diff --git a/browser/config/mozconfigs/macosx64/opt-static-analysis b/browser/config/mozconfigs/macosx64/opt-static-analysis
new file mode 100644
index 000000000000..90f9f9269c18
--- /dev/null
+++ b/browser/config/mozconfigs/macosx64/opt-static-analysis
@@ -0,0 +1,19 @@
+MOZ_AUTOMATION_BUILD_SYMBOLS=0
+MOZ_AUTOMATION_PACKAGE_TESTS=0
+MOZ_AUTOMATION_L10N_CHECK=0
+
+. $topsrcdir/build/macosx/mozconfig.common
+
+ac_add_options --disable-debug
+ac_add_options --enable-optimize
+ac_add_options --enable-dmd
+
+# Treat warnings as errors (modulo ALLOW_COMPILER_WARNINGS).
+ac_add_options --enable-warnings-as-errors
+
+ac_add_options --enable-clang-plugin
+
+. "$topsrcdir/build/macosx/mozconfig.rust"
+. "$topsrcdir/build/mozconfig.common.override"
+. "$topsrcdir/build/mozconfig.cache"
+
diff --git a/browser/config/tooltool-manifests/linux32/clang.manifest b/browser/config/tooltool-manifests/linux32/clang.manifest
index 227459a06646..05278d7586a1 100644
--- a/browser/config/tooltool-manifests/linux32/clang.manifest
+++ b/browser/config/tooltool-manifests/linux32/clang.manifest
@@ -6,7 +6,7 @@
 "size": 93197192,
 "digest": "6ebd8994ac76cf6694c3d9054104219836f47578223c799cb9ba9669cfdee00112e9de56aea9d1e6d9d50ee94a201970555de19794b5fbb7546f58fdf8e59a99",
 "algorithm": "sha512", 
-"filename": "clang.tar.bz2",
+"filename": "clang.tar.xz",
 "unpack": true,
 }
 ]
diff --git a/browser/config/tooltool-manifests/macosx64/clang.manifest b/browser/config/tooltool-manifests/macosx64/clang.manifest
index 81a6ae165dc3..d572cf39c2f4 100644
--- a/browser/config/tooltool-manifests/macosx64/clang.manifest
+++ b/browser/config/tooltool-manifests/macosx64/clang.manifest
@@ -6,7 +6,7 @@
 "size": 97314461,
 "digest": "9a74670fa917f760a4767923485d5166bbd258a8023c8aeb899b8c4d22f2847be76508ac5f26d7d2193318a2bb368a71bc62888d1bfe9d81eb45329a60451aa4",
 "algorithm": "sha512",
-"filename": "clang.tar.xz",
+"filename": "clang.tar.bz2",
 "unpack": true
 },
 {
diff --git a/build/annotationProcessors/CodeGenerator.java b/build/annotationProcessors/CodeGenerator.java
index 0bba34e3af0a..b36d1602eb71 100644
--- a/build/annotationProcessors/CodeGenerator.java
+++ b/build/annotationProcessors/CodeGenerator.java
@@ -66,15 +66,37 @@ public class CodeGenerator {
         return (includeScope ? clsName + "::" : "") + uniqueName + "_t";
     }
 
+    /**
+     * Return the C++ type name for this class or any class within the chain
+     * of declaring classes, if the target class matches the given type.
+     *
+     * Return null if the given type does not match any class searched.
+     */
+    private String getMatchingClassType(final Class<?> type) {
+        Class<?> cls = this.cls;
+        String clsName = this.clsName;
+
+        while (cls != null) {
+            if (type == cls) {
+                return clsName;
+            }
+            cls = cls.getDeclaringClass();
+            clsName = clsName.substring(0, Math.max(0, clsName.lastIndexOf("::")));
+        }
+        return null;
+    }
+
     private String getNativeParameterType(Class<?> type, AnnotationInfo info) {
-        if (type == cls) {
+        final String clsName = getMatchingClassType(type);
+        if (clsName != null) {
             return Utils.getUnqualifiedName(clsName) + "::Param";
         }
         return Utils.getNativeParameterType(type, info);
     }
 
     private String getNativeReturnType(Class<?> type, AnnotationInfo info) {
-        if (type == cls) {
+        final String clsName = getMatchingClassType(type);
+        if (clsName != null) {
             return Utils.getUnqualifiedName(clsName) + "::LocalRef";
         }
         return Utils.getNativeReturnType(type, info);
@@ -370,6 +392,7 @@ public class CodeGenerator {
         if (isStatic && isFinal && (type.isPrimitive() || type == String.class)) {
             Object val = null;
             try {
+                field.setAccessible(true);
                 val = field.get(null);
             } catch (final IllegalAccessException e) {
             }
diff --git a/build/unix/build-clang/build-clang.py b/build/unix/build-clang/build-clang.py
index 973ea6f5dfe0..f418d752b3e0 100755
--- a/build/unix/build-clang/build-clang.py
+++ b/build/unix/build-clang/build-clang.py
@@ -64,7 +64,7 @@ def updated_env(env):
 def build_tar_package(tar, name, base, directory):
     name = os.path.realpath(name)
     run_in(base, [tar,
-                  "-c -%s -f" % "J" if ".xz" in name else "j",
+                  "-c -%s -f" % ("J" if ".xz" in name else "j"),
                   name, directory])
 
 
diff --git a/devtools/client/styleinspector/test/browser_ruleview_authored.js b/devtools/client/styleinspector/test/browser_ruleview_authored.js
index 67c02e4a671b..973625278101 100644
--- a/devtools/client/styleinspector/test/browser_ruleview_authored.js
+++ b/devtools/client/styleinspector/test/browser_ruleview_authored.js
@@ -55,16 +55,17 @@ function* basicTest() {
 }
 
 function* overrideTest() {
-  let gradientText = "(45deg, rgba(255,255,255,0.2) 25%, transparent 25%, transparent 50%, rgba(255,255,255,0.2) 50%, rgba(255,255,255,0.2) 75%, transparent 75%, transparent);";
+  let gradientText1 = "(orange, blue);";
+  let gradientText2 = "(pink, teal);";
 
   let view =
       yield createTestContent("#testid {" +
-                              "  background-image: -moz-linear-gradient" +
-                              gradientText +
-                              "  background-image: -webkit-linear-gradient" +
-                              gradientText +
                               "  background-image: linear-gradient" +
-                              gradientText +
+                              gradientText1 +
+                              "  background-image: -ms-linear-gradient" +
+                              gradientText2 +
+                              "  background-image: linear-gradient" +
+                              gradientText2 +
                               "} ");
 
   let elementStyle = view._elementStyle;
diff --git a/dom/apps/Webapps.jsm b/dom/apps/Webapps.jsm
index 2415dd221e97..dc5a219fa404 100644
--- a/dom/apps/Webapps.jsm
+++ b/dom/apps/Webapps.jsm
@@ -4106,11 +4106,6 @@ this.DOMApplicationRegistry = {
   },
 
   doUninstall: Task.async(function*(aData, aMm) {
-    // The yields here could get stuck forever, so we only hold
-    // a weak reference to the message manager while yielding, to avoid
-    // leaking the whole page associationed with the message manager.
-    aMm = Cu.getWeakReference(aMm);
-
     let response = "Webapps:Uninstall:Return:OK";
 
     try {
@@ -4140,9 +4135,7 @@ this.DOMApplicationRegistry = {
       response = "Webapps:Uninstall:Return:KO";
     }
 
-    if ((aMm = aMm.get())) {
-      aMm.sendAsyncMessage(response, this.formatMessage(aData));
-    }
+    aMm.sendAsyncMessage(response, this.formatMessage(aData));
   }),
 
   uninstall: function(aManifestURL) {
diff --git a/dom/base/EventSource.cpp b/dom/base/EventSource.cpp
index ac35e0d9eb7f..9327cc67e45f 100644
--- a/dom/base/EventSource.cpp
+++ b/dom/base/EventSource.cpp
@@ -114,9 +114,7 @@ NS_IMPL_CYCLE_COLLECTION_TRACE_END
 NS_IMPL_CYCLE_COLLECTION_TRAVERSE_BEGIN_INHERITED(EventSource,
                                                   DOMEventTargetHelper)
   NS_IMPL_CYCLE_COLLECTION_TRAVERSE(mSrc)
-  NS_IMPL_CYCLE_COLLECTION_TRAVERSE(mNotificationCallbacks)
   NS_IMPL_CYCLE_COLLECTION_TRAVERSE(mLoadGroup)
-  NS_IMPL_CYCLE_COLLECTION_TRAVERSE(mChannelEventSink)
   NS_IMPL_CYCLE_COLLECTION_TRAVERSE(mHttpChannel)
   NS_IMPL_CYCLE_COLLECTION_TRAVERSE(mTimer)
   NS_IMPL_CYCLE_COLLECTION_TRAVERSE(mUnicodeDecoder)
@@ -490,48 +488,6 @@ EventSource::OnStopRequest(nsIRequest *aRequest,
   return NS_OK;
 }
 
-/**
- * Simple helper class that just forwards the redirect callback back
- * to the EventSource.
- */
-class AsyncVerifyRedirectCallbackFwr final : public nsIAsyncVerifyRedirectCallback
-{
-public:
-  explicit AsyncVerifyRedirectCallbackFwr(EventSource* aEventsource)
-    : mEventSource(aEventsource)
-  {
-  }
-
-  NS_DECL_CYCLE_COLLECTING_ISUPPORTS
-  NS_DECL_CYCLE_COLLECTION_CLASS(AsyncVerifyRedirectCallbackFwr)
-
-  // nsIAsyncVerifyRedirectCallback implementation
-  NS_IMETHOD OnRedirectVerifyCallback(nsresult aResult) override
-  {
-    nsresult rv = mEventSource->OnRedirectVerifyCallback(aResult);
-    if (NS_FAILED(rv)) {
-      mEventSource->mErrorLoadOnRedirect = true;
-      mEventSource->DispatchFailConnection();
-    }
-
-    return NS_OK;
-  }
-
-private:
-  ~AsyncVerifyRedirectCallbackFwr() {}
-  nsRefPtr<EventSource> mEventSource;
-};
-
-NS_IMPL_CYCLE_COLLECTION(AsyncVerifyRedirectCallbackFwr, mEventSource)
-
-NS_INTERFACE_MAP_BEGIN_CYCLE_COLLECTION(AsyncVerifyRedirectCallbackFwr)
-  NS_INTERFACE_MAP_ENTRY(nsISupports)
-  NS_INTERFACE_MAP_ENTRY(nsIAsyncVerifyRedirectCallback)
-NS_INTERFACE_MAP_END
-
-NS_IMPL_CYCLE_COLLECTING_ADDREF(AsyncVerifyRedirectCallbackFwr)
-NS_IMPL_CYCLE_COLLECTING_RELEASE(AsyncVerifyRedirectCallbackFwr)
-
 //-----------------------------------------------------------------------------
 // EventSource::nsIChannelEventSink
 //-----------------------------------------------------------------------------
@@ -564,56 +520,20 @@ EventSource::AsyncOnChannelRedirect(nsIChannel *aOldChannel,
      return NS_ERROR_DOM_SECURITY_ERR;
   }
 
-  // Prepare to receive callback
-  mRedirectFlags = aFlags;
-  mRedirectCallback = aCallback;
-  mNewRedirectChannel = aNewChannel;
-
-  if (mChannelEventSink) {
-    nsRefPtr<AsyncVerifyRedirectCallbackFwr> fwd =
-      new AsyncVerifyRedirectCallbackFwr(this);
-
-    rv = mChannelEventSink->AsyncOnChannelRedirect(aOldChannel,
-                                                   aNewChannel,
-                                                   aFlags, fwd);
-    if (NS_FAILED(rv)) {
-      mRedirectCallback = nullptr;
-      mNewRedirectChannel = nullptr;
-      mErrorLoadOnRedirect = true;
-      DispatchFailConnection();
-    }
-    return rv;
-  }
-  OnRedirectVerifyCallback(NS_OK);
-  return NS_OK;
-}
-
-nsresult
-EventSource::OnRedirectVerifyCallback(nsresult aResult)
-{
-  MOZ_ASSERT(mRedirectCallback, "mRedirectCallback not set in callback");
-  MOZ_ASSERT(mNewRedirectChannel,
-             "mNewRedirectChannel not set in callback");
-
-  NS_ENSURE_SUCCESS(aResult, aResult);
-
   // update our channel
 
-  mHttpChannel = do_QueryInterface(mNewRedirectChannel);
+  mHttpChannel = do_QueryInterface(aNewChannel);
   NS_ENSURE_STATE(mHttpChannel);
 
-  nsresult rv = SetupHttpChannel();
+  rv = SetupHttpChannel();
   NS_ENSURE_SUCCESS(rv, rv);
 
-  if ((mRedirectFlags & nsIChannelEventSink::REDIRECT_PERMANENT) != 0) {
+  if ((aFlags & nsIChannelEventSink::REDIRECT_PERMANENT) != 0) {
     rv = NS_GetFinalChannelURI(mHttpChannel, getter_AddRefs(mSrc));
     NS_ENSURE_SUCCESS(rv, rv);
   }
 
-  mNewRedirectChannel = nullptr;
-
-  mRedirectCallback->OnRedirectVerifyCallback(aResult);
-  mRedirectCallback = nullptr;
+  aCallback->OnRedirectVerifyCallback(NS_OK);
 
   return NS_OK;
 }
@@ -626,27 +546,12 @@ NS_IMETHODIMP
 EventSource::GetInterface(const nsIID & aIID,
                           void **aResult)
 {
-  // Make sure to return ourselves for the channel event sink interface,
-  // no matter what.  We can forward these to mNotificationCallbacks
-  // if it wants to get notifications for them.  But we
-  // need to see these notifications for proper functioning.
   if (aIID.Equals(NS_GET_IID(nsIChannelEventSink))) {
-    mChannelEventSink = do_GetInterface(mNotificationCallbacks);
     *aResult = static_cast<nsIChannelEventSink*>(this);
     NS_ADDREF_THIS();
     return NS_OK;
   }
 
-  // Now give mNotificationCallbacks (if non-null) a chance to return the
-  // desired interface.
-  if (mNotificationCallbacks) {
-    nsresult rv = mNotificationCallbacks->GetInterface(aIID, aResult);
-    if (NS_SUCCEEDED(rv)) {
-      NS_ASSERTION(*aResult, "Lying nsIInterfaceRequestor implementation!");
-      return rv;
-    }
-  }
-
   if (aIID.Equals(NS_GET_IID(nsIAuthPrompt)) ||
       aIID.Equals(NS_GET_IID(nsIAuthPrompt2))) {
     nsresult rv = CheckInnerWindowCorrectness();
@@ -807,12 +712,14 @@ EventSource::InitChannelAndRequestEventSource()
   rv = SetupHttpChannel();
   NS_ENSURE_SUCCESS(rv, rv);
 
-  nsCOMPtr<nsIInterfaceRequestor> notificationCallbacks;
-  mHttpChannel->GetNotificationCallbacks(getter_AddRefs(notificationCallbacks));
-  if (notificationCallbacks != this) {
-    mNotificationCallbacks = notificationCallbacks;
-    mHttpChannel->SetNotificationCallbacks(this);
+#ifdef DEBUG
+  {
+    nsCOMPtr<nsIInterfaceRequestor> notificationCallbacks;
+    mHttpChannel->GetNotificationCallbacks(getter_AddRefs(notificationCallbacks));
+    MOZ_ASSERT(!notificationCallbacks);
   }
+#endif
+  mHttpChannel->SetNotificationCallbacks(this);
 
   // Start reading from the channel
   rv = mHttpChannel->AsyncOpen2(this);
@@ -878,11 +785,7 @@ EventSource::ResetConnection()
   mLastConvertionResult = NS_OK;
 
   mHttpChannel = nullptr;
-  mNotificationCallbacks = nullptr;
-  mChannelEventSink = nullptr;
   mStatus = PARSE_STATE_OFF;
-  mRedirectCallback = nullptr;
-  mNewRedirectChannel = nullptr;
 
   mReadyState = CONNECTING;
 
diff --git a/dom/base/EventSource.h b/dom/base/EventSource.h
index 995ed47e1ea1..ea1fe10aa8da 100644
--- a/dom/base/EventSource.h
+++ b/dom/base/EventSource.h
@@ -34,7 +34,6 @@ class ErrorResult;
 
 namespace dom {
 
-class AsyncVerifyRedirectCallbackFwr;
 struct EventSourceInit;
 
 class EventSource final : public DOMEventTargetHelper
@@ -44,8 +43,6 @@ class EventSource final : public DOMEventTargetHelper
                         , public nsIInterfaceRequestor
                         , public nsSupportsWeakReference
 {
-friend class AsyncVerifyRedirectCallbackFwr;
-
 public:
   explicit EventSource(nsPIDOMWindow* aOwnerWindow);
   NS_DECL_ISUPPORTS_INHERITED
@@ -232,13 +229,6 @@ protected:
 
   nsCOMPtr<nsILoadGroup> mLoadGroup;
 
-  /**
-   * The notification callbacks the channel had initially.
-   * We want to forward things here as needed.
-   */
-  nsCOMPtr<nsIInterfaceRequestor> mNotificationCallbacks;
-  nsCOMPtr<nsIChannelEventSink>   mChannelEventSink;
-
   nsCOMPtr<nsIHttpChannel> mHttpChannel;
 
   nsCOMPtr<nsITimer> mTimer;
@@ -249,10 +239,6 @@ protected:
   nsCOMPtr<nsIPrincipal> mPrincipal;
   nsString mOrigin;
 
-  uint32_t mRedirectFlags;
-  nsCOMPtr<nsIAsyncVerifyRedirectCallback> mRedirectCallback;
-  nsCOMPtr<nsIChannel> mNewRedirectChannel;
-
   // Event Source owner information:
   // - the script file name
   // - source code line number and column number where the Event Source object
diff --git a/dom/base/WindowNamedPropertiesHandler.cpp b/dom/base/WindowNamedPropertiesHandler.cpp
index ca0e4924b69a..ab6ac33716e6 100644
--- a/dom/base/WindowNamedPropertiesHandler.cpp
+++ b/dom/base/WindowNamedPropertiesHandler.cpp
@@ -274,13 +274,27 @@ WindowNamedPropertiesHandler::Create(JSContext* aCx,
   // Note: since the scope polluter proxy lives on the window's prototype
   // chain, it needs a singleton type to avoid polluting type information
   // for properties on the window.
-  JS::Rooted<JSObject*> gsp(aCx);
   js::ProxyOptions options;
   options.setSingleton(true);
   options.setClass(&WindowNamedPropertiesClass.mBase);
-  return js::NewProxyObject(aCx, WindowNamedPropertiesHandler::getInstance(),
-                            JS::NullHandleValue, aProto,
-                            options);
+
+  JS::Rooted<JSObject*> gsp(aCx);
+  gsp = js::NewProxyObject(aCx, WindowNamedPropertiesHandler::getInstance(),
+                           JS::NullHandleValue, aProto,
+                           options);
+  if (!gsp) {
+    return nullptr;
+  }
+
+  bool succeeded;
+  if (!JS_SetImmutablePrototype(aCx, gsp, &succeeded)) {
+    return nullptr;
+  }
+  MOZ_ASSERT(succeeded,
+             "errors making the [[Prototype]] of the named properties object "
+             "immutable should have been JSAPI failures, not !succeeded");
+
+  return gsp;
 }
 
 } // namespace dom
diff --git a/dom/events/MessageEvent.cpp b/dom/events/MessageEvent.cpp
index 29cb907678d9..08fe8b54c0d4 100644
--- a/dom/events/MessageEvent.cpp
+++ b/dom/events/MessageEvent.cpp
@@ -199,6 +199,49 @@ MessageEvent::InitMessageEvent(const nsAString& aType,
   return NS_OK;
 }
 
+void
+MessageEvent::InitMessageEvent(JSContext* aCx, const nsAString& aType,
+                               bool aCanBubble, bool aCancelable,
+                               JS::Handle<JS::Value> aData,
+                               const nsAString& aOrigin,
+                               const nsAString& aLastEventId,
+                               const Nullable<WindowProxyOrMessagePort>& aSource,
+                               const Nullable<Sequence<OwningNonNull<MessagePort>>>& aPorts,
+                               ErrorResult& aRv)
+{
+  aRv = Event::InitEvent(aType, aCanBubble, aCancelable);
+  if (NS_WARN_IF(aRv.Failed())) {
+    return;
+  }
+
+  mData = aData;
+  mozilla::HoldJSObjects(this);
+  mOrigin = aOrigin;
+  mLastEventId = aLastEventId;
+
+  mWindowSource = nullptr;
+  mPortSource = nullptr;
+
+  if (!aSource.IsNull()) {
+    if (aSource.Value().IsWindowProxy()) {
+      mWindowSource = aSource.Value().GetAsWindowProxy();
+    } else {
+      mPortSource = &aSource.Value().GetAsMessagePort();
+    }
+  }
+
+  mPorts = nullptr;
+
+  if (!aPorts.IsNull()) {
+    nsTArray<nsRefPtr<MessagePort>> ports;
+    for (uint32_t i = 0, len = aPorts.Value().Length(); i < len; ++i) {
+      ports.AppendElement(aPorts.Value()[i]);
+    }
+
+    mPorts = new MessagePortList(static_cast<Event*>(this), ports);
+  }
+}
+
 void
 MessageEvent::SetPorts(MessagePortList* aPorts)
 {
@@ -227,7 +270,7 @@ using namespace mozilla::dom;
 already_AddRefed<MessageEvent>
 NS_NewDOMMessageEvent(EventTarget* aOwner,
                       nsPresContext* aPresContext,
-                      WidgetEvent* aEvent) 
+                      WidgetEvent* aEvent)
 {
   nsRefPtr<MessageEvent> it = new MessageEvent(aOwner, aPresContext, aEvent);
   return it.forget();
diff --git a/dom/events/MessageEvent.h b/dom/events/MessageEvent.h
index e2b4e1afcaa0..a435f1ae798a 100644
--- a/dom/events/MessageEvent.h
+++ b/dom/events/MessageEvent.h
@@ -8,9 +8,10 @@
 #define mozilla_dom_MessageEvent_h_
 
 #include "mozilla/dom/Event.h"
+#include "mozilla/dom/BindingUtils.h"
+#include "mozilla/dom/MessagePortList.h"
 #include "nsCycleCollectionParticipant.h"
 #include "nsIDOMMessageEvent.h"
-#include "mozilla/dom/MessagePortList.h"
 
 namespace mozilla {
 namespace dom {
@@ -19,6 +20,7 @@ struct MessageEventInit;
 class MessagePort;
 class MessagePortList;
 class OwningWindowProxyOrMessagePortOrClient;
+class WindowProxyOrMessagePort;
 
 namespace workers {
 
@@ -85,6 +87,13 @@ public:
               const MessageEventInit& aEventInit,
               ErrorResult& aRv);
 
+  void InitMessageEvent(JSContext* aCx, const nsAString& aType, bool aCanBubble,
+                        bool aCancelable, JS::Handle<JS::Value> aData,
+                        const nsAString& aOrigin, const nsAString& aLastEventId,
+                        const Nullable<WindowProxyOrMessagePort>& aSource,
+                        const Nullable<Sequence<OwningNonNull<MessagePort>>>& aPorts,
+                        ErrorResult& aRv);
+
 protected:
   ~MessageEvent();
 
diff --git a/dom/events/test/test_messageEvent.html b/dom/events/test/test_messageEvent.html
index b8dc91f86645..249aa9e8c158 100644
--- a/dom/events/test/test_messageEvent.html
+++ b/dom/events/test/test_messageEvent.html
@@ -13,6 +13,23 @@ https://bugzilla.mozilla.org/show_bug.cgi?id=848294
 </head>
 <body>
   <script type="application/javascript">
+  function testMessageEvent(e, test) {
+    ok(e, "MessageEvent created");
+    is(e.type, 'message', 'MessageEvent.type is right');
+
+    is(e.data, 'data' in test ? test.data : undefined, 'MessageEvent.data is ok');
+    is(e.origin, 'origin' in test ? test.origin : '', 'MessageEvent.origin is ok');
+    is(e.lastEventId, 'lastEventId' in test ? test.lastEventId : '', 'MessageEvent.lastEventId is ok');
+    is(e.source, 'source' in test ? test.source : null, 'MessageEvent.source is ok');
+
+    if (test.ports != undefined) {
+      is(e.ports.length, test.ports.length, 'MessageEvent.ports is ok');
+      is(e.ports, e.ports, 'MessageEvent.ports is ok');
+    } else {
+      ok(!('ports' in test) || test.ports == null, 'MessageEvent.ports is ok');
+    }
+  }
+
   function runTest() {
     var channel = new MessageChannel();
 
@@ -33,20 +50,16 @@ https://bugzilla.mozilla.org/show_bug.cgi?id=848294
       var test = tests.shift();
 
       var e = new MessageEvent('message', test);
-      ok(e, "MessageEvent created");
-      is(e.type, 'message', 'MessageEvent.type is right');
+      testMessageEvent(e, test);
 
-      is(e.data, 'data' in test ? test.data : undefined, 'MessageEvent.data is ok');
-      is(e.origin, 'origin' in test ? test.origin : '', 'MessageEvent.origin is ok');
-      is(e.lastEventId, 'lastEventId' in test ? test.lastEventId : '', 'MessageEvent.lastEventId is ok');
-      is(e.source, 'source' in test ? test.source : null, 'MessageEvent.source is ok');
-
-      if (test.ports != undefined) {
-        is(e.ports.length, test.ports.length, 'MessageEvent.ports is ok');
-        is(e.ports, e.ports, 'MessageEvent.ports is ok');
-      } else {
-        ok(!('ports' in test) || test.ports == null, 'MessageEvent.ports is ok');
-      }
+      e = new MessageEvent('message');
+      e.initMessageEvent('message', true, true,
+                         'data' in test ? test.data : undefined,
+                         'origin' in test ? test.origin : '',
+                         'lastEventId' in test ? test.lastEventId : '',
+                         'source' in test ? test.source : null,
+                         'ports' in test ? test.ports : null);
+      testMessageEvent(e, test);
     }
 
     try {
diff --git a/dom/fetch/FetchDriver.cpp b/dom/fetch/FetchDriver.cpp
index d6863cc2738c..c1827604d5b4 100644
--- a/dom/fetch/FetchDriver.cpp
+++ b/dom/fetch/FetchDriver.cpp
@@ -7,6 +7,7 @@
 #include "mozilla/DebugOnly.h"
 #include "mozilla/dom/FetchDriver.h"
 
+#include "nsIAsyncVerifyRedirectCallback.h"
 #include "nsIDocument.h"
 #include "nsIInputStream.h"
 #include "nsIOutputStream.h"
@@ -42,7 +43,7 @@ namespace dom {
 
 NS_IMPL_ISUPPORTS(FetchDriver,
                   nsIStreamListener, nsIChannelEventSink, nsIInterfaceRequestor,
-                  nsIAsyncVerifyRedirectCallback, nsIThreadRetargetableStreamListener)
+                  nsIThreadRetargetableStreamListener)
 
 FetchDriver::FetchDriver(InternalRequest* aRequest, nsIPrincipal* aPrincipal,
                          nsILoadGroup* aLoadGroup)
@@ -459,7 +460,13 @@ FetchDriver::HttpFetch(bool aCORSFlag, bool aCORSPreflightFlag, bool aAuthentica
 
   // Insert ourselves into the notification callbacks chain so we can handle
   // cross-origin redirects.
-  chan->GetNotificationCallbacks(getter_AddRefs(mNotificationCallbacks));
+#ifdef DEBUG
+  {
+    nsCOMPtr<nsIInterfaceRequestor> notificationCallbacks;
+    chan->GetNotificationCallbacks(getter_AddRefs(notificationCallbacks));
+    MOZ_ASSERT(!notificationCallbacks);
+  }
+#endif
   chan->SetNotificationCallbacks(this);
 
   // FIXME(nsm): Bug 1120715.
@@ -915,8 +922,6 @@ FetchDriver::AsyncOnChannelRedirect(nsIChannel* aOldChannel,
 {
   NS_PRECONDITION(aNewChannel, "Redirect without a channel?");
 
-  nsresult rv;
-
   // HTTP Fetch step 5, "redirect status", step 1
   if (NS_WARN_IF(mRequest->GetRedirectMode() == RequestRedirect::Error)) {
     aOldChannel->Cancel(NS_BINDING_FAILED);
@@ -970,27 +975,85 @@ FetchDriver::AsyncOnChannelRedirect(nsIChannel* aOldChannel,
   // to a URL with credentials in CORS mode.  This is implemented in
   // nsCORSListenerProxy.
 
-  mRedirectCallback = aCallback;
-  mOldRedirectChannel = aOldChannel;
-  mNewRedirectChannel = aNewChannel;
+  // On a successful redirect we perform the following substeps of HTTP Fetch,
+  // step 5, "redirect status", step 11.
 
-  nsCOMPtr<nsIChannelEventSink> outer =
-    do_GetInterface(mNotificationCallbacks);
-  if (outer) {
-    // The callee is supposed to call OnRedirectVerifyCallback() on success,
-    // and nobody has to call it on failure, so we can just return after this
-    // block.
-    rv = outer->AsyncOnChannelRedirect(aOldChannel, aNewChannel, aFlags, this);
-    if (NS_FAILED(rv)) {
-      aOldChannel->Cancel(rv);
-      mRedirectCallback = nullptr;
-      mOldRedirectChannel = nullptr;
-      mNewRedirectChannel = nullptr;
-    }
+  // Step 11.5 "Append locationURL to request's url list." so that when we set the
+  // Response's URL from the Request's URL in Main Fetch, step 15, we get the
+  // final value. Note, we still use a single URL value instead of a list.
+  nsCOMPtr<nsIURI> newURI;
+  nsresult rv = NS_GetFinalChannelURI(aNewChannel, getter_AddRefs(newURI));
+  if (NS_FAILED(rv)) {
+    aOldChannel->Cancel(rv);
     return rv;
   }
 
-  (void) OnRedirectVerifyCallback(NS_OK);
+  // We need to update our request's URL.
+  nsAutoCString newUrl;
+  newURI->GetSpec(newUrl);
+  mRequest->SetURL(newUrl);
+
+  // Implement Main Fetch step 8 again on redirect.
+  MainFetchOp nextOp = SetTaintingAndGetNextOp(mCORSFlagEverSet);
+
+  if (nextOp.mType == NETWORK_ERROR) {
+    // Cancel the channel if Main Fetch blocks the redirect from continuing.
+    aOldChannel->Cancel(NS_ERROR_DOM_BAD_URI);
+    return NS_ERROR_DOM_BAD_URI;
+  }
+
+  // Otherwise, we rely on necko and the CORS proxy to do the right thing
+  // as the redirect is followed.  In general this means basic or http
+  // fetch.  If we've ever been CORS, we need to stay CORS.
+  MOZ_ASSERT(nextOp.mType == BASIC_FETCH || nextOp.mType == HTTP_FETCH);
+  MOZ_ASSERT_IF(mCORSFlagEverSet, nextOp.mType == HTTP_FETCH);
+  MOZ_ASSERT_IF(mCORSFlagEverSet, nextOp.mCORSFlag);
+
+  // Examine and possibly set the LOAD_ANONYMOUS flag on the channel.
+  nsLoadFlags flags;
+  rv = aNewChannel->GetLoadFlags(&flags);
+  if (NS_FAILED(rv)) {
+    aOldChannel->Cancel(rv);
+    return rv;
+  }
+
+  if (mRequest->GetCredentialsMode() == RequestCredentials::Same_origin &&
+      mRequest->GetResponseTainting() == InternalRequest::RESPONSETAINT_OPAQUE) {
+    // In the case of a "no-cors" mode request with "same-origin" credentials,
+    // we have to set LOAD_ANONYMOUS manually here in order to avoid sending
+    // credentials on a cross-origin redirect.
+    flags |= nsIRequest::LOAD_ANONYMOUS;
+    rv = aNewChannel->SetLoadFlags(flags);
+    if (NS_FAILED(rv)) {
+      aOldChannel->Cancel(rv);
+      return rv;
+    }
+
+  } else if (mRequest->GetCredentialsMode() == RequestCredentials::Omit) {
+    // Make sure nothing in the redirect chain screws up our credentials
+    // settings.  LOAD_ANONYMOUS must be set if we RequestCredentials is "omit".
+    MOZ_ASSERT(flags & nsIRequest::LOAD_ANONYMOUS);
+
+  } else if (mRequest->GetCredentialsMode() == RequestCredentials::Same_origin &&
+             nextOp.mCORSFlag) {
+    // We also want to verify the LOAD_ANONYMOUS flag is set when we are in
+    // "same-origin" credentials mode and the CORS flag is set.  We can't
+    // unconditionally assert here, however, because the nsCORSListenerProxy
+    // will set the flag later in the redirect callback chain.  Instead,
+    // perform a weaker assertion here by checking if CORS flag was set
+    // before this redirect.  In that case LOAD_ANONYMOUS must still be set.
+    MOZ_ASSERT_IF(mCORSFlagEverSet, flags & nsIRequest::LOAD_ANONYMOUS);
+
+  } else {
+    // Otherwise, we should be sending credentials
+    MOZ_ASSERT(!(flags & nsIRequest::LOAD_ANONYMOUS));
+  }
+
+  // Track the CORSFlag through redirects.
+  mCORSFlagEverSet = mCORSFlagEverSet || nextOp.mCORSFlag;
+
+  aCallback->OnRedirectVerifyCallback(NS_OK);
+
   return NS_OK;
 }
 
@@ -1036,21 +1099,12 @@ FetchDriver::GetInterface(const nsIID& aIID, void **aResult)
     return NS_OK;
   }
 
-  nsresult rv;
-
-  if (mNotificationCallbacks) {
-    rv = mNotificationCallbacks->GetInterface(aIID, aResult);
-    if (NS_SUCCEEDED(rv)) {
-      NS_ASSERTION(*aResult, "Lying nsIInterfaceRequestor implementation!");
-      return rv;
-    }
-  }
-  else if (aIID.Equals(NS_GET_IID(nsIStreamListener))) {
+  if (aIID.Equals(NS_GET_IID(nsIStreamListener))) {
     *aResult = static_cast<nsIStreamListener*>(this);
     NS_ADDREF_THIS();
     return NS_OK;
   }
-  else if (aIID.Equals(NS_GET_IID(nsIRequestObserver))) {
+  if (aIID.Equals(NS_GET_IID(nsIRequestObserver))) {
     *aResult = static_cast<nsIRequestObserver*>(this);
     NS_ADDREF_THIS();
     return NS_OK;
@@ -1059,90 +1113,6 @@ FetchDriver::GetInterface(const nsIID& aIID, void **aResult)
   return QueryInterface(aIID, aResult);
 }
 
-NS_IMETHODIMP
-FetchDriver::OnRedirectVerifyCallback(nsresult aResult)
-{
-  // On a successful redirect we perform the following substeps of HTTP Fetch,
-  // step 5, "redirect status", step 11.
-  if (NS_SUCCEEDED(aResult)) {
-    // Step 11.5 "Append locationURL to request's url list." so that when we set the
-    // Response's URL from the Request's URL in Main Fetch, step 15, we get the
-    // final value. Note, we still use a single URL value instead of a list.
-    nsCOMPtr<nsIURI> newURI;
-    nsresult rv = NS_GetFinalChannelURI(mNewRedirectChannel, getter_AddRefs(newURI));
-    if (NS_WARN_IF(NS_FAILED(rv))) {
-      aResult = rv;
-    } else {
-      // We need to update our request's URL.
-      nsAutoCString newUrl;
-      newURI->GetSpec(newUrl);
-      mRequest->SetURL(newUrl);
-    }
-  }
-
-  if (NS_FAILED(aResult)) {
-    mOldRedirectChannel->Cancel(aResult);
-  }
-
-  // Implement Main Fetch step 8 again on redirect.
-  MainFetchOp nextOp = SetTaintingAndGetNextOp(mCORSFlagEverSet);
-
-  if (nextOp.mType == NETWORK_ERROR) {
-    // Cancel the channel if Main Fetch blocks the redirect from continuing.
-    aResult = NS_ERROR_DOM_BAD_URI;
-    mOldRedirectChannel->Cancel(aResult);
-  } else {
-    // Otherwise, we rely on necko and the CORS proxy to do the right thing
-    // as the redirect is followed.  In general this means basic or http
-    // fetch.  If we've ever been CORS, we need to stay CORS.
-    MOZ_ASSERT(nextOp.mType == BASIC_FETCH || nextOp.mType == HTTP_FETCH);
-    MOZ_ASSERT_IF(mCORSFlagEverSet, nextOp.mType == HTTP_FETCH);
-    MOZ_ASSERT_IF(mCORSFlagEverSet, nextOp.mCORSFlag);
-
-    // Examine and possibly set the LOAD_ANONYMOUS flag on the channel.
-    nsLoadFlags flags;
-    aResult = mNewRedirectChannel->GetLoadFlags(&flags);
-    if (NS_SUCCEEDED(aResult)) {
-      if (mRequest->GetCredentialsMode() == RequestCredentials::Same_origin &&
-          mRequest->GetResponseTainting() == InternalRequest::RESPONSETAINT_OPAQUE) {
-        // In the case of a "no-cors" mode request with "same-origin" credentials,
-        // we have to set LOAD_ANONYMOUS manually here in order to avoid sending
-        // credentials on a cross-origin redirect.
-        flags |= nsIRequest::LOAD_ANONYMOUS;
-        aResult = mNewRedirectChannel->SetLoadFlags(flags);
-
-      } else if (mRequest->GetCredentialsMode() == RequestCredentials::Omit) {
-        // Make sure nothing in the redirect chain screws up our credentials
-        // settings.  LOAD_ANONYMOUS must be set if we RequestCredentials is "omit".
-        MOZ_ASSERT(flags & nsIRequest::LOAD_ANONYMOUS);
-
-      } else if (mRequest->GetCredentialsMode() == RequestCredentials::Same_origin &&
-                 nextOp.mCORSFlag) {
-        // We also want to verify the LOAD_ANONYMOUS flag is set when we are in
-        // "same-origin" credentials mode and the CORS flag is set.  We can't
-        // unconditionally assert here, however, because the nsCORSListenerProxy
-        // will set the flag later in the redirect callback chain.  Instead,
-        // perform a weaker assertion here by checking if CORS flag was set
-        // before this redirect.  In that case LOAD_ANONYMOUS must still be set.
-        MOZ_ASSERT_IF(mCORSFlagEverSet, flags & nsIRequest::LOAD_ANONYMOUS);
-
-      } else {
-        // Otherwise, we should be sending credentials
-        MOZ_ASSERT(!(flags & nsIRequest::LOAD_ANONYMOUS));
-      }
-    }
-
-    // Track the CORSFlag through redirects.
-    mCORSFlagEverSet = mCORSFlagEverSet || nextOp.mCORSFlag;
-  }
-
-  mOldRedirectChannel = nullptr;
-  mNewRedirectChannel = nullptr;
-  mRedirectCallback->OnRedirectVerifyCallback(aResult);
-  mRedirectCallback = nullptr;
-  return NS_OK;
-}
-
 void
 FetchDriver::SetDocument(nsIDocument* aDocument)
 {
diff --git a/dom/fetch/FetchDriver.h b/dom/fetch/FetchDriver.h
index 9a5648579816..20eb6584e614 100644
--- a/dom/fetch/FetchDriver.h
+++ b/dom/fetch/FetchDriver.h
@@ -8,7 +8,6 @@
 #define mozilla_dom_FetchDriver_h
 
 #include "nsAutoPtr.h"
-#include "nsIAsyncVerifyRedirectCallback.h"
 #include "nsIChannelEventSink.h"
 #include "nsIInterfaceRequestor.h"
 #include "nsIStreamListener.h"
@@ -58,7 +57,6 @@ private:
 class FetchDriver final : public nsIStreamListener,
                           public nsIChannelEventSink,
                           public nsIInterfaceRequestor,
-                          public nsIAsyncVerifyRedirectCallback,
                           public nsIThreadRetargetableStreamListener
 {
 public:
@@ -67,7 +65,6 @@ public:
   NS_DECL_NSISTREAMLISTENER
   NS_DECL_NSICHANNELEVENTSINK
   NS_DECL_NSIINTERFACEREQUESTOR
-  NS_DECL_NSIASYNCVERIFYREDIRECTCALLBACK
   NS_DECL_NSITHREADRETARGETABLESTREAMLISTENER
 
   explicit FetchDriver(InternalRequest* aRequest, nsIPrincipal* aPrincipal,
@@ -84,10 +81,6 @@ private:
   nsRefPtr<InternalResponse> mResponse;
   nsCOMPtr<nsIOutputStream> mPipeOutputStream;
   nsRefPtr<FetchDriverObserver> mObserver;
-  nsCOMPtr<nsIInterfaceRequestor> mNotificationCallbacks;
-  nsCOMPtr<nsIAsyncVerifyRedirectCallback> mRedirectCallback;
-  nsCOMPtr<nsIChannel> mOldRedirectChannel;
-  nsCOMPtr<nsIChannel> mNewRedirectChannel;
   nsCOMPtr<nsIDocument> mDocument;
   uint32_t mFetchRecursionCount;
   bool mCORSFlagEverSet;
diff --git a/dom/ipc/TabParent.cpp b/dom/ipc/TabParent.cpp
index 5a2f489deccb..a767aa1ad245 100644
--- a/dom/ipc/TabParent.cpp
+++ b/dom/ipc/TabParent.cpp
@@ -1443,6 +1443,7 @@ TabParent::RecvPDocAccessibleConstructor(PDocAccessibleParent* aDoc,
 a11y::DocAccessibleParent*
 TabParent::GetTopLevelDocAccessible() const
 {
+#ifdef ACCESSIBILITY
   // XXX Consider managing non top level PDocAccessibles with their parent
   // document accessible.
   const nsTArray<PDocAccessibleParent*>& docs = ManagedPDocAccessibleParent();
@@ -1453,7 +1454,7 @@ TabParent::GetTopLevelDocAccessible() const
       return doc;
     }
   }
-
+#endif
   return nullptr;
 }
 
diff --git a/dom/ipc/TabParent.h b/dom/ipc/TabParent.h
index 5a598f5a229f..b7644ed6e858 100644
--- a/dom/ipc/TabParent.h
+++ b/dom/ipc/TabParent.h
@@ -39,9 +39,9 @@ class nsIDocShell;
 
 namespace mozilla {
 
-  namespace a11y {
+namespace a11y {
 class DocAccessibleParent;
-  }
+}
 
 namespace jsipc {
 class CpowHolder;
@@ -266,7 +266,7 @@ public:
     /**
      * Return the top level doc accessible parent for this tab.
      */
-     a11y::DocAccessibleParent* GetTopLevelDocAccessible() const;
+    a11y::DocAccessibleParent* GetTopLevelDocAccessible() const;
 
     void LoadURL(nsIURI* aURI);
     // XXX/cjones: it's not clear what we gain by hiding these
diff --git a/dom/media/MediaDecoderStateMachine.cpp b/dom/media/MediaDecoderStateMachine.cpp
index fb82ef418a81..5a09aa77710f 100644
--- a/dom/media/MediaDecoderStateMachine.cpp
+++ b/dom/media/MediaDecoderStateMachine.cpp
@@ -849,6 +849,10 @@ MediaDecoderStateMachine::OnVideoDecoded(MediaData* aVideoSample)
              (video ? video->GetEndTime() : -1),
              (video ? video->mDiscontinuity : 0));
 
+  // Check frame validity here for every decoded frame in order to have a
+  // better chance to make the decision of turning off HW acceleration.
+  CheckFrameValidity(aVideoSample->As<VideoData>());
+
   switch (mState) {
     case DECODER_STATE_BUFFERING: {
       // If we're buffering, this may be the sample we need to stop buffering.
@@ -2448,16 +2452,11 @@ MediaDecoderStateMachine::Reset()
   DecodeTaskQueue()->Dispatch(resetTask.forget());
 }
 
-bool MediaDecoderStateMachine::CheckFrameValidity(VideoData* aData)
+void
+MediaDecoderStateMachine::CheckFrameValidity(VideoData* aData)
 {
   MOZ_ASSERT(OnTaskQueue());
 
-  // If we've sent this frame before then only return the valid state,
-  // don't update the statistics.
-  if (aData->mSentToCompositor) {
-    return !aData->mImage || aData->mImage->IsValid();
-  }
-
   // Update corrupt-frames statistics
   if (aData->mImage && !aData->mImage->IsValid()) {
     FrameStatistics& frameStats = mDecoder->GetFrameStatistics();
@@ -2475,10 +2474,8 @@ bool MediaDecoderStateMachine::CheckFrameValidity(VideoData* aData)
         mCorruptFrames.clear();
       gfxCriticalNote << "Too many dropped/corrupted frames, disabling DXVA";
     }
-    return false;
   } else {
     mCorruptFrames.insert(0);
-    return true;
   }
 }
 
@@ -2500,7 +2497,7 @@ void MediaDecoderStateMachine::RenderVideoFrames(int32_t aMaxFrames,
   for (uint32_t i = 0; i < frames.Length(); ++i) {
     VideoData* frame = frames[i]->As<VideoData>();
 
-    bool valid = CheckFrameValidity(frame);
+    bool valid = !frame->mImage || frame->mImage->IsValid();
     frame->mSentToCompositor = true;
 
     if (!valid) {
diff --git a/dom/media/MediaDecoderStateMachine.h b/dom/media/MediaDecoderStateMachine.h
index 21ba666a38a0..ceb6d11fac6d 100644
--- a/dom/media/MediaDecoderStateMachine.h
+++ b/dom/media/MediaDecoderStateMachine.h
@@ -463,8 +463,9 @@ protected:
   // machine thread, caller must hold the decoder lock.
   void UpdatePlaybackPositionInternal(int64_t aTime);
 
-  // Decode monitor must be held.
-  bool CheckFrameValidity(VideoData* aData);
+  // Decode monitor must be held. To determine if MDSM needs to turn off HW
+  // acceleration.
+  void CheckFrameValidity(VideoData* aData);
 
   // Sets VideoQueue images into the VideoFrameContainer. Called on the shared
   // state machine thread. Decode monitor must be held. The first aMaxFrames
diff --git a/dom/media/mediasource/test/mochitest.ini b/dom/media/mediasource/test/mochitest.ini
index 2d990ce0b9b7..05753c89cc5f 100644
--- a/dom/media/mediasource/test/mochitest.ini
+++ b/dom/media/mediasource/test/mochitest.ini
@@ -1,5 +1,5 @@
 [DEFAULT]
-skip-if = e10s || buildapp == 'b2g' # b2g( ReferenceError: MediaSource is not defined)
+skip-if = buildapp == 'b2g' # b2g( ReferenceError: MediaSource is not defined)
 support-files =
   mediasource.js
   seek.webm seek.webm^headers^
diff --git a/dom/messagechannel/MessagePortList.h b/dom/messagechannel/MessagePortList.h
index 8ad339b9a63b..ecc741677615 100644
--- a/dom/messagechannel/MessagePortList.h
+++ b/dom/messagechannel/MessagePortList.h
@@ -66,7 +66,7 @@ public:
     return mPorts[aIndex];
   }
 
-public:
+private:
   nsCOMPtr<nsISupports> mOwner;
   nsTArray<nsRefPtr<MessagePort>> mPorts;
 };
diff --git a/dom/webidl/MessageEvent.webidl b/dom/webidl/MessageEvent.webidl
index 8693d310ddd5..fe85559f903f 100644
--- a/dom/webidl/MessageEvent.webidl
+++ b/dom/webidl/MessageEvent.webidl
@@ -44,6 +44,12 @@ interface MessageEvent : Event {
    * data, origin, source, and lastEventId attributes of this appropriately.
    */
   readonly attribute MessagePortList? ports;
+
+  [Throws]
+  void initMessageEvent(DOMString type, boolean bubbles, boolean cancelable,
+                        any data, DOMString origin, DOMString lastEventId,
+                        (WindowProxy or MessagePort)? source,
+                        sequence<MessagePort>? ports);
 };
 
 dictionary MessageEventInit : EventInit {
diff --git a/editor/libeditor/nsHTMLEditRules.cpp b/editor/libeditor/nsHTMLEditRules.cpp
index 61026a8a02a3..24ede7d7ebc2 100644
--- a/editor/libeditor/nsHTMLEditRules.cpp
+++ b/editor/libeditor/nsHTMLEditRules.cpp
@@ -6393,25 +6393,25 @@ nsHTMLEditRules::ReturnInHeader(Selection* aSelection,
                                 nsIDOMNode *aNode,
                                 int32_t aOffset)
 {
-  NS_ENSURE_TRUE(aSelection && aHeader && aNode, NS_ERROR_NULL_POINTER);
+  nsCOMPtr<Element> header = do_QueryInterface(aHeader);
+  nsCOMPtr<nsINode> node = do_QueryInterface(aNode);
+  NS_ENSURE_TRUE(aSelection && header && node, NS_ERROR_NULL_POINTER);
 
   // remeber where the header is
   int32_t offset;
   nsCOMPtr<nsIDOMNode> headerParent = nsEditor::GetNodeLocation(aHeader, &offset);
 
   // get ws code to adjust any ws
-  nsCOMPtr<nsINode> selNode(do_QueryInterface(aNode));
   NS_ENSURE_STATE(mHTMLEditor);
   nsresult res = nsWSRunObject::PrepareToSplitAcrossBlocks(mHTMLEditor,
-                                                           address_of(selNode),
+                                                           address_of(node),
                                                            &aOffset);
   NS_ENSURE_SUCCESS(res, res);
 
   // split the header
-  int32_t newOffset;
+  NS_ENSURE_STATE(node->IsContent());
   NS_ENSURE_STATE(mHTMLEditor);
-  res = mHTMLEditor->SplitNodeDeep(aHeader, GetAsDOMNode(selNode), aOffset, &newOffset);
-  NS_ENSURE_SUCCESS(res, res);
+  mHTMLEditor->SplitNodeDeep(*header, *node->AsContent(), aOffset);
 
   // if the leftand heading is empty, put a mozbr in it
   nsCOMPtr<nsIDOMNode> prevItem;
@@ -6598,13 +6598,14 @@ nsHTMLEditRules::SplitParagraph(nsIDOMNode *aPara,
                                 nsCOMPtr<nsIDOMNode> *aSelNode,
                                 int32_t *aOffset)
 {
-  NS_ENSURE_TRUE(aPara && aBRNode && aSelNode && *aSelNode && aOffset && aSelection, NS_ERROR_NULL_POINTER);
+  nsCOMPtr<Element> para = do_QueryInterface(aPara);
+  NS_ENSURE_TRUE(para && aBRNode && aSelNode && *aSelNode && aOffset &&
+                 aSelection, NS_ERROR_NULL_POINTER);
   nsresult res = NS_OK;
 
   // split para
-  int32_t newOffset;
   // get ws code to adjust any ws
-  nsCOMPtr<nsIDOMNode> leftPara, rightPara;
+  nsCOMPtr<nsIContent> leftPara, rightPara;
   NS_ENSURE_STATE(mHTMLEditor);
   nsCOMPtr<nsINode> selNode(do_QueryInterface(*aSelNode));
   res = nsWSRunObject::PrepareToSplitAcrossBlocks(mHTMLEditor, address_of(selNode), aOffset);
@@ -6612,9 +6613,11 @@ nsHTMLEditRules::SplitParagraph(nsIDOMNode *aPara,
   NS_ENSURE_SUCCESS(res, res);
   // split the paragraph
   NS_ENSURE_STATE(mHTMLEditor);
-  res = mHTMLEditor->SplitNodeDeep(aPara, *aSelNode, *aOffset, &newOffset, false,
-                                   address_of(leftPara), address_of(rightPara));
-  NS_ENSURE_SUCCESS(res, res);
+  NS_ENSURE_STATE(selNode->IsContent());
+  mHTMLEditor->SplitNodeDeep(*para, *selNode->AsContent(), *aOffset,
+                             nsHTMLEditor::EmptyContainers::yes,
+                             getter_AddRefs(leftPara),
+                             getter_AddRefs(rightPara));
   // get rid of the break, if it is visible (otherwise it may be needed to prevent an empty p)
   NS_ENSURE_STATE(mHTMLEditor);
   if (mHTMLEditor->IsVisBreak(aBRNode))
@@ -6631,9 +6634,9 @@ nsHTMLEditRules::SplitParagraph(nsIDOMNode *aPara,
   NS_ENSURE_SUCCESS(res, res);
 
   // check both halves of para to see if we need mozBR
-  res = InsertMozBRIfNeeded(leftPara);
+  res = InsertMozBRIfNeeded(GetAsDOMNode(leftPara));
   NS_ENSURE_SUCCESS(res, res);
-  res = InsertMozBRIfNeeded(rightPara);
+  res = InsertMozBRIfNeeded(GetAsDOMNode(rightPara));
   NS_ENSURE_SUCCESS(res, res);
 
   // selection to beginning of right hand para;
@@ -6751,10 +6754,9 @@ nsHTMLEditRules::ReturnInListItem(Selection* aSelection,
   res = nsWSRunObject::PrepareToSplitAcrossBlocks(mHTMLEditor, address_of(selNode), &aOffset);
   NS_ENSURE_SUCCESS(res, res);
   // now split list item
-  int32_t newOffset;
   NS_ENSURE_STATE(mHTMLEditor);
-  res = mHTMLEditor->SplitNodeDeep(aListItem, GetAsDOMNode(selNode), aOffset, &newOffset, false);
-  NS_ENSURE_SUCCESS(res, res);
+  NS_ENSURE_STATE(selNode->IsContent());
+  mHTMLEditor->SplitNodeDeep(*listItem, *selNode->AsContent(), aOffset);
   // hack: until I can change the damaged doc range code back to being
   // extra inclusive, I have to manually detect certain list items that
   // may be left empty.
@@ -7156,14 +7158,15 @@ nsHTMLEditRules::SplitAsNeeded(nsIAtom& aTag,
     // Could not find a place to build tag!
     return NS_ERROR_FAILURE;
   }
-  if (splitNode) {
+  if (splitNode && splitNode->IsContent() && inOutParent->IsContent()) {
     // We found a place for block, but above inOutParent. We need to split.
     NS_ENSURE_STATE(mHTMLEditor);
-    nsresult res = mHTMLEditor->SplitNodeDeep(splitNode->AsDOMNode(),
-                                              inOutParent->AsDOMNode(),
-                                              inOutOffset, &inOutOffset);
-    NS_ENSURE_SUCCESS(res, res);
+    int32_t offset = mHTMLEditor->SplitNodeDeep(*splitNode->AsContent(),
+                                                *inOutParent->AsContent(),
+                                                inOutOffset);
+    NS_ENSURE_STATE(offset != -1);
     inOutParent = tagParent;
+    inOutOffset = offset;
   }
   return NS_OK;
 }
diff --git a/editor/libeditor/nsHTMLEditor.cpp b/editor/libeditor/nsHTMLEditor.cpp
index b13314881489..31a399ebcad8 100644
--- a/editor/libeditor/nsHTMLEditor.cpp
+++ b/editor/libeditor/nsHTMLEditor.cpp
@@ -1583,10 +1583,10 @@ nsHTMLEditor::InsertNodeAtPoint(nsIDOMNode *aNode,
   NS_ENSURE_TRUE(ioOffset, NS_ERROR_NULL_POINTER);
 
   nsresult res = NS_OK;
-  nsCOMPtr<nsINode> parent = do_QueryInterface(*ioParent);
+  nsCOMPtr<nsIContent> parent = do_QueryInterface(*ioParent);
   NS_ENSURE_TRUE(parent, NS_ERROR_NULL_POINTER);
-  nsCOMPtr<nsINode> topChild = parent;
-  int32_t offsetOfInsert = *ioOffset;
+  nsCOMPtr<nsIContent> topChild = parent;
+  nsCOMPtr<nsIContent> origParent = parent;
 
   // Search up the parent chain to find a suitable container
   while (!CanContain(*parent, *node)) {
@@ -1602,24 +1602,24 @@ nsHTMLEditor::InsertNodeAtPoint(nsIDOMNode *aNode,
       // There's no suitable place to put the node in this editing host.  Maybe
       // someone is trying to put block content in a span.  So just put it
       // where we were originally asked.
-      parent = topChild = do_QueryInterface(*ioParent);
-      NS_ENSURE_STATE(parent);
+      parent = topChild = origParent;
       break;
     }
     topChild = parent;
-    parent = parent->GetParentNode();
+    parent = parent->GetParent();
   }
   if (parent != topChild)
   {
     // we need to split some levels above the original selection parent
-    res = SplitNodeDeep(GetAsDOMNode(topChild), *ioParent, *ioOffset,
-                        &offsetOfInsert, aNoEmptyNodes);
-    NS_ENSURE_SUCCESS(res, res);
+    int32_t offset = SplitNodeDeep(*topChild, *origParent, *ioOffset,
+                                   aNoEmptyNodes ? EmptyContainers::no
+                                                 : EmptyContainers::yes);
+    NS_ENSURE_STATE(offset != -1);
     *ioParent = GetAsDOMNode(parent);
-    *ioOffset = offsetOfInsert;
+    *ioOffset = offset;
   }
   // Now we can insert the new node
-  res = InsertNode(*node, *parent, offsetOfInsert);
+  res = InsertNode(*node, *parent, *ioOffset);
   return res;
 }
 
@@ -1927,30 +1927,31 @@ nsHTMLEditor::MakeOrChangeList(const nsAString& aListType, bool entireList, cons
     // Find out if the selection is collapsed:
     bool isCollapsed = selection->Collapsed();
 
-    nsCOMPtr<nsINode> node;
-    int32_t offset;
-    res = GetStartNodeAndOffset(selection, getter_AddRefs(node), &offset);
-    if (!node) res = NS_ERROR_FAILURE;
-    NS_ENSURE_SUCCESS(res, res);
+    NS_ENSURE_TRUE(selection->GetRangeAt(0) &&
+                   selection->GetRangeAt(0)->GetStartParent() &&
+                   selection->GetRangeAt(0)->GetStartParent()->IsContent(),
+                   NS_ERROR_FAILURE);
+    OwningNonNull<nsIContent> node =
+      *selection->GetRangeAt(0)->GetStartParent()->AsContent();
+    int32_t offset = selection->GetRangeAt(0)->StartOffset();
 
     if (isCollapsed)
     {
       // have to find a place to put the list
-      nsCOMPtr<nsINode> parent = node;
-      nsCOMPtr<nsINode> topChild = node;
+      nsCOMPtr<nsIContent> parent = node;
+      nsCOMPtr<nsIContent> topChild = node;
 
       nsCOMPtr<nsIAtom> listAtom = do_GetAtom(aListType);
       while (!CanContainTag(*parent, *listAtom)) {
         topChild = parent;
-        parent = parent->GetParentNode();
+        parent = parent->GetParent();
       }
 
       if (parent != node)
       {
         // we need to split up to the child of parent
-        res = SplitNodeDeep(GetAsDOMNode(topChild), GetAsDOMNode(node), offset,
-                            &offset);
-        NS_ENSURE_SUCCESS(res, res);
+        offset = SplitNodeDeep(*topChild, *node, offset);
+        NS_ENSURE_STATE(offset != -1);
       }
 
       // make a list
@@ -2058,31 +2059,32 @@ nsHTMLEditor::InsertBasicBlock(const nsAString& aBlockType)
     // Find out if the selection is collapsed:
     bool isCollapsed = selection->Collapsed();
 
-    nsCOMPtr<nsINode> node;
-    int32_t offset;
-    res = GetStartNodeAndOffset(selection, getter_AddRefs(node), &offset);
-    if (!node) res = NS_ERROR_FAILURE;
-    NS_ENSURE_SUCCESS(res, res);
+    NS_ENSURE_TRUE(selection->GetRangeAt(0) &&
+                   selection->GetRangeAt(0)->GetStartParent() &&
+                   selection->GetRangeAt(0)->GetStartParent()->IsContent(),
+                   NS_ERROR_FAILURE);
+    OwningNonNull<nsIContent> node =
+      *selection->GetRangeAt(0)->GetStartParent()->AsContent();
+    int32_t offset = selection->GetRangeAt(0)->StartOffset();
 
     if (isCollapsed)
     {
       // have to find a place to put the block
-      nsCOMPtr<nsINode> parent = node;
-      nsCOMPtr<nsINode> topChild = node;
+      nsCOMPtr<nsIContent> parent = node;
+      nsCOMPtr<nsIContent> topChild = node;
 
       nsCOMPtr<nsIAtom> blockAtom = do_GetAtom(aBlockType);
       while (!CanContainTag(*parent, *blockAtom)) {
-        NS_ENSURE_TRUE(parent->GetParentNode(), NS_ERROR_FAILURE);
+        NS_ENSURE_TRUE(parent->GetParent(), NS_ERROR_FAILURE);
         topChild = parent;
-        parent = parent->GetParentNode();
+        parent = parent->GetParent();
       }
 
       if (parent != node)
       {
         // we need to split up to the child of parent
-        res = SplitNodeDeep(GetAsDOMNode(topChild), GetAsDOMNode(node), offset,
-                            &offset);
-        NS_ENSURE_SUCCESS(res, res);
+        offset = SplitNodeDeep(*topChild, *node, offset);
+        NS_ENSURE_STATE(offset != -1);
       }
 
       // make a block
@@ -2128,33 +2130,34 @@ nsHTMLEditor::Indent(const nsAString& aIndent)
   if (!handled)
   {
     // Do default - insert a blockquote node if selection collapsed
-    nsCOMPtr<nsINode> node;
-    int32_t offset;
     bool isCollapsed = selection->Collapsed();
 
-    res = GetStartNodeAndOffset(selection, getter_AddRefs(node), &offset);
-    if (!node) res = NS_ERROR_FAILURE;
-    NS_ENSURE_SUCCESS(res, res);
+    NS_ENSURE_TRUE(selection->GetRangeAt(0) &&
+                   selection->GetRangeAt(0)->GetStartParent() &&
+                   selection->GetRangeAt(0)->GetStartParent()->IsContent(),
+                   NS_ERROR_FAILURE);
+    OwningNonNull<nsIContent> node =
+      *selection->GetRangeAt(0)->GetStartParent()->AsContent();
+    int32_t offset = selection->GetRangeAt(0)->StartOffset();
 
     if (aIndent.EqualsLiteral("indent"))
     {
       if (isCollapsed)
       {
         // have to find a place to put the blockquote
-        nsCOMPtr<nsINode> parent = node;
-        nsCOMPtr<nsINode> topChild = node;
+        nsCOMPtr<nsIContent> parent = node;
+        nsCOMPtr<nsIContent> topChild = node;
         while (!CanContainTag(*parent, *nsGkAtoms::blockquote)) {
-          NS_ENSURE_TRUE(parent->GetParentNode(), NS_ERROR_FAILURE);
+          NS_ENSURE_TRUE(parent->GetParent(), NS_ERROR_FAILURE);
           topChild = parent;
-          parent = parent->GetParentNode();
+          parent = parent->GetParent();
         }
 
         if (parent != node)
         {
           // we need to split up to the child of parent
-          res = SplitNodeDeep(GetAsDOMNode(topChild), GetAsDOMNode(node),
-                              offset, &offset);
-          NS_ENSURE_SUCCESS(res, res);
+          offset = SplitNodeDeep(*topChild, *node, offset);
+          NS_ENSURE_STATE(offset != -1);
         }
 
         // make a blockquote
@@ -2166,9 +2169,9 @@ nsHTMLEditor::Indent(const nsAString& aIndent)
         res = InsertText(NS_LITERAL_STRING(" "));
         NS_ENSURE_SUCCESS(res, res);
         // reposition selection to before the space character
-        res = GetStartNodeAndOffset(selection, getter_AddRefs(node), &offset);
-        NS_ENSURE_SUCCESS(res, res);
-        res = selection->Collapse(node,0);
+        NS_ENSURE_STATE(selection->GetRangeAt(0));
+        res = selection->Collapse(selection->GetRangeAt(0)->GetStartParent(),
+                                  0);
         NS_ENSURE_SUCCESS(res, res);
       }
     }
diff --git a/editor/libeditor/nsHTMLEditorStyle.cpp b/editor/libeditor/nsHTMLEditorStyle.cpp
index 43d6929f4d47..bb9c17350151 100644
--- a/editor/libeditor/nsHTMLEditorStyle.cpp
+++ b/editor/libeditor/nsHTMLEditorStyle.cpp
@@ -592,12 +592,22 @@ nsresult nsHTMLEditor::SplitStyleAbovePoint(nsCOMPtr<nsIDOMNode> *aNode,
         // or the style is specified in the style attribute
         isSet) {
       // found a style node we need to split
-      nsresult rv = SplitNodeDeep(GetAsDOMNode(node), *aNode, *aOffset,
-                                  &offset, false, outLeftNode, outRightNode);
-      NS_ENSURE_SUCCESS(rv, rv);
+      nsCOMPtr<nsIContent> outLeftContent, outRightContent;
+      nsCOMPtr<nsIContent> nodeParam = do_QueryInterface(*aNode);
+      NS_ENSURE_STATE(nodeParam || !*aNode);
+      offset = SplitNodeDeep(*node, *nodeParam, *aOffset, EmptyContainers::yes,
+                             getter_AddRefs(outLeftContent),
+                             getter_AddRefs(outRightContent));
+      NS_ENSURE_TRUE(offset != -1, NS_ERROR_FAILURE);
       // reset startNode/startOffset
       *aNode = GetAsDOMNode(node->GetParent());
       *aOffset = offset;
+      if (outLeftNode) {
+        *outLeftNode = GetAsDOMNode(outLeftContent);
+      }
+      if (outRightNode) {
+        *outRightNode = GetAsDOMNode(outRightContent);
+      }
     }
     node = node->GetParent();
   }
diff --git a/gfx/2d/DrawTargetSkia.cpp b/gfx/2d/DrawTargetSkia.cpp
index 9438b86168ce..1554094ace7d 100644
--- a/gfx/2d/DrawTargetSkia.cpp
+++ b/gfx/2d/DrawTargetSkia.cpp
@@ -837,20 +837,18 @@ DrawTargetSkia::Init(const IntSize &aSize, SurfaceFormat aFormat)
         aSize.width, aSize.height,
         GfxFormatToSkiaColorType(aFormat),
         alphaType);
+  // we need to have surfaces that have a stride aligned to 4 for interop with cairo
+  int stride = (BytesPerPixel(aFormat)*aSize.width + (4-1)) & -4;
 
-  SkAutoTUnref<SkBaseDevice> device(SkBitmapDevice::Create(skiInfo));
-  if (!device) {
-      return false;
-  }
-
-  SkBitmap bitmap = device->accessBitmap(true);
+  SkBitmap bitmap;
+  bitmap.setInfo(skiInfo, stride);
   if (!bitmap.allocPixels()) {
     return false;
   }
 
   bitmap.eraseARGB(0, 0, 0, 0);
 
-  mCanvas.adopt(new SkCanvas(device.get()));
+  mCanvas.adopt(new SkCanvas(bitmap));
   mSize = aSize;
 
   mFormat = aFormat;
diff --git a/gfx/2d/SourceSurfaceD2DTarget.cpp b/gfx/2d/SourceSurfaceD2DTarget.cpp
index b2145747cd4b..6953508f56c4 100644
--- a/gfx/2d/SourceSurfaceD2DTarget.cpp
+++ b/gfx/2d/SourceSurfaceD2DTarget.cpp
@@ -64,6 +64,11 @@ SourceSurfaceD2DTarget::GetDataSurface()
   desc.BindFlags = 0;
   desc.MiscFlags = 0;
 
+  if (!Factory::GetDirect3D10Device()) {
+    gfxCriticalError() << "Invalid D3D10 device in D2D target surface";
+    return nullptr;
+  }
+
   HRESULT hr = Factory::GetDirect3D10Device()->CreateTexture2D(&desc, nullptr, byRef(dataSurf->mTexture));
 
   if (FAILED(hr)) {
diff --git a/gfx/gl/GLContext.cpp b/gfx/gl/GLContext.cpp
index ea6385990e73..7bb2dd2e1580 100644
--- a/gfx/gl/GLContext.cpp
+++ b/gfx/gl/GLContext.cpp
@@ -1352,6 +1352,7 @@ GLContext::InitWithPrefix(const char *prefix, bool trygl)
             SymLoadStruct mapBufferRangeSymbols[] = {
                 { (PRFuncPtr*) &mSymbols.fMapBufferRange, { "MapBufferRange", nullptr } },
                 { (PRFuncPtr*) &mSymbols.fFlushMappedBufferRange, { "FlushMappedBufferRange", nullptr } },
+                { (PRFuncPtr*) &mSymbols.fUnmapBuffer, { "UnmapBuffer", nullptr } },
                 END_SYMBOLS
             };
 
diff --git a/gfx/skia/skia/src/core/SkDraw.cpp b/gfx/skia/skia/src/core/SkDraw.cpp
index b77eb430c7be..d9c44a2b6fe4 100644
--- a/gfx/skia/skia/src/core/SkDraw.cpp
+++ b/gfx/skia/skia/src/core/SkDraw.cpp
@@ -734,6 +734,16 @@ void SkDraw::drawPoints(SkCanvas::PointMode mode, size_t count,
     }
 }
 
+static inline SkPoint compute_stroke_size(const SkPaint& paint, const SkMatrix& matrix) {
+    SkASSERT(matrix.rectStaysRect());
+    SkASSERT(SkPaint::kFill_Style != paint.getStyle());
+
+    SkVector size;
+    SkPoint pt = { paint.getStrokeWidth(), paint.getStrokeWidth() };
+    matrix.mapVectors(&size, &pt, 1);
+    return SkPoint::Make(SkScalarAbs(size.fX), SkScalarAbs(size.fY));
+}
+
 static bool easy_rect_join(const SkPaint& paint, const SkMatrix& matrix,
                            SkPoint* strokeSize) {
     if (SkPaint::kMiter_Join != paint.getStrokeJoin() ||
@@ -812,12 +822,22 @@ void SkDraw::drawRect(const SkRect& rect, const SkPaint& paint) const {
     devRect.sort();
 
     // look for the quick exit, before we build a blitter
-    SkIRect ir;
-    devRect.roundOut(&ir);
+    SkRect bbox = devRect;
     if (paint.getStyle() != SkPaint::kFill_Style) {
         // extra space for hairlines
-        ir.inset(-1, -1);
+        if (paint.getStrokeWidth() == 0) {
+            bbox.outset(1, 1);
+        } else {
+            // For kStroke_RectType, strokeSize is already computed.
+            const SkPoint& ssize = (kStroke_RectType == rtype)
+                ? strokeSize
+                : compute_stroke_size(paint, *fMatrix);
+            bbox.outset(SkScalarHalf(ssize.x()), SkScalarHalf(ssize.y()));
+        }
     }
+
+    SkIRect ir;
+    bbox.roundOut(&ir);
     if (fRC->quickReject(ir)) {
         return;
     }
diff --git a/gfx/thebes/gfxPlatform.cpp b/gfx/thebes/gfxPlatform.cpp
index 06d6b877fc42..4d805e308f06 100644
--- a/gfx/thebes/gfxPlatform.cpp
+++ b/gfx/thebes/gfxPlatform.cpp
@@ -2157,13 +2157,9 @@ gfxPlatform::PerfWarnings()
   return gfxPrefs::PerfWarnings();
 }
 
-void
-gfxPlatform::GetAcceleratedCompositorBackends(nsTArray<LayersBackend>& aBackends)
+static inline bool
+AllowOpenGL(bool* aWhitelisted)
 {
-  // Being whitelisted is not enough to accelerate, but not being whitelisted is
-  // enough not to:
-  bool whitelisted = false;
-
   nsCOMPtr<nsIGfxInfo> gfxInfo = do_GetService("@mozilla.org/gfx/info;1");
   if (gfxInfo) {
     // bug 655578: on X11 at least, we must always call GetData (even if we don't need that information)
@@ -2175,12 +2171,26 @@ gfxPlatform::GetAcceleratedCompositorBackends(nsTArray<LayersBackend>& aBackends
     int32_t status;
     if (NS_SUCCEEDED(gfxInfo->GetFeatureStatus(nsIGfxInfo::FEATURE_OPENGL_LAYERS, &status))) {
       if (status == nsIGfxInfo::FEATURE_STATUS_OK) {
-        aBackends.AppendElement(LayersBackend::LAYERS_OPENGL);
-        whitelisted = true;
+        *aWhitelisted = true;
+        return true;
       }
     }
   }
 
+  return gfxPrefs::LayersAccelerationForceEnabled();
+}
+
+void
+gfxPlatform::GetAcceleratedCompositorBackends(nsTArray<LayersBackend>& aBackends)
+{
+  // Being whitelisted is not enough to accelerate, but not being whitelisted is
+  // enough not to:
+  bool whitelisted = false;
+
+  if (AllowOpenGL(&whitelisted)) {
+    aBackends.AppendElement(LayersBackend::LAYERS_OPENGL);
+  }
+
   if (!whitelisted) {
     static int tell_me_once = 0;
     if (!tell_me_once) {
diff --git a/gfx/thebes/gfxWindowsPlatform.cpp b/gfx/thebes/gfxWindowsPlatform.cpp
index d2aeed8b4d1d..cfc3550eda95 100755
--- a/gfx/thebes/gfxWindowsPlatform.cpp
+++ b/gfx/thebes/gfxWindowsPlatform.cpp
@@ -1967,6 +1967,10 @@ gfxWindowsPlatform::CheckD3D11Support(bool* aCanUseHardware)
     *aCanUseHardware = false;
     return FeatureStatus::Available;
   }
+  if (gfxPrefs::LayersAccelerationForceEnabled()) {
+    *aCanUseHardware = true;
+    return FeatureStatus::Available;
+  }
 
   if (nsCOMPtr<nsIGfxInfo> gfxInfo = services::GetGfxInfo()) {
     int32_t status;
diff --git a/js/src/asmjs/AsmJSModule.cpp b/js/src/asmjs/AsmJSModule.cpp
index 290cf9ba6273..b8026d5470d7 100644
--- a/js/src/asmjs/AsmJSModule.cpp
+++ b/js/src/asmjs/AsmJSModule.cpp
@@ -1792,6 +1792,7 @@ AsmJSModule::setProfilingEnabled(bool enabled, JSContext* cx)
 #elif defined(JS_CODEGEN_ARM64)
         MOZ_CRASH();
         void* callee = nullptr;
+        (void)callerRetAddr;
 #elif defined(JS_CODEGEN_MIPS32)
         Instruction* instr = (Instruction*)(callerRetAddr - 4 * sizeof(uint32_t));
         void* callee = (void*)Assembler::ExtractLuiOriValue(instr, instr->next());
@@ -1817,6 +1818,7 @@ AsmJSModule::setProfilingEnabled(bool enabled, JSContext* cx)
 #elif defined(JS_CODEGEN_ARM)
         new (caller) InstBLImm(BOffImm(newCallee - caller), Assembler::Always);
 #elif defined(JS_CODEGEN_ARM64)
+        (void)newCallee;
         MOZ_CRASH();
 #elif defined(JS_CODEGEN_MIPS32)
         Assembler::WriteLuiOriInstructions(instr, instr->next(),
@@ -1882,6 +1884,8 @@ AsmJSModule::setProfilingEnabled(bool enabled, JSContext* cx)
             new (jump) InstNOP();
         }
 #elif defined(JS_CODEGEN_ARM64)
+        (void)jump;
+        (void)profilingEpilogue;
         MOZ_CRASH();
 #elif defined(JS_CODEGEN_MIPS32)
         Instruction* instr = (Instruction*)jump;
diff --git a/js/src/builtin/ReflectParse.cpp b/js/src/builtin/ReflectParse.cpp
index 0d090b625ce2..62434d235626 100644
--- a/js/src/builtin/ReflectParse.cpp
+++ b/js/src/builtin/ReflectParse.cpp
@@ -3111,13 +3111,20 @@ ASTSerializer::expression(ParseNode* pn, MutableHandleValue dst)
       case PNK_NEW:
       case PNK_TAGGED_TEMPLATE:
       case PNK_CALL:
+      case PNK_SUPERCALL:
       {
         ParseNode* next = pn->pn_head;
         MOZ_ASSERT(pn->pn_pos.encloses(next->pn_pos));
 
         RootedValue callee(cx);
-        if (!expression(next, &callee))
-            return false;
+        if (pn->isKind(PNK_SUPERCALL)) {
+            MOZ_ASSERT(next->isKind(PNK_POSHOLDER));
+            if (!builder.super(&next->pn_pos, &callee))
+                return false;
+        } else {
+            if (!expression(next, &callee))
+                return false;
+        }
 
         NodeVector args(cx);
         if (!args.reserve(pn->pn_count - 1))
@@ -3135,6 +3142,7 @@ ASTSerializer::expression(ParseNode* pn, MutableHandleValue dst)
         if (pn->getKind() == PNK_TAGGED_TEMPLATE)
             return builder.taggedTemplate(callee, args, &pn->pn_pos, dst);
 
+        // SUPERCALL is Call(super, args)
         return pn->isKind(PNK_NEW)
                ? builder.newExpression(callee, args, &pn->pn_pos, dst)
 
diff --git a/js/src/builtin/TestingFunctions.cpp b/js/src/builtin/TestingFunctions.cpp
index 4ee690cd4fe1..4915caa51835 100644
--- a/js/src/builtin/TestingFunctions.cpp
+++ b/js/src/builtin/TestingFunctions.cpp
@@ -868,7 +868,7 @@ SetSavedStacksRNGState(JSContext* cx, unsigned argc, Value* vp)
     if (!ToInt32(cx, args[0], &seed))
         return false;
 
-    cx->compartment()->savedStacks().setRNGState((seed ^ RNG_MULTIPLIER) & RNG_MASK);
+    cx->compartment()->savedStacks().setRNGState(seed, seed * 33);
     return true;
 }
 
diff --git a/js/src/frontend/BytecodeEmitter.cpp b/js/src/frontend/BytecodeEmitter.cpp
index 98f7b53ab6fb..5212e6c8a6cc 100644
--- a/js/src/frontend/BytecodeEmitter.cpp
+++ b/js/src/frontend/BytecodeEmitter.cpp
@@ -1934,7 +1934,6 @@ BytecodeEmitter::checkSideEffects(ParseNode* pn, bool* answer)
       case PNK_TRUE:
       case PNK_FALSE:
       case PNK_NULL:
-      case PNK_THIS:
       case PNK_ELISION:
       case PNK_GENERATOR:
       case PNK_NUMBER:
@@ -1943,6 +1942,12 @@ BytecodeEmitter::checkSideEffects(ParseNode* pn, bool* answer)
         *answer = false;
         return true;
 
+      // |this| can throw in derived class constructors.
+      case PNK_THIS:
+        MOZ_ASSERT(pn->isArity(PN_NULLARY));
+        *answer = sc->isFunctionBox() && sc->asFunctionBox()->isDerivedClassConstructor();
+        return true;
+
       // Trivial binary nodes with more token pos holders.
       case PNK_NEWTARGET:
         MOZ_ASSERT(pn->isArity(PN_BINARY));
@@ -2185,6 +2190,7 @@ BytecodeEmitter::checkSideEffects(ParseNode* pn, bool* answer)
       case PNK_NEW:
       case PNK_CALL:
       case PNK_TAGGED_TEMPLATE:
+      case PNK_SUPERCALL:
         MOZ_ASSERT(pn->isArity(PN_LIST));
         *answer = true;
         return true;
@@ -6727,6 +6733,12 @@ BytecodeEmitter::emitCallOrNew(ParseNode* pn)
         }
         callop = false;
         break;
+      case PNK_POSHOLDER:
+        MOZ_ASSERT(pn->isKind(PNK_SUPERCALL));
+        MOZ_ASSERT(parser->handler.isSuperBase(pn2, cx));
+        if (!emit1(JSOP_SUPERFUN))
+            return false;
+        break;
       default:
         if (!emitTree(pn2))
             return false;
@@ -6739,7 +6751,8 @@ BytecodeEmitter::emitCallOrNew(ParseNode* pn)
             return false;
     }
 
-    bool isNewOp = pn->getOp() == JSOP_NEW || pn->getOp() == JSOP_SPREADNEW;
+    bool isNewOp = pn->getOp() == JSOP_NEW || pn->getOp() == JSOP_SPREADNEW ||
+                   pn->getOp() == JSOP_SUPERCALL || pn->getOp() == JSOP_SPREADSUPERCALL;;
 
     /*
      * Emit code for each argument in order, then emit the JSOP_*CALL or
@@ -6755,17 +6768,27 @@ BytecodeEmitter::emitCallOrNew(ParseNode* pn)
         }
 
         if (isNewOp) {
-            // Repush the callee as new.target
-            if (!emitDupAt(argc + 1))
-                return false;
+            if (pn->isKind(PNK_SUPERCALL)) {
+                if (!emit1(JSOP_NEWTARGET))
+                    return false;
+            } else {
+                // Repush the callee as new.target
+                if (!emitDupAt(argc + 1))
+                    return false;
+            }
         }
     } else {
         if (!emitArray(pn2->pn_next, argc, JSOP_SPREADCALLARRAY))
             return false;
 
         if (isNewOp) {
-            if (!emitDupAt(2))
-                return false;
+            if (pn->isKind(PNK_SUPERCALL)) {
+                if (!emit1(JSOP_NEWTARGET))
+                    return false;
+            } else {
+                if (!emitDupAt(2))
+                    return false;
+            }
         }
     }
     emittingForInit = oldEmittingForInit;
@@ -6791,6 +6814,9 @@ BytecodeEmitter::emitCallOrNew(ParseNode* pn)
         if (!emitUint16Operand(JSOP_THROWMSG, JSMSG_BAD_LEFTSIDE_OF_ASS))
             return false;
     }
+
+    if (pn->isKind(PNK_SUPERCALL) && !emit1(JSOP_SETTHIS))
+        return false;
     return true;
 }
 
@@ -7847,6 +7873,7 @@ BytecodeEmitter::emitTree(ParseNode* pn)
       case PNK_TAGGED_TEMPLATE:
       case PNK_CALL:
       case PNK_GENEXP:
+      case PNK_SUPERCALL:
         ok = emitCallOrNew(pn);
         break;
 
diff --git a/js/src/frontend/FoldConstants.cpp b/js/src/frontend/FoldConstants.cpp
index c46b07b36eed..e1fe96bc69f1 100644
--- a/js/src/frontend/FoldConstants.cpp
+++ b/js/src/frontend/FoldConstants.cpp
@@ -414,6 +414,7 @@ ContainsHoistedDeclaration(ExclusiveContext* cx, ParseNode* node, bool* result)
       case PNK_CLASSNAMES:
       case PNK_NEWTARGET:
       case PNK_POSHOLDER:
+      case PNK_SUPERCALL:
         MOZ_CRASH("ContainsHoistedDeclaration should have indicated false on "
                   "some parent node without recurring to test this node");
 
@@ -1579,7 +1580,8 @@ static bool
 FoldCall(ExclusiveContext* cx, ParseNode* node, Parser<FullParseHandler>& parser,
          bool inGenexpLambda)
 {
-    MOZ_ASSERT(node->isKind(PNK_CALL) || node->isKind(PNK_TAGGED_TEMPLATE));
+    MOZ_ASSERT(node->isKind(PNK_CALL) || node->isKind(PNK_SUPERCALL) ||
+               node->isKind(PNK_TAGGED_TEMPLATE));
     MOZ_ASSERT(node->isArity(PN_LIST));
 
     // Don't fold a parenthesized callable component in an invocation, as this
@@ -1876,6 +1878,7 @@ Fold(ExclusiveContext* cx, ParseNode** pnp, Parser<FullParseHandler>& parser, bo
         return FoldAdd(cx, pnp, parser, inGenexpLambda);
 
       case PNK_CALL:
+      case PNK_SUPERCALL:
       case PNK_TAGGED_TEMPLATE:
         return FoldCall(cx, pn, parser, inGenexpLambda);
 
diff --git a/js/src/frontend/NameFunctions.cpp b/js/src/frontend/NameFunctions.cpp
index 388ddd9802cb..c05ad2a7be20 100644
--- a/js/src/frontend/NameFunctions.cpp
+++ b/js/src/frontend/NameFunctions.cpp
@@ -376,6 +376,7 @@ class NameResolver
           case PNK_EXPORT_BATCH_SPEC:
           case PNK_FRESHENBLOCK:
           case PNK_OBJECT_PROPERTY_NAME:
+          case PNK_POSHOLDER:
             MOZ_ASSERT(cur->isArity(PN_NULLARY));
             break;
 
@@ -673,6 +674,7 @@ class NameResolver
           case PNK_COMMA:
           case PNK_NEW:
           case PNK_CALL:
+          case PNK_SUPERCALL:
           case PNK_GENEXP:
           case PNK_ARRAY:
           case PNK_STATEMENTLIST:
@@ -796,7 +798,6 @@ class NameResolver
           case PNK_EXPORT_SPEC: // by PNK_EXPORT_SPEC_LIST
           case PNK_CALLSITEOBJ: // by PNK_TAGGED_TEMPLATE
           case PNK_CLASSNAMES:  // by PNK_CLASS
-          case PNK_POSHOLDER:   // by PNK_NEWTARGET, PNK_DOT
             MOZ_CRASH("should have been handled by a parent node");
 
           case PNK_LIMIT: // invalid sentinel value
diff --git a/js/src/frontend/ParseNode.cpp b/js/src/frontend/ParseNode.cpp
index fd8e897a5a4b..07c667fd06f7 100644
--- a/js/src/frontend/ParseNode.cpp
+++ b/js/src/frontend/ParseNode.cpp
@@ -489,6 +489,7 @@ PushNodeChildren(ParseNode* pn, NodeStack* stack)
       case PNK_COMMA:
       case PNK_NEW:
       case PNK_CALL:
+      case PNK_SUPERCALL:
       case PNK_GENEXP:
       case PNK_ARRAY:
       case PNK_OBJECT:
diff --git a/js/src/frontend/ParseNode.h b/js/src/frontend/ParseNode.h
index 5023e4ade9c1..879a5d63df1d 100644
--- a/js/src/frontend/ParseNode.h
+++ b/js/src/frontend/ParseNode.h
@@ -175,6 +175,7 @@ class PackedScopeCoordinate
     F(CLASSNAMES) \
     F(NEWTARGET) \
     F(POSHOLDER) \
+    F(SUPERCALL) \
     \
     /* Unary operators. */ \
     F(TYPEOFNAME) \
diff --git a/js/src/frontend/Parser.cpp b/js/src/frontend/Parser.cpp
index a8b77025ddd8..c855c98cc332 100644
--- a/js/src/frontend/Parser.cpp
+++ b/js/src/frontend/Parser.cpp
@@ -8648,9 +8648,31 @@ Parser<ParseHandler>::memberExpr(YieldHandling yieldHandling, TokenKind tt, bool
                    tt == TOK_NO_SUBS_TEMPLATE)
         {
             if (handler.isSuperBase(lhs, context)) {
-                // For now...
-                report(ParseError, false, null(), JSMSG_BAD_SUPER);
-                return null();
+                if (!pc->sc->isFunctionBox() || !pc->sc->asFunctionBox()->isDerivedClassConstructor()) {
+                    report(ParseError, false, null(), JSMSG_BAD_SUPERCALL);
+                    return null();
+                }
+
+                if (tt != TOK_LP) {
+                    report(ParseError, false, null(), JSMSG_BAD_SUPER);
+                    return null();
+                }
+
+                nextMember = handler.newList(PNK_SUPERCALL, lhs, JSOP_SUPERCALL);
+                if (!nextMember)
+                    return null();
+
+                // Despite the fact that it's impossible to have |super()| is a
+                // generator, we still inherity the yieldHandling of the
+                // memberExpression, per spec. Curious.
+                bool isSpread = false;
+                if (!argumentList(yieldHandling, nextMember, &isSpread))
+                    return null();
+
+                if (isSpread)
+                    handler.setOp(nextMember, JSOP_SPREADSUPERCALL);
+
+                return nextMember;
             }
 
             nextMember = tt == TOK_LP ? handler.newCall() : handler.newTaggedTemplate();
diff --git a/js/src/frontend/SharedContext.h b/js/src/frontend/SharedContext.h
index 7ccabafccfb2..10034c7fa22d 100644
--- a/js/src/frontend/SharedContext.h
+++ b/js/src/frontend/SharedContext.h
@@ -374,6 +374,7 @@ class FunctionBox : public ObjectBox, public SharedContext
                hasExtensibleScope() ||
                needsDeclEnvObject() ||
                needsHomeObject()    ||
+               isDerivedClassConstructor() ||
                isGenerator();
     }
 };
diff --git a/js/src/jit-test/tests/auto-regress/bug759306.js b/js/src/jit-test/tests/auto-regress/bug759306.js
index 6db04ed34e58..32032e84eddc 100644
--- a/js/src/jit-test/tests/auto-regress/bug759306.js
+++ b/js/src/jit-test/tests/auto-regress/bug759306.js
@@ -1,4 +1,4 @@
-// |jit-test| error:InternalError
+// |jit-test| error:TypeError
 
 // Binary: cache/js-dbg-32-4ce3983a43f4-linux
 // Flags:
diff --git a/js/src/jit-test/tests/basic/testProxyConstructors.js b/js/src/jit-test/tests/basic/testProxyConstructors.js
index 5bf689bf9af5..f002b069f345 100644
--- a/js/src/jit-test/tests/basic/testProxyConstructors.js
+++ b/js/src/jit-test/tests/basic/testProxyConstructors.js
@@ -1,13 +1,15 @@
 // |jit-test| error: ExitCleanly
 
-assertEq((new (Proxy.createFunction({},
+var handler = { getPropertyDescriptor() { return undefined; } }
+
+assertEq((new (Proxy.createFunction(handler,
                                     function(){ this.x = 1 },
                                     function(){ this.x = 2 }))).x, 2);
 // proxies can return the callee
-var x = Proxy.createFunction({}, function (q) { return q; });
+var x = Proxy.createFunction(handler, function (q) { return q; });
 assertEq(new x(x), x);
 try {
-    var x = (Proxy.createFunction({}, "".indexOf));
+    var x = (Proxy.createFunction(handler, "".indexOf));
     new x;
     throw "Should not be reached"
 }
diff --git a/js/src/jit-test/tests/debug/Memory-allocationSamplingProbability-02.js b/js/src/jit-test/tests/debug/Memory-allocationSamplingProbability-02.js
index 106f39e62003..4afa86838563 100644
--- a/js/src/jit-test/tests/debug/Memory-allocationSamplingProbability-02.js
+++ b/js/src/jit-test/tests/debug/Memory-allocationSamplingProbability-02.js
@@ -32,5 +32,5 @@ dbg.memory.trackingAllocationSites = true;
 // probability is fine.
 measure(0.0, 0);
 measure(1.0, 100);
-measure(0.1, 9);
-measure(0.5, 51);
+measure(0.1, 7);
+measure(0.5, 44);
diff --git a/js/src/jit-test/tests/ion/bug825705.js b/js/src/jit-test/tests/ion/bug825705.js
index 05689f6edec0..ebd30c21c89f 100644
--- a/js/src/jit-test/tests/ion/bug825705.js
+++ b/js/src/jit-test/tests/ion/bug825705.js
@@ -6,18 +6,3 @@ evalcx("\
     f();\
     f();\
 ", newGlobal());
-
-// Test 2: Don't take the prototype of proxy's to create |this|,
-// as this will throw... Not expected behaviour.
-var O = new Proxy(function() {}, {
-    get: function() {
-	    throw "get trap";
-    }
-});
-
-function f() {
-  new O();
-}
-
-f();
-f();
diff --git a/js/src/jit/BaselineBailouts.cpp b/js/src/jit/BaselineBailouts.cpp
index d6bdea5b2868..fa106a2c6660 100644
--- a/js/src/jit/BaselineBailouts.cpp
+++ b/js/src/jit/BaselineBailouts.cpp
@@ -980,7 +980,7 @@ InitFromBailout(JSContext* cx, HandleScript caller, jsbytecode* callerPC,
 #endif
 
     bool pushedNewTarget = op == JSOP_NEW;
-    
+
     // If this was the last inline frame, or we are bailing out to a catch or
     // finally block in this frame, then unpacking is almost done.
     if (!iter.moreFrames() || catchingException) {
@@ -1877,6 +1877,8 @@ jit::FinishBailoutToBaseline(BaselineBailoutInfo* bailoutInfo)
       case Bailout_NonSimdFloat32x4Input:
       case Bailout_InitialState:
       case Bailout_Debugger:
+      case Bailout_UninitializedThis:
+      case Bailout_BadDerivedConstructorReturn:
         // Do nothing.
         break;
 
diff --git a/js/src/jit/BaselineCompiler.cpp b/js/src/jit/BaselineCompiler.cpp
index 51c9df083462..e51acf99c2f0 100644
--- a/js/src/jit/BaselineCompiler.cpp
+++ b/js/src/jit/BaselineCompiler.cpp
@@ -1285,6 +1285,30 @@ BaselineCompiler::emit_JSOP_NULL()
     return true;
 }
 
+typedef bool (*ThrowUninitializedThisFn)(JSContext*, BaselineFrame* frame);
+static const VMFunction ThrowUninitializedThisInfo =
+    FunctionInfo<ThrowUninitializedThisFn>(BaselineThrowUninitializedThis);
+
+bool
+BaselineCompiler::emitCheckThis()
+{
+    frame.assertSyncedStack();
+
+    Label thisOK;
+    masm.branchTestMagic(Assembler::NotEqual, frame.addressOfThis(), &thisOK);
+
+    prepareVMCall();
+
+    masm.loadBaselineFramePtr(BaselineFrameReg, R0.scratchReg());
+    pushArg(R0.scratchReg());
+
+    if (!callVM(ThrowUninitializedThisInfo))
+        return false;
+
+    masm.bind(&thisOK);
+    return true;
+}
+
 bool
 BaselineCompiler::emit_JSOP_THIS()
 {
@@ -1299,6 +1323,12 @@ BaselineCompiler::emit_JSOP_THIS()
         return true;
     }
 
+    if (script->isDerivedClassConstructor()) {
+        frame.syncStack(0);
+        if (!emitCheckThis())
+            return false;
+    }
+
     // Keep this value in R0
     frame.pushThis();
 
@@ -2873,7 +2903,7 @@ BaselineCompiler::emitCall()
 {
     MOZ_ASSERT(IsCallPC(pc));
 
-    bool construct = JSOp(*pc) == JSOP_NEW;
+    bool construct = JSOp(*pc) == JSOP_NEW || JSOp(*pc) == JSOP_SUPERCALL;
     uint32_t argc = GET_ARGC(pc);
 
     frame.syncStack(0);
@@ -2900,13 +2930,13 @@ BaselineCompiler::emitSpreadCall()
     masm.move32(Imm32(1), R0.scratchReg());
 
     // Call IC
-    ICCall_Fallback::Compiler stubCompiler(cx, /* isConstructing = */ JSOp(*pc) == JSOP_SPREADNEW,
+    bool construct = JSOp(*pc) == JSOP_SPREADNEW || JSOp(*pc) == JSOP_SPREADSUPERCALL;
+    ICCall_Fallback::Compiler stubCompiler(cx, /* isConstructing = */ construct,
                                            /* isSpread = */ true);
     if (!emitOpIC(stubCompiler.getStub(&stubSpace_)))
         return false;
 
     // Update FrameInfo.
-    bool construct = JSOp(*pc) == JSOP_SPREADNEW;
     frame.popn(3 + construct);
     frame.push(R0);
     return true;
@@ -2924,6 +2954,12 @@ BaselineCompiler::emit_JSOP_NEW()
     return emitCall();
 }
 
+bool
+BaselineCompiler::emit_JSOP_SUPERCALL()
+{
+    return emitCall();
+}
+
 bool
 BaselineCompiler::emit_JSOP_FUNCALL()
 {
@@ -2960,6 +2996,12 @@ BaselineCompiler::emit_JSOP_SPREADNEW()
     return emitSpreadCall();
 }
 
+bool
+BaselineCompiler::emit_JSOP_SPREADSUPERCALL()
+{
+    return emitSpreadCall();
+}
+
 bool
 BaselineCompiler::emit_JSOP_SPREADEVAL()
 {
@@ -3290,6 +3332,10 @@ BaselineCompiler::emit_JSOP_DEBUGGER()
     return true;
 }
 
+typedef bool (*ThrowBadDerivedReturnFn)(JSContext*, HandleValue);
+static const VMFunction ThrowBadDerivedReturnInfo =
+    FunctionInfo<ThrowBadDerivedReturnFn>(jit::ThrowBadDerivedReturn);
+
 typedef bool (*DebugEpilogueFn)(JSContext*, BaselineFrame*, jsbytecode*);
 static const VMFunction DebugEpilogueInfo =
     FunctionInfo<DebugEpilogueFn>(jit::DebugEpilogueOnBaselineReturn);
@@ -3297,6 +3343,29 @@ static const VMFunction DebugEpilogueInfo =
 bool
 BaselineCompiler::emitReturn()
 {
+    if (script->isDerivedClassConstructor()) {
+        frame.syncStack(0);
+
+        Label derivedDone, returnOK;
+        masm.branchTestObject(Assembler::Equal, JSReturnOperand, &derivedDone);
+        masm.branchTestUndefined(Assembler::Equal, JSReturnOperand, &returnOK);
+
+        // This is going to smash JSReturnOperand, but we don't care, because it's
+        // also going to throw unconditionally.
+        prepareVMCall();
+        pushArg(JSReturnOperand);
+        if (!callVM(ThrowBadDerivedReturnInfo))
+            return false;
+        masm.assumeUnreachable("Should throw on bad derived constructor return");
+
+        masm.bind(&returnOK);
+
+        if (!emitCheckThis())
+            return false;
+
+        masm.bind(&derivedDone);
+    }
+
     if (compileDebugInstrumentation_) {
         // Move return value into the frame's rval slot.
         masm.storeValue(JSReturnOperand, frame.addressOfReturnValue());
diff --git a/js/src/jit/BaselineCompiler.h b/js/src/jit/BaselineCompiler.h
index 6a4eb2c430a0..0e4dafba4875 100644
--- a/js/src/jit/BaselineCompiler.h
+++ b/js/src/jit/BaselineCompiler.h
@@ -201,7 +201,9 @@ namespace jit {
     _(JSOP_SETRVAL)            \
     _(JSOP_RETRVAL)            \
     _(JSOP_RETURN)             \
-    _(JSOP_NEWTARGET)
+    _(JSOP_NEWTARGET)          \
+    _(JSOP_SUPERCALL)          \
+    _(JSOP_SPREADSUPERCALL)
 
 class BaselineCompiler : public BaselineCompilerSpecific
 {
@@ -305,6 +307,7 @@ class BaselineCompiler : public BaselineCompilerSpecific
     bool emitFormalArgAccess(uint32_t arg, bool get);
 
     bool emitUninitializedLexicalCheck(const ValueOperand& val);
+    bool emitCheckThis();
 
     bool addPCMappingEntry(bool addIndexEntry);
 
diff --git a/js/src/jit/BaselineIC.cpp b/js/src/jit/BaselineIC.cpp
index 23b9d13a7871..5c4919f62e57 100644
--- a/js/src/jit/BaselineIC.cpp
+++ b/js/src/jit/BaselineIC.cpp
@@ -395,6 +395,8 @@ ICTypeMonitor_Fallback::addMonitorStubForValue(JSContext* cx, JSScript* script,
     }
 
     if (val.isPrimitive()) {
+        if (val.isMagic(JS_UNINITIALIZED_LEXICAL))
+            return true;
         MOZ_ASSERT(!val.isMagic());
         JSValueType type = val.isDouble() ? JSVAL_TYPE_DOUBLE : val.extractNonDoubleType();
 
@@ -503,10 +505,15 @@ DoTypeMonitorFallback(JSContext* cx, BaselineFrame* frame, ICTypeMonitor_Fallbac
 {
     // It's possible that we arrived here from bailing out of Ion, and that
     // Ion proved that the value is dead and optimized out. In such cases, do
-    // nothing.
-    if (value.isMagic(JS_OPTIMIZED_OUT)) {
-        res.set(value);
-        return true;
+    // nothing. However, it's also possible that we have an uninitialized this,
+    // in which case we should not look for other magic values.
+    if (stub->monitorsThis()) {
+        MOZ_ASSERT_IF(value.isMagic(), value.isMagic(JS_UNINITIALIZED_LEXICAL));
+    } else {
+        if (value.isMagic(JS_OPTIMIZED_OUT)) {
+            res.set(value);
+            return true;
+        }
     }
 
     RootedScript script(cx, frame->script());
@@ -516,7 +523,10 @@ DoTypeMonitorFallback(JSContext* cx, BaselineFrame* frame, ICTypeMonitor_Fallbac
     uint32_t argument;
     if (stub->monitorsThis()) {
         MOZ_ASSERT(pc == script->code());
-        TypeScript::SetThis(cx, script, value);
+        if (value.isMagic(JS_UNINITIALIZED_LEXICAL))
+            TypeScript::SetThis(cx, script, TypeSet::UnknownType());
+        else
+            TypeScript::SetThis(cx, script, value);
     } else if (stub->monitorsArgument(&argument)) {
         MOZ_ASSERT(pc == script->code());
         TypeScript::SetArgument(cx, script, argument, value);
@@ -5015,6 +5025,18 @@ TryAttachGlobalNameAccessorStub(JSContext* cx, HandleScript script, jsbytecode*
         ICStub* monitorStub = stub->fallbackMonitorStub()->firstMonitorStub();
         RootedFunction getter(cx, &shape->getterObject()->as<JSFunction>());
 
+        // The CallNativeGlobal stub needs to generate 3 shape checks:
+        //
+        // 1. The global lexical scope shape check.
+        // 2. The global object shape check.
+        // 3. The holder shape check.
+        //
+        // 1 is done as the receiver check, as for GETNAME the global lexical scope is in the
+        // receiver position. 2 is done as a manual check that other GetProp stubs don't do. 3 is
+        // done as the holder check per normal.
+        //
+        // In the case the holder is the global object, check 2 is redundant but is not yet
+        // optimized away.
         JitSpew(JitSpew_BaselineIC, "  Generating GetName(GlobalName/NativeGetter) stub");
         if (UpdateExistingGetPropCallStubs(stub, ICStub::GetProp_CallNativeGlobal, current,
                                            globalLexical, getter))
@@ -8622,6 +8644,8 @@ TryAttachCallStub(JSContext* cx, ICCall_Fallback* stub, HandleScript script, jsb
                   JSOp op, uint32_t argc, Value* vp, bool constructing, bool isSpread,
                   bool createSingleton, bool* handled)
 {
+    bool isSuper = op == JSOP_SUPERCALL || op == JSOP_SPREADSUPERCALL;
+
     if (createSingleton || op == JSOP_EVAL || op == JSOP_STRICTEVAL)
         return true;
 
@@ -8729,9 +8753,11 @@ TryAttachCallStub(JSContext* cx, ICCall_Fallback* stub, HandleScript script, jsb
             EnsureTrackPropertyTypes(cx, fun, NameToId(cx->names().prototype));
 
         // Remember the template object associated with any script being called
-        // as a constructor, for later use during Ion compilation.
+        // as a constructor, for later use during Ion compilation. This is unsound
+        // for super(), as a single callsite can have multiple possible prototype object
+        // created (via different newTargets)
         RootedObject templateObject(cx);
-        if (constructing) {
+        if (constructing && !isSuper) {
             // If we are calling a constructor for which the new script
             // properties analysis has not been performed yet, don't attach a
             // stub. After the analysis is performed, CreateThisForFunction may
@@ -8740,15 +8766,16 @@ TryAttachCallStub(JSContext* cx, ICCall_Fallback* stub, HandleScript script, jsb
 
             // Only attach a stub if the function already has a prototype and
             // we can look it up without causing side effects.
+            RootedObject newTarget(cx, &vp[2 + argc].toObject());
             RootedValue protov(cx);
-            if (!GetPropertyPure(cx, fun, NameToId(cx->names().prototype), protov.address())) {
+            if (!GetPropertyPure(cx, newTarget, NameToId(cx->names().prototype), protov.address())) {
                 JitSpew(JitSpew_BaselineIC, "  Can't purely lookup function prototype");
                 return true;
             }
 
             if (protov.isObject()) {
                 TaggedProto proto(&protov.toObject());
-                ObjectGroup* group = ObjectGroup::defaultNewGroup(cx, nullptr, proto, fun);
+                ObjectGroup* group = ObjectGroup::defaultNewGroup(cx, nullptr, proto, newTarget);
                 if (!group)
                     return false;
 
@@ -8762,7 +8789,7 @@ TryAttachCallStub(JSContext* cx, ICCall_Fallback* stub, HandleScript script, jsb
                 }
             }
 
-            JSObject* thisObject = CreateThisForFunction(cx, fun, TenuredObject);
+            JSObject* thisObject = CreateThisForFunction(cx, fun, newTarget, TenuredObject);
             if (!thisObject)
                 return false;
 
@@ -8830,7 +8857,7 @@ TryAttachCallStub(JSContext* cx, ICCall_Fallback* stub, HandleScript script, jsb
         }
 
         RootedObject templateObject(cx);
-        if (MOZ_LIKELY(!isSpread)) {
+        if (MOZ_LIKELY(!isSpread && !isSuper)) {
             bool skipAttach = false;
             CallArgs args = CallArgsFromVp(argc, vp);
             if (!GetTemplateObjectForNative(cx, fun->native(), args, &templateObject, &skipAttach))
@@ -9516,7 +9543,8 @@ ICCall_Fallback::Compiler::postGenerateStubCode(MacroAssembler& masm, Handle<Jit
                                                                     isConstructing_);
 }
 
-typedef bool (*CreateThisFn)(JSContext* cx, HandleObject callee, MutableHandleValue rval);
+typedef bool (*CreateThisFn)(JSContext* cx, HandleObject callee, HandleObject newTarget,
+                             MutableHandleValue rval);
 static const VMFunction CreateThisInfoBaseline = FunctionInfo<CreateThisFn>(CreateThis);
 
 bool
@@ -9610,24 +9638,31 @@ ICCallScriptedCompiler::generateStubCode(MacroAssembler& masm)
 
         // Stack now looks like:
         //      [..., Callee, ThisV, Arg0V, ..., ArgNV, NewTarget, StubFrameHeader, ArgC ]
+        masm.loadValue(Address(masm.getStackPointer(), STUB_FRAME_SIZE + sizeof(size_t)), R1);
+        masm.push(masm.extractObject(R1, ExtractTemp0));
+
         if (isSpread_) {
             masm.loadValue(Address(masm.getStackPointer(),
-                                   3 * sizeof(Value) + STUB_FRAME_SIZE + sizeof(size_t)), R1);
+                                   3 * sizeof(Value) + STUB_FRAME_SIZE + sizeof(size_t) +
+                                   sizeof(JSObject*)),
+                                   R1);
         } else {
             BaseValueIndex calleeSlot2(masm.getStackPointer(), argcReg,
-                                       2 * sizeof(Value) + STUB_FRAME_SIZE + sizeof(size_t));
+                                       2 * sizeof(Value) + STUB_FRAME_SIZE + sizeof(size_t) +
+                                       sizeof(JSObject*));
             masm.loadValue(calleeSlot2, R1);
         }
         masm.push(masm.extractObject(R1, ExtractTemp0));
         if (!callVM(CreateThisInfoBaseline, masm))
             return false;
 
-        // Return of CreateThis must be an object.
+        // Return of CreateThis must be an object or uninitialized.
 #ifdef DEBUG
-        Label createdThisIsObject;
-        masm.branchTestObject(Assembler::Equal, JSReturnOperand, &createdThisIsObject);
-        masm.assumeUnreachable("The return of CreateThis must be an object.");
-        masm.bind(&createdThisIsObject);
+        Label createdThisOK;
+        masm.branchTestObject(Assembler::Equal, JSReturnOperand, &createdThisOK);
+        masm.branchTestMagic(Assembler::Equal, JSReturnOperand, &createdThisOK);
+        masm.assumeUnreachable("The return of CreateThis must be an object or uninitialized.");
+        masm.bind(&createdThisOK);
 #endif
 
         // Reset the register set from here on in.
diff --git a/js/src/jit/BaselineJIT.cpp b/js/src/jit/BaselineJIT.cpp
index 387052fb8cf6..debf0bddd9e1 100644
--- a/js/src/jit/BaselineJIT.cpp
+++ b/js/src/jit/BaselineJIT.cpp
@@ -111,7 +111,8 @@ EnterBaseline(JSContext* cx, EnterJitData& data)
     EnterJitCode enter = cx->runtime()->jitRuntime()->enterBaseline();
 
     // Caller must construct |this| before invoking the Ion function.
-    MOZ_ASSERT_IF(data.constructing, data.maxArgv[0].isObject());
+    MOZ_ASSERT_IF(data.constructing, data.maxArgv[0].isObject() ||
+                                     data.maxArgv[0].isMagic(JS_UNINITIALIZED_LEXICAL));
 
     data.result.setInt32(data.numActualArgs);
     {
@@ -131,9 +132,12 @@ EnterBaseline(JSContext* cx, EnterJitData& data)
 
     MOZ_ASSERT(!cx->runtime()->jitRuntime()->hasIonReturnOverride());
 
-    // Jit callers wrap primitive constructor return.
-    if (!data.result.isMagic() && data.constructing && data.result.isPrimitive())
+    // Jit callers wrap primitive constructor return, except for derived
+    // class constructors, which are forced to do it themselves.
+    if (!data.result.isMagic() && data.constructing && data.result.isPrimitive()) {
+        MOZ_ASSERT(data.maxArgv[0].isObject());
         data.result = data.maxArgv[0];
+    }
 
     // Release temporary buffer used for OSR into Ion.
     cx->runtime()->getJitRuntime(cx)->freeOsrTempData();
@@ -211,7 +215,7 @@ jit::EnterBaselineAtBranch(JSContext* cx, InterpreterFrame* fp, jsbytecode* pc)
                 return JitExec_Aborted;
 
             vals.infallibleAppend(thisv);
-            
+
             if (fp->isFunctionFrame())
                 vals.infallibleAppend(fp->newTarget());
             else
@@ -306,15 +310,6 @@ CanEnterBaselineJIT(JSContext* cx, HandleScript script, InterpreterFrame* osrFra
 MethodStatus
 jit::CanEnterBaselineAtBranch(JSContext* cx, InterpreterFrame* fp, bool newType)
 {
-   // If constructing, allocate a new |this| object.
-   if (fp->isConstructing() && fp->functionThis().isPrimitive()) {
-       RootedObject callee(cx, &fp->callee());
-       RootedObject obj(cx, CreateThisForFunction(cx, callee, newType ? SingletonObject : GenericObject));
-       if (!obj)
-           return Method_Skipped;
-       fp->functionThis().setObject(*obj);
-   }
-
    if (!CheckFrame(fp))
        return Method_CantCompile;
 
@@ -356,8 +351,13 @@ jit::CanEnterBaselineMethod(JSContext* cx, RunState& state)
             return Method_CantCompile;
         }
 
-        if (!state.maybeCreateThisForConstructor(cx))
-            return Method_Skipped;
+        if (!state.maybeCreateThisForConstructor(cx)) {
+            if (cx->isThrowingOutOfMemory()) {
+                cx->recoverFromOutOfMemory();
+                return Method_Skipped;
+            }
+            return Method_Error;
+        }
     } else {
         MOZ_ASSERT(state.isExecute());
         ExecuteType type = state.asExecute()->type();
diff --git a/js/src/jit/CodeGenerator.cpp b/js/src/jit/CodeGenerator.cpp
index 39daaaddc44c..3f31ce1aff41 100644
--- a/js/src/jit/CodeGenerator.cpp
+++ b/js/src/jit/CodeGenerator.cpp
@@ -4928,13 +4928,19 @@ CodeGenerator::visitInitPropGetterSetter(LInitPropGetterSetter* lir)
     callVM(InitPropGetterSetterInfo, lir);
 }
 
-typedef bool (*CreateThisFn)(JSContext* cx, HandleObject callee, MutableHandleValue rval);
+typedef bool (*CreateThisFn)(JSContext* cx, HandleObject callee, HandleObject newTarget, MutableHandleValue rval);
 static const VMFunction CreateThisInfoCodeGen = FunctionInfo<CreateThisFn>(CreateThis);
 
 void
 CodeGenerator::visitCreateThis(LCreateThis* lir)
 {
     const LAllocation* callee = lir->getCallee();
+    const LAllocation* newTarget = lir->getNewTarget();
+
+    if (newTarget->isConstant())
+        pushArg(ImmGCPtr(&newTarget->toConstant()->toObject()));
+    else
+        pushArg(ToRegister(newTarget));
 
     if (callee->isConstant())
         pushArg(ImmGCPtr(&callee->toConstant()->toObject()));
@@ -4945,12 +4951,14 @@ CodeGenerator::visitCreateThis(LCreateThis* lir)
 }
 
 static JSObject*
-CreateThisForFunctionWithProtoWrapper(JSContext* cx, js::HandleObject callee, HandleObject proto)
+CreateThisForFunctionWithProtoWrapper(JSContext* cx, HandleObject callee, HandleObject newTarget,
+                                      HandleObject proto)
 {
-    return CreateThisForFunctionWithProto(cx, callee, proto);
+    return CreateThisForFunctionWithProto(cx, callee, newTarget, proto);
 }
 
-typedef JSObject* (*CreateThisWithProtoFn)(JSContext* cx, HandleObject callee, HandleObject proto);
+typedef JSObject* (*CreateThisWithProtoFn)(JSContext* cx, HandleObject callee,
+                                           HandleObject newTarget, HandleObject proto);
 static const VMFunction CreateThisWithProtoInfo =
 FunctionInfo<CreateThisWithProtoFn>(CreateThisForFunctionWithProtoWrapper);
 
@@ -4958,6 +4966,7 @@ void
 CodeGenerator::visitCreateThisWithProto(LCreateThisWithProto* lir)
 {
     const LAllocation* callee = lir->getCallee();
+    const LAllocation* newTarget = lir->getNewTarget();
     const LAllocation* proto = lir->getPrototype();
 
     if (proto->isConstant())
@@ -4965,6 +4974,11 @@ CodeGenerator::visitCreateThisWithProto(LCreateThisWithProto* lir)
     else
         pushArg(ToRegister(proto));
 
+    if (newTarget->isConstant())
+        pushArg(ImmGCPtr(&newTarget->toConstant()->toObject()));
+    else
+        pushArg(ToRegister(newTarget));
+
     if (callee->isConstant())
         pushArg(ImmGCPtr(&callee->toConstant()->toObject()));
     else
@@ -10325,6 +10339,19 @@ CodeGenerator::visitNewTarget(LNewTarget *ins)
     masm.bind(&done);
 }
 
+void
+CodeGenerator::visitCheckReturn(LCheckReturn* ins)
+{
+    ValueOperand returnValue = ToValue(ins, LCheckReturn::ReturnValue);
+    ValueOperand thisValue = ToValue(ins, LCheckReturn::ThisValue);
+    Label bail, noChecks;
+    masm.branchTestObject(Assembler::Equal, returnValue, &noChecks);
+    masm.branchTestUndefined(Assembler::NotEqual, returnValue, &bail);
+    masm.branchTestMagicValue(Assembler::Equal, thisValue, JS_UNINITIALIZED_LEXICAL, &bail);
+    bailoutFrom(&bail, ins->snapshot());
+    masm.bind(&noChecks);
+}
+
 // Out-of-line math_random_no_outparam call for LRandom.
 class OutOfLineRandom : public OutOfLineCodeBase<CodeGenerator>
 {
diff --git a/js/src/jit/CodeGenerator.h b/js/src/jit/CodeGenerator.h
index 7dc9e70add1a..d1669456ffc7 100644
--- a/js/src/jit/CodeGenerator.h
+++ b/js/src/jit/CodeGenerator.h
@@ -335,6 +335,7 @@ class CodeGenerator : public CodeGeneratorSpecific
     void visitDebugger(LDebugger* ins);
     void visitNewTarget(LNewTarget* ins);
     void visitArrowNewTarget(LArrowNewTarget* ins);
+    void visitCheckReturn(LCheckReturn* ins);
 
     void visitCheckOverRecursed(LCheckOverRecursed* lir);
     void visitCheckOverRecursedFailure(CheckOverRecursedFailure* ool);
diff --git a/js/src/jit/Ion.cpp b/js/src/jit/Ion.cpp
index eaf90d6bbe8d..ab7ae9862336 100644
--- a/js/src/jit/Ion.cpp
+++ b/js/src/jit/Ion.cpp
@@ -2547,8 +2547,11 @@ jit::CanEnter(JSContext* cx, RunState& state)
         }
 
         if (!state.maybeCreateThisForConstructor(cx)) {
-            cx->recoverFromOutOfMemory();
-            return Method_Skipped;
+            if (cx->isThrowingOutOfMemory()) {
+                cx->recoverFromOutOfMemory();
+                return Method_Skipped;
+            }
+            return Method_Error;
         }
     }
 
@@ -2659,7 +2662,8 @@ EnterIon(JSContext* cx, EnterJitData& data)
     EnterJitCode enter = cx->runtime()->jitRuntime()->enterIon();
 
     // Caller must construct |this| before invoking the Ion function.
-    MOZ_ASSERT_IF(data.constructing, data.maxArgv[0].isObject());
+    MOZ_ASSERT_IF(data.constructing,
+                  data.maxArgv[0].isObject() || data.maxArgv[0].isMagic(JS_UNINITIALIZED_LEXICAL));
 
     data.result.setInt32(data.numActualArgs);
     {
@@ -2672,9 +2676,13 @@ EnterIon(JSContext* cx, EnterJitData& data)
 
     MOZ_ASSERT(!cx->runtime()->jitRuntime()->hasIonReturnOverride());
 
-    // Jit callers wrap primitive constructor return.
-    if (!data.result.isMagic() && data.constructing && data.result.isPrimitive())
+    // Jit callers wrap primitive constructor return, except for derived class constructors.
+    if (!data.result.isMagic() && data.constructing &&
+        data.result.isPrimitive())
+    {
+        MOZ_ASSERT(data.maxArgv[0].isObject());
         data.result = data.maxArgv[0];
+    }
 
     // Release temporary buffer used for OSR into Ion.
     cx->runtime()->getJitRuntime(cx)->freeOsrTempData();
diff --git a/js/src/jit/IonBuilder.cpp b/js/src/jit/IonBuilder.cpp
index c18487d90311..3db7968221dd 100644
--- a/js/src/jit/IonBuilder.cpp
+++ b/js/src/jit/IonBuilder.cpp
@@ -1867,7 +1867,8 @@ IonBuilder::inspectOpcode(JSOp op)
 
       case JSOP_CALL:
       case JSOP_NEW:
-        return jsop_call(GET_ARGC(pc), (JSOp)*pc == JSOP_NEW);
+      case JSOP_SUPERCALL:
+        return jsop_call(GET_ARGC(pc), (JSOp)*pc == JSOP_NEW || (JSOp)*pc == JSOP_SUPERCALL);
 
       case JSOP_EVAL:
       case JSOP_STRICTEVAL:
@@ -4469,6 +4470,15 @@ IonBuilder::processReturn(JSOp op)
         MOZ_CRASH("unknown return op");
     }
 
+    if (script()->isDerivedClassConstructor() &&
+        def->type() != MIRType_Object)
+    {
+        MOZ_ASSERT(info().funMaybeLazy() && info().funMaybeLazy()->isClassConstructor());
+        MCheckReturn* checkRet = MCheckReturn::New(alloc(), def, current->getSlot(info().thisSlot()));
+        current->add(checkRet);
+        def = checkRet;
+    }
+
     MReturn* ret = MReturn::New(alloc(), def);
     current->end(ret);
 
@@ -4944,7 +4954,7 @@ IonBuilder::inlineScriptedCall(CallInfo& callInfo, JSFunction* target)
 
     // Create new |this| on the caller-side for inlined constructors.
     if (callInfo.constructing()) {
-        MDefinition* thisDefn = createThis(target, callInfo.fun());
+        MDefinition* thisDefn = createThis(target, callInfo.fun(), callInfo.getNewTarget());
         if (!thisDefn)
             return false;
         callInfo.setThis(thisDefn);
@@ -6038,7 +6048,7 @@ IonBuilder::createCallObject(MDefinition* callee, MDefinition* scope)
 }
 
 MDefinition*
-IonBuilder::createThisScripted(MDefinition* callee)
+IonBuilder::createThisScripted(MDefinition* callee, MDefinition* newTarget)
 {
     // Get callee.prototype.
     //
@@ -6053,12 +6063,12 @@ IonBuilder::createThisScripted(MDefinition* callee)
     //       and thus invalidation.
     MInstruction* getProto;
     if (!invalidatedIdempotentCache()) {
-        MGetPropertyCache* getPropCache = MGetPropertyCache::New(alloc(), callee, names().prototype,
+        MGetPropertyCache* getPropCache = MGetPropertyCache::New(alloc(), newTarget, names().prototype,
                                                                  /* monitored = */ false);
         getPropCache->setIdempotent();
         getProto = getPropCache;
     } else {
-        MCallGetProperty* callGetProp = MCallGetProperty::New(alloc(), callee, names().prototype,
+        MCallGetProperty* callGetProp = MCallGetProperty::New(alloc(), newTarget, names().prototype,
                                                               /* callprop = */ false);
         callGetProp->setIdempotent();
         getProto = callGetProp;
@@ -6066,7 +6076,7 @@ IonBuilder::createThisScripted(MDefinition* callee)
     current->add(getProto);
 
     // Create this from prototype
-    MCreateThisWithProto* createThis = MCreateThisWithProto::New(alloc(), callee, getProto);
+    MCreateThisWithProto* createThis = MCreateThisWithProto::New(alloc(), callee, newTarget, getProto);
     current->add(createThis);
 
     return createThis;
@@ -6131,6 +6141,8 @@ IonBuilder::createThisScriptedBaseline(MDefinition* callee)
         return nullptr;
 
     JSObject* templateObject = inspector->getTemplateObject(pc);
+    if (!templateObject)
+        return nullptr;
     if (!templateObject->is<PlainObject>() && !templateObject->is<UnboxedPlainObject>())
         return nullptr;
 
@@ -6181,14 +6193,14 @@ IonBuilder::createThisScriptedBaseline(MDefinition* callee)
 }
 
 MDefinition*
-IonBuilder::createThis(JSFunction* target, MDefinition* callee)
+IonBuilder::createThis(JSFunction* target, MDefinition* callee, MDefinition* newTarget)
 {
     // Create |this| for unknown target.
     if (!target) {
         if (MDefinition* createThis = createThisScriptedBaseline(callee))
             return createThis;
 
-        MCreateThis* createThis = MCreateThis::New(alloc(), callee);
+        MCreateThis* createThis = MCreateThis::New(alloc(), callee, newTarget);
         current->add(createThis);
         return createThis;
     }
@@ -6203,6 +6215,11 @@ IonBuilder::createThis(JSFunction* target, MDefinition* callee)
         return magic;
     }
 
+    if (target->isDerivedClassConstructor()) {
+        MOZ_ASSERT(target->isClassConstructor());
+        return constant(MagicValue(JS_UNINITIALIZED_LEXICAL));
+    }
+
     // Try baking in the prototype.
     if (MDefinition* createThis = createThisScriptedSingleton(target, callee))
         return createThis;
@@ -6210,7 +6227,7 @@ IonBuilder::createThis(JSFunction* target, MDefinition* callee)
     if (MDefinition* createThis = createThisScriptedBaseline(callee))
         return createThis;
 
-    return createThisScripted(callee);
+    return createThisScripted(callee, newTarget);
 }
 
 bool
@@ -6600,7 +6617,7 @@ IonBuilder::makeCallHelper(JSFunction* target, CallInfo& callInfo)
 
     // Inline the constructor on the caller-side.
     if (callInfo.constructing()) {
-        MDefinition* create = createThis(target, callInfo.fun());
+        MDefinition* create = createThis(target, callInfo.fun(), callInfo.getNewTarget());
         if (!create) {
             abort("Failure inlining constructor for call.");
             return nullptr;
@@ -12749,10 +12766,22 @@ IonBuilder::jsop_this()
 
     if (script()->strict() || info().funMaybeLazy()->isSelfHostedBuiltin()) {
         // No need to wrap primitive |this| in strict mode or self-hosted code.
-        current->pushSlot(info().thisSlot());
+        MDefinition* thisVal = current->getSlot(info().thisSlot());
+        if (script()->isDerivedClassConstructor()) {
+            MOZ_ASSERT(info().funMaybeLazy()->isClassConstructor());
+            MOZ_ASSERT(script()->strict());
+
+            MLexicalCheck* checkThis = MLexicalCheck::New(alloc(), thisVal, Bailout_UninitializedThis);
+            current->add(checkThis);
+            thisVal = checkThis;
+        }
+
+        current->push(thisVal);
         return true;
     }
 
+    MOZ_ASSERT(!info().funMaybeLazy()->isClassConstructor());
+
     if (thisTypes && (thisTypes->getKnownMIRType() == MIRType_Object ||
         (thisTypes->empty() && baselineFrame_ && baselineFrame_->thisType.isSomeObject())))
     {
diff --git a/js/src/jit/IonBuilder.h b/js/src/jit/IonBuilder.h
index 4cc6544ef878..954aa90d542b 100644
--- a/js/src/jit/IonBuilder.h
+++ b/js/src/jit/IonBuilder.h
@@ -380,10 +380,10 @@ class IonBuilder
 
     JSObject* getSingletonPrototype(JSFunction* target);
 
-    MDefinition* createThisScripted(MDefinition* callee);
+    MDefinition* createThisScripted(MDefinition* callee, MDefinition* newTarget);
     MDefinition* createThisScriptedSingleton(JSFunction* target, MDefinition* callee);
     MDefinition* createThisScriptedBaseline(MDefinition* callee);
-    MDefinition* createThis(JSFunction* target, MDefinition* callee);
+    MDefinition* createThis(JSFunction* target, MDefinition* callee, MDefinition* newTarget);
     MInstruction* createDeclEnvObject(MDefinition* callee, MDefinition* scopeObj);
     MInstruction* createCallObject(MDefinition* callee, MDefinition* scopeObj);
 
diff --git a/js/src/jit/IonTypes.h b/js/src/jit/IonTypes.h
index 4a4a463acd6f..099e3a1970fb 100644
--- a/js/src/jit/IonTypes.h
+++ b/js/src/jit/IonTypes.h
@@ -111,8 +111,13 @@ enum BailoutKind
     // We hit a |debugger;| statement.
     Bailout_Debugger,
 
-    // END Normal bailouts
+    // |this| used uninitialized in a derived constructor
+    Bailout_UninitializedThis,
 
+    // Derived constructors must return object or undefined
+    Bailout_BadDerivedConstructorReturn,
+
+    // END Normal bailouts
 
     // Bailouts caused by invalid assumptions based on Baseline code.
     // Causes immediate invalidation.
@@ -151,7 +156,7 @@ enum BailoutKind
     Bailout_UninitializedLexical,
 
     // A bailout to baseline from Ion on exception to handle Debugger hooks.
-    Bailout_IonExceptionDebugMode,
+    Bailout_IonExceptionDebugMode
 };
 
 inline const char*
@@ -209,6 +214,10 @@ BailoutKindString(BailoutKind kind)
         return "Bailout_InitialState";
       case Bailout_Debugger:
         return "Bailout_Debugger";
+      case Bailout_UninitializedThis:
+        return "Bailout_UninitializedThis";
+      case Bailout_BadDerivedConstructorReturn:
+        return "Bailout_BadDerivedConstructorReturn";
 
       // Bailouts caused by invalid assumptions.
       case Bailout_OverflowInvalidate:
diff --git a/js/src/jit/Lowering.cpp b/js/src/jit/Lowering.cpp
index 0397572b5dfc..7a7629301643 100644
--- a/js/src/jit/Lowering.cpp
+++ b/js/src/jit/Lowering.cpp
@@ -328,6 +328,7 @@ LIRGenerator::visitCreateThisWithProto(MCreateThisWithProto* ins)
 {
     LCreateThisWithProto* lir =
         new(alloc()) LCreateThisWithProto(useRegisterOrConstantAtStart(ins->getCallee()),
+                                          useRegisterOrConstantAtStart(ins->getNewTarget()),
                                           useRegisterOrConstantAtStart(ins->getPrototype()));
     defineReturn(lir, ins);
     assignSafepoint(lir, ins);
@@ -336,7 +337,8 @@ LIRGenerator::visitCreateThisWithProto(MCreateThisWithProto* ins)
 void
 LIRGenerator::visitCreateThis(MCreateThis* ins)
 {
-    LCreateThis* lir = new(alloc()) LCreateThis(useRegisterOrConstantAtStart(ins->getCallee()));
+    LCreateThis* lir = new(alloc()) LCreateThis(useRegisterOrConstantAtStart(ins->getCallee()),
+                                                useRegisterOrConstantAtStart(ins->getNewTarget()));
     defineReturn(lir, ins);
     assignSafepoint(lir, ins);
 }
@@ -4258,7 +4260,7 @@ LIRGenerator::visitLexicalCheck(MLexicalCheck* ins)
     MOZ_ASSERT(input->type() == MIRType_Value);
     LLexicalCheck* lir = new(alloc()) LLexicalCheck();
     useBox(lir, LLexicalCheck::Input, input);
-    assignSnapshot(lir, Bailout_UninitializedLexical);
+    assignSnapshot(lir, ins->bailoutKind());
     add(lir, ins);
     redefine(ins, input);
 }
@@ -4293,6 +4295,22 @@ LIRGenerator::visitAtomicIsLockFree(MAtomicIsLockFree* ins)
     define(new(alloc()) LAtomicIsLockFree(useRegister(ins->input())), ins);
 }
 
+void
+LIRGenerator::visitCheckReturn(MCheckReturn* ins)
+{
+    MDefinition* retVal = ins->returnValue();
+    MDefinition* thisVal = ins->thisValue();
+    MOZ_ASSERT(retVal->type() == MIRType_Value);
+    MOZ_ASSERT(thisVal->type() == MIRType_Value);
+
+    LCheckReturn* lir = new(alloc()) LCheckReturn();
+    useBoxAtStart(lir, LCheckReturn::ReturnValue, retVal);
+    useBoxAtStart(lir, LCheckReturn::ThisValue, thisVal);
+    assignSnapshot(lir, Bailout_BadDerivedConstructorReturn);
+    add(lir, ins);
+    redefine(ins, retVal);
+}
+
 static void
 SpewResumePoint(MBasicBlock* block, MInstruction* ins, MResumePoint* resumePoint)
 {
diff --git a/js/src/jit/Lowering.h b/js/src/jit/Lowering.h
index addf1536b98c..aaed7195d718 100644
--- a/js/src/jit/Lowering.h
+++ b/js/src/jit/Lowering.h
@@ -306,6 +306,7 @@ class LIRGenerator : public LIRGeneratorSpecific
     void visitNewTarget(MNewTarget* ins);
     void visitArrowNewTarget(MArrowNewTarget* ins);
     void visitAtomicIsLockFree(MAtomicIsLockFree* ins);
+    void visitCheckReturn(MCheckReturn* ins);
 };
 
 } // namespace jit
diff --git a/js/src/jit/MIR.h b/js/src/jit/MIR.h
index eba00f6211b1..07af8224ade5 100644
--- a/js/src/jit/MIR.h
+++ b/js/src/jit/MIR.h
@@ -4613,11 +4613,11 @@ class MCreateThisWithTemplate
 // Caller-side allocation of |this| for |new|:
 // Given a prototype operand, construct |this| for JSOP_NEW.
 class MCreateThisWithProto
-  : public MBinaryInstruction,
-    public MixPolicy<ObjectPolicy<0>, ObjectPolicy<1> >::Data
+  : public MTernaryInstruction,
+    public Mix3Policy<ObjectPolicy<0>, ObjectPolicy<1>, ObjectPolicy<2> >::Data
 {
-    MCreateThisWithProto(MDefinition* callee, MDefinition* prototype)
-      : MBinaryInstruction(callee, prototype)
+    MCreateThisWithProto(MDefinition* callee, MDefinition* newTarget, MDefinition* prototype)
+      : MTernaryInstruction(callee, newTarget, prototype)
     {
         setResultType(MIRType_Object);
     }
@@ -4625,17 +4625,20 @@ class MCreateThisWithProto
   public:
     INSTRUCTION_HEADER(CreateThisWithProto)
     static MCreateThisWithProto* New(TempAllocator& alloc, MDefinition* callee,
-                                     MDefinition* prototype)
+                                     MDefinition* newTarget, MDefinition* prototype)
     {
-        return new(alloc) MCreateThisWithProto(callee, prototype);
+        return new(alloc) MCreateThisWithProto(callee, newTarget, prototype);
     }
 
     MDefinition* getCallee() const {
         return getOperand(0);
     }
-    MDefinition* getPrototype() const {
+    MDefinition* getNewTarget() const {
         return getOperand(1);
     }
+    MDefinition* getPrototype() const {
+        return getOperand(2);
+    }
 
     // Although creation of |this| modifies global state, it is safely repeatable.
     AliasSet getAliasSet() const override {
@@ -4649,25 +4652,28 @@ class MCreateThisWithProto
 // Caller-side allocation of |this| for |new|:
 // Constructs |this| when possible, else MagicValue(JS_IS_CONSTRUCTING).
 class MCreateThis
-  : public MUnaryInstruction,
-    public ObjectPolicy<0>::Data
+  : public MBinaryInstruction,
+    public MixPolicy<ObjectPolicy<0>, ObjectPolicy<1> >::Data
 {
-    explicit MCreateThis(MDefinition* callee)
-      : MUnaryInstruction(callee)
+    explicit MCreateThis(MDefinition* callee, MDefinition* newTarget)
+      : MBinaryInstruction(callee, newTarget)
     {
         setResultType(MIRType_Value);
     }
 
   public:
     INSTRUCTION_HEADER(CreateThis)
-    static MCreateThis* New(TempAllocator& alloc, MDefinition* callee)
+    static MCreateThis* New(TempAllocator& alloc, MDefinition* callee, MDefinition* newTarget)
     {
-        return new(alloc) MCreateThis(callee);
+        return new(alloc) MCreateThis(callee, newTarget);
     }
 
     MDefinition* getCallee() const {
         return getOperand(0);
     }
+    MDefinition* getNewTarget() const {
+        return getOperand(0);
+    }
 
     // Although creation of |this| modifies global state, it is safely repeatable.
     AliasSet getAliasSet() const override {
@@ -7230,8 +7236,10 @@ class MLexicalCheck
   : public MUnaryInstruction,
     public BoxPolicy<0>::Data
 {
-    explicit MLexicalCheck(MDefinition* input)
-      : MUnaryInstruction(input)
+    BailoutKind kind_;
+    explicit MLexicalCheck(MDefinition* input, BailoutKind kind)
+      : MUnaryInstruction(input),
+        kind_(kind)
     {
         setResultType(MIRType_Value);
         setResultTypeSet(input->resultTypeSet());
@@ -7242,8 +7250,9 @@ class MLexicalCheck
   public:
     INSTRUCTION_HEADER(LexicalCheck)
 
-    static MLexicalCheck* New(TempAllocator& alloc, MDefinition* input) {
-        return new(alloc) MLexicalCheck(input);
+    static MLexicalCheck* New(TempAllocator& alloc, MDefinition* input,
+                              BailoutKind kind = Bailout_UninitializedLexical) {
+        return new(alloc) MLexicalCheck(input, kind);
     }
 
     AliasSet getAliasSet() const override {
@@ -7254,6 +7263,10 @@ class MLexicalCheck
         return getOperand(0);
     }
 
+    BailoutKind bailoutKind() const {
+        return kind_;
+    }
+
     bool congruentTo(const MDefinition* ins) const override {
         return congruentIfOperandsEqual(ins);
     }
@@ -12936,6 +12949,33 @@ class MHasClass
     }
 };
 
+class MCheckReturn
+  : public MBinaryInstruction,
+    public BoxInputsPolicy::Data
+{
+    explicit MCheckReturn(MDefinition* retVal, MDefinition* thisVal)
+      : MBinaryInstruction(retVal, thisVal)
+    {
+        setGuard();
+        setResultType(MIRType_Value);
+        setResultTypeSet(retVal->resultTypeSet());
+    }
+
+  public:
+    INSTRUCTION_HEADER(CheckReturn)
+
+    static MCheckReturn* New(TempAllocator& alloc, MDefinition* retVal, MDefinition* thisVal) {
+        return new (alloc) MCheckReturn(retVal, thisVal);
+    }
+
+    MDefinition* returnValue() const {
+        return getOperand(0);
+    }
+    MDefinition* thisValue() const {
+        return getOperand(1);
+    }
+};
+
 // Increase the warm-up counter of the provided script upon execution and test if
 // the warm-up counter surpasses the threshold. Upon hit it will recompile the
 // outermost script (i.e. not the inlined script).
diff --git a/js/src/jit/MOpcodes.h b/js/src/jit/MOpcodes.h
index 6eaef4158c71..8c4b8514cd03 100644
--- a/js/src/jit/MOpcodes.h
+++ b/js/src/jit/MOpcodes.h
@@ -277,7 +277,8 @@ namespace jit {
     _(GlobalNameConflictsCheck)                                             \
     _(Debugger)                                                             \
     _(NewTarget)                                                            \
-    _(ArrowNewTarget)
+    _(ArrowNewTarget)                                                       \
+    _(CheckReturn)
 
 // Forward declarations of MIR types.
 #define FORWARD_DECLARE(op) class M##op;
diff --git a/js/src/jit/TypePolicy.cpp b/js/src/jit/TypePolicy.cpp
index bdcf34fa9c6f..07d9491f2dcd 100644
--- a/js/src/jit/TypePolicy.cpp
+++ b/js/src/jit/TypePolicy.cpp
@@ -1196,6 +1196,7 @@ FilterTypeSetPolicy::adjustInputs(TempAllocator& alloc, MInstruction* ins)
     _(Mix3Policy<ObjectPolicy<0>, IntPolicy<1>, IntPolicy<2> >)         \
     _(Mix3Policy<ObjectPolicy<0>, IntPolicy<1>, TruncateToInt32Policy<2> >) \
     _(Mix3Policy<ObjectPolicy<0>, ObjectPolicy<1>, IntPolicy<2> >)      \
+    _(Mix3Policy<ObjectPolicy<0>, ObjectPolicy<1>, ObjectPolicy<2> >)   \
     _(Mix3Policy<StringPolicy<0>, IntPolicy<1>, IntPolicy<2>>)          \
     _(Mix3Policy<StringPolicy<0>, ObjectPolicy<1>, StringPolicy<2> >)   \
     _(Mix3Policy<StringPolicy<0>, StringPolicy<1>, StringPolicy<2> >)   \
diff --git a/js/src/jit/VMFunctions.cpp b/js/src/jit/VMFunctions.cpp
index dcee11930759..8ce657e4fb00 100644
--- a/js/src/jit/VMFunctions.cpp
+++ b/js/src/jit/VMFunctions.cpp
@@ -565,7 +565,7 @@ GetIntrinsicValue(JSContext* cx, HandlePropertyName name, MutableHandleValue rva
 }
 
 bool
-CreateThis(JSContext* cx, HandleObject callee, MutableHandleValue rval)
+CreateThis(JSContext* cx, HandleObject callee, HandleObject newTarget, MutableHandleValue rval)
 {
     rval.set(MagicValue(JS_IS_CONSTRUCTING));
 
@@ -575,10 +575,14 @@ CreateThis(JSContext* cx, HandleObject callee, MutableHandleValue rval)
             JSScript* script = fun->getOrCreateScript(cx);
             if (!script || !script->ensureHasTypes(cx))
                 return false;
-            JSObject* thisObj = CreateThisForFunction(cx, callee, GenericObject);
-            if (!thisObj)
-                return false;
-            rval.set(ObjectValue(*thisObj));
+            if (script->isDerivedClassConstructor()) {
+                rval.set(MagicValue(JS_UNINITIALIZED_LEXICAL));
+            } else {
+                JSObject* thisObj = CreateThisForFunction(cx, callee, newTarget, GenericObject);
+                if (!thisObj)
+                    return false;
+                rval.set(ObjectValue(*thisObj));
+            }
         }
     }
 
@@ -1291,5 +1295,18 @@ ThrowUninitializedLexical(JSContext* cx)
     return false;
 }
 
+bool
+ThrowBadDerivedReturn(JSContext* cx, HandleValue v)
+{
+    ReportValueError(cx, JSMSG_BAD_DERIVED_RETURN, JSDVG_IGNORE_STACK, v, nullptr);
+    return false;
+}
+
+bool
+BaselineThrowUninitializedThis(JSContext* cx, BaselineFrame* frame)
+{
+    return ThrowUninitializedThis(cx, frame);
+}
+
 } // namespace jit
 } // namespace js
diff --git a/js/src/jit/VMFunctions.h b/js/src/jit/VMFunctions.h
index 944ded9d1588..0e344ac15c3d 100644
--- a/js/src/jit/VMFunctions.h
+++ b/js/src/jit/VMFunctions.h
@@ -634,7 +634,7 @@ bool OperatorInI(JSContext* cx, uint32_t index, HandleObject obj, bool* out);
 
 bool GetIntrinsicValue(JSContext* cx, HandlePropertyName name, MutableHandleValue rval);
 
-bool CreateThis(JSContext* cx, HandleObject callee, MutableHandleValue rval);
+bool CreateThis(JSContext* cx, HandleObject callee, HandleObject newTarget, MutableHandleValue rval);
 
 void GetDynamicName(JSContext* cx, JSObject* scopeChain, JSString* str, Value* vp);
 
@@ -734,6 +734,8 @@ IonMarkFunction(MIRType type)
 bool ObjectIsCallable(JSObject* obj);
 
 bool ThrowUninitializedLexical(JSContext* cx);
+bool BaselineThrowUninitializedThis(JSContext* cx, BaselineFrame* frame);
+bool ThrowBadDerivedReturn(JSContext* cx, HandleValue v);
 
 } // namespace jit
 } // namespace js
diff --git a/js/src/jit/arm64/BaselineIC-arm64.cpp b/js/src/jit/arm64/BaselineIC-arm64.cpp
index 2bd65c16cc65..54ac47d5bbdf 100644
--- a/js/src/jit/arm64/BaselineIC-arm64.cpp
+++ b/js/src/jit/arm64/BaselineIC-arm64.cpp
@@ -13,6 +13,7 @@
 #include "jit/arm64/vixl/Debugger-vixl.h"
 #endif
 
+#include "jit/MacroAssembler-inl.h"
 
 using namespace js;
 using namespace js::jit;
diff --git a/js/src/jit/arm64/MoveEmitter-arm64.cpp b/js/src/jit/arm64/MoveEmitter-arm64.cpp
index 2eaffc14689e..f8e237683121 100644
--- a/js/src/jit/arm64/MoveEmitter-arm64.cpp
+++ b/js/src/jit/arm64/MoveEmitter-arm64.cpp
@@ -5,10 +5,21 @@
  * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
 
 #include "jit/arm64/MoveEmitter-arm64.h"
+#include "jit/MacroAssembler-inl.h"
 
 using namespace js;
 using namespace js::jit;
 
+MemOperand
+MoveEmitterARM64::toMemOperand(const MoveOperand& operand) const
+{
+    MOZ_ASSERT(operand.isMemory());
+    ARMRegister base(operand.base(), 64);
+    if (operand.base() == masm.getStackPointer())
+        return MemOperand(base, operand.disp() + (masm.framePushed() - pushedAtStart_));
+    return MemOperand(base, operand.disp());
+}
+
 void
 MoveEmitterARM64::emit(const MoveResolver& moves)
 {
diff --git a/js/src/jit/arm64/MoveEmitter-arm64.h b/js/src/jit/arm64/MoveEmitter-arm64.h
index cd8dcf2495a5..09f96315fdc8 100644
--- a/js/src/jit/arm64/MoveEmitter-arm64.h
+++ b/js/src/jit/arm64/MoveEmitter-arm64.h
@@ -35,13 +35,7 @@ class MoveEmitterARM64
     }
 
     MemOperand cycleSlot();
-    MemOperand toMemOperand(const MoveOperand& operand) const {
-        MOZ_ASSERT(operand.isMemory());
-        ARMRegister base(operand.base(), 64);
-        if (operand.base() == masm.getStackPointer())
-            return MemOperand(base, operand.disp() + (masm.framePushed() -  pushedAtStart_));
-        return MemOperand(base, operand.disp());
-    }
+    MemOperand toMemOperand(const MoveOperand& operand) const;
     ARMRegister toARMReg32(const MoveOperand& operand) const {
         MOZ_ASSERT(operand.isGeneralReg());
         return ARMRegister(operand.reg(), 32);
diff --git a/js/src/jit/arm64/vixl/Instructions-vixl.cpp b/js/src/jit/arm64/vixl/Instructions-vixl.cpp
index c49ae1311ae6..234d8260f849 100644
--- a/js/src/jit/arm64/vixl/Instructions-vixl.cpp
+++ b/js/src/jit/arm64/vixl/Instructions-vixl.cpp
@@ -256,7 +256,7 @@ const Instruction* Instruction::ImmPCOffsetTarget() const {
 }
 
 
-inline int Instruction::ImmBranch() const {
+int Instruction::ImmBranch() const {
   switch (BranchType()) {
     case CondBranchType: return ImmCondBranch();
     case UncondBranchType: return ImmUncondBranch();
diff --git a/js/src/jit/shared/LIR-shared.h b/js/src/jit/shared/LIR-shared.h
index 178bc8d24306..fafb2e0624f0 100644
--- a/js/src/jit/shared/LIR-shared.h
+++ b/js/src/jit/shared/LIR-shared.h
@@ -1300,19 +1300,23 @@ class LToIdV : public LInstructionHelper<BOX_PIECES, 2 * BOX_PIECES, 1>
 
 // Allocate an object for |new| on the caller-side,
 // when there is no templateObject or prototype known
-class LCreateThis : public LCallInstructionHelper<BOX_PIECES, 1, 0>
+class LCreateThis : public LCallInstructionHelper<BOX_PIECES, 2, 0>
 {
   public:
     LIR_HEADER(CreateThis)
 
-    explicit LCreateThis(const LAllocation& callee)
+    LCreateThis(const LAllocation& callee, const LAllocation& newTarget)
     {
         setOperand(0, callee);
+        setOperand(1, newTarget);
     }
 
     const LAllocation* getCallee() {
         return getOperand(0);
     }
+    const LAllocation* getNewTarget() {
+        return getOperand(1);
+    }
 
     MCreateThis* mir() const {
         return mir_->toCreateThis();
@@ -1321,23 +1325,28 @@ class LCreateThis : public LCallInstructionHelper<BOX_PIECES, 1, 0>
 
 // Allocate an object for |new| on the caller-side,
 // when the prototype is known.
-class LCreateThisWithProto : public LCallInstructionHelper<1, 2, 0>
+class LCreateThisWithProto : public LCallInstructionHelper<1, 3, 0>
 {
   public:
     LIR_HEADER(CreateThisWithProto)
 
-    LCreateThisWithProto(const LAllocation& callee, const LAllocation& prototype)
+    LCreateThisWithProto(const LAllocation& callee, const LAllocation& newTarget,
+                         const LAllocation& prototype)
     {
         setOperand(0, callee);
-        setOperand(1, prototype);
+        setOperand(1, newTarget);
+        setOperand(2, prototype);
     }
 
     const LAllocation* getCallee() {
         return getOperand(0);
     }
-    const LAllocation* getPrototype() {
+    const LAllocation* getNewTarget() {
         return getOperand(1);
     }
+    const LAllocation* getPrototype() {
+        return getOperand(2);
+    }
 
     MCreateThis* mir() const {
         return mir_->toCreateThis();
@@ -7247,6 +7256,15 @@ class LRandom : public LInstructionHelper<1, 0, LRANDOM_NUM_TEMPS>
     }
 };
 
+class LCheckReturn : public LCallInstructionHelper<BOX_PIECES, 2 * BOX_PIECES, 0>
+{
+  public:
+    static const size_t ReturnValue = 0;
+    static const size_t ThisValue = BOX_PIECES;
+
+    LIR_HEADER(CheckReturn)
+};
+
 } // namespace jit
 } // namespace js
 
diff --git a/js/src/jit/shared/LOpcodes-shared.h b/js/src/jit/shared/LOpcodes-shared.h
index 6393fa00f312..aaede6dbcda6 100644
--- a/js/src/jit/shared/LOpcodes-shared.h
+++ b/js/src/jit/shared/LOpcodes-shared.h
@@ -368,6 +368,7 @@
     _(GlobalNameConflictsCheck)     \
     _(Debugger)                     \
     _(NewTarget)                    \
-    _(ArrowNewTarget)
+    _(ArrowNewTarget)               \
+    _(CheckReturn)
 
 #endif /* jit_shared_LOpcodes_shared_h */
diff --git a/js/src/js.msg b/js/src/js.msg
index b7f41bd6a8fd..98739bc4bb30 100644
--- a/js/src/js.msg
+++ b/js/src/js.msg
@@ -106,6 +106,8 @@ MSG_DEF(JSMSG_TERMINATED,              1, JSEXN_ERR, "Script terminated by timeo
 MSG_DEF(JSMSG_PROTO_NOT_OBJORNULL,     1, JSEXN_TYPEERR, "{0}.prototype is not an object or null")
 MSG_DEF(JSMSG_CANT_CALL_CLASS_CONSTRUCTOR, 0, JSEXN_TYPEERR, "class constructors must be invoked with |new|")
 MSG_DEF(JSMSG_DISABLED_DERIVED_CLASS,  1, JSEXN_INTERNALERR, "{0} temporarily disallowed in derived class constructors")
+MSG_DEF(JSMSG_UNINITIALIZED_THIS,      1, JSEXN_REFERENCEERR, "|this| used uninitialized in {0} class constructor")
+MSG_DEF(JSMSG_BAD_DERIVED_RETURN,      1, JSEXN_TYPEERR, "derived class constructor returned invalid value {0}")
 
 // JSON
 MSG_DEF(JSMSG_JSON_BAD_PARSE,          3, JSEXN_SYNTAXERR, "JSON.parse: {0} at line {1} column {2} of the JSON data")
@@ -212,6 +214,7 @@ MSG_DEF(JSMSG_BAD_STRICT_ASSIGN,       1, JSEXN_SYNTAXERR, "can't assign to {0}
 MSG_DEF(JSMSG_BAD_SWITCH,              0, JSEXN_SYNTAXERR, "invalid switch statement")
 MSG_DEF(JSMSG_BAD_SUPER,               0, JSEXN_SYNTAXERR, "invalid use of keyword 'super'")
 MSG_DEF(JSMSG_BAD_SUPERPROP,           1, JSEXN_SYNTAXERR, "use of super {0} accesses only valid within methods or eval code within methods")
+MSG_DEF(JSMSG_BAD_SUPERCALL,           0, JSEXN_SYNTAXERR, "super() is only valid in derived class constructors")
 MSG_DEF(JSMSG_BRACKET_AFTER_ARRAY_COMPREHENSION, 0, JSEXN_SYNTAXERR, "missing ] after array comprehension")
 MSG_DEF(JSMSG_BRACKET_AFTER_LIST,      0, JSEXN_SYNTAXERR, "missing ] after element list")
 MSG_DEF(JSMSG_BRACKET_IN_INDEX,        0, JSEXN_SYNTAXERR, "missing ] in index expression")
@@ -507,6 +510,7 @@ MSG_DEF(JSMSG_NO_INDEXED_SETTER,         2, JSEXN_TYPEERR, "{0} doesn't have an
 
 // Super
 MSG_DEF(JSMSG_CANT_DELETE_SUPER, 0, JSEXN_REFERENCEERR, "invalid delete involving 'super'")
+MSG_DEF(JSMSG_REINIT_THIS,       0, JSEXN_REFERENCEERR, "super() called twice in derived class constructor")
 
 // Modules
 MSG_DEF(JSMSG_BAD_DEFAULT_EXPORT,        0, JSEXN_SYNTAXERR, "default export cannot be provided by export *")
diff --git a/js/src/jsapi.cpp b/js/src/jsapi.cpp
index 0e7968271744..4cf9f6f19922 100644
--- a/js/src/jsapi.cpp
+++ b/js/src/jsapi.cpp
@@ -6390,6 +6390,12 @@ JS_DecodeInterpretedFunction(JSContext* cx, const void* data, uint32_t length)
     return funobj;
 }
 
+JS_PUBLIC_API(bool)
+JS_SetImmutablePrototype(JSContext *cx, JS::HandleObject obj, bool *succeeded)
+{
+    return SetImmutablePrototype(cx, obj, succeeded);
+}
+
 JS_PUBLIC_API(void)
 JS::SetAsmJSCacheOps(JSRuntime* rt, const JS::AsmJSCacheOps* ops)
 {
diff --git a/js/src/jsapi.h b/js/src/jsapi.h
index 9e19ca7365e2..aefdf518bdab 100644
--- a/js/src/jsapi.h
+++ b/js/src/jsapi.h
@@ -2462,6 +2462,16 @@ JS_FreezeObject(JSContext* cx, JS::Handle<JSObject*> obj);
 extern JS_PUBLIC_API(bool)
 JS_PreventExtensions(JSContext* cx, JS::HandleObject obj, JS::ObjectOpResult& result);
 
+/*
+ * Attempt to make the [[Prototype]] of |obj| immutable, such that any attempt
+ * to modify it will fail.  If an error occurs during the attempt, return false
+ * (with a pending exception set, depending upon the nature of the error).  If
+ * no error occurs, return true with |*succeeded| set to indicate whether the
+ * attempt successfully made the [[Prototype]] immutable.
+ */
+extern JS_PUBLIC_API(bool)
+JS_SetImmutablePrototype(JSContext* cx, JS::HandleObject obj, bool* succeeded);
+
 extern JS_PUBLIC_API(JSObject*)
 JS_New(JSContext* cx, JS::HandleObject ctor, const JS::HandleValueArray& args);
 
diff --git a/js/src/jscompartment.h b/js/src/jscompartment.h
index 11b89b48e041..65df03cb2d29 100644
--- a/js/src/jscompartment.h
+++ b/js/src/jscompartment.h
@@ -374,6 +374,12 @@ struct JSCompartment
     js::NewObjectMetadataState objectMetadataState;
 
   public:
+    // Recompute the probability with which this compartment should record
+    // profiling data (stack traces, allocations log, etc.) about each
+    // allocation. We consult the probabilities requested by the Debugger
+    // instances observing us, if any.
+    void chooseAllocationSamplingProbability() { savedStacks_.chooseSamplingProbability(this); }
+
     bool hasObjectPendingMetadata() const { return objectMetadataState.is<js::PendingMetadata>(); }
 
     void setObjectPendingMetadata(JSContext* cx, JSObject* obj) {
diff --git a/js/src/jsfun.h b/js/src/jsfun.h
index cde4e2ee88c9..6433fda0454e 100644
--- a/js/src/jsfun.h
+++ b/js/src/jsfun.h
@@ -156,6 +156,7 @@ class JSFunction : public js::NativeObject
                nonLazyScript()->funHasExtensibleScope() ||
                nonLazyScript()->funNeedsDeclEnvObject() ||
                nonLazyScript()->needsHomeObject()       ||
+               nonLazyScript()->isDerivedClassConstructor() ||
                isGenerator();
     }
 
@@ -516,6 +517,16 @@ class JSFunction : public js::NativeObject
         u.n.jitinfo = data;
     }
 
+    bool isDerivedClassConstructor() {
+        bool derived;
+        if (isInterpretedLazy())
+            derived = lazyScript()->isDerivedClassConstructor();
+        else
+            derived = nonLazyScript()->isDerivedClassConstructor();
+        MOZ_ASSERT_IF(derived, isClassConstructor());
+        return derived;
+    }
+
     static unsigned offsetOfNativeOrScript() {
         static_assert(offsetof(U, n.native) == offsetof(U, i.s.script_),
                       "native and script pointers must be in the same spot "
diff --git a/js/src/jsmath.cpp b/js/src/jsmath.cpp
index e4d247ba6ea4..cb3e4485a8b5 100644
--- a/js/src/jsmath.cpp
+++ b/js/src/jsmath.cpp
@@ -734,15 +734,11 @@ js::math_pow(JSContext* cx, unsigned argc, Value* vp)
     return math_pow_handle(cx, args.get(0), args.get(1), args.rval());
 }
 
-static uint64_t
-random_generateSeed()
+void
+js::random_generateSeed(uint64_t* seedBuffer, size_t length)
 {
-    union {
-        uint8_t     u8[8];
-        uint32_t    u32[2];
-        uint64_t    u64;
-    } seed;
-    seed.u64 = 0;
+    if (length == 0)
+        return;
 
 #if defined(XP_WIN)
     /*
@@ -760,6 +756,12 @@ random_generateSeed()
     if (oldWay && !newWay)
         MOZ_CRASH();
 
+    union {
+        uint32_t    u32[2];
+        uint64_t    u64;
+    } seed;
+    seed.u64 = 0;
+
     errno_t error = rand_s(&seed.u32[0]);
 
     if (oldWay)
@@ -771,24 +773,44 @@ random_generateSeed()
 
     error = rand_s(&seed.u32[1]);
     MOZ_ASSERT(error == 0, "rand_s() error?!");
+
+    seedBuffer[0] = seed.u64 ^= PRMJ_Now();
+    for (size_t i = 1; i < length; i++) {
+        error = rand_s(&seed.u32[0]);
+        MOZ_ASSERT(error == 0, "rand_s() error?!");
+
+        error = rand_s(&seed.u32[1]);
+        MOZ_ASSERT(error == 0, "rand_s() error?!");
+
+        seedBuffer[i] = seed.u64 ^ PRMJ_Now();
+    }
+
 #elif defined(HAVE_ARC4RANDOM)
-    seed.u32[0] = arc4random();
-    seed.u32[1] = arc4random();
+    union {
+        uint32_t    u32[2];
+        uint64_t    u64;
+    } seed;
+    seed.u64 = 0;
+
+    for (size_t i = 0; i < length; i++) {
+        seed.u32[0] = arc4random();
+        seed.u32[1] = arc4random();
+        seedBuffer[i] = seed.u64 ^ PRMJ_Now();
+    }
+
 #elif defined(XP_UNIX)
     int fd = open("/dev/urandom", O_RDONLY);
     MOZ_ASSERT(fd >= 0, "Can't open /dev/urandom?!");
     if (fd >= 0) {
-        ssize_t nread = read(fd, seed.u8, mozilla::ArrayLength(seed.u8));
-        MOZ_ASSERT(nread == 8, "Can't read /dev/urandom?!");
+        ssize_t size = length * sizeof(seedBuffer[0]);
+        ssize_t nread = read(fd, (char *) seedBuffer, size);
+        MOZ_ASSERT(nread == size, "Can't read /dev/urandom?!");
         mozilla::unused << nread;
         close(fd);
     }
 #else
 # error "Platform needs to implement random_generateSeed()"
 #endif
-
-    seed.u64 ^= PRMJ_Now();
-    return seed.u64;
 }
 
 /*
@@ -798,7 +820,8 @@ void
 js::random_initState(uint64_t* rngState)
 {
     /* Our PRNG only uses 48 bits, so squeeze our entropy into those bits. */
-    uint64_t seed = random_generateSeed();
+    uint64_t seed;
+    random_generateSeed(&seed, 1);
     seed ^= (seed >> 16);
     *rngState = (seed ^ RNG_MULTIPLIER) & RNG_MASK;
 }
diff --git a/js/src/jsmath.h b/js/src/jsmath.h
index 6e0fc6bdce84..46b8af4f5e8d 100644
--- a/js/src/jsmath.h
+++ b/js/src/jsmath.h
@@ -109,6 +109,13 @@ class MathCache
 extern JSObject*
 InitMathClass(JSContext* cx, HandleObject obj);
 
+/*
+ * Fill |seed[0]| through |seed[length-1]| with random bits, suitable for
+ * seeding a random number generator.
+ */
+extern void
+random_generateSeed(uint64_t* seed, size_t length);
+
 extern void
 random_initState(uint64_t* rngState);
 
diff --git a/js/src/jsobj.cpp b/js/src/jsobj.cpp
index b21348259719..e758dad9fe64 100644
--- a/js/src/jsobj.cpp
+++ b/js/src/jsobj.cpp
@@ -967,14 +967,14 @@ CreateThisForFunctionWithGroup(JSContext* cx, HandleObjectGroup group,
 }
 
 JSObject*
-js::CreateThisForFunctionWithProto(JSContext* cx, HandleObject callee, HandleObject proto,
-                                   NewObjectKind newKind /* = GenericObject */)
+js::CreateThisForFunctionWithProto(JSContext* cx, HandleObject callee, HandleObject newTarget,
+                                   HandleObject proto, NewObjectKind newKind /* = GenericObject */)
 {
     RootedObject res(cx);
 
     if (proto) {
         RootedObjectGroup group(cx, ObjectGroup::defaultNewGroup(cx, nullptr, TaggedProto(proto),
-                                                                 &callee->as<JSFunction>()));
+                                                                 newTarget));
         if (!group)
             return nullptr;
 
@@ -986,7 +986,7 @@ js::CreateThisForFunctionWithProto(JSContext* cx, HandleObject callee, HandleObj
                 // The script was analyzed successfully and may have changed
                 // the new type table, so refetch the group.
                 group = ObjectGroup::defaultNewGroup(cx, nullptr, TaggedProto(proto),
-                                                     &callee->as<JSFunction>());
+                                                     newTarget);
                 MOZ_ASSERT(group && group->newScript());
             }
         }
@@ -1007,15 +1007,16 @@ js::CreateThisForFunctionWithProto(JSContext* cx, HandleObject callee, HandleObj
 }
 
 JSObject*
-js::CreateThisForFunction(JSContext* cx, HandleObject callee, NewObjectKind newKind)
+js::CreateThisForFunction(JSContext* cx, HandleObject callee, HandleObject newTarget,
+                          NewObjectKind newKind)
 {
     RootedValue protov(cx);
-    if (!GetProperty(cx, callee, callee, cx->names().prototype, &protov))
+    if (!GetProperty(cx, newTarget, newTarget, cx->names().prototype, &protov))
         return nullptr;
     RootedObject proto(cx);
     if (protov.isObject())
         proto = &protov.toObject();
-    JSObject* obj = CreateThisForFunctionWithProto(cx, callee, proto, newKind);
+    JSObject* obj = CreateThisForFunctionWithProto(cx, callee, newTarget, proto, newKind);
 
     if (obj && newKind == SingletonObject) {
         RootedPlainObject nobj(cx, &obj->as<PlainObject>());
@@ -2394,7 +2395,7 @@ JSObject::reportNotExtensible(JSContext* cx, unsigned report)
 // immutable-prototype behavior is enforced; if it's false, behavior is not
 // enforced, and immutable-prototype bits stored on objects are completely
 // ignored.
-static const bool ImmutablePrototypesEnabled = true;
+static const bool ImmutablePrototypesEnabled = false;
 
 JS_FRIEND_API(bool)
 JS_ImmutablePrototypesEnabled()
@@ -3340,6 +3341,7 @@ JSObject::dump()
     if (obj->hasUncacheableProto()) fprintf(stderr, " has_uncacheable_proto");
     if (obj->hadElementsAccess()) fprintf(stderr, " had_elements_access");
     if (obj->wasNewScriptCleared()) fprintf(stderr, " new_script_cleared");
+    if (!obj->hasLazyPrototype() && obj->nonLazyPrototypeIsImmutable()) fprintf(stderr, " immutable_prototype");
 
     if (obj->isNative()) {
         NativeObject* nobj = &obj->as<NativeObject>();
diff --git a/js/src/jsobj.h b/js/src/jsobj.h
index 490c1fb2b152..dd45f857aa7e 100644
--- a/js/src/jsobj.h
+++ b/js/src/jsobj.h
@@ -1162,12 +1162,13 @@ GetInitialHeap(NewObjectKind newKind, const Class* clasp)
 // Specialized call for constructing |this| with a known function callee,
 // and a known prototype.
 extern JSObject*
-CreateThisForFunctionWithProto(JSContext* cx, js::HandleObject callee, HandleObject proto,
-                               NewObjectKind newKind = GenericObject);
+CreateThisForFunctionWithProto(JSContext* cx, js::HandleObject callee, HandleObject newTarget,
+                               HandleObject proto, NewObjectKind newKind = GenericObject);
 
 // Specialized call for constructing |this| with a known function callee.
 extern JSObject*
-CreateThisForFunction(JSContext* cx, js::HandleObject callee, NewObjectKind newKind);
+CreateThisForFunction(JSContext* cx, js::HandleObject callee, js::HandleObject newTarget,
+                      NewObjectKind newKind);
 
 // Generic call for constructing |this|.
 extern JSObject*
diff --git a/js/src/jsopcode.cpp b/js/src/jsopcode.cpp
index 175e11845aa1..7fc518613817 100644
--- a/js/src/jsopcode.cpp
+++ b/js/src/jsopcode.cpp
@@ -125,6 +125,7 @@ js::StackUses(JSScript* script, jsbytecode* pc)
       case JSOP_POPN:
         return GET_UINT16(pc);
       case JSOP_NEW:
+      case JSOP_SUPERCALL:
         return 2 + GET_ARGC(pc) + 1;
       default:
         /* stack: fun, this, [argc arguments] */
diff --git a/js/src/shell/js.cpp b/js/src/shell/js.cpp
index f66ae78bfbd0..7701f7295d10 100644
--- a/js/src/shell/js.cpp
+++ b/js/src/shell/js.cpp
@@ -109,30 +109,53 @@ enum JSShellExitCode {
     EXITCODE_TIMEOUT            = 6
 };
 
-static size_t gStackChunkSize = 8192;
+static const size_t gStackChunkSize = 8192;
 
 /*
  * Note: This limit should match the stack limit set by the browser in
  *       js/xpconnect/src/XPCJSRuntime.cpp
  */
 #if defined(MOZ_ASAN) || (defined(DEBUG) && !defined(XP_WIN))
-static size_t gMaxStackSize = 2 * 128 * sizeof(size_t) * 1024;
+static const size_t gMaxStackSize = 2 * 128 * sizeof(size_t) * 1024;
 #else
-static size_t gMaxStackSize = 128 * sizeof(size_t) * 1024;
+static const size_t gMaxStackSize = 128 * sizeof(size_t) * 1024;
 #endif
 
 /*
  * Limit the timeout to 30 minutes to prevent an overflow on platfoms
  * that represent the time internally in microseconds using 32-bit int.
  */
-static double MAX_TIMEOUT_INTERVAL = 1800.0;
-static double gTimeoutInterval = -1.0;
-static Atomic<bool> gServiceInterrupt;
-static JS::PersistentRootedValue gInterruptFunc;
+static const double MAX_TIMEOUT_INTERVAL = 1800.0;
 
-static bool gLastWarningEnabled = false;
-static JS::PersistentRootedValue gLastWarning;
+// Per-runtime shell state.
+struct ShellRuntime
+{
+    ShellRuntime();
 
+    bool isWorker;
+    double timeoutInterval;
+    Atomic<bool> serviceInterrupt;
+    JS::PersistentRootedValue interruptFunc;
+    bool lastWarningEnabled;
+    JS::PersistentRootedValue lastWarning;
+
+    /*
+     * Watchdog thread state.
+     */
+    PRLock* watchdogLock;
+    PRCondVar* watchdogWakeup;
+    PRThread* watchdogThread;
+    bool watchdogHasTimeout;
+    int64_t watchdogTimeout;
+
+    PRCondVar* sleepWakeup;
+
+    int exitCode;
+    bool quitting;
+    bool gotError;
+};
+
+// Shell state set once at startup.
 static bool enableCodeCoverage = false;
 static bool enableDisassemblyDumps = false;
 static bool offthreadCompilation = false;
@@ -144,11 +167,22 @@ static bool enableUnboxedArrays = false;
 #ifdef JS_GC_ZEAL
 static char gZealStr[128];
 #endif
-
 static bool printTiming = false;
 static const char* jsCacheDir = nullptr;
 static const char* jsCacheAsmJSPath = nullptr;
-static bool jsCachingEnabled = false;
+static FILE* gErrFile = nullptr;
+static FILE* gOutFile = nullptr;
+static bool reportWarnings = true;
+static bool compileOnly = false;
+static bool fuzzingSafe = false;
+static bool disableOOMFunctions = false;
+#ifdef DEBUG
+static bool dumpEntrainedVariables = false;
+static bool OOM_printAllocationCount = false;
+#endif
+
+// Shell state this is only accessed on the main thread.
+bool jsCachingEnabled = false;
 mozilla::Atomic<bool> jsCacheOpened(false);
 
 static bool
@@ -158,7 +192,7 @@ static bool
 InitWatchdog(JSRuntime* rt);
 
 static void
-KillWatchdog();
+KillWatchdog(JSRuntime *rt);
 
 static bool
 ScheduleWatchdog(JSRuntime* rt, double t);
@@ -166,33 +200,6 @@ ScheduleWatchdog(JSRuntime* rt, double t);
 static void
 CancelExecution(JSRuntime* rt);
 
-/*
- * Watchdog thread state.
- */
-static PRLock* gWatchdogLock = nullptr;
-static PRCondVar* gWatchdogWakeup = nullptr;
-static PRThread* gWatchdogThread = nullptr;
-static bool gWatchdogHasTimeout = false;
-static int64_t gWatchdogTimeout = 0;
-
-static PRCondVar* gSleepWakeup = nullptr;
-
-static int gExitCode = 0;
-static bool gQuitting = false;
-static bool gGotError = false;
-static FILE* gErrFile = nullptr;
-static FILE* gOutFile = nullptr;
-
-static bool reportWarnings = true;
-static bool compileOnly = false;
-static bool fuzzingSafe = false;
-static bool disableOOMFunctions = false;
-
-#ifdef DEBUG
-static bool dumpEntrainedVariables = false;
-static bool OOM_printAllocationCount = false;
-#endif
-
 static JSContext*
 NewContext(JSRuntime* rt);
 
@@ -267,6 +274,36 @@ extern JS_EXPORT_API(void)   add_history(char* line);
 } // extern "C"
 #endif
 
+ShellRuntime::ShellRuntime()
+  : isWorker(false),
+    timeoutInterval(-1.0),
+    serviceInterrupt(false),
+    lastWarningEnabled(false),
+    watchdogLock(nullptr),
+    watchdogWakeup(nullptr),
+    watchdogThread(nullptr),
+    watchdogHasTimeout(false),
+    watchdogTimeout(0),
+    sleepWakeup(nullptr),
+    exitCode(0),
+    quitting(false),
+    gotError(false)
+{}
+
+static ShellRuntime*
+GetShellRuntime(JSRuntime *rt)
+{
+    ShellRuntime* sr = static_cast<ShellRuntime*>(JS_GetRuntimePrivate(rt));
+    MOZ_ASSERT(sr);
+    return sr;
+}
+
+static ShellRuntime*
+GetShellRuntime(JSContext* cx)
+{
+    return GetShellRuntime(cx->runtime());
+}
+
 static char*
 GetLine(FILE* file, const char * prompt)
 {
@@ -370,17 +407,18 @@ GetContextData(JSContext* cx)
 static bool
 ShellInterruptCallback(JSContext* cx)
 {
-    if (!gServiceInterrupt)
+    ShellRuntime* sr = GetShellRuntime(cx);
+    if (!sr->serviceInterrupt)
         return true;
 
-    // Reset gServiceInterrupt. CancelExecution or InterruptIf will set it to
+    // Reset serviceInterrupt. CancelExecution or InterruptIf will set it to
     // true to distinguish watchdog or user triggered interrupts.
     // Do this first to prevent other interrupts that may occur while the
     // user-supplied callback is executing from re-entering the handler.
-    gServiceInterrupt = false;
+    sr->serviceInterrupt = false;
 
     bool result;
-    RootedValue interruptFunc(cx, gInterruptFunc);
+    RootedValue interruptFunc(cx, sr->interruptFunc);
     if (!interruptFunc.isNull()) {
         JS::AutoSaveExceptionState savedExc(cx);
         JSAutoCompartment ac(cx, &interruptFunc.toObject());
@@ -398,8 +436,8 @@ ShellInterruptCallback(JSContext* cx)
         result = false;
     }
 
-    if (!result && gExitCode == 0)
-        gExitCode = EXITCODE_TIMEOUT;
+    if (!result && sr->exitCode == 0)
+        sr->exitCode = EXITCODE_TIMEOUT;
 
     return result;
 }
@@ -432,6 +470,8 @@ SkipUTF8BOM(FILE* file)
 static void
 RunFile(JSContext* cx, const char* filename, FILE* file, bool compileOnly)
 {
+    ShellRuntime* sr = GetShellRuntime(cx);
+
     SkipUTF8BOM(file);
 
     // To support the UNIX #! shell hack, gobble the first line if it starts
@@ -456,9 +496,9 @@ RunFile(JSContext* cx, const char* filename, FILE* file, bool compileOnly)
                .setIsRunOnce(true)
                .setNoScriptRval(true);
 
-        gGotError = false;
+        sr->gotError = false;
         (void) JS::Compile(cx, options, file, &script);
-        MOZ_ASSERT_IF(!script, gGotError);
+        MOZ_ASSERT_IF(!script, sr->gotError);
     }
 
     #ifdef DEBUG
@@ -467,8 +507,8 @@ RunFile(JSContext* cx, const char* filename, FILE* file, bool compileOnly)
     #endif
     if (script && !compileOnly) {
         if (!JS_ExecuteScript(cx, script)) {
-            if (!gQuitting && gExitCode != EXITCODE_TIMEOUT)
-                gExitCode = EXITCODE_RUNTIME_ERROR;
+            if (!sr->quitting && sr->exitCode != EXITCODE_TIMEOUT)
+                sr->exitCode = EXITCODE_RUNTIME_ERROR;
         }
         int64_t t2 = PRMJ_Now() - t1;
         if (printTiming)
@@ -514,6 +554,7 @@ EvalAndPrint(JSContext* cx, const char* bytes, size_t length,
 static void
 ReadEvalPrintLoop(JSContext* cx, FILE* in, FILE* out, bool compileOnly)
 {
+    ShellRuntime* sr = GetShellRuntime(cx);
     int lineno = 1;
     bool hitEOF = false;
 
@@ -529,7 +570,7 @@ ReadEvalPrintLoop(JSContext* cx, FILE* in, FILE* out, bool compileOnly)
         CharBuffer buffer(cx);
         do {
             ScheduleWatchdog(cx->runtime(), -1);
-            gServiceInterrupt = false;
+            sr->serviceInterrupt = false;
             errno = 0;
 
             char* line = GetLine(in, startline == lineno ? "js> " : "");
@@ -546,7 +587,7 @@ ReadEvalPrintLoop(JSContext* cx, FILE* in, FILE* out, bool compileOnly)
                 return;
 
             lineno++;
-            if (!ScheduleWatchdog(cx->runtime(), gTimeoutInterval)) {
+            if (!ScheduleWatchdog(cx->runtime(), sr->timeoutInterval)) {
                 hitEOF = true;
                 break;
             }
@@ -561,7 +602,7 @@ ReadEvalPrintLoop(JSContext* cx, FILE* in, FILE* out, bool compileOnly)
             // Catch the error, report it, and keep going.
             JS_ReportPendingException(cx);
         }
-    } while (!hitEOF && !gQuitting);
+    } while (!hitEOF && !sr->quitting);
 
     fprintf(out, "\n");
 }
@@ -1543,6 +1584,8 @@ Help(JSContext* cx, unsigned argc, Value* vp);
 static bool
 Quit(JSContext* cx, unsigned argc, Value* vp)
 {
+    ShellRuntime* sr = GetShellRuntime(cx);
+
 #ifdef JS_MORE_DETERMINISTIC
     // Print a message to stderr in more-deterministic builds to help jsfunfuzz
     // find uncatchable-exception bugs.
@@ -1564,8 +1607,8 @@ Quit(JSContext* cx, unsigned argc, Value* vp)
         return false;
     }
 
-    gExitCode = code;
-    gQuitting = true;
+    sr->exitCode = code;
+    sr->quitting = true;
     return false;
 }
 
@@ -2545,9 +2588,25 @@ WorkerMain(void* arg)
         js_delete(input);
         return;
     }
+
+    mozilla::UniquePtr<ShellRuntime> sr = MakeUnique<ShellRuntime>();
+    if (!sr) {
+        JS_DestroyRuntime(rt);
+        js_delete(input);
+        return;
+    }
+
+    sr->isWorker = true;
+    JS_SetRuntimePrivate(rt, sr.get());
     JS_SetErrorReporter(rt, my_ErrorReporter);
     SetWorkerRuntimeOptions(rt);
 
+    if (!InitWatchdog(rt)) {
+        JS_DestroyRuntime(rt);
+        js_delete(input);
+        return;
+    }
+
     JSContext* cx = NewContext(rt);
     if (!cx) {
         JS_DestroyRuntime(rt);
@@ -2653,6 +2712,7 @@ IsBefore(int64_t t1, int64_t t2)
 static bool
 Sleep_fn(JSContext* cx, unsigned argc, Value* vp)
 {
+    ShellRuntime* sr = GetShellRuntime(cx);
     CallArgs args = CallArgsFromVp(argc, vp);
     int64_t t_ticks;
 
@@ -2673,61 +2733,63 @@ Sleep_fn(JSContext* cx, unsigned argc, Value* vp)
                   ? 0
                   : int64_t(PRMJ_USEC_PER_SEC * t_secs);
     }
-    PR_Lock(gWatchdogLock);
+    PR_Lock(sr->watchdogLock);
     int64_t to_wakeup = PRMJ_Now() + t_ticks;
     for (;;) {
-        PR_WaitCondVar(gSleepWakeup, PR_MillisecondsToInterval(t_ticks / 1000));
-        if (gServiceInterrupt)
+        PR_WaitCondVar(sr->sleepWakeup, PR_MillisecondsToInterval(t_ticks / 1000));
+        if (sr->serviceInterrupt)
             break;
         int64_t now = PRMJ_Now();
         if (!IsBefore(now, to_wakeup))
             break;
         t_ticks = to_wakeup - now;
     }
-    PR_Unlock(gWatchdogLock);
+    PR_Unlock(sr->watchdogLock);
     args.rval().setUndefined();
-    return !gServiceInterrupt;
+    return !sr->serviceInterrupt;
 }
 
 static bool
 InitWatchdog(JSRuntime* rt)
 {
-    MOZ_ASSERT(!gWatchdogThread);
-    gWatchdogLock = PR_NewLock();
-    if (gWatchdogLock) {
-        gWatchdogWakeup = PR_NewCondVar(gWatchdogLock);
-        if (gWatchdogWakeup) {
-            gSleepWakeup = PR_NewCondVar(gWatchdogLock);
-            if (gSleepWakeup)
+    ShellRuntime* sr = GetShellRuntime(rt);
+    MOZ_ASSERT(!sr->watchdogThread);
+    sr->watchdogLock = PR_NewLock();
+    if (sr->watchdogLock) {
+        sr->watchdogWakeup = PR_NewCondVar(sr->watchdogLock);
+        if (sr->watchdogWakeup) {
+            sr->sleepWakeup = PR_NewCondVar(sr->watchdogLock);
+            if (sr->sleepWakeup)
                 return true;
-            PR_DestroyCondVar(gWatchdogWakeup);
+            PR_DestroyCondVar(sr->watchdogWakeup);
         }
-        PR_DestroyLock(gWatchdogLock);
+        PR_DestroyLock(sr->watchdogLock);
     }
     return false;
 }
 
 static void
-KillWatchdog()
+KillWatchdog(JSRuntime* rt)
 {
+    ShellRuntime* sr = GetShellRuntime(rt);
     PRThread* thread;
 
-    PR_Lock(gWatchdogLock);
-    thread = gWatchdogThread;
+    PR_Lock(sr->watchdogLock);
+    thread = sr->watchdogThread;
     if (thread) {
         /*
          * The watchdog thread is running, tell it to terminate waking it up
          * if necessary.
          */
-        gWatchdogThread = nullptr;
-        PR_NotifyCondVar(gWatchdogWakeup);
+        sr->watchdogThread = nullptr;
+        PR_NotifyCondVar(sr->watchdogWakeup);
     }
-    PR_Unlock(gWatchdogLock);
+    PR_Unlock(sr->watchdogLock);
     if (thread)
         PR_JoinThread(thread);
-    PR_DestroyCondVar(gSleepWakeup);
-    PR_DestroyCondVar(gWatchdogWakeup);
-    PR_DestroyLock(gWatchdogLock);
+    PR_DestroyCondVar(sr->sleepWakeup);
+    PR_DestroyCondVar(sr->watchdogWakeup);
+    PR_DestroyLock(sr->watchdogLock);
 }
 
 static void
@@ -2736,24 +2798,25 @@ WatchdogMain(void* arg)
     PR_SetCurrentThreadName("JS Watchdog");
 
     JSRuntime* rt = (JSRuntime*) arg;
+    ShellRuntime* sr = GetShellRuntime(rt);
 
-    PR_Lock(gWatchdogLock);
-    while (gWatchdogThread) {
+    PR_Lock(sr->watchdogLock);
+    while (sr->watchdogThread) {
         int64_t now = PRMJ_Now();
-        if (gWatchdogHasTimeout && !IsBefore(now, gWatchdogTimeout)) {
+        if (sr->watchdogHasTimeout && !IsBefore(now, sr->watchdogTimeout)) {
             /*
              * The timeout has just expired. Request an interrupt callback
              * outside the lock.
              */
-            gWatchdogHasTimeout = false;
-            PR_Unlock(gWatchdogLock);
+            sr->watchdogHasTimeout = false;
+            PR_Unlock(sr->watchdogLock);
             CancelExecution(rt);
-            PR_Lock(gWatchdogLock);
+            PR_Lock(sr->watchdogLock);
 
             /* Wake up any threads doing sleep. */
-            PR_NotifyAllCondVar(gSleepWakeup);
+            PR_NotifyAllCondVar(sr->sleepWakeup);
         } else {
-            if (gWatchdogHasTimeout) {
+            if (sr->watchdogHasTimeout) {
                 /*
                  * Time hasn't expired yet. Simulate an interrupt callback
                  * which doesn't abort execution.
@@ -2762,58 +2825,61 @@ WatchdogMain(void* arg)
             }
 
             uint64_t sleepDuration = PR_INTERVAL_NO_TIMEOUT;
-            if (gWatchdogHasTimeout)
+            if (sr->watchdogHasTimeout)
                 sleepDuration = PR_TicksPerSecond() / 10;
             mozilla::DebugOnly<PRStatus> status =
-              PR_WaitCondVar(gWatchdogWakeup, sleepDuration);
+              PR_WaitCondVar(sr->watchdogWakeup, sleepDuration);
             MOZ_ASSERT(status == PR_SUCCESS);
         }
     }
-    PR_Unlock(gWatchdogLock);
+    PR_Unlock(sr->watchdogLock);
 }
 
 static bool
 ScheduleWatchdog(JSRuntime* rt, double t)
 {
+    ShellRuntime* sr = GetShellRuntime(rt);
+
     if (t <= 0) {
-        PR_Lock(gWatchdogLock);
-        gWatchdogHasTimeout = false;
-        PR_Unlock(gWatchdogLock);
+        PR_Lock(sr->watchdogLock);
+        sr->watchdogHasTimeout = false;
+        PR_Unlock(sr->watchdogLock);
         return true;
     }
 
     int64_t interval = int64_t(ceil(t * PRMJ_USEC_PER_SEC));
     int64_t timeout = PRMJ_Now() + interval;
-    PR_Lock(gWatchdogLock);
-    if (!gWatchdogThread) {
-        MOZ_ASSERT(!gWatchdogHasTimeout);
-        gWatchdogThread = PR_CreateThread(PR_USER_THREAD,
+    PR_Lock(sr->watchdogLock);
+    if (!sr->watchdogThread) {
+        MOZ_ASSERT(!sr->watchdogHasTimeout);
+        sr->watchdogThread = PR_CreateThread(PR_USER_THREAD,
                                           WatchdogMain,
                                           rt,
                                           PR_PRIORITY_NORMAL,
                                           PR_GLOBAL_THREAD,
                                           PR_JOINABLE_THREAD,
                                           0);
-        if (!gWatchdogThread) {
-            PR_Unlock(gWatchdogLock);
+        if (!sr->watchdogThread) {
+            PR_Unlock(sr->watchdogLock);
             return false;
         }
-    } else if (!gWatchdogHasTimeout || IsBefore(timeout, gWatchdogTimeout)) {
-         PR_NotifyCondVar(gWatchdogWakeup);
+    } else if (!sr->watchdogHasTimeout || IsBefore(timeout, sr->watchdogTimeout)) {
+         PR_NotifyCondVar(sr->watchdogWakeup);
     }
-    gWatchdogHasTimeout = true;
-    gWatchdogTimeout = timeout;
-    PR_Unlock(gWatchdogLock);
+    sr->watchdogHasTimeout = true;
+    sr->watchdogTimeout = timeout;
+    PR_Unlock(sr->watchdogLock);
     return true;
 }
 
 static void
 CancelExecution(JSRuntime* rt)
 {
-    gServiceInterrupt = true;
+    ShellRuntime* sr = GetShellRuntime(rt);
+    sr->serviceInterrupt = true;
     JS_RequestInterruptCallback(rt);
 
-    if (!gInterruptFunc.isNull()) {
+    if (!sr->interruptFunc.isNull()) {
         static const char msg[] = "Script runs for too long, terminating.\n";
         fputs(msg, stderr);
     }
@@ -2827,7 +2893,7 @@ SetTimeoutValue(JSContext* cx, double t)
         JS_ReportError(cx, "Excessive timeout value");
         return false;
     }
-    gTimeoutInterval = t;
+    GetShellRuntime(cx)->timeoutInterval = t;
     if (!ScheduleWatchdog(cx->runtime(), t)) {
         JS_ReportError(cx, "Failed to create the watchdog");
         return false;
@@ -2838,10 +2904,11 @@ SetTimeoutValue(JSContext* cx, double t)
 static bool
 Timeout(JSContext* cx, unsigned argc, Value* vp)
 {
+    ShellRuntime* sr = GetShellRuntime(cx);
     CallArgs args = CallArgsFromVp(argc, vp);
 
     if (args.length() == 0) {
-        args.rval().setNumber(gTimeoutInterval);
+        args.rval().setNumber(sr->timeoutInterval);
         return true;
     }
 
@@ -2860,7 +2927,7 @@ Timeout(JSContext* cx, unsigned argc, Value* vp)
             JS_ReportError(cx, "Second argument must be a timeout function");
             return false;
         }
-        gInterruptFunc = value;
+        sr->interruptFunc = value;
     }
 
     args.rval().setUndefined();
@@ -2878,7 +2945,7 @@ InterruptIf(JSContext* cx, unsigned argc, Value* vp)
     }
 
     if (ToBoolean(args[0])) {
-        gServiceInterrupt = true;
+        GetShellRuntime(cx)->serviceInterrupt = true;
         JS_RequestInterruptCallback(cx->runtime());
     }
 
@@ -2895,7 +2962,7 @@ InvokeInterruptCallbackWrapper(JSContext* cx, unsigned argc, Value* vp)
         return false;
     }
 
-    gServiceInterrupt = true;
+    GetShellRuntime(cx)->serviceInterrupt = true;
     JS_RequestInterruptCallback(cx->runtime());
     bool interruptRv = CheckForInterrupt(cx);
 
@@ -2931,7 +2998,7 @@ SetInterruptCallback(JSContext* cx, unsigned argc, Value* vp)
         JS_ReportError(cx, "Argument must be a function");
         return false;
     }
-    gInterruptFunc = value;
+    GetShellRuntime(cx)->interruptFunc = value;
 
     args.rval().setUndefined();
     return true;
@@ -2940,10 +3007,11 @@ SetInterruptCallback(JSContext* cx, unsigned argc, Value* vp)
 static bool
 EnableLastWarning(JSContext* cx, unsigned argc, Value* vp)
 {
+    ShellRuntime* sr = GetShellRuntime(cx);
     CallArgs args = CallArgsFromVp(argc, vp);
 
-    gLastWarningEnabled = true;
-    gLastWarning.setNull();
+    sr->lastWarningEnabled = true;
+    sr->lastWarning.setNull();
 
     args.rval().setUndefined();
     return true;
@@ -2952,10 +3020,11 @@ EnableLastWarning(JSContext* cx, unsigned argc, Value* vp)
 static bool
 DisableLastWarning(JSContext* cx, unsigned argc, Value* vp)
 {
+    ShellRuntime* sr = GetShellRuntime(cx);
     CallArgs args = CallArgsFromVp(argc, vp);
 
-    gLastWarningEnabled = false;
-    gLastWarning.setNull();
+    sr->lastWarningEnabled = false;
+    sr->lastWarning.setNull();
 
     args.rval().setUndefined();
     return true;
@@ -2964,31 +3033,33 @@ DisableLastWarning(JSContext* cx, unsigned argc, Value* vp)
 static bool
 GetLastWarning(JSContext* cx, unsigned argc, Value* vp)
 {
+    ShellRuntime* sr = GetShellRuntime(cx);
     CallArgs args = CallArgsFromVp(argc, vp);
 
-    if (!gLastWarningEnabled) {
+    if (!sr->lastWarningEnabled) {
         JS_ReportError(cx, "Call enableLastWarning first.");
         return false;
     }
 
-    if (!JS_WrapValue(cx, &gLastWarning))
+    if (!JS_WrapValue(cx, &sr->lastWarning))
         return false;
 
-    args.rval().set(gLastWarning);
+    args.rval().set(sr->lastWarning);
     return true;
 }
 
 static bool
 ClearLastWarning(JSContext* cx, unsigned argc, Value* vp)
 {
+    ShellRuntime* sr = GetShellRuntime(cx);
     CallArgs args = CallArgsFromVp(argc, vp);
 
-    if (!gLastWarningEnabled) {
+    if (!sr->lastWarningEnabled) {
         JS_ReportError(cx, "Call enableLastWarning first.");
         return false;
     }
 
-    gLastWarning.setNull();
+    sr->lastWarning.setNull();
 
     args.rval().setUndefined();
     return true;
@@ -3893,6 +3964,11 @@ static bool
 SetCachingEnabled(JSContext* cx, unsigned argc, Value* vp)
 {
     CallArgs args = CallArgsFromVp(argc, vp);
+    if (GetShellRuntime(cx)->isWorker) {
+        JS_ReportError(cx, "Caching is not supported in workers");
+        return false;
+    }
+
     jsCachingEnabled = ToBoolean(args.get(0));
     args.rval().setUndefined();
     return true;
@@ -5142,7 +5218,7 @@ CreateLastWarningObject(JSContext* cx, JSErrorReport* report)
     if (!DefineProperty(cx, warningObj, cx->names().columnNumber, columnVal))
         return false;
 
-    gLastWarning.setObject(*warningObj);
+    GetShellRuntime(cx)->lastWarning.setObject(*warningObj);
     return true;
 }
 
@@ -5184,7 +5260,9 @@ PrintStackTrace(JSContext* cx, HandleValue exn)
 void
 js::shell::my_ErrorReporter(JSContext* cx, const char* message, JSErrorReport* report)
 {
-    if (report && JSREPORT_IS_WARNING(report->flags) && gLastWarningEnabled) {
+    ShellRuntime* sr = GetShellRuntime(cx);
+
+    if (report && JSREPORT_IS_WARNING(report->flags) && sr->lastWarningEnabled) {
         JS::AutoSaveExceptionState savedExc(cx);
         if (!CreateLastWarningObject(cx, report)) {
             fputs("Unhandled error happened while creating last warning object.\n", gOutFile);
@@ -5198,7 +5276,7 @@ js::shell::my_ErrorReporter(JSContext* cx, const char* message, JSErrorReport* r
     if (JS_IsExceptionPending(cx))
         (void) JS_GetPendingException(cx, &exn);
 
-    gGotError = PrintError(cx, gErrFile, message, report, reportWarnings);
+    sr->gotError = PrintError(cx, gErrFile, message, report, reportWarnings);
     if (!exn.isUndefined()) {
         JS::AutoSaveExceptionState savedExc(cx);
         if (!PrintStackTrace(cx, exn))
@@ -5207,11 +5285,10 @@ js::shell::my_ErrorReporter(JSContext* cx, const char* message, JSErrorReport* r
     }
 
     if (report->exnType != JSEXN_NONE && !JSREPORT_IS_WARNING(report->flags)) {
-        if (report->errorNumber == JSMSG_OUT_OF_MEMORY) {
-            gExitCode = EXITCODE_OUT_OF_MEMORY;
-        } else {
-            gExitCode = EXITCODE_RUNTIME_ERROR;
-        }
+        if (report->errorNumber == JSMSG_OUT_OF_MEMORY)
+            sr->exitCode = EXITCODE_OUT_OF_MEMORY;
+        else
+            sr->exitCode = EXITCODE_RUNTIME_ERROR;
     }
 }
 
@@ -5222,7 +5299,7 @@ my_OOMCallback(JSContext* cx, void* data)
     // memory", which may or may not be caught. Otherwise the engine will just
     // unwind and return null/false, with no exception set.
     if (!JS_IsRunning(cx))
-        gGotError = true;
+        GetShellRuntime(cx)->gotError = true;
 }
 
 static bool
@@ -5767,6 +5844,13 @@ NewGlobalObject(JSContext* cx, JS::CompartmentOptions& options,
             return nullptr;
 #endif
 
+        bool succeeded;
+        if (!JS_SetImmutablePrototype(cx, glob, &succeeded))
+            return nullptr;
+        MOZ_ASSERT(succeeded,
+                   "a fresh, unexposed global object is always capable of "
+                   "having its [[Prototype]] be immutable");
+
 #ifdef JS_HAS_CTYPES
         if (!JS_InitCTypesClass(cx, glob))
             return nullptr;
@@ -5880,6 +5964,8 @@ OptionFailure(const char* option, const char* str)
 static int
 ProcessArgs(JSContext* cx, OptionParser* op)
 {
+    ShellRuntime* sr = GetShellRuntime(cx);
+
     if (op->getBoolOption('s'))
         JS::RuntimeOptionsRef(cx).toggleExtraWarnings();
 
@@ -5892,7 +5978,7 @@ ProcessArgs(JSContext* cx, OptionParser* op)
 
     if (filePaths.empty() && codeChunks.empty() && !op->getStringArg("script")) {
         Process(cx, nullptr, true); /* Interactive. */
-        return gExitCode;
+        return sr->exitCode;
     }
 
     while (!filePaths.empty() || !codeChunks.empty()) {
@@ -5901,8 +5987,8 @@ ProcessArgs(JSContext* cx, OptionParser* op)
         if (fpArgno < ccArgno) {
             char* path = filePaths.front();
             Process(cx, path, false);
-            if (gExitCode)
-                return gExitCode;
+            if (sr->exitCode)
+                return sr->exitCode;
             filePaths.popFront();
         } else {
             const char* code = codeChunks.front();
@@ -5910,27 +5996,27 @@ ProcessArgs(JSContext* cx, OptionParser* op)
             JS::CompileOptions opts(cx);
             opts.setFileAndLine("-e", 1);
             if (!JS::Evaluate(cx, opts, code, strlen(code), &rval))
-                return gExitCode ? gExitCode : EXITCODE_RUNTIME_ERROR;
+                return sr->exitCode ? sr->exitCode : EXITCODE_RUNTIME_ERROR;
             codeChunks.popFront();
-            if (gQuitting)
+            if (sr->quitting)
                 break;
         }
     }
 
-    if (gQuitting)
-        return gExitCode ? gExitCode : EXIT_SUCCESS;
+    if (sr->quitting)
+        return sr->exitCode ? sr->exitCode : EXIT_SUCCESS;
 
     /* The |script| argument is processed after all options. */
     if (const char* path = op->getStringArg("script")) {
         Process(cx, path, false);
-        if (gExitCode)
-            return gExitCode;
+        if (sr->exitCode)
+            return sr->exitCode;
     }
 
     if (op->getBoolOption('i'))
         Process(cx, nullptr, true);
 
-    return gExitCode ? gExitCode : EXIT_SUCCESS;
+    return sr->exitCode ? sr->exitCode : EXIT_SUCCESS;
 }
 
 static bool
@@ -6530,13 +6616,18 @@ main(int argc, char** argv, char** envp)
     if (!rt)
         return 1;
 
+    mozilla::UniquePtr<ShellRuntime> sr = MakeUnique<ShellRuntime>();
+    if (!sr)
+        return 1;
+
+    JS_SetRuntimePrivate(rt, sr.get());
     JS_SetErrorReporter(rt, my_ErrorReporter);
     JS::SetOutOfMemoryCallback(rt, my_OOMCallback, nullptr);
     if (!SetRuntimeOptions(rt, op))
         return 1;
 
-    gInterruptFunc.init(rt, NullValue());
-    gLastWarning.init(rt, NullValue());
+    sr->interruptFunc.init(rt, NullValue());
+    sr->lastWarning.init(rt, NullValue());
 
     JS_SetGCParameter(rt, JSGC_MAX_BYTES, 0xffffffff);
 
@@ -6594,7 +6685,7 @@ main(int argc, char** argv, char** envp)
 
     DestroyContext(cx, true);
 
-    KillWatchdog();
+    KillWatchdog(rt);
 
     MOZ_ASSERT_IF(!CanUseExtraThreads(), workerThreads.empty());
     for (size_t i = 0; i < workerThreads.length(); i++)
diff --git a/js/src/tests/ecma_6/Class/classHeritage.js b/js/src/tests/ecma_6/Class/classHeritage.js
index d8804bdfbdcb..0b01612cf5ea 100644
--- a/js/src/tests/ecma_6/Class/classHeritage.js
+++ b/js/src/tests/ecma_6/Class/classHeritage.js
@@ -36,11 +36,11 @@ class base {
     override() { overrideCalled = "base" }
 }
 class derived extends base {
-    constructor() { };
+    constructor() { super(); };
     override() { overrideCalled = "derived"; }
 }
 var derivedExpr = class extends base {
-    constructor() { };
+    constructor() { super(); };
     override() { overrideCalled = "derived"; }
 };
 
diff --git a/js/src/tests/ecma_6/Class/derivedConstructorDisabled.js b/js/src/tests/ecma_6/Class/derivedConstructorDisabled.js
index 6f4898b31f7a..4b86408fc122 100644
--- a/js/src/tests/ecma_6/Class/derivedConstructorDisabled.js
+++ b/js/src/tests/ecma_6/Class/derivedConstructorDisabled.js
@@ -18,6 +18,7 @@ class derived extends base {
 // Make sure eval and arrows are still valid in non-derived constructors.
 new base();
 
+
 // Eval throws in derived class constructors, in both class expressions and
 // statements.
 assertThrowsInstanceOf((() => new derived()), InternalError);
@@ -26,8 +27,8 @@ assertThrowsInstanceOf((() => new class extends base { constructor() { eval('')
 var g = newGlobal();
 var dbg = Debugger(g);
 dbg.onDebuggerStatement = function(frame) { assertThrowsInstanceOf(()=>frame.eval(''), InternalError); };
-g.eval("new class foo extends null { constructor() { debugger; } }()");
 
+g.eval("new class foo extends null { constructor() { debugger; return {}; } }()");
 `;
 
 if (classesEnabled())
diff --git a/js/src/tests/ecma_6/Class/derivedConstructorInlining.js b/js/src/tests/ecma_6/Class/derivedConstructorInlining.js
new file mode 100644
index 000000000000..e0052305bcf4
--- /dev/null
+++ b/js/src/tests/ecma_6/Class/derivedConstructorInlining.js
@@ -0,0 +1,19 @@
+// Since we (for now!) can't emit jitcode for derived class statements. Make
+// sure we can corectly invoke derived class constructors.
+
+class foo extends null {
+    constructor() {
+        // Anything that tests |this| should throw, so just let it run off the
+        // end.
+    }
+}
+
+function intermediate() {
+    new foo();
+}
+
+for (let i = 0; i < 1100; i++)
+    assertThrownErrorContains(intermediate, "|this|");
+
+if (typeof reportCompare === 'function')
+    reportCompare(0,0,"OK");
diff --git a/js/src/tests/ecma_6/Class/derivedConstructorReturnPrimitive.js b/js/src/tests/ecma_6/Class/derivedConstructorReturnPrimitive.js
new file mode 100644
index 000000000000..8b1594fa812b
--- /dev/null
+++ b/js/src/tests/ecma_6/Class/derivedConstructorReturnPrimitive.js
@@ -0,0 +1,15 @@
+class foo extends null {
+    constructor() {
+        // Returning a primitive is a TypeError in derived constructors. This
+        // ensures that super() can take the return value directly, without
+        // checking it. Use |null| here, as a tricky check to make sure we
+        // didn't lump it in with the object check, somehow.
+        return null;
+    }
+}
+
+for (let i = 0; i < 1100; i++)
+    assertThrownErrorContains(() => new foo(), "return");
+
+if (typeof reportCompare === 'function')
+    reportCompare(0,0,"OK");
diff --git a/js/src/tests/ecma_6/Class/derivedConstructorTDZExplicitThis.js b/js/src/tests/ecma_6/Class/derivedConstructorTDZExplicitThis.js
new file mode 100644
index 000000000000..8ef9e48eea40
--- /dev/null
+++ b/js/src/tests/ecma_6/Class/derivedConstructorTDZExplicitThis.js
@@ -0,0 +1,18 @@
+function pleaseRunMyCode() { }
+
+class foo extends null {
+    constructor() {
+        // Just bareword |this| is DCEd by the BytecodeEmitter. Your guess as
+        // to why we think this is a good idea is as good as mine. In order to
+        // combat this inanity, make it a function arg, so we have to compute
+        // it.
+        pleaseRunMyCode(this);
+        assertEq(false, true);
+    }
+}
+
+for (let i = 0; i < 1100; i++)
+    assertThrownErrorContains(() => new foo(), "|this|");
+
+if (typeof reportCompare === 'function')
+    reportCompare(0,0,"OK");
diff --git a/js/src/tests/ecma_6/Class/derivedConstructorTDZOffEdge.js b/js/src/tests/ecma_6/Class/derivedConstructorTDZOffEdge.js
new file mode 100644
index 000000000000..145b12d2a113
--- /dev/null
+++ b/js/src/tests/ecma_6/Class/derivedConstructorTDZOffEdge.js
@@ -0,0 +1,11 @@
+class foo extends null {
+    constructor() {
+        // Let it fall off the edge and throw.
+    }
+}
+
+for (let i = 0; i < 1100; i++)
+    assertThrownErrorContains(() => new foo(), "|this|");
+
+if (typeof reportCompare === 'function')
+    reportCompare(0,0,"OK");
diff --git a/js/src/tests/ecma_6/Class/derivedConstructorTDZReturnObject.js b/js/src/tests/ecma_6/Class/derivedConstructorTDZReturnObject.js
new file mode 100644
index 000000000000..48206a881e1a
--- /dev/null
+++ b/js/src/tests/ecma_6/Class/derivedConstructorTDZReturnObject.js
@@ -0,0 +1,13 @@
+class foo extends null {
+    constructor() {
+        // If you return an object, we don't care that |this| went
+        // uninitialized
+        return {};
+    }
+}
+
+for (let i = 0; i < 1100; i++)
+    new foo();
+
+if (typeof reportCompare === 'function')
+    reportCompare(0,0,"OK");
diff --git a/js/src/tests/ecma_6/Class/derivedConstructorTDZReturnUndefined.js b/js/src/tests/ecma_6/Class/derivedConstructorTDZReturnUndefined.js
new file mode 100644
index 000000000000..ab31b7aedd2a
--- /dev/null
+++ b/js/src/tests/ecma_6/Class/derivedConstructorTDZReturnUndefined.js
@@ -0,0 +1,13 @@
+class foo extends null {
+    constructor() {
+        // Explicit returns of undefined should act the same as falling off the
+        // end of the function. That is to say, they should throw.
+        return undefined;
+    }
+}
+
+for (let i = 0; i < 1100; i++)
+    assertThrownErrorContains(() => new foo(), "|this|");
+
+if (typeof reportCompare === 'function')
+    reportCompare(0,0,"OK");
diff --git a/js/src/tests/ecma_6/Class/superCallBadDynamicSuperClass.js b/js/src/tests/ecma_6/Class/superCallBadDynamicSuperClass.js
new file mode 100644
index 000000000000..e904d82efdab
--- /dev/null
+++ b/js/src/tests/ecma_6/Class/superCallBadDynamicSuperClass.js
@@ -0,0 +1,17 @@
+var test = `
+
+class base { constructor() { } }
+
+class inst extends base { constructor() { super(); } }
+
+Object.setPrototypeOf(inst, Math.sin);
+
+assertThrowsInstanceOf(() => new inst(), TypeError);
+
+`;
+
+if (classesEnabled())
+    eval(test);
+
+if (typeof reportCompare === 'function')
+    reportCompare(0,0,"OK");
diff --git a/js/src/tests/ecma_6/Class/superCallBadNewTargetPrototype.js b/js/src/tests/ecma_6/Class/superCallBadNewTargetPrototype.js
new file mode 100644
index 000000000000..577e7d3cda7b
--- /dev/null
+++ b/js/src/tests/ecma_6/Class/superCallBadNewTargetPrototype.js
@@ -0,0 +1,30 @@
+var test = `
+
+class base { constructor() { } }
+
+// lies and the lying liars who tell them
+function lies() { }
+lies.prototype = 4;
+
+assertThrowsInstanceOf(()=>Reflect.consruct(base, [], lies), TypeError);
+
+// lie a slightly different way
+function get(target, property, receiver) {
+    if (property === "prototype")
+        return 42;
+    return Reflect.get(target, property, receiver);
+}
+
+class inst extends base {
+    constructor() { super(); }
+}
+
+assertThrowsInstanceOf(()=>new new Proxy(inst, {get})(), TypeError);
+
+`;
+
+if (classesEnabled())
+    eval(test);
+
+if (typeof reportCompare === 'function')
+    reportCompare(0,0,"OK");
diff --git a/js/src/tests/ecma_6/Class/superCallBaseInvoked.js b/js/src/tests/ecma_6/Class/superCallBaseInvoked.js
new file mode 100644
index 000000000000..37ab89f5cfa0
--- /dev/null
+++ b/js/src/tests/ecma_6/Class/superCallBaseInvoked.js
@@ -0,0 +1,53 @@
+var test = `
+
+function testBase(base) {
+    class instance extends base {
+        constructor(inst, one) {
+            super(inst, one);
+        }
+    }
+
+    let inst = new instance(instance, 1);
+    assertEq(Object.getPrototypeOf(inst), instance.prototype);
+    assertEq(inst.calledBase, true);
+}
+
+class base {
+    // Base class must be [[Construct]]ed, as you cannot [[Call]] a class
+    // constructor
+    constructor(nt, one) {
+        assertEq(new.target, nt);
+
+        // Check argument ordering
+        assertEq(one, 1);
+        this.calledBase = true;
+    }
+}
+
+testBase(base);
+testBase(class extends base {
+             constructor(nt, one) {
+                 // Every step of the way, new.target and args should be right
+                 assertEq(new.target, nt);
+                 assertEq(one, 1);
+                 super(nt, one);
+             }
+         });
+function baseFunc(nt, one) {
+    assertEq(new.target, nt);
+    assertEq(one, 1);
+    this.calledBase = true;
+}
+
+testBase(baseFunc);
+testBase(new Proxy(baseFunc, {}));
+
+// Object will have to wait for fixed builtins.
+
+`;
+
+if (classesEnabled())
+    eval(test);
+
+if (typeof reportCompare === 'function')
+    reportCompare(0,0,"OK");
diff --git a/js/src/tests/ecma_6/Class/superCallIllegal.js b/js/src/tests/ecma_6/Class/superCallIllegal.js
new file mode 100644
index 000000000000..8b7b36397d17
--- /dev/null
+++ b/js/src/tests/ecma_6/Class/superCallIllegal.js
@@ -0,0 +1,7 @@
+// super() invalid outside derived class constructors, including in dynamic
+// functions and eval
+assertThrowsInstanceOf(() => new Function("super();"), SyntaxError);
+assertThrowsInstanceOf(() => eval("super()"), SyntaxError);
+
+if (typeof reportCompare === 'function')
+    reportCompare(0,0,"OK");
diff --git a/js/src/tests/ecma_6/Class/superCallInvalidBase.js b/js/src/tests/ecma_6/Class/superCallInvalidBase.js
new file mode 100644
index 000000000000..03ffb5e58d33
--- /dev/null
+++ b/js/src/tests/ecma_6/Class/superCallInvalidBase.js
@@ -0,0 +1,15 @@
+var test = `
+
+class instance extends null {
+    constructor() { super(); }
+}
+
+assertThrowsInstanceOf(() => new instance(), TypeError);
+
+`;
+
+if (classesEnabled())
+    eval(test);
+
+if (typeof reportCompare === 'function')
+    reportCompare(0,0,"OK");
diff --git a/js/src/tests/ecma_6/Class/superCallOrder.js b/js/src/tests/ecma_6/Class/superCallOrder.js
new file mode 100644
index 000000000000..1c71785b388c
--- /dev/null
+++ b/js/src/tests/ecma_6/Class/superCallOrder.js
@@ -0,0 +1,33 @@
+var test = `
+
+function base() { }
+
+class beforeSwizzle extends base {
+    constructor() {
+        super(Object.setPrototypeOf(beforeSwizzle, null));
+    }
+}
+
+new beforeSwizzle();
+
+// Again, testing both dynamic prototype dispatch, and that we get the function
+// before evaluating args
+class beforeThrow extends base {
+    constructor() {
+        function thrower() { throw new Error(); }
+        super(thrower());
+    }
+}
+
+Object.setPrototypeOf(beforeThrow, Math.sin);
+
+// Will throw that Math.sin is not a constructor before evaluating the args
+assertThrowsInstanceOf(() => new beforeThrow(), TypeError);
+
+`;
+
+if (classesEnabled())
+    eval(test);
+
+if (typeof reportCompare === 'function')
+    reportCompare(0,0,"OK");
diff --git a/js/src/tests/ecma_6/Class/superCallProperBase.js b/js/src/tests/ecma_6/Class/superCallProperBase.js
new file mode 100644
index 000000000000..a33bbcf45762
--- /dev/null
+++ b/js/src/tests/ecma_6/Class/superCallProperBase.js
@@ -0,0 +1,33 @@
+var test = `
+
+class base1 {
+    constructor() {
+        this.base = 1;
+    }
+}
+
+class base2 {
+    constructor() {
+        this.base = 2;
+    }
+}
+
+class inst extends base1 {
+    constructor() {
+        super();
+    }
+}
+
+assertEq(new inst().base, 1);
+
+Object.setPrototypeOf(inst, base2);
+
+assertEq(new inst().base, 2);
+
+`;
+
+if (classesEnabled())
+    eval(test);
+
+if (typeof reportCompare === 'function')
+    reportCompare(0,0,"OK");
diff --git a/js/src/tests/ecma_6/Class/superCallSpreadCall.js b/js/src/tests/ecma_6/Class/superCallSpreadCall.js
new file mode 100644
index 000000000000..e20f9627d671
--- /dev/null
+++ b/js/src/tests/ecma_6/Class/superCallSpreadCall.js
@@ -0,0 +1,34 @@
+var test = `
+
+class base {
+    constructor(a, b, c) {
+        assertEq(a, 1);
+        assertEq(b, 2);
+        assertEq(c, 3);
+        this.calledBase = true;
+    }
+}
+
+class test extends base {
+    constructor(arr) {
+        super(...arr);
+    }
+}
+
+assertEq(new test([1,2,3]).calledBase, true);
+
+class testRest extends base {
+   constructor(...args) {
+       super(...args);
+   }
+}
+
+assertEq(new testRest(1,2,3).calledBase, true);
+
+`;
+
+if (classesEnabled())
+    eval(test);
+
+if (typeof reportCompare === 'function')
+    reportCompare(0,0,"OK");
diff --git a/js/src/tests/ecma_6/Class/superCallThisInit.js b/js/src/tests/ecma_6/Class/superCallThisInit.js
new file mode 100644
index 000000000000..b2442d91d091
--- /dev/null
+++ b/js/src/tests/ecma_6/Class/superCallThisInit.js
@@ -0,0 +1,52 @@
+var test = `
+
+function base() { this.prop = 42; }
+
+class testInitialize extends base {
+    constructor() {
+        // A poor man's assertThrowsInstanceOf, as arrow functions are currently
+        // disabled in this context
+        try {
+            this;
+            throw new Error();
+        } catch (e if e instanceof ReferenceError) { }
+        super();
+        assertEq(this.prop, 42);
+    }
+}
+assertEq(new testInitialize().prop, 42);
+
+// super() twice is a no-go.
+class willThrow extends base {
+    constructor() {
+        super();
+        super();
+    }
+}
+assertThrowsInstanceOf(()=>new willThrow(), ReferenceError);
+
+// This is determined at runtime, not the syntax level.
+class willStillThrow extends base {
+    constructor() {
+        for (let i = 0; i < 3; i++) {
+            super();
+        }
+    }
+}
+assertThrowsInstanceOf(()=>new willStillThrow(), ReferenceError);
+
+class canCatchThrow extends base {
+    constructor() {
+        super();
+        try { super(); } catch(e) { }
+    }
+}
+assertEq(new canCatchThrow().prop, 42);
+
+`;
+
+if (classesEnabled())
+    eval(test);
+
+if (typeof reportCompare === 'function')
+    reportCompare(0,0,"OK");
diff --git a/js/src/tests/ecma_6/Class/superPropBasicGetter.js b/js/src/tests/ecma_6/Class/superPropBasicGetter.js
index e30c180540ee..88c9c64f3513 100644
--- a/js/src/tests/ecma_6/Class/superPropBasicGetter.js
+++ b/js/src/tests/ecma_6/Class/superPropBasicGetter.js
@@ -13,7 +13,7 @@ class base {
 }
 
 class derived extends base {
-    constructor() {}
+    constructor() { super(); }
 
     get a() { return super.getValue(); }
     set a(v) { super.setValue(v); }
diff --git a/js/src/tests/ecma_6/Class/superPropBasicNew.js b/js/src/tests/ecma_6/Class/superPropBasicNew.js
index 84d248726987..e12cdea56d5d 100644
--- a/js/src/tests/ecma_6/Class/superPropBasicNew.js
+++ b/js/src/tests/ecma_6/Class/superPropBasicNew.js
@@ -4,12 +4,13 @@ class Base {
     constructor() {}
 }
 class Mid extends Base {
-    constructor() {}
+    constructor() { super(); }
     f() { return new super.constructor(); }
 }
 class Derived extends Mid {
-    constructor() {}
+    constructor() { super(); }
 }
+
 let d = new Derived();
 var df = d.f();
 assertEq(df.constructor, Base);
diff --git a/js/src/tests/ecma_6/Class/superPropChains.js b/js/src/tests/ecma_6/Class/superPropChains.js
index 9b83a835678d..8770e9eac309 100644
--- a/js/src/tests/ecma_6/Class/superPropChains.js
+++ b/js/src/tests/ecma_6/Class/superPropChains.js
@@ -9,7 +9,7 @@ class base {
 }
 
 class middle extends base {
-    constructor() { }
+    constructor() { super(); }
     testChain() {
         this.middleCalled = true;
         super.testChain();
@@ -17,7 +17,7 @@ class middle extends base {
 }
 
 class derived extends middle {
-    constructor() { }
+    constructor() { super(); }
     testChain() {
         super.testChain();
         assertEq(this.middleCalled, true);
@@ -32,7 +32,7 @@ function bootlegMiddle() { }
 bootlegMiddle.prototype = middle.prototype;
 
 new class extends bootlegMiddle {
-        constructor() { }
+        constructor() { super(); }
         testChain() {
             super.testChain();
             assertEq(this.middleCalled, true);
@@ -43,11 +43,11 @@ new class extends bootlegMiddle {
 // Now let's try out some "long" chains
 base.prototype.x = "yeehaw";
 
-let chain = class extends base { constructor() { } }
+let chain = class extends base { constructor() { super(); } }
 
 const CHAIN_LENGTH = 100;
 for (let i = 0; i < CHAIN_LENGTH; i++)
-    chain = class extends chain { constructor() { } }
+    chain = class extends chain { constructor() { super(); } }
 
 // Now we poke the chain
 let inst = new chain();
diff --git a/js/src/tests/ecma_6/Class/superPropDelete.js b/js/src/tests/ecma_6/Class/superPropDelete.js
index 24f709d3e2c5..68e133136561 100644
--- a/js/src/tests/ecma_6/Class/superPropDelete.js
+++ b/js/src/tests/ecma_6/Class/superPropDelete.js
@@ -8,7 +8,7 @@ class base {
 }
 
 class derived extends base {
-    constructor() { }
+    constructor() { super(); }
     testDeleteProp() { delete super.prop; }
     testDeleteElem() {
         let sideEffect = 0;
diff --git a/js/src/tests/ecma_6/Class/superPropDerivedCalls.js b/js/src/tests/ecma_6/Class/superPropDerivedCalls.js
index b5239b96508f..3b0ef4def376 100644
--- a/js/src/tests/ecma_6/Class/superPropDerivedCalls.js
+++ b/js/src/tests/ecma_6/Class/superPropDerivedCalls.js
@@ -26,7 +26,7 @@ class base {
 }
 
 class derived extends base {
-    constructor() { }
+    constructor() { super(); }
 
     // |super| actually checks the chain, not |this|
     method() { throw "FAIL"; }
diff --git a/js/src/tests/ecma_6/Class/superPropDestructuring.js b/js/src/tests/ecma_6/Class/superPropDestructuring.js
index 418e1c71e756..f6bc0c5925aa 100644
--- a/js/src/tests/ecma_6/Class/superPropDestructuring.js
+++ b/js/src/tests/ecma_6/Class/superPropDestructuring.js
@@ -22,7 +22,7 @@ Object.defineProperty(base.prototype, "intendent",
 
 const testArr = [525600, "Fred"];
 class derived extends base {
-    constructor() { }
+    constructor() { super(); }
     prepForTest() { seenValues = []; }
     testAsserts() { assertDeepEq(seenValues, testArr); }
     testProps() {
diff --git a/js/src/tests/ecma_6/Class/superPropHomeObject.js b/js/src/tests/ecma_6/Class/superPropHomeObject.js
index 514f388db475..6fee18070128 100644
--- a/js/src/tests/ecma_6/Class/superPropHomeObject.js
+++ b/js/src/tests/ecma_6/Class/superPropHomeObject.js
@@ -14,7 +14,7 @@ class base {
 }
 
 class derived extends base {
-    constructor() { }
+    constructor() { super(); }
     test(expected) { super.test(expected); }
     testArrow() { return (() => super.test(this)); }
     ["testCPN"](expected) { super.test(expected); }
@@ -55,7 +55,7 @@ class base2 {
 let animals = [];
 for (let exprBase of [base1, base2])
     new class extends exprBase {
-        constructor() { }
+        constructor() { super(); }
         test() { animals.push(super["test"]()); }
     }().test();
 assertDeepEq(animals, ["llama", "alpaca"]);
diff --git a/js/src/tests/ecma_6/Class/superPropOrdering.js b/js/src/tests/ecma_6/Class/superPropOrdering.js
index 75f43daced2b..689819020207 100644
--- a/js/src/tests/ecma_6/Class/superPropOrdering.js
+++ b/js/src/tests/ecma_6/Class/superPropOrdering.js
@@ -6,16 +6,16 @@ class base {
 }
 
 class derived extends base {
-    constructor() { this.methodCalled = 0; }
+    constructor() { super(); this.methodCalled = 0; }
 
     // Test orderings of various evaluations relative to the superbase
-    
+
     // Unlike in regular element evaluation, the propVal is evaluated before
     // checking the starting object ([[HomeObject]].[[Prototype]])
     testElem() { super[ruin()]; }
-   
+
     // The starting object for looking up super.method is determined before
-    // ruin() is called. 
+    // ruin() is called.
     testProp() { super.method(ruin()); }
 
     // The entire super.method property lookup has concluded before the args
@@ -71,7 +71,6 @@ function reset() {
 }
 
 let instance = new derived();
-
 assertThrowsInstanceOf(() => instance.testElem(), TypeError);
 reset();
 
@@ -91,6 +90,7 @@ instance.testAssignElemPropValChange();
 instance.testAssignProp();
 
 instance.testCompoundAssignProp();
+
 `;
 
 if (classesEnabled())
diff --git a/js/src/tests/ecma_6/Class/superPropProtoChanges.js b/js/src/tests/ecma_6/Class/superPropProtoChanges.js
index 7cb457f6cd19..bca849ee1100 100644
--- a/js/src/tests/ecma_6/Class/superPropProtoChanges.js
+++ b/js/src/tests/ecma_6/Class/superPropProtoChanges.js
@@ -10,7 +10,7 @@ class base {
 let standin = { test() { return true; } };
 
 class derived extends base {
-    constructor() { }
+    constructor() { super(); }
     test() {
         assertEq(super.test(), false);
         Object.setPrototypeOf(derived.prototype, standin);
diff --git a/js/src/tests/ecma_6/Class/superPropProxies.js b/js/src/tests/ecma_6/Class/superPropProxies.js
index 3d5669d781b9..926205600d28 100644
--- a/js/src/tests/ecma_6/Class/superPropProxies.js
+++ b/js/src/tests/ecma_6/Class/superPropProxies.js
@@ -11,7 +11,7 @@ let midStaticHandler = { };
 let getterCalled, setterCalled;
 
 class mid extends new Proxy(base, midStaticHandler) {
-    constructor() { }
+    constructor() { super(); }
     testSuperInProxy() {
         super.prop = "looking";
         assertEq(setterCalled, true);
@@ -21,7 +21,7 @@ class mid extends new Proxy(base, midStaticHandler) {
 }
 
 class child extends mid {
-    constructor() { }
+    constructor() { super(); }
     static testStaticLookups() {
         // This funtion is called more than once.
         this.called = false;
@@ -30,7 +30,6 @@ class child extends mid {
     }
 }
 
-
 let midInstance = new mid();
 
 // Make sure proxies are searched properly on the prototype chain
diff --git a/js/src/tests/ecma_6/Class/superPropSkips.js b/js/src/tests/ecma_6/Class/superPropSkips.js
index 05d659a56947..408e53b0b4ed 100644
--- a/js/src/tests/ecma_6/Class/superPropSkips.js
+++ b/js/src/tests/ecma_6/Class/superPropSkips.js
@@ -9,7 +9,7 @@ class base {
 }
 
 class derived extends base {
-    constructor() { this.prop = "flamingo"; }
+    constructor() { super(); this.prop = "flamingo"; }
 
     toString() { throw "No!"; }
 
@@ -37,6 +37,7 @@ class derived extends base {
 }
 
 Object.defineProperty(derived.prototype, "nonWritableProp", { writable: false, value: "pony" });
+
 let instance = new derived();
 instance.testSkipGet();
 instance.testSkipDerivedOverrides();
diff --git a/js/src/tests/ecma_6/Proxy/revoke-as-side-effect.js b/js/src/tests/ecma_6/Proxy/revoke-as-side-effect.js
index 6ff5aaf5b49a..21f8f8e20d3b 100644
--- a/js/src/tests/ecma_6/Proxy/revoke-as-side-effect.js
+++ b/js/src/tests/ecma_6/Proxy/revoke-as-side-effect.js
@@ -71,8 +71,13 @@ assertEq(Object.getOwnPropertyNames(createProxy({a: 5})).length, 1);
 assertEq(createProxy(function() { return "ok" })(), "ok");
 
 // [[Construct]]
-// This should throw per bug 1141865.
-assertEq(new (createProxy(function(){ return obj; })), obj);
+// This throws because after the "construct" trap on the proxy is consulted,
+// OrdinaryCreateFromConstructor (called because the |q| function's
+// [[ConstructorKind]] is "base" per FunctionAllocate) accesses
+// |new.target.prototype| to create the |this| for the construct operation, that
+// would be returned if |return obj;| didn't override it.
+assertThrowsInstanceOf(() => new (createProxy(function q(){ return obj; })),
+                       TypeError);
 
 if (typeof reportCompare === "function")
   reportCompare(true, true);
diff --git a/js/src/tests/ecma_6/Reflect/construct.js b/js/src/tests/ecma_6/Reflect/construct.js
index 659d64592f56..00473d591f67 100644
--- a/js/src/tests/ecma_6/Reflect/construct.js
+++ b/js/src/tests/ecma_6/Reflect/construct.js
@@ -38,20 +38,15 @@ if (classesEnabled()) {
                 this.newTarget = new.target;
             }
         }
-        //class Derived extends Base {
-        //    constructor(...args) { super(...args); }
-        //}
+        class Derived extends Base {
+            constructor(...args) { super(...args); }
+        }
 
         assertDeepEq(Reflect.construct(Base, []), new Base);
-        //assertDeepEq(Reflect.construct(Derived, [7]), new Derived(7));
-        //g = Derived.bind(null, "q");
-        //assertDeepEq(Reflect.construct(g, [8, 9]), new g(8, 9));
+        assertDeepEq(Reflect.construct(Derived, [7]), new Derived(7));
+        g = Derived.bind(null, "q");
+        assertDeepEq(Reflect.construct(g, [8, 9]), new g(8, 9));
     }`);
-
-    if (classesEnabled("class X extends Y { constructor() { super(); } }")) {
-        throw new Error("Congratulations on implementing super()! " +
-                        "Please uncomment the Derived tests in this file!");
-    }
 }
 
 // Cross-compartment wrappers:
diff --git a/js/src/tests/js1_8_5/reflect-parse/PatternBuilders.js b/js/src/tests/js1_8_5/reflect-parse/PatternBuilders.js
index 4b808a346eac..abc2155bd250 100644
--- a/js/src/tests/js1_8_5/reflect-parse/PatternBuilders.js
+++ b/js/src/tests/js1_8_5/reflect-parse/PatternBuilders.js
@@ -207,6 +207,9 @@ function newExpr(callee, args) {
 function callExpr(callee, args) {
     return Pattern({ type: "CallExpression", callee: callee, arguments: args });
 }
+function superCallExpr(args) {
+    return callExpr({ type: "Super" }, args);
+}
 function arrExpr(elts) {
     return Pattern({ type: "ArrayExpression", elements: elts });
 }
diff --git a/js/src/tests/js1_8_5/reflect-parse/classes.js b/js/src/tests/js1_8_5/reflect-parse/classes.js
index 615a36673f1e..497e79730650 100644
--- a/js/src/tests/js1_8_5/reflect-parse/classes.js
+++ b/js/src/tests/js1_8_5/reflect-parse/classes.js
@@ -25,9 +25,9 @@ function testClasses() {
                            methodFun(id, kind, generator, args),
                            kind, isStatic);
     }
-    function ctorWithName(id) {
+    function ctorWithName(id, body = []) {
         return classMethod(ident("constructor"),
-                           methodFun(id, "method", false, []),
+                           methodFun(id, "method", false, [], body),
                            "method", false);
     }
     function emptyCPNMethod(id, isStatic) {
@@ -40,14 +40,15 @@ function testClasses() {
         let template = classExpr(name, heritage, methods);
         assertExpr("(" + str + ")", template);
     }
+
     // FunctionExpression of constructor has class name as its id.
     // FIXME: Implement ES6 function "name" property semantics (bug 883377).
     let ctorPlaceholder = {};
-    function assertClass(str, methods, heritage=null) {
+    function assertClass(str, methods, heritage=null, constructorBody=[]) {
         let namelessStr = str.replace("NAME", "");
         let namedStr = str.replace("NAME", "Foo");
-        let namedCtor = ctorWithName("Foo");
-        let namelessCtor = ctorWithName(null);
+        let namedCtor = ctorWithName("Foo", constructorBody);
+        let namelessCtor = ctorWithName(null, constructorBody);
         let namelessMethods = methods.map(x => x == ctorPlaceholder ? namelessCtor : x);
         let namedMethods = methods.map(x => x == ctorPlaceholder ? namedCtor : x);
         assertClassExpr(namelessStr, namelessMethods, heritage);
@@ -437,6 +438,42 @@ function testClasses() {
     assertError("{ foo() { super } }", SyntaxError);
     assertClassError("class NAME { constructor() { super; } }", SyntaxError);
 
+    /* SuperCall */
+
+    // SuperCall is invalid outside derived class constructors.
+    assertError("super()", SyntaxError);
+    assertError("(function() { super(); })", SyntaxError);
+
+    // SuperCall is invalid in generator comprehensions, even inside derived
+    // class constructors
+    assertError("(super() for (x in y))", SyntaxError);
+    assertClassError("class NAME { constructor() { (super() for (x in y))", SyntaxError);
+
+
+    // Even in class constructors
+    assertClassError("class NAME { constructor() { super(); } }", SyntaxError);
+
+    function superConstructor(args) {
+        return classMethod(ident("constructor"),
+                           methodFun("NAME", "method", false,
+                                     [], [exprStmt(superCallExpr(args))]),
+                           "method", false);
+    }
+
+    function superCallBody(args) {
+        return [exprStmt(superCallExpr(args))];
+    }
+
+    // SuperCall works with various argument configurations.
+    assertClass("class NAME extends null { constructor() { super() } }",
+                [ctorPlaceholder], lit(null), superCallBody([]));
+    assertClass("class NAME extends null { constructor() { super(1) } }",
+                [ctorPlaceholder], lit(null), superCallBody([lit(1)]));
+    assertClass("class NAME extends null { constructor() { super(1, a) } }",
+                [ctorPlaceholder], lit(null), superCallBody([lit(1), ident("a")]));
+    assertClass("class NAME extends null { constructor() { super(...[]) } }",
+                [ctorPlaceholder], lit(null), superCallBody([spread(arrExpr([]))]));
+
     /* EOF */
     // Clipped classes should throw a syntax error
     assertClassError("class NAME {", SyntaxError);
diff --git a/js/src/tests/jstests.py b/js/src/tests/jstests.py
index 946fdea585a9..04d7006c508e 100755
--- a/js/src/tests/jstests.py
+++ b/js/src/tests/jstests.py
@@ -350,14 +350,15 @@ def main():
     test_dir = dirname(abspath(__file__))
 
     if options.debug:
-        if len(list(test_gen)) > 1:
+        tests = list(test_gen)
+        if len(tests) > 1:
             print('Multiple tests match command line arguments,'
                   ' debugger can only run one')
-            for tc in test_gen:
+            for tc in tests:
                 print('    {}'.format(tc.path))
             return 2
 
-        cmd = test_gen[0].get_command(RefTestCase.js_cmd_prefix)
+        cmd = tests[0].get_command(prefix)
         if options.show_cmd:
             print(list2cmdline(cmd))
         with changedir(test_dir):
diff --git a/js/src/vm/Debugger.cpp b/js/src/vm/Debugger.cpp
index 23a5de92b1ae..81089dc4dd3d 100644
--- a/js/src/vm/Debugger.cpp
+++ b/js/src/vm/Debugger.cpp
@@ -1735,7 +1735,7 @@ bool
 Debugger::appendAllocationSite(JSContext* cx, HandleObject obj, HandleSavedFrame frame,
                                double when)
 {
-    MOZ_ASSERT(trackingAllocationSites);
+    MOZ_ASSERT(trackingAllocationSites && enabled);
 
     AutoCompartment ac(cx, object);
     RootedObject wrappedFrame(cx, frame);
@@ -2319,19 +2319,20 @@ Debugger::isObservedByDebuggerTrackingAllocations(const GlobalObject& debuggee)
 }
 
 /* static */ bool
-Debugger::addAllocationsTracking(JSContext* cx, GlobalObject& debuggee)
+Debugger::addAllocationsTracking(JSContext* cx, Handle<GlobalObject*> debuggee)
 {
     // Precondition: the given global object is being observed by at least one
     // Debugger that is tracking allocations.
-    MOZ_ASSERT(isObservedByDebuggerTrackingAllocations(debuggee));
+    MOZ_ASSERT(isObservedByDebuggerTrackingAllocations(*debuggee));
 
-    if (Debugger::cannotTrackAllocations(debuggee)) {
+    if (Debugger::cannotTrackAllocations(*debuggee)) {
         JS_ReportErrorNumber(cx, GetErrorMessage, nullptr,
                              JSMSG_OBJECT_METADATA_CALLBACK_ALREADY_SET);
         return false;
     }
 
-    debuggee.compartment()->setObjectMetadataCallback(SavedStacksMetadataCallback);
+    debuggee->compartment()->setObjectMetadataCallback(SavedStacksMetadataCallback);
+    debuggee->compartment()->chooseAllocationSamplingProbability();
     return true;
 }
 
@@ -2339,9 +2340,12 @@ Debugger::addAllocationsTracking(JSContext* cx, GlobalObject& debuggee)
 Debugger::removeAllocationsTracking(GlobalObject& global)
 {
     // If there are still Debuggers that are observing allocations, we cannot
-    // remove the metadata callback yet.
-    if (isObservedByDebuggerTrackingAllocations(global))
+    // remove the metadata callback yet. Recompute the sampling probability
+    // based on the remaining debuggers' needs.
+    if (isObservedByDebuggerTrackingAllocations(global)) {
+        global.compartment()->chooseAllocationSamplingProbability();
         return;
+    }
 
     global.compartment()->forgetObjectMetadataCallback();
 }
@@ -2364,10 +2368,12 @@ Debugger::addAllocationsTrackingForAllDebuggees(JSContext* cx)
         }
     }
 
+    Rooted<GlobalObject*> g(cx);
     for (WeakGlobalObjectSet::Range r = debuggees.all(); !r.empty(); r.popFront()) {
         // This should always succeed, since we already checked for the
         // error case above.
-        MOZ_ALWAYS_TRUE(Debugger::addAllocationsTracking(cx, *r.front().get()));
+        g = r.front().get();
+        MOZ_ALWAYS_TRUE(Debugger::addAllocationsTracking(cx, g));
     }
 
     return true;
@@ -2376,9 +2382,9 @@ Debugger::addAllocationsTrackingForAllDebuggees(JSContext* cx)
 void
 Debugger::removeAllocationsTrackingForAllDebuggees()
 {
-    for (WeakGlobalObjectSet::Range r = debuggees.all(); !r.empty(); r.popFront()) {
+    for (WeakGlobalObjectSet::Range r = debuggees.all(); !r.empty(); r.popFront())
         Debugger::removeAllocationsTracking(*r.front().get());
-    }
+
     allocationsLog.clear();
 }
 
@@ -3422,8 +3428,9 @@ Debugger::addDebuggeeGlobal(JSContext* cx, Handle<GlobalObject*> global)
     });
 
     // (5)
-    if (trackingAllocationSites && enabled && !Debugger::addAllocationsTracking(cx, *global))
-            return false;
+    if (trackingAllocationSites && enabled && !Debugger::addAllocationsTracking(cx, global))
+        return false;
+
     auto allocationsTrackingGuard = MakeScopeExit([&] {
         if (trackingAllocationSites && enabled)
             Debugger::removeAllocationsTracking(*global);
diff --git a/js/src/vm/Debugger.h b/js/src/vm/Debugger.h
index 72c8e41f72fe..14ca32c4e27e 100644
--- a/js/src/vm/Debugger.h
+++ b/js/src/vm/Debugger.h
@@ -396,7 +396,7 @@ class Debugger : private mozilla::LinkedListElement<Debugger>
      * debuggee's compartment. The given debuggee global must be observed by at
      * least one Debugger that is enabled and tracking allocations.
      */
-    static bool addAllocationsTracking(JSContext* cx, GlobalObject& debuggee);
+    static bool addAllocationsTracking(JSContext* cx, Handle<GlobalObject*> debuggee);
 
     /*
      * Remove allocations tracking for objects allocated within the given
diff --git a/js/src/vm/DebuggerMemory.cpp b/js/src/vm/DebuggerMemory.cpp
index 22d2b5fb8f5b..e08b4da6e8f6 100644
--- a/js/src/vm/DebuggerMemory.cpp
+++ b/js/src/vm/DebuggerMemory.cpp
@@ -314,7 +314,18 @@ DebuggerMemory::setAllocationSamplingProbability(JSContext* cx, unsigned argc, V
         return false;
     }
 
-    memory->getDebugger()->allocationSamplingProbability = probability;
+    Debugger* dbg = memory->getDebugger();
+    if (dbg->allocationSamplingProbability != probability) {
+        dbg->allocationSamplingProbability = probability;
+
+        // If this is a change any debuggees would observe, have all debuggee
+        // compartments recompute their sampling probabilities.
+        if (dbg->enabled && dbg->trackingAllocationSites) {
+            for (auto r = dbg->debuggees.all(); !r.empty(); r.popFront())
+                r.front()->compartment()->chooseAllocationSamplingProbability();
+        }
+    }
+
     args.rval().setUndefined();
     return true;
 }
diff --git a/js/src/vm/GlobalObject.cpp b/js/src/vm/GlobalObject.cpp
index 1812a3d9087d..23020caaa8c0 100644
--- a/js/src/vm/GlobalObject.cpp
+++ b/js/src/vm/GlobalObject.cpp
@@ -90,9 +90,6 @@ js::GlobalObject::getTypedObjectModule() const {
     return v.toObject().as<TypedObjectModuleObject>();
 }
 
-
-
-
 /* static */ bool
 GlobalObject::ensureConstructor(JSContext* cx, Handle<GlobalObject*> global, JSProtoKey key)
 {
diff --git a/js/src/vm/Interpreter.cpp b/js/src/vm/Interpreter.cpp
index 24949a54be42..2956d21a6968 100644
--- a/js/src/vm/Interpreter.cpp
+++ b/js/src/vm/Interpreter.cpp
@@ -347,11 +347,17 @@ RunState::maybeCreateThisForConstructor(JSContext* cx)
         InvokeState& invoke = *asInvoke();
         if (invoke.constructing() && invoke.args().thisv().isPrimitive()) {
             RootedObject callee(cx, &invoke.args().callee());
-            NewObjectKind newKind = invoke.createSingleton() ? SingletonObject : GenericObject;
-            JSObject* obj = CreateThisForFunction(cx, callee, newKind);
-            if (!obj)
-                return false;
-            invoke.args().setThis(ObjectValue(*obj));
+            if (script()->isDerivedClassConstructor()) {
+                MOZ_ASSERT(callee->as<JSFunction>().isClassConstructor());
+                invoke.args().setThis(MagicValue(JS_UNINITIALIZED_LEXICAL));
+            } else {
+                RootedObject newTarget(cx, &invoke.args().newTarget().toObject());
+                NewObjectKind newKind = invoke.createSingleton() ? SingletonObject : GenericObject;
+                JSObject* obj = CreateThisForFunction(cx, callee, newTarget, newKind);
+                if (!obj)
+                    return false;
+                invoke.args().setThis(ObjectValue(*obj));
+            }
         }
     }
     return true;
@@ -869,9 +875,9 @@ StackCheckIsConstructorCalleeNewTarget(JSContext* cx, HandleValue callee, Handle
         return false;
     }
 
-    // The new.target for a stack construction attempt is just the callee: no
-    // need to check that it's a constructor.
-    MOZ_ASSERT(&callee.toObject() == &newTarget.toObject());
+    // The new.target has already been vetted by previous calls, or is the callee.
+    // We can just assert that it's a constructor.
+    MOZ_ASSERT(IsConstructor(newTarget));
 
     return true;
 }
@@ -1744,6 +1750,34 @@ SetObjectElementOperation(JSContext* cx, HandleObject obj, HandleValue receiver,
            result.checkStrictErrorOrWarning(cx, obj, id, strict);
 }
 
+/*
+ * Get the innermost enclosing function that has a 'this' binding.
+ *
+ * Implements ES6 12.3.5.2 GetSuperConstructor() steps 1-3, including
+ * the loop in ES6 8.3.2 GetThisEnvironment(). Our implementation of
+ * ES6 12.3.5.3 MakeSuperPropertyReference() also uses this code.
+ */
+static JSFunction&
+GetSuperEnvFunction(JSContext *cx, InterpreterRegs& regs)
+{
+    ScopeIter si(cx, regs.fp()->scopeChain(), regs.fp()->script()->innermostStaticScope(regs.pc));
+    for (; !si.done(); ++si) {
+        if (si.hasSyntacticScopeObject() && si.type() == ScopeIter::Call) {
+            JSFunction& callee = si.scope().as<CallObject>().callee();
+
+            // Arrow functions don't have the information we're looking for,
+            // their enclosing scopes do. Nevertheless, they might have call
+            // objects. Skip them to find what we came for.
+            if (callee.isArrow())
+                continue;
+
+            return callee;
+        }
+    }
+    MOZ_CRASH("unexpected scope chain for GetSuperEnvFunction");
+}
+
+
 /*
  * As an optimization, the interpreter creates a handful of reserved Rooted<T>
  * variables at the beginning, thus inserting them into the Rooted list once
@@ -2053,10 +2087,6 @@ CASE(JSOP_NOP)
 CASE(JSOP_UNUSED2)
 CASE(JSOP_UNUSED14)
 CASE(JSOP_BACKPATCH)
-CASE(JSOP_UNUSED163)
-CASE(JSOP_UNUSED164)
-CASE(JSOP_UNUSED165)
-CASE(JSOP_UNUSED166)
 CASE(JSOP_UNUSED167)
 CASE(JSOP_UNUSED168)
 CASE(JSOP_UNUSED169)
@@ -2197,8 +2227,12 @@ CASE(JSOP_RETRVAL)
      */
     CHECK_BRANCH();
 
+    if (!REGS.fp()->checkReturn(cx))
+        goto error;
+
   successful_return_continuation:
     interpReturnOK = true;
+
   return_continuation:
     if (activation.entryFrame() != REGS.fp()) {
         // Stop the engine. (No details about which engine exactly, could be
@@ -2775,6 +2809,8 @@ END_CASE(JSOP_VOID)
 CASE(JSOP_THIS)
     if (!ComputeThis(cx, REGS.fp()))
         goto error;
+    if (!REGS.fp()->checkThis(cx))
+        goto error;
     PUSH_COPY(REGS.fp()->thisValue());
 END_CASE(JSOP_THIS)
 
@@ -2994,6 +3030,7 @@ END_CASE(JSOP_EVAL)
 
 CASE(JSOP_SPREADNEW)
 CASE(JSOP_SPREADCALL)
+CASE(JSOP_SPREADSUPERCALL)
     if (REGS.fp()->hasPushedSPSFrame())
         cx->runtime()->spsProfiler.updatePC(script, REGS.pc);
     /* FALL THROUGH */
@@ -3003,7 +3040,7 @@ CASE(JSOP_STRICTSPREADEVAL)
 {
     static_assert(JSOP_SPREADEVAL_LENGTH == JSOP_STRICTSPREADEVAL_LENGTH,
                   "spreadeval and strictspreadeval must be the same size");
-    bool construct = JSOp(*REGS.pc) == JSOP_SPREADNEW;
+    bool construct = JSOp(*REGS.pc) == JSOP_SPREADNEW || JSOp(*REGS.pc) == JSOP_SPREADSUPERCALL;;
 
     MOZ_ASSERT(REGS.stackDepth() >= 3u + construct);
 
@@ -3035,12 +3072,13 @@ CASE(JSOP_FUNAPPLY)
 
 CASE(JSOP_NEW)
 CASE(JSOP_CALL)
+CASE(JSOP_SUPERCALL)
 CASE(JSOP_FUNCALL)
 {
     if (REGS.fp()->hasPushedSPSFrame())
         cx->runtime()->spsProfiler.updatePC(script, REGS.pc);
 
-    bool construct = (*REGS.pc == JSOP_NEW);
+    bool construct = (*REGS.pc == JSOP_NEW || *REGS.pc == JSOP_SUPERCALL);
     unsigned argStackSlots = GET_ARGC(REGS.pc) + construct;
 
     MOZ_ASSERT(REGS.stackDepth() >= 2u + GET_ARGC(REGS.pc));
@@ -4063,37 +4101,22 @@ END_CASE(JSOP_INITHOMEOBJECT)
 
 CASE(JSOP_SUPERBASE)
 {
-    ScopeIter si(cx, REGS.fp()->scopeChain(), REGS.fp()->script()->innermostStaticScope(REGS.pc));
-    for (; !si.done(); ++si) {
-        if (si.hasSyntacticScopeObject() && si.type() == ScopeIter::Call) {
-            JSFunction& callee = si.scope().as<CallObject>().callee();
+    JSFunction& superEnvFunc = GetSuperEnvFunction(cx, REGS);
+    MOZ_ASSERT(superEnvFunc.allowSuperProperty());
+    MOZ_ASSERT(superEnvFunc.nonLazyScript()->needsHomeObject());
+    const Value& homeObjVal = superEnvFunc.getExtendedSlot(FunctionExtended::METHOD_HOMEOBJECT_SLOT);
 
-            // Arrow functions don't have the information we're looking for,
-            // their enclosing scopes do. Nevertheless, they might have call
-            // objects. Skip them to find what we came for.
-            if (callee.isArrow())
-                continue;
+    ReservedRooted<JSObject*> homeObj(&rootObject0, &homeObjVal.toObject());
+    ReservedRooted<JSObject*> superBase(&rootObject1);
+    if (!GetPrototype(cx, homeObj, &superBase))
+        goto error;
 
-            MOZ_ASSERT(callee.allowSuperProperty());
-            MOZ_ASSERT(callee.nonLazyScript()->needsHomeObject());
-            const Value& homeObjVal = callee.getExtendedSlot(FunctionExtended::METHOD_HOMEOBJECT_SLOT);
-
-            ReservedRooted<JSObject*> homeObj(&rootObject0, &homeObjVal.toObject());
-            ReservedRooted<JSObject*> superBase(&rootObject1);
-            if (!GetPrototype(cx, homeObj, &superBase))
-                goto error;
-
-            if (!superBase) {
-                JS_ReportErrorNumber(cx, GetErrorMessage, nullptr, JSMSG_CANT_CONVERT_TO,
-                                     "null", "object");
-                goto error;
-            }
-            PUSH_OBJECT(*superBase);
-            break;
-        }
+    if (!superBase) {
+        JS_ReportErrorNumber(cx, GetErrorMessage, nullptr, JSMSG_CANT_CONVERT_TO,
+                                "null", "object");
+        goto error;
     }
-    if (si.done())
-        MOZ_CRASH("Unexpected scope chain in superbase");
+    PUSH_OBJECT(*superBase);
 }
 END_CASE(JSOP_SUPERBASE)
 
@@ -4102,6 +4125,48 @@ CASE(JSOP_NEWTARGET)
     MOZ_ASSERT(REGS.sp[-1].isObject() || REGS.sp[-1].isUndefined());
 END_CASE(JSOP_NEWTARGET)
 
+CASE(JSOP_SUPERFUN)
+{
+    ReservedRooted<JSObject*> superEnvFunc(&rootObject0, &GetSuperEnvFunction(cx, REGS));
+    MOZ_ASSERT(superEnvFunc->as<JSFunction>().isClassConstructor());
+    MOZ_ASSERT(superEnvFunc->as<JSFunction>().nonLazyScript()->isDerivedClassConstructor());
+
+    ReservedRooted<JSObject*> superFun(&rootObject1);
+
+    if (!GetPrototype(cx, superEnvFunc, &superFun))
+        goto error;
+
+    ReservedRooted<Value> superFunVal(&rootValue0, UndefinedValue());
+    if (!superFun)
+        superFunVal = NullValue();
+    else if (!superFun->isConstructor())
+        superFunVal = ObjectValue(*superFun);
+
+    if (superFunVal.isObjectOrNull()) {
+        ReportIsNotFunction(cx, superFunVal, JSDVG_IGNORE_STACK, CONSTRUCT);
+        goto error;
+    }
+
+    PUSH_OBJECT(*superFun);
+}
+END_CASE(JSOP_SUPERFUN)
+
+CASE(JSOP_SETTHIS)
+{
+    MOZ_ASSERT(REGS.fp()->isNonEvalFunctionFrame());
+    MOZ_ASSERT(REGS.fp()->script()->isDerivedClassConstructor());
+    MOZ_ASSERT(REGS.fp()->callee().isClassConstructor());
+
+    if (!REGS.fp()->thisValue().isMagic(JS_UNINITIALIZED_LEXICAL)) {
+        JS_ReportErrorNumber(cx, GetErrorMessage, nullptr, JSMSG_REINIT_THIS);
+        goto error;
+    }
+
+    ReservedRooted<JSObject*> thisv(&rootObject0, &REGS.sp[-1].toObject());
+    REGS.fp()->setDerivedConstructorThis(thisv);
+}
+END_CASE(JSOP_SETTHIS)
+
 DEFAULT()
 {
     char numBuf[12];
@@ -4702,7 +4767,7 @@ js::SpreadCallOperation(JSContext* cx, HandleScript script, jsbytecode* pc, Hand
     RootedArrayObject aobj(cx, &arr.toObject().as<ArrayObject>());
     uint32_t length = aobj->length();
     JSOp op = JSOp(*pc);
-    bool constructing = op == JSOP_SPREADNEW;
+    bool constructing = op == JSOP_SPREADNEW || op == JSOP_SPREADSUPERCALL;
 
     if (length > ARGS_LENGTH_MAX) {
         JS_ReportErrorNumber(cx, GetErrorMessage, nullptr,
@@ -4720,7 +4785,7 @@ js::SpreadCallOperation(JSContext* cx, HandleScript script, jsbytecode* pc, Hand
         MOZ_ASSERT(!aobj->getDenseElement(i).isMagic());
 #endif
 
-    if (op == JSOP_SPREADNEW) {
+    if (constructing) {
         if (!StackCheckIsConstructorCalleeNewTarget(cx, callee, newTarget))
             return false;
 
@@ -4980,3 +5045,23 @@ js::ReportRuntimeRedeclaration(JSContext* cx, HandlePropertyName name,
                              kindStr, printable.ptr());
     }
 }
+
+bool
+js::ThrowUninitializedThis(JSContext* cx, AbstractFramePtr frame)
+{
+    RootedFunction fun(cx, frame.callee());
+
+    MOZ_ASSERT(fun->isClassConstructor());
+    MOZ_ASSERT(fun->nonLazyScript()->isDerivedClassConstructor());
+
+    const char* name = "anonymous";
+    JSAutoByteString str;
+    if (fun->atom()) {
+        if (!AtomToPrintableString(cx, fun->atom(), &str))
+            return false;
+        name = str.ptr();
+    }
+
+    JS_ReportErrorNumber(cx, GetErrorMessage, nullptr, JSMSG_UNINITIALIZED_THIS, name);
+    return false;
+}
diff --git a/js/src/vm/Interpreter.h b/js/src/vm/Interpreter.h
index 68bc3b4745c2..19ae644f2a83 100644
--- a/js/src/vm/Interpreter.h
+++ b/js/src/vm/Interpreter.h
@@ -485,6 +485,8 @@ ReportUninitializedLexical(JSContext* cx, HandleScript script, jsbytecode* pc);
 void
 ReportRuntimeRedeclaration(JSContext* cx, HandlePropertyName name,
                            frontend::Definition::Kind declKind);
+bool
+ThrowUninitializedThis(JSContext* cx, AbstractFramePtr frame);
 
 }  /* namespace js */
 
diff --git a/js/src/vm/ObjectGroup.cpp b/js/src/vm/ObjectGroup.cpp
index 5d0739a79da8..66e01b2815f6 100644
--- a/js/src/vm/ObjectGroup.cpp
+++ b/js/src/vm/ObjectGroup.cpp
@@ -465,13 +465,12 @@ ObjectGroup::defaultNewGroup(ExclusiveContext* cx, const Class* clasp,
                              TaggedProto proto, JSObject* associated)
 {
     MOZ_ASSERT_IF(associated, proto.isObject());
-    MOZ_ASSERT_IF(associated, associated->is<JSFunction>() || associated->is<TypeDescr>());
     MOZ_ASSERT_IF(proto.isObject(), cx->isInsideCurrentCompartment(proto.toObject()));
 
     // A null lookup clasp is used for 'new' groups with an associated
     // function. The group starts out as a plain object but might mutate into an
     // unboxed plain object.
-    MOZ_ASSERT(!clasp == (associated && associated->is<JSFunction>()));
+    MOZ_ASSERT_IF(!clasp, !!associated);
 
     AutoEnterAnalysis enter(cx);
 
@@ -487,22 +486,27 @@ ObjectGroup::defaultNewGroup(ExclusiveContext* cx, const Class* clasp,
         }
     }
 
-    if (associated && associated->is<JSFunction>()) {
+    if (associated && !associated->is<TypeDescr>()) {
         MOZ_ASSERT(!clasp);
+        if (associated->is<JSFunction>()) {
 
-        // Canonicalize new functions to use the original one associated with its script.
-        JSFunction* fun = &associated->as<JSFunction>();
-        if (fun->hasScript())
-            associated = fun->nonLazyScript()->functionNonDelazifying();
-        else if (fun->isInterpretedLazy() && !fun->isSelfHostedBuiltin())
-            associated = fun->lazyScript()->functionNonDelazifying();
-        else
-            associated = nullptr;
+            // Canonicalize new functions to use the original one associated with its script.
+            JSFunction* fun = &associated->as<JSFunction>();
+            if (fun->hasScript())
+                associated = fun->nonLazyScript()->functionNonDelazifying();
+            else if (fun->isInterpretedLazy() && !fun->isSelfHostedBuiltin())
+                associated = fun->lazyScript()->functionNonDelazifying();
+            else
+                associated = nullptr;
 
-        // If we have previously cleared the 'new' script information for this
-        // function, don't try to construct another one.
-        if (associated && associated->wasNewScriptCleared())
+            // If we have previously cleared the 'new' script information for this
+            // function, don't try to construct another one.
+            if (associated && associated->wasNewScriptCleared())
+                associated = nullptr;
+
+        } else {
             associated = nullptr;
+        }
 
         if (!associated)
             clasp = &PlainObject::class_;
diff --git a/js/src/vm/Opcodes.h b/js/src/vm/Opcodes.h
index 22e3689a4156..f7ef7b23cebc 100644
--- a/js/src/vm/Opcodes.h
+++ b/js/src/vm/Opcodes.h
@@ -1669,10 +1669,45 @@
      */ \
     macro(JSOP_DEFLET,        162,"deflet",     NULL,     5,  0,  0,  JOF_ATOM) \
     \
-    macro(JSOP_UNUSED163,     163,"unused163",  NULL,     1,  0,  0,  JOF_BYTE) \
-    macro(JSOP_UNUSED164,     164,"unused164",  NULL,     1,  0,  0,  JOF_BYTE) \
-    macro(JSOP_UNUSED165,     165,"unused165",  NULL,     1,  0,  0,  JOF_BYTE) \
-    macro(JSOP_UNUSED166,     166,"unused166",  NULL,     1,  0,  0,  JOF_BYTE) \
+    /*
+     * Bind the |this| value of a function to the supplied value.
+     *
+     *  Category: Variables and Scopes
+     *  Type: This
+     *  Operands:
+     *  Stack: this => this
+     */ \
+    macro(JSOP_SETTHIS  ,     163,"setthis",    NULL,     1,  1,  1,  JOF_BYTE) \
+    /*
+     * Find the function to invoke with |super()| on the scope chain.
+     *
+     *  Category: Variables and Scopes
+     *  Type: Super
+     *  Operands:
+     *  Stack: => superFun
+     */ \
+    macro(JSOP_SUPERFUN,      164,"superfun",   NULL,     1,  0,  1,  JOF_BYTE) \
+    /*
+     * Behaves exactly like JSOP_NEW, but allows JITs to distinguish the two cases.
+     *
+     *   Category: Statements
+     *   Type: Function
+     *   Operands: uint16_t argc
+     *   Stack: callee, this, args[0], ..., args[argc-1], newTarget => rval
+     *   nuses: (argc+3)
+     */ \
+    macro(JSOP_SUPERCALL,     165,"supercall",  NULL,     3, -1,  1,  JOF_UINT16|JOF_INVOKE|JOF_TYPESET) \
+    /*
+     * spreadcall variant of JSOP_SUPERCALL.
+     *
+     * Behaves exactly like JSOP_SPREADNEW.
+     *
+     *   Category: Statements
+     *   Type: Function
+     *   Operands:
+     *   Stack: callee, this, args, newTarget => rval
+     */ \
+    macro(JSOP_SPREADSUPERCALL, 166, "spreadsupercall", NULL, 1,  4,  1, JOF_BYTE|JOF_INVOKE|JOF_TYPESET) \
     macro(JSOP_UNUSED167,     167,"unused167",  NULL,     1,  0,  0,  JOF_BYTE) \
     macro(JSOP_UNUSED168,     168,"unused168",  NULL,     1,  0,  0,  JOF_BYTE) \
     macro(JSOP_UNUSED169,     169,"unused169",  NULL,     1,  0,  0,  JOF_BYTE) \
diff --git a/js/src/vm/SavedStacks.cpp b/js/src/vm/SavedStacks.cpp
index 1e30548bede5..8dbfe38771ed 100644
--- a/js/src/vm/SavedStacks.cpp
+++ b/js/src/vm/SavedStacks.cpp
@@ -6,6 +6,7 @@
 
 #include "vm/SavedStacks.h"
 
+#include "mozilla/ArrayUtils.h"
 #include "mozilla/Attributes.h"
 #include "mozilla/DebugOnly.h"
 #include "mozilla/Move.h"
@@ -904,6 +905,10 @@ SavedFrame::toStringMethod(JSContext* cx, unsigned argc, Value* vp)
 bool
 SavedStacks::init()
 {
+    uint64_t seed[2];
+    random_generateSeed(seed, mozilla::ArrayLength(seed));
+    bernoulli.setRandomState(seed[0], seed[1]);
+
     if (!pcLocationMap.init())
         return false;
 
@@ -1326,16 +1331,20 @@ SavedStacks::getLocation(JSContext* cx, const FrameIter& iter, MutableHandleLoca
 }
 
 void
-SavedStacks::chooseSamplingProbability(JSContext* cx)
+SavedStacks::chooseSamplingProbability(JSCompartment* compartment)
 {
-    GlobalObject::DebuggerVector* dbgs = cx->global()->getDebuggers();
+    GlobalObject* global = compartment->maybeGlobal();
+    if (!global)
+        return;
+
+    GlobalObject::DebuggerVector* dbgs = global->getDebuggers();
     if (!dbgs || dbgs->empty())
         return;
 
     mozilla::DebugOnly<Debugger**> begin = dbgs->begin();
     mozilla::DebugOnly<bool> foundAnyDebuggers = false;
 
-    allocationSamplingProbability = 0;
+    double probability = 0;
     for (Debugger** dbgp = dbgs->begin(); dbgp < dbgs->end(); dbgp++) {
         // The set of debuggers had better not change while we're iterating,
         // such that the vector gets reallocated.
@@ -1343,11 +1352,13 @@ SavedStacks::chooseSamplingProbability(JSContext* cx)
 
         if ((*dbgp)->trackingAllocationSites && (*dbgp)->enabled) {
             foundAnyDebuggers = true;
-            allocationSamplingProbability = std::max((*dbgp)->allocationSamplingProbability,
-                                                     allocationSamplingProbability);
+            probability = std::max((*dbgp)->allocationSamplingProbability,
+                                   probability);
         }
     }
     MOZ_ASSERT(foundAnyDebuggers);
+
+    bernoulli.setProbability(probability);
 }
 
 JSObject*
@@ -1356,39 +1367,8 @@ SavedStacksMetadataCallback(JSContext* cx, JSObject* target)
     RootedObject obj(cx, target);
 
     SavedStacks& stacks = cx->compartment()->savedStacks();
-    if (stacks.allocationSkipCount > 0) {
-        stacks.allocationSkipCount--;
+    if (!stacks.bernoulli.trial())
         return nullptr;
-    }
-
-    stacks.chooseSamplingProbability(cx);
-    if (stacks.allocationSamplingProbability == 0.0)
-        return nullptr;
-
-    // If the sampling probability is set to 1.0, we are always taking a sample
-    // and can therefore leave allocationSkipCount at 0.
-    if (stacks.allocationSamplingProbability != 1.0) {
-        // Rather than generating a random number on every allocation to decide
-        // if we want to sample that particular allocation (which would be
-        // expensive), we calculate the number of allocations to skip before
-        // taking the next sample.
-        //
-        // P = the probability we sample any given event.
-        //
-        // ~P = 1-P, the probability we don't sample a given event.
-        //
-        // (~P)^n = the probability that we skip at least the next n events.
-        //
-        // let X = random between 0 and 1.
-        //
-        // floor(log base ~P of X) = n, aka the number of events we should skip
-        // until we take the next sample. Any value for X less than (~P)^n
-        // yields a skip count greater than n, so the likelihood of a skip count
-        // greater than n is (~P)^n, as required.
-        double notSamplingProb = 1.0 - stacks.allocationSamplingProbability;
-        stacks.allocationSkipCount = std::floor(std::log(random_nextDouble(&stacks.rngState)) /
-                                                std::log(notSamplingProb));
-    }
 
     AutoEnterOOMUnsafeRegion oomUnsafe;
     RootedSavedFrame frame(cx);
diff --git a/js/src/vm/SavedStacks.h b/js/src/vm/SavedStacks.h
index 977937c04979..06fdcd26d364 100644
--- a/js/src/vm/SavedStacks.h
+++ b/js/src/vm/SavedStacks.h
@@ -7,6 +7,8 @@
 #ifndef vm_SavedStacks_h
 #define vm_SavedStacks_h
 
+#include "mozilla/FastBernoulliTrial.h"
+
 #include "jscntxt.h"
 #include "jsmath.h"
 #include "jswrapper.h"
@@ -154,9 +156,7 @@ class SavedStacks {
   public:
     SavedStacks()
       : frames(),
-        allocationSamplingProbability(1.0),
-        allocationSkipCount(0),
-        rngState(0),
+        bernoulli(1.0, 0x59fdad7f6b4cc573, 0x91adf38db96a9354),
         creatingSavedFrame(false)
     { }
 
@@ -167,16 +167,15 @@ class SavedStacks {
     void     trace(JSTracer* trc);
     uint32_t count();
     void     clear();
-    void     setRNGState(uint64_t state) { rngState = state; }
+    void     setRNGState(uint64_t state0, uint64_t state1) { bernoulli.setRandomState(state0, state1); }
+    void     chooseSamplingProbability(JSCompartment*);
 
     size_t sizeOfExcludingThis(mozilla::MallocSizeOf mallocSizeOf);
 
   private:
     SavedFrame::Set frames;
-    double          allocationSamplingProbability;
-    uint32_t        allocationSkipCount;
-    uint64_t        rngState;
-    bool            creatingSavedFrame;
+    mozilla::FastBernoulliTrial bernoulli;
+    bool creatingSavedFrame;
 
     // Similar to mozilla::ReentrancyGuard, but instead of asserting against
     // reentrancy, just change the behavior of SavedStacks::saveCurrentStack to
@@ -206,7 +205,6 @@ class SavedStacks {
                                 unsigned maxFrameCount);
     SavedFrame* getOrCreateSavedFrame(JSContext* cx, SavedFrame::HandleLookup lookup);
     SavedFrame* createFrameFromLookup(JSContext* cx, SavedFrame::HandleLookup lookup);
-    void        chooseSamplingProbability(JSContext* cx);
 
     // Cache for memoizing PCToLineNumber lookups.
 
diff --git a/js/src/vm/Stack.cpp b/js/src/vm/Stack.cpp
index 6de93ec6eb6c..47c5d5f1ba68 100644
--- a/js/src/vm/Stack.cpp
+++ b/js/src/vm/Stack.cpp
@@ -258,13 +258,19 @@ InterpreterFrame::prologue(JSContext* cx)
     if (fun()->needsCallObject() && !initFunctionScopeObjects(cx))
         return false;
 
-    if (isConstructing() && functionThis().isPrimitive()) {
-        RootedObject callee(cx, &this->callee());
-        JSObject* obj = CreateThisForFunction(cx, callee,
-                                              createSingleton() ? SingletonObject : GenericObject);
-        if (!obj)
-            return false;
-        functionThis() = ObjectValue(*obj);
+    if (isConstructing()) {
+        if (script->isDerivedClassConstructor()) {
+            MOZ_ASSERT(callee().isClassConstructor());
+            functionThis() = MagicValue(JS_UNINITIALIZED_LEXICAL);
+        } else if (functionThis().isPrimitive()) {
+            RootedObject callee(cx, &this->callee());
+            RootedObject newTarget(cx, &this->newTarget().toObject());
+            JSObject* obj = CreateThisForFunction(cx, callee, newTarget,
+                                                  createSingleton() ? SingletonObject : GenericObject);
+            if (!obj)
+                return false;
+            functionThis() = ObjectValue(*obj);
+        }
     }
 
     return probes::EnterScript(cx, script, script->functionNonDelazifying(), this);
@@ -316,6 +322,43 @@ InterpreterFrame::epilogue(JSContext* cx)
         setReturnValue(ObjectValue(constructorThis()));
 }
 
+bool
+InterpreterFrame::checkThis(JSContext* cx)
+{
+    if (script()->isDerivedClassConstructor()) {
+        MOZ_ASSERT(isNonEvalFunctionFrame());
+        MOZ_ASSERT(fun()->isClassConstructor());
+
+        if (thisValue().isMagic(JS_UNINITIALIZED_LEXICAL)) {
+            RootedFunction func(cx, fun());
+            return ThrowUninitializedThis(cx, this);
+        }
+    }
+    return true;
+}
+
+bool
+InterpreterFrame::checkReturn(JSContext* cx)
+{
+    if (script()->isDerivedClassConstructor()) {
+        MOZ_ASSERT(isNonEvalFunctionFrame());
+        MOZ_ASSERT(callee().isClassConstructor());
+
+        HandleValue retVal = returnValue();
+        if (retVal.isObject())
+            return true;
+
+        if (!retVal.isUndefined()) {
+            ReportValueError(cx, JSMSG_BAD_DERIVED_RETURN, JSDVG_IGNORE_STACK, retVal, nullptr);
+            return false;
+        }
+
+        if (!checkThis(cx))
+            return false;
+    }
+    return true;
+}
+
 bool
 InterpreterFrame::pushBlock(JSContext* cx, StaticBlockObject& block)
 {
diff --git a/js/src/vm/Stack.h b/js/src/vm/Stack.h
index 731c0bb0dfa9..b6fd39364a09 100644
--- a/js/src/vm/Stack.h
+++ b/js/src/vm/Stack.h
@@ -452,6 +452,9 @@ class InterpreterFrame
     bool prologue(JSContext* cx);
     void epilogue(JSContext* cx);
 
+    bool checkReturn(JSContext* cx);
+    bool checkThis(JSContext* cx);
+
     bool initFunctionScopeObjects(JSContext* cx);
 
     /*
@@ -738,6 +741,14 @@ class InterpreterFrame
         return argv()[-1];
     }
 
+    void setDerivedConstructorThis(HandleObject thisv) {
+        MOZ_ASSERT(isNonEvalFunctionFrame());
+        MOZ_ASSERT(script()->isDerivedClassConstructor());
+        MOZ_ASSERT(callee().isClassConstructor());
+        MOZ_ASSERT(thisValue().isMagic(JS_UNINITIALIZED_LEXICAL));
+        argv()[-1] = ObjectValue(*thisv);
+    }
+
     /*
      * Callee
      *
diff --git a/js/src/vm/Xdr.h b/js/src/vm/Xdr.h
index e65fc7cb8b13..296357af9f75 100644
--- a/js/src/vm/Xdr.h
+++ b/js/src/vm/Xdr.h
@@ -29,11 +29,11 @@ namespace js {
  *
  *  https://developer.mozilla.org/en-US/docs/SpiderMonkey/Internals/Bytecode
  */
-static const uint32_t XDR_BYTECODE_VERSION_SUBTRAHEND = 310;
+static const uint32_t XDR_BYTECODE_VERSION_SUBTRAHEND = 312;
 static const uint32_t XDR_BYTECODE_VERSION =
     uint32_t(0xb973c0de - XDR_BYTECODE_VERSION_SUBTRAHEND);
 
-static_assert(JSErr_Limit == 415,
+static_assert(JSErr_Limit == 419,
               "GREETINGS, POTENTIAL SUBTRAHEND INCREMENTER! If you added or "
               "removed MSG_DEFs from js.msg, you should increment "
               "XDR_BYTECODE_VERSION_SUBTRAHEND and update this assertion's "
diff --git a/js/xpconnect/idl/xpccomponents.idl b/js/xpconnect/idl/xpccomponents.idl
index f33e6ca12d3d..b531ae911f52 100644
--- a/js/xpconnect/idl/xpccomponents.idl
+++ b/js/xpconnect/idl/xpccomponents.idl
@@ -123,7 +123,7 @@ interface ScheduledGCCallback : nsISupports
 /**
 * interface of Components.utils
 */
-[scriptable, uuid(e04a4a58-2b5e-4a74-941a-0d344b057c5a)]
+[scriptable, uuid(eaeab2c0-ada3-4c22-b36d-70320dd923ba)]
 interface nsIXPCComponents_Utils : nsISupports
 {
 
@@ -488,16 +488,6 @@ interface nsIXPCComponents_Utils : nsISupports
     [implicit_jscontext]
     void forcePermissiveCOWs();
 
-    /*
-     * Disables the XPConnect security checks that deny access to callables and
-     * accessor descriptors on COWs. Do not use this unless you are bholley.
-     *
-     * For the benefit of his magesty TCPSocket while he takes his sweet time
-     * converting to WebIDL. See bug 885982.
-     */
-    [implicit_jscontext]
-    void skipCOWCallableChecks();
-
     /*
      * Forces the usage of a privileged |Components| object for a potentially-
      * unprivileged scope. This will crash if used outside of automation.
diff --git a/js/xpconnect/src/XPCComponents.cpp b/js/xpconnect/src/XPCComponents.cpp
index f8be53c0a037..800eee746e69 100644
--- a/js/xpconnect/src/XPCComponents.cpp
+++ b/js/xpconnect/src/XPCComponents.cpp
@@ -2949,13 +2949,6 @@ nsXPCComponents_Utils::ForcePermissiveCOWs(JSContext* cx)
     return NS_OK;
 }
 
-NS_IMETHODIMP
-nsXPCComponents_Utils::SkipCOWCallableChecks(JSContext* cx)
-{
-    CompartmentPrivate::Get(CurrentGlobalOrNull(cx))->skipCOWCallableChecks = true;
-    return NS_OK;
-}
-
 NS_IMETHODIMP
 nsXPCComponents_Utils::ForcePrivilegedComponentsForScope(HandleValue vscope,
                                                          JSContext* cx)
diff --git a/js/xpconnect/src/xpcprivate.h b/js/xpconnect/src/xpcprivate.h
index 0b521c219779..61f12597262c 100644
--- a/js/xpconnect/src/xpcprivate.h
+++ b/js/xpconnect/src/xpcprivate.h
@@ -3682,7 +3682,6 @@ public:
         , skipWriteToGlobalPrototype(false)
         , universalXPConnectEnabled(false)
         , forcePermissiveCOWs(false)
-        , skipCOWCallableChecks(false)
         , scriptability(c)
         , scope(nullptr)
     {
@@ -3743,10 +3742,6 @@ public:
     // Using it in production is inherently unsafe.
     bool forcePermissiveCOWs;
 
-    // Disables the XPConnect security checks that deny access to callables and
-    // accessor descriptors on COWs. Do not use this unless you are bholley.
-    bool skipCOWCallableChecks;
-
     // Whether we've emitted a warning about a property that was filtered out
     // by a security wrapper. See XrayWrapper.cpp.
     bool wrapperDenialWarnings[WrapperDenialTypeCount];
diff --git a/js/xpconnect/wrappers/AccessCheck.cpp b/js/xpconnect/wrappers/AccessCheck.cpp
index d14d1a317a4f..72b46f172f50 100644
--- a/js/xpconnect/wrappers/AccessCheck.cpp
+++ b/js/xpconnect/wrappers/AccessCheck.cpp
@@ -412,18 +412,17 @@ ExposedPropertiesOnly::check(JSContext* cx, HandleObject wrapper, HandleId id, W
     }
 
     // Inspect the property on the underlying object to check for red flags.
-    bool skipCallableChecks = CompartmentPrivate::Get(wrappedObject)->skipCOWCallableChecks;
     if (!JS_GetPropertyDescriptorById(cx, wrappedObject, id, &desc))
         return false;
 
     // Reject accessor properties.
-    if (!skipCallableChecks && desc.hasGetterOrSetter()) {
+    if (desc.hasGetterOrSetter()) {
         EnterAndThrow(cx, wrapper, "Exposing privileged accessor properties is prohibited");
         return false;
     }
 
     // Reject privileged or cross-origin callables.
-    if (!skipCallableChecks && desc.value().isObject()) {
+    if (desc.value().isObject()) {
         RootedObject maybeCallable(cx, js::UncheckedUnwrap(&desc.value().toObject()));
         if (JS::IsCallable(maybeCallable) && !AccessCheck::subsumes(wrapper, maybeCallable)) {
             EnterAndThrow(cx, wrapper, "Exposing privileged or cross-origin callable is prohibited");
diff --git a/layout/base/AccessibleCaretManager.cpp b/layout/base/AccessibleCaretManager.cpp
index c939de383831..1541c331b2a9 100644
--- a/layout/base/AccessibleCaretManager.cpp
+++ b/layout/base/AccessibleCaretManager.cpp
@@ -453,6 +453,10 @@ AccessibleCaretManager::OnScrollStart()
 {
   AC_LOG("%s", __FUNCTION__);
 
+  if (GetCaretMode() == CaretMode::Cursor) {
+    mFirstCaretAppearanceOnScrollStart = mFirstCaret->GetAppearance();
+  }
+
   HideCarets();
 }
 
@@ -464,12 +468,16 @@ AccessibleCaretManager::OnScrollEnd()
   }
 
   if (GetCaretMode() == CaretMode::Cursor) {
-    AC_LOG("%s: HideCarets()", __FUNCTION__);
-    HideCarets();
-  } else {
-    AC_LOG("%s: UpdateCarets()", __FUNCTION__);
-    UpdateCarets();
+    mFirstCaret->SetAppearance(mFirstCaretAppearanceOnScrollStart);
+    if (!mFirstCaret->IsLogicallyVisible()) {
+      // If the caret is hide (Appearance::None) due to timeout or blur, no need
+      // to update it.
+      return;
+    }
   }
+
+  AC_LOG("%s: UpdateCarets()", __FUNCTION__);
+  UpdateCarets();
 }
 
 void
diff --git a/layout/base/AccessibleCaretManager.h b/layout/base/AccessibleCaretManager.h
index 2fc314c90764..6fc050d1231c 100644
--- a/layout/base/AccessibleCaretManager.h
+++ b/layout/base/AccessibleCaretManager.h
@@ -7,6 +7,7 @@
 #ifndef AccessibleCaretManager_h
 #define AccessibleCaretManager_h
 
+#include "AccessibleCaret.h"
 #include "nsCOMPtr.h"
 #include "nsCoord.h"
 #include "nsIFrame.h"
@@ -30,8 +31,6 @@ class Element;
 class Selection;
 } // namespace dom
 
-class AccessibleCaret;
-
 // -----------------------------------------------------------------------------
 // AccessibleCaretManager does not deal with events or callbacks directly. It
 // relies on AccessibleCaretEventHub to call its public methods to do the work.
@@ -225,6 +224,11 @@ protected:
   // The caret mode since last update carets.
   CaretMode mLastUpdateCaretMode = CaretMode::None;
 
+  // Store the appearance of the first caret when calling OnScrollStart so that
+  // it can be restored in OnScrollEnd.
+  AccessibleCaret::Appearance mFirstCaretAppearanceOnScrollStart =
+                                 AccessibleCaret::Appearance::None;
+
   static const int32_t kAutoScrollTimerDelay = 30;
 
   // Clicking on the boundary of input or textarea will move the caret to the
diff --git a/layout/base/gtest/TestAccessibleCaretManager.cpp b/layout/base/gtest/TestAccessibleCaretManager.cpp
index 2c7783a6a960..acd11ab13827 100644
--- a/layout/base/gtest/TestAccessibleCaretManager.cpp
+++ b/layout/base/gtest/TestAccessibleCaretManager.cpp
@@ -57,6 +57,7 @@ public:
   public:
     using CaretMode = AccessibleCaretManager::CaretMode;
     using AccessibleCaretManager::UpdateCarets;
+    using AccessibleCaretManager::HideCarets;
 
     MockAccessibleCaretManager()
       : AccessibleCaretManager(nullptr)
@@ -379,4 +380,118 @@ TEST_F(AccessibleCaretManagerTester, TestScrollInSelectionMode)
   EXPECT_EQ(SecondCaretAppearance(), Appearance::NormalNotShown);
 }
 
+TEST_F(AccessibleCaretManagerTester, TestScrollInCursorModeWhenLogicallyVisible)
+{
+  EXPECT_CALL(mManager, GetCaretMode())
+    .WillRepeatedly(Return(CaretMode::Cursor));
+
+  EXPECT_CALL(mManager, HasNonEmptyTextContent(_))
+    .WillRepeatedly(Return(true));
+
+  MockFunction<void(std::string aCheckPointName)> check;
+  {
+    InSequence dummy;
+
+    EXPECT_CALL(mManager, DispatchCaretStateChangedEvent(
+                  CaretChangedReason::Updateposition)).Times(1);
+    EXPECT_CALL(check, Call("updatecarets"));
+
+    EXPECT_CALL(mManager, DispatchCaretStateChangedEvent(
+                  CaretChangedReason::Visibilitychange)).Times(1);
+    EXPECT_CALL(check, Call("scrollstart1"));
+
+    // After scroll ended, the caret is out of scroll port.
+    EXPECT_CALL(mManager.FirstCaret(), SetPosition(_, _))
+      .WillRepeatedly(Return(PositionChangedResult::Invisible));
+    EXPECT_CALL(mManager, DispatchCaretStateChangedEvent(
+                  CaretChangedReason::Updateposition)).Times(1);
+    EXPECT_CALL(check, Call("scrollend1"));
+
+    EXPECT_CALL(mManager, DispatchCaretStateChangedEvent(
+                  CaretChangedReason::Visibilitychange)).Times(1);
+    EXPECT_CALL(check, Call("scrollstart2"));
+
+    // After scroll ended, the caret is visible again.
+    EXPECT_CALL(mManager.FirstCaret(), SetPosition(_, _))
+      .WillRepeatedly(Return(PositionChangedResult::Changed));
+    EXPECT_CALL(mManager, DispatchCaretStateChangedEvent(
+                  CaretChangedReason::Updateposition)).Times(1);
+    EXPECT_CALL(check, Call("scrollend2"));
+  }
+
+  mManager.UpdateCarets();
+  EXPECT_EQ(FirstCaretAppearance(), Appearance::Normal);
+  check.Call("updatecarets");
+
+  mManager.OnScrollStart();
+  EXPECT_EQ(FirstCaretAppearance(), Appearance::None);
+  check.Call("scrollstart1");
+
+  mManager.OnScrollEnd();
+  EXPECT_EQ(FirstCaretAppearance(), Appearance::NormalNotShown);
+  check.Call("scrollend1");
+
+  mManager.OnScrollStart();
+  EXPECT_EQ(FirstCaretAppearance(), Appearance::None);
+  check.Call("scrollstart2");
+
+  mManager.OnScrollEnd();
+  EXPECT_EQ(FirstCaretAppearance(), Appearance::Normal);
+  check.Call("scrollend2");
+}
+
+TEST_F(AccessibleCaretManagerTester, TestScrollInCursorModeWhenHidden)
+{
+  EXPECT_CALL(mManager, GetCaretMode())
+    .WillRepeatedly(Return(CaretMode::Cursor));
+
+  EXPECT_CALL(mManager, HasNonEmptyTextContent(_))
+    .WillRepeatedly(Return(true));
+
+  MockFunction<void(std::string aCheckPointName)> check;
+  {
+    InSequence dummy;
+
+    EXPECT_CALL(mManager, DispatchCaretStateChangedEvent(
+                  CaretChangedReason::Updateposition)).Times(1);
+    EXPECT_CALL(check, Call("updatecarets"));
+
+    EXPECT_CALL(mManager, DispatchCaretStateChangedEvent(
+                  CaretChangedReason::Visibilitychange)).Times(1);
+    EXPECT_CALL(check, Call("hidecarets"));
+
+    // After scroll ended, the caret is out of scroll port.
+    EXPECT_CALL(mManager.FirstCaret(), SetPosition(_, _))
+      .WillRepeatedly(Return(PositionChangedResult::Invisible));
+    EXPECT_CALL(check, Call("scrollend1"));
+
+    // After scroll ended, the caret is visible again.
+    EXPECT_CALL(mManager.FirstCaret(), SetPosition(_, _))
+      .WillRepeatedly(Return(PositionChangedResult::Changed));
+    EXPECT_CALL(check, Call("scrollend2"));
+  }
+
+  mManager.UpdateCarets();
+  EXPECT_EQ(FirstCaretAppearance(), Appearance::Normal);
+  check.Call("updatecarets");
+
+  mManager.HideCarets();
+  EXPECT_EQ(FirstCaretAppearance(), Appearance::None);
+  check.Call("hidecarets");
+
+  mManager.OnScrollStart();
+  EXPECT_EQ(FirstCaretAppearance(), Appearance::None);
+
+  mManager.OnScrollEnd();
+  EXPECT_EQ(FirstCaretAppearance(), Appearance::None);
+  check.Call("scrollend1");
+
+  mManager.OnScrollStart();
+  EXPECT_EQ(FirstCaretAppearance(), Appearance::None);
+
+  mManager.OnScrollEnd();
+  EXPECT_EQ(FirstCaretAppearance(), Appearance::None);
+  check.Call("scrollend2");
+}
+
 } // namespace mozilla
diff --git a/layout/style/CSSStyleSheet.cpp b/layout/style/CSSStyleSheet.cpp
index a75af511d89d..36db0ff3b8f4 100644
--- a/layout/style/CSSStyleSheet.cpp
+++ b/layout/style/CSSStyleSheet.cpp
@@ -1791,11 +1791,17 @@ CSSStyleSheet::SubjectSubsumesInnerPrincipal()
     return NS_ERROR_DOM_SECURITY_ERR;
   }
 
-  // Now make sure we set the principal of our inner to the
-  // subjectPrincipal.  That means we need a unique inner, of
-  // course.  But we don't want to do that if we're not complete
-  // yet.  Luckily, all the callers of this method throw anyway if
-  // not complete, so we can just do that here too.
+  // Now make sure we set the principal of our inner to the subjectPrincipal.
+  // We do this because we're in a situation where the caller would not normally
+  // be able to access the sheet, but the sheet has opted in to being read.
+  // Unfortunately, that means it's also opted in to being _edited_, and if the
+  // caller now makes edits to the sheet we want the resulting resource loads,
+  // if any, to look as if they are coming from the caller's principal, not the
+  // original sheet principal.
+  //
+  // That means we need a unique inner, of course.  But we don't want to do that
+  // if we're not complete yet.  Luckily, all the callers of this method throw
+  // anyway if not complete, so we can just do that here too.
   if (!mInner->mComplete) {
     return NS_ERROR_DOM_INVALID_ACCESS_ERR;
   }
diff --git a/layout/style/nsCSSPropList.h b/layout/style/nsCSSPropList.h
index a274ec82b2c0..397b7581d54f 100644
--- a/layout/style/nsCSSPropList.h
+++ b/layout/style/nsCSSPropList.h
@@ -3618,19 +3618,17 @@ CSS_PROP_POSITION(
     kWidthKTable,
     offsetof(nsStylePosition, mWidth),
     eStyleAnimType_Coord)
-#ifndef CSS_PROP_LIST_EXCLUDE_INTERNAL
 CSS_PROP_USERINTERFACE(
     -moz-window-dragging,
     _moz_window_dragging,
     CSS_PROP_DOMPROP_PREFIXED(WindowDragging),
-    CSS_PROPERTY_INTERNAL |
-        CSS_PROPERTY_PARSE_VALUE |
-        CSS_PROPERTY_ENABLED_IN_UA_SHEETS_AND_CHROME,
+    CSS_PROPERTY_PARSE_VALUE,
     "",
     VARIANT_HK,
     kWindowDraggingKTable,
     CSS_PROP_NO_OFFSET,
     eStyleAnimType_None)
+#ifndef CSS_PROP_LIST_EXCLUDE_INTERNAL
 CSS_PROP_UIRESET(
     -moz-window-shadow,
     _moz_window_shadow,
diff --git a/layout/style/test/ListCSSProperties.cpp b/layout/style/test/ListCSSProperties.cpp
index 52a6f5c1da8f..b34d24e0a298 100644
--- a/layout/style/test/ListCSSProperties.cpp
+++ b/layout/style/test/ListCSSProperties.cpp
@@ -114,7 +114,6 @@ const char *gInaccessibleProperties[] = {
     "-moz-math-display", // parsed by UA sheets only
     "-moz-top-layer", // parsed by UA sheets only
     "-moz-min-font-size-ratio", // parsed by UA sheets only
-    "-moz-window-dragging", // chrome-only internal properties
     "-moz-window-shadow" // chrome-only internal properties
 };
 
diff --git a/layout/style/test/property_database.js b/layout/style/test/property_database.js
index eb36600c10c9..e74486493073 100644
--- a/layout/style/test/property_database.js
+++ b/layout/style/test/property_database.js
@@ -3969,6 +3969,14 @@ var gCSSProperties = {
     other_values: [ "non-scaling-stroke" ],
     invalid_values: []
   },
+  "-moz-window-dragging": {
+    domProp: "MozWindowDragging",
+    inherited: true,
+    type: CSS_TYPE_LONGHAND,
+    initial_values: [ "no-drag" ],
+    other_values: [ "drag" ],
+    invalid_values: [ "none" ]
+  },
   "align-content": {
     domProp: "alignContent",
     inherited: false,
@@ -6623,14 +6631,6 @@ for (var prop in gCSSProperties) {
 if (false) {
   // TODO These properties are chrome-only, and are not exposed via CSSOM.
   // We may still want to find a way to test them. See bug 1206999.
-  gCSSProperties["-moz-window-dragging"] = {
-    //domProp: "MozWindowDragging",
-    inherited: true,
-    type: CSS_TYPE_LONGHAND,
-    initial_values: [ "no-drag" ],
-    other_values: [ "drag" ],
-    invalid_values: [ "none" ]
-  };
   gCSSProperties["-moz-window-shadow"] = {
     //domProp: "MozWindowShadow",
     inherited: false,
diff --git a/layout/xul/nsMenuPopupFrame.cpp b/layout/xul/nsMenuPopupFrame.cpp
index 6a986d193b6b..5d1ad9e49885 100644
--- a/layout/xul/nsMenuPopupFrame.cpp
+++ b/layout/xul/nsMenuPopupFrame.cpp
@@ -1845,8 +1845,7 @@ nsMenuPopupFrame::ChangeMenuItem(nsMenuFrame* aMenuItem,
           // Fire a command event as the new item, but we don't want to close
           // the menu, blink it, or update any other state of the menuitem. The
           // command event will cause the item to be selected.
-          nsContentUtils::DispatchXULCommand(aMenuItem->GetContent(),
-                                             nsContentUtils::IsCallerChrome(),
+          nsContentUtils::DispatchXULCommand(aMenuItem->GetContent(), /* aTrusted = */ true,
                                              nullptr, PresContext()->PresShell(),
                                              false, false, false, false);
         }
diff --git a/mfbt/Assertions.h b/mfbt/Assertions.h
index 6184d0d2c3f9..26319081c0fc 100644
--- a/mfbt/Assertions.h
+++ b/mfbt/Assertions.h
@@ -23,7 +23,6 @@
 
 #if defined(MOZ_CRASHREPORTER) && defined(MOZILLA_INTERNAL_API) && \
     !defined(MOZILLA_EXTERNAL_LINKAGE) && defined(__cplusplus)
-#  define MOZ_CRASH_CRASHREPORT
 namespace CrashReporter {
 // This declaration is present here as well as in nsExceptionHandler.h
 // nsExceptionHandler.h is not directly included in this file as it includes
@@ -33,6 +32,10 @@ namespace CrashReporter {
 // nsExceptionHandler.h
 void AnnotateMozCrashReason(const char* aReason);
 } // namespace CrashReporter
+
+#  define MOZ_CRASH_ANNOTATE(...) CrashReporter::AnnotateMozCrashReason("" __VA_ARGS__)
+#else
+#  define MOZ_CRASH_ANNOTATE(...) do { /* nothing */ } while (0)
 #endif
 
 #include <stddef.h>
@@ -263,19 +266,16 @@ __declspec(noreturn) __inline void MOZ_NoReturn() {}
  * corrupted.
  */
 #ifndef DEBUG
-#  ifdef MOZ_CRASH_CRASHREPORT
-#    define MOZ_CRASH(...) \
-       do { \
-         CrashReporter::AnnotateMozCrashReason("MOZ_CRASH(" __VA_ARGS__ ")"); \
-         MOZ_REALLY_CRASH(); \
-       } while (0)
-#  else
-#    define MOZ_CRASH(...) MOZ_REALLY_CRASH()
-#  endif
+#  define MOZ_CRASH(...) \
+     do { \
+       MOZ_CRASH_ANNOTATE("MOZ_CRASH(" __VA_ARGS__ ")"); \
+       MOZ_REALLY_CRASH(); \
+     } while (0)
 #else
 #  define MOZ_CRASH(...) \
      do { \
        MOZ_ReportCrash("" __VA_ARGS__, __FILE__, __LINE__); \
+       MOZ_CRASH_ANNOTATE("MOZ_CRASH(" __VA_ARGS__ ")"); \
        MOZ_REALLY_CRASH(); \
      } while (0)
 #endif
@@ -382,6 +382,7 @@ struct AssertionConditionType
     MOZ_VALIDATE_ASSERT_CONDITION_TYPE(expr); \
     if (MOZ_UNLIKELY(!(expr))) { \
       MOZ_ReportAssertionFailure(#expr, __FILE__, __LINE__); \
+      MOZ_CRASH_ANNOTATE("MOZ_RELEASE_ASSERT(" #expr ")"); \
       MOZ_REALLY_CRASH(); \
     } \
   } while (0)
@@ -391,6 +392,7 @@ struct AssertionConditionType
     MOZ_VALIDATE_ASSERT_CONDITION_TYPE(expr); \
     if (MOZ_UNLIKELY(!(expr))) { \
       MOZ_ReportAssertionFailure(#expr " (" explain ")", __FILE__, __LINE__); \
+      MOZ_CRASH_ANNOTATE("MOZ_RELEASE_ASSERT(" #expr ") (" explain ")"); \
       MOZ_REALLY_CRASH(); \
     } \
   } while (0)
diff --git a/mfbt/FastBernoulliTrial.h b/mfbt/FastBernoulliTrial.h
new file mode 100644
index 000000000000..8d7f19621bfd
--- /dev/null
+++ b/mfbt/FastBernoulliTrial.h
@@ -0,0 +1,376 @@
+/* -*- Mode: C++; tab-width: 8; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
+/* vim: set ts=8 sts=2 et sw=2 tw=80: */
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+#ifndef mozilla_FastBernoulliTrial_h
+#define mozilla_FastBernoulliTrial_h
+
+#include "mozilla/Assertions.h"
+#include "mozilla/XorShift128PlusRNG.h"
+
+#include <cmath>
+#include <stdint.h>
+
+namespace mozilla {
+
+/**
+ * class FastBernoulliTrial: Efficient sampling with uniform probability
+ *
+ * When gathering statistics about a program's behavior, we may be observing
+ * events that occur very frequently (e.g., function calls or memory
+ * allocations) and we may be gathering information that is somewhat expensive
+ * to produce (e.g., call stacks). Sampling all the events could have a
+ * significant impact on the program's performance.
+ *
+ * Why not just sample every N'th event? This technique is called "systematic
+ * sampling"; it's simple and efficient, and it's fine if we imagine a
+ * patternless stream of events. But what if we're sampling allocations, and the
+ * program happens to have a loop where each iteration does exactly N
+ * allocations? You would end up sampling the same allocation every time through
+ * the loop; the entire rest of the loop becomes invisible to your measurements!
+ * More generally, if each iteration does M allocations, and M and N have any
+ * common divisor at all, most allocation sites will never be sampled. If
+ * they're both even, say, the odd-numbered allocations disappear from your
+ * results.
+ *
+ * Ideally, we'd like each event to have some probability P of being sampled,
+ * independent of its neighbors and of its position in the sequence. This is
+ * called "Bernoulli sampling", and it doesn't suffer from any of the problems
+ * mentioned above.
+ *
+ * One disadvantage of Bernoulli sampling is that you can't be sure exactly how
+ * many samples you'll get: technically, it's possible that you might sample
+ * none of them, or all of them. But if the number of events N is large, these
+ * aren't likely outcomes; you can generally expect somewhere around P * N
+ * events to be sampled.
+ *
+ * The other disadvantage of Bernoulli sampling is that you have to generate a
+ * random number for every event, which can be slow.
+ *
+ * [significant pause]
+ *
+ * BUT NOT WITH THIS CLASS! FastBernoulliTrial lets you do true Bernoulli
+ * sampling, while generating a fresh random number only when we do decide to
+ * sample an event, not on every trial. When it decides not to sample, a call to
+ * |FastBernoulliTrial::trial| is nothing but decrementing a counter and
+ * comparing it to zero. So the lower your sampling probability is, the less
+ * overhead FastBernoulliTrial imposes.
+ *
+ * Probabilities of 0 and 1 are handled efficiently. (In neither case need we
+ * ever generate a random number at all.)
+ *
+ * The essential API:
+ *
+ * - FastBernoulliTrial(double P)
+ *   Construct an instance that selects events with probability P.
+ *
+ * - FastBernoulliTrial::trial()
+ *   Return true with probability P. Call this each time an event occurs, to
+ *   decide whether to sample it or not.
+ *
+ * - FastBernoulliTrial::trial(size_t n)
+ *   Equivalent to calling trial() |n| times, and returning true if any of those
+ *   calls do. However, like trial, this runs in fast constant time.
+ *
+ *   What is this good for? In some applications, some events are "bigger" than
+ *   others. For example, large allocations are more significant than small
+ *   allocations. Perhaps we'd like to imagine that we're drawing allocations
+ *   from a stream of bytes, and performing a separate Bernoulli trial on every
+ *   byte from the stream. We can accomplish this by calling |t.trial(S)| for
+ *   the number of bytes S, and sampling the event if that returns true.
+ *
+ *   Of course, this style of sampling needs to be paired with analysis and
+ *   presentation that makes the size of the event apparent, lest trials with
+ *   large values for |n| appear to be indistinguishable from those with small
+ *   values for |n|.
+ */
+class FastBernoulliTrial {
+  /*
+   * This comment should just read, "Generate skip counts with a geometric
+   * distribution", and leave everyone to go look that up and see why it's the
+   * right thing to do, if they don't know already.
+   *
+   * BUT IF YOU'RE CURIOUS, COMMENTS ARE FREE...
+   *
+   * Instead of generating a fresh random number for every trial, we can
+   * randomly generate a count of how many times we should return false before
+   * the next time we return true. We call this a "skip count". Once we've
+   * returned true, we generate a fresh skip count, and begin counting down
+   * again.
+   *
+   * Here's an awesome fact: by exercising a little care in the way we generate
+   * skip counts, we can produce results indistinguishable from those we would
+   * get "rolling the dice" afresh for every trial.
+   *
+   * In short, skip counts in Bernoulli trials of probability P obey a geometric
+   * distribution. If a random variable X is uniformly distributed from [0..1),
+   * then std::floor(std::log(X) / std::log(1-P)) has the appropriate geometric
+   * distribution for the skip counts.
+   *
+   * Why that formula?
+   *
+   * Suppose we're to return |true| with some probability P, say, 0.3. Spread
+   * all possible futures along a line segment of length 1. In portion P of
+   * those cases, we'll return true on the next call to |trial|; the skip count
+   * is 0. For the remaining portion 1-P of cases, the skip count is 1 or more.
+   *
+   * skip:                0                         1 or more
+   *             |------------------^-----------------------------------------|
+   * portion:            0.3                            0.7
+   *                      P                             1-P
+   *
+   * But the "1 or more" section of the line is subdivided the same way: *within
+   * that section*, in portion P the second call to |trial()| returns true, and in
+   * portion 1-P it returns false a second time; the skip count is two or more.
+   * So we return true on the second call in proportion 0.7 * 0.3, and skip at
+   * least the first two in proportion 0.7 * 0.7.
+   *
+   * skip:                0                1              2 or more
+   *             |------------------^------------^----------------------------|
+   * portion:            0.3           0.7 * 0.3          0.7 * 0.7
+   *                      P             (1-P)*P            (1-P)^2
+   *
+   * We can continue to subdivide:
+   *
+   * skip >= 0:  |------------------------------------------------- (1-P)^0 --|
+   * skip >= 1:  |                  ------------------------------- (1-P)^1 --|
+   * skip >= 2:  |                               ------------------ (1-P)^2 --|
+   * skip >= 3:  |                                 ^     ---------- (1-P)^3 --|
+   * skip >= 4:  |                                 .            --- (1-P)^4 --|
+   *                                               .
+   *                                               ^X, see below
+   *
+   * In other words, the likelihood of the next n calls to |trial| returning
+   * false is (1-P)^n. The longer a run we require, the more the likelihood
+   * drops. Further calls may return false too, but this is the probability
+   * we'll skip at least n.
+   *
+   * This is interesting, because we can pick a point along this line segment
+   * and see which skip count's range it falls within; the point X above, for
+   * example, is within the ">= 2" range, but not within the ">= 3" range, so it
+   * designates a skip count of 2. So if we pick points on the line at random
+   * and use the skip counts they fall under, that will be indistinguishable
+   * from generating a fresh random number between 0 and 1 for each trial and
+   * comparing it to P.
+   *
+   * So to find the skip count for a point X, we must ask: To what whole power
+   * must we raise 1-P such that we include X, but the next power would exclude
+   * it? This is exactly std::floor(std::log(X) / std::log(1-P)).
+   *
+   * Our algorithm is then, simply: When constructed, compute an initial skip
+   * count. Return false from |trial| that many times, and then compute a new skip
+   * count.
+   *
+   * For a call to |trial(n)|, if the skip count is greater than n, return false
+   * and subtract n from the skip count. If the skip count is less than n,
+   * return true and compute a new skip count. Since each trial is independent,
+   * it doesn't matter by how much n overshoots the skip count; we can actually
+   * compute a new skip count at *any* time without affecting the distribution.
+   * This is really beautiful.
+   */
+ public:
+  /**
+   * Construct a fast Bernoulli trial generator. Calls to |trial()| return true
+   * with probability |aProbability|. Use |aState0| and |aState1| to seed the
+   * random number generator; both may not be zero.
+   */
+  FastBernoulliTrial(double aProbability, uint64_t aState0, uint64_t aState1)
+   : mGenerator(aState0, aState1)
+  {
+    setProbability(aProbability);
+  }
+
+  /**
+   * Return true with probability |mProbability|. Call this each time an event
+   * occurs, to decide whether to sample it or not. The lower |mProbability| is,
+   * the faster this function runs.
+   */
+  bool trial() {
+    if (mSkipCount) {
+      mSkipCount--;
+      return false;
+    }
+
+    return chooseSkipCount();
+  }
+
+  /**
+   * Equivalent to calling trial() |n| times, and returning true if any of those
+   * calls do. However, like trial, this runs in fast constant time.
+   *
+   * What is this good for? In some applications, some events are "bigger" than
+   * others. For example, large allocations are more significant than small
+   * allocations. Perhaps we'd like to imagine that we're drawing allocations
+   * from a stream of bytes, and performing a separate Bernoulli trial on every
+   * byte from the stream. We can accomplish this by calling |t.trial(S)| for
+   * the number of bytes S, and sampling the event if that returns true.
+   *
+   * Of course, this style of sampling needs to be paired with analysis and
+   * presentation that makes the "size" of the event apparent, lest trials with
+   * large values for |n| appear to be indistinguishable from those with small
+   * values for |n|, despite being potentially much more likely to be sampled.
+   */
+  bool trial(size_t aCount) {
+    if (mSkipCount > aCount) {
+      mSkipCount -= aCount;
+      return false;
+    }
+
+    return chooseSkipCount();
+  }
+
+  void setRandomState(uint64_t aState0, uint64_t aState1) {
+    mGenerator.setState(aState0, aState1);
+  }
+
+  void setProbability(double aProbability) {
+    MOZ_ASSERT(0 <= aProbability && aProbability <= 1);
+    mProbability = aProbability;
+    if (0 < mProbability && mProbability < 1) {
+      /*
+       * Let's look carefully at how this calculation plays out in floating-
+       * point arithmetic. We'll assume IEEE, but the final C++ code we arrive
+       * at would still be fine if our numbers were mathematically perfect. So,
+       * while we've considered IEEE's edge cases, we haven't done anything that
+       * should be actively bad when using other representations.
+       *
+       * (In the below, read comparisons as exact mathematical comparisons: when
+       * we say something "equals 1", that means it's exactly equal to 1. We
+       * treat approximation using intervals with open boundaries: saying a
+       * value is in (0,1) doesn't specify how close to 0 or 1 the value gets.
+       * When we use closed boundaries like [1, 2**-53], we're careful to ensure
+       * the boundary values are actually representable.)
+       *
+       * - After the comparison above, we know mProbability is in (0,1).
+       *
+       * - The gaps below 1 are 2**-53, so that interval is (0, 1-2**-53].
+       *
+       * - Because the floating-point gaps near 1 are wider than those near
+       *   zero, there are many small positive doubles ε such that 1-ε rounds to
+       *   exactly 1. However, 2**-53 can be represented exactly. So
+       *   1-mProbability is in [2**-53, 1].
+       *
+       * - log(1 - mProbability) is thus in (-37, 0].
+       *
+       *   That range includes zero, but when we use mInvLogNotProbability, it
+       *   would be helpful if we could trust that it's negative. So when log(1
+       *   - mProbability) is 0, we'll just set mProbability to 0, so that
+       *   mInvLogNotProbability is not used in chooseSkipCount.
+       *
+       * - How much of the range of mProbability does this cause us to ignore?
+       *   The only value for which log returns 0 is exactly 1; the slope of log
+       *   at 1 is 1, so for small ε such that 1 - ε != 1, log(1 - ε) is -ε,
+       *   never 0. The gaps near one are larger than the gaps near zero, so if
+       *   1 - ε wasn't 1, then -ε is representable. So if log(1 - mProbability)
+       *   isn't 0, then 1 - mProbability isn't 1, which means that mProbability
+       *   is at least 2**-53, as discussed earlier. This is a sampling
+       *   likelihood of roughly one in ten trillion, which is unlikely to be
+       *   distinguishable from zero in practice.
+       *
+       *   So by forbidding zero, we've tightened our range to (-37, -2**-53].
+       *
+       * - Finally, 1 / log(1 - mProbability) is in [-2**53, -1/37). This all
+       *   falls readily within the range of an IEEE double.
+       *
+       * ALL THAT HAVING BEEN SAID: here are the five lines of actual code:
+       */
+      double logNotProbability = std::log(1 - mProbability);
+      if (logNotProbability == 0.0)
+        mProbability = 0.0;
+      else
+        mInvLogNotProbability = 1 / logNotProbability;
+    }
+
+    chooseSkipCount();
+  }
+
+ private:
+  /* The likelihood that any given call to |trial| should return true. */
+  double mProbability;
+
+  /*
+   * The value of 1/std::log(1 - mProbability), cached for repeated use.
+   *
+   * If mProbability is exactly 0 or exactly 1, we don't use this value.
+   * Otherwise, we guarantee this value is in the range [-2**53, -1/37), i.e.
+   * definitely negative, as required by chooseSkipCount. See setProbability for
+   * the details.
+   */
+  double mInvLogNotProbability;
+
+  /* Our random number generator. */
+  non_crypto::XorShift128PlusRNG mGenerator;
+
+  /* The number of times |trial| should return false before next returning true. */
+  size_t mSkipCount;
+
+  /*
+   * Choose the next skip count. This also returns the value that |trial| should
+   * return, since we have to check for the extreme values for mProbability
+   * anyway, and |trial| should never return true at all when mProbability is 0.
+   */
+  bool chooseSkipCount() {
+    /*
+     * If the probability is 1.0, every call to |trial| returns true. Make sure
+     * mSkipCount is 0.
+     */
+    if (mProbability == 1.0) {
+      mSkipCount = 0;
+      return true;
+    }
+
+    /*
+     * If the probabilility is zero, |trial| never returns true. Don't bother us
+     * for a while.
+     */
+    if (mProbability == 0.0) {
+      mSkipCount = SIZE_MAX;
+      return false;
+    }
+
+    /*
+     * What sorts of values can this call to std::floor produce?
+     *
+     * Since mGenerator.nextDouble returns a value in [0, 1-2**-53], std::log
+     * returns a value in the range [-infinity, -2**-53], all negative. Since
+     * mInvLogNotProbability is negative (see its comments), the product is
+     * positive and possibly infinite. std::floor returns +infinity unchanged.
+     * So the result will always be positive.
+     *
+     * Converting a double to an integer that is out of range for that integer
+     * is undefined behavior, so we must clamp our result to SIZE_MAX, to ensure
+     * we get an acceptable value for mSkipCount.
+     *
+     * The clamp is written carefully. Note that if we had said:
+     *
+     *    if (skipCount > SIZE_MAX)
+     *       skipCount = SIZE_MAX;
+     *
+     * that leads to undefined behavior 64-bit machines: SIZE_MAX coerced to
+     * double is 2^64, not 2^64-1, so this doesn't actually set skipCount to a
+     * value that can be safely assigned to mSkipCount.
+     *
+     * Jakub Oleson cleverly suggested flipping the sense of the comparison: if
+     * we require that skipCount < SIZE_MAX, then because of the gaps (2048)
+     * between doubles at that magnitude, the highest double less than 2^64 is
+     * 2^64 - 2048, which is fine to store in a size_t.
+     *
+     * (On 32-bit machines, all size_t values can be represented exactly in
+     * double, so all is well.)
+     */
+    double skipCount = std::floor(std::log(mGenerator.nextDouble())
+                                  * mInvLogNotProbability);
+    if (skipCount < SIZE_MAX)
+      mSkipCount = skipCount;
+    else
+      mSkipCount = SIZE_MAX;
+
+    return true;
+  }
+};
+
+}  /* namespace mozilla */
+
+#endif /* mozilla_FastBernoulliTrial_h */
diff --git a/mfbt/moz.build b/mfbt/moz.build
index c7d23819b521..cf96da62540b 100644
--- a/mfbt/moz.build
+++ b/mfbt/moz.build
@@ -39,6 +39,7 @@ EXPORTS.mozilla = [
     'EnumeratedArray.h',
     'EnumeratedRange.h',
     'EnumSet.h',
+    'FastBernoulliTrial.h',
     'FloatingPoint.h',
     'Function.h',
     'GuardObjects.h',
diff --git a/mfbt/tests/TestFastBernoulliTrial.cpp b/mfbt/tests/TestFastBernoulliTrial.cpp
new file mode 100644
index 000000000000..62d4b51a79d4
--- /dev/null
+++ b/mfbt/tests/TestFastBernoulliTrial.cpp
@@ -0,0 +1,209 @@
+/* -*- Mode: C++; tab-width: 8; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
+/* vim: set ts=8 sts=2 et sw=2 tw=80: */
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this file,
+ * You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+#include "mozilla/Assertions.h"
+#include "mozilla/FastBernoulliTrial.h"
+
+#include <math.h>
+
+// Note that because we always provide FastBernoulliTrial with a fixed
+// pseudorandom seed in these tests, the results here are completely
+// deterministic.
+//
+// A non-optimized version of this test runs in .009s on my laptop. Using larger
+// sample sizes lets us meet tighter bounds on the counts.
+
+static void
+TestProportions()
+{
+  mozilla::FastBernoulliTrial bernoulli(1.0,
+                                        698079309544035222ULL,
+                                        6012389156611637584ULL);
+
+  for (size_t i = 0; i < 100; i++)
+    MOZ_RELEASE_ASSERT(bernoulli.trial());
+
+  {
+    bernoulli.setProbability(0.5);
+    size_t count = 0;
+    for (size_t i = 0; i < 1000; i++)
+      count += bernoulli.trial();
+    MOZ_RELEASE_ASSERT(count == 496);
+  }
+
+  {
+    bernoulli.setProbability(0.001);
+    size_t count = 0;
+    for (size_t i = 0; i < 1000; i++)
+      count += bernoulli.trial();
+    MOZ_RELEASE_ASSERT(count == 2);
+  }
+
+  {
+    bernoulli.setProbability(0.85);
+    size_t count = 0;
+    for (size_t i = 0; i < 1000; i++)
+      count += bernoulli.trial();
+    MOZ_RELEASE_ASSERT(count == 852);
+  }
+
+  bernoulli.setProbability(0.0);
+  for (size_t i = 0; i < 100; i++)
+    MOZ_RELEASE_ASSERT(!bernoulli.trial());
+}
+
+static void
+TestHarmonics()
+{
+  mozilla::FastBernoulliTrial bernoulli(0.1,
+                                        698079309544035222ULL,
+                                        6012389156611637584ULL);
+
+  const size_t n = 100000;
+  bool trials[n];
+  for (size_t i = 0; i < n; i++)
+    trials[i] = bernoulli.trial();
+
+  // For each harmonic and phase, check that the proportion sampled is
+  // within acceptable bounds.
+  for (size_t harmonic = 1; harmonic < 20; harmonic++) {
+    size_t expected = n / harmonic / 10;
+    size_t low_expected = expected * 85 / 100;
+    size_t high_expected = expected * 115 / 100;
+
+    for (size_t phase = 0; phase < harmonic; phase++) {
+      size_t count = 0;
+      for (size_t i = phase; i < n; i += harmonic)
+        count += trials[i];
+
+      MOZ_RELEASE_ASSERT(low_expected <= count && count <= high_expected);
+    }
+  }
+}
+
+static void
+TestTrialN()
+{
+  mozilla::FastBernoulliTrial bernoulli(0.01,
+                                        0x67ff17e25d855942ULL,
+                                        0x74f298193fe1c5b1ULL);
+
+  {
+    size_t count = 0;
+    for (size_t i = 0; i < 10000; i++)
+      count += bernoulli.trial(1);
+
+    // Expected value: 0.01 * 10000 == 100
+    MOZ_RELEASE_ASSERT(count == 97);
+  }
+
+  {
+    size_t count = 0;
+    for (size_t i = 0; i < 10000; i++)
+      count += bernoulli.trial(3);
+
+    // Expected value: (1 - (1 - 0.01) ** 3) == 0.0297,
+    // 0.0297 * 10000 == 297
+    MOZ_RELEASE_ASSERT(count == 304);
+  }
+
+  {
+    size_t count = 0;
+    for (size_t i = 0; i < 10000; i++)
+      count += bernoulli.trial(10);
+
+    // Expected value: (1 - (1 - 0.01) ** 10) == 0.0956,
+    // 0.0956 * 10000 == 956
+    MOZ_RELEASE_ASSERT(count == 936);
+  }
+
+  {
+    size_t count = 0;
+    for (size_t i = 0; i < 10000; i++)
+      count += bernoulli.trial(100);
+
+    // Expected value: (1 - (1 - 0.01) ** 100) == 0.6339
+    // 0.6339 * 10000 == 6339
+    MOZ_RELEASE_ASSERT(count == 6372);
+  }
+
+  {
+    size_t count = 0;
+    for (size_t i = 0; i < 10000; i++)
+      count += bernoulli.trial(1000);
+
+    // Expected value: (1 - (1 - 0.01) ** 1000) == 0.9999
+    // 0.9999 * 10000 == 9999
+    MOZ_RELEASE_ASSERT(count == 9998);
+  }
+}
+
+static void
+TestChangeProbability()
+{
+  mozilla::FastBernoulliTrial bernoulli(1.0,
+                                        0x67ff17e25d855942ULL,
+                                        0x74f298193fe1c5b1ULL);
+
+  // Establish a very high skip count.
+  bernoulli.setProbability(0.0);
+
+  // This should re-establish a zero skip count.
+  bernoulli.setProbability(1.0);
+
+  // So this should return true.
+  MOZ_RELEASE_ASSERT(bernoulli.trial());
+}
+
+static void
+TestCuspProbabilities()
+{
+  /*
+   * FastBernoulliTrial takes care to avoid screwing up on edge cases. The
+   * checks here all look pretty dumb, but they exercise paths in the code that
+   * could exhibit undefined behavior if coded naïvely.
+   */
+
+  /*
+   * This should not be perceptibly different from 1; for 64-bit doubles, this
+   * is a one in ten trillion chance of the trial not succeeding. Overflows
+   * converting doubles to size_t skip counts may change this, though.
+   */
+  mozilla::FastBernoulliTrial bernoulli(nextafter(1, 0),
+                                        0x67ff17e25d855942ULL,
+                                        0x74f298193fe1c5b1ULL);
+
+  for (size_t i = 0; i < 1000; i++)
+    MOZ_RELEASE_ASSERT(bernoulli.trial());
+
+  /*
+   * This should not be perceptibly different from 0; for 64-bit doubles,
+   * the FastBernoulliTrial will actually treat this as exactly zero.
+   */
+  bernoulli.setProbability(nextafter(0, 1));
+  for (size_t i = 0; i < 1000; i++)
+    MOZ_RELEASE_ASSERT(!bernoulli.trial());
+
+  /*
+   * This should be a vanishingly low probability which FastBernoulliTrial does
+   * *not* treat as exactly zero.
+   */
+  bernoulli.setProbability(1 - nextafter(1, 0));
+  for (size_t i = 0; i < 1000; i++)
+    MOZ_RELEASE_ASSERT(!bernoulli.trial());
+}
+
+int
+main()
+{
+  TestProportions();
+  TestHarmonics();
+  TestTrialN();
+  TestChangeProbability();
+  TestCuspProbabilities();
+
+  return 0;
+}
diff --git a/mfbt/tests/moz.build b/mfbt/tests/moz.build
index f9cd9e270223..227e02a03b96 100644
--- a/mfbt/tests/moz.build
+++ b/mfbt/tests/moz.build
@@ -16,6 +16,7 @@ CppUnitTests([
     'TestCountZeroes',
     'TestEndian',
     'TestEnumSet',
+    'TestFastBernoulliTrial',
     'TestFloatingPoint',
     'TestFunction',
     'TestIntegerPrintfMacros',
diff --git a/mobile/android/base/GeckoAppShell.java b/mobile/android/base/GeckoAppShell.java
index 75fc882cb561..6699817e8600 100644
--- a/mobile/android/base/GeckoAppShell.java
+++ b/mobile/android/base/GeckoAppShell.java
@@ -133,8 +133,6 @@ public class GeckoAppShell
     // We have static members only.
     private GeckoAppShell() { }
 
-    private static GeckoEditableListener editableListener;
-
     private static final CrashHandler CRASH_HANDLER = new CrashHandler() {
         @Override
         protected String getAppPackageName() {
@@ -325,17 +323,6 @@ public class GeckoAppShell
             return;
         }
         sLayerView = lv;
-
-        // We should have a unique GeckoEditable instance per nsWindow instance,
-        // so even though we have a new view here, the underlying nsWindow is the same,
-        // and we don't create a new GeckoEditable.
-        if (editableListener == null) {
-            // Starting up; istall new Gecko-to-Java editable listener.
-            editableListener = new GeckoEditable();
-        } else {
-            // Bind the existing GeckoEditable instance to the new LayerView
-            GeckoAppShell.notifyIMEContext(GeckoEditableListener.IME_STATE_DISABLED, "", "", "");
-        }
     }
 
     @RobocopTarget
@@ -420,31 +407,6 @@ public class GeckoAppShell
         CRASH_HANDLER.uncaughtException(thread, e);
     }
 
-    @WrapForJNI
-    public static void notifyIME(int type) {
-        if (editableListener != null) {
-            editableListener.notifyIME(type);
-        }
-    }
-
-    @WrapForJNI
-    public static void notifyIMEContext(int state, String typeHint,
-                                        String modeHint, String actionHint) {
-        if (editableListener != null) {
-            editableListener.notifyIMEContext(state, typeHint,
-                                               modeHint, actionHint);
-        }
-    }
-
-    @WrapForJNI
-    public static void notifyIMEChange(String text, int start, int end, int newEnd) {
-        if (newEnd < 0) { // Selection change
-            editableListener.onSelectionChange(start, end);
-        } else { // Text change
-            editableListener.onTextChange(text, start, end, newEnd);
-        }
-    }
-
     private static final Object sEventAckLock = new Object();
     private static boolean sWaitingForEventAck;
 
@@ -2446,7 +2408,7 @@ public class GeckoAppShell
 
     private static boolean sImeWasEnabledOnLastResize = false;
     public static void viewSizeChanged() {
-        LayerView v = getLayerView();
+        GeckoView v = (GeckoView) getLayerView();
         if (v == null) {
             return;
         }
diff --git a/mobile/android/base/GeckoEditable.java b/mobile/android/base/GeckoEditable.java
index 1d0b7203491e..be7a98f6c3ee 100644
--- a/mobile/android/base/GeckoEditable.java
+++ b/mobile/android/base/GeckoEditable.java
@@ -16,7 +16,7 @@ import java.util.concurrent.Semaphore;
 
 import org.json.JSONObject;
 import org.mozilla.gecko.AppConstants.Versions;
-import org.mozilla.gecko.gfx.InputConnectionHandler;
+import org.mozilla.gecko.annotation.WrapForJNI;
 import org.mozilla.gecko.gfx.LayerView;
 import org.mozilla.gecko.util.GeckoEventListener;
 import org.mozilla.gecko.util.ThreadUtils;
@@ -348,7 +348,12 @@ final class GeckoEditable
         }
     }
 
+    @WrapForJNI
     GeckoEditable() {
+        if (DEBUG) {
+            // Called by nsWindow.
+            ThreadUtils.assertOnGeckoThread();
+        }
         mActionQueue = new ActionQueue();
         mSavedSelectionStart = -1;
         mUpdateGecko = true;
@@ -361,12 +366,41 @@ final class GeckoEditable
                 Editable.class.getClassLoader(),
                 PROXY_INTERFACES, this);
 
-        LayerView v = GeckoAppShell.getLayerView();
-        mListener = GeckoInputConnection.create(v, this);
-
         mIcRunHandler = mIcPostHandler = ThreadUtils.getUiHandler();
     }
 
+    @WrapForJNI
+    /* package */ void onViewChange(final GeckoView v) {
+        if (DEBUG) {
+            // Called by nsWindow.
+            ThreadUtils.assertOnGeckoThread();
+            Log.d(LOGTAG, "onViewChange(" + v + ")");
+        }
+
+        final GeckoEditableListener newListener = GeckoInputConnection.create(v, this);
+        geckoPostToIc(new Runnable() {
+            @Override
+            public void run() {
+                if (DEBUG) {
+                    Log.d(LOGTAG, "onViewChange (set listener)");
+                }
+                // Make sure there are no other things going on
+                mActionQueue.syncWithGecko();
+                mListener = newListener;
+            }
+        });
+
+        ThreadUtils.postToUiThread(new Runnable() {
+            @Override
+            public void run() {
+                if (DEBUG) {
+                    Log.d(LOGTAG, "onViewChange (set IC)");
+                }
+                v.setInputConnectionListener((InputConnectionListener) newListener);
+            }
+        });
+    }
+
     private boolean onIcThread() {
         return mIcRunHandler.getLooper() == Looper.myLooper();
     }
@@ -769,7 +803,7 @@ final class GeckoEditable
         }
     }
 
-    @Override
+    @WrapForJNI @Override
     public void notifyIME(final int type) {
         if (DEBUG) {
             // GeckoEditableListener methods should all be called from the Gecko thread
@@ -845,12 +879,12 @@ final class GeckoEditable
         }
     }
 
-    @Override
+    @WrapForJNI @Override
     public void notifyIMEContext(final int state, final String typeHint,
-                          final String modeHint, final String actionHint) {
-        // Because we want to be able to bind GeckoEditable to the newest LayerView instance,
-        // this can be called from the Java IC thread in addition to the Gecko thread.
+                                 final String modeHint, final String actionHint) {
         if (DEBUG) {
+            // GeckoEditableListener methods should all be called from the Gecko thread
+            ThreadUtils.assertOnGeckoThread();
             Log.d(LOGTAG, "notifyIMEContext(" +
                           getConstantName(GeckoEditableListener.class, "IME_STATE_", state) +
                           ", \"" + typeHint + "\", \"" + modeHint + "\", \"" + actionHint + "\")");
@@ -858,22 +892,12 @@ final class GeckoEditable
         geckoPostToIc(new Runnable() {
             @Override
             public void run() {
-                // Make sure there are no other things going on
-                mActionQueue.syncWithGecko();
-                // Set InputConnectionHandler in notifyIMEContext because
-                // GeckoInputConnection.notifyIMEContext calls restartInput() which will invoke
-                // InputConnectionHandler.onCreateInputConnection
-                LayerView v = GeckoAppShell.getLayerView();
-                if (v != null) {
-                    mListener = GeckoInputConnection.create(v, GeckoEditable.this);
-                    v.setInputConnectionHandler((InputConnectionHandler)mListener);
-                    mListener.notifyIMEContext(state, typeHint, modeHint, actionHint);
-                }
+                mListener.notifyIMEContext(state, typeHint, modeHint, actionHint);
             }
         });
     }
 
-    @Override
+    @WrapForJNI @Override
     public void onSelectionChange(final int start, final int end) {
         if (DEBUG) {
             // GeckoEditableListener methods should all be called from the Gecko thread
@@ -929,9 +953,9 @@ final class GeckoEditable
                TextUtils.regionMatches(mText, start, newText, 0, oldEnd - start);
     }
 
-    @Override
+    @WrapForJNI @Override
     public void onTextChange(final CharSequence text, final int start,
-                      final int unboundedOldEnd, final int unboundedNewEnd) {
+                             final int unboundedOldEnd, final int unboundedNewEnd) {
         if (DEBUG) {
             // GeckoEditableListener methods should all be called from the Gecko thread
             ThreadUtils.assertOnGeckoThread();
diff --git a/mobile/android/base/GeckoEditableListener.java b/mobile/android/base/GeckoEditableListener.java
index f8b9daa5b781..a68ba0d62137 100644
--- a/mobile/android/base/GeckoEditableListener.java
+++ b/mobile/android/base/GeckoEditableListener.java
@@ -5,13 +5,17 @@
 
 package org.mozilla.gecko;
 
+import org.mozilla.gecko.annotation.WrapForJNI;
+
 /**
  * Interface for the Editable to listen on the Gecko thread, as well as for the IC thread to listen
  * to the Editable.
  */
 interface GeckoEditableListener {
     // IME notification type for notifyIME(), corresponding to NotificationToIME enum in Gecko
+    @WrapForJNI
     int NOTIFY_IME_OPEN_VKB = -2;
+    @WrapForJNI
     int NOTIFY_IME_REPLY_EVENT = -1;
     int NOTIFY_IME_OF_FOCUS = 1;
     int NOTIFY_IME_OF_BLUR = 2;
diff --git a/mobile/android/base/GeckoEvent.java b/mobile/android/base/GeckoEvent.java
index 5c7904218543..e56910f9ad1f 100644
--- a/mobile/android/base/GeckoEvent.java
+++ b/mobile/android/base/GeckoEvent.java
@@ -73,7 +73,6 @@ public class GeckoEvent {
         KEY_EVENT(1),
         MOTION_EVENT(2),
         SENSOR_EVENT(3),
-        PROCESS_OBJECT(4),
         LOCATION_EVENT(5),
         IME_EVENT(6),
         SIZE_CHANGED(8),
@@ -159,8 +158,6 @@ public class GeckoEvent {
     public static final int ACTION_GAMEPAD_BUTTON = 1;
     public static final int ACTION_GAMEPAD_AXES = 2;
 
-    public static final int ACTION_OBJECT_LAYER_CLIENT = 1;
-
     private final int mType;
     private int mAction;
     private boolean mAckNeeded;
@@ -222,8 +219,6 @@ public class GeckoEvent {
     private float mGamepadButtonValue;
     private float[] mGamepadValues;
 
-    private Object mObject;
-
     private GeckoEvent(NativeGeckoEvent event) {
         mType = event.value;
     }
@@ -584,13 +579,6 @@ public class GeckoEvent {
         return event;
     }
 
-    public static GeckoEvent createObjectEvent(final int action, final Object object) {
-        GeckoEvent event = GeckoEvent.get(NativeGeckoEvent.PROCESS_OBJECT);
-        event.mAction = action;
-        event.mObject = object;
-        return event;
-    }
-
     public static GeckoEvent createLocationEvent(Location l) {
         GeckoEvent event = GeckoEvent.get(NativeGeckoEvent.LOCATION_EVENT);
         event.mLocation = l;
diff --git a/mobile/android/base/GeckoInputConnection.java b/mobile/android/base/GeckoInputConnection.java
index 1e4d5ff2d64c..eda840d69d63 100644
--- a/mobile/android/base/GeckoInputConnection.java
+++ b/mobile/android/base/GeckoInputConnection.java
@@ -11,7 +11,6 @@ import java.lang.reflect.Proxy;
 import java.util.concurrent.SynchronousQueue;
 
 import org.mozilla.gecko.AppConstants.Versions;
-import org.mozilla.gecko.gfx.InputConnectionHandler;
 import org.mozilla.gecko.util.Clipboard;
 import org.mozilla.gecko.util.GamepadUtils;
 import org.mozilla.gecko.util.ThreadUtils;
@@ -40,7 +39,7 @@ import android.view.inputmethod.InputMethodManager;
 
 class GeckoInputConnection
     extends BaseInputConnection
-    implements InputConnectionHandler, GeckoEditableListener {
+    implements InputConnectionListener, GeckoEditableListener {
 
     private static final boolean DEBUG = false;
     protected static final String LOGTAG = "GeckoInputConnection";
@@ -1007,7 +1006,7 @@ final class DebugGeckoInputConnection
     public static GeckoEditableListener create(View targetView,
                                                GeckoEditableClient editable) {
         final Class<?>[] PROXY_INTERFACES = { InputConnection.class,
-                InputConnectionHandler.class,
+                InputConnectionListener.class,
                 GeckoEditableListener.class };
         DebugGeckoInputConnection dgic =
                 new DebugGeckoInputConnection(targetView, editable);
diff --git a/mobile/android/base/GeckoThread.java b/mobile/android/base/GeckoThread.java
index 4b15a81d28ab..c3907e07005c 100644
--- a/mobile/android/base/GeckoThread.java
+++ b/mobile/android/base/GeckoThread.java
@@ -165,8 +165,15 @@ public class GeckoThread extends Thread implements GeckoEventListener {
     private static void queueNativeCallLocked(final Class<?> cls, final String methodName,
                                               final Object obj, final Object[] args,
                                               final State state) {
-        final Class<?>[] argTypes = new Class<?>[args.length];
+        final ArrayList<Class<?>> argTypes = new ArrayList<>(args.length);
+        final ArrayList<Object> argValues = new ArrayList<>(args.length);
+
         for (int i = 0; i < args.length; i++) {
+            if (args[i] instanceof Class) {
+                argTypes.add((Class<?>) args[i]);
+                argValues.add(args[++i]);
+                continue;
+            }
             Class<?> argType = args[i].getClass();
             if (argType == Boolean.class) argType = Boolean.TYPE;
             else if (argType == Byte.class) argType = Byte.TYPE;
@@ -176,20 +183,24 @@ public class GeckoThread extends Thread implements GeckoEventListener {
             else if (argType == Integer.class) argType = Integer.TYPE;
             else if (argType == Long.class) argType = Long.TYPE;
             else if (argType == Short.class) argType = Short.TYPE;
-            argTypes[i] = argType;
+            argTypes.add(argType);
+            argValues.add(args[i]);
         }
         final Method method;
         try {
-            method = cls.getDeclaredMethod(methodName, argTypes);
+            method = cls.getDeclaredMethod(
+                    methodName, argTypes.toArray(new Class<?>[argTypes.size()]));
         } catch (final NoSuchMethodException e) {
             throw new UnsupportedOperationException("Cannot find method", e);
         }
 
         if (QUEUED_CALLS.size() == 0 && isStateAtLeast(state)) {
-            invokeMethod(method, obj, args);
+            invokeMethod(method, obj, argValues.toArray());
             return;
         }
-        QUEUED_CALLS.add(new QueuedCall(method, obj, args, state));
+
+        QUEUED_CALLS.add(new QueuedCall(
+                method, obj, argValues.toArray(), state));
     }
 
     /**
@@ -200,7 +211,8 @@ public class GeckoThread extends Thread implements GeckoEventListener {
      *              run when Gecko is at or after RUNNING state.
      * @param cls Class that declares the static method.
      * @param methodName Name of the static method.
-     * @param args Args to call the static method with.
+     * @param args Args to call the static method with; to specify a parameter type,
+     *             pass in a Class instance first, followed by the value.
      */
     public static void queueNativeCallUntil(final State state, final Class<?> cls,
                                             final String methodName, final Object... args) {
@@ -225,7 +237,8 @@ public class GeckoThread extends Thread implements GeckoEventListener {
      * @param state The Gecko state in which the native call could be executed.
      * @param obj Object that declares the instance method.
      * @param methodName Name of the instance method.
-     * @param args Args to call the instance method with.
+     * @param args Args to call the instance method with; to specify a parameter type,
+     *             pass in a Class instance first, followed by the value.
      */
     public static void queueNativeCallUntil(final State state, final Object obj,
                                             final String methodName, final Object... args) {
diff --git a/mobile/android/base/GeckoView.java b/mobile/android/base/GeckoView.java
index f7cbadabd192..e877d8d437f2 100644
--- a/mobile/android/base/GeckoView.java
+++ b/mobile/android/base/GeckoView.java
@@ -30,10 +30,14 @@ import android.content.Intent;
 import android.content.SharedPreferences;
 import android.content.res.TypedArray;
 import android.os.Bundle;
+import android.os.Handler;
 import android.util.AttributeSet;
 import android.util.DisplayMetrics;
 import android.util.Log;
+import android.view.KeyEvent;
 import android.view.View;
+import android.view.inputmethod.EditorInfo;
+import android.view.inputmethod.InputConnection;
 
 public class GeckoView extends LayerView
     implements ContextGetter {
@@ -44,6 +48,8 @@ public class GeckoView extends LayerView
     private ChromeDelegate mChromeDelegate;
     private ContentDelegate mContentDelegate;
 
+    private InputConnectionListener mInputConnectionListener;
+
     private final GeckoEventListener mGeckoEventListener = new GeckoEventListener() {
         @Override
         public void handleMessage(final String event, final JSONObject message) {
@@ -109,7 +115,8 @@ public class GeckoView extends LayerView
 
     @WrapForJNI
     private static final class Window extends JNIObject {
-        static native void open(Window instance, int width, int height);
+        static native void open(Window instance, GeckoView view, int width, int height);
+        static native void setLayerClient(Object client);
         @Override protected native void disposeNative();
     }
 
@@ -142,8 +149,14 @@ public class GeckoView extends LayerView
         GeckoAppShell.setLayerView(this);
 
         initializeView(EventDispatcher.getInstance());
-        GeckoAppShell.sendEventToGecko(GeckoEvent.createObjectEvent(
-                GeckoEvent.ACTION_OBJECT_LAYER_CLIENT, getLayerClientObject()));
+
+        if (GeckoThread.isStateAtLeast(GeckoThread.State.JNI_READY)) {
+            Window.setLayerClient(getLayerClientObject());
+        } else {
+            GeckoThread.queueNativeCallUntil(GeckoThread.State.JNI_READY,
+                    Window.class, "setLayerClient",
+                    Object.class, getLayerClientObject());
+        }
 
         // TODO: Fennec currently takes care of its own initialization, so this
         // flag is a hack used in Fennec to prevent GeckoView initialization.
@@ -212,10 +225,11 @@ public class GeckoView extends LayerView
         final DisplayMetrics metrics = getContext().getResources().getDisplayMetrics();
 
         if (GeckoThread.isStateAtLeast(GeckoThread.State.PROFILE_READY)) {
-            Window.open(window, metrics.widthPixels, metrics.heightPixels);
+            Window.open(window, this, metrics.widthPixels, metrics.heightPixels);
         } else {
             GeckoThread.queueNativeCallUntil(GeckoThread.State.PROFILE_READY, Window.class,
-                    "open", window, metrics.widthPixels, metrics.heightPixels);
+                    "open", window, GeckoView.class, this,
+                    metrics.widthPixels, metrics.heightPixels);
         }
     }
 
@@ -226,6 +240,76 @@ public class GeckoView extends LayerView
         window.disposeNative();
     }
 
+    /* package */ void setInputConnectionListener(final InputConnectionListener icl) {
+        mInputConnectionListener = icl;
+    }
+
+    @Override
+    public Handler getHandler() {
+        if (mInputConnectionListener != null) {
+            return mInputConnectionListener.getHandler(super.getHandler());
+        }
+        return super.getHandler();
+    }
+
+    @Override
+    public InputConnection onCreateInputConnection(EditorInfo outAttrs) {
+        if (mInputConnectionListener != null) {
+            return mInputConnectionListener.onCreateInputConnection(outAttrs);
+        }
+        return null;
+    }
+
+    @Override
+    public boolean onKeyPreIme(int keyCode, KeyEvent event) {
+        if (super.onKeyPreIme(keyCode, event)) {
+            return true;
+        }
+        return mInputConnectionListener != null &&
+                mInputConnectionListener.onKeyPreIme(keyCode, event);
+    }
+
+    @Override
+    public boolean onKeyUp(int keyCode, KeyEvent event) {
+        if (super.onKeyUp(keyCode, event)) {
+            return true;
+        }
+        return mInputConnectionListener != null &&
+                mInputConnectionListener.onKeyUp(keyCode, event);
+    }
+
+    @Override
+    public boolean onKeyDown(int keyCode, KeyEvent event) {
+        if (super.onKeyDown(keyCode, event)) {
+            return true;
+        }
+        return mInputConnectionListener != null &&
+                mInputConnectionListener.onKeyDown(keyCode, event);
+    }
+
+    @Override
+    public boolean onKeyLongPress(int keyCode, KeyEvent event) {
+        if (super.onKeyLongPress(keyCode, event)) {
+            return true;
+        }
+        return mInputConnectionListener != null &&
+                mInputConnectionListener.onKeyLongPress(keyCode, event);
+    }
+
+    @Override
+    public boolean onKeyMultiple(int keyCode, int repeatCount, KeyEvent event) {
+        if (super.onKeyMultiple(keyCode, repeatCount, event)) {
+            return true;
+        }
+        return mInputConnectionListener != null &&
+                mInputConnectionListener.onKeyMultiple(keyCode, repeatCount, event);
+    }
+
+    /* package */ boolean isIMEEnabled() {
+        return mInputConnectionListener != null &&
+                mInputConnectionListener.isIMEEnabled();
+    }
+
     /**
     * Add a Browser to the GeckoView container.
     * @param url The URL resource to load into the new Browser.
diff --git a/mobile/android/base/gfx/InputConnectionHandler.java b/mobile/android/base/InputConnectionListener.java
similarity index 84%
rename from mobile/android/base/gfx/InputConnectionHandler.java
rename to mobile/android/base/InputConnectionListener.java
index 9b3ca381b5a4..baddc4ed25cc 100644
--- a/mobile/android/base/gfx/InputConnectionHandler.java
+++ b/mobile/android/base/InputConnectionListener.java
@@ -2,14 +2,17 @@
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
 
-package org.mozilla.gecko.gfx;
+package org.mozilla.gecko;
 
 import android.os.Handler;
 import android.view.KeyEvent;
 import android.view.inputmethod.EditorInfo;
 import android.view.inputmethod.InputConnection;
 
-public interface InputConnectionHandler
+/**
+ * Interface for interacting with GeckoInputConnection from GeckoView.
+ */
+interface InputConnectionListener
 {
     Handler getHandler(Handler defHandler);
     InputConnection onCreateInputConnection(EditorInfo outAttrs);
diff --git a/mobile/android/base/gfx/LayerView.java b/mobile/android/base/gfx/LayerView.java
index ecd54eecea6e..846a81de89ed 100644
--- a/mobile/android/base/gfx/LayerView.java
+++ b/mobile/android/base/gfx/LayerView.java
@@ -31,7 +31,6 @@ import android.graphics.Point;
 import android.graphics.PointF;
 import android.graphics.Rect;
 import android.graphics.SurfaceTexture;
-import android.os.Handler;
 import android.util.AttributeSet;
 import android.util.Log;
 import android.view.KeyEvent;
@@ -41,8 +40,6 @@ import android.view.SurfaceView;
 import android.view.TextureView;
 import android.view.View;
 import android.view.ViewGroup;
-import android.view.inputmethod.EditorInfo;
-import android.view.inputmethod.InputConnection;
 import android.view.InputDevice;
 import android.widget.LinearLayout;
 import android.widget.ScrollView;
@@ -57,7 +54,6 @@ public class LayerView extends ScrollView implements Tabs.OnTabsChangedListener
     private PanZoomController mPanZoomController;
     private DynamicToolbarAnimator mToolbarAnimator;
     private final GLController mGLController;
-    private InputConnectionHandler mInputConnectionHandler;
     private LayerRenderer mRenderer;
     /* Must be a PAINT_xxx constant */
     private int mPaintState;
@@ -136,7 +132,6 @@ public class LayerView extends ScrollView implements Tabs.OnTabsChangedListener
         mToolbarAnimator = mLayerClient.getDynamicToolbarAnimator();
 
         mRenderer = new LayerRenderer(this);
-        mInputConnectionHandler = null;
 
         setFocusable(true);
         setFocusableInTouchMode(true);
@@ -364,71 +359,11 @@ public class LayerView extends ScrollView implements Tabs.OnTabsChangedListener
         mLayerClient.setIsRTL(aIsRTL);
     }
 
-    public void setInputConnectionHandler(InputConnectionHandler inputConnectionHandler) {
-        mInputConnectionHandler = inputConnectionHandler;
-    }
-
-    @Override
-    public Handler getHandler() {
-        if (mInputConnectionHandler != null)
-            return mInputConnectionHandler.getHandler(super.getHandler());
-        return super.getHandler();
-    }
-
-    @Override
-    public InputConnection onCreateInputConnection(EditorInfo outAttrs) {
-        if (mInputConnectionHandler != null)
-            return mInputConnectionHandler.onCreateInputConnection(outAttrs);
-        return null;
-    }
-
-    @Override
-    public boolean onKeyPreIme(int keyCode, KeyEvent event) {
-        if (mInputConnectionHandler != null && mInputConnectionHandler.onKeyPreIme(keyCode, event)) {
-            return true;
-        }
-        return false;
-    }
-
     @Override
     public boolean onKeyDown(int keyCode, KeyEvent event) {
         if (mPanZoomController != null && mPanZoomController.onKeyEvent(event)) {
             return true;
         }
-        if (mInputConnectionHandler != null && mInputConnectionHandler.onKeyDown(keyCode, event)) {
-            return true;
-        }
-        return false;
-    }
-
-    @Override
-    public boolean onKeyLongPress(int keyCode, KeyEvent event) {
-        if (mInputConnectionHandler != null && mInputConnectionHandler.onKeyLongPress(keyCode, event)) {
-            return true;
-        }
-        return false;
-    }
-
-    @Override
-    public boolean onKeyMultiple(int keyCode, int repeatCount, KeyEvent event) {
-        if (mInputConnectionHandler != null && mInputConnectionHandler.onKeyMultiple(keyCode, repeatCount, event)) {
-            return true;
-        }
-        return false;
-    }
-
-    @Override
-    public boolean onKeyUp(int keyCode, KeyEvent event) {
-        if (mInputConnectionHandler != null && mInputConnectionHandler.onKeyUp(keyCode, event)) {
-            return true;
-        }
-        return false;
-    }
-
-    public boolean isIMEEnabled() {
-        if (mInputConnectionHandler != null) {
-            return mInputConnectionHandler.isIMEEnabled();
-        }
         return false;
     }
 
diff --git a/mobile/android/base/moz.build b/mobile/android/base/moz.build
index 3544e010fdcc..27840334ea2b 100644
--- a/mobile/android/base/moz.build
+++ b/mobile/android/base/moz.build
@@ -288,7 +288,6 @@ gbjar.sources += [
     'gfx/GeckoLayerClient.java',
     'gfx/GLController.java',
     'gfx/ImmutableViewportMetrics.java',
-    'gfx/InputConnectionHandler.java',
     'gfx/IntSize.java',
     'gfx/JavaPanZoomController.java',
     'gfx/Layer.java',
@@ -381,6 +380,7 @@ gbjar.sources += [
     'home/TopSitesThumbnailView.java',
     'home/TransitionAwareCursorLoaderCallbacks.java',
     'home/TwoLinePageRow.java',
+    'InputConnectionListener.java',
     'InputMethods.java',
     'IntentHelper.java',
     'javaaddons/JavaAddonManager.java',
diff --git a/netwerk/protocol/http/Http2Session.cpp b/netwerk/protocol/http/Http2Session.cpp
index d4ce0fb42e8d..dff049f5d295 100644
--- a/netwerk/protocol/http/Http2Session.cpp
+++ b/netwerk/protocol/http/Http2Session.cpp
@@ -2886,7 +2886,10 @@ Http2Session::ProcessSlowConsumer(Http2Stream *slowConsumer,
     rv = NS_BASE_STREAM_CLOSED;
   }
 
-  if (NS_SUCCEEDED(rv)) {
+  if (NS_SUCCEEDED(rv) && (*countWritten > 0)) {
+    // There have been buffered bytes successfully fed into the
+    // formerly blocked consumer. Repeat until buffer empty or
+    // consumer is blocked again.
     UpdateLocalRwin(slowConsumer, 0);
     ConnectSlowConsumer(slowConsumer);
   }
@@ -3189,7 +3192,8 @@ Http2Session::OnWriteSegment(char *buf,
     return NS_ERROR_FAILURE;
   }
 
-  if (mDownstreamState == NOT_USING_NETWORK) {
+  if (mDownstreamState == NOT_USING_NETWORK ||
+      mDownstreamState == BUFFERING_FRAME_HEADER) {
     return NS_BASE_STREAM_WOULD_BLOCK;
   }
 
diff --git a/netwerk/protocol/http/Http2Stream.cpp b/netwerk/protocol/http/Http2Stream.cpp
index 42b23484231b..1b857b4e10b6 100644
--- a/netwerk/protocol/http/Http2Stream.cpp
+++ b/netwerk/protocol/http/Http2Stream.cpp
@@ -324,8 +324,20 @@ Http2Stream::WriteSegments(nsAHttpSegmentWriter *writer,
     // won't block other streams. but we should not advance the flow control window
     // so that we'll eventually push back on the sender.
 
+    // with tunnels you need to make sure that this is an underlying connction established
+    // that can be meaningfully giving this signal
+    bool doBuffer = true;
+    if (mIsTunnel) {
+      nsRefPtr<SpdyConnectTransaction> qiTrans(mTransaction->QuerySpdyConnectTransaction());
+      if (qiTrans) {
+        doBuffer = qiTrans->ConnectedReadyForInput();
+      }
+    }
     // stash this data
-    rv = BufferInput(count, countWritten);
+    if (doBuffer) {
+      rv = BufferInput(count, countWritten);
+      LOG3(("Http2Stream::WriteSegments %p Buffered %X %d\n", this, rv, *countWritten));
+    }
   }
   mSegmentWriter = nullptr;
   return rv;
diff --git a/netwerk/protocol/http/TunnelUtils.cpp b/netwerk/protocol/http/TunnelUtils.cpp
index f3424744bee0..b2e03330cf94 100644
--- a/netwerk/protocol/http/TunnelUtils.cpp
+++ b/netwerk/protocol/http/TunnelUtils.cpp
@@ -1263,6 +1263,12 @@ SpdyConnectTransaction::WriteSegments(nsAHttpSegmentWriter *writer,
   return rv;
 }
 
+bool
+SpdyConnectTransaction::ConnectedReadyForInput()
+{
+  return mTunneledConn && mTunnelStreamIn->mCallback;
+}
+
 nsHttpRequestHead *
 SpdyConnectTransaction::RequestHead()
 {
diff --git a/netwerk/protocol/http/TunnelUtils.h b/netwerk/protocol/http/TunnelUtils.h
index b1b741383858..4ab1486e7345 100644
--- a/netwerk/protocol/http/TunnelUtils.h
+++ b/netwerk/protocol/http/TunnelUtils.h
@@ -201,6 +201,10 @@ public:
   nsHttpRequestHead *RequestHead() override final;
   void Close(nsresult reason) override final;
 
+  // ConnectedReadyForInput() tests whether the spdy connect transaction is attached to
+  // an nsHttpConnection that can properly deal with flow control, etc..
+  bool ConnectedReadyForInput();
+
 private:
   friend class InputStreamShim;
   friend class OutputStreamShim;
diff --git a/netwerk/protocol/http/nsHttpConnection.cpp b/netwerk/protocol/http/nsHttpConnection.cpp
index 3259fd4f196e..5fe663775ab8 100644
--- a/netwerk/protocol/http/nsHttpConnection.cpp
+++ b/netwerk/protocol/http/nsHttpConnection.cpp
@@ -2114,9 +2114,17 @@ void
 nsHttpConnection::CheckForTraffic(bool check)
 {
     if (check) {
+        LOG((" CheckForTraffic conn %p\n", this));
         if (mSpdySession) {
-            // Send a ping to verify it is still alive
-            mSpdySession->SendPing();
+            if (PR_IntervalToMilliseconds(IdleTime()) >= 500) {
+                // Send a ping to verify it is still alive if it has been idle
+                // more than half a second, the network changed events are
+                // rate-limited to one per 1000 ms.
+                LOG((" SendPing\n"));
+                mSpdySession->SendPing();
+            } else {
+                LOG((" SendPing skipped due to network activity\n"));
+            }
         } else {
             // If not SPDY, Store snapshot amount of data right now
             mTrafficCount = mTotalBytesWritten + mTotalBytesRead;
diff --git a/netwerk/protocol/http/nsHttpTransaction.cpp b/netwerk/protocol/http/nsHttpTransaction.cpp
index 5dd887c580d3..db033027809a 100644
--- a/netwerk/protocol/http/nsHttpTransaction.cpp
+++ b/netwerk/protocol/http/nsHttpTransaction.cpp
@@ -540,7 +540,7 @@ nsHttpTransaction::OnTransportStatus(nsITransport* transport,
     // and the correct value will be returned in nsPerformance.
     if (TimingEnabled() && GetRequestStart().IsNull()) {
         if (status == NS_NET_STATUS_RESOLVING_HOST) {
-            SetDomainLookupStart(TimeStamp::Now());
+            SetDomainLookupStart(TimeStamp::Now(), true);
         } else if (status == NS_NET_STATUS_RESOLVED_HOST) {
             SetDomainLookupEnd(TimeStamp::Now());
         } else if (status == NS_NET_STATUS_CONNECTING_TO) {
diff --git a/netwerk/system/linux/nsNotifyAddrListener_Linux.cpp b/netwerk/system/linux/nsNotifyAddrListener_Linux.cpp
index 67bde347d52b..b54c3a2ea8f6 100644
--- a/netwerk/system/linux/nsNotifyAddrListener_Linux.cpp
+++ b/netwerk/system/linux/nsNotifyAddrListener_Linux.cpp
@@ -36,6 +36,10 @@
 /* a shorter name that better explains what it does */
 #define EINTR_RETRY(x) MOZ_TEMP_FAILURE_RETRY(x)
 
+// period during which to absorb subsequent network change events, in
+// milliseconds
+static const unsigned int kNetworkChangeCoalescingPeriod  = 1000;
+
 using namespace mozilla;
 
 static PRLogModuleInfo *gNotifyAddrLog = nullptr;
@@ -53,6 +57,7 @@ nsNotifyAddrListener::nsNotifyAddrListener()
     , mStatusKnown(false)
     , mAllowChangedEvent(true)
     , mChildThreadShutdown(false)
+    , mCoalescingActive(false)
 {
     mShutdownPipe[0] = -1;
     mShutdownPipe[1] = -1;
@@ -223,7 +228,7 @@ void nsNotifyAddrListener::OnNetlinkMessage(int aNetlinkSocket)
     }
 
     if (networkChange && mAllowChangedEvent) {
-        SendEvent(NS_NETWORK_LINK_DATA_CHANGED);
+        NetworkChanged();
     }
 
     if (networkChange) {
@@ -275,8 +280,9 @@ nsNotifyAddrListener::Run()
 
     nsresult rv = NS_OK;
     bool shutdown = false;
+    int pollWait = pollTimeout;
     while (!shutdown) {
-        int rc = EINTR_RETRY(poll(fds, 2, pollTimeout));
+        int rc = EINTR_RETRY(poll(fds, 2, pollWait));
 
         if (rc > 0) {
             if (fds[0].revents & POLLIN) {
@@ -291,6 +297,19 @@ nsNotifyAddrListener::Run()
             rv = NS_ERROR_FAILURE;
             break;
         }
+        if (mCoalescingActive) {
+            // check if coalescing period should continue
+            double period = (TimeStamp::Now() - mChangeTime).ToMilliseconds();
+            if (period >= kNetworkChangeCoalescingPeriod) {
+                SendEvent(NS_NETWORK_LINK_DATA_CHANGED);
+                mCoalescingActive = false;
+                pollWait = pollTimeout; // restore to default
+            } else {
+                // wait no longer than to the end of the period
+                pollWait = static_cast<int>
+                    (kNetworkChangeCoalescingPeriod - period);
+            }
+        }
         if (mChildThreadShutdown) {
             LOG(("thread shutdown via variable, dying...\n"));
             shutdown = true;
@@ -387,6 +406,27 @@ nsNotifyAddrListener::Shutdown(void)
     return rv;
 }
 
+
+/*
+ * A network event has been registered. Delay the actual sending of the event
+ * for a while and absorb subsequent events in the mean time in an effort to
+ * squash potentially many triggers into a single event.
+ * Only ever called from the same thread.
+ */
+nsresult
+nsNotifyAddrListener::NetworkChanged()
+{
+    if (mCoalescingActive) {
+        LOG(("NetworkChanged: absorbed an event (coalescing active)\n"));
+    } else {
+        // A fresh trigger!
+        mChangeTime = TimeStamp::Now();
+        mCoalescingActive = true;
+        LOG(("NetworkChanged: coalescing period started\n"));
+    }
+    return NS_OK;
+}
+
 /* Sends the given event.  Assumes aEventID never goes out of scope (static
  * strings are ideal).
  */
diff --git a/netwerk/system/linux/nsNotifyAddrListener_Linux.h b/netwerk/system/linux/nsNotifyAddrListener_Linux.h
index 51c540804936..c774118665b8 100644
--- a/netwerk/system/linux/nsNotifyAddrListener_Linux.h
+++ b/netwerk/system/linux/nsNotifyAddrListener_Linux.h
@@ -22,6 +22,7 @@
 #include "nsCOMPtr.h"
 #include "mozilla/Atomics.h"
 #include "mozilla/TimeStamp.h"
+#include "nsITimer.h"
 
 class nsNotifyAddrListener : public nsINetworkLinkService,
                              public nsIRunnable,
@@ -53,6 +54,9 @@ private:
     // Called when xpcom-shutdown-threads is received.
     nsresult Shutdown(void);
 
+    // Called when a network change was detected
+    nsresult NetworkChanged();
+
     // Sends the network event.
     nsresult SendEvent(const char *aEventID);
 
@@ -78,6 +82,12 @@ private:
 
     // Flag to signal child thread kill with
     mozilla::Atomic<bool, mozilla::Relaxed> mChildThreadShutdown;
-};
+
+    // Flag set while coalescing change events
+    bool mCoalescingActive;
+
+    // Time stamp for first event during coalescing
+    mozilla::TimeStamp mChangeTime;
+ };
 
 #endif /* NSNOTIFYADDRLISTENER_LINUX_H_ */
diff --git a/netwerk/system/win32/nsNotifyAddrListener.cpp b/netwerk/system/win32/nsNotifyAddrListener.cpp
index 7646305061c2..714904af7f12 100644
--- a/netwerk/system/win32/nsNotifyAddrListener.cpp
+++ b/netwerk/system/win32/nsNotifyAddrListener.cpp
@@ -47,6 +47,10 @@ static decltype(CancelMibChangeNotify2)* sCancelMibChangeNotify2;
 
 #define NETWORK_NOTIFY_CHANGED_PREF "network.notify.changed"
 
+// period during which to absorb subsequent network change events, in
+// milliseconds
+static const unsigned int kNetworkChangeCoalescingPeriod  = 1000;
+
 static void InitIphlpapi(void)
 {
     if (!sIphlpapi) {
@@ -98,9 +102,11 @@ nsNotifyAddrListener::nsNotifyAddrListener()
     : mLinkUp(true)  // assume true by default
     , mStatusKnown(false)
     , mCheckAttempted(false)
-    , mShutdownEvent(nullptr)
+    , mCheckEvent(nullptr)
+    , mShutdown(false)
     , mIPInterfaceChecksum(0)
     , mAllowChangedEvent(true)
+    , mCoalescingActive(false)
 {
     InitIphlpapi();
 }
@@ -149,12 +155,30 @@ static void WINAPI OnInterfaceChange(PVOID callerContext,
     notify->CheckLinkStatus();
 }
 
+DWORD
+nsNotifyAddrListener::nextCoalesceWaitTime()
+{
+    // check if coalescing period should continue
+    double period = (TimeStamp::Now() - mChangeTime).ToMilliseconds();
+    if (period >= kNetworkChangeCoalescingPeriod) {
+        SendEvent(NS_NETWORK_LINK_DATA_CHANGED);
+        mCoalescingActive = false;
+        return INFINITE; // return default
+    } else {
+        // wait no longer than to the end of the period
+        return static_cast<DWORD>
+            (kNetworkChangeCoalescingPeriod - period);
+    }
+}
+
 NS_IMETHODIMP
 nsNotifyAddrListener::Run()
 {
     PR_SetCurrentThreadName("Link Monitor");
 
-    mChangedTime = TimeStamp::Now();
+    mStartTime = TimeStamp::Now();
+
+    DWORD waitTime = INFINITE;
 
     if (!sNotifyIpInterfaceChange || !sCancelMibChangeNotify2) {
         // For Windows versions which are older than Vista which lack
@@ -162,7 +186,7 @@ nsNotifyAddrListener::Run()
         HANDLE ev = CreateEvent(nullptr, FALSE, FALSE, nullptr);
         NS_ENSURE_TRUE(ev, NS_ERROR_OUT_OF_MEMORY);
 
-        HANDLE handles[2] = { ev, mShutdownEvent };
+        HANDLE handles[2] = { ev, mCheckEvent };
         OVERLAPPED overlapped = { 0 };
         bool shuttingDown = false;
 
@@ -172,9 +196,11 @@ nsNotifyAddrListener::Run()
             DWORD ret = NotifyAddrChange(&h, &overlapped);
 
             if (ret == ERROR_IO_PENDING) {
-                ret = WaitForMultipleObjects(2, handles, FALSE, INFINITE);
+                ret = WaitForMultipleObjects(2, handles, FALSE, waitTime);
                 if (ret == WAIT_OBJECT_0) {
                     CheckLinkStatus();
+                } else if (!mShutdown) {
+                    waitTime = nextCoalesceWaitTime();
                 } else {
                     shuttingDown = true;
                 }
@@ -194,9 +220,15 @@ nsNotifyAddrListener::Run()
             false, // no initial notification
             &interfacechange);
 
-        if (ret == NO_ERROR) {
-            ret = WaitForSingleObject(mShutdownEvent, INFINITE);
-        }
+        do {
+            ret = WaitForSingleObject(mCheckEvent, waitTime);
+            if (!mShutdown) {
+                waitTime = nextCoalesceWaitTime();
+            }
+            else {
+                break;
+            }
+        } while (ret != WAIT_FAILED);
         sCancelMibChangeNotify2(interfacechange);
     }
     return NS_OK;
@@ -231,8 +263,8 @@ nsNotifyAddrListener::Init(void)
     Preferences::AddBoolVarCache(&mAllowChangedEvent,
                                  NETWORK_NOTIFY_CHANGED_PREF, true);
 
-    mShutdownEvent = CreateEvent(nullptr, FALSE, FALSE, nullptr);
-    NS_ENSURE_TRUE(mShutdownEvent, NS_ERROR_OUT_OF_MEMORY);
+    mCheckEvent = CreateEvent(nullptr, FALSE, FALSE, nullptr);
+    NS_ENSURE_TRUE(mCheckEvent, NS_ERROR_OUT_OF_MEMORY);
 
     rv = NS_NewThread(getter_AddRefs(mThread), this);
     NS_ENSURE_SUCCESS(rv, rv);
@@ -249,10 +281,11 @@ nsNotifyAddrListener::Shutdown(void)
     if (observerService)
         observerService->RemoveObserver(this, "xpcom-shutdown-threads");
 
-    if (!mShutdownEvent)
+    if (!mCheckEvent)
         return NS_OK;
 
-    SetEvent(mShutdownEvent);
+    mShutdown = true;
+    SetEvent(mCheckEvent);
 
     nsresult rv = mThread->Shutdown();
 
@@ -261,12 +294,33 @@ nsNotifyAddrListener::Shutdown(void)
     // via its mRunnable
     mThread = nullptr;
 
-    CloseHandle(mShutdownEvent);
-    mShutdownEvent = nullptr;
+    CloseHandle(mCheckEvent);
+    mCheckEvent = nullptr;
 
     return rv;
 }
 
+/*
+ * A network event has been registered. Delay the actual sending of the event
+ * for a while and absorb subsequent events in the mean time in an effort to
+ * squash potentially many triggers into a single event.
+ * Only ever called from the same thread.
+ */
+nsresult
+nsNotifyAddrListener::NetworkChanged()
+{
+    if (mCoalescingActive) {
+        LOG(("NetworkChanged: absorbed an event (coalescing active)\n"));
+    } else {
+        // A fresh trigger!
+        mChangeTime = TimeStamp::Now();
+        mCoalescingActive = true;
+        SetEvent(mCheckEvent);
+        LOG(("NetworkChanged: coalescing period started\n"));
+    }
+    return NS_OK;
+}
+
 /* Sends the given event.  Assumes aEventID never goes out of scope (static
  * strings are ideal).
  */
@@ -517,12 +571,12 @@ nsNotifyAddrListener::CheckLinkStatus(void)
         }
 
         if (mLinkUp && (prevCsum != mIPInterfaceChecksum)) {
-            TimeDuration since = TimeStamp::Now() - mChangedTime;
+            TimeDuration since = TimeStamp::Now() - mStartTime;
 
             // Network is online. Topology has changed. Always send CHANGED
             // before UP - if allowed to and having cooled down.
             if (mAllowChangedEvent && (since.ToMilliseconds() > 2000)) {
-                SendEvent(NS_NETWORK_LINK_DATA_CHANGED);
+                NetworkChanged();
             }
         }
         if (prevLinkUp != mLinkUp) {
diff --git a/netwerk/system/win32/nsNotifyAddrListener.h b/netwerk/system/win32/nsNotifyAddrListener.h
index 4a0f383e1857..8ef6650b3e0d 100644
--- a/netwerk/system/win32/nsNotifyAddrListener.h
+++ b/netwerk/system/win32/nsNotifyAddrListener.h
@@ -60,18 +60,33 @@ protected:
 
     nsCOMPtr<nsIThread> mThread;
 
-    HANDLE        mShutdownEvent;
-
 private:
+    // Returns the new timeout period for coalescing (or INFINITE)
+    DWORD nextCoalesceWaitTime();
+
+    // Called for every detected network change
+    nsresult NetworkChanged();
+
+    HANDLE mCheckEvent;
+
+    // set true when mCheckEvent means shutdown
+    bool mShutdown;
+
     // This is a checksum of various meta data for all network interfaces
     // considered UP at last check.
     ULONG mIPInterfaceChecksum;
 
-    // time of the last sent changed event
-    mozilla::TimeStamp mChangedTime;
+    // start time of the checking
+    mozilla::TimeStamp mStartTime;
 
     // Network changed events are enabled
     bool mAllowChangedEvent;
+
+    // Flag set while coalescing change events
+    bool mCoalescingActive;
+
+    // Time stamp for first event during coalescing
+    mozilla::TimeStamp mChangeTime;
 };
 
 #endif /* NSNOTIFYADDRLISTENER_H_ */
diff --git a/testing/docker/build.sh b/testing/docker/build.sh
index 4d46ce874f50..5254790d06f9 100755
--- a/testing/docker/build.sh
+++ b/testing/docker/build.sh
@@ -4,11 +4,14 @@
 # versions and registry deployment... It also attempts to detect any potential
 # missing dependencies and warns you about them.
 
+gecko_root="$( cd "$( dirname "${BASH_SOURCE[0]}" )/../.." && pwd )"
+
 usage() {
-  echo "Build a docker image in the given folder (and tag it)"
+  echo "Build a docker image (and tag it)"
   echo
-  echo "$0 <folder>"
+  echo "$0 <image-name>"
   echo
+  echo "  Images are defined in testing/docker/<image-name>."
   echo "  For more see: $PWD/README.md"
   echo
 }
@@ -31,17 +34,18 @@ find_registry() {
 }
 
 build() {
-  local folder=$1
-  local folder_reg="$1/REGISTRY"
-  local folder_ver="$1/VERSION"
+  local image_name=$1
+  local folder="$gecko_root/testing/docker/$image_name"
+  local folder_reg="$folder/REGISTRY"
+  local folder_ver="$folder/VERSION"
 
-  if [ "$folder" == "" ];
+  if [ "$image_name" == "" ];
   then
     usage
     return
   fi
 
-  test -d "$folder" || usage_err "Unknown folder: $folder"
+  test -d "$folder" || usage_err "Unknown image: $image_name"
   test -f "$folder_ver" || usage_err "$folder must contain VERSION file"
 
   # Fallback to default registry if one is not in the folder...
@@ -55,7 +59,7 @@ build() {
   test -n "$registry" || usage_err "$folder_reg is empty aborting..."
   test -n "$version" || usage_err "$folder_ver is empty aborting..."
 
-  local tag="$registry/$folder:$version"
+  local tag="$registry/$image_name:$version"
 
   if [ -f $folder/build.sh ]; then
     shift
@@ -63,10 +67,10 @@ build() {
   else
     # use --no-cache so that we always get the latest updates from yum
     # and use the latest version of system-setup.sh
-    docker build --no-cache -t $tag $folder || exit 1
+    ( cd $folder/.. && docker build --no-cache -t $tag $image_name ) || exit 1
   fi
 
-  echo "Success built $folder and tagged with $tag"
+  echo "Success built $image_name and tagged with $tag"
   echo "If deploying now you can run 'docker push $tag'"
 }
 
diff --git a/testing/mozharness/configs/builds/releng_sub_mac_configs/64_cross_opt.py b/testing/mozharness/configs/builds/releng_sub_mac_configs/64_cross_opt.py
new file mode 100644
index 000000000000..4fec687cc29c
--- /dev/null
+++ b/testing/mozharness/configs/builds/releng_sub_mac_configs/64_cross_opt.py
@@ -0,0 +1,40 @@
+import os
+
+MOZ_OBJDIR = 'obj-firefox'
+
+config = {
+    'default_actions': [
+        'clobber',
+        'clone-tools',
+        'checkout-sources',
+        # 'setup-mock',
+        'build',
+    ],
+    'stage_platform': 'macosx64-st-an',
+    'debug_build': False,
+    'objdir': 'obj-firefox',
+    'enable_talos_sendchange': False,
+    #### 64 bit build specific #####
+    'env': {
+        'MOZBUILD_STATE_PATH': os.path.join(os.getcwd(), '.mozbuild'),
+        'MOZ_AUTOMATION': '1',
+        'HG_SHARE_BASE_DIR': '/builds/hg-shared',
+        'MOZ_OBJDIR': 'obj-firefox',
+        'TINDERBOX_OUTPUT': '1',
+        'TOOLTOOL_CACHE': '/builds/tooltool_cache',
+        'TOOLTOOL_HOME': '/builds',
+        'MOZ_CRASHREPORTER_NO_REPORT': '1',
+        'CCACHE_DIR': '/builds/ccache',
+        'CCACHE_COMPRESS': '1',
+        'CCACHE_UMASK': '002',
+        'LC_ALL': 'C',
+        'XPCOM_DEBUG_BREAK': 'stack-and-abort',
+        ## 64 bit specific
+        'PATH': '/tools/python/bin:/tools/buildbot/bin:/opt/local/bin:/usr/bin:'
+                '/bin:/usr/sbin:/sbin:/usr/local/bin:/usr/X11/bin',
+        ##
+    },
+    'src_mozconfig': 'browser/config/mozconfigs/macosx64/opt-static-analysis',
+    'purge_minsize': 10,
+    #######################
+}
diff --git a/testing/mozharness/mozharness/mozilla/building/buildbase.py b/testing/mozharness/mozharness/mozilla/building/buildbase.py
index e652299bbf2d..c170906076d0 100755
--- a/testing/mozharness/mozharness/mozilla/building/buildbase.py
+++ b/testing/mozharness/mozharness/mozilla/building/buildbase.py
@@ -310,6 +310,7 @@ class BuildOptionParser(object):
         'tsan': 'builds/releng_sub_%s_configs/%s_tsan.py',
         'b2g-debug': 'b2g/releng_sub_%s_configs/%s_debug.py',
         'cross-debug': 'builds/releng_sub_%s_configs/%s_cross_debug.py',
+        'cross-opt': 'builds/releng_sub_%s_configs/%s_cross_opt.py',
         'debug': 'builds/releng_sub_%s_configs/%s_debug.py',
         'asan-and-debug': 'builds/releng_sub_%s_configs/%s_asan_and_debug.py',
         'stat-and-debug': 'builds/releng_sub_%s_configs/%s_stat_and_debug.py',
diff --git a/testing/mozharness/scripts/desktop_l10n.py b/testing/mozharness/scripts/desktop_l10n.py
index d803ad171e7f..75467467c2bf 100755
--- a/testing/mozharness/scripts/desktop_l10n.py
+++ b/testing/mozharness/scripts/desktop_l10n.py
@@ -60,6 +60,7 @@ PyMakeIgnoreList = [
 # it's a list of values that are already known before starting a build
 configuration_tokens = ('branch',
                         'platform',
+                        'en_us_binary_url',
                         'update_platform',
                         'update_channel',
                         'ssh_key_dir',
diff --git a/testing/taskcluster/tasks/branches/base_job_flags.yml b/testing/taskcluster/tasks/branches/base_job_flags.yml
index 037dcec0fb60..322928a1790e 100644
--- a/testing/taskcluster/tasks/branches/base_job_flags.yml
+++ b/testing/taskcluster/tasks/branches/base_job_flags.yml
@@ -40,6 +40,7 @@ flags:
     - linux64
     - linux64-st-an
     - macosx64
+    - macosx64-st-an
 
   tests:
     - cppunit
diff --git a/testing/taskcluster/tasks/branches/base_jobs.yml b/testing/taskcluster/tasks/branches/base_jobs.yml
index 6982ff0412ee..34445e185645 100644
--- a/testing/taskcluster/tasks/branches/base_jobs.yml
+++ b/testing/taskcluster/tasks/branches/base_jobs.yml
@@ -158,6 +158,12 @@ builds:
     types:
       debug:
         task: tasks/builds/dbg_macosx64.yml
+  macosx64-st-an:
+    platforms:
+      - MacOSX64 Static Analysis
+    types:
+      opt:
+        task: tasks/builds/opt_macosx64_st-an.yml
   android-b2gdroid:
     platforms:
       - Android
diff --git a/testing/taskcluster/tasks/branches/try/job_flags.yml b/testing/taskcluster/tasks/branches/try/job_flags.yml
index 00ba48697022..620d6bfc1f35 100644
--- a/testing/taskcluster/tasks/branches/try/job_flags.yml
+++ b/testing/taskcluster/tasks/branches/try/job_flags.yml
@@ -215,6 +215,12 @@ builds:
     types:
       debug:
         task: tasks/builds/dbg_macosx64_clobber.yml
+  macosx64-st-an:
+    platforms:
+      - MacOSX64 Static Analysis
+    types:
+      opt:
+        task: tasks/builds/opt_macosx64_st-an_clobber.yml
 
 post-build:
   upload-symbols:
diff --git a/testing/taskcluster/tasks/builds/opt_macosx64_st-an.yml b/testing/taskcluster/tasks/builds/opt_macosx64_st-an.yml
new file mode 100644
index 000000000000..16480bb4b614
--- /dev/null
+++ b/testing/taskcluster/tasks/builds/opt_macosx64_st-an.yml
@@ -0,0 +1,28 @@
+$inherits:
+  from: 'tasks/builds/opt_macosx64_clobber.yml'
+  variables:
+    build_name: 'macosx64-st-an'
+task:
+  metadata:
+      name: '[TC] MacOSX64 Static Analysis Opt'
+      description: 'MacOSX64 Static Analysis Opt'
+
+  scopes:
+    - 'docker-worker:cache:build-macosx64-st-an-workspace'
+
+  routes:
+    - 'index.buildbot.branches.{{project}}.macosx64-st-an'
+    - 'index.buildbot.revisions.{{head_rev}}.{{project}}.macosx64-st-an'
+
+  payload:
+    cache:
+      build-macosx64-st-an-workspace: '/home/worker/workspace'
+    env:
+      MH_CUSTOM_BUILD_VARIANT_CFG: 'cross-opt'
+      DIST_UPLOADS: ''
+      DIST_TARGET_UPLOADS: ''
+  extra:
+    treeherder:
+      groupSymbol: "?"
+      groupName: Submitted by taskcluster
+      symbol: S
diff --git a/testing/taskcluster/tasks/builds/opt_macosx64_st-an_clobber.yml b/testing/taskcluster/tasks/builds/opt_macosx64_st-an_clobber.yml
new file mode 100644
index 000000000000..7df2505d64ab
--- /dev/null
+++ b/testing/taskcluster/tasks/builds/opt_macosx64_st-an_clobber.yml
@@ -0,0 +1,23 @@
+$inherits:
+  from: 'tasks/builds/opt_macosx64_clobber.yml'
+  variables:
+    build_name: 'macosx64-st-an'
+task:
+  metadata:
+      name: '[TC] MacOSX64 Static Analysis Opt'
+      description: 'MacOSX64 Static Analysis Opt'
+
+  routes:
+    - 'index.buildbot.branches.{{project}}.macosx64-st-an'
+    - 'index.buildbot.revisions.{{head_rev}}.{{project}}.macosx64-st-an'
+
+  payload:
+    env:
+      MH_CUSTOM_BUILD_VARIANT_CFG: 'cross-opt'
+      DIST_UPLOADS: ''
+      DIST_TARGET_UPLOADS: ''
+  extra:
+    treeherder:
+      groupSymbol: "?"
+      groupName: Submitted by taskcluster
+      symbol: S
diff --git a/testing/taskcluster/tasks/tests/b2g_build_test.yml b/testing/taskcluster/tasks/tests/b2g_build_test.yml
index 5862175a799c..f829daa9c59c 100644
--- a/testing/taskcluster/tasks/tests/b2g_build_test.yml
+++ b/testing/taskcluster/tasks/tests/b2g_build_test.yml
@@ -22,7 +22,7 @@ task:
         --download-symbols ondemand
         --gaia-repo https://hg.mozilla.org/integration/gaia-central
         --gaia-dir /home/worker
-        --xre-url https://queue.taskcluster.net/v1/task/wXAHAaxDQpqxoWF1iljJjg/runs/0/artifacts/public/cache/xulrunner-sdk-40.zip
+        --xre-url http://people.mozilla.org/~jdai/xulrunner-sdk-40.zip
     artifacts:
       'public/build':
         type: directory
diff --git a/testing/taskcluster/tasks/tests/b2g_emulator_mochitest.yml b/testing/taskcluster/tasks/tests/b2g_emulator_mochitest.yml
index a5850f56d285..b38b4dd77ff7 100644
--- a/testing/taskcluster/tasks/tests/b2g_emulator_mochitest.yml
+++ b/testing/taskcluster/tasks/tests/b2g_emulator_mochitest.yml
@@ -13,6 +13,7 @@ task:
       - entrypoint
       - >
         python ./mozharness/scripts/b2g_emulator_unittest.py
+        --no-read-buildbot-config
         --config-file ./mozharness/configs/b2g/emulator_automation_config.py
         --config-file ./mozharness_configs/gaia_integration_override.py
         --config-file ./mozharness_configs/emulator_override.py
@@ -21,7 +22,7 @@ task:
         --test-suite mochitest
         --installer-url {{build_url}}
         --test-packages-url {{test_packages_url}}
-        --xre-url https://queue.taskcluster.net/v1/task/wXAHAaxDQpqxoWF1iljJjg/runs/0/artifacts/public/cache/xulrunner-sdk-40.zip
+        --xre-url http://people.mozilla.org/~jdai/xulrunner-sdk-40.zip
         --this-chunk {{chunk}}
         --total-chunk {{total_chunks}}
     artifacts:
diff --git a/testing/taskcluster/tasks/tests/b2g_emulator_mochitest_media.yml b/testing/taskcluster/tasks/tests/b2g_emulator_mochitest_media.yml
index 50fd012d834f..773677b13b8f 100644
--- a/testing/taskcluster/tasks/tests/b2g_emulator_mochitest_media.yml
+++ b/testing/taskcluster/tasks/tests/b2g_emulator_mochitest_media.yml
@@ -12,6 +12,7 @@ task:
       - entrypoint
       - >
         python ./mozharness/scripts/b2g_emulator_unittest.py
+        --no-read-buildbot-config
         --config-file ./mozharness/configs/b2g/emulator_automation_config.py
         --config-file ./mozharness_configs/gaia_integration_override.py
         --config-file ./mozharness_configs/emulator_override.py
@@ -20,7 +21,7 @@ task:
         --test-suite mochitest
         --installer-url {{build_url}}
         --test-packages-url {{test_packages_url}}
-        --xre-url https://queue.taskcluster.net/v1/task/wXAHAaxDQpqxoWF1iljJjg/runs/0/artifacts/public/cache/xulrunner-sdk-40.zip
+        --xre-url http://people.mozilla.org/~jdai/xulrunner-sdk-40.zip
         dom/media/tests
     artifacts:
       'public/build':
diff --git a/testing/web-platform/meta/html/dom/interfaces.html.ini b/testing/web-platform/meta/html/dom/interfaces.html.ini
index aff06daf7cae..79e00e9dda62 100644
--- a/testing/web-platform/meta/html/dom/interfaces.html.ini
+++ b/testing/web-platform/meta/html/dom/interfaces.html.ini
@@ -2323,9 +2323,6 @@
   [Navigator interface: window.navigator must inherit property "javaEnabled" with the proper type (20)]
     expected: FAIL
 
-  [MessageEvent interface: operation initMessageEvent(DOMString,boolean,boolean,any,DOMString,DOMString,[object Object\],[object Object\],MessagePort)]
-    expected: FAIL
-
   [PortCollection interface: existence and properties of interface object]
     expected: FAIL
 
diff --git a/widget/android/AndroidJavaWrappers.cpp b/widget/android/AndroidJavaWrappers.cpp
index 114cc4f1446a..8a946b378dfd 100644
--- a/widget/android/AndroidJavaWrappers.cpp
+++ b/widget/android/AndroidJavaWrappers.cpp
@@ -70,7 +70,6 @@ jfieldID AndroidGeckoEvent::jGamepadButtonField = 0;
 jfieldID AndroidGeckoEvent::jGamepadButtonPressedField = 0;
 jfieldID AndroidGeckoEvent::jGamepadButtonValueField = 0;
 jfieldID AndroidGeckoEvent::jGamepadValuesField = 0;
-jfieldID AndroidGeckoEvent::jObjectField = 0;
 
 jclass AndroidPoint::jPointClass = 0;
 jfieldID AndroidPoint::jXField = 0;
@@ -178,7 +177,6 @@ AndroidGeckoEvent::InitGeckoEventClass(JNIEnv *jEnv)
     jGamepadButtonPressedField = geckoEvent.getField("mGamepadButtonPressed", "Z");
     jGamepadButtonValueField = geckoEvent.getField("mGamepadButtonValue", "F");
     jGamepadValuesField = geckoEvent.getField("mGamepadValues", "[F");
-    jObjectField = geckoEvent.getField("mObject", "Ljava/lang/Object;");
 }
 
 void
@@ -473,13 +471,6 @@ AndroidGeckoEvent::Init(JNIEnv *jenv, jobject jobj)
              mMetaState = jenv->GetIntField(jobj, jMetaStateField);
              break;
 
-        case PROCESS_OBJECT: {
-            const jobject obj = jenv->GetObjectField(jobj, jObjectField);
-            mObject.Init(obj, jenv);
-            jenv->DeleteLocalRef(obj);
-            break;
-        }
-
         case LOCATION_EVENT: {
             jobject location = jenv->GetObjectField(jobj, jLocationField);
             mGeoPosition = AndroidLocation::CreateGeoPosition(jenv, location);
diff --git a/widget/android/AndroidJavaWrappers.h b/widget/android/AndroidJavaWrappers.h
index a84f6a27e24c..ed4e06e69ac0 100644
--- a/widget/android/AndroidJavaWrappers.h
+++ b/widget/android/AndroidJavaWrappers.h
@@ -571,7 +571,6 @@ public:
     float GamepadButtonValue() { return mGamepadButtonValue; }
     const nsTArray<float>& GamepadValues() { return mGamepadValues; }
     int RequestId() { return mCount; } // for convenience
-    const AutoGlobalWrappedJavaObject& Object() { return mObject; }
     bool CanCoalesceWith(AndroidGeckoEvent* ae);
     WidgetTouchEvent MakeTouchEvent(nsIWidget* widget);
     MultiTouchInput MakeMultiTouchInput(nsIWidget* widget);
@@ -624,7 +623,6 @@ protected:
     mozilla::layers::ScrollableLayerGuid mApzGuid;
     uint64_t mApzInputBlockId;
     nsEventStatus mApzEventStatus;
-    AutoGlobalWrappedJavaObject mObject;
 
     void ReadIntArray(nsTArray<int> &aVals,
                       JNIEnv *jenv,
@@ -707,15 +705,12 @@ protected:
     static jfieldID jGamepadButtonValueField;
     static jfieldID jGamepadValuesField;
 
-    static jfieldID jObjectField;
-
 public:
     enum {
         NATIVE_POKE = 0,
         KEY_EVENT = 1,
         MOTION_EVENT = 2,
         SENSOR_EVENT = 3,
-        PROCESS_OBJECT = 4,
         LOCATION_EVENT = 5,
         IME_EVENT = 6,
         SIZE_CHANGED = 8,
@@ -786,11 +781,6 @@ public:
         ACTION_GAMEPAD_BUTTON = 1,
         ACTION_GAMEPAD_AXES = 2
     };
-
-    enum {
-        ACTION_OBJECT_LAYER_CLIENT = 1,
-        dummy_object_enum_list_end
-    };
 };
 
 class nsJNIString : public nsString
diff --git a/widget/android/GeneratedJNINatives.h b/widget/android/GeneratedJNINatives.h
index fd3c55273a17..de7e6b3a0bf7 100644
--- a/widget/android/GeneratedJNINatives.h
+++ b/widget/android/GeneratedJNINatives.h
@@ -152,7 +152,11 @@ public:
 
         mozilla::jni::MakeNativeMethod<GeckoView::Window::Open_t>(
                 mozilla::jni::NativeStub<GeckoView::Window::Open_t, Impl>
-                ::template Wrap<&Impl::Open>)
+                ::template Wrap<&Impl::Open>),
+
+        mozilla::jni::MakeNativeMethod<GeckoView::Window::SetLayerClient_t>(
+                mozilla::jni::NativeStub<GeckoView::Window::SetLayerClient_t, Impl>
+                ::template Wrap<&Impl::SetLayerClient>)
     };
 };
 
diff --git a/widget/android/GeneratedJNIWrappers.cpp b/widget/android/GeneratedJNIWrappers.cpp
index 812ba5611e3e..c39fbdbc672f 100644
--- a/widget/android/GeneratedJNIWrappers.cpp
+++ b/widget/android/GeneratedJNIWrappers.cpp
@@ -550,30 +550,6 @@ auto GeckoAppShell::NotifyDefaultPrevented(bool a0) -> void
     return mozilla::jni::Method<NotifyDefaultPrevented_t>::Call(nullptr, nullptr, a0);
 }
 
-constexpr char GeckoAppShell::NotifyIME_t::name[];
-constexpr char GeckoAppShell::NotifyIME_t::signature[];
-
-auto GeckoAppShell::NotifyIME(int32_t a0) -> void
-{
-    return mozilla::jni::Method<NotifyIME_t>::Call(nullptr, nullptr, a0);
-}
-
-constexpr char GeckoAppShell::NotifyIMEChange_t::name[];
-constexpr char GeckoAppShell::NotifyIMEChange_t::signature[];
-
-auto GeckoAppShell::NotifyIMEChange(mozilla::jni::String::Param a0, int32_t a1, int32_t a2, int32_t a3) -> void
-{
-    return mozilla::jni::Method<NotifyIMEChange_t>::Call(nullptr, nullptr, a0, a1, a2, a3);
-}
-
-constexpr char GeckoAppShell::NotifyIMEContext_t::name[];
-constexpr char GeckoAppShell::NotifyIMEContext_t::signature[];
-
-auto GeckoAppShell::NotifyIMEContext(int32_t a0, mozilla::jni::String::Param a1, mozilla::jni::String::Param a2, mozilla::jni::String::Param a3) -> void
-{
-    return mozilla::jni::Method<NotifyIMEContext_t>::Call(nullptr, nullptr, a0, a1, a2, a3);
-}
-
 constexpr char GeckoAppShell::NotifyWakeLockChanged_t::name[];
 constexpr char GeckoAppShell::NotifyWakeLockChanged_t::signature[];
 
@@ -742,6 +718,58 @@ auto GeckoAppShell::VibrateA(mozilla::jni::LongArray::Param a0, int32_t a1) -> v
     return mozilla::jni::Method<VibrateA_t>::Call(nullptr, nullptr, a0, a1);
 }
 
+constexpr char GeckoEditable::name[];
+
+constexpr char GeckoEditable::New_t::name[];
+constexpr char GeckoEditable::New_t::signature[];
+
+auto GeckoEditable::New() -> GeckoEditable::LocalRef
+{
+    return mozilla::jni::Constructor<New_t>::Call(nullptr, nullptr);
+}
+
+constexpr char GeckoEditable::NotifyIME_t::name[];
+constexpr char GeckoEditable::NotifyIME_t::signature[];
+
+auto GeckoEditable::NotifyIME(int32_t a0) const -> void
+{
+    return mozilla::jni::Method<NotifyIME_t>::Call(this, nullptr, a0);
+}
+
+constexpr char GeckoEditable::NotifyIMEContext_t::name[];
+constexpr char GeckoEditable::NotifyIMEContext_t::signature[];
+
+auto GeckoEditable::NotifyIMEContext(int32_t a0, mozilla::jni::String::Param a1, mozilla::jni::String::Param a2, mozilla::jni::String::Param a3) const -> void
+{
+    return mozilla::jni::Method<NotifyIMEContext_t>::Call(this, nullptr, a0, a1, a2, a3);
+}
+
+constexpr char GeckoEditable::OnSelectionChange_t::name[];
+constexpr char GeckoEditable::OnSelectionChange_t::signature[];
+
+auto GeckoEditable::OnSelectionChange(int32_t a0, int32_t a1) const -> void
+{
+    return mozilla::jni::Method<OnSelectionChange_t>::Call(this, nullptr, a0, a1);
+}
+
+constexpr char GeckoEditable::OnTextChange_t::name[];
+constexpr char GeckoEditable::OnTextChange_t::signature[];
+
+auto GeckoEditable::OnTextChange(mozilla::jni::String::Param a0, int32_t a1, int32_t a2, int32_t a3) const -> void
+{
+    return mozilla::jni::Method<OnTextChange_t>::Call(this, nullptr, a0, a1, a2, a3);
+}
+
+constexpr char GeckoEditable::OnViewChange_t::name[];
+constexpr char GeckoEditable::OnViewChange_t::signature[];
+
+auto GeckoEditable::OnViewChange(mozilla::jni::Object::Param a0) const -> void
+{
+    return mozilla::jni::Method<OnViewChange_t>::Call(this, nullptr, a0);
+}
+
+constexpr char GeckoEditableListener::name[];
+
 constexpr char GeckoJavaSampler::name[];
 
 constexpr char GeckoJavaSampler::GetFrameNameJavaProfilingWrapper_t::name[];
@@ -1031,6 +1059,9 @@ constexpr char GeckoView::Window::DisposeNative_t::signature[];
 constexpr char GeckoView::Window::Open_t::name[];
 constexpr char GeckoView::Window::Open_t::signature[];
 
+constexpr char GeckoView::Window::SetLayerClient_t::name[];
+constexpr char GeckoView::Window::SetLayerClient_t::signature[];
+
 constexpr char PrefsHelper::name[];
 
 constexpr char PrefsHelper::GetPrefsById_t::name[];
@@ -1550,14 +1581,6 @@ auto SQLiteBridgeException::New(mozilla::jni::String::Param a0) -> SQLiteBridgeE
     return mozilla::jni::Constructor<New2_t>::Call(nullptr, nullptr, a0);
 }
 
-constexpr char SQLiteBridgeException::SerialVersionUID_t::name[];
-constexpr char SQLiteBridgeException::SerialVersionUID_t::signature[];
-
-auto SQLiteBridgeException::SerialVersionUID() -> int64_t
-{
-    return mozilla::jni::Field<SerialVersionUID_t>::Get(nullptr, nullptr);
-}
-
 constexpr char Clipboard::name[];
 
 constexpr char Clipboard::ClearText_t::name[];
diff --git a/widget/android/GeneratedJNIWrappers.h b/widget/android/GeneratedJNIWrappers.h
index f723324b2161..ca0b87c6a466 100644
--- a/widget/android/GeneratedJNIWrappers.h
+++ b/widget/android/GeneratedJNIWrappers.h
@@ -1313,66 +1313,6 @@ public:
 
     static auto NotifyDefaultPrevented(bool) -> void;
 
-public:
-    struct NotifyIME_t {
-        typedef GeckoAppShell Owner;
-        typedef void ReturnType;
-        typedef void SetterType;
-        typedef mozilla::jni::Args<
-                int32_t> Args;
-        static constexpr char name[] = "notifyIME";
-        static constexpr char signature[] =
-                "(I)V";
-        static const bool isStatic = true;
-        static const bool isMultithreaded = false;
-        static const mozilla::jni::ExceptionMode exceptionMode =
-                mozilla::jni::ExceptionMode::ABORT;
-    };
-
-    static auto NotifyIME(int32_t) -> void;
-
-public:
-    struct NotifyIMEChange_t {
-        typedef GeckoAppShell Owner;
-        typedef void ReturnType;
-        typedef void SetterType;
-        typedef mozilla::jni::Args<
-                mozilla::jni::String::Param,
-                int32_t,
-                int32_t,
-                int32_t> Args;
-        static constexpr char name[] = "notifyIMEChange";
-        static constexpr char signature[] =
-                "(Ljava/lang/String;III)V";
-        static const bool isStatic = true;
-        static const bool isMultithreaded = false;
-        static const mozilla::jni::ExceptionMode exceptionMode =
-                mozilla::jni::ExceptionMode::ABORT;
-    };
-
-    static auto NotifyIMEChange(mozilla::jni::String::Param, int32_t, int32_t, int32_t) -> void;
-
-public:
-    struct NotifyIMEContext_t {
-        typedef GeckoAppShell Owner;
-        typedef void ReturnType;
-        typedef void SetterType;
-        typedef mozilla::jni::Args<
-                int32_t,
-                mozilla::jni::String::Param,
-                mozilla::jni::String::Param,
-                mozilla::jni::String::Param> Args;
-        static constexpr char name[] = "notifyIMEContext";
-        static constexpr char signature[] =
-                "(ILjava/lang/String;Ljava/lang/String;Ljava/lang/String;)V";
-        static const bool isStatic = true;
-        static const bool isMultithreaded = false;
-        static const mozilla::jni::ExceptionMode exceptionMode =
-                mozilla::jni::ExceptionMode::ABORT;
-    };
-
-    static auto NotifyIMEContext(int32_t, mozilla::jni::String::Param, mozilla::jni::String::Param, mozilla::jni::String::Param) -> void;
-
 public:
     struct NotifyWakeLockChanged_t {
         typedef GeckoAppShell Owner;
@@ -1764,6 +1704,158 @@ public:
 
 };
 
+class GeckoEditable : public mozilla::jni::Class<GeckoEditable>
+{
+public:
+    typedef mozilla::jni::Ref<GeckoEditable> Ref;
+    typedef mozilla::jni::LocalRef<GeckoEditable> LocalRef;
+    typedef mozilla::jni::GlobalRef<GeckoEditable> GlobalRef;
+    typedef const mozilla::jni::Param<GeckoEditable>& Param;
+
+    static constexpr char name[] =
+            "org/mozilla/gecko/GeckoEditable";
+
+protected:
+    GeckoEditable(jobject instance) : Class(instance) {}
+
+public:
+    struct New_t {
+        typedef GeckoEditable Owner;
+        typedef GeckoEditable::LocalRef ReturnType;
+        typedef GeckoEditable::Param SetterType;
+        typedef mozilla::jni::Args<> Args;
+        static constexpr char name[] = "<init>";
+        static constexpr char signature[] =
+                "()V";
+        static const bool isStatic = false;
+        static const bool isMultithreaded = false;
+        static const mozilla::jni::ExceptionMode exceptionMode =
+                mozilla::jni::ExceptionMode::ABORT;
+    };
+
+    static auto New() -> GeckoEditable::LocalRef;
+
+public:
+    struct NotifyIME_t {
+        typedef GeckoEditable Owner;
+        typedef void ReturnType;
+        typedef void SetterType;
+        typedef mozilla::jni::Args<
+                int32_t> Args;
+        static constexpr char name[] = "notifyIME";
+        static constexpr char signature[] =
+                "(I)V";
+        static const bool isStatic = false;
+        static const bool isMultithreaded = false;
+        static const mozilla::jni::ExceptionMode exceptionMode =
+                mozilla::jni::ExceptionMode::ABORT;
+    };
+
+    auto NotifyIME(int32_t) const -> void;
+
+public:
+    struct NotifyIMEContext_t {
+        typedef GeckoEditable Owner;
+        typedef void ReturnType;
+        typedef void SetterType;
+        typedef mozilla::jni::Args<
+                int32_t,
+                mozilla::jni::String::Param,
+                mozilla::jni::String::Param,
+                mozilla::jni::String::Param> Args;
+        static constexpr char name[] = "notifyIMEContext";
+        static constexpr char signature[] =
+                "(ILjava/lang/String;Ljava/lang/String;Ljava/lang/String;)V";
+        static const bool isStatic = false;
+        static const bool isMultithreaded = false;
+        static const mozilla::jni::ExceptionMode exceptionMode =
+                mozilla::jni::ExceptionMode::ABORT;
+    };
+
+    auto NotifyIMEContext(int32_t, mozilla::jni::String::Param, mozilla::jni::String::Param, mozilla::jni::String::Param) const -> void;
+
+public:
+    struct OnSelectionChange_t {
+        typedef GeckoEditable Owner;
+        typedef void ReturnType;
+        typedef void SetterType;
+        typedef mozilla::jni::Args<
+                int32_t,
+                int32_t> Args;
+        static constexpr char name[] = "onSelectionChange";
+        static constexpr char signature[] =
+                "(II)V";
+        static const bool isStatic = false;
+        static const bool isMultithreaded = false;
+        static const mozilla::jni::ExceptionMode exceptionMode =
+                mozilla::jni::ExceptionMode::ABORT;
+    };
+
+    auto OnSelectionChange(int32_t, int32_t) const -> void;
+
+public:
+    struct OnTextChange_t {
+        typedef GeckoEditable Owner;
+        typedef void ReturnType;
+        typedef void SetterType;
+        typedef mozilla::jni::Args<
+                mozilla::jni::String::Param,
+                int32_t,
+                int32_t,
+                int32_t> Args;
+        static constexpr char name[] = "onTextChange";
+        static constexpr char signature[] =
+                "(Ljava/lang/CharSequence;III)V";
+        static const bool isStatic = false;
+        static const bool isMultithreaded = false;
+        static const mozilla::jni::ExceptionMode exceptionMode =
+                mozilla::jni::ExceptionMode::ABORT;
+    };
+
+    auto OnTextChange(mozilla::jni::String::Param, int32_t, int32_t, int32_t) const -> void;
+
+public:
+    struct OnViewChange_t {
+        typedef GeckoEditable Owner;
+        typedef void ReturnType;
+        typedef void SetterType;
+        typedef mozilla::jni::Args<
+                mozilla::jni::Object::Param> Args;
+        static constexpr char name[] = "onViewChange";
+        static constexpr char signature[] =
+                "(Lorg/mozilla/gecko/GeckoView;)V";
+        static const bool isStatic = false;
+        static const bool isMultithreaded = false;
+        static const mozilla::jni::ExceptionMode exceptionMode =
+                mozilla::jni::ExceptionMode::ABORT;
+    };
+
+    auto OnViewChange(mozilla::jni::Object::Param) const -> void;
+
+};
+
+class GeckoEditableListener : public mozilla::jni::Class<GeckoEditableListener>
+{
+public:
+    typedef mozilla::jni::Ref<GeckoEditableListener> Ref;
+    typedef mozilla::jni::LocalRef<GeckoEditableListener> LocalRef;
+    typedef mozilla::jni::GlobalRef<GeckoEditableListener> GlobalRef;
+    typedef const mozilla::jni::Param<GeckoEditableListener>& Param;
+
+    static constexpr char name[] =
+            "org/mozilla/gecko/GeckoEditableListener";
+
+protected:
+    GeckoEditableListener(jobject instance) : Class(instance) {}
+
+public:
+    static const int32_t NOTIFY_IME_OPEN_VKB = -2;
+
+public:
+    static const int32_t NOTIFY_IME_REPLY_EVENT = -1;
+
+};
+
 class GeckoJavaSampler : public mozilla::jni::Class<GeckoJavaSampler>
 {
 public:
@@ -2649,11 +2741,28 @@ public:
         typedef void SetterType;
         typedef mozilla::jni::Args<
                 Window::Param,
+                GeckoView::Param,
                 int32_t,
                 int32_t> Args;
         static constexpr char name[] = "open";
         static constexpr char signature[] =
-                "(Lorg/mozilla/gecko/GeckoView$Window;II)V";
+                "(Lorg/mozilla/gecko/GeckoView$Window;Lorg/mozilla/gecko/GeckoView;II)V";
+        static const bool isStatic = true;
+        static const bool isMultithreaded = true;
+        static const mozilla::jni::ExceptionMode exceptionMode =
+                mozilla::jni::ExceptionMode::ABORT;
+    };
+
+public:
+    struct SetLayerClient_t {
+        typedef Window Owner;
+        typedef void ReturnType;
+        typedef void SetterType;
+        typedef mozilla::jni::Args<
+                mozilla::jni::Object::Param> Args;
+        static constexpr char name[] = "setLayerClient";
+        static constexpr char signature[] =
+                "(Ljava/lang/Object;)V";
         static const bool isStatic = true;
         static const bool isMultithreaded = true;
         static const mozilla::jni::ExceptionMode exceptionMode =
@@ -3897,21 +4006,7 @@ public:
     static auto New(mozilla::jni::String::Param) -> SQLiteBridgeException::LocalRef;
 
 public:
-    struct SerialVersionUID_t {
-        typedef SQLiteBridgeException Owner;
-        typedef int64_t ReturnType;
-        typedef int64_t SetterType;
-        typedef mozilla::jni::Args<> Args;
-        static constexpr char name[] = "serialVersionUID";
-        static constexpr char signature[] =
-                "J";
-        static const bool isStatic = true;
-        static const bool isMultithreaded = true;
-        static const mozilla::jni::ExceptionMode exceptionMode =
-                mozilla::jni::ExceptionMode::ABORT;
-    };
-
-    static auto SerialVersionUID() -> int64_t;
+    static const int64_t SerialVersionUID = 1;
 
 };
 
diff --git a/widget/android/nsAppShell.cpp b/widget/android/nsAppShell.cpp
index 633b2065952b..8f198991ac6a 100644
--- a/widget/android/nsAppShell.cpp
+++ b/widget/android/nsAppShell.cpp
@@ -434,17 +434,6 @@ nsAppShell::LegacyGeckoEvent::Run()
       }
       break;
 
-    case AndroidGeckoEvent::PROCESS_OBJECT: {
-
-      switch (curEvent->Action()) {
-      case AndroidGeckoEvent::ACTION_OBJECT_LAYER_CLIENT:
-        AndroidBridge::Bridge()->SetLayerClient(
-                widget::GeckoLayerClient::Ref::From(curEvent->Object().wrappedObject()));
-        break;
-      }
-      break;
-    }
-
     case AndroidGeckoEvent::LOCATION_EVENT: {
         if (!gLocationCallback)
             break;
diff --git a/widget/android/nsWindow.cpp b/widget/android/nsWindow.cpp
index 56a31bbd8c8c..167f00d41e1d 100644
--- a/widget/android/nsWindow.cpp
+++ b/widget/android/nsWindow.cpp
@@ -186,12 +186,22 @@ public:
     // Create and attach a window.
     static void Open(const jni::ClassObject::LocalRef& cls,
                      GeckoView::Window::Param gvWindow,
+                     GeckoView::Param view,
                      int32_t width, int32_t height);
+
+    // Set the active layer client object
+    static void SetLayerClient(jni::Object::Param client)
+    {
+        MOZ_ASSERT(NS_IsMainThread());
+        AndroidBridge::Bridge()->SetLayerClient(
+                widget::GeckoLayerClient::Ref::From(client.Get()));
+    }
 };
 
 void
 nsWindow::Natives::Open(const jni::ClassObject::LocalRef& cls,
                         GeckoView::Window::Param gvWindow,
+                        GeckoView::Param view,
                         int32_t width, int32_t height)
 {
     MOZ_ASSERT(NS_IsMainThread());
@@ -202,6 +212,10 @@ nsWindow::Natives::Open(const jni::ClassObject::LocalRef& cls,
     if (gGeckoViewWindow) {
         // Should have been created the first time.
         MOZ_ASSERT(gGeckoViewWindow->mNatives);
+
+        // Associate our previous GeckoEditable with the new GeckoView.
+        gGeckoViewWindow->mEditable->OnViewChange(view);
+
         AttachNative(GeckoView::Window::LocalRef(cls.Env(), gvWindow),
                      gGeckoViewWindow->mNatives.get());
         return;
@@ -241,6 +255,11 @@ nsWindow::Natives::Open(const jni::ClassObject::LocalRef& cls,
 
     gGeckoViewWindow = static_cast<nsWindow*>(widget.get());
     gGeckoViewWindow->mNatives = mozilla::MakeUnique<Natives>(gGeckoViewWindow);
+
+    // Create GeckoEditable for the new nsWindow/GeckoView pair.
+    gGeckoViewWindow->mEditable = GeckoEditable::New();
+    gGeckoViewWindow->mEditable->OnViewChange(view);
+
     AttachNative(GeckoView::Window::LocalRef(cls.Env(), gvWindow),
                  gGeckoViewWindow->mNatives.get());
 }
@@ -1003,8 +1022,8 @@ nsWindow::OnGlobalAndroidEvent(AndroidGeckoEvent *ae)
             break;
 
         case AndroidGeckoEvent::IME_EVENT:
-            win->UserActivity();
-            win->OnIMEEvent(ae);
+            gGeckoViewWindow->UserActivity();
+            gGeckoViewWindow->OnIMEEvent(ae);
             break;
 
         case AndroidGeckoEvent::IME_KEY_EVENT:
@@ -1800,7 +1819,7 @@ public:
 nsRefPtr<mozilla::TextComposition>
 nsWindow::GetIMEComposition()
 {
-    MOZ_ASSERT(this == TopWindow());
+    MOZ_ASSERT(this == FindTopLevel());
     return mozilla::IMEStateManager::GetTextCompositionFor(this);
 }
 
@@ -1876,14 +1895,14 @@ nsWindow::OnIMEEvent(AndroidGeckoEvent *ae)
             NotifyIMEOfTextChange(notification);
             FlushIMEChanges();
         }
-        GeckoAppShell::NotifyIME(AndroidBridge::NOTIFY_IME_REPLY_EVENT);
+        mEditable->NotifyIME(GeckoEditableListener::NOTIFY_IME_REPLY_EVENT);
         return;
 
     } else if (ae->Action() == AndroidGeckoEvent::IME_UPDATE_CONTEXT) {
-        GeckoAppShell::NotifyIMEContext(mInputContext.mIMEState.mEnabled,
-                                        mInputContext.mHTMLInputType,
-                                        mInputContext.mHTMLInputInputmode,
-                                        mInputContext.mActionHint);
+        mEditable->NotifyIMEContext(mInputContext.mIMEState.mEnabled,
+                                    mInputContext.mHTMLInputType,
+                                    mInputContext.mHTMLInputInputmode,
+                                    mInputContext.mActionHint);
         mIMEUpdatingContext = false;
         return;
     }
@@ -1893,7 +1912,7 @@ nsWindow::OnIMEEvent(AndroidGeckoEvent *ae)
         if (ae->Action() == AndroidGeckoEvent::IME_SYNCHRONIZE ||
             ae->Action() == AndroidGeckoEvent::IME_COMPOSE_TEXT ||
             ae->Action() == AndroidGeckoEvent::IME_REPLACE_TEXT) {
-            GeckoAppShell::NotifyIME(AndroidBridge::NOTIFY_IME_REPLY_EVENT);
+            mEditable->NotifyIME(GeckoEditableListener::NOTIFY_IME_REPLY_EVENT);
         }
         return;
     }
@@ -1908,7 +1927,7 @@ nsWindow::OnIMEEvent(AndroidGeckoEvent *ae)
     case AndroidGeckoEvent::IME_SYNCHRONIZE:
         {
             FlushIMEChanges();
-            GeckoAppShell::NotifyIME(AndroidBridge::NOTIFY_IME_REPLY_EVENT);
+            mEditable->NotifyIME(GeckoEditableListener::NOTIFY_IME_REPLY_EVENT);
         }
         break;
 
@@ -1953,7 +1972,8 @@ nsWindow::OnIMEEvent(AndroidGeckoEvent *ae)
                     }
                     mIMEKeyEvents.Clear();
                     FlushIMEChanges();
-                    GeckoAppShell::NotifyIME(AndroidBridge::NOTIFY_IME_REPLY_EVENT);
+                    mEditable->NotifyIME(
+                            GeckoEditableListener::NOTIFY_IME_REPLY_EVENT);
                     // Break out of the switch block
                     break;
                 }
@@ -2004,7 +2024,7 @@ nsWindow::OnIMEEvent(AndroidGeckoEvent *ae)
             }
 
             FlushIMEChanges();
-            GeckoAppShell::NotifyIME(AndroidBridge::NOTIFY_IME_REPLY_EVENT);
+            mEditable->NotifyIME(GeckoEditableListener::NOTIFY_IME_REPLY_EVENT);
         }
         break;
 
@@ -2168,13 +2188,17 @@ nsWindow::UserActivity()
 nsresult
 nsWindow::NotifyIMEInternal(const IMENotification& aIMENotification)
 {
-    MOZ_ASSERT(this == TopWindow());
+    MOZ_ASSERT(this == FindTopLevel());
+
+    if (!mEditable) {
+        return NS_ERROR_NOT_AVAILABLE;
+    }
 
     switch (aIMENotification.mMessage) {
         case REQUEST_TO_COMMIT_COMPOSITION:
             //ALOGIME("IME: REQUEST_TO_COMMIT_COMPOSITION: s=%d", aState);
             RemoveIMEComposition();
-            GeckoAppShell::NotifyIME(REQUEST_TO_COMMIT_COMPOSITION);
+            mEditable->NotifyIME(REQUEST_TO_COMMIT_COMPOSITION);
             return NS_OK;
 
         case REQUEST_TO_CANCEL_COMPOSITION:
@@ -2192,12 +2216,12 @@ nsWindow::NotifyIMEInternal(const IMENotification& aIMENotification)
                 DispatchEvent(&compositionCommitEvent);
             }
 
-            GeckoAppShell::NotifyIME(REQUEST_TO_CANCEL_COMPOSITION);
+            mEditable->NotifyIME(REQUEST_TO_CANCEL_COMPOSITION);
             return NS_OK;
 
         case NOTIFY_IME_OF_FOCUS:
             ALOGIME("IME: NOTIFY_IME_OF_FOCUS");
-            GeckoAppShell::NotifyIME(NOTIFY_IME_OF_FOCUS);
+            mEditable->NotifyIME(NOTIFY_IME_OF_FOCUS);
             return NS_OK;
 
         case NOTIFY_IME_OF_BLUR:
@@ -2208,7 +2232,7 @@ nsWindow::NotifyIMEInternal(const IMENotification& aIMENotification)
             // event back to Gecko. That is where we unmask event handling
             mIMEMaskEventsCount++;
 
-            GeckoAppShell::NotifyIME(NOTIFY_IME_OF_BLUR);
+            mEditable->NotifyIME(NOTIFY_IME_OF_BLUR);
             return NS_OK;
 
         case NOTIFY_IME_OF_SELECTION_CHANGE:
@@ -2238,7 +2262,7 @@ nsWindow::SetInputContext(const InputContext& aContext,
     // Disable the Android keyboard on b2gdroid.
     return;
 #endif
-    nsWindow *top = TopWindow();
+    nsWindow *top = FindTopLevel();
     if (top && this != top) {
         // We are using an IME event later to notify Java, and the IME event
         // will be processed by the top window. Therefore, to ensure the
@@ -2248,6 +2272,10 @@ nsWindow::SetInputContext(const InputContext& aContext,
         return;
     }
 
+    if (!mEditable) {
+        return;
+    }
+
     ALOGIME("IME: SetInputContext: s=0x%X, 0x%X, action=0x%X, 0x%X",
             aContext.mIMEState.mEnabled, aContext.mIMEState.mOpen,
             aAction.mCause, aAction.mFocusChange);
@@ -2276,7 +2304,7 @@ nsWindow::SetInputContext(const InputContext& aContext,
 
     if (enabled == IMEState::ENABLED && aAction.UserMightRequestOpenVKB()) {
         // Don't reset keyboard when we should simply open the vkb
-        GeckoAppShell::NotifyIME(AndroidBridge::NOTIFY_IME_OPEN_VKB);
+        mEditable->NotifyIME(GeckoEditableListener::NOTIFY_IME_OPEN_VKB);
         return;
     }
 
@@ -2292,7 +2320,7 @@ nsWindow::SetInputContext(const InputContext& aContext,
 NS_IMETHODIMP_(InputContext)
 nsWindow::GetInputContext()
 {
-    nsWindow *top = TopWindow();
+    nsWindow *top = FindTopLevel();
     if (top && this != top) {
         // We let the top window process SetInputContext,
         // so we should let it process GetInputContext as well.
@@ -2352,8 +2380,8 @@ nsWindow::FlushIMEChanges()
             NS_ENSURE_TRUE_VOID(event.mReply.mContentsRoot == imeRoot.get());
         }
 
-        GeckoAppShell::NotifyIMEChange(event.mReply.mString, change.mStart,
-                                       change.mOldEnd, change.mNewEnd);
+        mEditable->OnTextChange(event.mReply.mString, change.mStart,
+                                change.mOldEnd, change.mNewEnd);
     }
     mIMETextChanges.Clear();
 
@@ -2365,9 +2393,8 @@ nsWindow::FlushIMEChanges()
         NS_ENSURE_TRUE_VOID(event.mSucceeded);
         NS_ENSURE_TRUE_VOID(event.mReply.mContentsRoot == imeRoot.get());
 
-        GeckoAppShell::NotifyIMEChange(EmptyString(),
-                                       int32_t(event.GetSelectionStart()),
-                                       int32_t(event.GetSelectionEnd()), -1);
+        mEditable->OnSelectionChange(int32_t(event.GetSelectionStart()),
+                                     int32_t(event.GetSelectionEnd()));
         mIMESelectionChanged = false;
     }
 }
@@ -2375,6 +2402,8 @@ nsWindow::FlushIMEChanges()
 nsresult
 nsWindow::NotifyIMEOfTextChange(const IMENotification& aIMENotification)
 {
+    MOZ_ASSERT(this == FindTopLevel());
+
     MOZ_ASSERT(aIMENotification.mMessage == NOTIFY_IME_OF_TEXT_CHANGE,
                "NotifyIMEOfTextChange() is called with invaild notification");
 
diff --git a/widget/android/nsWindow.h b/widget/android/nsWindow.h
index 417562157eda..0247c81721a9 100644
--- a/widget/android/nsWindow.h
+++ b/widget/android/nsWindow.h
@@ -49,6 +49,9 @@ public:
     // Object that implements native GeckoView calls;
     // nullptr for nsWindows that were not opened from GeckoView.
     mozilla::UniquePtr<Natives> mNatives;
+    // GeckoEditable instance used by this nsWindow;
+    // nullptr for nsWindows that are not GeckoViews.
+    mozilla::widget::GeckoEditable::GlobalRef mEditable;
 
     static void OnGlobalAndroidEvent(mozilla::AndroidGeckoEvent *ae);
     static mozilla::gfx::IntSize GetAndroidScreenBounds();
diff --git a/xpfe/appshell/nsXULWindow.cpp b/xpfe/appshell/nsXULWindow.cpp
index 571ae4b5a0e7..741f06af5e38 100644
--- a/xpfe/appshell/nsXULWindow.cpp
+++ b/xpfe/appshell/nsXULWindow.cpp
@@ -1473,6 +1473,9 @@ void nsXULWindow::SaveAttributes()
     return;
   }
 
+  nsAutoString persistString;
+  docShellElement->GetAttribute(PERSIST_ATTRIBUTE, persistString);
+
   // get our size, position and mode to persist
   nsIntRect rect;
   bool gotRestoredBounds = NS_SUCCEEDED(mWindow->GetRestoredBounds(rect));
@@ -1495,23 +1498,29 @@ void nsXULWindow::SaveAttributes()
   ErrorResult rv;
   // (only for size elements which are persisted)
   if ((mPersistentAttributesDirty & PAD_POSITION) && gotRestoredBounds) {
-    PR_snprintf(sizeBuf, sizeof(sizeBuf), "%d", NSToIntRound(rect.x / scale.scale));
-    sizeString.AssignWithConversion(sizeBuf);
-    docShellElement->SetAttribute(SCREENX_ATTRIBUTE, sizeString, rv);
-
-    PR_snprintf(sizeBuf, sizeof(sizeBuf), "%d", NSToIntRound(rect.y / scale.scale));
-    sizeString.AssignWithConversion(sizeBuf);
-    docShellElement->SetAttribute(SCREENY_ATTRIBUTE, sizeString, rv);
+    if (persistString.Find("screenX") >= 0) {
+      PR_snprintf(sizeBuf, sizeof(sizeBuf), "%d", NSToIntRound(rect.x / scale.scale));
+      sizeString.AssignWithConversion(sizeBuf);
+      docShellElement->SetAttribute(SCREENX_ATTRIBUTE, sizeString, rv);
+    }
+    if (persistString.Find("screenY") >= 0) {
+      PR_snprintf(sizeBuf, sizeof(sizeBuf), "%d", NSToIntRound(rect.y / scale.scale));
+      sizeString.AssignWithConversion(sizeBuf);
+      docShellElement->SetAttribute(SCREENY_ATTRIBUTE, sizeString, rv);
+    }
   }
 
   if ((mPersistentAttributesDirty & PAD_SIZE) && gotRestoredBounds) {
-    PR_snprintf(sizeBuf, sizeof(sizeBuf), "%d", NSToIntRound(rect.width / scale.scale));
-    sizeString.AssignWithConversion(sizeBuf);
-    docShellElement->SetAttribute(WIDTH_ATTRIBUTE, sizeString, rv);
-
-    PR_snprintf(sizeBuf, sizeof(sizeBuf), "%d", NSToIntRound(rect.height / scale.scale));
-    sizeString.AssignWithConversion(sizeBuf);
-    docShellElement->SetAttribute(HEIGHT_ATTRIBUTE, sizeString, rv);
+    if (persistString.Find("width") >= 0) {
+      PR_snprintf(sizeBuf, sizeof(sizeBuf), "%d", NSToIntRound(rect.width / scale.scale));
+      sizeString.AssignWithConversion(sizeBuf);
+      docShellElement->SetAttribute(WIDTH_ATTRIBUTE, sizeString, rv);
+    }
+    if (persistString.Find("height") >= 0) {
+      PR_snprintf(sizeBuf, sizeof(sizeBuf), "%d", NSToIntRound(rect.height / scale.scale));
+      sizeString.AssignWithConversion(sizeBuf);
+      docShellElement->SetAttribute(HEIGHT_ATTRIBUTE, sizeString, rv);
+    }
   }
 
   if (mPersistentAttributesDirty & PAD_MISC) {
@@ -1526,14 +1535,15 @@ void nsXULWindow::SaveAttributes()
         sizeString.Assign(SIZEMODE_NORMAL);
       docShellElement->SetAttribute(MODE_ATTRIBUTE, sizeString, rv);
     }
-
-    uint32_t zLevel;
-    nsCOMPtr<nsIWindowMediator> mediator(do_GetService(NS_WINDOWMEDIATOR_CONTRACTID));
-    if (mediator) {
-      mediator->GetZLevel(this, &zLevel);
-      PR_snprintf(sizeBuf, sizeof(sizeBuf), "%lu", (unsigned long)zLevel);
-      sizeString.AssignWithConversion(sizeBuf);
-      docShellElement->SetAttribute(ZLEVEL_ATTRIBUTE, sizeString, rv);
+    if (persistString.Find("zlevel") >= 0) {
+      uint32_t zLevel;
+      nsCOMPtr<nsIWindowMediator> mediator(do_GetService(NS_WINDOWMEDIATOR_CONTRACTID));
+      if (mediator) {
+        mediator->GetZLevel(this, &zLevel);
+        PR_snprintf(sizeBuf, sizeof(sizeBuf), "%lu", (unsigned long)zLevel);
+        sizeString.AssignWithConversion(sizeBuf);
+        docShellElement->SetAttribute(ZLEVEL_ATTRIBUTE, sizeString, rv);
+      }
     }
   }