Merge mozilla-central into build-system

accessible/src/base/nsARIAMap.cpp

@@ -249,7 +249,7 @@ static nsRoleMapEntry sWAIRoleMaps[] =
     eNoValue,
     eNoAction,
     eNoLiveAttr,
-    eSelect,
+    eListControl | eSelect,
     kNoReqStates,
     eARIAMultiSelectable,
     eARIAReadonly

accessible/src/base/nsAccessibilityService.cpp

@@ -804,7 +804,7 @@ nsAccessibilityService::GetOrCreateAccessible(nsINode* aNode,
           newAcc = new ARIAGridCellAccessibleWrap(content, document);
         }
 
-      } else if ((roleMapEntry->accTypes & eTable) &&
+      } else if ((roleMapEntry->IsOfType(eTable)) &&
                  frame->AccessibleType() != eHTMLTableType) {
         newAcc = new ARIAGridAccessibleWrap(content, document);
       }
@@ -824,7 +824,7 @@ nsAccessibilityService::GetOrCreateAccessible(nsINode* aNode,
       if (!roleMapEntry && newAcc) {
         if (frame->AccessibleType() == eHTMLTableRowType) {
           nsRoleMapEntry* contextRoleMap = aContext->ARIARoleMap();
-          if (contextRoleMap && !(contextRoleMap->accTypes & eTable))
+          if (contextRoleMap && !(contextRoleMap->IsOfType(eTable)))
             roleMapEntry = &nsARIAMap::gEmptyRoleMap;
 
         } else if (frame->AccessibleType() == eHTMLTableCellType &&
@@ -836,7 +836,7 @@ nsAccessibilityService::GetOrCreateAccessible(nsINode* aNode,
                    content->Tag() == nsGkAtoms::dd ||
                    frame->AccessibleType() == eHTMLLiType) {
           nsRoleMapEntry* contextRoleMap = aContext->ARIARoleMap();
-          if (contextRoleMap && !(contextRoleMap->accTypes & eList))
+          if (contextRoleMap && !(contextRoleMap->IsOfType(eList)))
             roleMapEntry = &nsARIAMap::gEmptyRoleMap;
         }
       }

accessible/src/generic/Accessible.cpp

@@ -1589,17 +1589,44 @@ Accessible::GetValue(nsAString& aValue)
 void
 Accessible::Value(nsString& aValue)
 {
-  if (mRoleMapEntry) {
-    if (mRoleMapEntry->valueRule == eNoValue)
-      return;
+  if (!mRoleMapEntry)
+    return;
 
-    // aria-valuenow is a number, and aria-valuetext is the optional text equivalent
-    // For the string value, we will try the optional text equivalent first
+  if (mRoleMapEntry->valueRule != eNoValue) {
+    // aria-valuenow is a number, and aria-valuetext is the optional text
+    // equivalent. For the string value, we will try the optional text
+    // equivalent first.
     if (!mContent->GetAttr(kNameSpaceID_None,
                            nsGkAtoms::aria_valuetext, aValue)) {
       mContent->GetAttr(kNameSpaceID_None, nsGkAtoms::aria_valuenow,
                         aValue);
     }
+    return;
+  }
+
+  // Value of combobox is a text of current or selected item.
+  if (mRoleMapEntry->Is(nsGkAtoms::combobox)) {
+    Accessible* option = CurrentItem();
+    if (!option) {
+      Accessible* listbox = nullptr;
+      IDRefsIterator iter(mDoc, mContent, nsGkAtoms::aria_owns);
+      while ((listbox = iter.Next()) && !listbox->IsListControl());
+
+      if (!listbox) {
+        uint32_t childCount = ChildCount();
+        for (uint32_t idx = 0; idx < childCount; idx++) {
+          Accessible* child = mChildren.ElementAt(idx);
+          if (child->IsListControl())
+            listbox = child;
+        }
+      }
+
+      if (listbox)
+        option = listbox->GetSelectedItem(0);
+    }
+
+    if (option)
+      nsTextEquivUtils::GetNameFromSubtree(option, aValue);
   }
 }
 

accessible/src/html/HTMLFormControlAccessible.cpp

@@ -358,7 +358,7 @@ HTMLTextFieldAccessible::Value(nsString& aValue)
     textArea->GetValue(aValue);
     return;
   }
-  
+
   nsHTMLInputElement* input = nsHTMLInputElement::FromContent(mContent);
   if (input)
     input->GetValue(aValue);

accessible/src/html/HTMLTableAccessible.cpp

@@ -502,7 +502,8 @@ HTMLTableAccessible::SelectedCellCount()
       int32_t startRow = -1, startCol = -1;
       cellFrame->GetRowIndex(startRow);
       cellFrame->GetColIndex(startCol);
-      if (startRow == rowIdx && startCol == colIdx)
+      if (startRow >= 0 && (uint32_t)startRow == rowIdx &&
+          startCol >= 0 && (uint32_t)startCol == colIdx)
         count++;
     }
   }
@@ -551,7 +552,8 @@ HTMLTableAccessible::SelectedCells(nsTArray<Accessible*>* aCells)
       int32_t startCol = -1, startRow = -1;
       cellFrame->GetRowIndex(startRow);
       cellFrame->GetColIndex(startCol);
-      if (startRow != rowIdx || startCol != colIdx)
+      if ((startRow >= 0 && (uint32_t)startRow != rowIdx) ||
+          (startCol >= 0 && (uint32_t)startCol != colIdx))
         continue;
 
       Accessible* cell = mDoc->GetAccessible(cellFrame->GetContent());
@@ -577,7 +579,8 @@ HTMLTableAccessible::SelectedCellIndices(nsTArray<uint32_t>* aCells)
       int32_t startRow = -1, startCol = -1;
       cellFrame->GetColIndex(startCol);
       cellFrame->GetRowIndex(startRow);
-      if (startRow == rowIdx && startCol == colIdx)
+      if (startRow >= 0 && (uint32_t)startRow == rowIdx &&
+          startCol >= 0 && (uint32_t)startCol == colIdx)
         aCells->AppendElement(CellIndexAt(rowIdx, colIdx));
     }
   }

accessible/tests/mochitest/value/test_general.html

@@ -50,6 +50,21 @@
       testValue("aria_main_link", href);
       testValue("aria_navigation_link", href);
 
+      //////////////////////////////////////////////////////////////////////////
+      // ARIA comboboxes
+
+      // aria-activedescendant defines a current item the value is computed from
+      testValue("aria_combobox1", kDiscBulletText + "Zoom");
+
+      // aria-selected defines a selected item the value is computed from,
+      // list control is pointed by aria-owns relation.
+      testValue("aria_combobox2", kDiscBulletText + "Zoom");
+
+      // aria-selected defines a selected item the value is computed from,
+      // list control is a child of combobox.
+      testValue("aria_combobox3", kDiscBulletText + "2");
+
+      //////////////////////////////////////////////////////////////////////////
       // HTML controls
       testValue("combobox1", "item1");
       testValue("combobox2", "item2");
@@ -69,7 +84,12 @@
      href="https://bugzilla.mozilla.org/show_bug.cgi?id=494807"
      title="Do not expose a11y info specific to hyperlinks when role is overridden using ARIA">
     Mozilla Bug 494807
-  </a><br />
+  </a>
+  <a target="_blank"
+     href="https://bugzilla.mozilla.org/show_bug.cgi?id=819273"
+     title=" ARIA combobox should have accessible value">
+    Mozilla Bug 819273
+  </a>
   <p id="display"></p>
   <div id="content" style="display: none">
   </div>
@@ -88,6 +108,32 @@
   <!-- strange edge case: please don't do this in the wild -->
   <a id="aria_link_link" role="link" href="foo">link</a>
 
+  <div id="aria_combobox1" role="combobox"
+       aria-owns="aria_combobox1_owned_listbox"
+       aria-activedescendant="aria_combobox1_selected_option">
+  </div>
+  <ul role="listbox" id="aria_combobox1_owned_listbox">
+    <li role="option">Zebra</li>
+    <li role="option" id="aria_combobox1_selected_option">Zoom</li>
+  </ul>
+
+  <div id="aria_combobox2" role="combobox"
+       aria-owns="aria_combobox2_owned_listbox">
+  </div>
+  <ul role="listbox" id="aria_combobox2_owned_listbox">
+    <li role="option">Zebra</li>
+    <li role="option" aria-selected="true">Zoom</li>
+  </ul>
+
+  <div id="aria_combobox3" role="combobox">
+    <div role="textbox"></div>
+    <ul role="listbox">
+      <li role="option">1</li>
+      <li role="option" aria-selected="true">2</li>
+      <li role="option">3</li>
+    </ul>
+  </div>
+
   <select id="combobox1">
     <option id="cb1_item1">item1</option>
     <option id="cb1_item2">item2</option>

b2g/app/BootAnimation.cpp

@@ -363,9 +363,8 @@ AnimationThread(void *)
     ANativeWindow const * const window = gNativeWindow.get();
     window->query(window, NATIVE_WINDOW_FORMAT, &format);
 
-    EGLConfig config = NULL;
-    CreateConfig(&config, display, format);
-    if (!config) {
+    EGLConfig config;
+    if (!CreateConfig(&config, display, format)) {
         LOGW("Could not find config for pixel format");
         return nullptr;
     }

b2g/app/b2g.js

@@ -333,7 +333,7 @@ pref("urlclassifier.gethashtables", "goog-phish-shavar,goog-malware-shavar");
 // If an urlclassifier table has not been updated in this number of seconds,
 // a gethash request will be forced to check that the result is still in
 // the database.
-pref("urlclassifier.confirm-age", 2700);
+pref("urlclassifier.max-complete-age", 2700);
 
 // URL for checking the reason for a malware warning.
 pref("browser.safebrowsing.malware.reportURL", "http://safebrowsing.clients.google.com/safebrowsing/diagnostic?client=%NAME%&hl=%LOCALE%&site=");

b2g/chrome/content/identity.js

@@ -98,6 +98,7 @@ function doInternalWatch() {
 function doInternalRequest() {
   log("doInternalRequest:", options && isLoaded);
   if (options && isLoaded) {
+    var stringifiedOptions = JSON.stringify(options);
     content.wrappedJSObject.BrowserID.internal.get(
       options.origin,
       function(assertion, internalParams) {
@@ -110,7 +111,7 @@ function doInternalRequest() {
         }
         closeIdentityDialog();
       },
-      options);
+      stringifiedOptions);
   }
 }
 

b2g/components/test/unit/test_signintowebsite.js

@@ -206,7 +206,7 @@ function test_options_pass_through() {
   let randomMixedParams = {
     loggedInUser: "juanita@mozilla.com",
     forceAuthentication: true,
-    issuer: "https://foo.com",
+    forceIssuer: "foo.com",
     someThing: {
       name: "Pertelote",
       legs: 4,

b2g/installer/package-manifest.in

@@ -158,6 +158,7 @@
 @BINPATH@/components/dom_activities.xpt
 @BINPATH@/components/dom_apps.xpt
 @BINPATH@/components/dom_base.xpt
+@BINPATH@/components/dom_system.xpt
 #ifdef MOZ_B2G_RIL
 @BINPATH@/components/dom_telephony.xpt
 @BINPATH@/components/dom_wifi.xpt

browser/app/profile/firefox.js

@@ -741,7 +741,7 @@ pref("urlclassifier.gethashtables", "goog-phish-shavar,goog-malware-shavar");
 // If an urlclassifier table has not been updated in this number of seconds,
 // a gethash request will be forced to check that the result is still in
 // the database.
-pref("urlclassifier.confirm-age", 2700);
+pref("urlclassifier.max-complete-age", 2700);
 #endif
 
 pref("browser.geolocation.warning.infoURL", "http://www.mozilla.com/%LOCALE%/firefox/geolocation/");

browser/base/content/browser-places.js

@@ -269,7 +269,11 @@ var PlacesCommandHook = {
       var description;
       var charset;
       try {
-        title = webNav.document.title || url.spec;
+        let isErrorPage = /^about:(neterror|certerror|blocked)/
+                          .test(webNav.document.documentURI);
+        title = isErrorPage ? PlacesUtils.history.getPageTitle(url)
+                            : webNav.document.title;
+        title = title || url.spec;
         description = PlacesUIUtils.getDescriptionFromDocument(webNav.document);
         charset = webNav.document.characterSet;
       }

browser/base/content/browser.js

@@ -1262,7 +1262,7 @@ var gBrowserInit = {
     }, true);
 
     // Ensure login manager is up and running.
-    Cc["@mozilla.org/login-manager;1"].getService(Ci.nsILoginManager);
+    Services.logins;
 
     if (mustLoadSidebar) {
       let sidebar = document.getElementById("sidebar");
@@ -1341,7 +1341,7 @@ var gBrowserInit = {
     // If the user manually opens the download manager before the timeout, the
     // downloads will start right away, and getting the service again won't hurt.
     setTimeout(function() {
-      Cc["@mozilla.org/download-manager;1"].getService(Ci.nsIDownloadManager);
+      Services.downloads;
 
 #ifdef XP_WIN
       if (Win7Features) {
@@ -1495,10 +1495,8 @@ var gBrowserInit = {
     // End startup crash tracking after a delay to catch crashes while restoring
     // tabs and to postpone saving the pref to disk.
     try {
-      let appStartup = Cc["@mozilla.org/toolkit/app-startup;1"].
-                       getService(Ci.nsIAppStartup);
       const startupCrashEndDelay = 30 * 1000;
-      setTimeout(appStartup.trackStartupCrashEnd, startupCrashEndDelay);
+      setTimeout(Services.startup.trackStartupCrashEnd, startupCrashEndDelay);
     } catch (ex) {
       Cu.reportError("Could not end startup crash tracking: " + ex);
     }
@@ -2222,10 +2220,6 @@ function readFromClipboard()
   var url;
 
   try {
-    // Get clipboard.
-    var clipboard = Components.classes["@mozilla.org/widget/clipboard;1"]
-                              .getService(Components.interfaces.nsIClipboard);
-
     // Create transferable that will transfer the text.
     var trans = Components.classes["@mozilla.org/widget/transferable;1"]
                           .createInstance(Components.interfaces.nsITransferable);
@@ -2234,10 +2228,10 @@ function readFromClipboard()
     trans.addDataFlavor("text/unicode");
 
     // If available, use selection clipboard, otherwise global one
-    if (clipboard.supportsSelectionClipboard())
-      clipboard.getData(trans, clipboard.kSelectionClipboard);
+    if (Services.clipboard.supportsSelectionClipboard())
+      Services.clipboard.getData(trans, Services.clipboard.kSelectionClipboard);
     else
-      clipboard.getData(trans, clipboard.kGlobalClipboard);
+      Services.clipboard.getData(trans, Services.clipboard.kGlobalClipboard);
 
     var data = {};
     var dataLen = {};
@@ -2303,9 +2297,7 @@ function BrowserViewSourceOfDocument(aDocument)
 // imageElement - image to load in the Media Tab of the Page Info window; can be null/omitted
 function BrowserPageInfo(doc, initialTab, imageElement) {
   var args = {doc: doc, initialTab: initialTab, imageElement: imageElement};
-  var windows = Cc['@mozilla.org/appshell/window-mediator;1']
-                  .getService(Ci.nsIWindowMediator)
-                  .getEnumerator("Browser:page-info");
+  var windows = Services.wm.getEnumerator("Browser:page-info");
 
   var documentURL = doc ? doc.location : window.content.document.location;
 
@@ -2468,7 +2460,7 @@ function PageProxyClickHandler(aEvent)
  *  to the DOM for unprivileged pages.
  */
 function BrowserOnAboutPageLoad(document) {
-  if (/^about:home$/i.test(document.documentURI)) {
+  if (document.documentURI.toLowerCase() == "about:home") {
     // XXX bug 738646 - when Marketplace is launched, remove this statement and
     // the hidden attribute set on the apps button in aboutHome.xhtml
     if (getBoolPref("browser.aboutHome.apps", false))
@@ -2517,16 +2509,14 @@ let BrowserOnClick = {
     else if (ownerDoc.documentURI.startsWith("about:neterror")) {
       this.onAboutNetError(originalTarget, ownerDoc);
     }
-    else if (/^about:home$/i.test(ownerDoc.documentURI)) {
+    else if (ownerDoc.documentURI.toLowerCase() == "about:home") {
       this.onAboutHome(originalTarget, ownerDoc);
     }
   },
 
   onAboutCertError: function BrowserOnClick_onAboutCertError(aTargetElm, aOwnerDoc) {
     let elmId = aTargetElm.getAttribute("id");
-    let secHistogram = Cc["@mozilla.org/base/telemetry;1"].
-                        getService(Ci.nsITelemetry).
-                        getHistogramById("SECURITY_UI");
+    let secHistogram = Services.telemetry.getHistogramById("SECURITY_UI");
 
     switch (elmId) {
       case "exceptionDialogButton":
@@ -2571,9 +2561,7 @@ let BrowserOnClick = {
 
   onAboutBlocked: function BrowserOnClick_onAboutBlocked(aTargetElm, aOwnerDoc) {
     let elmId = aTargetElm.getAttribute("id");
-    let secHistogram = Cc["@mozilla.org/base/telemetry;1"].
-                        getService(Ci.nsITelemetry).
-                        getHistogramById("SECURITY_UI");
+    let secHistogram = Services.telemetry.getHistogramById("SECURITY_UI");
 
     // The event came from a button on a malware/phishing block page
     // First check whether it's malware or phishing, so that we can
@@ -2743,8 +2731,7 @@ let BrowserOnClick = {
  */
 function getMeOutOfHere() {
   // Get the start page from the *default* pref branch, not the user's
-  var prefs = Cc["@mozilla.org/preferences-service;1"]
-             .getService(Ci.nsIPrefService).getDefaultBranch(null);
+  var prefs = Services.prefs.getDefaultBranch(null);
   var url = BROWSER_NEW_TAB_URL;
   try {
     url = prefs.getComplexValue("browser.startup.homepage",
@@ -3134,8 +3121,7 @@ const DOMLinkHandler = {
     ].some(function (re) re.test(targetDoc.documentURI));
 
     if (!isAllowedPage || !uri.schemeIs("chrome")) {
-      var ssm = Cc["@mozilla.org/scriptsecuritymanager;1"].
-                getService(Ci.nsIScriptSecurityManager);
+      var ssm = Services.scriptSecurityManager;
       try {
         ssm.checkLoadURIWithPrincipal(targetDoc.nodePrincipal, uri,
                                       Ci.nsIScriptSecurityManager.DISALLOW_SCRIPT);
@@ -3768,7 +3754,8 @@ function updateEditUIVisibility()
  */
 function mimeTypeIsTextBased(aMimeType)
 {
-  return /^text\/|\+xml$/.test(aMimeType) ||
+  return aMimeType.startsWith("text/") ||
+         aMimeType.endsWith("+xml") ||
          aMimeType == "application/x-javascript" ||
          aMimeType == "application/javascript" ||
          aMimeType == "application/xml" ||
@@ -4066,7 +4053,7 @@ var XULBrowserWindow = {
       let newSpec = location;
       let newIndexOfHash = newSpec.indexOf("#");
       if (newIndexOfHash != -1)
-        newSpec = newSpec.substr(0, newSpec.indexOf("#"));
+        newSpec = newSpec.substr(0, newIndexOfHash);
       if (newSpec != oldSpec) {
         // Remove all the notifications, except for those which want to
         // persist across the first location change.
@@ -5083,8 +5070,8 @@ var gHomeButton = {
 
     // use this if we can't find the pref
     if (!url) {
-      var SBS = Cc["@mozilla.org/intl/stringbundle;1"].getService(Ci.nsIStringBundleService);
-      var configBundle = SBS.createBundle("chrome://branding/locale/browserconfig.properties");
+      var configBundle = Services.strings
+                                 .createBundle("chrome://branding/locale/browserconfig.properties");
       url = configBundle.GetStringFromName(this.prefDomain);
     }
 
@@ -5144,9 +5131,7 @@ function getBrowserSelection(aCharLen) {
       selection = RegExp.lastMatch;
     }
 
-    selection = selection.replace(/^\s+/, "")
-                         .replace(/\s+$/, "")
-                         .replace(/\s+/g, " ");
+    selection = selection.trim().replace(/\s+/g, " ");
 
     if (selection.length > charLen)
       selection = selection.substr(0, charLen);
@@ -5278,8 +5263,8 @@ function contentAreaClick(event, isPanelClick)
     if (isPanelClick && mainTarget) {
       // javascript and data links should be executed in the current browser.
       if (linkNode.getAttribute("onclick") ||
-          href.substr(0, 11) === "javascript:" ||
-          href.substr(0, 5) === "data:")
+          href.startsWith("javascript:") ||
+          href.startsWith("data:"))
         return;
 
       try {
@@ -6644,16 +6629,12 @@ var gIdentityHandler = {
    * Return the eTLD+1 version of the current hostname
    */
   getEffectiveHost : function() {
-    // Cache the eTLDService if this is our first time through
-    if (!this._eTLDService)
-      this._eTLDService = Cc["@mozilla.org/network/effective-tld-service;1"]
-                         .getService(Ci.nsIEffectiveTLDService);
     if (!this._IDNService)
       this._IDNService = Cc["@mozilla.org/network/idn-service;1"]
                          .getService(Ci.nsIIDNService);
     try {
       let baseDomain =
-        this._eTLDService.getBaseDomainFromHost(this._lastLocation.hostname);
+        Services.eTLD.getBaseDomainFromHost(this._lastLocation.hostname);
       return this._IDNService.convertToDisplayIDN(baseDomain, {});
     } catch (e) {
       // If something goes wrong (e.g. hostname is an IP address) just fail back
@@ -7000,8 +6981,7 @@ let gPrivateBrowsingUI = {
     }
     catch (ex) { }
 
-    var bundleService = Cc["@mozilla.org/intl/stringbundle;1"].
-                        getService(Ci.nsIStringBundleService);
+    var bundleService = Services.strings;
     var pbBundle = bundleService.createBundle("chrome://browser/locale/browser.properties");
     var brandBundle = bundleService.createBundle("chrome://branding/locale/brand.properties");
 
@@ -7332,9 +7312,7 @@ function safeModeRestart()
                                      buttonFlags, restartText, null, null,
                                      null, {});
   if (rv == 0) {
-    let appStartup = Cc["@mozilla.org/toolkit/app-startup;1"].
-                     getService(Ci.nsIAppStartup);
-    appStartup.restartInSafeMode(Ci.nsIAppStartup.eAttemptQuit);
+    Services.startup.restartInSafeMode(Ci.nsIAppStartup.eAttemptQuit);
   }
 }
 
@@ -7401,9 +7379,7 @@ XPCOMUtils.defineLazyGetter(ResponsiveUI, "ResponsiveUIManager", function() {
 XPCOMUtils.defineLazyGetter(window, "gShowPageResizers", function () {
 #ifdef XP_WIN
   // Only show resizers on Windows 2000 and XP
-  let sysInfo = Components.classes["@mozilla.org/system-info;1"]
-                          .getService(Components.interfaces.nsIPropertyBag2);
-  return parseFloat(sysInfo.getProperty("version")) < 6;
+  return parseFloat(Services.sysinfo.getProperty("version")) < 6;
 #else
   return false;
 #endif
@@ -7473,7 +7449,7 @@ var MousePosTracker = {
 };
 
 function focusNextFrame(event) {
-  let fm = Cc["@mozilla.org/focus-manager;1"].getService(Ci.nsIFocusManager);
+  let fm = Services.focus;
   let dir = event.shiftKey ? fm.MOVEFOCUS_BACKWARDDOC : fm.MOVEFOCUS_FORWARDDOC;
   let element = fm.moveFocus(window, null, dir, fm.FLAG_BYKEY);
   if (element.ownerDocument == document)

browser/base/content/test/Makefile.in

@@ -292,6 +292,7 @@ _BROWSER_FILES = \
                  browser_bug676619.js \
                  download_page.html \
                  browser_URLBarSetURI.js \
+                 browser_bookmark_titles.js \
                  $(NULL)
 
 ifneq (cocoa,$(MOZ_WIDGET_TOOLKIT))

browser/base/content/test/browser_bookmark_titles.js

@@ -0,0 +1,75 @@
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+// This file is tests for the default titles that new bookmarks get.
+
+let tests = [
+    ['http://example.com/browser/browser/base/content/test/dummy_page.html',
+     'Dummy test page'],
+    ['data:text/html;charset=utf-8,<title>test data: url</title>',
+     'test data: url'],
+    ['http://unregistered-domain.example',
+     'http://unregistered-domain.example/'],
+    ['https://untrusted.example.com/somepage.html',
+     'https://untrusted.example.com/somepage.html']
+];
+
+function generatorTest() {
+    gBrowser.selectedTab = gBrowser.addTab();
+    let browser = gBrowser.selectedBrowser;
+
+    browser.addEventListener("DOMContentLoaded", nextStep, true);
+    registerCleanupFunction(function () {
+        browser.removeEventListener("DOMContentLoaded", nextStep, true);
+        gBrowser.removeCurrentTab();
+    });
+
+    yield; // Wait for the new tab to load.
+
+    // Test that a bookmark of each URI gets the corresponding default title.
+    for (let i = 0; i < tests.length; ++i) {
+        let [uri, title] = tests[i];
+        content.location = uri;
+        yield;
+        checkBookmark(uri, title);
+    }
+
+    // Network failure test: now that dummy_page.html is in history, bookmarking
+    // it should give the last known page title as the default bookmark title.
+
+    // Simulate a network outage with offline mode. (Localhost is still
+    // accessible in offline mode, so disable the test proxy as well.)
+    BrowserOffline.toggleOfflineStatus();
+    let proxy = Services.prefs.getIntPref('network.proxy.type');
+    Services.prefs.setIntPref('network.proxy.type', 0);
+    registerCleanupFunction(function () {
+        BrowserOffline.toggleOfflineStatus();
+        Services.prefs.setIntPref('network.proxy.type', proxy);
+    });
+
+    // LOAD_FLAGS_BYPASS_CACHE isn't good enough. So clear the cache.
+    Services.cache.evictEntries(Services.cache.STORE_ANYWHERE);
+
+    let [uri, title] = tests[0];
+    content.location = uri;
+    yield;
+    // The offline mode test is only good if the page failed to load.
+    is(content.document.documentURI.substring(0, 14), 'about:neterror',
+        "Offline mode successfully simulated network outage.");
+    checkBookmark(uri, title);
+}
+
+// Bookmark the current page and confirm that the new bookmark has the expected
+// title. (Then delete the bookmark.)
+function checkBookmark(uri, expected_title) {
+    PlacesCommandHook.bookmarkCurrentPage(false);
+    
+    let id = PlacesUtils.getMostRecentBookmarkForURI(PlacesUtils._uri(uri));
+    let title = PlacesUtils.bookmarks.getItemTitle(id);
+
+    is(title, expected_title, "Bookmark got a good default title.");
+
+    PlacesUtils.bookmarks.removeItem(id);
+}
+

browser/components/downloads/content/allDownloadsViewOverlay.js

@@ -96,7 +96,7 @@ DownloadElementShell.prototype = {
     }
     else if (this._placesNode) {
       this._wasInProgress = false;
-      this._wasDone = this._state == nsIDM.DOWNLOAD_FINISHED;
+      this._wasDone = this.getDownloadState(true) == nsIDM.DOWNLOAD_FINISHED;
     }
 
     this._updateStatusUI();
@@ -115,7 +115,7 @@ DownloadElementShell.prototype = {
       this._placesNode = aNode;
       if (!this._dataItem && this._placesNode) {
         this._wasInProgress = false;
-        this._wasDone = this._state == nsIDM.DOWNLOAD_FINISHED;
+        this._wasDone = this.getDownloadState(true) == nsIDM.DOWNLOAD_FINISHED;
         this._updateStatusUI();
       }
     }
@@ -216,42 +216,53 @@ DownloadElementShell.prototype = {
   // The target's file size in bytes. If there's no target file, or If we
   // cannot determine its size, 0 is returned.
   get _fileSize() {
-    if (!this._file || !this._file.exists())
-      return 0;
-    try {
-      return this._file.fileSize;
-    }
-    catch(ex) {
-      Cu.reportError(ex);
-      return 0;
+    if (!("__fileSize" in this)) {
+      if (!this._file || !this._file.exists())
+        this.__fileSize = 0;
+      try {
+        this.__fileSize = this._file.fileSize;
+      }
+      catch(ex) {
+        Cu.reportError(ex);
+        this.__fileSize = 0;
+      }
     }
+    return this.__fileSize;
   },
 
+  /**
+   * Get the state of the download
+   * @param [optional] aForceUpdate
+   *        Whether to force update the cached download state. Default: false.
+   */
   // The download state (see nsIDownloadManager).
-  get _state() {
-    if (this._dataItem)
-      return this._dataItem.state;
-
-    let state = -1;
-    try {
-      return this._getAnnotation(DOWNLOAD_STATE_ANNO);
-    }
-    catch (ex) {
-      // The state annotation didn't exist in past releases.
-      if (!this._file) {
-        state = nsIDM.DOWNLOAD_FAILED;
-      }
-      else if (this._file.exists()) {
-        state = this._fileSize > 0 ?
-          nsIDM.DOWNLOAD_FINISHED : nsIDM.DOWNLOAD_FAILED;
+  getDownloadState: function DES_getDownloadState(aForceUpdate = false) {
+    if (aForceUpdate || !("_state" in this)) {
+      if (this._dataItem) {
+        this._state = this._dataItem.state;
       }
       else {
-        // XXXmano I'm not sure if this right. We should probably show no
-        // status text at all in this case.
-        state = nsIDM.DOWNLOAD_CANCELED;
+        try {
+          this._state = this._getAnnotation(DOWNLOAD_STATE_ANNO);
+        }
+        catch (ex) {
+          // The state annotation didn't exist in past releases.
+          if (!this._file) {
+            this._state = nsIDM.DOWNLOAD_FAILED;
+          }
+          else if (this._file.exists()) {
+            this._state = this._fileSize > 0 ?
+              nsIDM.DOWNLOAD_FINISHED : nsIDM.DOWNLOAD_FAILED;
+          }
+          else {
+            // XXXmano I'm not sure if this right. We should probably show no
+            // status text at all in this case.
+            this._state = nsIDM.DOWNLOAD_CANCELED;
+          }
+        }
       }
     }
-    return state;
+    return this._state;
   },
 
   // The status text for the download
@@ -292,7 +303,7 @@ DownloadElementShell.prototype = {
       return s.statusSeparator(fullHost, fullDate);
     }
 
-    switch (this._state) {
+    switch (this.getDownloadState()) {
       case nsIDM.DOWNLOAD_FAILED:
         return s.stateFailed;
       case nsIDM.DOWNLOAD_CANCELED:
@@ -331,7 +342,7 @@ DownloadElementShell.prototype = {
   // appropriate buttons and context menu items), the status text label,
   // and the progress meter.
   _updateDownloadStatusUI: function  DES__updateDownloadStatusUI() {
-    this._element.setAttribute("state", this._state);
+    this._element.setAttribute("state", this.getDownloadState(true));
     this._element.setAttribute("status", this._statusText);
 
     // For past-downloads, we're done. For session-downloads, we may also need
@@ -429,7 +440,7 @@ DownloadElementShell.prototype = {
       case "downloadsCmd_open": {
         return this._file.exists() &&
                ((this._dataItem && this._dataItem.openable) ||
-                (this._state == nsIDM.DOWNLOAD_FINISHED));
+                (this.getDownloadState() == nsIDM.DOWNLOAD_FINISHED));
       }
       case "downloadsCmd_show": {
         return this._getTargetFileOrPartFileIfExists() != null;
@@ -547,7 +558,7 @@ DownloadElementShell.prototype = {
       }
       return "";
     }
-    let command = getDefaultCommandForState(this._state);
+    let command = getDefaultCommandForState(this.getDownloadState());
     if (this.isCommandEnabled(command))
       this.doCommand(command);
   }
@@ -1079,7 +1090,7 @@ DownloadsPlacesView.prototype = {
 
     // Set the state attribute so that only the appropriate items are displayed.
     let contextMenu = document.getElementById("downloadsContextMenu");
-    contextMenu.setAttribute("state", element._shell._state);
+    contextMenu.setAttribute("state", element._shell.getDownloadState());
     return true;
   },
 

browser/devtools/framework/ToolDefinitions.jsm

@@ -66,7 +66,7 @@ let webConsoleDefinition = {
   accesskey: l10n("webConsoleCmd.accesskey", webConsoleStrings),
   modifiers: Services.appinfo.OS == "Darwin" ? "accel,alt" : "accel,shift",
   ordinal: 0,
-  icon: "chrome://browser/skin/devtools/webconsole-tool-icon.png",
+  icon: "chrome://browser/skin/devtools/tool-webconsole.png",
   url: "chrome://browser/content/devtools/webconsole.xul",
   label: l10n("ToolboxWebconsole.label", webConsoleStrings),
   tooltip: l10n("ToolboxWebconsole.tooltip", webConsoleStrings),
@@ -87,7 +87,7 @@ let debuggerDefinition = {
   modifiers: osString == "Darwin" ? "accel,alt" : "accel,shift",
   ordinal: 1,
   killswitch: "devtools.debugger.enabled",
-  icon: "chrome://browser/skin/devtools/tools-icons-small.png",
+  icon: "chrome://browser/skin/devtools/tool-debugger.png",
   url: "chrome://browser/content/debugger.xul",
   label: l10n("ToolboxDebugger.label", debuggerStrings),
   tooltip: l10n("ToolboxDebugger.tooltip", debuggerStrings),
@@ -108,7 +108,7 @@ let inspectorDefinition = {
   key: l10n("inspector.commandkey", inspectorStrings),
   ordinal: 2,
   modifiers: osString == "Darwin" ? "accel,alt" : "accel,shift",
-  icon: "chrome://browser/skin/devtools/tools-icons-small.png",
+  icon: "chrome://browser/skin/devtools/tool-inspector.png",
   url: "chrome://browser/content/devtools/inspector/inspector.xul",
   label: l10n("inspector.label", inspectorStrings),
   tooltip: l10n("inspector.tooltip", inspectorStrings),
@@ -130,6 +130,7 @@ let styleEditorDefinition = {
   accesskey: l10n("open.accesskey", styleEditorStrings),
   modifiers: "shift",
   label: l10n("ToolboxStyleEditor.label", styleEditorStrings),
+  icon: "chrome://browser/skin/devtools/tool-styleeditor.png",
   url: "chrome://browser/content/styleeditor.xul",
   tooltip: l10n("ToolboxStyleEditor.tooltip", styleEditorStrings),
 
@@ -146,7 +147,6 @@ let styleEditorDefinition = {
 let profilerDefinition = {
   id: "jsprofiler",
   killswitch: "devtools.profiler.enabled",
-  icon: "chrome://browser/skin/devtools/tools-icons-small.png",
   url: "chrome://browser/content/profiler.xul",
   label: l10n("profiler.label", profilerStrings),
   tooltip: l10n("profiler.tooltip", profilerStrings),

browser/devtools/framework/Toolbox.jsm

@@ -362,6 +362,9 @@ Toolbox.prototype = {
     radio.id = "toolbox-tab-" + id;
     radio.setAttribute("toolid", id);
     radio.setAttribute("tooltiptext", toolDefinition.tooltip);
+    if (toolDefinition.icon) {
+      radio.setAttribute("src", toolDefinition.icon);
+    }
 
     let ordinal = (typeof toolDefinition.ordinal == "number") ?
                   toolDefinition.ordinal : MAX_ORDINAL;

browser/devtools/framework/connect/connect.css

@@ -78,12 +78,12 @@ body.connecting > #connecting {
   vertical-align: top;
 }
 
-#actors {
+.actors {
   padding-left: 0;
   font-size: 0.9rem;
 }
 
-#actors > a {
+.actors > a {
   display: block;
   margin: 5px;
   padding: 5px;

browser/devtools/framework/connect/connect.js

@@ -71,7 +71,7 @@ function onConnectionReady(aType, aTraits) {
     document.body.classList.remove("connecting");
     document.body.classList.add("actors-mode");
 
-    let parent = document.getElementById("actors");
+    let parent = document.getElementById("tabActors");
 
     // Add Global Process debugging...
     let globals = JSON.parse(JSON.stringify(aResponse));
@@ -85,6 +85,8 @@ function onConnectionReady(aType, aTraits) {
       buildLink(aResponse.tabs[i], parent, i == aResponse.selected);
     }
 
+    let gParent = document.getElementById("globalActors");
+
     // Build the Remote Process button
     if (Object.keys(globals).length > 1) {
       let a = document.createElement("a");
@@ -92,10 +94,10 @@ function onConnectionReady(aType, aTraits) {
         openToolbox(globals, true);
 
       }
-      a.title = a.textContent = window.l10n.GetStringFromName("remoteProcess");
+      a.title = a.textContent = window.l10n.GetStringFromName("mainProcess");
       a.className = "remote-process";
       a.href = "#";
-      parent.appendChild(a);
+      gParent.appendChild(a);
     }
     // Move the selected tab on top
     let selectedLink = parent.querySelector("a.selected");
@@ -164,4 +166,5 @@ function handleConnectionTimeout() {
 function openToolbox(form, chrome=false) {
   let target = TargetFactory.forRemote(form, gClient, chrome);
   gDevTools.showToolbox(target, "webconsole", Toolbox.HostType.WINDOW);
+  window.close();
 }

browser/devtools/framework/connect/connect.xhtml

@@ -37,8 +37,10 @@
       <p class="error-message error-unexpected">&errorUnexpected;</p>
     </section>
     <section id="actors-list">
-      <p>&availability;</p>
-      <ul id="actors"></ul>
+      <p>&availableTabs;</p>
+      <ul class="actors" id="tabActors"></ul>
+      <p>&availableProcesses;</p>
+      <ul class="actors" id="globalActors"></ul>
     </section>
     <section id="connecting">
       <p><img src="chrome://browser/skin/tabbrowser/loading.png"></img> &connecting;</p>

browser/devtools/framework/toolbox.css

@@ -8,3 +8,8 @@
   display: none;
 }
 
+#toolbox-controls > toolbarbutton > .toolbarbutton-text,
+#toolbox-dock-buttons > toolbarbutton > .toolbarbutton-text,
+.command-button > .toolbarbutton-text {
+  display: none;
+}

browser/devtools/framework/toolbox.xul

@@ -7,7 +7,6 @@
  %toolboxDTD;
 ]>
 <?xml-stylesheet href="chrome://browser/skin/" type="text/css"?>
-<?xml-stylesheet href="chrome://browser/content/devtools/shared/common.css" type="text/css"?>
 <?xml-stylesheet href="chrome://browser/content/devtools/framework/toolbox.css" type="text/css"?>
 <?xml-stylesheet href="chrome://browser/skin/devtools/common.css" type="text/css"?>
 <?xml-stylesheet href="chrome://browser/skin/devtools/toolbox.css" type="text/css"?>
@@ -20,7 +19,6 @@
 #ifdef XP_MACOSX
       <hbox id="toolbox-controls">
         <toolbarbutton id="toolbox-close"
-                       class="devtools-closebutton"
                        tooltiptext="&toolboxCloseButton.tooltip;"/>
         <hbox id="toolbox-dock-buttons"/>
       </hbox>
@@ -29,10 +27,10 @@
       </radiogroup>
       <hbox id="toolbox-buttons" flex="1" pack="end"/>
 #ifndef XP_MACOSX
+      <vbox id="toolbox-controls-separator"/>
       <hbox id="toolbox-controls">
         <hbox id="toolbox-dock-buttons"/>
         <toolbarbutton id="toolbox-close"
-                       class="devtools-closebutton"
                        tooltiptext="&toolboxCloseButton.tooltip;"/>
       </hbox>
 #endif

browser/devtools/inspector/InspectorPanel.jsm

@@ -201,13 +201,21 @@ InspectorPanel.prototype = {
     this._destroyMarkup();
     this.isDirty = false;
     let self = this;
-    newWindow.addEventListener("DOMContentLoaded", function onDOMReady() {
-      newWindow.removeEventListener("DOMContentLoaded", onDOMReady, true);;
+
+    function onDOMReady() {
+      newWindow.removeEventListener("DOMContentLoaded", onDOMReady, true);
+
       if (!self.selection.node) {
         self.selection.setNode(newWindow.document.documentElement);
       }
       self._initMarkup();
-    }, true);
+    }
+
+    if (newWindow.document.readyState == "loading") {
+      newWindow.addEventListener("DOMContentLoaded", onDOMReady, true);
+    } else {
+      onDOMReady();
+    }
   },
 
   /**

browser/devtools/responsivedesign/CmdResize.jsm

@@ -31,7 +31,7 @@ gcli.addCommand({
 gcli.addCommand({
   name: 'resize toggle',
   buttonId: "command-button-responsive",
-  buttonClass: "command-button devtools-toolbarbutton",
+  buttonClass: "command-button",
   tooltipText: gcli.lookup("resizeModeToggleTooltip"),
   description: gcli.lookup('resizeModeToggleDesc'),
   manual: gcli.lookup('resizeModeManual'),

browser/devtools/scratchpad/CmdScratchpad.jsm

@@ -12,7 +12,7 @@ Components.utils.import("resource:///modules/devtools/gcli.jsm");
 gcli.addCommand({
   name: "scratchpad",
   buttonId: "command-button-scratchpad",
-  buttonClass: "command-button devtools-toolbarbutton",
+  buttonClass: "command-button",
   tooltipText: gcli.lookup("scratchpadOpenTooltip"),
   hidden: true,
   exec: function(args, context) {

browser/devtools/styleinspector/CssHtmlTree.jsm

@@ -1204,13 +1204,13 @@ SelectorView.prototype = {
     let result = this.selectorInfo.selector.text;
     if (this.selectorInfo.elementStyle) {
       let source = this.selectorInfo.sourceElement;
-      let IUI = this.tree.styleInspector.IUI;
-      if (IUI && IUI.selection == source) {
+      let inspector = this.tree.styleInspector.inspector;
+
+      if (inspector.selection.node == source) {
         result = "this";
       } else {
         result = CssLogic.getShortName(source);
       }
-
       result += ".style";
     }
 

browser/devtools/tilt/CmdTilt.jsm

@@ -43,7 +43,7 @@ gcli.addCommand({
 gcli.addCommand({
   name: "tilt toggle",
   buttonId: "command-button-tilt",
-  buttonClass: "command-button  devtools-toolbarbutton",
+  buttonClass: "command-button",
   tooltipText: gcli.lookup("tiltToggleTooltip"),
   hidden: true,
   exec: function(args, context) {

browser/locales/en-US/chrome/browser/devtools/connection-screen.dtd

@@ -13,10 +13,10 @@
 <!ENTITY port       "Port:">
 <!ENTITY connect    "Connect">
 <!ENTITY connecting "Connecting…">
-<!ENTITY availability "Available remote objects:">
-<!ENTITY remoteProcess "remote process">
+<!ENTITY availableTabs "Available remote tabs:">
+<!ENTITY availableProcesses "Available remote processes:">
 <!ENTITY connectionError "Error:">
 <!ENTITY errorTimeout "Error: connection timeout.">
 <!ENTITY errorRefused "Error: connection refused.">
 <!ENTITY errorUnexpected "Unexpected error.">
-<!ENTITY help "Firefox Developer Tools can debug remote devices (Firefox for Android and Firefox OS for example). Make sure that you have turned on the 'Debugger Server' option on the remote device. See <a target='_' href='https://developer.mozilla.org/en-US/docs/Tools/Debugger#Remote_Debugging'>documentation</a>.">
+<!ENTITY help "Firefox Developer Tools can debug remote devices (Firefox for Android and Firefox OS, for example). Make sure that you have turned on the 'Remote debugging' option in the remote device. See the <a target='_' href='https://developer.mozilla.org/docs/Tools/Debugger#Remote_Debugging'>documentation</a> for more.">

browser/locales/en-US/chrome/browser/devtools/connection-screen.properties

@@ -6,4 +6,4 @@
 # The Remote Connection window can reached from the "connect…" menuitem
 # in the Web Developer menu.
 
-remoteProcess=Remote Process
+mainProcess=Main Process

browser/locales/jar.mn

@@ -39,6 +39,7 @@
     locale/browser/devtools/layoutview.dtd            (%chrome/browser/devtools/layoutview.dtd)
     locale/browser/devtools/responsiveUI.properties   (%chrome/browser/devtools/responsiveUI.properties)
     locale/browser/devtools/toolbox.dtd            (%chrome/browser/devtools/toolbox.dtd)
+    locale/browser/devtools/toolbox.properties     (%chrome/browser/devtools/toolbox.properties)
     locale/browser/devtools/inspector.dtd          (%chrome/browser/devtools/inspector.dtd)
     locale/browser/devtools/connection-screen.dtd  (%chrome/browser/devtools/connection-screen.dtd)
     locale/browser/devtools/connection-screen.properties (%chrome/browser/devtools/connection-screen.properties)

browser/themes/gnomestripe/devtools/toolbox.css

@@ -2,8 +2,16 @@
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
 
-#toolbox-tabs {
-  margin: 0;
+#toolbox-controls {
+  margin: 0 4px;
+}
+
+#toolbox-controls > toolbarbutton,
+#toolbox-dock-buttons > toolbarbutton {
+  -moz-appearance: none;
+  margin: 0 4px;
+  min-width: 16px;
+  width: 16px;
 }
 
 #toolbox-dock-bottom {
@@ -15,7 +23,52 @@
 }
 
 #toolbox-dock-window {
-  list-style-image: url("chrome://browser/skin/devtools/dock-window.png");
+  list-style-image: url("chrome://browser/skin/devtools/undock.png");
+}
+
+#toolbox-close {
+  list-style-image: url("chrome://browser/skin/devtools/close.png");
+}
+
+#toolbox-dock-window,
+#toolbox-dock-bottom,
+#toolbox-dock-side,
+#toolbox-close {
+  opacity: 0.6;
+}
+
+#toolbox-dock-window:hover,
+#toolbox-dock-bottom:hover,
+#toolbox-dock-side:hover,
+#toolbox-close:hover {
+  opacity: 1;
+}
+
+#toolbox-controls-separator {
+  width: 3px;
+  background-image: linear-gradient(hsla(204,45%,98%,0), hsla(204,45%,98%,.1), hsla(204,45%,98%,0)),
+                    linear-gradient(hsla(206,37%,4%,0), hsla(206,37%,4%,.6), hsla(206,37%,4%,0)),
+                    linear-gradient(hsla(204,45%,98%,0), hsla(204,45%,98%,.1), hsla(204,45%,98%,0));
+  background-size: 1px 100%;
+  background-repeat: no-repeat;
+  background-position: 0, 1px, 2px;
+  -moz-margin-start: 8px;
+}
+
+/* Command buttons */
+
+.command-button {
+  -moz-appearance: none;
+  padding: 0 8px;
+  margin: 0;
+  width: 16px;
+}
+
+.command-button:hover {
+  background-color: hsla(206,37%,4%,.2);
+}
+.command-button:hover:active {
+  background-color: hsla(206,37%,4%,.4);
 }
 
 #command-button-responsive {
@@ -66,29 +119,91 @@
 
 .devtools-tabbar {
   -moz-appearance: none;
-  background-image: linear-gradient(to bottom, hsl(210,11%,36%), hsl(210,11%,18%));
-  color: hsl(210,30%,85%);
-  padding: 4px 3px 3px;
-  box-shadow: 0 -3px 0 0 rgb(20,20,20) inset, 0 -4px 0 0 rgba(0,0,0,0.8) inset;
+  background-image: url(background-noise-toolbar.png),
+                    linear-gradient(#303840, #2d3640);
+  border-top: 1px solid #060a0d;
+  box-shadow: 0 1px 0 hsla(204,45%,98%,.05) inset,
+              0 -1px 0 hsla(206,37%,4%,.1) inset;
+  min-height: 32px;
+  padding: 0;
+}
+
+#toolbox-tabs {
+  margin: 0;
 }
 
 .devtools-tab {
   -moz-appearance: none;
-  min-width: 78px;
-  min-height: 22px;
-  text-shadow: 0 -1px 0 hsla(210,8%,5%,.45);
-  border-radius: 3px 3px 0 0;
-  color: inherit;
-  border-style: solid;
-  border-color: transparent;
-  border-width: 1px 1px 0;
-  margin: 0 5px;
-  padding: 0 10px 1px;
+  min-width: 88px;
+  min-height: 32px;
+  color: #b6babf;
+  margin: 0;
+  padding: 0;
+  background-image: linear-gradient(hsla(204,45%,98%,.05), hsla(204,45%,98%,.1)),
+                    linear-gradient(hsla(204,45%,98%,.05), hsla(204,45%,98%,.1));
+  background-size: 1px 100%;
+  background-repeat: no-repeat;
+  background-position: left, right;
+  border-right: 1px solid hsla(206,37%,4%,.45);
+}
+
+.devtools-tab > .radio-label-center-box > .radio-label-box {
+  -moz-appearance: none;
+  border: none;
+  padding: 0 16px;
+}
+
+.devtools-tab > .radio-label-center-box >.radio-label-box > .radio-icon {
+  -moz-margin-end: 6px;
+  opacity: 0.6;
+}
+
+.devtools-tab:hover > .radio-label-center-box > .radio-label-box >
+.radio-icon {
+  opacity: 0.8;
+}
+
+.devtools-tab:active > .radio-label-center-box > .radio-label-box > .radio-icon,
+.devtools-tab[selected=true] > .radio-label-center-box > .radio-label-box >
+.radio-icon {
+  opacity: 1;
+}
+
+.devtools-tab:hover {
+  background-image: linear-gradient(hsla(204,45%,98%,.05), hsla(204,45%,98%,.1)),
+                    linear-gradient(hsla(204,45%,98%,.05), hsla(204,45%,98%,.1)),
+                    linear-gradient(hsla(206,37%,4%,.1), hsla(206,37%,4%,.2));
+  background size: 1px 100%,
+                   1px 100%,
+                   100%;
+  background-repeat: no-repeat,
+                     no-repeat,
+                     repeat-x;
+  background-position: left, right;
+  color: #ced3d9;
+}
+.devtools-tab:hover:active {
+  background-color: hsla(206,37%,4%,.2);
+  color: #f5f7fa;
 }
 
 .devtools-tab[selected=true] {
-  border-color: hsla(210,8%,5%,.6);
-  background-color: rgb(20,20,20);
-  text-shadow: none;
-  color: white;
+  color: #f5f7fa;
+  background-image: radial-gradient(ellipse farthest-corner at center top, #9fdfff, hsla(200,100%,70%,.3)),
+                    radial-gradient(ellipse farthest-side at center top, hsla(200,100%,70%,.4), hsla(200,100%,70%,0)),
+                    linear-gradient(hsla(204,45%,98%,.05), hsla(204,45%,98%,.1)),
+                    linear-gradient(hsla(204,45%,98%,.02), hsla(204,45%,98%,.04)),
+                    linear-gradient(hsla(206,37%,4%,.2), hsla(206,37%,4%,.3));
+  background-size: 100% 1px,
+                   100% 5px,
+                   1px 100%,
+                   1px 100%,
+                   100%;
+  background-repeat: no-repeat,
+                     no-repeat,
+                     no-repeat,
+                     no-repeat,
+                     repeat-x;
+  background-position: top right, top left, left, right;
+  box-shadow: 1px -1px 0 hsla(206,37%,4%,.2) inset;
 }

browser/themes/gnomestripe/jar.mn

@@ -172,10 +172,15 @@ browser.jar:
   skin/classic/browser/devtools/tools-icons-small.png     (devtools/tools-icons-small.png)
   skin/classic/browser/devtools/dock-bottom.png           (devtools/dock-bottom.png)
   skin/classic/browser/devtools/dock-side.png             (devtools/dock-side.png)
-  skin/classic/browser/devtools/dock-window.png           (devtools/dock-window.png)
   skin/classic/browser/devtools/floating-scrollbars.css   (devtools/floating-scrollbars.css)
   skin/classic/browser/devtools/inspector.css             (devtools/inspector.css)
   skin/classic/browser/devtools/toolbox.css               (devtools/toolbox.css)
+  skin/classic/browser/devtools/tool-webconsole.png       (devtools/tool-webconsole.png)
+  skin/classic/browser/devtools/tool-debugger.png         (devtools/tool-debugger.png)
+  skin/classic/browser/devtools/tool-inspector.png        (devtools/tool-inspector.png)
+  skin/classic/browser/devtools/tool-styleeditor.png      (devtools/tool-styleeditor.png)
+  skin/classic/browser/devtools/close.png                 (devtools/close.png)
+  skin/classic/browser/devtools/undock.png                (devtools/undock.png)
 #ifdef MOZ_SERVICES_SYNC
   skin/classic/browser/sync-16-throbber.png
   skin/classic/browser/sync-16.png

browser/themes/pinstripe/devtools/toolbox.css

@@ -2,8 +2,15 @@
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
 
-#toolbox-tabs {
-  margin: 0;
+#toolbox-controls {
+  margin: 0 4px;
+}
+
+#toolbox-controls > toolbarbutton,
+#toolbox-dock-buttons > toolbarbutton {
+  margin: 0 4px;
+  min-width: 16px;
+  width: 16px;
 }
 
 #toolbox-dock-bottom {
@@ -15,7 +22,40 @@
 }
 
 #toolbox-dock-window {
-  list-style-image: url("chrome://browser/skin/devtools/dock-window.png");
+  list-style-image: url("chrome://browser/skin/devtools/undock.png");
+}
+
+#toolbox-close {
+  list-style-image: url("chrome://browser/skin/devtools/close.png");
+}
+
+#toolbox-dock-window,
+#toolbox-dock-bottom,
+#toolbox-dock-side,
+#toolbox-close {
+  opacity: 0.6;
+}
+
+#toolbox-dock-window:hover,
+#toolbox-dock-bottom:hover,
+#toolbox-dock-side:hover,
+#toolbox-close:hover {
+  opacity: 1;
+}
+
+/* Command buttons */
+
+.command-button {
+  padding: 0 8px;
+  margin: 0;
+  width: 16px;
+}
+
+.command-button:hover {
+  background-color: hsla(206,37%,4%,.2);
+}
+.command-button:hover:active {
+  background-color: hsla(206,37%,4%,.4);
 }
 
 #command-button-responsive {
@@ -66,29 +106,88 @@
 
 .devtools-tabbar {
   -moz-appearance: none;
-  background-image: url(background-noise-toolbar.png), linear-gradient(to bottom, hsl(210,11%,36%), hsl(210,11%,18%));
-  color: hsl(210,30%,85%);
-  padding: 4px 3px 3px;
-  box-shadow: 0 -3px 0 0 rgb(20,20,20) inset, 0 -4px 0 0 rgba(0,0,0,0.8) inset;
+  background-image: url(background-noise-toolbar.png),
+                    linear-gradient(#303840, #2d3640);
+  border-top: 1px solid #060a0d;
+  box-shadow: 0 1px 0 hsla(204,45%,98%,.05) inset,
+              0 -1px 0 hsla(206,37%,4%,.1) inset;
+  min-height: 32px;
+  padding: 0;
+}
+
+#toolbox-tabs {
+  margin: 0;
+  border-left: 1px solid hsla(206,37%,4%,.45);
 }
 
 .devtools-tab {
   -moz-appearance: none;
-  min-width: 78px;
-  min-height: 22px;
-  text-shadow: 0 -1px 0 hsla(210,8%,5%,.45);
-  border-radius: @toolbarbuttonCornerRadius@ @toolbarbuttonCornerRadius@ 0 0;
-  color: inherit;
-  border-style: solid;
-  border-color: transparent;
-  border-width: 1px 1px 0;
-  margin: 0 5px;
-  padding: 0 10px 1px;
+  min-width: 88px;
+  min-height: 32px;
+  color: #b6babf;
+  margin: 0;
+  padding: 0;
+  background-image: linear-gradient(hsla(204,45%,98%,.05), hsla(204,45%,98%,.1)),
+                    linear-gradient(hsla(204,45%,98%,.05), hsla(204,45%,98%,.1));
+  background-size: 1px 100%;
+  background-repeat: no-repeat;
+  background-position: left, right;
+  border-right: 1px solid hsla(206,37%,4%,.45);
+}
+
+.devtools-tab > .radio-label-box {
+  padding: 0 16px;
+}
+
+.devtools-tab > .radio-label-box > .radio-icon {
+  -moz-margin-end: 6px;
+  opacity: 0.6;
+}
+
+.devtools-tab:hover > .radio-label-box > .radio-icon {
+  opacity: 0.8;
+}
+
+.devtools-tab:active > .radio-label-box > .radio-icon,
+.devtools-tab[selected=true] > .radio-label-box > .radio-icon {
+  opacity: 1;
+}
+
+.devtools-tab:hover {
+  background-image: linear-gradient(hsla(204,45%,98%,.05), hsla(204,45%,98%,.1)),
+                    linear-gradient(hsla(204,45%,98%,.05), hsla(204,45%,98%,.1)),
+                    linear-gradient(hsla(206,37%,4%,.1), hsla(206,37%,4%,.2));
+  background size: 1px 100%,
+                   1px 100%,
+                   100%;
+  background-repeat: no-repeat,
+                     no-repeat,
+                     repeat-x;
+  background-position: left, right;
+  color: #ced3d9;
+}
+.devtools-tab:hover:active {
+  background-color: hsla(206,37%,4%,.2);
+  color: #f5f7fa;
 }
 
 .devtools-tab[selected=true] {
-  border-color: hsla(210,8%,5%,.6);
-  background-color: rgb(20,20,20);
-  text-shadow: none;
-  color: white;
+  color: #f5f7fa;
+  background-image: radial-gradient(ellipse farthest-corner at center top, #9fdfff, hsla(200,100%,70%,.3)),
+                    radial-gradient(ellipse farthest-side at center top, hsla(200,100%,70%,.4), hsla(200,100%,70%,0)),
+                    linear-gradient(hsla(204,45%,98%,.05), hsla(204,45%,98%,.1)),
+                    linear-gradient(hsla(204,45%,98%,.02), hsla(204,45%,98%,.04)),
+                    linear-gradient(hsla(206,37%,4%,.2), hsla(206,37%,4%,.3));
+  background-size: 100% 1px,
+                   100% 5px,
+                   1px 100%,
+                   1px 100%,
+                   100%;
+  background-repeat: no-repeat,
+                     no-repeat,
+                     no-repeat,
+                     no-repeat,
+                     repeat-x;
+  background-position: top right, top left, left, right;
+  box-shadow: 1px -1px 0 hsla(206,37%,4%,.2) inset;
 }

browser/themes/pinstripe/jar.mn

@@ -243,10 +243,15 @@ browser.jar:
   skin/classic/browser/devtools/tools-icons-small.png       (devtools/tools-icons-small.png)
   skin/classic/browser/devtools/dock-bottom.png             (devtools/dock-bottom.png)
   skin/classic/browser/devtools/dock-side.png               (devtools/dock-side.png)
-  skin/classic/browser/devtools/dock-window.png             (devtools/dock-window.png)
   skin/classic/browser/devtools/floating-scrollbars.css     (devtools/floating-scrollbars.css)
 * skin/classic/browser/devtools/inspector.css               (devtools/inspector.css)
   skin/classic/browser/devtools/toolbox.css                 (devtools/toolbox.css)
+  skin/classic/browser/devtools/tool-webconsole.png         (devtools/tool-webconsole.png)
+  skin/classic/browser/devtools/tool-debugger.png           (devtools/tool-debugger.png)
+  skin/classic/browser/devtools/tool-inspector.png          (devtools/tool-inspector.png)
+  skin/classic/browser/devtools/tool-styleeditor.png        (devtools/tool-styleeditor.png)
+  skin/classic/browser/devtools/close.png                   (devtools/close.png)
+  skin/classic/browser/devtools/undock.png                  (devtools/undock.png)
 #ifdef MOZ_SERVICES_SYNC
   skin/classic/browser/sync-throbber.png
   skin/classic/browser/sync-16.png

browser/themes/winstripe/devtools/toolbox.css

@@ -2,8 +2,17 @@
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
 
-#toolbox-tabs {
-  margin: 0;
+#toolbox-controls {
+  margin: 0 4px;
+}
+
+#toolbox-controls > toolbarbutton,
+#toolbox-dock-buttons > toolbarbutton {
+  -moz-appearance: none;
+  border: none;
+  margin: 0 4px;
+  min-width: 16px;
+  width: 16px;
 }
 
 #toolbox-dock-bottom {
@@ -15,7 +24,54 @@
 }
 
 #toolbox-dock-window {
-  list-style-image: url("chrome://browser/skin/devtools/dock-window.png");
+  list-style-image: url("chrome://browser/skin/devtools/undock.png");
+}
+
+#toolbox-close {
+  list-style-image: url("chrome://browser/skin/devtools/close.png");
+}
+
+#toolbox-dock-window,
+#toolbox-dock-bottom,
+#toolbox-dock-side,
+#toolbox-close {
+  opacity: 0.6;
+}
+
+#toolbox-dock-window:hover,
+#toolbox-dock-bottom:hover,
+#toolbox-dock-side:hover,
+#toolbox-close:hover {
+  opacity: 1;
+}
+
+#toolbox-controls-separator {
+  width: 3px;
+  background-image: linear-gradient(hsla(204,45%,98%,0), hsla(204,45%,98%,.1), hsla(204,45%,98%,0)),
+                    linear-gradient(hsla(206,37%,4%,0), hsla(206,37%,4%,.6), hsla(206,37%,4%,0)),
+                    linear-gradient(hsla(204,45%,98%,0), hsla(204,45%,98%,.1), hsla(204,45%,98%,0));
+  background-size: 1px 100%;
+  background-repeat: no-repeat;
+  background-position: 0, 1px, 2px;
+  -moz-margin-start: 8px;
+}
+
+
+/* Command buttons */
+
+.command-button {
+  -moz-appearance: none;
+  border: none;
+  margin: 0;
+  padding: 0 8px;
+  width: 16px;
+}
+
+.command-button:hover {
+  background-color: hsla(206,37%,4%,.2);
+}
+.command-button:hover:active {
+  background-color: hsla(206,37%,4%,.4);
 }
 
 #command-button-responsive {
@@ -66,33 +122,89 @@
 
 .devtools-tabbar {
   -moz-appearance: none;
-  background-image: linear-gradient(to bottom, hsl(209,18%,34%), hsl(210,24%,16%));
-  color: hsl(210,30%,85%);
-  padding: 4px 3px 3px;
-  box-shadow: 0 -3px 0 0 rgb(20,20,20) inset, 0 -4px 0 0 rgba(0,0,0,0.8) inset;
+  background-image: url(background-noise-toolbar.png),
+                    linear-gradient(#303840, #2d3640);
+  border: none;
+  box-shadow: 0 1px 0 hsla(204,45%,98%,.05) inset,
+              0 -1px 0 hsla(206,37%,4%,.1) inset;
+  min-height: 32px;
+  padding: 0;
+}
+
+#toolbox-tabs {
+  margin: 0;
 }
 
 .devtools-tab {
   -moz-appearance: none;
-  min-width: 78px;
-  min-height: 22px;
-  text-shadow: 0 -1px 0 hsla(210,8%,5%,.45);
-  border-radius: 3px 3px 0 0;
-  color: inherit;
-  border-style: solid;
-  border-color: transparent;
-  border-width: 1px 1px 0;
-  margin: 0 5px;
-  padding: 0 10px 1px;
-}
-
-.devtools-tab[selected=true] {
-  border-color: hsla(210,8%,5%,.6);
-  background-color: rgb(20,20,20);
-  text-shadow: none;
-  color: white;
+  min-width: 88px;
+  min-height: 32px;
+  color: #b6babf;
+  margin: 0;
+  padding: 0;
+  background-image: linear-gradient(hsla(204,45%,98%,.05), hsla(204,45%,98%,.1)),
+                    linear-gradient(hsla(204,45%,98%,.05), hsla(204,45%,98%,.1));
+  background-size: 1px 100%;
+  background-repeat: no-repeat;
+  background-position: left, right;
+  border-top: 1px solid #060a0d;
+  border-right: 1px solid hsla(206,37%,4%,.45);
 }
 
 .devtools-tab > .radio-label-box {
-  -moz-margin-start: 0px
+  border: none;
+  padding: 0 16px;
+}
+
+.devtools-tab > .radio-label-box > .radio-icon {
+  -moz-margin-end: 6px;
+  opacity: 0.6;
+}
+
+.devtools-tab:hover > .radio-label-box > .radio-icon {
+  opacity: 0.8;
+}
+
+.devtools-tab:active > .radio-label-box > .radio-icon,
+.devtools-tab[selected=true] > .radio-label-box > .radio-icon {
+  opacity: 1;
+}
+
+.devtools-tab:hover {
+  background-image: linear-gradient(hsla(204,45%,98%,.05), hsla(204,45%,98%,.1)),
+                    linear-gradient(hsla(204,45%,98%,.05), hsla(204,45%,98%,.1)),
+                    linear-gradient(hsla(206,37%,4%,.1), hsla(206,37%,4%,.2));
+  background size: 1px 100%,
+                   1px 100%,
+                   100%;
+  background-repeat: no-repeat,
+                     no-repeat,
+                     repeat-x;
+  background-position: left, right;
+  color: #ced3d9;
+}
+.devtools-tab:hover:active {
+  background-color: hsla(206,37%,4%,.2);
+  color: #f5f7fa;
+}
+
+.devtools-tab[selected=true] {
+  color: #f5f7fa;
+  background-image: radial-gradient(ellipse farthest-corner at center top, #9fdfff, hsla(200,100%,70%,.3)),
+                    radial-gradient(ellipse farthest-side at center top, hsla(200,100%,70%,.4), hsla(200,100%,70%,0)),
+                    linear-gradient(hsla(204,45%,98%,.05), hsla(204,45%,98%,.1)),
+                    linear-gradient(hsla(204,45%,98%,.02), hsla(204,45%,98%,.04)),
+                    linear-gradient(hsla(206,37%,4%,.2), hsla(206,37%,4%,.3));
+  background-size: 100% 1px,
+                   100% 5px,
+                   1px 100%,
+                   1px 100%,
+                   100%;
+  background-repeat: no-repeat,
+                     no-repeat,
+                     no-repeat,
+                     no-repeat,
+                     repeat-x;
+  background-position: top right, top left, left, right;
+  box-shadow: 1px -1px 0 hsla(206,37%,4%,.2) inset;
 }

browser/themes/winstripe/jar.mn

@@ -198,10 +198,15 @@ browser.jar:
         skin/classic/browser/devtools/tools-icons-small.png         (devtools/tools-icons-small.png)
         skin/classic/browser/devtools/dock-bottom.png               (devtools/dock-bottom.png)
         skin/classic/browser/devtools/dock-side.png                 (devtools/dock-side.png)
-        skin/classic/browser/devtools/dock-window.png               (devtools/dock-window.png)
         skin/classic/browser/devtools/floating-scrollbars.css       (devtools/floating-scrollbars.css)
         skin/classic/browser/devtools/inspector.css                 (devtools/inspector.css)
         skin/classic/browser/devtools/toolbox.css                   (devtools/toolbox.css)
+        skin/classic/browser/devtools/tool-webconsole.png           (devtools/tool-webconsole.png)
+        skin/classic/browser/devtools/tool-debugger.png             (devtools/tool-debugger.png)
+        skin/classic/browser/devtools/tool-inspector.png            (devtools/tool-inspector.png)
+        skin/classic/browser/devtools/tool-styleeditor.png          (devtools/tool-styleeditor.png)
+        skin/classic/browser/devtools/close.png                     (devtools/close.png)
+        skin/classic/browser/devtools/undock.png                    (devtools/undock.png)
 #ifdef MOZ_SERVICES_SYNC
         skin/classic/browser/sync-throbber.png
         skin/classic/browser/sync-16.png
@@ -411,10 +416,15 @@ browser.jar:
         skin/classic/aero/browser/devtools/tools-icons-small.png     (devtools/tools-icons-small.png)
         skin/classic/aero/browser/devtools/dock-bottom.png           (devtools/dock-bottom.png)
         skin/classic/aero/browser/devtools/dock-side.png             (devtools/dock-side.png)
-        skin/classic/aero/browser/devtools/dock-window.png           (devtools/dock-window.png)
         skin/classic/aero/browser/devtools/floating-scrollbars.css   (devtools/floating-scrollbars.css)
         skin/classic/aero/browser/devtools/inspector.css             (devtools/inspector.css)
         skin/classic/aero/browser/devtools/toolbox.css               (devtools/toolbox.css)
+        skin/classic/aero/browser/devtools/tool-webconsole.png       (devtools/tool-webconsole.png)
+        skin/classic/aero/browser/devtools/tool-debugger.png         (devtools/tool-debugger.png)
+        skin/classic/aero/browser/devtools/tool-inspector.png        (devtools/tool-inspector.png)
+        skin/classic/aero/browser/devtools/tool-styleeditor.png      (devtools/tool-styleeditor.png)
+        skin/classic/aero/browser/devtools/close.png                 (devtools/close.png)
+        skin/classic/aero/browser/devtools/undock.png                (devtools/undock.png)
 #ifdef MOZ_SERVICES_SYNC
         skin/classic/aero/browser/sync-throbber.png
         skin/classic/aero/browser/sync-16.png

build/Makefile.in

@@ -45,10 +45,8 @@ endif
 endif
 
 ifdef LIBXUL_SDK
-GRE_MILESTONE = $(shell $(PYTHON) $(topsrcdir)/config/printconfigsetting.py $(LIBXUL_DIST)/bin/platform.ini Build Milestone)
 APP_INI_DEPS = $(LIBXUL_DIST)/bin/platform.ini
 else
-GRE_MILESTONE = $(shell tail -n 1 $(topsrcdir)/config/milestone.txt 2>/dev/null || tail -1 $(topsrcdir)/config/milestone.txt)
 APP_INI_DEPS = $(topsrcdir)/config/milestone.txt
 endif
 

build/valgrind/cross-architecture.sup

@@ -277,3 +277,11 @@
    fun:_ZN2js6ctypes10StructTypeL6CreateEP9JSContextjPN2JS5ValueE
    ...
 }
+{
+   Bug 824323
+   Memcheck:Leak
+   fun:malloc
+   ...
+   fun:_ZN7mozilla3dom7workers13WorkerPrivate9DoRunLoopEP9JSContext
+   ...
+}

config/rules.mk

@@ -1203,6 +1203,12 @@ PP_TARGETS += PREF_JS_EXPORTS
 endif
 endif
 
+# Set a flag that can be used in pref files to disable features if
+# we are not building for Aurora or Nightly.
+ifeq (,$(findstring a,$(GRE_MILESTONE)))
+PREF_PPFLAGS += -DRELEASE_BUILD
+endif
+
 ################################################################################
 # Copy each element of AUTOCFG_JS_EXPORTS to $(FINAL_TARGET)/defaults/autoconfig
 

configure.in

@@ -3946,6 +3946,15 @@ else
     fi
 fi
 
+dnl set GRE_MILESTONE
+dnl ========================================================
+if test -n "$LIBXUL_SDK"; then
+    GRE_MILESTONE=`$PYTHON "$_topsrcdir"/config/printconfigsetting.py "$LIBXUL_DIST"/bin/platform.ini Build Milestone`
+else
+    GRE_MILESTONE=`tail -n 1 "$_topsrcdir"/config/milestone.txt 2>/dev/null || tail -1 "$_topsrcdir"/config/milestone.txt`
+fi
+AC_SUBST(GRE_MILESTONE)
+
 dnl system libevent Support
 dnl ========================================================
 MOZ_ARG_WITH_STRING(system-libevent,

content/base/crashtests/822723.html

@@ -0,0 +1,20 @@
+<!DOCTYPE html>
+<html>
+<head>
+<script>
+
+function boom()
+{
+  var outer = document.createElementNS("http://www.w3.org/1999/xhtml", "div");
+  outer.setAttribute("dir", "auto");
+  var inner = document.createElementNS("http://www.w3.org/1999/xhtml", "div");
+  inner.appendChild(document.createTextNode("A"));
+  inner.appendChild(document.createTextNode("B"));
+  outer.appendChild(inner);
+  inner.setAttribute("dir", "ltr");
+}
+
+</script>
+</head>
+<body onload="boom();"></body>
+</html>

content/base/crashtests/crashtests.list

@@ -119,3 +119,4 @@ load xhr_empty_datauri.html
 load 815477.html
 load 815500.html
 load 816253.html
+load 822723.html

content/base/public/Element.h

@@ -695,6 +695,14 @@ public:
            nsPresContext::AppUnitsToIntCSSPixels(sf->GetScrollRange().XMost()) :
            0;
   }
+  virtual void GetInnerHTML(nsAString& aInnerHTML,
+                            mozilla::ErrorResult& aError);
+  virtual void SetInnerHTML(const nsAString& aInnerHTML,
+                            mozilla::ErrorResult& aError);
+  void GetOuterHTML(nsAString& aOuterHTML, mozilla::ErrorResult& aError);
+  void SetOuterHTML(const nsAString& aOuterHTML, mozilla::ErrorResult& aError);
+  void InsertAdjacentHTML(const nsAString& aPosition, const nsAString& aText,
+                          mozilla::ErrorResult& aError);
 
   //----------------------------------------
 
@@ -844,6 +852,11 @@ public:
   virtual JSObject* WrapObject(JSContext *aCx, JSObject *aScope,
                                bool *aTriedToWrap) MOZ_FINAL;
 
+  /**
+   * Locate an nsIEditor rooted at this content node, if there is one.
+   */
+  nsIEditor* GetEditorInternal();
+
 protected:
   /*
    * Named-bools for use with SetAttrAndNotify to make call sites easier to
@@ -1082,6 +1095,8 @@ private:
 
   nsIScrollableFrame* GetScrollFrame(nsIFrame **aStyledFrame = nullptr);
 
+  nsresult GetMarkup(bool aIncludeSelf, nsAString& aMarkup);
+
   // Data members
   nsEventStates mState;
 };

content/base/public/nsContentUtils.h

@@ -354,10 +354,10 @@ public:
   /**
    * Checks whether two nodes come from the same origin.
    */
-  static nsresult CheckSameOrigin(nsINode* aTrustedNode,
+  static nsresult CheckSameOrigin(const nsINode* aTrustedNode,
                                   nsIDOMNode* aUnTrustedNode);
-  static nsresult CheckSameOrigin(nsINode* aTrustedNode,
-                                  nsINode* unTrustedNode);
+  static nsresult CheckSameOrigin(const nsINode* aTrustedNode,
+                                  const nsINode* unTrustedNode);
 
   // Check if the (JS) caller can access aNode.
   static bool CanCallerAccess(nsIDOMNode *aNode);

content/base/public/nsIDocument.h

@@ -45,9 +45,15 @@ class nsIDocumentObserver;
 class nsIDOMDocument;
 class nsIDOMDocumentFragment;
 class nsIDOMDocumentType;
+class nsDOMDocumentType;
+class nsXMLProcessingInstruction;
 class nsIDOMElement;
 class nsIDOMEventTarget;
 class nsIDOMNodeList;
+class nsIDOMTouch;
+class nsIDOMTouchList;
+class nsIDOMXPathExpression;
+class nsIDOMXPathNSResolver;
 class nsILayoutHistoryState;
 class nsIObjectLoadingContent;
 class nsIObserver;
@@ -61,27 +67,35 @@ class nsIURI;
 class nsIVariant;
 class nsIViewManager;
 class nsPresContext;
+class nsRange;
 class nsScriptLoader;
 class nsSMILAnimationController;
 class nsStyleSet;
+class nsTextNode;
 class nsWindowSizes;
 class nsSmallVoidArray;
 
 namespace mozilla {
+class ErrorResult;
+
 namespace css {
 class Loader;
 class ImageLoader;
 } // namespace css
 
 namespace dom {
-class Link;
+class Comment;
+class DocumentFragment;
+class DOMImplementation;
 class Element;
+class Link;
+template<typename> class Sequence;
 } // namespace dom
 } // namespace mozilla
 
 #define NS_IDOCUMENT_IID \
-{ 0x1517f31a, 0x0ef9, 0x4629, \
- { 0xb4, 0x7f, 0x56, 0x31, 0x0d, 0x80, 0x61, 0xaf } }
+{ 0xff03d72f, 0x87cd, 0x4d11, \
+ { 0x81, 0x8d, 0xa8, 0xb4, 0xf5, 0x98, 0x1a, 0x10 } }
 
 // Flag for AddStyleSheet().
 #define NS_STYLESHEET_FROM_CATALOG                (1 << 0)
@@ -100,6 +114,13 @@ enum DocumentFlavor {
 // Window activation status
 #define NS_DOCUMENT_STATE_WINDOW_INACTIVE         NS_DEFINE_EVENT_STATE_MACRO(1)
 
+// Some function forward-declarations
+class nsContentList;
+
+already_AddRefed<nsContentList>
+NS_GetContentList(nsINode* aRootNode,
+                  int32_t aMatchNameSpaceId,
+                  const nsAString& aTagname);
 //----------------------------------------------------------------------
 
 // Document interface.  This is implemented by all document objects in
@@ -531,7 +552,7 @@ public:
   /**
    * Return the doctype for this document.
    */
-  nsIContent* GetDocumentType() const;
+  nsDOMDocumentType* GetDoctype() const;
 
   /**
    * Return the root element for this document.
@@ -714,7 +735,7 @@ public:
    * document is truly gone. Use this object when you're trying to find a
    * content wrapper in XPConnect.
    */
-  virtual nsIScriptGlobalObject* GetScopeObject() = 0;
+  virtual nsIScriptGlobalObject* GetScopeObject() const = 0;
 
   /**
    * Return the window containing the document (the outer window).
@@ -870,7 +891,10 @@ public:
 
   enum ReadyState { READYSTATE_UNINITIALIZED = 0, READYSTATE_LOADING = 1, READYSTATE_INTERACTIVE = 3, READYSTATE_COMPLETE = 4};
   virtual void SetReadyStateInternal(ReadyState rs) = 0;
-  virtual ReadyState GetReadyStateEnum() = 0;
+  ReadyState GetReadyStateEnum()
+  {
+    return mReadyState;
+  }
 
   // notify that a content node changed state.  This must happen under
   // a scriptblocker but NOT within a begin/end update.
@@ -1204,7 +1228,7 @@ public:
   /**
    * See GetAnonymousElementByAttribute on nsIDOMDocumentXBL.
    */
-  virtual nsIContent*
+  virtual Element*
     GetAnonymousElementByAttribute(nsIContent* aElement,
                                    nsIAtom* aAttrName,
                                    const nsAString& aAttrValue) const = 0;
@@ -1215,10 +1239,9 @@ public:
    *
    * @see nsIDOMWindowUtils::elementFromPoint
    */
-  virtual nsresult ElementFromPointHelper(float aX, float aY,
+  virtual Element* ElementFromPointHelper(float aX, float aY,
                                           bool aIgnoreRootScrollFrame,
-                                          bool aFlushLayout,
-                                          nsIDOMElement** aReturn) = 0;
+                                          bool aFlushLayout) = 0;
 
   virtual nsresult NodesFromRectHelper(float aX, float aY,
                                        float aTopSize, float aRightSize,
@@ -1702,7 +1725,7 @@ public:
 
   virtual void PostVisibilityUpdateEvent() = 0;
   
-  bool IsSyntheticDocument() { return mIsSyntheticDocument; }
+  bool IsSyntheticDocument() const { return mIsSyntheticDocument; }
 
   void SetNeedLayoutFlush() {
     mNeedLayoutFlush = true;
@@ -1757,6 +1780,164 @@ public:
     return mCreatingStaticClone;
   }
 
+  // WebIDL API
+  nsIScriptGlobalObject* GetParentObject() const
+  {
+    return GetScopeObject();
+  }
+  static already_AddRefed<nsIDocument> Constructor(nsISupports* aGlobal,
+                                                   mozilla::ErrorResult& rv);
+  virtual mozilla::dom::DOMImplementation*
+    GetImplementation(mozilla::ErrorResult& rv) = 0;
+  void GetURL(nsString& retval) const;
+  void GetDocumentURI(nsString& retval) const;
+  void GetCompatMode(nsString& retval) const;
+  void GetCharacterSet(nsAString& retval) const;
+  // Skip GetContentType, because our NS_IMETHOD version above works fine here.
+  // GetDoctype defined above
+  Element* GetDocumentElement() const
+  {
+    return GetRootElement();
+  }
+  already_AddRefed<nsContentList>
+  GetElementsByTagName(const nsAString& aTagName)
+  {
+    return NS_GetContentList(this, kNameSpaceID_Unknown, aTagName);
+  }
+  already_AddRefed<nsContentList>
+    GetElementsByTagNameNS(const nsAString& aNamespaceURI,
+                           const nsAString& aLocalName);
+  already_AddRefed<nsContentList>
+    GetElementsByClassName(const nsAString& aClasses);
+  // GetElementById defined above
+  already_AddRefed<Element> CreateElement(const nsAString& aTagName,
+                                          mozilla::ErrorResult& rv);
+  already_AddRefed<Element> CreateElementNS(const nsAString& aNamespaceURI,
+                                            const nsAString& aQualifiedName,
+                                            mozilla::ErrorResult& rv);
+  already_AddRefed<mozilla::dom::DocumentFragment>
+    CreateDocumentFragment(mozilla::ErrorResult& rv) const;
+  already_AddRefed<nsTextNode> CreateTextNode(const nsAString& aData,
+                                              mozilla::ErrorResult& rv) const;
+  already_AddRefed<mozilla::dom::Comment>
+    CreateComment(const nsAString& aData, mozilla::ErrorResult& rv) const;
+  already_AddRefed<nsXMLProcessingInstruction>
+    CreateProcessingInstruction(const nsAString& target, const nsAString& data,
+                                mozilla::ErrorResult& rv) const;
+  already_AddRefed<nsINode>
+    ImportNode(nsINode& aNode, bool aDeep, mozilla::ErrorResult& rv) const;
+  nsINode* AdoptNode(nsINode& aNode, mozilla::ErrorResult& rv);
+  already_AddRefed<nsIDOMEvent> CreateEvent(const nsAString& aEventType,
+                                            mozilla::ErrorResult& rv) const;
+  already_AddRefed<nsRange> CreateRange(mozilla::ErrorResult& rv);
+  already_AddRefed<nsIDOMNodeIterator>
+    CreateNodeIterator(nsINode& aRoot, uint32_t aWhatToShow,
+                       nsIDOMNodeFilter* aFilter, mozilla::ErrorResult& rv) const;
+  already_AddRefed<nsIDOMTreeWalker>
+    CreateTreeWalker(nsINode& aRoot, uint32_t aWhatToShow,
+                     nsIDOMNodeFilter* aFilter, mozilla::ErrorResult& rv) const;
+
+  // Deprecated WebIDL bits
+  already_AddRefed<nsIDOMCDATASection>
+    CreateCDATASection(const nsAString& aData, mozilla::ErrorResult& rv);
+  already_AddRefed<nsIDOMAttr>
+    CreateAttribute(const nsAString& aName, mozilla::ErrorResult& rv);
+  already_AddRefed<nsIDOMAttr>
+    CreateAttributeNS(const nsAString& aNamespaceURI,
+                      const nsAString& aQualifiedName,
+                      mozilla::ErrorResult& rv);
+  void GetInputEncoding(nsAString& aInputEncoding);
+  already_AddRefed<nsIDOMLocation> GetLocation() const;
+  void GetReferrer(nsAString& aReferrer) const;
+  void GetLastModified(nsAString& aLastModified) const;
+  void GetReadyState(nsAString& aReadyState) const;
+  // Not const because otherwise the compiler can't figure out whether to call
+  // this GetTitle or the nsAString version from non-const methods, since
+  // neither is an exact match.
+  virtual void GetTitle(nsString& aTitle) = 0;
+  virtual void SetTitle(const nsAString& aTitle, mozilla::ErrorResult& rv) = 0;
+  void GetDir(nsAString& aDirection) const;
+  void SetDir(const nsAString& aDirection, mozilla::ErrorResult& rv);
+  nsIDOMWindow* GetDefaultView() const
+  {
+    return GetWindow();
+  }
+  Element* GetActiveElement();
+  bool HasFocus(mozilla::ErrorResult& rv) const;
+  // Event handlers are all on nsINode already
+  bool MozSyntheticDocument() const
+  {
+    return IsSyntheticDocument();
+  }
+  Element* GetCurrentScript();
+  void ReleaseCapture() const;
+  virtual void MozSetImageElement(const nsAString& aImageElementId,
+                                  Element* aElement) = 0;
+  // Not const because all the full-screen goop is not const
+  virtual bool MozFullScreenEnabled() = 0;
+  virtual Element* GetMozFullScreenElement(mozilla::ErrorResult& rv) = 0;
+  bool MozFullScreen()
+  {
+    return IsFullScreenDoc();
+  }
+  void MozCancelFullScreen();
+  Element* GetMozPointerLockElement();
+  void MozExitPointerLock()
+  {
+    UnlockPointer();
+  }
+  bool Hidden() const
+  {
+    return mVisibilityState != eVisible;
+  }
+  bool MozHidden() // Not const because of WarnOnceAbout
+  {
+    WarnOnceAbout(ePrefixedVisibilityAPI);
+    return Hidden();
+  }
+  void GetVisibilityState(nsAString& aState);
+  void GetMozVisibilityState(nsAString& aState);
+  virtual nsIDOMStyleSheetList* StyleSheets() = 0;
+  void GetSelectedStyleSheetSet(nsAString& aSheetSet);
+  virtual void SetSelectedStyleSheetSet(const nsAString& aSheetSet) = 0;
+  virtual void GetLastStyleSheetSet(nsString& aSheetSet) = 0;
+  void GetPreferredStyleSheetSet(nsAString& aSheetSet);
+  virtual nsIDOMDOMStringList* StyleSheetSets() = 0;
+  virtual void EnableStyleSheetsForSet(const nsAString& aSheetSet) = 0;
+  Element* ElementFromPoint(float aX, float aY);
+  // QuerySelector and QuerySelectorAll already defined on nsINode
+  nsINodeList* GetAnonymousNodes(Element& aElement);
+  Element* GetAnonymousElementByAttribute(Element& aElement,
+                                          const nsAString& aAttrName,
+                                          const nsAString& aAttrValue);
+  void AddBinding(Element& aElement, const nsAString& aURI,
+                  mozilla::ErrorResult& rv);
+  void RemoveBinding(Element& aElement, const nsAString& aURI,
+                     mozilla::ErrorResult& rv);
+  Element* GetBindingParent(nsINode& aNode);
+  void LoadBindingDocument(const nsAString& aURI, mozilla::ErrorResult& rv);
+  already_AddRefed<nsIDOMXPathExpression>
+    CreateExpression(const nsAString& aExpression,
+                     nsIDOMXPathNSResolver* aResolver,
+                     mozilla::ErrorResult& rv);
+  already_AddRefed<nsIDOMXPathNSResolver>
+    CreateNSResolver(nsINode* aNodeResolver, mozilla::ErrorResult& rv);
+  already_AddRefed<nsISupports>
+    Evaluate(const nsAString& aExpression, nsINode* aContextNode,
+             nsIDOMXPathNSResolver* aResolver, uint16_t aType,
+             nsISupports* aResult, mozilla::ErrorResult& rv);
+  // Touch event handlers already on nsINode
+  already_AddRefed<nsIDOMTouch>
+    CreateTouch(nsIDOMWindow* aView, nsISupports* aTarget,
+                int32_t aIdentifier, int32_t aPageX, int32_t aPageY,
+                int32_t aScreenX, int32_t aScreenY, int32_t aClientX,
+                int32_t aClientY, int32_t aRadiusX, int32_t aRadiusY,
+                float aRotationAngle, float aForce);
+  already_AddRefed<nsIDOMTouchList>
+    CreateTouchList(nsIDOMTouch* aTouch);
+  already_AddRefed<nsIDOMTouchList>
+    CreateTouchList(const mozilla::dom::Sequence<nsRefPtr<nsIDOMTouch> >& aTouches);
+
 private:
   uint64_t mWarnedAbout;
 
@@ -1801,6 +1982,23 @@ protected:
     return mContentType;
   }
 
+  inline void
+  SetDocumentDirectionality(mozilla::Directionality aDir)
+  {
+    mDirectionality = aDir;
+  }
+
+  // This needs to stay in sync with the list in GetVisibilityState.
+  // XXXbz visibilityState needs to be an IDL enum.
+  enum VisibilityState {
+    eHidden = 0,
+    eVisible,
+    eVisibilityStateCount
+  };
+
+  nsCString mReferrer;
+  nsString mLastModified;
+
   nsCOMPtr<nsIURI> mDocumentURI;
   nsCOMPtr<nsIURI> mOriginalURI;
   nsCOMPtr<nsIURI> mDocumentBaseURI;
@@ -1845,6 +2043,12 @@ protected:
   // Compatibility mode
   nsCompatibility mCompatMode;
 
+  // Our readyState
+  ReadyState mReadyState;
+
+  // Our visibility state
+  VisibilityState mVisibilityState;
+
   // True if BIDI is enabled.
   bool mBidiEnabled;
   // True if a MathML element has ever been owned by this document.
@@ -1934,6 +2138,10 @@ protected:
   // True if DisallowBFCaching has been called on this document.
   bool mBFCacheDisallowed;
 
+  // If true, we have an input encoding.  If this is false, then the
+  // document was created entirely in memory
+  bool mHaveInputEncoding;
+
   // The document's script global object, the object from which the
   // document can get its script context and scope. This is the
   // *inner* window object.

content/base/public/nsINode.h

@@ -277,11 +277,11 @@ public:
   // worthwhile:
   // - nsGenericHTMLElement:  mForm, mFieldSet
   // - nsGenericHTMLFrameElement: mFrameLoader (bug 672539), mTitleChangedListener
-  // - nsHTMLBodyElement:     mContentStyleRule
-  // - nsHTMLDataListElement: mOptions
+  // - HTMLBodyElement:       mContentStyleRule
+  // - HTMLDataListElement:   mOptions
   // - nsHTMLFieldSetElement: mElements, mDependentElements, mFirstLegend
   // - nsHTMLFormElement:     many!
-  // - nsHTMLFrameSetElement: mRowSpecs, mColSpecs
+  // - HTMLFrameSetElement:   mRowSpecs, mColSpecs
   // - nsHTMLInputElement:    mInputData, mFiles, mFileList, mStaticDocfileList
   // - nsHTMLMapElement:      mAreas
   // - nsHTMLMediaElement:    many!

content/base/src/DirectionalityUtils.cpp

@@ -363,21 +363,40 @@ WalkDescendantsSetDirectionFromText(Element* aElement, bool aNotify = true,
                                        nsINode* aStartAfterNode = nullptr)
 {
   MOZ_ASSERT(aElement, "aElement is null");
+  if (DoesNotParticipateInAutoDirection(aElement)) {
+    return nullptr;
+  }
 
   nsIContent* child;
   if (aStartAfterNode &&
       nsContentUtils::ContentIsDescendantOf(aStartAfterNode, aElement)) {
+    nsIContent* firstNode = aStartAfterNode->GetNextNode(aElement);
+
 #ifdef DEBUG
+    // In debug builds, assert that aStartAfterNode is correctly set by checking
+    // that text node descendants of elements up to aStartAfterNode don't have
+    // any strong directional characters
     child = aElement->GetFirstChild();
-    while (child && child != aStartAfterNode) {
+    while (child && child != firstNode) {
+      // Skip over nodes whose text node descendants don't affect directionality
+      // of their ancestors
+      if (child->IsElement() &&
+          (DoesNotParticipateInAutoDirection(child->AsElement()) ||
+           child->NodeInfo()->Equals(nsGkAtoms::bdi) ||
+           child->HasFixedDir())) {
+        child = child->GetNextNonChildNode(aElement);
+        continue;
+      }
+
       if (child->NodeType() == nsIDOMNode::TEXT_NODE) {
         MOZ_ASSERT(GetDirectionFromText(child->GetText()) == eDir_NotSet,
                    "Strong directional characters before aStartAfterNode");
       }
       child = child->GetNextNode(aElement);
     }
+#else
+    child = firstNode;
 #endif
-    child = aStartAfterNode->GetNextNode(aElement);
   } else {
     child = aElement->GetFirstChild();
   }

content/base/src/Element.cpp

@@ -127,6 +127,8 @@
 
 #include "nsStyledElement.h"
 #include "nsXBLService.h"
+#include "nsContentCID.h"
+#include "nsITextControlElement.h"
 
 using namespace mozilla;
 using namespace mozilla::dom;
@@ -2664,3 +2666,946 @@ Element::MozRequestFullScreen()
 
   return;
 }
+
+// Try to keep the size of StringBuilder close to a jemalloc bucket size.
+#define STRING_BUFFER_UNITS 1020
+
+class StringBuilder
+{
+private:
+  class Unit
+  {
+  public:
+    Unit() : mAtom(nullptr), mType(eUnknown), mLength(0)
+    {
+      MOZ_COUNT_CTOR(StringBuilder::Unit);
+    }
+    ~Unit()
+    {
+      if (mType == eString || mType == eStringWithEncode) {
+        delete mString;
+      }
+      MOZ_COUNT_DTOR(StringBuilder::Unit);
+    }
+
+    enum Type
+    {
+      eUnknown,
+      eAtom,
+      eString,
+      eStringWithEncode,
+      eLiteral,
+      eTextFragment,
+      eTextFragmentWithEncode,
+    };
+
+    union
+    {
+      nsIAtom*              mAtom;
+      const char*           mLiteral;
+      nsAutoString*         mString;
+      const nsTextFragment* mTextFragment;
+    };
+    Type     mType;
+    uint32_t mLength;
+  };
+public:
+  StringBuilder() : mLast(this), mLength(0)
+  {
+    MOZ_COUNT_CTOR(StringBuilder);
+  }
+
+  ~StringBuilder()
+  {
+    MOZ_COUNT_DTOR(StringBuilder);
+  }
+
+  void Append(nsIAtom* aAtom)
+  {
+    Unit* u = AddUnit();
+    u->mAtom = aAtom;
+    u->mType = Unit::eAtom;
+    uint32_t len = aAtom->GetLength();
+    u->mLength = len;
+    mLength += len;
+  }
+
+  template<int N>
+  void Append(const char (&aLiteral)[N])
+  {
+    Unit* u = AddUnit();
+    u->mLiteral = aLiteral;
+    u->mType = Unit::eLiteral;
+    uint32_t len = N - 1;
+    u->mLength = len;
+    mLength += len;
+  }
+
+  template<int N>
+  void Append(char (&aLiteral)[N])
+  {
+    Unit* u = AddUnit();
+    u->mLiteral = aLiteral;
+    u->mType = Unit::eLiteral;
+    uint32_t len = N - 1;
+    u->mLength = len;
+    mLength += len;
+  }
+
+  void Append(const nsAString& aString)
+  {
+    Unit* u = AddUnit();
+    u->mString = new nsAutoString(aString);
+    u->mType = Unit::eString;
+    uint32_t len = aString.Length();
+    u->mLength = len;
+    mLength += len;
+  }
+
+  void Append(nsAutoString* aString)
+  {
+    Unit* u = AddUnit();
+    u->mString = aString;
+    u->mType = Unit::eString;
+    uint32_t len = aString->Length();
+    u->mLength = len;
+    mLength += len;
+  }
+
+  void AppendWithAttrEncode(nsAutoString* aString, uint32_t aLen)
+  {
+    Unit* u = AddUnit();
+    u->mString = aString;
+    u->mType = Unit::eStringWithEncode;
+    u->mLength = aLen;
+    mLength += aLen;
+  }
+
+  void Append(const nsTextFragment* aTextFragment)
+  {
+    Unit* u = AddUnit();
+    u->mTextFragment = aTextFragment;
+    u->mType = Unit::eTextFragment;
+    uint32_t len = aTextFragment->GetLength();
+    u->mLength = len;
+    mLength += len;
+  }
+
+  void AppendWithEncode(const nsTextFragment* aTextFragment, uint32_t aLen)
+  {
+    Unit* u = AddUnit();
+    u->mTextFragment = aTextFragment;
+    u->mType = Unit::eTextFragmentWithEncode;
+    u->mLength = aLen;
+    mLength += aLen;
+  }
+
+  bool ToString(nsAString& aOut)
+  {
+    if (!aOut.SetCapacity(mLength, fallible_t())) {
+      return false;
+    }
+
+    for (StringBuilder* current = this; current; current = current->mNext) {
+      uint32_t len = current->mUnits.Length();
+      for (uint32_t i = 0; i < len; ++i) {
+        Unit& u = current->mUnits[i];
+        switch (u.mType) {
+          case Unit::eAtom:
+            aOut.Append(nsDependentAtomString(u.mAtom));
+            break;
+          case Unit::eString:
+            aOut.Append(*(u.mString));
+            break;
+          case Unit::eStringWithEncode:
+            EncodeAttrString(*(u.mString), aOut);
+            break;
+          case Unit::eLiteral:
+            aOut.AppendASCII(u.mLiteral, u.mLength);
+            break;
+          case Unit::eTextFragment:
+            u.mTextFragment->AppendTo(aOut);
+            break;
+          case Unit::eTextFragmentWithEncode:
+            EncodeTextFragment(u.mTextFragment, aOut);
+            break;
+          default:
+            MOZ_NOT_REACHED("Unknown unit type?");
+        }
+      }
+    }
+    return true;
+  }
+private:
+  Unit* AddUnit()
+  {
+    if (mLast->mUnits.Length() == STRING_BUFFER_UNITS) {
+      new StringBuilder(this);
+    }
+    return mLast->mUnits.AppendElement();
+  }
+
+  StringBuilder(StringBuilder* aFirst)
+  : mLast(nullptr), mLength(0)
+  {
+    MOZ_COUNT_CTOR(StringBuilder);
+    aFirst->mLast->mNext = this;
+    aFirst->mLast = this;
+  }
+
+  void EncodeAttrString(const nsAutoString& aValue, nsAString& aOut)
+  {
+    const PRUnichar* c = aValue.BeginReading();
+    const PRUnichar* end = aValue.EndReading();
+    while (c < end) {
+      switch (*c) {
+      case '"':
+        aOut.AppendLiteral("&quot;");
+        break;
+      case '&':
+        aOut.AppendLiteral("&amp;");
+        break;
+      case 0x00A0:
+        aOut.AppendLiteral("&nbsp;");
+        break;
+      default:
+        aOut.Append(*c);
+        break;
+      }
+      ++c;
+    }
+  }
+
+  void EncodeTextFragment(const nsTextFragment* aValue, nsAString& aOut)
+  {
+    uint32_t len = aValue->GetLength();
+    if (aValue->Is2b()) {
+      const PRUnichar* data = aValue->Get2b();
+      for (uint32_t i = 0; i < len; ++i) {
+        const PRUnichar c = data[i];
+        switch (c) {
+          case '<':
+            aOut.AppendLiteral("&lt;");
+            break;
+          case '>':
+            aOut.AppendLiteral("&gt;");
+            break;
+          case '&':
+            aOut.AppendLiteral("&amp;");
+            break;
+          case 0x00A0:
+            aOut.AppendLiteral("&nbsp;");
+            break;
+          default:
+            aOut.Append(c);
+            break;
+        }
+      }
+    } else {
+      const char* data = aValue->Get1b();
+      for (uint32_t i = 0; i < len; ++i) {
+        const unsigned char c = data[i];
+        switch (c) {
+          case '<':
+            aOut.AppendLiteral("&lt;");
+            break;
+          case '>':
+            aOut.AppendLiteral("&gt;");
+            break;
+          case '&':
+            aOut.AppendLiteral("&amp;");
+            break;
+          case 0x00A0:
+            aOut.AppendLiteral("&nbsp;");
+            break;
+          default:
+            aOut.Append(c);
+            break;
+        }
+      }
+    }
+  }
+
+  nsAutoTArray<Unit, STRING_BUFFER_UNITS> mUnits;
+  nsAutoPtr<StringBuilder>                mNext;
+  StringBuilder*                          mLast;
+  // mLength is used only in the first StringBuilder object in the linked list.
+  uint32_t                                mLength;
+};
+
+static void
+AppendEncodedCharacters(const nsTextFragment* aText, StringBuilder& aBuilder)
+{
+  uint32_t extraSpaceNeeded = 0;
+  uint32_t len = aText->GetLength();
+  if (aText->Is2b()) {
+    const PRUnichar* data = aText->Get2b();
+    for (uint32_t i = 0; i < len; ++i) {
+      const PRUnichar c = data[i];
+      switch (c) {
+        case '<':
+          extraSpaceNeeded += ArrayLength("&lt;") - 2;
+          break;
+        case '>':
+          extraSpaceNeeded += ArrayLength("&gt;") - 2;
+          break;
+        case '&':
+          extraSpaceNeeded += ArrayLength("&amp;") - 2;
+          break;
+        case 0x00A0:
+          extraSpaceNeeded += ArrayLength("&nbsp;") - 2;
+          break;
+        default:
+          break;
+      }
+    }
+  } else {
+    const char* data = aText->Get1b();
+    for (uint32_t i = 0; i < len; ++i) {
+      const unsigned char c = data[i];
+      switch (c) {
+        case '<':
+          extraSpaceNeeded += ArrayLength("&lt;") - 2;
+          break;
+        case '>':
+          extraSpaceNeeded += ArrayLength("&gt;") - 2;
+          break;
+        case '&':
+          extraSpaceNeeded += ArrayLength("&amp;") - 2;
+          break;
+        case 0x00A0:
+          extraSpaceNeeded += ArrayLength("&nbsp;") - 2;
+          break;
+        default:
+          break;
+      }
+    }
+  }
+
+  if (extraSpaceNeeded) {
+    aBuilder.AppendWithEncode(aText, len + extraSpaceNeeded);
+  } else {
+    aBuilder.Append(aText);
+  }
+}
+
+static void
+AppendEncodedAttributeValue(nsAutoString* aValue, StringBuilder& aBuilder)
+{
+  const PRUnichar* c = aValue->BeginReading();
+  const PRUnichar* end = aValue->EndReading();
+
+  uint32_t extraSpaceNeeded = 0;
+  while (c < end) {
+    switch (*c) {
+      case '"':
+        extraSpaceNeeded += ArrayLength("&quot;") - 2;
+        break;
+      case '&':
+        extraSpaceNeeded += ArrayLength("&amp;") - 2;
+        break;
+      case 0x00A0:
+        extraSpaceNeeded += ArrayLength("&nbsp;") - 2;
+        break;
+      default:
+        break;
+    }
+    ++c;
+  }
+
+  if (extraSpaceNeeded) {
+    aBuilder.AppendWithAttrEncode(aValue, aValue->Length() + extraSpaceNeeded);
+  } else {
+    aBuilder.Append(aValue);
+  }
+}
+
+static void
+StartElement(Element* aContent, StringBuilder& aBuilder)
+{
+  nsIAtom* localName = aContent->Tag();
+  int32_t tagNS = aContent->GetNameSpaceID();
+
+  aBuilder.Append("<");
+  if (aContent->IsHTML() || aContent->IsSVG() || aContent->IsMathML()) {
+    aBuilder.Append(localName);
+  } else {
+    aBuilder.Append(aContent->NodeName());
+  }
+
+  int32_t count = aContent->GetAttrCount();
+  for (int32_t i = count; i > 0;) {
+    --i;
+    const nsAttrName* name = aContent->GetAttrNameAt(i);
+    int32_t attNs = name->NamespaceID();
+    nsIAtom* attName = name->LocalName();
+
+    // Filter out any attribute starting with [-|_]moz
+    nsDependentAtomString attrNameStr(attName);
+    if (StringBeginsWith(attrNameStr, NS_LITERAL_STRING("_moz")) ||
+        StringBeginsWith(attrNameStr, NS_LITERAL_STRING("-moz"))) {
+      continue;
+    }
+
+    nsAutoString* attValue = new nsAutoString();
+    aContent->GetAttr(attNs, attName, *attValue);
+
+    // Filter out special case of <br type="_moz*"> used by the editor.
+    // Bug 16988.  Yuck.
+    if (localName == nsGkAtoms::br && tagNS == kNameSpaceID_XHTML &&
+        attName == nsGkAtoms::type && attNs == kNameSpaceID_None &&
+        StringBeginsWith(*attValue, NS_LITERAL_STRING("_moz"))) {
+      delete attValue;
+      continue;
+    }
+    
+    if (MOZ_LIKELY(attNs == kNameSpaceID_None) ||
+        (attNs == kNameSpaceID_XMLNS &&
+         attName == nsGkAtoms::xmlns)) {
+      aBuilder.Append(" ");
+    } else if (attNs == kNameSpaceID_XML) {
+      aBuilder.Append(" xml:");
+    } else if (attNs == kNameSpaceID_XMLNS) {
+      aBuilder.Append(" xmlns:");
+    } else if (attNs == kNameSpaceID_XLink) {
+      aBuilder.Append(" xlink:");
+    } else {
+      nsIAtom* prefix = name->GetPrefix();
+      if (prefix) {
+        aBuilder.Append(" ");
+        aBuilder.Append(prefix);
+        aBuilder.Append(":");
+      }
+    }
+
+    aBuilder.Append(attName);
+    aBuilder.Append("=\"");
+    AppendEncodedAttributeValue(attValue, aBuilder);
+    aBuilder.Append("\"");
+  }
+
+  aBuilder.Append(">");
+
+  /*
+  // Per HTML spec we should append one \n if the first child of
+  // pre/textarea/listing is a textnode and starts with a \n.
+  // But because browsers haven't traditionally had that behavior,
+  // we're not changing our behavior either - yet.
+  if (aContent->IsHTML()) {
+    if (localName == nsGkAtoms::pre || localName == nsGkAtoms::textarea ||
+        localName == nsGkAtoms::listing) {
+      nsIContent* fc = aContent->GetFirstChild();
+      if (fc &&
+          (fc->NodeType() == nsIDOMNode::TEXT_NODE ||
+           fc->NodeType() == nsIDOMNode::CDATA_SECTION_NODE)) {
+        const nsTextFragment* text = fc->GetText();
+        if (text && text->GetLength() && text->CharAt(0) == PRUnichar('\n')) {
+          aBuilder.Append("\n");
+        }
+      }
+    }
+  }*/
+}
+
+static inline bool
+ShouldEscape(nsIContent* aParent)
+{
+  if (!aParent || !aParent->IsHTML()) {
+    return true;
+  }
+
+  static const nsIAtom* nonEscapingElements[] = {
+    nsGkAtoms::style, nsGkAtoms::script, nsGkAtoms::xmp,
+    nsGkAtoms::iframe, nsGkAtoms::noembed, nsGkAtoms::noframes,
+    nsGkAtoms::plaintext, 
+    // Per the current spec noscript should be escaped in case
+    // scripts are disabled or if document doesn't have
+    // browsing context. However the latter seems to be a spec bug
+    // and Gecko hasn't traditionally done the former.
+    nsGkAtoms::noscript    
+  };
+  static mozilla::BloomFilter<12, nsIAtom> sFilter;
+  static bool sInitialized = false;
+  if (!sInitialized) {
+    sInitialized = true;
+    for (uint32_t i = 0; i < ArrayLength(nonEscapingElements); ++i) {
+      sFilter.add(nonEscapingElements[i]);
+    }
+  }
+
+  nsIAtom* tag = aParent->Tag();
+  if (sFilter.mightContain(tag)) {
+    for (uint32_t i = 0; i < ArrayLength(nonEscapingElements); ++i) {
+      if (tag == nonEscapingElements[i]) {
+        return false;
+      }
+    }
+  }
+  return true;
+}
+
+static inline bool
+IsVoidTag(Element* aElement)
+{
+  if (!aElement->IsHTML()) {
+    return false;
+  }
+
+  static const nsIAtom* voidElements[] = {
+    nsGkAtoms::area, nsGkAtoms::base, nsGkAtoms::basefont,
+    nsGkAtoms::bgsound, nsGkAtoms::br, nsGkAtoms::col,
+    nsGkAtoms::command, nsGkAtoms::embed, nsGkAtoms::frame,
+    nsGkAtoms::hr, nsGkAtoms::img, nsGkAtoms::input,
+    nsGkAtoms::keygen, nsGkAtoms::link, nsGkAtoms::meta,
+    nsGkAtoms::param, nsGkAtoms::source, nsGkAtoms::track,
+    nsGkAtoms::wbr
+  };
+
+  static mozilla::BloomFilter<12, nsIAtom> sFilter;
+  static bool sInitialized = false;
+  if (!sInitialized) {
+    sInitialized = true;
+    for (uint32_t i = 0; i < ArrayLength(voidElements); ++i) {
+      sFilter.add(voidElements[i]);
+    }
+  }
+  
+  nsIAtom* tag = aElement->Tag();
+  if (sFilter.mightContain(tag)) {
+    for (uint32_t i = 0; i < ArrayLength(voidElements); ++i) {
+      if (tag == voidElements[i]) {
+        return true;
+      }
+    }
+  }
+  return false;
+}
+
+static bool
+Serialize(Element* aRoot, bool aDescendentsOnly, nsAString& aOut)
+{
+  nsINode* current = aDescendentsOnly ? aRoot->GetFirstChild() : aRoot;
+  if (!current) {
+    return true;
+  }
+
+  StringBuilder builder;
+  nsIContent* next;
+  while (true) {
+    bool isVoid = false;
+    switch (current->NodeType()) {
+      case nsIDOMNode::ELEMENT_NODE: {
+        Element* elem = current->AsElement();
+        StartElement(elem, builder);
+        isVoid = IsVoidTag(elem);
+        if (!isVoid && (next = current->GetFirstChild())) {
+          current = next;
+          continue;
+        }
+        break;
+      }
+
+      case nsIDOMNode::TEXT_NODE:
+      case nsIDOMNode::CDATA_SECTION_NODE: {
+        const nsTextFragment* text = static_cast<nsIContent*>(current)->GetText();
+        nsIContent* parent = current->GetParent();
+        if (ShouldEscape(parent)) {
+          AppendEncodedCharacters(text, builder);
+        } else {
+          builder.Append(text);
+        }
+        break;
+      }
+
+      case nsIDOMNode::COMMENT_NODE: {
+        builder.Append("<!--");
+        builder.Append(static_cast<nsIContent*>(current)->GetText());
+        builder.Append("-->");
+        break;
+      }
+
+      case nsIDOMNode::DOCUMENT_TYPE_NODE: {
+        builder.Append("<!DOCTYPE ");
+        builder.Append(current->NodeName());
+        builder.Append(">");
+        break;
+      }
+
+      case nsIDOMNode::PROCESSING_INSTRUCTION_NODE: {
+        builder.Append("<?");
+        builder.Append(current->NodeName());
+        builder.Append(" ");
+        builder.Append(static_cast<nsIContent*>(current)->GetText());
+        builder.Append(">");
+        break;
+      }
+    }
+
+    while (true) {
+      if (!isVoid && current->NodeType() == nsIDOMNode::ELEMENT_NODE) {
+        builder.Append("</");
+        nsIContent* elem = static_cast<nsIContent*>(current);
+        if (elem->IsHTML() || elem->IsSVG() || elem->IsMathML()) {
+          builder.Append(elem->Tag());
+        } else {
+          builder.Append(current->NodeName());
+        }
+        builder.Append(">");
+      }
+      isVoid = false;
+
+      if (current == aRoot) {
+        return builder.ToString(aOut);
+      }
+
+      if ((next = current->GetNextSibling())) {
+        current = next;
+        break;
+      }
+
+      current = current->GetParentNode();
+      if (aDescendentsOnly && current == aRoot) {
+        return builder.ToString(aOut);
+      }
+    }
+  }
+}
+
+nsresult
+Element::GetMarkup(bool aIncludeSelf, nsAString& aMarkup)
+{
+  aMarkup.Truncate();
+
+  nsIDocument* doc = OwnerDoc();
+  if (IsInHTMLDocument()) {
+    return Serialize(this, !aIncludeSelf, aMarkup) ? NS_OK : NS_ERROR_OUT_OF_MEMORY;
+  }
+
+  nsAutoString contentType;
+  doc->GetContentType(contentType);
+
+  nsCOMPtr<nsIDocumentEncoder> docEncoder = doc->GetCachedEncoder();
+  if (!docEncoder) {
+    docEncoder =
+      do_CreateInstance(PromiseFlatCString(
+        nsDependentCString(NS_DOC_ENCODER_CONTRACTID_BASE) +
+        NS_ConvertUTF16toUTF8(contentType)
+      ).get());
+  }
+  if (!docEncoder) {
+    // This could be some type for which we create a synthetic document.  Try
+    // again as XML
+    contentType.AssignLiteral("application/xml");
+    docEncoder = do_CreateInstance(NS_DOC_ENCODER_CONTRACTID_BASE "application/xml");
+  }
+
+  NS_ENSURE_TRUE(docEncoder, NS_ERROR_FAILURE);
+
+  uint32_t flags = nsIDocumentEncoder::OutputEncodeBasicEntities |
+                   // Output DOM-standard newlines
+                   nsIDocumentEncoder::OutputLFLineBreak |
+                   // Don't do linebreaking that's not present in
+                   // the source
+                   nsIDocumentEncoder::OutputRaw |
+                   // Only check for mozdirty when necessary (bug 599983)
+                   nsIDocumentEncoder::OutputIgnoreMozDirty;
+
+  if (IsEditable()) {
+    nsIEditor* editor = GetEditorInternal();
+    if (editor && editor->OutputsMozDirty()) {
+      flags &= ~nsIDocumentEncoder::OutputIgnoreMozDirty;
+    }
+  }
+
+  nsresult rv = docEncoder->NativeInit(doc, contentType, flags);
+  NS_ENSURE_SUCCESS(rv, rv);
+
+  if (aIncludeSelf) {
+    docEncoder->SetNativeNode(this);
+  } else {
+    docEncoder->SetNativeContainerNode(this);
+  }
+  rv = docEncoder->EncodeToString(aMarkup);
+  if (!aIncludeSelf) {
+    doc->SetCachedEncoder(docEncoder.forget());
+  }
+  return rv;
+}
+
+/**
+ * Fire mutation events for changes caused by parsing directly into a
+ * context node.
+ *
+ * @param aDoc the document of the node
+ * @param aDest the destination node that got stuff appended to it
+ * @param aOldChildCount the number of children the node had before parsing
+ */
+static void
+FireMutationEventsForDirectParsing(nsIDocument* aDoc, nsIContent* aDest,
+                                   int32_t aOldChildCount)
+{
+  // Fire mutation events. Optimize for the case when there are no listeners
+  int32_t newChildCount = aDest->GetChildCount();
+  if (newChildCount && nsContentUtils::
+        HasMutationListeners(aDoc, NS_EVENT_BITS_MUTATION_NODEINSERTED)) {
+    nsAutoTArray<nsCOMPtr<nsIContent>, 50> childNodes;
+    NS_ASSERTION(newChildCount - aOldChildCount >= 0,
+                 "What, some unexpected dom mutation has happened?");
+    childNodes.SetCapacity(newChildCount - aOldChildCount);
+    for (nsIContent* child = aDest->GetFirstChild();
+         child;
+         child = child->GetNextSibling()) {
+      childNodes.AppendElement(child);
+    }
+    Element::FireNodeInserted(aDoc, aDest, childNodes);
+  }
+}
+
+void
+Element::GetInnerHTML(nsAString& aInnerHTML, ErrorResult& aError)
+{
+  aError = GetMarkup(false, aInnerHTML);
+}
+
+void
+Element::SetInnerHTML(const nsAString& aInnerHTML, ErrorResult& aError)
+{
+  nsIDocument* doc = OwnerDoc();
+
+  // Batch possible DOMSubtreeModified events.
+  mozAutoSubtreeModified subtree(doc, nullptr);
+
+  FireNodeRemovedForChildren();
+
+  // Needed when innerHTML is used in combination with contenteditable
+  mozAutoDocUpdate updateBatch(doc, UPDATE_CONTENT_MODEL, true);
+
+  // Remove childnodes.
+  uint32_t childCount = GetChildCount();
+  nsAutoMutationBatch mb(this, true, false);
+  for (uint32_t i = 0; i < childCount; ++i) {
+    RemoveChildAt(0, true);
+  }
+  mb.RemovalDone();
+
+  nsAutoScriptLoaderDisabler sld(doc);
+
+  if (doc->IsHTML()) {
+    int32_t oldChildCount = GetChildCount();
+    aError = nsContentUtils::ParseFragmentHTML(aInnerHTML,
+                                               this,
+                                               Tag(),
+                                               GetNameSpaceID(),
+                                               doc->GetCompatibilityMode() ==
+                                                 eCompatibility_NavQuirks,
+                                               true);
+    mb.NodesAdded();
+    // HTML5 parser has notified, but not fired mutation events.
+    FireMutationEventsForDirectParsing(doc, this, oldChildCount);
+  } else {
+    nsCOMPtr<nsIDOMDocumentFragment> df;
+    aError = nsContentUtils::CreateContextualFragment(this, aInnerHTML,
+                                                      true,
+                                                      getter_AddRefs(df));
+    nsCOMPtr<nsINode> fragment = do_QueryInterface(df);
+    if (!aError.Failed()) {
+      // Suppress assertion about node removal mutation events that can't have
+      // listeners anyway, because no one has had the chance to register mutation
+      // listeners on the fragment that comes from the parser.
+      nsAutoScriptBlockerSuppressNodeRemoved scriptBlocker;
+
+      static_cast<nsINode*>(this)->AppendChild(*fragment, aError);
+      mb.NodesAdded();
+    }
+  }
+}
+
+void
+Element::GetOuterHTML(nsAString& aOuterHTML, ErrorResult& aError)
+{
+  aError = GetMarkup(true, aOuterHTML);
+}
+
+void
+Element::SetOuterHTML(const nsAString& aOuterHTML, ErrorResult& aError)
+{
+  nsCOMPtr<nsINode> parent = GetParentNode();
+  if (!parent) {
+    return;
+  }
+
+  if (parent->NodeType() == nsIDOMNode::DOCUMENT_NODE) {
+    aError.Throw(NS_ERROR_DOM_NO_MODIFICATION_ALLOWED_ERR);
+    return;
+  }
+
+  if (OwnerDoc()->IsHTML()) {
+    nsIAtom* localName;
+    int32_t namespaceID;
+    if (parent->IsElement()) {
+      localName = static_cast<nsIContent*>(parent.get())->Tag();
+      namespaceID = static_cast<nsIContent*>(parent.get())->GetNameSpaceID();
+    } else {
+      NS_ASSERTION(parent->NodeType() == nsIDOMNode::DOCUMENT_FRAGMENT_NODE,
+        "How come the parent isn't a document, a fragment or an element?");
+      localName = nsGkAtoms::body;
+      namespaceID = kNameSpaceID_XHTML;
+    }
+    nsCOMPtr<nsIDOMDocumentFragment> df;
+    aError = NS_NewDocumentFragment(getter_AddRefs(df),
+                                    OwnerDoc()->NodeInfoManager());
+    if (aError.Failed()) {
+      return;
+    }
+    nsCOMPtr<nsIContent> fragment = do_QueryInterface(df);
+    nsContentUtils::ParseFragmentHTML(aOuterHTML,
+                                      fragment,
+                                      localName,
+                                      namespaceID,
+                                      OwnerDoc()->GetCompatibilityMode() ==
+                                        eCompatibility_NavQuirks,
+                                      true);
+    nsAutoMutationBatch mb(parent, true, false);
+    parent->ReplaceChild(*fragment, *this, aError);
+    return;
+  }
+
+  nsCOMPtr<nsINode> context;
+  if (parent->IsElement()) {
+    context = parent;
+  } else {
+    NS_ASSERTION(parent->NodeType() == nsIDOMNode::DOCUMENT_FRAGMENT_NODE,
+      "How come the parent isn't a document, a fragment or an element?");
+    nsCOMPtr<nsINodeInfo> info =
+      OwnerDoc()->NodeInfoManager()->GetNodeInfo(nsGkAtoms::body,
+                                                 nullptr,
+                                                 kNameSpaceID_XHTML,
+                                                 nsIDOMNode::ELEMENT_NODE);
+    context = NS_NewHTMLBodyElement(info.forget(), FROM_PARSER_FRAGMENT);
+  }
+
+  nsCOMPtr<nsIDOMDocumentFragment> df;
+  aError = nsContentUtils::CreateContextualFragment(context,
+                                                    aOuterHTML,
+                                                    true,
+                                                    getter_AddRefs(df));
+  if (aError.Failed()) {
+    return;
+  }
+  nsCOMPtr<nsINode> fragment = do_QueryInterface(df);
+  nsAutoMutationBatch mb(parent, true, false);
+  parent->ReplaceChild(*fragment, *this, aError);
+}
+
+enum nsAdjacentPosition {
+  eBeforeBegin,
+  eAfterBegin,
+  eBeforeEnd,
+  eAfterEnd
+};
+
+void
+Element::InsertAdjacentHTML(const nsAString& aPosition, const nsAString& aText,
+                            ErrorResult& aError)
+{
+  nsAdjacentPosition position;
+  if (aPosition.LowerCaseEqualsLiteral("beforebegin")) {
+    position = eBeforeBegin;
+  } else if (aPosition.LowerCaseEqualsLiteral("afterbegin")) {
+    position = eAfterBegin;
+  } else if (aPosition.LowerCaseEqualsLiteral("beforeend")) {
+    position = eBeforeEnd;
+  } else if (aPosition.LowerCaseEqualsLiteral("afterend")) {
+    position = eAfterEnd;
+  } else {
+    aError.Throw(NS_ERROR_DOM_SYNTAX_ERR);
+    return;
+  }
+
+  nsCOMPtr<nsIContent> destination;
+  if (position == eBeforeBegin || position == eAfterEnd) {
+    destination = GetParent();
+    if (!destination) {
+      aError.Throw(NS_ERROR_DOM_NO_MODIFICATION_ALLOWED_ERR);
+      return;
+    }
+  } else {
+    destination = this;
+  }
+
+  nsIDocument* doc = OwnerDoc();
+
+  // Needed when insertAdjacentHTML is used in combination with contenteditable
+  mozAutoDocUpdate updateBatch(doc, UPDATE_CONTENT_MODEL, true);
+  nsAutoScriptLoaderDisabler sld(doc);
+  
+  // Batch possible DOMSubtreeModified events.
+  mozAutoSubtreeModified subtree(doc, nullptr);
+
+  // Parse directly into destination if possible
+  if (doc->IsHTML() && !OwnerDoc()->MayHaveDOMMutationObservers() &&
+      (position == eBeforeEnd ||
+       (position == eAfterEnd && !GetNextSibling()) ||
+       (position == eAfterBegin && !GetFirstChild()))) {
+    int32_t oldChildCount = destination->GetChildCount();
+    int32_t contextNs = destination->GetNameSpaceID();
+    nsIAtom* contextLocal = destination->Tag();
+    if (contextLocal == nsGkAtoms::html && contextNs == kNameSpaceID_XHTML) {
+      // For compat with IE6 through IE9. Willful violation of HTML5 as of
+      // 2011-04-06. CreateContextualFragment does the same already.
+      // Spec bug: http://www.w3.org/Bugs/Public/show_bug.cgi?id=12434
+      contextLocal = nsGkAtoms::body;
+    }
+    aError = nsContentUtils::ParseFragmentHTML(aText,
+                                               destination,
+                                               contextLocal,
+                                               contextNs,
+                                               doc->GetCompatibilityMode() ==
+                                                 eCompatibility_NavQuirks,
+                                               true);
+    // HTML5 parser has notified, but not fired mutation events.
+    FireMutationEventsForDirectParsing(doc, destination, oldChildCount);
+    return;
+  }
+
+  // couldn't parse directly
+  nsCOMPtr<nsIDOMDocumentFragment> df;
+  aError = nsContentUtils::CreateContextualFragment(destination,
+                                                    aText,
+                                                    true,
+                                                    getter_AddRefs(df));
+  if (aError.Failed()) {
+    return;
+  }
+
+  nsCOMPtr<nsINode> fragment = do_QueryInterface(df);
+
+  // Suppress assertion about node removal mutation events that can't have
+  // listeners anyway, because no one has had the chance to register mutation
+  // listeners on the fragment that comes from the parser.
+  nsAutoScriptBlockerSuppressNodeRemoved scriptBlocker;
+
+  nsAutoMutationBatch mb(destination, true, false);
+  switch (position) {
+    case eBeforeBegin:
+      destination->InsertBefore(*fragment, this, aError);
+      break;
+    case eAfterBegin:
+      static_cast<nsINode*>(this)->InsertBefore(*fragment, GetFirstChild(),
+                                                aError);
+      break;
+    case eBeforeEnd:
+      static_cast<nsINode*>(this)->AppendChild(*fragment, aError);
+      break;
+    case eAfterEnd:
+      destination->InsertBefore(*fragment, GetNextSibling(), aError);
+      break;
+  }
+}
+
+nsIEditor*
+Element::GetEditorInternal()
+{
+  nsCOMPtr<nsITextControlElement> textCtrl = do_QueryInterface(this);
+  return textCtrl ? textCtrl->GetTextEditor() : nullptr;
+}

content/base/src/Makefile.in

@@ -186,6 +186,7 @@ LOCAL_INCLUDES += \
   -I$(topsrcdir)/caps/include \
   -I$(topsrcdir)/content/events/src \
   -I$(topsrcdir)/content/html/content/src \
+  -I$(topsrcdir)/content/html/document/src \
   -I$(topsrcdir)/content/xbl/src \
   -I$(topsrcdir)/content/xml/content/src \
   -I$(topsrcdir)/content/xml/document/src \

content/base/src/nsContentUtils.cpp

@@ -1506,7 +1506,7 @@ nsContentUtils::Shutdown()
  */
 // static
 nsresult
-nsContentUtils::CheckSameOrigin(nsINode *aTrustedNode,
+nsContentUtils::CheckSameOrigin(const nsINode *aTrustedNode,
                                 nsIDOMNode *aUnTrustedNode)
 {
   MOZ_ASSERT(aTrustedNode);
@@ -1518,8 +1518,8 @@ nsContentUtils::CheckSameOrigin(nsINode *aTrustedNode,
 }
 
 nsresult
-nsContentUtils::CheckSameOrigin(nsINode* aTrustedNode,
-                                nsINode* unTrustedNode)
+nsContentUtils::CheckSameOrigin(const nsINode* aTrustedNode,
+                                const nsINode* unTrustedNode)
 {
   MOZ_ASSERT(aTrustedNode);
   MOZ_ASSERT(unTrustedNode);

content/base/src/nsDocument.h

@@ -63,7 +63,7 @@
 #include "nsISecurityEventSink.h"
 #include "nsIChannelEventSink.h"
 #include "imgIRequest.h"
-#include "nsIDOMDOMImplementation.h"
+#include "mozilla/dom/DOMImplementation.h"
 #include "nsIDOMTouchEvent.h"
 #include "nsIInlineEventHandlers.h"
 #include "nsDataHashtable.h"
@@ -477,6 +477,7 @@ class nsDocument : public nsIDocument,
 {
 public:
   typedef mozilla::dom::Element Element;
+  using nsIDocument::GetElementsByTagName;
 
   NS_DECL_CYCLE_COLLECTING_ISUPPORTS
 
@@ -624,7 +625,7 @@ public:
 
   virtual void SetScriptHandlingObject(nsIScriptGlobalObject* aScriptObject);
 
-  virtual nsIScriptGlobalObject* GetScopeObject();
+  virtual nsIScriptGlobalObject* GetScopeObject() const;
 
   /**
    * Get the script loader for this document
@@ -660,7 +661,6 @@ public:
   virtual void EndLoad();
 
   virtual void SetReadyStateInternal(ReadyState rs);
-  virtual ReadyState GetReadyStateEnum();
 
   virtual void ContentStateChanged(nsIContent* aContent,
                                    nsEventStates aStateMask);
@@ -775,12 +775,6 @@ public:
                               int32_t aNamespaceID,
                               nsIContent **aResult);
 
-  nsresult CreateElement(const nsAString& aTagName,
-                         nsIContent** aReturn);
-  nsresult CreateElementNS(const nsAString& aNamespaceURI,
-                           const nsAString& aQualifiedName,
-                           nsIContent** aReturn);
-
   nsresult CreateTextNode(const nsAString& aData, nsIContent** aReturn);
 
   virtual NS_HIDDEN_(nsresult) Sanitize();
@@ -806,15 +800,14 @@ public:
                                                    nsIDOMNodeList** aResult);
   virtual NS_HIDDEN_(nsresult) GetContentListFor(nsIContent* aContent,
                                                  nsIDOMNodeList** aResult);
-  virtual NS_HIDDEN_(nsIContent*)
+  virtual NS_HIDDEN_(Element*)
     GetAnonymousElementByAttribute(nsIContent* aElement,
                                    nsIAtom* aAttrName,
                                    const nsAString& aAttrValue) const;
 
-  virtual NS_HIDDEN_(nsresult) ElementFromPointHelper(float aX, float aY,
+  virtual NS_HIDDEN_(Element*) ElementFromPointHelper(float aX, float aY,
                                                       bool aIgnoreRootScrollFrame,
-                                                      bool aFlushLayout,
-                                                      nsIDOMElement** aReturn);
+                                                      bool aFlushLayout);
 
   virtual NS_HIDDEN_(nsresult) NodesFromRectHelper(float aX, float aY,
                                                    float aTopSize, float aRightSize,
@@ -899,18 +892,12 @@ public:
   virtual void ResetScrolledToRefAlready();
   virtual void SetChangeScrollPosWhenScrollingToRef(bool aValue);
 
-  already_AddRefed<nsContentList>
-  GetElementsByTagName(const nsAString& aTagName) {
-    return NS_GetContentList(this, kNameSpaceID_Unknown, aTagName);
-  }
-  already_AddRefed<nsContentList>
-    GetElementsByTagNameNS(const nsAString& aNamespaceURI,
-                           const nsAString& aLocalName);
-
   virtual Element *GetElementById(const nsAString& aElementId);
   virtual const nsSmallVoidArray* GetAllElementsForId(const nsAString& aElementId) const;
 
   virtual Element *LookupImageElement(const nsAString& aElementId);
+  virtual void MozSetImageElement(const nsAString& aImageElementId,
+                                  Element* aElement);
 
   virtual NS_HIDDEN_(nsresult) AddImage(imgIRequest* aImage);
   virtual NS_HIDDEN_(nsresult) RemoveImage(imgIRequest* aImage, uint32_t aFlags);
@@ -990,6 +977,10 @@ public:
   // Returns the top element from the full-screen stack.
   Element* FullScreenStackTop();
 
+  // DOM-exposed fullscreen API
+  virtual bool MozFullScreenEnabled();
+  virtual Element* GetMozFullScreenElement(mozilla::ErrorResult& rv);
+
   void RequestPointerLock(Element* aElement);
   bool ShouldLockPointer(Element* aElement);
   bool SetPointerLock(Element* aElement, int aCursorStyle);
@@ -1005,6 +996,16 @@ public:
   // DocSizeOfIncludingThis is inherited from nsIDocument.
 
   virtual nsIDOMNode* AsDOMNode() { return this; }
+
+  // WebIDL bits
+  virtual mozilla::dom::DOMImplementation*
+    GetImplementation(mozilla::ErrorResult& rv);
+  virtual nsIDOMStyleSheetList* StyleSheets();
+  virtual void SetSelectedStyleSheetSet(const nsAString& aSheetSet);
+  virtual void GetLastStyleSheetSet(nsString& aSheetSet);
+  virtual nsIDOMDOMStringList* StyleSheetSets();
+  virtual void EnableStyleSheetsForSet(const nsAString& aSheetSet);
+
 protected:
   friend class nsNodeUtils;
 
@@ -1052,12 +1053,6 @@ protected:
   nsIContent* GetFirstBaseNodeWithHref();
   nsresult SetFirstBaseNodeWithHref(nsIContent *node);
 
-  inline void
-  SetDocumentDirectionality(mozilla::Directionality aDir)
-  {
-    mDirectionality = aDir;
-  }
-
   // Get the first <title> element with the given IsNodeOfType type, or
   // return null if there isn't one
   nsIContent* GetTitleContent(uint32_t aNodeType);
@@ -1065,7 +1060,13 @@ protected:
   // append the concatenation of its text node children to aTitle. Do
   // nothing if there is no such element.
   void GetTitleFromElement(uint32_t aNodeType, nsAString& aTitle);
+public:
+  // Get our title
+  virtual void GetTitle(nsString& aTitle);
+  // Set our title
+  virtual void SetTitle(const nsAString& aTitle, mozilla::ErrorResult& rv);
 
+protected:
   nsresult doCreateShell(nsPresContext* aContext,
                          nsIViewManager* aViewManager, nsStyleSet* aStyleSet,
                          nsCompatibility aCompatMode,
@@ -1101,9 +1102,6 @@ protected:
 
   void EnsureOnloadBlocker();
 
-  nsCString mReferrer;
-  nsString mLastModified;
-
   nsTArray<nsIObserver*> mCharSetObservers;
 
   PLDHashTable *mSubDocuments;
@@ -1196,10 +1194,6 @@ protected:
 
   bool mSynchronousDOMContentLoaded:1;
 
-  // If true, we have an input encoding.  If this is false, then the
-  // document was created entirely in memory
-  bool mHaveInputEncoding:1;
-
   bool mInXBLUpdate:1;
 
   // Whether we're currently holding a lock on all of our images.
@@ -1258,12 +1252,6 @@ protected:
   nsRefPtr<nsDOMNavigationTiming> mTiming;
 private:
   friend class nsUnblockOnloadEvent;
-  // This needs to stay in sync with the list in GetVisibilityState.
-  enum VisibilityState {
-    eHidden = 0,
-    eVisible,
-    eVisibilityStateCount
-  };
   // Recomputes the visibility state but doesn't set the new value.
   VisibilityState GetVisibilityState() const;
 
@@ -1322,7 +1310,6 @@ private:
   // Onload blockers which haven't been activated yet
   uint32_t mAsyncOnloadBlockCount;
   nsCOMPtr<nsIRequest> mOnloadBlocker;
-  ReadyState mReadyState;
 
   // A hashtable of styled links keyed by address pointer.
   nsTHashtable<nsPtrHashKey<mozilla::dom::Link> > mStyledLinks;
@@ -1348,7 +1335,7 @@ private:
   // All images in process of being preloaded
   nsCOMArray<imgIRequest> mPreloadingImages;
 
-  nsCOMPtr<nsIDOMDOMImplementation> mDOMImplementation;
+  nsRefPtr<mozilla::dom::DOMImplementation> mDOMImplementation;
 
   nsRefPtr<nsContentList> mImageMaps;
 
@@ -1362,8 +1349,6 @@ private:
   // Tracking for plugins in the document.
   nsTHashtable< nsPtrHashKey<nsIObjectLoadingContent> > mPlugins;
 
-  VisibilityState mVisibilityState;
-
 #ifdef DEBUG
 protected:
   bool mWillReparent;

content/base/src/nsFrameLoader.cpp

@@ -642,14 +642,16 @@ SetTreeOwnerAndChromeEventHandlerOnDocshellTree(nsIDocShellTreeItem* aItem,
   NS_PRECONDITION(aItem, "Must have item");
 
   aItem->SetTreeOwner(aOwner);
-  nsCOMPtr<nsIDocShell> shell(do_QueryInterface(aItem));
-  shell->SetChromeEventHandler(aHandler);
 
   int32_t childCount = 0;
   aItem->GetChildCount(&childCount);
   for (int32_t i = 0; i < childCount; ++i) {
     nsCOMPtr<nsIDocShellTreeItem> item;
     aItem->GetChildAt(i, getter_AddRefs(item));
+    if (aHandler) {
+      nsCOMPtr<nsIDocShell> shell(do_QueryInterface(item));
+      shell->SetChromeEventHandler(aHandler);
+    }
     SetTreeOwnerAndChromeEventHandlerOnDocshellTree(item, aOwner, aHandler);
   }
 }
@@ -1056,7 +1058,8 @@ nsFrameLoader::SwapWithOtherLoader(nsFrameLoader* aOther,
   }
 
   // Also make sure that the two docshells are the same type. Otherwise
-  // swapping is certainly not safe.
+  // swapping is certainly not safe. If this needs to be changed then
+  // the code below needs to be audited as it assumes identical types.
   int32_t ourType = nsIDocShellTreeItem::typeChrome;
   int32_t otherType = nsIDocShellTreeItem::typeChrome;
   ourTreeItem->GetItemType(&ourType);
@@ -1205,11 +1208,15 @@ nsFrameLoader::SwapWithOtherLoader(nsFrameLoader* aOther,
   ourParentItem->AddChild(otherTreeItem);
   otherParentItem->AddChild(ourTreeItem);
 
+  // Restore the correct chrome event handlers.
+  ourDocshell->SetChromeEventHandler(otherChromeEventHandler);
+  otherDocshell->SetChromeEventHandler(ourChromeEventHandler);
   // Restore the correct treeowners
+  // (and also chrome event handlers for content frames only).
   SetTreeOwnerAndChromeEventHandlerOnDocshellTree(ourTreeItem, otherOwner,
-                                                  otherChromeEventHandler);
+    ourType == nsIDocShellTreeItem::typeContent ? otherChromeEventHandler : nullptr);
   SetTreeOwnerAndChromeEventHandlerOnDocshellTree(otherTreeItem, ourOwner,
-                                                  ourChromeEventHandler);
+    ourType == nsIDocShellTreeItem::typeContent ? ourChromeEventHandler : nullptr);
 
   // Switch the owner content before we start calling AddTreeItemToTreeOwner.
   // Note that we rely on this to deal with setting mObservingOwnerContent to

content/base/src/nsFrameMessageManager.cpp

@@ -231,7 +231,7 @@ GetParamsForMessage(JSContext* aCx,
   NS_ENSURE_TRUE(!json.IsEmpty(), false);
 
   jsval val = JSVAL_NULL;
-  NS_ENSURE_TRUE(JS_ParseJSON(aCx, static_cast<const jschar*>(PromiseFlatString(json).get()),
+  NS_ENSURE_TRUE(JS_ParseJSON(aCx, static_cast<const jschar*>(json.get()),
                               json.Length(), &val), false);
 
   return WriteStructuredClone(aCx, val, aBuffer, aClosure);
@@ -535,7 +535,7 @@ nsFrameMessageManager::ReceiveMessage(nsISupports* aTarget,
         }
         JSString* jsMessage =
           JS_NewUCStringCopyN(ctx,
-                              static_cast<const jschar*>(PromiseFlatString(aMessage).get()),
+                              static_cast<const jschar*>(aMessage.BeginReading()),
                               aMessage.Length());
         NS_ENSURE_TRUE(jsMessage, NS_ERROR_OUT_OF_MEMORY);
         JS_DefineProperty(ctx, param, "target", targetv, NULL, NULL, JSPROP_ENUMERATE);

content/base/src/nsINode.cpp

@@ -103,6 +103,7 @@
 #include "nsHTMLLegendElement.h"
 #include "nsWrapperCacheInlines.h"
 #include "WrapperFactory.h"
+#include "nsDOMDocumentType.h"
 
 using namespace mozilla;
 using namespace mozilla::dom;
@@ -222,9 +223,8 @@ nsINode::GetTextEditorRootContent(nsIEditor** aEditor)
         !node->AsElement()->IsHTML())
       continue;
 
-    nsCOMPtr<nsIEditor> editor;
-    static_cast<nsGenericHTMLElement*>(node)->
-        GetEditorInternal(getter_AddRefs(editor));
+    nsCOMPtr<nsIEditor> editor =
+      static_cast<nsGenericHTMLElement*>(node)->GetEditorInternal();
     if (!editor)
       continue;
 
@@ -1443,7 +1443,7 @@ bool IsAllowedAsChild(nsIContent* aNewChild, nsINode* aParent,
         return true;
       }
 
-      nsIContent* docTypeContent = parentDocument->GetDocumentType();
+      nsIContent* docTypeContent = parentDocument->GetDoctype();
       if (!docTypeContent) {
         // It's all good.
         return true;
@@ -1466,7 +1466,7 @@ bool IsAllowedAsChild(nsIContent* aNewChild, nsINode* aParent,
       }
 
       nsIDocument* parentDocument = static_cast<nsIDocument*>(aParent);
-      nsIContent* docTypeContent = parentDocument->GetDocumentType();
+      nsIContent* docTypeContent = parentDocument->GetDoctype();
       if (docTypeContent) {
         // Already have a doctype, so this is only OK if we're replacing it
         return aIsReplace && docTypeContent == aRefChild;

content/base/src/nsRange.h

@@ -243,4 +243,16 @@ protected:
 #endif
 };
 
+inline nsISupports*
+ToCanonicalSupports(nsRange* aRange)
+{
+  return static_cast<nsIDOMRange*>(aRange);
+}
+
+inline nsISupports*
+ToSupports(nsRange* aRange)
+{
+  return static_cast<nsIDOMRange*>(aRange);
+}
+
 #endif /* nsRange_h___ */

content/base/src/nsStyledElement.cpp

@@ -19,7 +19,6 @@
 #include "mozilla/css/Loader.h"
 #include "nsIDOMMutationEvent.h"
 #include "nsXULElement.h"
-#include "nsIDOMSVGStylable.h"
 #include "nsContentUtils.h"
 
 namespace css = mozilla::css;

content/base/src/nsXMLHttpRequest.h

@@ -372,10 +372,9 @@ public:
     NS_ASSERTION(aBlob, "Null should go to string version");
     aRv = Send(RequestBody(aBlob));
   }
-  void Send(nsIDocument* aDoc, ErrorResult& aRv)
+  void Send(nsIDocument& aDoc, ErrorResult& aRv)
   {
-    NS_ASSERTION(aDoc, "Null should go to string version");
-    aRv = Send(RequestBody(aDoc));
+    aRv = Send(RequestBody(&aDoc));
   }
   void Send(const nsAString& aString, ErrorResult& aRv)
   {

content/base/test/Makefile.in

@@ -268,6 +268,8 @@ MOCHITEST_FILES_A = \
 		test_bug282547.html \
 		bug282547.sjs \
 		test_domparser_null_char.html \
+		test_bug811701.html \
+		test_bug811701.xhtml \
 		$(NULL)
 
 MOCHITEST_FILES_B = \

content/base/test/chrome/Makefile.in

@@ -50,6 +50,9 @@ MOCHITEST_CHROME_FILES = \
     test_bug800386.xul \
     test_csp_bug773891.html \
     test_domparsing.xul \
+    test_bug814638.xul \
+    host_bug814638.xul \
+    frame_bug814638.xul \
     $(NULL)
 
 include $(topsrcdir)/config/rules.mk

content/base/test/chrome/frame_bug814638.xul

@@ -0,0 +1,15 @@
+<?xml version="1.0"?>
+<?xml-stylesheet type="text/css" href="chrome://global/skin"?>
+<!--
+https://bugzilla.mozilla.org/show_bug.cgi?id=814638
+-->
+<window title="Mozilla Bug 814638"
+        xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul">
+
+  <keyset>
+    <key key="T" modifiers="control" oncommand="receivedKeyEvent()"/>
+  </keyset>
+
+  <iframe flex="1" src="about:"/>
+
+</window>

content/base/test/chrome/host_bug814638.xul

@@ -0,0 +1,9 @@
+<?xml version="1.0"?>
+<?xml-stylesheet type="text/css" href="chrome://global/skin"?>
+<!--
+https://bugzilla.mozilla.org/show_bug.cgi?id=814638
+-->
+<window title="Mozilla Bug 814638"
+        xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul">
+  <iframe flex="1" src="frame_bug814638.xul"/>
+</window>

content/base/test/chrome/test_bug814638.xul

@@ -0,0 +1,64 @@
+<?xml version="1.0"?>
+<?xml-stylesheet type="text/css" href="chrome://global/skin"?>
+<?xml-stylesheet type="text/css" href="chrome://mochikit/content/tests/SimpleTest/test.css"?>
+<!--
+https://bugzilla.mozilla.org/show_bug.cgi?id=814638
+-->
+<window title="Mozilla Bug 814638"
+        xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul">
+  <script type="application/javascript" src="chrome://mochikit/content/tests/SimpleTest/SimpleTest.js"/>
+
+  <!-- test results are displayed in the html:body -->
+  <body xmlns="http://www.w3.org/1999/xhtml">
+  <a href="https://bugzilla.mozilla.org/show_bug.cgi?id=814638"
+     target="_blank" id="link">Mozilla Bug 814638</a>
+  </body>
+
+  <!-- test code goes here -->
+  <script type="application/javascript">
+  <![CDATA[
+  /** Test for Bug 814638 **/
+
+  SimpleTest.waitForExplicitFinish();
+
+  function startTest() {
+    let hostURL = "chrome://mochitests/content/chrome/content/base/test/chrome/host_bug814638.xul";
+    let host1 = window.open(hostURL, "_blank", "chrome");
+    let host2 = window.open(hostURL, "_blank", "chrome");
+
+    let isHost1Loaded = isHost2Loaded = false
+    host1.onload = function() {
+      isHost1Loaded = true;
+      if (isHost2Loaded) swapFrames();
+    }
+    host2.onload = function() {
+      isHost2Loaded = true;
+      if (isHost1Loaded) swapFrames();
+    }
+
+    function swapFrames() {
+      let iframe1 = host1.document.querySelector("iframe");
+      let iframe2 = host2.document.querySelector("iframe");
+      iframe2.QueryInterface(Components.interfaces.nsIFrameLoaderOwner);
+      iframe2.swapFrameLoaders(iframe1);
+      setTimeout(function() {
+        iframe2.contentWindow.receivedKeyEvent = receivedKeyEvent;
+        let innerIframe2 = iframe2.contentDocument.querySelector("iframe");
+        let e = innerIframe2.contentDocument.createEvent("KeyboardEvent");
+        e.initKeyEvent("keypress", true, true, null, true, false, false, false, 0, "t".charCodeAt(0));
+        innerIframe2.contentDocument.documentElement.dispatchEvent(e);
+        host1.close();
+        host2.close();
+      }, 0);
+    }
+  }
+
+  function receivedKeyEvent() {
+    ok(true, "Received key event");
+    SimpleTest.finish();
+  }
+
+  addLoadEvent(startTest);
+  ]]>
+  </script>
+</window>

content/base/test/test_bug811701.html

@@ -0,0 +1,48 @@
+<!DOCTYPE HTML>
+<html>
+<!--
+https://bugzilla.mozilla.org/show_bug.cgi?id=811701
+-->
+<head>
+  <meta charset="utf-8">
+  <title>Test for Bug 811701</title>
+  <script type="application/javascript" src="/tests/SimpleTest/SimpleTest.js"></script>
+  <link rel="stylesheet" type="text/css" href="/tests/SimpleTest/test.css"/>
+</head>
+<body>
+<a target="_blank" href="https://bugzilla.mozilla.org/show_bug.cgi?id=811701">Mozilla Bug 811701</a>
+<p id="display"></p>
+<div id="content" style="display: none">
+<math><mtext>test</mtext></math>
+<svg><polygon points="0,0 100,100 200,300"/></svg>
+</div>
+<pre id="test">
+</pre>
+  <script type="application/javascript">
+
+  /** Test for Bug 811701 **/
+  var math = document.querySelector("math");
+  is(math.innerHTML, "<mtext>test</mtext>", "<math> should have innerHTML");
+  is(math.outerHTML, "<math><mtext>test</mtext></math>",
+     "<math> should have innerHTML");
+  math.innerHTML = "<mo>+</mo>";
+  is(math.firstChild.namespaceURI, "http://www.w3.org/1999/xhtml",
+     "Should have the right namespace after setting innerHTML on <math>");
+
+  var polygon = document.querySelector("polygon");
+  is(polygon.parentNode.innerHTML,
+     '<polygon points="0,0 100,100 200,300"></polygon>',
+     "<svg> should have innerHTML");
+  is(polygon.parentNode.outerHTML,
+     '<svg><polygon points="0,0 100,100 200,300"></polygon></svg>',
+     "<svg> should have outerHTML");
+  is(polygon.outerHTML, '<polygon points="0,0 100,100 200,300"></polygon>',
+     "<polygon> should have outerHTML");
+
+  var svg = document.querySelector("svg");
+  svg.innerHTML = "<rect/>";
+  is(svg.firstChild.namespaceURI, "http://www.w3.org/1999/xhtml",
+     "Should have the right namespace after setting innerHTML on <math>");
+  </script>
+</body>
+</html>

content/base/test/test_bug811701.xhtml

@@ -0,0 +1,52 @@
+<html xmlns="http://www.w3.org/1999/xhtml">
+<!--
+https://bugzilla.mozilla.org/show_bug.cgi?id=811701
+-->
+<head>
+  <title>Test for Bug 811701</title>
+  <script type="application/javascript" src="/tests/SimpleTest/SimpleTest.js"></script>
+  <link rel="stylesheet" type="text/css" href="/tests/SimpleTest/test.css"/>
+</head>
+<body>
+<a target="_blank" href="https://bugzilla.mozilla.org/show_bug.cgi?id=811701">Mozilla Bug 811701</a>
+<p id="display"></p>
+<div id="content" style="display: none">
+<math xmlns="http://www.w3.org/1998/Math/MathML"><mtext>test</mtext></math>
+<svg xmlns="http://www.w3.org/2000/svg"><polygon points="0,0 100,100 200,300"/></svg>
+</div>
+<pre id="test">
+</pre>
+  <script type="application/javascript">
+  <![CDATA[
+
+
+  /** Test for Bug 811701 **/
+  var math = document.querySelector("math");
+  is(math.innerHTML,
+     '<mtext xmlns="http://www.w3.org/1998/Math/MathML">test</mtext>',
+     "<math> should have innerHTML");
+  is(math.outerHTML,
+     '<math xmlns="http://www.w3.org/1998/Math/MathML"><mtext>test</mtext></math>',
+     "<math> should have innerHTML");
+  math.innerHTML = "<mo>+</mo>";
+  is(math.firstChild.namespaceURI, "http://www.w3.org/1998/Math/MathML",
+     "Should have the right namespace after setting innerHTML on <math>");
+
+  var polygon = document.querySelector("polygon");
+  is(polygon.parentNode.innerHTML,
+     '<polygon xmlns="http://www.w3.org/2000/svg" points="0,0 100,100 200,300"/>',
+     "<svg> should have innerHTML");
+  is(polygon.parentNode.outerHTML,
+     '<svg xmlns="http://www.w3.org/2000/svg"><polygon points="0,0 100,100 200,300"/></svg>',
+     "<svg> should have outerHTML");
+  is(polygon.outerHTML, '<polygon xmlns="http://www.w3.org/2000/svg" points="0,0 100,100 200,300"/>',
+     "<polygon> should have outerHTML");
+
+  var svg = document.querySelector("svg");
+  svg.innerHTML = "<rect/>";
+  is(svg.firstChild.namespaceURI, "http://www.w3.org/2000/svg",
+     "Should have the right namespace after setting innerHTML on <math>");
+  ]]>
+</script>
+</body>
+</html>

content/canvas/src/WebGLContextGL.cpp

@@ -4169,15 +4169,13 @@ WebGLContext::CompileShader(WebGLShader *shader)
         // cleanSource nsAString instance will be destroyed before the reference is
         // actually used.
         StripComments stripComments(shader->Source());
-        const nsAString& cleanSource = nsString(stripComments.result().Elements(), stripComments.length());
+        const nsAString& cleanSource = Substring(stripComments.result().Elements(), stripComments.length());
         if (!ValidateGLSLString(cleanSource, "compileShader"))
             return;
 
-        const nsPromiseFlatString& flatSource = PromiseFlatString(cleanSource);
-
         // shaderSource() already checks that the source stripped of comments is in the
         // 7-bit ASCII range, so we can skip the NS_IsAscii() check.
-        const nsCString& sourceCString = NS_LossyConvertUTF16toASCII(flatSource);
+        NS_LossyConvertUTF16toASCII sourceCString(cleanSource);
 
         if (gl->WorkAroundDriverBugs()) {
             const uint32_t maxSourceLength = 0x3ffff;
@@ -4298,8 +4296,7 @@ WebGLContext::CompileShader(WebGLShader *shader)
             translatedSrc.SetLength(len);
             ShGetObjectCode(compiler, translatedSrc.BeginWriting());
 
-            nsPromiseFlatCString translatedSrc2(translatedSrc);
-            const char *ts = translatedSrc2.get();
+            const char *ts = translatedSrc.get();
 
             gl->fShaderSource(shadername, 1, &ts, NULL);
         } else { // not useShaderSourceTranslation
@@ -4613,7 +4610,7 @@ WebGLContext::ShaderSource(WebGLShader *shader, const nsAString& source)
     // cleanSource nsAString instance will be destroyed before the reference is
     // actually used.
     StripComments stripComments(source);
-    const nsAString& cleanSource = nsString(stripComments.result().Elements(), stripComments.length());
+    const nsAString& cleanSource = Substring(stripComments.result().Elements(), stripComments.length());
     if (!ValidateGLSLString(cleanSource, "compileShader"))
         return;
 

content/events/src/nsContentEventHandler.cpp

@@ -26,6 +26,9 @@
 #include "nsLayoutUtils.h"
 #include "nsIMEStateManager.h"
 #include "nsIObjectFrame.h"
+#include "mozilla/dom/Element.h"
+
+using namespace mozilla::dom;
 
 /******************************************************************/
 /* nsContentEventHandler                                          */
@@ -870,10 +873,8 @@ nsContentEventHandler::OnQueryDOMWidgetHittest(nsQueryContentEvent* aEvent)
   eventLoc.x -= docFrameRect.x;
   eventLoc.y -= docFrameRect.y;
 
-  nsCOMPtr<nsIDOMElement> elementUnderMouse;
-  doc->ElementFromPointHelper(eventLoc.x, eventLoc.y, false, false,
-                              getter_AddRefs(elementUnderMouse));
-  nsCOMPtr<nsIContent> contentUnderMouse = do_QueryInterface(elementUnderMouse);
+  Element* contentUnderMouse =
+    doc->ElementFromPointHelper(eventLoc.x, eventLoc.y, false, false);
   if (contentUnderMouse) {
     nsIWidget* targetWidget = nullptr;
     nsIFrame* targetFrame = contentUnderMouse->GetPrimaryFrame();

content/events/src/nsEventStateManager.cpp

@@ -92,7 +92,7 @@
 #include "nsICommandParams.h"
 #include "mozilla/Services.h"
 #include "mozAutoDocUpdate.h"
-#include "nsHTMLLabelElement.h"
+#include "mozilla/dom/HTMLLabelElement.h"
 
 #include "mozilla/Preferences.h"
 #include "mozilla/LookAndFeel.h"
@@ -4613,7 +4613,8 @@ nsEventStateManager::GetEventTargetContent(nsEvent* aEvent)
 static Element*
 GetLabelTarget(nsIContent* aPossibleLabel)
 {
-  nsHTMLLabelElement* label = nsHTMLLabelElement::FromContent(aPossibleLabel);
+  mozilla::dom::HTMLLabelElement* label =
+    mozilla::dom::HTMLLabelElement::FromContent(aPossibleLabel);
   if (!label)
     return nullptr;
 

content/html/content/src/HTMLBodyElement.cpp

@@ -5,10 +5,8 @@
 
 #include "mozilla/Util.h"
 
-#include "nscore.h"
-#include "nsCOMPtr.h"
-#include "nsIDOMHTMLBodyElement.h"
-#include "nsGenericHTMLElement.h"
+#include "HTMLBodyElement.h"
+#include "mozilla/dom/HTMLBodyElementBinding.h"
 #include "nsAttrValueInlines.h"
 #include "nsGkAtoms.h"
 #include "nsStyleConsts.h"
@@ -16,98 +14,24 @@
 #include "nsIPresShell.h"
 #include "nsIDocument.h"
 #include "nsHTMLStyleSheet.h"
+#include "nsIEditor.h"
 #include "nsIMarkupDocumentViewer.h"
 #include "nsMappedAttributes.h"
 #include "nsRuleData.h"
 #include "nsIDocShell.h"
 #include "nsIEditorDocShell.h"
 #include "nsRuleWalker.h"
-#include "jspubtd.h"
-#include "mozilla/dom/EventHandlerBinding.h"
+#include "nsGlobalWindow.h"
+
+NS_IMPL_NS_NEW_HTML_ELEMENT(Body)
+DOMCI_NODE_DATA(HTMLBodyElement, mozilla::dom::HTMLBodyElement)
+
+namespace mozilla {
+namespace dom {
 
 //----------------------------------------------------------------------
 
-using namespace mozilla;
-using namespace mozilla::dom;
-
-class nsHTMLBodyElement;
-
-class BodyRule: public nsIStyleRule {
-public:
-  BodyRule(nsHTMLBodyElement* aPart);
-  virtual ~BodyRule();
-
-  NS_DECL_ISUPPORTS
-
-  // nsIStyleRule interface
-  virtual void MapRuleInfoInto(nsRuleData* aRuleData);
-#ifdef DEBUG
-  virtual void List(FILE* out = stdout, int32_t aIndent = 0) const;
-#endif
-
-  nsHTMLBodyElement*  mPart;  // not ref-counted, cleared by content 
-};
-
-//----------------------------------------------------------------------
-
-class nsHTMLBodyElement : public nsGenericHTMLElement,
-                          public nsIDOMHTMLBodyElement
-{
-public:
-  using Element::GetText;
-  using Element::SetText;
-
-  nsHTMLBodyElement(already_AddRefed<nsINodeInfo> aNodeInfo);
-  virtual ~nsHTMLBodyElement();
-
-  // nsISupports
-  NS_DECL_ISUPPORTS_INHERITED
-
-  // nsIDOMNode
-  NS_FORWARD_NSIDOMNODE_TO_NSINODE
-
-  // nsIDOMElement
-  NS_FORWARD_NSIDOMELEMENT_TO_GENERIC
-
-  // nsIDOMHTMLElement
-  NS_FORWARD_NSIDOMHTMLELEMENT_TO_GENERIC
-
-  // nsIDOMHTMLBodyElement
-  NS_DECL_NSIDOMHTMLBODYELEMENT
-
-  // Event listener stuff; we need to declare only the ones we need to
-  // forward to window that don't come from nsIDOMHTMLBodyElement.
-#define EVENT(name_, id_, type_, struct_) /* nothing; handled by the shim */
-#define FORWARDED_EVENT(name_, id_, type_, struct_)               \
-    NS_IMETHOD GetOn##name_(JSContext *cx, jsval *vp);            \
-    NS_IMETHOD SetOn##name_(JSContext *cx, const jsval &v);
-#include "nsEventNameList.h"
-#undef FORWARDED_EVENT
-#undef EVENT
-
-  virtual bool ParseAttribute(int32_t aNamespaceID,
-                              nsIAtom* aAttribute,
-                              const nsAString& aValue,
-                              nsAttrValue& aResult);
-  virtual void UnbindFromTree(bool aDeep = true,
-                              bool aNullParent = true);
-  virtual nsMapRuleToAttributesFunc GetAttributeMappingFunction() const;
-  NS_IMETHOD WalkContentStyleRules(nsRuleWalker* aRuleWalker);
-  NS_IMETHOD_(bool) IsAttributeMapped(const nsIAtom* aAttribute) const;
-  virtual already_AddRefed<nsIEditor> GetAssociatedEditor();
-  virtual nsresult Clone(nsINodeInfo *aNodeInfo, nsINode **aResult) const;
-  virtual nsXPCClassInfo* GetClassInfo();
-  virtual nsIDOMNode* AsDOMNode() { return this; }
-private:
-  nsresult GetColorHelper(nsIAtom* aAtom, nsAString& aColor);
-
-protected:
-  BodyRule* mContentStyleRule;
-};
-
-//----------------------------------------------------------------------
-
-BodyRule::BodyRule(nsHTMLBodyElement* aPart)
+BodyRule::BodyRule(HTMLBodyElement* aPart)
 {
   mPart = aPart;
 }
@@ -264,52 +188,138 @@ BodyRule::List(FILE* out, int32_t aIndent) const
 
 //----------------------------------------------------------------------
 
-
-NS_IMPL_NS_NEW_HTML_ELEMENT(Body)
-
-
-nsHTMLBodyElement::nsHTMLBodyElement(already_AddRefed<nsINodeInfo> aNodeInfo)
-  : nsGenericHTMLElement(aNodeInfo),
-    mContentStyleRule(nullptr)
-{
-}
-
-nsHTMLBodyElement::~nsHTMLBodyElement()
+HTMLBodyElement::~HTMLBodyElement()
 {
   if (mContentStyleRule) {
     mContentStyleRule->mPart = nullptr;
-    NS_RELEASE(mContentStyleRule);
   }
 }
 
+JSObject*
+HTMLBodyElement::WrapNode(JSContext *aCx, JSObject *aScope, bool *aTriedToWrap)
+{
+  return HTMLBodyElementBinding::Wrap(aCx, aScope, this, aTriedToWrap);
+}
 
-NS_IMPL_ADDREF_INHERITED(nsHTMLBodyElement, Element)
-NS_IMPL_RELEASE_INHERITED(nsHTMLBodyElement, Element)
+NS_IMPL_ADDREF_INHERITED(HTMLBodyElement, Element)
+NS_IMPL_RELEASE_INHERITED(HTMLBodyElement, Element)
 
-DOMCI_NODE_DATA(HTMLBodyElement, nsHTMLBodyElement)
-
-// QueryInterface implementation for nsHTMLBodyElement
-NS_INTERFACE_TABLE_HEAD(nsHTMLBodyElement)
-  NS_HTML_CONTENT_INTERFACE_TABLE1(nsHTMLBodyElement, nsIDOMHTMLBodyElement)
-  NS_HTML_CONTENT_INTERFACE_TABLE_TO_MAP_SEGUE(nsHTMLBodyElement,
+// QueryInterface implementation for HTMLBodyElement
+NS_INTERFACE_TABLE_HEAD(HTMLBodyElement)
+  NS_HTML_CONTENT_INTERFACE_TABLE1(HTMLBodyElement, nsIDOMHTMLBodyElement)
+  NS_HTML_CONTENT_INTERFACE_TABLE_TO_MAP_SEGUE(HTMLBodyElement,
                                                nsGenericHTMLElement)
 NS_HTML_CONTENT_INTERFACE_TABLE_TAIL_CLASSINFO(HTMLBodyElement)
 
-NS_IMPL_ELEMENT_CLONE(nsHTMLBodyElement)
+NS_IMPL_ELEMENT_CLONE(HTMLBodyElement)
 
+NS_IMETHODIMP 
+HTMLBodyElement::SetBackground(const nsAString& aBackground)
+{
+  ErrorResult rv;
+  SetBackground(aBackground, rv);
+  return rv.ErrorCode();
+}
 
-NS_IMPL_STRING_ATTR(nsHTMLBodyElement, Background, background)
-NS_IMPL_STRING_ATTR(nsHTMLBodyElement, VLink, vlink)
-NS_IMPL_STRING_ATTR(nsHTMLBodyElement, ALink, alink)
-NS_IMPL_STRING_ATTR(nsHTMLBodyElement, Link, link)
-NS_IMPL_STRING_ATTR(nsHTMLBodyElement, Text, text)
-NS_IMPL_STRING_ATTR(nsHTMLBodyElement, BgColor, bgcolor)
+NS_IMETHODIMP
+HTMLBodyElement::GetBackground(nsAString& aBackground)
+{
+  nsString background;
+  GetBackground(background);
+  aBackground = background;
+  return NS_OK;
+}
+
+NS_IMETHODIMP 
+HTMLBodyElement::SetVLink(const nsAString& aVLink)
+{
+  ErrorResult rv;
+  SetVLink(aVLink, rv);
+  return rv.ErrorCode();
+}
+
+NS_IMETHODIMP
+HTMLBodyElement::GetVLink(nsAString& aVLink)
+{
+  nsString vLink;
+  GetVLink(vLink);
+  aVLink = vLink;
+  return NS_OK;
+}
+
+NS_IMETHODIMP 
+HTMLBodyElement::SetALink(const nsAString& aALink)
+{
+  ErrorResult rv;
+  SetALink(aALink, rv);
+  return rv.ErrorCode();
+}
+
+NS_IMETHODIMP
+HTMLBodyElement::GetALink(nsAString& aALink)
+{
+  nsString aLink;
+  GetALink(aLink);
+  aALink = aLink;
+  return NS_OK;
+}
+
+NS_IMETHODIMP 
+HTMLBodyElement::SetLink(const nsAString& aLink)
+{
+  ErrorResult rv;
+  SetLink(aLink, rv);
+  return rv.ErrorCode();
+}
+
+NS_IMETHODIMP
+HTMLBodyElement::GetLink(nsAString& aLink)
+{
+  nsString link;
+  GetLink(link);
+  aLink = link;
+  return NS_OK;
+}
+
+NS_IMETHODIMP 
+HTMLBodyElement::SetText(const nsAString& aText)
+{
+  ErrorResult rv;
+  SetText(aText, rv);
+  return rv.ErrorCode();
+}
+
+NS_IMETHODIMP
+HTMLBodyElement::GetText(nsAString& aText)
+{
+  nsString text;
+  GetText(text);
+  aText = text;
+  return NS_OK;
+}
+
+NS_IMETHODIMP 
+HTMLBodyElement::SetBgColor(const nsAString& aBgColor)
+{
+  ErrorResult rv;
+  SetBgColor(aBgColor, rv);
+  return rv.ErrorCode();
+}
+
+NS_IMETHODIMP
+HTMLBodyElement::GetBgColor(nsAString& aBgColor)
+{
+  nsString bgColor;
+  GetBgColor(bgColor);
+  aBgColor = bgColor;
+  return NS_OK;
+}
 
 bool
-nsHTMLBodyElement::ParseAttribute(int32_t aNamespaceID,
-                                  nsIAtom* aAttribute,
-                                  const nsAString& aValue,
-                                  nsAttrValue& aResult)
+HTMLBodyElement::ParseAttribute(int32_t aNamespaceID,
+                                nsIAtom* aAttribute,
+                                const nsAString& aValue,
+                                nsAttrValue& aResult)
 {
   if (aNamespaceID == kNameSpaceID_None) {
     if (aAttribute == nsGkAtoms::bgcolor ||
@@ -337,7 +347,7 @@ nsHTMLBodyElement::ParseAttribute(int32_t aNamespaceID,
 }
 
 void
-nsHTMLBodyElement::UnbindFromTree(bool aDeep, bool aNullParent)
+HTMLBodyElement::UnbindFromTree(bool aDeep, bool aNullParent)
 {
   if (mContentStyleRule) {
     mContentStyleRule->mPart = nullptr;
@@ -398,13 +408,13 @@ void MapAttributesIntoRule(const nsMappedAttributes* aAttributes, nsRuleData* aD
 }
 
 nsMapRuleToAttributesFunc
-nsHTMLBodyElement::GetAttributeMappingFunction() const
+HTMLBodyElement::GetAttributeMappingFunction() const
 {
   return &MapAttributesIntoRule;
 }
 
 NS_IMETHODIMP
-nsHTMLBodyElement::WalkContentStyleRules(nsRuleWalker* aRuleWalker)
+HTMLBodyElement::WalkContentStyleRules(nsRuleWalker* aRuleWalker)
 {
   nsGenericHTMLElement::WalkContentStyleRules(aRuleWalker);
 
@@ -421,7 +431,7 @@ nsHTMLBodyElement::WalkContentStyleRules(nsRuleWalker* aRuleWalker)
 }
 
 NS_IMETHODIMP_(bool)
-nsHTMLBodyElement::IsAttributeMapped(const nsIAtom* aAttribute) const
+HTMLBodyElement::IsAttributeMapped(const nsIAtom* aAttribute) const
 {
   static const MappedAttributeEntry attributes[] = {
     { &nsGkAtoms::link },
@@ -447,11 +457,11 @@ nsHTMLBodyElement::IsAttributeMapped(const nsIAtom* aAttribute) const
 }
 
 already_AddRefed<nsIEditor>
-nsHTMLBodyElement::GetAssociatedEditor()
+HTMLBodyElement::GetAssociatedEditor()
 {
-  nsIEditor* editor = nullptr;
-  if (NS_SUCCEEDED(GetEditorInternal(&editor)) && editor) {
-    return editor;
+  nsCOMPtr<nsIEditor> editor = GetEditorInternal();
+  if (editor) {
+    return editor.forget();
   }
 
   // Make sure this is the actual body of the document
@@ -471,67 +481,87 @@ nsHTMLBodyElement::GetAssociatedEditor()
     return nullptr;
   }
 
-  editorDocShell->GetEditor(&editor);
-  return editor;
+  editorDocShell->GetEditor(getter_AddRefs(editor));
+  return editor.forget();
 }
 
 #define EVENT(name_, id_, type_, struct_) /* nothing; handled by the superclass */
 // nsGenericHTMLElement::GetOnError returns
 // already_AddRefed<EventHandlerNonNull> while other getters return
 // EventHandlerNonNull*, so allow passing in the type to use here.
-#define FORWARDED_EVENT_HELPER(name_, getter_type_)                 \
-  NS_IMETHODIMP nsHTMLBodyElement::GetOn##name_(JSContext *cx,      \
-                                           jsval *vp) {             \
-    getter_type_ h = nsGenericHTMLElement::GetOn##name_();          \
-    vp->setObjectOrNull(h ? h->Callable() : nullptr);               \
-    return NS_OK;                                                   \
-  }                                                                 \
-  NS_IMETHODIMP nsHTMLBodyElement::SetOn##name_(JSContext *cx,      \
-                                           const jsval &v) {        \
-    JSObject *obj = GetWrapper();                                   \
-    if (!obj) {                                                     \
-      /* Just silently do nothing */                                \
-      return NS_OK;                                                 \
-    }                                                               \
-    nsRefPtr<EventHandlerNonNull> handler;                          \
-    JSObject *callable;                                             \
-    if (v.isObject() &&                                             \
-        JS_ObjectIsCallable(cx, callable = &v.toObject())) {        \
-      bool ok;                                                      \
-      handler = new EventHandlerNonNull(cx, obj, callable, &ok);    \
-      if (!ok) {                                                    \
-        return NS_ERROR_OUT_OF_MEMORY;                              \
-      }                                                             \
-    }                                                               \
-    ErrorResult rv;                                                 \
-    nsGenericHTMLElement::SetOn##name_(handler, rv);                \
-    return rv.ErrorCode();                                          \
-  }
-#define FORWARDED_EVENT(name_, id_, type_, struct_)                 \
-  FORWARDED_EVENT_HELPER(name_, EventHandlerNonNull*)
-#define ERROR_EVENT(name_, id_, type_, struct_)                     \
-  FORWARDED_EVENT_HELPER(name_, nsCOMPtr<EventHandlerNonNull>)
-#define WINDOW_EVENT(name_, id_, type_, struct_)                  \
-  NS_IMETHODIMP nsHTMLBodyElement::GetOn##name_(JSContext *cx,    \
-                                                jsval *vp) {      \
-    nsPIDOMWindow* win = OwnerDoc()->GetInnerWindow();         \
-    if (win && win->IsInnerWindow()) {                            \
-      return win->GetOn##name_(cx, vp);                           \
-    }                                                             \
-    *vp = JSVAL_NULL;                                             \
-    return NS_OK;                                                 \
-  }                                                               \
-  NS_IMETHODIMP nsHTMLBodyElement::SetOn##name_(JSContext *cx,    \
-                                                const jsval &v) { \
-    nsPIDOMWindow* win = OwnerDoc()->GetInnerWindow();         \
-    if (win && win->IsInnerWindow()) {                            \
-      return win->SetOn##name_(cx, v);                            \
-    }                                                             \
-    return NS_OK;                                                 \
+#define FORWARDED_EVENT_HELPER(name_, forwardto_, type_, getter_type_)         \
+  NS_IMETHODIMP                                                                \
+  HTMLBodyElement::GetOn##name_(JSContext *cx, jsval *vp)                      \
+  {                                                                            \
+    getter_type_ h = forwardto_::GetOn##name_();                               \
+    vp->setObjectOrNull(h ? h->Callable() : nullptr);                          \
+    return NS_OK;                                                              \
+  }                                                                            \
+  NS_IMETHODIMP                                                                \
+  HTMLBodyElement::SetOn##name_(JSContext *cx, const jsval &v)                 \
+  {                                                                            \
+    JSObject *obj = GetWrapper();                                              \
+    if (!obj) {                                                                \
+      /* Just silently do nothing */                                           \
+      return NS_OK;                                                            \
+    }                                                                          \
+    nsRefPtr<type_> handler;                                                   \
+    JSObject *callable;                                                        \
+    if (v.isObject() &&                                                        \
+        JS_ObjectIsCallable(cx, callable = &v.toObject())) {                   \
+      bool ok;                                                                 \
+      handler = new type_(cx, obj, callable, &ok);                             \
+      if (!ok) {                                                               \
+        return NS_ERROR_OUT_OF_MEMORY;                                         \
+      }                                                                        \
+    }                                                                          \
+    ErrorResult rv;                                                            \
+    forwardto_::SetOn##name_(handler, rv);                                     \
+    return rv.ErrorCode();                                                     \
   }
+#define FORWARDED_EVENT(name_, id_, type_, struct_)                            \
+  FORWARDED_EVENT_HELPER(name_, nsGenericHTMLElement, EventHandlerNonNull,     \
+                         EventHandlerNonNull*)
+#define ERROR_EVENT(name_, id_, type_, struct_)                                \
+  FORWARDED_EVENT_HELPER(name_, nsGenericHTMLElement,                          \
+                         EventHandlerNonNull, nsCOMPtr<EventHandlerNonNull>)
+#define WINDOW_EVENT_HELPER(name_, type_)                                      \
+  type_*                                                                       \
+  HTMLBodyElement::GetOn##name_()                                              \
+  {                                                                            \
+    nsPIDOMWindow* win = OwnerDoc()->GetInnerWindow();                         \
+    if (win && win->IsInnerWindow()) {                                         \
+      nsCOMPtr<nsISupports> supports = do_QueryInterface(win);                 \
+      nsGlobalWindow* globalWin = nsGlobalWindow::FromSupports(supports);      \
+      return globalWin->GetOn##name_();                                        \
+    }                                                                          \
+    return nullptr;                                                            \
+  }                                                                            \
+  void                                                                         \
+  HTMLBodyElement::SetOn##name_(type_* handler, ErrorResult& error)            \
+  {                                                                            \
+    nsPIDOMWindow* win = OwnerDoc()->GetInnerWindow();                         \
+    if (!win || !win->IsInnerWindow()) {                                       \
+      return;                                                                  \
+    }                                                                          \
+                                                                               \
+    nsCOMPtr<nsISupports> supports = do_QueryInterface(win);                   \
+    nsGlobalWindow* globalWin = nsGlobalWindow::FromSupports(supports);        \
+    return globalWin->SetOn##name_(handler, error);                            \
+  }                                                                            \
+  FORWARDED_EVENT_HELPER(name_, HTMLBodyElement, type_, type_*)
+#define WINDOW_EVENT(name_, id_, type_, struct_)                               \
+  WINDOW_EVENT_HELPER(name_, EventHandlerNonNull)
+#define BEFOREUNLOAD_EVENT(name_, id_, type_, struct_)                         \
+  WINDOW_EVENT_HELPER(name_, BeforeUnloadEventHandlerNonNull)
 #include "nsEventNameList.h"
+#undef BEFOREUNLOAD_EVENT
 #undef WINDOW_EVENT
+#undef WINDOW_EVENT_HELPER
 #undef ERROR_EVENT
 #undef FORWARDED_EVENT
 #undef FORWARDED_EVENT_HELPER
 #undef EVENT
+
+} // namespace dom
+} // namespace mozilla

content/html/content/src/HTMLBodyElement.h

@@ -0,0 +1,159 @@
+/* -*- Mode: C++; tab-width: 2; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
+#ifndef HTMLBodyElement_h___
+#define HTMLBodyElement_h___
+
+#include "nsGenericHTMLElement.h"
+#include "nsIDOMHTMLBodyElement.h"
+#include "nsIStyleRule.h"
+
+namespace mozilla {
+namespace dom {
+
+class BeforeUnloadEventHandlerNonNull;
+class HTMLBodyElement;
+
+class BodyRule: public nsIStyleRule
+{
+public:
+  BodyRule(HTMLBodyElement* aPart);
+  virtual ~BodyRule();
+
+  NS_DECL_ISUPPORTS
+
+  // nsIStyleRule interface
+  virtual void MapRuleInfoInto(nsRuleData* aRuleData);
+#ifdef DEBUG
+  virtual void List(FILE* out = stdout, int32_t aIndent = 0) const;
+#endif
+
+  HTMLBodyElement*  mPart;  // not ref-counted, cleared by content 
+};
+
+class HTMLBodyElement : public nsGenericHTMLElement,
+                        public nsIDOMHTMLBodyElement
+{
+public:
+  using Element::GetText;
+  using Element::SetText;
+
+  HTMLBodyElement(already_AddRefed<nsINodeInfo> aNodeInfo)
+    : nsGenericHTMLElement(aNodeInfo)
+  {
+    SetIsDOMBinding();
+  }
+  virtual ~HTMLBodyElement();
+
+  // nsISupports
+  NS_DECL_ISUPPORTS_INHERITED
+
+  // nsIDOMNode
+  NS_FORWARD_NSIDOMNODE_TO_NSINODE
+
+  // nsIDOMElement
+  NS_FORWARD_NSIDOMELEMENT_TO_GENERIC
+
+  // nsIDOMHTMLElement
+  NS_FORWARD_NSIDOMHTMLELEMENT_TO_GENERIC
+
+  // nsIDOMHTMLBodyElement
+  NS_DECL_NSIDOMHTMLBODYELEMENT
+
+  // Event listener stuff; we need to declare only the ones we need to
+  // forward to window that don't come from nsIDOMHTMLBodyElement.
+#define EVENT(name_, id_, type_, struct_) /* nothing; handled by the shim */
+#define FORWARDED_EVENT(name_, id_, type_, struct_)                     \
+  NS_IMETHOD GetOn##name_(JSContext *cx, jsval *vp);                    \
+  NS_IMETHOD SetOn##name_(JSContext *cx, const jsval &v);
+#define WINDOW_EVENT_HELPER(name_, type_)                               \
+  type_* GetOn##name_();                                                \
+  void SetOn##name_(type_* handler, ErrorResult& error);
+#define WINDOW_EVENT(name_, id_, type_, struct_)                        \
+  WINDOW_EVENT_HELPER(name_, EventHandlerNonNull)
+#define BEFOREUNLOAD_EVENT(name_, id_, type_, struct_)                  \
+  WINDOW_EVENT_HELPER(name_, BeforeUnloadEventHandlerNonNull)
+#include "nsEventNameList.h"
+#undef BEFOREUNLOAD_EVENT
+#undef WINDOW_EVENT
+#undef WINDOW_EVENT_HELPER
+#undef FORWARDED_EVENT
+#undef EVENT
+
+  void GetText(nsString& aText)
+  {
+    GetHTMLAttr(nsGkAtoms::text, aText);
+  }
+  void SetText(const nsAString& aText, ErrorResult& aError)
+  {
+    SetHTMLAttr(nsGkAtoms::text, aText, aError);
+  }
+  void GetLink(nsString& aLink)
+  {
+    GetHTMLAttr(nsGkAtoms::link, aLink);
+  }
+  void SetLink(const nsAString& aLink, ErrorResult& aError)
+  {
+    SetHTMLAttr(nsGkAtoms::link, aLink, aError);
+  }
+  void GetVLink(nsString& aVLink)
+  {
+    GetHTMLAttr(nsGkAtoms::vlink, aVLink);
+  }
+  void SetVLink(const nsAString& aVLink, ErrorResult& aError)
+  {
+    SetHTMLAttr(nsGkAtoms::vlink, aVLink, aError);
+  }
+  void GetALink(nsString& aALink)
+  {
+    GetHTMLAttr(nsGkAtoms::alink, aALink);
+  }
+  void SetALink(const nsAString& aALink, ErrorResult& aError)
+  {
+    SetHTMLAttr(nsGkAtoms::alink, aALink, aError);
+  }
+  void GetBgColor(nsString& aBgColor)
+  {
+    GetHTMLAttr(nsGkAtoms::bgcolor, aBgColor);
+  }
+  void SetBgColor(const nsAString& aBgColor, ErrorResult& aError)
+  {
+    SetHTMLAttr(nsGkAtoms::bgcolor, aBgColor, aError);
+  }
+  void GetBackground(nsString& aBackground)
+  {
+    GetHTMLAttr(nsGkAtoms::background, aBackground);
+  }
+  void SetBackground(const nsAString& aBackground, ErrorResult& aError)
+  {
+    SetHTMLAttr(nsGkAtoms::background, aBackground, aError);
+  }
+
+  virtual bool ParseAttribute(int32_t aNamespaceID,
+                              nsIAtom* aAttribute,
+                              const nsAString& aValue,
+                              nsAttrValue& aResult);
+  virtual void UnbindFromTree(bool aDeep = true,
+                              bool aNullParent = true);
+  virtual nsMapRuleToAttributesFunc GetAttributeMappingFunction() const;
+  NS_IMETHOD WalkContentStyleRules(nsRuleWalker* aRuleWalker);
+  NS_IMETHOD_(bool) IsAttributeMapped(const nsIAtom* aAttribute) const;
+  virtual already_AddRefed<nsIEditor> GetAssociatedEditor();
+  virtual nsresult Clone(nsINodeInfo *aNodeInfo, nsINode **aResult) const;
+  virtual nsXPCClassInfo* GetClassInfo();
+  virtual nsIDOMNode* AsDOMNode() { return this; }
+private:
+  nsresult GetColorHelper(nsIAtom* aAtom, nsAString& aColor);
+
+protected:
+  virtual JSObject* WrapNode(JSContext *aCx, JSObject *aScope,
+                             bool *aTriedToWrap) MOZ_OVERRIDE;
+
+  nsRefPtr<BodyRule> mContentStyleRule;
+};
+
+} // namespace dom
+} // namespace mozilla
+
+#endif /* HTMLBodyElement_h___ */

content/html/content/src/HTMLDataListElement.cpp

@@ -0,0 +1,67 @@
+/* -*- Mode: C++; tab-width: 2; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+#include "HTMLDataListElement.h"
+#include "mozilla/dom/HTMLDataListElementBinding.h"
+
+NS_IMPL_NS_NEW_HTML_ELEMENT(DataList)
+DOMCI_NODE_DATA(HTMLDataListElement, mozilla::dom::HTMLDataListElement)
+
+namespace mozilla {
+namespace dom {
+
+HTMLDataListElement::~HTMLDataListElement()
+{
+}
+
+JSObject*
+HTMLDataListElement::WrapNode(JSContext *aCx, JSObject *aScope,
+                              bool *aTriedToWrap)
+{
+  return HTMLDataListElementBinding::Wrap(aCx, aScope, this, aTriedToWrap);
+}
+
+NS_IMPL_CYCLE_COLLECTION_UNLINK_BEGIN_INHERITED(HTMLDataListElement,
+                                                nsGenericHTMLElement)
+  NS_IMPL_CYCLE_COLLECTION_UNLINK(mOptions)
+NS_IMPL_CYCLE_COLLECTION_UNLINK_END
+
+NS_IMPL_CYCLE_COLLECTION_CLASS(HTMLDataListElement)
+NS_IMPL_CYCLE_COLLECTION_TRAVERSE_BEGIN_INHERITED(HTMLDataListElement,
+                                                  nsGenericHTMLElement)
+  NS_IMPL_CYCLE_COLLECTION_TRAVERSE(mOptions)
+NS_IMPL_CYCLE_COLLECTION_TRAVERSE_END
+
+NS_IMPL_ADDREF_INHERITED(HTMLDataListElement, Element)
+NS_IMPL_RELEASE_INHERITED(HTMLDataListElement, Element)
+
+NS_INTERFACE_TABLE_HEAD_CYCLE_COLLECTION_INHERITED(HTMLDataListElement)
+  NS_HTML_CONTENT_INTERFACE_TABLE1(HTMLDataListElement,
+                                   nsIDOMHTMLDataListElement)
+  NS_HTML_CONTENT_INTERFACE_TABLE_TO_MAP_SEGUE(HTMLDataListElement,
+                                               nsGenericHTMLElement)
+NS_HTML_CONTENT_INTERFACE_TABLE_TAIL_CLASSINFO(HTMLDataListElement)
+
+
+NS_IMPL_ELEMENT_CLONE(HTMLDataListElement)
+
+bool
+HTMLDataListElement::MatchOptions(nsIContent* aContent, int32_t aNamespaceID,
+                                  nsIAtom* aAtom, void* aData)
+{
+  return aContent->NodeInfo()->Equals(nsGkAtoms::option, kNameSpaceID_XHTML) &&
+         !aContent->HasAttr(kNameSpaceID_None, nsGkAtoms::disabled);
+}
+
+NS_IMETHODIMP
+HTMLDataListElement::GetOptions(nsIDOMHTMLCollection** aOptions)
+{
+  NS_ADDREF(*aOptions = Options());
+
+  return NS_OK;
+}
+
+} // namespace dom
+} // namespace mozilla

content/html/content/src/HTMLDataListElement.h

@@ -0,0 +1,73 @@
+/* -*- Mode: C++; tab-width: 2; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
+#ifndef HTMLDataListElement_h___
+#define HTMLDataListElement_h___
+
+#include "nsGenericHTMLElement.h"
+#include "nsIDOMHTMLDataListElement.h"
+#include "nsContentList.h"
+
+namespace mozilla {
+namespace dom {
+
+class HTMLDataListElement : public nsGenericHTMLElement,
+                            public nsIDOMHTMLDataListElement
+{
+public:
+  HTMLDataListElement(already_AddRefed<nsINodeInfo> aNodeInfo)
+    : nsGenericHTMLElement(aNodeInfo)
+  {
+    SetIsDOMBinding();
+  }
+  virtual ~HTMLDataListElement();
+
+  // nsISupports
+  NS_DECL_ISUPPORTS_INHERITED
+
+  // nsIDOMNode
+  NS_FORWARD_NSIDOMNODE_TO_NSINODE
+
+  // nsIDOMElement
+  NS_FORWARD_NSIDOMELEMENT_TO_GENERIC
+
+  // nsIDOMHTMLElement
+  NS_FORWARD_NSIDOMHTMLELEMENT_TO_GENERIC
+
+  // nsIDOMHTMLDataListElement
+  NS_DECL_NSIDOMHTMLDATALISTELEMENT
+
+  nsContentList* Options()
+  {
+    if (!mOptions) {
+      mOptions = new nsContentList(this, MatchOptions, nullptr, nullptr, true);
+    }
+
+    return mOptions;
+  }
+
+
+  virtual nsresult Clone(nsINodeInfo *aNodeInfo, nsINode **aResult) const;
+
+  // This function is used to generate the nsContentList (option elements).
+  static bool MatchOptions(nsIContent* aContent, int32_t aNamespaceID,
+                             nsIAtom* aAtom, void* aData);
+
+  NS_DECL_CYCLE_COLLECTION_CLASS_INHERITED(HTMLDataListElement,
+                                           nsGenericHTMLElement)
+
+  virtual nsXPCClassInfo* GetClassInfo();
+  virtual nsIDOMNode* AsDOMNode() { return this; }
+protected:
+  virtual JSObject* WrapNode(JSContext *aCx, JSObject *aScope,
+                             bool *aTriedToWrap) MOZ_OVERRIDE;
+
+  // <option>'s list inside the datalist element.
+  nsRefPtr<nsContentList> mOptions;
+};
+
+} // namespace dom
+} // namespace mozilla
+
+#endif /* HTMLDataListElement_h___ */

content/html/content/src/HTMLDivElement.cpp

@@ -5,54 +5,45 @@
 
 #include "mozilla/Util.h"
 
-#include "nsHTMLDivElement.h"
+#include "HTMLDivElement.h"
 #include "nsGenericHTMLElement.h"
 #include "nsStyleConsts.h"
 #include "nsMappedAttributes.h"
 #include "mozilla/dom/HTMLDivElementBinding.h"
 
-using namespace mozilla;
-using namespace mozilla::dom;
-
 NS_IMPL_NS_NEW_HTML_ELEMENT(Div)
+DOMCI_NODE_DATA(HTMLDivElement, mozilla::dom::HTMLDivElement)
 
+namespace mozilla {
+namespace dom {
 
-nsHTMLDivElement::nsHTMLDivElement(already_AddRefed<nsINodeInfo> aNodeInfo)
-  : nsGenericHTMLElement(aNodeInfo)
-{
-  SetIsDOMBinding();
-}
-
-nsHTMLDivElement::~nsHTMLDivElement()
+HTMLDivElement::~HTMLDivElement()
 {
 }
 
+NS_IMPL_ADDREF_INHERITED(HTMLDivElement, Element)
+NS_IMPL_RELEASE_INHERITED(HTMLDivElement, Element)
 
-NS_IMPL_ADDREF_INHERITED(nsHTMLDivElement, Element)
-NS_IMPL_RELEASE_INHERITED(nsHTMLDivElement, Element)
-
-DOMCI_NODE_DATA(HTMLDivElement, nsHTMLDivElement)
-
-// QueryInterface implementation for nsHTMLDivElement
-NS_INTERFACE_TABLE_HEAD(nsHTMLDivElement)
-  NS_HTML_CONTENT_INTERFACE_TABLE1(nsHTMLDivElement, nsIDOMHTMLDivElement)
-  NS_HTML_CONTENT_INTERFACE_TABLE_TO_MAP_SEGUE(nsHTMLDivElement,
+// QueryInterface implementation for HTMLDivElement
+NS_INTERFACE_TABLE_HEAD(HTMLDivElement)
+  NS_HTML_CONTENT_INTERFACE_TABLE1(HTMLDivElement, nsIDOMHTMLDivElement)
+  NS_HTML_CONTENT_INTERFACE_TABLE_TO_MAP_SEGUE(HTMLDivElement,
                                                nsGenericHTMLElement)
 NS_HTML_CONTENT_INTERFACE_TABLE_TAIL_CLASSINFO(HTMLDivElement)
 
-NS_IMPL_ELEMENT_CLONE(nsHTMLDivElement)
+NS_IMPL_ELEMENT_CLONE(HTMLDivElement)
 
 JSObject*
-nsHTMLDivElement::WrapNode(JSContext *aCx, JSObject *aScope, bool *aTriedToWrap)
+HTMLDivElement::WrapNode(JSContext *aCx, JSObject *aScope, bool *aTriedToWrap)
 {
   return dom::HTMLDivElementBinding::Wrap(aCx, aScope, this, aTriedToWrap);
 }
 
 bool
-nsHTMLDivElement::ParseAttribute(int32_t aNamespaceID,
-                                 nsIAtom* aAttribute,
-                                 const nsAString& aValue,
-                                 nsAttrValue& aResult)
+HTMLDivElement::ParseAttribute(int32_t aNamespaceID,
+                               nsIAtom* aAttribute,
+                               const nsAString& aValue,
+                               nsAttrValue& aResult)
 {
   if (aNamespaceID == kNameSpaceID_None) {
     if (mNodeInfo->Equals(nsGkAtoms::marquee)) {
@@ -96,7 +87,7 @@ MapMarqueeAttributesIntoRule(const nsMappedAttributes* aAttributes, nsRuleData*
 }
 
 NS_IMETHODIMP_(bool)
-nsHTMLDivElement::IsAttributeMapped(const nsIAtom* aAttribute) const
+HTMLDivElement::IsAttributeMapped(const nsIAtom* aAttribute) const
 {
   if (mNodeInfo->Equals(nsGkAtoms::div)) {
     static const MappedAttributeEntry* const map[] = {
@@ -118,7 +109,7 @@ nsHTMLDivElement::IsAttributeMapped(const nsIAtom* aAttribute) const
 }
 
 nsMapRuleToAttributesFunc
-nsHTMLDivElement::GetAttributeMappingFunction() const
+HTMLDivElement::GetAttributeMappingFunction() const
 {
   if (mNodeInfo->Equals(nsGkAtoms::div)) {
     return &MapAttributesIntoRule;
@@ -129,3 +120,5 @@ nsHTMLDivElement::GetAttributeMappingFunction() const
   return nsGenericHTMLElement::GetAttributeMappingFunction();
 }
 
+} // namespace dom
+} // namespace mozilla

content/html/content/src/HTMLDivElement.h

@@ -2,18 +2,25 @@
 /* This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
-#ifndef nsHTMLDivElement_h___
-#define nsHTMLDivElement_h___
+#ifndef HTMLDivElement_h___
+#define HTMLDivElement_h___
 
 #include "nsGenericHTMLElement.h"
 #include "nsIDOMHTMLDivElement.h"
 
-class nsHTMLDivElement MOZ_FINAL : public nsGenericHTMLElement,
-                                   public nsIDOMHTMLDivElement
+namespace mozilla {
+namespace dom {
+
+class HTMLDivElement MOZ_FINAL : public nsGenericHTMLElement,
+                                 public nsIDOMHTMLDivElement
 {
 public:
-  nsHTMLDivElement(already_AddRefed<nsINodeInfo> aNodeInfo);
-  virtual ~nsHTMLDivElement();
+  HTMLDivElement(already_AddRefed<nsINodeInfo> aNodeInfo)
+    : nsGenericHTMLElement(aNodeInfo)
+  {
+    SetIsDOMBinding();
+  }
+  virtual ~HTMLDivElement();
 
   // nsISupports
   NS_DECL_ISUPPORTS_INHERITED
@@ -52,9 +59,9 @@ public:
   }
 
   virtual bool ParseAttribute(int32_t aNamespaceID,
-                                nsIAtom* aAttribute,
-                                const nsAString& aValue,
-                                nsAttrValue& aResult);
+                              nsIAtom* aAttribute,
+                              const nsAString& aValue,
+                              nsAttrValue& aResult);
   NS_IMETHOD_(bool) IsAttributeMapped(const nsIAtom* aAttribute) const;
   virtual nsMapRuleToAttributesFunc GetAttributeMappingFunction() const;
   virtual nsresult Clone(nsINodeInfo *aNodeInfo, nsINode **aResult) const;
@@ -67,4 +74,7 @@ protected:
                              bool *aTriedToWrap) MOZ_OVERRIDE;
 };
 
-#endif /* nsHTMLDivElement_h___ */
+} // namespace dom
+} // namespace mozilla
+
+#endif /* HTMLDivElement_h___ */