Merge mozilla-inbound to mozilla-central. a=merge on a CLOSED TREE

accessible/tests/mochitest/elm/test_shadowroot_subframe.html

@@ -37,7 +37,14 @@
     var component = document.getElementById("component");
     var shadow = component.attachShadow({mode: "open"});
 
-    shadow.innerHTML = "<button>Hello</button>" +
-      '<a href="#"> World</a>';
+    var button = document.createElement("button");
+    button.append("Hello");
+
+    var a = document.createElement("a");
+    a.setAttribute("href", "#");
+    a.append(" World");
+
+    shadow.appendChild(button);
+    shadow.appendChild(a);
   </script>
 </body>

browser/base/content/newtab/grid.js

@@ -179,18 +179,37 @@ var gGrid = {
     site.classList.add("newtab-site");
     site.setAttribute("draggable", "true");
 
-    // Create the site's inner HTML code.
-    site.innerHTML =
-      '<a class="newtab-link">' +
-      '  <span class="newtab-thumbnail placeholder"/>' +
-      '  <img src="" alt="" class="newtab-thumbnail thumbnail"/>' +
-      '  <img src="" alt="" class="newtab-thumbnail enhanced-content"/>' +
-      '  <span class="newtab-title"/>' +
-      '</a>' +
-      '<input type="button" title="' + newTabString("pin") + '"' +
-      '       class="newtab-control newtab-control-pin"/>' +
-      '<input type="button" title="' + newTabString("block") + '"' +
-      '       class="newtab-control newtab-control-block"/>';
+    let link = document.createElement("a");
+    link.className = "newtab-link";
+    site.appendChild(link);
+
+    let thumbnailPlaceHolder = document.createElement("span");
+    thumbnailPlaceHolder.className = "newtab-thumbnail placeholder";
+    link.appendChild(thumbnailPlaceHolder);
+
+    let thumbnail = document.createElement("img");
+    thumbnail.className = "newtab-thumbnail thumbnail";
+    link.appendChild(thumbnail);
+
+    let enhancedContent = document.createElement("img");
+    enhancedContent.className = "newtab-thumbnail enhanced-content";
+    link.appendChild(enhancedContent);
+
+    let title = document.createElement("span");
+    title.className = "newtab-title";
+    link.appendChild(title);
+
+    let pinButton = document.createElement("input");
+    pinButton.type = "button";
+    pinButton.title = newTabString("pin");
+    pinButton.className = "newtab-control newtab-control-pin";
+    site.appendChild(pinButton);
+
+    let removeButton = document.createElement("input");
+    removeButton.type = "button";
+    removeButton.title = newTabString("block");
+    removeButton.className = "newtab-control newtab-control-block";
+    site.appendChild(removeButton);
 
     this._siteFragment = document.createDocumentFragment();
     this._siteFragment.appendChild(site);

browser/base/content/test/general/contentSearchUI.js

@@ -168,8 +168,7 @@ function waitForSuggestions(cb) {
 }
 
 function waitForContentSearchEvent(messageType, cb) {
-  let mm = content.SpecialPowers.Cc["@mozilla.org/globalmessagemanager;1"].
-    getService(content.SpecialPowers.Ci.nsIMessageListenerManager);
+  let mm = content.SpecialPowers.Cc["@mozilla.org/globalmessagemanager;1"].getService();
   mm.addMessageListener("ContentSearch", function listener(aMsg) {
     if (aMsg.data.type != messageType) {
       return;

browser/base/content/test/pageinfo/browser_pageInfo.js

@@ -1,14 +1,17 @@
+const URI = "https://example.com/browser/browser/base/content/test/pageinfo/feed_tab.html";
+
 function test() {
   waitForExplicitFinish();
 
   var pageInfo;
 
   gBrowser.selectedTab = BrowserTestUtils.addTab(gBrowser);
-  BrowserTestUtils.browserLoaded(gBrowser.selectedBrowser).then(() => {
+  BrowserTestUtils.browserLoaded(gBrowser.selectedBrowser, false,
+                                 URI).then(() => {
     Services.obs.addObserver(observer, "page-info-dialog-loaded");
     pageInfo = BrowserPageInfo();
   });
-  gBrowser.selectedBrowser.loadURI("https://example.com/browser/browser/base/content/test/pageinfo/feed_tab.html");
+  gBrowser.selectedBrowser.loadURI(URI);
 
   function observer(win, topic, data) {
     Services.obs.removeObserver(observer, "page-info-dialog-loaded");

browser/base/content/test/pageinfo/browser_pageinfo_firstPartyIsolation.js

@@ -73,8 +73,9 @@ async function test() {
 
   let url = "https://example.com/browser/browser/base/content/test/pageinfo/image.html";
   gBrowser.selectedTab = BrowserTestUtils.addTab(gBrowser);
+  let loadPromise = BrowserTestUtils.browserLoaded(gBrowser.selectedBrowser, false, url);
   gBrowser.selectedBrowser.loadURI(url);
-  await BrowserTestUtils.browserLoaded(gBrowser.selectedBrowser, false, url);
+  await loadPromise;
 
   // Pass a dummy imageElement, if there isn't an imageElement, pageInfo.js
   // will do a preview, however this sometimes will cause intermittent failures,

browser/base/content/test/pageinfo/browser_pageinfo_image_info.js

@@ -8,12 +8,23 @@ function getImageInfo(imageElement) {
   };
 }
 
+const URI =
+  "data:text/html," +
+  "<style type='text/css'>%23test-image,%23not-test-image {background-image: url('about:logo?c');}</style>" +
+  "<img src='about:logo?b' height=300 width=350 alt=2 id='not-test-image'>" +
+  "<img src='about:logo?b' height=300 width=350 alt=2>" +
+  "<img src='about:logo?a' height=200 width=250>" +
+  "<img src='about:logo?b' height=200 width=250 alt=1>" +
+  "<img src='about:logo?b' height=100 width=150 alt=2 id='test-image'>";
+
 function test() {
   waitForExplicitFinish();
 
   gBrowser.selectedTab = BrowserTestUtils.addTab(gBrowser);
 
-  BrowserTestUtils.browserLoaded(gBrowser.selectedBrowser).then(function() {
+  let uriToWaitFor = URI.replace(/ /g, "%20");
+  BrowserTestUtils.browserLoaded(gBrowser.selectedBrowser, false,
+                                 uriToWaitFor).then(function() {
     // eslint-disable-next-line mozilla/no-cpows-in-tests
     var doc = gBrowser.contentDocumentAsCPOW;
     var testImg = doc.getElementById("test-image");
@@ -37,12 +48,5 @@ function test() {
     }, {capture: true, once: true});
   });
 
-  gBrowser.loadURI(
-    "data:text/html," +
-    "<style type='text/css'>%23test-image,%23not-test-image {background-image: url('about:logo?c');}</style>" +
-    "<img src='about:logo?b' height=300 width=350 alt=2 id='not-test-image'>" +
-    "<img src='about:logo?b' height=300 width=350 alt=2>" +
-    "<img src='about:logo?a' height=200 width=250>" +
-    "<img src='about:logo?b' height=200 width=250 alt=1>" +
-    "<img src='about:logo?b' height=100 width=150 alt=2 id='test-image'>");
+  gBrowser.loadURI(URI);
 }

browser/base/content/test/pageinfo/browser_pageinfo_svg_image.js

@@ -1,9 +1,12 @@
+const URI = "https://example.com/browser/browser/base/content/test/pageinfo/svg_image.html";
+
 function test() {
   waitForExplicitFinish();
 
   gBrowser.selectedTab = BrowserTestUtils.addTab(gBrowser);
 
-  BrowserTestUtils.browserLoaded(gBrowser.selectedBrowser).then(() => {
+  BrowserTestUtils.browserLoaded(gBrowser.selectedBrowser, false,
+                                 URI).then(() => {
     var pageInfo = BrowserPageInfo(gBrowser.selectedBrowser.currentURI.spec,
                                    "mediaTab");
 
@@ -32,6 +35,5 @@ function test() {
     }, {capture: true, once: true});
   });
 
-  gBrowser.selectedBrowser.loadURI(
-    "https://example.com/browser/browser/base/content/test/pageinfo/svg_image.html");
+  gBrowser.selectedBrowser.loadURI(URI);
 }

browser/base/content/test/webrtc/browser_devices_get_user_media_multi_process.js

@@ -42,10 +42,7 @@ var gTests = [
 
     // If we have reached the max process count already, increase it to ensure
     // our new tab can have its own content process.
-    var ppmm = Cc["@mozilla.org/parentprocessmessagemanager;1"]
-                 .getService(Ci.nsIMessageBroadcaster);
-    ppmm.QueryInterface(Ci.nsIProcessScriptLoader);
-    let childCount = ppmm.childCount;
+    let childCount = Services.ppmm.childCount;
     let maxContentProcess = Services.prefs.getIntPref("dom.ipc.processCount");
     // The first check is because if we are on a branch where e10s-multi is
     // disabled, we want to keep testing e10s with a single content process.
@@ -146,10 +143,7 @@ var gTests = [
 
     // If we have reached the max process count already, increase it to ensure
     // our new tab can have its own content process.
-    var ppmm = Cc["@mozilla.org/parentprocessmessagemanager;1"]
-                 .getService(Ci.nsIMessageBroadcaster);
-    ppmm.QueryInterface(Ci.nsIProcessScriptLoader);
-    let childCount = ppmm.childCount;
+    let childCount = Services.ppmm.childCount;
     let maxContentProcess = Services.prefs.getIntPref("dom.ipc.processCount");
     // The first check is because if we are on a branch where e10s-multi is
     // disabled, we want to keep testing e10s with a single content process.
@@ -255,10 +249,7 @@ var gTests = [
 
     // If we have reached the max process count already, increase it to ensure
     // our new tab can have its own content process.
-    var ppmm = Cc["@mozilla.org/parentprocessmessagemanager;1"]
-                 .getService(Ci.nsIMessageBroadcaster);
-    ppmm.QueryInterface(Ci.nsIProcessScriptLoader);
-    let childCount = ppmm.childCount;
+    let childCount = Services.ppmm.childCount;
     let maxContentProcess = Services.prefs.getIntPref("dom.ipc.processCount");
     // The first check is because if we are on a branch where e10s-multi is
     // disabled, we want to keep testing e10s with a single content process.

browser/components/extensions/test/browser/browser_ext_tabs_executeScript.js

@@ -19,12 +19,6 @@ add_task(async function testExecuteScript() {
       Services.ppmm.getChildAt(0),
     ];
     for (let mm of messageManagerMap.keys()) {
-      // Sanity check: mm is a message manager.
-      try {
-        mm.QueryInterface(Ci.nsIMessageSender);
-      } catch (e) {
-        mm.QueryInterface(Ci.nsIMessageBroadcaster);
-      }
       if (!globalMMs.includes(mm)) {
         ++count;
       }

browser/components/nsBrowserGlue.js

@@ -3188,14 +3188,13 @@ this.NSGetFactory = XPCOMUtils.generateNSGetFactory(components);
 // Listen for UITour messages.
 // Do it here instead of the UITour module itself so that the UITour module is lazy loaded
 // when the first message is received.
-var globalMM = Cc["@mozilla.org/globalmessagemanager;1"].getService(Ci.nsIMessageListenerManager);
-globalMM.addMessageListener("UITour:onPageEvent", function(aMessage) {
+Services.mm.addMessageListener("UITour:onPageEvent", function(aMessage) {
   UITour.onPageEvent(aMessage, aMessage.data);
 });
 
 // Listen for HybridContentTelemetry messages.
 // Do it here instead of HybridContentTelemetry.init() so that
 // the module can be lazily loaded on the first message.
-globalMM.addMessageListener("HybridContentTelemetry:onTelemetryMessage", aMessage => {
+Services.mm.addMessageListener("HybridContentTelemetry:onTelemetryMessage", aMessage => {
   HybridContentTelemetry.onTelemetryMessage(aMessage, aMessage.data);
 });

browser/components/sessionstore/test/head.js

@@ -15,16 +15,13 @@ const FRAME_SCRIPTS = [
   ROOT + "content-forms.js"
 ];
 
-var globalMM = Cc["@mozilla.org/globalmessagemanager;1"]
-           .getService(Ci.nsIMessageListenerManager);
-
 for (let script of FRAME_SCRIPTS) {
-  globalMM.loadFrameScript(script, true);
+  Services.mm.loadFrameScript(script, true);
 }
 
 registerCleanupFunction(() => {
   for (let script of FRAME_SCRIPTS) {
-    globalMM.removeDelayedFrameScript(script, true);
+    Services.mm.removeDelayedFrameScript(script, true);
   }
 });
 

browser/extensions/onboarding/content/onboarding.js

@@ -26,6 +26,62 @@ const SPEECH_BUBBLE_NEWTOUR_STRING_ID = "onboarding.overlay-icon-tooltip2";
 const SPEECH_BUBBLE_UPDATETOUR_STRING_ID = "onboarding.overlay-icon-tooltip-updated2";
 const ICON_STATE_WATERMARK = "watermark";
 const ICON_STATE_DEFAULT = "default";
+
+/**
+ * Helper function to create the tour description UI element.
+ */
+function createOnboardingTourDescription(div, title, description) {
+  let doc = div.ownerDocument;
+  let section = doc.createElement("section");
+  section.className = "onboarding-tour-description";
+
+  let h1 = doc.createElement("h1");
+  h1.setAttribute("data-l10n-id", title);
+  section.appendChild(h1);
+
+  let p = doc.createElement("p");
+  p.setAttribute("data-l10n-id", description);
+  section.appendChild(p);
+
+  div.appendChild(section);
+  return section;
+}
+
+/**
+ * Helper function to create the tour content UI element.
+ */
+function createOnboardingTourContent(div, imageSrc) {
+  let doc = div.ownerDocument;
+  let section = doc.createElement("section");
+  section.className = "onboarding-tour-content";
+
+  let img = doc.createElement("img");
+  img.setAttribute("src", imageSrc);
+  img.setAttribute("role", "presentation");
+  section.appendChild(img);
+
+  div.appendChild(section);
+  return section;
+}
+
+/**
+ * Helper function to create the tour button UI element.
+ */
+function createOnboardingTourButton(div, buttonId, l10nId) {
+  let doc = div.ownerDocument;
+  let aside = doc.createElement("aside");
+  aside.className = "onboarding-tour-button-container";
+
+  let button = doc.createElement("button");
+  button.id = buttonId;
+  button.className = "onboarding-tour-action-button";
+  button.setAttribute("data-l10n-id", l10nId);
+  aside.appendChild(button);
+
+  div.appendChild(aside);
+  return aside;
+}
+
 /**
  * Add any number of tours, key is the tourId, value should follow the format below
  * "tourId": { // The short tour id which could be saved in pref
@@ -60,18 +116,13 @@ var onboardingTourset = {
     },
     getPage(win) {
       let div = win.document.createElement("div");
-      div.innerHTML = `
-        <section class="onboarding-tour-description">
-          <h1 data-l10n-id="onboarding.tour-private-browsing.title2"></h1>
-          <p data-l10n-id="onboarding.tour-private-browsing.description3"></p>
-        </section>
-        <section class="onboarding-tour-content">
-          <img src="resource://onboarding/img/figure_private.svg" role="presentation"/>
-        </section>
-        <aside class="onboarding-tour-button-container">
-          <button id="onboarding-tour-private-browsing-button" class="onboarding-tour-action-button" data-l10n-id="onboarding.tour-private-browsing.button"></button>
-        </aside>
-      `;
+
+      createOnboardingTourDescription(div,
+        "onboarding.tour-private-browsing.title2", "onboarding.tour-private-browsing.description3");
+      createOnboardingTourContent(div, "resource://onboarding/img/figure_private.svg");
+      createOnboardingTourButton(div,
+        "onboarding-tour-private-browsing-button", "onboarding.tour-private-browsing.button");
+
       return div;
     },
   },
@@ -87,18 +138,13 @@ var onboardingTourset = {
     },
     getPage(win) {
       let div = win.document.createElement("div");
-      div.innerHTML = `
-        <section class="onboarding-tour-description">
-          <h1 data-l10n-id="onboarding.tour-addons.title2"></h1>
-          <p data-l10n-id="onboarding.tour-addons.description2"></p>
-        </section>
-        <section class="onboarding-tour-content">
-          <img src="resource://onboarding/img/figure_addons.svg" role="presentation"/>
-        </section>
-        <aside class="onboarding-tour-button-container">
-          <button id="onboarding-tour-addons-button" class="onboarding-tour-action-button" data-l10n-id="onboarding.tour-addons.button"></button>
-        </aside>
-      `;
+
+      createOnboardingTourDescription(div,
+        "onboarding.tour-addons.title2", "onboarding.tour-addons.description2");
+      createOnboardingTourContent(div, "resource://onboarding/img/figure_addons.svg");
+      createOnboardingTourButton(div,
+        "onboarding-tour-addons-button", "onboarding.tour-addons.button");
+
       return div;
     },
   },
@@ -114,18 +160,13 @@ var onboardingTourset = {
     },
     getPage(win) {
       let div = win.document.createElement("div");
-      div.innerHTML = `
-        <section class="onboarding-tour-description">
-          <h1 data-l10n-id="onboarding.tour-customize.title2"></h1>
-          <p data-l10n-id="onboarding.tour-customize.description2"></p>
-        </section>
-        <section class="onboarding-tour-content">
-          <img src="resource://onboarding/img/figure_customize.svg" role="presentation"/>
-        </section>
-        <aside class="onboarding-tour-button-container">
-          <button id="onboarding-tour-customize-button" class="onboarding-tour-action-button" data-l10n-id="onboarding.tour-customize.button"></button>
-        </aside>
-      `;
+
+      createOnboardingTourDescription(div,
+        "onboarding.tour-customize.title2", "onboarding.tour-customize.description2");
+      createOnboardingTourContent(div, "resource://onboarding/img/figure_customize.svg");
+      createOnboardingTourButton(div,
+        "onboarding-tour-customize-button", "onboarding.tour-customize.button");
+
       return div;
     },
   },
@@ -146,21 +187,31 @@ var onboardingTourset = {
       let setFromPanel = bundle.GetStringFromName("onboarding.tour-default-browser.button");
       let isDefaultMessage = bundle.GetStringFromName("onboarding.tour-default-browser.is-default.message");
       let isDefault2ndMessage = bundle.formatStringFromName("onboarding.tour-default-browser.is-default.2nd-message", [BRAND_SHORT_NAME], 1);
-      // eslint-disable-next-line no-unsanitized/property
-      div.innerHTML = `
-        <section class="onboarding-tour-description">
-          <h1 data-l10n-id="onboarding.tour-default-browser.title2"></h1>
-          <p data-l10n-id="onboarding.tour-default-browser.description2"></p>
-        </section>
-        <section class="onboarding-tour-content">
-          <img src="resource://onboarding/img/figure_default.svg" role="presentation"/>
-        </section>
-        <aside class="onboarding-tour-button-container">
-          <button id="onboarding-tour-default-browser-button" class="onboarding-tour-action-button"
-            data-bg="${setFromBackGround}" data-panel="${setFromPanel}"></button>
-          <div id="onboarding-tour-is-default-browser-msg" class="onboarding-hidden">${isDefaultMessage}<br/>${isDefault2ndMessage}</div>
-        </aside>
-      `;
+
+      createOnboardingTourDescription(div,
+        "onboarding.tour-default-browser.title2", "onboarding.tour-default-browser.description2");
+      createOnboardingTourContent(div, "resource://onboarding/img/figure_default.svg");
+
+      let aside = win.document.createElement("aside");
+      aside.className = "onboarding-tour-button-container";
+      div.appendChild(aside);
+
+      let button = win.document.createElement("button");
+      button.id = "onboarding-tour-default-browser-button";
+      button.className = "onboarding-tour-action-button";
+      button.setAttribute("data-bg", setFromBackGround);
+      button.setAttribute("data-panel", setFromPanel);
+      aside.appendChild(button);
+
+      let isDefaultBrowserMsg = win.document.createElement("div");
+      isDefaultBrowserMsg.id = "onboarding-tour-is-default-browser-msg";
+      isDefaultBrowserMsg.className = "onboarding-hidden";
+      aside.appendChild(isDefaultBrowserMsg);
+      isDefaultBrowserMsg.append(isDefaultMessage);
+
+      let br = win.document.createElement("br");
+      isDefaultBrowserMsg.appendChild(br);
+      isDefaultBrowserMsg.append(isDefault2ndMessage);
 
       div.addEventListener("beforeshow", () => {
         win.document.dispatchEvent(new Event("Agent:CanSetDefaultBrowserInBackground"));
@@ -189,30 +240,71 @@ var onboardingTourset = {
       // discussion in https://bugzilla.mozilla.org/show_bug.cgi?id=1378770#c6
       // for detail.
       let emailRegex = "^[\\w.!#$%&’*+\\/=?^`{|}~-]{1,64}@[a-z\\d](?:[a-z\\d-]{0,253}[a-z\\d])?(?:\\.[a-z\\d](?:[a-z\\d-]{0,253}[a-z\\d])?)+$";
-      div.innerHTML = `
-        <section class="onboarding-tour-description">
-          <h1 data-l10n-id="onboarding.tour-sync.title2" class="show-on-logged-out"></h1>
-          <p data-l10n-id="onboarding.tour-sync.description2" class="show-on-logged-out"></p>
-          <h1 data-l10n-id="onboarding.tour-sync.logged-in.title" class="show-on-logged-in"></h1>
-          <p data-l10n-id="onboarding.tour-sync.logged-in.description" class="show-on-logged-in"></p>
-        </section>
-        <section class="onboarding-tour-content">
-          <form class="show-on-logged-out">
-            <h3 data-l10n-id="onboarding.tour-sync.form.title"></h3>
-            <p data-l10n-id="onboarding.tour-sync.form.description"></p>
-            <input id="onboarding-tour-sync-email-input" type="email" required="true"></input><br />
-            <button id="onboarding-tour-sync-button" class="onboarding-tour-action-button" data-l10n-id="onboarding.tour-sync.button"></button>
-          </form>
-          <img src="resource://onboarding/img/figure_sync.svg" role="presentation"/>
-        </section>
-        <aside class="onboarding-tour-button-container show-on-logged-in">
-          <button id="onboarding-tour-sync-connect-device-button" class="onboarding-tour-action-button" data-l10n-id="onboarding.tour-sync.connect-device.button"></button>
-        </aside>
-      `;
-      let emailInput = div.querySelector("#onboarding-tour-sync-email-input");
-      emailInput.placeholder =
+
+      let description = createOnboardingTourDescription(div,
+        "onboarding.tour-sync.title2", "onboarding.tour-sync.description2");
+
+      description.querySelector("h1").className = "show-on-logged-out";
+      description.querySelector("p").className = "show-on-logged-out";
+
+      let h1LoggedIn = win.document.createElement("h1");
+      h1LoggedIn.setAttribute("data-l10n-id", "onboarding.tour-sync.logged-in.title");
+      h1LoggedIn.className = "show-on-logged-in";
+      description.appendChild(h1LoggedIn);
+
+      let pLoggedIn = win.document.createElement("p");
+      pLoggedIn.setAttribute("data-l10n-id", "onboarding.tour-sync.logged-in.description");
+      pLoggedIn.className = "show-on-logged-in";
+      description.appendChild(pLoggedIn);
+
+      let content = win.document.createElement("section");
+      content.className = "onboarding-tour-content";
+      div.appendChild(content);
+
+      let form = win.document.createElement("form");
+      form.className = "show-on-logged-out";
+      content.appendChild(form);
+
+      let h3 = win.document.createElement("h3");
+      h3.setAttribute("data-l10n-id", "onboarding.tour-sync.form.title");
+      form.appendChild(h3);
+
+      let p = win.document.createElement("p");
+      p.setAttribute("data-l10n-id", "onboarding.tour-sync.form.description");
+      form.appendChild(p);
+
+      let input = win.document.createElement("input");
+      input.id = "onboarding-tour-sync-email-input";
+      input.setAttribute("required", "true");
+      input.setAttribute("type", "email");
+      input.placeholder =
         bundle.GetStringFromName("onboarding.tour-sync.email-input.placeholder");
-      emailInput.pattern = emailRegex;
+      input.pattern = emailRegex;
+      form.appendChild(input);
+
+      let br = win.document.createElement("br");
+      form.appendChild(br);
+
+      let button = win.document.createElement("button");
+      button.id = "onboarding-tour-sync-button";
+      button.className = "onboarding-tour-action-button";
+      button.setAttribute("data-l10n-id", "onboarding.tour-sync.button");
+      form.appendChild(button);
+
+      let img = win.document.createElement("img");
+      img.setAttribute("src", "resource://onboarding/img/figure_sync.svg");
+      img.setAttribute("role", "presentation");
+      content.appendChild(img);
+
+      let aside = win.document.createElement("aside");
+      aside.className = "onboarding-tour-button-container show-on-logged-in";
+      div.appendChild(aside);
+
+      let connectDeviceButton = win.document.createElement("button");
+      connectDeviceButton.id = "onboarding-tour-sync-connect-device-button";
+      connectDeviceButton.className = "onboarding-tour-action-button";
+      connectDeviceButton.setAttribute("data-l10n-id", "onboarding.tour-sync.connect-device.button");
+      aside.appendChild(connectDeviceButton);
 
       div.addEventListener("beforeshow", () => {
         function loginStatusListener(msg) {
@@ -238,18 +330,13 @@ var onboardingTourset = {
     },
     getPage(win) {
       let div = win.document.createElement("div");
-      div.innerHTML = `
-        <section class="onboarding-tour-description">
-          <h1 data-l10n-id="onboarding.tour-library.title"></h1>
-          <p data-l10n-id="onboarding.tour-library.description2"></p>
-        </section>
-        <section class="onboarding-tour-content">
-          <img src="resource://onboarding/img/figure_library.svg" role="presentation"/>
-        </section>
-        <aside class="onboarding-tour-button-container">
-          <button id="onboarding-tour-library-button" class="onboarding-tour-action-button" data-l10n-id="onboarding.tour-library.button2"></button>
-        </aside>
-      `;
+
+      createOnboardingTourDescription(div,
+        "onboarding.tour-library.title", "onboarding.tour-library.description2");
+      createOnboardingTourContent(div, "resource://onboarding/img/figure_library.svg");
+      createOnboardingTourButton(div,
+        "onboarding-tour-library-button", "onboarding.tour-library.button2");
+
       return div;
     },
   },
@@ -265,18 +352,13 @@ var onboardingTourset = {
     },
     getPage(win, bundle) {
       let div = win.document.createElement("div");
-      div.innerHTML = `
-        <section class="onboarding-tour-description">
-          <h1 data-l10n-id="onboarding.tour-singlesearch.title"></h1>
-          <p data-l10n-id="onboarding.tour-singlesearch.description"></p>
-        </section>
-        <section class="onboarding-tour-content">
-          <img src="resource://onboarding/img/figure_singlesearch.svg" role="presentation"/>
-        </section>
-        <aside class="onboarding-tour-button-container">
-          <button id="onboarding-tour-singlesearch-button" class="onboarding-tour-action-button" data-l10n-id="onboarding.tour-singlesearch.button"></button>
-        </aside>
-      `;
+
+      createOnboardingTourDescription(div,
+        "onboarding.tour-singlesearch.title", "onboarding.tour-singlesearch.description");
+      createOnboardingTourContent(div, "resource://onboarding/img/figure_singlesearch.svg");
+      createOnboardingTourButton(div,
+        "onboarding-tour-singlesearch-button", "onboarding.tour-singlesearch.button");
+
       return div;
     },
   },
@@ -293,15 +375,11 @@ var onboardingTourset = {
     },
     getPage(win, bundle) {
       let div = win.document.createElement("div");
-      div.innerHTML = `
-        <section class="onboarding-tour-description">
-          <h1 data-l10n-id="onboarding.tour-performance.title"></h1>
-          <p data-l10n-id="onboarding.tour-performance.description"></p>
-        </section>
-        <section class="onboarding-tour-content">
-          <img src="resource://onboarding/img/figure_performance.svg" role="presentation"/>
-        </section>
-      `;
+
+      createOnboardingTourDescription(div,
+        "onboarding.tour-performance.title", "onboarding.tour-performance.description");
+      createOnboardingTourContent(div, "resource://onboarding/img/figure_performance.svg");
+
       return div;
     },
   },
@@ -319,19 +397,18 @@ var onboardingTourset = {
       let div = win.document.createElement("div");
       // Screenshot tour opens the screenshot page directly, see below a#onboarding-tour-screenshots-button.
       // The screenshots page should be responsible for highlighting the Screenshots button
-      div.innerHTML = `
-        <section class="onboarding-tour-description">
-          <h1 data-l10n-id="onboarding.tour-screenshots.title"></h1>
-          <p data-l10n-id="onboarding.tour-screenshots.description"></p>
-        </section>
-        <section class="onboarding-tour-content">
-          <img src="resource://onboarding/img/figure_screenshots.svg" role="presentation"/>
-        </section>
-        <aside class="onboarding-tour-button-container">
-          <a id="onboarding-tour-screenshots-button" class="onboarding-tour-action-button" data-l10n-id="onboarding.tour-screenshots.button"
-             href="https://screenshots.firefox.com/#tour" target="_blank"></a>
-        </aside>
-      `;
+
+      createOnboardingTourDescription(div,
+        "onboarding.tour-screenshots.title", "onboarding.tour-screenshots.description");
+      createOnboardingTourContent(div, "resource://onboarding/img/figure_screenshots.svg");
+
+      let aside = createOnboardingTourButton(div,
+        "onboarding-tour-screenshots-button", "onboarding.tour-screenshots.button");
+
+      let button = aside.querySelector("button");
+      button.setAttribute("href", "https://screenshots.firefox.com/#tour");
+      button.setAttribute("target", "_blank");
+
       return div;
     },
   },
@@ -1248,23 +1325,43 @@ class Onboarding {
     footer.id = "onboarding-notification-bar";
     footer.setAttribute("aria-live", "polite");
     footer.setAttribute("aria-labelledby", "onboarding-notification-tour-title");
-    // We use `innerHTML` for more friendly reading.
-    // The security should be fine because this is not from an external input.
-    footer.innerHTML = `
-      <section id="onboarding-notification-message-section" role="presentation">
-        <div id="onboarding-notification-tour-icon" role="presentation"></div>
-        <div id="onboarding-notification-body" role="presentation">
-          <h1 id="onboarding-notification-tour-title"></h1>
-          <p id="onboarding-notification-tour-message"></p>
-        </div>
-        <button id="onboarding-notification-action-btn" class="onboarding-action-button"></button>
-      </section>
-      <button id="onboarding-notification-close-btn" class="onboarding-close-btn"></button>
-    `;
 
-    let closeBtn = footer.querySelector("#onboarding-notification-close-btn");
-    closeBtn.setAttribute("title",
+    let section = this._window.document.createElement("section");
+    section.id = "onboarding-notification-message-section";
+    section.setAttribute("role", "presentation");
+    footer.appendChild(section);
+
+    let icon = this._window.document.createElement("div");
+    icon.id = "onboarding-notification-tour-icon";
+    icon.setAttribute("role", "presentation");
+    section.appendChild(icon);
+
+    let onboardingNotificationBody = this._window.document.createElement("div");
+    onboardingNotificationBody.id = "onboarding-notification-body";
+    onboardingNotificationBody.setAttribute("role", "presentation");
+    section.appendChild(onboardingNotificationBody);
+
+    let title = this._window.document.createElement("h1");
+    title.id = "onboarding-notification-tour-title";
+    onboardingNotificationBody.appendChild(title);
+
+    let message = this._window.document.createElement("p");
+    message.id = "onboarding-notification-tour-message";
+    onboardingNotificationBody.appendChild(message);
+
+    let actionButton = this._window.document.createElement("button");
+    actionButton.id = "onboarding-notification-action-btn";
+    actionButton.className = "onboarding-action-button";
+    section.appendChild(actionButton);
+
+    let closeButton = this._window.document.createElement("button");
+    closeButton.id = "onboarding-notification-close-btn";
+    closeButton.className = "onboarding-close-btn";
+    footer.appendChild(closeButton);
+
+    closeButton.setAttribute("title",
       this._bundle.GetStringFromName("onboarding.notification-close-button-tooltip"));
+
     return footer;
   }
 
@@ -1291,35 +1388,47 @@ class Onboarding {
   _renderOverlay() {
     let div = this._window.document.createElement("div");
     div.id = "onboarding-overlay";
-    // We use `innerHTML` for more friendly reading.
-    // The security should be fine because this is not from an external input.
-    div.innerHTML = `
-      <div role="dialog" tabindex="-1" aria-labelledby="onboarding-header">
-        <header id="onboarding-header"></header>
-        <nav>
-          <ul id="onboarding-tour-list" role="tablist"></ul>
-        </nav>
-        <footer id="onboarding-footer"></footer>
-        <button id="onboarding-overlay-close-btn" class="onboarding-close-btn"></button>
-      </div>
-    `;
 
-    this._dialog = div.querySelector(`[role="dialog"]`);
+    this._dialog = this._window.document.createElement("div");
+    this._dialog.setAttribute("role", "dialog");
+    this._dialog.setAttribute("tabindex", "-1");
+    this._dialog.setAttribute("aria-labelledby", "onboarding-header");
     this._dialog.id = ONBOARDING_DIALOG_ID;
-    div.querySelector("#onboarding-header").textContent =
-      this._bundle.GetStringFromName("onboarding.overlay-title2");
+    div.appendChild(this._dialog);
+
+    let header = this._window.document.createElement("header");
+    header.id = "onboarding-header";
+    header.textContent = this._bundle.GetStringFromName("onboarding.overlay-title2");
+    this._dialog.appendChild(header);
+
+    let nav = this._window.document.createElement("nav");
+    this._dialog.appendChild(nav);
+
+    let tourList = this._window.document.createElement("ul");
+    tourList.id = "onboarding-tour-list";
+    tourList.setAttribute("role", "tablist");
+    nav.appendChild(tourList);
+
+    let footer = this._window.document.createElement("footer");
+    footer.id = "onboarding-footer";
+    this._dialog.appendChild(footer);
+
+    let button = this._window.document.createElement("button");
+    button.id = "onboarding-overlay-close-btn";
+    button.className = "onboarding-close-btn";
+    button.setAttribute("title",
+      this._bundle.GetStringFromName("onboarding.overlay-close-button-tooltip"));
+    this._dialog.appendChild(button);
+
     // support show/hide skip tour button via pref
     if (!Services.prefs.getBoolPref("browser.onboarding.skip-tour-button.hide", false)) {
-      let footer = div.querySelector("#onboarding-footer");
       let skipButton = this._window.document.createElement("button");
       skipButton.id = "onboarding-skip-tour-button";
       skipButton.classList.add("onboarding-action-button");
       skipButton.textContent = this._bundle.GetStringFromName("onboarding.skip-tour-button-label");
       footer.appendChild(skipButton);
     }
-    let closeBtn = div.querySelector("#onboarding-overlay-close-btn");
-    closeBtn.setAttribute("title",
-      this._bundle.GetStringFromName("onboarding.overlay-close-button-tooltip"));
+
     return div;
   }
 

browser/extensions/pdfjs/content/PdfjsChromeUtils.jsm

@@ -68,8 +68,7 @@ var PdfjsChromeUtils = {
     this._browsers = new WeakSet();
     if (!this._ppmm) {
       // global parent process message manager (PPMM)
-      this._ppmm = Cc["@mozilla.org/parentprocessmessagemanager;1"].
-        getService(Ci.nsIMessageBroadcaster);
+      this._ppmm = Services.ppmm;
       this._ppmm.addMessageListener("PDFJS:Parent:clearUserPref", this);
       this._ppmm.addMessageListener("PDFJS:Parent:setIntPref", this);
       this._ppmm.addMessageListener("PDFJS:Parent:setBoolPref", this);
@@ -78,8 +77,7 @@ var PdfjsChromeUtils = {
       this._ppmm.addMessageListener("PDFJS:Parent:isDefaultHandlerApp", this);
 
       // global dom message manager (MMg)
-      this._mmg = Cc["@mozilla.org/globalmessagemanager;1"].
-        getService(Ci.nsIMessageListenerManager);
+      this._mmg = Services.mm;
       this._mmg.addMessageListener("PDFJS:Parent:displayWarning", this);
 
       this._mmg.addMessageListener("PDFJS:Parent:addEventListener", this);

browser/extensions/pdfjs/content/PdfjsContentUtils.jsm

@@ -35,8 +35,7 @@ var PdfjsContentUtils = {
     // child *process* mm, or when loaded into the parent for in-content
     // support the psuedo child process mm 'child PPMM'.
     if (!this._mm) {
-      this._mm = Cc["@mozilla.org/childprocessmessagemanager;1"].
-        getService(Ci.nsISyncMessageSender);
+      this._mm = Services.cpmm;
       this._mm.addMessageListener("PDFJS:Child:updateSettings", this);
 
       Services.obs.addObserver(this, "quit-application");

browser/extensions/pocket/bootstrap.js

@@ -408,9 +408,7 @@ var PocketOverlay = {
     }
   },
   shutdown(reason) {
-    let ppmm = Cc["@mozilla.org/parentprocessmessagemanager;1"]
-                 .getService(Ci.nsIMessageBroadcaster);
-    ppmm.broadcastAsyncMessage("PocketShuttingDown");
+    Services.ppmm.broadcastAsyncMessage("PocketShuttingDown");
     Services.obs.removeObserver(this, "browser-delayed-startup-finished");
     // Although the ppmm loads the scripts into the chrome process as well,
     // we need to manually unregister here anyway to ensure these aren't part

browser/modules/AboutHome.jsm

@@ -178,8 +178,7 @@ var AboutHome = {
       if (target && target.messageManager) {
         target.messageManager.sendAsyncMessage("AboutHome:Update", data);
       } else {
-        let mm = Cc["@mozilla.org/globalmessagemanager;1"].getService(Ci.nsIMessageListenerManager);
-        mm.broadcastAsyncMessage("AboutHome:Update", data);
+        Services.mm.broadcastAsyncMessage("AboutHome:Update", data);
       }
     }).catch(function onError(x) {
       Cu.reportError("Error in AboutHome.sendAboutHomeData: " + x);

browser/modules/ContentCrashHandlers.jsm

@@ -995,12 +995,10 @@ var PluginCrashReporter = {
         // Only the parent process gets the gmp-plugin-crash observer
         // notification, so we need to inform any content processes that
         // the GMP has crashed.
-        if (Cc["@mozilla.org/parentprocessmessagemanager;1"]) {
+        if (Services.ppmm) {
           let pluginName = propertyBag.getPropertyAsAString("pluginName");
-          let mm = Cc["@mozilla.org/parentprocessmessagemanager;1"]
-            .getService(Ci.nsIMessageListenerManager);
-          mm.broadcastAsyncMessage("gmp-plugin-crash",
-                                   { pluginName, pluginID });
+          Services.ppmm.broadcastAsyncMessage("gmp-plugin-crash",
+                                              { pluginName, pluginID });
         }
         break;
       }

browser/modules/ContentSearch.jsm

@@ -489,9 +489,7 @@ var ContentSearch = {
   },
 
   _broadcast(type, data) {
-    Cc["@mozilla.org/globalmessagemanager;1"].
-      getService(Ci.nsIMessageListenerManager).
-      broadcastAsyncMessage(...this._msgArgs(type, data));
+    Services.mm.broadcastAsyncMessage(...this._msgArgs(type, data));
   },
 
   _msgArgs(type, data) {

devtools/client/jsonview/converter-child.js

@@ -6,7 +6,7 @@
 
 "use strict";
 
-const {Cc, Ci, Cu, CC} = require("chrome");
+const {Ci, Cu, CC} = require("chrome");
 const { XPCOMUtils } = require("resource://gre/modules/XPCOMUtils.jsm");
 const Services = require("Services");
 
@@ -17,9 +17,6 @@ loader.lazyGetter(this, "debug", function () {
   return !!(AppConstants.DEBUG || AppConstants.DEBUG_JS_MODULES);
 });
 
-const childProcessMessageManager =
-  Cc["@mozilla.org/childprocessmessagemanager;1"]
-    .getService(Ci.nsISyncMessageSender);
 const BinaryInput = CC("@mozilla.org/binaryinputstream;1",
                        "nsIBinaryInputStream", "setInputStream");
 const BufferStream = CC("@mozilla.org/io/arraybuffer-input-stream;1",
@@ -304,7 +301,7 @@ function onContentMessage(e) {
   let value = e.detail.value;
   switch (e.detail.type) {
     case "save":
-      childProcessMessageManager.sendAsyncMessage(
+      Services.cpmm.sendAsyncMessage(
         "devtools:jsonview:save", value);
   }
 }

devtools/client/netmonitor/test/browser_net_view-source-debugger.js

@@ -23,7 +23,7 @@ add_task(async function () {
   await waitForContentRequests;
 
   info("Clicking stack-trace tab and waiting for stack-trace panel to open");
-  let wait = waitForDOM(document, "#stack-trace-panel .frame-link", 4);
+  let wait = waitForDOM(document, "#stack-trace-panel .frame-link", 5);
   // Click on the first request
   EventUtils.sendMouseEvent({ type: "mousedown" },
     document.querySelector(".request-list-item"));

devtools/client/shared/test/browser_html_tooltip-03.js

@@ -131,7 +131,10 @@ function* createTooltip(doc, autofocus) {
   let div = doc.createElementNS(HTML_NS, "div");
   div.classList.add("tooltip-content");
   div.style.height = "50px";
-  div.innerHTML = '<input type="text"></input>';
+
+  let input = doc.createElementNS(HTML_NS, "input");
+  input.setAttribute("type", "text");
+  div.appendChild(input);
 
   tooltip.setContent(div, {width: 150, height: 50});
   return tooltip;

devtools/client/shared/widgets/FilterWidget.js

@@ -150,43 +150,83 @@ exports.CSSFilterEditorWidget = CSSFilterEditorWidget;
 
 CSSFilterEditorWidget.prototype = {
   _initMarkup: function () {
-    let filterListSelectPlaceholder =
-      L10N.getStr("filterListSelectPlaceholder");
-    let addNewFilterButton = L10N.getStr("addNewFilterButton");
-    let presetsToggleButton = L10N.getStr("presetsToggleButton");
-    let newPresetPlaceholder = L10N.getStr("newPresetPlaceholder");
-    let savePresetButton = L10N.getStr("savePresetButton");
+    // The following structure is created:
+    //   <div class="filters-list">
+    //     <div id="filters"></div>
+    //     <div class="footer">
+    //       <select value="">
+    //         <option value="">${filterListSelectPlaceholder}</option>
+    //       </select>
+    //       <button id="add-filter" class="add">${addNewFilterButton}</button>
+    //       <button id="toggle-presets">${presetsToggleButton}</button>
+    //     </div>
+    //   </div>
+    //   <div class="presets-list">
+    //     <div id="presets"></div>
+    //     <div class="footer">
+    //       <input value="" class="devtools-textinput"
+    //              placeholder="${newPresetPlaceholder}"></input>
+    //       <button class="add">${savePresetButton}</button>
+    //     </div>
+    //   </div>
+    let content = this.doc.createDocumentFragment();
 
-    // eslint-disable-next-line no-unsanitized/property
-    this.el.innerHTML = `
-      <div class="filters-list">
-        <div id="filters"></div>
-        <div class="footer">
-          <select value="">
-            <option value="">${filterListSelectPlaceholder}</option>
-          </select>
-          <button id="add-filter" class="add">${addNewFilterButton}</button>
-          <button id="toggle-presets">${presetsToggleButton}</button>
-        </div>
-      </div>
+    let filterListWrapper = this.doc.createElementNS(XHTML_NS, "div");
+    filterListWrapper.classList.add("filters-list");
+    content.appendChild(filterListWrapper);
 
-      <div class="presets-list">
-        <div id="presets"></div>
-        <div class="footer">
-          <input value="" class="devtools-textinput"
-                 placeholder="${newPresetPlaceholder}"></input>
-          <button class="add">${savePresetButton}</button>
-        </div>
-      </div>
-    `;
-    this.filtersList = this.el.querySelector("#filters");
-    this.presetsList = this.el.querySelector("#presets");
-    this.togglePresets = this.el.querySelector("#toggle-presets");
-    this.filterSelect = this.el.querySelector("select");
-    this.addPresetButton = this.el.querySelector(".presets-list .add");
-    this.addPresetInput = this.el.querySelector(".presets-list .footer input");
+    this.filterList = this.doc.createElementNS(XHTML_NS, "div");
+    this.filterList.setAttribute("id", "filters");
+    filterListWrapper.appendChild(this.filterList);
 
-    this.el.querySelector(".presets-list input").value = "";
+    let filterListFooter = this.doc.createElementNS(XHTML_NS, "div");
+    filterListFooter.classList.add("footer");
+    filterListWrapper.appendChild(filterListFooter);
+
+    this.filterSelect = this.doc.createElementNS(XHTML_NS, "select");
+    this.filterSelect.setAttribute("value", "");
+    filterListFooter.appendChild(this.filterSelect);
+
+    let filterListPlaceholder = this.doc.createElementNS(XHTML_NS, "option");
+    filterListPlaceholder.setAttribute("value", "");
+    filterListPlaceholder.textContent = L10N.getStr("filterListSelectPlaceholder");
+    this.filterSelect.appendChild(filterListPlaceholder);
+
+    let addFilter = this.doc.createElementNS(XHTML_NS, "button");
+    addFilter.setAttribute("id", "add-filter");
+    addFilter.classList.add("add");
+    addFilter.textContent = L10N.getStr("addNewFilterButton");
+    filterListFooter.appendChild(addFilter);
+
+    this.togglePresets = this.doc.createElementNS(XHTML_NS, "button");
+    this.togglePresets.setAttribute("id", "toggle-presets");
+    this.togglePresets.textContent = L10N.getStr("presetsToggleButton");
+    filterListFooter.appendChild(this.togglePresets);
+
+    let presetListWrapper = this.doc.createElementNS(XHTML_NS, "div");
+    presetListWrapper.classList.add("presets-list");
+    content.appendChild(presetListWrapper);
+
+    this.presetList = this.doc.createElementNS(XHTML_NS, "div");
+    this.presetList.setAttribute("id", "presets");
+    presetListWrapper.appendChild(this.presetList);
+
+    let presetListFooter = this.doc.createElementNS(XHTML_NS, "div");
+    presetListFooter.classList.add("footer");
+    presetListWrapper.appendChild(presetListFooter);
+
+    this.addPresetInput = this.doc.createElementNS(XHTML_NS, "input");
+    this.addPresetInput.setAttribute("value", "");
+    this.addPresetInput.classList.add("devtools-textinput");
+    this.addPresetInput.setAttribute("placeholder", L10N.getStr("newPresetPlaceholder"));
+    presetListFooter.appendChild(this.addPresetInput);
+
+    this.addPresetButton = this.doc.createElementNS(XHTML_NS, "button");
+    this.addPresetButton.classList.add("add");
+    this.addPresetButton.textContent = L10N.getStr("savePresetButton");
+    presetListFooter.appendChild(this.addPresetButton);
+
+    this.el.appendChild(content);
 
     this._populateFilterSelect();
   },
@@ -194,8 +234,8 @@ CSSFilterEditorWidget.prototype = {
   _destroyMarkup: function () {
     this._filterItemMarkup.remove();
     this.el.remove();
-    this.el = this.filtersList = this._filterItemMarkup = null;
-    this.presetsList = this.togglePresets = this.filterSelect = null;
+    this.el = this.filterList = this._filterItemMarkup = null;
+    this.presetList = this.togglePresets = this.filterSelect = null;
     this.addPresetButton = null;
   },
 
@@ -277,12 +317,12 @@ CSSFilterEditorWidget.prototype = {
   _addEventListeners: function () {
     this.addButton = this.el.querySelector("#add-filter");
     this.addButton.addEventListener("click", this._addButtonClick);
-    this.filtersList.addEventListener("click", this._removeButtonClick);
-    this.filtersList.addEventListener("mousedown", this._mouseDown);
-    this.filtersList.addEventListener("keydown", this._keyDown);
+    this.filterList.addEventListener("click", this._removeButtonClick);
+    this.filterList.addEventListener("mousedown", this._mouseDown);
+    this.filterList.addEventListener("keydown", this._keyDown);
     this.el.addEventListener("mousedown", this._resetFocus);
 
-    this.presetsList.addEventListener("click", this._presetClick);
+    this.presetList.addEventListener("click", this._presetClick);
     this.togglePresets.addEventListener("click", this._togglePresets);
     this.addPresetButton.addEventListener("click", this._savePreset);
 
@@ -292,17 +332,17 @@ CSSFilterEditorWidget.prototype = {
     this.win.addEventListener("mouseup", this._mouseUp);
 
     // Used to workaround float-precision problems
-    this.filtersList.addEventListener("input", this._input);
+    this.filterList.addEventListener("input", this._input);
   },
 
   _removeEventListeners: function () {
     this.addButton.removeEventListener("click", this._addButtonClick);
-    this.filtersList.removeEventListener("click", this._removeButtonClick);
-    this.filtersList.removeEventListener("mousedown", this._mouseDown);
-    this.filtersList.removeEventListener("keydown", this._keyDown);
+    this.filterList.removeEventListener("click", this._removeButtonClick);
+    this.filterList.removeEventListener("mousedown", this._mouseDown);
+    this.filterList.removeEventListener("keydown", this._keyDown);
     this.el.removeEventListener("mousedown", this._resetFocus);
 
-    this.presetsList.removeEventListener("click", this._presetClick);
+    this.presetList.removeEventListener("click", this._presetClick);
     this.togglePresets.removeEventListener("click", this._togglePresets);
     this.addPresetButton.removeEventListener("click", this._savePreset);
 
@@ -311,11 +351,11 @@ CSSFilterEditorWidget.prototype = {
     this.win.removeEventListener("mouseup", this._mouseUp);
 
     // Used to workaround float-precision problems
-    this.filtersList.removeEventListener("input", this._input);
+    this.filterList.removeEventListener("input", this._input);
   },
 
   _getFilterElementIndex: function (el) {
-    return [...this.filtersList.children].indexOf(el);
+    return [...this.filterList.children].indexOf(el);
   },
 
   _keyDown: function (e) {
@@ -454,7 +494,7 @@ CSSFilterEditorWidget.prototype = {
   },
 
   _dragFilterElement: function (e) {
-    const rect = this.filtersList.getBoundingClientRect();
+    const rect = this.filterList.getBoundingClientRect();
     let top = e.pageY - LIST_PADDING;
     let bottom = e.pageY + LIST_PADDING;
     // don't allow dragging over top/bottom of list
@@ -462,7 +502,7 @@ CSSFilterEditorWidget.prototype = {
       return;
     }
 
-    const filterEl = this.filtersList.querySelector(".dragging");
+    const filterEl = this.filterList.querySelector(".dragging");
 
     const delta = e.pageY - filterEl.startingY;
     filterEl.style.top = delta + "px";
@@ -476,7 +516,7 @@ CSSFilterEditorWidget.prototype = {
       change = Math.ceil(change);
     }
 
-    const children = this.filtersList.children;
+    const children = this.filterList.children;
     const index = [...children].indexOf(filterEl);
     const destination = index + change;
 
@@ -492,9 +532,9 @@ CSSFilterEditorWidget.prototype = {
     const target = change > 0 ? children[destination + 1]
                               : children[destination];
     if (target) {
-      this.filtersList.insertBefore(filterEl, target);
+      this.filterList.insertBefore(filterEl, target);
     } else {
-      this.filtersList.appendChild(filterEl);
+      this.filterList.appendChild(filterEl);
     }
 
     filterEl.removeAttribute("style");
@@ -545,7 +585,7 @@ CSSFilterEditorWidget.prototype = {
     if (!this.isReorderingFilter) {
       return;
     }
-    let filterEl = this.filtersList.querySelector(".dragging");
+    let filterEl = this.filterList.querySelector(".dragging");
 
     this.isReorderingFilter = false;
     filterEl.classList.remove("dragging");
@@ -626,13 +666,13 @@ CSSFilterEditorWidget.prototype = {
   render: function () {
     if (!this.filters.length) {
   // eslint-disable-next-line no-unsanitized/property
-      this.filtersList.innerHTML = `<p> ${L10N.getStr("emptyFilterList")} <br />
+      this.filterList.innerHTML = `<p> ${L10N.getStr("emptyFilterList")} <br />
                                  ${L10N.getStr("addUsingList")} </p>`;
       this.emit("render");
       return;
     }
 
-    this.filtersList.innerHTML = "";
+    this.filterList.innerHTML = "";
 
     let base = this._filterItemMarkup;
 
@@ -682,11 +722,11 @@ CSSFilterEditorWidget.prototype = {
         unitPreview.remove();
       }
 
-      this.filtersList.appendChild(el);
+      this.filterList.appendChild(el);
     }
 
     let lastInput =
-        this.filtersList.querySelector(".filter:last-of-type input");
+        this.filterList.querySelector(".filter:last-of-type input");
     if (lastInput) {
       lastInput.focus();
       if (lastInput.type === "text") {
@@ -702,19 +742,19 @@ CSSFilterEditorWidget.prototype = {
   renderPresets: function () {
     this.getPresets().then(presets => {
       // getPresets is async and the widget may be destroyed in between.
-      if (!this.presetsList) {
+      if (!this.presetList) {
         return;
       }
 
       if (!presets || !presets.length) {
       // eslint-disable-next-line no-unsanitized/property
-        this.presetsList.innerHTML = `<p>${L10N.getStr("emptyPresetList")}</p>`;
+        this.presetList.innerHTML = `<p>${L10N.getStr("emptyPresetList")}</p>`;
         this.emit("render");
         return;
       }
       let base = this._presetItemMarkup;
 
-      this.presetsList.innerHTML = "";
+      this.presetList.innerHTML = "";
 
       for (let [index, preset] of presets.entries()) {
         let el = base.cloneNode(true);
@@ -726,7 +766,7 @@ CSSFilterEditorWidget.prototype = {
         label.textContent = preset.name;
         span.textContent = preset.value;
 
-        this.presetsList.appendChild(el);
+        this.presetList.appendChild(el);
       }
 
       this.emit("render");

devtools/client/sourceeditor/README

@@ -54,7 +54,7 @@ are licensed according to the contents in the LICENSE file.
 diff --git a/devtools/client/sourceeditor/codemirror/addon/search/search.js b/devtools/client/sourceeditor/codemirror/addon/search/search.js
 --- a/devtools/client/sourceeditor/codemirror/addon/search/search.js
 +++ b/devtools/client/sourceeditor/codemirror/addon/search/search.js
-@@ -92,32 +92,47 @@
+@@ -93,32 +93,47 @@
      } else {
        query = parseString(query)
      }
@@ -64,7 +64,7 @@ diff --git a/devtools/client/sourceeditor/codemirror/addon/search/search.js b/de
    }
 
 -  var queryDialog =
--    'Search: <input type="text" style="width: 10em" class="CodeMirror-search-field"/> <span style="color: #888" class="CodeMirror-search-hint">(Use /re/ syntax for regexp search)</span>';
+-    '<span class="CodeMirror-search-label">Search:</span> <input type="text" style="width: 10em" class="CodeMirror-search-field"/> <span style="color: #888" class="CodeMirror-search-hint">(Use /re/ syntax for regexp search)</span>';
 +  var queryDialog;
 
    function startSearch(cm, state, query) {
@@ -79,7 +79,7 @@ diff --git a/devtools/client/sourceeditor/codemirror/addon/search/search.js b/de
      }
    }
 
-   function doSearch(cm, rev, persistent) {
+   function doSearch(cm, rev, persistent, immediate) {
 +    if (!queryDialog) {
 +      let doc = cm.getWrapperElement().ownerDocument;
 +      let inp = doc.createElement("input");
@@ -99,11 +99,132 @@ diff --git a/devtools/client/sourceeditor/codemirror/addon/search/search.js b/de
      var state = getSearchState(cm);
      if (state.query) return findNext(cm, rev);
      var q = cm.getSelection() || state.lastQuery;
+     if (q instanceof RegExp && q.source == "x^") q = null
      if (persistent && cm.openDialog) {
        var hiding = null
-       persistentDialog(cm, queryDialog, q, function(query, event) {
+       var searchNext = function(query, event) {
          CodeMirror.e_stop(event);
-         if (!query) return;
+@@ -181,56 +196,110 @@
+     var state = getSearchState(cm);
+     state.lastQuery = state.query;
+     if (!state.query) return;
+     state.query = state.queryText = null;
+     cm.removeOverlay(state.overlay);
+     if (state.annotate) { state.annotate.clear(); state.annotate = null; }
+   });}
+ 
+-  var replaceQueryDialog =
+-    ' <input type="text" style="width: 10em" class="CodeMirror-search-field"/> <span style="color: #888" class="CodeMirror-search-hint">(Use /re/ syntax for regexp search)</span>';
+-  var replacementQueryDialog = '<span class="CodeMirror-search-label">With:</span> <input type="text" style="width: 10em" class="CodeMirror-search-field"/>';
+-  var doReplaceConfirm = '<span class="CodeMirror-search-label">Replace?</span> <button>Yes</button> <button>No</button> <button>All</button> <button>Stop</button>';
+-
+   function replaceAll(cm, query, text) {
+     cm.operation(function() {
+       for (var cursor = getSearchCursor(cm, query); cursor.findNext();) {
+         if (typeof query != "string") {
+           var match = cm.getRange(cursor.from(), cursor.to()).match(query);
+           cursor.replace(text.replace(/\$(\d)/g, function(_, i) {return match[i];}));
+         } else cursor.replace(text);
+       }
+     });
+   }
+ 
+   function replace(cm, all) {
+     if (cm.getOption("readOnly")) return;
+     var query = cm.getSelection() || getSearchState(cm).lastQuery;
+-    var dialogText = '<span class="CodeMirror-search-label">' + (all ? 'Replace all:' : 'Replace:') + '</span>';
+-    dialog(cm, dialogText + replaceQueryDialog, dialogText, query, function(query) {
++
++    let doc = cm.getWrapperElement().ownerDocument;
++
++    // `searchLabel` is used as part of `replaceQueryFragment` and as a separate
++    // argument by itself, so it should be cloned.
++    let searchLabel = doc.createElement("span");
++    searchLabel.classList.add("CodeMirror-search-label");
++    searchLabel.textContent = all ? "Replace all:" : "Replace:";
++
++    let replaceQueryFragment = doc.createDocumentFragment();
++    replaceQueryFragment.appendChild(searchLabel.cloneNode(true));
++
++    let searchField = doc.createElement("input");
++    searchField.setAttribute("type", "text");
++    searchField.setAttribute("style", "width: 10em");
++    searchField.classList.add("CodeMirror-search-field");
++    replaceQueryFragment.appendChild(searchField);
++
++    let searchHint = doc.createElement("span");
++    searchHint.setAttribute("style", "color: #888");
++    searchHint.classList.add("CodeMirror-search-hint");
++    searchHint.textContent = "(Use /re/ syntax for regexp search)";
++    replaceQueryFragment.appendChild(searchHint);
++
++    dialog(cm, replaceQueryFragment, searchLabel, query, function(query) {
+       if (!query) return;
+       query = parseQuery(query);
+-      dialog(cm, replacementQueryDialog, "Replace with:", "", function(text) {
++
++      let replacementQueryFragment = doc.createDocumentFragment();
++
++      let replaceWithLabel = searchLabel.cloneNode(false);
++      replaceWithLabel.textContent = "With:";
++      replacementQueryFragment.appendChild(replaceWithLabel);
++
++      let replaceField = doc.createElement("input");
++      replaceField.setAttribute("type", "text");
++      replaceField.setAttribute("style", "width: 10em");
++      replaceField.classList.add("CodeMirror-search-field");
++      replacementQueryFragment.appendChild(replaceField);
++
++      dialog(cm, replacementQueryFragment, "Replace with:", "", function(text) {
+         text = parseString(text)
+         if (all) {
+           replaceAll(cm, query, text)
+         } else {
+           clearSearch(cm);
+           var cursor = getSearchCursor(cm, query, cm.getCursor("from"));
+           var advance = function() {
+             var start = cursor.from(), match;
+             if (!(match = cursor.findNext())) {
+               cursor = getSearchCursor(cm, query);
+               if (!(match = cursor.findNext()) ||
+                   (start && cursor.from().line == start.line && cursor.from().ch == start.ch)) return;
+             }
+             cm.setSelection(cursor.from(), cursor.to());
+-            cm.scrollIntoView({from: cursor.from(), to: cursor.to()});
+-            confirmDialog(cm, doReplaceConfirm, "Replace?",
++            cm.scrollIntoView({ from: cursor.from(), to: cursor.to() });
++
++            let replaceConfirmFragment = doc.createDocumentFragment();
++
++            let replaceConfirmLabel = searchLabel.cloneNode(false);
++            replaceConfirmLabel.textContent = "Replace?";
++            replaceConfirmFragment.appendChild(replaceConfirmLabel);
++
++            let yesButton = doc.createElement("button");
++            yesButton.textContent = "Yes";
++            replaceConfirmFragment.appendChild(yesButton);
++
++            let noButton = doc.createElement("button");
++            noButton.textContent = "No";
++            replaceConfirmFragment.appendChild(noButton);
++
++            let allButton = doc.createElement("button");
++            allButton.textContent = "All";
++            replaceConfirmFragment.appendChild(allButton);
++
++            let stopButton = doc.createElement("button");
++            stopButton.textContent = "Stop";
++            replaceConfirmFragment.appendChild(stopButton);
++
++            confirmDialog(cm, replaceConfirmFragment, "Replace?",
+                           [function() {doReplace(match);}, advance,
+                            function() {replaceAll(cm, query, text)}]);
+           };
+           var doReplace = function(match) {
+             cursor.replace(typeof query == "string" ? text :
+                            text.replace(/\$(\d)/g, function(_, i) {return match[i];}));
+             advance();
+           };
 
 # Footnotes
 

devtools/client/sourceeditor/codemirror/addon/search/search.js

@@ -201,11 +201,6 @@
     if (state.annotate) { state.annotate.clear(); state.annotate = null; }
   });}
 
-  var replaceQueryDialog =
-    ' <input type="text" style="width: 10em" class="CodeMirror-search-field"/> <span style="color: #888" class="CodeMirror-search-hint">(Use /re/ syntax for regexp search)</span>';
-  var replacementQueryDialog = '<span class="CodeMirror-search-label">With:</span> <input type="text" style="width: 10em" class="CodeMirror-search-field"/>';
-  var doReplaceConfirm = '<span class="CodeMirror-search-label">Replace?</span> <button>Yes</button> <button>No</button> <button>All</button> <button>Stop</button>';
-
   function replaceAll(cm, query, text) {
     cm.operation(function() {
       for (var cursor = getSearchCursor(cm, query); cursor.findNext();) {
@@ -220,11 +215,47 @@
   function replace(cm, all) {
     if (cm.getOption("readOnly")) return;
     var query = cm.getSelection() || getSearchState(cm).lastQuery;
-    var dialogText = '<span class="CodeMirror-search-label">' + (all ? 'Replace all:' : 'Replace:') + '</span>';
-    dialog(cm, dialogText + replaceQueryDialog, dialogText, query, function(query) {
+
+    let doc = cm.getWrapperElement().ownerDocument;
+
+    // `searchLabel` is used as part of `replaceQueryFragment` and as a separate
+    // argument by itself, so it should be cloned.
+    let searchLabel = doc.createElement("span");
+    searchLabel.classList.add("CodeMirror-search-label");
+    searchLabel.textContent = all ? "Replace all:" : "Replace:";
+
+    let replaceQueryFragment = doc.createDocumentFragment();
+    replaceQueryFragment.appendChild(searchLabel.cloneNode(true));
+
+    let searchField = doc.createElement("input");
+    searchField.setAttribute("type", "text");
+    searchField.setAttribute("style", "width: 10em");
+    searchField.classList.add("CodeMirror-search-field");
+    replaceQueryFragment.appendChild(searchField);
+
+    let searchHint = doc.createElement("span");
+    searchHint.setAttribute("style", "color: #888");
+    searchHint.classList.add("CodeMirror-search-hint");
+    searchHint.textContent = "(Use /re/ syntax for regexp search)";
+    replaceQueryFragment.appendChild(searchHint);
+
+    dialog(cm, replaceQueryFragment, searchLabel, query, function(query) {
       if (!query) return;
       query = parseQuery(query);
-      dialog(cm, replacementQueryDialog, "Replace with:", "", function(text) {
+
+      let replacementQueryFragment = doc.createDocumentFragment();
+
+      let replaceWithLabel = searchLabel.cloneNode(false);
+      replaceWithLabel.textContent = "With:";
+      replacementQueryFragment.appendChild(replaceWithLabel);
+
+      let replaceField = doc.createElement("input");
+      replaceField.setAttribute("type", "text");
+      replaceField.setAttribute("style", "width: 10em");
+      replaceField.classList.add("CodeMirror-search-field");
+      replacementQueryFragment.appendChild(replaceField);
+
+      dialog(cm, replacementQueryFragment, "Replace with:", "", function(text) {
         text = parseString(text)
         if (all) {
           replaceAll(cm, query, text)
@@ -239,8 +270,31 @@
                   (start && cursor.from().line == start.line && cursor.from().ch == start.ch)) return;
             }
             cm.setSelection(cursor.from(), cursor.to());
-            cm.scrollIntoView({from: cursor.from(), to: cursor.to()});
-            confirmDialog(cm, doReplaceConfirm, "Replace?",
+            cm.scrollIntoView({ from: cursor.from(), to: cursor.to() });
+
+            let replaceConfirmFragment = doc.createDocumentFragment();
+
+            let replaceConfirmLabel = searchLabel.cloneNode(false);
+            replaceConfirmLabel.textContent = "Replace?";
+            replaceConfirmFragment.appendChild(replaceConfirmLabel);
+
+            let yesButton = doc.createElement("button");
+            yesButton.textContent = "Yes";
+            replaceConfirmFragment.appendChild(yesButton);
+
+            let noButton = doc.createElement("button");
+            noButton.textContent = "No";
+            replaceConfirmFragment.appendChild(noButton);
+
+            let allButton = doc.createElement("button");
+            allButton.textContent = "All";
+            replaceConfirmFragment.appendChild(allButton);
+
+            let stopButton = doc.createElement("button");
+            stopButton.textContent = "Stop";
+            replaceConfirmFragment.appendChild(stopButton);
+
+            confirmDialog(cm, replaceConfirmFragment, "Replace?",
                           [function() {doReplace(match);}, advance,
                            function() {replaceAll(cm, query, text)}]);
           };

devtools/client/sourceeditor/codemirror/codemirror.bundle.js

@@ -10407,11 +10407,6 @@ var CodeMirror =
 	    if (state.annotate) { state.annotate.clear(); state.annotate = null; }
 	  });}
 
-	  var replaceQueryDialog =
-	    ' <input type="text" style="width: 10em" class="CodeMirror-search-field"/> <span style="color: #888" class="CodeMirror-search-hint">(Use /re/ syntax for regexp search)</span>';
-	  var replacementQueryDialog = '<span class="CodeMirror-search-label">With:</span> <input type="text" style="width: 10em" class="CodeMirror-search-field"/>';
-	  var doReplaceConfirm = '<span class="CodeMirror-search-label">Replace?</span> <button>Yes</button> <button>No</button> <button>All</button> <button>Stop</button>';
-
 	  function replaceAll(cm, query, text) {
 	    cm.operation(function() {
 	      for (var cursor = getSearchCursor(cm, query); cursor.findNext();) {
@@ -10426,11 +10421,47 @@ var CodeMirror =
 	  function replace(cm, all) {
 	    if (cm.getOption("readOnly")) return;
 	    var query = cm.getSelection() || getSearchState(cm).lastQuery;
-	    var dialogText = '<span class="CodeMirror-search-label">' + (all ? 'Replace all:' : 'Replace:') + '</span>';
-	    dialog(cm, dialogText + replaceQueryDialog, dialogText, query, function(query) {
+
+	    let doc = cm.getWrapperElement().ownerDocument;
+
+	    // `searchLabel` is used as part of `replaceQueryFragment` and as a separate
+	    // argument by itself, so it should be cloned.
+	    let searchLabel = doc.createElement("span");
+	    searchLabel.classList.add("CodeMirror-search-label");
+	    searchLabel.textContent = all ? "Replace all:" : "Replace:";
+
+	    let replaceQueryFragment = doc.createDocumentFragment();
+	    replaceQueryFragment.appendChild(searchLabel.cloneNode(true));
+
+	    let searchField = doc.createElement("input");
+	    searchField.setAttribute("type", "text");
+	    searchField.setAttribute("style", "width: 10em");
+	    searchField.classList.add("CodeMirror-search-field");
+	    replaceQueryFragment.appendChild(searchField);
+
+	    let searchHint = doc.createElement("span");
+	    searchHint.setAttribute("style", "color: #888");
+	    searchHint.classList.add("CodeMirror-search-hint");
+	    searchHint.textContent = "(Use /re/ syntax for regexp search)";
+	    replaceQueryFragment.appendChild(searchHint);
+
+	    dialog(cm, replaceQueryFragment, searchLabel, query, function(query) {
 	      if (!query) return;
 	      query = parseQuery(query);
-	      dialog(cm, replacementQueryDialog, "Replace with:", "", function(text) {
+
+	      let replacementQueryFragment = doc.createDocumentFragment();
+
+	      let replaceWithLabel = searchLabel.cloneNode(false);
+	      replaceWithLabel.textContent = "With:";
+	      replacementQueryFragment.appendChild(replaceWithLabel);
+
+	      let replaceField = doc.createElement("input");
+	      replaceField.setAttribute("type", "text");
+	      replaceField.setAttribute("style", "width: 10em");
+	      replaceField.classList.add("CodeMirror-search-field");
+	      replacementQueryFragment.appendChild(replaceField);
+
+	      dialog(cm, replacementQueryFragment, "Replace with:", "", function(text) {
 	        text = parseString(text)
 	        if (all) {
 	          replaceAll(cm, query, text)
@@ -10445,8 +10476,31 @@ var CodeMirror =
 	                  (start && cursor.from().line == start.line && cursor.from().ch == start.ch)) return;
 	            }
 	            cm.setSelection(cursor.from(), cursor.to());
-	            cm.scrollIntoView({from: cursor.from(), to: cursor.to()});
-	            confirmDialog(cm, doReplaceConfirm, "Replace?",
+	            cm.scrollIntoView({ from: cursor.from(), to: cursor.to() });
+
+	            let replaceConfirmFragment = doc.createDocumentFragment();
+
+	            let replaceConfirmLabel = searchLabel.cloneNode(false);
+	            replaceConfirmLabel.textContent = "Replace?";
+	            replaceConfirmFragment.appendChild(replaceConfirmLabel);
+
+	            let yesButton = doc.createElement("button");
+	            yesButton.textContent = "Yes";
+	            replaceConfirmFragment.appendChild(yesButton);
+
+	            let noButton = doc.createElement("button");
+	            noButton.textContent = "No";
+	            replaceConfirmFragment.appendChild(noButton);
+
+	            let allButton = doc.createElement("button");
+	            allButton.textContent = "All";
+	            replaceConfirmFragment.appendChild(allButton);
+
+	            let stopButton = doc.createElement("button");
+	            stopButton.textContent = "Stop";
+	            replaceConfirmFragment.appendChild(stopButton);
+
+	            confirmDialog(cm, replaceConfirmFragment, "Replace?",
 	                          [function() {doReplace(match);}, advance,
 	                           function() {replaceAll(cm, query, text)}]);
 	          };

devtools/client/webaudioeditor/test/browser_wa_properties-view-media-nodes.js

@@ -20,12 +20,10 @@ function waitForDeviceClosed() {
 
   return new Promise((resolve, reject) => {
     const message = "webrtc:UpdateGlobalIndicators";
-    let ppmm = Cc["@mozilla.org/parentprocessmessagemanager;1"]
-                 .getService(Ci.nsIMessageBroadcaster);
-    ppmm.addMessageListener(message, function listener(aMessage) {
+    Services.ppmm.addMessageListener(message, function listener(aMessage) {
       info("Received " + message + " message");
       if (!aMessage.data.showGlobalIndicator) {
-        ppmm.removeMessageListener(message, listener);
+        Services.ppmm.removeMessageListener(message, listener);
         resolve();
       }
     });

devtools/server/actors/process.js

@@ -4,11 +4,10 @@
 
 "use strict";
 
-var { Cc, Ci } = require("chrome");
+var { Cc } = require("chrome");
 
 loader.lazyGetter(this, "ppmm", () => {
-  return Cc["@mozilla.org/parentprocessmessagemanager;1"].getService(
-    Ci.nsIMessageBroadcaster);
+  return Cc["@mozilla.org/parentprocessmessagemanager;1"].getService();
 });
 
 function ProcessActorList() {

devtools/server/actors/root.js

@@ -6,15 +6,11 @@
 
 "use strict";
 
-const { Cc, Ci, Cu } = require("chrome");
+const { Cu } = require("chrome");
 const Services = require("Services");
 const { ActorPool, appendExtraActors, createExtraActors } = require("devtools/server/actors/common");
 const { DebuggerServer } = require("devtools/server/main");
 
-loader.lazyGetter(this, "ppmm", () => {
-  return Cc["@mozilla.org/parentprocessmessagemanager;1"].getService(
-    Ci.nsIMessageBroadcaster);
-});
 loader.lazyRequireGetter(this, "WindowActor",
   "devtools/server/actors/window", true);
 
@@ -547,7 +543,7 @@ RootActor.prototype = {
     }
 
     let { id } = request;
-    let mm = ppmm.getChildAt(id);
+    let mm = Services.ppmm.getChildAt(id);
     if (!mm) {
       return { error: "noProcess",
                message: "There is no process with id '" + id + "'." };

devtools/server/actors/storage.js

@@ -4,7 +4,7 @@
 
 "use strict";
 
-const {Cc, Ci, Cu, CC} = require("chrome");
+const {Ci, Cu, CC} = require("chrome");
 const protocol = require("devtools/shared/protocol");
 const {LongStringActor} = require("devtools/server/actors/string");
 const {DebuggerServer} = require("devtools/server/main");
@@ -1938,20 +1938,14 @@ StorageActors.createActor({
 
 var indexedDBHelpers = {
   backToChild(...args) {
-    let mm = Cc["@mozilla.org/globalmessagemanager;1"]
-               .getService(Ci.nsIMessageListenerManager);
-
-    mm.broadcastAsyncMessage("debug:storage-indexedDB-request-child", {
+    Services.mm.broadcastAsyncMessage("debug:storage-indexedDB-request-child", {
       method: "backToChild",
       args: args
     });
   },
 
   onItemUpdated(action, host, path) {
-    let mm = Cc["@mozilla.org/globalmessagemanager;1"]
-               .getService(Ci.nsIMessageListenerManager);
-
-    mm.broadcastAsyncMessage("debug:storage-indexedDB-request-child", {
+    Services.mm.broadcastAsyncMessage("debug:storage-indexedDB-request-child", {
       method: "onItemUpdated",
       args: [ action, host, path ]
     });

devtools/server/actors/webconsole/content-process-forward.js

@@ -7,9 +7,6 @@
 const { Services } = ChromeUtils.import("resource://gre/modules/Services.jsm", {});
 const { XPCOMUtils } = ChromeUtils.import("resource://gre/modules/XPCOMUtils.jsm", {});
 
-XPCOMUtils.defineLazyServiceGetter(this, "cpmm",
-                                   "@mozilla.org/childprocessmessagemanager;1",
-                                   "nsIMessageSender");
 ChromeUtils.defineModuleGetter(this, "E10SUtils",
                                "resource://gre/modules/E10SUtils.jsm");
 
@@ -37,7 +34,7 @@ const MSG_MGR_CONSOLE_INFO_MAX = 1024;
 function ContentProcessForward() {
   Services.obs.addObserver(this, "console-api-log-event");
   Services.obs.addObserver(this, "xpcom-shutdown");
-  cpmm.addMessageListener("DevTools:StopForwardingContentProcessMessage", this);
+  Services.cpmm.addMessageListener("DevTools:StopForwardingContentProcessMessage", this);
 }
 ContentProcessForward.prototype = {
   QueryInterface: XPCOMUtils.generateQI([Ci.nsIObserver,
@@ -108,7 +105,7 @@ ContentProcessForward.prototype = {
           }
         }
 
-        cpmm.sendAsyncMessage("Console:Log", msgData);
+        Services.cpmm.sendAsyncMessage("Console:Log", msgData);
         break;
       }
 
@@ -121,7 +118,8 @@ ContentProcessForward.prototype = {
   uninit() {
     Services.obs.removeObserver(this, "console-api-log-event");
     Services.obs.removeObserver(this, "xpcom-shutdown");
-    cpmm.removeMessageListener("DevTools:StopForwardingContentProcessMessage", this);
+    Services.cpmm.removeMessageListener("DevTools:StopForwardingContentProcessMessage",
+                                        this);
   }
 };
 

devtools/server/content-server.jsm

@@ -49,7 +49,6 @@ function setupServer(mm) {
 
 function init(msg) {
   let mm = msg.target;
-  mm.QueryInterface(Ci.nsISyncMessageSender);
   let prefix = msg.data.prefix;
 
   // Using the JS debugger causes problems when we're trying to

devtools/server/tests/mochitest/inspector-traversal-data.html

@@ -25,7 +25,18 @@
       let host = document.querySelector("#shadow");
       if (host.createShadowRoot) {
         let root = host.createShadowRoot();
-        root.innerHTML = "<h3>Shadow <em>DOM</em></h3><select multiple></select>";
+
+        let h3 = document.createElement("h3");
+        h3.append("Shadow ");
+
+        let em = document.createElement("em");
+        em.append("DOM");
+
+        let select = document.createElement("select");
+        select.setAttribute("multiple", "");
+        h3.appendChild(em);
+        root.appendChild(h3);
+        root.appendChild(select);
       }
 
       // Put a copy of the body in an iframe to test frame traversal.

devtools/server/tests/mochitest/setup-in-child.js

@@ -1,8 +1,7 @@
 "use strict";
 
-const {Cc, Ci} = require("chrome");
-const cpmm = Cc["@mozilla.org/childprocessmessagemanager;1"]
-             .getService(Ci.nsIMessageListenerManager);
+const {Cc} = require("chrome");
+const cpmm = Cc["@mozilla.org/childprocessmessagemanager;1"].getService();
 const { DebuggerServer } = require("devtools/server/main");
 
 exports.setupChild = function (a, b, c) {

devtools/server/tests/mochitest/test_setupInParentChild.html

@@ -49,10 +49,8 @@ function runTests() {
   let client = new DebuggerClient(transport);
 
   // Wait for a response from setupInChild
-  const ppmm = Cc["@mozilla.org/parentprocessmessagemanager;1"]
-                 .getService(Ci.nsIMessageListenerManager);
   let onChild = msg => {
-    ppmm.removeMessageListener("test:setupChild", onChild);
+    Services.ppmm.removeMessageListener("test:setupChild", onChild);
     let args = msg.json;
 
     is(args[0], 1, "Got first numeric argument");
@@ -65,7 +63,7 @@ function runTests() {
       setupChild: "callParent"
     });
   };
-  ppmm.addMessageListener("test:setupChild", onChild);
+  Services.ppmm.addMessageListener("test:setupChild", onChild);
 
   // Wait also for a reponse from setupInParent called from setup-in-child.js
   let onParent = (_, topic, args) => {

docshell/base/nsDocShell.cpp

@@ -649,11 +649,10 @@ nsDocShell::GetInterface(const nsIID& aIID, void** aSink)
     *aSink = GetTabChild().take();
     return *aSink ? NS_OK : NS_ERROR_FAILURE;
   } else if (aIID.Equals(NS_GET_IID(nsIContentFrameMessageManager))) {
-    nsCOMPtr<nsITabChild> tabChild =
-      do_GetInterface(static_cast<nsIDocShell*>(this));
+    RefPtr<TabChild> tabChild = TabChild::GetFrom(this);
     nsCOMPtr<nsIContentFrameMessageManager> mm;
     if (tabChild) {
-      tabChild->GetMessageManager(getter_AddRefs(mm));
+      mm = tabChild->GetMessageManager();
     } else {
       if (nsPIDOMWindowOuter* win = GetWindow()) {
         mm = do_QueryInterface(win->GetParentTarget());

dom/base/ChildProcessMessageManager.h

@@ -0,0 +1,42 @@
+/* -*- Mode: C++; tab-width: 8; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
+/* vim: set ts=8 sts=2 et sw=2 tw=80: */
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+#ifndef mozilla_dom_ChildProcessMessageManager_h
+#define mozilla_dom_ChildProcessMessageManager_h
+
+#include "mozilla/dom/SyncMessageSender.h"
+#include "mozilla/dom/MessageManagerBinding.h"
+
+namespace mozilla {
+namespace dom {
+
+class ChildProcessMessageManager final : public SyncMessageSender
+{
+public:
+  explicit ChildProcessMessageManager(ipc::MessageManagerCallback* aCallback)
+    : SyncMessageSender(aCallback,
+                        MessageManagerFlags::MM_PROCESSMANAGER |
+                        MessageManagerFlags::MM_OWNSCALLBACK)
+  {
+    mozilla::HoldJSObjects(this);
+  }
+
+  virtual JSObject* WrapObject(JSContext* aCx, JS::Handle<JSObject*> aGivenProto) override
+  {
+    return ChildProcessMessageManagerBinding::Wrap(aCx, this, aGivenProto);
+  }
+
+protected:
+  virtual ~ChildProcessMessageManager()
+  {
+    mozilla::DropJSObjects(this);
+  }
+};
+
+} // namespace dom
+} // namespace mozilla
+
+#endif // mozilla_dom_ChildProcessMessageManager_h

dom/base/ChromeMessageBroadcaster.cpp

@@ -0,0 +1,47 @@
+/* -*- Mode: C++; tab-width: 8; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
+/* vim: set ts=8 sts=2 et sw=2 tw=80: */
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+#include "mozilla/dom/ChromeMessageBroadcaster.h"
+#include "AccessCheck.h"
+#include "mozilla/HoldDropJSObjects.h"
+#include "mozilla/dom/MessageManagerBinding.h"
+
+namespace mozilla {
+namespace dom {
+
+ChromeMessageBroadcaster::ChromeMessageBroadcaster(nsFrameMessageManager* aParentManager,
+                                                   MessageManagerFlags aFlags)
+  : MessageListenerManager(nullptr, aParentManager,
+                           aFlags |
+                           MessageManagerFlags::MM_BROADCASTER |
+                           MessageManagerFlags::MM_CHROME)
+{
+  if (mIsProcessManager) {
+    mozilla::HoldJSObjects(this);
+  }
+  if (aParentManager) {
+    aParentManager->AddChildManager(this);
+  }
+}
+
+ChromeMessageBroadcaster::~ChromeMessageBroadcaster()
+{
+  if (mIsProcessManager) {
+    mozilla::DropJSObjects(this);
+  }
+}
+
+JSObject*
+ChromeMessageBroadcaster::WrapObject(JSContext* aCx,
+                                     JS::Handle<JSObject*> aGivenProto)
+{
+  MOZ_ASSERT(nsContentUtils::IsSystemCaller(aCx));
+
+  return ChromeMessageBroadcasterBinding::Wrap(aCx, this, aGivenProto);
+}
+
+} // namespace dom
+} // namespace mozilla

dom/base/ChromeMessageBroadcaster.h

@@ -0,0 +1,95 @@
+/* -*- Mode: C++; tab-width: 8; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
+/* vim: set ts=8 sts=2 et sw=2 tw=80: */
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+#ifndef mozilla_dom_ChromeMessageBroadcaster_h
+#define mozilla_dom_ChromeMessageBroadcaster_h
+
+#include "mozilla/dom/MessageListenerManager.h"
+
+namespace mozilla {
+namespace dom {
+
+class ChromeMessageBroadcaster final : public MessageListenerManager
+{
+public:
+  explicit ChromeMessageBroadcaster(MessageManagerFlags aFlags)
+    : ChromeMessageBroadcaster(nullptr, aFlags)
+  {
+    MOZ_ASSERT(!(aFlags & ~(MessageManagerFlags::MM_GLOBAL |
+                            MessageManagerFlags::MM_PROCESSMANAGER |
+                            MessageManagerFlags::MM_OWNSCALLBACK)));
+  }
+  explicit ChromeMessageBroadcaster(nsFrameMessageManager* aParentManager)
+    : ChromeMessageBroadcaster(aParentManager, MessageManagerFlags::MM_NONE)
+  {}
+
+  virtual JSObject* WrapObject(JSContext* aCx,
+                               JS::Handle<JSObject*> aGivenProto) override;
+
+  using nsFrameMessageManager::BroadcastAsyncMessage;
+  void BroadcastAsyncMessage(JSContext* aCx, const nsAString& aMessageName,
+                             JS::Handle<JS::Value> aObj,
+                             JS::Handle<JSObject*> aObjects,
+                             mozilla::ErrorResult& aError)
+  {
+    DispatchAsyncMessage(aCx, aMessageName, aObj, aObjects, nullptr,
+                         JS::UndefinedHandleValue, aError);
+  }
+  uint32_t ChildCount()
+  {
+    return mChildManagers.Length();
+  }
+  using nsFrameMessageManager::GetChildAt;
+  MessageListenerManager* GetChildAt(uint32_t aIndex)
+  {
+    return mChildManagers.SafeElementAt(aIndex);
+  }
+  // XPCOM ReleaseCachedProcesses is OK
+
+  // ProcessScriptLoader
+  using nsFrameMessageManager::LoadProcessScript;
+  void LoadProcessScript(const nsAString& aUrl, bool aAllowDelayedLoad,
+                         mozilla::ErrorResult& aError)
+  {
+    LoadScript(aUrl, aAllowDelayedLoad, false, aError);
+  }
+  // XPCOM RemoveDelayedProcessScript is OK
+  using nsFrameMessageManager::GetDelayedProcessScripts;
+  void GetDelayedProcessScripts(JSContext* aCx,
+                                nsTArray<nsTArray<JS::Value>>& aScripts,
+                                mozilla::ErrorResult& aError)
+  {
+    GetDelayedScripts(aCx, aScripts, aError);
+  }
+
+  // GlobalProcessScriptLoader
+  // XPCOM GetInitialProcessData is OK
+
+  // FrameScriptLoader
+  using nsFrameMessageManager::LoadFrameScript;
+  void LoadFrameScript(const nsAString& aUrl, bool aAllowDelayedLoad,
+                       bool aRunInGlobalScope, mozilla::ErrorResult& aError)
+  {
+    LoadScript(aUrl, aAllowDelayedLoad, aRunInGlobalScope, aError);
+  }
+  using nsFrameMessageManager::GetDelayedFrameScripts;
+  void GetDelayedFrameScripts(JSContext* aCx,
+                              nsTArray<nsTArray<JS::Value>>& aScripts,
+                              mozilla::ErrorResult& aError)
+  {
+    GetDelayedScripts(aCx, aScripts, aError);
+  }
+
+private:
+  ChromeMessageBroadcaster(nsFrameMessageManager* aParentManager,
+                           MessageManagerFlags aFlags);
+  virtual ~ChromeMessageBroadcaster();
+};
+
+} // namespace dom
+} // namespace mozilla
+
+#endif // mozilla_dom_ChromeMessageBroadcaster_h

dom/base/ChromeMessageSender.cpp

@@ -0,0 +1,41 @@
+/* -*- Mode: C++; tab-width: 8; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
+/* vim: set ts=8 sts=2 et sw=2 tw=80: */
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+#include "mozilla/dom/ChromeMessageSender.h"
+#include "mozilla/dom/MessageManagerBinding.h"
+
+namespace mozilla {
+namespace dom {
+
+ChromeMessageSender::ChromeMessageSender(ipc::MessageManagerCallback* aCallback,
+                                         nsFrameMessageManager* aParentManager,
+                                         MessageManagerFlags aFlags)
+  : MessageSender(aCallback, aParentManager, aFlags | MessageManagerFlags::MM_CHROME)
+{
+  MOZ_ASSERT(!(aFlags & ~(MessageManagerFlags::MM_GLOBAL |
+                          MessageManagerFlags::MM_PROCESSMANAGER |
+                          MessageManagerFlags::MM_OWNSCALLBACK)));
+
+  // This is a bit hackish. We attach to the parent, but only if we have a callback. We
+  // don't have a callback for the frame message manager, and for parent process message
+  // managers (except the parent in-process message manager). In those cases we wait until
+  // the child process is running (see MessageSender::InitWithCallback).
+  if (aParentManager && mCallback) {
+    aParentManager->AddChildManager(this);
+  }
+}
+
+JSObject*
+ChromeMessageSender::WrapObject(JSContext* aCx,
+                                JS::Handle<JSObject*> aGivenProto)
+{
+  MOZ_ASSERT(nsContentUtils::IsSystemCaller(aCx));
+
+  return ChromeMessageSenderBinding::Wrap(aCx, this, aGivenProto);
+}
+
+} // namespace dom
+} // namespace mozilla

dom/base/ChromeMessageSender.h

@@ -0,0 +1,60 @@
+/* -*- Mode: C++; tab-width: 8; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
+/* vim: set ts=8 sts=2 et sw=2 tw=80: */
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+#ifndef mozilla_dom_ChromeMessageSender_h
+#define mozilla_dom_ChromeMessageSender_h
+
+#include "mozilla/dom/MessageSender.h"
+
+namespace mozilla {
+namespace dom {
+
+class ChromeMessageSender final : public MessageSender
+{
+public:
+  ChromeMessageSender(ipc::MessageManagerCallback* aCallback,
+                      nsFrameMessageManager* aParentManager,
+                      MessageManagerFlags aFlags=MessageManagerFlags::MM_NONE);
+
+  virtual JSObject* WrapObject(JSContext* aCx,
+                               JS::Handle<JSObject*> aGivenProto) override;
+
+  // ProcessScriptLoader
+  using nsFrameMessageManager::LoadProcessScript;
+  void LoadProcessScript(const nsAString& aUrl, bool aAllowDelayedLoad,
+                         mozilla::ErrorResult& aError)
+  {
+    LoadScript(aUrl, aAllowDelayedLoad, false, aError);
+  }
+  // XPCOM RemoveDelayedProcessScript is OK
+  using nsFrameMessageManager::GetDelayedProcessScripts;
+  void GetDelayedProcessScripts(JSContext* aCx,
+                                nsTArray<nsTArray<JS::Value>>& aScripts,
+                                mozilla::ErrorResult& aError)
+  {
+    GetDelayedScripts(aCx, aScripts, aError);
+  }
+
+  // FrameScriptLoader
+  using nsFrameMessageManager::LoadFrameScript;
+  void LoadFrameScript(const nsAString& aUrl, bool aAllowDelayedLoad,
+                       bool aRunInGlobalScope, mozilla::ErrorResult& aError)
+  {
+    LoadScript(aUrl, aAllowDelayedLoad, aRunInGlobalScope, aError);
+  }
+  using nsFrameMessageManager::GetDelayedFrameScripts;
+  void GetDelayedFrameScripts(JSContext* aCx,
+                              nsTArray<nsTArray<JS::Value>>& aScripts,
+                              mozilla::ErrorResult& aError)
+  {
+    GetDelayedScripts(aCx, aScripts, aError);
+  }
+};
+
+} // namespace dom
+} // namespace mozilla
+
+#endif // mozilla_dom_ChromeMessageSender_h

dom/base/ContentFrameMessageManager.h

@@ -0,0 +1,95 @@
+/* -*- Mode: C++; tab-width: 8; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
+/* vim: set ts=8 sts=2 et sw=2 tw=80: */
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+#ifndef mozilla_dom_ContentFrameMessageManager_h
+#define mozilla_dom_ContentFrameMessageManager_h
+
+#include "mozilla/DOMEventTargetHelper.h"
+#include "mozilla/dom/MessageManagerGlobal.h"
+#include "mozilla/dom/ResolveSystemBinding.h"
+#include "nsContentUtils.h"
+
+namespace mozilla {
+namespace dom {
+
+/**
+ * Base class for implementing the WebIDL ContentFrameMessageManager class.
+ */
+class ContentFrameMessageManager : public DOMEventTargetHelper,
+                                   public MessageManagerGlobal
+{
+public:
+  using DOMEventTargetHelper::AddRef;
+  using DOMEventTargetHelper::Release;
+
+  bool DoResolve(JSContext* aCx, JS::Handle<JSObject*> aObj,
+                 JS::Handle<jsid> aId,
+                 JS::MutableHandle<JS::PropertyDescriptor> aDesc)
+  {
+    bool found;
+    if (!SystemGlobalResolve(aCx, aObj, aId, &found)) {
+      return false;
+    }
+    if (found) {
+      FillPropertyDescriptor(aDesc, aObj, JS::UndefinedValue(), false);
+    }
+    return true;
+  }
+  static bool MayResolve(jsid aId)
+  {
+    return MayResolveAsSystemBindingName(aId);
+  }
+  void GetOwnPropertyNames(JSContext* aCx, JS::AutoIdVector& aNames,
+                           bool aEnumerableOnly, mozilla::ErrorResult& aRv)
+  {
+    JS::Rooted<JSObject*> thisObj(aCx, GetWrapper());
+    GetSystemBindingNames(aCx, thisObj, aNames, aEnumerableOnly, aRv);
+  }
+
+  nsresult AddEventListener(const nsAString& aType,
+                            nsIDOMEventListener* aListener,
+                            bool aUseCapture)
+  {
+    // By default add listeners only for trusted events!
+    return DOMEventTargetHelper::AddEventListener(aType, aListener,
+                                                  aUseCapture, false, 2);
+  }
+  using DOMEventTargetHelper::AddEventListener;
+  NS_IMETHOD AddEventListener(const nsAString& aType,
+                              nsIDOMEventListener* aListener,
+                              bool aUseCapture, bool aWantsUntrusted,
+                              uint8_t optional_argc) override
+  {
+    return DOMEventTargetHelper::AddEventListener(aType, aListener,
+                                                  aUseCapture,
+                                                  aWantsUntrusted,
+                                                  optional_argc);
+  }
+
+  virtual already_AddRefed<nsPIDOMWindowOuter> GetContent(ErrorResult& aError) = 0;
+  virtual already_AddRefed<nsIDocShell> GetDocShell(ErrorResult& aError) = 0;
+  virtual already_AddRefed<nsIEventTarget> GetTabEventTarget() = 0;
+
+  nsFrameMessageManager* GetMessageManager()
+  {
+    return mMessageManager;
+  }
+  void DisconnectMessageManager()
+  {
+    mMessageManager->Disconnect();
+    mMessageManager = nullptr;
+  }
+
+protected:
+  explicit ContentFrameMessageManager(nsFrameMessageManager* aMessageManager)
+    : MessageManagerGlobal(aMessageManager)
+  {}
+};
+
+} // namespace dom
+} // namespace mozilla
+
+#endif // mozilla_dom_ContentFrameMessageManager_h

dom/base/DOMMatrix.cpp

@@ -12,8 +12,10 @@
 #include "mozilla/dom/DOMPointBinding.h"
 #include "mozilla/dom/BindingDeclarations.h"
 #include "mozilla/dom/ToJSValue.h"
+#include "mozilla/RuleNodeCacheConditions.h"
 #include "mozilla/ServoCSSParser.h"
 #include "nsCSSParser.h"
+#include "nsGlobalWindowInner.h"
 #include "nsStyleTransformMatrix.h"
 
 #include <math.h>

dom/base/DOMRequestHelper.jsm

@@ -21,10 +21,6 @@ var EXPORTED_SYMBOLS = ["DOMRequestIpcHelper"];
 ChromeUtils.import("resource://gre/modules/XPCOMUtils.jsm");
 ChromeUtils.import("resource://gre/modules/Services.jsm");
 
-XPCOMUtils.defineLazyServiceGetter(this, "cpmm",
-                                   "@mozilla.org/childprocessmessagemanager;1",
-                                   "nsIMessageListenerManager");
-
 function DOMRequestIpcHelper() {
   // _listeners keeps a list of messages for which we added a listener and the
   // kind of listener that we added (strong or weak). It's an object of this
@@ -89,8 +85,8 @@ DOMRequestIpcHelper.prototype = {
         }
       }
 
-      aMsg.weakRef ? cpmm.addWeakMessageListener(name, this)
-                   : cpmm.addMessageListener(name, this);
+      aMsg.weakRef ? Services.cpmm.addWeakMessageListener(name, this)
+                   : Services.cpmm.addMessageListener(name, this);
       this._listeners[name] = {
         weakRef: !!aMsg.weakRef,
         count: 1
@@ -120,8 +116,8 @@ DOMRequestIpcHelper.prototype = {
       // be waiting on a message.
       if (!--this._listeners[aName].count) {
         this._listeners[aName].weakRef ?
-            cpmm.removeWeakMessageListener(aName, this)
-          : cpmm.removeMessageListener(aName, this);
+            Services.cpmm.removeWeakMessageListener(aName, this)
+          : Services.cpmm.removeMessageListener(aName, this);
         delete this._listeners[aName];
       }
     });
@@ -181,8 +177,9 @@ DOMRequestIpcHelper.prototype = {
 
     if (this._listeners) {
       Object.keys(this._listeners).forEach((aName) => {
-        this._listeners[aName].weakRef ? cpmm.removeWeakMessageListener(aName, this)
-                                       : cpmm.removeMessageListener(aName, this);
+        this._listeners[aName].weakRef ?
+            Services.cpmm.removeWeakMessageListener(aName, this)
+          : Services.cpmm.removeMessageListener(aName, this);
       });
     }
 

dom/base/MessageListenerManager.cpp

@@ -0,0 +1,55 @@
+/* -*- Mode: C++; tab-width: 8; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
+/* vim: set ts=8 sts=2 et sw=2 tw=80: */
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+#include "mozilla/dom/MessageListenerManager.h"
+
+namespace mozilla {
+namespace dom {
+
+MessageListenerManager::MessageListenerManager(ipc::MessageManagerCallback* aCallback,
+                                               nsFrameMessageManager* aParentManager,
+                                               ipc::MessageManagerFlags aFlags)
+  : nsFrameMessageManager(aCallback, aFlags),
+    mParentManager(aParentManager)
+{
+}
+
+MessageListenerManager::~MessageListenerManager()
+{
+}
+
+NS_INTERFACE_MAP_BEGIN_CYCLE_COLLECTION(MessageListenerManager)
+  NS_WRAPPERCACHE_INTERFACE_MAP_ENTRY
+NS_INTERFACE_MAP_END_INHERITING(nsFrameMessageManager)
+NS_IMPL_ADDREF_INHERITED(MessageListenerManager, nsFrameMessageManager)
+NS_IMPL_RELEASE_INHERITED(MessageListenerManager, nsFrameMessageManager)
+
+NS_IMPL_CYCLE_COLLECTION_CLASS(MessageListenerManager)
+NS_IMPL_CYCLE_COLLECTION_TRAVERSE_BEGIN_INHERITED(MessageListenerManager,
+                                                  nsFrameMessageManager)
+  NS_IMPL_CYCLE_COLLECTION_TRAVERSE(mParentManager)
+NS_IMPL_CYCLE_COLLECTION_TRAVERSE_END
+NS_IMPL_CYCLE_COLLECTION_TRACE_BEGIN_INHERITED(MessageListenerManager,
+                                               nsFrameMessageManager)
+  NS_IMPL_CYCLE_COLLECTION_TRACE_PRESERVED_WRAPPER
+NS_IMPL_CYCLE_COLLECTION_TRACE_END
+NS_IMPL_CYCLE_COLLECTION_UNLINK_BEGIN_INHERITED(MessageListenerManager,
+                                                nsFrameMessageManager)
+  NS_IMPL_CYCLE_COLLECTION_UNLINK_PRESERVED_WRAPPER
+  NS_IMPL_CYCLE_COLLECTION_UNLINK(mParentManager)
+NS_IMPL_CYCLE_COLLECTION_UNLINK_END
+
+void
+MessageListenerManager::ClearParentManager(bool aRemove)
+{
+  if (aRemove && mParentManager) {
+    mParentManager->RemoveChildManager(this);
+  }
+  mParentManager = nullptr;
+}
+
+} // namespace dom
+} // namespace mozilla

dom/base/MessageListenerManager.h

@@ -0,0 +1,53 @@
+/* -*- Mode: C++; tab-width: 8; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
+/* vim: set ts=8 sts=2 et sw=2 tw=80: */
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+#ifndef mozilla_dom_MessageListenerManager_h
+#define mozilla_dom_MessageListenerManager_h
+
+#include "nsCycleCollectionNoteChild.h"
+#include "nsFrameMessageManager.h"
+#include "nsWrapperCache.h"
+
+namespace mozilla {
+namespace dom {
+
+class MessageListenerManager : public nsFrameMessageManager,
+                               public nsWrapperCache
+{
+public:
+  NS_DECL_ISUPPORTS_INHERITED
+  NS_DECL_CYCLE_COLLECTION_SCRIPT_HOLDER_CLASS_INHERITED(MessageListenerManager,
+                                                         nsFrameMessageManager)
+
+  nsISupports* GetParentObject()
+  {
+    return ToSupports(mParentManager.get());
+  }
+
+  virtual nsFrameMessageManager* GetParentManager() override
+  {
+    return mParentManager;
+  }
+
+  /**
+   * If aRemove is true then RemoveChildManager(this) will be called on the parent manager
+   * first.
+   */
+  virtual void ClearParentManager(bool aRemove) override;
+
+protected:
+  MessageListenerManager(ipc::MessageManagerCallback* aCallback,
+                         nsFrameMessageManager* aParentManager,
+                         MessageManagerFlags aFlags);
+  virtual ~MessageListenerManager();
+
+  RefPtr<nsFrameMessageManager> mParentManager;
+};
+
+} // namespace dom
+} // namespace mozilla
+
+#endif // mozilla_dom_MessageListenerManager_h

dom/base/MessageManagerGlobal.h

@@ -0,0 +1,181 @@
+/* -*- Mode: C++; tab-width: 8; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
+/* vim: set ts=8 sts=2 et sw=2 tw=80: */
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+#ifndef mozilla_dom_MessageManagerGlobal_h
+#define mozilla_dom_MessageManagerGlobal_h
+
+#include "nsFrameMessageManager.h"
+#include "mozilla/ErrorResult.h"
+
+namespace mozilla {
+namespace dom {
+
+/**
+ * Base class for implementing the WebIDL MessageManagerGlobal class.
+ */
+class MessageManagerGlobal
+{
+public:
+  // MessageListenerManager
+  void AddMessageListener(const nsAString& aMessageName,
+                          MessageListener& aListener,
+                          bool aListenWhenClosed,
+                          ErrorResult& aError)
+  {
+    if (!mMessageManager) {
+      aError.Throw(NS_ERROR_NULL_POINTER);
+      return;
+    }
+    mMessageManager->AddMessageListener(aMessageName, aListener,
+                                        aListenWhenClosed, aError);
+  }
+  void RemoveMessageListener(const nsAString& aMessageName,
+                             MessageListener& aListener,
+                             ErrorResult& aError)
+  {
+    if (!mMessageManager) {
+      aError.Throw(NS_ERROR_NULL_POINTER);
+      return;
+    }
+    mMessageManager->RemoveMessageListener(aMessageName, aListener, aError);
+  }
+  void AddWeakMessageListener(const nsAString& aMessageName,
+                              MessageListener& aListener,
+                              ErrorResult& aError)
+  {
+    if (!mMessageManager) {
+      aError.Throw(NS_ERROR_NULL_POINTER);
+      return;
+    }
+    mMessageManager->AddWeakMessageListener(aMessageName, aListener, aError);
+  }
+  void RemoveWeakMessageListener(const nsAString& aMessageName,
+                                 MessageListener& aListener,
+                                 ErrorResult& aError)
+  {
+    if (!mMessageManager) {
+      aError.Throw(NS_ERROR_NULL_POINTER);
+      return;
+    }
+    mMessageManager->RemoveWeakMessageListener(aMessageName, aListener, aError);
+  }
+
+  // MessageSender
+  void SendAsyncMessage(JSContext* aCx, const nsAString& aMessageName,
+                        JS::Handle<JS::Value> aObj,
+                        JS::Handle<JSObject*> aObjects,
+                        nsIPrincipal* aPrincipal,
+                        JS::Handle<JS::Value> aTransfers,
+                        ErrorResult& aError)
+  {
+    if (!mMessageManager) {
+      aError.Throw(NS_ERROR_NULL_POINTER);
+      return;
+    }
+    mMessageManager->SendAsyncMessage(aCx, aMessageName, aObj, aObjects,
+                                      aPrincipal, aTransfers, aError);
+  }
+  already_AddRefed<nsIMessageSender> GetProcessMessageManager(mozilla::ErrorResult& aError)
+  {
+    if (!mMessageManager) {
+      aError.Throw(NS_ERROR_NULL_POINTER);
+      return nullptr;
+    }
+    return mMessageManager->GetProcessMessageManager(aError);
+  }
+
+  void GetRemoteType(nsAString& aRemoteType, mozilla::ErrorResult& aError)
+  {
+    if (!mMessageManager) {
+      aError.Throw(NS_ERROR_NULL_POINTER);
+      return;
+    }
+    mMessageManager->GetRemoteType(aRemoteType, aError);
+  }
+
+  // SyncMessageSender
+  void SendSyncMessage(JSContext* aCx, const nsAString& aMessageName,
+                       JS::Handle<JS::Value> aObj,
+                       JS::Handle<JSObject*> aObjects,
+                       nsIPrincipal* aPrincipal,
+                       nsTArray<JS::Value>& aResult,
+                       ErrorResult& aError)
+  {
+    if (!mMessageManager) {
+      aError.Throw(NS_ERROR_NULL_POINTER);
+      return;
+    }
+    mMessageManager->SendSyncMessage(aCx, aMessageName, aObj, aObjects,
+                                     aPrincipal, aResult, aError);
+  }
+  void SendRpcMessage(JSContext* aCx, const nsAString& aMessageName,
+                      JS::Handle<JS::Value> aObj,
+                      JS::Handle<JSObject*> aObjects,
+                      nsIPrincipal* aPrincipal,
+                      nsTArray<JS::Value>& aResult,
+                      ErrorResult& aError)
+  {
+    if (!mMessageManager) {
+      aError.Throw(NS_ERROR_NULL_POINTER);
+      return;
+    }
+    mMessageManager->SendRpcMessage(aCx, aMessageName, aObj, aObjects,
+                                    aPrincipal, aResult, aError);
+  }
+
+  // MessageManagerGlobal
+  void Dump(const nsAString& aStr, ErrorResult& aError)
+  {
+    if (!mMessageManager) {
+      aError.Throw(NS_ERROR_NULL_POINTER);
+      return;
+    }
+    aError = mMessageManager->Dump(aStr);
+  }
+  void PrivateNoteIntentionalCrash(ErrorResult& aError)
+  {
+    if (!mMessageManager) {
+      aError.Throw(NS_ERROR_NULL_POINTER);
+      return;
+    }
+    aError = mMessageManager->PrivateNoteIntentionalCrash();
+  }
+  void Atob(const nsAString& aAsciiString, nsAString& aBase64Data,
+            ErrorResult& aError)
+  {
+    if (!mMessageManager) {
+      aError.Throw(NS_ERROR_NULL_POINTER);
+      return;
+    }
+    aError = mMessageManager->Atob(aAsciiString, aBase64Data);
+  }
+  void Btoa(const nsAString& aBase64Data, nsAString& aAsciiString,
+            ErrorResult& aError)
+  {
+    if (!mMessageManager) {
+      aError.Throw(NS_ERROR_NULL_POINTER);
+      return;
+    }
+    aError = mMessageManager->Btoa(aBase64Data, aAsciiString);
+  }
+
+  bool MarkForCC()
+  {
+    return mMessageManager && mMessageManager->MarkForCC();
+  }
+
+protected:
+  explicit MessageManagerGlobal(nsFrameMessageManager* aMessageManager)
+    : mMessageManager(aMessageManager)
+  {}
+
+  RefPtr<nsFrameMessageManager> mMessageManager;
+};
+
+} // namespace dom
+} // namespace mozilla
+
+#endif // mozilla_dom_MessageManagerGlobal_h

dom/base/MessageSender.cpp

@@ -0,0 +1,33 @@
+/* -*- Mode: C++; tab-width: 8; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
+/* vim: set ts=8 sts=2 et sw=2 tw=80: */
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+#include "mozilla/dom/MessageSender.h"
+
+namespace mozilla {
+namespace dom {
+
+void
+MessageSender::InitWithCallback(ipc::MessageManagerCallback* aCallback)
+{
+  if (mCallback) {
+    // Initialization should only happen once.
+    return;
+  }
+
+  SetCallback(aCallback);
+
+  // First load parent scripts by adding this to parent manager.
+  if (mParentManager) {
+    mParentManager->AddChildManager(this);
+  }
+
+  for (uint32_t i = 0; i < mPendingScripts.Length(); ++i) {
+    LoadFrameScript(mPendingScripts[i], false, mPendingScriptsGlobalStates[i]);
+  }
+}
+
+} // namespace dom
+} // namespace mozilla

dom/base/MessageSender.h

@@ -0,0 +1,31 @@
+/* -*- Mode: C++; tab-width: 8; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
+/* vim: set ts=8 sts=2 et sw=2 tw=80: */
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+#ifndef mozilla_dom_MessageSender_h
+#define mozilla_dom_MessageSender_h
+
+#include "mozilla/dom/MessageListenerManager.h"
+
+namespace mozilla {
+namespace dom {
+
+class MessageSender : public MessageListenerManager
+{
+public:
+  void InitWithCallback(ipc::MessageManagerCallback* aCallback);
+
+protected:
+  MessageSender(ipc::MessageManagerCallback* aCallback,
+                nsFrameMessageManager* aParentManager,
+                MessageManagerFlags aFlags)
+    : MessageListenerManager(aCallback, aParentManager, aFlags)
+  {}
+};
+
+} // namespace dom
+} // namespace mozilla
+
+#endif // mozilla_dom_MessageSender_h

dom/base/ProcessGlobal.cpp

@@ -7,17 +7,16 @@
 #include "ProcessGlobal.h"
 
 #include "nsContentCID.h"
-#include "nsDOMClassInfoID.h"
-#include "mozilla/HoldDropJSObjects.h"
+#include "mozilla/dom/MessageManagerBinding.h"
+#include "mozilla/dom/ResolveSystemBinding.h"
 
 using namespace mozilla;
 using namespace mozilla::dom;
 
 ProcessGlobal::ProcessGlobal(nsFrameMessageManager* aMessageManager)
- : mInitialized(false),
-   mMessageManager(aMessageManager)
+ : MessageManagerGlobal(aMessageManager),
+   mInitialized(false)
 {
-  SetIsNotDOMBinding();
   mozilla::HoldJSObjects(this);
 }
 
@@ -27,6 +26,36 @@ ProcessGlobal::~ProcessGlobal()
   mozilla::DropJSObjects(this);
 }
 
+bool
+ProcessGlobal::DoResolve(JSContext* aCx, JS::Handle<JSObject*> aObj,
+                         JS::Handle<jsid> aId,
+                         JS::MutableHandle<JS::PropertyDescriptor> aDesc)
+{
+    bool found;
+    if (!SystemGlobalResolve(aCx, aObj, aId, &found)) {
+      return false;
+    }
+    if (found) {
+      FillPropertyDescriptor(aDesc, aObj, JS::UndefinedValue(), false);
+    }
+    return true;
+}
+
+/* static */
+bool
+ProcessGlobal::MayResolve(jsid aId)
+{
+  return MayResolveAsSystemBindingName(aId);
+}
+
+void
+ProcessGlobal::GetOwnPropertyNames(JSContext* aCx, JS::AutoIdVector& aNames,
+                                   bool aEnumerableOnly, ErrorResult& aRv)
+{
+  JS::Rooted<JSObject*> thisObj(aCx, GetWrapper());
+  GetSystemBindingNames(aCx, thisObj, aNames, aEnumerableOnly, aRv);
+}
+
 ProcessGlobal*
 ProcessGlobal::Get()
 {
@@ -43,7 +72,7 @@ NS_IMETHODIMP_(bool)
 ProcessGlobal::MarkForCC()
 {
   MarkScopesForCC();
-  return mMessageManager ? mMessageManager->MarkForCC() : false;
+  return MessageManagerGlobal::MarkForCC();
 }
 
 NS_IMPL_CYCLE_COLLECTION_CLASS(ProcessGlobal)
@@ -75,7 +104,6 @@ NS_INTERFACE_MAP_BEGIN_CYCLE_COLLECTION(ProcessGlobal)
   NS_INTERFACE_MAP_ENTRY(nsIScriptObjectPrincipal)
   NS_INTERFACE_MAP_ENTRY(nsIGlobalObject)
   NS_INTERFACE_MAP_ENTRY(nsISupportsWeakReference)
-  NS_DOM_INTERFACE_MAP_ENTRY_CLASSINFO(ContentProcessMessageManager)
 NS_INTERFACE_MAP_END
 
 NS_IMPL_CYCLE_COLLECTING_ADDREF(ProcessGlobal)
@@ -89,15 +117,30 @@ ProcessGlobal::Init()
   }
   mInitialized = true;
 
-  nsISupports* scopeSupports = NS_ISUPPORTS_CAST(nsIContentProcessMessageManager*, this);
-  return InitChildGlobalInternal(scopeSupports, NS_LITERAL_CSTRING("processChildGlobal"));
+  return InitChildGlobalInternal(NS_LITERAL_CSTRING("processChildGlobal"));
+}
+
+bool
+ProcessGlobal::WrapGlobalObject(JSContext* aCx,
+                                JS::CompartmentOptions& aOptions,
+                                JS::MutableHandle<JSObject*> aReflector)
+{
+  bool ok = ContentProcessMessageManagerBinding::Wrap(aCx, this, this, aOptions,
+                                                      nsJSPrincipals::get(mPrincipal),
+                                                      true, aReflector);
+  if (ok) {
+    // Since we can't rewrap we have to preserve the global's wrapper here.
+    PreserveWrapper(ToSupports(this));
+  }
+  return ok;
 }
 
 void
 ProcessGlobal::LoadScript(const nsAString& aURL)
 {
   Init();
-  LoadScriptInternal(aURL, false);
+  JS::Rooted<JSObject*> global(mozilla::dom::RootingCx(), GetWrapper());
+  LoadScriptInternal(global, aURL, false);
 }
 
 void

dom/base/ProcessGlobal.h

@@ -8,6 +8,7 @@
 #define mozilla_dom_ProcessGlobal_h
 
 #include "mozilla/Attributes.h"
+#include "mozilla/dom/MessageManagerGlobal.h"
 #include "nsCOMPtr.h"
 #include "nsFrameMessageManager.h"
 #include "nsIScriptContext.h"
@@ -25,18 +26,26 @@ namespace mozilla {
 namespace dom {
 
 class ProcessGlobal :
-  public nsMessageManagerScriptExecutor,
   public nsIContentProcessMessageManager,
+  public nsMessageManagerScriptExecutor,
   public nsIGlobalObject,
   public nsIScriptObjectPrincipal,
   public nsSupportsWeakReference,
-  public mozilla::dom::ipc::MessageManagerCallback,
+  public ipc::MessageManagerCallback,
+  public MessageManagerGlobal,
   public nsWrapperCache
 {
 public:
   explicit ProcessGlobal(nsFrameMessageManager* aMessageManager);
 
-  using mozilla::dom::ipc::MessageManagerCallback::GetProcessMessageManager;
+  bool DoResolve(JSContext* aCx, JS::Handle<JSObject*> aObj,
+                 JS::Handle<jsid> aId,
+                 JS::MutableHandle<JS::PropertyDescriptor> aDesc);
+  static bool MayResolve(jsid aId);
+  void GetOwnPropertyNames(JSContext* aCx, JS::AutoIdVector& aNames,
+                           bool aEnumerableOnly, ErrorResult& aRv);
+
+  using ipc::MessageManagerCallback::GetProcessMessageManager;
 
   bool Init();
 
@@ -45,6 +54,41 @@ public:
   NS_DECL_CYCLE_COLLECTING_ISUPPORTS
   NS_DECL_CYCLE_COLLECTION_SCRIPT_HOLDER_CLASS_AMBIGUOUS(ProcessGlobal, nsIContentProcessMessageManager)
 
+  virtual JSObject* WrapObject(JSContext* aCx,
+                               JS::Handle<JSObject*> aGivenProto) override
+  {
+    MOZ_CRASH("We should never get here!");
+  }
+  virtual bool WrapGlobalObject(JSContext* aCx,
+                                JS::CompartmentOptions& aOptions,
+                                JS::MutableHandle<JSObject*> aReflector) override;
+
+  using MessageManagerGlobal::AddMessageListener;
+  using MessageManagerGlobal::RemoveMessageListener;
+  using MessageManagerGlobal::AddWeakMessageListener;
+  using MessageManagerGlobal::RemoveWeakMessageListener;
+  using MessageManagerGlobal::SendAsyncMessage;
+  using MessageManagerGlobal::GetProcessMessageManager;
+  using MessageManagerGlobal::GetRemoteType;
+  using MessageManagerGlobal::SendSyncMessage;
+  using MessageManagerGlobal::SendRpcMessage;
+  using MessageManagerGlobal::Dump;
+  using MessageManagerGlobal::PrivateNoteIntentionalCrash;
+  using MessageManagerGlobal::Atob;
+  using MessageManagerGlobal::Btoa;
+
+  // ContentProcessMessageManager
+  void GetInitialProcessData(JSContext* aCx,
+                             JS::MutableHandle<JS::Value> aInitialProcessData,
+                             ErrorResult& aError)
+  {
+    if (!mMessageManager) {
+      aError.Throw(NS_ERROR_NULL_POINTER);
+      return;
+    }
+    mMessageManager->GetInitialProcessData(aCx, aInitialProcessData, aError);
+  }
+
   NS_FORWARD_SAFE_NSIMESSAGELISTENERMANAGER(mMessageManager)
   NS_FORWARD_SAFE_NSIMESSAGESENDER(mMessageManager)
   NS_FORWARD_SAFE_NSISYNCMESSAGESENDER(mMessageManager)
@@ -55,15 +99,10 @@ public:
 
   virtual JSObject* GetGlobalJSObject() override
   {
-    return mGlobal;
+    return GetWrapper();
   }
   virtual nsIPrincipal* GetPrincipal() override { return mPrincipal; }
 
-  virtual JSObject* WrapObject(JSContext* cx, JS::Handle<JSObject*> aGivenProto) override
-  {
-    MOZ_CRASH("ProcessGlobal doesn't use DOM bindings!");
-  }
-
   void SetInitialProcessData(JS::HandleValue aInitialData);
 
 protected:
@@ -71,7 +110,6 @@ protected:
 
 private:
   bool mInitialized;
-  RefPtr<nsFrameMessageManager> mMessageManager;
 };
 
 } // namespace dom

dom/base/SyncMessageSender.h

@@ -0,0 +1,27 @@
+/* -*- Mode: C++; tab-width: 8; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
+/* vim: set ts=8 sts=2 et sw=2 tw=80: */
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+#ifndef mozilla_dom_SyncMessageSender_h
+#define mozilla_dom_SyncMessageSender_h
+
+#include "mozilla/dom/MessageSender.h"
+
+namespace mozilla {
+namespace dom {
+
+class SyncMessageSender : public MessageSender
+{
+protected:
+  SyncMessageSender(ipc::MessageManagerCallback* aCallback,
+                    MessageManagerFlags aFlags)
+    : MessageSender(aCallback, nullptr, aFlags)
+  {}
+};
+
+} // namespace dom
+} // namespace mozilla
+
+#endif // mozilla_dom_SyncMessageSender_h

dom/base/TextInputProcessor.cpp

@@ -18,6 +18,7 @@
 #include "nsPIDOMWindow.h"
 #include "nsPresContext.h"
 
+using mozilla::dom::KeyboardEvent;
 using namespace mozilla::widget;
 
 namespace mozilla {

dom/base/TimeoutExecutor.cpp

@@ -8,6 +8,7 @@
 
 #include "mozilla/dom/TimeoutManager.h"
 #include "nsComponentManagerUtils.h"
+#include "nsIEventTarget.h"
 #include "nsString.h"
 
 namespace mozilla {

dom/base/TimeoutManager.h

@@ -12,6 +12,7 @@
 
 class nsIEventTarget;
 class nsITimeoutHandler;
+class nsITimer;
 class nsGlobalWindowInner;
 
 namespace mozilla {

dom/base/moz.build

@@ -156,9 +156,13 @@ EXPORTS.mozilla.dom += [
     'BodyUtil.h',
     'BorrowedAttrInfo.h',
     'ChildIterator.h',
+    'ChildProcessMessageManager.h',
+    'ChromeMessageBroadcaster.h',
+    'ChromeMessageSender.h',
     'ChromeNodeList.h',
     'ChromeUtils.h',
     'Comment.h',
+    'ContentFrameMessageManager.h',
     'CustomElementRegistry.h',
     'DirectionalityUtils.h',
     'DispatcherTrait.h',
@@ -195,6 +199,9 @@ EXPORTS.mozilla.dom += [
     'IntlUtils.h',
     'Link.h',
     'Location.h',
+    'MessageListenerManager.h',
+    'MessageManagerGlobal.h',
+    'MessageSender.h',
     'NameSpaceConstants.h',
     'Navigator.h',
     'NodeInfo.h',
@@ -212,6 +219,7 @@ EXPORTS.mozilla.dom += [
     'StructuredCloneTags.h',
     'StyleSheetList.h',
     'SubtleCrypto.h',
+    'SyncMessageSender.h',
     'TabGroup.h',
     'Text.h',
     'Timeout.h',
@@ -234,6 +242,8 @@ UNIFIED_SOURCES += [
     'BodyUtil.cpp',
     'BorrowedAttrInfo.cpp',
     'ChildIterator.cpp',
+    'ChromeMessageBroadcaster.cpp',
+    'ChromeMessageSender.cpp',
     'ChromeNodeList.cpp',
     'ChromeUtils.cpp',
     'Comment.cpp',
@@ -269,6 +279,8 @@ UNIFIED_SOURCES += [
     'IntlUtils.cpp',
     'Link.cpp',
     'Location.cpp',
+    'MessageListenerManager.cpp',
+    'MessageSender.cpp',
     'Navigator.cpp',
     'NodeInfo.cpp',
     'NodeIterator.cpp',

dom/base/nsCCUncollectableMarker.cpp

@@ -17,7 +17,6 @@
 #include "nsISHistory.h"
 #include "nsISHEntry.h"
 #include "nsISHContainer.h"
-#include "nsITabChild.h"
 #include "nsIWindowWatcher.h"
 #include "mozilla/Services.h"
 #include "nsIXULWindow.h"
@@ -33,6 +32,7 @@
 #include "mozilla/EventListenerManager.h"
 #include "mozilla/dom/Element.h"
 #include "mozilla/dom/ProcessGlobal.h"
+#include "mozilla/dom/TabChild.h"
 #include "mozilla/dom/TimeoutManager.h"
 #include "xpcpublic.h"
 #include "nsObserverService.h"
@@ -311,11 +311,9 @@ MarkWindowList(nsISimpleEnumerator* aWindowList, bool aCleanupJS,
 
       MarkDocShell(rootDocShell, aCleanupJS, aPrepareForCC);
 
-      nsCOMPtr<nsITabChild> tabChild =
-        rootDocShell ? rootDocShell->GetTabChild() : nullptr;
+      RefPtr<TabChild> tabChild = TabChild::GetFrom(rootDocShell);
       if (tabChild) {
-        nsCOMPtr<nsIContentFrameMessageManager> mm;
-        tabChild->GetMessageManager(getter_AddRefs(mm));
+        nsCOMPtr<nsIContentFrameMessageManager> mm = tabChild->GetMessageManager();
         if (mm) {
           // MarkForCC ends up calling UnmarkGray on message listeners, which
           // TraceBlackJS can't do yet.
@@ -533,7 +531,7 @@ mozilla::dom::TraceBlackJS(JSTracer* aTrc, bool aIsShutdownGC)
           if (ds) {
             nsCOMPtr<nsITabChild> tabChild = ds->GetTabChild();
             if (tabChild) {
-              nsCOMPtr<nsIContentFrameMessageManager> mm;
+              nsCOMPtr<nsISupports> mm;
               tabChild->GetMessageManager(getter_AddRefs(mm));
               nsCOMPtr<EventTarget> et = do_QueryInterface(mm);
               if (et) {

dom/base/nsContentIterator.cpp

@@ -18,6 +18,7 @@
 #include "nsElementTable.h"
 
 using mozilla::DebugOnly;
+using mozilla::Move;
 using mozilla::RawRangeBoundary;
 
 // couple of utility static functs

dom/base/nsContentUtils.cpp

@@ -5239,6 +5239,7 @@ nsContentUtils::ParseFragmentHTML(const nsAString& aSourceBuffer,
 
     nsTreeSanitizer sanitizer(nsIParserUtils::SanitizerAllowStyle |
                               nsIParserUtils::SanitizerAllowComments |
+                              nsIParserUtils::SanitizerDropForms |
                               nsIParserUtils::SanitizerLogRemovals);
     sanitizer.Sanitize(fragment);
 
@@ -5333,6 +5334,7 @@ nsContentUtils::ParseFragmentXML(const nsAString& aSourceBuffer,
 
     nsTreeSanitizer sanitizer(nsIParserUtils::SanitizerAllowStyle |
                               nsIParserUtils::SanitizerAllowComments |
+                              nsIParserUtils::SanitizerDropForms |
                               nsIParserUtils::SanitizerLogRemovals);
     sanitizer.Sanitize(fragment);
   }

dom/base/nsDOMClassInfo.cpp

@@ -73,7 +73,6 @@
 // includes needed for the prototype chain interfaces
 
 #include "nsIEventListenerService.h"
-#include "nsIMessageManager.h"
 
 #include "mozilla/dom/TouchEvent.h"
 
@@ -131,9 +130,6 @@ using namespace mozilla::dom;
 #define NS_DEFINE_CLASSINFO_DATA(_class, _helper, _flags)                     \
   NS_DEFINE_CLASSINFO_DATA_HELPER(_class, _helper, _flags, false, false)
 
-#define NS_DEFINE_CHROME_ONLY_CLASSINFO_DATA(_class, _helper, _flags)         \
-  NS_DEFINE_CLASSINFO_DATA_HELPER(_class, _helper, _flags, true, false)
-
 #define NS_DEFINE_CHROME_XBL_CLASSINFO_DATA(_class, _helper, _flags)          \
   NS_DEFINE_CLASSINFO_DATA_HELPER(_class, _helper, _flags, true, true)
 
@@ -168,22 +164,6 @@ static nsDOMClassInfoData sClassInfoData[] = {
 
   // Misc Core related classes
 
-  NS_DEFINE_CHROME_ONLY_CLASSINFO_DATA(ContentFrameMessageManager,
-                                       nsMessageManagerSH<nsEventTargetSH>,
-                                       DOM_DEFAULT_SCRIPTABLE_FLAGS |
-                                       XPC_SCRIPTABLE_WANT_ENUMERATE |
-                                       XPC_SCRIPTABLE_IS_GLOBAL_OBJECT)
-  NS_DEFINE_CHROME_ONLY_CLASSINFO_DATA(ContentProcessMessageManager,
-                                       nsMessageManagerSH<nsDOMGenericSH>,
-                                       DOM_DEFAULT_SCRIPTABLE_FLAGS |
-                                       XPC_SCRIPTABLE_WANT_ENUMERATE |
-                                       XPC_SCRIPTABLE_IS_GLOBAL_OBJECT)
-  NS_DEFINE_CHROME_ONLY_CLASSINFO_DATA(ChromeMessageBroadcaster, nsDOMGenericSH,
-                                       DOM_DEFAULT_SCRIPTABLE_FLAGS)
-  NS_DEFINE_CHROME_ONLY_CLASSINFO_DATA(ChromeMessageSender, nsDOMGenericSH,
-                                       DOM_DEFAULT_SCRIPTABLE_FLAGS)
-
-
   NS_DEFINE_CHROME_XBL_CLASSINFO_DATA(XULControlElement, nsDOMGenericSH,
                                       DOM_DEFAULT_SCRIPTABLE_FLAGS)
   NS_DEFINE_CHROME_XBL_CLASSINFO_DATA(XULLabeledControlElement, nsDOMGenericSH,
@@ -425,36 +405,6 @@ nsDOMClassInfo::Init()
     DOM_CLASSINFO_MAP_ENTRY(nsIDOMDOMConstructor)
   DOM_CLASSINFO_MAP_END
 
-  DOM_CLASSINFO_MAP_BEGIN_NO_CLASS_IF(ContentFrameMessageManager, nsISupports)
-    DOM_CLASSINFO_MAP_ENTRY(nsIDOMEventTarget)
-    DOM_CLASSINFO_MAP_ENTRY(nsIMessageListenerManager)
-    DOM_CLASSINFO_MAP_ENTRY(nsIMessageSender)
-    DOM_CLASSINFO_MAP_ENTRY(nsISyncMessageSender)
-    DOM_CLASSINFO_MAP_ENTRY(nsIContentFrameMessageManager)
-  DOM_CLASSINFO_MAP_END
-
-  DOM_CLASSINFO_MAP_BEGIN_NO_CLASS_IF(ContentProcessMessageManager, nsISupports)
-    DOM_CLASSINFO_MAP_ENTRY(nsIMessageListenerManager)
-    DOM_CLASSINFO_MAP_ENTRY(nsIMessageSender)
-    DOM_CLASSINFO_MAP_ENTRY(nsISyncMessageSender)
-    DOM_CLASSINFO_MAP_ENTRY(nsIContentProcessMessageManager)
-  DOM_CLASSINFO_MAP_END
-
-  DOM_CLASSINFO_MAP_BEGIN_NO_CLASS_IF(ChromeMessageBroadcaster, nsISupports)
-    DOM_CLASSINFO_MAP_ENTRY(nsIFrameScriptLoader)
-    DOM_CLASSINFO_MAP_ENTRY(nsIProcessScriptLoader)
-    DOM_CLASSINFO_MAP_ENTRY(nsIGlobalProcessScriptLoader)
-    DOM_CLASSINFO_MAP_ENTRY(nsIMessageListenerManager)
-    DOM_CLASSINFO_MAP_ENTRY(nsIMessageBroadcaster)
-  DOM_CLASSINFO_MAP_END
-
-  DOM_CLASSINFO_MAP_BEGIN_NO_CLASS_IF(ChromeMessageSender, nsISupports)
-    DOM_CLASSINFO_MAP_ENTRY(nsIFrameScriptLoader)
-    DOM_CLASSINFO_MAP_ENTRY(nsIProcessScriptLoader)
-    DOM_CLASSINFO_MAP_ENTRY(nsIMessageListenerManager)
-    DOM_CLASSINFO_MAP_ENTRY(nsIMessageSender)
-  DOM_CLASSINFO_MAP_END
-
   DOM_CLASSINFO_MAP_BEGIN_NO_CLASS_IF(XULControlElement, nsIDOMXULControlElement)
     DOM_CLASSINFO_MAP_ENTRY(nsIDOMXULControlElement)
   DOM_CLASSINFO_MAP_END
@@ -1922,41 +1872,3 @@ nsDOMConstructorSH::HasInstance(nsIXPConnectWrappedNative *wrapper,
 
   return wrapped->HasInstance(wrapper, cx, obj, val, bp, _retval);
 }
-
-// nsContentFrameMessageManagerSH
-
-template<typename Super>
-NS_IMETHODIMP
-nsMessageManagerSH<Super>::Resolve(nsIXPConnectWrappedNative* wrapper,
-                                   JSContext* cx, JSObject* obj_,
-                                   jsid id_, bool* resolvedp,
-                                   bool* _retval)
-{
-  JS::Rooted<JSObject*> obj(cx, obj_);
-  JS::Rooted<jsid> id(cx, id_);
-
-  *_retval = SystemGlobalResolve(cx, obj, id, resolvedp);
-  NS_ENSURE_TRUE(*_retval, NS_ERROR_FAILURE);
-
-  if (*resolvedp) {
-    return NS_OK;
-  }
-
-  return Super::Resolve(wrapper, cx, obj, id, resolvedp, _retval);
-}
-
-template<typename Super>
-NS_IMETHODIMP
-nsMessageManagerSH<Super>::Enumerate(nsIXPConnectWrappedNative* wrapper,
-                                     JSContext* cx, JSObject* obj_,
-                                     bool* _retval)
-{
-  JS::Rooted<JSObject*> obj(cx, obj_);
-
-  *_retval = SystemGlobalEnumerate(cx, obj);
-  NS_ENSURE_TRUE(*_retval, NS_ERROR_FAILURE);
-
-  // Don't call up to our superclass, since neither nsDOMGenericSH nor
-  // nsEventTargetSH have WANT_ENUMERATE.
-  return NS_OK;
-}

dom/base/nsDOMClassInfo.h

@@ -212,29 +212,4 @@ public:
   }
 };
 
-template<typename Super>
-class nsMessageManagerSH : public Super
-{
-protected:
-  explicit nsMessageManagerSH(nsDOMClassInfoData* aData)
-    : Super(aData)
-  {
-  }
-
-  virtual ~nsMessageManagerSH()
-  {
-  }
-public:
-  NS_IMETHOD Resolve(nsIXPConnectWrappedNative* wrapper, JSContext* cx,
-                     JSObject* obj_, jsid id_, bool* resolvedp,
-                     bool* _retval) override;
-  NS_IMETHOD Enumerate(nsIXPConnectWrappedNative* wrapper, JSContext* cx,
-                       JSObject* obj_, bool* _retval) override;
-
-  static nsIClassInfo *doCreate(nsDOMClassInfoData* aData)
-  {
-    return new nsMessageManagerSH(aData);
-  }
-};
-
 #endif /* nsDOMClassInfo_h___ */

dom/base/nsDOMClassInfoID.h

@@ -19,11 +19,6 @@ enum nsDOMClassInfoID
   eDOMClassInfo_DOMPrototype_id,
   eDOMClassInfo_DOMConstructor_id,
 
-  eDOMClassInfo_ContentFrameMessageManager_id,
-  eDOMClassInfo_ContentProcessMessageManager_id,
-  eDOMClassInfo_ChromeMessageBroadcaster_id,
-  eDOMClassInfo_ChromeMessageSender_id,
-
   eDOMClassInfo_XULControlElement_id,
   eDOMClassInfo_XULLabeledControlElement_id,
   eDOMClassInfo_XULButtonElement_id,

dom/base/nsFrameLoader.cpp

@@ -79,6 +79,7 @@
 #include "mozilla/HTMLEditor.h"
 #include "mozilla/Preferences.h"
 #include "mozilla/Unused.h"
+#include "mozilla/dom/ChromeMessageSender.h"
 #include "mozilla/dom/Element.h"
 #include "mozilla/dom/FrameLoaderBinding.h"
 #include "mozilla/jsipc/CrossProcessObjectWrappers.h"
@@ -1642,14 +1643,12 @@ nsFrameLoader::SwapWithOtherLoader(nsFrameLoader* aOther,
   RefPtr<nsFrameMessageManager> otherMessageManager = aOther->mMessageManager;
   // Swap pointers in child message managers.
   if (mChildMessageManager) {
-    nsInProcessTabChildGlobal* tabChild =
-      static_cast<nsInProcessTabChildGlobal*>(mChildMessageManager.get());
+    nsInProcessTabChildGlobal* tabChild = mChildMessageManager;
     tabChild->SetOwner(otherContent);
     tabChild->SetChromeMessageManager(otherMessageManager);
   }
   if (aOther->mChildMessageManager) {
-    nsInProcessTabChildGlobal* otherTabChild =
-      static_cast<nsInProcessTabChildGlobal*>(aOther->mChildMessageManager.get());
+    nsInProcessTabChildGlobal* otherTabChild = aOther->mChildMessageManager;
     otherTabChild->SetOwner(ourContent);
     otherTabChild->SetChromeMessageManager(ourMessageManager);
   }
@@ -1884,7 +1883,7 @@ nsFrameLoader::DestroyDocShell()
 
   // Fire the "unload" event if we're in-process.
   if (mChildMessageManager) {
-    static_cast<nsInProcessTabChildGlobal*>(mChildMessageManager.get())->FireUnloadEvent();
+    mChildMessageManager->FireUnloadEvent();
   }
 
   // Destroy the docshell.
@@ -1896,7 +1895,7 @@ nsFrameLoader::DestroyDocShell()
 
   if (mChildMessageManager) {
     // Stop handling events in the in-process frame script.
-    static_cast<nsInProcessTabChildGlobal*>(mChildMessageManager.get())->DisconnectEventListeners();
+    mChildMessageManager->DisconnectEventListeners();
   }
 }
 
@@ -1931,7 +1930,7 @@ nsFrameLoader::DestroyComplete()
   }
 
   if (mChildMessageManager) {
-    static_cast<nsInProcessTabChildGlobal*>(mChildMessageManager.get())->Disconnect();
+    mChildMessageManager->Disconnect();
   }
 
   mMessageManager = nullptr;
@@ -2987,12 +2986,11 @@ public:
 
   NS_IMETHOD Run() override
   {
-    nsInProcessTabChildGlobal* tabChild =
-      static_cast<nsInProcessTabChildGlobal*>(mFrameLoader->mChildMessageManager.get());
+    nsInProcessTabChildGlobal* tabChild = mFrameLoader->mChildMessageManager;
     // Since bug 1126089, messages can arrive even when the docShell is destroyed.
     // Here we make sure that those messages are not delivered.
     if (tabChild && tabChild->GetInnerManager() && mFrameLoader->GetExistingDocShell()) {
-      JS::Rooted<JSObject*> kungFuDeathGrip(dom::RootingCx(), tabChild->GetGlobal());
+      JS::Rooted<JSObject*> kungFuDeathGrip(dom::RootingCx(), tabChild->GetWrapper());
       ReceiveMessage(static_cast<EventTarget*>(tabChild), mFrameLoader,
                      tabChild->GetInnerManager());
     }
@@ -3106,9 +3104,8 @@ nsFrameLoader::EnsureMessageManager()
     parentManager = do_GetService("@mozilla.org/globalmessagemanager;1");
   }
 
-  mMessageManager = new nsFrameMessageManager(nullptr,
-                                              static_cast<nsFrameMessageManager*>(parentManager.get()),
-                                              MM_CHROME);
+  mMessageManager = new ChromeMessageSender(nullptr,
+                                            static_cast<nsFrameMessageManager*>(parentManager.get()));
   if (!IsRemoteFrame()) {
     nsresult rv = MaybeCreateDocShell();
     if (NS_FAILED(rv)) {
@@ -3141,7 +3138,7 @@ nsFrameLoader::ReallyLoadFrameScripts()
 EventTarget*
 nsFrameLoader::GetTabChildGlobalAsEventTarget()
 {
-  return static_cast<nsInProcessTabChildGlobal*>(mChildMessageManager.get());
+  return mChildMessageManager.get();
 }
 
 already_AddRefed<Element>

dom/base/nsFrameLoader.h

@@ -32,7 +32,7 @@
 class nsIURI;
 class nsSubDocumentFrame;
 class nsView;
-class nsIInProcessContentFrameMessageManager;
+class nsInProcessTabChildGlobal;
 class AutoResetInShow;
 class AutoResetInFrameSwap;
 class nsITabParent;
@@ -44,6 +44,7 @@ namespace mozilla {
 class OriginAttributes;
 
 namespace dom {
+class ChromeMessageSender;
 class ContentParent;
 class PBrowserParent;
 class Promise;
@@ -268,7 +269,7 @@ public:
    */
   RenderFrameParent* GetCurrentRenderFrame() const;
 
-  nsFrameMessageManager* GetFrameMessageManager() { return mMessageManager; }
+  mozilla::dom::ChromeMessageSender* GetFrameMessageManager() { return mMessageManager; }
 
   mozilla::dom::Element* GetOwnerContent() { return mOwnerContent; }
   bool ShouldClipSubdocument() { return mClipSubdocument; }
@@ -319,8 +320,8 @@ public:
   virtual nsIMessageSender* GetProcessMessageManager() const override;
 
   // public because a callback needs these.
-  RefPtr<nsFrameMessageManager> mMessageManager;
-  nsCOMPtr<nsIInProcessContentFrameMessageManager> mChildMessageManager;
+  RefPtr<mozilla::dom::ChromeMessageSender> mMessageManager;
+  RefPtr<nsInProcessTabChildGlobal> mChildMessageManager;
 
   virtual JSObject* WrapObject(JSContext* cx, JS::Handle<JSObject*> aGivenProto) override;
 

dom/base/nsFrameMessageManager.h

@@ -28,6 +28,8 @@
 #include "mozilla/Attributes.h"
 #include "js/RootingAPI.h"
 #include "nsTObserverArray.h"
+#include "mozilla/TypedEnumBits.h"
+#include "mozilla/dom/CallbackObject.h"
 #include "mozilla/dom/SameProcessMessageQueue.h"
 #include "mozilla/dom/ipc/StructuredCloneData.h"
 #include "mozilla/jsipc/CpowHolder.h"
@@ -39,8 +41,13 @@ namespace dom {
 
 class nsIContentParent;
 class nsIContentChild;
+class ChildProcessMessageManager;
+class ChromeMessageSender;
 class ClonedMessageData;
+class MessageListener;
+class MessageListenerManager;
 class MessageManagerReporter;
+template<typename T> class Optional;
 
 namespace ipc {
 
@@ -48,14 +55,15 @@ namespace ipc {
 // of 1 ms actually captures from 500us and above.
 static const uint32_t kMinTelemetrySyncMessageManagerLatencyMs = 1;
 
-enum MessageManagerFlags {
-  MM_CHILD = 0,
+enum class MessageManagerFlags {
+  MM_NONE = 0,
   MM_CHROME = 1,
   MM_GLOBAL = 2,
   MM_PROCESSMANAGER = 4,
   MM_BROADCASTER = 8,
   MM_OWNSCALLBACK = 16
 };
+MOZ_MAKE_ENUM_CLASS_BITWISE_OPERATORS(MessageManagerFlags);
 
 class MessageManagerCallback
 {
@@ -118,6 +126,10 @@ void UnpackClonedMessageDataForChild(const ClonedMessageData& aClonedData,
                                      StructuredCloneData& aData);
 
 } // namespace ipc
+
+typedef CallbackObjectHolder<mozilla::dom::MessageListener,
+                             nsIMessageListener> MessageListenerHolder;
+
 } // namespace dom
 } // namespace mozilla
 
@@ -128,12 +140,22 @@ struct nsMessageListenerInfo
     return &aOther == this;
   }
 
-  // Exactly one of mStrongListener and mWeakListener must be non-null.
-  nsCOMPtr<nsIMessageListener> mStrongListener;
+  // If mWeakListener is null then mStrongListener holds either a MessageListener or an
+  // nsIMessageListener. If mWeakListener is non-null then mStrongListener contains null.
+  mozilla::dom::MessageListenerHolder mStrongListener;
   nsWeakPtr mWeakListener;
   bool mListenWhenClosed;
 };
 
+inline void
+ImplCycleCollectionTraverse(nsCycleCollectionTraversalCallback& aCallback,
+                            nsMessageListenerInfo& aField,
+                            const char* aName,
+                            uint32_t aFlags = 0)
+{
+  ImplCycleCollectionTraverse(aCallback, aField.mStrongListener, aName, aFlags);
+  ImplCycleCollectionTraverse(aCallback, aField.mWeakListener, aName, aFlags);
+}
 
 class MOZ_STACK_CLASS SameProcessCpowHolder : public mozilla::jsipc::CpowHolder
 {
@@ -150,25 +172,86 @@ private:
   JS::Rooted<JSObject*> mObj;
 };
 
-class nsFrameMessageManager final : public nsIContentFrameMessageManager,
-                                    public nsIMessageBroadcaster,
-                                    public nsIFrameScriptLoader,
-                                    public nsIGlobalProcessScriptLoader
+class nsFrameMessageManager : public nsIContentFrameMessageManager,
+                              public nsIMessageBroadcaster,
+                              public nsIFrameScriptLoader,
+                              public nsIGlobalProcessScriptLoader
 {
   friend class mozilla::dom::MessageManagerReporter;
   typedef mozilla::dom::ipc::StructuredCloneData StructuredCloneData;
-public:
+
+protected:
+  typedef mozilla::dom::ipc::MessageManagerFlags MessageManagerFlags;
+
   nsFrameMessageManager(mozilla::dom::ipc::MessageManagerCallback* aCallback,
-                        nsFrameMessageManager* aParentManager,
-                        /* mozilla::dom::ipc::MessageManagerFlags */ uint32_t aFlags);
+                        MessageManagerFlags aFlags);
 
-private:
-  ~nsFrameMessageManager();
+  virtual ~nsFrameMessageManager();
 
 public:
+  explicit nsFrameMessageManager(mozilla::dom::ipc::MessageManagerCallback* aCallback)
+    : nsFrameMessageManager(aCallback, MessageManagerFlags::MM_NONE)
+  {}
+
   NS_DECL_CYCLE_COLLECTING_ISUPPORTS
   NS_DECL_CYCLE_COLLECTION_SCRIPT_HOLDER_CLASS_AMBIGUOUS(nsFrameMessageManager,
                                                          nsIContentFrameMessageManager)
+
+  // MessageListenerManager
+  void AddMessageListener(const nsAString& aMessageName,
+                          mozilla::dom::MessageListener& aListener,
+                          bool aListenWhenClosed,
+                          mozilla::ErrorResult& aError);
+  void RemoveMessageListener(const nsAString& aMessageName,
+                             mozilla::dom::MessageListener& aListener,
+                             mozilla::ErrorResult& aError);
+  void AddWeakMessageListener(const nsAString& aMessageName,
+                              mozilla::dom::MessageListener& aListener,
+                              mozilla::ErrorResult& aError);
+  void RemoveWeakMessageListener(const nsAString& aMessageName,
+                                 mozilla::dom::MessageListener& aListener,
+                                 mozilla::ErrorResult& aError);
+
+  // MessageSender
+  void SendAsyncMessage(JSContext* aCx, const nsAString& aMessageName,
+                        JS::Handle<JS::Value> aObj,
+                        JS::Handle<JSObject*> aObjects,
+                        nsIPrincipal* aPrincipal,
+                        JS::Handle<JS::Value> aTransfers,
+                        mozilla::ErrorResult& aError)
+  {
+    DispatchAsyncMessage(aCx, aMessageName, aObj, aObjects, aPrincipal, aTransfers,
+                         aError);
+  }
+  already_AddRefed<nsIMessageSender>
+    GetProcessMessageManager(mozilla::ErrorResult& aError);
+  void GetRemoteType(nsAString& aRemoteType, mozilla::ErrorResult& aError) const;
+
+  // SyncMessageSender
+  void SendSyncMessage(JSContext* aCx, const nsAString& aMessageName,
+                       JS::Handle<JS::Value> aObj,
+                       JS::Handle<JSObject*> aObjects,
+                       nsIPrincipal* aPrincipal,
+                       nsTArray<JS::Value>& aResult,
+                       mozilla::ErrorResult& aError)
+  {
+    SendMessage(aCx, aMessageName, aObj, aObjects, aPrincipal, true, aResult, aError);
+  }
+  void SendRpcMessage(JSContext* aCx, const nsAString& aMessageName,
+                      JS::Handle<JS::Value> aObj,
+                      JS::Handle<JSObject*> aObjects,
+                      nsIPrincipal* aPrincipal,
+                      nsTArray<JS::Value>& aResult,
+                      mozilla::ErrorResult& aError)
+  {
+    SendMessage(aCx, aMessageName, aObj, aObjects, aPrincipal, false, aResult, aError);
+  }
+
+  // GlobalProcessScriptLoader
+  void GetInitialProcessData(JSContext* aCx,
+                             JS::MutableHandle<JS::Value> aInitialProcessData,
+                             mozilla::ErrorResult& aError);
+
   NS_DECL_NSIMESSAGELISTENERMANAGER
   NS_DECL_NSIMESSAGESENDER
   NS_DECL_NSIMESSAGEBROADCASTER
@@ -179,7 +262,7 @@ public:
   NS_DECL_NSIPROCESSSCRIPTLOADER
   NS_DECL_NSIGLOBALPROCESSSCRIPTLOADER
 
-  static nsFrameMessageManager*
+  static mozilla::dom::ChromeMessageSender*
   NewProcessMessageManager(bool aIsRemote);
 
   nsresult ReceiveMessage(nsISupports* aTarget, nsIFrameLoader* aTargetFrameLoader,
@@ -188,15 +271,11 @@ public:
                           mozilla::jsipc::CpowHolder* aCpows, nsIPrincipal* aPrincipal,
                           nsTArray<StructuredCloneData>* aRetVal);
 
-  void AddChildManager(nsFrameMessageManager* aManager);
-  void RemoveChildManager(nsFrameMessageManager* aManager)
-  {
-    mChildManagers.RemoveObject(aManager);
-  }
+  void AddChildManager(mozilla::dom::MessageListenerManager* aManager);
+  void RemoveChildManager(mozilla::dom::MessageListenerManager* aManager);
   void Disconnect(bool aRemoveFromParent = true);
   void Close();
 
-  void InitWithCallback(mozilla::dom::ipc::MessageManagerCallback* aCallback);
   void SetCallback(mozilla::dom::ipc::MessageManagerCallback* aCallback);
 
   mozilla::dom::ipc::MessageManagerCallback* GetCallback()
@@ -217,14 +296,6 @@ public:
                                         StructuredCloneData& aData,
                                         JS::Handle<JSObject*> aCpows,
                                         nsIPrincipal* aPrincipal);
-  void RemoveFromParent();
-  nsFrameMessageManager* GetParentManager() { return mParentManager; }
-  void SetParentManager(nsFrameMessageManager* aParent)
-  {
-    NS_ASSERTION(!mParentManager, "We have parent manager already!");
-    NS_ASSERTION(mChrome, "Should not set parent manager!");
-    mParentManager = aParent;
-  }
   bool IsGlobal() { return mGlobal; }
   bool IsBroadcaster() { return mIsBroadcaster; }
 
@@ -232,11 +303,11 @@ public:
   {
     return sParentProcessManager;
   }
-  static nsFrameMessageManager* GetChildProcessManager()
+  static mozilla::dom::ChildProcessMessageManager* GetChildProcessManager()
   {
     return sChildProcessManager;
   }
-  static void SetChildProcessManager(nsFrameMessageManager* aManager)
+  static void SetChildProcessManager(mozilla::dom::ChildProcessMessageManager* aManager)
   {
     sChildProcessManager = aManager;
   }
@@ -245,7 +316,24 @@ public:
 
   void LoadPendingScripts();
 
-private:
+protected:
+  friend class MMListenerRemover;
+
+  virtual nsFrameMessageManager* GetParentManager()
+  {
+    return nullptr;
+  }
+  virtual void ClearParentManager(bool aRemove)
+  {
+  }
+
+  void DispatchAsyncMessage(JSContext* aCx, const nsAString& aMessageName,
+                            JS::Handle<JS::Value> aObj,
+                            JS::Handle<JSObject*> aObjects,
+                            nsIPrincipal* aPrincipal,
+                            JS::Handle<JS::Value> aTransfers,
+                            mozilla::ErrorResult& aError);
+
   nsresult SendMessage(const nsAString& aMessageName,
                        JS::Handle<JS::Value> aJSON,
                        JS::Handle<JS::Value> aObjects,
@@ -254,6 +342,14 @@ private:
                        uint8_t aArgc,
                        JS::MutableHandle<JS::Value> aRetval,
                        bool aIsSync);
+  void SendMessage(JSContext* aCx, const nsAString& aMessageName,
+                   JS::Handle<JS::Value> aObj, JS::Handle<JSObject*> aObjects,
+                   nsIPrincipal* aPrincipal, bool aIsSync, nsTArray<JS::Value>& aResult,
+                   mozilla::ErrorResult& aError);
+  void SendMessage(JSContext* aCx, const nsAString& aMessageName,
+                   StructuredCloneData& aData, JS::Handle<JSObject*> aObjects,
+                   nsIPrincipal* aPrincipal, bool aIsSync,
+                   nsTArray<JS::Value>& aResult, mozilla::ErrorResult& aError);
 
   nsresult ReceiveMessage(nsISupports* aTarget, nsIFrameLoader* aTargetFrameLoader,
                           bool aTargetClosed, const nsAString& aMessage,
@@ -261,19 +357,28 @@ private:
                           mozilla::jsipc::CpowHolder* aCpows, nsIPrincipal* aPrincipal,
                           nsTArray<StructuredCloneData>* aRetVal);
 
-  NS_IMETHOD LoadScript(const nsAString& aURL,
-                        bool aAllowDelayedLoad,
-                        bool aRunInGlobalScope);
-  NS_IMETHOD RemoveDelayedScript(const nsAString& aURL);
-  NS_IMETHOD GetDelayedScripts(JSContext* aCx, JS::MutableHandle<JS::Value> aList);
+  void LoadScript(const nsAString& aURL, bool aAllowDelayedLoad,
+                  bool aRunInGlobalScope, mozilla::ErrorResult& aError);
+  void RemoveDelayedScript(const nsAString& aURL);
+  nsresult GetDelayedScripts(JSContext* aCx,
+                             JS::MutableHandle<JS::Value> aList);
+  void GetDelayedScripts(JSContext* aCx, nsTArray<nsTArray<JS::Value>>& aList,
+                         mozilla::ErrorResult& aError);
+
+  enum ProcessCheckerType {
+    PROCESS_CHECKER_PERMISSION,
+    PROCESS_CHECKER_MANIFEST_URL,
+    ASSERT_APP_HAS_PERMISSION
+  };
+  bool AssertProcessInternal(ProcessCheckerType aType,
+                             const nsAString& aCapability,
+                             mozilla::ErrorResult& aError);
 
-protected:
-  friend class MMListenerRemover;
   // We keep the message listeners as arrays in a hastable indexed by the
   // message name. That gives us fast lookups in ReceiveMessage().
   nsClassHashtable<nsStringHashKey,
                    nsAutoTObserverArray<nsMessageListenerInfo, 1>> mListeners;
-  nsCOMArray<nsIContentFrameMessageManager> mChildManagers;
+  nsTArray<RefPtr<mozilla::dom::MessageListenerManager>> mChildManagers;
   bool mChrome;     // true if we're in the chrome process
   bool mGlobal;     // true if we're the global frame message manager
   bool mIsProcessManager; // true if the message manager belongs to the process realm
@@ -284,7 +389,6 @@ protected:
   bool mDisconnected;
   mozilla::dom::ipc::MessageManagerCallback* mCallback;
   nsAutoPtr<mozilla::dom::ipc::MessageManagerCallback> mOwnedCallback;
-  RefPtr<nsFrameMessageManager> mParentManager;
   nsTArray<nsString> mPendingScripts;
   nsTArray<bool> mPendingScriptsGlobalStates;
   JS::Heap<JS::Value> mInitialProcessData;
@@ -296,15 +400,13 @@ public:
   static nsFrameMessageManager* sSameProcessParentManager;
   static nsTArray<nsCOMPtr<nsIRunnable> >* sPendingSameProcessAsyncMessages;
 private:
-  static nsFrameMessageManager* sChildProcessManager;
-  enum ProcessCheckerType {
-    PROCESS_CHECKER_PERMISSION,
-    PROCESS_CHECKER_MANIFEST_URL,
-    ASSERT_APP_HAS_PERMISSION
-  };
-  nsresult AssertProcessInternal(ProcessCheckerType aType,
-                                 const nsAString& aCapability,
-                                 bool* aValid);
+  void AddMessageListener(const nsAString& aMessageName,
+                          mozilla::dom::MessageListenerHolder&& aListener,
+                          bool aListenWhenClosed);
+  void RemoveMessageListener(const nsAString& aMessageName,
+                             const mozilla::dom::MessageListenerHolder&  aListener);
+
+  static mozilla::dom::ChildProcessMessageManager* sChildProcessManager;
 };
 
 /* A helper class for taking care of many details for async message sending
@@ -374,10 +476,6 @@ class nsMessageManagerScriptExecutor
 public:
   static void PurgeCache();
   static void Shutdown();
-  JSObject* GetGlobal()
-  {
-    return mGlobal;
-  }
 
   void MarkScopesForCC();
 protected:
@@ -386,17 +484,20 @@ protected:
   ~nsMessageManagerScriptExecutor() { MOZ_COUNT_DTOR(nsMessageManagerScriptExecutor); }
 
   void DidCreateGlobal();
-  void LoadScriptInternal(const nsAString& aURL, bool aRunInGlobalScope);
+  void LoadScriptInternal(JS::Handle<JSObject*> aGlobal, const nsAString& aURL,
+                          bool aRunInGlobalScope);
   void TryCacheLoadAndCompileScript(const nsAString& aURL,
                                     bool aRunInGlobalScope,
                                     bool aShouldCache,
                                     JS::MutableHandle<JSScript*> aScriptp);
   void TryCacheLoadAndCompileScript(const nsAString& aURL,
                                     bool aRunInGlobalScope);
-  bool InitChildGlobalInternal(nsISupports* aScope, const nsACString& aID);
+  bool InitChildGlobalInternal(const nsACString& aID);
+  virtual bool WrapGlobalObject(JSContext* aCx,
+                                JS::CompartmentOptions& aOptions,
+                                JS::MutableHandle<JSObject*> aReflector) = 0;
   void Trace(const TraceCallbacks& aCallbacks, void* aClosure);
   void Unlink();
-  JS::TenuredHeap<JSObject*> mGlobal;
   nsCOMPtr<nsIPrincipal> mPrincipal;
   AutoTArray<JS::Heap<JSObject*>, 2> mAnonymousGlobalScopes;
 

dom/base/nsGlobalWindowInner.cpp

@@ -1246,8 +1246,7 @@ nsGlobalWindowInner::CleanUp()
   if (mCleanMessageManager) {
     MOZ_ASSERT(mIsChrome, "only chrome should have msg manager cleaned");
     if (mChromeFields.mMessageManager) {
-      static_cast<nsFrameMessageManager*>(
-        mChromeFields.mMessageManager.get())->Disconnect();
+      mChromeFields.mMessageManager->Disconnect();
     }
   }
 
@@ -7593,7 +7592,7 @@ nsGlobalWindowInner::GetMessageManager(nsIMessageBroadcaster** aManager)
   return rv.StealNSResult();
 }
 
-nsIMessageBroadcaster*
+ChromeMessageBroadcaster*
 nsGlobalWindowInner::GetMessageManager(ErrorResult& aError)
 {
   MOZ_ASSERT(IsChromeWindow());
@@ -7601,9 +7600,7 @@ nsGlobalWindowInner::GetMessageManager(ErrorResult& aError)
     nsCOMPtr<nsIMessageBroadcaster> globalMM =
       do_GetService("@mozilla.org/globalmessagemanager;1");
     mChromeFields.mMessageManager =
-      new nsFrameMessageManager(nullptr,
-                                static_cast<nsFrameMessageManager*>(globalMM.get()),
-                                MM_CHROME | MM_BROADCASTER);
+      new ChromeMessageBroadcaster(static_cast<nsFrameMessageManager*>(globalMM.get()));
   }
   return mChromeFields.mMessageManager;
 }
@@ -7618,21 +7615,18 @@ nsGlobalWindowInner::GetGroupMessageManager(const nsAString& aGroup,
   return rv.StealNSResult();
 }
 
-nsIMessageBroadcaster*
+ChromeMessageBroadcaster*
 nsGlobalWindowInner::GetGroupMessageManager(const nsAString& aGroup,
                                             ErrorResult& aError)
 {
   MOZ_ASSERT(IsChromeWindow());
 
-  nsCOMPtr<nsIMessageBroadcaster> messageManager =
+  RefPtr<ChromeMessageBroadcaster> messageManager =
     mChromeFields.mGroupMessageManagers.LookupForAdd(aGroup).OrInsert(
       [this, &aError] () {
-        nsFrameMessageManager* parent =
-          static_cast<nsFrameMessageManager*>(GetMessageManager(aError));
+        nsFrameMessageManager* parent = GetMessageManager(aError);
 
-        return new nsFrameMessageManager(nullptr,
-                                         parent,
-                                         MM_CHROME | MM_BROADCASTER);
+        return new ChromeMessageBroadcaster(parent);
       });
   return messageManager;
 }

dom/base/nsGlobalWindowInner.h

@@ -37,11 +37,11 @@
 #include "prclist.h"
 #include "mozilla/dom/DOMPrefs.h"
 #include "mozilla/dom/BindingDeclarations.h"
+#include "mozilla/dom/ChromeMessageBroadcaster.h"
 #include "mozilla/dom/StorageEvent.h"
 #include "mozilla/dom/StorageEventBinding.h"
 #include "mozilla/dom/UnionTypes.h"
 #include "mozilla/ErrorResult.h"
-#include "nsFrameMessageManager.h"
 #include "mozilla/Attributes.h"
 #include "mozilla/GuardObjects.h"
 #include "mozilla/LinkedList.h"
@@ -941,9 +941,11 @@ public:
   void Restore();
   void NotifyDefaultButtonLoaded(mozilla::dom::Element& aDefaultButton,
                                  mozilla::ErrorResult& aError);
-  nsIMessageBroadcaster* GetMessageManager(mozilla::ErrorResult& aError);
-  nsIMessageBroadcaster* GetGroupMessageManager(const nsAString& aGroup,
-                                                mozilla::ErrorResult& aError);
+  mozilla::dom::ChromeMessageBroadcaster*
+    GetMessageManager(mozilla::ErrorResult& aError);
+  mozilla::dom::ChromeMessageBroadcaster*
+    GetGroupMessageManager(const nsAString& aGroup,
+                           mozilla::ErrorResult& aError);
   void BeginWindowMove(mozilla::dom::Event& aMouseDownEvent,
                        mozilla::dom::Element* aPanel,
                        mozilla::ErrorResult& aError);
@@ -1271,9 +1273,9 @@ private:
   {
     MOZ_RELEASE_ASSERT(IsChromeWindow());
     for (auto iter = mChromeFields.mGroupMessageManagers.Iter(); !iter.Done(); iter.Next()) {
-      nsIMessageBroadcaster* mm = iter.UserData();
+      mozilla::dom::ChromeMessageBroadcaster* mm = iter.UserData();
       if (mm) {
-        static_cast<nsFrameMessageManager*>(mm)->Disconnect();
+        mm->Disconnect();
       }
     }
     mChromeFields.mGroupMessageManagers.Clear();
@@ -1473,8 +1475,9 @@ protected:
       : mGroupMessageManagers(1)
     {}
 
-    nsCOMPtr<nsIMessageBroadcaster> mMessageManager;
-    nsInterfaceHashtable<nsStringHashKey, nsIMessageBroadcaster> mGroupMessageManagers;
+    RefPtr<mozilla::dom::ChromeMessageBroadcaster> mMessageManager;
+    nsRefPtrHashtable<nsStringHashKey,
+                      mozilla::dom::ChromeMessageBroadcaster> mGroupMessageManagers;
   } mChromeFields;
 
   // These fields are used by the inner and outer windows to prevent

dom/base/nsGlobalWindowOuter.h

@@ -37,11 +37,11 @@
 #include "mozilla/FlushType.h"
 #include "prclist.h"
 #include "mozilla/dom/BindingDeclarations.h"
+#include "mozilla/dom/ChromeMessageBroadcaster.h"
 #include "mozilla/dom/StorageEvent.h"
 #include "mozilla/dom/StorageEventBinding.h"
 #include "mozilla/dom/UnionTypes.h"
 #include "mozilla/ErrorResult.h"
-#include "nsFrameMessageManager.h"
 #include "mozilla/Attributes.h"
 #include "mozilla/GuardObjects.h"
 #include "mozilla/LinkedList.h"

dom/base/nsIMessageManager.idl

@@ -203,7 +203,7 @@ interface nsIMessageListener : nsISupports
   void receiveMessage();
 };
 
-[scriptable, builtinclass, uuid(b949bfec-bb7d-47bc-b387-ac6a9b655072)]
+[uuid(b949bfec-bb7d-47bc-b387-ac6a9b655072)]
 interface nsIMessageListenerManager : nsISupports
 {
   /**
@@ -261,7 +261,7 @@ interface nsIMessageListenerManager : nsISupports
  * messages that are only delivered to its one parent-process message
  * manager.
  */
-[scriptable, builtinclass, uuid(bb5d79e4-e73c-45e7-9651-4d718f4b994c)]
+[uuid(bb5d79e4-e73c-45e7-9651-4d718f4b994c)]
 interface nsIMessageSender : nsIMessageListenerManager
 {
   /**
@@ -309,7 +309,7 @@ interface nsIMessageSender : nsIMessageListenerManager
  * manager will broadcast the message to all frame message managers
  * within its window.
  */
-[scriptable, builtinclass, uuid(4d7d62ad-4725-4f39-86cf-8fb22bf9c1d8)]
+[uuid(4d7d62ad-4725-4f39-86cf-8fb22bf9c1d8)]
 interface nsIMessageBroadcaster : nsIMessageListenerManager
 {
   /**
@@ -342,7 +342,7 @@ interface nsIMessageBroadcaster : nsIMessageListenerManager
    void releaseCachedProcesses();
 };
 
-[scriptable, builtinclass, uuid(0e602c9e-1977-422a-a8e4-fe0d4a4f78d0)]
+[uuid(0e602c9e-1977-422a-a8e4-fe0d4a4f78d0)]
 interface nsISyncMessageSender : nsIMessageSender
 {
   /**
@@ -372,7 +372,7 @@ interface nsISyncMessageSender : nsIMessageSender
                        [optional] in nsIPrincipal principal);
 };
 
-[scriptable, builtinclass, uuid(13f3555f-769e-44ea-b607-5239230c3162)]
+[uuid(13f3555f-769e-44ea-b607-5239230c3162)]
 interface nsIMessageManagerGlobal : nsISyncMessageSender
 {
   /**
@@ -393,7 +393,7 @@ interface nsIMessageManagerGlobal : nsISyncMessageSender
   DOMString btoa(in DOMString aBase64Data);
 };
 
-[scriptable, builtinclass, uuid(694e367c-aa25-4446-8499-2c527c4bd838)]
+[uuid(694e367c-aa25-4446-8499-2c527c4bd838)]
 interface nsIContentFrameMessageManager : nsIMessageManagerGlobal
 {
   /**
@@ -420,7 +420,7 @@ interface nsIInProcessContentFrameMessageManager : nsIContentFrameMessageManager
   [notxpcom] void cacheFrameLoader(in nsIFrameLoader aFrameLoader);
 };
 
-[scriptable, builtinclass, uuid(6d12e467-2446-46db-9965-e4e93cb87ca5)]
+[uuid(6d12e467-2446-46db-9965-e4e93cb87ca5)]
 interface nsIContentProcessMessageManager : nsIMessageManagerGlobal
 {
   /**
@@ -431,7 +431,7 @@ interface nsIContentProcessMessageManager : nsIMessageManagerGlobal
   readonly attribute jsval initialProcessData;
 };
 
-[scriptable, builtinclass, uuid(bf61446b-ba24-4b1d-88c7-4f94724b9ce1)]
+[uuid(bf61446b-ba24-4b1d-88c7-4f94724b9ce1)]
 interface nsIFrameScriptLoader : nsISupports
 {
   /**
@@ -458,7 +458,7 @@ interface nsIFrameScriptLoader : nsISupports
   jsval getDelayedFrameScripts();
 };
 
-[scriptable, builtinclass, uuid(7e1e1a20-b24f-11e4-ab27-0800200c9a66)]
+[uuid(7e1e1a20-b24f-11e4-ab27-0800200c9a66)]
 interface nsIProcessScriptLoader : nsISupports
 {
   /**
@@ -483,7 +483,7 @@ interface nsIProcessScriptLoader : nsISupports
   jsval getDelayedProcessScripts();
 };
 
-[scriptable, builtinclass, uuid(5b390753-abb3-49b0-ae3b-b803dab58144)]
+[uuid(5b390753-abb3-49b0-ae3b-b803dab58144)]
 interface nsIGlobalProcessScriptLoader : nsIProcessScriptLoader
 {
   /**

dom/base/nsInProcessTabChildGlobal.cpp

@@ -14,8 +14,9 @@
 #include "nsFrameLoader.h"
 #include "xpcpublic.h"
 #include "nsIMozBrowserFrame.h"
-#include "nsDOMClassInfoID.h"
 #include "mozilla/EventDispatcher.h"
+#include "mozilla/dom/ChromeMessageSender.h"
+#include "mozilla/dom/MessageManagerBinding.h"
 #include "mozilla/dom/SameProcessMessageQueue.h"
 #include "mozilla/dom/ScriptLoader.h"
 
@@ -89,11 +90,11 @@ nsInProcessTabChildGlobal::DoSendAsyncMessage(JSContext* aCx,
 nsInProcessTabChildGlobal::nsInProcessTabChildGlobal(nsIDocShell* aShell,
                                                      nsIContent* aOwner,
                                                      nsFrameMessageManager* aChrome)
-: mDocShell(aShell), mInitialized(false), mLoadingScript(false),
+: ContentFrameMessageManager(aChrome),
+  mDocShell(aShell), mInitialized(false), mLoadingScript(false),
   mPreventEventsEscaping(false),
   mOwner(aOwner), mChromeMessageManager(aChrome)
 {
-  SetIsNotDOMBinding();
   mozilla::HoldJSObjects(this);
 
   // If owner corresponds to an <iframe mozbrowser>, we'll have to tweak our
@@ -119,7 +120,7 @@ NS_IMETHODIMP_(bool)
 nsInProcessTabChildGlobal::MarkForCC()
 {
   MarkScopesForCC();
-  return mMessageManager ? mMessageManager->MarkForCC() : false;
+  return MessageManagerGlobal::MarkForCC();
 }
 
 nsresult
@@ -131,9 +132,7 @@ nsInProcessTabChildGlobal::Init()
   InitTabChildGlobal();
   NS_WARNING_ASSERTION(NS_SUCCEEDED(rv),
                        "Couldn't initialize nsInProcessTabChildGlobal");
-  mMessageManager = new nsFrameMessageManager(this,
-                                              nullptr,
-                                              dom::ipc::MM_CHILD);
+  mMessageManager = new nsFrameMessageManager(this);
   return NS_OK;
 }
 
@@ -169,43 +168,69 @@ NS_INTERFACE_MAP_BEGIN_CYCLE_COLLECTION(nsInProcessTabChildGlobal)
   NS_INTERFACE_MAP_ENTRY(nsIScriptObjectPrincipal)
   NS_INTERFACE_MAP_ENTRY(nsIGlobalObject)
   NS_INTERFACE_MAP_ENTRY(nsISupportsWeakReference)
-  NS_DOM_INTERFACE_MAP_ENTRY_CLASSINFO(ContentFrameMessageManager)
 NS_INTERFACE_MAP_END_INHERITING(DOMEventTargetHelper)
 
 NS_IMPL_ADDREF_INHERITED(nsInProcessTabChildGlobal, DOMEventTargetHelper)
 NS_IMPL_RELEASE_INHERITED(nsInProcessTabChildGlobal, DOMEventTargetHelper)
 
+bool
+nsInProcessTabChildGlobal::WrapGlobalObject(JSContext* aCx,
+                                            JS::CompartmentOptions& aOptions,
+                                            JS::MutableHandle<JSObject*> aReflector)
+{
+  bool ok = ContentFrameMessageManagerBinding::Wrap(aCx, this, this, aOptions,
+                                                    nsJSPrincipals::get(mPrincipal),
+                                                    true, aReflector);
+  if (ok) {
+    // Since we can't rewrap we have to preserve the global's wrapper here.
+    PreserveWrapper(ToSupports(this));
+  }
+  return ok;
+}
+
 void
 nsInProcessTabChildGlobal::CacheFrameLoader(nsIFrameLoader* aFrameLoader)
 {
   mFrameLoader = aFrameLoader;
 }
 
+already_AddRefed<nsPIDOMWindowOuter>
+nsInProcessTabChildGlobal::GetContent(ErrorResult& aError)
+{
+  nsCOMPtr<nsPIDOMWindowOuter> content;
+  if (mDocShell) {
+    content = mDocShell->GetWindow();
+  }
+  return content.forget();
+}
+
 NS_IMETHODIMP
 nsInProcessTabChildGlobal::GetContent(mozIDOMWindowProxy** aContent)
 {
-  *aContent = nullptr;
-  if (!mDocShell) {
-    return NS_OK;
-  }
-
-  nsCOMPtr<nsPIDOMWindowOuter> window = mDocShell->GetWindow();
-  window.forget(aContent);
-  return NS_OK;
+  ErrorResult rv;
+  *aContent = GetContent(rv).take();
+  return rv.StealNSResult();
 }
 
 NS_IMETHODIMP
 nsInProcessTabChildGlobal::GetDocShell(nsIDocShell** aDocShell)
 {
-  NS_IF_ADDREF(*aDocShell = mDocShell);
-  return NS_OK;
+  ErrorResult rv;
+  *aDocShell = GetDocShell(rv).take();
+  return rv.StealNSResult();
+}
+
+already_AddRefed<nsIEventTarget>
+nsInProcessTabChildGlobal::GetTabEventTarget()
+{
+  nsCOMPtr<nsIEventTarget> target = GetMainThreadEventTarget();
+  return target.forget();
 }
 
 NS_IMETHODIMP
 nsInProcessTabChildGlobal::GetTabEventTarget(nsIEventTarget** aTarget)
 {
-  nsCOMPtr<nsIEventTarget> target = GetMainThreadEventTarget();
-  target.forget(aTarget);
+  *aTarget = GetTabEventTarget().take();
   return NS_OK;
 }
 
@@ -312,8 +337,7 @@ nsInProcessTabChildGlobal::InitTabChildGlobal()
     id.AppendLiteral("?ownedBy=");
     id.Append(u);
   }
-  nsISupports* scopeSupports = NS_ISUPPORTS_CAST(EventTarget*, this);
-  NS_ENSURE_STATE(InitChildGlobalInternal(scopeSupports, id));
+  NS_ENSURE_STATE(InitChildGlobalInternal(id));
   return NS_OK;
 }
 
@@ -353,7 +377,8 @@ nsInProcessTabChildGlobal::LoadFrameScript(const nsAString& aURL, bool aRunInGlo
   }
   bool tmp = mLoadingScript;
   mLoadingScript = true;
-  LoadScriptInternal(aURL, aRunInGlobalScope);
+  JS::Rooted<JSObject*> global(mozilla::dom::RootingCx(), GetWrapper());
+  LoadScriptInternal(global, aURL, aRunInGlobalScope);
   mLoadingScript = tmp;
 }
 

dom/base/nsInProcessTabChildGlobal.h

@@ -9,6 +9,7 @@
 
 #include "mozilla/Attributes.h"
 #include "mozilla/DOMEventTargetHelper.h"
+#include "mozilla/dom/ContentFrameMessageManager.h"
 #include "nsCOMPtr.h"
 #include "nsFrameMessageManager.h"
 #include "nsIScriptContext.h"
@@ -27,7 +28,7 @@ namespace mozilla {
 class EventChainPreVisitor;
 } // namespace mozilla
 
-class nsInProcessTabChildGlobal : public mozilla::DOMEventTargetHelper,
+class nsInProcessTabChildGlobal : public mozilla::dom::ContentFrameMessageManager,
                                   public nsMessageManagerScriptExecutor,
                                   public nsIInProcessContentFrameMessageManager,
                                   public nsIGlobalObject,
@@ -46,38 +47,30 @@ public:
   NS_DECL_CYCLE_COLLECTION_SCRIPT_HOLDER_CLASS_INHERITED(nsInProcessTabChildGlobal,
                                                          mozilla::DOMEventTargetHelper)
 
+  virtual JSObject* WrapObject(JSContext* aCx,
+                               JS::Handle<JSObject*> aGivenProto) override
+  {
+    MOZ_CRASH("We should never get here!");
+  }
+  virtual bool WrapGlobalObject(JSContext* aCx,
+                                JS::CompartmentOptions& aOptions,
+                                JS::MutableHandle<JSObject*> aReflector) override;
+
+  virtual already_AddRefed<nsPIDOMWindowOuter>
+    GetContent(mozilla::ErrorResult& aError) override;
+  virtual already_AddRefed<nsIDocShell>
+    GetDocShell(mozilla::ErrorResult& aError) override
+  {
+    nsCOMPtr<nsIDocShell> docShell(mDocShell);
+    return docShell.forget();
+  }
+  virtual already_AddRefed<nsIEventTarget> GetTabEventTarget() override;
+
   NS_FORWARD_SAFE_NSIMESSAGELISTENERMANAGER(mMessageManager)
   NS_FORWARD_SAFE_NSIMESSAGESENDER(mMessageManager)
+  NS_FORWARD_SAFE_NSISYNCMESSAGESENDER(mMessageManager);
   NS_FORWARD_SAFE_NSIMESSAGEMANAGERGLOBAL(mMessageManager)
-  NS_IMETHOD SendSyncMessage(const nsAString& aMessageName,
-                             JS::Handle<JS::Value> aObject,
-                             JS::Handle<JS::Value> aRemote,
-                             nsIPrincipal* aPrincipal,
-                             JSContext* aCx,
-                             uint8_t aArgc,
-                             JS::MutableHandle<JS::Value> aRetval) override
-  {
-    return mMessageManager
-      ? mMessageManager->SendSyncMessage(aMessageName, aObject, aRemote,
-                                         aPrincipal, aCx, aArgc, aRetval)
-      : NS_ERROR_NULL_POINTER;
-  }
-  NS_IMETHOD SendRpcMessage(const nsAString& aMessageName,
-                            JS::Handle<JS::Value> aObject,
-                            JS::Handle<JS::Value> aRemote,
-                            nsIPrincipal* aPrincipal,
-                            JSContext* aCx,
-                            uint8_t aArgc,
-                            JS::MutableHandle<JS::Value> aRetval) override
-  {
-    return mMessageManager
-      ? mMessageManager->SendRpcMessage(aMessageName, aObject, aRemote,
-                                        aPrincipal, aCx, aArgc, aRetval)
-      : NS_ERROR_NULL_POINTER;
-  }
-  NS_IMETHOD GetContent(mozIDOMWindowProxy** aContent) override;
-  NS_IMETHOD GetDocShell(nsIDocShell** aDocShell) override;
-  NS_IMETHOD GetTabEventTarget(nsIEventTarget** aTarget) override;
+  NS_DECL_NSICONTENTFRAMEMESSAGEMANAGER
 
   NS_DECL_NSIINPROCESSCONTENTFRAMEMESSAGEMANAGER
 
@@ -99,26 +92,6 @@ public:
 
   virtual nsresult GetEventTargetParent(
                      mozilla::EventChainPreVisitor& aVisitor) override;
-  NS_IMETHOD AddEventListener(const nsAString& aType,
-                              nsIDOMEventListener* aListener,
-                              bool aUseCapture)
-  {
-    // By default add listeners only for trusted events!
-    return mozilla::DOMEventTargetHelper::AddEventListener(aType, aListener,
-                                                           aUseCapture, false,
-                                                           2);
-  }
-  NS_IMETHOD AddEventListener(const nsAString& aType,
-                              nsIDOMEventListener* aListener,
-                              bool aUseCapture, bool aWantsUntrusted,
-                              uint8_t optional_argc) override
-  {
-    return mozilla::DOMEventTargetHelper::AddEventListener(aType, aListener,
-                                                           aUseCapture,
-                                                           aWantsUntrusted,
-                                                           optional_argc);
-  }
-  using mozilla::DOMEventTargetHelper::AddEventListener;
 
   virtual nsIPrincipal* GetPrincipal() override { return mPrincipal; }
   void LoadFrameScript(const nsAString& aURL, bool aRunInGlobalScope);
@@ -143,12 +116,9 @@ public:
     mChromeMessageManager = aParent;
   }
 
-  virtual JSObject* GetGlobalJSObject() override {
-    return mGlobal;
-  }
-  virtual JSObject* WrapObject(JSContext* cx, JS::Handle<JSObject*> aGivenProto) override
+  virtual JSObject* GetGlobalJSObject() override
   {
-    MOZ_CRASH("nsInProcessTabChildGlobal doesn't use DOM bindings!");
+    return GetWrapper();
   }
 
   already_AddRefed<nsIFrameLoader> GetFrameLoader();
@@ -158,7 +128,6 @@ protected:
 
   nsresult Init();
   nsresult InitTabChildGlobal();
-  nsCOMPtr<nsIContentFrameMessageManager> mMessageManager;
   nsCOMPtr<nsIDocShell> mDocShell;
   bool mInitialized;
   bool mLoadingScript;

dom/base/nsJSUtils.cpp

@@ -15,6 +15,7 @@
 #include "jsapi.h"
 #include "jsfriendapi.h"
 #include "nsIScriptContext.h"
+#include "nsIScriptElement.h"
 #include "nsIScriptGlobalObject.h"
 #include "nsIXPConnect.h"
 #include "nsCOMPtr.h"

dom/base/nsWrapperCache.h

@@ -344,11 +344,7 @@ private:
   // Friend declarations for things that need to be able to call
   // SetIsNotDOMBinding().  The goal is to get rid of all of these, and
   // SetIsNotDOMBinding() too.
-  friend class mozilla::dom::TabChildGlobal;
-  friend class mozilla::dom::ProcessGlobal;
   friend class SandboxPrivate;
-  friend class nsInProcessTabChildGlobal;
-  friend class nsWindowRoot;
   void SetIsNotDOMBinding()
   {
     MOZ_ASSERT(!mWrapper && !(GetWrapperFlags() & ~WRAPPER_IS_NOT_DOM_BINDING),

dom/base/test/browser_messagemanager_loadprocessscript.js

@@ -1,10 +1,6 @@
-var ppmm = Cc["@mozilla.org/parentprocessmessagemanager;1"]
-           .getService(Ci.nsIMessageBroadcaster);
-ppmm.QueryInterface(Ci.nsIProcessScriptLoader);
-
 const BASE_NUMBER_OF_PROCESSES = 3;
 function checkBaseProcessCount(description) {
-  const {childCount} = ppmm;
+  const {childCount} = Services.ppmm;
   // With preloaded activity-stream, process count is a bit undeterministic, so
   // allow for some variation
   const extraCount = BASE_NUMBER_OF_PROCESSES + 1;
@@ -12,14 +8,12 @@ function checkBaseProcessCount(description) {
 }
 
 function processScript() {
-  let cpmm = Components.classes["@mozilla.org/childprocessmessagemanager;1"]
-           .getService(Components.interfaces.nsISyncMessageSender);
-  if (cpmm !== this) {
+  if (Services.cpmm !== this) {
     dump("Test failed: wrong global object\n");
     return;
   }
 
-  this.cpmm = cpmm;
+  this.cpmm = Services.cpmm;
 
   addMessageListener("ProcessTest:Reply", function listener(msg) {
     removeMessageListener("ProcessTest:Reply", listener);
@@ -70,7 +64,7 @@ add_task(async function(){
   if (!gMultiProcessBrowser)
     return;
 
-  ppmm.releaseCachedProcesses();
+  Services.ppmm.releaseCachedProcesses();
 
   await SpecialPowers.pushPrefEnv({"set": [["dom.ipc.processCount", 5]]})
   await SpecialPowers.pushPrefEnv({"set": [["dom.ipc.keepProcessesAlive.web", 5]]})
@@ -84,17 +78,17 @@ add_task(async function(){
     await BrowserTestUtils.removeTab(tabs[i]);
   }
 
-  ppmm.releaseCachedProcesses();
+  Services.ppmm.releaseCachedProcesses();
   checkBaseProcessCount("Should get back to the base number of processes at this point");
 })
 
 // Test that loading a process script loads in all existing processes
 add_task(async function() {
   let checks = [];
-  for (let i = 0; i < ppmm.childCount; i++)
-    checks.push(checkProcess(ppmm.getChildAt(i)));
+  for (let i = 0; i < Services.ppmm.childCount; i++)
+    checks.push(checkProcess(Services.ppmm.getChildAt(i)));
 
-  ppmm.loadProcessScript(processScriptURL, false);
+  Services.ppmm.loadProcessScript(processScriptURL, false);
   await Promise.all(checks);
 });
 
@@ -110,7 +104,7 @@ add_task(async function() {
   gBrowser.selectedBrowser.loadURI("about:robots");
   await BrowserTestUtils.browserLoaded(gBrowser.selectedBrowser);
 
-  let init = ppmm.initialProcessData;
+  let init = Services.ppmm.initialProcessData;
   init.test123 = "hello";
   init.test456 = new Map();
   init.test456.set("hi", "bye");
@@ -119,16 +113,16 @@ add_task(async function() {
   // However, stuff like remote thumbnails can cause a content
   // process to exist nonetheless. This should be rare, though,
   // so the test is useful most of the time.
-  if (ppmm.childCount == 2) {
-    let mainMM = ppmm.getChildAt(0);
+  if (Services.ppmm.childCount == 2) {
+    let mainMM = Services.ppmm.getChildAt(0);
 
-    let check = checkProcess(ppmm);
-    ppmm.loadProcessScript(processScriptURL, true);
+    let check = checkProcess(Services.ppmm);
+    Services.ppmm.loadProcessScript(processScriptURL, true);
 
     // The main process should respond
     await check;
 
-    check = checkProcess(ppmm);
+    check = checkProcess(Services.ppmm);
     // Reset the default browser to start a new child process
     gBrowser.updateBrowserRemoteness(gBrowser.selectedBrowser, true);
     gBrowser.selectedBrowser.loadURI("about:blank");
@@ -139,10 +133,10 @@ add_task(async function() {
     // The new process should have responded
     await check;
 
-    ppmm.removeDelayedProcessScript(processScriptURL);
+    Services.ppmm.removeDelayedProcessScript(processScriptURL);
 
     let childMM;
-    childMM = ppmm.getChildAt(2);
+    childMM = Services.ppmm.getChildAt(2);
 
     childMM.loadProcessScript(initTestScriptURL, false);
     let msg = await promiseMessage(childMM, "ProcessTest:InitGood");

dom/base/test/chrome/file_bug1139964.xul

@@ -11,8 +11,7 @@ https://bugzilla.mozilla.org/show_bug.cgi?id=1139964
   <label value="Mozilla Bug 1139964"/>
   <!-- test code goes here -->
   <script type="application/javascript"><![CDATA[
-  var ppm = Cc["@mozilla.org/parentprocessmessagemanager;1"]
-              .getService(Ci.nsIMessageBroadcaster);
+  var ppm = Cc["@mozilla.org/parentprocessmessagemanager;1"].getService();
 
   function ok(cond, msg) {
     opener.wrappedJSObject.ok(cond, msg);

dom/base/test/chrome/file_bug549682.xul

@@ -14,12 +14,9 @@ https://bugzilla.mozilla.org/show_bug.cgi?id=549682
   var didRunAsync = false;
   var didRunLocal = false;
 
-  var global = Cc["@mozilla.org/globalmessagemanager;1"]
-                 .getService(Components.interfaces.nsIMessageBroadcaster);
-  var ppm = Cc["@mozilla.org/parentprocessmessagemanager;1"]
-              .getService(Components.interfaces.nsIMessageBroadcaster);
-  var cpm = Cc["@mozilla.org/childprocessmessagemanager;1"]
-              .getService(Components.interfaces.nsISyncMessageSender);
+  var global = Cc["@mozilla.org/globalmessagemanager;1"].getService();
+  var ppm = Cc["@mozilla.org/parentprocessmessagemanager;1"].getService();
+  var cpm = Cc["@mozilla.org/childprocessmessagemanager;1"].getService();
 
   ChromeUtils.import("resource://gre/modules/XPCOMUtils.jsm");
 

dom/base/test/chrome/file_bug990812-1.xul

@@ -16,8 +16,7 @@ https://bugzilla.mozilla.org/show_bug.cgi?id=990812
     var FRAME_SCRIPT_WINDOW = "data:,sendSyncMessage('test', 'window')";
     var FRAME_SCRIPT_GROUP  = "data:,sendSyncMessage('test', 'group')";
 
-    var globalMM = Cc["@mozilla.org/globalmessagemanager;1"]
-                     .getService(Ci.nsIMessageListenerManager);
+    var globalMM = Cc["@mozilla.org/globalmessagemanager;1"].getService();
 
     function is(val, exp, msg) {
       opener.wrappedJSObject.is(val, exp, msg);

dom/base/test/chrome/file_bug990812-2.xul

@@ -15,8 +15,7 @@ https://bugzilla.mozilla.org/show_bug.cgi?id=990812
     var FRAME_SCRIPT = "data:,sendAsyncMessage('test')";
     var order = ["group", "window", "global"];
 
-    var globalMM = Cc["@mozilla.org/globalmessagemanager;1"]
-                     .getService(Ci.nsIMessageListenerManager);
+    var globalMM = Cc["@mozilla.org/globalmessagemanager;1"].getService();
 
     function is(val, exp, msg) {
       opener.wrappedJSObject.is(val, exp, msg);

dom/base/test/chrome/file_bug990812-3.xul

@@ -15,8 +15,7 @@ https://bugzilla.mozilla.org/show_bug.cgi?id=990812
     var FRAME_SCRIPT = "data:,addMessageListener('test', function (msg) {" +
                        "sendSyncMessage('test', msg.data)})";
 
-    var globalMM = Cc["@mozilla.org/globalmessagemanager;1"]
-                     .getService(Ci.nsIMessageListenerManager);
+    var globalMM = Cc["@mozilla.org/globalmessagemanager;1"].getService();
 
     function is(val, exp, msg) {
       opener.wrappedJSObject.is(val, exp, msg);

dom/base/test/chrome/file_bug990812-4.xul

@@ -17,8 +17,7 @@ https://bugzilla.mozilla.org/show_bug.cgi?id=990812
     var FRAME_SCRIPT2 = "data:,addMessageListener('test', function () {" +
                         "sendSyncMessage('test', 'frame2')})";
 
-    var globalMM = Cc["@mozilla.org/globalmessagemanager;1"]
-                     .getService(Ci.nsIMessageListenerManager);
+    var globalMM = Cc["@mozilla.org/globalmessagemanager;1"].getService();
 
     function is(val, exp, msg) {
       opener.wrappedJSObject.is(val, exp, msg);

dom/base/test/chrome/file_bug990812-5.xul

@@ -17,8 +17,7 @@ https://bugzilla.mozilla.org/show_bug.cgi?id=990812
     var FRAME_SCRIPT2 = "data:,addMessageListener('test', function () {" +
                         "sendSyncMessage('test', 'group2')})";
 
-    var globalMM = Cc["@mozilla.org/globalmessagemanager;1"]
-                     .getService(Ci.nsIMessageListenerManager);
+    var globalMM = Cc["@mozilla.org/globalmessagemanager;1"].getService();
 
     function is(val, exp, msg) {
       opener.wrappedJSObject.is(val, exp, msg);

dom/base/test/chrome/file_bug990812.xul

@@ -16,8 +16,7 @@ https://bugzilla.mozilla.org/show_bug.cgi?id=990812
     var FRAME_SCRIPT_WINDOW = "data:,sendSyncMessage('test', 'window')";
     var FRAME_SCRIPT_GROUP  = "data:,sendSyncMessage('test', 'group')";
 
-    var globalMM = Cc["@mozilla.org/globalmessagemanager;1"]
-                     .getService(Ci.nsIMessageListenerManager);
+    var globalMM = Cc["@mozilla.org/globalmessagemanager;1"].getService();
 
     function is(val, exp, msg) {
       opener.wrappedJSObject.is(val, exp, msg);

dom/base/test/chrome/test_bug1098074_throw_from_ReceiveMessage.xul

@@ -21,8 +21,7 @@ https://bugzilla.mozilla.org/show_bug.cgi?id=1098074
   // with SimpleTest.finish as a continuation function.
   SimpleTest.monitorConsole(SimpleTest.finish, [{errorMessage: new RegExp('acopia')}]);
 
-  var globalMM = Cc["@mozilla.org/globalmessagemanager;1"]
-                   .getService(Ci.nsIMessageListenerManager);
+  var globalMM = Cc["@mozilla.org/globalmessagemanager;1"].getService();
   globalMM.addMessageListener("flimfniffle", function onMessage(msg) {
     globalMM.removeMessageListener("flimfniffle", onMessage);
     is(msg.data, "teufeltor", "correct message");

dom/base/test/test_domrequesthelper.xul

@@ -18,8 +18,7 @@
     ChromeUtils.import("resource://gre/modules/DOMRequestHelper.jsm");
     let obs = Cc["@mozilla.org/observer-service;1"].
               getService(Ci.nsIObserverService);
-    let ppmm = Cc["@mozilla.org/parentprocessmessagemanager;1"].
-              getService(Ci.nsIMessageBroadcaster);
+    let ppmm = Cc["@mozilla.org/parentprocessmessagemanager;1"].getService();
 
     function DummyHelperSubclass() {
       this.onuninit = null;

dom/bindings/BindingUtils.cpp

@@ -3127,11 +3127,22 @@ ConvertExceptionToPromise(JSContext* cx,
 
 /* static */
 void
-CreateGlobalOptions<nsGlobalWindowInner>::TraceGlobal(JSTracer* aTrc, JSObject* aObj)
+CreateGlobalOptionsWithXPConnect::TraceGlobal(JSTracer* aTrc, JSObject* aObj)
 {
   xpc::TraceXPCGlobal(aTrc, aObj);
 }
 
+/* static */
+bool
+CreateGlobalOptionsWithXPConnect::PostCreateGlobal(JSContext* aCx,
+                                                   JS::Handle<JSObject*> aGlobal)
+{
+  // Invoking the XPCWrappedNativeScope constructor automatically hooks it
+  // up to the compartment of aGlobal.
+  (void) new XPCWrappedNativeScope(aCx, aGlobal);
+  return true;
+}
+
 static bool sRegisteredDOMNames = false;
 
 nsresult
@@ -3165,10 +3176,7 @@ CreateGlobalOptions<nsGlobalWindowInner>::PostCreateGlobal(JSContext* aCx,
     return Throw(aCx, rv);
   }
 
-  // Invoking the XPCWrappedNativeScope constructor automatically hooks it
-  // up to the compartment of aGlobal.
-  (void) new XPCWrappedNativeScope(aCx, aGlobal);
-  return true;
+  return CreateGlobalOptionsWithXPConnect::PostCreateGlobal(aCx, aGlobal);
 }
 
 #ifdef DEBUG

dom/bindings/BindingUtils.h

@@ -50,6 +50,7 @@ enum UseCounter : int16_t;
 
 namespace dom {
 class CustomElementReactionsStack;
+class MessageManagerGlobal;
 template<typename KeyType, typename ValueType> class Record;
 
 nsresult
@@ -3100,11 +3101,9 @@ bool
 EnumerateGlobal(JSContext* aCx, JS::HandleObject aObj,
                 JS::AutoIdVector& aProperties, bool aEnumerableOnly);
 
-template <class T>
-struct CreateGlobalOptions
+
+struct CreateGlobalOptionsGeneric
 {
-  static constexpr ProtoAndIfaceCache::Kind ProtoAndIfaceCacheKind =
-    ProtoAndIfaceCache::NonWindowLike;
   static void TraceGlobal(JSTracer* aTrc, JSObject* aObj)
   {
     mozilla::dom::TraceProtoAndIfaceCache(aTrc, aObj);
@@ -3117,12 +3116,34 @@ struct CreateGlobalOptions
   }
 };
 
+struct CreateGlobalOptionsWithXPConnect
+{
+  static void TraceGlobal(JSTracer* aTrc, JSObject* aObj);
+  static bool PostCreateGlobal(JSContext* aCx, JS::Handle<JSObject*> aGlobal);
+};
+
+template <class T>
+using IsGlobalWithXPConnect =
+  IntegralConstant<bool,
+                   IsBaseOf<nsGlobalWindowInner, T>::value ||
+                   IsBaseOf<MessageManagerGlobal, T>::value>;
+
+template <class T>
+struct CreateGlobalOptions
+  : Conditional<IsGlobalWithXPConnect<T>::value,
+                CreateGlobalOptionsWithXPConnect,
+                CreateGlobalOptionsGeneric>::Type
+{
+  static constexpr ProtoAndIfaceCache::Kind ProtoAndIfaceCacheKind =
+    ProtoAndIfaceCache::NonWindowLike;
+};
+
 template <>
 struct CreateGlobalOptions<nsGlobalWindowInner>
+  : public CreateGlobalOptionsWithXPConnect
 {
   static constexpr ProtoAndIfaceCache::Kind ProtoAndIfaceCacheKind =
     ProtoAndIfaceCache::WindowLike;
-  static void TraceGlobal(JSTracer* aTrc, JSObject* aObj);
   static bool PostCreateGlobal(JSContext* aCx, JS::Handle<JSObject*> aGlobal);
 };
 
@@ -3213,11 +3234,11 @@ class PinnedStringId
     return true;
   }
 
-  operator const jsid& () {
+  operator const jsid& () const {
     return id;
   }
 
-  operator JS::Handle<jsid> () {
+  operator JS::Handle<jsid> () const {
     /* This is safe because we have pinned the string. */
     return JS::Handle<jsid>::fromMarkedLocation(&id);
   }

dom/bindings/Bindings.conf

@@ -152,6 +152,10 @@ DOMInterfaces = {
     'implicitJSContext': ['clear', 'count', 'groupEnd', 'time', 'timeEnd'],
 },
 
+'ContentProcessMessageManager': {
+    'nativeType': 'mozilla::dom::ProcessGlobal'
+},
+
 'ConvolverNode': {
     'implicitJSContext': [ 'buffer' ],
 },
@@ -570,6 +574,18 @@ DOMInterfaces = {
     'headerFile': 'MediaRecorder.h',
 },
 
+'MessageBroadcaster': {
+    'concrete': False
+},
+
+'MessageListenerManager': {
+    'concrete': False
+},
+
+'MessageSender': {
+    'concrete': False
+},
+
 'MimeType': {
     'headerFile' : 'nsMimeTypeArray.h',
     'nativeType': 'nsMimeType',
@@ -1015,6 +1031,10 @@ DOMInterfaces = {
     'concrete': False,
 },
 
+'SyncMessageSender' : {
+    'concrete': False,
+},
+
 'TestFunctions': {
     'wrapperCache': False
 },
@@ -1711,13 +1731,10 @@ addExternalIface('MozTreeView', nativeType='nsITreeView',
 addExternalIface('MozWakeLockListener', headerFile='nsIDOMWakeLockListener.h')
 addExternalIface('nsIBrowserDOMWindow', nativeType='nsIBrowserDOMWindow',
                  notflattened=True)
+addExternalIface('nsIEventTarget', nativeType='nsIEventTarget', notflattened=True)
 addExternalIface('nsIFile', nativeType='nsIFile', notflattened=True)
 addExternalIface('nsILoadGroup', nativeType='nsILoadGroup',
                  headerFile='nsILoadGroup.h', notflattened=True)
-addExternalIface('nsIMessageBroadcaster', nativeType='nsIMessageBroadcaster',
-                 headerFile='nsIMessageManager.h', notflattened=True)
-addExternalIface('nsIMessageSender', nativeType='nsIMessageSender',
-                 headerFile='nsIMessageManager.h', notflattened=True)
 addExternalIface('nsIPrintSettings', nativeType='nsIPrintSettings',
                  notflattened=True)
 addExternalIface('nsISelectionListener', nativeType='nsISelectionListener')

dom/bindings/Codegen.py

@@ -281,12 +281,15 @@ class CGStringTable(CGThing):
     The uint16_t indices are smaller than the pointer equivalents, and the
     string table requires no runtime relocations.
     """
-    def __init__(self, accessorName, strings):
+    def __init__(self, accessorName, strings, static=False):
         CGThing.__init__(self)
         self.accessorName = accessorName
         self.strings = strings
+        self.static = static
 
     def declare(self):
+        if self.static:
+            return ""
         return "extern const char *%s(unsigned int aIndex);\n" % self.accessorName
 
     def define(self):
@@ -298,7 +301,7 @@ class CGStringTable(CGThing):
             currentIndex += len(s) + 1  # for the null terminator
         return fill(
             """
-            const char *${name}(unsigned int aIndex)
+            ${static}const char *${name}(unsigned int aIndex)
             {
               static const char table[] = ${table};
               static const uint16_t indices[] = { ${indices} };
@@ -306,6 +309,7 @@ class CGStringTable(CGThing):
               return &table[indices[aIndex]];
             }
             """,
+            static="static " if self.static else "",
             name=self.accessorName,
             table=table,
             indices=", ".join("%d" % index for index in indices),
@@ -1103,7 +1107,7 @@ class CGHeaders(CGWrapper):
                                       interfacesImplementingSelf)
 
         # Grab the includes for the things that involve XPCOM interfaces
-        hasInstanceIncludes = set("nsIDOM" + d.interface.identifier.name + ".h" for d
+        hasInstanceIncludes = set(self.getDeclarationFilename(d.interface) for d
                                   in descriptors if
                                   d.interface.hasInterfaceObject() and
                                   NeedsGeneratedHasInstance(d) and
@@ -13949,58 +13953,120 @@ class CGRegisterWorkletBindings(CGAbstractMethod):
         lines.append(CGGeneric("return true;\n"))
         return CGList(lines, "\n").define()
 
+
+class CGSystemBindingInitIds(CGAbstractMethod):
+    def __init__(self):
+        CGAbstractMethod.__init__(self, None, 'SystemBindingInitIds', 'bool',
+                                  [Argument('JSContext*', 'aCx')])
+
+    def definition_body(self):
+        return dedent("""
+            MOZ_ASSERT(NS_IsMainThread());
+
+            if (!idsInited) {
+              // We can't use range-based for because we need the index to call IdString.
+              for (uint32_t i = 0; i < ArrayLength(properties); ++i) {
+                if (!properties[i].id.init(aCx, IdString(i))) {
+                  return false;
+                }
+              }
+              idsInited = true;
+            }
+
+            return true;
+            """)
+
+
 class CGResolveSystemBinding(CGAbstractMethod):
-    def __init__(self, config):
+    def __init__(self):
         CGAbstractMethod.__init__(self, None, 'ResolveSystemBinding', 'bool',
                                   [Argument('JSContext*', 'aCx'),
                                    Argument('JS::Handle<JSObject*>', 'aObj'),
                                    Argument('JS::Handle<jsid>', 'aId'),
                                    Argument('bool*', 'aResolvedp')])
-        self.config = config
 
     def definition_body(self):
-        descriptors = self.config.getDescriptors(hasInterfaceObject=True,
-                                                 isExposedInSystemGlobals=True,
-                                                 register=True)
+        return dedent("""
+            MOZ_ASSERT(NS_IsMainThread());
+            MOZ_ASSERT(idsInited);
 
-        def descNameToId(name):
-            return "s%s_id" % name
-        jsidNames = [descNameToId(desc.name) for desc in descriptors]
-        jsidDecls = CGList(CGGeneric("static jsid %s;\n" % name)
-                           for name in jsidNames)
+            if (JSID_IS_VOID(aId)) {
+              for (const auto& property : properties) {
+                if (!property.enabled || property.enabled(aCx, aObj)) {
+                  if (!property.define(aCx)) {
+                    return false;
+                  }
+                  *aResolvedp = true;
+                }
+              }
+              return true;
+            }
 
-        jsidInits = CGList(
-            (CGIfWrapper(
-                CGGeneric("return false;\n"),
-                '!AtomizeAndPinJSString(aCx, %s, "%s")' %
-                (descNameToId(desc.name), desc.interface.identifier.name))
-             for desc in descriptors),
-            "\n")
-        jsidInits.append(CGGeneric("idsInited = true;\n"))
-        jsidInits = CGIfWrapper(jsidInits, "!idsInited")
-        jsidInits = CGList([CGGeneric("static bool idsInited = false;\n"),
-                            jsidInits])
+            for (const auto& property : properties) {
+              if (property.id == aId) {
+                if (!property.enabled || property.enabled(aCx, aObj)) {
+                  if (!property.define(aCx)) {
+                    return false;
+                  }
+                  *aResolvedp = true;
+                  break;
+                }
+              }
+            }
+            return true;
+            """)
 
-        definitions = CGList([], "\n")
-        for desc in descriptors:
-            bindingNS = toBindingNamespace(desc.name)
-            defineCode = "!%s::GetConstructorObject(aCx)" % bindingNS
-            defineCode = CGIfWrapper(CGGeneric("return false;\n"), defineCode)
-            defineCode = CGList([defineCode,
-                                 CGGeneric("*aResolvedp = true;\n")])
 
-            condition = "JSID_IS_VOID(aId) || aId == %s" % descNameToId(desc.name)
-            if desc.isExposedConditionally():
-                condition = "(%s) && %s::ConstructorEnabled(aCx, aObj)" % (condition, bindingNS)
+class CGMayResolveAsSystemBindingName(CGAbstractMethod):
+    def __init__(self):
+        CGAbstractMethod.__init__(self, None, 'MayResolveAsSystemBindingName', 'bool',
+                                  [Argument('jsid', 'aId')])
 
-            definitions.append(CGIfWrapper(defineCode, condition))
+    def definition_body(self):
+        return dedent("""
+            MOZ_ASSERT(NS_IsMainThread());
+            MOZ_ASSERT(idsInited);
 
-        return CGList([CGGeneric("MOZ_ASSERT(NS_IsMainThread());\n"),
-                       jsidDecls,
-                       jsidInits,
-                       definitions,
-                       CGGeneric("return true;\n")],
-                      "\n").define()
+            for (const auto& property : properties) {
+              if (aId == property.id) {
+                return true;
+              }
+            }
+            return false;
+            """)
+
+
+class CGGetSystemBindingNames(CGAbstractMethod):
+    def __init__(self):
+        CGAbstractMethod.__init__(self, None, 'GetSystemBindingNames', 'void',
+                                  [Argument('JSContext*', 'aCx'),
+                                   Argument('JS::Handle<JSObject*>', 'aObj'),
+                                   Argument('JS::AutoIdVector&', 'aNames'),
+                                   Argument('bool', 'aEnumerableOnly'),
+                                   Argument('mozilla::ErrorResult&', 'aRv')])
+
+    def definition_body(self):
+        return dedent("""
+            MOZ_ASSERT(NS_IsMainThread());
+
+            if (aEnumerableOnly) {
+              return;
+            }
+
+            if (!SystemBindingInitIds(aCx)) {
+              aRv.NoteJSContextException(aCx);
+              return;
+            }
+
+            for (const auto& property : properties) {
+              if (!property.enabled || property.enabled(aCx, aObj)) {
+                if (!aNames.append(property.id)) {
+                  aRv.Throw(NS_ERROR_OUT_OF_MEMORY);
+                  return;
+                }
+              }
+            }
+            """)
 
 
 def getGlobalNames(config):
@@ -17496,8 +17562,44 @@ class GlobalGenRoots():
 
     @staticmethod
     def ResolveSystemBinding(config):
+        curr = CGList([], "\n")
+        
+        descriptors = config.getDescriptors(hasInterfaceObject=True,
+                                            isExposedInSystemGlobals=True,
+                                            register=True)
+        properties = [desc.name for desc in descriptors]
+        
+        curr.append(CGStringTable("IdString", properties, static=True))
 
-        curr = CGResolveSystemBinding(config)
+        initValues = []
+        for desc in descriptors:
+            bindingNS = toBindingNamespace(desc.name)
+            if desc.isExposedConditionally():
+                enabled = "%s::ConstructorEnabled" % bindingNS
+            else:
+                enabled = "nullptr"
+            define = "%s::GetConstructorObject" % bindingNS
+            initValues.append("{ %s, %s },\n" % (enabled, define))
+        curr.append(CGGeneric(fill("""
+            struct SystemProperty
+            {
+              WebIDLGlobalNameHash::ConstructorEnabled enabled;
+              ProtoGetter define;
+              PinnedStringId id;
+            };
+          
+            static SystemProperty properties[] = {
+              $*{init}
+            };
+
+            static bool idsInited = false;
+            """,
+            init="".join(initValues))))
+
+        curr.append(CGSystemBindingInitIds())
+        curr.append(CGResolveSystemBinding())
+        curr.append(CGMayResolveAsSystemBindingName())
+        curr.append(CGGetSystemBindingNames())
 
         # Wrap all of that in our namespaces.
         curr = CGNamespace.build(['mozilla', 'dom'],
@@ -17511,7 +17613,7 @@ class GlobalGenRoots():
                                                             isExposedInSystemGlobals=True)]
         defineIncludes.append("nsThreadUtils.h")  # For NS_IsMainThread
         defineIncludes.append("js/Id.h")  # For jsid
-        defineIncludes.append("mozilla/dom/BindingUtils.h")  # AtomizeAndPinJSString
+        defineIncludes.append("mozilla/dom/WebIDLGlobalNameHash.h")
 
         curr = CGHeaders([], [], [], [], [], defineIncludes,
                          'ResolveSystemBinding', curr)

dom/bindings/ToJSValue.h

@@ -233,6 +233,13 @@ ToJSValue(JSContext* aCx,
 
 // Accept existing JS values (which may not be same-compartment with us
 MOZ_MUST_USE inline bool
+ToJSValue(JSContext* aCx, const JS::Value& aArgument,
+          JS::MutableHandle<JS::Value> aValue)
+{
+  aValue.set(aArgument);
+  return MaybeWrapValue(aCx, aValue);
+}
+MOZ_MUST_USE inline bool
 ToJSValue(JSContext* aCx, JS::Handle<JS::Value> aArgument,
           JS::MutableHandle<JS::Value> aValue)
 {
@@ -312,33 +319,13 @@ ToJSValue(JSContext* aCx,
           Promise& aArgument,
           JS::MutableHandle<JS::Value> aValue);
 
-// Accept arrays of other things we accept
+// Accept arrays (and nested arrays) of other things we accept
 template <typename T>
 MOZ_MUST_USE bool
 ToJSValue(JSContext* aCx,
           T* aArguments,
           size_t aLength,
-          JS::MutableHandle<JS::Value> aValue)
-{
-  // Make sure we're called in a compartment
-  MOZ_ASSERT(JS::CurrentGlobalOrNull(aCx));
-
-  JS::AutoValueVector v(aCx);
-  if (!v.resize(aLength)) {
-    return false;
-  }
-  for (size_t i = 0; i < aLength; ++i) {
-    if (!ToJSValue(aCx, aArguments[i], v[i])) {
-      return false;
-    }
-  }
-  JSObject* arrayObj = JS_NewArrayObject(aCx, v);
-  if (!arrayObj) {
-    return false;
-  }
-  aValue.setObject(*arrayObj);
-  return true;
-}
+          JS::MutableHandle<JS::Value> aValue);
 
 template <typename T>
 MOZ_MUST_USE bool
@@ -369,6 +356,34 @@ ToJSValue(JSContext* aCx,
   return ToJSValue(aCx, aArgument, N, aValue);
 }
 
+// Accept arrays of other things we accept
+template <typename T>
+MOZ_MUST_USE bool
+ToJSValue(JSContext* aCx,
+          T* aArguments,
+          size_t aLength,
+          JS::MutableHandle<JS::Value> aValue)
+{
+  // Make sure we're called in a compartment
+  MOZ_ASSERT(JS::CurrentGlobalOrNull(aCx));
+
+  JS::AutoValueVector v(aCx);
+  if (!v.resize(aLength)) {
+    return false;
+  }
+  for (size_t i = 0; i < aLength; ++i) {
+    if (!ToJSValue(aCx, aArguments[i], v[i])) {
+      return false;
+    }
+  }
+  JSObject* arrayObj = JS_NewArrayObject(aCx, v);
+  if (!arrayObj) {
+    return false;
+  }
+  aValue.setObject(*arrayObj);
+  return true;
+}
+
 } // namespace dom
 } // namespace mozilla
 

dom/bindings/WebIDLGlobalNameHash.cpp

@@ -111,7 +111,7 @@ struct WebIDLNameTableEntry : public PLDHashEntryHdr
   constructors::id::ID mConstructorId;
   WebIDLGlobalNameHash::DefineGlobalName mDefine;
   // May be null if enabled unconditionally
-  WebIDLGlobalNameHash::ConstructorEnabled* mEnabled;
+  WebIDLGlobalNameHash::ConstructorEnabled mEnabled;
 };
 
 static nsTHashtable<WebIDLNameTableEntry>* sWebIDLGlobalNames;
@@ -163,7 +163,7 @@ WebIDLGlobalNameHash::Shutdown()
 void
 WebIDLGlobalNameHash::Register(uint16_t aNameOffset, uint16_t aNameLength,
                                DefineGlobalName aDefine,
-                               ConstructorEnabled* aEnabled,
+                               ConstructorEnabled aEnabled,
                                constructors::id::ID aConstructorId)
 {
   const char* name = sNames + aNameOffset;
@@ -211,7 +211,7 @@ WebIDLGlobalNameHash::DefineIfEnabled(JSContext* aCx,
 
   *aFound = true;
 
-  ConstructorEnabled* checkEnabledForScope = entry->mEnabled;
+  ConstructorEnabled checkEnabledForScope = entry->mEnabled;
   // We do the enabled check on the current compartment of aCx, but for the
   // actual object we pass in the underlying object in the Xray case.  That
   // way the callee can decide whether to allow access based on the caller

dom/bindings/WebIDLGlobalNameHash.h

@@ -38,10 +38,10 @@ public:
   // pointer, so it's more obvious that pointers to a ConstructorEnabled
   // can be null.
   typedef bool
-  (ConstructorEnabled)(JSContext* cx, JS::Handle<JSObject*> obj);
+  (*ConstructorEnabled)(JSContext* cx, JS::Handle<JSObject*> obj);
 
   static void Register(uint16_t aNameOffset, uint16_t aNameLength,
-                       DefineGlobalName aDefine, ConstructorEnabled* aEnabled,
+                       DefineGlobalName aDefine, ConstructorEnabled aEnabled,
                        constructors::id::ID aConstructorId);
 
   static void Remove(const char* aName, uint32_t aLength);

dom/file/tests/test_ipc_messagemanager_blob.html

@@ -72,10 +72,10 @@
         let receivedMessageIndex = 0;
 
         let mm = SpecialPowers.getBrowserFrameMessageManager(iframe);
-        mm.addMessageListener("test:ipcClonedMessage", function(message) {
+        mm.addMessageListener("test:ipcClonedMessage", SpecialPowers.wrapCallback(function(message) {
           let data = message.json;
 
-          if (data instanceof Blob) {
+          if (SpecialPowers.call_Instanceof(data, Blob)) {
             is(receivedMessageIndex, messages.length - 1, "Blob is last");
             is (data.size,
                 messages[receivedMessageIndex].size,
@@ -104,7 +104,7 @@
               }
             };
 
-            reader1.readAsText(data);
+            SpecialPowers.wrap(reader1).readAsText(data);
             reader2.readAsText(messages[receivedMessageIndex]);
             return;
           }
@@ -112,7 +112,7 @@
           is(message.json,
              messages[receivedMessageIndex++],
              "Got correct round-tripped response");
-        });
+        }));
         mm.loadFrameScript("data:,(" + childFrameScript.toString() + ")();",
                            false);
 

dom/indexedDB/test/head.js

@@ -80,11 +80,14 @@ function waitForMessage(aMessage, browser)
 {
   return new Promise((resolve, reject) => {
     /* eslint-disable no-undef */
+    // When contentScript runs, "this" is a ContentFrameMessageManager (so that's where
+    // addEventListener will add the listener), but the non-bubbling "message" event is
+    // sent to the Window involved, so we need a capturing listener.
     function contentScript() {
       addEventListener("message", function(event) {
         sendAsyncMessage("testLocal:message",
           {message: event.data});
-      }, {once: true}, true);
+      }, {once: true, capture: true}, true);
     }
     /* eslint-enable no-undef */
 

dom/indexedDB/test/test_message_manager_ipc.html

@@ -214,16 +214,16 @@ function parentFrameScript(mm) {
   function* testSteps() {
     let result = yield undefined;
 
-    is(Array.isArray(result), true, "Child delivered an array of results");
+    is(SpecialPowers.Cu.getClassName(result, true), "Array", "Child delivered an array of results");
     is(result.length, 2, "Child delivered two results");
 
     let blob = result[0];
-    is(blob instanceof Blob, true, "Child delivered a blob");
+    is(SpecialPowers.call_Instanceof(blob, Blob), true, "Child delivered a blob");
     is(blob.size, blobText.length, "Blob has correct size");
     is(blob.type, blobType, "Blob has correct type");
 
     let slice = result[1];
-    is(slice instanceof Blob, true, "Child delivered a slice");
+    is(SpecialPowers.call_Instanceof(slice, Blob), true, "Child delivered a slice");
     is(slice.size, blobData[0].length, "Slice has correct size");
     is(slice.type, blobType, "Slice has correct type");
 
@@ -231,7 +231,7 @@ function parentFrameScript(mm) {
 
     let reader = new FileReader();
     reader.onload = grabAndContinue;
-    reader.readAsText(blob);
+    SpecialPowers.wrap(reader).readAsText(blob);
     yield undefined;
 
     is(reader.result, blobText, "Blob has correct data");
@@ -240,14 +240,14 @@ function parentFrameScript(mm) {
 
     reader = new FileReader();
     reader.onload = grabAndContinue;
-    reader.readAsText(slice);
+    SpecialPowers.wrap(reader).readAsText(slice);
     yield undefined;
 
     is(reader.result, blobData[0], "Slice has correct data");
 
     slice = blob.slice(0, blobData[0].length, blobType);
 
-    is(slice instanceof Blob, true, "Made a new slice from blob");
+    is(SpecialPowers.call_Instanceof(slice, Blob), true, "Child delivered a slice");
     is(slice.size, blobData[0].length, "Second slice has correct size");
     is(slice.type, blobType, "Second slice has correct type");
 
@@ -255,7 +255,7 @@ function parentFrameScript(mm) {
 
     reader = new FileReader();
     reader.onload = grabAndContinue;
-    reader.readAsText(slice);
+    SpecialPowers.wrap(reader).readAsText(slice);
     yield undefined;
 
     is(reader.result, blobData[0], "Second slice has correct data");
@@ -266,7 +266,7 @@ function parentFrameScript(mm) {
   let testGenerator = testSteps();
   testGenerator.next();
 
-  mm.addMessageListener(messageName, function(message) {
+  mm.addMessageListener(messageName, SpecialPowers.wrapCallback(function(message) {
     let data = message.data;
     switch (data.op) {
       case "info": {
@@ -289,7 +289,7 @@ function parentFrameScript(mm) {
         SimpleTest.finish();
       }
     }
-  });
+  }));
 
   mm.loadFrameScript("data:,(" + childFrameScript.toString() + ")();",
                       false);

dom/interfaces/base/nsIContentProcess.idl

@@ -5,7 +5,6 @@
 #include "nsISupports.idl"
 
 interface nsIDOMElement;
-interface nsIMessageSender;
 interface nsIURI;
 
 [scriptable, builtinclass, uuid(456f58be-29dd-4973-885b-95aece1c9a8a)]
@@ -36,7 +35,7 @@ interface nsIContentProcessInfo : nsISupports
    * The process manager for this ContentParent (so a process message manager
    * as opposed to a frame message manager.
    */
-  readonly attribute nsIMessageSender messageManager;
+  readonly attribute nsISupports messageManager;
 };
 
 [scriptable, uuid(83ffb063-5f65-4c45-ae07-3f553e0809bb)]

dom/interfaces/base/nsITabChild.idl

@@ -6,7 +6,6 @@
 #include "domstubs.idl"
 #include "nsIDroppedLinkHandler.idl"
 
-interface nsIContentFrameMessageManager;
 interface nsIWebBrowserChrome3;
 
 native CommandsArray(nsTArray<nsCString>);
@@ -15,7 +14,7 @@ native CommandsArray(nsTArray<nsCString>);
 [scriptable, uuid(1fb79c27-e760-4088-b19c-1ce3673ec24e)]
 interface nsITabChild : nsISupports
 {
-  readonly attribute nsIContentFrameMessageManager messageManager;
+  readonly attribute nsISupports messageManager;
 
   attribute nsIWebBrowserChrome3 webBrowserChrome;
 

dom/ipc/ContentBridgeParent.cpp

@@ -5,6 +5,7 @@
  * You can obtain one at http://mozilla.org/MPL/2.0/. */
 
 #include "mozilla/dom/ContentBridgeParent.h"
+#include "mozilla/dom/ChromeMessageSender.h"
 #include "mozilla/dom/TabParent.h"
 #include "mozilla/jsipc/CrossProcessObjectWrappers.h"
 #include "nsXULAppAPI.h"

dom/ipc/ContentChild.cpp

@@ -24,6 +24,7 @@
 #include "mozilla/docshell/OfflineCacheUpdateChild.h"
 #include "mozilla/dom/ClientManager.h"
 #include "mozilla/dom/ClientOpenWindowOpActors.h"
+#include "mozilla/dom/ChildProcessMessageManager.h"
 #include "mozilla/dom/ContentBridgeChild.h"
 #include "mozilla/dom/ContentBridgeParent.h"
 #include "mozilla/dom/DOMPrefs.h"

dom/ipc/ContentParent.cpp

@@ -526,7 +526,7 @@ ScriptableCPInfo::GetTabCount(int32_t* aTabCount)
 }
 
 NS_IMETHODIMP
-ScriptableCPInfo::GetMessageManager(nsIMessageSender** aMessenger)
+ScriptableCPInfo::GetMessageManager(nsISupports** aMessenger)
 {
   *aMessenger = nullptr;
   if (!mContentParent) {

dom/ipc/TabChild.cpp

@@ -19,6 +19,7 @@
 #include "mozilla/BrowserElementParent.h"
 #include "mozilla/ClearOnShutdown.h"
 #include "mozilla/EventListenerManager.h"
+#include "mozilla/dom/MessageManagerBinding.h"
 #include "mozilla/dom/indexedDB/PIndexedDBPermissionRequestChild.h"
 #include "mozilla/dom/PaymentRequestChild.h"
 #include "mozilla/dom/TelemetryScrollProbe.h"
@@ -104,7 +105,6 @@
 #include "UnitTransforms.h"
 #include "ClientLayerManager.h"
 #include "LayersLogging.h"
-#include "nsDOMClassInfoID.h"
 #include "nsColorPickerProxy.h"
 #include "nsContentPermissionHelper.h"
 #include "nsNetUtil.h"
@@ -236,11 +236,10 @@ TabChildBase::DispatchMessageManagerMessage(const nsAString& aMessageName,
         }
     }
 
-    JS::Rooted<JSObject*> kungFuDeathGrip(cx, GetGlobal());
+    JS::Rooted<JSObject*> kungFuDeathGrip(cx, mTabChildGlobal->GetWrapper());
     // Let the BrowserElementScrolling helper (if it exists) for this
     // content manipulate the frame state.
-    RefPtr<nsFrameMessageManager> mm =
-      static_cast<nsFrameMessageManager*>(mTabChildGlobal->mMessageManager.get());
+    RefPtr<nsFrameMessageManager> mm = mTabChildGlobal->GetMessageManager();
     mm->ReceiveMessage(static_cast<EventTarget*>(mTabChildGlobal), nullptr,
                        aMessageName, false, &data, nullptr, nullptr, nullptr);
 }
@@ -272,7 +271,7 @@ TabChildBase::UpdateFrameHandler(const FrameMetrics& aFrameMetrics)
 void
 TabChildBase::ProcessUpdateFrame(const FrameMetrics& aFrameMetrics)
 {
-    if (!mGlobal || !mTabChildGlobal) {
+    if (!mTabChildGlobal) {
         return;
     }
 
@@ -1109,13 +1108,11 @@ TabChild::ActorDestroy(ActorDestroyReason why)
     // We should have a message manager if the global is alive, but it
     // seems sometimes we don't.  Assert in aurora/nightly, but don't
     // crash in release builds.
-    MOZ_DIAGNOSTIC_ASSERT(mTabChildGlobal->mMessageManager);
-    if (mTabChildGlobal->mMessageManager) {
+    MOZ_DIAGNOSTIC_ASSERT(mTabChildGlobal->GetMessageManager());
+    if (mTabChildGlobal->GetMessageManager()) {
       // The messageManager relays messages via the TabChild which
       // no longer exists.
-      static_cast<nsFrameMessageManager*>
-        (mTabChildGlobal->mMessageManager.get())->Disconnect();
-      mTabChildGlobal->mMessageManager = nullptr;
+      mTabChildGlobal->DisconnectMessageManager();
     }
   }
 
@@ -1362,9 +1359,11 @@ TabChild::HandleDoubleTap(const CSSPoint& aPoint, const Modifiers& aModifiers,
                           const ScrollableLayerGuid& aGuid)
 {
   TABC_LOG("Handling double tap at %s with %p %p\n",
-    Stringify(aPoint).c_str(), mGlobal.get(), mTabChildGlobal.get());
+    Stringify(aPoint).c_str(),
+    mTabChildGlobal ? mTabChildGlobal->GetWrapper() : nullptr,
+    mTabChildGlobal.get());
 
-  if (!mGlobal || !mTabChildGlobal) {
+  if (!mTabChildGlobal || !mTabChildGlobal->GetWrapper()) {
     return;
   }
 
@@ -1405,7 +1404,7 @@ TabChild::RecvHandleTap(const GeckoContentController::TapType& aType,
 
   switch (aType) {
   case GeckoContentController::TapType::eSingleTap:
-    if (mGlobal && mTabChildGlobal) {
+    if (mTabChildGlobal) {
       mAPZEventState->ProcessSingleTap(point, scale, aModifiers, aGuid, 1);
     }
     break;
@@ -1413,18 +1412,18 @@ TabChild::RecvHandleTap(const GeckoContentController::TapType& aType,
     HandleDoubleTap(point, aModifiers, aGuid);
     break;
   case GeckoContentController::TapType::eSecondTap:
-    if (mGlobal && mTabChildGlobal) {
+    if (mTabChildGlobal) {
       mAPZEventState->ProcessSingleTap(point, scale, aModifiers, aGuid, 2);
     }
     break;
   case GeckoContentController::TapType::eLongTap:
-    if (mGlobal && mTabChildGlobal) {
+    if (mTabChildGlobal) {
       mAPZEventState->ProcessLongTap(presShell, point, scale, aModifiers, aGuid,
           aInputBlockId);
     }
     break;
   case GeckoContentController::TapType::eLongTapUp:
-    if (mGlobal && mTabChildGlobal) {
+    if (mTabChildGlobal) {
       mAPZEventState->ProcessLongTapUp(presShell, point, scale, aModifiers);
     }
     break;
@@ -2276,12 +2275,18 @@ TabChild::RecvActivateFrameEvent(const nsString& aType, const bool& capture)
 mozilla::ipc::IPCResult
 TabChild::RecvLoadRemoteScript(const nsString& aURL, const bool& aRunInGlobalScope)
 {
-  if (!mGlobal && !InitTabChildGlobal())
+  if (!InitTabChildGlobal())
     // This can happen if we're half-destroyed.  It's not a fatal
     // error.
     return IPC_OK();
 
-  LoadScriptInternal(aURL, aRunInGlobalScope);
+  JS::Rooted<JSObject*> global(RootingCx(), mTabChildGlobal->GetWrapper());
+  if (!global) {
+    // This can happen if we're half-destroyed.  It's not a fatal error.
+    return IPC_OK();
+  }
+
+  LoadScriptInternal(global, aURL, aRunInGlobalScope);
   return IPC_OK();
 }
 
@@ -2299,19 +2304,19 @@ TabChild::RecvAsyncMessage(const nsString& aMessage,
     return IPC_OK();
   }
 
+  RefPtr<nsFrameMessageManager> mm = mTabChildGlobal->GetMessageManager();
+
   // We should have a message manager if the global is alive, but it
   // seems sometimes we don't.  Assert in aurora/nightly, but don't
   // crash in release builds.
-  MOZ_DIAGNOSTIC_ASSERT(mTabChildGlobal->mMessageManager);
-  if (!mTabChildGlobal->mMessageManager) {
+  MOZ_DIAGNOSTIC_ASSERT(mm);
+  if (!mm) {
     return IPC_OK();
   }
 
-  JS::Rooted<JSObject*> kungFuDeathGrip(dom::RootingCx(), GetGlobal());
+  JS::Rooted<JSObject*> kungFuDeathGrip(dom::RootingCx(), mTabChildGlobal->GetWrapper());
   StructuredCloneData data;
   UnpackClonedMessageDataForChild(aData, data);
-  RefPtr<nsFrameMessageManager> mm =
-    static_cast<nsFrameMessageManager*>(mTabChildGlobal->mMessageManager.get());
   mm->ReceiveMessage(static_cast<EventTarget*>(mTabChildGlobal), nullptr,
                      aMessage, false, &data, &cpows, aPrincipal, nullptr);
   return IPC_OK();
@@ -2717,27 +2722,29 @@ TabChild::DeallocPRenderFrameChild(PRenderFrameChild* aFrame)
 bool
 TabChild::InitTabChildGlobal()
 {
-  if (!mGlobal && !mTabChildGlobal) {
+  if (!mTabChildGlobal) {
     nsCOMPtr<nsPIDOMWindowOuter> window = do_GetInterface(WebNavigation());
     NS_ENSURE_TRUE(window, false);
     nsCOMPtr<EventTarget> chromeHandler =
       do_QueryInterface(window->GetChromeEventHandler());
     NS_ENSURE_TRUE(chromeHandler, false);
 
-    RefPtr<TabChildGlobal> scope = new TabChildGlobal(this);
-
-    nsISupports* scopeSupports = NS_ISUPPORTS_CAST(EventTarget*, scope);
+    RefPtr<TabChildGlobal> scope = mTabChildGlobal = new TabChildGlobal(this);
 
     NS_NAMED_LITERAL_CSTRING(globalId, "outOfProcessTabChildGlobal");
-    NS_ENSURE_TRUE(InitChildGlobalInternal(scopeSupports, globalId), false);
+    if (NS_WARN_IF(!InitChildGlobalInternal(globalId))) {
+        mTabChildGlobal = nullptr;
+        return false;
+    }
 
     scope->Init();
 
     nsCOMPtr<nsPIWindowRoot> root = do_QueryInterface(chromeHandler);
-    NS_ENSURE_TRUE(root, false);
+    if (NS_WARN_IF(!root)) {
+        mTabChildGlobal = nullptr;
+        return false;
+    }
     root->SetParentTarget(scope);
-
-    mTabChildGlobal = scope.forget();;
   }
 
   if (!mTriedBrowserInit) {
@@ -2958,14 +2965,11 @@ TabChild::IsVisible()
 }
 
 NS_IMETHODIMP
-TabChild::GetMessageManager(nsIContentFrameMessageManager** aResult)
+TabChild::GetMessageManager(nsISupports** aResult)
 {
-  if (mTabChildGlobal) {
-    NS_ADDREF(*aResult = mTabChildGlobal);
-    return NS_OK;
-  }
-  *aResult = nullptr;
-  return NS_ERROR_FAILURE;
+  nsCOMPtr<nsIContentFrameMessageManager> mm(mTabChildGlobal);
+  mm.forget(aResult);
+  return *aResult ? NS_OK : NS_ERROR_FAILURE;
 }
 
 NS_IMETHODIMP
@@ -3473,9 +3477,9 @@ TabChild::TabGroup()
 }
 
 TabChildGlobal::TabChildGlobal(TabChild* aTabChild)
-: mTabChild(aTabChild)
+: ContentFrameMessageManager(new nsFrameMessageManager(aTabChild)),
+  mTabChild(aTabChild)
 {
-  SetIsNotDOMBinding();
 }
 
 TabChildGlobal::~TabChildGlobal()
@@ -3485,11 +3489,6 @@ TabChildGlobal::~TabChildGlobal()
 void
 TabChildGlobal::Init()
 {
-  NS_ASSERTION(!mMessageManager, "Re-initializing?!?");
-  mMessageManager = new nsFrameMessageManager(mTabChild,
-                                              nullptr,
-                                              MM_CHILD);
-
   TelemetryScrollProbe::Create(this);
 }
 
@@ -3517,12 +3516,26 @@ NS_INTERFACE_MAP_BEGIN_CYCLE_COLLECTION(TabChildGlobal)
   NS_INTERFACE_MAP_ENTRY(nsIScriptObjectPrincipal)
   NS_INTERFACE_MAP_ENTRY(nsIGlobalObject)
   NS_INTERFACE_MAP_ENTRY(nsISupportsWeakReference)
-  NS_DOM_INTERFACE_MAP_ENTRY_CLASSINFO(ContentFrameMessageManager)
 NS_INTERFACE_MAP_END_INHERITING(DOMEventTargetHelper)
 
 NS_IMPL_ADDREF_INHERITED(TabChildGlobal, DOMEventTargetHelper)
 NS_IMPL_RELEASE_INHERITED(TabChildGlobal, DOMEventTargetHelper)
 
+bool
+TabChildGlobal::WrapGlobalObject(JSContext* aCx,
+                                 JS::CompartmentOptions& aOptions,
+                                 JS::MutableHandle<JSObject*> aReflector)
+{
+  bool ok = ContentFrameMessageManagerBinding::Wrap(aCx, this, this, aOptions,
+                                                    nsJSPrincipals::get(mTabChild->GetPrincipal()),
+                                                    true, aReflector);
+  if (ok) {
+    // Since we can't rewrap we have to preserve the global's wrapper here.
+    PreserveWrapper(ToSupports(this));
+  }
+  return ok;
+}
+
 // This method isn't automatically forwarded safely because it's notxpcom, so
 // the IDL binding doesn't know what value to return.
 NS_IMETHODIMP_(bool)
@@ -3535,36 +3548,59 @@ TabChildGlobal::MarkForCC()
   if (elm) {
     elm->MarkForCC();
   }
-  return mMessageManager ? mMessageManager->MarkForCC() : false;
+  return MessageManagerGlobal::MarkForCC();
+}
+
+already_AddRefed<nsPIDOMWindowOuter>
+TabChildGlobal::GetContent(ErrorResult& aError)
+{
+  if (!mTabChild) {
+    aError.Throw(NS_ERROR_NULL_POINTER);
+    return nullptr;
+  }
+  nsCOMPtr<nsPIDOMWindowOuter> window =
+    do_GetInterface(mTabChild->WebNavigation());
+  return window.forget();
 }
 
 NS_IMETHODIMP
 TabChildGlobal::GetContent(mozIDOMWindowProxy** aContent)
 {
-  *aContent = nullptr;
-  if (!mTabChild)
-    return NS_ERROR_NULL_POINTER;
-  nsCOMPtr<nsPIDOMWindowOuter> window = do_GetInterface(mTabChild->WebNavigation());
-  window.forget(aContent);
-  return NS_OK;
+  ErrorResult rv;
+  *aContent = GetContent(rv).take();
+  return rv.StealNSResult();
+}
+
+already_AddRefed<nsIDocShell>
+TabChildGlobal::GetDocShell(ErrorResult& aError)
+{
+  if (!mTabChild) {
+    aError.Throw(NS_ERROR_NULL_POINTER);
+    return nullptr;
+  }
+  nsCOMPtr<nsIDocShell> window = do_GetInterface(mTabChild->WebNavigation());
+  return window.forget();
 }
 
 NS_IMETHODIMP
 TabChildGlobal::GetDocShell(nsIDocShell** aDocShell)
 {
-  *aDocShell = nullptr;
-  if (!mTabChild)
-    return NS_ERROR_NULL_POINTER;
-  nsCOMPtr<nsIDocShell> docShell = do_GetInterface(mTabChild->WebNavigation());
-  docShell.swap(*aDocShell);
-  return NS_OK;
+  ErrorResult rv;
+  *aDocShell = GetDocShell(rv).take();
+  return rv.StealNSResult();
+}
+
+already_AddRefed<nsIEventTarget>
+TabChildGlobal::GetTabEventTarget()
+{
+  nsCOMPtr<nsIEventTarget> target = EventTargetFor(TaskCategory::Other);
+  return target.forget();
 }
 
 NS_IMETHODIMP
 TabChildGlobal::GetTabEventTarget(nsIEventTarget** aTarget)
 {
-  nsCOMPtr<nsIEventTarget> target = EventTargetFor(TaskCategory::Other);
-  target.forget(aTarget);
+  *aTarget = GetTabEventTarget().take();
   return NS_OK;
 }
 
@@ -3580,7 +3616,7 @@ JSObject*
 TabChildGlobal::GetGlobalJSObject()
 {
   NS_ENSURE_TRUE(mTabChild, nullptr);
-  return mTabChild->GetGlobal();
+  return GetWrapper();
 }
 
 nsresult