Merge m-c to s-c.
authorRichard Newman <rnewman@mozilla.com>
Tue, 10 Apr 2012 22:20:12 -0700
changeset 91393 e9bfc7255afde4d7629210b699c3887b5ccb415a
parent 91392 cf6ac3f55a41ae0784d353e577e22d36816bde6e (current diff)
parent 91314 4db1292be760c4ddc632dbf8f5d69d73840b9ce2 (diff)
child 91394 1711e06ca9f7b8cba7ecb27a48b9fd8ad1980a26
push id672
push usertim.taubert@gmx.de
push dateFri, 13 Apr 2012 10:22:59 +0000
treeherderfx-team@cb2e81306595 [default view] [failures only]
perfherder[talos] [build metrics] [platform microbench] (compared to previous push)
milestone14.0a1
Merge m-c to s-c.
accessible/src/atk/nsARIAGridAccessibleWrap.h
accessible/src/base/nsARIAGridAccessible.cpp
accessible/src/base/nsARIAGridAccessible.h
accessible/src/mac/nsARIAGridAccessibleWrap.h
accessible/src/msaa/nsARIAGridAccessibleWrap.cpp
accessible/src/msaa/nsARIAGridAccessibleWrap.h
accessible/src/other/nsARIAGridAccessibleWrap.h
browser/config/mozconfigs/macosx-lion-universal/nightly
browser/config/mozconfigs/macosx-lion-universal/release
browser/config/mozconfigs/macosx-lion-universal/shark
browser/config/mozconfigs/macosx32-lion/debug
browser/config/mozconfigs/macosx64-lion/debug
browser/config/mozconfigs/macosx64-lion/l10n-mozconfig
netwerk/test/unit/test_mismatch_lm.js
rename from accessible/src/atk/nsARIAGridAccessibleWrap.h
rename to accessible/src/atk/ARIAGridAccessibleWrap.h
--- a/accessible/src/atk/nsARIAGridAccessibleWrap.h
+++ b/accessible/src/atk/ARIAGridAccessibleWrap.h
@@ -32,18 +32,23 @@
  * use your version of this file under the terms of the MPL, indicate your
  * decision by deleting the provisions above and replace them with the notice
  * and other provisions required by the GPL or the LGPL. If you do not delete
  * the provisions above, a recipient may use your version of this file under
  * the terms of any one of the MPL, the GPL or the LGPL.
  *
  * ***** END LICENSE BLOCK ***** */
 
-#ifndef _NSARIAGRIDACCESSIBLEWRAP_H
-#define _NSARIAGRIDACCESSIBLEWRAP_H
+#ifndef MOZILLA_A11Y_ARIAGRIDACCESSIBLEWRAP_H
+#define MOZILLA_A11Y_ARIAGRIDACCESSIBLEWRAP_H
+
+#include "ARIAGridAccessible.h"
 
-#include "nsARIAGridAccessible.h"
+namespace mozilla {
+namespace a11y {
 
-typedef class nsARIAGridAccessible nsARIAGridAccessibleWrap;
-typedef class nsARIAGridCellAccessible nsARIAGridCellAccessibleWrap;
+typedef class ARIAGridAccessible ARIAGridAccessibleWrap;
+typedef class ARIAGridCellAccessible ARIAGridCellAccessibleWrap;
+
+} // namespace a11y
+} // namespace mozilla
 
 #endif
-
--- a/accessible/src/atk/Makefile.in
+++ b/accessible/src/atk/Makefile.in
@@ -64,19 +64,19 @@ CPPSRCS = \
   nsMaiInterfaceHypertext.cpp \
   nsMaiInterfaceHyperlinkImpl.cpp \
   nsMaiInterfaceTable.cpp \
   nsMaiInterfaceDocument.cpp \
   nsMaiInterfaceImage.cpp \
   $(NULL)
 
 EXPORTS = \
+  ARIAGridAccessibleWrap.h \
   AtkSocketAccessible.h \
   nsAccessNodeWrap.h \
-  nsARIAGridAccessibleWrap.h \
   nsAccessibleWrap.h \
   nsDocAccessibleWrap.h \
   nsRootAccessibleWrap.h \
   nsTextAccessibleWrap.h \
   nsXULMenuAccessibleWrap.h \
   nsXULListboxAccessibleWrap.h \
   nsXULTreeGridAccessibleWrap.h \
   nsHyperTextAccessibleWrap.h \
--- a/accessible/src/base/Makefile.in
+++ b/accessible/src/base/Makefile.in
@@ -53,17 +53,16 @@ CPPSRCS = \
   AccGroupInfo.cpp \
   AccIterator.cpp \
   ARIAStateMap.cpp \
   filters.cpp \
   FocusManager.cpp \
   NotificationController.cpp \
   nsAccDocManager.cpp \
   nsAccessNode.cpp \
-  nsARIAGridAccessible.cpp \
   nsARIAMap.cpp \
   nsDocAccessible.cpp \
   nsCoreUtils.cpp \
   nsAccUtils.cpp \
   nsAccessibilityService.cpp \
   nsAccessible.cpp \
   nsAccessiblePivot.cpp \
   nsAccTreeWalker.cpp \
@@ -104,19 +103,19 @@ FORCE_STATIC_LIB = 1
 include $(topsrcdir)/config/rules.mk
 
 LOCAL_INCLUDES += \
   -I$(srcdir) \
   -I$(srcdir)/../generic \
   -I$(srcdir)/../html \
   -I$(srcdir)/../xpcom \
   -I$(srcdir)/../xul \
+  -I$(srcdir)/../xforms \
   -I$(srcdir)/../../../layout/generic \
   -I$(srcdir)/../../../layout/style \
   -I$(srcdir)/../../../layout/xul/base/src \
-  -I$(srcdir)/../xforms \
   $(NULL)
 
 ifeq ($(MOZ_WIDGET_TOOLKIT),gtk2)
 LOCAL_INCLUDES += \
   -I$(srcdir)/../atk \
   $(NULL)
 endif
--- a/accessible/src/base/nsAccessibilityService.cpp
+++ b/accessible/src/base/nsAccessibilityService.cpp
@@ -31,94 +31,84 @@
  * use your version of this file under the terms of the MPL, indicate your
  * decision by deleting the provisions above and replace them with the notice
  * and other provisions required by the GPL or the LGPL. If you do not delete
  * the provisions above, a recipient may use your version of this file under
  * the terms of any one of the MPL, the GPL or the LGPL.
  *
  * ***** END LICENSE BLOCK ***** */
 
-#include "mozilla/Util.h"
+#include "nsAccessibilityService.h"
 
 // NOTE: alphabetically ordered
-#include "nsAccessibilityService.h"
+#include "ARIAGridAccessibleWrap.h"
+#ifdef MOZ_ACCESSIBILITY_ATK
+#include "AtkSocketAccessible.h"
+#endif
+#include "FocusManager.h"
 #include "nsAccessiblePivot.h"
-#include "nsCoreUtils.h"
 #include "nsAccUtils.h"
+#include "nsARIAMap.h"
 #include "nsApplicationAccessibleWrap.h"
-#include "nsARIAGridAccessibleWrap.h"
-#include "nsARIAMap.h"
-#include "FocusManager.h"
-
-#include "nsIContentViewer.h"
-#include "nsCURILoader.h"
-#include "nsDocAccessible.h"
+#include "nsIAccessibleProvider.h"
 #include "nsHTMLCanvasAccessible.h"
 #include "nsHTMLImageMapAccessible.h"
 #include "nsHTMLLinkAccessible.h"
 #include "nsHTMLSelectAccessible.h"
 #include "nsHTMLTableAccessibleWrap.h"
 #include "nsHTMLTextAccessible.h"
 #include "nsHyperTextAccessibleWrap.h"
-#include "nsIAccessibilityService.h"
-#include "nsIAccessibleProvider.h"
+#include "nsRootAccessibleWrap.h"
+#include "nsXFormsFormControlsAccessible.h"
+#include "nsXFormsWidgetsAccessible.h"
+#include "OuterDocAccessible.h"
 #include "Role.h"
 #include "States.h"
 #include "Statistics.h"
+#ifdef XP_WIN
+#include "nsHTMLWin32ObjectAccessible.h"
+#endif
 
+#include "nsCURILoader.h"
+#include "nsEventStates.h"
+#include "nsIContentViewer.h"
 #include "nsIDOMDocument.h"
 #include "nsIDOMHTMLAreaElement.h"
 #include "nsIDOMHTMLLegendElement.h"
 #include "nsIDOMHTMLObjectElement.h"
 #include "nsIDOMHTMLOptGroupElement.h"
 #include "nsIDOMHTMLOptionElement.h"
 #include "nsIDOMXULElement.h"
 #include "nsIHTMLDocument.h"
 #include "nsImageFrame.h"
 #include "nsILink.h"
 #include "nsIObserverService.h"
 #include "nsLayoutUtils.h"
 #include "nsNPAPIPluginInstance.h"
 #include "nsISupportsUtils.h"
 #include "nsObjectFrame.h"
-#include "nsRootAccessibleWrap.h"
 #include "nsTextFragment.h"
+#include "mozilla/FunctionTimer.h"
+#include "mozilla/dom/Element.h"
 #include "mozilla/Services.h"
-#include "nsEventStates.h"
+#include "mozilla/Util.h"
 
 #ifdef MOZ_XUL
 #include "nsXULAlertAccessible.h"
 #include "nsXULColorPickerAccessible.h"
 #include "nsXULComboboxAccessible.h"
 #include "nsXULFormControlAccessible.h"
 #include "nsXULListboxAccessibleWrap.h"
 #include "nsXULMenuAccessibleWrap.h"
 #include "nsXULSliderAccessible.h"
 #include "nsXULTabAccessible.h"
 #include "nsXULTextAccessible.h"
 #include "nsXULTreeGridAccessibleWrap.h"
 #endif
 
-// For native window support for object/embed/applet tags
-#ifdef XP_WIN
-#include "nsHTMLWin32ObjectAccessible.h"
-#endif
-
-// For embedding plugin accessibles
-#ifdef MOZ_ACCESSIBILITY_ATK
-#include "AtkSocketAccessible.h"
-#endif
-
-#include "nsXFormsFormControlsAccessible.h"
-#include "nsXFormsWidgetsAccessible.h"
-#include "OuterDocAccessible.h"
-
-#include "mozilla/FunctionTimer.h"
-#include "mozilla/dom/Element.h"
-
 using namespace mozilla;
 using namespace mozilla::a11y;
 
 ////////////////////////////////////////////////////////////////////////////////
 // nsAccessibilityService
 ////////////////////////////////////////////////////////////////////////////////
 
 nsAccessibilityService *nsAccessibilityService::gAccessibilityService = nsnull;
@@ -1171,22 +1161,22 @@ nsAccessibilityService::GetOrCreateAcces
     if (roleMapEntry) {
       // Create ARIA grid/treegrid accessibles if node is not of a child or
       // valid child of HTML table and is not a HTML table.
       if ((!partOfHTMLTable || !tryTagNameOrFrame) &&
           frameType != nsGkAtoms::tableOuterFrame) {
 
         if (roleMapEntry->role == roles::TABLE ||
             roleMapEntry->role == roles::TREE_TABLE) {
-          newAcc = new nsARIAGridAccessibleWrap(content, docAcc);
+          newAcc = new ARIAGridAccessibleWrap(content, docAcc);
 
         } else if (roleMapEntry->role == roles::GRID_CELL ||
             roleMapEntry->role == roles::ROWHEADER ||
             roleMapEntry->role == roles::COLUMNHEADER) {
-          newAcc = new nsARIAGridCellAccessibleWrap(content, docAcc);
+          newAcc = new ARIAGridCellAccessibleWrap(content, docAcc);
         }
       }
     }
 
     if (!newAcc && tryTagNameOrFrame) {
       // Prefer to use markup (mostly tag name, perhaps attributes) to
       // decide if and what kind of accessible to create.
       // The method creates accessibles for table related content too therefore
--- a/accessible/src/base/nsAccessible.cpp
+++ b/accessible/src/base/nsAccessible.cpp
@@ -1656,50 +1656,56 @@ nsAccessible::ApplyARIAState(PRUint64* a
 
   *aState |= mRoleMapEntry->state;
 
   if (aria::MapToState(mRoleMapEntry->attributeMap1, element, aState) &&
       aria::MapToState(mRoleMapEntry->attributeMap2, element, aState))
     aria::MapToState(mRoleMapEntry->attributeMap3, element, aState);
 }
 
-/* DOMString getValue (); */
 NS_IMETHODIMP
 nsAccessible::GetValue(nsAString& aValue)
 {
   if (IsDefunct())
     return NS_ERROR_FAILURE;
 
+  nsAutoString value;
+  Value(value);
+  aValue.Assign(value);
+
+  return NS_OK;
+}
+
+void
+nsAccessible::Value(nsString& aValue)
+{
   if (mRoleMapEntry) {
-    if (mRoleMapEntry->valueRule == eNoValue) {
-      return NS_OK;
-    }
+    if (mRoleMapEntry->valueRule == eNoValue)
+      return;
 
     // aria-valuenow is a number, and aria-valuetext is the optional text equivalent
     // For the string value, we will try the optional text equivalent first
     if (!mContent->GetAttr(kNameSpaceID_None,
                            nsGkAtoms::aria_valuetext, aValue)) {
       mContent->GetAttr(kNameSpaceID_None, nsGkAtoms::aria_valuenow,
                         aValue);
     }
   }
 
   if (!aValue.IsEmpty())
-    return NS_OK;
+    return;
 
   // Check if it's a simple xlink.
   if (nsCoreUtils::IsXLink(mContent)) {
     nsIPresShell* presShell = mDoc->PresShell();
     if (presShell) {
       nsCOMPtr<nsIDOMNode> DOMNode(do_QueryInterface(mContent));
-      return presShell->GetLinkLocation(DOMNode, aValue);
+      presShell->GetLinkLocation(DOMNode, aValue);
     }
   }
-
-  return NS_OK;
 }
 
 // nsIAccessibleValue
 NS_IMETHODIMP
 nsAccessible::GetMaximumValue(double *aMaximumValue)
 {
   return GetAttrValue(nsGkAtoms::aria_valuemax, aMaximumValue);
 }
--- a/accessible/src/base/nsAccessible.h
+++ b/accessible/src/base/nsAccessible.h
@@ -126,21 +126,26 @@ public:
   // nsAccessNode
 
   virtual void Shutdown();
 
   //////////////////////////////////////////////////////////////////////////////
   // Public methods
 
   /**
-   * get the description of this accessible
+   * Get the description of this accessible.
    */
   virtual void Description(nsString& aDescription);
 
   /**
+   * Get the value of this accessible.
+   */
+  virtual void Value(nsString& aValue);
+
+  /**
    * Return DOM node associated with this accessible.
    */
   inline already_AddRefed<nsIDOMNode> DOMNode() const
   {
     nsIDOMNode *DOMNode = nsnull;
     if (GetNode())
       CallQueryInterface(GetNode(), &DOMNode);
     return DOMNode;
--- a/accessible/src/base/nsApplicationAccessible.cpp
+++ b/accessible/src/base/nsApplicationAccessible.cpp
@@ -119,29 +119,28 @@ nsApplicationAccessible::GetName(nsAStri
     NS_WARNING("brandShortName not found, using default app name");
     appName.AssignLiteral("Gecko based application");
   }
 
   aName.Assign(appName);
   return NS_OK;
 }
 
-NS_IMETHODIMP
-nsApplicationAccessible::GetValue(nsAString &aValue)
-{
-  aValue.Truncate();
-  return NS_OK;
-}
-
 void
 nsApplicationAccessible::Description(nsString &aDescription)
 {
   aDescription.Truncate();
 }
 
+void
+nsApplicationAccessible::Value(nsString& aValue)
+{
+  aValue.Truncate();
+}
+
 PRUint64
 nsApplicationAccessible::State()
 {
   return IsDefunct() ? states::DEFUNCT : 0;
 }
 
 NS_IMETHODIMP
 nsApplicationAccessible::GetAttributes(nsIPersistentProperties **aAttributes)
--- a/accessible/src/base/nsApplicationAccessible.h
+++ b/accessible/src/base/nsApplicationAccessible.h
@@ -75,17 +75,16 @@ public:
   NS_SCRIPTABLE NS_IMETHOD GetRootDocument(nsIAccessibleDocument** aRootDocument);
   NS_SCRIPTABLE NS_IMETHOD ScrollTo(PRUint32 aScrollType);
   NS_SCRIPTABLE NS_IMETHOD ScrollToPoint(PRUint32 aCoordinateType, PRInt32 aX, PRInt32 aY);
   NS_SCRIPTABLE NS_IMETHOD GetLanguage(nsAString& aLanguage);
   NS_IMETHOD GetParent(nsIAccessible **aParent);
   NS_IMETHOD GetNextSibling(nsIAccessible **aNextSibling);
   NS_IMETHOD GetPreviousSibling(nsIAccessible **aPreviousSibling);
   NS_IMETHOD GetName(nsAString &aName);
-  NS_IMETHOD GetValue(nsAString &aValue);
   NS_IMETHOD GetAttributes(nsIPersistentProperties **aAttributes);
   NS_IMETHOD GroupPosition(PRInt32 *aGroupLevel, PRInt32 *aSimilarItemsInGroup,
                            PRInt32 *aPositionInGroup);
   NS_IMETHOD GetBounds(PRInt32 *aX, PRInt32 *aY,
                        PRInt32 *aWidth, PRInt32 *aHeight);
   NS_IMETHOD SetSelected(bool aIsSelected);
   NS_IMETHOD TakeSelection();
   NS_IMETHOD TakeFocus();
@@ -99,16 +98,17 @@ public:
   // nsAccessNode
   virtual bool Init();
   virtual void Shutdown();
   virtual bool IsPrimaryForNode() const;
 
   // nsAccessible
   virtual void ApplyARIAState(PRUint64* aState);
   virtual void Description(nsString& aDescription);
+  virtual void Value(nsString& aValue);
   virtual mozilla::a11y::role NativeRole();
   virtual PRUint64 State();
   virtual PRUint64 NativeState();
   virtual Relation RelationByType(PRUint32 aRelType);
 
   virtual nsAccessible* ChildAtPoint(PRInt32 aX, PRInt32 aY,
                                      EWhichChildAtPoint aWhichChild);
   virtual nsAccessible* FocusedChild();
--- a/accessible/src/base/nsBaseWidgetAccessible.cpp
+++ b/accessible/src/base/nsBaseWidgetAccessible.cpp
@@ -119,26 +119,27 @@ nsLinkableAccessible::NativeState()
     states |= states::LINKED;
     if (mActionAcc->State() & states::TRAVERSED)
       states |= states::TRAVERSED;
   }
 
   return states;
 }
 
-NS_IMETHODIMP
-nsLinkableAccessible::GetValue(nsAString& aValue)
+void
+nsLinkableAccessible::Value(nsString& aValue)
 {
   aValue.Truncate();
 
-  nsAccessible::GetValue(aValue);
+  nsAccessible::Value(aValue);
   if (!aValue.IsEmpty())
-    return NS_OK;
+    return;
 
-  return mIsLink ? mActionAcc->GetValue(aValue) : NS_ERROR_NOT_IMPLEMENTED;
+  if (aValue.IsEmpty() && mIsLink)
+    mActionAcc->Value(aValue);
 }
 
 
 PRUint8
 nsLinkableAccessible::ActionCount()
 {
   return (mIsOnclick || mIsLink) ? 1 : 0;
 }
--- a/accessible/src/base/nsBaseWidgetAccessible.h
+++ b/accessible/src/base/nsBaseWidgetAccessible.h
@@ -84,23 +84,23 @@ public:
 
   nsLinkableAccessible(nsIContent* aContent, nsDocAccessible* aDoc);
 
   NS_DECL_ISUPPORTS_INHERITED
 
   // nsIAccessible
   NS_IMETHOD GetActionName(PRUint8 aIndex, nsAString& aName);
   NS_IMETHOD DoAction(PRUint8 index);
-  NS_IMETHOD GetValue(nsAString& _retval);
   NS_IMETHOD TakeFocus();
 
   // nsAccessNode
   virtual void Shutdown();
 
   // nsAccessible
+  virtual void Value(nsString& aValue);
   virtual PRUint64 NativeState();
 
   // ActionAccessible
   virtual PRUint8 ActionCount();
   virtual KeyBinding AccessKey() const;
 
   // HyperLinkAccessible
   virtual already_AddRefed<nsIURI> AnchorURIAt(PRUint32 aAnchorIndex);
--- a/accessible/src/base/nsFormControlAccessible.cpp
+++ b/accessible/src/base/nsFormControlAccessible.cpp
@@ -105,42 +105,39 @@ ProgressMeterAccessible<Max>::IsWidget()
 {
   return true;
 }
 
 ////////////////////////////////////////////////////////////////////////////////
 // nsIAccessibleValue
 
 template<int Max>
-NS_IMETHODIMP
-ProgressMeterAccessible<Max>::GetValue(nsAString& aValue)
+void
+ProgressMeterAccessible<Max>::Value(nsString& aValue)
 {
-  nsresult rv = nsFormControlAccessible::GetValue(aValue);
-  NS_ENSURE_SUCCESS(rv, rv);
-
+  nsFormControlAccessible::Value(aValue);
   if (!aValue.IsEmpty())
-    return NS_OK;
+    return;
 
   double maxValue = 0;
-  rv = GetMaximumValue(&maxValue);
-  NS_ENSURE_SUCCESS(rv, rv);
+  nsresult rv = GetMaximumValue(&maxValue);
+  NS_ENSURE_SUCCESS(rv, );
+  if (maxValue == 0)
+    return;
 
   double curValue = 0;
-  rv = GetCurrentValue(&curValue);
-  NS_ENSURE_SUCCESS(rv, rv);
+  GetCurrentValue(&curValue);
+  NS_ENSURE_SUCCESS(rv, );
 
   // Treat the current value bigger than maximum as 100%.
   double percentValue = (curValue < maxValue) ?
     (curValue / maxValue) * 100 : 100;
 
-  nsAutoString value;
-  value.AppendFloat(percentValue); // AppendFloat isn't available on nsAString
-  value.AppendLiteral("%");
-  aValue = value;
-  return NS_OK;
+  aValue.AppendFloat(percentValue);
+  aValue.AppendLiteral("%");
 }
 
 template<int Max>
 NS_IMETHODIMP
 ProgressMeterAccessible<Max>::GetMaximumValue(double* aMaximumValue)
 {
   nsresult rv = nsFormControlAccessible::GetMaximumValue(aMaximumValue);
   if (rv != NS_OK_NO_ARIA_VALUE)
--- a/accessible/src/base/nsFormControlAccessible.h
+++ b/accessible/src/base/nsFormControlAccessible.h
@@ -53,20 +53,18 @@ public:
   ProgressMeterAccessible(nsIContent* aContent, nsDocAccessible* aDoc) :
     nsFormControlAccessible(aContent, aDoc)
   {
   }
 
   NS_DECL_ISUPPORTS_INHERITED
   NS_DECL_NSIACCESSIBLEVALUE
 
-  // nsIAccessible
-  NS_IMETHOD GetValue(nsAString &aValue);
-
   // nsAccessible
+  virtual void Value(nsString& aValue);
   virtual mozilla::a11y::role NativeRole();
   virtual PRUint64 NativeState();
 
   // Widgets
   virtual bool IsWidget() const;
 };
 
 /**
--- a/accessible/src/base/nsTextEquivUtils.cpp
+++ b/accessible/src/base/nsTextEquivUtils.cpp
@@ -278,18 +278,17 @@ nsTextEquivUtils::AppendFromValue(nsAcce
 
   // Implementation of step f. of text equivalent computation. If the given
   // accessible is not root accessible (the accessible the text equivalent is
   // computed for in the end) then append accessible value. Otherwise append
   // value if and only if the given accessible is in the middle of its parent.
 
   nsAutoString text;
   if (aAccessible != gInitiatorAcc) {
-    nsresult rv = aAccessible->GetValue(text);
-    NS_ENSURE_SUCCESS(rv, rv);
+    aAccessible->Value(text);
 
     return AppendString(aString, text) ?
       NS_OK : NS_OK_NO_NAME_CLAUSE_HANDLED;
   }
 
   //XXX: is it necessary to care the accessible is not a document?
   if (aAccessible->IsDocumentNode())
     return NS_ERROR_UNEXPECTED;
@@ -299,18 +298,17 @@ nsTextEquivUtils::AppendFromValue(nsAcce
   for (nsIContent* childContent = content->GetPreviousSibling(); childContent;
        childContent = childContent->GetPreviousSibling()) {
     // check for preceding text...
     if (!childContent->TextIsOnlyWhitespace()) {
       for (nsIContent* siblingContent = content->GetNextSibling(); siblingContent;
            siblingContent = siblingContent->GetNextSibling()) {
         // .. and subsequent text
         if (!siblingContent->TextIsOnlyWhitespace()) {
-          nsresult rv = aAccessible->GetValue(text);
-          NS_ENSURE_SUCCESS(rv, rv);
+          aAccessible->Value(text);
 
           return AppendString(aString, text) ?
             NS_OK : NS_OK_NO_NAME_CLAUSE_HANDLED;
           break;
         }
       }
       break;
     }
rename from accessible/src/base/nsARIAGridAccessible.cpp
rename to accessible/src/generic/ARIAGridAccessible.cpp
--- a/accessible/src/base/nsARIAGridAccessible.cpp
+++ b/accessible/src/generic/ARIAGridAccessible.cpp
@@ -31,136 +31,137 @@
  * use your version of this file under the terms of the MPL, indicate your
  * decision by deleting the provisions above and replace them with the notice
  * and other provisions required by the GPL or the LGPL. If you do not delete
  * the provisions above, a recipient may use your version of this file under
  * the terms of any one of the MPL, the GPL or the LGPL.
  *
  * ***** END LICENSE BLOCK ***** */
 
-#include "nsARIAGridAccessible.h"
+#include "ARIAGridAccessible.h"
 
 #include "AccIterator.h"
 #include "nsAccUtils.h"
 #include "Role.h"
 #include "States.h"
 
 #include "nsIMutableArray.h"
 #include "nsComponentManagerUtils.h"
 
+using namespace mozilla;
 using namespace mozilla::a11y;
 
 ////////////////////////////////////////////////////////////////////////////////
-// nsARIAGridAccessible
+// ARIAGridAccessible
 ////////////////////////////////////////////////////////////////////////////////
 
 
 ////////////////////////////////////////////////////////////////////////////////
 // Constructor
 
-nsARIAGridAccessible::
-  nsARIAGridAccessible(nsIContent* aContent, nsDocAccessible* aDoc) :
+ARIAGridAccessible::
+  ARIAGridAccessible(nsIContent* aContent, nsDocAccessible* aDoc) :
   nsAccessibleWrap(aContent, aDoc), xpcAccessibleTable(this)
 {
 }
 
 ////////////////////////////////////////////////////////////////////////////////
 // nsISupports
 
-NS_IMPL_ISUPPORTS_INHERITED1(nsARIAGridAccessible,
+NS_IMPL_ISUPPORTS_INHERITED1(ARIAGridAccessible,
                              nsAccessible,
                              nsIAccessibleTable)
 
 ////////////////////////////////////////////////////////////////////////////////
 //nsAccessNode
 
 void
-nsARIAGridAccessible::Shutdown()
+ARIAGridAccessible::Shutdown()
 {
   mTable = nsnull;
   nsAccessibleWrap::Shutdown();
 }
 
 ////////////////////////////////////////////////////////////////////////////////
 // nsIAccessibleTable
 
 NS_IMETHODIMP
-nsARIAGridAccessible::GetSummary(nsAString &aSummary)
+ARIAGridAccessible::GetSummary(nsAString& aSummary)
 {
   aSummary.Truncate();
 
   if (IsDefunct())
     return NS_ERROR_FAILURE;
 
   // XXX: should be pointed by aria-describedby on grid?
   return NS_ERROR_NOT_IMPLEMENTED;
 }
 
 NS_IMETHODIMP
-nsARIAGridAccessible::GetColumnCount(PRInt32 *acolumnCount)
+ARIAGridAccessible::GetColumnCount(PRInt32* aColumnCount)
 {
-  NS_ENSURE_ARG_POINTER(acolumnCount);
-  *acolumnCount = 0;
+  NS_ENSURE_ARG_POINTER(aColumnCount);
+  *aColumnCount = 0;
 
   if (IsDefunct())
     return NS_ERROR_FAILURE;
 
   AccIterator rowIter(this, filters::GetRow);
   nsAccessible* row = rowIter.Next();
   if (!row)
     return NS_OK;
 
   AccIterator cellIter(row, filters::GetCell);
   nsAccessible *cell = nsnull;
 
   while ((cell = cellIter.Next()))
-    (*acolumnCount)++;
+    (*aColumnCount)++;
 
   return NS_OK;
 }
 
 NS_IMETHODIMP
-nsARIAGridAccessible::GetRowCount(PRInt32 *arowCount)
+ARIAGridAccessible::GetRowCount(PRInt32* aRowCount)
 {
-  NS_ENSURE_ARG_POINTER(arowCount);
-  *arowCount = 0;
+  NS_ENSURE_ARG_POINTER(aRowCount);
+  *aRowCount = 0;
 
   if (IsDefunct())
     return NS_ERROR_FAILURE;
 
   AccIterator rowIter(this, filters::GetRow);
   while (rowIter.Next())
-    (*arowCount)++;
+    (*aRowCount)++;
 
   return NS_OK;
 }
 
 NS_IMETHODIMP
-nsARIAGridAccessible::GetCellAt(PRInt32 aRowIndex, PRInt32 aColumnIndex,
-                                nsIAccessible **aAccessible)
+ARIAGridAccessible::GetCellAt(PRInt32 aRowIndex, PRInt32 aColumnIndex,
+                              nsIAccessible** aCell)
 {
-  NS_ENSURE_ARG_POINTER(aAccessible);
-  *aAccessible = nsnull;
+  NS_ENSURE_ARG_POINTER(aCell);
+  *aCell = nsnull;
 
   if (IsDefunct())
     return NS_ERROR_FAILURE;
 
   nsAccessible *row = GetRowAt(aRowIndex);
   NS_ENSURE_ARG(row);
 
   nsAccessible *cell = GetCellInRowAt(row, aColumnIndex);
   NS_ENSURE_ARG(cell);
 
-  NS_ADDREF(*aAccessible = cell);
+  NS_ADDREF(*aCell = cell);
   return NS_OK;
 }
 
 NS_IMETHODIMP
-nsARIAGridAccessible::GetCellIndexAt(PRInt32 aRowIndex, PRInt32 aColumnIndex,
-                                     PRInt32 *aCellIndex)
+ARIAGridAccessible::GetCellIndexAt(PRInt32 aRowIndex, PRInt32 aColumnIndex,
+                                   PRInt32* aCellIndex)
 {
   NS_ENSURE_ARG_POINTER(aCellIndex);
   *aCellIndex = -1;
 
   if (IsDefunct())
     return NS_ERROR_FAILURE;
 
   NS_ENSURE_ARG(aRowIndex >= 0 && aColumnIndex >= 0);
@@ -173,18 +174,18 @@ nsARIAGridAccessible::GetCellIndexAt(PRI
   GetColumnCount(&colsCount);
   NS_ENSURE_ARG(aColumnIndex < colsCount);
 
   *aCellIndex = colsCount * aRowIndex + aColumnIndex;
   return NS_OK;
 }
 
 NS_IMETHODIMP
-nsARIAGridAccessible::GetColumnIndexAt(PRInt32 aCellIndex,
-                                       PRInt32 *aColumnIndex)
+ARIAGridAccessible::GetColumnIndexAt(PRInt32 aCellIndex,
+                                     PRInt32* aColumnIndex)
 {
   NS_ENSURE_ARG_POINTER(aColumnIndex);
   *aColumnIndex = -1;
 
   if (IsDefunct())
     return NS_ERROR_FAILURE;
 
   NS_ENSURE_ARG(aCellIndex >= 0);
@@ -197,17 +198,17 @@ nsARIAGridAccessible::GetColumnIndexAt(P
 
   NS_ENSURE_ARG(aCellIndex < rowCount * colsCount);
 
   *aColumnIndex = aCellIndex % colsCount;
   return NS_OK;
 }
 
 NS_IMETHODIMP
-nsARIAGridAccessible::GetRowIndexAt(PRInt32 aCellIndex, PRInt32 *aRowIndex)
+ARIAGridAccessible::GetRowIndexAt(PRInt32 aCellIndex, PRInt32* aRowIndex)
 {
   NS_ENSURE_ARG_POINTER(aRowIndex);
   *aRowIndex = -1;
 
   if (IsDefunct())
     return NS_ERROR_FAILURE;
 
   NS_ENSURE_ARG(aCellIndex >= 0);
@@ -220,19 +221,19 @@ nsARIAGridAccessible::GetRowIndexAt(PRIn
 
   NS_ENSURE_ARG(aCellIndex < rowCount * colsCount);
 
   *aRowIndex = aCellIndex / colsCount;
   return NS_OK;
 }
 
 NS_IMETHODIMP
-nsARIAGridAccessible::GetRowAndColumnIndicesAt(PRInt32 aCellIndex,
-                                               PRInt32* aRowIndex,
-                                               PRInt32* aColumnIndex)
+ARIAGridAccessible::GetRowAndColumnIndicesAt(PRInt32 aCellIndex,
+                                             PRInt32* aRowIndex,
+                                             PRInt32* aColumnIndex)
 {
   NS_ENSURE_ARG_POINTER(aRowIndex);
   *aRowIndex = -1;
   NS_ENSURE_ARG_POINTER(aColumnIndex);
   *aColumnIndex = -1;
 
   if (IsDefunct())
     return NS_ERROR_FAILURE;
@@ -248,78 +249,78 @@ nsARIAGridAccessible::GetRowAndColumnInd
   NS_ENSURE_ARG(aCellIndex < rowCount * colsCount);
 
   *aColumnIndex = aCellIndex % colsCount;
   *aRowIndex = aCellIndex / colsCount;
   return NS_OK;
 }
 
 NS_IMETHODIMP
-nsARIAGridAccessible::GetColumnExtentAt(PRInt32 aRow, PRInt32 aColumn,
-                                        PRInt32 *aExtentCount)
+ARIAGridAccessible::GetRowExtentAt(PRInt32 aRow, PRInt32 aColumn,
+                                   PRInt32* aExtentCount)
 {
   NS_ENSURE_ARG_POINTER(aExtentCount);
   *aExtentCount = 0;
 
   if (IsDefunct())
     return NS_ERROR_FAILURE;
 
   NS_ENSURE_ARG(IsValidRowNColumn(aRow, aColumn));
 
   *aExtentCount = 1;
   return NS_OK;
 }
 
 NS_IMETHODIMP
-nsARIAGridAccessible::GetRowExtentAt(PRInt32 aRow, PRInt32 aColumn,
-                                      PRInt32 *aExtentCount)
+ARIAGridAccessible::GetColumnExtentAt(PRInt32 aRow, PRInt32 aColumn,
+                                      PRInt32* aExtentCount)
 {
   NS_ENSURE_ARG_POINTER(aExtentCount);
   *aExtentCount = 0;
 
   if (IsDefunct())
     return NS_ERROR_FAILURE;
 
   NS_ENSURE_ARG(IsValidRowNColumn(aRow, aColumn));
 
   *aExtentCount = 1;
   return NS_OK;
 }
 
 NS_IMETHODIMP
-nsARIAGridAccessible::GetColumnDescription(PRInt32 aColumn,
-                                           nsAString& aDescription)
+ARIAGridAccessible::GetColumnDescription(PRInt32 aColumn,
+                                         nsAString& aDescription)
 {
   aDescription.Truncate();
 
   if (IsDefunct())
     return NS_ERROR_FAILURE;
 
   NS_ENSURE_ARG(IsValidColumn(aColumn));
 
   // XXX: not implemented
   return NS_ERROR_NOT_IMPLEMENTED;
 }
 
 NS_IMETHODIMP
-nsARIAGridAccessible::GetRowDescription(PRInt32 aRow, nsAString& aDescription)
+ARIAGridAccessible::GetRowDescription(PRInt32 aRow, nsAString& aDescription)
 {
   aDescription.Truncate();
 
   if (IsDefunct())
     return NS_ERROR_FAILURE;
 
   NS_ENSURE_ARG(IsValidRow(aRow));
 
   // XXX: not implemented
   return NS_ERROR_NOT_IMPLEMENTED;
 }
 
 NS_IMETHODIMP
-nsARIAGridAccessible::IsColumnSelected(PRInt32 aColumn, bool *aIsSelected)
+ARIAGridAccessible::IsColumnSelected(PRInt32 aColumn, bool* aIsSelected)
 {
   NS_ENSURE_ARG_POINTER(aIsSelected);
   *aIsSelected = false;
 
   if (IsDefunct())
     return NS_ERROR_FAILURE;
 
   NS_ENSURE_ARG(IsValidColumn(aColumn));
@@ -340,17 +341,17 @@ nsARIAGridAccessible::IsColumnSelected(P
     }
   } while ((row = rowIter.Next()));
 
   *aIsSelected = true;
   return NS_OK;
 }
 
 NS_IMETHODIMP
-nsARIAGridAccessible::IsRowSelected(PRInt32 aRow, bool *aIsSelected)
+ARIAGridAccessible::IsRowSelected(PRInt32 aRow, bool* aIsSelected)
 {
   NS_ENSURE_ARG_POINTER(aIsSelected);
   *aIsSelected = false;
 
   if (IsDefunct())
     return NS_ERROR_FAILURE;
 
   nsAccessible *row = GetRowAt(aRow);
@@ -365,18 +366,18 @@ nsARIAGridAccessible::IsRowSelected(PRIn
     }
   }
 
   *aIsSelected = true;
   return NS_OK;
 }
 
 NS_IMETHODIMP
-nsARIAGridAccessible::IsCellSelected(PRInt32 aRow, PRInt32 aColumn,
-                                     bool *aIsSelected)
+ARIAGridAccessible::IsCellSelected(PRInt32 aRow, PRInt32 aColumn,
+                                   bool* aIsSelected)
 {
   NS_ENSURE_ARG_POINTER(aIsSelected);
   *aIsSelected = false;
 
   if (IsDefunct())
     return NS_ERROR_FAILURE;
 
   nsAccessible *row = GetRowAt(aRow);
@@ -390,17 +391,17 @@ nsARIAGridAccessible::IsCellSelected(PRI
       return NS_OK;
   }
 
   *aIsSelected = true;
   return NS_OK;
 }
 
 NS_IMETHODIMP
-nsARIAGridAccessible::GetSelectedCellCount(PRUint32* aCount)
+ARIAGridAccessible::GetSelectedCellCount(PRUint32* aCount)
 {
   NS_ENSURE_ARG_POINTER(aCount);
   *aCount = 0;
 
   if (IsDefunct())
     return NS_ERROR_FAILURE;
 
   PRInt32 colCount = 0;
@@ -423,23 +424,23 @@ nsARIAGridAccessible::GetSelectedCellCou
         (*aCount)++;
     }
   }
 
   return NS_OK;
 }
 
 NS_IMETHODIMP
-nsARIAGridAccessible::GetSelectedColumnCount(PRUint32* aCount)
+ARIAGridAccessible::GetSelectedColumnCount(PRUint32* aCount)
 {
   return GetSelectedColumnsArray(aCount);
 }
 
 NS_IMETHODIMP
-nsARIAGridAccessible::GetSelectedRowCount(PRUint32* aCount)
+ARIAGridAccessible::GetSelectedRowCount(PRUint32* aCount)
 {
   NS_ENSURE_ARG_POINTER(aCount);
   *aCount = 0;
 
   if (IsDefunct())
     return NS_ERROR_FAILURE;
 
   AccIterator rowIter(this, filters::GetRow);
@@ -467,17 +468,17 @@ nsARIAGridAccessible::GetSelectedRowCoun
     if (isRowSelected)
       (*aCount)++;
   }
 
   return NS_OK;
 }
 
 NS_IMETHODIMP
-nsARIAGridAccessible::GetSelectedCells(nsIArray **aCells)
+ARIAGridAccessible::GetSelectedCells(nsIArray** aCells)
 {
   NS_ENSURE_ARG_POINTER(aCells);
   *aCells = nsnull;
 
   if (IsDefunct())
     return NS_ERROR_FAILURE;
 
   nsresult rv = NS_OK;
@@ -505,18 +506,18 @@ nsARIAGridAccessible::GetSelectedCells(n
     }
   }
 
   NS_ADDREF(*aCells = selCells);
   return NS_OK;
 }
 
 NS_IMETHODIMP
-nsARIAGridAccessible::GetSelectedCellIndices(PRUint32 *aCellsCount,
-                                             PRInt32 **aCells)
+ARIAGridAccessible::GetSelectedCellIndices(PRUint32* aCellsCount,
+                                           PRInt32** aCells)
 {
   NS_ENSURE_ARG_POINTER(aCellsCount);
   *aCellsCount = 0;
   NS_ENSURE_ARG_POINTER(aCells);
   *aCells = nsnull;
 
   if (IsDefunct())
     return NS_ERROR_FAILURE;
@@ -557,30 +558,30 @@ nsARIAGridAccessible::GetSelectedCellInd
     nsMemory::Clone(selCells.Elements(), selCellsCount * sizeof(PRInt32)));
   NS_ENSURE_TRUE(*aCells, NS_ERROR_OUT_OF_MEMORY);
 
   *aCellsCount = selCellsCount;
   return NS_OK;
 }
 
 NS_IMETHODIMP
-nsARIAGridAccessible::GetSelectedColumnIndices(PRUint32 *acolumnCount,
-                                               PRInt32 **aColumns)
+ARIAGridAccessible::GetSelectedColumnIndices(PRUint32* aColumnCount,
+                                             PRInt32** aColumns)
 {
   NS_ENSURE_ARG_POINTER(aColumns);
 
-  return GetSelectedColumnsArray(acolumnCount, aColumns);
+  return GetSelectedColumnsArray(aColumnCount, aColumns);
 }
 
 NS_IMETHODIMP
-nsARIAGridAccessible::GetSelectedRowIndices(PRUint32 *arowCount,
-                                            PRInt32 **aRows)
+ARIAGridAccessible::GetSelectedRowIndices(PRUint32* aRowCount,
+                                          PRInt32** aRows)
 {
-  NS_ENSURE_ARG_POINTER(arowCount);
-  *arowCount = 0;
+  NS_ENSURE_ARG_POINTER(aRowCount);
+  *aRowCount = 0;
   NS_ENSURE_ARG_POINTER(aRows);
   *aRows = nsnull;
 
   if (IsDefunct())
     return NS_ERROR_FAILURE;
 
   PRInt32 rowCount = 0;
   GetRowCount(&rowCount);
@@ -618,22 +619,22 @@ nsARIAGridAccessible::GetSelectedRowIndi
   PRUint32 selrowCount = selRows.Length();
   if (!selrowCount)
     return NS_OK;
 
   *aRows = static_cast<PRInt32*>(
     nsMemory::Clone(selRows.Elements(), selrowCount * sizeof(PRInt32)));
   NS_ENSURE_TRUE(*aRows, NS_ERROR_OUT_OF_MEMORY);
 
-  *arowCount = selrowCount;
+  *aRowCount = selrowCount;
   return NS_OK;
 }
 
 NS_IMETHODIMP
-nsARIAGridAccessible::SelectRow(PRInt32 aRow)
+ARIAGridAccessible::SelectRow(PRInt32 aRow)
 {
   NS_ENSURE_ARG(IsValidRow(aRow));
 
   if (IsDefunct())
     return NS_ERROR_FAILURE;
 
   AccIterator rowIter(this, filters::GetRow);
 
@@ -642,17 +643,17 @@ nsARIAGridAccessible::SelectRow(PRInt32 
     nsresult rv = SetARIASelected(row, rowIdx == aRow);
     NS_ENSURE_SUCCESS(rv, rv);
   }
 
   return NS_OK;
 }
 
 NS_IMETHODIMP
-nsARIAGridAccessible::SelectColumn(PRInt32 aColumn)
+ARIAGridAccessible::SelectColumn(PRInt32 aColumn)
 {
   NS_ENSURE_ARG(IsValidColumn(aColumn));
 
   if (IsDefunct())
     return NS_ERROR_FAILURE;
 
   AccIterator rowIter(this, filters::GetRow);
 
@@ -669,29 +670,29 @@ nsARIAGridAccessible::SelectColumn(PRInt
       NS_ENSURE_SUCCESS(rv, rv);
     }
   }
 
   return NS_OK;
 }
 
 NS_IMETHODIMP
-nsARIAGridAccessible::UnselectRow(PRInt32 aRow)
+ARIAGridAccessible::UnselectRow(PRInt32 aRow)
 {
   if (IsDefunct())
     return NS_ERROR_FAILURE;
 
   nsAccessible *row = GetRowAt(aRow);
   NS_ENSURE_ARG(row);
 
   return SetARIASelected(row, false);
 }
 
 NS_IMETHODIMP
-nsARIAGridAccessible::UnselectColumn(PRInt32 aColumn)
+ARIAGridAccessible::UnselectColumn(PRInt32 aColumn)
 {
   NS_ENSURE_ARG(IsValidColumn(aColumn));
 
   if (IsDefunct())
     return NS_ERROR_FAILURE;
 
   AccIterator rowIter(this, filters::GetRow);
 
@@ -706,83 +707,83 @@ nsARIAGridAccessible::UnselectColumn(PRI
 
   return NS_OK;
 }
 
 ////////////////////////////////////////////////////////////////////////////////
 // Protected
 
 bool
-nsARIAGridAccessible::IsValidRow(PRInt32 aRow)
+ARIAGridAccessible::IsValidRow(PRInt32 aRow)
 {
   if (aRow < 0)
     return false;
   
   PRInt32 rowCount = 0;
   GetRowCount(&rowCount);
   return aRow < rowCount;
 }
 
 bool
-nsARIAGridAccessible::IsValidColumn(PRInt32 aColumn)
+ARIAGridAccessible::IsValidColumn(PRInt32 aColumn)
 {
   if (aColumn < 0)
     return false;
 
   PRInt32 colCount = 0;
   GetColumnCount(&colCount);
   return aColumn < colCount;
 }
 
 bool
-nsARIAGridAccessible::IsValidRowNColumn(PRInt32 aRow, PRInt32 aColumn)
+ARIAGridAccessible::IsValidRowNColumn(PRInt32 aRow, PRInt32 aColumn)
 {
   if (aRow < 0 || aColumn < 0)
     return false;
   
   PRInt32 rowCount = 0;
   GetRowCount(&rowCount);
   if (aRow >= rowCount)
     return false;
 
   PRInt32 colCount = 0;
   GetColumnCount(&colCount);
   return aColumn < colCount;
 }
 
 nsAccessible*
-nsARIAGridAccessible::GetRowAt(PRInt32 aRow)
+ARIAGridAccessible::GetRowAt(PRInt32 aRow)
 {
   PRInt32 rowIdx = aRow;
 
   AccIterator rowIter(this, filters::GetRow);
 
   nsAccessible *row = rowIter.Next();
   while (rowIdx != 0 && (row = rowIter.Next()))
     rowIdx--;
 
   return row;
 }
 
 nsAccessible*
-nsARIAGridAccessible::GetCellInRowAt(nsAccessible *aRow, PRInt32 aColumn)
+ARIAGridAccessible::GetCellInRowAt(nsAccessible* aRow, PRInt32 aColumn)
 {
   PRInt32 colIdx = aColumn;
 
   AccIterator cellIter(aRow, filters::GetCell);
   nsAccessible *cell = cellIter.Next();
   while (colIdx != 0 && (cell = cellIter.Next()))
     colIdx--;
 
   return cell;
 }
 
 nsresult
-nsARIAGridAccessible::SetARIASelected(nsAccessible *aAccessible,
-                                      bool aIsSelected, bool aNotify)
+ARIAGridAccessible::SetARIASelected(nsAccessible* aAccessible,
+                                    bool aIsSelected, bool aNotify)
 {
   nsIContent *content = aAccessible->GetContent();
   NS_ENSURE_STATE(content);
 
   nsresult rv = NS_OK;
   if (aIsSelected)
     rv = content->SetAttr(kNameSpaceID_None, nsGkAtoms::aria_selected,
                           NS_LITERAL_STRING("true"), aNotify);
@@ -839,21 +840,21 @@ nsARIAGridAccessible::SetARIASelected(ns
       }
     }
   }
 
   return NS_OK;
 }
 
 nsresult
-nsARIAGridAccessible::GetSelectedColumnsArray(PRUint32 *acolumnCount,
-                                              PRInt32 **aColumns)
+ARIAGridAccessible::GetSelectedColumnsArray(PRUint32* aColumnCount,
+                                            PRInt32** aColumns)
 {
-  NS_ENSURE_ARG_POINTER(acolumnCount);
-  *acolumnCount = 0;
+  NS_ENSURE_ARG_POINTER(aColumnCount);
+  *aColumnCount = 0;
   if (aColumns)
     *aColumns = nsnull;
 
   if (IsDefunct())
     return NS_ERROR_FAILURE;
 
   AccIterator rowIter(this, filters::GetRow);
   nsAccessible *row = rowIter.Next();
@@ -888,60 +889,60 @@ nsARIAGridAccessible::GetSelectedColumns
       }
     }
   } while ((row = rowIter.Next()));
 
   if (!selColCount)
     return NS_OK;
 
   if (!aColumns) {
-    *acolumnCount = selColCount;
+    *aColumnCount = selColCount;
     return NS_OK;
   }
 
   *aColumns = static_cast<PRInt32*>(
     nsMemory::Alloc(selColCount * sizeof(PRInt32)));
   NS_ENSURE_TRUE(*aColumns, NS_ERROR_OUT_OF_MEMORY);
 
-  *acolumnCount = selColCount;
+  *aColumnCount = selColCount;
   for (PRInt32 colIdx = 0, idx = 0; colIdx < colCount; colIdx++) {
     if (isColSelArray[colIdx])
       (*aColumns)[idx++] = colIdx;
   }
 
   return NS_OK;
 }
 
 
 ////////////////////////////////////////////////////////////////////////////////
-// nsARIAGridCellAccessible
+// ARIAGridCellAccessible
 ////////////////////////////////////////////////////////////////////////////////
 
 
 ////////////////////////////////////////////////////////////////////////////////
 // Constructor
 
-nsARIAGridCellAccessible::
-  nsARIAGridCellAccessible(nsIContent* aContent, nsDocAccessible* aDoc) :
+ARIAGridCellAccessible::
+  ARIAGridCellAccessible(nsIContent* aContent, nsDocAccessible* aDoc) :
   nsHyperTextAccessibleWrap(aContent, aDoc)
 {
 }
 
 ////////////////////////////////////////////////////////////////////////////////
 // nsISupports
 
-NS_IMPL_ISUPPORTS_INHERITED1(nsARIAGridCellAccessible,
+NS_IMPL_ISUPPORTS_INHERITED1(ARIAGridCellAccessible,
                              nsHyperTextAccessible,
                              nsIAccessibleTableCell)
 
 ////////////////////////////////////////////////////////////////////////////////
 // nsIAccessibleTableCell
 
 NS_IMETHODIMP
-nsARIAGridCellAccessible::GetTable(nsIAccessibleTable **aTable)
+ARIAGridCellAccessible::GetTable(nsIAccessibleTable** aTable)
 {
   NS_ENSURE_ARG_POINTER(aTable);
   *aTable = nsnull;
 
   nsAccessible* thisRow = Parent();
   if (!thisRow || thisRow->Role() != roles::ROW)
     return NS_OK;
 
@@ -953,17 +954,17 @@ nsARIAGridCellAccessible::GetTable(nsIAc
   if (tableRole != roles::TABLE && tableRole != roles::TREE_TABLE)
     return NS_OK;
 
   CallQueryInterface(table, aTable);
   return NS_OK;
 }
 
 NS_IMETHODIMP
-nsARIAGridCellAccessible::GetColumnIndex(PRInt32 *aColumnIndex)
+ARIAGridCellAccessible::GetColumnIndex(PRInt32* aColumnIndex)
 {
   NS_ENSURE_ARG_POINTER(aColumnIndex);
   *aColumnIndex = -1;
 
   if (IsDefunct())
     return NS_ERROR_FAILURE;
 
   nsAccessible* row = Parent();
@@ -980,17 +981,17 @@ nsARIAGridCellAccessible::GetColumnIndex
         role == roles::COLUMNHEADER)
       (*aColumnIndex)++;
   }
 
   return NS_OK;
 }
 
 NS_IMETHODIMP
-nsARIAGridCellAccessible::GetRowIndex(PRInt32 *aRowIndex)
+ARIAGridCellAccessible::GetRowIndex(PRInt32* aRowIndex)
 {
   NS_ENSURE_ARG_POINTER(aRowIndex);
   *aRowIndex = -1;
 
   if (IsDefunct())
     return NS_ERROR_FAILURE;
 
   nsAccessible* row = Parent();
@@ -1009,43 +1010,43 @@ nsARIAGridCellAccessible::GetRowIndex(PR
     if (row->Role() == roles::ROW)
       (*aRowIndex)++;
   }
 
   return NS_OK;
 }
 
 NS_IMETHODIMP
-nsARIAGridCellAccessible::GetColumnExtent(PRInt32 *aExtentCount)
+ARIAGridCellAccessible::GetColumnExtent(PRInt32* aExtentCount)
 {
   NS_ENSURE_ARG_POINTER(aExtentCount);
   *aExtentCount = 0;
 
   if (IsDefunct())
     return NS_ERROR_FAILURE;
 
   *aExtentCount = 1;
   return NS_OK;
 }
 
 NS_IMETHODIMP
-nsARIAGridCellAccessible::GetRowExtent(PRInt32 *aExtentCount)
+ARIAGridCellAccessible::GetRowExtent(PRInt32* aExtentCount)
 {
   NS_ENSURE_ARG_POINTER(aExtentCount);
   *aExtentCount = 0;
 
   if (IsDefunct())
     return NS_ERROR_FAILURE;
 
   *aExtentCount = 1;
   return NS_OK;
 }
 
 NS_IMETHODIMP
-nsARIAGridCellAccessible::GetColumnHeaderCells(nsIArray **aHeaderCells)
+ARIAGridCellAccessible::GetColumnHeaderCells(nsIArray** aHeaderCells)
 {
   NS_ENSURE_ARG_POINTER(aHeaderCells);
   *aHeaderCells = nsnull;
 
   if (IsDefunct())
     return NS_ERROR_FAILURE;
 
   nsCOMPtr<nsIAccessibleTable> table;
@@ -1054,17 +1055,17 @@ nsARIAGridCellAccessible::GetColumnHeade
     return NS_OK;
 
   return nsAccUtils::GetHeaderCellsFor(table, this,
                                        nsAccUtils::eColumnHeaderCells,
                                        aHeaderCells);
 }
 
 NS_IMETHODIMP
-nsARIAGridCellAccessible::GetRowHeaderCells(nsIArray **aHeaderCells)
+ARIAGridCellAccessible::GetRowHeaderCells(nsIArray** aHeaderCells)
 {
   NS_ENSURE_ARG_POINTER(aHeaderCells);
   *aHeaderCells = nsnull;
 
   if (IsDefunct())
     return NS_ERROR_FAILURE;
 
   nsCOMPtr<nsIAccessibleTable> table;
@@ -1073,17 +1074,17 @@ nsARIAGridCellAccessible::GetRowHeaderCe
     return NS_OK;
 
   return nsAccUtils::GetHeaderCellsFor(table, this,
                                        nsAccUtils::eRowHeaderCells,
                                        aHeaderCells);
 }
 
 NS_IMETHODIMP
-nsARIAGridCellAccessible::IsSelected(bool *aIsSelected)
+ARIAGridCellAccessible::IsSelected(bool* aIsSelected)
 {
   NS_ENSURE_ARG_POINTER(aIsSelected);
   *aIsSelected = false;
 
   if (IsDefunct())
     return NS_ERROR_FAILURE;
 
   nsAccessible* row = Parent();
@@ -1096,17 +1097,17 @@ nsARIAGridCellAccessible::IsSelected(boo
   *aIsSelected = true;
   return NS_OK;
 }
 
 ////////////////////////////////////////////////////////////////////////////////
 // nsAccessible
 
 void
-nsARIAGridCellAccessible::ApplyARIAState(PRUint64* aState)
+ARIAGridCellAccessible::ApplyARIAState(PRUint64* aState)
 {
   nsHyperTextAccessibleWrap::ApplyARIAState(aState);
 
   // Return if the gridcell has aria-selected="true".
   if (*aState & states::SELECTED)
     return;
 
   // Check aria-selected="true" on the row.
@@ -1119,17 +1120,17 @@ nsARIAGridCellAccessible::ApplyARIAState
                                       nsGkAtoms::aria_selected) &&
       !rowContent->AttrValueIs(kNameSpaceID_None,
                                nsGkAtoms::aria_selected,
                                nsGkAtoms::_false, eCaseMatters))
     *aState |= states::SELECTABLE | states::SELECTED;
 }
 
 nsresult
-nsARIAGridCellAccessible::GetAttributesInternal(nsIPersistentProperties *aAttributes)
+ARIAGridCellAccessible::GetAttributesInternal(nsIPersistentProperties* aAttributes)
 {
   if (IsDefunct())
     return NS_ERROR_FAILURE;
   
   nsresult rv = nsHyperTextAccessibleWrap::GetAttributesInternal(aAttributes);
   NS_ENSURE_SUCCESS(rv, rv);
 
   // Expose "table-cell-index" attribute.
rename from accessible/src/base/nsARIAGridAccessible.h
rename to accessible/src/generic/ARIAGridAccessible.h
--- a/accessible/src/base/nsARIAGridAccessible.h
+++ b/accessible/src/generic/ARIAGridAccessible.h
@@ -31,35 +31,38 @@
  * use your version of this file under the terms of the MPL, indicate your
  * decision by deleting the provisions above and replace them with the notice
  * and other provisions required by the GPL or the LGPL. If you do not delete
  * the provisions above, a recipient may use your version of this file under
  * the terms of any one of the MPL, the GPL or the LGPL.
  *
  * ***** END LICENSE BLOCK ***** */
 
-#ifndef nsARIAGridAccessible_h_
-#define nsARIAGridAccessible_h_
+#ifndef MOZILLA_A11Y_ARIAGridAccessible_h_
+#define MOZILLA_A11Y_ARIAGridAccessible_h_
 
 #include "nsIAccessibleTable.h"
 
 #include "nsHyperTextAccessibleWrap.h"
 #include "TableAccessible.h"
 #include "xpcAccessibleTable.h"
 
+namespace mozilla {
+namespace a11y {
+
 /**
  * Accessible for ARIA grid and treegrid.
  */
-class nsARIAGridAccessible : public nsAccessibleWrap,
-                             public xpcAccessibleTable,
-                             public nsIAccessibleTable,
-                             public mozilla::a11y::TableAccessible
+class ARIAGridAccessible : public nsAccessibleWrap,
+                           public xpcAccessibleTable,
+                           public nsIAccessibleTable,
+                           public TableAccessible
 {
 public:
-  nsARIAGridAccessible(nsIContent* aContent, nsDocAccessible* aDoc);
+  ARIAGridAccessible(nsIContent* aContent, nsDocAccessible* aDoc);
 
   // nsISupports
   NS_DECL_ISUPPORTS_INHERITED
 
   // nsIAccessibleTable
   NS_DECL_OR_FORWARD_NSIACCESSIBLETABLE_WITH_XPCACCESSIBLETABLE
 
   // nsAccessible
@@ -111,26 +114,29 @@ protected:
   nsresult GetSelectedColumnsArray(PRUint32 *acolumnCount,
                                    PRInt32 **aColumns = nsnull);
 };
 
 
 /**
  * Accessible for ARIA gridcell and rowheader/columnheader.
  */
-class nsARIAGridCellAccessible : public nsHyperTextAccessibleWrap,
-                                 public nsIAccessibleTableCell
+class ARIAGridCellAccessible : public nsHyperTextAccessibleWrap,
+                               public nsIAccessibleTableCell
 {
 public:
-  nsARIAGridCellAccessible(nsIContent* aContent, nsDocAccessible* aDoc);
+  ARIAGridCellAccessible(nsIContent* aContent, nsDocAccessible* aDoc);
 
   // nsISupports
   NS_DECL_ISUPPORTS_INHERITED
 
   // nsIAccessibleTableCell
   NS_DECL_NSIACCESSIBLETABLECELL
 
   // nsAccessible
   virtual void ApplyARIAState(PRUint64* aState);
   virtual nsresult GetAttributesInternal(nsIPersistentProperties *aAttributes);
 };
 
+} // namespace a11y
+} // namespace mozilla
+
 #endif
--- a/accessible/src/generic/Makefile.in
+++ b/accessible/src/generic/Makefile.in
@@ -10,16 +10,17 @@ VPATH = @srcdir@
 include $(DEPTH)/config/autoconf.mk
 
 MODULE = accessibility
 LIBRARY_NAME = accessibility_generic_s
 LIBXUL_LIBRARY = 1
 
 
 CPPSRCS = \
+  ARIAGridAccessible.cpp \
   OuterDocAccessible.cpp \
   $(NULL)
 
 # we don't want the shared lib, but we want to force the creation of a static lib.
 FORCE_STATIC_LIB = 1
 
 include $(topsrcdir)/config/rules.mk
 
--- a/accessible/src/html/nsHTMLFormControlAccessible.cpp
+++ b/accessible/src/html/nsHTMLFormControlAccessible.cpp
@@ -401,35 +401,33 @@ nsHTMLTextFieldAccessible::GetNameIntern
     return NS_OK;
 
   // text inputs and textareas might have useful placeholder text
   mContent->GetAttr(kNameSpaceID_None, nsGkAtoms::placeholder, aName);
 
   return NS_OK;
 }
 
-NS_IMETHODIMP nsHTMLTextFieldAccessible::GetValue(nsAString& _retval)
+void
+nsHTMLTextFieldAccessible::Value(nsString& aValue)
 {
-  if (IsDefunct())
-    return NS_ERROR_FAILURE;
-
+  aValue.Truncate();
   if (NativeState() & states::PROTECTED)    // Don't return password text!
-    return NS_ERROR_FAILURE;
+    return;
 
   nsCOMPtr<nsIDOMHTMLTextAreaElement> textArea(do_QueryInterface(mContent));
   if (textArea) {
-    return textArea->GetValue(_retval);
+    textArea->GetValue(aValue);
+    return;
   }
   
   nsCOMPtr<nsIDOMHTMLInputElement> inputElement(do_QueryInterface(mContent));
   if (inputElement) {
-    return inputElement->GetValue(_retval);
+    inputElement->GetValue(aValue);
   }
-
-  return NS_ERROR_FAILURE;
 }
 
 void
 nsHTMLTextFieldAccessible::ApplyARIAState(PRUint64* aState)
 {
   nsHyperTextAccessibleWrap::ApplyARIAState(aState);
 
   aria::MapToState(aria::eARIAAutoComplete, mContent->AsElement(), aState);
--- a/accessible/src/html/nsHTMLFormControlAccessible.h
+++ b/accessible/src/html/nsHTMLFormControlAccessible.h
@@ -129,24 +129,24 @@ class nsHTMLTextFieldAccessible : public
 public:
   enum { eAction_Click = 0 };
 
   nsHTMLTextFieldAccessible(nsIContent* aContent, nsDocAccessible* aDoc);
 
   NS_DECL_ISUPPORTS_INHERITED
 
   // nsIAccessible
-  NS_IMETHOD GetValue(nsAString& _retval); 
   NS_IMETHOD GetActionName(PRUint8 aIndex, nsAString& aName);
   NS_IMETHOD DoAction(PRUint8 index);
 
   // nsHyperTextAccessible
   virtual already_AddRefed<nsIEditor> GetEditor() const;
 
   // nsAccessible
+  virtual void Value(nsString& aValue);
   virtual void ApplyARIAState(PRUint64* aState);
   virtual nsresult GetNameInternal(nsAString& aName);
   virtual mozilla::a11y::role NativeRole();
   virtual PRUint64 State();
   virtual PRUint64 NativeState();
 
   // ActionAccessible
   virtual PRUint8 ActionCount();
--- a/accessible/src/html/nsHTMLLinkAccessible.cpp
+++ b/accessible/src/html/nsHTMLLinkAccessible.cpp
@@ -101,30 +101,28 @@ nsHTMLLinkAccessible::NativeState()
   // it doesn't have any attributes. Check if 'click' event handler is
   // registered, otherwise bail out.
   if (nsCoreUtils::HasClickListener(mContent))
     states |= states::LINKED;
 
   return states;
 }
 
-NS_IMETHODIMP
-nsHTMLLinkAccessible::GetValue(nsAString& aValue)
+void
+nsHTMLLinkAccessible::Value(nsString& aValue)
 {
   aValue.Truncate();
 
-  nsresult rv = nsHyperTextAccessible::GetValue(aValue);
-  NS_ENSURE_SUCCESS(rv, rv);
-
+  nsHyperTextAccessible::Value(aValue);
   if (!aValue.IsEmpty())
-    return NS_OK;
+    return;
   
   nsIPresShell* presShell(mDoc->PresShell());
   nsCOMPtr<nsIDOMNode> DOMNode(do_QueryInterface(mContent));
-  return presShell->GetLinkLocation(DOMNode, aValue);
+  presShell->GetLinkLocation(DOMNode, aValue);
 }
 
 PRUint8
 nsHTMLLinkAccessible::ActionCount()
 {
   return IsLinked() ? 1 : nsHyperTextAccessible::ActionCount();
 }
 
--- a/accessible/src/html/nsHTMLLinkAccessible.h
+++ b/accessible/src/html/nsHTMLLinkAccessible.h
@@ -45,22 +45,21 @@
 class nsHTMLLinkAccessible : public nsHyperTextAccessibleWrap
 {
 public:
   nsHTMLLinkAccessible(nsIContent* aContent, nsDocAccessible* aDoc);
  
   NS_DECL_ISUPPORTS_INHERITED
 
   // nsIAccessible
-  NS_IMETHOD GetValue(nsAString& aValue);
-
   NS_IMETHOD GetActionName(PRUint8 aIndex, nsAString& aName);
   NS_IMETHOD DoAction(PRUint8 aIndex);
 
   // nsAccessible
+  virtual void Value(nsString& aValue);
   virtual mozilla::a11y::role NativeRole();
   virtual PRUint64 NativeState();
 
   // ActionAccessible
   virtual PRUint8 ActionCount();
 
   // HyperLinkAccessible
   virtual bool IsLink();
--- a/accessible/src/html/nsHTMLSelectAccessible.cpp
+++ b/accessible/src/html/nsHTMLSelectAccessible.cpp
@@ -582,21 +582,23 @@ nsHTMLComboboxAccessible::Description(ns
     return;
 
   // Otherwise use description of selected option.
   nsAccessible* option = SelectedOption();
   if (option)
     option->Description(aDescription);
 }
 
-NS_IMETHODIMP nsHTMLComboboxAccessible::GetValue(nsAString& aValue)
+void
+nsHTMLComboboxAccessible::Value(nsString& aValue)
 {
   // Use accessible name of selected option.
   nsAccessible* option = SelectedOption();
-  return option ? option->GetName(aValue) : NS_OK;
+  if (option)
+    option->GetName(aValue);
 }
 
 PRUint8
 nsHTMLComboboxAccessible::ActionCount()
 {
   return 1;
 }
 
--- a/accessible/src/html/nsHTMLSelectAccessible.h
+++ b/accessible/src/html/nsHTMLSelectAccessible.h
@@ -182,25 +182,25 @@ class nsHTMLComboboxAccessible : public 
 {
 public:
   enum { eAction_Click = 0 };
 
   nsHTMLComboboxAccessible(nsIContent* aContent, nsDocAccessible* aDoc);
   virtual ~nsHTMLComboboxAccessible() {}
 
   // nsIAccessible
-  NS_IMETHOD GetValue(nsAString& _retval);
   NS_IMETHOD DoAction(PRUint8 index);
   NS_IMETHOD GetActionName(PRUint8 aIndex, nsAString& aName);
 
   // nsAccessNode
   virtual void Shutdown();
 
   // nsAccessible
   virtual void Description(nsString& aDescription);
+  virtual void Value(nsString& aValue);
   virtual mozilla::a11y::role NativeRole();
   virtual PRUint64 NativeState();
   virtual void InvalidateChildren();
 
   // ActionAccessible
   virtual PRUint8 ActionCount();
 
   // Widgets
rename from accessible/src/mac/nsARIAGridAccessibleWrap.h
rename to accessible/src/mac/ARIAGridAccessibleWrap.h
--- a/accessible/src/mac/nsARIAGridAccessibleWrap.h
+++ b/accessible/src/mac/ARIAGridAccessibleWrap.h
@@ -33,18 +33,23 @@
  * use your version of this file under the terms of the MPL, indicate your
  * decision by deleting the provisions above and replace them with the notice
  * and other provisions required by the GPL or the LGPL. If you do not delete
  * the provisions above, a recipient may use your version of this file under
  * the terms of any one of the MPL, the GPL or the LGPL.
  *
  * ***** END LICENSE BLOCK ***** */
 
-#ifndef _NSARIAGRIDACCESSIBLEWRAP_H
-#define _NSARIAGRIDACCESSIBLEWRAP_H
+#ifndef MOZILLA_A11Y_ARIAGRIDACCESSIBLEWRAP_H
+#define MOZILLA_A11Y_ARIAGRIDACCESSIBLEWRAP_H
+
+#include "ARIAGridAccessible.h"
 
-#include "nsARIAGridAccessible.h"
+namespace mozilla {
+namespace a11y {
 
-typedef class nsARIAGridAccessible nsARIAGridAccessibleWrap;
-typedef class nsARIAGridCellAccessible nsARIAGridCellAccessibleWrap;
+typedef class ARIAGridAccessible ARIAGridAccessibleWrap;
+typedef class ARIAGridCellAccessible ARIAGridCellAccessibleWrap;
+
+} // namespace a11y
+} // namespace mozilla
 
 #endif
-
--- a/accessible/src/mac/Makefile.in
+++ b/accessible/src/mac/Makefile.in
@@ -57,20 +57,20 @@ CMMSRCS = nsAccessNodeWrap.mm \
           mozActionElements.mm \
           mozTextAccessible.mm \
           mozHTMLAccessible.mm \
           MacUtils.mm \
           $(NULL)
 
 
 EXPORTS = \
+  ARIAGridAccessibleWrap.h \
   nsAccessNodeWrap.h \
   nsTextAccessibleWrap.h \
   nsAccessibleWrap.h \
-  nsARIAGridAccessibleWrap.h \
   nsDocAccessibleWrap.h \
   nsRootAccessibleWrap.h \
   nsXULMenuAccessibleWrap.h \
   nsXULListboxAccessibleWrap.h \
   nsXULTreeGridAccessibleWrap.h \
   nsHyperTextAccessibleWrap.h \
   nsHTMLImageAccessibleWrap.h \
   nsHTMLTableAccessibleWrap.h \
--- a/accessible/src/mac/mozHTMLAccessible.mm
+++ b/accessible/src/mac/mozHTMLAccessible.mm
@@ -111,22 +111,21 @@
   if ([action isEqualToString:NSAccessibilityPressAction])
     mGeckoAccessible->DoAction(0);
   else
     [super accessibilityPerformAction:action];
 }
 
 - (NSURL*)url
 {
-  if (!mGeckoAccessible)
+  if (!mGeckoAccessible || mGeckoAccessible->IsDefunct())
     return nil;
 
   nsAutoString value;
-  nsresult rv = mGeckoAccessible->GetValue(value);
-  NS_ENSURE_SUCCESS(rv, nil);
+  mGeckoAccessible->Value(value);
 
   NSString* urlString = value.IsEmpty() ? nil : nsCocoaUtils::ToNSString(value);
   if (!urlString)
     return nil;
 
   return [NSURL URLWithString:urlString];
 }
 
rename from accessible/src/msaa/nsARIAGridAccessibleWrap.cpp
rename to accessible/src/msaa/ARIAGridAccessibleWrap.cpp
--- a/accessible/src/msaa/nsARIAGridAccessibleWrap.cpp
+++ b/accessible/src/msaa/ARIAGridAccessibleWrap.cpp
@@ -33,32 +33,36 @@
  * use your version of this file under the terms of the MPL, indicate your
  * decision by deleting the provisions above and replace them with the notice
  * and other provisions required by the GPL or the LGPL. If you do not delete
  * the provisions above, a recipient may use your version of this file under
  * the terms of any one of the MPL, the GPL or the LGPL.
  *
  * ***** END LICENSE BLOCK ***** */
 
-#include "nsARIAGridAccessibleWrap.h"
+#include "ARIAGridAccessibleWrap.h"
+
+using namespace mozilla;
+using namespace mozilla::a11y;
 
 ////////////////////////////////////////////////////////////////////////////////
-// nsARIAGridAccessibleWrap
+// ARIAGridAccessibleWrap
 ////////////////////////////////////////////////////////////////////////////////
 
-NS_IMPL_ISUPPORTS_INHERITED0(nsARIAGridAccessibleWrap,
-                             nsARIAGridAccessible)
+NS_IMPL_ISUPPORTS_INHERITED0(ARIAGridAccessibleWrap,
+                             ARIAGridAccessible)
 
-IMPL_IUNKNOWN_INHERITED1(nsARIAGridAccessibleWrap,
+IMPL_IUNKNOWN_INHERITED1(ARIAGridAccessibleWrap,
                          nsAccessibleWrap,
                          CAccessibleTable)
 
 
 ////////////////////////////////////////////////////////////////////////////////
-// nsARIAGridCellAccessibleWrap
+// ARIAGridCellAccessibleWrap
 ////////////////////////////////////////////////////////////////////////////////
 
-NS_IMPL_ISUPPORTS_INHERITED0(nsARIAGridCellAccessibleWrap,
-                             nsARIAGridCellAccessible)
+NS_IMPL_ISUPPORTS_INHERITED0(ARIAGridCellAccessibleWrap,
+                             ARIAGridCellAccessible)
 
-IMPL_IUNKNOWN_INHERITED1(nsARIAGridCellAccessibleWrap,
+IMPL_IUNKNOWN_INHERITED1(ARIAGridCellAccessibleWrap,
                          nsHyperTextAccessibleWrap,
                          CAccessibleTableCell)
+
rename from accessible/src/msaa/nsARIAGridAccessibleWrap.h
rename to accessible/src/msaa/ARIAGridAccessibleWrap.h
--- a/accessible/src/msaa/nsARIAGridAccessibleWrap.h
+++ b/accessible/src/msaa/ARIAGridAccessibleWrap.h
@@ -33,52 +33,58 @@
  * use your version of this file under the terms of the MPL, indicate your
  * decision by deleting the provisions above and replace them with the notice
  * and other provisions required by the GPL or the LGPL. If you do not delete
  * the provisions above, a recipient may use your version of this file under
  * the terms of any one of the MPL, the GPL or the LGPL.
  *
  * ***** END LICENSE BLOCK ***** */
 
-#ifndef _NSARIAGRIDACCESSIBLEWRAP_H
-#define _NSARIAGRIDACCESSIBLEWRAP_H
+#ifndef MOZILLA_A11Y_ARIAGRIDACCESSIBLEWRAP_H
+#define MOZILLA_A11Y_ARIAGRIDACCESSIBLEWRAP_H
 
-#include "nsARIAGridAccessible.h"
+#include "ARIAGridAccessible.h"
 #include "CAccessibleTable.h"
 #include "CAccessibleTableCell.h"
 
+namespace mozilla {
+namespace a11y {
+
 /**
- * IA2 wrapper class for nsARIAGridAccessible implementing IAccessibleTable and
+ * IA2 wrapper class for ARIAGridAccessible implementing IAccessibleTable and
  * IAccessibleTable2 interfaces.
  */
-class nsARIAGridAccessibleWrap : public nsARIAGridAccessible,
-                                 public CAccessibleTable
+class ARIAGridAccessibleWrap : public ARIAGridAccessible,
+                               public CAccessibleTable
 {
 public:
-  nsARIAGridAccessibleWrap(nsIContent* aContent, nsDocAccessible* aDoc) :
-    nsARIAGridAccessible(aContent, aDoc) {}
+  ARIAGridAccessibleWrap(nsIContent* aContent, nsDocAccessible* aDoc) :
+    ARIAGridAccessible(aContent, aDoc) {}
 
   // IUnknown
   DECL_IUNKNOWN_INHERITED
 
   // nsISupports
   NS_DECL_ISUPPORTS_INHERITED
 };
 
 /**
- * IA2 wrapper class for nsARIAGridCellAccessible implementing
+ * IA2 wrapper class for ARIAGridCellAccessible implementing
  * IAccessibleTableCell interface.
  */
-class nsARIAGridCellAccessibleWrap : public nsARIAGridCellAccessible,
-                                     public CAccessibleTableCell
+class ARIAGridCellAccessibleWrap : public ARIAGridCellAccessible,
+                                   public CAccessibleTableCell
 {
 public:
-  nsARIAGridCellAccessibleWrap(nsIContent* aContent, nsDocAccessible* aDoc) :
-    nsARIAGridCellAccessible(aContent, aDoc) {}
+  ARIAGridCellAccessibleWrap(nsIContent* aContent, nsDocAccessible* aDoc) :
+    ARIAGridCellAccessible(aContent, aDoc) {}
 
   // IUnknown
   DECL_IUNKNOWN_INHERITED
 
   // nsISupports
   NS_DECL_ISUPPORTS_INHERITED
 };
 
+} // namespace a11y
+} // namespace mozilla
+
 #endif
--- a/accessible/src/msaa/CAccessibleComponent.cpp
+++ b/accessible/src/msaa/CAccessibleComponent.cpp
@@ -75,18 +75,18 @@ CAccessibleComponent::QueryInterface(REF
 STDMETHODIMP
 CAccessibleComponent::get_locationInParent(long *aX, long *aY)
 {
 __try {
   *aX = 0;
   *aY = 0;
 
   nsRefPtr<nsAccessible> acc(do_QueryObject(this));
-  if (!acc)
-    return E_FAIL;
+  if (acc->IsDefunct())
+    return CO_E_OBJNOTCONNECTED;
 
   // If the object is not on any screen the returned position is (0,0).
   PRUint64 state = acc->State();
   if (state & states::INVISIBLE)
     return S_OK;
 
   PRInt32 x = 0, y = 0, width = 0, height = 0;
   nsresult rv = acc->GetBounds(&x, &y, &width, &height);
@@ -123,17 +123,17 @@ CAccessibleComponent::get_locationInPare
 }
 
 STDMETHODIMP
 CAccessibleComponent::get_foreground(IA2Color* aForeground)
 {
 __try {
   nsRefPtr<nsAccessible> acc(do_QueryObject(this));
   if (acc->IsDefunct())
-    return E_FAIL;
+    return CO_E_OBJNOTCONNECTED;
 
   nsIFrame* frame = acc->GetFrame();
   if (frame)
     *aForeground = frame->GetStyleColor()->mColor;
 
   return S_OK;
 
 } __except(nsAccessNodeWrap::FilterA11yExceptions(::GetExceptionCode(), GetExceptionInformation())) { }
@@ -142,17 +142,17 @@ CAccessibleComponent::get_foreground(IA2
 }
 
 STDMETHODIMP
 CAccessibleComponent::get_background(IA2Color* aBackground)
 {
 __try {
   nsRefPtr<nsAccessible> acc(do_QueryObject(this));
   if (acc->IsDefunct())
-    return E_FAIL;
+    return CO_E_OBJNOTCONNECTED;
 
   nsIFrame* frame = acc->GetFrame();
   if (frame)
     *aBackground = frame->GetStyleBackground()->mBackgroundColor;
 
   return S_OK;
 
 } __except(nsAccessNodeWrap::FilterA11yExceptions(::GetExceptionCode(), GetExceptionInformation())) { }
--- a/accessible/src/msaa/CAccessibleEditableText.cpp
+++ b/accessible/src/msaa/CAccessibleEditableText.cpp
@@ -35,30 +35,22 @@
  * and other provisions required by the GPL or the LGPL. If you do not delete
  * the provisions above, a recipient may use your version of this file under
  * the terms of any one of the MPL, the GPL or the LGPL.
  *
  * ***** END LICENSE BLOCK ***** */
 
 #include "CAccessibleEditableText.h"
 
-#include "nsIAccessibleEditableText.h"
 #include "AccessibleEditableText_i.c"
-#include "nsAccessNodeWrap.h"
+#include "nsHyperTextAccessible.h"
 
 #include "nsCOMPtr.h"
 #include "nsString.h"
 
-#define GET_NSIACCESSIBLEEDITABLETEXT \
-nsCOMPtr<nsIAccessibleEditableText> textAcc(do_QueryObject(this));\
-NS_ASSERTION(textAcc,\
-             "Subclass of CAccessibleEditableText doesn't implement nsIAccessibleEditableText");\
-if (!textAcc)\
-  return E_FAIL;\
-
 // IUnknown
 
 STDMETHODIMP
 CAccessibleEditableText::QueryInterface(REFIID iid, void** ppv)
 {
   *ppv = NULL;
 
   if (IID_IAccessibleEditableText == iid) {
@@ -74,86 +66,98 @@ CAccessibleEditableText::QueryInterface(
 }
 
 // IAccessibleEditableText
 
 STDMETHODIMP
 CAccessibleEditableText::copyText(long aStartOffset, long aEndOffset)
 {
 __try {
-  GET_NSIACCESSIBLEEDITABLETEXT
+  nsRefPtr<nsHyperTextAccessible> textAcc(do_QueryObject(this));
+  if (textAcc->IsDefunct())
+    return CO_E_OBJNOTCONNECTED;
 
   nsresult rv = textAcc->CopyText(aStartOffset, aEndOffset);
   return GetHRESULT(rv);
 
 } __except(nsAccessNodeWrap::FilterA11yExceptions(::GetExceptionCode(), GetExceptionInformation())) { }
   return E_FAIL;
 }
 
 STDMETHODIMP
 CAccessibleEditableText::deleteText(long aStartOffset, long aEndOffset)
 {
 __try {
-  GET_NSIACCESSIBLEEDITABLETEXT
+  nsRefPtr<nsHyperTextAccessible> textAcc(do_QueryObject(this));
+  if (textAcc->IsDefunct())
+    return CO_E_OBJNOTCONNECTED;
 
   nsresult rv = textAcc->DeleteText(aStartOffset, aEndOffset);
   return GetHRESULT(rv);
 
 } __except(nsAccessNodeWrap::FilterA11yExceptions(::GetExceptionCode(), GetExceptionInformation())) { }
   return E_FAIL;
 }
 
 STDMETHODIMP
 CAccessibleEditableText::insertText(long aOffset, BSTR *aText)
 {
 __try {
-  GET_NSIACCESSIBLEEDITABLETEXT
+  nsRefPtr<nsHyperTextAccessible> textAcc(do_QueryObject(this));
+  if (textAcc->IsDefunct())
+    return CO_E_OBJNOTCONNECTED;
 
   PRUint32 length = ::SysStringLen(*aText);
   nsAutoString text(*aText, length);
 
   nsresult rv = textAcc->InsertText(text, aOffset);
   return GetHRESULT(rv);
 
 } __except(nsAccessNodeWrap::FilterA11yExceptions(::GetExceptionCode(), GetExceptionInformation())) { }
   return E_FAIL;
 }
 
 STDMETHODIMP
 CAccessibleEditableText::cutText(long aStartOffset, long aEndOffset)
 {
 __try {
-  GET_NSIACCESSIBLEEDITABLETEXT
+  nsRefPtr<nsHyperTextAccessible> textAcc(do_QueryObject(this));
+  if (textAcc->IsDefunct())
+    return CO_E_OBJNOTCONNECTED;
 
   nsresult rv = textAcc->CutText(aStartOffset, aEndOffset);
   return GetHRESULT(rv);
 
 } __except(nsAccessNodeWrap::FilterA11yExceptions(::GetExceptionCode(), GetExceptionInformation())) { }
   return E_FAIL;
 }
 
 STDMETHODIMP
 CAccessibleEditableText::pasteText(long aOffset)
 {
 __try {
-  GET_NSIACCESSIBLEEDITABLETEXT
+  nsRefPtr<nsHyperTextAccessible> textAcc(do_QueryObject(this));
+  if (textAcc->IsDefunct())
+    return CO_E_OBJNOTCONNECTED;
 
   nsresult rv = textAcc->PasteText(aOffset);
   return GetHRESULT(rv);
 
 } __except(nsAccessNodeWrap::FilterA11yExceptions(::GetExceptionCode(), GetExceptionInformation())) { }
   return E_FAIL;
 }
 
 STDMETHODIMP
 CAccessibleEditableText::replaceText(long aStartOffset, long aEndOffset,
                                      BSTR *aText)
 {
 __try {
-  GET_NSIACCESSIBLEEDITABLETEXT
+  nsRefPtr<nsHyperTextAccessible> textAcc(do_QueryObject(this));
+  if (textAcc->IsDefunct())
+    return CO_E_OBJNOTCONNECTED;
 
   nsresult rv = textAcc->DeleteText(aStartOffset, aEndOffset);
   if (NS_FAILED(rv))
     return GetHRESULT(rv);
 
   PRUint32 length = ::SysStringLen(*aText);
   nsAutoString text(*aText, length);
 
--- a/accessible/src/msaa/CAccessibleHyperlink.cpp
+++ b/accessible/src/msaa/CAccessibleHyperlink.cpp
@@ -39,17 +39,17 @@
  * ***** END LICENSE BLOCK ***** */
 
 #include "CAccessibleHyperlink.h"
 
 #include "Accessible2.h"
 #include "AccessibleHyperlink.h"
 #include "AccessibleHyperlink_i.c"
 
-#include "nsAccessible.h"
+#include "nsAccessibleWrap.h"
 #include "nsIWinAccessNode.h"
 
 // IUnknown
 
 STDMETHODIMP
 CAccessibleHyperlink::QueryInterface(REFIID iid, void** ppv)
 {
   *ppv = NULL;
@@ -71,57 +71,60 @@ CAccessibleHyperlink::QueryInterface(REF
 
 STDMETHODIMP
 CAccessibleHyperlink::get_anchor(long aIndex, VARIANT *aAnchor)
 {
 __try {
   VariantInit(aAnchor);
 
   nsRefPtr<nsAccessible> thisObj = do_QueryObject(this);
-  if (thisObj->IsDefunct() || !thisObj->IsLink())
-    return E_FAIL;
+  if (thisObj->IsDefunct())
+    return CO_E_OBJNOTCONNECTED;
 
   if (aIndex < 0 || aIndex >= static_cast<long>(thisObj->AnchorCount()))
     return E_INVALIDARG;
 
-  nsAccessible* anchor = thisObj->AnchorAt(aIndex);
+  if (!thisObj->IsLink())
+    return S_FALSE;
+
+  nsAccessibleWrap* anchor =
+    static_cast<nsAccessibleWrap*>(thisObj->AnchorAt(aIndex));
   if (!anchor)
     return S_FALSE;
 
-  nsCOMPtr<nsIWinAccessNode> winAccessNode(do_QueryObject(anchor));
-  if (!winAccessNode)
-    return E_FAIL;
+  void* instancePtr = NULL;
+  HRESULT result = anchor->QueryInterface(IID_IUnknown, &instancePtr);
+  if (FAILED(result))
+    return result;
 
-  void *instancePtr = NULL;
-  nsresult rv = winAccessNode->QueryNativeInterface(IID_IUnknown, &instancePtr);
-  if (NS_FAILED(rv))
-    return E_FAIL;
-
-  IUnknown *unknownPtr = static_cast<IUnknown*>(instancePtr);
+  IUnknown* unknownPtr = static_cast<IUnknown*>(instancePtr);
   aAnchor->ppunkVal = &unknownPtr;
   aAnchor->vt = VT_UNKNOWN;
   return S_OK;
 
 } __except(nsAccessNodeWrap::FilterA11yExceptions(::GetExceptionCode(), GetExceptionInformation())) { }
   return E_FAIL;
 }
 
 STDMETHODIMP
 CAccessibleHyperlink::get_anchorTarget(long aIndex, VARIANT *aAnchorTarget)
 {
 __try {
   VariantInit(aAnchorTarget);
 
   nsRefPtr<nsAccessible> thisObj = do_QueryObject(this);
-  if (thisObj->IsDefunct() || !thisObj->IsLink())
-    return E_FAIL;
+  if (thisObj->IsDefunct())
+    return CO_E_OBJNOTCONNECTED;
 
   if (aIndex < 0 || aIndex >= static_cast<long>(thisObj->AnchorCount()))
     return E_INVALIDARG;
 
+  if (!thisObj->IsLink())
+    return S_FALSE;
+
   nsCOMPtr<nsIURI> uri = thisObj->AnchorURIAt(aIndex);
   if (!uri)
     return S_FALSE;
 
   nsCAutoString prePath;
   nsresult rv = uri->GetPrePath(prePath);
   if (NS_FAILED(rv))
     return GetHRESULT(rv);
@@ -146,52 +149,61 @@ CAccessibleHyperlink::get_anchorTarget(l
 
 STDMETHODIMP
 CAccessibleHyperlink::get_startIndex(long *aIndex)
 {
 __try {
   *aIndex = 0;
 
   nsRefPtr<nsAccessible> thisObj = do_QueryObject(this);
-  if (thisObj->IsDefunct() || !thisObj->IsLink())
-    return E_FAIL;
+  if (thisObj->IsDefunct())
+    return CO_E_OBJNOTCONNECTED;
+
+  if (!thisObj->IsLink())
+    return S_FALSE;
 
   *aIndex = thisObj->StartOffset();
   return S_OK;
 
 } __except(nsAccessNodeWrap::FilterA11yExceptions(::GetExceptionCode(), GetExceptionInformation())) { }
   return E_FAIL;
 }
 
 STDMETHODIMP
 CAccessibleHyperlink::get_endIndex(long *aIndex)
 {
 __try {
   *aIndex = 0;
 
   nsRefPtr<nsAccessible> thisObj = do_QueryObject(this);
-  if (thisObj->IsDefunct() || !thisObj->IsLink())
-    return E_FAIL;
+  if (thisObj->IsDefunct())
+    return CO_E_OBJNOTCONNECTED;
+
+  if (!thisObj->IsLink())
+    return S_FALSE;
 
   *aIndex = thisObj->EndOffset();
   return S_OK;
 
 } __except(nsAccessNodeWrap::FilterA11yExceptions(::GetExceptionCode(), GetExceptionInformation())) { }
   return E_FAIL;
 }
 
 STDMETHODIMP
 CAccessibleHyperlink::get_valid(boolean *aValid)
 {
 __try {
   *aValid = false;
 
   nsRefPtr<nsAccessible> thisObj = do_QueryObject(this);
-  if (thisObj->IsDefunct() || !thisObj->IsLink())
-    return E_FAIL;
+  if (thisObj->IsDefunct())
+    return CO_E_OBJNOTCONNECTED;
+
+  if (!thisObj->IsLink())
+    return S_FALSE;
 
   *aValid = thisObj->IsLinkValid();
   return S_OK;
 
 } __except(nsAccessNodeWrap::FilterA11yExceptions(::GetExceptionCode(), GetExceptionInformation())) { }
   return E_FAIL;
 }
 
--- a/accessible/src/msaa/CAccessibleHypertext.cpp
+++ b/accessible/src/msaa/CAccessibleHypertext.cpp
@@ -67,36 +67,36 @@ CAccessibleHypertext::QueryInterface(REF
 
 STDMETHODIMP
 CAccessibleHypertext::get_nHyperlinks(long *aHyperlinkCount)
 {
 __try {
   *aHyperlinkCount = 0;
 
   nsRefPtr<nsHyperTextAccessible> hyperText = do_QueryObject(this);
-  if (!hyperText)
-    return E_FAIL;
+  if (hyperText->IsDefunct())
+    return CO_E_OBJNOTCONNECTED;
 
   *aHyperlinkCount = hyperText->GetLinkCount();
   return S_OK;
 
 } __except(nsAccessNodeWrap::FilterA11yExceptions(::GetExceptionCode(), GetExceptionInformation())) { }
   return E_FAIL;
 }
 
 STDMETHODIMP
 CAccessibleHypertext::get_hyperlink(long aLinkIndex,
                                     IAccessibleHyperlink **aHyperlink)
 {
 __try {
   *aHyperlink = NULL;
 
   nsRefPtr<nsHyperTextAccessible> hyperText = do_QueryObject(this);
-  if (!hyperText)
-    return E_FAIL;
+  if (hyperText->IsDefunct())
+    return CO_E_OBJNOTCONNECTED;
 
   nsAccessible* hyperLink = hyperText->GetLinkAt(aLinkIndex);
   nsCOMPtr<nsIWinAccessNode> winAccessNode(do_QueryObject(hyperLink));
   if (!winAccessNode)
     return E_FAIL;
 
   void *instancePtr = NULL;
   nsresult rv =  winAccessNode->QueryNativeInterface(IID_IAccessibleHyperlink,
@@ -113,18 +113,18 @@ CAccessibleHypertext::get_hyperlink(long
 
 STDMETHODIMP
 CAccessibleHypertext::get_hyperlinkIndex(long aCharIndex, long *aHyperlinkIndex)
 {
 __try {
   *aHyperlinkIndex = 0;
 
   nsRefPtr<nsHyperTextAccessible> hyperAcc(do_QueryObject(this));
-  if (!hyperAcc)
-    return E_FAIL;
+  if (hyperAcc->IsDefunct())
+    return CO_E_OBJNOTCONNECTED;
 
   *aHyperlinkIndex = hyperAcc->GetLinkIndexAtOffset(aCharIndex);
   return S_OK;
 
 } __except(nsAccessNodeWrap::FilterA11yExceptions(::GetExceptionCode(), GetExceptionInformation())) { }
   return E_FAIL;
 }
 
--- a/accessible/src/msaa/CAccessibleText.cpp
+++ b/accessible/src/msaa/CAccessibleText.cpp
@@ -69,16 +69,19 @@ CAccessibleText::QueryInterface(REFIID i
 
 // IAccessibleText
 
 STDMETHODIMP
 CAccessibleText::addSelection(long aStartOffset, long aEndOffset)
 {
 __try {
   nsRefPtr<nsHyperTextAccessible> textAcc(do_QueryObject(this));
+  if (textAcc->IsDefunct())
+    return CO_E_OBJNOTCONNECTED;
+
   nsresult rv = textAcc->AddSelection(aStartOffset, aEndOffset);
   return GetHRESULT(rv);
 
 } __except(nsAccessNodeWrap::FilterA11yExceptions(::GetExceptionCode(), GetExceptionInformation())) { }
   return E_FAIL;
 }
 
 STDMETHODIMP
@@ -89,16 +92,18 @@ CAccessibleText::get_attributes(long aOf
   if (!aStartOffset || !aEndOffset || !aTextAttributes)
     return E_INVALIDARG;
 
   *aStartOffset = 0;
   *aEndOffset = 0;
   *aTextAttributes = NULL;
 
   nsRefPtr<nsHyperTextAccessible> textAcc(do_QueryObject(this));
+  if (textAcc->IsDefunct())
+    return CO_E_OBJNOTCONNECTED;
 
   PRInt32 startOffset = 0, endOffset = 0;
   nsCOMPtr<nsIPersistentProperties> attributes;
   nsresult rv = textAcc->GetTextAttributes(true, aOffset,
                                            &startOffset, &endOffset,
                                            getter_AddRefs(attributes));
   if (NS_FAILED(rv))
     return GetHRESULT(rv);
@@ -119,16 +124,18 @@ CAccessibleText::get_attributes(long aOf
 
 STDMETHODIMP
 CAccessibleText::get_caretOffset(long *aOffset)
 {
 __try {
   *aOffset = -1;
 
   nsRefPtr<nsHyperTextAccessible> textAcc(do_QueryObject(this));
+  if (textAcc->IsDefunct())
+    return CO_E_OBJNOTCONNECTED;
 
   PRInt32 offset = 0;
   nsresult rv = textAcc->GetCaretOffset(&offset);
   if (NS_FAILED(rv))
     return GetHRESULT(rv);
 
   *aOffset = offset;
   return offset != -1 ? S_OK : S_FALSE;
@@ -145,16 +152,18 @@ CAccessibleText::get_characterExtents(lo
 {
 __try {
   *aX = 0;
   *aY = 0;
   *aWidth = 0;
   *aHeight = 0;
 
   nsRefPtr<nsHyperTextAccessible> textAcc(do_QueryObject(this));
+  if (textAcc->IsDefunct())
+    return CO_E_OBJNOTCONNECTED;
 
   PRUint32 geckoCoordType = (aCoordType == IA2_COORDTYPE_SCREEN_RELATIVE) ?
     nsIAccessibleCoordinateType::COORDTYPE_SCREEN_RELATIVE :
     nsIAccessibleCoordinateType::COORDTYPE_PARENT_RELATIVE;
 
   PRInt32 x = 0, y =0, width = 0, height = 0;
   nsresult rv = textAcc->GetCharacterExtents (aOffset, &x, &y, &width, &height,
                                               geckoCoordType);
@@ -174,17 +183,17 @@ CAccessibleText::get_characterExtents(lo
 STDMETHODIMP
 CAccessibleText::get_nSelections(long *aNSelections)
 {
 __try {
   *aNSelections = 0;
 
   nsRefPtr<nsHyperTextAccessible> textAcc(do_QueryObject(this));
   if (textAcc->IsDefunct())
-    return E_FAIL;
+    return CO_E_OBJNOTCONNECTED;
 
   PRInt32 selCount = 0;
   nsresult rv = textAcc->GetSelectionCount(&selCount);
   if (NS_FAILED(rv))
     return GetHRESULT(rv);
 
   *aNSelections = selCount;
   return S_OK;
@@ -197,16 +206,18 @@ STDMETHODIMP
 CAccessibleText::get_offsetAtPoint(long aX, long aY,
                                    enum IA2CoordinateType aCoordType,
                                    long *aOffset)
 {
 __try {
   *aOffset = 0;
 
   nsRefPtr<nsHyperTextAccessible> textAcc(do_QueryObject(this));
+  if (textAcc->IsDefunct())
+    return CO_E_OBJNOTCONNECTED;
 
   PRUint32 geckoCoordType = (aCoordType == IA2_COORDTYPE_SCREEN_RELATIVE) ?
     nsIAccessibleCoordinateType::COORDTYPE_SCREEN_RELATIVE :
     nsIAccessibleCoordinateType::COORDTYPE_PARENT_RELATIVE;
 
   PRInt32 offset = 0;
   nsresult rv = textAcc->GetOffsetAtPoint(aX, aY, geckoCoordType, &offset);
   if (NS_FAILED(rv))
@@ -223,16 +234,18 @@ STDMETHODIMP
 CAccessibleText::get_selection(long aSelectionIndex, long *aStartOffset,
                                long *aEndOffset)
 {
 __try {
   *aStartOffset = 0;
   *aEndOffset = 0;
 
   nsRefPtr<nsHyperTextAccessible> textAcc(do_QueryObject(this));
+  if (textAcc->IsDefunct())
+    return CO_E_OBJNOTCONNECTED;
 
   PRInt32 startOffset = 0, endOffset = 0;
   nsresult rv = textAcc->GetSelectionBounds(aSelectionIndex,
                                             &startOffset, &endOffset);
   if (NS_FAILED(rv))
     return GetHRESULT(rv);
 
   *aStartOffset = startOffset;
@@ -245,16 +258,18 @@ CAccessibleText::get_selection(long aSel
 
 STDMETHODIMP
 CAccessibleText::get_text(long aStartOffset, long aEndOffset, BSTR *aText)
 {
 __try {
   *aText = NULL;
 
   nsRefPtr<nsHyperTextAccessible> textAcc(do_QueryObject(this));
+  if (textAcc->IsDefunct())
+    return CO_E_OBJNOTCONNECTED;
 
   nsAutoString text;
   nsresult rv = textAcc->GetText(aStartOffset, aEndOffset, text);
   if (NS_FAILED(rv))
     return GetHRESULT(rv);
 
   if (text.IsEmpty())
     return S_FALSE;
@@ -274,17 +289,17 @@ CAccessibleText::get_textBeforeOffset(lo
 {
 __try {
   *aStartOffset = 0;
   *aEndOffset = 0;
   *aText = NULL;
 
   nsRefPtr<nsHyperTextAccessible> textAcc(do_QueryObject(this));
   if (textAcc->IsDefunct())
-    return E_FAIL;
+    return CO_E_OBJNOTCONNECTED;
 
   nsresult rv = NS_OK;
   nsAutoString text;
   PRInt32 startOffset = 0, endOffset = 0;
 
   if (aBoundaryType == IA2_TEXT_BOUNDARY_ALL) {
     startOffset = 0;
     endOffset = textAcc->CharacterCount();
@@ -321,17 +336,17 @@ CAccessibleText::get_textAfterOffset(lon
 {
 __try {
   *aStartOffset = 0;
   *aEndOffset = 0;
   *aText = NULL;
 
   nsRefPtr<nsHyperTextAccessible> textAcc(do_QueryObject(this));
   if (textAcc->IsDefunct())
-    return E_FAIL;
+    return CO_E_OBJNOTCONNECTED;
 
   nsresult rv = NS_OK;
   nsAutoString text;
   PRInt32 startOffset = 0, endOffset = 0;
 
   if (aBoundaryType == IA2_TEXT_BOUNDARY_ALL) {
     startOffset = 0;
     endOffset = textAcc->CharacterCount();
@@ -368,17 +383,17 @@ CAccessibleText::get_textAtOffset(long a
 {
 __try {
   *aStartOffset = 0;
   *aEndOffset = 0;
   *aText = NULL;
 
   nsRefPtr<nsHyperTextAccessible> textAcc(do_QueryObject(this));
   if (textAcc->IsDefunct())
-    return E_FAIL;
+    return CO_E_OBJNOTCONNECTED;
 
   nsresult rv = NS_OK;
   nsAutoString text;
   PRInt32 startOffset = 0, endOffset = 0;
 
   if (aBoundaryType == IA2_TEXT_BOUNDARY_ALL) {
     startOffset = 0;
     endOffset = textAcc->CharacterCount();
@@ -407,43 +422,49 @@ CAccessibleText::get_textAtOffset(long a
   return E_FAIL;
 }
 
 STDMETHODIMP
 CAccessibleText::removeSelection(long aSelectionIndex)
 {
 __try {
   nsRefPtr<nsHyperTextAccessible> textAcc(do_QueryObject(this));
+  if (textAcc->IsDefunct())
+    return CO_E_OBJNOTCONNECTED;
 
   nsresult rv = textAcc->RemoveSelection(aSelectionIndex);
   return GetHRESULT(rv);
 
 } __except(nsAccessNodeWrap::FilterA11yExceptions(::GetExceptionCode(), GetExceptionInformation())) { }
   return E_FAIL;
 }
 
 STDMETHODIMP
 CAccessibleText::setCaretOffset(long aOffset)
 {
 __try {
   nsRefPtr<nsHyperTextAccessible> textAcc(do_QueryObject(this));
+  if (textAcc->IsDefunct())
+    return CO_E_OBJNOTCONNECTED;
 
   nsresult rv = textAcc->SetCaretOffset(aOffset);
   return GetHRESULT(rv);
 
 } __except(nsAccessNodeWrap::FilterA11yExceptions(::GetExceptionCode(), GetExceptionInformation())) { }
   return E_FAIL;
 }
 
 STDMETHODIMP
 CAccessibleText::setSelection(long aSelectionIndex, long aStartOffset,
                               long aEndOffset)
 {
 __try {
   nsRefPtr<nsHyperTextAccessible> textAcc(do_QueryObject(this));
+  if (textAcc->IsDefunct())
+    return CO_E_OBJNOTCONNECTED;
 
   nsresult rv = textAcc->SetSelectionBounds(aSelectionIndex,
                                             aStartOffset, aEndOffset);
   return GetHRESULT(rv);
 
 } __except(nsAccessNodeWrap::FilterA11yExceptions(::GetExceptionCode(), GetExceptionInformation())) { }
   return E_FAIL;
 }
@@ -451,46 +472,50 @@ CAccessibleText::setSelection(long aSele
 STDMETHODIMP
 CAccessibleText::get_nCharacters(long *aNCharacters)
 {
 __try {
   *aNCharacters = 0;
 
   nsRefPtr<nsHyperTextAccessible> textAcc(do_QueryObject(this));
   if (textAcc->IsDefunct())
-    return E_FAIL;
+    return CO_E_OBJNOTCONNECTED;
 
   *aNCharacters  = textAcc->CharacterCount();
   return S_OK;
 
 } __except(nsAccessNodeWrap::FilterA11yExceptions(::GetExceptionCode(), GetExceptionInformation())) { }
   return E_FAIL;
 }
 
 STDMETHODIMP
 CAccessibleText::scrollSubstringTo(long aStartIndex, long aEndIndex,
                                    enum IA2ScrollType aScrollType)
 {
 __try {
   nsRefPtr<nsHyperTextAccessible> textAcc(do_QueryObject(this));
+  if (textAcc->IsDefunct())
+    return CO_E_OBJNOTCONNECTED;
 
   nsresult rv = textAcc->ScrollSubstringTo(aStartIndex, aEndIndex, aScrollType);
   return GetHRESULT(rv);
 
 } __except(nsAccessNodeWrap::FilterA11yExceptions(::GetExceptionCode(), GetExceptionInformation())) { }
   return E_FAIL;
 }
 
 STDMETHODIMP
 CAccessibleText::scrollSubstringToPoint(long aStartIndex, long aEndIndex,
                                         enum IA2CoordinateType aCoordType,
                                         long aX, long aY)
 {
 __try {
   nsRefPtr<nsHyperTextAccessible> textAcc(do_QueryObject(this));
+  if (textAcc->IsDefunct())
+    return CO_E_OBJNOTCONNECTED;
 
   PRUint32 geckoCoordType = (aCoordType == IA2_COORDTYPE_SCREEN_RELATIVE) ?
     nsIAccessibleCoordinateType::COORDTYPE_SCREEN_RELATIVE :
     nsIAccessibleCoordinateType::COORDTYPE_PARENT_RELATIVE;
 
   nsresult rv = textAcc->ScrollSubstringToPoint(aStartIndex, aEndIndex,
                                                 geckoCoordType, aX, aY);
   return GetHRESULT(rv);
--- a/accessible/src/msaa/Makefile.in
+++ b/accessible/src/msaa/Makefile.in
@@ -48,17 +48,17 @@ LIBXUL_LIBRARY = 1
 
 
 CPPSRCS = \
   nsAccessNodeWrap.cpp \
   nsAccessibleWrap.cpp \
   nsTextAccessibleWrap.cpp \
   nsDocAccessibleWrap.cpp \
   nsHTMLWin32ObjectAccessible.cpp \
-  nsARIAGridAccessibleWrap.cpp \
+  ARIAGridAccessibleWrap.cpp \
   nsRootAccessibleWrap.cpp \
   nsXULMenuAccessibleWrap.cpp \
   nsXULListboxAccessibleWrap.cpp \
   nsXULTreeGridAccessibleWrap.cpp \
   nsHyperTextAccessibleWrap.cpp \
   nsHTMLImageAccessibleWrap.cpp \
   nsHTMLTableAccessibleWrap.cpp \
   nsApplicationAccessibleWrap.cpp \
@@ -73,23 +73,23 @@ CPPSRCS = \
   ia2AccessibleRelation.cpp \
   CAccessibleTable.cpp \
   CAccessibleTableCell.cpp \
   CAccessibleValue.cpp \
   Compatibility.cpp \
   $(NULL)
 
 EXPORTS = \
+  ARIAGridAccessibleWrap.h \
   nsAccessNodeWrap.h \
   nsAccessibleWrap.h \
   nsTextAccessibleWrap.h \
   nsDocAccessibleWrap.h \
   nsRootAccessibleWrap.h \
   nsHTMLWin32ObjectAccessible.h \
-  nsARIAGridAccessibleWrap.h \
   nsXULMenuAccessibleWrap.h \
   nsXULListboxAccessibleWrap.h \
   nsXULTreeGridAccessibleWrap.h \
   nsHyperTextAccessibleWrap.h \
   nsHTMLImageAccessibleWrap.h \
   nsHTMLTableAccessibleWrap.h \
   nsApplicationAccessibleWrap.h \
   ia2AccessibleAction.h \
--- a/accessible/src/msaa/ia2AccessibleAction.cpp
+++ b/accessible/src/msaa/ia2AccessibleAction.cpp
@@ -68,32 +68,32 @@ ia2AccessibleAction::nActions(long* aAct
 __try {
   if (!aActionCount)
     return E_INVALIDARG;
 
   *aActionCount = 0;
 
   nsAccessibleWrap* acc = static_cast<nsAccessibleWrap*>(this);
   if (acc->IsDefunct())
-    return E_FAIL;
+    return CO_E_OBJNOTCONNECTED;
 
   *aActionCount = acc->ActionCount();
   return S_OK;
 
 } __except(nsAccessNodeWrap::FilterA11yExceptions(::GetExceptionCode(), GetExceptionInformation())) { }
   return E_FAIL;
 }
 
 STDMETHODIMP
 ia2AccessibleAction::doAction(long aActionIndex)
 {
 __try {
   nsAccessibleWrap* acc = static_cast<nsAccessibleWrap*>(this);
   if (acc->IsDefunct())
-    return E_FAIL;
+    return CO_E_OBJNOTCONNECTED;
 
   PRUint8 index = static_cast<PRUint8>(aActionIndex);
   nsresult rv = acc->DoAction(index);
   return GetHRESULT(rv);
 
 } __except(nsAccessNodeWrap::FilterA11yExceptions(::GetExceptionCode(), GetExceptionInformation())) { }
   return E_FAIL;
 }
@@ -101,17 +101,17 @@ ia2AccessibleAction::doAction(long aActi
 STDMETHODIMP
 ia2AccessibleAction::get_description(long aActionIndex, BSTR *aDescription)
 {
 __try {
   *aDescription = NULL;
 
   nsAccessibleWrap* acc = static_cast<nsAccessibleWrap*>(this);
   if (acc->IsDefunct())
-    return E_FAIL;
+    return CO_E_OBJNOTCONNECTED;
 
   nsAutoString description;
   PRUint8 index = static_cast<PRUint8>(aActionIndex);
   nsresult rv = acc->GetActionDescription(index, description);
   if (NS_FAILED(rv))
     return GetHRESULT(rv);
 
   if (description.IsEmpty())
@@ -139,17 +139,17 @@ ia2AccessibleAction::get_keyBinding(long
     return E_INVALIDARG;
   *aNumBinding = 0;
 
   if (aActionIndex != 0 || aNumMaxBinding < 1)
     return E_INVALIDARG;
 
   nsAccessibleWrap* acc = static_cast<nsAccessibleWrap*>(this);
   if (acc->IsDefunct())
-    return E_FAIL;
+    return CO_E_OBJNOTCONNECTED;
 
   // Expose keyboard shortcut if it's not exposed via MSAA keyboard shortcut.
   KeyBinding keyBinding = acc->AccessKey();
   if (keyBinding.IsEmpty())
     return S_FALSE;
 
   keyBinding = acc->KeyboardShortcut();
   if (keyBinding.IsEmpty())
@@ -178,17 +178,17 @@ ia2AccessibleAction::get_keyBinding(long
 STDMETHODIMP
 ia2AccessibleAction::get_name(long aActionIndex, BSTR *aName)
 {
 __try {
   *aName = NULL;
 
   nsAccessibleWrap* acc = static_cast<nsAccessibleWrap*>(this);
   if (acc->IsDefunct())
-    return E_FAIL;
+    return CO_E_OBJNOTCONNECTED;
 
   nsAutoString name;
   PRUint8 index = static_cast<PRUint8>(aActionIndex);
   nsresult rv = acc->GetActionName(index, name);
   if (NS_FAILED(rv))
     return GetHRESULT(rv);
 
   if (name.IsEmpty())
--- a/accessible/src/msaa/nsAccessibleWrap.cpp
+++ b/accessible/src/msaa/nsAccessibleWrap.cpp
@@ -163,19 +163,19 @@ STDMETHODIMP nsAccessibleWrap::QueryInte
 //-----------------------------------------------------
 
 STDMETHODIMP nsAccessibleWrap::get_accParent( IDispatch __RPC_FAR *__RPC_FAR *ppdispParent)
 {
 __try {
   *ppdispParent = NULL;
 
   if (IsDefunct())
-    return E_FAIL;
+    return CO_E_OBJNOTCONNECTED;
 
-  nsRefPtr<nsDocAccessible> doc(do_QueryObject(this));
+  nsDocAccessible* doc = AsDoc();
   if (doc) {
     // Return window system accessible object for root document and tab document
     // accessibles.
     if (!doc->ParentDocument() ||
         nsWinUtils::IsWindowEmulationStarted() &&
         nsCoreUtils::IsTabDocument(doc->GetDocumentNode())) {
       HWND hwnd = static_cast<HWND>(doc->GetNativeWindow());
       if (hwnd && SUCCEEDED(::AccessibleObjectFromWindow(hwnd, OBJID_WINDOW,
@@ -205,17 +205,17 @@ STDMETHODIMP nsAccessibleWrap::get_accCh
 {
 __try {
   if (!pcountChildren)
     return E_INVALIDARG;
 
   *pcountChildren = 0;
 
   if (IsDefunct())
-    return E_FAIL;
+    return CO_E_OBJNOTCONNECTED;
 
   if (nsAccUtils::MustPrune(this))
     return S_OK;
 
   *pcountChildren = GetChildCount();
 } __except(FilterA11yExceptions(::GetExceptionCode(), GetExceptionInformation())) { }
 
   return S_OK;
@@ -223,41 +223,54 @@ STDMETHODIMP nsAccessibleWrap::get_accCh
 
 STDMETHODIMP nsAccessibleWrap::get_accChild(
       /* [in] */ VARIANT varChild,
       /* [retval][out] */ IDispatch __RPC_FAR *__RPC_FAR *ppdispChild)
 {
 __try {
   *ppdispChild = NULL;
   if (IsDefunct())
-    return E_FAIL;
+    return CO_E_OBJNOTCONNECTED;
 
   // IAccessible::accChild is used to return this accessible or child accessible
   // at the given index or to get an accessible by child ID in the case of
   // document accessible (it's handled by overriden GetXPAccessibleFor method
   // on the document accessible). The getting an accessible by child ID is used
   // by AccessibleObjectFromEvent() called by AT when AT handles our MSAA event.
   nsAccessible* child = GetXPAccessibleFor(varChild);
-  if (child)
-    *ppdispChild = NativeAccessible(child);
+  if (!child)
+    return E_INVALIDARG;
+
+  if (child->IsDefunct())
+    return CO_E_OBJNOTCONNECTED;
+
+  *ppdispChild = NativeAccessible(child);
 
 } __except(FilterA11yExceptions(::GetExceptionCode(), GetExceptionInformation())) { }
 
-  return (*ppdispChild)? S_OK: E_INVALIDARG;
+  return S_OK;
 }
 
 STDMETHODIMP nsAccessibleWrap::get_accName(
       /* [optional][in] */ VARIANT varChild,
       /* [retval][out] */ BSTR __RPC_FAR *pszName)
 {
 __try {
   *pszName = NULL;
-  nsAccessible *xpAccessible = GetXPAccessibleFor(varChild);
+
+  if (IsDefunct())
+    return CO_E_OBJNOTCONNECTED;
+
+  nsAccessible* xpAccessible = GetXPAccessibleFor(varChild);
   if (!xpAccessible)
-    return E_FAIL;
+    return E_INVALIDARG;
+
+  if (xpAccessible->IsDefunct())
+    return CO_E_OBJNOTCONNECTED;
+
   nsAutoString name;
   nsresult rv = xpAccessible->GetName(name);
   if (NS_FAILED(rv))
     return GetHRESULT(rv);
 
   // The name was not provided, e.g. no alt attribute for an image. A screen
   // reader may choose to invent its own accessible name, e.g. from an image src
   // attribute. Refer to NS_OK_EMPTY_NAME return value.
@@ -276,23 +289,31 @@ STDMETHODIMP nsAccessibleWrap::get_accNa
 
 STDMETHODIMP nsAccessibleWrap::get_accValue(
       /* [optional][in] */ VARIANT varChild,
       /* [retval][out] */ BSTR __RPC_FAR *pszValue)
 {
 __try {
   *pszValue = NULL;
 
+  if (IsDefunct())
+    return CO_E_OBJNOTCONNECTED;
+
   nsAccessible* xpAccessible = GetXPAccessibleFor(varChild);
-  if (!xpAccessible || xpAccessible->IsDefunct())
-    return E_FAIL;
+  if (!xpAccessible)
+    return E_INVALIDARG;
+
+  if (xpAccessible->IsDefunct())
+    return CO_E_OBJNOTCONNECTED;
+
+  if (xpAccessible->NativeRole() == roles::PASSWORD_TEXT)
+    return E_ACCESSDENIED;
 
   nsAutoString value;
-  if (NS_FAILED(xpAccessible->GetValue(value)))
-    return E_FAIL;
+  xpAccessible->Value(value);
 
   // See bug 438784: need to expose URL on doc's value attribute. For this,
   // reverting part of fix for bug 425693 to make this MSAA method behave
   // IAccessible2-style.
   if (value.IsEmpty())
     return S_FALSE;
 
   *pszValue = ::SysAllocStringLen(value.get(), value.Length());
@@ -305,19 +326,25 @@ STDMETHODIMP nsAccessibleWrap::get_accVa
 
 STDMETHODIMP
 nsAccessibleWrap::get_accDescription(VARIANT varChild,
                                      BSTR __RPC_FAR *pszDescription)
 {
 __try {
   *pszDescription = NULL;
 
-  nsAccessible *xpAccessible = GetXPAccessibleFor(varChild);
-  if (!xpAccessible || xpAccessible->IsDefunct())
-    return E_FAIL;
+  if (IsDefunct())
+    return CO_E_OBJNOTCONNECTED;
+
+  nsAccessible* xpAccessible = GetXPAccessibleFor(varChild);
+  if (!xpAccessible)
+    return E_INVALIDARG;
+
+  if (xpAccessible->IsDefunct())
+    return CO_E_OBJNOTCONNECTED;
 
   nsAutoString description;
   xpAccessible->Description(description);
 
   *pszDescription = ::SysAllocStringLen(description.get(),
                                         description.Length());
   return *pszDescription ? S_OK : E_OUTOFMEMORY;
 
@@ -328,21 +355,24 @@ nsAccessibleWrap::get_accDescription(VAR
 STDMETHODIMP nsAccessibleWrap::get_accRole(
       /* [optional][in] */ VARIANT varChild,
       /* [retval][out] */ VARIANT __RPC_FAR *pvarRole)
 {
 __try {
   VariantInit(pvarRole);
 
   if (IsDefunct())
-    return E_FAIL;
+    return CO_E_OBJNOTCONNECTED;
 
-  nsAccessible *xpAccessible = GetXPAccessibleFor(varChild);
+  nsAccessible* xpAccessible = GetXPAccessibleFor(varChild);
   if (!xpAccessible)
-    return E_FAIL;
+    return E_INVALIDARG;
+
+  if (xpAccessible->IsDefunct())
+    return CO_E_OBJNOTCONNECTED;
 
 #ifdef DEBUG_A11Y
   NS_ASSERTION(nsAccUtils::IsTextInterfaceSupportCorrect(xpAccessible),
                "Does not support nsIAccessibleText when it should");
 #endif
 
   roles::Role role = xpAccessible->Role();
   PRUint32 msaaRole = gWindowsRoleMap[role].msaaRole;
@@ -405,19 +435,25 @@ STDMETHODIMP nsAccessibleWrap::get_accSt
       /* [optional][in] */ VARIANT varChild,
       /* [retval][out] */ VARIANT __RPC_FAR *pvarState)
 {
 __try {
   VariantInit(pvarState);
   pvarState->vt = VT_I4;
   pvarState->lVal = 0;
 
-  nsAccessible *xpAccessible = GetXPAccessibleFor(varChild);
+  if (IsDefunct())
+    return CO_E_OBJNOTCONNECTED;
+
+  nsAccessible* xpAccessible = GetXPAccessibleFor(varChild);
   if (!xpAccessible)
-    return E_FAIL;
+    return E_INVALIDARG;
+
+  if (xpAccessible->IsDefunct())
+    return CO_E_OBJNOTCONNECTED;
 
   // MSAA only has 31 states and the lowest 31 bits of our state bit mask
   // are the same states as MSAA.
   // Note: we map the following Gecko states to different MSAA states:
   //   REQUIRED -> ALERT_LOW
   //   ALERT -> ALERT_MEDIUM
   //   INVALID -> ALERT_HIGH
   //   CHECKABLE -> MARQUEED
@@ -462,19 +498,25 @@ STDMETHODIMP nsAccessibleWrap::get_accKe
       /* [optional][in] */ VARIANT varChild,
       /* [retval][out] */ BSTR __RPC_FAR *pszKeyboardShortcut)
 {
 __try {
   if (!pszKeyboardShortcut)
     return E_INVALIDARG;
   *pszKeyboardShortcut = NULL;
 
+  if (IsDefunct())
+    return CO_E_OBJNOTCONNECTED;
+
   nsAccessible* acc = GetXPAccessibleFor(varChild);
-  if (!acc || acc->IsDefunct())
-    return E_FAIL;
+  if (!acc)
+    return E_INVALIDARG;
+
+  if (acc->IsDefunct())
+    return CO_E_OBJNOTCONNECTED;
 
   KeyBinding keyBinding = acc->AccessKey();
   if (keyBinding.IsEmpty())
     keyBinding = acc->KeyboardShortcut();
 
   nsAutoString shortcut;
   keyBinding.ToString(shortcut);
 
@@ -491,17 +533,17 @@ STDMETHODIMP nsAccessibleWrap::get_accFo
   // VT_EMPTY:    None. This object does not have the keyboard focus itself
   //              and does not contain a child that has the keyboard focus.
   // VT_I4:       lVal is CHILDID_SELF. The object itself has the keyboard focus.
   // VT_I4:       lVal contains the child ID of the child element with the keyboard focus.
   // VT_DISPATCH: pdispVal member is the address of the IDispatch interface
   //              for the child object with the keyboard focus.
 __try {
   if (IsDefunct())
-    return E_FAIL;
+    return CO_E_OBJNOTCONNECTED;
 
   VariantInit(pvarChild);
 
   // Return the current IAccessible child that has focus
   nsAccessible* focusedAccessible = FocusedChild();
   if (focusedAccessible == this) {
     pvarChild->vt = VT_I4;
     pvarChild->lVal = CHILDID_SELF;
@@ -665,16 +707,19 @@ AccessibleEnumerator::Skip(unsigned long
   *  - the object is not the type that can have children selected
   */
 STDMETHODIMP nsAccessibleWrap::get_accSelection(VARIANT __RPC_FAR *pvarChildren)
 {
 __try {
   VariantInit(pvarChildren);
   pvarChildren->vt = VT_EMPTY;
 
+  if (IsDefunct())
+    return CO_E_OBJNOTCONNECTED;
+
   if (IsSelect()) {
     nsCOMPtr<nsIArray> selectedItems = SelectedItems();
     if (selectedItems) {
       // 1) Create and initialize the enumeration
       nsRefPtr<AccessibleEnumerator> pEnum =
         new AccessibleEnumerator(selectedItems);
 
       // 2) Put the enumerator in the VARIANT
@@ -689,39 +734,54 @@ STDMETHODIMP nsAccessibleWrap::get_accSe
 }
 
 STDMETHODIMP nsAccessibleWrap::get_accDefaultAction(
       /* [optional][in] */ VARIANT varChild,
       /* [retval][out] */ BSTR __RPC_FAR *pszDefaultAction)
 {
 __try {
   *pszDefaultAction = NULL;
-  nsAccessible *xpAccessible = GetXPAccessibleFor(varChild);
-  if (xpAccessible) {
-    nsAutoString defaultAction;
-    if (NS_FAILED(xpAccessible->GetActionName(0, defaultAction)))
-      return E_FAIL;
+
+  if (IsDefunct())
+    return CO_E_OBJNOTCONNECTED;
+
+  nsAccessible* xpAccessible = GetXPAccessibleFor(varChild);
+  if (!xpAccessible)
+    return E_INVALIDARG;
 
-    *pszDefaultAction = ::SysAllocStringLen(defaultAction.get(),
-                                            defaultAction.Length());
-    return *pszDefaultAction ? S_OK : E_OUTOFMEMORY;
-  }
+  if (xpAccessible->IsDefunct())
+    return CO_E_OBJNOTCONNECTED;
+
+  nsAutoString defaultAction;
+  if (NS_FAILED(xpAccessible->GetActionName(0, defaultAction)))
+    return E_FAIL;
+
+  *pszDefaultAction = ::SysAllocStringLen(defaultAction.get(),
+                                          defaultAction.Length());
+  return *pszDefaultAction ? S_OK : E_OUTOFMEMORY;
 
 } __except(FilterA11yExceptions(::GetExceptionCode(), GetExceptionInformation())) { }
   return E_FAIL;
 }
 
 STDMETHODIMP nsAccessibleWrap::accSelect(
       /* [in] */ long flagsSelect,
       /* [optional][in] */ VARIANT varChild)
 {
 __try {
+  if (IsDefunct())
+    return CO_E_OBJNOTCONNECTED;
+
   // currently only handle focus and selection
-  nsAccessible *xpAccessible = GetXPAccessibleFor(varChild);
-  NS_ENSURE_TRUE(xpAccessible, E_FAIL);
+  nsAccessible* xpAccessible = GetXPAccessibleFor(varChild);
+  if (!xpAccessible)
+    return E_INVALIDARG;
+
+  if (xpAccessible->IsDefunct())
+    return CO_E_OBJNOTCONNECTED;
 
   if (flagsSelect & (SELFLAG_TAKEFOCUS|SELFLAG_TAKESELECTION|SELFLAG_REMOVESELECTION))
   {
     if (flagsSelect & SELFLAG_TAKEFOCUS)
       xpAccessible->TakeFocus();
 
     if (flagsSelect & SELFLAG_TAKESELECTION)
       xpAccessible->TakeSelection();
@@ -745,46 +805,59 @@ STDMETHODIMP nsAccessibleWrap::accSelect
 STDMETHODIMP nsAccessibleWrap::accLocation(
       /* [out] */ long __RPC_FAR *pxLeft,
       /* [out] */ long __RPC_FAR *pyTop,
       /* [out] */ long __RPC_FAR *pcxWidth,
       /* [out] */ long __RPC_FAR *pcyHeight,
       /* [optional][in] */ VARIANT varChild)
 {
 __try {
-  nsAccessible *xpAccessible = GetXPAccessibleFor(varChild);
+  if (IsDefunct())
+    return CO_E_OBJNOTCONNECTED;
 
-  if (xpAccessible) {
-    PRInt32 x, y, width, height;
-    if (NS_FAILED(xpAccessible->GetBounds(&x, &y, &width, &height)))
-      return E_FAIL;
+  nsAccessible* xpAccessible = GetXPAccessibleFor(varChild);
+  if (!xpAccessible)
+    return E_INVALIDARG;
+
+  if (xpAccessible->IsDefunct())
+    return CO_E_OBJNOTCONNECTED;
 
-    *pxLeft = x;
-    *pyTop = y;
-    *pcxWidth = width;
-    *pcyHeight = height;
-    return S_OK;
-  }
+  PRInt32 x, y, width, height;
+  if (NS_FAILED(xpAccessible->GetBounds(&x, &y, &width, &height)))
+    return E_FAIL;
+
+  *pxLeft = x;
+  *pyTop = y;
+  *pcxWidth = width;
+  *pcyHeight = height;
+  return S_OK;
+
 } __except(FilterA11yExceptions(::GetExceptionCode(), GetExceptionInformation())) { }
 
   return E_FAIL;
 }
 
 STDMETHODIMP nsAccessibleWrap::accNavigate(
       /* [in] */ long navDir,
       /* [optional][in] */ VARIANT varStart,
       /* [retval][out] */ VARIANT __RPC_FAR *pvarEndUpAt)
 {
 __try {
   if (!pvarEndUpAt)
     return E_INVALIDARG;
 
+  if (IsDefunct())
+    return CO_E_OBJNOTCONNECTED;
+
   nsAccessible* accessible = GetXPAccessibleFor(varStart);
-  if (!accessible || accessible->IsDefunct())
-    return E_FAIL;
+  if (!accessible)
+    return E_INVALIDARG;
+
+  if (accessible->IsDefunct())
+    return CO_E_OBJNOTCONNECTED;
 
   VariantInit(pvarEndUpAt);
 
   nsAccessible* navAccessible = nsnull;
   PRUint32 xpRelation = 0;
 
   switch(navDir) {
     case NAVDIR_FIRSTCHILD:
@@ -879,18 +952,19 @@ STDMETHODIMP nsAccessibleWrap::accNaviga
 
 STDMETHODIMP nsAccessibleWrap::accHitTest(
       /* [in] */ long xLeft,
       /* [in] */ long yTop,
       /* [retval][out] */ VARIANT __RPC_FAR *pvarChild)
 {
 __try {
   VariantInit(pvarChild);
+
   if (IsDefunct())
-    return E_FAIL;
+    return CO_E_OBJNOTCONNECTED;
 
   nsAccessible* accessible = ChildAtPoint(xLeft, yTop, eDirectChild);
 
   // if we got a child
   if (accessible) {
     // if the child is us
     if (accessible == this) {
       pvarChild->vt = VT_I4;
@@ -908,22 +982,30 @@ STDMETHODIMP nsAccessibleWrap::accHitTes
 
   return S_OK;
 }
 
 STDMETHODIMP nsAccessibleWrap::accDoDefaultAction(
       /* [optional][in] */ VARIANT varChild)
 {
 __try {
-  nsAccessible *xpAccessible = GetXPAccessibleFor(varChild);
-  if (!xpAccessible || FAILED(xpAccessible->DoAction(0))) {
-    return E_FAIL;
-  }
+  if (IsDefunct())
+    return CO_E_OBJNOTCONNECTED;
+
+  nsAccessible* xpAccessible = GetXPAccessibleFor(varChild);
+  if (!xpAccessible)
+    return E_INVALIDARG;
+
+  if (xpAccessible->IsDefunct())
+    return CO_E_OBJNOTCONNECTED;
+
+  return GetHRESULT(xpAccessible->DoAction(0));
+
 } __except(nsAccessNodeWrap::FilterA11yExceptions(::GetExceptionCode(), GetExceptionInformation())) { }
-  return S_OK;
+  return E_FAIL;
 }
 
 STDMETHODIMP nsAccessibleWrap::put_accName(
       /* [optional][in] */ VARIANT varChild,
       /* [in] */ BSTR szName)
 {
   return E_NOTIMPL;
 }
@@ -1028,17 +1110,17 @@ nsAccessibleWrap::get_nRelations(long *a
 {
 __try {
   if (!aNRelations)
     return E_INVALIDARG;
 
   *aNRelations = 0;
 
   if (IsDefunct())
-    return E_FAIL;
+    return CO_E_OBJNOTCONNECTED;
 
   for (PRUint32 relType = nsIAccessibleRelation::RELATION_FIRST;
        relType <= nsIAccessibleRelation::RELATION_LAST; relType++) {
     Relation rel = RelationByType(relType);
     if (rel.Next())
       (*aNRelations)++;
   }
   return S_OK;
@@ -1052,17 +1134,17 @@ nsAccessibleWrap::get_relation(long aRel
 {
 __try {
   if (!aRelation)
     return E_INVALIDARG;
 
   *aRelation = NULL;
 
   if (IsDefunct())
-    return E_FAIL;
+    return CO_E_OBJNOTCONNECTED;
 
   PRUint32 relIdx = 0;
   for (PRUint32 relType = nsIAccessibleRelation::RELATION_FIRST;
        relType <= nsIAccessibleRelation::RELATION_LAST; relType++) {
     Relation rel = RelationByType(relType);
     nsRefPtr<ia2AccessibleRelation> ia2Relation =
       new ia2AccessibleRelation(relType, &rel);
     if (ia2Relation->HasTargets()) {
@@ -1087,17 +1169,17 @@ nsAccessibleWrap::get_relations(long aMa
 {
 __try {
   if (!aRelation || !aNRelations)
     return E_INVALIDARG;
 
   *aNRelations = 0;
 
   if (IsDefunct())
-    return E_FAIL;
+    return CO_E_OBJNOTCONNECTED;
 
   for (PRUint32 relType = nsIAccessibleRelation::RELATION_FIRST;
        relType <= nsIAccessibleRelation::RELATION_LAST &&
        *aNRelations < aMaxRelations; relType++) {
     Relation rel = RelationByType(relType);
     nsRefPtr<ia2AccessibleRelation> ia2Rel =
       new ia2AccessibleRelation(relType, &rel);
     if (ia2Rel->HasTargets()) {
@@ -1113,17 +1195,17 @@ nsAccessibleWrap::get_relations(long aMa
 
 STDMETHODIMP
 nsAccessibleWrap::role(long *aRole)
 {
 __try {
   *aRole = 0;
 
   if (IsDefunct())
-    return E_FAIL;
+    return CO_E_OBJNOTCONNECTED;
 
   NS_ASSERTION(gWindowsRoleMap[roles::LAST_ENTRY].ia2Role == ROLE_WINDOWS_LAST_ENTRY,
                "MSAA role map skewed");
 
   roles::Role role = Role();
   *aRole = gWindowsRoleMap[role].ia2Role;
 
   // Special case, if there is a ROLE_ROW inside of a ROLE_TREE_TABLE, then call
@@ -1139,28 +1221,34 @@ nsAccessibleWrap::role(long *aRole)
 } __except(nsAccessNodeWrap::FilterA11yExceptions(::GetExceptionCode(), GetExceptionInformation())) { }
   return E_FAIL;
 }
 
 STDMETHODIMP
 nsAccessibleWrap::scrollTo(enum IA2ScrollType aScrollType)
 {
 __try {
+  if (IsDefunct())
+    return CO_E_OBJNOTCONNECTED;
+
   nsAccessNode::ScrollTo(aScrollType);
   return S_OK;
 
 } __except(nsAccessNodeWrap::FilterA11yExceptions(::GetExceptionCode(), GetExceptionInformation())) { }
   return E_FAIL;
 }
 
 STDMETHODIMP
 nsAccessibleWrap::scrollToPoint(enum IA2CoordinateType aCoordType,
                                 long aX, long aY)
 {
 __try {
+  if (IsDefunct())
+      return CO_E_OBJNOTCONNECTED;
+
   PRUint32 geckoCoordType = (aCoordType == IA2_COORDTYPE_SCREEN_RELATIVE) ?
     nsIAccessibleCoordinateType::COORDTYPE_SCREEN_RELATIVE :
     nsIAccessibleCoordinateType::COORDTYPE_PARENT_RELATIVE;
 
   nsresult rv = ScrollToPoint(geckoCoordType, aX, aY);
   return GetHRESULT(rv);
 
 } __except(nsAccessNodeWrap::FilterA11yExceptions(::GetExceptionCode(), GetExceptionInformation())) { }
@@ -1168,16 +1256,19 @@ nsAccessibleWrap::scrollToPoint(enum IA2
 }
 
 STDMETHODIMP
 nsAccessibleWrap::get_groupPosition(long *aGroupLevel,
                                     long *aSimilarItemsInGroup,
                                     long *aPositionInGroup)
 {
 __try {
+  if (IsDefunct())
+    return CO_E_OBJNOTCONNECTED;
+
   PRInt32 groupLevel = 0;
   PRInt32 similarItemsInGroup = 0;
   PRInt32 positionInGroup = 0;
 
   nsresult rv = GroupPosition(&groupLevel, &similarItemsInGroup,
                               &positionInGroup);
   if (NS_FAILED(rv))
     return GetHRESULT(rv);
@@ -1199,16 +1290,19 @@ nsAccessibleWrap::get_groupPosition(long
 }
 
 STDMETHODIMP
 nsAccessibleWrap::get_states(AccessibleStates *aStates)
 {
 __try {
   *aStates = 0;
 
+  if (IsDefunct())
+    return CO_E_OBJNOTCONNECTED;
+
   // XXX: bug 344674 should come with better approach that we have here.
 
   PRUint64 state = State();
 
   if (state & states::INVALID)
     *aStates |= IA2_STATE_INVALID_ENTRY;
   if (state & states::REQUIRED)
     *aStates |= IA2_STATE_REQUIRED;
@@ -1321,17 +1415,17 @@ nsAccessibleWrap::get_uniqueID(long *uni
 
 STDMETHODIMP
 nsAccessibleWrap::get_windowHandle(HWND *aWindowHandle)
 {
 __try {
   *aWindowHandle = 0;
 
   if (IsDefunct())
-    return E_FAIL;
+    return CO_E_OBJNOTCONNECTED;
 
   *aWindowHandle = GetHWNDFor(this);
   return S_OK;
 
 } __except(nsAccessNodeWrap::FilterA11yExceptions(::GetExceptionCode(), GetExceptionInformation())) { }
   return E_FAIL;
 }
 
@@ -1339,17 +1433,17 @@ STDMETHODIMP
 nsAccessibleWrap::get_indexInParent(long *aIndexInParent)
 {
 __try {
   if (!aIndexInParent)
     return E_INVALIDARG;
 
   *aIndexInParent = -1;
   if (IsDefunct())
-    return E_FAIL;
+    return CO_E_OBJNOTCONNECTED;
 
   *aIndexInParent = IndexInParent();
   if (*aIndexInParent == -1)
     return S_FALSE;
 
   return S_OK;
 } __except(nsAccessNodeWrap::FilterA11yExceptions(::GetExceptionCode(), GetExceptionInformation())) { }
   return E_FAIL;
@@ -1359,16 +1453,19 @@ STDMETHODIMP
 nsAccessibleWrap::get_locale(IA2Locale *aLocale)
 {
 __try {
   // Language codes consist of a primary code and a possibly empty series of
   // subcodes: language-code = primary-code ( "-" subcode )*
   // Two-letter primary codes are reserved for [ISO639] language abbreviations.
   // Any two-letter subcode is understood to be a [ISO3166] country code.
 
+  if (IsDefunct())
+    return CO_E_OBJNOTCONNECTED;
+
   nsAutoString lang;
   Language(lang);
 
   // If primary code consists from two letters then expose it as language.
   PRInt32 offset = lang.FindChar('-', 0);
   if (offset == -1) {
     if (lang.Length() == 2) {
       aLocale->language = ::SysAllocString(lang.get());
@@ -1402,16 +1499,19 @@ nsAccessibleWrap::get_locale(IA2Locale *
 STDMETHODIMP
 nsAccessibleWrap::get_attributes(BSTR *aAttributes)
 {
   // The format is name:value;name:value; with \ for escaping these
   // characters ":;=,\".
 __try {
   *aAttributes = NULL;
 
+  if (IsDefunct())
+    return CO_E_OBJNOTCONNECTED;
+
   nsCOMPtr<nsIPersistentProperties> attributes;
   nsresult rv = GetAttributes(getter_AddRefs(attributes));
   if (NS_FAILED(rv))
     return GetHRESULT(rv);
 
   return ConvertToIA2Attributes(attributes, aAttributes);
 
 } __except(nsAccessNodeWrap::FilterA11yExceptions(::GetExceptionCode(), GetExceptionInformation())) { }
--- a/accessible/src/msaa/nsApplicationAccessibleWrap.cpp
+++ b/accessible/src/msaa/nsApplicationAccessibleWrap.cpp
@@ -97,16 +97,19 @@ nsApplicationAccessibleWrap::QueryInterf
 // IAccessibleApplication
 
 STDMETHODIMP
 nsApplicationAccessibleWrap::get_appName(BSTR *aName)
 {
 __try {
   *aName = NULL;
 
+  if (IsDefunct())
+    return CO_E_OBJNOTCONNECTED;
+
   nsAutoString name;
   nsresult rv = GetAppName(name);
   if (NS_FAILED(rv))
     return GetHRESULT(rv);
 
   if (name.IsEmpty())
     return S_FALSE;
 
@@ -118,16 +121,19 @@ nsApplicationAccessibleWrap::get_appName
 }
 
 STDMETHODIMP
 nsApplicationAccessibleWrap::get_appVersion(BSTR *aVersion)
 {
 __try {
   *aVersion = NULL;
 
+  if (IsDefunct())
+    return CO_E_OBJNOTCONNECTED;
+
   nsAutoString version;
   nsresult rv = GetAppVersion(version);
   if (NS_FAILED(rv))
     return GetHRESULT(rv);
 
   if (version.IsEmpty())
     return S_FALSE;
 
@@ -137,16 +143,19 @@ nsApplicationAccessibleWrap::get_appVers
 } __except(FilterA11yExceptions(::GetExceptionCode(), GetExceptionInformation())) { }
   return E_FAIL;
 }
 
 STDMETHODIMP
 nsApplicationAccessibleWrap::get_toolkitName(BSTR *aName)
 {
 __try {
+  if (IsDefunct())
+    return CO_E_OBJNOTCONNECTED;
+
   nsAutoString name;
   nsresult rv = GetPlatformName(name);
   if (NS_FAILED(rv))
     return GetHRESULT(rv);
 
   if (name.IsEmpty())
     return S_FALSE;
 
@@ -158,16 +167,19 @@ nsApplicationAccessibleWrap::get_toolkit
 }
 
 STDMETHODIMP
 nsApplicationAccessibleWrap::get_toolkitVersion(BSTR *aVersion)
 {
 __try {
   *aVersion = NULL;
 
+  if (IsDefunct())
+    return CO_E_OBJNOTCONNECTED;
+
   nsAutoString version;
   nsresult rv = GetPlatformVersion(version);
   if (NS_FAILED(rv))
     return GetHRESULT(rv);
 
   if (version.IsEmpty())
     return S_FALSE;
 
rename from accessible/src/other/nsARIAGridAccessibleWrap.h
rename to accessible/src/other/ARIAGridAccessibleWrap.h
--- a/accessible/src/other/nsARIAGridAccessibleWrap.h
+++ b/accessible/src/other/ARIAGridAccessibleWrap.h
@@ -33,18 +33,24 @@
  * use your version of this file under the terms of the MPL, indicate your
  * decision by deleting the provisions above and replace them with the notice
  * and other provisions required by the GPL or the LGPL. If you do not delete
  * the provisions above, a recipient may use your version of this file under
  * the terms of any one of the MPL, the GPL or the LGPL.
  *
  * ***** END LICENSE BLOCK ***** */
 
-#ifndef _NSARIAGRIDACCESSIBLEWRAP_H
-#define _NSARIAGRIDACCESSIBLEWRAP_H
+#ifndef MOZILLA_A11Y_ARIAGRIDACCESSIBLEWRAP_H
+#define MOZILLA_A11Y_ARIAGRIDACCESSIBLEWRAP_H
+
+#include "ARIAGridAccessible.h"
 
-#include "nsARIAGridAccessible.h"
+namespace mozilla {
+namespace a11y {
 
-typedef class nsARIAGridAccessible nsARIAGridAccessibleWrap;
-typedef class nsARIAGridCellAccessible nsARIAGridCellAccessibleWrap;
+typedef class ARIAGridAccessible ARIAGridAccessibleWrap;
+typedef class ARIAGridCellAccessible ARIAGridCellAccessibleWrap;
+
+} // namespace a11y
+} // namespace mozilla
 
 #endif
 
--- a/accessible/src/other/Makefile.in
+++ b/accessible/src/other/Makefile.in
@@ -49,18 +49,18 @@ LIBXUL_LIBRARY = 1
 
 CPPSRCS = \
   nsAccessNodeWrap.cpp \
   nsAccessibleWrap.cpp \
   nsRootAccessibleWrap.cpp \
   $(NULL)
 
 EXPORTS = \
+  ARIAGridAccessibleWrap.h \
   nsAccessNodeWrap.h \
-  nsARIAGridAccessibleWrap.h \
   nsTextAccessibleWrap.h \
   nsAccessibleWrap.h \
   nsDocAccessibleWrap.h \
   nsRootAccessibleWrap.h \
   nsXULMenuAccessibleWrap.h \
   nsXULListboxAccessibleWrap.h \
   nsXULTreeGridAccessibleWrap.h \
   nsHyperTextAccessibleWrap.h \
--- a/accessible/src/xforms/nsXFormsAccessible.cpp
+++ b/accessible/src/xforms/nsXFormsAccessible.cpp
@@ -140,26 +140,16 @@ nsXFormsAccessible::CacheSelectChildren(
       GetAccService()->GetOrCreateAccessible(child, mDoc);
     if (!accessible)
       continue;
 
     AppendChild(accessible);
   }
 }
 
-// nsIAccessible
-
-NS_IMETHODIMP
-nsXFormsAccessible::GetValue(nsAString& aValue)
-{
-  NS_ENSURE_TRUE(sXFormsService, NS_ERROR_FAILURE);
-  nsCOMPtr<nsIDOMNode> DOMNode(do_QueryInterface(mContent));
-  return sXFormsService->GetValue(DOMNode, aValue);
-}
-
 PRUint64
 nsXFormsAccessible::NativeState()
 {
   NS_ENSURE_TRUE(sXFormsService, 0);
 
   nsCOMPtr<nsIDOMNode> DOMNode(do_QueryInterface(mContent));
 
   bool isRelevant = false;
@@ -208,16 +198,23 @@ nsXFormsAccessible::Description(nsString
   nsTextEquivUtils::
     GetTextEquivFromIDRefs(this, nsGkAtoms::aria_describedby,
                            aDescription);
 
   if (aDescription.IsEmpty())
     GetBoundChildElementValue(NS_LITERAL_STRING("hint"), aDescription);
 }
 
+void
+nsXFormsAccessible::Value(nsString& aValue)
+{
+  nsCOMPtr<nsIDOMNode> DOMNode(do_QueryInterface(mContent));
+  sXFormsService->GetValue(DOMNode, aValue);
+}
+
 bool
 nsXFormsAccessible::CanHaveAnonChildren()
 {
   return false;
 }
 
 
 ////////////////////////////////////////////////////////////////////////////////
@@ -540,21 +537,21 @@ nsXFormsSelectableAccessible::GetItemByI
 
 nsXFormsSelectableItemAccessible::
   nsXFormsSelectableItemAccessible(nsIContent* aContent,
                                    nsDocAccessible* aDoc) :
   nsXFormsAccessible(aContent, aDoc)
 {
 }
 
-NS_IMETHODIMP
-nsXFormsSelectableItemAccessible::GetValue(nsAString& aValue)
+void
+nsXFormsSelectableItemAccessible::Value(nsString& aValue)
 {
   nsCOMPtr<nsIDOMNode> DOMNode(do_QueryInterface(mContent));
-  return sXFormsService->GetValue(DOMNode, aValue);
+  sXFormsService->GetValue(DOMNode, aValue);
 }
 
 PRUint8
 nsXFormsSelectableItemAccessible::ActionCount()
 {
   return 1;
 }
 
--- a/accessible/src/xforms/nsXFormsAccessible.h
+++ b/accessible/src/xforms/nsXFormsAccessible.h
@@ -67,25 +67,23 @@ protected:
  * class is base class for accessible objects for these XForms elements.
  */
 class nsXFormsAccessible : public nsHyperTextAccessibleWrap,
                            public nsXFormsAccessibleBase
 {
 public:
   nsXFormsAccessible(nsIContent* aContent, nsDocAccessible* aDoc);
 
-  // nsIAccessible
-
-  // Returns value of instance node that xforms element is bound to.
-  NS_IMETHOD GetValue(nsAString& aValue);
-
   // nsAccessible
   // Returns value of child xforms 'hint' element.
   virtual void Description(nsString& aDescription);
 
+  // Returns value of instance node that xforms element is bound to.
+  virtual void Value(nsString& aValue);
+
   // Returns value of child xforms 'label' element.
   virtual nsresult GetNameInternal(nsAString& aName);
 
   // Returns state of xforms element taking into account state of instance node
   // that it is bound to.
   virtual PRUint64 NativeState();
 
   // Denies accessible nodes in anonymous content of xforms element by
@@ -184,19 +182,21 @@ protected:
  * The class is base for accessible objects for XForms item elements.
  */
 class nsXFormsSelectableItemAccessible : public nsXFormsAccessible
 {
 public:
   nsXFormsSelectableItemAccessible(nsIContent* aContent,
                                    nsDocAccessible* aDoc);
 
-  NS_IMETHOD GetValue(nsAString& aValue);
   NS_IMETHOD DoAction(PRUint8 aIndex);
 
+  // nsAccessible
+  virtual void Value(nsString& aValue);
+
   // ActionAccessible
   virtual PRUint8 ActionCount();
 
 protected:
   bool IsSelected();
 };
 
 #endif
--- a/accessible/src/xforms/nsXFormsFormControlsAccessible.cpp
+++ b/accessible/src/xforms/nsXFormsFormControlsAccessible.cpp
@@ -104,21 +104,20 @@ nsXFormsTriggerAccessible::
 }
 
 role
 nsXFormsTriggerAccessible::NativeRole()
 {
   return roles::PUSHBUTTON;
 }
 
-NS_IMETHODIMP
-nsXFormsTriggerAccessible::GetValue(nsAString& aValue)
+void
+nsXFormsTriggerAccessible::Value(nsString& aValue)
 {
   aValue.Truncate();
-  return NS_OK;
 }
 
 PRUint8
 nsXFormsTriggerAccessible::ActionCount()
 {
   return 1;
 }
 
@@ -290,20 +289,20 @@ nsXFormsSecretAccessible::NativeRole()
 }
 
 PRUint64
 nsXFormsSecretAccessible::NativeState()
 {
   return nsXFormsInputAccessible::NativeState() | states::PROTECTED;
 }
 
-NS_IMETHODIMP
-nsXFormsSecretAccessible::GetValue(nsAString& aValue)
+void
+nsXFormsSecretAccessible::Value(nsString& aValue)
 {
-  return NS_ERROR_FAILURE;
+  aValue.Truncate();
 }
 
 
 ////////////////////////////////////////////////////////////////////////////////
 // nsXFormsRangeAccessible
 ////////////////////////////////////////////////////////////////////////////////
 
 nsXFormsRangeAccessible::
@@ -433,21 +432,20 @@ nsXFormsChoicesAccessible::
 }
 
 role
 nsXFormsChoicesAccessible::NativeRole()
 {
   return roles::GROUPING;
 }
 
-NS_IMETHODIMP
-nsXFormsChoicesAccessible::GetValue(nsAString& aValue)
+void
+nsXFormsChoicesAccessible::Value(nsString& aValue)
 {
   aValue.Truncate();
-  return NS_OK;
 }
 
 void
 nsXFormsChoicesAccessible::CacheChildren()
 {
   CacheSelectChildren();
 }
 
--- a/accessible/src/xforms/nsXFormsFormControlsAccessible.h
+++ b/accessible/src/xforms/nsXFormsFormControlsAccessible.h
@@ -74,22 +74,21 @@ public:
  */
 
 class nsXFormsTriggerAccessible : public nsXFormsAccessible
 {
 public:
   nsXFormsTriggerAccessible(nsIContent* aContent, nsDocAccessible* aDoc);
 
   // nsIAccessible
-  NS_IMETHOD GetValue(nsAString& aValue);
-
   NS_IMETHOD GetActionName(PRUint8 aIndex, nsAString& aName);
   NS_IMETHOD DoAction(PRUint8 aIndex);
 
   // nsAccessible
+  virtual void Value(nsString& aValue);
   virtual mozilla::a11y::role NativeRole();
 
   // ActionAccessible
   virtual PRUint8 ActionCount();
 };
 
 /**
  * Accessible object for xforms:input and xforms:textarea.
@@ -151,20 +150,18 @@ public:
  * Accessible object for xforms:secret.
  */
 
 class nsXFormsSecretAccessible : public nsXFormsInputAccessible
 {
 public:
   nsXFormsSecretAccessible(nsIContent* aContent, nsDocAccessible* aDoc);
 
-  // nsIAccessible
-  NS_IMETHOD GetValue(nsAString& aValue);
-
   // nsAccessible
+  virtual void Value(nsString& aValue);
   virtual mozilla::a11y::role NativeRole();
   virtual PRUint64 NativeState();
 };
 
 
 /**
  * Accessible object for xforms:range.
  */
@@ -206,19 +203,19 @@ public:
  */
 
 class nsXFormsChoicesAccessible : public nsXFormsAccessible
 {
 public:
   nsXFormsChoicesAccessible(nsIContent* aContent, nsDocAccessible* aDoc);
 
   // nsIAccessible
-  NS_IMETHOD GetValue(nsAString& aValue);
 
   // nsAccessible
+  virtual void Value(nsString& aValue);
   virtual mozilla::a11y::role NativeRole();
 
 protected:
   // nsAccessible
   virtual void CacheChildren();
 };
 
 
--- a/accessible/src/xforms/nsXFormsWidgetsAccessible.cpp
+++ b/accessible/src/xforms/nsXFormsWidgetsAccessible.cpp
@@ -157,37 +157,36 @@ nsXFormsComboboxPopupWidgetAccessible::N
   if (isOpen)
     state = states::FLOATING;
   else
     state = states::INVISIBLE;
 
   return state;
 }
 
-NS_IMETHODIMP
-nsXFormsComboboxPopupWidgetAccessible::GetValue(nsAString& aValue)
-{
-  aValue.Truncate();
-  return NS_OK;
-}
-
 nsresult
 nsXFormsComboboxPopupWidgetAccessible::GetNameInternal(nsAString& aName)
 {
   // Override nsXFormsAccessible::GetName() to prevent name calculation by
   // XForms rules.
   return NS_OK;
 }
 
 void
 nsXFormsComboboxPopupWidgetAccessible::Description(nsString& aDescription)
 {
   aDescription.Truncate();
 }
 
 void
+nsXFormsComboboxPopupWidgetAccessible::Value(nsString& aValue)
+{
+  aValue.Truncate();
+}
+
+void
 nsXFormsComboboxPopupWidgetAccessible::CacheChildren()
 {
   nsCOMPtr<nsIDOMNode> parent = do_QueryInterface(mContent->GetNodeParent());
   // Parent node must be an xforms:select1 element.
   CacheSelectChildren(parent);
 }
 
--- a/accessible/src/xforms/nsXFormsWidgetsAccessible.h
+++ b/accessible/src/xforms/nsXFormsWidgetsAccessible.h
@@ -86,21 +86,19 @@ public:
  * represented by combobox.
  */
 class nsXFormsComboboxPopupWidgetAccessible : public nsXFormsAccessible
 {
 public:
   nsXFormsComboboxPopupWidgetAccessible(nsIContent* aContent,
                                         nsDocAccessible* aDoc);
 
-  // nsIAccessible
-  NS_IMETHOD GetValue(nsAString& aValue);
-
   // nsAccessible
   virtual void Description(nsString& aDescription);
+  virtual void Value(nsString& aValue);
   virtual nsresult GetNameInternal(nsAString& aName);
   virtual mozilla::a11y::role NativeRole();
   virtual PRUint64 NativeState();
 
 protected:
   // nsAccessible
   virtual void CacheChildren();
 };
--- a/accessible/src/xul/nsXULColorPickerAccessible.cpp
+++ b/accessible/src/xul/nsXULColorPickerAccessible.cpp
@@ -58,26 +58,22 @@ nsXULColorPickerTileAccessible::
   nsXULColorPickerTileAccessible(nsIContent* aContent, nsDocAccessible* aDoc) :
   nsAccessibleWrap(aContent, aDoc)
 {
 }
 
 ////////////////////////////////////////////////////////////////////////////////
 // nsXULColorPickerTileAccessible: nsIAccessible
 
-NS_IMETHODIMP
-nsXULColorPickerTileAccessible::GetValue(nsAString& aValue)
+void
+nsXULColorPickerTileAccessible::Value(nsString& aValue)
 {
   aValue.Truncate();
 
-  if (IsDefunct())
-    return NS_ERROR_FAILURE;
-
   mContent->GetAttr(kNameSpaceID_None, nsGkAtoms::color, aValue);
-  return NS_OK;
 }
 
 ////////////////////////////////////////////////////////////////////////////////
 // nsXULColorPickerTileAccessible: nsAccessible
 
 role
 nsXULColorPickerTileAccessible::NativeRole()
 {
--- a/accessible/src/xul/nsXULColorPickerAccessible.h
+++ b/accessible/src/xul/nsXULColorPickerAccessible.h
@@ -45,20 +45,18 @@
  * Used for color button in colorpicker palette.
  */
 class nsXULColorPickerTileAccessible : public nsAccessibleWrap
 {
 public:
   nsXULColorPickerTileAccessible(nsIContent* aContent,
                                  nsDocAccessible* aDoc);
 
-  // nsIAccessible
-  NS_IMETHOD GetValue(nsAString& _retval);
-
   // nsAccessible
+  virtual void Value(nsString& aValue);
   virtual mozilla::a11y::role NativeRole();
   virtual PRUint64 NativeState();
 
   // Widgets
   virtual nsAccessible* ContainerWidget() const;
 };
 
 
--- a/accessible/src/xul/nsXULComboboxAccessible.cpp
+++ b/accessible/src/xul/nsXULComboboxAccessible.cpp
@@ -98,32 +98,16 @@ nsXULComboboxAccessible::NativeState()
     }
   }
 
   states |= states::HASPOPUP | states::FOCUSABLE;
 
   return states;
 }
 
-NS_IMETHODIMP
-nsXULComboboxAccessible::GetValue(nsAString& aValue)
-{
-  aValue.Truncate();
-
-  if (IsDefunct())
-    return NS_ERROR_FAILURE;
-
-  // The value is the option or text shown entered in the combobox.
-  nsCOMPtr<nsIDOMXULMenuListElement> menuList(do_QueryInterface(mContent));
-  if (menuList)
-    return menuList->GetLabel(aValue);
-
-  return NS_ERROR_FAILURE;
-}
-
 void
 nsXULComboboxAccessible::Description(nsString& aDescription)
 {
   aDescription.Truncate();
   // Use description of currently focused option
   nsCOMPtr<nsIDOMXULMenuListElement> menuListElm(do_QueryInterface(mContent));
   if (!menuListElm)
     return;
@@ -134,16 +118,27 @@ nsXULComboboxAccessible::Description(nsS
     do_QueryInterface(focusedOptionItem);
   if (focusedOptionContent && mDoc) {
     nsAccessible* focusedOptionAcc = mDoc->GetAccessible(focusedOptionContent);
     if (focusedOptionAcc)
       focusedOptionAcc->Description(aDescription);
   }
 }
 
+void
+nsXULComboboxAccessible::Value(nsString& aValue)
+{
+  aValue.Truncate();
+
+  // The value is the option or text shown entered in the combobox.
+  nsCOMPtr<nsIDOMXULMenuListElement> menuList(do_QueryInterface(mContent));
+  if (menuList)
+    menuList->GetLabel(aValue);
+}
+
 bool
 nsXULComboboxAccessible::CanHaveAnonChildren()
 {
   if (mContent->NodeInfo()->Equals(nsGkAtoms::textbox, kNameSpaceID_XUL) ||
       mContent->AttrValueIs(kNameSpaceID_None, nsGkAtoms::editable,
                             nsGkAtoms::_true, eIgnoreCase)) {
     // Both the XUL <textbox type="autocomplete"> and <menulist editable="true"> widgets
     // use nsXULComboboxAccessible. We need to walk the anonymous children for these
--- a/accessible/src/xul/nsXULComboboxAccessible.h
+++ b/accessible/src/xul/nsXULComboboxAccessible.h
@@ -48,22 +48,22 @@
 class nsXULComboboxAccessible : public nsAccessibleWrap
 {
 public:
   enum { eAction_Click = 0 };
 
   nsXULComboboxAccessible(nsIContent* aContent, nsDocAccessible* aDoc);
 
   // nsIAccessible
-  NS_IMETHOD GetValue(nsAString& aValue);
   NS_IMETHOD DoAction(PRUint8 aIndex);
   NS_IMETHOD GetActionName(PRUint8 aIndex, nsAString& aName);
 
   // nsAccessible
   virtual void Description(nsString& aDescription);
+  virtual void Value(nsString& aValue);
   virtual mozilla::a11y::role NativeRole();
   virtual PRUint64 NativeState();
   virtual bool CanHaveAnonChildren();
 
   // ActionAccessible
   virtual PRUint8 ActionCount();
 
   // Widgets
--- a/accessible/src/xul/nsXULFormControlAccessible.cpp
+++ b/accessible/src/xul/nsXULFormControlAccessible.cpp
@@ -723,35 +723,32 @@ nsXULTextFieldAccessible::
 {
 }
 
 NS_IMPL_ISUPPORTS_INHERITED3(nsXULTextFieldAccessible, nsAccessible, nsHyperTextAccessible, nsIAccessibleText, nsIAccessibleEditableText)
 
 ////////////////////////////////////////////////////////////////////////////////
 // nsXULTextFieldAccessible: nsIAccessible
 
-NS_IMETHODIMP nsXULTextFieldAccessible::GetValue(nsAString& aValue)
+void
+nsXULTextFieldAccessible::Value(nsString& aValue)
 {
-  if (IsDefunct())
-    return NS_ERROR_FAILURE;
-
-  PRUint64 state = NativeState();
-
-  if (state & states::PROTECTED)    // Don't return password text!
-    return NS_ERROR_FAILURE;
+  aValue.Truncate();
+  if (NativeRole() == roles::PASSWORD_TEXT) // Don't return password text!
+    return;
 
   nsCOMPtr<nsIDOMXULTextBoxElement> textBox(do_QueryInterface(mContent));
   if (textBox) {
-    return textBox->GetValue(aValue);
+    textBox->GetValue(aValue);
+    return;
   }
+
   nsCOMPtr<nsIDOMXULMenuListElement> menuList(do_QueryInterface(mContent));
-  if (menuList) {
-    return menuList->GetLabel(aValue);
-  }
-  return NS_ERROR_FAILURE;
+  if (menuList)
+    menuList->GetLabel(aValue);
 }
 
 void
 nsXULTextFieldAccessible::ApplyARIAState(PRUint64* aState)
 {
   nsHyperTextAccessibleWrap::ApplyARIAState(aState);
 
   aria::MapToState(aria::eARIAAutoComplete, mContent->AsElement(), aState);
--- a/accessible/src/xul/nsXULFormControlAccessible.h
+++ b/accessible/src/xul/nsXULFormControlAccessible.h
@@ -249,24 +249,24 @@ class nsXULTextFieldAccessible : public 
 public:
   enum { eAction_Click = 0 };
 
   nsXULTextFieldAccessible(nsIContent* aContent, nsDocAccessible* aDoc);
 
   NS_DECL_ISUPPORTS_INHERITED
 
   // nsIAccessible
-  NS_IMETHOD GetValue(nsAString& aValue);
   NS_IMETHOD GetActionName(PRUint8 aIndex, nsAString& aName);
   NS_IMETHOD DoAction(PRUint8 index);
 
   // nsHyperTextAccessible
   virtual already_AddRefed<nsIEditor> GetEditor() const;
 
   // nsAccessible
+  virtual void Value(nsString& aValue);
   virtual void ApplyARIAState(PRUint64* aState);
   virtual mozilla::a11y::role NativeRole();
   virtual PRUint64 NativeState();
   virtual bool CanHaveAnonChildren();
 
   // ActionAccessible
   virtual PRUint8 ActionCount();
 
--- a/accessible/src/xul/nsXULListboxAccessible.cpp
+++ b/accessible/src/xul/nsXULListboxAccessible.cpp
@@ -205,27 +205,28 @@ nsXULListboxAccessible::NativeState()
   }
 
   return states;
 }
 
 /**
   * Our value is the label of our ( first ) selected child.
   */
-NS_IMETHODIMP nsXULListboxAccessible::GetValue(nsAString& _retval)
+void
+nsXULListboxAccessible::Value(nsString& aValue)
 {
-  _retval.Truncate();
+  aValue.Truncate();
+
   nsCOMPtr<nsIDOMXULSelectControlElement> select(do_QueryInterface(mContent));
   if (select) {
     nsCOMPtr<nsIDOMXULSelectControlItemElement> selectedItem;
     select->GetSelectedItem(getter_AddRefs(selectedItem));
     if (selectedItem)
-      return selectedItem->GetLabel(_retval);
+      selectedItem->GetLabel(aValue);
   }
-  return NS_ERROR_FAILURE;
 }
 
 role
 nsXULListboxAccessible::NativeRole()
 {
   // A richlistbox is used with the new autocomplete URL bar, and has a parent
   // popup <panel>.
   nsCOMPtr<nsIDOMXULPopupElement> xulPopup =
--- a/accessible/src/xul/nsXULListboxAccessible.h
+++ b/accessible/src/xul/nsXULListboxAccessible.h
@@ -99,23 +99,21 @@ public:
   nsXULListboxAccessible(nsIContent* aContent, nsDocAccessible* aDoc);
   virtual ~nsXULListboxAccessible() {}
 
   NS_DECL_ISUPPORTS_INHERITED
 
   // nsIAccessibleTable
   NS_DECL_OR_FORWARD_NSIACCESSIBLETABLE_WITH_XPCACCESSIBLETABLE
 
-  // nsIAccessible
-  NS_IMETHOD GetValue(nsAString& aValue);
-
   // nsAccessNode
   virtual void Shutdown();
 
   // nsAccessible
+  virtual void Value(nsString& aValue);
   virtual mozilla::a11y::TableAccessible* AsTable() { return this; }
   virtual mozilla::a11y::role NativeRole();
   virtual PRUint64 NativeState();
 
   // Widgets
   virtual bool IsWidget() const;
   virtual bool IsActiveWidget() const;
   virtual bool AreItemsOperable() const;
--- a/accessible/src/xul/nsXULSliderAccessible.cpp
+++ b/accessible/src/xul/nsXULSliderAccessible.cpp
@@ -87,20 +87,20 @@ nsXULSliderAccessible::NativeState()
   if (FocusMgr()->IsFocused(this))
     states |= states::FOCUSED;
 
   return states;
 }
 
 // nsIAccessible
 
-NS_IMETHODIMP
-nsXULSliderAccessible::GetValue(nsAString& aValue)
+void
+nsXULSliderAccessible::Value(nsString& aValue)
 {
-  return GetSliderAttr(nsGkAtoms::curpos, aValue);
+  GetSliderAttr(nsGkAtoms::curpos, aValue);
 }
 
 PRUint8
 nsXULSliderAccessible::ActionCount()
 {
   return 1;
 }
 
--- a/accessible/src/xul/nsXULSliderAccessible.h
+++ b/accessible/src/xul/nsXULSliderAccessible.h
@@ -50,24 +50,24 @@ class nsXULSliderAccessible : public nsA
 {
 public:
   nsXULSliderAccessible(nsIContent* aContent, nsDocAccessible* aDoc);
 
   // nsISupports
   NS_DECL_ISUPPORTS_INHERITED
 
   // nsIAccessible
-  NS_IMETHOD GetValue(nsAString& aValue);
   NS_IMETHOD GetActionName(PRUint8 aIndex, nsAString& aName);
   NS_IMETHOD DoAction(PRUint8 aIndex);
 
   // nsIAccessibleValue
   NS_DECL_NSIACCESSIBLEVALUE
 
   // nsAccessible
+  virtual void Value(nsString& aValue);
   virtual mozilla::a11y::role NativeRole();
   virtual PRUint64 NativeState();
   virtual bool CanHaveAnonChildren();
 
   // ActionAccessible
   virtual PRUint8 ActionCount();
 
 protected:
--- a/accessible/src/xul/nsXULTabAccessible.cpp
+++ b/accessible/src/xul/nsXULTabAccessible.cpp
@@ -182,20 +182,20 @@ nsXULTabsAccessible::NativeRole()
 }
 
 PRUint8
 nsXULTabsAccessible::ActionCount()
 {
   return 0;
 }
 
-/** no value */
-NS_IMETHODIMP nsXULTabsAccessible::GetValue(nsAString& _retval)
+void
+nsXULTabsAccessible::Value(nsString& aValue)
 {
-  return NS_OK;
+  aValue.Truncate();
 }
 
 nsresult
 nsXULTabsAccessible::GetNameInternal(nsAString& aName)
 {
   // no name
   return NS_OK;
 }
--- a/accessible/src/xul/nsXULTabAccessible.h
+++ b/accessible/src/xul/nsXULTabAccessible.h
@@ -71,20 +71,18 @@ public:
 /**
  * A container of tab objects, xul:tabs element.
  */
 class nsXULTabsAccessible : public XULSelectControlAccessible
 {
 public:
   nsXULTabsAccessible(nsIContent* aContent, nsDocAccessible* aDoc);
 
-  // nsIAccessible
-  NS_IMETHOD GetValue(nsAString& _retval);
-
   // nsAccessible
+  virtual void Value(nsString& aValue);
   virtual nsresult GetNameInternal(nsAString& aName);
   virtual mozilla::a11y::role NativeRole();
 
   // ActionAccessible
   virtual PRUint8 ActionCount();
 };
 
 
--- a/accessible/src/xul/nsXULTextAccessible.cpp
+++ b/accessible/src/xul/nsXULTextAccessible.cpp
@@ -146,26 +146,22 @@ nsXULLinkAccessible::
 
 // Expose nsIAccessibleHyperLink unconditionally
 NS_IMPL_ISUPPORTS_INHERITED1(nsXULLinkAccessible, nsHyperTextAccessibleWrap,
                              nsIAccessibleHyperLink)
 
 ////////////////////////////////////////////////////////////////////////////////
 // nsXULLinkAccessible. nsIAccessible
 
-NS_IMETHODIMP
-nsXULLinkAccessible::GetValue(nsAString& aValue)
+void
+nsXULLinkAccessible::Value(nsString& aValue)
 {
   aValue.Truncate();
 
-  if (IsDefunct())
-    return NS_ERROR_FAILURE;
-
   mContent->GetAttr(kNameSpaceID_None, nsGkAtoms::href, aValue);
-  return NS_OK;
 }
 
 nsresult
 nsXULLinkAccessible::GetNameInternal(nsAString& aName)
 {
   mContent->GetAttr(kNameSpaceID_None, nsGkAtoms::value, aName);
   if (!aName.IsEmpty())
     return NS_OK;
--- a/accessible/src/xul/nsXULTextAccessible.h
+++ b/accessible/src/xul/nsXULTextAccessible.h
@@ -76,22 +76,21 @@ class nsXULLinkAccessible : public nsHyp
 {
 
 public:
   nsXULLinkAccessible(nsIContent* aContent, nsDocAccessible* aDoc);
 
   NS_DECL_ISUPPORTS_INHERITED
 
   // nsIAccessible
-  NS_IMETHOD GetValue(nsAString& aValue);
-
   NS_IMETHOD GetActionName(PRUint8 aIndex, nsAString& aName);
   NS_IMETHOD DoAction(PRUint8 aIndex);
 
   // nsAccessible
+  virtual void Value(nsString& aValue);
   virtual nsresult GetNameInternal(nsAString& aName);
   virtual mozilla::a11y::role NativeRole();
   virtual PRUint64 NativeState();
 
   // ActionAccessible
   virtual PRUint8 ActionCount();
 
   // HyperLinkAccessible
--- a/accessible/src/xul/nsXULTreeAccessible.cpp
+++ b/accessible/src/xul/nsXULTreeAccessible.cpp
@@ -138,46 +138,42 @@ nsXULTreeAccessible::NativeState()
   NS_ENSURE_SUCCESS(rv, state);
 
   if (!isSingle)
     state |= states::MULTISELECTABLE;
 
   return state;
 }
 
-NS_IMETHODIMP
-nsXULTreeAccessible::GetValue(nsAString& aValue)
+void
+nsXULTreeAccessible::Value(nsString& aValue)
 {
   // Return the value is the first selected child.
 
   aValue.Truncate();
 
-  if (IsDefunct() || !mTreeView)
-    return NS_ERROR_FAILURE;
-
   nsCOMPtr<nsITreeSelection> selection;
   mTreeView->GetSelection(getter_AddRefs(selection));
   if (!selection)
-    return NS_ERROR_FAILURE;
+    return;
 
   PRInt32 currentIndex;
   nsCOMPtr<nsIDOMElement> selectItem;
   selection->GetCurrentIndex(&currentIndex);
   if (currentIndex >= 0) {
     nsCOMPtr<nsITreeColumn> keyCol;
 
     nsCOMPtr<nsITreeColumns> cols;
     mTree->GetColumns(getter_AddRefs(cols));
     if (cols)
       cols->GetKeyColumn(getter_AddRefs(keyCol));
 
-    return mTreeView->GetCellText(currentIndex, keyCol, aValue);
+    mTreeView->GetCellText(currentIndex, keyCol, aValue);
   }
 
-  return NS_OK;
 }
 
 ////////////////////////////////////////////////////////////////////////////////
 // nsXULTreeAccessible: nsAccessNode implementation
 
 void
 nsXULTreeAccessible::Shutdown()
 {
--- a/accessible/src/xul/nsXULTreeAccessible.h
+++ b/accessible/src/xul/nsXULTreeAccessible.h
@@ -69,23 +69,21 @@ public:
 
   nsXULTreeAccessible(nsIContent* aContent, nsDocAccessible* aDoc);
 
   // nsISupports and cycle collection
   NS_DECL_ISUPPORTS_INHERITED
   NS_DECL_CYCLE_COLLECTION_CLASS_INHERITED(nsXULTreeAccessible,
                                            nsAccessible)
 
-  // nsIAccessible
-  NS_IMETHOD GetValue(nsAString& aValue);
-
   // nsAccessNode
   virtual void Shutdown();
 
   // nsAccessible
+  virtual void Value(nsString& aValue);
   virtual mozilla::a11y::role NativeRole();
   virtual PRUint64 NativeState();
   virtual nsAccessible* ChildAtPoint(PRInt32 aX, PRInt32 aY,
                                      EWhichChildAtPoint aWhichChild);
 
   virtual nsAccessible* GetChildAt(PRUint32 aIndex);
   virtual PRInt32 GetChildCount();
 
--- a/accessible/tests/mochitest/testTextboxes.js
+++ b/accessible/tests/mochitest/testTextboxes.js
@@ -1,21 +1,11 @@
 function testValue(aID, aAcc, aValue, aRole)
 {
-  if (aRole == ROLE_PASSWORD_TEXT) {
-    var value;
-    try {
-      value = aAcc.value;
-      do_throw("We do not want a value on " + aID + "!");
-    } catch(e) {
-      is(e.result, Components.results.NS_ERROR_FAILURE,
-         "Wrong return value for getValue on " + aID + "!");
-    }
-  } else
-    is(aAcc.value, aValue, "Wrong value for " + aID + "!");
+  is(aAcc.value, aValue, "Wrong value for " + aID + "!");
 }
 
 function testAction(aID, aAcc, aNumActions, aActionName, aActionDescription)
 {
   var numActions = aAcc.numActions;
   is(numActions, aNumActions, "Wrong number of actions for " + aID + "!");
 
   if (numActions != 0) {
--- a/b2g/installer/package-manifest.in
+++ b/b2g/installer/package-manifest.in
@@ -232,17 +232,19 @@
 @BINPATH@/components/necko.xpt
 @BINPATH@/components/loginmgr.xpt
 @BINPATH@/components/parentalcontrols.xpt
 @BINPATH@/components/places.xpt
 @BINPATH@/components/plugin.xpt
 @BINPATH@/components/pref.xpt
 @BINPATH@/components/prefetch.xpt
 @BINPATH@/components/profile.xpt
+#ifdef MOZ_ENABLE_PROFILER_SPS
 @BINPATH@/components/profiler.xpt
+#endif
 @BINPATH@/components/proxyObject.xpt
 @BINPATH@/components/rdf.xpt
 @BINPATH@/components/satchel.xpt
 @BINPATH@/components/saxparser.xpt
 @BINPATH@/components/sessionstore.xpt
 #ifdef MOZ_SERVICES_SYNC
 @BINPATH@/components/services-crypto.xpt
 #endif
deleted file mode 100644
--- a/browser/config/mozconfigs/macosx-lion-universal/nightly
+++ /dev/null
@@ -1,25 +0,0 @@
-. $topsrcdir/build/macosx/universal/mozconfig
-
-# Universal builds override the default of browser (bug 575283 comment 29)
-ac_add_options --enable-application=browser
-
-ac_add_options --enable-update-channel=${MOZ_UPDATE_CHANNEL}
-ac_add_options --enable-update-packaging
-ac_add_options --enable-codesighs
-ac_add_options --disable-install-strip
-ac_add_options --enable-signmar
-
-# Nightlies only since this has a cost in performance
-ac_add_options --enable-js-diagnostics
-
-# Needed to enable breakpad in application.ini
-export MOZILLA_OFFICIAL=1
-
-export MOZ_TELEMETRY_REPORTING=1
-mk_add_options MOZ_MAKE_FLAGS="-j12"
-
-ac_add_options --with-macbundlename-prefix=Firefox
-
-# Treat warnings as errors in directories with FAIL_ON_WARNINGS.
-ac_add_options --enable-warnings-as-errors
-ac_add_options --with-ccache
deleted file mode 100644
--- a/browser/config/mozconfigs/macosx-lion-universal/release
+++ /dev/null
@@ -1,20 +0,0 @@
-. $topsrcdir/build/macosx/universal/mozconfig
-
-# Universal builds override the default of browser (bug 575283 comment 29)
-ac_add_options --enable-application=browser
-
-ac_add_options --enable-update-channel=${MOZ_UPDATE_CHANNEL}
-ac_add_options --enable-update-packaging
-ac_add_options --enable-official-branding
-
-# Needed to enable breakpad in application.ini
-export MOZILLA_OFFICIAL=1
-
-export MOZ_TELEMETRY_REPORTING=1
-
-# Treat warnings as errors in directories with FAIL_ON_WARNINGS.
-ac_add_options --enable-warnings-as-errors
-
-# Enable parallel compiling
-mk_add_options MOZ_MAKE_FLAGS="-j4"
-ac_add_options --with-ccache
deleted file mode 100644
--- a/browser/config/mozconfigs/macosx-lion-universal/shark
+++ /dev/null
@@ -1,26 +0,0 @@
-# Just like nightlies, but without tests, not on an update channel, and with
-# shark and dtrace enabled
-. $topsrcdir/build/macosx/universal/mozconfig
-
-# Universal builds override the default of browser (bug 575283 comment 29)
-ac_add_options --enable-application=browser
-
-ac_add_options --disable-tests
-ac_add_options --disable-install-strip
-
-# Needed to enable breakpad in application.ini
-export MOZILLA_OFFICIAL=1
-
-# Enable parallel compiling
-mk_add_options MOZ_MAKE_FLAGS="-j12"
-
-# shark specific options
-ac_add_options --enable-shark
-ac_add_options --enable-dtrace
-
-# Need this to prevent name conflicts with the normal nightly build packages
-export MOZ_PKG_SPECIAL="shark"
-
-# Treat warnings as errors in directories with FAIL_ON_WARNINGS.
-ac_add_options --enable-warnings-as-errors
-ac_add_options --with-ccache
--- a/browser/config/mozconfigs/macosx-universal/nightly
+++ b/browser/config/mozconfigs/macosx-universal/nightly
@@ -11,17 +11,18 @@ ac_add_options --enable-signmar
 
 # Nightlies only since this has a cost in performance
 ac_add_options --enable-js-diagnostics
 
 # Needed to enable breakpad in application.ini
 export MOZILLA_OFFICIAL=1
 
 export MOZ_TELEMETRY_REPORTING=1
-mk_add_options MOZ_MAKE_FLAGS="-j4"
+mk_add_options MOZ_MAKE_FLAGS="-j12"
 
 ac_add_options --with-macbundlename-prefix=Firefox
 
 # Treat warnings as errors in directories with FAIL_ON_WARNINGS.
 ac_add_options --enable-warnings-as-errors
+ac_add_options --with-ccache
 
 # Package js shell.
 export MOZ_PACKAGE_JSSHELL=1
--- a/browser/config/mozconfigs/macosx-universal/shark
+++ b/browser/config/mozconfigs/macosx-universal/shark
@@ -7,19 +7,20 @@ ac_add_options --enable-application=brow
 
 ac_add_options --disable-tests
 ac_add_options --disable-install-strip
 
 # Needed to enable breakpad in application.ini
 export MOZILLA_OFFICIAL=1
 
 # Enable parallel compiling
-mk_add_options MOZ_MAKE_FLAGS="-j4"
+mk_add_options MOZ_MAKE_FLAGS="-j12"
 
 # shark specific options
 ac_add_options --enable-shark
 ac_add_options --enable-dtrace
 
 # Need this to prevent name conflicts with the normal nightly build packages
 export MOZ_PKG_SPECIAL="shark"
 
 # Treat warnings as errors in directories with FAIL_ON_WARNINGS.
 ac_add_options --enable-warnings-as-errors
+ac_add_options --with-ccache
deleted file mode 100644
--- a/browser/config/mozconfigs/macosx32-lion/debug
+++ /dev/null
@@ -1,13 +0,0 @@
-. $topsrcdir/build/macosx/mozconfig.leopard
-ac_add_options --enable-debug
-ac_add_options --enable-trace-malloc
-ac_add_options --enable-signmar
-
-# Enable parallel compiling
-mk_add_options MOZ_MAKE_FLAGS="-j12"
-
-# Needed to enable breakpad in application.ini
-export MOZILLA_OFFICIAL=1
-
-ac_add_options --with-macbundlename-prefix=Firefox
-ac_add_options --with-ccache
--- a/browser/config/mozconfigs/macosx32/debug
+++ b/browser/config/mozconfigs/macosx32/debug
@@ -1,15 +1,16 @@
 . $topsrcdir/build/macosx/mozconfig.leopard
 ac_add_options --enable-debug
 ac_add_options --enable-trace-malloc
 ac_add_options --enable-signmar
 
 # Enable parallel compiling
-mk_add_options MOZ_MAKE_FLAGS="-j4"
+mk_add_options MOZ_MAKE_FLAGS="-j12"
 
 # Needed to enable breakpad in application.ini
 export MOZILLA_OFFICIAL=1
 
 ac_add_options --with-macbundlename-prefix=Firefox
+ac_add_options --with-ccache
 
 # Package js shell.
 export MOZ_PACKAGE_JSSHELL=1
deleted file mode 100644
--- a/browser/config/mozconfigs/macosx64-lion/debug
+++ /dev/null
@@ -1,18 +0,0 @@
-. $topsrcdir/build/macosx/common
-
-ac_add_options --enable-debug
-ac_add_options --enable-trace-malloc
-ac_add_options --enable-accessibility
-ac_add_options --enable-signmar
-
-# Enable parallel compiling
-mk_add_options MOZ_MAKE_FLAGS="-j12"
-
-# Needed to enable breakpad in application.ini
-export MOZILLA_OFFICIAL=1
-
-ac_add_options --with-macbundlename-prefix=Firefox
-
-# Treat warnings as errors in directories with FAIL_ON_WARNINGS.
-ac_add_options --enable-warnings-as-errors
-ac_add_options --with-ccache
deleted file mode 100644
--- a/browser/config/mozconfigs/macosx64-lion/l10n-mozconfig
+++ /dev/null
@@ -1,5 +0,0 @@
-ac_add_options --with-l10n-base=../../l10n-central
-ac_add_options --enable-official-branding
-ac_add_options --enable-update-channel=${MOZ_UPDATE_CHANNEL}
-ac_add_options --enable-update-packaging
-ac_add_options --with-ccache
--- a/browser/config/mozconfigs/macosx64/debug
+++ b/browser/config/mozconfigs/macosx64/debug
@@ -1,20 +1,21 @@
 . $topsrcdir/build/macosx/common
 
 ac_add_options --enable-debug
 ac_add_options --enable-trace-malloc
 ac_add_options --enable-accessibility
 ac_add_options --enable-signmar
 
 # Enable parallel compiling
-mk_add_options MOZ_MAKE_FLAGS="-j4"
+mk_add_options MOZ_MAKE_FLAGS="-j12"
 
 # Needed to enable breakpad in application.ini
 export MOZILLA_OFFICIAL=1
 
 ac_add_options --with-macbundlename-prefix=Firefox
 
 # Treat warnings as errors in directories with FAIL_ON_WARNINGS.
 ac_add_options --enable-warnings-as-errors
+ac_add_options --with-ccache
 
 # Package js shell.
 export MOZ_PACKAGE_JSSHELL=1
--- a/browser/config/mozconfigs/macosx64/l10n-mozconfig
+++ b/browser/config/mozconfigs/macosx64/l10n-mozconfig
@@ -1,4 +1,5 @@
 ac_add_options --with-l10n-base=../../l10n-central
 ac_add_options --enable-official-branding
 ac_add_options --enable-update-channel=${MOZ_UPDATE_CHANNEL}
 ac_add_options --enable-update-packaging
+ac_add_options --with-ccache
--- a/browser/installer/package-manifest.in
+++ b/browser/installer/package-manifest.in
@@ -237,17 +237,19 @@
 @BINPATH@/components/necko.xpt
 @BINPATH@/components/loginmgr.xpt
 @BINPATH@/components/parentalcontrols.xpt
 @BINPATH@/components/places.xpt
 @BINPATH@/components/plugin.xpt
 @BINPATH@/components/pref.xpt
 @BINPATH@/components/prefetch.xpt
 @BINPATH@/components/profile.xpt
+#ifdef MOZ_ENABLE_PROFILER_SPS
 @BINPATH@/components/profiler.xpt
+#endif
 @BINPATH@/components/rdf.xpt
 @BINPATH@/components/satchel.xpt
 @BINPATH@/components/saxparser.xpt
 @BINPATH@/components/sessionstore.xpt
 @BINPATH@/components/services-crypto-component.xpt
 @BINPATH@/components/shellservice.xpt
 @BINPATH@/components/shistory.xpt
 @BINPATH@/components/spellchecker.xpt
--- a/config/config.mk
+++ b/config/config.mk
@@ -400,21 +400,16 @@ MY_CONFIG	:= $(DEPTH)/config/myconfig.mk
 MY_RULES	:= $(DEPTH)/config/myrules.mk
 
 #
 # Default command macros; can be overridden in <arch>.mk.
 #
 CCC = $(CXX)
 PURIFY = purify $(PURIFYOPTIONS)
 QUANTIFY = quantify $(QUANTIFYOPTIONS)
-ifdef CROSS_COMPILE
-XPIDL_COMPILE = $(LIBXUL_DIST)/host/bin/host_xpidl$(HOST_BIN_SUFFIX)
-else
-XPIDL_COMPILE = $(LIBXUL_DIST)/bin/xpidl$(BIN_SUFFIX)
-endif
 XPIDL_LINK = $(PYTHON) $(LIBXUL_DIST)/sdk/bin/xpt.py link
 
 # Java macros
 JAVA_GEN_DIR  = _javagen
 JAVA_DIST_DIR = $(DEPTH)/$(JAVA_GEN_DIR)
 JAVA_IFACES_PKG_NAME = org/mozilla/interfaces
 
 INCLUDES = \
--- a/configure.in
+++ b/configure.in
@@ -7225,17 +7225,17 @@ AC_SUBST(DLLFLAGS)
 dnl We need to wrap dlopen and related functions on Android because we use
 dnl our own linker.
 if test "$OS_TARGET" = Android; then
     WRAP_LDFLAGS="${WRAP_LDFLAGS} -L$_objdir/dist/lib -lmozglue"
     if test -n "$MOZ_OLD_LINKER"; then
         WRAP_LDFLAGS="${WRAP_LDFLAGS} -Wl,--wrap=dlopen,--wrap=dlclose,--wrap=dlerror,--wrap=dlsym,--wrap=dladdr"
     fi
     WRAP_LDFLAGS="${WRAP_LDFLAGS} -Wl,--wrap=getaddrinfo,--wrap=freeaddrinfo,--wrap=gai_strerror"
-    WRAP_LDFLAGS="${WRAP_LDFLAGS} -Wl,--wrap=fork,--wrap=pthread_atfork"
+    WRAP_LDFLAGS="${WRAP_LDFLAGS} -Wl,--wrap=fork,--wrap=pthread_atfork,--wrap=raise"
 fi
 
 dnl ========================================================
 dnl = Use malloc wrapper lib
 dnl ========================================================
 MOZ_ARG_ENABLE_BOOL(wrap-malloc,
 [  --enable-wrap-malloc    Wrap malloc calls (gnu linker only)],
     _WRAP_MALLOC=1,
--- a/content/base/src/nsDOMMutationObserver.h
+++ b/content/base/src/nsDOMMutationObserver.h
@@ -147,17 +147,17 @@ protected:
     mRegisterTarget->AddMutationObserver(this);
     mRegisterTarget->SetMayHaveDOMMutationObserver();
     mRegisterTarget->OwnerDoc()->SetMayHaveDOMMutationObservers();
   }
 
   nsMutationReceiverBase(nsINode* aRegisterTarget,
                          nsMutationReceiverBase* aParent)
   : mTarget(nsnull), mObserver(nsnull), mParent(aParent),
-    mRegisterTarget(aRegisterTarget)
+    mRegisterTarget(aRegisterTarget), mKungFuDeathGrip(aParent->Target())
   {
     NS_ASSERTION(mParent->Subtree(), "Should clone a non-subtree observer!");
     mRegisterTarget->AddMutationObserver(this);
     mRegisterTarget->SetMayHaveDOMMutationObserver();
     mRegisterTarget->OwnerDoc()->SetMayHaveDOMMutationObservers();
   }
 
   bool ObservesAttr(mozilla::dom::Element* aElement,
@@ -190,16 +190,19 @@ protected:
   // The target for the MutationObserver.observe() method.
   nsINode*                           mTarget;
   nsIDOMMozMutationObserver*         mObserver;
   nsRefPtr<nsMutationReceiverBase>   mParent; // Cleared after microtask.
   // The node to which Gecko-internal nsIMutationObserver was registered to.
   // This is different than mTarget when dealing with transient observers.
   nsINode*                           mRegisterTarget;
   nsCOMArray<nsMutationReceiverBase> mTransientReceivers;
+  // While we have transient receivers, keep the original mutation receiver
+  // alive so it doesn't go away and disconnect all its transient receivers.
+  nsCOMPtr<nsINode>                  mKungFuDeathGrip;
   
 private:
   bool                               mSubtree;
   bool                               mChildList;
   bool                               mCharacterData;
   bool                               mCharacterDataOldValue;
   bool                               mAttributes;
   bool                               mAllAttributes;
--- a/content/base/src/nsRange.cpp
+++ b/content/base/src/nsRange.cpp
@@ -660,17 +660,17 @@ nsRange::ComparePoint(nsIDOMNode* aParen
   if (!nsContentUtils::ContentIsDescendantOf(parent, mRoot)) {
     return NS_ERROR_DOM_WRONG_DOCUMENT_ERR;
   }
   
   if (parent->NodeType() == nsIDOMNode::DOCUMENT_TYPE_NODE) {
     return NS_ERROR_DOM_INVALID_NODE_TYPE_ERR;
   }
 
-  if (aOffset < 0 || aOffset > parent->Length()) {
+  if (aOffset < 0 || PRUint32(aOffset) > parent->Length()) {
     return NS_ERROR_DOM_INDEX_SIZE_ERR;
   }
   
   PRInt32 cmp;
   if ((cmp = nsContentUtils::ComparePoints(parent, aOffset,
                                            mStartParent, mStartOffset)) <= 0) {
     
     *aResult = cmp;
@@ -924,17 +924,17 @@ nsRange::SetStart(nsIDOMNode* aParent, P
 }
 
 /* virtual */ nsresult
 nsRange::SetStart(nsINode* aParent, PRInt32 aOffset)
 {
   nsINode* newRoot = IsValidBoundary(aParent);
   NS_ENSURE_TRUE(newRoot, NS_ERROR_DOM_INVALID_NODE_TYPE_ERR);
 
-  if (aOffset < 0 || aOffset > aParent->Length()) {
+  if (aOffset < 0 || PRUint32(aOffset) > aParent->Length()) {
     return NS_ERROR_DOM_INDEX_SIZE_ERR;
   }
 
   // Collapse if not positioned yet, if positioned in another doc or
   // if the new start is after end.
   if (!mIsPositioned || newRoot != mRoot ||
       nsContentUtils::ComparePoints(aParent, aOffset,
                                     mEndParent, mEndOffset) == 1) {
@@ -988,17 +988,17 @@ nsRange::SetEnd(nsIDOMNode* aParent, PRI
 
 
 /* virtual */ nsresult
 nsRange::SetEnd(nsINode* aParent, PRInt32 aOffset)
 {
   nsINode* newRoot = IsValidBoundary(aParent);
   NS_ENSURE_TRUE(newRoot, NS_ERROR_DOM_INVALID_NODE_TYPE_ERR);
 
-  if (aOffset < 0 || aOffset > aParent->Length()) {
+  if (aOffset < 0 || PRUint32(aOffset) > aParent->Length()) {
     return NS_ERROR_DOM_INDEX_SIZE_ERR;
   }
 
   // Collapse if not positioned yet, if positioned in another doc or
   // if the new end is before start.
   if (!mIsPositioned || newRoot != mRoot ||
       nsContentUtils::ComparePoints(mStartParent, mStartOffset,
                                     aParent, aOffset) == 1) {
--- a/content/canvas/src/WebGLContext.h
+++ b/content/canvas/src/WebGLContext.h
@@ -1162,17 +1162,17 @@ public:
       }
     }
 
     PRInt32 FindMaxUshortElement() {
       if (mHasCachedMaxUshortElement) {
         return mCachedMaxUshortElement;
       } else {
         mHasCachedMaxUshortElement = true;
-        mCachedMaxUshortElement = FindMaxElementInSubArray<GLshort>(mByteLength>>1, 0);
+        mCachedMaxUshortElement = FindMaxElementInSubArray<GLushort>(mByteLength>>1, 0);
         return mCachedMaxUshortElement;
       }
     }
 
     NS_DECL_ISUPPORTS
     NS_DECL_NSIWEBGLBUFFER
 
 protected:
--- a/content/html/document/src/nsHTMLDocument.cpp
+++ b/content/html/document/src/nsHTMLDocument.cpp
@@ -555,52 +555,52 @@ nsHTMLDocument::StartDocumentLoad(const 
                                   nsIChannel* aChannel,
                                   nsILoadGroup* aLoadGroup,
                                   nsISupports* aContainer,
                                   nsIStreamListener **aDocListener,
                                   bool aReset,
                                   nsIContentSink* aSink)
 {
   if (!aCommand) {
-    MOZ_NOT_REACHED("Command is mandatory");
+    MOZ_ASSERT(false, "Command is mandatory");
     return NS_ERROR_INVALID_POINTER;
   }
   if (aSink) {
-    MOZ_NOT_REACHED("Got a sink override. Should not happen for HTML doc.");
+    MOZ_ASSERT(false, "Got a sink override. Should not happen for HTML doc.");
     return NS_ERROR_INVALID_ARG;
   }
   if (!mIsRegularHTML) {
-    MOZ_NOT_REACHED("Must not set HTML doc to XHTML mode before load start.");
+    MOZ_ASSERT(false, "Must not set HTML doc to XHTML mode before load start.");
     return NS_ERROR_DOM_INVALID_STATE_ERR;
   }
 
   nsCAutoString contentType;
   aChannel->GetContentType(contentType);
 
   bool view = !strcmp(aCommand, "view") ||
               !strcmp(aCommand, "external-resource");
   bool viewSource = !strcmp(aCommand, "view-source");
   bool asData = !strcmp(aCommand, kLoadAsData);
   if(!(view || viewSource || asData)) {
-    MOZ_NOT_REACHED("Bad parser command");
+    MOZ_ASSERT(false, "Bad parser command");
     return NS_ERROR_INVALID_ARG;
   }
 
   bool html = contentType.EqualsLiteral(TEXT_HTML);
   bool xhtml = !html && contentType.EqualsLiteral(APPLICATION_XHTML_XML);
   bool plainText = !html && !xhtml && (contentType.EqualsLiteral(TEXT_PLAIN) ||
     contentType.EqualsLiteral(TEXT_CSS) ||
     contentType.EqualsLiteral(APPLICATION_JAVASCRIPT) ||
     contentType.EqualsLiteral(APPLICATION_XJAVASCRIPT) ||
     contentType.EqualsLiteral(TEXT_ECMASCRIPT) ||
     contentType.EqualsLiteral(APPLICATION_ECMASCRIPT) ||
     contentType.EqualsLiteral(TEXT_JAVASCRIPT) ||
     contentType.EqualsLiteral(APPLICATION_JSON));
   if (!(html || xhtml || plainText || viewSource)) {
-    MOZ_NOT_REACHED("Channel with bad content type.");
+    MOZ_ASSERT(false, "Channel with bad content type.");
     return NS_ERROR_INVALID_ARG;
   }
 
   bool loadAsHtml5 = true;
 
   if (!viewSource && xhtml) {
       // We're parsing XHTML as XML, remember that.
       mIsRegularHTML = false;
--- a/dom/base/nsScreen.cpp
+++ b/dom/base/nsScreen.cpp
@@ -367,18 +367,25 @@ nsScreen::MozLockOrientation(const nsASt
   }
 
   if (!GetOwner()) {
     *aReturn = false;
     return NS_OK;
   }
 
   if (!IsChromeType(GetOwner()->GetDocShell())) {
+    nsCOMPtr<nsIDOMDocument> doc;
+    GetOwner()->GetDocument(getter_AddRefs(doc));
+    if (!doc) {
+      *aReturn = false;
+      return NS_OK;
+    }
+
     bool fullscreen;
-    GetOwner()->GetFullScreen(&fullscreen);
+    doc->GetMozFullScreen(&fullscreen);
     if (!fullscreen) {
       *aReturn = false;
       return NS_OK;
     }
 
     nsCOMPtr<nsIDOMEventTarget> target = do_QueryInterface(GetOwner());
     if (!target) {
       *aReturn = false;
--- a/dom/indexedDB/test/unit/test_keys.js
+++ b/dom/indexedDB/test/unit/test_keys.js
@@ -46,20 +46,20 @@ function testSteps()
     new Date(-1000),
     new Date(-10),
     new Date(-1),
     new Date(0),
     new Date(1),
     new Date(2),
     new Date(1000),
     new Date("1971-01-01"),
-    new Date("1971-01-01T01:01:01"),
-    new Date("1971-01-01T01:01:01.001"),
-    new Date("1971-01-01T01:01:01.01"),
-    new Date("1971-01-01T01:01:01.1"),
+    new Date("1971-01-01T01:01:01Z"),
+    new Date("1971-01-01T01:01:01.001Z"),
+    new Date("1971-01-01T01:01:01.01Z"),
+    new Date("1971-01-01T01:01:01.1Z"),
     new Date("1980-02-02"),
     new Date("3333-03-19T03:33:33.333"),
     "",
     "\x00",
     "\x00\x00",
     "\x00\x01",
     "\x01",
     "\x02",
--- a/dom/plugins/base/nsNPAPIPlugin.cpp
+++ b/dom/plugins/base/nsNPAPIPlugin.cpp
@@ -377,17 +377,16 @@ nsNPAPIPlugin::RunPluginOOP(const nsPlug
   nsCAutoString prefGroupKey("dom.ipc.plugins.enabled.ppc.");
 #endif
 #else
   nsCAutoString prefGroupKey("dom.ipc.plugins.enabled.");
 #endif
 
   // Java plugins include a number of different file names,
   // so use the mime type (mIsJavaPlugin) and a special pref.
-  bool javaIsEnabled;
   if (aPluginTag->mIsJavaPlugin &&
       !Preferences::GetBool("dom.ipc.plugins.java.enabled", true)) {
     return false;
   }
 
   PRUint32 prefCount;
   char** prefNames;
   nsresult rv = prefs->GetChildList(prefGroupKey.get(),
--- a/dom/plugins/base/nsPluginInstanceOwner.cpp
+++ b/dom/plugins/base/nsPluginInstanceOwner.cpp
@@ -1810,27 +1810,17 @@ void nsPluginInstanceOwner::RemovePlugin
 {
   if (!mInstance)
     return;
 
   void* surface = mInstance->GetJavaSurface();
   if (!surface)
     return;
 
-  JNIEnv* env = GetJNIForThread();
-  if (!env)
-    return;
-
-  AndroidBridge::AutoLocalJNIFrame frame(env, 1);
-
-  jclass cls = env->FindClass("org/mozilla/gecko/GeckoAppShell");
-  jmethodID method = env->GetStaticMethodID(cls,
-                                            "removePluginView",
-                                            "(Landroid/view/View;)V");
-  env->CallStaticVoidMethod(cls, method, surface);
+  AndroidBridge::RemovePluginView(surface);
 }
 
 void nsPluginInstanceOwner::Invalidate() {
   NPRect rect;
   rect.left = rect.top = 0;
   rect.right = mPluginWindow->width;
   rect.bottom = mPluginWindow->height;
   InvalidateRect(&rect);
--- a/editor/libeditor/html/nsHTMLEditor.cpp
+++ b/editor/libeditor/html/nsHTMLEditor.cpp
@@ -4299,27 +4299,27 @@ nsHTMLEditor::GetNextHTMLSibling(nsIDOMN
 //                   takes a parent/offset instead of a node.
 //                       
 nsresult
 nsHTMLEditor::GetNextHTMLSibling(nsIDOMNode *inParent, PRInt32 inOffset, nsCOMPtr<nsIDOMNode> *outNode)
 {
   NS_ENSURE_TRUE(outNode && inParent, NS_ERROR_NULL_POINTER);
   nsresult res = NS_OK;
   *outNode = nsnull;
-  nsCOMPtr<nsIDOMNode> node = nsEditor::GetChildAt(inParent,inOffset);
+  nsCOMPtr<nsIDOMNode> node = nsEditor::GetChildAt(inParent, inOffset + 1);
   if (!node) {
     // return null sibling if no sibling
     return NS_OK;
   }
   if (node && IsEditable(node)) {
     *outNode = node;
     return res;
   }
   // else
-  return GetPriorHTMLSibling(node, outNode);
+  return GetNextHTMLSibling(node, outNode);
 }
 
 
 
 ///////////////////////////////////////////////////////////////////////////
 // GetPriorHTMLNode: returns the previous editable leaf node, if there is
 //                   one within the <body>
 //
--- a/extensions/spellcheck/tests/chrome/test_add_remove_dictionaries.xul
+++ b/extensions/spellcheck/tests/chrome/test_add_remove_dictionaries.xul
@@ -7,17 +7,16 @@
   <title>Add and remove dictionaries test</title>
 
   <script type="application/javascript"
           src="chrome://mochikit/content/tests/SimpleTest/SimpleTest.js"/>
 
   <script type="application/javascript">
   <![CDATA[
 SimpleTest.waitForExplicitFinish();
-SimpleTest.ignoreAllUncaughtExceptions();
 
 function getMisspelledWords(editor) {
   return editor.selectionController.getSelection(Components.interfaces.nsISelectionController.SELECTION_SPELLCHECK).toString();
 }
 
 function getDictionaryList(editor) {
   var spellchecker = editor.getInlineSpellChecker(true).spellChecker;
   var o1 = {};
@@ -31,17 +30,19 @@ function getCurrentDictionary(editor) {
 }
 
 function setCurrentDictionary(editor, dictionary) {
   var spellchecker = editor.getInlineSpellChecker(true).spellChecker;
   spellchecker.SetCurrentDictionary(dictionary);
 }
 
 function RunTest() {
-  var editor = document.getElementById('textbox').editor;
+  var textbox = document.getElementById('textbox');
+  textbox.focus();
+  var editor = textbox.editor;
 
   var dir = Components.classes["@mozilla.org/file/directory_service;1"].
             getService(Components.interfaces.nsIProperties).
             get("CurWorkD", Components.interfaces.nsIFile);
   dir.append("chrome");
   dir.append("extensions");
   dir.append("spellcheck");
   dir.append("tests");
--- a/gfx/cairo/cairo/src/cairo-compiler-private.h
+++ b/gfx/cairo/cairo/src/cairo-compiler-private.h
@@ -229,16 +229,20 @@ ffs (int x)
 
     if (_BitScanForward(&i, x) != 0)
 	return i + 1;
 
     return 0;
 }
 #endif
 
+#elif defined(__WIN32__) && defined(__GNUC__)
+
+#define ffs(x) __builtin_ffs(x)
+
 #endif
 
 #if defined(_MSC_VER) && defined(_M_IX86)
 /* When compiling with /Gy and /OPT:ICF identical functions will be folded in together.
    The CAIRO_ENSURE_UNIQUE macro ensures that a function is always unique and
    will never be folded into another one. Something like this might eventually
    be needed for GCC but it seems fine for now. */
 #define CAIRO_ENSURE_UNIQUE                       \
new file mode 100644
--- /dev/null
+++ b/gfx/cairo/win32-ffs-gcc.patch
@@ -0,0 +1,25 @@
+diff --git a/gfx/cairo/cairo/src/cairo-compiler-private.h b/gfx/cairo/cairo/src/cairo-compiler-private.h
+index ffac9ce..9a05831 100644
+--- a/gfx/cairo/cairo/src/cairo-compiler-private.h
++++ b/gfx/cairo/cairo/src/cairo-compiler-private.h
+@@ -229,16 +229,20 @@ ffs (int x)
+ 
+     if (_BitScanForward(&i, x) != 0)
+ 	return i + 1;
+ 
+     return 0;
+ }
+ #endif
+ 
++#elif defined(__WIN32__) && defined(__GNUC__)
++
++#define ffs(x) __builtin_ffs(x)
++
+ #endif
+ 
+ #if defined(_MSC_VER) && defined(_M_IX86)
+ /* When compiling with /Gy and /OPT:ICF identical functions will be folded in together.
+    The CAIRO_ENSURE_UNIQUE macro ensures that a function is always unique and
+    will never be folded into another one. Something like this might eventually
+    be needed for GCC but it seems fine for now. */
+ #define CAIRO_ENSURE_UNIQUE                       \
--- a/gfx/gl/GLContextProviderCGL.mm
+++ b/gfx/gl/GLContextProviderCGL.mm
@@ -496,18 +496,16 @@ CreateOffscreenPBufferContext(const gfxI
     A_(aFormat.depth);
 
     A_(NSOpenGLPFAStencilSize);
     A_(aFormat.stencil);
 
     A_(0);
 #undef A_
 
-    printf_stderr("colorbits: %d alpha: %d depth: %d stencil: %d\n", aFormat.colorBits(), aFormat.alpha, aFormat.depth, aFormat.stencil);
-
     NSOpenGLPixelFormat *pbFormat = [[NSOpenGLPixelFormat alloc]
                                      initWithAttributes:attribs.Elements()];
     if (!pbFormat) {
         return nsnull;
     }
 
     // If we ask for any of these to be on/off and we get the opposite, we stop
     // creating a pbuffer and instead create an FBO.
@@ -547,17 +545,16 @@ CreateOffscreenPBufferContext(const gfxI
      setPixelBuffer:pb
      cubeMapFace:0
      mipMapLevel:0
      currentVirtualScreen:[context currentVirtualScreen]];
 
     {
         GLint l;
         [pbFormat getValues:&l forAttribute:NSOpenGLPFADepthSize forVirtualScreen:[context currentVirtualScreen]];
-        printf_stderr("*** depth: %d (req: %d)\n", l, aFormat.depth);
     }
 
     [pbFormat release];
 
     nsRefPtr<GLContextCGL> glContext = new GLContextCGL(aFormat, shareContext, context, pb);
 
     return glContext.forget();
 }
--- a/gfx/thebes/gfxFont.cpp
+++ b/gfx/thebes/gfxFont.cpp
@@ -1495,34 +1495,35 @@ struct GlyphBufferAzure {
 
         gfxContext::AzureState state = aThebesContext->CurrentState();
         if (aDrawMode & gfxFont::GLYPH_FILL) {
             if (state.pattern) {
                 Pattern *pat = state.pattern->GetPattern(aDT, state.patternTransformChanged ? &state.patternTransform : nsnull);
 
                 if (invFontMatrix) {
                     // The brush matrix needs to be multiplied with the inverted matrix
-	                // as well, to move the brush into the space of the glyphs. Before
-	                // the render target transformation
+                    // as well, to move the brush into the space of the glyphs. Before
+                    // the render target transformation
 
                     // This relies on the returned Pattern not to be reused by
                     // others, but regenerated on GetPattern calls. This is true!
-                    Matrix *mat;
+                    Matrix *mat = nsnull;
                     if (pat->GetType() == PATTERN_LINEAR_GRADIENT) {
                         mat = &static_cast<LinearGradientPattern*>(pat)->mMatrix;
                     } else if (pat->GetType() == PATTERN_RADIAL_GRADIENT) {
-                        mat = &static_cast<LinearGradientPattern*>(pat)->mMatrix;
+                        mat = &static_cast<RadialGradientPattern*>(pat)->mMatrix;
                     } else if (pat->GetType() == PATTERN_SURFACE) {
-                        mat = &static_cast<LinearGradientPattern*>(pat)->mMatrix;
+                        mat = &static_cast<SurfacePattern*>(pat)->mMatrix;
                     }
 
-                    *mat = (*mat) * (*invFontMatrix);
+                    if (mat) {
+                        *mat = (*mat) * (*invFontMatrix);
+                    }
                 }
 
-
                 aDT->FillGlyphs(aFont, buf, *pat,
                                 DrawOptions(), aOptions);
             } else if (state.sourceSurface) {
                 aDT->FillGlyphs(aFont, buf, SurfacePattern(state.sourceSurface,
                                                            EXTEND_CLAMP,
                                                            state.surfTransform),
                                 DrawOptions(), aOptions);
             } else {
--- a/gfx/thebes/gfxMacPlatformFontList.mm
+++ b/gfx/thebes/gfxMacPlatformFontList.mm
@@ -163,31 +163,31 @@ MacOSFontEntry::MacOSFontEntry(const nsA
 // ATSUI requires AAT-enabled fonts to render complex scripts correctly.
 // For now, simple clear out the cmap codepoints for fonts that have
 // codepoints for complex scripts. (Bug 361986)
 // Core Text is similar, but can render Arabic using OpenType fonts as well.
 
 enum eComplexScript {
     eComplexScriptArabic,
     eComplexScriptIndic,
-    eComplexScriptTibetan
+    eComplexScriptLaoTibetan
 };
 
 struct ScriptRange {
     eComplexScript   script;
     PRUint32         rangeStart;
     PRUint32         rangeEnd;
 };
 
 const ScriptRange gScriptsThatRequireShaping[] = {
     { eComplexScriptArabic, 0x0600, 0x077F },   // Basic Arabic, Syriac, Arabic Supplement
     { eComplexScriptIndic, 0x0900, 0x0D7F },     // Indic scripts - Devanagari, Bengali, ..., Malayalam
-    { eComplexScriptTibetan, 0x0F00, 0x0FFF }     // Tibetan
+    { eComplexScriptLaoTibetan, 0x0E80, 0x0FFF }     // Lao, Tibetan
     // Thai seems to be "renderable" without AAT morphing tables
-    // xxx - Lao, Khmer?
+    // xxx - Khmer?
 };
 
 nsresult
 MacOSFontEntry::ReadCMAP()
 {
     // attempt this once, if errors occur leave a blank cmap
     if (mCmapInitialized) {
         return NS_OK;
--- a/image/src/imgRequest.cpp
+++ b/image/src/imgRequest.cpp
@@ -682,21 +682,21 @@ NS_IMETHODIMP imgRequest::OnStopDecode(i
   nsTObserverArray<imgRequestProxy*>::ForwardIterator iter(mObservers);
   while (iter.HasMore()) {
     mImage->GetStatusTracker().SendStopDecode(iter.GetNext(), aStatus,
                                               aStatusArg);
   }
 
   if (NS_FAILED(aStatus)) {
     // Some kind of problem has happened with image decoding.
-    // Report the URI to net:failed-to-decode-uri observers.
+    // Report the URI to net:failed-to-process-uri-conent observers.
 
     nsCOMPtr<nsIObserverService> os = mozilla::services::GetObserverService();
     if (os)
-      os->NotifyObservers(mURI, "net:failed-to-process-uri", nsnull);
+      os->NotifyObservers(mURI, "net:failed-to-process-uri-content", nsnull);
   }
 
   // RasterImage and everything below it is completely correct and
   // bulletproof about its handling of decoder notifications.
   // Unfortunately, here and above we have to make some gross and
   // inappropriate use of things to get things to work without
   // completely overhauling the decoder observer interface (this will,
   // thankfully, happen in bug 505385). From imgRequest and above (for
--- a/image/test/mochitest/test_net_failedtoprocess.html
+++ b/image/test/mochitest/test_net_failedtoprocess.html
@@ -1,16 +1,16 @@
 <!DOCTYPE HTML>
 <html>
 <!--
-Test that a image decoding error producs a net:failed-to-process-uri
+Test that a image decoding error producs a net:failed-to-process-uri-content
 observer event with the nsIURI of the failed image as the subject
 -->
 <head>
-  <title>Test for image net:failed-to-process-uri</title>
+  <title>Test for image net:failed-to-process-uri-content</title>
   <script type="application/javascript" src="chrome://mochikit/content/MochiKit/packed.js"></script>
   <script type="application/javascript" src="chrome://mochikit/content/tests/SimpleTest/SimpleTest.js"></script>
   <link rel="stylesheet" type="text/css" href="chrome://mochikit/content/tests/SimpleTest/test.css" />
 </head>
 <body>
 <p id="display"></p>
 <pre id="test">
 <script type="application/javascript">
@@ -24,25 +24,25 @@ var observer = {
   QueryInterface: function (aIID) {
     if (aIID.equals(Ci.nsISupports) ||
         aIID.equals(Ci.nsIObserver))
       return this;
     throw Cr.NS_ERROR_NO_INTERFACE;
   },
 
   observe: function(subject, topic, data) {
-    ok(topic == "net:failed-to-process-uri", "wrong topic");
+    ok(topic == "net:failed-to-process-uri-content", "wrong topic");
     subject = subject.QueryInterface(Ci.nsIURI);
     ok(subject.asciiSpec == "chrome://mochitests/content/chrome/image/test/mochitest/invalid.jpg", "wrong subject");
     SimpleTest.finish();
   }
 };
 
 var obs = Cc["@mozilla.org/observer-service;1"].getService();
 obs = obs.QueryInterface(Ci.nsIObserverService);
-obs.addObserver(observer, "net:failed-to-process-uri", false);
+obs.addObserver(observer, "net:failed-to-process-uri-content", false);
 
 </script>
 </pre>
 <img src="damon.jpg">
 <img src="invalid.jpg">
 </body>
 </html>
--- a/js/public/HashTable.h
+++ b/js/public/HashTable.h
@@ -625,19 +625,17 @@ class HashTable : private AllocPolicy
             if (removedCount >= (capacity() >> 2)) {
                 METER(stats.compresses++);
                 deltaLog2 = 0;
             } else {
                 METER(stats.grows++);
                 deltaLog2 = 1;
             }
 
-            (void) changeTableSize(deltaLog2);
-
-            return true;
+            return changeTableSize(deltaLog2);
         }
 
         return false;
     }
 
     void remove(Entry &e)
     {
         METER(stats.removes++);
--- a/js/src/config/config.mk
+++ b/js/src/config/config.mk
@@ -400,21 +400,16 @@ MY_CONFIG	:= $(DEPTH)/config/myconfig.mk
 MY_RULES	:= $(DEPTH)/config/myrules.mk
 
 #
 # Default command macros; can be overridden in <arch>.mk.
 #
 CCC = $(CXX)
 PURIFY = purify $(PURIFYOPTIONS)
 QUANTIFY = quantify $(QUANTIFYOPTIONS)
-ifdef CROSS_COMPILE
-XPIDL_COMPILE = $(LIBXUL_DIST)/host/bin/host_xpidl$(HOST_BIN_SUFFIX)
-else
-XPIDL_COMPILE = $(LIBXUL_DIST)/bin/xpidl$(BIN_SUFFIX)
-endif
 XPIDL_LINK = $(PYTHON) $(LIBXUL_DIST)/sdk/bin/xpt.py link
 
 # Java macros
 JAVA_GEN_DIR  = _javagen
 JAVA_DIST_DIR = $(DEPTH)/$(JAVA_GEN_DIR)
 JAVA_IFACES_PKG_NAME = org/mozilla/interfaces
 
 INCLUDES = \
new file mode 100644
--- /dev/null
+++ b/js/src/jit-test/tests/basic/testBug723445.js
@@ -0,0 +1,10 @@
+var global = newGlobal('new-compartment');
+global.eval("function f(b) { if (b) { new Error }; }");
+
+function f(b) { global.f(b) }
+function g(b) { f(b) }
+function h() {
+    for (var i = 0; i < 1000; ++i)
+        g(i > 900);
+}
+h();
new file mode 100644
--- /dev/null
+++ b/js/src/jit-test/tests/debug/testEarlyReturnOnCall.js
@@ -0,0 +1,24 @@
+var g = newGlobal('new-compartment');
+g.eval("var success = false");
+g.eval("function ponies() {}");
+g.eval("function foo() { ponies(); success = false }");
+
+var dbg = new Debugger(g);
+dbg.onEnterFrame = function(frame) {
+    // The goal here is force an early return on the 'call' instruction,
+    // which should be the 3rd step (callgname, undefined, call)
+    var step = 0;
+    frame.onStep = function() {
+        ++step;
+        if (step == 2) {
+            g.success = true;
+            return;
+        }
+        if (step == 3)
+            return { return: undefined }
+    }
+    frame.onPop = function() { new Error(); /* boom */ }
+}
+
+g.foo();
+assertEq(g.success, true);
--- a/js/src/jsanalyze.cpp
+++ b/js/src/jsanalyze.cpp
@@ -183,28 +183,28 @@ ScriptAnalysis::analyzeBytecode(JSContex
      */
 
     PodZero(escapedSlots, numSlots);
 
     if (script->usesEval || script->mayNeedArgsObj() || script->compartment()->debugMode()) {
         for (unsigned i = 0; i < nargs; i++)
             escapedSlots[ArgSlot(i)] = true;
     } else {
-        for (uint32_t i = 0; i < script->nClosedArgs(); i++) {
+        for (uint32_t i = 0; i < script->numClosedArgs(); i++) {
             unsigned arg = script->getClosedArg(i);
             JS_ASSERT(arg < nargs);
             escapedSlots[ArgSlot(arg)] = true;
         }
     }
 
     if (script->usesEval || script->compartment()->debugMode()) {
         for (unsigned i = 0; i < script->nfixed; i++)
             escapedSlots[LocalSlot(script, i)] = true;
     } else {
-        for (uint32_t i = 0; i < script->nClosedVars(); i++) {
+        for (uint32_t i = 0; i < script->numClosedVars(); i++) {
             unsigned local = script->getClosedVar(i);
             JS_ASSERT(local < script->nfixed);
             escapedSlots[LocalSlot(script, local)] = true;
         }
     }
 
     /*
      * If the script is in debug mode, JS_SetFrameReturnValue can be called at
@@ -213,23 +213,23 @@ ScriptAnalysis::analyzeBytecode(JSContex
     if (cx->compartment->debugMode())
         usesReturnValue_ = true;
 
     bool heavyweight = script->function() && script->function()->isHeavyweight();
 
     isCompileable = true;
 
     isInlineable = true;
-    if (script->nClosedArgs() || script->nClosedVars() || heavyweight ||
+    if (script->numClosedArgs() || script->numClosedVars() || heavyweight ||
         script->usesEval || script->mayNeedArgsObj() || cx->compartment->debugMode()) {
         isInlineable = false;
     }
 
     modifiesArguments_ = false;
-    if (script->nClosedArgs() || heavyweight)
+    if (script->numClosedArgs() || heavyweight)
         modifiesArguments_ = true;
 
     canTrackVars = true;
 
     /*
      * If we are in the middle of one or more jumps, the offset of the highest
      * target jumping over this bytecode.  Includes implicit jumps from
      * try/catch/finally blocks.
--- a/js/src/jsapi.cpp
+++ b/js/src/jsapi.cpp
@@ -776,18 +776,16 @@ JSRuntime::JSRuntime()
     securityCallbacks(const_cast<JSSecurityCallbacks *>(&NullSecurityCallbacks)),
     destroyPrincipals(NULL),
     structuredCloneCallbacks(NULL),
     telemetryCallback(NULL),
     propertyRemovals(0),
     thousandsSeparator(0),
     decimalSeparator(0),
     numGrouping(0),
-    anynameObject(NULL),
-    functionNamespaceObject(NULL),
     waiveGCQuota(false),
     dtoaState(NULL),
     pendingProxyOperation(NULL),
     trustedPrincipals_(NULL),
     wrapObjectCallback(TransparentObjectWrapper),
     preWrapObjectCallback(NULL),
     preserveWrapperCallback(NULL),
 #ifdef DEBUG
--- a/js/src/jscntxt.h
+++ b/js/src/jscntxt.h
@@ -562,26 +562,16 @@ struct JSRuntime : js::RuntimeFriendFiel
     int32_t             propertyRemovals;
 
     /* Number localization, used by jsnum.c */
     const char          *thousandsSeparator;
     const char          *decimalSeparator;
     const char          *numGrouping;
 
     /*
-     * Weak references to lazily-created, well-known XML singletons.
-     *
-     * NB: Singleton objects must be carefully disconnected from the rest of
-     * the object graph usually associated with a JSContext's global object,
-     * including the set of standard class objects.  See jsxml.c for details.
-     */
-    JSObject            *anynameObject;
-    JSObject            *functionNamespaceObject;
-
-    /*
      * Flag indicating that we are waiving any soft limits on the GC heap
      * because we want allocations to be infallible (except when we hit OOM).
      */
     bool                waiveGCQuota;
 
     /*
      * The GSN cache is per thread since even multi-cx-per-thread embeddings
      * do not interleave js_GetSrcNote calls.
--- a/js/src/jsdate.cpp
+++ b/js/src/jsdate.cpp
@@ -1754,22 +1754,16 @@ date_makeTime(JSContext *cx, Native nati
 
     bool ok;
     JSObject *obj = NonGenericMethodGuard(cx, args, native, &DateClass, &ok);
     if (!obj)
         return ok;
 
     double result = obj->getDateUTCTime().toNumber();
 
-    /* just return NaN if the date is already NaN */
-    if (!JSDOUBLE_IS_FINITE(result)) {
-        args.rval().setNumber(result);
-        return true;
-    }
-
     /*
      * Satisfy the ECMA rule that if a function is called with
      * fewer arguments than the specified formal arguments, the
      * remaining arguments are set to undefined.  Seems like all
      * the Date.setWhatever functions in ECMA are only varargs
      * beyond the first argument; this should be set to undefined
      * if it's not given.  This means that "d = new Date();
      * d.setMilliseconds()" returns NaN.  Blech.
@@ -1777,24 +1771,40 @@ date_makeTime(JSContext *cx, Native nati
     if (args.length() == 0) {
         SetDateToNaN(cx, obj, &args.rval());
         return true;
     }
 
     unsigned numNums = Min(args.length(), maxargs);
     JS_ASSERT(numNums <= 4);
     double nums[4];
+    bool argIsNotFinite = false;
     for (unsigned i = 0; i < numNums; i++) {
         if (!ToNumber(cx, args[i], &nums[i]))
             return false;
         if (!JSDOUBLE_IS_FINITE(nums[i])) {
-            SetDateToNaN(cx, obj, &args.rval());
-            return true;
+            argIsNotFinite = true;
+        } else {
+            nums[i] = js_DoubleToInteger(nums[i]);
         }
-        nums[i] = js_DoubleToInteger(nums[i]);
+    }
+
+    /*
+     * Return NaN if the date is already NaN, but don't short-circuit argument
+     * evaluation.
+     */
+    if (!JSDOUBLE_IS_FINITE(result)) {
+        args.rval().setNumber(result);
+        return true;
+    }
+
+    /* set Date to NaN, after argument evaluation. */
+    if (argIsNotFinite) {
+        SetDateToNaN(cx, obj, &args.rval());
+        return true;
     }
 
     double lorutime;  /* Local or UTC version of *date */
     if (local)
         lorutime = LocalTime(result, cx);
     else
         lorutime = result;
 
@@ -1888,41 +1898,48 @@ date_makeDate(JSContext *cx, Native nati
 
     bool ok;
     JSObject *obj = NonGenericMethodGuard(cx, args, native, &DateClass, &ok);
     if (!obj)
         return ok;
 
     double result = obj->getDateUTCTime().toNumber();
 
-    /* see complaint about ECMA in date_MakeTime */
+    /* See complaint about ECMA in date_makeTime. */
     if (args.length() == 0) {
         SetDateToNaN(cx, obj, &args.rval());
         return true;
     }
 
     unsigned numNums = Min(args.length(), maxargs);
     JS_ASSERT(1 <= numNums && numNums <= 3);
     double nums[3];
+    bool argIsNotFinite = false;
     for (unsigned i = 0; i < numNums; i++) {
         if (!ToNumber(cx, args[i], &nums[i]))
             return JS_FALSE;
         if (!JSDOUBLE_IS_FINITE(nums[i])) {
-            SetDateToNaN(cx, obj, &args.rval());
-            return true;
+            argIsNotFinite = true;
+        } else {
+            nums[i] = js_DoubleToInteger(nums[i]);
         }
-        nums[i] = js_DoubleToInteger(nums[i]);
+    }
+
+    /* If we found a non-finite argument, set the date to NaN and return. */
+    if (argIsNotFinite) {
+        SetDateToNaN(cx, obj, &args.rval());
+        return true;
     }
 
     /*
-     * return NaN if date is NaN and we're not setting the year, If we are, use
-     * 0 as the time.
+     * Return NaN if date is NaN and we're not setting the year.  If we are,
+     * use 0 as the time.
      */
     double lorutime; /* local or UTC version of *date */
-    if (!(JSDOUBLE_IS_FINITE(result))) {
+    if (!JSDOUBLE_IS_FINITE(result)) {
         if (maxargs < 3) {
             args.rval().setDouble(result);
             return true;
         }
         lorutime = +0.;
     } else {
         lorutime = local ? LocalTime(result, cx) : result;
     }
--- a/js/src/jsinterp.cpp
+++ b/js/src/jsinterp.cpp
@@ -4129,16 +4129,18 @@ END_CASE(JSOP_ARRAYPUSH)
     } else {
         UnwindForUncatchableException(cx, regs);
         interpReturnOK = false;
     }
 
   forced_return:
     UnwindScope(cx, 0);
     regs.sp = regs.fp()->base();
+    regs.pc = script->code + script->length - JSOP_STOP_LENGTH;
+    JS_ASSERT(*regs.pc == JSOP_STOP);
 
     if (entryFrame != regs.fp())
         goto inline_return;
 
   exit:
     if (cx->compartment->debugMode())
         interpReturnOK = ScriptDebugEpilogue(cx, regs.fp(), interpReturnOK);
     interpReturnOK = ScriptEpilogueOrGeneratorYield(cx, regs.fp(), interpReturnOK);
--- a/js/src/jsscript.cpp
+++ b/js/src/jsscript.cpp
@@ -536,18 +536,18 @@ js::XDRScript(XDRState<mode> *xdr, JSScr
             nconsts = script->consts()->length;
         if (JSScript::isValidOffset(script->objectsOffset))
             nobjects = script->objects()->length;
         if (JSScript::isValidOffset(script->regexpsOffset))
             nregexps = script->regexps()->length;
         if (JSScript::isValidOffset(script->trynotesOffset))
             ntrynotes = script->trynotes()->length;
         /* no globals when encoding;  see assertion above */
-        nClosedArgs = script->nClosedArgs();
-        nClosedVars = script->nClosedVars();
+        nClosedArgs = script->numClosedArgs();
+        nClosedVars = script->numClosedVars();
 
         nTypeSets = script->nTypeSets;
 
         if (script->noScriptRval)
             scriptBits |= (1 << NoScriptRval);
         if (script->savedCallerFun)
             scriptBits |= (1 << SavedCallerFun);
         if (script->strictModeCode)
--- a/js/src/jsscript.h
+++ b/js/src/jsscript.h
@@ -343,16 +343,17 @@ static const uint32_t JS_SCRIPT_COOKIE =
 
 struct JSScript : public js::gc::Cell
 {
   private:
     static const uint32_t stepFlagMask = 0x80000000U;
     static const uint32_t stepCountMask = 0x7fffffffU;
 
   public:
+#ifdef JS_METHODJIT
     // This type wraps JITScript.  It has three possible states.
     // - "Empty": no compilation has been attempted and there is no JITScript.
     // - "Unjittable": compilation failed and there is no JITScript.
     // - "Valid": compilation succeeded and there is a JITScript.
     class JITScriptHandle
     {
         // CallCompiler must be a friend because it generates code that uses
         // UNJITTABLE.
@@ -384,16 +385,17 @@ struct JSScript : public js::gc::Cell
         void setUnjittable()    { value = const_cast<js::mjit::JITScript *>(UNJITTABLE); }
         void setValid(js::mjit::JITScript *jit) {
             value = jit;
             JS_ASSERT(isValid());
         }
 
         static void staticAsserts();
     };
+#endif  // JS_METHODJIT
 
     //
     // We order fields according to their size in order to avoid wasting space
     // for alignment.
     //
 
     // Larger-than-word-sized fields.
 
@@ -742,21 +744,21 @@ struct JSScript : public js::gc::Cell
         return reinterpret_cast<js::ClosedSlotArray *>(data + closedArgsOffset);
     }
 
     js::ClosedSlotArray *closedVars() {
         JS_ASSERT(isValidOffset(closedVarsOffset));
         return reinterpret_cast<js::ClosedSlotArray *>(data + closedVarsOffset);
     }
 
-    uint32_t nClosedArgs() {
+    uint32_t numClosedArgs() {
         return isValidOffset(closedArgsOffset) ? closedArgs()->length : 0;
     }
 
-    uint32_t nClosedVars() {
+    uint32_t numClosedVars() {
         return isValidOffset(closedVarsOffset) ? closedVars()->length : 0;
     }
 
     js::HeapPtrAtom &getAtom(size_t index) const {
         JS_ASSERT(index < natoms);
         return atoms[index];
     }
 
--- a/js/src/methodjit/MonoIC.cpp
+++ b/js/src/methodjit/MonoIC.cpp
@@ -954,26 +954,29 @@ class CallCompiler : public BaseCompiler
 
     void *update()
     {
         RecompilationMonitor monitor(cx);
 
         bool lowered = ic.frameSize.lowered(f.pc());
         JS_ASSERT_IF(lowered, !callingNew);
 
+        StackFrame *initialFp = f.fp();
+
         stubs::UncachedCallResult ucr;
         if (callingNew)
             stubs::UncachedNewHelper(f, ic.frameSize.staticArgc(), &ucr);
         else
             stubs::UncachedCallHelper(f, ic.frameSize.getArgc(f), lowered, &ucr);
 
         // Watch out in case the IC was invalidated by a recompilation on the calling
         // script. This can happen either if the callee is executed or if it compiles
-        // and the compilation has a static overflow.
-        if (monitor.recompiled())
+        // and the compilation has a static overflow. Also watch for cases where
+        // an exception is thrown and the callee frame hasn't unwound yet.
+        if (monitor.recompiled() || f.fp() != initialFp)
             return ucr.codeAddr;
 
         // If the function cannot be jitted (generally unjittable or empty script),
         // patch this site to go to a slow path always.
         if (!ucr.codeAddr) {
             if (ucr.unjittable)
                 disable();
             return NULL;
--- a/js/src/tests/ecma_5/Date/jstests.list
+++ b/js/src/tests/ecma_5/Date/jstests.list
@@ -1,6 +1,7 @@
 url-prefix ../../jsreftest.html?test=ecma_5/Date/
 script 15.9.4.2.js
 script defaultvalue.js
 script equality-to-boolean.js
 script toJSON-01.js
 script toISOString.js
+script setTime-argument-shortcircuiting.js
new file mode 100644
--- /dev/null
+++ b/js/src/tests/ecma_5/Date/setTime-argument-shortcircuiting.js
@@ -0,0 +1,147 @@
+// Any copyright is dedicated to the Public Domain.
+// http://creativecommons.org/licenses/publicdomain/
+
+//-----------------------------------------------------------------------------
+print("Test for correct short-circuiting implementation of Date.set methods");
+
+/**************
+ * BEGIN TEST *
+ **************/
+var global = 0;
+var date;
+
+/* Test that methods don't short circuit argument evaluation. */
+date = new Date(0).setSeconds(NaN, {valueOf:function(){global = 3}});
+assertEq(global, 3);
+
+date = new Date(0).setUTCSeconds(NaN, {valueOf:function(){global = 4}});
+assertEq(global, 4);
+
+date = new Date(0).setMinutes(NaN, {valueOf:function(){global = 5}});
+assertEq(global, 5);
+
+date = new Date(0).setUTCMinutes(NaN, {valueOf:function(){global = 6}});
+assertEq(global, 6);
+
+date = new Date(0).setHours(NaN, {valueOf:function(){global = 7}});
+assertEq(global, 7);
+
+date = new Date(0).setUTCHours(NaN, {valueOf:function(){global = 8}});
+assertEq(global, 8);
+
+date = new Date(0).setMonth(NaN, {valueOf:function(){global = 11}});
+assertEq(global, 11);
+
+date = new Date(0).setUTCMonth(NaN, {valueOf:function(){global = 12}});
+assertEq(global, 12);
+
+date = new Date(0).setFullYear(NaN, {valueOf:function(){global = 13}});
+assertEq(global, 13);
+
+date = new Date(0).setUTCFullYear(NaN, {valueOf:function(){global = 14}});
+assertEq(global, 14);
+
+
+
+/* Test that argument evaluation is not short circuited if Date == NaN */
+date = new Date(NaN).setMilliseconds({valueOf:function(){global = 15}});
+assertEq(global, 15);
+
+date = new Date(NaN).setUTCMilliseconds({valueOf:function(){global = 16}});
+assertEq(global, 16);
+
+date = new Date(NaN).setSeconds({valueOf:function(){global = 17}});
+assertEq(global, 17);
+
+date = new Date(NaN).setUTCSeconds({valueOf:function(){global = 18}});
+assertEq(global, 18);
+
+date = new Date(NaN).setMinutes({valueOf:function(){global = 19}});
+assertEq(global, 19);
+
+date = new Date(NaN).setUTCMinutes({valueOf:function(){global = 20}});
+assertEq(global, 20);
+
+date = new Date(NaN).setHours({valueOf:function(){global = 21}});
+assertEq(global, 21);
+
+date = new Date(NaN).setUTCHours({valueOf:function(){global = 22}});
+assertEq(global, 22);
+
+date = new Date(NaN).setDate({valueOf:function(){global = 23}});
+assertEq(global, 23);
+
+date = new Date(NaN).setUTCDate({valueOf:function(){global = 24}});
+assertEq(global, 24);
+
+date = new Date(NaN).setMonth({valueOf:function(){global = 25}});
+assertEq(global, 25);
+
+date = new Date(NaN).setUTCMonth({valueOf:function(){global = 26}});
+assertEq(global, 26);
+
+date = new Date(NaN).setFullYear({valueOf:function(){global = 27}});
+assertEq(global, 27);
+
+date = new Date(NaN).setUTCFullYear({valueOf:function(){global = 28}});
+assertEq(global, 28);
+
+
+/* Test the combination of the above two. */
+date = new Date(NaN).setSeconds(NaN, {valueOf:function(){global = 31}});
+assertEq(global, 31);
+
+date = new Date(NaN).setUTCSeconds(NaN, {valueOf:function(){global = 32}});
+assertEq(global, 32);
+
+date = new Date(NaN).setMinutes(NaN, {valueOf:function(){global = 33}});
+assertEq(global, 33);
+
+date = new Date(NaN).setUTCMinutes(NaN, {valueOf:function(){global = 34}});
+assertEq(global, 34);
+
+date = new Date(NaN).setHours(NaN, {valueOf:function(){global = 35}});
+assertEq(global, 35);
+
+date = new Date(NaN).setUTCHours(NaN, {valueOf:function(){global = 36}});
+assertEq(global, 36);
+
+date = new Date(NaN).setMonth(NaN, {valueOf:function(){global = 39}});
+assertEq(global, 39);
+
+date = new Date(NaN).setUTCMonth(NaN, {valueOf:function(){global = 40}});
+assertEq(global, 40);
+
+date = new Date(NaN).setFullYear(NaN, {valueOf:function(){global = 41}});
+assertEq(global, 41);
+
+date = new Date(NaN).setUTCFullYear(NaN, {valueOf:function(){global = 42}});
+assertEq(global, 42);
+
+
+/*Test two methods evaluation*/
+var secondGlobal = 0;
+
+date = new Date(NaN).setFullYear({valueOf:function(){global = 43}}, {valueOf:function(){secondGlobal = 1}});
+assertEq(global, 43);
+assertEq(secondGlobal, 1);
+
+date = new Date(0).setFullYear(NaN, {valueOf:function(){global = 44}}, {valueOf:function(){secondGlobal = 2}});
+assertEq(global, 44);
+assertEq(secondGlobal, 2);
+
+
+/* Test year methods*/
+date = new Date(0).setYear({valueOf:function(){global = 45}});
+assertEq(global, 45);
+
+date = new Date(NaN).setYear({valueOf:function(){global = 46}});
+assertEq(global, 46);
+
+
+/******************************************************************************/
+
+if (typeof reportCompare === "function")
+  reportCompare(true, true);
+
+print("Tests complete");
--- a/js/src/vm/ScopeObject.cpp
+++ b/js/src/vm/ScopeObject.cpp
@@ -94,27 +94,27 @@ js_PutCallObject(StackFrame *fp)
             } else {
                 /*
                  * For each arg & var that is closed over, copy it from the stack
                  * into the call object. We use initArg/VarUnchecked because,
                  * when you call a getter on a call object, js_NativeGetInline
                  * caches the return value in the slot, so we can't assert that
                  * it's undefined.
                  */
-                uint32_t nclosed = script->nClosedArgs();
+                uint32_t nclosed = script->numClosedArgs();
                 for (uint32_t i = 0; i < nclosed; i++) {
                     uint32_t e = script->getClosedArg(i);
 #ifdef JS_GC_ZEAL
                     callobj.setArg(e, fp->formalArg(e));
 #else
                     callobj.initArgUnchecked(e, fp->formalArg(e));
 #endif
                 }
 
-                nclosed = script->nClosedVars();
+                nclosed = script->numClosedVars();
                 for (uint32_t i = 0; i < nclosed; i++) {
                     uint32_t e = script->getClosedVar(i);
 #ifdef JS_GC_ZEAL
                     callobj.setVar(e, fp->slots()[e]);
 #else
                     callobj.initVarUnchecked(e, fp->slots()[e]);
 #endif
                 }
--- a/js/src/vm/Stack.cpp
+++ b/js/src/vm/Stack.cpp
@@ -1193,17 +1193,19 @@ StackIter::settleOnNewState()
     }
 }
 
 StackIter::StackIter(JSContext *cx, SavedOption savedOption)
   : cx_(cx),
     savedOption_(savedOption)
 {
 #ifdef JS_METHODJIT
-    mjit::ExpandInlineFrames(cx->compartment);
+    CompartmentVector &v = cx->runtime->compartments;
+    for (size_t i = 0; i < v.length(); i++)
+        mjit::ExpandInlineFrames(v[i]);
 #endif
 
     if (StackSegment *seg = cx->stack.seg_) {
         startOnSegment(seg);
         settleOnNewState();
     } else {
         state_ = DONE;
     }
--- a/layout/base/FrameLayerBuilder.cpp
+++ b/layout/base/FrameLayerBuilder.cpp
@@ -140,16 +140,23 @@ public:
                  ContainerLayer* aContainerLayer,
                  const FrameLayerBuilder::ContainerParameters& aParameters) :
     mBuilder(aBuilder), mManager(aManager),
     mContainerFrame(aContainerFrame), mContainerLayer(aContainerLayer),
     mParameters(aParameters),
     mNextFreeRecycledThebesLayer(0), mNextFreeRecycledColorLayer(0),
     mNextFreeRecycledImageLayer(0), mInvalidateAllThebesContent(false)
   {
+    nsPresContext* presContext = aContainerFrame->PresContext();
+    mAppUnitsPerDevPixel = presContext->AppUnitsPerDevPixel();
+    // When AllowResidualTranslation is false, display items will be drawn
+    // scaled with a translation by integer pixels, so we know how the snapping
+    // will work.
+    mSnappingEnabled = aManager->IsSnappingEffectiveTransforms() &&
+      !mParameters.AllowResidualTranslation();
     CollectOldLayers();
   }
 
   void SetInvalidThebesContent(const nsIntRegion& aRegion)
   {
     mInvalidThebesContent = aRegion;
   }
   void SetInvalidateAllThebesContent()
@@ -171,16 +178,40 @@ public:
    * layers as children of the container that aren't in mNewChildLayers.
    * @param aTextContentFlags if any child layer has CONTENT_COMPONENT_ALPHA,
    * set *aTextContentFlags to CONTENT_COMPONENT_ALPHA
    */
   void Finish(PRUint32 *aTextContentFlags);
 
   nsRect GetChildrenBounds() { return mBounds; }
 
+  nscoord GetAppUnitsPerDevPixel() { return mAppUnitsPerDevPixel; }
+
+  nsIntRect ScaleToNearestPixels(const nsRect& aRect)
+  {
+    return aRect.ScaleToNearestPixels(mParameters.mXScale, mParameters.mYScale,
+                                      mAppUnitsPerDevPixel);
+  }
+  nsIntRect ScaleToOutsidePixels(const nsRect& aRect, bool aSnap)
+  {
+    if (aSnap && mSnappingEnabled) {
+      return ScaleToNearestPixels(aRect);
+    }
+    return aRect.ScaleToOutsidePixels(mParameters.mXScale, mParameters.mYScale,
+                                      mAppUnitsPerDevPixel);
+  }
+  nsIntRect ScaleToInsidePixels(const nsRect& aRect, bool aSnap)
+  {
+    if (aSnap && mSnappingEnabled) {
+      return ScaleToNearestPixels(aRect);
+    }
+    return aRect.ScaleToInsidePixels(mParameters.mXScale, mParameters.mYScale,
+                                     mAppUnitsPerDevPixel);
+  }
+
 protected:
   /**
    * We keep a stack of these to represent the ThebesLayers that are
    * currently available to have display items added to.
    * We use a stack here because as much as possible we want to
    * assign display items to existing ThebesLayers, and to the lowest
    * ThebesLayer in z-order. This reduces the number of layers and
    * makes it more likely a display item will be rendered to an opaque
@@ -386,17 +417,19 @@ protected:
   typedef nsAutoTArray<nsRefPtr<Layer>,1> AutoLayersArray;
   AutoLayersArray                  mNewChildLayers;
   nsTArray<nsRefPtr<ThebesLayer> > mRecycledThebesLayers;
   nsTArray<nsRefPtr<ColorLayer> >  mRecycledColorLayers;
   nsTArray<nsRefPtr<ImageLayer> >  mRecycledImageLayers;
   PRUint32                         mNextFreeRecycledThebesLayer;
   PRUint32                         mNextFreeRecycledColorLayer;
   PRUint32                         mNextFreeRecycledImageLayer;
+  nscoord                          mAppUnitsPerDevPixel;
   bool                             mInvalidateAllThebesContent;
+  bool                             mSnappingEnabled;
 };
 
 class ThebesDisplayItemLayerUserData : public LayerUserData
 {
 public:
   ThebesDisplayItemLayerUserData() :
     mForcedBackgroundColor(NS_RGBA(0,0,0,0)),
     mXScale(1.f), mYScale(1.f),
@@ -846,21 +879,17 @@ ContainerState::CreateOrRecycleThebesLay
     if (!layer)
       return nsnull;
     // Mark this layer as being used for Thebes-painting display items
     data = new ThebesDisplayItemLayerUserData();
     layer->SetUserData(&gThebesDisplayItemLayerUserData, data);
   }
   data->mXScale = mParameters.mXScale;
   data->mYScale = mParameters.mYScale;
-  // If we're in a transformed subtree, but no ancestor transform is actively
-  // changing, we'll use the residual translation when drawing into the
-  // ThebesLayer to ensure that snapping exactly matches the ideal transform.
-  layer->SetAllowResidualTranslation(
-      mParameters.mInTransformedSubtree && !mParameters.mInActiveTransformedSubtree);
+  layer->SetAllowResidualTranslation(mParameters.AllowResidualTranslation());
 
   mBuilder->LayerBuilder()->SaveLastPaintOffset(layer);
 
   // Set up transform so that 0,0 in the Thebes layer corresponds to the
   // (pixel-snapped) top-left of the aActiveScrolledRoot.
   nsPoint offset = mBuilder->ToReferenceFrame(aActiveScrolledRoot);
   nscoord appUnitsPerDevPixel = aActiveScrolledRoot->PresContext()->AppUnitsPerDevPixel();
   gfxPoint scaledOffset(
@@ -955,20 +984,18 @@ ContainerState::FindOpaqueBackgroundColo
     intersection.And(candidate->mVisibleRegion, target->mVisibleRegion);
     if (intersection.IsEmpty()) {
       // The layer doesn't intersect our target, ignore it and move on
       continue;
     }
 
     // The candidate intersects our target. If any layer has a solid-color
     // area behind our target, this must be it. Scan its display items.
-    nsPresContext* presContext = mContainerFrame->PresContext();
-    nscoord appUnitsPerDevPixel = presContext->AppUnitsPerDevPixel();
     nsRect rect =
-      target->mVisibleRegion.GetBounds().ToAppUnits(appUnitsPerDevPixel);
+      target->mVisibleRegion.GetBounds().ToAppUnits(mAppUnitsPerDevPixel);
     rect.ScaleInverseRoundOut(mParameters.mXScale, mParameters.mYScale);
     return mBuilder->LayerBuilder()->
       FindOpaqueColorCovering(mBuilder, candidate->mLayer, rect);
   }
   return NS_RGBA(0,0,0,0);
 }
 
 already_AddRefed<ImageContainer>
@@ -1004,20 +1031,17 @@ ContainerState::PopThebesLayerData()
         // The layer's current transform is applied first, then the result is scaled.
         gfx3DMatrix transform = imageLayer->GetTransform()*
           gfx3DMatrix::ScalingMatrix(mParameters.mXScale, mParameters.mYScale, 1.0f);
         imageLayer->SetTransform(transform);
       }
       NS_ASSERTION(data->mImageClip.mRoundedClipRects.IsEmpty(),
                    "How did we get rounded clip rects here?");
       if (data->mImageClip.mHaveClipRect) {
-        nsPresContext* presContext = mContainerFrame->PresContext();
-        nscoord appUnitsPerDevPixel = presContext->AppUnitsPerDevPixel();
-        nsIntRect clip = data->mImageClip.mClipRect.ScaleToNearestPixels(
-            mParameters.mXScale, mParameters.mYScale, appUnitsPerDevPixel);
+        nsIntRect clip = ScaleToNearestPixels(data->mImageClip.mClipRect);
         imageLayer->IntersectClipRect(clip);
       }
       layer = imageLayer;
     } else {
       nsRefPtr<ColorLayer> colorLayer = CreateOrRecycleColorLayer();
       colorLayer->SetIsFixedPosition(data->mLayer->GetIsFixedPosition());
       colorLayer->SetColor(data->mSolidColor);
 
@@ -1173,20 +1197,27 @@ ContainerState::ThebesLayerData::Accumul
   } else {
     mImage = nsnull;
   }
 
   // Some display items have to exist (so they can set forceTransparentSurface
   // below) but don't draw anything. They'll return true for isUniform but
   // a color with opacity 0.
   if (!isUniform || NS_GET_A(uniformColor) > 0) {
-    if (isUniform &&
-        aItem->GetBounds(aState->mBuilder).ScaleToInsidePixels(
-            aState->mParameters.mXScale, aState->mParameters.mYScale,
-            AppUnitsPerDevPixel(aItem)).Contains(aVisibleRect)) {
+    // Make sure that the visible area is covered by uniform pixels. In
+    // particular this excludes cases where the edges of the item are not
+    // pixel-aligned (thus the item will not be truly uniform).
+    if (isUniform) {
+      bool snap;
+      nsRect bounds = aItem->GetBounds(aState->mBuilder, &snap);
+      if (!aState->ScaleToInsidePixels(bounds, snap).Contains(aVisibleRect)) {
+        isUniform = false;
+      }
+    }
+    if (isUniform) {
       if (mVisibleRegion.IsEmpty()) {
         // This color is all we have
         mSolidColor = uniformColor;
         mIsSolidColorInVisibleRegion = true;
       } else if (mIsSolidColorInVisibleRegion &&
                  mVisibleRegion.IsEqual(nsIntRegion(aVisibleRect))) {
         // we can just blend the colors together
         mSolidColor = NS_ComposeColors(mSolidColor, uniformColor);
@@ -1198,30 +1229,30 @@ ContainerState::ThebesLayerData::Accumul
     }
 
     mVisibleRegion.Or(mVisibleRegion, aVisibleRect);
     mVisibleRegion.SimplifyOutward(4);
     mDrawRegion.Or(mDrawRegion, aDrawRect);
     mDrawRegion.SimplifyOutward(4);
   }
   
-  bool forceTransparentSurface = false;
-  nsRegion opaque = aItem->GetOpaqueRegion(aState->mBuilder, &forceTransparentSurface);
+  bool forceTransparentSurface;
+  bool snap;
+  nsRegion opaque = aItem->GetOpaqueRegion(aState->mBuilder, &snap,
+                                           &forceTransparentSurface);
   if (!opaque.IsEmpty()) {
     nsRegionRectIterator iter(opaque);
-    nscoord appUnitsPerDevPixel = AppUnitsPerDevPixel(aItem);
     for (const nsRect* r = iter.Next(); r; r = iter.Next()) {
       // We don't use SimplifyInward here since it's not defined exactly
       // what it will discard. For our purposes the most important case
       // is a large opaque background at the bottom of z-order (e.g.,
       // a canvas background), so we need to make sure that the first rect
       // we see doesn't get discarded.
-      nsIntRect rect = aClip.ApproximateIntersect(*r).ScaleToInsidePixels(
-          aState->mParameters.mXScale, aState->mParameters.mYScale,
-          appUnitsPerDevPixel);
+      nsIntRect rect =
+        aState->ScaleToInsidePixels(aClip.ApproximateIntersect(*r), snap);
       nsIntRegion tmp;
       tmp.Or(mOpaqueRegion, rect);
        // Opaque display items in chrome documents whose window is partially
        // transparent are always added to the opaque region. This helps ensure
        // that we get as much subpixel-AA as possible in the chrome.
        if (tmp.GetNumRects() <= 4 ||
            (WindowHasTransparency(aState->mBuilder) &&
             aItem->GetUnderlyingFrame()->PresContext()->IsChrome())) {
@@ -1232,21 +1263,20 @@ ContainerState::ThebesLayerData::Accumul
   if (aState->mParameters.mDisableSubpixelAntialiasingInDescendants) {
     // Disable component alpha. This is cheaper than calling GetComponentAlphaBounds since for
     // most items this is a single virtual call that does nothing.
     // Note that the transform (if any) on the ThebesLayer is always an integer translation so
     // we don't have to factor that in here.
     aItem->DisableComponentAlpha();
   } else {
     nsRect componentAlpha = aItem->GetComponentAlphaBounds(aState->mBuilder);
-    componentAlpha.IntersectRect(componentAlpha, aItem->GetVisibleRect());
     if (!componentAlpha.IsEmpty()) {
-      nscoord appUnitsPerDevPixel = AppUnitsPerDevPixel(aItem);
-      if (!mOpaqueRegion.Contains(componentAlpha.ScaleToOutsidePixels(
-          aState->mParameters.mXScale, aState->mParameters.mYScale, appUnitsPerDevPixel))) {
+      nsIntRect componentAlphaRect =
+        aState->ScaleToOutsidePixels(componentAlpha, false).Intersect(aVisibleRect);
+      if (!mOpaqueRegion.Contains(componentAlphaRect)) {
         if (SuppressComponentAlpha(aState->mBuilder, aItem, componentAlpha)) {
           aItem->DisableComponentAlpha();
         } else {
           mNeedComponentAlpha = true;
         }
       }
     }
   }
@@ -1393,41 +1423,39 @@ PaintInactiveLayer(nsDisplayListBuilder*
  * We set the visible rect for all layers, although the actual setting
  * of visible rects for some ThebesLayers is deferred until the calling
  * of ContainerState::Finish.
  */
 void
 ContainerState::ProcessDisplayItems(const nsDisplayList& aList,
                                     FrameLayerBuilder::Clip& aClip)
 {
-  PRInt32 appUnitsPerDevPixel =
-    mContainerFrame->PresContext()->AppUnitsPerDevPixel();
-
   for (nsDisplayItem* item = aList.GetBottom(); item; item = item->GetAbove()) {
     nsDisplayItem::Type type = item->GetType();
     if (type == nsDisplayItem::TYPE_CLIP ||
         type == nsDisplayItem::TYPE_CLIP_ROUNDED_RECT) {
       FrameLayerBuilder::Clip childClip(aClip, item);
       ProcessDisplayItems(*item->GetList(), childClip);
       continue;
     }
 
-    NS_ASSERTION(appUnitsPerDevPixel == AppUnitsPerDevPixel(item),
+    NS_ASSERTION(mAppUnitsPerDevPixel == AppUnitsPerDevPixel(item),
       "items in a container layer should all have the same app units per dev pixel");
 
     nsIntRect itemVisibleRect =
-      item->GetVisibleRect().ScaleToOutsidePixels(
-          mParameters.mXScale, mParameters.mYScale, appUnitsPerDevPixel);
-    nsRect itemContent = item->GetBounds(mBuilder);
+      ScaleToOutsidePixels(item->GetVisibleRect(), false);
+    bool snap;
+    nsRect itemContent = item->GetBounds(mBuilder, &snap);
     if (aClip.mHaveClipRect) {
       itemContent.IntersectRect(aClip.mClipRect, itemContent);
     }
     mBounds.UnionRect(mBounds, itemContent);
-    nsIntRect itemDrawRect = itemContent.ScaleToOutsidePixels(
-        mParameters.mXScale, mParameters.mYScale, appUnitsPerDevPixel);
+    nsIntRect itemDrawRect = ScaleToOutsidePixels(itemContent, snap);
+    itemVisibleRect.IntersectRect(itemVisibleRect, itemDrawRect);
+
     LayerState layerState = item->GetLayerState(mBuilder, mManager);
 
     nsIFrame* activeScrolledRoot =
       nsLayoutUtils::GetActiveScrolledRootFor(item, mBuilder);
 
     // Assign the item to a layer
     if (layerState == LAYER_ACTIVE_FORCE ||
         layerState == LAYER_ACTIVE_EMPTY ||
@@ -1476,18 +1504,17 @@ ContainerState::ProcessDisplayItems(cons
       NS_ASSERTION(!ownLayer->HasUserData(&gLayerManagerUserData),
                    "We shouldn't have a FrameLayerBuilder-managed layer here!");
       NS_ASSERTION(aClip.mHaveClipRect ||
                      aClip.mRoundedClipRects.IsEmpty(),
                    "If we have rounded rects, we must have a clip rect");
       // It has its own layer. Update that layer's clip and visible rects.
       if (aClip.mHaveClipRect) {
         ownLayer->IntersectClipRect(
-            aClip.NonRoundedIntersection().ScaleToNearestPixels(
-                mParameters.mXScale, mParameters.mYScale, appUnitsPerDevPixel));
+          ScaleToNearestPixels(aClip.NonRoundedIntersection()));
       }
       ThebesLayerData* data = GetTopThebesLayerData();
       if (data) {
         data->mVisibleAboveRegion.Or(data->mVisibleAboveRegion, itemVisibleRect);
         data->mVisibleAboveRegion.SimplifyOutward(4);
         // Add the entire bounds rect to the mDrawAboveRegion.
         // The visible region may be excluding opaque content above the
         // item, and we need to ensure that that content is not placed
@@ -1537,44 +1564,41 @@ ContainerState::InvalidateForLayerChange
     return;
   }
   if (aNewLayer != oldLayer) {
     // The item has changed layers.
     // Invalidate the bounds in the old layer and new layer.
     // The bounds might have changed, but we assume that any difference
     // in the bounds will have been invalidated for all Thebes layers
     // in the container via regular frame invalidation.
-    nsRect bounds = aItem->GetBounds(mBuilder);
-    PRInt32 appUnitsPerDevPixel = AppUnitsPerDevPixel(aItem);
+    bool snap;
+    nsRect bounds = aItem->GetBounds(mBuilder, &snap);
 
     ThebesLayer* t = oldLayer->AsThebesLayer();
     if (t) {
       ThebesDisplayItemLayerUserData* data =
           static_cast<ThebesDisplayItemLayerUserData*>(t->GetUserData(&gThebesDisplayItemLayerUserData));
       // Note that whenever the layer's scale changes, we invalidate the whole thing,
       // so it doesn't matter whether we are using the old scale at last paint
       // or a new scale here
       InvalidatePostTransformRegion(t,
-          bounds.ScaleToOutsidePixels(data->mXScale, data->mYScale, appUnitsPerDevPixel),
+          bounds.ScaleToOutsidePixels(data->mXScale, data->mYScale, mAppUnitsPerDevPixel),
           mBuilder->LayerBuilder()->GetLastPaintOffset(t));
     }
     if (aNewLayer) {
       ThebesLayer* newLayer = aNewLayer->AsThebesLayer();
       if (newLayer) {
         ThebesDisplayItemLayerUserData* data =
             static_cast<ThebesDisplayItemLayerUserData*>(newLayer->GetUserData(&gThebesDisplayItemLayerUserData));
         InvalidatePostTransformRegion(newLayer,
-            bounds.ScaleToOutsidePixels(data->mXScale, data->mYScale, appUnitsPerDevPixel),
+            bounds.ScaleToOutsidePixels(data->mXScale, data->mYScale, mAppUnitsPerDevPixel),
             GetTranslationForThebesLayer(newLayer));
       }
     }
 
-    NS_ASSERTION(appUnitsPerDevPixel ==
-                   mContainerFrame->PresContext()->AppUnitsPerDevPixel(),
-                 "app units per dev pixel should be constant in a container");
     mContainerFrame->InvalidateWithFlags(
         bounds - mBuilder->ToReferenceFrame(mContainerFrame),
         nsIFrame::INVALIDATE_NO_THEBES_LAYERS |
         nsIFrame::INVALIDATE_EXCLUDE_CURRENT_PAINT);
   }
 }
 
 bool
@@ -1855,17 +1879,16 @@ FrameLayerBuilder::BuildContainerLayerFo
     return containerLayer.forget();
   }
 
   ContainerParameters scaleParameters =
     ChooseScaleAndSetTransform(this, aContainerFrame, aTransform, aParameters,
                                containerLayer);
   ContainerState state(aBuilder, aManager, aContainerFrame, containerLayer,
                        scaleParameters);
-  nscoord appUnitsPerDevPixel = aContainerFrame->PresContext()->AppUnitsPerDevPixel();
 
   if (aManager == mRetainingManager) {
     DisplayItemDataEntry* entry = mNewDisplayItemData.PutEntry(aContainerFrame);
     if (entry) {
       entry->mData.AppendElement(
           DisplayItemData(containerLayer, containerDisplayItemKey, LAYER_ACTIVE));
     }
 
@@ -1875,17 +1898,17 @@ FrameLayerBuilder::BuildContainerLayerFo
 
     nsRegion* invalidThebesContent(static_cast<nsRegion*>
       (props.Get(ThebesLayerInvalidRegionProperty())));
     if (invalidThebesContent) {
       nsPoint offset = offsetAtLastPaint ? *offsetAtLastPaint : currentOffset;
       invalidThebesContent->MoveBy(offset);
       state.SetInvalidThebesContent(invalidThebesContent->
         ScaleToOutsidePixels(scaleParameters.mXScale, scaleParameters.mYScale,
-                             appUnitsPerDevPixel));
+                             state.GetAppUnitsPerDevPixel()));
       // We have to preserve the current contents of invalidThebesContent
       // because there might be multiple container layers for the same
       // frame and we need to invalidate the ThebesLayer children of all
       // of them.
       invalidThebesContent->MoveBy(-offset);
     } else {
       // The region was deleted to indicate that everything should be
       // invalidated.
@@ -1900,25 +1923,23 @@ FrameLayerBuilder::BuildContainerLayerFo
   // Set CONTENT_COMPONENT_ALPHA if any of our children have it.
   // This is suboptimal ... a child could have text that's over transparent
   // pixels in its own layer, but over opaque parts of previous siblings.
   PRUint32 flags;
   state.Finish(&flags);
 
   nsRect bounds = state.GetChildrenBounds();
   NS_ASSERTION(bounds.IsEqualInterior(aChildren.GetBounds(aBuilder)), "Wrong bounds");
-  nsIntRect pixBounds =
-    bounds.ScaleToOutsidePixels(scaleParameters.mXScale, scaleParameters.mYScale,
-                                appUnitsPerDevPixel);
+  nsIntRect pixBounds = state.ScaleToOutsidePixels(bounds, false);
   containerLayer->SetVisibleRegion(pixBounds);
   // Make sure that rounding the visible region out didn't add any area
   // we won't paint
   if (aChildren.IsOpaque() && !aChildren.NeedsTransparentSurface()) {
     bounds.ScaleRoundIn(scaleParameters.mXScale, scaleParameters.mYScale);
-    if (bounds.Contains(pixBounds.ToAppUnits(appUnitsPerDevPixel))) {
+    if (bounds.Contains(pixBounds.ToAppUnits(state.GetAppUnitsPerDevPixel()))) {
       // Clear CONTENT_COMPONENT_ALPHA
       flags = Layer::CONTENT_OPAQUE;
     }
   }
   containerLayer->SetContentFlags(flags);
 
   return containerLayer.forget();
 }
@@ -2041,17 +2062,18 @@ FrameLayerBuilder::GetDedicatedLayer(nsI
     }
   }
   return nsnull;
 }
 
 #ifdef MOZ_DUMP_PAINTING
 static void DebugPaintItem(nsRenderingContext* aDest, nsDisplayItem *aItem, nsDisplayListBuilder* aBuilder)
 {
-  nsRect appUnitBounds = aItem->GetBounds(aBuilder);
+  bool snap;
+  nsRect appUnitBounds = aItem->GetBounds(aBuilder, &snap);
   gfxRect bounds(appUnitBounds.x, appUnitBounds.y, appUnitBounds.width, appUnitBounds.height);
   bounds.ScaleInverse(aDest->AppUnitsPerDevPixel());
 
   nsRefPtr<gfxASurface> surf = 
     gfxPlatform::GetPlatform()->CreateOffscreenSurface(gfxIntSize(bounds.width, bounds.height), 
                                                        gfxASurface::CONTENT_COLOR_ALPHA);
   surf->SetDeviceOffset(-bounds.TopLeft());
   nsRefPtr<gfxContext> context = new gfxContext(surf);
--- a/layout/base/FrameLayerBuilder.h
+++ b/layout/base/FrameLayerBuilder.h
@@ -158,16 +158,27 @@ public:
       mInTransformedSubtree(aParent.mInTransformedSubtree),
       mInActiveTransformedSubtree(aParent.mInActiveTransformedSubtree),
       mDisableSubpixelAntialiasingInDescendants(aParent.mDisableSubpixelAntialiasingInDescendants)
     {}
     float mXScale, mYScale;
     bool mInTransformedSubtree;
     bool mInActiveTransformedSubtree;
     bool mDisableSubpixelAntialiasingInDescendants;
+    /**
+     * When this is false, ThebesLayer coordinates are drawn to with an integer
+     * translation and the scale in mXScale/mYScale.
+     */
+    bool AllowResidualTranslation()
+    {
+      // If we're in a transformed subtree, but no ancestor transform is actively
+      // changing, we'll use the residual translation when drawing into the
+      // ThebesLayer to ensure that snapping exactly matches the ideal transform.
+      return mInTransformedSubtree && !mInActiveTransformedSubtree;
+    }
   };
   /**
    * Build a container layer for a display item that contains a child
    * list, either reusing an existing one or creating a new one. It
    * sets the container layer children to layers which together render
    * the contents of the display list. It reuses existing layers from
    * the retained layer manager if possible.
    * aContainer may be null, in which case we construct a root layer.
--- a/layout/base/nsDisplayList.cpp
+++ b/layout/base/nsDisplayList.cpp
@@ -83,17 +83,16 @@ nsDisplayListBuilder::nsDisplayListBuild
       mHadToIgnoreSuppression(false),
       mIsAtRootOfPseudoStackingContext(false),
       mIncludeAllOutOfFlows(false),
       mSelectedFramesOnly(false),
       mAccurateVisibleRegions(false),
       mInTransform(false),
       mSyncDecodeImages(false),
       mIsPaintingToWindow(false),
-      mSnappingEnabled(mMode != EVENT_DELIVERY),
       mHasDisplayPort(false),
       mHasFixedItems(false)
 {
   MOZ_COUNT_CTOR(nsDisplayListBuilder);
   PL_InitArenaPool(&mPool, "displayListArena", 1024,
                    NS_MAX(NS_ALIGNMENT_OF(void*),NS_ALIGNMENT_OF(double))-1);
 
   nsPresContext* pc = aReferenceFrame->PresContext();
@@ -410,42 +409,44 @@ nsDisplayList::FlattenTo(nsTArray<nsDisp
     }
   }
 }
 
 nsRect
 nsDisplayList::GetBounds(nsDisplayListBuilder* aBuilder) const {
   nsRect bounds;
   for (nsDisplayItem* i = GetBottom(); i != nsnull; i = i->GetAbove()) {
-    bounds.UnionRect(bounds, i->GetBounds(aBuilder));
+    bool snap;
+    bounds.UnionRect(bounds, i->GetBounds(aBuilder, &snap));
   }
   return bounds;
 }
 
 bool
 nsDisplayList::ComputeVisibilityForRoot(nsDisplayListBuilder* aBuilder,
                                         nsRegion* aVisibleRegion) {
   nsRegion r;
   r.And(*aVisibleRegion, GetBounds(aBuilder));
   return ComputeVisibilityForSublist(aBuilder, aVisibleRegion, r.GetBounds(), r.GetBounds());
 }
 
 static nsRegion
 TreatAsOpaque(nsDisplayItem* aItem, nsDisplayListBuilder* aBuilder,
               bool* aTransparentBackground)
 {
-  nsRegion opaque = aItem->GetOpaqueRegion(aBuilder, aTransparentBackground);
+  bool snap;
+  nsRegion opaque = aItem->GetOpaqueRegion(aBuilder, &snap, aTransparentBackground);
   if (aBuilder->IsForPluginGeometry()) {
     // Treat all chrome items as opaque, unless their frames are opacity:0.
     // Since opacity:0 frames generate an nsDisplayOpacity, that item will
     // not be treated as opaque here, so opacity:0 chrome content will be
     // effectively ignored, as it should be.
     nsIFrame* f = aItem->GetUnderlyingFrame();
     if (f && f->PresContext()->IsChrome() && f->GetStyleDisplay()->mOpacity != 0.0) {
-      opaque = aItem->GetBounds(aBuilder);
+      opaque = aItem->GetBounds(aBuilder, &snap);
     }
   }
   return opaque;
 }
 
 static nsRect
 GetDisplayPortBounds(nsDisplayListBuilder* aBuilder, nsDisplayItem* aItem)
 {
@@ -468,16 +469,17 @@ GetDisplayPortBounds(nsDisplayListBuilde
   return result;
 }
 
 bool
 nsDisplayList::ComputeVisibilityForSublist(nsDisplayListBuilder* aBuilder,
                                            nsRegion* aVisibleRegion,
                                            const nsRect& aListVisibleBounds,
                                            const nsRect& aAllowVisibleRegionExpansion) {
+  bool snap;
 #ifdef DEBUG
   nsRegion r;
   r.And(*aVisibleRegion, GetBounds(aBuilder));
   NS_ASSERTION(r.GetBounds().IsEqualInterior(aListVisibleBounds),
                "bad aListVisibleBounds");
 #endif
   mVisibleRect = aListVisibleBounds;
   bool anyVisible = false;
@@ -502,17 +504,17 @@ nsDisplayList::ComputeVisibilityForSubli
       // The elements on the list >= i no longer serve any use.
       elements.SetLength(i);
       list->FlattenTo(&elements);
       i = elements.Length();
       item->~nsDisplayItem();
       continue;
     }
 
-    nsRect bounds = item->GetBounds(aBuilder);
+    nsRect bounds = item->GetBounds(aBuilder, &snap);
 
     nsRegion itemVisible;
     if (ForceVisiblityForFixedItem(aBuilder, item)) {
       itemVisible.And(GetDisplayPortBounds(aBuilder, item), bounds);
     } else {
       itemVisible.And(*aVisibleRegion, bounds);
     }
     item->mVisibleRect = itemVisible.GetBounds();
@@ -737,17 +739,18 @@ void nsDisplayList::HitTest(nsDisplayLis
   }
   nsAutoTArray<FramesWithDepth, 16> temp;
   for (PRInt32 i = aState->mItemBuffer.Length() - 1; i >= itemBufferStart; --i) {
     // Pop element off the end of the buffer. We want to shorten the buffer
     // so that recursive calls to HitTest have more buffer space.
     item = aState->mItemBuffer[i];
     aState->mItemBuffer.SetLength(i);
 
-    if (aRect.Intersects(item->GetBounds(aBuilder))) {
+    bool snap;
+    if (aRect.Intersects(item->GetBounds(aBuilder, &snap))) {
       nsAutoTArray<nsIFrame*, 16> outFrames;
       item->HitTest(aBuilder, aRect, aState, &outFrames);
       
       // For 3d transforms with preserve-3d we add hit frames into the temp list 
       // so we can sort them later, otherwise we add them directly to the output list.
       nsTArray<nsIFrame*> *writeFrames = aOutFrames;
       if (item->GetType() == nsDisplayItem::TYPE_TRANSFORM &&
           item->GetUnderlyingFrame()->Preserves3D()) {
@@ -890,17 +893,18 @@ void nsDisplayList::SortByContentOrder(n
 void nsDisplayList::Sort(nsDisplayListBuilder* aBuilder,
                          SortLEQ aCmp, void* aClosure) {
   ExplodeAnonymousChildLists(aBuilder);
   ::Sort(this, Count(), aCmp, aClosure);
 }
 
 bool nsDisplayItem::RecomputeVisibility(nsDisplayListBuilder* aBuilder,
                                           nsRegion* aVisibleRegion) {
-  nsRect bounds = GetBounds(aBuilder);
+  bool snap;
+  nsRect bounds = GetBounds(aBuilder, &snap);
 
   nsRegion itemVisible;
   if (ForceVisiblityForFixedItem(aBuilder, this)) {
     itemVisible.And(GetDisplayPortBounds(aBuilder, this), bounds);
   } else {
     itemVisible.And(*aVisibleRegion, bounds);
   }
   mVisibleRect = itemVisible.GetBounds();
@@ -912,36 +916,21 @@ bool nsDisplayItem::RecomputeVisibility(
     return false;
 
   bool forceTransparentBackground;
   nsRegion opaque = TreatAsOpaque(this, aBuilder, &forceTransparentBackground);
   aBuilder->SubtractFromVisibleRegion(aVisibleRegion, opaque);
   return true;
 }
 
-// Note that even if the rectangle we draw and snap is smaller than aRect,
-// it's OK to call this to get a bounding rect for what we'll draw, because
-// snapping a rectangle which is contained in R always gives you a
-// rectangle which is contained in the snapped R.
-static nsRect
-SnapBounds(bool aSnappingEnabled, nsPresContext* aPresContext,
-           const nsRect& aRect) {
-  nsRect r = aRect;
-  if (aSnappingEnabled) {
-    nscoord appUnitsPerDevPixel = aPresContext->AppUnitsPerDevPixel();
-    r = r.ToNearestPixels(appUnitsPerDevPixel).ToAppUnits(appUnitsPerDevPixel);
-  }
-  return r;
-}
-
 nsRect
-nsDisplaySolidColor::GetBounds(nsDisplayListBuilder* aBuilder)
+nsDisplaySolidColor::GetBounds(nsDisplayListBuilder* aBuilder, bool* aSnap)
 {
-  nsPresContext* presContext = mFrame->PresContext();
-  return SnapBounds(mSnappingEnabled, presContext, mBounds);
+  *aSnap = true;
+  return mBounds;
 }
 
 void
 nsDisplaySolidColor::Paint(nsDisplayListBuilder* aBuilder,
                            nsRenderingContext* aCtx)
 {
   aCtx->SetColor(mColor);
   aCtx->FillRect(mVisibleRect);
@@ -963,18 +952,17 @@ RegisterThemeGeometry(nsDisplayListBuild
 
   nsRect borderBox(aFrame->GetOffsetTo(displayRoot), aFrame->GetSize());
   aBuilder->RegisterThemeGeometry(aFrame->GetStyleDisplay()->mAppearance,
       borderBox.ToNearestPixels(aFrame->PresContext()->AppUnitsPerDevPixel()));
 }
 
 nsDisplayBackground::nsDisplayBackground(nsDisplayListBuilder* aBuilder,
                                          nsIFrame* aFrame)
-  : nsDisplayItem(aBuilder, aFrame),
-    mSnappingEnabled(aBuilder->IsSnappingEnabled() && !aBuilder->IsInTransform())
+  : nsDisplayItem(aBuilder, aFrame)
 {
   MOZ_COUNT_CTOR(nsDisplayBackground);
   const nsStyleDisplay* disp = mFrame->GetStyleDisplay();
   mIsThemed = mFrame->IsThemed(disp, &mThemeTransparency);
 
   if (mIsThemed) {
     // Perform necessary RegisterThemeGeometry
     if (disp->mAppearance == NS_THEME_MOZ_MAC_UNIFIED_TOOLBAR ||
@@ -1121,17 +1109,18 @@ nsDisplayBackground::ComputeVisibility(n
   // anything.
   nsStyleContext* bgSC;
   return mIsThemed ||
     nsCSSRendering::FindBackground(mFrame->PresContext(), mFrame, &bgSC);
 }
 
 nsRegion
 nsDisplayBackground::GetInsideClipRegion(nsPresContext* aPresContext,
-                                         PRUint8 aClip, const nsRect& aRect)
+                                         PRUint8 aClip, const nsRect& aRect,
+                                         bool* aSnap)
 {
   nsRegion result;
   if (aRect.IsEmpty())
     return result;
 
   nscoord radii[8];
   nsRect clipRect;
   bool haveRadii;
@@ -1148,75 +1137,75 @@ nsDisplayBackground::GetInsideClipRegion
     haveRadii = mFrame->GetContentBoxBorderRadii(radii);
     clipRect = mFrame->GetContentRect() - mFrame->GetPosition() + ToReferenceFrame();
     break;
   default:
     NS_NOTREACHED("Unknown clip type");
     return result;
   }
 
-  nsRect inputRect = SnapBounds(mSnappingEnabled, aPresContext, aRect);
-  clipRect = SnapBounds(mSnappingEnabled, aPresContext, clipRect);
-
   if (haveRadii) {
-    result = nsLayoutUtils::RoundedRectIntersectRect(clipRect, radii, inputRect);
+    *aSnap = false;
+    result = nsLayoutUtils::RoundedRectIntersectRect(clipRect, radii, aRect);
   } else {
     nsRect r;
-    r.IntersectRect(clipRect, inputRect);
+    r.IntersectRect(clipRect, aRect);
     result = r;
   }
   return result;
 }
 
 nsRegion
 nsDisplayBackground::GetOpaqueRegion(nsDisplayListBuilder* aBuilder,
+                                     bool* aSnap,
                                      bool* aForceTransparentSurface) {
   nsRegion result;
-  if (aForceTransparentSurface) {
-    *aForceTransparentSurface = false;
-  }
+  *aSnap = false;
+  *aForceTransparentSurface = false;
   // theme background overrides any other background
   if (mIsThemed) {
     if (aForceTransparentSurface) {
       const nsStyleDisplay* disp = mFrame->GetStyleDisplay();
       *aForceTransparentSurface = disp->mAppearance == NS_THEME_WIN_BORDERLESS_GLASS ||
                                   disp->mAppearance == NS_THEME_WIN_GLASS;
     }
     if (mThemeTransparency == nsITheme::eOpaque) {
-      result = GetBounds(aBuilder);
+      result = GetBounds(aBuilder, aSnap);
     }
     return result;
   }
 
   nsStyleContext* bgSC;
   nsPresContext* presContext = mFrame->PresContext();
   if (!nsCSSRendering::FindBackground(mFrame->PresContext(), mFrame, &bgSC))
     return result;
   const nsStyleBackground* bg = bgSC->GetStyleBackground();
   const nsStyleBackground::Layer& bottomLayer = bg->BottomLayer();
 
+  *aSnap = true;
+
   nsRect borderBox = nsRect(ToReferenceFrame(), mFrame->GetSize());
   if (NS_GET_A(bg->mBackgroundColor) == 255 &&
       !nsCSSRendering::IsCanvasFrame(mFrame)) {
-    result = GetInsideClipRegion(presContext, bottomLayer.mClip, borderBox);
+    result = GetInsideClipRegion(presContext, bottomLayer.mClip, borderBox, aSnap);
   }
 
   // For policies other than EACH_BOX, don't try to optimize here, since
   // this could easily lead to O(N^2) behavior inside InlineBackgroundData,
   // which expects frames to be sent to it in content order, not reverse
   // content order which we'll produce here.
   // Of course, if there's only one frame in the flow, it doesn't matter.
   if (bg->mBackgroundInlinePolicy == NS_STYLE_BG_INLINE_POLICY_EACH_BOX ||
       (!mFrame->GetPrevContinuation() && !mFrame->GetNextContinuation())) {
     NS_FOR_VISIBLE_BACKGROUND_LAYERS_BACK_TO_FRONT(i, bg) {
       const nsStyleBackground::Layer& layer = bg->mLayers[i];
       if (layer.mImage.IsOpaque()) {
         nsRect r = nsCSSRendering::GetBackgroundLayerRect(presContext, mFrame,
             borderBox, *bg, layer);
-        result.Or(result, GetInsideClipRegion(presContext, layer.mClip, r));
+        result.Or(result, GetInsideClipRegion(presContext, layer.mClip, r, aSnap));
       }
     }
   }
 
   return result;
 }
 
 bool
@@ -1305,17 +1294,18 @@ nsDisplayBackground::ShouldFixToViewport
     }
     if (layer.mClip != NS_STYLE_BG_CLIP_BORDER)
       return false;
   }
 
   if (nsLayoutUtils::HasNonZeroCorner(mFrame->GetStyleBorder()->mBorderRadius))
     return false;
 
-  nsRect bounds = GetBounds(aBuilder);
+  bool snap;
+  nsRect bounds = GetBounds(aBuilder, &snap);
   nsIFrame* rootScrollFrame = presContext->PresShell()->GetRootScrollFrame();
   if (!rootScrollFrame)
     return false;
   nsIScrollableFrame* scrollable = do_QueryFrame(rootScrollFrame);
   nsRect scrollport = scrollable->GetScrollPortRect() +
     aBuilder->ToReferenceFrame(rootScrollFrame);
   return bounds.Contains(scrollport);
 }
@@ -1332,31 +1322,33 @@ nsDisplayBackground::Paint(nsDisplayList
   }
   nsCSSRendering::PaintBackground(mFrame->PresContext(), *aCtx, mFrame,
                                   mVisibleRect,
                                   nsRect(offset, mFrame->GetSize()),
                                   flags);
 }
 
 nsRect
-nsDisplayBackground::GetBounds(nsDisplayListBuilder* aBuilder) {
+nsDisplayBackground::GetBounds(nsDisplayListBuilder* aBuilder, bool* aSnap) {
   nsRect r(nsPoint(0,0), mFrame->GetSize());
   nsPresContext* presContext = mFrame->PresContext();
 
   if (mIsThemed) {
     presContext->GetTheme()->
         GetWidgetOverflow(presContext->DeviceContext(), mFrame,
                           mFrame->GetStyleDisplay()->mAppearance, &r);
   }
 
-  return SnapBounds(mSnappingEnabled, presContext, r + ToReferenceFrame());
+  *aSnap = true;
+  return r + ToReferenceFrame();
 }
 
 nsRect
-nsDisplayOutline::GetBounds(nsDisplayListBuilder* aBuilder) {
+nsDisplayOutline::GetBounds(nsDisplayListBuilder* aBuilder, bool* aSnap) {
+  *aSnap = false;
   return mFrame->GetVisualOverflowRectRelativeToSelf() + ToReferenceFrame();
 }
 
 void
 nsDisplayOutline::Paint(nsDisplayListBuilder* aBuilder,
                         nsRenderingContext* aCtx) {
   // TODO join outlines together
   nsPoint offset = ToReferenceFrame();
@@ -1445,21 +1437,22 @@ nsDisplayBorder::Paint(nsDisplayListBuil
   nsCSSRendering::PaintBorder(mFrame->PresContext(), *aCtx, mFrame,
                               mVisibleRect,
                               nsRect(offset, mFrame->GetSize()),
                               mFrame->GetStyleContext(),
                               mFrame->GetSkipSides());
 }
 
 nsRect
-nsDisplayBorder::GetBounds(nsDisplayListBuilder* aBuilder)
+nsDisplayBorder::GetBounds(nsDisplayListBuilder* aBuilder, bool* aSnap)
 {
   nsRect borderBounds(ToReferenceFrame(), mFrame->GetSize());
   borderBounds.Inflate(mFrame->GetStyleBorder()->GetImageOutset());
-  return SnapBounds(mSnappingEnabled, mFrame->PresContext(), borderBounds);
+  *aSnap = true;
+  return borderBounds;
 }
 
 // Given a region, compute a conservative approximation to it as a list
 // of rectangles that aren't vertically adjacent (i.e., vertically
 // adjacent or overlapping rectangles are combined).
 // Right now this is only approximate, some vertically overlapping rectangles
 // aren't guaranteed to be combined.
 static void
@@ -1502,17 +1495,18 @@ nsDisplayBoxShadowOuter::Paint(nsDisplay
     aCtx->IntersectClip(rects[i]);
     nsCSSRendering::PaintBoxShadowOuter(presContext, *aCtx, mFrame,
                                         borderRect, rects[i]);
     aCtx->PopState();
   }
 }
 
 nsRect
-nsDisplayBoxShadowOuter::GetBounds(nsDisplayListBuilder* aBuilder) {
+nsDisplayBoxShadowOuter::GetBounds(nsDisplayListBuilder* aBuilder, bool* aSnap) {
+  *aSnap = false;
   return mFrame->GetVisualOverflowRectRelativeToSelf() + ToReferenceFrame();
 }
 
 bool
 nsDisplayBoxShadowOuter::ComputeVisibility(nsDisplayListBuilder* aBuilder,
                                            nsRegion* aVisibleRegion,
                                            const nsRect& aAllowVisibleRegionExpansion) {
   if (!nsDisplayItem::ComputeVisibility(aBuilder, aVisibleRegion,
@@ -1594,38 +1588,39 @@ nsDisplayWrapList::~nsDisplayWrapList() 
 
 void
 nsDisplayWrapList::HitTest(nsDisplayListBuilder* aBuilder, const nsRect& aRect,
                            HitTestState* aState, nsTArray<nsIFrame*> *aOutFrames) {
   mList.HitTest(aBuilder, aRect, aState, aOutFrames);
 }
 
 nsRect
-nsDisplayWrapList::GetBounds(nsDisplayListBuilder* aBuilder) {
+nsDisplayWrapList::GetBounds(nsDisplayListBuilder* aBuilder, bool* aSnap) {
+  *aSnap = false;
   return mList.GetBounds(aBuilder);
 }
 
 bool
 nsDisplayWrapList::ComputeVisibility(nsDisplayListBuilder* aBuilder,
                                      nsRegion* aVisibleRegion,
                                      const nsRect& aAllowVisibleRegionExpansion) {
   return mList.ComputeVisibilityForSublist(aBuilder, aVisibleRegion,
                                            mVisibleRect,
                                            aAllowVisibleRegionExpansion);
 }
 
 nsRegion
 nsDisplayWrapList::GetOpaqueRegion(nsDisplayListBuilder* aBuilder,
+                                   bool* aSnap,
                                    bool* aForceTransparentSurface) {
-  if (aForceTransparentSurface) {
-    *aForceTransparentSurface = false;
-  }
+  *aForceTransparentSurface = false;
+  *aSnap = false;
   nsRegion result;
   if (mList.IsOpaque()) {
-    result = GetBounds(aBuilder);
+    result = GetBounds(aBuilder, aSnap);
   }
   return result;
 }
 
 bool nsDisplayWrapList::IsUniform(nsDisplayListBuilder* aBuilder, nscolor* aColor) {
   // We could try to do something but let's conservatively just return false.
   return false;
 }
@@ -1755,20 +1750,20 @@ nsDisplayOpacity::nsDisplayOpacity(nsDis
 
 #ifdef NS_BUILD_REFCNT_LOGGING
 nsDisplayOpacity::~nsDisplayOpacity() {
   MOZ_COUNT_DTOR(nsDisplayOpacity);
 }
 #endif
 
 nsRegion nsDisplayOpacity::GetOpaqueRegion(nsDisplayListBuilder* aBuilder,
+                                           bool* aSnap,
                                            bool* aForceTransparentSurface) {
-  if (aForceTransparentSurface) {
-    *aForceTransparentSurface = false;
-  }
+  *aForceTransparentSurface = false;
+  *aSnap = false;
   // We are never opaque, if our opacity was < 1 then we wouldn't have
   // been created.
   return nsRegion();
 }
 
 // nsDisplayOpacity uses layers for rendering
 already_AddRefed<Layer>
 nsDisplayOpacity::BuildLayer(nsDisplayListBuilder* aBuilder,
@@ -1815,17 +1810,18 @@ bool
 nsDisplayOpacity::ComputeVisibility(nsDisplayListBuilder* aBuilder,
                                     nsRegion* aVisibleRegion,
                                     const nsRect& aAllowVisibleRegionExpansion) {
   // Our children are translucent so we should not allow them to subtract
   // area from aVisibleRegion. We do need to find out what is visible under
   // our children in the temporary compositing buffer, because if our children
   // paint our entire bounds opaquely then we don't need an alpha channel in
   // the temporary compositing buffer.
-  nsRect bounds = GetBounds(aBuilder);
+  bool snap;
+  nsRect bounds = GetBounds(aBuilder, &snap);
   nsRegion visibleUnderChildren;
   visibleUnderChildren.And(*aVisibleRegion, bounds);
   nsRect allowExpansion;
   allowExpansion.IntersectRect(bounds, aAllowVisibleRegionExpansion);
   return
     nsDisplayWrapList::ComputeVisibility(aBuilder, &visibleUnderChildren,
                                          allowExpansion);
 }
@@ -2090,33 +2086,30 @@ nsDisplayScrollInfoLayer::ShouldFlattenA
   // nsDisplayScrollInfoLayer (with only the metadata) should survive the
   // visibility computation. 
   return RemoveScrollLayerCount() == 1;
 }
 
 nsDisplayClip::nsDisplayClip(nsDisplayListBuilder* aBuilder,
                              nsIFrame* aFrame, nsDisplayItem* aItem,
                              const nsRect& aRect)
-   : nsDisplayWrapList(aBuilder, aFrame, aItem) {
+   : nsDisplayWrapList(aBuilder, aFrame, aItem), mClip(aRect) {
   MOZ_COUNT_CTOR(nsDisplayClip);
-  mClip = SnapBounds(aBuilder->IsSnappingEnabled() && !aBuilder->IsInTransform(),
-                     aBuilder->CurrentPresContext(), aRect);
 }
 
 nsDisplayClip::nsDisplayClip(nsDisplayListBuilder* aBuilder,
                              nsIFrame* aFrame, nsDisplayList* aList,
                              const nsRect& aRect)
-   : nsDisplayWrapList(aBuilder, aFrame, aList) {
+   : nsDisplayWrapList(aBuilder, aFrame, aList), mClip(aRect) {
   MOZ_COUNT_CTOR(nsDisplayClip);
-  mClip = SnapBounds(aBuilder->IsSnappingEnabled() && !aBuilder->IsInTransform(),
-                     aBuilder->CurrentPresContext(), aRect);
 }
 
-nsRect nsDisplayClip::GetBounds(nsDisplayListBuilder* aBuilder) {
-  nsRect r = nsDisplayWrapList::GetBounds(aBuilder);
+nsRect nsDisplayClip::GetBounds(nsDisplayListBuilder* aBuilder, bool* aSnap) {
+  nsRect r = nsDisplayWrapList::GetBounds(aBuilder, aSnap);
+  *aSnap = true;
   r.IntersectRect(mClip, r);
   return r;
 }
 
 #ifdef NS_BUILD_REFCNT_LOGGING
 nsDisplayClip::~nsDisplayClip() {
   MOZ_COUNT_DTOR(nsDisplayClip);
 }
@@ -2188,21 +2181,21 @@ nsDisplayClipRoundedRect::nsDisplayClipR
 nsDisplayClipRoundedRect::~nsDisplayClipRoundedRect()
 {
   MOZ_COUNT_DTOR(nsDisplayClipRoundedRect);
 }
 #endif
 
 nsRegion
 nsDisplayClipRoundedRect::GetOpaqueRegion(nsDisplayListBuilder* aBuilder,
+                                          bool* aSnap,
                                           bool* aForceTransparentSurface)
 {
-  if (aForceTransparentSurface) {
-    *aForceTransparentSurface = false;
-  }
+  *aSnap = false;
+  *aForceTransparentSurface = false;
   return nsRegion();
 }
 
 void
 nsDisplayClipRoundedRect::HitTest(nsDisplayListBuilder* aBuilder,
                                   const nsRect& aRect, HitTestState* aState,
                                   nsTArray<nsIFrame*> *aOutFrames)
 {
@@ -2262,19 +2255,20 @@ nsDisplayZoom::nsDisplayZoom(nsDisplayLi
 }
 
 #ifdef NS_BUILD_REFCNT_LOGGING
 nsDisplayZoom::~nsDisplayZoom() {
   MOZ_COUNT_DTOR(nsDisplayZoom);
 }
 #endif
 
-nsRect nsDisplayZoom::GetBounds(nsDisplayListBuilder* aBuilder)
+nsRect nsDisplayZoom::GetBounds(nsDisplayListBuilder* aBuilder, bool* aSnap)
 {
-  nsRect bounds = nsDisplayWrapList::GetBounds(aBuilder);
+  nsRect bounds = nsDisplayWrapList::GetBounds(aBuilder, aSnap);
+  *aSnap = false;
   return bounds.ConvertAppUnitsRoundOut(mAPD, mParentAPD);
 }
 
 void nsDisplayZoom::HitTest(nsDisplayListBuilder *aBuilder,
                             const nsRect& aRect,
                             HitTestState *aState,
                             nsTArray<nsIFrame*> *aOutFrames)
 {
@@ -2292,18 +2286,18 @@ void nsDisplayZoom::HitTest(nsDisplayLis
 
 void nsDisplayZoom::Paint(nsDisplayListBuilder* aBuilder,
                           nsRenderingContext* aCtx)
 {
   mList.PaintForFrame(aBuilder, aCtx, mFrame, nsDisplayList::PAINT_DEFAULT);
 }
 
 bool nsDisplayZoom::ComputeVisibility(nsDisplayListBuilder *aBuilder,
-                                        nsRegion *aVisibleRegion,
-                                        const nsRect& aAllowVisibleRegionExpansion)
+                                      nsRegion *aVisibleRegion,
+                                      const nsRect& aAllowVisibleRegionExpansion)
 {
   // Convert the passed in visible region to our appunits.
   nsRegion visibleRegion =
     aVisibleRegion->ConvertAppUnitsRoundOut(mParentAPD, mAPD);
   nsRegion originalVisibleRegion = visibleRegion;
 
   nsRect transformedVisibleRect =
     mVisibleRect.ConvertAppUnitsRoundOut(mParentAPD, mAPD);
@@ -2795,22 +2789,23 @@ nsDisplayTransform::GetHitDepthAtPoint(c
 
   gfxPoint3D transformed = matrix.Transform3D(gfxPoint3D(point.x, point.y, 0));
   return transformed.z;
 }
 
 /* The bounding rectangle for the object is the overflow rectangle translated
  * by the reference point.
  */
-nsRect nsDisplayTransform::GetBounds(nsDisplayListBuilder *aBuilder)
+nsRect nsDisplayTransform::GetBounds(nsDisplayListBuilder *aBuilder, bool* aSnap)
 {
   nsRect untransformedBounds =
     ShouldPrerenderTransformedContent(aBuilder, mFrame) ?
     mFrame->GetVisualOverflowRectRelativeToSelf() + ToReferenceFrame() :
-    mStoredList.GetBounds(aBuilder);
+    mStoredList.GetBounds(aBuilder, aSnap);
+  *aSnap = false;
   float factor = nsPresContext::AppUnitsPerCSSPixel();
   return nsLayoutUtils::MatrixTransformRect(untransformedBounds,
                                             GetTransform(factor),
                                             factor);
 }
 
 /* The transform is opaque iff the transform consists solely of scales and
  * translations and if the underlying content is opaque.  Thus if the transform
@@ -2824,34 +2819,37 @@ nsRect nsDisplayTransform::GetBounds(nsD
  *
  * We also need to check whether the underlying opaque content completely fills
  * our visible rect. We use UntransformRect which expands to the axis-aligned
  * bounding rect, but that's OK since if
  * mStoredList.GetVisibleRect().Contains(untransformedVisible), then it
  * certainly contains the actual (non-axis-aligned) untransformed rect.
  */
 nsRegion nsDisplayTransform::GetOpaqueRegion(nsDisplayListBuilder *aBuilder,
+                                             bool* aSnap,
                                              bool* aForceTransparentSurface)
 {
-  if (aForceTransparentSurface) {
-    *aForceTransparentSurface = false;
-  }
+  *aForceTransparentSurface = false;
+  *aSnap = false;
   nsRect untransformedVisible;
   float factor = nsPresContext::AppUnitsPerCSSPixel();
   if (!UntransformRectMatrix(mVisibleRect, GetTransform(factor), factor, &untransformedVisible)) {
       return nsRegion();
   }
   
   const gfx3DMatrix& matrix = GetTransform(nsPresContext::AppUnitsPerCSSPixel());
-                
+
   nsRegion result;
   gfxMatrix matrix2d;
+  bool tmpSnap;
+  bool forceTransparentSurface;
   if (matrix.Is2D(&matrix2d) &&
       matrix2d.PreservesAxisAlignedRectangles() &&
-      mStoredList.GetOpaqueRegion(aBuilder).Contains(untransformedVisible)) {
+      mStoredList.GetOpaqueRegion(aBuilder, &tmpSnap, &forceTransparentSurface).
+        Contains(untransformedVisible)) {
     result = mVisibleRect;
   }
   return result;
 }
 
 /* The transform is uniform if it fills the entire bounding rect and the
  * wrapped list is uniform.  See GetOpaqueRegion for discussion of why this
  * works.
@@ -3002,21 +3000,21 @@ nsDisplaySVGEffects::nsDisplaySVGEffects
 #ifdef NS_BUILD_REFCNT_LOGGING
 nsDisplaySVGEffects::~nsDisplaySVGEffects()
 {
   MOZ_COUNT_DTOR(nsDisplaySVGEffects);
 }
 #endif
 
 nsRegion nsDisplaySVGEffects::GetOpaqueRegion(nsDisplayListBuilder* aBuilder,
+                                              bool* aSnap,
                                               bool* aForceTransparentSurface)
 {
-  if (aForceTransparentSurface) {
-    *aForceTransparentSurface = false;
-  }
+  *aForceTransparentSurface = false;
+  *aSnap = false;
   return nsRegion();
 }
 
 void
 nsDisplaySVGEffects::HitTest(nsDisplayListBuilder* aBuilder, const nsRect& aRect,
                              HitTestState* aState, nsTArray<nsIFrame*> *aOutFrames)
 {
   nsPoint rectCenter(aRect.x + aRect.width / 2, aRect.y + aRect.height / 2);
--- a/layout/base/nsDisplayList.h
+++ b/layout/base/nsDisplayList.h
@@ -302,26 +302,16 @@ public:
    * Call this if ReferenceFrame() is a viewport frame with fixed-position
    * children, or when we construct an item which will return true from
    * ShouldFixToViewport()
    */
   void SetHasFixedItems() { mHasFixedItems = true; }
   bool GetHasFixedItems() { return mHasFixedItems; }
 
   /**
-   * Returns true if snapping is enabled for the final drawing context.
-   * The default is true.
-   */
-  bool IsSnappingEnabled() { return mSnappingEnabled; }
-  /**
-   * Set if snapping is enabled for the final drawing context.
-   */
-  void SetSnappingEnabled(bool aSnappingEnabled) { mSnappingEnabled = aSnappingEnabled; }
-
-  /**
    * @return true if images have been set to decode synchronously.
    */
   bool ShouldSyncDecodeImages() { return mSyncDecodeImages; }
 
   /**
    * Indicates whether we should synchronously decode images. If true, we decode
    * and draw whatever image data has been loaded. If false, we just draw
    * whatever has already been decoded.
@@ -515,17 +505,16 @@ private:
   bool                           mIncludeAllOutOfFlows;
   bool                           mSelectedFramesOnly;
   bool                           mAccurateVisibleRegions;
   // True when we're building a display list that's directly or indirectly
   // under an nsDisplayTransform
   bool                           mInTransform;
   bool                           mSyncDecodeImages;
   bool                           mIsPaintingToWindow;
-  bool                           mSnappingEnabled;
   bool                           mHasDisplayPort;
   bool                           mHasFixedItems;
 };
 
 class nsDisplayItem;
 class nsDisplayList;
 /**
  * nsDisplayItems are put in singly-linked lists rooted in an nsDisplayList.
@@ -641,34 +630,43 @@ public:
    * @return the frame that this display item is based on. This is used to sort
    * items by z-index and content order and for some other uses. For some items
    * that wrap item lists, this could return nsnull because there is no single
    * underlying frame; for leaf items it will never return nsnull.
    */
   inline nsIFrame* GetUnderlyingFrame() const { return mFrame; }
   /**
    * The default bounds is the frame border rect.
+   * @param aSnap *aSnap is set to true if the returned rect will be
+   * snapped to nearest device pixel edges during actual drawing.
+   * It might be set to false and snap anyway, so code computing the set of
+   * pixels affected by this display item needs to round outwards to pixel
+   * boundaries when *aSnap is set to false.
    * @return a rectangle relative to aBuilder->ReferenceFrame() that
    * contains the area drawn by this display item
    */
-  virtual nsRect GetBounds(nsDisplayListBuilder* aBuilder) {
+  virtual nsRect GetBounds(nsDisplayListBuilder* aBuilder, bool* aSnap)
+  {
+    *aSnap = false;
     return nsRect(ToReferenceFrame(), GetUnderlyingFrame()->GetSize());
   }
   /**
+   * @param aSnap set to true if the edges of the rectangles of the opaque
+   * region would be snapped to device pixels when drawing
    * @return a region of the item that is opaque --- every pixel painted
    * with an opaque color. This is useful for determining when one piece
    * of content completely obscures another so that we can do occlusion
    * culling.
    */
   virtual nsRegion GetOpaqueRegion(nsDisplayListBuilder* aBuilder,
-                                   bool* aForceTransparentSurface = nsnull)
+                                   bool* aSnap,
+                                   bool* aForceTransparentSurface)
   {
-    if (aForceTransparentSurface) {
-      *aForceTransparentSurface = false;
-    }
+    *aSnap = false;
+    *aForceTransparentSurface = false;
     return nsRegion();
   }
   /**
    * If this returns true, then aColor is set to the uniform color
    * @return true if the item is guaranteed to paint every pixel in its
    * bounds with the same (possibly translucent) color
    */
   virtual bool IsUniform(nsDisplayListBuilder* aBuilder, nscolor* aColor) { return false; }
@@ -1327,18 +1325,20 @@ public:
 #endif
   
   virtual void Paint(nsDisplayListBuilder* aBuilder, nsRenderingContext* aCtx) {
     mPaint(mFrame, aCtx, mVisibleRect, ToReferenceFrame());
   }
   NS_DISPLAY_DECL_NAME(mName, mType)
 
   virtual nsRect GetComponentAlphaBounds(nsDisplayListBuilder* aBuilder) {
-    if (mType == nsDisplayItem::TYPE_HEADER_FOOTER)
-      return GetBounds(aBuilder);
+    if (mType == nsDisplayItem::TYPE_HEADER_FOOTER) {
+      bool snap;
+      return GetBounds(aBuilder, &snap);
+    }
     return nsRect();
   }
 
 protected:
   PaintCallback mPaint;
 #ifdef MOZ_DUMP_PAINTING
   const char*   mName;
 #endif
@@ -1436,51 +1436,49 @@ public:
     MOZ_COUNT_CTOR(nsDisplayCaret);
   }
 #ifdef NS_BUILD_REFCNT_LOGGING
   virtual ~nsDisplayCaret() {
     MOZ_COUNT_DTOR(nsDisplayCaret);
   }
 #endif
 
-  virtual nsRect GetBounds(nsDisplayListBuilder* aBuilder) {
+  virtual nsRect GetBounds(nsDisplayListBuilder* aBuilder, bool* aSnap) {
+    *aSnap = false;
     // The caret returns a rect in the coordinates of mFrame.
     return mCaret->GetCaretRect() + ToReferenceFrame();
   }
   virtual void Paint(nsDisplayListBuilder* aBuilder, nsRenderingContext* aCtx);
   NS_DISPLAY_DECL_NAME("Caret", TYPE_CARET)
 protected:
   nsRefPtr<nsCaret> mCaret;
 };
 
 /**
  * The standard display item to paint the CSS borders of a frame.
  */
 class nsDisplayBorder : public nsDisplayItem {
 public:
   nsDisplayBorder(nsDisplayListBuilder* aBuilder, nsIFrame* aFrame) :
-    nsDisplayItem(aBuilder, aFrame),
-    mSnappingEnabled(aBuilder->IsSnappingEnabled() && !aBuilder->IsInTransform()) {
+    nsDisplayItem(aBuilder, aFrame)
+  {
     MOZ_COUNT_CTOR(nsDisplayBorder);
   }
 #ifdef NS_BUILD_REFCNT_LOGGING
   virtual ~nsDisplayBorder() {
     MOZ_COUNT_DTOR(nsDisplayBorder);
   }
 #endif
 
-  virtual nsRect GetBounds(nsDisplayListBuilder* aBuilder);
+  virtual nsRect GetBounds(nsDisplayListBuilder* aBuilder, bool* aSnap);
   virtual void Paint(nsDisplayListBuilder* aBuilder, nsRenderingContext* aCtx);
   virtual bool ComputeVisibility(nsDisplayListBuilder* aBuilder,
                                    nsRegion* aVisibleRegion,
                                    const nsRect& aAllowVisibleRegionExpansion);
   NS_DISPLAY_DECL_NAME("Border", TYPE_BORDER)
-
-protected:
-  bool mSnappingEnabled;
 };
 
 /**
  * A simple display item that just renders a solid color across the
  * specified bounds. For canvas frames (in the CSS sense) we split off the
  * drawing of the background color into this class (from nsDisplayBackground
  * via nsDisplayCanvasBackground). This is done so that we can always draw a
  * background color to avoid ugly flashes of white when we can't draw a full
@@ -1488,37 +1486,37 @@ protected:
  * frame's bounds -- this is needed when a frame/iframe is loading and there
  * is not yet a frame tree to go in the frame/iframe so we use the subdoc
  * frame of the parent document as a standin.
  */
 class nsDisplaySolidColor : public nsDisplayItem {
 public:
   nsDisplaySolidColor(nsDisplayListBuilder* aBuilder, nsIFrame* aFrame,
                       const nsRect& aBounds, nscolor aColor)
-    : nsDisplayItem(aBuilder, aFrame), mBounds(aBounds), mColor(aColor),
-      mSnappingEnabled(aBuilder->IsSnappingEnabled() && !aBuilder->IsInTransform()) {
+    : nsDisplayItem(aBuilder, aFrame), mBounds(aBounds), mColor(aColor)
+  {
     NS_ASSERTION(NS_GET_A(aColor) > 0, "Don't create invisible nsDisplaySolidColors!");
     MOZ_COUNT_CTOR(nsDisplaySolidColor);
   }
 #ifdef NS_BUILD_REFCNT_LOGGING
   virtual ~nsDisplaySolidColor() {
     MOZ_COUNT_DTOR(nsDisplaySolidColor);
   }
 #endif
 
-  virtual nsRect GetBounds(nsDisplayListBuilder* aBuilder);
+  virtual nsRect GetBounds(nsDisplayListBuilder* aBuilder, bool* aSnap);
 
   virtual nsRegion GetOpaqueRegion(nsDisplayListBuilder* aBuilder,
-                                   bool* aOutTransparentBackground = nsnull) {
-    if (aOutTransparentBackground) {
-      *aOutTransparentBackground = false;
-    }
+                                   bool* aSnap,
+                                   bool* aOutTransparentBackground) {
+    *aSnap = false;
+    *aOutTransparentBackground = false;
     nsRegion result;
     if (NS_GET_A(mColor) == 255) {
-      result = GetBounds(aBuilder);
+      result = GetBounds(aBuilder, aSnap);
     }
     return result;
   }
 
   virtual bool IsUniform(nsDisplayListBuilder* aBuilder, nscolor* aColor)
   {
     *aColor = mColor;
     return true;
@@ -1526,17 +1524,16 @@ public:
 
   virtual void Paint(nsDisplayListBuilder* aBuilder, nsRenderingContext* aCtx);
 
   NS_DISPLAY_DECL_NAME("SolidColor", TYPE_SOLID_COLOR)
 
 private:
   nsRect  mBounds;
   nscolor mColor;
-  bool mSnappingEnabled;
 };
 
 /**
  * The standard display item to paint the CSS background of a frame.
  */
 class nsDisplayBackground : public nsDisplayItem {
 public:
   nsDisplayBackground(nsDisplayListBuilder* aBuilder, nsIFrame* aFrame);
@@ -1547,31 +1544,31 @@ public:
 #endif
 
   virtual void HitTest(nsDisplayListBuilder* aBuilder, const nsRect& aRect,
                        HitTestState* aState, nsTArray<nsIFrame*> *aOutFrames);
   virtual bool ComputeVisibility(nsDisplayListBuilder* aBuilder,
                                    nsRegion* aVisibleRegion,
                                    const nsRect& aAllowVisibleRegionExpansion);
   virtual nsRegion GetOpaqueRegion(nsDisplayListBuilder* aBuilder,
-                                   bool* aForceTransparentSurface = nsnull);
+                                   bool* aSnap,
+                                   bool* aForceTransparentSurface);
   virtual bool IsVaryingRelativeToMovingFrame(nsDisplayListBuilder* aBuilder,
                                                 nsIFrame* aFrame);
   virtual bool IsUniform(nsDisplayListBuilder* aBuilder, nscolor* aColor);
   virtual bool ShouldFixToViewport(nsDisplayListBuilder* aBuilder);
-  virtual nsRect GetBounds(nsDisplayListBuilder* aBuilder);
+  virtual nsRect GetBounds(nsDisplayListBuilder* aBuilder, bool* aSnap);
   virtual void Paint(nsDisplayListBuilder* aBuilder, nsRenderingContext* aCtx);
   NS_DISPLAY_DECL_NAME("Background", TYPE_BACKGROUND)
 protected:
   nsRegion GetInsideClipRegion(nsPresContext* aPresContext, PRUint8 aClip,
-                               const nsRect& aRect);
+                               const nsRect& aRect, bool* aSnap);
 
   /* Used to cache mFrame->IsThemed() since it isn't a cheap call */
   bool mIsThemed;
-  bool mSnappingEnabled;
   nsITheme::Transparency mThemeTransparency;
 };
 
 /**
  * The standard display item to paint the outer CSS box-shadows of a frame.
  */
 class nsDisplayBoxShadowOuter : public nsDisplayItem {
 public:
@@ -1581,17 +1578,17 @@ public:
   }
 #ifdef NS_BUILD_REFCNT_LOGGING
   virtual ~nsDisplayBoxShadowOuter() {
     MOZ_COUNT_DTOR(nsDisplayBoxShadowOuter);
   }
 #endif
 
   virtual void Paint(nsDisplayListBuilder* aBuilder, nsRenderingContext* aCtx);
-  virtual nsRect GetBounds(nsDisplayListBuilder* aBuilder);
+  virtual nsRect GetBounds(nsDisplayListBuilder* aBuilder, bool* aSnap);
   virtual bool ComputeVisibility(nsDisplayListBuilder* aBuilder,
                                    nsRegion* aVisibleRegion,
                                    const nsRect& aAllowVisibleRegionExpansion);
   NS_DISPLAY_DECL_NAME("BoxShadowOuter", TYPE_BOX_SHADOW_OUTER)
 
 private:
   nsRegion mVisibleRegion;
 };
@@ -1631,17 +1628,17 @@ public:
     MOZ_COUNT_CTOR(nsDisplayOutline);
   }
 #ifdef NS_BUILD_REFCNT_LOGGING
   virtual ~nsDisplayOutline() {
     MOZ_COUNT_DTOR(nsDisplayOutline);
   }
 #endif
 
-  virtual nsRect GetBounds(nsDisplayListBuilder* aBuilder);
+  virtual nsRect GetBounds(nsDisplayListBuilder* aBuilder, bool* aSnap);
   virtual void Paint(nsDisplayListBuilder* aBuilder, nsRenderingContext* aCtx);
   virtual bool ComputeVisibility(nsDisplayListBuilder* aBuilder,
                                    nsRegion* aVisibleRegion,
                                    const nsRect& aAllowVisibleRegionExpansion);
   NS_DISPLAY_DECL_NAME("Outline", TYPE_OUTLINE)
 };
 
 /**
@@ -1689,19 +1686,20 @@ public:
   nsDisplayWrapList(nsDisplayListBuilder* aBuilder, nsIFrame* aFrame,
                     nsDisplayList* aList);
   nsDisplayWrapList(nsDisplayListBuilder* aBuilder, nsIFrame* aFrame,
                     nsDisplayItem* aItem);
   nsDisplayWrapList(nsDisplayListBuilder* aBuilder, nsIFrame* aFrame);
   virtual ~nsDisplayWrapList();
   virtual void HitTest(nsDisplayListBuilder* aBuilder, const nsRect& aRect,
                        HitTestState* aState, nsTArray<nsIFrame*> *aOutFrames);
-  virtual nsRect GetBounds(nsDisplayListBuilder* aBuilder);
+  virtual nsRect GetBounds(nsDisplayListBuilder* aBuilder, bool* aSnap);
   virtual nsRegion GetOpaqueRegion(nsDisplayListBuilder* aBuilder,
-                                   bool* aForceTransparentSurface = nsnull);
+                                   bool* aSnap,
+                                   bool* aForceTransparentSurface);
   virtual bool IsUniform(nsDisplayListBuilder* aBuilder, nscolor* aColor);
   virtual bool IsVaryingRelativeToMovingFrame(nsDisplayListBuilder* aBuilder,
                                                 nsIFrame* aFrame);
   virtual void Paint(nsDisplayListBuilder* aBuilder, nsRenderingContext* aCtx);
   virtual bool ComputeVisibility(nsDisplayListBuilder* aBuilder,
                                    nsRegion* aVisibleRegion,
                                    const nsRect& aAllowVisibleRegionExpansion);
   virtual bool TryMerge(nsDisplayListBuilder* aBuilder, nsDisplayItem* aItem) {
@@ -1776,17 +1774,18 @@ class nsDisplayOpacity : public nsDispla
 public:
   nsDisplayOpacity(nsDisplayListBuilder* aBuilder, nsIFrame* aFrame,
                    nsDisplayList* aList);
 #ifdef NS_BUILD_REFCNT_LOGGING
   virtual ~nsDisplayOpacity();
 #endif
   
   virtual nsRegion GetOpaqueRegion(nsDisplayListBuilder* aBuilder,
-                                   bool* aForceTransparentSurface = nsnull);
+                                   bool* aSnap,
+                                   bool* aForceTransparentSurface);
   virtual already_AddRefed<Layer> BuildLayer(nsDisplayListBuilder* aBuilder,
                                              LayerManager* aManager,
                                              const ContainerParameters& aContainerParameters);
   virtual LayerState GetLayerState(nsDisplayListBuilder* aBuilder,
                                    LayerManager* aManager);
   virtual bool ComputeVisibility(nsDisplayListBuilder* aBuilder,
                                    nsRegion* aVisibleRegion,
                                    const nsRect& aAllowVisibleRegionExpansion);  
@@ -1941,17 +1940,17 @@ public:
   nsDisplayClip(nsDisplayListBuilder* aBuilder, nsIFrame* aFrame,
                 nsDisplayItem* aItem, const nsRect& aRect);
   nsDisplayClip(nsDisplayListBuilder* aBuilder, nsIFrame* aFrame,
                 nsDisplayList* aList, const nsRect& aRect);
 #ifdef NS_BUILD_REFCNT_LOGGING
   virtual ~nsDisplayClip();
 #endif
   
-  virtual nsRect GetBounds(nsDisplayListBuilder* aBuilder);
+  virtual nsRect GetBounds(nsDisplayListBuilder* aBuilder, bool* aSnap);
   virtual void Paint(nsDisplayListBuilder* aBuilder, nsRenderingContext* aCtx);
   virtual bool ComputeVisibility(nsDisplayListBuilder* aBuilder,
                                    nsRegion* aVisibleRegion,
                                    const nsRect& aAllowVisibleRegionExpansion);
   virtual bool TryMerge(nsDisplayListBuilder* aBuilder, nsDisplayItem* aItem);
   NS_DISPLAY_DECL_NAME("Clip", TYPE_CLIP)
   virtual PRUint32 GetPerFrameKey() { return 0; }
   
@@ -1982,17 +1981,18 @@ public:
   nsDisplayClipRoundedRect(nsDisplayListBuilder* aBuilder, nsIFrame* aFrame,
                            nsDisplayList* aList,
                            const nsRect& aRect, nscoord aRadii[8]);
 #ifdef NS_BUILD_REFCNT_LOGGING
   virtual ~nsDisplayClipRoundedRect();
 #endif
 
   virtual nsRegion GetOpaqueRegion(nsDisplayListBuilder* aBuilder,
-                                   bool* aForceTransparentSurface = nsnull);
+                                   bool* aSnap,
+                                   bool* aForceTransparentSurface);
   virtual void HitTest(nsDisplayListBuilder* aBuilder, const nsRect& aRect,
                        HitTestState* aState, nsTArray<nsIFrame*> *aOutFrames);
   virtual bool ComputeVisibility(nsDisplayListBuilder* aBuilder,
                                    nsRegion* aVisibleRegion,
                                    const nsRect& aAllowVisibleRegionExpansion);
   virtual bool TryMerge(nsDisplayListBuilder* aBuilder, nsDisplayItem* aItem);
   NS_DISPLAY_DECL_NAME("ClipRoundedRect", TYPE_CLIP_ROUNDED_RECT)
 
@@ -2022,17 +2022,17 @@ public:
    */
   nsDisplayZoom(nsDisplayListBuilder* aBuilder, nsIFrame* aFrame,
                 nsDisplayList* aList,
                 PRInt32 aAPD, PRInt32 aParentAPD);
 #ifdef NS_BUILD_REFCNT_LOGGING
   virtual ~nsDisplayZoom();
 #endif
   
-  virtual nsRect GetBounds(nsDisplayListBuilder* aBuilder);
+  virtual nsRect GetBounds(nsDisplayListBuilder* aBuilder, bool* aSnap);
   virtual void Paint(nsDisplayListBuilder* aBuilder, nsRenderingContext* aCtx);
   virtual void HitTest(nsDisplayListBuilder* aBuilder, const nsRect& aRect,
                        HitTestState* aState, nsTArray<nsIFrame*> *aOutFrames);
   virtual bool ComputeVisibility(nsDisplayListBuilder* aBuilder,
                                    nsRegion* aVisibleRegion,
                                    const nsRect& aAllowVisibleRegionExpansion);
   NS_DISPLAY_DECL_NAME("Zoom", TYPE_ZOOM)
 
@@ -2053,20 +2053,22 @@ class nsDisplaySVGEffects : public nsDis
 public:
   nsDisplaySVGEffects(nsDisplayListBuilder* aBuilder, nsIFrame* aFrame,
                       nsDisplayList* aList);
 #ifdef NS_BUILD_REFCNT_LOGGING
   virtual ~nsDisplaySVGEffects();
 #endif
   
   virtual nsRegion GetOpaqueRegion(nsDisplayListBuilder* aBuilder,
-                                   bool* aForceTransparentSurface = nsnull);
+                                   bool* aSnap,
+                                   bool* aForceTransparentSurface);
   virtual void HitTest(nsDisplayListBuilder* aBuilder, const nsRect& aRect,
                        HitTestState* aState, nsTArray<nsIFrame*> *aOutFrames);
-  virtual nsRect GetBounds(nsDisplayListBuilder* aBuilder) {
+  virtual nsRect GetBounds(nsDisplayListBuilder* aBuilder, bool* aSnap) {
+    *aSnap = false;
     return mBounds + aBuilder->ToReferenceFrame(mEffectsFrame);
   }
   virtual void Paint(nsDisplayListBuilder* aBuilder, nsRenderingContext* aCtx);
   virtual bool ComputeVisibility(nsDisplayListBuilder* aBuilder,
                                    nsRegion* aVisibleRegion,
                                    const nsRect& aAllowVisibleRegionExpansion);  
   virtual bool TryMerge(nsDisplayListBuilder* aBuilder, nsDisplayItem* aItem);
   NS_DISPLAY_DECL_NAME("SVGEffects", TYPE_SVG_EFFECTS)
@@ -2125,26 +2127,28 @@ public:
 #endif
 
   NS_DISPLAY_DECL_NAME("nsDisplayTransform", TYPE_TRANSFORM);
 
   virtual nsRect GetComponentAlphaBounds(nsDisplayListBuilder* aBuilder)
   {
     if (mStoredList.GetComponentAlphaBounds(aBuilder).IsEmpty())
       return nsRect();
-    return GetBounds(aBuilder);
+    bool snap;
+    return GetBounds(aBuilder, &snap);
   }
 
   nsDisplayWrapList* GetStoredList() { return &mStoredList; }
 
   virtual void HitTest(nsDisplayListBuilder *aBuilder, const nsRect& aRect,
                        HitTestState *aState, nsTArray<nsIFrame*> *aOutFrames);
-  virtual nsRect GetBounds(nsDisplayListBuilder *aBuilder);
+  virtual nsRect GetBounds(nsDisplayListBuilder *aBuilder, bool* aSnap);
   virtual nsRegion GetOpaqueRegion(nsDisplayListBuilder *aBuilder,
-                                   bool* aForceTransparentSurface = nsnull);
+                                   bool* aSnap,
+                                   bool* aForceTransparentSurface);
   virtual bool IsUniform(nsDisplayListBuilder *aBuilder, nscolor* aColor);
   virtual LayerState GetLayerState(nsDisplayListBuilder* aBuilder,
                                    LayerManager* aManager);
   virtual already_AddRefed<Layer> BuildLayer(nsDisplayListBuilder* aBuilder,
                                              LayerManager* aManager,
                                              const ContainerParameters& aContainerParameters);
   virtual bool ComputeVisibility(nsDisplayListBuilder *aBuilder,
                                    nsRegion *aVisibleRegion,
--- a/layout/base/nsLayoutDebugger.cpp
+++ b/layout/base/nsLayoutDebugger.cpp
@@ -165,17 +165,18 @@ PrintDisplayListTo(nsDisplayListBuilder*
     fprintf(aOutput, "<li>");
     nsIFrame* f = i->GetUnderlyingFrame();
     nsAutoString fName;
 #ifdef DEBUG
     if (f) {
       f->GetFrameName(fName);
     }
 #endif
-    nsRect rect = i->GetBounds(aBuilder);
+    bool snap;
+    nsRect rect = i->GetBounds(aBuilder, &snap);
     switch (i->GetType()) {
       case nsDisplayItem::TYPE_CLIP:
       case nsDisplayItem::TYPE_CLIP_ROUNDED_RECT: {
         nsDisplayClip* c = static_cast<nsDisplayClip*>(i);
         rect = c->GetClipRect();
         break;
       }
       default:
@@ -186,17 +187,18 @@ PrintDisplayListTo(nsDisplayListBuilder*
     nsDisplayList* list = i->GetList();
     nsRegion opaque;
     if (i->GetType() == nsDisplayItem::TYPE_TRANSFORM) {
         nsDisplayTransform* t = static_cast<nsDisplayTransform*>(i);
         list = t->GetStoredList()->GetList();
     }
 #ifdef DEBUG
     if (!list || list->DidComputeVisibility()) {
-      opaque = i->GetOpaqueRegion(aBuilder);
+      bool forceTransparentSurface;
+      opaque = i->GetOpaqueRegion(aBuilder, &snap, &forceTransparentSurface);
     }
 #endif
     if (i->Painted()) {
       nsCString string(i->Name());
       string.Append("-");
       string.AppendInt((PRUint64)i);
       fprintf(aOutput, "<a href=\"javascript:ViewImage('%s')\">", string.BeginReading());
     }
--- a/layout/base/nsLayoutUtils.cpp
+++ b/layout/base/nsLayoutUtils.cpp
@@ -1602,20 +1602,16 @@ nsLayoutUtils::PaintFrame(nsRenderingCon
     builder.SetSyncDecodeImages(true);
   }
   if (aFlags & (PAINT_WIDGET_LAYERS | PAINT_TO_WINDOW)) {
     builder.SetPaintingToWindow(true);
   }
   if (aFlags & PAINT_IGNORE_SUPPRESSION) {
     builder.IgnorePaintSuppression();
   }
-  if (aRenderingContext &&
-      aRenderingContext->ThebesContext()->GetFlags() & gfxContext::FLAG_DISABLE_SNAPPING) {
-    builder.SetSnappingEnabled(false);
-  }
   nsRect canvasArea(nsPoint(0, 0), aFrame->GetSize());
 
 #ifdef DEBUG
   if (ignoreViewportScrolling) {
     nsIDocument* doc = aFrame->GetContent() ?
       aFrame->GetContent()->GetCurrentDoc() : nsnull;
     NS_ASSERTION(!aFrame->GetParent() ||
                  (doc && doc->IsBeingUsedAsImage()),
--- a/layout/base/nsPresShell.cpp
+++ b/layout/base/nsPresShell.cpp
@@ -4598,17 +4598,18 @@ PresShell::ClipListToRange(nsDisplayList
         else if (content->GetCurrentDoc() ==
                    aRange->GetStartParent()->GetCurrentDoc()) {
           // if the node is within the range, append it to the temporary list
           bool before, after;
           nsresult rv =
             nsRange::CompareNodeToRange(content, aRange, &before, &after);
           if (NS_SUCCEEDED(rv) && !before && !after) {
             itemToInsert = i;
-            surfaceRect.UnionRect(surfaceRect, i->GetBounds(aBuilder));
+            bool snap;
+            surfaceRect.UnionRect(surfaceRect, i->GetBounds(aBuilder, &snap));
           }
         }
       }
     }
 
     // insert the item into the list if necessary. If the item has a child
     // list, insert that as well
     nsDisplayList* sublist = i->GetList();
--- a/layout/forms/nsButtonFrameRenderer.cpp
+++ b/layout/forms/nsButtonFrameRenderer.cpp
@@ -101,24 +101,25 @@ public:
 #ifdef NS_BUILD_REFCNT_LOGGING
   virtual ~nsDisplayButtonBoxShadowOuter() {
     MOZ_COUNT_DTOR(nsDisplayButtonBoxShadowOuter);
   }
 #endif  
   
   virtual void Paint(nsDisplayListBuilder* aBuilder,
                      nsRenderingContext* aCtx);
-  virtual nsRect GetBounds(nsDisplayListBuilder* aBuilder);
+  virtual nsRect GetBounds(nsDisplayListBuilder* aBuilder, bool* aSnap);
   NS_DISPLAY_DECL_NAME("ButtonBoxShadowOuter", TYPE_BUTTON_BOX_SHADOW_OUTER)
 private:
   nsButtonFrameRenderer* mBFR;
 };
 
 nsRect
-nsDisplayButtonBoxShadowOuter::GetBounds(nsDisplayListBuilder* aBuilder) {
+nsDisplayButtonBoxShadowOuter::GetBounds(nsDisplayListBuilder* aBuilder, bool* aSnap) {
+  *aSnap = false;
   return mFrame->GetVisualOverflowRectRelativeToSelf() + ToReferenceFrame();
 }
 
 void
 nsDisplayButtonBoxShadowOuter::Paint(nsDisplayListBuilder* aBuilder,
                                      nsRenderingContext* aCtx) {
   nsRect frameRect = nsRect(ToReferenceFrame(), mFrame->GetSize());
 
--- a/layout/forms/nsSelectsAreaFrame.cpp
+++ b/layout/forms/nsSelectsAreaFrame.cpp
@@ -144,17 +144,18 @@ public:
     MOZ_COUNT_CTOR(nsDisplayListFocus);
   }
 #ifdef NS_BUILD_REFCNT_LOGGING
   virtual ~nsDisplayListFocus() {
     MOZ_COUNT_DTOR(nsDisplayListFocus);
   }
 #endif
 
-  virtual nsRect GetBounds(nsDisplayListBuilder* aBuilder) {
+  virtual nsRect GetBounds(nsDisplayListBuilder* aBuilder, bool* aSnap) {
+    *aSnap = false;
     // override bounds because the list item focus ring may extend outside
     // the nsSelectsAreaFrame
     nsListControlFrame* listFrame = GetEnclosingListFrame(GetUnderlyingFrame());
     return listFrame->GetVisualOverflowRectRelativeToSelf() +
            aBuilder->ToReferenceFrame(listFrame);
   }
   virtual void Paint(nsDisplayListBuilder* aBuilder,
                      nsRenderingContext* aCtx) {
--- a/layout/generic/TextOverflow.cpp
+++ b/layout/generic/TextOverflow.cpp
@@ -185,17 +185,18 @@ public:
       mAscent(aAscent), mIndex(aIndex) {
     MOZ_COUNT_CTOR(nsDisplayTextOverflowMarker);
   }
 #ifdef NS_BUILD_REFCNT_LOGGING
   virtual ~nsDisplayTextOverflowMarker() {
     MOZ_COUNT_DTOR(nsDisplayTextOverflowMarker);
   }
 #endif
-  virtual nsRect GetBounds(nsDisplayListBuilder* aBuilder) {
+  virtual nsRect GetBounds(nsDisplayListBuilder* aBuilder, bool* aSnap) {
+    *aSnap = false;
     nsRect shadowRect =
       nsLayoutUtils::GetTextShadowRectsUnion(mRect, mFrame);
     return mRect.Union(shadowRect);
   }
   virtual void Paint(nsDisplayListBuilder* aBuilder,
                      nsRenderingContext* aCtx);
 
   virtual PRUint32 GetPerFrameKey() { 
--- a/layout/generic/nsBulletFrame.cpp
+++ b/layout/generic/nsBulletFrame.cpp
@@ -208,31 +208,33 @@ public:
     MOZ_COUNT_CTOR(nsDisplayBullet);
   }
 #ifdef NS_BUILD_REFCNT_LOGGING
   virtual ~nsDisplayBullet() {
     MOZ_COUNT_DTOR(nsDisplayBullet);
   }
 #endif
 
-  virtual nsRect GetBounds(nsDisplayListBuilder* aBuilder)
+  virtual nsRect GetBounds(nsDisplayListBuilder* aBuilder, bool* aSnap)
   {
+    *aSnap = false;
     return mFrame->GetVisualOverflowRectRelativeToSelf() + ToReferenceFrame();
   }
   virtual void HitTest(nsDisplayListBuilder* aBuilder, const nsRect& aRect,
                        HitTestState* aState, nsTArray<nsIFrame*> *aOutFrames) {
     aOutFrames->AppendElement(mFrame);
   }
   virtual void Paint(nsDisplayListBuilder* aBuilder,
                      nsRenderingContext* aCtx);
   NS_DISPLAY_DECL_NAME("Bullet", TYPE_BULLET)
 
   virtual nsRect GetComponentAlphaBounds(nsDisplayListBuilder* aBuilder)
   {
-    return GetBounds(aBuilder);
+    bool snap;
+    return GetBounds(aBuilder, &snap);
   }
 };
 
 void nsDisplayBullet::Paint(nsDisplayListBuilder* aBuilder,
                             nsRenderingContext* aCtx)
 {
   static_cast<nsBulletFrame*>(mFrame)->
     PaintBullet(*aCtx, ToReferenceFrame(), mVisibleRect);
--- a/layout/generic/nsCanvasFrame.cpp
+++ b/layout/generic/nsCanvasFrame.cpp
@@ -248,18 +248,19 @@ public:
     : nsDisplayItem(aBuilder, aFrame)
   {
     MOZ_COUNT_CTOR(nsDisplayCanvasFocus);
   }
   virtual ~nsDisplayCanvasFocus() {
     MOZ_COUNT_DTOR(nsDisplayCanvasFocus);
   }
 
-  virtual nsRect GetBounds(nsDisplayListBuilder* aBuilder)
+  virtual nsRect GetBounds(nsDisplayListBuilder* aBuilder, bool* aSnap)
   {
+    *aSnap = false;
     // This is an overestimate, but that's not a problem.
     nsCanvasFrame* frame = static_cast<nsCanvasFrame*>(mFrame);
     return frame->CanvasArea() + ToReferenceFrame();
   }
 
   virtual void Paint(nsDisplayListBuilder* aBuilder,
                      nsRenderingContext* aCtx)
   {
--- a/layout/generic/nsCanvasFrame.h
+++ b/layout/generic/nsCanvasFrame.h
@@ -157,53 +157,50 @@ class nsDisplayCanvasBackground : public
 public:
   nsDisplayCanvasBackground(nsDisplayListBuilder* aBuilder, nsIFrame *aFrame)
     : nsDisplayBackground(aBuilder, aFrame)
   {
     mExtraBackgroundColor = NS_RGBA(0,0,0,0);
   }
 
   virtual bool ComputeVisibility(nsDisplayListBuilder* aBuilder,
-                                   nsRegion* aVisibleRegion,
-                                   const nsRect& aAllowVisibleRegionExpansion)
+                                 nsRegion* aVisibleRegion,
+                                 const nsRect& aAllowVisibleRegionExpansion)
   {
     return NS_GET_A(mExtraBackgroundColor) > 0 ||
       nsDisplayBackground::ComputeVisibility(aBuilder, aVisibleRegion,
                                              aAllowVisibleRegionExpansion);
   }
   virtual nsRegion GetOpaqueRegion(nsDisplayListBuilder* aBuilder,
-                                   bool* aForceTransparentSurface = nsnull)
+                                   bool* aSnap,
+                                   bool* aForceTransparentSurface)
   {
-    if (aForceTransparentSurface) {
+    if (NS_GET_A(mExtraBackgroundColor) == 255) {
       *aForceTransparentSurface = false;
+      return nsRegion(GetBounds(aBuilder, aSnap));
     }
-    if (NS_GET_A(mExtraBackgroundColor) == 255)
-      return nsRegion(GetBounds(aBuilder));
-    return nsDisplayBackground::GetOpaqueRegion(aBuilder);
+    return nsDisplayBackground::GetOpaqueRegion(aBuilder, aSnap,
+                                                aForceTransparentSurface);
   }
   virtual bool IsUniform(nsDisplayListBuilder* aBuilder, nscolor* aColor)
   {
     nscolor background;
     if (!nsDisplayBackground::IsUniform(aBuilder, &background))
       return false;
     NS_ASSERTION(background == NS_RGBA(0,0,0,0),
                  "The nsDisplayBackground for a canvas frame doesn't paint "
                  "its background color normally");
     *aColor = mExtraBackgroundColor;
     return true;
   }
-  virtual nsRect GetBounds(nsDisplayListBuilder* aBuilder)
+  virtual nsRect GetBounds(nsDisplayListBuilder* aBuilder, bool* aSnap)
   {
     nsCanvasFrame* frame = static_cast<nsCanvasFrame*>(mFrame);
-    nsRect r = frame->CanvasArea() + ToReferenceFrame();
-    if (mSnappingEnabled) {
-      nscoord appUnitsPerDevPixel = frame->PresContext()->AppUnitsPerDevPixel();
-      r = r.ToNearestPixels(appUnitsPerDevPixel).ToAppUnits(appUnitsPerDevPixel);
-    }
-    return r;
+    *aSnap = true;
+    return frame->CanvasArea() + ToReferenceFrame();
   }
   virtual void HitTest(nsDisplayListBuilder* aBuilder, const nsRect& aRect,
                        HitTestState* aState, nsTArray<nsIFrame*> *aOutFrames)
   {
     // We need to override so we don't consider border-radius.
     aOutFrames->AppendElement(mFrame);
   }
 
--- a/layout/generic/nsHTMLCanvasFrame.cpp
+++ b/layout/generic/nsHTMLCanvasFrame.cpp
@@ -77,30 +77,31 @@ public:
   virtual ~nsDisplayCanvas() {
     MOZ_COUNT_DTOR(nsDisplayCanvas);
   }
 #endif
 
   NS_DISPLAY_DECL_NAME("nsDisplayCanvas", TYPE_CANVAS)
 
   virtual nsRegion GetOpaqueRegion(nsDisplayListBuilder* aBuilder,
-                                   bool* aForceTransparentSurface = nsnull) {
-    if (aForceTransparentSurface) {
-      *aForceTransparentSurface = false;
-    }
+                                   bool* aSnap,
+                                   bool* aForceTransparentSurface) {
+    *aForceTransparentSurface = false;
+    *aSnap = false;
     nsIFrame* f = GetUnderlyingFrame();
     nsHTMLCanvasElement *canvas = CanvasElementFromContent(f->GetContent());
     nsRegion result;
     if (canvas->GetIsOpaque()) {
-      result = GetBounds(aBuilder);
+      result = GetBounds(aBuilder, aSnap);
     }
     return result;
   }
 
-  virtual nsRect GetBounds(nsDisplayListBuilder* aBuilder) {
+  virtual nsRect GetBounds(nsDisplayListBuilder* aBuilder, bool* aSnap) {
+    *aSnap = false;
     nsHTMLCanvasFrame* f = static_cast<nsHTMLCanvasFrame*>(GetUnderlyingFrame());
     return f->GetInnerArea() + ToReferenceFrame();
   }
 
   virtual already_AddRefed<Layer> BuildLayer(nsDisplayListBuilder* aBuilder,
                                              LayerManager* aManager,
                                              const ContainerParameters& aContainerParameters)
   {
--- a/layout/generic/nsObjectFrame.cpp
+++ b/layout/generic/nsObjectFrame.cpp
@@ -912,17 +912,17 @@ public:
     MOZ_COUNT_CTOR(nsDisplayPluginReadback);
   }
 #ifdef NS_BUILD_REFCNT_LOGGING
   virtual ~nsDisplayPluginReadback() {
     MOZ_COUNT_DTOR(nsDisplayPluginReadback);
   }
 #endif
 
-  virtual nsRect GetBounds(nsDisplayListBuilder* aBuilder);
+  virtual nsRect GetBounds(nsDisplayListBuilder* aBuilder, bool* aSnap);
   virtual bool ComputeVisibility(nsDisplayListBuilder* aBuilder,
                                    nsRegion* aVisibleRegion,
                                    const nsRect& aAllowVisibleRegionExpansion);
 
   NS_DISPLAY_DECL_NAME("PluginReadback", TYPE_PLUGIN_READBACK)
 
   virtual already_AddRefed<Layer> BuildLayer(nsDisplayListBuilder* aBuilder,
                                              LayerManager* aManager,
@@ -941,70 +941,75 @@ public:
 static nsRect
 GetDisplayItemBounds(nsDisplayListBuilder* aBuilder, nsDisplayItem* aItem, nsIFrame* aFrame)
 {
   // XXX For slightly more accurate region computations we should pixel-snap this
   return aFrame->GetContentRectRelativeToSelf() + aItem->ToReferenceFrame();
 }
 
 nsRect
-nsDisplayPluginReadback::GetBounds(nsDisplayListBuilder* aBuilder)
+nsDisplayPluginReadback::GetBounds(nsDisplayListBuilder* aBuilder, bool* aSnap)
 {
+  *aSnap = false;
   return GetDisplayItemBounds(aBuilder, this, mFrame);
 }
 
 bool
 nsDisplayPluginReadback::ComputeVisibility(nsDisplayListBuilder* aBuilder,
                                            nsRegion* aVisibleRegion,
                                            const nsRect& aAllowVisibleRegionExpansion)
 {
   if (!nsDisplayItem::ComputeVisibility(aBuilder, aVisibleRegion,
                                         aAllowVisibleRegionExpansion))
     return false;
 
   nsRect expand;
-  expand.IntersectRect(aAllowVisibleRegionExpansion, GetBounds(aBuilder));
+  bool snap;
+  expand.IntersectRect(aAllowVisibleRegionExpansion, GetBounds(aBuilder, &snap));
   // *Add* our bounds to the visible region so that stuff underneath us is
   // likely to be made visible, so we can use it for a background! This is
   // a bit crazy since we normally only subtract from the visible region.
   aVisibleRegion->Or(*aVisibleRegion, expand);
   return true;
 }
 
 nsRect
-nsDisplayPlugin::GetBounds(nsDisplayListBuilder* aBuilder)
+nsDisplayPlugin::GetBounds(nsDisplayListBuilder* aBuilder, bool* aSnap)
 {
+  *aSnap = false;
   return GetDisplayItemBounds(aBuilder, this, mFrame);
 }
 
 void
 nsDisplayPlugin::Paint(nsDisplayListBuilder* aBuilder,
                        nsRenderingContext* aCtx)
 {
   nsObjectFrame* f = static_cast<nsObjectFrame*>(mFrame);
-  f->PaintPlugin(aBuilder, *aCtx, mVisibleRect, GetBounds(aBuilder));
+  bool snap;
+  f->PaintPlugin(aBuilder, *aCtx, mVisibleRect, GetBounds(aBuilder, &snap));
 }
 
 bool
 nsDisplayPlugin::ComputeVisibility(nsDisplayListBuilder* aBuilder,
                                    nsRegion* aVisibleRegion,
                                    const nsRect& aAllowVisibleRegionExpansion)
 {
-  mVisibleRegion.And(*aVisibleRegion, GetBounds(aBuilder));  
+  bool snap;
+  mVisibleRegion.And(*aVisibleRegion, GetBounds(aBuilder, &snap));
   return nsDisplayItem::ComputeVisibility(aBuilder, aVisibleRegion,
                                           aAllowVisibleRegionExpansion);
 }
 
 nsRegion
 nsDisplayPlugin::GetOpaqueRegion(nsDisplayListBuilder* aBuilder,
+                                 bool* aSnap,
                                  bool* aForceTransparentSurface)
 {
-  if (aForceTransparentSurface) {
-    *aForceTransparentSurface = false;
-  }
+  *aForceTransparentSurface = false;
+  *aSnap = false;
   nsRegion result;
   nsObjectFrame* f = static_cast<nsObjectFrame*>(mFrame);
   if (!aBuilder->IsForPluginGeometry()) {
     nsIWidget* widget = f->GetWidget();
     if (widget) {
       nsTArray<nsIntRect> clip;
       widget->GetWindowClipRegion(&clip);
       nsTArray<nsIWidget::Configuration> configuration;
@@ -1013,21 +1018,23 @@ nsDisplayPlugin::GetOpaqueRegion(nsDispl
       if (clip != configuration[0].mClipRegion) {
         // Something has clipped us unexpectedly. Perhaps there is a translucent
         // chrome element overlaying us that forced us to be clipped away. Treat
         // us as non-opaque since we may have holes.
     	return result;
       }
     }
   }
-  if (f->IsOpaque() &&
-      (aBuilder->IsForPluginGeometry() ||
-       (f->GetPaintedRect(this) + ToReferenceFrame()).Contains(GetBounds(aBuilder)))) {
-    // We can treat this as opaque
-    result = GetBounds(aBuilder);
+  if (f->IsOpaque()) {
+    nsRect bounds = GetBounds(aBuilder, aSnap);
+    if (aBuilder->IsForPluginGeometry() ||
+        (f->GetPaintedRect(this) + ToReferenceFrame()).Contains(bounds)) {
+      // We can treat this as opaque
+      result = bounds;
+    }
   }
   return result;
 }
 
 void
 nsDisplayPlugin::GetWidgetConfiguration(nsDisplayListBuilder* aBuilder,
                                         nsTArray<nsIWidget::Configuration>* aConfigurations)
 {
--- a/layout/generic/nsObjectFrame.h
+++ b/layout/generic/nsObjectFrame.h
@@ -294,19 +294,20 @@ public:
     MOZ_COUNT_CTOR(nsDisplayPlugin);
   }
 #ifdef NS_BUILD_REFCNT_LOGGING
   virtual ~nsDisplayPlugin() {
     MOZ_COUNT_DTOR(nsDisplayPlugin);
   }
 #endif
 
-  virtual nsRect GetBounds(nsDisplayListBuilder* aBuilder);
+  virtual nsRect GetBounds(nsDisplayListBuilder* aBuilder, bool* aSnap);
   virtual nsRegion GetOpaqueRegion(nsDisplayListBuilder* aBuilder,
-                                   bool* aForceTransparentSurface = nsnull);
+                                   bool* aSnap,
+                                   bool* aForceTransparentSurface);
   virtual void Paint(nsDisplayListBuilder* aBuilder,
                      nsRenderingContext* aCtx);
   virtual bool ComputeVisibility(nsDisplayListBuilder* aBuilder,
                                    nsRegion* aVisibleRegion,
                                    const nsRect& aAllowVisibleRegionExpansion);
 
   NS_DISPLAY_DECL_NAME("Plugin", TYPE_PLUGIN)
 
--- a/layout/generic/nsTextFrameThebes.cpp
+++ b/layout/generic/nsTextFrameThebes.cpp
@@ -4384,32 +4384,34 @@ public:
     MOZ_COUNT_CTOR(nsDisplayText);
   }
 #ifdef NS_BUILD_REFCNT_LOGGING
   virtual ~nsDisplayText() {
     MOZ_COUNT_DTOR(nsDisplayText);
   }
 #endif
 
-  virtual nsRect GetBounds(nsDisplayListBuilder* aBuilder) {
+  virtual nsRect GetBounds(nsDisplayListBuilder* aBuilder, bool* aSnap) {
+    *aSnap = false;
     return mFrame->GetVisualOverflowRectRelativeToSelf() + ToReferenceFrame();
   }
   virtual void HitTest(nsDisplayListBuilder* aBuilder, const nsRect& aRect,
                        HitTestState* aState, nsTArray<nsIFrame*> *aOutFrames) {
     if (nsRect(ToReferenceFrame(), mFrame->GetSize()).Intersects(aRect)) {
       aOutFrames->AppendElement(mFrame);
     }
   }
   virtual void Paint(nsDisplayListBuilder* aBuilder,
                      nsRenderingContext* aCtx);
   NS_DISPLAY_DECL_NAME("Text", TYPE_TEXT)
 
   virtual nsRect GetComponentAlphaBounds(nsDisplayListBuilder* aBuilder)
   {
-    return GetBounds(aBuilder);
+    bool snap;
+    return GetBounds(aBuilder, &snap);
   }
 
   virtual void DisableComponentAlpha() { mDisableSubpixelAA = true; }
 
   bool mDisableSubpixelAA;
 };
 
 void
--- a/layout/generic/nsVideoFrame.cpp
+++ b/layout/generic/nsVideoFrame.cpp
@@ -190,16 +190,18 @@ nsVideoFrame::BuildLayer(nsDisplayListBu
 {
   nsRect area = GetContentRect() - GetPosition() + aItem->ToReferenceFrame();
   nsHTMLVideoElement* element = static_cast<nsHTMLVideoElement*>(GetContent());
   nsIntSize videoSize = element->GetVideoSize(nsIntSize(0, 0));
   if (videoSize.width <= 0 || videoSize.height <= 0 || area.IsEmpty())
     return nsnull;
 
   nsRefPtr<ImageContainer> container = element->GetImageContainer();
+  if (!container)
+    return nsnull;
   
   // Retrieve the size of the decoded video frame, before being scaled
   // by pixel aspect ratio.
   gfxIntSize frameSize = container->GetCurrentSize();
   if (frameSize.width == 0 || frameSize.height == 0) {
     // No image, or zero-sized image. No point creating a layer.
     return nsnull;
   }
@@ -338,18 +340,19 @@ public:
   // It would be great if we could override GetOpaqueRegion to return nonempty here,
   // but it's probably not safe to do so in general. Video frames are
   // updated asynchronously from decoder threads, and it's possible that
   // we might have an opaque video frame when GetOpaqueRegion is called, but
   // when we come to paint, the video frame is transparent or has gone
   // away completely (e.g. because of a decoder error). The problem would
   // be especially acute if we have off-main-thread rendering.
 
-  virtual nsRect GetBounds(nsDisplayListBuilder* aBuilder)
+  virtual nsRect GetBounds(nsDisplayListBuilder* aBuilder, bool* aSnap)
   {
+    *aSnap = false;
     nsIFrame* f = GetUnderlyingFrame();
     return f->GetContentRect() - f->GetPosition() + ToReferenceFrame();
   }
 
   virtual already_AddRefed<Layer> BuildLayer(nsDisplayListBuilder* aBuilder,
                                              LayerManager* aManager,
                                              const ContainerParameters& aContainerParameters)
   {
--- a/layout/ipc/RenderFrameParent.h
+++ b/layout/ipc/RenderFrameParent.h
@@ -193,18 +193,19 @@ public:
                         nsIFrame* aFrame,
                         nsRect aRect,
                         ViewID aId)
     : nsDisplayItem(aBuilder, aFrame)
     , mRect(aRect)
     , mId(aId)
   {}
 
-  NS_OVERRIDE nsRect GetBounds(nsDisplayListBuilder* aBuilder)
+  NS_OVERRIDE nsRect GetBounds(nsDisplayListBuilder* aBuilder, bool* aSnap)
   {
+    *aSnap = false;
     return mRect;
   }
 
   virtual PRUint32 GetPerFrameKey()
   {
     NS_ABORT();
     return 0;
   }
--- a/layout/mathml/nsMathMLChar.cpp
+++ b/layout/mathml/nsMathMLChar.cpp
@@ -1904,17 +1904,18 @@ public:
     MOZ_COUNT_CTOR(nsDisplayMathMLCharForeground);
   }
 #ifdef NS_BUILD_REFCNT_LOGGING
   virtual ~nsDisplayMathMLCharForeground() {
     MOZ_COUNT_DTOR(nsDisplayMathMLCharForeground);
   }
 #endif
 
-  virtual nsRect GetBounds(nsDisplayListBuilder* aBuilder) {
+  virtual nsRect GetBounds(nsDisplayListBuilder* aBuilder, bool* aSnap) {
+    *aSnap = false;
     nsRect rect;
     mChar->GetRect(rect);
     nsPoint offset = ToReferenceFrame() + rect.TopLeft();
     nsBoundingMetrics bm;
     mChar->GetBoundingMetrics(bm);
     return nsRect(offset.x + bm.leftBearing, offset.y,
                   bm.rightBearing - bm.leftBearing, bm.ascent + bm.descent);
   }
@@ -1925,17 +1926,18 @@ public:
     mChar->PaintForeground(mFrame->PresContext(), *aCtx,
                            ToReferenceFrame(), mIsSelected);
   }
 
   NS_DISPLAY_DECL_NAME("MathMLCharForeground", TYPE_MATHML_CHAR_FOREGROUND)
 
   virtual nsRect GetComponentAlphaBounds(nsDisplayListBuilder* aBuilder)
   {
-    return GetBounds(aBuilder);
+    bool snap;
+    return GetBounds(aBuilder, &snap);
   }
 
 private:
   nsMathMLChar* mChar;
   bool          mIsSelected;
 };
 
 #ifdef NS_DEBUG
--- a/layout/reftests/text-overflow/reftest.list
+++ b/layout/reftests/text-overflow/reftest.list
@@ -2,17 +2,17 @@
 HTTP(..) == marker-basic.html marker-basic-ref.html
 HTTP(..) == marker-string.html marker-string-ref.html
 skip-if(Android) HTTP(..) == bidi-simple.html bidi-simple-ref.html # Fails on Android due to anti-aliasing
 skip-if(!gtk2Widget) HTTP(..) == bidi-simple-scrolled.html bidi-simple-scrolled-ref.html # Fails on Windows and OSX due to anti-aliasing
 HTTP(..) == scroll-rounding.html scroll-rounding-ref.html
 HTTP(..) == anonymous-block.html anonymous-block-ref.html
 HTTP(..) == false-marker-overlap.html false-marker-overlap-ref.html
 HTTP(..) == visibility-hidden.html visibility-hidden-ref.html
-fails-if(Android&&layersOpenGL) HTTP(..) == block-padding.html block-padding-ref.html
+fails-if(Android) HTTP(..) == block-padding.html block-padding-ref.html
 HTTP(..) == quirks-decorations.html quirks-decorations-ref.html
 HTTP(..) == quirks-line-height.html quirks-line-height-ref.html
 HTTP(..) == standards-decorations.html standards-decorations-ref.html
 HTTP(..) == standards-line-height.html standards-line-height-ref.html
 HTTP(..) == selection.html selection-ref.html
 HTTP(..) == marker-shadow.html marker-shadow-ref.html
 == aligned-baseline.html aligned-baseline-ref.html
 skip-if(Android) == clipped-elements.html clipped-elements-ref.html
--- a/layout/tables/nsTableCellFrame.cpp
+++ b/layout/tables/nsTableCellFrame.cpp
@@ -396,35 +396,36 @@ public:
 #endif
 
   virtual void HitTest(nsDisplayListBuilder* aBuilder, const nsRect& aRect,
                        HitTestState* aState, nsTArray<nsIFrame*> *aOutFrames) {
     aOutFrames->AppendElement(mFrame);
   }
   virtual void Paint(nsDisplayListBuilder* aBuilder,
                      nsRenderingContext* aCtx);
-  virtual nsRect GetBounds(nsDisplayListBuilder* aBuilder);
+  virtual nsRect GetBounds(nsDisplayListBuilder* aBuilder, bool* aSnap);
 
   NS_DISPLAY_DECL_NAME("TableCellBackground", TYPE_TABLE_CELL_BACKGROUND)
 };
 
 void nsDisplayTableCellBackground::Paint(nsDisplayListBuilder* aBuilder,
                                          nsRenderingContext* aCtx)
 {
   static_cast<nsTableCellFrame*>(mFrame)->
     PaintBackground(*aCtx, mVisibleRect, ToReferenceFrame(),
                     aBuilder->GetBackgroundPaintFlags());
 }
 
 nsRect
-nsDisplayTableCellBackground::GetBounds(nsDisplayListBuilder* aBuilder)
+nsDisplayTableCellBackground::GetBounds(nsDisplayListBuilder* aBuilder,
+                                        bool* aSnap)
 {
   // revert from nsDisplayTableItem's implementation ... cell backgrounds
   // don't overflow the cell
-  return nsDisplayItem::GetBounds(aBuilder);
+  return nsDisplayItem::GetBounds(aBuilder, aSnap);
 }
 
 static void
 PaintTableCellSelection(nsIFrame* aFrame, nsRenderingContext* aCtx,
                         const nsRect& aRect, nsPoint aPt)
 {
   static_cast<nsTableCellFrame*>(aFrame)->DecorateForSelection(*aCtx, aPt);
 }
--- a/layout/tables/nsTableFrame.cpp
+++ b/layout/tables/nsTableFrame.cpp
@@ -1057,17 +1057,18 @@ nsTableFrame::GetChildList(ChildListID a
 void
 nsTableFrame::GetChildLists(nsTArray<ChildList>* aLists) const
 {
   nsContainerFrame::GetChildLists(aLists);
   mColGroups.AppendIfNonempty(aLists, kColGroupList);
 }
 
 nsRect
-nsDisplayTableItem::GetBounds(nsDisplayListBuilder* aBuilder) {
+nsDisplayTableItem::GetBounds(nsDisplayListBuilder* aBuilder, bool* aSnap) {
+  *aSnap = false;
   return mFrame->GetVisualOverflowRectRelativeToSelf() + ToReferenceFrame();
 }
 
 bool
 nsDisplayTableItem::IsVaryingRelativeToMovingFrame(nsDisplayListBuilder* aBuilder,
                                                    nsIFrame* aFrame)
 {
   if (!mPartHasFixedBackground)
--- a/layout/tables/nsTableFrame.h
+++ b/layout/tables/nsTableFrame.h
@@ -73,17 +73,17 @@ public:
       mPartHasFixedBackground(false) {}
 
   virtual bool IsVaryingRelativeToMovingFrame(nsDisplayListBuilder* aBuilder,
                                                 nsIFrame* aFrame);
   // With collapsed borders, parts of the collapsed border can extend outside
   // the table part frames, so allow this display element to blow out to our
   // overflow rect. This is also useful for row frames that have spanning
   // cells extending outside them.
-  virtual nsRect GetBounds(nsDisplayListBuilder* aBuilder);
+  virtual nsRect GetBounds(nsDisplayListBuilder* aBuilder, bool* aSnap);
 
   void UpdateForFrameBackground(nsIFrame* aFrame);
 
 private:
   bool mPartHasFixedBackground;
 };
 
 class nsAutoPushCurrentTableItem
--- a/layout/xul/base/src/nsTextBoxFrame.cpp
+++ b/layout/xul/base/src/nsTextBoxFrame.cpp
@@ -320,17 +320,17 @@ public:
 #ifdef NS_BUILD_REFCNT_LOGGING
   virtual ~nsDisplayXULTextBox() {
     MOZ_COUNT_DTOR(nsDisplayXULTextBox);
   }
 #endif
 
   virtual void Paint(nsDisplayListBuilder* aBuilder,
                      nsRenderingContext* aCtx);
-  virtual nsRect GetBounds(nsDisplayListBuilder* aBuilder);
+  virtual nsRect GetBounds(nsDisplayListBuilder* aBuilder, bool* aSnap);
   NS_DISPLAY_DECL_NAME("XULTextBox", TYPE_XUL_TEXT_BOX)
 
   virtual nsRect GetComponentAlphaBounds(nsDisplayListBuilder* aBuilder);
 
   virtual void DisableComponentAlpha() { mDisableSubpixelAA = true; }
 
   void PaintTextToContext(nsRenderingContext* aCtx,
                           nsPoint aOffset,
@@ -373,17 +373,18 @@ nsDisplayXULTextBox::PaintTextToContext(
                                         nsPoint aOffset,
                                         const nscolor* aColor)
 {
   static_cast<nsTextBoxFrame*>(mFrame)->
     PaintTitle(*aCtx, mVisibleRect, ToReferenceFrame() + aOffset, aColor);
 }
 
 nsRect
-nsDisplayXULTextBox::GetBounds(nsDisplayListBuilder* aBuilder) {
+nsDisplayXULTextBox::GetBounds(nsDisplayListBuilder* aBuilder, bool* aSnap) {
+  *aSnap = false;
   return mFrame->GetVisualOverflowRectRelativeToSelf() + ToReferenceFrame();
 }
 
 nsRect
 nsDisplayXULTextBox::GetComponentAlphaBounds(nsDisplayListBuilder* aBuilder)
 {
   return static_cast<nsTextBoxFrame*>(mFrame)->GetComponentAlphaBounds() +
       ToReferenceFrame();
--- a/mfbt/Assertions.cpp
+++ b/mfbt/Assertions.cpp
@@ -42,16 +42,20 @@
 #include "mozilla/Types.h"
 
 #include <cstdio>
 #include <cstdlib>
 #ifndef WIN32
 #include <signal.h>
 #endif
 
+#ifdef ANDROID
+#include <android/log.h>
+#endif
+
 /* Implementations of runtime and static assertion macros for C and C++. */
 
 extern "C" {
 
 MOZ_EXPORT_API(void)
 MOZ_Crash()
 {
   /*
@@ -63,29 +67,41 @@ MOZ_Crash()
 
 #if defined(WIN32)
   /*
    * We used to call DebugBreak() on Windows, but amazingly, it causes
    * the MSVS 2010 debugger not to be able to recover a call stack.
    */
   *((volatile int *) NULL) = 123;
   exit(3);
+#elif defined(ANDROID)
+  /*
+   * On Android, raise(SIGABRT) is handled asynchronously. Seg fault now
+   * so we crash immediately and capture the current call stack.
+   */
+  *((volatile int *) NULL) = 123;
+  abort();
 #elif defined(__APPLE__)
   /*
    * On Mac OS X, Breakpad ignores signals. Only real Mach exceptions are
    * trapped.
    */
   *((volatile int *) NULL) = 123;  /* To continue from here in GDB: "return" then "continue". */
   raise(SIGABRT);  /* In case above statement gets nixed by the optimizer. */
 #else
   raise(SIGABRT);  /* To continue from here in GDB: "signal 0". */
 #endif
 }
 
 MOZ_EXPORT_API(void)
 MOZ_Assert(const char* s, const char* file, int ln)
 {
+#ifdef ANDROID
+  __android_log_print(ANDROID_LOG_FATAL, "MOZ_Assert",
+                      "Assertion failure: %s, at %s:%d\n", s, file, ln);
+#else
   fprintf(stderr, "Assertion failure: %s, at %s:%d\n", s, file, ln);
   fflush(stderr);
+#endif
   MOZ_Crash();
 }
 
 }
--- a/mobile/android/app/mobile.js
+++ b/mobile/android/app/mobile.js
@@ -701,8 +701,11 @@ pref("media.realtime_decoder.enabled", t
 
 pref("dom.report_all_js_exceptions", true);
 pref("javascript.options.showInConsole", true);
 
 pref("full-screen-api.enabled", true);
 
 pref("direct-texture.force.enabled", false);
 pref("direct-texture.force.disabled", false);
+
+pref("remote-debugger.enabled", false);
+pref("remote-debugger.port", 6000);
--- a/mobile/android/base/Tab.java
+++ b/mobile/android/base/Tab.java
@@ -120,17 +120,17 @@ public final class Tab {
         mHistoryIndex = -1;
         mBookmark = false;
         mDoorHangers = new HashMap<String, DoorHanger>();
         mFaviconLoadId = 0;
         mDocumentURI = "";
         mContentType = "";
         mPluginViews = new ArrayList<View>();
         mPluginLayers = new HashMap<Surface, Layer>();
-        mState = STATE_LOADING;
+        setState(STATE_LOADING);
         mContentResolver = Tabs.getInstance().getContentResolver();
         mContentObserver = new ContentObserver(GeckoAppShell.getHandler()) {
             public void onChange(boolean selfChange) {
                 updateBookmark();
             }
         };
         BrowserDB.registerBookmarkObserver(mContentResolver, mContentObserver);
     }
@@ -319,17 +319,21 @@ public final class Tab {
                 }
             });
         } else {
             Log.e(LOGTAG, "Requested title update on empty history stack");
         }
     }
 
     public void setState(int state) {
-        mState = state;
+        // Pages implemented in Java are not bound by Gecko state
+        if ("about:home".equals(mUrl))
+            mState = STATE_SUCCESS;
+        else
+            mState = state;
     }
 
     public int getState() {
         return mState;
     }
 
     public void setHasTouchListeners(boolean aValue) {
         mHasTouchListeners = aValue;
--- a/mobile/android/base/db/BrowserContract.java.in
+++ b/mobile/android/base/db/BrowserContract.java.in
@@ -55,16 +55,18 @@ public class BrowserContract {
 
     public static final String DEFAULT_PROFILE = "default";
     public static final String PARAM_PROFILE = "profile";
     public static final String PARAM_PROFILE_PATH = "profilePath";
     public static final String PARAM_LIMIT = "limit";
     public static final String PARAM_IS_SYNC = "sync";
     public static final String PARAM_SHOW_DELETED = "show_deleted";
     public static final String PARAM_IS_TEST = "test";
+    public static final String PARAM_INSERT_IF_NEEDED = "insert_if_needed";
+    public static final String PARAM_INCREMENT_VISITS = "increment_visits";
 
     public interface CommonColumns {
         public static final String _ID = "_id";
     }
 
     public interface SyncColumns {
         public static final String GUID = "guid";
         public static final String DATE_CREATED = "created";
--- a/mobile/android/base/db/BrowserProvider.java.in
+++ b/mobile/android/base/db/BrowserProvider.java.in
@@ -61,23 +61,23 @@ import android.text.TextUtils;
 import android.util.Log;
 
 public class BrowserProvider extends ContentProvider {
     private static final String LOGTAG = "GeckoBrowserProvider";
     private Context mContext;
 
     static final String DATABASE_NAME = "browser.db";
 
-    static final int DATABASE_VERSION = 6;
+    static final int DATABASE_VERSION = 8;
 
     // Maximum age of deleted records to be cleaned up (20 days in ms)
     static final long MAX_AGE_OF_DELETED_RECORDS = 86400000 * 20;
 
     // Number of records marked as deleted to be removed
-    static final long DELETED_RECORDS_PURGE_LIMIT = 7;
+    static final long DELETED_RECORDS_PURGE_LIMIT = 5;
 
     // How many records to reposition in a single query.
     // This should be less than the SQLite maximum number of query variables
     // (currently 999) divided by the number of variables used per positioning
     // query (currently 3).
     static final int MAX_POSITION_UPDATES_PER_QUERY = 100;
 
     static final String TABLE_BOOKMARKS = "bookmarks";
@@ -805,16 +805,50 @@ public class BrowserProvider extends Con
                 } while (cursor.moveToNext());
             }
 
             migrateBookmarksTable(db);
             migrateHistoryTable(db);
             migrateImagesTable(db);
         }
 
+        private void upgradeDatabaseFrom7to8(SQLiteDatabase db) {
+            debug("Combining history entries with the same URL");
+
+            final String TABLE_DUPES = "duped_urls";
+            final String TOTAL = "total";
+            final String LATEST = "latest";
+            final String WINNER = "winner";
+
+            db.execSQL("CREATE TEMP TABLE " + TABLE_DUPES + " AS" +
+                      " SELECT " + History.URL + ", " +
+                                  "SUM(" + History.VISITS + ") AS " + TOTAL + ", " +
+                                  "MAX(" + History.DATE_MODIFIED + ") AS " + LATEST + ", " +
+                                  "MAX(" + History._ID + ") AS " + WINNER +
+                      " FROM " + TABLE_HISTORY +
+                      " GROUP BY " + History.URL +
+                      " HAVING count(" + History.URL + ") > 1");
+
+            db.execSQL("CREATE UNIQUE INDEX " + TABLE_DUPES + "_url_index ON " +
+                       TABLE_DUPES + " (" + History.URL + ")");
+
+            final String fromClause = " FROM " + TABLE_DUPES + " WHERE " +
+                                      qualifyColumn(TABLE_DUPES, History.URL) + " = " +
+                                      qualifyColumn(TABLE_HISTORY, History.URL);
+
+            db.execSQL("UPDATE " + TABLE_HISTORY +
+                      " SET " + History.VISITS + " = (SELECT " + TOTAL + fromClause + "), " +
+                                History.DATE_MODIFIED + " = (SELECT " + LATEST + fromClause + "), " +
+                                History.IS_DELETED + " = " +
+                                    "(" + History._ID + " <> (SELECT " + WINNER + fromClause + "))" +
+                      " WHERE " + History.URL + " IN (SELECT " + History.URL + " FROM " + TABLE_DUPES + ")");
+
+            db.execSQL("DROP TABLE " + TABLE_DUPES);
+        }
+
         @Override
         public void onUpgrade(SQLiteDatabase db, int oldVersion, int newVersion) {
             debug("Upgrading browser.db: " + db.getPath() + " from " +
                     oldVersion + " to " + newVersion);
 
             db.beginTransaction();
 
             // We have to do incremental upgrades until we reach the current
@@ -839,16 +873,19 @@ public class BrowserProvider extends Con
 
                     case 6:
                         upgradeDatabaseFrom5to6(db);
                         break;
 
                     case 7:
                         upgradeDatabaseFrom6to7(db);
                         break;
+
+                    case 8:
+                        upgradeDatabaseFrom7to8(db);
                  }
              }
 
              db.setTransactionSuccessful();
              db.endTransaction();
         }
 
         @Override
@@ -1036,16 +1073,26 @@ public class BrowserProvider extends Con
         return !TextUtils.isEmpty(isTest);
     }
 
     private boolean shouldShowDeleted(Uri uri) {
         String showDeleted = uri.getQueryParameter(BrowserContract.PARAM_SHOW_DELETED);
         return !TextUtils.isEmpty(showDeleted);
     }
 
+    private boolean shouldUpdateOrInsert(Uri uri) {
+        String insertIfNeeded = uri.getQueryParameter(BrowserContract.PARAM_INSERT_IF_NEEDED);
+        return Boolean.parseBoolean(insertIfNeeded);
+    }
+
+    private boolean shouldIncrementVisits(Uri uri) {
+        String incrementVisits = uri.getQueryParameter(BrowserContract.PARAM_INCREMENT_VISITS);
+        return Boolean.parseBoolean(incrementVisits);
+    }
+
     @Override
     public boolean onCreate() {
         debug("Creating BrowserProvider");
 
         GeckoBackgroundThread.post(new Runnable() {
             @Override
             public void run() {
                 // Kick this off early. It is synchronized so that other callers will wait
@@ -1251,39 +1298,17 @@ public class BrowserProvider extends Con
 
                 debug("Inserting bookmark in database with URL: " + url);
                 id = db.insertOrThrow(TABLE_BOOKMARKS, Bookmarks.TITLE, values);
                 break;
             }
 
             case HISTORY: {
                 trace("Insert on HISTORY: " + uri);
-
-                long now = System.currentTimeMillis();
-                values.put(History.DATE_CREATED, now);
-                values.put(History.DATE_MODIFIED, now);
-
-                // Generate GUID for new history entry. Don't override specified GUIDs.
-                if (!values.containsKey(History.GUID)) {
-                  values.put(History.GUID, Utils.generateGuid());
-                }
-
-                String url = values.getAsString(History.URL);
-
-                ContentValues imageValues = extractImageValues(values,
-                        values.getAsString(History.URL));
-
-                if (imageValues != null) {
-                    debug("Inserting history image for URL: " + url);
-                    updateOrInsertImage(uri, imageValues, Images.URL + " = ?",
-                            new String[] { url });
-                }
-
-                debug("Inserting history in database with URL: " + url);
-                id = db.insertOrThrow(TABLE_HISTORY, History.VISITS, values);
+                id = insertHistory(uri, values);
                 break;
             }
 
             case IMAGES: {
                 trace("Insert on IMAGES: " + uri);
 
                 long now = System.currentTimeMillis();
                 values.put(History.DATE_CREATED, now);
@@ -1386,17 +1411,20 @@ public class BrowserProvider extends Con
                 debug("Update on HISTORY_ID: " + uri);
 
                 selection = DBUtils.concatenateWhere(selection, TABLE_HISTORY + "._id = ?");
                 selectionArgs = DBUtils.appendSelectionArgs(selectionArgs,
                         new String[] { Long.toString(ContentUris.parseId(uri)) });
                 // fall through
             case HISTORY: {
                 debug("Updating history: " + uri);
-                updated = updateHistory(uri, values, selection, selectionArgs);
+                if (shouldUpdateOrInsert(uri))
+                    updated = updateOrInsertHistory(uri, values, selection, selectionArgs);
+                else
+                    updated = updateHistory(uri, values, selection, selectionArgs);
                 break;
             }
 
             case IMAGES: {
                 debug("Update on IMAGES: " + uri);
 
                 String url = values.getAsString(Images.URL);
 
@@ -1820,25 +1848,70 @@ public class BrowserProvider extends Con
         } finally {
             if (cursor != null)
                 cursor.close();
         }
 
         return updated;
     }
 
+    long insertHistory(Uri uri, ContentValues values) {
+        final SQLiteDatabase db = getWritableDatabase(uri);
+
+        long now = System.currentTimeMillis();
+        values.put(History.DATE_CREATED, now);
+        values.put(History.DATE_MODIFIED, now);
+
+        // Generate GUID for new history entry. Don't override specified GUIDs.
+        if (!values.containsKey(History.GUID)) {
+          values.put(History.GUID, Utils.generateGuid());
+        }
+
+        String url = values.getAsString(History.URL);
+        ContentValues imageValues = extractImageValues(values, url);
+
+        if (imageValues != null) {
+            debug("Inserting history image for URL: " + url);
+            updateOrInsertImage(uri, imageValues, Images.URL + " = ?",
+                    new String[] { url });
+        }
+
+        debug("Inserting history in database with URL: " + url);
+        return db.insertOrThrow(TABLE_HISTORY, History.VISITS, values);
+    }
+
+    int updateOrInsertHistory(Uri uri, ContentValues values, String selection,
+            String[] selectionArgs) {
+        int updated = updateHistory(uri, values, selection, selectionArgs);
+        if (updated > 0)
+            return updated;
+
+        // Insert a new entry if necessary
+        if (!values.containsKey(History.VISITS))
+            values.put(History.VISITS, 1);
+        if (!values.containsKey(History.TITLE))
+            values.put(History.TITLE, values.getAsString(History.URL));
+
+        insertHistory(uri, values);
+
+        // Return 0 if we added a new row
+        return 0;
+    }
+
     int updateHistory(Uri uri, ContentValues values, String selection,
             String[] selectionArgs) {
         trace("Updating history on URI: " + uri);
 
         final SQLiteDatabase db = getWritableDatabase(uri);
         int updated = 0;
 
-        final String[] historyProjection = new String[] { History._ID, // 0
-                History.URL, // 1
+        final String[] historyProjection = new String[] {
+            History._ID,   // 0
+            History.URL,   // 1
+            History.VISITS // 2
         };
 
         Cursor cursor = db.query(TABLE_HISTORY, historyProjection, selection,
                 selectionArgs, null, null, null);
 
         try {
             values.put(History.DATE_MODIFIED, System.currentTimeMillis());
 
@@ -1850,16 +1923,24 @@ public class BrowserProvider extends Con
 
             ContentValues imageValues = extractImageValues(values, url);
 
             while (cursor.moveToNext()) {
                 long id = cursor.getLong(0);
 
                 trace("Updating history entry with ID: " + id);
 
+                if (shouldIncrementVisits(uri)) {
+                    long existing = cursor.getLong(2);
+                    Long additional = values.getAsLong(History.VISITS);
+
+                    // Increment visit count by a specified amount, or default to increment by 1
+                    values.put(History.VISITS, existing + ((additional != null) ? additional.longValue() : 1));
+                }
+
                 updated += db.update(TABLE_HISTORY, values, "_id = ?",
                         new String[] { Long.toString(id) });
 
                 if (imageValues == null)
                     continue;
 
                 if (!updatingUrl) {
                     url = cursor.getString(1);
--- a/mobile/android/base/db/FormHistoryProvider.java.in
+++ b/mobile/android/base/db/FormHistoryProvider.java.in
@@ -147,27 +147,24 @@ public class FormHistoryProvider extends
         GeckoAppShell.sendEventToGecko(GeckoEvent.createBroadcastEvent("FormHistory:Init", null));
     }
 
     @Override
     public void onPreInsert(ContentValues values, Uri uri, SQLiteBridge db) {
         if (!values.containsKey(FormHistory.GUID)) {
             return;
         }
+
         String guid = values.getAsString(FormHistory.GUID);
-        try {
-            if (guid == null) {
-                db.delete(TABLE_DELETED_FORM_HISTORY, WHERE_GUID_IS_NULL, null);
-                return;
-            }
-            String[] args = new String[] { guid };
-            db.delete(TABLE_DELETED_FORM_HISTORY, WHERE_GUID_IS_VALUE, args);
-        } catch(SQLiteBridgeException ex) {
-            Log.w(getLogTag(), "Error removing entry with GUID " + guid, ex);
+        if (guid == null) {
+            db.delete(TABLE_DELETED_FORM_HISTORY, WHERE_GUID_IS_NULL, null);
+            return;
         }
+        String[] args = new String[] { guid };
+        db.delete(TABLE_DELETED_FORM_HISTORY, WHERE_GUID_IS_VALUE, args);
      }
 
     @Override
     public void onPreUpdate(ContentValues values, Uri uri, SQLiteBridge db) { }
 
     @Override
     public void onPostQuery(Cursor cursor, Uri uri, SQLiteBridge db) { }
 }
--- a/mobile/android/base/db/GeckoProvider.java.in
+++ b/mobile/android/base/db/GeckoProvider.java.in
@@ -5,16 +5,18 @@
 #filter substitution
 package @ANDROID_PACKAGE_NAME@.db;
 
 import java.io.File;
 import java.io.IOException;
 import java.lang.IllegalArgumentException;
 import java.util.HashMap;
 import java.util.ArrayList;
+import java.util.Collection;
+import java.util.Iterator;
 import java.util.Random;
 
 import org.mozilla.gecko.GeckoApp;
 import org.mozilla.gecko.GeckoAppShell;
 import org.mozilla.gecko.GeckoProfile;
 import org.mozilla.gecko.GeckoEvent;
 import org.mozilla.gecko.GeckoEventListener;
 import org.mozilla.gecko.db.BrowserContract.CommonColumns;
@@ -54,16 +56,40 @@ import android.util.Log;
 
 public abstract class GeckoProvider extends ContentProvider {
     private String mLogTag = "GeckoPasswordsProvider";
     private String mDBName = "";
     private int mDBVersion = 0;
     private HashMap<String, SQLiteBridge> mDatabasePerProfile;
     protected Context mContext = null;
 
+    @Override
+    public void shutdown() {
+        if (mDatabasePerProfile == null)
+          return;
+
+        Collection<SQLiteBridge> bridges = mDatabasePerProfile.values();
+        Iterator<SQLiteBridge> it = bridges.iterator();
+
+        while (it.hasNext()) {
+            SQLiteBridge bridge = it.next();
+            if (bridge != null) {
+                try {
+                    bridge.close();
+                } catch (Exception ex) { }
+            }
+        }
+
+        mDatabasePerProfile = null;
+    }
+
+    public void finalize() {
+        shutdown();
+    }
+
     protected void setLogTag(String aLogTag) {
         mLogTag = aLogTag;
     }
 
     protected String getLogTag() {
         return mLogTag;
     }
 
@@ -86,21 +112,24 @@ public abstract class GeckoProvider exte
     private SQLiteBridge getDB(Context context, final String databasePath) {
         SQLiteBridge bridge = null;
 
         boolean dbNeedsSetup = true;
         try {
             String resourcePath = context.getPackageResourcePath();
             GeckoAppShell.loadSQLiteLibs(context, resourcePath);
             GeckoAppShell.loadNSSLibs(context, resourcePath);
-            bridge = new SQLiteBridge(databasePath);
+            bridge = SQLiteBridge.openDatabase(databasePath, null, 0);
             int version = bridge.getVersion();
-            Log.i(mLogTag, version + " == " + mDBVersion);
             dbNeedsSetup = version != mDBVersion;
-        } catch(SQLiteBridgeException ex) {
+        } catch (SQLiteBridgeException ex) {
+            // close the database
+            if (bridge != null)
+                bridge.close();
+
             // this will throw if the database can't be found
             // we should attempt to set it up if Gecko is running
             dbNeedsSetup = true;
             Log.e(mLogTag, "Error getting version ", ex);
 
             // if Gecko is not running, we should bail out. Otherwise we try to
             // let Gecko build the database for us
             if (!GeckoApp.checkLaunchState(GeckoApp.LaunchState.GeckoRunning)) {
@@ -112,17 +141,18 @@ public abstract class GeckoProvider exte
         // If the database is not set up yet, or is the wrong schema version, we send an initialize
         // call to Gecko. Gecko will handle building the database file correctly, as well as any
         // migrations that are necessary
         if (dbNeedsSetup) {
             Log.i(mLogTag, "Sending init to gecko");
             bridge = null;
             initGecko();
         }
-        mDatabasePerProfile.put(databasePath, bridge);
+        if (bridge != null)
+            mDatabasePerProfile.put(databasePath, bridge);
 
         return bridge;
     }
 
     private SQLiteBridge getDatabaseForProfile(String profile) {
         if (TextUtils.isEmpty(profile)) {
             Log.d(mLogTag, "No profile provided, using default");
             profile = BrowserContract.DEFAULT_PROFILE;
@@ -199,16 +229,17 @@ public abstract class GeckoProvider exte
         final SQLiteBridge db = getDatabase(uri);
         if (db == null)
             return deleted;
 
         try {
             deleted = db.delete(getTable(uri), selection, selectionArgs);
         } catch (SQLiteBridgeException ex) {
             Log.e(mLogTag, "Error deleting record", ex);
+            throw ex;
         }
 
         return deleted;
     }
 
     @Override
     public Uri insert(Uri uri, ContentValues values) {
         long id = -1;
@@ -217,45 +248,94 @@ public abstract class GeckoProvider exte
         // If we can not get a SQLiteBridge instance, its likely that the database
         // has not been set up and Gecko is not running. We return null and expect
         // callers to try again later
         if (db == null)
             return null;
 
         setupDefaults(uri, values);
 
-        onPreInsert(values, uri, db);
-
+        boolean useTransaction = !db.inTransaction();
         try {
+            if (useTransaction) {
+                db.beginTransaction();
+            }
+ 
+            // onPreInsert does a check for the item in the deleted table in some cases
+            // so we put it inside this transaction
+            onPreInsert(values, uri, db);
             id = db.insert(getTable(uri), null, values);
-        } catch(SQLiteBridgeException ex) {
+
+            if (useTransaction) {
+                db.setTransactionSuccessful();
+            }
+        } catch (SQLiteBridgeException ex) {
             Log.e(mLogTag, "Error inserting in db", ex);
+            throw ex;
+        } finally {
+            if (useTransaction) {
+                db.endTransaction();
+            }
         }
 
         return ContentUris.withAppendedId(uri, id);
     }
 
     @Override
+    public int bulkInsert(Uri uri, ContentValues[] allValues) {
+        final SQLiteBridge db = getDatabase(uri);
+        // If we can not get a SQLiteBridge instance, its likely that the database
+        // has not been set up and Gecko is not running. We return 0 and expect
+        // callers to try again later
+        if (db == null)
+            return 0;
+
+        long id = -1;
+        int rowsAdded = 0;
+
+        String table = getTable(uri);
+
+        try {
+            db.beginTransaction();
+            for (ContentValues initialValues : allValues) {
+                ContentValues values = new ContentValues(initialValues);
+                setupDefaults(uri, values);
+                onPreInsert(values, uri, db);
+                id = db.insert(table, null, values);
+                rowsAdded++;
+            }
+            db.setTransactionSuccessful();
+        } catch (SQLiteBridgeException ex) {
+            Log.e(mLogTag, "Error inserting in db", ex);
+            throw ex;
+        } finally {
+            db.endTransaction();
+        }
+        return rowsAdded;
+    }
+
+    @Override
     public int update(Uri uri, ContentValues values, String selection,
             String[] selectionArgs) {
         int updated = 0;
         final SQLiteBridge db = getDatabase(uri);
 
         // If we can not get a SQLiteBridge instance, its likely that the database
         // has not been set up and Gecko is not running. We return null and expect
         // callers to try again later
         if (db == null)
             return updated;
 
         onPreUpdate(values, uri, db);
 
         try {
             updated = db.update(getTable(uri), values, selection, selectionArgs);
-        } catch(SQLiteBridgeException ex) {
+        } catch (SQLiteBridgeException ex) {
             Log.e(mLogTag, "Error updating table", ex);
+            throw ex;
         }
 
         return updated;
     }
 
     @Override
     public Cursor query(Uri uri, String[] projection, String selection,
             String[] selectionArgs, String sortOrder) {
@@ -270,16 +350,17 @@ public abstract class GeckoProvider exte
 
         sortOrder = getSortOrder(uri, sortOrder);
 
         try {
             cursor = db.query(getTable(uri), projection, selection, selectionArgs, null, null, sortOrder, null);
             onPostQuery(cursor, uri, db);
         } catch (SQLiteBridgeException ex) {
             Log.e(mLogTag, "Error querying database", ex);
+            throw ex;
         }
 
         return cursor;
     }
 
     public abstract String getTable(Uri uri);
 
     public abstract String getSortOrder(Uri uri, String aRequested);
--- a/mobile/android/base/db/LocalBrowserDB.java
+++ b/mobile/android/base/db/LocalBrowserDB.java
@@ -86,16 +86,17 @@ public class LocalBrowserDB implements B
     private Boolean mDesktopBookmarksExist;
 
     private final Uri mBookmarksUriWithProfile;
     private final Uri mParentsUriWithProfile;
     private final Uri mHistoryUriWithProfile;
     private final Uri mImagesUriWithProfile;
     private final Uri mCombinedUriWithProfile;
     private final Uri mDeletedHistoryUriWithProfile;
+    private final Uri mUpdateHistoryUriWithProfile;
 
     private static final String[] DEFAULT_BOOKMARK_COLUMNS =
             new String[] { Bookmarks._ID,
                            Bookmarks.GUID,
                            Bookmarks.URL,
                            Bookmarks.TITLE,
                            Bookmarks.TYPE,
                            Bookmarks.PARENT,
@@ -110,16 +111,20 @@ public class LocalBrowserDB implements B
         mBookmarksUriWithProfile = appendProfile(Bookmarks.CONTENT_URI);
         mParentsUriWithProfile = appendProfile(Bookmarks.PARENTS_CONTENT_URI);
         mHistoryUriWithProfile = appendProfile(History.CONTENT_URI);
         mImagesUriWithProfile = appendProfile(Images.CONTENT_URI);
         mCombinedUriWithProfile = appendProfile(Combined.CONTENT_URI);
 
         mDeletedHistoryUriWithProfile = mHistoryUriWithProfile.buildUpon().
             appendQueryParameter(BrowserContract.PARAM_SHOW_DELETED, "1").build();
+
+        mUpdateHistoryUriWithProfile = mHistoryUriWithProfile.buildUpon().
+            appendQueryParameter(BrowserContract.PARAM_INCREMENT_VISITS, "true").
+            appendQueryParameter(BrowserContract.PARAM_INSERT_IF_NEEDED, "true").build();
     }
 
     // Invalidate cached data
     public void invalidateCachedState() {
         mDesktopBookmarksExist = null;
     }
 
     private Uri historyUriWithLimit(int limit) {
@@ -226,60 +231,33 @@ public class LocalBrowserDB implements B
             }
         } finally {
             if (cursor != null)
                 cursor.close();
         }
     }
 
     public void updateVisitedHistory(ContentResolver cr, String uri) {
-        long now = System.currentTimeMillis();
-        Cursor cursor = null;
-
-        try {
-            final String[] projection = new String[] {
-                    History._ID,    // 0
-                    History.VISITS, // 1
-            };
+        ContentValues values = new ContentValues();
 
-            cursor = cr.query(mDeletedHistoryUriWithProfile,
-                              projection,
-                              History.URL + " = ?",
-                              new String[] { uri },
-                              null);
-
-            if (cursor.moveToFirst()) {
-                ContentValues values = new ContentValues();
-
-                values.put(History.VISITS, cursor.getInt(1) + 1);
-                values.put(History.DATE_LAST_VISITED, now);
+        values.put(History.URL, uri);
+        values.put(History.DATE_LAST_VISITED, System.currentTimeMillis());
+        values.put(History.IS_DELETED, 0);
 
-                // Restore deleted record if possible
-                values.put(History.IS_DELETED, 0);
-
-                Uri historyUri = ContentUris.withAppendedId(History.CONTENT_URI, cursor.getLong(0));
-                cr.update(appendProfile(historyUri), values, null, null);
-            } else {
-                // Ensure we don't blow up our database with too
-                // many history items.
-                truncateHistory(cr);
-
-                ContentValues values = new ContentValues();
+        // This will insert a new history entry if one for this URL
+        // doesn't already exist
+        int updated = cr.update(mUpdateHistoryUriWithProfile,
+                                values,
+                                History.URL + " = ?",
+                                new String[] { uri });
 
-                values.put(History.URL, uri);
-                values.put(History.VISITS, 1);
-                values.put(History.DATE_LAST_VISITED, now);
-                values.put(History.TITLE, uri);
-
-                cr.insert(mHistoryUriWithProfile, values);
-            }
-        } finally {
-            if (cursor != null)
-                cursor.close();
-        }
+        // If we added a new row, ensure we don't blow up our database
+        // with too many history items.
+        if (updated == 0)
+            truncateHistory(cr);
     }
 
     public void updateHistoryTitle(ContentResolver cr, String uri, String title) {
         ContentValues values = new ContentValues();
         values.put(History.TITLE, title);
 
         cr.update(mHistoryUriWithProfile,
                   values,
--- a/mobile/android/base/db/PasswordsProvider.java.in
+++ b/mobile/android/base/db/PasswordsProvider.java.in
@@ -212,26 +212,22 @@ public class PasswordsProvider extends G
         }
         return result;
     }
 
     @Override
     public void onPreInsert(ContentValues values, Uri uri, SQLiteBridge db) {
         if (values.containsKey(Passwords.GUID)) {
             String guid = values.getAsString(Passwords.GUID);
-            try {
-                if (guid == null) {
-                    db.delete(TABLE_DELETED_PASSWORDS, WHERE_GUID_IS_NULL, null);
-                    return;
-                }
-                String[] args = new String[] { guid };
-                db.delete(TABLE_DELETED_PASSWORDS, WHERE_GUID_IS_VALUE, args);
-            } catch(SQLiteBridgeException ex) {
-                Log.w(getLogTag(), "Error removing entry with GUID " + guid, ex);
+            if (guid == null) {
+                db.delete(TABLE_DELETED_PASSWORDS, WHERE_GUID_IS_NULL, null);
+                return;
             }
+            String[] args = new String[] { guid };
+            db.delete(TABLE_DELETED_PASSWORDS, WHERE_GUID_IS_VALUE, args);
         }
 
         if (values.containsKey(Passwords.ENCRYPTED_PASSWORD)) {
             String res = doCrypto(values.getAsString(Passwords.ENCRYPTED_PASSWORD), uri, true);
             values.put(Passwords.ENCRYPTED_PASSWORD, res);
         }
 
         if (values.containsKey(Passwords.ENCRYPTED_USERNAME)) {
--- a/mobile/android/base/gfx/LayerRenderer.java
+++ b/mobile/android/base/gfx/LayerRenderer.java
@@ -412,33 +412,31 @@ public class LayerRenderer implements GL
                     mFrameRateLayer = TextLayer.create(frameRateLayerSize, "-- ms/--");
                     moveFrameRateLayer(mView.getWidth(), mView.getHeight());
                 }
                 mProfileRender = Log.isLoggable(PROFTAG, Log.DEBUG);
             }
         }).start();
     }
 
-    private void updateCheckerboardLayer(RenderContext renderContext) {
+    private void updateCheckerboardImage() {
         int checkerboardColor = mView.getController().getCheckerboardColor();
         boolean showChecks = mView.getController().checkerboardShouldShowChecks();
         if (checkerboardColor == mCheckerboardImage.getColor() &&
             showChecks == mCheckerboardImage.getShowChecks()) {
             return;
         }
 
         mCheckerboardLayer.beginTransaction();  // called on compositor thread
         try {
             mCheckerboardImage.update(showChecks, checkerboardColor);
             mCheckerboardLayer.invalidate();
         } finally {
             mCheckerboardLayer.endTransaction();
         }
-
-        mCheckerboardLayer.update(renderContext);   // called on compositor thread
     }
 
     /*
      * create a vertex shader type (GLES20.GL_VERTEX_SHADER)
      * or a fragment shader type (GLES20.GL_FRAGMENT_SHADER)
      */
     public static int loadShader(int type, String shaderCode) {
         int shader = GLES20.glCreateShader(type);
@@ -532,17 +530,18 @@ public class LayerRenderer implements GL
                 }
             }
             mLastPageContext = mPageContext;
 
             /* Update layers. */
             if (rootLayer != null) mUpdated &= rootLayer.update(mPageContext);  // called on compositor thread
             mUpdated &= mBackgroundLayer.update(mScreenContext);    // called on compositor thread
             mUpdated &= mShadowLayer.update(mPageContext);  // called on compositor thread
-            updateCheckerboardLayer(mScreenContext);
+            updateCheckerboardImage();
+            mUpdated &= mCheckerboardLayer.update(mScreenContext);   // called on compositor thread
             if (mFrameRateLayer != null) mUpdated &= mFrameRateLayer.update(mScreenContext); // called on compositor thread
             mUpdated &= mVertScrollLayer.update(mPageContext);  // called on compositor thread
             mUpdated &= mHorizScrollLayer.update(mPageContext); // called on compositor thread
 
             for (Layer layer : mExtraLayers)
                 mUpdated &= layer.update(mPageContext); // called on compositor thread
 
             GLES20.glDisable(GLES20.GL_SCISSOR_TEST);
--- a/mobile/android/base/sqlite/SQLiteBridge.java
+++ b/mobile/android/base/sqlite/SQLiteBridge.java
@@ -3,49 +3,64 @@
  * You can obtain one at http://mozilla.org/MPL/2.0/. */
 
 package org.mozilla.gecko.sqlite;
 
 import org.mozilla.gecko.sqlite.SQLiteBridgeException;
 import org.mozilla.gecko.sqlite.MatrixBlobCursor;
 import android.content.ContentValues;
 import android.database.Cursor;
+import android.database.sqlite.SQLiteDatabase;
+import android.database.sqlite.SQLiteException;
+import android.database.DatabaseErrorHandler;
 import android.text.TextUtils;
-import android.util.Log;
 
 import java.lang.String;
 import java.util.ArrayList;
 import java.util.HashMap;
 import java.util.Iterator;
 import java.util.List;
+import android.util.Log;
 import java.util.Map.Entry;
 import java.util.Set;
 
 /*
  * This class allows using the mozsqlite3 library included with Firefox
  * to read SQLite databases, instead of the Android SQLiteDataBase API,
  * which might use whatever outdated DB is present on the Android system.
  */
 public class SQLiteBridge {
     private static final String LOGTAG = "SQLiteBridge";
 
-    // Path to the database. We reopen it every query.
+    // Path to the database. If this database was not opened with openDatabase, we reopen it every query.
     private String mDb;
+    // pointer to the database if it was opened with openDatabase
+    protected long mDbPointer = 0;
 
     // Values remembered after a query.
     private long[] mQueryResults;
 
+    private boolean mTransactionSuccess = false;
+    private boolean mInTransaction = false;
+
     private static final int RESULT_INSERT_ROW_ID = 0;
     private static final int RESULT_ROWS_CHANGED = 1;
 
     // JNI code in $(topdir)/mozglue/android/..
     private static native MatrixBlobCursor sqliteCall(String aDb, String aQuery,
                                                       String[] aParams,
                                                       long[] aUpdateResult)
         throws SQLiteBridgeException;
+    private static native MatrixBlobCursor sqliteCallWithDb(long aDb, String aQuery,
+                                                            String[] aParams,
+                                                            long[] aUpdateResult)
+        throws SQLiteBridgeException;
+    private static native long openDatabase(String aDb)
+        throws SQLiteBridgeException;
+    private static native void closeDatabase(long aDb);
 
     // Takes the path to the database we want to access.
     public SQLiteBridge(String aDb) throws SQLiteBridgeException {
         mDb = aDb;
     }
 
     // Executes a simple line of sql.
     public void execSQL(String sql)
@@ -116,27 +131,33 @@ public class SQLiteBridge {
     /* This method is referenced by Robocop via reflection. */
     public Cursor rawQuery(String sql, String[] selectionArgs)
         throws SQLiteBridgeException {
         return internalQuery(sql, selectionArgs);
     }
 
     public long insert(String table, String nullColumnHack, ContentValues values)
                throws SQLiteBridgeException {
-        Set<Entry<String, Object>> valueSet = values.valueSet();
-        Iterator<Entry<String, Object>> valueIterator = valueSet.iterator();
+        if (values == null)
+            return 0;
+
         ArrayList<String> valueNames = new ArrayList<String>();
         ArrayList<String> valueBinds = new ArrayList<String>();
         ArrayList<String> keyNames = new ArrayList<String>();
 
-        while(valueIterator.hasNext()) {
-            Entry<String, Object> value = valueIterator.next();
+        for (Entry<String, Object> value : values.valueSet()) {
             keyNames.add(value.getKey());
-            valueNames.add("?");
-            valueBinds.add(value.getValue().toString());
+
+            Object val = value.getValue();
+            if (val == null) {
+                valueNames.add("NULL");
+            } else {
+                valueNames.add("?");
+                valueBinds.add(val.toString());
+            }
         }
 
         StringBuilder sb = new StringBuilder("INSERT into ");
         sb.append(table);
 
         sb.append(" (");
         sb.append(TextUtils.join(", ", keyNames));
         sb.append(")");
@@ -149,35 +170,45 @@ public class SQLiteBridge {
         String[] binds = new String[valueBinds.size()];
         valueBinds.toArray(binds);
         internalQuery(sb.toString(), binds);
         return mQueryResults[RESULT_INSERT_ROW_ID];
     }
 
     public int update(String table, ContentValues values, String whereClause, String[] whereArgs)
                throws SQLiteBridgeException {
-        Set<Entry<String, Object>> valueSet = values.valueSet();
-        Iterator<Entry<String, Object>> valueIterator = valueSet.iterator();
+        if (values == null)
+            return 0;
+
         ArrayList<String> valueNames = new ArrayList<String>();
 
         StringBuilder sb = new StringBuilder("UPDATE ");
         sb.append(table);
+        sb.append(" SET ");
 
-        sb.append(" SET ");
-        while(valueIterator.hasNext()) {
-            Entry<String, Object> value = valueIterator.next();
-            sb.append(value.getKey() + " = ?");
-            valueNames.add(value.getValue().toString());
-            if (valueIterator.hasNext())
+        boolean isFirst = true;
+
+        for (Entry<String, Object> value : values.valueSet()) {
+            if (isFirst)
+                isFirst = false;
+            else
                 sb.append(", ");
-            else
-                sb.append(" ");
+
+            sb.append(value.getKey());
+
+            Object val = value.getValue();
+            if (val == null) {
+                sb.append(" = NULL");
+            } else {
+                sb.append(" = ?");
+                valueNames.add(val.toString());
+            }
         }
 
-        if (whereClause != null) {
+        if (!TextUtils.isEmpty(whereClause)) {
             sb.append(" WHERE ");
             sb.append(whereClause);
             for (int i = 0; i < whereArgs.length; i++) {
                 valueNames.add(whereArgs[i]);
             }
         }
 
         String[] binds = new String[valueNames.size()];
@@ -199,15 +230,97 @@ public class SQLiteBridge {
         return ret;
     }
 
     // Do an SQL query, substituting the parameters in the query with the passed
     // parameters. The parameters are subsituded in order, so named parameters
     // are not supported.
     private Cursor internalQuery(String aQuery, String[] aParams)
         throws SQLiteBridgeException {
+
         mQueryResults = new long[2];
+        if (isOpen()) {
+            return sqliteCallWithDb(mDbPointer, aQuery, aParams, mQueryResults);
+        }
         return sqliteCall(mDb, aQuery, aParams, mQueryResults);
     }
 
-    // nop, provided for API compatibility with SQLiteDatabase.
-    public void close() { }
+    /*
+     * The second two parameters here are just provided for compatbility with SQLiteDatabase
+     * Support for them is not currently implemented
+    */
+    public static SQLiteBridge openDatabase(String path, SQLiteDatabase.CursorFactory factory, int flags)
+        throws SQLiteException {
+        SQLiteBridge bridge = null;
+        try {
+            bridge = new SQLiteBridge(path);
+            bridge.mDbPointer = bridge.openDatabase(path);
+        } catch(SQLiteBridgeException ex) {
+            // catch and rethrow as a SQLiteException to match SQLiteDatabase
+            throw new SQLiteException(ex.getMessage());
+        }
+        return bridge;
+    }
+
+    public void close() {
+        if (isOpen()) {
+          closeDatabase(mDbPointer);
+        }
+        mDbPointer = 0;
+    }
+
+    public boolean isOpen() {
+        return mDbPointer > 0;
+    }
+
+    public void beginTransaction() throws SQLiteBridgeException {
+        if (inTransaction()) {
+            throw new SQLiteBridgeException("Nested transactions are not supported");
+        }
+        execSQL("BEGIN EXCLUSIVE");
+        mTransactionSuccess = false;
+        mInTransaction = true;
+    }
+
+    public void beginTransactionNonExclusive() throws SQLiteBridgeException {
+        if (inTransaction()) {
+            throw new SQLiteBridgeException("Nested transactions are not supported");
+        }
+        execSQL("BEGIN IMMEDIATE");
+        mTransactionSuccess = false;
+        mInTransaction = true;
+    }
+
+    public void endTransaction() {
+        if (!inTransaction())
+            return;
+
+        try {
+          if (mTransactionSuccess) {
+              execSQL("COMMIT TRANSACTION");
+          } else {
+              execSQL("ROLLBACK TRANSACTION");
+          }
+        } catch(SQLiteBridgeException ex) {
+            Log.e(LOGTAG, "Error ending transaction", ex);
+        }
+        mInTransaction = false;
+        mTransactionSuccess = false;
+    }
+
+    public void setTransactionSuccessful() throws SQLiteBridgeException {
+        if (!inTransaction()) {
+            throw new SQLiteBridgeException("setTransactionSuccessful called outside a transaction");
+        }
+        mTransactionSuccess = true;
+    }
+
+    public boolean inTransaction() {
+        return mInTransaction;
+    }
+
+    public void finalize() {
+        if (isOpen()) {
+            Log.e(LOGTAG, "Bridge finalized without closing the database");
+            close();
+        }
+    }
 }
--- a/mobile/android/base/sqlite/SQLiteBridgeException.java
+++ b/mobile/android/base/sqlite/SQLiteBridgeException.java
@@ -32,16 +32,16 @@
  * and other provisions required by the GPL or the LGPL. If you do not delete
  * the provisions above, a recipient may use your version of this file under
  * the terms of any one of the MPL, the GPL or the LGPL.
  *
  * ***** END LICENSE BLOCK ***** */
 
 package org.mozilla.gecko.sqlite;
 
-public class SQLiteBridgeException extends Exception {
+public class SQLiteBridgeException extends RuntimeException {
     static final long serialVersionUID = 1L;
 
     public SQLiteBridgeException() {}
     public SQLiteBridgeException(String msg) {
         super(msg);
     }
-}
\ No newline at end of file
+}
--- a/mobile/android/base/tests/BaseTest.java.in
+++ b/mobile/android/base/tests/BaseTest.java.in
@@ -165,19 +165,24 @@ abstract class BaseTest extends Activity
         Cursor c = mActions.querySql(dbPath, sqlCommand);
         SqliteCompare(c, cvs);
     }
 
     private boolean CursorMatches(Cursor c, String[] columns, ContentValues cv) {
         for (int i = 0; i < columns.length; i++) {
             String column = columns[i];
             if (cv.containsKey(column)) {
-                mAsserter.info("Comparing", "Column value " + c.getString(i) + " ?= " + cv.get(column).toString());
-                if (!cv.get(column).toString().equals(c.getString(i))) {
-                    return false;
+                mAsserter.info("Comparing", "Column values for: " + column);
+                Object value = cv.get(column);
+                if (value == null) {
+                    if (!c.isNull(i))
+                        return false;
+                } else {
+                    if (c.isNull(i) || !value.toString().equals(c.getString(i)))
+                        return false;
                 }
             }
         }
         return true;
     }
 
     @SuppressWarnings({"unchecked", "non-varargs"})
     public void SqliteCompare(Cursor c, ContentValues[] cvs) {
@@ -194,19 +199,24 @@ abstract class BaseTest extends Activity
             } while(c.moveToNext());
         }
     }
 
     public boolean CursorMatches(Cursor c, ContentValues cv) {
         for (int i = 0; i < c.getColumnCount(); i++) {
             String column = c.getColumnName(i);
              if (cv.containsKey(column)) {
-                mAsserter.info("Pass","Column value " + c.getString(i) + " ?= " + cv.get(column).toString());
-                if (!cv.get(column).toString().equals(c.getString(i))) {
-                    return false;
+                mAsserter.info("Comparing", "Column values for: " + column);
+                Object value = cv.get(column);
+                if (value == null) {
+                    if (!c.isNull(i))
+                        return false;
+                } else {
+                    if (c.isNull(i) || !value.toString().equals(c.getString(i)))
+                        return false;
                 }
             }
         }
         return true;
     }
 
     public InputStream getAsset(String filename) throws IOException {
         AssetManager assets = getInstrumentation().getContext().getAssets();
--- a/mobile/android/base/tests/testBrowserProvider.java.in
+++ b/mobile/android/base/tests/testBrowserProvider.java.in
@@ -290,16 +290,17 @@ public class testBrowserProvider extends
         mTests.add(new TestPositionBookmarks());
 
         mTests.add(new TestInsertHistory());
         mTests.add(new TestInsertHistoryImages());
         mTests.add(new TestDeleteHistory());
         mTests.add(new TestDeleteHistoryImages());
         mTests.add(new TestUpdateHistory());
         mTests.add(new TestUpdateHistoryImages());
+        mTests.add(new TestUpdateOrInsertHistory());
 
         mTests.add(new TestCombinedView());
     }
 
     public void testBrowserProvider() throws Exception {
         setTestType("mochitest");
 
         loadMobileFolderId();
@@ -995,16 +996,131 @@ public class testBrowserProvider extends
             c = getImagesByUrl(h.getAsString(mHistoryUrlCol));
             mAsserter.is(c.moveToFirst(), true, "Updated images found");
 
             mAsserter.is(new String(c.getBlob(c.getColumnIndex(mImagesFaviconCol)), "UTF8"),
                          newFavicon, "Updated image has corresponding favicon image");
         }
     }
 
+    class TestUpdateOrInsertHistory extends Test {
+        private final String TEST_URL_1 = "http://example.com";
+        private final String TEST_URL_2 = "http://example.org";
+        private final String TEST_TITLE = "Example";
+
+        private long getHistoryEntryIdByUrl(String url) {
+            Cursor c = mProvider.query(mHistoryUri,
+                                       new String[] { mHistoryIdCol },
+                                       mHistoryUrlCol + " = ?",
+                                       new String[] { url },
+                                       null);
+            c.moveToFirst();
+            long id = c.getLong(0);
+            c.close();
+
+            return id;
+        }
+
+        public void test() throws Exception {
+            Uri updateHistoryUriWithProfile = mHistoryUri.buildUpon().
+                appendQueryParameter("insert_if_needed", "true").
+                appendQueryParameter("increment_visits", "true").build();
+
+            // Update a non-existent history entry, without specifying visits or title
+            ContentValues values = new ContentValues();
+            values.put(mHistoryUrlCol, TEST_URL_1);
+
+            int updated = mProvider.update(updateHistoryUriWithProfile, values,
+                                           mHistoryUrlCol + " = ?",
+                                           new String[] { TEST_URL_1 });
+            mAsserter.is((updated == 0), true, "History entry was inserted, not updated");
+
+            long id = getHistoryEntryIdByUrl(TEST_URL_1);
+            Cursor c = getHistoryEntryById(id);
+            mAsserter.is(c.moveToFirst(), true, "History entry was inserted");
+
+            long dateCreated = c.getLong(c.getColumnIndex(mHistoryDateCreatedCol));
+            long dateModified = c.getLong(c.getColumnIndex(mHistoryDateModifiedCol));
+
+            mAsserter.is(new Long(c.getLong(c.getColumnIndex(mHistoryVisitsCol))), new Long(1),
+                         "Inserted history entry has correct default number of visits");
+            mAsserter.is(c.getString(c.getColumnIndex(mHistoryTitleCol)), TEST_URL_1,
+                         "Inserted history entry has correct default title");
+
+            // Update the history entry, without specifying an additional visit count
+            values = new ContentValues();
+            values.put(mHistoryLastVisitedCol, System.currentTimeMillis());
+            values.put(mHistoryTitleCol, TEST_TITLE);
+
+            updated = mProvider.update(updateHistoryUriWithProfile, values,
+                                       mHistoryIdCol + " = ?",
+                                       new String[] { String.valueOf(id) });
+            mAsserter.is((updated == 1), true, "Inserted history entry was updated");
+
+            c = getHistoryEntryById(id);
+            mAsserter.is(c.moveToFirst(), true, "Updated history entry found");
+
+            mAsserter.is(c.getString(c.getColumnIndex(mHistoryTitleCol)), TEST_TITLE,
+                         "Updated history entry has correct title");
+            mAsserter.is(new Long(c.getLong(c.getColumnIndex(mHistoryVisitsCol))), new Long(2),
+                         "Updated history entry has correct number of visits");
+            mAsserter.is(new Long(c.getLong(c.getColumnIndex(mHistoryDateCreatedCol))), new Long(dateCreated),
+                         "Updated history entry has same creation date");
+            mAsserter.isnot(new Long(c.getLong(c.getColumnIndex(mHistoryDateModifiedCol))), new Long(dateModified),
+                            "Updated history entry has new modification date");
+
+            // Create a new history entry, specifying visits and history
+            values = new ContentValues();
+            values.put(mHistoryUrlCol, TEST_URL_2);
+            values.put(mHistoryTitleCol, TEST_TITLE);
+            values.put(mHistoryVisitsCol, 10);
+
+            updated = mProvider.update(updateHistoryUriWithProfile, values,
+                                           mHistoryUrlCol + " = ?",
+                                           new String[] { values.getAsString(mHistoryUrlCol) });
+            mAsserter.is((updated == 0), true, "History entry was inserted, not updated");
+
+            id = getHistoryEntryIdByUrl(TEST_URL_2);
+            c = getHistoryEntryById(id);
+            mAsserter.is(c.moveToFirst(), true, "History entry was inserted");
+
+            dateCreated = c.getLong(c.getColumnIndex(mHistoryDateCreatedCol));
+            dateModified = c.getLong(c.getColumnIndex(mHistoryDateModifiedCol));
+
+            mAsserter.is(new Long(c.getLong(c.getColumnIndex(mHistoryVisitsCol))), new Long(10),
+                         "Inserted history entry has correct specified number of visits");
+            mAsserter.is(c.getString(c.getColumnIndex(mHistoryTitleCol)), TEST_TITLE,
+                         "Inserted history entry has correct specified title");
+
+            // Update the history entry, specifying additional visit count
+            values = new ContentValues();
+            values.put(mHistoryVisitsCol, 10);
+
+            updated = mProvider.update(updateHistoryUriWithProfile, values,
+                                       mHistoryIdCol + " = ?",
+                                       new String[] { String.valueOf(id) });
+            mAsserter.is((updated == 1), true, "Inserted history entry was updated");
+
+            c = getHistoryEntryById(id);
+            mAsserter.is(c.moveToFirst(), true, "Updated history entry found");
+
+            mAsserter.is(c.getString(c.getColumnIndex(mHistoryTitleCol)), TEST_TITLE,
+                         "Updated history entry has correct unchanged title");
+            mAsserter.is(c.getString(c.getColumnIndex(mHistoryUrlCol)), TEST_URL_2,
+                         "Updated history entry has correct unchanged URL");
+            mAsserter.is(new Long(c.getLong(c.getColumnIndex(mHistoryVisitsCol))), new Long(20),
+                         "Updated history entry has correct number of visits");
+            mAsserter.is(new Long(c.getLong(c.getColumnIndex(mHistoryDateCreatedCol))), new Long(dateCreated),
+                         "Updated history entry has same creation date");
+            mAsserter.isnot(new Long(c.getLong(c.getColumnIndex(mHistoryDateModifiedCol))), new Long(dateModified),
+                            "Updated history entry has new modification date");
+
+        }
+    }
+
     class TestCombinedView extends Test {
         public void test() throws Exception {
             final String TITLE_1 = "Test Page 1";
             final String TITLE_2 = "Test Page 2";
             final String TITLE_3_HISTORY = "Test Page 3 (History Entry)";
             final String TITLE_3_BOOKMARK = "Test Page 3 (Bookmark Entry)";
 
             final String URL_1 = "http://example.com";
--- a/mobile/android/base/tests/testFormHistory.java.in
+++ b/mobile/android/base/tests/testFormHistory.java.in
@@ -27,16 +27,21 @@ public class testFormHistory extends Bas
         ContentResolver cr = context.getContentResolver();
         ContentValues[] cvs = new ContentValues[1];
         cvs[0] = new ContentValues();
   
         Actions.EventExpecter contentEventExpecter = mActions.expectGeckoEvent("Gecko:Ready");
         contentEventExpecter.blockForEvent();
   
         Uri formHistoryUri;
+        Uri insertUri;
+        Uri expectedUri;
+        int numUpdated;
+        int numDeleted;
+
         try {
             ClassLoader classLoader = getActivity().getClassLoader();
             Class fh = classLoader.loadClass("org.mozilla.gecko.db.BrowserContract$FormHistory");
       
             cvs[0].put("fieldname", "fieldname");
             cvs[0].put("value", "value");
             cvs[0].put("timesUsed", "0");
             cvs[0].put("guid", "guid");
@@ -51,28 +56,52 @@ public class testFormHistory extends Bas
         } catch(NoSuchFieldException ex) {
             mAsserter.is(false, true, "Error getting field");
             return;
         } catch(IllegalAccessException ex) {
             mAsserter.is(false, true, "Error using field");
             return;
         }
 
-        Uri uri = cr.insert(formHistoryUri, cvs[0]);
-        Uri expectedUri = formHistoryUri.buildUpon().appendPath("1").build();
-        mAsserter.is(expectedUri.toString(), uri.toString(), "Insert returned correct uri");
+        insertUri = cr.insert(formHistoryUri, cvs[0]);
+        expectedUri = formHistoryUri.buildUpon().appendPath("1").build();
+        mAsserter.is(expectedUri.toString(), insertUri.toString(), "Insert returned correct uri");
         SqliteCompare(DB_NAME, "SELECT * FROM moz_formhistory", cvs);
   
         cvs[0].put("fieldname", "fieldname2");
+        cvs[0].putNull("guid");
   
-        int numUpdated = cr.update(formHistoryUri, cvs[0], null, null);
+        numUpdated = cr.update(formHistoryUri, cvs[0], null, null);
         mAsserter.is(1, numUpdated, "Correct number updated");
         SqliteCompare(DB_NAME, "SELECT * FROM moz_formhistory", cvs);
   
-        int numDeleted = cr.delete(formHistoryUri, null, null);
+        numDeleted = cr.delete(formHistoryUri, null, null);
+        mAsserter.is(1, numDeleted, "Correct number deleted");
+        cvs = new ContentValues[0];
+        SqliteCompare(DB_NAME, "SELECT * FROM moz_formhistory", cvs);
+        
+        cvs = new ContentValues[1];
+        cvs[0] = new ContentValues();
+        cvs[0].put("fieldname", "fieldname");
+        cvs[0].put("value", "value");
+        cvs[0].put("timesUsed", "0");
+        cvs[0].putNull("guid");
+
+        insertUri = cr.insert(formHistoryUri, cvs[0]);
+        expectedUri = formHistoryUri.buildUpon().appendPath("1").build();
+        mAsserter.is(expectedUri.toString(), insertUri.toString(), "Insert returned correct uri");
+        SqliteCompare(DB_NAME, "SELECT * FROM moz_formhistory", cvs);
+  
+        cvs[0].put("guid", "guid");
+  
+        numUpdated = cr.update(formHistoryUri, cvs[0], null, null);
+        mAsserter.is(1, numUpdated, "Correct number updated");
+        SqliteCompare(DB_NAME, "SELECT * FROM moz_formhistory", cvs);
+  
+        numDeleted = cr.delete(formHistoryUri, null, null);
         mAsserter.is(1, numDeleted, "Correct number deleted");
         cvs = new ContentValues[0];
         SqliteCompare(DB_NAME, "SELECT * FROM moz_formhistory", cvs);
     }
 
     public void tearDown() throws Exception {
       super.tearDown();
 
--- a/mobile/android/branding/aurora/android-resources.mn
+++ b/mobile/android/branding/aurora/android-resources.mn
@@ -1,4 +1,5 @@
 mobile/android/app/android/drawable/alertaddons.png
 mobile/android/app/android/drawable/alertdownloads.png
 mobile/android/branding/aurora/content/logo.png
 mobile/android/branding/aurora/content/favicon32.png
+mobile/android/branding/aurora/content/bookmarkdefaults_favicon_aboutfirefox.png
new file mode 100644
index e69de29bb2d1d6434b8b29ae775ad8c2e48c5391..f515b5d337e2f8fccc52bec5700778c5ace418b1
GIT binary patch
literal 3712
zc$|G#c{tST-?s0|*g~W+mh3ZQ8^%5xBf_LeW0?(8W-&7{NTTd2YiS{b7D`AGDiSGb
zLM5`LgUaE^PVsWi>AdgtUcd8uuIu}Kp3mpH@B8^YpXdJPN%h?4EG@B9f{%|+8ta0>
zZOy>#PfTR%&yJ2>*qT&1XkX5LMldImz@qRukr_k^5KAM3P;e9iIV!x9V#~)T2%>uX
za(vz0;3Njkgs_b<;nJ9V+r!p@%OsGFQaC^&C4@@11I;!*1_7yLJCKisJH(xdq=Zsk
zqFI#v(fhnf(ML(vWRQbB(3T6|5};8y1R$3dMrXshcA!6X;altNG#CW@6T&%a2l}fh
zUw2O+lEI<?EleQBB#0#hXbClenwi63Fe9KT1PTE|Ou<l7V<-%6W(tQufPW9r)^03v
zFdT=%{Jqy!WCsf6aF}o~I5INQB+|@;!3qIGt*x!MHB3#7w-CncC_0D0HKwz*ekq_R
zY!Zvg<WL!O;C4(PGLCWVK%ieopfUfErL+HT(^kX4TmlmeHGzQt576EHze8!Xf6#0W
zjuQOe(QNN1CIyV6uo=f#q^*k!*4idB;Yb#Rz+tew8H})BUGxlPa2V`R1`~+fZvk{C
zkf`+S_)omMI~+@Aa|m=21&gu+ZDmZTR5Bc9jd8+QAkARrC`%|54RJC@L#&`MD+@~`
z1ZLr6@r#RMkdDzPbj~j>`G2|Q|H|FA!e49(iyA>8V^|Ct@XsT|ssEuCGix)58O*|R
zOV8pz*YX#a{O`4x{%bAZtzy9c@1lRDw%oJ5{KvLi!9T{Q(6`*q+OqZG=_Cg}K8Xb^
z%E_BM(B^~9P!Ca!t@D|E=@$8#YkR*V;!1x`2C0L!L)g<rF$F0m5p2URx<d!?DJ54>
zzFs{OfB?#;_zH>Xh@KbJlPuEPm!KK`i93Co8*Ez``(@_q*8!h^w<*9JJs&@VV;&xh
zo3SJ7!^^`yt=C3=s13)a3dlcoE;*{=V1Bkc@*Sk6DzT6Arf_Hc)LIj|)$Xc#)g4-U
z4#i@qOt}nKeP{8A#g|(^iHboV5hr$yh?l_e<?s|@;$*qYgoGpLyOCVxh8nJ2v?*H~
zp@>O|Rem%%q`x-&^jXbPYRD!e@MgWYqBlR<AJOdp>^`X2`(O{w>5)LGgG<iXxYW#q
zs4yZyMgR12JJ&;iDzDWqF80zCIJkC`XBJ0kwx~R}&s!5~3D1FFa#s?SnMs)C@($=Y
zgWYk2{-MI}(yNVS2j{C1KZ{3D6SX6I)ep<>^vYh!eOWn7%wKVsE0rBtDl2$GO@K&^
z?u_+~PxeJL*i3bs1Qz~G+I=%xJ__RVo_p;SE}6fV?;Y>?YuCj5RDJ`wtj}VIFu^fT
zx02BtewSBkw3F&n>Xv-aZ|UXX55xke<?<A(`83BJ)zN>%iUv%z`VA&jy&zp4dYd>i
zP<iKzt&07N?37M_<BXZhPW}<R%F@u>c-DSob1y1(*`%*S*DEYT^9vY}r<4+wUZRs(
zk<91xDqE&xZ2oad{SX8CjXs<J`C}~FQvH2`g5TYymj1kkIAh->on|~PYlYw7z%B%!
z_!d>qhJie9$U~{hU)0q{rQe92kw_Y{M%4+VEkcW+t(#PU_f<k`0bTNzfx+*GN#Vu1
zGweoHeG2R@VO45cmN0ngYfm0q@+sMAImIPiXNQ>6wL2yGw=(zVgp_6W7`r@@y4b87
ztLv2s#DMlpN#(XXi4~sex8pxB_?q7{E4s>&7o6`XjRh<fby#p&m`-mEqkyC@3u8j3
z<NECy2V#+6ZzaV%0H!M4X2xFRc3<mTN#!xoorso`IDl%VlS2ILbWCe$zkP!?i#UwP
zUEwL6W#3ECew3w!)gHRA8YO}I(%)%*D0u#my|}h4UeMBO^vQ`My)%Kkz5V*%r{+_i
zq)CO*rL$gDA+WVTxiMwUQlf^fR+i!{(=W3&LhJ*?arDg<_3Swv6!je5>a4brri{;r
z7Z@kT@aC%CkD*obI-n>>w%72F>6RQMH0Y#ah1wNG(k_^Xhh~kN#x2KvwgO4Vb9Ho|
zn&%5eJW5wMD0)PMJy(MbvRP?7>4M#eY6Y`jl*={9;VOh0tk&+97I4kS6V=<*)x?~o
z8s9_eO|m$;#g#=*a3V?4btNU5Wnt%%#pMmp+|ZXBZ@2Ne;xEUdYxCzYYlMhm2_77B
z!qd@-!>arjzeydwmqchWvRL+yRE}HB(1Xx4&px6Jd~>lr0zkMl4S2)e*A&k+Hmpjk
z+e8UkLr<&AdKzG*+!DJ=ocrP-81=Skw#%a1n6%(&T?P3;W}~1`E~~0hEM%Ovf>eHW
zsU@N<aK4+bq{|)?ADOJ+`=dw4+cBgmzI)N$6)kLHxV~~TN2Q?u<z+15rogpXQ?Bc8
zq{Sa`qdK<v%CT)~fF$2Ul8~5)=Er!xk!&bFFvQfqUrp_JeeLGR?E}__E_W*BW@in>
z!-6)~^pq<an#u*vr1G~9qVY}lG9)K=@QA;~Uj^vvx-U6b+Ai!@yma8X(o${v$jT{O
zF0pai4qO5d7C!|~X;QkO)gi}OM|D;m@DoOtmt`a=mOL5kTFJE*y@yb(yJ-+CGu`?v
zE^b${ZpZv-)BB}e20=^*$(dBoDNe+DR4AIaCh;Oi%4!O6P34)F@VmE^`#?nK9yfRq
z<L=8PKzk41_RqyzR?w)IzN3qo<P4&O)@@6p!PcMGXWBl!2)4(?rZ4Dr=RhQ18OF#8
z9}y)?GKFMrU$9%oi${kz>~THWAQ$wlTZenLHKsp-o^6xaxuf6iQo*jzu0{_Fv-JGV
z)M29pF1BQNWQ<<-*eGna3}0g}7vYUtt|=yK8;y+4Yo9BfzfmKzK5I?T=-XYcQdy~)
zp`;=yC~}?`+fnq|1>idFd-xuKe%bBGr{*YuEUUOV@CC^--MortM~-D*s&&nJ`17-q
zq9NL-DiYeGnt1hTp|DI;5Ms_%Zv>j8QKk8YNu^gOB~AuMVU&nBMPf3E3;l8&n2u5R
zay4yWN?LSkr$%;H>rG46^gujLuUsM-tQK~tVq)OLM3+$-rz<<)WNmY*T>+?r=j7Ex
z2)Rg}!Pt|N6ixLn1Oyo`dsV=KBJ5Nu1gFXbk|tr*b=V#q1A$@XL5;WPu2s1X;nS{%
zXna0*n=M?&!GEu~@os>psFY?v4696~t+lkdNb^f?^2T&0OzsqS^@H?Pdp%GVq!R)K
zS2CZeB-NcUczef_076B5>9HkdCG9H_YE^M9KFiW~iuGB%822MQ^)Vx(WMFu{Hn;(e
zG4y?KTs(c=2kJg$`4G8qBMDyzv1xP^+qD*_fV^;5;Y7M^|JTGHS6Z1wW>fXE53oeg
zS5cYK)<og_;^&q(k5>gvm8$f3#+IFqg}pm*{L{uzrq98^WFx8rWA^gKhQUwUQOn+s
zLoKV4^ZA!l(6#us5A4~ZTar_1CdRFp`0^an(C0#miQVJgDb>yn<ImgpMJ~JxKSoG@
zeoGyF@iT>|xEjLrYWRKWo7ADKz~{@Oxr3RcW8HosuY1R}){9(q@CAXb1MNG{U#RDe
z?dYqg^|hDZeL$Y)<)`m;lgC8;ma0fx-q1zgaQoB=kia8$Dpf8Y&pZnGC?s;2%<@AN
zi+jVZqDQivBf>Jo-G&yt)Zr&2cy(3xmejE}O@x@CwnD*}4<uD^VMCjdWPVJH_?_8F
z_~>2Yg$qb!{0EIsWj<AaXxRc}@*Azs&h$oAXn`l=1=Ho=<-B!-s%w-(xdUhZ>zl(i
zk55Dz${dfG%mJ!st;;&d_qWR;2Uvi{8+~7|G-h%Xutj0XLC-1!I)9v^>+`H+b~m5(
z8*xtDr<$a3&{F!x_dOnO<gC|S^M?J$51<-YfVXduWB#%qA?$9yfLBZP1w#Eklg>FE
zGY|JjeN5f~3pk~dkGF3ivr^BP{q!(f>sZAB*!o^y);EtIv)o)CKDVoFZ<T-2Udi)m
zv<-~Y6}`Um66EGHbIp5lVrFe3j;iYp9hK+K)sHkxG&p+Jf!#*J*DMabDIdAAZfH0>
z>W5Ew5|F$K2Th#S4_DJ%1me)KGk~}g8|od9!P7_axu%ErDBm+ZMiGj+Zl8dO`ELF`
zjeU`h&*2jcSPzn4iNE9uyU(y%>g#0vT*ynTP3f~YESVEK#GB5dCOd%=U5TD(W8U7=
z>N=P%B_%zU&hD0(p*>C2m~TNlB@9g?kzU#ME1gsR+Mia;5)V$^zqk~#c`sr$EOrnm
z-b;8SQudLH6LB-uAQxqZni?wTS?L=pdts`1ExzB@CgEjY1=EaT1QcG@ht3UT*0g~?
zX-AJ}FCc!;g9V(p#qLcNeeA0?9oJ>?P`Vd?4ea?=9#%gwt#5wn0Dv>aN`0MnO>b&(
z@-uPu8&#!?nvIZr_u%f=J}D4zQ&vE!StjRlc=n?>`D&VQTBSpA8y9rjVz6$a?fR~l
z5B49pr)rPvX>fU^oh^A}m0I$h^%@#jv@c3s@xIGv!OB;q&o#@QC&J8%j$ZY&#_Dfe
dt%{R`@M-Bje$)|{8o&J}#G?11?jV8^{s&wVTyOvY
--- a/mobile/android/branding/beta/android-resources.mn
+++ b/mobile/android/branding/beta/android-resources.mn
@@ -1,4 +1,5 @@
 mobile/android/app/android/drawable/alertaddons.png
 mobile/android/app/android/drawable/alertdownloads.png
 mobile/android/branding/beta/content/logo.png
 mobile/android/branding/beta/content/favicon32.png
+mobile/android/branding/beta/content/bookmarkdefaults_favicon_aboutfirefox.png
new file mode 100644
index e69de29bb2d1d6434b8b29ae775ad8c2e48c5391..ac4a6968bf2746ad89a82d85df3a8679b5530cca
GIT binary patch
literal 2670
zc$@)l3X%1RP)<h;3K|Lk000e1NJLTq001BW001Be1^@s6b9#F80000PbVXQnQ*UN;
zcVTj606}DLVr3vnZDD6+Qe|Oed2z{QJOBU+5J^NqR9M5smwSv|)pf>y`*F^>_uRR6
zX0GRsXFM~048}HoB17y@T%a+O7OSy{>(UYl6w!tjHL6+&c~nuPMnY7L(lk;FR#T;r
zrcp|&CPlO<l_f*LaboJ$j<GS!B;y&6?Rnj~?|WW*@BU$oOapEH%O`DV@1?D^Kdq&`
z*0+Rnj-My=)lK<>5C1IpKLFec+zf06Rs;ROGB6FC0bT=M1&;rJ&Z@@_A)Iq0&+dK4
z==*T^P026+wZP20c$M5f;GmZe53Jt0zGvqLx3PQ2I&K&%Ggu7iHalFHt8)C!iyS$6
zhSSGRwbD-KAA#qp#}2)4$M!pU_Sb5}egkj30wTp31MuDij!a1Q9)jMH@#}!!71IB`
zRa<W??En3H*|MR`n1Tu*0RdRRx+{jdhVQ<5mdWQ|;N;1f_WW}66!3I&W@+-w$4|XC
zfhThc054D<+I`R1{ypEE{Da<`K6aOo>XV*dx@%<1hq(3EKfut&3Y+^SW3GeJ0a9Ke
z;NB*XIEaC%cE+L4A7b~)7^`ER|F`LvA0ImRgZlHYd;w@)n+AF9q15kxCM0|4&O7#f
zF=^YUlhnH_U*3#g9H7(A$RGX|gJ0N3_PwWQOF`H2_HuNMrEM(r)KZHQw%&Iy|8Oj(
zxv<Pv|8(@WrQvO#9J%}Yza8Dtx9NQew3g#NL#|u+!{F4TYl6o3?Q12!G`h@MIm<2I
zeVp6BdOydXIl^=8&9o9nH*-W5x(3<?W;-bpwJsNyI#ibv?%aPHlk;Vs`P!R2@R<q=
zLpwjxJ6QVXksEt={?sp6J){Pf>Q*jas<V4Xo)>rg5I^sud-|!)LT&O4Q=O2@quc1&
zwuO3T>CqAoK?W?RhS%piEH@%L&6KEVIX@Zm(7sX9dXwha*ZHl-$N0`;qt}<i&ffrg
zfc85Pn4LHG7D8!<?&?KWe2TOX^(w8mCTUMiqWW`Om`-W@%0UV@jIiW;EC-6Z5Y()r
zD+J}fJjG%jseM+A_tCfYIzIcQ<LugA=Z2d`80^ln<6s4EeC3Tpn|nTeZ3HSpiG$bg
z>QOXfmM1d|8e_pJiSh(NUNbflv+l%G6rR0+uN9|zwy<>D0sOE)WF5{|ge&s&7jiV(
zj?#FDzj_mY^u%$FemkWjbKEf4X2ro#UV3%vqrm5`61YF#?{D9-)p^Y`5ouRqFjygQ
z5=0;o!l431>&z6p^p`0YV4-&x&kz10E7y#X#0jZ!#1^6i>I+?FkDaD+^G@D)?j+y%
zT8;Y;q-2XFHm+-MM2ZS<yM8jKN=l0lZy48QyA%_3z@jk5VF9NcLOEn=*|c*7?O-FT
z9^TLCle7HY(K51=LoP(5sio8G(y4VZeu2hPgWAPQh%hA5MUJ0Z;-hyo$d80r0fXy<
zba}FMiw63%C)N)SE3dnlVV%MN4uKN_qyQ-qflp<um*KL{=bl;M>*tDu8#b~@`P6C&
z#tNF3TU5`U!)hO~Y7Fc9q~|9YS=r0%g27zsBG+_rnV>u%WUi?1(?Bm!F7_$XixMjZ
z&N!SD2v4E{P0*JoH_$^^&@|f%9GWPz`kr5<w?Cv-k1<I~>nBrK1l@LvsNTfQUcj_k
zG^=$U`AClFf=_G<$i)W!aFHyMMU%QM8mO4e1->t6q+H3n5=c*?LQN_Z3(FSU=rYA1
z*HsL~P!hK~)RGt>03ql!+jOSSW1Pcg88%CC7UF7^c0J{Z$5NtMiAxitsWWpKX)=cf
zf-H5K*x=<HaV!u@phHC~cAWap8m5^r6IA%~={*eO6U+(&)f$QCAtZpn_#w7X!ZemK
zQ3Tdvt;IU1)f$ks5w?ad<%s8(xiBx##!3x%T8peRmwGv0(2PJRfea)UCpx&qFj$7t
zYM&JwZlYle6jY4q#-ve3;xw5BUkHNAC|ReA=`I2SXDv1}bXpN~^JMioR4(QGt5v9k
z=xLd%JGJP~`{FkTN-797beux^5`0BtE~20<#Sk{H%UIjn;COT$OIeX9g?!pzmwKJu
zeKT0&n3*@2g&AzOgUvFsG)1Oub__4Ee^*S}ZX-m5CoLP-TIS!1YWmZWIrdlmdSYqG
z?yUF%=Yw+sA)wqRaN1G|!CBZJ{D5uV6o=beF-~%ef0iw!d5Wu6pto)3k6+o!U(OcL
z@jT91y44!Ly?2p6x%)g>L!m@MGM^wLOS)*OUrtVIfFyM<F4ePbaY1=m(INtcwa~jV
zhw@?yp`aV3oIDY;Zo?c8moDK1Bq=0|DQDhn@XFCXrd%19jgrL?CN+pG;@<5ul(RM_
z4#?_Vl9~Y-aQfdD>v6{&)&Nn)_o_|%$YNc3oj4_L1qEN?7ku<!5u3&oa+>5)#LNHE
zWzAZTFb~E!UTanOQhg88at$bj=XFRs5jJuZb1^p$RB3lIg03T}CLr^~vo)q)H#KW`
z`D!VC$rz?5t9GmBJHjNzD=35lQOM(RK28|6-V{*%k>cq$%3Ss;T=L3H$zif^)s=#k
zv`CgOB1|4Bx_o@s4E=$knM5Q@DRDJMByIldh`<qaANj`Gm)>c|ndMMBaeo$Aa@{l|
zSIijjC5bQ)D)2N;!!PVsO!SvHbAFf~w+FDM7dQPHbQU0q5ISMg#xZsc*7?-ldD^O%
zXnp~y71?sikEbLj-zYM^WAulm11H`k$qG5m(Sj$oM=6A%WYhK@az%;G3%tBU`4a63
zdVGt+^6iO1zBRdui<hVHU7JlS9rtWYIIz9}!r_e%)12#KyD_yn!`bgg{HQv>=t|$*
z`rysmw|wHC&b&(#YQa8V^7nxjrAFcy8uVGeA%_knUS6OBiS{MZ6G-U@RfcgH-AtgQ
zrIa_=)Y3@>xsn2Fh%MySRETD4w1behPQ(lp%-8pPv-ZHd6cIq?ctOFJQ_H8cAefy?
z0LR*O0nSKlVzD`i)Do#6l^}&gIExXEg{CG;zz?nzpkO#halDMM8FE-N@gGfk^XB{7
zb07ODNp=;n;qy2*Acc5HD}u`lDQRq2y(XYk)(Gbifx{}mSu$te?ww$aMQPB1!|zde
zfk$V$L36&wxf9Mh<l())Q@FeL!KHV`v3I55TKJMD5aJV_rpH-_uVHA|XK>h~P?C5#
zf%ZUZhtd`$9YS)YH^?i^?DT&}%uE?fEKN}0FCIJ>Kl;9-+5bjj`K*?_W{mryl42bK
z7A_~W8yN!wn%=S`UjRSvz;mFk2pCn)ksA$JZc3uQkYFIetBbGP_r}7b@Ac06M&KG0
zLZ2rc;sGHj1s>#mD29S!4-|SpYe!-otxOOLO`{2&NaFSQlPmo8V;?@2e&_w1|11Om
z=*@||7s%fTa`Lv+aCft1hSJO_lR1<YE(k>C=j2@fO7E04{Hu%8W1h%PO#B4<fB6+Z
c@A3S90Dk@A_1u|U7XSbN07*qoM6N<$g3GcX<p2Nx
--- a/mobile/android/branding/nightly/android-resources.mn
+++ b/mobile/android/branding/nightly/android-resources.mn
@@ -1,4 +1,5 @@
 mobile/android/app/android/drawable/alertaddons.png
 mobile/android/app/android/drawable/alertdownloads.png
 mobile/android/branding/nightly/content/logo.png
 mobile/android/branding/nightly/content/favicon32.png
+mobile/android/branding/nightly/content/bookmarkdefaults_favicon_aboutfirefox.png
new file mode 100644
index e69de29bb2d1d6434b8b29ae775ad8c2e48c5391..43ad466c6152fe70cb872cac784929be8d7d9d84
GIT binary patch
literal 3485
zc$|G#c{r47AD#+Xk|o<9jiG1`v)D}rV;3VyNW_>K3}$I&>^aC@LPBL<vb2!wB4qg}
zd$yPmLeytplBJJxPUris@47nAb-nNN{C?Mc|DOB#J@@;^8)a^0$jvFr2><}Njg9my
z_Gi$+!_Kz<ru+G=?N304z769N#hKxar4ayVJjICsGA3bN2o?k^-uL<&f(8I^1WdHF
zVc1|ykvIwoiao$UeMnTm!O+n1p<;3F1O~{7;6fy$z>78YU=R_H0$VF%;25ed!Ify_
zM<ZPFGqc3`x#QIFU@c9Mh7WST0ExiBf_z9GWIECZ1^%Nha({i0hJitUKp5^Q@Smb=
zFy<g#3XK3#hQj4>a1}U61p!4UDygcf%7GN%2sjL`07EFqBUF)!3P?B{^w$9I??%Hr
zBQ5j{{@QClLV;Zw3@Q=^^Y-?JdMiRHG#3~`U0wa4hJu3pK0==EOJ-nw<jHiYpB3~7
zbR3OHWe_Q3&_RrKqIfb;VDQf)kf?u`CDZ?E(|*HXK3FOY0foc<2Z+J^Gn7R78%<|e
z5S;%RO}F%=5?~etI>nQQ+rKzxsRJ?<sY@eZ85Ei&h2rtEi{`Er28HfQp@MWTDT6Rr
z9Fcqw|AEI~kj7*>153scjP+39{S1^y#3SKoeRZ_HzOt&4E*gQ*hohDB;c5s~HDwiD
zxT-Q*`6pM8g7YL1$c&#{{C~MBzvLcR;ZHV!M)V@!4QLb+=#L{KiNDsO_-ieHa`C^`
zqV!8HY+nrQ|1SDxYTrEv%fD^AAN*~60(sx<w0&EP_|`K408Tz*J+!6INUgPdv>gHX
zd)ICUVYZ}nb0K$htU{hE%<4suNHO;wfC~}o8g0NDZP0iDXMQ4NIby}|4$E1vo^~~d
zaf)_JrViKiyIf`xw5*0ubIyORqidJ8F#9ca7+S`MnTROeCUkYA((7ge#%F!UHrdg<
zA9t(=59`%!5*zADVoxIYfUIhri?Ipzrk_Y3=*E`QXNl0X_Ngb-fu*z8R`k<lsP<u?
zDz5avCTj<1UWuSs#q8_V8;n-v=neg^@iOA-%JzYbG86w#LqmBf!k$yN+ZqZlbR^f0
z2WF>21u@O*0NehS?+M}E8>d0b_{#zlTwqA;K=4Dh7)<{S2mU?Co0XH#191gA#6yoZ
z5_eu`)p~h#uHgmGBD8fj`J%R}_HJF1XqQ!%OTch>wi}ExByaHx33Ch3G({^y^A@Yl
z`!i$5Y6C_CG6WiWaI0NW`5PJ0DkYwbr%14EkoH<JeN)sFGkdpF=&qLH?UfJw8hwYp
zEi#`yewL$A)8Gb-+~m>zJcquqo*ZI6kT&HVn=E|9@#8~v|M@+cRza7dpt=G!eT$E@
z5E_&R{VeOsWAvIwWN<{o=Akh#waNQvk$sqT+Rf}YvI)scS&dP7#q%RD7{q?m{mjBJ
zb`J)4<A6E0%A>hwR;ICh=sVML&^qYi(*`97+^p_a{}ZfIGN%;77s2{50wgDqQXn)F
z=QhN5S=tnneh3!!%&nN^B)RO!GG?gO>c&jbQy3twRP*qXS>L&>Cd1gm3?x+?_y(;2
z&bip3_>x~E1VT?)dWKXjtH%0xig@<ecG_}eQ?j4tAL+|?c|p9S1+hF2tqk1@)=W)>
zNR|?ROD!^4yymy!U%#aW94nhO|2-h!O_-CIxu9^l9Y@#B)gFPPNl$f_bO_aj2~7@T
zKI%U#*<OLO4JU@>cur)rtHxz&+_4p0ZsTRMnv<0?Z7dmZ@Cw}BGwjmb*mbLVEPL<z
z#7G8RB0X)jcStp~XaOpcsQ=#NL~#nirjF&o>8j{4#Vgh|y>Hq28e8JoRBqfqU!Y>+
zed5J~F$mMni;v%Txl0UZl+R#D19H;`zWV(;II*CGzIcBTMPwx8&mfi?OXEa>FFy<`
zSBnW9Y|w5*U&jhP84og4LFREVX^!U>R<Z?9%;3eEW~ZiHbai@&3dGO~ET7)-Laqoa
z>H3NHI>cdaYlbo)6jbRhF;?WK_2A(X#H2>Yq<~P&*NAwnXp16t<E5pU*GG(8Ci~UP
z$pXDyu7@*9GWi<?<9qX^nBlL>+KbuS$hPmRe5GQ!Kl8DQZV3$OM>=zpJ&o7pCuW3#
z?1>ylXP>3aZy_f|Rk3bEn}=?%sy9!9X@nD3pMSU|M%fXURz6~F403P<J0@tlFW%#V
z{#&ghXu#D8n-w`0BO7>vIKU$Et&NfIThH0$+?{z1q61H|F_=n9<Y&jbvnh-9;ktQ)
zZqGISz>gdoEa8@N_n-4%-PwX2z3X82G3;6Omx@T?Di-bCR`B6$1gn?|cXp*}@R>j_
zQPz&`*%w|-0Ke~kSEWymzT`s&<Th?|I0v+I1~vN(3e1iNhRhw~y^B%%AU!a2XQA$x
znRuG^EAl<l{#T&5)g9d1S5|B7*USr%@(Rwgw<2YxiXTRKz5Lh~E}7bS8NN4&5LrLd
zWeVdj)>8%^d$c79D7P$VM3n5jMoVo&xtm)SMpZ$hiRheb!E(k+;t|OFxvKUBVK^5S
zSlh#0oh+cAW6`=nN|9`JvZ;J2{CwvNe6Z+?%u%J4xZNy???xd*)f4NJoPZ&37KIF?
zOuJ|Ot)k!opSiI5sW!2x_q*lHp8C8DA$J%>yr|*FXSK4AaqBzw?-=hZBDze)j-L`W
z)R34)#boA4MVY#Yaq7DapWBJ;fU%fI&GY*)y?a(q$O_SIl2gzS!KS3%J9w|^+|VGY
zU^;Z3+Q+4xdUftWX#QRq4=0I+XK+m-fY$bvN5bW^ZSqL|WnYE9=(Q!2i`23*62hFu
zh!tErvPPOk+wY)X1IVYkGeX6qBoljjv>s@O=#ly{Hy!);N;o+AeJAA4Ipw<L6w04J
zEdc6ET`|Fw<to%(NZfM-rJXs!3dAVC?RxTR=xqb38=8&EsuP$2=aGX7j^$iSpU%w6
zsjNTwkdXjlSl(v!5TA>9@>o7+S$FzgXj+=_+fFxvvRnvOO)fuL+X~UR+IqY;ChVcU
zbDLiEr%XGks6>%wpUM4?p>`VkhC|~1l#;L)tVShdh)1GziF%GS(Af9^JjlIyZ|+Q<
zi;$7*cWIM}h+IchX{oQ1ux*BJ=heJBVID#?UgXxA)(a61Xt2mdCokZu2AujZ>&2lA
zRQ<`@Qd$yEha>)#J#4)fIriGusI14*E_m*@vI$?gX_L=$i#pYEufZuz*M18Rh<vx!
zv=)X!v)d0jM&Tl582yhq@2(%0$>lZjDeBjZY!*}%sTN+ilRnOMqY(AG1FaxdN*K84
zsz#qziaC|mEc~1qqm$KP>HRMGh;u=34>wDE*K9nV=f3?&4Bjx*bcomj0rv)_42h)O
z7%SF!V9VmR=_Y$Jp#B?G;{EzJ@r%X8Z|USN0ioHwjo440n6V&Ww`BT!XqRcK-=?1X
zVc|A1ninRL^eXc;J8OI)cheU(1PT@FUbh4kNBT&YF|BF}tcG<3j;oHk^VNIgOM0$9
znw5Cj_nj)?dfkS%!<DkKx@%3=veoeCMDOZXoyob}IMUJxsdSTgOPSV(HHUYmJdA=o
zSsU*fQ%YM!eGPD1EYZ=6p}XBe>D_F6*%|?JS$j3qt;vY+M4vmJbWgMh_jqE=|EOU_
z6R)aNl1GRPL|n;N${@2qW2Wl#J#&Q!_QX)6=cLG)@gD$Y1$pASL`+MGk!g8yc+qKN
zO+HaY;K?zzfYIFglz?wBy28<TEJxB^mbmv!DZ3IP%6nznnxeTpA|YK4QRK^ShNQB(
z>XqRn#anJjKBAh$R9wkD<tpx>MAIQZ2D@^HvZQ_uSMdR6f2l+Te$Qf3ww_-wczym%
zo2Bc#JnDY*UWfI<&fHqBFp!w`Q7saQ6|3krjsty;y9rZx_nGD`4Z7%9D#@NPRh{5`
zN<=(tq<%u?63_43v!}N0isOT=gv5FH3<|<?DhSx?e%Jtn)(>YaO>R1D=2KFWrU?LR
zvSB;C)ZH1H)z6|*81#tyfuFh}3t`}2@gf(<KODQg%^dnmvjWZfj@>$&z-!WaA#uK!
z;nzM;ImlJYQ`KTuGp^RY6*u_S7wu^Lh!^lh4nC<(2}%AuLmj_jaW8E=ZDh4DU#qu?
z=>A^tKAL4h*FpNGD>%lsdZUb&=x=)^?JIw3d8Mz{lyk*GOhfr@&z;ZYY#DYF+pF8F
uNf!eZw%^-V-wr_T#meOT*!(hn_!yvxOx?Z=#C09~Fd6Hc=@scX-uw?jBpfUN
--- a/mobile/android/branding/official/android-resources.mn
+++ b/mobile/android/branding/official/android-resources.mn
@@ -1,4 +1,5 @@
 mobile/android/app/android/drawable/alertaddons.png
 mobile/android/app/android/drawable/alertdownloads.png
 mobile/android/branding/official/content/logo.png
 mobile/android/branding/official/content/favicon32.png
+mobile/android/branding/official/content/bookmarkdefaults_favicon_aboutfirefox.png
new file mode 100644
index e69de29bb2d1d6434b8b29ae775ad8c2e48c5391..ac4a6968bf2746ad89a82d85df3a8679b5530cca
GIT binary patch
literal 2670
zc$@)l3X%1RP)<h;3K|Lk000e1NJLTq001BW001Be1^@s6b9#F80000PbVXQnQ*UN;
zcVTj606}DLVr3vnZDD6+Qe|Oed2z{QJOBU+5J^NqR9M5smwSv|)pf>y`*F^>_uRR6
zX0GRsXFM~048}HoB17y@T%a+O7OSy{>(UYl6w!tjHL6+&c~nuPMnY7L(lk;FR#T;r
zrcp|&CPlO<l_f*LaboJ$j<GS!B;y&6?Rnj~?|WW*@BU$oOapEH%O`DV@1?D^Kdq&`
z*0+Rnj-My=)lK<>5C1IpKLFec+zf06Rs;ROGB6FC0bT=M1&;rJ&Z@@_A)Iq0&+dK4
z==*T^P026+wZP20c$M5f;GmZe53Jt0zGvqLx3PQ2I&K&%Ggu7iHalFHt8)C!iyS$6
zhSSGRwbD-KAA#qp#}2)4$M!pU_Sb5}egkj30wTp31MuDij!a1Q9)jMH@#}!!71IB`
zRa<W??En3H*|MR`n1Tu*0RdRRx+{jdhVQ<5mdWQ|;N;1f_WW}66!3I&W@+-w$4|XC
zfhThc054D<+I`R1{ypEE{Da<`K6aOo>XV*dx@%<1hq(3EKfut&3Y+^SW3GeJ0a9Ke
z;NB*XIEaC%cE+L4A7b~)7^`ER|F`LvA0ImRgZlHYd;w@)n+AF9q15kxCM0|4&O7#f
zF=^YUlhnH_U*3#g9H7(A$RGX|gJ0N3_PwWQOF`H2_HuNMrEM(r)KZHQw%&Iy|8Oj(
zxv<Pv|8(@WrQvO#9J%}Yza8Dtx9NQew3g#NL#|u+!{F4TYl6o3?Q12!G`h@MIm<2I
zeVp6BdOydXIl^=8&9o9nH*-W5x(3<?W;-bpwJsNyI#ibv?%aPHlk;Vs`P!R2@R<q=
zLpwjxJ6QVXksEt={?sp6J){Pf>Q*jas<V4Xo)>rg5I^sud-|!)LT&O4Q=O2@quc1&
zwuO3T>CqAoK?W?RhS%piEH@%L&6KEVIX@Zm(7sX9dXwha*ZHl-$N0`;qt}<i&ffrg
zfc85Pn4LHG7D8!<?&?KWe2TOX^(w8mCTUMiqWW`Om`-W@%0UV@jIiW;EC-6Z5Y()r
zD+J}fJjG%jseM+A_tCfYIzIcQ<LugA=Z2d`80^ln<6s4EeC3Tpn|nTeZ3HSpiG$bg
z>QOXfmM1d|8e_pJiSh(NUNbflv+l%G6rR0+uN9|zwy<>D0sOE)WF5{|ge&s&7jiV(
zj?#FDzj_mY^u%$FemkWjbKEf4X2ro#UV3%vqrm5`61YF#?{D9-)p^Y`5ouRqFjygQ
z5=0;o!l431>&z6p^p`0YV4-&x&kz10E7y#X#0jZ!#1^6i>I+?FkDaD+^G@D)?j+y%
zT8;Y;q-2XFHm+-MM2ZS<yM8jKN=l0lZy48QyA%_3z@jk5VF9NcLOEn=*|c*7?O-FT
z9^TLCle7HY(K51=LoP(5sio8G(y4VZeu2hPgWAPQh%hA5MUJ0Z;-hyo$d80r0fXy<
zba}FMiw63%C)N)SE3dnlVV%MN4uKN_qyQ-qflp<um*KL{=bl;M>*tDu8#b~@`P6C&
z#tNF3TU5`U!)hO~Y7Fc9q~|9YS=r0%g27zsBG+_rnV>u%WUi?1(?Bm!F7_$XixMjZ
z&N!SD2v4E{P0*JoH_$^^&@|f%9GWPz`kr5<w?Cv-k1<I~>nBrK1l@LvsNTfQUcj_k
zG^=$U`AClFf=_G<$i)W!aFHyMMU%QM8mO4e1->t6q+H3n5=c*?LQN_Z3(FSU=rYA1
z*HsL~P!hK~)RGt>03ql!+jOSSW1Pcg88%CC7UF7^c0J{Z$5NtMiAxitsWWpKX)=cf
zf-H5K*x=<HaV!u@phHC~cAWap8m5^r6IA%~={*eO6U+(&)f$QCAtZpn_#w7X!ZemK
zQ3Tdvt;IU1)f$ks5w?ad<%s8(xiBx##!3x%T8peRmwGv0(2PJRfea)UCpx&qFj$7t
zYM&JwZlYle6jY4q#-ve3;xw5BUkHNAC|ReA=`I2SXDv1}bXpN~^JMioR4(QGt5v9k
z=xLd%JGJP~`{FkTN-797beux^5`0BtE~20<#Sk{H%UIjn;COT$OIeX9g?!pzmwKJu
zeKT0&n3*@2g&AzOgUvFsG)1Oub__4Ee^*S}ZX-m5CoLP-TIS!1YWmZWIrdlmdSYqG
z?yUF%=Yw+sA)wqRaN1G|!CBZJ{D5uV6o=beF-~%ef0iw!d5Wu6pto)3k6+o!U(OcL
z@jT91y44!Ly?2p6x%)g>L!m@MGM^wLOS)*OUrtVIfFyM<F4ePbaY1=m(INtcwa~jV
zhw@?yp`aV3oIDY;Zo?c8moDK1Bq=0|DQDhn@XFCXrd%19jgrL?CN+pG;@<5ul(RM_
z4#?_Vl9~Y-aQfdD>v6{&)&Nn)_o_|%$YNc3oj4_L1qEN?7ku<!5u3&oa+>5)#LNHE
zWzAZTFb~E!UTanOQhg88at$bj=XFRs5jJuZb1^p$RB3lIg03T}CLr^~vo)q)H#KW`
z`D!VC$rz?5t9GmBJHjNzD=35lQOM(RK28|6-V{*%k>cq$%3Ss;T=L3H$zif^)s=#k
zv`CgOB1|4Bx_o@s4E=$knM5Q@DRDJMByIldh`<qaANj`Gm)>c|ndMMBaeo$Aa@{l|
zSIijjC5bQ)D)2N;!!PVsO!SvHbAFf~w+FDM7dQPHbQU0q5ISMg#xZsc*7?-ldD^O%
zXnp~y71?sikEbLj-zYM^WAulm11H`k$qG5m(Sj$oM=6A%WYhK@az%;G3%tBU`4a63
zdVGt+^6iO1zBRdui<hVHU7JlS9rtWYIIz9}!r_e%)12#KyD_yn!`bgg{HQv>=t|$*
z`rysmw|wHC&b&(#YQa8V^7nxjrAFcy8uVGeA%_knUS6OBiS{MZ6G-U@RfcgH-AtgQ
zrIa_=)Y3@>xsn2Fh%MySRETD4w1behPQ(lp%-8pPv-ZHd6cIq?ctOFJQ_H8cAefy?
z0LR*O0nSKlVzD`i)Do#6l^}&gIExXEg{CG;zz?nzpkO#halDMM8FE-N@gGfk^XB{7
zb07ODNp=;n;qy2*Acc5HD}u`lDQRq2y(XYk)(Gbifx{}mSu$te?ww$aMQPB1!|zde
zfk$V$L36&wxf9Mh<l())Q@FeL!KHV`v3I55TKJMD5aJV_rpH-_uVHA|XK>h~P?C5#
zf%ZUZhtd`$9YS)YH^?i^?DT&}%uE?fEKN}0FCIJ>Kl;9-+5bjj`K*?_W{mryl42bK
z7A_~W8yN!wn%=S`UjRSvz;mFk2pCn)ksA$JZc3uQkYFIetBbGP_r}7b@Ac06M&KG0
zLZ2rc;sGHj1s>#mD29S!4-|SpYe!-otxOOLO`{2&NaFSQlPmo8V;?@2e&_w1|11Om
z=*@||7s%fTa`Lv+aCft1hSJO_lR1<YE(k>C=j2@fO7E04{Hu%8W1h%PO#B4<fB6+Z
c@A3S90Dk@A_1u|U7XSbN07*qoM6N<$g3GcX<p2Nx
--- a/mobile/android/branding/unofficial/android-resources.mn
+++ b/mobile/android/branding/unofficial/android-resources.mn
@@ -1,4 +1,5 @@
 mobile/android/app/android/drawable/alertaddons.png
 mobile/android/app/android/drawable/alertdownloads.png
 mobile/android/branding/unofficial/content/favicon32.png
 mobile/android/branding/unofficial/content/logo.png
+mobile/android/branding/unofficial/content/bookmarkdefaults_favicon_aboutfirefox.png
new file mode 100644
index e69de29bb2d1d6434b8b29ae775ad8c2e48c5391..3f04acd50d303235149c6a2822003ed94f8a51a7
GIT binary patch
literal 1761
zc$@*@1|Io|P)<h;3K|Lk000e1NJLTq0015U0015c1^@s6J20-I0000PbVXQnQ*UN;
zcVTj606}DLVr3vnZDD6+Qe|Oed2z{QJOBU&gGod|RCwCtS8Z%t)fs;5d;M+4UvbhT
zj+1&$(l(gVrY%)UQz#TlDYRnMKw}e?rcE2wer$vBV;^En+8?HM`@=e5DpDnuRtO3u
zg;63X1eK(1671P&zU?@65<7P6>)7|&*Vo=_uaTmvg|%oxXs`6h(z)lH=e+NEpZC0$
zl}aUi9VW-uWU^m8+4Yq+_~WbRzgZsNDltn?5tL6K-X;4gp*9hOtGJQb3Hu101*uqD
zES6+48A=M4Dbm=7gtHWO|BV)3Js?AK3M<6TYK`{gREm>SN_K?CJ|XlFa#z<dgdb%@
z`J)q}+vVEWS*teKG<vH6>4i8F^RvSEr#*=lYjm>4qUff%XK3@#D#G>j^AM?LHysuX
zBY&B`zgZ@JYUe%oKHGKo4#z?)n)G{pbLV?M3X&(MXu-#2FR!E>KbBkv*FV0;Ei)U`
zU|2b797e>#X^6atnK3{9^88U)6p29BcHQx^_k`*)q26fPc;L_@POU~~Du|Nol^2hl
zC-O(icNI+}64_i%fW4vK<a9br`wu?Ya^iS*!-&Uo=)#!J9n;h_ey6P((KL_PGLI^&
z2E{CkP@F?HnSq$gqjT35oIBIoJQQy_a)%|beN97y@%uk`;x?5+T{Ss2jkK_g!6EOw
zTwX~DiRrwfDLxljc%Z(%acy{Z4y=NOWsOa~dE2I1P1TyZb3>esPc6~ZJWAv(Yf(c~
zNLb1Wh!LsG$Y5qXfRRrJz-4$e?%AvBayQ$KJoR{s@AGlhsDBcLf`oFJx_D_YP%H?4
zpiqxjJZ6~^KQ$FhS*>Q{r2!B8z6tEQdmB2puG9bHuP*%h^#BAu4?$5xe0dp6o`FnG
zf}q`&Q#@o1wa~6#hYcN@@yww%>~QH!@0|VsIU$eQx*DjIN~F`v#n?h5YBFg0S7cE>
z%-?5cL(aDK-!hslCe+kg5sk)C6eZZ!Sn%w=Iy`g2k9=5yLal^c$v{rT93@w3HiDVK
zVYnaOho=v;qSL8?-#do8c5Q=NqsA5AB$g5>T)Oo6Jdu`FlUN}x+u6Br@P{M52^VRE
z%?mlKZE;{Hd7VsfXt$ejxYL3^y*><<PA_N3V@8JP=s4#6emY<t8{~7??cQD%3f8r|
zFg-DY$?+g!(F7$Ui;3~kNuyr*OA2#obpa8|S?u+CykcHN`^Glt^*W?dX=rsCOij+<
zvE8j`CABXG1B7WTPES`>3z;NZ*P8L$BllD6XwQ<IbZCXuu?cq9ZO~{`@Q+*x5@|P)
z`c_w<6+2!kWNqPaxV8wk-saeVlsAcvE$y^l60?B_j{fX^ymYb;cip*}9Al8CWIFer
z36CAvilS5kCsbER#X=TZmV?o#M<TwINyX<!HEKoAwWV*h^~4v$_vG`UB9qD5>@Ay+
z;0-W4??q-YKp~yMllwcMx3)kgD<PLn!EN6I1%*;+-iktrg_zC2cX<F~!+l7^BDqj#
z`f`<C`6786{32o>%gCQgbJ6FLsZ592=CDO0L8vrZXpFT;1xG-KLX!Izw0bkRM3^cO
zQ-MYlk&`4ygymEM94`qop{W6*UUiH}-@3MhmUVpXSeQgU5nW7dezp6bO%lHZXQLTX
zI)DsGN#F(WnGCpO3}U{3f>@}K@!T9lNsjm5eGkw7?)O-TO!}R6%TXfjzR@dlJ?pQp
zsp?fJ7TTH{Of{j=p^9#;)y7IO5DOwo(tkP^mMu$*!EA_#^IpUPvsj2PX7=vrn4{09
zZ}ezf&*K%#*460TC(rcPa~#Ju+M5wi10LTMSd3cas7#6!-j6PL5Q*_%DcSl5hH&!j
zPjKIM=b))d{pZzLd^7LyMWbH*QddXAh0&>qU?j4&Z5wg&jrTDZi6cuH&1Ld<<7^+c
z+_@75g9?2^V`ytOT&}a}Ph9U_Z>AAAWi@I2KmW<M^D3&()p`-bo?+}g_(bKd@7w=f
zjQBlhs@K7wSK+6JAI`M9YNNF7*niVWe3|w5Jj3qDe5`11ykLIxd&(wP>+L3i=cx`m
zFxcPAz5CW{;i6Q?DHUu{E|dL@ye)p&reAc&D>flXVy{-CJXOdGLqq-N9kzOxZhF*f
z0Hch*_R0$vO9kPDLY_aJ<1_CN=?DL-F7x)RP&gXOXx(+Hw6999`VEow-AdDTv*yvN
z*<ZD(^AAzK*F&VA-D<aZEB4t{eDnTE{QnXETYv!ou|o5pXp8b100000NkvXXu0mjf
Di}Ylk
--- a/mobile/android/chrome/content/about.xhtml
+++ b/mobile/android/chrome/content/about.xhtml
@@ -51,16 +51,17 @@
    -
    - ***** END LICENSE BLOCK ***** -->
 
 <html xmlns="http://www.w3.org/1999/xhtml">
 <head>
   <meta name="viewport" content="width=480; initial-scale=.6667; user-scalable=no"/>
   <title>&aboutPage.title;</title>
   <link rel="stylesheet" href="chrome://browser/skin/aboutPage.css" type="text/css"/>
+  <link rel="icon" type="image/png" href="chrome://branding/content/favicon32.png" />
 </head>
 
 <body dir="&locale.dir;">
   <div id="header">
     <div id="wordmark"></div>
 #expand <p id="version">__MOZ_APP_VERSION__</p>
   </div>
 
@@ -69,16 +70,19 @@
 #ifdef MOZ_UPDATER
     <div id="updateBox">
       <a id="updateLink" href="" onclick="checkForUpdates();">&aboutPage.checkForUpdates.link;</a>
       <span id="update-message-checking">&aboutPage.checkForUpdates.checking;</span>
       <span id="update-message-none">&aboutPage.checkForUpdates.none;</span>
       <span id="update-message-found">&aboutPage.checkForUpdates.found;</span>
     </div>
 #endif
+    <div id="aboutTelemetry" hidden="true">
+      <p id="telemetry">&aboutPage.warningVersion;&aboutPage.telemetryStart;<a href="http://www.mozilla.org/">&aboutPage.telemetryMozillaLink;</a>&aboutPage.telemetryEnd;</p>
+    </div>
   </div>
 
     <ul id="aboutLinks">
       <div class="top-border"></div>
       <li><a id="faqURL">&aboutPage.faq.label;</a></li>
       <li><a id="supportURL">&aboutPage.support.label;</a></li>
       <li><a id="privacyURL">&aboutPage.privacyPolicy.label;</a></li>
       <li><a href="about:rights">&aboutPage.rights.label;</a></li>
@@ -92,26 +96,28 @@
       <p>&logoTrademark;</p>
     </div>
 
     <script type="application/javascript;version=1.8"><![CDATA[
       let Ci = Components.interfaces, Cc = Components.classes, Cu = Components.utils, Cr = Components.results;
       Cu.import("resource://gre/modules/XPCOMUtils.jsm");
       Cu.import("resource://gre/modules/Services.jsm");
 
-      // Include the build date if this is an "a#" (nightly or aurora) build
+      // Include the build date and a warning about Telemetry
+      // if this is an "a#" (nightly or aurora) build
 #expand const version = "__MOZ_APP_VERSION__";
       if (/a\d+$/.test(version)) {
         let buildID = Services.appinfo.appBuildID;
         let buildDate = buildID.slice(0,4) + "-" + buildID.slice(4,6) + "-" + buildID.slice(6,8);
         let br = document.createElement("br");
         let versionPara = document.getElementById("version");
         versionPara.appendChild(br);
         let date = document.createTextNode("(" + buildDate + ")");
         versionPara.appendChild(date);
+        document.getElementById("aboutTelemetry").hidden = false;
       }
 
       // get URLs from prefs
       try {
         let formatter = Cc["@mozilla.org/toolkit/URLFormatterService;1"].getService(Ci.nsIURLFormatter);
 
         let links = [
           {id: "releaseNotesURL", pref: "app.releaseNotesURL"},
--- a/mobile/android/chrome/content/browser.js
+++ b/mobile/android/chrome/content/browser.js
@@ -47,16 +47,21 @@ Cu.import("resource://gre/modules/Servic
 Cu.import("resource://gre/modules/AddonManager.jsm");
 Cu.import("resource://gre/modules/FileUtils.jsm");
 
 XPCOMUtils.defineLazyGetter(this, "PluralForm", function() {
   Cu.import("resource://gre/modules/PluralForm.jsm");
   return PluralForm;
 });
 
+XPCOMUtils.defineLazyGetter(this, "DebuggerServer", function() {
+  Cu.import("resource://gre/modules/devtools/dbg-server.jsm");
+  return DebuggerServer;
+});
+
 // Lazily-loaded browser scripts:
 [
   ["SelectHelper", "chrome://browser/content/SelectHelper.js"],
 ].forEach(function (aScript) {
   let [name, script] = aScript;
   XPCOMUtils.defineLazyGetter(window, name, function() {
     let sandbox = {};
     Services.scriptloader.loadSubScript(script, sandbox);
@@ -232,16 +237,17 @@ var BrowserApp = {
     XPInstallObserver.init();
     ConsoleAPI.init();
     ClipboardHelper.init();
     PermissionsHelper.init();
     CharacterEncoding.init();
     SearchEngines.init();
     ActivityObserver.init();
     WebappsUI.init();
+    RemoteDebugger.init();
 
     // Init LoginManager
     Cc["@mozilla.org/login-manager;1"].getService(Ci.nsILoginManager);
     // Init FormHistory
     Cc["@mozilla.org/satchel/form-history;1"].getService(Ci.nsIFormHistory2);
 
     let url = "about:home";
     let forceRestore = false;
@@ -412,16 +418,17 @@ var BrowserApp = {
     OfflineApps.uninit();
     IndexedDB.uninit();
     ViewportHandler.uninit();
     XPInstallObserver.uninit();
     ConsoleAPI.uninit();
     CharacterEncoding.uninit();
     SearchEngines.uninit();
     WebappsUI.uninit();
+    RemoteDebugger.uninit();
   },
 
   // This function returns false during periods where the browser displayed document is
   // different from the browser content document, so user actions and some kinds of viewport
   // updates should be ignored. This period starts when we start loading a new page or
   // switch tabs, and ends when the new browser content document has been drawn and handed
   // off to the compositor.
   isBrowserContentDocumentDisplayed: function() {
@@ -2710,30 +2717,33 @@ const ElementTouchHelper = {
       this.dpiRatio = aWindowUtils.displayDPI / kReferenceDpi;
 
     let dpiRatio = this.dpiRatio;
 
     let target = aWindowUtils.elementFromPoint(aX, aY,
                                                true,   /* ignore root scroll frame*/
                                                false); /* don't flush layout */
 
-    // if this element is clickable we return quickly
-    if (this.isElementClickable(target))
+    // if this element is clickable we return quickly. also, if it isn't,
+    // use a cache to speed up future calls to isElementClickable in the
+    // loop below.
+    let unclickableCache = new Array();
+    if (this.isElementClickable(target, unclickableCache))
       return target;
 
     let target = null;
     let nodes = aWindowUtils.nodesFromRect(aX, aY, this.radius.top * dpiRatio,
                                                    this.radius.right * dpiRatio,
                                                    this.radius.bottom * dpiRatio,
                                                    this.radius.left * dpiRatio, true, false);
 
     let threshold = Number.POSITIVE_INFINITY;
     for (let i = 0; i < nodes.length; i++) {
       let current = nodes[i];
-      if (!current.mozMatchesSelector || !this.isElementClickable(current))
+      if (!current.mozMatchesSelector || !this.isElementClickable(current, unclickableCache))
         continue;
 
       let rect = current.getBoundingClientRect();
       let distance = this._computeDistanceFromRect(aX, aY, rect);
 
       // increase a little bit the weight for already visited items
       if (current && current.mozMatchesSelector("*:visited"))
         distance *= (this.weight.visited / 100);
@@ -2742,23 +2752,27 @@ const ElementTouchHelper = {
         target = current;
         threshold = distance;
       }
     }
 
     return target;
   },
 
-  isElementClickable: function isElementClickable(aElement) {
+  isElementClickable: function isElementClickable(aElement, aUnclickableCache) {
     const selector = "a,:link,:visited,[role=button],button,input,select,textarea,label";
     for (let elem = aElement; elem; elem = elem.parentNode) {
+      if (aUnclickableCache && aUnclickableCache.indexOf(elem) != -1)
+        continue;
       if (this._hasMouseListener(elem))
         return true;
       if (elem.mozMatchesSelector && elem.mozMatchesSelector(selector))
         return true;
+      if (aUnclickableCache)
+        aUnclickableCache.push(elem);
     }
     return false;
   },
 
   _computeDistanceFromRect: function _computeDistanceFromRect(aX, aY, aRect) {
     let x = 0, y = 0;
     let xmost = aRect.left + aRect.width;
     let ymost = aRect.top + aRect.height;
@@ -4606,8 +4620,74 @@ var WebappsUI = {
     if (tab) {
       BrowserApp.selectTab(tab);
     } else {
       tab = BrowserApp.addTab(aURI);
       ss.setTabValue(tab, "appOrigin", aOrigin);
     }
   }
 }
+
+var RemoteDebugger = {
+  init: function rd_init() {
+    Services.prefs.addObserver("remote-debugger.", this, false);
+
+    if (this._isEnabled())
+      this._start();
+  },
+
+  observe: function rd_observe(aSubject, aTopic, aData) {
+    if (aTopic != "nsPref:changed")
+      return;
+
+    switch (aData) {
+      case "remote-debugger.enabled":
+        if (this._isEnabled())
+          this._start();
+        else
+          this._stop();
+        break;
+
+      case "remote-debugger.port":
+        if (this._isEnabled())
+          this._restart();
+        break;
+    }
+  },
+
+  uninit: function rd_uninit() {
+    Services.prefs.removeObserver("remote-debugger.", this);
+    this._stop();
+  },
+
+  _getPort: function _rd_getPort() {
+    return Services.prefs.getIntPref("remote-debugger.port");
+  },
+
+  _isEnabled: function rd_isEnabled() {
+    return Services.prefs.getBoolPref("remote-debugger.enabled");
+  },
+
+  _restart: function rd_restart() {
+    this._stop();
+    this._start();
+  },
+
+  _start: function rd_start() {
+    try {
+      if (!DebuggerServer.initialized) {
+        DebuggerServer.init();
+        DebuggerServer.addActors("chrome://browser/content/dbg-browser-actors.js");
+      }
+
+      let port = this._getPort();
+      DebuggerServer.openListener(port, false);
+      dump("Remote debugger listening on port " + port);
+    } catch(e) {
+      dump("Remote debugger didn't start: " + e);
+    }
+  },
+
+  _stop: function rd_start() {
+    DebuggerServer.closeListener();
+    dump("Remote debugger stopped");
+  }
+}
new file mode 100644
--- /dev/null
+++ b/mobile/android/chrome/content/dbg-browser-actors.js
@@ -0,0 +1,414 @@
+/* -*- Mode: javascript; tab-width: 2; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this file,
+ * You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+"use strict";
+/**
+ * Fennec-specific actors.
+ */
+
+var windowMediator = Cc["@mozilla.org/appshell/window-mediator;1"]
+  .getService(Ci.nsIWindowMediator);
+
+function createRootActor(aConnection) {
+  return new BrowserRootActor(aConnection);
+}
+
+/**
+ * Creates the root actor that client-server communications always start with.
+ * The root actor is responsible for the initial 'hello' packet and for
+ * responding to a 'listTabs' request that produces the list of currently open
+ * tabs.
+ *
+ * @param aConnection DebuggerServerConnection
+ *        The conection to the client.
+ */
+function BrowserRootActor(aConnection) {
+  this.conn = aConnection;
+  this._tabActors = new WeakMap();
+  this._tabActorPool = null;
+  this._actorFactories = null;
+
+  this.onTabClosed = this.onTabClosed.bind(this);
+  windowMediator.addListener(this);
+}
+
+BrowserRootActor.prototype = {
+  /**
+   * Return a 'hello' packet as specified by the Remote Debugging Protocol.
+   */
+  sayHello: function BRA_sayHello() {
+    return { from: "root",
+             applicationType: "browser",
+             traits: [] };
+  },
+
+  /**
+   * Disconnects the actor from the browser window.
+   */
+  disconnect: function BRA_disconnect() {
+    windowMediator.removeListener(this);
+
+    // We may have registered event listeners on browser windows to
+    // watch for tab closes, remove those.
+    let win = windowMediator.getMostRecentWindow("navigator:browser");
+    this.unwatchWindow(win);
+
+    // Signal our imminent shutdown.
+    let evt = win.document.createEvent("Event");
+    evt.initEvent("Debugger:Shutdown", true, false);
+    win.document.documentElement.dispatchEvent(evt);
+  },
+
+  /**
+   * Handles the listTabs request.  Builds a list of actors
+   * for the tabs running in the process.  The actors will survive
+   * until at least the next listTabs request.
+   */
+  onListTabs: function BRA_onListTabs() {
+    // Get actors for all the currently-running tabs (reusing
+    // existing actors where applicable), and store them in
+    // an ActorPool.
+
+    let actorPool = new ActorPool(this.conn);
+    let actorList = [];
+
+    let win = windowMediator.getMostRecentWindow("navigator:browser");
+    this.browser = win.BrowserApp.selectedBrowser;
+
+    // Watch the window for tab closes so we can invalidate
+    // actors as needed.
+    this.watchWindow(win);
+
+    let tabs = win.BrowserApp.tabs;
+    let selected;
+
+    for each (let tab in tabs) {
+      let browser = tab.browser;
+
+      if (browser == this.browser) {
+        selected = actorList.length;
+      }
+
+      let actor = this._tabActors.get(browser);
+      if (!actor) {
+        actor = new BrowserTabActor(this.conn, browser);
+        actor.parentID = this.actorID;
+        this._tabActors.set(browser, actor);
+      }
+
+      actorPool.addActor(actor);
+      actorList.push(actor);
+    }
+
+    // Now drop the old actorID -> actor map.  Actors that still
+    // mattered were added to the new map, others will go
+    // away.
+    if (this._tabActorPool) {
+      this.conn.removeActorPool(this._tabActorPool);
+    }
+
+    this._tabActorPool = actorPool;
+    this.conn.addActorPool(this._tabActorPool);
+
+    return { "from": "root",
+             "selected": selected,
+             "tabs": [actor.grip()
+                      for each (actor in actorList)] };
+  },
+
+  /**
+   * Watch a window that was visited during onListTabs for
+   * tab closures.
+   */
+  watchWindow: function BRA_watchWindow(aWindow) {
+    let tabContainer = aWindow.document.getElementById("browsers");
+    tabContainer.addEventListener("TabClose",
+                                  this.onTabClosed,
+                                  false);
+  },
+
+  /**
+   * Stop watching a window for tab closes.
+   */
+  unwatchWindow: function BRA_unwatchWindow(aWindow) {
+    let tabContainer = aWindow.document.getElementById("browsers");
+    tabContainer.removeEventListener("TabClose", this.onTabClosed);
+    this.exitTabActor(aWindow);
+  },
+
+  /**
+   * When a tab is closed, exit its tab actor.  The actor
+   * will be dropped at the next listTabs request.
+   */
+  onTabClosed: function BRA_onTabClosed(aEvent) {
+    this.exitTabActor(aEvent.target.browser);
+  },
+
+  /**
+   * Exit the tab actor of the specified tab.
+   */
+  exitTabActor: function BRA_exitTabActor(aWindow) {
+    let actor = this._tabActors.get(aWindow);
+    if (actor) {
+      actor.exit();
+    }
+  },
+
+  // nsIWindowMediatorListener
+  onWindowTitleChange: function BRA_onWindowTitleChange(aWindow, aTitle) { },
+  onOpenWindow: function BRA_onOpenWindow(aWindow) { },
+  onCloseWindow: function BRA_onCloseWindow(aWindow) {
+    if (aWindow.BrowserApp) {
+      this.unwatchWindow(aWindow);
+    }
+  }
+}
+
+/**
+ * The request types this actor can handle.
+ */
+BrowserRootActor.prototype.requestTypes = {
+  "listTabs": BrowserRootActor.prototype.onListTabs
+};
+
+/**
+ * Creates a tab actor for handling requests to a browser tab, like attaching
+ * and detaching.
+ *
+ * @param aConnection DebuggerServerConnection
+ *        The conection to the client.
+ * @param aBrowser browser
+ *        The browser instance that contains this tab.
+ */
+function BrowserTabActor(aConnection, aBrowser)
+{
+  this.conn = aConnection;
+  this._browser = aBrowser;
+
+  this._onWindowCreated = this.onWindowCreated.bind(this);
+}
+
+// XXX (bug 710213): BrowserTabActor attach/detach/exit/disconnect is a
+// *complete* mess, needs to be rethought asap.
+
+BrowserTabActor.prototype = {
+  get browser() { return this._browser; },
+
+  get exited() { return !this._browser; },
+  get attached() { return !!this._attached },
+
+  _tabPool: null,
+  get tabActorPool() { return this._tabPool; },
+
+  _contextPool: null,
+  get contextActorPool() { return this._contextPool; },
+
+  actorPrefix: "tab",
+
+  grip: function BTA_grip() {
+    dbg_assert(!this.exited,
+               "grip() shouldn't be called on exited browser actor.");
+    dbg_assert(this.actorID,
+               "tab should have an actorID.");
+    return { actor: this.actorID,
+             title: this._browser.contentTitle,
+             url: this._browser.currentURI.spec }
+  },
+
+  /**
+   * Called when the actor is removed from the connection.
+   */
+  disconnect: function BTA_disconnect() {
+    this._detach();
+  },
+
+  /**
+   * Called by the root actor when the underlying tab is closed.
+   */
+  exit: function BTA_exit() {
+    if (this.exited) {
+      return;
+    }
+
+    if (this.attached) {
+      this._detach();
+      this.conn.send({ from: this.actorID,
+                       type: "tabDetached" });
+    }
+
+    this._browser = null;
+  },
+
+  /**
+   * Does the actual work of attching to a tab.
+   */
+  _attach: function BTA_attach() {
+    if (this._attached) {
+      return;
+    }
+
+    // Create a pool for tab-lifetime actors.
+    dbg_assert(!this._tabPool, "Shouldn't have a tab pool if we weren't attached.");
+    this._tabPool = new ActorPool(this.conn);
+    this.conn.addActorPool(this._tabPool);
+
+    // ... and a pool for context-lifetime actors.
+    this._pushContext();
+
+    // Watch for globals being created in this tab.
+    this._browser.addEventListener("DOMWindowCreated", this._onWindowCreated, true);
+
+    this._attached = true;
+  },
+
+  /**
+   * Creates a thread actor and a pool for context-lifetime actors. It then sets
+   * up the content window for debugging.
+   */
+  _pushContext: function BTA_pushContext() {
+    dbg_assert(!this._contextPool, "Can't push multiple contexts");
+
+    this._contextPool = new ActorPool(this.conn);
+    this.conn.addActorPool(this._contextPool);
+
+    this.threadActor = new ThreadActor(this);
+    this._addDebuggees(this._browser.contentWindow.wrappedJSObject);
+    this._contextPool.addActor(this.threadActor);
+  },
+
+  /**
+   * Add the provided window and all windows in its frame tree as debuggees.
+   */
+  _addDebuggees: function BTA__addDebuggees(aWindow) {
+    this.threadActor.addDebuggee(aWindow);
+    let frames = aWindow.frames;
+    for (let i = 0; i < frames.length; i++) {
+      this._addDebuggees(frames[i]);
+    }
+  },
+
+  /**
+   * Exits the current thread actor and removes the context-lifetime actor pool.
+   * The content window is no longer being debugged after this call.
+   */
+  _popContext: function BTA_popContext() {
+    dbg_assert(!!this._contextPool, "No context to pop.");
+
+    this.conn.removeActorPool(this._contextPool);
+    this._contextPool = null;
+    this.threadActor.exit();
+    this.threadActor = null;
+  },
+
+  /**
+   * Does the actual work of detaching from a tab.
+   */
+  _detach: function BTA_detach() {
+    if (!this.attached) {
+      return;
+    }
+
+    this._browser.removeEventListener("DOMWindowCreated", this._onWindowCreated, true);
+
+    this._popContext();
+
+    // Shut down actors that belong to this tab's pool.
+    this.conn.removeActorPool(this._tabPool);
+    this._tabPool = null;
+
+    this._attached = false;
+  },
+
+  // Protocol Request Handlers
+
+  onAttach: function BTA_onAttach(aRequest) {
+    if (this.exited) {
+      return { type: "exited" };
+    }
+
+    this._attach();
+
+    return { type: "tabAttached", threadActor: this.threadActor.actorID };
+  },
+
+  onDetach: function BTA_onDetach(aRequest) {
+    if (!this.attached) {
+      return { error: "wrongState" };
+    }
+
+    this._detach();
+
+    return { type: "detached" };
+  },
+
+  /**
+   * Prepare to enter a nested event loop by disabling debuggee events.
+   */
+  preNest: function BTA_preNest() {
+    if (!this._browser) {
+      // The tab is already closed.
+      return;
+    }
+    let windowUtils = this._browser.contentWindow
+                          .QueryInterface(Ci.nsIInterfaceRequestor)
+                          .getInterface(Ci.nsIDOMWindowUtils);
+    windowUtils.suppressEventHandling(true);
+    windowUtils.suspendTimeouts();
+  },
+
+  /**
+   * Prepare to exit a nested event loop by enabling debuggee events.
+   */
+  postNest: function BTA_postNest(aNestData) {
+    if (!this._browser) {
+      // The tab is already closed.
+      return;
+    }
+    let windowUtils = this._browser.contentWindow
+                          .QueryInterface(Ci.nsIInterfaceRequestor)
+                          .getInterface(Ci.nsIDOMWindowUtils);
+    windowUtils.resumeTimeouts();
+    windowUtils.suppressEventHandling(false);
+  },
+
+  /**
+   * Handle location changes, by sending a tabNavigated notification to the
+   * client.
+   */
+  onWindowCreated: function BTA_onWindowCreated(evt) {
+    if (evt.target === this._browser.contentDocument) {
+      if (this._attached) {
+        this.conn.send({ from: this.actorID, type: "tabNavigated",
+                         url: this._browser.contentDocument.URL });
+      }
+    }
+  }
+};
+
+/**
+ * The request types this actor can handle.
+ */
+BrowserTabActor.prototype.requestTypes = {
+  "attach": BrowserTabActor.prototype.onAttach,
+  "detach": BrowserTabActor.prototype.onDetach
+};
+
+/**
+ * Registers handlers for new request types defined dynamically. This is used
+ * for example by add-ons to augment the functionality of the tab actor.
+ *
+ * @param aName string
+ *        The name of the new request type.
+ * @param aFunction function
+ *        The handler for this request type.
+ */
+DebuggerServer.addTabRequest = function DS_addTabRequest(aName, aFunction) {
+  BrowserTabActor.prototype.requestTypes[aName] = function(aRequest) {
+    if (!this.attached) {
+      return { error: "wrongState" };
+    }
+    return aFunction(this, aRequest);
+  }
+};
--- a/mobile/android/chrome/jar.mn
+++ b/mobile/android/chrome/jar.mn
@@ -25,12 +25,13 @@ chrome.jar:
   content/browser.css                  (content/browser.css)
   content/cursor.css                   (content/cursor.css)
 % content branding %content/branding/
   content/sanitize.js                  (content/sanitize.js)
   content/exceptions.js                (content/exceptions.js)
 * content/downloads.js                 (content/downloads.js)
   content/netError.xhtml               (content/netError.xhtml)
   content/SelectHelper.js              (content/SelectHelper.js)
+  content/dbg-browser-actors.js        (content/dbg-browser-actors.js)
 
 % override chrome://global/content/config.xul chrome://browser/content/config.xhtml
 % override chrome://global/content/netError.xhtml chrome://browser/content/netError.xhtml
 % override chrome://mozapps/content/extensions/extensions.xul chrome://browser/content/aboutAddons.xhtml
--- a/mobile/android/installer/package-manifest.in
+++ b/mobile/android/installer/package-manifest.in
@@ -194,16 +194,18 @@
 @BINPATH@/components/htmlparser.xpt
 @BINPATH@/components/imglib2.xpt
 @BINPATH@/compone