --git a/gfx/layers/composite/TiledContentHost.h b/gfx/layers/composite/TiledContentHost.h
index 1c29651a4551..dfeb45070272 100644
--- a/gfx/layers/composite/TiledContentHost.h
+++ b/gfx/layers/composite/TiledContentHost.h
@@ -189,7 +189,7 @@ class TiledContentHost : public ContentHost,
                          public TiledLayerComposer
 {
 public:
-  TiledContentHost(const TextureInfo& aTextureInfo);
+  explicit TiledContentHost(const TextureInfo& aTextureInfo);
 
 protected:
   ~TiledContentHost();
diff --git a/gfx/layers/ipc/AsyncTransactionTracker.h b/gfx/layers/ipc/AsyncTransactionTracker.h
index 5fb6cd6eebd0..8ea40e58b7f1 100644
--- a/gfx/layers/ipc/AsyncTransactionTracker.h
+++ b/gfx/layers/ipc/AsyncTransactionTracker.h
@@ -190,7 +190,7 @@ protected:
  */
 class FenceDeliveryTracker : public AsyncTransactionTracker {
 public:
-  FenceDeliveryTracker(FenceHandle& aFenceHandle)
+  explicit FenceDeliveryTracker(FenceHandle& aFenceHandle)
     : mFenceHandle(aFenceHandle)
   {
     MOZ_COUNT_CTOR(FenceDeliveryTracker);
diff --git a/gfx/layers/ipc/CompositorChild.h b/gfx/layers/ipc/CompositorChild.h
index 602d44bcbd61..e4d091caaa46 100644
--- a/gfx/layers/ipc/CompositorChild.h
+++ b/gfx/layers/ipc/CompositorChild.h
@@ -41,7 +41,7 @@ class CompositorChild MOZ_FINAL : public PCompositorChild
   NS_INLINE_DECL_THREADSAFE_REFCOUNTING_WITH_MAIN_THREAD_DESTRUCTION(CompositorChild)
 
 public:
-  CompositorChild(ClientLayerManager *aLayerManager);
+  explicit CompositorChild(ClientLayerManager *aLayerManager);
 
   void Destroy();
 
diff --git a/gfx/layers/ipc/CompositorParent.h b/gfx/layers/ipc/CompositorParent.h
index 5bbaa2d1dd95..2dc7e73efe40 100644
--- a/gfx/layers/ipc/CompositorParent.h
+++ b/gfx/layers/ipc/CompositorParent.h
@@ -93,9 +93,9 @@ class CompositorParent : public PCompositorParent,
   NS_INLINE_DECL_THREADSAFE_REFCOUNTING_WITH_MAIN_THREAD_DESTRUCTION(CompositorParent)
 
 public:
-  CompositorParent(nsIWidget* aWidget,
-                   bool aUseExternalSurfaceSize = false,
-                   int aSurfaceWidth = -1, int aSurfaceHeight = -1);
+  explicit CompositorParent(nsIWidget* aWidget,
+                            bool aUseExternalSurfaceSize = false,
+                            int aSurfaceWidth = -1, int aSurfaceHeight = -1);
 
   // IToplevelProtocol::CloneToplevel()
   virtual IToplevelProtocol*
diff --git a/gfx/layers/ipc/FenceUtils.h b/gfx/layers/ipc/FenceUtils.h
index 63f58436ea58..82c2498aaf54 100644
--- a/gfx/layers/ipc/FenceUtils.h
+++ b/gfx/layers/ipc/FenceUtils.h
@@ -23,14 +23,14 @@ struct FenceHandleFromChild;
 
 struct FenceHandle {
   FenceHandle() {}
-  FenceHandle(const FenceHandleFromChild& aFenceHandle) {}
+  explicit FenceHandle(const FenceHandleFromChild& aFenceHandle) {}
   bool operator==(const FenceHandle&) const { return false; }
   bool IsValid() const { return false; }
 };
 
 struct FenceHandleFromChild {
   FenceHandleFromChild() {}
-  FenceHandleFromChild(const FenceHandle& aFence) {}
+  explicit FenceHandleFromChild(const FenceHandle& aFence) {}
   bool operator==(const FenceHandle&) const { return false; }
   bool operator==(const FenceHandleFromChild&) const { return false; }
   bool IsValid() const { return false; }
diff --git a/gfx/layers/ipc/ImageBridgeChild.cpp b/gfx/layers/ipc/ImageBridgeChild.cpp
index a2172c537dba..85cc57696768 100644
--- a/gfx/layers/ipc/ImageBridgeChild.cpp
+++ b/gfx/layers/ipc/ImageBridgeChild.cpp
@@ -101,7 +101,7 @@ struct CompositableTransaction
 };
 
 struct AutoEndTransaction {
-  AutoEndTransaction(CompositableTransaction* aTxn) : mTxn(aTxn) {}
+  explicit AutoEndTransaction(CompositableTransaction* aTxn) : mTxn(aTxn) {}
   ~AutoEndTransaction() { mTxn->End(); }
   CompositableTransaction* mTxn;
 };
@@ -464,7 +464,7 @@ ImageBridgeChild::BeginTransaction()
 class MOZ_STACK_CLASS AutoRemoveTextures
 {
 public:
-  AutoRemoveTextures(ImageBridgeChild* aImageBridge)
+  explicit AutoRemoveTextures(ImageBridgeChild* aImageBridge)
     : mImageBridge(aImageBridge) {}
 
   ~AutoRemoveTextures()
diff --git a/gfx/layers/ipc/ShadowLayerChild.h b/gfx/layers/ipc/ShadowLayerChild.h
index 71b36931ed57..ea7317a08d4e 100644
--- a/gfx/layers/ipc/ShadowLayerChild.h
+++ b/gfx/layers/ipc/ShadowLayerChild.h
@@ -20,7 +20,7 @@ class ShadowableLayer;
 class ShadowLayerChild : public PLayerChild
 {
 public:
-  ShadowLayerChild(ShadowableLayer* aLayer);
+  explicit ShadowLayerChild(ShadowableLayer* aLayer);
   virtual ~ShadowLayerChild();
 
   ShadowableLayer* layer() const { return mLayer; }
diff --git a/gfx/layers/ipc/ShadowLayers.cpp b/gfx/layers/ipc/ShadowLayers.cpp
index c9a15a4287cc..166660f6eba8 100644
--- a/gfx/layers/ipc/ShadowLayers.cpp
+++ b/gfx/layers/ipc/ShadowLayers.cpp
@@ -154,7 +154,7 @@ private:
   Transaction& operator=(const Transaction&);
 };
 struct AutoTxnEnd {
-  AutoTxnEnd(Transaction* aTxn) : mTxn(aTxn) {}
+  explicit AutoTxnEnd(Transaction* aTxn) : mTxn(aTxn) {}
   ~AutoTxnEnd() { mTxn->End(); }
   Transaction* mTxn;
 };
diff --git a/gfx/layers/ipc/SharedBufferManagerParent.cpp b/gfx/layers/ipc/SharedBufferManagerParent.cpp
index d1a3e022be93..69c2e1a9a32b 100644
--- a/gfx/layers/ipc/SharedBufferManagerParent.cpp
+++ b/gfx/layers/ipc/SharedBufferManagerParent.cpp
@@ -108,7 +108,7 @@ void InitGralloc() {
 class DeleteSharedBufferManagerParentTask : public Task
 {
 public:
-    DeleteSharedBufferManagerParentTask(UniquePtr<SharedBufferManagerParent> aSharedBufferManager)
+    explicit DeleteSharedBufferManagerParentTask(UniquePtr<SharedBufferManagerParent> aSharedBufferManager)
         : mSharedBufferManager(Move(aSharedBufferManager)) {
     }
     virtual void Run() MOZ_OVERRIDE {}
diff --git a/gfx/layers/ipc/SharedPlanarYCbCrImage.h b/gfx/layers/ipc/SharedPlanarYCbCrImage.h
index 23f03a3a4147..483e40c1c586 100644
--- a/gfx/layers/ipc/SharedPlanarYCbCrImage.h
+++ b/gfx/layers/ipc/SharedPlanarYCbCrImage.h
@@ -28,7 +28,7 @@ class SharedPlanarYCbCrImage : public PlanarYCbCrImage
                              , public ISharedImage
 {
 public:
-  SharedPlanarYCbCrImage(ImageClient* aCompositable);
+  explicit SharedPlanarYCbCrImage(ImageClient* aCompositable);
 
 protected:
   ~SharedPlanarYCbCrImage();
diff --git a/gfx/layers/ipc/SharedRGBImage.h b/gfx/layers/ipc/SharedRGBImage.h
index 69a919389220..e9aee420d375 100644
--- a/gfx/layers/ipc/SharedRGBImage.h
+++ b/gfx/layers/ipc/SharedRGBImage.h
@@ -40,7 +40,7 @@ class SharedRGBImage : public Image
                      , public ISharedImage
 {
 public:
-  SharedRGBImage(ImageClient* aCompositable);
+  explicit SharedRGBImage(ImageClient* aCompositable);
 
 protected:
   ~SharedRGBImage();
diff --git a/gfx/layers/opengl/CompositorOGL.cpp b/gfx/layers/opengl/CompositorOGL.cpp
index 648e79c45d26..a68a3f291fb3 100644
--- a/gfx/layers/opengl/CompositorOGL.cpp
+++ b/gfx/layers/opengl/CompositorOGL.cpp
@@ -474,8 +474,8 @@ DecomposeIntoNoRepeatRects(const Rect& aRect,
 
   // If we are dealing with wrapping br.x and br.y are greater than 1.0 so
   // wrap them here as well.
-  br = Point(xwrap ? WrapTexCoord(br.x) : br.x,
-             ywrap ? WrapTexCoord(br.y) : br.y);
+  br = Point(xwrap ? WrapTexCoord(br.x) : br.x.value,
+             ywrap ? WrapTexCoord(br.y) : br.y.value);
 
   // If we wrap around along the x axis, we will draw first from
   // tl.x .. 1.0 and then from 0.0 .. br.x (which we just wrapped above).
@@ -759,8 +759,7 @@ CompositorOGL::BeginFrame(const nsIntRegion& aInvalidRegion,
   // UI for its dynamic toolbar.
   IntPoint origin;
   if (!mTarget) {
-    origin.x = -mRenderOffset.x;
-    origin.y = -mRenderOffset.y;
+    origin = -TruncatedToInt(mRenderOffset.ToUnknownPoint());
   }
 
   mCurrentRenderTarget =
diff --git a/gfx/layers/opengl/CompositorOGL.h b/gfx/layers/opengl/CompositorOGL.h
index 4e959c06fa67..d858fa004533 100644
--- a/gfx/layers/opengl/CompositorOGL.h
+++ b/gfx/layers/opengl/CompositorOGL.h
@@ -85,7 +85,7 @@ public:
 class PerUnitTexturePoolOGL : public CompositorTexturePoolOGL
 {
 public:
-  PerUnitTexturePoolOGL(gl::GLContext* aGL)
+  explicit PerUnitTexturePoolOGL(gl::GLContext* aGL)
   : mTextureTarget(0) // zero is never a valid texture target
   , mGL(aGL)
   {}
@@ -124,7 +124,7 @@ protected:
 class PerFrameTexturePoolOGL : public CompositorTexturePoolOGL
 {
 public:
-  PerFrameTexturePoolOGL(gl::GLContext* aGL)
+  explicit PerFrameTexturePoolOGL(gl::GLContext* aGL)
   : mTextureTarget(0) // zero is never a valid texture target
   , mGL(aGL)
   {}
@@ -162,8 +162,8 @@ class CompositorOGL MOZ_FINAL : public Compositor
 
   std::map<ShaderConfigOGL, ShaderProgramOGL*> mPrograms;
 public:
-  CompositorOGL(nsIWidget *aWidget, int aSurfaceWidth = -1, int aSurfaceHeight = -1,
-                bool aUseExternalSurfaceSize = false);
+  explicit CompositorOGL(nsIWidget *aWidget, int aSurfaceWidth = -1, int aSurfaceHeight = -1,
+                         bool aUseExternalSurfaceSize = false);
 
 protected:
   virtual ~CompositorOGL();
diff --git a/gfx/layers/opengl/GLManager.cpp b/gfx/layers/opengl/GLManager.cpp
index 803aa4f18f5b..a1bd66af69b6 100644
--- a/gfx/layers/opengl/GLManager.cpp
+++ b/gfx/layers/opengl/GLManager.cpp
@@ -23,7 +23,7 @@ namespace layers {
 class GLManagerCompositor : public GLManager
 {
 public:
-  GLManagerCompositor(CompositorOGL* aCompositor)
+  explicit GLManagerCompositor(CompositorOGL* aCompositor)
     : mImpl(aCompositor)
   {}
 
diff --git a/gfx/layers/opengl/MacIOSurfaceTextureClientOGL.h b/gfx/layers/opengl/MacIOSurfaceTextureClientOGL.h
index db838bd491c4..b7353464337a 100644
--- a/gfx/layers/opengl/MacIOSurfaceTextureClientOGL.h
+++ b/gfx/layers/opengl/MacIOSurfaceTextureClientOGL.h
@@ -16,7 +16,7 @@ namespace layers {
 class MacIOSurfaceTextureClientOGL : public TextureClient
 {
 public:
-  MacIOSurfaceTextureClientOGL(TextureFlags aFlags);
+  explicit MacIOSurfaceTextureClientOGL(TextureFlags aFlags);
 
   virtual ~MacIOSurfaceTextureClientOGL();
 
diff --git a/gfx/layers/opengl/TextureClientOGL.h b/gfx/layers/opengl/TextureClientOGL.h
index f506854fea2c..97436ef52745 100644
--- a/gfx/layers/opengl/TextureClientOGL.h
+++ b/gfx/layers/opengl/TextureClientOGL.h
@@ -32,7 +32,7 @@ class CompositableForwarder;
 class SharedTextureClientOGL : public TextureClient
 {
 public:
-  SharedTextureClientOGL(TextureFlags aFlags);
+  explicit SharedTextureClientOGL(TextureFlags aFlags);
 
   ~SharedTextureClientOGL();
 
diff --git a/gfx/layers/opengl/TextureHostOGL.h b/gfx/layers/opengl/TextureHostOGL.h
index b9398ee77727..afaaab398454 100644
--- a/gfx/layers/opengl/TextureHostOGL.h
+++ b/gfx/layers/opengl/TextureHostOGL.h
@@ -212,8 +212,8 @@ class TextureImageTextureSourceOGL : public DataTextureSource
                                    , public BigImageIterator
 {
 public:
-  TextureImageTextureSourceOGL(gl::GLContext* aGL,
-                               TextureFlags aFlags = TextureFlags::DEFAULT)
+  explicit TextureImageTextureSourceOGL(gl::GLContext* aGL,
+                                        TextureFlags aFlags = TextureFlags::DEFAULT)
     : mGL(aGL)
     , mFlags(aFlags)
     , mIterating(false)
diff --git a/gfx/src/nsFont.cpp b/gfx/src/nsFont.cpp
index 1b0819f6947e..a51d9d7e37fe 100644
--- a/gfx/src/nsFont.cpp
+++ b/gfx/src/nsFont.cpp
@@ -19,27 +19,25 @@
 using namespace mozilla;
 
 nsFont::nsFont(const FontFamilyList& aFontlist, uint8_t aStyle,
-               uint8_t aVariant, uint16_t aWeight, int16_t aStretch,
+               uint16_t aWeight, int16_t aStretch,
                uint8_t aDecoration, nscoord aSize)
   : fontlist(aFontlist)
 {
   Init();
   style = aStyle;
-  variant = aVariant;
   weight = aWeight;
   stretch = aStretch;
   decorations = aDecoration;
   size = aSize;
 }
 
-nsFont::nsFont(FontFamilyType aGenericType, uint8_t aStyle, uint8_t aVariant,
+nsFont::nsFont(FontFamilyType aGenericType, uint8_t aStyle,
                uint16_t aWeight, int16_t aStretch, uint8_t aDecoration,
                nscoord aSize)
   : fontlist(aGenericType)
 {
   Init();
   style = aStyle;
-  variant = aVariant;
   weight = aWeight;
   stretch = aStretch;
   decorations = aDecoration;
@@ -68,7 +66,6 @@ nsFont::nsFont(const nsFont& aOther)
 {
   style = aOther.style;
   systemFont = aOther.systemFont;
-  variant = aOther.variant;
   weight = aOther.weight;
   stretch = aOther.stretch;
   decorations = aOther.decorations;
@@ -110,7 +107,6 @@ bool nsFont::BaseEquals(const nsFont& aOther) const
       (synthesis == aOther.synthesis) &&
       (fontFeatureSettings == aOther.fontFeatureSettings) &&
       (languageOverride == aOther.languageOverride) &&
-      (variant == aOther.variant) &&
       (variantAlternates == aOther.variantAlternates) &&
       (variantCaps == aOther.variantCaps) &&
       (variantEastAsian == aOther.variantEastAsian) &&
@@ -139,7 +135,6 @@ nsFont& nsFont::operator=(const nsFont& aOther)
   fontlist = aOther.fontlist;
   style = aOther.style;
   systemFont = aOther.systemFont;
-  variant = aOther.variant;
   weight = aOther.weight;
   stretch = aOther.stretch;
   decorations = aOther.decorations;
@@ -274,14 +269,7 @@ void nsFont::AddFontFeaturesToStyle(gfxFontStyle *aStyle) const
   aStyle->featureValueLookup = featureValueLookup;
 
   // -- caps
-  // passed into gfxFontStyle to deal with appropriate fallback.
-  // for now, font-variant setting overrides font-variant-caps
-  // when font-variant becomes a shorthand, this will be removed
-  if (variant == NS_FONT_VARIANT_SMALL_CAPS) {
-    aStyle->variantCaps = NS_FONT_VARIANT_CAPS_SMALLCAPS;
-  } else {
-    aStyle->variantCaps = variantCaps;
-  }
+  aStyle->variantCaps = variantCaps;
 
   // -- east-asian
   if (variantEastAsian) {
diff --git a/gfx/src/nsFont.h b/gfx/src/nsFont.h
index 8efece82fd07..fc076365f8cc 100644
--- a/gfx/src/nsFont.h
+++ b/gfx/src/nsFont.h
@@ -52,11 +52,7 @@ struct NS_GFX nsFont {
   // the name is the same as a CSS generic font family.
   bool systemFont;
 
-  // The variant of the font (normal, small-caps)
-  uint8_t variant;
-
   // Variant subproperties
-  // (currently -moz- versions, will replace variant above eventually)
   uint8_t variantCaps;
   uint8_t variantNumeric;
   uint8_t variantPosition;
@@ -116,11 +112,11 @@ struct NS_GFX nsFont {
 
   // initialize the font with a fontlist
   nsFont(const mozilla::FontFamilyList& aFontlist, uint8_t aStyle,
-         uint8_t aVariant, uint16_t aWeight, int16_t aStretch,
+         uint16_t aWeight, int16_t aStretch,
          uint8_t aDecoration, nscoord aSize);
 
   // initialize the font with a single generic
-  nsFont(mozilla::FontFamilyType aGenericType, uint8_t aStyle, uint8_t aVariant,
+  nsFont(mozilla::FontFamilyType aGenericType, uint8_t aStyle,
          uint16_t aWeight, int16_t aStretch, uint8_t aDecoration,
          nscoord aSize);
 
diff --git a/gfx/tests/gtest/TestAsyncPanZoomController.cpp b/gfx/tests/gtest/TestAsyncPanZoomController.cpp
index 58e5f78825ce..4762bede2712 100644
--- a/gfx/tests/gtest/TestAsyncPanZoomController.cpp
+++ b/gfx/tests/gtest/TestAsyncPanZoomController.cpp
@@ -30,14 +30,6 @@ using ::testing::InSequence;
 
 class Task;
 
-class APZCTreeManagerTester : public ::testing::Test {
-protected:
-  virtual void SetUp() {
-    gfxPrefs::GetSingleton();
-    AsyncPanZoomController::SetThreadAssertionsEnabled(false);
-  }
-};
-
 template<class T>
 class ScopedGfxPref {
 public:
@@ -152,6 +144,16 @@ public:
     ReentrantMonitorAutoEnter lock(mMonitor);
     EXPECT_EQ(NOTHING, mState);
   }
+
+  bool SampleContentTransformForFrame(const TimeStamp& aSampleTime,
+                                      ViewTransform* aOutTransform,
+                                      ScreenPoint& aScrollOffset,
+                                      ViewTransform* aOutOverscrollTransform = nullptr) {
+    bool ret = AdvanceAnimations(aSampleTime);
+    AsyncPanZoomController::SampleContentTransformForFrame(
+      aOutTransform, aScrollOffset, aOutOverscrollTransform);
+    return ret;
+  }
 };
 
 class TestAPZCTreeManager : public APZCTreeManager {
@@ -721,39 +723,39 @@ TEST_F(APZCBasicTester, ComplexTransform) {
   apzc->SetFrameMetrics(metrics);
   apzc->NotifyLayersUpdated(metrics, true);
   apzc->SampleContentTransformForFrame(testStartTime, &viewTransformOut, pointOut);
-  EXPECT_EQ(ViewTransform(LayerPoint(), ParentLayerToScreenScale(2)), viewTransformOut);
+  EXPECT_EQ(ViewTransform(ParentLayerToScreenScale(2), ScreenPoint()), viewTransformOut);
   EXPECT_EQ(ScreenPoint(60, 60), pointOut);
 
   childApzc->SetFrameMetrics(childMetrics);
   childApzc->NotifyLayersUpdated(childMetrics, true);
   childApzc->SampleContentTransformForFrame(testStartTime, &viewTransformOut, pointOut);
-  EXPECT_EQ(ViewTransform(LayerPoint(), ParentLayerToScreenScale(2)), viewTransformOut);
+  EXPECT_EQ(ViewTransform(ParentLayerToScreenScale(2), ScreenPoint()), viewTransformOut);
   EXPECT_EQ(ScreenPoint(60, 60), pointOut);
 
   // do an async scroll by 5 pixels and check the transform
   metrics.ScrollBy(CSSPoint(5, 0));
   apzc->SetFrameMetrics(metrics);
   apzc->SampleContentTransformForFrame(testStartTime, &viewTransformOut, pointOut);
-  EXPECT_EQ(ViewTransform(LayerPoint(-30, 0), ParentLayerToScreenScale(2)), viewTransformOut);
+  EXPECT_EQ(ViewTransform(ParentLayerToScreenScale(2), ScreenPoint(-30, 0)), viewTransformOut);
   EXPECT_EQ(ScreenPoint(90, 60), pointOut);
 
   childMetrics.ScrollBy(CSSPoint(5, 0));
   childApzc->SetFrameMetrics(childMetrics);
   childApzc->SampleContentTransformForFrame(testStartTime, &viewTransformOut, pointOut);
-  EXPECT_EQ(ViewTransform(LayerPoint(-30, 0), ParentLayerToScreenScale(2)), viewTransformOut);
+  EXPECT_EQ(ViewTransform(ParentLayerToScreenScale(2), ScreenPoint(-30, 0)), viewTransformOut);
   EXPECT_EQ(ScreenPoint(90, 60), pointOut);
 
   // do an async zoom of 1.5x and check the transform
   metrics.ZoomBy(1.5f);
   apzc->SetFrameMetrics(metrics);
   apzc->SampleContentTransformForFrame(testStartTime, &viewTransformOut, pointOut);
-  EXPECT_EQ(ViewTransform(LayerPoint(-30, 0), ParentLayerToScreenScale(3)), viewTransformOut);
+  EXPECT_EQ(ViewTransform(ParentLayerToScreenScale(3), ScreenPoint(-45, 0)), viewTransformOut);
   EXPECT_EQ(ScreenPoint(135, 90), pointOut);
 
   childMetrics.ZoomBy(1.5f);
   childApzc->SetFrameMetrics(childMetrics);
   childApzc->SampleContentTransformForFrame(testStartTime, &viewTransformOut, pointOut);
-  EXPECT_EQ(ViewTransform(LayerPoint(-30, 0), ParentLayerToScreenScale(3)), viewTransformOut);
+  EXPECT_EQ(ViewTransform(ParentLayerToScreenScale(3), ScreenPoint(-45, 0)), viewTransformOut);
   EXPECT_EQ(ScreenPoint(135, 90), pointOut);
 }
 
@@ -1000,92 +1002,6 @@ TEST_F(APZCFlingStopTester, FlingStopPreventDefault) {
   DoFlingStopWithSlowListener(true);
 }
 
-TEST_F(APZCBasicTester, OverScrollPanning) {
-  SCOPED_GFX_PREF(APZOverscrollEnabled, bool, true);
-
-  // Pan sufficiently to hit overscroll behavior
-  int time = 0;
-  int touchStart = 500;
-  int touchEnd = 10;
-  ApzcPan(apzc, time, touchStart, touchEnd);
-  EXPECT_TRUE(apzc->IsOverscrolled());
-
-  // Note that in the calls to SampleContentTransformForFrame below, the time
-  // increment used is sufficiently large for the animation to have completed. However,
-  // any single call to SampleContentTransformForFrame will not finish an animation
-  // *and* also proceed through the following animation, if there is one.
-  // Therefore the minimum number of calls to go from an overscroll-inducing pan
-  // to a reset state is 3; these are documented further below.
-
-  ScreenPoint pointOut;
-  ViewTransform viewTransformOut;
-
-  // This sample will run to the end of the non-overscrolling fling animation
-  // and will schedule the overscrolling fling animation.
-  apzc->SampleContentTransformForFrame(testStartTime + TimeDuration::FromMilliseconds(10000), &viewTransformOut, pointOut);
-  EXPECT_EQ(ScreenPoint(0, 90), pointOut);
-  EXPECT_TRUE(apzc->IsOverscrolled());
-
-  // This sample will run to the end of the overscrolling fling animation and
-  // will schedule the snapback animation.
-  apzc->SampleContentTransformForFrame(testStartTime + TimeDuration::FromMilliseconds(20000), &viewTransformOut, pointOut);
-  EXPECT_EQ(ScreenPoint(0, 90), pointOut);
-  EXPECT_TRUE(apzc->IsOverscrolled());
-
-  // This sample will run to the end of the snapback animation and reset the state.
-  apzc->SampleContentTransformForFrame(testStartTime + TimeDuration::FromMilliseconds(30000), &viewTransformOut, pointOut);
-  EXPECT_EQ(ScreenPoint(0, 90), pointOut);
-  EXPECT_FALSE(apzc->IsOverscrolled());
-
-  apzc->AssertStateIsReset();
-}
-
-TEST_F(APZCBasicTester, OverScrollAbort) {
-  SCOPED_GFX_PREF(APZOverscrollEnabled, bool, true);
-
-  // Pan sufficiently to hit overscroll behavior
-  int time = 0;
-  int touchStart = 500;
-  int touchEnd = 10;
-  ApzcPan(apzc, time, touchStart, touchEnd);
-  EXPECT_TRUE(apzc->IsOverscrolled());
-
-  ScreenPoint pointOut;
-  ViewTransform viewTransformOut;
-
-  // This sample call will run to the end of the non-overscrolling fling animation
-  // and will schedule the overscrolling fling animation (see comment in OverScrollPanning
-  // above for more explanation).
-  apzc->SampleContentTransformForFrame(testStartTime + TimeDuration::FromMilliseconds(10000), &viewTransformOut, pointOut);
-  EXPECT_TRUE(apzc->IsOverscrolled());
-
-  // At this point, we have an active overscrolling fling animation.
-  // Check that cancelling the animation clears the overscroll.
-  apzc->CancelAnimation();
-  EXPECT_FALSE(apzc->IsOverscrolled());
-  apzc->AssertStateIsReset();
-}
-
-TEST_F(APZCBasicTester, OverScrollPanningAbort) {
-  SCOPED_GFX_PREF(APZOverscrollEnabled, bool, true);
-
-  // Pan sufficiently to hit overscroll behaviour. Keep the finger down so
-  // the pan does not end.
-  int time = 0;
-  int touchStart = 500;
-  int touchEnd = 10;
-  ApzcPan(apzc, time, touchStart, touchEnd,
-          true);                   // keep finger down
-  EXPECT_TRUE(apzc->IsOverscrolled());
-
-  // Check that calling CancelAnimation() while the user is still panning
-  // (and thus no fling or snap-back animation has had a chance to start)
-  // clears the overscroll.
-  apzc->CancelAnimation();
-  EXPECT_FALSE(apzc->IsOverscrolled());
-  apzc->AssertStateIsReset();
-}
-
 TEST_F(APZCGestureDetectorTester, ShortPress) {
   MakeApzcUnzoomable();
 
@@ -1399,92 +1315,139 @@ TEST_F(APZCGestureDetectorTester, DoubleTapPreventDefaultBoth) {
   apzc->AssertStateIsReset();
 }
 
-// Layer tree for HitTesting1
-static already_AddRefed<mozilla::layers::Layer>
-CreateTestLayerTree1(nsRefPtr<LayerManager>& aLayerManager, nsTArray<nsRefPtr<Layer> >& aLayers) {
-  const char* layerTreeSyntax = "c(ttcc)";
-  // LayerID                     0 1234
-  nsIntRegion layerVisibleRegion[] = {
-    nsIntRegion(nsIntRect(0,0,100,100)),
-    nsIntRegion(nsIntRect(0,0,100,100)),
-    nsIntRegion(nsIntRect(10,10,20,20)),
-    nsIntRegion(nsIntRect(10,10,20,20)),
-    nsIntRegion(nsIntRect(5,5,20,20)),
-  };
-  Matrix4x4 transforms[] = {
-    Matrix4x4(),
-    Matrix4x4(),
-    Matrix4x4(),
-    Matrix4x4(),
-    Matrix4x4(),
-  };
-  return CreateLayerTree(layerTreeSyntax, layerVisibleRegion, transforms, aLayerManager, aLayers);
-}
+class APZCTreeManagerTester : public ::testing::Test {
+protected:
+  virtual void SetUp() {
+    gfxPrefs::GetSingleton();
+    AsyncPanZoomController::SetThreadAssertionsEnabled(false);
 
-// Layer Tree for HitTesting2
-static already_AddRefed<mozilla::layers::Layer>
-CreateTestLayerTree2(nsRefPtr<LayerManager>& aLayerManager, nsTArray<nsRefPtr<Layer> >& aLayers) {
-  const char* layerTreeSyntax = "c(cc(c))";
-  // LayerID                     0 12 3
-  nsIntRegion layerVisibleRegion[] = {
-    nsIntRegion(nsIntRect(0,0,100,100)),
-    nsIntRegion(nsIntRect(10,10,40,40)),
-    nsIntRegion(nsIntRect(10,60,40,40)),
-    nsIntRegion(nsIntRect(10,60,40,40)),
-  };
-  Matrix4x4 transforms[] = {
-    Matrix4x4(),
-    Matrix4x4(),
-    Matrix4x4(),
-    Matrix4x4(),
-  };
-  return CreateLayerTree(layerTreeSyntax, layerVisibleRegion, transforms, aLayerManager, aLayers);
-}
+    TimeStamp testStartTime = TimeStamp::Now();
+    AsyncPanZoomController::SetFrameTime(testStartTime);
 
-static void
-SetScrollableFrameMetrics(Layer* aLayer, FrameMetrics::ViewID aScrollId,
-                          // The scrollable rect is only used in HitTesting2,
-                          // HitTesting1 doesn't care about it.
-                          CSSRect aScrollableRect = CSSRect(-1, -1, -1, -1))
-{
-  FrameMetrics metrics;
-  metrics.SetScrollId(aScrollId);
-  nsIntRect layerBound = aLayer->GetVisibleRegion().GetBounds();
-  metrics.mCompositionBounds = ParentLayerRect(layerBound.x, layerBound.y,
-                                               layerBound.width, layerBound.height);
-  metrics.mScrollableRect = aScrollableRect;
-  metrics.SetScrollOffset(CSSPoint(0, 0));
-  aLayer->SetFrameMetrics(metrics);
-}
-
-static already_AddRefed<AsyncPanZoomController>
-GetTargetAPZC(APZCTreeManager* manager, const ScreenPoint& aPoint,
-              Matrix4x4& aTransformToApzcOut, Matrix4x4& aTransformToGeckoOut)
-{
-  nsRefPtr<AsyncPanZoomController> hit = manager->GetTargetAPZC(aPoint, nullptr);
-  if (hit) {
-    manager->GetInputTransforms(hit.get(), aTransformToApzcOut, aTransformToGeckoOut);
+    mcc = new NiceMock<MockContentController>();
+    manager = new TestAPZCTreeManager();
   }
-  return hit.forget();
-}
 
-// A simple hit testing test that doesn't involve any transforms on layers.
-TEST_F(APZCTreeManagerTester, HitTesting1) {
+  virtual void TearDown() {
+    manager->ClearTree();
+  }
+
+  TimeStamp testStartTime;
+  nsRefPtr<MockContentController> mcc;
+
   nsTArray<nsRefPtr<Layer> > layers;
   nsRefPtr<LayerManager> lm;
-  nsRefPtr<Layer> root = CreateTestLayerTree1(lm, layers);
+  nsRefPtr<Layer> root;
 
-  TimeStamp testStartTime = TimeStamp::Now();
-  AsyncPanZoomController::SetFrameTime(testStartTime);
-  nsRefPtr<MockContentController> mcc = new NiceMock<MockContentController>();
-  ScopedLayerTreeRegistration controller(0, root, mcc);
+  nsRefPtr<TestAPZCTreeManager> manager;
 
-  nsRefPtr<APZCTreeManager> manager = new TestAPZCTreeManager();
+protected:
+  static void SetScrollableFrameMetrics(Layer* aLayer, FrameMetrics::ViewID aScrollId,
+                                        // The scrollable rect is only used in HitTesting2,
+                                        // HitTesting1 doesn't care about it.
+                                        CSSRect aScrollableRect = CSSRect(-1, -1, -1, -1)) {
+    FrameMetrics metrics;
+    metrics.SetScrollId(aScrollId);
+    nsIntRect layerBound = aLayer->GetVisibleRegion().GetBounds();
+    metrics.mCompositionBounds = ParentLayerRect(layerBound.x, layerBound.y,
+                                                 layerBound.width, layerBound.height);
+    metrics.mScrollableRect = aScrollableRect;
+    metrics.SetScrollOffset(CSSPoint(0, 0));
+    aLayer->SetFrameMetrics(metrics);
+  }
+
+  void CreateSimpleMultiLayerTree() {
+    const char* layerTreeSyntax = "c(tt)";
+    // LayerID                     0 12
+    nsIntRegion layerVisibleRegion[] = {
+      nsIntRegion(nsIntRect(0,0,100,100)),
+      nsIntRegion(nsIntRect(0,0,100,50)),
+      nsIntRegion(nsIntRect(0,50,100,50)),
+    };
+    root = CreateLayerTree(layerTreeSyntax, layerVisibleRegion, nullptr, lm, layers);
+  }
+};
+
+class APZHitTestingTester : public APZCTreeManagerTester {
+protected:
   Matrix4x4 transformToApzc;
   Matrix4x4 transformToGecko;
 
+  already_AddRefed<AsyncPanZoomController> GetTargetAPZC(const ScreenPoint& aPoint) {
+    nsRefPtr<AsyncPanZoomController> hit = manager->GetTargetAPZC(aPoint, nullptr);
+    if (hit) {
+      manager->GetInputTransforms(hit.get(), transformToApzc, transformToGecko);
+    }
+    return hit.forget();
+  }
+
+protected:
+  void CreateHitTesting1LayerTree() {
+    const char* layerTreeSyntax = "c(ttcc)";
+    // LayerID                     0 1234
+    nsIntRegion layerVisibleRegion[] = {
+      nsIntRegion(nsIntRect(0,0,100,100)),
+      nsIntRegion(nsIntRect(0,0,100,100)),
+      nsIntRegion(nsIntRect(10,10,20,20)),
+      nsIntRegion(nsIntRect(10,10,20,20)),
+      nsIntRegion(nsIntRect(5,5,20,20)),
+    };
+    root = CreateLayerTree(layerTreeSyntax, layerVisibleRegion, nullptr, lm, layers);
+  }
+
+  void CreateHitTesting2LayerTree() {
+    const char* layerTreeSyntax = "c(cc(c))";
+    // LayerID                     0 12 3
+    nsIntRegion layerVisibleRegion[] = {
+      nsIntRegion(nsIntRect(0,0,100,100)),
+      nsIntRegion(nsIntRect(10,10,40,40)),
+      nsIntRegion(nsIntRect(10,60,40,40)),
+      nsIntRegion(nsIntRect(10,60,40,40)),
+    };
+    Matrix4x4 transforms[] = {
+      Matrix4x4(),
+      Matrix4x4(),
+      Matrix4x4().Scale(2, 1, 1),
+      Matrix4x4(),
+    };
+    root = CreateLayerTree(layerTreeSyntax, layerVisibleRegion, transforms, lm, layers);
+
+    SetScrollableFrameMetrics(root, FrameMetrics::START_SCROLL_ID, CSSRect(0, 0, 200, 200));
+    SetScrollableFrameMetrics(layers[1], FrameMetrics::START_SCROLL_ID + 1, CSSRect(0, 0, 80, 80));
+    SetScrollableFrameMetrics(layers[3], FrameMetrics::START_SCROLL_ID + 2, CSSRect(0, 0, 80, 80));
+  }
+
+  void CreateComplexMultiLayerTree() {
+    const char* layerTreeSyntax = "c(tc(t)tc(c(t)t))";
+    // LayerID                     0 12 3 45 6 7 8
+    nsIntRegion layerVisibleRegion[] = {
+      nsIntRegion(nsIntRect(0,0,300,400)),      // root(0)
+      nsIntRegion(nsIntRect(0,0,100,100)),      // thebes(1) in top-left
+      nsIntRegion(nsIntRect(50,50,200,300)),    // container(2) centered in root(0)
+      nsIntRegion(nsIntRect(50,50,200,300)),    // thebes(3) fully occupying parent container(2)
+      nsIntRegion(nsIntRect(0,200,100,100)),    // thebes(4) in bottom-left
+      nsIntRegion(nsIntRect(200,0,100,400)),    // container(5) along the right 100px of root(0)
+      nsIntRegion(nsIntRect(200,0,100,200)),    // container(6) taking up the top half of parent container(5)
+      nsIntRegion(nsIntRect(200,0,100,200)),    // thebes(7) fully occupying parent container(6)
+      nsIntRegion(nsIntRect(200,200,100,200)),  // thebes(8) in bottom-right
+    };
+    root = CreateLayerTree(layerTreeSyntax, layerVisibleRegion, nullptr, lm, layers);
+    SetScrollableFrameMetrics(layers[1], FrameMetrics::START_SCROLL_ID);
+    SetScrollableFrameMetrics(layers[2], FrameMetrics::START_SCROLL_ID);
+    SetScrollableFrameMetrics(layers[4], FrameMetrics::START_SCROLL_ID + 1);
+    SetScrollableFrameMetrics(layers[6], FrameMetrics::START_SCROLL_ID + 1);
+    SetScrollableFrameMetrics(layers[7], FrameMetrics::START_SCROLL_ID + 2);
+    SetScrollableFrameMetrics(layers[8], FrameMetrics::START_SCROLL_ID + 3);
+  }
+};
+
+// A simple hit testing test that doesn't involve any transforms on layers.
+TEST_F(APZHitTestingTester, HitTesting1) {
+  CreateHitTesting1LayerTree();
+  ScopedLayerTreeRegistration registration(0, root, mcc);
+
   // No APZC attached so hit testing will return no APZC at (20,20)
-  nsRefPtr<AsyncPanZoomController> hit = GetTargetAPZC(manager, ScreenPoint(20, 20), transformToApzc, transformToGecko);
+  nsRefPtr<AsyncPanZoomController> hit = GetTargetAPZC(ScreenPoint(20, 20));
   AsyncPanZoomController* nullAPZC = nullptr;
   EXPECT_EQ(nullAPZC, hit.get());
   EXPECT_EQ(Matrix4x4(), transformToApzc);
@@ -1495,7 +1458,7 @@ TEST_F(APZCTreeManagerTester, HitTesting1) {
   // Now we have a root APZC that will match the page
   SetScrollableFrameMetrics(root, FrameMetrics::START_SCROLL_ID);
   manager->UpdatePanZoomControllerTree(nullptr, root, false, 0, paintSequenceNumber++);
-  hit = GetTargetAPZC(manager, ScreenPoint(15, 15), transformToApzc, transformToGecko);
+  hit = GetTargetAPZC(ScreenPoint(15, 15));
   EXPECT_EQ(root->GetAsyncPanZoomController(), hit.get());
   // expect hit point at LayerIntPoint(15, 15)
   EXPECT_EQ(Point(15, 15), transformToApzc * Point(15, 15));
@@ -1505,7 +1468,7 @@ TEST_F(APZCTreeManagerTester, HitTesting1) {
   SetScrollableFrameMetrics(layers[3], FrameMetrics::START_SCROLL_ID + 1);
   manager->UpdatePanZoomControllerTree(nullptr, root, false, 0, paintSequenceNumber++);
   EXPECT_NE(root->GetAsyncPanZoomController(), layers[3]->GetAsyncPanZoomController());
-  hit = GetTargetAPZC(manager, ScreenPoint(25, 25), transformToApzc, transformToGecko);
+  hit = GetTargetAPZC(ScreenPoint(25, 25));
   EXPECT_EQ(layers[3]->GetAsyncPanZoomController(), hit.get());
   // expect hit point at LayerIntPoint(25, 25)
   EXPECT_EQ(Point(25, 25), transformToApzc * Point(25, 25));
@@ -1513,63 +1476,40 @@ TEST_F(APZCTreeManagerTester, HitTesting1) {
 
   // At this point, layers[4] obscures layers[3] at the point (15, 15) so
   // hitting there should hit the root APZC
-  hit = GetTargetAPZC(manager, ScreenPoint(15, 15), transformToApzc, transformToGecko);
+  hit = GetTargetAPZC(ScreenPoint(15, 15));
   EXPECT_EQ(root->GetAsyncPanZoomController(), hit.get());
 
   // Now test hit testing when we have two scrollable layers
   SetScrollableFrameMetrics(layers[4], FrameMetrics::START_SCROLL_ID + 2);
   manager->UpdatePanZoomControllerTree(nullptr, root, false, 0, paintSequenceNumber++);
-  hit = GetTargetAPZC(manager, ScreenPoint(15, 15), transformToApzc, transformToGecko);
+  hit = GetTargetAPZC(ScreenPoint(15, 15));
   EXPECT_EQ(layers[4]->GetAsyncPanZoomController(), hit.get());
   // expect hit point at LayerIntPoint(15, 15)
   EXPECT_EQ(Point(15, 15), transformToApzc * Point(15, 15));
   EXPECT_EQ(Point(15, 15), transformToGecko * Point(15, 15));
 
   // Hit test ouside the reach of layer[3,4] but inside root
-  hit = GetTargetAPZC(manager, ScreenPoint(90, 90), transformToApzc, transformToGecko);
+  hit = GetTargetAPZC(ScreenPoint(90, 90));
   EXPECT_EQ(root->GetAsyncPanZoomController(), hit.get());
   // expect hit point at LayerIntPoint(90, 90)
   EXPECT_EQ(Point(90, 90), transformToApzc * Point(90, 90));
   EXPECT_EQ(Point(90, 90), transformToGecko * Point(90, 90));
 
   // Hit test ouside the reach of any layer
-  hit = GetTargetAPZC(manager, ScreenPoint(1000, 10), transformToApzc, transformToGecko);
+  hit = GetTargetAPZC(ScreenPoint(1000, 10));
   EXPECT_EQ(nullAPZC, hit.get());
   EXPECT_EQ(Matrix4x4(), transformToApzc);
   EXPECT_EQ(Matrix4x4(), transformToGecko);
-  hit = GetTargetAPZC(manager, ScreenPoint(-1000, 10), transformToApzc, transformToGecko);
+  hit = GetTargetAPZC(ScreenPoint(-1000, 10));
   EXPECT_EQ(nullAPZC, hit.get());
   EXPECT_EQ(Matrix4x4(), transformToApzc);
   EXPECT_EQ(Matrix4x4(), transformToGecko);
-
-  manager->ClearTree();
 }
 
 // A more involved hit testing test that involves css and async transforms.
-TEST_F(APZCTreeManagerTester, HitTesting2) {
-  nsTArray<nsRefPtr<Layer> > layers;
-  nsRefPtr<LayerManager> lm;
-  nsRefPtr<Layer> root = CreateTestLayerTree2(lm, layers);
-
-  TimeStamp testStartTime = TimeStamp::Now();
-  AsyncPanZoomController::SetFrameTime(testStartTime);
-  nsRefPtr<MockContentController> mcc = new NiceMock<MockContentController>();
-  ScopedLayerTreeRegistration controller(0, root, mcc);
-
-  nsRefPtr<TestAPZCTreeManager> manager = new TestAPZCTreeManager();
-  nsRefPtr<AsyncPanZoomController> hit;
-  Matrix4x4 transformToApzc;
-  Matrix4x4 transformToGecko;
-
-  // Set a CSS transform on one of the layers.
-  Matrix4x4 transform;
-  transform = transform * Matrix4x4().Scale(2, 1, 1);
-  layers[2]->SetBaseTransform(transform);
-
-  // Make some other layers scrollable.
-  SetScrollableFrameMetrics(root, FrameMetrics::START_SCROLL_ID, CSSRect(0, 0, 200, 200));
-  SetScrollableFrameMetrics(layers[1], FrameMetrics::START_SCROLL_ID + 1, CSSRect(0, 0, 80, 80));
-  SetScrollableFrameMetrics(layers[3], FrameMetrics::START_SCROLL_ID + 2, CSSRect(0, 0, 80, 80));
+TEST_F(APZHitTestingTester, HitTesting2) {
+  CreateHitTesting2LayerTree();
+  ScopedLayerTreeRegistration registration(0, root, mcc);
 
   manager->UpdatePanZoomControllerTree(nullptr, root, false, 0, 0);
 
@@ -1584,7 +1524,7 @@ TEST_F(APZCTreeManagerTester, HitTesting2) {
   AsyncPanZoomController* apzc3 = layers[3]->GetAsyncPanZoomController();
 
   // Hit an area that's clearly on the root layer but not any of the child layers.
-  hit = GetTargetAPZC(manager, ScreenPoint(75, 25), transformToApzc, transformToGecko);
+  nsRefPtr<AsyncPanZoomController> hit = GetTargetAPZC(ScreenPoint(75, 25));
   EXPECT_EQ(apzcroot, hit.get());
   EXPECT_EQ(Point(75, 25), transformToApzc * Point(75, 25));
   EXPECT_EQ(Point(75, 25), transformToGecko * Point(75, 25));
@@ -1596,19 +1536,19 @@ TEST_F(APZCTreeManagerTester, HitTesting2) {
   // scale-only transform that we set on layers[2] would be invalid because
   // it would place the layer into overscroll, as its composition bounds
   // start at x=10 but its content at x=20).
-  hit = GetTargetAPZC(manager, ScreenPoint(15, 75), transformToApzc, transformToGecko);
+  hit = GetTargetAPZC(ScreenPoint(15, 75));
   EXPECT_EQ(apzcroot, hit.get());
   EXPECT_EQ(Point(15, 75), transformToApzc * Point(15, 75));
   EXPECT_EQ(Point(15, 75), transformToGecko * Point(15, 75));
 
   // Hit an area on layers[1].
-  hit = GetTargetAPZC(manager, ScreenPoint(25, 25), transformToApzc, transformToGecko);
+  hit = GetTargetAPZC(ScreenPoint(25, 25));
   EXPECT_EQ(apzc1, hit.get());
   EXPECT_EQ(Point(25, 25), transformToApzc * Point(25, 25));
   EXPECT_EQ(Point(25, 25), transformToGecko * Point(25, 25));
 
   // Hit an area on layers[3].
-  hit = GetTargetAPZC(manager, ScreenPoint(25, 75), transformToApzc, transformToGecko);
+  hit = GetTargetAPZC(ScreenPoint(25, 75));
   EXPECT_EQ(apzc3, hit.get());
   // transformToApzc should unapply layers[2]'s transform
   EXPECT_EQ(Point(12.5, 75), transformToApzc * Point(25, 75));
@@ -1617,7 +1557,7 @@ TEST_F(APZCTreeManagerTester, HitTesting2) {
 
   // Hit an area on layers[3] that would be on the root if layers[2]
   // weren't transformed.
-  hit = GetTargetAPZC(manager, ScreenPoint(75, 75), transformToApzc, transformToGecko);
+  hit = GetTargetAPZC(ScreenPoint(75, 75));
   EXPECT_EQ(apzc3, hit.get());
   // transformToApzc should unapply layers[2]'s transform
   EXPECT_EQ(Point(37.5, 75), transformToApzc * Point(75, 75));
@@ -1639,7 +1579,7 @@ TEST_F(APZCTreeManagerTester, HitTesting2) {
   ApzcPanNoFling(apzcroot, time, 100, 50);
 
   // Hit where layers[3] used to be. It should now hit the root.
-  hit = GetTargetAPZC(manager, ScreenPoint(75, 75), transformToApzc, transformToGecko);
+  hit = GetTargetAPZC(ScreenPoint(75, 75));
   EXPECT_EQ(apzcroot, hit.get());
   // transformToApzc doesn't unapply the root's own async transform
   EXPECT_EQ(Point(75, 75), transformToApzc * Point(75, 75));
@@ -1649,7 +1589,7 @@ TEST_F(APZCTreeManagerTester, HitTesting2) {
   EXPECT_EQ(Point(75, 75), transformToGecko * Point(75, 75));
 
   // Hit where layers[1] used to be and where layers[3] should now be.
-  hit = GetTargetAPZC(manager, ScreenPoint(25, 25), transformToApzc, transformToGecko);
+  hit = GetTargetAPZC(ScreenPoint(25, 25));
   EXPECT_EQ(apzc3, hit.get());
   // transformToApzc unapplies both layers[2]'s css transform and the root's
   // async transform
@@ -1665,7 +1605,7 @@ TEST_F(APZCTreeManagerTester, HitTesting2) {
   ApzcPanNoFling(apzcroot, time, 100, 50);
 
   // Hit where layers[3] used to be. It should now hit the root.
-  hit = GetTargetAPZC(manager, ScreenPoint(75, 75), transformToApzc, transformToGecko);
+  hit = GetTargetAPZC(ScreenPoint(75, 75));
   EXPECT_EQ(apzcroot, hit.get());
   // transformToApzc doesn't unapply the root's own async transform
   EXPECT_EQ(Point(75, 75), transformToApzc * Point(75, 75));
@@ -1674,15 +1614,76 @@ TEST_F(APZCTreeManagerTester, HitTesting2) {
   EXPECT_EQ(Point(75, 125), transformToGecko * Point(75, 75));
 
   // Hit where layers[1] used to be. It should now hit the root.
-  hit = GetTargetAPZC(manager, ScreenPoint(25, 25), transformToApzc, transformToGecko);
+  hit = GetTargetAPZC(ScreenPoint(25, 25));
   EXPECT_EQ(apzcroot, hit.get());
   // transformToApzc doesn't unapply the root's own async transform
   EXPECT_EQ(Point(25, 25), transformToApzc * Point(25, 25));
   // transformToGecko unapplies the full async transform of -100 pixels, and then
   // reapplies the "D" transform of -50 leading to an overall adjustment of +50
   EXPECT_EQ(Point(25, 75), transformToGecko * Point(25, 25));
+}
 
-  manager->ClearTree();
+TEST_F(APZCTreeManagerTester, ScrollableThebesLayers) {
+  CreateSimpleMultiLayerTree();
+  ScopedLayerTreeRegistration registration(0, root, mcc);
+
+  // both layers have the same scrollId
+  SetScrollableFrameMetrics(layers[1], FrameMetrics::START_SCROLL_ID);
+  SetScrollableFrameMetrics(layers[2], FrameMetrics::START_SCROLL_ID);
+  manager->UpdatePanZoomControllerTree(nullptr, root, false, 0, 0);
+
+  AsyncPanZoomController* nullAPZC = nullptr;
+  // so they should have the same APZC
+  EXPECT_EQ(nullAPZC, layers[0]->GetAsyncPanZoomController());
+  EXPECT_NE(nullAPZC, layers[1]->GetAsyncPanZoomController());
+  EXPECT_NE(nullAPZC, layers[2]->GetAsyncPanZoomController());
+  EXPECT_EQ(layers[1]->GetAsyncPanZoomController(), layers[2]->GetAsyncPanZoomController());
+
+  // Change the scrollId of layers[1], and verify the APZC changes
+  SetScrollableFrameMetrics(layers[1], FrameMetrics::START_SCROLL_ID + 1);
+  manager->UpdatePanZoomControllerTree(nullptr, root, false, 0, 0);
+  EXPECT_NE(layers[1]->GetAsyncPanZoomController(), layers[2]->GetAsyncPanZoomController());
+
+  // Change the scrollId of layers[2] to match that of layers[1], ensure we get the same
+  // APZC for both again
+  SetScrollableFrameMetrics(layers[2], FrameMetrics::START_SCROLL_ID + 1);
+  manager->UpdatePanZoomControllerTree(nullptr, root, false, 0, 0);
+  EXPECT_EQ(layers[1]->GetAsyncPanZoomController(), layers[2]->GetAsyncPanZoomController());
+}
+
+TEST_F(APZHitTestingTester, ComplexMultiLayerTree) {
+  CreateComplexMultiLayerTree();
+  ScopedLayerTreeRegistration registration(0, root, mcc);
+  manager->UpdatePanZoomControllerTree(nullptr, root, false, 0, 0);
+
+  AsyncPanZoomController* nullAPZC = nullptr;
+  // Ensure all the scrollable layers have an APZC
+  EXPECT_EQ(nullAPZC, layers[0]->GetAsyncPanZoomController());
+  EXPECT_NE(nullAPZC, layers[1]->GetAsyncPanZoomController());
+  EXPECT_NE(nullAPZC, layers[2]->GetAsyncPanZoomController());
+  EXPECT_EQ(nullAPZC, layers[3]->GetAsyncPanZoomController());
+  EXPECT_NE(nullAPZC, layers[4]->GetAsyncPanZoomController());
+  EXPECT_EQ(nullAPZC, layers[5]->GetAsyncPanZoomController());
+  EXPECT_NE(nullAPZC, layers[6]->GetAsyncPanZoomController());
+  EXPECT_NE(nullAPZC, layers[7]->GetAsyncPanZoomController());
+  EXPECT_NE(nullAPZC, layers[8]->GetAsyncPanZoomController());
+  // Ensure those that scroll together have the same APZCs
+  EXPECT_EQ(layers[1]->GetAsyncPanZoomController(), layers[2]->GetAsyncPanZoomController());
+  EXPECT_EQ(layers[4]->GetAsyncPanZoomController(), layers[6]->GetAsyncPanZoomController());
+  // Ensure those that don't scroll together have different APZCs
+  EXPECT_NE(layers[1]->GetAsyncPanZoomController(), layers[4]->GetAsyncPanZoomController());
+  EXPECT_NE(layers[1]->GetAsyncPanZoomController(), layers[7]->GetAsyncPanZoomController());
+  EXPECT_NE(layers[1]->GetAsyncPanZoomController(), layers[8]->GetAsyncPanZoomController());
+  EXPECT_NE(layers[4]->GetAsyncPanZoomController(), layers[7]->GetAsyncPanZoomController());
+  EXPECT_NE(layers[4]->GetAsyncPanZoomController(), layers[8]->GetAsyncPanZoomController());
+  EXPECT_NE(layers[7]->GetAsyncPanZoomController(), layers[8]->GetAsyncPanZoomController());
+
+  nsRefPtr<AsyncPanZoomController> hit = GetTargetAPZC(ScreenPoint(25, 25));
+  EXPECT_EQ(layers[1]->GetAsyncPanZoomController(), hit.get());
+  hit = GetTargetAPZC(ScreenPoint(275, 375));
+  EXPECT_EQ(layers[8]->GetAsyncPanZoomController(), hit.get());
+  hit = GetTargetAPZC(ScreenPoint(250, 100));
+  EXPECT_EQ(layers[7]->GetAsyncPanZoomController(), hit.get());
 }
 
 class TaskRunMetrics {
diff --git a/gfx/thebes/gfxPlatformMac.cpp b/gfx/thebes/gfxPlatformMac.cpp
index 049012207067..8aead2a4bb25 100644
--- a/gfx/thebes/gfxPlatformMac.cpp
+++ b/gfx/thebes/gfxPlatformMac.cpp
@@ -303,11 +303,11 @@ gfxPlatformMac::GetCommonFallbackFonts(const uint32_t aCh,
         case 0x2a:
         case 0x2b:
         case 0x2e:
+            aFontList.AppendElement(kFontHiraginoKakuGothic);
             aFontList.AppendElement(kFontAppleSymbols);
             aFontList.AppendElement(kFontMenlo);
             aFontList.AppendElement(kFontSTIXGeneral);
             aFontList.AppendElement(kFontGeneva);
-            aFontList.AppendElement(kFontHiraginoKakuGothic);
             aFontList.AppendElement(kFontAppleColorEmoji);
             break;
         case 0x2c:
diff --git a/image/src/imgFrame.cpp b/image/src/imgFrame.cpp
index 662218f2b36f..b46b942f342c 100644
--- a/image/src/imgFrame.cpp
+++ b/image/src/imgFrame.cpp
@@ -181,6 +181,11 @@ nsresult imgFrame::Init(int32_t aX, int32_t aY, int32_t aWidth, int32_t aHeight,
       if (!mVBuf) {
         return NS_ERROR_OUT_OF_MEMORY;
       }
+      if (mVBuf->OnHeap()) {
+        int32_t stride = VolatileSurfaceStride(mSize, mFormat);
+        VolatileBufferPtr<uint8_t> ptr(mVBuf);
+        memset(ptr, 0, stride * mSize.height);
+      }
       mImageSurface = CreateLockedSurface(mVBuf, mSize, mFormat);
     }
 
diff --git a/js/public/Value.h b/js/public/Value.h
index e0dd6c335b5f..d8ec20f38f79 100644
--- a/js/public/Value.h
+++ b/js/public/Value.h
@@ -1693,7 +1693,7 @@ class ValueOperations
     JS::Symbol *toSymbol() const { return value()->toSymbol(); }
     JSObject &toObject() const { return value()->toObject(); }
     JSObject *toObjectOrNull() const { return value()->toObjectOrNull(); }
-    void *toGCThing() const { return value()->toGCThing(); }
+    gc::Cell *toGCThing() const { return value()->toGCThing(); }
     uint64_t asRawBits() const { return value()->asRawBits(); }
 
     JSValueType extractNonDoubleType() const { return value()->extractNonDoubleType(); }
diff --git a/js/src/builtin/Object.js b/js/src/builtin/Object.js
index adafe0bf5358..d3ecc3dbb11d 100644
--- a/js/src/builtin/Object.js
+++ b/js/src/builtin/Object.js
@@ -14,8 +14,14 @@ function ObjectStaticAssign(target, firstSource) {
     // Step 4.
     var i = 1;
     do {
-        // Step 5.a-b.
+        // Step 5.a-b, plus an unspecified flourish to skip null/undefined, so
+        // any site depending on agreed-upon (but not-yet-drafted) semantics
+        // from TC39 meeting minutes will work. (Yes, implausibly, such a site
+        // exists. See bug 1054426.)
         var nextSource = arguments[i];
+        if (nextSource === null || nextSource === undefined)
+            continue;
+
         var from = ToObject(nextSource);
 
         // Step 5.c-d.
@@ -58,8 +64,7 @@ function ObjectStaticAssign(target, firstSource) {
         // Step 5.k.
         if (pendingException !== MISSING)
             throw pendingException;
-        i++;
-    } while (i < arguments.length);
+    } while (++i < arguments.length);
 
     // Step 6.
     return to;
diff --git a/js/src/doc/Debugger/Debugger-API.md b/js/src/doc/Debugger/Debugger-API.md
index 84a581688a66..a9afe253e88a 100644
--- a/js/src/doc/Debugger/Debugger-API.md
+++ b/js/src/doc/Debugger/Debugger-API.md
@@ -84,6 +84,9 @@ full copy of its source code, and explain how the code entered the system,
 whether via a call to `eval`, a `<script>` element, or otherwise. A
 `Debugger.Script` points to the `Debugger.Source` from which it is derived.
 
+Also omitted is the `Debugger`'s [`Debugger.Memory`][memory] instance, which
+holds methods and accessors for observing the debuggee's memory use.
+
 All these types follow some [general conventions][conventions], which you
 should look through before drilling down into any particular type's
 specification.
diff --git a/js/src/doc/Debugger/Debugger.Memory.md b/js/src/doc/Debugger/Debugger.Memory.md
index 98e24cb2de3d..a1fdbf5c0d8b 100644
--- a/js/src/doc/Debugger/Debugger.Memory.md
+++ b/js/src/doc/Debugger/Debugger.Memory.md
@@ -1,35 +1,71 @@
 Debugger.Memory
 ===============
 
-`Debugger` can survey the debuggee's memory usage in various ways:
+The [`Debugger API`][debugger] can help tools observe the debuggee's memory use
+in various ways:
 
-- It can find the path by which a given item is referenced from any debuggee
-  global.
+- It can mark each new object with the JavaScript call stack at which it was
+  allocated.
 
-- It can compute the *retained size* of an item: the total size of all
-  items that are reachable only through that item&mdash;and thus would be
-  freed if the given item were freed.
+- It can log all object allocations, yielding a stream of JavaScript call stacks
+  at which allocations have occurred.
 
-- It can compute a *census* of items in debuggee compartments, categorizing
-  items in various ways, yielding item counts, storage consumed, and "top
-  N" item lists for each category.
+- It can compute a *census* of items belonging to the debuggee, categorizing
+  items in various ways, and yielding item counts.
 
-In this documentation, the term *item* refers to anything that occupies memory
-in the browser, whether it implements something that web developers would
-recognize (JavaScript objects; DOM nodes) or an implementation detail that web
-developers would have no reason to be familiar with (SpiderMonkey shapes and
-types).
-
-If `dbg` is a `Debugger` instance, then `dbg.memory` is an instance of
-`Debugger.Memory` whose methods and accessors operate on `dbg`. This class
-exists only to hold member functions and accessors related to memory analysis,
-keeping them separate from other `Debugger` facilities.
+If <i>dbg</i> is a [`Debugger`][debugger-object] instance, then the methods and
+accessor properties of <code><i>dbg</i>.memory</code> control how <i>dbg</i>
+observes its debuggees' memory use. The <code><i>dbg</i>.memory</code> object is
+an instance of `Debugger.Memory`; its inherited accesors and methods are
+described below.
 
 
-Allocation Site Tracking
-------------------------
+### Allocation Site Tracking
 
-<code id="trackingallocationsites">Debugger.Memory.prototype.trackingAllocationSites</code>
+The JavaScript engine marks each new object with the call stack at which it was
+allocated, if:
+
+- the object is allocated in the scope of a global object that is a debuggee of
+  some [`Debugger`][debugger-object] instance <i>dbg</i>; and
+
+- <code><i>dbg</i>.memory.[trackingAllocationSites][tracking-allocs]</code> is
+  set to `true`.
+
+Given a [`Debugger.Object`][object] instance <i>dobj</i> referring to some
+object, <code><i>dobj</i>.[allocationSite][allocation-site]</code> returns a
+[saved call stack][saved-frame] indicating where <i>dobj</i>'s referent was
+allocated.
+
+
+### Allocation Logging
+
+If <i>dbg</i> is a [`Debugger`][debugger-object] instance, and
+<code><i>dbg</i>.memory.[trackingAllocationSites][tracking-allocs]</code> is set
+to `true`, then the JavaScript engine logs each object allocated by <i>dbg</i>'s
+debuggee code. You can retrieve the current log by calling
+<code><i>dbg</i>.memory.[drainAllocationsLog][drain-alloc-log]</code>. You can
+control the limit on the log's size by setting
+<code><i>dbg</i>.memory.[maxAllocationsLogLength][max-alloc-log]</code>.
+
+
+### Censuses
+
+A *census* is a complete traversal of the graph of all reachable memory items
+belonging to a particular `Debugger`'s debuggees. It produces a count of those
+items, broken down by various criteria. If <i>dbg</i> is a
+[`Debugger`][debugger-object] instance, you can call
+<code><i>dbg</i>.memory.[takeCensus][take-census]</code> to conduct a census of
+its debuggees' possessions.
+
+
+Accessor Properties of the `Debugger.Memory.prototype` Object
+-------------------------------------------------------------
+
+If <i>dbg</i> is a [`Debugger`][debugger-object] instance, then
+`<i>dbg</i>.memory` is a `Debugger.Memory` instance, which inherits the
+following accessor properties from its prototype:
+
+<code id='trackingallocationsites'>trackingAllocationSites</code>
 :   A boolean value indicating whether this `Debugger.Memory` instance is
     capturing the JavaScript execution stack when each Object is allocated. This
     accessor property has both a getter and setter: assigning to it enables or
@@ -44,26 +80,34 @@ Allocation Site Tracking
     [`Debugger.Object.prototype.allocationSite`][allocation-site] accessor
     property.
 
+<code id='max-alloc-log'>maxAllocationsLogLength</code>
+:   The maximum number of allocation sites to accumulate in the allocations log
+    at a time. This accessor can be both fetched and stored to. Its default
+    value is `5000`.
 
-Censuses
---------
 
-A *census* is a complete traversal of the graph of all reachable items belonging
-to a particular `Debugger`'s debuggee compartments, producing a count of those
-items, broken down by various criteria. `Debugger` can perform a census as part
-of the same heap traversal that computes [retained sizes][retsz], or as an
-independent operation.
+Function Properties of the `Debugger.Memory.prototype` Object
+-------------------------------------------------------------
 
-Because performing a census requires traversing the entire graph of objects in
-debuggee compartments, it is an expensive operation. On developer hardware in
-2014, traversing a memory graph containing roughly 130,000 nodes and 410,000
-edges took roughly 100ms. The traversal itself temporarily allocates one hash
-table entry per node (roughly two address-sized words) in addition to the
-per-category counts, whose size depends on the number of categories.
+<code id='drain-alloc-log'>drainAllocationsLog()</code>
+:   When `trackingAllocationSites` is `true`, this method returns an array of
+    allocation sites (as [captured stacks][saved-frame]) for recent `Object`
+    allocations within the set of debuggees. Entries for objects allocated with
+    no JavaScript frames on the stack are `null`. *Recent* is defined as the
+    `maxAllocationsLogLength` most recent `Object` allocations since the last
+    call to `drainAllocationsLog`. Therefore, calling this method effectively
+    clears the log.
 
-`Debugger.Memory.prototype.takeCensus()`
-:   Carry out a census of the debuggee compartments' contents. Return an
-    object of the form:
+    When `trackingAllocationSites` is `false`, `drainAllocationsLog()` throws an
+    `Error`.
+
+<code id='take-census'>takeCensus()</code>
+:   Carry out a census of the debuggee compartments' contents. A *census* is a
+    complete traversal of the graph of all reachable memory items belonging to a
+    particular `Debugger`'s debuggees. The census produces a count of those
+    items, broken down by various criteria.
+
+    The `takeCensus` method returns an object of the form:
 
     <pre class='language-js'><code>
     {
@@ -94,6 +138,14 @@ per-category counts, whose size depends on the number of categories.
     The `"other"` property's value contains the tallies of other items used
     internally by SpiderMonkey, broken down by their C++ type name.
 
+    Because performing a census requires traversing the entire graph of objects
+    in debuggee compartments, it is an expensive operation. On developer
+    hardware in 2014, traversing a memory graph containing roughly 130,000 nodes
+    and 410,000 edges took roughly 100ms. The traversal itself temporarily
+    allocates one hash table entry per node (roughly two address-sized words) in
+    addition to the per-category counts, whose size depends on the number of
+    categories.
+
 
 Memory Use Analysis Exposes Implementation Details
 --------------------------------------------------
@@ -173,20 +225,3 @@ variables and object properties. This type information can be large.
 
 In a census, all the various forms of JavaScript code are placed in the
 `"script"` category. Type information is accounted to the `"types"` category.
-
-`maxAllocationsLogLength`
-:   The maximum number of allocation sites to accumulate in the allocations log
-    at a time. Its default value is `5000`.
-
-## Function Properties of the `Debugger.Memory.prototype` Object
-
-`drainAllocationsLog()`
-:   When `trackingAllocationSites` is `true`, this method returns an array of
-    allocation sites (as [captured stacks][saved-frame]) for recent `Object`
-    allocations within the set of debuggees. *Recent* is defined as the
-    `maxAllocationsLogLength` most recent `Object` allocations since the last
-    call to `drainAllocationsLog`. Therefore, calling this method effectively
-    clears the log.
-
-    When `trackingAllocationSites` is `false`, `drainAllocationsLog()` throws an
-    `Error`.
diff --git a/js/src/doc/Debugger/config.sh b/js/src/doc/Debugger/config.sh
index 2be3b879fc93..4e95842d2b2c 100644
--- a/js/src/doc/Debugger/config.sh
+++ b/js/src/doc/Debugger/config.sh
@@ -40,7 +40,9 @@ markdown Debugger.Source.md Debugger-API/Debugger.Source
 markdown Debugger.Memory.md Debugger-API/Debugger.Memory
   label 'memory'                                "Debugger.Memory"
   label 'tracking-allocs' '#trackingallocationsites' "Debugger.Memory: trackingAllocationSites"
-  label 'retsz'           '#retained-size'      "Debugger.Memory: Retained Sizes"
+  label 'drain-alloc-log' '#drain-alloc-log'    "Debugger.Memory: drainAllocationsLog"
+  label 'max-alloc-log' '#max-alloc-log'        "Debugger.Memory: maxAllocationsLogLength"
+  label 'take-census'   '#take-census'          "Debugger.Memory: takeCensus"
 
 # Images:
 RBASE=https://mdn.mozillademos.org/files
diff --git a/js/src/frontend/BytecodeEmitter.cpp b/js/src/frontend/BytecodeEmitter.cpp
index 2f2500d96afe..8bb4b664b083 100644
--- a/js/src/frontend/BytecodeEmitter.cpp
+++ b/js/src/frontend/BytecodeEmitter.cpp
@@ -3856,7 +3856,7 @@ EmitAssignment(ExclusiveContext *cx, BytecodeEmitter *bce, ParseNode *lhs, JSOp
 }
 
 bool
-ParseNode::getConstantValue(ExclusiveContext *cx, MutableHandleValue vp)
+ParseNode::getConstantValue(ExclusiveContext *cx, AllowConstantObjects allowObjects, MutableHandleValue vp)
 {
     switch (getKind()) {
       case PNK_NUMBER:
@@ -3883,6 +3883,11 @@ ParseNode::getConstantValue(ExclusiveContext *cx, MutableHandleValue vp)
         unsigned count;
         ParseNode *pn;
 
+        if (allowObjects == DontAllowObjects)
+            return false;
+        if (allowObjects == DontAllowNestedObjects)
+            allowObjects = DontAllowObjects;
+
         if (getKind() == PNK_CALLSITEOBJ) {
             count = pn_count - 1;
             pn = pn_head->pn_next;
@@ -3899,7 +3904,7 @@ ParseNode::getConstantValue(ExclusiveContext *cx, MutableHandleValue vp)
         unsigned idx = 0;
         RootedId id(cx);
         for (; pn; idx++, pn = pn->pn_next) {
-            if (!pn->getConstantValue(cx, &value))
+            if (!pn->getConstantValue(cx, allowObjects, &value))
                 return false;
             id = INT_TO_JSID(idx);
             if (!JSObject::defineGeneric(cx, obj, id, value, nullptr, nullptr, JSPROP_ENUMERATE))
@@ -3915,6 +3920,11 @@ ParseNode::getConstantValue(ExclusiveContext *cx, MutableHandleValue vp)
         JS_ASSERT(isOp(JSOP_NEWINIT));
         JS_ASSERT(!(pn_xflags & PNX_NONCONST));
 
+        if (allowObjects == DontAllowObjects)
+            return false;
+        if (allowObjects == DontAllowNestedObjects)
+            allowObjects = DontAllowObjects;
+
         gc::AllocKind kind = GuessObjectGCKind(pn_count);
         RootedObject obj(cx, NewBuiltinClassInstance(cx, &JSObject::class_, kind, MaybeSingletonObject));
         if (!obj)
@@ -3922,7 +3932,7 @@ ParseNode::getConstantValue(ExclusiveContext *cx, MutableHandleValue vp)
 
         RootedValue value(cx), idvalue(cx);
         for (ParseNode *pn = pn_head; pn; pn = pn->pn_next) {
-            if (!pn->pn_right->getConstantValue(cx, &value))
+            if (!pn->pn_right->getConstantValue(cx, allowObjects, &value))
                 return false;
 
             ParseNode *pnid = pn->pn_left;
@@ -3976,7 +3986,7 @@ static bool
 EmitSingletonInitialiser(ExclusiveContext *cx, BytecodeEmitter *bce, ParseNode *pn)
 {
     RootedValue value(cx);
-    if (!pn->getConstantValue(cx, &value))
+    if (!pn->getConstantValue(cx, ParseNode::AllowObjects, &value))
         return false;
 
     RootedObject obj(cx, &value.toObject());
@@ -3994,7 +4004,7 @@ static bool
 EmitCallSiteObject(ExclusiveContext *cx, BytecodeEmitter *bce, ParseNode *pn)
 {
     RootedValue value(cx);
-    if (!pn->getConstantValue(cx, &value))
+    if (!pn->getConstantValue(cx, ParseNode::AllowObjects, &value))
         return false;
 
     JS_ASSERT(value.isObject());
@@ -6726,10 +6736,43 @@ frontend::EmitTree(ExclusiveContext *cx, BytecodeEmitter *bce, ParseNode *pn)
             break;
 
       case PNK_ARRAY:
-        if (!(pn->pn_xflags & PNX_NONCONST) && pn->pn_head && bce->checkSingletonContext())
-            ok = EmitSingletonInitialiser(cx, bce, pn);
-        else
-            ok = EmitArray(cx, bce, pn->pn_head, pn->pn_count);
+        if (!(pn->pn_xflags & PNX_NONCONST) && pn->pn_head) {
+            if (bce->checkSingletonContext()) {
+                // Bake in the object entirely if it will only be created once.
+                ok = EmitSingletonInitialiser(cx, bce, pn);
+                break;
+            }
+
+            // If the array consists entirely of primitive values, make a
+            // template object with copy on write elements that can be reused
+            // every time the initializer executes.
+            RootedValue value(cx);
+            if (bce->emitterMode != BytecodeEmitter::SelfHosting &&
+                bce->script->compileAndGo() &&
+                pn->pn_count != 0 &&
+                pn->getConstantValue(cx, ParseNode::DontAllowNestedObjects, &value))
+            {
+                // Note: the type of the template object might not yet reflect
+                // that the object has copy on write elements. When the
+                // interpreter or JIT compiler fetches the template, it should
+                // use types::GetOrFixupCopyOnWriteObject to make sure the type
+                // for the template is accurate. We don't do this here as we
+                // want to use types::InitObject, which requires a finished
+                // script.
+                JSObject *obj = &value.toObject();
+                if (!ObjectElements::MakeElementsCopyOnWrite(cx, obj))
+                    return false;
+
+                ObjectBox *objbox = bce->parser->newObjectBox(obj);
+                if (!objbox)
+                    return false;
+
+                ok = EmitObjectOp(cx, objbox, JSOP_NEWARRAY_COPYONWRITE, bce);
+                break;
+            }
+        }
+
+        ok = EmitArray(cx, bce, pn->pn_head, pn->pn_count);
         break;
 
        case PNK_ARRAYCOMP:
diff --git a/js/src/frontend/ParseNode.h b/js/src/frontend/ParseNode.h
index 3ea403d4aa74..a5b5fb19df16 100644
--- a/js/src/frontend/ParseNode.h
+++ b/js/src/frontend/ParseNode.h
@@ -831,7 +831,13 @@ class ParseNode
 #endif
     ;
 
-    bool getConstantValue(ExclusiveContext *cx, MutableHandleValue vp);
+    enum AllowConstantObjects {
+        DontAllowObjects = 0,
+        DontAllowNestedObjects,
+        AllowObjects
+    };
+
+    bool getConstantValue(ExclusiveContext *cx, AllowConstantObjects allowObjects, MutableHandleValue vp);
     inline bool isConstant();
 
     template <class NodeType>
@@ -1274,7 +1280,7 @@ struct CallSiteNode : public ListNode {
     }
 
     bool getRawArrayValue(ExclusiveContext *cx, MutableHandleValue vp) {
-        return pn_head->getConstantValue(cx, vp);
+        return pn_head->getConstantValue(cx, AllowObjects, vp);
     }
 };
 
diff --git a/js/src/gc/Barrier.h b/js/src/gc/Barrier.h
index 21bce82f0517..a33d187078ab 100644
--- a/js/src/gc/Barrier.h
+++ b/js/src/gc/Barrier.h
@@ -1007,14 +1007,34 @@ class HeapSlotArray
 {
     HeapSlot *array;
 
+    // Whether writes may be performed to the slots in this array. This helps
+    // to control how object elements which may be copy on write are used.
+#ifdef DEBUG
+    bool allowWrite_;
+#endif
+
   public:
-    explicit HeapSlotArray(HeapSlot *array) : array(array) {}
+    explicit HeapSlotArray(HeapSlot *array, bool allowWrite)
+      : array(array)
+#ifdef DEBUG
+      , allowWrite_(allowWrite)
+#endif
+    {}
 
     operator const Value *() const { return Valueify(array); }
-    operator HeapSlot *() const { return array; }
+    operator HeapSlot *() const { JS_ASSERT(allowWrite()); return array; }
 
-    HeapSlotArray operator +(int offset) const { return HeapSlotArray(array + offset); }
-    HeapSlotArray operator +(uint32_t offset) const { return HeapSlotArray(array + offset); }
+    HeapSlotArray operator +(int offset) const { return HeapSlotArray(array + offset, allowWrite()); }
+    HeapSlotArray operator +(uint32_t offset) const { return HeapSlotArray(array + offset, allowWrite()); }
+
+  private:
+    bool allowWrite() const {
+#ifdef DEBUG
+        return allowWrite_;
+#else
+        return true;
+#endif
+    }
 };
 
 /*
diff --git a/js/src/gc/ForkJoinNursery.cpp b/js/src/gc/ForkJoinNursery.cpp
index 97f7cc162888..434345a119f4 100644
--- a/js/src/gc/ForkJoinNursery.cpp
+++ b/js/src/gc/ForkJoinNursery.cpp
@@ -849,7 +849,7 @@ ForkJoinNursery::copySlotsToTospace(JSObject *dst, JSObject *src, AllocKind dstK
 size_t
 ForkJoinNursery::copyElementsToTospace(JSObject *dst, JSObject *src, AllocKind dstKind)
 {
-    if (src->hasEmptyElements())
+    if (src->hasEmptyElements() || src->denseElementsAreCopyOnWrite())
         return 0;
 
     ObjectElements *srcHeader = src->getElementsHeader();
diff --git a/js/src/gc/Marking.cpp b/js/src/gc/Marking.cpp
index 583361534b4d..14951a641ec3 100644
--- a/js/src/gc/Marking.cpp
+++ b/js/src/gc/Marking.cpp
@@ -1753,13 +1753,24 @@ GCMarker::processMarkStackTop(SliceBudget &budget)
 
         unsigned nslots = obj->slotSpan();
 
-        if (!obj->hasEmptyElements()) {
-            vp = obj->getDenseElements();
+        do {
+            if (obj->hasEmptyElements())
+                break;
+
+            if (obj->denseElementsAreCopyOnWrite()) {
+                JSObject *owner = obj->getElementsHeader()->ownerObject();
+                if (owner != obj) {
+                    PushMarkStack(this, owner);
+                    break;
+                }
+            }
+
+            vp = obj->getDenseElementsAllowCopyOnWrite();
             end = vp + obj->getDenseInitializedLength();
             if (!nslots)
                 goto scan_value_array;
             pushValueArray(obj, vp, end);
-        }
+        } while (false);
 
         vp = obj->fixedSlots();
         if (obj->slots) {
diff --git a/js/src/gc/Nursery.cpp b/js/src/gc/Nursery.cpp
index b74823505cbe..4899410a2a7e 100644
--- a/js/src/gc/Nursery.cpp
+++ b/js/src/gc/Nursery.cpp
@@ -523,7 +523,9 @@ js::Nursery::traceObject(MinorCollectionTracer *trc, JSObject *obj)
     if (!obj->isNative())
         return;
 
-    if (!obj->hasEmptyElements())
+    // Note: the contents of copy on write elements pointers are filled in
+    // during parsing and cannot contain nursery pointers.
+    if (!obj->hasEmptyElements() && !obj->denseElementsAreCopyOnWrite())
         markSlots(trc, obj->getDenseElements(), obj->getDenseInitializedLength());
 
     HeapSlot *fixedStart, *fixedEnd, *dynStart, *dynEnd;
@@ -669,7 +671,7 @@ js::Nursery::moveSlotsToTenured(JSObject *dst, JSObject *src, AllocKind dstKind)
 size_t
 js::Nursery::moveElementsToTenured(JSObject *dst, JSObject *src, AllocKind dstKind)
 {
-    if (src->hasEmptyElements())
+    if (src->hasEmptyElements() || src->denseElementsAreCopyOnWrite())
         return 0;
 
     Zone *zone = src->zone();
diff --git a/js/src/jit-test/tests/debug/Script-getAllColumnOffsets-05.js b/js/src/jit-test/tests/debug/Script-getAllColumnOffsets-05.js
index 8e9bcb3b36e1..a41007006694 100644
--- a/js/src/jit-test/tests/debug/Script-getAllColumnOffsets-05.js
+++ b/js/src/jit-test/tests/debug/Script-getAllColumnOffsets-05.js
@@ -14,7 +14,7 @@ Debugger(global).onDebuggerStatement = function (frame) {
 };
 
 global.log = '';
-global.eval("function f(n){var a=[1,2,3]} debugger;");
+global.eval("function f(n){var a=[1,2,n]} debugger;");
 global.f(3);
 // Should hit each item in the array.
 assertEq(global.log, "18 21 23 25 19 ");
diff --git a/js/src/jit-test/tests/parallel/write-array.js b/js/src/jit-test/tests/parallel/write-array.js
index 183e926bf7b3..8b917a62629f 100644
--- a/js/src/jit-test/tests/parallel/write-array.js
+++ b/js/src/jit-test/tests/parallel/write-array.js
@@ -3,7 +3,7 @@ load(libdir + "parallelarray-helpers.js");
 function buildSimple() {
   assertParallelModesCommute(["seq", "par"], function(m) {
     return Array.buildPar(256, function(i) {
-      let obj = [0, 1, 2];
+      let obj = [i, 1, 2];
       obj[0] += 1;
       obj[1] += 1;
       obj[2] += 1;
diff --git a/js/src/jit/BaselineCompiler.cpp b/js/src/jit/BaselineCompiler.cpp
index c6d204537e49..49efff8418d8 100644
--- a/js/src/jit/BaselineCompiler.cpp
+++ b/js/src/jit/BaselineCompiler.cpp
@@ -1649,6 +1649,32 @@ BaselineCompiler::emit_JSOP_NEWARRAY()
     return true;
 }
 
+typedef JSObject *(*NewArrayCopyOnWriteFn)(JSContext *, HandleObject, gc::InitialHeap);
+const VMFunction jit::NewArrayCopyOnWriteInfo =
+    FunctionInfo<NewArrayCopyOnWriteFn>(js::NewDenseCopyOnWriteArray);
+
+bool
+BaselineCompiler::emit_JSOP_NEWARRAY_COPYONWRITE()
+{
+    RootedScript scriptRoot(cx, script);
+    JSObject *obj = types::GetOrFixupCopyOnWriteObject(cx, scriptRoot, pc);
+    if (!obj)
+        return false;
+
+    prepareVMCall();
+
+    pushArg(Imm32(gc::DefaultHeap));
+    pushArg(ImmGCPtr(obj));
+
+    if (!callVM(NewArrayCopyOnWriteInfo))
+        return false;
+
+    // Box and push return value.
+    masm.tagValue(JSVAL_TYPE_OBJECT, ReturnReg, R0);
+    frame.push(R0);
+    return true;
+}
+
 bool
 BaselineCompiler::emit_JSOP_INITELEM_ARRAY()
 {
diff --git a/js/src/jit/BaselineCompiler.h b/js/src/jit/BaselineCompiler.h
index c60e6d4529f1..3f8d7762a60c 100644
--- a/js/src/jit/BaselineCompiler.h
+++ b/js/src/jit/BaselineCompiler.h
@@ -92,6 +92,7 @@ namespace jit {
     _(JSOP_BITNOT)             \
     _(JSOP_NEG)                \
     _(JSOP_NEWARRAY)           \
+    _(JSOP_NEWARRAY_COPYONWRITE) \
     _(JSOP_INITELEM_ARRAY)     \
     _(JSOP_NEWOBJECT)          \
     _(JSOP_NEWINIT)            \
@@ -273,6 +274,8 @@ class BaselineCompiler : public BaselineCompilerSpecific
     Address getScopeCoordinateAddress(Register reg);
 };
 
+extern const VMFunction NewArrayCopyOnWriteInfo;
+
 } // namespace jit
 } // namespace js
 
diff --git a/js/src/jit/BaselineIC.cpp b/js/src/jit/BaselineIC.cpp
index 878fafa3202e..d2d2adb7e568 100644
--- a/js/src/jit/BaselineIC.cpp
+++ b/js/src/jit/BaselineIC.cpp
@@ -5256,6 +5256,20 @@ ICSetElem_Dense::Compiler::generateStubCode(MacroAssembler &masm)
     BaseIndex element(scratchReg, key, TimesEight);
     masm.branchTestMagic(Assembler::Equal, element, &failure);
 
+    // Perform a single test to see if we either need to convert double
+    // elements or clone the copy on write elements in the object.
+    Label noSpecialHandling;
+    Address elementsFlags(scratchReg, ObjectElements::offsetOfFlags());
+    masm.branchTest32(Assembler::Zero, elementsFlags,
+                      Imm32(ObjectElements::CONVERT_DOUBLE_ELEMENTS |
+                            ObjectElements::COPY_ON_WRITE),
+                      &noSpecialHandling);
+
+    // Fail if we need to clone copy on write elements.
+    masm.branchTest32(Assembler::NonZero, elementsFlags,
+                      Imm32(ObjectElements::COPY_ON_WRITE),
+                      &failure);
+
     // Failure is not possible now.  Free up registers.
     regs.add(R0);
     regs.add(R1);
@@ -5263,21 +5277,17 @@ ICSetElem_Dense::Compiler::generateStubCode(MacroAssembler &masm)
     regs.takeUnchecked(key);
     Address valueAddr(BaselineStackReg, ICStackValueOffset);
 
-    // Convert int32 values to double if convertDoubleElements is set. In this
-    // case the heap typeset is guaranteed to contain both int32 and double, so
-    // it's okay to store a double.
-    Label dontConvertDoubles;
-    Address elementsFlags(scratchReg, ObjectElements::offsetOfFlags());
-    masm.branchTest32(Assembler::Zero, elementsFlags,
-                      Imm32(ObjectElements::CONVERT_DOUBLE_ELEMENTS),
-                      &dontConvertDoubles);
-    // Note that double arrays are only created by IonMonkey, so if we have no
-    // floating-point support Ion is disabled and there should be no double arrays.
+    // We need to convert int32 values being stored into doubles. In this case
+    // the heap typeset is guaranteed to contain both int32 and double, so it's
+    // okay to store a double. Note that double arrays are only created by
+    // IonMonkey, so if we have no floating-point support Ion is disabled and
+    // there should be no double arrays.
     if (cx->runtime()->jitSupportsFloatingPoint)
-        masm.convertInt32ValueToDouble(valueAddr, regs.getAny(), &dontConvertDoubles);
+        masm.convertInt32ValueToDouble(valueAddr, regs.getAny(), &noSpecialHandling);
     else
         masm.assumeUnreachable("There shouldn't be double arrays when there is no FP support.");
-    masm.bind(&dontConvertDoubles);
+
+    masm.bind(&noSpecialHandling);
 
     // Don't overwrite R0 becuase |obj| might overlap with it, and it's needed
     // for post-write barrier later.
@@ -5429,6 +5439,12 @@ ICSetElemDenseAddCompiler::generateStubCode(MacroAssembler &masm)
     Address capacity(scratchReg, ObjectElements::offsetOfCapacity());
     masm.branch32(Assembler::BelowOrEqual, capacity, key, &failure);
 
+    // Check for copy on write elements.
+    Address elementsFlags(scratchReg, ObjectElements::offsetOfFlags());
+    masm.branchTest32(Assembler::NonZero, elementsFlags,
+                      Imm32(ObjectElements::COPY_ON_WRITE),
+                      &failure);
+
     // Failure is not possible now.  Free up registers.
     regs.add(R0);
     regs.add(R1);
@@ -5451,7 +5467,6 @@ ICSetElemDenseAddCompiler::generateStubCode(MacroAssembler &masm)
     // case the heap typeset is guaranteed to contain both int32 and double, so
     // it's okay to store a double.
     Label dontConvertDoubles;
-    Address elementsFlags(scratchReg, ObjectElements::offsetOfFlags());
     masm.branchTest32(Assembler::Zero, elementsFlags,
                       Imm32(ObjectElements::CONVERT_DOUBLE_ELEMENTS),
                       &dontConvertDoubles);
diff --git a/js/src/jit/CodeGenerator.cpp b/js/src/jit/CodeGenerator.cpp
index 55ffa53ac216..c027cd2a83c9 100644
--- a/js/src/jit/CodeGenerator.cpp
+++ b/js/src/jit/CodeGenerator.cpp
@@ -22,6 +22,7 @@
 #ifdef JSGC_GENERATIONAL
 # include "gc/Nursery.h"
 #endif
+#include "jit/BaselineCompiler.h"
 #include "jit/IonCaches.h"
 #include "jit/IonLinker.h"
 #include "jit/IonOptimizationLevels.h"
@@ -1868,6 +1869,30 @@ CodeGenerator::visitMaybeToDoubleElement(LMaybeToDoubleElement *lir)
     return true;
 }
 
+typedef bool (*CopyElementsForWriteFn)(ThreadSafeContext *, JSObject *);
+static const VMFunction CopyElementsForWriteInfo =
+    FunctionInfo<CopyElementsForWriteFn>(JSObject::CopyElementsForWrite);
+
+bool
+CodeGenerator::visitMaybeCopyElementsForWrite(LMaybeCopyElementsForWrite *lir)
+{
+    Register object = ToRegister(lir->object());
+    Register temp = ToRegister(lir->temp());
+
+    OutOfLineCode *ool = oolCallVM(CopyElementsForWriteInfo, lir,
+                                   (ArgList(), object), StoreNothing());
+    if (!ool)
+        return false;
+
+    masm.loadPtr(Address(object, JSObject::offsetOfElements()), temp);
+    masm.branchTest32(Assembler::NonZero,
+                      Address(temp, ObjectElements::offsetOfFlags()),
+                      Imm32(ObjectElements::COPY_ON_WRITE),
+                      ool->entry());
+    masm.bind(ool->rejoin());
+    return true;
+}
+
 bool
 CodeGenerator::visitFunctionEnvironment(LFunctionEnvironment *lir)
 {
@@ -3566,6 +3591,27 @@ CodeGenerator::visitOutOfLineNewArray(OutOfLineNewArray *ool)
     return true;
 }
 
+bool
+CodeGenerator::visitNewArrayCopyOnWrite(LNewArrayCopyOnWrite *lir)
+{
+    Register objReg = ToRegister(lir->output());
+    Register tempReg = ToRegister(lir->temp());
+    JSObject *templateObject = lir->mir()->templateObject();
+    gc::InitialHeap initialHeap = lir->mir()->initialHeap();
+
+    // If we have a template object, we can inline call object creation.
+    OutOfLineCode *ool = oolCallVM(NewArrayCopyOnWriteInfo, lir,
+                                   (ArgList(), ImmGCPtr(templateObject), Imm32(initialHeap)),
+                                   StoreRegisterTo(objReg));
+    if (!ool)
+        return false;
+
+    masm.createGCObject(objReg, tempReg, templateObject, initialHeap, ool->entry());
+
+    masm.bind(ool->rejoin());
+    return true;
+}
+
 // Out-of-line object allocation for JSOP_NEWOBJECT.
 class OutOfLineNewObject : public OutOfLineCodeBase<CodeGenerator>
 {
diff --git a/js/src/jit/CodeGenerator.h b/js/src/jit/CodeGenerator.h
index a6f9e2e06cb9..95a04de066f1 100644
--- a/js/src/jit/CodeGenerator.h
+++ b/js/src/jit/CodeGenerator.h
@@ -115,6 +115,7 @@ class CodeGenerator : public CodeGeneratorSpecific
     bool visitElements(LElements *lir);
     bool visitConvertElementsToDoubles(LConvertElementsToDoubles *lir);
     bool visitMaybeToDoubleElement(LMaybeToDoubleElement *lir);
+    bool visitMaybeCopyElementsForWrite(LMaybeCopyElementsForWrite *lir);
     bool visitGuardObjectIdentity(LGuardObjectIdentity *guard);
     bool visitGuardShapePolymorphic(LGuardShapePolymorphic *lir);
     bool visitTypeBarrierV(LTypeBarrierV *lir);
@@ -144,6 +145,7 @@ class CodeGenerator : public CodeGeneratorSpecific
     bool visitNewArrayCallVM(LNewArray *lir);
     bool visitNewArray(LNewArray *lir);
     bool visitOutOfLineNewArray(OutOfLineNewArray *ool);
+    bool visitNewArrayCopyOnWrite(LNewArrayCopyOnWrite *lir);
     bool visitNewObjectVMCall(LNewObject *lir);
     bool visitNewObject(LNewObject *lir);
     bool visitOutOfLineNewObject(OutOfLineNewObject *ool);
diff --git a/js/src/jit/IonAnalysis.cpp b/js/src/jit/IonAnalysis.cpp
index c9f5cb9be0ef..abc8b4b6d59b 100644
--- a/js/src/jit/IonAnalysis.cpp
+++ b/js/src/jit/IonAnalysis.cpp
@@ -2268,6 +2268,16 @@ TryEliminateTypeBarrier(MTypeBarrier *barrier, bool *eliminated)
     return true;
 }
 
+static inline MDefinition *
+PassthroughOperand(MDefinition *def)
+{
+    if (def->isConvertElementsToDoubles())
+        return def->toConvertElementsToDoubles()->elements();
+    if (def->isMaybeCopyElementsForWrite())
+        return def->toMaybeCopyElementsForWrite()->object();
+    return nullptr;
+}
+
 // Eliminate checks which are redundant given each other or other instructions.
 //
 // A type barrier is considered redundant if all missing types have been tested
@@ -2324,11 +2334,12 @@ jit::EliminateRedundantChecks(MIRGraph &graph)
             } else if (iter->isTypeBarrier()) {
                 if (!TryEliminateTypeBarrier(iter->toTypeBarrier(), &eliminated))
                     return false;
-            } else if (iter->isConvertElementsToDoubles()) {
-                // Now that code motion passes have finished, replace any
-                // ConvertElementsToDoubles with the actual elements.
-                MConvertElementsToDoubles *ins = iter->toConvertElementsToDoubles();
-                ins->replaceAllUsesWith(ins->elements());
+            } else {
+                // Now that code motion passes have finished, replace
+                // instructions which pass through one of their operands
+                // (and perform additional checks) with that operand.
+                if (MDefinition *passthrough = PassthroughOperand(*iter))
+                    iter->replaceAllUsesWith(passthrough);
             }
 
             if (eliminated)
diff --git a/js/src/jit/IonBuilder.cpp b/js/src/jit/IonBuilder.cpp
index f5bf43c9d806..2850c6d5ad1e 100644
--- a/js/src/jit/IonBuilder.cpp
+++ b/js/src/jit/IonBuilder.cpp
@@ -1547,6 +1547,9 @@ IonBuilder::inspectOpcode(JSOp op)
       case JSOP_NEWARRAY:
         return jsop_newarray(GET_UINT24(pc));
 
+      case JSOP_NEWARRAY_COPYONWRITE:
+        return jsop_newarray_copyonwrite();
+
       case JSOP_NEWOBJECT:
         return jsop_newobject();
 
@@ -5536,6 +5539,28 @@ IonBuilder::jsop_newarray(uint32_t count)
     return true;
 }
 
+bool
+IonBuilder::jsop_newarray_copyonwrite()
+{
+    JSObject *templateObject = types::GetCopyOnWriteObject(script(), pc);
+
+    // The baseline compiler should have ensured the template object has a type
+    // with the copy on write flag set already. During the arguments usage
+    // analysis the baseline compiler hasn't run yet, however, though in this
+    // case the template object's type doesn't matter.
+    JS_ASSERT_IF(info().executionMode() != ArgumentsUsageAnalysis,
+                 templateObject->type()->hasAnyFlags(types::OBJECT_FLAG_COPY_ON_WRITE));
+
+    MNewArrayCopyOnWrite *ins =
+        MNewArrayCopyOnWrite::New(alloc(), constraints(), templateObject,
+                                  templateObject->type()->initialHeap(constraints()));
+
+    current->add(ins);
+    current->push(ins);
+
+    return true;
+}
+
 bool
 IonBuilder::jsop_newobject()
 {
@@ -7931,6 +7956,9 @@ IonBuilder::setElemTryCache(bool *emitted, MDefinition *object,
     // another value.
     bool guardHoles = ElementAccessHasExtraIndexedProperty(constraints(), object);
 
+    // Make sure the object being written to doesn't have copy on write elements.
+    object = addMaybeCopyElementsForWrite(object);
+
     if (NeedsPostBarrier(info(), value))
         current->add(MPostWriteBarrier::New(alloc(), object, value));
 
@@ -7966,6 +7994,9 @@ IonBuilder::jsop_setelem_dense(types::TemporaryTypeSet::DoubleConversion convers
     current->add(idInt32);
     id = idInt32;
 
+    // Copy the elements vector if necessary.
+    obj = addMaybeCopyElementsForWrite(obj);
+
     // Get the elements vector.
     MElements *elements = MElements::New(alloc(), obj);
     current->add(elements);
@@ -10258,6 +10289,16 @@ IonBuilder::addConvertElementsToDoubles(MDefinition *elements)
     return convert;
 }
 
+MDefinition *
+IonBuilder::addMaybeCopyElementsForWrite(MDefinition *object)
+{
+    if (!ElementAccessMightBeCopyOnWrite(constraints(), object))
+        return object;
+    MInstruction *copy = MMaybeCopyElementsForWrite::New(alloc(), object);
+    current->add(copy);
+    return copy;
+}
+
 MInstruction *
 IonBuilder::addBoundsCheck(MDefinition *index, MDefinition *length)
 {
diff --git a/js/src/jit/IonBuilder.h b/js/src/jit/IonBuilder.h
index e1f23366faeb..558dd74b2047 100644
--- a/js/src/jit/IonBuilder.h
+++ b/js/src/jit/IonBuilder.h
@@ -375,6 +375,7 @@ class IonBuilder : public MIRGenerator
     MDefinition *walkScopeChain(unsigned hops);
 
     MInstruction *addConvertElementsToDoubles(MDefinition *elements);
+    MDefinition *addMaybeCopyElementsForWrite(MDefinition *object);
     MInstruction *addBoundsCheck(MDefinition *index, MDefinition *length);
     MInstruction *addShapeGuard(MDefinition *obj, Shape *const shape, BailoutKind bailoutKind);
 
@@ -618,6 +619,7 @@ class IonBuilder : public MIRGenerator
     bool jsop_delprop(PropertyName *name);
     bool jsop_delelem();
     bool jsop_newarray(uint32_t count);
+    bool jsop_newarray_copyonwrite();
     bool jsop_newobject();
     bool jsop_initelem();
     bool jsop_initelem_array();
diff --git a/js/src/jit/IonFrames.cpp b/js/src/jit/IonFrames.cpp
index e22b7177b06c..c3d039537fd5 100644
--- a/js/src/jit/IonFrames.cpp
+++ b/js/src/jit/IonFrames.cpp
@@ -113,7 +113,6 @@ JitFrameIterator::JitFrameIterator(IonJSFrameLayout *fp, ExecutionMode mode)
     mode_(mode),
     kind_(Kind_FrameIterator)
 {
-    verifyReturnAddressUsingNativeToBytecodeMap();
 }
 
 IonBailoutIterator *
@@ -331,7 +330,6 @@ JitFrameIterator::operator++()
     returnAddressToFp_ = current()->returnAddress();
     current_ = prev;
 
-    verifyReturnAddressUsingNativeToBytecodeMap();
 
     return *this;
 }
diff --git a/js/src/jit/IonMacroAssembler.cpp b/js/src/jit/IonMacroAssembler.cpp
index 58e9ec0b91b6..f4c33aa2fc3a 100644
--- a/js/src/jit/IonMacroAssembler.cpp
+++ b/js/src/jit/IonMacroAssembler.cpp
@@ -609,6 +609,12 @@ MacroAssembler::createGCObject(Register obj, Register temp, JSObject *templateOb
     gc::AllocKind allocKind = templateObj->tenuredGetAllocKind();
     JS_ASSERT(allocKind >= gc::FINALIZE_OBJECT0 && allocKind <= gc::FINALIZE_OBJECT_LAST);
 
+    // Arrays with copy on write elements do not need fixed space for an
+    // elements header. The template object, which owns the original elements,
+    // might have another allocation kind.
+    if (templateObj->denseElementsAreCopyOnWrite())
+        allocKind = gc::FINALIZE_OBJECT0_BACKGROUND;
+
     allocateObject(obj, temp, allocKind, nDynamicSlots, initialHeap, fail);
     initGCThing(obj, temp, templateObj, initFixedSlots);
 }
@@ -844,7 +850,7 @@ MacroAssembler::initGCThing(Register obj, Register slots, JSObject *templateObj,
 {
     // Fast initialization of an empty object returned by allocateObject().
 
-    JS_ASSERT(!templateObj->hasDynamicElements());
+    JS_ASSERT_IF(!templateObj->denseElementsAreCopyOnWrite(), !templateObj->hasDynamicElements());
 
     storePtr(ImmGCPtr(templateObj->lastProperty()), Address(obj, JSObject::offsetOfShape()));
     storePtr(ImmGCPtr(templateObj->type()), Address(obj, JSObject::offsetOfType()));
@@ -853,7 +859,10 @@ MacroAssembler::initGCThing(Register obj, Register slots, JSObject *templateObj,
     else
         storePtr(ImmPtr(nullptr), Address(obj, JSObject::offsetOfSlots()));
 
-    if (templateObj->is<ArrayObject>()) {
+    if (templateObj->denseElementsAreCopyOnWrite()) {
+        storePtr(ImmPtr((const Value *) templateObj->getDenseElements()),
+                 Address(obj, JSObject::offsetOfElements()));
+    } else if (templateObj->is<ArrayObject>()) {
         Register temp = slots;
         JS_ASSERT(!templateObj->getDenseInitializedLength());
 
diff --git a/js/src/jit/JitFrameIterator.h b/js/src/jit/JitFrameIterator.h
index f20fe53bc218..636bbd4b0a89 100644
--- a/js/src/jit/JitFrameIterator.h
+++ b/js/src/jit/JitFrameIterator.h
@@ -592,7 +592,7 @@ class InlineFrameIterator
                     parent_s.readCommonFrameSlots(nullptr, nullptr);
                     parent_s.readFunctionFrameArgs(argOp, nullptr, nullptr,
                                                    nformal, nactual, it.script(),
-                                                   unreadablePlaceholder);
+                                                   unreadablePlaceholder, silentFailure);
                 } else {
                     // There is no parent frame to this inlined frame, we can read
                     // from the frame's Value vector directly.
diff --git a/js/src/jit/LIR-Common.h b/js/src/jit/LIR-Common.h
index 0602056b347f..5b4a33aa7449 100644
--- a/js/src/jit/LIR-Common.h
+++ b/js/src/jit/LIR-Common.h
@@ -437,6 +437,24 @@ class LNewArray : public LInstructionHelper<1, 0, 1>
     }
 };
 
+class LNewArrayCopyOnWrite : public LInstructionHelper<1, 0, 1>
+{
+  public:
+    LIR_HEADER(NewArrayCopyOnWrite)
+
+    explicit LNewArrayCopyOnWrite(const LDefinition &temp) {
+        setTemp(0, temp);
+    }
+
+    const LDefinition *temp() {
+        return getTemp(0);
+    }
+
+    MNewArrayCopyOnWrite *mir() const {
+        return mir_->toNewArrayCopyOnWrite();
+    }
+};
+
 class LNewObject : public LInstructionHelper<1, 0, 1>
 {
   public:
@@ -3759,6 +3777,26 @@ class LMaybeToDoubleElement : public LInstructionHelper<BOX_PIECES, 2, 1>
     }
 };
 
+// If necessary, copy the elements in an object so they may be written to.
+class LMaybeCopyElementsForWrite : public LInstructionHelper<0, 1, 1>
+{
+  public:
+    LIR_HEADER(MaybeCopyElementsForWrite)
+
+    explicit LMaybeCopyElementsForWrite(const LAllocation &obj, const LDefinition &temp) {
+        setOperand(0, obj);
+        setTemp(0, temp);
+    }
+
+    const LAllocation *object() {
+        return getOperand(0);
+    }
+
+    const LDefinition *temp() {
+        return getTemp(0);
+    }
+};
+
 // Load the initialized length from an elements header.
 class LInitializedLength : public LInstructionHelper<1, 1, 0>
 {
diff --git a/js/src/jit/LOpcodes.h b/js/src/jit/LOpcodes.h
index 4a45ff8385ef..a2c9256de91c 100644
--- a/js/src/jit/LOpcodes.h
+++ b/js/src/jit/LOpcodes.h
@@ -31,6 +31,7 @@
     _(TableSwitchV)                 \
     _(Goto)                         \
     _(NewArray)                     \
+    _(NewArrayCopyOnWrite)          \
     _(ArraySplice)                  \
     _(NewObject)                    \
     _(NewDeclEnvObject)             \
@@ -174,6 +175,7 @@
     _(Elements)                     \
     _(ConvertElementsToDoubles)     \
     _(MaybeToDoubleElement)         \
+    _(MaybeCopyElementsForWrite)    \
     _(LoadSlotV)                    \
     _(LoadSlotT)                    \
     _(StoreSlotV)                   \
diff --git a/js/src/jit/Lowering.cpp b/js/src/jit/Lowering.cpp
index 02645d313d02..33f443815cac 100644
--- a/js/src/jit/Lowering.cpp
+++ b/js/src/jit/Lowering.cpp
@@ -155,6 +155,13 @@ LIRGenerator::visitNewArray(MNewArray *ins)
     return define(lir, ins) && assignSafepoint(lir, ins);
 }
 
+bool
+LIRGenerator::visitNewArrayCopyOnWrite(MNewArrayCopyOnWrite *ins)
+{
+    LNewArrayCopyOnWrite *lir = new(alloc()) LNewArrayCopyOnWrite(temp());
+    return define(lir, ins) && assignSafepoint(lir, ins);
+}
+
 bool
 LIRGenerator::visitNewObject(MNewObject *ins)
 {
@@ -2165,6 +2172,13 @@ LIRGenerator::visitMaybeToDoubleElement(MMaybeToDoubleElement *ins)
     return defineBox(lir, ins);
 }
 
+bool
+LIRGenerator::visitMaybeCopyElementsForWrite(MMaybeCopyElementsForWrite *ins)
+{
+    LInstruction *check = new(alloc()) LMaybeCopyElementsForWrite(useRegister(ins->object()), temp());
+    return add(check, ins) && assignSafepoint(check, ins);
+}
+
 bool
 LIRGenerator::visitLoadSlot(MLoadSlot *ins)
 {
diff --git a/js/src/jit/Lowering.h b/js/src/jit/Lowering.h
index c1fb467e0913..e3320f92bede 100644
--- a/js/src/jit/Lowering.h
+++ b/js/src/jit/Lowering.h
@@ -70,6 +70,7 @@ class LIRGenerator : public LIRGeneratorSpecific
     bool visitGoto(MGoto *ins);
     bool visitTableSwitch(MTableSwitch *tableswitch);
     bool visitNewArray(MNewArray *ins);
+    bool visitNewArrayCopyOnWrite(MNewArrayCopyOnWrite *ins);
     bool visitNewObject(MNewObject *ins);
     bool visitNewDeclEnvObject(MNewDeclEnvObject *ins);
     bool visitNewCallObject(MNewCallObject *ins);
@@ -166,6 +167,7 @@ class LIRGenerator : public LIRGeneratorSpecific
     bool visitConstantElements(MConstantElements *ins);
     bool visitConvertElementsToDoubles(MConvertElementsToDoubles *ins);
     bool visitMaybeToDoubleElement(MMaybeToDoubleElement *ins);
+    bool visitMaybeCopyElementsForWrite(MMaybeCopyElementsForWrite *ins);
     bool visitLoadSlot(MLoadSlot *ins);
     bool visitFunctionEnvironment(MFunctionEnvironment *ins);
     bool visitForkJoinContext(MForkJoinContext *ins);
diff --git a/js/src/jit/MCallOptimize.cpp b/js/src/jit/MCallOptimize.cpp
index 0c7b897b922d..4883045bcd0e 100644
--- a/js/src/jit/MCallOptimize.cpp
+++ b/js/src/jit/MCallOptimize.cpp
@@ -408,7 +408,8 @@ IonBuilder::inlineArrayPopShift(CallInfo &callInfo, MArrayPopShift::Mode mode)
         types::OBJECT_FLAG_LENGTH_OVERFLOW |
         types::OBJECT_FLAG_ITERATED;
 
-    types::TemporaryTypeSet *thisTypes = callInfo.thisArg()->resultTypeSet();
+    MDefinition *obj = callInfo.thisArg();
+    types::TemporaryTypeSet *thisTypes = obj->resultTypeSet();
     if (!thisTypes || thisTypes->getKnownClass() != &ArrayObject::class_)
         return InliningStatus_NotInlined;
     if (thisTypes->hasObjectFlags(constraints(), unhandledFlags))
@@ -419,17 +420,18 @@ IonBuilder::inlineArrayPopShift(CallInfo &callInfo, MArrayPopShift::Mode mode)
 
     callInfo.setImplicitlyUsedUnchecked();
 
+    obj = addMaybeCopyElementsForWrite(obj);
+
     types::TemporaryTypeSet *returnTypes = getInlineReturnTypeSet();
     bool needsHoleCheck = thisTypes->hasObjectFlags(constraints(), types::OBJECT_FLAG_NON_PACKED);
     bool maybeUndefined = returnTypes->hasType(types::Type::UndefinedType());
 
     BarrierKind barrier = PropertyReadNeedsTypeBarrier(analysisContext, constraints(),
-                                                       callInfo.thisArg(), nullptr, returnTypes);
+                                                       obj, nullptr, returnTypes);
     if (barrier != BarrierKind::NoBarrier)
         returnType = MIRType_Value;
 
-    MArrayPopShift *ins = MArrayPopShift::New(alloc(), callInfo.thisArg(), mode,
-                                              needsHoleCheck, maybeUndefined);
+    MArrayPopShift *ins = MArrayPopShift::New(alloc(), obj, mode, needsHoleCheck, maybeUndefined);
     current->add(ins);
     current->push(ins);
     ins->setResultType(returnType);
@@ -550,10 +552,12 @@ IonBuilder::inlineArrayPush(CallInfo &callInfo)
         value = valueDouble;
     }
 
-    if (NeedsPostBarrier(info(), value))
-        current->add(MPostWriteBarrier::New(alloc(), callInfo.thisArg(), value));
+    obj = addMaybeCopyElementsForWrite(obj);
 
-    MArrayPush *ins = MArrayPush::New(alloc(), callInfo.thisArg(), value);
+    if (NeedsPostBarrier(info(), value))
+        current->add(MPostWriteBarrier::New(alloc(), obj, value));
+
+    MArrayPush *ins = MArrayPush::New(alloc(), obj, value);
     current->add(ins);
     current->push(ins);
 
diff --git a/js/src/jit/MIR.cpp b/js/src/jit/MIR.cpp
index 5fa9a13a9d4d..9811d29d4d35 100644
--- a/js/src/jit/MIR.cpp
+++ b/js/src/jit/MIR.cpp
@@ -3447,6 +3447,13 @@ jit::ElementAccessIsPacked(types::CompilerConstraintList *constraints, MDefiniti
     return types && !types->hasObjectFlags(constraints, types::OBJECT_FLAG_NON_PACKED);
 }
 
+bool
+jit::ElementAccessMightBeCopyOnWrite(types::CompilerConstraintList *constraints, MDefinition *obj)
+{
+    types::TemporaryTypeSet *types = obj->resultTypeSet();
+    return !types || types->hasObjectFlags(constraints, types::OBJECT_FLAG_COPY_ON_WRITE);
+}
+
 bool
 jit::ElementAccessHasExtraIndexedProperty(types::CompilerConstraintList *constraints,
                                           MDefinition *obj)
diff --git a/js/src/jit/MIR.h b/js/src/jit/MIR.h
index fa01b693ab3e..35014bb6102a 100644
--- a/js/src/jit/MIR.h
+++ b/js/src/jit/MIR.h
@@ -1926,6 +1926,45 @@ class MNewArray : public MUnaryInstruction
     }
 };
 
+class MNewArrayCopyOnWrite : public MNullaryInstruction
+{
+    CompilerRootObject templateObject_;
+    gc::InitialHeap initialHeap_;
+
+    MNewArrayCopyOnWrite(types::CompilerConstraintList *constraints, JSObject *templateObject,
+              gc::InitialHeap initialHeap)
+      : templateObject_(templateObject),
+        initialHeap_(initialHeap)
+    {
+        JS_ASSERT(!templateObject->hasSingletonType());
+        setResultType(MIRType_Object);
+        setResultTypeSet(MakeSingletonTypeSet(constraints, templateObject));
+    }
+
+  public:
+    INSTRUCTION_HEADER(NewArrayCopyOnWrite)
+
+    static MNewArrayCopyOnWrite *New(TempAllocator &alloc,
+                                     types::CompilerConstraintList *constraints,
+                                     JSObject *templateObject,
+                                     gc::InitialHeap initialHeap)
+    {
+        return new(alloc) MNewArrayCopyOnWrite(constraints, templateObject, initialHeap);
+    }
+
+    JSObject *templateObject() const {
+        return templateObject_;
+    }
+
+    gc::InitialHeap initialHeap() const {
+        return initialHeap_;
+    }
+
+    virtual AliasSet getAliasSet() const {
+        return AliasSet::None();
+    }
+};
+
 class MNewObject : public MUnaryInstruction
 {
     gc::InitialHeap initialHeap_;
@@ -6451,6 +6490,49 @@ class MMaybeToDoubleElement
     }
 };
 
+// Passes through an object, after ensuring its elements are not copy on write.
+class MMaybeCopyElementsForWrite
+  : public MUnaryInstruction,
+    public SingleObjectPolicy
+{
+    explicit MMaybeCopyElementsForWrite(MDefinition *object)
+      : MUnaryInstruction(object)
+    {
+        setGuard();
+        setMovable();
+        setResultType(MIRType_Object);
+        setResultTypeSet(object->resultTypeSet());
+    }
+
+  public:
+    INSTRUCTION_HEADER(MaybeCopyElementsForWrite)
+
+    static MMaybeCopyElementsForWrite *New(TempAllocator &alloc, MDefinition *object) {
+        return new(alloc) MMaybeCopyElementsForWrite(object);
+    }
+
+    MDefinition *object() const {
+        return getOperand(0);
+    }
+    bool congruentTo(const MDefinition *ins) const {
+        return congruentIfOperandsEqual(ins);
+    }
+    AliasSet getAliasSet() const {
+        // This instruction can read and write to the elements' contents,
+        // in the same manner as MConvertElementsToDoubles. As with that
+        // instruction, this is safe to consolidate and freely reorder this
+        // instruction, though this must precede any loads of the object's
+        // elements pointer or writes to the object's elements. The latter
+        // property is ensured by chaining this with the object definition
+        // itself, in the same manner as MBoundsCheck.
+        return AliasSet::None();
+    }
+
+    TypePolicy *typePolicy() {
+        return this;
+    }
+};
+
 // Load the initialized length from an elements header.
 class MInitializedLength
   : public MUnaryInstruction
@@ -11343,6 +11425,7 @@ bool ElementAccessIsDenseNative(MDefinition *obj, MDefinition *id);
 bool ElementAccessIsTypedArray(MDefinition *obj, MDefinition *id,
                                Scalar::Type *arrayType);
 bool ElementAccessIsPacked(types::CompilerConstraintList *constraints, MDefinition *obj);
+bool ElementAccessMightBeCopyOnWrite(types::CompilerConstraintList *constraints, MDefinition *obj);
 bool ElementAccessHasExtraIndexedProperty(types::CompilerConstraintList *constraints,
                                           MDefinition *obj);
 MIRType DenseNativeElementType(types::CompilerConstraintList *constraints, MDefinition *obj);
diff --git a/js/src/jit/MOpcodes.h b/js/src/jit/MOpcodes.h
index d85b049fadbf..4becf6c00c76 100644
--- a/js/src/jit/MOpcodes.h
+++ b/js/src/jit/MOpcodes.h
@@ -93,6 +93,7 @@ namespace jit {
     _(TruncateToInt32)                                                      \
     _(ToString)                                                             \
     _(NewArray)                                                             \
+    _(NewArrayCopyOnWrite)                                                  \
     _(NewObject)                                                            \
     _(NewDeclEnvObject)                                                     \
     _(NewCallObject)                                                        \
@@ -121,6 +122,7 @@ namespace jit {
     _(ConstantElements)                                                     \
     _(ConvertElementsToDoubles)                                             \
     _(MaybeToDoubleElement)                                                 \
+    _(MaybeCopyElementsForWrite)                                            \
     _(LoadSlot)                                                             \
     _(StoreSlot)                                                            \
     _(FunctionEnvironment)                                                  \
diff --git a/js/src/jit/ParallelSafetyAnalysis.cpp b/js/src/jit/ParallelSafetyAnalysis.cpp
index 510ed747413e..22b4f6b312a5 100644
--- a/js/src/jit/ParallelSafetyAnalysis.cpp
+++ b/js/src/jit/ParallelSafetyAnalysis.cpp
@@ -187,6 +187,7 @@ class ParallelSafetyVisitor : public MDefinitionVisitor
     SAFE_OP(MaybeToDoubleElement)
     CUSTOM_OP(ToString)
     CUSTOM_OP(NewArray)
+    UNSAFE_OP(NewArrayCopyOnWrite)
     CUSTOM_OP(NewObject)
     CUSTOM_OP(NewCallObject)
     CUSTOM_OP(NewRunOnceCallObject)
@@ -336,6 +337,7 @@ class ParallelSafetyVisitor : public MDefinitionVisitor
 
     // It looks like this could easily be made safe:
     UNSAFE_OP(ConvertElementsToDoubles)
+    UNSAFE_OP(MaybeCopyElementsForWrite)
 };
 
 static void
diff --git a/js/src/jsapi-tests/moz.build b/js/src/jsapi-tests/moz.build
index 266f312a7af8..3e485bf5c6ec 100644
--- a/js/src/jsapi-tests/moz.build
+++ b/js/src/jsapi-tests/moz.build
@@ -24,6 +24,7 @@ UNIFIED_SOURCES += [
     'testDeepFreeze.cpp',
     'testDefineGetterSetterNonEnumerable.cpp',
     'testDefineProperty.cpp',
+    'testDefinePropertyIgnoredAttributes.cpp',
     'testEnclosingFunction.cpp',
     'testErrorCopying.cpp',
     'testException.cpp',
@@ -63,6 +64,7 @@ UNIFIED_SOURCES += [
     'testResolveRecursion.cpp',
     'tests.cpp',
     'testSameValue.cpp',
+    'testSavedStacks.cpp',
     'testScriptInfo.cpp',
     'testScriptObject.cpp',
     'testSetProperty.cpp',
diff --git a/js/src/jsapi-tests/testDefinePropertyIgnoredAttributes.cpp b/js/src/jsapi-tests/testDefinePropertyIgnoredAttributes.cpp
new file mode 100644
index 000000000000..e9f99f34929e
--- /dev/null
+++ b/js/src/jsapi-tests/testDefinePropertyIgnoredAttributes.cpp
@@ -0,0 +1,94 @@
+/* -*- Mode: C++; tab-width: 8; indent-tabs-mode: nil; c-basic-offset: 4 -*-
+ * vim: set ts=8 sts=4 et sw=4 tw=99:
+ */
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+#include "jsapi-tests/tests.h"
+
+static const unsigned IgnoreWithValue = JSPROP_IGNORE_ENUMERATE | JSPROP_IGNORE_READONLY |
+                               JSPROP_IGNORE_PERMANENT;
+static const unsigned IgnoreAll = IgnoreWithValue | JSPROP_IGNORE_VALUE;
+
+static const unsigned AllowConfigure = IgnoreAll & ~JSPROP_IGNORE_PERMANENT;
+static const unsigned AllowEnumerate = IgnoreAll & ~JSPROP_IGNORE_ENUMERATE;
+static const unsigned AllowWritable  = IgnoreAll & ~JSPROP_IGNORE_READONLY;
+static const unsigned ValueWithConfigurable = IgnoreWithValue & ~JSPROP_IGNORE_PERMANENT;
+
+static bool
+Getter(JSContext *cx, unsigned argc, JS::Value *vp)
+{
+    JS::CallArgs args = CallArgsFromVp(argc, vp);
+    args.rval().setBoolean(true);
+    return true;
+}
+
+static bool
+CheckDescriptor(JS::Handle<JSPropertyDescriptor> desc, bool enumerable,
+                bool writable, bool configurable)
+{
+    if (!desc.object())
+        return false;
+    if (desc.isEnumerable() != enumerable)
+        return false;
+    if (desc.isReadonly() == writable)
+        return false;
+    if (desc.isPermanent() == configurable)
+        return false;
+    return true;
+}
+
+BEGIN_TEST(testDefinePropertyIgnoredAttributes)
+{
+    JS::RootedObject obj(cx, JS_NewObject(cx, nullptr, JS::NullPtr(), JS::NullPtr()));
+    JS::Rooted<JSPropertyDescriptor> desc(cx);
+    JS::RootedValue defineValue(cx);
+
+    // Try a getter. Allow it to fill in the defaults.
+    CHECK(JS_DefineProperty(cx, obj, "foo", defineValue,
+                            IgnoreAll | JSPROP_NATIVE_ACCESSORS, (JSPropertyOp)Getter));
+
+    CHECK(JS_GetPropertyDescriptor(cx, obj, "foo", &desc));
+
+    // Note that since JSPROP_READONLY means nothing for accessor properties, we will actually
+    // claim to be writable, since the flag is not included in the mask.
+    CHECK(CheckDescriptor(desc, false, true, false));
+
+    // Install another configurable property, so we can futz with it.
+    CHECK(JS_DefineProperty(cx, obj, "bar", defineValue,
+                            AllowConfigure | JSPROP_NATIVE_ACCESSORS, (JSPropertyOp)Getter));
+    CHECK(JS_GetPropertyDescriptor(cx, obj, "bar", &desc));
+    CHECK(CheckDescriptor(desc, false, true, true));
+
+    // Rewrite the descriptor to now be enumerable, ensuring that the lack of
+    // configurablity stayed.
+    CHECK(JS_DefineProperty(cx, obj, "bar", defineValue,
+                            AllowEnumerate |
+                            JSPROP_ENUMERATE |
+                            JSPROP_NATIVE_ACCESSORS,
+                            (JSPropertyOp)Getter));
+    CHECK(JS_GetPropertyDescriptor(cx, obj, "bar", &desc));
+    CHECK(CheckDescriptor(desc, true, true, true));
+
+    // Now try the same game with a value property
+    defineValue.setObject(*obj);
+    CHECK(JS_DefineProperty(cx, obj, "baz", defineValue, IgnoreWithValue));
+    CHECK(JS_GetPropertyDescriptor(cx, obj, "baz", &desc));
+    CHECK(CheckDescriptor(desc, false, false, false));
+
+    // Now again with a configurable property
+    CHECK(JS_DefineProperty(cx, obj, "quox", defineValue, ValueWithConfigurable));
+    CHECK(JS_GetPropertyDescriptor(cx, obj, "quox", &desc));
+    CHECK(CheckDescriptor(desc, false, false, true));
+
+    // Just make it writable. Leave the old value and everythign else alone.
+    defineValue.setUndefined();
+    CHECK(JS_DefineProperty(cx, obj, "quox", defineValue, AllowWritable));
+    CHECK(JS_GetPropertyDescriptor(cx, obj, "quox", &desc));
+    CHECK(CheckDescriptor(desc, false, true, true));
+    CHECK_SAME(ObjectValue(*obj), desc.value());
+
+    return true;
+}
+END_TEST(testDefinePropertyIgnoredAttributes)
diff --git a/js/src/jsapi-tests/testSavedStacks.cpp b/js/src/jsapi-tests/testSavedStacks.cpp
new file mode 100644
index 000000000000..691a30d38ede
--- /dev/null
+++ b/js/src/jsapi-tests/testSavedStacks.cpp
@@ -0,0 +1,24 @@
+/* -*- Mode: C++; tab-width: 8; indent-tabs-mode: nil; c-basic-offset: 4 -*-
+ * vim: set ts=8 sts=4 et sw=4 tw=99:
+ * This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+#include "jscompartment.h"
+#include "jsfriendapi.h"
+#include "jsstr.h"
+
+#include "jsapi-tests/tests.h"
+
+#include "vm/ArrayObject.h"
+#include "vm/SavedStacks.h"
+
+BEGIN_TEST(testSavedStacks_withNoStack)
+{
+    JSCompartment *compartment = js::GetContextCompartment(cx);
+    compartment->setObjectMetadataCallback(js::SavedStacksMetadataCallback);
+    JS::RootedObject obj(cx, js::NewDenseEmptyArray(cx));
+    compartment->setObjectMetadataCallback(nullptr);
+    return true;
+}
+END_TEST(testSavedStacks_withNoStack)
diff --git a/js/src/jsapi.h b/js/src/jsapi.h
index b6d6b70ca28f..055c746c875a 100644
--- a/js/src/jsapi.h
+++ b/js/src/jsapi.h
@@ -894,7 +894,12 @@ class MOZ_STACK_CLASS SourceBufferHolder MOZ_FINAL
 
 /************************************************************************/
 
-/* Property attributes, set in JSPropertySpec and passed to API functions. */
+/* Property attributes, set in JSPropertySpec and passed to API functions.
+ *
+ * NB: The data structure in which some of these values are stored only uses
+ *     a uint8_t to store the relevant information. Proceed with caution if
+ *     trying to reorder or change the the first byte worth of flags.
+ */
 #define JSPROP_ENUMERATE        0x01    /* property is visible to for/in loop */
 #define JSPROP_READONLY         0x02    /* not settable: assignment is no-op.
                                            This flag is only valid when neither
@@ -918,6 +923,18 @@ class MOZ_STACK_CLASS SourceBufferHolder MOZ_FINAL
 
 #define JSFUN_CONSTRUCTOR      0x400    /* native that can be called as a ctor */
 
+#define JSPROP_IGNORE_ENUMERATE 0x1000  /* ignore the value in JSPROP_ENUMERATE.
+                                           This flag only valid when defining over
+                                           an existing property. */
+#define JSPROP_IGNORE_READONLY  0x2000  /* ignore the value in JSPROP_READONLY.
+                                           This flag only valid when defining over
+                                           an existing property. */
+#define JSPROP_IGNORE_PERMANENT 0x4000  /* ignore the value in JSPROP_PERMANENT.
+                                           This flag only valid when defining over
+                                           an existing property. */
+#define JSPROP_IGNORE_VALUE     0x8000  /* ignore the Value in the descriptor. Nothing was
+                                           specified when passed to Object.defineProperty
+                                           from script. */
 
 /*
  * Specify a generic native prototype methods, i.e., methods of a class
diff --git a/js/src/jsarray.cpp b/js/src/jsarray.cpp
index 1ffbe4840fe0..464b53e5d125 100644
--- a/js/src/jsarray.cpp
+++ b/js/src/jsarray.cpp
@@ -336,6 +336,8 @@ DeleteArrayElement(JSContext *cx, HandleObject obj, double index, bool *succeede
         if (index <= UINT32_MAX) {
             uint32_t idx = uint32_t(index);
             if (idx < obj->getDenseInitializedLength()) {
+                if (!obj->maybeCopyElementsForWrite(cx))
+                    return false;
                 obj->markDenseElementsNotPacked(cx);
                 obj->setDenseElement(idx, MagicValue(JS_ELEMENTS_HOLE));
                 if (!js_SuppressDeletedElement(cx, obj, idx))
@@ -472,6 +474,9 @@ js::ArraySetLength(typename ExecutionModeTraits<mode>::ContextType cxArg,
     MOZ_ASSERT(cxArg->isThreadLocal(arr));
     MOZ_ASSERT(id == NameToId(cxArg->names().length));
 
+    if (!arr->maybeCopyElementsForWrite(cxArg))
+        return false;
+
     /* Steps 1-2 are irrelevant in our implementation. */
 
     /* Steps 3-5. */
@@ -547,6 +552,9 @@ js::ArraySetLength(typename ExecutionModeTraits<mode>::ContextType cxArg,
         // fix this inefficiency by moving indexed storage to be entirely
         // separate from non-indexed storage.
         if (!arr->isIndexed()) {
+            if (!arr->maybeCopyElementsForWrite(cxArg))
+                return false;
+
             uint32_t oldCapacity = arr->getDenseCapacity();
             uint32_t oldInitializedLength = arr->getDenseInitializedLength();
             MOZ_ASSERT(oldCapacity >= oldInitializedLength);
@@ -2139,8 +2147,11 @@ js::array_pop(JSContext *cx, unsigned argc, Value *vp)
     // Don't do anything if this isn't an array, as any deletion above has no
     // effect on any elements after the "last" one indicated by the "length"
     // property.
-    if (obj->is<ArrayObject>() && obj->getDenseInitializedLength() > index)
+    if (obj->is<ArrayObject>() && obj->getDenseInitializedLength() > index) {
+        if (!obj->maybeCopyElementsForWrite(cx))
+            return false;
         obj->setDenseInitializedLength(index);
+    }
 
     /* Steps 4a, 5d. */
     return SetLengthProperty(cx, obj, index);
@@ -2200,6 +2211,9 @@ js::array_shift(JSContext *cx, unsigned argc, Value *vp)
         if (args.rval().isMagic(JS_ELEMENTS_HOLE))
             args.rval().setUndefined();
 
+        if (!obj->maybeCopyElementsForWrite(cx))
+            return false;
+
         obj->moveDenseElements(0, 1, obj->getDenseInitializedLength() - 1);
         obj->setDenseInitializedLength(obj->getDenseInitializedLength() - 1);
 
@@ -2458,6 +2472,9 @@ js::array_splice_impl(JSContext *cx, unsigned argc, Value *vp, bool returnValueI
         uint32_t finalLength = len - actualDeleteCount + itemCount;
 
         if (CanOptimizeForDenseStorage(obj, 0, len, cx)) {
+            if (!obj->maybeCopyElementsForWrite(cx))
+                return false;
+
             /* Steps 12(a)-(b). */
             obj->moveDenseElements(targetIndex, sourceIndex, len - sourceIndex);
 
@@ -2539,6 +2556,8 @@ js::array_splice_impl(JSContext *cx, unsigned argc, Value *vp, bool returnValueI
         }
 
         if (CanOptimizeForDenseStorage(obj, len, itemCount - actualDeleteCount, cx)) {
+            if (!obj->maybeCopyElementsForWrite(cx))
+                return false;
             obj->moveDenseElements(actualStart + itemCount,
                                    actualStart + actualDeleteCount,
                                    len - (actualStart + actualDeleteCount));
@@ -3343,12 +3362,7 @@ js::NewDenseAllocatedArrayWithTemplate(JSContext *cx, uint32_t length, JSObject
     allocKind = GetBackgroundAllocKind(allocKind);
 
     RootedTypeObject type(cx, templateObject->type());
-    if (!type)
-        return nullptr;
-
     RootedShape shape(cx, templateObject->lastProperty());
-    if (!shape)
-        return nullptr;
 
     gc::InitialHeap heap = GetInitialHeap(GenericObject, &ArrayObject::class_);
     Rooted<ArrayObject *> arr(cx, JSObject::createArray(cx, allocKind, heap, shape, type, length));
@@ -3363,6 +3377,32 @@ js::NewDenseAllocatedArrayWithTemplate(JSContext *cx, uint32_t length, JSObject
     return arr;
 }
 
+JSObject *
+js::NewDenseCopyOnWriteArray(JSContext *cx, HandleObject templateObject, gc::InitialHeap heap)
+{
+    RootedTypeObject type(cx, templateObject->type());
+    RootedShape shape(cx, templateObject->lastProperty());
+
+    JS_ASSERT(!gc::IsInsideNursery(templateObject));
+    HeapSlot *elements = templateObject->getDenseElementsAllowCopyOnWrite();
+
+    JSObject *metadata = nullptr;
+    if (!NewObjectMetadata(cx, &metadata))
+        return nullptr;
+    if (metadata) {
+        shape = Shape::setObjectMetadata(cx, metadata, templateObject->getTaggedProto(), shape);
+        if (!shape)
+            return nullptr;
+    }
+
+    Rooted<ArrayObject *> arr(cx, JSObject::createArray(cx, heap, shape, type, elements));
+    if (!arr)
+        return nullptr;
+
+    probes::CreateObject(cx, arr);
+    return arr;
+}
+
 #ifdef DEBUG
 bool
 js_ArrayInfo(JSContext *cx, unsigned argc, Value *vp)
diff --git a/js/src/jsarray.h b/js/src/jsarray.h
index 0f6e5b38bc70..b46cec85357b 100644
--- a/js/src/jsarray.h
+++ b/js/src/jsarray.h
@@ -81,6 +81,10 @@ NewDenseCopiedArray(JSContext *cx, uint32_t length, const Value *values, JSObjec
 extern ArrayObject *
 NewDenseAllocatedArrayWithTemplate(JSContext *cx, uint32_t length, JSObject *templateObject);
 
+/* Create a dense array with the same copy-on-write elements as another object. */
+extern JSObject *
+NewDenseCopyOnWriteArray(JSContext *cx, HandleObject templateObject, gc::InitialHeap heap);
+
 /*
  * Determines whether a write to the given element on |obj| should fail because
  * |obj| is an Array with a non-writable length, and writing that element would
diff --git a/js/src/jsinfer.cpp b/js/src/jsinfer.cpp
index 287c1e493be0..b87b78178990 100644
--- a/js/src/jsinfer.cpp
+++ b/js/src/jsinfer.cpp
@@ -3465,6 +3465,50 @@ types::FillBytecodeTypeMap(JSScript *script, uint32_t *bytecodeMap)
     JS_ASSERT(added == script->nTypeSets());
 }
 
+JSObject *
+types::GetOrFixupCopyOnWriteObject(JSContext *cx, HandleScript script, jsbytecode *pc)
+{
+    // Make sure that the template object for script/pc has a type indicating
+    // that the object and its copies have copy on write elements.
+    RootedObject obj(cx, script->getObject(GET_UINT32_INDEX(pc)));
+    JS_ASSERT(obj->is<ArrayObject>());
+    JS_ASSERT(obj->denseElementsAreCopyOnWrite());
+
+    if (obj->type()->hasAnyFlags(OBJECT_FLAG_COPY_ON_WRITE))
+        return obj;
+
+    RootedTypeObject type(cx, TypeScript::InitObject(cx, script, pc, JSProto_Array));
+    if (!type)
+        return nullptr;
+
+    type->addFlags(OBJECT_FLAG_COPY_ON_WRITE);
+
+    // Update type information in the initializer object type.
+    JS_ASSERT(obj->slotSpan() == 0);
+    for (size_t i = 0; i < obj->getDenseInitializedLength(); i++) {
+        const Value &v = obj->getDenseElement(i);
+        AddTypePropertyId(cx, type, JSID_VOID, v);
+    }
+
+    obj->setType(type);
+    return obj;
+}
+
+JSObject *
+types::GetCopyOnWriteObject(JSScript *script, jsbytecode *pc)
+{
+    // GetOrFixupCopyOnWriteObject should already have been called for
+    // script/pc, ensuring that the template object has a type with the
+    // COPY_ON_WRITE flag. We don't assert this here, due to a corner case
+    // where this property doesn't hold. See jsop_newarray_copyonwrite in
+    // IonBuilder.
+    JSObject *obj = script->getObject(GET_UINT32_INDEX(pc));
+    JS_ASSERT(obj->is<ArrayObject>());
+    JS_ASSERT(obj->denseElementsAreCopyOnWrite());
+
+    return obj;
+}
+
 void
 types::TypeMonitorResult(JSContext *cx, JSScript *script, jsbytecode *pc, const js::Value &rval)
 {
diff --git a/js/src/jsinfer.h b/js/src/jsinfer.h
index 3dd0d3afffbc..cbc219b3da4c 100644
--- a/js/src/jsinfer.h
+++ b/js/src/jsinfer.h
@@ -484,14 +484,17 @@ enum MOZ_ENUM_TYPE(uint32_t) {
      */
     OBJECT_FLAG_PRE_TENURE            = 0x00400000,
 
+    /* Whether objects with this type might have copy on write elements. */
+    OBJECT_FLAG_COPY_ON_WRITE         = 0x00800000,
+
     /*
      * Whether all properties of this object are considered unknown.
      * If set, all other flags in DYNAMIC_MASK will also be set.
      */
-    OBJECT_FLAG_UNKNOWN_PROPERTIES    = 0x00800000,
+    OBJECT_FLAG_UNKNOWN_PROPERTIES    = 0x01000000,
 
     /* Flags which indicate dynamic properties of represented objects. */
-    OBJECT_FLAG_DYNAMIC_MASK          = 0x00ff0000,
+    OBJECT_FLAG_DYNAMIC_MASK          = 0x01ff0000,
 
     /* Mask for objects created with unknown properties. */
     OBJECT_FLAG_UNKNOWN_MASK =
@@ -1280,6 +1283,12 @@ class TypeScript
 void
 FillBytecodeTypeMap(JSScript *script, uint32_t *bytecodeMap);
 
+JSObject *
+GetOrFixupCopyOnWriteObject(JSContext *cx, HandleScript script, jsbytecode *pc);
+
+JSObject *
+GetCopyOnWriteObject(JSScript *script, jsbytecode *pc);
+
 class RecompileInfo;
 
 // Allocate a CompilerOutput for a finished compilation and generate the type
diff --git a/js/src/jsobj.cpp b/js/src/jsobj.cpp
index 0c1c62bda238..dd717126d2ae 100644
--- a/js/src/jsobj.cpp
+++ b/js/src/jsobj.cpp
@@ -312,12 +312,12 @@ PropDesc::initFromPropertyDescriptor(Handle<PropertyDescriptor> desc)
         get_.setUndefined();
         hasSet_ = false;
         set_.setUndefined();
-        hasValue_ = true;
-        value_ = desc.value();
-        hasWritable_ = true;
+        hasValue_ = !(desc.attributes() & JSPROP_IGNORE_VALUE);
+        value_ = hasValue_ ? desc.value() : UndefinedValue();
+        hasWritable_ = !(desc.attributes() & JSPROP_IGNORE_READONLY);
     }
-    hasEnumerable_ = true;
-    hasConfigurable_ = true;
+    hasEnumerable_ = !(desc.attributes() & JSPROP_IGNORE_ENUMERATE);
+    hasConfigurable_ = !(desc.attributes() & JSPROP_IGNORE_PERMANENT);
 }
 
 void
@@ -331,7 +331,19 @@ PropDesc::populatePropertyDescriptor(HandleObject obj, MutableHandle<PropertyDes
     desc.value().set(hasValue() ? value() : UndefinedValue());
     desc.setGetter(getter());
     desc.setSetter(setter());
-    desc.setAttributes(attributes());
+
+    // Make sure we honor the "has" notions in some way.
+    unsigned attrs = attributes();
+    if (!hasEnumerable())
+        attrs |= JSPROP_IGNORE_ENUMERATE;
+    if (!hasWritable())
+        attrs |= JSPROP_IGNORE_READONLY;
+    if (!hasConfigurable())
+        attrs |= JSPROP_IGNORE_PERMANENT;
+    if (!hasValue())
+        attrs |= JSPROP_IGNORE_VALUE;
+    desc.setAttributes(attrs);
+
     desc.object().set(obj);
 }
 
@@ -654,7 +666,60 @@ Reject(JSContext *cx, HandleId id, unsigned errorNumber, bool throwError, bool *
     return true;
 }
 
-// See comments on CheckDefineProperty in jsobj.h.
+static unsigned
+ApplyAttributes(unsigned attrs, bool enumerable, bool writable, bool configurable)
+{
+    /*
+     * Respect the fact that some callers may want to preserve existing attributes as much as
+     * possible, or install defaults otherwise.
+     */
+    if (attrs & JSPROP_IGNORE_ENUMERATE) {
+        attrs &= ~JSPROP_IGNORE_ENUMERATE;
+        if (enumerable)
+            attrs |= JSPROP_ENUMERATE;
+        else
+            attrs &= ~JSPROP_ENUMERATE;
+    }
+    if (attrs & JSPROP_IGNORE_READONLY) {
+        attrs &= ~JSPROP_IGNORE_READONLY;
+        // Only update the writability if it's relevant
+        if (!(attrs & (JSPROP_GETTER | JSPROP_SETTER))) {
+            if (!writable)
+                attrs |= JSPROP_READONLY;
+            else
+                attrs &= ~JSPROP_READONLY;
+        }
+    }
+    if (attrs & JSPROP_IGNORE_PERMANENT) {
+        attrs &= ~JSPROP_IGNORE_PERMANENT;
+        if (!configurable)
+            attrs |= JSPROP_PERMANENT;
+        else
+            attrs &= ~JSPROP_PERMANENT;
+    }
+    return attrs;
+}
+
+static unsigned
+ApplyOrDefaultAttributes(unsigned attrs, const Shape *shape = nullptr)
+{
+    bool enumerable = shape ? shape->enumerable() : false;
+    bool writable = shape ? shape->writable() : false;
+    bool configurable = shape ? shape->configurable() : false;
+    return ApplyAttributes(attrs, enumerable, writable, configurable);
+}
+
+static unsigned
+ApplyOrDefaultAttributes(unsigned attrs, Handle<PropertyDescriptor> desc)
+{
+    bool present = !!desc.object();
+    bool enumerable = present ? desc.isEnumerable() : false;
+    bool writable = present ? !desc.isReadonly() : false;
+    bool configurable = present ? !desc.isPermanent() : false;
+    return ApplyAttributes(attrs, enumerable, writable, configurable);
+}
+
+// See comments on CheckDefineProperty in jsfriendapi.h.
 //
 // DefinePropertyOnObject has its own implementation of these checks.
 //
@@ -671,6 +736,11 @@ js::CheckDefineProperty(JSContext *cx, HandleObject obj, HandleId id, HandleValu
     if (!GetOwnPropertyDescriptor(cx, obj, id, &desc))
         return false;
 
+    // Appropriately handle the potential for ignored attributes. Since the proxy code calls us
+    // directly, these might flow in legitimately. Ensure that we compare against the values that
+    // are intended.
+    attrs = ApplyOrDefaultAttributes(attrs, desc) & ~JSPROP_IGNORE_VALUE;
+
     // This does not have to check obj's extensibility when !desc.obj (steps
     // 2-3) because the low-level methods JSObject::{add,put}Property check
     // for that.
@@ -1295,8 +1365,11 @@ JSObject::sealOrFreeze(JSContext *cx, HandleObject obj, ImmutabilityType it)
     // arrays with non-writable length.  We don't need to do anything special
     // for that, because capacity was zeroed out by preventExtensions.  (See
     // the assertion before the if-else above.)
-    if (it == FREEZE && obj->is<ArrayObject>())
+    if (it == FREEZE && obj->is<ArrayObject>()) {
+        if (!obj->maybeCopyElementsForWrite(cx))
+            return false;
         obj->getElementsHeader()->setNonwritableArrayLength();
+    }
 
     return true;
 }
@@ -2245,15 +2318,48 @@ js::XDRObjectLiteral(XDRState<XDR_DECODE> *xdr, MutableHandleObject obj);
 JSObject *
 js::CloneObjectLiteral(JSContext *cx, HandleObject parent, HandleObject srcObj)
 {
-    Rooted<TypeObject*> typeObj(cx);
-    typeObj = cx->getNewType(&JSObject::class_, TaggedProto(cx->global()->getOrCreateObjectPrototype(cx)));
+    if (srcObj->getClass() == &JSObject::class_) {
+        AllocKind kind = GetBackgroundAllocKind(GuessObjectGCKind(srcObj->numFixedSlots()));
+        JS_ASSERT_IF(srcObj->isTenured(), kind == srcObj->tenuredGetAllocKind());
 
-    JS_ASSERT(srcObj->getClass() == &JSObject::class_);
-    AllocKind kind = GetBackgroundAllocKind(GuessObjectGCKind(srcObj->numFixedSlots()));
-    JS_ASSERT_IF(srcObj->isTenured(), kind == srcObj->tenuredGetAllocKind());
+        JSObject *proto = cx->global()->getOrCreateObjectPrototype(cx);
+        if (!proto)
+            return nullptr;
+        Rooted<TypeObject*> typeObj(cx, cx->getNewType(&JSObject::class_, TaggedProto(proto)));
+        if (!typeObj)
+            return nullptr;
 
-    RootedShape shape(cx, srcObj->lastProperty());
-    return NewReshapedObject(cx, typeObj, parent, kind, shape);
+        RootedShape shape(cx, srcObj->lastProperty());
+        return NewReshapedObject(cx, typeObj, parent, kind, shape);
+    }
+
+    JS_ASSERT(srcObj->is<ArrayObject>());
+    JS_ASSERT(srcObj->denseElementsAreCopyOnWrite());
+    JS_ASSERT(srcObj->getElementsHeader()->ownerObject() == srcObj);
+
+    size_t length = srcObj->as<ArrayObject>().length();
+    RootedObject res(cx, NewDenseAllocatedArray(cx, length, nullptr, MaybeSingletonObject));
+    if (!res)
+        return nullptr;
+
+    RootedId id(cx);
+    RootedValue value(cx);
+    for (size_t i = 0; i < length; i++) {
+        // The only markable values in copy on write arrays are atoms, which
+        // can be freely copied between compartments.
+        value = srcObj->getDenseElement(i);
+        JS_ASSERT_IF(value.isMarkable(),
+                     cx->runtime()->isAtomsZone(value.toGCThing()->tenuredZone()));
+
+        id = INT_TO_JSID(i);
+        if (!JSObject::defineGeneric(cx, res, id, value, nullptr, nullptr, JSPROP_ENUMERATE))
+            return nullptr;
+    }
+
+    if (!ObjectElements::MakeElementsCopyOnWrite(cx, res))
+        return nullptr;
+
+    return res;
 }
 
 struct JSObject::TradeGutsReserved {
@@ -2993,6 +3099,9 @@ JSObject::shrinkSlots(ThreadSafeContext *cx, HandleObject obj, uint32_t oldCount
 /* static */ bool
 JSObject::sparsifyDenseElement(ExclusiveContext *cx, HandleObject obj, uint32_t index)
 {
+    if (!obj->maybeCopyElementsForWrite(cx))
+        return false;
+
     RootedValue value(cx, obj->getDenseElement(index));
     JS_ASSERT(!value.isMagic(JS_ELEMENTS_HOLE));
 
@@ -3013,6 +3122,9 @@ JSObject::sparsifyDenseElement(ExclusiveContext *cx, HandleObject obj, uint32_t
 /* static */ bool
 JSObject::sparsifyDenseElements(js::ExclusiveContext *cx, HandleObject obj)
 {
+    if (!obj->maybeCopyElementsForWrite(cx))
+        return false;
+
     uint32_t initialized = obj->getDenseInitializedLength();
 
     /* Create new properties with the value of non-hole dense elements. */
@@ -3131,6 +3243,9 @@ JSObject::maybeDensifySparseElements(js::ExclusiveContext *cx, HandleObject obj)
      * properties into dense elements.
      */
 
+    if (!obj->maybeCopyElementsForWrite(cx))
+        return ED_FAILED;
+
     if (newInitializedLength > obj->getDenseCapacity()) {
         if (!obj->growElements(cx, newInitializedLength))
             return ED_FAILED;
@@ -3312,6 +3427,8 @@ JSObject::growElements(ThreadSafeContext *cx, uint32_t reqCapacity)
 {
     JS_ASSERT(nonProxyIsExtensible());
     JS_ASSERT(canHaveNonEmptyElements());
+    if (denseElementsAreCopyOnWrite())
+        MOZ_CRASH();
 
     uint32_t oldCapacity = getDenseCapacity();
     JS_ASSERT(oldCapacity < reqCapacity);
@@ -3374,6 +3491,8 @@ JSObject::shrinkElements(ThreadSafeContext *cx, uint32_t reqCapacity)
 {
     JS_ASSERT(cx->isThreadLocal(this));
     JS_ASSERT(canHaveNonEmptyElements());
+    if (denseElementsAreCopyOnWrite())
+        MOZ_CRASH();
 
     if (!hasDynamicElements())
         return;
@@ -3401,6 +3520,38 @@ JSObject::shrinkElements(ThreadSafeContext *cx, uint32_t reqCapacity)
     elements = newheader->elements();
 }
 
+/* static */ bool
+JSObject::CopyElementsForWrite(ThreadSafeContext *cx, JSObject *obj)
+{
+    JS_ASSERT(obj->denseElementsAreCopyOnWrite());
+
+    // The original owner of a COW elements array should never be modified.
+    JS_ASSERT(obj->getElementsHeader()->ownerObject() != obj);
+
+    uint32_t initlen = obj->getDenseInitializedLength();
+    uint32_t allocated = initlen + ObjectElements::VALUES_PER_HEADER;
+    uint32_t newAllocated = goodAllocated(allocated);
+
+    uint32_t newCapacity = newAllocated - ObjectElements::VALUES_PER_HEADER;
+
+    if (newCapacity >= NELEMENTS_LIMIT)
+        return false;
+
+    ObjectElements *newheader = AllocateElements(cx, obj, newAllocated);
+    if (!newheader)
+        return false;
+    js_memcpy(newheader, obj->getElementsHeader(),
+              (ObjectElements::VALUES_PER_HEADER + initlen) * sizeof(Value));
+
+    newheader->capacity = newCapacity;
+    newheader->clearCopyOnWrite();
+    obj->elements = newheader->elements();
+
+    Debug_SetSlotRangeToCrashOnTouch(obj->elements + initlen, newCapacity - initlen);
+
+    return true;
+}
+
 bool
 js::SetClassAndProto(JSContext *cx, HandleObject obj,
                      const Class *clasp, Handle<js::TaggedProto> proto,
@@ -3897,6 +4048,9 @@ CallAddPropertyHookDense(typename ExecutionModeTraits<mode>::ExclusiveContextTyp
         if (!cx->shouldBeJSContext())
             return false;
 
+        if (!obj->maybeCopyElementsForWrite(cx))
+            return false;
+
         /* Make a local copy of value so addProperty can mutate its inout parameter. */
         RootedValue value(cx, nominal);
 
@@ -4034,6 +4188,9 @@ DefinePropertyOrElement(typename ExecutionModeTraits<mode>::ExclusiveContextType
         if (mode == ParallelExecution)
             return false;
 
+        if (!obj->maybeCopyElementsForWrite(cx))
+            return false;
+
         ExclusiveContext *ncx = cx->asExclusiveContext();
         uint32_t index = JSID_TO_INT(id);
         JSObject::removeDenseElementForSparseIndex(ncx, obj, index);
@@ -4071,20 +4228,23 @@ js::DefineNativeProperty(ExclusiveContext *cx, HandleObject obj, HandleId id, Ha
 
     AutoRooterGetterSetter gsRoot(cx, attrs, &getter, &setter);
 
+    RootedShape shape(cx);
+    RootedValue updateValue(cx, value);
+    bool shouldDefine = true;
+
     /*
      * If defining a getter or setter, we must check for its counterpart and
      * update the attributes and property ops.  A getter or setter is really
      * only half of a property.
      */
-    RootedShape shape(cx);
     if (attrs & (JSPROP_GETTER | JSPROP_SETTER)) {
-        /*
-         * If we are defining a getter whose setter was already defined, or
-         * vice versa, finish the job via obj->changeProperty.
-         */
         if (!NativeLookupOwnProperty(cx, obj, id, &shape))
             return false;
         if (shape) {
+            /*
+             * If we are defining a getter whose setter was already defined, or
+             * vice versa, finish the job via obj->changeProperty.
+             */
             if (IsImplicitDenseOrTypedArrayElement(shape)) {
                 if (obj->is<TypedArrayObject>()) {
                     /* Ignore getter/setter properties added to typed arrays. */
@@ -4095,6 +4255,7 @@ js::DefineNativeProperty(ExclusiveContext *cx, HandleObject obj, HandleId id, Ha
                 shape = obj->nativeLookup(cx, id);
             }
             if (shape->isAccessorDescriptor()) {
+                attrs = ApplyOrDefaultAttributes(attrs, shape);
                 shape = JSObject::changeProperty<SequentialExecution>(cx, obj, shape, attrs,
                                                                       JSPROP_GETTER | JSPROP_SETTER,
                                                                       (attrs & JSPROP_GETTER)
@@ -4105,10 +4266,42 @@ js::DefineNativeProperty(ExclusiveContext *cx, HandleObject obj, HandleId id, Ha
                                                                       : shape->setter());
                 if (!shape)
                     return false;
-            } else {
-                shape = nullptr;
+                shouldDefine = false;
             }
         }
+    } else if (!(attrs & JSPROP_IGNORE_VALUE)) {
+        /*
+         * We might still want to ignore redefining some of our attributes, if the
+         * request came through a proxy after Object.defineProperty(), but only if we're redefining
+         * a data property.
+         * FIXME: All this logic should be removed when Proxies use PropDesc, but we need to
+         *        remove JSPropertyOp getters and setters first.
+         */
+        shape = obj->nativeLookup(cx, id);
+        if (shape && shape->isDataDescriptor())
+            attrs = ApplyOrDefaultAttributes(attrs, shape);
+    } else {
+        /*
+         * We have been asked merely to update some attributes by a caller of
+         * Object.defineProperty, laundered through the proxy system, and returning here. We can
+         * get away with just using JSObject::changeProperty here.
+         */
+        if (!NativeLookupOwnProperty(cx, obj, id, &shape))
+            return false;
+
+        if (shape) {
+            attrs = ApplyOrDefaultAttributes(attrs, shape);
+
+            /* Keep everything from the shape that isn't the things we're changing */
+            unsigned attrMask = ~(JSPROP_ENUMERATE | JSPROP_READONLY | JSPROP_PERMANENT);
+            shape = JSObject::changeProperty<SequentialExecution>(cx, obj, shape, attrs, attrMask,
+                                                                  shape->getter(), shape->setter());
+            if (!shape)
+                return false;
+            if (shape->hasSlot())
+                updateValue = obj->getSlot(shape->slot());
+            shouldDefine = false;
+        }
     }
 
     /*
@@ -4125,14 +4318,20 @@ js::DefineNativeProperty(ExclusiveContext *cx, HandleObject obj, HandleId id, Ha
     if (!setter && !(attrs & JSPROP_SETTER))
         setter = clasp->setProperty;
 
-    if (!shape) {
+    if (shouldDefine) {
+        // Handle the default cases here. Anyone that wanted to set non-default attributes has
+        // cleared the IGNORE flags by now. Since we can never get here with JSPROP_IGNORE_VALUE
+        // relevant, just clear it.
+        attrs = ApplyOrDefaultAttributes(attrs) & ~JSPROP_IGNORE_VALUE;
         return DefinePropertyOrElement<SequentialExecution>(cx, obj, id, getter, setter,
                                                             attrs, value, false, false);
     }
 
-    JS_ALWAYS_TRUE(UpdateShapeTypeAndValue<SequentialExecution>(cx, obj, shape, value));
+    MOZ_ASSERT(shape);
 
-    return CallAddPropertyHook<SequentialExecution>(cx, clasp, obj, shape, value);
+    JS_ALWAYS_TRUE(UpdateShapeTypeAndValue<SequentialExecution>(cx, obj, shape, updateValue));
+
+    return CallAddPropertyHook<SequentialExecution>(cx, clasp, obj, shape, updateValue);
 }
 
 /*
@@ -5272,6 +5471,9 @@ baseops::SetPropertyHelper(typename ExecutionModeTraits<mode>::ContextType cxArg
             return true;
         }
 
+        if (!obj->maybeCopyElementsForWrite(cxArg))
+            return false;
+
         if (mode == ParallelExecution)
             return obj->setDenseElementIfHasType(index, vp);
 
@@ -5428,6 +5630,9 @@ baseops::DeleteGeneric(JSContext *cx, HandleObject obj, HandleId id, bool *succe
         if (!succeeded)
             return true;
 
+        if (!obj->maybeCopyElementsForWrite(cx))
+            return false;
+
         obj->setDenseElementHole(cx, JSID_TO_INT(id));
         return js_SuppressDeletedProperty(cx, obj, id);
     }
@@ -6141,7 +6346,8 @@ JSObject::addSizeOfExcludingThis(mozilla::MallocSizeOf mallocSizeOf, JS::Objects
 
     if (hasDynamicElements()) {
         js::ObjectElements *elements = getElementsHeader();
-        sizes->mallocHeapElementsNonAsmJS += mallocSizeOf(elements);
+        if (!elements->isCopyOnWrite() || elements->ownerObject() == this)
+            sizes->mallocHeapElementsNonAsmJS += mallocSizeOf(elements);
     }
 
     // Other things may be measured in the future if DMD indicates it is worthwhile.
diff --git a/js/src/jsobj.h b/js/src/jsobj.h
index bb8100763c64..358d76ffb84a 100644
--- a/js/src/jsobj.h
+++ b/js/src/jsobj.h
@@ -246,6 +246,20 @@ class JSObject : public js::ObjectImpl
                                                js::HandleTypeObject type,
                                                uint32_t length);
 
+    /* Make an array object with the specified initial state and elements. */
+    static inline js::ArrayObject *createArray(js::ExclusiveContext *cx,
+                                               js::gc::InitialHeap heap,
+                                               js::HandleShape shape,
+                                               js::HandleTypeObject type,
+                                               js::HeapSlot *elements);
+
+  private:
+    // Helper for the above two methods.
+    static inline JSObject *
+    createArrayInternal(js::ExclusiveContext *cx, js::gc::AllocKind kind, js::gc::InitialHeap heap,
+                        js::HandleShape shape, js::HandleTypeObject type);
+  public:
+
     /*
      * Remove the last property of an object, provided that it is safe to do so
      * (the shape and previous shape do not carry conflicting information about
@@ -390,6 +404,7 @@ class JSObject : public js::ObjectImpl
 
     void prepareElementRangeForOverwrite(size_t start, size_t end) {
         JS_ASSERT(end <= getDenseInitializedLength());
+        JS_ASSERT(!denseElementsAreCopyOnWrite());
         for (size_t i = start; i < end; i++)
             elements[i].js::HeapSlot::~HeapSlot();
     }
@@ -597,6 +612,7 @@ class JSObject : public js::ObjectImpl
 
     /* Accessors for elements. */
     bool ensureElements(js::ThreadSafeContext *cx, uint32_t capacity) {
+        JS_ASSERT(!denseElementsAreCopyOnWrite());
         if (capacity > getDenseCapacity())
             return growElements(cx, capacity);
         return true;
@@ -617,6 +633,14 @@ class JSObject : public js::ObjectImpl
         return getElementsHeader()->capacity;
     }
 
+    static bool CopyElementsForWrite(js::ThreadSafeContext *cx, JSObject *obj);
+
+    bool maybeCopyElementsForWrite(js::ThreadSafeContext *cx) {
+        if (denseElementsAreCopyOnWrite())
+            return CopyElementsForWrite(cx, this);
+        return true;
+    }
+
   private:
     inline void ensureDenseInitializedLengthNoPackedCheck(js::ThreadSafeContext *cx,
                                                           uint32_t index, uint32_t extra);
@@ -625,6 +649,7 @@ class JSObject : public js::ObjectImpl
     void setDenseInitializedLength(uint32_t length) {
         JS_ASSERT(isNative());
         JS_ASSERT(length <= getDenseCapacity());
+        JS_ASSERT(!denseElementsAreCopyOnWrite());
         prepareElementRangeForOverwrite(length, getElementsHeader()->initializedLength);
         getElementsHeader()->initializedLength = length;
     }
@@ -635,11 +660,13 @@ class JSObject : public js::ObjectImpl
                                                                uint32_t index, uint32_t extra);
     void setDenseElement(uint32_t index, const js::Value &val) {
         JS_ASSERT(isNative() && index < getDenseInitializedLength());
+        JS_ASSERT(!denseElementsAreCopyOnWrite());
         elements[index].set(this, js::HeapSlot::Element, index, val);
     }
 
     void initDenseElement(uint32_t index, const js::Value &val) {
         JS_ASSERT(isNative() && index < getDenseInitializedLength());
+        JS_ASSERT(!denseElementsAreCopyOnWrite());
         elements[index].init(this, js::HeapSlot::Element, index, val);
     }
 
@@ -663,6 +690,7 @@ class JSObject : public js::ObjectImpl
 
     void copyDenseElements(uint32_t dstStart, const js::Value *src, uint32_t count) {
         JS_ASSERT(dstStart + count <= getDenseCapacity());
+        JS_ASSERT(!denseElementsAreCopyOnWrite());
         JSRuntime *rt = runtimeFromMainThread();
         if (JS::IsIncrementalBarrierNeeded(rt)) {
             JS::Zone *zone = this->zone();
@@ -676,6 +704,7 @@ class JSObject : public js::ObjectImpl
 
     void initDenseElements(uint32_t dstStart, const js::Value *src, uint32_t count) {
         JS_ASSERT(dstStart + count <= getDenseCapacity());
+        JS_ASSERT(!denseElementsAreCopyOnWrite());
         memcpy(&elements[dstStart], src, count * sizeof(js::HeapSlot));
         DenseRangeWriteBarrierPost(runtimeFromMainThread(), this, dstStart, count);
     }
@@ -685,6 +714,7 @@ class JSObject : public js::ObjectImpl
     void moveDenseElements(uint32_t dstStart, uint32_t srcStart, uint32_t count) {
         JS_ASSERT(dstStart + count <= getDenseCapacity());
         JS_ASSERT(srcStart + count <= getDenseInitializedLength());
+        JS_ASSERT(!denseElementsAreCopyOnWrite());
 
         /*
          * Using memmove here would skip write barriers. Also, we need to consider
@@ -723,6 +753,7 @@ class JSObject : public js::ObjectImpl
 
         JS_ASSERT(dstStart + count <= getDenseCapacity());
         JS_ASSERT(srcStart + count <= getDenseCapacity());
+        JS_ASSERT(!denseElementsAreCopyOnWrite());
 
         memmove(elements + dstStart, elements + srcStart, count * sizeof(js::Value));
         DenseRangeWriteBarrierPost(runtimeFromMainThread(), this, dstStart, count);
@@ -736,6 +767,11 @@ class JSObject : public js::ObjectImpl
     inline void setShouldConvertDoubleElements();
     inline void clearShouldConvertDoubleElements();
 
+    bool denseElementsAreCopyOnWrite() {
+        JS_ASSERT(isNative());
+        return getElementsHeader()->isCopyOnWrite();
+    }
+
     /* Packed information for this object's elements. */
     inline bool writeToIndexWouldMarkNotPacked(uint32_t index);
     inline void markDenseElementsNotPacked(js::ExclusiveContext *cx);
diff --git a/js/src/jsobjinlines.h b/js/src/jsobjinlines.h
index 0d0dbfb87758..b29a6f267fd1 100644
--- a/js/src/jsobjinlines.h
+++ b/js/src/jsobjinlines.h
@@ -213,6 +213,7 @@ JSObject::ensureDenseInitializedLengthNoPackedCheck(js::ThreadSafeContext *cx, u
                                                     uint32_t extra)
 {
     JS_ASSERT(cx->isThreadLocal(this));
+    JS_ASSERT(!denseElementsAreCopyOnWrite());
 
     /*
      * Ensure that the array's contents have been initialized up to index, and
@@ -255,6 +256,7 @@ JSObject::extendDenseElements(js::ThreadSafeContext *cx,
                               uint32_t requiredCapacity, uint32_t extra)
 {
     JS_ASSERT(cx->isThreadLocal(this));
+    JS_ASSERT(!denseElementsAreCopyOnWrite());
 
     /*
      * Don't grow elements for non-extensible objects or watched objects. Dense
@@ -294,6 +296,9 @@ JSObject::ensureDenseElementsNoPackedCheck(js::ThreadSafeContext *cx, uint32_t i
 {
     JS_ASSERT(isNative());
 
+    if (!maybeCopyElementsForWrite(cx))
+        return ED_FAILED;
+
     uint32_t currentCapacity = getDenseCapacity();
 
     uint32_t requiredCapacity;
@@ -359,6 +364,7 @@ JSObject::initDenseElementsUnbarriered(uint32_t dstStart, const js::Value *src,
      * things do not require a barrier.
      */
     JS_ASSERT(dstStart + count <= getDenseCapacity());
+    JS_ASSERT(!denseElementsAreCopyOnWrite());
 #if defined(DEBUG) && defined(JSGC_GENERATIONAL)
     /*
      * This asserts a global invariant: parallel code does not
@@ -550,31 +556,42 @@ JSObject::create(js::ExclusiveContext *cx, js::gc::AllocKind kind, js::gc::Initi
     return obj;
 }
 
-/* static */ inline js::ArrayObject *
-JSObject::createArray(js::ExclusiveContext *cx, js::gc::AllocKind kind, js::gc::InitialHeap heap,
-                      js::HandleShape shape, js::HandleTypeObject type,
-                      uint32_t length)
+/* static */ inline JSObject *
+JSObject::createArrayInternal(js::ExclusiveContext *cx, js::gc::AllocKind kind, js::gc::InitialHeap heap,
+                              js::HandleShape shape, js::HandleTypeObject type)
 {
+    // Create a new array and initialize everything except for its elements.
     JS_ASSERT(shape && type);
     JS_ASSERT(type->clasp() == shape->getObjectClass());
     JS_ASSERT(type->clasp() == &js::ArrayObject::class_);
     JS_ASSERT_IF(type->clasp()->finalize, heap == js::gc::TenuredHeap);
 
-    /*
-     * Arrays use their fixed slots to store elements, and must have enough
-     * space for the elements header and also be marked as having no space for
-     * named properties stored in those fixed slots.
-     */
+    // Arrays can use their fixed slots to store elements, so can't have shapes
+    // which allow named properties to be stored in the fixed slots.
     JS_ASSERT(shape->numFixedSlots() == 0);
+
     size_t nDynamicSlots = dynamicSlotsCount(0, shape->slotSpan(), type->clasp());
     JSObject *obj = js::NewGCObject<js::CanGC>(cx, kind, nDynamicSlots, heap);
     if (!obj)
         return nullptr;
 
-    uint32_t capacity = js::gc::GetGCKindSlots(kind) - js::ObjectElements::VALUES_PER_HEADER;
-
     obj->shape_.init(shape);
     obj->type_.init(type);
+
+    return obj;
+}
+
+/* static */ inline js::ArrayObject *
+JSObject::createArray(js::ExclusiveContext *cx, js::gc::AllocKind kind, js::gc::InitialHeap heap,
+                      js::HandleShape shape, js::HandleTypeObject type,
+                      uint32_t length)
+{
+    JSObject *obj = createArrayInternal(cx, kind, heap, shape, type);
+    if (!obj)
+        return nullptr;
+
+    uint32_t capacity = js::gc::GetGCKindSlots(kind) - js::ObjectElements::VALUES_PER_HEADER;
+
     obj->setFixedElements();
     new (obj->getElementsHeader()) js::ObjectElements(capacity, length);
 
@@ -587,6 +604,31 @@ JSObject::createArray(js::ExclusiveContext *cx, js::gc::AllocKind kind, js::gc::
     return &obj->as<js::ArrayObject>();
 }
 
+/* static */ inline js::ArrayObject *
+JSObject::createArray(js::ExclusiveContext *cx, js::gc::InitialHeap heap,
+                      js::HandleShape shape, js::HandleTypeObject type,
+                      js::HeapSlot *elements)
+{
+    // Use the smallest allocation kind for the array, as it can't have any
+    // fixed slots (see assert in the above function) and will not be using its
+    // fixed elements.
+    js::gc::AllocKind kind = js::gc::FINALIZE_OBJECT0_BACKGROUND;
+
+    JSObject *obj = createArrayInternal(cx, kind, heap, shape, type);
+    if (!obj)
+        return nullptr;
+
+    obj->elements = elements;
+
+    size_t span = shape->slotSpan();
+    if (span)
+        obj->initializeSlotRange(0, span);
+
+    js::gc::TraceCreateObject(obj);
+
+    return &obj->as<js::ArrayObject>();
+}
+
 inline void
 JSObject::finish(js::FreeOp *fop)
 {
@@ -595,7 +637,8 @@ JSObject::finish(js::FreeOp *fop)
 
     if (hasDynamicElements()) {
         js::ObjectElements *elements = getElementsHeader();
-        fop->free_(elements);
+        if (!elements->isCopyOnWrite() || elements->ownerObject() == this)
+            fop->free_(elements);
     }
 }
 
diff --git a/js/src/jsopcode.cpp b/js/src/jsopcode.cpp
index ea18d5e0ff31..6469873ad2bc 100644
--- a/js/src/jsopcode.cpp
+++ b/js/src/jsopcode.cpp
@@ -1555,7 +1555,8 @@ ExpressionDecompiler::decompilePC(jsbytecode *pc)
       case JSOP_NEWARRAY:
         return write("[]");
       case JSOP_REGEXP:
-      case JSOP_OBJECT: {
+      case JSOP_OBJECT:
+      case JSOP_NEWARRAY_COPYONWRITE: {
         JSObject *obj = (op == JSOP_REGEXP)
                         ? script->getRegExp(GET_UINT32_INDEX(pc))
                         : script->getObject(GET_UINT32_INDEX(pc));
diff --git a/js/src/tests/ecma_6/Object/assign.js b/js/src/tests/ecma_6/Object/assign.js
index 3cbbcf0c35cf..b39a48591fef 100644
--- a/js/src/tests/ecma_6/Object/assign.js
+++ b/js/src/tests/ecma_6/Object/assign.js
@@ -38,12 +38,27 @@ function basicSymbols() {
 }
 basicSymbols();
 
-// Calls ToObject() for target and source
+// Calls ToObject() for target, skips null/undefined sources, uses
+// ToObject(source) otherwise.
 function testToObject() {
     assertThrowsInstanceOf(() => Object.assign(null, null), TypeError);
     assertThrowsInstanceOf(() => Object.assign(), TypeError);
     assertThrowsInstanceOf(() => Object.assign(null, {}), TypeError);
-    assertThrowsInstanceOf(() => Object.assign({}, null), TypeError);
+    assertEq(Object.assign({}, null) instanceof Object, true);
+    assertEq(Object.assign({}, undefined) instanceof Object, true);
+
+    // Technically an embedding could have this as extension acting differently
+    // from ours, so a feature-test is inadequate.  We can move this subtest
+    // into extensions/ if that ever matters.
+    if (typeof objectEmulatingUndefined === "function") {
+        var falsyObject = objectEmulatingUndefined();
+        falsyObject.foo = 7;
+
+        var obj = Object.assign({}, falsyObject);
+        assertEq(obj instanceof Object, true);
+        assertEq(obj.foo, 7);
+    }
+
     assertEq(Object.assign(true, {}) instanceof Boolean, true);
     assertEq(Object.assign(1, {}) instanceof Number, true);
     assertEq(Object.assign("string", {}) instanceof String, true);
diff --git a/js/src/tests/ecma_6/Proxy/regress-bug1037770.js b/js/src/tests/ecma_6/Proxy/regress-bug1037770.js
new file mode 100644
index 000000000000..c97d6d21c7ca
--- /dev/null
+++ b/js/src/tests/ecma_6/Proxy/regress-bug1037770.js
@@ -0,0 +1,7 @@
+foo = 1;
+Object.defineProperty(this, "foo", {writable:false});
+foo = 2;
+assertEq(foo, 1);
+
+if (typeof reportCompare === "function")
+    reportCompare(true, true);
diff --git a/js/src/vm/Debugger.cpp b/js/src/vm/Debugger.cpp
index 237e687f49cc..719ca4784086 100644
--- a/js/src/vm/Debugger.cpp
+++ b/js/src/vm/Debugger.cpp
@@ -1716,8 +1716,10 @@ Debugger::trace(JSTracer *trc)
     /*
      * Mark every allocation site in our allocation log.
      */
-    for (AllocationSite *s = allocationsLog.getFirst(); s; s = s->getNext())
-        MarkObject(trc, &s->frame, "allocation log SavedFrame");
+    for (AllocationSite *s = allocationsLog.getFirst(); s; s = s->getNext()) {
+        if (s->frame)
+            MarkObject(trc, &s->frame, "allocation log SavedFrame");
+    }
 
     /* Trace the weak map from JSScript instances to Debugger.Script objects. */
     scripts.trace(trc);
diff --git a/js/src/vm/Debugger.h b/js/src/vm/Debugger.h
index 784e7f944f3b..5e131196eb38 100644
--- a/js/src/vm/Debugger.h
+++ b/js/src/vm/Debugger.h
@@ -202,7 +202,7 @@ class Debugger : private mozilla::LinkedListElement<Debugger>
     struct AllocationSite : public mozilla::LinkedListElement<AllocationSite>
     {
         AllocationSite(HandleObject frame) : frame(frame) {
-            JS_ASSERT(UncheckedUnwrap(frame)->is<SavedFrame>());
+            JS_ASSERT_IF(frame, UncheckedUnwrap(frame)->is<SavedFrame>());
         };
         RelocatablePtrObject frame;
     };
@@ -790,7 +790,7 @@ Debugger::onNewGlobalObject(JSContext *cx, Handle<GlobalObject *> global)
 bool
 Debugger::onLogAllocationSite(JSContext *cx, HandleSavedFrame frame)
 {
-    GlobalObject::DebuggerVector *dbgs = frame->global().getDebuggers();
+    GlobalObject::DebuggerVector *dbgs = cx->global()->getDebuggers();
     if (!dbgs || dbgs->empty())
         return true;
     return Debugger::slowPathOnLogAllocationSite(cx, frame, *dbgs);
diff --git a/js/src/vm/DebuggerMemory.cpp b/js/src/vm/DebuggerMemory.cpp
index 594b747a9c42..24c21721f1e1 100644
--- a/js/src/vm/DebuggerMemory.cpp
+++ b/js/src/vm/DebuggerMemory.cpp
@@ -8,6 +8,9 @@
 
 #include "mozilla/Maybe.h"
 #include "mozilla/Move.h"
+#include "mozilla/Vector.h"
+
+#include <stdlib.h>
 
 #include "jscompartment.h"
 
@@ -195,7 +198,7 @@ DebuggerMemory::drainAllocationsLog(JSContext *cx, unsigned argc, Value *vp)
 
     for (size_t i = 0; i < length; i++) {
         Debugger::AllocationSite *allocSite = dbg->allocationsLog.popFirst();
-        result->setDenseElement(i, ObjectValue(*allocSite->frame));
+        result->setDenseElement(i, ObjectOrNullValue(allocSite->frame));
         js_delete(allocSite);
     }
 
@@ -280,6 +283,9 @@ struct Census {
 //   bool count(Census &census, const Node &node);
 //      Categorize and count |node| as appropriate for this kind of assorter.
 //
+//   size_t total() const;
+//      Return the number of times 'count' has been called.
+//
 //   bool report(Census &census, MutableHandleValue report);
 //      Construct a JavaScript object reporting the counts this assorter has
 //      seen, and store it in |report|.
@@ -289,23 +295,25 @@ struct Census {
 
 // The simplest assorter: count everything, and return a tally form.
 class Tally {
-    size_t counter;
+    size_t total_;
 
   public:
-    Tally(Census &census) : counter(0) { }
-    Tally(Tally &&rhs) : counter(rhs.counter) { }
-    Tally &operator=(Tally &&rhs) { counter = rhs.counter; return *this; }
+    Tally(Census &census) : total_(0) { }
+    Tally(Tally &&rhs) : total_(rhs.total_) { }
+    Tally &operator=(Tally &&rhs) { total_ = rhs.total_; return *this; }
 
     bool init(Census &census) { return true; }
 
     bool count(Census &census, const Node &node) {
-        counter++;
+        total_++;
         return true;
     }
 
+    size_t total() const { return total_; }
+
     bool report(Census &census, MutableHandleValue report) {
         RootedObject obj(census.cx, NewBuiltinClassInstance(census.cx, &JSObject::class_));
-        RootedValue countValue(census.cx, NumberValue(counter));
+        RootedValue countValue(census.cx, NumberValue(total_));
         if (!obj ||
             !JSObject::defineProperty(census.cx, obj, census.cx->names().count, countValue))
         {
@@ -327,6 +335,7 @@ template<typename EachObject = Tally,
          typename EachString = Tally,
          typename EachOther  = Tally>
 class ByJSType {
+    size_t total_;
     EachObject objects;
     EachScript scripts;
     EachString strings;
@@ -334,13 +343,15 @@ class ByJSType {
 
   public:
     ByJSType(Census &census)
-      : objects(census),
+      : total_(0),
+        objects(census),
         scripts(census),
         strings(census),
         other(census)
     { }
     ByJSType(ByJSType &&rhs)
-      : objects(Move(rhs.objects)),
+      : total_(rhs.total_),
+        objects(Move(rhs.objects)),
         scripts(move(rhs.scripts)),
         strings(move(rhs.strings)),
         other(move(rhs.other))
@@ -360,6 +371,7 @@ class ByJSType {
     }
 
     bool count(Census &census, const Node &node) {
+        total_++;
         if (node.is<JSObject>())
             return objects.count(census, node);
          if (node.is<JSScript>() || node.is<LazyScript>() || node.is<jit::JitCode>())
@@ -401,7 +413,6 @@ class ByJSType {
     }
 };
 
-
 // An assorter that categorizes nodes that are JSObjects by their class, and
 // places all other nodes in an 'other' category. The template arguments must be
 // assorter types; each JSObject class gets an EachClass assorter, and the
@@ -409,6 +420,8 @@ class ByJSType {
 template<typename EachClass = Tally,
          typename EachOther = Tally>
 class ByObjectClass {
+    size_t total_;
+
     // A hash policy that compares js::Classes by name.
     struct HashPolicy {
         typedef const js::Class *Lookup;
@@ -424,12 +437,29 @@ class ByObjectClass {
     // six named "Object"), you will get several different Classes being counted
     // in the same table entry.
     typedef HashMap<const js::Class *, EachClass, HashPolicy, SystemAllocPolicy> Table;
+    typedef typename Table::Entry Entry;
     Table table;
     EachOther other;
 
+    static int compareEntries(const void *lhsVoid, const void *rhsVoid) {
+        size_t lhs = (*static_cast<const Entry * const *>(lhsVoid))->value().total();
+        size_t rhs = (*static_cast<const Entry * const *>(rhsVoid))->value().total();
+
+        // qsort sorts in "ascending" order, so we should describe entries with
+        // smaller counts as being "greater than" entries with larger counts. We
+        // don't want to just subtract the counts, as they're unsigned.
+        if (lhs < rhs)
+            return 1;
+        if (lhs > rhs)
+            return -1;
+        return 0;
+    }
+
   public:
-    ByObjectClass(Census &census) : other(census) { }
-    ByObjectClass(ByObjectClass &&rhs) : table(Move(rhs.table)), other(Move(rhs.other)) { }
+    ByObjectClass(Census &census) : total_(0), other(census) { }
+    ByObjectClass(ByObjectClass &&rhs)
+      : total_(rhs.total_), table(Move(rhs.table)), other(Move(rhs.other))
+    { }
     ByObjectClass &operator=(ByObjectClass &&rhs) {
         MOZ_ASSERT(&rhs != this);
         this->~ByObjectClass();
@@ -440,6 +470,7 @@ class ByObjectClass {
     bool init(Census &census) { return table.init() && other.init(census); }
 
     bool count(Census &census, const Node &node) {
+        total_++;
         if (!node.is<JSObject>())
             return other.count(census, node);
 
@@ -454,20 +485,33 @@ class ByObjectClass {
         return p->value().count(census, node);
     }
 
+    size_t total() const { return total_; }
+
     bool report(Census &census, MutableHandleValue report) {
         JSContext *cx = census.cx;
 
+        // Build a vector of pointers to entries; sort by total; and then use
+        // that to build the result object. This makes the ordering of entries
+        // more interesting, and a little less non-deterministic.
+        mozilla::Vector<Entry *> entries;
+        if (!entries.reserve(table.count()))
+            return false;
+        for (typename Table::Range r = table.all(); !r.empty(); r.popFront())
+            entries.infallibleAppend(&r.front());
+        qsort(entries.begin(), entries.length(), sizeof(*entries.begin()), compareEntries);
+
+        // Now build the result by iterating over the sorted vector.
         RootedObject obj(cx, NewBuiltinClassInstance(cx, &JSObject::class_));
         if (!obj)
             return false;
-
-        for (typename Table::Range r = table.all(); !r.empty(); r.popFront()) {
-            EachClass &entry = r.front().value();
-            RootedValue entryReport(cx);
-            if (!entry.report(census, &entryReport))
+        for (Entry **entryPtr = entries.begin(); entryPtr < entries.end(); entryPtr++) {
+            Entry &entry = **entryPtr;
+            EachClass &assorter = entry.value();
+            RootedValue assorterReport(cx);
+            if (!assorter.report(census, &assorterReport))
                 return false;
 
-            const char *name = r.front().key()->name;
+            const char *name = entry.key()->name;
             MOZ_ASSERT(name);
             JSAtom *atom = Atomize(census.cx, name, strlen(name));
             if (!atom)
@@ -488,7 +532,7 @@ class ByObjectClass {
             }
 #endif
 
-            if (!JSObject::defineGeneric(cx, obj, entryId, entryReport))
+            if (!JSObject::defineGeneric(cx, obj, entryId, assorterReport))
                 return false;
         }
 
@@ -501,15 +545,18 @@ class ByObjectClass {
 // An assorter that categorizes nodes by their ubi::Node::typeName.
 template<typename EachType = Tally>
 class ByUbinodeType {
+    size_t total_;
+
     // Note that, because ubi::Node::typeName promises to return a specific
     // pointer, not just any string whose contents are correct, we can use their
     // addresses as hash table keys.
     typedef HashMap<const jschar *, EachType, DefaultHasher<const jschar *>, SystemAllocPolicy> Table;
+    typedef typename Table::Entry Entry;
     Table table;
 
   public:
-    ByUbinodeType(Census &census) { }
-    ByUbinodeType(ByUbinodeType &&rhs) : table(Move(rhs.table)) { }
+    ByUbinodeType(Census &census) : total_(0) { }
+    ByUbinodeType(ByUbinodeType &&rhs) : total_(rhs.total_), table(Move(rhs.table)) { }
     ByUbinodeType &operator=(ByUbinodeType &&rhs) {
         MOZ_ASSERT(&rhs != this);
         this->~ByUbinodeType();
@@ -520,6 +567,7 @@ class ByUbinodeType {
     bool init(Census &census) { return table.init(); }
 
     bool count(Census &census, const Node &node) {
+        total_++;
         const jschar *key = node.typeName();
         typename Table::AddPtr p = table.lookupForAdd(key);
         if (!p) {
@@ -531,27 +579,54 @@ class ByUbinodeType {
         return p->value().count(census, node);
     }
 
+    size_t total() const { return total_; }
+
+    static int compareEntries(const void *lhsVoid, const void *rhsVoid) {
+        size_t lhs = (*static_cast<const Entry * const *>(lhsVoid))->value().total();
+        size_t rhs = (*static_cast<const Entry * const *>(rhsVoid))->value().total();
+
+        // qsort sorts in "ascending" order, so we should describe entries with
+        // smaller counts as being "greater than" entries with larger counts. We
+        // don't want to just subtract the counts, as they're unsigned.
+        if (lhs < rhs)
+            return 1;
+        if (lhs > rhs)
+            return -1;
+        return 0;
+    }
+
     bool report(Census &census, MutableHandleValue report) {
         JSContext *cx = census.cx;
 
+        // Build a vector of pointers to entries; sort by total; and then use
+        // that to build the result object. This makes the ordering of entries
+        // more interesting, and a little less non-deterministic.
+        mozilla::Vector<Entry *> entries;
+        if (!entries.reserve(table.count()))
+            return false;
+        for (typename Table::Range r = table.all(); !r.empty(); r.popFront())
+            entries.infallibleAppend(&r.front());
+        qsort(entries.begin(), entries.length(), sizeof(*entries.begin()), compareEntries);
+
+        // Now build the result by iterating over the sorted vector.
         RootedObject obj(cx, NewBuiltinClassInstance(cx, &JSObject::class_));
         if (!obj)
             return false;
-
-        for (typename Table::Range r = table.all(); !r.empty(); r.popFront()) {
-            EachType &entry = r.front().value();
-            RootedValue entryReport(cx);
-            if (!entry.report(census, &entryReport))
+        for (Entry **entryPtr = entries.begin(); entryPtr < entries.end(); entryPtr++) {
+            Entry &entry = **entryPtr;
+            EachType &assorter = entry.value();
+            RootedValue assorterReport(cx);
+            if (!assorter.report(census, &assorterReport))
                 return false;
 
-            const jschar *name = r.front().key();
+            const jschar *name = entry.key();
             MOZ_ASSERT(name);
             JSAtom *atom = AtomizeChars(cx, name, js_strlen(name));
             if (!atom)
                 return false;
             RootedId entryId(cx, AtomToId(atom));
 
-            if (!JSObject::defineGeneric(cx, obj, entryId, entryReport))
+            if (!JSObject::defineGeneric(cx, obj, entryId, assorterReport))
                 return false;
         }
 
diff --git a/js/src/vm/Interpreter.cpp b/js/src/vm/Interpreter.cpp
index fdb53b6c44aa..685f3e552722 100644
--- a/js/src/vm/Interpreter.cpp
+++ b/js/src/vm/Interpreter.cpp
@@ -1596,7 +1596,6 @@ CASE(JSOP_UNUSED51)
 CASE(JSOP_UNUSED52)
 CASE(JSOP_UNUSED57)
 CASE(JSOP_UNUSED83)
-CASE(JSOP_UNUSED102)
 CASE(JSOP_UNUSED103)
 CASE(JSOP_UNUSED104)
 CASE(JSOP_UNUSED105)
@@ -3063,6 +3062,22 @@ CASE(JSOP_NEWARRAY)
 }
 END_CASE(JSOP_NEWARRAY)
 
+CASE(JSOP_NEWARRAY_COPYONWRITE)
+{
+    RootedObject &baseobj = rootObject0;
+    baseobj = types::GetOrFixupCopyOnWriteObject(cx, script, REGS.pc);
+    if (!baseobj)
+        goto error;
+
+    RootedObject &obj = rootObject1;
+    obj = NewDenseCopyOnWriteArray(cx, baseobj, gc::DefaultHeap);
+    if (!obj)
+        goto error;
+
+    PUSH_OBJECT(*obj);
+}
+END_CASE(JSOP_NEWARRAY_COPYONWRITE)
+
 CASE(JSOP_NEWOBJECT)
 {
     RootedObject &baseobj = rootObject0;
diff --git a/js/src/vm/ObjectImpl.cpp b/js/src/vm/ObjectImpl.cpp
index 35b11865f1d5..fe31d5819de2 100644
--- a/js/src/vm/ObjectImpl.cpp
+++ b/js/src/vm/ObjectImpl.cpp
@@ -97,6 +97,8 @@ ObjectElements::ConvertElementsToDoubles(JSContext *cx, uintptr_t elementsPtr)
     ObjectElements *header = ObjectElements::fromElements(elementsHeapPtr);
     JS_ASSERT(!header->shouldConvertDoubleElements());
 
+    // Note: the elements can be mutated in place even for copy on write
+    // arrays. See comment on ObjectElements.
     Value *vp = (Value *) elementsPtr;
     for (size_t i = 0; i < header->initializedLength; i++) {
         if (vp[i].isInt32())
@@ -107,6 +109,26 @@ ObjectElements::ConvertElementsToDoubles(JSContext *cx, uintptr_t elementsPtr)
     return true;
 }
 
+/* static */ bool
+ObjectElements::MakeElementsCopyOnWrite(ExclusiveContext *cx, JSObject *obj)
+{
+    // Make sure there is enough room for the owner object pointer at the end
+    // of the elements.
+    JS_STATIC_ASSERT(sizeof(HeapSlot) >= sizeof(HeapPtrObject));
+    if (!obj->ensureElements(cx, obj->getDenseInitializedLength() + 1))
+        return false;
+
+    ObjectElements *header = obj->getElementsHeader();
+
+    // Note: this method doesn't update type information to indicate that the
+    // elements might be copy on write. Handling this is left to the caller.
+    JS_ASSERT(!header->isCopyOnWrite());
+    header->flags |= COPY_ON_WRITE;
+
+    header->ownerObject().init(obj);
+    return true;
+}
+
 #ifdef DEBUG
 void
 js::ObjectImpl::checkShapeConsistency()
@@ -294,7 +316,21 @@ js::ObjectImpl::markChildren(JSTracer *trc)
 
     if (shape_->isNative()) {
         MarkObjectSlots(trc, obj, 0, obj->slotSpan());
-        gc::MarkArraySlots(trc, obj->getDenseInitializedLength(), obj->getDenseElements(), "objectElements");
+
+        do {
+            if (obj->denseElementsAreCopyOnWrite()) {
+                HeapPtrObject &owner = getElementsHeader()->ownerObject();
+                if (owner != this) {
+                    MarkObject(trc, &owner, "objectElementsOwner");
+                    break;
+                }
+            }
+
+            gc::MarkArraySlots(trc,
+                               obj->getDenseInitializedLength(),
+                               obj->getDenseElementsAllowCopyOnWrite(),
+                               "objectElements");
+        } while (false);
     }
 }
 
diff --git a/js/src/vm/ObjectImpl.h b/js/src/vm/ObjectImpl.h
index ec89c169fd6f..81783e365b3f 100644
--- a/js/src/vm/ObjectImpl.h
+++ b/js/src/vm/ObjectImpl.h
@@ -169,11 +169,21 @@ class ObjectElements
 {
   public:
     enum Flags {
+        // Integers written to these elements must be converted to doubles.
         CONVERT_DOUBLE_ELEMENTS     = 0x1,
 
         // Present only if these elements correspond to an array with
         // non-writable length; never present for non-arrays.
-        NONWRITABLE_ARRAY_LENGTH    = 0x2
+        NONWRITABLE_ARRAY_LENGTH    = 0x2,
+
+        // These elements are shared with another object and must be copied
+        // before they can be changed. A pointer to the original owner of the
+        // elements, which is immutable, is stored immediately after the
+        // elements data. There is one case where elements can be written to
+        // before being copied: when setting the CONVERT_DOUBLE_ELEMENTS flag
+        // the shared elements may change (from ints to doubles) without
+        // making a copy first.
+        COPY_ON_WRITE               = 0x4
     };
 
   private:
@@ -210,17 +220,27 @@ class ObjectElements
         return flags & CONVERT_DOUBLE_ELEMENTS;
     }
     void setShouldConvertDoubleElements() {
+        // Note: allow isCopyOnWrite() here, see comment above.
         flags |= CONVERT_DOUBLE_ELEMENTS;
     }
     void clearShouldConvertDoubleElements() {
+        JS_ASSERT(!isCopyOnWrite());
         flags &= ~CONVERT_DOUBLE_ELEMENTS;
     }
     bool hasNonwritableArrayLength() const {
         return flags & NONWRITABLE_ARRAY_LENGTH;
     }
     void setNonwritableArrayLength() {
+        JS_ASSERT(!isCopyOnWrite());
         flags |= NONWRITABLE_ARRAY_LENGTH;
     }
+    bool isCopyOnWrite() const {
+        return flags & COPY_ON_WRITE;
+    }
+    void clearCopyOnWrite() {
+        JS_ASSERT(isCopyOnWrite());
+        flags &= ~COPY_ON_WRITE;
+    }
 
   public:
     MOZ_CONSTEXPR ObjectElements(uint32_t capacity, uint32_t length)
@@ -230,10 +250,18 @@ class ObjectElements
     HeapSlot *elements() {
         return reinterpret_cast<HeapSlot*>(uintptr_t(this) + sizeof(ObjectElements));
     }
+    const HeapSlot *elements() const {
+        return reinterpret_cast<const HeapSlot*>(uintptr_t(this) + sizeof(ObjectElements));
+    }
     static ObjectElements * fromElements(HeapSlot *elems) {
         return reinterpret_cast<ObjectElements*>(uintptr_t(elems) - sizeof(ObjectElements));
     }
 
+    HeapPtrObject &ownerObject() const {
+        JS_ASSERT(isCopyOnWrite());
+        return *(HeapPtrObject *)(&elements()[initializedLength]);
+    }
+
     static int offsetOfFlags() {
         return int(offsetof(ObjectElements, flags)) - int(sizeof(ObjectElements));
     }
@@ -248,6 +276,7 @@ class ObjectElements
     }
 
     static bool ConvertElementsToDoubles(JSContext *cx, uintptr_t elements);
+    static bool MakeElementsCopyOnWrite(ExclusiveContext *cx, JSObject *obj);
 
     // This is enough slots to store an object of this class. See the static
     // assertion below.
@@ -406,7 +435,12 @@ class ObjectImpl : public gc::BarrieredCell<ObjectImpl>
 
     HeapSlotArray getDenseElements() {
         JS_ASSERT(isNative());
-        return HeapSlotArray(elements);
+        return HeapSlotArray(elements, !getElementsHeader()->isCopyOnWrite());
+    }
+    HeapSlotArray getDenseElementsAllowCopyOnWrite() {
+        // Backdoor allowing direct access to copy on write elements.
+        JS_ASSERT(isNative());
+        return HeapSlotArray(elements, true);
     }
     const Value &getDenseElement(uint32_t idx) {
         JS_ASSERT(isNative());
diff --git a/js/src/vm/Opcodes.h b/js/src/vm/Opcodes.h
index 4f24a9150762..3d86f4612bef 100644
--- a/js/src/vm/Opcodes.h
+++ b/js/src/vm/Opcodes.h
@@ -882,7 +882,6 @@
      *   Stack: obj, id, val => obj
      */ \
     macro(JSOP_INITELEM_SETTER, 100, "initelem_setter",   NULL, 1,  3,  1, JOF_BYTE|JOF_ELEM|JOF_SET|JOF_DETECTING) \
-    \
     /*
      * Pushes the call site object specified by objectIndex onto the stack. Defines the raw
      * property specified by objectIndex + 1 on the call site object and freezes both the call site
@@ -894,7 +893,17 @@
      */ \
     macro(JSOP_CALLSITEOBJ,     101, "callsiteobj",     NULL,         5,  0,  1,  JOF_OBJECT) \
     \
-    macro(JSOP_UNUSED102,  102, "unused102",   NULL,         1,  0,  0,  JOF_BYTE) \
+    /*
+     * Pushes a newly created array onto the stack, whose elements are the same
+     * as that of a template object's copy on write elements.
+     *
+     *   Category: Literals
+     *   Type: Array
+     *   Operands: uint32_t objectIndex
+     *   Stack: => obj
+     */ \
+    macro(JSOP_NEWARRAY_COPYONWRITE, 102, "newarray_copyonwrite", NULL, 5, 0, 1, JOF_OBJECT) \
+    \
     macro(JSOP_UNUSED103,  103, "unused103",   NULL,         1,  0,  0,  JOF_BYTE) \
     macro(JSOP_UNUSED104,  104, "unused104",   NULL,         1,  0,  0,  JOF_BYTE) \
     macro(JSOP_UNUSED105,  105, "unused105",   NULL,         1,  0,  0,  JOF_BYTE) \
diff --git a/js/src/vm/Xdr.h b/js/src/vm/Xdr.h
index 65cac43ba09a..791f7511b8ab 100644
--- a/js/src/vm/Xdr.h
+++ b/js/src/vm/Xdr.h
@@ -28,7 +28,7 @@ namespace js {
  *
  *  https://developer.mozilla.org/en-US/docs/SpiderMonkey/Internals/Bytecode
  */
-static const uint32_t XDR_BYTECODE_VERSION = uint32_t(0xb973c0de - 180);
+static const uint32_t XDR_BYTECODE_VERSION = uint32_t(0xb973c0de - 181);
 
 class XDRBuffer {
   public:
diff --git a/layout/base/UnitTransforms.h b/layout/base/UnitTransforms.h
index 8f5c116e894b..e85576a288f8 100644
--- a/layout/base/UnitTransforms.h
+++ b/layout/base/UnitTransforms.h
@@ -8,6 +8,7 @@
 #define MOZ_UNIT_TRANSFORMS_H_
 
 #include "Units.h"
+#include "mozilla/gfx/Matrix.h"
 
 namespace mozilla {
 
@@ -42,7 +43,11 @@ gfx::PointTyped<TargetUnits> ViewAs(const gfxPoint& aPoint) {
   return gfx::PointTyped<TargetUnits>(aPoint.x, aPoint.y);
 }
 template <class TargetUnits>
-gfx::RectTyped<TargetUnits> ViewAs(const gfxRect& aRect) {
+gfx::PointTyped<TargetUnits> ViewAs(const gfx::Point& aPoint) {
+  return gfx::PointTyped<TargetUnits>(aPoint.x, aPoint.y);
+}
+template <class TargetUnits>
+gfx::RectTyped<TargetUnits> ViewAs(const gfx::Rect& aRect) {
   return gfx::RectTyped<TargetUnits>(aRect.x, aRect.y, aRect.width, aRect.height);
 }
 template <class TargetUnits>
@@ -58,31 +63,25 @@ gfx::IntRectTyped<TargetUnits> ViewAs(const nsIntRect& aRect) {
   return gfx::IntRectTyped<TargetUnits>(aRect.x, aRect.y, aRect.width, aRect.height);
 }
 
-// Convenience functions for casting typed entities to untyped entities.
-// Using these functions does not require a justification, but once we convert
-// all code to use strongly typed units they should not be needed any longer.
-template <class SourceUnits>
-gfxPoint ViewAsUntyped(const gfx::PointTyped<SourceUnits>& aPoint) {
-  return gfxPoint(aPoint.x, aPoint.y);
-}
-template <class SourceUnits>
-gfxRect ViewAsUntyped(const gfx::RectTyped<SourceUnits>& aRect) {
-  return gfxRect(aRect.x, aRect.y, aRect.width, aRect.height);
-}
-
 // Convenience functions for transforming an entity from one strongly-typed
 // coordinate system to another using the provided transformation matrix.
 template <typename TargetUnits, typename SourceUnits>
-static gfx::PointTyped<TargetUnits> TransformTo(const gfx3DMatrix& aTransform,
+static gfx::PointTyped<TargetUnits> TransformTo(const gfx::Matrix4x4& aTransform,
                                                 const gfx::PointTyped<SourceUnits>& aPoint)
 {
-  return ViewAs<TargetUnits>(aTransform.Transform(ViewAsUntyped(aPoint)));
+  return ViewAs<TargetUnits>(aTransform * aPoint.ToUnknownPoint());
 }
 template <typename TargetUnits, typename SourceUnits>
-static gfx::RectTyped<TargetUnits> TransformTo(const gfx3DMatrix& aTransform,
+static gfx::IntPointTyped<TargetUnits> TransformTo(const gfx::Matrix4x4& aTransform,
+                                                   const gfx::IntPointTyped<SourceUnits>& aPoint)
+{
+  return RoundedToInt(TransformTo<TargetUnits>(aTransform, gfx::PointTyped<SourceUnits>(aPoint)));
+}
+template <typename TargetUnits, typename SourceUnits>
+static gfx::RectTyped<TargetUnits> TransformTo(const gfx::Matrix4x4& aTransform,
                                                const gfx::RectTyped<SourceUnits>& aRect)
 {
-  return ViewAs<TargetUnits>(aTransform.TransformBounds(ViewAsUntyped(aRect)));
+  return ViewAs<TargetUnits>(aTransform.TransformBounds(aRect.ToUnknownRect()));
 }
 
 
diff --git a/layout/base/Units.h b/layout/base/Units.h
index 37f56bffe0dc..144ab55601d5 100644
--- a/layout/base/Units.h
+++ b/layout/base/Units.h
@@ -7,6 +7,7 @@
 #ifndef MOZ_UNITS_H_
 #define MOZ_UNITS_H_
 
+#include "mozilla/gfx/Coord.h"
 #include "mozilla/gfx/Point.h"
 #include "mozilla/gfx/Rect.h"
 #include "mozilla/gfx/ScaleFactor.h"
@@ -30,6 +31,8 @@ template<> struct IsPixel<LayoutDevicePixel> : TrueType {};
 template<> struct IsPixel<LayerPixel>        : TrueType {};
 template<> struct IsPixel<ScreenPixel>       : TrueType {};
 
+typedef gfx::CoordTyped<CSSPixel> CSSCoord;
+typedef gfx::IntCoordTyped<CSSPixel> CSSIntCoord;
 typedef gfx::PointTyped<CSSPixel> CSSPoint;
 typedef gfx::IntPointTyped<CSSPixel> CSSIntPoint;
 typedef gfx::SizeTyped<CSSPixel> CSSSize;
@@ -39,6 +42,8 @@ typedef gfx::IntRectTyped<CSSPixel> CSSIntRect;
 typedef gfx::MarginTyped<CSSPixel> CSSMargin;
 typedef gfx::IntMarginTyped<CSSPixel> CSSIntMargin;
 
+typedef gfx::CoordTyped<LayoutDevicePixel> LayoutDeviceCoord;
+typedef gfx::IntCoordTyped<LayoutDevicePixel> LayoutDeviceIntCoord;
 typedef gfx::PointTyped<LayoutDevicePixel> LayoutDevicePoint;
 typedef gfx::IntPointTyped<LayoutDevicePixel> LayoutDeviceIntPoint;
 typedef gfx::SizeTyped<LayoutDevicePixel> LayoutDeviceSize;
@@ -48,6 +53,8 @@ typedef gfx::IntRectTyped<LayoutDevicePixel> LayoutDeviceIntRect;
 typedef gfx::MarginTyped<LayoutDevicePixel> LayoutDeviceMargin;
 typedef gfx::IntMarginTyped<LayoutDevicePixel> LayoutDeviceIntMargin;
 
+typedef gfx::CoordTyped<LayerPixel> LayerCoord;
+typedef gfx::IntCoordTyped<LayerPixel> LayerIntCoord;
 typedef gfx::PointTyped<LayerPixel> LayerPoint;
 typedef gfx::IntPointTyped<LayerPixel> LayerIntPoint;
 typedef gfx::SizeTyped<LayerPixel> LayerSize;
@@ -57,6 +64,8 @@ typedef gfx::IntRectTyped<LayerPixel> LayerIntRect;
 typedef gfx::MarginTyped<LayerPixel> LayerMargin;
 typedef gfx::IntMarginTyped<LayerPixel> LayerIntMargin;
 
+typedef gfx::CoordTyped<ScreenPixel> ScreenCoord;
+typedef gfx::IntCoordTyped<ScreenPixel> ScreenIntCoord;
 typedef gfx::PointTyped<ScreenPixel> ScreenPoint;
 typedef gfx::IntPointTyped<ScreenPixel> ScreenIntPoint;
 typedef gfx::SizeTyped<ScreenPixel> ScreenSize;
diff --git a/layout/base/nsDisplayList.cpp b/layout/base/nsDisplayList.cpp
index 66a0ecf6da4f..49bde8ba5447 100644
--- a/layout/base/nsDisplayList.cpp
+++ b/layout/base/nsDisplayList.cpp
@@ -4725,11 +4725,16 @@ nsDisplayTransform::GetResultingTransformMatrixInternal(const FrameTransformProp
     FrameTransformProperties props(frame->GetParent(),
                                    aAppUnitsPerPixel,
                                    nullptr);
+
+    // If this frame isn't transformed (but we exist for backface-visibility),
+    // then we're not a reference frame so no offset to origin will be added. Our
+    // parent transform however *is* the reference frame, so we pass true for
+    // aOffsetByOrigin to convert into the correct coordinate space.
     gfx3DMatrix parent =
       GetResultingTransformMatrixInternal(props,
                                           aOrigin - frame->GetPosition(),
                                           aAppUnitsPerPixel, nullptr,
-                                          aOutAncestor, false);
+                                          aOutAncestor, !frame->IsTransformed());
 
     result.ChangeBasis(offsetBetweenOrigins);
     result = result * parent;
@@ -4868,7 +4873,7 @@ nsDisplayTransform::GetTransform()
        */
       mTransform = ToMatrix4x4(
         GetResultingTransformMatrix(mFrame, ToReferenceFrame(), scale,
-                                    nullptr, nullptr, true));
+                                    nullptr, nullptr, mFrame->IsTransformed()));
     }
   }
   return mTransform;
diff --git a/layout/base/nsPresContext.h b/layout/base/nsPresContext.h
index 2cef783198ba..c6664c931679 100644
--- a/layout/base/nsPresContext.h
+++ b/layout/base/nsPresContext.h
@@ -1069,28 +1069,26 @@ protected:
       : mLangGroup(nullptr)
       , mMinimumFontSize(0)
       , mDefaultVariableFont(mozilla::eFamily_serif, NS_FONT_STYLE_NORMAL,
-                             NS_FONT_VARIANT_NORMAL,
                              NS_FONT_WEIGHT_NORMAL,
                              NS_FONT_STRETCH_NORMAL, 0, 0)
       , mDefaultFixedFont(mozilla::eFamily_monospace, NS_FONT_STYLE_NORMAL,
-                          NS_FONT_VARIANT_NORMAL, NS_FONT_WEIGHT_NORMAL,
+                          NS_FONT_WEIGHT_NORMAL,
                           NS_FONT_STRETCH_NORMAL, 0, 0)
       , mDefaultSerifFont(mozilla::eFamily_serif, NS_FONT_STYLE_NORMAL,
-                          NS_FONT_VARIANT_NORMAL, NS_FONT_WEIGHT_NORMAL,
+                          NS_FONT_WEIGHT_NORMAL,
                           NS_FONT_STRETCH_NORMAL, 0, 0)
       , mDefaultSansSerifFont(mozilla::eFamily_sans_serif,
                               NS_FONT_STYLE_NORMAL,
-                              NS_FONT_VARIANT_NORMAL,
                               NS_FONT_WEIGHT_NORMAL,
                               NS_FONT_STRETCH_NORMAL, 0, 0)
       , mDefaultMonospaceFont(mozilla::eFamily_monospace, NS_FONT_STYLE_NORMAL,
-                              NS_FONT_VARIANT_NORMAL, NS_FONT_WEIGHT_NORMAL,
+                              NS_FONT_WEIGHT_NORMAL,
                               NS_FONT_STRETCH_NORMAL, 0, 0)
       , mDefaultCursiveFont(mozilla::eFamily_cursive, NS_FONT_STYLE_NORMAL,
-                            NS_FONT_VARIANT_NORMAL, NS_FONT_WEIGHT_NORMAL,
+                            NS_FONT_WEIGHT_NORMAL,
                             NS_FONT_STRETCH_NORMAL, 0, 0)
       , mDefaultFantasyFont(mozilla::eFamily_fantasy, NS_FONT_STYLE_NORMAL,
-                            NS_FONT_VARIANT_NORMAL, NS_FONT_WEIGHT_NORMAL,
+                            NS_FONT_WEIGHT_NORMAL,
                             NS_FONT_STRETCH_NORMAL, 0, 0)
     {}
 
diff --git a/layout/base/nsPresShell.cpp b/layout/base/nsPresShell.cpp
index 76303bd86e15..1f7f3664b402 100644
--- a/layout/base/nsPresShell.cpp
+++ b/layout/base/nsPresShell.cpp
@@ -9943,7 +9943,7 @@ void ReflowCountMgr::PaintCount(const char*     aName,
     if (counter != nullptr && counter->mName.EqualsASCII(aName)) {
       aRenderingContext->PushState();
       aRenderingContext->Translate(aOffset);
-      nsFont font(eFamily_serif, NS_FONT_STYLE_NORMAL, NS_FONT_VARIANT_NORMAL,
+      nsFont font(eFamily_serif, NS_FONT_STYLE_NORMAL,
                   NS_FONT_WEIGHT_NORMAL, NS_FONT_STRETCH_NORMAL, 0,
                   nsPresContext::CSSPixelsToAppUnits(11));
 
diff --git a/layout/generic/MathMLTextRunFactory.cpp b/layout/generic/MathMLTextRunFactory.cpp
index 30853ca1149e..835ead12e8da 100644
--- a/layout/generic/MathMLTextRunFactory.cpp
+++ b/layout/generic/MathMLTextRunFactory.cpp
@@ -567,7 +567,7 @@ MathMLTextRunFactory::RebuildTextRun(nsTransformedTextRun* aTextRun,
         larger, no change is made.
 
         If the user doesn't want this to happen, all they need to do is set
-        style="-moz-font-feature-settings: 'ssty' 0"
+        style="font-feature-settings: 'ssty' 0"
       */
       if (scriptScaling <= (NS_MATHML_DEFAULT_SCRIPT_SIZE_MULTIPLIER +
                             (NS_MATHML_DEFAULT_SCRIPT_SIZE_MULTIPLIER*
diff --git a/layout/generic/nsTextRunTransformations.h b/layout/generic/nsTextRunTransformations.h
index 844ea2244e67..e198a7bf17c7 100644
--- a/layout/generic/nsTextRunTransformations.h
+++ b/layout/generic/nsTextRunTransformations.h
@@ -43,8 +43,8 @@ public:
   // via the fontgroup.
   
   // Takes ownership of aInnerTransformTextRunFactory
-  nsCaseTransformTextRunFactory(nsTransformingTextRunFactory* aInnerTransformingTextRunFactory,
-                                bool aAllUppercase = false)
+  explicit nsCaseTransformTextRunFactory(nsTransformingTextRunFactory* aInnerTransformingTextRunFactory,
+                                         bool aAllUppercase = false)
     : mInnerTransformingTextRunFactory(aInnerTransformingTextRunFactory),
       mAllUppercase(aAllUppercase) {}
 
diff --git a/layout/reftests/counter-style/ref-common.css b/layout/reftests/counter-style/ref-common.css
index 57039fa3c0ab..92d77de0e5da 100644
--- a/layout/reftests/counter-style/ref-common.css
+++ b/layout/reftests/counter-style/ref-common.css
@@ -1,7 +1,6 @@
 body {
   /* to match ua.css, see bug 1020143 */
-  -moz-font-feature-settings: "tnum";
-  font-feature-settings: "tnum";
+  font-variant-numeric: tabular-nums;
 }
 div, p {
   padding: 0; margin: 0;
diff --git a/layout/reftests/counter-style/test-common.css b/layout/reftests/counter-style/test-common.css
index b6f5374156f3..dcbf4e1e0240 100644
--- a/layout/reftests/counter-style/test-common.css
+++ b/layout/reftests/counter-style/test-common.css
@@ -1,7 +1,6 @@
 body {
   /* to match ua.css, see bug 1020143 */
-  -moz-font-feature-settings: "tnum";
-  font-feature-settings: "tnum";
+  font-variant-numeric: tabular-nums;
 }
 ol, ul, section, p {
   padding: 0; margin: 0;
diff --git a/layout/reftests/counters/counter-suffix-ref.html b/layout/reftests/counters/counter-suffix-ref.html
index 1cac54810771..bcc760a7d353 100644
--- a/layout/reftests/counters/counter-suffix-ref.html
+++ b/layout/reftests/counters/counter-suffix-ref.html
@@ -7,8 +7,7 @@
     width: 3em;
     text-align: end;
     box-sizing: border-box;
-    -moz-font-feature-settings: "tnum"; /* to match ua.css, see bug 1020143 */
-    font-feature-settings: "tnum";
+    font-variant-numeric: tabular-nums;
   }
 </style>
 <div id="wrapper">
diff --git a/layout/reftests/font-features/alternates-order-ref.html b/layout/reftests/font-features/alternates-order-ref.html
index a235981072c9..08f29d157768 100644
--- a/layout/reftests/font-features/alternates-order-ref.html
+++ b/layout/reftests/font-features/alternates-order-ref.html
@@ -14,7 +14,7 @@ body {
 
 div { margin: 0 20px; }
 span {
-  -moz-font-feature-settings: "ss05"; /* crossed W */
+  font-feature-settings: "ss05"; /* crossed W */
 }
 
 </style>
diff --git a/layout/reftests/font-features/alternates-order.html b/layout/reftests/font-features/alternates-order.html
index c20c15df97f2..2efe803abb50 100644
--- a/layout/reftests/font-features/alternates-order.html
+++ b/layout/reftests/font-features/alternates-order.html
@@ -10,13 +10,13 @@
 @font-face {
   font-family: fontA;
   src: url(../fonts/LinLibertine_Re-4.7.5.woff) format("woff");
-  -moz-font-feature-settings: "ss05" on;
+  font-feature-settings: "ss05" on;
 }
 
 @font-face {
   font-family: fontB;
   src: url(../fonts/LinLibertine_Re-4.7.5.woff) format("woff");
-  -moz-font-feature-settings: "ss05" off;
+  font-feature-settings: "ss05" off;
 }
 
 @font-feature-values libertine {
@@ -49,7 +49,7 @@ body {
   line-height: 1.2em;
 }
 
-/* -moz-font-feature-settings: "ss05"; crossed W */
+/* font-feature-settings: "ss05"; crossed W */
 
 div { margin: 0 20px; }
 
@@ -84,14 +84,14 @@ div { margin: 0 20px; }
 #test6 {
   /* testing one feature doesn't affect another */
   font-variant-alternates: styleset(somethingElse);
-  -moz-font-feature-settings: "ss05" on;
+  font-feature-settings: "ss05" on;
 }
 
 #test7 {
   /* testing font-specificity of feature value rule */
   font-family: fontA;
   font-variant-alternates: styleset(scriptJ);
-  -moz-font-feature-settings: "ss06";
+  font-feature-settings: "ss06";
 }
 
 #test8 {
diff --git a/layout/reftests/font-features/annotations-ref.html b/layout/reftests/font-features/annotations-ref.html
index c3418bfd642f..a21ea28fc57d 100644
--- a/layout/reftests/font-features/annotations-ref.html
+++ b/layout/reftests/font-features/annotations-ref.html
@@ -17,37 +17,37 @@ body {
 @font-face {
   font-family: testMeiryo-circled;
   src: local(Meiryo);
-  -moz-font-feature-settings: "nalt" 4;
+  font-feature-settings: "nalt" 4;
 }
 
 @font-face {
   font-family: testMeiryo-black-circled;
   src: local(Meiryo);
-  -moz-font-feature-settings: "nalt" 5;
+  font-feature-settings: "nalt" 5;
 }
 
 @font-face {
   font-family: testMeiryo-rounded-box;
   src: local(Meiryo);
-  -moz-font-feature-settings: "nalt" 9;
+  font-feature-settings: "nalt" 9;
 }
 
 @font-face {
   font-family: testHiraginoMaru-circled;
   src: local(HiraMaruProN-W4), local(Hiragino Maru Gothic ProN W4);
-  -moz-font-feature-settings: "nalt" 1;
+  font-feature-settings: "nalt" 1;
 }
 
 @font-face {
   font-family: testHiraginoMaru-black-circled;
   src: local(HiraMaruProN-W4), local(Hiragino Maru Gothic ProN W4);
-  -moz-font-feature-settings: "nalt" 4;
+  font-feature-settings: "nalt" 4;
 }
 
 @font-face {
   font-family: testHiraginoMaru-rounded-box;
   src: local(HiraMaruProN-W4), local(Hiragino Maru Gothic ProN W4);
-  -moz-font-feature-settings: "nalt" 10;
+  font-feature-settings: "nalt" 10;
 }
 
 #test1 {
diff --git a/layout/reftests/font-features/font-features-across-space-1-ref.html b/layout/reftests/font-features/font-features-across-space-1-ref.html
index 5c3a4c541a39..110ab16ae72c 100644
--- a/layout/reftests/font-features/font-features-across-space-1-ref.html
+++ b/layout/reftests/font-features/font-features-across-space-1-ref.html
@@ -16,10 +16,7 @@ td {
 .test {
   font-family: ligsym;
   font-size: 150%;
-  -moz-font-feature-settings: "liga=1";
-  -moz-font-feature-settings: "liga" on;
   -webkit-font-feature-settings: "liga" on;
-  -ms-font-feature-settings: "liga" on;
   -o-font-feature-settings: "liga" on;
   font-feature-settings: "liga" on;
 }
diff --git a/layout/reftests/font-features/font-features-across-space-1.html b/layout/reftests/font-features/font-features-across-space-1.html
index 3797f777047c..1f60e3d2c5d0 100644
--- a/layout/reftests/font-features/font-features-across-space-1.html
+++ b/layout/reftests/font-features/font-features-across-space-1.html
@@ -16,10 +16,7 @@ td {
 .test {
   font-family: ligsym;
   font-size: 150%;
-  -moz-font-feature-settings: "liga=1";
-  -moz-font-feature-settings: "liga" on;
   -webkit-font-feature-settings: "liga" on;
-  -ms-font-feature-settings: "liga" on;
   -o-font-feature-settings: "liga" on;
   font-feature-settings: "liga" on;
 }
diff --git a/layout/reftests/font-features/font-features-hlig-2.html b/layout/reftests/font-features/font-features-hlig-2.html
index 79d7caf61735..3fde28f26d0d 100644
--- a/layout/reftests/font-features/font-features-hlig-2.html
+++ b/layout/reftests/font-features/font-features-hlig-2.html
@@ -4,7 +4,7 @@
 @font-face {
   font-family: libertine;
   src: url(../fonts/LinLibertine_Re-4.7.5.woff) format("woff");
-  -moz-font-feature-settings: "hlig";
+  font-feature-settings: "hlig";
 }
 body {
   font-family: libertine, sans-serif;
diff --git a/layout/reftests/font-features/font-features-hlig-3.html b/layout/reftests/font-features/font-features-hlig-3.html
index fe5b92a6e158..5efa9d13b62b 100644
--- a/layout/reftests/font-features/font-features-hlig-3.html
+++ b/layout/reftests/font-features/font-features-hlig-3.html
@@ -4,13 +4,13 @@
 @font-face {
   font-family: libertine;
   src: url(../fonts/LinLibertine_Re-4.7.5.woff) format("woff");
-  -moz-font-feature-settings: "hlig";
+  font-feature-settings: "hlig";
 }
 body {
   font-family: libertine, sans-serif;
   font-size: 400%;
   line-height: 2em;
-  -moz-font-feature-settings: "hlig" off, "liga" off;
+  font-feature-settings: "hlig" off, "liga" off;
 }
 </style>
 </head>
diff --git a/layout/reftests/font-features/font-features-hlig-4.html b/layout/reftests/font-features/font-features-hlig-4.html
index 607af26734ab..409c7f808538 100644
--- a/layout/reftests/font-features/font-features-hlig-4.html
+++ b/layout/reftests/font-features/font-features-hlig-4.html
@@ -4,13 +4,13 @@
 @font-face {
   font-family: libertine;
   src: url(../fonts/LinLibertine_Re-4.7.5.woff) format("woff");
-  -moz-font-feature-settings: "hlig" off;
+  font-feature-settings: "hlig" off;
 }
 body {
   font-family: libertine, sans-serif;
   font-size: 400%;
   line-height: 2em;
-  -moz-font-feature-settings: "hlig" on;
+  font-feature-settings: "hlig" on;
 }
 </style>
 </head>
diff --git a/layout/reftests/font-features/font-features-hlig-5.html b/layout/reftests/font-features/font-features-hlig-5.html
index 8f57ce5bec02..c076f64b9cc5 100644
--- a/layout/reftests/font-features/font-features-hlig-5.html
+++ b/layout/reftests/font-features/font-features-hlig-5.html
@@ -4,13 +4,13 @@
 @font-face {
   font-family: libertine;
   src: url(../fonts/LinLibertine_Re-4.7.5.woff) format("woff");
-  -moz-font-feature-settings: "hlig";
+  font-feature-settings: "hlig";
 }
 body {
   font-family: libertine, sans-serif;
   font-size: 400%;
   line-height: 2em;
-  -moz-font-feature-settings: "hlig" off;
+  font-feature-settings: "hlig" off;
 }
 </style>
 </head>
diff --git a/layout/reftests/font-features/font-features-hlig.html b/layout/reftests/font-features/font-features-hlig.html
index 8caae03e717d..1b93834fdde2 100644
--- a/layout/reftests/font-features/font-features-hlig.html
+++ b/layout/reftests/font-features/font-features-hlig.html
@@ -9,7 +9,7 @@ body {
   font-family: libertine, sans-serif;
   font-size: 400%;
   line-height: 2em;
-  -moz-font-feature-settings: "hlig" on;
+  font-feature-settings: "hlig" on;
 }
 </style>
 </head>
diff --git a/layout/reftests/font-features/font-features-noliga.html b/layout/reftests/font-features/font-features-noliga.html
index 774c969cdc74..c7e8e56b9f28 100644
--- a/layout/reftests/font-features/font-features-noliga.html
+++ b/layout/reftests/font-features/font-features-noliga.html
@@ -9,7 +9,7 @@ body {
   font-family: libertine, sans-serif;
   font-size: 400%;
   line-height: 2em;
-  -moz-font-feature-settings: "liga" 0;
+  font-feature-settings: "liga" 0;
 }
 </style>
 </head>
diff --git a/layout/reftests/font-features/font-features-oldsyntax-1.html b/layout/reftests/font-features/font-features-oldsyntax-1.html
deleted file mode 100644
index 83c67265f251..000000000000
--- a/layout/reftests/font-features/font-features-oldsyntax-1.html
+++ /dev/null
@@ -1,20 +0,0 @@
-<html>
-<head>
-<style type="text/css">
-@font-face {
-  font-family: libertine;
-  src: url(../fonts/LinLibertine_Re-4.7.5.woff) format("woff");
-}
-body {
-  font-family: libertine, sans-serif;
-  font-size: 400%;
-  line-height: 2em;
-  -moz-font-feature-settings: "hlig=1";
-  -moz-font-feature-settings: "hlig" off;
-}
-</style>
-</head>
-<body lang="en">
-fastest firefox
-</body>
-</html>
diff --git a/layout/reftests/font-features/font-features-oldsyntax-2.html b/layout/reftests/font-features/font-features-oldsyntax-2.html
deleted file mode 100644
index 7215dd71aecd..000000000000
--- a/layout/reftests/font-features/font-features-oldsyntax-2.html
+++ /dev/null
@@ -1,20 +0,0 @@
-<html>
-<head>
-<style type="text/css">
-@font-face {
-  font-family: libertine;
-  src: url(../fonts/LinLibertine_Re-4.7.5.woff) format("woff");
-}
-body {
-  font-family: libertine, sans-serif;
-  font-size: 400%;
-  line-height: 2em;
-  -moz-font-feature-settings: "hlig" off;
-  -moz-font-feature-settings: "hlig=1";
-}
-</style>
-</head>
-<body lang="en">
-fastest firefox
-</body>
-</html>
diff --git a/layout/reftests/font-features/font-features-oldsyntax-3.html b/layout/reftests/font-features/font-features-oldsyntax-3.html
deleted file mode 100644
index 4cc803f7609c..000000000000
--- a/layout/reftests/font-features/font-features-oldsyntax-3.html
+++ /dev/null
@@ -1,20 +0,0 @@
-<html>
-<head>
-<style type="text/css">
-@font-face {
-  font-family: libertine;
-  src: url(../fonts/LinLibertine_Re-4.7.5.woff) format("woff");
-}
-body {
-  font-family: libertine, sans-serif;
-  font-size: 400%;
-  line-height: 2em;
-  -moz-font-feature-settings: "hlig=0";
-  -moz-font-feature-settings: "hlig";
-}
-</style>
-</head>
-<body lang="en">
-fastest firefox
-</body>
-</html>
diff --git a/layout/reftests/font-features/font-features-oldsyntax-4.html b/layout/reftests/font-features/font-features-oldsyntax-4.html
deleted file mode 100644
index 3e13f90b7ce7..000000000000
--- a/layout/reftests/font-features/font-features-oldsyntax-4.html
+++ /dev/null
@@ -1,20 +0,0 @@
-<html>
-<head>
-<style type="text/css">
-@font-face {
-  font-family: libertine;
-  src: url(../fonts/LinLibertine_Re-4.7.5.woff) format("woff");
-}
-body {
-  font-family: libertine, sans-serif;
-  font-size: 400%;
-  line-height: 2em;
-  -moz-font-feature-settings: "hlig";
-  -moz-font-feature-settings: "hlig=0";
-}
-</style>
-</head>
-<body lang="en">
-fastest firefox
-</body>
-</html>
diff --git a/layout/reftests/font-features/font-features-order-1.html b/layout/reftests/font-features/font-features-order-1.html
index d407aba0a876..a2d97256b848 100644
--- a/layout/reftests/font-features/font-features-order-1.html
+++ b/layout/reftests/font-features/font-features-order-1.html
@@ -10,7 +10,7 @@ body {
   font-family: libertine, sans-serif;
   font-size: 400%;
   line-height: 2em;
-  -moz-font-feature-settings: "liga" 0, "liga" 1;
+  font-feature-settings: "liga" 0, "liga" 1;
 }
 </style>
 </head>
diff --git a/layout/reftests/font-features/font-features-order-2.html b/layout/reftests/font-features/font-features-order-2.html
index 7a8060440f98..2b68c394535f 100644
--- a/layout/reftests/font-features/font-features-order-2.html
+++ b/layout/reftests/font-features/font-features-order-2.html
@@ -10,7 +10,7 @@ body {
   font-family: libertine, sans-serif;
   font-size: 400%;
   line-height: 2em;
-  -moz-font-feature-settings: "liga" 1, "liga" 0;
+  font-feature-settings: "liga" 1, "liga" 0;
 }
 </style>
 </head>
diff --git a/layout/reftests/font-features/font-features-order-3.html b/layout/reftests/font-features/font-features-order-3.html
index 8b70771be87e..d38f8709f571 100644
--- a/layout/reftests/font-features/font-features-order-3.html
+++ b/layout/reftests/font-features/font-features-order-3.html
@@ -5,14 +5,14 @@
 @font-face {
   font-family: libertine;
   src: url(../fonts/LinLibertine_Re-4.7.5.woff) format("woff");
-  -moz-font-feature-settings: "liga" on, "hlig" on;
+  font-feature-settings: "liga" on, "hlig" on;
 }
 body {
   font-family: libertine, sans-serif;
   font-size: 400%;
   line-height: 2em;
   /* font feature settings property should override font setting */
-  -moz-font-feature-settings: "liga" off, "hlig" off;
+  font-feature-settings: "liga" off, "hlig" off;
 }
 </style>
 </head>
diff --git a/layout/reftests/font-features/font-features-turkish-override-1.html b/layout/reftests/font-features/font-features-turkish-override-1.html
index 5c0ad54b730a..9ba3e603a7df 100644
--- a/layout/reftests/font-features/font-features-turkish-override-1.html
+++ b/layout/reftests/font-features/font-features-turkish-override-1.html
@@ -9,7 +9,7 @@ body {
   font-family: libertine, sans-serif;
   font-size: 400%;
   line-height: 2em;
-  -moz-font-language-override: "TRK";
+  font-language-override: "TRK";
 }
 </style>
 </head>
diff --git a/layout/reftests/font-features/font-features-turkish-override-2.html b/layout/reftests/font-features/font-features-turkish-override-2.html
index 52e592353a4b..165810e189fb 100644
--- a/layout/reftests/font-features/font-features-turkish-override-2.html
+++ b/layout/reftests/font-features/font-features-turkish-override-2.html
@@ -4,7 +4,7 @@
 @font-face {
   font-family: libertine;
   src: url(../fonts/LinLibertine_Re-4.7.5.woff) format("woff");
-  -moz-font-language-override: "TRK";
+  font-language-override: "TRK";
 }
 body {
   font-family: libertine, sans-serif;
diff --git a/layout/reftests/font-features/font-features-turkish-override-3.html b/layout/reftests/font-features/font-features-turkish-override-3.html
index b94a3ab3d7cb..b2c8c69450f2 100644
--- a/layout/reftests/font-features/font-features-turkish-override-3.html
+++ b/layout/reftests/font-features/font-features-turkish-override-3.html
@@ -9,7 +9,7 @@ body {
   font-family: libertine, sans-serif;
   font-size: 400%;
   line-height: 2em;
-  -moz-font-language-override: "ENG";
+  font-language-override: "ENG";
 }
 </style>
 </head>
diff --git a/layout/reftests/font-features/font-features-turkish-override-4.html b/layout/reftests/font-features/font-features-turkish-override-4.html
index b84cdd2cf307..13c379c3d876 100644
--- a/layout/reftests/font-features/font-features-turkish-override-4.html
+++ b/layout/reftests/font-features/font-features-turkish-override-4.html
@@ -4,7 +4,7 @@
 @font-face {
   font-family: libertine;
   src: url(../fonts/LinLibertine_Re-4.7.5.woff) format("woff");
-  -moz-font-language-override: "ENG";
+  font-language-override: "ENG";
 }
 body {
   font-family: libertine, sans-serif;
diff --git a/layout/reftests/font-features/font-features-turkish-override-5.html b/layout/reftests/font-features/font-features-turkish-override-5.html
index 790f30370fe9..1e847cb1e13f 100644
--- a/layout/reftests/font-features/font-features-turkish-override-5.html
+++ b/layout/reftests/font-features/font-features-turkish-override-5.html
@@ -4,13 +4,13 @@
 @font-face {
   font-family: libertine;
   src: url(../fonts/LinLibertine_Re-4.7.5.woff) format("woff");
-  -moz-font-language-override: "ENG";
+  font-language-override: "ENG";
 }
 body {
   font-family: libertine, sans-serif;
   font-size: 400%;
   line-height: 2em;
-  -moz-font-language-override: "TRK";
+  font-language-override: "TRK";
 }
 </style>
 </head>
diff --git a/layout/reftests/font-features/font-variant-features.js b/layout/reftests/font-features/font-variant-features.js
index 262e629ef1aa..e3a850514895 100644
--- a/layout/reftests/font-features/font-variant-features.js
+++ b/layout/reftests/font-features/font-variant-features.js
@@ -10,11 +10,43 @@ gPrefix = "";
 // each of these tests evaluate whether a given feature is enabled as required
 // and also whether features that shouldn't be enabled are or not.
 var gPropertyData = [
+  // font-variant (shorthand)
+  // valid values
+  { prop: "font-variant", value: "normal", features: {"smcp": 0} },
+  { prop: "font-variant", value: "small-caps", features: {"smcp": 1, "c2sc": 0} },
+  { prop: "font-variant", value: "none", features: {"liga": 0, "dlig": 0, "clig": 0, "calt": 0, "hlig": 0} },
+  { prop: "font-variant", value: "all-small-caps", features: {"smcp": 1, "c2sc": 1, "pcap": 0} },
+  { prop: "font-variant", value: "common-ligatures no-discretionary-ligatures", features: {"liga": 1, "clig": 1, "dlig": 0, "hlig": 0, "calt": 1} },
+  { prop: "font-variant", value: "proportional-nums slashed-zero diagonal-fractions oldstyle-nums ordinal", features: {"frac": 1, "afrc": 0, "tnum": 0, "pnum": 1, "onum": 1, "ordn": 1, "zero": 1} },
+  { prop: "font-variant", value: "all-small-caps traditional", features: {"smcp": 1, "c2sc": 1, "pcap": 0, "trad": 1, "jp04": 0} },
+  { prop: "font-variant", value: "styleset(out-of-bounds1, out-of-bounds2) traditional", features: {"ss00": 0, "ss01": 0, "ss99": 0, "trad": 1} }, // out-of-bounds values but not invalid syntax
+  { prop: "font-variant", value: "styleset(ok-alt-a, ok-alt-b) historical-forms", features: {"ss01": 1, "ss02": 0, "ss03": 1, "ss04": 0, "ss05": 1, "ss19": 1, "ss20": 0, "hist": 1, "hlig": 0} },
+  { prop: "font-variant", value: "traditional historical-forms styleset(ok-alt-a, ok-alt-b)", features: {"trad": 1, "ss01": 1, "ss02": 0, "ss03": 1, "ss04": 0, "ss05": 1, "ss19": 1, "ss20": 0, "hist": 1, "hlig": 0} },
+  { prop: "font-variant", value: "styleset(scope-test2)", features: {"ss23": 0, "ss24": 1, "ss01": 1} },
+  { prop: "font-variant", value: "character-variant(scope-test2)", features: {"cv23": 2, "cv24": 0, "cv01": 0} },
+
+  // invalid values
+  { prop: "font-variant", value: "normal small-caps", features: {"smcp": 0}, invalid: true },
+  { prop: "font-variant", value: "common-ligatures none", features: {"liga": 1, "clig": 1, "dlig": 0}, invalid: true },
+  { prop: "font-variant", value: "none common-ligatures", features: {"liga": 1, "clig": 1, "dlig": 0}, invalid: true },
+  { prop: "font-variant", value: "small-caps potato", features: {"smcp": 0}, invalid: true },
+  { prop: "font-variant", value: "common-ligatures traditional no-common-ligatures", features: {"liga": 1, "clig": 1, "dlig": 0, "trad": 0}, invalid: true },
+  { prop: "font-variant", value: "common-ligatures traditional common-ligatures", features: {"liga": 1, "clig": 1, "dlig": 0, "trad": 0}, invalid: true },
+  { prop: "font-variant", value: "small-caps jis83 all-small-caps", features: {"smcp": 0, "c2sc": 0, "jp83": 0}, invalid: true },
+  { prop: "font-variant", value: "lining-nums traditional slashed-zero ordinal normal", features: {"lnum": 0, "onum": 0, "zero": 0, "trad": 0}, invalid: true },
+  { prop: "font-variant", value: "diagonal-fractions stacked-fractions", features: {"frac": 0, "afrc": 0}, invalid: true },
+  { prop: "font-variant", value: "stacked-fractions diagonal-fractions historical-ligatures", features: {"frac": 0, "afrc": 0, "hlig": 0}, invalid: true },
+  { prop: "font-variant", value: "super sub", features: {"subs": 0, "sups": 0}, invalid: true },
+  { prop: "font-variant", value: "super historical-ligatures sub", features: {"subs": 0, "sups": 0, "hlig": 0}, invalid: true },
+  { prop: "font-variant", value: "annotation(circled) annotation(circled)", features: {"nalt": 0, "lnum": 0, "onum": 0, "pnum": 0}, invalid: true },
+
   // font-variant-alternates
   // valid values
   { prop: "font-variant-alternates", value: "normal", features: {"salt": 0, "swsh": 0} },
   { prop: "font-variant-alternates", value: "historical-forms", features: {"hist": 1, "hlig": 0} },
   { prop: "font-variant-alternates", value: "styleset(ok-alt-a, ok-alt-b)", features: {"ss01": 1, "ss02": 0, "ss03": 1, "ss04": 0, "ss05": 1, "ss19": 1, "ss20": 0} },
+  { prop: "font-variant-alternates", value: "styleset(ok-alt-a, ok-alt-b) historical-forms", features: {"ss01": 1, "ss02": 0, "ss03": 1, "ss04": 0, "ss05": 1, "ss19": 1, "ss20": 0, "hist": 1, "hlig": 0} },
+  { prop: "font-variant-alternates", value: "historical-forms styleset(ok-alt-a, ok-alt-b)", features: {"ss01": 1, "ss02": 0, "ss03": 1, "ss04": 0, "ss05": 1, "ss19": 1, "ss20": 0, "hist": 1, "hlig": 0} },
   { prop: "font-variant-alternates", value: "character-variant(ok-1)", features: {"cv78": 2, "cv79": 0, "cv77": 0} },
   { prop: "font-variant-alternates", value: "character-variant(ok-1, ok-3)", features: {"cv78": 2, "cv79": 0, "cv77": 0, "cv23": 1, "cv22": 0, "cv24": 0} },
   { prop: "font-variant-alternates", value: "annotation(circled)", features: {"nalt": 1} },
diff --git a/layout/reftests/font-features/font-variant-ref.html b/layout/reftests/font-features/font-variant-ref.html
new file mode 100644
index 000000000000..6fd182e879d4
--- /dev/null
+++ b/layout/reftests/font-features/font-variant-ref.html
@@ -0,0 +1,16 @@
+<!DOCTYPE HTML>
+<html lang="en">
+<head>
+<title>font-variant shorthand test</title>
+<meta http-equiv="Content-Type" content="text/html; charset=utf-8" />
+<script type="text/javascript" src="../fonts/gsubtest/gsubtest-features.js"></script>
+<script type="text/javascript" src="font-variant-features.js"></script>
+<link rel="stylesheet" href="font-variant-features.css" type="text/css"/>
+</head>
+<body>
+<div id="content"></div>
+<script type="text/javascript">
+  document.getElementById("content").appendChild(createFeatureTestTable(gPropertyData, "font-variant", true, false));
+</script>
+</body>
+</html>
diff --git a/layout/reftests/font-features/font-variant.html b/layout/reftests/font-features/font-variant.html
new file mode 100644
index 000000000000..bde0cd6c272d
--- /dev/null
+++ b/layout/reftests/font-features/font-variant.html
@@ -0,0 +1,16 @@
+<!DOCTYPE HTML>
+<html lang="en">
+<head>
+<title>font-variant shorthand test</title>
+<meta http-equiv="Content-Type" content="text/html; charset=utf-8" />
+<script type="text/javascript" src="../fonts/gsubtest/gsubtest-features.js"></script>
+<script type="text/javascript" src="font-variant-features.js"></script>
+<link rel="stylesheet" href="font-variant-features.css" type="text/css"/>
+</head>
+<body>
+<div id="content"></div>
+<script type="text/javascript">
+  document.getElementById("content").appendChild(createFeatureTestTable(gPropertyData, "font-variant", false, false));
+</script>
+</body>
+</html>
diff --git a/layout/reftests/font-features/fwid-spaces.html b/layout/reftests/font-features/fwid-spaces.html
index b92ba33c7dbc..5715886d2585 100644
--- a/layout/reftests/font-features/fwid-spaces.html
+++ b/layout/reftests/font-features/fwid-spaces.html
@@ -12,7 +12,6 @@ body {
 
 #test, #test pre {
   font: 150% Hiragino Kaku Gothic ProN, Meiryo, sans-serif;
-  -moz-font-feature-settings: "fwid" on;
   -webkit-font-feature-settings: "fwid" on;
   font-feature-settings: "fwid" on;
 }
diff --git a/layout/reftests/font-features/kerning-sanity-check-kern.html b/layout/reftests/font-features/kerning-sanity-check-kern.html
index 503fe466d022..66225cd372fa 100644
--- a/layout/reftests/font-features/kerning-sanity-check-kern.html
+++ b/layout/reftests/font-features/kerning-sanity-check-kern.html
@@ -19,7 +19,6 @@ div#test, div#test pre {
   font-family: Arial, LinuxLibertine, sans-serif;
   font-size: 300%;
   line-height: 1.1em;
-  -moz-font-feature-settings: "kern" on;
   -webkit-font-feature-settings: "kern" on;
   font-feature-settings: "kern" on;
 }
diff --git a/layout/reftests/font-features/kerning-sanity-check-nokern.html b/layout/reftests/font-features/kerning-sanity-check-nokern.html
index 2d84c74540f2..1b49441f526e 100644
--- a/layout/reftests/font-features/kerning-sanity-check-nokern.html
+++ b/layout/reftests/font-features/kerning-sanity-check-nokern.html
@@ -19,7 +19,6 @@ div#test, div#test pre {
   font-family: Arial, LinuxLibertine, sans-serif;
   font-size: 300%;
   line-height: 1.1em;
-  -moz-font-feature-settings: "kern" off;
   -webkit-font-feature-settings: "kern" off;
   font-feature-settings: "kern" off;
 }
diff --git a/layout/reftests/font-features/kerning-spaces-arial-kern.html b/layout/reftests/font-features/kerning-spaces-arial-kern.html
index afc2963e1c9a..7b859073d8a3 100644
--- a/layout/reftests/font-features/kerning-spaces-arial-kern.html
+++ b/layout/reftests/font-features/kerning-spaces-arial-kern.html
@@ -14,7 +14,6 @@ div#test, div#test pre {
   font-family: Arial, sans-serif;
   font-size: 150%;
   line-height: 1.1em;
-  -moz-font-feature-settings: "kern" on;
   -webkit-font-feature-settings: "kern" on;
   font-feature-settings: "kern" on;
 }
diff --git a/layout/reftests/font-features/kerning-spaces-arial-nokern.html b/layout/reftests/font-features/kerning-spaces-arial-nokern.html
index b58e12db8511..d73007baccc5 100644
--- a/layout/reftests/font-features/kerning-spaces-arial-nokern.html
+++ b/layout/reftests/font-features/kerning-spaces-arial-nokern.html
@@ -14,7 +14,6 @@ div#test, div#test pre {
   font-family: Arial, sans-serif;
   font-size: 150%;
   line-height: 1.1em;
-  -moz-font-feature-settings: "kern" off;
   -webkit-font-feature-settings: "kern" off;
   font-feature-settings: "kern" off;
 }
diff --git a/layout/reftests/font-features/kerning-spaces-tnr-kern.html b/layout/reftests/font-features/kerning-spaces-tnr-kern.html
index 2bc22c3d8d7e..18dbc186189d 100644
--- a/layout/reftests/font-features/kerning-spaces-tnr-kern.html
+++ b/layout/reftests/font-features/kerning-spaces-tnr-kern.html
@@ -14,7 +14,6 @@ div#test, div#test pre {
   font-family: Times New Roman, sans-serif;
   font-size: 150%;
   line-height: 1.1em;
-  -moz-font-feature-settings: "kern" on;
   -webkit-font-feature-settings: "kern" on;
   font-feature-settings: "kern" on;
 }
diff --git a/layout/reftests/font-features/kerning-spaces-tnr-nokern.html b/layout/reftests/font-features/kerning-spaces-tnr-nokern.html
index b813fbea80b3..0e033454c01f 100644
--- a/layout/reftests/font-features/kerning-spaces-tnr-nokern.html
+++ b/layout/reftests/font-features/kerning-spaces-tnr-nokern.html
@@ -14,7 +14,6 @@ div#test, div#test pre {
   font-family: Times New Roman, sans-serif;
   font-size: 150%;
   line-height: 1.1em;
-  -moz-font-feature-settings: "kern" off;
   -webkit-font-feature-settings: "kern" off;
   font-feature-settings: "kern" off;
 }
diff --git a/layout/reftests/font-features/reftest.list b/layout/reftests/font-features/reftest.list
index d22675c8a6ca..048f56d0d662 100644
--- a/layout/reftests/font-features/reftest.list
+++ b/layout/reftests/font-features/reftest.list
@@ -27,22 +27,16 @@ HTTP(..) == font-features-turkish.html font-features-noliga.html
 HTTP(..) == font-features-hlig-2.html font-features-hlig.html
 HTTP(..) == font-features-hlig-4.html font-features-hlig.html
 HTTP(..) != font-features-hlig-5.html font-features-hlig.html
-pref(layout.css.font-features.enabled,true) HTTP(..) == font-features-ligatures-none.html font-features-noliga.html
+HTTP(..) == font-features-ligatures-none.html font-features-noliga.html
 
 # check that feature in style rule overrides @font-face
 skip-if(B2G) HTTP(..) == font-features-hlig-3.html font-features-noliga.html # bug 773482
 
-# make sure old syntax usage never interferes with new syntax usage
-HTTP(..) == font-features-oldsyntax-1.html font-features-ref.html
-HTTP(..) == font-features-oldsyntax-2.html font-features-ref.html
-HTTP(..) == font-features-oldsyntax-3.html font-features-hlig.html
-HTTP(..) == font-features-oldsyntax-4.html font-features-hlig.html
-
-# compare -moz-font-language-override rendering to lang-tagged rendering
+# compare font-language-override rendering to lang-tagged rendering
 skip-if(B2G) HTTP(..) == font-features-turkish-override-1.html font-features-turkish.html # bug 773482
 HTTP(..) == font-features-turkish-override-2.html font-features-turkish.html
 
-# check use of -moz-font-language-override to override explicit lang tag
+# check use of font-language-override to override explicit lang tag
 HTTP(..) == font-features-turkish-override-3.html font-features-ref.html
 HTTP(..) == font-features-turkish-override-4.html font-features-ref.html
 skip-if(B2G) HTTP(..) == font-features-turkish-override-5.html font-features-turkish.html # bug 773482
@@ -53,35 +47,35 @@ HTTP(..) == font-features-order-2.html font-features-noliga.html
 
 # check priority of feature settings vs. font-variant subproperty
 HTTP(..) == font-features-order-3.html font-features-noliga.html
-pref(layout.css.font-features.enabled,true) HTTP(..) == font-features-order-4.html font-features-noliga.html
-pref(layout.css.font-features.enabled,true) HTTP(..) == font-features-order-5.html font-features-hlig.html
+HTTP(..) == font-features-order-4.html font-features-noliga.html
+HTTP(..) == font-features-order-5.html font-features-hlig.html
 
 # check priority involving feature settings and font-variant-alternates
-pref(layout.css.font-features.enabled,true) HTTP(..) == alternates-order.html alternates-order-ref.html
+HTTP(..) == alternates-order.html alternates-order-ref.html
 
 # check that font-specific values line up with @font-face feature settings
-pref(layout.css.font-features.enabled,true) HTTP(..) == annotations.html annotations-ref.html
+HTTP(..) == annotations.html annotations-ref.html
 
 # font-variant subproperties
 # test for specific features being on and others off, based on prop values
 # (debug problems with font-variant-debug.html which displays all props)
-pref(layout.css.font-features.enabled,true) HTTP(..) == font-variant-alternates.html font-variant-alternates-ref.html
-pref(layout.css.font-features.enabled,true) HTTP(..) == font-variant-caps.html font-variant-caps-ref.html
-pref(layout.css.font-features.enabled,true) HTTP(..) == font-variant-east-asian.html font-variant-east-asian-ref.html
-pref(layout.css.font-features.enabled,true) HTTP(..) == font-variant-ligatures.html font-variant-ligatures-ref.html
-pref(layout.css.font-features.enabled,true) HTTP(..) == font-variant-numeric.html font-variant-numeric-ref.html
-pref(layout.css.font-features.enabled,true) HTTP(..) == font-variant-position.html font-variant-position-ref.html
+HTTP(..) == font-variant-alternates.html font-variant-alternates-ref.html
+HTTP(..) == font-variant-caps.html font-variant-caps-ref.html
+HTTP(..) == font-variant-east-asian.html font-variant-east-asian-ref.html
+HTTP(..) == font-variant-ligatures.html font-variant-ligatures-ref.html
+HTTP(..) == font-variant-numeric.html font-variant-numeric-ref.html
+HTTP(..) == font-variant-position.html font-variant-position-ref.html
 
 # font-kerning
-pref(layout.css.font-features.enabled,true) HTTP(..) != font-kerning-normal.html font-kerning-none.html
-pref(layout.css.font-features.enabled,true) HTTP(..) != font-kerning-auto.html font-kerning-none.html
-pref(layout.css.font-features.enabled,true) HTTP(..) == font-kerning-auto.html font-kerning-normal.html
-pref(layout.css.font-features.enabled,true) HTTP(..) == font-kerning-normal.html font-kerning-kern.html
-pref(layout.css.font-features.enabled,true) HTTP(..) == font-kerning-none.html font-kerning-nokern.html
-pref(layout.css.font-features.enabled,true) HTTP(..) == font-kerning-1.html font-kerning-none.html
-pref(layout.css.font-features.enabled,true) HTTP(..) == font-kerning-2.html font-kerning-normal.html
-pref(layout.css.font-features.enabled,true) HTTP(..) == font-kerning-3.html font-kerning-none.html
-pref(layout.css.font-features.enabled,true) HTTP(..) != font-kerning-table-none.html font-kerning-table-normal.html
+HTTP(..) != font-kerning-normal.html font-kerning-none.html
+HTTP(..) != font-kerning-auto.html font-kerning-none.html
+HTTP(..) == font-kerning-auto.html font-kerning-normal.html
+HTTP(..) == font-kerning-normal.html font-kerning-kern.html
+HTTP(..) == font-kerning-none.html font-kerning-nokern.html
+HTTP(..) == font-kerning-1.html font-kerning-none.html
+HTTP(..) == font-kerning-2.html font-kerning-normal.html
+HTTP(..) == font-kerning-3.html font-kerning-none.html
+HTTP(..) != font-kerning-table-none.html font-kerning-table-normal.html
 
 # sanity check for kerning - with no spaces, kerning should occur
 HTTP(..) == kerning-sanity-check-kern.html kerning-sanity-check-default.html
@@ -102,24 +96,24 @@ random-if(!winWidget&&!cocoaWidget) fails-if(winWidget||cocoaWidget) random-if(/
 
 # font-variant-caps fallback
 # -- sanity check - none of these should look like the default rendering
-pref(layout.css.font-features.enabled,true) HTTP(..) != caps-fallback-smallcaps1.html caps-fallback-default.html
-pref(layout.css.font-features.enabled,true) HTTP(..) != caps-fallback-smallcaps2.html caps-fallback-default.html
-pref(layout.css.font-features.enabled,true) HTTP(..) != caps-fallback-petitecaps.html caps-fallback-default.html
-pref(layout.css.font-features.enabled,true) HTTP(..) != caps-fallback-allsmallcaps.html caps-fallback-default.html
-pref(layout.css.font-features.enabled,true) HTTP(..) != caps-fallback-allpetitecaps.html caps-fallback-default.html
+HTTP(..) != caps-fallback-smallcaps1.html caps-fallback-default.html
+HTTP(..) != caps-fallback-smallcaps2.html caps-fallback-default.html
+HTTP(..) != caps-fallback-petitecaps.html caps-fallback-default.html
+HTTP(..) != caps-fallback-allsmallcaps.html caps-fallback-default.html
+HTTP(..) != caps-fallback-allpetitecaps.html caps-fallback-default.html
 # -- normal or fallback rendering
-pref(layout.css.font-features.enabled,true) HTTP(..) == caps-fallback-smallcaps1.html caps-fallback-smcp.html
-pref(layout.css.font-features.enabled,true) HTTP(..) == caps-fallback-smallcaps2.html caps-fallback-smcp.html
-pref(layout.css.font-features.enabled,true) HTTP(..) == caps-fallback-petitecaps.html caps-fallback-smcp.html
-pref(layout.css.font-features.enabled,true) HTTP(..) == caps-fallback-allsmallcaps.html caps-fallback-smcpc2sc.html
-pref(layout.css.font-features.enabled,true) HTTP(..) == caps-fallback-allpetitecaps.html caps-fallback-smcpc2sc.html
+HTTP(..) == caps-fallback-smallcaps1.html caps-fallback-smcp.html
+HTTP(..) == caps-fallback-smallcaps2.html caps-fallback-smcp.html
+HTTP(..) == caps-fallback-petitecaps.html caps-fallback-smcp.html
+HTTP(..) == caps-fallback-allsmallcaps.html caps-fallback-smcpc2sc.html
+HTTP(..) == caps-fallback-allpetitecaps.html caps-fallback-smcpc2sc.html
 
 # font-variant-position fallback
-pref(layout.css.font-features.enabled,true) HTTP(..) == subsuper-fallback.html subsuper-fallback-ref.html
-pref(layout.css.font-features.enabled,true) HTTP(..) != subsuper-fallback.html subsuper-fallback-notref1.html
-pref(layout.css.font-features.enabled,true) HTTP(..) != subsuper-fallback.html subsuper-fallback-notref2.html
-pref(layout.css.font-features.enabled,true) HTTP(..) != subsuper-fallback.html subsuper-fallback-notref3.html
-pref(layout.css.font-features.enabled,true) HTTP(..) != subsuper-fallback-omega.html subsuper-fallback-omega-notref.html
-pref(layout.css.font-features.enabled,true) HTTP(..) == subsuper-nofallback.html subsuper-nofallback-ref1.html
-pref(layout.css.font-features.enabled,true) HTTP(..) == subsuper-nofallback.html subsuper-nofallback-ref2.html
-pref(layout.css.font-features.enabled,true) HTTP(..) != subsuper-nofallback.html subsuper-nofallback-notref.html
+HTTP(..) == subsuper-fallback.html subsuper-fallback-ref.html
+HTTP(..) != subsuper-fallback.html subsuper-fallback-notref1.html
+HTTP(..) != subsuper-fallback.html subsuper-fallback-notref2.html
+HTTP(..) != subsuper-fallback.html subsuper-fallback-notref3.html
+HTTP(..) != subsuper-fallback-omega.html subsuper-fallback-omega-notref.html
+HTTP(..) == subsuper-nofallback.html subsuper-nofallback-ref1.html
+HTTP(..) == subsuper-nofallback.html subsuper-nofallback-ref2.html
+HTTP(..) != subsuper-nofallback.html subsuper-nofallback-notref.html
diff --git a/layout/reftests/font-features/spacelookups-wordcache-ref.html b/layout/reftests/font-features/spacelookups-wordcache-ref.html
index f7b1b9775220..cd6af0cf4354 100644
--- a/layout/reftests/font-features/spacelookups-wordcache-ref.html
+++ b/layout/reftests/font-features/spacelookups-wordcache-ref.html
@@ -54,13 +54,11 @@ p { margin: 0; line-height: 1.2; }
 
 p.kern {
   -webkit-font-feature-settings: "liga" on, "kern" on;
-  -moz-font-feature-settings: "liga" on, "kern" on;
   font-feature-settings: "liga" on, "kern" on;
 }
 
 p.nokern {
   -webkit-font-feature-settings: "liga" on, "kern" off;
-  -moz-font-feature-settings: "liga" on, "kern" off;
   font-feature-settings: "liga" on, "kern" off;
 }
 
diff --git a/layout/reftests/font-features/spacelookups-wordcache.html b/layout/reftests/font-features/spacelookups-wordcache.html
index 437696e4d1b7..a3bd642b260a 100644
--- a/layout/reftests/font-features/spacelookups-wordcache.html
+++ b/layout/reftests/font-features/spacelookups-wordcache.html
@@ -55,7 +55,6 @@ p { margin: 0; line-height: 1.2; }
 
 .dlig {
   -webkit-font-feature-settings: "dlig" on;
-  -moz-font-feature-settings: "dlig" on;
   font-feature-settings: "dlig" on;
 }
 </style>
diff --git a/layout/reftests/font-features/spacelookups.html b/layout/reftests/font-features/spacelookups.html
index a3bf6b979b7d..ab22ac97995b 100644
--- a/layout/reftests/font-features/spacelookups.html
+++ b/layout/reftests/font-features/spacelookups.html
@@ -64,7 +64,6 @@ div { font-size: 400%; }
 
 .dlig {
   -webkit-font-feature-settings: "dlig" on;
-  -moz-font-feature-settings: "dlig" on;
   font-feature-settings: "dlig" on;
 }
 </style>
diff --git a/layout/reftests/font-features/subsuper-nofallback-ref1.html b/layout/reftests/font-features/subsuper-nofallback-ref1.html
index e35760fe829c..2c015d026f44 100644
--- a/layout/reftests/font-features/subsuper-nofallback-ref1.html
+++ b/layout/reftests/font-features/subsuper-nofallback-ref1.html
@@ -22,12 +22,10 @@ p {
 }
 h4 { font-weight: normal }
 span.super {
-  -moz-font-feature-settings: "sups" on;
   -webkit-font-feature-settings: "sups" on;
   font-feature-settings: "sups" on;
 }
 span.sub {
-  -moz-font-feature-settings: "subs" on;
   -webkit-font-feature-settings: "subs" on;
   font-feature-settings: "subs" on;
 }
diff --git a/layout/reftests/font-matching/reftest.list b/layout/reftests/font-matching/reftest.list
index 5844cdf041da..e3271cfdfebb 100644
--- a/layout/reftests/font-matching/reftest.list
+++ b/layout/reftests/font-matching/reftest.list
@@ -91,5 +91,5 @@ random-if(!(cocoaWidget||winWidget)) == arial-arabic.html arial-arabic-ref.html
 
 != syntheticbold-rotated.html syntheticbold-rotated-ref.html
 
-pref(layout.css.font-features.enabled,true) HTTP(..) == font-synthesis-1.html font-synthesis-1-ref.html
-pref(layout.css.font-features.enabled,true) HTTP(..) == font-synthesis-2.html font-synthesis-2-ref.html
+HTTP(..) == font-synthesis-1.html font-synthesis-1-ref.html
+HTTP(..) == font-synthesis-2.html font-synthesis-2-ref.html
diff --git a/layout/reftests/mathml/mathscript-1.html b/layout/reftests/mathml/mathscript-1.html
index 7a6e2ae0a19c..7685fcc3037b 100644
--- a/layout/reftests/mathml/mathscript-1.html
+++ b/layout/reftests/mathml/mathscript-1.html
@@ -11,24 +11,24 @@
 
   <!-- Demonstrate that it has no effect outside MathML -->
   <div style="font-family: 'mathssty'; 
-              -moz-font-feature-settings: 'ssty' 1">A</div>
+              font-feature-settings: 'ssty' 1">A</div>
   <div style="font-family: 'mathssty'; 
-              -moz-font-feature-settings: 'ssty' 2">A</div>
+              font-feature-settings: 'ssty' 2">A</div>
 
   <!-- Demonstrate that it works within MathML -->
   <math>
     <mstyle style="font-family: 'mathssty';">
     <mrow>
-      <mo style="-moz-font-feature-settings: 'ssty' 0">A</mo>
-      <mo style="-moz-font-feature-settings: 'ssty' 1">A</mo>
-      <mo style="-moz-font-feature-settings: 'ssty' 2">A</mo>
+      <mo style="font-feature-settings: 'ssty' 0">A</mo>
+      <mo style="font-feature-settings: 'ssty' 1">A</mo>
+      <mo style="font-feature-settings: 'ssty' 2">A</mo>
     </mrow>
     </mstyle>
   </math>
   <p>
   <!-- verify it works for the other elements except mtext -->
   <math>
-    <mstyle style="font-family: 'mathssty'; -moz-font-feature-settings: 'ssty' 2">
+    <mstyle style="font-family: 'mathssty'; font-feature-settings: 'ssty' 2">
       <mi mathvariant="normal">A</mi>
       <mn>A</mn>
       <mtext>A</mtext>
diff --git a/layout/reftests/mathml/mathscript-2.html b/layout/reftests/mathml/mathscript-2.html
index ed6ea014f13c..862be8599446 100644
--- a/layout/reftests/mathml/mathscript-2.html
+++ b/layout/reftests/mathml/mathscript-2.html
@@ -14,11 +14,11 @@
 
   <!-- Demonstrate that it has no effect outside MathML -->
   <div style="font-family: 'mathssty';
-              -moz-font-feature-settings: 'ssty' " id="div0">A</div>
+              font-feature-settings: 'ssty' " id="div0">A</div>
 
   <!-- Demonstrate that it works within MathML -->
   <math>
-    <mstyle style="font-family: 'mathssty'; -moz-font-feature-settings: 'ssty' 2">
+    <mstyle style="font-family: 'mathssty'; font-feature-settings: 'ssty' 2">
       <mo id="mo0">A</mo>
     </mstyle>
   </math>
diff --git a/layout/reftests/mathml/ssty-1.html b/layout/reftests/mathml/ssty-1.html
index 79a58a72bca3..bbeeed1253b8 100644
--- a/layout/reftests/mathml/ssty-1.html
+++ b/layout/reftests/mathml/ssty-1.html
@@ -280,7 +280,7 @@
       <msup>
         <mo>A</mo>
         <msup>
-          <mo style="-moz-font-feature-settings: 'ssty' 0">A</mo>
+          <mo style="font-feature-settings: 'ssty' 0">A</mo>
           <mo>A</mo>
         </msup>
       </msup>
@@ -288,7 +288,7 @@
       <msub>
         <mo>A</mo>
         <msub>
-          <mo style="-moz-font-feature-settings: 'ssty' 0">A</mo>
+          <mo style="font-feature-settings: 'ssty' 0">A</mo>
           <mo>A</mo>
         </msub>
       </msub>
@@ -296,12 +296,12 @@
       <msubsup>
         <mo>A</mo>
         <msubsup>
-          <mo style="-moz-font-feature-settings: 'ssty' 0">A</mo>
+          <mo style="font-feature-settings: 'ssty' 0">A</mo>
           <mo>A</mo>
           <mo>A</mo>
         </msubsup>
         <msubsup>
-          <mo style="-moz-font-feature-settings: 'ssty' 0">A</mo>
+          <mo style="font-feature-settings: 'ssty' 0">A</mo>
           <mo>A</mo>
           <mo>A</mo>
         </msubsup>
@@ -310,12 +310,12 @@
       <mmultiscripts>
         <mo>A</mo>
         <mmultiscripts>
-          <mo style="-moz-font-feature-settings: 'ssty' 0">A</mo>
+          <mo style="font-feature-settings: 'ssty' 0">A</mo>
           <mo>A</mo>
           <mo>A</mo>
         </mmultiscripts>
         <mmultiscripts>
-          <mo style="-moz-font-feature-settings: 'ssty' 0">A</mo>
+          <mo style="font-feature-settings: 'ssty' 0">A</mo>
           <mo>A</mo>
           <mo>A</mo>
         </mmultiscripts>
diff --git a/layout/reftests/mathml/ssty-4-ref.html b/layout/reftests/mathml/ssty-4-ref.html
index 3e25b44acf49..7d4b5dc5d83b 100644
--- a/layout/reftests/mathml/ssty-4-ref.html
+++ b/layout/reftests/mathml/ssty-4-ref.html
@@ -139,7 +139,7 @@
   <p>
 
   <math>
-    <mstyle id="mstyle5" style ="font-family: 'sstyfont';  -moz-font-feature-settings: 'ssty' 0">
+    <mstyle id="mstyle5" style ="font-family: 'sstyfont';  font-feature-settings: 'ssty' 0">
       <mfrac>
         <mfrac>
           <mo>D</mo>
diff --git a/layout/reftests/mathml/ssty-4.html b/layout/reftests/mathml/ssty-4.html
index 4dce9a1caa84..5b2a662c0f6a 100644
--- a/layout/reftests/mathml/ssty-4.html
+++ b/layout/reftests/mathml/ssty-4.html
@@ -119,7 +119,7 @@
  <p>
 
   <math>
-    <mstyle id="mstyle4" style ="font-family: 'sstyfont'; -moz-font-feature-settings: 'ssty' 0">
+    <mstyle id="mstyle4" style ="font-family: 'sstyfont'; font-feature-settings: 'ssty' 0">
       <mfrac>
         <mfrac>
           <mo>A</mo>
@@ -176,7 +176,7 @@
           "style", "font-family: 'sstyfont';")
         // setting an explicit ssty font feature 
         document.getElementById("mstyle5").setAttribute(
-          "style" , "font-family: 'sstyfont'; -moz-font-feature-settings: 'ssty' 0")
+          "style" , "font-family: 'sstyfont'; font-feature-settings: 'ssty' 0")
 
         document.documentElement.removeAttribute("class");
       }
diff --git a/layout/reftests/text-transform/graphite-small-caps-1-ref.html b/layout/reftests/text-transform/graphite-small-caps-1-ref.html
index f479b5edc91e..0d553460af42 100644
--- a/layout/reftests/text-transform/graphite-small-caps-1-ref.html
+++ b/layout/reftests/text-transform/graphite-small-caps-1-ref.html
@@ -12,7 +12,6 @@ body {
   font: 100px test;
 }
 div {
-  -moz-font-feature-settings: 'smcp' on;
   font-feature-settings: 'smcp' on;
 }
 </style>
diff --git a/layout/reftests/text-transform/opentype-small-caps-1-ref.html b/layout/reftests/text-transform/opentype-small-caps-1-ref.html
index 466b4efecea4..ead0ecec888d 100644
--- a/layout/reftests/text-transform/opentype-small-caps-1-ref.html
+++ b/layout/reftests/text-transform/opentype-small-caps-1-ref.html
@@ -12,7 +12,6 @@ body {
   font: 100px test;
 }
 div {
-  -moz-font-feature-settings: 'smcp' on;
   font-feature-settings: 'smcp' on;
 }
 </style>
diff --git a/layout/reftests/text/auto-hyphenation-pl-1-ref.html b/layout/reftests/text/auto-hyphenation-pl-1-ref.html
index 69bc8f70993e..0c571f148180 100644
--- a/layout/reftests/text/auto-hyphenation-pl-1-ref.html
+++ b/layout/reftests/text/auto-hyphenation-pl-1-ref.html
@@ -6,7 +6,6 @@
 <style>
 body {
   font-family: "Times New Roman", serif; /* prefer TNR to Times (default) on OS X... */
-  -moz-font-feature-settings: 'kern' off; /* ...so that we can disable kerning */
   font-feature-settings: 'kern' off;
 }
 </style>
diff --git a/layout/reftests/text/auto-hyphenation-pl-1.html b/layout/reftests/text/auto-hyphenation-pl-1.html
index ca6219e2435f..9d371f82d6de 100644
--- a/layout/reftests/text/auto-hyphenation-pl-1.html
+++ b/layout/reftests/text/auto-hyphenation-pl-1.html
@@ -6,7 +6,6 @@
 <style>
 body {
   font-family: "Times New Roman", serif; /* prefer TNR to Times (default) on OS X... */
-  -moz-font-feature-settings: 'kern' off; /* ...so that we can disable kerning */
   font-feature-settings: 'kern' off;
 }
 </style>
diff --git a/layout/reftests/text/graphite-03b.html b/layout/reftests/text/graphite-03b.html
index d3f8f853e2d0..c584612e242c 100644
--- a/layout/reftests/text/graphite-03b.html
+++ b/layout/reftests/text/graphite-03b.html
@@ -10,7 +10,6 @@
 
 body {
   font: 34px padauk;
-  -moz-font-feature-settings: "kdot" on;
   font-feature-settings: "kdot" on;
     /* check that setting an optional graphite feature affects rendering:
      * this adds "dots" to the ends of a number of curved strokes
diff --git a/layout/reftests/text/graphite-05-feat.html b/layout/reftests/text/graphite-05-feat.html
index 83dc2d59b7df..f4082dde0815 100644
--- a/layout/reftests/text/graphite-05-feat.html
+++ b/layout/reftests/text/graphite-05-feat.html
@@ -10,7 +10,7 @@
 body {
   margin: 20px;
   font: 100px test;
-  -moz-font-feature-settings: "TST1", "FTP2";
+  font-feature-settings: "TST1", "FTP2";
 }
 p { margin: 0; padding: 0; }
 </style>
diff --git a/layout/reftests/text/graphite-05-lang.html b/layout/reftests/text/graphite-05-lang.html
index a02eb58a9652..c4a8cb0ddc7b 100644
--- a/layout/reftests/text/graphite-05-lang.html
+++ b/layout/reftests/text/graphite-05-lang.html
@@ -10,7 +10,7 @@
 body {
   margin: 20px;
   font: 100px test;
-  -moz-font-feature-settings: "TST1";
+  font-feature-settings: "TST1";
 }
 p { margin: 0; padding: 0; }
 </style>
diff --git a/layout/reftests/text/graphite-05-multipass.html b/layout/reftests/text/graphite-05-multipass.html
index 1667b2228e12..b3e2522cde7f 100644
--- a/layout/reftests/text/graphite-05-multipass.html
+++ b/layout/reftests/text/graphite-05-multipass.html
@@ -10,7 +10,7 @@
 body {
   margin: 20px;
   font: 100px test;
-  -moz-font-feature-settings: "TST1";
+  font-feature-settings: "TST1";
 }
 p { margin: 0; padding: 0; }
 </style>
diff --git a/layout/reftests/text/graphite-05-ot-only.html b/layout/reftests/text/graphite-05-ot-only.html
index d5f6d1879f3b..ae4d046cab2a 100644
--- a/layout/reftests/text/graphite-05-ot-only.html
+++ b/layout/reftests/text/graphite-05-ot-only.html
@@ -10,7 +10,7 @@
 body {
   margin: 20px;
   font: 100px test;
-  -moz-font-feature-settings: "TST1";
+  font-feature-settings: "TST1";
 }
 p { margin: 0; padding: 0; }
 </style>
diff --git a/layout/reftests/text/graphite-05-simple.html b/layout/reftests/text/graphite-05-simple.html
index 21a065c2c982..aa126ede851d 100644
--- a/layout/reftests/text/graphite-05-simple.html
+++ b/layout/reftests/text/graphite-05-simple.html
@@ -10,7 +10,7 @@
 body {
   margin: 20px;
   font: 100px test;
-  -moz-font-feature-settings: "TST1";
+  font-feature-settings: "TST1";
 }
 p { margin: 0; padding: 0; }
 </style>
diff --git a/layout/reftests/transform-3d/backface-visibility-3-ref.html b/layout/reftests/transform-3d/backface-visibility-3-ref.html
new file mode 100644
index 000000000000..b75cb6def5a5
--- /dev/null
+++ b/layout/reftests/transform-3d/backface-visibility-3-ref.html
@@ -0,0 +1,21 @@
+<!DOCTYPE html>
+<html>
+<head>
+  <style type='text/css'>
+    div {
+      position: absolute;
+      display: block;
+      width: 160px;
+      height: 160px;
+      background: red;
+      top:108px;
+      left:308px;
+    }
+  </style>
+</head>
+<body>
+    <div></div>
+</body>
+</html>
+
+
diff --git a/layout/reftests/transform-3d/backface-visibility-3.html b/layout/reftests/transform-3d/backface-visibility-3.html
new file mode 100644
index 000000000000..ec8d648de9c6
--- /dev/null
+++ b/layout/reftests/transform-3d/backface-visibility-3.html
@@ -0,0 +1,33 @@
+<!DOCTYPE html>
+<html>
+<head>
+  <style type='text/css'>
+    body {
+      overflow: hidden;
+    }
+    #test {
+      transform-origin: 0 0;
+      transform: scale(2) translateX(100px);
+      transform-style: preserve-3d;
+    }
+    #test div {
+      position: absolute;
+      display: block;
+      width: 80px;
+      height: 80px;
+      background: red;
+      top:50px;
+      left:50px;
+
+     backface-visibility: hidden;
+    }
+  </style>
+</head>
+<body>
+  <div id="test">
+    <div></div>
+  </div>
+</body>
+</html>
+
+
diff --git a/layout/reftests/transform-3d/reftest.list b/layout/reftests/transform-3d/reftest.list
index 72cb19505ad8..344d5fa1364c 100644
--- a/layout/reftests/transform-3d/reftest.list
+++ b/layout/reftests/transform-3d/reftest.list
@@ -36,6 +36,7 @@ fuzzy-if(winWidget,102,580) fuzzy-if(d2d,143,681) fuzzy-if(OSX==10.8,224,924) fu
 == backface-visibility-1b.html about:blank
 == backface-visibility-1c.html about:blank
 == backface-visibility-2.html backface-visibility-2-ref.html
+== backface-visibility-3.html backface-visibility-3-ref.html
 != perspective-origin-1a.html rotatex-perspective-1a.html
 random-if(Android&&AndroidVersion==17) == perspective-origin-1b.html perspective-origin-1a.html
 random-if(Android&&!browserIsRemote) == perspective-origin-2a.html perspective-origin-2-ref.html # bug 732568
diff --git a/layout/style/AnimationCommon.h b/layout/style/AnimationCommon.h
index fb56f95c1560..2c6f3c2e0911 100644
--- a/layout/style/AnimationCommon.h
+++ b/layout/style/AnimationCommon.h
@@ -38,7 +38,7 @@ bool IsGeometricProperty(nsCSSProperty aProperty);
 class CommonAnimationManager : public nsIStyleRuleProcessor,
                                public nsARefreshObserver {
 public:
-  CommonAnimationManager(nsPresContext *aPresContext);
+  explicit CommonAnimationManager(nsPresContext *aPresContext);
 
   // nsISupports
   NS_DECL_ISUPPORTS
diff --git a/layout/style/Declaration.cpp b/layout/style/Declaration.cpp
index 610c8ac660ef..3888862d185e 100644
--- a/layout/style/Declaration.cpp
+++ b/layout/style/Declaration.cpp
@@ -599,8 +599,6 @@ Declaration::GetValue(nsCSSProperty aProperty, nsAString& aValue,
         data->ValueFor(eCSSProperty__x_system_font);
       const nsCSSValue *style =
         data->ValueFor(eCSSProperty_font_style);
-      const nsCSSValue *variant =
-        data->ValueFor(eCSSProperty_font_variant);
       const nsCSSValue *weight =
         data->ValueFor(eCSSProperty_font_weight);
       const nsCSSValue *size =
@@ -634,17 +632,10 @@ Declaration::GetValue(nsCSSProperty aProperty, nsAString& aValue,
       const nsCSSValue *fontVariantPosition =
         data->ValueFor(eCSSProperty_font_variant_position);
 
-      // if font features are not enabled, pointers for fontVariant
-      // values above may be null since the shorthand check ignores them
-      // font-variant-alternates enabled ==> layout.css.font-features.enabled is true
-      bool fontFeaturesEnabled =
-        nsCSSProps::IsEnabled(eCSSProperty_font_variant_alternates);
-
       if (systemFont &&
           systemFont->GetUnit() != eCSSUnit_None &&
           systemFont->GetUnit() != eCSSUnit_Null) {
         if (style->GetUnit() != eCSSUnit_System_Font ||
-            variant->GetUnit() != eCSSUnit_System_Font ||
             weight->GetUnit() != eCSSUnit_System_Font ||
             size->GetUnit() != eCSSUnit_System_Font ||
             lh->GetUnit() != eCSSUnit_System_Font ||
@@ -653,15 +644,14 @@ Declaration::GetValue(nsCSSProperty aProperty, nsAString& aValue,
             sizeAdjust->GetUnit() != eCSSUnit_System_Font ||
             featureSettings->GetUnit() != eCSSUnit_System_Font ||
             languageOverride->GetUnit() != eCSSUnit_System_Font ||
-            (fontFeaturesEnabled &&
-             (fontKerning->GetUnit() != eCSSUnit_System_Font ||
-              fontSynthesis->GetUnit() != eCSSUnit_System_Font ||
-              fontVariantAlternates->GetUnit() != eCSSUnit_System_Font ||
-              fontVariantCaps->GetUnit() != eCSSUnit_System_Font ||
-              fontVariantEastAsian->GetUnit() != eCSSUnit_System_Font ||
-              fontVariantLigatures->GetUnit() != eCSSUnit_System_Font ||
-              fontVariantNumeric->GetUnit() != eCSSUnit_System_Font ||
-              fontVariantPosition->GetUnit() != eCSSUnit_System_Font))) {
+            fontKerning->GetUnit() != eCSSUnit_System_Font ||
+            fontSynthesis->GetUnit() != eCSSUnit_System_Font ||
+            fontVariantAlternates->GetUnit() != eCSSUnit_System_Font ||
+            fontVariantCaps->GetUnit() != eCSSUnit_System_Font ||
+            fontVariantEastAsian->GetUnit() != eCSSUnit_System_Font ||
+            fontVariantLigatures->GetUnit() != eCSSUnit_System_Font ||
+            fontVariantNumeric->GetUnit() != eCSSUnit_System_Font ||
+            fontVariantPosition->GetUnit() != eCSSUnit_System_Font) {
           // This can't be represented as a shorthand.
           return;
         }
@@ -675,17 +665,23 @@ Declaration::GetValue(nsCSSProperty aProperty, nsAString& aValue,
             sizeAdjust->GetUnit() != eCSSUnit_None ||
             featureSettings->GetUnit() != eCSSUnit_Normal ||
             languageOverride->GetUnit() != eCSSUnit_Normal ||
-            (fontFeaturesEnabled &&
-             (fontKerning->GetIntValue() != NS_FONT_KERNING_AUTO ||
-              fontSynthesis->GetUnit() != eCSSUnit_Enumerated ||
-              fontSynthesis->GetIntValue() !=
-                (NS_FONT_SYNTHESIS_WEIGHT | NS_FONT_SYNTHESIS_STYLE) ||
-              fontVariantAlternates->GetUnit() != eCSSUnit_Normal ||
-              fontVariantCaps->GetUnit() != eCSSUnit_Normal ||
-              fontVariantEastAsian->GetUnit() != eCSSUnit_Normal ||
-              fontVariantLigatures->GetUnit() != eCSSUnit_Normal ||
-              fontVariantNumeric->GetUnit() != eCSSUnit_Normal ||
-              fontVariantPosition->GetUnit() != eCSSUnit_Normal))) {
+            fontKerning->GetIntValue() != NS_FONT_KERNING_AUTO ||
+            fontSynthesis->GetUnit() != eCSSUnit_Enumerated ||
+            fontSynthesis->GetIntValue() !=
+              (NS_FONT_SYNTHESIS_WEIGHT | NS_FONT_SYNTHESIS_STYLE) ||
+            fontVariantAlternates->GetUnit() != eCSSUnit_Normal ||
+            fontVariantEastAsian->GetUnit() != eCSSUnit_Normal ||
+            fontVariantLigatures->GetUnit() != eCSSUnit_Normal ||
+            fontVariantNumeric->GetUnit() != eCSSUnit_Normal ||
+            fontVariantPosition->GetUnit() != eCSSUnit_Normal) {
+          return;
+        }
+
+        // only a normal or small-caps values of font-variant-caps can
+        // be represented in the font shorthand
+        if (fontVariantCaps->GetUnit() != eCSSUnit_Normal &&
+            (fontVariantCaps->GetUnit() != eCSSUnit_Enumerated ||
+             fontVariantCaps->GetIntValue() != NS_FONT_VARIANT_CAPS_SMALLCAPS)) {
           return;
         }
 
@@ -695,9 +691,8 @@ Declaration::GetValue(nsCSSProperty aProperty, nsAString& aValue,
                                 aSerialization);
           aValue.Append(char16_t(' '));
         }
-        if (variant->GetUnit() != eCSSUnit_Enumerated ||
-            variant->GetIntValue() != NS_FONT_VARIANT_NORMAL) {
-          variant->AppendToString(eCSSProperty_font_variant, aValue,
+        if (fontVariantCaps->GetUnit() != eCSSUnit_Normal) {
+          fontVariantCaps->AppendToString(eCSSProperty_font_variant_caps, aValue,
                                   aSerialization);
           aValue.Append(char16_t(' '));
         }
@@ -718,6 +713,60 @@ Declaration::GetValue(nsCSSProperty aProperty, nsAString& aValue,
       }
       break;
     }
+    case eCSSProperty_font_variant: {
+      const nsCSSProperty *subprops =
+        nsCSSProps::SubpropertyEntryFor(aProperty);
+      const nsCSSValue *fontVariantLigatures =
+        data->ValueFor(eCSSProperty_font_variant_ligatures);
+
+      // all subproperty values normal? system font?
+      bool normalLigs = true, normalNonLigs = true, systemFont = true,
+           hasSystem = false;
+      for (const nsCSSProperty *sp = subprops; *sp != eCSSProperty_UNKNOWN; sp++) {
+        const nsCSSValue *spVal = data->ValueFor(*sp);
+        bool isNormal = (spVal->GetUnit() == eCSSUnit_Normal);
+        if (*sp == eCSSProperty_font_variant_ligatures) {
+          normalLigs = normalLigs && isNormal;
+        } else {
+          normalNonLigs = normalNonLigs && isNormal;
+        }
+        bool isSystem = (spVal->GetUnit() == eCSSUnit_System_Font);
+        systemFont = systemFont && isSystem;
+        hasSystem = hasSystem || isSystem;
+      }
+
+      bool ligsNone =
+        fontVariantLigatures->GetUnit() == eCSSUnit_None;
+
+      // normal, none, or system font ==> single value
+      if ((normalLigs && normalNonLigs) ||
+          (normalNonLigs && ligsNone) ||
+          systemFont) {
+        fontVariantLigatures->AppendToString(eCSSProperty_font_variant_ligatures,
+                                             aValue,
+                                             aSerialization);
+      } else if (ligsNone || hasSystem) {
+        // ligatures none but other values are non-normal ==> empty
+        // at least one but not all values are system font ==> empty
+        return;
+      } else {
+        // iterate over and append non-normal values
+        bool appendSpace = false;
+        for (const nsCSSProperty *sp = subprops;
+             *sp != eCSSProperty_UNKNOWN; sp++) {
+          const nsCSSValue *spVal = data->ValueFor(*sp);
+          if (spVal && spVal->GetUnit() != eCSSUnit_Normal) {
+            if (appendSpace) {
+              aValue.Append(char16_t(' '));
+            } else {
+              appendSpace = true;
+            }
+            spVal->AppendToString(*sp, aValue, aSerialization);
+          }
+        }
+      }
+      break;
+    }
     case eCSSProperty_list_style:
       if (AppendValueToString(eCSSProperty_list_style_position, aValue,
                               aSerialization)) {
@@ -1294,9 +1343,17 @@ Declaration::ToString(nsAString& aString) const
       // least, which is exactly the order we want to test them.
       nsCSSProperty shorthand = *shorthands;
 
+      GetValue(shorthand, value);
+
+      // in the system font case, skip over font-variant shorthand, since all
+      // subproperties are already dealt with via the font shorthand
+      if (shorthand == eCSSProperty_font_variant &&
+          value.EqualsLiteral("-moz-use-system-font")) {
+        continue;
+      }
+
       // If GetValue gives us a non-empty string back, we can use that
       // value; otherwise it's not possible to use this shorthand.
-      GetValue(shorthand, value);
       if (!value.IsEmpty()) {
         AppendPropertyAndValueToString(shorthand, value, aString);
         shorthandsUsed.AppendElement(shorthand);
@@ -1304,9 +1361,6 @@ Declaration::ToString(nsAString& aString) const
         break;
       }
 
-      NS_ABORT_IF_FALSE(shorthand != eCSSProperty_font ||
-                        *(shorthands + 1) == eCSSProperty_UNKNOWN,
-                        "font should always be the only containing shorthand");
       if (shorthand == eCSSProperty_font) {
         if (haveSystemFont && !didSystemFont) {
           // Output the shorthand font declaration that we will
@@ -1329,6 +1383,7 @@ Declaration::ToString(nsAString& aString) const
         if (property == eCSSProperty__x_system_font ||
             (haveSystemFont && val && val->GetUnit() == eCSSUnit_System_Font)) {
           doneProperty = true;
+          break;
         }
       }
     }
diff --git a/layout/style/StyleRule.h b/layout/style/StyleRule.h
index 9b84f22a7630..4a74ffd76c6c 100644
--- a/layout/style/StyleRule.h
+++ b/layout/style/StyleRule.h
@@ -30,8 +30,8 @@ class CSSStyleSheet;
 
 struct nsAtomList {
 public:
-  nsAtomList(nsIAtom* aAtom);
-  nsAtomList(const nsString& aAtomValue);
+  explicit nsAtomList(nsIAtom* aAtom);
+  explicit nsAtomList(const nsString& aAtomValue);
   ~nsAtomList(void);
 
   /** Do a deep clone.  Should be used only on the first in the linked list. */
@@ -50,7 +50,7 @@ private:
 
 struct nsPseudoClassList {
 public:
-  nsPseudoClassList(nsCSSPseudoClasses::Type aType);
+  explicit nsPseudoClassList(nsCSSPseudoClasses::Type aType);
   nsPseudoClassList(nsCSSPseudoClasses::Type aType, const char16_t *aString);
   nsPseudoClassList(nsCSSPseudoClasses::Type aType, const int32_t *aIntPair);
   nsPseudoClassList(nsCSSPseudoClasses::Type aType,
@@ -284,7 +284,7 @@ class StyleRule;
 
 class ImportantRule : public nsIStyleRule {
 public:
-  ImportantRule(Declaration *aDeclaration);
+  explicit ImportantRule(Declaration *aDeclaration);
 
   NS_DECL_ISUPPORTS
 
diff --git a/layout/style/nsAnimationManager.h b/layout/style/nsAnimationManager.h
index 791305232eae..5244436c9d87 100644
--- a/layout/style/nsAnimationManager.h
+++ b/layout/style/nsAnimationManager.h
@@ -52,7 +52,7 @@ class nsAnimationManager MOZ_FINAL
   : public mozilla::css::CommonAnimationManager
 {
 public:
-  nsAnimationManager(nsPresContext *aPresContext)
+  explicit nsAnimationManager(nsPresContext *aPresContext)
     : mozilla::css::CommonAnimationManager(aPresContext)
     , mObservingRefreshDriver(false)
   {
diff --git a/layout/style/nsCSSFontDescList.h b/layout/style/nsCSSFontDescList.h
index cbbaeab630ba..f4255fc61df5 100644
--- a/layout/style/nsCSSFontDescList.h
+++ b/layout/style/nsCSSFontDescList.h
@@ -9,8 +9,5 @@ CSS_FONT_DESC(font-weight, Weight)
 CSS_FONT_DESC(font-stretch, Stretch)
 CSS_FONT_DESC(src, Src)
 CSS_FONT_DESC(unicode-range, UnicodeRange)
-
-/* Note: the parsing code explicitly also accepts font-feature-settings
-         and font-language-override. */
-CSS_FONT_DESC(-moz-font-feature-settings, FontFeatureSettings)
-CSS_FONT_DESC(-moz-font-language-override, FontLanguageOverride)
+CSS_FONT_DESC(font-feature-settings, FontFeatureSettings)
+CSS_FONT_DESC(font-language-override, FontLanguageOverride)
diff --git a/layout/style/nsCSSParser.cpp b/layout/style/nsCSSParser.cpp
index 50cbe9e9ac55..645cd9a6ea67 100644
--- a/layout/style/nsCSSParser.cpp
+++ b/layout/style/nsCSSParser.cpp
@@ -757,12 +757,15 @@ protected:
   bool ParseFontSynthesis(nsCSSValue& aValue);
   bool ParseSingleAlternate(int32_t& aWhichFeature, nsCSSValue& aValue);
   bool ParseFontVariantAlternates(nsCSSValue& aValue);
+  bool MergeBitmaskValue(int32_t aNewValue, const int32_t aMasks[],
+                         int32_t& aMergedValue);
   bool ParseBitmaskValues(nsCSSValue& aValue,
                           const KTableValue aKeywordTable[],
                           const int32_t aMasks[]);
   bool ParseFontVariantEastAsian(nsCSSValue& aValue);
   bool ParseFontVariantLigatures(nsCSSValue& aValue);
   bool ParseFontVariantNumeric(nsCSSValue& aValue);
+  bool ParseFontVariant();
   bool ParseFontWeight(nsCSSValue& aValue);
   bool ParseOneFamily(nsAString& aFamily, bool& aOneKeyword, bool& aQuoted);
   bool ParseFamily(nsCSSValue& aValue);
@@ -2752,8 +2755,7 @@ CSSParserImpl::ParseAtRule(RuleAppendFunc aAppendFunc,
     parseFunc = &CSSParserImpl::ParseFontFaceRule;
     newSection = eCSSSection_General;
 
-  } else if (mToken.mIdent.LowerCaseEqualsLiteral("font-feature-values") &&
-             nsCSSFontFeatureValuesRule::PrefEnabled()) {
+  } else if (mToken.mIdent.LowerCaseEqualsLiteral("font-feature-values")) {
     parseFunc = &CSSParserImpl::ParseFontFeatureValuesRule;
     newSection = eCSSSection_General;
 
@@ -9738,6 +9740,8 @@ CSSParserImpl::ParsePropertyByFunction(nsCSSProperty aPropID)
     return ParseFlexFlow();
   case eCSSProperty_font:
     return ParseFont();
+  case eCSSProperty_font_variant:
+    return ParseFontVariant();
   case eCSSProperty_grid_auto_flow:
     return ParseGridAutoFlow();
   case eCSSProperty_grid_auto_columns:
@@ -11727,13 +11731,10 @@ CSSParserImpl::ParseFont()
 {
   static const nsCSSProperty fontIDs[] = {
     eCSSProperty_font_style,
-    eCSSProperty_font_variant,
+    eCSSProperty_font_variant_caps,
     eCSSProperty_font_weight
   };
 
-  // font-variant-alternates enabled ==> layout.css.font-features.enabled is true
-  bool featuresEnabled =
-    nsCSSProps::IsEnabled(eCSSProperty_font_variant_alternates);
   nsCSSValue  family;
   if (ParseVariant(family, VARIANT_HK, nsCSSProps::kFontKTable)) {
     if (eCSSUnit_Inherit == family.GetUnit() ||
@@ -11742,7 +11743,6 @@ CSSParserImpl::ParseFont()
       AppendValue(eCSSProperty__x_system_font, nsCSSValue(eCSSUnit_None));
       AppendValue(eCSSProperty_font_family, family);
       AppendValue(eCSSProperty_font_style, family);
-      AppendValue(eCSSProperty_font_variant, family);
       AppendValue(eCSSProperty_font_weight, family);
       AppendValue(eCSSProperty_font_size, family);
       AppendValue(eCSSProperty_line_height, family);
@@ -11750,23 +11750,20 @@ CSSParserImpl::ParseFont()
       AppendValue(eCSSProperty_font_size_adjust, family);
       AppendValue(eCSSProperty_font_feature_settings, family);
       AppendValue(eCSSProperty_font_language_override, family);
-      if (featuresEnabled) {
-        AppendValue(eCSSProperty_font_kerning, family);
-        AppendValue(eCSSProperty_font_synthesis, family);
-        AppendValue(eCSSProperty_font_variant_alternates, family);
-        AppendValue(eCSSProperty_font_variant_caps, family);
-        AppendValue(eCSSProperty_font_variant_east_asian, family);
-        AppendValue(eCSSProperty_font_variant_ligatures, family);
-        AppendValue(eCSSProperty_font_variant_numeric, family);
-        AppendValue(eCSSProperty_font_variant_position, family);
-      }
+      AppendValue(eCSSProperty_font_kerning, family);
+      AppendValue(eCSSProperty_font_synthesis, family);
+      AppendValue(eCSSProperty_font_variant_alternates, family);
+      AppendValue(eCSSProperty_font_variant_caps, family);
+      AppendValue(eCSSProperty_font_variant_east_asian, family);
+      AppendValue(eCSSProperty_font_variant_ligatures, family);
+      AppendValue(eCSSProperty_font_variant_numeric, family);
+      AppendValue(eCSSProperty_font_variant_position, family);
     }
     else {
       AppendValue(eCSSProperty__x_system_font, family);
       nsCSSValue systemFont(eCSSUnit_System_Font);
       AppendValue(eCSSProperty_font_family, systemFont);
       AppendValue(eCSSProperty_font_style, systemFont);
-      AppendValue(eCSSProperty_font_variant, systemFont);
       AppendValue(eCSSProperty_font_weight, systemFont);
       AppendValue(eCSSProperty_font_size, systemFont);
       AppendValue(eCSSProperty_line_height, systemFont);
@@ -11774,16 +11771,14 @@ CSSParserImpl::ParseFont()
       AppendValue(eCSSProperty_font_size_adjust, systemFont);
       AppendValue(eCSSProperty_font_feature_settings, systemFont);
       AppendValue(eCSSProperty_font_language_override, systemFont);
-      if (featuresEnabled) {
-        AppendValue(eCSSProperty_font_kerning, systemFont);
-        AppendValue(eCSSProperty_font_synthesis, systemFont);
-        AppendValue(eCSSProperty_font_variant_alternates, systemFont);
-        AppendValue(eCSSProperty_font_variant_caps, systemFont);
-        AppendValue(eCSSProperty_font_variant_east_asian, systemFont);
-        AppendValue(eCSSProperty_font_variant_ligatures, systemFont);
-        AppendValue(eCSSProperty_font_variant_numeric, systemFont);
-        AppendValue(eCSSProperty_font_variant_position, systemFont);
-      }
+      AppendValue(eCSSProperty_font_kerning, systemFont);
+      AppendValue(eCSSProperty_font_synthesis, systemFont);
+      AppendValue(eCSSProperty_font_variant_alternates, systemFont);
+      AppendValue(eCSSProperty_font_variant_caps, systemFont);
+      AppendValue(eCSSProperty_font_variant_east_asian, systemFont);
+      AppendValue(eCSSProperty_font_variant_ligatures, systemFont);
+      AppendValue(eCSSProperty_font_variant_numeric, systemFont);
+      AppendValue(eCSSProperty_font_variant_position, systemFont);
     }
     return true;
   }
@@ -11804,7 +11799,15 @@ CSSParserImpl::ParseFont()
   }
   if ((found & 2) == 0) {
     // Provide default font-variant
-    values[1].SetIntValue(NS_FONT_VARIANT_NORMAL, eCSSUnit_Enumerated);
+    values[1].SetNormalValue();
+  } else {
+    if (values[1].GetUnit() == eCSSUnit_Enumerated &&
+        !values[1].GetIntValue() == NS_FONT_VARIANT_CAPS_SMALLCAPS) {
+      // only normal or small-caps is allowed in font shorthand
+      // this also assumes other values for font-variant-caps never overlap
+      // possible values for style or weight
+      return false;
+    }
   }
   if ((found & 4) == 0) {
     // Provide default font-weight
@@ -11840,7 +11843,7 @@ CSSParserImpl::ParseFont()
       AppendValue(eCSSProperty__x_system_font, nsCSSValue(eCSSUnit_None));
       AppendValue(eCSSProperty_font_family, family);
       AppendValue(eCSSProperty_font_style, values[0]);
-      AppendValue(eCSSProperty_font_variant, values[1]);
+      AppendValue(eCSSProperty_font_variant_caps, values[1]);
       AppendValue(eCSSProperty_font_weight, values[2]);
       AppendValue(eCSSProperty_font_size, size);
       AppendValue(eCSSProperty_line_height, lineHeight);
@@ -11849,24 +11852,21 @@ CSSParserImpl::ParseFont()
       AppendValue(eCSSProperty_font_size_adjust, nsCSSValue(eCSSUnit_None));
       AppendValue(eCSSProperty_font_feature_settings, nsCSSValue(eCSSUnit_Normal));
       AppendValue(eCSSProperty_font_language_override, nsCSSValue(eCSSUnit_Normal));
-      if (featuresEnabled) {
-        AppendValue(eCSSProperty_font_kerning,
-                    nsCSSValue(NS_FONT_KERNING_AUTO, eCSSUnit_Enumerated));
-        AppendValue(eCSSProperty_font_synthesis,
-                    nsCSSValue(NS_FONT_SYNTHESIS_WEIGHT | NS_FONT_SYNTHESIS_STYLE,
-                               eCSSUnit_Enumerated));
-        AppendValue(eCSSProperty_font_variant_alternates,
-                    nsCSSValue(eCSSUnit_Normal));
-        AppendValue(eCSSProperty_font_variant_caps, nsCSSValue(eCSSUnit_Normal));
-        AppendValue(eCSSProperty_font_variant_east_asian,
-                    nsCSSValue(eCSSUnit_Normal));
-        AppendValue(eCSSProperty_font_variant_ligatures,
-                    nsCSSValue(eCSSUnit_Normal));
-        AppendValue(eCSSProperty_font_variant_numeric,
-                    nsCSSValue(eCSSUnit_Normal));
-        AppendValue(eCSSProperty_font_variant_position,
-                    nsCSSValue(eCSSUnit_Normal));
-      }
+      AppendValue(eCSSProperty_font_kerning,
+                  nsCSSValue(NS_FONT_KERNING_AUTO, eCSSUnit_Enumerated));
+      AppendValue(eCSSProperty_font_synthesis,
+                  nsCSSValue(NS_FONT_SYNTHESIS_WEIGHT | NS_FONT_SYNTHESIS_STYLE,
+                             eCSSUnit_Enumerated));
+      AppendValue(eCSSProperty_font_variant_alternates,
+                  nsCSSValue(eCSSUnit_Normal));
+      AppendValue(eCSSProperty_font_variant_east_asian,
+                  nsCSSValue(eCSSUnit_Normal));
+      AppendValue(eCSSProperty_font_variant_ligatures,
+                  nsCSSValue(eCSSUnit_Normal));
+      AppendValue(eCSSProperty_font_variant_numeric,
+                  nsCSSValue(eCSSUnit_Normal));
+      AppendValue(eCSSProperty_font_variant_position,
+                  nsCSSValue(eCSSUnit_Normal));
       return true;
     }
   }
@@ -11910,7 +11910,7 @@ CSSParserImpl::ParseFontSynthesis(nsCSSValue& aValue)
 // parameter lists with one or more idents which are later resolved
 // based on values defined in @font-feature-value rules.
 //
-// font-variant-alternates: swash(flowing), historical-forms, styleset(alt-g, alt-m);
+// font-variant-alternates: swash(flowing) historical-forms styleset(alt-g, alt-m);
 //
 // So for this the nsCSSValue is set to a pair value, with one
 // value for a bitmask of both simple and functional property values
@@ -11932,6 +11932,17 @@ CSSParserImpl::ParseFontSynthesis(nsCSSValue& aValue)
 
 #define MAX_ALLOWED_FEATURES 512
 
+static uint16_t
+MaxElementsForAlternateType(nsCSSKeyword keyword)
+{
+  uint16_t maxElems = 1;
+  if (keyword == eCSSKeyword_styleset ||
+      keyword == eCSSKeyword_character_variant) {
+    maxElems = MAX_ALLOWED_FEATURES;
+  }
+  return maxElems;
+}
+
 bool
 CSSParserImpl::ParseSingleAlternate(int32_t& aWhichFeature,
                                     nsCSSValue& aValue)
@@ -11967,13 +11978,8 @@ CSSParserImpl::ParseSingleAlternate(int32_t& aWhichFeature,
     return true;
   }
 
-  uint16_t maxElems = 1;
-  if (keyword == eCSSKeyword_styleset ||
-      keyword == eCSSKeyword_character_variant) {
-    maxElems = MAX_ALLOWED_FEATURES;
-  }
   return ParseFunction(keyword, nullptr, VARIANT_IDENTIFIER,
-                       1, maxElems, aValue);
+                       1, MaxElementsForAlternateType(keyword), aValue);
 }
 
 bool
@@ -12026,6 +12032,35 @@ CSSParserImpl::ParseFontVariantAlternates(nsCSSValue& aValue)
   return true;
 }
 
+bool
+CSSParserImpl::MergeBitmaskValue(int32_t aNewValue,
+                                 const int32_t aMasks[],
+                                 int32_t& aMergedValue)
+{
+  // check to make sure value not already set
+  if (aNewValue & aMergedValue) {
+    return false;
+  }
+
+  const int32_t *m = aMasks;
+  int32_t c = 0;
+
+  while (*m != MASK_END_VALUE) {
+    if (*m & aNewValue) {
+      c = aMergedValue & *m;
+      break;
+    }
+    m++;
+  }
+
+  if (c) {
+    return false;
+  }
+
+  aMergedValue |= aNewValue;
+  return true;
+}
+
 // aMasks - array of masks for mutually-exclusive property values,
 //          e.g. proportial-nums, tabular-nums
 
@@ -12045,29 +12080,9 @@ CSSParserImpl::ParseBitmaskValues(nsCSSValue& aValue,
 
   while (ParseEnum(nextValue, aKeywordTable))
   {
-    int32_t nextIntValue = nextValue.GetIntValue();
-
-    // check to make sure value not already set
-    if (nextIntValue & mergedValue) {
+    if (!MergeBitmaskValue(nextValue.GetIntValue(), aMasks, mergedValue)) {
       return false;
     }
-
-    const int32_t *m = aMasks;
-    int32_t c = 0;
-
-    while (*m != MASK_END_VALUE) {
-      if (*m & nextIntValue) {
-        c = mergedValue & *m;
-        break;
-      }
-      m++;
-    }
-
-    if (c) {
-      return false;
-    }
-
-    mergedValue |= nextIntValue;
   }
 
   aValue.SetIntValue(mergedValue, eCSSUnit_Enumerated);
@@ -12107,7 +12122,9 @@ static const int32_t maskLigatures[] = {
 bool
 CSSParserImpl::ParseFontVariantLigatures(nsCSSValue& aValue)
 {
-  if (ParseVariant(aValue, VARIANT_INHERIT | VARIANT_NORMAL, nullptr)) {
+  if (ParseVariant(aValue,
+                   VARIANT_INHERIT | VARIANT_NORMAL | VARIANT_NONE,
+                   nullptr)) {
     return true;
   }
 
@@ -12115,20 +12132,8 @@ CSSParserImpl::ParseFontVariantLigatures(nsCSSValue& aValue)
                  MASK_END_VALUE,
                "incorrectly terminated array");
 
-  bool parsed =
-    ParseBitmaskValues(aValue, nsCSSProps::kFontVariantLigaturesKTable,
-                       maskLigatures);
-
-  // if none value included, no other values are possible
-  if (parsed && eCSSUnit_Enumerated == aValue.GetUnit()) {
-    int32_t val = aValue.GetIntValue();
-    if ((val & NS_FONT_VARIANT_LIGATURES_NONE) &&
-        (val & ~int32_t(NS_FONT_VARIANT_LIGATURES_NONE))) {
-      parsed = false;
-    }
-  }
-
-  return parsed;
+  return ParseBitmaskValues(aValue, nsCSSProps::kFontVariantLigaturesKTable,
+                            maskLigatures);
 }
 
 static const int32_t maskNumeric[] = {
@@ -12153,6 +12158,194 @@ CSSParserImpl::ParseFontVariantNumeric(nsCSSValue& aValue)
                             maskNumeric);
 }
 
+bool
+CSSParserImpl::ParseFontVariant()
+{
+  // parse single values - normal/inherit/none
+  nsCSSValue value;
+  nsCSSValue normal(eCSSUnit_Normal);
+
+  if (ParseVariant(value,
+                   VARIANT_INHERIT | VARIANT_NORMAL | VARIANT_NONE,
+                   nullptr)) {
+    AppendValue(eCSSProperty_font_variant_ligatures, value);
+    if (eCSSUnit_None == value.GetUnit()) {
+      // 'none' applies the value 'normal' to all properties other
+      // than 'font-variant-ligatures'
+      value.SetNormalValue();
+    }
+    AppendValue(eCSSProperty_font_variant_alternates, value);
+    AppendValue(eCSSProperty_font_variant_caps, value);
+    AppendValue(eCSSProperty_font_variant_east_asian, value);
+    AppendValue(eCSSProperty_font_variant_numeric, value);
+    AppendValue(eCSSProperty_font_variant_position, value);
+    return true;
+  }
+
+  // set each of the individual subproperties
+  int32_t altFeatures = 0, capsFeatures = 0, eastAsianFeatures = 0,
+          ligFeatures = 0, numericFeatures = 0, posFeatures = 0;
+  nsCSSValue altListValue;
+  nsCSSValueList* altList = nullptr;
+
+  // if no functional values, this may be a list with a single, unused element
+  altListValue.SetListValue();
+
+  bool foundValid = false; // found at least one proper value
+  while (GetToken(true)) {
+    // only an ident or a function at this point
+    bool isFunction = (mToken.mType == eCSSToken_Function);
+    if (mToken.mType != eCSSToken_Ident && !isFunction) {
+      UngetToken();
+      break;
+    }
+
+    nsCSSKeyword keyword = nsCSSKeywords::LookupKeyword(mToken.mIdent);
+    if (keyword == eCSSKeyword_UNKNOWN) {
+      UngetToken();
+      return false;
+    }
+
+    int32_t feature;
+
+    // function? ==> font-variant-alternates
+    if (isFunction) {
+      if (!nsCSSProps::FindKeyword(keyword,
+                                   nsCSSProps::kFontVariantAlternatesFuncsKTable,
+                                   feature) ||
+          (feature & altFeatures)) {
+        UngetToken();
+        return false;
+      }
+
+      altFeatures |= feature;
+      nsCSSValue funcValue;
+      if (!ParseFunction(keyword, nullptr, VARIANT_IDENTIFIER, 1,
+                         MaxElementsForAlternateType(keyword), funcValue) ||
+          funcValue.GetUnit() != eCSSUnit_Function) {
+        UngetToken();
+        return false;
+      }
+
+      if (!altList) {
+        altList = altListValue.GetListValue();
+      } else {
+        altList->mNext = new nsCSSValueList;
+        altList = altList->mNext;
+      }
+      altList->mValue = funcValue;
+    } else if (nsCSSProps::FindKeyword(keyword,
+                                       nsCSSProps::kFontVariantCapsKTable,
+                                       feature)) {
+      if (capsFeatures != 0) {
+        // multiple values for font-variant-caps
+        UngetToken();
+        return false;
+      }
+      capsFeatures = feature;
+    } else if (nsCSSProps::FindKeyword(keyword,
+                                       nsCSSProps::kFontVariantAlternatesKTable,
+                                       feature)) {
+      if (feature & altFeatures) {
+        // same value repeated
+        UngetToken();
+        return false;
+      }
+      altFeatures |= feature;
+    } else if (nsCSSProps::FindKeyword(keyword,
+                                       nsCSSProps::kFontVariantEastAsianKTable,
+                                       feature)) {
+      if (!MergeBitmaskValue(feature, maskEastAsian, eastAsianFeatures)) {
+        // multiple mutually exclusive values
+        UngetToken();
+        return false;
+      }
+    } else if (nsCSSProps::FindKeyword(keyword,
+                                       nsCSSProps::kFontVariantLigaturesKTable,
+                                       feature)) {
+      if (keyword == eCSSKeyword_none ||
+          !MergeBitmaskValue(feature, maskLigatures, ligFeatures)) {
+        // none or multiple mutually exclusive values
+        UngetToken();
+        return false;
+      }
+    } else if (nsCSSProps::FindKeyword(keyword,
+                                       nsCSSProps::kFontVariantNumericKTable,
+                                       feature)) {
+      if (!MergeBitmaskValue(feature, maskNumeric, numericFeatures)) {
+        // multiple mutually exclusive values
+        UngetToken();
+        return false;
+      }
+    } else if (nsCSSProps::FindKeyword(keyword,
+                                       nsCSSProps::kFontVariantPositionKTable,
+                                       feature)) {
+      if (posFeatures != 0) {
+        // multiple values for font-variant-caps
+        UngetToken();
+        return false;
+      }
+      posFeatures = feature;
+    } else {
+      // bogus keyword, bail...
+      UngetToken();
+      return false;
+    }
+
+    foundValid = true;
+  }
+
+  if (!foundValid) {
+    return false;
+  }
+
+  if (altFeatures) {
+    nsCSSValue featureValue;
+    featureValue.SetIntValue(altFeatures, eCSSUnit_Enumerated);
+    value.SetPairValue(featureValue, altListValue);
+    AppendValue(eCSSProperty_font_variant_alternates, value);
+  } else {
+    AppendValue(eCSSProperty_font_variant_alternates, normal);
+  }
+
+  if (capsFeatures) {
+    value.SetIntValue(capsFeatures, eCSSUnit_Enumerated);
+    AppendValue(eCSSProperty_font_variant_caps, value);
+  } else {
+    AppendValue(eCSSProperty_font_variant_caps, normal);
+  }
+
+  if (eastAsianFeatures) {
+    value.SetIntValue(eastAsianFeatures, eCSSUnit_Enumerated);
+    AppendValue(eCSSProperty_font_variant_east_asian, value);
+  } else {
+    AppendValue(eCSSProperty_font_variant_east_asian, normal);
+  }
+
+  if (ligFeatures) {
+    value.SetIntValue(ligFeatures, eCSSUnit_Enumerated);
+    AppendValue(eCSSProperty_font_variant_ligatures, value);
+  } else {
+    AppendValue(eCSSProperty_font_variant_ligatures, normal);
+  }
+
+  if (numericFeatures) {
+    value.SetIntValue(numericFeatures, eCSSUnit_Enumerated);
+    AppendValue(eCSSProperty_font_variant_numeric, value);
+  } else {
+    AppendValue(eCSSProperty_font_variant_numeric, normal);
+  }
+
+  if (posFeatures) {
+    value.SetIntValue(posFeatures, eCSSUnit_Enumerated);
+    AppendValue(eCSSProperty_font_variant_position, value);
+  } else {
+    AppendValue(eCSSProperty_font_variant_position, normal);
+  }
+
+  return true;
+}
+
 bool
 CSSParserImpl::ParseFontWeight(nsCSSValue& aValue)
 {
diff --git a/layout/style/nsCSSPropAliasList.h b/layout/style/nsCSSPropAliasList.h
index 6c37268f1bc3..4bc9625d6a5a 100644
--- a/layout/style/nsCSSPropAliasList.h
+++ b/layout/style/nsCSSPropAliasList.h
@@ -119,11 +119,11 @@ CSS_PROP_ALIAS(-moz-box-sizing,
                box_sizing,
                MozBoxSizing,
                "layout.css.prefixes.box-sizing")
-CSS_PROP_ALIAS(font-feature-settings,
+CSS_PROP_ALIAS(-moz-font-feature-settings,
                font_feature_settings,
-               FontFeatureSettings,
-               "layout.css.font-features.enabled")
-CSS_PROP_ALIAS(font-language-override,
+               MozFontFeatureSettings,
+               "layout.css.prefixes.font-features")
+CSS_PROP_ALIAS(-moz-font-language-override,
                font_language_override,
-               FontLanguageOverride,
-               "layout.css.font-features.enabled")
+               MozFontLanguageOverride,
+               "layout.css.prefixes.font-features")
diff --git a/layout/style/nsCSSPropList.h b/layout/style/nsCSSPropList.h
index 54786eeb8fd3..e2eb0b69facc 100644
--- a/layout/style/nsCSSPropList.h
+++ b/layout/style/nsCSSPropList.h
@@ -1775,9 +1775,9 @@ CSS_PROP_FONT(
     CSS_PROP_NO_OFFSET,
     eStyleAnimType_None)
 CSS_PROP_FONT(
-    -moz-font-feature-settings,
+    font-feature-settings,
     font_feature_settings,
-    CSS_PROP_DOMPROP_PREFIXED(FontFeatureSettings),
+    FontFeatureSettings,
     CSS_PROPERTY_PARSE_VALUE |
         CSS_PROPERTY_VALUE_PARSER_FUNCTION |
         CSS_PROPERTY_APPLIES_TO_FIRST_LETTER_AND_FIRST_LINE |
@@ -1794,15 +1794,15 @@ CSS_PROP_FONT(
     CSS_PROPERTY_PARSE_VALUE |
         CSS_PROPERTY_APPLIES_TO_FIRST_LETTER_AND_FIRST_LINE |
         CSS_PROPERTY_APPLIES_TO_PLACEHOLDER,
-    "layout.css.font-features.enabled",
+    "",
     VARIANT_HK,
     kFontKerningKTable,
     CSS_PROP_NO_OFFSET,
     eStyleAnimType_None)
 CSS_PROP_FONT(
-    -moz-font-language-override,
+    font-language-override,
     font_language_override,
-    CSS_PROP_DOMPROP_PREFIXED(FontLanguageOverride),
+    FontLanguageOverride,
     CSS_PROPERTY_PARSE_VALUE |
         CSS_PROPERTY_APPLIES_TO_FIRST_LETTER_AND_FIRST_LINE |
         CSS_PROPERTY_APPLIES_TO_PLACEHOLDER,
@@ -1884,23 +1884,17 @@ CSS_PROP_FONT(
         CSS_PROPERTY_VALUE_PARSER_FUNCTION |
         CSS_PROPERTY_APPLIES_TO_FIRST_LETTER_AND_FIRST_LINE |
         CSS_PROPERTY_APPLIES_TO_PLACEHOLDER,
-    "layout.css.font-features.enabled",
+    "",
     0,
     kFontSynthesisKTable,
     CSS_PROP_NO_OFFSET,
     eStyleAnimType_None)
-CSS_PROP_FONT(
+CSS_PROP_SHORTHAND(
     font-variant,
     font_variant,
     FontVariant,
-    CSS_PROPERTY_PARSE_VALUE |
-        CSS_PROPERTY_APPLIES_TO_FIRST_LETTER_AND_FIRST_LINE |
-        CSS_PROPERTY_APPLIES_TO_PLACEHOLDER,
-    "",
-    VARIANT_HK | VARIANT_SYSFONT,
-    kFontVariantKTable,
-    offsetof(nsStyleFont, mFont.variant),
-    eStyleAnimType_EnumU8)
+    CSS_PROPERTY_PARSE_FUNCTION,
+    "")
 CSS_PROP_FONT(
     font-variant-alternates,
     font_variant_alternates,
@@ -1909,8 +1903,8 @@ CSS_PROP_FONT(
         CSS_PROPERTY_VALUE_PARSER_FUNCTION |
         CSS_PROPERTY_APPLIES_TO_FIRST_LETTER_AND_FIRST_LINE |
         CSS_PROPERTY_APPLIES_TO_PLACEHOLDER,
-    "layout.css.font-features.enabled",
-    VARIANT_HK,
+    "",
+    0,
     kFontVariantAlternatesKTable,
     CSS_PROP_NO_OFFSET,
     eStyleAnimType_None)
@@ -1921,7 +1915,7 @@ CSS_PROP_FONT(
     CSS_PROPERTY_PARSE_VALUE |
         CSS_PROPERTY_APPLIES_TO_FIRST_LETTER_AND_FIRST_LINE |
         CSS_PROPERTY_APPLIES_TO_PLACEHOLDER,
-    "layout.css.font-features.enabled",
+    "",
     VARIANT_HMK,
     kFontVariantCapsKTable,
     CSS_PROP_NO_OFFSET,
@@ -1934,7 +1928,7 @@ CSS_PROP_FONT(
         CSS_PROPERTY_VALUE_PARSER_FUNCTION |
         CSS_PROPERTY_APPLIES_TO_FIRST_LETTER_AND_FIRST_LINE |
         CSS_PROPERTY_APPLIES_TO_PLACEHOLDER,
-    "layout.css.font-features.enabled",
+    "",
     0,
     kFontVariantEastAsianKTable,
     CSS_PROP_NO_OFFSET,
@@ -1947,7 +1941,7 @@ CSS_PROP_FONT(
         CSS_PROPERTY_VALUE_PARSER_FUNCTION |
         CSS_PROPERTY_APPLIES_TO_FIRST_LETTER_AND_FIRST_LINE |
         CSS_PROPERTY_APPLIES_TO_PLACEHOLDER,
-    "layout.css.font-features.enabled",
+    "",
     0,
     kFontVariantLigaturesKTable,
     CSS_PROP_NO_OFFSET,
@@ -1960,7 +1954,7 @@ CSS_PROP_FONT(
         CSS_PROPERTY_VALUE_PARSER_FUNCTION |
         CSS_PROPERTY_APPLIES_TO_FIRST_LETTER_AND_FIRST_LINE |
         CSS_PROPERTY_APPLIES_TO_PLACEHOLDER,
-    "layout.css.font-features.enabled",
+    "",
     0,
     kFontVariantNumericKTable,
     CSS_PROP_NO_OFFSET,
@@ -1972,7 +1966,7 @@ CSS_PROP_FONT(
     CSS_PROPERTY_PARSE_VALUE |
         CSS_PROPERTY_APPLIES_TO_FIRST_LETTER_AND_FIRST_LINE |
         CSS_PROPERTY_APPLIES_TO_PLACEHOLDER,
-    "layout.css.font-features.enabled",
+    "",
     VARIANT_HMK,
     kFontVariantPositionKTable,
     CSS_PROP_NO_OFFSET,
diff --git a/layout/style/nsCSSProps.cpp b/layout/style/nsCSSProps.cpp
index d03c3e146f38..594798ed5ef8 100644
--- a/layout/style/nsCSSProps.cpp
+++ b/layout/style/nsCSSProps.cpp
@@ -476,12 +476,8 @@ nsCSSProps::LookupFontDesc(const nsAString& aFontDesc)
   NS_ABORT_IF_FALSE(gFontDescTable, "no lookup table, needs addref");
   nsCSSFontDesc which = nsCSSFontDesc(gFontDescTable->Lookup(aFontDesc));
 
-  // font-variant-alternates enabled ==> layout.css.font-features.enabled is true
-  bool fontFeaturesEnabled =
-    nsCSSProps::IsEnabled(eCSSProperty_font_variant_alternates);
-
   // check for unprefixed font-feature-settings/font-language-override
-  if (which == eCSSFontDesc_UNKNOWN && fontFeaturesEnabled) {
+  if (which == eCSSFontDesc_UNKNOWN) {
     nsAutoString prefixedProp;
     prefixedProp.AppendLiteral("-moz-");
     prefixedProp.Append(aFontDesc);
@@ -1246,13 +1242,6 @@ const KTableValue nsCSSProps::kFontSynthesisKTable[] = {
   eCSSKeyword_UNKNOWN,-1
 };
 
-
-const KTableValue nsCSSProps::kFontVariantKTable[] = {
-  eCSSKeyword_normal, NS_STYLE_FONT_VARIANT_NORMAL,
-  eCSSKeyword_small_caps, NS_STYLE_FONT_VARIANT_SMALL_CAPS,
-  eCSSKeyword_UNKNOWN,-1
-};
-
 const KTableValue nsCSSProps::kFontVariantAlternatesKTable[] = {
   eCSSKeyword_historical_forms, NS_FONT_VARIANT_ALTERNATES_HISTORICAL,
   eCSSKeyword_UNKNOWN,-1
@@ -1292,7 +1281,6 @@ const KTableValue nsCSSProps::kFontVariantEastAsianKTable[] = {
 };
 
 const KTableValue nsCSSProps::kFontVariantLigaturesKTable[] = {
-  eCSSKeyword_none, NS_FONT_VARIANT_LIGATURES_NONE,
   eCSSKeyword_common_ligatures, NS_FONT_VARIANT_LIGATURES_COMMON,
   eCSSKeyword_no_common_ligatures, NS_FONT_VARIANT_LIGATURES_NO_COMMON,
   eCSSKeyword_discretionary_ligatures, NS_FONT_VARIANT_LIGATURES_DISCRETIONARY,
@@ -2470,7 +2458,6 @@ static const nsCSSProperty gBorderEndWidthSubpropTable[] = {
 static const nsCSSProperty gFontSubpropTable[] = {
   eCSSProperty_font_family,
   eCSSProperty_font_style,
-  eCSSProperty_font_variant,
   eCSSProperty_font_weight,
   eCSSProperty_font_size,
   eCSSProperty_line_height,
@@ -2490,6 +2477,16 @@ static const nsCSSProperty gFontSubpropTable[] = {
   eCSSProperty_UNKNOWN
 };
 
+static const nsCSSProperty gFontVariantSubpropTable[] = {
+  eCSSProperty_font_variant_alternates,
+  eCSSProperty_font_variant_caps,
+  eCSSProperty_font_variant_east_asian,
+  eCSSProperty_font_variant_ligatures,
+  eCSSProperty_font_variant_numeric,
+  eCSSProperty_font_variant_position,
+  eCSSProperty_UNKNOWN
+};
+
 static const nsCSSProperty gListStyleSubpropTable[] = {
   eCSSProperty_list_style_type,
   eCSSProperty_list_style_image,
diff --git a/layout/style/nsCSSRules.h b/layout/style/nsCSSRules.h
index 6cbd924f2966..03308d301711 100644
--- a/layout/style/nsCSSRules.h
+++ b/layout/style/nsCSSRules.h
@@ -338,15 +338,6 @@ public:
 
   virtual size_t SizeOfIncludingThis(mozilla::MallocSizeOf aMallocSizeOf) const MOZ_OVERRIDE;
 
-  static bool PrefEnabled()
-  {
-    // font-variant-alternates enabled ==> layout.css.font-features.enabled is true
-    bool fontFeaturesEnabled =
-      nsCSSProps::IsEnabled(eCSSProperty_font_variant_alternates);
-
-    return fontFeaturesEnabled;
-  }
-
 protected:
   ~nsCSSFontFeatureValuesRule() {}
 
diff --git a/layout/style/nsComputedDOMStyle.cpp b/layout/style/nsComputedDOMStyle.cpp
index 31f34a15f87d..b28a926e6a2e 100644
--- a/layout/style/nsComputedDOMStyle.cpp
+++ b/layout/style/nsComputedDOMStyle.cpp
@@ -1469,16 +1469,6 @@ nsComputedDOMStyle::DoGetFontWeight()
   return val;
 }
 
-CSSValue*
-nsComputedDOMStyle::DoGetFontVariant()
-{
-  nsROCSSPrimitiveValue* val = new nsROCSSPrimitiveValue;
-  val->SetIdent(
-    nsCSSProps::ValueToKeywordEnum(StyleFont()->mFont.variant,
-                                   nsCSSProps::kFontVariantKTable));
-  return val;
-}
-
 CSSValue*
 nsComputedDOMStyle::DoGetFontFeatureSettings()
 {
@@ -1543,6 +1533,37 @@ nsComputedDOMStyle::DoGetFontSynthesis()
   return val;
 }
 
+// return a value *only* for valid longhand values from CSS 2.1, either
+// normal or small-caps only
+CSSValue*
+nsComputedDOMStyle::DoGetFontVariant()
+{
+  const nsFont& f = StyleFont()->mFont;
+
+  // if any of the other font-variant subproperties other than
+  // font-variant-caps are not normal then can't calculate a computed value
+  if (f.variantAlternates || f.variantEastAsian || f.variantLigatures ||
+      f.variantNumeric || f.variantPosition) {
+    return nullptr;
+  }
+
+  nsCSSKeyword keyword;
+  switch (f.variantCaps) {
+    case 0:
+      keyword = eCSSKeyword_normal;
+      break;
+    case NS_FONT_VARIANT_CAPS_SMALLCAPS:
+      keyword = eCSSKeyword_small_caps;
+      break;
+    default:
+      return nullptr;
+  }
+
+  nsROCSSPrimitiveValue* val = new nsROCSSPrimitiveValue;
+  val->SetIdent(keyword);
+  return val;
+}
+
 CSSValue*
 nsComputedDOMStyle::DoGetFontVariantAlternates()
 {
@@ -1573,7 +1594,6 @@ nsComputedDOMStyle::DoGetFontVariantAlternates()
   return val;
 }
 
-
 CSSValue*
 nsComputedDOMStyle::DoGetFontVariantCaps()
 {
@@ -1622,6 +1642,8 @@ nsComputedDOMStyle::DoGetFontVariantLigatures()
 
   if (0 == intValue) {
     val->SetIdent(eCSSKeyword_normal);
+  } else if (NS_FONT_VARIANT_LIGATURES_NONE == intValue) {
+    val->SetIdent(eCSSKeyword_none);
   } else {
     nsAutoString valueStr;
 
diff --git a/layout/style/nsComputedDOMStylePropertyList.h b/layout/style/nsComputedDOMStylePropertyList.h
index 335f2e816dc7..7f3f38da258e 100644
--- a/layout/style/nsComputedDOMStylePropertyList.h
+++ b/layout/style/nsComputedDOMStylePropertyList.h
@@ -117,7 +117,9 @@ COMPUTED_STYLE_PROP(flex_wrap,                     FlexWrap)
 COMPUTED_STYLE_PROP(float,                         Float)
 //// COMPUTED_STYLE_PROP(font,                     Font)
 COMPUTED_STYLE_PROP(font_family,                   FontFamily)
+COMPUTED_STYLE_PROP(font_feature_settings,         FontFeatureSettings)
 COMPUTED_STYLE_PROP(font_kerning,                  FontKerning)
+COMPUTED_STYLE_PROP(font_language_override,        FontLanguageOverride)
 COMPUTED_STYLE_PROP(font_size,                     FontSize)
 COMPUTED_STYLE_PROP(font_size_adjust,              FontSizeAdjust)
 COMPUTED_STYLE_PROP(font_stretch,                  FontStretch)
@@ -250,8 +252,6 @@ COMPUTED_STYLE_PROP(_moz_column_rule_style,        ColumnRuleStyle)
 COMPUTED_STYLE_PROP(_moz_column_rule_width,        ColumnRuleWidth)
 COMPUTED_STYLE_PROP(_moz_column_width,             ColumnWidth)
 COMPUTED_STYLE_PROP(float_edge,                    FloatEdge)
-COMPUTED_STYLE_PROP(font_feature_settings,         FontFeatureSettings)
-COMPUTED_STYLE_PROP(font_language_override,        FontLanguageOverride)
 COMPUTED_STYLE_PROP(force_broken_image_icon,       ForceBrokenImageIcon)
 COMPUTED_STYLE_PROP(hyphens,                       Hyphens)
 COMPUTED_STYLE_PROP(image_region,                  ImageRegion)
diff --git a/layout/style/nsRuleNode.cpp b/layout/style/nsRuleNode.cpp
index d4ee5a763004..547b067db9de 100644
--- a/layout/style/nsRuleNode.cpp
+++ b/layout/style/nsRuleNode.cpp
@@ -3332,7 +3332,6 @@ nsRuleNode::SetFont(nsPresContext* aPresContext, nsStyleContext* aContext,
       systemFont.fontlist.SetDefaultFontType(eFamily_none);
       systemFont.style = fontStyle.style;
       systemFont.systemFont = fontStyle.systemFont;
-      systemFont.variant = NS_FONT_VARIANT_NORMAL;
       systemFont.weight = fontStyle.weight;
       systemFont.stretch = fontStyle.stretch;
       systemFont.decorations = NS_FONT_DECORATION_NONE;
@@ -3456,14 +3455,6 @@ nsRuleNode::SetFont(nsPresContext* aPresContext, nsStyleContext* aContext,
                 0, 0, 0, systemFont.style);
   }
 
-  // font-variant: enum, inherit, initial, -moz-system-font
-  SetDiscrete(*aRuleData->ValueForFontVariant(),
-              aFont->mFont.variant, aCanStoreInRuleTree,
-              SETDSC_ENUMERATED | SETDSC_SYSTEM_FONT | SETDSC_UNSET_INHERIT,
-              aParentFont->mFont.variant,
-              defaultVariableFont->variant,
-              0, 0, 0, systemFont.variant);
-
   // font-weight: int, enum, inherit, initial, -moz-system-font
   // special handling for enum
   const nsCSSValue* weightValue = aRuleData->ValueForFontWeight();
@@ -3647,15 +3638,15 @@ nsRuleNode::SetFont(nsPresContext* aPresContext, nsStyleContext* aContext,
               defaultVariableFont->variantEastAsian,
               0, 0, 0, systemFont.variantEastAsian);
 
-  // font-variant-ligatures: normal, enum (bit field), inherit, initial,
+  // font-variant-ligatures: normal, none, enum (bit field), inherit, initial,
   //                         -moz-system-font
   SetDiscrete(*aRuleData->ValueForFontVariantLigatures(),
               aFont->mFont.variantLigatures, aCanStoreInRuleTree,
-              SETDSC_NORMAL | SETDSC_ENUMERATED | SETDSC_SYSTEM_FONT |
-                SETDSC_UNSET_INHERIT,
+              SETDSC_NORMAL | SETDSC_NONE | SETDSC_ENUMERATED |
+                SETDSC_SYSTEM_FONT | SETDSC_UNSET_INHERIT,
               aParentFont->mFont.variantLigatures,
               defaultVariableFont->variantLigatures,
-              0, 0, 0, systemFont.variantLigatures);
+              0, NS_FONT_VARIANT_LIGATURES_NONE, 0, systemFont.variantLigatures);
 
   // font-variant-numeric: normal, enum (bit field), inherit, initial,
   //                       -moz-system-font
diff --git a/layout/style/nsStyleConsts.h b/layout/style/nsStyleConsts.h
index 41bbf75b8561..f1224ac01253 100644
--- a/layout/style/nsStyleConsts.h
+++ b/layout/style/nsStyleConsts.h
@@ -494,11 +494,6 @@ static inline mozilla::css::Side operator++(mozilla::css::Side& side, int) {
 #define NS_STYLE_FONT_STYLE_ITALIC              NS_FONT_STYLE_ITALIC
 #define NS_STYLE_FONT_STYLE_OBLIQUE             NS_FONT_STYLE_OBLIQUE
 
-// See nsStyleFont
-// We should eventually stop using the NS_STYLE_* variants here.
-#define NS_STYLE_FONT_VARIANT_NORMAL            NS_FONT_VARIANT_NORMAL
-#define NS_STYLE_FONT_VARIANT_SMALL_CAPS        NS_FONT_VARIANT_SMALL_CAPS
-
 // See nsStyleFont
 // We should eventually stop using the NS_STYLE_* variants here.
 #define NS_STYLE_FONT_WEIGHT_NORMAL             NS_FONT_WEIGHT_NORMAL
diff --git a/layout/style/nsStyleStruct.cpp b/layout/style/nsStyleStruct.cpp
index e90da88566ad..05251525f580 100644
--- a/layout/style/nsStyleStruct.cpp
+++ b/layout/style/nsStyleStruct.cpp
@@ -214,7 +214,6 @@ nsChangeHint nsStyleFont::CalcFontDifference(const nsFont& aFont1, const nsFont&
   if ((aFont1.size == aFont2.size) && 
       (aFont1.sizeAdjust == aFont2.sizeAdjust) && 
       (aFont1.style == aFont2.style) &&
-      (aFont1.variant == aFont2.variant) &&
       (aFont1.weight == aFont2.weight) &&
       (aFont1.stretch == aFont2.stretch) &&
       (aFont1.smoothing == aFont2.smoothing) &&
diff --git a/layout/style/test/property_database.js b/layout/style/test/property_database.js
index fffa1421d270..4a6da740bf7b 100644
--- a/layout/style/test/property_database.js
+++ b/layout/style/test/property_database.js
@@ -2429,7 +2429,10 @@ var gCSSProperties = {
     domProp: "font",
     inherited: true,
     type: CSS_TYPE_TRUE_SHORTHAND,
-    subproperties: [ "font-style", "font-variant", "font-weight", "font-size", "line-height", "font-family", "font-stretch", "font-size-adjust", "-moz-font-feature-settings", "-moz-font-language-override" ],
+    subproperties: [ "font-style", "font-variant", "font-weight", "font-size", "line-height", "font-family", "font-stretch",
+                     "font-size-adjust", "font-feature-settings", "font-language-override",
+                     "font-kerning", "font-synthesis", "font-variant-alternates", "font-variant-caps", "font-variant-east-asian",
+                     "font-variant-ligatures", "font-variant-numeric", "font-variant-position" ],
     initial_values: [ (gInitialFontFamilyIsSansSerif ? "medium sans-serif" : "medium serif") ],
     other_values: [ "large serif", "9px fantasy", "bold italic small-caps 24px/1.4 Times New Roman, serif", "small inherit roman", "small roman inherit",
       // system fonts
@@ -2447,8 +2450,8 @@ var gCSSProperties = {
     other_values: [ (gInitialFontFamilyIsSansSerif ? "serif" : "sans-serif"), "Times New Roman, serif", "'Times New Roman', serif", "cursive", "fantasy", "\\\"Times New Roman", "\"Times New Roman\"", "Times, \\\"Times New Roman", "Times, \"Times New Roman\"", "-no-such-font-installed", "inherit roman", "roman inherit", "Times, inherit roman", "inherit roman, Times", "roman inherit, Times", "Times, roman inherit" ],
     invalid_values: [ "\"Times New\" Roman", "\"Times New Roman\n", "Times, \"Times New Roman\n" ]
   },
-  "-moz-font-feature-settings": {
-    domProp: "MozFontFeatureSettings",
+  "font-feature-settings": {
+    domProp: "fontFeatureSettings",
     inherited: true,
     type: CSS_TYPE_LONGHAND,
     initial_values: [ "normal" ],
@@ -2466,8 +2469,16 @@ var gCSSProperties = {
       '"liga" 1 off', '"liga" on off', '"liga" , 0 "smcp"', '"liga" "smcp"'
     ]
   },
-  "-moz-font-language-override": {
-    domProp: "MozFontLanguageOverride",
+  "font-kerning": {
+    domProp: "fontKerning",
+    inherited: true,
+    type: CSS_TYPE_LONGHAND,
+    initial_values: [ "auto" ],
+    other_values: [ "normal", "none" ],
+    invalid_values: [ "on" ]
+  },
+  "font-language-override": {
+    domProp: "fontLanguageOverride",
     inherited: true,
     type: CSS_TYPE_LONGHAND,
     initial_values: [ "normal" ],
@@ -2519,13 +2530,94 @@ var gCSSProperties = {
     other_values: [ "italic", "oblique" ],
     invalid_values: []
   },
+  "font-synthesis": {
+    domProp: "fontSynthesis",
+    inherited: true,
+    type: CSS_TYPE_LONGHAND,
+    initial_values: [ "weight style" ],
+    other_values: [ "none", "weight", "style" ],
+    invalid_values: [ "weight none", "style none", "none style", "weight 10px", "weight weight", "style style" ]
+  },
   "font-variant": {
     domProp: "fontVariant",
     inherited: true,
+    type: CSS_TYPE_TRUE_SHORTHAND,
+    subproperties: [ "font-variant-alternates", "font-variant-caps", "font-variant-east-asian", "font-variant-ligatures", "font-variant-numeric", "font-variant-position" ],
+    initial_values: [ "normal" ],
+    other_values: [ "small-caps", "none", "traditional oldstyle-nums", "all-small-caps", "common-ligatures no-discretionary-ligatures",
+                    "proportional-nums oldstyle-nums", "proportional-nums slashed-zero diagonal-fractions oldstyle-nums ordinal",
+                    "traditional historical-forms styleset(ok-alt-a, ok-alt-b)", "styleset(potato)" ],
+    invalid_values: [ "small-caps normal", "small-caps small-caps", "none common-ligatures", "common-ligatures none", "small-caps potato",
+                      "small-caps jis83 all-small-caps", "super historical-ligatures sub", "stacked-fractions diagonal-fractions historical-ligatures",
+                      "common-ligatures traditional common-ligatures", "lining-nums traditional slashed-zero ordinal normal",
+                      "traditional historical-forms styleset(ok-alt-a, ok-alt-b) historical-forms",
+                      "historical-forms styleset(ok-alt-a, ok-alt-b) traditional styleset(potato)", "annotation(a,b,c)" ]
+  },
+  "font-variant-alternates": {
+    domProp: "fontVariantAlternates",
+    inherited: true,
     type: CSS_TYPE_LONGHAND,
     initial_values: [ "normal" ],
-    other_values: [ "small-caps" ],
-    invalid_values: [ "small-caps normal" ]
+    other_values: [ "historical-forms",
+                        "styleset(alt-a, alt-b)", "character-variant(a, b, c)", "annotation(circled)",
+                        "swash(squishy)", "styleset(complex\\ blob, a)", "annotation(\\62 lah)" ],
+    invalid_values: [ "historical-forms normal", "historical-forms historical-forms",
+                          "swash", "swash(3)", "annotation(a, b)", "ornaments(a,b)",
+                          "styleset(1234blah)", "annotation(a), annotation(b)", "annotation(a) normal" ]
+  },
+   "font-variant-caps": {
+    domProp: "fontVariantCaps",
+    inherited: true,
+    type: CSS_TYPE_LONGHAND,
+    initial_values: [ "normal" ],
+    other_values: [ "small-caps", "all-small-caps", "petite-caps", "all-petite-caps", "titling-caps", "unicase" ],
+    invalid_values: [ "normal small-caps", "petite-caps normal", "unicase unicase" ]
+  },
+  "font-variant-east-asian": {
+    domProp: "fontVariantEastAsian",
+    inherited: true,
+    type: CSS_TYPE_LONGHAND,
+    initial_values: [ "normal" ],
+    other_values: [ "jis78", "jis83", "jis90", "jis04", "simplified", "traditional", "full-width", "proportional-width", "ruby",
+                    "jis78 full-width", "jis78 full-width ruby", "simplified proportional-width", "ruby simplified" ],
+    invalid_values: [ "jis78 normal", "jis90 jis04", "simplified traditional", "full-width proportional-width",
+                          "ruby simplified ruby", "jis78 ruby simplified" ]
+  },
+  "font-variant-ligatures": {
+    domProp: "fontVariantLigatures",
+    inherited: true,
+    type: CSS_TYPE_LONGHAND,
+    initial_values: [ "normal" ],
+    other_values: [ "none", "common-ligatures", "no-common-ligatures", "discretionary-ligatures", "no-discretionary-ligatures",
+                    "historical-ligatures", "no-historical-ligatures", "contextual", "no-contextual",
+                    "common-ligatures no-discretionary-ligatures", "contextual no-discretionary-ligatures",
+                    "historical-ligatures no-common-ligatures", "no-historical-ligatures discretionary-ligatures",
+                    "common-ligatures no-discretionary-ligatures historical-ligatures no-contextual" ],
+    invalid_values: [ "common-ligatures normal", "common-ligatures no-common-ligatures", "common-ligatures common-ligatures",
+                      "no-historical-ligatures historical-ligatures", "no-discretionary-ligatures discretionary-ligatures",
+                      "no-contextual contextual", "common-ligatures no-discretionary-ligatures no-common-ligatures",
+                      "common-ligatures none", "no-discretionary-ligatures none", "none common-ligatures" ]
+  },
+  "font-variant-numeric": {
+    domProp: "fontVariantNumeric",
+    inherited: true,
+    type: CSS_TYPE_LONGHAND,
+    initial_values: [ "normal" ],
+    other_values: [ "lining-nums", "oldstyle-nums", "proportional-nums", "tabular-nums", "diagonal-fractions",
+                    "stacked-fractions", "slashed-zero", "ordinal", "lining-nums diagonal-fractions",
+                    "tabular-nums stacked-fractions", "tabular-nums slashed-zero stacked-fractions",
+                    "proportional-nums slashed-zero diagonal-fractions oldstyle-nums ordinal" ],
+    invalid_values: [ "lining-nums normal", "lining-nums oldstyle-nums", "lining-nums normal slashed-zero ordinal",
+                      "proportional-nums tabular-nums", "diagonal-fractions stacked-fractions", "slashed-zero diagonal-fractions slashed-zero",
+                      "lining-nums slashed-zero diagonal-fractions oldstyle-nums", "diagonal-fractions diagonal-fractions" ]
+  },
+  "font-variant-position": {
+    domProp: "fontVariantPosition",
+    inherited: true,
+    type: CSS_TYPE_LONGHAND,
+    initial_values: [ "normal" ],
+    other_values: [ "super", "sub" ],
+    invalid_values: [ "normal sub", "super sub" ]
   },
   "font-weight": {
     domProp: "fontWeight",
@@ -4334,6 +4426,37 @@ var gCSSProperties = {
     initial_values: [ "ease", "cubic-bezier(0.25, 0.1, 0.25, 1.0)" ],
     other_values: [ "linear", "ease-in", "ease-out", "ease-in-out", "linear, ease-in, cubic-bezier(0.1, 0.2, 0.8, 0.9)", "cubic-bezier(0.5, 0.5, 0.5, 0.5)", "cubic-bezier(0.25, 1.5, 0.75, -0.5)", "step-start", "step-end", "steps(1)", "steps(2, start)", "steps(386)", "steps(3, end)" ],
     invalid_values: [ "none", "auto", "cubic-bezier(0.25, 0.1, 0.25)", "cubic-bezier(0.25, 0.1, 0.25, 0.25, 1.0)", "cubic-bezier(-0.5, 0.5, 0.5, 0.5)", "cubic-bezier(1.5, 0.5, 0.5, 0.5)", "cubic-bezier(0.5, 0.5, -0.5, 0.5)", "cubic-bezier(0.5, 0.5, 1.5, 0.5)", "steps(2, step-end)", "steps(0)", "steps(-2)", "steps(0, step-end, 1)" ]
+  },
+  "-moz-font-feature-settings": {
+    domProp: "MozFontFeatureSettings",
+    inherited: true,
+    type: CSS_TYPE_SHORTHAND_AND_LONGHAND,
+    alias_for: "font-feature-settings",
+    subproperties: [ "font-feature-settings" ],
+    initial_values: [ "normal" ],
+    other_values: [
+      "'liga' on", "'liga'", "\"liga\" 1", "'liga', 'clig' 1",
+      "\"liga\" off", "\"liga\" 0", '"cv01" 3, "cv02" 4',
+      '"cswh", "smcp" off, "salt" 4', '"cswh" 1, "smcp" off, "salt" 4',
+      '"cswh" 0, \'blah\', "liga", "smcp" off, "salt" 4',
+      '"liga"        ,"smcp" 0         , "blah"'
+    ],
+    invalid_values: [
+      'liga', 'liga 1', 'liga normal', '"liga" normal', 'normal liga',
+      'normal "liga"', 'normal, "liga"', '"liga=1"', "'foobar' on",
+      '"blahblah" 0', '"liga" 3.14', '"liga" 1 3.14', '"liga" 1 normal',
+      '"liga" 1 off', '"liga" on off', '"liga" , 0 "smcp"', '"liga" "smcp"'
+    ]
+  },
+  "-moz-font-language-override": {
+    domProp: "MozFontLanguageOverride",
+    inherited: true,
+    type: CSS_TYPE_SHORTHAND_AND_LONGHAND,
+    alias_for: "font-language-override",
+    subproperties: [ "font-language-override" ],
+    initial_values: [ "normal" ],
+    other_values: [ "'ENG'", "'TRK'", "\"TRK\"", "'N\\'Ko'" ],
+    invalid_values: [ "TRK", "ja" ]
   }
 }
 
@@ -4423,130 +4546,6 @@ if (SpecialPowers.getBoolPref("layout.css.vertical-text.enabled")) {
   }
 }
 
-if (SpecialPowers.getBoolPref("layout.css.font-features.enabled")) {
-  var fontFeatureProperties = {
-    "font-kerning": {
-      domProp: "fontKerning",
-      inherited: true,
-      type: CSS_TYPE_LONGHAND,
-      initial_values: [ "auto" ],
-      other_values: [ "normal", "none" ],
-      invalid_values: [ "on" ]
-    },
-    "font-variant-alternates": {
-      domProp: "fontVariantAlternates",
-      inherited: true,
-      type: CSS_TYPE_LONGHAND,
-      initial_values: [ "normal" ],
-      other_values: [ "historical-forms",
-                          "styleset(alt-a, alt-b)", "character-variant(a, b, c)", "annotation(circled)",
-                          "swash(squishy)", "styleset(complex\\ blob, a)", "annotation(\\62 lah)" ],
-      invalid_values: [ "historical-forms normal", "historical-forms historical-forms",
-                            "swash", "swash(3)", "annotation(a, b)", "ornaments(a,b)",
-                            "styleset(1234blah)", "annotation(a), annotation(b)", "annotation(a) normal" ]
-    },
-     "font-variant-caps": {
-      domProp: "fontVariantCaps",
-      inherited: true,
-      type: CSS_TYPE_LONGHAND,
-      initial_values: [ "normal" ],
-      other_values: [ "small-caps", "all-small-caps", "petite-caps", "all-petite-caps", "titling-caps", "unicase" ],
-      invalid_values: [ "normal small-caps", "petite-caps normal", "unicase unicase" ]
-    },
-    "font-variant-east-asian": {
-      domProp: "fontVariantEastAsian",
-      inherited: true,
-      type: CSS_TYPE_LONGHAND,
-      initial_values: [ "normal" ],
-      other_values: [ "jis78", "jis83", "jis90", "jis04", "simplified", "traditional", "full-width", "proportional-width", "ruby",
-                      "jis78 full-width", "jis78 full-width ruby", "simplified proportional-width", "ruby simplified" ],
-      invalid_values: [ "jis78 normal", "jis90 jis04", "simplified traditional", "full-width proportional-width",
-                            "ruby simplified ruby", "jis78 ruby simplified" ]
-    },
-    "font-variant-ligatures": {
-      domProp: "fontVariantLigatures",
-      inherited: true,
-      type: CSS_TYPE_LONGHAND,
-      initial_values: [ "normal" ],
-      other_values: [ "none", "common-ligatures", "no-common-ligatures", "discretionary-ligatures", "no-discretionary-ligatures",
-                      "historical-ligatures", "no-historical-ligatures", "contextual", "no-contextual",
-                      "common-ligatures no-discretionary-ligatures", "contextual no-discretionary-ligatures",
-                      "historical-ligatures no-common-ligatures", "no-historical-ligatures discretionary-ligatures",
-                      "common-ligatures no-discretionary-ligatures historical-ligatures no-contextual" ],
-      invalid_values: [ "common-ligatures normal", "common-ligatures no-common-ligatures", "common-ligatures common-ligatures",
-                        "no-historical-ligatures historical-ligatures", "no-discretionary-ligatures discretionary-ligatures",
-                        "no-contextual contextual", "common-ligatures no-discretionary-ligatures no-common-ligatures",
-                        "common-ligatures none", "no-discretionary-ligatures none", "none common-ligatures" ]
-    },
-    "font-variant-numeric": {
-      domProp: "fontVariantNumeric",
-      inherited: true,
-      type: CSS_TYPE_LONGHAND,
-      initial_values: [ "normal" ],
-      other_values: [ "lining-nums", "oldstyle-nums", "proportional-nums", "tabular-nums", "diagonal-fractions",
-                      "stacked-fractions", "slashed-zero", "ordinal", "lining-nums diagonal-fractions",
-                      "tabular-nums stacked-fractions", "tabular-nums slashed-zero stacked-fractions",
-                      "proportional-nums slashed-zero diagonal-fractions oldstyle-nums ordinal" ],
-      invalid_values: [ "lining-nums normal", "lining-nums oldstyle-nums", "lining-nums normal slashed-zero ordinal",
-                        "proportional-nums tabular-nums", "diagonal-fractions stacked-fractions", "slashed-zero diagonal-fractions slashed-zero",
-                        "lining-nums slashed-zero diagonal-fractions oldstyle-nums", "diagonal-fractions diagonal-fractions" ]
-    },
-    "font-variant-position": {
-      domProp: "fontVariantPosition",
-      inherited: true,
-      type: CSS_TYPE_LONGHAND,
-      initial_values: [ "normal" ],
-      other_values: [ "super", "sub" ],
-      invalid_values: [ "normal sub", "super sub" ]
-    },
-    "font-synthesis": {
-      domProp: "fontSynthesis",
-      inherited: true,
-      type: CSS_TYPE_LONGHAND,
-      initial_values: [ "weight style" ],
-      other_values: [ "none", "weight", "style" ],
-      invalid_values: [ "weight none", "style none", "none style", "weight 10px", "weight weight", "style style" ]
-    },
-    // aliases for prefixed properties
-    "font-feature-settings": {
-      domProp: "fontFeatureSettings",
-      inherited: true,
-      type: CSS_TYPE_SHORTHAND_AND_LONGHAND,
-      alias_for: "-moz-font-feature-settings",
-      subproperties: [ "-moz-font-feature-settings" ],
-      initial_values: [ "normal" ],
-      other_values: [
-        "'liga' on", "'liga'", "\"liga\" 1", "'liga', 'clig' 1",
-        "\"liga\" off", "\"liga\" 0", '"cv01" 3, "cv02" 4',
-        '"cswh", "smcp" off, "salt" 4', '"cswh" 1, "smcp" off, "salt" 4',
-        '"cswh" 0, \'blah\', "liga", "smcp" off, "salt" 4',
-        '"liga"        ,"smcp" 0         , "blah"'
-      ],
-      invalid_values: [
-        'liga', 'liga 1', 'liga normal', '"liga" normal', 'normal liga',
-        'normal "liga"', 'normal, "liga"', '"liga=1"', "'foobar' on",
-        '"blahblah" 0', '"liga" 3.14', '"liga" 1 3.14', '"liga" 1 normal',
-        '"liga" 1 off', '"liga" on off', '"liga" , 0 "smcp"', '"liga" "smcp"'
-      ]
-    },
-    "font-language-override": {
-      domProp: "fontLanguageOverride",
-      inherited: true,
-      type: CSS_TYPE_SHORTHAND_AND_LONGHAND,
-      alias_for: "-moz-font-language-override",
-      subproperties: [ "-moz-font-language-override" ],
-      initial_values: [ "normal" ],
-      other_values: [ "'ENG'", "'TRK'", "\"TRK\"", "'N\\'Ko'" ],
-      invalid_values: [ "TRK", "ja" ]
-    }
-  };
-  for (var prop in fontFeatureProperties) {
-    gCSSProperties[prop] = fontFeatureProperties[prop];
-  }
-  var fontAdditions = [ "font-kerning", "font-synthesis", "font-variant-alternates", "font-variant-caps", "font-variant-east-asian", "font-variant-ligatures", "font-variant-numeric", "font-variant-position" ];
-  gCSSProperties["font"].subproperties = gCSSProperties["font"].subproperties.concat(fontAdditions);
-}
-
 if (SpecialPowers.getBoolPref("layout.css.masking.enabled")) {
   gCSSProperties["mask-type"] = {
     domProp: "maskType",
diff --git a/layout/style/test/test_bug377947.html b/layout/style/test/test_bug377947.html
index 2bcea156fa69..00946bf2fe6e 100644
--- a/layout/style/test/test_bug377947.html
+++ b/layout/style/test/test_bug377947.html
@@ -58,24 +58,18 @@ var all_but_one = {
   "font-size": "small",
   "font-size-adjust": "none", // has to be default value
   "font-stretch": "normal", // has to be default value
-  "-moz-font-feature-settings": "normal", // has to be default value
-  "-moz-font-language-override": "normal" // has to be default value
+  "font-feature-settings": "normal", // has to be default value
+  "font-language-override": "normal", // has to be default value
+  "font-kerning": "auto", // has to be default value
+  "font-synthesis": "weight style", // has to be default value
+  "font-variant-alternates": "normal", // has to be default value
+  "font-variant-caps": "normal", // has to be default value
+  "font-variant-east-asian": "normal", // has to be default value
+  "font-variant-ligatures": "normal", // has to be default value
+  "font-variant-numeric": "normal", // has to be default value
+  "font-variant-position": "normal" // has to be default value
 };
-if (SpecialPowers.getBoolPref("layout.css.font-features.enabled")) {
-  var featureDefs = {
-    "font-kerning": "auto", // has to be default value
-    "font-synthesis": "weight style", // has to be default value
-    "font-variant-alternates": "normal", // has to be default value
-    "font-variant-caps": "normal", // has to be default value
-    "font-variant-east-asian": "normal", // has to be default value
-    "font-variant-ligatures": "normal", // has to be default value
-    "font-variant-numeric": "normal", // has to be default value
-    "font-variant-position": "normal" // has to be default value
-  };
-  for (var prop in featureDefs) {
-    all_but_one[prop] = featureDefs[prop];
-  }
-}
+
 for (var prop in all_but_one) {
   s.setProperty(prop, all_but_one[prop], "");
 }
diff --git a/layout/style/test/test_bug892929.html b/layout/style/test/test_bug892929.html
index 4868dac0017d..a67db56ee32f 100644
--- a/layout/style/test/test_bug892929.html
+++ b/layout/style/test/test_bug892929.html
@@ -5,7 +5,7 @@
   <title>Bug 892929 test</title>
   <link rel="author" title="John Daggett" href="mailto:jdaggett@mozilla.com">
   <link rel="help" href="http://www.w3.org/TR/css-fonts-3/#om-fontfeaturevalues" />
-  <meta name="assert" content="window.CSSFontFeatureValuesRule should only appear when layout.css.font-features.enabled is true" />
+  <meta name="assert" content="window.CSSFontFeatureValuesRule should appear by default" />
   <script type="text/javascript" src="/resources/testharness.js"></script>
   <script type="text/javascript" src="/resources/testharnessreport.js"></script>
   <style type="text/css">
diff --git a/layout/style/test/test_computed_style_prefs.html b/layout/style/test/test_computed_style_prefs.html
index f34002a2f109..776896d3f6a1 100644
--- a/layout/style/test/test_computed_style_prefs.html
+++ b/layout/style/test/test_computed_style_prefs.html
@@ -69,7 +69,6 @@ function step() {
 
 var gProps = {
   "layout.css.vertical-text.enabled": ["text-combine-upright", "text-orientation", "writing-mode"],
-  "layout.css.font-features.enabled": ["font-kerning", "font-synthesis", "font-variant-alternates", "font-variant-caps", "font-variant-east-asian", "font-variant-ligatures", "font-variant-numeric", "font-variant-position"],
   "layout.css.image-orientation.enabled": ["image-orientation"],
   "layout.css.mix-blend-mode.enabled": ["mix-blend-mode"],
   "layout.css.masking.enabled": ["mask-type"],
diff --git a/layout/style/test/test_font_face_parser.html b/layout/style/test/test_font_face_parser.html
index 7432427e01df..d968b3b087f3 100644
--- a/layout/style/test/test_font_face_parser.html
+++ b/layout/style/test/test_font_face_parser.html
@@ -253,40 +253,40 @@
     { rule: _("unicode-range: U+A5, U+220043"),
       d: { "unicode-range" : "U+00A5" }, noncanonical: true },
 
-    // -moz-font-feature-settings
-    { rule: _("-moz-font-feature-settings: normal;"),
-      d: { "-moz-font-feature-settings" : "normal" } },
-    { rule: _("-moz-font-feature-settings: \"dlig\";"),
-      d: { "-moz-font-feature-settings" : "\"dlig\"" } },
-    { rule: _("-moz-font-feature-settings: \"dlig\" 1;"),
-      d: { "-moz-font-feature-settings" : "\"dlig\"" }, noncanonical: true },
-    { rule: _("-moz-font-feature-settings: 'dlig' 1"),
-      d: { "-moz-font-feature-settings" : "\"dlig\"" }, noncanonical: true },
+    // font-feature-settings
+    { rule: _("font-feature-settings: normal;"),
+      d: { "font-feature-settings" : "normal" } },
+    { rule: _("font-feature-settings: \"dlig\";"),
+      d: { "font-feature-settings" : "\"dlig\"" } },
+    { rule: _("font-feature-settings: \"dlig\" 1;"),
+      d: { "font-feature-settings" : "\"dlig\"" }, noncanonical: true },
+    { rule: _("font-feature-settings: 'dlig' 1"),
+      d: { "font-feature-settings" : "\"dlig\"" }, noncanonical: true },
 
-    // incorrect -moz-font-feature-settings
-    { rule: _("-moz-font-feature-settings: dlig 1"), d: {} },
-    { rule: _("-moz-font-feature-settings: none;"), d: {} },
-    { rule: _("-moz-font-feature-settings: 0;"), d: {} },
-    { rule: _("-moz-font-feature-settings: 3.14;"), d: {} },
-    { rule: _("-moz-font-feature-settings: 'blah' 3.14;"), d: {} },
-    { rule: _("-moz-font-feature-settings: 'dlig' 1 'hist' 0;"), d: {} },
-    { rule: _("-moz-font-feature-settings: 'dlig=1,hist=1'"), d: {} },
+    // incorrect font-feature-settings
+    { rule: _("font-feature-settings: dlig 1"), d: {} },
+    { rule: _("font-feature-settings: none;"), d: {} },
+    { rule: _("font-feature-settings: 0;"), d: {} },
+    { rule: _("font-feature-settings: 3.14;"), d: {} },
+    { rule: _("font-feature-settings: 'blah' 3.14;"), d: {} },
+    { rule: _("font-feature-settings: 'dlig' 1 'hist' 0;"), d: {} },
+    { rule: _("font-feature-settings: 'dlig=1,hist=1'"), d: {} },
 
-    // -moz-font-language-override:
-    { rule: _("-moz-font-language-override: normal;"),
-      d: { "-moz-font-language-override" : "normal" } },
-    { rule: _("-moz-font-language-override: \"TRK\";"),
-      d: { "-moz-font-language-override" : "\"TRK\"" } },
-    { rule: _("-moz-font-language-override: 'TRK'"),
-      d: { "-moz-font-language-override" : "\"TRK\"" }, noncanonical: true },
+    // font-language-override:
+    { rule: _("font-language-override: normal;"),
+      d: { "font-language-override" : "normal" } },
+    { rule: _("font-language-override: \"TRK\";"),
+      d: { "font-language-override" : "\"TRK\"" } },
+    { rule: _("font-language-override: 'TRK'"),
+      d: { "font-language-override" : "\"TRK\"" }, noncanonical: true },
 
-    // incorrect -moz-font-language-override
-    { rule: _("-moz-font-language-override: TRK"), d: {} },
-    { rule: _("-moz-font-language-override: none;"), d: {} },
-    { rule: _("-moz-font-language-override: 0;"), d: {} },
-    { rule: _("-moz-font-language-override: #999;"), d: {} },
-    { rule: _("-moz-font-language-override: 'TRK' 'SRB'"), d: {} },
-    { rule: _("-moz-font-language-override: 'TRK', 'SRB'"), d: {} },
+    // incorrect font-language-override
+    { rule: _("font-language-override: TRK"), d: {} },
+    { rule: _("font-language-override: none;"), d: {} },
+    { rule: _("font-language-override: 0;"), d: {} },
+    { rule: _("font-language-override: #999;"), d: {} },
+    { rule: _("font-language-override: 'TRK' 'SRB'"), d: {} },
+    { rule: _("font-language-override: 'TRK', 'SRB'"), d: {} },
   ];
 
   var display = document.getElementById("display");
diff --git a/layout/style/test/test_font_feature_values_parsing.html b/layout/style/test/test_font_feature_values_parsing.html
index 8fcc1b67fc96..a5d4a6834062 100644
--- a/layout/style/test/test_font_feature_values_parsing.html
+++ b/layout/style/test/test_font_feature_values_parsing.html
@@ -335,10 +335,6 @@ function testOneRule(testrule) {
 }
 
 function testFontFeatureValuesRuleParsing() {
-  // Gecko-specific check - if pref not set, skip these tests
-  if (window.SpecialPowers && !window.SpecialPowers.getBoolPref("layout.css.font-features.enabled")) {
-    return;
-  }
   var i;
   for (i = 0; i < testrules.length; i++) {
     var testrule = testrules[i];
diff --git a/layout/style/test/test_specified_value_serialization.html b/layout/style/test/test_specified_value_serialization.html
index c0369d3b0a61..9cc2f9b2f14a 100644
--- a/layout/style/test/test_specified_value_serialization.html
+++ b/layout/style/test/test_specified_value_serialization.html
@@ -50,13 +50,11 @@ is(elt.style.getPropertyValue("transform"),
    "translateX(5px) translateY(10px) translateZ(2px) rotateX(30deg) rotateY(30deg) rotateZ(5deg) skewX(10deg) skewY(10deg) scaleX(2) scaleY(0.5) scaleZ(2)",
    "expected case canonicalization of transform functions");
 
-if (SpecialPowers.getBoolPref("layout.css.font-features.enabled")) {
-  elt.setAttribute("style",
-                   "font-variant-alternates: SWASH(fOo) stYLIStiC(Bar)");
-  is(elt.style.getPropertyValue("font-variant-alternates"),
-     "swash(fOo) stylistic(Bar)",
-     "expected case canonicalization of transform functions");
-}
+elt.setAttribute("style",
+                 "font-variant-alternates: SWASH(fOo) stYLIStiC(Bar)");
+is(elt.style.getPropertyValue("font-variant-alternates"),
+   "swash(fOo) stylistic(Bar)",
+   "expected case canonicalization of transform functions");
 
 elt.setAttribute("style", ""); // leave the page in a useful state
 
diff --git a/layout/style/test/test_system_font_serialization.html b/layout/style/test/test_system_font_serialization.html
index cd29b9a80f66..65b0168365dd 100644
--- a/layout/style/test/test_system_font_serialization.html
+++ b/layout/style/test/test_system_font_serialization.html
@@ -48,10 +48,7 @@ is(e.style.font, "", "font getter returns nothing");
 
 e.setAttribute("style", "font: inherit; font-family: Helvetica;");
 
-var cssTextStr = "font-style: inherit; font-variant: inherit; font-weight: inherit; font-size: inherit; line-height: inherit; font-size-adjust: inherit; font-stretch: inherit; -moz-font-feature-settings: inherit; -moz-font-language-override: inherit;";
-if (SpecialPowers.getBoolPref("layout.css.font-features.enabled")) {
-  cssTextStr += " font-kerning: inherit; font-synthesis: inherit; font-variant-alternates: inherit; font-variant-caps: inherit; font-variant-east-asian: inherit; font-variant-ligatures: inherit; font-variant-numeric: inherit; font-variant-position: inherit;"
-}
+var cssTextStr = "font-style: inherit; font-weight: inherit; font-size: inherit; line-height: inherit; font-size-adjust: inherit; font-stretch: inherit; font-feature-settings: inherit; font-language-override: inherit; font-kerning: inherit; font-synthesis: inherit; font-variant: inherit;";
 
 is(e.style.cssText, cssTextStr + " font-family: Helvetica;", "don't serialize system font for font:inherit");
 is(e.style.font, "", "font getter returns nothing");
diff --git a/layout/style/ua.css b/layout/style/ua.css
index f19892ca7544..0db24aab2813 100644
--- a/layout/style/ua.css
+++ b/layout/style/ua.css
@@ -96,10 +96,7 @@
 *|*::-moz-list-bullet, *|*::-moz-list-number {
   display: inline;
   vertical-align: baseline;
-  /* TODO: Replace this with font-variant-numeric:tabular-nums once the
-     font-variant-* properties are enabled for all channels (bug 975744). */
-  -moz-font-feature-settings: "tnum";
-  font-feature-settings: "tnum";
+  font-variant-numeric: tabular-nums;
 }
 
 /* Links */
diff --git a/layout/svg/nsSVGUtils.h b/layout/svg/nsSVGUtils.h
index 11e0dc3543b6..db81e4d5883a 100644
--- a/layout/svg/nsSVGUtils.h
+++ b/layout/svg/nsSVGUtils.h
@@ -90,10 +90,10 @@ public:
   SVGBBox() 
     : mIsEmpty(true) {}
 
-  SVGBBox(const Rect& aRect)
+  MOZ_IMPLICIT SVGBBox(const Rect& aRect)
     : mBBox(aRect), mIsEmpty(false) {}
 
-  SVGBBox(const gfxRect& aRect)
+  MOZ_IMPLICIT SVGBBox(const gfxRect& aRect)
     : mBBox(ToRect(aRect)), mIsEmpty(false) {}
 
   gfxRect ToThebesRect() const {
diff --git a/media/webrtc/signaling/src/media-conduit/WebrtcOMXH264VideoCodec.cpp b/media/webrtc/signaling/src/media-conduit/WebrtcOMXH264VideoCodec.cpp
index b27737cff903..82b30e58a1b2 100644
--- a/media/webrtc/signaling/src/media-conduit/WebrtcOMXH264VideoCodec.cpp
+++ b/media/webrtc/signaling/src/media-conduit/WebrtcOMXH264VideoCodec.cpp
@@ -225,6 +225,7 @@ public:
     , mStarted(false)
     , mDecodedFrameLock("WebRTC decoded frame lock")
     , mCallback(aCallback)
+    , mEnding(false)
   {
     // Create binder thread pool required by stagefright.
     android::ProcessState::self()->startThreadPool();
@@ -238,6 +239,7 @@ public:
 
   virtual ~WebrtcOMXDecoder()
   {
+    CODEC_LOGD("WebrtcOMXH264VideoDecoder:%p OMX destructor", this);
     if (mStarted) {
       Stop();
     }
@@ -418,6 +420,10 @@ public:
       {
         // Store info of this frame. OnNewFrame() will need the timestamp later.
         MutexAutoLock lock(mDecodedFrameLock);
+        if (mEnding) {
+          mCodec->releaseOutputBuffer(index);
+          return err;
+        }
         mDecodedFrames.push(frame);
       }
       // Ask codec to queue buffer back to native window. OnNewFrame() will be
@@ -504,6 +510,10 @@ private:
       return OK;
     }
 
+    {
+      MutexAutoLock lock(mDecodedFrameLock);
+      mEnding = false;
+    }
     status_t err = mCodec->start();
     if (err == OK) {
       mStarted = true;
@@ -525,12 +535,14 @@ private:
     // Drop all 'pending to render' frames.
     {
       MutexAutoLock lock(mDecodedFrameLock);
+      mEnding = true;
       while (!mDecodedFrames.empty()) {
         mDecodedFrames.pop();
       }
     }
 
     if (mOutputDrain != nullptr) {
+      CODEC_LOGD("decoder's OutputDrain stopping");
       mOutputDrain->Stop();
       mOutputDrain = nullptr;
     }
@@ -544,7 +556,6 @@ private:
       MOZ_ASSERT(false);
     }
     CODEC_LOGD("OMXOutputDrain decoder stopped");
-
     return err;
   }
 
@@ -561,8 +572,9 @@ private:
   RefPtr<OutputDrain> mOutputDrain;
   webrtc::DecodedImageCallback* mCallback;
 
-  Mutex mDecodedFrameLock; // To protect mDecodedFrames.
+  Mutex mDecodedFrameLock; // To protect mDecodedFrames and mEnding
   std::queue<EncodedFrame> mDecodedFrames;
+  bool mEnding;
 };
 
 class EncOutputDrain : public OMXOutputDrain
@@ -1111,7 +1123,7 @@ WebrtcOMXH264VideoDecoder::Release()
 {
   CODEC_LOGD("WebrtcOMXH264VideoDecoder:%p will be released", this);
 
-  mOMX = nullptr;
+  mOMX = nullptr; // calls Stop()
   mReservation->ReleaseOMXCodec();
 
   return WEBRTC_VIDEO_CODEC_OK;
diff --git a/memory/mozalloc/VolatileBuffer.h b/memory/mozalloc/VolatileBuffer.h
index 667600f81c97..89e875156efc 100644
--- a/memory/mozalloc/VolatileBuffer.h
+++ b/memory/mozalloc/VolatileBuffer.h
@@ -56,11 +56,11 @@ public:
 
   size_t HeapSizeOfExcludingThis(MallocSizeOf aMallocSizeOf) const;
   size_t NonHeapSizeOfExcludingThis() const;
+  bool OnHeap() const;
 
 protected:
   bool Lock(void** aBuf);
   void Unlock();
-  bool OnHeap() const;
 
 private:
   void* mBuf;
diff --git a/mobile/android/components/build/nsAndroidHistory.h b/mobile/android/components/build/nsAndroidHistory.h
index 8999915d79d9..ab5a957489e9 100644
--- a/mobile/android/components/build/nsAndroidHistory.h
+++ b/mobile/android/components/build/nsAndroidHistory.h
@@ -10,6 +10,7 @@
 #include "nsDataHashtable.h"
 #include "nsTPriorityQueue.h"
 #include "nsIRunnable.h"
+#include "nsIURI.h"
 
 #define NS_ANDROIDHISTORY_CID \
     {0xCCAA4880, 0x44DD, 0x40A7, {0xA1, 0x3F, 0x61, 0x56, 0xFC, 0x88, 0x2C, 0x0B}}
@@ -20,7 +21,7 @@
 // Max size of History::mEmbedURIs
 #define EMBED_URI_SIZE 128
 
-class nsAndroidHistory : public mozilla::IHistory, public nsIRunnable
+class nsAndroidHistory MOZ_FINAL : public mozilla::IHistory, public nsIRunnable
 {
 public:
   NS_DECL_ISUPPORTS
@@ -36,6 +37,8 @@ public:
   nsAndroidHistory();
 
 private:
+  ~nsAndroidHistory() {}
+
   static nsAndroidHistory* sHistory;
 
   nsDataHashtable<nsStringHashKey, nsTArray<mozilla::dom::Link *> *> mListeners;
diff --git a/mobile/android/components/build/nsShellService.h b/mobile/android/components/build/nsShellService.h
index 47ba069f15c8..f80569d48931 100644
--- a/mobile/android/components/build/nsShellService.h
+++ b/mobile/android/components/build/nsShellService.h
@@ -8,7 +8,7 @@
 
 #include "nsIShellService.h"
 
-class nsShellService : public nsIShellService
+class nsShellService MOZ_FINAL : public nsIShellService
 {
 public:
 
@@ -16,6 +16,8 @@ public:
   NS_DECL_NSISHELLSERVICE
 
   nsShellService() {};
+
+private:
   ~nsShellService() {};
 
 };
diff --git a/modules/libjar/nsJAR.cpp b/modules/libjar/nsJAR.cpp
index 60c782c70160..598de411e871 100644
--- a/modules/libjar/nsJAR.cpp
+++ b/modules/libjar/nsJAR.cpp
@@ -1147,6 +1147,8 @@ nsZipReaderCache::GetInnerZip(nsIFile* zipFile, const nsACString &entry,
   nsresult rv = GetZip(zipFile, getter_AddRefs(outerZipReader));
   NS_ENSURE_SUCCESS(rv, rv);
 
+  MutexAutoLock lock(mLock);
+
 #ifdef ZIP_CACHE_HIT_RATE
   mZipCacheLookups++;
 #endif
@@ -1189,7 +1191,6 @@ nsZipReaderCache::SetMustCacheFd(nsIFile* zipFile, bool aMustCacheFd)
   MOZ_CRASH("Not implemented");
   return NS_ERROR_NOT_IMPLEMENTED;
 #else
-  mMustCacheFd = aMustCacheFd;
 
   if (!aMustCacheFd) {
     return NS_OK;
@@ -1208,6 +1209,9 @@ nsZipReaderCache::SetMustCacheFd(nsIFile* zipFile, bool aMustCacheFd)
   uri.Insert(NS_LITERAL_CSTRING("file:"), 0);
 
   MutexAutoLock lock(mLock);
+
+  mMustCacheFd = aMustCacheFd;
+
   nsRefPtr<nsJAR> zip;
   mZips.Get(uri, getter_AddRefs(zip));
   if (!zip) {
@@ -1388,6 +1392,7 @@ nsZipReaderCache::Observe(nsISupports *aSubject,
     mZips.Enumerate(FindFlushableZip, nullptr);
   }
   else if (strcmp(aTopic, "chrome-flush-caches") == 0) {
+    MutexAutoLock lock(mLock);
     mZips.EnumerateRead(DropZipReaderCache, nullptr);
     mZips.Clear();
   }
diff --git a/modules/libpref/init/all.js b/modules/libpref/init/all.js
index 12dedaa261e2..87547ee5abdf 100644
--- a/modules/libpref/init/all.js
+++ b/modules/libpref/init/all.js
@@ -1990,25 +1990,13 @@ pref("layout.css.text-align-true-value.enabled", false);
 // Is support for the CSS4 image-orientation property enabled?
 pref("layout.css.image-orientation.enabled", true);
 
-// Is support for CSS3 Fonts features enabled?
-// (includes font-variant-*, font-kerning, font-synthesis
-// and the @font-feature-values rule)
-// Note: with this enabled, font-feature-settings is aliased
-// to -moz-font-feature-settings.  When unprefixing, this should
-// be reversed, -moz-font-feature-settings should alias to
-// font-feature-settings.
-#ifdef RELEASE_BUILD
-pref("layout.css.font-features.enabled", false);
-#else
-pref("layout.css.font-features.enabled", true);
-#endif
-
 // Are sets of prefixed properties supported?
 pref("layout.css.prefixes.border-image", true);
 pref("layout.css.prefixes.transforms", true);
 pref("layout.css.prefixes.transitions", true);
 pref("layout.css.prefixes.animations", true);
 pref("layout.css.prefixes.box-sizing", true);
+pref("layout.css.prefixes.font-features", true);
 
 // Is support for the :scope selector enabled?
 pref("layout.css.scope-pseudo.enabled", true);
diff --git a/netwerk/base/src/nsPACMan.cpp b/netwerk/base/src/nsPACMan.cpp
index 18a77f469f48..b78525216ded 100644
--- a/netwerk/base/src/nsPACMan.cpp
+++ b/netwerk/base/src/nsPACMan.cpp
@@ -113,6 +113,30 @@ private:
   nsCOMPtr<nsIThread> mThread;
 };
 
+// Dispatch this to wait until the PAC thread shuts down.
+
+class WaitForThreadShutdown MOZ_FINAL : public nsRunnable
+{
+public:
+  explicit WaitForThreadShutdown(nsPACMan *aPACMan)
+    : mPACMan(aPACMan)
+  {
+  }
+
+  NS_IMETHODIMP Run()
+  {
+    NS_ABORT_IF_FALSE(NS_IsMainThread(), "wrong thread");
+    if (mPACMan->mPACThread) {
+      mPACMan->mPACThread->Shutdown();
+      mPACMan->mPACThread = nullptr;
+    }
+    return NS_OK;
+  }
+
+private:
+  nsRefPtr<nsPACMan> mPACMan;
+};
+
 //-----------------------------------------------------------------------------
 
 // PACLoadComplete allows the PAC thread to tell the main thread that
@@ -292,9 +316,15 @@ void
 nsPACMan::Shutdown()
 {
   NS_ABORT_IF_FALSE(NS_IsMainThread(), "pacman must be shutdown on main thread");
-  CancelExistingLoad();
+  if (mShutdown) {
+    return;
+  }
   mShutdown = true;
+  CancelExistingLoad();
   PostCancelPendingQ(NS_ERROR_ABORT);
+
+  nsRefPtr<WaitForThreadShutdown> runnable = new WaitForThreadShutdown(this);
+  NS_DispatchToMainThread(runnable);
 }
 
 nsresult
@@ -502,11 +532,12 @@ nsPACMan::ProcessPendingQ()
   NS_ABORT_IF_FALSE(!NS_IsMainThread(), "wrong thread");
   while (ProcessPending());
 
-  // do GC while the thread has nothing pending
-  mPAC.GC();
-
-  if (mShutdown)
+  if (mShutdown) {
     mPAC.Shutdown();
+  } else {
+    // do GC while the thread has nothing pending
+    mPAC.GC();
+  }
 }
 
 // returns true if progress was made by shortening the queue
diff --git a/netwerk/base/src/nsPACMan.h b/netwerk/base/src/nsPACMan.h
index c8b0a70622a8..9f59a356fba7 100644
--- a/netwerk/base/src/nsPACMan.h
+++ b/netwerk/base/src/nsPACMan.h
@@ -24,6 +24,7 @@
 class nsPACMan;
 class nsISystemProxySettings;
 class nsIThread;
+class WaitForThreadShutdown;
 
 /**
  * This class defines a callback interface used by AsyncGetProxyForURI.
@@ -164,6 +165,7 @@ private:
   friend class PendingPACQuery;
   friend class PACLoadComplete;
   friend class ExecutePACThreadAction;
+  friend class WaitForThreadShutdown;
 
   ~nsPACMan();
 
diff --git a/security/sandbox/moz.build b/security/sandbox/moz.build
index cced08b51e9f..16be93c5be7a 100644
--- a/security/sandbox/moz.build
+++ b/security/sandbox/moz.build
@@ -146,6 +146,7 @@ elif CONFIG['OS_ARCH'] == 'WINNT':
         CXXFLAGS += [
             '-wd4275', # non dll-interface class exception used as base for dll-interface class
             '-wd4717', # recursive on all control paths, function will cause runtime stack overflow
+            '-wd4996', # 'GetVersionExW': was declared deprecated
         ]
 
 FAIL_ON_WARNINGS = True
diff --git a/services/crypto/modules/utils.js b/services/crypto/modules/utils.js
index 751f9d0a347b..113be5650759 100644
--- a/services/crypto/modules/utils.js
+++ b/services/crypto/modules/utils.js
@@ -393,7 +393,7 @@ this.CryptoUtils = {
    */
 
   stripHeaderAttributes: function(value) {
-    let value = value || "";
+    value = value || "";
     let i = value.indexOf(";");
     return value.substring(0, (i >= 0) ? i : undefined).trim().toLowerCase();
   },
diff --git a/services/fxaccounts/FxAccountsCommon.js b/services/fxaccounts/FxAccountsCommon.js
index 267e5ecdb7af..659bbe5b9b1e 100644
--- a/services/fxaccounts/FxAccountsCommon.js
+++ b/services/fxaccounts/FxAccountsCommon.js
@@ -21,7 +21,9 @@ const PREF_LOG_LEVEL_DUMP = "identity.fxaccounts.log.appender.dump";
 // identifiable info, credentials, etc) will be logged.
 const PREF_LOG_SENSITIVE_DETAILS = "identity.fxaccounts.log.sensitive";
 
-XPCOMUtils.defineLazyGetter(this, 'log', function() {
+let exports = Object.create(null);
+
+XPCOMUtils.defineLazyGetter(exports, 'log', function() {
   let log = Log.repository.getLogger("FirefoxAccounts");
   // We set the log level to debug, but the default dump appender is set to
   // the level reflected in the pref.  Other code that consumes FxA may then
@@ -52,7 +54,7 @@ XPCOMUtils.defineLazyGetter(this, 'log', function() {
 
 // A boolean to indicate if personally identifiable information (or anything
 // else sensitive, such as credentials) should be logged.
-XPCOMUtils.defineLazyGetter(this, 'logPII', function() {
+XPCOMUtils.defineLazyGetter(exports, 'logPII', function() {
   try {
     return Services.prefs.getBoolPref(PREF_LOG_SENSITIVE_DETAILS);
   } catch (_) {
@@ -60,101 +62,123 @@ XPCOMUtils.defineLazyGetter(this, 'logPII', function() {
   }
 });
 
-this.FXACCOUNTS_PERMISSION = "firefox-accounts";
+exports.FXACCOUNTS_PERMISSION = "firefox-accounts";
 
-this.DATA_FORMAT_VERSION = 1;
-this.DEFAULT_STORAGE_FILENAME = "signedInUser.json";
+exports.DATA_FORMAT_VERSION = 1;
+exports.DEFAULT_STORAGE_FILENAME = "signedInUser.json";
 
 // Token life times.
 // Having this parameter be short has limited security value and can cause
 // spurious authentication values if the client's clock is skewed and
 // we fail to adjust. See Bug 983256.
-this.ASSERTION_LIFETIME = 1000 * 3600 * 24 * 365 * 25; // 25 years
+exports.ASSERTION_LIFETIME = 1000 * 3600 * 24 * 365 * 25; // 25 years
 // This is a time period we want to guarantee that the assertion will be
 // valid after we generate it (e.g., the signed cert won't expire in this
 // period).
-this.ASSERTION_USE_PERIOD = 1000 * 60 * 5; // 5 minutes
-this.CERT_LIFETIME      = 1000 * 3600 * 6;  // 6 hours
-this.KEY_LIFETIME       = 1000 * 3600 * 12; // 12 hours
+exports.ASSERTION_USE_PERIOD = 1000 * 60 * 5; // 5 minutes
+exports.CERT_LIFETIME      = 1000 * 3600 * 6;  // 6 hours
+exports.KEY_LIFETIME       = 1000 * 3600 * 12; // 12 hours
 
 // Polling timings.
-this.POLL_SESSION       = 1000 * 60 * 5;    // 5 minutes
-this.POLL_STEP          = 1000 * 3;         // 3 seconds
+exports.POLL_SESSION       = 1000 * 60 * 5;    // 5 minutes
+exports.POLL_STEP          = 1000 * 3;         // 3 seconds
 
 // Observer notifications.
-this.ONLOGIN_NOTIFICATION = "fxaccounts:onlogin";
-this.ONVERIFIED_NOTIFICATION = "fxaccounts:onverified";
-this.ONLOGOUT_NOTIFICATION = "fxaccounts:onlogout";
+exports.ONLOGIN_NOTIFICATION = "fxaccounts:onlogin";
+exports.ONVERIFIED_NOTIFICATION = "fxaccounts:onverified";
+exports.ONLOGOUT_NOTIFICATION = "fxaccounts:onlogout";
 // Internal to services/fxaccounts only
-this.ON_FXA_UPDATE_NOTIFICATION = "fxaccounts:update";
+exports.ON_FXA_UPDATE_NOTIFICATION = "fxaccounts:update";
 
 // UI Requests.
-this.UI_REQUEST_SIGN_IN_FLOW = "signInFlow";
-this.UI_REQUEST_REFRESH_AUTH = "refreshAuthentication";
+exports.UI_REQUEST_SIGN_IN_FLOW = "signInFlow";
+exports.UI_REQUEST_REFRESH_AUTH = "refreshAuthentication";
 
 // Server errno.
 // From https://github.com/mozilla/fxa-auth-server/blob/master/docs/api.md#response-format
-this.ERRNO_ACCOUNT_ALREADY_EXISTS         = 101;
-this.ERRNO_ACCOUNT_DOES_NOT_EXIST         = 102;
-this.ERRNO_INCORRECT_PASSWORD             = 103;
-this.ERRNO_UNVERIFIED_ACCOUNT             = 104;
-this.ERRNO_INVALID_VERIFICATION_CODE      = 105;
-this.ERRNO_NOT_VALID_JSON_BODY            = 106;
-this.ERRNO_INVALID_BODY_PARAMETERS        = 107;
-this.ERRNO_MISSING_BODY_PARAMETERS        = 108;
-this.ERRNO_INVALID_REQUEST_SIGNATURE      = 109;
-this.ERRNO_INVALID_AUTH_TOKEN             = 110;
-this.ERRNO_INVALID_AUTH_TIMESTAMP         = 111;
-this.ERRNO_MISSING_CONTENT_LENGTH         = 112;
-this.ERRNO_REQUEST_BODY_TOO_LARGE         = 113;
-this.ERRNO_TOO_MANY_CLIENT_REQUESTS       = 114;
-this.ERRNO_INVALID_AUTH_NONCE             = 115;
-this.ERRNO_ENDPOINT_NO_LONGER_SUPPORTED   = 116;
-this.ERRNO_INCORRECT_LOGIN_METHOD         = 117;
-this.ERRNO_INCORRECT_KEY_RETRIEVAL_METHOD = 118;
-this.ERRNO_INCORRECT_API_VERSION          = 119;
-this.ERRNO_INCORRECT_EMAIL_CASE           = 120;
-this.ERRNO_SERVICE_TEMP_UNAVAILABLE       = 201;
-this.ERRNO_UNKNOWN_ERROR                  = 999;
+exports.ERRNO_ACCOUNT_ALREADY_EXISTS         = 101;
+exports.ERRNO_ACCOUNT_DOES_NOT_EXIST         = 102;
+exports.ERRNO_INCORRECT_PASSWORD             = 103;
+exports.ERRNO_UNVERIFIED_ACCOUNT             = 104;
+exports.ERRNO_INVALID_VERIFICATION_CODE      = 105;
+exports.ERRNO_NOT_VALID_JSON_BODY            = 106;
+exports.ERRNO_INVALID_BODY_PARAMETERS        = 107;
+exports.ERRNO_MISSING_BODY_PARAMETERS        = 108;
+exports.ERRNO_INVALID_REQUEST_SIGNATURE      = 109;
+exports.ERRNO_INVALID_AUTH_TOKEN             = 110;
+exports.ERRNO_INVALID_AUTH_TIMESTAMP         = 111;
+exports.ERRNO_MISSING_CONTENT_LENGTH         = 112;
+exports.ERRNO_REQUEST_BODY_TOO_LARGE         = 113;
+exports.ERRNO_TOO_MANY_CLIENT_REQUESTS       = 114;
+exports.ERRNO_INVALID_AUTH_NONCE             = 115;
+exports.ERRNO_ENDPOINT_NO_LONGER_SUPPORTED   = 116;
+exports.ERRNO_INCORRECT_LOGIN_METHOD         = 117;
+exports.ERRNO_INCORRECT_KEY_RETRIEVAL_METHOD = 118;
+exports.ERRNO_INCORRECT_API_VERSION          = 119;
+exports.ERRNO_INCORRECT_EMAIL_CASE           = 120;
+exports.ERRNO_SERVICE_TEMP_UNAVAILABLE       = 201;
+exports.ERRNO_UNKNOWN_ERROR                  = 999;
 
 // Errors.
-this.ERROR_ACCOUNT_ALREADY_EXISTS         = "ACCOUNT_ALREADY_EXISTS";
-this.ERROR_ACCOUNT_DOES_NOT_EXIST         = "ACCOUNT_DOES_NOT_EXIST ";
-this.ERROR_ALREADY_SIGNED_IN_USER         = "ALREADY_SIGNED_IN_USER";
-this.ERROR_ENDPOINT_NO_LONGER_SUPPORTED   = "ENDPOINT_NO_LONGER_SUPPORTED";
-this.ERROR_INCORRECT_API_VERSION          = "INCORRECT_API_VERSION";
-this.ERROR_INCORRECT_EMAIL_CASE           = "INCORRECT_EMAIL_CASE";
-this.ERROR_INCORRECT_KEY_RETRIEVAL_METHOD = "INCORRECT_KEY_RETRIEVAL_METHOD";
-this.ERROR_INCORRECT_LOGIN_METHOD         = "INCORRECT_LOGIN_METHOD";
-this.ERROR_INVALID_EMAIL                  = "INVALID_EMAIL";
-this.ERROR_INVALID_AUDIENCE               = "INVALID_AUDIENCE";
-this.ERROR_INVALID_AUTH_TOKEN             = "INVALID_AUTH_TOKEN";
-this.ERROR_INVALID_AUTH_TIMESTAMP         = "INVALID_AUTH_TIMESTAMP";
-this.ERROR_INVALID_AUTH_NONCE             = "INVALID_AUTH_NONCE";
-this.ERROR_INVALID_BODY_PARAMETERS        = "INVALID_BODY_PARAMETERS";
-this.ERROR_INVALID_PASSWORD               = "INVALID_PASSWORD";
-this.ERROR_INVALID_VERIFICATION_CODE      = "INVALID_VERIFICATION_CODE";
-this.ERROR_INVALID_REFRESH_AUTH_VALUE     = "INVALID_REFRESH_AUTH_VALUE";
-this.ERROR_INVALID_REQUEST_SIGNATURE      = "INVALID_REQUEST_SIGNATURE";
-this.ERROR_INTERNAL_INVALID_USER          = "INTERNAL_ERROR_INVALID_USER";
-this.ERROR_MISSING_BODY_PARAMETERS        = "MISSING_BODY_PARAMETERS";
-this.ERROR_MISSING_CONTENT_LENGTH         = "MISSING_CONTENT_LENGTH";
-this.ERROR_NO_TOKEN_SESSION               = "NO_TOKEN_SESSION";
-this.ERROR_NO_SILENT_REFRESH_AUTH         = "NO_SILENT_REFRESH_AUTH";
-this.ERROR_NOT_VALID_JSON_BODY            = "NOT_VALID_JSON_BODY";
-this.ERROR_OFFLINE                        = "OFFLINE";
-this.ERROR_PERMISSION_DENIED              = "PERMISSION_DENIED";
-this.ERROR_REQUEST_BODY_TOO_LARGE         = "REQUEST_BODY_TOO_LARGE";
-this.ERROR_SERVER_ERROR                   = "SERVER_ERROR";
-this.ERROR_TOO_MANY_CLIENT_REQUESTS       = "TOO_MANY_CLIENT_REQUESTS";
-this.ERROR_SERVICE_TEMP_UNAVAILABLE       = "SERVICE_TEMPORARY_UNAVAILABLE";
-this.ERROR_UI_ERROR                       = "UI_ERROR";
-this.ERROR_UI_REQUEST                     = "UI_REQUEST";
-this.ERROR_UNKNOWN                        = "UNKNOWN_ERROR";
-this.ERROR_UNVERIFIED_ACCOUNT             = "UNVERIFIED_ACCOUNT";
+exports.ERROR_ACCOUNT_ALREADY_EXISTS         = "ACCOUNT_ALREADY_EXISTS";
+exports.ERROR_ACCOUNT_DOES_NOT_EXIST         = "ACCOUNT_DOES_NOT_EXIST ";
+exports.ERROR_ALREADY_SIGNED_IN_USER         = "ALREADY_SIGNED_IN_USER";
+exports.ERROR_ENDPOINT_NO_LONGER_SUPPORTED   = "ENDPOINT_NO_LONGER_SUPPORTED";
+exports.ERROR_INCORRECT_API_VERSION          = "INCORRECT_API_VERSION";
+exports.ERROR_INCORRECT_EMAIL_CASE           = "INCORRECT_EMAIL_CASE";
+exports.ERROR_INCORRECT_KEY_RETRIEVAL_METHOD = "INCORRECT_KEY_RETRIEVAL_METHOD";
+exports.ERROR_INCORRECT_LOGIN_METHOD         = "INCORRECT_LOGIN_METHOD";
+exports.ERROR_INVALID_EMAIL                  = "INVALID_EMAIL";
+exports.ERROR_INVALID_AUDIENCE               = "INVALID_AUDIENCE";
+exports.ERROR_INVALID_AUTH_TOKEN             = "INVALID_AUTH_TOKEN";
+exports.ERROR_INVALID_AUTH_TIMESTAMP         = "INVALID_AUTH_TIMESTAMP";
+exports.ERROR_INVALID_AUTH_NONCE             = "INVALID_AUTH_NONCE";
+exports.ERROR_INVALID_BODY_PARAMETERS        = "INVALID_BODY_PARAMETERS";
+exports.ERROR_INVALID_PASSWORD               = "INVALID_PASSWORD";
+exports.ERROR_INVALID_VERIFICATION_CODE      = "INVALID_VERIFICATION_CODE";
+exports.ERROR_INVALID_REFRESH_AUTH_VALUE     = "INVALID_REFRESH_AUTH_VALUE";
+exports.ERROR_INVALID_REQUEST_SIGNATURE      = "INVALID_REQUEST_SIGNATURE";
+exports.ERROR_INTERNAL_INVALID_USER          = "INTERNAL_ERROR_INVALID_USER";
+exports.ERROR_MISSING_BODY_PARAMETERS        = "MISSING_BODY_PARAMETERS";
+exports.ERROR_MISSING_CONTENT_LENGTH         = "MISSING_CONTENT_LENGTH";
+exports.ERROR_NO_TOKEN_SESSION               = "NO_TOKEN_SESSION";
+exports.ERROR_NO_SILENT_REFRESH_AUTH         = "NO_SILENT_REFRESH_AUTH";
+exports.ERROR_NOT_VALID_JSON_BODY            = "NOT_VALID_JSON_BODY";
+exports.ERROR_OFFLINE                        = "OFFLINE";
+exports.ERROR_PERMISSION_DENIED              = "PERMISSION_DENIED";
+exports.ERROR_REQUEST_BODY_TOO_LARGE         = "REQUEST_BODY_TOO_LARGE";
+exports.ERROR_SERVER_ERROR                   = "SERVER_ERROR";
+exports.ERROR_TOO_MANY_CLIENT_REQUESTS       = "TOO_MANY_CLIENT_REQUESTS";
+exports.ERROR_SERVICE_TEMP_UNAVAILABLE       = "SERVICE_TEMPORARY_UNAVAILABLE";
+exports.ERROR_UI_ERROR                       = "UI_ERROR";
+exports.ERROR_UI_REQUEST                     = "UI_REQUEST";
+exports.ERROR_UNKNOWN                        = "UNKNOWN_ERROR";
+exports.ERROR_UNVERIFIED_ACCOUNT             = "UNVERIFIED_ACCOUNT";
+
+// FxAccounts has the ability to "split" the credentials between a plain-text
+// JSON file in the profile dir and in the login manager.
+// These constants relate to that.
+
+// The fields we save in the plaintext JSON.
+// See bug 1013064 comments 23-25 for why the sessionToken is "safe"
+exports.FXA_PWDMGR_PLAINTEXT_FIELDS = ["email", "verified", "authAt",
+                                       "sessionToken", "uid"];
+// The pseudo-host we use in the login manager
+exports.FXA_PWDMGR_HOST = "chrome://FirefoxAccounts";
+// The realm we use in the login manager.
+exports.FXA_PWDMGR_REALM = "Firefox Accounts credentials";
 
 // Error matching.
-this.SERVER_ERRNO_TO_ERROR = {};
+exports.SERVER_ERRNO_TO_ERROR = {};
+
+for (let id in exports) {
+  this[id] = exports[id];
+}
+
+// Allow this file to be imported via Components.utils.import().
+this.EXPORTED_SYMBOLS = Object.keys(exports);
+
+// Set these up now that everything has been loaded into |this|.
 SERVER_ERRNO_TO_ERROR[ERRNO_ACCOUNT_ALREADY_EXISTS]         = ERROR_ACCOUNT_ALREADY_EXISTS;
 SERVER_ERRNO_TO_ERROR[ERRNO_ACCOUNT_DOES_NOT_EXIST]         = ERROR_ACCOUNT_DOES_NOT_EXIST;
 SERVER_ERRNO_TO_ERROR[ERRNO_INCORRECT_PASSWORD]             = ERROR_INVALID_PASSWORD;
@@ -177,19 +201,3 @@ SERVER_ERRNO_TO_ERROR[ERRNO_INCORRECT_API_VERSION]          = ERROR_INCORRECT_AP
 SERVER_ERRNO_TO_ERROR[ERRNO_INCORRECT_EMAIL_CASE]           = ERROR_INCORRECT_EMAIL_CASE;
 SERVER_ERRNO_TO_ERROR[ERRNO_SERVICE_TEMP_UNAVAILABLE]       = ERROR_SERVICE_TEMP_UNAVAILABLE;
 SERVER_ERRNO_TO_ERROR[ERRNO_UNKNOWN_ERROR]                  = ERROR_UNKNOWN;
-
-// FxAccounts has the ability to "split" the credentials between a plain-text
-// JSON file in the profile dir and in the login manager.
-// These constants relate to that.
-
-// The fields we save in the plaintext JSON.
-// See bug 1013064 comments 23-25 for why the sessionToken is "safe"
-this.FXA_PWDMGR_PLAINTEXT_FIELDS = ["email", "verified", "authAt",
-                                    "sessionToken", "uid"];
-// The pseudo-host we use in the login manager
-this.FXA_PWDMGR_HOST = "chrome://FirefoxAccounts";
-// The realm we use in the login manager.
-this.FXA_PWDMGR_REALM = "Firefox Accounts credentials";
-
-// Allow this file to be imported via Components.utils.import().
-this.EXPORTED_SYMBOLS = Object.keys(this);
diff --git a/services/fxaccounts/FxAccountsOAuthClient.jsm b/services/fxaccounts/FxAccountsOAuthClient.jsm
index c59c84cdc0fa..0ef832776151 100644
--- a/services/fxaccounts/FxAccountsOAuthClient.jsm
+++ b/services/fxaccounts/FxAccountsOAuthClient.jsm
@@ -11,6 +11,7 @@ this.EXPORTED_SYMBOLS = ["FxAccountsOAuthClient"];
 
 const {classes: Cc, interfaces: Ci, utils: Cu, results: Cr} = Components;
 
+Cu.import("resource://gre/modules/XPCOMUtils.jsm");
 Cu.import("resource://gre/modules/Log.jsm");
 Cu.import("resource://gre/modules/Services.jsm");
 Cu.import("resource://gre/modules/FxAccountsCommon.js");
diff --git a/services/healthreport/providers.jsm b/services/healthreport/providers.jsm
index 8dc8ca8455d7..2e5b0036c3fa 100644
--- a/services/healthreport/providers.jsm
+++ b/services/healthreport/providers.jsm
@@ -865,12 +865,12 @@ AddonsProvider.prototype = Object.freeze({
   _collectAndStoreAddons: function () {
     let deferred = Promise.defer();
 
-    AddonManager.getAllAddons(function onAllAddons(addons) {
+    AddonManager.getAllAddons(function onAllAddons(allAddons) {
       let data;
       let addonsField;
       let pluginsField;
       try {
-        data = this._createDataStructure(addons);
+        data = this._createDataStructure(allAddons);
         addonsField = JSON.stringify(data.addons);
         pluginsField = JSON.stringify(data.plugins);
       } catch (ex) {
diff --git a/services/sync/modules/status.js b/services/sync/modules/status.js
index 2b290e6c4f7d..19dff9712496 100644
--- a/services/sync/modules/status.js
+++ b/services/sync/modules/status.js
@@ -42,7 +42,7 @@ this.Status = {
   },
 
   set service(code) {
-    this._log.debug("Status.service: " + this._service + " => " + code);
+    this._log.debug("Status.service: " + (this._service || undefined) + " => " + code);
     this._service = code;
   },
 
diff --git a/testing/mozbase/mozversion/tests/test_apk.py b/testing/mozbase/mozversion/tests/test_apk.py
new file mode 100644
index 000000000000..3cdde623aecf
--- /dev/null
+++ b/testing/mozbase/mozversion/tests/test_apk.py
@@ -0,0 +1,32 @@
+#!/usr/bin/env python
+
+# This Source Code Form is subject to the terms of the Mozilla Public
+# License, v. 2.0. If a copy of the MPL was not distributed with this file,
+# You can obtain one at http://mozilla.org/MPL/2.0/.
+
+import mozfile
+import unittest
+import zipfile
+from mozversion import get_version
+
+
+class ApkTest(unittest.TestCase):
+    """test getting version information from an android .apk"""
+
+    application_changeset = 'a'*40
+    platform_changeset = 'b'*40
+
+    def test_basic(self):
+        with mozfile.NamedTemporaryFile() as f:
+            with zipfile.ZipFile(f.name, 'w') as z:
+                z.writestr('application.ini',
+                           """[App]\nSourceStamp=%s\n""" % self.application_changeset)
+                z.writestr('platform.ini',
+                           """[Build]\nSourceStamp=%s\n""" % self.platform_changeset)
+                z.writestr('AndroidManifest.xml', '')
+            v = get_version(f.name)
+            self.assertEqual(v.get('application_changeset'), self.application_changeset)
+            self.assertEqual(v.get('platform_changeset'), self.platform_changeset)
+
+if __name__ == '__main__':
+    unittest.main()
diff --git a/toolkit/components/aboutmemory/content/aboutMemory.js b/toolkit/components/aboutmemory/content/aboutMemory.js
index 6eb1c32f8a96..41981aa131ed 100644
--- a/toolkit/components/aboutmemory/content/aboutMemory.js
+++ b/toolkit/components/aboutmemory/content/aboutMemory.js
@@ -823,10 +823,10 @@ function makeDReportMap(aJSONReports)
     // e.g. PIDs, addresses, null principal UUIDs. (Note that we don't strip
     // out all UUIDs because some of them -- such as those used by add-ons --
     // are deterministic.)
-    let strippedProcess = jr.process.replace(/pid \d+/, "pid NNN");
-    let strippedPath = jr.path.replace(/0x[0-9A-Fa-f]+/, "0xNNN");
+    let strippedProcess = jr.process.replace(/pid \d+/g, "pid NNN");
+    let strippedPath = jr.path.replace(/0x[0-9A-Fa-f]+/g, "0xNNN");
     strippedPath = strippedPath.replace(
-      /moz-nullprincipal:{........-....-....-....-............}/,
+      /moz-nullprincipal:{........-....-....-....-............}/g,
       "moz-nullprincipal:{NNNNNNNN-NNNN-NNNN-NNNN-NNNNNNNNNNNN}");
     let processPath = strippedProcess + kProcessPathSep + strippedPath;
 
diff --git a/toolkit/components/aboutmemory/tests/memory-reports-diff1.json b/toolkit/components/aboutmemory/tests/memory-reports-diff1.json
index 5541fa668767..aa3b4cbbc030 100644
--- a/toolkit/components/aboutmemory/tests/memory-reports-diff1.json
+++ b/toolkit/components/aboutmemory/tests/memory-reports-diff1.json
@@ -20,7 +20,7 @@
     {"process": "P", "path": "a/c/g", "kind": 2, "units": 0, "amount": 3000000, "description": "Desc."},
     {"process": "P", "path": "a/h", "kind": 2, "units": 0, "amount": 1000, "description": "Desc."},
 
-    {"process": "P2 (pid 22)", "path": "z-moz-nullprincipal:{85e250f3-57ae-46c4-a11e-4176dd39d9c5} 0x1234", "kind": 2, "units": 0, "amount": 33, "description": "Desc."},
+    {"process": "P2 (pid 22)", "path": "z-moz-nullprincipal:{85e250f3-57ae-46c4-a11e-4176dd39d9c5} 0x1234-blah(0x2345)", "kind": 2, "units": 0, "amount": 33, "description": "Desc."},
 
     {"process": "P3", "path": "p3", "kind": 2, "units": 0, "amount": 55, "description": "Desc."},
 
diff --git a/toolkit/components/aboutmemory/tests/memory-reports-diff2.json b/toolkit/components/aboutmemory/tests/memory-reports-diff2.json
index 409cfce83074..ee36643233a7 100644
--- a/toolkit/components/aboutmemory/tests/memory-reports-diff2.json
+++ b/toolkit/components/aboutmemory/tests/memory-reports-diff2.json
@@ -21,7 +21,7 @@
     {"process": "P", "path": "a/c/g", "kind": 2, "units": 0, "amount": 3001000, "description": "Desc."},
     {"process": "P", "path": "a/h", "kind": 2, "units": 0, "amount": 2000, "description": "Desc."},
 
-    {"process": "P2 (pid 33)", "path": "z-moz-nullprincipal:{161effaa-c1f7-4010-a08e-e7c9aea01aed} 0x5678", "kind": 2, "units": 0, "amount": 44, "description": "Desc."},
+    {"process": "P2 (pid 33)", "path": "z-moz-nullprincipal:{161effaa-c1f7-4010-a08e-e7c9aea01aed} 0x5678-blah(0x6789)", "kind": 2, "units": 0, "amount": 44, "description": "Desc."},
 
     {"process": "P4", "path": "p4", "kind": 2, "units": 0, "amount": 66, "description": "Desc."},
 
diff --git a/toolkit/components/aboutmemory/tests/test_aboutmemory3.xul b/toolkit/components/aboutmemory/tests/test_aboutmemory3.xul
index 4eaecd8acabe..6cc2231648d2 100644
--- a/toolkit/components/aboutmemory/tests/test_aboutmemory3.xul
+++ b/toolkit/components/aboutmemory/tests/test_aboutmemory3.xul
@@ -307,7 +307,7 @@ End of P\n\
 P2 (pid NNN)\n\
 Other Measurements\n\
 \n\
-0.00 MB ── z-moz-nullprincipal:{NNNNNNNN-NNNN-NNNN-NNNN-NNNNNNNNNNNN} 0xNNN\n\
+0.00 MB ── z-moz-nullprincipal:{NNNNNNNN-NNNN-NNNN-NNNN-NNNNNNNNNNNN} 0xNNN-blah(0xNNN)\n\
 \n\
 End of P2 (pid NNN)\n\
 P3\n\
@@ -382,7 +382,7 @@ End of P\n\
 P2 (pid NNN)\n\
 Other Measurements\n\
 \n\
-11 B ── z-moz-nullprincipal:{NNNNNNNN-NNNN-NNNN-NNNN-NNNNNNNNNNNN} 0xNNN\n\
+11 B ── z-moz-nullprincipal:{NNNNNNNN-NNNN-NNNN-NNNN-NNNNNNNNNNNN} 0xNNN-blah(0xNNN)\n\
 \n\
 End of P2 (pid NNN)\n\
 P3\n\
diff --git a/toolkit/components/contentprefs/ContentPrefService2.jsm b/toolkit/components/contentprefs/ContentPrefService2.jsm
index fff6fa4cbcdc..9c45e1e0c8a7 100644
--- a/toolkit/components/contentprefs/ContentPrefService2.jsm
+++ b/toolkit/components/contentprefs/ContentPrefService2.jsm
@@ -666,7 +666,7 @@ ContentPrefService2.prototype = {
    *             spaces.  Call like _stmt("SELECT *", "FROM foo").
    * @return     The cached, possibly new, statement.
    */
-  _stmt: function CPS2__stmt(sql /*, sql2, sql3, ... */) {
+  _stmt: function CPS2__stmt(sql1 /*, sql2, sql3, ... */) {
     let sql = joinArgs(arguments);
     if (!this._statements)
       this._statements = {};
diff --git a/toolkit/components/crashes/CrashManager.jsm b/toolkit/components/crashes/CrashManager.jsm
index 7a57235c7d7e..2ebe18dd9ecc 100644
--- a/toolkit/components/crashes/CrashManager.jsm
+++ b/toolkit/components/crashes/CrashManager.jsm
@@ -395,7 +395,7 @@ this.CrashManager.prototype = Object.freeze({
 
   _addSubmissionAsCrash: function (store, processType, crashType, succeeded,
                                    id, date) {
-    let id = id + "-" + this.PROCESS_TYPE_SUBMISSION;
+    id += "-" + this.PROCESS_TYPE_SUBMISSION;
     let process = processType + "-" + crashType + "-" +
                   this.PROCESS_TYPE_SUBMISSION;
     let submission_type = (
diff --git a/toolkit/components/downloads/ApplicationReputation.cpp b/toolkit/components/downloads/ApplicationReputation.cpp
index c0cc37881cc8..2837f72632e8 100644
--- a/toolkit/components/downloads/ApplicationReputation.cpp
+++ b/toolkit/components/downloads/ApplicationReputation.cpp
@@ -422,6 +422,14 @@ PendingLookup::LookupNext()
     return lookup->LookupSpec(spec, true);
   }
 #ifdef XP_WIN
+  // If there is no service URL for querying application reputation, abort.
+  nsCString serviceUrl;
+  NS_ENSURE_SUCCESS(Preferences::GetCString(PREF_SB_APP_REP_URL, &serviceUrl),
+                    NS_ERROR_NOT_AVAILABLE);
+  if (serviceUrl.EqualsLiteral("")) {
+    return OnComplete(false, NS_ERROR_NOT_AVAILABLE);
+  }
+
   // There are no more URIs to check against local list. If the file is not
   // eligible for remote lookup, bail.
   if (!IsBinaryFile()) {
@@ -1066,14 +1074,6 @@ nsresult ApplicationReputationService::QueryReputationInternal(
     return NS_ERROR_NOT_AVAILABLE;
   }
 
-  // If there is no service URL for querying application reputation, abort.
-  nsCString serviceUrl;
-  NS_ENSURE_SUCCESS(Preferences::GetCString(PREF_SB_APP_REP_URL, &serviceUrl),
-                    NS_ERROR_NOT_AVAILABLE);
-  if (serviceUrl.EqualsLiteral("")) {
-    return NS_ERROR_NOT_AVAILABLE;
-  }
-
   nsCOMPtr<nsIURI> uri;
   rv = aQuery->GetSourceURI(getter_AddRefs(uri));
   NS_ENSURE_SUCCESS(rv, rv);
diff --git a/toolkit/components/downloads/nsDownloadManager.cpp b/toolkit/components/downloads/nsDownloadManager.cpp
index 8f3e11e86847..c43ece588340 100644
--- a/toolkit/components/downloads/nsDownloadManager.cpp
+++ b/toolkit/components/downloads/nsDownloadManager.cpp
@@ -945,31 +945,13 @@ nsDownloadManager::Init()
   // When MOZ_JSDOWNLOADS is undefined, we still check the preference that can
   // be used to enable the JavaScript API during the migration process.
   mUseJSTransfer = Preferences::GetBool(PREF_BD_USEJSTRANSFER, false);
-#else
-
-  nsAutoCString appID;
-  nsCOMPtr<nsIXULAppInfo> info = do_GetService("@mozilla.org/xre/app-info;1");
-  if (info) {
-    rv = info->GetID(appID);
-    NS_ENSURE_SUCCESS(rv, rv);
-  }
-
-  // The webapp runtime doesn't use the new JS downloads API yet.
-  // The conversion of the webapp runtime to use the JavaScript API for
-  // downloads is tracked in bug 911636.
-  if (appID.EqualsLiteral("webapprt@mozilla.org")) {
-    mUseJSTransfer = false;
-  } else {
-#if !defined(XP_WIN)
-    mUseJSTransfer = true;
-#else
+#elif defined(XP_WIN)
     // When MOZ_JSDOWNLOADS is defined on Windows, this component is disabled
     // unless we are running in Windows Metro.  The conversion of Windows Metro
     // to use the JavaScript API for downloads is tracked in bug 906042.
     mUseJSTransfer = !IsRunningInWindowsMetro();
-#endif
-  }
-
+#else
+    mUseJSTransfer = true;
 #endif
 
   if (mUseJSTransfer)
diff --git a/toolkit/components/downloads/test/unit/test_app_rep.js b/toolkit/components/downloads/test/unit/test_app_rep.js
index e24e433ec66a..2592525807d6 100644
--- a/toolkit/components/downloads/test/unit/test_app_rep.js
+++ b/toolkit/components/downloads/test/unit/test_app_rep.js
@@ -164,21 +164,6 @@ add_test(function test_nullCallback() {
   }
 });
 
-add_test(function test_disabled() {
-  let counts = get_telemetry_counts();
-  Services.prefs.setCharPref("browser.safebrowsing.appRepURL", "");
-  gAppRep.queryReputation({
-    sourceURI: createURI("http://example.com"),
-    fileSize: 12,
-  }, function onComplete(aShouldBlock, aStatus) {
-    // We should be getting NS_ERROR_NOT_AVAILABLE if the service is disabled
-    do_check_eq(Cr.NS_ERROR_NOT_AVAILABLE, aStatus);
-    do_check_false(aShouldBlock);
-    check_telemetry(counts.total + 1, counts.shouldBlock, counts.listCounts);
-    run_next_test();
-  });
-});
-
 // Set up the local whitelist.
 add_test(function test_local_list() {
   // Construct a response with redirect urls.
diff --git a/toolkit/components/search/nsSearchService.js b/toolkit/components/search/nsSearchService.js
index e3eb8494efd5..4259763265c0 100644
--- a/toolkit/components/search/nsSearchService.js
+++ b/toolkit/components/search/nsSearchService.js
@@ -4410,7 +4410,7 @@ SearchService.prototype = {
     // Therefore, we need to walk our engine-list, looking for expired engines
     var currentTime = Date.now();
     LOG("currentTime: " + currentTime);
-    for each (engine in this._engines) {
+    for each (let engine in this._engines) {
       engine = engine.wrappedJSObject;
       if (!engine._hasUpdates)
         continue;
diff --git a/toolkit/content/browser-child.js b/toolkit/content/browser-child.js
index f94b8cb7b3dd..96a15a47e3ef 100644
--- a/toolkit/content/browser-child.js
+++ b/toolkit/content/browser-child.js
@@ -434,8 +434,12 @@ let AutoCompletePopup = {
   }
 }
 
-let [initData] = sendSyncMessage("Browser:Init");
-docShell.useGlobalHistory = initData.useGlobalHistory;
-if (initData.initPopup) {
-  setTimeout(function() AutoCompletePopup.init(), 0);
+// We may not get any responses to Browser:Init if the browser element
+// is torn down too quickly.
+let initData = sendSyncMessage("Browser:Init");
+if (initData.length) {
+  docShell.useGlobalHistory = initData[0].useGlobalHistory;
+  if (initData[0].initPopup) {
+    setTimeout(() => AutoCompletePopup.init(), 0);
+  }
 }
diff --git a/toolkit/content/tests/chrome/test_bug437844.xul b/toolkit/content/tests/chrome/test_bug437844.xul
index d58dfc68bec8..0a8dbb384dcc 100644
--- a/toolkit/content/tests/chrome/test_bug437844.xul
+++ b/toolkit/content/tests/chrome/test_bug437844.xul
@@ -37,7 +37,7 @@ https://bugzilla.mozilla.org/show_bug.cgi?id=348233
   <script class="testbody" type="application/javascript">
     <![CDATA[
 
-      SimpleTest.expectAssertions(20, 21);
+      SimpleTest.expectAssertions(19, 21);
 
       /** Test for Bug 437844 and Bug 348233 **/
       SimpleTest.waitForExplicitFinish();
diff --git a/toolkit/content/widgets/popup.xml b/toolkit/content/widgets/popup.xml
index 5491ee3881c8..485c44bf7413 100644
--- a/toolkit/content/widgets/popup.xml
+++ b/toolkit/content/widgets/popup.xml
@@ -262,11 +262,11 @@
         // Capture the previous focus before has a chance to get set inside the panel
         try {
           this._prevFocus = document.commandDispatcher.focusedElement;
-          if (!this._prevFocus)  // Content window has focus
-            this._prevFocus = document.commandDispatcher.focusedWindow;
-        } catch (ex) {
-          this._prevFocus = document.activeElement;
-        }
+          if (this._prevFocus)
+            return;
+        } catch (ex) { }
+
+        this._prevFocus = document.activeElement;
       ]]></handler>
       <handler event="popupshown"><![CDATA[
         // Fire event for accessibility APIs
diff --git a/toolkit/modules/Sqlite.jsm b/toolkit/modules/Sqlite.jsm
index c873fceef24f..60349500756a 100644
--- a/toolkit/modules/Sqlite.jsm
+++ b/toolkit/modules/Sqlite.jsm
@@ -731,13 +731,13 @@ function openConnection(options) {
 
   log.info("Opening database: " + path + " (" + identifier + ")");
   let deferred = Promise.defer();
-  let options = null;
+  let dbOptions = null;
   if (!sharedMemoryCache) {
-    options = Cc["@mozilla.org/hash-property-bag;1"].
+    dbOptions = Cc["@mozilla.org/hash-property-bag;1"].
       createInstance(Ci.nsIWritablePropertyBag);
-    options.setProperty("shared", false);
+    dbOptions.setProperty("shared", false);
   }
-  Services.storage.openAsyncDatabase(file, options, function(status, connection) {
+  Services.storage.openAsyncDatabase(file, dbOptions, function(status, connection) {
     if (!connection) {
       log.warn("Could not open connection: " + status);
       deferred.reject(new Error("Could not open connection: " + status));
diff --git a/toolkit/modules/sessionstore/FormData.jsm b/toolkit/modules/sessionstore/FormData.jsm
index e00077534c85..329c7d6a6934 100644
--- a/toolkit/modules/sessionstore/FormData.jsm
+++ b/toolkit/modules/sessionstore/FormData.jsm
@@ -139,7 +139,7 @@ let FormDataInternal = {
     const MAX_TRAVERSED_XPATHS = 100;
     let generatedCount = 0;
 
-    while (node = formNodes.iterateNext()) {
+    while ((node = formNodes.iterateNext())) {
       let hasDefaultValue = true;
       let value;
 
diff --git a/tools/profiler/platform-linux.cc b/tools/profiler/platform-linux.cc
index e380a699ebfe..85fef75fb33d 100644
--- a/tools/profiler/platform-linux.cc
+++ b/tools/profiler/platform-linux.cc
@@ -631,19 +631,26 @@ void TickSample::PopulateContext(void* aContext)
   }
 }
 
-// WARNING: Works with values up to 1 second
 void OS::SleepMicro(int microseconds)
 {
+  if (MOZ_UNLIKELY(microseconds >= 1000000)) {
+    // Use usleep for larger intervals, because the nanosleep
+    // code below only supports intervals < 1 second.
+    MOZ_ALWAYS_TRUE(!::usleep(microseconds));
+    return;
+  }
+
   struct timespec ts;
   ts.tv_sec  = 0;
   ts.tv_nsec = microseconds * 1000UL;
 
-  while (true) {
-    // in the case of interrupt we keep waiting
-    // nanosleep puts the remaining to back into ts
-    if (!nanosleep(&ts, &ts) || errno != EINTR) {
-      return;
-    }
-  }
-}
+  int rv = ::nanosleep(&ts, &ts);
 
+  while (rv != 0 && errno == EINTR) {
+    // Keep waiting in case of interrupt.
+    // nanosleep puts the remaining time back into ts.
+    rv = ::nanosleep(&ts, &ts);
+  }
+
+  MOZ_ASSERT(!rv, "nanosleep call failed");
+}
diff --git a/tools/trace-malloc/lib/nsTypeInfo.cpp b/tools/trace-malloc/lib/nsTypeInfo.cpp
index bf88aa8fcc15..2a4ae4bb7ef1 100644
--- a/tools/trace-malloc/lib/nsTypeInfo.cpp
+++ b/tools/trace-malloc/lib/nsTypeInfo.cpp
@@ -14,6 +14,7 @@
   by Patrick C. Beard.
  */
 
+#include <exception> /* Needed for MSVC2010 due to bug 1055675 */
 #include <typeinfo>
 #include <ctype.h>
 
diff --git a/webapprt/DownloadView.jsm b/webapprt/DownloadView.jsm
new file mode 100644
index 000000000000..8c140f933730
--- /dev/null
+++ b/webapprt/DownloadView.jsm
@@ -0,0 +1,35 @@
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this file,
+ * You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+"use strict";
+
+this.EXPORTED_SYMBOLS = ["DownloadView"];
+
+const Cu = Components.utils;
+
+Cu.import("resource://gre/modules/Services.jsm");
+Cu.import("resource://gre/modules/Downloads.jsm");
+
+this.DownloadView = {
+  init: function() {
+    Downloads.getList(Downloads.ALL)
+             .then(list => list.addView(this))
+             .catch(Cu.reportError);
+  },
+
+  onDownloadAdded: function(aDownload) {
+    let dmWindow = Services.wm.getMostRecentWindow("Download:Manager");
+    if (dmWindow) {
+      dmWindow.focus();
+    } else {
+      Services.ww.openWindow(null,
+                             "chrome://webapprt/content/downloads/downloads.xul",
+                             "Download:Manager",
+                             "chrome,dialog=no,resizable",
+                             null);
+    }
+  },
+};
+
+DownloadView.init();
diff --git a/webapprt/Startup.jsm b/webapprt/Startup.jsm
index c4a16a6a4327..13284ab978f6 100644
--- a/webapprt/Startup.jsm
+++ b/webapprt/Startup.jsm
@@ -142,11 +142,19 @@ this.startup = function(window) {
     // Wait for XUL window loading
     yield deferredWindowLoad.promise;
 
+    // Override Toolkit's nsITransfer implementation with the one from the
+    // JavaScript API for downloads. This will eventually be removed when
+    // nsIDownloadManager will not be available anymore (bug 851471).
+    Components.manager.QueryInterface(Ci.nsIComponentRegistrar)
+              .registerFactory(Components.ID("{1b4c85df-cbdd-4bb6-b04e-613caece083c}"),
+                               "", "@mozilla.org/transfer;1", null);
+
     // Load these modules here because they aren't needed right at startup,
     // but they need to be loaded to perform some initialization steps.
     Cu.import("resource://gre/modules/Payment.jsm");
     Cu.import("resource://gre/modules/AlarmService.jsm");
     Cu.import("resource://webapprt/modules/WebRTCHandler.jsm");
+    Cu.import("resource://webapprt/modules/DownloadView.jsm");
 
     // Get the <browser> element in the webapp.xul window.
     let appBrowser = window.document.getElementById("content");
diff --git a/webapprt/content/downloads/download.xml b/webapprt/content/downloads/download.xml
new file mode 100644
index 000000000000..f2c6fbfe1545
--- /dev/null
+++ b/webapprt/content/downloads/download.xml
@@ -0,0 +1,328 @@
+<?xml version="1.0"?>
+
+<!-- This Source Code Form is subject to the terms of the Mozilla Public
+   - License, v. 2.0. If a copy of the MPL was not distributed with this
+   - file, You can obtain one at http://mozilla.org/MPL/2.0/. -->
+
+<!DOCTYPE bindings [
+  <!ENTITY % downloadDTD SYSTEM "chrome://webapprt/locale/downloads/downloads.dtd" >
+  %downloadDTD;
+]>
+
+<bindings id="downloadBindings"
+          xmlns="http://www.mozilla.org/xbl"
+          xmlns:xul="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul"
+          xmlns:xbl="http://www.mozilla.org/xbl">
+
+  <binding id="download-base" extends="chrome://global/content/bindings/richlistbox.xml#richlistitem">
+    <resources>
+      <stylesheet src="chrome://webapprt/skin/downloads/downloads.css"/>
+    </resources>
+    <implementation>
+      <property name="paused">
+        <getter>
+        <![CDATA[
+          return parseInt(this.getAttribute("state")) == Components.interfaces.nsIDownloadManager.DOWNLOAD_PAUSED;
+        ]]>
+        </getter>
+      </property>
+      <property name="openable">
+        <getter>
+        <![CDATA[
+          return parseInt(this.getAttribute("state")) == Components.interfaces.nsIDownloadManager.DOWNLOAD_FINISHED;
+        ]]>
+        </getter>
+      </property>
+      <property name="inProgress">
+        <getter>
+        <![CDATA[
+          var state = parseInt(this.getAttribute("state"));
+          const dl = Components.interfaces.nsIDownloadManager;
+          return state == dl.DOWNLOAD_NOTSTARTED || 
+                 state == dl.DOWNLOAD_QUEUED ||
+                 state == dl.DOWNLOAD_DOWNLOADING || 
+                 state == dl.DOWNLOAD_PAUSED ||
+                 state == dl.DOWNLOAD_SCANNING;
+        ]]>
+        </getter>
+      </property>
+      <property name="removable">
+        <getter>
+        <![CDATA[
+          var state = parseInt(this.getAttribute("state"));
+          const dl = Components.interfaces.nsIDownloadManager;
+          return state == dl.DOWNLOAD_FINISHED || 
+                 state == dl.DOWNLOAD_CANCELED || 
+                 state == dl.DOWNLOAD_BLOCKED_PARENTAL || 
+                 state == dl.DOWNLOAD_BLOCKED_POLICY || 
+                 state == dl.DOWNLOAD_DIRTY || 
+                 state == dl.DOWNLOAD_FAILED;
+        ]]>
+        </getter>
+      </property>
+      <property name="buttons">
+        <getter>
+        <![CDATA[
+          var startEl = document.getAnonymousNodes(this);
+          if (!startEl.length) {
+            startEl = [this];
+          }
+
+          const XULNS = "http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul";
+          return startEl[0].getElementsByTagNameNS(XULNS, "button");
+        ]]>
+        </getter>
+      </property>
+    </implementation>
+  </binding>
+
+  <binding id="download-starting" extends="chrome://webapprt/content/downloads/download.xml#download-base">
+    <content>
+      <xul:hbox flex="1">
+        <xul:vbox pack="center">
+          <xul:image class="downloadTypeIcon" validate="always"
+                     xbl:inherits="src=image"/>
+        </xul:vbox>
+        <xul:vbox pack="start" flex="1">
+          <xul:label xbl:inherits="value=target,tooltiptext=target"
+                     crop="center" class="name"/>
+          <xul:progressmeter mode="normal" value="0" flex="1"
+                             anonid="progressmeter"/>
+          <xul:label value="&starting.label;" class="status"/>
+          <xul:spacer flex="1"/>
+        </xul:vbox>
+        <xul:vbox pack="center">
+          <xul:button class="cancel mini-button" tooltiptext="&cmd.cancel.label;"
+                      cmd="cmd_cancel" ondblclick="event.stopPropagation();"
+                      oncommand="gDownloadList.performCommand('cmd_cancel', this);"/>
+        </xul:vbox>
+      </xul:hbox>
+    </content>
+  </binding>
+
+  <binding id="download-downloading" extends="chrome://webapprt/content/downloads/download.xml#download-base">
+    <content>
+      <xul:hbox flex="1" class="downloadContentBox">
+        <xul:vbox pack="center">
+          <xul:image class="downloadTypeIcon" validate="always"
+                     xbl:inherits="src=image"/>
+        </xul:vbox>
+        <xul:vbox flex="1">
+          <xul:label xbl:inherits="value=target,tooltiptext=target"
+                       crop="center" flex="2" class="name"/>
+          <xul:hbox>
+            <xul:vbox flex="1">
+              <xul:progressmeter mode="normal" value="0" flex="1"
+                                 anonid="progressmeter"
+                                 xbl:inherits="value=progress,mode=progressmode"/>
+            </xul:vbox>
+            <xul:button class="pause mini-button" tooltiptext="&cmd.pause.label;"
+                        cmd="cmd_pause" ondblclick="event.stopPropagation();"
+                        oncommand="gDownloadList.performCommand('cmd_pause', this);"/>
+            <xul:button class="cancel mini-button" tooltiptext="&cmd.cancel.label;"
+                        cmd="cmd_cancel" ondblclick="event.stopPropagation();"
+                        oncommand="gDownloadList.performCommand('cmd_cancel', this);"/>
+          </xul:hbox>
+          <xul:label xbl:inherits="value=status,tooltiptext=statusTip" flex="1"
+                     crop="right" class="status"/>
+          <xul:spacer flex="1"/>
+        </xul:vbox>
+      </xul:hbox>
+    </content>
+  </binding>
+
+  <binding id="download-paused" extends="chrome://webapprt/content/downloads/download.xml#download-base">
+    <content>
+      <xul:hbox flex="1">
+        <xul:vbox pack="center">
+          <xul:image class="downloadTypeIcon" validate="always"
+                     xbl:inherits="src=image"/>
+        </xul:vbox>
+        <xul:vbox flex="1">
+          <xul:label xbl:inherits="value=target,tooltiptext=target"
+                     crop="center" flex="2" class="name"/>
+          <xul:hbox>
+            <xul:vbox flex="1">
+              <xul:progressmeter mode="normal" value="0" flex="1"
+                                 anonid="progressmeter"
+                                 xbl:inherits="value=progress,mode=progressmode"/>
+            </xul:vbox>
+            <xul:button class="resume mini-button" tooltiptext="&cmd.resume.label;"
+                        cmd="cmd_resume" ondblclick="event.stopPropagation();"
+                        oncommand="gDownloadList.performCommand('cmd_resume', this);"/>
+            <xul:button class="cancel mini-button" tooltiptext="&cmd.cancel.label;"
+                        cmd="cmd_cancel" ondblclick="event.stopPropagation();"
+                        oncommand="gDownloadList.performCommand('cmd_cancel', this);"/>
+          </xul:hbox>
+          <xul:label xbl:inherits="value=status,tooltiptext=statusTip" flex="1"
+                     crop="right" class="status"/>
+          <xul:spacer flex="1"/>
+        </xul:vbox>
+      </xul:hbox>
+    </content>
+  </binding>
+
+  <binding id="download-done" extends="chrome://webapprt/content/downloads/download.xml#download-base">
+    <content>
+      <xul:hbox flex="1">
+        <xul:vbox pack="center">
+          <xul:image class="downloadTypeIcon" validate="always"
+                     xbl:inherits="src=image"/>
+        </xul:vbox>
+        <xul:vbox pack="start" flex="1">
+          <xul:hbox align="center" flex="1">
+            <xul:label xbl:inherits="value=target,tooltiptext=target"
+                       crop="center" flex="1" class="name"/>
+            <xul:label xbl:inherits="value=dateTime,tooltiptext=dateTimeTip"
+                       class="dateTime"/>
+          </xul:hbox>
+          <xul:hbox align="center" flex="1">
+            <xul:label xbl:inherits="value=status,tooltiptext=statusTip"
+                       crop="end" flex="1" class="status"/>
+          </xul:hbox>
+        </xul:vbox>
+      </xul:hbox>
+    </content>
+  </binding>
+
+  <binding id="download-canceled" extends="chrome://webapprt/content/downloads/download.xml#download-base">
+    <content>
+      <xul:hbox flex="1">
+        <xul:vbox pack="center">
+          <xul:image class="downloadTypeIcon" validate="always"
+                     xbl:inherits="src=image"/>
+        </xul:vbox>
+        <xul:vbox pack="start" flex="1">
+          <xul:hbox align="center" flex="1">
+            <xul:label xbl:inherits="value=target,tooltiptext=target"
+                       crop="center" flex="1" class="name"/>
+            <xul:label xbl:inherits="value=dateTime,tooltiptext=dateTimeTip"
+                       class="dateTime"/>
+          </xul:hbox>
+          <xul:hbox align="center" flex="1">
+            <xul:label xbl:inherits="value=status,tooltiptext=statusTip"
+                       crop="end" flex="1" class="status"/>
+            <xul:button class="retry mini-button" tooltiptext="&cmd.retry.label;"
+                        cmd="cmd_retry" ondblclick="event.stopPropagation();"
+                        oncommand="gDownloadList.performCommand('cmd_retry', this);"/>
+          </xul:hbox>
+        </xul:vbox>
+      </xul:hbox>
+    </content>
+  </binding>
+
+  <binding id="download-failed" extends="chrome://webapprt/content/downloads/download.xml#download-base">
+    <content>
+      <xul:hbox flex="1">
+        <xul:vbox pack="center">
+          <xul:image class="downloadTypeIcon" validate="always"
+                     xbl:inherits="src=image"/>
+        </xul:vbox>
+        <xul:vbox pack="start" flex="1">
+          <xul:hbox align="center" flex="1">
+            <xul:label xbl:inherits="value=target,tooltiptext=target"
+                       crop="center" flex="1" class="name"/>
+            <xul:label xbl:inherits="value=dateTime,tooltiptext=dateTimeTip"
+                       class="dateTime"/>
+          </xul:hbox>
+          <xul:hbox align="center" flex="1">
+            <xul:label xbl:inherits="value=status,tooltiptext=statusTip"
+                       crop="end" flex="1" class="status"/>
+            <xul:button class="retry mini-button" tooltiptext="&cmd.retry.label;"
+                        cmd="cmd_retry" ondblclick="event.stopPropagation();"
+                        oncommand="gDownloadList.performCommand('cmd_retry', this);"/>
+          </xul:hbox>
+        </xul:vbox>
+      </xul:hbox>
+    </content>
+  </binding>
+
+  <binding id="download-blocked-parental" extends="chrome://webapprt/content/downloads/download.xml#download-base">
+    <content>
+      <xul:hbox flex="1">
+        <xul:vbox pack="center">
+          <xul:image class="downloadTypeIcon blockedIcon"/>
+        </xul:vbox>
+        <xul:vbox pack="start" flex="1">
+          <xul:hbox align="center" flex="1">
+            <xul:label xbl:inherits="value=target,tooltiptext=target"
+                       crop="center" flex="1" class="name"/>
+            <xul:label xbl:inherits="value=dateTime,tooltiptext=dateTimeTip"
+                       class="dateTime"/>
+          </xul:hbox>
+          <xul:hbox align="center" flex="1">
+            <xul:label xbl:inherits="value=status,tooltiptext=statusTip"
+                       crop="end" flex="1" class="status"/>
+          </xul:hbox>
+        </xul:vbox>
+      </xul:hbox>
+    </content>
+  </binding>
+
+  <binding id="download-blocked-policy" extends="chrome://webapprt/content/downloads/download.xml#download-base">
+    <content>
+      <xul:hbox flex="1">
+        <xul:vbox pack="center">
+          <xul:image class="downloadTypeIcon blockedIcon"/>
+        </xul:vbox>
+        <xul:vbox pack="start" flex="1">
+          <xul:hbox align="center" flex="1">
+            <xul:label xbl:inherits="value=target,tooltiptext=target"
+                       crop="center" flex="1" class="name"/>
+            <xul:label xbl:inherits="value=dateTime,tooltiptext=dateTimeTip"
+                       class="dateTime"/>
+          </xul:hbox>
+          <xul:hbox align="center" flex="1">
+            <xul:label xbl:inherits="value=status,tooltiptext=statusTip"
+                       crop="end" flex="1" class="status"/>
+          </xul:hbox>
+        </xul:vbox>
+      </xul:hbox>
+    </content>
+  </binding>
+
+  <binding id="download-scanning" extends="chrome://webapprt/content/downloads/download.xml#download-base">
+    <content>
+      <xul:hbox flex="1">
+        <xul:vbox pack="center">
+          <xul:image class="downloadTypeIcon" validate="always"
+                     xbl:inherits="src=image"/>
+        </xul:vbox>
+        <xul:vbox pack="start" flex="1">
+          <xul:label xbl:inherits="value=target,tooltiptext=target"
+                       crop="center" flex="2" class="name"/>
+          <xul:hbox>
+            <xul:vbox flex="1">
+              <xul:progressmeter mode="undetermined" flex="1" />
+            </xul:vbox>
+          </xul:hbox>
+          <xul:label value="&scanning.label;" class="status"/>
+          <xul:spacer flex="1"/>
+        </xul:vbox>
+      </xul:hbox>
+    </content>
+  </binding>
+
+  <binding id="download-dirty" extends="chrome://webapprt/content/downloads/download.xml#download-base">
+    <content>
+      <xul:hbox flex="1">
+        <xul:vbox pack="center">
+          <xul:image class="downloadTypeIcon blockedIcon"/>
+        </xul:vbox>
+        <xul:vbox pack="start" flex="1">
+          <xul:hbox align="center" flex="1">
+            <xul:label xbl:inherits="value=target,tooltiptext=target"
+                       crop="center" flex="1" class="name"/>
+            <xul:label xbl:inherits="value=dateTime,tooltiptext=dateTimeTip"
+                       class="dateTime"/>
+          </xul:hbox>
+          <xul:hbox align="center" flex="1">
+            <xul:label xbl:inherits="value=status,tooltiptext=statusTip"
+                       crop="end" flex="1" class="status"/>
+          </xul:hbox>
+        </xul:vbox>
+      </xul:hbox>
+    </content>
+  </binding>
+
+</bindings>
diff --git a/webapprt/content/downloads/downloads.css b/webapprt/content/downloads/downloads.css
new file mode 100644
index 000000000000..825aeb401a38
--- /dev/null
+++ b/webapprt/content/downloads/downloads.css
@@ -0,0 +1,50 @@
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+richlistitem[type="download"] {
+  -moz-binding: url('chrome://webapprt/content/downloads/download.xml#download-starting');
+  -moz-box-orient: vertical;
+}
+
+richlistitem[type="download"][state="0"] {
+  -moz-binding: url('chrome://webapprt/content/downloads/download.xml#download-downloading');
+}
+
+richlistitem[type="download"][state="1"] {
+  -moz-binding: url('chrome://webapprt/content/downloads/download.xml#download-done');
+}
+
+richlistitem[type="download"][state="2"] {
+  -moz-binding: url('chrome://webapprt/content/downloads/download.xml#download-failed');
+}
+
+richlistitem[type="download"][state="3"] {
+  -moz-binding: url('chrome://webapprt/content/downloads/download.xml#download-canceled');
+}
+
+richlistitem[type="download"][state="4"] {
+  -moz-binding: url('chrome://webapprt/content/downloads/download.xml#download-paused');
+}
+
+richlistitem[type="download"][state="6"] {
+  -moz-binding: url('chrome://webapprt/content/downloads/download.xml#download-blocked-parental');
+}
+
+richlistitem[type="download"][state="7"] {
+  -moz-binding: url('chrome://webapprt/content/downloads/download.xml#download-scanning');
+}
+
+richlistitem[type="download"][state="8"] {
+  -moz-binding: url('chrome://webapprt/content/downloads/download.xml#download-dirty');
+}
+
+richlistitem[type="download"][state="9"] {
+  -moz-binding: url('chrome://webapprt/content/downloads/download.xml#download-blocked-policy');
+}
+
+/* Only focus buttons in the selected item*/
+richlistitem[type="download"]:not([selected="true"]) button {
+  -moz-user-focus: none;
+}
+
diff --git a/webapprt/content/downloads/downloads.js b/webapprt/content/downloads/downloads.js
new file mode 100644
index 000000000000..80781c528d79
--- /dev/null
+++ b/webapprt/content/downloads/downloads.js
@@ -0,0 +1,1134 @@
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this file,
+ * You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+const { interfaces: Ci, utils: Cu, classes: Cc } = Components;
+
+const nsIDM = Ci.nsIDownloadManager;
+
+Cu.import("resource://gre/modules/XPCOMUtils.jsm");
+Cu.import("resource://gre/modules/Services.jsm");
+Cu.import("resource://gre/modules/Task.jsm");
+Cu.import("resource://gre/modules/osfile.jsm");
+
+XPCOMUtils.defineLazyModuleGetter(this, "NetUtil",
+  "resource://gre/modules/NetUtil.jsm");
+
+XPCOMUtils.defineLazyModuleGetter(this, "DownloadUtils",
+  "resource://gre/modules/DownloadUtils.jsm");
+
+XPCOMUtils.defineLazyModuleGetter(this, "PluralForm",
+  "resource://gre/modules/PluralForm.jsm");
+
+let gStr = {};
+
+let DownloadItem = function(aID, aDownload) {
+  this.id = aID;
+  this._download = aDownload;
+
+  this.file = aDownload.target.path;
+  this.target = OS.Path.basename(aDownload.target.path);
+  this.uri = aDownload.source.url;
+  this.endTime = new Date();
+
+  this.updateState();
+
+  this.updateData();
+
+  this.createItem();
+};
+
+DownloadItem.prototype = {
+  /**
+   * The XUL element corresponding to the associated richlistbox item.
+   */
+  element: null,
+
+  /**
+   * The inner XUL element for the progress bar, or null if not available.
+   */
+  _progressElement: null,
+
+  _lastEstimatedSecondsLeft: Infinity,
+
+  updateState: function() {
+    // Collapse state using the correct priority.
+    if (this._download.succeeded) {
+      this.state = nsIDM.DOWNLOAD_FINISHED;
+    } else if (this._download.error &&
+               this._download.error.becauseBlockedByParentalControls) {
+      this.state = nsIDM.DOWNLOAD_BLOCKED_PARENTAL;
+    } else if (this._download.error &&
+               this._download.error.becauseBlockedByReputationCheck) {
+      this.state = nsIDM.DOWNLOAD_DIRTY;
+    } else if (this._download.error) {
+      this.state = nsIDM.DOWNLOAD_FAILED;
+    } else if (this._download.canceled && this._download.hasPartialData) {
+      this.state = nsIDM.DOWNLOAD_PAUSED;
+    } else if (this._download.canceled) {
+      this.state = nsIDM.DOWNLOAD_CANCELED;
+    } else if (this._download.stopped) {
+      this.state = nsIDM.DOWNLOAD_NOTSTARTED;
+    } else {
+      this.state = nsIDM.DOWNLOAD_DOWNLOADING;
+    }
+  },
+
+  updateData: function() {
+    let wasInProgress = this.inProgress;
+
+    this.updateState();
+
+    if (wasInProgress && !this.inProgress) {
+      this.endTime = new Date();
+    }
+
+    this.referrer = this._download.source.referrer;
+    this.startTime = this._download.startTime;
+    this.currBytes = this._download.currentBytes;
+    this.resumable = this._download.hasPartialData;
+    this.speed = this._download.speed;
+
+    if (this._download.succeeded) {
+      // If the download succeeded, show the final size if available, otherwise
+      // use the last known number of bytes transferred.  The final size on disk
+      // will be available when bug 941063 is resolved.
+      this.maxBytes = this._download.hasProgress ? this._download.totalBytes
+                                                 : this._download.currentBytes;
+      this.percentComplete = 100;
+    } else if (this._download.hasProgress) {
+      // If the final size and progress are known, use them.
+      this.maxBytes = this._download.totalBytes;
+      this.percentComplete = this._download.progress;
+    } else {
+      // The download final size and progress percentage is unknown.
+      this.maxBytes = -1;
+      this.percentComplete = -1;
+    }
+  },
+
+  /**
+   * Indicates whether the download is proceeding normally, and not finished
+   * yet. This includes paused downloads.  When this property is true, the
+   * "progress" property represents the current progress of the download.
+   */
+  get inProgress() {
+    return [
+      nsIDM.DOWNLOAD_NOTSTARTED,
+      nsIDM.DOWNLOAD_QUEUED,
+      nsIDM.DOWNLOAD_DOWNLOADING,
+      nsIDM.DOWNLOAD_PAUSED,
+      nsIDM.DOWNLOAD_SCANNING,
+    ].indexOf(this.state) != -1;
+  },
+
+  /**
+   * This is true during the initial phases of a download, before the actual
+   * download of data bytes starts.
+   */
+  get starting() {
+    return this.state == nsIDM.DOWNLOAD_NOTSTARTED ||
+           this.state == nsIDM.DOWNLOAD_QUEUED;
+  },
+
+  /**
+   * Indicates whether the download is paused.
+   */
+  get paused() {
+    return this.state == nsIDM.DOWNLOAD_PAUSED;
+  },
+
+  /**
+   * Indicates whether the download is in a final state, either because it
+   * completed successfully or because it was blocked.
+   */
+  get done() {
+    return [
+      nsIDM.DOWNLOAD_FINISHED,
+      nsIDM.DOWNLOAD_BLOCKED_PARENTAL,
+      nsIDM.DOWNLOAD_BLOCKED_POLICY,
+      nsIDM.DOWNLOAD_DIRTY,
+    ].indexOf(this.state) != -1;
+  },
+
+  /**
+   * Indicates whether the download can be removed.
+   */
+  get removable() {
+    return [
+      nsIDM.DOWNLOAD_FINISHED,
+      nsIDM.DOWNLOAD_CANCELED,
+      nsIDM.DOWNLOAD_BLOCKED_PARENTAL,
+      nsIDM.DOWNLOAD_BLOCKED_POLICY,
+      nsIDM.DOWNLOAD_DIRTY,
+      nsIDM.DOWNLOAD_FAILED,
+    ].indexOf(this.state) != -1;
+  },
+
+  /**
+   * Indicates whether the download is finished and can be opened.
+   */
+  get openable() {
+    return this.state == nsIDM.DOWNLOAD_FINISHED;
+  },
+
+  /**
+   * Indicates whether the download stopped because of an error, and can be
+   * resumed manually.
+   */
+  get canRetry() {
+    return this.state == nsIDM.DOWNLOAD_CANCELED ||
+           this.state == nsIDM.DOWNLOAD_FAILED;
+  },
+
+  /**
+   * Returns the nsILocalFile for the download target.
+   *
+   * @throws if the native path is not valid.  This can happen if the same
+   *         profile is used on different platforms, for example if a native
+   *         Windows path is stored and then the item is accessed on a Mac.
+   */
+  get localFile() {
+    return this._getFile(this.file);
+  },
+
+  /**
+   * Returns the nsILocalFile for the partially downloaded target.
+   *
+   * @throws if the native path is not valid.  This can happen if the same
+   *         profile is used on different platforms, for example if a native
+   *         Windows path is stored and then the item is accessed on a Mac.
+   */
+  get partFile() {
+    return this._getFile(this.file + ".part");
+  },
+
+  /**
+   * Return a nsILocalFile for aFilename. aFilename might be a file URL or
+   * a native path.
+   *
+   * @param aFilename the filename of the file to retrieve.
+   * @return an nsILocalFile for the file.
+   * @throws if the native path is not valid.  This can happen if the same
+   *         profile is used on different platforms, for example if a native
+   *         Windows path is stored and then the item is accessed on a Mac.
+   * @note This function makes no guarantees about the file's existence -
+   *       callers should check that the returned file exists.
+   */
+  _getFile: function(aFilename) {
+    // The download database may contain targets stored as file URLs or native
+    // paths.  This can still be true for previously stored items, even if new
+    // items are stored using their file URL.  See also bug 239948 comment 12.
+    if (aFilename.startsWith("file:")) {
+      // Assume the file URL we obtained from the downloads database or from the
+      // "spec" property of the target has the UTF-8 charset.
+      let fileUrl = NetUtil.newURI(aFilename).QueryInterface(Ci.nsIFileURL);
+      return fileUrl.file;
+    }
+
+    // The downloads database contains a native path.  Try to create a local
+    // file, though this may throw an exception if the path is invalid.
+    let file = Cc["@mozilla.org/file/local;1"].createInstance(Ci.nsIFile);
+    file.initWithPath(aFilename);
+    return file;
+  },
+
+  /**
+   * Show a downloaded file in the system file manager.
+   */
+  showLocalFile: function() {
+    let file = this.localFile;
+
+    try {
+      // Show the directory containing the file and select the file.
+      file.reveal();
+    } catch (ex) {
+      // If reveal fails for some reason (e.g., it's not implemented on unix
+      // or the file doesn't exist), try using the parent if we have it.
+      let parent = file.parent;
+      if (!parent) {
+        return;
+      }
+
+      try {
+        // Open the parent directory to show where the file should be.
+        parent.launch();
+      } catch (ex) {
+        // If launch also fails (probably because it's not implemented), let
+        // the OS handler try to open the parent.
+        Cc["@mozilla.org/uriloader/external-protocol-service;1"].
+        getService(Ci.nsIExternalProtocolService).
+        loadUrl(NetUtil.newURI(parent));
+      }
+    }
+  },
+
+  /**
+   * Open the target file for this download.
+   */
+  openLocalFile: function() {
+    return this._download.launch();
+  },
+
+  /**
+   * Pause the download, if it is active.
+   */
+  pause: function() {
+    return this._download.cancel();
+  },
+
+  /**
+   * Resume the download, if it is paused.
+   */
+  resume: function() {
+    return this._download.start();
+  },
+
+  /**
+   * Attempt to retry the download.
+   */
+  retry: function() {
+    return this._download.start();
+  },
+
+  /**
+   * Cancel the download.
+   */
+  cancel: function() {
+    this._download.cancel();
+    return this._download.removePartialData();
+  },
+
+  /**
+   * Remove the download.
+   */
+  remove: function() {
+    return Downloads.getList(Downloads.ALL)
+                    .then(list => list.remove(this._download))
+                    .then(() => this._download.finalize(true));
+  },
+
+  /**
+   * Create a download richlistitem with the provided attributes.
+   */
+  createItem: function() {
+    this.element = document.createElement("richlistitem");
+
+    this.element.setAttribute("id", this.id);
+    this.element.setAttribute("target", this.target);
+    this.element.setAttribute("state", this.state);
+    this.element.setAttribute("progress", this.percentComplete);
+    this.element.setAttribute("type", "download");
+    this.element.setAttribute("image", "moz-icon://" + this.file + "?size=32");
+  },
+
+  /**
+   * Update the status for a download item depending on its state.
+   */
+  updateStatusText: function() {
+    let status = "";
+    let statusTip = "";
+
+    switch (this.state) {
+      case nsIDM.DOWNLOAD_PAUSED:
+        let transfer = DownloadUtils.getTransferTotal(this.currBytes,
+                                                      this.maxBytes);
+        status = gStr.paused.replace("#1", transfer);
+
+        break;
+
+      case nsIDM.DOWNLOAD_DOWNLOADING:
+        let newLast;
+        [status, newLast] =
+          DownloadUtils.getDownloadStatus(this.currBytes, this.maxBytes,
+                                          this.speed,
+                                          this._lastEstimatedSecondsLeft);
+
+        this._lastEstimatedSecondsLeft = newLast;
+
+        break;
+
+      case nsIDM.DOWNLOAD_FINISHED:
+      case nsIDM.DOWNLOAD_FAILED:
+      case nsIDM.DOWNLOAD_CANCELED:
+      case nsIDM.DOWNLOAD_BLOCKED_PARENTAL:
+      case nsIDM.DOWNLOAD_BLOCKED_POLICY:
+      case nsIDM.DOWNLOAD_DIRTY:
+        let (stateSize = {}) {
+          stateSize[nsIDM.DOWNLOAD_FINISHED] = () => {
+            // Display the file size, but show "Unknown" for negative sizes.
+            let sizeText = gStr.doneSizeUnknown;
+            if (this.maxBytes >= 0) {
+              let [size, unit] = DownloadUtils.convertByteUnits(this.maxBytes);
+              sizeText = gStr.doneSize.replace("#1", size);
+              sizeText = sizeText.replace("#2", unit);
+            }
+            return sizeText;
+          };
+          stateSize[nsIDM.DOWNLOAD_FAILED] = () => gStr.stateFailed;
+          stateSize[nsIDM.DOWNLOAD_CANCELED] = () => gStr.stateCanceled;
+          stateSize[nsIDM.DOWNLOAD_BLOCKED_PARENTAL] = () => gStr.stateBlocked;
+          stateSize[nsIDM.DOWNLOAD_BLOCKED_POLICY] = () => gStr.stateBlockedPolicy;
+          stateSize[nsIDM.DOWNLOAD_DIRTY] = () => gStr.stateDirty;
+
+          // Insert 1 is the download size or download state.
+          status = gStr.doneStatus.replace("#1", stateSize[this.state]());
+        }
+
+        let [displayHost, fullHost] =
+          DownloadUtils.getURIHost(this.referrer || this.uri);
+        // Insert 2 is the eTLD + 1 or other variations of the host.
+        status = status.replace("#2", displayHost);
+        // Set the tooltip to be the full host.
+        statusTip = fullHost;
+
+        break;
+    }
+
+    this.element.setAttribute("status", status);
+    this.element.setAttribute("statusTip", statusTip || status);
+  },
+
+  updateView: function() {
+    this.updateData();
+
+    // Update this download's progressmeter.
+    if (this.starting) {
+      // Before the download starts, the progress meter has its initial value.
+      this.element.setAttribute("progressmode", "normal");
+      this.element.setAttribute("progress", "0");
+    } else if (this.state == Ci.nsIDownloadManager.DOWNLOAD_SCANNING ||
+               this.percentComplete == -1) {
+      // We might not know the progress of a running download, and we don't know
+      // the remaining time during the malware scanning phase.
+      this.element.setAttribute("progressmode", "undetermined");
+    } else {
+      // This is a running download of which we know the progress.
+      this.element.setAttribute("progressmode", "normal");
+      this.element.setAttribute("progress", this.percentComplete);
+    }
+
+    // Find the progress element as soon as the download binding is accessible.
+    if (!this._progressElement) {
+      this._progressElement =
+           document.getAnonymousElementByAttribute(this.element, "anonid",
+                                                   "progressmeter");
+    }
+
+    // Dispatch the ValueChange event for accessibility, if possible.
+    if (this._progressElement) {
+      let event = document.createEvent("Events");
+      event.initEvent("ValueChange", true, true);
+      this._progressElement.dispatchEvent(event);
+    }
+
+    // Update the rest of the UI (bytes transferred, bytes total, download rate,
+    // time remaining).
+
+    // Update the time that gets shown for completed download items
+    // Don't bother updating it for things that aren't finished
+    if (!this.inProgress) {
+      let [dateCompact, dateComplete] = DownloadUtils.getReadableDates(this.endTime);
+      this.element.setAttribute("dateTime", dateCompact);
+      this.element.setAttribute("dateTimeTip", dateComplete);
+    }
+
+    this.element.setAttribute("state", this.state);
+
+    this.updateStatusText();
+
+    // Update the disabled state of the buttons of a download
+    let buttons = this.element.buttons;
+    for (let i = 0; i < buttons.length; ++i) {
+      let cmd = buttons[i].getAttribute("cmd");
+      let enabled = this.isCommandEnabled(cmd);
+      buttons[i].disabled = !enabled;
+
+      if ("cmd_pause" == cmd && !enabled) {
+        // We need to add the tooltip indicating that the download cannot be
+        // paused now.
+        buttons[i].setAttribute("tooltiptext", gStr.cannotPause);
+      }
+    }
+
+    if (this.done) {
+      // getTypeFromFile fails if it can't find a type for this file.
+      try {
+        // Refresh the icon, so that executable icons are shown.
+        let mimeService = Cc["@mozilla.org/mime;1"].
+                          getService(Ci.nsIMIMEService);
+        let contentType = mimeService.getTypeFromFile(this.localFile);
+
+        let oldImage = this.element.getAttribute("image");
+        // Tacking on contentType bypasses cache
+        this.element.setAttribute("image", oldImage + "&contentType=" + contentType);
+      } catch (e) {}
+    }
+  },
+
+  /**
+   * Check if the download matches the provided search term based on the texts
+   * shown to the user. All search terms are checked to see if each matches any
+   * of the displayed texts.
+   *
+   * @return Boolean true if it matches the search; false otherwise
+   */
+  matchesSearch: function(aTerms, aAttributes) {
+    return aTerms.some(term => aAttributes.some(attr => this.element.getAttribute(attr).contains(term)));
+  },
+
+  isCommandEnabled: function(aCommand) {
+    switch (aCommand) {
+      case "cmd_cancel":
+        return this.inProgress;
+
+      case "cmd_open":
+        return this.openable && this.localFile.exists();
+
+      case "cmd_show":
+        return this.localFile.exists();
+
+      case "cmd_pause":
+        return this.inProgress && !this.paused && this.resumable;
+
+      case "cmd_pauseResume":
+        return (this.inProgress || this.paused) && this.resumable;
+
+      case "cmd_resume":
+        return this.paused && this.resumable;
+
+      case "cmd_openReferrer":
+        return !!this.referrer;
+
+      case "cmd_removeFromList":
+        return this.removable;
+
+      case "cmd_retry":
+        return this.canRetry;
+
+      case "cmd_copyLocation":
+        return true;
+    }
+
+    return false;
+  },
+
+  doCommand: function(aCommand) {
+    if (!this.isCommandEnabled(aCommand)) {
+      return;
+    }
+
+    switch (aCommand) {
+      case "cmd_cancel":
+        this.cancel().catch(Cu.reportError);
+        break;
+
+      case "cmd_open":
+        this.openLocalFile().catch(Cu.reportError);
+        break;
+
+      case "cmd_show":
+        this.showLocalFile();
+        break;
+
+      case "cmd_pause":
+        this.pause().catch(Cu.reportError);
+        break;
+
+      case "cmd_pauseResume":
+        if (this.paused) {
+          this.resume().catch(Cu.reportError);
+        } else {
+          this.pause().catch(Cu.reportError);
+        }
+        break;
+
+      case "cmd_resume":
+        this.resume().catch(Cu.reportError);
+        break;
+
+      case "cmd_openReferrer":
+        let uri = Services.io.newURI(this.referrer || this.uri, null, null);
+
+        // Direct the URL to the default browser.
+        Cc["@mozilla.org/uriloader/external-protocol-service;1"].
+        getService(Ci.nsIExternalProtocolService).
+        getProtocolHandlerInfo(uri.scheme).
+        launchWithURI(uri);
+        break;
+
+      case "cmd_removeFromList":
+        this.remove().catch(Cu.reportError);
+        break;
+
+      case "cmd_retry":
+        this.retry().catch(Cu.reportError);
+        break;
+
+      case "cmd_copyLocation":
+        let clipboard = Cc["@mozilla.org/widget/clipboardhelper;1"].
+                        getService(Ci.nsIClipboardHelper);
+        clipboard.copyString(this.uri, document);
+        break;
+    }
+  },
+};
+
+let gDownloadList = {
+  downloadItemsMap: new Map(),
+  downloadItems: {},
+  _autoIncrementID: 0,
+  downloadView: null,
+  searchBox: null,
+  searchTerms: [],
+  searchAttributes: [ "target", "status", "dateTime", ],
+  contextMenus: [
+    // DOWNLOAD_DOWNLOADING
+    [
+      "menuitem_pause",
+      "menuitem_cancel",
+      "menuseparator",
+      "menuitem_show",
+      "menuseparator",
+      "menuitem_openReferrer",
+      "menuitem_copyLocation",
+      "menuseparator",
+      "menuitem_selectAll",
+    ],
+    // DOWNLOAD_FINISHED
+    [
+      "menuitem_open",
+      "menuitem_show",
+      "menuseparator",
+      "menuitem_openReferrer",
+      "menuitem_copyLocation",
+      "menuseparator",
+      "menuitem_selectAll",
+      "menuseparator",
+      "menuitem_removeFromList"
+    ],
+    // DOWNLOAD_FAILED
+    [
+      "menuitem_retry",
+      "menuseparator",
+      "menuitem_openReferrer",
+      "menuitem_copyLocation",
+      "menuseparator",
+      "menuitem_selectAll",
+      "menuseparator",
+      "menuitem_removeFromList",
+    ],
+    // DOWNLOAD_CANCELED
+    [
+      "menuitem_retry",
+      "menuseparator",
+      "menuitem_openReferrer",
+      "menuitem_copyLocation",
+      "menuseparator",
+      "menuitem_selectAll",
+      "menuseparator",
+      "menuitem_removeFromList",
+    ],
+    // DOWNLOAD_PAUSED
+    [
+      "menuitem_resume",
+      "menuitem_cancel",
+      "menuseparator",
+      "menuitem_show",
+      "menuseparator",
+      "menuitem_openReferrer",
+      "menuitem_copyLocation",
+      "menuseparator",
+      "menuitem_selectAll",
+    ],
+    // DOWNLOAD_QUEUED
+    [
+      "menuitem_cancel",
+      "menuseparator",
+      "menuitem_show",
+      "menuseparator",
+      "menuitem_openReferrer",
+      "menuitem_copyLocation",
+      "menuseparator",
+      "menuitem_selectAll",
+    ],
+    // DOWNLOAD_BLOCKED_PARENTAL
+    [
+      "menuitem_openReferrer",
+      "menuitem_copyLocation",
+      "menuseparator",
+      "menuitem_selectAll",
+      "menuseparator",
+      "menuitem_removeFromList",
+    ],
+    // DOWNLOAD_SCANNING
+    [
+      "menuitem_show",
+      "menuseparator",
+      "menuitem_openReferrer",
+      "menuitem_copyLocation",
+      "menuseparator",
+      "menuitem_selectAll",
+    ],
+    // DOWNLOAD_DIRTY
+    [
+      "menuitem_openReferrer",
+      "menuitem_copyLocation",
+      "menuseparator",
+      "menuitem_selectAll",
+      "menuseparator",
+      "menuitem_removeFromList",
+    ],
+    // DOWNLOAD_BLOCKED_POLICY
+    [
+      "menuitem_openReferrer",
+      "menuitem_copyLocation",
+      "menuseparator",
+      "menuitem_selectAll",
+      "menuseparator",
+      "menuitem_removeFromList",
+    ]
+  ],
+
+  init: function() {
+    this.downloadView = document.getElementById("downloadView");
+    this.searchBox = document.getElementById("searchbox");
+
+    this.buildList(true);
+
+    this.downloadView.focus();
+
+    // Clear the search box and move focus to the list on escape from the box.
+    this.searchBox.addEventListener("keypress", (e) => {
+      this.searchBoxKeyPressHandler(e);
+    }, false);
+
+    Downloads.getList(Downloads.ALL)
+             .then(list => list.addView(this))
+             .catch(Cu.reportError);
+  },
+
+  buildList: function(aForceBuild) {
+    // Stringify the previous search.
+    let prevSearch = this.searchTerms.join(" ");
+
+    // Array of space-separated lower-case search terms.
+    this.searchTerms = this.searchBox.value.trim().toLowerCase().split(/\s+/);
+
+    // Unless forced, don't rebuild the download list if the search didn't change.
+    if (!aForceBuild && this.searchTerms.join(" ") == prevSearch) {
+      return;
+    }
+
+    // Clear the list before adding items by replacing with a shallow copy.
+    let (empty = this.downloadView.cloneNode(false)) {
+      this.downloadView.parentNode.replaceChild(empty, this.downloadView);
+      this.downloadView = empty;
+    }
+
+    for each (let downloadItem in this.downloadItems) {
+      if (downloadItem.inProgress ||
+          downloadItem.matchesSearch(this.searchTerms, this.searchAttributes)) {
+        this.downloadView.appendChild(downloadItem.element);
+
+        // Because of the joys of XBL, we can't update the buttons until the
+        // download object is in the document.
+        downloadItem.updateView();
+      }
+    }
+
+    this.updateClearListButton();
+  },
+
+  /**
+   * Remove the finished downloads from the shown download list.
+   */
+  clearList: Task.async(function*() {
+    let searchTerms = this.searchTerms;
+
+    let list = yield Downloads.getList(Downloads.ALL);
+
+    yield list.removeFinished((aDownload) => {
+      let downloadItem = this.downloadItemsMap.get(aDownload);
+      if (!downloadItem) {
+        Cu.reportError("Download doesn't exist.");
+        return;
+      }
+
+      return downloadItem.matchesSearch(searchTerms, this.searchAttributes);
+    });
+
+    // Clear the input as if the user did it and move focus to the list.
+    this.searchBox.value = "";
+    this.searchBox.doCommand();
+    this.downloadView.focus();
+  }),
+
+  /**
+   * Update the disabled state of the clear list button based on whether or not
+   * there are items in the list that can potentially be removed.
+   */
+  updateClearListButton: function() {
+    let button = document.getElementById("clearListButton");
+
+    // The button is enabled if we have items in the list that we can clean up.
+    for each (let downloadItem in this.downloadItems) {
+      if (!downloadItem.inProgress &&
+          downloadItem.matchesSearch(this.searchTerms, this.searchAttributes)) {
+        button.disabled = false;
+        return;
+      }
+    }
+
+    button.disabled = true;
+  },
+
+  setSearchboxFocus: function() {
+    this.searchBox.focus();
+    this.searchBox.select();
+  },
+
+  searchBoxKeyPressHandler: function(aEvent) {
+    if (aEvent.keyCode == aEvent.DOM_VK_ESCAPE) {
+      // Move focus to the list instead of closing the window.
+      this.downloadView.focus();
+      aEvent.preventDefault();
+    }
+  },
+
+  buildContextMenu: function(aEvent) {
+    if (aEvent.target.id != "downloadContextMenu") {
+      return false;
+    }
+
+    let popup = document.getElementById("downloadContextMenu");
+    while (popup.hasChildNodes()) {
+      popup.removeChild(popup.firstChild);
+    }
+
+    if (this.downloadView.selectedItem) {
+      let dl = this.downloadView.selectedItem;
+      let downloadItem = this.downloadItems[dl.getAttribute("id")];
+
+      let idx = downloadItem.state;
+      if (idx < 0) {
+        idx = 0;
+      }
+
+      let menus = this.contextMenus[idx];
+      for (let i = 0; i < menus.length; ++i) {
+        let menuitem = document.getElementById(menus[i]).cloneNode(true);
+        let cmd = menuitem.getAttribute("cmd");
+        if (cmd) {
+          menuitem.disabled = !downloadItem.isCommandEnabled(cmd);
+        }
+
+        popup.appendChild(menuitem);
+      }
+
+      return true;
+    }
+
+    return false;
+  },
+
+  /**
+   * Perform the default action for the currently selected download item.
+   */
+  doDefaultForSelected: function() {
+    // Make sure we have something selected.
+    let item = this.downloadView.selectedItem;
+    if (!item) {
+      return;
+    }
+
+    let download = this.downloadItems[item.getAttribute("id")];
+
+    // Get the default action (first item in the menu).
+    let menuitem = document.getElementById(this.contextMenus[download.state][0]);
+
+    // Try to do the action if the command is enabled.
+    download.doCommand(menuitem.getAttribute("cmd"));
+  },
+
+  onDownloadDblClick: function(aEvent) {
+    // Only do the default action for double primary clicks.
+    if (aEvent.button == 0 && aEvent.target.selected) {
+      this.doDefaultForSelected();
+    }
+  },
+
+  /**
+   * Helper function to do commands.
+   *
+   * @param aCmd
+   *        The command to be performed.
+   * @param aItem
+   *        The richlistitem that represents the download that will have the
+   *        command performed on it. If this is null, the command is performed on
+   *        all downloads. If the item passed in is not a richlistitem that
+   *        represents a download, it will walk up the parent nodes until it finds
+   *        a DOM node that is.
+   */
+  performCommand: function(aCmd, aItem) {
+    if (!aItem) {
+      // Convert the nodelist into an array to keep a copy of the download items.
+      let items = Array.from(this.downloadView.selectedItems);
+
+      // Do the command for each download item.
+      for each (let item in items) {
+        this.performCommand(aCmd, item);
+      }
+
+      return;
+    }
+
+    let elm = aItem;
+
+    while (elm.nodeName != "richlistitem" ||
+           elm.getAttribute("type") != "download") {
+      elm = elm.parentNode;
+    }
+
+    let downloadItem = this.downloadItems[elm.getAttribute("id")];
+    downloadItem.doCommand(aCmd);
+  },
+
+  onDragStart: function(aEvent) {
+    if (!this.downloadView.selectedItem) {
+      return;
+    }
+
+    let dl = this.downloadView.selectedItem;
+    let downloadItem = this.downloadItems[dl.getAttribute("id")];
+    let f = downloadItem.localFile;
+    if (!f.exists()) {
+      return;
+    }
+
+    let dt = aEvent.dataTransfer;
+    dt.mozSetDataAt("application/x-moz-file", f, 0);
+    let url = Services.io.newFileURI(f).spec;
+    dt.setData("text/uri-list", url);
+    dt.setData("text/plain", url);
+    dt.effectAllowed = "copyMove";
+    dt.addElement(dl);
+  },
+
+  onDragOver: function(aEvent) {
+    let types = aEvent.dataTransfer.types;
+    if (types.contains("text/uri-list") ||
+        types.contains("text/x-moz-url") ||
+        types.contains("text/plain")) {
+      aEvent.preventDefault();
+    }
+
+    aEvent.stopPropagation();
+  },
+
+  onDrop: function(aEvent) {
+    let dt = aEvent.dataTransfer;
+    // If dragged item is from our source, do not try to
+    // redownload already downloaded file.
+    if (dt.mozGetDataAt("application/x-moz-file", 0)) {
+      return;
+    }
+
+    let name;
+    let url = dt.getData("URL");
+
+    if (!url) {
+      url = dt.getData("text/x-moz-url") || dt.getData("text/plain");
+      [url, name] = url.split("\n");
+    }
+
+    if (url) {
+      let sourceDoc = dt.mozSourceNode ? dt.mozSourceNode.ownerDocument : document;
+      saveURL(url, name ? name : url, null, true, true, null, sourceDoc);
+    }
+  },
+
+  pasteHandler: function() {
+    let trans = Cc["@mozilla.org/widget/transferable;1"].
+                createInstance(Ci.nsITransferable);
+    trans.init(null);
+    let flavors = ["text/x-moz-url", "text/unicode"];
+    flavors.forEach(trans.addDataFlavor);
+
+    Services.clipboard.getData(trans, Services.clipboard.kGlobalClipboard);
+
+    // Getting the data or creating the nsIURI might fail
+    try {
+      let data = {};
+      trans.getAnyTransferData({}, data, {});
+      let [url, name] = data.value.QueryInterface(Ci.nsISupportsString).data.split("\n");
+
+      if (!url) {
+        return;
+      }
+
+      let uri = Services.io.newURI(url, null, null);
+
+      saveURL(uri.spec, name || uri.spec, null, true, true, null, document);
+    } catch (ex) {}
+  },
+
+  selectAll: function() {
+    this.downloadView.selectAll();
+  },
+
+  onUpdateProgress: function() {
+    let numActive = 0;
+    let totalSize = 0;
+    let totalTransferred = 0;
+
+    for each (let downloadItem in this.downloadItems) {
+      if (!downloadItem.inProgress) {
+        continue;
+      }
+
+      numActive++;
+
+      // Only add to total values if we actually know the download size.
+      if (downloadItem.maxBytes > 0 &&
+          downloadItem.state != nsIDM.DOWNLOAD_CANCELED &&
+          downloadItem.state != nsIDM.DOWNLOAD_FAILED) {
+        totalSize += downloadItem.maxBytes;
+        totalTransferred += downloadItem.currBytes;
+      }
+    }
+
+    // Use the default title and reset "last" values if there are no downloads.
+    if (numActive == 0) {
+      document.title = document.documentElement.getAttribute("statictitle");
+      return;
+    }
+
+    // Establish the mean transfer speed and amount downloaded.
+    let mean = totalTransferred;
+
+    // Calculate the percent transferred, unless we don't have a total file size.
+    let title = gStr.downloadsTitlePercent;
+    if (totalSize == 0) {
+      title = gStr.downloadsTitleFiles;
+    } else {
+      mean = Math.floor((totalTransferred / totalSize) * 100);
+    }
+
+    // Get the correct plural form and insert number of downloads and percent.
+    title = PluralForm.get(numActive, title);
+    title = title.replace("#1", numActive);
+    title = title.replace("#2", mean);
+
+    // Update title of window.
+    document.title = title;
+  },
+
+  onDownloadAdded: function(aDownload) {
+    let newID = this._autoIncrementID++;
+
+    let downloadItem = new DownloadItem(newID, aDownload);
+    this.downloadItemsMap.set(aDownload, downloadItem);
+    this.downloadItems[newID] = downloadItem;
+
+    if (downloadItem.inProgress ||
+        downloadItem.matchesSearch(this.searchTerms, this.searchAttributes)) {
+      this.downloadView.appendChild(downloadItem.element);
+
+      // Because of the joys of XBL, we can't update the buttons until the
+      // download object is in the document.
+      downloadItem.updateView();
+
+      // We might have added an item to an empty list, so update button.
+      this.updateClearListButton();
+    }
+  },
+
+  onDownloadChanged: function(aDownload) {
+    let downloadItem = this.downloadItemsMap.get(aDownload);
+    if (!downloadItem) {
+      Cu.reportError("Download doesn't exist.");
+      return;
+    }
+
+    downloadItem.updateView();
+
+    this.onUpdateProgress();
+
+    // The download may have changed state, so update the clear list button.
+    this.updateClearListButton();
+
+    if (downloadItem.done) {
+      // Move the download below active if it should stay in the list.
+      if (downloadItem.matchesSearch(this.searchTerms, this.searchAttributes)) {
+        // Iterate down until we find a non-active download.
+        let next = this.element.nextSibling;
+        while (next && next.inProgress) {
+          next = next.nextSibling;
+        }
+
+        // Move the item.
+        this.downloadView.insertBefore(this.element, next);
+      } else {
+        this.removeFromView(downloadItem);
+      }
+
+      return true;
+    }
+
+    return false;
+  },
+
+  onDownloadRemoved: function(aDownload) {
+    let downloadItem = this.downloadItemsMap.get(aDownload);
+    if (!downloadItem) {
+      Cu.reportError("Download doesn't exist.");
+      return;
+    }
+
+    this.downloadItemsMap.delete(aDownload);
+    delete this.downloadItems[downloadItem.id];
+
+    this.removeFromView(downloadItem);
+  },
+
+  removeFromView: function(aDownloadItem) {
+    // Make sure we have an item to remove.
+    if (!aDownloadItem.element) {
+      return;
+    }
+
+    let index = this.downloadView.selectedIndex;
+    this.downloadView.removeChild(aDownloadItem.element);
+    this.downloadView.selectedIndex = Math.min(index, this.downloadView.itemCount - 1);
+
+    // We might have removed the last item, so update the clear list button.
+    this.updateClearListButton();
+  },
+};
+
+function Startup() {
+  // Convert strings to those in the string bundle.
+  let (sb = document.getElementById("downloadStrings")) {
+    let strings = ["paused", "cannotPause", "doneStatus", "doneSize",
+                   "doneSizeUnknown", "stateFailed", "stateCanceled",
+                   "stateBlocked", "stateBlockedPolicy", "stateDirty",
+                   "downloadsTitleFiles", "downloadsTitlePercent",];
+
+    for each (let name in strings) {
+      gStr[name] = sb.getString(name);
+    }
+  }
+
+  gDownloadList.init();
+
+  let DownloadTaskbarProgress =
+    Cu.import("resource://gre/modules/DownloadTaskbarProgress.jsm", {}).DownloadTaskbarProgress;
+  DownloadTaskbarProgress.onDownloadWindowLoad(window);
+}
+
+function Shutdown() {
+  Downloads.getList(Downloads.ALL)
+           .then(list => list.removeView(gDownloadList))
+           .catch(Cu.reportError);
+}
diff --git a/webapprt/content/downloads/downloads.xul b/webapprt/content/downloads/downloads.xul
new file mode 100644
index 000000000000..ea2847efc100
--- /dev/null
+++ b/webapprt/content/downloads/downloads.xul
@@ -0,0 +1,163 @@
+<?xml version="1.0"?>
+
+# -*- Mode: Java; tab-width: 4; indent-tabs-mode: nil; c-basic-offset: 4 -*-
+# This Source Code Form is subject to the terms of the Mozilla Public
+# License, v. 2.0. If a copy of the MPL was not distributed with this
+# file, You can obtain one at http://mozilla.org/MPL/2.0/.
+
+#ifdef XP_UNIX
+#ifndef XP_MACOSX
+#define XP_GNOME 1
+#endif
+#endif
+
+<?xml-stylesheet href="chrome://global/skin/" type="text/css"?>
+<?xml-stylesheet href="chrome://webapprt/content/downloads/downloads.css"?>
+<?xml-stylesheet href="chrome://webapprt/skin/downloads/downloads.css"?>
+
+<!DOCTYPE window [
+<!ENTITY % downloadManagerDTD SYSTEM "chrome://webapprt/locale/downloads/downloads.dtd">
+%downloadManagerDTD;
+<!ENTITY % editMenuOverlayDTD SYSTEM "chrome://global/locale/editMenuOverlay.dtd">
+%editMenuOverlayDTD;
+]>
+
+<window xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"
+        xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul"
+        id="downloadManager" windowtype="Download:Manager"
+        orient="vertical" title="&downloads.title;" statictitle="&downloads.title;"
+        width="&window.width2;" height="&window.height;" screenX="10" screenY="10"
+        persist="width height screenX screenY sizemode"
+        onload="Startup();" onunload="Shutdown();"
+        onclose="return closeWindow(false);">
+
+  <script type="application/javascript" src="chrome://webapprt/content/downloads/downloads.js"/>
+  <script type="application/javascript" src="chrome://global/content/contentAreaUtils.js"/>
+  <script type="application/javascript" src="chrome://global/content/globalOverlay.js"/>
+
+  <stringbundleset id="downloadSet">
+    <stringbundle id="brandStrings" src="chrome://branding/locale/brand.properties"/>
+    <stringbundle id="downloadStrings" src="chrome://mozapps/locale/downloads/downloads.properties"/>
+  </stringbundleset>
+
+  <!-- Use this commandset for command which do not depened on focus or selection -->
+  <commandset id="generalCommands">
+    <command id="cmd_findDownload" oncommand="gDownloadList.setSearchboxFocus();"/>
+    <command id="cmd_selectAllDownloads" oncommand="gDownloadList.selectAll();"/>
+    <command id="cmd_clearList" oncommand="gDownloadList.clearList();"/>
+  </commandset>
+
+  <keyset id="downloadKeys">
+    <key keycode="VK_RETURN" oncommand="gDownloadList.doDefaultForSelected();"/>
+    <key id="key_pauseResume" key=" " oncommand="gDownloadList.performCommand('cmd_pauseResume');"/>
+    <key id="key_removeFromList"  keycode="VK_DELETE" oncommand="gDownloadList.performCommand('cmd_removeFromList');"/>
+#ifdef XP_MACOSX
+    <key id="key_removeFromList2" keycode="VK_BACK" oncommand="gDownloadList.performCommand('cmd_removeFromList');"/>
+#endif
+    <key id="key_close"   key="&cmd.close.commandKey;"  oncommand="closeWindow(true);"    modifiers="accel"/>
+#ifdef XP_GNOME
+    <key id="key_close2"  key="&cmd.close2Unix.commandKey;" oncommand="closeWindow(true);" modifiers="accel,shift"/>
+#else
+    <key id="key_close2"  key="&cmd.close2.commandKey;" oncommand="closeWindow(true);" modifiers="accel"/>
+#endif
+    <key                  keycode="VK_ESCAPE"           oncommand="closeWindow(true);"/>
+
+    <key id="key_findDownload"
+         key="&cmd.find.commandKey;"
+         modifiers="accel"
+         command="cmd_findDownload"/>
+    <key id="key_findDownload2"
+         key="&cmd.search.commandKey;"
+         modifiers="accel"
+         command="cmd_findDownload"/>
+    <key id="key_selectAllDownloads"
+         key="&selectAllCmd.key;"
+         modifiers="accel"
+         command="cmd_selectAllDownloads"/>
+    <key id="pasteKey"
+         key="V"
+         modifiers="accel"
+         oncommand="gDownloadList.pasteHandler();"/>
+  </keyset>
+
+  <vbox id="contextMenuPalette" hidden="true">
+    <menuitem id="menuitem_pause"
+              label="&cmd.pause.label;" accesskey="&cmd.pause.accesskey;"
+              oncommand="gDownloadList.performCommand('cmd_pause');"
+              cmd="cmd_pause"/>
+    <menuitem id="menuitem_resume"
+              label="&cmd.resume.label;" accesskey="&cmd.resume.accesskey;"
+              oncommand="gDownloadList.performCommand('cmd_resume');"
+              cmd="cmd_resume"/>
+    <menuitem id="menuitem_cancel"
+              label="&cmd.cancel.label;" accesskey="&cmd.cancel.accesskey;"
+              oncommand="gDownloadList.performCommand('cmd_cancel');"
+              cmd="cmd_cancel"/>
+
+    <menuitem id="menuitem_open" default="true"
+              label="&cmd.open.label;" accesskey="&cmd.open.accesskey;"
+              oncommand="gDownloadList.performCommand('cmd_open');"
+              cmd="cmd_open"/>
+    <menuitem id="menuitem_show"
+#ifdef XP_MACOSX
+              label="&cmd.showMac.label;"
+              accesskey="&cmd.showMac.accesskey;"
+#else
+              label="&cmd.show.label;"
+              accesskey="&cmd.show.accesskey;"
+#endif
+              oncommand="gDownloadList.performCommand('cmd_show');"
+              cmd="cmd_show"/>
+
+    <menuitem id="menuitem_retry" default="true"
+              label="&cmd.retry.label;" accesskey="&cmd.retry.accesskey;"
+              oncommand="gDownloadList.performCommand('cmd_retry');"
+              cmd="cmd_retry"/>
+
+    <menuitem id="menuitem_removeFromList"
+              label="&cmd.removeFromList.label;" accesskey="&cmd.removeFromList.accesskey;"
+              oncommand="gDownloadList.performCommand('cmd_removeFromList');"
+              cmd="cmd_removeFromList"/>
+
+    <menuseparator id="menuseparator"/>
+
+    <menuitem id="menuitem_openReferrer"
+              label="&cmd.goToDownloadPage.label;"
+              accesskey="&cmd.goToDownloadPage.accesskey;"
+              oncommand="gDownloadList.performCommand('cmd_openReferrer');"
+              cmd="cmd_openReferrer"/>
+
+    <menuitem id="menuitem_copyLocation"
+              label="&cmd.copyDownloadLink.label;"
+              accesskey="&cmd.copyDownloadLink.accesskey;"
+              oncommand="gDownloadList.performCommand('cmd_copyLocation');"
+              cmd="cmd_copyLocation"/>
+
+    <menuitem id="menuitem_selectAll"
+              label="&selectAllCmd.label;"
+              accesskey="&selectAllCmd.accesskey;"
+              command="cmd_selectAllDownloads"/>
+  </vbox>
+
+  <menupopup id="downloadContextMenu" onpopupshowing="return gDownloadList.buildContextMenu(event);"/>
+
+  <richlistbox id="downloadView" seltype="multiple" flex="1"
+               context="downloadContextMenu"
+               ondblclick="gDownloadList.onDownloadDblClick(event);"
+               ondragstart="gDownloadList.onDragStart(event);"
+               ondragover="gDownloadList.onDragOver(event);"
+               ondrop="gDownloadList.onDrop(event)">
+  </richlistbox>
+
+  <windowdragbox id="search" align="center">
+    <button id="clearListButton" command="cmd_clearList"
+            label="&cmd.clearList.label;"
+            accesskey="&cmd.clearList.accesskey;"
+            tooltiptext="&cmd.clearList.tooltip;"/>
+    <spacer flex="1"/>
+    <textbox type="search" id="searchbox" class="compact"
+             aria-controls="downloadView"
+             oncommand="gDownloadList.buildList();" placeholder="&searchBox.label;"/>
+  </windowdragbox>
+
+</window>
diff --git a/webapprt/jar.mn b/webapprt/jar.mn
index 3cadccaee3a5..d7d2e6338fbe 100644
--- a/webapprt/jar.mn
+++ b/webapprt/jar.mn
@@ -12,3 +12,7 @@ webapprt.jar:
   content/mochitest.js                  (content/mochitest.js)
   content/mochitest.xul                 (content/mochitest.xul)
   content/dbg-webapp-actors.js          (content/dbg-webapp-actors.js)
+* content/downloads/downloads.xul       (content/downloads/downloads.xul)
+  content/downloads/downloads.js        (content/downloads/downloads.js)
+  content/downloads/downloads.css       (content/downloads/downloads.css)
+  content/downloads/download.xml        (content/downloads/download.xml)
diff --git a/webapprt/locales/en-US/webapprt/downloads/downloads.dtd b/webapprt/locales/en-US/webapprt/downloads/downloads.dtd
new file mode 100644
index 000000000000..3c6373cfb81b
--- /dev/null
+++ b/webapprt/locales/en-US/webapprt/downloads/downloads.dtd
@@ -0,0 +1,52 @@
+<!-- This Source Code Form is subject to the terms of the Mozilla Public
+   - License, v. 2.0. If a copy of the MPL was not distributed with this
+   - file, You can obtain one at http://mozilla.org/MPL/2.0/. -->
+
+<!-- LOCALIZATION NOTE (window.width2, window.height): These values should be
+close to the golden ratio (1.618:1) while making sure it's wide enough for long
+file names and tall enough to hint that there are more downloads in the list -->
+<!ENTITY window.width2                    "485">
+<!ENTITY window.height                    "300"> 
+
+<!ENTITY starting.label                   "Starting…">
+<!ENTITY scanning.label                   "Scanning for viruses…">
+
+<!ENTITY downloads.title                  "Downloads">
+
+<!ENTITY cmd.pause.label                  "Pause">
+<!ENTITY cmd.pause.accesskey              "P">
+<!ENTITY cmd.resume.label                 "Resume">
+<!ENTITY cmd.resume.accesskey             "R">
+<!ENTITY cmd.cancel.label                 "Cancel">
+<!ENTITY cmd.cancel.accesskey             "C">
+<!ENTITY cmd.show.label                   "Open Containing Folder">
+<!ENTITY cmd.show.accesskey               "F">
+<!ENTITY cmd.showMac.label                "Show in Finder">
+<!ENTITY cmd.showMac.accesskey            "F">
+<!ENTITY cmd.open.label                   "Open">
+<!ENTITY cmd.open.accesskey               "O">
+<!ENTITY cmd.openWith.label               "Open With…">
+<!ENTITY cmd.openWith.accesskey           "h">
+<!ENTITY cmd.retry.label                  "Retry">
+<!ENTITY cmd.retry.accesskey              "R">
+<!ENTITY cmd.goToDownloadPage.label       "Go to Download Page">
+<!ENTITY cmd.goToDownloadPage.accesskey   "G">
+<!ENTITY cmd.copyDownloadLink.label       "Copy Download Link">
+<!ENTITY cmd.copyDownloadLink.accesskey   "L">
+<!ENTITY cmd.removeFromList.label         "Remove From List">
+<!ENTITY cmd.removeFromList.accesskey     "e">
+
+<!ENTITY cmd.close.commandKey             "w">
+<!ENTITY cmd.close2.commandKey            "j">
+<!ENTITY cmd.close2Unix.commandKey        "y">
+<!ENTITY cmd.clearList.label              "Clear List">
+<!ENTITY cmd.clearList.tooltip            "Removes completed, canceled, and failed downloads from the list">
+<!ENTITY cmd.clearList.accesskey          "C">
+<!ENTITY cmd.find.commandKey              "f">
+<!ENTITY cmd.search.commandKey            "k">
+
+<!ENTITY closeWhenDone.label              "Close when downloads complete">
+<!ENTITY closeWhenDone.tooltip            "Closes the Downloads window when all files are done downloading">
+
+<!ENTITY showFolder.label                 "Show this Folder">
+<!ENTITY searchBox.label                  "Search…">
diff --git a/webapprt/locales/jar.mn b/webapprt/locales/jar.mn
index 0408101c5206..fd0e4aca9209 100644
--- a/webapprt/locales/jar.mn
+++ b/webapprt/locales/jar.mn
@@ -8,8 +8,10 @@
     locale/webapprt/webapp.dtd                     (%webapprt/webapp.dtd)
     locale/webapprt/webapp.properties              (%webapprt/webapp.properties)
     locale/webapprt/getUserMediaDialog.dtd         (%webapprt/getUserMediaDialog.dtd)
-    locale/webapprt/appstrings.properties         (%webapprt/overrides/appstrings.properties)
-    locale/webapprt/dom.properties         (%webapprt/overrides/dom.properties)
+    locale/webapprt/appstrings.properties          (%webapprt/overrides/appstrings.properties)
+    locale/webapprt/dom.properties                 (%webapprt/overrides/dom.properties)
+    locale/webapprt/downloads/downloads.dtd        (%webapprt/downloads/downloads.dtd)
+
 
 % locale branding @AB_CD@ resource://webappbranding/
 
diff --git a/webapprt/moz.build b/webapprt/moz.build
index 92ba5035a456..11773910f1bd 100644
--- a/webapprt/moz.build
+++ b/webapprt/moz.build
@@ -11,7 +11,10 @@ elif CONFIG['OS_ARCH'] == 'Darwin':
 elif CONFIG['MOZ_ENABLE_GTK']:
     DIRS += ['gtk']
 
-DIRS += ['locales']
+DIRS += [
+    'locales',
+    'themes',
+]
 
 EXTRA_COMPONENTS += [
     'CommandLineHandler.js',
@@ -22,6 +25,7 @@ EXTRA_COMPONENTS += [
 ]
 
 EXTRA_JS_MODULES += [
+    'DownloadView.jsm',
     'RemoteDebugger.jsm',
     'Startup.jsm',
     'WebappManager.jsm',
@@ -29,7 +33,10 @@ EXTRA_JS_MODULES += [
     'WebRTCHandler.jsm',
 ]
 
-MOCHITEST_WEBAPPRT_CHROME_MANIFESTS += ['test/chrome/webapprt.ini']
+MOCHITEST_WEBAPPRT_CHROME_MANIFESTS += [
+    'test/chrome/downloads/webapprt.ini',
+    'test/chrome/webapprt.ini',
+]
 MOCHITEST_MANIFESTS += ['test/content/mochitest.ini']
 
 # Place webapprt resources in a separate app dir
diff --git a/webapprt/test/chrome/browser_download.js b/webapprt/test/chrome/browser_download.js
index b12bad4e7f97..02e93553ddd0 100644
--- a/webapprt/test/chrome/browser_download.js
+++ b/webapprt/test/chrome/browser_download.js
@@ -1,4 +1,31 @@
 Cu.import("resource://gre/modules/Services.jsm");
+let { Downloads } = Cu.import("resource://gre/modules/Downloads.jsm", {});
+Cu.import("resource://gre/modules/Task.jsm");
+Cu.import("resource://gre/modules/NetUtil.jsm");
+
+function getFile(aFilename) {
+  // The download database may contain targets stored as file URLs or native
+  // paths.  This can still be true for previously stored items, even if new
+  // items are stored using their file URL.  See also bug 239948 comment 12.
+  if (aFilename.startsWith("file:")) {
+    // Assume the file URL we obtained from the downloads database or from the
+    // "spec" property of the target has the UTF-8 charset.
+    let fileUrl = NetUtil.newURI(aFilename).QueryInterface(Ci.nsIFileURL);
+    return fileUrl.file.clone();
+  }
+
+  // The downloads database contains a native path.  Try to create a local
+  // file, though this may throw an exception if the path is invalid.
+  let file = Cc["@mozilla.org/file/local;1"].createInstance(Ci.nsIFile);
+  file.initWithPath(aFilename);
+  return file;
+}
+
+let fileDownloaded = false;
+
+let download = new DummyDownload("download.test");
+download.state = 1;
+download.percentComplete = 100;
 
 let winObserver = function(win, topic) {
   if (topic == "domwindowopened") {
@@ -9,11 +36,20 @@ let winObserver = function(win, topic) {
           "chrome://mozapps/content/downloads/unknownContentType.xul") {
         ok(true, "Download dialog shown");
 
-        setTimeout(() => {
+        executeSoon(() => {
           let button = win.document.documentElement.getButton("accept");
           button.disabled = false;
           win.document.documentElement.acceptDialog();
-        }, 0);
+        });
+      } else if (win.document.documentURI ==
+          "chrome://webapprt/content/downloads/downloads.xul") {
+        ok(true, "Download manager window shown");
+        ok(fileDownloaded, "File downloaded");
+
+        waitDownloadListPopulation(win).then(() => {
+          test_downloadList(win, [download]);
+          finish();
+        });
       }
     }, false);
   }
@@ -23,36 +59,67 @@ Services.ww.registerNotification(winObserver);
 
 let MockFilePicker = SpecialPowers.MockFilePicker;
 MockFilePicker.init(window);
-MockFilePicker.useAnyFile();
+MockFilePicker.returnFiles = [download.file];
 MockFilePicker.showCallback = function() {
   ok(true, "File picker shown");
   return MockFilePicker.returnOK;
 }
 
 let downloadListener = {
-  onDownloadStateChange: function(aState, aDownload) {
-    if (aDownload.state == Services.downloads.DOWNLOAD_FINISHED) {
-      ok(aDownload.targetFile.exists(), "Download completed");
-      is(aDownload.targetFile.fileSize, 154, "Downloaded file has correct size");
+  onDownloadAdded: function(aDownload) {
+    if (aDownload.succeeded) {
+      let downloadedFile = getFile(aDownload.target.path);
+      ok(downloadedFile.exists(), "Download completed");
+      is(downloadedFile.fileSize, 10, "Downloaded file has correct size");
+      fileDownloaded = true;
+      try {
+        downloadedFile.remove(true);
+      } catch (ex) {
+      }
+    }
+  },
 
-      finish();
+  onDownloadChanged: function(aDownload) {
+    if (aDownload.succeeded) {
+      let downloadedFile = getFile(aDownload.target.path);
+      ok(downloadedFile.exists(), "Download completed");
+      is(downloadedFile.fileSize, 10, "Downloaded file has correct size");
+      fileDownloaded = true;
+      try {
+        downloadedFile.remove(true);
+      } catch (ex) {
+      }
     }
   },
 };
 
-Services.downloads.addListener(downloadListener);
+let downloadList;
 
 registerCleanupFunction(function() {
   Services.wm.getMostRecentWindow("Download:Manager").close();
+
   Services.ww.unregisterNotification(winObserver);
+
   MockFilePicker.cleanup();
-  Services.downloads.removeListener(downloadListener);
+
+  if (downloadList) {
+    return downloadList.removeView(downloadListener);
+  }
 });
 
 function test() {
   waitForExplicitFinish();
 
   loadWebapp("download.webapp", undefined, function onLoad() {
-    gAppBrowser.contentDocument.getElementById("download").click();
+    Task.spawn(function*() {
+      downloadList = yield Downloads.getList(Downloads.ALL);
+
+      yield downloadList.addView(downloadListener);
+
+      gAppBrowser.contentDocument.getElementById("download").click();
+    }).catch(function(e) {
+      ok(false, "Error during test: " + e);
+      SimpleTest.finish();
+    });
   });
 }
diff --git a/webapprt/test/chrome/download.html b/webapprt/test/chrome/download.html
index 7ec1a205d5ae..a04e903b7140 100644
--- a/webapprt/test/chrome/download.html
+++ b/webapprt/test/chrome/download.html
@@ -6,6 +6,6 @@
   </head>
   <body>
     <h1>Download Test App</h1>
-    <a id="download" href="http://mochi.test:8888//webapprtChrome/webapprt/test/chrome/download.webapp">Download</a>
+    <a id="download" href="http://mochi.test:8888//webapprtChrome/webapprt/test/chrome/download.test">Download</a>
   </body>
 </html>
diff --git a/webapprt/test/chrome/download.test b/webapprt/test/chrome/download.test
new file mode 100644
index 000000000000..fafd745150eb
--- /dev/null
+++ b/webapprt/test/chrome/download.test
@@ -0,0 +1 @@
+TEST FILE
diff --git a/webapprt/test/chrome/downloads/browser_add_download.js b/webapprt/test/chrome/downloads/browser_add_download.js
new file mode 100644
index 000000000000..899a60eb71e7
--- /dev/null
+++ b/webapprt/test/chrome/downloads/browser_add_download.js
@@ -0,0 +1,44 @@
+Cu.import("resource://gre/modules/Services.jsm");
+
+let list = MockDownloadsModule();
+
+let downloadsInList = [
+  new DummyDownload("test1"),
+  new DummyDownload("test2"),
+];
+
+let winObserver = function(win, topic) {
+  if (topic == "domwindowopened") {
+    win.addEventListener("load", function onLoadWindow() {
+      win.removeEventListener("load", onLoadWindow, false);
+
+      if (win.document.documentURI ==
+          "chrome://webapprt/content/downloads/downloads.xul") {
+        ok(true, "Download manager window shown");
+
+        waitDownloadListPopulation(win).then(() => {
+          test_downloadList(win, downloadsInList);
+          finish();
+        });
+      }
+    }, false);
+  }
+}
+
+Services.ww.registerNotification(winObserver);
+
+registerCleanupFunction(function() {
+  Services.ww.unregisterNotification(winObserver);
+
+  Services.wm.getMostRecentWindow("Download:Manager").close();
+});
+
+function test() {
+  waitForExplicitFinish();
+
+  loadWebapp("download.webapp", undefined, function onLoad() {
+    for each (let download in downloadsInList) {
+      list.addDownload(download);
+    }
+  });
+}
diff --git a/webapprt/test/chrome/downloads/browser_remove_download.js b/webapprt/test/chrome/downloads/browser_remove_download.js
new file mode 100644
index 000000000000..ee78e99c88e6
--- /dev/null
+++ b/webapprt/test/chrome/downloads/browser_remove_download.js
@@ -0,0 +1,45 @@
+Cu.import("resource://gre/modules/Services.jsm");
+
+let list = MockDownloadsModule();
+
+let download = new DummyDownload("test");
+let removedDownload = new DummyDownload("removed");
+
+let winObserver = function(win, topic) {
+  if (topic == "domwindowopened") {
+    win.addEventListener("load", function onLoadWindow() {
+      win.removeEventListener("load", onLoadWindow, false);
+
+      if (win.document.documentURI ==
+          "chrome://webapprt/content/downloads/downloads.xul") {
+        ok(true, "Download manager window shown");
+
+        waitDownloadListPopulation(win).then(() => {
+          test_downloadList(win, [download, removedDownload]);
+          list.removeDownload(removedDownload);
+          executeSoon(() => {
+            test_downloadList(win, [download]);
+            finish();
+          });
+        });
+      }
+    }, false);
+  }
+}
+
+Services.ww.registerNotification(winObserver);
+
+registerCleanupFunction(function() {
+  Services.ww.unregisterNotification(winObserver);
+
+  Services.wm.getMostRecentWindow("Download:Manager").close();
+});
+
+function test() {
+  waitForExplicitFinish();
+
+  loadWebapp("download.webapp", undefined, function onLoad() {
+    list.addDownload(download);
+    list.addDownload(removedDownload);
+  });
+}
diff --git a/webapprt/test/chrome/downloads/webapprt.ini b/webapprt/test/chrome/downloads/webapprt.ini
new file mode 100644
index 000000000000..a1b511836f68
--- /dev/null
+++ b/webapprt/test/chrome/downloads/webapprt.ini
@@ -0,0 +1,6 @@
+[DEFAULT]
+support-files =
+  ../head.js
+
+[browser_add_download.js]
+[browser_remove_download.js]
diff --git a/webapprt/test/chrome/head.js b/webapprt/test/chrome/head.js
index 77777fb4853e..5ff420b6ee94 100644
--- a/webapprt/test/chrome/head.js
+++ b/webapprt/test/chrome/head.js
@@ -40,7 +40,195 @@ function loadWebapp(manifest, parameters, onLoad) {
     let { DOMApplicationRegistry } = Cu.import("resource://gre/modules/Webapps.jsm", {});
 
     return new Promise(function(resolve, reject) {
-      DOMApplicationRegistry.uninstall(url.spec, resolve, reject);
+      DOMApplicationRegistry.uninstall(url.spec, () => {
+        // Load another page in the browser element, this is needed for tests
+        // that use the same app (that have the same URL).
+        gAppBrowser.setAttribute("src", "about:blank");
+
+        resolve();
+      }, reject);
     });
   });
 }
+
+// Utilities for the downloads tests
+
+let MockDownloadList = function() {
+};
+
+MockDownloadList.prototype = {
+  downloads: new Set(),
+  views: new Set(),
+
+  addView: function(aView) {
+    this.views.add(aView);
+
+    for (let download of this.downloads) {
+      for (let view of this.views) {
+        view.onDownloadAdded(download);
+      }
+    }
+  },
+
+  removeView: function(aView) {
+    this.views.delete(aView);
+  },
+
+  addDownload: function(aDownload) {
+    this.downloads.add(aDownload);
+
+    for (let view of this.views) {
+      view.onDownloadAdded(aDownload);
+    }
+  },
+
+  changeDownload: function(aDownload) {
+    for (let view of this.views) {
+      if (view.onDownloadChanged) {
+        view.onDownloadChanged(aDownload);
+      }
+    }
+  },
+
+  removeDownload: function(aDownload) {
+    this.downloads.delete(aDownload);
+
+    for (let view of this.views) {
+      if (view.onDownloadRemoved) {
+        view.onDownloadRemoved(aDownload);
+      }
+    }
+  },
+}
+
+function MockDownloadsModule() {
+  let { DownloadView } = Cu.import("resource://webapprt/modules/DownloadView.jsm", {});
+
+  let list = new MockDownloadList();
+
+  let { Downloads } = Cu.import("resource://gre/modules/Downloads.jsm", {});
+  let oldDownloadsGetList = Downloads.getList;
+
+  Downloads.getList = function(aKind) {
+    return new Promise(function(resolve, reject) {
+      resolve(list);
+    });
+  };
+
+  registerCleanupFunction(function() {
+    list.removeView(DownloadView);
+
+    Downloads.getList = oldDownloadsGetList;
+  });
+
+  // Reinitialize DownloadView because it's already initialized
+  // when the webapprt test starts.
+  // We need to reinitialize it so that it gets associated to the
+  // MockDownloadList object that we've created.
+  DownloadView.init();
+
+  return list;
+}
+
+function DummyDownload(aFileName) {
+  this.file = Services.dirsvc.get("ProfD", Ci.nsIFile);
+  this.file.append(aFileName);
+  this.file.createUnique(Ci.nsIFile.NORMAL_FILE_TYPE, 0o644);
+
+  this.startTime = Date.now();
+  this.source = {
+    url: "http://mochi.test:8888//webapprtChrome/webapprt/test/chrome/download.webapp",
+    isPrivate: false,
+    referrer: null,
+  };
+  this.target = {
+    path: this.file.path,
+    partFilePath: this.file.path + ".part",
+  }
+};
+
+DummyDownload.prototype = {
+  succeeded: false,
+  canceled: false,
+  stopped: false,
+  hasPartialData: false,
+  hasProgress: false,
+  progress: 0,
+  currentBytes: 0,
+  totalBytes: 0,
+  error: null,
+
+  // Attributes needed to test the download item in the richlistbox
+  state: 0,
+  percentComplete: -1,
+};
+
+function waitDownloadListPopulation(aWin) {
+  return new Promise(function(resolve, reject) {
+    let disconnected = false;
+
+    var observer = new MutationObserver(function(aMutations) {
+      for each (let mutation in aMutations) {
+        if (mutation.addedNodes) {
+          for each (let node in mutation.addedNodes) {
+            if (node.id == "downloadView") {
+              observer.disconnect();
+              disconnected = true;
+
+              // Wait for the resolution of the Downloads.getList promise.
+              executeSoon(() => {
+                resolve();
+              });
+            }
+          }
+        }
+      }
+    });
+
+    observer.observe(aWin.document, {
+      childList: true,
+      subtree: true,
+      attributes: false,
+      characterData: false
+    });
+
+    registerCleanupFunction(function() {
+      if (!disconnected) {
+        observer.disconnect();
+      }
+    });
+  });
+}
+
+function test_downloadList(aWin, aDownloadList) {
+  let richlistbox = aWin.document.getElementById("downloadView");
+
+  is(richlistbox.children.length, aDownloadList.length,
+     "There is the correct number of richlistitems");
+
+  for (let i = 0; i < richlistbox.children.length; i++) {
+    let elm = richlistbox.children[i];
+
+    let name = elm.getAttribute("target");
+
+    let download = null;
+    for (let d = 0; d < aDownloadList.length; d++) {
+      if (aDownloadList[d].file.leafName == name) {
+        download = aDownloadList[d];
+        aDownloadList.splice(d, 1);
+      }
+    }
+
+    if (!download) {
+      ok(false, "Download item unexpected");
+    } else {
+      ok(true, "Download item expected");
+      is(elm.getAttribute("state"), download.state, "Download state correct");
+      is(elm.getAttribute("progress"), download.percentComplete,
+         "Download progress correct");
+    }
+  }
+
+  is(aDownloadList.length, 0,
+     "All the downloads expected to be in the list were in the list");
+}
diff --git a/webapprt/test/chrome/webapprt.ini b/webapprt/test/chrome/webapprt.ini
index 91476a9b04d1..c97b88a2a266 100644
--- a/webapprt/test/chrome/webapprt.ini
+++ b/webapprt/test/chrome/webapprt.ini
@@ -45,7 +45,7 @@ support-files =
   download.html
   download.webapp
   download.webapp^headers^
-
+  download.test
 
 [browser_sample.js]
 [browser_window-title.js]
diff --git a/webapprt/themes/LICENSE b/webapprt/themes/LICENSE
new file mode 100644
index 000000000000..39d4f8fdf519
--- /dev/null
+++ b/webapprt/themes/LICENSE
@@ -0,0 +1,2 @@
+All files in this directory are assumed to be licensed under the MPL 2 license
+which is used throughout this codebase.
diff --git a/webapprt/themes/linux/downloads/downloadIcon.png b/webapprt/themes/linux/downloads/downloadIcon.png
new file mode 100644
index 000000000000..39eeb7be177f
Binary files /dev/null and b/webapprt/themes/linux/downloads/downloadIcon.png differ
diff --git a/webapprt/themes/linux/downloads/downloads.css b/webapprt/themes/linux/downloads/downloads.css
new file mode 100644
index 000000000000..bb441f4b115d
--- /dev/null
+++ b/webapprt/themes/linux/downloads/downloads.css
@@ -0,0 +1,112 @@
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+#downloadManager {
+  background-color: ThreeDFace;
+}
+
+/* Download View */
+#downloadView {
+  -moz-appearance: none !important;
+  margin: 0;
+  border-bottom: 2px solid;
+  -moz-border-bottom-colors: ThreeDHighlight ThreeDLightShadow;
+}
+
+/* Download View Items */
+richlistitem[type="download"] {
+  padding: 4px 8px 4px 4px;
+  min-height: 46px;
+}
+
+richlistitem[type="download"]:not([selected="true"]):nth-child(odd) {
+  background-color: -moz-oddtreerow;
+}
+
+richlistitem[type="download"] .name {
+  font-size: larger;
+}
+
+richlistitem[type="download"] .dateTime {
+  font-size: smaller;
+}
+
+.mini-button {
+  -moz-appearance: none;
+  background-color: transparent;
+  border: none;
+  padding: 0;
+  margin: 0;
+  min-width: 0;
+  min-height: 0;
+}
+
+.mini-button > .button-box {
+  padding: 0 !important;
+}
+
+menuitem:not([type]) {
+  -moz-binding: url("chrome://global/content/bindings/menu.xml#menuitem-iconic");
+}
+
+.cancel,
+#menuitem_cancel {
+  list-style-image: url("moz-icon://stock/gtk-cancel?size=menu");
+}
+
+#menuitem_open {
+  list-style-image: url("moz-icon://stock/gtk-open?size=menu");
+}
+#menuitem_open[disabled="true"] {
+  list-style-image: url("moz-icon://stock/gtk-open?size=menu&state=disabled");
+}
+
+.pause,
+#menuitem_pause {
+  list-style-image: url("moz-icon://stock/gtk-media-pause?size=menu");
+}
+
+.pause[disabled="true"],
+#menuitem_pause[disabled="true"] {
+  list-style-image: url("moz-icon://stock/gtk-media-pause?size=menu&state=disabled");
+}
+
+.resume,
+#menuitem_resume {
+  list-style-image: url("moz-icon://stock/gtk-media-play?size=menu");
+}
+
+.retry,
+#menuitem_retry {
+  list-style-image: url("moz-icon://stock/gtk-redo?size=menu");
+}
+
+#menuitem_removeFromList {
+  list-style-image: url("moz-icon://stock/gtk-remove?size=menu");
+}
+
+#menuitem_copyLocation {
+  list-style-image: url("moz-icon://stock/gtk-copy?size=menu");
+}
+
+.blockedIcon {
+  list-style-image: url("moz-icon://stock/gtk-dialog-error?size=dialog");
+  width: 32px;
+  height: 32px;
+}
+
+/* prevent flickering when changing states */
+.downloadTypeIcon {
+  min-height: 32px;
+  min-width: 32px;
+}
+
+#clearListButton {
+  list-style-image: url(moz-icon://stock/gtk-clear?size=button);
+  margin-top: 3px;
+}
+
+#clearListButton[disabled="true"] {
+  list-style-image: url(moz-icon://stock/gtk-clear?size=button&state=disabled);
+}
diff --git a/webapprt/themes/linux/jar.mn b/webapprt/themes/linux/jar.mn
new file mode 100644
index 000000000000..84d620d1100c
--- /dev/null
+++ b/webapprt/themes/linux/jar.mn
@@ -0,0 +1,7 @@
+# This Source Code Form is subject to the terms of the Mozilla Public
+# License, v. 2.0. If a copy of the MPL was not distributed with this
+# file, You can obtain one at http://mozilla.org/MPL/2.0/.
+
+webapprt.jar:
++ skin/classic/webapprt/downloads/downloadIcon.png          (downloads/downloadIcon.png)
++ skin/classic/webapprt/downloads/downloads.css             (downloads/downloads.css)
diff --git a/webapprt/themes/linux/moz.build b/webapprt/themes/linux/moz.build
new file mode 100644
index 000000000000..c97072bba2df
--- /dev/null
+++ b/webapprt/themes/linux/moz.build
@@ -0,0 +1,7 @@
+# -*- Mode: python; c-basic-offset: 4; indent-tabs-mode: nil; tab-width: 40 -*-
+# vim: set filetype=python:
+# This Source Code Form is subject to the terms of the Mozilla Public
+# License, v. 2.0. If a copy of the MPL was not distributed with this
+# file, You can obtain one at http://mozilla.org/MPL/2.0/.
+
+JAR_MANIFESTS += ['jar.mn']
\ No newline at end of file
diff --git a/webapprt/themes/moz.build b/webapprt/themes/moz.build
new file mode 100644
index 000000000000..228393cd5a57
--- /dev/null
+++ b/webapprt/themes/moz.build
@@ -0,0 +1,22 @@
+# -*- Mode: python; c-basic-offset: 4; indent-tabs-mode: nil; tab-width: 40 -*-
+# vim: set filetype=python:
+# This Source Code Form is subject to the terms of the Mozilla Public
+# License, v. 2.0. If a copy of the MPL was not distributed with this
+# file, You can obtain one at http://mozilla.org/MPL/2.0/.
+
+# Theme Selection
+#
+# MacOS X                 osx (toolkit/themes/osx)
+# Windows                 windows (toolkit/themes/windows)
+# GNOME/Linux             windows (toolkit/themes/windows) +
+#                         linux overrides (toolkit/themes/linux)
+
+toolkit = CONFIG['MOZ_WIDGET_TOOLKIT']
+
+if toolkit == 'cocoa':
+    DIRS += ['osx']
+else:
+    DIRS += ['windows']
+
+    if toolkit in ('gtk2', 'gtk3', 'qt'):
+        DIRS += ['linux']
diff --git a/webapprt/themes/osx/downloads/buttons.png b/webapprt/themes/osx/downloads/buttons.png
new file mode 100644
index 000000000000..04da26a25248
Binary files /dev/null and b/webapprt/themes/osx/downloads/buttons.png differ
diff --git a/webapprt/themes/osx/downloads/downloadIcon.png b/webapprt/themes/osx/downloads/downloadIcon.png
new file mode 100644
index 000000000000..42dc4943d7a5
Binary files /dev/null and b/webapprt/themes/osx/downloads/downloadIcon.png differ
diff --git a/webapprt/themes/osx/downloads/downloads.css b/webapprt/themes/osx/downloads/downloads.css
new file mode 100644
index 000000000000..8f4cacf9abaa
--- /dev/null
+++ b/webapprt/themes/osx/downloads/downloads.css
@@ -0,0 +1,121 @@
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+#downloadView {
+  -moz-appearance: none;
+  margin: 0;
+  padding: 0;
+  border-width: 0;
+}
+
+/* Download View Items */
+richlistitem[type="download"] {
+  padding: 5px;
+  min-height: 44px !important;
+  border: 1px solid transparent;
+}
+
+richlistitem[type="download"]:not([selected="true"]):nth-child(odd) {
+  background-color: -moz-oddtreerow;
+}
+
+richlistitem[type="download"] .dateTime,
+richlistitem[type="download"] .status {
+  font-size: smaller;
+  color: #555;
+}
+
+richlistitem[selected="true"][type="download"] {
+  outline: none;
+}
+
+richlistbox:focus > richlistitem[selected="true"][type="download"] .dateTime,
+richlistbox:focus > richlistitem[selected="true"][type="download"] .status {
+  color: highlighttext;
+}
+
+
+richlistitem[type="download"] button {
+  -moz-appearance: none;
+  min-height: 16px;
+  min-width: 16px;
+  max-height: 16px;
+  max-width: 16px;
+  padding: 0;
+  margin: 0 1px 0 1px;
+}
+
+/**
+ * Images for buttons in the interface
+ */
+richlistitem[type="download"] button {
+  list-style-image: url(chrome://webapprt/skin/downloads/buttons.png);
+}
+.cancel {
+  -moz-image-region: rect(0px, 16px, 16px, 0px);
+}
+.cancel:hover {
+  -moz-image-region: rect(0px, 32px, 16px, 16px);
+}
+.cancel:hover:active {
+  -moz-image-region: rect(0px, 48px, 16px, 32px);
+}
+
+.pause {
+  -moz-image-region: rect(48px, 16px, 64px, 0px);
+}
+.pause:hover {
+  -moz-image-region: rect(48px, 32px, 64px, 16px);
+}
+.pause:not([disabled="true"]):hover:active {
+  -moz-image-region: rect(48px, 48px, 64px, 32px);
+}
+.pause[disabled="true"] {
+  -moz-image-region: rect(48px, 16px, 64px, 0px);
+}
+
+.resume {
+  -moz-image-region: rect(16px, 16px, 32px, 0px);
+}
+.resume:hover {
+  -moz-image-region: rect(16px, 32px, 32px, 16px);
+}
+.resume:hover:active {
+  -moz-image-region: rect(16px, 48px, 32px, 32px);
+}
+
+.retry {
+  -moz-image-region: rect(32px, 16px, 48px, 0px);
+}
+.retry:hover {
+  -moz-image-region: rect(32px, 32px, 48px, 16px);
+}
+.retry:hover:active {
+  -moz-image-region: rect(32px, 48px, 48px, 32px);
+}
+
+.blockedIcon {
+  list-style-image: url(chrome://global/skin/icons/Error.png);
+}
+
+/* prevent flickering when changing states */
+.downloadTypeIcon {
+  height: 32px;
+  width: 32px;
+  -moz-padding-end: 2px;
+}
+
+#search {
+  -moz-box-pack: end;
+  -moz-padding-end: 4px;
+  -moz-appearance: statusbar;
+}
+
+#clearListButton {
+  -moz-appearance: toolbarbutton;
+  min-height: 18px;
+  min-width: 0;
+  margin: 0 6px;
+  text-shadow: 0 1px rgba(255, 255, 255, .4);
+}
diff --git a/webapprt/themes/osx/jar.mn b/webapprt/themes/osx/jar.mn
new file mode 100644
index 000000000000..73dfd0420508
--- /dev/null
+++ b/webapprt/themes/osx/jar.mn
@@ -0,0 +1,9 @@
+# This Source Code Form is subject to the terms of the Mozilla Public
+# License, v. 2.0. If a copy of the MPL was not distributed with this
+# file, You can obtain one at http://mozilla.org/MPL/2.0/.
+
+webapprt.jar:
+% skin webapprt classic/1.0 %skin/classic/webapprt/
+  skin/classic/webapprt/downloads/buttons.png                      (downloads/buttons.png)
+  skin/classic/webapprt/downloads/downloadIcon.png                 (downloads/downloadIcon.png)
+  skin/classic/webapprt/downloads/downloads.css                    (downloads/downloads.css)
diff --git a/webapprt/themes/osx/moz.build b/webapprt/themes/osx/moz.build
new file mode 100644
index 000000000000..c97072bba2df
--- /dev/null
+++ b/webapprt/themes/osx/moz.build
@@ -0,0 +1,7 @@
+# -*- Mode: python; c-basic-offset: 4; indent-tabs-mode: nil; tab-width: 40 -*-
+# vim: set filetype=python:
+# This Source Code Form is subject to the terms of the Mozilla Public
+# License, v. 2.0. If a copy of the MPL was not distributed with this
+# file, You can obtain one at http://mozilla.org/MPL/2.0/.
+
+JAR_MANIFESTS += ['jar.mn']
\ No newline at end of file
diff --git a/webapprt/themes/windows/downloads/downloadButtons-aero.png b/webapprt/themes/windows/downloads/downloadButtons-aero.png
new file mode 100644
index 000000000000..a5d0944eb48d
Binary files /dev/null and b/webapprt/themes/windows/downloads/downloadButtons-aero.png differ
diff --git a/webapprt/themes/windows/downloads/downloadButtons.png b/webapprt/themes/windows/downloads/downloadButtons.png
new file mode 100644
index 000000000000..d36385ce535c
Binary files /dev/null and b/webapprt/themes/windows/downloads/downloadButtons.png differ
diff --git a/webapprt/themes/windows/downloads/downloadIcon-aero.png b/webapprt/themes/windows/downloads/downloadIcon-aero.png
new file mode 100644
index 000000000000..fd01949cbb98
Binary files /dev/null and b/webapprt/themes/windows/downloads/downloadIcon-aero.png differ
diff --git a/webapprt/themes/windows/downloads/downloadIcon.png b/webapprt/themes/windows/downloads/downloadIcon.png
new file mode 100644
index 000000000000..8225b6c2dc45
Binary files /dev/null and b/webapprt/themes/windows/downloads/downloadIcon.png differ
diff --git a/webapprt/themes/windows/downloads/downloads-aero.css b/webapprt/themes/windows/downloads/downloads-aero.css
new file mode 100644
index 000000000000..7dd410f9b0c1
--- /dev/null
+++ b/webapprt/themes/windows/downloads/downloads-aero.css
@@ -0,0 +1,32 @@
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+%include downloads.css
+
+@media (-moz-windows-compositor) {
+  #downloadManager {
+    -moz-appearance: -moz-win-glass;
+    background: transparent;
+  }
+
+  #downloadView {
+    /* Clamp glass bounds to the rich list so our glass haze stays constant. */
+    -moz-appearance: -moz-win-exclude-glass;
+    border: none;
+  }
+
+  windowdragbox {
+    -moz-binding: url("chrome://global/content/bindings/general.xml#windowdragbox");
+  }
+
+  #clearListButton {
+    -moz-margin-start: 0;
+    margin-bottom: 0;
+  }
+
+  #searchbox {
+    -moz-margin-end: 0;
+    margin-bottom: 0;
+  }
+}
diff --git a/webapprt/themes/windows/downloads/downloads.css b/webapprt/themes/windows/downloads/downloads.css
new file mode 100644
index 000000000000..b9ab16b07632
--- /dev/null
+++ b/webapprt/themes/windows/downloads/downloads.css
@@ -0,0 +1,112 @@
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+#downloadManager {
+  background-color: ThreeDFace;
+}
+
+/* Download View */
+@media not all and (-moz-windows-classic) {
+  #downloadView {
+    -moz-appearance: none;
+    margin: 0;
+    border-bottom: 2px solid;
+    -moz-border-bottom-colors: ThreeDHighlight ThreeDLightShadow;
+  }
+}
+
+/* Download View Items */
+richlistitem[type="download"] {
+  padding: 4px 8px 4px 4px;
+  min-height: 46px;
+  border-bottom: 1px solid ThreeDLightShadow;
+}
+
+richlistitem[type="download"] .name {
+  font-size: larger;
+}
+
+richlistitem[type="download"] .dateTime {
+  font-size: smaller;
+}
+
+.mini-button {
+  -moz-appearance: none;
+  list-style-image: url(chrome://webapprt/skin/downloads/downloadButtons.png);
+  background-color: transparent;
+  border: none;
+  padding: 0;
+  margin: 0;
+  min-width: 0;
+  min-height: 0;
+}
+
+.mini-button > .button-box {
+  padding: 0 !important;
+}
+
+.cancel {
+  -moz-image-region: rect(0px, 32px, 16px, 16px);
+}
+.cancel:hover {
+  -moz-image-region: rect(16px, 32px, 32px, 16px);
+}
+.cancel:active {
+  -moz-image-region: rect(32px, 32px, 48px, 16px);
+}
+.cancel[disabled="true"] {
+  -moz-image-region: rect(48px, 32px, 64px, 16px);
+}
+.pause {
+  -moz-image-region: rect(0px, 48px, 16px, 32px);
+}
+.pause:hover {
+  -moz-image-region: rect(16px, 48px, 32px, 32px);
+}
+.pause:active {
+  -moz-image-region: rect(32px, 48px, 48px, 32px);
+}
+.pause[disabled="true"] {
+  -moz-image-region: rect(48px, 48px, 64px, 32px);
+}
+.resume {
+  -moz-image-region: rect(0px, 16px, 16px, 0px);
+}
+.resume:hover {
+  -moz-image-region: rect(16px, 16px, 32px, 0px);
+}
+.resume:active {
+  -moz-image-region: rect(32px, 16px, 48px, 0px);
+}
+.resume[disabled="true"] {
+  -moz-image-region: rect(48px, 16px, 64px, 0px);
+}
+.retry {
+  -moz-image-region: rect(0px, 64px, 16px, 48px);
+}
+.retry:hover {
+  -moz-image-region: rect(16px, 64px, 32px, 48px);
+}
+.retry:active {
+  -moz-image-region: rect(32px, 64px, 48px, 48px);
+}
+.retry[disabled="true"] {
+  -moz-image-region: rect(48px, 64px, 64px, 48px);
+}
+
+.blockedIcon {
+  list-style-image: url(chrome://global/skin/icons/Error.png);
+}
+
+/* prevent flickering when changing states */
+.downloadTypeIcon {
+  min-height: 32px;
+  min-width: 32px;
+}
+
+#clearListButton {
+  min-height: 0;
+  min-width: 0;
+  margin-top: 3px;
+}
diff --git a/webapprt/themes/windows/jar.mn b/webapprt/themes/windows/jar.mn
new file mode 100644
index 000000000000..057e67357ecb
--- /dev/null
+++ b/webapprt/themes/windows/jar.mn
@@ -0,0 +1,20 @@
+# This Source Code Form is subject to the terms of the Mozilla Public
+# License, v. 2.0. If a copy of the MPL was not distributed with this
+# file, You can obtain one at http://mozilla.org/MPL/2.0/.
+
+webapprt.jar:
+% skin webapprt classic/1.0 %skin/classic/webapprt/ os=WINNT osversion<6
+% skin webapprt classic/1.0 %skin/classic/webapprt/ os!=WINNT
+# NOTE: If you add a new file here, you'll need to add it to the aero
+# section at the bottom of this file
+        skin/classic/webapprt/downloads/downloadButtons.png         (downloads/downloadButtons.png)
+        skin/classic/webapprt/downloads/downloadIcon.png            (downloads/downloadIcon.png)
+        skin/classic/webapprt/downloads/downloads.css               (downloads/downloads.css)
+
+#ifdef XP_WIN
+webapprt.jar:
+% skin webapprt classic/1.0 %skin/classic/aero/webapprt/ os=WINNT osversion>=6
+        skin/classic/aero/webapprt/downloads/downloadButtons.png            (downloads/downloadButtons-aero.png)
+        skin/classic/aero/webapprt/downloads/downloadIcon.png               (downloads/downloadIcon-aero.png)
+*       skin/classic/aero/webapprt/downloads/downloads.css                  (downloads/downloads-aero.css)
+#endif
diff --git a/webapprt/themes/windows/moz.build b/webapprt/themes/windows/moz.build
new file mode 100644
index 000000000000..c97072bba2df
--- /dev/null
+++ b/webapprt/themes/windows/moz.build
@@ -0,0 +1,7 @@
+# -*- Mode: python; c-basic-offset: 4; indent-tabs-mode: nil; tab-width: 40 -*-
+# vim: set filetype=python:
+# This Source Code Form is subject to the terms of the Mozilla Public
+# License, v. 2.0. If a copy of the MPL was not distributed with this
+# file, You can obtain one at http://mozilla.org/MPL/2.0/.
+
+JAR_MANIFESTS += ['jar.mn']
\ No newline at end of file
diff --git a/widget/InputData.h b/widget/InputData.h
index 96abd7131727..6080ba8f6d38 100644
--- a/widget/InputData.h
+++ b/widget/InputData.h
@@ -188,7 +188,7 @@ public:
     mTouches.AppendElements(aOther.mTouches);
   }
 
-  MultiTouchInput(const WidgetTouchEvent& aTouchEvent);
+  explicit MultiTouchInput(const WidgetTouchEvent& aTouchEvent);
   WidgetTouchEvent ToWidgetTouchEvent(nsIWidget* aWidget) const;
 
   // This conversion from WidgetMouseEvent to MultiTouchInput is needed because
@@ -197,7 +197,7 @@ public:
   // the panning code can handle. This code is very limited and only supports
   // SingleTouchData. It also sends garbage for the identifier, radius, force
   // and rotation angle.
-  MultiTouchInput(const WidgetMouseEvent& aMouseEvent);
+  explicit MultiTouchInput(const WidgetMouseEvent& aMouseEvent);
 
   MultiTouchType mType;
   nsTArray<SingleTouchData> mTouches;
diff --git a/widget/cocoa/nsCocoaUtils.h b/widget/cocoa/nsCocoaUtils.h
index d8a77035ba46..57e26d4298c1 100644
--- a/widget/cocoa/nsCocoaUtils.h
+++ b/widget/cocoa/nsCocoaUtils.h
@@ -54,7 +54,7 @@ class SourceSurface;
 // Used to retain a Cocoa object for the remainder of a method's execution.
 class nsAutoRetainCocoaObject {
 public:
-nsAutoRetainCocoaObject(id anObject)
+explicit nsAutoRetainCocoaObject(id anObject)
 {
   mObject = NS_OBJC_TRY_EXPR_ABORT([anObject retain]);
 }
diff --git a/widget/cocoa/nsCocoaWindow.mm b/widget/cocoa/nsCocoaWindow.mm
index 484bfbe4ccc8..56f3a155548d 100644
--- a/widget/cocoa/nsCocoaWindow.mm
+++ b/widget/cocoa/nsCocoaWindow.mm
@@ -1790,6 +1790,10 @@ NS_IMETHODIMP nsCocoaWindow::SetFocus(bool aState)
     mPopupContentView->SetFocus(aState);
   }
   else if (aState && ([mWindow isVisible] || [mWindow isMiniaturized])) {
+    if ([mWindow isMiniaturized]) {
+      [mWindow deminiaturize:nil];
+    }
+
     [mWindow makeKeyAndOrderFront:nil];
     SendSetZLevelEvent();
   }
diff --git a/widget/windows/winrt/MetroInput.cpp b/widget/windows/winrt/MetroInput.cpp
index 8a1324da1003..8e7bde5fde90 100644
--- a/widget/windows/winrt/MetroInput.cpp
+++ b/widget/windows/winrt/MetroInput.cpp
@@ -737,9 +737,7 @@ MetroInput::TransformRefPoint(const Foundation::Point& aPosition, LayoutDeviceIn
   // If this event is destined for content we need to transform our ref point through
   // the apz so that zoom can be accounted for.
   aRefPointOut = LayoutDeviceIntPoint::FromUntyped(MetroUtils::LogToPhys(aPosition));
-  ScreenIntPoint spt;
-  spt.x = aRefPointOut.x;
-  spt.y = aRefPointOut.y;
+  ScreenIntPoint spt(aRefPointOut.x, aRefPointOut.y);
   // This is currently a general contained rect hit test, it may produce a false positive for
   // overlay chrome elements.
   bool apzIntersect = mWidget->ApzHitTest(spt);
diff --git a/widget/xpwidgets/nsBaseWidget.cpp b/widget/xpwidgets/nsBaseWidget.cpp
index c06c1967fa06..d8f6bdf544eb 100644
--- a/widget/xpwidgets/nsBaseWidget.cpp
+++ b/widget/xpwidgets/nsBaseWidget.cpp
@@ -1805,8 +1805,8 @@ nsBaseWidget::debug_DumpEvent(FILE *                aFileOut,
           (void *) aWidget,
           aWidgetName.get(),
           aWindowID,
-          aGuiEvent->refPoint.x,
-          aGuiEvent->refPoint.y);
+          aGuiEvent->refPoint.x.value,
+          aGuiEvent->refPoint.y.value);
 }
 //////////////////////////////////////////////////////////////
 /* static */ void
diff --git a/xpcom/glue/DeadlockDetector.h b/xpcom/glue/DeadlockDetector.h
index 3763b34a73a0..e16443935ee0 100644
--- a/xpcom/glue/DeadlockDetector.h
+++ b/xpcom/glue/DeadlockDetector.h
@@ -83,7 +83,7 @@ private:
    */
   struct OrderingEntry
   {
-    OrderingEntry(const T* aResource)
+    explicit OrderingEntry(const T* aResource)
       : mOrderedLT()        // FIXME bug 456272: set to empirical dep size?
       , mExternalRefs()
       , mResource(aResource)
diff --git a/xpcom/glue/nsTPriorityQueue.h b/xpcom/glue/nsTPriorityQueue.h
index 417fc491ea40..2fcfcc4206a0 100644
--- a/xpcom/glue/nsTPriorityQueue.h
+++ b/xpcom/glue/nsTPriorityQueue.h
@@ -31,7 +31,7 @@ public:
    * Constructor to allow a specific instance of a comparator object to be
    * used.
    */
-  nsTPriorityQueue(const Compare& aComp) : mCompare(aComp) {}
+  explicit nsTPriorityQueue(const Compare& aComp) : mCompare(aComp) {}
 
   /**
    * Copy constructor