diff --git a/accessible/src/base/nsRootAccessible.cpp b/accessible/src/base/nsRootAccessible.cpp
index 2b389d3fb91e..ad690ac964a9 100644
--- a/accessible/src/base/nsRootAccessible.cpp
+++ b/accessible/src/base/nsRootAccessible.cpp
@@ -67,7 +67,7 @@
 #include "nsIDocument.h"
 #include "nsEventListenerManager.h"
 #include "nsIFrame.h"
-#include "nsIMenuFrame.h"
+#include "nsMenuFrame.h"
 #include "nsIHTMLDocument.h"
 #include "nsIInterfaceRequestorUtils.h"
 #include "nsISelectionPrivate.h"
@@ -688,16 +688,13 @@ nsRootAccessible::ProcessDOMEvent(nsIDOMEvent* aDOMEvent)
         return; // Tree with nothing selected
       }
 #endif
-      nsIFrame* menuFrame = accessible->GetFrame();
-      if (!menuFrame)
-        return;
 
-      nsIMenuFrame* imenuFrame = do_QueryFrame(menuFrame);
-      if (imenuFrame)
+      nsMenuFrame* menuFrame = do_QueryFrame(accessible->GetFrame());
+      if (menuFrame)
         fireFocus = PR_TRUE;
-      // QI failed for nsIMenuFrame means it's not on menu bar
-      if (imenuFrame && imenuFrame->IsOnMenuBar() &&
-                       !imenuFrame->IsOnActiveMenuBar()) {
+      // QI failed for nsMenuFrame means it's not on menu bar
+      if (menuFrame && menuFrame->IsOnMenuBar() &&
+                       !menuFrame->IsOnActiveMenuBar()) {
         // It is a top level menuitem. Only fire a focus event when the menu bar
         // is active.
         return;
diff --git a/browser/app/README.txt b/browser/app/README.txt
deleted file mode 100644
index 7b8e405c358f..000000000000
--- a/browser/app/README.txt
+++ /dev/null
@@ -1,4 +0,0 @@
-For information about installing, running and configuring Firefox 
-including a list of known issues and troubleshooting information, 
-refer to: http://getfirefox.com/releases/
-
diff --git a/browser/app/profile/firefox.js b/browser/app/profile/firefox.js
index 3ab6acf4feef..4760737bdaf2 100644
--- a/browser/app/profile/firefox.js
+++ b/browser/app/profile/firefox.js
@@ -567,7 +567,7 @@ pref("plugins.hide_infobar_for_missing_plugin", false);
 pref("plugins.hide_infobar_for_outdated_plugin", false);
 
 #ifdef XP_MACOSX
-pref("plugins.use_layers", false);
+pref("plugins.use_layers", true);
 pref("plugins.hide_infobar_for_carbon_failure_plugin", false);
 #endif
 
diff --git a/browser/base/content/browser.css b/browser/base/content/browser.css
index 223aa27f6a45..514f949dc12f 100644
--- a/browser/base/content/browser.css
+++ b/browser/base/content/browser.css
@@ -500,3 +500,6 @@ statuspanel[label=""] {
 .panel-inner-arrowcontentfooter[footertype="promobox"] {
   -moz-binding: url("chrome://browser/content/urlbarBindings.xml#promobox");
 }
+
+/* highlighter */
+%include highlighter.css
diff --git a/browser/base/content/browser.xul b/browser/base/content/browser.xul
index a060456ffadc..531a74f94e84 100644
--- a/browser/base/content/browser.xul
+++ b/browser/base/content/browser.xul
@@ -1024,12 +1024,6 @@
 #endif
 
 </vbox>
-# <iframe id="highlighter-frame"
-#   transparent="true"
-#   type="content"
-#   src="chrome://content/base/highlighter.html"/> is dynamically appended as
-#     the last child of #tab-view-deck, only when it is needed, for minimal
-#     performance impact.
 # <iframe id="tab-view"> is dynamically appended as the 2nd child of #tab-view-deck.
 #     Introducing the iframe dynamically, as needed, was found to be better than
 #     starting with an empty iframe here in browser.xul from a Ts standpoint.
diff --git a/browser/base/content/highlighter.css b/browser/base/content/highlighter.css
new file mode 100644
index 000000000000..44cedfa60c97
--- /dev/null
+++ b/browser/base/content/highlighter.css
@@ -0,0 +1,36 @@
+#highlighter-container {
+  pointer-events: none;
+}
+
+#highlighter-controls {
+  position: absolute;
+  top: 0;
+  left: 0;
+}
+
+#highlighter-veil-container {
+  overflow: hidden;
+}
+
+.highlighter-veil,
+#highlighter-veil-middlebox,
+#highlighter-veil-transparentbox {
+  -moz-transition-property: width, height;
+  -moz-transition-duration: 0.1s;
+  -moz-transition-timing-function: linear;
+}
+
+#highlighter-veil-bottombox,
+#highlighter-veil-rightbox {
+  -moz-box-flex: 1;
+}
+
+#highlighter-veil-middlebox:-moz-locale-dir(rtl) {
+  -moz-box-direction: reverse;
+}
+
+#highlighter-close-button {
+  position: absolute;
+  pointer-events: auto;
+  z-index: 1;
+}
diff --git a/browser/base/content/highlighter.xhtml b/browser/base/content/highlighter.xhtml
deleted file mode 100644
index 1bd12eace731..000000000000
--- a/browser/base/content/highlighter.xhtml
+++ /dev/null
@@ -1,63 +0,0 @@
-<?xml version="1.0" encoding="UTF-8"?>
-<!DOCTYPE html>
-<!-- ***** BEGIN LICENSE BLOCK *****
-   - Version: MPL 1.1/GPL 2.0/LGPL 2.1
-   -
-   - The contents of this file are subject to the Mozilla Public License Version
-   - 1.1 (the "License"); you may not use this file except in compliance with
-   - the License. You may obtain a copy of the License at
-   - http://www.mozilla.org/MPL/
-   -
-   - Software distributed under the License is distributed on an "AS IS" basis,
-   - WITHOUT WARRANTY OF ANY KIND, either express or implied. See the License
-   - for the specific language governing rights and limitations under the
-   - License.
-   -
-   - The Original Code is Inspector Highlighter code.
-   -
-   - The Initial Developer of the Original Code is The Mozilla Foundation.
-   - Portions created by the Initial Developer are Copyright (C) 2011
-   - the Initial Developer. All Rights Reserved.
-   -
-   - Contributor(s):
-   -   Rob Campbell <rcampbell@mozilla.com> (Original Author)
-   -   Paul Rouget <paul@mozilla.com>
-   -
-   - Alternatively, the contents of this file may be used under the terms of
-   - either the GNU General Public License Version 2 or later (the "GPL"), or
-   - the GNU Lesser General Public License Version 2.1 or later (the "LGPL"),
-   - in which case the provisions of the GPL or the LGPL are applicable instead
-   - of those above. If you wish to allow use of your version of this file only
-   - under the terms of either the GPL or the LGPL, and not to allow others to
-   - use your version of this file under the terms of the MPL, indicate your
-   - decision by deleting the provisions above and replace them with the notice
-   - and other provisions required by the LGPL or the GPL. If you do not delete
-   - the provisions above, a recipient may use your version of this file under
-   - the terms of any one of the MPL, the GPL or the LGPL.
-   -
-   - ***** END LICENSE BLOCK ***** -->
-<html xmlns="http://www.w3.org/1999/xhtml">
-<head>
-  <link rel="stylesheet" href="chrome://browser/skin/highlighter.css" type="text/css"/>
-</head>
-<body>
-<div id="close-button" role="button" class="clickable"/>
-
-<!--
-    To darken the page around the selected node, we use black-transparent
-    divs, organized in 3 rows, keeping the div in the middle transparent.
--->
-<div id="veil-container">
-  <div id="veil">
-    <div id="veil-topbox" class="veil"/>
-    <div id="veil-middlebox">
-      <div id="veil-leftbox" class="veil"/>
-      <div id="veil-transparentbox"/>
-      <div id="veil-rightbox" class="veil"/>
-    </div>
-    <div id="veil-bottombox" class="veil"/>
-  </div>
-</div>
-
-</body>
-</html>
diff --git a/browser/base/content/inspector.js b/browser/base/content/inspector.js
index 6cfda745fda4..ad07ec0f7858 100644
--- a/browser/base/content/inspector.js
+++ b/browser/base/content/inspector.js
@@ -58,9 +58,6 @@ const INSPECTOR_INVISIBLE_ELEMENTS = {
 
 // Inspector notifications dispatched through the nsIObserverService.
 const INSPECTOR_NOTIFICATIONS = {
-  // Fires once the Inspector highlighter is initialized and ready for use.
-  HIGHLIGHTER_READY: "highlighter-ready",
-
   // Fires once the Inspector highlights an element in the page.
   HIGHLIGHTING: "inspector-highlighting",
 
@@ -76,86 +73,153 @@ const INSPECTOR_NOTIFICATIONS = {
 };
 
 ///////////////////////////////////////////////////////////////////////////
-//// IFrameHighlighter
+//// Highlighter
 
 /**
- * A highlighter mechanism using a transparent xul iframe.
+ * A highlighter mechanism.
+ *
+ * The highlighter is built dynamically once the Inspector is invoked:
+ * <stack id="highlighter-container">
+ *   <vbox id="highlighter-veil-container">...</vbox>
+ *   <box id="highlighter-controls>...</vbox>
+ * </stack>
  *
  * @param nsIDOMNode aBrowser
  *        The xul:browser object for the content window being highlighted.
  */
-function IFrameHighlighter(aBrowser)
+function Highlighter(aBrowser)
 {
   this._init(aBrowser);
 }
 
-IFrameHighlighter.prototype = {
+Highlighter.prototype = {
 
-  _init: function IFH__init(aBrowser)
+  _init: function Highlighter__init(aBrowser)
   {
     this.browser = aBrowser;
     let stack = this.browser.parentNode;
     this.win = this.browser.contentWindow;
     this._highlighting = false;
 
-    let div = document.createElement("div");
-    div.flex = 1;
-    div.setAttribute("style", "pointer-events: none; -moz-user-focus: ignore");
+    this.highlighterContainer = document.createElement("stack");
+    this.highlighterContainer.id = "highlighter-container";
 
-    let iframe = document.createElement("iframe");
-    iframe.setAttribute("id", "highlighter-frame");
-    iframe.setAttribute("transparent", "true");
-    iframe.setAttribute("type", "content");
-    iframe.addEventListener("DOMTitleChanged", function(aEvent) {
-      aEvent.stopPropagation();
-    }, true);
-    iframe.flex = 1;
-    iframe.setAttribute("style", "-moz-user-focus: ignore");
+    let veilBox = document.createElement("vbox");
+    veilBox.id = "highlighter-veil-container";
 
-    this.listenOnce(iframe, "load", (function iframeLoaded() {
-      this.iframeDoc = iframe.contentDocument;
+    let controlsBox = document.createElement("box");
+    controlsBox.id = "highlighter-controls";
 
-      this.veilTopDiv = this.iframeDoc.getElementById("veil-topbox");
-      this.veilLeftDiv = this.iframeDoc.getElementById("veil-leftbox");
-      this.veilMiddleDiv = this.iframeDoc.getElementById("veil-middlebox");
-      this.veilTransparentDiv = this.iframeDoc.getElementById("veil-transparentbox");
+    // The veil will make the whole page darker except
+    // for the region of the selected box.
+    this.buildVeil(veilBox);
 
-      let closeButton = this.iframeDoc.getElementById("close-button");
-      this.listenOnce(closeButton, "click",
-        InspectorUI.closeInspectorUI.bind(InspectorUI, false), false);
+    // The controlsBox will host the different interactive
+    // elements of the highlighter (buttons, toolbars, ...).
+    this.buildControls(controlsBox);
 
-      this.browser.addEventListener("click", this, true);
-      iframe.contentWindow.addEventListener("resize", this, false);
-      this.handleResize();
-      Services.obs.notifyObservers(null,
-        INSPECTOR_NOTIFICATIONS.HIGHLIGHTER_READY, null);
-    }).bind(this), true);
+    this.highlighterContainer.appendChild(veilBox);
+    this.highlighterContainer.appendChild(controlsBox);
 
-    iframe.setAttribute("src", "chrome://browser/content/highlighter.xhtml");
+    stack.appendChild(this.highlighterContainer);
 
-    div.appendChild(iframe);
-    stack.appendChild(div);
-    this.iframe = iframe;
-    this.iframeContainer = div;
+    this.browser.addEventListener("resize", this, true);
+    this.browser.addEventListener("scroll", this, true);
+
+    this.handleResize();
+  },
+
+
+  /**
+   * Build the veil:
+   *
+   * <vbox id="highlighter-veil-container">
+   *   <box id="highlighter-veil-topbox" class="highlighter-veil"/>
+   *   <hbox id="highlighter-veil-middlebox">
+   *     <box id="highlighter-veil-leftbox" class="highlighter-veil"/>
+   *     <box id="highlighter-veil-transparentbox"/>
+   *     <box id="highlighter-veil-rightbox" class="highlighter-veil"/>
+   *   </hbox>
+   *   <box id="highlighter-veil-bottombox" class="highlighter-veil"/>
+   * </vbox>
+   *
+   * @param nsIDOMNode aParent
+   */
+  buildVeil: function Highlighter_buildVeil(aParent)
+  {
+
+    // We will need to resize these boxes to surround a node.
+    // See highlightRectangle().
+
+    this.veilTopBox = document.createElement("box");
+    this.veilTopBox.id = "highlighter-veil-topbox";
+    this.veilTopBox.className = "highlighter-veil";
+
+    this.veilMiddleBox = document.createElement("hbox");
+    this.veilMiddleBox.id = "highlighter-veil-middlebox";
+
+    this.veilLeftBox = document.createElement("box");
+    this.veilLeftBox.id = "highlighter-veil-leftbox";
+    this.veilLeftBox.className = "highlighter-veil";
+
+    this.veilTransparentBox = document.createElement("box");
+    this.veilTransparentBox.id = "highlighter-veil-transparentbox";
+
+    // We don't need any references to veilRightBox and veilBottomBox.
+    // These boxes are automatically resized (flex=1)
+
+    let veilRightBox = document.createElement("box");
+    veilRightBox.id = "highlighter-veil-rightbox";
+    veilRightBox.className = "highlighter-veil";
+
+    let veilBottomBox = document.createElement("box");
+    veilBottomBox.id = "highlighter-veil-bottombox";
+    veilBottomBox.className = "highlighter-veil";
+
+    this.veilMiddleBox.appendChild(this.veilLeftBox);
+    this.veilMiddleBox.appendChild(this.veilTransparentBox);
+    this.veilMiddleBox.appendChild(veilRightBox);
+
+    aParent.appendChild(this.veilTopBox);
+    aParent.appendChild(this.veilMiddleBox);
+    aParent.appendChild(veilBottomBox);
   },
 
   /**
-   * Destroy the iframe and its nodes.
+   * Build the controls:
+   *
+   * <box id="highlighter-close-button"/>
+   *
+   * @param nsIDOMNode aParent
    */
-  destroy: function IFH_destroy()
+  buildControls: function Highlighter_buildControls(aParent)
   {
-    this.browser.removeEventListener("click", this, true);
+    let closeButton = document.createElement("box");
+    closeButton.id = "highlighter-close-button";
+    closeButton.appendChild(document.createElement("image"));
+
+    closeButton.setAttribute("onclick", "InspectorUI.closeInspectorUI(false);");
+
+    aParent.appendChild(closeButton);
+  },
+
+
+  /**
+   * Destroy the nodes.
+   */
+  destroy: function Highlighter_destroy()
+  {
+    this.browser.removeEventListener("scroll", this, true);
+    this.browser.removeEventListener("resize", this, true);
     this._highlightRect = null;
     this._highlighting = false;
-    this.veilTopDiv = null;
-    this.veilLeftDiv = null;
-    this.veilMiddleDiv = null;
-    this.veilTransparentDiv = null;
+    this.veilTopBox = null;
+    this.veilLeftBox = null;
+    this.veilMiddleBox = null;
+    this.veilTransparentBox = null;
     this.node = null;
-    this.iframeDoc = null;
-    this.browser.parentNode.removeChild(this.iframeContainer);
-    this.iframeContainer = null;
-    this.iframe = null;
+    this.highlighterContainer.parentNode.removeChild(this.highlighterContainer);
+    this.highlighterContainer = null;
     this.win = null
     this.browser = null;
   },
@@ -174,7 +238,7 @@ IFrameHighlighter.prototype = {
    * @param boolean aScroll
    *        Boolean determining whether to scroll or not.
    */
-  highlight: function IFH_highlight(aScroll)
+  highlight: function Highlighter_highlight(aScroll)
   {
     // node is not set or node is not highlightable, bail
     if (!this.node || !this.isNodeHighlightable()) {
@@ -188,12 +252,6 @@ IFrameHighlighter.prototype = {
                 left: clientRect.left,
                 width: clientRect.width,
                 height: clientRect.height};
-    let oldRect = this._highlightRect;
-
-    if (oldRect && rect.top == oldRect.top && rect.left == oldRect.left &&
-        rect.width == oldRect.width && rect.height == oldRect.height) {
-      return; // same rectangle
-    }
 
     if (aScroll) {
       this.node.scrollIntoView();
@@ -248,7 +306,7 @@ IFrameHighlighter.prototype = {
    * @param object aParams
    *        extra parameters object
    */
-  highlightNode: function IFH_highlightNode(aNode, aParams)
+  highlightNode: function Highlighter_highlightNode(aNode, aParams)
   {
     this.node = aNode;
     this.highlight(aParams && aParams.scroll);
@@ -262,16 +320,23 @@ IFrameHighlighter.prototype = {
    * @returns boolean
    *          True if the rectangle was highlighted, false otherwise.
    */
-  highlightRectangle: function IFH_highlightRectangle(aRect)
+  highlightRectangle: function Highlighter_highlightRectangle(aRect)
   {
+    let oldRect = this._highlightRect;
+
+    if (oldRect && aRect.top == oldRect.top && aRect.left == oldRect.left &&
+        aRect.width == oldRect.width && aRect.height == oldRect.height) {
+      return this._highlighting; // same rectangle
+    }
+
     if (aRect.left >= 0 && aRect.top >= 0 &&
         aRect.width > 0 && aRect.height > 0) {
       // The bottom div and the right div are flexibles (flex=1).
       // We don't need to resize them.
-      this.veilTopDiv.style.height = aRect.top + "px";
-      this.veilLeftDiv.style.width = aRect.left + "px";
-      this.veilMiddleDiv.style.height = aRect.height + "px";
-      this.veilTransparentDiv.style.width = aRect.width + "px";
+      this.veilTopBox.style.height = aRect.top + "px";
+      this.veilLeftBox.style.width = aRect.left + "px";
+      this.veilMiddleBox.style.height = aRect.height + "px";
+      this.veilTransparentBox.style.width = aRect.width + "px";
 
       this._highlighting = true;
     } else {
@@ -286,11 +351,11 @@ IFrameHighlighter.prototype = {
   /**
    * Clear the highlighter surface.
    */
-  unhighlight: function IFH_unhighlight()
+  unhighlight: function Highlighter_unhighlight()
   {
     this._highlighting = false;
-    this.veilMiddleDiv.style.height = 0;
-    this.veilTransparentDiv.style.width = 0;
+    this.veilMiddleBox.style.height = 0;
+    this.veilTransparentBox.style.width = 0;
     Services.obs.notifyObservers(null,
       INSPECTOR_NOTIFICATIONS.UNHIGHLIGHTING, null);
   },
@@ -305,7 +370,7 @@ IFrameHighlighter.prototype = {
    * @returns object
    *          An object with x and y properties.
    */
-  midPoint: function IFH_midPoint(aPointA, aPointB)
+  midPoint: function Highlighter_midPoint(aPointA, aPointB)
   {
     let pointC = { };
     pointC.x = (aPointB.x - aPointA.x) / 2 + aPointA.x;
@@ -352,7 +417,7 @@ IFrameHighlighter.prototype = {
    * @returns boolean
    *          True if the node is highlightable or false otherwise.
    */
-  isNodeHighlightable: function IFH_isNodeHighlightable()
+  isNodeHighlightable: function Highlighter_isNodeHighlightable()
   {
     if (!this.node || this.node.nodeType != Node.ELEMENT_NODE) {
       return false;
@@ -364,29 +429,32 @@ IFrameHighlighter.prototype = {
   /////////////////////////////////////////////////////////////////////////
   //// Event Handling
 
-  attachInspectListeners: function IFH_attachInspectListeners()
+  attachInspectListeners: function Highlighter_attachInspectListeners()
   {
     this.browser.addEventListener("mousemove", this, true);
+    this.browser.addEventListener("click", this, true);
     this.browser.addEventListener("dblclick", this, true);
     this.browser.addEventListener("mousedown", this, true);
     this.browser.addEventListener("mouseup", this, true);
   },
 
-  detachInspectListeners: function IFH_detachInspectListeners()
+  detachInspectListeners: function Highlighter_detachInspectListeners()
   {
     this.browser.removeEventListener("mousemove", this, true);
+    this.browser.removeEventListener("click", this, true);
     this.browser.removeEventListener("dblclick", this, true);
     this.browser.removeEventListener("mousedown", this, true);
     this.browser.removeEventListener("mouseup", this, true);
   },
 
+
   /**
    * Generic event handler.
    *
    * @param nsIDOMEvent aEvent
    *        The DOM event object.
    */
-  handleEvent: function IFH_handleEvent(aEvent)
+  handleEvent: function Highlighter_handleEvent(aEvent)
   {
     switch (aEvent.type) {
       case "click":
@@ -404,54 +472,28 @@ IFrameHighlighter.prototype = {
         aEvent.stopPropagation();
         aEvent.preventDefault();
         break;
+      case "scroll":
+        this.highlight();
+        break;
     }
   },
 
   /**
-   * Handle clicks on the iframe.
+   * Handle clicks.
    *
    * @param nsIDOMEvent aEvent
    *        The DOM event.
    */
-  handleClick: function IFH_handleClick(aEvent)
+  handleClick: function Highlighter_handleClick(aEvent)
   {
-    // Proxy the click event to the iframe.
-    let x = aEvent.clientX;
-    let y = aEvent.clientY;
-    let frameWin = aEvent.view;
-    while (frameWin != this.win) {
-      if (frameWin.frameElement) {
-        let frameRect = frameWin.frameElement.getBoundingClientRect();
-        x += frameRect.left;
-        y += frameRect.top;
-      }
-      frameWin = frameWin.parent;
-    }
-
-    let element = this.iframeDoc.elementFromPoint(x, y);
-    if (element && element.classList &&
-        element.classList.contains("clickable")) {
-      let newEvent = this.iframeDoc.createEvent("MouseEvents");
-      newEvent.initMouseEvent(aEvent.type, aEvent.bubbles, aEvent.cancelable,
-        this.iframeDoc.defaultView, aEvent.detail, aEvent.screenX,
-        aEvent.screenY, x, y, aEvent.ctrlKey, aEvent.altKey, aEvent.shiftKey,
-        aEvent.metaKey, aEvent.button, null);
-      element.dispatchEvent(newEvent);
-      aEvent.preventDefault();
-      aEvent.stopPropagation();
-      return;
-    }
-
     // Stop inspection when the user clicks on a node.
-    if (InspectorUI.inspecting) {
-      if (aEvent.button == 0) {
-        let win = aEvent.target.ownerDocument.defaultView;
-        InspectorUI.stopInspecting();
-        win.focus();
-      }
-      aEvent.preventDefault();
-      aEvent.stopPropagation();
+    if (aEvent.button == 0) {
+      let win = aEvent.target.ownerDocument.defaultView;
+      InspectorUI.stopInspecting();
+      win.focus();
     }
+    aEvent.preventDefault();
+    aEvent.stopPropagation();
   },
 
   /**
@@ -460,12 +502,8 @@ IFrameHighlighter.prototype = {
    * @param nsiDOMEvent aEvent
    *        The MouseEvent triggering the method.
    */
-  handleMouseMove: function IFH_handleMouseMove(aEvent)
+  handleMouseMove: function Highlighter_handleMouseMove(aEvent)
   {
-    if (!InspectorUI.inspecting) {
-      return;
-    }
-
     let element = InspectorUI.elementFromPoint(aEvent.target.ownerDocument,
       aEvent.clientX, aEvent.clientY);
     if (element && element != this.node) {
@@ -476,69 +514,10 @@ IFrameHighlighter.prototype = {
   /**
    * Handle window resize events.
    */
-  handleResize: function IFH_handleResize()
+  handleResize: function Highlighter_handleResize()
   {
-    let style = this.iframeContainer.style;
-    if (this.win.scrollMaxY && this.win.scrollbars.visible) {
-      style.paddingRight = this.getScrollbarWidth() + "px";
-    } else {
-      style.paddingRight = 0;
-    }
-    if (this.win.scrollMaxX && this.win.scrollbars.visible) {
-      style.paddingBottom = this.getScrollbarWidth() + "px";
-    } else {
-      style.paddingBottom = 0;
-    }
-
     this.highlight();
   },
-
-  /**
-   * Determine the scrollbar width in the current document.
-   *
-   * @returns number
-   *          The scrollbar width in pixels.
-   */
-  getScrollbarWidth: function IFH_getScrollbarWidth()
-  {
-    if (this._scrollbarWidth) {
-      return this._scrollbarWidth;
-    }
-
-    let hbox = document.createElement("hbox");
-    hbox.setAttribute("style", "height: 0%; overflow: hidden");
-
-    let scrollbar = document.createElement("scrollbar");
-    scrollbar.setAttribute("orient", "vertical");
-    hbox.appendChild(scrollbar);
-
-    document.documentElement.appendChild(hbox);
-    this._scrollbarWidth = scrollbar.clientWidth;
-    document.documentElement.removeChild(hbox);
-
-    return this._scrollbarWidth;
-  },
-
-  /**
-   * Helper to listen for an event only once.
-   *
-   * @param nsIDOMEventTarget aTarget
-   *        The DOM event target you want to add an event listener to.
-   * @param string aName
-   *        The event name you want to listen for.
-   * @param function aCallback
-   *        The function you want to execute once for the given event.
-   * @param boolean aCapturing
-   *        Tells if you want to use capture for the event listener.
-   * @returns void
-   */
-  listenOnce: function IFH_listenOnce(aTarget, aName, aCallback, aCapturing)
-  {
-    aTarget.addEventListener(aName, function listenOnce_handler(aEvent) {
-      aTarget.removeEventListener(aName, listenOnce_handler, aCapturing);
-      aCallback.call(this, aEvent);
-    }, aCapturing);
-  },
 };
 
 ///////////////////////////////////////////////////////////////////////////
@@ -785,7 +764,6 @@ var InspectorUI = {
 
     this.openTreePanel();
 
-    this.browser.addEventListener("scroll", this, true);
     this.inspectCmd.setAttribute("checked", true);
   },
 
@@ -794,9 +772,8 @@ var InspectorUI = {
    */
   initializeHighlighter: function IUI_initializeHighlighter()
   {
-    Services.obs.addObserver(this.highlighterReady,
-      INSPECTOR_NOTIFICATIONS.HIGHLIGHTER_READY, false);
-    this.highlighter = new IFrameHighlighter(this.browser);
+    this.highlighter = new Highlighter(this.browser);
+    this.highlighterReady();
   },
 
   /**
@@ -857,7 +834,6 @@ var InspectorUI = {
       gBrowser.tabContainer.removeEventListener("TabSelect", this, false);
     }
 
-    this.browser.removeEventListener("scroll", this, true);
     this.stopInspecting();
     if (this.highlighter) {
       this.highlighter.destroy();
@@ -953,7 +929,7 @@ var InspectorUI = {
   /////////////////////////////////////////////////////////////////////////
   //// Event Handling
 
-  notifyReady: function IUI_notifyReady()
+  highlighterReady: function IUI_highlighterReady()
   {
     // Setup the InspectorStore or restore state
     this.initializeStore();
@@ -966,13 +942,6 @@ var InspectorUI = {
     Services.obs.notifyObservers(null, INSPECTOR_NOTIFICATIONS.OPENED, null);
   },
 
-  highlighterReady: function IUI_highlighterReady()
-  {
-    Services.obs.removeObserver(InspectorUI.highlighterReady,
-      INSPECTOR_NOTIFICATIONS.HIGHLIGHTER_READY, false);
-    InspectorUI.notifyReady();
-  },
-
   /**
    * Main callback handler for events.
    *
@@ -1040,9 +1009,6 @@ var InspectorUI = {
             break;
         }
         break;
-      case "scroll":
-        this.highlighter.highlight();
-        break;
     }
   },
 
diff --git a/browser/base/content/tabbrowser.xml b/browser/base/content/tabbrowser.xml
index 9d36c2b5f302..89500c50e600 100644
--- a/browser/base/content/tabbrowser.xml
+++ b/browser/base/content/tabbrowser.xml
@@ -867,7 +867,8 @@
               updatePageReport = true;
 
             newBrowser.setAttribute("type", "content-primary");
-            newBrowser.docShellIsActive = true;
+            newBrowser.docShellIsActive =
+              (window.windowState != window.STATE_MINIMIZED);
             this.mCurrentBrowser = newBrowser;
             this.mCurrentTab = this.selectedTab;
             this.showTab(this.mCurrentTab);
@@ -2463,6 +2464,12 @@
             case "keypress":
               this._handleKeyEvent(aEvent);
               break;
+            case "sizemodechange":
+              if (aEvent.target == window) {
+                this.mCurrentBrowser.docShellIsActive =
+                  (window.windowState != window.STATE_MINIMIZED);
+              }
+              break;
           }
         ]]></body>
       </method>
@@ -2472,6 +2479,7 @@
           this.mCurrentBrowser = this.mPanelContainer.childNodes[0].firstChild.firstChild;
           this.mCurrentTab = this.tabContainer.firstChild;
           document.addEventListener("keypress", this, false);
+          window.addEventListener("sizemodechange", this, false);
 
           var uniqueId = "panel" + Date.now();
           this.mPanelContainer.childNodes[0].id = uniqueId;
@@ -2534,6 +2542,7 @@
             this.mTabListeners[i] = null;
           }
           document.removeEventListener("keypress", this, false);
+          window.removeEventListener("sizemodechange", this, false);
         ]]>
       </destructor>
 
diff --git a/browser/base/content/test/Makefile.in b/browser/base/content/test/Makefile.in
index 3c1eb8f9ff88..d1284543fbc6 100644
--- a/browser/base/content/test/Makefile.in
+++ b/browser/base/content/test/Makefile.in
@@ -256,6 +256,7 @@ _BROWSER_FILES = \
                  browser_addon_bar_shortcut.js \
                  browser_addon_bar_aomlistener.js \
                  test_bug628179.html \
+                 browser_minimize.js \
                  $(NULL)
 
 ifneq (cocoa,$(MOZ_WIDGET_TOOLKIT))
diff --git a/browser/base/content/test/browser_bug519216.js b/browser/base/content/test/browser_bug519216.js
index e12601b4dcfc..a924f7a0912d 100644
--- a/browser/base/content/test/browser_bug519216.js
+++ b/browser/base/content/test/browser_bug519216.js
@@ -41,8 +41,10 @@ var progressListener4 = {
   onLocationChange: function onLocationChange() {
     ok(expectListener4, "didn't call progressListener4 for the first location change");
     gBrowser.removeProgressListener(this);
-    gBrowser.addTab();
-    gBrowser.removeCurrentTab();
-    finish();
+    executeSoon(function () {
+      gBrowser.addTab();
+      gBrowser.removeCurrentTab();
+      finish();
+    });
   }
 };
diff --git a/browser/base/content/test/browser_minimize.js b/browser/base/content/test/browser_minimize.js
new file mode 100644
index 000000000000..37e03b1f911e
--- /dev/null
+++ b/browser/base/content/test/browser_minimize.js
@@ -0,0 +1,33 @@
+/* Any copyright is dedicated to the Public Domain.
+   http://creativecommons.org/publicdomain/zero/1.0/ */
+function waitForActive() {
+    if (!gBrowser.docShell.isActive) {
+        executeSoon(waitForActive);
+        return;
+    }
+    is(gBrowser.docShell.isActive, true, "Docshell should be active again");
+    finish();
+}
+
+function waitForInactive() {
+    if (gBrowser.docShell.isActive) {
+        executeSoon(waitForInactive);
+        return;
+    }
+    is(gBrowser.docShell.isActive, false, "Docshell should be inactive");
+    window.restore();
+    waitForActive();
+}
+
+function test() {
+    waitForExplicitFinish();
+    is(gBrowser.docShell.isActive, true, "Docshell should be active");
+    window.minimize();
+    // XXX On Linux minimize/restore seem to be very very async, but
+    // our window.windowState changes sync.... so we can't rely on the
+    // latter correctly reflecting the state of the former.  In
+    // particular, a restore() call before minimizing is done will not
+    // actually restore the window, but change the window state.  As a
+    // result, just poll waiting for our expected isActive values.
+    waitForInactive();
+}
diff --git a/browser/base/content/test/browser_popupNotification.js b/browser/base/content/test/browser_popupNotification.js
index acb1d6c152a1..9b1a364f4eb4 100644
--- a/browser/base/content/test/browser_popupNotification.js
+++ b/browser/base/content/test/browser_popupNotification.js
@@ -110,9 +110,11 @@ function runNextTest() {
 
       let onHidden = onHiddenArray.shift();
       info("[Test #" + gTestIndex + "] popup hidden (" + onHiddenArray.length + " hides remaining)");
-      onHidden.call(nextTest, this);
-      if (!onHiddenArray.length)
-        goNext();
+      executeSoon(function () {
+        onHidden.call(nextTest, this);
+        if (!onHiddenArray.length)
+          goNext();
+      });
     }, onHiddenArray.length);
     info("[Test #" + gTestIndex + "] added listeners; panel state: " + PopupNotifications.isPanelOpen);
   }
@@ -739,4 +741,4 @@ function dismissNotification(popup) {
   executeSoon(function () {
     EventUtils.synthesizeKey("VK_ESCAPE", {});
   });
-}
\ No newline at end of file
+}
diff --git a/browser/base/jar.mn b/browser/base/jar.mn
index 59646b1c8eec..ac0f5547e7b6 100644
--- a/browser/base/jar.mn
+++ b/browser/base/jar.mn
@@ -30,7 +30,6 @@ browser.jar:
 *       content/browser/browser.xul                   (content/browser.xul)
 *       content/browser/browser-tabPreviews.xml       (content/browser-tabPreviews.xml)
 *       content/browser/fullscreen-video.xhtml        (content/fullscreen-video.xhtml)
-        content/browser/highlighter.xhtml             (content/highlighter.xhtml)
 *       content/browser/inspector.html                (content/inspector.html)
 *       content/browser/scratchpad.xul                (content/scratchpad.xul)
 *       content/browser/scratchpad.js                 (content/scratchpad.js)
diff --git a/browser/components/places/tests/browser/browser_library_middleclick.js b/browser/components/places/tests/browser/browser_library_middleclick.js
index 0f88d48b72fc..8e864830918a 100644
--- a/browser/components/places/tests/browser/browser_library_middleclick.js
+++ b/browser/components/places/tests/browser/browser_library_middleclick.js
@@ -84,13 +84,17 @@ var gTabsListener = {
 
       // Reset arrays.
       this._loadedURIs.length = 0;
-      // Close all tabs.
-      while (gBrowser.tabs.length > 1)
-        gBrowser.removeCurrentTab();
+
       this._openTabsCount = 0;
 
-      // Test finished.  This will move to the next one.
-      waitForFocus(gCurrentTest.finish, gBrowser.ownerDocument.defaultView);
+      executeSoon(function () {
+        // Close all tabs.
+        while (gBrowser.tabs.length > 1)
+          gBrowser.removeCurrentTab();
+
+        // Test finished.  This will move to the next one.
+        waitForFocus(gCurrentTest.finish, gBrowser.ownerDocument.defaultView);
+      });
     }
   }
 }
diff --git a/browser/installer/package-manifest.in b/browser/installer/package-manifest.in
index 7b611dd99236..335d61e9b36e 100644
--- a/browser/installer/package-manifest.in
+++ b/browser/installer/package-manifest.in
@@ -101,7 +101,6 @@
 #else
 @BINPATH@/mozsqlt3@DLL_SUFFIX@
 #endif
-@BINPATH@/README.txt
 @BINPATH@/blocklist.xml
 #ifdef XP_UNIX
 @BINPATH@/run-mozilla.sh
diff --git a/browser/installer/removed-files.in b/browser/installer/removed-files.in
index 809cd00f0bea..6d75dea38498 100644
--- a/browser/installer/removed-files.in
+++ b/browser/installer/removed-files.in
@@ -229,6 +229,7 @@ install.rdf
 modules/JSON.jsm
 mozilla-runtime@BIN_SUFFIX@
 old-homepage-default.properties
+README.txt
 res/arrow.gif
 res/arrowd.gif
 res/broken-image.gif
diff --git a/browser/locales/Makefile.in b/browser/locales/Makefile.in
index 1982b179a782..b30a715e964b 100644
--- a/browser/locales/Makefile.in
+++ b/browser/locales/Makefile.in
@@ -125,8 +125,6 @@ install::
 	    $(LOCALE_SRCDIR)/existing-profile-defaults.js > $(DESTDIR)$(mozappdir)/defaults/existing-profile-defaults.js; \
 	fi
 
-README_FILE = $(call MERGE_FILE,README.txt)
-
 PROFILE_FILES = \
 	localstore.rdf \
 	mimeTypes.rdf \
@@ -134,18 +132,6 @@ PROFILE_FILES = \
 
 PROFILE_CHROME = userChrome-example.css userContent-example.css
 
-libs:: $(README_FILE)
-ifeq ($(OS_ARCH),WINNT)
-	$(EXIT_ON_ERROR) \
-	for file in $^; do \
-	  $(PERL) -pe 's/(?<!\r)\n/\r\n/g;' < $$file > $(FINAL_TARGET)/`basename $$file`; \
-	done
-else
-ifneq ($(OS_ARCH),OS2)
-	$(SYSINSTALL) $(IFLAGS1) $^ $(FINAL_TARGET)
-endif
-endif
-
 NO_JA_JP_MAC_AB_CD := $(if $(filter ja-JP-mac, $(AB_CD)),ja,$(AB_CD))
 
 %/defaults/profile/bookmarks.html: bookmarks.inc generic/profile/bookmarks.html.in
diff --git a/browser/locales/en-US/README.txt b/browser/locales/en-US/README.txt
deleted file mode 100644
index 7b8e405c358f..000000000000
--- a/browser/locales/en-US/README.txt
+++ /dev/null
@@ -1,4 +0,0 @@
-For information about installing, running and configuring Firefox 
-including a list of known issues and troubleshooting information, 
-refer to: http://getfirefox.com/releases/
-
diff --git a/browser/makefiles.sh b/browser/makefiles.sh
index f1ddea88988b..f102ed7503be 100644
--- a/browser/makefiles.sh
+++ b/browser/makefiles.sh
@@ -98,7 +98,6 @@ if [ "$ENABLE_TESTS" ]; then
     browser/components/places/tests/Makefile
     browser/components/places/tests/chrome/Makefile
     browser/components/places/tests/browser/Makefile
-    browser/components/places/tests/perf/Makefile
     browser/components/privatebrowsing/test/Makefile
     browser/components/privatebrowsing/test/browser/Makefile
     browser/components/safebrowsing/content/test/Makefile
diff --git a/browser/themes/gnomestripe/browser/browser.css b/browser/themes/gnomestripe/browser/browser.css
index 1e3281848535..59a4d9435011 100644
--- a/browser/themes/gnomestripe/browser/browser.css
+++ b/browser/themes/gnomestripe/browser/browser.css
@@ -1935,3 +1935,27 @@ panel[dimmed="true"] {
   border-top-left-radius: .3em;
   margin-left: 1em;
 }
+
+/* Highlighter */
+
+.highlighter-veil {
+  background-color: rgba(0, 0, 0, 0.5);
+}
+
+#highlighter-close-button {
+  list-style-image: url("chrome://browser/skin/KUI-close.png");
+  top: 12px;
+  right: 12px;
+  cursor: pointer;
+}
+
+#highlighter-close-button:-moz-locale-dir(rtl)  {
+  right: auto;
+  left: 12px;
+}
+
+#highlighter-veil-transparentbox {
+  box-shadow: 0 0 0 1px rgba(0,0,0,0.5);
+  outline: 1px dashed rgba(255,255,255,0.5);
+  outline-offset: -1px;
+}
diff --git a/browser/themes/gnomestripe/browser/highlighter.css b/browser/themes/gnomestripe/browser/highlighter.css
deleted file mode 100644
index 6be6bd600bc8..000000000000
--- a/browser/themes/gnomestripe/browser/highlighter.css
+++ /dev/null
@@ -1,104 +0,0 @@
-/* ***** BEGIN LICENSE BLOCK *****
- * Version: MPL 1.1/GPL 2.0/LGPL 2.1
- *
- * The contents of this file are subject to the Mozilla Public License Version
- * 1.1 (the "License"); you may not use this file except in compliance with
- * the License. You may obtain a copy of the License at
- * http://www.mozilla.org/MPL/
- *
- * Software distributed under the License is distributed on an "AS IS" basis,
- * WITHOUT WARRANTY OF ANY KIND, either express or implied. See the License
- * for the specific language governing rights and limitations under the
- * License.
- *
- * The Original Code is the Mozilla Inspector Module.
- *
- * The Initial Developer of the Original Code is
- * The Mozilla Foundation.
- * Portions created by the Initial Developer are Copyright (C) 2011
- * the Initial Developer. All Rights Reserved.
- *
- * Contributor(s):
- *   Rob Campbell <rcampbell@mozilla.com> (original author)
- *   Paul Rouget <paul@mozilla.com>
- *
- * Alternatively, the contents of this file may be used under the terms of
- * either the GNU General Public License Version 2 or later (the "GPL"), or
- * the GNU Lesser General Public License Version 2.1 or later (the "LGPL"),
- * in which case the provisions of the GPL or the LGPL are applicable instead
- * of those above. If you wish to allow use of your version of this file only
- * under the terms of either the GPL or the LGPL, and not to allow others to
- * use your version of this file under the terms of the MPL, indicate your
- * decision by deleting the provisions above and replace them with the notice
- * and other provisions required by the GPL or the LGPL. If you do not delete
- * the provisions above, a recipient may use your version of this file under
- * the terms of any one of the MPL, the GPL or the LGPL.
- *
- * ***** END LICENSE BLOCK ***** */
-
-body {
-  margin: 0;
-  overflow: hidden;
-}
-
-#close-button {
-  background-image: url("KUI-close.png");
-  border: none;
-  padding: 0;
-  width: 24px;
-  height: 24px;
-  position: fixed;
-  top: 12px;
-  right: 12px;
-  z-index: 1;
-  cursor: pointer;
-}
-
-.veil {
-  background-color: rgba(0, 0, 0, 0.5);
-}
-
-.veil, #veil-middlebox, #veil-transparentbox {
-  -moz-transition: 0.1s;
-  -moz-transition-timing-function: linear;
-}
-
-#veil-container {
-  position: absolute;
-  top: 0;
-  left: 0;
-  width: 100%;
-  height: 100%;
-}
-
-#veil {
-  width: 100%;
-  height: 100%;
-  display: -moz-box;
-  -moz-box-orient: vertical;
-}
-
-#veil-topbox, #veil-bottombox {
-  width: 100%;
-}
-
-#veil-bottombox {
-  -moz-box-flex: 1;
-}
-
-#veil-middlebox {
-  display: -moz-box;
-  -moz-box-orient: horizontal;
-}
-
-#veil-leftbox, #veil-rightbox {
-  height: 100%;
-}
-
-#veil-rightbox {
-  -moz-box-flex: 1;
-}
-
-#veil {
-  vertical-align: top;
-}
diff --git a/browser/themes/gnomestripe/browser/jar.mn b/browser/themes/gnomestripe/browser/jar.mn
index d2e5fc706d8a..0471acd9cbcb 100644
--- a/browser/themes/gnomestripe/browser/jar.mn
+++ b/browser/themes/gnomestripe/browser/jar.mn
@@ -17,7 +17,6 @@ browser.jar:
   skin/classic/browser/Geolocation-16.png
   skin/classic/browser/Geolocation-64.png
   skin/classic/browser/Go-arrow.png
-* skin/classic/browser/highlighter.css
   skin/classic/browser/identity.png
   skin/classic/browser/Info.png
   skin/classic/browser/KUI-close.png
diff --git a/browser/themes/pinstripe/browser/browser.css b/browser/themes/pinstripe/browser/browser.css
index a757c185b900..4d4639c03b56 100644
--- a/browser/themes/pinstripe/browser/browser.css
+++ b/browser/themes/pinstripe/browser/browser.css
@@ -2508,3 +2508,28 @@ panel[dimmed="true"] {
   border-top-left-radius: .3em;
   margin-left: 1em;
 }
+
+
+/* Highlighter */
+
+.highlighter-veil {
+  background-color: rgba(0, 0, 0, 0.5);
+}
+
+#highlighter-close-button {
+  list-style-image: url("chrome://browser/skin/KUI-close.png");
+  top: 12px;
+  right: 12px;
+  cursor: pointer;
+}
+
+#highlighter-close-button:-moz-locale-dir(rtl)  {
+  right: auto;
+  left: 12px;
+}
+
+#highlighter-veil-transparentbox {
+  box-shadow: 0 0 0 1px rgba(0,0,0,0.5);
+  outline: 1px dashed rgba(255,255,255,0.5);
+  outline-offset: -1px;
+}
diff --git a/browser/themes/pinstripe/browser/jar.mn b/browser/themes/pinstripe/browser/jar.mn
index 4c16d09c6edb..223cab38e93f 100644
--- a/browser/themes/pinstripe/browser/jar.mn
+++ b/browser/themes/pinstripe/browser/jar.mn
@@ -15,7 +15,6 @@ browser.jar:
   skin/classic/browser/Geolocation-16.png
   skin/classic/browser/Geolocation-64.png
   skin/classic/browser/Go-arrow.png
-* skin/classic/browser/highlighter.css
   skin/classic/browser/home.png
   skin/classic/browser/hud-style-check-box-checked.png
   skin/classic/browser/hud-style-check-box-empty.png
diff --git a/browser/themes/winstripe/browser/browser.css b/browser/themes/winstripe/browser/browser.css
index 121a8aa66953..a06051af263b 100644
--- a/browser/themes/winstripe/browser/browser.css
+++ b/browser/themes/winstripe/browser/browser.css
@@ -2434,3 +2434,27 @@ panel[dimmed="true"] {
   border-top-left-radius: .3em;
   margin-left: 1em;
 }
+
+/* Highlighter */
+
+.highlighter-veil {
+  background-color: rgba(0, 0, 0, 0.5);
+}
+
+#highlighter-close-button {
+  list-style-image: url("chrome://browser/skin/KUI-close.png");
+  top: 12px;
+  right: 12px;
+  cursor: pointer;
+}
+
+#highlighter-close-button:-moz-locale-dir(rtl)  {
+  right: auto;
+  left: 12px;
+}
+
+#highlighter-veil-transparentbox {
+  box-shadow: 0 0 0 1px rgba(0,0,0,0.5);
+  outline: 1px dashed rgba(255,255,255,0.5);
+  outline-offset: -1px;
+}
diff --git a/browser/themes/winstripe/browser/highlighter.css b/browser/themes/winstripe/browser/highlighter.css
deleted file mode 100644
index 6a3236b97155..000000000000
--- a/browser/themes/winstripe/browser/highlighter.css
+++ /dev/null
@@ -1,105 +0,0 @@
-/* ***** BEGIN LICENSE BLOCK *****
- * Version: MPL 1.1/GPL 2.0/LGPL 2.1
- *
- * The contents of this file are subject to the Mozilla Public License Version
- * 1.1 (the "License"); you may not use this file except in compliance with
- * the License. You may obtain a copy of the License at
- * http://www.mozilla.org/MPL/
- *
- * Software distributed under the License is distributed on an "AS IS" basis,
- * WITHOUT WARRANTY OF ANY KIND, either express or implied. See the License
- * for the specific language governing rights and limitations under the
- * License.
- *
- * The Original Code is the Mozilla Inspector Module.
- *
- * The Initial Developer of the Original Code is
- * The Mozilla Foundation.
- * Portions created by the Initial Developer are Copyright (C) 2011
- * the Initial Developer. All Rights Reserved.
- *
- * Contributor(s):
- *   Rob Campbell <rcampbell@mozilla.com> (original author)
- *   Paul Rouget <paul@mozilla.com>
- *
- * Alternatively, the contents of this file may be used under the terms of
- * either the GNU General Public License Version 2 or later (the "GPL"), or
- * the GNU Lesser General Public License Version 2.1 or later (the "LGPL"),
- * in which case the provisions of the GPL or the LGPL are applicable instead
- * of those above. If you wish to allow use of your version of this file only
- * under the terms of either the GPL or the LGPL, and not to allow others to
- * use your version of this file under the terms of the MPL, indicate your
- * decision by deleting the provisions above and replace them with the notice
- * and other provisions required by the GPL or the LGPL. If you do not delete
- * the provisions above, a recipient may use your version of this file under
- * the terms of any one of the MPL, the GPL or the LGPL.
- *
- * ***** END LICENSE BLOCK ***** */
-
-body {
-  margin: 0;
-  overflow: hidden;
-}
-
-#close-button {
-  background-image: url("KUI-close.png");
-  border: none;
-  padding: 0;
-  width: 24px;
-  height: 24px;
-  position: fixed;
-  top: 12px;
-  right: 12px;
-  z-index: 1;
-  cursor: pointer;
-}
-
-.veil {
-  background-color: rgba(0, 0, 0, 0.5);
-}
-
-.veil, #veil-middlebox, #veil-transparentbox {
-  -moz-transition: 0.1s;
-  -moz-transition-timing-function: linear;
-}
-
-#veil-container {
-  position: absolute;
-  top: 0;
-  left: 0;
-  width: 100%;
-  height: 100%;
-}
-
-#veil {
-  width: 100%;
-  height: 100%;
-  display: -moz-box;
-  -moz-box-orient: vertical;
-}
-
-#veil-topbox, #veil-bottombox {
-  width: 100%;
-}
-
-#veil-bottombox {
-  -moz-box-flex: 1;
-}
-
-#veil-middlebox {
-  display: -moz-box;
-  -moz-box-orient: horizontal;
-}
-
-#veil-leftbox, #veil-rightbox {
-  height: 100%;
-}
-
-#veil-rightbox {
-  -moz-box-flex: 1;
-}
-
-#veil {
-  vertical-align: top;
-}
-
diff --git a/browser/themes/winstripe/browser/jar.mn b/browser/themes/winstripe/browser/jar.mn
index b0e49bd3a75e..119fc0fa8fe3 100644
--- a/browser/themes/winstripe/browser/jar.mn
+++ b/browser/themes/winstripe/browser/jar.mn
@@ -19,7 +19,6 @@ browser.jar:
         skin/classic/browser/fullscreen-video.css
         skin/classic/browser/Geolocation-16.png
         skin/classic/browser/Geolocation-64.png
-*       skin/classic/browser/highlighter.css
         skin/classic/browser/Info.png                                (Info.png)
         skin/classic/browser/identity.png                            (identity.png)
         skin/classic/browser/keyhole-forward-mask.svg
@@ -134,7 +133,6 @@ browser.jar:
         skin/classic/aero/browser/fullscreen-video.css
         skin/classic/aero/browser/Geolocation-16.png
         skin/classic/aero/browser/Geolocation-64.png
-*       skin/classic/aero/browser/highlighter.css
         skin/classic/aero/browser/Info.png                           (Info-aero.png)
         skin/classic/aero/browser/identity.png                       (identity-aero.png)
         skin/classic/aero/browser/keyhole-forward-mask.svg
diff --git a/build/autoconf/libstdcxx.py b/build/autoconf/libstdcxx.py
index cc4ecb678938..35008918e6d9 100755
--- a/build/autoconf/libstdcxx.py
+++ b/build/autoconf/libstdcxx.py
@@ -67,7 +67,7 @@ def find_version(e):
     return encode_ver(last_version)
 
 if __name__ == '__main__':
-    cxx_env = os.environ.get('CXX', 'c++')
+    cxx_env = os.environ['CXX']
     print 'MOZ_LIBSTDCXX_TARGET_VERSION=%s' % find_version(cxx_env)
     host_cxx_env = os.environ.get('HOST_CXX', cxx_env)
     print 'MOZ_LIBSTDCXX_HOST_VERSION=%s' % find_version(host_cxx_env)
diff --git a/config/autoconf.mk.in b/config/autoconf.mk.in
index 6cd9a5ff3075..cb2f7040f34d 100644
--- a/config/autoconf.mk.in
+++ b/config/autoconf.mk.in
@@ -112,6 +112,7 @@ MOZ_JPROF       = @MOZ_JPROF@
 MOZ_SHARK       = @MOZ_SHARK@
 MOZ_CALLGRIND   = @MOZ_CALLGRIND@
 MOZ_VTUNE       = @MOZ_VTUNE@
+MOZ_ETW         = @MOZ_ETW@
 MOZ_TRACE_JSCALLS = @MOZ_TRACE_JSCALLS@
 MOZ_TRACEVIS    = @MOZ_TRACEVIS@
 DEHYDRA_PATH    = @DEHYDRA_PATH@
@@ -343,6 +344,7 @@ AS_DASH_C_FLAG	= @AS_DASH_C_FLAG@
 LD		= @LD@
 RC		= @RC@
 RCFLAGS		= @RCFLAGS@
+MC		= @MC@
 WINDRES		= @WINDRES@
 IMPLIB		= @IMPLIB@
 FILTER		= @FILTER@
diff --git a/config/rules.mk b/config/rules.mk
index c6cae7e1ffa7..638d32b8765c 100644
--- a/config/rules.mk
+++ b/config/rules.mk
@@ -2020,6 +2020,7 @@ showbuild:
 	@echo "MKSHLIB            = $(MKSHLIB)"
 	@echo "MKCSHLIB           = $(MKCSHLIB)"
 	@echo "RC                 = $(RC)"
+	@echo "MC                 = $(MC)"
 	@echo "CFLAGS             = $(CFLAGS)"
 	@echo "OS_CFLAGS          = $(OS_CFLAGS)"
 	@echo "COMPILE_CFLAGS     = $(COMPILE_CFLAGS)"
diff --git a/configure.in b/configure.in
index 7a1d9d5a49c5..61577a85808a 100644
--- a/configure.in
+++ b/configure.in
@@ -2255,13 +2255,17 @@ ia64*-hpux*)
         MOZ_DEBUG_FLAGS="-g" # We want inlining
     ;;
     esac
-    ;;
 
+    if test -z "$MC"; then 
+        MC=mc.exe  
+    fi
+    ;;
 *-mingw*)
     DSO_CFLAGS=
     DSO_PIC_CFLAGS=
     DLL_SUFFIX=.dll
     RC=rc.exe
+    MC=mc.exe
     # certain versions of cygwin's makedepend barf on the 
     # #include <string> vs -I./dist/include/string issue so don't use it
     SYSTEM_MAKEDEPEND=
@@ -2549,6 +2553,7 @@ ia64*-hpux*)
     TARGET_MD_ARCH=os2
     _PLATFORM_DEFAULT_TOOLKIT="cairo-os2"
     RC=rc.exe
+    MC=mc.exe
     RCFLAGS='-n'
     MOZ_USER_DIR="Mozilla"
     ZIP="$ZIP -X"
@@ -7547,6 +7552,26 @@ if test -n "$MOZ_GCTIMER"; then
     AC_DEFINE(MOZ_GCTIMER)
 fi
 
+dnl ========================================================
+dnl ETW - Event Tracing for Windows
+dnl ========================================================
+MOZ_ARG_ENABLE_BOOL(ETW,
+[  --enable-ETW            Enable ETW (Event Tracing for Windows) event reporting
+                          (needs Windows Vista+ SDK)],
+    MOZ_ETW=1,
+    MOZ_ETW= )
+if test -n "$MOZ_ETW"; then
+    AC_DEFINE(MOZ_ETW)
+fi
+
+if test -n "$MOZ_ETW"; then
+    if test -z "$MOZ_WINSDK_TARGETVER"; then
+        AC_MSG_ERROR([--enable-ETW is only valid on Windows])
+    elif test "$MOZ_WINSDK_TARGETVER" -lt "06000000"; then
+        AC_MSG_ERROR([--enable-ETW requires the Windows Vista SDK or newer])
+    fi
+fi
+
 dnl ========================================================
 dnl Zealous JavaScript GC
 dnl ========================================================
@@ -7698,7 +7723,7 @@ MOZ_ARG_ENABLE_BOOL(stdcxx-compat,
 AC_SUBST(STDCXX_COMPAT)
 
 if test -n "$STDCXX_COMPAT"; then
-   eval $($PYTHON $_topsrcdir/build/autoconf/libstdcxx.py)
+   eval $(CXX="$CXX" $PYTHON $_topsrcdir/build/autoconf/libstdcxx.py)
    AC_SUBST(MOZ_LIBSTDCXX_TARGET_VERSION)
    AC_SUBST(MOZ_LIBSTDCXX_HOST_VERSION)
 fi
@@ -8851,6 +8876,7 @@ AC_SUBST(AS_DASH_C_FLAG)
 AC_SUBST(LD)
 AC_SUBST(RC)
 AC_SUBST(RCFLAGS)
+AC_SUBST(MC)
 AC_SUBST(WINDRES)
 AC_SUBST(IMPLIB)
 AC_SUBST(FILTER)
@@ -8883,6 +8909,7 @@ AC_SUBST(MOZ_JPROF)
 AC_SUBST(MOZ_SHARK)
 AC_SUBST(MOZ_CALLGRIND)
 AC_SUBST(MOZ_VTUNE)
+AC_SUBST(MOZ_ETW)
 AC_SUBST(MOZ_PROFILING)
 AC_SUBST(MOZ_QUANTIFY)
 AC_SUBST(LIBICONV)
diff --git a/content/base/public/Element.h b/content/base/public/Element.h
index 5a3c185c3fa4..406cc4afb5ff 100644
--- a/content/base/public/Element.h
+++ b/content/base/public/Element.h
@@ -42,6 +42,7 @@
 
 #include "nsIContent.h"
 #include "nsEventStates.h"
+#include "nsDOMMemoryReporter.h"
 
 class nsEventStateManager;
 class nsGlobalWindow;
@@ -97,6 +98,8 @@ public:
   {}
 #endif // MOZILLA_INTERNAL_API
 
+  NS_DECL_AND_IMPL_DOM_MEMORY_REPORTER_SIZEOF(Element, nsIContent)
+
   /**
    * Method to get the full state of this element.  See nsEventStates.h for
    * the possible bits that could be set here.
diff --git a/content/base/public/nsDOMFile.h b/content/base/public/nsDOMFile.h
index ceb76b1f6b63..351898eba774 100644
--- a/content/base/public/nsDOMFile.h
+++ b/content/base/public/nsDOMFile.h
@@ -54,53 +54,111 @@
 #include "prmem.h"
 #include "nsAutoPtr.h"
 
+#ifndef PR_UINT64_MAX
+#define PR_UINT64_MAX (~(PRUint64)(0))
+#endif
+
 class nsIFile;
 class nsIInputStream;
 class nsIClassInfo;
 class nsIBlobBuilder;
 
 nsresult NS_NewBlobBuilder(nsISupports* *aSupports);
-void ParseSize(PRInt64 aSize, PRInt64& aStart, PRInt64& aEnd);
 
-class nsDOMFile : public nsIDOMFile,
-                  public nsIXHRSendable,
-                  public nsIJSNativeInitializer
+class nsDOMFileBase : public nsIDOMFile,
+                      public nsIXHRSendable
 {
 public:
+
+  nsDOMFileBase(const nsAString& aName, const nsAString& aContentType,
+                PRUint64 aLength)
+    : mIsFile(true), mContentType(aContentType), mName(aName),
+      mStart(0), mLength(aLength)
+  {
+    // Ensure non-null mContentType by default
+    mContentType.SetIsVoid(PR_FALSE);
+  }
+
+  nsDOMFileBase(const nsAString& aContentType, PRUint64 aLength)
+    : mIsFile(false), mContentType(aContentType),
+      mStart(0), mLength(aLength)
+  {
+    // Ensure non-null mContentType by default
+    mContentType.SetIsVoid(PR_FALSE);
+  }
+
+  nsDOMFileBase(const nsAString& aContentType,
+                PRUint64 aStart, PRUint64 aLength)
+    : mIsFile(false), mContentType(aContentType),
+      mStart(aStart), mLength(aLength)
+  {
+    NS_ASSERTION(aLength != PR_UINT64_MAX,
+                 "Must know length when creating slice");
+    // Ensure non-null mContentType by default
+    mContentType.SetIsVoid(PR_FALSE);
+  }
+
+  virtual ~nsDOMFileBase() {}
+
+  virtual already_AddRefed<nsIDOMBlob>
+  CreateSlice(PRUint64 aStart, PRUint64 aLength,
+              const nsAString& aContentType) = 0;
+
   NS_DECL_ISUPPORTS
   NS_DECL_NSIDOMBLOB
   NS_DECL_NSIDOMFILE
   NS_DECL_NSIXHRSENDABLE
 
-  nsDOMFile(nsIFile *aFile, const nsAString& aContentType,
-            nsISupports *aCacheToken = nsnull)
-    : mFile(aFile),
-      mCacheToken(aCacheToken),
-      mContentType(aContentType),
-      mIsFullFile(true)
-  {}
-
-  nsDOMFile(nsIFile *aFile)
-    : mFile(aFile),
-      mIsFullFile(true)
-  {}
-
-  nsDOMFile(const nsDOMFile* aOther, PRUint64 aStart, PRUint64 aLength,
-            const nsAString& aContentType)
-    : mFile(aOther->mFile),
-      mCacheToken(aOther->mCacheToken),
-      mStart(aOther->mIsFullFile ? aStart :
-                                   (aOther->mStart + aStart)),
-      mLength(aLength),
-      mContentType(aContentType),
-      mIsFullFile(false)
+protected:
+  bool IsSizeUnknown()
   {
-    NS_ASSERTION(mFile, "must have file");
-    // Ensure non-null mContentType
-    mContentType.SetIsVoid(PR_FALSE);
+    return mLength == PR_UINT64_MAX;
   }
 
-  virtual ~nsDOMFile() {}
+  bool mIsFile;
+  nsString mContentType;
+  nsString mName;
+
+  PRUint64 mStart;
+  PRUint64 mLength;
+};
+
+class nsDOMFileFile : public nsDOMFileBase,
+                      public nsIJSNativeInitializer
+{
+public:
+  // Create as a file
+  nsDOMFileFile(nsIFile *aFile)
+    : nsDOMFileBase(EmptyString(), EmptyString(), PR_UINT64_MAX),
+      mFile(aFile), mWholeFile(true)
+  {
+    NS_ASSERTION(mFile, "must have file");
+    // Lazily get the content type and size
+    mContentType.SetIsVoid(PR_TRUE);
+    mFile->GetLeafName(mName);
+  }
+
+  // Create as a blob
+  nsDOMFileFile(nsIFile *aFile, const nsAString& aContentType,
+                nsISupports *aCacheToken = nsnull)
+    : nsDOMFileBase(aContentType, PR_UINT64_MAX),
+      mFile(aFile), mWholeFile(true),
+      mCacheToken(aCacheToken)
+  {
+    NS_ASSERTION(mFile, "must have file");
+  }
+
+  // Create as a file to be later initialized
+  nsDOMFileFile()
+    : nsDOMFileBase(EmptyString(), EmptyString(), PR_UINT64_MAX),
+      mWholeFile(true)
+  {
+    // Lazily get the content type and size
+    mContentType.SetIsVoid(PR_TRUE);
+    mName.SetIsVoid(PR_TRUE);
+  }
+
+  NS_DECL_ISUPPORTS_INHERITED
 
   // nsIJSNativeInitializer
   NS_IMETHOD Initialize(nsISupports* aOwner,
@@ -109,62 +167,74 @@ public:
                         PRUint32 aArgc,
                         jsval* aArgv);
 
+  // Overrides
+  NS_IMETHOD GetSize(PRUint64* aSize);
+  NS_IMETHOD GetType(nsAString& aType);
+  NS_IMETHOD GetMozFullPathInternal(nsAString& aFullPath);
+  NS_IMETHOD GetInternalStream(nsIInputStream**);
+
   // DOMClassInfo constructor (for File("foo"))
   static nsresult
   NewFile(nsISupports* *aNewObject);
 
 protected:
+  // Create slice
+  nsDOMFileFile(const nsDOMFileFile* aOther, PRUint64 aStart, PRUint64 aLength,
+                const nsAString& aContentType)
+    : nsDOMFileBase(aContentType, aOther->mStart + aStart, aLength),
+      mFile(aOther->mFile), mWholeFile(false),
+      mCacheToken(aOther->mCacheToken)
+  {
+    NS_ASSERTION(mFile, "must have file");
+  }
+  virtual already_AddRefed<nsIDOMBlob>
+  CreateSlice(PRUint64 aStart, PRUint64 aLength,
+              const nsAString& aContentType);
+
   nsCOMPtr<nsIFile> mFile;
+  bool mWholeFile;
   nsCOMPtr<nsISupports> mCacheToken;
-
-  // start and length in 
-  PRUint64 mStart;
-  PRUint64 mLength;
-
-  nsString mContentType;
-  
-  bool mIsFullFile;
 };
 
-class nsDOMMemoryFile : public nsDOMFile
+class nsDOMMemoryFile : public nsDOMFileBase
 {
 public:
+  // Create as file
   nsDOMMemoryFile(void *aMemoryBuffer,
                   PRUint64 aLength,
                   const nsAString& aName,
                   const nsAString& aContentType)
-    : nsDOMFile(nsnull, aContentType),
-      mDataOwner(new DataOwner(aMemoryBuffer)),
-      mName(aName)
+    : nsDOMFileBase(aName, aContentType, aLength),
+      mDataOwner(new DataOwner(aMemoryBuffer))
   {
-    mStart = 0;
-    mLength = aLength;
+    NS_ASSERTION(mDataOwner && mDataOwner->mData, "must have data");
   }
 
+  // Create as blob
+  nsDOMMemoryFile(void *aMemoryBuffer,
+                  PRUint64 aLength,
+                  const nsAString& aContentType)
+    : nsDOMFileBase(aContentType, aLength),
+      mDataOwner(new DataOwner(aMemoryBuffer))
+  {
+    NS_ASSERTION(mDataOwner && mDataOwner->mData, "must have data");
+  }
+
+  NS_IMETHOD GetInternalStream(nsIInputStream**);
+
+protected:
+  // Create slice
   nsDOMMemoryFile(const nsDOMMemoryFile* aOther, PRUint64 aStart,
                   PRUint64 aLength, const nsAString& aContentType)
-    : nsDOMFile(nsnull, aContentType),
+    : nsDOMFileBase(aContentType, aOther->mStart + aStart, aLength),
       mDataOwner(aOther->mDataOwner)
   {
     NS_ASSERTION(mDataOwner && mDataOwner->mData, "must have data");
-
-    mIsFullFile = false;
-    mStart = aOther->mStart + aStart;
-    mLength = aLength;
-
-    // Ensure non-null mContentType
-    mContentType.SetIsVoid(PR_FALSE);
   }
+  virtual already_AddRefed<nsIDOMBlob>
+  CreateSlice(PRUint64 aStart, PRUint64 aLength,
+              const nsAString& aContentType);
 
-  NS_IMETHOD GetName(nsAString&);
-  NS_IMETHOD GetSize(PRUint64*);
-  NS_IMETHOD GetInternalStream(nsIInputStream**);
-  NS_IMETHOD GetMozFullPathInternal(nsAString&);
-  NS_IMETHOD MozSlice(PRInt64 aStart, PRInt64 aEnd,
-                      const nsAString& aContentType, PRUint8 optional_argc,
-                      nsIDOMBlob **aBlob);
-
-protected:
   friend class DataOwnerAdapter; // Needs to see DataOwner
   class DataOwner {
   public:
@@ -181,8 +251,6 @@ protected:
 
   // Used when backed by a memory store
   nsRefPtr<DataOwner> mDataOwner;
-
-  nsString mName;
 };
 
 class nsDOMFileList : public nsIDOMFileList
diff --git a/content/base/public/nsIContent.h b/content/base/public/nsIContent.h
index f1213510aeea..a10134ac5630 100644
--- a/content/base/public/nsIContent.h
+++ b/content/base/public/nsIContent.h
@@ -43,6 +43,7 @@
 #include "nsChangeHint.h"
 #include "nsINode.h"
 #include "nsIDocument.h" // for IsInHTMLDocument
+#include "nsDOMMemoryReporter.h"
 
 // Forward declarations
 class nsIAtom;
@@ -76,8 +77,8 @@ enum nsLinkState {
 
 // IID for the nsIContent interface
 #define NS_ICONTENT_IID       \
-{ 0x860ee35b, 0xe505, 0x438f, \
- { 0xa7, 0x7b, 0x65, 0xb9, 0xf5, 0x0b, 0xe5, 0x29 } }
+{ 0x4aad2c06, 0xd6c3, 0x4f44, \
+ { 0x94, 0xf9, 0xd5, 0xac, 0xe5, 0x04, 0x67, 0xec } }
 
 /**
  * A node of content in a document's content model. This interface
@@ -100,6 +101,8 @@ public:
 
   NS_DECLARE_STATIC_IID_ACCESSOR(NS_ICONTENT_IID)
 
+  NS_DECL_AND_IMPL_DOM_MEMORY_REPORTER_SIZEOF(nsIContent, nsINode);
+
   /**
    * Bind this content node to a tree.  If this method throws, the caller must
    * call UnbindFromTree() on the node.  In the typical case of a node being
@@ -946,10 +949,6 @@ public:
 
   virtual nsresult PreHandleEvent(nsEventChainPreVisitor& aVisitor);
 
-  PRInt64 SizeOf() const {
-    return sizeof(*this);
-  }
-
 protected:
   /**
    * Hook for implementing GetID.  This is guaranteed to only be
diff --git a/content/base/public/nsIDOMFile.idl b/content/base/public/nsIDOMFile.idl
index 834c83ecbeef..a5604985bfb3 100644
--- a/content/base/public/nsIDOMFile.idl
+++ b/content/base/public/nsIDOMFile.idl
@@ -47,7 +47,7 @@ interface nsIURI;
 interface nsIPrincipal;
 interface nsIDOMBlob;
 
-[scriptable, uuid(d5237f31-443a-460b-9e42-449a135346f0)]
+[scriptable, builtinclass, uuid(d5237f31-443a-460b-9e42-449a135346f0)]
 interface nsIDOMBlob : nsISupports
 {
   readonly attribute unsigned long long size;
@@ -58,12 +58,12 @@ interface nsIDOMBlob : nsISupports
   // moz-filedata: protocol handler
   [noscript] DOMString getInternalUrl(in nsIPrincipal principal);
 
-  [optional_argc] nsIDOMBlob mozSlice(in long long start,
+  [optional_argc] nsIDOMBlob mozSlice([optional] in long long start,
                                       [optional] in long long end,
                                       [optional] in DOMString contentType);
 };
 
-[scriptable, uuid(b096ef67-7b77-47f8-8e70-5d8ee36416bf)]
+[scriptable, builtinclass, uuid(b096ef67-7b77-47f8-8e70-5d8ee36416bf)]
 interface nsIDOMFile : nsIDOMBlob
 {
   readonly attribute DOMString name;
@@ -73,9 +73,10 @@ interface nsIDOMFile : nsIDOMBlob
   [noscript] readonly attribute DOMString mozFullPathInternal;
 };
 
-[scriptable, uuid(c4a77171-039b-4f84-97f9-820fb51626af)]
+[scriptable, builtinclass, uuid(006d2cde-ec18-41d4-acc3-43682dd418e2)]
 interface nsIDOMMozBlobBuilder : nsISupports
 {
   nsIDOMBlob getBlob([optional] in DOMString contentType);
+  nsIDOMFile getFile(in DOMString name, [optional] in DOMString contentType);
   [implicit_jscontext] void append(in jsval data);
 };
diff --git a/content/base/public/nsINode.h b/content/base/public/nsINode.h
index f78aad13e5d7..138d3ed5ee07 100644
--- a/content/base/public/nsINode.h
+++ b/content/base/public/nsINode.h
@@ -280,8 +280,8 @@ private:
 
 // IID for the nsINode interface
 #define NS_INODE_IID \
-{ 0x4776aa9a, 0xa886, 0x40c9, \
- { 0xae, 0x4c, 0x4d, 0x92, 0xe2, 0xf0, 0xd9, 0x61 } }
+{ 0xc7abbb40, 0x2571, 0x4d12, \
+ { 0x8f, 0x89, 0x0d, 0x4f, 0x55, 0xc0, 0x92, 0xf6 } }
 
 /**
  * An internal interface that abstracts some DOMNode-related parts that both
@@ -294,6 +294,10 @@ class nsINode : public nsIDOMEventTarget,
 public:
   NS_DECLARE_STATIC_IID_ACCESSOR(NS_INODE_IID)
 
+  virtual PRInt64 SizeOf() const {
+    return sizeof(*this);
+  }
+
   friend class nsNodeUtils;
   friend class nsNodeWeakReference;
   friend class nsNodeSupportsWeakRefTearoff;
diff --git a/content/base/src/nsAttrAndChildArray.cpp b/content/base/src/nsAttrAndChildArray.cpp
index 7cbc8db8c542..bedcee7703d0 100644
--- a/content/base/src/nsAttrAndChildArray.cpp
+++ b/content/base/src/nsAttrAndChildArray.cpp
@@ -847,3 +847,21 @@ nsAttrAndChildArray::SetChildAtPos(void** aPos, nsIContent* aChild,
     next->mPreviousSibling = aChild;
   }
 }
+
+PRInt64
+nsAttrAndChildArray::SizeOf() const
+{
+  PRInt64 size = sizeof(*this);
+
+  if (mImpl) {
+    // Don't add the size taken by *mMappedAttrs because it's shared.
+
+    // mBuffer cointains InternalAttr and nsIContent* (even if it's void**)
+    // so, we just have to compute the size of *mBuffer given that this object
+    // doesn't own the children list.
+    size += mImpl->mBufferSize * sizeof(*(mImpl->mBuffer)) + NS_IMPL_EXTRA_SIZE;
+  }
+
+  return size;
+}
+
diff --git a/content/base/src/nsAttrAndChildArray.h b/content/base/src/nsAttrAndChildArray.h
index da6b0e82e900..675add867267 100644
--- a/content/base/src/nsAttrAndChildArray.h
+++ b/content/base/src/nsAttrAndChildArray.h
@@ -131,6 +131,8 @@ public:
            !AttrSlotIsTaken(ATTRCHILD_ARRAY_MAX_ATTR_COUNT - 1);
   }
 
+  PRInt64 SizeOf() const;
+
 private:
   nsAttrAndChildArray(const nsAttrAndChildArray& aOther); // Not to be implemented
   nsAttrAndChildArray& operator=(const nsAttrAndChildArray& aOther); // Not to be implemented
diff --git a/content/base/src/nsDOMBlobBuilder.cpp b/content/base/src/nsDOMBlobBuilder.cpp
index 0f02188ed075..e3d1af47bb1f 100644
--- a/content/base/src/nsDOMBlobBuilder.cpp
+++ b/content/base/src/nsDOMBlobBuilder.cpp
@@ -52,64 +52,65 @@
 
 using namespace mozilla;
 
-class nsDOMMultipartBlob : public nsDOMFile
+class nsDOMMultipartFile : public nsDOMFileBase
 {
 public:
-  nsDOMMultipartBlob(nsTArray<nsCOMPtr<nsIDOMBlob> > aBlobs,
+  // Create as a file
+  nsDOMMultipartFile(nsTArray<nsCOMPtr<nsIDOMBlob> > aBlobs,
+                     const nsAString& aName,
                      const nsAString& aContentType)
-    : nsDOMFile(nsnull, aContentType),
+    : nsDOMFileBase(aName, aContentType, PR_UINT64_MAX),
       mBlobs(aBlobs)
   {
-    mIsFullFile = false;
-    mStart = 0;
-    mLength = 0;
   }
 
+  // Create as a blob
+  nsDOMMultipartFile(nsTArray<nsCOMPtr<nsIDOMBlob> > aBlobs,
+                     const nsAString& aContentType)
+    : nsDOMFileBase(aContentType, PR_UINT64_MAX),
+      mBlobs(aBlobs)
+  {
+  }
+
+  already_AddRefed<nsIDOMBlob>
+  CreateSlice(PRUint64 aStart, PRUint64 aLength, const nsAString& aContentType);
+
   NS_IMETHOD GetSize(PRUint64*);
   NS_IMETHOD GetInternalStream(nsIInputStream**);
-  NS_IMETHOD MozSlice(PRInt64 aStart, PRInt64 aEnd,
-                      const nsAString& aContentType, PRUint8 optional_argc,
-                      nsIDOMBlob **aBlob);
 
 protected:
   nsTArray<nsCOMPtr<nsIDOMBlob> > mBlobs;
 };
 
 NS_IMETHODIMP
-nsDOMMultipartBlob::GetSize(PRUint64* aLength)
+nsDOMMultipartFile::GetSize(PRUint64* aLength)
 {
-  nsresult rv;
-  *aLength = 0;
+  if (mLength == PR_UINT64_MAX) {
+    CheckedUint64 length = 0;
+  
+    PRUint32 i;
+    PRUint32 len = mBlobs.Length();
+    for (i = 0; i < len; i++) {
+      nsIDOMBlob* blob = mBlobs.ElementAt(i).get();
+      PRUint64 l = 0;
+  
+      nsresult rv = blob->GetSize(&l);
+      NS_ENSURE_SUCCESS(rv, rv);
+  
+      length += l;
+    }
+  
+    NS_ENSURE_TRUE(length.valid(), NS_ERROR_FAILURE);
 
-  if (mLength) {
-    *aLength = mLength;
-    return NS_OK;
+    mLength = length.value();
   }
 
-  CheckedUint64 length = 0;
-
-  PRUint32 i;
-  PRUint32 len = mBlobs.Length();
-  for (i = 0; i < len; i++) {
-    nsIDOMBlob* blob = mBlobs.ElementAt(i).get();
-    PRUint64 l = 0;
-
-    rv = blob->GetSize(&l);
-    NS_ENSURE_SUCCESS(rv, rv);
-
-    length += l;
-  }
-
-  if (!length.valid())
-    return NS_ERROR_FAILURE;
-
-  mLength = length.value();
   *aLength = mLength;
   return NS_OK;
 }
 
 NS_IMETHODIMP
-nsDOMMultipartBlob::GetInternalStream(nsIInputStream** aStream)
+nsDOMMultipartFile::GetInternalStream(nsIInputStream** aStream)
 {
   nsresult rv;
   *aStream = nsnull;
@@ -133,57 +134,37 @@ nsDOMMultipartBlob::GetInternalStream(nsIInputStream** aStream)
   return CallQueryInterface(stream, aStream);
 }
 
-NS_IMETHODIMP
-nsDOMMultipartBlob::MozSlice(PRInt64 aStart, PRInt64 aEnd,
-                             const nsAString& aContentType,
-                             PRUint8 optional_argc,
-                             nsIDOMBlob **aBlob)
+already_AddRefed<nsIDOMBlob>
+nsDOMMultipartFile::CreateSlice(PRUint64 aStart, PRUint64 aLength,
+                                const nsAString& aContentType)
 {
-  nsresult rv;
-  *aBlob = nsnull;
-
-  // Truncate aStart and aEnd so that we stay within this file.
-  PRUint64 thisLength;
-  rv = GetSize(&thisLength);
-  NS_ENSURE_SUCCESS(rv, rv);
-
-  if (!optional_argc) {
-    aEnd = (PRInt64)thisLength;
-  }
-
-  // Modifies aStart and aEnd.
-  ParseSize((PRInt64)thisLength, aStart, aEnd);
-
   // If we clamped to nothing we create an empty blob
   nsTArray<nsCOMPtr<nsIDOMBlob> > blobs;
 
-  PRUint64 length = aEnd - aStart;
+  PRUint64 length = aLength;
   PRUint64 skipStart = aStart;
 
-  NS_ABORT_IF_FALSE(PRUint64(aStart) + length <= thisLength, "Er, what?");
-
   // Prune the list of blobs if we can
   PRUint32 i;
   for (i = 0; length && skipStart && i < mBlobs.Length(); i++) {
     nsIDOMBlob* blob = mBlobs[i].get();
 
     PRUint64 l;
-    rv = blob->GetSize(&l);
-    NS_ENSURE_SUCCESS(rv, rv);
+    nsresult rv = blob->GetSize(&l);
+    NS_ENSURE_SUCCESS(rv, nsnull);
 
     if (skipStart < l) {
       PRUint64 upperBound = NS_MIN<PRUint64>(l - skipStart, length);
 
       nsCOMPtr<nsIDOMBlob> firstBlob;
-      rv = mBlobs.ElementAt(i)->MozSlice(skipStart, skipStart + upperBound,
-                                         aContentType, 2,
-                                         getter_AddRefs(firstBlob));
-      NS_ENSURE_SUCCESS(rv, rv);
+      rv = blob->MozSlice(skipStart, skipStart + upperBound,
+                          aContentType, 3,
+                          getter_AddRefs(firstBlob));
+      NS_ENSURE_SUCCESS(rv, nsnull);
 
-      // Avoid wrapping a single blob inside an nsDOMMultipartBlob
+      // Avoid wrapping a single blob inside an nsDOMMultipartFile
       if (length == upperBound) {
-        firstBlob.forget(aBlob);
-        return NS_OK;
+        return firstBlob.forget();
       }
 
       blobs.AppendElement(firstBlob);
@@ -199,14 +180,14 @@ nsDOMMultipartBlob::MozSlice(PRInt64 aStart, PRInt64 aEnd,
     nsIDOMBlob* blob = mBlobs[i].get();
 
     PRUint64 l;
-    rv = blob->GetSize(&l);
-    NS_ENSURE_SUCCESS(rv, rv);
+    nsresult rv = blob->GetSize(&l);
+    NS_ENSURE_SUCCESS(rv, nsnull);
 
     if (length < l) {
       nsCOMPtr<nsIDOMBlob> lastBlob;
-      rv = mBlobs.ElementAt(i)->MozSlice(0, length, aContentType, 2,
-                                         getter_AddRefs(lastBlob));
-      NS_ENSURE_SUCCESS(rv, rv);
+      rv = blob->MozSlice(0, length, aContentType, 3,
+                          getter_AddRefs(lastBlob));
+      NS_ENSURE_SUCCESS(rv, nsnull);
 
       blobs.AppendElement(lastBlob);
     } else {
@@ -216,9 +197,8 @@ nsDOMMultipartBlob::MozSlice(PRInt64 aStart, PRInt64 aEnd,
   }
 
   // we can create our blob now
-  nsCOMPtr<nsIDOMBlob> blob = new nsDOMMultipartBlob(blobs, aContentType);
-  blob.forget(aBlob);
-  return NS_OK;
+  nsCOMPtr<nsIDOMBlob> blob = new nsDOMMultipartFile(blobs, aContentType);
+  return blob.forget();
 }
 
 class nsDOMBlobBuilder : public nsIDOMMozBlobBuilder
@@ -346,7 +326,7 @@ nsDOMBlobBuilder::GetBlob(const nsAString& aContentType,
 
   Flush();
 
-  nsCOMPtr<nsIDOMBlob> blob = new nsDOMMultipartBlob(mBlobs,
+  nsCOMPtr<nsIDOMBlob> blob = new nsDOMMultipartFile(mBlobs,
                                                      aContentType);
   blob.forget(aBlob);
 
@@ -359,6 +339,30 @@ nsDOMBlobBuilder::GetBlob(const nsAString& aContentType,
   return NS_OK;
 }
 
+/* nsIDOMBlob getFile (in DOMString name, [optional] in DOMString contentType); */
+NS_IMETHODIMP
+nsDOMBlobBuilder::GetFile(const nsAString& aName,
+                          const nsAString& aContentType,
+                          nsIDOMFile** aFile)
+{
+  NS_ENSURE_ARG(aFile);
+
+  Flush();
+
+  nsCOMPtr<nsIDOMFile> file = new nsDOMMultipartFile(mBlobs,
+                                                     aName,
+                                                     aContentType);
+  file.forget(aFile);
+
+  // NB: This is a willful violation of the spec.  The spec says that
+  // the existing contents of the BlobBuilder should be included
+  // in the next blob produced.  This seems silly and has been raised
+  // on the WHATWG listserv.
+  mBlobs.Clear();
+
+  return NS_OK;
+}
+
 /* [implicit_jscontext] void append (in jsval data); */
 NS_IMETHODIMP
 nsDOMBlobBuilder::Append(const jsval& aData, JSContext* aCx)
diff --git a/content/base/src/nsDOMFile.cpp b/content/base/src/nsDOMFile.cpp
index 16f066a39d1e..ededcc26d2df 100644
--- a/content/base/src/nsDOMFile.cpp
+++ b/content/base/src/nsDOMFile.cpp
@@ -132,57 +132,36 @@ nsresult DataOwnerAdapter::Create(DataOwner* aDataOwner,
   return NS_OK;
 }
 
-// nsDOMFile implementation
+////////////////////////////////////////////////////////////////////////////
+// nsDOMFileBase implementation
 
-DOMCI_DATA(File, nsDOMFile)
-DOMCI_DATA(Blob, nsDOMFile)
+DOMCI_DATA(File, nsDOMFileBase)
+DOMCI_DATA(Blob, nsDOMFileBase)
 
-NS_INTERFACE_MAP_BEGIN(nsDOMFile)
+NS_INTERFACE_MAP_BEGIN(nsDOMFileBase)
   NS_INTERFACE_MAP_ENTRY_AMBIGUOUS(nsISupports, nsIDOMFile)
   NS_INTERFACE_MAP_ENTRY(nsIDOMBlob)
-  NS_INTERFACE_MAP_ENTRY_CONDITIONAL(nsIDOMFile, mIsFullFile)
+  NS_INTERFACE_MAP_ENTRY_CONDITIONAL(nsIDOMFile, mIsFile)
   NS_INTERFACE_MAP_ENTRY(nsIXHRSendable)
-  NS_INTERFACE_MAP_ENTRY(nsIJSNativeInitializer)
-  NS_DOM_INTERFACE_MAP_ENTRY_CLASSINFO_CONDITIONAL(File, mIsFullFile)
-  NS_DOM_INTERFACE_MAP_ENTRY_CLASSINFO_CONDITIONAL(Blob, !mIsFullFile)
+  NS_DOM_INTERFACE_MAP_ENTRY_CLASSINFO_CONDITIONAL(File, mIsFile)
+  NS_DOM_INTERFACE_MAP_ENTRY_CLASSINFO_CONDITIONAL(Blob, !mIsFile)
 NS_INTERFACE_MAP_END
 
-NS_IMPL_ADDREF(nsDOMFile)
-NS_IMPL_RELEASE(nsDOMFile)
+NS_IMPL_ADDREF(nsDOMFileBase)
+NS_IMPL_RELEASE(nsDOMFileBase)
 
-static nsresult
-DOMFileResult(nsresult rv)
+NS_IMETHODIMP
+nsDOMFileBase::GetName(nsAString &aFileName)
 {
-  if (rv == NS_ERROR_FILE_NOT_FOUND) {
-    return NS_ERROR_DOM_FILE_NOT_FOUND_ERR;
-  }
-
-  if (NS_ERROR_GET_MODULE(rv) == NS_ERROR_MODULE_FILES) {
-    return NS_ERROR_DOM_FILE_NOT_READABLE_ERR;
-  }
-
-  return rv;
-}
-
-/* static */ nsresult
-nsDOMFile::NewFile(nsISupports* *aNewObject)
-{
-  nsCOMPtr<nsISupports> file = do_QueryObject(new nsDOMFile(nsnull));
-  file.forget(aNewObject);
+  NS_ASSERTION(mIsFile, "Should only be called on files");
+  aFileName = mName;
   return NS_OK;
 }
 
 NS_IMETHODIMP
-nsDOMFile::GetName(nsAString &aFileName)
+nsDOMFileBase::GetMozFullPath(nsAString &aFileName)
 {
-  NS_ASSERTION(mIsFullFile, "Should only be called on files");
-  return mFile->GetLeafName(aFileName);
-}
-
-NS_IMETHODIMP
-nsDOMFile::GetMozFullPath(nsAString &aFileName)
-{
-  NS_ASSERTION(mIsFullFile, "Should only be called on files");
+  NS_ASSERTION(mIsFile, "Should only be called on files");
   if (nsContentUtils::IsCallerTrustedForCapability("UniversalFileRead")) {
     return GetMozFullPathInternal(aFileName);
   }
@@ -191,60 +170,30 @@ nsDOMFile::GetMozFullPath(nsAString &aFileName)
 }
 
 NS_IMETHODIMP
-nsDOMFile::GetMozFullPathInternal(nsAString &aFilename)
+nsDOMFileBase::GetMozFullPathInternal(nsAString &aFileName)
 {
-  NS_ASSERTION(mIsFullFile, "Should only be called on files");
-  return mFile->GetPath(aFilename);
-}
-
-NS_IMETHODIMP
-nsDOMFile::GetSize(PRUint64 *aFileSize)
-{
-  if (mIsFullFile) {
-    PRInt64 fileSize;
-    nsresult rv = mFile->GetFileSize(&fileSize);
-    NS_ENSURE_SUCCESS(rv, rv);
-  
-    if (fileSize < 0) {
-      return NS_ERROR_FAILURE;
-    }
-  
-    *aFileSize = fileSize;
-  }
-  else {
-    *aFileSize = mLength;
-  }
-
+  NS_ASSERTION(mIsFile, "Should only be called on files");
+  aFileName.Truncate();
   return NS_OK;
 }
 
 NS_IMETHODIMP
-nsDOMFile::GetType(nsAString &aType)
+nsDOMFileBase::GetSize(PRUint64 *aSize)
 {
-  if (mContentType.IsEmpty() && mFile && mIsFullFile) {
-    nsresult rv;
-    nsCOMPtr<nsIMIMEService> mimeService =
-      do_GetService(NS_MIMESERVICE_CONTRACTID, &rv);
-    NS_ENSURE_SUCCESS(rv, rv);
-
-    nsCAutoString mimeType;
-    rv = mimeService->GetTypeFromFile(mFile, mimeType);
-    if (NS_FAILED(rv)) {
-      aType.Truncate();
-      return NS_OK;
-    }
-
-    AppendUTF8toUTF16(mimeType, mContentType);
-  }
+  *aSize = mLength;
+  return NS_OK;
+}
 
+NS_IMETHODIMP
+nsDOMFileBase::GetType(nsAString &aType)
+{
   aType = mContentType;
-
   return NS_OK;
 }
 
 // Makes sure that aStart and aEnd is less then or equal to aSize and greater
 // than 0
-void
+static void
 ParseSize(PRInt64 aSize, PRInt64& aStart, PRInt64& aEnd)
 {
   CheckedInt64 newStartOffset = aStart;
@@ -280,9 +229,9 @@ ParseSize(PRInt64 aSize, PRInt64& aStart, PRInt64& aEnd)
 }
 
 NS_IMETHODIMP
-nsDOMFile::MozSlice(PRInt64 aStart, PRInt64 aEnd,
-                    const nsAString& aContentType, PRUint8 optional_argc,
-                    nsIDOMBlob **aBlob)
+nsDOMFileBase::MozSlice(PRInt64 aStart, PRInt64 aEnd,
+                        const nsAString& aContentType, PRUint8 optional_argc,
+                        nsIDOMBlob **aBlob)
 {
   *aBlob = nsnull;
 
@@ -291,34 +240,30 @@ nsDOMFile::MozSlice(PRInt64 aStart, PRInt64 aEnd,
   nsresult rv = GetSize(&thisLength);
   NS_ENSURE_SUCCESS(rv, rv);
 
-  if (!optional_argc) {
+  if (optional_argc < 2) {
     aEnd = (PRInt64)thisLength;
   }
 
   ParseSize((PRInt64)thisLength, aStart, aEnd);
   
   // Create the new file
-  NS_ADDREF(*aBlob = new nsDOMFile(this, aStart, aEnd - aStart, aContentType));
-  
-  return NS_OK;
+  *aBlob = CreateSlice((PRUint64)aStart, (PRUint64)(aEnd - aStart),
+                       aContentType).get();
+
+  return *aBlob ? NS_OK : NS_ERROR_UNEXPECTED;
 }
 
-const PRUint32 sFileStreamFlags =
-  nsIFileInputStream::CLOSE_ON_EOF |
-  nsIFileInputStream::REOPEN_ON_REWIND |
-  nsIFileInputStream::DEFER_OPEN;
-
 NS_IMETHODIMP
-nsDOMFile::GetInternalStream(nsIInputStream **aStream)
+nsDOMFileBase::GetInternalStream(nsIInputStream **aStream)
 {
-  return mIsFullFile ?
-    NS_NewLocalFileInputStream(aStream, mFile, -1, -1, sFileStreamFlags) :
-    NS_NewPartialLocalFileInputStream(aStream, mFile, mStart, mLength,
-                                      -1, -1, sFileStreamFlags);
+  // Must be overridden
+  NS_NOTREACHED("Must override GetInternalStream");
+  
+  return NS_ERROR_NOT_IMPLEMENTED;
 }
 
 NS_IMETHODIMP
-nsDOMFile::GetInternalUrl(nsIPrincipal* aPrincipal, nsAString& aURL)
+nsDOMFileBase::GetInternalUrl(nsIPrincipal* aPrincipal, nsAString& aURL)
 {
   NS_ENSURE_STATE(aPrincipal);
 
@@ -346,9 +291,9 @@ nsDOMFile::GetInternalUrl(nsIPrincipal* aPrincipal, nsAString& aURL)
 }
 
 NS_IMETHODIMP
-nsDOMFile::GetSendInfo(nsIInputStream** aBody,
-                       nsACString& aContentType,
-                       nsACString& aCharset)
+nsDOMFileBase::GetSendInfo(nsIInputStream** aBody,
+                           nsACString& aContentType,
+                           nsACString& aCharset)
 {
   nsresult rv;
 
@@ -368,12 +313,103 @@ nsDOMFile::GetSendInfo(nsIInputStream** aBody,
   return NS_OK;
 }
 
+////////////////////////////////////////////////////////////////////////////
+// nsDOMFileFile implementation
+
+NS_IMPL_ISUPPORTS_INHERITED1(nsDOMFileFile, nsDOMFileBase,
+                             nsIJSNativeInitializer)
+
+already_AddRefed<nsIDOMBlob>
+nsDOMFileFile::CreateSlice(PRUint64 aStart, PRUint64 aLength,
+                           const nsAString& aContentType)
+{
+  nsCOMPtr<nsIDOMBlob> t = new nsDOMFileFile(this, aStart, aLength, aContentType);
+  return t.forget();
+}
+
+/* static */ nsresult
+nsDOMFileFile::NewFile(nsISupports* *aNewObject)
+{
+  nsCOMPtr<nsISupports> file = do_QueryObject(new nsDOMFileFile());
+  file.forget(aNewObject);
+  return NS_OK;
+}
+
 NS_IMETHODIMP
-nsDOMFile::Initialize(nsISupports* aOwner,
-                      JSContext* aCx,
-                      JSObject* aObj,
-                      PRUint32 aArgc,
-                      jsval* aArgv)
+nsDOMFileFile::GetMozFullPathInternal(nsAString &aFilename)
+{
+  NS_ASSERTION(mIsFile, "Should only be called on files");
+  return mFile->GetPath(aFilename);
+}
+
+NS_IMETHODIMP
+nsDOMFileFile::GetSize(PRUint64 *aFileSize)
+{
+  if (IsSizeUnknown()) {
+    NS_ASSERTION(mWholeFile,
+                 "Should only use lazy size when using the whole file");
+    PRInt64 fileSize;
+    nsresult rv = mFile->GetFileSize(&fileSize);
+    NS_ENSURE_SUCCESS(rv, rv);
+  
+    if (fileSize < 0) {
+      return NS_ERROR_FAILURE;
+    }
+  
+    mLength = fileSize;
+  }
+
+  *aFileSize = mLength;
+
+  return NS_OK;
+}
+
+NS_IMETHODIMP
+nsDOMFileFile::GetType(nsAString &aType)
+{
+  if (mContentType.IsVoid()) {
+    NS_ASSERTION(mWholeFile,
+                 "Should only use lazy ContentType when using the whole file");
+    nsresult rv;
+    nsCOMPtr<nsIMIMEService> mimeService =
+      do_GetService(NS_MIMESERVICE_CONTRACTID, &rv);
+    NS_ENSURE_SUCCESS(rv, rv);
+
+    nsCAutoString mimeType;
+    rv = mimeService->GetTypeFromFile(mFile, mimeType);
+    if (NS_FAILED(rv)) {
+      mimeType.Truncate();
+    }
+
+    AppendUTF8toUTF16(mimeType, mContentType);
+    mContentType.SetIsVoid(PR_FALSE);
+  }
+
+  aType = mContentType;
+
+  return NS_OK;
+}
+
+const PRUint32 sFileStreamFlags =
+  nsIFileInputStream::CLOSE_ON_EOF |
+  nsIFileInputStream::REOPEN_ON_REWIND |
+  nsIFileInputStream::DEFER_OPEN;
+
+NS_IMETHODIMP
+nsDOMFileFile::GetInternalStream(nsIInputStream **aStream)
+{
+  return mWholeFile ?
+    NS_NewLocalFileInputStream(aStream, mFile, -1, -1, sFileStreamFlags) :
+    NS_NewPartialLocalFileInputStream(aStream, mFile, mStart, mLength,
+                                      -1, -1, sFileStreamFlags);
+}
+
+NS_IMETHODIMP
+nsDOMFileFile::Initialize(nsISupports* aOwner,
+                          JSContext* aCx,
+                          JSObject* aObj,
+                          PRUint32 aArgc,
+                          jsval* aArgv)
 {
   nsresult rv;
 
@@ -430,44 +466,21 @@ nsDOMFile::Initialize(nsISupports* aOwner,
   NS_ENSURE_FALSE(isDir, NS_ERROR_FILE_IS_DIRECTORY);
 
   mFile = file;
+  file->GetLeafName(mName);
+
   return NS_OK;
 }
 
-// nsDOMMemoryFile Implementation
-NS_IMETHODIMP
-nsDOMMemoryFile::GetName(nsAString &aFileName)
+////////////////////////////////////////////////////////////////////////////
+// nsDOMMemoryFile implementation
+
+already_AddRefed<nsIDOMBlob>
+nsDOMMemoryFile::CreateSlice(PRUint64 aStart, PRUint64 aLength,
+                             const nsAString& aContentType)
 {
-  NS_ASSERTION(mIsFullFile, "Should only be called on files");
-  aFileName = mName;
-  return NS_OK;
-}
-
-NS_IMETHODIMP
-nsDOMMemoryFile::GetSize(PRUint64 *aFileSize)
-{
-  *aFileSize = mLength;
-  return NS_OK;
-}
-
-NS_IMETHODIMP
-nsDOMMemoryFile::MozSlice(PRInt64 aStart, PRInt64 aEnd,
-                          const nsAString& aContentType, PRUint8 optional_argc,
-                          nsIDOMBlob **aBlob)
-{
-  *aBlob = nsnull;
-
-  if (!optional_argc) {
-    aEnd = (PRInt64)mLength;
-  }
-
-  // Truncate aLength and aStart so that we stay within this file.
-  ParseSize((PRInt64)mLength, aStart, aEnd);
-
-  // Create the new file
-  NS_ADDREF(*aBlob = new nsDOMMemoryFile(this, aStart, aEnd - aStart,
-                                         aContentType));
-  
-  return NS_OK;
+  nsCOMPtr<nsIDOMBlob> t =
+    new nsDOMMemoryFile(this, aStart, aLength, aContentType);
+  return t.forget();
 }
 
 NS_IMETHODIMP
@@ -479,14 +492,7 @@ nsDOMMemoryFile::GetInternalStream(nsIInputStream **aStream)
   return DataOwnerAdapter::Create(mDataOwner, mStart, mLength, aStream);
 }
 
-NS_IMETHODIMP
-nsDOMMemoryFile::GetMozFullPathInternal(nsAString &aFilename)
-{
-  NS_ASSERTION(mIsFullFile, "Should only be called on files");
-  aFilename.Truncate();
-  return NS_OK;
-}
-
+////////////////////////////////////////////////////////////////////////////
 // nsDOMFileList implementation
 
 DOMCI_DATA(FileList, nsDOMFileList)
@@ -516,6 +522,7 @@ nsDOMFileList::Item(PRUint32 aIndex, nsIDOMFile **aFile)
   return NS_OK;
 }
 
+////////////////////////////////////////////////////////////////////////////
 // nsDOMFileError implementation
 
 DOMCI_DATA(FileError, nsDOMFileError)
@@ -536,6 +543,9 @@ nsDOMFileError::GetCode(PRUint16* aCode)
   return NS_OK;
 }
 
+////////////////////////////////////////////////////////////////////////////
+// nsDOMFileInternalUrlHolder implementation
+
 nsDOMFileInternalUrlHolder::nsDOMFileInternalUrlHolder(nsIDOMBlob* aFile,
                                                        nsIPrincipal* aPrincipal
                                                        MOZILLA_GUARD_OBJECT_NOTIFIER_PARAM_IN_IMPL) {
diff --git a/content/base/src/nsGenericElement.cpp b/content/base/src/nsGenericElement.cpp
index 9a2087137a2f..6c4102847ef5 100644
--- a/content/base/src/nsGenericElement.cpp
+++ b/content/base/src/nsGenericElement.cpp
@@ -146,6 +146,7 @@
 #include "prprf.h"
 
 #include "nsSVGFeatures.h"
+#include "nsDOMMemoryReporter.h"
 
 using namespace mozilla::dom;
 namespace css = mozilla::css;
@@ -5372,3 +5373,15 @@ nsNSElementTearoff::MozMatchesSelector(const nsAString& aSelector, PRBool* aRetu
 
   return rv;
 }
+
+PRInt64
+nsGenericElement::SizeOf() const
+{
+  PRInt64 size = MemoryReporter::GetBasicSize<nsGenericElement, Element>(this);
+
+  size -= sizeof(mAttrsAndChildren);
+  size += mAttrsAndChildren.SizeOf();
+
+  return size;
+}
+
diff --git a/content/base/src/nsGenericElement.h b/content/base/src/nsGenericElement.h
index fb3d2f144d11..8fa9ab247167 100644
--- a/content/base/src/nsGenericElement.h
+++ b/content/base/src/nsGenericElement.h
@@ -240,6 +240,8 @@ public:
 
   NS_DECL_CYCLE_COLLECTING_ISUPPORTS
 
+  NS_DECL_DOM_MEMORY_REPORTER_SIZEOF
+
   /**
    * Called during QueryInterface to give the binding manager a chance to
    * get an interface for this element.
diff --git a/content/base/src/nsWebSocket.cpp b/content/base/src/nsWebSocket.cpp
index ea1fa436001b..644268f71f55 100644
--- a/content/base/src/nsWebSocket.cpp
+++ b/content/base/src/nsWebSocket.cpp
@@ -1351,6 +1351,18 @@ nsWebSocket::Init(nsIPrincipal* aPrincipal,
   rv = ParseURL(PromiseFlatString(aURL));
   NS_ENSURE_SUCCESS(rv, rv);
 
+  // Don't allow https:// to open ws://
+  nsCOMPtr<nsIURI> originURI;
+  PRBool originHTTPS;
+  if (!mSecure && 
+      !Preferences::GetBool("network.websocket.allowInsecureFromHTTPS",
+                            PR_FALSE) &&
+      NS_SUCCEEDED(NS_NewURI(getter_AddRefs(originURI), mUTF16Origin)) &&
+      NS_SUCCEEDED(originURI->SchemeIs("https", &originHTTPS)) &&
+      originHTTPS) {
+    return NS_ERROR_DOM_SECURITY_ERR;
+  }
+
   // sets the protocol
   if (!aProtocol.IsEmpty()) {
     rv = SetProtocol(PromiseFlatString(aProtocol));
diff --git a/content/base/src/nsXMLHttpRequest.cpp b/content/base/src/nsXMLHttpRequest.cpp
index be232ea679fe..4757e5723f5e 100644
--- a/content/base/src/nsXMLHttpRequest.cpp
+++ b/content/base/src/nsXMLHttpRequest.cpp
@@ -1600,13 +1600,6 @@ void nsXMLHttpRequest::CreateResponseBlob(nsIRequest *request)
   nsCOMPtr<nsICachingChannel> cc(do_QueryInterface(request));
   if (cc) {
     cc->GetCacheFile(getter_AddRefs(file));
-    if (!file) {
-      // cacheAsFile returns false if caching is inhibited
-      PRBool cacheAsFile = PR_FALSE;
-      if (NS_SUCCEEDED(cc->GetCacheAsFile(&cacheAsFile)) && cacheAsFile) {
-        
-      }
-    }
   } else {
     nsCOMPtr<nsIFileChannel> fc = do_QueryInterface(request);
     if (fc) {
@@ -1621,20 +1614,8 @@ void nsXMLHttpRequest::CreateResponseBlob(nsIRequest *request)
       cc->GetCacheToken(getter_AddRefs(cacheToken));
     }
 
-    NS_ConvertASCIItoUTF16 wideContentType(contentType);
-
-    nsCOMPtr<nsIDOMBlob> blob =
-      new nsDOMFile(file, wideContentType, cacheToken);
-
-    // XXXkhuey this is a complete hack ... but we need to get 6 out the door
-    // The response blob here should not be a File object, it should only
-    // be a Blob.  Unfortunately, because nsDOMFile has grown through
-    // accretion over the years and is in dangerous need of a refactoring,
-    // slicing it is the easiest way to get there ...
-    PRUint64 size = 0;
-    blob->GetSize(&size);
-    blob->MozSlice(0, size, wideContentType, 2, getter_AddRefs(mResponseBlob));
-    
+    mResponseBlob =
+      new nsDOMFileFile(file, NS_ConvertASCIItoUTF16(contentType), cacheToken);
     mResponseBody.Truncate();
     mResponseBodyUnicode.SetIsVoid(PR_TRUE);
   }
@@ -1906,19 +1887,9 @@ nsXMLHttpRequest::OnStopRequest(nsIRequest *request, nsISupports *ctxt, nsresult
       if (blobData) {
         memcpy(blobData, mResponseBody.BeginReading(), blobLen);
 
-        NS_ConvertASCIItoUTF16 wideContentType(contentType);
-        nsCOMPtr<nsIDOMBlob> blob =
-          new nsDOMMemoryFile(blobData, blobLen, EmptyString(),
-                              wideContentType);
-
-        // XXXkhuey this is a complete hack ... but we need to get 6 out the door
-        // The response blob here should not be a File object, it should only
-        // be a Blob.  Unfortunately, because nsDOMFile has grown through
-        // accretion over the years and is in dangerous need of a refactoring,
-        // slicing it is the easiest way to get there ...
-        blob->MozSlice(0, blobLen, wideContentType,
-                       2, getter_AddRefs(mResponseBlob));
-
+        mResponseBlob =
+          new nsDOMMemoryFile(blobData, blobLen,
+                              NS_ConvertASCIItoUTF16(contentType));
         mResponseBody.Truncate();
       }
       NS_ASSERTION(mResponseBodyUnicode.IsVoid(),
diff --git a/content/base/test/fileutils.js b/content/base/test/fileutils.js
index e2c4364b3ce8..fbe6cbaa1c39 100644
--- a/content/base/test/fileutils.js
+++ b/content/base/test/fileutils.js
@@ -220,6 +220,7 @@ function testSlice(file, size, type, contents, fileType) {
   is(slice.mozSlice(0, 10, "hello/world").type, "hello/world", fileType + " slice-slice hello/world type");
   is(slice.mozSlice(0, 10, "hello/world").size, 10, fileType + " slice-slice hello/world size");
 
+  // Start, end, expected size
   var indexes = [[0, size, size],
                  [0, 1234, 1234],
                  [size-500, size, 500],
@@ -228,6 +229,7 @@ function testSlice(file, size, type, contents, fileType) {
                  [0, 0, 0],
                  [1000, 1000, 0],
                  [size, size, 0],
+                 [undefined, undefined, size],
                  [0, undefined, size],
                  [100, undefined, size-100],
                  [-100, undefined, 100],
@@ -244,7 +246,12 @@ function testSlice(file, size, type, contents, fileType) {
   for (var i = 0; i < indexes.length; ++i) {
     var sliceContents;
     var testName;
-    if (indexes[i][1] == undefined) {
+    if (indexes[i][0] == undefined) {
+      slice = file.mozSlice();
+      sliceContents = contents.slice();
+      testName = fileType + " slice()";
+    }
+    else if (indexes[i][1] == undefined) {
       slice = file.mozSlice(indexes[i][0]);
       sliceContents = contents.slice(indexes[i][0]);
       testName = fileType + " slice(" + indexes[i][0] + ")";
diff --git a/content/base/test/test_blobbuilder.html b/content/base/test/test_blobbuilder.html
index 32e8d8c1e0f6..8ead57568412 100644
--- a/content/base/test/test_blobbuilder.html
+++ b/content/base/test/test_blobbuilder.html
@@ -28,6 +28,7 @@ ok(blobBuilder, "BlobBuilder should exist");
 
 ok(blobBuilder.append, "BlobBuilder should have an append method");
 ok(blobBuilder.getBlob, "BlobBuilder should have a getBlob method");
+ok(blobBuilder.getFile, "BlobBuilder should have a getFile method");
 
 try {
 blobBuilder.append();
@@ -38,8 +39,43 @@ ok(true, "an empty argument to append should throw");
 
 blobBuilder.append("squiggle");
 let blob1 = blobBuilder.getBlob();
+ok(blob1 instanceof Blob, "getBlob should produce Blobs");
+ok(!(blob1 instanceof File), "getBlob should not produce Files");
+is(blob1.type, "", "getBlob with no argument should return Blob with empty type");
+is(blob1.size, 8, "getBlob should return Blob with correct size");
+
 blobBuilder.append("ohai");
-let blob2 = blobBuilder.getBlob();
+let blob2 = blobBuilder.getFile("thefilename");
+ok(blob2 instanceof Blob, "getFile should produce Blobs");
+ok(blob2 instanceof File, "getFile should produce Files");
+is(blob2.name, "thefilename", "getFile should produces Files with correct name");
+is(blob2.type, "", "getFile with no second argument should return File with empty type");
+is(blob2.size, 4, "getFile should return Blob with correct size");
+
+blobBuilder.append("steak");
+let blob3 = blobBuilder.getBlob("content/type");
+ok(blob3 instanceof Blob, "getBlob should produce Blobs");
+ok(!(blob3 instanceof File), "getBlob should not produce Files");
+is(blob3.type, "content/type", "getBlob with no argument should return Blob with empty type");
+is(blob3.size, 5, "getBlob should return Blob with correct size");
+
+blobBuilder.append("apples");
+let blob4 = blobBuilder.getFile("the other filename", "text/plain");
+ok(blob4 instanceof Blob, "getFile should produce Blobs");
+ok(blob4 instanceof File, "getFile should produce Files");
+is(blob4.name, "the other filename", "getFile should produces Files with correct name");
+is(blob4.type, "text/plain", "getFile with second argument should return File with correct type");
+is(blob4.size, 6, "getFile should return Blob with correct size");
+
+blobBuilder.append("boletes");
+let blob5 = blobBuilder.getFile("");
+ok(blob5 instanceof Blob, "getFile should produce Blobs");
+ok(blob5 instanceof File, "getFile should produce Files");
+is(blob5.name, "", "getFile with empty name should produces Files with empty name");
+is(blob5.type, "", "getFile with no second argument should return File with correct type");
+is(blob5.size, 7, "getFile should return Blob with correct size");
+testFile(blob5, "boletes", "Test empty-named File from BlobBuilder.getFile");
+
 
 let aB = new ArrayBuffer(16);
 var int8View = new Int8Array(aB);
@@ -54,10 +90,10 @@ let testData =
                              {start: 0, length: 3, contents: "foo"},
                              {start: 3, length:6, contents:  "barbaz"},
                              {start: 6, length: 3, contents:  "baz"},
-                             {start: 6, length: 6, elength: 3, contents: "baz"},
+                             {start: 6, length: 6, contents: "baz"},
                              {start: 0, length: 9, contents:  "foobarbaz"},
-                             {start: 0, length: 11, elength: 9, contents: "foobarbaz"},
-                             {start: 10, length: 5, elength: 0, contents: ""}]],
+                             {start: 0, length: 11, contents: "foobarbaz"},
+                             {start: 10, length: 5, contents: ""}]],
     // Test string, Blob, string
     [["foo", blob1, "baz"], [{start: 0, length: 3, contents:  "foo"},
                              {start: 3, length: 8, contents:  "squiggle"},
@@ -69,7 +105,7 @@ let testData =
                              {start: 10, length: 2, contents: "os"},
                              {start: 1, length: 3, contents:  "qui"},
                              {start: 12, length: 3, contents: "qui"},
-                             {start: 40, length: 20, elength: 0, contents: ""}]],
+                             {start: 40, length: 20, contents: ""}]],
     // Test blobs all the way down
     [[blob2, blob1, blob2], [{start: 0, length: 4, contents:  "ohai"},
                              {start: 4, length: 8, contents:  "squiggle"},
@@ -84,7 +120,7 @@ let testData =
     // Test type coercion of a number
     [[3, aB, "foo"],        [{start: 0, length: 8, contents:  "3ABCDEFG"},
                              {start: 8, length:10, contents:  "HIJKLMNOPf"},
-                             {start: 17, length: 4, elength: 3, contents: "foo"},
+                             {start: 17, length: 4, contents: "foo"},
                              {start: 4, length: 8, contents:  "DEFGHIJK"}]]
  ];
 
@@ -110,17 +146,16 @@ function doTest(data) {
     let blob = bb.getBlob();
     ok(blob, "Test " + testCounter + " got blob");
     ok(blob instanceof Blob, "Test " + testCounter + " blob is a Blob");
-    //ok(!(blob instanceof File), "Test " + testCounter + " blob is not a File");
+    ok(!(blob instanceof File), "Test " + testCounter + " blob is not a File");
 
     let slice = blob.mozSlice(test.start, test.start + test.length);
     ok(slice, "Test " + testCounter + " got slice");
     ok(slice instanceof Blob, "Test " + testCounter + " slice is a Blob");
-    //ok(!(slice instanceof File), "Test " + testCounter + " slice is not a File");
-    is(slice.size,"elength" in test ? test.elength : test.length,
+    ok(!(slice instanceof File), "Test " + testCounter + " slice is not a File");
+    is(slice.size, test.contents.length,
        "Test " + testCounter + " slice is correct size");
 
-    testFile(slice, test.contents, "Test " + testCounter,
-             "elength" in test ? test.elength : test.length);
+    testFile(slice, test.contents, "Test " + testCounter);
   }
   tests.forEach(runTest);
   SpecialPowers.gc();
diff --git a/content/canvas/src/nsCanvasRenderingContext2D.cpp b/content/canvas/src/nsCanvasRenderingContext2D.cpp
index cd506303efac..092100cc51c3 100644
--- a/content/canvas/src/nsCanvasRenderingContext2D.cpp
+++ b/content/canvas/src/nsCanvasRenderingContext2D.cpp
@@ -103,6 +103,7 @@
 
 #include "nsFrameManager.h"
 #include "nsFrameLoader.h"
+#include "nsBidi.h"
 #include "nsBidiPresUtils.h"
 #include "Layers.h"
 #include "CanvasUtils.h"
@@ -1068,6 +1069,8 @@ nsCanvasRenderingContext2D::SetDimensions(PRInt32 width, PRInt32 height)
             mZero = PR_TRUE;
             height = 1;
             width = 1;
+        } else {
+            mZero = PR_FALSE;
         }
 
         gfxASurface::gfxImageFormat format = GetImageFormat();
@@ -2736,10 +2739,6 @@ nsCanvasRenderingContext2D::DrawOrMeasureText(const nsAString& aRawText,
 
     nsIDocument* document = presShell->GetDocument();
 
-    nsBidiPresUtils* bidiUtils = presShell->GetPresContext()->GetBidiUtils();
-    if (!bidiUtils)
-        return NS_ERROR_FAILURE;
-
     // replace all the whitespace characters with U+0020 SPACE
     nsAutoString textToDraw(aRawText);
     TextReplaceWhitespaceCharacters(textToDraw);
@@ -2785,15 +2784,17 @@ nsCanvasRenderingContext2D::DrawOrMeasureText(const nsAString& aRawText,
 
     // calls bidi algo twice since it needs the full text width and the
     // bounding boxes before rendering anything
-    rv = bidiUtils->ProcessText(textToDraw.get(),
-                                textToDraw.Length(),
-                                isRTL ? NSBIDI_RTL : NSBIDI_LTR,
-                                presShell->GetPresContext(),
-                                processor,
-                                nsBidiPresUtils::MODE_MEASURE,
-                                nsnull,
-                                0,
-                                &totalWidthCoord);
+    nsBidi bidiEngine;
+    rv = nsBidiPresUtils::ProcessText(textToDraw.get(),
+                                      textToDraw.Length(),
+                                      isRTL ? NSBIDI_RTL : NSBIDI_LTR,
+                                      presShell->GetPresContext(),
+                                      processor,
+                                      nsBidiPresUtils::MODE_MEASURE,
+                                      nsnull,
+                                      0,
+                                      &totalWidthCoord,
+                                      &bidiEngine);
     if (NS_FAILED(rv))
         return rv;
 
@@ -2892,15 +2893,16 @@ nsCanvasRenderingContext2D::DrawOrMeasureText(const nsAString& aRawText,
             ctx->SetOperator(gfxContext::OPERATOR_SOURCE);
             processor.mThebes = ctx;
 
-            rv = bidiUtils->ProcessText(textToDraw.get(),
-                                        textToDraw.Length(),
-                                        isRTL ? NSBIDI_RTL : NSBIDI_LTR,
-                                        presShell->GetPresContext(),
-                                        processor,
-                                        nsBidiPresUtils::MODE_DRAW,
-                                        nsnull,
-                                        0,
-                                        nsnull);
+            rv = nsBidiPresUtils::ProcessText(textToDraw.get(),
+                                              textToDraw.Length(),
+                                              isRTL ? NSBIDI_RTL : NSBIDI_LTR,
+                                              presShell->GetPresContext(),
+                                              processor,
+                                              nsBidiPresUtils::MODE_DRAW,
+                                              nsnull,
+                                              0,
+                                              nsnull,
+                                              &bidiEngine);
             if (NS_FAILED(rv))
                 return rv;
 
@@ -2929,15 +2931,16 @@ nsCanvasRenderingContext2D::DrawOrMeasureText(const nsAString& aRawText,
         ApplyStyle(STYLE_FILL);
     }
 
-    rv = bidiUtils->ProcessText(textToDraw.get(),
-                                textToDraw.Length(),
-                                isRTL ? NSBIDI_RTL : NSBIDI_LTR,
-                                presShell->GetPresContext(),
-                                processor,
-                                nsBidiPresUtils::MODE_DRAW,
-                                nsnull,
-                                0,
-                                nsnull);
+    rv = nsBidiPresUtils::ProcessText(textToDraw.get(),
+                                      textToDraw.Length(),
+                                      isRTL ? NSBIDI_RTL : NSBIDI_LTR,
+                                      presShell->GetPresContext(),
+                                      processor,
+                                      nsBidiPresUtils::MODE_DRAW,
+                                      nsnull,
+                                      0,
+                                      nsnull,
+                                      &bidiEngine);
 
     // this needs to be restored before function can return
     if (doUseIntermediateSurface) {
diff --git a/content/canvas/src/nsCanvasRenderingContext2DAzure.cpp b/content/canvas/src/nsCanvasRenderingContext2DAzure.cpp
index b8fa71535a01..5cabfe086b14 100644
--- a/content/canvas/src/nsCanvasRenderingContext2DAzure.cpp
+++ b/content/canvas/src/nsCanvasRenderingContext2DAzure.cpp
@@ -100,6 +100,7 @@
 
 #include "nsFrameManager.h"
 #include "nsFrameLoader.h"
+#include "nsBidi.h"
 #include "nsBidiPresUtils.h"
 #include "Layers.h"
 #include "CanvasUtils.h"
@@ -1226,6 +1227,8 @@ nsCanvasRenderingContext2DAzure::SetDimensions(PRInt32 width, PRInt32 height)
     mZero = PR_TRUE;
     height = 1;
     width = 1;
+  } else {
+    mZero = PR_FALSE;
   }
 
   // Check that the dimensions are sane
@@ -3194,11 +3197,6 @@ nsCanvasRenderingContext2DAzure::DrawOrMeasureText(const nsAString& aRawText,
 
   nsIDocument* document = presShell->GetDocument();
 
-  nsBidiPresUtils* bidiUtils = presShell->GetPresContext()->GetBidiUtils();
-  if (!bidiUtils) {
-    return NS_ERROR_FAILURE;
-  }
-
   // replace all the whitespace characters with U+0020 SPACE
   nsAutoString textToDraw(aRawText);
   TextReplaceWhitespaceCharacters(textToDraw);
@@ -3249,15 +3247,17 @@ nsCanvasRenderingContext2DAzure::DrawOrMeasureText(const nsAString& aRawText,
 
   // calls bidi algo twice since it needs the full text width and the
   // bounding boxes before rendering anything
-  rv = bidiUtils->ProcessText(textToDraw.get(),
-                              textToDraw.Length(),
-                              isRTL ? NSBIDI_RTL : NSBIDI_LTR,
-                              presShell->GetPresContext(),
-                              processor,
-                              nsBidiPresUtils::MODE_MEASURE,
-                              nsnull,
-                              0,
-                              &totalWidthCoord);
+  nsBidi bidiEngine;
+  rv = nsBidiPresUtils::ProcessText(textToDraw.get(),
+                                textToDraw.Length(),
+                                isRTL ? NSBIDI_RTL : NSBIDI_LTR,
+                                presShell->GetPresContext(),
+                                processor,
+                                nsBidiPresUtils::MODE_MEASURE,
+                                nsnull,
+                                0,
+                                &totalWidthCoord,
+                                &bidiEngine);
   if (NS_FAILED(rv)) {
     return rv;
   }
@@ -3348,15 +3348,16 @@ nsCanvasRenderingContext2DAzure::DrawOrMeasureText(const nsAString& aRawText,
   // don't ever need to measure the bounding box twice
   processor.mDoMeasureBoundingBox = PR_FALSE;
 
-  rv = bidiUtils->ProcessText(textToDraw.get(),
-                              textToDraw.Length(),
-                              isRTL ? NSBIDI_RTL : NSBIDI_LTR,
-                              presShell->GetPresContext(),
-                              processor,
-                              nsBidiPresUtils::MODE_DRAW,
-                              nsnull,
-                              0,
-                              nsnull);
+  rv = nsBidiPresUtils::ProcessText(textToDraw.get(),
+                                    textToDraw.Length(),
+                                    isRTL ? NSBIDI_RTL : NSBIDI_LTR,
+                                    presShell->GetPresContext(),
+                                    processor,
+                                    nsBidiPresUtils::MODE_DRAW,
+                                    nsnull,
+                                    0,
+                                    nsnull,
+                                    &bidiEngine);
 
 
   mTarget->SetTransform(oldTransform);
diff --git a/content/canvas/test/test_canvas.html b/content/canvas/test/test_canvas.html
index 3b4258cf0160..05e9f615a9f9 100644
--- a/content/canvas/test/test_canvas.html
+++ b/content/canvas/test/test_canvas.html
@@ -21392,6 +21392,27 @@ function test_zero_dimensions_imagedata() {
 }
 </script>
 
+<p>Canvas test: getImageData_after_zero_canvas</p>
+<canvas id="c686" width="100" height="100"></canvas>
+<script type="text/javascript">
+function test_getImageData_after_zero_canvas() {
+    var c = document.getElementById("c686");
+    var ctx = c.getContext("2d");
+    ctx.fillStyle = "rgba(0, 0, 0, 1.0)";
+    ctx.fillRect(0, 0, c.width, c.height);
+    var oldimgdata = ctx.getImageData(0, 0, c.width, c.height);
+    c.width = c.height = 0;
+    c.width = c.height = 100;
+    ctx.fillRect(0, 0, c.width, c.height);
+    var imgdata = ctx.getImageData(0, 0, c.width, c.height);
+    var same = false;
+    ok(imgdata.data.length === oldimgdata.data.length, "not the same length");
+    for (var i = 0; i < imgdata.data.length; ++i)
+        same = imgdata.data[i] === oldimgdata.data[i];
+    ok(same, "changing dimensions broke canvas");
+}
+</script>
+
 <script>
 
 function asyncTestsDone() {
@@ -24661,6 +24682,12 @@ function runTests() {
  } catch(e) {
   ok(false, "unexpected exception thrown in: test_zero_dimensions_imagedata");
  }
+ try {
+  test_getImageData_after_zero_canvas();
+ } catch(e) {
+  throw e;
+  ok(false, "unexpected exception thrown in: test_getImageData_after_zero_canvas");
+ }
  try {
   // run this test last since it replaces the getContext method
   test_type_replace();
diff --git a/content/events/src/nsDOMDataTransfer.cpp b/content/events/src/nsDOMDataTransfer.cpp
index 59f90aa16202..59a0fa30c42b 100644
--- a/content/events/src/nsDOMDataTransfer.cpp
+++ b/content/events/src/nsDOMDataTransfer.cpp
@@ -255,7 +255,7 @@ nsDOMDataTransfer::GetFiles(nsIDOMFileList** aFileList)
       if (!file)
         continue;
 
-      nsRefPtr<nsDOMFile> domFile = new nsDOMFile(file);
+      nsRefPtr<nsDOMFileFile> domFile = new nsDOMFileFile(file);
 
       if (!mFiles->Append(domFile))
         return NS_ERROR_FAILURE;
diff --git a/content/html/content/src/nsGenericHTMLElement.cpp b/content/html/content/src/nsGenericHTMLElement.cpp
index 88eee264ba2e..50561f4e7d31 100644
--- a/content/html/content/src/nsGenericHTMLElement.cpp
+++ b/content/html/content/src/nsGenericHTMLElement.cpp
@@ -2103,17 +2103,6 @@ nsGenericHTMLElement::SetAttrHelper(nsIAtom* aAttr, const nsAString& aValue)
   return SetAttr(kNameSpaceID_None, aAttr, aValue, PR_TRUE);
 }
 
-nsresult
-nsGenericHTMLElement::GetStringAttrWithDefault(nsIAtom* aAttr,
-                                               const char* aDefault,
-                                               nsAString& aResult)
-{
-  if (!GetAttr(kNameSpaceID_None, aAttr, aResult)) {
-    CopyASCIItoUTF16(aDefault, aResult);
-  }
-  return NS_OK;
-}
-
 nsresult
 nsGenericHTMLElement::SetBoolAttr(nsIAtom* aAttr, PRBool aValue)
 {
diff --git a/content/html/content/src/nsGenericHTMLElement.h b/content/html/content/src/nsGenericHTMLElement.h
index 5a6603c523cb..c0e6c6d7beec 100644
--- a/content/html/content/src/nsGenericHTMLElement.h
+++ b/content/html/content/src/nsGenericHTMLElement.h
@@ -609,19 +609,6 @@ protected:
    */
   NS_HIDDEN_(nsresult) SetAttrHelper(nsIAtom* aAttr, const nsAString& aValue);
 
-  /**
-   * Helper method for NS_IMPL_STRING_ATTR_DEFAULT_VALUE macro.
-   * Gets the value of an attribute, returns specified default value if the
-   * attribute isn't set. Only works for attributes in null namespace.
-   *
-   * @param aAttr    name of attribute.
-   * @param aDefault default-value to return if attribute isn't set.
-   * @param aResult  result value [out]
-   */
-  NS_HIDDEN_(nsresult) GetStringAttrWithDefault(nsIAtom* aAttr,
-                                                const char* aDefault,
-                                                nsAString& aResult);
-
   /**
    * Helper method for NS_IMPL_BOOL_ATTR macro.
    * Gets value of boolean attribute. Only works for attributes in null
@@ -1084,23 +1071,6 @@ protected:
     return SetAttrHelper(nsGkAtoms::_atom, aValue);                  \
   }
 
-/**
- * A macro to implement the getter and setter for a given string
- * valued content property with a default value.
- * The method uses the generic GetAttr and SetAttr methods.
- */
-#define NS_IMPL_STRING_ATTR_DEFAULT_VALUE(_class, _method, _atom, _default) \
-  NS_IMETHODIMP                                                      \
-  _class::Get##_method(nsAString& aValue)                            \
-  {                                                                  \
-    return GetStringAttrWithDefault(nsGkAtoms::_atom, _default, aValue);\
-  }                                                                  \
-  NS_IMETHODIMP                                                      \
-  _class::Set##_method(const nsAString& aValue)                      \
-  {                                                                  \
-    return SetAttrHelper(nsGkAtoms::_atom, aValue);                \
-  }
-
 /**
  * A macro to implement the getter and setter for a given boolean
  * valued content property. The method uses the generic GetAttr and
diff --git a/content/html/content/src/nsHTMLImageElement.cpp b/content/html/content/src/nsHTMLImageElement.cpp
index 5b1dacd1463c..76d0e78ac07c 100644
--- a/content/html/content/src/nsHTMLImageElement.cpp
+++ b/content/html/content/src/nsHTMLImageElement.cpp
@@ -287,11 +287,13 @@ nsHTMLImageElement::GetWidthHeight()
     }
   }
 
+  NS_ASSERTION(size.width >= 0, "negative width");
+  NS_ASSERTION(size.height >= 0, "negative height");
   return size;
 }
 
 NS_IMETHODIMP
-nsHTMLImageElement::GetHeight(PRInt32* aHeight)
+nsHTMLImageElement::GetHeight(PRUint32* aHeight)
 {
   *aHeight = GetWidthHeight().height;
 
@@ -299,7 +301,7 @@ nsHTMLImageElement::GetHeight(PRInt32* aHeight)
 }
 
 NS_IMETHODIMP
-nsHTMLImageElement::SetHeight(PRInt32 aHeight)
+nsHTMLImageElement::SetHeight(PRUint32 aHeight)
 {
   nsAutoString val;
   val.AppendInt(aHeight);
@@ -309,7 +311,7 @@ nsHTMLImageElement::SetHeight(PRInt32 aHeight)
 }
 
 NS_IMETHODIMP
-nsHTMLImageElement::GetWidth(PRInt32* aWidth)
+nsHTMLImageElement::GetWidth(PRUint32* aWidth)
 {
   *aWidth = GetWidthHeight().width;
 
@@ -317,7 +319,7 @@ nsHTMLImageElement::GetWidth(PRInt32* aWidth)
 }
 
 NS_IMETHODIMP
-nsHTMLImageElement::SetWidth(PRInt32 aWidth)
+nsHTMLImageElement::SetWidth(PRUint32 aWidth)
 {
   nsAutoString val;
   val.AppendInt(aWidth);
@@ -576,7 +578,7 @@ nsHTMLImageElement::Initialize(nsISupports* aOwner, JSContext* aContext,
 }
 
 NS_IMETHODIMP
-nsHTMLImageElement::GetNaturalHeight(PRInt32* aNaturalHeight)
+nsHTMLImageElement::GetNaturalHeight(PRUint32* aNaturalHeight)
 {
   NS_ENSURE_ARG_POINTER(aNaturalHeight);
 
@@ -592,12 +594,15 @@ nsHTMLImageElement::GetNaturalHeight(PRInt32* aNaturalHeight)
     return NS_OK;
   }
 
-  image->GetHeight(aNaturalHeight);
+  PRInt32 height;
+  if (NS_SUCCEEDED(image->GetHeight(&height))) {
+    *aNaturalHeight = height;
+  }
   return NS_OK;
 }
 
 NS_IMETHODIMP
-nsHTMLImageElement::GetNaturalWidth(PRInt32* aNaturalWidth)
+nsHTMLImageElement::GetNaturalWidth(PRUint32* aNaturalWidth)
 {
   NS_ENSURE_ARG_POINTER(aNaturalWidth);
 
@@ -613,7 +618,10 @@ nsHTMLImageElement::GetNaturalWidth(PRInt32* aNaturalWidth)
     return NS_OK;
   }
 
-  image->GetWidth(aNaturalWidth);
+  PRInt32 width;
+  if (NS_SUCCEEDED(image->GetWidth(&width))) {
+    *aNaturalWidth = width;
+  }
   return NS_OK;
 }
 
diff --git a/content/html/content/src/nsHTMLInputElement.cpp b/content/html/content/src/nsHTMLInputElement.cpp
index b39b8496fdec..fd0177a1c1cf 100644
--- a/content/html/content/src/nsHTMLInputElement.cpp
+++ b/content/html/content/src/nsHTMLInputElement.cpp
@@ -404,7 +404,7 @@ AsyncClickHandler::Run()
         rv = localFile->GetPath(unicodePath);
         if (!unicodePath.IsEmpty()) {
           nsCOMPtr<nsIDOMFile> domFile =
-            do_QueryObject(new nsDOMFile(localFile));
+            do_QueryObject(new nsDOMFileFile(localFile));
           newFiles.AppendObject(domFile);
         }
         if (!prefSaved) {
@@ -424,7 +424,7 @@ AsyncClickHandler::Run()
       rv = localFile->GetPath(unicodePath);
       if (!unicodePath.IsEmpty()) {
         nsCOMPtr<nsIDOMFile> domFile=
-          do_QueryObject(new nsDOMFile(localFile));
+          do_QueryObject(new nsDOMFileFile(localFile));
         newFiles.AppendObject(domFile);
       }
       // Store the last used directory using the content pref service
@@ -1149,7 +1149,7 @@ nsHTMLInputElement::MozSetFileNameArray(const PRUnichar **aFileNames, PRUint32 a
     }
 
     if (file) {
-      nsCOMPtr<nsIDOMFile> domFile = new nsDOMFile(file);
+      nsCOMPtr<nsIDOMFile> domFile = new nsDOMFileFile(file);
       files.AppendObject(domFile);
     } else {
       continue; // Not much we can do if the file doesn't exist
diff --git a/content/html/content/src/nsHTMLMediaElement.cpp b/content/html/content/src/nsHTMLMediaElement.cpp
index cf8a2ec2065d..20dc5b849ec6 100644
--- a/content/html/content/src/nsHTMLMediaElement.cpp
+++ b/content/html/content/src/nsHTMLMediaElement.cpp
@@ -1987,11 +1987,11 @@ void nsHTMLMediaElement::NetworkError()
 
 void nsHTMLMediaElement::DecodeError()
 {
+  if (mDecoder) {
+    mDecoder->Shutdown();
+    mDecoder = nsnull;
+  }
   if (mIsLoadingFromSourceChildren) {
-    if (mDecoder) {
-      mDecoder->Shutdown();
-      mDecoder = nsnull;
-    }
     mError = nsnull;
     if (mSourceLoadCandidate) {
       DispatchAsyncSourceError(mSourceLoadCandidate);
diff --git a/content/html/content/src/nsHTMLTableCellElement.cpp b/content/html/content/src/nsHTMLTableCellElement.cpp
index a22759cd6d61..314d77080ff9 100644
--- a/content/html/content/src/nsHTMLTableCellElement.cpp
+++ b/content/html/content/src/nsHTMLTableCellElement.cpp
@@ -222,7 +222,7 @@ nsHTMLTableCellElement::WalkContentStyleRules(nsRuleWalker* aRuleWalker)
 NS_IMPL_STRING_ATTR(nsHTMLTableCellElement, Abbr, abbr)
 NS_IMPL_STRING_ATTR(nsHTMLTableCellElement, Axis, axis)
 NS_IMPL_STRING_ATTR(nsHTMLTableCellElement, BgColor, bgcolor)
-NS_IMPL_STRING_ATTR_DEFAULT_VALUE(nsHTMLTableCellElement, Ch, _char, ".")
+NS_IMPL_STRING_ATTR(nsHTMLTableCellElement, Ch, _char)
 NS_IMPL_STRING_ATTR(nsHTMLTableCellElement, ChOff, charoff)
 NS_IMPL_INT_ATTR_DEFAULT_VALUE(nsHTMLTableCellElement, ColSpan, colspan, 1)
 NS_IMPL_STRING_ATTR(nsHTMLTableCellElement, Headers, headers)
@@ -230,7 +230,7 @@ NS_IMPL_STRING_ATTR(nsHTMLTableCellElement, Height, height)
 NS_IMPL_BOOL_ATTR(nsHTMLTableCellElement, NoWrap, nowrap)
 NS_IMPL_INT_ATTR_DEFAULT_VALUE(nsHTMLTableCellElement, RowSpan, rowspan, 1)
 NS_IMPL_STRING_ATTR(nsHTMLTableCellElement, Scope, scope)
-NS_IMPL_STRING_ATTR_DEFAULT_VALUE(nsHTMLTableCellElement, VAlign, valign, "middle")
+NS_IMPL_STRING_ATTR(nsHTMLTableCellElement, VAlign, valign)
 NS_IMPL_STRING_ATTR(nsHTMLTableCellElement, Width, width)
 
 
diff --git a/content/html/content/src/nsHTMLTableColElement.cpp b/content/html/content/src/nsHTMLTableColElement.cpp
index 90b6dc7706c9..bb645ba5c38c 100644
--- a/content/html/content/src/nsHTMLTableColElement.cpp
+++ b/content/html/content/src/nsHTMLTableColElement.cpp
@@ -111,11 +111,11 @@ NS_HTML_CONTENT_INTERFACE_TABLE_TAIL_CLASSINFO(HTMLTableColElement)
 NS_IMPL_ELEMENT_CLONE(nsHTMLTableColElement)
 
 
-NS_IMPL_STRING_ATTR_DEFAULT_VALUE(nsHTMLTableColElement, Align, align, "left")
-NS_IMPL_STRING_ATTR_DEFAULT_VALUE(nsHTMLTableColElement, Ch, _char, ".")
+NS_IMPL_STRING_ATTR(nsHTMLTableColElement, Align, align)
+NS_IMPL_STRING_ATTR(nsHTMLTableColElement, Ch, _char)
 NS_IMPL_STRING_ATTR(nsHTMLTableColElement, ChOff, charoff)
 NS_IMPL_INT_ATTR_DEFAULT_VALUE(nsHTMLTableColElement, Span, span, 1)
-NS_IMPL_STRING_ATTR_DEFAULT_VALUE(nsHTMLTableColElement, VAlign, valign, "middle")
+NS_IMPL_STRING_ATTR(nsHTMLTableColElement, VAlign, valign)
 NS_IMPL_STRING_ATTR(nsHTMLTableColElement, Width, width)
 
 
diff --git a/content/html/content/src/nsHTMLTableElement.cpp b/content/html/content/src/nsHTMLTableElement.cpp
index cd159605d5b2..4d035e8b9eb2 100644
--- a/content/html/content/src/nsHTMLTableElement.cpp
+++ b/content/html/content/src/nsHTMLTableElement.cpp
@@ -965,17 +965,10 @@ nsHTMLTableElement::ParseAttribute(PRInt32 aNamespaceID,
         aAttribute == nsGkAtoms::cellpadding) {
       return aResult.ParseSpecialIntValue(aValue);
     }
-    if (aAttribute == nsGkAtoms::cols) {
+    if (aAttribute == nsGkAtoms::cols ||
+        aAttribute == nsGkAtoms::border) {
       return aResult.ParseIntWithBounds(aValue, 0);
     }
-    if (aAttribute == nsGkAtoms::border) {
-      if (!aResult.ParseIntWithBounds(aValue, 0)) {
-        // XXX this should really be NavQuirks only to allow non numeric value
-        aResult.SetTo(1);
-      }
-
-      return PR_TRUE;
-    }
     if (aAttribute == nsGkAtoms::height) {
       return aResult.ParseSpecialIntValue(aValue);
     }
@@ -983,14 +976,12 @@ nsHTMLTableElement::ParseAttribute(PRInt32 aNamespaceID,
       if (aResult.ParseSpecialIntValue(aValue)) {
         // treat 0 width as auto
         nsAttrValue::ValueType type = aResult.Type();
-        if ((type == nsAttrValue::eInteger &&
-             aResult.GetIntegerValue() == 0) ||
-            (type == nsAttrValue::ePercent &&
-             aResult.GetPercentValue() == 0.0f)) {
-          return PR_FALSE;
-        }
+        return !((type == nsAttrValue::eInteger &&
+                  aResult.GetIntegerValue() == 0) ||
+                 (type == nsAttrValue::ePercent &&
+                  aResult.GetPercentValue() == 0.0f));
       }
-      return PR_TRUE;
+      return PR_FALSE;
     }
     
     if (aAttribute == nsGkAtoms::align) {
diff --git a/content/html/content/src/nsHTMLTableRowElement.cpp b/content/html/content/src/nsHTMLTableRowElement.cpp
index 93e452ad43ee..08672d8da589 100644
--- a/content/html/content/src/nsHTMLTableRowElement.cpp
+++ b/content/html/content/src/nsHTMLTableRowElement.cpp
@@ -359,11 +359,11 @@ nsHTMLTableRowElement::DeleteCell(PRInt32 aValue)
   return RemoveChild(cell, getter_AddRefs(retChild));
 }
 
-NS_IMPL_STRING_ATTR_DEFAULT_VALUE(nsHTMLTableRowElement, Align, align, "left")
+NS_IMPL_STRING_ATTR(nsHTMLTableRowElement, Align, align)
 NS_IMPL_STRING_ATTR(nsHTMLTableRowElement, BgColor, bgcolor)
-NS_IMPL_STRING_ATTR_DEFAULT_VALUE(nsHTMLTableRowElement, Ch, _char, ".")
+NS_IMPL_STRING_ATTR(nsHTMLTableRowElement, Ch, _char)
 NS_IMPL_STRING_ATTR(nsHTMLTableRowElement, ChOff, charoff)
-NS_IMPL_STRING_ATTR_DEFAULT_VALUE(nsHTMLTableRowElement, VAlign, valign, "middle")
+NS_IMPL_STRING_ATTR(nsHTMLTableRowElement, VAlign, valign)
 
 
 PRBool
diff --git a/content/html/content/src/nsHTMLTableSectionElement.cpp b/content/html/content/src/nsHTMLTableSectionElement.cpp
index 9b815dc30799..875aad130335 100644
--- a/content/html/content/src/nsHTMLTableSectionElement.cpp
+++ b/content/html/content/src/nsHTMLTableSectionElement.cpp
@@ -120,9 +120,9 @@ NS_HTML_CONTENT_INTERFACE_TABLE_TAIL_CLASSINFO(HTMLTableSectionElement)
 NS_IMPL_ELEMENT_CLONE(nsHTMLTableSectionElement)
 
 
-NS_IMPL_STRING_ATTR_DEFAULT_VALUE(nsHTMLTableSectionElement, Align, align, "left")
-NS_IMPL_STRING_ATTR_DEFAULT_VALUE(nsHTMLTableSectionElement, VAlign, valign, "middle")
-NS_IMPL_STRING_ATTR_DEFAULT_VALUE(nsHTMLTableSectionElement, Ch, _char, ".")
+NS_IMPL_STRING_ATTR(nsHTMLTableSectionElement, Align, align)
+NS_IMPL_STRING_ATTR(nsHTMLTableSectionElement, VAlign, valign)
+NS_IMPL_STRING_ATTR(nsHTMLTableSectionElement, Ch, _char)
 NS_IMPL_STRING_ATTR(nsHTMLTableSectionElement, ChOff, charoff)
 
 
diff --git a/content/html/content/test/Makefile.in b/content/html/content/test/Makefile.in
index 42a5400351f3..4d90d04193a2 100644
--- a/content/html/content/test/Makefile.in
+++ b/content/html/content/test/Makefile.in
@@ -273,6 +273,7 @@ _TEST_FILES = \
 		test_bug659596.html \
 		test_bug659743.xml \
 		test_bug660663.html \
+		test_bug586786.html \
 		test_restore_from_parser_fragment.html \
 		$(NULL)
 
diff --git a/content/html/content/test/test_bug586786.html b/content/html/content/test/test_bug586786.html
new file mode 100644
index 000000000000..37d8d9ac57bc
--- /dev/null
+++ b/content/html/content/test/test_bug586786.html
@@ -0,0 +1,58 @@
+<!DOCTYPE HTML>
+<html>
+<!--
+https://bugzilla.mozilla.org/show_bug.cgi?id=586786
+-->
+<head>
+  <title>Test for Bug 586786</title>
+  <script type="application/javascript" src="/MochiKit/packed.js"></script>
+  <script type="application/javascript" src="/tests/SimpleTest/SimpleTest.js"></script>
+  <script type="application/javascript" src="reflect.js"></script>
+  <link rel="stylesheet" type="text/css" href="/tests/SimpleTest/test.css"/>
+</head>
+<body>
+<a target="_blank" href="https://bugzilla.mozilla.org/show_bug.cgi?id=586786">Mozilla Bug 586786</a>
+<p id="display"></p>
+<div id="content" style="display: none">
+</div>
+<pre id="test">
+<script type="application/javascript">
+
+/** Test for Bug 586786 **/
+
+var elements = ["col", "colgroup", "tbody", "tfoot", "thead", "tr", "td", "th"];
+
+for(var i = 0; i < elements.length; i++)
+{
+  reflectString({
+    element: document.createElement(elements[i]), 
+    attribute: "align",
+    otherValues: [ "left", "right", "center", "justify", "char" ]
+  });
+  
+  reflectString({
+    element: document.createElement(elements[i]), 
+    attribute: "vAlign",
+    otherValues: [ "top", "middle", "bottom", "baseline" ]
+  });
+  
+  reflectString({
+    element: document.createElement(elements[i]), 
+    attribute: {idl: "ch", content: "char"}
+  });
+}
+
+// table.border, table.width
+reflectString({
+  element: document.createElement("table"), 
+  attribute: "border"
+});
+
+reflectString({
+  element: document.createElement("table"), 
+  attribute: "width"
+});
+</script>
+</pre>
+</body>
+</html>
diff --git a/content/media/nsAudioStream.h b/content/media/nsAudioStream.h
index 192dcc0f06eb..0501b19a3511 100644
--- a/content/media/nsAudioStream.h
+++ b/content/media/nsAudioStream.h
@@ -76,9 +76,11 @@ public:
   // Initialize the audio stream. aNumChannels is the number of audio channels 
   // (1 for mono, 2 for stereo, etc) and aRate is the frequency of the sound 
   // samples (22050, 44100, etc).
+  // Unsafe to call with the decoder monitor held.
   virtual nsresult Init(PRInt32 aNumChannels, PRInt32 aRate, SampleFormat aFormat) = 0;
 
   // Closes the stream. All future use of the stream is an error.
+  // Unsafe to call with the decoder monitor held.
   virtual void Shutdown() = 0;
 
   // Write sound data to the audio hardware.  aBuf is an array of samples in
@@ -98,6 +100,7 @@ public:
   virtual void SetVolume(double aVolume) = 0;
 
   // Block until buffered audio data has been consumed.
+  // Unsafe to call with the decoder monitor held.
   virtual void Drain() = 0;
 
   // Pause audio playback
@@ -119,6 +122,7 @@ public:
 
   // Returns the minimum number of samples which must be written before
   // you can be sure that something will be played.
+  // Unsafe to call with the decoder monitor held.
   virtual PRInt32 GetMinWriteSamples() = 0;
 
 protected:
diff --git a/content/media/nsBuiltinDecoder.cpp b/content/media/nsBuiltinDecoder.cpp
index 7c8d066795b8..c7ea5fb00935 100644
--- a/content/media/nsBuiltinDecoder.cpp
+++ b/content/media/nsBuiltinDecoder.cpp
@@ -46,6 +46,7 @@
 #include "nsTArray.h"
 #include "VideoUtils.h"
 #include "nsBuiltinDecoder.h"
+#include "nsBuiltinDecoderStateMachine.h"
 
 using namespace mozilla;
 
@@ -122,20 +123,6 @@ PRBool nsBuiltinDecoder::Init(nsHTMLMediaElement* aElement)
   return PR_TRUE;
 }
 
-void nsBuiltinDecoder::Stop()
-{
-  NS_ASSERTION(NS_IsMainThread(), "Should be on main thread");
-
-  // The decode thread must die before the state machine can die.
-  // The state machine must die before the reader.
-  // The state machine must die before the decoder.
-  if (mStateMachineThread)
-    mStateMachineThread->Shutdown();
-
-  mStateMachineThread = nsnull;
-  mDecoderStateMachine = nsnull;
-}
-
 void nsBuiltinDecoder::Shutdown()
 {
   NS_ASSERTION(NS_IsMainThread(), "Should be on main thread.");
@@ -161,17 +148,6 @@ void nsBuiltinDecoder::Shutdown()
   ChangeState(PLAY_STATE_SHUTDOWN);
   nsMediaDecoder::Shutdown();
 
-  // We can't destroy mDecoderStateMachine until mStateMachineThread is shut down.
-  // It's unsafe to Shutdown() the decode thread here, as
-  // nsIThread::Shutdown() may run events, such as JS event handlers,
-  // and we could be running at an unsafe time such as during element
-  // destruction.
-  // So we destroy the decoder on the main thread in an asynchronous event.
-  // See bug 468721.
-  nsCOMPtr<nsIRunnable> event =
-    NS_NewRunnableMethod(this, &nsBuiltinDecoder::Stop);
-  NS_DispatchToMainThread(event, NS_DISPATCH_NORMAL);
-
   nsContentUtils::UnregisterShutdownObserver(this);
 }
 
@@ -183,8 +159,8 @@ nsBuiltinDecoder::~nsBuiltinDecoder()
 }
 
 nsresult nsBuiltinDecoder::Load(nsMediaStream* aStream,
-                            nsIStreamListener** aStreamListener,
-                            nsMediaDecoder* aCloneDonor)
+                                nsIStreamListener** aStreamListener,
+                                nsMediaDecoder* aCloneDonor)
 {
   NS_ASSERTION(NS_IsMainThread(), "Should be on main thread.");
   if (aStreamListener) {
@@ -229,7 +205,7 @@ nsresult nsBuiltinDecoder::Load(nsMediaStream* aStream,
 
   ChangeState(PLAY_STATE_LOADING);
 
-  return StartStateMachineThread();
+  return ScheduleStateMachineThread();
 }
 
 nsresult nsBuiltinDecoder::RequestFrameBufferLength(PRUint32 aLength)
@@ -244,23 +220,25 @@ nsresult nsBuiltinDecoder::RequestFrameBufferLength(PRUint32 aLength)
   return res;
 }
 
-nsresult nsBuiltinDecoder::StartStateMachineThread()
+nsresult nsBuiltinDecoder::ScheduleStateMachineThread()
 {
+  NS_ASSERTION(NS_IsMainThread(), "Should be on main thread.");
   NS_ASSERTION(mDecoderStateMachine,
                "Must have state machine to start state machine thread");
-  if (mStateMachineThread) {
+
+  if (mShuttingDown)
     return NS_OK;
-  }
-  nsresult rv = NS_NewThread(getter_AddRefs(mStateMachineThread));
-  NS_ENSURE_SUCCESS(rv, rv);
-  return mStateMachineThread->Dispatch(mDecoderStateMachine, NS_DISPATCH_NORMAL);
+  ReentrantMonitorAutoEnter mon(mReentrantMonitor);
+  nsBuiltinDecoderStateMachine* m =
+    static_cast<nsBuiltinDecoderStateMachine*>(mDecoderStateMachine.get());
+  return m->ScheduleStateMachine();
 }
 
 nsresult nsBuiltinDecoder::Play()
 {
   NS_ASSERTION(NS_IsMainThread(), "Should be on main thread.");
   ReentrantMonitorAutoEnter mon(mReentrantMonitor);
-  nsresult res = StartStateMachineThread();
+  nsresult res = ScheduleStateMachineThread();
   NS_ENSURE_SUCCESS(res,res);
   if (mPlayState == PLAY_STATE_SEEKING) {
     mNextState = PLAY_STATE_PLAYING;
@@ -298,7 +276,7 @@ nsresult nsBuiltinDecoder::Seek(double aTime)
     ChangeState(PLAY_STATE_SEEKING);
   }
 
-  return StartStateMachineThread();
+  return ScheduleStateMachineThread();
 }
 
 nsresult nsBuiltinDecoder::PlaybackRateChanged()
@@ -532,7 +510,7 @@ nsBuiltinDecoder::GetStatistics()
 double nsBuiltinDecoder::ComputePlaybackRate(PRPackedBool* aReliable)
 {
   GetReentrantMonitor().AssertCurrentThreadIn();
-  NS_ASSERTION(NS_IsMainThread() || IsCurrentThread(mStateMachineThread),
+  NS_ASSERTION(NS_IsMainThread() || OnStateMachineThread(),
                "Should be on main or state machine thread.");
 
   PRInt64 length = mStream ? mStream->GetLength() : -1;
@@ -545,7 +523,7 @@ double nsBuiltinDecoder::ComputePlaybackRate(PRPackedBool* aReliable)
 
 void nsBuiltinDecoder::UpdatePlaybackRate()
 {
-  NS_ASSERTION(NS_IsMainThread() || IsCurrentThread(mStateMachineThread),
+  NS_ASSERTION(NS_IsMainThread() || OnStateMachineThread(),
                "Should be on main or state machine thread.");
   GetReentrantMonitor().AssertCurrentThreadIn();
   if (!mStream)
@@ -871,7 +849,9 @@ void nsBuiltinDecoder::Resume(PRBool aForceBuffering)
 
 void nsBuiltinDecoder::StopProgressUpdates()
 {
-  NS_ASSERTION(IsCurrentThread(mStateMachineThread), "Should be on state machine thread.");
+  NS_ASSERTION(OnStateMachineThread() || OnDecodeThread(),
+               "Should be on state machine or decode thread.");
+  GetReentrantMonitor().AssertCurrentThreadIn();
   mIgnoreProgressData = PR_TRUE;
   if (mStream) {
     mStream->SetReadMode(nsMediaCacheStream::MODE_METADATA);
@@ -880,7 +860,9 @@ void nsBuiltinDecoder::StopProgressUpdates()
 
 void nsBuiltinDecoder::StartProgressUpdates()
 {
-  NS_ASSERTION(IsCurrentThread(mStateMachineThread), "Should be on state machine thread.");
+  NS_ASSERTION(OnStateMachineThread() || OnDecodeThread(),
+               "Should be on state machine or decode thread.");
+  GetReentrantMonitor().AssertCurrentThreadIn();
   mIgnoreProgressData = PR_FALSE;
   if (mStream) {
     mStream->SetReadMode(nsMediaCacheStream::MODE_PLAYBACK);
@@ -901,3 +883,7 @@ void nsBuiltinDecoder::UpdatePlaybackOffset(PRInt64 aOffset)
   ReentrantMonitorAutoEnter mon(mReentrantMonitor);
   mPlaybackPosition = NS_MAX(aOffset, mPlaybackPosition);
 }
+
+PRBool nsBuiltinDecoder::OnStateMachineThread() const {
+  return IsCurrentThread(nsBuiltinDecoderStateMachine::GetStateMachineThread());
+}
diff --git a/content/media/nsBuiltinDecoder.h b/content/media/nsBuiltinDecoder.h
index ea702c12c9a1..1bdc75dee6d3 100644
--- a/content/media/nsBuiltinDecoder.h
+++ b/content/media/nsBuiltinDecoder.h
@@ -37,24 +37,28 @@
  *
  * ***** END LICENSE BLOCK ***** */
 /*
-Each video element based on nsBuiltinDecoder has at least one thread
-dedicated to decoding video.
+Each video element based on nsBuiltinDecoder has a state machine to manage
+its play state and keep the current frame up to date. All state machines
+share time in a single shared thread. Each decoder also has one thread
+dedicated to decoding audio and video data. This thread is shutdown when
+playback is paused. Each decoder also has a thread to push decoded audio
+to the hardware. This thread is not created until playback starts, but
+currently is not destroyed when paused, only when playback ends.
 
-This thread (called the state machine thread owns the resources for
-downloading and reading the media file. nsDecoderStateMachine is the
-class that needs to be implemented and it gets run on the state
-machine thread.
+The decoder owns the resources for downloading the media file, and the
+high level state. It holds an owning reference to the state machine
+(a subclass of nsDecoderStateMachine; nsBuiltinDecoderStateMachine) that
+owns all the resources related to decoding data, and manages the low level
+decoding operations and A/V sync. 
 
-The state machine thread has one event that is dispatched to it (the
-implementation of nsDecoderStateMachine) and that event runs for the
-lifetime of the playback of the resource. State shared between threads
-is synchronised with the main thread via a monitor held by the
-nsBuiltinDecoder object.
-
-The state machine thread event consist of a Run method which is an
-infinite loop that performs the decoding operation and checks the
-state that the state machine is in and processes operations on that
-state.
+Each state machine runs on the shared state machine thread. Every time some
+action is required for a state machine, it is scheduled to run on the shared
+the state machine thread. The state machine runs one "cycle" on the state
+machine thread, and then returns. If necessary, it will schedule itself to
+run again in future. While running this cycle, it must not block the
+thread, as other state machines' events may need to run. State shared
+between a state machine's threads is synchronised via the monitor owned
+by its nsBuiltinDecoder object.
 
 The Main thread controls the decode state machine by setting the value
 of a mPlayState variable and notifying on the monitor based on the
@@ -85,25 +89,37 @@ SHUTDOWN
 State transition occurs when the Media Element calls the Play, Seek,
 etc methods on the nsBuiltinDecoder object. When the transition
 occurs nsBuiltinDecoder then calls the methods on the decoder state
-machine object to cause it to behave appropriate to the play state.
+machine object to cause it to behave as required by the play state.
+State transitions will likely schedule the state machine to run to
+affect the change.
 
 An implementation of the nsDecoderStateMachine class is the event
-that gets dispatched to the state machine thread. It has the following states:
+that gets dispatched to the state machine thread. Each time the event is run,
+the state machine must cycle the state machine once, and then return.
+
+The state machine has the following states:
 
 DECODING_METADATA
   The media headers are being loaded, and things like framerate, etc are
   being determined, and the first frame of audio/video data is being decoded.
 DECODING
-  The decode and audio threads are started and video frames displayed at
-  the required time. 
+  The decode has started. If the PlayState is PLAYING, the decode thread
+  should be alive and decoding video and audio frame, the audio thread
+  should be playing audio, and the state machine should run periodically
+  to update the video frames being displayed.
 SEEKING
-  A seek operation is in progress.
+  A seek operation is in progress. The decode thread should be seeking.
 BUFFERING
-  Decoding is paused while data is buffered for smooth playback.
+  Decoding is paused while data is buffered for smooth playback. If playback
+  is paused (PlayState transitions to PAUSED) we'll destory the decode thread.
 COMPLETED
-  The resource has completed decoding, but not finished playback. 
+  The resource has completed decoding, but possibly not finished playback.
+  The decode thread will be destroyed. Once playback finished, the audio
+  thread will also be destroyed.
 SHUTDOWN
-  The decoder object is about to be destroyed.
+  The decoder object and its state machine are about to be destroyed.
+  Once the last state machine has been destroyed, the shared state machine
+  thread will also be destroyed. It will be recreated later if needed.
 
 The following result in state transitions.
 
@@ -157,41 +173,41 @@ player SHUTDOWN  decoder SHUTDOWN
 The general sequence of events is:
 
 1) The video element calls Load on nsMediaDecoder. This creates the
-   state machine thread and starts the channel for downloading the
-   file. It instantiates and starts the nsDecoderStateMachine. The
+   state machine and starts the channel for downloading the
+   file. It instantiates and schedules the nsDecoderStateMachine. The
    high level LOADING state is entered, which results in the decode
-   state machine to start decoding metadata. These are the headers
-   that give the video size, framerate, etc.  It returns immediately
-   to the calling video element.
+   thread being created and starting to decode metadata. These are
+   the headers that give the video size, framerate, etc. Load() returns
+   immediately to the calling video element.
 
-2) When the metadata has been loaded by the decode thread it will call
-   a method on the video element object to inform it that this step is
-   done, so it can do the things required by the video specification
-   at this stage. The decoder then continues to decode the first frame
+2) When the metadata has been loaded by the decode thread, the state machine
+   will call a method on the video element object to inform it that this
+   step is done, so it can do the things required by the video specification
+   at this stage. The decode thread then continues to decode the first frame
    of data.
 
-3) When the first frame of data has been successfully decoded it calls
-   a method on the video element object to inform it that this step
-   has been done, once again so it can do the required things by the
-   video specification at this stage.
+3) When the first frame of data has been successfully decoded the state
+   machine calls a method on the video element object to inform it that
+   this step has been done, once again so it can do the required things
+   by the video specification at this stage.
 
    This results in the high level state changing to PLAYING or PAUSED
    depending on any user action that may have occurred.
 
-   The decode thread plays audio and video, if the correct frame time
-   comes around and the decoder play state is PLAYING.
-   
-a/v synchronisation is handled by the nsDecoderStateMachine implementation.
+   While the play state is PLAYING, the decode thread will decode
+   data, and the audio thread will push audio data to the hardware to
+   be played. The state machine will run periodically on the shared
+   state machine thread to ensure video frames are played at the 
+   correct time; i.e. the state machine manages A/V sync.
 
-The Shutdown method on nsBuiltinDecoder can spin the event loop as it
-waits for threads to complete. Spinning the event loop is a bad thing
-to happen during certain times like destruction of the media
-element. To work around this the Shutdown method does nothing but
-queue an event to the main thread to perform the actual Shutdown. This
-way the shutdown can occur at a safe time.
+The Shutdown method on nsBuiltinDecoder closes the download channel, and
+signals to the state machine that it should shutdown. The state machine
+shuts down asynchronously, and will release the owning reference to the
+state machine once its threads are shutdown.
+
+The owning object of a nsBuiltinDecoder object *MUST* call Shutdown when
+destroying the nsBuiltinDecoder object.
 
-This means the owning object of a nsBuiltinDecoder object *MUST* call
-Shutdown when destroying the nsBuiltinDecoder object.  
 */
 #if !defined(nsBuiltinDecoder_h_)
 #define nsBuiltinDecoder_h_
@@ -269,6 +285,9 @@ public:
   // on the appropriate threads.
   virtual PRBool OnDecodeThread() const = 0;
 
+  // Returns PR_TRUE if the current thread is the state machine thread.
+  virtual PRBool OnStateMachineThread() const = 0;
+
   virtual nsHTMLMediaElement::NextFrameStatus GetNextFrameStatus() = 0;
 
   // Cause state transitions. These methods obtain the decoder monitor
@@ -425,19 +444,13 @@ class nsBuiltinDecoder : public nsMediaDecoder
   // Tells our nsMediaStream to put all loads in the background.
   virtual void MoveLoadsToBackground();
 
-  // Stop the state machine thread and drop references to the thread and
-  // state machine.
-  void Stop();
-
   void AudioAvailable(float* aFrameBuffer, PRUint32 aFrameBufferLength, float aTime);
 
   // Called by the state machine to notify the decoder that the duration
   // has changed.
   void DurationChanged();
 
-  PRBool OnStateMachineThread() {
-    return IsCurrentThread(mStateMachineThread);
-  }
+  PRBool OnStateMachineThread() const;
 
   PRBool OnDecodeThread() const {
     return mDecoderStateMachine->OnDecodeThread();
@@ -567,9 +580,9 @@ public:
   // Notifies the element that decoding has failed.
   void DecodeError();
 
-  // Ensures the state machine thread is running, starting a new one
-  // if necessary.
-  nsresult StartStateMachineThread();
+  // Schedules the state machine to run one cycle on the shared state
+  // machine thread. Main thread only.
+  nsresult ScheduleStateMachineThread();
 
   /******
    * The following members should be accessed with the decoder lock held.
@@ -590,9 +603,6 @@ public:
   // time of the last decoded video frame).
   nsChannelStatistics mPlaybackStatistics;
 
-  // Thread to manage playback state machine.
-  nsCOMPtr<nsIThread> mStateMachineThread;
-
   // The current playback position of the media resource in units of
   // seconds. This is updated approximately at the framerate of the
   // video (if it is a video) or the callback period of the audio.
diff --git a/content/media/nsBuiltinDecoderReader.cpp b/content/media/nsBuiltinDecoderReader.cpp
index f749a77a492a..475f7eff2b77 100644
--- a/content/media/nsBuiltinDecoderReader.cpp
+++ b/content/media/nsBuiltinDecoderReader.cpp
@@ -190,8 +190,7 @@ VideoData* VideoData::Create(nsVideoInfo& aInfo,
 }
 
 nsBuiltinDecoderReader::nsBuiltinDecoderReader(nsBuiltinDecoder* aDecoder)
-  : mReentrantMonitor("media.decoderreader"),
-    mDecoder(aDecoder)
+  : mDecoder(aDecoder)
 {
   MOZ_COUNT_CTOR(nsBuiltinDecoderReader);
 }
@@ -214,7 +213,8 @@ nsresult nsBuiltinDecoderReader::ResetDecode()
 
 VideoData* nsBuiltinDecoderReader::FindStartTime(PRInt64& aOutStartTime)
 {
-  NS_ASSERTION(mDecoder->OnStateMachineThread(), "Should be on state machine thread.");
+  NS_ASSERTION(mDecoder->OnStateMachineThread() || mDecoder->OnDecodeThread(),
+               "Should be on state machine or decode thread.");
 
   // Extract the start times of the bitstreams in order to calculate
   // the duration.
@@ -274,7 +274,6 @@ nsresult nsBuiltinDecoderReader::DecodeToTarget(PRInt64 aTarget)
         PRBool skip = PR_FALSE;
         eof = !DecodeVideoFrame(skip, 0);
         {
-          ReentrantMonitorAutoExit exitReaderMon(mReentrantMonitor);
           ReentrantMonitorAutoEnter decoderMon(mDecoder->GetReentrantMonitor());
           if (mDecoder->GetDecodeState() == nsBuiltinDecoderStateMachine::DECODER_STATE_SHUTDOWN) {
             return NS_ERROR_FAILURE;
@@ -299,7 +298,6 @@ nsresult nsBuiltinDecoderReader::DecodeToTarget(PRInt64 aTarget)
       }
     }
     {
-      ReentrantMonitorAutoExit exitReaderMon(mReentrantMonitor);
       ReentrantMonitorAutoEnter decoderMon(mDecoder->GetReentrantMonitor());
       if (mDecoder->GetDecodeState() == nsBuiltinDecoderStateMachine::DECODER_STATE_SHUTDOWN) {
         return NS_ERROR_FAILURE;
@@ -319,7 +317,6 @@ nsresult nsBuiltinDecoderReader::DecodeToTarget(PRInt64 aTarget)
       while (!eof && mAudioQueue.GetSize() == 0) {
         eof = !DecodeAudioData();
         {
-          ReentrantMonitorAutoExit exitReaderMon(mReentrantMonitor);
           ReentrantMonitorAutoEnter decoderMon(mDecoder->GetReentrantMonitor());
           if (mDecoder->GetDecodeState() == nsBuiltinDecoderStateMachine::DECODER_STATE_SHUTDOWN) {
             return NS_ERROR_FAILURE;
diff --git a/content/media/nsBuiltinDecoderReader.h b/content/media/nsBuiltinDecoderReader.h
index 200e1baea064..25b1c3b1faf3 100644
--- a/content/media/nsBuiltinDecoderReader.h
+++ b/content/media/nsBuiltinDecoderReader.h
@@ -398,12 +398,10 @@ private:
   PRBool mEndOfStream;
 };
 
-// Encapsulates the decoding and reading of media data. Reading can be done
-// on either the state machine thread (when loading and seeking) or on
-// the reader thread (when it's reading and decoding). The reader encapsulates
-// the reading state and maintains it's own monitor to ensure thread safety
-// and correctness. Never hold the nsBuiltinDecoder's monitor when calling into
-// this class.
+// Encapsulates the decoding and reading of media data. Reading can only be
+// done on the decode thread thread. Never hold the decoder monitor when
+// calling into this class. Unless otherwise specified, methods and fields of
+// this class can only be accessed on the decode thread.
 class nsBuiltinDecoderReader : public nsRunnable {
 public:
   typedef mozilla::ReentrantMonitor ReentrantMonitor;
@@ -452,10 +450,12 @@ public:
                         PRInt64 aEndTime,
                         PRInt64 aCurrentTime) = 0;
 
-  // Queue of audio samples. This queue is threadsafe.
+  // Queue of audio samples. This queue is threadsafe, and is accessed from
+  // the audio, decoder, state machine, and main threads.
   MediaQueue<SoundData> mAudioQueue;
 
-  // Queue of video samples. This queue is threadsafe.
+  // Queue of video samples. This queue is threadsafe, and is accessed from
+  // the decoder, state machine, and main threads.
   MediaQueue<VideoData> mVideoQueue;
 
   // Populates aBuffered with the time ranges which are buffered. aStartTime
@@ -492,16 +492,10 @@ protected:
     return DecodeVideoFrame(f, 0);
   }
 
-  // The lock which we hold whenever we read or decode. This ensures the thread
-  // safety of the reader and its data fields.
-  ReentrantMonitor mReentrantMonitor;
-
-  // Reference to the owning decoder object. Do not hold the
-  // reader's monitor when accessing this.
+  // Reference to the owning decoder object.
   nsBuiltinDecoder* mDecoder;
 
-  // Stores presentation info required for playback. The reader's monitor
-  // must be held when accessing this.
+  // Stores presentation info required for playback.
   nsVideoInfo mInfo;
 };
 
diff --git a/content/media/nsBuiltinDecoderStateMachine.cpp b/content/media/nsBuiltinDecoderStateMachine.cpp
index 25968e3641bc..9edc2287d4ce 100644
--- a/content/media/nsBuiltinDecoderStateMachine.cpp
+++ b/content/media/nsBuiltinDecoderStateMachine.cpp
@@ -171,11 +171,32 @@ public:
   const PRUint32 mRate;
 };
 
+static PRUint32 gStateMachineCount = 0;
+static nsIThread* gStateMachineThread = 0;
+
+nsIThread* nsBuiltinDecoderStateMachine::GetStateMachineThread() {
+  return gStateMachineThread;
+}
+
+// Shuts down a thread asynchronously.
+class ShutdownThreadEvent : public nsRunnable 
+{
+public:
+  ShutdownThreadEvent(nsIThread* aThread) : mThread(aThread) {}
+  ~ShutdownThreadEvent() {}
+  NS_IMETHOD Run() {
+    mThread->Shutdown();
+    mThread = nsnull;
+    return NS_OK;
+  }
+private:
+  nsCOMPtr<nsIThread> mThread;
+};
+
 nsBuiltinDecoderStateMachine::nsBuiltinDecoderStateMachine(nsBuiltinDecoder* aDecoder,
                                                            nsBuiltinDecoderReader* aReader) :
   mDecoder(aDecoder),
   mState(DECODER_STATE_DECODING_METADATA),
-  mAudioReentrantMonitor("media.audiostream"),
   mCbCrSize(0),
   mPlayDuration(0),
   mStartTime(-1),
@@ -191,16 +212,45 @@ nsBuiltinDecoderStateMachine::nsBuiltinDecoderStateMachine(nsBuiltinDecoder* aDe
   mPositionChangeQueued(PR_FALSE),
   mAudioCompleted(PR_FALSE),
   mGotDurationFromMetaData(PR_FALSE),
-  mStopDecodeThreads(PR_TRUE),
+  mStopDecodeThread(PR_TRUE),
+  mDecodeThreadIdle(PR_FALSE),
+  mStopAudioThread(PR_TRUE),
   mQuickBuffering(PR_FALSE),
-  mEventManager(aDecoder)
+  mEventManager(aDecoder),
+  mIsRunning(PR_FALSE),
+  mRunAgain(PR_FALSE),
+  mDispatchedRunEvent(PR_FALSE),
+  mDecodeThreadWaiting(PR_FALSE)
 {
   MOZ_COUNT_CTOR(nsBuiltinDecoderStateMachine);
+  NS_ASSERTION(NS_IsMainThread(), "Should be on main thread.");
+  if (gStateMachineCount == 0) {
+    NS_ASSERTION(!gStateMachineThread, "Should have null state machine thread!");
+    nsresult res = NS_NewThread(&gStateMachineThread);
+    NS_ABORT_IF_FALSE(NS_SUCCEEDED(res), "Can't create media state machine thread");
+  }
+  gStateMachineCount++;
 }
 
 nsBuiltinDecoderStateMachine::~nsBuiltinDecoderStateMachine()
 {
+  NS_ASSERTION(NS_IsMainThread(), "Should be on main thread.");
   MOZ_COUNT_DTOR(nsBuiltinDecoderStateMachine);
+  if (mTimer)
+    mTimer->Cancel();
+  mTimer = nsnull;
+  
+  NS_ASSERTION(NS_IsMainThread(), "Should be on main thread.");
+  NS_ABORT_IF_FALSE(gStateMachineCount > 0,
+    "State machine ref count must be > 0");
+  gStateMachineCount--;
+  if (gStateMachineCount == 0) {
+    LOG(PR_LOG_DEBUG, ("Destroying media state machine thread"));
+    nsCOMPtr<nsIRunnable> event = new ShutdownThreadEvent(gStateMachineThread);
+    NS_RELEASE(gStateMachineThread);
+    gStateMachineThread = nsnull;
+    NS_DispatchToMainThread(event);
+  }
 }
 
 PRBool nsBuiltinDecoderStateMachine::HasFutureAudio() const {
@@ -231,8 +281,39 @@ PRInt64 nsBuiltinDecoderStateMachine::GetDecodedAudioDuration() {
   return audioDecoded;
 }
 
+void nsBuiltinDecoderStateMachine::DecodeThreadRun()
+{
+  NS_ASSERTION(OnDecodeThread(), "Should be on decode thread.");
+  ReentrantMonitorAutoEnter mon(mDecoder->GetReentrantMonitor());
+
+  if (mState == DECODER_STATE_DECODING_METADATA) {
+    if (NS_FAILED(DecodeMetadata())) {
+      NS_ASSERTION(mState == DECODER_STATE_SHUTDOWN,
+                   "Should be in shutdown state if metadata loading fails.");
+      LOG(PR_LOG_DEBUG, ("Decode metadata failed, shutting down decode thread"));
+    }
+  }
+
+  while (mState != DECODER_STATE_SHUTDOWN &&
+         mState != DECODER_STATE_COMPLETED &&
+         !mStopDecodeThread)
+  {
+    if (mState == DECODER_STATE_DECODING || mState == DECODER_STATE_BUFFERING) {
+      DecodeLoop();
+    } else if (mState == DECODER_STATE_SEEKING) {
+      DecodeSeek();
+    }
+  }
+
+  mDecodeThreadIdle = PR_TRUE;
+  LOG(PR_LOG_DEBUG, ("%p Decode thread finished", mDecoder.get()));
+}
+
 void nsBuiltinDecoderStateMachine::DecodeLoop()
 {
+  LOG(PR_LOG_DEBUG, ("%p Start DecodeLoop()", mDecoder.get()));
+
+  mDecoder->GetReentrantMonitor().AssertCurrentThreadIn();
   NS_ASSERTION(OnDecodeThread(), "Should be on decode thread.");
 
   // We want to "pump" the decode until we've got a few frames/samples decoded
@@ -267,14 +348,11 @@ void nsBuiltinDecoderStateMachine::DecodeLoop()
   MediaQueue<VideoData>& videoQueue = mReader->mVideoQueue;
   MediaQueue<SoundData>& audioQueue = mReader->mAudioQueue;
 
-  ReentrantMonitorAutoEnter mon(mDecoder->GetReentrantMonitor());
-
+  // Main decode loop.
   PRBool videoPlaying = HasVideo();
   PRBool audioPlaying = HasAudio();
-
-  // Main decode loop.
-  while (mState != DECODER_STATE_SHUTDOWN &&
-         !mStopDecodeThreads &&
+  while ((mState == DECODER_STATE_DECODING || mState == DECODER_STATE_BUFFERING) &&
+         !mStopDecodeThread &&
          (videoPlaying || audioPlaying))
   {
     // We don't want to consider skipping to the next keyframe if we've
@@ -310,7 +388,7 @@ void nsBuiltinDecoderStateMachine::DecodeLoop()
 
     {
       skipToNextKeyframe = PR_TRUE;
-      LOG(PR_LOG_DEBUG, ("%p Skipping video decode to the next keyframe", mDecoder));
+      LOG(PR_LOG_DEBUG, ("%p Skipping video decode to the next keyframe", mDecoder.get()));
     }
 
     // Video decode.
@@ -357,8 +435,8 @@ void nsBuiltinDecoderStateMachine::DecodeLoop()
     // ready state, so that DOM events can fire.
     UpdateReadyState();
 
-    if (mState != DECODER_STATE_SHUTDOWN &&
-        !mStopDecodeThreads &&
+    if ((mState == DECODER_STATE_DECODING || mState == DECODER_STATE_BUFFERING) &&
+        !mStopDecodeThread &&
         (videoPlaying || audioPlaying) &&
         (!audioPlaying || (GetDecodedAudioDuration() >= ampleAudioThreshold &&
                            audioQueue.GetSize() > 0))
@@ -375,20 +453,29 @@ void nsBuiltinDecoderStateMachine::DecodeLoop()
       // monitor which will wake us up shortly after we sleep, thus preventing
       // both the decode and audio push threads waiting at the same time.
       // See bug 620326.
-      mon.Wait();
+      mDecodeThreadWaiting = PR_TRUE;
+      if (mDecoder->GetState() != nsBuiltinDecoder::PLAY_STATE_PLAYING) {
+        // We're not playing, and the decode is about to wait. This means
+        // the decode thread may not be needed in future. Signal the state
+        // machine thread to run, so it can decide whether to shutdown the
+        // decode thread.
+        ScheduleStateMachine();
+      }
+      mDecoder->GetReentrantMonitor().Wait();
+      mDecodeThreadWaiting = PR_FALSE;
     }
 
   } // End decode loop.
 
-  if (!mStopDecodeThreads &&
+  if (!mStopDecodeThread &&
       mState != DECODER_STATE_SHUTDOWN &&
       mState != DECODER_STATE_SEEKING)
   {
     mState = DECODER_STATE_COMPLETED;
-    mDecoder->GetReentrantMonitor().NotifyAll();
+    ScheduleStateMachine();
   }
 
-  LOG(PR_LOG_DEBUG, ("%p Shutting down DecodeLoop this=%p", mDecoder, this));
+  LOG(PR_LOG_DEBUG, ("%p Exiting DecodeLoop", mDecoder.get()));
 }
 
 PRBool nsBuiltinDecoderStateMachine::IsPlaying()
@@ -401,7 +488,7 @@ PRBool nsBuiltinDecoderStateMachine::IsPlaying()
 void nsBuiltinDecoderStateMachine::AudioLoop()
 {
   NS_ASSERTION(OnAudioThread(), "Should be on audio thread.");
-  LOG(PR_LOG_DEBUG, ("%p Begun audio thread/loop", mDecoder));
+  LOG(PR_LOG_DEBUG, ("%p Begun audio thread/loop", mDecoder.get()));
   PRInt64 audioDuration = 0;
   PRInt64 audioStartTime = -1;
   PRUint32 channels, rate;
@@ -409,6 +496,7 @@ void nsBuiltinDecoderStateMachine::AudioLoop()
   PRBool setVolume;
   PRInt32 minWriteSamples = -1;
   PRInt64 samplesAtLastSleep = 0;
+
   {
     ReentrantMonitorAutoEnter mon(mDecoder->GetReentrantMonitor());
     mAudioCompleted = PR_FALSE;
@@ -417,6 +505,29 @@ void nsBuiltinDecoderStateMachine::AudioLoop()
     rate = mInfo.mAudioRate;
     NS_ASSERTION(audioStartTime != -1, "Should have audio start time by now");
   }
+
+  // It is unsafe to call some methods of nsAudioStream with the decoder
+  // monitor held, as on Android those methods do a synchronous dispatch to
+  // the main thread. If the audio thread holds the decoder monitor while
+  // it does a synchronous dispatch to the main thread, we can get deadlocks
+  // if the main thread tries to acquire the decoder monitor before the
+  // dispatched event has finished (or even started!) running. Methods which
+  // are unsafe to call with the decoder monitor held are documented as such
+  // in nsAudioStream.h.
+  nsRefPtr<nsAudioStream> audioStream = nsAudioStream::AllocateStream();
+  audioStream->Init(channels, rate, MOZ_SOUND_DATA_FORMAT);
+
+  {
+    // We must hold the monitor while setting mAudioStream or whenever we query
+    // the playback position off the audio thread. This ensures the audio stream
+    // is always alive when we use it off the audio thread. Note that querying
+    // the playback position does not do a synchronous dispatch to the main
+    // thread, so it's safe to call with the decoder monitor held.
+    ReentrantMonitorAutoEnter mon(mDecoder->GetReentrantMonitor());
+    mAudioStream = audioStream;
+    volume = mVolume;
+    mAudioStream->SetVolume(volume);
+  }
   while (1) {
 
     // Wait while we're not playing, and we're not shutting down, or we're
@@ -426,42 +537,45 @@ void nsBuiltinDecoderStateMachine::AudioLoop()
       NS_ASSERTION(mState != DECODER_STATE_DECODING_METADATA,
                    "Should have meta data before audio started playing.");
       while (mState != DECODER_STATE_SHUTDOWN &&
-             !mStopDecodeThreads &&
+             !mStopAudioThread &&
              (!IsPlaying() ||
               mState == DECODER_STATE_BUFFERING ||
               (mReader->mAudioQueue.GetSize() == 0 &&
                !mReader->mAudioQueue.AtEndOfStream())))
       {
+        if (!IsPlaying() && !mAudioStream->IsPaused()) {
+          mAudioStream->Pause();
+        }
         samplesAtLastSleep = audioDuration;
         mon.Wait();
       }
 
       // If we're shutting down, break out and exit the audio thread.
       if (mState == DECODER_STATE_SHUTDOWN ||
-          mStopDecodeThreads ||
+          mStopAudioThread ||
           mReader->mAudioQueue.AtEndOfStream())
       {
         break;
       }
 
-      // We only want to go to the expense of taking the audio monitor and
-      // changing the volume if it's the first time we've entered the loop
-      // (as we must sync the volume in case it's changed since the
-      // nsAudioStream was created) or if the volume has changed.
+      // We only want to go to the expense of changing the volume if
+      // the volume has changed.
       setVolume = volume != mVolume;
       volume = mVolume;
+
+      // Note audio stream IsPaused() does not do synchronous dispatch to the
+      // main thread on Android, so can be called safely with the decoder
+      // monitor held.
+      if (IsPlaying() && mAudioStream->IsPaused()) {
+        mAudioStream->Resume();
+      }
     }
 
-    if (setVolume || minWriteSamples == -1) {
-      ReentrantMonitorAutoEnter audioMon(mAudioReentrantMonitor);
-      if (mAudioStream) {
-        if (setVolume) {
-          mAudioStream->SetVolume(volume);
-        }
-        if (minWriteSamples == -1) {
-          minWriteSamples = mAudioStream->GetMinWriteSamples();
-        }
-      }
+    if (setVolume) {
+      mAudioStream->SetVolume(volume);
+    }
+    if (minWriteSamples == -1) {
+      minWriteSamples = mAudioStream->GetMinWriteSamples();
     }
     NS_ASSERTION(mReader->mAudioQueue.GetSize() > 0,
                  "Should have data to play");
@@ -539,52 +653,53 @@ void nsBuiltinDecoderStateMachine::AudioLoop()
   }
   if (mReader->mAudioQueue.AtEndOfStream() &&
       mState != DECODER_STATE_SHUTDOWN &&
-      !mStopDecodeThreads)
+      !mStopAudioThread)
   {
     // Last sample pushed to audio hardware, wait for the audio to finish,
     // before the audio thread terminates.
-    ReentrantMonitorAutoEnter audioMon(mAudioReentrantMonitor);
-    if (mAudioStream) {
-      PRBool seeking = PR_FALSE;
+    PRBool seeking = PR_FALSE;
+    {
+      ReentrantMonitorAutoEnter mon(mDecoder->GetReentrantMonitor());
       PRInt64 oldPosition = -1;
-
+      PRInt64 position = GetMediaTime();
+      while (oldPosition != position &&
+             mAudioEndTime - position > 0 &&
+             mState != DECODER_STATE_SEEKING &&
+             mState != DECODER_STATE_SHUTDOWN)
       {
-        ReentrantMonitorAutoExit audioExit(mAudioReentrantMonitor);
-        ReentrantMonitorAutoEnter mon(mDecoder->GetReentrantMonitor());
-        PRInt64 position = GetMediaTime();
-        while (oldPosition != position &&
-               mAudioEndTime - position > 0 &&
-               mState != DECODER_STATE_SEEKING &&
-               mState != DECODER_STATE_SHUTDOWN)
-        {
-          const PRInt64 DRAIN_BLOCK_USECS = 100000;
-          Wait(NS_MIN(mAudioEndTime - position, DRAIN_BLOCK_USECS));
-          oldPosition = position;
-          position = GetMediaTime();
-        }
-        if (mState == DECODER_STATE_SEEKING) {
-          seeking = PR_TRUE;
-        }
-      }
-
-      if (!seeking && mAudioStream && !mAudioStream->IsPaused()) {
-        mAudioStream->Drain();
-
-        // Fire one last event for any extra samples that didn't fill a framebuffer.
-        mEventManager.Drain(mAudioEndTime);
+        const PRInt64 DRAIN_BLOCK_USECS = 100000;
+        Wait(NS_MIN(mAudioEndTime - position, DRAIN_BLOCK_USECS));
+        oldPosition = position;
+        position = GetMediaTime();
       }
+      seeking = mState == DECODER_STATE_SEEKING;
+    }
+
+    if (!seeking && !mAudioStream->IsPaused()) {
+      mAudioStream->Drain();
+      // Fire one last event for any extra samples that didn't fill a framebuffer.
+      mEventManager.Drain(mAudioEndTime);
     }
-    LOG(PR_LOG_DEBUG, ("%p Reached audio stream end.", mDecoder));
   }
+  LOG(PR_LOG_DEBUG, ("%p Reached audio stream end.", mDecoder.get()));
   {
+    // Must hold lock while anulling the audio stream to prevent
+    // state machine thread trying to use it while we're destroying it.
     ReentrantMonitorAutoEnter mon(mDecoder->GetReentrantMonitor());
+    mAudioStream = nsnull;
+    mEventManager.Clear();
     mAudioCompleted = PR_TRUE;
     UpdateReadyState();
-    // Kick the decode and state machine threads; they may be sleeping waiting
-    // for this to finish.
+    // Kick the decode thread; it may be sleeping waiting for this to finish.
     mDecoder->GetReentrantMonitor().NotifyAll();
   }
-  LOG(PR_LOG_DEBUG, ("%p Audio stream finished playing, audio thread exit", mDecoder));
+
+  // Must not hold the decoder monitor while we shutdown the audio stream, as
+  // it makes a synchronous dispatch on Android.
+  audioStream->Shutdown();
+  audioStream = nsnull;
+
+  LOG(PR_LOG_DEBUG, ("%p Audio stream finished playing, audio thread exit", mDecoder.get()));
 }
 
 PRUint32 nsBuiltinDecoderStateMachine::PlaySilence(PRUint32 aSamples,
@@ -592,12 +707,8 @@ PRUint32 nsBuiltinDecoderStateMachine::PlaySilence(PRUint32 aSamples,
                                                    PRUint64 aSampleOffset)
 
 {
-  ReentrantMonitorAutoEnter audioMon(mAudioReentrantMonitor);
-  if (!mAudioStream || mAudioStream->IsPaused()) {
-    // The state machine has paused since we've released the decoder
-    // monitor and acquired the audio monitor. Don't write any audio.
-    return 0;
-  }
+  NS_ASSERTION(OnAudioThread(), "Only call on audio thread.");
+  NS_ASSERTION(!mAudioStream->IsPaused(), "Don't play when paused");
   PRUint32 maxSamples = SILENCE_BYTES_CHUNK / aChannels;
   PRUint32 samples = NS_MIN(aSamples, maxSamples);
   PRUint32 numValues = samples * aChannels;
@@ -613,6 +724,8 @@ PRUint32 nsBuiltinDecoderStateMachine::PlaySilence(PRUint32 aSamples,
 PRUint32 nsBuiltinDecoderStateMachine::PlayFromAudioQueue(PRUint64 aSampleOffset,
                                                           PRUint32 aChannels)
 {
+  NS_ASSERTION(OnAudioThread(), "Only call on audio thread.");
+  NS_ASSERTION(!mAudioStream->IsPaused(), "Don't play when paused");
   nsAutoPtr<SoundData> sound(mReader->mAudioQueue.PopFront());
   {
     ReentrantMonitorAutoEnter mon(mDecoder->GetReentrantMonitor());
@@ -623,34 +736,28 @@ PRUint32 nsBuiltinDecoderStateMachine::PlayFromAudioQueue(PRUint64 aSampleOffset
   }
   PRInt64 offset = -1;
   PRUint32 samples = 0;
-  {
-    ReentrantMonitorAutoEnter audioMon(mAudioReentrantMonitor);
-    if (!mAudioStream) {
-      return 0;
-    }
-    // The state machine could have paused since we've released the decoder
-    // monitor and acquired the audio monitor. Rather than acquire both
-    // monitors, the audio stream also maintains whether its paused or not.
-    // This prevents us from doing a blocking write while holding the audio
-    // monitor while paused; we would block, and the state machine won't be
-    // able to acquire the audio monitor in order to resume or destroy the
-    // audio stream.
-    if (!mAudioStream->IsPaused()) {
-      mAudioStream->Write(sound->mAudioData,
-                          sound->AudioDataLength(),
-                          PR_TRUE);
+  // The state machine could have paused since we've released the decoder
+  // monitor and acquired the audio monitor. Rather than acquire both
+  // monitors, the audio stream also maintains whether its paused or not.
+  // This prevents us from doing a blocking write while holding the audio
+  // monitor while paused; we would block, and the state machine won't be
+  // able to acquire the audio monitor in order to resume or destroy the
+  // audio stream.
+  if (!mAudioStream->IsPaused()) {
+    mAudioStream->Write(sound->mAudioData,
+                        sound->AudioDataLength(),
+                        PR_TRUE);
 
-      offset = sound->mOffset;
-      samples = sound->mSamples;
+    offset = sound->mOffset;
+    samples = sound->mSamples;
 
-      // Dispatch events to the DOM for the audio just written.
-      mEventManager.QueueWrittenAudioData(sound->mAudioData.get(),
-                                          sound->AudioDataLength(),
-                                          (aSampleOffset + samples) * aChannels);
-    } else {
-      mReader->mAudioQueue.PushFront(sound);
-      sound.forget();
-    }
+    // Dispatch events to the DOM for the audio just written.
+    mEventManager.QueueWrittenAudioData(sound->mAudioData.get(),
+                                        sound->AudioDataLength(),
+                                        (aSampleOffset + samples) * aChannels);
+  } else {
+    mReader->mAudioQueue.PushFront(sound);
+    sound.forget();
   }
   if (offset != -1) {
     mDecoder->UpdatePlaybackOffset(offset);
@@ -667,9 +774,11 @@ nsresult nsBuiltinDecoderStateMachine::Init(nsDecoderStateMachine* aCloneDonor)
   return mReader->Init(cloneReader);
 }
 
-void nsBuiltinDecoderStateMachine::StopPlayback(eStopMode aMode)
+void nsBuiltinDecoderStateMachine::StopPlayback()
 {
-  NS_ASSERTION(IsCurrentThread(mDecoder->mStateMachineThread),
+  LOG(PR_LOG_DEBUG, ("%p StopPlayback()", mDecoder.get()));
+
+  NS_ASSERTION(OnStateMachineThread() || OnDecodeThread(),
                "Should be on state machine thread.");
   mDecoder->GetReentrantMonitor().AssertCurrentThreadIn();
 
@@ -684,55 +793,32 @@ void nsBuiltinDecoderStateMachine::StopPlayback(eStopMode aMode)
     mPlayDuration += DurationToUsecs(TimeStamp::Now() - mPlayStartTime);
     mPlayStartTime = TimeStamp();
   }
-  if (HasAudio()) {
-    ReentrantMonitorAutoExit exitMon(mDecoder->GetReentrantMonitor());
-    ReentrantMonitorAutoEnter audioMon(mAudioReentrantMonitor);
-    if (mAudioStream) {
-      if (aMode == AUDIO_PAUSE) {
-        mAudioStream->Pause();
-      } else if (aMode == AUDIO_SHUTDOWN) {
-        mAudioStream->Shutdown();
-        mAudioStream = nsnull;
-        mEventManager.Clear();
-      }
-    }
-  }
+  // Notify the audio thread, so that it notices that we've stopped playing,
+  // so it can pause audio playback.
+  mDecoder->GetReentrantMonitor().NotifyAll();
+  NS_ASSERTION(!IsPlaying(), "Should report not playing at end of StopPlayback()");
 }
 
 void nsBuiltinDecoderStateMachine::StartPlayback()
 {
-  NS_ASSERTION(IsCurrentThread(mDecoder->mStateMachineThread),
-               "Should be on state machine thread.");
+  LOG(PR_LOG_DEBUG, ("%p StartPlayback()", mDecoder.get()));
+
   NS_ASSERTION(!IsPlaying(), "Shouldn't be playing when StartPlayback() is called");
   mDecoder->GetReentrantMonitor().AssertCurrentThreadIn();
-  LOG(PR_LOG_DEBUG, ("%p StartPlayback", mDecoder));
+  LOG(PR_LOG_DEBUG, ("%p StartPlayback", mDecoder.get()));
   mDecoder->mPlaybackStatistics.Start(TimeStamp::Now());
-  if (HasAudio()) {
-    PRInt32 rate = mInfo.mAudioRate;
-    PRInt32 channels = mInfo.mAudioChannels;
-
-    {
-      ReentrantMonitorAutoExit exitMon(mDecoder->GetReentrantMonitor());
-      ReentrantMonitorAutoEnter audioMon(mAudioReentrantMonitor);
-      if (mAudioStream) {
-        // We have an audiostream, so it must have been paused the last time
-        // StopPlayback() was called.
-        mAudioStream->Resume();
-      } else {
-        // No audiostream, create one.
-        mAudioStream = nsAudioStream::AllocateStream();
-        mAudioStream->Init(channels, rate, MOZ_SOUND_DATA_FORMAT);
-        mAudioStream->SetVolume(mVolume);
-      }
-    }
-  }
   mPlayStartTime = TimeStamp::Now();
+
+  NS_ASSERTION(IsPlaying(), "Should report playing by end of StartPlayback()");
+  if (NS_FAILED(StartAudioThread())) {
+    NS_WARNING("Failed to create audio thread"); 
+  }
   mDecoder->GetReentrantMonitor().NotifyAll();
 }
 
 void nsBuiltinDecoderStateMachine::UpdatePlaybackPositionInternal(PRInt64 aTime)
 {
-  NS_ASSERTION(IsCurrentThread(mDecoder->mStateMachineThread),
+  NS_ASSERTION(OnStateMachineThread() || OnDecodeThread(),
                "Should be on state machine thread.");
   mDecoder->GetReentrantMonitor().AssertCurrentThreadIn();
 
@@ -793,7 +879,7 @@ void nsBuiltinDecoderStateMachine::SetVolume(double volume)
 double nsBuiltinDecoderStateMachine::GetCurrentTime() const
 {
   NS_ASSERTION(NS_IsMainThread() ||
-               mDecoder->OnStateMachineThread() ||
+               OnStateMachineThread() ||
                OnDecodeThread(),
                "Should be on main, decode, or state machine thread.");
 
@@ -811,8 +897,8 @@ PRInt64 nsBuiltinDecoderStateMachine::GetDuration()
 
 void nsBuiltinDecoderStateMachine::SetDuration(PRInt64 aDuration)
 {
-  NS_ASSERTION(NS_IsMainThread() || mDecoder->OnStateMachineThread(),
-    "Should be on main or state machine thread.");
+  NS_ASSERTION(NS_IsMainThread() || OnDecodeThread(),
+               "Should be on main or decode thread.");
   mDecoder->GetReentrantMonitor().AssertCurrentThreadIn();
 
   if (aDuration == -1) {
@@ -829,7 +915,7 @@ void nsBuiltinDecoderStateMachine::SetDuration(PRInt64 aDuration)
 
 void nsBuiltinDecoderStateMachine::SetEndTime(PRInt64 aEndTime)
 {
-  NS_ASSERTION(OnStateMachineThread(), "Should be on state machine thread");
+  NS_ASSERTION(OnDecodeThread(), "Should be on decode thread");
   mDecoder->GetReentrantMonitor().AssertCurrentThreadIn();
 
   mEndTime = aEndTime;
@@ -852,20 +938,22 @@ void nsBuiltinDecoderStateMachine::Shutdown()
 
   // Change state before issuing shutdown request to threads so those
   // threads can start exiting cleanly during the Shutdown call.
-  LOG(PR_LOG_DEBUG, ("%p Changed state to SHUTDOWN", mDecoder));
+  LOG(PR_LOG_DEBUG, ("%p Changed state to SHUTDOWN", mDecoder.get()));
+  ScheduleStateMachine();
   mState = DECODER_STATE_SHUTDOWN;
   mDecoder->GetReentrantMonitor().NotifyAll();
 }
 
 void nsBuiltinDecoderStateMachine::StartDecoding()
 {
-  NS_ASSERTION(IsCurrentThread(mDecoder->mStateMachineThread),
-               "Should be on state machine thread.");
+  NS_ASSERTION(OnStateMachineThread() || OnDecodeThread(),
+               "Should be on state machine or decode thread.");
   ReentrantMonitorAutoEnter mon(mDecoder->GetReentrantMonitor());
   if (mState != DECODER_STATE_DECODING) {
     mDecodeStartTime = TimeStamp::Now();
   }
   mState = DECODER_STATE_DECODING;
+  ScheduleStateMachine();
 }
 
 void nsBuiltinDecoderStateMachine::Play()
@@ -876,17 +964,16 @@ void nsBuiltinDecoderStateMachine::Play()
   // when the state machine notices the decoder's state change to PLAYING.
   ReentrantMonitorAutoEnter mon(mDecoder->GetReentrantMonitor());
   if (mState == DECODER_STATE_BUFFERING) {
-    LOG(PR_LOG_DEBUG, ("%p Changed state from BUFFERING to DECODING", mDecoder));
+    LOG(PR_LOG_DEBUG, ("%p Changed state from BUFFERING to DECODING", mDecoder.get()));
     mState = DECODER_STATE_DECODING;
     mDecodeStartTime = TimeStamp::Now();
-    mDecoder->GetReentrantMonitor().NotifyAll();
   }
+  ScheduleStateMachine();
 }
 
 void nsBuiltinDecoderStateMachine::ResetPlayback()
 {
-  NS_ASSERTION(IsCurrentThread(mDecoder->mStateMachineThread),
-               "Should be on state machine thread.");
+  NS_ASSERTION(OnDecodeThread(), "Should be on decode thread.");
   mVideoFrameEndTime = -1;
   mAudioStartTime = -1;
   mAudioEndTime = -1;
@@ -918,25 +1005,35 @@ void nsBuiltinDecoderStateMachine::Seek(double aTime)
   NS_ASSERTION(mEndTime != -1, "Should know end time by now");
   mSeekTime = NS_MIN(mSeekTime, mEndTime);
   mSeekTime = NS_MAX(mStartTime, mSeekTime);
-  LOG(PR_LOG_DEBUG, ("%p Changed state to SEEKING (to %f)", mDecoder, aTime));
+  LOG(PR_LOG_DEBUG, ("%p Changed state to SEEKING (to %f)", mDecoder.get(), aTime));
   mState = DECODER_STATE_SEEKING;
+  ScheduleStateMachine();
 }
 
-void nsBuiltinDecoderStateMachine::StopDecodeThreads()
+void nsBuiltinDecoderStateMachine::StopDecodeThread()
 {
-  NS_ASSERTION(IsCurrentThread(mDecoder->mStateMachineThread),
-               "Should be on state machine thread.");
+  NS_ASSERTION(OnStateMachineThread(), "Should be on state machine thread.");
   mDecoder->GetReentrantMonitor().AssertCurrentThreadIn();
-  mStopDecodeThreads = PR_TRUE;
+  mStopDecodeThread = PR_TRUE;
   mDecoder->GetReentrantMonitor().NotifyAll();
   if (mDecodeThread) {
+    LOG(PR_LOG_DEBUG, ("%p Shutdown decode thread", mDecoder.get()));
     {
       ReentrantMonitorAutoExit exitMon(mDecoder->GetReentrantMonitor());
       mDecodeThread->Shutdown();
     }
     mDecodeThread = nsnull;
+    mDecodeThreadIdle = PR_FALSE;
   }
+}
+
+void nsBuiltinDecoderStateMachine::StopAudioThread()
+{
+  mDecoder->GetReentrantMonitor().AssertCurrentThreadIn();
+  mStopAudioThread = PR_TRUE;
+  mDecoder->GetReentrantMonitor().NotifyAll();
   if (mAudioThread) {
+    LOG(PR_LOG_DEBUG, ("%p Shutdown audio thread", mDecoder.get()));
     {
       ReentrantMonitorAutoExit exitMon(mDecoder->GetReentrantMonitor());
       mAudioThread->Shutdown();
@@ -946,22 +1043,35 @@ void nsBuiltinDecoderStateMachine::StopDecodeThreads()
 }
 
 nsresult
-nsBuiltinDecoderStateMachine::StartDecodeThreads()
+nsBuiltinDecoderStateMachine::StartDecodeThread()
 {
-  NS_ASSERTION(IsCurrentThread(mDecoder->mStateMachineThread),
-               "Should be on state machine thread.");
+  NS_ASSERTION(OnStateMachineThread(), "Should be on state machine thread.");
   mDecoder->GetReentrantMonitor().AssertCurrentThreadIn();
-  mStopDecodeThreads = PR_FALSE;
-  if (!mDecodeThread && mState < DECODER_STATE_COMPLETED) {
+  mStopDecodeThread = PR_FALSE;
+  if ((mDecodeThread && !mDecodeThreadIdle) || mState >= DECODER_STATE_COMPLETED)
+    return NS_OK;
+
+  if (!mDecodeThread) {
     nsresult rv = NS_NewThread(getter_AddRefs(mDecodeThread));
     if (NS_FAILED(rv)) {
       mState = DECODER_STATE_SHUTDOWN;
       return rv;
     }
-    nsCOMPtr<nsIRunnable> event =
-      NS_NewRunnableMethod(this, &nsBuiltinDecoderStateMachine::DecodeLoop);
-    mDecodeThread->Dispatch(event, NS_DISPATCH_NORMAL);
   }
+  nsCOMPtr<nsIRunnable> event =
+    NS_NewRunnableMethod(this, &nsBuiltinDecoderStateMachine::DecodeThreadRun);
+  mDecodeThread->Dispatch(event, NS_DISPATCH_NORMAL);
+  mDecodeThreadIdle = PR_FALSE;
+  return NS_OK;
+}
+
+nsresult
+nsBuiltinDecoderStateMachine::StartAudioThread()
+{
+  NS_ASSERTION(OnStateMachineThread() || OnDecodeThread(),
+               "Should be on state machine or decode thread.");
+  mDecoder->GetReentrantMonitor().AssertCurrentThreadIn();
+  mStopAudioThread = PR_FALSE;
   if (HasAudio() && !mAudioThread) {
     nsresult rv = NS_NewThread(getter_AddRefs(mAudioThread));
     if (NS_FAILED(rv)) {
@@ -1047,310 +1157,410 @@ void nsBuiltinDecoderStateMachine::SetFrameBufferLength(PRUint32 aLength)
   mEventManager.SetSignalBufferLength(aLength);
 }
 
-nsresult nsBuiltinDecoderStateMachine::Run()
+nsresult nsBuiltinDecoderStateMachine::DecodeMetadata()
 {
-  NS_ASSERTION(IsCurrentThread(mDecoder->mStateMachineThread),
-               "Should be on state machine thread.");
+  NS_ASSERTION(OnDecodeThread(), "Should be on decode thread.");
+  mDecoder->GetReentrantMonitor().AssertCurrentThreadIn();
+  NS_ASSERTION(mState == DECODER_STATE_DECODING_METADATA,
+               "Only call when in metadata decoding state");
+
+  LOG(PR_LOG_DEBUG, ("%p Decoding Media Headers", mDecoder.get()));
+  nsresult res;
+  nsVideoInfo info;
+  {
+    ReentrantMonitorAutoExit exitMon(mDecoder->GetReentrantMonitor());
+    res = mReader->ReadMetadata(&info);
+  }
+  mInfo = info;
+
+  if (NS_FAILED(res) || (!info.mHasVideo && !info.mHasAudio)) {
+    // Dispatch the event to call DecodeError synchronously. This ensures
+    // we're in shutdown state by the time we exit the decode thread.
+    // If we just moved to shutdown state here on the decode thread, we may
+    // cause the state machine to shutdown/free memory without closing its
+    // media stream properly, and we'll get callbacks from the media stream
+    // causing a crash. Note the state machine shutdown joins this decode
+    // thread during shutdown (and other state machines can run on the state
+    // machine thread while the join is waiting), so it's safe to do this
+    // synchronously.
+    nsCOMPtr<nsIRunnable> event =
+      NS_NewRunnableMethod(mDecoder, &nsBuiltinDecoder::DecodeError);
+    ReentrantMonitorAutoExit exitMon(mDecoder->GetReentrantMonitor());
+    NS_DispatchToMainThread(event, NS_DISPATCH_SYNC);
+    return NS_ERROR_FAILURE;
+  }
+  mDecoder->StartProgressUpdates();
+  mGotDurationFromMetaData = (GetDuration() != -1);
+
+  VideoData* videoData = FindStartTime();
+  if (videoData) {
+    ReentrantMonitorAutoExit exitMon(mDecoder->GetReentrantMonitor());
+    RenderVideoFrame(videoData, TimeStamp::Now());
+  }
+
+  if (mState == DECODER_STATE_SHUTDOWN) {
+    return NS_ERROR_FAILURE;
+  }
+
+  NS_ASSERTION(mStartTime != -1, "Must have start time");
+  NS_ASSERTION((!HasVideo() && !HasAudio()) ||
+                !mSeekable || mEndTime != -1,
+                "Active seekable media should have end time");
+  NS_ASSERTION(!mSeekable || GetDuration() != -1, "Seekable media should have duration");
+  LOG(PR_LOG_DEBUG, ("%p Media goes from %lld to %lld (duration %lld) seekable=%d",
+                      mDecoder.get(), mStartTime, mEndTime, GetDuration(), mSeekable));
+
+  // Inform the element that we've loaded the metadata and the first frame,
+  // setting the default framebuffer size for audioavailable events.  Also,
+  // if there is audio, let the MozAudioAvailable event manager know about
+  // the metadata.
+  if (HasAudio()) {
+    mEventManager.Init(mInfo.mAudioChannels, mInfo.mAudioRate);
+    // Set the buffer length at the decoder level to be able, to be able
+    // to retrive the value via media element method. The RequestFrameBufferLength
+    // will call the nsBuiltinDecoderStateMachine::SetFrameBufferLength().
+    PRUint32 frameBufferLength = mInfo.mAudioChannels * FRAMEBUFFER_LENGTH_PER_CHANNEL;
+    mDecoder->RequestFrameBufferLength(frameBufferLength);
+  }
+  nsCOMPtr<nsIRunnable> metadataLoadedEvent =
+    new nsAudioMetadataEventRunner(mDecoder, mInfo.mAudioChannels, mInfo.mAudioRate);
+  NS_DispatchToMainThread(metadataLoadedEvent, NS_DISPATCH_NORMAL);
+
+  if (mState == DECODER_STATE_DECODING_METADATA) {
+    LOG(PR_LOG_DEBUG, ("%p Changed state from DECODING_METADATA to DECODING", mDecoder.get()));
+    StartDecoding();
+  }
+
+  if ((mState == DECODER_STATE_DECODING || mState == DECODER_STATE_COMPLETED) &&
+      mDecoder->GetState() == nsBuiltinDecoder::PLAY_STATE_PLAYING &&
+      !IsPlaying())
+  {
+    StartPlayback();
+  }
+
+  return NS_OK;
+}
+
+void nsBuiltinDecoderStateMachine::DecodeSeek()
+{
+  NS_ASSERTION(OnDecodeThread(), "Should be on decode thread.");
+  mDecoder->GetReentrantMonitor().AssertCurrentThreadIn();
+  NS_ASSERTION(mState == DECODER_STATE_SEEKING,
+               "Only call when in seeking state");
+
+  // During the seek, don't have a lock on the decoder state,
+  // otherwise long seek operations can block the main thread.
+  // The events dispatched to the main thread are SYNC calls.
+  // These calls are made outside of the decode monitor lock so
+  // it is safe for the main thread to makes calls that acquire
+  // the lock since it won't deadlock. We check the state when
+  // acquiring the lock again in case shutdown has occurred
+  // during the time when we didn't have the lock.
+  PRInt64 seekTime = mSeekTime;
+  mDecoder->StopProgressUpdates();
+
+  PRBool currentTimeChanged = false;
+  PRInt64 mediaTime = GetMediaTime();
+  if (mediaTime != seekTime) {
+    currentTimeChanged = true;
+    UpdatePlaybackPositionInternal(seekTime);
+  }
+
+  // SeekingStarted will do a UpdateReadyStateForData which will
+  // inform the element and its users that we have no frames
+  // to display
+  {
+    ReentrantMonitorAutoExit exitMon(mDecoder->GetReentrantMonitor());
+    nsCOMPtr<nsIRunnable> startEvent =
+      NS_NewRunnableMethod(mDecoder, &nsBuiltinDecoder::SeekingStarted);
+    NS_DispatchToMainThread(startEvent, NS_DISPATCH_SYNC);
+  }
+
+  if (currentTimeChanged) {
+    // The seek target is different than the current playback position,
+    // we'll need to seek the playback position, so shutdown our decode
+    // and audio threads.
+    StopPlayback();
+    StopAudioThread();
+    ResetPlayback();
+    nsresult res;
+    {
+      ReentrantMonitorAutoExit exitMon(mDecoder->GetReentrantMonitor());
+      // Now perform the seek. We must not hold the state machine monitor
+      // while we seek, since the seek reads, which could block on I/O.
+      res = mReader->Seek(seekTime,
+                          mStartTime,
+                          mEndTime,
+                          mediaTime);
+    }
+    if (NS_SUCCEEDED(res)) {
+      SoundData* audio = HasAudio() ? mReader->mAudioQueue.PeekFront() : nsnull;
+      NS_ASSERTION(!audio || (audio->mTime <= seekTime &&
+                              seekTime <= audio->mTime + audio->mDuration),
+                    "Seek target should lie inside the first audio block after seek");
+      PRInt64 startTime = (audio && audio->mTime < seekTime) ? audio->mTime : seekTime;
+      mAudioStartTime = startTime;
+      mPlayDuration = startTime - mStartTime;
+      if (HasVideo()) {
+        nsAutoPtr<VideoData> video(mReader->mVideoQueue.PeekFront());
+        if (video) {
+          NS_ASSERTION(video->mTime <= seekTime && seekTime <= video->mEndTime,
+                        "Seek target should lie inside the first frame after seek");
+          {
+            ReentrantMonitorAutoExit exitMon(mDecoder->GetReentrantMonitor());
+            RenderVideoFrame(video, TimeStamp::Now());
+          }
+          mReader->mVideoQueue.PopFront();
+          nsCOMPtr<nsIRunnable> event =
+            NS_NewRunnableMethod(mDecoder, &nsBuiltinDecoder::Invalidate);
+          NS_DispatchToMainThread(event, NS_DISPATCH_NORMAL);
+        }
+      }
+    }
+  }
+  mDecoder->StartProgressUpdates();
+  if (mState == DECODER_STATE_SHUTDOWN)
+    return;
+
+  // Try to decode another frame to detect if we're at the end...
+  LOG(PR_LOG_DEBUG, ("%p Seek completed, mCurrentFrameTime=%lld\n",
+      mDecoder.get(), mCurrentFrameTime));
+
+  // Change state to DECODING or COMPLETED now. SeekingStopped will
+  // call nsBuiltinDecoderStateMachine::Seek to reset our state to SEEKING
+  // if we need to seek again.
+
+  nsCOMPtr<nsIRunnable> stopEvent;
+  if (GetMediaTime() == mEndTime) {
+    LOG(PR_LOG_DEBUG, ("%p Changed state from SEEKING (to %lld) to COMPLETED",
+                        mDecoder.get(), seekTime));
+    stopEvent = NS_NewRunnableMethod(mDecoder, &nsBuiltinDecoder::SeekingStoppedAtEnd);
+    mState = DECODER_STATE_COMPLETED;
+  } else {
+    LOG(PR_LOG_DEBUG, ("%p Changed state from SEEKING (to %lld) to DECODING",
+                        mDecoder.get(), seekTime));
+    stopEvent = NS_NewRunnableMethod(mDecoder, &nsBuiltinDecoder::SeekingStopped);
+    StartDecoding();
+  }
+  {
+    ReentrantMonitorAutoExit exitMon(mDecoder->GetReentrantMonitor());
+    NS_DispatchToMainThread(stopEvent, NS_DISPATCH_SYNC);
+  }
+
+  // Reset quick buffering status. This ensures that if we began the
+  // seek while quick-buffering, we won't bypass quick buffering mode
+  // if we need to buffer after the seek.
+  mQuickBuffering = PR_FALSE;
+
+  ScheduleStateMachine();
+}
+
+// Runnable to dispose of the decoder and state machine on the main thread.
+class nsDecoderDisposeEvent : public nsRunnable {
+public:
+  nsDecoderDisposeEvent(already_AddRefed<nsBuiltinDecoder> aDecoder)
+    : mDecoder(aDecoder) {}
+  NS_IMETHOD Run() {
+    NS_ASSERTION(NS_IsMainThread(), "Must be on main thread.");
+    mDecoder = nsnull;
+    return NS_OK;
+  }
+private:
+  nsRefPtr<nsBuiltinDecoder> mDecoder;
+};
+
+// Runnable which dispatches an event to the main thread to dispose of the
+// decoder and state machine. This runs on the state machine thread after
+// the state machine has shutdown, and all events for that state machine have
+// finished running.
+class nsDispatchDisposeEvent : public nsRunnable {
+public:
+  nsDispatchDisposeEvent(already_AddRefed<nsBuiltinDecoder> aDecoder)
+    : mDecoder(aDecoder) {}
+  NS_IMETHOD Run() {
+    NS_DispatchToMainThread(new nsDecoderDisposeEvent(mDecoder.forget()),
+                            NS_DISPATCH_NORMAL);
+    return NS_OK;
+  }
+private:
+  nsRefPtr<nsBuiltinDecoder> mDecoder;
+};
+
+nsresult nsBuiltinDecoderStateMachine::RunStateMachine()
+{
+  mDecoder->GetReentrantMonitor().AssertCurrentThreadIn();
+
   nsMediaStream* stream = mDecoder->GetCurrentStream();
   NS_ENSURE_TRUE(stream, NS_ERROR_NULL_POINTER);
 
-  while (PR_TRUE) {
-    ReentrantMonitorAutoEnter mon(mDecoder->GetReentrantMonitor());
-    switch (mState) {
-    case DECODER_STATE_SHUTDOWN:
+  switch (mState) {
+    case DECODER_STATE_SHUTDOWN: {
       if (IsPlaying()) {
-        StopPlayback(AUDIO_SHUTDOWN);
+        StopPlayback();
       }
-      StopDecodeThreads();
+      StopAudioThread();
+      StopDecodeThread();
       NS_ASSERTION(mState == DECODER_STATE_SHUTDOWN,
                    "How did we escape from the shutdown state???");
+      // We must daisy-chain these events to destroy the decoder. We must
+      // destroy the decoder on the main thread, but we can't destroy the
+      // decoder while this thread holds the decoder monitor. We can't
+      // dispatch an event to the main thread to destroy the decoder from
+      // here, as the event may run before the dispatch returns, and we
+      // hold the decoder monitor here. We also want to guarantee that the
+      // state machine is destroyed on the main thread, and so the
+      // event runner running this function (which holds a reference to the
+      // state machine) needs to finish and be released in order to allow
+      // that. So we dispatch an event to run after this event runner has
+      // finished and released its monitor/references. That event then will
+      // dispatch an event to the main thread to release the decoder and
+      // state machine.
+      NS_DispatchToCurrentThread(
+        new nsDispatchDisposeEvent(mDecoder.forget()));
       return NS_OK;
+    }
 
-    case DECODER_STATE_DECODING_METADATA:
+    case DECODER_STATE_DECODING_METADATA: {
+      // Ensure we have a decode thread to decode metadata.
+      return StartDecodeThread();
+    }
+  
+    case DECODER_STATE_DECODING: {
+      if (mDecoder->GetState() != nsBuiltinDecoder::PLAY_STATE_PLAYING &&
+          IsPlaying())
       {
-        LoadMetadata();
-        if (mState == DECODER_STATE_SHUTDOWN) {
-          continue;
-        }
-
-        VideoData* videoData = FindStartTime();
-        if (videoData) {
-          ReentrantMonitorAutoExit exitMon(mDecoder->GetReentrantMonitor());
-          RenderVideoFrame(videoData, TimeStamp::Now());
-        }
-
-        // Start the decode threads, so that we can pre buffer the streams.
-        // and calculate the start time in order to determine the duration.
-        if (NS_FAILED(StartDecodeThreads())) {
-          continue;
-        }
-
-        NS_ASSERTION(mStartTime != -1, "Must have start time");
-        NS_ASSERTION((!HasVideo() && !HasAudio()) ||
-                     !mSeekable || mEndTime != -1,
-                     "Active seekable media should have end time");
-        NS_ASSERTION(!mSeekable || GetDuration() != -1, "Seekable media should have duration");
-        LOG(PR_LOG_DEBUG, ("%p Media goes from %lld to %lld (duration %lld) seekable=%d",
-                           mDecoder, mStartTime, mEndTime, GetDuration(), mSeekable));
-
-        if (mState == DECODER_STATE_SHUTDOWN)
-          continue;
-
-        // Inform the element that we've loaded the metadata and the first frame,
-        // setting the default framebuffer size for audioavailable events.  Also,
-        // if there is audio, let the MozAudioAvailable event manager know about
-        // the metadata.
-        if (HasAudio()) {
-          mEventManager.Init(mInfo.mAudioChannels, mInfo.mAudioRate);
-          // Set the buffer length at the decoder level to be able, to be able
-          // to retrive the value via media element method. The RequestFrameBufferLength
-          // will call the nsBuiltinDecoderStateMachine::SetFrameBufferLength().
-          PRUint32 frameBufferLength = mInfo.mAudioChannels * FRAMEBUFFER_LENGTH_PER_CHANNEL;
-          mDecoder->RequestFrameBufferLength(frameBufferLength);
-        }
-        nsCOMPtr<nsIRunnable> metadataLoadedEvent =
-          new nsAudioMetadataEventRunner(mDecoder, mInfo.mAudioChannels, mInfo.mAudioRate);
-        NS_DispatchToMainThread(metadataLoadedEvent, NS_DISPATCH_NORMAL);
-
-        if (mState == DECODER_STATE_DECODING_METADATA) {
-          LOG(PR_LOG_DEBUG, ("%p Changed state from DECODING_METADATA to DECODING", mDecoder));
-          StartDecoding();
-        }
-
-        // Start playback.
-        if (mDecoder->GetState() == nsBuiltinDecoder::PLAY_STATE_PLAYING) {
-          if (!IsPlaying()) {
-            StartPlayback();
-          }
-        }
+        // We're playing, but the element/decoder is in paused state. Stop
+        // playing! Note we do this before StopDecodeThread() below because
+        // that blocks this state machine's execution, and can cause a
+        // perceptible delay between the pause command, and playback actually
+        // pausing.
+        StopPlayback();
       }
-      break;
 
-    case DECODER_STATE_DECODING:
+      if (IsPausedAndDecoderWaiting()) {
+        // The decode buffers are full, and playback is paused. Shutdown the
+        // decode thread.
+        StopDecodeThread();
+        return NS_OK;
+      }
+
+      // We're playing and/or our decode buffers aren't full. Ensure we have
+      // an active decode thread.
+      if (NS_FAILED(StartDecodeThread())) {
+        NS_WARNING("Failed to start media decode thread!");
+        return NS_ERROR_FAILURE;
+      }
+
+      AdvanceFrame();
+      NS_ASSERTION(mDecoder->GetState() != nsBuiltinDecoder::PLAY_STATE_PLAYING ||
+                   IsStateMachineScheduled(), "Must have timer scheduled");
+      return NS_OK;
+    }
+
+    case DECODER_STATE_BUFFERING: {
+      if (IsPausedAndDecoderWaiting()) {
+        // The decode buffers are full, and playback is paused. Shutdown the
+        // decode thread.
+        StopDecodeThread();
+        return NS_OK;
+      }
+
+      TimeStamp now = TimeStamp::Now();
+      NS_ASSERTION(!mBufferingStart.IsNull(), "Must know buffering start time.");
+
+      // We will remain in the buffering state if we've not decoded enough
+      // data to begin playback, or if we've not downloaded a reasonable
+      // amount of data inside our buffering time.
+      TimeDuration elapsed = now - mBufferingStart;
+      PRBool isLiveStream = mDecoder->GetCurrentStream()->GetLength() == -1;
+      if ((isLiveStream || !mDecoder->CanPlayThrough()) &&
+            elapsed < TimeDuration::FromSeconds(BUFFERING_WAIT) &&
+            (mQuickBuffering ? HasLowDecodedData(QUICK_BUFFERING_LOW_DATA_USECS)
+                            : (GetUndecodedData() < BUFFERING_WAIT * USECS_PER_S)) &&
+            !stream->IsDataCachedToEndOfStream(mDecoder->mDecoderPosition) &&
+            !stream->IsSuspended())
       {
-        if (NS_FAILED(StartDecodeThreads())) {
-          continue;
-        }
+        LOG(PR_LOG_DEBUG,
+            ("%p Buffering: %.3lfs/%ds, timeout in %.3lfs %s",
+              mDecoder.get(),
+              GetUndecodedData() / static_cast<double>(USECS_PER_S),
+              BUFFERING_WAIT,
+              BUFFERING_WAIT - elapsed.ToSeconds(),
+              (mQuickBuffering ? "(quick exit)" : "")));
+        ScheduleStateMachine(USECS_PER_S);
+        return NS_OK;
+      } else {
+        LOG(PR_LOG_DEBUG, ("%p Changed state from BUFFERING to DECODING", mDecoder.get()));
+        LOG(PR_LOG_DEBUG, ("%p Buffered for %.3lfs",
+                            mDecoder.get(),
+                            (now - mBufferingStart).ToSeconds()));
+        StartDecoding();
+      }
 
+      // Notify to allow blocked decoder thread to continue
+      mDecoder->GetReentrantMonitor().NotifyAll();
+      UpdateReadyState();
+      if (mDecoder->GetState() == nsBuiltinDecoder::PLAY_STATE_PLAYING &&
+          !IsPlaying())
+      {
+        StartPlayback();
+      }
+      NS_ASSERTION(IsStateMachineScheduled(), "Must have timer scheduled");
+      return NS_OK;
+    }
+
+    case DECODER_STATE_SEEKING: {
+      // Ensure we have a decode thread to perform the seek.
+     return StartDecodeThread();
+    }
+
+    case DECODER_STATE_COMPLETED: {
+      StopDecodeThread();
+
+      if (mState != DECODER_STATE_COMPLETED) {
+        // While we're waiting for the decode thread to shutdown, we can
+        // change state, for example to seeking or shutdown state.
+        // Whatever changed our state should have scheduled another state
+        // machine run.
+        NS_ASSERTION(IsStateMachineScheduled(), "Must have timer scheduled");
+        return NS_OK;
+      }
+
+      // Play the remaining media. We want to run AdvanceFrame() at least
+      // once to ensure the current playback position is advanced to the
+      // end of the media, and so that we update the readyState.
+      if (mState == DECODER_STATE_COMPLETED &&
+          (mReader->mVideoQueue.GetSize() > 0 ||
+          (HasAudio() && !mAudioCompleted)))
+      {
         AdvanceFrame();
-
-        if (mState != DECODER_STATE_DECODING)
-          continue;
-      }
-      break;
-
-    case DECODER_STATE_SEEKING:
-      {
-        // During the seek, don't have a lock on the decoder state,
-        // otherwise long seek operations can block the main thread.
-        // The events dispatched to the main thread are SYNC calls.
-        // These calls are made outside of the decode monitor lock so
-        // it is safe for the main thread to makes calls that acquire
-        // the lock since it won't deadlock. We check the state when
-        // acquiring the lock again in case shutdown has occurred
-        // during the time when we didn't have the lock.
-        PRInt64 seekTime = mSeekTime;
-        mDecoder->StopProgressUpdates();
-
-        PRBool currentTimeChanged = false;
-        PRInt64 mediaTime = GetMediaTime();
-        if (mediaTime != seekTime) {
-          currentTimeChanged = true;
-          UpdatePlaybackPositionInternal(seekTime);
-        }
-
-        // SeekingStarted will do a UpdateReadyStateForData which will
-        // inform the element and its users that we have no frames
-        // to display
-        {
-          ReentrantMonitorAutoExit exitMon(mDecoder->GetReentrantMonitor());
-          nsCOMPtr<nsIRunnable> startEvent =
-            NS_NewRunnableMethod(mDecoder, &nsBuiltinDecoder::SeekingStarted);
-          NS_DispatchToMainThread(startEvent, NS_DISPATCH_SYNC);
-        }
-
-        if (currentTimeChanged) {
-          // The seek target is different than the current playback position,
-          // we'll need to seek the playback position, so shutdown our decode
-          // and audio threads.
-          StopPlayback(AUDIO_SHUTDOWN);
-          StopDecodeThreads();
-          ResetPlayback();
-          nsresult res;
-          {
-            ReentrantMonitorAutoExit exitMon(mDecoder->GetReentrantMonitor());
-            // Now perform the seek. We must not hold the state machine monitor
-            // while we seek, since the seek decodes.
-            res = mReader->Seek(seekTime,
-                                mStartTime,
-                                mEndTime,
-                                mediaTime);
-          }
-          if (NS_SUCCEEDED(res)){
-            SoundData* audio = HasAudio() ? mReader->mAudioQueue.PeekFront() : nsnull;
-            NS_ASSERTION(!audio || (audio->mTime <= seekTime &&
-                                    seekTime <= audio->mTime + audio->mDuration),
-                         "Seek target should lie inside the first audio block after seek");
-            PRInt64 startTime = (audio && audio->mTime < seekTime) ? audio->mTime : seekTime;
-            mAudioStartTime = startTime;
-            mPlayDuration = startTime - mStartTime;
-            if (HasVideo()) {
-              nsAutoPtr<VideoData> video(mReader->mVideoQueue.PeekFront());
-              if (video) {
-                NS_ASSERTION(video->mTime <= seekTime && seekTime <= video->mEndTime,
-                             "Seek target should lie inside the first frame after seek");
-                {
-                  ReentrantMonitorAutoExit exitMon(mDecoder->GetReentrantMonitor());
-                  RenderVideoFrame(video, TimeStamp::Now());
-                }
-                mReader->mVideoQueue.PopFront();
-                nsCOMPtr<nsIRunnable> event =
-                  NS_NewRunnableMethod(mDecoder, &nsBuiltinDecoder::Invalidate);
-                NS_DispatchToMainThread(event, NS_DISPATCH_NORMAL);
-              }
-            }
-          }
-        }
-        mDecoder->StartProgressUpdates();
-        if (mState == DECODER_STATE_SHUTDOWN)
-          continue;
-
-        // Try to decode another frame to detect if we're at the end...
-        LOG(PR_LOG_DEBUG, ("%p Seek completed, mCurrentFrameTime=%lld\n", mDecoder, mCurrentFrameTime));
-
-        // Change state to DECODING or COMPLETED now. SeekingStopped will
-        // call nsBuiltinDecoderStateMachine::Seek to reset our state to SEEKING
-        // if we need to seek again.
-        
-        nsCOMPtr<nsIRunnable> stopEvent;
-        if (GetMediaTime() == mEndTime) {
-          LOG(PR_LOG_DEBUG, ("%p Changed state from SEEKING (to %lld) to COMPLETED",
-                             mDecoder, seekTime));
-          stopEvent = NS_NewRunnableMethod(mDecoder, &nsBuiltinDecoder::SeekingStoppedAtEnd);
-          mState = DECODER_STATE_COMPLETED;
-        } else {
-          LOG(PR_LOG_DEBUG, ("%p Changed state from SEEKING (to %lld) to DECODING",
-                             mDecoder, seekTime));
-          stopEvent = NS_NewRunnableMethod(mDecoder, &nsBuiltinDecoder::SeekingStopped);
-          StartDecoding();
-        }
-        mDecoder->GetReentrantMonitor().NotifyAll();
-
-        {
-          ReentrantMonitorAutoExit exitMon(mDecoder->GetReentrantMonitor());
-          NS_DispatchToMainThread(stopEvent, NS_DISPATCH_SYNC);
-        }
-
-        // Reset quick buffering status. This ensures that if we began the
-        // seek while quick-buffering, we won't bypass quick buffering mode
-        // if we need to buffer after the seek.
-        mQuickBuffering = PR_FALSE;
-      }
-      break;
-
-    case DECODER_STATE_BUFFERING:
-      {
-        if (IsPlaying()) {
-          StopPlayback(AUDIO_PAUSE);
-          mDecoder->GetReentrantMonitor().NotifyAll();
-        }
-
-        TimeStamp now = TimeStamp::Now();
-        NS_ASSERTION(!mBufferingStart.IsNull(), "Must know buffering start time.");
-
-        // We will remain in the buffering state if we've not decoded enough
-        // data to begin playback, or if we've not downloaded a reasonable
-        // amount of data inside our buffering time.
-        TimeDuration elapsed = now - mBufferingStart;
-        PRBool isLiveStream = mDecoder->GetCurrentStream()->GetLength() == -1;
-        if ((isLiveStream || !mDecoder->CanPlayThrough()) &&
-             elapsed < TimeDuration::FromSeconds(BUFFERING_WAIT) &&
-             (mQuickBuffering ? HasLowDecodedData(QUICK_BUFFERING_LOW_DATA_USECS)
-                              : (GetUndecodedData() < BUFFERING_WAIT * USECS_PER_S)) &&
-             !stream->IsDataCachedToEndOfStream(mDecoder->mDecoderPosition) &&
-             !stream->IsSuspended())
-        {
-          LOG(PR_LOG_DEBUG,
-              ("Buffering: %.3lfs/%ds, timeout in %.3lfs %s",
-               GetUndecodedData() / static_cast<double>(USECS_PER_S),
-               BUFFERING_WAIT,
-               BUFFERING_WAIT - elapsed.ToSeconds(),
-               (mQuickBuffering ? "(quick exit)" : "")));
-          Wait(USECS_PER_S);
-          if (mState == DECODER_STATE_SHUTDOWN)
-            continue;
-        } else {
-          LOG(PR_LOG_DEBUG, ("%p Changed state from BUFFERING to DECODING", mDecoder));
-          LOG(PR_LOG_DEBUG, ("%p Buffered for %.3lfs",
-                             mDecoder,
-                             (now - mBufferingStart).ToSeconds()));
-          StartDecoding();
-        }
-
-        if (mState != DECODER_STATE_BUFFERING) {
-          // Notify to allow blocked decoder thread to continue
-          mDecoder->GetReentrantMonitor().NotifyAll();
-          UpdateReadyState();
-          if (mDecoder->GetState() == nsBuiltinDecoder::PLAY_STATE_PLAYING) {
-            if (!IsPlaying()) {
-              StartPlayback();
-            }
-          }
-        }
-        break;
+        NS_ASSERTION(mDecoder->GetState() != nsBuiltinDecoder::PLAY_STATE_PLAYING ||
+                     IsStateMachineScheduled(),
+                     "Must have timer scheduled");
+        return NS_OK;
       }
 
-    case DECODER_STATE_COMPLETED:
-      {
-        if (NS_FAILED(StartDecodeThreads())) {
-          continue;
-        }
+      // StopPlayback in order to reset the IsPlaying() state so audio
+      // is restarted correctly.
+      StopPlayback();
 
-        // Play the remaining media. We want to run AdvanceFrame() at least
-        // once to ensure the current playback position is advanced to the
-        // end of the media, and so that we update the readyState.
-        do {
-          AdvanceFrame();
-        } while (mState == DECODER_STATE_COMPLETED &&
-                 (mReader->mVideoQueue.GetSize() > 0 ||
-                 (HasAudio() && !mAudioCompleted)));
-
-        if (mAudioStream) {
-          // Close the audio stream so that next time audio is used a new stream
-          // is created. The StopPlayback call also resets the IsPlaying() state
-          // so audio is restarted correctly.
-          StopPlayback(AUDIO_SHUTDOWN);
-        }
-
-        if (mState != DECODER_STATE_COMPLETED)
-          continue;
-
-        LOG(PR_LOG_DEBUG, ("%p Shutting down the state machine thread", mDecoder));
-        StopDecodeThreads();
-
-        if (mDecoder->GetState() == nsBuiltinDecoder::PLAY_STATE_PLAYING) {
-          PRInt64 videoTime = HasVideo() ? mVideoFrameEndTime : 0;
-          PRInt64 clockTime = NS_MAX(mEndTime, NS_MAX(videoTime, GetAudioClock()));
-          UpdatePlaybackPosition(clockTime);
-          {
-            ReentrantMonitorAutoExit exitMon(mDecoder->GetReentrantMonitor());
-            nsCOMPtr<nsIRunnable> event =
-              NS_NewRunnableMethod(mDecoder, &nsBuiltinDecoder::PlaybackEnded);
-            NS_DispatchToMainThread(event, NS_DISPATCH_SYNC);
-          }
-        }
-
-        if (mState == DECODER_STATE_COMPLETED) {
-          // We've finished playback. Shutdown the state machine thread, 
-          // in order to save memory on thread stacks, particuarly on Linux.
-          nsCOMPtr<nsIRunnable> event =
-            new ShutdownThreadEvent(mDecoder->mStateMachineThread);
-          NS_DispatchToMainThread(event, NS_DISPATCH_NORMAL);
-          mDecoder->mStateMachineThread = nsnull;
-          return NS_OK;
-        }
+      if (mState != DECODER_STATE_COMPLETED) {
+        // While we're presenting a frame we can change state. Whatever changed
+        // our state should have scheduled another state machine run.
+        NS_ASSERTION(IsStateMachineScheduled(), "Must have timer scheduled");
+        return NS_OK;
       }
-      break;
+ 
+      StopAudioThread();
+      if (mDecoder->GetState() == nsBuiltinDecoder::PLAY_STATE_PLAYING) {
+        PRInt64 videoTime = HasVideo() ? mVideoFrameEndTime : 0;
+        PRInt64 clockTime = NS_MAX(mEndTime, NS_MAX(videoTime, GetAudioClock()));
+        UpdatePlaybackPosition(clockTime);
+        nsCOMPtr<nsIRunnable> event =
+          NS_NewRunnableMethod(mDecoder, &nsBuiltinDecoder::PlaybackEnded);
+        NS_DispatchToMainThread(event, NS_DISPATCH_NORMAL);
+      }
+      return NS_OK;
     }
   }
 
@@ -1360,7 +1570,8 @@ nsresult nsBuiltinDecoderStateMachine::Run()
 void nsBuiltinDecoderStateMachine::RenderVideoFrame(VideoData* aData,
                                                     TimeStamp aTarget)
 {
-  NS_ASSERTION(IsCurrentThread(mDecoder->mStateMachineThread), "Should be on state machine thread.");
+  NS_ASSERTION(OnStateMachineThread() || OnDecodeThread(),
+               "Should be on state machine or decode thread.");
   mDecoder->GetReentrantMonitor().AssertNotCurrentThreadIn();
 
   if (aData->mDuplicate) {
@@ -1376,167 +1587,162 @@ void nsBuiltinDecoderStateMachine::RenderVideoFrame(VideoData* aData,
 PRInt64
 nsBuiltinDecoderStateMachine::GetAudioClock()
 {
-  NS_ASSERTION(IsCurrentThread(mDecoder->mStateMachineThread), "Should be on state machine thread.");
-  if (!mAudioStream || !HasAudio())
+  NS_ASSERTION(OnStateMachineThread(), "Should be on state machine thread.");
+  mDecoder->GetReentrantMonitor().AssertCurrentThreadIn();
+  if (!HasAudio())
     return -1;
+  // We must hold the decoder monitor while using the audio stream off the
+  // audio thread to ensure that it doesn't get destroyed on the audio thread
+  // while we're using it.
+  if (!mAudioStream) {
+    // Audio thread hasn't played any data yet.
+    return mAudioStartTime;
+  }
+  // Note that querying the playback position does not do a synchronous
+  // dispatch to the main thread on Android, so it's safe to call with
+  // the decoder monitor held here.
   PRInt64 t = mAudioStream->GetPosition();
   return (t == -1) ? -1 : t + mAudioStartTime;
 }
 
 void nsBuiltinDecoderStateMachine::AdvanceFrame()
 {
-  NS_ASSERTION(IsCurrentThread(mDecoder->mStateMachineThread), "Should be on state machine thread.");
+  NS_ASSERTION(OnStateMachineThread(), "Should be on state machine thread.");
   mDecoder->GetReentrantMonitor().AssertCurrentThreadIn();
+  NS_ASSERTION(!HasAudio() || mAudioStartTime != -1,
+               "Should know audio start time if we have audio.");
 
-  // When it's time to display a frame, decode the frame and display it.
-  if (mDecoder->GetState() == nsBuiltinDecoder::PLAY_STATE_PLAYING) {
-    if (HasAudio() && mAudioStartTime == -1 && !mAudioCompleted) {
-      // We've got audio (so we should sync off the audio clock), but we've not
-      // played a sample on the audio thread, so we can't get a time from the
-      // audio clock. Just wait and then return, to give the audio clock time
-      // to tick.  This should really wait for a specific signal from the audio
-      // thread rather than polling after a sleep.  See bug 568431 comment 4.
-      Wait(AUDIO_DURATION_USECS);
-      return;
-    }
+  if (mDecoder->GetState() != nsBuiltinDecoder::PLAY_STATE_PLAYING) {
+    return;
+  }
 
-    // Determine the clock time. If we've got audio, and we've not reached
-    // the end of the audio, use the audio clock. However if we've finished
-    // audio, or don't have audio, use the system clock.
-    PRInt64 clock_time = -1;
-    if (!IsPlaying()) {
-      clock_time = mPlayDuration + mStartTime;
-    } else {
-      PRInt64 audio_time = GetAudioClock();
-      if (HasAudio() && !mAudioCompleted && audio_time != -1) {
-        clock_time = audio_time;
-        // Resync against the audio clock, while we're trusting the
-        // audio clock. This ensures no "drift", particularly on Linux.
-        mPlayDuration = clock_time - mStartTime;
-        mPlayStartTime = TimeStamp::Now();
-      } else {
-        // Sound is disabled on this system. Sync to the system clock.
-        clock_time = DurationToUsecs(TimeStamp::Now() - mPlayStartTime) + mPlayDuration;
-        // Ensure the clock can never go backwards.
-        NS_ASSERTION(mCurrentFrameTime <= clock_time, "Clock should go forwards");
-        clock_time = NS_MAX(mCurrentFrameTime, clock_time) + mStartTime;
-      }
-    }
-
-    // Skip frames up to the frame at the playback position, and figure out
-    // the time remaining until it's time to display the next frame.
-    PRInt64 remainingTime = AUDIO_DURATION_USECS;
-    NS_ASSERTION(clock_time >= mStartTime, "Should have positive clock time.");
-    nsAutoPtr<VideoData> currentFrame;
-    if (mReader->mVideoQueue.GetSize() > 0) {
-      VideoData* frame = mReader->mVideoQueue.PeekFront();
-      while (clock_time >= frame->mTime) {
-        mVideoFrameEndTime = frame->mEndTime;
-        currentFrame = frame;
-        mReader->mVideoQueue.PopFront();
-        // Notify the decode thread that the video queue's buffers may have
-        // free'd up space for more frames.
-        mDecoder->GetReentrantMonitor().NotifyAll();
-        mDecoder->UpdatePlaybackOffset(frame->mOffset);
-        if (mReader->mVideoQueue.GetSize() == 0)
-          break;
-        frame = mReader->mVideoQueue.PeekFront();
-      }
-      // Current frame has already been presented, wait until it's time to
-      // present the next frame.
-      if (frame && !currentFrame) {
-        PRInt64 now = IsPlaying()
-          ? (DurationToUsecs(TimeStamp::Now() - mPlayStartTime) + mPlayDuration)
-          : mPlayDuration;
-        remainingTime = frame->mTime - mStartTime - now;
-      }
-    }
-
-    // Check to see if we don't have enough data to play up to the next frame.
-    // If we don't, switch to buffering mode.
-    nsMediaStream* stream = mDecoder->GetCurrentStream();
-    if (mState == DECODER_STATE_DECODING &&
-        mDecoder->GetState() == nsBuiltinDecoder::PLAY_STATE_PLAYING &&
-        HasLowDecodedData(remainingTime + EXHAUSTED_DATA_MARGIN_USECS) &&
-        !stream->IsDataCachedToEndOfStream(mDecoder->mDecoderPosition) &&
-        !stream->IsSuspended() &&
-        (JustExitedQuickBuffering() || HasLowUndecodedData()))
-    {
-      if (currentFrame) {
-        mReader->mVideoQueue.PushFront(currentFrame.forget());
-      }
-      StartBuffering();
-      return;
-    }
-
-    // We've got enough data to keep playing until at least the next frame.
-    // Start playing now if need be.
-    if (!IsPlaying()) {
-      StartPlayback();
-      mDecoder->GetReentrantMonitor().NotifyAll();
-    }
-
-    if (currentFrame) {
-      // Decode one frame and display it.
-      TimeStamp presTime = mPlayStartTime - UsecsToDuration(mPlayDuration) +
-                           UsecsToDuration(currentFrame->mTime - mStartTime);
-      NS_ASSERTION(currentFrame->mTime >= mStartTime, "Should have positive frame time");
-      {
-        ReentrantMonitorAutoExit exitMon(mDecoder->GetReentrantMonitor());
-        // If we have video, we want to increment the clock in steps of the frame
-        // duration.
-        RenderVideoFrame(currentFrame, presTime);
-      }
-      mDecoder->GetFrameStatistics().NotifyPresentedFrame();
-      PRInt64 now = DurationToUsecs(TimeStamp::Now() - mPlayStartTime) + mPlayDuration;
-      remainingTime = currentFrame->mEndTime - mStartTime - now;
-      currentFrame = nsnull;
-    }
-
-    // Cap the current time to the larger of the audio and video end time.
-    // This ensures that if we're running off the system clock, we don't
-    // advance the clock to after the media end time.
-    if (mVideoFrameEndTime != -1 || mAudioEndTime != -1) {
-      // These will be non -1 if we've displayed a video frame, or played an audio sample.
-      clock_time = NS_MIN(clock_time, NS_MAX(mVideoFrameEndTime, mAudioEndTime));
-      if (clock_time > GetMediaTime()) {
-        // Only update the playback position if the clock time is greater
-        // than the previous playback position. The audio clock can
-        // sometimes report a time less than its previously reported in
-        // some situations, and we need to gracefully handle that.
-        UpdatePlaybackPosition(clock_time);
-      }
-    }
-
-    // If the number of audio/video samples queued has changed, either by
-    // this function popping and playing a video sample, or by the audio
-    // thread popping and playing an audio sample, we may need to update our
-    // ready state. Post an update to do so.
-    UpdateReadyState();
-
-    if (remainingTime > 0) {
-      Wait(remainingTime);
-    }
+  // Determine the clock time. If we've got audio, and we've not reached
+  // the end of the audio, use the audio clock. However if we've finished
+  // audio, or don't have audio, use the system clock.
+  PRInt64 clock_time = -1;
+  if (!IsPlaying()) {
+    clock_time = mPlayDuration + mStartTime;
   } else {
-    if (IsPlaying()) {
-      StopPlayback(AUDIO_PAUSE);
-      mDecoder->GetReentrantMonitor().NotifyAll();
-    }
-
-    if (mState == DECODER_STATE_DECODING ||
-        mState == DECODER_STATE_COMPLETED) {
-      mDecoder->GetReentrantMonitor().Wait();
+    PRInt64 audio_time = GetAudioClock();
+    if (HasAudio() && !mAudioCompleted && audio_time != -1) {
+      clock_time = audio_time;
+      // Resync against the audio clock, while we're trusting the
+      // audio clock. This ensures no "drift", particularly on Linux.
+      mPlayDuration = clock_time - mStartTime;
+      mPlayStartTime = TimeStamp::Now();
+    } else {
+      // Sound is disabled on this system. Sync to the system clock.
+      clock_time = DurationToUsecs(TimeStamp::Now() - mPlayStartTime) + mPlayDuration;
+      // Ensure the clock can never go backwards.
+      NS_ASSERTION(mCurrentFrameTime <= clock_time, "Clock should go forwards");
+      clock_time = NS_MAX(mCurrentFrameTime, clock_time) + mStartTime;
     }
   }
+
+  // Skip frames up to the frame at the playback position, and figure out
+  // the time remaining until it's time to display the next frame.
+  PRInt64 remainingTime = AUDIO_DURATION_USECS;
+  NS_ASSERTION(clock_time >= mStartTime, "Should have positive clock time.");
+  nsAutoPtr<VideoData> currentFrame;
+  if (mReader->mVideoQueue.GetSize() > 0) {
+    VideoData* frame = mReader->mVideoQueue.PeekFront();
+    while (clock_time >= frame->mTime) {
+      mVideoFrameEndTime = frame->mEndTime;
+      currentFrame = frame;
+      mReader->mVideoQueue.PopFront();
+      // Notify the decode thread that the video queue's buffers may have
+      // free'd up space for more frames.
+      mDecoder->GetReentrantMonitor().NotifyAll();
+      mDecoder->UpdatePlaybackOffset(frame->mOffset);
+      if (mReader->mVideoQueue.GetSize() == 0)
+        break;
+      frame = mReader->mVideoQueue.PeekFront();
+    }
+    // Current frame has already been presented, wait until it's time to
+    // present the next frame.
+    if (frame && !currentFrame) {
+      PRInt64 now = IsPlaying()
+        ? (DurationToUsecs(TimeStamp::Now() - mPlayStartTime) + mPlayDuration)
+        : mPlayDuration;
+      remainingTime = frame->mTime - mStartTime - now;
+    }
+  }
+
+  // Check to see if we don't have enough data to play up to the next frame.
+  // If we don't, switch to buffering mode.
+  nsMediaStream* stream = mDecoder->GetCurrentStream();
+  if (mState == DECODER_STATE_DECODING &&
+      mDecoder->GetState() == nsBuiltinDecoder::PLAY_STATE_PLAYING &&
+      HasLowDecodedData(remainingTime + EXHAUSTED_DATA_MARGIN_USECS) &&
+      !stream->IsDataCachedToEndOfStream(mDecoder->mDecoderPosition) &&
+      !stream->IsSuspended() &&
+      (JustExitedQuickBuffering() || HasLowUndecodedData()))
+  {
+    if (currentFrame) {
+      mReader->mVideoQueue.PushFront(currentFrame.forget());
+    }
+    StartBuffering();
+    ScheduleStateMachine();
+    return;
+  }
+
+  // We've got enough data to keep playing until at least the next frame.
+  // Start playing now if need be.
+  if (!IsPlaying()) {
+    StartPlayback();
+  }
+
+  if (currentFrame) {
+    // Decode one frame and display it.
+    TimeStamp presTime = mPlayStartTime - UsecsToDuration(mPlayDuration) +
+                          UsecsToDuration(currentFrame->mTime - mStartTime);
+    NS_ASSERTION(currentFrame->mTime >= mStartTime, "Should have positive frame time");
+    {
+      ReentrantMonitorAutoExit exitMon(mDecoder->GetReentrantMonitor());
+      // If we have video, we want to increment the clock in steps of the frame
+      // duration.
+      RenderVideoFrame(currentFrame, presTime);
+    }
+    mDecoder->GetFrameStatistics().NotifyPresentedFrame();
+    PRInt64 now = DurationToUsecs(TimeStamp::Now() - mPlayStartTime) + mPlayDuration;
+    remainingTime = currentFrame->mEndTime - mStartTime - now;
+    currentFrame = nsnull;
+  }
+
+  // Cap the current time to the larger of the audio and video end time.
+  // This ensures that if we're running off the system clock, we don't
+  // advance the clock to after the media end time.
+  if (mVideoFrameEndTime != -1 || mAudioEndTime != -1) {
+    // These will be non -1 if we've displayed a video frame, or played an audio sample.
+    clock_time = NS_MIN(clock_time, NS_MAX(mVideoFrameEndTime, mAudioEndTime));
+    if (clock_time > GetMediaTime()) {
+      // Only update the playback position if the clock time is greater
+      // than the previous playback position. The audio clock can
+      // sometimes report a time less than its previously reported in
+      // some situations, and we need to gracefully handle that.
+      UpdatePlaybackPosition(clock_time);
+    }
+  }
+
+  // If the number of audio/video samples queued has changed, either by
+  // this function popping and playing a video sample, or by the audio
+  // thread popping and playing an audio sample, we may need to update our
+  // ready state. Post an update to do so.
+  UpdateReadyState();
+
+  ScheduleStateMachine(remainingTime);
 }
 
 void nsBuiltinDecoderStateMachine::Wait(PRInt64 aUsecs) {
+  NS_ASSERTION(OnAudioThread(), "Only call on the audio thread");
   mDecoder->GetReentrantMonitor().AssertCurrentThreadIn();
   TimeStamp end = TimeStamp::Now() + UsecsToDuration(NS_MAX<PRInt64>(USECS_PER_MS, aUsecs));
   TimeStamp now;
   while ((now = TimeStamp::Now()) < end &&
          mState != DECODER_STATE_SHUTDOWN &&
-         mState != DECODER_STATE_SEEKING)
+         mState != DECODER_STATE_SEEKING &&
+         !mStopAudioThread &&
+         IsPlaying())
   {
     PRInt64 ms = static_cast<PRInt64>(NS_round((end - now).ToSeconds() * 1000));
     if (ms == 0 || ms > PR_UINT32_MAX) {
@@ -1548,7 +1754,7 @@ void nsBuiltinDecoderStateMachine::Wait(PRInt64 aUsecs) {
 
 VideoData* nsBuiltinDecoderStateMachine::FindStartTime()
 {
-  NS_ASSERTION(IsCurrentThread(mDecoder->mStateMachineThread), "Should be on state machine thread.");
+  NS_ASSERTION(OnDecodeThread(), "Should be on decode thread.");
   mDecoder->GetReentrantMonitor().AssertCurrentThreadIn();
   PRInt64 startTime = 0;
   mStartTime = 0;
@@ -1572,7 +1778,7 @@ VideoData* nsBuiltinDecoderStateMachine::FindStartTime()
   // first acutal audio sample we have, we'll inject silence during playback
   // to ensure the audio starts at the correct time.
   mAudioStartTime = mStartTime;
-  LOG(PR_LOG_DEBUG, ("%p Media start time is %lld", mDecoder, mStartTime));
+  LOG(PR_LOG_DEBUG, ("%p Media start time is %lld", mDecoder.get(), mStartTime));
   return v;
 }
 
@@ -1597,32 +1803,6 @@ void nsBuiltinDecoderStateMachine::UpdateReadyState() {
   NS_DispatchToMainThread(event, NS_DISPATCH_NORMAL);
 }
 
-void nsBuiltinDecoderStateMachine::LoadMetadata()
-{
-  NS_ASSERTION(IsCurrentThread(mDecoder->mStateMachineThread),
-               "Should be on state machine thread.");
-  mDecoder->GetReentrantMonitor().AssertCurrentThreadIn();
-
-  LOG(PR_LOG_DEBUG, ("%p Loading Media Headers", mDecoder));
-  nsresult res;
-  nsVideoInfo info;
-  {
-    ReentrantMonitorAutoExit exitMon(mDecoder->GetReentrantMonitor());
-    res = mReader->ReadMetadata(&info);
-  }
-  mInfo = info;
-
-  if (NS_FAILED(res) || (!info.mHasVideo && !info.mHasAudio)) {
-    mState = DECODER_STATE_SHUTDOWN;      
-    nsCOMPtr<nsIRunnable> event =
-      NS_NewRunnableMethod(mDecoder, &nsBuiltinDecoder::DecodeError);
-    NS_DispatchToMainThread(event, NS_DISPATCH_NORMAL);
-    return;
-  }
-  mDecoder->StartProgressUpdates();
-  mGotDurationFromMetaData = (GetDuration() != -1);
-}
-
 PRBool nsBuiltinDecoderStateMachine::JustExitedQuickBuffering()
 {
   return !mDecodeStartTime.IsNull() &&
@@ -1634,6 +1814,10 @@ void nsBuiltinDecoderStateMachine::StartBuffering()
 {
   mDecoder->GetReentrantMonitor().AssertCurrentThreadIn();
 
+  if (IsPlaying()) {
+    StopPlayback();
+  }
+
   TimeDuration decodeDuration = TimeStamp::Now() - mDecodeStartTime;
   // Go into quick buffering mode provided we've not just left buffering using
   // a "quick exit". This stops us flip-flopping between playing and buffering
@@ -1655,10 +1839,10 @@ void nsBuiltinDecoderStateMachine::StartBuffering()
   UpdateReadyState();
   mState = DECODER_STATE_BUFFERING;
   LOG(PR_LOG_DEBUG, ("%p Changed state from DECODING to BUFFERING, decoded for %.3lfs",
-                     mDecoder, decodeDuration.ToSeconds()));
+                     mDecoder.get(), decodeDuration.ToSeconds()));
   nsMediaDecoder::Statistics stats = mDecoder->GetStatistics();
   LOG(PR_LOG_DEBUG, ("%p Playback rate: %.1lfKB/s%s download rate: %.1lfKB/s%s",
-    mDecoder,
+    mDecoder.get(),
     stats.mPlaybackRate/1024, stats.mPlaybackRateReliable ? "" : " (unreliable)",
     stats.mDownloadRate/1024, stats.mDownloadRateReliable ? "" : " (unreliable)"));
 }
@@ -1671,3 +1855,133 @@ nsresult nsBuiltinDecoderStateMachine::GetBuffered(nsTimeRanges* aBuffered) {
   stream->Unpin();
   return res;
 }
+
+PRBool nsBuiltinDecoderStateMachine::IsPausedAndDecoderWaiting() {
+  mDecoder->GetReentrantMonitor().AssertCurrentThreadIn();
+  NS_ASSERTION(OnStateMachineThread(), "Should be on state machine thread.");
+
+  return
+    mDecodeThreadWaiting &&
+    mDecoder->GetState() != nsBuiltinDecoder::PLAY_STATE_PLAYING &&
+    (mState == DECODER_STATE_DECODING || mState == DECODER_STATE_BUFFERING);
+}
+
+nsresult nsBuiltinDecoderStateMachine::Run()
+{
+  ReentrantMonitorAutoEnter mon(mDecoder->GetReentrantMonitor());
+  NS_ASSERTION(OnStateMachineThread(), "Should be on state machine thread.");
+
+  return CallRunStateMachine();
+}
+
+nsresult nsBuiltinDecoderStateMachine::CallRunStateMachine()
+{
+  mDecoder->GetReentrantMonitor().AssertCurrentThreadIn();
+  NS_ASSERTION(OnStateMachineThread(), "Should be on state machine thread.");
+  // This will be set to PR_TRUE by ScheduleStateMachine() if it's called
+  // while we're in RunStateMachine().
+  mRunAgain = PR_FALSE;
+
+  // Set to PR_TRUE whenever we dispatch an event to run this state machine.
+  // This flag prevents us from dispatching
+  mDispatchedRunEvent = PR_FALSE;
+
+  mTimeout = TimeStamp();
+
+  mIsRunning = PR_TRUE;
+  nsresult res = RunStateMachine();
+  mIsRunning = PR_FALSE;
+
+  if (mRunAgain && !mDispatchedRunEvent) {
+    mDispatchedRunEvent = PR_TRUE;
+    return NS_DispatchToCurrentThread(this);
+  }
+
+  return res;
+}
+
+static void TimeoutExpired(nsITimer *aTimer, void *aClosure) {
+  nsBuiltinDecoderStateMachine *machine =
+    static_cast<nsBuiltinDecoderStateMachine*>(aClosure);
+  NS_ASSERTION(machine, "Must have been passed state machine");
+  machine->TimeoutExpired();
+}
+
+void nsBuiltinDecoderStateMachine::TimeoutExpired()
+{
+  ReentrantMonitorAutoEnter mon(mDecoder->GetReentrantMonitor());
+  NS_ASSERTION(OnStateMachineThread(), "Must be on state machine thread");
+  if (mIsRunning) {
+    mRunAgain = PR_TRUE;
+  } else if (!mDispatchedRunEvent) {
+    // We don't have an event dispatched to run the state machine, so we
+    // can just run it from here.
+    CallRunStateMachine();
+  }
+  // Otherwise, an event has already been dispatched to run the state machine
+  // as soon as possible. Nothing else needed to do, the state machine is
+  // going to run anyway.
+}
+
+nsresult nsBuiltinDecoderStateMachine::ScheduleStateMachine() {
+  return ScheduleStateMachine(0);
+}
+
+nsresult nsBuiltinDecoderStateMachine::ScheduleStateMachine(PRInt64 aUsecs) {
+  mDecoder->GetReentrantMonitor().AssertCurrentThreadIn();
+  NS_ABORT_IF_FALSE(gStateMachineThread,
+    "Must have a state machine thread to schedule");
+
+  if (mState == DECODER_STATE_SHUTDOWN) {
+    return NS_ERROR_FAILURE;
+  }
+  aUsecs = PR_MAX(aUsecs, 0);
+
+  TimeStamp timeout = TimeStamp::Now() + UsecsToDuration(aUsecs);
+  if (!mTimeout.IsNull()) {
+    if (timeout >= mTimeout) {
+      // We've already scheduled a timer set to expire at or before this time,
+      // or have an event dispatched to run the state machine.
+      return NS_OK;
+    }
+    if (mTimer) {
+      // We've been asked to schedule a timer to run before an existing timer.
+      // Cancel the existing timer.
+      mTimer->Cancel();
+    }
+  }
+
+  PRUint32 ms = static_cast<PRUint32>((aUsecs / USECS_PER_MS) & 0xFFFFFFFF);
+  if (ms == 0) {
+    if (mIsRunning) {
+      // We're currently running this state machine on the state machine
+      // thread. Signal it to run again once it finishes its current cycle.
+      mRunAgain = PR_TRUE;
+      return NS_OK;
+    } else if (!mDispatchedRunEvent) {
+      // We're not currently running this state machine on the state machine
+      // thread. Dispatch an event to run one cycle of the state machine.
+      mDispatchedRunEvent = PR_TRUE;
+      return gStateMachineThread->Dispatch(this, NS_DISPATCH_NORMAL);
+    }
+    // We're not currently running this state machine on the state machine
+    // thread, but something has already dispatched an event to run it again,
+    // so just exit; it's going to run real soon.
+    return NS_OK;
+  }
+
+  mTimeout = timeout;
+
+  nsresult res;
+  if (!mTimer) {
+    mTimer = do_CreateInstance("@mozilla.org/timer;1", &res);
+    if (NS_FAILED(res)) return res;
+    mTimer->SetTarget(gStateMachineThread);
+  }
+
+  res = mTimer->InitWithFuncCallback(::TimeoutExpired,
+                                     this,
+                                     ms,
+                                     nsITimer::TYPE_ONE_SHOT);
+  return res;
+}
diff --git a/content/media/nsBuiltinDecoderStateMachine.h b/content/media/nsBuiltinDecoderStateMachine.h
index e78c79f1bee7..67c6452c5777 100644
--- a/content/media/nsBuiltinDecoderStateMachine.h
+++ b/content/media/nsBuiltinDecoderStateMachine.h
@@ -37,11 +37,10 @@
  *
  * ***** END LICENSE BLOCK ***** */
 /*
-Each video element for a media file has two additional threads beyond
-those needed by nsBuiltinDecoder.
+Each video element for a media file has two threads:
 
   1) The Audio thread writes the decoded audio data to the audio
-     hardware.  This is done in a seperate thread to ensure that the
+     hardware. This is done in a separate thread to ensure that the
      audio hardware gets a constant stream of data without
      interruption due to decoding or display. At some point
      libsydneyaudio will be refactored to have a callback interface
@@ -49,31 +48,27 @@ those needed by nsBuiltinDecoder.
      needed.
 
   2) The decode thread. This thread reads from the media stream and
-     decodes the Theora and Vorbis data. It places the decoded data in
-     a queue for the other threads to pull from.
+     decodes the Theora and Vorbis data. It places the decoded data into
+     queues for the other threads to pull from.
 
-All file reads and seeks must occur on either the state machine thread
-or the decode thread. Synchronisation is done via a monitor owned by
-nsBuiltinDecoder.
+All file reads, seeks, and all decoding must occur on the decode thread.
+Synchronisation of state between the thread is done via a monitor owned
+by nsBuiltinDecoder.
 
-The decode thread and the audio thread are created and destroyed in
-the state machine thread. When playback needs to occur they are
-created and events dispatched to them to start them. These events exit
-when decoding is completed or no longer required (during seeking or
-shutdown).
-    
-The decode thread has its own monitor to ensure that its internal
-state is independent of the other threads, and to ensure that it's not
-hogging the nsBuiltinDecoder monitor while decoding.
+The lifetime of the decode and audio threads is controlled by the state
+machine when it runs on the shared state machine thread. When playback
+needs to occur they are created and events dispatched to them to run
+them. These events exit when decoding/audio playback is completed or
+no longer required.
 
-a/v synchronisation is handled by the state machine thread. It
-examines the audio playback time and compares this to the next frame
-in the queue of frames. If it is time to play the video frame it is
-then displayed.
+A/V synchronisation is handled by the state machine. It examines the audio
+playback time and compares this to the next frame in the queue of video
+frames. If it is time to play the video frame it is then displayed, otherwise
+it schedules the state machine to run again at the time of the next frame.
 
 Frame skipping is done in the following ways:
 
-  1) The state machine thread will skip all frames in the video queue whose
+  1) The state machine will skip all frames in the video queue whose
      display time is less than the current audio time. This ensures
      the correct frame for the current time is always displayed.
 
@@ -86,28 +81,30 @@ Frame skipping is done in the following ways:
           will be decoding video data that won't be displayed due
           to the decode thread dropping the frame immediately.
 
-YCbCr conversion is done on the decode thread when it is time to display
-the video frame. This means frames that are skipped will not have the
-YCbCr conversion done, improving playback.
+When hardware accelerated graphics is not available, YCbCr conversion
+is done on the decode thread when video frames are decoded.
 
 The decode thread pushes decoded audio and videos frames into two
 separate queues - one for audio and one for video. These are kept
 separate to make it easy to constantly feed audio data to the sound
 hardware while allowing frame skipping of video data. These queues are
-threadsafe, and neither the decode, audio, or state machine thread should
+threadsafe, and neither the decode, audio, or state machine should
 be able to monopolize them, and cause starvation of the other threads.
 
 Both queues are bounded by a maximum size. When this size is reached
 the decode thread will no longer decode video or audio depending on the
-queue that has reached the threshold.
+queue that has reached the threshold. If both queues are full, the decode
+thread will wait on the decoder monitor.
+
+When the decode queues are full (they've reaced their maximum size) and
+the decoder is not in PLAYING play state, the state machine may opt
+to shut down the decode thread in order to conserve resources.
 
 During playback the audio thread will be idle (via a Wait() on the
-monitor) if the audio queue is empty. Otherwise it constantly pops an
-item off the queue and plays it with a blocking write to the audio
+monitor) if the audio queue is empty. Otherwise it constantly pops
+sound data off the queue and plays it with a blocking write to the audio
 hardware (via nsAudioStream and libsydneyaudio).
 
-The decode thread idles if the video queue is empty or if it is
-not yet time to display the next frame.
 */
 #if !defined(nsBuiltinDecoderStateMachine_h__)
 #define nsBuiltinDecoderStateMachine_h__
@@ -119,21 +116,17 @@ not yet time to display the next frame.
 #include "nsAudioAvailableEventManager.h"
 #include "nsHTMLMediaElement.h"
 #include "mozilla/ReentrantMonitor.h"
+#include "nsITimer.h"
 
 /*
-  The playback state machine class. This manages the decoding in the
-  nsBuiltinDecoderReader on the decode thread, seeking and in-sync-playback on the
+  The state machine class. This manages the decoding and seeking in the
+  nsBuiltinDecoderReader on the decode thread, and A/V sync on the shared
   state machine thread, and controls the audio "push" thread.
 
-  All internal state is synchronised via the decoder monitor. NotifyAll
-  on the monitor is called when the state of the state machine is changed
-  by the main thread. The following changes to state cause a notify:
-
-    mState and data related to that state changed (mSeekTime, etc)
-    Metadata Loaded
-    First Frame Loaded
-    Frame decoded
-    data pushed or popped from the video and audio queues
+  All internal state is synchronised via the decoder monitor. State changes
+  are either propagated by NotifyAll on the monitor (typically when state
+  changes need to be propagated to non-state machine threads) or by scheduling
+  the state machine to run another cycle on the shared state machine thread.
 
   See nsBuiltinDecoder.h for more details.
 */
@@ -172,13 +165,7 @@ public:
   virtual void UpdatePlaybackPosition(PRInt64 aTime);
   virtual void StartBuffering();
 
-
-  // Load metadata Called on the state machine thread. The decoder monitor must be held with
-  // exactly one lock count.
-  virtual void LoadMetadata();
-
-  // State machine thread run function. Polls the state, sends frames to be
-  // displayed at appropriate times, and generally manages the decode.
+  // State machine thread run function. Defers to RunStateMachine().
   NS_IMETHOD Run();
 
   // This is called on the state machine thread and audio thread.
@@ -214,26 +201,29 @@ public:
 
   // Functions used by assertions to ensure we're calling things
   // on the appropriate threads.
-  PRBool OnAudioThread() {
+  PRBool OnAudioThread() const {
     return IsCurrentThread(mAudioThread);
   }
 
-  PRBool OnStateMachineThread() {
-    return mDecoder->OnStateMachineThread();
+  PRBool OnStateMachineThread() const {
+    return IsCurrentThread(GetStateMachineThread());
   }
-
-  // Decode loop, called on the decode thread.
-  void DecodeLoop();
-
-  // The decoder object that created this state machine. The decoder
-  // always outlives us since it controls our lifetime. This is accessed
-  // read only on the AV, state machine, audio and main thread.
-  nsBuiltinDecoder* mDecoder;
+ 
+  // The decoder object that created this state machine. The state machine
+  // holds a strong reference to the decoder to ensure that the decoder stays
+  // alive once media element has started the decoder shutdown process, and has
+  // dropped its reference to the decoder. This enables the state machine to
+  // keep using the decoder's monitor until the state machine has finished
+  // shutting down, without fear of the monitor being destroyed. After
+  // shutting down, the state machine will then release this reference,
+  // causing the decoder to be destroyed. This is accessed on the decode,
+  // state machine, audio and main threads.
+  nsRefPtr<nsBuiltinDecoder> mDecoder;
 
   // The decoder monitor must be obtained before modifying this state.
-  // NotifyAll on the monitor must be called when the state is changed by
-  // the main thread so the decoder thread can wake up.
-  // Accessed on state machine, audio, main, and AV thread. 
+  // NotifyAll on the monitor must be called when the state is changed so
+  // that interested threads can wake up and alter behaviour if appropriate
+  // Accessed on state machine, audio, main, and AV thread.
   State mState;
 
   nsresult GetBuffered(nsTimeRanges* aBuffered);
@@ -257,6 +247,23 @@ public:
   // Accessed on the main and state machine threads.
   virtual void SetFrameBufferLength(PRUint32 aLength);
 
+  // Returns the shared state machine thread.
+  static nsIThread* GetStateMachineThread();
+
+  // Schedules the shared state machine thread to run the state machine.
+  // If the state machine thread is the currently running the state machine,
+  // we wait until that has completely finished before running the state
+  // machine again.
+  nsresult ScheduleStateMachine();
+
+  // Schedules the shared state machine thread to run the state machine
+  // in aUsecs microseconds from now, if it's not already scheduled to run
+  // earlier, in which case the request is discarded.
+  nsresult ScheduleStateMachine(PRInt64 aUsecs);
+
+  // Timer function to implement ScheduleStateMachine(aUsecs).
+  void TimeoutExpired();
+
 protected:
 
   // Returns PR_TRUE if we've got less than aAudioUsecs microseconds of decoded
@@ -290,14 +297,14 @@ protected:
   // wait for a specified time, and that the myriad of Notify()s we do on
   // the decoder monitor don't cause the audio thread to be starved. aUsecs
   // values of less than 1 millisecond are rounded up to 1 millisecond
-  // (see bug 651023). The decoder monitor must be held.
+  // (see bug 651023). The decoder monitor must be held. Called only on the
+  // audio thread.
   void Wait(PRInt64 aUsecs);
 
   // Dispatches an asynchronous event to update the media element's ready state.
   void UpdateReadyState();
 
-  // Resets playback timing data. Called when we seek, on the state machine
-  // thread.
+  // Resets playback timing data. Called when we seek, on the decode thread.
   void ResetPlayback();
 
   // Returns the audio clock, if we have audio, or -1 if we don't.
@@ -316,9 +323,8 @@ protected:
   // machine thread, caller must hold the decoder lock.
   void UpdatePlaybackPositionInternal(PRInt64 aTime);
 
-  // Performs YCbCr to RGB conversion, and pushes the image down the
-  // rendering pipeline. Called on the state machine thread. The decoder
-  // monitor must not be held when calling this.
+  // Pushes the image down the rendering pipeline. Called on the shared state
+  // machine thread. The decoder monitor must *not* be held when calling this.
   void RenderVideoFrame(VideoData* aData, TimeStamp aTarget);
  
   // If we have video, display a video frame if it's time for display has
@@ -344,36 +350,35 @@ protected:
   // queued here. Called on the audio thread.
   PRUint32 PlayFromAudioQueue(PRUint64 aSampleOffset, PRUint32 aChannels);
 
-  // Stops the decode threads. The decoder monitor must be held with exactly
+  // Stops the decode thread. The decoder monitor must be held with exactly
   // one lock count. Called on the state machine thread.
-  void StopDecodeThreads();
+  void StopDecodeThread();
 
-  // Starts the decode threads. The decoder monitor must be held with exactly
+  // Stops the audio thread. The decoder monitor must be held with exactly
   // one lock count. Called on the state machine thread.
-  nsresult StartDecodeThreads();
+  void StopAudioThread();
+
+  // Starts the decode thread. The decoder monitor must be held with exactly
+  // one lock count. Called on the state machine thread.
+  nsresult StartDecodeThread();
+
+  // Starts the audio thread. The decoder monitor must be held with exactly
+  // one lock count. Called on the state machine thread.
+  nsresult StartAudioThread();
 
   // The main loop for the audio thread. Sent to the thread as
   // an nsRunnableMethod. This continually does blocking writes to
   // to audio stream to play audio data.
   void AudioLoop();
 
-  // Stop or pause playback of media. This has two modes, denoted by
-  // aMode being either AUDIO_PAUSE or AUDIO_SHUTDOWN.
-  //
-  // AUDIO_PAUSE: Suspends the audio stream to be resumed later.
-  // This does not close the OS based audio stream 
-  //
-  // AUDIO_SHUTDOWN: Closes and destroys the audio stream and
-  // releases any OS resources.
-  //
-  // The decoder monitor must be held with exactly one lock count. Called
-  // on the state machine thread.
-  enum eStopMode {AUDIO_PAUSE, AUDIO_SHUTDOWN};
-  void StopPlayback(eStopMode aMode);
+  // Sets internal state which causes playback of media to pause.
+  // The decoder monitor must be held. Called on the main, state machine,
+  // and decode threads.
+  void StopPlayback();
 
-  // Resume playback of media. Must be called with the decode monitor held.
-  // This resumes a paused audio stream. The decoder monitor must be held with
-  // exactly one lock count. Called on the state machine thread.
+  // Sets internal state which causes playback of media to begin or resume.
+  // Must be called with the decode monitor held. Called on the state machine
+  // and decode threads.
   void StartPlayback();
 
   // Moves the decoder into decoding state. Called on the state machine
@@ -400,14 +405,42 @@ protected:
   // which has been pushed to the audio hardware for playback. Note that after
   // calling this, the audio hardware may play some of the audio pushed to
   // hardware, so this can only be used as a upper bound. The decoder monitor
-  // must be held when calling this. Called on the decoder thread.
+  // must be held when calling this. Called on the decode thread.
   PRInt64 GetDecodedAudioDuration();
 
-  // ReentrantMonitor on mAudioStream. This monitor must be held in
-  // order to delete or use the audio stream. This stops us destroying
-  // the audio stream while it's being used on another thread
-  // (typically when it's being written to on the audio thread).
-  ReentrantMonitor mAudioReentrantMonitor;
+  // Load metadata. Called on the decode thread. The decoder monitor
+  // must be held with exactly one lock count.
+  nsresult DecodeMetadata();
+
+  // Seeks to mSeekTarget. Called on the decode thread. The decoder monitor
+  // must be held with exactly one lock count.
+  void DecodeSeek();
+
+  // Decode loop, decodes data until EOF or shutdown.
+  // Called on the decode thread.
+  void DecodeLoop();
+
+  // Decode thread run function. Determines which of the Decode*() functions
+  // to call.
+  void DecodeThreadRun();
+
+  // State machine thread run function. Defers to RunStateMachine().
+  nsresult CallRunStateMachine();
+
+  // Performs one "cycle" of the state machine. Polls the state, and may send
+  // a video frame to be displayed, and generally manages the decode. Called
+  // periodically via timer to ensure the video stays in sync.
+  nsresult RunStateMachine();
+
+  PRBool IsStateMachineScheduled() const {
+    mDecoder->GetReentrantMonitor().AssertCurrentThreadIn();
+    return !mTimeout.IsNull() || mRunAgain;
+  }
+
+  // Returns PR_TRUE if we're not playing and the decode thread has filled its
+  // decode buffers and is waiting. We can shut the decode thread down in this
+  // case as it may not be needed again.
+  PRBool IsPausedAndDecoderWaiting();
 
   // The size of the decoded YCbCr frame.
   // Accessed on state machine thread.
@@ -423,6 +456,15 @@ protected:
   // Thread for decoding video in background. The "decode thread".
   nsCOMPtr<nsIThread> mDecodeThread;
 
+  // Timer to call the state machine Run() method. Used by
+  // ScheduleStateMachine(). Access protected by decoder monitor.
+  nsCOMPtr<nsITimer> mTimer;
+
+  // Timestamp at which the next state machine Run() method will be called.
+  // If this is non-null, a call to Run() is scheduled, either by a timer,
+  // or via an event. Access protected by decoder monitor.
+  TimeStamp mTimeout;
+
   // The time that playback started from the system clock. This is used for
   // timing the presentation of video frames when there's no audio.
   // Accessed only via the state machine thread.
@@ -441,23 +483,24 @@ protected:
 
   // Start time of the media, in microseconds. This is the presentation
   // time of the first sample decoded from the media, and is used to calculate
-  // duration and as a bounds for seeking. Accessed on state machine and
-  // main thread. Access controlled by decoder monitor.
+  // duration and as a bounds for seeking. Accessed on state machine, decode,
+  // and main threads. Access controlled by decoder monitor.
   PRInt64 mStartTime;
 
   // Time of the last page in the media, in microseconds. This is the
   // end time of the last sample in the media. Accessed on state
-  // machine and main thread. Access controlled by decoder monitor.
+  // machine, decode, and main threads. Access controlled by decoder monitor.
   PRInt64 mEndTime;
 
   // Position to seek to in microseconds when the seek state transition occurs.
   // The decoder monitor lock must be obtained before reading or writing
-  // this value. Accessed on main and state machine thread.
+  // this value. Accessed on main and decode thread.
   PRInt64 mSeekTime;
 
-  // The audio stream resource. Used on the state machine, audio, and
-  // main threads. You must hold the mAudioReentrantMonitor, and must
-  // NOT hold the decoder monitor when using the audio stream!
+  // The audio stream resource. Used on the state machine, and audio threads.
+  // This is created and destroyed on the audio thread, while holding the
+  // decoder monitor, so if this is used off the audio thread, you must
+  // first acquire the decoder monitor and check that it is non-null.
   nsRefPtr<nsAudioStream> mAudioStream;
 
   // The reader, don't call its methods with the decoder monitor held.
@@ -516,9 +559,20 @@ protected:
   // the media index/metadata. Accessed on the state machine thread.
   PRPackedBool mGotDurationFromMetaData;
     
-  // PR_FALSE while decode threads should be running. Accessed on audio, 
-  // state machine and decode threads. Syncrhonised by decoder monitor.
-  PRPackedBool mStopDecodeThreads;
+  // PR_FALSE while decode thread should be running. Accessed state machine
+  // and decode threads. Syncrhonised by decoder monitor.
+  PRPackedBool mStopDecodeThread;
+
+  // PR_TRUE when the decode thread run function has finished, but the thread
+  // has not necessarily been shut down yet. This can happen if we switch
+  // from COMPLETED state to SEEKING before the state machine has a chance
+  // to run in the COMPLETED state and shutdown the decode thread.
+  // Synchronised by the decoder monitor.
+  PRPackedBool mDecodeThreadIdle;
+
+  // PR_FALSE while audio thread should be running. Accessed state machine
+  // and audio threads. Syncrhonised by decoder monitor.
+  PRPackedBool mStopAudioThread;
 
   // If this is PR_TRUE while we're in buffering mode, we can exit early,
   // as it's likely we may be able to playback. This happens when we enter
@@ -527,6 +581,26 @@ protected:
   // Synchronised via decoder monitor.
   PRPackedBool mQuickBuffering;
 
+  // PR_TRUE if the shared state machine thread is currently running this
+  // state machine.
+  PRPackedBool mIsRunning;
+
+  // PR_TRUE if we should run the state machine again once the current
+  // state machine run has finished.
+  PRPackedBool mRunAgain;
+
+  // PR_TRUE if we've dispatched an event to run the state machine. It's
+  // imperative that we don't dispatch multiple events to run the state
+  // machine at the same time, as our code assume all events are synchronous.
+  // If we dispatch multiple events, the second event can run while the
+  // first is shutting down a thread, causing inconsistent state.
+  PRPackedBool mDispatchedRunEvent;
+
+  // PR_TRUE if the decode thread has gone filled its buffers and is now
+  // waiting to be awakened before it continues decoding. Synchronized
+  // by the decoder monitor.
+  PRPackedBool mDecodeThreadWaiting;
+
 private:
   // Manager for queuing and dispatching MozAudioAvailable events.  The
   // event manager is accessed from the state machine and audio threads,
diff --git a/content/media/nsMediaDecoder.h b/content/media/nsMediaDecoder.h
index 23d18b8f0a16..900446b871b7 100644
--- a/content/media/nsMediaDecoder.h
+++ b/content/media/nsMediaDecoder.h
@@ -65,20 +65,6 @@ class nsTimeRanges;
 #define FRAMEBUFFER_LENGTH_MIN 512
 #define FRAMEBUFFER_LENGTH_MAX 16384
 
-// Shuts down a thread asynchronously.
-class ShutdownThreadEvent : public nsRunnable 
-{
-public:
-  ShutdownThreadEvent(nsIThread* aThread) : mThread(aThread) {}
-  ~ShutdownThreadEvent() {}
-  NS_IMETHOD Run() {
-    mThread->Shutdown();
-    return NS_OK;
-  }
-private:
-  nsCOMPtr<nsIThread> mThread;
-};
-
 // All methods of nsMediaDecoder must be called from the main thread only
 // with the exception of GetImageContainer, SetVideoData and GetStatistics,
 // which can be called from any thread.
diff --git a/content/media/ogg/nsOggReader.cpp b/content/media/ogg/nsOggReader.cpp
index 7a067374a78a..5bd819501d6f 100644
--- a/content/media/ogg/nsOggReader.cpp
+++ b/content/media/ogg/nsOggReader.cpp
@@ -140,23 +140,20 @@ nsresult nsOggReader::Init(nsBuiltinDecoderReader* aCloneDonor) {
 
 nsresult nsOggReader::ResetDecode()
 {
+  NS_ASSERTION(mDecoder->OnDecodeThread(), "Should be on decode thread.");
   nsresult res = NS_OK;
 
   if (NS_FAILED(nsBuiltinDecoderReader::ResetDecode())) {
     res = NS_ERROR_FAILURE;
   }
 
-  {
-    ReentrantMonitorAutoEnter mon(mReentrantMonitor);
-
-    // Discard any previously buffered packets/pages.
-    ogg_sync_reset(&mOggState);
-    if (mVorbisState && NS_FAILED(mVorbisState->Reset())) {
-      res = NS_ERROR_FAILURE;
-    }
-    if (mTheoraState && NS_FAILED(mTheoraState->Reset())) {
-      res = NS_ERROR_FAILURE;
-    }
+  // Discard any previously buffered packets/pages.
+  ogg_sync_reset(&mOggState);
+  if (mVorbisState && NS_FAILED(mVorbisState->Reset())) {
+    res = NS_ERROR_FAILURE;
+  }
+  if (mTheoraState && NS_FAILED(mTheoraState->Reset())) {
+    res = NS_ERROR_FAILURE;
   }
 
   return res;
@@ -178,8 +175,7 @@ PRBool nsOggReader::ReadHeaders(nsOggCodecState* aState)
 
 nsresult nsOggReader::ReadMetadata(nsVideoInfo* aInfo)
 {
-  NS_ASSERTION(mDecoder->OnStateMachineThread(), "Should be on play state machine thread.");
-  ReentrantMonitorAutoEnter mon(mReentrantMonitor);
+  NS_ASSERTION(mDecoder->OnDecodeThread(), "Should be on decode thread.");
 
   // We read packets until all bitstreams have read all their header packets.
   // We record the offset of the first non-header page so that we know
@@ -318,8 +314,7 @@ nsresult nsOggReader::ReadMetadata(nsVideoInfo* aInfo)
       }
       PRInt64 duration = 0;
       if (NS_SUCCEEDED(mSkeletonState->GetDuration(tracks, duration))) {
-        ReentrantMonitorAutoExit exitReaderMon(mReentrantMonitor);
-        ReentrantMonitorAutoEnter decoderMon(mDecoder->GetReentrantMonitor());
+        ReentrantMonitorAutoEnter mon(mDecoder->GetReentrantMonitor());
         mDecoder->GetStateMachine()->SetDuration(duration);
         LOG(PR_LOG_DEBUG, ("Got duration from Skeleton index %lld", duration));
       }
@@ -327,8 +322,7 @@ nsresult nsOggReader::ReadMetadata(nsVideoInfo* aInfo)
   }
 
   {
-    ReentrantMonitorAutoExit exitReaderMon(mReentrantMonitor);
-    ReentrantMonitorAutoEnter decoderMon(mDecoder->GetReentrantMonitor());
+    ReentrantMonitorAutoEnter mon(mDecoder->GetReentrantMonitor());
 
     nsMediaStream* stream = mDecoder->GetCurrentStream();
     if (mDecoder->GetStateMachine()->GetDuration() == -1 &&
@@ -402,9 +396,7 @@ nsresult nsOggReader::DecodeVorbis(ogg_packet* aPacket) {
 
 PRBool nsOggReader::DecodeAudioData()
 {
-  ReentrantMonitorAutoEnter mon(mReentrantMonitor);
-  NS_ASSERTION(mDecoder->OnStateMachineThread() || mDecoder->OnDecodeThread(),
-               "Should be on playback or decode thread.");
+  NS_ASSERTION(mDecoder->OnDecodeThread(), "Should be on decode thread.");
   NS_ASSERTION(mVorbisState!=0, "Need Vorbis state to decode audio");
 
   // Read the next data packet. Skip any non-data packets we encounter.
@@ -480,9 +472,6 @@ nsresult nsOggReader::DecodeTheora(ogg_packet* aPacket, PRInt64 aTimeThreshold)
       b.mPlanes[i].mStride = buffer[i].stride;
     }
 
-    // Need the monitor to be held to be able to use mInfo. This
-    // is held by our caller.
-    mReentrantMonitor.AssertCurrentThreadIn();
     VideoData *v = VideoData::Create(mInfo,
                                      mDecoder->GetImageContainer(),
                                      mPageOffset,
@@ -506,9 +495,7 @@ nsresult nsOggReader::DecodeTheora(ogg_packet* aPacket, PRInt64 aTimeThreshold)
 PRBool nsOggReader::DecodeVideoFrame(PRBool &aKeyframeSkip,
                                      PRInt64 aTimeThreshold)
 {
-  ReentrantMonitorAutoEnter mon(mReentrantMonitor);
-  NS_ASSERTION(mDecoder->OnStateMachineThread() || mDecoder->OnDecodeThread(),
-               "Should be on state machine or AV thread.");
+  NS_ASSERTION(mDecoder->OnDecodeThread(), "Should be on decode thread.");
 
   // Record number of frames decoded and parsed. Automatically update the
   // stats counters using the AutoNotifyDecoded stack-based class.
@@ -557,9 +544,7 @@ PRBool nsOggReader::DecodeVideoFrame(PRBool &aKeyframeSkip,
 
 PRInt64 nsOggReader::ReadOggPage(ogg_page* aPage)
 {
-  NS_ASSERTION(mDecoder->OnStateMachineThread() || mDecoder->OnDecodeThread(),
-               "Should be on play state machine or decode thread.");
-  mReentrantMonitor.AssertCurrentThreadIn();
+  NS_ASSERTION(mDecoder->OnDecodeThread(), "Should be on decode thread.");
 
   int ret = 0;
   while((ret = ogg_sync_pageseek(&mOggState, aPage)) <= 0) {
@@ -597,9 +582,7 @@ PRInt64 nsOggReader::ReadOggPage(ogg_page* aPage)
 
 ogg_packet* nsOggReader::NextOggPacket(nsOggCodecState* aCodecState)
 {
-  NS_ASSERTION(mDecoder->OnStateMachineThread() || mDecoder->OnDecodeThread(),
-               "Should be on play state machine or decode thread.");
-  mReentrantMonitor.AssertCurrentThreadIn();
+  NS_ASSERTION(mDecoder->OnDecodeThread(), "Should be on decode thread.");
 
   if (!aCodecState || !aCodecState->mActive) {
     return nsnull;
@@ -642,8 +625,7 @@ GetChecksum(ogg_page* page)
 
 PRInt64 nsOggReader::RangeStartTime(PRInt64 aOffset)
 {
-  NS_ASSERTION(mDecoder->OnStateMachineThread(),
-               "Should be on state machine thread.");
+  NS_ASSERTION(mDecoder->OnDecodeThread(), "Should be on decode thread.");
   nsMediaStream* stream = mDecoder->GetCurrentStream();
   NS_ENSURE_TRUE(stream != nsnull, nsnull);
   nsresult res = stream->Seek(nsISeekableStream::NS_SEEK_SET, aOffset);
@@ -665,9 +647,8 @@ struct nsAutoOggSyncState {
 
 PRInt64 nsOggReader::RangeEndTime(PRInt64 aEndOffset)
 {
-  ReentrantMonitorAutoEnter mon(mReentrantMonitor);
-  NS_ASSERTION(mDecoder->OnStateMachineThread(),
-               "Should be on state machine thread.");
+  NS_ASSERTION(mDecoder->OnStateMachineThread() || mDecoder->OnDecodeThread(),
+               "Should be on state machine or decode thread.");
 
   nsMediaStream* stream = mDecoder->GetCurrentStream();
   NS_ENSURE_TRUE(stream != nsnull, -1);
@@ -797,9 +778,7 @@ PRInt64 nsOggReader::RangeEndTime(PRInt64 aStartOffset,
 
 nsresult nsOggReader::GetSeekRanges(nsTArray<SeekRange>& aRanges)
 {
-  NS_ASSERTION(mDecoder->OnStateMachineThread(),
-               "Should be on state machine thread.");
-  mReentrantMonitor.AssertCurrentThreadIn();
+  NS_ASSERTION(mDecoder->OnDecodeThread(), "Should be on decode thread.");
   nsTArray<nsByteRange> cached;
   nsresult res = mDecoder->GetCurrentStream()->GetCachedRanges(cached);
   NS_ENSURE_SUCCESS(res, res);
@@ -838,8 +817,7 @@ nsOggReader::SelectSeekRange(const nsTArray<SeekRange>& ranges,
                              PRInt64 aEndTime,
                              PRBool aExact)
 {
-  NS_ASSERTION(mDecoder->OnStateMachineThread(),
-               "Should be on state machine thread.");
+  NS_ASSERTION(mDecoder->OnDecodeThread(), "Should be on decode thread.");
   PRInt64 so = 0;
   PRInt64 eo = mDecoder->GetCurrentStream()->GetLength();
   PRInt64 st = aStartTime;
@@ -977,8 +955,7 @@ nsresult nsOggReader::SeekInBufferedRange(PRInt64 aTarget,
     PRBool skip = PR_FALSE;
     eof = !DecodeVideoFrame(skip, 0);
     {
-      ReentrantMonitorAutoExit exitReaderMon(mReentrantMonitor);
-      ReentrantMonitorAutoEnter decoderMon(mDecoder->GetReentrantMonitor());
+      ReentrantMonitorAutoEnter mon(mDecoder->GetReentrantMonitor());
       if (mDecoder->GetDecodeState() == nsBuiltinDecoderStateMachine::DECODER_STATE_SHUTDOWN) {
         return NS_ERROR_FAILURE;
       }
@@ -1052,9 +1029,7 @@ nsresult nsOggReader::Seek(PRInt64 aTarget,
                            PRInt64 aEndTime,
                            PRInt64 aCurrentTime)
 {
-  ReentrantMonitorAutoEnter mon(mReentrantMonitor);
-  NS_ASSERTION(mDecoder->OnStateMachineThread(),
-               "Should be on state machine thread.");
+  NS_ASSERTION(mDecoder->OnDecodeThread(), "Should be on decode thread.");
   LOG(PR_LOG_DEBUG, ("%p About to seek to %lldms", mDecoder, aTarget));
   nsresult res;
   nsMediaStream* stream = mDecoder->GetCurrentStream();
@@ -1072,8 +1047,7 @@ nsresult nsOggReader::Seek(PRInt64 aTarget,
 
     NS_ASSERTION(aStartTime != -1, "mStartTime should be known");
     {
-      ReentrantMonitorAutoExit exitReaderMon(mReentrantMonitor);
-      ReentrantMonitorAutoEnter decoderMon(mDecoder->GetReentrantMonitor());
+      ReentrantMonitorAutoEnter mon(mDecoder->GetReentrantMonitor());
       mDecoder->UpdatePlaybackPosition(aStartTime);
     }
   } else if (CanDecodeToTarget(aTarget, aCurrentTime)) {
@@ -1183,8 +1157,7 @@ nsresult nsOggReader::SeekBisection(PRInt64 aTarget,
                                     const SeekRange& aRange,
                                     PRUint32 aFuzz)
 {
-  NS_ASSERTION(mDecoder->OnStateMachineThread(),
-               "Should be on state machine thread.");
+  NS_ASSERTION(mDecoder->OnDecodeThread(), "Should be on decode thread.");
   nsresult res;
   nsMediaStream* stream = mDecoder->GetCurrentStream();
 
diff --git a/content/media/ogg/nsOggReader.h b/content/media/ogg/nsOggReader.h
index 84c0d2cbe49e..1e4d79b0c0f8 100644
--- a/content/media/ogg/nsOggReader.h
+++ b/content/media/ogg/nsOggReader.h
@@ -71,15 +71,11 @@ public:
   virtual PRBool DecodeVideoFrame(PRBool &aKeyframeSkip,
                                   PRInt64 aTimeThreshold);
 
-  virtual PRBool HasAudio()
-  {
-    mozilla::ReentrantMonitorAutoEnter mon(mReentrantMonitor);
+  virtual PRBool HasAudio() {
     return mVorbisState != 0 && mVorbisState->mActive;
   }
 
-  virtual PRBool HasVideo()
-  {
-    mozilla::ReentrantMonitorAutoEnter mon(mReentrantMonitor);
+  virtual PRBool HasVideo() {
     return mTheoraState != 0 && mTheoraState->mActive;
   }
 
@@ -89,9 +85,7 @@ public:
 
 private:
 
-  PRBool HasSkeleton()
-  {
-    ReentrantMonitorAutoEnter mon(mReentrantMonitor);
+  PRBool HasSkeleton() {
     return mSkeletonState != 0 && mSkeletonState->mActive;
   }
 
diff --git a/content/media/test/manifest.js b/content/media/test/manifest.js
index b3238af5eb95..7ef33b9fa772 100644
--- a/content/media/test/manifest.js
+++ b/content/media/test/manifest.js
@@ -123,7 +123,6 @@ var gPlayTests = [
   { name:"spacestorm-1000Hz-100ms.ogg", type:"audio/ogg", duration:0.099 },
 
   { name:"bogus.duh", type:"bogus/duh", duration:Number.NaN }
-  
 ];
 
 // Converts a path/filename to a file:// URI which we can load from disk.
diff --git a/content/media/test/seek1.js b/content/media/test/seek1.js
index 2fbd25c61db6..8340a1bb4f59 100644
--- a/content/media/test/seek1.js
+++ b/content/media/test/seek1.js
@@ -29,7 +29,8 @@ function startTest() {
 function seekStarted() {
   if (completed)
     return false;
-  ok(v.currentTime >= seekTime - 0.1, "Video currentTime should be around " + seekTime + ": " + v.currentTime);
+  ok(v.currentTime >= seekTime - 0.1,
+     "Video currentTime should be around " + seekTime + ": " + v.currentTime + " (seeking)");
   v.pause();
   startPassed = true;
   return false;
@@ -43,7 +44,7 @@ function seekEnded() {
   // Since we were playing, and we only paused asynchronously, we can't be
   // sure that we paused before the seek finished, so we may have played
   // ahead arbitrarily far.
-  ok(t >= seekTime - 0.1, "Video currentTime should be around " + seekTime + ": " + t);
+  ok(t >= seekTime - 0.1, "Video currentTime should be around " + seekTime + ": " + t + " (seeked)");
   v.play();
   endPassed = true;
   seekFlagEnd = v.seeking;
diff --git a/content/media/test/test_buffered.html b/content/media/test/test_buffered.html
index 0eb2d7675eb9..6848503dcb49 100644
--- a/content/media/test/test_buffered.html
+++ b/content/media/test/test_buffered.html
@@ -41,7 +41,7 @@ function ended(e) {
   } catch (e) {
     caught = e.code == DOMException.INDEX_SIZE_ERR;
   }
-  is(caught, true, "Should throw INDEX_SIZE_ERR on under start bounds range");
+  is(caught, true, v._name + ": Should throw INDEX_SIZE_ERR on under start bounds range");
   
   caught = false;
   try {
@@ -49,7 +49,7 @@ function ended(e) {
   } catch (e) {
     caught = e.code == DOMException.INDEX_SIZE_ERR;
   }
-  is(caught, true, "Should throw INDEX_SIZE_ERR on under end bounds range");
+  is(caught, true, v._name + ": Should throw INDEX_SIZE_ERR on under end bounds range");
 
   caught = false;
   try {
@@ -57,7 +57,7 @@ function ended(e) {
   } catch (e) {
     caught = e.code == DOMException.INDEX_SIZE_ERR;
   }
-  is(caught, true, "Should throw INDEX_SIZE_ERR on over start bounds range");
+  is(caught, true, v._name + ": Should throw INDEX_SIZE_ERR on over start bounds range");
   
   caught = false;
   try {
@@ -65,8 +65,9 @@ function ended(e) {
   } catch (e) {
     caught = e.code == DOMException.INDEX_SIZE_ERR;
   }
-  is(caught, true, "Should throw INDEX_SIZE_ERR on over end bounds range");
-  
+  is(caught, true, v._name + ": Should throw INDEX_SIZE_ERR on over end bounds range");
+
+  v.src = "";
   v.parentNode.removeChild(v);
   manager.finished(v.token);
 
diff --git a/content/media/test/test_bug493187.html b/content/media/test/test_bug493187.html
index 4c8564f5a8a6..d5a42cbd4cac 100644
--- a/content/media/test/test_bug493187.html
+++ b/content/media/test/test_bug493187.html
@@ -33,6 +33,7 @@ function canPlayThrough(e) {
     ok(true, "Got canplaythrough after seek for " + v._name);
     v._finished = true;
     v.parentNode.removeChild(v);
+    v.src = "";
     manager.finished(v.token);
   }
 }
diff --git a/content/media/wave/nsWaveReader.cpp b/content/media/wave/nsWaveReader.cpp
index d983abe73b42..0d2d294631d0 100644
--- a/content/media/wave/nsWaveReader.cpp
+++ b/content/media/wave/nsWaveReader.cpp
@@ -152,8 +152,7 @@ nsresult nsWaveReader::Init(nsBuiltinDecoderReader* aCloneDonor)
 
 nsresult nsWaveReader::ReadMetadata(nsVideoInfo* aInfo)
 {
-  NS_ASSERTION(mDecoder->OnStateMachineThread(), "Should be on state machine thread.");
-  ReentrantMonitorAutoEnter mon(mReentrantMonitor);
+  NS_ASSERTION(mDecoder->OnDecodeThread(), "Should be on decode thread.");
 
   PRBool loaded = LoadRIFFChunk() && LoadFormatChunk() && FindDataOffset();
   if (!loaded) {
@@ -167,8 +166,7 @@ nsresult nsWaveReader::ReadMetadata(nsVideoInfo* aInfo)
 
   *aInfo = mInfo;
 
-  ReentrantMonitorAutoExit exitReaderMon(mReentrantMonitor);
-  ReentrantMonitorAutoEnter decoderMon(mDecoder->GetReentrantMonitor());
+  ReentrantMonitorAutoEnter mon(mDecoder->GetReentrantMonitor());
 
   mDecoder->GetStateMachine()->SetDuration(
     static_cast<PRInt64>(BytesToTime(GetDataLength()) * USECS_PER_S));
@@ -178,9 +176,7 @@ nsresult nsWaveReader::ReadMetadata(nsVideoInfo* aInfo)
 
 PRBool nsWaveReader::DecodeAudioData()
 {
-  ReentrantMonitorAutoEnter mon(mReentrantMonitor);
-  NS_ASSERTION(mDecoder->OnStateMachineThread() || mDecoder->OnDecodeThread(),
-               "Should be on state machine thread or decode thread.");
+  NS_ASSERTION(mDecoder->OnDecodeThread(), "Should be on decode thread.");
 
   PRInt64 pos = GetPosition() - mWavePCMOffset;
   PRInt64 len = GetDataLength();
@@ -246,18 +242,14 @@ PRBool nsWaveReader::DecodeAudioData()
 PRBool nsWaveReader::DecodeVideoFrame(PRBool &aKeyframeSkip,
                                       PRInt64 aTimeThreshold)
 {
-  ReentrantMonitorAutoEnter mon(mReentrantMonitor);
-  NS_ASSERTION(mDecoder->OnStateMachineThread() || mDecoder->OnDecodeThread(),
-               "Should be on state machine or decode thread.");
+  NS_ASSERTION(mDecoder->OnDecodeThread(), "Should be on decode thread.");
 
   return PR_FALSE;
 }
 
 nsresult nsWaveReader::Seek(PRInt64 aTarget, PRInt64 aStartTime, PRInt64 aEndTime, PRInt64 aCurrentTime)
 {
-  ReentrantMonitorAutoEnter mon(mReentrantMonitor);
-  NS_ASSERTION(mDecoder->OnStateMachineThread(),
-               "Should be on state machine thread.");
+  NS_ASSERTION(mDecoder->OnDecodeThread(), "Should be on decode thread.");
   LOG(PR_LOG_DEBUG, ("%p About to seek to %lld", mDecoder, aTarget));
   if (NS_FAILED(ResetDecode())) {
     return NS_ERROR_FAILURE;
diff --git a/content/media/webm/nsWebMReader.cpp b/content/media/webm/nsWebMReader.cpp
index 631db80864e4..4613cfe0f688 100644
--- a/content/media/webm/nsWebMReader.cpp
+++ b/content/media/webm/nsWebMReader.cpp
@@ -209,8 +209,7 @@ void nsWebMReader::Cleanup()
 
 nsresult nsWebMReader::ReadMetadata(nsVideoInfo* aInfo)
 {
-  NS_ASSERTION(mDecoder->OnStateMachineThread(), "Should be on state machine thread.");
-  ReentrantMonitorAutoEnter mon(mReentrantMonitor);
+  NS_ASSERTION(mDecoder->OnDecodeThread(), "Should be on decode thread.");
 
   nestegg_io io;
   io.read = webm_read;
@@ -225,8 +224,7 @@ nsresult nsWebMReader::ReadMetadata(nsVideoInfo* aInfo)
   uint64_t duration = 0;
   r = nestegg_duration(mContext, &duration);
   if (r == 0) {
-    ReentrantMonitorAutoExit exitReaderMon(mReentrantMonitor);
-    ReentrantMonitorAutoEnter decoderMon(mDecoder->GetReentrantMonitor());
+    ReentrantMonitorAutoEnter mon(mDecoder->GetReentrantMonitor());
     mDecoder->GetStateMachine()->SetDuration(duration / NS_PER_USEC);
   }
 
@@ -411,7 +409,7 @@ ogg_packet nsWebMReader::InitOggPacket(unsigned char* aData,
  
 PRBool nsWebMReader::DecodeAudioPacket(nestegg_packet* aPacket, PRInt64 aOffset)
 {
-  mReentrantMonitor.AssertCurrentThreadIn();
+  NS_ASSERTION(mDecoder->OnDecodeThread(), "Should be on decode thread.");
 
   int r = 0;
   unsigned int count = 0;
@@ -589,9 +587,8 @@ nsReturnRef<NesteggPacketHolder> nsWebMReader::NextPacket(TrackType aTrackType)
 
 PRBool nsWebMReader::DecodeAudioData()
 {
-  ReentrantMonitorAutoEnter mon(mReentrantMonitor);
-  NS_ASSERTION(mDecoder->OnStateMachineThread() || mDecoder->OnDecodeThread(),
-    "Should be on state machine thread or decode thread.");
+  NS_ASSERTION(mDecoder->OnDecodeThread(), "Should be on decode thread.");
+
   nsAutoRef<NesteggPacketHolder> holder(NextPacket(AUDIO));
   if (!holder) {
     mAudioQueue.Finish();
@@ -604,9 +601,7 @@ PRBool nsWebMReader::DecodeAudioData()
 PRBool nsWebMReader::DecodeVideoFrame(PRBool &aKeyframeSkip,
                                       PRInt64 aTimeThreshold)
 {
-  ReentrantMonitorAutoEnter mon(mReentrantMonitor);
-  NS_ASSERTION(mDecoder->OnStateMachineThread() || mDecoder->OnDecodeThread(),
-               "Should be on state machine or decode thread.");
+  NS_ASSERTION(mDecoder->OnDecodeThread(), "Should be on decode thread.");
 
   // Record number of frames decoded and parsed. Automatically update the
   // stats counters using the AutoNotifyDecoded stack-based class.
@@ -652,7 +647,6 @@ PRBool nsWebMReader::DecodeVideoFrame(PRBool &aKeyframeSkip,
       }
       mVideoPackets.PushFront(next_holder.disown());
     } else {
-      ReentrantMonitorAutoExit exitMon(mReentrantMonitor);
       ReentrantMonitorAutoEnter decoderMon(mDecoder->GetReentrantMonitor());
       nsBuiltinDecoderStateMachine* s =
         static_cast<nsBuiltinDecoderStateMachine*>(mDecoder->GetStateMachine());
@@ -766,9 +760,8 @@ PRBool nsWebMReader::CanDecodeToTarget(PRInt64 aTarget,
 nsresult nsWebMReader::Seek(PRInt64 aTarget, PRInt64 aStartTime, PRInt64 aEndTime,
                             PRInt64 aCurrentTime)
 {
-  ReentrantMonitorAutoEnter mon(mReentrantMonitor);
-  NS_ASSERTION(mDecoder->OnStateMachineThread(),
-               "Should be on state machine thread.");
+  NS_ASSERTION(mDecoder->OnDecodeThread(), "Should be on decode thread.");
+
   LOG(PR_LOG_DEBUG, ("%p About to seek to %lldms", mDecoder, aTarget));
   if (CanDecodeToTarget(aTarget, aCurrentTime)) {
     LOG(PR_LOG_DEBUG, ("%p Seek target (%lld) is close to current time (%lld), "
diff --git a/content/media/webm/nsWebMReader.h b/content/media/webm/nsWebMReader.h
index f64811e03178..e60f33fcffcc 100644
--- a/content/media/webm/nsWebMReader.h
+++ b/content/media/webm/nsWebMReader.h
@@ -143,13 +143,13 @@ public:
 
   virtual PRBool HasAudio()
   {
-    mozilla::ReentrantMonitorAutoEnter mon(mReentrantMonitor);
+    NS_ASSERTION(mDecoder->OnDecodeThread(), "Should be on decode thread.");
     return mHasAudio;
   }
 
   virtual PRBool HasVideo()
   {
-    mozilla::ReentrantMonitorAutoEnter mon(mReentrantMonitor);
+    NS_ASSERTION(mDecoder->OnDecodeThread(), "Should be on decode thread.");
     return mHasVideo;
   }
 
diff --git a/content/svg/content/src/nsSVGFilterElement.cpp b/content/svg/content/src/nsSVGFilterElement.cpp
index d10f7c2dad4a..a55970ceb6cf 100644
--- a/content/svg/content/src/nsSVGFilterElement.cpp
+++ b/content/svg/content/src/nsSVGFilterElement.cpp
@@ -242,22 +242,35 @@ nsSVGFilterElement::GetStringInfo()
                               NS_ARRAY_LENGTH(sStringInfo));
 }
 
-void
-nsSVGFilterElement::DidAnimateLength(PRUint8 aAttrEnum)
+inline static void DidAnimateAttr(nsSVGFilterElement *aFilterElement)
 {
-  // nsSVGFilterFrame does not implement a useful AttributeChanged
-  nsIFrame* frame = GetPrimaryFrame();
+  // nsSVGFilterFrame doesn't implement a useful AttributeChanged
+  nsIFrame* frame = aFilterElement->GetPrimaryFrame();
   if (frame) {
     nsSVGEffects::InvalidateRenderingObservers(frame);
   }
 }
 
+void
+nsSVGFilterElement::DidAnimateLength(PRUint8 aAttrEnum)
+{
+  DidAnimateAttr(this);
+}
+
+void
+nsSVGFilterElement::DidAnimateIntegerPair(PRUint8 aAttrEnum)
+{
+  DidAnimateAttr(this);
+}
+
 void
 nsSVGFilterElement::DidAnimateEnum(PRUint8 aAttrEnum)
 {
-  // nsSVGFilterFrame does not implement a useful AttributeChanged
-  nsIFrame* frame = GetPrimaryFrame();
-  if (frame) {
-    nsSVGEffects::InvalidateRenderingObservers(frame);
-  }
+  DidAnimateAttr(this);
+}
+
+void
+nsSVGFilterElement::DidAnimateString(PRUint8 aAttrEnum)
+{
+  DidAnimateAttr(this);
 }
diff --git a/content/svg/content/src/nsSVGFilterElement.h b/content/svg/content/src/nsSVGFilterElement.h
index 17b1dc7a3311..095cbfe365eb 100644
--- a/content/svg/content/src/nsSVGFilterElement.h
+++ b/content/svg/content/src/nsSVGFilterElement.h
@@ -89,7 +89,9 @@ protected:
   virtual StringAttributesInfo GetStringInfo();
 
   virtual void DidAnimateLength(PRUint8 aAttrEnum);
+  virtual void DidAnimateIntegerPair(PRUint8 aAttrEnum);
   virtual void DidAnimateEnum(PRUint8 aAttrEnum);
+  virtual void DidAnimateString(PRUint8 aAttrEnum);
 
   enum { X, Y, WIDTH, HEIGHT };
   nsSVGLength2 mLengthAttributes[4];
diff --git a/content/svg/content/src/nsSVGFilters.cpp b/content/svg/content/src/nsSVGFilters.cpp
index 25c1f430200f..3bbfeb082cb4 100644
--- a/content/svg/content/src/nsSVGFilters.cpp
+++ b/content/svg/content/src/nsSVGFilters.cpp
@@ -310,7 +310,8 @@ inline static void DidAnimateAttr(Element *aFilterPrimitive)
   }
 }
 
-inline static void DidAnimateAttrViaParent(Element *aFilterPrimitive) {
+inline static void DidAnimateAttrViaParent(Element *aFilterPrimitive)
+{
   // No frame, use parent's
   NS_ASSERTION(!aFilterPrimitive->GetPrimaryFrame(), "Not expecting a frame");
   nsIContent *parent = aFilterPrimitive->GetFlattenedTreeParent();
diff --git a/content/xul/content/src/nsXULPopupListener.cpp b/content/xul/content/src/nsXULPopupListener.cpp
index 2f7b6937708e..6e5eac0d6685 100644
--- a/content/xul/content/src/nsXULPopupListener.cpp
+++ b/content/xul/content/src/nsXULPopupListener.cpp
@@ -79,7 +79,6 @@
 #include "nsPIDOMWindow.h"
 #include "nsIViewManager.h"
 #include "nsDOMError.h"
-#include "nsIMenuFrame.h"
 
 using namespace mozilla;
 
diff --git a/dom/base/Makefile.in b/dom/base/Makefile.in
index 39f01b5b2663..d2d81f42744e 100644
--- a/dom/base/Makefile.in
+++ b/dom/base/Makefile.in
@@ -85,6 +85,7 @@ EXPORTS = \
   nsWrapperCache.h \
   nsContentPermissionHelper.h \
   nsStructuredCloneContainer.h \
+  nsDOMMemoryReporter.h \
   $(NULL)
 
 CPPSRCS =			\
diff --git a/dom/base/nsDOMClassInfo.cpp b/dom/base/nsDOMClassInfo.cpp
index 944eae3f6c57..db49f9300a78 100644
--- a/dom/base/nsDOMClassInfo.cpp
+++ b/dom/base/nsDOMClassInfo.cpp
@@ -1574,7 +1574,7 @@ static const nsConstructorFuncMapData kConstructorFuncMap[] =
 {
   NS_DEFINE_CONSTRUCTOR_FUNC_DATA(Worker, nsDOMWorker::NewWorker)
   NS_DEFINE_CONSTRUCTOR_FUNC_DATA(ChromeWorker, nsDOMWorker::NewChromeWorker)
-  NS_DEFINE_CONSTRUCTOR_FUNC_DATA(File, nsDOMFile::NewFile)
+  NS_DEFINE_CONSTRUCTOR_FUNC_DATA(File, nsDOMFileFile::NewFile)
   NS_DEFINE_CONSTRUCTOR_FUNC_DATA(MozBlobBuilder, NS_NewBlobBuilder)
 };
 
diff --git a/dom/base/nsDOMMemoryReporter.h b/dom/base/nsDOMMemoryReporter.h
index 8d9ecf7fd9f0..1ffed8a38395 100644
--- a/dom/base/nsDOMMemoryReporter.h
+++ b/dom/base/nsDOMMemoryReporter.h
@@ -41,6 +41,40 @@
 #include "nsIMemoryReporter.h"
 
 
+/**
+ * Helper methods for the DOM Memory Reporter.
+ */
+namespace mozilla {
+  namespace dom {
+    namespace MemoryReporter {
+      /**
+       * It will compute the basic size of an object. This means the size of the
+       * object itself plus everything owned by its superclasses.  This will not
+       * include the size of objects owned by this objects (which have to be
+       * manually added to ::SizeOf), but does include the size of any pointers
+       * to those objects stored in this object.
+       */
+      template <class TypeCurrent, class TypeParent>
+      inline PRInt64 GetBasicSize(const TypeCurrent* const obj) {
+        return obj->TypeParent::SizeOf() - sizeof(TypeParent)
+                                         + sizeof(TypeCurrent);
+      }
+    }
+  }
+}
+
+/**
+ * Helper macros to declare/implement SizeOf() method for DOM objects.
+ */
+#define NS_DECL_DOM_MEMORY_REPORTER_SIZEOF  \
+  virtual PRInt64 SizeOf() const;
+
+#define NS_DECL_AND_IMPL_DOM_MEMORY_REPORTER_SIZEOF(TypeCurrent, TypeParent) \
+  virtual PRInt64 SizeOf() const {                                           \
+    return mozilla::dom::MemoryReporter::GetBasicSize<TypeCurrent,           \
+                                                      TypeParent>(this);     \
+  }
+
 class nsDOMMemoryReporter: public nsIMemoryReporter {
 public:
   NS_DECL_ISUPPORTS
diff --git a/dom/base/nsGlobalWindow.cpp b/dom/base/nsGlobalWindow.cpp
index 347afe26b284..b29bd0bf1a09 100644
--- a/dom/base/nsGlobalWindow.cpp
+++ b/dom/base/nsGlobalWindow.cpp
@@ -1026,6 +1026,8 @@ nsGlobalWindow::~nsGlobalWindow()
 
   CleanUp(PR_TRUE);
 
+  NS_ASSERTION(!mHasDeviceMotion, "Window still registered with device motion.");
+
 #ifdef DEBUG
   nsCycleCollector_DEBUG_wasFreed(static_cast<nsIScriptGlobalObject*>(this));
 #endif
diff --git a/dom/base/nsGlobalWindow.h b/dom/base/nsGlobalWindow.h
index 4892e780a0bf..e4e681530d2a 100644
--- a/dom/base/nsGlobalWindow.h
+++ b/dom/base/nsGlobalWindow.h
@@ -383,6 +383,7 @@ public:
   virtual NS_HIDDEN_(void) SetHasOrientationEventListener();
   virtual NS_HIDDEN_(void) MaybeUpdateTouchState();
   virtual NS_HIDDEN_(void) UpdateTouchState();
+  virtual NS_HIDDEN_(PRBool) DispatchCustomEvent(const char *aEventName);
 
   // nsIDOMStorageWindow
   NS_DECL_NSIDOMSTORAGEWINDOW
@@ -729,8 +730,6 @@ protected:
     return GetParentInternal() != nsnull;
   }
 
-  PRBool DispatchCustomEvent(const char *aEventName);
-
   // If aLookForCallerOnJSStack is true, this method will look at the JS stack
   // to determine who the caller is.  If it's false, it'll use |this| as the
   // caller.
diff --git a/dom/base/nsJSEnvironment.cpp b/dom/base/nsJSEnvironment.cpp
index 909154db6ebf..f2b0987b355e 100644
--- a/dom/base/nsJSEnvironment.cpp
+++ b/dom/base/nsJSEnvironment.cpp
@@ -1833,7 +1833,9 @@ nsJSContext::CallEventHandler(nsISupports* aTarget, void *aScope, void *aHandler
 #ifdef NS_FUNCTION_TIMER
   {
     JSObject *obj = static_cast<JSObject *>(aHandler);
-    JSString *id = JS_GetFunctionId(static_cast<JSFunction *>(JS_GetPrivate(mContext, obj)));
+    if (obj->isFunctionProxy())
+      obj = obj->unwrap(NULL);
+    JSString *id = JS_GetFunctionId(GET_FUNCTION_PRIVATE(mContext, obj));
     JSAutoByteString bytes;
     const char *name = !id ? "anonymous" : bytes.encode(mContext, id) ? bytes.ptr() : "<error>";
     NS_TIME_FUNCTION_FMT(1.0, "%s (line %d) (function: %s)", MOZ_FUNCTION_NAME, __LINE__, name);
diff --git a/dom/base/nsPIDOMWindow.h b/dom/base/nsPIDOMWindow.h
index f25c629e4cde..a5f362715afa 100644
--- a/dom/base/nsPIDOMWindow.h
+++ b/dom/base/nsPIDOMWindow.h
@@ -80,8 +80,8 @@ class nsIArray;
 class nsPIWindowRoot;
 
 #define NS_PIDOMWINDOW_IID \
-{ 0x6c05ae9d, 0x4ad1, 0x4e92, \
-  { 0x9c, 0x95, 0xd3, 0x54, 0xea, 0x0f, 0xb9, 0x48 } }
+{ 0xa595249b, 0x1e74, 0x467e, \
+ { 0x92, 0x56, 0x58, 0xff, 0x07, 0x1b, 0xc2, 0x96 } }
 
 class nsPIDOMWindow : public nsIDOMWindowInternal
 {
@@ -579,6 +579,12 @@ public:
    */
   PRUint64 WindowID() const { return mWindowID; }
 
+  /**
+   * Dispatch a custom event with name aEventName targeted at this window.
+   * Returns whether the default action should be performed.
+   */
+  virtual PRBool DispatchCustomEvent(const char *aEventName) = 0;
+
 protected:
   // The nsPIDOMWindow constructor. The aOuterWindow argument should
   // be null if and only if the created window itself is an outer
diff --git a/dom/interfaces/html/nsIDOMHTMLImageElement.idl b/dom/interfaces/html/nsIDOMHTMLImageElement.idl
index 188a337e8cca..6f0cb12da612 100644
--- a/dom/interfaces/html/nsIDOMHTMLImageElement.idl
+++ b/dom/interfaces/html/nsIDOMHTMLImageElement.idl
@@ -50,17 +50,17 @@
  * http://www.whatwg.org/specs/web-apps/current-work/
  */
 
-[scriptable, uuid(cf8a8744-ec3b-474e-8f2b-8def3da2344a)]
+[scriptable, uuid(4bedb0a0-f901-4c61-a93a-a43c1b7674d4)]
 interface nsIDOMHTMLImageElement : nsIDOMHTMLElement
 {
            attribute DOMString        alt;
            attribute DOMString        src;
            attribute DOMString        useMap;
            attribute boolean          isMap;
-           attribute long             width;
-           attribute long             height;
-  readonly attribute long             naturalWidth;
-  readonly attribute long             naturalHeight;
+           attribute unsigned long    width;
+           attribute unsigned long    height;
+  readonly attribute unsigned long    naturalWidth;
+  readonly attribute unsigned long    naturalHeight;
   readonly attribute boolean          complete;
 
 
diff --git a/dom/plugins/base/nsNPAPIPluginInstance.cpp b/dom/plugins/base/nsNPAPIPluginInstance.cpp
index 7eab9e1e1995..2f80b3f81954 100644
--- a/dom/plugins/base/nsNPAPIPluginInstance.cpp
+++ b/dom/plugins/base/nsNPAPIPluginInstance.cpp
@@ -87,7 +87,7 @@ nsNPAPIPluginInstance::nsNPAPIPluginInstance(nsNPAPIPlugin* plugin)
     mMIMEType(nsnull),
     mOwner(nsnull),
     mCurrentPluginEvent(nsnull),
-#if defined(MOZ_X11) || defined(XP_WIN)
+#if defined(MOZ_X11) || defined(XP_WIN) || defined(XP_MACOSX)
     mUsePluginLayersPref(PR_TRUE)
 #else
     mUsePluginLayersPref(PR_FALSE)
diff --git a/dom/plugins/base/nsPluginInstanceOwner.cpp b/dom/plugins/base/nsPluginInstanceOwner.cpp
index 0b781f06905c..e87cfd583d92 100644
--- a/dom/plugins/base/nsPluginInstanceOwner.cpp
+++ b/dom/plugins/base/nsPluginInstanceOwner.cpp
@@ -1477,8 +1477,8 @@ void nsPluginInstanceOwner::RenderCoreAnimation(CGContextRef aCGContext,
     // If the renderer is backed by an IOSurface, resize it as required.
     mIOSurface = nsIOSurface::CreateIOSurface(aWidth, aHeight);
     if (mIOSurface) {
-      nsIOSurface *attachSurface = nsIOSurface::LookupSurface(
-                                      mIOSurface->GetIOSurfaceID());
+      nsRefPtr<nsIOSurface> attachSurface = nsIOSurface::LookupSurface(
+                                              mIOSurface->GetIOSurfaceID());
       if (attachSurface) {
         mCARenderer.AttachIOSurface(attachSurface);
       } else {
diff --git a/dom/plugins/base/nsPluginInstanceOwner.h b/dom/plugins/base/nsPluginInstanceOwner.h
index a088ae151dfa..803280df4e40 100644
--- a/dom/plugins/base/nsPluginInstanceOwner.h
+++ b/dom/plugins/base/nsPluginInstanceOwner.h
@@ -324,7 +324,7 @@ private:
   NP_Port                                   mQDPluginPortCopy;
 #endif
   PRInt32                                   mInCGPaintLevel;
-  nsIOSurface                              *mIOSurface;
+  nsRefPtr<nsIOSurface>                     mIOSurface;
   nsCARenderer                              mCARenderer;
   CGColorSpaceRef                           mColorProfile;
   static nsCOMPtr<nsITimer>                *sCATimer;
diff --git a/dom/plugins/ipc/Makefile.in b/dom/plugins/ipc/Makefile.in
index 8c03fa6d6f53..d20eea8f2837 100644
--- a/dom/plugins/ipc/Makefile.in
+++ b/dom/plugins/ipc/Makefile.in
@@ -75,6 +75,7 @@ EXPORTS_mozilla/plugins = \
   PluginScriptableObjectUtils-inl.h \
   PluginInstanceChild.h \
   PluginInstanceParent.h \
+  PluginUtilsOSX.h \
   AStream.h \
   BrowserStreamChild.h \
   BrowserStreamParent.h \
diff --git a/dom/plugins/ipc/PluginInstanceChild.cpp b/dom/plugins/ipc/PluginInstanceChild.cpp
index 8aa742b18fe4..9fa4467afd40 100644
--- a/dom/plugins/ipc/PluginInstanceChild.cpp
+++ b/dom/plugins/ipc/PluginInstanceChild.cpp
@@ -186,7 +186,7 @@ PluginInstanceChild::~PluginInstanceChild()
         ::CGContextRelease(mShContext);
     }
     if (mCGLayer) {
-        mozilla::plugins::PluginUtilsOSX::ReleaseCGLayer(mCGLayer);
+        PluginUtilsOSX::ReleaseCGLayer(mCGLayer);
     }
 #endif
 }
@@ -844,7 +844,7 @@ PluginInstanceChild::AnswerNPP_HandleEvent_IOSurface(const NPRemoteEvent& event,
     PaintTracker pt;
 
     NPCocoaEvent evcopy = event.event;
-    nsIOSurface* surf = nsIOSurface::LookupSurface(surfaceid);
+    nsRefPtr<nsIOSurface> surf = nsIOSurface::LookupSurface(surfaceid);
     if (!surf) {
         NS_ERROR("Invalid IOSurface.");
         *handled = false;
@@ -2577,44 +2577,18 @@ PluginInstanceChild::EnsureCurrentBuffer(void)
 
     return true;
 #else // XP_MACOSX
-    if (mCurrentIOSurface && 
-        (mCurrentIOSurface->GetWidth() != mWindow.width ||
-         mCurrentIOSurface->GetHeight() != mWindow.height) ) {
-        mCurrentIOSurface = nsnull;
-    }
-
-    if (!mCARenderer.isInit() || !mCurrentIOSurface) {
-        if (!mCurrentIOSurface) {
-            mCurrentIOSurface = nsIOSurface::CreateIOSurface(mWindow.width, mWindow.height);
-
-            nsIntRect toInvalidate(0, 0, mWindow.width, mWindow.height);
-            mAccumulatedInvalidRect.UnionRect(mAccumulatedInvalidRect, toInvalidate);
-        }
-
-        if (!mCurrentIOSurface) {
-            NS_WARNING("Failed to allocate IOSurface");
-            return false;
-        }
-
-        nsIOSurface *rendererSurface = nsIOSurface::LookupSurface(mCurrentIOSurface->GetIOSurfaceID()); 
-        if (!rendererSurface) {
-            NS_WARNING("Failed to lookup IOSurface");
-            return false;
-        }
-        mCARenderer.AttachIOSurface(rendererSurface);
 
+    if (!mDoubleBufferCARenderer.HasCALayer()) {
         void *caLayer = nsnull;
         if (mDrawingModel == NPDrawingModelCoreGraphics) {
-            if (mCGLayer) {
-                mozilla::plugins::PluginUtilsOSX::ReleaseCGLayer(mCGLayer);
-                mCGLayer = nsnull;
-            }
+            if (!mCGLayer) {
+                caLayer = mozilla::plugins::PluginUtilsOSX::GetCGLayer(CallCGDraw, this);
 
-            caLayer = mozilla::plugins::PluginUtilsOSX::GetCGLayer(CallCGDraw, this);
-            if (!caLayer) {
-                return false;
+                if (!caLayer) {
+                    PLUGIN_LOG_DEBUG(("GetCGLayer failed."));
+                    return false;
+                }
             }
-
             mCGLayer = caLayer;
         } else {
             NPError result = mPluginIface->getvalue(GetNPP(),
@@ -2626,13 +2600,30 @@ PluginInstanceChild::EnsureCurrentBuffer(void)
                 return false;
             }
         }
-
-        mCARenderer.SetupRenderer(caLayer, mWindow.width, mWindow.height);
-        // Flash needs to have the window set again after this step
-        if (mPluginIface->setwindow)
-            (void) mPluginIface->setwindow(&mData, &mWindow);
+        mDoubleBufferCARenderer.SetCALayer(caLayer);
     }
 
+    if (mDoubleBufferCARenderer.HasFrontSurface() &&
+        (mDoubleBufferCARenderer.GetFrontSurfaceWidth() != mWindow.width ||
+         mDoubleBufferCARenderer.GetFrontSurfaceHeight() != mWindow.height) ) {
+        mDoubleBufferCARenderer.ClearFrontSurface();
+    }
+
+    if (!mDoubleBufferCARenderer.HasFrontSurface()) {
+        bool allocSurface = mDoubleBufferCARenderer.InitFrontSurface(mWindow.width, 
+                                                           mWindow.height);
+        if (!allocSurface) {
+            PLUGIN_LOG_DEBUG(("Fail to allocate front IOSurface"));
+            return false;
+        }
+
+        if (mPluginIface->setwindow)
+            (void) mPluginIface->setwindow(&mData, &mWindow);
+
+        nsIntRect toInvalidate(0, 0, mWindow.width, mWindow.height);
+        mAccumulatedInvalidRect.UnionRect(mAccumulatedInvalidRect, toInvalidate);
+    }
+  
     return true;
 #endif
 }
@@ -3030,7 +3021,7 @@ PluginInstanceChild::ShowPluginFrame()
         return false;
     }
 
-#ifdef XP_MACOSX
+#ifdef MOZ_WIDGET_COCOA
     // We can't use the thebes code with CoreAnimation so we will
     // take a different code path.
     if (mDrawingModel == NPDrawingModelCoreAnimation ||
@@ -3041,6 +3032,11 @@ PluginInstanceChild::ShowPluginFrame()
             return true;
         }
 
+        if (!mDoubleBufferCARenderer.HasFrontSurface()) {
+            NS_ERROR("CARenderer not initialized for rendering");
+            return false;
+        }
+
         // Clear accRect here to be able to pass
         // test_invalidate_during_plugin_paint  test
         nsIntRect rect = mAccumulatedInvalidRect;
@@ -3049,33 +3045,30 @@ PluginInstanceChild::ShowPluginFrame()
         // Fix up old invalidations that might have been made when our
         // surface was a different size
         rect.IntersectRect(rect,
-                         nsIntRect(0, 0, mCurrentIOSurface->GetWidth(), mCurrentIOSurface->GetHeight()));
-      
-        if (!mCARenderer.isInit()) {
-            NS_ERROR("CARenderer not initialized");
-            return false;
-        }
+                          nsIntRect(0, 0, 
+                          mDoubleBufferCARenderer.GetFrontSurfaceWidth(), 
+                          mDoubleBufferCARenderer.GetFrontSurfaceHeight()));
 
         if (mDrawingModel == NPDrawingModelCoreGraphics) {
             mozilla::plugins::PluginUtilsOSX::Repaint(mCGLayer, rect);
         }
 
-        mCARenderer.Render(mWindow.width, mWindow.height, nsnull);
+        mDoubleBufferCARenderer.Render();
 
         NPRect r = { (uint16_t)rect.y, (uint16_t)rect.x,
                      (uint16_t)rect.YMost(), (uint16_t)rect.XMost() };
         SurfaceDescriptor currSurf;
-        currSurf = IOSurfaceDescriptor(mCurrentIOSurface->GetIOSurfaceID());
+        currSurf = IOSurfaceDescriptor(mDoubleBufferCARenderer.GetFrontSurfaceID());
 
         mHasPainted = true;
 
-        // Unused
         SurfaceDescriptor returnSurf;
 
         if (!SendShow(r, currSurf, &returnSurf)) {
             return false;
         }
 
+        SwapSurfaces();
         return true;
     } else {
         NS_ERROR("Unsupported drawing model for async layer rendering");
@@ -3511,19 +3504,32 @@ PluginInstanceChild::SwapSurfaces()
     mBackSurfaceActor = tmpactor;
 #endif
 
+#ifdef MOZ_WIDGET_COCOA
+    mDoubleBufferCARenderer.SwapSurfaces();
+
     // Outdated back surface... not usable anymore due to changed plugin size.
     // Dropping obsolete surface
-    if (mCurrentSurface && mBackSurface &&
-        (mCurrentSurface->GetSize() != mBackSurface->GetSize() ||
-         mCurrentSurface->GetContentType() != mBackSurface->GetContentType())) {
-        ClearCurrentSurface();
+    if (mDoubleBufferCARenderer.HasFrontSurface() && 
+        mDoubleBufferCARenderer.HasBackSurface() &&
+        (mDoubleBufferCARenderer.GetFrontSurfaceWidth() != 
+            mDoubleBufferCARenderer.GetBackSurfaceWidth() ||
+        mDoubleBufferCARenderer.GetFrontSurfaceHeight() != 
+            mDoubleBufferCARenderer.GetBackSurfaceHeight())) {
+
+        mDoubleBufferCARenderer.ClearFrontSurface();
     }
+#endif //MOZ_WIDGET_COCOA
 }
 
 void
 PluginInstanceChild::ClearCurrentSurface()
 {
     mCurrentSurface = nsnull;
+#ifdef MOZ_WIDGET_COCOA
+    if (mDoubleBufferCARenderer.HasFrontSurface()) {
+        mDoubleBufferCARenderer.ClearFrontSurface();
+    }
+#endif
 #ifdef XP_WIN
     if (mCurrentSurfaceActor) {
         PPluginSurfaceChild::Send__delete__(mCurrentSurfaceActor);
@@ -3542,6 +3548,7 @@ PluginInstanceChild::ClearAllSurfaces()
         NPRect r = { 0, 0, 1, 1 };
         SendShow(r, temp, &temp);
     }
+
     if (gfxSharedImageSurface::IsSharedImage(mCurrentSurface))
         DeallocShmem(static_cast<gfxSharedImageSurface*>(mCurrentSurface.get())->GetShmem());
     if (gfxSharedImageSurface::IsSharedImage(mBackSurface))
@@ -3560,8 +3567,8 @@ PluginInstanceChild::ClearAllSurfaces()
     }
 #endif
 
-#ifdef XP_MACOSX
-    if (mCurrentIOSurface) {
+#ifdef MOZ_WIDGET_COCOA
+    if (mDoubleBufferCARenderer.HasBackSurface()) {
         // Get last surface back, and drop it
         SurfaceDescriptor temp = null_t();
         NPRect r = { 0, 0, 1, 1 };
@@ -3573,7 +3580,8 @@ PluginInstanceChild::ClearAllSurfaces()
         mCGLayer = nsnull;
     }
 
-    mCurrentIOSurface = nsnull;
+    mDoubleBufferCARenderer.ClearFrontSurface();
+    mDoubleBufferCARenderer.ClearBackSurface();
 #endif
 }
 
diff --git a/dom/plugins/ipc/PluginInstanceChild.h b/dom/plugins/ipc/PluginInstanceChild.h
index 874d9b9663f6..21ef030fc687 100644
--- a/dom/plugins/ipc/PluginInstanceChild.h
+++ b/dom/plugins/ipc/PluginInstanceChild.h
@@ -46,8 +46,11 @@
 #if defined(OS_WIN)
 #include "mozilla/gfx/SharedDIBWin.h"
 #elif defined(MOZ_WIDGET_COCOA)
+#include "PluginUtilsOSX.h"
 #include "nsCoreAnimationSupport.h"
 #include "base/timer.h"
+
+using namespace mozilla::plugins::PluginUtilsOSX;
 #endif
 
 #include "npfunctions.h"
@@ -524,7 +527,7 @@ private:
 #ifdef XP_MACOSX
     // Current IOSurface available for rendering
     // We can't use thebes gfxASurface like other platforms.
-    nsAutoPtr<nsIOSurface> mCurrentIOSurface; 
+    nsDoubleBufferCARenderer mDoubleBufferCARenderer; 
 #endif
 
     // (Not to be confused with mBackSurface).  This is a recent copy
diff --git a/dom/plugins/ipc/PluginInstanceParent.cpp b/dom/plugins/ipc/PluginInstanceParent.cpp
index 58ecd63310a9..aca9ac726d3b 100644
--- a/dom/plugins/ipc/PluginInstanceParent.cpp
+++ b/dom/plugins/ipc/PluginInstanceParent.cpp
@@ -519,19 +519,22 @@ PluginInstanceParent::RecvShow(const NPRect& updatedRect,
     else if (newSurface.type() == SurfaceDescriptor::TIOSurfaceDescriptor) {
         IOSurfaceDescriptor iodesc = newSurface.get_IOSurfaceDescriptor();
     
-        nsIOSurface *newIOSurface = nsIOSurface::LookupSurface(iodesc.surfaceId());
+        nsRefPtr<nsIOSurface> newIOSurface = nsIOSurface::LookupSurface(iodesc.surfaceId());
 
         if (!newIOSurface) {
             NS_WARNING("Got bad IOSurfaceDescriptor in RecvShow");
             return false;
         }
       
+        if (mFrontIOSurface)
+            *prevSurface = IOSurfaceDescriptor(mFrontIOSurface->GetIOSurfaceID());
+        else
+            *prevSurface = null_t();
+
         mFrontIOSurface = newIOSurface;
 
         RecvNPN_InvalidateRect(updatedRect);
 
-        *prevSurface = null_t();
-
         PLUGIN_LOG_DEBUG(("   (RecvShow invalidated for surface %p)",
                           mFrontSurface.get()));
 
diff --git a/dom/plugins/ipc/PluginInstanceParent.h b/dom/plugins/ipc/PluginInstanceParent.h
index 460e46580b35..2543f5e74821 100644
--- a/dom/plugins/ipc/PluginInstanceParent.h
+++ b/dom/plugins/ipc/PluginInstanceParent.h
@@ -357,8 +357,8 @@ private:
     size_t                 mShHeight;
     CGColorSpaceRef        mShColorSpace;
     int16_t                mDrawingModel;
-    nsAutoPtr<nsIOSurface> mIOSurface;
-    nsAutoPtr<nsIOSurface> mFrontIOSurface;
+    nsRefPtr<nsIOSurface> mIOSurface;
+    nsRefPtr<nsIOSurface> mFrontIOSurface;
 #endif // definied(MOZ_WIDGET_COCOA)
 
     // ObjectFrame layer wrapper
diff --git a/dom/plugins/ipc/PluginUtilsOSX.h b/dom/plugins/ipc/PluginUtilsOSX.h
index cc9719f1c69d..c6b80ee4a03a 100644
--- a/dom/plugins/ipc/PluginUtilsOSX.h
+++ b/dom/plugins/ipc/PluginUtilsOSX.h
@@ -37,8 +37,12 @@
   *
   * ***** END LICENSE BLOCK ***** */
 
+#ifndef dom_plugins_PluginUtilsOSX_h
+#define dom_plugins_PluginUtilsOSX_h 1
+
 #include "npapi.h"
 #include "nsRect.h"
+#include "nsCoreAnimationSupport.h"
 
 namespace mozilla {
 namespace plugins {
@@ -60,6 +64,44 @@ void Repaint(void* cgLayer, nsIntRect aRect);
 
 bool SetProcessName(const char* aProcessName);
 
+/*
+ * Provides a wrapper around nsCARenderer to manage double buffering
+ * without having to unbind nsCARenderer on every surface swaps.
+ *
+ * The double buffer renderer begins with no initialize surfaces.
+ * The buffers can be initialized and cleared individually.
+ * Swapping still occurs regardless if the buffers are initialized.
+ */
+class THEBES_API nsDoubleBufferCARenderer {
+public:
+  nsDoubleBufferCARenderer() : mCALayer(nsnull) {}
+  size_t GetFrontSurfaceWidth();
+  size_t GetFrontSurfaceHeight();
+  size_t GetBackSurfaceWidth();
+  size_t GetBackSurfaceHeight();
+  IOSurfaceID GetFrontSurfaceID();
+
+  bool HasBackSurface();
+  bool HasFrontSurface();
+  bool HasCALayer();
+
+  void SetCALayer(void *aCALayer);
+  bool InitFrontSurface(size_t aWidth, size_t aHeight);
+  void Render();
+  void SwapSurfaces();
+  void ClearFrontSurface();
+  void ClearBackSurface();
+
+private:
+  void *mCALayer;
+  nsRefPtr<nsCARenderer> mFrontRenderer;
+  nsRefPtr<nsCARenderer> mBackRenderer;
+  nsRefPtr<nsIOSurface> mFrontSurface;
+  nsRefPtr<nsIOSurface> mBackSurface;
+};
+
 } // namespace PluginUtilsOSX
 } // namespace plugins
 } // namespace mozilla
+
+#endif //dom_plugins_PluginUtilsOSX_h
diff --git a/dom/plugins/ipc/PluginUtilsOSX.mm b/dom/plugins/ipc/PluginUtilsOSX.mm
index a91870f61756..3bad67a23417 100644
--- a/dom/plugins/ipc/PluginUtilsOSX.mm
+++ b/dom/plugins/ipc/PluginUtilsOSX.mm
@@ -177,8 +177,14 @@ void mozilla::plugins::PluginUtilsOSX::InvokeNativeEventLoop()
 
 
 #define UNDOCUMENTED_SESSION_CONSTANT ((int)-2)
-static void *mozilla::plugins::PluginUtilsOSX::sApplicationASN = NULL;
-static void *mozilla::plugins::PluginUtilsOSX::sApplicationInfoItem = NULL;
+namespace mozilla {
+namespace plugins {
+namespace PluginUtilsOSX {
+  static void *sApplicationASN = NULL;
+  static void *sApplicationInfoItem = NULL;
+}
+}
+}
 
 bool mozilla::plugins::PluginUtilsOSX::SetProcessName(const char* aProcessName) {
   NS_OBJC_BEGIN_TRY_ABORT_BLOCK;
@@ -270,3 +276,137 @@ bool mozilla::plugins::PluginUtilsOSX::SetProcessName(const char* aProcessName)
   return true;
   NS_OBJC_END_TRY_ABORT_BLOCK_RETURN(false);
 }
+
+namespace mozilla {
+namespace plugins {
+namespace PluginUtilsOSX {
+
+size_t nsDoubleBufferCARenderer::GetFrontSurfaceWidth() {
+  if (!HasFrontSurface()) {
+    return 0;
+  }
+
+  return mFrontSurface->GetWidth();
+}
+
+size_t nsDoubleBufferCARenderer::GetFrontSurfaceHeight() {
+  if (!HasFrontSurface()) {
+    return 0;
+  }
+
+  return mFrontSurface->GetHeight();
+}
+
+size_t nsDoubleBufferCARenderer::GetBackSurfaceWidth() {
+  if (!HasBackSurface()) {
+    return 0;
+  }
+
+  return mBackSurface->GetWidth();
+}
+
+size_t nsDoubleBufferCARenderer::GetBackSurfaceHeight() {
+  if (!HasBackSurface()) {
+    return 0;
+  }
+
+  return mBackSurface->GetHeight();
+}
+
+IOSurfaceID nsDoubleBufferCARenderer::GetFrontSurfaceID() {
+  if (!HasFrontSurface()) {
+    return 0;
+  }
+
+  return mFrontSurface->GetIOSurfaceID();
+}
+
+bool nsDoubleBufferCARenderer::HasBackSurface() {
+  return !!mBackSurface;
+}
+
+bool nsDoubleBufferCARenderer::HasFrontSurface() {
+  return !!mFrontSurface;
+}
+
+bool nsDoubleBufferCARenderer::HasCALayer() {
+  return !!mCALayer;
+}
+
+void nsDoubleBufferCARenderer::SetCALayer(void *aCALayer) {
+  mCALayer = aCALayer;
+}
+
+bool nsDoubleBufferCARenderer::InitFrontSurface(size_t aWidth, size_t aHeight) {
+  if (!mCALayer) {
+    return false;
+  }
+
+  mFrontSurface = nsIOSurface::CreateIOSurface(aWidth, aHeight);
+  if (!mFrontSurface) {
+    return false;
+  }
+
+  mFrontRenderer = new nsCARenderer();
+  if (!mFrontRenderer) {
+    mFrontSurface = nsnull;
+    return false;
+  }
+
+  nsRefPtr<nsIOSurface> ioSurface = nsIOSurface::LookupSurface(mFrontSurface->GetIOSurfaceID());
+  if (!ioSurface) {
+    mFrontRenderer = nsnull;
+    mFrontSurface = nsnull;
+    return false;
+  }
+
+  mFrontRenderer->AttachIOSurface(ioSurface);
+
+  nsresult result = mFrontRenderer->SetupRenderer(mCALayer, 
+                        ioSurface->GetWidth(), 
+                        ioSurface->GetHeight());
+
+  return result == NS_OK;
+}
+
+void nsDoubleBufferCARenderer::Render() {
+  if (!HasFrontSurface()) {
+    return;
+  }
+
+  mFrontRenderer->Render(GetFrontSurfaceWidth(), GetFrontSurfaceHeight(), nsnull);
+}
+
+void nsDoubleBufferCARenderer::SwapSurfaces() {
+  if (mFrontRenderer) {
+    mFrontRenderer->DettachCALayer();
+  }
+
+  nsRefPtr<nsCARenderer> prevFrontRenderer = mFrontRenderer;
+  nsRefPtr<nsIOSurface> prevFrontSurface = mFrontSurface;
+
+  mFrontRenderer = mBackRenderer;
+  mFrontSurface = mBackSurface;
+
+  mBackRenderer = prevFrontRenderer;
+  mBackSurface = prevFrontSurface;
+
+  if (mFrontRenderer) {
+    mFrontRenderer->AttachCALayer(mCALayer);
+  }
+}
+
+void nsDoubleBufferCARenderer::ClearFrontSurface() {
+  mFrontRenderer = nsnull;
+  mFrontSurface = nsnull;
+}
+
+void nsDoubleBufferCARenderer::ClearBackSurface() {
+  mBackRenderer = nsnull;
+  mBackSurface = nsnull;
+}
+
+} //PluginUtilsOSX
+} //plugins
+} //mozilla
+
diff --git a/dom/plugins/test/mochitest/utils.js b/dom/plugins/test/mochitest/utils.js
index c367a541391e..eb0f44354bd7 100644
--- a/dom/plugins/test/mochitest/utils.js
+++ b/dom/plugins/test/mochitest/utils.js
@@ -1,8 +1,7 @@
 function paintCountIs(plugin, expected, msg) {
   var count = plugin.getPaintCount();
   var realExpected = expected;
-  var isAsync = SimpleTest.testPluginIsOOP() &&
-    navigator.platform.indexOf("Mac") < 0;
+  var isAsync = SimpleTest.testPluginIsOOP();
   if (isAsync) {
     ++realExpected; // extra paint at startup for all async-rendering plugins
   } else {
diff --git a/dom/plugins/test/testplugin/Makefile.in b/dom/plugins/test/testplugin/Makefile.in
index a1648c0aec21..4c2c6b77ef64 100644
--- a/dom/plugins/test/testplugin/Makefile.in
+++ b/dom/plugins/test/testplugin/Makefile.in
@@ -98,6 +98,9 @@ RCFILE    = nptest.rc
 RESFILE   = nptest.res
 DEFFILE   = $(win_srcdir)/nptest.def
 OS_LIBS  += $(call EXPAND_LIBNAME,msimg32)
+
+# Windows opt builds without PGO break nptest.dll
+MOZ_OPTIMIZE=
 endif
 
 include $(topsrcdir)/config/rules.mk
diff --git a/dom/system/nsDeviceMotion.cpp b/dom/system/nsDeviceMotion.cpp
index 19246fc3f77b..414cfa9cd747 100644
--- a/dom/system/nsDeviceMotion.cpp
+++ b/dom/system/nsDeviceMotion.cpp
@@ -163,7 +163,7 @@ nsDeviceMotion::TimeoutHandler(nsITimer *aTimer, void *aClosure)
   }
   
   // what about listeners that don't clean up properly?  they will leak
-  if (self->mListeners.Count() == 0 && self->mWindowListeners.Count() == 0) {
+  if (self->mListeners.Count() == 0 && self->mWindowListeners.Length() == 0) {
     self->Shutdown();
     self->mStarted = PR_FALSE;
   }
@@ -195,26 +195,18 @@ NS_IMETHODIMP nsDeviceMotion::RemoveListener(nsIDeviceMotionListener *aListener)
 
 NS_IMETHODIMP nsDeviceMotion::AddWindowListener(nsIDOMWindow *aWindow)
 {
-  if (mWindowListeners.IndexOf(aWindow) >= 0)
-    return NS_OK; // already exists
-
   if (mStarted == PR_FALSE) {
     mStarted = PR_TRUE;
     Startup();
   }
-
-  mWindowListeners.AppendObject(aWindow);
+  mWindowListeners.AppendElement(aWindow);
   return NS_OK;
 }
 
 NS_IMETHODIMP nsDeviceMotion::RemoveWindowListener(nsIDOMWindow *aWindow)
 {
-  if (mWindowListeners.IndexOf(aWindow) < 0)
-    return NS_OK; // doesn't exist
-
-  mWindowListeners.RemoveObject(aWindow);
+  mWindowListeners.RemoveElement(aWindow);
   StartDisconnectTimer();
-
   return NS_OK;
 }
 
@@ -230,7 +222,7 @@ nsDeviceMotion::DeviceMotionChanged(PRUint32 type, double x, double y, double z)
     mListeners[i]->OnMotionChange(a);
   }
 
-  for (PRUint32 i = mWindowListeners.Count(); i > 0 ; ) {
+  for (PRUint32 i = mWindowListeners.Length(); i > 0 ; ) {
     --i;
 
     nsCOMPtr<nsIDOMDocument> domdoc;
diff --git a/dom/system/nsDeviceMotion.h b/dom/system/nsDeviceMotion.h
index 6ff77ede89b7..3d4ac3ad5b22 100644
--- a/dom/system/nsDeviceMotion.h
+++ b/dom/system/nsDeviceMotion.h
@@ -40,6 +40,7 @@
 #include "nsIDeviceMotion.h"
 #include "nsIDOMDeviceMotionEvent.h"
 #include "nsCOMArray.h"
+#include "nsTPtrArray.h"
 #include "nsCOMPtr.h"
 #include "nsITimer.h"
 
@@ -64,7 +65,7 @@ public:
 
 private:
   nsCOMArray<nsIDeviceMotionListener> mListeners;
-  nsCOMArray<nsIDOMWindow> mWindowListeners;
+  nsTPtrArray<nsIDOMWindow> mWindowListeners;
 
   void StartDisconnectTimer();
 
diff --git a/dom/tests/mochitest/Makefile.in b/dom/tests/mochitest/Makefile.in
index 64a343eb641a..5dcf7c3f84ee 100644
--- a/dom/tests/mochitest/Makefile.in
+++ b/dom/tests/mochitest/Makefile.in
@@ -55,6 +55,7 @@ DIRS	+= \
 	geolocation \
 	globalstorage \
 	localstorage \
+	orientation \
 	sessionstorage \
 	storageevent \
 	$(NULL)
diff --git a/dom/tests/mochitest/orientation/Makefile.in b/dom/tests/mochitest/orientation/Makefile.in
new file mode 100644
index 000000000000..26f070525b4f
--- /dev/null
+++ b/dom/tests/mochitest/orientation/Makefile.in
@@ -0,0 +1,53 @@
+# ***** BEGIN LICENSE BLOCK *****
+# Version: MPL 1.1/GPL 2.0/LGPL 2.1
+#
+# The contents of this file are subject to the Mozilla Public License Version
+# 1.1 (the "License"); you may not use this file except in compliance with
+# the License. You may obtain a copy of the License at
+# http://www.mozilla.org/MPL/
+#
+# Software distributed under the License is distributed on an "AS IS" basis,
+# WITHOUT WARRANTY OF ANY KIND, either express or implied. See the License
+# for the specific language governing rights and limitations under the
+# License.
+#
+# The Original Code is mozilla.org build system.
+#
+# The Initial Developer of the Original Code is Mozilla Foundation
+# Portions created by the Initial Developer are Copyright (C) 2011
+# the Initial Developer. All Rights Reserved.
+#
+# Contributor(s):
+#  Doug Turner <dougt@dougt.org>
+#
+# Alternatively, the contents of this file may be used under the terms of
+# either the GNU General Public License Version 2 or later (the "GPL"), or
+# the GNU Lesser General Public License Version 2.1 or later (the "LGPL"),
+# in which case the provisions of the GPL or the LGPL are applicable instead
+# of those above. If you wish to allow use of your version of this file only
+# under the terms of either the GPL or the LGPL, and not to allow others to
+# use your version of this file under the terms of the MPL, indicate your
+# decision by deleting the provisions above and replace them with the notice
+# and other provisions required by the GPL or the LGPL. If you do not delete
+# the provisions above, a recipient may use your version of this file under
+# the terms of any one of the MPL, the GPL or the LGPL.
+#
+# ***** END LICENSE BLOCK *****
+
+DEPTH		= ../../../..
+topsrcdir	= @top_srcdir@
+srcdir		= @srcdir@
+VPATH		= @srcdir@
+relativesrcdir	= dom/tests/mochitest/orientation
+
+include $(DEPTH)/config/autoconf.mk
+
+include $(topsrcdir)/config/rules.mk
+
+_TEST_FILES	= \
+		test_bug507902.html \
+		$(NULL)
+
+libs:: 	$(_TEST_FILES)
+	$(INSTALL) $(foreach f,$^,"$f") $(DEPTH)/_tests/testing/mochitest/tests/$(relativesrcdir)
+
diff --git a/dom/tests/mochitest/orientation/test_bug507902.html b/dom/tests/mochitest/orientation/test_bug507902.html
new file mode 100644
index 000000000000..088e936af392
--- /dev/null
+++ b/dom/tests/mochitest/orientation/test_bug507902.html
@@ -0,0 +1,39 @@
+<!DOCTYPE HTML>
+<html>
+<!--
+https://bugzilla.mozilla.org/show_bug.cgi?id=507902
+-->
+<head>
+  <title>Test for watchPosition </title>
+  <script type="text/javascript" src="/MochiKit/packed.js"></script>
+  <script type="text/javascript" src="/tests/SimpleTest/SimpleTest.js"></script>
+  <link rel="stylesheet" type="text/css" href="/tests/SimpleTest/test.css" />
+</head>
+<body>
+<a target="_blank" href="https://bugzilla.mozilla.org/show_bug.cgi?id=507902">Mozilla Bug 507902</a>
+<p id="display"></p>
+<div id="content" style="display: none">
+  
+</div>
+<pre id="test">
+<script class="testbody" type="text/javascript">
+
+function boom()
+{
+  window.addEventListener("unload", function(){}, false);
+  window.addEventListener("devicemotion", function(){}, false);
+  location = "data:text/html,2";
+
+  ok(1, "leak will be at the end of mochitests. so pass.");
+  SimpleTest.finish();
+}
+
+SimpleTest.waitForExplicitFinish();
+
+window.addEventListener("load", function() { setTimeout(boom, 0); }, false);
+
+</script>
+</pre>
+</body>
+</html>
+
diff --git a/embedding/android/AndroidManifest.xml.in b/embedding/android/AndroidManifest.xml.in
index 1768d05d236d..6f10cc73c879 100644
--- a/embedding/android/AndroidManifest.xml.in
+++ b/embedding/android/AndroidManifest.xml.in
@@ -13,6 +13,7 @@
     <uses-permission android:name="android.permission.ACCESS_NETWORK_STATE"/>
     <uses-permission android:name="android.permission.INTERNET"/>
     <uses-permission android:name="android.permission.WRITE_EXTERNAL_STORAGE"/>
+    <uses-permission android:name="android.permission.READ_PHONE_STATE"/>
     <uses-permission android:name="com.android.launcher.permission.INSTALL_SHORTCUT"/>
 
     <uses-feature android:name="android.hardware.location" android:required="false"/>
diff --git a/embedding/android/GeckoApp.java b/embedding/android/GeckoApp.java
index 8a851640f60f..524939167ddb 100644
--- a/embedding/android/GeckoApp.java
+++ b/embedding/android/GeckoApp.java
@@ -61,6 +61,7 @@ import android.util.*;
 import android.net.*;
 import android.database.*;
 import android.provider.*;
+import android.telephony.*;
 
 abstract public class GeckoApp
     extends Activity
@@ -77,6 +78,7 @@ abstract public class GeckoApp
     public Handler mMainHandler;
     private IntentFilter mConnectivityFilter;
     private BroadcastReceiver mConnectivityReceiver;
+    private PhoneStateListener mPhoneStateListener;
 
     enum LaunchState {PreLaunch, Launching, WaitButton,
                       Launched, GeckoRunning, GeckoExiting};
@@ -232,6 +234,8 @@ abstract public class GeckoApp
         mConnectivityFilter.addAction(ConnectivityManager.CONNECTIVITY_ACTION);
         mConnectivityReceiver = new GeckoConnectivityReceiver();
 
+        mPhoneStateListener = new GeckoPhoneStateListener();
+
         if (!checkAndSetLaunchState(LaunchState.PreLaunch,
                                     LaunchState.Launching))
             return;
@@ -326,6 +330,10 @@ abstract public class GeckoApp
         super.onPause();
 
         unregisterReceiver(mConnectivityReceiver);
+
+        TelephonyManager tm = (TelephonyManager)
+            GeckoApp.mAppContext.getSystemService(Context.TELEPHONY_SERVICE);
+        tm.listen(mPhoneStateListener, PhoneStateListener.LISTEN_NONE);
     }
 
     @Override
@@ -344,6 +352,13 @@ abstract public class GeckoApp
             onNewIntent(getIntent());
 
         registerReceiver(mConnectivityReceiver, mConnectivityFilter);
+
+        TelephonyManager tm = (TelephonyManager)
+            GeckoApp.mAppContext.getSystemService(Context.TELEPHONY_SERVICE);
+        tm.listen(mPhoneStateListener, PhoneStateListener.LISTEN_DATA_CONNECTION_STATE);
+
+        // Notify if network state changed since we paused
+        GeckoAppShell.onNetworkStateChange(true);
     }
 
     @Override
diff --git a/embedding/android/GeckoAppShell.java b/embedding/android/GeckoAppShell.java
index 76a150fd4ea0..0a7638ade555 100644
--- a/embedding/android/GeckoAppShell.java
+++ b/embedding/android/GeckoAppShell.java
@@ -58,6 +58,7 @@ import android.graphics.*;
 import android.widget.*;
 import android.hardware.*;
 import android.location.*;
+import android.telephony.*;
 import android.webkit.MimeTypeMap;
 import android.media.MediaScannerConnection;
 import android.media.MediaScannerConnection.MediaScannerConnectionClient;
@@ -94,6 +95,10 @@ public class GeckoAppShell
     static private File sCacheFile = null;
     static private int sFreeSpace = -1;
 
+    static private String sNetworkState = "unknown";
+    static private String sNetworkType = "unknown";
+    static private int sNetworkTypeCode = 0;
+
     /* The Android-side API: API methods that Android calls */
 
     // Initialization methods
@@ -108,7 +113,7 @@ public class GeckoAppShell
     public static native void callObserver(String observerKey, String topic, String data);
     public static native void removeObserver(String observerKey);
     public static native void loadLibs(String apkName, boolean shouldExtract);
-    public static native void onChangeNetworkLinkStatus(String status);
+    public static native void onChangeNetworkLinkStatus(String status, String type);
     public static native void reportJavaCrash(String stack);
 
     // A looper thread, accessed by GeckoAppShell.getHandler
@@ -654,6 +659,9 @@ public class GeckoAppShell
         // mLaunchState can only be Launched at this point
         GeckoApp.setLaunchState(GeckoApp.LaunchState.GeckoRunning);
         sendPendingEventsToGecko();
+
+        // Refresh the network connectivity state
+        onNetworkStateChange(false);
     }
 
     static void onXreExit() {
@@ -1010,20 +1018,92 @@ public class GeckoAppShell
     }
 
     public static boolean isNetworkLinkUp() {
-        ConnectivityManager cm = (ConnectivityManager)
-            GeckoApp.mAppContext.getSystemService(Context.CONNECTIVITY_SERVICE);
-        NetworkInfo info = cm.getActiveNetworkInfo();
-        if (info == null || !info.isConnected())
+        if (sNetworkState == "up")
+            return true;
+        return false;
+    }
+
+    public static boolean isNetworkLinkKnown() {
+        if (sNetworkState == "unknown")
             return false;
         return true;
     }
 
-    public static boolean isNetworkLinkKnown() {
+    public static int getNetworkLinkType() {
+        return sNetworkTypeCode;
+    }
+
+    public static void onNetworkStateChange(boolean notifyChanged) {
+        String state;
+        String type;
+        int typeCode;
+
         ConnectivityManager cm = (ConnectivityManager)
             GeckoApp.mAppContext.getSystemService(Context.CONNECTIVITY_SERVICE);
-        if (cm.getActiveNetworkInfo() == null)
-            return false;
-        return true;
+        NetworkInfo info = cm.getActiveNetworkInfo();
+
+        // Note, these strings and codes correspond to those specified in
+        // nsINetworkLinkService. Make sure to keep them in sync!
+        type = "unknown";
+        typeCode = 0;
+        if (info == null) {
+            state = "unknown";
+        } else if (!info.isConnected()) {
+            state = "down";
+        } else {
+            state = "up";
+
+            int androidType = info.getType();
+
+            if (androidType == ConnectivityManager.TYPE_WIFI) {
+                type = "wifi";
+                typeCode = 3;
+            } else if (androidType == ConnectivityManager.TYPE_WIMAX) {
+                type = "wimax";
+                typeCode = 4;
+            } else if (androidType == ConnectivityManager.TYPE_MOBILE) {
+                TelephonyManager tm = (TelephonyManager)
+                    GeckoApp.mAppContext.getSystemService(Context.TELEPHONY_SERVICE);
+                typeCode = tm.getNetworkType();
+
+                // Note that the value of some of these constants are used due
+                // to not all of these existing in API level 8.
+                //
+                // In particular, EVDO_B appears at level 9, and EHRPD and LTE
+                // appear at level 11.
+                if (androidType == TelephonyManager.NETWORK_TYPE_GPRS ||
+                    androidType == TelephonyManager.NETWORK_TYPE_EDGE ||
+                    androidType == TelephonyManager.NETWORK_TYPE_CDMA ||
+                    androidType == TelephonyManager.NETWORK_TYPE_IDEN ||
+                    androidType == TelephonyManager.NETWORK_TYPE_1xRTT) {
+                    type = "2g";
+                    typeCode = 5;
+                } else if (androidType == TelephonyManager.NETWORK_TYPE_UMTS ||
+                           androidType == TelephonyManager.NETWORK_TYPE_HSDPA ||
+                           androidType == TelephonyManager.NETWORK_TYPE_HSUPA ||
+                           androidType == TelephonyManager.NETWORK_TYPE_HSPA ||
+                           androidType == TelephonyManager.NETWORK_TYPE_EVDO_0 ||
+                           androidType == TelephonyManager.NETWORK_TYPE_EVDO_A ||
+                           androidType == 12 || // TelephonyManager.NETWORK_TYPE_EVDO_B
+                           androidType == 14) { // TelephonyManager.NETWORK_TYPE_EHRPD
+                    type = "3g";
+                    typeCode = 6;
+                } else if (androidType == 13) { // TelephonyManager.NETWORK_TYPE_LTE
+                    type = "4g";
+                    typeCode = 7;
+                }
+            }
+        }
+
+        // If the network state has changed, notify Gecko
+        if (notifyChanged && (state != sNetworkState || typeCode != sNetworkTypeCode)) {
+            Log.i("GeckoAppShell", "Network state changed: (" + state + ", " + type + ") ");
+            sNetworkState = state;
+            sNetworkType = type;
+            sNetworkTypeCode = typeCode;
+            if (GeckoApp.checkLaunchState(GeckoApp.LaunchState.GeckoRunning))
+                onChangeNetworkLinkStatus(sNetworkState, sNetworkType);
+        }
     }
 
     public static void setSelectedLocale(String localeCode) {
diff --git a/embedding/android/GeckoConnectivityReceiver.java b/embedding/android/GeckoConnectivityReceiver.java
index ffabc9a547d7..18c7724c5576 100644
--- a/embedding/android/GeckoConnectivityReceiver.java
+++ b/embedding/android/GeckoConnectivityReceiver.java
@@ -38,25 +38,12 @@
 package org.mozilla.gecko;
 
 import android.content.*;
-import android.net.*;
 
 public class GeckoConnectivityReceiver
     extends BroadcastReceiver
 {
     @Override
     public void onReceive(Context context, Intent intent) {
-        String status;
-        ConnectivityManager cm = (ConnectivityManager)
-            context.getSystemService(Context.CONNECTIVITY_SERVICE);
-        NetworkInfo info = cm.getActiveNetworkInfo();
-        if (info == null)
-            status = "unknown";
-        else if (!info.isConnected())
-            status = "down";
-        else
-            status = "up";
-
-        if (GeckoApp.checkLaunchState(GeckoApp.LaunchState.GeckoRunning))
-            GeckoAppShell.onChangeNetworkLinkStatus(status);
+        GeckoAppShell.onNetworkStateChange(true);
     }
 }
diff --git a/browser/themes/pinstripe/browser/highlighter.css b/embedding/android/GeckoPhoneStateListener.java
similarity index 57%
rename from browser/themes/pinstripe/browser/highlighter.css
rename to embedding/android/GeckoPhoneStateListener.java
index 6be6bd600bc8..58f5f8118e56 100644
--- a/browser/themes/pinstripe/browser/highlighter.css
+++ b/embedding/android/GeckoPhoneStateListener.java
@@ -1,4 +1,5 @@
-/* ***** BEGIN LICENSE BLOCK *****
+/* -*- Mode: Java; c-basic-offset: 4; tab-width: 20; indent-tabs-mode: nil; -*-
+ * ***** BEGIN LICENSE BLOCK *****
  * Version: MPL 1.1/GPL 2.0/LGPL 2.1
  *
  * The contents of this file are subject to the Mozilla Public License Version
@@ -11,16 +12,14 @@
  * for the specific language governing rights and limitations under the
  * License.
  *
- * The Original Code is the Mozilla Inspector Module.
+ * The Original Code is Mozilla Android code.
  *
- * The Initial Developer of the Original Code is
- * The Mozilla Foundation.
+ * The Initial Developer of the Original Code is Mozilla Foundation.
  * Portions created by the Initial Developer are Copyright (C) 2011
  * the Initial Developer. All Rights Reserved.
  *
  * Contributor(s):
- *   Rob Campbell <rcampbell@mozilla.com> (original author)
- *   Paul Rouget <paul@mozilla.com>
+ *   Chris Lord <chrislord.net@gmail.com>
  *
  * Alternatively, the contents of this file may be used under the terms of
  * either the GNU General Public License Version 2 or later (the "GPL"), or
@@ -36,69 +35,16 @@
  *
  * ***** END LICENSE BLOCK ***** */
 
-body {
-  margin: 0;
-  overflow: hidden;
+package org.mozilla.gecko;
+
+import android.telephony.*;
+
+public class GeckoPhoneStateListener
+    extends PhoneStateListener
+{
+    @Override
+    public void onDataConnectionStateChanged(int state, int networkType) {
+        GeckoAppShell.onNetworkStateChange(true);
+    }
 }
 
-#close-button {
-  background-image: url("KUI-close.png");
-  border: none;
-  padding: 0;
-  width: 24px;
-  height: 24px;
-  position: fixed;
-  top: 12px;
-  right: 12px;
-  z-index: 1;
-  cursor: pointer;
-}
-
-.veil {
-  background-color: rgba(0, 0, 0, 0.5);
-}
-
-.veil, #veil-middlebox, #veil-transparentbox {
-  -moz-transition: 0.1s;
-  -moz-transition-timing-function: linear;
-}
-
-#veil-container {
-  position: absolute;
-  top: 0;
-  left: 0;
-  width: 100%;
-  height: 100%;
-}
-
-#veil {
-  width: 100%;
-  height: 100%;
-  display: -moz-box;
-  -moz-box-orient: vertical;
-}
-
-#veil-topbox, #veil-bottombox {
-  width: 100%;
-}
-
-#veil-bottombox {
-  -moz-box-flex: 1;
-}
-
-#veil-middlebox {
-  display: -moz-box;
-  -moz-box-orient: horizontal;
-}
-
-#veil-leftbox, #veil-rightbox {
-  height: 100%;
-}
-
-#veil-rightbox {
-  -moz-box-flex: 1;
-}
-
-#veil {
-  vertical-align: top;
-}
diff --git a/embedding/android/Makefile.in b/embedding/android/Makefile.in
index 136ceb0c471e..dd8f9cda55d6 100644
--- a/embedding/android/Makefile.in
+++ b/embedding/android/Makefile.in
@@ -52,6 +52,7 @@ JAVAFILES = \
   GeckoEvent.java \
   GeckoSurfaceView.java \
   GeckoInputConnection.java \
+  GeckoPhoneStateListener.java \
   AlertNotification.java \
   $(NULL)
 
diff --git a/embedding/components/windowwatcher/src/nsAutoWindowStateHelper.cpp b/embedding/components/windowwatcher/src/nsAutoWindowStateHelper.cpp
index d44166eb763e..f7a0e669334b 100644
--- a/embedding/components/windowwatcher/src/nsAutoWindowStateHelper.cpp
+++ b/embedding/components/windowwatcher/src/nsAutoWindowStateHelper.cpp
@@ -1,4 +1,4 @@
-/* -*- Mode: C++; tab-width: 2; indent-tabs-mode: nil; c-basic-offset: 4 -*- */
+/* -*- Mode: C++; tab-width: 2; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
 /* ***** BEGIN LICENSE BLOCK *****
  * Version: MPL 1.1/GPL 2.0/LGPL 2.1
  *
@@ -75,38 +75,11 @@ nsAutoWindowStateHelper::~nsAutoWindowStateHelper()
 PRBool
 nsAutoWindowStateHelper::DispatchCustomEvent(const char *aEventName)
 {
-  if (!mWindow) {
+  nsCOMPtr<nsPIDOMWindow> window = do_QueryInterface(mWindow);
+  if (!window) {
     return PR_TRUE;
   }
 
-#ifdef DEBUG
-  {
-    nsCOMPtr<nsPIDOMWindow> window(do_QueryInterface(mWindow));
-  }
-#endif
-
-  nsCOMPtr<nsIDOMDocument> domdoc;
-  mWindow->GetDocument(getter_AddRefs(domdoc));
-
-  nsCOMPtr<nsIDOMEvent> event;
-
-  PRBool defaultActionEnabled = PR_TRUE;
-
-  if (domdoc) {
-    domdoc->CreateEvent(NS_LITERAL_STRING("Events"), getter_AddRefs(event));
-
-    nsCOMPtr<nsIPrivateDOMEvent> privateEvent(do_QueryInterface(event));
-    if (privateEvent) {
-      event->InitEvent(NS_ConvertASCIItoUTF16(aEventName), PR_TRUE, PR_TRUE);
-
-      privateEvent->SetTrusted(PR_TRUE);
-
-      nsCOMPtr<nsIDOMEventTarget> target(do_QueryInterface(mWindow));
-
-      target->DispatchEvent(event, &defaultActionEnabled);
-    }
-  }
-
-  return defaultActionEnabled;
+  return window->DispatchCustomEvent(aEventName);
 }
 
diff --git a/gfx/cairo/README b/gfx/cairo/README
index b96e1e61e093..1286ef86e70f 100644
--- a/gfx/cairo/README
+++ b/gfx/cairo/README
@@ -166,6 +166,8 @@ fix-cairo-win32-print-gdi-error.diff: Don't use fwprintf with char* format.  Flu
 
 pixman-image-transform.patch: Reset the transform on pixman images when using them as destinations.
 
+fix-cairo-surface-wrapper-flush-build-warning.patch: Ensures that _cairo_surface_wrapper_flush always returns a status, to silence the build warning
+
 ==== pixman patches ====
 
 pixman-android-cpu-detect.patch: Add CPU detection support for Android, where we can't reliably access /proc/self/auxv.
diff --git a/gfx/cairo/cairo/src/cairo-surface-wrapper.c b/gfx/cairo/cairo/src/cairo-surface-wrapper.c
index fb4b0577af6b..86fdf8be31ea 100644
--- a/gfx/cairo/cairo/src/cairo-surface-wrapper.c
+++ b/gfx/cairo/cairo/src/cairo-surface-wrapper.c
@@ -717,4 +717,5 @@ _cairo_surface_wrapper_flush (cairo_surface_wrapper_t *wrapper)
     if (wrapper->target->backend->flush) {
 	return wrapper->target->backend->flush(wrapper->target);
     }
+    return CAIRO_STATUS_SUCCESS;
 }
diff --git a/gfx/cairo/fix-cairo-surface-wrapper-flush-build-warning.patch b/gfx/cairo/fix-cairo-surface-wrapper-flush-build-warning.patch
new file mode 100644
index 000000000000..0e7c0b973a73
--- /dev/null
+++ b/gfx/cairo/fix-cairo-surface-wrapper-flush-build-warning.patch
@@ -0,0 +1,19 @@
+# HG changeset patch
+# Parent 5479a346b95b82162c72419a95cbb4022cbbfe4d
+# User Ed Morley <bmo@edmorley.co.uk>
+Bug 631155 - undefined return value in function '_cairo_surface_wrapper_flush'; r=jrmuizel
+
+diff --git a/gfx/cairo/cairo/src/cairo-surface-wrapper.c b/gfx/cairo/cairo/src/cairo-surface-wrapper.c
+--- a/gfx/cairo/cairo/src/cairo-surface-wrapper.c
++++ b/gfx/cairo/cairo/src/cairo-surface-wrapper.c
+@@ -712,9 +712,10 @@ _cairo_surface_wrapper_fini (cairo_surfa
+ }
+ 
+ cairo_status_t
+ _cairo_surface_wrapper_flush (cairo_surface_wrapper_t *wrapper)
+ {
+     if (wrapper->target->backend->flush) {
+ 	return wrapper->target->backend->flush(wrapper->target);
+     }
++    return CAIRO_STATUS_SUCCESS;
+ }
diff --git a/gfx/layers/opengl/MacIOSurfaceImageOGL.h b/gfx/layers/opengl/MacIOSurfaceImageOGL.h
index 4594d502fd18..fac9ebc202a4 100644
--- a/gfx/layers/opengl/MacIOSurfaceImageOGL.h
+++ b/gfx/layers/opengl/MacIOSurfaceImageOGL.h
@@ -60,7 +60,7 @@ public:
 
   GLTexture mTexture;
   gfxIntSize mSize;
-  nsAutoPtr<nsIOSurface> mIOSurface;
+  nsRefPtr<nsIOSurface> mIOSurface;
   void* mPluginInstanceOwner;
   UpdateSurfaceCallback mUpdateCallback;
   DestroyCallback mDestroyCallback;
diff --git a/gfx/src/nsCoord.h b/gfx/src/nsCoord.h
index 89d5014cc564..b5f5bce3e28e 100644
--- a/gfx/src/nsCoord.h
+++ b/gfx/src/nsCoord.h
@@ -98,6 +98,15 @@ inline nscoord NSToCoordRound(float aValue)
 #endif /* XP_WIN32 && _M_IX86 && !__GNUC__ */
 }
 
+inline nscoord NSToCoordRound(double aValue)
+{
+#if defined(XP_WIN32) && defined(_M_IX86) && !defined(__GNUC__)
+  return NS_lroundup30((float)aValue);
+#else
+  return nscoord(NS_floor(aValue + 0.5f));
+#endif /* XP_WIN32 && _M_IX86 && !__GNUC__ */
+}
+
 inline nscoord NSToCoordRoundWithClamp(float aValue)
 {
 #ifndef NS_COORD_IS_FLOAT
@@ -354,6 +363,11 @@ inline nscoord NSToCoordFloor(float aValue)
   return nscoord(NS_floorf(aValue));
 }
 
+inline nscoord NSToCoordFloor(double aValue)
+{
+  return nscoord(NS_floor(aValue));
+}
+
 inline nscoord NSToCoordFloorClamped(float aValue)
 {
 #ifndef NS_COORD_IS_FLOAT
@@ -377,6 +391,11 @@ inline nscoord NSToCoordCeil(float aValue)
   return nscoord(NS_ceilf(aValue));
 }
 
+inline nscoord NSToCoordCeil(double aValue)
+{
+  return nscoord(NS_ceil(aValue));
+}
+
 inline nscoord NSToCoordCeilClamped(float aValue)
 {
 #ifndef NS_COORD_IS_FLOAT
@@ -395,6 +414,24 @@ inline nscoord NSToCoordCeilClamped(float aValue)
   return NSToCoordCeil(aValue);
 }
 
+inline nscoord NSToCoordCeilClamped(double aValue)
+{
+#ifndef NS_COORD_IS_FLOAT
+  // Bounds-check before converting out of double, to avoid overflow
+  NS_WARN_IF_FALSE(aValue <= nscoord_MAX,
+                   "Overflowed nscoord_MAX in conversion to nscoord");
+  if (aValue >= nscoord_MAX) {
+    return nscoord_MAX;
+  }
+  NS_WARN_IF_FALSE(aValue >= nscoord_MIN,
+                   "Overflowed nscoord_MIN in conversion to nscoord");
+  if (aValue <= nscoord_MIN) {
+    return nscoord_MIN;
+  }
+#endif
+  return NSToCoordCeil(aValue);
+}
+
 /*
  * Int Rounding Functions
  */
@@ -413,6 +450,11 @@ inline PRInt32 NSToIntRound(float aValue)
   return NS_lroundf(aValue);
 }
 
+inline PRInt32 NSToIntRound(double aValue)
+{
+  return NS_lround(aValue);
+}
+
 inline PRInt32 NSToIntRoundUp(float aValue)
 {
   return PRInt32(NS_floorf(aValue + 0.5f));
diff --git a/gfx/src/nsRect.cpp b/gfx/src/nsRect.cpp
index 1c89cb3d1165..4fa72cde86d8 100644
--- a/gfx/src/nsRect.cpp
+++ b/gfx/src/nsRect.cpp
@@ -47,13 +47,6 @@ PR_STATIC_ASSERT((NS_SIDE_TOP == 0) && (NS_SIDE_RIGHT == 1) && (NS_SIDE_BOTTOM =
 /* static */
 const nsIntRect nsIntRect::kMaxSizedIntRect(0, 0, INT_MAX, INT_MAX);
 
-#ifdef DEBUG
-static bool IsFloatInteger(float aFloat)
-{
-  return fabs(aFloat - NS_round(aFloat)) < 1e-6;
-}
-#endif
-
 #ifdef DEBUG
 // Diagnostics
 
diff --git a/gfx/thebes/GLContext.cpp b/gfx/thebes/GLContext.cpp
index e3a4bb48735e..c5ddefca12c6 100644
--- a/gfx/thebes/GLContext.cpp
+++ b/gfx/thebes/GLContext.cpp
@@ -1009,21 +1009,22 @@ GLContext::ResizeOffscreenFBO(const gfxIntSize& aSize)
             if (mIsGLES2) {
                 if (IsExtensionSupported(OES_depth32)) {
                     depthType = LOCAL_GL_DEPTH_COMPONENT32;
+                    cf.depth = 32;
                 } else if (IsExtensionSupported(OES_depth24)) {
                     depthType = LOCAL_GL_DEPTH_COMPONENT24;
+                    cf.depth = 24;
                 } else {
                     depthType = LOCAL_GL_DEPTH_COMPONENT16;
+                   cf.depth = 16;
                 }
             } else {
                 depthType = LOCAL_GL_DEPTH_COMPONENT24;
+                cf.depth = 24;
             }
 
             fBindRenderbuffer(LOCAL_GL_RENDERBUFFER, mOffscreenDepthRB);
-            fRenderbufferStorage(LOCAL_GL_RENDERBUFFER,
-                                 mIsGLES2 ? LOCAL_GL_DEPTH_COMPONENT16
-                                          : LOCAL_GL_DEPTH_COMPONENT24,
+            fRenderbufferStorage(LOCAL_GL_RENDERBUFFER, depthType,
                                  aSize.width, aSize.height);
-            cf.depth = mIsGLES2 ? 16 : 24;
         }
 
         if (stencil) {
diff --git a/gfx/thebes/gfxFT2Fonts.cpp b/gfx/thebes/gfxFT2Fonts.cpp
index 088da9c55d97..f98d667cfcb2 100644
--- a/gfx/thebes/gfxFT2Fonts.cpp
+++ b/gfx/thebes/gfxFT2Fonts.cpp
@@ -339,8 +339,9 @@ FontFamily::FindStyleVariations()
 
 PRBool
 gfxFT2FontGroup::FontCallback(const nsAString& fontName,
-                             const nsACString& genericName,
-                             void *closure)
+                              const nsACString& genericName,
+                              PRBool aUseFontSet,
+                              void *closure)
 {
     nsTArray<nsString> *sa = static_cast<nsTArray<nsString>*>(closure);
 
@@ -449,6 +450,7 @@ PRUint32 getUTF8CharAndNext(const PRUint8 *aString, PRUint8 *aLength)
 static PRBool
 AddFontNameToArray(const nsAString& aName,
                    const nsACString& aGenericName,
+                   PRBool aUseFontSet,
                    void *aClosure)
 {
     if (!aName.IsEmpty()) {
diff --git a/gfx/thebes/gfxFT2Fonts.h b/gfx/thebes/gfxFT2Fonts.h
index 37c1cb11f92e..df14e16f3767 100644
--- a/gfx/thebes/gfxFT2Fonts.h
+++ b/gfx/thebes/gfxFT2Fonts.h
@@ -199,6 +199,7 @@ protected: // new functions
 
     static PRBool FontCallback (const nsAString & fontName, 
                                 const nsACString & genericName, 
+                                PRBool aUseFontSet,
                                 void *closure);
     PRBool mEnableKerning;
 
diff --git a/gfx/thebes/gfxFont.cpp b/gfx/thebes/gfxFont.cpp
index 82d160666cad..6510420b721b 100644
--- a/gfx/thebes/gfxFont.cpp
+++ b/gfx/thebes/gfxFont.cpp
@@ -2060,6 +2060,7 @@ gfxFontGroup::BuildFontList()
 PRBool
 gfxFontGroup::FindPlatformFont(const nsAString& aName,
                                const nsACString& aGenericName,
+                               PRBool aUseFontSet,
                                void *aClosure)
 {
     gfxFontGroup *fontGroup = static_cast<gfxFontGroup*>(aClosure);
@@ -2068,21 +2069,23 @@ gfxFontGroup::FindPlatformFont(const nsAString& aName,
     PRBool needsBold;
     gfxFontEntry *fe = nsnull;
 
-    // First, look up in the user font set...
-    // If the fontSet matches the family, we must not look for a platform
-    // font of the same name, even if we fail to actually get a fontEntry
-    // here; we'll fall back to the next name in the CSS font-family list.
     PRBool foundFamily = PR_FALSE;
-    gfxUserFontSet *fs = fontGroup->GetUserFontSet();
-    if (fs) {
-        // If the fontSet matches the family, but the font has not yet finished
-        // loading (nor has its load timeout fired), the fontGroup should wait
-        // for the download, and not actually draw its text yet.
-        PRBool waitForUserFont = PR_FALSE;
-        fe = fs->FindFontEntry(aName, *fontStyle, foundFamily,
-                               needsBold, waitForUserFont);
-        if (!fe && waitForUserFont) {
-            fontGroup->mSkipDrawing = PR_TRUE;
+    if (aUseFontSet) {
+        // First, look up in the user font set...
+        // If the fontSet matches the family, we must not look for a platform
+        // font of the same name, even if we fail to actually get a fontEntry
+        // here; we'll fall back to the next name in the CSS font-family list.
+        gfxUserFontSet *fs = fontGroup->GetUserFontSet();
+        if (fs) {
+            // If the fontSet matches the family, but the font has not yet finished
+            // loading (nor has its load timeout fired), the fontGroup should wait
+            // for the download, and not actually draw its text yet.
+            PRBool waitForUserFont = PR_FALSE;
+            fe = fs->FindFontEntry(aName, *fontStyle, foundFamily,
+                                   needsBold, waitForUserFont);
+            if (!fe && waitForUserFont) {
+                fontGroup->mSkipDrawing = PR_TRUE;
+            }
         }
     }
 
@@ -2144,7 +2147,7 @@ gfxFontGroup::ForEachFont(FontCreationCallback fc,
                           void *closure)
 {
     return ForEachFontInternal(mFamilies, mStyle.language,
-                               PR_TRUE, PR_TRUE, fc, closure);
+                               PR_TRUE, PR_TRUE, PR_TRUE, fc, closure);
 }
 
 PRBool
@@ -2154,19 +2157,22 @@ gfxFontGroup::ForEachFont(const nsAString& aFamilies,
                           void *closure)
 {
     return ForEachFontInternal(aFamilies, aLanguage,
-                               PR_FALSE, PR_TRUE, fc, closure);
+                               PR_FALSE, PR_TRUE, PR_TRUE, fc, closure);
 }
 
 struct ResolveData {
     ResolveData(gfxFontGroup::FontCreationCallback aCallback,
                 nsACString& aGenericFamily,
+                PRBool aUseFontSet,
                 void *aClosure) :
         mCallback(aCallback),
         mGenericFamily(aGenericFamily),
+        mUseFontSet(aUseFontSet),
         mClosure(aClosure) {
     }
     gfxFontGroup::FontCreationCallback mCallback;
     nsCString mGenericFamily;
+    PRBool mUseFontSet;
     void *mClosure;
 };
 
@@ -2175,6 +2181,7 @@ gfxFontGroup::ForEachFontInternal(const nsAString& aFamilies,
                                   nsIAtom *aLanguage,
                                   PRBool aResolveGeneric,
                                   PRBool aResolveFontName,
+                                  PRBool aUseFontSet,
                                   FontCreationCallback fc,
                                   void *closure)
 {
@@ -2267,18 +2274,17 @@ gfxFontGroup::ForEachFontInternal(const nsAString& aFamilies,
             }
         }
 
+        NS_LossyConvertUTF16toASCII gf(genericFamily);
         if (generic) {
-            ForEachFontInternal(family, groupAtom, PR_FALSE,
-                                aResolveFontName, fc, closure);
+            fc(family, gf, PR_FALSE, closure);
         } else if (!family.IsEmpty()) {
-            NS_LossyConvertUTF16toASCII gf(genericFamily);
             if (aResolveFontName) {
-                ResolveData data(fc, gf, closure);
+                ResolveData data(fc, gf, aUseFontSet, closure);
                 PRBool aborted = PR_FALSE, needsBold;
                 nsresult rv = NS_OK;
                 PRBool foundFamily = PR_FALSE;
                 PRBool waitForUserFont = PR_FALSE;
-                if (mUserFontSet &&
+                if (aUseFontSet && mUserFontSet &&
                     mUserFontSet->FindFontEntry(family, mStyle, foundFamily,
                                                 needsBold, waitForUserFont))
                 {
@@ -2298,7 +2304,7 @@ gfxFontGroup::ForEachFontInternal(const nsAString& aFamilies,
                     return PR_FALSE;
             }
             else {
-                if (!fc(family, gf, closure))
+                if (!fc(family, gf, aUseFontSet, closure))
                     return PR_FALSE;
             }
         }
@@ -2310,7 +2316,8 @@ gfxFontGroup::ForEachFontInternal(const nsAString& aFamilies,
             prefName.Append(groupString);
             nsAdoptingString value = Preferences::GetString(prefName.get());
             if (value) {
-                ForEachFontInternal(value, groupAtom, PR_FALSE, aResolveFontName,
+                ForEachFontInternal(value, groupAtom, PR_FALSE,
+                                    aResolveFontName, PR_FALSE,
                                     fc, closure);
             }
         }
@@ -2325,7 +2332,8 @@ PRBool
 gfxFontGroup::FontResolverProc(const nsAString& aName, void *aClosure)
 {
     ResolveData *data = reinterpret_cast<ResolveData*>(aClosure);
-    return (data->mCallback)(aName, data->mGenericFamily, data->mClosure);
+    return (data->mCallback)(aName, data->mGenericFamily, data->mUseFontSet,
+                             data->mClosure);
 }
 
 gfxTextRun *
diff --git a/gfx/thebes/gfxFont.h b/gfx/thebes/gfxFont.h
index 252c2934ba8a..3a8b1e19fdfb 100644
--- a/gfx/thebes/gfxFont.h
+++ b/gfx/thebes/gfxFont.h
@@ -2344,6 +2344,7 @@ public:
      */
     typedef PRBool (*FontCreationCallback) (const nsAString& aName,
                                             const nsACString& aGenericName,
+                                            PRBool aUseFontSet,
                                             void *closure);
     PRBool ForEachFont(const nsAString& aFamilies,
                        nsIAtom *aLanguage,
@@ -2457,11 +2458,14 @@ protected:
      * and with actual font names.  If false then fc() is called with each
      * family name in aFamilies (after resolving CSS/Gecko generic family names
      * if aResolveGeneric).
+     * If aUseFontSet is true, the fontgroup's user font set is checked;
+     * if false then it is skipped.
      */
     PRBool ForEachFontInternal(const nsAString& aFamilies,
                                nsIAtom *aLanguage,
                                PRBool aResolveGeneric,
                                PRBool aResolveFontName,
+                               PRBool aUseFontSet,
                                FontCreationCallback fc,
                                void *closure);
 
@@ -2469,6 +2473,7 @@ protected:
 
     static PRBool FindPlatformFont(const nsAString& aName,
                                    const nsACString& aGenericName,
+                                   PRBool aUseFontSet,
                                    void *closure);
 
     static NS_HIDDEN_(nsILanguageAtomService*) gLangService;
diff --git a/gfx/thebes/gfxPangoFonts.cpp b/gfx/thebes/gfxPangoFonts.cpp
index 78f9b9657fae..6bf70f8544eb 100644
--- a/gfx/thebes/gfxPangoFonts.cpp
+++ b/gfx/thebes/gfxPangoFonts.cpp
@@ -1816,7 +1816,7 @@ FFRECountHyphens (const nsAString &aFFREName)
 
 static PRBool
 FamilyCallback (const nsAString& fontName, const nsACString& genericName,
-                void *closure)
+                PRBool aUseFontSet, void *closure)
 {
     FamilyCallbackData *data = static_cast<FamilyCallbackData*>(closure);
     nsTArray<nsString> *list = data->mFcFamilyList;
@@ -1854,7 +1854,7 @@ FamilyCallback (const nsAString& fontName, const nsACString& genericName,
         // longer includes the family name for matching against system fonts.
         //
         const gfxUserFontSet *userFontSet = data->mUserFontSet;
-        if (genericName.Length() == 0 &&
+        if (aUseFontSet && genericName.Length() == 0 &&
             userFontSet && userFontSet->HasFamily(fontName)) {
             nsAutoString userFontName =
                 NS_LITERAL_STRING(FONT_FACE_FAMILY_PREFIX) + fontName;
@@ -1900,7 +1900,7 @@ gfxPangoFontGroup::GetFcFamilies(nsTArray<nsString> *aFcFamilyList,
     FamilyCallbackData data(aFcFamilyList, mUserFontSet);
     // Leave non-existing fonts in the list so that fontconfig can get the
     // best match.
-    ForEachFontInternal(mFamilies, aLanguage, PR_TRUE, PR_FALSE,
+    ForEachFontInternal(mFamilies, aLanguage, PR_TRUE, PR_FALSE, PR_TRUE,
                         FamilyCallback, &data);
 }
 
diff --git a/gfx/thebes/gfxUserFontSet.cpp b/gfx/thebes/gfxUserFontSet.cpp
index 1b469dc3e834..68b8360c63d9 100644
--- a/gfx/thebes/gfxUserFontSet.cpp
+++ b/gfx/thebes/gfxUserFontSet.cpp
@@ -55,11 +55,11 @@
 using namespace mozilla;
 
 #ifdef PR_LOGGING
-static PRLogModuleInfo *gUserFontsLog = PR_NewLogModule("userfonts");
+PRLogModuleInfo *gfxUserFontSet::sUserFontsLog = PR_NewLogModule("userfonts");
 #endif /* PR_LOGGING */
 
-#define LOG(args) PR_LOG(gUserFontsLog, PR_LOG_DEBUG, args)
-#define LOG_ENABLED() PR_LOG_TEST(gUserFontsLog, PR_LOG_DEBUG)
+#define LOG(args) PR_LOG(sUserFontsLog, PR_LOG_DEBUG, args)
+#define LOG_ENABLED() PR_LOG_TEST(sUserFontsLog, PR_LOG_DEBUG)
 
 static PRUint64 sFontSetGeneration = LL_INIT(0, 0);
 
@@ -445,7 +445,7 @@ CopyWOFFMetadata(const PRUint8* aFontData, PRUint32 aLength,
 // ensure that it is eventually deleted via NS_Free().
 PRBool 
 gfxUserFontSet::OnLoadComplete(gfxProxyFontEntry *aProxy,
-                               const PRUint8 *aFontData, PRUint32 aLength, 
+                               const PRUint8 *aFontData, PRUint32 aLength,
                                nsresult aDownloadStatus)
 {
     // download successful, make platform font using font data
@@ -482,14 +482,9 @@ gfxUserFontSet::OnLoadComplete(gfxProxyFontEntry *aProxy,
             const PRUint8* saneData =
                 SanitizeOpenTypeData(aFontData, aLength, saneLen,
                                      fontType == GFX_USERFONT_WOFF);
-#ifdef DEBUG
             if (!saneData) {
-                char buf[1000];
-                sprintf(buf, "downloaded font rejected for \"%s\"",
-                        NS_ConvertUTF16toUTF8(aProxy->FamilyName()).get());
-                NS_WARNING(buf);
+                LogMessage(aProxy, "rejected by sanitizer");
             }
-#endif
             if (saneData) {
                 // The sanitizer ensures that we have a valid sfnt and a usable
                 // name table, so this should never fail unless we're out of
@@ -503,7 +498,7 @@ gfxUserFontSet::OnLoadComplete(gfxProxyFontEntry *aProxy,
                                                                   saneData,
                                                                   saneLen);
                 if (!fe) {
-                    NS_WARNING("failed to make platform font from download");
+                    LogMessage(aProxy, "not usable by platform");
                 }
             }
         } else {
@@ -523,11 +518,14 @@ gfxUserFontSet::OnLoadComplete(gfxProxyFontEntry *aProxy,
                     fe = gfxPlatform::GetPlatform()->MakePlatformFont(aProxy,
                                                                       aFontData,
                                                                       aLength);
+                    if (!fe) {
+                        LogMessage(aProxy, "not usable by platform");
+                    }
                     aFontData = nsnull; // we must NOT free this below!
                 } else {
                     // the data was unusable, so just discard it
                     // (error will be reported below, if logging is enabled)
-                    NS_WARNING("failed to make platform font from download");
+                    LogMessage(aProxy, "SFNT header or tables invalid");
                 }
             }
         }
@@ -572,16 +570,8 @@ gfxUserFontSet::OnLoadComplete(gfxProxyFontEntry *aProxy,
         }
     } else {
         // download failed
-#ifdef PR_LOGGING
-        if (LOG_ENABLED()) {
-            nsCAutoString fontURI;
-            aProxy->mSrcList[aProxy->mSrcIndex].mURI->GetSpec(fontURI);
-            LOG(("userfonts (%p) [src %d] failed uri: (%s) for (%s) error %8.8x downloading font data\n",
-                 this, aProxy->mSrcIndex, fontURI.get(),
-                 NS_ConvertUTF16toUTF8(aProxy->mFamily->Name()).get(),
-                 aDownloadStatus));
-        }
-#endif
+        LogMessage(aProxy, "download failed", nsIScriptError::errorFlag,
+                   aDownloadStatus);
     }
 
     if (aFontData) {
@@ -606,7 +596,8 @@ gfxUserFontSet::LoadNext(gfxProxyFontEntry *aProxyEntry)
 {
     PRUint32 numSrc = aProxyEntry->mSrcList.Length();
 
-    NS_ASSERTION(aProxyEntry->mSrcIndex < numSrc, "already at the end of the src list for user font");
+    NS_ASSERTION(aProxyEntry->mSrcIndex < numSrc,
+                 "already at the end of the src list for user font");
 
     if (aProxyEntry->mLoadingState == gfxProxyFontEntry::NOT_LOADING) {
         aProxyEntry->mLoadingState = gfxProxyFontEntry::LOADING_STARTED;
@@ -617,21 +608,22 @@ gfxUserFontSet::LoadNext(gfxProxyFontEntry *aProxyEntry)
         aProxyEntry->mSrcIndex++;
     }
 
-    // load each src entry in turn, until a local face is found or a download begins successfully
+    // load each src entry in turn, until a local face is found
+    // or a download begins successfully
     while (aProxyEntry->mSrcIndex < numSrc) {
         const gfxFontFaceSrc& currSrc = aProxyEntry->mSrcList[aProxyEntry->mSrcIndex];
 
-        // src local ==> lookup and load   
+        // src local ==> lookup and load
 
         if (currSrc.mIsLocal) {
             gfxFontEntry *fe =
                 gfxPlatform::GetPlatform()->LookupLocalFont(aProxyEntry,
                                                             currSrc.mLocalName);
             if (fe) {
-                LOG(("userfonts (%p) [src %d] loaded local: (%s) for (%s) gen: %8.8x\n", 
-                     this, aProxyEntry->mSrcIndex, 
-                     NS_ConvertUTF16toUTF8(currSrc.mLocalName).get(), 
-                     NS_ConvertUTF16toUTF8(aProxyEntry->mFamily->Name()).get(), 
+                LOG(("userfonts (%p) [src %d] loaded local: (%s) for (%s) gen: %8.8x\n",
+                     this, aProxyEntry->mSrcIndex,
+                     NS_ConvertUTF16toUTF8(currSrc.mLocalName).get(),
+                     NS_ConvertUTF16toUTF8(aProxyEntry->mFamily->Name()).get(),
                      PRUint32(mGeneration)));
                 fe->mFeatureSettings.AppendElements(aProxyEntry->mFeatureSettings);
                 fe->mLanguageOverride = aProxyEntry->mLanguageOverride;
@@ -639,52 +631,37 @@ gfxUserFontSet::LoadNext(gfxProxyFontEntry *aProxyEntry)
                 ReplaceFontEntry(aProxyEntry, fe);
                 return STATUS_LOADED;
             } else {
-                LOG(("userfonts (%p) [src %d] failed local: (%s) for (%s)\n", 
-                     this, aProxyEntry->mSrcIndex, 
-                     NS_ConvertUTF16toUTF8(currSrc.mLocalName).get(), 
-                     NS_ConvertUTF16toUTF8(aProxyEntry->mFamily->Name()).get()));            
+                LOG(("userfonts (%p) [src %d] failed local: (%s) for (%s)\n",
+                     this, aProxyEntry->mSrcIndex,
+                     NS_ConvertUTF16toUTF8(currSrc.mLocalName).get(),
+                     NS_ConvertUTF16toUTF8(aProxyEntry->mFamily->Name()).get()));
             }
-        } 
+        }
 
         // src url ==> start the load process
         else {
-            if (gfxPlatform::GetPlatform()->IsFontFormatSupported(currSrc.mURI, 
+            if (gfxPlatform::GetPlatform()->IsFontFormatSupported(currSrc.mURI,
                     currSrc.mFormatFlags)) {
                 nsresult rv = StartLoad(aProxyEntry, &currSrc);
                 PRBool loadOK = NS_SUCCEEDED(rv);
-                
                 if (loadOK) {
 #ifdef PR_LOGGING
                     if (LOG_ENABLED()) {
                         nsCAutoString fontURI;
                         currSrc.mURI->GetSpec(fontURI);
-                        LOG(("userfonts (%p) [src %d] loading uri: (%s) for (%s)\n", 
-                             this, aProxyEntry->mSrcIndex, fontURI.get(), 
+                        LOG(("userfonts (%p) [src %d] loading uri: (%s) for (%s)\n",
+                             this, aProxyEntry->mSrcIndex, fontURI.get(),
                              NS_ConvertUTF16toUTF8(aProxyEntry->mFamily->Name()).get()));
                     }
 #endif
-                    return STATUS_LOADING;                  
+                    return STATUS_LOADING;
                 } else {
-#ifdef PR_LOGGING
-                    if (LOG_ENABLED()) {
-                        nsCAutoString fontURI;
-                        currSrc.mURI->GetSpec(fontURI);
-                        LOG(("userfonts (%p) [src %d] failed uri: (%s) for (%s) download failed\n", 
-                             this, aProxyEntry->mSrcIndex, fontURI.get(), 
-                             NS_ConvertUTF16toUTF8(aProxyEntry->mFamily->Name()).get()));
-                    }
-#endif
+                    LogMessage(aProxyEntry, "download failed",
+                               nsIScriptError::errorFlag, rv);
                 }
             } else {
-#ifdef PR_LOGGING
-                if (LOG_ENABLED()) {
-                    nsCAutoString fontURI;
-                    currSrc.mURI->GetSpec(fontURI);
-                    LOG(("userfonts (%p) [src %d] failed uri: (%s) for (%s) format not supported\n", 
-                         this, aProxyEntry->mSrcIndex, fontURI.get(), 
-                         NS_ConvertUTF16toUTF8(aProxyEntry->mFamily->Name()).get()));
-                }
-#endif
+                LogMessage(aProxyEntry, "format not supported",
+                           nsIScriptError::warningFlag);
             }
         }
 
@@ -692,8 +669,8 @@ gfxUserFontSet::LoadNext(gfxProxyFontEntry *aProxyEntry)
     }
 
     // all src's failed; mark this entry as unusable (so fallback will occur)
-    LOG(("userfonts (%p) failed all src for (%s)\n", 
-        this, NS_ConvertUTF16toUTF8(aProxyEntry->mFamily->Name()).get()));            
+    LOG(("userfonts (%p) failed all src for (%s)\n",
+        this, NS_ConvertUTF16toUTF8(aProxyEntry->mFamily->Name()).get()));
     aProxyEntry->mLoadingState = gfxProxyFontEntry::LOADING_FAILED;
 
     return STATUS_END_OF_LIST;
diff --git a/gfx/thebes/gfxUserFontSet.h b/gfx/thebes/gfxUserFontSet.h
index 3274e8a0864d..4455263e4781 100644
--- a/gfx/thebes/gfxUserFontSet.h
+++ b/gfx/thebes/gfxUserFontSet.h
@@ -47,6 +47,7 @@
 #include "nsIURI.h"
 #include "nsIFile.h"
 #include "nsISupportsImpl.h"
+#include "nsIScriptError.h"
 
 class nsIURI;
 class gfxMixedFontFamily;
@@ -252,10 +253,18 @@ protected:
 
     gfxMixedFontFamily *GetFamily(const nsAString& aName) const;
 
+    // report a problem of some kind (implemented in nsUserFontSet)
+    virtual nsresult LogMessage(gfxProxyFontEntry *aProxy,
+                                const char *aMessage,
+                                PRUint32 aFlags = nsIScriptError::errorFlag,
+                                nsresult aStatus = 0) = 0;
+
     // font families defined by @font-face rules
     nsRefPtrHashtable<nsStringHashKey, gfxMixedFontFamily> mFontFamilies;
 
     PRUint64        mGeneration;
+
+    static PRLogModuleInfo *sUserFontsLog;
 };
 
 // acts a placeholder until the real font is downloaded
diff --git a/gfx/thebes/nsCoreAnimationSupport.h b/gfx/thebes/nsCoreAnimationSupport.h
index e18b33f023ea..a87ee5d2c873 100644
--- a/gfx/thebes/nsCoreAnimationSupport.h
+++ b/gfx/thebes/nsCoreAnimationSupport.h
@@ -41,10 +41,11 @@
 #define nsCoreAnimationSupport_h__
 #ifdef XP_MACOSX
 
+#import <QuartzCore/QuartzCore.h>
 #import "ApplicationServices/ApplicationServices.h"
 #include "nscore.h"
 #include "gfxTypes.h"
-#import <QuartzCore/QuartzCore.h>
+#include "nsAutoPtr.h"
 
 // Get the system color space.
 CGColorSpaceRef THEBES_API CreateSystemColorSpace();
@@ -54,7 +55,10 @@ struct _CGLPBufferObject;
 struct _CGLContextObject;
 class nsIOSurface;
 
+typedef uint32_t IOSurfaceID;
+
 class THEBES_API nsCARenderer {
+  NS_INLINE_DECL_REFCOUNTING(nsCARenderer)
 public:
   nsCARenderer() : mCARenderer(nsnull), mPixelBuffer(nsnull), mOpenGLContext(nsnull),
                    mCGImage(nsnull), mCGData(nsnull), mIOSurface(nsnull), mFBO(nsnull),
@@ -69,13 +73,18 @@ public:
    * is attached then an internal pixel buffer will be
    * used.
    */ 
-  void AttachIOSurface(nsIOSurface *aSurface);
+  void AttachIOSurface(nsRefPtr<nsIOSurface> aSurface);
+  IOSurfaceID GetIOSurfaceID();
   static nsresult DrawSurfaceToCGContext(CGContextRef aContext, 
                                          nsIOSurface *surf, 
                                          CGColorSpaceRef aColorSpace, 
                                          int aX, int aY,
                                          size_t aWidth, size_t aHeight);
-
+  
+  // Remove & Add the layer without destroying
+  // the renderer for fast back buffer swapping.
+  void DettachCALayer();
+  void AttachCALayer(void *aCALayer);
 #ifdef DEBUG
   static void SaveToDisk(nsIOSurface *surf);
 #endif
@@ -83,24 +92,23 @@ private:
   void Destroy();
 
   void *mCARenderer;
-  _CGLPBufferObject *mPixelBuffer;
-  _CGLContextObject *mOpenGLContext;
-  CGImageRef         mCGImage;
-  void              *mCGData;
-  nsIOSurface       *mIOSurface;
-  uint32_t           mFBO;
-  uint32_t           mIOTexture;
-  uint32_t           mUnsupportedWidth;
-  uint32_t           mUnsupportedHeight;
+  _CGLPBufferObject     *mPixelBuffer;
+  _CGLContextObject     *mOpenGLContext;
+  CGImageRef             mCGImage;
+  void                  *mCGData;
+  nsRefPtr<nsIOSurface>  mIOSurface;
+  uint32_t               mFBO;
+  uint32_t               mIOTexture;
+  uint32_t               mUnsupportedWidth;
+  uint32_t               mUnsupportedHeight;
 };
 
-typedef uint32_t IOSurfaceID;
-
 class THEBES_API nsIOSurface {
+    NS_INLINE_DECL_REFCOUNTING(nsIOSurface)
 public:
-  static nsIOSurface *CreateIOSurface(int aWidth, int aHeight); 
+  static already_AddRefed<nsIOSurface> CreateIOSurface(int aWidth, int aHeight);
   static void ReleaseIOSurface(nsIOSurface *aIOSurface); 
-  static nsIOSurface *LookupSurface(IOSurfaceID aSurfaceID);
+  static already_AddRefed<nsIOSurface> LookupSurface(IOSurfaceID aSurfaceID);
 
   nsIOSurface(CFTypeRef aIOSurfacePtr) : mIOSurfacePtr(aIOSurfacePtr) {}
   ~nsIOSurface() { CFRelease(mIOSurfacePtr); }
diff --git a/gfx/thebes/nsCoreAnimationSupport.mm b/gfx/thebes/nsCoreAnimationSupport.mm
index 2ba01a1d3dca..4d48d09761d8 100644
--- a/gfx/thebes/nsCoreAnimationSupport.mm
+++ b/gfx/thebes/nsCoreAnimationSupport.mm
@@ -267,7 +267,7 @@ void nsIOSurfaceLib::CloseLibrary() {
   sOpenGLFramework = nsnull;
 }
 
-nsIOSurface* nsIOSurface::CreateIOSurface(int aWidth, int aHeight) { 
+already_AddRefed<nsIOSurface> nsIOSurface::CreateIOSurface(int aWidth, int aHeight) { 
   if (!nsIOSurfaceLib::isInit())
     return nsnull;
 
@@ -300,16 +300,16 @@ nsIOSurface* nsIOSurface::CreateIOSurface(int aWidth, int aHeight) {
   if (!surfaceRef)
     return nsnull;
 
-  nsIOSurface* ioSurface = new nsIOSurface(surfaceRef);
+  nsRefPtr<nsIOSurface> ioSurface = new nsIOSurface(surfaceRef);
   if (!ioSurface) {
     ::CFRelease(surfaceRef);
     return nsnull;
   }
 
-  return ioSurface;
+  return ioSurface.forget();
 }
 
-nsIOSurface* nsIOSurface::LookupSurface(IOSurfaceID aIOSurfaceID) { 
+already_AddRefed<nsIOSurface> nsIOSurface::LookupSurface(IOSurfaceID aIOSurfaceID) { 
   if (!nsIOSurfaceLib::isInit())
     return nsnull;
 
@@ -317,12 +317,12 @@ nsIOSurface* nsIOSurface::LookupSurface(IOSurfaceID aIOSurfaceID) {
   if (!surfaceRef)
     return nsnull;
 
-  nsIOSurface* ioSurface = new nsIOSurface(surfaceRef);
+  nsRefPtr<nsIOSurface> ioSurface = new nsIOSurface(surfaceRef);
   if (!ioSurface) {
     ::CFRelease(surfaceRef);
     return nsnull;
   }
-  return ioSurface;
+  return ioSurface.forget();
 }
 
 IOSurfaceID nsIOSurface::GetIOSurfaceID() { 
@@ -427,9 +427,6 @@ void nsCARenderer::Destroy() {
   if (mCGImage) {
     ::CGImageRelease(mCGImage);
   }
-  if (mIOSurface) {
-    delete mIOSurface;
-  }
   // mCGData is deallocated by cgdata_release_callback
 
   mCARenderer = nil;
@@ -512,7 +509,6 @@ nsresult nsCARenderer::SetupRenderer(void *aCALayer, int aWidth, int aHeight) {
   layer.actions = newActions;
   [newActions release];
 
-  double time = 0;
   [CATransaction setValue: [NSNumber numberWithFloat:0.0f] forKey: kCATransactionAnimationDuration];
   [CATransaction setValue: (id) kCFBooleanTrue forKey: kCATransactionDisableActions];
   [layer setBounds:CGRectMake(0, 0, aWidth, aHeight)];
@@ -626,10 +622,12 @@ nsresult nsCARenderer::SetupRenderer(void *aCALayer, int aWidth, int aHeight) {
   return NS_OK;
 }
 
-void nsCARenderer::AttachIOSurface(nsIOSurface *aSurface) {
+void nsCARenderer::AttachIOSurface(nsRefPtr<nsIOSurface> aSurface) {
   if (mIOSurface && 
       aSurface->GetIOSurfaceID() == mIOSurface->GetIOSurfaceID()) {
-    delete aSurface; 
+    // This object isn't needed since we already have a
+    // handle to the same io surface.
+    aSurface = nsnull;
     return;
   }
   if (mCARenderer) {
@@ -637,12 +635,18 @@ void nsCARenderer::AttachIOSurface(nsIOSurface *aSurface) {
     // resize our elements.
     Destroy(); 
   }
-  if (mIOSurface)
-    delete mIOSurface;
 
   mIOSurface = aSurface;
 }
 
+IOSurfaceID nsCARenderer::GetIOSurfaceID() {
+  if (!mIOSurface) {
+    return 0;
+  }
+
+  return mIOSurface->GetIOSurfaceID();
+}
+
 nsresult nsCARenderer::Render(int aWidth, int aHeight, 
                               CGImageRef *aOutCGImage) {
   if (!aOutCGImage && !mIOSurface) {
@@ -782,6 +786,19 @@ nsresult nsCARenderer::DrawSurfaceToCGContext(CGContextRef aContext,
   return NS_OK;
 }
 
+void nsCARenderer::DettachCALayer() {
+  CARenderer* caRenderer = (CARenderer*)mCARenderer;
+
+  caRenderer.layer = nil;
+}
+
+void nsCARenderer::AttachCALayer(void *aCALayer) {
+  CARenderer* caRenderer = (CARenderer*)mCARenderer;
+
+  CALayer* caLayer = (CALayer*)aCALayer;
+  caRenderer.layer = caLayer;
+}
+
 #ifdef DEBUG
 
 int sSaveToDiskSequence = 0;
@@ -834,3 +851,4 @@ void nsCARenderer::SaveToDisk(nsIOSurface *surf) {
 }
 
 #endif
+
diff --git a/intl/locale/src/windows/nsWinCharset.cpp b/intl/locale/src/windows/nsWinCharset.cpp
index af89cd96d8c1..69cb9dc00cb4 100644
--- a/intl/locale/src/windows/nsWinCharset.cpp
+++ b/intl/locale/src/windows/nsWinCharset.cpp
@@ -46,6 +46,7 @@
 #include "nsServiceManagerUtils.h"
 #include "nsITimelineService.h"
 #include "nsPlatformCharset.h"
+#include "nsEncoderDecoderUtils.h"
 
 static const char* kWinCharsets[][3] = {
 #include "wincharset.properties.h"
@@ -79,6 +80,7 @@ nsPlatformCharset::MapToCharset(nsAString& inANSICodePage, nsACString& outCharse
       NS_ARRAY_LENGTH(kWinCharsets), key, outCharset);
   if (NS_FAILED(rv)) {
     outCharset.AssignLiteral("windows-1252");
+    return NS_SUCCESS_USING_FALLBACK_LOCALE;
   }
   return rv;
 }
diff --git a/js/src/ETWProvider.man b/js/src/ETWProvider.man
new file mode 100644
index 000000000000..10d8cda56dc7
--- /dev/null
+++ b/js/src/ETWProvider.man
@@ -0,0 +1,280 @@
+<!-- <?xml version="1.0" encoding="UTF-16"?> -->
+<instrumentationManifest
+    xsi:schemaLocation="http://schemas.microsoft.com/win/2004/08/events eventman.xsd"
+    xmlns="http://schemas.microsoft.com/win/2004/08/events"
+    xmlns:win="http://manifests.microsoft.com/win/2004/08/windows/events"
+    xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+    xmlns:xs="http://www.w3.org/2001/XMLSchema"
+    xmlns:trace="http://schemas.microsoft.com/win/2004/08/events/trace">
+  <instrumentation>
+    <events>
+      <provider name="MozillaSpiderMonkey"
+                message="$(string.ProviderMessage)"
+                guid="{2C378EC2-8A64-4b48-9A41-3CA4506D06C5}"
+                symbol="MozillaSpiderMonkey"
+                resourceFileName="mozjs.dll"
+                messageFileName="mozjs.dll">
+        <events>
+          <!-- execution -->
+          <event symbol="EvtExecuteStart" value="1001" version="1"
+                 channel="MozillaChannel" level="win:Informational"
+                 template="CodeLocationTemplate" task="Execution" opcode="ExecuteStart"
+                 keywords="SampleKeyword" message="$(string.MozillaSpiderMonkey.ExecuteStart.message)"/>
+          <event symbol="EvtExecuteDone" value="1002" version="1"
+                 channel="MozillaChannel" level="win:Informational"
+                 template="CodeLocationTemplate" task="Execution" opcode="ExecuteStop"
+                 keywords="SampleKeyword" message="$(string.MozillaSpiderMonkey.ExecuteDone.message)"/>
+          
+          <event symbol="EvtScriptCompileBegin" value="1003" version="1"
+                 channel="MozillaChannel" level="win:Informational"
+                 template="CodeLocationTemplate" task="Execution" opcode="CompileBegin"
+                 keywords="SampleKeyword" message="$(string.MozillaSpiderMonkey.ScriptCompileBegin.message)"/>
+          <event symbol="EvtScriptCompileEnd" value="1004" version="1"
+                 channel="MozillaChannel" level="win:Informational"
+                 template="CodeLocationTemplate" task="Execution" opcode="CompileEnd"
+                 keywords="SampleKeyword" message="$(string.MozillaSpiderMonkey.ScriptCompileEnd.message)"/>
+
+          <event symbol="EvtCalloutBegin" value="2001" version="1"
+                 channel="MozillaChannel" level="win:Verbose"
+                 template="FunctionInvocationTemplate" task="Execution" opcode="CalloutBegin"
+                 keywords="SampleKeyword" message="$(string.SampleProvider.SampleEvent.message)"/>
+          <event symbol="EvtCalloutEnd" value="2002" version="1"
+                 channel="MozillaChannel" level="win:Verbose"
+                 template="FunctionInvocationTemplate" task="Execution" opcode="CalloutEnd"
+                 keywords="SampleKeyword" message="$(string.SampleProvider.SampleEvent.message)"/>
+
+          <event symbol="EvtFunctionEntry" value="1005" version="1"
+                 channel="MozillaChannel" level="win:Verbose"
+                 template="FunctionInvocationTemplate" task="Execution" opcode="FunctionEnter"
+                 keywords="SampleKeyword" message="$(string.SampleProvider.SampleEvent.message)"/>
+          <event symbol="EvtFunctionExit" value="1006" version="1"
+                 channel="MozillaChannel" level="win:Verbose"
+                 template="FunctionInvocationTemplate" task="Execution" opcode="FunctionExit"
+                 keywords="SampleKeyword" message="$(string.SampleProvider.SampleEvent.message)"/>
+
+          <!-- allocation -->
+          <event symbol="EvtObjectCreate" value="1007" version="1"
+                 channel="MozillaChannel" level="win:Verbose"
+                 template="ObjectCreateTemplate" task="Allocation" opcode="ObjectCreate"
+                 keywords="SampleKeyword" message="$(string.SampleProvider.SampleEvent.message)"/>
+          <event symbol="EvtObjectFinalize" value="1008" version="1"
+                 channel="MozillaChannel" level="win:Verbose"
+                 template="ObjectFinalizeTemplate" task="Allocation" opcode="ObjectFinalize"
+                 keywords="SampleKeyword" message="$(string.SampleProvider.SampleEvent.message)"/>
+          
+          <event symbol="EvtStringCreate" value="1009" version="1"
+                 channel="MozillaChannel" level="win:Verbose"
+                 template="StringCreateTemplate" task="Allocation" opcode="StringCreate"
+                 keywords="SampleKeyword" message="$(string.SampleProvider.SampleEvent.message)"/>
+          <event symbol="EvtStringFinalize" value="1010" version="1"
+                 channel="MozillaChannel" level="win:Verbose"
+                 template="StringFinalizeTemplate" task="Allocation" opcode="StringFinalize"
+                 keywords="SampleKeyword" message="$(string.SampleProvider.SampleEvent.message)"/>
+
+          <event symbol="EvtObjectResize" value="1011" version="1"
+                 channel="MozillaChannel" level="win:Verbose"
+                 template="ObjectResizeTemplate" task="Allocation" opcode="ObjectResize"
+                 keywords="SampleKeyword" message="$(string.SampleProvider.SampleEvent.message)"/>
+
+          <!-- GC -->
+          <event symbol="EvtGCStart" value="1012" version="1"
+                 channel="MozillaChannel" level="win:Informational"
+                 template="CompartmentTemplate" task="Allocation" opcode="GCStart"
+                 keywords="SampleKeyword" message="$(string.SampleProvider.SampleEvent.message)"/>
+          <event symbol="EvtGCEnd" value="1013" version="1"
+                 channel="MozillaChannel" level="win:Informational"
+                 template="CompartmentTemplate" task="Allocation" opcode="GCEnd"
+                 keywords="SampleKeyword" message="$(string.SampleProvider.SampleEvent.message)"/>
+
+          <event symbol="EvtGCStartMarkPhase" value="1014" version="1"
+                 channel="MozillaChannel" level="win:Informational"
+                 template="CompartmentTemplate" task="Allocation" opcode="GCMarkStart"
+                 keywords="SampleKeyword" message="$(string.SampleProvider.SampleEvent.message)"/>
+          <event symbol="EvtGCEndMarkPhase" value="1015" version="1"
+                 channel="MozillaChannel" level="win:Informational"
+                 template="CompartmentTemplate" task="Allocation" opcode="GCMarkEnd"
+                 keywords="SampleKeyword" message="$(string.SampleProvider.SampleEvent.message)"/>
+                    
+          <event symbol="EvtGCStartSweepPhase" value="1016" version="1"
+                 channel="MozillaChannel" level="win:Informational"
+                 template="CompartmentTemplate" task="Allocation" opcode="GCSweepStart"
+                 keywords="SampleKeyword" message="$(string.SampleProvider.SampleEvent.message)"/>
+          <event symbol="EvtGCEndSweepPhase" value="1017" version="1"
+                 channel="MozillaChannel" level="win:Informational"
+                 template="CompartmentTemplate" task="Allocation" opcode="GCSweepEnd"
+                 keywords="SampleKeyword" message="$(string.SampleProvider.SampleEvent.message)"/>
+
+          <event symbol="EvtMemoryAcquire" value="1018" version="1"
+                 channel="MozillaChannel" level="win:Verbose"
+                 template="MemoryLocationTemplate" task="Allocation" opcode="AcquireMemory"
+                 keywords="SampleKeyword" message="$(string.SampleProvider.SampleEvent.message)"/>
+          <event symbol="EvtMemoryRelease" value="1019" version="1"
+                 channel="MozillaChannel" level="win:Verbose"
+                 template="MemoryLocationTemplate" task="Allocation" opcode="ReleaseMemory"
+                 keywords="SampleKeyword" message="$(string.SampleProvider.SampleEvent.message)"/>
+
+          <event symbol="EvtHeapResize" value="1020" version="1"
+                 channel="MozillaChannel" level="win:Informational"
+                 template="HeapResizeTemplate" task="Allocation" opcode="ResizeHeap"
+                 keywords="SampleKeyword" message="$(string.SampleProvider.SampleEvent.message)"/>
+
+          <event symbol="EvtCustomString" value="1021" version="1"
+                 channel="MozillaChannel" level="win:Informational"
+                 template="StringTemplate" task="Markers" opcode="CustomMark"
+                 keywords="SampleKeyword" message="$(string.SampleProvider.SampleEvent.message)"/>
+          <event symbol="EvtCustomANSIString" value="1022" version="1"
+                 channel="MozillaChannel" level="win:Informational"
+                 template="ANSIStringTemplate" task="Markers" opcode="CustomMark"
+                 keywords="SampleKeyword" message="$(string.SampleProvider.SampleEvent.message)"/>
+          <event symbol="EvtCustomInt" value="1023" version="1"
+                 channel="MozillaChannel" level="win:Informational"
+                 template="IntTemplate" task="Markers" opcode="CustomMark"
+                 keywords="SampleKeyword" message="$(string.SampleProvider.SampleEvent.message)"/>
+        </events>
+
+	<!-- So far, I am just using the standard win:Informational and win:Verbose levels -->
+        <levels>
+        </levels>
+
+        <tasks>
+          <task name="Execution" symbol="ExecutionTask" value="1"
+                eventGUID="{A77103F5-3C77-4d71-A11A-BC6564F9B5B7}"/>
+          <task name="Allocation" symbol="AllocationTask" value="2"
+                eventGUID="{1FBF0FBF-019C-4a3f-BCC5-364AD54C4823}"/>
+          <task name="GC" symbol="GCTask" value="3"
+                eventGUID="{4BC38669-3062-41e6-AF41-12AF2D692B05}"/>
+          <task name="Markers" symbol="MarkersTask" value="4"
+                eventGUID="{83a61eb2-aa42-11df-AF41-0021859332ad}"/>
+        </tasks>
+
+        <opcodes>
+          <opcode name="Default" symbol="OpDefault" value="10"/>
+          <opcode name="ExecuteStart" symbol="OpExecuteStart" value="11"/>
+          <opcode name="ExecuteStop" symbol="OpExecuteStop" value="12"/>
+          <opcode name="CompileBegin" symbol="OpCompileBegin" value="13"/>
+          <opcode name="CompileEnd" symbol="OpCompileEnd" value="14"/>
+          <opcode name="CalloutBegin" symbol="OpCalloutBegin" value="15"/>
+          <opcode name="CalloutEnd" symbol="OpCalloutEnd" value="16"/>
+          <opcode name="FunctionEnter" symbol="OpFunctionEnter" value="17"/>
+          <opcode name="FunctionExit" symbol="OpFunctionExit" value="18"/>
+          <opcode name="ObjectCreate" symbol="OpObjectCreate" value="19"/>
+          <opcode name="ObjectFinalize" symbol="OpObjectFinalize" value="20"/>
+          <opcode name="StringCreate" symbol="OpStringCreate" value="21"/>
+          <opcode name="StringFinalize" symbol="OpStringFinalize" value="22"/>
+          <opcode name="ObjectResize" symbol="OpObjectResize" value="23"/>
+          <opcode name="GCStart" symbol="OpGCStart" value="24"/>
+          <opcode name="GCEnd" symbol="OpGCEnd" value="25"/>
+          <opcode name="GCMarkStart" symbol="OpGCMarkStart" value="26"/>
+          <opcode name="GCMarkEnd" symbol="OpGCMarkEnd" value="27"/>
+          <opcode name="GCSweepStart" symbol="OpGCSweepStart" value="28"/>
+          <opcode name="GCSweepEnd" symbol="OpGCSweepEnd" value="29"/>
+          <opcode name="AcquireMemory" symbol="OpAcquireMemory" value="30"/>
+          <opcode name="ReleaseMemory" symbol="OpReleaseMemory" value="31"/>
+          <opcode name="ResizeHeap" symbol="OpResizeHeap" value="32"/>
+          <opcode name="CustomMark" symbol="OpCustomMark" value="33"/>
+        </opcodes>
+        
+        <channels>
+          <channel name="MozillaChannel" chid="MozillaPerformanceReportingChannel"
+                   symbol="MOZILLA_PERFORMANCE_REPORTING_CHANNEL" type="Analytic"
+                   enabled="true"/>
+        </channels>
+
+        <keywords>
+          <keyword name="SampleKeyword" symbol="KwSample" mask="0x1"/>
+        </keywords>
+        
+        <templates>
+          <template tid="CodeLocationTemplate">
+            <data name="FileName" inType="win:AnsiString" outType="xs:string"/>
+            <data name="LineNumber" inType="win:Int32" outType="xs:int"/>
+          </template>
+          
+          <template tid="ObjectCreateTemplate">
+            <data name="FileName" inType="win:AnsiString" outType="xs:string"/>
+            <data name="LineNumber" inType="win:Int32" outType="xs:int"/>
+            <data name="ClassName" inType="win:AnsiString" outType="xs:string"/>
+            <data name="Address" inType="win:Int64" outType="xs:long"/>
+            <data name="Size" inType="win:Int64" outType="xs:long"/>
+          </template>
+
+          <template tid="ObjectFinalizeTemplate">
+            <data name="ClassName" inType="win:AnsiString" outType="xs:string"/>
+            <data name="Address" inType="win:Int64" outType="xs:long"/>
+          </template>
+
+          <template tid="ObjectResizeTemplate">
+            <data name="FileName" inType="win:AnsiString" outType="xs:string"/>
+            <data name="LineNumber" inType="win:Int32" outType="xs:int"/>
+            <data name="ClassName" inType="win:AnsiString" outType="xs:string"/>
+            <data name="Address" inType="win:Int64" outType="xs:long"/>
+            <data name="OldSize" inType="win:Int64" outType="xs:long"/>
+            <data name="NewSize" inType="win:Int64" outType="xs:long"/>
+          </template>
+
+          <template tid="FunctionInvocationTemplate">
+            <data name="FileName" inType="win:AnsiString" outType="xs:string"/>
+            <data name="LineNumber" inType="win:Int32" outType="xs:int"/>
+            <data name="ClassName" inType="win:AnsiString" outType="xs:string"/>
+            <data name="FunctionName" inType="win:AnsiString" outType="xs:string"/>
+          </template>
+
+          <template tid="StringCreateTemplate">
+            <data name="FileName" inType="win:AnsiString" outType="xs:string"/>
+            <data name="LineNumber" inType="win:Int32" outType="xs:int"/>
+            <data name="Address" inType="win:Int64" outType="xs:long"/>
+            <data name="Size" inType="win:Int64" outType="xs:long"/>
+          </template>
+
+          <template tid="StringFinalizeTemplate">
+            <data name="Address" inType="win:Int64" outType="xs:long"/>
+            <data name="Size" inType="win:Int64" outType="xs:long"/>
+          </template>
+
+          <template tid="CompartmentTemplate">
+            <data name="Compartment" inType="win:Int64" outType="xs:long"/>
+          </template>
+
+          <template tid="MemoryLocationTemplate">
+            <data name="Compartment" inType="win:Int64" outType="xs:long"/>
+            <data name="Address" inType="win:Int64" outType="xs:long"/>
+            <data name="Size" inType="win:Int64" outType="xs:long"/>
+          </template>
+
+          <template tid="HeapResizeTemplate">
+            <data name="Compartment" inType="win:Int64" outType="xs:long"/>
+            <data name="OldSize" inType="win:Int64" outType="xs:long"/>
+            <data name="NewSize" inType="win:Int64" outType="xs:long"/>
+          </template>
+
+          <template tid="ANSIStringTemplate">
+            <data name="String" inType="win:AnsiString" outType="xs:string"/>
+          </template>
+
+          <template tid="StringTemplate">
+            <data name="String" inType="win:UnicodeString" outType="xs:string"/>
+          </template>
+
+          <template tid="IntTemplate">
+            <data name="Int" inType="win:Int32" outType="xs:int"/>
+          </template>
+
+        </templates>
+      </provider>
+    </events>
+  </instrumentation>
+
+  <localization>
+    <resources culture="en-US">
+      <stringTable>
+        <string id="ProviderMessage" value="Event traces for Mozilla SpiderMonkey (Javascript engine)"/>
+        <string id="MozillaSpiderMonkey.ExecuteStart.message" value="Javascript execution start" />
+        <string id="MozillaSpiderMonkey.ExecuteDone.message" value="Javascript execution end" />
+
+        <string id="MozillaSpiderMonkey.ScriptCompileBegin.message" value="Javascript code compilation start" />
+        <string id="MozillaSpiderMonkey.ScriptCompileEnd.message" value="Javascript code compilation end" />
+        <string id="SampleProvider.SampleEvent.message" value="Sample message" />
+      </stringTable>
+    </resources>
+  </localization>
+</instrumentationManifest>
diff --git a/js/src/Makefile.in b/js/src/Makefile.in
index d7927f70529d..2980b9560af5 100644
--- a/js/src/Makefile.in
+++ b/js/src/Makefile.in
@@ -421,6 +421,7 @@ VPATH +=	$(srcdir)/assembler \
 
 CPPSRCS += \
 		Assertions.cpp \
+		OSAllocatorOS2.cpp \
 		OSAllocatorPosix.cpp \
 		OSAllocatorWin.cpp \
 		PageBlock.cpp \
@@ -450,6 +451,7 @@ CPPSRCS += 	Assertions.cpp \
         Logging.cpp \
 		MacroAssemblerARM.cpp \
 		MacroAssemblerX86Common.cpp \
+		OSAllocatorOS2.cpp \
 		OSAllocatorPosix.cpp \
 		OSAllocatorWin.cpp \
 		PageBlock.cpp \
@@ -783,6 +785,11 @@ EXTRA_DSO_LDOPTS += C:/Program\ Files/Intel/VTune/Analyzer/Lib/VtuneApi.lib
 LIBS +=  C:/Program\ Files/Intel/VTune/Analyzer/Lib/VtuneApi.lib
 endif
 
+ifdef MOZ_ETW
+# This will get the ETW provider resources into the library mozjs.dll
+RESFILE = ETWProvider.res
+endif
+
 # HP-UX does not require the extra linking of "-lm"
 ifeq (,$(filter HP-UX WINNT OS2,$(OS_ARCH)))
 EXTRA_LIBS	+= -lm
@@ -999,6 +1006,22 @@ $(CURDIR)/jsautooplen.h: host_jsoplengen$(HOST_BIN_SUFFIX)
 # Force auto-header generation before compiling any source that may use them
 $(patsubst %.cc,%.$(OBJ_SUFFIX),$(CPPSRCS:%.cpp=%.$(OBJ_SUFFIX))): $(CURDIR)/jsautokw.h $(CURDIR)/jsautooplen.h
 
+ifdef MOZ_ETW
+ETWProvider.h ETWProvider.rc ETWProvider.mof: ETWProvider.man
+	$(MC) -um -mof $^
+
+$(CPPSRCS:%.cpp=%.$(OBJ_SUFFIX)): ETWProvider.h
+
+ETWProvider.res: ETWProvider.rc
+	$(RC) -r -i "$(SDKDIR)Include" $^
+
+export:: ETWProvider.res
+
+install:: ETWProvider.mof ETWProvider.man
+	$(SYSINSTALL) $^ $(DESTDIR)$(bindir)
+
+endif
+
 ifdef HAVE_DTRACE
 $(CURDIR)/javascript-trace.h: $(srcdir)/javascript-trace.d
 	dtrace -h -s $(srcdir)/javascript-trace.d -o javascript-trace.h.in
diff --git a/js/src/assembler/wtf/Platform.h b/js/src/assembler/wtf/Platform.h
index ec8be2eda71b..194672d5fb17 100644
--- a/js/src/assembler/wtf/Platform.h
+++ b/js/src/assembler/wtf/Platform.h
@@ -478,6 +478,11 @@
 #define WTF_OS_UNIX 1
 #endif
 
+/* WTF_OS_OS2 - OS/2 */
+#if defined (__OS2__)
+#define WTF_OS_OS2 1
+#endif
+
 /* Operating environments */
 
 /* FIXME: these are all mixes of OS, operating environment and policy choices. */
@@ -846,6 +851,18 @@
 #define HAVE_SYS_PARAM_H 1
 #define HAVE_SYS_TIME_H 1
 
+#elif WTF_OS_OS2
+
+#define USE_SYSTEM_MALLOC 1
+#define HAVE_ERRNO_H 1
+#define HAVE_LANGINFO_H 1
+#define HAVE_MMAP 0
+#define HAVE_POSIX_MEMALIGN 1
+#define HAVE_SBRK 1
+#define HAVE_SYS_PARAM_H 1
+#define HAVE_SYS_TIME_H 1
+#define HAVE_STRINGS_H 1
+
 #else
 
 /* FIXME: is this actually used or do other platforms generate their own config.h? */
diff --git a/js/src/config/autoconf.mk.in b/js/src/config/autoconf.mk.in
index e76b7098ea94..103af18bd273 100644
--- a/js/src/config/autoconf.mk.in
+++ b/js/src/config/autoconf.mk.in
@@ -90,6 +90,7 @@ MOZ_JPROF       = @MOZ_JPROF@
 MOZ_SHARK       = @MOZ_SHARK@
 MOZ_CALLGRIND   = @MOZ_CALLGRIND@
 MOZ_VTUNE       = @MOZ_VTUNE@
+MOZ_ETW       = @MOZ_ETW@
 JS_HAS_CTYPES = @JS_HAS_CTYPES@
 DEHYDRA_PATH    = @DEHYDRA_PATH@
 
@@ -169,6 +170,7 @@ AS_DASH_C_FLAG	= @AS_DASH_C_FLAG@
 LD		= @LD@
 RC		= @RC@
 RCFLAGS		= @RCFLAGS@
+MC		= @MC@
 WINDRES		= @WINDRES@
 IMPLIB		= @IMPLIB@
 FILTER		= @FILTER@
diff --git a/js/src/config/rules.mk b/js/src/config/rules.mk
index c6cae7e1ffa7..638d32b8765c 100644
--- a/js/src/config/rules.mk
+++ b/js/src/config/rules.mk
@@ -2020,6 +2020,7 @@ showbuild:
 	@echo "MKSHLIB            = $(MKSHLIB)"
 	@echo "MKCSHLIB           = $(MKCSHLIB)"
 	@echo "RC                 = $(RC)"
+	@echo "MC                 = $(MC)"
 	@echo "CFLAGS             = $(CFLAGS)"
 	@echo "OS_CFLAGS          = $(OS_CFLAGS)"
 	@echo "COMPILE_CFLAGS     = $(COMPILE_CFLAGS)"
diff --git a/js/src/configure.in b/js/src/configure.in
index a0dddaf09108..d3b44c582e3a 100644
--- a/js/src/configure.in
+++ b/js/src/configure.in
@@ -2161,8 +2161,11 @@ ia64*-hpux*)
         MOZ_DEBUG_FLAGS="-g" # We want inlining
     ;;
     esac
-    ;;
 
+    if test -z "$MC"; then 
+        MC=mc.exe  
+    fi
+    ;;
 *-symbian*)
 
     AC_DEFINE(XP_UNIX)
@@ -2196,6 +2199,7 @@ ia64*-hpux*)
     DSO_PIC_CFLAGS=
     DLL_SUFFIX=.dll
     RC=rc.exe
+    MC=mc.exe
     # certain versions of cygwin's makedepend barf on the 
     # #include <string> vs -I./dist/include/string issue so don't use it
     SYSTEM_MAKEDEPEND=
@@ -2465,6 +2469,7 @@ ia64*-hpux*)
     TARGET_MD_ARCH=os2
     _PLATFORM_DEFAULT_TOOLKIT="cairo-os2"
     RC=rc.exe
+    MC=mc.exe
     RCFLAGS='-n'
     MOZ_USER_DIR="Mozilla"
 
@@ -5011,6 +5016,27 @@ if test -n "$MOZ_VTUNE"; then
     AC_DEFINE(MOZ_VTUNE)
 fi
 
+dnl ========================================================
+dnl ETW - Event Tracing for Windows
+dnl ========================================================
+MOZ_ARG_ENABLE_BOOL(ETW,
+[  --enable-ETW            Enable ETW (Event Tracing for Windows) event reporting
+                          (needs Windows Vista+ SDK)],
+    MOZ_ETW=1,
+    MOZ_ETW= )
+if test -n "$MOZ_ETW"; then
+    AC_DEFINE(MOZ_ETW)
+    WINVER=600
+fi
+
+if test -n "$MOZ_ETW"; then
+    if test -z "$MOZ_WINSDK_TARGETVER"; then
+        AC_MSG_ERROR([--enable-ETW is only valid on Windows])
+    elif test "$MOZ_WINSDK_TARGETVER" -lt "06000000"; then
+        AC_MSG_ERROR([--enable-ETW requires the Windows Vista SDK or newer])
+    fi
+fi
+
 dnl ========================================================
 dnl Profiling
 dnl ========================================================
@@ -5604,6 +5630,7 @@ AC_SUBST(AS_DASH_C_FLAG)
 AC_SUBST(LD)
 AC_SUBST(RC)
 AC_SUBST(RCFLAGS)
+AC_SUBST(MC)
 AC_SUBST(WINDRES)
 AC_SUBST(IMPLIB)
 AC_SUBST(FILTER)
@@ -5623,6 +5650,7 @@ AC_SUBST(MOZ_JPROF)
 AC_SUBST(MOZ_SHARK)
 AC_SUBST(MOZ_CALLGRIND)
 AC_SUBST(MOZ_VTUNE)
+AC_SUBST(MOZ_ETW)
 AC_SUBST(MOZ_PROFILING)
 AC_SUBST(MOZ_QUANTIFY)
 AC_SUBST(LIBICONV)
diff --git a/js/src/editline/editline.h b/js/src/editline/editline.h
index 41f8f3d3337e..237802fc90f7 100644
--- a/js/src/editline/editline.h
+++ b/js/src/editline/editline.h
@@ -115,7 +115,7 @@ extern unsigned rl_kill;
 extern unsigned rl_quit;
 extern char	*rl_complete();
 extern int	rl_list_possib();
-extern void	rl_ttyset();
+extern void	rl_ttyset(int);
 extern void	rl_add_slash();
 
 #if	!defined(HAVE_STDLIB)
diff --git a/js/src/jsapi-tests/Makefile.in b/js/src/jsapi-tests/Makefile.in
index b51159ef766b..0e35fb93fb62 100644
--- a/js/src/jsapi-tests/Makefile.in
+++ b/js/src/jsapi-tests/Makefile.in
@@ -75,6 +75,7 @@ CPPSRCS = \
   testRegExp.cpp \
   testResolveRecursion.cpp \
   testSameValue.cpp \
+  testScriptInfo.cpp \
   testScriptObject.cpp \
   testSetProperty.cpp \
   testStringBuffer.cpp \
diff --git a/js/src/jsapi-tests/testScriptInfo.cpp b/js/src/jsapi-tests/testScriptInfo.cpp
new file mode 100644
index 000000000000..2462abb42aea
--- /dev/null
+++ b/js/src/jsapi-tests/testScriptInfo.cpp
@@ -0,0 +1,40 @@
+/* -*- Mode: C++; tab-width: 8; indent-tabs-mode: nil; c-basic-offset: 4 -*-
+ * vim: set ts=8 sw=4 et tw=99:
+ */
+
+#include "tests.h"
+#include "jsdbgapi.h"
+
+const char code[] =
+    "xx = 1;       \n\
+                   \n\
+try {              \n\
+	 debugger; \n\
+                   \n\
+	 xx += 1;  \n\
+}                  \n\
+catch (e)          \n\
+{                  \n\
+	 xx += 1;  \n\
+}";
+
+// Bug 670958 - fix JS_GetScriptLineExtent, among others
+BEGIN_TEST(testScriptInfo)
+{
+    uintN startLine = 1000;
+
+    JSObject *scriptObj = JS_CompileScript(cx, global, code, strlen(code),
+                                           __FILE__, startLine);
+
+    CHECK(scriptObj);
+
+    JSScript *script = JS_GetScriptFromObject(scriptObj);
+    jsbytecode *start = JS_LineNumberToPC(cx, script, startLine);
+    CHECK_EQUAL(JS_GetScriptBaseLineNumber(cx, script), startLine);
+    CHECK_EQUAL(JS_PCToLineNumber(cx, script, start), startLine);
+    CHECK_EQUAL(JS_GetScriptLineExtent(cx, script), 10);
+    CHECK(strcmp(JS_GetScriptFilename(cx, script), __FILE__) == 0);
+    
+    return true;
+}
+END_TEST(testScriptInfo)
diff --git a/js/src/jsapi.cpp b/js/src/jsapi.cpp
index 8b8288e0733d..0959f9e0a9aa 100644
--- a/js/src/jsapi.cpp
+++ b/js/src/jsapi.cpp
@@ -76,6 +76,7 @@
 #include "jsobj.h"
 #include "jsopcode.h"
 #include "jsparse.h"
+#include "jsprobes.h"
 #include "jsproxy.h"
 #include "jsregexp.h"
 #include "jsscope.h"
@@ -630,11 +631,9 @@ JS_IsBuiltinFunctionConstructor(JSFunction *fun)
 /*
  * Has a new runtime ever been created?  This flag is used to detect unsafe
  * changes to js_CStringsAreUTF8 after a runtime has been created, and to
- * ensure that "first checks" on runtime creation are run only once.
+ * control things that should happen only once across all runtimes.
  */
-#ifdef DEBUG
 static JSBool js_NewRuntimeWasCalled = JS_FALSE;
-#endif
 
 JSRuntime::JSRuntime()
   : gcChunkAllocator(&defaultGCChunkAllocator),
@@ -750,8 +749,11 @@ JSRuntime::~JSRuntime()
 JS_PUBLIC_API(JSRuntime *)
 JS_NewRuntime(uint32 maxbytes)
 {
-#ifdef DEBUG
     if (!js_NewRuntimeWasCalled) {
+#ifdef MOZ_ETW
+        EventRegisterMozillaSpiderMonkey();
+#endif
+#ifdef DEBUG
         /*
          * This code asserts that the numbers associated with the error names
          * in jsmsg.def are monotonically increasing.  It uses values for the
@@ -776,10 +778,10 @@ JS_NewRuntime(uint32 maxbytes)
     JS_END_MACRO;
 #include "js.msg"
 #undef MSG_DEF
+#endif /* DEBUG */
 
         js_NewRuntimeWasCalled = JS_TRUE;
     }
-#endif /* DEBUG */
 
     void *mem = OffTheBooks::calloc_(sizeof(JSRuntime));
     if (!mem)
@@ -811,6 +813,10 @@ JS_ShutDown(void)
     js_CleanupLocks();
 #endif
     PRMJ_NowShutdown();
+
+#ifdef MOZ_ETW
+    EventUnregisterMozillaSpiderMonkey();
+#endif
 }
 
 JS_PUBLIC_API(void *)
@@ -2717,7 +2723,9 @@ JS_PUBLIC_API(JSString *)
 JS_NewExternalString(JSContext *cx, const jschar *chars, size_t length, intN type)
 {
     CHECK_REQUEST(cx);
-    return JSExternalString::new_(cx, chars, length, type, NULL);
+    JSString *s = JSExternalString::new_(cx, chars, length, type, NULL);
+    Probes::createString(cx, s, length);
+    return s;
 }
 
 extern JS_PUBLIC_API(JSString *)
diff --git a/js/src/jsbuiltins.h b/js/src/jsbuiltins.h
index 48127fab1116..1497c3814bca 100644
--- a/js/src/jsbuiltins.h
+++ b/js/src/jsbuiltins.h
@@ -42,12 +42,11 @@
 
 #ifdef JS_TRACER
 
+// nanojit.h includes windows.h, so undo the obnoxious #defines, if needed
 #include "nanojit/nanojit.h"
-#include "jsvalue.h"
+#include "jswin.h"
 
-#ifdef THIS
-#undef THIS
-#endif
+#include "jsvalue.h"
 
 enum JSTNErrType { INFALLIBLE, FAIL_STATUS, FAIL_NULL, FAIL_NEG, FAIL_NEITHER };
 enum { 
diff --git a/js/src/jscntxt.cpp b/js/src/jscntxt.cpp
index 934577c104d9..96afbf9ad060 100644
--- a/js/src/jscntxt.cpp
+++ b/js/src/jscntxt.cpp
@@ -149,6 +149,20 @@ ThreadData::triggerOperationCallback(JSRuntime *rt)
 
 } /* namespace js */
 
+JSScript *
+js_GetCurrentScript(JSContext *cx)
+{
+#ifdef JS_TRACER
+    VOUCH_DOES_NOT_REQUIRE_STACK();
+    if (JS_ON_TRACE(cx)) {
+        VMSideExit *bailExit = JS_TRACE_MONITOR_ON_TRACE(cx)->bailExit;
+        return bailExit ? bailExit->script : NULL;
+    }
+#endif
+    return cx->hasfp() ? cx->fp()->maybeScript() : NULL;
+}
+
+
 #ifdef JS_THREADSAFE
 
 JSThread *
diff --git a/js/src/jscntxt.h b/js/src/jscntxt.h
index c59fdb9761f7..af3f75e1870b 100644
--- a/js/src/jscntxt.h
+++ b/js/src/jscntxt.h
@@ -2283,6 +2283,9 @@ js_GetScriptedCaller(JSContext *cx, js::StackFrame *fp);
 extern jsbytecode*
 js_GetCurrentBytecodePC(JSContext* cx);
 
+extern JSScript *
+js_GetCurrentScript(JSContext* cx);
+
 extern bool
 js_CurrentPCIsInImacro(JSContext *cx);
 
diff --git a/js/src/jscrashreport.cpp b/js/src/jscrashreport.cpp
index 15aa88c71ecb..55d5b9596b64 100644
--- a/js/src/jscrashreport.cpp
+++ b/js/src/jscrashreport.cpp
@@ -52,7 +52,7 @@ const static int stack_snapshot_max_size = 32768;
 
 #if defined(XP_WIN)
 
-#include <Windows.h>
+#include <windows.h>
 
 static bool
 GetStack(uint64 *stack, uint64 *stack_len, CrashRegisters *regs, char *buffer, size_t size)
@@ -79,7 +79,8 @@ GetStack(uint64 *stack, uint64 *stack_len, CrashRegisters *regs, char *buffer, s
     *stack_len = len;
 
     /* Get the register state. */
-#if JS_BITS_PER_WORD == 32
+#if defined(_MSC_VER) && JS_BITS_PER_WORD == 32
+    /* ASM version for win2k that doesn't support RtlCaptureContext */
     uint32 vip, vsp, vbp;
     __asm {
     Label:
@@ -94,9 +95,15 @@ GetStack(uint64 *stack, uint64 *stack_len, CrashRegisters *regs, char *buffer, s
 #else
     CONTEXT context;
     RtlCaptureContext(&context);
+#if JS_BITS_PER_WORD == 32
+    regs->ip = context.Eip;
+    regs->sp = context.Esp;
+    regs->bp = context.Ebp;
+#else
     regs->ip = context.Rip;
     regs->sp = context.Rsp;
     regs->bp = context.Rbp;
+#endif
 #endif
 
     memcpy(buffer, (void *)p, len);
diff --git a/js/src/jsemit.cpp b/js/src/jsemit.cpp
index 39ffe3294253..6dcd6a93315c 100644
--- a/js/src/jsemit.cpp
+++ b/js/src/jsemit.cpp
@@ -4109,7 +4109,7 @@ EmitVariables(JSContext *cx, JSCodeGenerator *cg, JSParseNode *pn,
 {
     bool let, forInVar, first;
 #if JS_HAS_BLOCK_SCOPE
-    bool forInLet, popScope;
+    bool popScope;
     JSStmtInfo *stmt, *scopeStmt;
 #endif
     ptrdiff_t off, noteIndex, tmp;
@@ -4136,7 +4136,6 @@ EmitVariables(JSContext *cx, JSCodeGenerator *cg, JSParseNode *pn,
     let = (pn->pn_op == JSOP_NOP);
     forInVar = (pn->pn_xflags & PNX_FORINVAR) != 0;
 #if JS_HAS_BLOCK_SCOPE
-    forInLet = let && forInVar;
     popScope = (inLetHead || (let && (cg->flags & TCF_IN_FOR_INIT)));
     if (popScope) {
         stmt = cg->topStmt;
@@ -4901,9 +4900,10 @@ js_EmitTree(JSContext *cx, JSCodeGenerator *cg, JSParseNode *pn)
             return JS_FALSE;
 
         /* Set loop and enclosing label update offsets, for continue. */
+        off = CG_OFFSET(cg);
         stmt = &stmtInfo;
         do {
-            stmt->update = CG_OFFSET(cg);
+            stmt->update = off;
         } while ((stmt = stmt->down) != NULL && stmt->type == STMT_LABEL);
 
         /* Compile the loop condition, now that continues know where to go. */
@@ -4924,7 +4924,7 @@ js_EmitTree(JSContext *cx, JSCodeGenerator *cg, JSParseNode *pn)
          */
         if (!js_SetSrcNoteOffset(cx, cg, noteIndex2, 0, beq - top))
             return JS_FALSE;
-        if (!js_SetSrcNoteOffset(cx, cg, noteIndex, 0, 1 + (beq - top)))
+        if (!js_SetSrcNoteOffset(cx, cg, noteIndex, 0, 1 + (off - top)))
             return JS_FALSE;
         ok = js_PopStatementCG(cx, cg);
         break;
diff --git a/js/src/jsgc.cpp b/js/src/jsgc.cpp
index e5c39ac3a06e..8c46bc58d1d1 100644
--- a/js/src/jsgc.cpp
+++ b/js/src/jsgc.cpp
@@ -369,6 +369,7 @@ Chunk::allocateArena(JSContext *cx, unsigned thingKind)
     --info.numFree;
 
     JSRuntime *rt = info.runtime;
+    Probes::resizeHeap(comp, rt->gcBytes, rt->gcBytes + ArenaSize);
     JS_ATOMIC_ADD(&rt->gcBytes, ArenaSize);
     JS_ATOMIC_ADD(&comp->gcBytes, ArenaSize);
     if (comp->gcBytes >= comp->gcTriggerBytes)
@@ -388,6 +389,7 @@ Chunk::releaseArena(ArenaHeader *aheader)
 #endif
     JSCompartment *comp = aheader->compartment;
 
+    Probes::resizeHeap(comp, rt->gcBytes, rt->gcBytes - ArenaSize);
     JS_ASSERT(size_t(rt->gcBytes) >= ArenaSize);
     JS_ASSERT(size_t(comp->gcBytes) >= ArenaSize);
 #ifdef JS_THREADSAFE
@@ -2199,6 +2201,7 @@ SweepCompartments(JSContext *cx, JSGCInvocationKind gckind)
             (compartment->arenaListsAreEmpty() || gckind == GC_LAST_CONTEXT))
         {
             compartment->freeLists.checkEmpty();
+            Probes::GCEndSweepPhase(compartment);
             if (callback)
                 JS_ALWAYS_TRUE(callback(cx, compartment, JSCOMPARTMENT_DESTROY));
             if (compartment->principals)
@@ -2351,9 +2354,17 @@ MarkAndSweep(JSContext *cx, JSCompartment *comp, JSGCInvocationKind gckind GCTIM
         comp->finalizeShapeArenaLists(cx);
         GCTIMESTAMP(sweepShapeEnd);
     } else {
+        /*
+         * Some sweeping is not compartment-specific. Start a NULL-compartment
+         * phase to demarcate all of that. (The compartment sweeps will nest
+         * within.)
+         */
+        Probes::GCStartSweepPhase(NULL);
         SweepCrossCompartmentWrappers(cx);
-        for (JSCompartment **c = rt->compartments.begin(); c != rt->compartments.end(); c++)
+        for (JSCompartment **c = rt->compartments.begin(); c != rt->compartments.end(); c++) {
+            Probes::GCStartSweepPhase(*c);
             (*c)->finalizeObjectArenaLists(cx);
+        }
 
         GCTIMESTAMP(sweepObjectEnd);
 
@@ -2362,8 +2373,10 @@ MarkAndSweep(JSContext *cx, JSCompartment *comp, JSGCInvocationKind gckind GCTIM
 
         GCTIMESTAMP(sweepStringEnd);
 
-        for (JSCompartment **c = rt->compartments.begin(); c != rt->compartments.end(); c++)
+        for (JSCompartment **c = rt->compartments.begin(); c != rt->compartments.end(); c++) {
             (*c)->finalizeShapeArenaLists(cx);
+            Probes::GCEndSweepPhase(*c);
+        }
 
         GCTIMESTAMP(sweepShapeEnd);
     }
@@ -2382,6 +2395,9 @@ MarkAndSweep(JSContext *cx, JSCompartment *comp, JSGCInvocationKind gckind GCTIM
          * script's filename. See bug 323267.
          */
         js_SweepScriptFilenames(rt);
+
+        /* non-compartmental sweep pieces */
+        Probes::GCEndSweepPhase(NULL);
     }
 
 #ifndef JS_THREADSAFE
@@ -2696,6 +2712,16 @@ js_GC(JSContext *cx, JSCompartment *comp, JSGCInvocationKind gckind)
 
     GCTIMER_BEGIN(rt, comp);
 
+    struct AutoGCProbe {
+        JSCompartment *comp;
+        AutoGCProbe(JSCompartment *comp) : comp(comp) {
+            Probes::GCStart(comp);
+        }
+        ~AutoGCProbe() {
+            Probes::GCEnd(comp); /* background thread may still be sweeping */
+        }
+    } autoGCProbe(comp);
+
     do {
         /*
          * Let the API user decide to defer a GC if it wants to (unless this
diff --git a/js/src/jsinterp.cpp b/js/src/jsinterp.cpp
index cf649ca3abd9..bc8a806d09f2 100644
--- a/js/src/jsinterp.cpp
+++ b/js/src/jsinterp.cpp
@@ -1201,7 +1201,10 @@ InvokeConstructor(JSContext *cx, const CallArgs &argsRef)
 
             if (fun->isConstructor()) {
                 args.thisv().setMagicWithObjectOrNullPayload(NULL);
-                return CallJSNativeConstructor(cx, fun->u.n.native, args);
+            Probes::calloutBegin(cx, fun);
+            bool ok = CallJSNativeConstructor(cx, fun->u.n.native, args);
+            Probes::calloutEnd(cx, fun);
+            return ok;
             }
 
             if (!fun->isInterpretedConstructor())
@@ -1245,7 +1248,9 @@ InvokeConstructorWithGivenThis(JSContext *cx, JSObject *thisobj, const Value &fv
     bool ok;
     if (clasp == &js_FunctionClass && (fun = callee.getFunctionPrivate())->isConstructor()) {
         args.thisv().setMagicWithObjectOrNullPayload(thisobj);
+        Probes::calloutBegin(cx, fun);
         ok = CallJSNativeConstructor(cx, fun->u.n.native, args);
+        Probes::calloutEnd(cx, fun);
     } else if (clasp->construct) {
         args.thisv().setMagicWithObjectOrNullPayload(thisobj);
         ok = CallJSNativeConstructor(cx, clasp->construct, args);
diff --git a/js/src/jslibmath.h b/js/src/jslibmath.h
index 0c6f1d0bc5de..215e7a5771cb 100644
--- a/js/src/jslibmath.h
+++ b/js/src/jslibmath.h
@@ -65,7 +65,7 @@ extern double js_copysign(double, double);
 #define js_copysign copysign
 #endif
 
-#if defined(_M_X64) && _MSC_VER <= 1500
+#if defined(_M_X64) && defined(_MSC_VER) && _MSC_VER <= 1500
 // This is a workaround for fmod bug (http://support.microsoft.com/kb/982107)
 extern "C" double js_myfmod(double x, double y);
 #define fmod js_myfmod
diff --git a/js/src/jsobj.cpp b/js/src/jsobj.cpp
index b4d03df2e327..57f538ae91f1 100644
--- a/js/src/jsobj.cpp
+++ b/js/src/jsobj.cpp
@@ -70,6 +70,7 @@
 #include "jsonparser.h"
 #include "jsopcode.h"
 #include "jsparse.h"
+#include "jsprobes.h"
 #include "jsproxy.h"
 #include "jsscope.h"
 #include "jsscript.h"
@@ -100,7 +101,6 @@
 #include "jsxdrapi.h"
 #endif
 
-#include "jsprobes.h"
 #include "jsatominlines.h"
 #include "jsobjinlines.h"
 #include "jsscriptinlines.h"
@@ -954,6 +954,9 @@ static JS_ALWAYS_INLINE JSScript *
 EvalCacheLookup(JSContext *cx, JSLinearString *str, StackFrame *caller, uintN staticLevel,
                 JSPrincipals *principals, JSObject &scopeobj, JSScript **bucket)
 {
+    if (!principals)
+        return NULL;
+
     /*
      * Cache local eval scripts indexed by source qualified by scope.
      *
@@ -981,7 +984,8 @@ EvalCacheLookup(JSContext *cx, JSLinearString *str, StackFrame *caller, uintN st
             script->getVersion() == version &&
             !script->hasSingletons &&
             (script->principals == principals ||
-             (principals->subsume(principals, script->principals) &&
+             (script->principals &&
+              principals->subsume(principals, script->principals) &&
               script->principals->subsume(script->principals, principals)))) {
             /*
              * Get the prior (cache-filling) eval's saved caller function.
@@ -3961,6 +3965,7 @@ bool
 JSObject::allocSlots(JSContext *cx, size_t newcap)
 {
     uint32 oldcap = numSlots();
+    size_t oldSize = slotsAndStructSize();
 
     JS_ASSERT(newcap >= oldcap && !hasSlotsArray());
 
@@ -3979,6 +3984,8 @@ JSObject::allocSlots(JSContext *cx, size_t newcap)
     /* Copy over anything from the inline buffer. */
     memcpy(slots, fixedSlots(), oldcap * sizeof(Value));
     ClearValueRange(slots + oldcap, newcap - oldcap, isDenseArray());
+    Probes::resizeObject(cx, this, oldSize, slotsAndStructSize());
+
     return true;
 }
 
@@ -4021,11 +4028,14 @@ JSObject::growSlots(JSContext *cx, size_t newcap)
     Value *tmpslots = (Value*) cx->realloc_(slots, oldcap * sizeof(Value), actualCapacity * sizeof(Value));
     if (!tmpslots)
         return false;    /* Leave dslots as its old size. */
+    size_t oldSize = slotsAndStructSize();
     slots = tmpslots;
     capacity = actualCapacity;
 
     /* Initialize the additional slots we added. */
     ClearValueRange(slots + oldcap, actualCapacity - oldcap, isDenseArray());
+    Probes::resizeObject(cx, this, oldSize, slotsAndStructSize());
+
     return true;
 }
 
@@ -4051,6 +4061,7 @@ JSObject::shrinkSlots(JSContext *cx, size_t newcap)
     Value *tmpslots = (Value*) cx->realloc_(slots, newcap * sizeof(Value));
     if (!tmpslots)
         return;  /* Leave slots at its old size. */
+    size_t oldSize = slotsAndStructSize();
     slots = tmpslots;
     capacity = newcap;
 
@@ -4058,6 +4069,8 @@ JSObject::shrinkSlots(JSContext *cx, size_t newcap)
         /* Clear any excess holes if we tried to shrink below SLOT_CAPACITY_MIN. */
         ClearValueRange(slots + fill, newcap - fill, isDenseArray());
     }
+
+    Probes::resizeObject(cx, this, oldSize, slotsAndStructSize());
 }
 
 bool
diff --git a/js/src/jsobj.h b/js/src/jsobj.h
index f955c3382d89..9bc92ae9cb38 100644
--- a/js/src/jsobj.h
+++ b/js/src/jsobj.h
@@ -305,9 +305,12 @@ class ValidateWriter;
  * The slots member is a pointer to the slot vector for the object.
  * This can be either a fixed array allocated immediately after the object,
  * or a dynamically allocated array.  A dynamic array can be tested for with
- * hasSlotsArray().  In all cases, capacity gives the number of usable slots.
- * Two objects with the same shape have the same number of fixed slots,
- * and either both have or neither have dynamically allocated slot arrays.
+ * hasSlotsArray().  In all cases but one, capacity gives the number of usable
+ * slots. The exception is for ArrayBuffer where capacity gives the number of
+ * whole slots in the slots array (which includes one word for the array's
+ * length); there may be a fraction of a slot left over at the end.
+ * Two objects with the same shape have the same number of fixed slots, and
+ * either both have or neither have dynamically allocated slot arrays.
  *
  * If you change this struct, you'll probably need to change the AccSet values
  * in jsbuiltins.h.
@@ -386,7 +389,8 @@ struct JSObject : js::gc::Cell {
     JSObject    *proto;                     /* object's prototype */
     JSObject    *parent;                    /* object's parent */
     void        *privateData;               /* private data */
-    jsuword     capacity;                   /* capacity of slots */
+    jsuword     capacity;                   /* number of slots; for ArrayBuffer the number 
+                                               may be be non-integral, so this may underestimate */
     js::Value   *slots;                     /* dynamically allocated slots,
                                                or pointer to fixedSlots() */
 
diff --git a/js/src/jsobjinlines.h b/js/src/jsobjinlines.h
index 4077d4cdc667..77ac1e6d01f3 100644
--- a/js/src/jsobjinlines.h
+++ b/js/src/jsobjinlines.h
@@ -135,13 +135,13 @@ JSObject::finalize(JSContext *cx)
     if (isNewborn())
         return;
 
+    js::Probes::finalizeObject(this);
+
     /* Finalize obj first, in case it needs map and slots. */
     js::Class *clasp = getClass();
     if (clasp->finalize)
         clasp->finalize(cx, this);
 
-    js::Probes::finalizeObject(this);
-
     finish(cx);
 }
 
diff --git a/js/src/json.h b/js/src/json.h
index 8d8704493162..907038473b58 100644
--- a/js/src/json.h
+++ b/js/src/json.h
@@ -55,14 +55,6 @@ extern JSBool
 js_Stringify(JSContext *cx, js::Value *vp, JSObject *replacer, js::Value space,
              js::StringBuffer &sb);
 
-/* Aargh, Windows. */
-#ifdef STRICT
-#undef STRICT
-#endif
-#ifdef LEGACY
-#undef LEGACY
-#endif
-
 /*
  * The type of JSON decoding to perform.  Strict decoding is to-the-spec;
  * legacy decoding accepts a few non-JSON syntaxes historically accepted by the
diff --git a/js/src/jsopcode.cpp b/js/src/jsopcode.cpp
index a20f914619dd..19c05eb49c82 100644
--- a/js/src/jsopcode.cpp
+++ b/js/src/jsopcode.cpp
@@ -2241,8 +2241,11 @@ Decompile(SprintStack *ss, jsbytecode *pc, intN nb, JSOp nextop)
                 todo = -2;
                 switch (sn ? SN_TYPE(sn) : SRC_NULL) {
                   case SRC_WHILE:
+                    /* First instuction (NOP) contains offset to condition */
                     ++pc;
-                    tail = js_GetSrcNoteOffset(sn, 0) - 1;
+                    /* Second instruction (TRACE) contains offset to JSOP_IFNE */
+                    sn = js_GetSrcNote(jp->script, pc);
+                    tail = js_GetSrcNoteOffset(sn, 0);
                     LOCAL_ASSERT(pc[tail] == JSOP_IFNE ||
                                  pc[tail] == JSOP_IFNEX);
                     js_printf(jp, "\tdo {\n");
diff --git a/js/src/jsparse.cpp b/js/src/jsparse.cpp
index 4fe7e7f99970..d3b04bc53237 100644
--- a/js/src/jsparse.cpp
+++ b/js/src/jsparse.cpp
@@ -74,6 +74,7 @@
 #include "jsobj.h"
 #include "jsopcode.h"
 #include "jsparse.h"
+#include "jsprobes.h"
 #include "jsscan.h"
 #include "jsscope.h"
 #include "jsscript.h"
@@ -929,6 +930,8 @@ Compiler::compileScript(JSContext *cx, JSObject *scopeChain, StackFrame *callerF
     if (!cg.init(cx, JSTreeContext::USED_AS_TREE_CONTEXT))
         return NULL;
 
+    Probes::compileScriptBegin(cx, filename, lineno);
+
     MUST_FLOW_THROUGH("out");
 
     // We can specialize a bit for the given scope chain if that scope chain is the global object.
@@ -1123,6 +1126,7 @@ Compiler::compileScript(JSContext *cx, JSObject *scopeChain, StackFrame *callerF
   out:
     JS_FinishArenaPool(&codePool);
     JS_FinishArenaPool(&notePool);
+    Probes::compileScriptEnd(cx, script, filename, lineno);
     return script;
 
   too_many_slots:
diff --git a/js/src/jsprobes.cpp b/js/src/jsprobes.cpp
index f6edb6f64051..c75c0c1753ce 100644
--- a/js/src/jsprobes.cpp
+++ b/js/src/jsprobes.cpp
@@ -42,6 +42,7 @@
 #include "jsinterp.h"
 #include "jsobj.h"
 #include "jsscript.h"
+#include "jsstaticcheck.h"
 #include "jsstr.h"
 
 #ifdef __APPLE__
@@ -56,6 +57,63 @@
 using namespace js;
 
 const char Probes::nullName[] = "(null)";
+const char Probes::anonymousName[] = "(anonymous)";
+
+bool Probes::ProfilingActive = true;
+
+bool
+Probes::controlProfilers(JSContext *cx, bool toState)
+{
+    JSBool ok = JS_TRUE;
+#if defined(MOZ_SHARK) || defined(MOZ_CALLGRIND) || defined(MOZ_VTUNE)
+    jsval dummy;
+#endif
+
+    if (! ProfilingActive && toState) {
+#ifdef MOZ_SHARK
+        if (! js_StartShark(cx, 0, &dummy))
+            ok = JS_FALSE;
+#endif
+#ifdef MOZ_CALLGRIND
+        if (! js_StartCallgrind(cx, 0, &dummy))
+            ok = JS_FALSE;
+#endif
+#ifdef MOZ_VTUNE
+        if (! js_ResumeVtune(cx, 0, &dummy))
+            ok = JS_FALSE;
+#endif
+    } else if (ProfilingActive && ! toState) {
+#ifdef MOZ_SHARK
+        if (! js_StopShark(cx, 0, &dummy))
+            ok = JS_FALSE;
+#endif
+#ifdef MOZ_CALLGRIND
+        if (! js_StopCallgrind(cx, 0, &dummy))
+            ok = JS_FALSE;
+#endif
+#ifdef MOZ_VTUNE
+        if (! js_PauseVtune(cx, 0, &dummy))
+            ok = JS_FALSE;
+#endif
+    }
+
+    ProfilingActive = toState;
+
+    return ok;
+}
+
+void
+Probes::current_location(JSContext *cx, int* lineno, char const **filename)
+{
+    JSScript *script = js_GetCurrentScript(cx);
+    if (! script) {
+        *lineno = -1;
+        *filename = "(uninitialized)";
+        return;
+    }
+    *lineno = js_PCToLineNumber(cx, script, js_GetCurrentBytecodePC(cx));
+    *filename = ScriptFilename(script);
+}
 
 const char *
 Probes::FunctionClassname(const JSFunction *fun)
@@ -80,69 +138,6 @@ Probes::FunctionLineNumber(JSContext *cx, const JSFunction *fun)
     return 0;
 }
 
-/*
- * This function is used to convert function arguments and return value (jsval)
- * into the following based on each value's type tag:
- *
- *      jsval      returned
- *      -------------------
- *      STRING  -> void *
- *      INT     -> int
- *      DOUBLE  -> double *
- *      BOOLEAN -> int
- *      OBJECT  -> void *
- *
- * All are presented as void * for DTrace consumers to use, after shifting or
- * masking out the JavaScript type bits. This allows D scripts to use ints and
- * booleans directly and copyinstr() for string arguments, when types are known
- * beforehand.
- *
- * This is used by the function-args and function-rval probes, which also
- * provide raw (unmasked) jsvals should type info be useful from D scripts.
- */
-#if 0
-static void *
-jsprobes_jsvaltovoid(JSContext *cx, const js::Value &argval)
-{
-    if (argval.isNull())
-        return (void *)JS_TYPE_STR(JSTYPE_NULL);
-
-    if (argval.isUndefined())
-        return (void *)JS_TYPE_STR(JSTYPE_VOID);
-
-    if (argval.isBoolean())
-        return (void *)argval.toBoolean();
-
-    if (argval.isNumber()) {
-        if (argval.isInt32())
-            return (void *)argval.toInt32();
-        // FIXME Now what?
-        //return (void *)argval.toDouble();
-    }
-
-    return argval.toGCThing();
-}
-#endif
-
-const char *
-Probes::FunctionName(JSContext *cx, const JSFunction *fun, JSAutoByteString *bytes)
-{
-    if (!fun)
-        return nullName;
-
-    JSAtom *atom = fun->atom;
-    if (!atom) {
-        /*
-         * TODO: maybe do more work here to figure out the name of the property
-         * or variable that held the anonymous function that we're calling, if anyone
-         * cares; an easy workaround is to just give your anonymous functions names.
-         */
-        return nullName;
-    }
-
-    return bytes->encode(cx, atom) ? bytes->ptr() : nullName;
-}
-
 #ifdef INCLUDE_MOZILLA_DTRACE
 /*
  * These functions call the DTrace macros for the JavaScript USDT probes.
diff --git a/js/src/jsprobes.h b/js/src/jsprobes.h
index 0fbfef7d4026..6e1b35e8b410 100644
--- a/js/src/jsprobes.h
+++ b/js/src/jsprobes.h
@@ -33,46 +33,110 @@
  *
  * ***** END LICENSE BLOCK ***** */
 
+#ifndef _JSPROBES_H
+#define _JSPROBES_H
+
 #ifdef INCLUDE_MOZILLA_DTRACE
 #include "javascript-trace.h"
 #endif
 #include "jspubtd.h"
 #include "jsprvtd.h"
 
-#ifndef _JSPROBES_H
-#define _JSPROBES_H
-
 namespace js {
 
+#ifdef MOZ_ETW
+#include "jswin.h"
+#include <evntprov.h>
+
+/* Generated from ETWProvider.man */
+#include "ETWProvider.h"
+#endif
+
 class Probes {
+    static bool ProfilingActive;
+    static bool controlProfilers(JSContext *cx, bool toState);
+
     static const char nullName[];
+    static const char anonymousName[];
+
+    static const char *FunctionName(JSContext *cx, const JSFunction *fun, JSAutoByteString* bytes)
+    {
+        if (!fun)
+            return nullName;
+        JSAtom *atom = const_cast<JSAtom*>(fun->atom);
+        if (!atom)
+            return anonymousName;
+        return bytes->encode(cx, atom) ? bytes->ptr() : nullName;
+    }
+
+    static const char *ScriptFilename(const JSScript *script) {
+        if (! script)
+            return "(null)";
+        if (! script->filename)
+            return "(anonymous)";
+        return script->filename;
+    }
+
+    static const char *ObjectClassname(JSObject *obj) {
+        if (! obj)
+            return "(null object)";
+        Class *clasp = obj->getClass();
+        if (! clasp)
+            return "(null)";
+        const char *class_name = clasp->name;
+        if (! class_name)
+            return "(null class name)";
+        return class_name;
+    }
+
+    static void current_location(JSContext *cx, int* lineno, char const **filename);
 
     static const char *FunctionClassname(const JSFunction *fun);
     static const char *ScriptFilename(JSScript *script);
     static int FunctionLineNumber(JSContext *cx, const JSFunction *fun);
-    static const char *FunctionName(JSContext *cx, const JSFunction *fun, JSAutoByteString *bytes);
 
     static void enterJSFunImpl(JSContext *cx, JSFunction *fun, JSScript *script);
     static void handleFunctionReturn(JSContext *cx, JSFunction *fun, JSScript *script);
     static void finalizeObjectImpl(JSObject *obj);
   public:
+    /*
+     * Pause/resume whatever profiling mechanism is currently compiled
+     * in, if applicable. This will not affect things like dtrace.
+     *
+     * Do not mix calls to these APIs with calls to the individual
+     * profilers' pase/resume functions, because only overall state is
+     * tracked, not the state of each profiler.
+     *
+     * Return the previous state.
+     */
+    static bool pauseProfilers(JSContext *cx) {
+        bool prevState = ProfilingActive;
+        controlProfilers(cx, false);
+        return prevState;
+    }
+    static bool resumeProfilers(JSContext *cx) {
+        bool prevState = ProfilingActive;
+        controlProfilers(cx, true);
+        return prevState;
+    }
+
     static bool callTrackingActive(JSContext *);
 
-    static void enterJSFun(JSContext *, JSFunction *, JSScript *, int counter = 1);
-    static void exitJSFun(JSContext *, JSFunction *, JSScript *, int counter = 0);
+    static bool enterJSFun(JSContext *, JSFunction *, JSScript *, int counter = 1);
+    static bool exitJSFun(JSContext *, JSFunction *, JSScript *, int counter = 0);
 
-    static void startExecution(JSContext *cx, JSScript *script);
-    static void stopExecution(JSContext *cx, JSScript *script);
+    static bool startExecution(JSContext *cx, JSScript *script);
+    static bool stopExecution(JSContext *cx, JSScript *script);
 
-    static void resizeHeap(JSCompartment *compartment, size_t oldSize, size_t newSize);
+    static bool resizeHeap(JSCompartment *compartment, size_t oldSize, size_t newSize);
 
     /* |obj| must exist (its class and size are computed) */
-    static void createObject(JSContext *cx, JSObject *obj);
+    static bool createObject(JSContext *cx, JSObject *obj);
 
-    static void resizeObject(JSContext *cx, JSObject *obj, size_t oldSize, size_t newSize);
+    static bool resizeObject(JSContext *cx, JSObject *obj, size_t oldSize, size_t newSize);
 
     /* |obj| must still exist (its class is accessed) */
-    static void finalizeObject(JSObject *obj);
+    static bool finalizeObject(JSObject *obj);
 
     /*
      * |string| does not need to contain any content yet; only its
@@ -82,29 +146,29 @@ class Probes {
      * string, or a rope, and the encoding is not taken into
      * consideration.)
      */
-    static void createString(JSContext *cx, JSString *string, size_t length);
+    static bool createString(JSContext *cx, JSString *string, size_t length);
 
     /*
      * |string| must still have a valid length.
      */
-    static void finalizeString(JSString *string);
+    static bool finalizeString(JSString *string);
 
-    static void compileScriptBegin(JSContext *cx, const char *filename, int lineno);
-    static void compileScriptEnd(JSContext *cx, JSScript *script, const char *filename, int lineno);
+    static bool compileScriptBegin(JSContext *cx, const char *filename, int lineno);
+    static bool compileScriptEnd(JSContext *cx, JSScript *script, const char *filename, int lineno);
 
-    static void calloutBegin(JSContext *cx, JSFunction *fun);
-    static void calloutEnd(JSContext *cx, JSFunction *fun);
+    static bool calloutBegin(JSContext *cx, JSFunction *fun);
+    static bool calloutEnd(JSContext *cx, JSFunction *fun);
 
-    static void acquireMemory(JSContext *cx, void *address, size_t nbytes);
-    static void releaseMemory(JSContext *cx, void *address, size_t nbytes);
+    static bool acquireMemory(JSContext *cx, void *address, size_t nbytes);
+    static bool releaseMemory(JSContext *cx, void *address, size_t nbytes);
 
-    static void GCStart(JSCompartment *compartment);
-    static void GCEnd(JSCompartment *compartment);
-    static void GCStartMarkPhase(JSCompartment *compartment);
+    static bool GCStart(JSCompartment *compartment);
+    static bool GCEnd(JSCompartment *compartment);
+    static bool GCStartMarkPhase(JSCompartment *compartment);
 
-    static void GCEndMarkPhase(JSCompartment *compartment);
-    static void GCStartSweepPhase(JSCompartment *compartment);
-    static void GCEndSweepPhase(JSCompartment *compartment);
+    static bool GCEndMarkPhase(JSCompartment *compartment);
+    static bool GCStartSweepPhase(JSCompartment *compartment);
+    static bool GCEndSweepPhase(JSCompartment *compartment);
 
     static bool CustomMark(JSString *string);
     static bool CustomMark(const char *string);
@@ -132,9 +196,27 @@ Probes::callTrackingActive(JSContext *cx)
     return false;
 }
 
-inline void
+extern inline JS_FRIEND_API(JSBool)
+js_PauseProfilers(JSContext *cx, uintN argc, jsval *vp)
+{
+    Probes::pauseProfilers(cx);
+    return JS_TRUE;
+}
+
+extern inline JS_FRIEND_API(JSBool)
+js_ResumeProfilers(JSContext *cx, uintN argc, jsval *vp)
+{
+    Probes::resumeProfilers(cx);
+    return JS_TRUE;
+}
+
+extern JS_FRIEND_API(JSBool)
+js_ResumeProfilers(JSContext *cx, uintN argc, jsval *vp);
+
+inline bool
 Probes::enterJSFun(JSContext *cx, JSFunction *fun, JSScript *script, int counter)
 {
+    bool ok = true;
 #ifdef INCLUDE_MOZILLA_DTRACE
     if (JAVASCRIPT_FUNCTION_ENTRY_ENABLED())
         enterJSFunImpl(cx, fun, script);
@@ -142,11 +224,26 @@ Probes::enterJSFun(JSContext *cx, JSFunction *fun, JSScript *script, int counter
 #ifdef MOZ_TRACE_JSCALLS
     cx->doFunctionCallback(fun, script, counter);
 #endif
+#ifdef MOZ_ETW
+    if (ProfilingActive) {
+        JSScript* script = fun ? FUN_SCRIPT(fun) : NULL;
+        int lineno = script ? script->lineno : -1;
+        JSAutoByteString bytes;
+        if (EventWriteEvtFunctionEntry(ScriptFilename(script), lineno,
+                                       ObjectClassname((JSObject *)fun),
+                                       FunctionName(cx, fun, &bytes)) != ERROR_SUCCESS)
+            ok = false;
+    }
+#endif
+
+    return ok;
 }
 
-inline void
+inline bool
 Probes::exitJSFun(JSContext *cx, JSFunction *fun, JSScript *script, int counter)
 {
+    bool ok = true;
+
 #ifdef INCLUDE_MOZILLA_DTRACE
     if (JAVASCRIPT_FUNCTION_RETURN_ENABLED())
         handleFunctionReturn(cx, fun, script);
@@ -156,22 +253,65 @@ Probes::exitJSFun(JSContext *cx, JSFunction *fun, JSScript *script, int counter)
         counter = -counter;
     cx->doFunctionCallback(fun, script, counter);
 #endif
-}
-
-inline void
-Probes::createObject(JSContext *cx, JSObject *obj)
-{
-#ifdef INCLUDE_MOZILLA_DTRACE
-    if (JAVASCRIPT_OBJECT_CREATE_ENABLED()) {
-        Class *clasp = obj->getClass();
-        JAVASCRIPT_OBJECT_CREATE((char *)clasp->name, (uintptr_t)obj);
+#ifdef MOZ_ETW
+    if (ProfilingActive) {
+        JSScript* script = fun ? FUN_SCRIPT(fun) : NULL;
+        int lineno = script ? script->lineno : -1;
+        JSAutoByteString bytes;
+        if (EventWriteEvtFunctionExit(ScriptFilename(script), lineno,
+                                      ObjectClassname((JSObject *)fun),
+                                      FunctionName(cx, fun, &bytes)) != ERROR_SUCCESS)
+            ok = false;
     }
 #endif
+
+    return ok;
 }
 
-inline void
+inline bool
+Probes::resizeHeap(JSCompartment *compartment, size_t oldSize, size_t newSize)
+{
+    bool ok = true;
+
+#ifdef MOZ_ETW
+    if (ProfilingActive)
+        if (EventWriteEvtHeapResize(reinterpret_cast<JSUint64>(compartment), oldSize, newSize) != ERROR_SUCCESS)
+            ok = false;
+#endif
+
+    return ok;
+}
+
+inline bool
+Probes::createObject(JSContext *cx, JSObject *obj)
+{
+    bool ok = true;
+
+#ifdef INCLUDE_MOZILLA_DTRACE
+    if (JAVASCRIPT_OBJECT_CREATE_ENABLED())
+        JAVASCRIPT_OBJECT_CREATE(ObjectClassname(obj), (uintptr_t)obj);
+#endif
+#ifdef MOZ_ETW
+    if (ProfilingActive) {
+        int lineno;
+        const char * script_filename;
+        current_location(cx, &lineno, &script_filename);
+
+        if (EventWriteEvtObjectCreate(script_filename, lineno,
+                                      ObjectClassname(obj), reinterpret_cast<JSUint64>(obj),
+                                      obj ? obj->slotsAndStructSize() : 0) != ERROR_SUCCESS)
+            ok = false;
+    }
+#endif
+
+    return ok;
+}
+
+inline bool
 Probes::finalizeObject(JSObject *obj)
 {
+    bool ok = true;
+
 #ifdef INCLUDE_MOZILLA_DTRACE
     if (JAVASCRIPT_OBJECT_FINALIZE_ENABLED()) {
         Class *clasp = obj->getClass();
@@ -180,52 +320,346 @@ Probes::finalizeObject(JSObject *obj)
         JAVASCRIPT_OBJECT_FINALIZE(NULL, (char *)clasp->name, (uintptr_t)obj);
     }
 #endif
+#ifdef MOZ_ETW
+    if (ProfilingActive)
+        if (EventWriteEvtObjectFinalize(ObjectClassname(obj),
+                                        reinterpret_cast<JSUint64>(obj)) != ERROR_SUCCESS)
+            ok = false;
+#endif
+
+    return ok;
 }
 
-inline void
+inline bool
+Probes::resizeObject(JSContext *cx, JSObject *obj, size_t oldSize, size_t newSize)
+{
+    bool ok = true;
+
+#ifdef MOZ_ETW
+    if (ProfilingActive) {
+        int lineno;
+        const char *script_filename;
+        current_location(cx, &lineno, &script_filename);
+
+        if (EventWriteEvtObjectResize(script_filename, lineno,
+                                      ObjectClassname(obj), reinterpret_cast<JSUint64>(obj),
+                                      oldSize, newSize) != ERROR_SUCCESS)
+            ok = false;
+    }
+#endif
+
+    return ok;
+}
+
+inline bool
+Probes::createString(JSContext *cx, JSString *string, size_t length)
+{
+    bool ok = true;
+
+#ifdef MOZ_ETW
+    if (ProfilingActive) {
+        int lineno;
+        const char *script_filename;
+        current_location(cx, &lineno, &script_filename);
+
+        if (EventWriteEvtStringCreate(script_filename, lineno,
+                                      reinterpret_cast<JSUint64>(string), length) != ERROR_SUCCESS)
+            ok = 0;
+    }
+#endif
+
+    return ok;
+}
+
+inline bool
+Probes::finalizeString(JSString *string)
+{
+    bool ok = true;
+
+#ifdef MOZ_ETW
+    if (ProfilingActive)
+        if (EventWriteEvtStringFinalize(reinterpret_cast<JSUint64>(string), string->length()) != ERROR_SUCCESS)
+            ok = false;
+#endif
+
+    return ok;
+}
+
+inline bool
+Probes::compileScriptBegin(JSContext *cx, const char *filename, int lineno)
+{
+    bool ok = true;
+
+#ifdef MOZ_ETW
+    if (ProfilingActive)
+        if (EventWriteEvtScriptCompileBegin(filename, lineno) != ERROR_SUCCESS)
+            ok = false;
+#endif
+
+    return ok;
+}
+
+inline bool
+Probes::compileScriptEnd(JSContext *cx, JSScript *script, const char *filename, int lineno)
+{
+    bool ok = true;
+
+#ifdef MOZ_ETW
+    if (ProfilingActive)
+        if (EventWriteEvtScriptCompileEnd(filename, lineno) != ERROR_SUCCESS)
+            ok = false;
+#endif
+
+    return ok;
+}
+
+inline bool
+Probes::calloutBegin(JSContext *cx, JSFunction *fun)
+{
+    bool ok = true;
+
+#ifdef MOZ_ETW
+    if (ProfilingActive) {
+        const char *script_filename;
+        int lineno;
+        JSAutoByteString bytes;
+        current_location(cx, &lineno, &script_filename);
+
+        if (EventWriteEvtCalloutBegin(script_filename,
+                                      lineno,
+                                      ObjectClassname((JSObject *)fun),
+                                      FunctionName(cx, fun, &bytes)) != ERROR_SUCCESS)
+            ok = false;
+    }
+#endif
+
+    return ok;
+}
+
+inline bool
+Probes::calloutEnd(JSContext *cx, JSFunction *fun)
+{
+    bool ok = true;
+
+#ifdef MOZ_ETW
+    if (ProfilingActive) {
+        const char *script_filename;
+        int lineno;
+        JSAutoByteString bytes;
+        current_location(cx, &lineno, &script_filename);
+
+        if (EventWriteEvtCalloutEnd(script_filename,
+                                    lineno,
+                                    ObjectClassname((JSObject *)fun),
+                                    FunctionName(cx, fun, &bytes)) != ERROR_SUCCESS)
+            ok = false;
+    }
+#endif
+
+    return ok;
+}
+
+inline bool
+Probes::acquireMemory(JSContext *cx, void *address, size_t nbytes)
+{
+    bool ok = true;
+
+#ifdef MOZ_ETW
+    if (ProfilingActive)
+        if (EventWriteEvtMemoryAcquire(reinterpret_cast<JSUint64>(cx->compartment),
+                                       reinterpret_cast<JSUint64>(address),
+                                       nbytes) != ERROR_SUCCESS)
+            ok = false;
+#endif
+
+    return ok;
+}
+
+inline bool
+Probes::releaseMemory(JSContext *cx, void *address, size_t nbytes)
+{
+    bool ok = true;
+
+#ifdef MOZ_ETW
+    if (ProfilingActive)
+        if (EventWriteEvtMemoryRelease(reinterpret_cast<JSUint64>(cx->compartment),
+                                       reinterpret_cast<JSUint64>(address),
+                                       nbytes) != ERROR_SUCCESS)
+            ok = false;
+#endif
+
+    return ok;
+}
+
+inline bool
+Probes::GCStart(JSCompartment *compartment)
+{
+    bool ok = true;
+
+#ifdef MOZ_ETW
+    if (ProfilingActive)
+        if (EventWriteEvtGCStart(reinterpret_cast<JSUint64>(compartment)) != ERROR_SUCCESS)
+            ok = false;
+#endif
+
+    return ok;
+}
+
+inline bool
+Probes::GCEnd(JSCompartment *compartment)
+{
+    bool ok = true;
+
+#ifdef MOZ_ETW
+    if (ProfilingActive)
+        if (EventWriteEvtGCEnd(reinterpret_cast<JSUint64>(compartment)) != ERROR_SUCCESS)
+            ok = false;
+#endif
+
+    return ok;
+}
+
+inline bool
+Probes::GCStartMarkPhase(JSCompartment *compartment)
+{
+    bool ok = true;
+
+#ifdef MOZ_ETW
+    if (ProfilingActive)
+        if (EventWriteEvtGCStartMarkPhase(reinterpret_cast<JSUint64>(compartment)) != ERROR_SUCCESS)
+            ok = false;
+#endif
+
+    return ok;
+}
+
+inline bool
+Probes::GCEndMarkPhase(JSCompartment *compartment)
+{
+    bool ok = true;
+
+#ifdef MOZ_ETW
+    if (ProfilingActive)
+        if (EventWriteEvtGCEndMarkPhase(reinterpret_cast<JSUint64>(compartment)) != ERROR_SUCCESS)
+            ok = false;
+#endif
+
+    return ok;
+}
+
+inline bool
+Probes::GCStartSweepPhase(JSCompartment *compartment)
+{
+    bool ok = true;
+
+#ifdef MOZ_ETW
+    if (ProfilingActive)
+        if (EventWriteEvtGCStartSweepPhase(reinterpret_cast<JSUint64>(compartment)) != ERROR_SUCCESS)
+            ok = false;
+#endif
+
+    return ok;
+}
+
+inline bool
+Probes::GCEndSweepPhase(JSCompartment *compartment)
+{
+    bool ok = true;
+
+#ifdef MOZ_ETW
+    if (ProfilingActive)
+        if (EventWriteEvtGCEndSweepPhase(reinterpret_cast<JSUint64>(compartment)) != ERROR_SUCCESS)
+            ok = false;
+#endif
+
+    return ok;
+}
+
+inline bool
+Probes::CustomMark(JSString *string)
+{
+    bool ok = true;
+
+#ifdef MOZ_ETW
+    if (ProfilingActive) {
+        const jschar *chars = string->getCharsZ(NULL);
+        if (!chars || EventWriteEvtCustomString(chars) != ERROR_SUCCESS)
+            ok = false;
+    }
+#endif
+
+    return ok;
+}
+
+inline bool
+Probes::CustomMark(const char *string)
+{
+    bool ok = true;
+
+#ifdef MOZ_ETW
+    if (ProfilingActive)
+        if (EventWriteEvtCustomANSIString(string) != ERROR_SUCCESS)
+            ok = false;
+#endif
+
+    return ok;
+}
+
+inline bool
+Probes::CustomMark(int marker)
+{
+    bool ok = true;
+
+#ifdef MOZ_ETW
+    if (ProfilingActive)
+        if (EventWriteEvtCustomInt(marker) != ERROR_SUCCESS)
+            ok = false;
+#endif
+
+    return ok;
+}
+
+inline bool
 Probes::startExecution(JSContext *cx, JSScript *script)
 {
+    bool ok = true;
+
 #ifdef INCLUDE_MOZILLA_DTRACE
     if (JAVASCRIPT_EXECUTE_START_ENABLED())
         JAVASCRIPT_EXECUTE_START((script->filename ? (char *)script->filename : nullName),
                                  script->lineno);
 #endif
+#ifdef MOZ_ETW
+    if (ProfilingActive) {
+        int lineno = script ? script->lineno : -1;
+        if (EventWriteEvtExecuteStart(ScriptFilename(script), lineno) != ERROR_SUCCESS)
+            ok = false;
+    }
+#endif
+
+    return ok;
 }
 
-inline void
+inline bool
 Probes::stopExecution(JSContext *cx, JSScript *script)
 {
+    bool ok = true;
+
 #ifdef INCLUDE_MOZILLA_DTRACE
     if (JAVASCRIPT_EXECUTE_DONE_ENABLED())
         JAVASCRIPT_EXECUTE_DONE((script->filename ? (char *)script->filename : nullName),
                                 script->lineno);
 #endif
-}
+#ifdef MOZ_ETW
+    if (ProfilingActive) {
+        int lineno = script ? script->lineno : -1;
+        if (EventWriteEvtExecuteDone(ScriptFilename(script), lineno) != ERROR_SUCCESS)
+            ok = false;
+    }
+#endif
 
-/*
- * New probes with no implementations, yet. Next patch will implement
- * them. These are here just to make all intermediate patches compile
- * and run.
- */
-inline void Probes::resizeHeap(JSCompartment *compartment, size_t oldSize, size_t newSize) {}
-inline void Probes::resizeObject(JSContext *cx, JSObject *obj, size_t oldSize, size_t newSize) {}
-inline void Probes::createString(JSContext *cx, JSString *string, size_t length) {}
-inline void Probes::finalizeString(JSString *string) {}
-inline void Probes::compileScriptBegin(JSContext *cx, const char *filename, int lineno) {}
-inline void Probes::compileScriptEnd(JSContext *cx, JSScript *script, const char *filename, int lineno) {}
-inline void Probes::calloutBegin(JSContext *cx, JSFunction *fun) {}
-inline void Probes::calloutEnd(JSContext *cx, JSFunction *fun) {}
-inline void Probes::acquireMemory(JSContext *cx, void *address, size_t nbytes) {}
-inline void Probes::releaseMemory(JSContext *cx, void *address, size_t nbytes) {}
-inline void Probes::GCStart(JSCompartment *compartment) {}
-inline void Probes::GCEnd(JSCompartment *compartment) {}
-inline void Probes::GCStartMarkPhase(JSCompartment *compartment) {}
-inline void Probes::GCEndMarkPhase(JSCompartment *compartment) {}
-inline void Probes::GCStartSweepPhase(JSCompartment *compartment) {}
-inline void Probes::GCEndSweepPhase(JSCompartment *compartment) {}
-inline bool Probes::CustomMark(JSString *string) { return JS_TRUE; }
-inline bool Probes::CustomMark(const char *string) { return JS_TRUE; }
-inline bool Probes::CustomMark(int marker) { return JS_TRUE; }
+    return ok;
+}
 
 struct AutoFunctionCallProbe {
     JSContext * const cx;
diff --git a/js/src/jsregexp.cpp b/js/src/jsregexp.cpp
index 6892d9b108b0..ef82629f59c9 100644
--- a/js/src/jsregexp.cpp
+++ b/js/src/jsregexp.cpp
@@ -814,33 +814,28 @@ static JSFunctionSpec regexp_methods[] = {
 };
 
 JSObject *
-js_InitRegExpClass(JSContext *cx, JSObject *global)
+js_InitRegExpClass(JSContext *cx, JSObject *obj)
 {
-    JS_ASSERT(global->isGlobal());
-    JS_ASSERT(global->isNative());
+    JS_ASSERT(obj->isNative());
 
-    /* Create and initialize RegExp.prototype. */
-    JSObject *objectProto;
-    if (!js_GetClassPrototype(cx, global, JSProto_Object, &objectProto))
-        return NULL;
-    JS_ASSERT(objectProto);
+    GlobalObject *global = obj->asGlobal();
 
-    JSObject *proto = NewObject<WithProto::Class>(cx, &js_RegExpClass, objectProto, global);
+    JSObject *proto = global->createBlankPrototype(cx, &js_RegExpClass);
     if (!proto)
         return NULL;
 
     AlreadyIncRefed<RegExp> re = RegExp::create(cx, cx->runtime->emptyString, 0, NULL);
     if (!re)
         return NULL;
-#ifdef DEBUG
-    assertSameCompartment(cx, proto, re->compartment);
-#endif
 
     /*
      * Associate the empty regular expression with RegExp.prototype, and define
      * the initial non-method properties of any regular expression instance.
      * These must be added before methods to preserve slot layout.
      */
+#ifdef DEBUG
+    assertSameCompartment(cx, proto, re->compartment);
+#endif
     if (!proto->initRegExp(cx, re.get()))
         return NULL;
 
@@ -882,17 +877,6 @@ js_InitRegExpClass(JSContext *cx, JSObject *global)
         return NULL;
     }
 
-    /*
-     * Make sure proto's emptyShape is available to be shared by objects of
-     * this class.  JSObject::emptyShape is a one-slot cache. If we omit this,
-     * some other class could snap it up. (The risk is particularly great for
-     * Object.prototype.)
-     *
-     * All callers of JSObject::initSharingEmptyShape depend on this.
-     */
-    if (!proto->getEmptyShape(cx, &js_RegExpClass, FINALIZE_OBJECT0))
-        return NULL;
-
     /* Install the fully-constructed RegExp and RegExp.prototype in global. */
     if (!DefineConstructorAndPrototype(cx, global, JSProto_RegExp, ctor, proto))
         return NULL;
diff --git a/js/src/jsregexpinlines.h b/js/src/jsregexpinlines.h
index 09f933af0ff5..129f0b48ba65 100644
--- a/js/src/jsregexpinlines.h
+++ b/js/src/jsregexpinlines.h
@@ -491,7 +491,9 @@ RegExp::compileHelper(JSContext *cx, JSLinearString &pattern, TokenStream *ts)
     }
 #endif
 
+#if ENABLE_YARR_JIT
     codeBlock.setFallBack(true);
+#endif
     byteCode = JSC::Yarr::byteCompile(yarrPattern, cx->compartment->regExpAllocator).get();
 
     return true;
diff --git a/js/src/jsscript.cpp b/js/src/jsscript.cpp
index 543b1e73a4dd..1f9cb86f8dfc 100644
--- a/js/src/jsscript.cpp
+++ b/js/src/jsscript.cpp
@@ -1714,19 +1714,36 @@ out:
 JS_FRIEND_API(uintN)
 js_GetScriptLineExtent(JSScript *script)
 {
+
+    bool counting;
     uintN lineno;
+    uintN maxLineNo;
     jssrcnote *sn;
     JSSrcNoteType type;
 
     lineno = script->lineno;
+    maxLineNo = 0;
+    counting = true;
     for (sn = script->notes(); !SN_IS_TERMINATOR(sn); sn = SN_NEXT(sn)) {
         type = (JSSrcNoteType) SN_TYPE(sn);
         if (type == SRC_SETLINE) {
+            if (maxLineNo < lineno)
+                maxLineNo = lineno;
             lineno = (uintN) js_GetSrcNoteOffset(sn, 0);
+            counting = true;
+            if (maxLineNo < lineno)
+                maxLineNo = lineno;
+            else
+                counting = false;
         } else if (type == SRC_NEWLINE) {
-            lineno++;
+            if (counting)
+                lineno++;
         }
     }
+
+    if (maxLineNo > lineno)
+        lineno = maxLineNo;
+
     return 1 + lineno - script->lineno;
 }
 
diff --git a/js/src/jsstr.cpp b/js/src/jsstr.cpp
index 9cdde816039d..f83abc4a6e31 100644
--- a/js/src/jsstr.cpp
+++ b/js/src/jsstr.cpp
@@ -67,6 +67,7 @@
 #include "jsnum.h"
 #include "jsobj.h"
 #include "jsopcode.h"
+#include "jsprobes.h"
 #include "jsregexp.h"
 #include "jsscope.h"
 #include "jsstaticcheck.h"
@@ -141,7 +142,7 @@ str_encodeURI(JSContext *cx, uintN argc, Value *vp);
 static JSBool
 str_encodeURI_Component(JSContext *cx, uintN argc, Value *vp);
 
-static const uint32 OVERLONG_UTF8 = UINT32_MAX;
+static const uint32 INVALID_UTF8 = UINT32_MAX;
 
 static uint32
 Utf8ToOneUcs4Char(const uint8 *utf8Buffer, int utf8Length);
@@ -3163,24 +3164,13 @@ StringObject::assignInitialShape(JSContext *cx)
 }
 
 JSObject *
-js_InitStringClass(JSContext *cx, JSObject *global)
+js_InitStringClass(JSContext *cx, JSObject *obj)
 {
-    JS_ASSERT(global->isGlobal());
-    JS_ASSERT(global->isNative());
+    JS_ASSERT(obj->isNative());
 
-    /*
-     * Define escape/unescape, the URI encode/decode functions, and maybe
-     * uneval on the global object.
-     */
-    if (!JS_DefineFunctions(cx, global, string_functions))
-        return NULL;
+    GlobalObject *global = obj->asGlobal();
 
-    /* Create and initialize String.prototype. */
-    JSObject *objectProto;
-    if (!js_GetClassPrototype(cx, global, JSProto_Object, &objectProto))
-        return NULL;
-
-    JSObject *proto = NewObject<WithProto::Class>(cx, &js_StringClass, objectProto, global);
+    JSObject *proto = global->createBlankPrototype(cx, &js_StringClass);
     if (!proto || !proto->asString()->init(cx, cx->runtime->emptyString))
         return NULL;
 
@@ -3214,21 +3204,17 @@ js_InitStringClass(JSContext *cx, JSObject *global)
     proto->brand(cx);
     ctor->brand(cx);
 
-    /*
-     * Make sure proto's emptyShape is available to be shared by String
-     * objects. JSObject::emptyShape is a one-slot cache. If we omit this, some
-     * other class could snap it up. (The risk is particularly great for
-     * Object.prototype.)
-     *
-     * All callers of JSObject::initSharingEmptyShape depend on this.
-     */
-    if (!proto->getEmptyShape(cx, &js_StringClass, FINALIZE_OBJECT0))
-        return NULL;
-
     /* Install the fully-constructed String and String.prototype. */
     if (!DefineConstructorAndPrototype(cx, global, JSProto_String, ctor, proto))
         return NULL;
 
+    /*
+     * Define escape/unescape, the URI encode/decode functions, and maybe
+     * uneval on the global object.
+     */
+    if (!JS_DefineFunctions(cx, global, string_functions))
+        return NULL;
+
     return proto;
 }
 
@@ -3238,7 +3224,9 @@ js_NewString(JSContext *cx, jschar *chars, size_t length)
     if (!CheckStringLength(cx, length))
         return NULL;
 
-    return JSFixedString::new_(cx, chars, length);
+    JSFixedString *s = JSFixedString::new_(cx, chars, length);
+    Probes::createString(cx, s, length);
+    return s;
 }
 
 static JS_ALWAYS_INLINE JSFixedString *
@@ -3259,6 +3247,7 @@ NewShortString(JSContext *cx, const jschar *chars, size_t length)
     jschar *storage = str->init(length);
     PodCopy(storage, chars, length);
     storage[length] = 0;
+    Probes::createString(cx, str, length);
     return str;
 }
 
@@ -3289,6 +3278,7 @@ NewShortString(JSContext *cx, const char *chars, size_t length)
             *p++ = (unsigned char)*chars++;
         *p = 0;
     }
+    Probes::createString(cx, str, length);
     return str;
 }
 
@@ -3379,7 +3369,9 @@ js_NewDependentString(JSContext *cx, JSString *baseArg, size_t start, size_t len
     if (JSLinearString *staticStr = JSAtom::lookupStatic(chars, length))
         return staticStr;
 
-    return JSDependentString::new_(cx, base, chars, length);
+    JSLinearString *s = JSDependentString::new_(cx, base, chars, length);
+    Probes::createString(cx, s, length);
+    return s;
 }
 
 JSFixedString *
@@ -5643,8 +5635,8 @@ Utf8ToOneUcs4Char(const uint8 *utf8Buffer, int utf8Length)
             JS_ASSERT((*utf8Buffer & 0xC0) == 0x80);
             ucs4Char = ucs4Char<<6 | (*utf8Buffer++ & 0x3F);
         }
-        if (JS_UNLIKELY(ucs4Char < minucs4Char)) {
-            ucs4Char = OVERLONG_UTF8;
+        if (JS_UNLIKELY(ucs4Char < minucs4Char || (ucs4Char >= 0xD800 && ucs4Char <= 0xDFFF))) {
+            ucs4Char = INVALID_UTF8;
         } else if (ucs4Char == 0xFFFE || ucs4Char == 0xFFFF) {
             ucs4Char = 0xFFFD;
         }
diff --git a/js/src/jstracer.cpp b/js/src/jstracer.cpp
index 2b93aedf6728..6a21c0fec354 100644
--- a/js/src/jstracer.cpp
+++ b/js/src/jstracer.cpp
@@ -4405,6 +4405,7 @@ TraceRecorder::snapshot(ExitType exitType)
                                            0;
     exit->exitType = exitType;
     exit->pc = pc;
+    exit->script = fp->maybeScript();
     exit->imacpc = fp->maybeImacropc();
     exit->sp_adj = (stackSlots * sizeof(double)) - tree->nativeStackBase;
     exit->rp_adj = exit->calldepth * sizeof(FrameInfo*);
diff --git a/js/src/jstracer.h b/js/src/jstracer.h
index 3e6720947ae5..32b96a89760e 100644
--- a/js/src/jstracer.h
+++ b/js/src/jstracer.h
@@ -364,6 +364,7 @@ struct FrameInfo;
 
 struct VMSideExit : public nanojit::SideExit
 {
+    JSScript* script;
     jsbytecode* pc;
     jsbytecode* imacpc;
     intptr_t sp_adj;
diff --git a/js/src/jstypedarray.cpp b/js/src/jstypedarray.cpp
index d4a545fa3414..779f74dfa811 100644
--- a/js/src/jstypedarray.cpp
+++ b/js/src/jstypedarray.cpp
@@ -152,11 +152,19 @@ ArrayBuffer::class_constructor(JSContext *cx, uintN argc, Value *vp)
 static inline JSBool
 AllocateSlots(JSContext *cx, JSObject *obj, uint32 size)
 {
-    uint32 bytes = size + sizeof(js::Value);
-    if (size > sizeof(js::Value) * ARRAYBUFFER_RESERVED_SLOTS - sizeof(js::Value) ) {
-        obj->slots = (js::Value *)cx->calloc_(bytes);
-        if (!obj->slots)
+    uint32 bytes = size + sizeof(Value);
+    if (size > sizeof(Value) * ARRAYBUFFER_RESERVED_SLOTS - sizeof(Value) ) {
+        JS_ASSERT(!obj->hasSlotsArray());
+        Value *tmpslots = (Value *)cx->calloc_(bytes);
+        if (!tmpslots)
             return false;
+        obj->slots = tmpslots;
+        /*
+         * Note that |bytes| may not be a multiple of |sizeof(Value)|, so
+         * |capacity * sizeof(Value)| may underestimate the size by up to
+         * |sizeof(Value) - 1| bytes.
+         */
+        obj->capacity = bytes / sizeof(Value);
     } else {
         memset(obj->slots, 0, bytes);
     }
diff --git a/js/src/jsvalue.h b/js/src/jsvalue.h
index ebe6cc987779..75064bd38670 100644
--- a/js/src/jsvalue.h
+++ b/js/src/jsvalue.h
@@ -92,16 +92,25 @@
 #define JSDOUBLE_SIGNBIT (((uint64) 1) << 63)
 #define JSDOUBLE_EXPMASK (((uint64) 0x7ff) << 52)
 #define JSDOUBLE_MANTMASK ((((uint64) 1) << 52) - 1)
+#define JSDOUBLE_HI32_SIGNBIT   0x80000000
 
 static JS_ALWAYS_INLINE JSBool
 JSDOUBLE_IS_NEGZERO(jsdouble d)
 {
+    if (d != 0)
+        return false;
     union {
+        struct {
+#if defined(IS_LITTLE_ENDIAN) && !defined(FPU_IS_ARM_FPA)
+            uint32 lo, hi;
+#else
+            uint32 hi, lo;
+#endif
+        } s;
         jsdouble d;
-        uint64 bits;
     } x;
     x.d = d;
-    return x.bits == JSDOUBLE_SIGNBIT;
+    return (x.s.hi & JSDOUBLE_HI32_SIGNBIT) != 0;
 }
 
 static inline bool
diff --git a/js/src/jswin.h b/js/src/jswin.h
index b71556a5cc9a..d11dcd90ca03 100644
--- a/js/src/jswin.h
+++ b/js/src/jswin.h
@@ -1,45 +1,49 @@
-/* ***** BEGIN LICENSE BLOCK *****
- * Version: MPL 1.1/GPL 2.0/LGPL 2.1
- *
- * The contents of this file are subject to the Mozilla Public License Version
- * 1.1 (the "License"); you may not use this file except in compliance with
- * the License. You may obtain a copy of the License at
- * http://www.mozilla.org/MPL/
- *
- * Software distributed under the License is distributed on an "AS IS" basis,
- * WITHOUT WARRANTY OF ANY KIND, either express or implied. See the License
- * for the specific language governing rights and limitations under the
- * License.
- *
- * The Original Code is workarounds for the Win32 headers.
- *
- * The Initial Developer of the Original Code is
- * the Mozilla Foundation.
- * Portions created by the Initial Developer are Copyright (C) 2010
- * the Initial Developer. All Rights Reserved.
- *
- * Contributor(s):
- *
- * Alternatively, the contents of this file may be used under the terms of
- * either the GNU General Public License Version 2 or later (the "GPL"), or
- * the GNU Lesser General Public License Version 2.1 or later (the "LGPL"),
- * in which case the provisions of the GPL or the LGPL are applicable instead
- * of those above. If you wish to allow use of your version of this file only
- * under the terms of either the GPL or the LGPL, and not to allow others to
- * use your version of this file under the terms of the MPL, indicate your
- * decision by deleting the provisions above and replace them with the notice
- * and other provisions required by the GPL or the LGPL. If you do not delete
- * the provisions above, a recipient may use your version of this file under
- * the terms of any one of the MPL, the GPL or the LGPL.
- *
- * ***** END LICENSE BLOCK ***** */
-
-/*
- * This file is a wrapper around <windows.h> to prevent the mangling of
- * various function names throughout the codebase.
- */
-#ifdef XP_WIN
-# include <windows.h>
-# undef GetProp
-# undef SetProp
-#endif
+/* ***** BEGIN LICENSE BLOCK *****
+ * Version: MPL 1.1/GPL 2.0/LGPL 2.1
+ *
+ * The contents of this file are subject to the Mozilla Public License Version
+ * 1.1 (the "License"); you may not use this file except in compliance with
+ * the License. You may obtain a copy of the License at
+ * http://www.mozilla.org/MPL/
+ *
+ * Software distributed under the License is distributed on an "AS IS" basis,
+ * WITHOUT WARRANTY OF ANY KIND, either express or implied. See the License
+ * for the specific language governing rights and limitations under the
+ * License.
+ *
+ * The Original Code is workarounds for the Win32 headers.
+ *
+ * The Initial Developer of the Original Code is
+ * the Mozilla Foundation.
+ * Portions created by the Initial Developer are Copyright (C) 2010
+ * the Initial Developer. All Rights Reserved.
+ *
+ * Contributor(s):
+ *
+ * Alternatively, the contents of this file may be used under the terms of
+ * either the GNU General Public License Version 2 or later (the "GPL"), or
+ * the GNU Lesser General Public License Version 2.1 or later (the "LGPL"),
+ * in which case the provisions of the GPL or the LGPL are applicable instead
+ * of those above. If you wish to allow use of your version of this file only
+ * under the terms of either the GPL or the LGPL, and not to allow others to
+ * use your version of this file under the terms of the MPL, indicate your
+ * decision by deleting the provisions above and replace them with the notice
+ * and other provisions required by the GPL or the LGPL. If you do not delete
+ * the provisions above, a recipient may use your version of this file under
+ * the terms of any one of the MPL, the GPL or the LGPL.
+ *
+ * ***** END LICENSE BLOCK ***** */
+
+/*
+ * This file is a wrapper around <windows.h> to prevent the mangling of
+ * various function names throughout the codebase.
+ */
+#ifdef XP_WIN
+# include <windows.h>
+# undef GetProp
+# undef SetProp
+# undef CONST
+# undef STRICT
+# undef LEGACY
+# undef THIS
+#endif
diff --git a/js/src/shell/js.cpp b/js/src/shell/js.cpp
index 4a94e937da9c..43a421881ab7 100644
--- a/js/src/shell/js.cpp
+++ b/js/src/shell/js.cpp
@@ -4864,6 +4864,8 @@ static JSFunctionSpec shell_functions[] = {
     JS_FN("evalInFrame",    EvalInFrame,    2,0),
     JS_FN("shapeOf",        ShapeOf,        1,0),
     JS_FN("resolver",       Resolver,       1,0),
+    JS_FN("pauseProfilers", js_PauseProfilers, 0,0),
+    JS_FN("resumeProfilers", js_ResumeProfilers, 0,0),
 #ifdef MOZ_CALLGRIND
     JS_FN("startCallgrind", js_StartCallgrind,  0,0),
     JS_FN("stopCallgrind",  js_StopCallgrind,   0,0),
@@ -5001,6 +5003,8 @@ static const char *const shell_help_messages[] = {
 "shapeOf(obj)             Get the shape of obj (an implementation detail)",
 "resolver(src[, proto])   Create object with resolve hook that copies properties\n"
 "                         from src. If proto is omitted, use Object.prototype.",
+"pauseProfilers()         Pause all profilers that can be paused",
+"resumeProfilers()        Resume profilers if they are paused",
 #ifdef MOZ_CALLGRIND
 "startCallgrind()         Start callgrind instrumentation",
 "stopCallgrind()          Stop callgrind instrumentation",
diff --git a/js/src/tests/ecma_5/Global/bug660612.js b/js/src/tests/ecma_5/Global/bug660612.js
new file mode 100644
index 000000000000..71589f53dfe7
--- /dev/null
+++ b/js/src/tests/ecma_5/Global/bug660612.js
@@ -0,0 +1,7 @@
+try {
+    decodeURIComponent('%ED%A0%80');
+    assertEq(true, false, "expected an URIError");
+} catch (e) {
+  assertEq(e instanceof URIError, true);
+  reportCompare(true,true);
+}
diff --git a/js/src/tests/ecma_5/Global/jstests.list b/js/src/tests/ecma_5/Global/jstests.list
index 5fc5a14ed6b7..af6efb02cf30 100644
--- a/js/src/tests/ecma_5/Global/jstests.list
+++ b/js/src/tests/ecma_5/Global/jstests.list
@@ -9,3 +9,4 @@ script parenthesized-eval-is-direct.js
 script eval-native-callback-is-indirect.js
 script direct-eval-but-not.js
 script eval-in-strict-eval-in-normal-function.js
+script bug660612.js
diff --git a/js/src/vm/GlobalObject.cpp b/js/src/vm/GlobalObject.cpp
index e0888d06ba93..d3284d9679f5 100644
--- a/js/src/vm/GlobalObject.cpp
+++ b/js/src/vm/GlobalObject.cpp
@@ -202,4 +202,28 @@ GlobalObject::isRuntimeCodeGenEnabled(JSContext *cx)
     return !v.isFalse();
 }
 
+JSObject *
+GlobalObject::createBlankPrototype(JSContext *cx, Class *clasp)
+{
+    JS_ASSERT(clasp != &js_ObjectClass);
+    JS_ASSERT(clasp != &js_FunctionClass);
+
+    JSObject *objectProto;
+    if (!js_GetClassPrototype(cx, this, JSProto_Object, &objectProto))
+        return NULL;
+
+    JSObject *proto = NewNonFunction<WithProto::Given>(cx, clasp, objectProto, this);
+    if (!proto)
+        return NULL;
+
+    /*
+     * Supply the created prototype object with an empty shape for the benefit
+     * of callers of JSObject::initSharingEmptyShape.
+     */
+    if (!proto->getEmptyShape(cx, clasp, gc::FINALIZE_OBJECT0))
+        return NULL;
+
+    return proto;
+}
+
 } // namespace js
diff --git a/js/src/vm/GlobalObject.h b/js/src/vm/GlobalObject.h
index b1587dc839ff..e820f15bd0ba 100644
--- a/js/src/vm/GlobalObject.h
+++ b/js/src/vm/GlobalObject.h
@@ -111,6 +111,16 @@ class GlobalObject : public ::JSObject {
   public:
     static GlobalObject *create(JSContext *cx, Class *clasp);
 
+    /*
+     * Create an object to serve as [[Prototype]] for instances of the given
+     * class, using |Object.prototype| as its [[Prototype]].  Users creating
+     * prototype objects with particular internal structure (e.g. reserved
+     * slots guaranteed to contain values of particular types) must immediately
+     * complete the minimal initialization to make the returned object safe to
+     * touch.
+     */
+    JSObject *createBlankPrototype(JSContext *cx, js::Class *clasp);
+
     void setThrowTypeError(JSFunction *fun) {
         Value &v = getSlotRef(THROWTYPEERROR);
         // Our bootstrapping code is currently too convoluted to correctly and
diff --git a/js/src/xpconnect/loader/Makefile.in b/js/src/xpconnect/loader/Makefile.in
index 4f20301d66ce..def3717d2dec 100644
--- a/js/src/xpconnect/loader/Makefile.in
+++ b/js/src/xpconnect/loader/Makefile.in
@@ -47,7 +47,7 @@ FORCE_STATIC_LIB = 1
 LIBXUL_LIBRARY = 1
 LOCAL_INCLUDES += -I$(srcdir)/../src
 
-CPPSRCS		= mozJSComponentLoader.cpp mozJSSubScriptLoader.cpp
+CPPSRCS		= mozJSComponentLoader.cpp mozJSSubScriptLoader.cpp mozJSLoaderUtils.cpp
 
 EXTRA_JS_MODULES = XPCOMUtils.jsm ISO8601DateUtils.jsm
 
diff --git a/js/src/xpconnect/loader/mozJSComponentLoader.cpp b/js/src/xpconnect/loader/mozJSComponentLoader.cpp
index 8956a3612c25..cb2888f9cab1 100644
--- a/js/src/xpconnect/loader/mozJSComponentLoader.cpp
+++ b/js/src/xpconnect/loader/mozJSComponentLoader.cpp
@@ -58,6 +58,7 @@
 #include "nsIServiceManager.h"
 #include "nsISupports.h"
 #include "mozJSComponentLoader.h"
+#include "mozJSLoaderUtils.h"
 #include "nsIJSRuntimeService.h"
 #include "nsIJSContextStack.h"
 #include "nsIXPConnect.h"
@@ -245,7 +246,7 @@ File(JSContext *cx, uintN argc, jsval *vp)
     }
 
     nsCOMPtr<nsISupports> native;
-    rv = nsDOMFile::NewFile(getter_AddRefs(native));
+    rv = nsDOMFileFile::NewFile(getter_AddRefs(native));
     if (NS_FAILED(rv)) {
         XPCThrower::Throw(rv, cx);
         return JS_FALSE;
@@ -386,108 +387,6 @@ ReportOnCaller(JSCLContextHelper &helper,
     return NS_OK;
 }
 
-static nsresult
-ReadScriptFromStream(JSContext *cx, nsIObjectInputStream *stream,
-                     JSObject **scriptObj)
-{
-    *scriptObj = nsnull;
-
-    PRUint32 size;
-    nsresult rv = stream->Read32(&size);
-    NS_ENSURE_SUCCESS(rv, rv);
-
-    char *data;
-    rv = stream->ReadBytes(size, &data);
-    NS_ENSURE_SUCCESS(rv, rv);
-
-    JSXDRState *xdr = JS_XDRNewMem(cx, JSXDR_DECODE);
-    NS_ENSURE_TRUE(xdr, NS_ERROR_OUT_OF_MEMORY);
-
-    xdr->userdata = stream;
-    JS_XDRMemSetData(xdr, data, size);
-
-    if (!JS_XDRScriptObject(xdr, scriptObj)) {
-        rv = NS_ERROR_FAILURE;
-    }
-
-    // Update data in case ::JS_XDRScript called back into C++ code to
-    // read an XPCOM object.
-    //
-    // In that case, the serialization process must have flushed a run
-    // of counted bytes containing JS data at the point where the XPCOM
-    // object starts, after which an encoding C++ callback from the JS
-    // XDR code must have written the XPCOM object directly into the
-    // nsIObjectOutputStream.
-    //
-    // The deserialization process will XDR-decode counted bytes up to
-    // but not including the XPCOM object, then call back into C++ to
-    // read the object, then read more counted bytes and hand them off
-    // to the JSXDRState, so more JS data can be decoded.
-    //
-    // This interleaving of JS XDR data and XPCOM object data may occur
-    // several times beneath the call to ::JS_XDRScript, above.  At the
-    // end of the day, we need to free (via nsMemory) the data owned by
-    // the JSXDRState.  So we steal it back, nulling xdr's buffer so it
-    // doesn't get passed to ::JS_free by ::JS_XDRDestroy.
-
-    uint32 length;
-    data = static_cast<char*>(JS_XDRMemGetData(xdr, &length));
-    if (data) {
-        JS_XDRMemSetData(xdr, nsnull, 0);
-    }
-    JS_XDRDestroy(xdr);
-
-    // If data is null now, it must have been freed while deserializing an
-    // XPCOM object (e.g., a principal) beneath ::JS_XDRScript.
-    if (data) {
-        nsMemory::Free(data);
-    }
-
-    return rv;
-}
-
-static nsresult
-WriteScriptToStream(JSContext *cx, JSObject *scriptObj,
-                    nsIObjectOutputStream *stream)
-{
-    JSXDRState *xdr = JS_XDRNewMem(cx, JSXDR_ENCODE);
-    NS_ENSURE_TRUE(xdr, NS_ERROR_OUT_OF_MEMORY);
-
-    xdr->userdata = stream;
-    nsresult rv = NS_OK;
-
-    if (JS_XDRScriptObject(xdr, &scriptObj)) {
-        // Get the encoded JSXDRState data and write it.  The JSXDRState owns
-        // this buffer memory and will free it beneath ::JS_XDRDestroy.
-        //
-        // If an XPCOM object needs to be written in the midst of the JS XDR
-        // encoding process, the C++ code called back from the JS engine (e.g.,
-        // nsEncodeJSPrincipals in caps/src/nsJSPrincipals.cpp) will flush data
-        // from the JSXDRState to aStream, then write the object, then return
-        // to JS XDR code with xdr reset so new JS data is encoded at the front
-        // of the xdr's data buffer.
-        //
-        // However many XPCOM objects are interleaved with JS XDR data in the
-        // stream, when control returns here from ::JS_XDRScript, we'll have
-        // one last buffer of data to write to aStream.
-
-        uint32 size;
-        const char* data = reinterpret_cast<const char*>
-                                           (JS_XDRMemGetData(xdr, &size));
-        NS_ASSERTION(data, "no decoded JSXDRState data!");
-
-        rv = stream->Write32(size);
-        if (NS_SUCCEEDED(rv)) {
-            rv = stream->WriteBytes(data, size);
-        }
-    } else {
-        rv = NS_ERROR_FAILURE; // likely to be a principals serialization error
-    }
-
-    JS_XDRDestroy(xdr);
-    return rv;
-}
-
 mozJSComponentLoader::mozJSComponentLoader()
     : mRuntime(nsnull),
       mContext(nsnull),
@@ -849,66 +748,6 @@ class JSPrincipalsHolder
     JSPrincipals *mPrincipals;
 };
 
-/* static */
-nsresult
-mozJSComponentLoader::ReadScript(StartupCache* cache, nsIURI *uri,
-                                 JSContext *cx, JSObject **scriptObj)
-{
-    nsresult rv;
-    
-    nsCAutoString spec(kJSCachePrefix);
-    rv = NS_PathifyURI(uri, spec);
-    NS_ENSURE_SUCCESS(rv, rv);
-    
-    nsAutoArrayPtr<char> buf;   
-    PRUint32 len;
-    rv = cache->GetBuffer(spec.get(), getter_Transfers(buf), 
-                          &len);
-    if (NS_FAILED(rv)) {
-        return rv; // don't warn since NOT_AVAILABLE is an ok error
-    }
-
-    LOG(("Found %s in startupcache\n", spec.get()));
-    nsCOMPtr<nsIObjectInputStream> ois;
-    rv = NS_NewObjectInputStreamFromBuffer(buf, len, getter_AddRefs(ois));
-    NS_ENSURE_SUCCESS(rv, rv);
-    buf.forget();
-
-    return ReadScriptFromStream(cx, ois, scriptObj);
-}
-
-nsresult
-mozJSComponentLoader::WriteScript(StartupCache* cache, JSObject *scriptObj,
-                                  nsIFile *component, nsIURI *uri, JSContext *cx)
-{
-    nsresult rv;
-
-    nsCAutoString spec(kJSCachePrefix);
-    rv = NS_PathifyURI(uri, spec);
-    NS_ENSURE_SUCCESS(rv, rv);
-
-    LOG(("Writing %s to startupcache\n", spec.get()));
-    nsCOMPtr<nsIObjectOutputStream> oos;
-    nsCOMPtr<nsIStorageStream> storageStream; 
-    rv = NS_NewObjectOutputWrappedStorageStream(getter_AddRefs(oos),
-                                                getter_AddRefs(storageStream),
-                                                true);
-    NS_ENSURE_SUCCESS(rv, rv);
-
-    rv = WriteScriptToStream(cx, scriptObj, oos);
-    oos->Close();
-    NS_ENSURE_SUCCESS(rv, rv);
- 
-    nsAutoArrayPtr<char> buf;
-    PRUint32 len;
-    rv = NS_NewBufferFromStorageStream(storageStream, getter_Transfers(buf), 
-                                       &len);
-    NS_ENSURE_SUCCESS(rv, rv);
- 
-    rv = cache->PutBuffer(spec.get(), buf, len);
-    return rv;
-}
-
 nsresult
 mozJSComponentLoader::GlobalForLocation(nsILocalFile *aComponentFile,
                                         nsIURI *aURI,
@@ -1015,8 +854,12 @@ mozJSComponentLoader::GlobalForLocation(nsILocalFile *aComponentFile,
     PRBool writeToCache = PR_FALSE;
     StartupCache* cache = StartupCache::GetSingleton();
 
+    nsCAutoString cachePath(kJSCachePrefix);
+    rv = NS_PathifyURI(aURI, cachePath);
+    NS_ENSURE_SUCCESS(rv, rv);
+
     if (cache) {
-        rv = ReadScript(cache, aURI, cx, &scriptObj);
+        rv = ReadCachedScript(cache, cachePath, cx, &scriptObj);
         if (NS_SUCCEEDED(rv)) {
             LOG(("Successfully loaded %s from startupcache\n", nativePath.get()));
         } else {
@@ -1170,7 +1013,7 @@ mozJSComponentLoader::GlobalForLocation(nsILocalFile *aComponentFile,
 
     if (writeToCache) {
         // We successfully compiled the script, so cache it. 
-        rv = WriteScript(cache, scriptObj, aComponentFile, aURI, cx);
+        rv = WriteCachedScript(cache, cachePath, cx, scriptObj);
 
         // Don't treat failure to write as fatal, since we might be working
         // with a read-only cache.
diff --git a/js/src/xpconnect/loader/mozJSComponentLoader.h b/js/src/xpconnect/loader/mozJSComponentLoader.h
index 77d4ae5f485a..5162a9749d44 100644
--- a/js/src/xpconnect/loader/mozJSComponentLoader.h
+++ b/js/src/xpconnect/loader/mozJSComponentLoader.h
@@ -106,11 +106,6 @@ class mozJSComponentLoader : public mozilla::ModuleLoader,
                                char **location,
                                jsval *exception);
 
-    nsresult ReadScript(StartupCache *cache, nsIURI *uri, 
-                        JSContext *cx, JSObject **scriptObj);
-    nsresult WriteScript(StartupCache *cache, JSObject *scriptObj,
-                         nsIFile *component, nsIURI *uri, JSContext *cx);
-
     nsCOMPtr<nsIComponentManager> mCompMgr;
     nsCOMPtr<nsIJSRuntimeService> mRuntimeService;
     nsCOMPtr<nsIThreadJSContextStack> mContextStack;
diff --git a/js/src/xpconnect/loader/mozJSLoaderUtils.cpp b/js/src/xpconnect/loader/mozJSLoaderUtils.cpp
new file mode 100644
index 000000000000..edd545b6548b
--- /dev/null
+++ b/js/src/xpconnect/loader/mozJSLoaderUtils.cpp
@@ -0,0 +1,196 @@
+/* ***** BEGIN LICENSE BLOCK *****
+ * Version: MPL 1.1/GPL 2.0/LGPL 2.1
+ *
+ * The contents of this file are subject to the Mozilla Public License Version
+ * 1.1 (the "License"); you may not use this file except in compliance with
+ * the License. You may obtain a copy of the License at
+ * http://www.mozilla.org/MPL/
+ *
+ * Software distributed under the License is distributed on an "AS IS" basis,
+ * WITHOUT WARRANTY OF ANY KIND, either express or implied. See the License
+ * for the specific language governing rights and limitations under the
+ * License.
+ *
+ * The Original Code is mozilla.org
+ *
+ * The Initial Developer of the Original Code is
+ * Mozilla Foundation.
+ * Portions created by the Initial Developer are Copyright (C) 2010-2011
+ * the Initial Developer. All Rights Reserved.
+ *
+ * Contributor(s):
+ *   Michael Wu <mwu@mozilla.com>
+ *
+ * Alternatively, the contents of this file may be used under the terms of
+ * either of the GNU General Public License Version 2 or later (the "GPL"),
+ * or the GNU Lesser General Public License Version 2.1 or later (the "LGPL"),
+ * in which case the provisions of the GPL or the LGPL are applicable instead
+ * of those above. If you wish to allow use of your version of this file only
+ * under the terms of either the GPL or the LGPL, and not to allow others to
+ * use your version of this file under the terms of the MPL, indicate your
+ * decision by deleting the provisions above and replace them with the notice
+ * and other provisions required by the GPL or the LGPL. If you do not delete
+ * the provisions above, a recipient may use your version of this file under
+ * the terms of any one of the MPL, the GPL or the LGPL.
+ *
+ * ***** END LICENSE BLOCK ***** */
+
+#if !defined(XPCONNECT_STANDALONE)
+
+#include "nsAutoPtr.h"
+#include "nsScriptLoader.h"
+
+#include "jsapi.h"
+#include "jsxdrapi.h"
+
+#include "mozilla/scache/StartupCache.h"
+#include "mozilla/scache/StartupCacheUtils.h"
+
+using namespace mozilla::scache;
+
+static nsresult
+ReadScriptFromStream(JSContext *cx, nsIObjectInputStream *stream,
+                     JSObject **scriptObj)
+{
+    *scriptObj = nsnull;
+
+    PRUint32 size;
+    nsresult rv = stream->Read32(&size);
+    NS_ENSURE_SUCCESS(rv, rv);
+
+    char *data;
+    rv = stream->ReadBytes(size, &data);
+    NS_ENSURE_SUCCESS(rv, rv);
+
+    JSXDRState *xdr = JS_XDRNewMem(cx, JSXDR_DECODE);
+    NS_ENSURE_TRUE(xdr, NS_ERROR_OUT_OF_MEMORY);
+
+    xdr->userdata = stream;
+    JS_XDRMemSetData(xdr, data, size);
+
+    if (!JS_XDRScriptObject(xdr, scriptObj)) {
+        rv = NS_ERROR_FAILURE;
+    }
+
+    // Update data in case ::JS_XDRScript called back into C++ code to
+    // read an XPCOM object.
+    //
+    // In that case, the serialization process must have flushed a run
+    // of counted bytes containing JS data at the point where the XPCOM
+    // object starts, after which an encoding C++ callback from the JS
+    // XDR code must have written the XPCOM object directly into the
+    // nsIObjectOutputStream.
+    //
+    // The deserialization process will XDR-decode counted bytes up to
+    // but not including the XPCOM object, then call back into C++ to
+    // read the object, then read more counted bytes and hand them off
+    // to the JSXDRState, so more JS data can be decoded.
+    //
+    // This interleaving of JS XDR data and XPCOM object data may occur
+    // several times beneath the call to ::JS_XDRScript, above.  At the
+    // end of the day, we need to free (via nsMemory) the data owned by
+    // the JSXDRState.  So we steal it back, nulling xdr's buffer so it
+    // doesn't get passed to ::JS_free by ::JS_XDRDestroy.
+
+    uint32 length;
+    data = static_cast<char*>(JS_XDRMemGetData(xdr, &length));
+    JS_XDRMemSetData(xdr, nsnull, 0);
+    JS_XDRDestroy(xdr);
+
+    // If data is null now, it must have been freed while deserializing an
+    // XPCOM object (e.g., a principal) beneath ::JS_XDRScript.
+    nsMemory::Free(data);
+
+    return rv;
+}
+
+static nsresult
+WriteScriptToStream(JSContext *cx, JSObject *scriptObj,
+                    nsIObjectOutputStream *stream)
+{
+    JSXDRState *xdr = JS_XDRNewMem(cx, JSXDR_ENCODE);
+    NS_ENSURE_TRUE(xdr, NS_ERROR_OUT_OF_MEMORY);
+
+    xdr->userdata = stream;
+    nsresult rv = NS_OK;
+
+    if (JS_XDRScriptObject(xdr, &scriptObj)) {
+        // Get the encoded JSXDRState data and write it.  The JSXDRState owns
+        // this buffer memory and will free it beneath ::JS_XDRDestroy.
+        //
+        // If an XPCOM object needs to be written in the midst of the JS XDR
+        // encoding process, the C++ code called back from the JS engine (e.g.,
+        // nsEncodeJSPrincipals in caps/src/nsJSPrincipals.cpp) will flush data
+        // from the JSXDRState to aStream, then write the object, then return
+        // to JS XDR code with xdr reset so new JS data is encoded at the front
+        // of the xdr's data buffer.
+        //
+        // However many XPCOM objects are interleaved with JS XDR data in the
+        // stream, when control returns here from ::JS_XDRScript, we'll have
+        // one last buffer of data to write to aStream.
+
+        uint32 size;
+        const char* data = reinterpret_cast<const char*>
+                                           (JS_XDRMemGetData(xdr, &size));
+        NS_ASSERTION(data, "no decoded JSXDRState data!");
+
+        rv = stream->Write32(size);
+        if (NS_SUCCEEDED(rv)) {
+            rv = stream->WriteBytes(data, size);
+        }
+    } else {
+        rv = NS_ERROR_FAILURE; // likely to be a principals serialization error
+    }
+
+    JS_XDRDestroy(xdr);
+    return rv;
+}
+
+nsresult
+ReadCachedScript(StartupCache* cache, nsACString &uri, JSContext *cx, JSObject **scriptObj)
+{
+    nsresult rv;
+
+    nsAutoArrayPtr<char> buf;
+    PRUint32 len;
+    rv = cache->GetBuffer(PromiseFlatCString(uri).get(), getter_Transfers(buf),
+                          &len);
+    if (NS_FAILED(rv)) {
+        return rv; // don't warn since NOT_AVAILABLE is an ok error
+    }
+
+    nsCOMPtr<nsIObjectInputStream> ois;
+    rv = NS_NewObjectInputStreamFromBuffer(buf, len, getter_AddRefs(ois));
+    NS_ENSURE_SUCCESS(rv, rv);
+    buf.forget();
+
+    return ReadScriptFromStream(cx, ois, scriptObj);
+}
+
+nsresult
+WriteCachedScript(StartupCache* cache, nsACString &uri, JSContext *cx, JSObject *scriptObj)
+{
+    nsresult rv;
+
+    nsCOMPtr<nsIObjectOutputStream> oos;
+    nsCOMPtr<nsIStorageStream> storageStream;
+    rv = NS_NewObjectOutputWrappedStorageStream(getter_AddRefs(oos),
+                                                getter_AddRefs(storageStream),
+                                                true);
+    NS_ENSURE_SUCCESS(rv, rv);
+
+    rv = WriteScriptToStream(cx, scriptObj, oos);
+    oos->Close();
+    NS_ENSURE_SUCCESS(rv, rv);
+
+    nsAutoArrayPtr<char> buf;
+    PRUint32 len;
+    rv = NS_NewBufferFromStorageStream(storageStream, getter_Transfers(buf),
+                                       &len);
+    NS_ENSURE_SUCCESS(rv, rv);
+
+    rv = cache->PutBuffer(PromiseFlatCString(uri).get(), buf, len);
+    return rv;
+}
+
+#endif /* XPCONNECT_STANDALONE */
diff --git a/layout/xul/base/public/nsIMenuFrame.h b/js/src/xpconnect/loader/mozJSLoaderUtils.h
similarity index 64%
rename from layout/xul/base/public/nsIMenuFrame.h
rename to js/src/xpconnect/loader/mozJSLoaderUtils.h
index 3c65ba8cbca5..5081f267925c 100644
--- a/layout/xul/base/public/nsIMenuFrame.h
+++ b/js/src/xpconnect/loader/mozJSLoaderUtils.h
@@ -1,5 +1,6 @@
-/* -*- Mode: C++; tab-width: 2; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
-/* ***** BEGIN LICENSE BLOCK *****
+/* -*- Mode: C++; tab-width: 4; indent-tabs-mode: nil; c-basic-offset: 4 -*-
+ *
+ * ***** BEGIN LICENSE BLOCK *****
  * Version: MPL 1.1/GPL 2.0/LGPL 2.1
  *
  * The contents of this file are subject to the Mozilla Public License Version
@@ -12,14 +13,15 @@
  * for the specific language governing rights and limitations under the
  * License.
  *
- * The Original Code is Mozilla Communicator client code.
+ * The Original Code is mozilla.org.
  *
  * The Initial Developer of the Original Code is
- * Netscape Communications Corporation.
- * Portions created by the Initial Developer are Copyright (C) 1998
+ * Mozilla Foundation.
+ * Portions created by the Initial Developer are Copyright (C) 2011
  * the Initial Developer. All Rights Reserved.
  *
  * Contributor(s):
+ *   Michael Wu <mwu@mozilla.com>
  *
  * Alternatively, the contents of this file may be used under the terms of
  * either of the GNU General Public License Version 2 or later (the "GPL"),
@@ -35,31 +37,24 @@
  *
  * ***** END LICENSE BLOCK ***** */
 
-#ifndef nsIMenuFrame_h___
-#define nsIMenuFrame_h___
+#ifndef mozJSLoaderUtils_h
+#define mozJSLoaderUtils_h
 
-#include "nsQueryFrame.h"
+#include "nsString.h"
+#include "jsapi.h"
 
-enum nsMenuListType {
-  eNotMenuList,
-  eReadonlyMenuList,
-  eEditableMenuList
-};
+class nsIURI;
+namespace mozilla {
+namespace scache {
+class StartupCache;
+}
+}
 
-// this interface exists solely because native themes need to call into it.
-// Only menu frames should implement it
-
-class nsIMenuFrame
-{
-public:
-  NS_DECL_QUERYFRAME_TARGET(nsIMenuFrame)
-
-  virtual PRBool IsOpen() = 0;
-  virtual PRBool IsMenu() = 0;
-  virtual PRBool IsOnMenuBar() = 0;
-  virtual PRBool IsOnActiveMenuBar() = 0;
-  virtual nsMenuListType GetParentMenuListType() = 0;
-};
-
-#endif
+nsresult
+ReadCachedScript(mozilla::scache::StartupCache* cache, nsACString &uri,
+                 JSContext *cx, JSObject **scriptObj);
 
+nsresult
+WriteCachedScript(mozilla::scache::StartupCache* cache, nsACString &uri,
+                  JSContext *cx, JSObject *scriptObj);
+#endif /* mozJSLoaderUtils_h */
diff --git a/js/src/xpconnect/loader/mozJSSubScriptLoader.cpp b/js/src/xpconnect/loader/mozJSSubScriptLoader.cpp
index 63e070ba229f..0f9dd6468103 100644
--- a/js/src/xpconnect/loader/mozJSSubScriptLoader.cpp
+++ b/js/src/xpconnect/loader/mozJSSubScriptLoader.cpp
@@ -41,6 +41,7 @@
  * ***** END LICENSE BLOCK ***** */
 
 #include "mozJSSubScriptLoader.h"
+#include "mozJSLoaderUtils.h"
 
 #include "nsIServiceManager.h"
 #include "nsIXPConnect.h"
@@ -58,10 +59,15 @@
 #include "nsScriptLoader.h"
 
 #include "jsapi.h"
+#include "jscntxt.h"
 #include "jsdbgapi.h"
 #include "jsfriendapi.h"
 
 #include "mozilla/FunctionTimer.h"
+#include "mozilla/scache/StartupCache.h"
+#include "mozilla/scache/StartupCacheUtils.h"
+
+using namespace mozilla::scache;
 
 /* load() error msgs, XXX localize? */
 #define LOAD_ERROR_NOSERVICE "Error creating IO Service."
@@ -91,6 +97,89 @@ mozJSSubScriptLoader::~mozJSSubScriptLoader()
 
 NS_IMPL_THREADSAFE_ISUPPORTS1(mozJSSubScriptLoader, mozIJSSubScriptLoader)
 
+static nsresult
+ReportError(JSContext *cx, const char *msg)
+{
+    JS_SetPendingException(cx, STRING_TO_JSVAL(JS_NewStringCopyZ(cx, msg)));
+    return NS_OK;
+}
+
+nsresult
+mozJSSubScriptLoader::ReadScript(nsIURI *uri, JSContext *cx, JSObject *target_obj,
+                                 jschar *charset, const char *uriStr,
+                                 nsIIOService *serv, JSObject **scriptObjp)
+{
+    nsCOMPtr<nsIChannel>     chan;
+    nsCOMPtr<nsIInputStream> instream;
+    JSPrincipals    *jsPrincipals;
+    JSErrorReporter  er;
+
+    nsresult rv;
+    // Instead of calling NS_OpenURI, we create the channel ourselves and call
+    // SetContentType, to avoid expensive MIME type lookups (bug 632490).
+    rv = NS_NewChannel(getter_AddRefs(chan), uri, serv,
+                       nsnull, nsnull, nsIRequest::LOAD_NORMAL);
+    if (NS_SUCCEEDED(rv)) {
+        chan->SetContentType(NS_LITERAL_CSTRING("application/javascript"));
+        rv = chan->Open(getter_AddRefs(instream));
+    }
+
+    if (NS_FAILED(rv)) {
+        return ReportError(cx, LOAD_ERROR_NOSTREAM);
+    }
+    
+    PRInt32 len = -1;
+
+    rv = chan->GetContentLength(&len);
+    if (NS_FAILED(rv) || len == -1) {
+        return ReportError(cx, LOAD_ERROR_NOCONTENT);
+    }
+
+    nsCString buf;
+    rv = NS_ReadInputStreamToString(instream, buf, len);
+    if (NS_FAILED(rv))
+        return rv;
+
+    /* we can't hold onto jsPrincipals as a module var because the
+     * JSPRINCIPALS_DROP macro takes a JSContext, which we won't have in the
+     * destructor */
+    rv = mSystemPrincipal->GetJSPrincipals(cx, &jsPrincipals);
+    if (NS_FAILED(rv) || !jsPrincipals) {
+        return ReportError(cx, LOAD_ERROR_NOPRINCIPALS);
+    }
+
+    /* set our own error reporter so we can report any bad things as catchable
+     * exceptions, including the source/line number */
+    er = JS_SetErrorReporter(cx, mozJSLoaderErrorReporter);
+
+    if (charset) {
+        nsString script;
+        rv = nsScriptLoader::ConvertToUTF16(
+                nsnull, reinterpret_cast<const PRUint8*>(buf.get()), len,
+                nsDependentString(reinterpret_cast<PRUnichar*>(charset)), nsnull, script);
+
+        if (NS_FAILED(rv)) {
+            JSPRINCIPALS_DROP(cx, jsPrincipals);
+            return ReportError(cx, LOAD_ERROR_BADCHARSET);
+        }
+
+        *scriptObjp =
+            JS_CompileUCScriptForPrincipals(cx, target_obj, jsPrincipals,
+                                            reinterpret_cast<const jschar*>(script.get()),
+                                            script.Length(), uriStr, 1);
+    } else {
+        *scriptObjp = JS_CompileScriptForPrincipals(cx, target_obj, jsPrincipals, buf.get(),
+                                                         len, uriStr, 1);
+    }
+
+    JSPRINCIPALS_DROP(cx, jsPrincipals);
+
+    /* repent for our evil deeds */
+    JS_SetErrorReporter(cx, er);
+
+    return NS_OK;
+}
+
 NS_IMETHODIMP /* args and return value are delt with using XPConnect and JSAPI */
 mozJSSubScriptLoader::LoadSubScript (const PRUnichar * aURL
                                      /* [, JSObject *target_obj] */)
@@ -227,17 +316,6 @@ mozJSSubScriptLoader::LoadSubScript (const PRUnichar * aURL
 
     /* load up the url.  From here on, failures are reflected as ``custom''
      * js exceptions */
-    PRInt32   len = -1;
-    PRUint32  readcount = 0;  // Total amount of data read
-    PRUint32  lastReadCount = 0;  // Amount of data read in last Read() call
-    nsAutoArrayPtr<char> buf;
-    
-    JSString        *errmsg;
-    JSErrorReporter  er;
-    JSPrincipals    *jsPrincipals;
-    
-    nsCOMPtr<nsIChannel>     chan;
-    nsCOMPtr<nsIInputStream> instream;
     nsCOMPtr<nsIURI> uri;
     nsCAutoString uriStr;
     nsCAutoString scheme;
@@ -261,32 +339,27 @@ mozJSSubScriptLoader::LoadSubScript (const PRUnichar * aURL
         return NS_ERROR_FAILURE;
     }
 
+    StartupCache* cache = StartupCache::GetSingleton();
     nsCOMPtr<nsIIOService> serv = do_GetService(NS_IOSERVICE_CONTRACTID);
-    if (!serv)
-    {
-        errmsg = JS_NewStringCopyZ (cx, LOAD_ERROR_NOSERVICE);
-        goto return_exception;
+    if (!serv) {
+        return ReportError(cx, LOAD_ERROR_NOSERVICE);
     }
 
     // Make sure to explicitly create the URI, since we'll need the
     // canonicalized spec.
     rv = NS_NewURI(getter_AddRefs(uri), urlbytes.ptr(), nsnull, serv);
     if (NS_FAILED(rv)) {
-        errmsg = JS_NewStringCopyZ (cx, LOAD_ERROR_NOURI);
-        goto return_exception;
+        return ReportError(cx, LOAD_ERROR_NOURI);
     }
 
     rv = uri->GetSpec(uriStr);
     if (NS_FAILED(rv)) {
-        errmsg = JS_NewStringCopyZ (cx, LOAD_ERROR_NOSPEC);
-        goto return_exception;
+        return ReportError(cx, LOAD_ERROR_NOSPEC);
     }    
 
     rv = uri->GetScheme(scheme);
-    if (NS_FAILED(rv))
-    {
-        errmsg = JS_NewStringCopyZ (cx, LOAD_ERROR_NOSCHEME);
-        goto return_exception;
+    if (NS_FAILED(rv)) {
+        return ReportError(cx, LOAD_ERROR_NOSCHEME);
     }
 
     if (!scheme.EqualsLiteral("chrome"))
@@ -294,10 +367,8 @@ mozJSSubScriptLoader::LoadSubScript (const PRUnichar * aURL
         // This might be a URI to a local file, though!
         nsCOMPtr<nsIURI> innerURI = NS_GetInnermostURI(uri);
         nsCOMPtr<nsIFileURL> fileURL = do_QueryInterface(innerURI);
-        if (!fileURL)
-        {
-            errmsg = JS_NewStringCopyZ (cx, LOAD_ERROR_URI_NOT_LOCAL);
-            goto return_exception;
+        if (!fileURL) {
+            return ReportError(cx, LOAD_ERROR_URI_NOT_LOCAL);
         }
 
         // For file URIs prepend the filename with the filename of the
@@ -309,104 +380,38 @@ mozJSSubScriptLoader::LoadSubScript (const PRUnichar * aURL
         uriStr = tmp;
     }
 
-    // Instead of calling NS_OpenURI, we create the channel ourselves and call
-    // SetContentType, to avoid expensive MIME type lookups (bug 632490).
-    rv = NS_NewChannel(getter_AddRefs(chan), uri, serv,
-                       nsnull, nsnull, nsIRequest::LOAD_NORMAL);
-    if (NS_SUCCEEDED(rv))
-    {
-        chan->SetContentType(NS_LITERAL_CSTRING("application/javascript"));
-        rv = chan->Open(getter_AddRefs(instream));
+    bool writeScript = false;
+    JSObject *scriptObj = nsnull;
+    JSVersion version = cx->findVersion();
+    nsCAutoString cachePath;
+    cachePath.AppendPrintf("jssubloader/%d", version);
+    NS_PathifyURI(uri, cachePath);
+
+    if (cache)
+        rv = ReadCachedScript(cache, cachePath, cx, &scriptObj);
+    if (!scriptObj) {
+        rv = ReadScript(uri, cx, target_obj, charset, (char *)uriStr.get(), serv, &scriptObj);
+        writeScript = true;
     }
 
-    if (NS_FAILED(rv))
-    {
-        errmsg = JS_NewStringCopyZ (cx, LOAD_ERROR_NOSTREAM);
-        goto return_exception;
-    }
-    
-    rv = chan->GetContentLength (&len);
-    if (NS_FAILED(rv) || len == -1)
-    {
-        errmsg = JS_NewStringCopyZ (cx, LOAD_ERROR_NOCONTENT);
-        goto return_exception;
-    }
+    if (NS_FAILED(rv) || !scriptObj)
+        return rv;
 
-    buf = new char[len + 1];
-    if (!buf)
-        return NS_ERROR_OUT_OF_MEMORY;
-    buf[len] = '\0';
-    
-    do {
-        rv = instream->Read (buf + readcount, len - readcount, &lastReadCount);
-        if (NS_FAILED(rv))
-        {
-            errmsg = JS_NewStringCopyZ (cx, LOAD_ERROR_BADREAD);
-            goto return_exception;
-        }
-        readcount += lastReadCount;
-    } while (lastReadCount && readcount != PRUint32(len));
-    
-    if (static_cast<PRUint32>(len) != readcount)
-    {
-        errmsg = JS_NewStringCopyZ (cx, LOAD_ERROR_READUNDERFLOW);
-        goto return_exception;
-    }
+    ok = false;
+    if (scriptObj)
+        ok = JS_ExecuteScriptVersion(cx, target_obj, scriptObj, rval, version);
 
-    /* we can't hold onto jsPrincipals as a module var because the
-     * JSPRINCIPALS_DROP macro takes a JSContext, which we won't have in the
-     * destructor */
-    rv = mSystemPrincipal->GetJSPrincipals(cx, &jsPrincipals);
-    if (NS_FAILED(rv) || !jsPrincipals)
-    {
-        errmsg = JS_NewStringCopyZ (cx, LOAD_ERROR_NOPRINCIPALS);
-        goto return_exception;
-    }
-
-    /* set our own error reporter so we can report any bad things as catchable
-     * exceptions, including the source/line number */
-    er = JS_SetErrorReporter (cx, mozJSLoaderErrorReporter);
-
-    if (charset)
-    {
-        nsString script;
-        rv = nsScriptLoader::ConvertToUTF16(
-                nsnull, reinterpret_cast<PRUint8*>(buf.get()), len,
-                nsDependentString(reinterpret_cast<PRUnichar*>(charset)), nsnull, script);
-
-        if (NS_FAILED(rv))
-        {
-            JSPRINCIPALS_DROP(cx, jsPrincipals);
-            errmsg = JS_NewStringCopyZ(cx, LOAD_ERROR_BADCHARSET);
-            goto return_exception;
-        }
-        ok = JS_EvaluateUCScriptForPrincipals(cx, target_obj, jsPrincipals,
-                                              reinterpret_cast<const jschar*>(script.get()),
-                                              script.Length(), uriStr.get(), 1, rval);
-    }
-    else
-    {
-        ok = JS_EvaluateScriptForPrincipals(cx, target_obj, jsPrincipals,
-                                            buf, len, uriStr.get(), 1, rval);
-    }
-
-    JSPRINCIPALS_DROP(cx, jsPrincipals);
-
-    if (ok)
-    {
+    if (ok) {
         JSAutoEnterCompartment rac;
-
         if (!rac.enter(cx, result_obj) || !JS_WrapValue(cx, rval))
             return NS_ERROR_UNEXPECTED; 
     }
 
-    /* repent for our evil deeds */
-    JS_SetErrorReporter (cx, er);
+    if (cache && ok && writeScript) {
+        WriteCachedScript(cache, cachePath, cx, scriptObj);
+    }
 
     cc->SetReturnValueWasSet (ok);
     return NS_OK;
-
- return_exception:
-    JS_SetPendingException (cx, STRING_TO_JSVAL(errmsg));
-    return NS_OK;
 }
+
diff --git a/js/src/xpconnect/loader/mozJSSubScriptLoader.h b/js/src/xpconnect/loader/mozJSSubScriptLoader.h
index c4ded258673e..2083d933eb12 100644
--- a/js/src/xpconnect/loader/mozJSSubScriptLoader.h
+++ b/js/src/xpconnect/loader/mozJSSubScriptLoader.h
@@ -38,6 +38,7 @@
  *
  * ***** END LICENSE BLOCK ***** */
 
+#include "jsapi.h"
 #include "nsCOMPtr.h"
 #include "mozIJSSubScriptLoader.h"
 #include "nsIScriptSecurityManager.h"
@@ -50,6 +51,8 @@
     {0x8e, 0x08, 0x82, 0xfa, 0x0a, 0x33, 0x9b, 0x00} \
 }
 
+class nsIIOService;
+
 class mozJSSubScriptLoader : public mozIJSSubScriptLoader
 {
 public:
@@ -61,6 +64,9 @@ public:
     NS_DECL_MOZIJSSUBSCRIPTLOADER
 
 private:
+    nsresult ReadScript(nsIURI *uri, JSContext *cx, JSObject *target_obj,
+                        jschar *charset, const char *uriStr,
+                        nsIIOService *serv, JSObject **scriptObjp);
+
     nsCOMPtr<nsIPrincipal> mSystemPrincipal;
-    
 };
diff --git a/js/src/xpconnect/shell/xpcshell.cpp b/js/src/xpconnect/shell/xpcshell.cpp
index e86f9f8c449e..2623fb7c76e3 100644
--- a/js/src/xpconnect/shell/xpcshell.cpp
+++ b/js/src/xpconnect/shell/xpcshell.cpp
@@ -548,14 +548,6 @@ GC(JSContext *cx, uintN argc, jsval *vp)
     rt = cx->runtime;
     preBytes = rt->gcBytes;
     JS_GC(cx);
-    fprintf(gOutFile, "before %lu, after %lu, break %08lx\n",
-           (unsigned long)preBytes, (unsigned long)rt->gcBytes,
-#if defined(XP_UNIX) && !defined(__SYMBIAN32__)
-           (unsigned long)sbrk(0)
-#else
-           0
-#endif
-           );
 #ifdef JS_GCMETER
     js_DumpGCStats(rt, stdout);
 #endif
diff --git a/js/src/yarr/OSAllocatorOS2.cpp b/js/src/yarr/OSAllocatorOS2.cpp
new file mode 100644
index 000000000000..ead003084dd1
--- /dev/null
+++ b/js/src/yarr/OSAllocatorOS2.cpp
@@ -0,0 +1,89 @@
+/* -*- Mode: C++; tab-width: 4; indent-tabs-mode: nil; c-basic-offset: 4 -*-
+ * vim: set ts=8 sw=4 et tw=99 ft=cpp:
+ *
+ * ***** BEGIN LICENSE BLOCK *****
+ * Copyright (C) 2010 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ *
+ * ***** END LICENSE BLOCK ***** */
+
+#include "assembler/wtf/Platform.h"
+
+#if ENABLE_ASSEMBLER && WTF_OS_OS2
+
+#define INCL_DOS
+#include <os2.h>
+
+#include "wtf/Assertions.h"
+
+#include "OSAllocator.h"
+
+namespace WTF {
+
+static inline ULONG protection(bool writable, bool executable)
+{
+    return (PAG_READ | (writable ? PAG_WRITE : 0) | (executable ? PAG_EXECUTE : 0));
+}
+
+void* OSAllocator::reserveUncommitted(size_t bytes, Usage, bool writable, bool executable)
+{
+    void* result = NULL;
+    if (DosAllocMem(&result, bytes, OBJ_ANY | protection(writable, executable)) &&
+        DosAllocMem(&result, bytes, protection(writable, executable)))
+    {   CRASH();
+    }
+    return result;
+}
+
+void* OSAllocator::reserveAndCommit(size_t bytes, Usage, bool writable, bool executable)
+{
+    void* result = NULL;
+    if (DosAllocMem(&result, bytes, OBJ_ANY | PAG_COMMIT | protection(writable, executable)) &&
+        DosAllocMem(&result, bytes, PAG_COMMIT | protection(writable, executable)))
+    {   CRASH();
+    }
+    return result;
+
+}
+
+void OSAllocator::commit(void* address, size_t bytes, bool writable, bool executable)
+{
+if (DosSetMem(address, bytes, PAG_COMMIT | protection(writable, executable)))
+    CRASH();
+}
+
+void OSAllocator::decommit(void* address, size_t bytes)
+{
+if (DosSetMem(address, bytes, PAG_DECOMMIT))
+    CRASH();
+}
+
+void OSAllocator::releaseDecommitted(void* address, size_t bytes)
+{
+if (DosFreeMem(address))
+    CRASH();
+}
+
+} // namespace WTF
+
+#endif
diff --git a/js/src/yarr/OSAllocatorPosix.cpp b/js/src/yarr/OSAllocatorPosix.cpp
index 57c240b22fe5..99bf061467ca 100644
--- a/js/src/yarr/OSAllocatorPosix.cpp
+++ b/js/src/yarr/OSAllocatorPosix.cpp
@@ -29,7 +29,7 @@
 
 #include "assembler/wtf/Platform.h"
 
-#if ENABLE_ASSEMBLER && WTF_OS_UNIX && !WTF_OS_SYMBIAN
+#if WTF_OS_UNIX && !WTF_OS_SYMBIAN
 
 #include "OSAllocator.h"
 
diff --git a/js/src/yarr/PageBlock.cpp b/js/src/yarr/PageBlock.cpp
index 0f435b772860..047172d6476f 100644
--- a/js/src/yarr/PageBlock.cpp
+++ b/js/src/yarr/PageBlock.cpp
@@ -44,11 +44,15 @@
 #include <e32std.h>
 #endif
 
+#if WTF_OS_OS2
+#include <stdlib.h>
+#endif
+
 namespace WTF {
 
 static size_t s_pageSize;
 
-#if WTF_OS_UNIX && !WTF_OS_SYMBIAN
+#if (WTF_OS_UNIX && !WTF_OS_SYMBIAN) || WTF_OS_OS2
 
 inline size_t systemPageSize()
 {
diff --git a/js/src/yarr/wtfbridge.h b/js/src/yarr/wtfbridge.h
index 9b2b993da333..ef7435cc3d2a 100644
--- a/js/src/yarr/wtfbridge.h
+++ b/js/src/yarr/wtfbridge.h
@@ -50,7 +50,9 @@
 #include "jstl.h"
 #include "vm/String.h"
 #include "assembler/wtf/Platform.h"
+#if ENABLE_YARR_JIT
 #include "assembler/jit/ExecutableAllocator.h"
+#endif
 
 namespace JSC { namespace Yarr {
 
@@ -261,6 +263,8 @@ deleteAllValues(Vector<T, N> &v) {
     v.deleteAllValues();
 }
 
+#if ENABLE_YARR_JIT
+
 /*
  * Minimal JSGlobalData. This used by Yarr to get the allocator.
  */
@@ -272,6 +276,8 @@ class JSGlobalData {
      : regexAllocator(regexAllocator) { }
 };
 
+#endif
+
 /*
  * Sentinel value used in Yarr.
  */
diff --git a/layout/base/crashtests/668941.xhtml b/layout/base/crashtests/668941.xhtml
new file mode 100644
index 000000000000..a1547a6b01fc
--- /dev/null
+++ b/layout/base/crashtests/668941.xhtml
@@ -0,0 +1,16 @@
+<html xmlns="http://www.w3.org/1999/xhtml" style="width: 1px; white-space: pre-wrap;">y
+<style>
+
+html:first-letter { }
+
+</style><script>
+
+window.addEventListener("load", function(){
+  document.documentElement.offsetHeight;
+  document.documentElement.style.direction = "rtl";
+  document.documentElement.offsetHeight;
+  document.documentElement.style.margin = "3em";
+  document.documentElement.offsetHeight;
+}, false);
+
+</script></html>
diff --git a/layout/base/crashtests/670226.html b/layout/base/crashtests/670226.html
new file mode 100644
index 000000000000..1207905200df
--- /dev/null
+++ b/layout/base/crashtests/670226.html
@@ -0,0 +1,10 @@
+<!DOCTYPE html>
+<html>
+<head>
+<style>body:first-letter { float: left; }</style>
+</head>
+
+<body style="white-space: pre-line;">&#x062A;
+</body>
+
+</html>
diff --git a/layout/base/crashtests/crashtests.list b/layout/base/crashtests/crashtests.list
index 75d1883b173b..58ba9e2f2223 100644
--- a/layout/base/crashtests/crashtests.list
+++ b/layout/base/crashtests/crashtests.list
@@ -340,3 +340,5 @@ load 663295.html
 load 663662-1.html
 load 663662-2.html
 load 665837.html
+load 668941.xhtml
+load 670226.html
diff --git a/layout/base/nsBidi.h b/layout/base/nsBidi.h
index 4d2dc4276d36..6cdd1795cb24 100644
--- a/layout/base/nsBidi.h
+++ b/layout/base/nsBidi.h
@@ -773,7 +773,7 @@ public:
    *      The array does not need to be initialized.<p>
    *      The index map will result in <code>aIndexMap[aLogicalIndex]==aVisualIndex</code>.
    */
-  nsresult ReorderLogical(const nsBidiLevel *aLevels, PRInt32 aLength, PRInt32 *aIndexMap);
+  static nsresult ReorderLogical(const nsBidiLevel *aLevels, PRInt32 aLength, PRInt32 *aIndexMap);
 #endif // FULL_BIDI_ENGINE
   /**
    * This is a convenience function that does not use a nsBidi object.
@@ -794,7 +794,7 @@ public:
    *      The array does not need to be initialized.<p>
    *      The index map will result in <code>aIndexMap[aVisualIndex]==aLogicalIndex</code>.
    */
-  nsresult ReorderVisual(const nsBidiLevel *aLevels, PRInt32 aLength, PRInt32 *aIndexMap);
+  static nsresult ReorderVisual(const nsBidiLevel *aLevels, PRInt32 aLength, PRInt32 *aIndexMap);
 
 #ifdef FULL_BIDI_ENGINE
   /**
@@ -917,7 +917,7 @@ private:
 
   void ReorderLine(nsBidiLevel aMinLevel, nsBidiLevel aMaxLevel);
 
-  PRBool PrepareReorder(const nsBidiLevel *aLevels, PRInt32 aLength, PRInt32 *aIndexMap, nsBidiLevel *aMinLevel, nsBidiLevel *aMaxLevel);
+  static PRBool PrepareReorder(const nsBidiLevel *aLevels, PRInt32 aLength, PRInt32 *aIndexMap, nsBidiLevel *aMinLevel, nsBidiLevel *aMaxLevel);
 
   PRInt32 doWriteReverse(const PRUnichar *src, PRInt32 srcLength,
                          PRUnichar *dest, PRUint16 options);
diff --git a/layout/base/nsBidiPresUtils.cpp b/layout/base/nsBidiPresUtils.cpp
index 1a6db235c0a3..eec042a1dac9 100644
--- a/layout/base/nsBidiPresUtils.cpp
+++ b/layout/base/nsBidiPresUtils.cpp
@@ -70,41 +70,271 @@ static const PRUnichar kRLE              = 0x202B;
 static const PRUnichar kLRO              = 0x202D;
 static const PRUnichar kRLO              = 0x202E;
 static const PRUnichar kPDF              = 0x202C;
-static const PRUnichar ALEF              = 0x05D0;
-
-#define CHAR_IS_HEBREW(c) ((0x0590 <= (c)) && ((c)<= 0x05FF))
-// Note: The above code are moved from gfx/src/windows/nsRenderingContextWin.cpp
 
 #define NS_BIDI_CONTROL_FRAME ((nsIFrame*)0xfffb1d1)
 
-nsBidiPresUtils::nsBidiPresUtils() : mArraySize(8),
-                                     mIndexMap(nsnull),
-                                     mLevels(nsnull),
-                                     mSuccess(NS_ERROR_FAILURE),
-                                     mBidiEngine(nsnull)
-{
-  mBidiEngine = new nsBidi();
-  if (mBidiEngine && mContentToFrameIndex.Init()) {
-    mSuccess = NS_OK;
-  }
-}
+struct BidiParagraphData {
+  nsString            mBuffer;
+  nsAutoTArray<PRUnichar, 16> mEmbeddingStack;
+  nsTArray<nsIFrame*> mLogicalFrames;
+  nsTArray<nsLineBox*> mLinePerFrame;
+  nsDataHashtable<nsISupportsHashKey, PRInt32> mContentToFrameIndex;
+  PRPackedBool        mIsVisual;
+  nsBidiLevel         mParaLevel;
+  nsIContent*         mPrevContent;
+  nsAutoPtr<nsBidi>   mBidiEngine;
+  nsIFrame*           mPrevFrame;
 
-nsBidiPresUtils::~nsBidiPresUtils()
-{
-  if (mLevels) {
-    delete[] mLevels;
-  }
-  if (mIndexMap) {
-    delete[] mIndexMap;
-  }
-  delete mBidiEngine;
-}
+  void Init(nsBlockFrame *aBlockFrame)
+  {
+    mContentToFrameIndex.Init();
+    mBidiEngine = new nsBidi();
+    mPrevContent = nsnull;
+    mParaLevel =
+     (NS_STYLE_DIRECTION_RTL == aBlockFrame->GetStyleVisibility()->mDirection) ?
+        NSBIDI_RTL : NSBIDI_LTR;
 
-PRBool
-nsBidiPresUtils::IsSuccessful() const
-{ 
-  return NS_SUCCEEDED(mSuccess); 
-}
+    mIsVisual = aBlockFrame->PresContext()->IsVisualMode();
+    if (mIsVisual) {
+      /**
+       * Drill up in content to detect whether this is an element that needs to
+       * be rendered with logical order even on visual pages.
+       *
+       * We always use logical order on form controls, firstly so that text
+       * entry will be in logical order, but also because visual pages were
+       * written with the assumption that even if the browser had no support
+       * for right-to-left text rendering, it would use native widgets with
+       * bidi support to display form controls.
+       *
+       * We also use logical order in XUL elements, since we expect that if a
+       * XUL element appears in a visual page, it will be generated by an XBL
+       * binding and contain localized text which will be in logical order.
+       */
+      for (nsIContent* content = aBlockFrame->GetContent() ; content; 
+           content = content->GetParent()) {
+        if (content->IsNodeOfType(nsINode::eHTML_FORM_CONTROL) ||
+            content->IsXUL()) {
+          mIsVisual = PR_FALSE;
+          break;
+        }
+      }
+    }
+  }
+
+  nsresult SetPara()
+  {
+    return mBidiEngine->SetPara(mBuffer.get(), BufferLength(),
+                                mParaLevel, nsnull);
+  }
+
+  nsresult CountRuns(PRInt32 *runCount){ return mBidiEngine->CountRuns(runCount); }
+
+  nsresult GetLogicalRun(PRInt32 aLogicalStart, 
+                         PRInt32* aLogicalLimit,
+                         nsBidiLevel* aLevel)
+  {
+    nsresult rv = mBidiEngine->GetLogicalRun(aLogicalStart,
+                                             aLogicalLimit, aLevel);
+    if (mIsVisual || NS_FAILED(rv))
+      *aLevel = mParaLevel;
+    return rv;
+  }
+
+  void ResetData()
+  {
+    mLogicalFrames.Clear();
+    mLinePerFrame.Clear();
+    mContentToFrameIndex.Clear();
+    mBuffer.SetLength(0);
+    mPrevContent = nsnull;
+    for (PRUint32 i = 0; i < mEmbeddingStack.Length(); ++i) {
+      mBuffer.Append(mEmbeddingStack[i]);
+      mLogicalFrames.AppendElement(NS_BIDI_CONTROL_FRAME);
+      mLinePerFrame.AppendElement((nsLineBox*)nsnull);
+    }
+  }
+
+  void AppendFrame(nsIFrame* aFrame,
+                   nsBlockInFlowLineIterator* aLineIter,
+                   nsIContent* aContent = nsnull)
+  {
+    if (aContent) {
+      mContentToFrameIndex.Put(aContent, FrameCount());
+    }
+    mLogicalFrames.AppendElement(aFrame);
+
+    AdvanceLineIteratorToFrame(aFrame, aLineIter, mPrevFrame);
+    mLinePerFrame.AppendElement(aLineIter->GetLine().get());
+  }
+
+  void AdvanceAndAppendFrame(nsIFrame** aFrame,
+                             nsBlockInFlowLineIterator* aLineIter,
+                             nsIFrame** aNextSibling)
+  {
+    nsIFrame* frame = *aFrame;
+    nsIFrame* nextSibling = *aNextSibling;
+
+    frame = frame->GetNextContinuation();
+    if (frame) {
+      AppendFrame(frame, aLineIter, nsnull);
+
+      /*
+       * If we have already overshot the saved next-sibling while
+       * scanning the frame's continuations, advance it.
+       */
+      if (frame == nextSibling) {
+        nextSibling = frame->GetNextSibling();
+      }
+    }
+
+    *aFrame = frame;
+    *aNextSibling = nextSibling;
+  }
+
+  PRInt32 GetLastFrameForContent(nsIContent *aContent)
+  {
+    PRInt32 index = 0;
+    mContentToFrameIndex.Get(aContent, &index);
+    return index;
+  }
+
+  PRInt32 FrameCount(){ return mLogicalFrames.Length(); }
+
+  PRInt32 BufferLength(){ return mBuffer.Length(); }
+
+  nsIFrame* FrameAt(PRInt32 aIndex){ return mLogicalFrames[aIndex]; }
+
+  nsLineBox* GetLineForFrameAt(PRInt32 aIndex){ return mLinePerFrame[aIndex]; }
+
+  void AppendUnichar(PRUnichar aCh){ mBuffer.Append(aCh); }
+
+  void AppendString(const nsDependentSubstring& aString){ mBuffer.Append(aString); }
+
+  void AppendUnicharFrame(nsIFrame* aFrame, PRUnichar aCh)
+  {
+    mLogicalFrames.AppendElement(aFrame);
+    mLinePerFrame.AppendElement((nsLineBox*)nsnull);
+    AppendUnichar(aCh);
+  }
+
+  void PushBidiControl(PRUnichar aCh)
+  {
+    AppendUnicharFrame(NS_BIDI_CONTROL_FRAME, aCh);
+    mEmbeddingStack.AppendElement(aCh);
+  }
+
+  void PopBidiControl()
+  {
+    AppendUnicharFrame(NS_BIDI_CONTROL_FRAME, kPDF);
+    NS_ASSERTION(mEmbeddingStack.Length(), "embedding/override underflow");
+    mEmbeddingStack.TruncateLength(mEmbeddingStack.Length() - 1);
+  }
+
+  void ClearBidiControls()
+  {
+    for (PRUint32 i = 0; i < mEmbeddingStack.Length(); ++i) {
+      AppendUnicharFrame(NS_BIDI_CONTROL_FRAME, kPDF);
+    }
+  }
+
+  static PRBool
+  IsFrameInCurrentLine(nsBlockInFlowLineIterator* aLineIter,
+                       nsIFrame* aPrevFrame, nsIFrame* aFrame)
+  {
+    nsIFrame* endFrame = aLineIter->IsLastLineInList() ? nsnull :
+      aLineIter->GetLine().next()->mFirstChild;
+    nsIFrame* startFrame = aPrevFrame ? aPrevFrame : aLineIter->GetLine()->mFirstChild;
+    for (nsIFrame* frame = startFrame; frame && frame != endFrame;
+         frame = frame->GetNextSibling()) {
+      if (frame == aFrame)
+        return PR_TRUE;
+    }
+    return PR_FALSE;
+  }
+
+  static void
+  AdvanceLineIteratorToFrame(nsIFrame* aFrame,
+                             nsBlockInFlowLineIterator* aLineIter,
+                             nsIFrame*& aPrevFrame)
+  {
+    // Advance aLine to the line containing aFrame
+    nsIFrame* child = aFrame;
+    nsFrameManager* frameManager = aFrame->PresContext()->FrameManager();
+    nsIFrame* parent = nsLayoutUtils::GetParentOrPlaceholderFor(frameManager, child);
+    while (parent && !nsLayoutUtils::GetAsBlock(parent)) {
+      child = parent;
+      parent = nsLayoutUtils::GetParentOrPlaceholderFor(frameManager, child);
+    }
+    NS_ASSERTION (parent, "aFrame is not a descendent of aBlockFrame");
+    while (!IsFrameInCurrentLine(aLineIter, aPrevFrame, child)) {
+#ifdef DEBUG
+      PRBool hasNext =
+#endif
+        aLineIter->Next();
+      NS_ASSERTION(hasNext, "Can't find frame in lines!");
+      aPrevFrame = nsnull;
+    }
+    aPrevFrame = child;
+  }
+
+};
+
+struct BidiLineData {
+  nsTArray<nsIFrame*> mLogicalFrames;
+  nsTArray<nsIFrame*> mVisualFrames;
+  nsTArray<PRInt32> mIndexMap;
+  nsAutoTArray<PRUint8, 18> mLevels;
+  PRBool mIsReordered;
+
+  BidiLineData(nsIFrame* aFirstFrameOnLine, PRInt32   aNumFramesOnLine)
+  {
+    /**
+     * Initialize the logically-ordered array of frames using the top-level
+     * frames of a single line
+     */
+    mLogicalFrames.Clear();
+
+    PRBool isReordered = PR_FALSE;
+    PRBool hasRTLFrames = PR_FALSE;
+
+    for (nsIFrame* frame = aFirstFrameOnLine;
+         frame && aNumFramesOnLine--;
+         frame = frame->GetNextSibling()) {
+      AppendFrame(frame);
+      PRUint8 level = nsBidiPresUtils::GetFrameEmbeddingLevel(frame);
+      mLevels.AppendElement(level);
+      mIndexMap.AppendElement(0);
+      if (level & 1) {
+        hasRTLFrames = PR_TRUE;
+      }
+    }
+
+    // Reorder the line
+    nsBidi::ReorderVisual(mLevels.Elements(), FrameCount(),
+                          mIndexMap.Elements());
+
+    for (PRInt32 i = 0; i < FrameCount(); i++) {
+      mVisualFrames.AppendElement(LogicalFrameAt(mIndexMap[i]));
+      if (i != mIndexMap[i]) {
+        isReordered = PR_TRUE;
+      }
+    }
+
+    // If there's an RTL frame, assume the line is reordered
+    mIsReordered = isReordered || hasRTLFrames;
+  }
+
+  void AppendFrame(nsIFrame* aFrame)
+  {
+    mLogicalFrames.AppendElement(aFrame); 
+  }
+
+  PRInt32 FrameCount(){ return mLogicalFrames.Length(); }
+
+  nsIFrame* LogicalFrameAt(PRInt32 aIndex){ return mLogicalFrames[aIndex]; }
+
+  nsIFrame* VisualFrameAt(PRInt32 aIndex){ return mVisualFrames[aIndex]; }
+};
 
 /* Some helper methods for Resolve() */
 
@@ -253,46 +483,6 @@ CreateContinuation(nsIFrame*  aFrame,
   return NS_OK;
 }
 
-static PRBool
-IsFrameInCurrentLine(nsBlockInFlowLineIterator* aLineIter,
-                     nsIFrame* aPrevFrame, nsIFrame* aFrame)
-{
-  nsIFrame* endFrame = aLineIter->IsLastLineInList() ? nsnull :
-    aLineIter->GetLine().next()->mFirstChild;
-  nsIFrame* startFrame = aPrevFrame ? aPrevFrame : aLineIter->GetLine()->mFirstChild;
-  for (nsIFrame* frame = startFrame; frame && frame != endFrame;
-       frame = frame->GetNextSibling()) {
-    if (frame == aFrame)
-      return PR_TRUE;
-  }
-  return PR_FALSE;
-}
-
-static void
-AdvanceLineIteratorToFrame(nsIFrame* aFrame,
-                           nsBlockInFlowLineIterator* aLineIter,
-                           nsIFrame*& aPrevFrame)
-{
-  // Advance aLine to the line containing aFrame
-  nsIFrame* child = aFrame;
-  nsFrameManager* frameManager = aFrame->PresContext()->FrameManager();
-  nsIFrame* parent = nsLayoutUtils::GetParentOrPlaceholderFor(frameManager, child);
-  while (parent && !nsLayoutUtils::GetAsBlock(parent)) {
-    child = parent;
-    parent = nsLayoutUtils::GetParentOrPlaceholderFor(frameManager, child);
-  }
-  NS_ASSERTION (parent, "aFrame is not a descendent of aBlockFrame");
-  while (!IsFrameInCurrentLine(aLineIter, aPrevFrame, child)) {
-#ifdef DEBUG
-    PRBool hasNext =
-#endif
-      aLineIter->Next();
-    NS_ASSERTION(hasNext, "Can't find frame in lines!");
-    aPrevFrame = nsnull;
-  }
-  aPrevFrame = child;
-}
-
 /*
  * Overview of the implementation of Resolve():
  *
@@ -326,50 +516,15 @@ AdvanceLineIteratorToFrame(nsIFrame* aFrame,
 nsresult
 nsBidiPresUtils::Resolve(nsBlockFrame* aBlockFrame)
 {
-  mLogicalFrames.Clear();
-  mContentToFrameIndex.Clear();
-  mLinePerFrame.Clear();
-  mBuffer.SetLength(0);
-  mEmbeddingStack.Clear();
-  
-  nsPresContext *presContext = aBlockFrame->PresContext();
-
-  const nsStyleVisibility* vis = aBlockFrame->GetStyleVisibility();
-
-  mParaLevel = (NS_STYLE_DIRECTION_RTL == vis->mDirection) ?
-                NSBIDI_RTL : NSBIDI_LTR;
-
-  mIsVisual = presContext->IsVisualMode();
-  if (mIsVisual) {
-    /**
-     * Drill up in content to detect whether this is an element that needs to be
-     * rendered with logical order even on visual pages.
-     *
-     * We always use logical order on form controls, firstly so that text entry
-     * will be in logical order, but also because visual pages were written with
-     * the assumption that even if the browser had no support for right-to-left
-     * text rendering, it would use native widgets with bidi support to display
-     * form controls.
-     *
-     * We also use logical order in XUL elements, since we expect that if a XUL
-     * element appears in a visual page, it will be generated by an XBL binding
-     * and contain localized text which will be in logical order.
-     */
-    for (nsIContent* content = aBlockFrame->GetContent() ; content; 
-         content = content->GetParent()) {
-      if (content->IsNodeOfType(nsINode::eHTML_FORM_CONTROL) ||
-          content->IsXUL()) {
-        mIsVisual = PR_FALSE;
-        break;
-      }
-    }
-  }
+  BidiParagraphData bpd;
+  bpd.Init(aBlockFrame);
 
   // handle bidi-override being set on the block itself before calling
   // TraverseFrames.
   const nsStyleTextReset* text = aBlockFrame->GetStyleTextReset();
   PRUnichar ch = 0;
   if (text->mUnicodeBidi == NS_STYLE_UNICODE_BIDI_OVERRIDE) {
+    const nsStyleVisibility* vis = aBlockFrame->GetStyleVisibility();
     if (NS_STYLE_DIRECTION_RTL == vis->mDirection) {
       ch = kRLO;
     }
@@ -377,69 +532,56 @@ nsBidiPresUtils::Resolve(nsBlockFrame* aBlockFrame)
       ch = kLRO;
     }
     if (ch != 0) {
-      mLogicalFrames.AppendElement(NS_BIDI_CONTROL_FRAME);
-      mLinePerFrame.AppendElement((nsLineBox*)nsnull);
-      mBuffer.Append(ch);
-      mEmbeddingStack.AppendElement(ch);
+      bpd.PushBidiControl(ch);
     }
   }
-  mPrevContent = nsnull;
   for (nsBlockFrame* block = aBlockFrame; block;
        block = static_cast<nsBlockFrame*>(block->GetNextContinuation())) {
     block->RemoveStateBits(NS_BLOCK_NEEDS_BIDI_RESOLUTION);
     nsBlockInFlowLineIterator lineIter(block, block->begin_lines(), PR_FALSE);
-    mPrevFrame = nsnull;
-    TraverseFrames(aBlockFrame, &lineIter, block->GetFirstChild(nsnull));
+    bpd.mPrevFrame = nsnull;
+    TraverseFrames(aBlockFrame, &lineIter, block->GetFirstChild(nsnull), &bpd);
   }
 
   if (ch != 0) {
-    mLogicalFrames.AppendElement(NS_BIDI_CONTROL_FRAME);
-    mLinePerFrame.AppendElement((nsLineBox*)nsnull);
-    mBuffer.Append(kPDF);
-    NS_ASSERTION(mEmbeddingStack.Length(), "embedding/override underflow");
-    mEmbeddingStack.TruncateLength(mEmbeddingStack.Length() - 1);
+    bpd.PopBidiControl();
   }
 
-  ResolveParagraph(aBlockFrame);
-  return mSuccess;
+  return ResolveParagraph(aBlockFrame, &bpd);
 }
 
-void
-nsBidiPresUtils::ResolveParagraph(nsBlockFrame* aBlockFrame)
+nsresult
+nsBidiPresUtils::ResolveParagraph(nsBlockFrame* aBlockFrame,
+                                  BidiParagraphData* aBpd)
 {
   nsPresContext *presContext = aBlockFrame->PresContext();
-  PRInt32 bufferLength = mBuffer.Length();
 
-  if (bufferLength < 1) {
-    mSuccess = NS_OK;
-    return;
+  if (aBpd->BufferLength() < 1) {
+    return NS_OK;
   }
-  mBuffer.ReplaceChar("\t\r\n", kSpace);
+  aBpd->mBuffer.ReplaceChar("\t\r\n", kSpace);
 
   PRInt32 runCount;
-  PRUint8 embeddingLevel = mParaLevel;
+  PRUint8 embeddingLevel = aBpd->mParaLevel;
 
-  mSuccess = mBidiEngine->SetPara(mBuffer.get(), bufferLength, mParaLevel, nsnull);
-  if (NS_FAILED(mSuccess) ) {
-      return;
-  }
+  nsresult rv = aBpd->SetPara();
+  NS_ENSURE_SUCCESS(rv, rv);
+
+  rv = aBpd->CountRuns(&runCount);
+  NS_ENSURE_SUCCESS(rv, rv);
 
-  mSuccess = mBidiEngine->CountRuns(&runCount);
-  if (NS_FAILED(mSuccess) ) {
-    return;
-  }
   PRInt32     runLength      = 0;   // the length of the current run of text
   PRInt32     lineOffset     = 0;   // the start of the current run
   PRInt32     logicalLimit   = 0;   // the end of the current run + 1
   PRInt32     numRun         = -1;
   PRInt32     fragmentLength = 0;   // the length of the current text frame
   PRInt32     frameIndex     = -1;  // index to the frames in mLogicalFrames
-  PRInt32     frameCount     = mLogicalFrames.Length();
+  PRInt32     frameCount     = aBpd->FrameCount();
   PRInt32     contentOffset  = 0;   // offset of current frame in its content node
   PRBool      isTextFrame    = PR_FALSE;
   nsIFrame*   frame = nsnull;
   nsIContent* content = nsnull;
-  PRInt32     contentTextLength;
+  PRInt32     contentTextLength = 0;
 
   FramePropertyTable *propTable = presContext->PropertyTable();
   nsLineBox* currentLine = nsnull;
@@ -447,7 +589,7 @@ nsBidiPresUtils::ResolveParagraph(nsBlockFrame* aBlockFrame)
 #ifdef DEBUG
 #ifdef NOISY_BIDI
   printf("Before Resolve(), aBlockFrame=0x%p, mBuffer='%s', frameCount=%d\n",
-         (void*)aBlockFrame, NS_ConvertUTF16toUTF8(mBuffer).get(), frameCount);
+         (void*)aBlockFrame, NS_ConvertUTF16toUTF8(aBpd->mBuffer).get(), frameCount);
 #ifdef REALLY_NOISY_BIDI
   printf(" block frame tree=:\n");
   aBlockFrame->List(stdout, 0);
@@ -461,7 +603,7 @@ nsBidiPresUtils::ResolveParagraph(nsBlockFrame* aBlockFrame)
       if (++frameIndex >= frameCount) {
         break;
       }
-      frame = mLogicalFrames[frameIndex];
+      frame = aBpd->FrameAt(frameIndex);
       if (frame == NS_BIDI_CONTROL_FRAME ||
           nsGkAtoms::textFrame != frame->GetType()) {
         /*
@@ -472,10 +614,10 @@ nsBidiPresUtils::ResolveParagraph(nsBlockFrame* aBlockFrame)
         fragmentLength = 1;
       }
       else {
-        currentLine = mLinePerFrame[frameIndex];
+        currentLine = aBpd->GetLineForFrameAt(frameIndex);
         content = frame->GetContent();
         if (!content) {
-          mSuccess = NS_OK;
+          rv = NS_OK;
           break;
         }
         contentTextLength = content->TextLength();
@@ -486,7 +628,7 @@ nsBidiPresUtils::ResolveParagraph(nsBlockFrame* aBlockFrame)
           propTable->Set(frame, nsIFrame::EmbeddingLevelProperty(),
                          NS_INT32_TO_PTR(embeddingLevel));
           propTable->Set(frame, nsIFrame::BaseLevelProperty(),
-                         NS_INT32_TO_PTR(mParaLevel));
+                         NS_INT32_TO_PTR(aBpd->mParaLevel));
           continue;
         }
         PRInt32 start, end;
@@ -505,14 +647,11 @@ nsBidiPresUtils::ResolveParagraph(nsBlockFrame* aBlockFrame)
         break;
       }
       lineOffset = logicalLimit;
-      if (NS_FAILED(mBidiEngine->GetLogicalRun(
+      if (NS_FAILED(aBpd->GetLogicalRun(
               lineOffset, &logicalLimit, &embeddingLevel) ) ) {
         break;
       }
       runLength = logicalLimit - lineOffset;
-      if (mIsVisual) {
-        embeddingLevel = mParaLevel;
-      }
     } // if (runLength <= 0)
 
     if (frame == NS_BIDI_CONTROL_FRAME) {
@@ -523,7 +662,7 @@ nsBidiPresUtils::ResolveParagraph(nsBlockFrame* aBlockFrame)
       propTable->Set(frame, nsIFrame::EmbeddingLevelProperty(),
                      NS_INT32_TO_PTR(embeddingLevel));
       propTable->Set(frame, nsIFrame::BaseLevelProperty(),
-                     NS_INT32_TO_PTR(mParaLevel));
+                     NS_INT32_TO_PTR(aBpd->mParaLevel));
       if (isTextFrame) {
         if ( (runLength > 0) && (runLength < fragmentLength) ) {
           /*
@@ -533,10 +672,10 @@ nsBidiPresUtils::ResolveParagraph(nsBlockFrame* aBlockFrame)
           currentLine->MarkDirty();
           nsIFrame* nextBidi;
           PRInt32 runEnd = contentOffset + runLength;
-          EnsureBidiContinuation(frame, &nextBidi, frameIndex,
-                                 contentOffset,
-                                 runEnd);
-          if (NS_FAILED(mSuccess)) {
+          rv = EnsureBidiContinuation(frame, &nextBidi, frameIndex,
+                                      contentOffset,
+                                      runEnd);
+          if (NS_FAILED(rv)) {
             break;
           }
           nextBidi->AdjustOffsetsForBidi(runEnd,
@@ -551,10 +690,10 @@ nsBidiPresUtils::ResolveParagraph(nsBlockFrame* aBlockFrame)
              * further non-fluid continuations to fluid continuations and advance
              * frameIndex to the last frame in the content node
              */
-            PRInt32 newIndex = 0;
-            mContentToFrameIndex.Get(content, &newIndex);
+            PRInt32 newIndex = aBpd->GetLastFrameForContent(content);
             if (newIndex > frameIndex) {
-              RemoveBidiContinuation(frame, frameIndex, newIndex, lineOffset);
+              RemoveBidiContinuation(aBpd, frame,
+                                     frameIndex, newIndex, lineOffset);
               frameIndex = newIndex;
             }
           } else if (fragmentLength > 0 && runLength > fragmentLength) {
@@ -567,9 +706,10 @@ nsBidiPresUtils::ResolveParagraph(nsBlockFrame* aBlockFrame)
             PRInt32 newIndex = frameIndex;
             do {
             } while (++newIndex < frameCount &&
-                     mLogicalFrames[newIndex] == NS_BIDI_CONTROL_FRAME);
+                     aBpd->FrameAt(newIndex) == NS_BIDI_CONTROL_FRAME);
             if (newIndex < frameCount) {
-              RemoveBidiContinuation(frame, frameIndex, newIndex, lineOffset);
+              RemoveBidiContinuation(aBpd, frame,
+                                     frameIndex, newIndex, lineOffset);
             }
           } else if (runLength == fragmentLength &&
                      numRun + 1 < runCount) {
@@ -603,27 +743,30 @@ nsBidiPresUtils::ResolveParagraph(nsBlockFrame* aBlockFrame)
       // finished processing the current run, and that the current frame
       // doesn't have a fluid continuation (it could have a fluid continuation
       // of zero length, so testing runLength alone is not sufficient).
-      if (numRun + 1 < runCount && runLength <= 0 && !frame->GetNextInFlow()) {
-        nsIFrame* child = frame;
-        nsIFrame* parent = frame->GetParent();
-        // As long as we're on the last sibling, the parent doesn't have to be split.
-        // However, if the parent has a fluid continuation, we do have to make
-        // it non-fluid. This can happen e.g. when we have a first-letter frame
-        // and the end of the first-letter coincides with the end of a
-        // directional run.
-        while (parent &&
-               IsBidiSplittable(parent) &&
-               !child->GetNextSibling()) {
-          nsIFrame* next = parent->GetNextInFlow();
-          if (next) {
-            parent->SetNextContinuation(next);
-            next->SetPrevContinuation(parent);
+      if (runLength <= 0 && !frame->GetNextInFlow()) {
+        if (numRun + 1 < runCount) {
+          nsIFrame* child = frame;
+          nsIFrame* parent = frame->GetParent();
+          // As long as we're on the last sibling, the parent doesn't have to
+          // be split.
+          // However, if the parent has a fluid continuation, we do have to make
+          // it non-fluid. This can happen e.g. when we have a first-letter
+          // frame and the end of the first-letter coincides with the end of a
+          // directional run.
+          while (parent &&
+                 IsBidiSplittable(parent) &&
+                 !child->GetNextSibling()) {
+            nsIFrame* next = parent->GetNextInFlow();
+            if (next) {
+              parent->SetNextContinuation(next);
+              next->SetPrevContinuation(parent);
+            }
+            child = parent;
+            parent = child->GetParent();
           }
-          child = parent;
-          parent = child->GetParent();
+          if (parent && IsBidiSplittable(parent))
+            SplitInlineAncestors(child);
         }
-        if (parent && IsBidiSplittable(parent))
-          SplitInlineAncestors(child);
       }
       else {
         // We're not at an end of a run. If |frame| is the last child of its
@@ -641,6 +784,8 @@ nsBidiPresUtils::ResolveParagraph(nsBlockFrame* aBlockFrame)
   printf("===\n");
 #endif
 #endif
+
+  return rv;
 }
 
 // Should this frame be treated as a leaf (e.g. when building mLogicalFrames)?
@@ -650,37 +795,11 @@ PRBool IsBidiLeaf(nsIFrame* aFrame) {
     || !aFrame->IsFrameOfType(nsIFrame::eBidiInlineContainer);
 }
 
-void
-nsBidiPresUtils::AdvanceAndAppendFrame(nsIFrame** aFrame,
-                                       nsBlockInFlowLineIterator* aLineIter,
-                                       nsIFrame** aNextSibling)
-{
-  nsIFrame* frame = *aFrame;
-  nsIFrame* nextSibling = *aNextSibling;
-
-  frame = frame->GetNextContinuation();
-  if (frame) {
-    mLogicalFrames.AppendElement(frame);
-    AdvanceLineIteratorToFrame(frame, aLineIter, mPrevFrame);
-    mLinePerFrame.AppendElement(aLineIter->GetLine().get());
-
-    /*
-     * If we have already overshot the saved next-sibling while
-     * scanning the frame's continuations, advance it.
-     */
-    if (frame == nextSibling) {
-      nextSibling = frame->GetNextSibling();
-    }
-  }
-
-  *aFrame = frame;
-  *aNextSibling = nextSibling;
-}
-
 void
 nsBidiPresUtils::TraverseFrames(nsBlockFrame*              aBlockFrame,
                                 nsBlockInFlowLineIterator* aLineIter,
-                                nsIFrame*                  aCurrentFrame)
+                                nsIFrame*                  aCurrentFrame,
+                                BidiParagraphData*         aBpd)
 {
   if (!aCurrentFrame)
     return;
@@ -738,10 +857,7 @@ nsBidiPresUtils::TraverseFrames(nsBlockFrame*              aBlockFrame,
       // Add a dummy frame pointer representing a bidi control code before the
       // first frame of an element specifying embedding or override
       if (ch != 0 && !frame->GetPrevContinuation()) {
-        mLogicalFrames.AppendElement(NS_BIDI_CONTROL_FRAME);
-        mLinePerFrame.AppendElement((nsLineBox*)nsnull);
-        mBuffer.Append(ch);
-        mEmbeddingStack.AppendElement(ch);
+        aBpd->PushBidiControl(ch);
       }
     }
 
@@ -752,21 +868,15 @@ nsBidiPresUtils::TraverseFrames(nsBlockFrame*              aBlockFrame,
        * frame in the array with a given content.
        */
       nsIContent* content = frame->GetContent();
-      if (content) {
-        mContentToFrameIndex.Put(content, mLogicalFrames.Length());
-      }
-      mLogicalFrames.AppendElement(frame);
-
-      AdvanceLineIteratorToFrame(frame, aLineIter, mPrevFrame);
-      mLinePerFrame.AppendElement(aLineIter->GetLine().get());
+      aBpd->AppendFrame(frame, aLineIter, content);
 
       // Append the content of the frame to the paragraph buffer
       nsIAtom* frameType = frame->GetType();
       if (nsGkAtoms::textFrame == frameType) {
-        if (content != mPrevContent) {
-          mPrevContent = content;
+        if (content != aBpd->mPrevContent) {
+          aBpd->mPrevContent = content;
           if (!frame->GetStyleContext()->GetStyleText()->NewlineIsSignificant()) {
-            content->AppendTextTo(mBuffer);
+            content->AppendTextTo(aBpd->mBuffer);
           } else {
             /*
              * For preformatted text we have to do bidi resolution on each line
@@ -787,9 +897,9 @@ nsBidiPresUtils::TraverseFrames(nsBlockFrame*              aBlockFrame,
                  * text from this frame and its continuations, and do bidi
                  * resolution later
                  */
-                mBuffer.Append(Substring(text, start));
+                aBpd->AppendString(Substring(text, start));
                 while (frame && nextSibling) {
-                  AdvanceAndAppendFrame(&frame, aLineIter, &nextSibling);
+                  aBpd->AdvanceAndAppendFrame(&frame, aLineIter, &nextSibling);
                 }
                 break;
               }
@@ -804,18 +914,23 @@ nsBidiPresUtils::TraverseFrames(nsBlockFrame*              aBlockFrame,
                * If the frame ends before the new line, save the text and move
                * into the next continuation
                */
-              mBuffer.Append(Substring(text, start,
-                                       NS_MIN(end, endLine) - start));
+              aBpd->AppendString(Substring(text, start,
+                                           NS_MIN(end, endLine) - start));
               while (end < endLine && nextSibling) { 
-                AdvanceAndAppendFrame(&frame, aLineIter, &nextSibling);
+                aBpd->AdvanceAndAppendFrame(&frame, aLineIter, &nextSibling);
                 NS_ASSERTION(frame, "Premature end of continuation chain");
                 frame->GetOffsets(start, end);
-                mBuffer.Append(Substring(text, start,
-                                         NS_MIN(end, endLine) - start));
+                aBpd->AppendString(Substring(text, start,
+                                             NS_MIN(end, endLine) - start));
+              }
+
+              if (end < endLine) {
+                aBpd->mPrevContent = nsnull;
+                break;
               }
 
               PRBool createdContinuation = PR_FALSE;
-              if (end >= endLine && PRUint32(endLine) < text.Length()) {
+              if (PRUint32(endLine) < text.Length()) {
                 /*
                  * Timing is everything here: if the frame already has a bidi
                  * continuation, we need to make the continuation fluid *before*
@@ -847,15 +962,13 @@ nsBidiPresUtils::TraverseFrames(nsBlockFrame*              aBlockFrame,
                   createdContinuation = PR_TRUE;
                 }
               }
-              ResolveParagraphWithinBlock(aBlockFrame);
+              ResolveParagraphWithinBlock(aBlockFrame, aBpd);
 
               if (!nextSibling && !createdContinuation) {
                 break;
               } else if (next) {
                 frame = next;
-                mLogicalFrames.AppendElement(frame);
-                AdvanceLineIteratorToFrame(frame, aLineIter, mPrevFrame);
-                mLinePerFrame.AppendElement(aLineIter->GetLine().get());
+                aBpd->AppendFrame(frame, aLineIter);
               }
 
               /*
@@ -871,73 +984,42 @@ nsBidiPresUtils::TraverseFrames(nsBlockFrame*              aBlockFrame,
         }
       } else if (nsGkAtoms::brFrame == frameType) {
         // break frame -- append line separator
-        mBuffer.Append(kLineSeparator);
-        ResolveParagraphWithinBlock(aBlockFrame);
+        aBpd->AppendUnichar(kLineSeparator);
+        ResolveParagraphWithinBlock(aBlockFrame, aBpd);
       } else { 
         // other frame type -- see the Unicode Bidi Algorithm:
         // "...inline objects (such as graphics) are treated as if they are ...
         // U+FFFC"
-        mBuffer.Append(kObjectSubstitute);
+        aBpd->AppendUnichar(kObjectSubstitute);
         if (!frame->GetStyleContext()->GetStyleDisplay()->IsInlineOutside()) {
           // if it is not inline, end the paragraph
-          ResolveParagraphWithinBlock(aBlockFrame);
+          ResolveParagraphWithinBlock(aBlockFrame, aBpd);
         }
       }
     }
     else {
       // For a non-leaf frame, recurse into TraverseFrames
       nsIFrame* kid = frame->GetFirstChild(nsnull);
-      TraverseFrames(aBlockFrame, aLineIter, kid);
+      TraverseFrames(aBlockFrame, aLineIter, kid, aBpd);
     }
 
     // If the element is attributed by dir, indicate direction pop (add PDF frame)
     if (ch != 0 && isLastFrame) {
       // Add a dummy frame pointer representing a bidi control code after the
       // last frame of an element specifying embedding or override
-      mLogicalFrames.AppendElement(NS_BIDI_CONTROL_FRAME);
-      mLinePerFrame.AppendElement((nsLineBox*)nsnull);
-      mBuffer.Append(kPDF);
-      NS_ASSERTION(mEmbeddingStack.Length(), "embedding/override underflow");
-      mEmbeddingStack.TruncateLength(mEmbeddingStack.Length() - 1);
+      aBpd->PopBidiControl();
     }
     childFrame = nextSibling;
   } while (childFrame);
 }
 
 void
-nsBidiPresUtils::ResolveParagraphWithinBlock(nsBlockFrame* aBlockFrame)
+nsBidiPresUtils::ResolveParagraphWithinBlock(nsBlockFrame* aBlockFrame,
+                                             BidiParagraphData* aBpd)
 {
-  nsIPresShell* shell;
-  nsStyleContext* styleContext;
-
-  if (mEmbeddingStack.Length() > 0) {
-    shell = aBlockFrame->PresContext()->PresShell();
-    styleContext = aBlockFrame->GetStyleContext();
-
-    // pop all embeddings and overrides
-    for (PRUint32 i = 0; i < mEmbeddingStack.Length(); ++i) {
-      mBuffer.Append(kPDF);
-      mLogicalFrames.AppendElement(NS_BIDI_CONTROL_FRAME);
-      mLinePerFrame.AppendElement((nsLineBox*)nsnull);
-    }
-  }
-
-  ResolveParagraph(aBlockFrame);
-
-  // Clear the frame array and paragraph buffer, and restore the stored 
-  // embeddings and overrides
-  mLogicalFrames.Clear();
-  mContentToFrameIndex.Clear();
-  mLinePerFrame.Clear();
-  mBuffer.SetLength(0);
-  mPrevContent = nsnull;
-  if (mEmbeddingStack.Length() > 0) {
-    for (PRUint32 i = 0; i < mEmbeddingStack.Length(); ++i) {
-      mBuffer.Append(mEmbeddingStack[i]);
-      mLogicalFrames.AppendElement(NS_BIDI_CONTROL_FRAME);
-      mLinePerFrame.AppendElement((nsLineBox*)nsnull);
-    }
-  } 
+  aBpd->ClearBidiControls();
+  ResolveParagraph(aBlockFrame, aBpd);
+  aBpd->ResetData();
 }
 
 void
@@ -954,77 +1036,8 @@ nsBidiPresUtils::ReorderFrames(nsIFrame*            aFirstFrameOnLine,
     aNumFramesOnLine = -1;
   }
 
-  InitLogicalArrayFromLine(aFirstFrameOnLine, aNumFramesOnLine);
-
-  PRBool isReordered;
-  PRBool hasRTLFrames;
-  Reorder(isReordered, hasRTLFrames);
-  RepositionInlineFrames(aFirstFrameOnLine);
-}
-
-nsresult
-nsBidiPresUtils::Reorder(PRBool& aReordered, PRBool& aHasRTLFrames)
-{
-  aReordered = PR_FALSE;
-  aHasRTLFrames = PR_FALSE;
-  PRInt32 count = mLogicalFrames.Length();
-
-  if (mArraySize < count) {
-    mArraySize = count << 1;
-    if (mLevels) {
-      delete[] mLevels;
-      mLevels = nsnull;
-    }
-    if (mIndexMap) {
-      delete[] mIndexMap;
-      mIndexMap = nsnull;
-    }
-  }
-  if (!mLevels) {
-    mLevels = new PRUint8[mArraySize];
-    if (!mLevels) {
-      return NS_ERROR_OUT_OF_MEMORY;
-    }
-  }
-  memset(mLevels, 0, sizeof(PRUint8) * mArraySize);
-
-  nsIFrame* frame;
-  PRInt32   i;
-
-  for (i = 0; i < count; i++) {
-    frame = mLogicalFrames[i];
-    mLevels[i] = GetFrameEmbeddingLevel(frame);
-    if (mLevels[i] & 1) {
-      aHasRTLFrames = PR_TRUE;
-    }      
-  }
-  if (!mIndexMap) {
-    mIndexMap = new PRInt32[mArraySize];
-  }
-  if (!mIndexMap) {
-    mSuccess = NS_ERROR_OUT_OF_MEMORY;
-  }
-  else {
-    memset(mIndexMap, 0, sizeof(PRUint32) * mArraySize);
-
-    mSuccess = mBidiEngine->ReorderVisual(mLevels, count, mIndexMap);
-
-    if (NS_SUCCEEDED(mSuccess) ) {
-      mVisualFrames.Clear();
-
-      for (i = 0; i < count; i++) {
-        mVisualFrames.AppendElement(mLogicalFrames[mIndexMap[i]]);
-        if (i != mIndexMap[i]) {
-          aReordered = PR_TRUE;
-        }
-      }
-    } // NS_SUCCEEDED(mSuccess)
-  } // indexMap
-
-  if (NS_FAILED(mSuccess) ) {
-    aReordered = PR_FALSE;
-  }
-  return mSuccess;
+  BidiLineData bld(aFirstFrameOnLine, aNumFramesOnLine);
+  RepositionInlineFrames(&bld, aFirstFrameOnLine);
 }
 
 nsBidiLevel
@@ -1054,7 +1067,7 @@ void
 nsBidiPresUtils::IsLeftOrRightMost(nsIFrame*              aFrame,
                                    nsContinuationStates*  aContinuationStates,
                                    PRBool&                aIsLeftMost /* out */,
-                                   PRBool&                aIsRightMost /* out */) const
+                                   PRBool&                aIsRightMost /* out */)
 {
   const nsStyleVisibility* vis = aFrame->GetStyleVisibility();
   PRBool isLTR = (NS_STYLE_DIRECTION_LTR == vis->mDirection);
@@ -1148,7 +1161,7 @@ void
 nsBidiPresUtils::RepositionFrame(nsIFrame*              aFrame,
                                  PRBool                 aIsOddLevel,
                                  nscoord&               aLeft,
-                                 nsContinuationStates*  aContinuationStates) const
+                                 nsContinuationStates*  aContinuationStates)
 {
   if (!aFrame)
     return;
@@ -1233,7 +1246,7 @@ nsBidiPresUtils::RepositionFrame(nsIFrame*              aFrame,
 
 void
 nsBidiPresUtils::InitContinuationStates(nsIFrame*              aFrame,
-                                        nsContinuationStates*  aContinuationStates) const
+                                        nsContinuationStates*  aContinuationStates)
 {
   nsFrameContinuationState* state = aContinuationStates->PutEntry(aFrame);
   state->mFirstVisualFrame = nsnull;
@@ -1252,7 +1265,8 @@ nsBidiPresUtils::InitContinuationStates(nsIFrame*              aFrame,
 }
 
 void
-nsBidiPresUtils::RepositionInlineFrames(nsIFrame* aFirstChild) const
+nsBidiPresUtils::RepositionInlineFrames(BidiLineData *aBld,
+                                        nsIFrame* aFirstChild)
 {
   const nsStyleVisibility* vis = aFirstChild->GetStyleVisibility();
   PRBool isLTR = (NS_STYLE_DIRECTION_LTR == vis->mDirection);
@@ -1268,7 +1282,7 @@ nsBidiPresUtils::RepositionInlineFrames(nsIFrame* aFirstChild) const
 
   nscoord left = aFirstChild->GetPosition().x - leftSpace;
   nsIFrame* frame;
-  PRInt32 count = mVisualFrames.Length();
+  PRInt32 count = aBld->mVisualFrames.Length();
   PRInt32 index;
   nsContinuationStates continuationStates;
 
@@ -1277,52 +1291,36 @@ nsBidiPresUtils::RepositionInlineFrames(nsIFrame* aFirstChild) const
   // Initialize continuation states to (nsnull, 0) for
   // each frame on the line.
   for (index = 0; index < count; index++) {
-    InitContinuationStates(mVisualFrames[index], &continuationStates);
+    InitContinuationStates(aBld->VisualFrameAt(index), &continuationStates);
   }
 
   // Reposition frames in visual order
   for (index = 0; index < count; index++) {
-    frame = mVisualFrames[index];
+    frame = aBld->VisualFrameAt(index);
     RepositionFrame(frame,
-                    (mLevels[mIndexMap[index]] & 1),
+                    (aBld->mLevels[aBld->mIndexMap[index]] & 1),
                     left,
                     &continuationStates);
   } // for
 }
 
-void 
-nsBidiPresUtils::InitLogicalArrayFromLine(nsIFrame* aFirstFrameOnLine,
-                                          PRInt32   aNumFramesOnLine) {
-  mLogicalFrames.Clear();
-  for (nsIFrame* frame = aFirstFrameOnLine;
-       frame && aNumFramesOnLine--;
-       frame = frame->GetNextSibling()) {
-    mLogicalFrames.AppendElement(frame);
-  }
-}
-
 PRBool
 nsBidiPresUtils::CheckLineOrder(nsIFrame*  aFirstFrameOnLine,
                                 PRInt32    aNumFramesOnLine,
                                 nsIFrame** aFirstVisual,
                                 nsIFrame** aLastVisual)
 {
-  InitLogicalArrayFromLine(aFirstFrameOnLine, aNumFramesOnLine);
-  
-  PRBool isReordered;
-  PRBool hasRTLFrames;
-  Reorder(isReordered, hasRTLFrames);
-  PRInt32 count = mLogicalFrames.Length();
+  BidiLineData bld(aFirstFrameOnLine, aNumFramesOnLine);
+  PRInt32 count = bld.FrameCount();
   
   if (aFirstVisual) {
-    *aFirstVisual = mVisualFrames[0];
+    *aFirstVisual = bld.VisualFrameAt(0);
   }
   if (aLastVisual) {
-    *aLastVisual = mVisualFrames[count-1];
+    *aLastVisual = bld.VisualFrameAt(count-1);
   }
   
-  // If there's an RTL frame, assume the line is reordered
-  return isReordered || hasRTLFrames;
+  return bld.mIsReordered;
 }
 
 nsIFrame*
@@ -1330,19 +1328,16 @@ nsBidiPresUtils::GetFrameToRightOf(const nsIFrame*  aFrame,
                                    nsIFrame*        aFirstFrameOnLine,
                                    PRInt32          aNumFramesOnLine)
 {
-  InitLogicalArrayFromLine(aFirstFrameOnLine, aNumFramesOnLine);
-  
-  PRBool isReordered;
-  PRBool hasRTLFrames;
-  Reorder(isReordered, hasRTLFrames);
-  PRInt32 count = mVisualFrames.Length();
+  BidiLineData bld(aFirstFrameOnLine, aNumFramesOnLine);
+
+  PRInt32 count = bld.mVisualFrames.Length();
 
   if (aFrame == nsnull)
-    return mVisualFrames[0];
+    return bld.VisualFrameAt(0);
   
   for (PRInt32 i = 0; i < count - 1; i++) {
-    if (mVisualFrames[i] == aFrame) {
-      return mVisualFrames[i+1];
+    if (bld.VisualFrameAt(i) == aFrame) {
+      return bld.VisualFrameAt(i+1);
     }
   }
   
@@ -1354,26 +1349,23 @@ nsBidiPresUtils::GetFrameToLeftOf(const nsIFrame*  aFrame,
                                   nsIFrame*        aFirstFrameOnLine,
                                   PRInt32          aNumFramesOnLine)
 {
-  InitLogicalArrayFromLine(aFirstFrameOnLine, aNumFramesOnLine);
-  
-  PRBool isReordered;
-  PRBool hasRTLFrames;
-  Reorder(isReordered, hasRTLFrames);
-  PRInt32 count = mVisualFrames.Length();
+  BidiLineData bld(aFirstFrameOnLine, aNumFramesOnLine);
+
+  PRInt32 count = bld.mVisualFrames.Length();
   
   if (aFrame == nsnull)
-    return mVisualFrames[count-1];
+    return bld.VisualFrameAt(count-1);
   
   for (PRInt32 i = 1; i < count; i++) {
-    if (mVisualFrames[i] == aFrame) {
-      return mVisualFrames[i-1];
+    if (bld.VisualFrameAt(i) == aFrame) {
+      return bld.VisualFrameAt(i-1);
     }
   }
   
   return nsnull;
 }
 
-inline void
+inline nsresult
 nsBidiPresUtils::EnsureBidiContinuation(nsIFrame*       aFrame,
                                         nsIFrame**      aNewFrame,
                                         PRInt32&        aFrameIndex,
@@ -1384,14 +1376,15 @@ nsBidiPresUtils::EnsureBidiContinuation(nsIFrame*       aFrame,
   NS_PRECONDITION(aFrame, "aFrame is null");
 
   aFrame->AdjustOffsetsForBidi(aStart, aEnd);
-  mSuccess = CreateContinuation(aFrame, aNewFrame, PR_FALSE);
+  return CreateContinuation(aFrame, aNewFrame, PR_FALSE);
 }
 
 void
-nsBidiPresUtils::RemoveBidiContinuation(nsIFrame*       aFrame,
+nsBidiPresUtils::RemoveBidiContinuation(BidiParagraphData *aBpd,
+                                        nsIFrame*       aFrame,
                                         PRInt32         aFirstIndex,
                                         PRInt32         aLastIndex,
-                                        PRInt32&        aOffset) const
+                                        PRInt32&        aOffset)
 {
   FrameProperties props = aFrame->Properties();
   nsBidiLevel embeddingLevel =
@@ -1400,7 +1393,7 @@ nsBidiPresUtils::RemoveBidiContinuation(nsIFrame*       aFrame,
     (nsBidiLevel)NS_PTR_TO_INT32(props.Get(nsIFrame::BaseLevelProperty()));
 
   for (PRInt32 index = aFirstIndex + 1; index <= aLastIndex; index++) {
-    nsIFrame* frame = mLogicalFrames[index];
+    nsIFrame* frame = aBpd->FrameAt(index);
     if (frame == NS_BIDI_CONTROL_FRAME) {
       ++aOffset;
     }
@@ -1494,7 +1487,7 @@ nsBidiPresUtils::FormatUnicodeText(nsPresContext*  aPresContext,
 
 void
 nsBidiPresUtils::StripBidiControlCharacters(PRUnichar* aText,
-                                            PRInt32&   aTextLength) const
+                                            PRInt32&   aTextLength)
 {
   if ( (nsnull == aText) || (aTextLength < 1) ) {
     return;
@@ -1537,13 +1530,15 @@ RemoveDiacritics(PRUnichar* aText,
 #endif
 
 void
-nsBidiPresUtils::CalculateCharType(PRInt32& aOffset,
+nsBidiPresUtils::CalculateCharType(nsBidi* aBidiEngine,
+                                   const PRUnichar* aText,
+                                   PRInt32& aOffset,
                                    PRInt32  aCharTypeLimit,
                                    PRInt32& aRunLimit,
                                    PRInt32& aRunLength,
                                    PRInt32& aRunCount,
                                    PRUint8& aCharType,
-                                   PRUint8& aPrevCharType) const
+                                   PRUint8& aPrevCharType)
 
 {
   PRBool     strongTypeFound = PR_FALSE;
@@ -1556,14 +1551,14 @@ nsBidiPresUtils::CalculateCharType(PRInt32& aOffset,
     // Make sure we give RTL chartype to all characters that would be classified
     // as Right-To-Left by a bidi platform.
     // (May differ from the UnicodeData, eg we set RTL chartype to some NSMs.)
-    if (IS_HEBREW_CHAR(mBuffer[offset]) ) {
+    if (IS_HEBREW_CHAR(aText[offset]) ) {
       charType = eCharType_RightToLeft;
     }
-    else if (IS_ARABIC_ALPHABETIC(mBuffer[offset]) ) {
+    else if (IS_ARABIC_ALPHABETIC(aText[offset]) ) {
       charType = eCharType_RightToLeftArabic;
     }
     else {
-      mBidiEngine->GetCharTypeAt(offset, &charType);
+      aBidiEngine->GetCharTypeAt(offset, &charType);
     }
 
     if (!CHARTYPE_IS_WEAK(charType) ) {
@@ -1606,24 +1601,25 @@ nsresult nsBidiPresUtils::ProcessText(const PRUnichar*       aText,
                                       Mode                   aMode,
                                       nsBidiPositionResolve* aPosResolve,
                                       PRInt32                aPosResolveCount,
-                                      nscoord*               aWidth)
+                                      nscoord*               aWidth,
+                                      nsBidi*                aBidiEngine)
 {
   NS_ASSERTION((aPosResolve == nsnull) != (aPosResolveCount > 0), "Incorrect aPosResolve / aPosResolveCount arguments");
 
   PRInt32 runCount;
 
-  mBuffer.Assign(aText, aLength);
+  nsAutoString textBuffer(aText, aLength);
 
-  nsresult rv = mBidiEngine->SetPara(mBuffer.get(), aLength, aBaseDirection, nsnull);
+  nsresult rv = aBidiEngine->SetPara(aText, aLength, aBaseDirection, nsnull);
   if (NS_FAILED(rv))
     return rv;
 
-  rv = mBidiEngine->CountRuns(&runCount);
+  rv = aBidiEngine->CountRuns(&runCount);
   if (NS_FAILED(rv))
     return rv;
 
   nscoord xOffset = 0;
-  nscoord width, xEndRun;
+  nscoord width, xEndRun = 0;
   nscoord totalWidth = 0;
   PRInt32 i, start, limit, length;
   PRUint32 visualStart = 0;
@@ -1639,11 +1635,11 @@ nsresult nsBidiPresUtils::ProcessText(const PRUnichar*       aText,
   }
 
   for (i = 0; i < runCount; i++) {
-    rv = mBidiEngine->GetVisualRun(i, &start, &length, &aBaseDirection);
+    rv = aBidiEngine->GetVisualRun(i, &start, &length, &aBaseDirection);
     if (NS_FAILED(rv))
       return rv;
 
-    rv = mBidiEngine->GetLogicalRun(start, &limit, &level);
+    rv = aBidiEngine->GetLogicalRun(start, &limit, &level);
     if (NS_FAILED(rv))
       return rv;
 
@@ -1675,7 +1671,7 @@ nsresult nsBidiPresUtils::ProcessText(const PRUnichar*       aText,
     while (subRunCount > 0) {
       // CalculateCharType can increment subRunCount if the run
       // contains mixed character types
-      CalculateCharType(lineOffset, typeLimit, subRunLimit, subRunLength, subRunCount, charType, prevType);
+      CalculateCharType(aBidiEngine, aText, lineOffset, typeLimit, subRunLimit, subRunLength, subRunCount, charType, prevType);
       
       nsAutoString runVisualText;
       runVisualText.Assign(aText + start, subRunLength);
@@ -1861,9 +1857,9 @@ nsresult nsBidiPresUtils::ProcessTextForRenderingContext(const PRUnichar*
                                                          nscoord*               aWidth)
 {
   nsIRenderingContextBidiProcessor processor(&aRenderingContext, &aTextRunConstructionContext, nsPoint(aX, aY));
-
+  nsBidi bidiEngine;
   return ProcessText(aText, aLength, aBaseDirection, aPresContext, processor,
-                     aMode, aPosResolve, aPosResolveCount, aWidth);
+                     aMode, aPosResolve, aPosResolveCount, aWidth, &bidiEngine);
 }
 
 /* static */
@@ -1985,8 +1981,9 @@ void nsBidiPresUtils::CopyLogicalToVisual(const nsAString& aSource,
       aDest.SetLength(0);
     }
   } else {
+    nsBidi bidiEngine;
     if (!WriteLogicalToVisual(fromBegin.get(), srcLength, toBegin.get(),
-                             aBaseDirection, mBidiEngine)) {
+                             aBaseDirection, &bidiEngine)) {
       aDest.SetLength(0);
     }
   }
@@ -1998,37 +1995,4 @@ void nsBidiPresUtils::CopyLogicalToVisual(const nsAString& aSource,
                   aDest);
   }
 }
-
-PRUint32 nsBidiPresUtils::EstimateMemoryUsed()
-{
-  PRUint32 size = 0;
-
-  size += sizeof(nsBidiPresUtils);
-  size += mBuffer.Length() * sizeof(PRUnichar);
-  size += moz_malloc_usable_size(mBidiEngine->mDirPropsMemory);
-  size += moz_malloc_usable_size(mBidiEngine->mLevelsMemory);
-  size += moz_malloc_usable_size(mBidiEngine->mRunsMemory);
-
-  return size;
-}
-
-static PLDHashOperator
-TraverseKey(nsISupports *aKey, PRInt32 aData, void *aUserArg)
-{
-  nsCycleCollectionTraversalCallback *cb =
-    static_cast<nsCycleCollectionTraversalCallback*>(aUserArg);
-  NS_CYCLE_COLLECTION_NOTE_EDGE_NAME(*cb, "mContentToFrameIndex key");
-  cb->NoteXPCOMChild(aKey);
-  return PL_DHASH_NEXT;
-}
-
-void nsBidiPresUtils::Traverse(nsCycleCollectionTraversalCallback &cb) const
-{
-  mContentToFrameIndex.EnumerateRead(TraverseKey, &cb);
-}
-
-void nsBidiPresUtils::Unlink()
-{
-  mContentToFrameIndex.Clear();
-}
 #endif // IBMBIDI
diff --git a/layout/base/nsBidiPresUtils.h b/layout/base/nsBidiPresUtils.h
index 22d88f9de104..5a81f0dcaec6 100644
--- a/layout/base/nsBidiPresUtils.h
+++ b/layout/base/nsBidiPresUtils.h
@@ -55,6 +55,9 @@
 #undef DrawText
 #endif
 
+struct BidiParagraphData;
+struct BidiLineData;
+
 /**
  * A structure representing some continuation state for each frame on the line,
  * used to determine the first and the last continuation frame for each
@@ -118,7 +121,6 @@ class nsBidiPresUtils {
 public:
   nsBidiPresUtils();
   ~nsBidiPresUtils();
-  PRBool IsSuccessful(void) const;
   
   /**
    * Interface for the processor used by ProcessText. Used by process text to
@@ -174,9 +176,11 @@ public:
    *
    *  @lina 06/18/2000
    */
-  nsresult Resolve(nsBlockFrame* aBlockFrame);
-  void ResolveParagraph(nsBlockFrame* aBlockFrame);
-  void ResolveParagraphWithinBlock(nsBlockFrame* aBlockFrame);
+  static nsresult Resolve(nsBlockFrame* aBlockFrame);
+  static nsresult ResolveParagraph(nsBlockFrame* aBlockFrame,
+                                   BidiParagraphData* aBpd);
+  static void ResolveParagraphWithinBlock(nsBlockFrame* aBlockFrame,
+                                          BidiParagraphData* aBpd);
 
   /**
    * Reorder this line using Bidi engine.
@@ -184,8 +188,8 @@ public:
    * 
    * @lina 05/02/2000
    */
-  void ReorderFrames(nsIFrame*            aFirstFrameOnLine,
-                     PRInt32              aNumFramesOnLine);
+  static void ReorderFrames(nsIFrame*            aFirstFrameOnLine,
+                            PRInt32              aNumFramesOnLine);
 
   /**
    * Format Unicode text, taking into account bidi capabilities
@@ -194,11 +198,11 @@ public:
    *
    * @lina 06/18/2000 
    */
-  nsresult FormatUnicodeText(nsPresContext* aPresContext,
-                             PRUnichar*      aText,
-                             PRInt32&        aTextLength,
-                             nsCharType      aCharType,
-                             PRBool          aIsOddLevel);
+  static nsresult FormatUnicodeText(nsPresContext* aPresContext,
+                                    PRUnichar*      aText,
+                                    PRInt32&        aTextLength,
+                                    nsCharType      aCharType,
+                                    PRBool          aIsOddLevel);
 
   /**
    * Reorder plain text using the Unicode Bidi algorithm and send it to
@@ -217,26 +221,26 @@ public:
    * @param[in,out] aPosResolve array of logical positions to resolve into visual positions; can be nsnull if this functionality is not required
    * @param aPosResolveCount number of items in the aPosResolve array
    */
-  nsresult RenderText(const PRUnichar*       aText,
-                      PRInt32                aLength,
-                      nsBidiDirection        aBaseDirection,
-                      nsPresContext*         aPresContext,
-                      nsRenderingContext&    aRenderingContext,
-                      nsRenderingContext&    aTextRunConstructionContext,
-                      nscoord                aX,
-                      nscoord                aY,
-                      nsBidiPositionResolve* aPosResolve = nsnull,
-                      PRInt32                aPosResolveCount = 0)
+  static nsresult RenderText(const PRUnichar*       aText,
+                             PRInt32                aLength,
+                             nsBidiDirection        aBaseDirection,
+                             nsPresContext*         aPresContext,
+                             nsRenderingContext&    aRenderingContext,
+                             nsRenderingContext&    aTextRunConstructionContext,
+                             nscoord                aX,
+                             nscoord                aY,
+                             nsBidiPositionResolve* aPosResolve = nsnull,
+                             PRInt32                aPosResolveCount = 0)
   {
     return ProcessTextForRenderingContext(aText, aLength, aBaseDirection, aPresContext, aRenderingContext,
                                           aTextRunConstructionContext, MODE_DRAW, aX, aY, aPosResolve, aPosResolveCount, nsnull);
   }
   
-  nscoord MeasureTextWidth(const PRUnichar*     aText,
-                           PRInt32              aLength,
-                           nsBidiDirection      aBaseDirection,
-                           nsPresContext*       aPresContext,
-                           nsRenderingContext&  aRenderingContext)
+  static nscoord MeasureTextWidth(const PRUnichar*     aText,
+                                  PRInt32              aLength,
+                                  nsBidiDirection      aBaseDirection,
+                                  nsPresContext*       aPresContext,
+                                  nsRenderingContext&  aRenderingContext)
   {
     nscoord length;
     nsresult rv = ProcessTextForRenderingContext(aText, aLength, aBaseDirection, aPresContext,
@@ -253,10 +257,10 @@ public:
    * @param[out] aLeftMost : leftmost frame on this line
    * @param[out] aRightMost : rightmost frame on this line
    */
-  PRBool CheckLineOrder(nsIFrame*  aFirstFrameOnLine,
-                        PRInt32    aNumFramesOnLine,
-                        nsIFrame** aLeftmost,
-                        nsIFrame** aRightmost);
+  static PRBool CheckLineOrder(nsIFrame*  aFirstFrameOnLine,
+                               PRInt32    aNumFramesOnLine,
+                               nsIFrame** aLeftmost,
+                               nsIFrame** aRightmost);
 
   /**
    * Get the frame to the right of the given frame, on the same line.
@@ -265,9 +269,9 @@ public:
    * @param aFirstFrameOnLine : first frame of the line to be tested
    * @param aNumFramesOnLine : number of frames on this line
    */
-  nsIFrame* GetFrameToRightOf(const nsIFrame*  aFrame,
-                              nsIFrame*        aFirstFrameOnLine,
-                              PRInt32          aNumFramesOnLine);
+  static nsIFrame* GetFrameToRightOf(const nsIFrame*  aFrame,
+                                     nsIFrame*        aFirstFrameOnLine,
+                                     PRInt32          aNumFramesOnLine);
     
   /**
    * Get the frame to the left of the given frame, on the same line.
@@ -276,9 +280,9 @@ public:
    * @param aFirstFrameOnLine : first frame of the line to be tested
    * @param aNumFramesOnLine : number of frames on this line
    */
-  nsIFrame* GetFrameToLeftOf(const nsIFrame*  aFrame,
-                             nsIFrame*        aFirstFrameOnLine,
-                             PRInt32          aNumFramesOnLine);
+  static nsIFrame* GetFrameToLeftOf(const nsIFrame*  aFrame,
+                                    nsIFrame*        aFirstFrameOnLine,
+                                    PRInt32          aNumFramesOnLine);
     
   /**
    * Get the bidi embedding level of the given (inline) frame.
@@ -312,15 +316,16 @@ public:
    * @param aPosResolveCount number of items in the aPosResolve array
    * @param[out] aWidth Pointer to where the width will be stored (may be null)
    */
-  nsresult ProcessText(const PRUnichar*       aText,
-                       PRInt32                aLength,
-                       nsBidiDirection        aBaseDirection,
-                       nsPresContext*         aPresContext,
-                       BidiProcessor&         aprocessor,
-                       Mode                   aMode,
-                       nsBidiPositionResolve* aPosResolve,
-                       PRInt32                aPosResolveCount,
-                       nscoord*               aWidth);
+  static nsresult ProcessText(const PRUnichar*       aText,
+                              PRInt32                aLength,
+                              nsBidiDirection        aBaseDirection,
+                              nsPresContext*         aPresContext,
+                              BidiProcessor&         aprocessor,
+                              Mode                   aMode,
+                              nsBidiPositionResolve* aPosResolve,
+                              PRInt32                aPosResolveCount,
+                              nscoord*               aWidth,
+                              nsBidi*                aBidiEngine);
 
   /**
    * Make a copy of a string, converting from logical to visual order
@@ -335,36 +340,25 @@ public:
    * @param aOverride if TRUE, the text has a bidi override, according to
    *                    the direction in aDir
    */
-  void CopyLogicalToVisual(const nsAString& aSource,
-                           nsAString& aDest,
-                           nsBidiLevel aBaseDirection,
-                           PRBool aOverride);
-
-  /**
-   * Guess at how much memory is being used by this nsBidiPresUtils instance,
-   * including memory used by nsBidi.
-   */
-  PRUint32 EstimateMemoryUsed();
-
-  void Traverse(nsCycleCollectionTraversalCallback &cb) const;
-  void Unlink();
+  static void CopyLogicalToVisual(const nsAString& aSource,
+                                  nsAString& aDest,
+                                  nsBidiLevel aBaseDirection,
+                                  PRBool aOverride);
 
 private:
-  nsresult ProcessTextForRenderingContext(const PRUnichar*       aText,
-                                          PRInt32                aLength,
-                                          nsBidiDirection        aBaseDirection,
-                                          nsPresContext*         aPresContext,
-                                          nsRenderingContext&    aRenderingContext,
-                                          nsRenderingContext&    aTextRunConstructionContext,
-                                          Mode                   aMode,
-                                          nscoord                aX, // DRAW only
-                                          nscoord                aY, // DRAW only
-                                          nsBidiPositionResolve* aPosResolve,  /* may be null */
-                                          PRInt32                aPosResolveCount,
-                                          nscoord*               aWidth /* may be null */);
-  void AdvanceAndAppendFrame(nsIFrame**                 aFrame,
-                             nsBlockInFlowLineIterator* aLineIter,
-                             nsIFrame**                 aNextSibling);
+  static nsresult
+  ProcessTextForRenderingContext(const PRUnichar*       aText,
+                                 PRInt32                aLength,
+                                 nsBidiDirection        aBaseDirection,
+                                 nsPresContext*         aPresContext,
+                                 nsRenderingContext&    aRenderingContext,
+                                 nsRenderingContext&    aTextRunConstructionContext,
+                                 Mode                   aMode,
+                                 nscoord                aX, // DRAW only
+                                 nscoord                aY, // DRAW only
+                                 nsBidiPositionResolve* aPosResolve,  /* may be null */
+                                 PRInt32                aPosResolveCount,
+                                 nscoord*               aWidth /* may be null */);
 
   /**
    * Traverse the child frames of the block element and:
@@ -374,26 +368,10 @@ private:
    *  than one paragraph for bidi resolution, resolve the paragraph up to that
    *  point.
    */
-  void TraverseFrames(nsBlockFrame*              aBlockFrame,
-                      nsBlockInFlowLineIterator* aLineIter,
-                      nsIFrame*                  aCurrentFrame);
-
-  /**
-   * Initialize the logically-ordered array of frames
-   * using the top-level frames of a single line
-   */
-  void InitLogicalArrayFromLine(nsIFrame* aFirstFrameOnLine,
-                                PRInt32   aNumFramesOnLine);
-
-  /**
-   * Reorder the frame array from logical to visual order
-   * 
-   * @param aReordered TRUE on return if the visual order is different from
-   *                   the logical order
-   * @param aHasRTLFrames TRUE on return if at least one of the frames is RTL
-   *                      (and therefore might have reordered descendents)
-   */
-  nsresult Reorder(PRBool& aReordered, PRBool& aHasRTLFrames);
+  static void TraverseFrames(nsBlockFrame*              aBlockFrame,
+                             nsBlockInFlowLineIterator* aLineIter,
+                             nsIFrame*                  aCurrentFrame,
+                             BidiParagraphData*         aBpd);
   
   /*
    * Position aFrame and it's descendants to their visual places. Also if aFrame
@@ -408,10 +386,10 @@ private:
    *                             adding its right margin)
    * @param aContinuationStates  A map from nsIFrame* to nsFrameContinuationState
    */
-  void RepositionFrame(nsIFrame*              aFrame,
-                       PRBool                 aIsOddLevel,
-                       nscoord&               aLeft,
-                       nsContinuationStates*  aContinuationStates) const;
+  static void RepositionFrame(nsIFrame*              aFrame,
+                              PRBool                 aIsOddLevel,
+                              nscoord&               aLeft,
+                              nsContinuationStates*  aContinuationStates);
 
   /*
    * Initialize the continuation state(nsFrameContinuationState) to
@@ -421,8 +399,8 @@ private:
    *                             be initialized
    * @param aContinuationStates  A map from nsIFrame* to nsFrameContinuationState
    */
-  void InitContinuationStates(nsIFrame*              aFrame,
-                              nsContinuationStates*  aContinuationStates) const;
+  static void InitContinuationStates(nsIFrame*              aFrame,
+                                     nsContinuationStates*  aContinuationStates);
 
   /*
    * Determine if aFrame is leftmost or rightmost, and set aIsLeftMost and
@@ -439,10 +417,10 @@ private:
    * @param[out] aIsLeftMost     TRUE means aFrame is leftmost frame or continuation
    * @param[out] aIsRightMost    TRUE means aFrame is rightmost frame or continuation
    */
-   void IsLeftOrRightMost(nsIFrame*              aFrame,
-                          nsContinuationStates*  aContinuationStates,
-                          PRBool&                aIsLeftMost /* out */,
-                          PRBool&                aIsRightMost /* out */) const;
+   static void IsLeftOrRightMost(nsIFrame*              aFrame,
+                                 nsContinuationStates*  aContinuationStates,
+                                 PRBool&                aIsLeftMost /* out */,
+                                 PRBool&                aIsRightMost /* out */);
 
   /**
    *  Adjust frame positions following their visual order
@@ -451,7 +429,8 @@ private:
    *
    *  @lina 04/11/2000
    */
-  void RepositionInlineFrames(nsIFrame* aFirstChild) const;
+  static void RepositionInlineFrames(BidiLineData* aBld,
+                                     nsIFrame* aFirstChild);
   
   /**
    * Helper method for Resolve()
@@ -468,12 +447,12 @@ private:
    * @see Resolve()
    * @see RemoveBidiContinuation()
    */
-  inline
-  void EnsureBidiContinuation(nsIFrame*       aFrame,
-                              nsIFrame**      aNewFrame,
-                              PRInt32&        aFrameIndex,
-                              PRInt32         aStart,
-                              PRInt32         aEnd);
+  static inline
+  nsresult EnsureBidiContinuation(nsIFrame*       aFrame,
+                                  nsIFrame**      aNewFrame,
+                                  PRInt32&        aFrameIndex,
+                                  PRInt32         aStart,
+                                  PRInt32         aEnd);
 
   /**
    * Helper method for Resolve()
@@ -491,20 +470,23 @@ private:
    * @see Resolve()
    * @see EnsureBidiContinuation()
    */
-  void RemoveBidiContinuation(nsIFrame*       aFrame,
-                              PRInt32         aFirstIndex,
-                              PRInt32         aLastIndex,
-                              PRInt32&        aOffset) const;
-  void CalculateCharType(PRInt32& aOffset,
-                         PRInt32  aCharTypeLimit,
-                         PRInt32& aRunLimit,
-                         PRInt32& aRunLength,
-                         PRInt32& aRunCount,
-                         PRUint8& aCharType,
-                         PRUint8& aPrevCharType) const;
+  static void RemoveBidiContinuation(BidiParagraphData* aBpd,
+                                     nsIFrame*          aFrame,
+                                     PRInt32            aFirstIndex,
+                                     PRInt32            aLastIndex,
+                                     PRInt32&           aOffset);
+  static void CalculateCharType(nsBidi*          aBidiEngine,
+                                const PRUnichar* aText,
+                                PRInt32&         aOffset,
+                                PRInt32          aCharTypeLimit,
+                                PRInt32&         aRunLimit,
+                                PRInt32&         aRunLength,
+                                PRInt32&         aRunCount,
+                                PRUint8&         aCharType,
+                                PRUint8&         aPrevCharType);
   
-  void StripBidiControlCharacters(PRUnichar* aText,
-                                  PRInt32&   aTextLength) const;
+  static void StripBidiControlCharacters(PRUnichar* aText,
+                                         PRInt32&   aTextLength);
 
   static PRBool WriteLogicalToVisual(const PRUnichar* aSrc,
                                      PRUint32 aSrcLength,
@@ -512,26 +494,9 @@ private:
                                      nsBidiLevel aBaseDirection,
                                      nsBidi* aBidiEngine);
 
- static void WriteReverse(const PRUnichar* aSrc,
-                          PRUint32 aSrcLength,
-                          PRUnichar* aDest);
-
-  nsString        mBuffer;
-  nsTArray<PRUnichar> mEmbeddingStack;
-  nsTArray<nsIFrame*> mLogicalFrames;
-  nsTArray<nsLineBox*> mLinePerFrame;
-  nsTArray<nsIFrame*> mVisualFrames;
-  nsDataHashtable<nsISupportsHashKey, PRInt32> mContentToFrameIndex;
-  PRInt32         mArraySize;
-  PRInt32*        mIndexMap;
-  PRUint8*        mLevels;
-  nsresult        mSuccess;
-  PRPackedBool    mIsVisual;
-  nsBidiLevel     mParaLevel;
-  nsIFrame*       mPrevFrame;
-  nsIContent*     mPrevContent;
-
-  nsBidi*         mBidiEngine;
+  static void WriteReverse(const PRUnichar* aSrc,
+                           PRUint32 aSrcLength,
+                           PRUnichar* aDest);
 };
 
 #endif /* nsBidiPresUtils_h___ */
diff --git a/layout/base/nsCSSFrameConstructor.cpp b/layout/base/nsCSSFrameConstructor.cpp
index cc383f44ab6c..4e15479d38c0 100644
--- a/layout/base/nsCSSFrameConstructor.cpp
+++ b/layout/base/nsCSSFrameConstructor.cpp
@@ -107,7 +107,7 @@
 #include "nsLayoutUtils.h"
 #include "nsAutoPtr.h"
 #include "nsBoxFrame.h"
-#include "nsIBoxLayout.h"
+#include "nsBoxLayout.h"
 #include "nsImageFrame.h"
 #include "nsIObjectLoadingContent.h"
 #include "nsContentErrors.h"
@@ -318,7 +318,7 @@ NS_NewTreeBodyFrame (nsIPresShell* aPresShell, nsStyleContext* aContext);
 
 // grid
 nsresult
-NS_NewGridLayout2 ( nsIPresShell* aPresShell, nsIBoxLayout** aNewLayout );
+NS_NewGridLayout2 ( nsIPresShell* aPresShell, nsBoxLayout** aNewLayout );
 nsIFrame*
 NS_NewGridRowLeafFrame (nsIPresShell* aPresShell, nsStyleContext* aContext);
 nsIFrame*
@@ -3947,7 +3947,7 @@ static
 nsIFrame* NS_NewGridBoxFrame(nsIPresShell* aPresShell,
                              nsStyleContext* aStyleContext)
 {
-  nsCOMPtr<nsIBoxLayout> layout;
+  nsCOMPtr<nsBoxLayout> layout;
   NS_NewGridLayout2(aPresShell, getter_AddRefs(layout));
   if (!layout) {
     return nsnull;
diff --git a/layout/base/nsLayoutUtils.cpp b/layout/base/nsLayoutUtils.cpp
index 6745f9663d2c..54fdad8661b5 100644
--- a/layout/base/nsLayoutUtils.cpp
+++ b/layout/base/nsLayoutUtils.cpp
@@ -2854,19 +2854,15 @@ nsLayoutUtils::DrawString(const nsIFrame*      aFrame,
   nsresult rv = NS_ERROR_FAILURE;
   nsPresContext* presContext = aFrame->PresContext();
   if (presContext->BidiEnabled()) {
-    nsBidiPresUtils* bidiUtils = presContext->GetBidiUtils();
-
-    if (bidiUtils) {
-      if (aDirection == NS_STYLE_DIRECTION_INHERIT) {
-        aDirection = aFrame->GetStyleVisibility()->mDirection;
-      }
-      nsBidiDirection direction =
-        (NS_STYLE_DIRECTION_RTL == aDirection) ?
-        NSBIDI_RTL : NSBIDI_LTR;
-      rv = bidiUtils->RenderText(aString, aLength, direction,
-                                 presContext, *aContext, *aContext,
-                                 aPoint.x, aPoint.y);
+    if (aDirection == NS_STYLE_DIRECTION_INHERIT) {
+      aDirection = aFrame->GetStyleVisibility()->mDirection;
     }
+    nsBidiDirection direction =
+      (NS_STYLE_DIRECTION_RTL == aDirection) ?
+      NSBIDI_RTL : NSBIDI_LTR;
+    rv = nsBidiPresUtils::RenderText(aString, aLength, direction,
+                                     presContext, *aContext, *aContext,
+                                     aPoint.x, aPoint.y);
   }
   if (NS_FAILED(rv))
 #endif // IBMBIDI
@@ -2885,16 +2881,12 @@ nsLayoutUtils::GetStringWidth(const nsIFrame*      aFrame,
 #ifdef IBMBIDI
   nsPresContext* presContext = aFrame->PresContext();
   if (presContext->BidiEnabled()) {
-    nsBidiPresUtils* bidiUtils = presContext->GetBidiUtils();
-
-    if (bidiUtils) {
-      const nsStyleVisibility* vis = aFrame->GetStyleVisibility();
-      nsBidiDirection direction =
-        (NS_STYLE_DIRECTION_RTL == vis->mDirection) ?
-        NSBIDI_RTL : NSBIDI_LTR;
-      return bidiUtils->MeasureTextWidth(aString, aLength,
-                                         direction, presContext, *aContext);
-    }
+    const nsStyleVisibility* vis = aFrame->GetStyleVisibility();
+    nsBidiDirection direction =
+      (NS_STYLE_DIRECTION_RTL == vis->mDirection) ?
+      NSBIDI_RTL : NSBIDI_LTR;
+    return nsBidiPresUtils::MeasureTextWidth(aString, aLength,
+                                             direction, presContext, *aContext);
   }
 #endif // IBMBIDI
   aContext->SetTextRunRTL(PR_FALSE);
diff --git a/layout/base/nsPresContext.cpp b/layout/base/nsPresContext.cpp
index 1b5b6e791633..4042b41aca44 100644
--- a/layout/base/nsPresContext.cpp
+++ b/layout/base/nsPresContext.cpp
@@ -369,8 +369,6 @@ NS_IMPL_CYCLE_COLLECTION_TRAVERSE_BEGIN(nsPresContext)
   // NS_IMPL_CYCLE_COLLECTION_TRAVERSE_NSCOMPTR(mLangService); // a service
   NS_IMPL_CYCLE_COLLECTION_TRAVERSE_NSCOMPTR(mPrintSettings);
   NS_IMPL_CYCLE_COLLECTION_TRAVERSE_NSCOMPTR(mPrefChangedTimer);
-  if (tmp->mBidiUtils)
-    tmp->mBidiUtils->Traverse(cb);
 NS_IMPL_CYCLE_COLLECTION_TRAVERSE_END
 
 NS_IMPL_CYCLE_COLLECTION_UNLINK_BEGIN(nsPresContext)
@@ -395,8 +393,6 @@ NS_IMPL_CYCLE_COLLECTION_UNLINK_BEGIN(nsPresContext)
     tmp->mPrefChangedTimer->Cancel();
     tmp->mPrefChangedTimer = nsnull;
   }
-  if (tmp->mBidiUtils)
-    tmp->mBidiUtils->Unlink();
 NS_IMPL_CYCLE_COLLECTION_UNLINK_END
 
 
@@ -649,10 +645,6 @@ nsPresContext::GetUserPreferences()
     // get a presshell.
     return;
   }
-    
-  mFontScaler =
-    Preferences::GetInt("browser.display.base_font_scaler", mFontScaler);
-
 
   mAutoQualityMinFontSizePixelsPref =
     Preferences::GetInt("browser.display.auto_quality_min_font_size");
@@ -1465,15 +1457,6 @@ nsPresContext::SetBidiEnabled() const
   }
 }
 
-nsBidiPresUtils*
-nsPresContext::GetBidiUtils()
-{
-  if (!mBidiUtils)
-    mBidiUtils = new nsBidiPresUtils;
-
-  return mBidiUtils;
-}
-
 void
 nsPresContext::SetBidi(PRUint32 aSource, PRBool aForceRestyle)
 {
@@ -1516,15 +1499,6 @@ nsPresContext::GetBidi() const
   return Document()->GetBidiOptions();
 }
 
-PRUint32
-nsPresContext::GetBidiMemoryUsed()
-{
-  if (!mBidiUtils)
-    return 0;
-
-  return mBidiUtils->EstimateMemoryUsed();
-}
-
 #endif //IBMBIDI
 
 PRBool
diff --git a/layout/base/nsPresContext.h b/layout/base/nsPresContext.h
index 9e554dc5cdc8..eeb100f0b6a9 100644
--- a/layout/base/nsPresContext.h
+++ b/layout/base/nsPresContext.h
@@ -394,11 +394,6 @@ public:
     return PR_FALSE;
   }
 
-  /**
-   * Access Nav's magic font scaler value
-   */
-  PRInt32 FontScaler() const { return mFontScaler; }
-
   /** 
    * Get the default colors
    */
@@ -762,11 +757,6 @@ public:
 
 //Mohamed
 
-  /**
-   * Get a Bidi presentation utilities object
-   */
-  NS_HIDDEN_(nsBidiPresUtils*) GetBidiUtils();
-
   /**
    * Set the Bidi options for the presentation context
    */  
@@ -779,10 +769,6 @@ public:
    * include nsIDocument.
    */  
   NS_HIDDEN_(PRUint32) GetBidi() const;
-
-  PRUint32 GetBidiMemoryUsed();
-#else
-  PRUint32 GetBidiMemoryUsed() { return 0; }
 #endif // IBMBIDI
 
   /**
@@ -1015,7 +1001,6 @@ public:
     PRUint32 result = 0;
 
     result += sizeof(nsPresContext);
-    result += GetBidiMemoryUsed();
 
     return result;
   }
@@ -1105,10 +1090,6 @@ protected:
   PRInt32               mCurAppUnitsPerDevPixel;
   PRInt32               mAutoQualityMinFontSizePixelsPref;
 
-#ifdef IBMBIDI
-  nsAutoPtr<nsBidiPresUtils> mBidiUtils;
-#endif
-
   nsCOMPtr<nsITheme> mTheme;
   nsCOMPtr<nsILanguageAtomService> mLangService;
   nsCOMPtr<nsIPrintSettings> mPrintSettings;
diff --git a/layout/base/nsPresShell.cpp b/layout/base/nsPresShell.cpp
index 3f77fb43fb2f..e656735ac908 100644
--- a/layout/base/nsPresShell.cpp
+++ b/layout/base/nsPresShell.cpp
@@ -1434,15 +1434,6 @@ public:
     return PL_DHASH_NEXT;
   }
 
-  static PLDHashOperator LiveShellBidiSizeEnumerator(PresShellPtrKey *aEntry,
-                                                     void *userArg)
-  {
-    PresShell *aShell = static_cast<PresShell*>(aEntry->GetKey());
-    PRUint32 *val = (PRUint32*)userArg;
-    *val += aShell->mPresContext->GetBidiMemoryUsed();
-    return PL_DHASH_NEXT;
-  }
-
   static PRUint32
   EstimateShellsMemory(nsTHashtable<PresShellPtrKey>::Enumerator aEnumerator)
   {
@@ -1456,10 +1447,6 @@ public:
     return EstimateShellsMemory(LiveShellSizeEnumerator);
   }
 
-  static PRInt64 SizeOfBidiMemoryReporter() {
-    return EstimateShellsMemory(LiveShellBidiSizeEnumerator);
-  }
-
 protected:
   void QueryIsActive();
   nsresult UpdateImageLockingState();
@@ -1675,13 +1662,6 @@ NS_MEMORY_REPORTER_IMPLEMENT(LayoutPresShell,
     PresShell::SizeOfLayoutMemoryReporter,
     "Memory used by layout PresShell, PresContext, and other related areas.")
 
-NS_MEMORY_REPORTER_IMPLEMENT(LayoutBidi,
-    "explicit/layout/bidi",
-    KIND_HEAP,
-    UNITS_BYTES,
-    PresShell::SizeOfBidiMemoryReporter,
-    "Memory used by layout Bidi processor.")
-
 PresShell::PresShell()
   : mMouseLocation(NS_UNCONSTRAINEDSIZE, NS_UNCONSTRAINEDSIZE)
 {
@@ -1710,7 +1690,6 @@ PresShell::PresShell()
   static bool registeredReporter = false;
   if (!registeredReporter) {
     NS_RegisterMemoryReporter(new NS_MEMORY_REPORTER_NAME(LayoutPresShell));
-    NS_RegisterMemoryReporter(new NS_MEMORY_REPORTER_NAME(LayoutBidi));
     Preferences::AddBoolVarCache(&sSynthMouseMove,
                                  "layout.reflow.synthMouseMove", PR_TRUE);
     registeredReporter = true;
diff --git a/layout/forms/test/Makefile.in b/layout/forms/test/Makefile.in
index b7f050f2eeca..861300316153 100644
--- a/layout/forms/test/Makefile.in
+++ b/layout/forms/test/Makefile.in
@@ -83,6 +83,15 @@ _CHROME_FILES = \
 		test_bug536567.html \
 		$(NULL)
 
+ifeq (WINNT,$(OS_ARCH))
+$(warning test_bug665540.html disabled due to bug 670053)
+else
+_CHROME_FILES += \
+		test_bug665540.html \
+		     bug665540_window.xul \
+		$(NULL)
+endif
+
 libs:: $(_TEST_FILES)
 	$(INSTALL) $^ $(DEPTH)/_tests/testing/mochitest/tests/$(relativesrcdir)
 
diff --git a/layout/forms/test/bug665540_window.xul b/layout/forms/test/bug665540_window.xul
new file mode 100644
index 000000000000..7075adf458ef
--- /dev/null
+++ b/layout/forms/test/bug665540_window.xul
@@ -0,0 +1,20 @@
+<?xml version="1.0"?>
+<?xml-stylesheet href="chrome://global/skin" type="text/css"?>
+
+<window title="Test Select Dropdown Positioning in Fullscreen Window"
+        xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul"
+        sizemode="fullscreen">
+
+  <title><label>Test Select Dropdown Positioning in Fullscreen Window</label></title>
+
+  <script>
+    opener.SimpleTest.waitForFocus(opener.childFocused, window);
+  </script>
+
+  <body xmlns="http://www.w3.org/1999/xhtml">
+    <select id="select" style="-moz-appearance:none">
+      <option id="optiona">a</option>
+      <option>b</option>
+    </select>
+  </body>
+</window>
diff --git a/layout/forms/test/test_bug665540.html b/layout/forms/test/test_bug665540.html
new file mode 100644
index 000000000000..dabe56a5055c
--- /dev/null
+++ b/layout/forms/test/test_bug665540.html
@@ -0,0 +1,104 @@
+<!DOCTYPE HTML>
+<html>
+<!--
+https://bugzilla.mozilla.org/show_bug.cgi?id=665540
+-->
+<head>
+  <title>Test for Bug 665540 Select dropdown position in fullscreen window</title>
+  <script type="application/javascript" src="chrome://mochikit/content/MochiKit/packed.js"></script>
+  <script type="application/javascript" src="chrome://mochikit/content/tests/SimpleTest/SimpleTest.js"></script>
+  <script type="application/javascript" src="chrome://mochikit/content/tests/SimpleTest/EventUtils.js"></script>
+  <link rel="stylesheet" type="text/css" href="chrome://mochikit/content/tests/SimpleTest/test.css"/>
+</head>
+<body onload="openFullscreenWindow()">
+<a target="_blank" href="https://bugzilla.mozilla.org/show_bug.cgi?id=665540">Mozilla Bug 665540</a>
+<p id="display"></p>
+<div id="content" style="display: none">
+  
+</div>
+<pre id="test">
+<script type="application/javascript">
+
+/** Test for Bug 665540 **/
+
+SimpleTest.waitForExplicitFinish();
+
+var win;
+var optiona;
+var eventType = "mouseover";
+var timeoutID;
+var eventOffsetX = 2;
+var eventOffsetY = 2;
+
+function openFullscreenWindow() {
+    win = open("bug665540_window.xul", "_blank", "resizable=yes,chrome");
+    // Close our window if the test times out so that it doesn't interfere
+    // with later tests.
+    timeoutID = setTimeout(function () {
+        ok(false, "Test timed out.");
+        // Provide some time for a screenshot
+        setTimeout(finish, 1000);
+    }, 20000);
+}
+
+function childFocused() {
+    ok(win.fullScreen, "window should be fullscreen");
+    // bug 670026
+    ((navigator.platform.indexOf("Mac") < 0) ? is : todo_is)
+        (win.windowState, win.STATE_FULLSCREEN,
+         "window state should be fullscreen");
+
+    // The select doesn't open if the mouse click is fired too soon
+    // (on X11 at least).
+    setTimeout(openSelect, 1000);
+}
+
+function openSelect() {
+    var select = win.document.getElementById("select");
+    synthesizeMouseAtCenter(select, {}, win);
+    // A yield was required on X11 tinderbox machines.
+    // (Wasn't required on other platforms nor on an X11 system with kwin.)
+    setTimeout(checkPosition, 1000);
+}
+
+function checkPosition() {
+    optiona = win.document.getElementById("optiona");
+    optiona.addEventListener(eventType, eventReceived, false);
+
+    // If the select dropdown is opened in the position where
+    // getBoundingClientRect() predicts, then optiona will receive the event.
+    // The event is received asynchronously (I don't know why), so the handler
+    // is removed later.
+    synthesizeMouse(optiona, eventOffsetX, eventOffsetY,
+                    { type: eventType }, win);
+}
+
+function eventReceived(event) {
+    clearTimeout(timeoutID);
+    optiona.removeEventListener(eventType, eventReceived, false);
+
+    var rect = optiona.getBoundingClientRect();
+
+    // Note that fullscreen only fully covers one monitor, so win.screenX can
+    // be non-zero.
+    is(event.screenX, win.screenX + rect.left + eventOffsetX,
+       "event.screenX should match sent event");
+    is(event.screenY, win.screenY + rect.top + eventOffsetY,
+       "event.screenY should match sent event");
+
+    finish();
+}
+
+function finish() {
+    // bug 670026
+    ((navigator.platform.indexOf("Mac") < 0) ? is : todo_is)
+        (win.windowState, win.STATE_FULLSCREEN,
+         "window state should still be fullscreen");
+
+    win.close();
+    SimpleTest.finish();
+}
+</script>
+</pre>
+</body>
+</html>
diff --git a/layout/generic/TextOverflow.cpp b/layout/generic/TextOverflow.cpp
index 791ad3527a60..cda92080b288 100644
--- a/layout/generic/TextOverflow.cpp
+++ b/layout/generic/TextOverflow.cpp
@@ -556,10 +556,20 @@ TextOverflow::PruneDisplayListContents(nsDisplayList*        aList,
       nsRect rect = itemFrame->GetScrollableOverflowRect() +
                     itemFrame->GetOffsetTo(mBlock);
       if (mLeft.IsNeeded() && rect.x < aInsideMarkersArea.x) {
-        charClip->mLeftEdge = aInsideMarkersArea.x - rect.x;
+        nscoord left = aInsideMarkersArea.x - rect.x;
+        if (NS_UNLIKELY(left < 0)) {
+          item->~nsDisplayItem();
+          continue;
+        }
+        charClip->mLeftEdge = left;
       }
       if (mRight.IsNeeded() && rect.XMost() > aInsideMarkersArea.XMost()) {
-        charClip->mRightEdge = rect.XMost() - aInsideMarkersArea.XMost();
+        nscoord right = rect.XMost() - aInsideMarkersArea.XMost();
+        if (NS_UNLIKELY(right < 0)) {
+          item->~nsDisplayItem();
+          continue;
+        }
+        charClip->mRightEdge = right;
       }
     }
 
diff --git a/layout/generic/crashtests/crashtests.list b/layout/generic/crashtests/crashtests.list
index 8aa74fa2321b..a215bbafd609 100644
--- a/layout/generic/crashtests/crashtests.list
+++ b/layout/generic/crashtests/crashtests.list
@@ -364,4 +364,5 @@ load text-overflow-form-elements.html
 load text-overflow-iframe.html
 load text-overflow-bug666751-1.html
 load text-overflow-bug666751-2.html
+asserts(2) load text-overflow-bug670564.xhtml # asserts(2) for bug 436470
 load 667025.html
diff --git a/layout/generic/crashtests/text-overflow-bug670564.xhtml b/layout/generic/crashtests/text-overflow-bug670564.xhtml
new file mode 100644
index 000000000000..13ee83631e75
--- /dev/null
+++ b/layout/generic/crashtests/text-overflow-bug670564.xhtml
@@ -0,0 +1,3 @@
+<html xmlns="http://www.w3.org/1999/xhtml" style="position: relative; white-space: pre-line; direction: rtl; top: -85967203400px; text-overflow: ellipsis; text-indent: 5242870ch; padding: 224652170px; overflow-y: scroll; -moz-column-width: 74804px; letter-spacing: 687194767px;">
+
+</html>
diff --git a/layout/generic/nsBlockFrame.cpp b/layout/generic/nsBlockFrame.cpp
index 059ec06b1596..05435bdae9b8 100644
--- a/layout/generic/nsBlockFrame.cpp
+++ b/layout/generic/nsBlockFrame.cpp
@@ -4257,11 +4257,7 @@ nsBlockFrame::PlaceLine(nsBlockReflowState& aState,
   if (aState.mPresContext->BidiEnabled()) {
     if (!aState.mPresContext->IsVisualMode() ||
         GetStyleVisibility()->mDirection == NS_STYLE_DIRECTION_RTL) {
-      nsBidiPresUtils* bidiUtils = aState.mPresContext->GetBidiUtils();
-
-      if (bidiUtils && bidiUtils->IsSuccessful() ) {
-        bidiUtils->ReorderFrames(aLine->mFirstChild, aLine->GetChildCount());
-      } // bidiUtils
+      nsBidiPresUtils::ReorderFrames(aLine->mFirstChild, aLine->GetChildCount());
     } // not visual mode
   } // bidi enabled
 #endif // IBMBIDI
@@ -7220,11 +7216,7 @@ nsBlockFrame::ResolveBidi()
     return NS_OK;
   }
 
-  nsBidiPresUtils* bidiUtils = presContext->GetBidiUtils();
-  if (!bidiUtils)
-    return NS_ERROR_NULL_POINTER;
-
-  return bidiUtils->Resolve(this);
+  return nsBidiPresUtils::Resolve(this);
 }
 #endif
 
diff --git a/layout/generic/nsFrame.cpp b/layout/generic/nsFrame.cpp
index 1061e3391db2..17223acdbded 100644
--- a/layout/generic/nsFrame.cpp
+++ b/layout/generic/nsFrame.cpp
@@ -2609,8 +2609,8 @@ nsFrame::ExpandSelectionByMouseMove(nsFrameSelection* aFrameSelection,
 
   nsIScrollableFrame* scrollableFrame =
     FindNearestScrollableFrameForSelection(this, selectionRoot);
-  // If a non-scrollable content captures by script, we may not be able to find
-  // any scrollable frame.
+  // If a non-scrollable content captures by script and there is no scrollable
+  // frame between the selection root and this, we don't need to do anymore.
   if (!scrollableFrame) {
     return NS_OK;
   }
@@ -2619,8 +2619,8 @@ nsFrame::ExpandSelectionByMouseMove(nsFrameSelection* aFrameSelection,
 
   if (!handleTableSelection) {
     nsIScrollableFrame* selectionRootScrollableFrame =
-      FindNearestScrollableFrameForSelection(selectionRoot->GetPrimaryFrame());
-    NS_ENSURE_TRUE(selectionRootScrollableFrame, NS_OK);
+      FindNearestScrollableFrameForSelection(selectionRoot->GetPrimaryFrame(),
+                                             selectionRoot);
     while (scrollableFrame) {
       // We don't need to scroll the selection root frame when the mouse cursor
       // is on its edge because selection root frame will be scrolled when the
diff --git a/layout/generic/nsFrameList.cpp b/layout/generic/nsFrameList.cpp
index 9b9d4f531235..b3e1fa9a8843 100644
--- a/layout/generic/nsFrameList.cpp
+++ b/layout/generic/nsFrameList.cpp
@@ -448,7 +448,6 @@ nsFrameList::GetPrevVisualFor(nsIFrame* aFrame) const
     return aFrame ? aFrame->GetPrevSibling() : LastChild();
 
   nsBidiLevel baseLevel = nsBidiPresUtils::GetFrameBaseLevel(mFirstChild);  
-  nsBidiPresUtils* bidiUtils = mFirstChild->PresContext()->GetBidiUtils();
 
   nsAutoLineIterator iter = parent->GetLineIterator();
   if (!iter) { 
@@ -456,9 +455,9 @@ nsFrameList::GetPrevVisualFor(nsIFrame* aFrame) const
     if (parent->GetType() == nsGkAtoms::lineFrame) {
       // Line frames are not bidi-splittable, so need to consider bidi reordering
       if (baseLevel == NSBIDI_LTR) {
-        return bidiUtils->GetFrameToLeftOf(aFrame, mFirstChild, -1);
+        return nsBidiPresUtils::GetFrameToLeftOf(aFrame, mFirstChild, -1);
       } else { // RTL
-        return bidiUtils->GetFrameToRightOf(aFrame, mFirstChild, -1);
+        return nsBidiPresUtils::GetFrameToRightOf(aFrame, mFirstChild, -1);
       }
     } else {
       // Just get the next or prev sibling, depending on block and frame direction.
@@ -493,9 +492,9 @@ nsFrameList::GetPrevVisualFor(nsIFrame* aFrame) const
     iter->GetLine(thisLine, &firstFrameOnLine, &numFramesOnLine, lineBounds, &lineFlags);
 
     if (baseLevel == NSBIDI_LTR) {
-      frame = bidiUtils->GetFrameToLeftOf(aFrame, firstFrameOnLine, numFramesOnLine);
+      frame = nsBidiPresUtils::GetFrameToLeftOf(aFrame, firstFrameOnLine, numFramesOnLine);
     } else { // RTL
-      frame = bidiUtils->GetFrameToRightOf(aFrame, firstFrameOnLine, numFramesOnLine);
+      frame = nsBidiPresUtils::GetFrameToRightOf(aFrame, firstFrameOnLine, numFramesOnLine);
     }
   }
 
@@ -504,9 +503,9 @@ nsFrameList::GetPrevVisualFor(nsIFrame* aFrame) const
     iter->GetLine(thisLine - 1, &firstFrameOnLine, &numFramesOnLine, lineBounds, &lineFlags);
 
     if (baseLevel == NSBIDI_LTR) {
-      frame = bidiUtils->GetFrameToLeftOf(nsnull, firstFrameOnLine, numFramesOnLine);
+      frame = nsBidiPresUtils::GetFrameToLeftOf(nsnull, firstFrameOnLine, numFramesOnLine);
     } else { // RTL
-      frame = bidiUtils->GetFrameToRightOf(nsnull, firstFrameOnLine, numFramesOnLine);
+      frame = nsBidiPresUtils::GetFrameToRightOf(nsnull, firstFrameOnLine, numFramesOnLine);
     }
   }
   return frame;
@@ -523,7 +522,6 @@ nsFrameList::GetNextVisualFor(nsIFrame* aFrame) const
     return aFrame ? aFrame->GetPrevSibling() : mFirstChild;
 
   nsBidiLevel baseLevel = nsBidiPresUtils::GetFrameBaseLevel(mFirstChild);
-  nsBidiPresUtils* bidiUtils = mFirstChild->PresContext()->GetBidiUtils();
   
   nsAutoLineIterator iter = parent->GetLineIterator();
   if (!iter) { 
@@ -531,9 +529,9 @@ nsFrameList::GetNextVisualFor(nsIFrame* aFrame) const
     if (parent->GetType() == nsGkAtoms::lineFrame) {
       // Line frames are not bidi-splittable, so need to consider bidi reordering
       if (baseLevel == NSBIDI_LTR) {
-        return bidiUtils->GetFrameToRightOf(aFrame, mFirstChild, -1);
+        return nsBidiPresUtils::GetFrameToRightOf(aFrame, mFirstChild, -1);
       } else { // RTL
-        return bidiUtils->GetFrameToLeftOf(aFrame, mFirstChild, -1);
+        return nsBidiPresUtils::GetFrameToLeftOf(aFrame, mFirstChild, -1);
       }
     } else {
       // Just get the next or prev sibling, depending on block and frame direction.
@@ -568,9 +566,9 @@ nsFrameList::GetNextVisualFor(nsIFrame* aFrame) const
     iter->GetLine(thisLine, &firstFrameOnLine, &numFramesOnLine, lineBounds, &lineFlags);
     
     if (baseLevel == NSBIDI_LTR) {
-      frame = bidiUtils->GetFrameToRightOf(aFrame, firstFrameOnLine, numFramesOnLine);
+      frame = nsBidiPresUtils::GetFrameToRightOf(aFrame, firstFrameOnLine, numFramesOnLine);
     } else { // RTL
-      frame = bidiUtils->GetFrameToLeftOf(aFrame, firstFrameOnLine, numFramesOnLine);
+      frame = nsBidiPresUtils::GetFrameToLeftOf(aFrame, firstFrameOnLine, numFramesOnLine);
     }
   }
   
@@ -580,9 +578,9 @@ nsFrameList::GetNextVisualFor(nsIFrame* aFrame) const
     iter->GetLine(thisLine + 1, &firstFrameOnLine, &numFramesOnLine, lineBounds, &lineFlags);
     
     if (baseLevel == NSBIDI_LTR) {
-      frame = bidiUtils->GetFrameToRightOf(nsnull, firstFrameOnLine, numFramesOnLine);
+      frame = nsBidiPresUtils::GetFrameToRightOf(nsnull, firstFrameOnLine, numFramesOnLine);
     } else { // RTL
-      frame = bidiUtils->GetFrameToLeftOf(nsnull, firstFrameOnLine, numFramesOnLine);
+      frame = nsBidiPresUtils::GetFrameToLeftOf(nsnull, firstFrameOnLine, numFramesOnLine);
     }
   }
   return frame;
diff --git a/layout/generic/nsFrameSelection.h b/layout/generic/nsFrameSelection.h
index 245e99a2617e..5852e5e9a8bc 100644
--- a/layout/generic/nsFrameSelection.h
+++ b/layout/generic/nsFrameSelection.h
@@ -378,6 +378,11 @@ public:
     return sDraggingFrameSelection;
   }
 
+  /**
+   * Call AbortDragForSelection() when we abort handling the drag as selecting.
+   */
+  void AbortDragForSelection();
+
   /**
     if we are in table cell selection mode. aka ctrl click in table cell
    */
@@ -616,7 +621,11 @@ public:
 
   nsIPresShell *GetShell()const  { return mShell; }
 
-  void DisconnectFromPresShell() { StopAutoScrollTimer(); mShell = nsnull; }
+  void DisconnectFromPresShell()
+  {
+    AbortDragForSelection();
+    mShell = nsnull;
+  }
 private:
   nsresult TakeFocus(nsIContent *aNewFocus,
                      PRUint32 aContentOffset,
diff --git a/layout/generic/nsGfxScrollFrame.cpp b/layout/generic/nsGfxScrollFrame.cpp
index b8051e49c5b8..5f5915090e6c 100644
--- a/layout/generic/nsGfxScrollFrame.cpp
+++ b/layout/generic/nsGfxScrollFrame.cpp
@@ -56,7 +56,7 @@
 #include "nsIDocument.h"
 #include "nsBoxLayoutState.h"
 #include "nsINodeInfo.h"
-#include "nsIScrollbarFrame.h"
+#include "nsScrollbarFrame.h"
 #include "nsIScrollbarMediator.h"
 #include "nsITextControlFrame.h"
 #include "nsIDOMHTMLTextAreaElement.h"
@@ -3559,10 +3559,7 @@ nsGfxScrollFrameInner::GetActualScrollbarSizes() const
 void
 nsGfxScrollFrameInner::SetScrollbarVisibility(nsIBox* aScrollbar, PRBool aVisible)
 {
-  if (!aScrollbar)
-    return;
-
-  nsIScrollbarFrame* scrollbar = do_QueryFrame(aScrollbar);
+  nsScrollbarFrame* scrollbar = do_QueryFrame(aScrollbar);
   if (scrollbar) {
     // See if we have a mediator.
     nsIScrollbarMediator* mediator = scrollbar->GetScrollbarMediator();
diff --git a/layout/generic/nsIFrame.h b/layout/generic/nsIFrame.h
index a37c4dd7fc38..bafb97d73c48 100644
--- a/layout/generic/nsIFrame.h
+++ b/layout/generic/nsIFrame.h
@@ -91,7 +91,7 @@ class nsIWidget;
 class nsIDOMRange;
 class nsISelectionController;
 class nsBoxLayoutState;
-class nsIBoxLayout;
+class nsBoxLayout;
 class nsILineIterator;
 #ifdef ACCESSIBILITY
 class nsAccessible;
@@ -2594,8 +2594,8 @@ NS_PTR_TO_INT32(frame->Properties().Get(nsIFrame::EmbeddingLevelProperty()))
   NS_IMETHOD GetBorder(nsMargin& aBorder)=0;
   NS_IMETHOD GetPadding(nsMargin& aBorderAndPadding)=0;
   NS_IMETHOD GetMargin(nsMargin& aMargin)=0;
-  virtual void SetLayoutManager(nsIBoxLayout* aLayout) { }
-  virtual nsIBoxLayout* GetLayoutManager() { return nsnull; }
+  virtual void SetLayoutManager(nsBoxLayout* aLayout) { }
+  virtual nsBoxLayout* GetLayoutManager() { return nsnull; }
   NS_HIDDEN_(nsresult) GetClientRect(nsRect& aContentRect);
 
   // For nsSprocketLayout
diff --git a/layout/generic/nsImageFrame.cpp b/layout/generic/nsImageFrame.cpp
index 8cb3c249d940..be772bc21b2c 100644
--- a/layout/generic/nsImageFrame.cpp
+++ b/layout/generic/nsImageFrame.cpp
@@ -1003,21 +1003,17 @@ nsImageFrame::DisplayAltText(nsPresContext*      aPresContext,
     nsresult rv = NS_ERROR_FAILURE;
 
     if (aPresContext->BidiEnabled()) {
-      nsBidiPresUtils* bidiUtils =  aPresContext->GetBidiUtils();
-      
-      if (bidiUtils) {
-        const nsStyleVisibility* vis = GetStyleVisibility();
-        if (vis->mDirection == NS_STYLE_DIRECTION_RTL)
-          rv = bidiUtils->RenderText(str, maxFit, NSBIDI_RTL,
-                                     aPresContext, aRenderingContext,
-                                     aRenderingContext,
-                                     aRect.XMost() - strWidth, y + maxAscent);
-        else
-          rv = bidiUtils->RenderText(str, maxFit, NSBIDI_LTR,
-                                     aPresContext, aRenderingContext,
-                                     aRenderingContext,
-                                     aRect.x, y + maxAscent);
-      }
+      const nsStyleVisibility* vis = GetStyleVisibility();
+      if (vis->mDirection == NS_STYLE_DIRECTION_RTL)
+        rv = nsBidiPresUtils::RenderText(str, maxFit, NSBIDI_RTL,
+                                         aPresContext, aRenderingContext,
+                                         aRenderingContext,
+                                         aRect.XMost() - strWidth, y + maxAscent);
+      else
+        rv = nsBidiPresUtils::RenderText(str, maxFit, NSBIDI_LTR,
+                                         aPresContext, aRenderingContext,
+                                         aRenderingContext,
+                                         aRect.x, y + maxAscent);
     }
     if (NS_FAILED(rv))
       aRenderingContext.DrawString(str, maxFit, aRect.x, y + maxAscent);
diff --git a/layout/generic/nsLineBox.cpp b/layout/generic/nsLineBox.cpp
index ef6b92d4c1d4..0ccb8b0b23eb 100644
--- a/layout/generic/nsLineBox.cpp
+++ b/layout/generic/nsLineBox.cpp
@@ -656,11 +656,9 @@ nsLineIterator::CheckLineOrder(PRInt32                  aLine,
     return NS_OK;
   }
 
-  nsBidiPresUtils* bidiUtils = line->mFirstChild->PresContext()->GetBidiUtils();
-
   nsIFrame* leftmostFrame;
   nsIFrame* rightmostFrame;
-  *aIsReordered = bidiUtils->CheckLineOrder(line->mFirstChild, line->GetChildCount(), &leftmostFrame, &rightmostFrame);
+  *aIsReordered = nsBidiPresUtils::CheckLineOrder(line->mFirstChild, line->GetChildCount(), &leftmostFrame, &rightmostFrame);
 
   // map leftmost/rightmost to first/last according to paragraph direction
   *aFirstVisual = mRightToLeft ? rightmostFrame : leftmostFrame;
diff --git a/layout/generic/nsObjectFrame.cpp b/layout/generic/nsObjectFrame.cpp
index 8557546f9bd9..c2660fe08096 100644
--- a/layout/generic/nsObjectFrame.cpp
+++ b/layout/generic/nsObjectFrame.cpp
@@ -1559,9 +1559,14 @@ nsObjectFrame::GetLayerState(nsDisplayListBuilder* aBuilder,
     return LAYER_NONE;
 
 #ifdef XP_MACOSX
-  if (aManager && aManager->GetBackendType() ==
-      LayerManager::LAYERS_OPENGL && 
-      !mInstanceOwner->UseAsyncRendering() &&
+  // Layer painting not supported without OpenGL
+  if (aManager && aManager->GetBackendType() !=
+      LayerManager::LAYERS_OPENGL) {
+    return LAYER_NONE;
+  }
+
+  // Synchronous painting, but with (gecko) layers.
+  if (!mInstanceOwner->UseAsyncRendering() &&
       mInstanceOwner->IsRemoteDrawingCoreAnimation() &&
       mInstanceOwner->GetEventModel() == NPEventModelCocoa) {
     return LAYER_ACTIVE;
diff --git a/layout/generic/nsQueryFrame.h b/layout/generic/nsQueryFrame.h
index 58e5faca0f5d..244e3524c366 100644
--- a/layout/generic/nsQueryFrame.h
+++ b/layout/generic/nsQueryFrame.h
@@ -125,7 +125,6 @@ public:
     nsISVGGlyphFragmentNode_id,
     nsISVGSVGFrame_id,
     nsIScrollableFrame_id,
-    nsIScrollbarFrame_id,
     nsIScrollbarMediator_id,
     nsISelectControlFrame_id,
     nsIStatefulFrame_id,
diff --git a/layout/generic/nsSelection.cpp b/layout/generic/nsSelection.cpp
index ba07eca956bb..6a0307823215 100644
--- a/layout/generic/nsSelection.cpp
+++ b/layout/generic/nsSelection.cpp
@@ -1927,15 +1927,33 @@ nsFrameSelection::SetMouseDownState(PRBool aState)
   mMouseDownState = aState;
 
   if (mMouseDownState) {
+    if (sDraggingFrameSelection) {
+      sDraggingFrameSelection->AbortDragForSelection();
+    }
     sDraggingFrameSelection = this;
   } else {
-    sDraggingFrameSelection = nsnull;
+    if (sDraggingFrameSelection == this) {
+      sDraggingFrameSelection = nsnull;
+    }
     mDragSelectingCells = PR_FALSE;
     PostReason(nsISelectionListener::MOUSEUP_REASON);
     NotifySelectionListeners(nsISelectionController::SELECTION_NORMAL); //notify that reason is mouse up please.
   }
 }
 
+void
+nsFrameSelection::AbortDragForSelection()
+{
+  if (sDraggingFrameSelection == this) {
+    sDraggingFrameSelection = nsnull;
+    mMouseDownState = PR_FALSE;
+    mDragSelectingCells = PR_FALSE;
+    PostReason(nsISelectionListener::NO_REASON);
+    NotifySelectionListeners(nsISelectionController::SELECTION_NORMAL);
+  }
+  StopAutoScrollTimer();
+}
+
 nsISelection*
 nsFrameSelection::GetSelection(SelectionType aType) const
 {
diff --git a/layout/generic/nsTextFrameThebes.cpp b/layout/generic/nsTextFrameThebes.cpp
index 7cfb4746ba61..281a26683520 100644
--- a/layout/generic/nsTextFrameThebes.cpp
+++ b/layout/generic/nsTextFrameThebes.cpp
@@ -106,7 +106,6 @@
 #endif
 #include "nsAutoPtr.h"
 
-#include "nsBidiPresUtils.h"
 #include "nsBidiUtils.h"
 
 #include "gfxFont.h"
@@ -132,7 +131,7 @@ using namespace mozilla::dom;
 
 struct TabWidth {
   TabWidth(PRUint32 aOffset, PRUint32 aWidth)
-    : mOffset(aOffset), mWidth(aWidth)
+    : mOffset(aOffset), mWidth(float(aWidth))
   { }
 
   PRUint32 mOffset; // character offset within the text covered by the
@@ -2750,7 +2749,7 @@ ComputeTabWidthAppUnits(nsIFrame* aFrame, gfxTextRun* aTextRun)
   // Round the space width when converting to appunits the same way
   // textruns do
   gfxFloat spaceWidthAppUnits =
-    NS_roundf(GetFirstFontMetrics(
+    NS_round(GetFirstFontMetrics(
                 GetFontGroupForFrame(aFrame)).spaceWidth *
               aTextRun->GetAppUnitsPerDevUnit());
   return textStyle->mTabSize * spaceWidthAppUnits;
@@ -2830,8 +2829,8 @@ PropertyProvider::CalcTabWidths(PRUint32 aStart, PRUint32 aLength)
         }
         double nextTab = AdvanceToNextTab(mOffsetFromBlockOriginForTabs,
                 mFrame, mTextRun, &tabWidth);
-        mTabWidths->mWidths.AppendElement(
-          TabWidth(i - startOffset, nextTab - mOffsetFromBlockOriginForTabs));
+        mTabWidths->mWidths.AppendElement(TabWidth(i - startOffset, 
+                NSToIntRound(nextTab - mOffsetFromBlockOriginForTabs)));
         mOffsetFromBlockOriginForTabs = nextTab;
       }
 
@@ -4418,7 +4417,7 @@ nsTextFrame::PaintTextDecorations(
   gfxFloat app = aTextPaintStyle.PresContext()->AppUnitsPerDevPixel();
 
   // XXX aFramePt is in AppUnits, shouldn't it be nsFloatPoint?
-  nscoord x = aFramePt.x;
+  nscoord x = NSToCoordRound(aFramePt.x);
   nscoord width = GetRect().width;
   aClipEdges.Intersect(&x, &width);
   gfxPoint pt(x / app, (aTextBaselinePt.y - mAscent) / app);
@@ -4798,8 +4797,10 @@ nsTextFrame::PaintOneShadow(PRUint32 aOffset, PRUint32 aLength,
   // that much in order to make the origin the top-left corner of the text bounding box.
   gfxRect shadowGfxRect = shadowMetrics.mBoundingBox +
     gfxPoint(aFramePt.x + aLeftSideOffset, aTextBaselinePt.y) + shadowOffset;
-  nsRect shadowRect(shadowGfxRect.X(), shadowGfxRect.Y(),
-                    shadowGfxRect.Width(), shadowGfxRect.Height());
+  nsRect shadowRect(NSToCoordRound(shadowGfxRect.X()),
+                    NSToCoordRound(shadowGfxRect.Y()),
+                    NSToCoordRound(shadowGfxRect.Width()),
+                    NSToCoordRound(shadowGfxRect.Height()));
 
   nsContextBoxBlur contextBoxBlur;
   gfxContext* shadowContext = contextBoxBlur.Init(shadowRect, 0, blurRadius,
@@ -6307,7 +6308,8 @@ nsTextFrame::AddInlineMinWidthForFlow(nsRenderingContext *aRenderingContext,
       } else if (i < flowEndInTextRun && hyphBreakBefore &&
                  hyphBreakBefore[i - start])
       {
-        aData->OptionallyBreak(aRenderingContext, provider.GetHyphenWidth());
+        aData->OptionallyBreak(aRenderingContext, 
+                               NSToCoordRound(provider.GetHyphenWidth()));
       } {
         aData->OptionallyBreak(aRenderingContext);
       }
diff --git a/layout/generic/test/Makefile.in b/layout/generic/test/Makefile.in
index 18f8f89a9912..742e7ca4ce42 100644
--- a/layout/generic/test/Makefile.in
+++ b/layout/generic/test/Makefile.in
@@ -137,6 +137,7 @@ _CHROME_FILES = \
   file_bug514732_window.xul \
   test_selection_scrolling.html \
   window_selection_scrolling.html \
+  test_bug670058.html \
   $(NULL)
 
 libs:: $(_TEST_FILES)
diff --git a/layout/generic/test/test_bug670058.html b/layout/generic/test/test_bug670058.html
new file mode 100644
index 000000000000..04e9f419f681
--- /dev/null
+++ b/layout/generic/test/test_bug670058.html
@@ -0,0 +1,52 @@
+<!DOCTYPE>
+<html>
+<head>
+<title>test for bug 670058</title>
+<script type="text/javascript"
+  src="chrome://mochikit/content/MochiKit/packed.js"></script>
+<script type="text/javascript"
+  src="chrome://mochikit/content/tests/SimpleTest/SimpleTest.js"></script>
+<script type="text/javascript"
+  src="chrome://mochikit/content/tests/SimpleTest/EventUtils.js"></script>
+<link rel="stylesheet" type="text/css"
+  href="chrome://mochikit/content/tests/SimpleTest/test.css" />
+</head>
+<body>
+<textarea id="textarea" style="width: 200px; height: 100px;"></textarea>
+<pre id="test">
+<script class="testbody" type="text/javascript">
+SimpleTest.waitForExplicitFinish();
+
+var textarea = document.getElementById('textarea');
+
+var x = 50;
+var y = 50;
+
+var timer = 0;
+
+function doTest() {
+  synthesizeMouse(textarea, x, y, { type: "mousedown" });
+
+  timer = setInterval(function()
+    {
+      if (textarea.style.display == 'block') {
+        synthesizeMouse(textarea, x++, y++, { type: "mousemove" });
+        textarea.style.display = '';
+      } else {
+        textarea.style.display = 'block';
+        synthesizeMouse(textarea, x++, y++, { type: "mousemove" });
+      }
+      if (x == 70) {
+        ok(true, "not crashed");
+        clearInterval(timer);
+        SimpleTest.finish();
+      }
+    }, 200);
+}
+
+SimpleTest.waitForFocus(doTest, window);
+
+</script>
+</pre>
+</body>
+</html>
diff --git a/layout/generic/test/window_selection_scrolling.html b/layout/generic/test/window_selection_scrolling.html
index 96c9c3450a15..f4d6bb7218d7 100644
--- a/layout/generic/test/window_selection_scrolling.html
+++ b/layout/generic/test/window_selection_scrolling.html
@@ -94,6 +94,7 @@
 
 var body = document.body;
 
+var div_container = document.getElementById("container");
 var div_fixed = document.getElementById("fixed");
 var div_subframe1 = document.getElementById("static_overflow");
 var div_subframe2 = document.getElementById("static_overflow_inner");
@@ -690,6 +691,71 @@ var gTests = [
     scrollIsExpected: true,
   },
 
+  // Scroll subframe1 on its edge when container (non-scrollable element) is
+  // capturing mouse events
+  //   visible scrollable elements: body, div_subframe1
+  {
+    description: "The scrollable div element (subframe1) should be scrolled by moving mouse from subframe1 to the right edge of the div element (container is capturing mouse events)",
+    prepare: function () {
+      div_subframe1.style.display = "block";
+      div_subframe1.onmousedown = function () { div_container.setCapture(); }
+    },
+    test: function () {
+      synthesizeMouse(div_subframe1, 50, 50, { type: "mousedown" });
+      synthesizeMouse(div_subframe1, div_subframe1.clientWidth - 10, 50,
+                      { type: "mousemove" });
+      return true;
+    },
+    resetAllElementsBeforeTest: true,
+    testTarget: function () { return div_subframe1; },
+    expectedScrollTop: function () { return 0; },
+    expectedScrollLeft: function () { return getScrollRightMost(div_subframe1); },
+    scrollIsExpected: true,
+  },
+
+  {
+    description: "The scrollable div element (subframe1) should be scrolled by moving mouse from subframe1 to the left edge of the div element (container is capturing mouse events)",
+    test: function () {
+      synthesizeMouse(div_subframe1, 50, 50, { type: "mousedown" });
+      synthesizeMouse(div_subframe1, 10, 50, { type: "mousemove" });
+      return true;
+    },
+    resetAllElementsBeforeTest: false,
+    testTarget: function () { return div_subframe1; },
+    expectedScrollTop: function () { return 0; },
+    expectedScrollLeft: function () { return 0; },
+    scrollIsExpected: true,
+  },
+
+  {
+    description: "The scrollable div element (subframe1) should be scrolled by moving mouse from subframe1 to the bottom edge of the div element (container is capturing mouse events)",
+    test: function () {
+      synthesizeMouse(div_subframe1, 50, 50, { type: "mousedown" });
+      synthesizeMouse(div_subframe1, 50, div_subframe1.clientHeight - 10,
+                      { type: "mousemove" });
+      return true;
+    },
+    resetAllElementsBeforeTest: false,
+    testTarget: function () { return div_subframe1; },
+    expectedScrollTop: function () { return getScrollBottomMost(div_subframe1); },
+    expectedScrollLeft: function () { return 0; },
+    scrollIsExpected: true,
+  },
+
+  {
+    description: "The scrollable div element (subframe1) should be scrolled by moving mouse from subframe1 to the top edge of the div element (container is capturing mouse events)",
+    test: function () {
+      synthesizeMouse(div_subframe1, 50, 50, { type: "mousedown" });
+      synthesizeMouse(div_subframe1, 50, 10, { type: "mousemove" });
+      return true;
+    },
+    resetAllElementsBeforeTest: false,
+    testTarget: function () { return div_subframe1; },
+    expectedScrollTop: function () { return 0; },
+    expectedScrollLeft: function () { return 0; },
+    scrollIsExpected: true,
+  },
+
   // Scroll subframe1 even if subframe2 is moved under the cursor
   //   visible scrollable elements: body, div_subframe1, div_subframe2
   {
diff --git a/layout/mathml/nsMathMLFrame.cpp b/layout/mathml/nsMathMLFrame.cpp
index 3861a90381b7..88893bfb0e16 100644
--- a/layout/mathml/nsMathMLFrame.cpp
+++ b/layout/mathml/nsMathMLFrame.cpp
@@ -62,14 +62,15 @@ nsMathMLFrame::GetMathMLFrameType()
   return eMathMLFrameType_Ordinary;  
 }
 
-// snippet of code used by <mstyle> and <mtable>, which are the only
-// two tags where the displaystyle attribute is allowed by the spec.
+// snippet of code used by <mstyle>, <mtable> and <math> which are the only
+// three tags where the displaystyle attribute is allowed by the spec.
 /* static */ void
 nsMathMLFrame::FindAttrDisplaystyle(nsIContent*         aContent,
                                     nsPresentationData& aPresentationData)
 {
   NS_ASSERTION(aContent->Tag() == nsGkAtoms::mstyle_ ||
-               aContent->Tag() == nsGkAtoms::mtable_, "bad caller");
+               aContent->Tag() == nsGkAtoms::mtable_ ||
+               aContent->Tag() == nsGkAtoms::math, "bad caller");
   static nsIContent::AttrValuesArray strings[] =
     {&nsGkAtoms::_false, &nsGkAtoms::_true, nsnull};
   // see if the explicit displaystyle attribute is there
@@ -219,6 +220,7 @@ nsMathMLFrame::GetPresentationDataFrom(nsIFrame*           aFrame,
       if (display->mDisplay == NS_STYLE_DISPLAY_BLOCK) {
         aPresentationData.flags |= NS_MATHML_DISPLAYSTYLE;
       }
+      FindAttrDisplaystyle(content, aPresentationData);
       aPresentationData.mstyle = frame->GetFirstContinuation();
       break;
     }
diff --git a/layout/mathml/nsMathMLmfencedFrame.cpp b/layout/mathml/nsMathMLmfencedFrame.cpp
index 4cb730fca643..721953731d15 100644
--- a/layout/mathml/nsMathMLmfencedFrame.cpp
+++ b/layout/mathml/nsMathMLmfencedFrame.cpp
@@ -24,6 +24,7 @@
  *   David J. Fiddes <D.J.Fiddes@hw.ac.uk>
  *   Pierre Phaneuf <pp@ludusdesign.com>
  *   Frederic Wang <fred.wang@free.fr>
+ *   Florian Scholz <elchi3@elchi3.de>
  *
  * Alternatively, the contents of this file may be used under the terms of
  * either of the GNU General Public License Version 2 or later (the "GPL"),
@@ -351,12 +352,10 @@ nsMathMLmfencedFrame::Reflow(nsPresContext*          aPresContext,
   // adjust the origin of children.
 
   // we need to center around the axis
-  if (firstChild) { // do nothing for an empty <mfenced></mfenced>
-    nscoord delta = NS_MAX(containerSize.ascent - axisHeight, 
-                           containerSize.descent + axisHeight);
-    containerSize.ascent = delta + axisHeight;
-    containerSize.descent = delta - axisHeight;
-  }
+  nscoord delta = NS_MAX(containerSize.ascent - axisHeight, 
+                         containerSize.descent + axisHeight);
+  containerSize.ascent = delta + axisHeight;
+  containerSize.descent = delta - axisHeight;
 
   /////////////////
   // opening fence ...
diff --git a/layout/reftests/bidi/670226-1-ref.html b/layout/reftests/bidi/670226-1-ref.html
new file mode 100644
index 000000000000..ef15ed7495f7
--- /dev/null
+++ b/layout/reftests/bidi/670226-1-ref.html
@@ -0,0 +1,14 @@
+<!DOCTYPE html>
+<html>
+ <head>
+  <title>Bug 670226</title>
+  <style type="text/css">
+   pre:first-letter { float:left; color: lime}
+   pre { font-size: 16pt }
+  </style>
+ </head>
+ <body>
+  <pre dir="rtl">a+b
+c</pre>
+ </body>
+</html>
diff --git a/layout/reftests/bidi/670226-1.html b/layout/reftests/bidi/670226-1.html
new file mode 100644
index 000000000000..bd230a7a931e
--- /dev/null
+++ b/layout/reftests/bidi/670226-1.html
@@ -0,0 +1,20 @@
+<!DOCTYPE html>
+<html>
+ <head>
+  <title>Bug 670226</title>
+  <style type="text/css">
+   pre:first-letter { float:left; color: lime}
+  </style>
+  <script type="text/javascript">
+function boom()
+{
+  var p = document.getElementById("p");
+  p.style.fontSize="16pt";
+}
+ </script>
+ </head>
+ <body onload="boom()">
+  <pre id="p" dir="rtl">a+b
+c</pre>
+ </body>
+</html>
diff --git a/layout/reftests/bidi/reftest.list b/layout/reftests/bidi/reftest.list
index e33bab48aeee..458465368d2b 100644
--- a/layout/reftests/bidi/reftest.list
+++ b/layout/reftests/bidi/reftest.list
@@ -82,3 +82,4 @@ fails-if(Android) == 386339.html 386339-ref.html
 == 612843-1.html 612843-1-ref.html
 == 613157-1.html 613157-1-ref.html
 == 613157-2.html 613157-2-ref.html
+== 670226-1.html 670226-1-ref.html
diff --git a/layout/reftests/bugs/579323-1-ref.html b/layout/reftests/bugs/579323-1-ref.html
index 2262baef0078..ff931c3c3ba7 100644
--- a/layout/reftests/bugs/579323-1-ref.html
+++ b/layout/reftests/bugs/579323-1-ref.html
@@ -2,12 +2,11 @@
 <html>
 <head>
 <style>
-body {
-  width: 500px;
-}
 div {
+  width: 500px;
   height: 100px;
-  opacity: 0.5;
+  opacity: 0.999;
+  background: lime;
   border: 1px solid black;
 }
 </style>
diff --git a/layout/reftests/bugs/579323-1.html b/layout/reftests/bugs/579323-1.html
index 2b260ca0ac97..ceb0bc5ab864 100644
--- a/layout/reftests/bugs/579323-1.html
+++ b/layout/reftests/bugs/579323-1.html
@@ -9,20 +9,22 @@ body {
 }
 canvas {
   -moz-box-flex: 1;
-  height: 100px;
-  opacity: 0.5;
+  opacity: 0.999;
   border: 1px solid black;
 }
 </style>
+</head>
+<body>
+<canvas id="c" width="100" height="100"></canvas>
 <script>
+var ctx = document.getElementById("c").getContext('2d');
+ctx.fillStyle = "lime";
+ctx.fillRect(0, 0, 100, 100);
 function doTest() {
-  document.body.style.width = "500px";
+  document.body.style.width = "502px";
   document.documentElement.removeAttribute("class");
 }
 window.addEventListener("MozReftestInvalidate", doTest, false);
 </script>
-</head>
-<body>
-<canvas></canvas>
 </body>
 </html>
diff --git a/layout/reftests/bugs/670442-1-ref.html b/layout/reftests/bugs/670442-1-ref.html
new file mode 100644
index 000000000000..6766643a2d7d
--- /dev/null
+++ b/layout/reftests/bugs/670442-1-ref.html
@@ -0,0 +1,40 @@
+<!DOCTYPE html>
+<html>
+  <body>
+    <div>
+      <canvas id="c1" width="400" height="400"></canvas>
+      <canvas id="c2" width="400" height="400"></canvas>
+    </div>
+    <script type="text/javascript">
+      var canv1 = document.getElementById('c1');
+      var canv2 = document.getElementById('c2');
+      var ctx1 = canv1.getContext('2d');
+      var ctx2 = canv2.getContext('2d');
+    
+      ctx1.strokeStyle = '#FF0000';
+      ctx1.moveTo(10, 10);
+      ctx1.lineTo(390, 390);
+      ctx1.stroke();
+    
+      function doTest()
+      {
+        // Save img data
+        var imgData = ctx1.getImageData(0, 0, canv1.width, canv1.height);
+        
+        // Resize canvas - seems to cause the bug
+        canv1.width  = 0;
+        canv1.height = 0;
+        canv1.width  = 400;
+        canv1.height = 400;
+        
+        // Put image data from ctx1 to ctx2
+        ctx2.putImageData(imgData, 0, 0);
+        
+        // Draw canvas2 on canvas1
+        ctx1.drawImage(canv2, 0, 0);
+      };
+
+      doTest();
+    </script>
+  </body>
+</html>
diff --git a/layout/reftests/bugs/670442-1.html b/layout/reftests/bugs/670442-1.html
new file mode 100644
index 000000000000..3823cd2ff0bf
--- /dev/null
+++ b/layout/reftests/bugs/670442-1.html
@@ -0,0 +1,41 @@
+<!DOCTYPE html>
+<html>
+  <body>
+    <div>
+      <canvas id="c1" width="400" height="400"></canvas>
+      <canvas id="c2" width="400" height="400"></canvas>
+    </div>
+    <script type="text/javascript">
+      var canv1 = document.getElementById('c1');
+      var canv2 = document.getElementById('c2');
+      var ctx1 = canv1.getContext('2d');
+      var ctx2 = canv2.getContext('2d');
+    
+      ctx1.strokeStyle = '#FF0000';
+      ctx1.moveTo(10, 10);
+      ctx1.lineTo(390, 390);
+      ctx1.stroke();
+    
+      function doTest()
+      {
+        // Save img data
+        var imgData = ctx1.getImageData(0, 0, canv1.width, canv1.height);
+        
+        // Resize canvas - seems to cause the bug
+        canv1.width  = 0;
+        canv1.height = 0;
+        canv1.width  = 400;
+        canv1.height = 400;
+        
+        // Put image data from ctx1 to ctx2
+        ctx2.putImageData(imgData, 0, 0);
+        
+        // Draw canvas2 on canvas1
+        ctx1.drawImage(canv2, 0, 0);
+      };
+
+      doTest();
+      doTest();
+    </script>
+  </body>
+</html>
diff --git a/layout/reftests/bugs/reftest.list b/layout/reftests/bugs/reftest.list
index aa3c3567c385..80d4f6595ffa 100644
--- a/layout/reftests/bugs/reftest.list
+++ b/layout/reftests/bugs/reftest.list
@@ -1545,7 +1545,7 @@ random-if(!winWidget) == 574907-2.html 574907-2-ref.html
 random-if(!winWidget) fails-if(winWidget&&!d2d) random-if(winWidget&&d2d) != 574907-3.html 574907-3-notref.html
 == 577838-1.html 577838-1-ref.html
 == 577838-2.html 577838-2-ref.html
-fails-if(Android) random-if(layersGPUAccelerated) == 579323-1.html 579323-1-ref.html
+== 579323-1.html 579323-1-ref.html
 == 579349-1.html 579349-1-ref.html
 == 579655-1.html 579655-1-ref.html
 fails-if(Android) == 579808-1.html 579808-1-ref.html
@@ -1651,3 +1651,4 @@ fails-if(layersGPUAccelerated&&cocoaWidget) == 654950-1.html 654950-1-ref.html #
 == 660682-1.html 660682-1-ref.html
 != 669015-1.xul 669015-1-notref.xul
 == 668319-1.xul about:blank
+== 670442-1.html 670442-1-ref.html
diff --git a/layout/reftests/font-face/name-collision-with-prefs-font-ref.html b/layout/reftests/font-face/name-collision-with-prefs-font-ref.html
new file mode 100644
index 000000000000..b1d522f51eb5
--- /dev/null
+++ b/layout/reftests/font-face/name-collision-with-prefs-font-ref.html
@@ -0,0 +1,29 @@
+<!DOCTYPE HTML>
+<html>
+<head>
+<title>Bug 668758 - @font-face disrupts font preferences</title>
+<meta http-equiv="Content-Type" content="text/html; charset=utf-8" />
+
+<style type="text/css">
+
+body {
+  margin: 50px;
+  font-family: serif;
+}
+
+</style>
+
+</head>
+
+<body>
+
+<p>
+This should be rendered using the default serif font.
+</p>
+
+<pre>
+And this is preformatted text that ought to be monospaced.
+</pre>
+
+</body>
+</html>
diff --git a/layout/reftests/font-face/name-collision-with-prefs-font.html b/layout/reftests/font-face/name-collision-with-prefs-font.html
new file mode 100644
index 000000000000..0f90870dea3a
--- /dev/null
+++ b/layout/reftests/font-face/name-collision-with-prefs-font.html
@@ -0,0 +1,65 @@
+<!DOCTYPE HTML>
+<html>
+<head>
+<title>Bug 668758 - @font-face disrupts font preferences</title>
+<meta http-equiv="Content-Type" content="text/html; charset=utf-8" />
+
+<style type="text/css">
+
+/* none of these @font-face declarations should affect the rendering! */
+@font-face {
+  font-family: Times;
+  src: url(../fonts/mplus/mplus-1p-black.ttf);
+}
+
+@font-face {
+  font-family: Times New Roman;
+  src: url(../fonts/mplus/mplus-1p-black.ttf);
+}
+
+@font-face {
+  font-family: Tms Rmn;
+  src: url(../fonts/mplus/mplus-1p-black.ttf);
+}
+
+@font-face {
+  font-family: Droid Serif;
+  src: url(../fonts/mplus/mplus-1p-black.ttf);
+}
+
+@font-face {
+  font-family: Courier;
+  src: url(../fonts/mplus/mplus-1p-black.ttf);
+}
+
+@font-face {
+  font-family: Courier New;
+  src: url(../fonts/mplus/mplus-1p-black.ttf);
+}
+
+@font-face {
+  font-family: Droid Sans Mono;
+  src: url(../fonts/mplus/mplus-1p-black.ttf);
+}
+
+body {
+  margin: 50px;
+  font-family: serif;
+}
+
+</style>
+
+</head>
+
+<body>
+
+<p>
+This should be rendered using the default serif font.
+</p>
+
+<pre>
+And this is preformatted text that ought to be monospaced.
+</pre>
+
+</body>
+</html>
diff --git a/layout/reftests/font-face/reftest.list b/layout/reftests/font-face/reftest.list
index 962a49407c85..b4a9d9f6ea65 100644
--- a/layout/reftests/font-face/reftest.list
+++ b/layout/reftests/font-face/reftest.list
@@ -99,6 +99,8 @@ HTTP(..) == load-badchecksum.html load-badchecksum-ref.html
 HTTP(..) == name-collision.html name-collision-ref.html
 HTTP(..) == name-collision-bad-url.html name-collision-bad-url-ref.html
 
+HTTP(..) == name-collision-with-prefs-font.html name-collision-with-prefs-font-ref.html # bug 668758
+
 # t2embed lib on windows is picky about fullname
 HTTP(..) == load-badfullname.html load-badfullname-ref.html
 
diff --git a/layout/reftests/mathml/math-display-ref.html b/layout/reftests/mathml/math-display-ref.html
new file mode 100644
index 000000000000..0716ec87854d
--- /dev/null
+++ b/layout/reftests/mathml/math-display-ref.html
@@ -0,0 +1,13 @@
+<html>
+  <body>
+    <math>
+      <mstyle displaystyle="true">
+	<munderover>
+	  <mo>&sum;</mo>
+	  <mi>b</mi>
+	  <mi>c</mi>
+	</munderover>
+      </mstyle>
+    </math>
+  </body>
+</html>
diff --git a/layout/reftests/mathml/math-display.html b/layout/reftests/mathml/math-display.html
new file mode 100644
index 000000000000..d464a95cba2a
--- /dev/null
+++ b/layout/reftests/mathml/math-display.html
@@ -0,0 +1,11 @@
+<html>
+  <body>
+    <math displaystyle="true">
+      <munderover>
+	<mo>&sum;</mo>
+	<mi>b</mi>
+	<mi>c</mi>
+      </munderover>
+    </math>
+  </body>
+</html>
diff --git a/layout/reftests/mathml/mfenced-10-ref.html b/layout/reftests/mathml/mfenced-10-ref.html
new file mode 100644
index 000000000000..de7a76788ee5
--- /dev/null
+++ b/layout/reftests/mathml/mfenced-10-ref.html
@@ -0,0 +1,29 @@
+<!DOCTYPE HTML>
+<html>
+  <body>
+
+    <!-- Stretchy fences -->
+
+    <math>
+      <mrow>
+
+        <mo form="prefix" fence="true" stretchy="true">(</mo> 
+ 
+        <mtable>
+          <mtr>
+            <mtd><mi>a</mi></mtd>
+            <mtd><mi>b</mi></mtd>
+          </mtr>
+          <mtr>
+            <mtd><mi>c</mi></mtd>
+            <mtd><mi>d</mi></mtd>
+          </mtr>
+        </mtable>
+
+        <mo form="postfix" fence="true" stretchy="true">)</mo> 
+
+      </mrow>
+    </math>
+
+  </body>
+</html>
diff --git a/layout/reftests/mathml/mfenced-10.html b/layout/reftests/mathml/mfenced-10.html
new file mode 100644
index 000000000000..b778b5c6f43d
--- /dev/null
+++ b/layout/reftests/mathml/mfenced-10.html
@@ -0,0 +1,23 @@
+<!DOCTYPE HTML>
+<html>
+  <body>
+
+    <!-- Stretchy fences -->
+
+    <math>
+      <mfenced> 
+        <mtable>
+          <mtr>
+            <mtd><mi>a</mi></mtd>
+            <mtd><mi>b</mi></mtd>
+          </mtr>
+          <mtr>
+            <mtd><mi>c</mi></mtd>
+            <mtd><mi>d</mi></mtd>
+          </mtr>
+        </mtable>
+      </mfenced>
+    </math>
+
+  </body>
+</html>
diff --git a/layout/reftests/mathml/mfenced-6-ref.html b/layout/reftests/mathml/mfenced-6-ref.html
new file mode 100644
index 000000000000..d4cbaeb4d309
--- /dev/null
+++ b/layout/reftests/mathml/mfenced-6-ref.html
@@ -0,0 +1,28 @@
+<!DOCTYPE HTML>
+<html>
+  <body>
+
+    <!-- Too many separators: Excess is ignored -->
+    <math>
+      <mfenced separators=";;;;">
+        <mi>a</mi> 
+        <mi>b</mi> 
+        <mi>c</mi> 
+        <mi>d</mi> 
+        <mi>e</mi>  
+      </mfenced>
+    </math>
+    
+    <!-- Too few separators: Last separator is repeated -->
+    <math>
+      <mfenced separators=";;,,">
+        <mi>a</mi> 
+        <mi>b</mi> 
+        <mi>c</mi> 
+        <mi>d</mi> 
+        <mi>e</mi>  
+      </mfenced>
+    </math>
+
+  </body>
+</html>
diff --git a/layout/reftests/mathml/mfenced-6.html b/layout/reftests/mathml/mfenced-6.html
new file mode 100644
index 000000000000..54a784e3ec80
--- /dev/null
+++ b/layout/reftests/mathml/mfenced-6.html
@@ -0,0 +1,28 @@
+<!DOCTYPE HTML>
+<html>
+  <body>
+
+    <!-- Too many separators: Excess is ignored -->
+    <math>
+      <mfenced separators=";;;;,,,,">
+        <mi>a</mi> 
+        <mi>b</mi> 
+        <mi>c</mi> 
+        <mi>d</mi> 
+        <mi>e</mi>  
+      </mfenced>
+    </math>
+    
+    <!-- Too few separators: Last separator is repeated -->
+    <math>
+      <mfenced separators=";;,">
+        <mi>a</mi> 
+        <mi>b</mi> 
+        <mi>c</mi> 
+        <mi>d</mi> 
+        <mi>e</mi>  
+      </mfenced>
+    </math>
+
+  </body>
+</html>
diff --git a/layout/reftests/mathml/mfenced-7-ref.html b/layout/reftests/mathml/mfenced-7-ref.html
new file mode 100644
index 000000000000..d0d28439eb99
--- /dev/null
+++ b/layout/reftests/mathml/mfenced-7-ref.html
@@ -0,0 +1,17 @@
+<!DOCTYPE HTML>
+<html>
+  <body>
+
+    <!-- Default values for open, close, separators -->
+    <math>
+      <mfenced open="(" close=")" separators=",">
+        <mi>a</mi> 
+        <mi>b</mi> 
+        <mi>c</mi> 
+        <mi>d</mi> 
+        <mi>e</mi>  
+      </mfenced>
+    </math>
+    
+ </body>
+</html>
diff --git a/layout/reftests/mathml/mfenced-7.html b/layout/reftests/mathml/mfenced-7.html
new file mode 100644
index 000000000000..14100352ada6
--- /dev/null
+++ b/layout/reftests/mathml/mfenced-7.html
@@ -0,0 +1,17 @@
+<!DOCTYPE HTML>
+<html>
+  <body>
+
+    <!-- Default values for open, close, separators -->
+    <math>
+      <mfenced>
+        <mi>a</mi> 
+        <mi>b</mi> 
+        <mi>c</mi> 
+        <mi>d</mi> 
+        <mi>e</mi>  
+      </mfenced>
+    </math>
+    
+ </body>
+</html>
diff --git a/layout/reftests/mathml/mfenced-8-ref.html b/layout/reftests/mathml/mfenced-8-ref.html
new file mode 100644
index 000000000000..4134808c7a38
--- /dev/null
+++ b/layout/reftests/mathml/mfenced-8-ref.html
@@ -0,0 +1,16 @@
+<!DOCTYPE HTML>
+<html>
+  <body>
+
+    <!-- Empty separators -->
+
+    <math>
+      <mfenced>
+        <mi>a</mi> 
+        <mi>b</mi> 
+        <mi>c</mi> 
+      </mfenced>
+    </math>
+
+  </body>
+</html>
diff --git a/layout/reftests/mathml/mfenced-8.html b/layout/reftests/mathml/mfenced-8.html
new file mode 100644
index 000000000000..69cf36fc98b0
--- /dev/null
+++ b/layout/reftests/mathml/mfenced-8.html
@@ -0,0 +1,16 @@
+<!DOCTYPE HTML>
+<html>
+  <body>
+
+    <!-- Empty separators -->
+
+    <math>
+      <mfenced separators="">
+        <mi>a</mi> 
+        <mi>b</mi> 
+        <mi>c</mi> 
+      </mfenced>
+    </math>
+
+  </body>
+</html>
diff --git a/layout/reftests/mathml/mfenced-9-ref.html b/layout/reftests/mathml/mfenced-9-ref.html
new file mode 100644
index 000000000000..5b9c7658f9e7
--- /dev/null
+++ b/layout/reftests/mathml/mfenced-9-ref.html
@@ -0,0 +1,14 @@
+<!DOCTYPE HTML>
+<html>
+  <body>
+
+    <!-- No arguments -->
+
+    <math>
+      <mfenced>
+        <mspace /> 
+      </mfenced>
+    </math>
+
+  </body>
+</html>
diff --git a/layout/reftests/mathml/mfenced-9.html b/layout/reftests/mathml/mfenced-9.html
new file mode 100644
index 000000000000..75660af9ee00
--- /dev/null
+++ b/layout/reftests/mathml/mfenced-9.html
@@ -0,0 +1,13 @@
+<!DOCTYPE HTML>
+<html>
+  <body>
+
+    <!-- No arguments -->
+
+    <math>
+      <mfenced>
+      </mfenced>
+    </math>
+
+  </body>
+</html>
diff --git a/layout/reftests/mathml/reftest.list b/layout/reftests/mathml/reftest.list
index c77bd3409651..d12bf3880f03 100644
--- a/layout/reftests/mathml/reftest.list
+++ b/layout/reftests/mathml/reftest.list
@@ -12,6 +12,11 @@
 == mfenced-5b.xhtml mfenced-5-ref.xhtml
 == mfenced-5c.xhtml mfenced-5-ref.xhtml
 == mfenced-5d.xhtml mfenced-5-ref.xhtml
+== mfenced-6.html mfenced-6-ref.html
+== mfenced-7.html mfenced-7-ref.html
+!= mfenced-8.html mfenced-8-ref.html
+== mfenced-9.html mfenced-9-ref.html
+fails-if(winWidget) == mfenced-10.html mfenced-10-ref.html
 == mi-mathvariant-1.xhtml mi-mathvariant-1-ref.xhtml
 == mi-mathvariant-2.xhtml mi-mathvariant-2-ref.xhtml
 != non-spacing-accent-1.xhtml non-spacing-accent-1-ref.xhtml
@@ -67,6 +72,7 @@ fails == mstyle-5.xhtml mstyle-5-ref.xhtml # See bug 569125#c29
 == mpadded-5.html mpadded-5-ref.html
 == mpadded-1-2.html mpadded-1-2-ref.html
 == mpadded-6.html mpadded-6-ref.html
+== math-display.html math-display-ref.html
 == mfrac-linethickness-1.xhtml mfrac-linethickness-1-ref.xhtml
 == mathml-negativespace.html mathml-negativespace-ref.html
 != link-1.xhtml link-ref.xhtml
diff --git a/layout/style/nsFontFaceLoader.cpp b/layout/style/nsFontFaceLoader.cpp
index 32ad9b4ce34d..782d15097414 100644
--- a/layout/style/nsFontFaceLoader.cpp
+++ b/layout/style/nsFontFaceLoader.cpp
@@ -73,6 +73,8 @@
 #include "nsIChannelPolicy.h"
 #include "nsChannelPolicy.h"
 
+#include "nsIConsoleService.h"
+
 #include "nsStyleSet.h"
 
 using namespace mozilla;
@@ -212,9 +214,28 @@ nsFontFaceLoader::OnStreamComplete(nsIStreamLoader* aLoader,
     return aStatus;
   }
 
+  if (NS_SUCCEEDED(aStatus)) {
+    // for HTTP requests, check whether the request _actually_ succeeded;
+    // the "request status" in aStatus does not necessarily indicate this,
+    // because HTTP responses such as 404 (Not Found) will still result in
+    // a success code and potentially an HTML error page from the server
+    // as the resulting data. We don't want to use that as a font.
+    nsCOMPtr<nsIHttpChannel> httpChannel = do_QueryInterface(mChannel);
+    if (httpChannel) {
+      PRBool succeeded;
+      nsresult rv = httpChannel->GetRequestSucceeded(&succeeded);
+      if (NS_SUCCEEDED(rv) && !succeeded) {
+        aStatus = NS_ERROR_NOT_AVAILABLE;
+      }
+    }
+  }
+
   // The userFontSet is responsible for freeing the downloaded data
   // (aString) when finished with it; the pointer is no longer valid
   // after OnLoadComplete returns.
+  // This is called even in the case of a failed download (HTTP 404, etc),
+  // as there may still be data to be freed (e.g. an error page),
+  // and we need the fontSet to initiate loading the next source.
   PRBool fontUpdate = userFontSet->OnLoadComplete(mFontEntry,
                                                   aString, aStringLen,
                                                   aStatus);
@@ -342,17 +363,7 @@ nsUserFontSet::StartLoad(gfxProxyFontEntry *aProxy,
   rv = nsFontFaceLoader::CheckLoadAllowed(principal, aFontFaceSrc->mURI, 
                                           ps->GetDocument());
   if (NS_FAILED(rv)) {
-#ifdef PR_LOGGING
-    if (LOG_ENABLED()) {
-      nsCAutoString fontURI, referrerURI;
-      aFontFaceSrc->mURI->GetSpec(fontURI);
-      if (aFontFaceSrc->mReferrer)
-        aFontFaceSrc->mReferrer->GetSpec(referrerURI);
-      LOG(("fontdownloader download blocked - font uri: (%s) "
-           "referrer uri: (%s) err: %8.8x\n", 
-          fontURI.get(), referrerURI.get(), rv));
-    }
-#endif    
+    LogMessage(aProxy, "download not allowed", nsIScriptError::errorFlag, rv);
     return rv;
   }
 
@@ -697,3 +708,105 @@ nsUserFontSet::FindRuleForEntry(gfxFontEntry *aFontEntry)
   }
   return nsnull;
 }
+
+nsresult
+nsUserFontSet::LogMessage(gfxProxyFontEntry *aProxy,
+                          const char        *aMessage,
+                          PRUint32          aFlags,
+                          nsresult          aStatus)
+{
+  nsCOMPtr<nsIConsoleService>
+    console(do_GetService(NS_CONSOLESERVICE_CONTRACTID));
+  if (!console) {
+    return NS_ERROR_NOT_AVAILABLE;
+  }
+
+  NS_ConvertUTF16toUTF8 familyName(aProxy->FamilyName());
+  nsCAutoString fontURI;
+  aProxy->mSrcList[aProxy->mSrcIndex].mURI->GetSpec(fontURI);
+
+  char weightKeywordBuf[8]; // plenty to sprintf() a PRUint16
+  const char *weightKeyword;
+  const nsAFlatCString& weightKeywordString =
+    nsCSSProps::ValueToKeyword(aProxy->Weight(),
+                               nsCSSProps::kFontWeightKTable);
+  if (weightKeywordString.Length() > 0) {
+    weightKeyword = weightKeywordString.get();
+  } else {
+    sprintf(weightKeywordBuf, "%u", aProxy->Weight());
+    weightKeyword = weightKeywordBuf;
+  }
+
+  nsPrintfCString
+    msg(1024,
+        "downloadable font: %s "
+        "(font-family: \"%s\" style:%s weight:%s stretch:%s src index:%d)",
+        aMessage,
+        familyName.get(),
+        aProxy->IsItalic() ? "italic" : "normal",
+        weightKeyword,
+        nsCSSProps::ValueToKeyword(aProxy->Stretch(),
+                                   nsCSSProps::kFontStretchKTable).get(),
+        aProxy->mSrcIndex);
+
+  if (aStatus != 0) {
+    msg.Append(": ");
+    switch (aStatus) {
+    case NS_ERROR_DOM_BAD_URI:
+      msg.Append("bad URI or cross-site access not allowed");
+      break;
+    case NS_ERROR_CONTENT_BLOCKED:
+      msg.Append("content blocked");
+      break;
+    default:
+      msg.Append("status=");
+      msg.AppendInt(aStatus);
+      break;
+    }
+  }
+  msg.Append("\nsource: ");
+  msg.Append(fontURI);
+
+#ifdef PR_LOGGING
+  if (PR_LOG_TEST(sUserFontsLog, PR_LOG_DEBUG)) {
+    PR_LOG(sUserFontsLog, PR_LOG_DEBUG,
+           ("userfonts (%p) %s", this, msg.get()));
+  }
+#endif
+
+  // try to give the user an indication of where the rule came from
+  nsCSSFontFaceRule* rule = FindRuleForEntry(aProxy);
+  nsString href;
+  nsString text;
+  nsresult rv;
+  if (rule) {
+    rv = rule->GetCssText(text);
+    NS_ENSURE_SUCCESS(rv, rv);
+    nsCOMPtr<nsIDOMCSSStyleSheet> sheet;
+    rv = rule->GetParentStyleSheet(getter_AddRefs(sheet));
+    NS_ENSURE_SUCCESS(rv, rv);
+    rv = sheet->GetHref(href);
+    NS_ENSURE_SUCCESS(rv, rv);
+  }
+
+  nsCOMPtr<nsIScriptError2> scriptError =
+    do_CreateInstance(NS_SCRIPTERROR_CONTRACTID, &rv);
+  NS_ENSURE_SUCCESS(rv, rv);
+
+  PRUint64 windowID = GetPresContext()->Document()->OuterWindowID();
+  rv = scriptError->InitWithWindowID(NS_ConvertUTF8toUTF16(msg).get(),
+                                     href.get(),   // file
+                                     text.get(),   // src line
+                                     0, 0,         // line & column number
+                                     aFlags,       // flags
+                                     "CSS Loader", // category (make separate?)
+                                     windowID);
+  if (NS_SUCCEEDED(rv)){
+    nsCOMPtr<nsIScriptError> logError = do_QueryInterface(scriptError);
+    if (logError) {
+      console->LogMessage(logError);
+    }
+  }
+
+  return NS_OK;
+}
diff --git a/layout/style/nsFontFaceLoader.h b/layout/style/nsFontFaceLoader.h
index 1b55ef264276..69070cb005fd 100644
--- a/layout/style/nsFontFaceLoader.h
+++ b/layout/style/nsFontFaceLoader.h
@@ -102,6 +102,11 @@ protected:
                   nsTArray<FontFaceRuleRecord>& oldRules,
                   PRBool& aFontSetModified);
 
+  virtual nsresult LogMessage(gfxProxyFontEntry *aProxy,
+                              const char *aMessage,
+                              PRUint32 aFlags = nsIScriptError::errorFlag,
+                              nsresult aStatus = 0);
+
   nsPresContext *mPresContext;  // weak reference
 
   // Set of all loaders pointing to us. These are not strong pointers,
diff --git a/layout/style/nsRuleNode.cpp b/layout/style/nsRuleNode.cpp
index 123ee0231af4..ab8888498fc1 100644
--- a/layout/style/nsRuleNode.cpp
+++ b/layout/style/nsRuleNode.cpp
@@ -2506,19 +2506,16 @@ nsRuleNode::SetFontSize(nsPresContext* aPresContext,
   const nsCSSValue* sizeValue = aRuleData->ValueForFontSize();
   if (eCSSUnit_Enumerated == sizeValue->GetUnit()) {
     PRInt32 value = sizeValue->GetIntValue();
-    PRInt32 scaler = aPresContext->FontScaler();
-    float scaleFactor = nsStyleUtil::GetScalingFactor(scaler);
 
     zoom = PR_TRUE;
     if ((NS_STYLE_FONT_SIZE_XXSMALL <= value) &&
         (value <= NS_STYLE_FONT_SIZE_XXLARGE)) {
       *aSize = nsStyleUtil::CalcFontPointSize(value, baseSize,
-                       scaleFactor, aPresContext, eFontSize_CSS);
+                       aPresContext, eFontSize_CSS);
     }
     else if (NS_STYLE_FONT_SIZE_XXXLARGE == value) {
       // <font size="7"> is not specified in CSS, so we don't use eFontSize_CSS.
-      *aSize = nsStyleUtil::CalcFontPointSize(value, baseSize,
-                       scaleFactor, aPresContext);
+      *aSize = nsStyleUtil::CalcFontPointSize(value, baseSize, aPresContext);
     }
     else if (NS_STYLE_FONT_SIZE_LARGER  == value ||
              NS_STYLE_FONT_SIZE_SMALLER == value) {
@@ -2534,14 +2531,14 @@ nsRuleNode::SetFontSize(nsPresContext* aPresContext,
 
       if (NS_STYLE_FONT_SIZE_LARGER == value) {
         *aSize = nsStyleUtil::FindNextLargerFontSize(parentSize,
-                         baseSize, scaleFactor, aPresContext, eFontSize_CSS);
+                         baseSize, aPresContext, eFontSize_CSS);
 
         NS_ASSERTION(*aSize >= parentSize,
                      "FindNextLargerFontSize failed");
       }
       else {
         *aSize = nsStyleUtil::FindNextSmallerFontSize(parentSize,
-                         baseSize, scaleFactor, aPresContext, eFontSize_CSS);
+                         baseSize, aPresContext, eFontSize_CSS);
         NS_ASSERTION(*aSize < parentSize ||
                      parentSize <= nsPresContext::CSSPixelsToAppUnits(1),
                      "FindNextSmallerFontSize failed");
diff --git a/layout/style/nsStyleUtil.cpp b/layout/style/nsStyleUtil.cpp
index 3befb2cd4d51..06d8f7f1d82b 100644
--- a/layout/style/nsStyleUtil.cpp
+++ b/layout/style/nsStyleUtil.cpp
@@ -51,49 +51,13 @@
 #include "nsTextFormatter.h"
 #include "nsCSSProps.h"
 
-#define POSITIVE_SCALE_FACTOR 1.10 /* 10% */
-#define NEGATIVE_SCALE_FACTOR .90  /* 10% */
-
-
-//------------------------------------------------------------------------------
-//
-//------------------------------------------------------------------------------
-
-/*
- * Return the scaling percentage given a font scaler
- * Lifted from layutil.c
- */
-float nsStyleUtil::GetScalingFactor(PRInt32 aScaler)
-{
-  double scale = 1.0;
-  double mult;
-  PRInt32 count;
-
-  if(aScaler < 0)   {
-    count = -aScaler;
-    mult = NEGATIVE_SCALE_FACTOR;
-  }
-  else {
-    count = aScaler;
-    mult = POSITIVE_SCALE_FACTOR;
-  }
-
-  /* use the percentage scaling factor to the power of the pref */
-  while(count--) {
-    scale *= mult;
-  }
-
-  return (float)scale;
-}
-
-
 //------------------------------------------------------------------------------
 // Font Algorithm Code
 //------------------------------------------------------------------------------
 
 nscoord
 nsStyleUtil::CalcFontPointSize(PRInt32 aHTMLSize, PRInt32 aBasePointSize,
-                               float aScalingFactor, nsPresContext* aPresContext,
+                               nsPresContext* aPresContext,
                                nsFontSizeType aFontSizeType)
 {
 #define sFontSizeTableMin  9 
@@ -212,7 +176,6 @@ nsStyleUtil::CalcFontPointSize(PRInt32 aHTMLSize, PRInt32 aBasePointSize,
     dFontSize = (factor * aBasePointSize) / 100;
   }
 
-  dFontSize *= aScalingFactor;
 
   if (1.0 < dFontSize) {
     return (nscoord)dFontSize;
@@ -226,7 +189,7 @@ nsStyleUtil::CalcFontPointSize(PRInt32 aHTMLSize, PRInt32 aBasePointSize,
 //------------------------------------------------------------------------------
 
 nscoord nsStyleUtil::FindNextSmallerFontSize(nscoord aFontSize, PRInt32 aBasePointSize, 
-                                             float aScalingFactor, nsPresContext* aPresContext,
+                                             nsPresContext* aPresContext,
                                              nsFontSizeType aFontSizeType)
 {
   PRInt32 index;
@@ -250,26 +213,26 @@ nscoord nsStyleUtil::FindNextSmallerFontSize(nscoord aFontSize, PRInt32 aBasePoi
     indexMax = 6;
   }
   
-  smallestIndexFontSize = CalcFontPointSize(indexMin, aBasePointSize, aScalingFactor, aPresContext, aFontSizeType);
-  largestIndexFontSize = CalcFontPointSize(indexMax, aBasePointSize, aScalingFactor, aPresContext, aFontSizeType); 
+  smallestIndexFontSize = CalcFontPointSize(indexMin, aBasePointSize, aPresContext, aFontSizeType);
+  largestIndexFontSize = CalcFontPointSize(indexMax, aBasePointSize, aPresContext, aFontSizeType); 
   if (aFontSize > smallestIndexFontSize) {
     if (aFontSize < NSToCoordRound(float(largestIndexFontSize) * 1.5)) { // smaller will be in HTML table
       // find largest index smaller than current
       for (index = indexMax; index >= indexMin; index--) {
-        indexFontSize = CalcFontPointSize(index, aBasePointSize, aScalingFactor, aPresContext, aFontSizeType);
+        indexFontSize = CalcFontPointSize(index, aBasePointSize, aPresContext, aFontSizeType);
         if (indexFontSize < aFontSize)
           break;
       } 
       // set up points beyond table for interpolation purposes
       if (indexFontSize == smallestIndexFontSize) {
         smallerIndexFontSize = indexFontSize - onePx;
-        largerIndexFontSize = CalcFontPointSize(index+1, aBasePointSize, aScalingFactor, aPresContext, aFontSizeType);
+        largerIndexFontSize = CalcFontPointSize(index+1, aBasePointSize, aPresContext, aFontSizeType);
       } else if (indexFontSize == largestIndexFontSize) {
-        smallerIndexFontSize = CalcFontPointSize(index-1, aBasePointSize, aScalingFactor, aPresContext, aFontSizeType);
+        smallerIndexFontSize = CalcFontPointSize(index-1, aBasePointSize, aPresContext, aFontSizeType);
         largerIndexFontSize = NSToCoordRound(float(largestIndexFontSize) * 1.5);
       } else {
-        smallerIndexFontSize = CalcFontPointSize(index-1, aBasePointSize, aScalingFactor, aPresContext, aFontSizeType);
-        largerIndexFontSize = CalcFontPointSize(index+1, aBasePointSize, aScalingFactor, aPresContext, aFontSizeType);
+        smallerIndexFontSize = CalcFontPointSize(index-1, aBasePointSize, aPresContext, aFontSizeType);
+        largerIndexFontSize = CalcFontPointSize(index+1, aBasePointSize, aPresContext, aFontSizeType);
       }
       // compute the relative position of the parent size between the two closest indexed sizes
       relativePosition = float(aFontSize - indexFontSize) / float(largerIndexFontSize - indexFontSize);            
@@ -291,7 +254,7 @@ nscoord nsStyleUtil::FindNextSmallerFontSize(nscoord aFontSize, PRInt32 aBasePoi
 //------------------------------------------------------------------------------
 
 nscoord nsStyleUtil::FindNextLargerFontSize(nscoord aFontSize, PRInt32 aBasePointSize, 
-                                            float aScalingFactor, nsPresContext* aPresContext,
+                                            nsPresContext* aPresContext,
                                             nsFontSizeType aFontSizeType)
 {
   PRInt32 index;
@@ -316,26 +279,26 @@ nscoord nsStyleUtil::FindNextLargerFontSize(nscoord aFontSize, PRInt32 aBasePoin
     indexMax = 6;
   }
   
-  smallestIndexFontSize = CalcFontPointSize(indexMin, aBasePointSize, aScalingFactor, aPresContext, aFontSizeType);
-  largestIndexFontSize = CalcFontPointSize(indexMax, aBasePointSize, aScalingFactor, aPresContext, aFontSizeType); 
+  smallestIndexFontSize = CalcFontPointSize(indexMin, aBasePointSize, aPresContext, aFontSizeType);
+  largestIndexFontSize = CalcFontPointSize(indexMax, aBasePointSize, aPresContext, aFontSizeType); 
   if (aFontSize > (smallestIndexFontSize - onePx)) {
     if (aFontSize < largestIndexFontSize) { // larger will be in HTML table
       // find smallest index larger than current
       for (index = indexMin; index <= indexMax; index++) { 
-        indexFontSize = CalcFontPointSize(index, aBasePointSize, aScalingFactor, aPresContext, aFontSizeType);
+        indexFontSize = CalcFontPointSize(index, aBasePointSize, aPresContext, aFontSizeType);
         if (indexFontSize > aFontSize)
           break;
       }
       // set up points beyond table for interpolation purposes
       if (indexFontSize == smallestIndexFontSize) {
         smallerIndexFontSize = indexFontSize - onePx;
-        largerIndexFontSize = CalcFontPointSize(index+1, aBasePointSize, aScalingFactor, aPresContext, aFontSizeType);
+        largerIndexFontSize = CalcFontPointSize(index+1, aBasePointSize, aPresContext, aFontSizeType);
       } else if (indexFontSize == largestIndexFontSize) {
-        smallerIndexFontSize = CalcFontPointSize(index-1, aBasePointSize, aScalingFactor, aPresContext, aFontSizeType);
+        smallerIndexFontSize = CalcFontPointSize(index-1, aBasePointSize, aPresContext, aFontSizeType);
         largerIndexFontSize = NSCoordSaturatingMultiply(largestIndexFontSize, 1.5);
       } else {
-        smallerIndexFontSize = CalcFontPointSize(index-1, aBasePointSize, aScalingFactor, aPresContext, aFontSizeType);
-        largerIndexFontSize = CalcFontPointSize(index+1, aBasePointSize, aScalingFactor, aPresContext, aFontSizeType);
+        smallerIndexFontSize = CalcFontPointSize(index-1, aBasePointSize, aPresContext, aFontSizeType);
+        largerIndexFontSize = CalcFontPointSize(index+1, aBasePointSize, aPresContext, aFontSizeType);
       }
       // compute the relative position of the parent size between the two closest indexed sizes
       relativePosition = float(aFontSize - smallerIndexFontSize) / float(indexFontSize - smallerIndexFontSize);
diff --git a/layout/style/nsStyleUtil.h b/layout/style/nsStyleUtil.h
index 93dd428ceaf3..cc86caa76dbf 100644
--- a/layout/style/nsStyleUtil.h
+++ b/layout/style/nsStyleUtil.h
@@ -56,18 +56,16 @@ enum nsFontSizeType {
 class nsStyleUtil {
 public:
   
-  static float GetScalingFactor(PRInt32 aScaler);
-
   static nscoord CalcFontPointSize(PRInt32 aHTMLSize, PRInt32 aBasePointSize, 
-                                   float aScalingFactor, nsPresContext* aPresContext,
+                                   nsPresContext* aPresContext,
                                    nsFontSizeType aFontSizeType = eFontSize_HTML);
 
   static nscoord FindNextSmallerFontSize(nscoord aFontSize, PRInt32 aBasePointSize, 
-                                         float aScalingFactor, nsPresContext* aPresContext,
+                                         nsPresContext* aPresContext,
                                          nsFontSizeType aFontSizeType = eFontSize_HTML);
 
   static nscoord FindNextLargerFontSize(nscoord aFontSize, PRInt32 aBasePointSize, 
-                                        float aScalingFactor, nsPresContext* aPresContext,
+                                        nsPresContext* aPresContext,
                                         nsFontSizeType aFontSizeType = eFontSize_HTML);
 
   static PRInt32 ConstrainFontWeight(PRInt32 aWeight);
diff --git a/layout/svg/base/src/nsSVGGlyphFrame.cpp b/layout/svg/base/src/nsSVGGlyphFrame.cpp
index b1309ea2afe8..21f74f23604c 100644
--- a/layout/svg/base/src/nsSVGGlyphFrame.cpp
+++ b/layout/svg/base/src/nsSVGGlyphFrame.cpp
@@ -1521,48 +1521,45 @@ nsSVGGlyphFrame::EnsureTextRun(float *aDrawScale, float *aMetricsScale,
     if (!GetCharacterData(text))
       return PR_FALSE;
 
-    nsBidiPresUtils* bidiUtils = presContext->GetBidiUtils();
-    if (bidiUtils) {
-      nsAutoString visualText;
-
-      /*
-       * XXXsmontagu: The SVG spec says:
-       *
-       * http://www.w3.org/TR/SVG11/text.html#DirectionProperty
-       *  "For the 'direction' property to have any effect, the 'unicode-bidi'
-       *   property's value must be embed or bidi-override."
-       *
-       * The SVGTiny spec, on the other hand, says 
-       *
-       * http://www.w3.org/TR/SVGTiny12/text.html#DirectionProperty
-       *  "For the 'direction' property to have any effect on an element that 
-       *   does not by itself establish a new text chunk (such as the 'tspan'
-       *   element in SVG 1.2 Tiny), the 'unicode-bidi' property's value must
-       *   be embed or bidi-override."
-       *
-       * Note that this is different from HTML/CSS, where setting the 'dir'
-       *  attribute on an inline element automatically sets unicode-bidi: embed
-       *
-       * Our current implementation of bidi in SVG does not distinguish between
-       * different text elements, but treats every text container frame as a
-       * new text chunk, so we always set the base direction according to the
-       * direction property
-       *
-       * See also XXXsmontagu comments in nsSVGTextFrame::UpdateGlyphPositioning
-       */
-        
-      // Get the unicodeBidi property from the parent, because it doesn't
-      // inherit
-      PRBool bidiOverride = (mParent->GetStyleTextReset()->mUnicodeBidi ==
-                             NS_STYLE_UNICODE_BIDI_OVERRIDE);
-      nsBidiLevel baseDirection =
-        GetStyleVisibility()->mDirection == NS_STYLE_DIRECTION_RTL ?
-          NSBIDI_RTL : NSBIDI_LTR;
-      bidiUtils->CopyLogicalToVisual(text, visualText,
-                                     baseDirection, bidiOverride);
-      if (!visualText.IsEmpty()) {
-        text = visualText;
-      }
+    nsAutoString visualText;
+      
+    /*
+     * XXXsmontagu: The SVG spec says:
+     *
+     * http://www.w3.org/TR/SVG11/text.html#DirectionProperty
+     *  "For the 'direction' property to have any effect, the 'unicode-bidi'
+     *   property's value must be embed or bidi-override."
+     *
+     * The SVGTiny spec, on the other hand, says 
+     *
+     * http://www.w3.org/TR/SVGTiny12/text.html#DirectionProperty
+     *  "For the 'direction' property to have any effect on an element that 
+     *   does not by itself establish a new text chunk (such as the 'tspan'
+     *   element in SVG 1.2 Tiny), the 'unicode-bidi' property's value must
+     *   be embed or bidi-override."
+     *
+     * Note that this is different from HTML/CSS, where setting the 'dir'
+     *  attribute on an inline element automatically sets unicode-bidi: embed
+     *
+     * Our current implementation of bidi in SVG does not distinguish between
+     * different text elements, but treats every text container frame as a
+     * new text chunk, so we always set the base direction according to the
+     * direction property
+     *
+     * See also XXXsmontagu comments in nsSVGTextFrame::UpdateGlyphPositioning
+     */
+    
+    // Get the unicodeBidi property from the parent, because it doesn't
+    // inherit
+    PRBool bidiOverride = (mParent->GetStyleTextReset()->mUnicodeBidi ==
+                           NS_STYLE_UNICODE_BIDI_OVERRIDE);
+    nsBidiLevel baseDirection =
+      GetStyleVisibility()->mDirection == NS_STYLE_DIRECTION_RTL ?
+        NSBIDI_RTL : NSBIDI_LTR;
+    nsBidiPresUtils::CopyLogicalToVisual(text, visualText,
+                                         baseDirection, bidiOverride);
+    if (!visualText.IsEmpty()) {
+      text = visualText;
     }
 
     gfxMatrix m;
diff --git a/layout/tools/reftest/reftest.js b/layout/tools/reftest/reftest.js
index 00eef50801b9..4cfdaa41e4cd 100644
--- a/layout/tools/reftest/reftest.js
+++ b/layout/tools/reftest/reftest.js
@@ -65,6 +65,7 @@ const NS_OBSERVER_SERVICE_CONTRACTID =
 var gLoadTimeout = 0;
 var gTimeoutHook = null;
 var gRemote = false;
+var gIgnoreWindowSize = false;
 var gTotalChunks = 0;
 var gThisChunk = 0;
 
@@ -273,6 +274,7 @@ function InitAndStartRefTests()
         }
       }
       gRemote = prefs.getBoolPref("reftest.remote");
+      gIgnoreWindowSize = prefs.getBoolPref("reftest.ignoreWindowSize");
     }
     catch(e) {
       gLoadTimeout = 5 * 60 * 1000; //5 minutes as per bug 479518
@@ -999,10 +1001,11 @@ function DoDrawWindow(ctx, x, y, w, h)
 {
     var flags = ctx.DRAWWINDOW_DRAW_CARET | ctx.DRAWWINDOW_DRAW_VIEW;
     var testRect = gBrowser.getBoundingClientRect();
-    if (0 <= testRect.left &&
-        0 <= testRect.top &&
-        window.innerWidth >= testRect.right &&
-        window.innerHeight >= testRect.bottom) {
+    if (gIgnoreWindowSize ||
+        (0 <= testRect.left &&
+         0 <= testRect.top &&
+         window.innerWidth >= testRect.right &&
+         window.innerHeight >= testRect.bottom)) {
         // We can use the window's retained layer manager
         // because the window is big enough to display the entire
         // browser element
diff --git a/layout/tools/reftest/remotereftest.py b/layout/tools/reftest/remotereftest.py
index b17d067b8f9a..1bbf21dbb102 100644
--- a/layout/tools/reftest/remotereftest.py
+++ b/layout/tools/reftest/remotereftest.py
@@ -407,12 +407,13 @@ def main():
         print "ERROR: Invalid options specified, use --help for a list of valid options"
         sys.exit(1)
 
-    parts = dm.getInfo('screen')['screen'][0].split()
-    width = int(parts[0].split(':')[1])
-    height = int(parts[1].split(':')[1])
-    if (width < 1050 or height < 1050):
-        print "ERROR: Invalid screen resolution %sx%s, please adjust to 1366x1050 or higher" % (width, height)
-        sys.exit(1)
+    if not options.ignoreWindowSize:
+        parts = dm.getInfo('screen')['screen'][0].split()
+        width = int(parts[0].split(':')[1])
+        height = int(parts[1].split(':')[1])
+        if (width < 1050 or height < 1050):
+            print "ERROR: Invalid screen resolution %sx%s, please adjust to 1366x1050 or higher" % (width, height)
+            sys.exit(1)
 
     automation.setAppName(options.app)
     automation.setRemoteProfile(options.remoteProfile)
diff --git a/layout/tools/reftest/runreftest.py b/layout/tools/reftest/runreftest.py
index 2b3c09008276..a036a9bf17e9 100644
--- a/layout/tools/reftest/runreftest.py
+++ b/layout/tools/reftest/runreftest.py
@@ -88,6 +88,8 @@ class RefTest(object):
       prefsFile.write('user_pref("reftest.thisChunk", %d);\n' % options.thisChunk)
     if options.logFile != None:
       prefsFile.write('user_pref("reftest.logFile", "%s");\n' % options.logFile)
+    if options.ignoreWindowSize != False:
+      prefsFile.write('user_pref("reftest.ignoreWindowSize", true);\n')
 
     for v in options.extraPrefs:
       thispref = v.split("=")
@@ -254,6 +256,11 @@ class ReftestOptions(OptionParser):
                     help = "skip tests marked as slow when running")
     defaults["skipSlowTests"] = False
 
+    self.add_option("--ignore-window-size",
+                    dest = "ignoreWindowSize", action = "store_true",
+                    help = "ignore the window size, which may cause spurious failures and passes")
+    defaults["ignoreWindowSize"] = False
+
     self.add_option("--install-extension",
                     action = "append", dest = "extensionsToInstall",
                     help = "install the specified extension in the testing profile."
diff --git a/layout/xul/base/public/Makefile.in b/layout/xul/base/public/Makefile.in
index f2630a95175e..4b9c775d03d4 100644
--- a/layout/xul/base/public/Makefile.in
+++ b/layout/xul/base/public/Makefile.in
@@ -48,7 +48,6 @@ GRE_MODULE	= 1
 
 EXPORTS		= \
 		nsPIBoxObject.h \
-		nsIMenuFrame.h \
 		nsIScrollbarMediator.h \
 		nsXULPopupManager.h \
 		$(NULL)
diff --git a/layout/xul/base/public/nsIScrollbarMediator.h b/layout/xul/base/public/nsIScrollbarMediator.h
index 4d5a2fd93d37..800b6cf83d79 100644
--- a/layout/xul/base/public/nsIScrollbarMediator.h
+++ b/layout/xul/base/public/nsIScrollbarMediator.h
@@ -42,19 +42,16 @@
 
 #include "nsQueryFrame.h"
 
-class nsIScrollbarFrame;
+class nsScrollbarFrame;
 
 class nsIScrollbarMediator
 {
 public:
   NS_DECL_QUERYFRAME_TARGET(nsIScrollbarMediator)
 
-  // The nsIFrame aScrollbar argument below denotes the
-  // scrollbar that's firing the notification. It should be
-  // where the same object as where nsIScrollbarFrame is implemented
-
-  NS_IMETHOD PositionChanged(nsIScrollbarFrame* aScrollbar, PRInt32 aOldIndex, PRInt32& aNewIndex) = 0;
-  NS_IMETHOD ScrollbarButtonPressed(nsIScrollbarFrame* aScrollbar, PRInt32 aOldIndex, PRInt32 aNewIndex) = 0;
+  // The aScrollbar argument denotes the scrollbar that's firing the notification.
+  NS_IMETHOD PositionChanged(nsScrollbarFrame* aScrollbar, PRInt32 aOldIndex, PRInt32& aNewIndex) = 0;
+  NS_IMETHOD ScrollbarButtonPressed(nsScrollbarFrame* aScrollbar, PRInt32 aOldIndex, PRInt32 aNewIndex) = 0;
 
   NS_IMETHOD VisibilityChanged(PRBool aVisible) = 0;
 };
diff --git a/layout/xul/base/src/grid/nsGrid.cpp b/layout/xul/base/src/grid/nsGrid.cpp
index 5c28a1f9da8b..b454cd9b4204 100644
--- a/layout/xul/base/src/grid/nsGrid.cpp
+++ b/layout/xul/base/src/grid/nsGrid.cpp
@@ -596,7 +596,7 @@ nsGrid::GetPartFromBox(nsIBox* aBox)
   if (!aBox)
     return nsnull;
 
-  nsIBoxLayout* layout = aBox->GetLayoutManager();
+  nsBoxLayout* layout = aBox->GetLayoutManager();
   return layout ? layout->AsGridPart() : nsnull;
 }
 
diff --git a/layout/xul/base/src/grid/nsGridLayout2.cpp b/layout/xul/base/src/grid/nsGridLayout2.cpp
index b68420238ef5..812368f9a76b 100644
--- a/layout/xul/base/src/grid/nsGridLayout2.cpp
+++ b/layout/xul/base/src/grid/nsGridLayout2.cpp
@@ -50,7 +50,7 @@
 #include "nsSprocketLayout.h"
 
 nsresult
-NS_NewGridLayout2( nsIPresShell* aPresShell, nsIBoxLayout** aNewLayout)
+NS_NewGridLayout2( nsIPresShell* aPresShell, nsBoxLayout** aNewLayout)
 {
   *aNewLayout = new nsGridLayout2(aPresShell);
   NS_IF_ADDREF(*aNewLayout);
diff --git a/layout/xul/base/src/grid/nsGridLayout2.h b/layout/xul/base/src/grid/nsGridLayout2.h
index 711f217b7ecc..03f806fb2378 100644
--- a/layout/xul/base/src/grid/nsGridLayout2.h
+++ b/layout/xul/base/src/grid/nsGridLayout2.h
@@ -53,14 +53,14 @@ class nsBoxLayoutState;
 class nsGridCell;
 
 /**
- * The nsIBoxLayout implementation for a grid.
+ * The nsBoxLayout implementation for a grid.
  */
 class nsGridLayout2 : public nsStackLayout, 
                       public nsIGridPart
 {
 public:
 
-  friend nsresult NS_NewGridLayout2(nsIPresShell* aPresShell, nsIBoxLayout** aNewLayout);
+  friend nsresult NS_NewGridLayout2(nsIPresShell* aPresShell, nsBoxLayout** aNewLayout);
 
   NS_DECL_ISUPPORTS_INHERITED
 
diff --git a/layout/xul/base/src/grid/nsGridRowGroupFrame.cpp b/layout/xul/base/src/grid/nsGridRowGroupFrame.cpp
index 1defe9f3de9d..e33cc7ae3925 100644
--- a/layout/xul/base/src/grid/nsGridRowGroupFrame.cpp
+++ b/layout/xul/base/src/grid/nsGridRowGroupFrame.cpp
@@ -48,13 +48,13 @@
 #include "nsBoxLayoutState.h"
 #include "nsGridLayout2.h"
 
-already_AddRefed<nsIBoxLayout> NS_NewGridRowGroupLayout();
+already_AddRefed<nsBoxLayout> NS_NewGridRowGroupLayout();
 
 nsIFrame*
 NS_NewGridRowGroupFrame(nsIPresShell* aPresShell,
                         nsStyleContext* aContext)
 {
-  nsCOMPtr<nsIBoxLayout> layout = NS_NewGridRowGroupLayout();
+  nsCOMPtr<nsBoxLayout> layout = NS_NewGridRowGroupLayout();
   if (!layout) {
     return nsnull;
   }
diff --git a/layout/xul/base/src/grid/nsGridRowGroupFrame.h b/layout/xul/base/src/grid/nsGridRowGroupFrame.h
index 05870e2a44c4..419107f9b93e 100644
--- a/layout/xul/base/src/grid/nsGridRowGroupFrame.h
+++ b/layout/xul/base/src/grid/nsGridRowGroupFrame.h
@@ -68,7 +68,7 @@ public:
 
   nsGridRowGroupFrame(nsIPresShell* aPresShell,
                       nsStyleContext* aContext,
-                      nsIBoxLayout* aLayoutManager):
+                      nsBoxLayout* aLayoutManager):
     nsBoxFrame(aPresShell, aContext, PR_FALSE, aLayoutManager) {}
 
   virtual nscoord GetFlex(nsBoxLayoutState& aBoxLayoutState);
diff --git a/layout/xul/base/src/grid/nsGridRowGroupLayout.cpp b/layout/xul/base/src/grid/nsGridRowGroupLayout.cpp
index 415e5974ebd9..038c8c629c1b 100644
--- a/layout/xul/base/src/grid/nsGridRowGroupLayout.cpp
+++ b/layout/xul/base/src/grid/nsGridRowGroupLayout.cpp
@@ -54,9 +54,9 @@
 #include "nsGridLayout2.h"
 #include "nsGridRow.h"
 
-already_AddRefed<nsIBoxLayout> NS_NewGridRowGroupLayout()
+already_AddRefed<nsBoxLayout> NS_NewGridRowGroupLayout()
 {
-  nsIBoxLayout* layout = new nsGridRowGroupLayout();
+  nsBoxLayout* layout = new nsGridRowGroupLayout();
   NS_IF_ADDREF(layout);
   return layout;
 } 
diff --git a/layout/xul/base/src/grid/nsGridRowGroupLayout.h b/layout/xul/base/src/grid/nsGridRowGroupLayout.h
index 563b0ea4f210..55c2f20ccad1 100644
--- a/layout/xul/base/src/grid/nsGridRowGroupLayout.h
+++ b/layout/xul/base/src/grid/nsGridRowGroupLayout.h
@@ -48,13 +48,13 @@
 #include "nsGridRowLayout.h"
 
 /**
- * The nsIBoxLayout implementation for nsGridRowGroupFrame.
+ * The nsBoxLayout implementation for nsGridRowGroupFrame.
  */
 class nsGridRowGroupLayout : public nsGridRowLayout
 {
 public:
 
-  friend already_AddRefed<nsIBoxLayout> NS_NewGridRowGroupLayout();
+  friend already_AddRefed<nsBoxLayout> NS_NewGridRowGroupLayout();
 
   virtual nsGridRowGroupLayout* CastToRowGroupLayout() { return this; }
   virtual nsSize GetMinSize(nsIBox* aBox, nsBoxLayoutState& aBoxLayoutState);
diff --git a/layout/xul/base/src/grid/nsGridRowLayout.cpp b/layout/xul/base/src/grid/nsGridRowLayout.cpp
index fbe4bc22421b..317d2ecbb5fd 100644
--- a/layout/xul/base/src/grid/nsGridRowLayout.cpp
+++ b/layout/xul/base/src/grid/nsGridRowLayout.cpp
@@ -128,7 +128,7 @@ nsGridRowLayout::GetGrid(nsIBox* aBox, PRInt32* aIndex, nsGridRowLayout* aReques
      // if there is a scrollframe walk inside it to its child
      nsIBox* childBox = nsGrid::GetScrolledBox(child);
 
-     nsIBoxLayout* layout = childBox->GetLayoutManager();
+     nsBoxLayout* layout = childBox->GetLayoutManager();
      nsIGridPart* gridRow = nsGrid::GetPartFromBox(childBox);
      if (gridRow) 
      {
diff --git a/layout/xul/base/src/grid/nsGridRowLayout.h b/layout/xul/base/src/grid/nsGridRowLayout.h
index 9060660388c9..d84f1d3c1581 100644
--- a/layout/xul/base/src/grid/nsGridRowLayout.h
+++ b/layout/xul/base/src/grid/nsGridRowLayout.h
@@ -53,8 +53,8 @@ class nsBoxLayoutState;
 class nsGrid;
 
 /**
- * A common base class for nsGridRowLeafLayout (the nsIBoxLayout object
- * for a grid row or column) and nsGridRowGroupLayout (the nsIBoxLayout
+ * A common base class for nsGridRowLeafLayout (the nsBoxLayout object
+ * for a grid row or column) and nsGridRowGroupLayout (the nsBoxLayout
  * object for a grid row group or column group).
  */
 // XXXldb This needs a name that indicates that it's a base class for
diff --git a/layout/xul/base/src/grid/nsGridRowLeafFrame.cpp b/layout/xul/base/src/grid/nsGridRowLeafFrame.cpp
index 1d6ca0cc1bef..f0aba6f16cea 100644
--- a/layout/xul/base/src/grid/nsGridRowLeafFrame.cpp
+++ b/layout/xul/base/src/grid/nsGridRowLeafFrame.cpp
@@ -48,13 +48,13 @@
 #include "nsBoxLayoutState.h"
 #include "nsGridLayout2.h"
 
-already_AddRefed<nsIBoxLayout> NS_NewGridRowLeafLayout();
+already_AddRefed<nsBoxLayout> NS_NewGridRowLeafLayout();
 
 nsIFrame*
 NS_NewGridRowLeafFrame(nsIPresShell* aPresShell,
                        nsStyleContext* aContext)
 {
-  nsCOMPtr<nsIBoxLayout> layout = NS_NewGridRowLeafLayout();
+  nsCOMPtr<nsBoxLayout> layout = NS_NewGridRowLeafLayout();
   if (!layout) {
     return nsnull;
   }
diff --git a/layout/xul/base/src/grid/nsGridRowLeafFrame.h b/layout/xul/base/src/grid/nsGridRowLeafFrame.h
index ac8b2d0490b6..691c6cf9bf2d 100644
--- a/layout/xul/base/src/grid/nsGridRowLeafFrame.h
+++ b/layout/xul/base/src/grid/nsGridRowLeafFrame.h
@@ -73,7 +73,7 @@ public:
   nsGridRowLeafFrame(nsIPresShell* aPresShell,
                      nsStyleContext* aContext,
                      PRBool aIsRoot,
-                     nsIBoxLayout* aLayoutManager):
+                     nsBoxLayout* aLayoutManager):
     nsBoxFrame(aPresShell, aContext, aIsRoot, aLayoutManager) {}
 
   NS_IMETHOD GetBorderAndPadding(nsMargin& aBorderAndPadding);
diff --git a/layout/xul/base/src/grid/nsGridRowLeafLayout.cpp b/layout/xul/base/src/grid/nsGridRowLeafLayout.cpp
index b946f584554e..afdfab8e45f3 100644
--- a/layout/xul/base/src/grid/nsGridRowLeafLayout.cpp
+++ b/layout/xul/base/src/grid/nsGridRowLeafLayout.cpp
@@ -51,9 +51,9 @@
 #include "nsBoxFrame.h"
 #include "nsGridLayout2.h"
 
-already_AddRefed<nsIBoxLayout> NS_NewGridRowLeafLayout()
+already_AddRefed<nsBoxLayout> NS_NewGridRowLeafLayout()
 {
-  nsIBoxLayout* layout = new nsGridRowLeafLayout();
+  nsBoxLayout* layout = new nsGridRowLeafLayout();
   NS_IF_ADDREF(layout);
   return layout;
 } 
diff --git a/layout/xul/base/src/grid/nsGridRowLeafLayout.h b/layout/xul/base/src/grid/nsGridRowLeafLayout.h
index 61b3bf966a94..4866a7092024 100644
--- a/layout/xul/base/src/grid/nsGridRowLeafLayout.h
+++ b/layout/xul/base/src/grid/nsGridRowLeafLayout.h
@@ -49,7 +49,7 @@
 #include "nsCOMPtr.h"
 
 /**
- * The nsIBoxLayout implementation for nsGridRowLeafFrame.
+ * The nsBoxLayout implementation for nsGridRowLeafFrame.
  */
 // XXXldb This needs a better name that indicates that it's for any grid
 // row.
@@ -57,7 +57,7 @@ class nsGridRowLeafLayout : public nsGridRowLayout
 {
 public:
 
-  friend already_AddRefed<nsIBoxLayout> NS_NewGridRowLeafLayout();
+  friend already_AddRefed<nsBoxLayout> NS_NewGridRowLeafLayout();
 
   virtual nsSize GetPrefSize(nsIBox* aBox, nsBoxLayoutState& aBoxLayoutState);
   virtual nsSize GetMinSize(nsIBox* aBox, nsBoxLayoutState& aBoxLayoutState);
diff --git a/layout/xul/base/src/grid/nsIGridPart.h b/layout/xul/base/src/grid/nsIGridPart.h
index 16547b443a30..b07d1c316303 100644
--- a/layout/xul/base/src/grid/nsIGridPart.h
+++ b/layout/xul/base/src/grid/nsIGridPart.h
@@ -53,7 +53,7 @@ class nsGridLayout2;
   { 0xb3, 0x6c, 0x69, 0xf7, 0xc1, 0x95, 0x67, 0x7b } }
 
 /**
- * An additional interface implemented by nsIBoxLayout implementations
+ * An additional interface implemented by nsBoxLayout implementations
  * for parts of a grid (excluding cells, which are not special).
  */
 class nsIGridPart : public nsISupports {
diff --git a/layout/xul/base/src/nsBox.cpp b/layout/xul/base/src/nsBox.cpp
index 945c402ecfce..dd89935b220a 100644
--- a/layout/xul/base/src/nsBox.cpp
+++ b/layout/xul/base/src/nsBox.cpp
@@ -53,7 +53,7 @@
 #include "nsIDocument.h"
 #include "nsITheme.h"
 #include "nsIServiceManager.h"
-#include "nsIBoxLayout.h"
+#include "nsBoxLayout.h"
 #include "FrameLayerBuilder.h"
 
 using namespace mozilla;
diff --git a/layout/xul/base/src/nsBoxFrame.cpp b/layout/xul/base/src/nsBoxFrame.cpp
index 31aca4ca690e..e911003a19ad 100644
--- a/layout/xul/base/src/nsBoxFrame.cpp
+++ b/layout/xul/base/src/nsBoxFrame.cpp
@@ -78,7 +78,7 @@
 #include "nsIPresShell.h"
 #include "nsCSSRendering.h"
 #include "nsIServiceManager.h"
-#include "nsIBoxLayout.h"
+#include "nsBoxLayout.h"
 #include "nsSprocketLayout.h"
 #include "nsIDocument.h"
 #include "nsIScrollableFrame.h"
@@ -120,7 +120,7 @@ nsIBox* nsBoxFrame::mDebugChild = nsnull;
 #endif
 
 nsIFrame*
-NS_NewBoxFrame(nsIPresShell* aPresShell, nsStyleContext* aContext, PRBool aIsRoot, nsIBoxLayout* aLayoutManager)
+NS_NewBoxFrame(nsIPresShell* aPresShell, nsStyleContext* aContext, PRBool aIsRoot, nsBoxLayout* aLayoutManager)
 {
   return new (aPresShell) nsBoxFrame(aPresShell, aContext, aIsRoot, aLayoutManager);
 }
@@ -136,7 +136,7 @@ NS_IMPL_FRAMEARENA_HELPERS(nsBoxFrame)
 nsBoxFrame::nsBoxFrame(nsIPresShell* aPresShell,
                        nsStyleContext* aContext,
                        PRBool aIsRoot,
-                       nsIBoxLayout* aLayoutManager) :
+                       nsBoxLayout* aLayoutManager) :
   nsContainerFrame(aContext)
 {
   mState |= NS_STATE_IS_HORIZONTAL;
@@ -149,7 +149,7 @@ nsBoxFrame::nsBoxFrame(nsIPresShell* aPresShell,
   mHalign = hAlign_Left;
   
   // if no layout manager specified us the static sprocket layout
-  nsCOMPtr<nsIBoxLayout> layout = aLayoutManager;
+  nsCOMPtr<nsBoxLayout> layout = aLayoutManager;
 
   if (layout == nsnull) {
     NS_NewSprocketLayout(aPresShell, layout);
diff --git a/layout/xul/base/src/nsBoxFrame.h b/layout/xul/base/src/nsBoxFrame.h
index 47481966f7f1..b76bc4bd5a76 100644
--- a/layout/xul/base/src/nsBoxFrame.h
+++ b/layout/xul/base/src/nsBoxFrame.h
@@ -71,7 +71,7 @@ class nsBoxLayoutState;
 nsIFrame* NS_NewBoxFrame(nsIPresShell* aPresShell,
                          nsStyleContext* aContext,
                          PRBool aIsRoot,
-                         nsIBoxLayout* aLayoutManager);
+                         nsBoxLayout* aLayoutManager);
 nsIFrame* NS_NewBoxFrame(nsIPresShell* aPresShell,
                          nsStyleContext* aContext);
 
@@ -83,7 +83,7 @@ public:
   friend nsIFrame* NS_NewBoxFrame(nsIPresShell* aPresShell, 
                                   nsStyleContext* aContext,
                                   PRBool aIsRoot,
-                                  nsIBoxLayout* aLayoutManager);
+                                  nsBoxLayout* aLayoutManager);
   friend nsIFrame* NS_NewBoxFrame(nsIPresShell* aPresShell,
                                   nsStyleContext* aContext);
 
@@ -91,8 +91,8 @@ public:
   // call this method to get the rect so you don't draw on the debug border or outer border.
 
   // ------ nsIBox -------------
-  virtual void SetLayoutManager(nsIBoxLayout* aLayout) { mLayoutManager = aLayout; }
-  virtual nsIBoxLayout* GetLayoutManager() { return mLayoutManager; }
+  virtual void SetLayoutManager(nsBoxLayout* aLayout) { mLayoutManager = aLayout; }
+  virtual nsBoxLayout* GetLayoutManager() { return mLayoutManager; }
 
   NS_IMETHOD RelayoutChildAtOrdinal(nsBoxLayoutState& aState, nsIBox* aChild);
 
@@ -181,7 +181,7 @@ public:
 
   virtual ~nsBoxFrame();
   
-  nsBoxFrame(nsIPresShell* aPresShell, nsStyleContext* aContext, PRBool aIsRoot = PR_FALSE, nsIBoxLayout* aLayoutManager = nsnull);
+  nsBoxFrame(nsIPresShell* aPresShell, nsStyleContext* aContext, PRBool aIsRoot = PR_FALSE, nsBoxLayout* aLayoutManager = nsnull);
 
   // virtual so nsStackFrame, nsButtonBoxFrame, nsSliderFrame and nsMenuFrame
   // can override it
@@ -240,7 +240,7 @@ protected:
     nscoord mFlex;
     nscoord mAscent;
 
-    nsCOMPtr<nsIBoxLayout> mLayoutManager;
+    nsCOMPtr<nsBoxLayout> mLayoutManager;
 
 protected:
     nsresult RegUnregAccessKey(PRBool aDoReg);
diff --git a/layout/xul/base/src/nsBoxLayout.cpp b/layout/xul/base/src/nsBoxLayout.cpp
index 50f66d9136ae..fd04a8ed51af 100644
--- a/layout/xul/base/src/nsBoxLayout.cpp
+++ b/layout/xul/base/src/nsBoxLayout.cpp
@@ -44,17 +44,10 @@
 //
 
 #include "nsBox.h"
-#include "nsPresContext.h"
 #include "nsCOMPtr.h"
-#include "nsIContent.h"
 #include "nsHTMLContainerFrame.h"
-#include "nsIFrame.h"
 #include "nsBoxLayout.h"
 
-nsBoxLayout::nsBoxLayout()
-{
-}
-
 void
 nsBoxLayout::AddBorderAndPadding(nsIBox* aBox, nsSize& aSize)
 {
@@ -131,42 +124,4 @@ nsBoxLayout::AddSmallestSize(nsSize& aSize, const nsSize& aSize2)
      aSize.height = aSize2.height;
 }
 
-void
-nsBoxLayout::ChildrenInserted(nsIBox* aBox, nsBoxLayoutState& aState,
-                              nsIBox* aPrevBox,
-                              const nsFrameList::Slice& aNewChildren)
-{
-}
-
-void
-nsBoxLayout::ChildrenAppended(nsIBox* aBox, nsBoxLayoutState& aState,
-                              const nsFrameList::Slice& aNewChildren)
-{
-}
-
-void
-nsBoxLayout::ChildrenRemoved(nsIBox* aBox, nsBoxLayoutState& aState, nsIBox* aChildList)
-{
-}
-
-void
-nsBoxLayout::ChildrenSet(nsIBox* aBox, nsBoxLayoutState& aState, nsIBox* aChildList)
-{
-}
-
-void
-nsBoxLayout::IntrinsicWidthsDirty(nsIBox* aBox, nsBoxLayoutState& aState)
-{
-}
-
-// nsISupports
-NS_IMPL_ADDREF(nsBoxLayout)
-NS_IMPL_RELEASE(nsBoxLayout)
-
-//
-// QueryInterface
-//
-NS_INTERFACE_MAP_BEGIN(nsBoxLayout)
-  NS_INTERFACE_MAP_ENTRY(nsIBoxLayout)
-  NS_INTERFACE_MAP_ENTRY(nsISupports)
-NS_INTERFACE_MAP_END
+NS_IMPL_ISUPPORTS1(nsBoxLayout, nsBoxLayout)
diff --git a/layout/xul/base/src/nsBoxLayout.h b/layout/xul/base/src/nsBoxLayout.h
index fe054bb1f8dd..de3d5ef2733c 100644
--- a/layout/xul/base/src/nsBoxLayout.h
+++ b/layout/xul/base/src/nsBoxLayout.h
@@ -38,17 +38,26 @@
 #ifndef nsBoxLayout_h___
 #define nsBoxLayout_h___
 
-#include "nsIBoxLayout.h"
+#include "nsISupports.h"
+#include "nsIFrame.h"
 
-class nsBoxLayout : public nsIBoxLayout {
+#define NS_BOX_LAYOUT_IID \
+{ 0x09d522a7, 0x304c, 0x4137, \
+ { 0xaf, 0xc9, 0xe0, 0x80, 0x2e, 0x89, 0xb7, 0xe8 } }
+
+class nsIGridPart;
+
+class nsBoxLayout : public nsISupports {
 
 public:
 
-  nsBoxLayout();
+  nsBoxLayout() {}
   virtual ~nsBoxLayout() {}
 
   NS_DECL_ISUPPORTS
 
+  NS_DECLARE_STATIC_IID_ACCESSOR(NS_BOX_LAYOUT_IID)
+
   NS_IMETHOD Layout(nsIBox* aBox, nsBoxLayoutState& aState);
 
   virtual nsSize GetPrefSize(nsIBox* aBox, nsBoxLayoutState& aBoxLayoutState);
@@ -57,12 +66,12 @@ public:
   virtual nscoord GetAscent(nsIBox* aBox, nsBoxLayoutState& aBoxLayoutState);
   virtual void ChildrenInserted(nsIBox* aBox, nsBoxLayoutState& aState,
                                 nsIBox* aPrevBox,
-                                const nsFrameList::Slice& aNewChildren);
+                                const nsFrameList::Slice& aNewChildren) {}
   virtual void ChildrenAppended(nsIBox* aBox, nsBoxLayoutState& aState,
-                                const nsFrameList::Slice& aNewChildren);
-  virtual void ChildrenRemoved(nsIBox* aBox, nsBoxLayoutState& aState, nsIBox* aChildList);
-  virtual void ChildrenSet(nsIBox* aBox, nsBoxLayoutState& aState, nsIBox* aChildList);
-  virtual void IntrinsicWidthsDirty(nsIBox* aBox, nsBoxLayoutState& aState);
+                                const nsFrameList::Slice& aNewChildren) {}
+  virtual void ChildrenRemoved(nsIBox* aBox, nsBoxLayoutState& aState, nsIBox* aChildList) {}
+  virtual void ChildrenSet(nsIBox* aBox, nsBoxLayoutState& aState, nsIBox* aChildList) {}
+  virtual void IntrinsicWidthsDirty(nsIBox* aBox, nsBoxLayoutState& aState) {}
 
   virtual void AddBorderAndPadding(nsIBox* aBox, nsSize& aSize);
   virtual void AddMargin(nsIBox* aChild, nsSize& aSize);
@@ -74,5 +83,7 @@ public:
   static void AddSmallestSize(nsSize& aSize, const nsSize& aToAdd);
 };
 
+NS_DEFINE_STATIC_IID_ACCESSOR(nsBoxLayout, NS_BOX_LAYOUT_IID)
+
 #endif
 
diff --git a/layout/xul/base/src/nsDeckFrame.cpp b/layout/xul/base/src/nsDeckFrame.cpp
index e23b41940c3c..01b921cc697a 100644
--- a/layout/xul/base/src/nsDeckFrame.cpp
+++ b/layout/xul/base/src/nsDeckFrame.cpp
@@ -70,7 +70,7 @@ NS_IMPL_FRAMEARENA_HELPERS(nsDeckFrame)
 nsDeckFrame::nsDeckFrame(nsIPresShell* aPresShell, nsStyleContext* aContext)
   : nsBoxFrame(aPresShell, aContext), mIndex(0)
 {
-  nsCOMPtr<nsIBoxLayout> layout;
+  nsCOMPtr<nsBoxLayout> layout;
   NS_NewStackLayout(aPresShell, layout);
   SetLayoutManager(layout);
 }
diff --git a/layout/xul/base/src/nsIBoxLayout.h b/layout/xul/base/src/nsIBoxLayout.h
deleted file mode 100644
index 63a03e84611d..000000000000
--- a/layout/xul/base/src/nsIBoxLayout.h
+++ /dev/null
@@ -1,85 +0,0 @@
-/* -*- Mode: C++; tab-width: 2; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
-/* ***** BEGIN LICENSE BLOCK *****
- * Version: MPL 1.1/GPL 2.0/LGPL 2.1
- *
- * The contents of this file are subject to the Mozilla Public License Version
- * 1.1 (the "License"); you may not use this file except in compliance with
- * the License. You may obtain a copy of the License at
- * http://www.mozilla.org/MPL/
- *
- * Software distributed under the License is distributed on an "AS IS" basis,
- * WITHOUT WARRANTY OF ANY KIND, either express or implied. See the License
- * for the specific language governing rights and limitations under the
- * License.
- *
- * The Original Code is Mozilla Communicator client code.
- *
- * The Initial Developer of the Original Code is
- * Netscape Communications Corporation.
- * Portions created by the Initial Developer are Copyright (C) 1998
- * the Initial Developer. All Rights Reserved.
- *
- * Contributor(s):
- *
- * Alternatively, the contents of this file may be used under the terms of
- * either of the GNU General Public License Version 2 or later (the "GPL"),
- * or the GNU Lesser General Public License Version 2.1 or later (the "LGPL"),
- * in which case the provisions of the GPL or the LGPL are applicable instead
- * of those above. If you wish to allow use of your version of this file only
- * under the terms of either the GPL or the LGPL, and not to allow others to
- * use your version of this file under the terms of the MPL, indicate your
- * decision by deleting the provisions above and replace them with the notice
- * and other provisions required by the GPL or the LGPL. If you do not delete
- * the provisions above, a recipient may use your version of this file under
- * the terms of any one of the MPL, the GPL or the LGPL.
- *
- * ***** END LICENSE BLOCK ***** */
-
-#ifndef nsIBoxLayout_h___
-#define nsIBoxLayout_h___
-
-#include "nsISupports.h"
-#include "nsIFrame.h"
-
-class nsBoxLayout;
-class nsBoxLayoutState;
-class nsRenderingContext;
-class nsIGridPart;
-struct nsRect;
-
-// 6a529924-c73d-4fae-af7a-0e8084e701d5
-#define NS_IBOX_LAYOUT_IID \
-{ 0x6a529924, 0xc73d, 0x4fae, \
- { 0xaf, 0x7a, 0x0e, 0x80, 0x84, 0xe7, 0x01, 0xd5 } }
-
-class nsIBoxLayout : public nsISupports {
-
-public:
-
-  NS_DECLARE_STATIC_IID_ACCESSOR(NS_IBOX_LAYOUT_IID)
-
-  NS_IMETHOD Layout(nsIBox* aBox, nsBoxLayoutState& aState)=0;
-
-  virtual nsSize GetPrefSize(nsIBox* aBox, nsBoxLayoutState& aBoxLayoutState)=0;
-  virtual nsSize GetMinSize(nsIBox* aBox, nsBoxLayoutState& aBoxLayoutState)=0;
-  virtual nsSize GetMaxSize(nsIBox* aBox, nsBoxLayoutState& aBoxLayoutState)=0;
-  virtual nscoord GetAscent(nsIBox* aBox, nsBoxLayoutState& aBoxLayoutState)=0;
-
-  // FIXME: Bug 507416.  The Children* notifications don't actually
-  // use all those arguments.  Can we just simplify the signatures?
-  virtual void ChildrenInserted(nsIBox* aBox, nsBoxLayoutState& aState,
-                                nsIBox* aPrevBox,
-                                const nsFrameList::Slice& aNewChildren)=0;
-  virtual void ChildrenAppended(nsIBox* aBox, nsBoxLayoutState& aState,
-                                const nsFrameList::Slice& aNewChildren)=0;
-  virtual void ChildrenRemoved(nsIBox* aBox, nsBoxLayoutState& aState, nsIBox* aChildList)=0;
-  virtual void ChildrenSet(nsIBox* aBox, nsBoxLayoutState& aState, nsIBox* aChildList)=0;
-  virtual void IntrinsicWidthsDirty(nsIBox* aBox, nsBoxLayoutState& aState)=0;
-
-  // Returns this if it is an nsIGridPart, not refcounted
-  virtual nsIGridPart* AsGridPart() = 0;
-};
-
-NS_DEFINE_STATIC_IID_ACCESSOR(nsIBoxLayout, NS_IBOX_LAYOUT_IID)
-
-#endif
diff --git a/layout/xul/base/src/nsIScrollbarFrame.h b/layout/xul/base/src/nsIScrollbarFrame.h
deleted file mode 100644
index 6783c868bef3..000000000000
--- a/layout/xul/base/src/nsIScrollbarFrame.h
+++ /dev/null
@@ -1,59 +0,0 @@
-/* -*- Mode: C++; tab-width: 2; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
-/* ***** BEGIN LICENSE BLOCK *****
- * Version: MPL 1.1/GPL 2.0/LGPL 2.1
- *
- * The contents of this file are subject to the Mozilla Public License Version
- * 1.1 (the "License"); you may not use this file except in compliance with
- * the License. You may obtain a copy of the License at
- * http://www.mozilla.org/MPL/
- *
- * Software distributed under the License is distributed on an "AS IS" basis,
- * WITHOUT WARRANTY OF ANY KIND, either express or implied. See the License
- * for the specific language governing rights and limitations under the
- * License.
- *
- * The Original Code is Mozilla Communicator client code.
- *
- * The Initial Developer of the Original Code is
- * Netscape Communications Corporation.
- * Portions created by the Initial Developer are Copyright (C) 1998
- * the Initial Developer. All Rights Reserved.
- *
- * Contributor(s):
- *   Original Author: David W. Hyatt (hyatt@netscape.com)
- *
- * Alternatively, the contents of this file may be used under the terms of
- * either of the GNU General Public License Version 2 or later (the "GPL"),
- * or the GNU Lesser General Public License Version 2.1 or later (the "LGPL"),
- * in which case the provisions of the GPL or the LGPL are applicable instead
- * of those above. If you wish to allow use of your version of this file only
- * under the terms of either the GPL or the LGPL, and not to allow others to
- * use your version of this file under the terms of the MPL, indicate your
- * decision by deleting the provisions above and replace them with the notice
- * and other provisions required by the GPL or the LGPL. If you do not delete
- * the provisions above, a recipient may use your version of this file under
- * the terms of any one of the MPL, the GPL or the LGPL.
- *
- * ***** END LICENSE BLOCK ***** */
-
-#ifndef nsIScrollbarFrame_h___
-#define nsIScrollbarFrame_h___
-
-#include "nsQueryFrame.h"
-
-class nsIScrollbarMediator;
-
-class nsIScrollbarFrame : public nsQueryFrame
-{
-public:
-  NS_DECL_QUERYFRAME_TARGET(nsIScrollbarFrame)
-  
-  // Sets the scrollbar mediator content. We will try to get its primary frame
-  // and then QI that to nsIScrollbarMediator as necessary.
-  virtual void SetScrollbarMediatorContent(nsIContent* aMediator) = 0;
-
-  // Do NOT hold on to this.
-  virtual nsIScrollbarMediator* GetScrollbarMediator() = 0;
-};
-
-#endif
diff --git a/layout/xul/base/src/nsListBoxBodyFrame.cpp b/layout/xul/base/src/nsListBoxBodyFrame.cpp
index 30d99d1fe5e7..7876b3216daa 100644
--- a/layout/xul/base/src/nsListBoxBodyFrame.cpp
+++ b/layout/xul/base/src/nsListBoxBodyFrame.cpp
@@ -54,7 +54,7 @@
 #include "nsIDOMNodeList.h"
 #include "nsCSSFrameConstructor.h"
 #include "nsIScrollableFrame.h"
-#include "nsIScrollbarFrame.h"
+#include "nsScrollbarFrame.h"
 #include "nsIView.h"
 #include "nsIViewManager.h"
 #include "nsStyleContext.h"
@@ -164,7 +164,7 @@ NS_IMPL_ISUPPORTS1(nsListScrollSmoother, nsITimerCallback)
 
 nsListBoxBodyFrame::nsListBoxBodyFrame(nsIPresShell* aPresShell,
                                        nsStyleContext* aContext,
-                                       nsIBoxLayout* aLayoutManager)
+                                       nsBoxLayout* aLayoutManager)
   : nsBoxFrame(aPresShell, aContext, PR_FALSE, aLayoutManager),
     mTopFrame(nsnull),
     mBottomFrame(nsnull),
@@ -214,8 +214,8 @@ nsListBoxBodyFrame::Init(nsIContent*     aContent,
   nsIScrollableFrame* scrollFrame = nsLayoutUtils::GetScrollableFrameFor(this);
   if (scrollFrame) {
     nsIBox* verticalScrollbar = scrollFrame->GetScrollbarBox(PR_TRUE);
-    if (verticalScrollbar) {
-      nsIScrollbarFrame* scrollbarFrame = do_QueryFrame(verticalScrollbar);
+    nsScrollbarFrame* scrollbarFrame = do_QueryFrame(verticalScrollbar);
+    if (scrollbarFrame) {
       scrollbarFrame->SetScrollbarMediatorContent(GetContent());
     }
   }
@@ -353,7 +353,7 @@ nsListBoxBodyFrame::GetPrefSize(nsBoxLayoutState& aBoxLayoutState)
 ///////////// nsIScrollbarMediator ///////////////
 
 NS_IMETHODIMP
-nsListBoxBodyFrame::PositionChanged(nsIScrollbarFrame* aScrollbar, PRInt32 aOldIndex, PRInt32& aNewIndex)
+nsListBoxBodyFrame::PositionChanged(nsScrollbarFrame* aScrollbar, PRInt32 aOldIndex, PRInt32& aNewIndex)
 { 
   if (mScrolling || mRowHeight == 0)
     return NS_OK;
@@ -423,7 +423,7 @@ nsListBoxBodyFrame::VisibilityChanged(PRBool aVisible)
 }
 
 NS_IMETHODIMP
-nsListBoxBodyFrame::ScrollbarButtonPressed(nsIScrollbarFrame* aScrollbar, PRInt32 aOldIndex, PRInt32 aNewIndex)
+nsListBoxBodyFrame::ScrollbarButtonPressed(nsScrollbarFrame* aScrollbar, PRInt32 aOldIndex, PRInt32 aNewIndex)
 {
   if (aOldIndex == aNewIndex)
     return NS_OK;
@@ -1508,12 +1508,12 @@ nsListBoxBodyFrame::RemoveChildFrame(nsBoxLayoutState &aState,
 
 // Creation Routines ///////////////////////////////////////////////////////////////////////
 
-already_AddRefed<nsIBoxLayout> NS_NewListBoxLayout();
+already_AddRefed<nsBoxLayout> NS_NewListBoxLayout();
 
 nsIFrame*
 NS_NewListBoxBodyFrame(nsIPresShell* aPresShell, nsStyleContext* aContext)
 {
-  nsCOMPtr<nsIBoxLayout> layout = NS_NewListBoxLayout();
+  nsCOMPtr<nsBoxLayout> layout = NS_NewListBoxLayout();
   if (!layout) {
     return nsnull;
   }
diff --git a/layout/xul/base/src/nsListBoxBodyFrame.h b/layout/xul/base/src/nsListBoxBodyFrame.h
index e221af1e427b..d7679be991c6 100644
--- a/layout/xul/base/src/nsListBoxBodyFrame.h
+++ b/layout/xul/base/src/nsListBoxBodyFrame.h
@@ -60,7 +60,7 @@ class nsListBoxBodyFrame : public nsBoxFrame,
                            public nsIReflowCallback
 {
   nsListBoxBodyFrame(nsIPresShell* aPresShell, nsStyleContext* aContext,
-                     nsIBoxLayout* aLayoutManager);
+                     nsBoxLayout* aLayoutManager);
   virtual ~nsListBoxBodyFrame();
 
 public:
@@ -90,8 +90,8 @@ public:
   NS_IMETHOD AttributeChanged(PRInt32 aNameSpaceID, nsIAtom* aAttribute, PRInt32 aModType);
 
   // nsIScrollbarMediator
-  NS_IMETHOD PositionChanged(nsIScrollbarFrame* aScrollbar, PRInt32 aOldIndex, PRInt32& aNewIndex);
-  NS_IMETHOD ScrollbarButtonPressed(nsIScrollbarFrame* aScrollbar, PRInt32 aOldIndex, PRInt32 aNewIndex);
+  NS_IMETHOD PositionChanged(nsScrollbarFrame* aScrollbar, PRInt32 aOldIndex, PRInt32& aNewIndex);
+  NS_IMETHOD ScrollbarButtonPressed(nsScrollbarFrame* aScrollbar, PRInt32 aOldIndex, PRInt32 aNewIndex);
   NS_IMETHOD VisibilityChanged(PRBool aVisible);
 
   // nsIReflowCallback
diff --git a/layout/xul/base/src/nsListBoxLayout.cpp b/layout/xul/base/src/nsListBoxLayout.cpp
index c05eead0d66d..662287fe4719 100644
--- a/layout/xul/base/src/nsListBoxLayout.cpp
+++ b/layout/xul/base/src/nsListBoxLayout.cpp
@@ -53,7 +53,7 @@ nsListBoxLayout::nsListBoxLayout() : nsGridRowGroupLayout()
 {
 }
 
-////////// nsIBoxLayout //////////////
+////////// nsBoxLayout //////////////
 
 nsSize
 nsListBoxLayout::GetPrefSize(nsIBox* aBox, nsBoxLayoutState& aBoxLayoutState)
@@ -242,9 +242,9 @@ nsListBoxLayout::LayoutInternal(nsIBox* aBox, nsBoxLayoutState& aState)
 
 // Creation Routines ///////////////////////////////////////////////////////////////////////
 
-already_AddRefed<nsIBoxLayout> NS_NewListBoxLayout()
+already_AddRefed<nsBoxLayout> NS_NewListBoxLayout()
 {
-  nsIBoxLayout* layout = new nsListBoxLayout();
+  nsBoxLayout* layout = new nsListBoxLayout();
   NS_IF_ADDREF(layout);
   return layout;
 } 
diff --git a/layout/xul/base/src/nsListBoxLayout.h b/layout/xul/base/src/nsListBoxLayout.h
index 7050f3c56eb3..aad501c0a657 100644
--- a/layout/xul/base/src/nsListBoxLayout.h
+++ b/layout/xul/base/src/nsListBoxLayout.h
@@ -50,7 +50,7 @@ class nsListBoxLayout : public nsGridRowGroupLayout
 public:
   nsListBoxLayout();
 
-  // nsIBoxLayout
+  // nsBoxLayout
   NS_IMETHOD Layout(nsIBox* aBox, nsBoxLayoutState& aState);
   virtual nsSize GetPrefSize(nsIBox* aBox, nsBoxLayoutState& aBoxLayoutState);
   virtual nsSize GetMinSize(nsIBox* aBox, nsBoxLayoutState& aBoxLayoutState);
diff --git a/layout/xul/base/src/nsListItemFrame.cpp b/layout/xul/base/src/nsListItemFrame.cpp
index b866eba9f070..037308cbce5f 100644
--- a/layout/xul/base/src/nsListItemFrame.cpp
+++ b/layout/xul/base/src/nsListItemFrame.cpp
@@ -43,12 +43,12 @@
 #include "nsINameSpaceManager.h" 
 #include "nsGkAtoms.h"
 #include "nsDisplayList.h"
-#include "nsIBoxLayout.h"
+#include "nsBoxLayout.h"
 
 nsListItemFrame::nsListItemFrame(nsIPresShell* aPresShell,
                                  nsStyleContext* aContext,
                                  PRBool aIsRoot,
-                                 nsIBoxLayout* aLayoutManager)
+                                 nsBoxLayout* aLayoutManager)
   : nsGridRowLeafFrame(aPresShell, aContext, aIsRoot, aLayoutManager) 
 {
 }
@@ -85,12 +85,12 @@ nsListItemFrame::BuildDisplayListForChildren(nsDisplayListBuilder*   aBuilder,
 
 // Creation Routine ///////////////////////////////////////////////////////////////////////
 
-already_AddRefed<nsIBoxLayout> NS_NewGridRowLeafLayout();
+already_AddRefed<nsBoxLayout> NS_NewGridRowLeafLayout();
 
 nsIFrame*
 NS_NewListItemFrame(nsIPresShell* aPresShell, nsStyleContext* aContext)
 {
-  nsCOMPtr<nsIBoxLayout> layout = NS_NewGridRowLeafLayout();
+  nsCOMPtr<nsBoxLayout> layout = NS_NewGridRowLeafLayout();
   if (!layout) {
     return nsnull;
   }
diff --git a/layout/xul/base/src/nsListItemFrame.h b/layout/xul/base/src/nsListItemFrame.h
index 5e89e4321753..60f4c26f3e29 100644
--- a/layout/xul/base/src/nsListItemFrame.h
+++ b/layout/xul/base/src/nsListItemFrame.h
@@ -64,7 +64,7 @@ protected:
   nsListItemFrame(nsIPresShell* aPresShell,
                   nsStyleContext *aContext,
                   PRBool aIsRoot = nsnull,
-                  nsIBoxLayout* aLayoutManager = nsnull);
+                  nsBoxLayout* aLayoutManager = nsnull);
   virtual ~nsListItemFrame();
 
 }; // class nsListItemFrame
diff --git a/layout/xul/base/src/nsMenuFrame.cpp b/layout/xul/base/src/nsMenuFrame.cpp
index 205cf1ecc76c..442ef8104e7d 100644
--- a/layout/xul/base/src/nsMenuFrame.cpp
+++ b/layout/xul/base/src/nsMenuFrame.cpp
@@ -213,7 +213,7 @@ NS_NewMenuItemFrame(nsIPresShell* aPresShell, nsStyleContext* aContext)
 NS_IMPL_FRAMEARENA_HELPERS(nsMenuFrame)
 
 NS_QUERYFRAME_HEAD(nsMenuFrame)
-  NS_QUERYFRAME_ENTRY(nsIMenuFrame)
+  NS_QUERYFRAME_ENTRY(nsMenuFrame)
 NS_QUERYFRAME_TAIL_INHERITING(nsBoxFrame)
 
 //
diff --git a/layout/xul/base/src/nsMenuFrame.h b/layout/xul/base/src/nsMenuFrame.h
index fdc34c614f86..6d9516bf833c 100644
--- a/layout/xul/base/src/nsMenuFrame.h
+++ b/layout/xul/base/src/nsMenuFrame.h
@@ -51,7 +51,6 @@
 #include "nsFrameList.h"
 #include "nsGkAtoms.h"
 #include "nsMenuParent.h"
-#include "nsIMenuFrame.h"
 #include "nsXULPopupManager.h"
 #include "nsITimer.h"
 #include "nsIDOMText.h"
@@ -75,6 +74,12 @@ enum nsMenuType {
   eMenuType_Radio = 2
 };
 
+enum nsMenuListType {
+  eNotMenuList,      // not a menulist
+  eReadonlyMenuList, // <menulist/>
+  eEditableMenuList  // <menulist editable="true"/>
+};
+
 class nsMenuFrame;
 
 /**
@@ -101,12 +106,12 @@ private:
   nsMenuFrame* mFrame;
 };
 
-class nsMenuFrame : public nsBoxFrame, 
-                    public nsIMenuFrame
+class nsMenuFrame : public nsBoxFrame
 {
 public:
   nsMenuFrame(nsIPresShell* aShell, nsStyleContext* aContext);
 
+  NS_DECL_QUERYFRAME_TARGET(nsMenuFrame)
   NS_DECL_QUERYFRAME
   NS_DECL_FRAMEARENA_HELPERS
 
@@ -185,11 +190,11 @@ public:
 
   // nsMenuFrame methods 
 
-  virtual PRBool IsOnMenuBar() { return mMenuParent && mMenuParent->IsMenuBar(); }
-  virtual PRBool IsOnActiveMenuBar() { return IsOnMenuBar() && mMenuParent->IsActive(); }
+  PRBool IsOnMenuBar() { return mMenuParent && mMenuParent->IsMenuBar(); }
+  PRBool IsOnActiveMenuBar() { return IsOnMenuBar() && mMenuParent->IsActive(); }
   virtual PRBool IsOpen();
   virtual PRBool IsMenu();
-  virtual nsMenuListType GetParentMenuListType();
+  nsMenuListType GetParentMenuListType();
   PRBool IsDisabled();
   void ToggleMenuState();
 
diff --git a/layout/xul/base/src/nsMenuPopupFrame.cpp b/layout/xul/base/src/nsMenuPopupFrame.cpp
index 72c72e13a0d1..998b659177e0 100644
--- a/layout/xul/base/src/nsMenuPopupFrame.cpp
+++ b/layout/xul/base/src/nsMenuPopupFrame.cpp
@@ -74,7 +74,6 @@
 #include "nsContentUtils.h"
 #include "nsCSSFrameConstructor.h"
 #include "nsEventStateManager.h"
-#include "nsIBoxLayout.h"
 #include "nsIPopupBoxObject.h"
 #include "nsPIWindowRoot.h"
 #include "nsIReflowCallback.h"
diff --git a/layout/xul/base/src/nsRootBoxFrame.cpp b/layout/xul/base/src/nsRootBoxFrame.cpp
index 281ce625d6c3..ed39330d6386 100644
--- a/layout/xul/base/src/nsRootBoxFrame.cpp
+++ b/layout/xul/base/src/nsRootBoxFrame.cpp
@@ -149,7 +149,7 @@ nsRootBoxFrame::nsRootBoxFrame(nsIPresShell* aShell, nsStyleContext* aContext):
 {
   mPopupSetFrame = nsnull;
 
-  nsCOMPtr<nsIBoxLayout> layout;
+  nsCOMPtr<nsBoxLayout> layout;
   NS_NewStackLayout(aShell, layout);
   SetLayoutManager(layout);
 }
diff --git a/layout/xul/base/src/nsScrollbarButtonFrame.cpp b/layout/xul/base/src/nsScrollbarButtonFrame.cpp
index 47da72bf2260..4b04c3a1530b 100644
--- a/layout/xul/base/src/nsScrollbarButtonFrame.cpp
+++ b/layout/xul/base/src/nsScrollbarButtonFrame.cpp
@@ -49,7 +49,7 @@
 #include "nsINameSpaceManager.h"
 #include "nsGkAtoms.h"
 #include "nsSliderFrame.h"
-#include "nsIScrollbarFrame.h"
+#include "nsScrollbarFrame.h"
 #include "nsIScrollbarMediator.h"
 #include "nsRepeatService.h"
 #include "nsGUIEvent.h"
@@ -245,7 +245,7 @@ nsScrollbarButtonFrame::DoButtonAction(PRBool aSmoothScroll)
   else if (curpos > maxpos)
     curpos = maxpos;
 
-  nsIScrollbarFrame* sb = do_QueryFrame(scrollbar);
+  nsScrollbarFrame* sb = do_QueryFrame(scrollbar);
   if (sb) {
     nsIScrollbarMediator* m = sb->GetScrollbarMediator();
     if (m) {
diff --git a/layout/xul/base/src/nsScrollbarFrame.cpp b/layout/xul/base/src/nsScrollbarFrame.cpp
index 3b11bf56ad39..69ece5a2d359 100644
--- a/layout/xul/base/src/nsScrollbarFrame.cpp
+++ b/layout/xul/base/src/nsScrollbarFrame.cpp
@@ -62,7 +62,7 @@ NS_NewScrollbarFrame (nsIPresShell* aPresShell, nsStyleContext* aContext)
 NS_IMPL_FRAMEARENA_HELPERS(nsScrollbarFrame)
 
 NS_QUERYFRAME_HEAD(nsScrollbarFrame)
-  NS_QUERYFRAME_ENTRY(nsIScrollbarFrame)
+  NS_QUERYFRAME_ENTRY(nsScrollbarFrame)
 NS_QUERYFRAME_TAIL_INHERITING(nsBoxFrame)
 
 NS_IMETHODIMP
@@ -129,11 +129,7 @@ nsScrollbarFrame::AttributeChanged(PRInt32 aNameSpaceID,
   if (aAttribute != nsGkAtoms::curpos)
     return rv;
 
-  nsIFrame* parent = GetParent();
-  if (!parent)
-    return rv;
-
-  nsIScrollableFrame* scrollable = do_QueryFrame(parent);
+  nsIScrollableFrame* scrollable = do_QueryFrame(GetParent());
   if (!scrollable)
     return rv;
 
@@ -170,16 +166,12 @@ nsScrollbarFrame::GetScrollbarMediator()
   if (!mScrollbarMediator)
     return nsnull;
   nsIFrame* f = mScrollbarMediator->GetPrimaryFrame();
-  if (!f)
-    return nsnull;
 
   // check if the frame is a scroll frame. If so, get the scrollable frame
   // inside it.
   nsIScrollableFrame* scrollFrame = do_QueryFrame(f);
   if (scrollFrame) {
     f = scrollFrame->GetScrolledFrame();
-    if (!f)
-      return nsnull;
   }
 
   nsIScrollbarMediator* sbm = do_QueryFrame(f);
diff --git a/layout/xul/base/src/nsScrollbarFrame.h b/layout/xul/base/src/nsScrollbarFrame.h
index 925690b0532b..c5d75f632d32 100644
--- a/layout/xul/base/src/nsScrollbarFrame.h
+++ b/layout/xul/base/src/nsScrollbarFrame.h
@@ -43,18 +43,19 @@
 #define nsScrollbarFrame_h__
 
 #include "nsBoxFrame.h"
-#include "nsIScrollbarFrame.h"
 
 class nsIScrollbarMediator;
 
 nsIFrame* NS_NewScrollbarFrame(nsIPresShell* aPresShell, nsStyleContext* aContext);
 
-class nsScrollbarFrame : public nsBoxFrame, public nsIScrollbarFrame
+class nsScrollbarFrame : public nsBoxFrame
 {
 public:
     nsScrollbarFrame(nsIPresShell* aShell, nsStyleContext* aContext):
       nsBoxFrame(aShell, aContext), mScrollbarMediator(nsnull) {}
 
+  NS_DECL_QUERYFRAME_TARGET(nsScrollbarFrame)
+
 #ifdef DEBUG
   NS_IMETHOD GetFrameName(nsAString& aResult) const {
     return MakeFrameName(NS_LITERAL_STRING("ScrollbarFrame"), aResult);
@@ -91,9 +92,8 @@ public:
 
   virtual nsIAtom* GetType() const;  
 
-  // nsIScrollbarFrame
-  virtual void SetScrollbarMediatorContent(nsIContent* aMediator);
-  virtual nsIScrollbarMediator* GetScrollbarMediator();
+  void SetScrollbarMediatorContent(nsIContent* aMediator);
+  nsIScrollbarMediator* GetScrollbarMediator();
 
   // nsBox methods
 
diff --git a/layout/xul/base/src/nsSliderFrame.cpp b/layout/xul/base/src/nsSliderFrame.cpp
index d332a1ac1fbe..7bb773ccb6c7 100644
--- a/layout/xul/base/src/nsSliderFrame.cpp
+++ b/layout/xul/base/src/nsSliderFrame.cpp
@@ -60,7 +60,7 @@
 #include "nsScrollbarButtonFrame.h"
 #include "nsISliderListener.h"
 #include "nsIScrollbarMediator.h"
-#include "nsIScrollbarFrame.h"
+#include "nsScrollbarFrame.h"
 #include "nsILookAndFeel.h"
 #include "nsRepeatService.h"
 #include "nsBoxLayoutState.h"
@@ -297,7 +297,7 @@ nsSliderFrame::AttributeChanged(PRInt32 aNameSpaceID,
             current = max;
 
         // set the new position and notify observers
-        nsIScrollbarFrame* scrollbarFrame = do_QueryFrame(scrollbarBox);
+        nsScrollbarFrame* scrollbarFrame = do_QueryFrame(scrollbarBox);
         if (scrollbarFrame) {
           nsIScrollbarMediator* mediator = scrollbarFrame->GetScrollbarMediator();
           if (mediator) {
@@ -812,7 +812,7 @@ nsSliderFrame::SetCurrentPositionInternal(nsIContent* aScrollbar, PRInt32 aNewPo
 
   mUserChanged = PR_TRUE;
 
-  nsIScrollbarFrame* scrollbarFrame = do_QueryFrame(scrollbarBox);
+  nsScrollbarFrame* scrollbarFrame = do_QueryFrame(scrollbarBox);
   if (scrollbarFrame) {
     // See if we have a mediator.
     nsIScrollbarMediator* mediator = scrollbarFrame->GetScrollbarMediator();
diff --git a/layout/xul/base/src/nsSprocketLayout.cpp b/layout/xul/base/src/nsSprocketLayout.cpp
index 5ec8744ebcd3..9fe12cb2a0e1 100644
--- a/layout/xul/base/src/nsSprocketLayout.cpp
+++ b/layout/xul/base/src/nsSprocketLayout.cpp
@@ -54,7 +54,7 @@
 #include "nsBoxFrame.h"
 #include "nsBoxFrame.h"
 
-nsIBoxLayout* nsSprocketLayout::gInstance = nsnull;
+nsBoxLayout* nsSprocketLayout::gInstance = nsnull;
 
 //#define DEBUG_GROW
 
@@ -64,7 +64,7 @@ nsIBoxLayout* nsSprocketLayout::gInstance = nsnull;
 
 
 nsresult
-NS_NewSprocketLayout( nsIPresShell* aPresShell, nsCOMPtr<nsIBoxLayout>& aNewLayout)
+NS_NewSprocketLayout( nsIPresShell* aPresShell, nsCOMPtr<nsBoxLayout>& aNewLayout)
 {
   if (!nsSprocketLayout::gInstance) {
     nsSprocketLayout::gInstance = new nsSprocketLayout();
diff --git a/layout/xul/base/src/nsSprocketLayout.h b/layout/xul/base/src/nsSprocketLayout.h
index 87952301e755..b8b75432d762 100644
--- a/layout/xul/base/src/nsSprocketLayout.h
+++ b/layout/xul/base/src/nsSprocketLayout.h
@@ -89,13 +89,13 @@ public:
 
 #define SET_COORD(aX, aY, coord, isHorizontal) if (isHorizontal) { aX = (coord); } else { aY  = (coord); }
 
-nsresult NS_NewSprocketLayout(nsIPresShell* aPresShell, nsCOMPtr<nsIBoxLayout>& aNewLayout);
+nsresult NS_NewSprocketLayout(nsIPresShell* aPresShell, nsCOMPtr<nsBoxLayout>& aNewLayout);
 
 class nsSprocketLayout : public nsBoxLayout {
 
 public:
 
-  friend nsresult NS_NewSprocketLayout(nsIPresShell* aPresShell, nsCOMPtr<nsIBoxLayout>& aNewLayout);
+  friend nsresult NS_NewSprocketLayout(nsIPresShell* aPresShell, nsCOMPtr<nsBoxLayout>& aNewLayout);
   static void Shutdown();
 
   NS_IMETHOD Layout(nsIBox* aBox, nsBoxLayoutState& aState);
@@ -162,8 +162,8 @@ private:
 
 
   // because the sprocket layout manager has no instance variables. We 
-  // can make a static on and reuse it everywhere.
-  static nsIBoxLayout* gInstance;
+  // can make a static one and reuse it everywhere.
+  static nsBoxLayout* gInstance;
 
 };
 
diff --git a/layout/xul/base/src/nsStackFrame.cpp b/layout/xul/base/src/nsStackFrame.cpp
index 1f3048056ed4..0f1c77c4add4 100644
--- a/layout/xul/base/src/nsStackFrame.cpp
+++ b/layout/xul/base/src/nsStackFrame.cpp
@@ -64,7 +64,7 @@ NS_IMPL_FRAMEARENA_HELPERS(nsStackFrame)
 nsStackFrame::nsStackFrame(nsIPresShell* aPresShell, nsStyleContext* aContext):
   nsBoxFrame(aPresShell, aContext)
 {
-  nsCOMPtr<nsIBoxLayout> layout;
+  nsCOMPtr<nsBoxLayout> layout;
   NS_NewStackLayout(aPresShell, layout);
   SetLayoutManager(layout);
 }
diff --git a/layout/xul/base/src/nsStackLayout.cpp b/layout/xul/base/src/nsStackLayout.cpp
index 80a55205a0b9..e58e982095a6 100644
--- a/layout/xul/base/src/nsStackLayout.cpp
+++ b/layout/xul/base/src/nsStackLayout.cpp
@@ -52,7 +52,7 @@
 #include "nsIContent.h"
 #include "nsINameSpaceManager.h"
 
-nsIBoxLayout* nsStackLayout::gInstance = nsnull;
+nsBoxLayout* nsStackLayout::gInstance = nsnull;
 
 #define SPECIFIED_LEFT (1 << NS_SIDE_LEFT)
 #define SPECIFIED_RIGHT (1 << NS_SIDE_RIGHT)
@@ -60,7 +60,7 @@ nsIBoxLayout* nsStackLayout::gInstance = nsnull;
 #define SPECIFIED_BOTTOM (1 << NS_SIDE_BOTTOM)
 
 nsresult
-NS_NewStackLayout( nsIPresShell* aPresShell, nsCOMPtr<nsIBoxLayout>& aNewLayout)
+NS_NewStackLayout( nsIPresShell* aPresShell, nsCOMPtr<nsBoxLayout>& aNewLayout)
 {
   if (!nsStackLayout::gInstance) {
     nsStackLayout::gInstance = new nsStackLayout();
diff --git a/layout/xul/base/src/nsStackLayout.h b/layout/xul/base/src/nsStackLayout.h
index 81d21e2cc1c7..4bdfaf894f71 100644
--- a/layout/xul/base/src/nsStackLayout.h
+++ b/layout/xul/base/src/nsStackLayout.h
@@ -50,13 +50,13 @@
 #include "nsBoxLayout.h"
 #include "nsCOMPtr.h"
 
-nsresult NS_NewStackLayout(nsIPresShell* aPresShell, nsCOMPtr<nsIBoxLayout>& aNewLayout);
+nsresult NS_NewStackLayout(nsIPresShell* aPresShell, nsCOMPtr<nsBoxLayout>& aNewLayout);
 
 class nsStackLayout : public nsBoxLayout
 {
 public:
 
-  friend nsresult NS_NewStackLayout(nsIPresShell* aPresShell, nsCOMPtr<nsIBoxLayout>& aNewLayout);
+  friend nsresult NS_NewStackLayout(nsIPresShell* aPresShell, nsCOMPtr<nsBoxLayout>& aNewLayout);
   static void Shutdown();
 
   nsStackLayout();
@@ -75,7 +75,7 @@ public:
   static PRUint8 GetOffset(nsBoxLayoutState& aState, nsIBox* aChild, nsMargin& aMargin);
 
 private:
-  static nsIBoxLayout* gInstance;
+  static nsBoxLayout* gInstance;
 
 }; // class nsStackLayout
 
diff --git a/layout/xul/base/src/nsTextBoxFrame.cpp b/layout/xul/base/src/nsTextBoxFrame.cpp
index 8a13282e2eba..0a4ce1ea7394 100644
--- a/layout/xul/base/src/nsTextBoxFrame.cpp
+++ b/layout/xul/base/src/nsTextBoxFrame.cpp
@@ -555,32 +555,28 @@ nsTextBoxFrame::DrawText(nsRenderingContext& aRenderingContext,
 
     if (mState & NS_FRAME_IS_BIDI) {
       presContext->SetBidiEnabled();
-      nsBidiPresUtils* bidiUtils = presContext->GetBidiUtils();
-
-      if (bidiUtils) {
-        const nsStyleVisibility* vis = GetStyleVisibility();
-        nsBidiDirection direction = (NS_STYLE_DIRECTION_RTL == vis->mDirection) ? NSBIDI_RTL : NSBIDI_LTR;
-        if (mAccessKeyInfo && mAccessKeyInfo->mAccesskeyIndex != kNotFound) {
-           // We let the RenderText function calculate the mnemonic's
-           // underline position for us.
-           nsBidiPositionResolve posResolve;
-           posResolve.logicalIndex = mAccessKeyInfo->mAccesskeyIndex;
-           rv = bidiUtils->RenderText(mCroppedTitle.get(), mCroppedTitle.Length(), direction,
-                                      presContext, aRenderingContext,
-                                      *refContext,
-                                      aTextRect.x, baseline,
-                                      &posResolve,
-                                      1);
-           mAccessKeyInfo->mBeforeWidth = posResolve.visualLeftTwips;
-           mAccessKeyInfo->mAccessWidth = posResolve.visualWidth;
-        }
-        else
-        {
-           rv = bidiUtils->RenderText(mCroppedTitle.get(), mCroppedTitle.Length(), direction,
-                                      presContext, aRenderingContext,
-                                      *refContext,
-                                      aTextRect.x, baseline);
-        }
+      const nsStyleVisibility* vis = GetStyleVisibility();
+      nsBidiDirection direction = (NS_STYLE_DIRECTION_RTL == vis->mDirection) ? NSBIDI_RTL : NSBIDI_LTR;
+      if (mAccessKeyInfo && mAccessKeyInfo->mAccesskeyIndex != kNotFound) {
+          // We let the RenderText function calculate the mnemonic's
+          // underline position for us.
+          nsBidiPositionResolve posResolve;
+          posResolve.logicalIndex = mAccessKeyInfo->mAccesskeyIndex;
+          rv = nsBidiPresUtils::RenderText(mCroppedTitle.get(), mCroppedTitle.Length(), direction,
+                                           presContext, aRenderingContext,
+                                           *refContext,
+                                           aTextRect.x, baseline,
+                                           &posResolve,
+                                           1);
+          mAccessKeyInfo->mBeforeWidth = posResolve.visualLeftTwips;
+          mAccessKeyInfo->mAccessWidth = posResolve.visualWidth;
+      }
+      else
+      {
+          rv = nsBidiPresUtils::RenderText(mCroppedTitle.get(), mCroppedTitle.Length(), direction,
+                                           presContext, aRenderingContext,
+                                           *refContext,
+                                           aTextRect.x, baseline);
       }
     }
     if (NS_FAILED(rv) )
diff --git a/layout/xul/base/src/tree/src/nsTreeBodyFrame.cpp b/layout/xul/base/src/tree/src/nsTreeBodyFrame.cpp
index b0bef65f6ea5..dbad2203484d 100644
--- a/layout/xul/base/src/tree/src/nsTreeBodyFrame.cpp
+++ b/layout/xul/base/src/tree/src/nsTreeBodyFrame.cpp
@@ -105,7 +105,7 @@
 #include "nsRenderingContext.h"
 
 #ifdef IBMBIDI
-#include "nsBidiPresUtils.h"
+#include "nsBidiUtils.h"
 #endif
 
 // Enumeration function that cancels all the image requests in our cache
@@ -842,7 +842,7 @@ FindScrollParts(nsIFrame* aCurrFrame, nsTreeBodyFrame::ScrollParts* aResult)
     }
   }
   
-  nsIScrollbarFrame *sf = do_QueryFrame(aCurrFrame);
+  nsScrollbarFrame *sf = do_QueryFrame(aCurrFrame);
   if (sf) {
     if (!aCurrFrame->IsHorizontal()) {
       if (!aResult->mVScrollbar) {
@@ -4148,7 +4148,7 @@ nsTreeBodyFrame::ScrollHorzInternal(const ScrollParts& aParts, PRInt32 aPosition
 }
 
 NS_IMETHODIMP
-nsTreeBodyFrame::ScrollbarButtonPressed(nsIScrollbarFrame* aScrollbar, PRInt32 aOldIndex, PRInt32 aNewIndex)
+nsTreeBodyFrame::ScrollbarButtonPressed(nsScrollbarFrame* aScrollbar, PRInt32 aOldIndex, PRInt32 aNewIndex)
 {
   ScrollParts parts = GetScrollParts();
 
@@ -4167,7 +4167,7 @@ nsTreeBodyFrame::ScrollbarButtonPressed(nsIScrollbarFrame* aScrollbar, PRInt32 a
 }
   
 NS_IMETHODIMP
-nsTreeBodyFrame::PositionChanged(nsIScrollbarFrame* aScrollbar, PRInt32 aOldIndex, PRInt32& aNewIndex)
+nsTreeBodyFrame::PositionChanged(nsScrollbarFrame* aScrollbar, PRInt32 aOldIndex, PRInt32& aNewIndex)
 {
   ScrollParts parts = GetScrollParts();
   
diff --git a/layout/xul/base/src/tree/src/nsTreeBodyFrame.h b/layout/xul/base/src/tree/src/nsTreeBodyFrame.h
index 2b2d6a5eec00..b0633503edb9 100644
--- a/layout/xul/base/src/tree/src/nsTreeBodyFrame.h
+++ b/layout/xul/base/src/tree/src/nsTreeBodyFrame.h
@@ -60,7 +60,7 @@
 #include "nsDataHashtable.h"
 #include "imgIRequest.h"
 #include "imgIDecoderObserver.h"
-#include "nsIScrollbarFrame.h"
+#include "nsScrollbarFrame.h"
 #include "nsThreadUtils.h"
 
 class nsOverflowChecker;
@@ -146,8 +146,8 @@ public:
   virtual PRBool PseudoMatches(nsCSSSelector* aSelector);
 
   // nsIScrollbarMediator
-  NS_IMETHOD PositionChanged(nsIScrollbarFrame* aScrollbar, PRInt32 aOldIndex, PRInt32& aNewIndex);
-  NS_IMETHOD ScrollbarButtonPressed(nsIScrollbarFrame* aScrollbar, PRInt32 aOldIndex, PRInt32 aNewIndex);
+  NS_IMETHOD PositionChanged(nsScrollbarFrame* aScrollbar, PRInt32 aOldIndex, PRInt32& aNewIndex);
+  NS_IMETHOD ScrollbarButtonPressed(nsScrollbarFrame* aScrollbar, PRInt32 aOldIndex, PRInt32 aNewIndex);
   NS_IMETHOD VisibilityChanged(PRBool aVisible) { Invalidate(); return NS_OK; }
 
   // Overridden from nsIFrame to cache our pres context.
@@ -173,9 +173,9 @@ public:
   friend class nsTreeColumn;
 
   struct ScrollParts {
-    nsIScrollbarFrame*   mVScrollbar;
+    nsScrollbarFrame*    mVScrollbar;
     nsCOMPtr<nsIContent> mVScrollbarContent;
-    nsIScrollbarFrame*   mHScrollbar;
+    nsScrollbarFrame*    mHScrollbar;
     nsCOMPtr<nsIContent> mHScrollbarContent;
     nsIFrame*            mColumnsFrame;
     nsIScrollableFrame*  mColumnsScrollFrame;
diff --git a/media/libvpx/Makefile.in b/media/libvpx/Makefile.in
index a5b455e91939..c4791945c0a7 100644
--- a/media/libvpx/Makefile.in
+++ b/media/libvpx/Makefile.in
@@ -236,7 +236,6 @@ CSRCS += \
   $(NULL)
 
 VPX_ASFILES = \
-  detokenize.asm \
   bilinearfilter_v6.asm \
   copymem8x4_v6.asm \
   copymem8x8_v6.asm \
@@ -304,16 +303,12 @@ GARBAGE += $(VPX_CONVERTED_ASFILES)
 vpx_asm_offsets.asm: vpx_asm_offsets.$(OBJ_SUFFIX) $(HOST_PROGRAM)
 	./$(HOST_PROGRAM) rvds $< | $(VPX_AS_CONVERSION) > $@
 
-detokenize.asm.$(OBJ_SUFFIX): vpx_asm_offsets.asm
-
 else
 ASFILES += $(VPX_ASFILES)
 
 vpx_asm_offsets.asm: vpx_asm_offsets.$(OBJ_SUFFIX) $(HOST_PROGRAM)
 	./$(HOST_PROGRAM) rvds $< > $@
 
-detokenize.$(OBJ_SUFFIX): vpx_asm_offsets.asm
-
 endif
 
 GARBAGE += vpx_asm_offsets.$(OBJ_SUFFIX) vpx_asm_offsets.asm
diff --git a/media/libvpx/vpx_config_arm-linux-gcc.h b/media/libvpx/vpx_config_arm-linux-gcc.h
index d51901ff8985..751b3f072d99 100644
--- a/media/libvpx/vpx_config_arm-linux-gcc.h
+++ b/media/libvpx/vpx_config_arm-linux-gcc.h
@@ -59,4 +59,4 @@
 #define CONFIG_REALTIME_ONLY 0
 #define CONFIG_SHARED 0
 #define CONFIG_SMALL 0
-#define CONFIG_ARM_ASM_DETOK 1
+#define CONFIG_ARM_ASM_DETOK 0
diff --git a/mobile/chrome/content/bindings/browser.js b/mobile/chrome/content/bindings/browser.js
index 9b6c90bb0339..2efffbe8a4a3 100644
--- a/mobile/chrome/content/bindings/browser.js
+++ b/mobile/chrome/content/bindings/browser.js
@@ -479,6 +479,10 @@ let DOMEvents =  {
           rel: target.rel,
           type: target.type
         };
+        
+        // rel=icon can also have a sizes attribute
+        if (target.hasAttribute("sizes"))
+          json.sizes = target.getAttribute("sizes");
 
         sendAsyncMessage("DOMLinkAdded", json);
         break;
diff --git a/mobile/chrome/content/browser-ui.js b/mobile/chrome/content/browser-ui.js
index 08fab028ffb7..1810e148eeb3 100644
--- a/mobile/chrome/content/browser-ui.js
+++ b/mobile/chrome/content/browser-ui.js
@@ -1039,17 +1039,31 @@ var BrowserUI = {
         break;
       case "DOMLinkAdded":
         // checks for an icon to use for a web app
-        // priority is : icon < apple-touch-icon
+        // apple-touch-icon size is 57px and default size is 16px
         let rel = json.rel.toLowerCase().split(" ");
-        if ((rel.indexOf("icon") != -1) && !browser.appIcon) {
-          // We should also use the sizes attribute if available
+        if (rel.indexOf("icon") != -1) {
+          // We use the sizes attribute if available
           // see http://www.whatwg.org/specs/web-apps/current-work/multipage/links.html#rel-icon
-          browser.appIcon = json.href;
+          let size = 16;
+          if (json.sizes) {
+            let sizes = json.sizes.toLowerCase().split(" ");
+            sizes.forEach(function(item) {
+              if (item != "any") {
+                let [w, h] = item.split("x");
+                size = Math.max(Math.min(w, h), size);
+              }
+            });
+          }
+          if (size > browser.appIcon.size) {
+            browser.appIcon.href = json.href;
+            browser.appIcon.size = size;
+          }
         }
-        else if (rel.indexOf("apple-touch-icon") != -1) {
+        else if ((rel.indexOf("apple-touch-icon") != -1) && (browser.appIcon.size < 57)) {
           // XXX should we support apple-touch-icon-precomposed ?
           // see http://developer.apple.com/safari/library/documentation/appleapplications/reference/safariwebcontent/configuringwebapplications/configuringwebapplications.html
-          browser.appIcon = json.href;
+          browser.appIcon.href = json.href;
+          browser.appIcon.size = 57;
         }
 
         // Handle favicon changes
diff --git a/mobile/chrome/content/browser.js b/mobile/chrome/content/browser.js
index 75a6e5f5119a..6b32da76bfdb 100644
--- a/mobile/chrome/content/browser.js
+++ b/mobile/chrome/content/browser.js
@@ -1493,7 +1493,7 @@ Browser.WebProgress.prototype = {
           tab.hostChanged = true;
           tab.browser.lastLocation = location;
           tab.browser.userTypedValue = "";
-          tab.browser.appIcon = null;
+          tab.browser.appIcon = { href: null, size:-1 };
 
 #ifdef MOZ_CRASH_REPORTER
           if (CrashReporter.enabled)
diff --git a/mobile/chrome/content/common-ui.js b/mobile/chrome/content/common-ui.js
index c6bae4c9f894..8a5ba196c360 100644
--- a/mobile/chrome/content/common-ui.js
+++ b/mobile/chrome/content/common-ui.js
@@ -1682,7 +1682,7 @@ var WebappsUI = {
     if (!aManifest) {
       // Try every way to get an icon
       let browser = Browser.selectedBrowser;
-      let icon = browser.appIcon;
+      let icon = browser.appIcon.href;
       if (!icon)
         icon = browser.mIconURL;
       if (!icon) 
@@ -1753,7 +1753,13 @@ var WebappsUI = {
   },
   
   updateWebappsInstall: function updateWebappsInstall(aNode) {
-    return !document.getElementById("main-window").hasAttribute("webapp");
+    if (document.getElementById("main-window").hasAttribute("webapp"))
+      return false;
+
+    let browser = Browser.selectedBrowser;
+
+    let webapp = Cc["@mozilla.org/webapps/support;1"].getService(Ci.nsIWebappsSupport);
+    return !(webapp && webapp.isApplicationInstalled(browser.currentURI.spec));
   },
   
   install: function(aURI, aTitle, aIcon) {
diff --git a/mobile/chrome/content/localePicker.js b/mobile/chrome/content/localePicker.js
index 75b322e93a46..aeede4d16085 100644
--- a/mobile/chrome/content/localePicker.js
+++ b/mobile/chrome/content/localePicker.js
@@ -317,16 +317,11 @@ function localesMatch(aLocale1, aLocale2) {
 function start() {
   let mouseModule = new MouseModule();
 
+  // if we have gotten this far, we can assume that we don't have anything matching the system
+  // locale and we should show the locale picker
   let chrome = Cc["@mozilla.org/chrome/chrome-registry;1"].getService(Ci.nsIXULChromeRegistry);
   chrome.QueryInterface(Ci.nsIToolkitChromeRegistry);
   let availableLocales = chrome.getLocalesForPackage("browser");
-
-  let localeService = Cc["@mozilla.org/intl/nslocaleservice;1"].getService(Ci.nsILocaleService);
-  let systemLocale = localeService.getSystemLocale().getCategory("NSILOCALE_CTYPE");
-  let matchingLocale = "";
-
-  let bestMatch = NO_MATCH;
-
   let strings = Services.strings.createBundle("chrome://browser/content/languages.properties");
   LocaleUI.availableLocales = [];
   while (availableLocales.hasMore()) {
@@ -336,24 +331,10 @@ function start() {
     try { label = strings.GetStringFromName(locale); }
     catch (e) { }
     LocaleUI.availableLocales.push({addon: { id: locale, name: label, targetLocale: locale }});
-
-    // see if we have a locale that looks like the system locale
-    // if it is not the current locale, switch to it
-    let match = localesMatch(systemLocale, locale);
-    if (match > bestMatch) {
-      bestMatch = match;
-      matchingLocale = locale;
-    }
   }
 
-  if (matchingLocale) {
-    if (matchingLocale != chrome.getSelectedLocale("browser"))
-      LocaleUI.language = matchingLocale;
-    LocaleUI.closeWindow();
-  } else {
-    LocaleUI._language = chrome.getSelectedLocale("browser");
-    LocaleUI.updateStrings();
-  }
+  LocaleUI._language = chrome.getSelectedLocale("browser");
+  LocaleUI.updateStrings();
 
   // update the page strings and show the correct page
   LocaleUI.defaultLanguage = LocaleUI._language;
diff --git a/mobile/components/BrowserCLH.js b/mobile/components/BrowserCLH.js
index 9c233c3524bb..e7b45fd40827 100644
--- a/mobile/components/BrowserCLH.js
+++ b/mobile/components/BrowserCLH.js
@@ -118,6 +118,23 @@ function showPanelWhenReady(aWindow, aPage) {
   }, false);
 }
 
+function haveSystemLocale() {
+  let chrome = Cc["@mozilla.org/chrome/chrome-registry;1"].getService(Ci.nsIXULChromeRegistry);
+  chrome.QueryInterface(Ci.nsIToolkitChromeRegistry);
+  let availableLocales = chrome.getLocalesForPackage("browser");
+
+  let localeService = Cc["@mozilla.org/intl/nslocaleservice;1"].getService(Ci.nsILocaleService);
+  let systemLocale = localeService.getSystemLocale().getCategory("NSILOCALE_CTYPE");
+  systemLocale = systemLocale.split("-")[0];
+  let systemLocaleRegEx = new RegExp("^" + systemLocale);
+
+  while (availableLocales.hasMore()) {
+    let locale = availableLocales.getNext();
+    if (systemLocaleRegEx.test(locale))
+      return true;
+  }
+  return false;
+}
 
 function BrowserCLH() { }
 
@@ -211,7 +228,8 @@ BrowserCLH.prototype = {
         }
 
         // Show the locale selector if we have a new profile
-        if (needHomepageOverride() == "new profile" && Services.prefs.getBoolPref("browser.firstrun.show.localepicker")) {
+        if (needHomepageOverride() == "new profile" && Services.prefs.getBoolPref("browser.firstrun.show.localepicker") && !haveSystemLocale()) {
+
           browserWin = openWindow(null, "chrome://browser/content/localePicker.xul", "_blank", "chrome,dialog=no,all", defaultURL);
           aCmdLine.preventDefault = true;
           return;
diff --git a/mobile/installer/package-manifest.in b/mobile/installer/package-manifest.in
index b2058ea6bd4b..747b3c61da72 100644
--- a/mobile/installer/package-manifest.in
+++ b/mobile/installer/package-manifest.in
@@ -103,7 +103,6 @@
 #else
 @BINPATH@/mozsqlt3@DLL_SUFFIX@
 #endif
-@BINPATH@/README.txt
 @BINPATH@/blocklist.xml
 #ifdef XP_UNIX
 @BINPATH@/run-mozilla.sh
diff --git a/mobile/installer/removed-files.in b/mobile/installer/removed-files.in
index 94bea4615a58..d97c1e9e5b04 100644
--- a/mobile/installer/removed-files.in
+++ b/mobile/installer/removed-files.in
@@ -1,3 +1,4 @@
+README.txt
 #if MOZ_UPDATE_CHANNEL != beta
 extensions/feedback@mobile.mozilla.org.xpi
 #endif
diff --git a/modules/libpref/src/init/all.js b/modules/libpref/src/init/all.js
index af3e9efc2f14..e597a2ac90c5 100644
--- a/modules/libpref/src/init/all.js
+++ b/modules/libpref/src/init/all.js
@@ -817,6 +817,10 @@ pref("network.websocket.extensions.stream-deflate", true);
 // one time.
 pref("network.websocket.max-connections", 200);
 
+// by default scripts loaded from a https:// origin can only open secure
+// (i.e. wss://) websockets.
+pref("network.websocket.allowInsecureFromHTTPS", false);
+
 // </ws>
 
 // Server-Sent Events
diff --git a/netwerk/base/public/nsINetworkLinkService.idl b/netwerk/base/public/nsINetworkLinkService.idl
index eabba888bd6c..3507eec685e0 100644
--- a/netwerk/base/public/nsINetworkLinkService.idl
+++ b/netwerk/base/public/nsINetworkLinkService.idl
@@ -42,9 +42,19 @@
 /**
  * Network link status monitoring service.
  */
-[scriptable, uuid(61618a52-ea91-4277-a4ab-ebe10d7b9a64)]
+[scriptable, uuid(f7d3be87-7403-4a1e-b89f-2797776e9b08)]
 interface nsINetworkLinkService : nsISupports
 {
+  /* Link type constants */
+  const unsigned long LINK_TYPE_UNKNOWN = 0;
+  const unsigned long LINK_TYPE_ETHERNET = 1;
+  const unsigned long LINK_TYPE_USB = 2;
+  const unsigned long LINK_TYPE_WIFI = 3;
+  const unsigned long LINK_TYPE_WIMAX = 4;
+  const unsigned long LINK_TYPE_2G = 5;
+  const unsigned long LINK_TYPE_3G = 6;
+  const unsigned long LINK_TYPE_4G = 7;
+
   /**
    * This is set to true when the system is believed to have a usable
    * network connection.
@@ -62,6 +72,11 @@ interface nsINetworkLinkService : nsISupports
    * This is set to true when we believe that isLinkUp is accurate.
    */
   readonly attribute boolean linkStatusKnown;
+
+  /**
+   * The type of network connection.
+   */
+  readonly attribute unsigned long linkType;
 };
 
 %{C++
@@ -85,4 +100,36 @@ interface nsINetworkLinkService : nsISupports
  * linkStatusKnown is now false.
  */
 #define NS_NETWORK_LINK_DATA_UNKNOWN "unknown"
+
+/**
+ * We send notifications through nsIObserverService with topic
+ * NS_NETWORK_LINK_TYPE_TOPIC whenever the network connection type
+ * changes. We pass one of the valid connection type constants
+ * below as the aData parameter of the notification.
+ */
+#define NS_NETWORK_LINK_TYPE_TOPIC "network:link-type-changed"
+
+/** We were unable to determine the network connection type */
+#define NS_NETWORK_LINK_TYPE_UNKNOWN  "unknown"
+
+/** A standard wired ethernet connection */
+#define NS_NETWORK_LINK_TYPE_ETHERNET    "ethernet"
+
+/** A connection via a USB port */
+#define NS_NETWORK_LINK_TYPE_USB    "usb"
+
+/** A connection via a WiFi access point (IEEE802.11) */
+#define NS_NETWORK_LINK_TYPE_WIFI "wifi"
+
+/** A connection via WiMax (IEEE802.16) */
+#define NS_NETWORK_LINK_TYPE_WIMAX "wimax"
+
+/** A '2G' mobile connection (e.g. GSM, GPRS, EDGE) */
+#define NS_NETWORK_LINK_TYPE_2G "2g"
+
+/** A '3G' mobile connection (e.g. UMTS, CDMA) */
+#define NS_NETWORK_LINK_TYPE_3G "3g"
+
+/** A '4G' mobile connection (e.g. LTE, UMB) */
+#define NS_NETWORK_LINK_TYPE_4G "4g"
 %}
diff --git a/netwerk/base/src/nsStandardURL.cpp b/netwerk/base/src/nsStandardURL.cpp
index dfae46aafc49..d9a591a09c30 100644
--- a/netwerk/base/src/nsStandardURL.cpp
+++ b/netwerk/base/src/nsStandardURL.cpp
@@ -484,6 +484,8 @@ nsStandardURL::AppendSegmentToBuf(char *buf, PRUint32 i, const char *str, URLSeg
             memcpy(buf + i, str + seg.mPos, seg.mLen);
         seg.mPos = i;
         i += seg.mLen;
+    } else {
+        seg.mPos = i;
     }
     return i;
 }
@@ -832,6 +834,8 @@ nsStandardURL::ParseURL(const char *spec, PRInt32 specLen)
 nsresult
 nsStandardURL::ParsePath(const char *spec, PRUint32 pathPos, PRInt32 pathLen)
 {
+    LOG(("ParsePath: %s pathpos %d len %d\n",spec,pathPos,pathLen));
+
     nsresult rv = mParser->ParsePath(spec + pathPos, pathLen,
                                      &mFilepath.mPos, &mFilepath.mLen,
                                      &mParam.mPos, &mParam.mLen,
diff --git a/netwerk/base/src/nsURLParsers.cpp b/netwerk/base/src/nsURLParsers.cpp
index 1c2032a78d7b..9ade45ce1e51 100644
--- a/netwerk/base/src/nsURLParsers.cpp
+++ b/netwerk/base/src/nsURLParsers.cpp
@@ -426,6 +426,8 @@ nsNoAuthURLParser::ParseAfterScheme(const char *spec, PRInt32 specLen,
 #if defined(XP_WIN) || defined(XP_OS2)
                 // if the authority looks like a drive number then we
                 // really want to treat it as part of the path
+                // [a-zA-Z][:|]{/\}
+                // i.e one of:   c:   c:\foo  c:/foo  c|  c|\foo  c|/foo
                 if ((specLen > 3) && (spec[3] == ':' || spec[3] == '|') &&
                     nsCRT::IsAsciiAlpha(spec[2]) &&
                     ((specLen == 4) || (spec[4] == '/') || (spec[4] == '\\'))) {
@@ -433,16 +435,17 @@ nsNoAuthURLParser::ParseAfterScheme(const char *spec, PRInt32 specLen,
                     break;  
                 } 
 #endif
-                p = (const char *) memchr(spec + 2, '/', specLen - 2);
+                // Ignore apparent authority; path is everything after it
+                for (p = spec + 2; p < spec + specLen; ++p) {
+                    if (*p == '/' || *p == '?' || *p == '#' || *p == ';')
+                        break;
+                }
             }
-            if (p) {
-                SET_RESULT(auth, 0, -1);
+            SET_RESULT(auth, 0, -1);
+            if (p && p != spec+specLen)
                 SET_RESULT(path, p - spec, specLen - (p - spec));
-            }
-            else {
-                SET_RESULT(auth, 0, -1);
+            else
                 SET_RESULT(path, 0, -1);
-            }
             return;
         }
     default:
diff --git a/netwerk/mime/nsMIMEHeaderParamImpl.cpp b/netwerk/mime/nsMIMEHeaderParamImpl.cpp
index d0c9fab98870..49a79a2d0665 100644
--- a/netwerk/mime/nsMIMEHeaderParamImpl.cpp
+++ b/netwerk/mime/nsMIMEHeaderParamImpl.cpp
@@ -221,6 +221,7 @@ nsMIMEHeaderParamImpl::GetParameterInternal(const char *aHeaderValue,
     const char *tokenEnd = 0;
     const char *valueStart = str;
     const char *valueEnd = 0;
+    PRBool seenEquals = PR_FALSE;
 
     NS_ASSERTION(!nsCRT::IsAsciiSpace(*str), "should be after whitespace.");
 
@@ -231,7 +232,10 @@ nsMIMEHeaderParamImpl::GetParameterInternal(const char *aHeaderValue,
 
     // Skip over whitespace, '=', and whitespace
     while (nsCRT::IsAsciiSpace(*str)) ++str;
-    if (*str == '=') ++str;
+    if (*str == '=') {
+      ++str;
+      seenEquals = PR_TRUE;
+    }
     while (nsCRT::IsAsciiSpace(*str)) ++str;
 
     PRBool needUnquote = PR_FALSE;
@@ -267,6 +271,7 @@ nsMIMEHeaderParamImpl::GetParameterInternal(const char *aHeaderValue,
     // a 'single' line value with no charset and lang.
     // If so, copy it and return.
     if (tokenEnd - tokenStart == paramLen &&
+        seenEquals &&
         !nsCRT::strncasecmp(tokenStart, aParamName, paramLen))
     {
       // if the parameter spans across multiple lines we have to strip out the
@@ -286,6 +291,7 @@ nsMIMEHeaderParamImpl::GetParameterInternal(const char *aHeaderValue,
     // case B, C, and D
     else if (tokenEnd - tokenStart > paramLen &&
              !nsCRT::strncasecmp(tokenStart, aParamName, paramLen) &&
+             seenEquals &&
              *(tokenStart + paramLen) == '*')
     {
       const char *cp = tokenStart + paramLen + 1; // 1st char pass '*'
diff --git a/netwerk/system/android/nsAndroidNetworkLinkService.cpp b/netwerk/system/android/nsAndroidNetworkLinkService.cpp
index b533586ffc00..1c6e55f87d24 100644
--- a/netwerk/system/android/nsAndroidNetworkLinkService.cpp
+++ b/netwerk/system/android/nsAndroidNetworkLinkService.cpp
@@ -70,3 +70,13 @@ nsAndroidNetworkLinkService::GetLinkStatusKnown(PRBool *aIsKnown)
   *aIsKnown = mozilla::AndroidBridge::Bridge()->IsNetworkLinkKnown();
   return NS_OK;
 }
+
+NS_IMETHODIMP
+nsAndroidNetworkLinkService::GetLinkType(PRUint32 *aLinkType)
+{
+  NS_ENSURE_ARG_POINTER(aLinkType);
+  NS_ENSURE_TRUE(mozilla::AndroidBridge::Bridge(), NS_ERROR_UNEXPECTED);
+
+  *aLinkType = mozilla::AndroidBridge::Bridge()->GetNetworkLinkType();
+  return NS_OK;
+}
diff --git a/netwerk/system/mac/nsNetworkLinkService.mm b/netwerk/system/mac/nsNetworkLinkService.mm
index 7a1c4d755966..ad31fc3e22f0 100644
--- a/netwerk/system/mac/nsNetworkLinkService.mm
+++ b/netwerk/system/mac/nsNetworkLinkService.mm
@@ -41,6 +41,7 @@
 #include "nsIObserverService.h"
 #include "nsServiceManagerUtils.h"
 #include "nsString.h"
+#include "nsCRT.h"
 
 #import <Cocoa/Cocoa.h>
 #import <netinet/in.h>
@@ -75,6 +76,16 @@ nsNetworkLinkService::GetLinkStatusKnown(PRBool *aIsUp)
     return NS_OK;
 }
 
+NS_IMETHODIMP
+nsNetworkLinkService::GetLinkType(PRUint32 *aLinkType)
+{
+  NS_ENSURE_ARG_POINTER(aLinkType);
+
+  // XXX This function has not yet been implemented for this platform
+  *aLinkType = nsINetworkLinkService::LINK_TYPE_UNKNOWN;
+  return NS_OK;
+}
+
 NS_IMETHODIMP
 nsNetworkLinkService::Observe(nsISupports *subject,
                               const char *topic,
diff --git a/netwerk/system/maemo/nsMaemoNetworkLinkService.cpp b/netwerk/system/maemo/nsMaemoNetworkLinkService.cpp
index d4d9a81e73b1..6abed897a6e7 100644
--- a/netwerk/system/maemo/nsMaemoNetworkLinkService.cpp
+++ b/netwerk/system/maemo/nsMaemoNetworkLinkService.cpp
@@ -43,6 +43,7 @@
 #include "nsString.h"
 #include "nsMaemoNetworkManager.h"
 #include "mozilla/Services.h"
+#include "nsCRT.h"
 
 NS_IMPL_ISUPPORTS2(nsMaemoNetworkLinkService,
                    nsINetworkLinkService,
@@ -70,6 +71,16 @@ nsMaemoNetworkLinkService::GetLinkStatusKnown(PRBool *aIsKnown)
   return NS_OK;
 }
 
+NS_IMETHODIMP
+nsMaemoNetworkLinkService::GetLinkType(PRUint32 *aLinkType)
+{
+  NS_ENSURE_ARG_POINTER(aLinkType);
+
+  // XXX This function has not yet been implemented for this platform
+  *aLinkType = nsINetworkLinkService::LINK_TYPE_UNKNOWN;
+  return NS_OK;
+}
+
 NS_IMETHODIMP
 nsMaemoNetworkLinkService::Observe(nsISupports *aSubject,
                                    const char *aTopic,
diff --git a/netwerk/system/qt/nsQtNetworkLinkService.cpp b/netwerk/system/qt/nsQtNetworkLinkService.cpp
index 15e6f617d6f7..589358f1a1a7 100644
--- a/netwerk/system/qt/nsQtNetworkLinkService.cpp
+++ b/netwerk/system/qt/nsQtNetworkLinkService.cpp
@@ -42,6 +42,7 @@
 #include "nsServiceManagerUtils.h"
 #include "nsString.h"
 #include "mozilla/Services.h"
+#include "nsCRT.h"
 
 NS_IMPL_ISUPPORTS2(nsQtNetworkLinkService,
                    nsINetworkLinkService,
@@ -69,6 +70,16 @@ nsQtNetworkLinkService::GetLinkStatusKnown(PRBool* aIsKnown)
   return NS_OK;
 }
 
+NS_IMETHODIMP
+nsQtNetworkLinkService::GetLinkType(PRUint32 *aLinkType)
+{
+  NS_ENSURE_ARG_POINTER(aLinkType);
+
+  // XXX This function has not yet been implemented for this platform
+  *aLinkType = nsINetworkLinkService::LINK_TYPE_UNKNOWN;
+  return NS_OK;
+}
+
 NS_IMETHODIMP
 nsQtNetworkLinkService::Observe(nsISupports* aSubject,
                                 const char* aTopic,
diff --git a/netwerk/system/win32/nsNotifyAddrListener.cpp b/netwerk/system/win32/nsNotifyAddrListener.cpp
index 2b091842e02d..a04d659e3391 100644
--- a/netwerk/system/win32/nsNotifyAddrListener.cpp
+++ b/netwerk/system/win32/nsNotifyAddrListener.cpp
@@ -54,6 +54,7 @@
 #include "nsString.h"
 #include "nsAutoPtr.h"
 #include "mozilla/Services.h"
+#include "nsCRT.h"
 
 #include <iptypes.h>
 #include <iphlpapi.h>
@@ -166,6 +167,16 @@ nsNotifyAddrListener::GetLinkStatusKnown(PRBool *aIsUp)
     return NS_OK;
 }
 
+NS_IMETHODIMP
+nsNotifyAddrListener::GetLinkType(PRUint32 *aLinkType)
+{
+  NS_ENSURE_ARG_POINTER(aLinkType);
+
+  // XXX This function has not yet been implemented for this platform
+  *aLinkType = nsINetworkLinkService::LINK_TYPE_UNKNOWN;
+  return NS_OK;
+}
+
 NS_IMETHODIMP
 nsNotifyAddrListener::Run()
 {
diff --git a/netwerk/test/unit/test_URIs.js b/netwerk/test/unit/test_URIs.js
index 2f7054a3567b..f35aa6364b64 100644
--- a/netwerk/test/unit/test_URIs.js
+++ b/netwerk/test/unit/test_URIs.js
@@ -1,6 +1,15 @@
 /* -*- Mode: Java; tab-width: 2; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
 Components.utils.import("resource://gre/modules/NetUtil.jsm");
 const Ci = Components.interfaces;
+const Cr = Components.results;
+
+var gIoService = Components.classes["@mozilla.org/network/io-service;1"]
+                           .getService(Components.interfaces.nsIIOService);
+
+
+// Relevant RFCs: 1738, 1808, 2396, 3986 (newer than the code)
+// http://greenbytes.de/tech/webdav/rfc3986.html#rfc.section.5.4
+// http://greenbytes.de/tech/tc/uris/
 
 // TEST DATA
 // ---------
@@ -29,12 +38,25 @@ var gTests = [
     path:    "text/html;charset=utf-8,<html></html>",
     ref:     "",
     nsIURL:  false, nsINestedURI: false },
+  { spec:    "data:text/html;charset=utf-8,<html>\r\n\t</html>",
+    scheme:  "data",
+    prePath: "data:",
+    path:    "text/html;charset=utf-8,<html></html>",
+    ref:     "",
+    nsIURL:  false, nsINestedURI: false },
   { spec:    "data:text/plain,hello world",
     scheme:  "data",
     prePath: "data:",
     path:    "text/plain,hello%20world",
     ref:     "",
     nsIURL:  false, nsINestedURI: false },
+  { spec:    "file:///dir/afile",
+    scheme:  "data",
+    prePath: "data:",
+    path:    "text/plain,2",
+    ref:     "",
+    relativeURI: "data:te\nxt/plain,2",
+    nsIURL:  false, nsINestedURI: false },
   { spec:    "file://",
     scheme:  "file",
     prePath: "file://",
@@ -53,6 +75,20 @@ var gTests = [
     path:    "/myFile.html",
     ref:     "",
     nsIURL:  true, nsINestedURI: false },
+  { spec:    "file:///dir/afile",
+    scheme:  "file",
+    prePath: "file://",
+    path:    "/dir/data/text/plain,2",
+    ref:     "",
+    relativeURI: "data/text/plain,2",
+    nsIURL:  true, nsINestedURI: false },
+  { spec:    "file:///dir/dir2/",
+    scheme:  "file",
+    prePath: "file://",
+    path:    "/dir/dir2/data/text/plain,2",
+    ref:     "",
+    relativeURI: "data/text/plain,2",
+    nsIURL:  true, nsINestedURI: false },
   { spec:    "ftp://",
     scheme:  "ftp",
     prePath: "ftp://",
@@ -74,6 +110,9 @@ var gTests = [
   { spec:    "ftp://foo:bar@ftp.mozilla.org:100/pub/mozilla.org/README",
     scheme:  "ftp",
     prePath: "ftp://foo:bar@ftp.mozilla.org:100",
+    port:    100,
+    username: "foo",
+    password: "bar",
     path:    "/pub/mozilla.org/README",
     ref:     "",
     nsIURL:  true, nsINestedURI: false },
@@ -101,6 +140,44 @@ var gTests = [
     path:    "/",
     ref:     "",
     nsIURL:  true, nsINestedURI: false },
+  { spec:    "http://www.exa\nmple.com/",
+    scheme:  "http",
+    prePath: "http://www.example.com",
+    path:    "/",
+    ref:     "",
+    nsIURL:  true, nsINestedURI: false },
+  { spec:    "http://10.32.4.239/",
+    scheme:  "http",
+    prePath: "http://10.32.4.239",
+    host:    "10.32.4.239",
+    path:    "/",
+    ref:     "",
+    nsIURL:  true, nsINestedURI: false },
+  { spec:    "http://[::192.9.5.5]/ipng",
+    scheme:  "http",
+    prePath: "http://[::192.9.5.5]",
+    host:    "::192.9.5.5",
+    path:    "/ipng",
+    ref:     "",
+    nsIURL:  true, nsINestedURI: false },
+  { spec:    "http://[FEDC:BA98:7654:3210:FEDC:BA98:7654:3210]:8888/index.html",
+    scheme:  "http",
+    prePath: "http://[fedc:ba98:7654:3210:fedc:ba98:7654:3210]:8888",
+    host:    "fedc:ba98:7654:3210:fedc:ba98:7654:3210",
+    port:    8888,
+    path:    "/index.html",
+    ref:     "",
+    nsIURL:  true, nsINestedURI: false },
+  { spec:    "http://bar:foo@www.mozilla.org:8080/pub/mozilla.org/README.html",
+    scheme:  "http",
+    prePath: "http://bar:foo@www.mozilla.org:8080",
+    port:    8080,
+    username: "bar",
+    password: "foo",
+    host:    "www.mozilla.org",
+    path:    "/pub/mozilla.org/README.html",
+    ref:     "",
+    nsIURL:  true, nsINestedURI: false },
   { spec:    "jar:resource://!/",
     scheme:  "jar",
     prePath: "jar:",
@@ -173,6 +250,284 @@ var gTests = [
     path:    "abc",
     ref:     "",
     nsIURL:  false, nsINestedURI: false },
+  { spec:    "http://www2.example.com/",
+    relativeURI: "a/b/c/d",
+    scheme:  "http",
+    prePath: "http://www2.example.com",
+    path:    "/a/b/c/d",
+    ref:     "",
+    nsIURL:  true, nsINestedURI: false },
+  // relative URL testcases from http://greenbytes.de/tech/webdav/rfc3986.html#rfc.section.5.4
+  { spec:    "http://a/b/c/d;p?q",
+    relativeURI: "g:h",
+    scheme:  "g",
+    prePath: "g:",
+    path:    "h",
+    ref:     "",
+    nsIURL:  false, nsINestedURI: false },
+  { spec:    "http://a/b/c/d;p?q",
+    relativeURI: "g",
+    scheme:  "http",
+    prePath: "http://a",
+    path:    "/b/c/g",
+    ref:     "",
+    nsIURL:  true, nsINestedURI: false },
+  { spec:    "http://a/b/c/d;p?q",
+    relativeURI: "./g",
+    scheme:  "http",
+    prePath: "http://a",
+    path:    "/b/c/g",
+    ref:     "",
+    nsIURL:  true, nsINestedURI: false },
+  { spec:    "http://a/b/c/d;p?q",
+    relativeURI: "g/",
+    scheme:  "http",
+    prePath: "http://a",
+    path:    "/b/c/g/",
+    ref:     "",
+    nsIURL:  true, nsINestedURI: false },
+  { spec:    "http://a/b/c/d;p?q",
+    relativeURI: "/g",
+    scheme:  "http",
+    prePath: "http://a",
+    path:    "/g",
+    ref:     "",
+    nsIURL:  true, nsINestedURI: false },
+  { spec:    "http://a/b/c/d;p?q",
+    relativeURI: "?y",
+    scheme:  "http",
+    prePath: "http://a",
+    path:    "/b/c/d;p?y",
+    ref:     "",// fix
+    nsIURL:  true, nsINestedURI: false },
+  { spec:    "http://a/b/c/d;p?q",
+    relativeURI: "g?y",
+    scheme:  "http",
+    prePath: "http://a",
+    path:    "/b/c/g?y",
+    ref:     "",// fix
+    nsIURL:  true, nsINestedURI: false },
+  { spec:    "http://a/b/c/d;p?q",
+    relativeURI: "#s",
+    scheme:  "http",
+    prePath: "http://a",
+    path:    "/b/c/d;p?q#s",
+    ref:     "s",// fix
+    nsIURL:  true, nsINestedURI: false },
+  { spec:    "http://a/b/c/d;p?q",
+    relativeURI: "g#s",
+    scheme:  "http",
+    prePath: "http://a",
+    path:    "/b/c/g#s",
+    ref:     "s",
+    nsIURL:  true, nsINestedURI: false },
+  { spec:    "http://a/b/c/d;p?q",
+    relativeURI: "g?y#s",
+    scheme:  "http",
+    prePath: "http://a",
+    path:    "/b/c/g?y#s",
+    ref:     "s",
+    nsIURL:  true, nsINestedURI: false },
+  /*
+    Bug xxxxxx - we return a path of b/c/;x
+  { spec:    "http://a/b/c/d;p?q",
+    relativeURI: ";x",
+    scheme:  "http",
+    prePath: "http://a",
+    path:    "/b/c/d;x",
+    ref:     "",
+    nsIURL:  true, nsINestedURI: false },
+  */
+  { spec:    "http://a/b/c/d;p?q",
+    relativeURI: "g;x",
+    scheme:  "http",
+    prePath: "http://a",
+    path:    "/b/c/g;x",
+    ref:     "",
+    nsIURL:  true, nsINestedURI: false },
+  { spec:    "http://a/b/c/d;p?q",
+    relativeURI: "g;x?y#s",
+    scheme:  "http",
+    prePath: "http://a",
+    path:    "/b/c/g;x?y#s",
+    ref:     "s",
+    nsIURL:  true, nsINestedURI: false },
+  /*
+    Can't easily specify a relative URI of "" to the test code
+  { spec:    "http://a/b/c/d;p?q",
+    relativeURI: "",
+    scheme:  "http",
+    prePath: "http://a",
+    path:    "/b/c/d",
+    ref:     "",
+    nsIURL:  true, nsINestedURI: false },
+  */
+  { spec:    "http://a/b/c/d;p?q",
+    relativeURI: ".",
+    scheme:  "http",
+    prePath: "http://a",
+    path:    "/b/c/",
+    ref:     "",
+    nsIURL:  true, nsINestedURI: false },
+  { spec:    "http://a/b/c/d;p?q",
+    relativeURI: "./",
+    scheme:  "http",
+    prePath: "http://a",
+    path:    "/b/c/",
+    ref:     "",
+    nsIURL:  true, nsINestedURI: false },
+  { spec:    "http://a/b/c/d;p?q",
+    relativeURI: "..",
+    scheme:  "http",
+    prePath: "http://a",
+    path:    "/b/",
+    ref:     "",
+    nsIURL:  true, nsINestedURI: false },
+  { spec:    "http://a/b/c/d;p?q",
+    relativeURI: "../",
+    scheme:  "http",
+    prePath: "http://a",
+    path:    "/b/",
+    ref:     "",
+    nsIURL:  true, nsINestedURI: false },
+  { spec:    "http://a/b/c/d;p?q",
+    relativeURI: "../g",
+    scheme:  "http",
+    prePath: "http://a",
+    path:    "/b/g",
+    ref:     "",
+    nsIURL:  true, nsINestedURI: false },
+  { spec:    "http://a/b/c/d;p?q",
+    relativeURI: "../..",
+    scheme:  "http",
+    prePath: "http://a",
+    path:    "/",
+    ref:     "",
+    nsIURL:  true, nsINestedURI: false },
+  { spec:    "http://a/b/c/d;p?q",
+    relativeURI: "../../",
+    scheme:  "http",
+    prePath: "http://a",
+    path:    "/",
+    ref:     "",
+    nsIURL:  true, nsINestedURI: false },
+  { spec:    "http://a/b/c/d;p?q",
+    relativeURI: "../../g",
+    scheme:  "http",
+    prePath: "http://a",
+    path:    "/g",
+    ref:     "",
+    nsIURL:  true, nsINestedURI: false },
+
+  // abnormal examples
+  { spec:    "http://a/b/c/d;p?q",
+    relativeURI: "../../../g",
+    scheme:  "http",
+    prePath: "http://a",
+    path:    "/g",
+    ref:     "",
+    nsIURL:  true, nsINestedURI: false },
+  { spec:    "http://a/b/c/d;p?q",
+    relativeURI: "../../../../g",
+    scheme:  "http",
+    prePath: "http://a",
+    path:    "/g",
+    ref:     "",
+    nsIURL:  true, nsINestedURI: false },
+
+  // coalesce 
+  { spec:    "http://a/b/c/d;p?q",
+    relativeURI: "/./g",
+    scheme:  "http",
+    prePath: "http://a",
+    path:    "/g",
+    ref:     "",
+    nsIURL:  true, nsINestedURI: false },
+  { spec:    "http://a/b/c/d;p?q",
+    relativeURI: "/../g",
+    scheme:  "http",
+    prePath: "http://a",
+    path:    "/g",
+    ref:     "",
+    nsIURL:  true, nsINestedURI: false },
+  { spec:    "http://a/b/c/d;p?q",
+    relativeURI: "g.",
+    scheme:  "http",
+    prePath: "http://a",
+    path:    "/b/c/g.",
+    ref:     "",
+    nsIURL:  true, nsINestedURI: false },
+  { spec:    "http://a/b/c/d;p?q",
+    relativeURI: ".g",
+    scheme:  "http",
+    prePath: "http://a",
+    path:    "/b/c/.g",
+    ref:     "",
+    nsIURL:  true, nsINestedURI: false },
+  { spec:    "http://a/b/c/d;p?q",
+    relativeURI: "g..",
+    scheme:  "http",
+    prePath: "http://a",
+    path:    "/b/c/g..",
+    ref:     "",
+    nsIURL:  true, nsINestedURI: false },
+  { spec:    "http://a/b/c/d;p?q",
+    relativeURI: "..g",
+    scheme:  "http",
+    prePath: "http://a",
+    path:    "/b/c/..g",
+    ref:     "",
+    nsIURL:  true, nsINestedURI: false },
+  { spec:    "http://a/b/c/d;p?q",
+    relativeURI: ".",
+    scheme:  "http",
+    prePath: "http://a",
+    path:    "/b/c/",
+    ref:     "",
+    nsIURL:  true, nsINestedURI: false },
+  { spec:    "http://a/b/c/d;p?q",
+    relativeURI: "./../g",
+    scheme:  "http",
+    prePath: "http://a",
+    path:    "/b/g",
+    ref:     "",
+    nsIURL:  true, nsINestedURI: false },
+  { spec:    "http://a/b/c/d;p?q",
+    relativeURI: "./g/.",
+    scheme:  "http",
+    prePath: "http://a",
+    path:    "/b/c/g/",
+    ref:     "",
+    nsIURL:  true, nsINestedURI: false },
+  { spec:    "http://a/b/c/d;p?q",
+    relativeURI: "g/./h",
+    scheme:  "http",
+    prePath: "http://a",
+    path:    "/b/c/g/h",
+    ref:     "",
+    nsIURL:  true, nsINestedURI: false },
+  { spec:    "http://a/b/c/d;p?q",
+    relativeURI: "g/../h",
+    scheme:  "http",
+    prePath: "http://a",
+    path:    "/b/c/h",
+    ref:     "",// fix
+    nsIURL:  true, nsINestedURI: false },
+  { spec:    "http://a/b/c/d;p?q",
+    relativeURI: "g;x=1/./y",
+    scheme:  "http",
+    prePath: "http://a",
+    path:    "/b/c/g;x=1/y",
+    ref:     "",
+    nsIURL:  true, nsINestedURI: false },
+  { spec:    "http://a/b/c/d;p?q",
+    relativeURI: "g;x=1/../y",
+    scheme:  "http",
+    prePath: "http://a",
+    path:    "/b/c/y",
+    ref:     "",
+    nsIURL:  true, nsINestedURI: false },
+
 ];
 
 var gHashSuffixes = [
@@ -239,24 +594,57 @@ function do_check_uri_eqExceptRef(aURI1, aURI2, aCheckTrueFunc) {
 // in the test bundle (or matches some function of that corresponding property,
 // if aTestFunctor is passed in).
 function do_check_property(aTest, aURI, aPropertyName, aTestFunctor) {
-  var expectedVal = aTestFunctor ?
-    aTestFunctor(aTest[aPropertyName]) :
-    aTest[aPropertyName];
+  if (aTest[aPropertyName]) {
+    var expectedVal = aTestFunctor ?
+                      aTestFunctor(aTest[aPropertyName]) :
+                      aTest[aPropertyName];
 
-  do_info("testing " + aPropertyName + " of " +
-          (aTestFunctor ? "modified '" : "'" ) + aTest.spec +
-          "' is '" + expectedVal + "'");
-  do_check_eq(aURI[aPropertyName], expectedVal);
+    do_info("testing " + aPropertyName + " of " +
+            (aTestFunctor ? "modified '" : "'" ) + aTest.spec +
+            "' is '" + expectedVal + "'");
+    do_check_eq(aURI[aPropertyName], expectedVal);
+  }
 }
 
 // Test that a given URI parses correctly into its various components.
 function do_test_uri_basic(aTest) {
-  var URI = NetUtil.newURI(aTest.spec);
+  var URI;
+
+  do_info("Basic tests for " + aTest.spec + " relative URI: " + aTest.relativeURI);
+
+  try {
+    URI = NetUtil.newURI(aTest.spec);
+  } catch(e) {
+    do_info("Caught error on parse of" + aTest.spec + " Error: " + e.result);
+    if (aTest.fail) {
+      do_check_eq(e.result, aTest.result);
+      return;
+    }
+    do_throw(e.result);
+  }
+
+  if (aTest.relativeURI) {
+    var relURI;
+
+    try {
+      relURI = gIoService.newURI(aTest.relativeURI, null, URI);
+    } catch (e) {
+      do_info("Caught error on Relative parse of " + aTest.spec + " + " + aTest.relativeURI +" Error: " + e.result);
+      if (aTest.relativeFail) {
+        do_check_eq(e.result, aTest.relativeFail);
+        return;
+      }
+      do_throw(e.result);
+    }
+    do_info("relURI.path = " + relURI.path + ", was " + URI.path);
+    URI = relURI;
+    do_info("URI.path now = " + URI.path);
+  }
 
   // Sanity-check
   do_info("testing " + aTest.spec + " equals a clone of itself");
   do_check_uri_eq(URI, URI.clone());
-  do_check_uri_eq(URI, URI.cloneIgnoringRef());
+  do_check_uri_eqExceptRef(URI, URI.cloneIgnoringRef());
   do_info("testing " + aTest.spec + " instanceof nsIURL");
   do_check_eq(URI instanceof Ci.nsIURL, aTest.nsIURL);
   do_info("testing " + aTest.spec + " instanceof nsINestedURI");
@@ -282,6 +670,10 @@ function do_test_uri_basic(aTest) {
   do_check_property(aTest, URI, "prePath");
   do_check_property(aTest, URI, "path");
   do_check_property(aTest, URI, "ref");
+  do_check_property(aTest, URI, "port");
+  do_check_property(aTest, URI, "username");
+  do_check_property(aTest, URI, "password");
+  do_check_property(aTest, URI, "host");
 }
 
 // Test that a given URI parses correctly when we add a given ref to the end
@@ -289,8 +681,25 @@ function do_test_uri_with_hash_suffix(aTest, aSuffix) {
   do_info("making sure caller is using suffix that starts with '#'");
   do_check_eq(aSuffix[0], "#");
 
-  var testURI = NetUtil.newURI(aTest.spec + aSuffix);
   var origURI = NetUtil.newURI(aTest.spec);
+  var testURI;
+
+  if (aTest.relativeURI) {
+    try {
+      origURI = gIoService.newURI(aTest.relativeURI, null, origURI);
+    } catch (e) {
+      do_info("Caught error on Relative parse of " + aTest.spec + " + " + aTest.relativeURI +" Error: " + e.result);
+      return;
+    }
+    try {
+      testURI = gIoService.newURI(aSuffix, null, origURI);
+    } catch (e) {
+      do_info("Caught error adding suffix to " + aTest.spec + " + " + aTest.relativeURI + ", suffix " + aSuffix + " Error: " + e.result);
+      return;
+    }
+  } else {
+    testURI = NetUtil.newURI(aTest.spec + aSuffix);
+  }
 
   do_info("testing " + aTest.spec + " with '" + aSuffix + "' appended " +
            "equals a clone of itself");
@@ -298,11 +707,6 @@ function do_test_uri_with_hash_suffix(aTest, aSuffix) {
 
   do_info("testing " + aTest.spec +
           " doesn't equal self with '" + aSuffix + "' appended");
-  if (aTest.spec == "file://") {
-    do_info("TODO: bug 656853");
-    todo_check_false(origURI.equals(testURI));
-    return;  // bail out early since file:// doesn't handle hash refs at all
-  }
 
   do_check_false(origURI.equals(testURI));
 
@@ -310,23 +714,24 @@ function do_test_uri_with_hash_suffix(aTest, aSuffix) {
           " is equalExceptRef to self with '" + aSuffix + "' appended");
   do_check_uri_eqExceptRef(origURI, testURI);
 
-  do_info("testing cloneIgnoringRef on " + testURI.spec +
-          " is equal to no-ref version but not equal to ref version");
-  var cloneNoRef = testURI.cloneIgnoringRef();
-  if ((aTest.spec == "http://" || aTest.spec == "ftp://") && aSuffix == "#") {
-    do_info("TODO: bug 657033");
-    do_check_uri_eq(cloneNoRef, origURI, todo_check_true);
-  } else {
+  if (!origURI.ref) {
+    // These tests fail if origURI has a ref
+    do_info("testing cloneIgnoringRef on " + testURI.spec +
+            " is equal to no-ref version but not equal to ref version");
+    var cloneNoRef = testURI.cloneIgnoringRef();
     do_check_uri_eq(cloneNoRef, origURI);
+    do_check_false(cloneNoRef.equals(testURI));
   }
-  do_check_false(cloneNoRef.equals(testURI));
 
   do_check_property(aTest, testURI, "scheme");
   do_check_property(aTest, testURI, "prePath");
-  do_check_property(aTest, testURI, "path",
-                    function(aStr) { return aStr + aSuffix; });
-  do_check_property(aTest, testURI, "ref",
-                    function(aStr) { return aSuffix.substr(1); });
+  if (!origURI.ref) {
+    // These don't work if it's a ref already because '+' doesn't give the right result
+    do_check_property(aTest, testURI, "path",
+                      function(aStr) { return aStr + aSuffix; });
+    do_check_property(aTest, testURI, "ref",
+                      function(aStr) { return aSuffix.substr(1); });
+  }
 }
 
 // Tests various ways of setting & clearing a ref on a URI.
@@ -339,13 +744,6 @@ function do_test_mutate_ref(aTest, aSuffix) {
 
   var testURI             = NetUtil.newURI(aTest.spec);
 
-  if (aTest.spec == "file://") {
-    do_info("TODO: bug 656853");
-    testURI.ref = aSuffix;
-    do_check_uri_eq(testURI, refURIWithSuffix, todo_check_true);
-    return; // bail out early since file:// doesn't handle hash refs at all
-  }
-
   // First: Try setting .ref to our suffix
   do_info("testing that setting .ref on " + aTest.spec +
           " to '" + aSuffix + "' does what we expect");
@@ -370,41 +768,39 @@ function do_test_mutate_ref(aTest, aSuffix) {
   do_check_uri_eq(testURI, refURIWithoutSuffix);
   do_check_uri_eqExceptRef(testURI, refURIWithSuffix);
 
-  // Now try setting .spec directly (including suffix) and then clearing .ref
-  var specWithSuffix = aTest.spec + aSuffix;
-  do_info("testing that setting spec to " +
-          specWithSuffix + " and then clearing ref does what we expect");
-  testURI.spec = specWithSuffix
-  testURI.ref = "";
-  if ((aTest.spec == "http://" || aTest.spec == "ftp://") && aSuffix == "#") {
-    do_info("TODO: bug 657033");
-    do_check_uri_eq(testURI, refURIWithoutSuffix, todo_check_true);
-    do_check_uri_eqExceptRef(testURI, refURIWithSuffix, todo_check_true);
-  } else {
-    do_check_uri_eq(testURI, refURIWithoutSuffix);
-    do_check_uri_eqExceptRef(testURI, refURIWithSuffix);
-  }
+  if (!aTest.relativeURI) {
+    // TODO: These tests don't work as-is for relative URIs.
 
-  // XXX nsIJARURI throws an exception in SetPath(), so skip it for next part.
-  if (!(testURI instanceof Ci.nsIJARURI)) {
-    // Now try setting .path directly (including suffix) and then clearing .ref
-    // (same as above, but with now with .path instead of .spec)
-    testURI = NetUtil.newURI(aTest.spec);
-
-    var pathWithSuffix = aTest.path + aSuffix;
-    do_info("testing that setting path to " +
-            pathWithSuffix + " and then clearing ref does what we expect");
-    testURI.path = pathWithSuffix;
+    // Now try setting .spec directly (including suffix) and then clearing .ref
+    var specWithSuffix = aTest.spec + aSuffix;
+    do_info("testing that setting spec to " +
+            specWithSuffix + " and then clearing ref does what we expect");
+    testURI.spec = specWithSuffix;
     testURI.ref = "";
     do_check_uri_eq(testURI, refURIWithoutSuffix);
     do_check_uri_eqExceptRef(testURI, refURIWithSuffix);
 
-    // Also: make sure that clearing .path also clears .ref
-    testURI.path = pathWithSuffix;
-    do_info("testing that clearing path from " + 
-            pathWithSuffix + " also clears .ref");
-    testURI.path = "";
-    do_check_eq(testURI.ref, "");
+    // XXX nsIJARURI throws an exception in SetPath(), so skip it for next part.
+    if (!(testURI instanceof Ci.nsIJARURI)) {
+      // Now try setting .path directly (including suffix) and then clearing .ref
+      // (same as above, but with now with .path instead of .spec)
+      testURI = NetUtil.newURI(aTest.spec);
+
+      var pathWithSuffix = aTest.path + aSuffix;
+      do_info("testing that setting path to " +
+              pathWithSuffix + " and then clearing ref does what we expect");
+      testURI.path = pathWithSuffix;
+      testURI.ref = "";
+      do_check_uri_eq(testURI, refURIWithoutSuffix);
+      do_check_uri_eqExceptRef(testURI, refURIWithSuffix);
+
+      // Also: make sure that clearing .path also clears .ref
+      testURI.path = pathWithSuffix;
+      do_info("testing that clearing path from " + 
+              pathWithSuffix + " also clears .ref");
+      testURI.path = "";
+      do_check_eq(testURI.ref, "");
+    }
   }
 }
 
@@ -437,22 +833,42 @@ function do_test_immutable(aTest) {
 // ------------------
 function run_test()
 {
+  // UTF-8 check - From bug 622981
+  // ASCII
+  let base = gIoService.newURI("http://example.org/xenia?", null, null);
+  let resolved = gIoService.newURI("?x", null, base);
+  let expected = gIoService.newURI("http://example.org/xenia?x",
+                                  null, null);
+  do_info("Bug 662981: ACSII - comparing " + resolved.spec + " and " + expected.spec);
+  do_check_true(resolved.equals(expected));
+
+  // UTF-8 character "è"
+  // Bug 622981 was triggered by an empty query string
+  base = gIoService.newURI("http://example.org/xènia?", null, null);
+  resolved = gIoService.newURI("?x", null, base);
+  expected = gIoService.newURI("http://example.org/xènia?x",
+                              null, null);
+  do_info("Bug 662981: UTF8 - comparing " + resolved.spec + " and " + expected.spec);
+  do_check_true(resolved.equals(expected));
+
   gTests.forEach(function(aTest) {
     // Check basic URI functionality
     do_test_uri_basic(aTest);
 
-    // Try adding various #-prefixed strings to the ends of the URIs
-    gHashSuffixes.forEach(function(aSuffix) {
-      do_test_uri_with_hash_suffix(aTest, aSuffix);
-      if (!aTest.immutable) {
-        do_test_mutate_ref(aTest, aSuffix);
-      }
-    });
+    if (!aTest.fail) {
+      // Try adding various #-prefixed strings to the ends of the URIs
+      gHashSuffixes.forEach(function(aSuffix) {
+          do_test_uri_with_hash_suffix(aTest, aSuffix);
+          if (!aTest.immutable) {
+            do_test_mutate_ref(aTest, aSuffix);
+          }
+        });
 
-    // For URIs that we couldn't mutate above due to them being immutable:
-    // Now we check that they're actually immutable.
-    if (aTest.immutable) {
-      do_test_immutable(aTest);
+      // For URIs that we couldn't mutate above due to them being immutable:
+      // Now we check that they're actually immutable.
+      if (aTest.immutable) {
+        do_test_immutable(aTest);
+      }
     }
   });
 }
diff --git a/netwerk/test/unit/test_bug670333.js b/netwerk/test/unit/test_bug670333.js
new file mode 100644
index 000000000000..aabcd4d03f13
--- /dev/null
+++ b/netwerk/test/unit/test_bug670333.js
@@ -0,0 +1,43 @@
+/**
+ * Test for bug 670333: Content-Disposition parser does not require presence of "=" in params
+ */
+
+const Cr = Components.results
+
+var BS = '\\';
+var DQUOTE = '"'; 
+ 
+var tests = [
+                 [ /* sanity check */
+                  "Content-Disposition: attachment; filename*=UTF-8''foo-%41.html", 
+                  "foo-A.html"],
+                 [ /* the actual bug */
+                  "Content-Disposition: attachment; filename *=UTF-8''foo-%41.html", 
+                  Cr.NS_ERROR_INVALID_ARG],
+                 [ /* the actual bug, without 2231/5987 encoding */
+                  "Content-Disposition: attachment; filename X", 
+                  Cr.NS_ERROR_INVALID_ARG],
+                 [ /* sanity check with WS on both sides */
+                  "Content-Disposition: attachment; filename = foo-A.html", 
+                  "foo-A.html"],
+                ];
+
+function run_test() {
+
+  var mhp = Components.classes["@mozilla.org/network/mime-hdrparam;1"]
+                      .getService(Components.interfaces.nsIMIMEHeaderParam);
+
+  var unused = { value : null };
+
+  for (var i = 0; i < tests.length; ++i) {
+    dump("Testing " + tests[i] + "\n");
+    try {
+      do_check_eq(mhp.getParameter(tests[i][0], "filename", "UTF-8", true, unused),
+                  tests[i][1]);
+    }
+    catch (e) {
+      do_check_eq(e.result, tests[i][1]);
+    }
+  }
+}
+
diff --git a/netwerk/test/unit/xpcshell.ini b/netwerk/test/unit/xpcshell.ini
index b3549e0b7491..8ee334674578 100644
--- a/netwerk/test/unit/xpcshell.ini
+++ b/netwerk/test/unit/xpcshell.ini
@@ -69,6 +69,7 @@ tail =
 [test_bug660066.js]
 [test_bug651185.js]
 [test_bug667907.js]
+[test_bug670333.js]
 [test_cacheflags.js]
 [test_channel_close.js]
 [test_compareURIs.js]
diff --git a/other-licenses/android/APKOpen.cpp b/other-licenses/android/APKOpen.cpp
index 431be6be890d..14de579f4f38 100644
--- a/other-licenses/android/APKOpen.cpp
+++ b/other-licenses/android/APKOpen.cpp
@@ -238,7 +238,7 @@ SHELL_WRAPPER0(onResume)
 SHELL_WRAPPER0(onLowMemory)
 SHELL_WRAPPER3(callObserver, jstring, jstring, jstring)
 SHELL_WRAPPER1(removeObserver, jstring)
-SHELL_WRAPPER1(onChangeNetworkLinkStatus, jstring)
+SHELL_WRAPPER2(onChangeNetworkLinkStatus, jstring, jstring)
 SHELL_WRAPPER1(reportJavaCrash, jstring)
 
 static void * xul_handle = NULL;
@@ -249,11 +249,6 @@ extern "C" int extractLibs = 1;
 extern "C" int extractLibs = 0;
 #endif
 
-#ifdef DEBUG
-#define DEBUG_EXTRACT_LIBS 1
-#endif
-
-#ifdef DEBUG_EXTRACT_LIBS
 static uint32_t simple_write(int fd, const void *buf, uint32_t count)
 {
   uint32_t out_offset = 0;
@@ -333,7 +328,6 @@ extractFile(const char * path, const struct cdir_entry *entry, void * data)
   close(fd);
   munmap(buf, 4096);
 }
-#endif
 
 static void
 extractLib(const struct cdir_entry *entry, void * data, void * dest)
@@ -454,7 +448,6 @@ static void * mozload(const char * path, void *zip,
   void * data = ((void *)&file->data) + letoh16(file->filename_size) + letoh16(file->extra_field_size);
   void * handle;
 
-#ifdef DEBUG_EXTRACT_LIBS
   if (extractLibs) {
     char fullpath[PATH_MAX];
     snprintf(fullpath, PATH_MAX, "%s/%s", getenv("CACHE_PATH"), path + 4);
@@ -473,7 +466,7 @@ static void * mozload(const char * path, void *zip,
 #endif
     return handle;
   }
-#endif
+
   size_t offset = letoh32(entry->offset) + sizeof(*file) + letoh16(file->filename_size) + letoh16(file->extra_field_size);
   bool skipLibCache = false;
   int fd = zip_fd;
diff --git a/other-licenses/android/dlfcn.c b/other-licenses/android/dlfcn.c
index 359fb2e195b0..bbde8bf41df5 100644
--- a/other-licenses/android/dlfcn.c
+++ b/other-licenses/android/dlfcn.c
@@ -54,10 +54,8 @@ static void set_dlerror(int err)
 
 void *__wrap_dlopen(const char *filename, int flag)
 {
-#ifdef DEBUG
     if (extractLibs)
         return dlopen(filename, flag);
-#endif
 
     soinfo *ret;
 
diff --git a/security/manager/ssl/src/nsNSSCallbacks.cpp b/security/manager/ssl/src/nsNSSCallbacks.cpp
index a23cbb05262d..9d110ac04157 100644
--- a/security/manager/ssl/src/nsNSSCallbacks.cpp
+++ b/security/manager/ssl/src/nsNSSCallbacks.cpp
@@ -127,6 +127,8 @@ nsHTTPDownloadEvent::Run()
   ios->NewChannel(mRequestSession->mURL, nsnull, nsnull, getter_AddRefs(chan));
   NS_ENSURE_STATE(chan);
 
+  chan->SetLoadFlags(nsIRequest::LOAD_ANONYMOUS);
+
   // Create a loadgroup for this new channel.  This way if the channel
   // is redirected, we'll have a way to cancel the resulting channel.
   nsCOMPtr<nsILoadGroup> lg = do_CreateInstance(NS_LOADGROUP_CONTRACTID);
diff --git a/storage/src/mozStorageService.cpp b/storage/src/mozStorageService.cpp
index 611267df3a81..a74004bd68c2 100644
--- a/storage/src/mozStorageService.cpp
+++ b/storage/src/mozStorageService.cpp
@@ -477,6 +477,8 @@ NS_IMETHODIMP
 Service::OpenUnsharedDatabase(nsIFile *aDatabaseFile,
                               mozIStorageConnection **_connection)
 {
+  NS_ENSURE_ARG(aDatabaseFile);
+
 #ifdef NS_FUNCTION_TIMER
   nsCString leafname;
   (void)aDatabaseFile->GetNativeLeafName(leafname);
diff --git a/storage/test/unit/test_storage_service.js b/storage/test/unit/test_storage_service.js
index 7fa705bb97d5..9bc1a1ba0d6f 100644
--- a/storage/test/unit/test_storage_service.js
+++ b/storage/test/unit/test_storage_service.js
@@ -64,6 +64,18 @@ function test_openDatabase_null_file()
   }
 }
 
+function test_openUnsharedDatabase_null_file()
+{
+  try {
+    getService().openUnsharedDatabase(null);
+    do_throw("We should not get here!");
+  } catch (e) {
+    print(e);
+    print("e.result is " + e.result);
+    do_check_eq(Cr.NS_ERROR_INVALID_ARG, e.result);
+  }
+}
+
 function test_openDatabase_file_DNE()
 {
   // the file should be created after calling
@@ -131,6 +143,7 @@ function test_backup_new_folder()
 var tests = [
   test_openSpecialDatabase_invalid_arg,
   test_openDatabase_null_file,
+  test_openUnsharedDatabase_null_file,
   test_openDatabase_file_DNE,
   test_openDatabase_file_exists,
   test_corrupt_db_throws_with_openDatabase,
diff --git a/testing/mochitest/tests/SimpleTest/WindowSnapshot.js b/testing/mochitest/tests/SimpleTest/WindowSnapshot.js
index 4e1ee054c735..a838cfabac5e 100644
--- a/testing/mochitest/tests/SimpleTest/WindowSnapshot.js
+++ b/testing/mochitest/tests/SimpleTest/WindowSnapshot.js
@@ -36,7 +36,19 @@ function compareSnapshots(s1, s2, expected) {
   var s1Str, s2Str;
   var correct = false;
   if (gWindowUtils) {
-    correct = ((gWindowUtils.compareCanvases(s1, s2, {}) == 0) == expected);
+    // First, check that the canvases are the same size.
+    var equal;
+    if (s1.width != s2.width || s1.height != s2.height) {
+      equal = false;
+    } else {
+      try {
+        equal = (gWindowUtils.compareCanvases(s1, s2, {}) == 0);
+      } catch (e) {
+        equal = false;
+        ok(false, "Exception thrown from compareCanvases: " + e);
+      }
+    }
+    correct = (equal == expected);
   }
 
   if (!correct) {
diff --git a/toolkit/components/alerts/resources/content/alert.js b/toolkit/components/alerts/resources/content/alert.js
index 40d5ab806728..95cd631a2e0b 100644
--- a/toolkit/components/alerts/resources/content/alert.js
+++ b/toolkit/components/alerts/resources/content/alert.js
@@ -127,14 +127,6 @@ function onAlertLoad()
   var alertBox = document.getElementById("alertBox");
   alertBox.orient = (gOrigin & NS_ALERT_HORIZONTAL) ? "vertical" : "horizontal";
 
-  // The above doesn't cause the labels in alertTextBox to reflow,
-  // see bug 311557. As the theme's -moz-box-align css rule gets ignored,
-  // we work around the bug by setting the align property.
-  if (gOrigin & NS_ALERT_HORIZONTAL)
-  {
-    document.getElementById("alertTextBox").align = "center";
-  }
-
   sizeToContent();
 
   // Work around a bug where sizeToContent() leaves a border outside of the content
diff --git a/toolkit/components/places/tests/unit/test_database_replaceOnStartup.js b/toolkit/components/places/tests/unit/test_database_replaceOnStartup.js
index 1f3a95d2e0d7..1b9e258a77ec 100644
--- a/toolkit/components/places/tests/unit/test_database_replaceOnStartup.js
+++ b/toolkit/components/places/tests/unit/test_database_replaceOnStartup.js
@@ -17,7 +17,8 @@ function run_test() {
 
   let file = do_get_file("default.sqlite");
   file.copyToFollowingLinks(gProfD, "places.sqlite");
-  file = gProfD.clone().append("places.sqlite");
+  file = gProfD.clone();
+  file.append("places.sqlite");
 
   // Create some unique stuff to check later.
   let db = Services.storage.openUnsharedDatabase(file);
diff --git a/toolkit/components/telemetry/TelemetryPing.js b/toolkit/components/telemetry/TelemetryPing.js
index aa458429f701..c0f0a4db3ada 100644
--- a/toolkit/components/telemetry/TelemetryPing.js
+++ b/toolkit/components/telemetry/TelemetryPing.js
@@ -63,6 +63,12 @@ const MEM_HISTOGRAMS = {
   "page-faults-hard": "PAGE_FAULTS_HARD"
 };
 
+function getLocale() {
+  return Cc["@mozilla.org/chrome/chrome-registry;1"].
+         getService(Ci.nsIXULChromeRegistry).
+         getSelectedLocale('global');
+}
+
 XPCOMUtils.defineLazyGetter(this, "Telemetry", function () {
   return Cc["@mozilla.org/base/telemetry;1"].getService(Ci.nsITelemetry);
 });
@@ -143,6 +149,7 @@ function getMetadata(reason) {
     appName: ai.name,
     appBuildID: ai.appBuildID,
     platformBuildID: ai.platformBuildID,
+    locale: getLocale(),
   };
 
   // sysinfo fields is not always available, get what we can.
diff --git a/toolkit/content/tests/chrome/Makefile.in b/toolkit/content/tests/chrome/Makefile.in
index 8f485f5c419f..bfe3e62cfb23 100644
--- a/toolkit/content/tests/chrome/Makefile.in
+++ b/toolkit/content/tests/chrome/Makefile.in
@@ -70,6 +70,8 @@ _TEST_FILES = 	findbar_window.xul \
 		test_bug451540.xul \
 		test_bug471776.xul \
 		test_bug570192.xul \
+		test_bug624329.xul \
+		bug624329_window.xul \
 		test_bug649840.xul \
 		test_popup_preventdefault_chrome.xul \
 		window_popup_preventdefault_chrome.xul \
diff --git a/toolkit/content/tests/chrome/bug624329_window.xul b/toolkit/content/tests/chrome/bug624329_window.xul
new file mode 100644
index 000000000000..0d44486ed867
--- /dev/null
+++ b/toolkit/content/tests/chrome/bug624329_window.xul
@@ -0,0 +1,24 @@
+<?xml version="1.0"?>
+<?xml-stylesheet href="chrome://global/skin" type="text/css"?>
+
+<window title="Test for bug 624329 context menu position"
+        xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul"
+        context="menu">
+
+  <title><label>Test for bug 624329 context menu position</label></title>
+
+  <script>
+    opener.SimpleTest.waitForFocus(opener.childFocused, window);
+  </script>
+
+  <menupopup id="menu">
+    <!-- The bug demonstrated only when the accesskey was presented separately
+         from the label.
+         e.g. because the accesskey is not a letter in the label.
+
+         The bug demonstrates only on the first show of the context menu
+         unless menu items are removed/added each time the menu is
+         constructed. -->
+    <menuitem label="Long label to ensure the popup would hit the right of the screen" accesskey="1"/>
+  </menupopup>
+</window>
diff --git a/toolkit/content/tests/chrome/test_bug624329.xul b/toolkit/content/tests/chrome/test_bug624329.xul
new file mode 100644
index 000000000000..7950390c30e6
--- /dev/null
+++ b/toolkit/content/tests/chrome/test_bug624329.xul
@@ -0,0 +1,125 @@
+<?xml version="1.0"?>
+<?xml-stylesheet type="text/css" href="chrome://global/skin"?>
+<?xml-stylesheet type="text/css" href="chrome://mochikit/content/tests/SimpleTest/test.css"?>
+<!--
+https://bugzilla.mozilla.org/show_bug.cgi?id=624329
+-->
+<window title="Mozilla Bug 624329 context menu position"
+        xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul">
+  <script type="application/javascript" src="chrome://mochikit/content/MochiKit/packed.js"/>
+  <script type="application/javascript" src="chrome://mochikit/content/tests/SimpleTest/SimpleTest.js"/>
+  <script type="application/javascript" src="chrome://mochikit/content/tests/SimpleTest/EventUtils.js"/>
+
+  <!-- test results are displayed in the html:body -->
+  <body xmlns="http://www.w3.org/1999/xhtml"
+        onload="openTestWindow()">
+  <a href="https://bugzilla.mozilla.org/show_bug.cgi?id=624329"
+     target="_blank">Mozilla Bug 624329</a>
+  </body>
+
+  <!-- test code goes here -->
+  <script type="application/javascript">
+  <![CDATA[
+  /** Test for Bug 624329 **/
+
+SimpleTest.waitForExplicitFinish();
+
+var win;
+var timeoutID;
+var menu;
+
+function openTestWindow() {
+    win = open("bug624329_window.xul", "_blank", "width=300,resizable=yes,chrome");
+    // Close our window if the test times out so that it doesn't interfere
+    // with later tests.
+    timeoutID = setTimeout(function () {
+        ok(false, "Test timed out.");
+        // Provide some time for a screenshot
+        setTimeout(finish, 1000);
+    }, 20000);
+}
+
+function listenOnce(event, callback) {
+    win.addEventListener(event, function listener() {
+        win.removeEventListener(event, listener, false);
+        callback();
+    }, false);
+}
+
+function childFocused() {
+    // maximizing the window is a simple way to ensure that the menu is near
+    // the right edge of the screen.
+
+    listenOnce("resize", childResized);
+    win.maximize();
+}
+
+function childResized() {
+    is(win.windowState, win.STATE_MAXIMIZED,
+       "window should be maximized");
+
+    isnot(win.innerWidth, 300,
+         "window inner width should have changed");
+
+    openContextMenu();
+}
+
+function openContextMenu() {
+    var mouseX = win.innerWidth - 10;
+    var mouseY = 10;
+
+    menu = win.document.getElementById("menu");
+    var screenX = menu.boxObject.screenX;
+    var screenY = menu.boxObject.screenY;
+    var utils =
+        win.QueryInterface(Components.interfaces.nsIInterfaceRequestor).
+            getInterface(Components.interfaces.nsIDOMWindowUtils);
+
+    utils.sendMouseEvent("contextmenu", mouseX, mouseY, 2, 0, 0);
+
+    var interval = setInterval(checkMoved, 200);
+    function checkMoved() {
+        if (menu.boxObject.screenX != screenX ||
+            menu.boxObject.screenY != screenY) {
+            clearInterval(interval);
+            // Wait further to check that the window does not move again.
+            setTimeout(checkPosition, 1000);
+        }
+    }
+
+    function checkPosition() {
+        var menubox = menu.boxObject;
+        var winbox = win.document.documentElement.boxObject
+
+        var x = menubox.screenX - winbox.screenX;
+        var y = menubox.screenY - winbox.screenY;
+        ok(y >= mouseY,
+           "menu top " + y + " should be below click point " + mouseY);
+        ok(y <= mouseY + 20,
+           "menu top " + y + " should not be too far below click point " + mouseY);
+
+        ok(x < mouseX,
+           "menu left " + x + " should be left of click point " + mouseX);
+        var right = x + menubox.width;
+        ok(right > mouseX,
+           "menu right " + right + " should be right of click point " + mouseX);
+
+        clearTimeout(timeoutID);
+        finish();
+    }
+
+}
+
+function finish() {
+    if (menu && navigator.platform.indexOf("Win") >= 0) {
+        todo(false, "Should not have to hide popup before closing its window");
+        // This avoids mochitest "Unable to restore focus" errors (bug 670053).
+        menu.hidePopup();
+    }
+    win.close();
+    SimpleTest.finish();
+}
+
+  ]]>
+  </script>
+</window>
diff --git a/toolkit/content/widgets/videocontrols.xml b/toolkit/content/widgets/videocontrols.xml
index da9d94765332..19e3d84347d0 100644
--- a/toolkit/content/widgets/videocontrols.xml
+++ b/toolkit/content/widgets/videocontrols.xml
@@ -56,9 +56,10 @@
           <body>
           <![CDATA[
               var timeString;
-              var hours = Math.floor(time / 3600000);
-              var mins  = Math.floor(time % 3600000 / 60000);
-              var secs  = Math.floor(time % 60000 / 1000);
+              time = Math.round(time / 1000);
+              var hours = Math.floor(time / 3600);
+              var mins  = Math.floor((time % 3600) / 60);
+              var secs  = Math.floor(time % 60);
               if (secs < 10)
                   secs = "0" + secs;
               if (hours || this.showHours) {
@@ -544,9 +545,10 @@
                 
                 formatTime : function(aTime) {
                     // Format the duration as "h:mm:ss" or "m:ss"
-                    let hours = Math.floor(aTime / 3600000);
-                    let mins  = Math.floor(aTime % 3600000 / 60000);
-                    let secs  = Math.floor(aTime % 60000 / 1000);
+                    aTime = Math.round(aTime / 1000);
+                    let hours = Math.floor(aTime / 3600);
+                    let mins  = Math.floor((aTime % 3600) / 60);
+                    let secs  = Math.floor(aTime % 60);
                     let timeString;
                     if (secs < 10)
                         secs = "0" + secs;
diff --git a/toolkit/mozapps/installer/packager.mk b/toolkit/mozapps/installer/packager.mk
index 1feaf24a7a68..37a70ed65b38 100644
--- a/toolkit/mozapps/installer/packager.mk
+++ b/toolkit/mozapps/installer/packager.mk
@@ -408,19 +408,23 @@ NON_OMNIJAR_FILES += \
 PACK_OMNIJAR	= \
   rm -f omni.jar components/binary.manifest && \
   grep -h '^binary-component' components/*.manifest > binary.manifest ; \
-  sed -e 's/^binary-component/\#binary-component/' components/components.manifest > components.manifest && \
-  mv components.manifest components && \
-  zip -r9m omni.jar $(OMNIJAR_FILES) -x $(NON_OMNIJAR_FILES) && \
+  for m in components/*.manifest; do \
+    sed -e 's/^binary-component/\#binary-component/' $$m > tmp.manifest && \
+    mv tmp.manifest $$m; \
+  done; \
+  $(ZIP) -r9m omni.jar $(OMNIJAR_FILES) -x $(NON_OMNIJAR_FILES) && \
   $(GENERATE_CACHE) && \
   $(OPTIMIZE_JARS_CMD) --optimize $(JARLOG_DIR_AB_CD) ./ ./ && \
   mv binary.manifest components && \
   printf "manifest components/binary.manifest\n" > chrome.manifest
 UNPACK_OMNIJAR	= \
   $(OPTIMIZE_JARS_CMD) --deoptimize $(JARLOG_DIR_AB_CD) ./ ./ && \
-  unzip -o omni.jar && \
+  $(UNZIP) -o omni.jar && \
   rm -f components/binary.manifest && \
-  sed -e 's/^\#binary-component/binary-component/' components/components.manifest > components.manifest && \
-  mv components.manifest components
+  for m in components/*.manifest; do \
+    sed -e 's/^\#binary-component/binary-component/' $$m > tmp.manifest && \
+    mv tmp.manifest $$m; \
+  done
 
 MAKE_PACKAGE	= (cd $(STAGEPATH)$(MOZ_PKG_DIR)$(_BINPATH) && $(PACK_OMNIJAR)) && \
 	              (cd $(STAGEPATH)$(MOZ_PKG_DIR)$(_BINPATH) && $(CREATE_PRECOMPLETE_CMD)) && $(INNER_MAKE_PACKAGE)
diff --git a/toolkit/system/dbus/nsNetworkManagerListener.cpp b/toolkit/system/dbus/nsNetworkManagerListener.cpp
index 92e69c200ed6..6b5d2691c798 100644
--- a/toolkit/system/dbus/nsNetworkManagerListener.cpp
+++ b/toolkit/system/dbus/nsNetworkManagerListener.cpp
@@ -45,6 +45,7 @@
 #include "nsServiceManagerUtils.h"
 #include "nsIObserverService.h"
 #include "nsStringAPI.h"
+#include "nsCRT.h"
 
 // Define NetworkManager API constants. This avoids a dependency on
 // NetworkManager-devel.
@@ -87,6 +88,16 @@ nsNetworkManagerListener::GetLinkStatusKnown(PRBool* aKnown) {
   return NS_OK;
 }
 
+nsresult
+nsNetworkManagerListener::GetLinkType(PRUint32 *aLinkType)
+{
+  NS_ENSURE_ARG_POINTER(aLinkType);
+
+  // XXX This function has not yet been implemented for this platform
+  *aLinkType = nsINetworkLinkService::LINK_TYPE_UNKNOWN;
+  return NS_OK;
+}
+
 nsresult
 nsNetworkManagerListener::Init() {
   mDBUS = nsDBusService::Get();
diff --git a/toolkit/themes/gnomestripe/global/alerts/alert.css b/toolkit/themes/gnomestripe/global/alerts/alert.css
index c30a08ade5ab..f0e6073a793a 100644
--- a/toolkit/themes/gnomestripe/global/alerts/alert.css
+++ b/toolkit/themes/gnomestripe/global/alerts/alert.css
@@ -90,5 +90,5 @@ label {
   -moz-padding-start: 5px;
   -moz-padding-end: 5px;
   margin-bottom: 8px;
-  -moz-box-align: center; /* also hard-coded in alert.js, see bug 311557 */
+  -moz-box-align: center;
 }
diff --git a/toolkit/themes/winstripe/global/alerts/alert.css b/toolkit/themes/winstripe/global/alerts/alert.css
index b5b1c4643b30..792eef2388dd 100644
--- a/toolkit/themes/winstripe/global/alerts/alert.css
+++ b/toolkit/themes/winstripe/global/alerts/alert.css
@@ -95,5 +95,5 @@ label {
   -moz-padding-start: 5px;
   -moz-padding-end: 5px;
   margin-bottom: 8px;
-  -moz-box-align: center; /* also hard-coded in alert.js, see bug 311557 */
+  -moz-box-align: center;
 }
diff --git a/toolkit/xre/nsAppRunner.cpp b/toolkit/xre/nsAppRunner.cpp
index acb1d0abdd2c..dc85abdf4387 100644
--- a/toolkit/xre/nsAppRunner.cpp
+++ b/toolkit/xre/nsAppRunner.cpp
@@ -2543,9 +2543,9 @@ NS_VISIBILITY_DEFAULT PRBool nspr_use_zone_allocator = PR_FALSE;
 #include <dwrite.h>
 
 typedef HRESULT (WINAPI*DWriteCreateFactoryFunc)(
-  __in   DWRITE_FACTORY_TYPE factoryType,
-  __in   REFIID iid,
-  __out  IUnknown **factory
+  DWRITE_FACTORY_TYPE factoryType,
+  REFIID iid,
+  IUnknown **factory
 );
 
 #ifdef DEBUG_DWRITE_STARTUP
diff --git a/widget/reftests/664925.xhtml b/widget/reftests/664925.xhtml
new file mode 100644
index 000000000000..b4a11a73861d
--- /dev/null
+++ b/widget/reftests/664925.xhtml
@@ -0,0 +1 @@
+<html xmlns="http://www.w3.org/1999/xhtml"><div><td style="-moz-appearance: progressbar;"></td></div></html>
diff --git a/widget/reftests/reftest.list b/widget/reftests/reftest.list
index 1cf1e1f3f3a6..7200783baf84 100644
--- a/widget/reftests/reftest.list
+++ b/widget/reftests/reftest.list
@@ -1,2 +1,3 @@
 skip-if(!cocoaWidget) != 507947.html about:blank
 == progressbar-fallback-default-style.html progressbar-fallback-default-style-ref.html
+load 664925.xhtml
diff --git a/widget/src/android/AndroidBridge.cpp b/widget/src/android/AndroidBridge.cpp
index 1e8493bae3fd..5415a69526a5 100644
--- a/widget/src/android/AndroidBridge.cpp
+++ b/widget/src/android/AndroidBridge.cpp
@@ -48,6 +48,7 @@
 #include "nsOSHelperAppService.h"
 #include "nsWindow.h"
 #include "mozilla/Preferences.h"
+#include "nsINetworkLinkService.h"
 
 #ifdef DEBUG
 #define ALOG_BRIDGE(args...) ALOG(args)
@@ -141,6 +142,7 @@ AndroidBridge::Init(JNIEnv *jEnv,
     jSetKeepScreenOn = (jmethodID) jEnv->GetStaticMethodID(jGeckoAppShellClass, "setKeepScreenOn", "(Z)V");
     jIsNetworkLinkUp = (jmethodID) jEnv->GetStaticMethodID(jGeckoAppShellClass, "isNetworkLinkUp", "()Z");
     jIsNetworkLinkKnown = (jmethodID) jEnv->GetStaticMethodID(jGeckoAppShellClass, "isNetworkLinkKnown", "()Z");
+    jGetNetworkLinkType = (jmethodID) jEnv->GetStaticMethodID(jGeckoAppShellClass, "getNetworkLinkType", "()I");
     jSetSelectedLocale = (jmethodID) jEnv->GetStaticMethodID(jGeckoAppShellClass, "setSelectedLocale", "(Ljava/lang/String;)V");
     jScanMedia = (jmethodID) jEnv->GetStaticMethodID(jGeckoAppShellClass, "scanMedia", "(Ljava/lang/String;Ljava/lang/String;)V");
     jGetSystemColors = (jmethodID) jEnv->GetStaticMethodID(jGeckoAppShellClass, "getSystemColors", "()[I");
@@ -669,6 +671,13 @@ AndroidBridge::IsNetworkLinkKnown()
     return !!mJNIEnv->CallStaticBooleanMethod(mGeckoAppShellClass, jIsNetworkLinkKnown);
 }
 
+int
+AndroidBridge::GetNetworkLinkType()
+{
+    ALOG_BRIDGE("AndroidBridge::GetNetworkLinkType");
+    return (int) mJNIEnv->CallStaticIntMethod(mGeckoAppShellClass, jGetNetworkLinkType);
+}
+
 void
 AndroidBridge::SetSelectedLocale(const nsAString& aLocale)
 {
diff --git a/widget/src/android/AndroidBridge.h b/widget/src/android/AndroidBridge.h
index 54c0b75ed8a7..0b4c301b7cac 100644
--- a/widget/src/android/AndroidBridge.h
+++ b/widget/src/android/AndroidBridge.h
@@ -204,6 +204,8 @@ public:
 
     bool IsNetworkLinkKnown();
 
+    int GetNetworkLinkType();
+
     void SetSelectedLocale(const nsAString&);
 
     void GetSystemColors(AndroidSystemColors *aColors);
@@ -312,6 +314,7 @@ protected:
     jmethodID jSetKeepScreenOn;
     jmethodID jIsNetworkLinkUp;
     jmethodID jIsNetworkLinkKnown;
+    jmethodID jGetNetworkLinkType;
     jmethodID jSetSelectedLocale;
     jmethodID jScanMedia;
     jmethodID jGetSystemColors;
diff --git a/widget/src/android/AndroidJNI.cpp b/widget/src/android/AndroidJNI.cpp
index 73850ed66f91..869e651d55bd 100644
--- a/widget/src/android/AndroidJNI.cpp
+++ b/widget/src/android/AndroidJNI.cpp
@@ -69,7 +69,7 @@ extern "C" {
     NS_EXPORT void JNICALL Java_org_mozilla_gecko_GeckoAppShell_onLowMemory(JNIEnv *, jclass);
     NS_EXPORT void JNICALL Java_org_mozilla_gecko_GeckoAppShell_callObserver(JNIEnv *, jclass, jstring observerKey, jstring topic, jstring data);
     NS_EXPORT void JNICALL Java_org_mozilla_gecko_GeckoAppShell_removeObserver(JNIEnv *jenv, jclass, jstring jObserverKey);
-    NS_EXPORT void JNICALL Java_org_mozilla_gecko_GeckoAppShell_onChangeNetworkLinkStatus(JNIEnv *, jclass, jstring status);
+    NS_EXPORT void JNICALL Java_org_mozilla_gecko_GeckoAppShell_onChangeNetworkLinkStatus(JNIEnv *, jclass, jstring status, jstring type);
     NS_EXPORT void JNICALL Java_org_mozilla_gecko_GeckoAppShell_reportJavaCrash(JNIEnv *, jclass, jstring stack);
 }
 
@@ -143,7 +143,7 @@ Java_org_mozilla_gecko_GeckoAppShell_removeObserver(JNIEnv *jenv, jclass, jstrin
 }
 
 NS_EXPORT void JNICALL
-Java_org_mozilla_gecko_GeckoAppShell_onChangeNetworkLinkStatus(JNIEnv *jenv, jclass, jstring jStatus)
+Java_org_mozilla_gecko_GeckoAppShell_onChangeNetworkLinkStatus(JNIEnv *jenv, jclass, jstring jStatus, jstring jType)
 {
     if (!nsAppShell::gAppShell)
         return;
@@ -153,6 +153,12 @@ Java_org_mozilla_gecko_GeckoAppShell_onChangeNetworkLinkStatus(JNIEnv *jenv, jcl
     nsAppShell::gAppShell->NotifyObservers(nsnull,
                                            NS_NETWORK_LINK_TOPIC,
                                            sStatus.get());
+
+    nsJNIString sType(jType, jenv);
+
+    nsAppShell::gAppShell->NotifyObservers(nsnull,
+                                           NS_NETWORK_LINK_TYPE_TOPIC,
+                                           sType.get());
 }
 
 NS_EXPORT void JNICALL
diff --git a/widget/src/gtk2/Makefile.in b/widget/src/gtk2/Makefile.in
index 3db756e43002..4dbdeb0deeee 100644
--- a/widget/src/gtk2/Makefile.in
+++ b/widget/src/gtk2/Makefile.in
@@ -137,6 +137,8 @@ DEFINES		+= -DCAIRO_GFX
 INCLUDES	+= \
 		-I$(srcdir)/../xpwidgets \
 		-I$(srcdir)/../shared \
+		-I$(topsrcdir)/layout/generic \
+		-I$(topsrcdir)/layout/xul/base/src \
 		-I$(topsrcdir)/other-licenses/atk-1.0 \
 		$(NULL)
 ifdef MOZ_X11
diff --git a/widget/src/gtk2/nsNativeThemeGTK.cpp b/widget/src/gtk2/nsNativeThemeGTK.cpp
index 5290ff4c6f58..d8f2d926106a 100644
--- a/widget/src/gtk2/nsNativeThemeGTK.cpp
+++ b/widget/src/gtk2/nsNativeThemeGTK.cpp
@@ -54,7 +54,7 @@
 #include "nsILookAndFeel.h"
 #include "nsGfxCIID.h"
 #include "nsTransform2D.h"
-#include "nsIMenuFrame.h"
+#include "nsMenuFrame.h"
 #include "prlink.h"
 #include "nsIDOMHTMLInputElement.h"
 #include "nsRenderingContext.h"
@@ -332,7 +332,7 @@ nsNativeThemeGTK::GetGtkWidgetAndState(PRUint8 aWidgetType, nsIFrame* aFrame,
             aWidgetType == NS_THEME_MENUSEPARATOR ||
             aWidgetType == NS_THEME_MENUARROW) {
           PRBool isTopLevel = PR_FALSE;
-          nsIMenuFrame *menuFrame = do_QueryFrame(aFrame);
+          nsMenuFrame *menuFrame = do_QueryFrame(aFrame);
           if (menuFrame) {
             isTopLevel = menuFrame->IsOnMenuBar();
           }
diff --git a/widget/src/gtk2/nsWindow.cpp b/widget/src/gtk2/nsWindow.cpp
index c356d835811c..86aa090dc1a2 100644
--- a/widget/src/gtk2/nsWindow.cpp
+++ b/widget/src/gtk2/nsWindow.cpp
@@ -1111,6 +1111,10 @@ nsWindow::Show(PRBool aState)
 NS_IMETHODIMP
 nsWindow::Resize(PRInt32 aWidth, PRInt32 aHeight, PRBool aRepaint)
 {
+    // For top-level windows, aWidth and aHeight should possibly be
+    // interpreted as frame bounds, but NativeResize treats these as window
+    // bounds (Bug 581866).
+
     mBounds.SizeTo(GetSafeWindowSize(nsIntSize(aWidth, aHeight)));
 
     if (!mCreated)
@@ -1547,11 +1551,13 @@ nsWindow::GetScreenBounds(nsIntRect &aRect)
     else {
         aRect.MoveTo(WidgetToScreenOffset());
     }
+    // mBounds.Size() is the window bounds, not the window-manager frame
+    // bounds (bug 581863).  gdk_window_get_frame_extents would give the
+    // frame bounds, but mBounds.Size() is returned here for consistency
+    // with Resize.
     aRect.SizeTo(mBounds.Size());
-    LOG(("GetScreenBounds %d %d | %d %d | %d %d\n",
-         aRect.x, aRect.y,
-         mBounds.width, mBounds.height,
-         aRect.width, aRect.height));
+    LOG(("GetScreenBounds %d,%d | %dx%d\n",
+         aRect.x, aRect.y, aRect.width, aRect.height));
     return NS_OK;
 }
 
@@ -2353,31 +2359,64 @@ nsWindow::OnExposeEvent(GtkWidget *aWidget, GdkEventExpose *aEvent)
 gboolean
 nsWindow::OnConfigureEvent(GtkWidget *aWidget, GdkEventConfigure *aEvent)
 {
+    // These events are only received on toplevel windows.
+    //
+    // GDK ensures that the coordinates are the client window top-left wrt the
+    // root window.
+    //
+    //   GDK calculates the cordinates for real ConfigureNotify events on
+    //   managed windows (that would normally be relative to the parent
+    //   window).
+    //
+    //   Synthetic ConfigureNotify events are from the window manager and
+    //   already relative to the root window.  GDK creates all X windows with
+    //   border_width = 0, so synthetic events also indicate the top-left of
+    //   the client window.
+    //
+    //   Override-redirect windows are children of the root window so parent
+    //   coordinates are root coordinates.
+
     LOG(("configure event [%p] %d %d %d %d\n", (void *)this,
          aEvent->x, aEvent->y, aEvent->width, aEvent->height));
 
-    // can we shortcut?
-    if (mBounds.x == aEvent->x &&
-        mBounds.y == aEvent->y)
-        return FALSE;
-
     if (mWindowType == eWindowType_toplevel || mWindowType == eWindowType_dialog) {
         check_for_rollup(aEvent->window, 0, 0, PR_FALSE, PR_TRUE);
     }
 
-    // Toplevel windows need to have their bounds set so that we can
-    // keep track of our location.  It's not often that the x,y is set
-    // by the layout engine.  Width and height are set elsewhere.
-    nsIntPoint pnt(aEvent->x, aEvent->y);
-    if (mIsTopLevel) {
-        // Need to translate this into the right coordinates
-        mBounds.MoveTo(WidgetToScreenOffset());
-        pnt = mBounds.TopLeft();
+    // This event indicates that the window position may have changed.
+    // mBounds.Size() is updated in OnSizeAllocate().
+
+    // (The gtk_window_get_window_type() function is only available from
+    // version 2.20.)
+    NS_ASSERTION(GTK_IS_WINDOW(aWidget),
+                 "Configure event on widget that is not a GtkWindow");
+    gint type;
+    g_object_get(aWidget, "type", &type, NULL);
+    if (type == GTK_WINDOW_POPUP) {
+        // Override-redirect window
+        //
+        // These windows should not be moved by the window manager, and so any
+        // change in position is a result of our direction.  mBounds has
+        // already been set in Move() or Resize(), and that is more
+        // up-to-date than the position in the ConfigureNotify event if the
+        // event is from an earlier window move.
+        //
+        // Skipping the NS_MOVE dispatch saves context menus from an infinite
+        // loop when nsXULPopupManager::PopupMoved moves the window to the new
+        // position and nsMenuPopupFrame::SetPopupPosition adds
+        // offsetForContextMenu on each iteration.
+        return FALSE;
     }
 
+    // This is wrong, but noautohide titlebar panels currently depend on it
+    // (bug 601545#c13).  mBounds.TopLeft() should refer to the
+    // window-manager frame top-left, but WidgetToScreenOffset() gives the
+    // client window origin.
+    mBounds.MoveTo(WidgetToScreenOffset());
+
     nsGUIEvent event(PR_TRUE, NS_MOVE, this);
 
-    event.refPoint = pnt;
+    event.refPoint = mBounds.TopLeft();
 
     // XXX mozilla will invalidate the entire window after this move
     // complete.  wtf?
@@ -3868,16 +3907,6 @@ nsWindow::Create(nsIWidget        *aParent,
 
     // save our bounds
     mBounds = aRect;
-    if (mWindowType != eWindowType_child &&
-        mWindowType != eWindowType_plugin) {
-        // We only move a toplevel window if someone has actually placed the
-        // window somewhere.  If no placement has taken place, we just let the
-        // window manager Do The Right Thing.
-        //
-        // Indicate that if we're shown, we at least need to have our size set.
-        // If we get explicitly moved, the position will also be set.
-        mNeedsResize = PR_TRUE;
-    }
 
     // figure out our parent window
     GtkWidget      *parentMozContainer = nsnull;
@@ -3913,6 +3942,14 @@ nsWindow::Create(nsIWidget        *aParent,
     case eWindowType_invisible: {
         mIsTopLevel = PR_TRUE;
 
+        // We only move a general managed toplevel window if someone has
+        // actually placed the window somewhere.  If no placement has taken
+        // place, we just let the window manager Do The Right Thing.
+        //
+        // Indicate that if we're shown, we at least need to have our size set.
+        // If we get explicitly moved, the position will also be set.
+        mNeedsResize = PR_TRUE;
+
         nsXPIDLString brandName;
         GetBrandName(brandName);
         NS_ConvertUTF16toUTF8 cBrand(brandName);
@@ -3949,6 +3986,11 @@ nsWindow::Create(nsIWidget        *aParent,
             }
         }
         else if (mWindowType == eWindowType_popup) {
+            // With popup windows, we want to control their position, so don't
+            // wait for the window manager to place them (which wouldn't
+            // happen with override-redirect windows anyway).
+            mNeedsMove = PR_TRUE;
+
             // Popups that are not noautohide are only temporary. The are used
             // for menus and the like and disappear when another window is used.
             if (!aInitData->mNoAutoHide) {
@@ -4402,7 +4444,9 @@ nsWindow::NativeResize(PRInt32 aX, PRInt32 aY,
     ResizeTransparencyBitmap(aWidth, aHeight);
 
     if (mIsTopLevel) {
+        // aX and aY give the position of the window manager frame top-left.
         gtk_window_move(GTK_WINDOW(mShell), aX, aY);
+        // This sets the client window size.
         gtk_window_resize(GTK_WINDOW(mShell), aWidth, aHeight);
     }
     else if (mContainer) {
diff --git a/widget/src/qt/mozqwidget.h b/widget/src/qt/mozqwidget.h
index 488fae1212ca..19de1f927b01 100644
--- a/widget/src/qt/mozqwidget.h
+++ b/widget/src/qt/mozqwidget.h
@@ -296,15 +296,14 @@ private slots:
 
     void VisibleScreenAreaChanged(const QRect& rect) {
         if (mTopLevelWidget) {
-            QRect r = mTopLevelWidget->geometry().toRect();
-            if (rect.height()) {
-                r.setHeight(rect.height());
-            }
+            QRegion region(scene()->views()[0]->rect());
+            region -= rect;
+            QRectF bounds = mapRectFromScene(region.boundingRect());
 
             nsCOMPtr<nsIObserverService> observerService = mozilla::services::GetObserverService();
             if (observerService) {
                 QString rect = QString("{\"left\": %1, \"top\": %2, \"right\": %3, \"bottom\": %4}")
-                                       .arg(r.x()).arg(r.y()).arg(r.width()).arg(r.height());
+                                       .arg(bounds.x()).arg(bounds.y()).arg(bounds.width()).arg(bounds.height());
                 observerService->NotifyObservers(nsnull, "softkb-change", rect.utf16());
             }
         }
diff --git a/widget/src/windows/Makefile.in b/widget/src/windows/Makefile.in
index 2f5945798d55..53277eae8d4b 100644
--- a/widget/src/windows/Makefile.in
+++ b/widget/src/windows/Makefile.in
@@ -124,6 +124,8 @@ LOCAL_INCLUDES	= \
 		-I. \
 		-I$(srcdir)/../xpwidgets \
 		-I$(srcdir) \
+		-I$(topsrcdir)/layout/generic \
+		-I$(topsrcdir)/layout/xul/base/src \
 		-I$(topsrcdir)/toolkit/xre \
 		-I$(topsrcdir)/xpcom/base \
 		$(NULL)
diff --git a/widget/src/windows/nsNativeThemeWin.cpp b/widget/src/windows/nsNativeThemeWin.cpp
index 8f9c99ffede4..20205852a9ba 100644
--- a/widget/src/windows/nsNativeThemeWin.cpp
+++ b/widget/src/windows/nsNativeThemeWin.cpp
@@ -55,7 +55,7 @@
 #include "nsINameSpaceManager.h"
 #include "nsILookAndFeel.h"
 #include "nsIDOMHTMLInputElement.h"
-#include "nsIMenuFrame.h"
+#include "nsMenuFrame.h"
 #include "nsWidgetAtoms.h"
 #include <malloc.h>
 #include "nsWindow.h"
@@ -148,7 +148,7 @@ nsNativeThemeWin::~nsNativeThemeWin() {
 static PRBool IsTopLevelMenu(nsIFrame *aFrame)
 {
   PRBool isTopLevel(PR_FALSE);
-  nsIMenuFrame *menuFrame = do_QueryFrame(aFrame);
+  nsMenuFrame *menuFrame = do_QueryFrame(aFrame);
   if (menuFrame) {
     isTopLevel = menuFrame->IsOnMenuBar();
   }
@@ -1062,7 +1062,7 @@ nsNativeThemeWin::GetThemePartAndState(nsIFrame* aFrame, PRUint8 aWidgetType,
       PRBool isTopLevel = PR_FALSE;
       PRBool isOpen = PR_FALSE;
       PRBool isHover = PR_FALSE;
-      nsIMenuFrame *menuFrame = do_QueryFrame(aFrame);
+      nsMenuFrame *menuFrame = do_QueryFrame(aFrame);
       nsEventStates eventState = GetContentState(aFrame, aWidgetType);
 
       isTopLevel = IsTopLevelMenu(aFrame);
@@ -2759,7 +2759,7 @@ nsresult nsNativeThemeWin::ClassicGetThemePartAndState(nsIFrame* aFrame, PRUint8
       PRBool isTopLevel = PR_FALSE;
       PRBool isOpen = PR_FALSE;
       PRBool isContainer = PR_FALSE;
-      nsIMenuFrame *menuFrame = do_QueryFrame(aFrame);
+      nsMenuFrame *menuFrame = do_QueryFrame(aFrame);
       nsEventStates eventState = GetContentState(aFrame, aWidgetType);
 
       // We indicate top-level-ness using aPart. 0 is a normal menu item,
diff --git a/widget/src/xpwidgets/nsNativeTheme.cpp b/widget/src/xpwidgets/nsNativeTheme.cpp
index a053cd9f8ae9..8cbd008c4971 100644
--- a/widget/src/xpwidgets/nsNativeTheme.cpp
+++ b/widget/src/xpwidgets/nsNativeTheme.cpp
@@ -53,7 +53,7 @@
 #include "nsIComponentManager.h"
 #include "nsPIDOMWindow.h"
 #include "nsProgressFrame.h"
-#include "nsIMenuFrame.h"
+#include "nsMenuFrame.h"
 
 nsNativeTheme::nsNativeTheme()
 : mAnimatedContentTimeout(PR_UINT32_MAX)
@@ -514,7 +514,7 @@ nsNativeTheme::IsSubmenu(nsIFrame* aFrame, PRBool* aLeftOfParent)
 PRBool
 nsNativeTheme::IsRegularMenuItem(nsIFrame *aFrame)
 {
-  nsIMenuFrame *menuFrame = do_QueryFrame(aFrame);
+  nsMenuFrame *menuFrame = do_QueryFrame(aFrame);
   return !(menuFrame && (menuFrame->IsOnMenuBar() ||
                          menuFrame->GetParentMenuListType() != eNotMenuList));
 }
diff --git a/xpcom/glue/arm.h b/xpcom/glue/arm.h
index 294065baba30..c935bb20672b 100644
--- a/xpcom/glue/arm.h
+++ b/xpcom/glue/arm.h
@@ -123,7 +123,7 @@
 #  if defined(HAVE_ARM_SIMD)
 #    define MOZILLA_MAY_SUPPORT_ARMV6 1
 #  endif
-#  if defined(HAVE_ARM_SIMD)
+#  if defined(HAVE_ARM_NEON)
 #    define MOZILLA_MAY_SUPPORT_NEON 1
 #  endif
 
diff --git a/xpcom/system/nsIDeviceMotion.idl b/xpcom/system/nsIDeviceMotion.idl
index e20bfbaf7699..f24144f6a3e6 100644
--- a/xpcom/system/nsIDeviceMotion.idl
+++ b/xpcom/system/nsIDeviceMotion.idl
@@ -57,14 +57,16 @@ interface nsIDeviceMotionListener : nsISupports
   void onMotionChange(in nsIDeviceMotionData aMotionData);
 };
 
-[scriptable, uuid(4B04E228-0B33-43FC-971F-AF60CEDB1C21)]
+[scriptable, uuid(B6E5C463-AAA6-44E2-BD07-7A7DC6192E68)]
 interface nsIDeviceMotion : nsISupports
 {
   void addListener(in nsIDeviceMotionListener aListener);
   void removeListener(in nsIDeviceMotionListener aListener);
 
-  void addWindowListener(in nsIDOMWindow aWindow);
-  void removeWindowListener(in nsIDOMWindow aWindow);
+  // Holds pointers, not AddRef objects -- it is up to the caller
+  // to call RemoveWindowListener before the window is deleted.
+  [noscript] void addWindowListener(in nsIDOMWindow aWindow);
+  [noscript] void removeWindowListener(in nsIDOMWindow aWindow);
 
 };
 
diff --git a/xpfe/appshell/src/nsWebShellWindow.cpp b/xpfe/appshell/src/nsWebShellWindow.cpp
index c8fa8dcd2aed..203a99c53a6c 100644
--- a/xpfe/appshell/src/nsWebShellWindow.cpp
+++ b/xpfe/appshell/src/nsWebShellWindow.cpp
@@ -381,13 +381,16 @@ nsWebShellWindow::HandleEvent(nsGUIEvent *aEvent)
         eventWindow->SetPersistenceTimer(PAD_MISC);
         result = nsEventStatus_eConsumeDoDefault;
 
-        // min, max, and normal are all the same to apps, but for
-        // fullscreen we need to let them know so they can update
-        // their ui. 
-        if (modeEvent->mSizeMode == nsSizeMode_Fullscreen) {
-          nsCOMPtr<nsIDOMWindowInternal> ourWindow = do_GetInterface(docShell);
-          if (ourWindow)
+        nsCOMPtr<nsPIDOMWindow> ourWindow = do_GetInterface(docShell);
+        if (ourWindow) {
+          // Let the application know if it's in fullscreen mode so it
+          // can update its UI.
+          if (modeEvent->mSizeMode == nsSizeMode_Fullscreen) {
             ourWindow->SetFullScreen(PR_TRUE);
+          }
+
+          // And always fire a user-defined sizemodechange event on the window
+          ourWindow->DispatchCustomEvent("sizemodechange");
         }
 
         // Note the current implementation of SetSizeMode just stores