Merge last PGO-green changeset of mozilla-inbound to mozilla-central
authorEd Morley <emorley@mozilla.com>
Mon, 17 Sep 2012 20:19:57 +0100
changeset 107268 0d3b17a88d5fe753b3e5e515159ff92ff47e2933
parent 107267 8f9db0705d2f4a45b73672dbf8c5077c14e2cd2e (current diff)
parent 107234 5f81207015b5d984c093c8595d22fee76fabd01a (diff)
child 107269 a66825ff145ef853c0f7235c90b37b49cce45d11
child 107364 2e429432490c6be74b670a9a52a57befab7c1ca6
push id14944
push useremorley@mozilla.com
push dateMon, 17 Sep 2012 19:21:06 +0000
treeherdermozilla-inbound@a66825ff145e [default view] [failures only]
perfherder[talos] [build metrics] [platform microbench] (compared to previous push)
milestone18.0a1
first release with
nightly linux32
0d3b17a88d5f / 18.0a1 / 20120918030553 / files
nightly linux64
0d3b17a88d5f / 18.0a1 / 20120918030553 / files
nightly mac
0d3b17a88d5f / 18.0a1 / 20120918030553 / files
nightly win32
0d3b17a88d5f / 18.0a1 / 20120918030553 / files
nightly win64
0d3b17a88d5f / 18.0a1 / 20120918030553 / files
last release without
nightly linux32
nightly linux64
nightly mac
nightly win32
nightly win64
releases
nightly linux32
nightly linux64
nightly mac
nightly win32
nightly win64
Merge last PGO-green changeset of mozilla-inbound to mozilla-central
browser/base/content/test/browser_bug583890.js
browser/base/content/test/browser_bug583890_label.js
browser/modules/TabTitleAbridger.jsm
editor/idl/nsIEditorObserver.idl
netwerk/base/src/ProxyAutoConfig.cpp
netwerk/base/src/ProxyAutoConfig.h
new file mode 100644
--- /dev/null
+++ b/AUTHORS
@@ -0,0 +1,1071 @@
+This is an (incomplete) list of people who have contributed to the
+codebase which lives in this repository. If you make a contribution
+here, you may add your name and, optionally, email address in the
+appropriate place.
+
+For a full list of the people who are credited with making a
+contribution to Mozilla, see http://www.mozilla.org/credits/ .
+
+<1010mozilla@Ostermiller.com>
+Aaron Boodman <aa@google.com>
+Aaron Kaluszka <ask@swva.net>
+Aaron Leventhal <aaronleventhal@moonset.net>
+Aaron Nowack <anowack@mimiru.net>
+Aaron Reed <aaronr@us.ibm.com>
+Aaron Spangler <aaron@spangler.ods.org>
+Aaron Train <aaron.train@gmail.com>
+Achim Hasenmueller <achimha@innotek.de>
+ActiveState Tool Corp.
+Adam Barth <hk9565@gmail.com>
+Adam Christian <adam.christian@gmail.com>
+Adam Hauner
+Adam Lock <adamlock@netscape.com>
+Adam L. Peller
+Adam Souzis <adam@souzis.com>
+Aditya Rao <adicoolrao@gmail.com>
+Adobe Systems Incorporated
+Adrian Havill <havill@redhat.com>
+Adrian Herscu <bmf1972@icqmail.com>
+Adrian Johnson <ajohnson@redneon.com>
+Adrian Kalla <akalla@aviary.pl>
+Adrian Klein <dragosan@dragosan.net>
+a-higuti
+Aiko
+Akhil Arora <akhil.arora@sun.com>
+Akkana Peck <akkana@netscape.com>
+Alden D'Souza <aldenfloyd@gmail.com>
+Alec Flett <alecf@flett.org>
+Aleksey Chernoraenko <archer@meta-comm.com>
+Aleksey Nogin <ayn2@cornell.edu>
+Aleks Totic <a@totic.org>
+Alexander Law <1@1o.ru>
+Alexander Surkov <surkov.alexander@gmail.com>
+Alexey Chernyak <alexeyc@bigfoot.com>
+Alex Fritze <alex@croczilla.com>
+Alex Miller <amiller@mozilla.com>
+Alex Musil
+Alex Pakhotin <alexp@mozilla.com>
+Alex Russell
+Alex Vincent <ajvincent@gmail.com>
+Alfred Kayser <alfredkayser@nl.ibm.com>
+Alfred Peng <alfred.peng@sun.com>
+Ali Juma <ajuma@mozilla.com>
+Allan Beaufour <allan@beaufour.dk>
+Allen Eubank <adeubank@gmail.com>
+Allison Naaktgeboren <ally@mozilla.com>
+Alon Zakai <azakai@mozilla.com>
+Amir Szekely <kichik@gmail.com>
+Anant Narayanan <anant@kix.in>
+An-Cheng Huang <pach@cs.cmu.edu>
+Anders Hammarquist
+Andras Timar
+Andrea Canciani <ranma42@gmail.com>
+Andreas Gal <gal@uci.edu>
+Andreas M. Schneider <clarence@clarence.de>
+Andreas Otte <andreas.otte@debitel.net>
+Andrei Saprykin
+Andrei Volkov <av@netscape.com>
+Andrew Drake <drakedevel@gmail.com>
+Andrew Halberstadt <halbersa@gmail.com>
+Andrew Huntwork <ash@huntwork.net>
+Andrew Schultz <ajschult@verizon.net>
+Andrew Shilliday <andrewshilliday@gmail.com>
+Andrew Shultz
+Andrew Smith
+Andrew Sutherland <asutherland@asutherland.org>
+Andrew Thompson
+Andrew Zabolotny
+Andrzej Skalski <askalski@mozilla.com>
+Annie Sullivan <annie.sullivan@gmail.com>
+Anoop Saldanha <poonaatsoc@gmail.com>
+antonglv
+Antti Järvelin <antti.i.jarvelin@gmail.com>
+Arkady Blyakher <rkadyb@mit.edu>
+Armen Zambrano Gasparnian <armenzg@mozilla.com>
+Arno Renevier
+Arpad Borsos <arpad.borsos@googlemail.com>
+Arron Mogge <paper@animecity.nu>
+Arthur Wiebe <artooro@gmail.com>
+Asaf Romano <mozilla.mano@sent.com>
+Asko Tontti <atontti@cc.hut.fi>
+Atul Apte <aapte135@gmail.com>
+Atul Varma <atul@mozilla.com>
+Axel Hecht <axel@pike.org>
+Aza Raskin <aza@mozilla.com>
+Bart <dev@bartbizon.com>
+Bas Schouten <bschouten@mozilla.com>
+Bastiaan Jacques <b.jacques@planet.nl>
+<bedney@technicalpursuit.com>
+Behdad Esfahbod <behdad@behdad.org>
+Behnam Esfahbod <behnam@zwnj.org>
+Ben Basson <contact@cusser.net>
+Ben Bucksch <mozilla@bucksch.org>
+Ben Combee <bcombee@mozilla.com>
+Bencsath Boldizsar
+Benedict Hsieh <bhsieh@mozilla.com>
+Ben Goodger <ben@bengoodger.com>
+Ben Hearsum <bhearsum@mozilla.com>
+Ben Hsieh <ben.hsieh@gmail.com>
+Benjamin Frisch <bfrisch@gmail.com>
+Benjamin Otte <otte@gnome.org>
+Benjamin Smedberg <benjamin@smedbergs.us>
+Benjamin Stover <bstover@mozilla.com>
+Ben Newman <bnewman@mozilla.com>
+Benoit Girard <b56girard@gmail.com>
+Benoit Jacob <bjacob@mozilla.com>
+Ben Turner <bent.mozilla@gmail.com>
+Bertrand Le Roy
+bex@xaotec.com
+Biju
+Bill Haneman (bill.haneman@sun.com)
+Bill Law <law@netscape.com>
+Bill Worley
+Biro Arpad
+Bjarne Geir Herland <bjarne@runitsoft.com>
+Björn Jacke <bjoern.jacke@gmx.de>
+Blair McBride <bmcbride@mozilla.com>
+Blake Kaplan <mrbkap@gmail.com>
+Blake Ross <blake@blakeross.com>
+Blue Static
+Bobby Holley <bobbyholley@gmail.com>
+Bob Clary <bob@bclary.com>
+bobj@netscape.com
+Bob Lord <lord@netscape.com>
+Bob Miller <kbob@oblix.com>
+Bob Moss <bmoss@mozilla.com>
+Bob Relyea <rrelyea@redhat.com>
+Bodo Moeller <moeller@cdc.informatik.tu-darmstadt.de>
+bogomip
+Bolian Yin <bolian.yin@sun.com>
+Boris Zbarsky <bzbarsky@mit.edu>
+Brad Lassey <brad@lassey.us>
+Bradley Baetz <bbaetz@acm.org>
+Brad Taylor <brad@getcoded.net>
+Bram Moolenaar
+Brandon Pung <brandonpung@gmail.com>
+Brandon Sterne <bsterne@mozilla.com>
+Brant Gurganus <brantgurganus2001@cherokeescouting.org>
+Braun <ebraun@o2.pl>
+Brendan Eich <brendan@mozilla.org>
+Brett Wilson <brettw@gmail.com>
+Brian Birtles <birtles@gmail.com>
+Brian Bober <netdemonz@yahoo.com>
+Brian Crowder <crowderbt@gmail.com>
+briang@tonic.com
+Brian Hackett <bhackett@mozilla.com>
+Brian Lu <brian.lu@sun.com>
+Brian Nesse <bnesse@netscape.com>
+Brian Nicholson <bnicholson@mozilla.com>
+Brian O'Keefe <bokeefe@alum.wpi.edu>
+Brian R. Bondy <netzen@gmail.com>
+Brian Ryner <bryner@brianryner.com>
+Brian Smith <bsmith@mozilla.com>
+Brian Stell <bstell@ix.netcom.com>
+Brijesh Patel <brijesh3105@gmail.com>
+Brodie Thiesfield <brofield@jellycan.com>
+Bruce Hoult
+Bruno Haible <bruno@clisp.org>
+Bryant Chen
+Calum Robinson <calumr@mac.com>
+CanadianGuy
+Canonical Ltd
+Caolan McNamara <cmc@openoffice.org>
+Carl D. Worth <cworth@cworth.org>
+Carlo Alberto Ferraris <cafxx@strayorange.com>
+Carsten Book
+Catalin Patulea
+Cavin Song <cavin@netscape.com>
+Cedric Vivier <cedricv@neonux.com>
+Celso Aguiar <celsoaguiar@hotmail.com>
+Chak Nanga <chak@netscape.com>
+Chao-ying Fu <fu@mips.com>
+Charles Manske <cmanske@netscape.com>
+Charles Verdon
+Chase Phillips <chase@mozilla.org>
+Chase Tingley <tingley@sundell.net>
+Chenxia Liu <liuche@mozilla.com>
+Chip Clark <chipc@netscape.com>
+Chookij Vanatham <Chookij.Vanatham@Eng.Sun.COM>
+Chris AtLee <catlee@mozilla.com>
+Chris Beard <cbeard@mozilla.com>
+Chris Coulson <chris.coulson@canonical.com>
+Chris Double <chris.double@double.co.nz>
+Chris Evans
+Chris Halls
+Chris Jones <jones.chris.g@gmail.com>
+Chris Leary <cdleary@mozilla.com>
+Chris Lord <chrislord.net@gmail.com>
+Chris McAfee <mcafee@netscape.com>
+Chris Pearce <chris@pearce.org.nz>
+Chris Saari <saari@netscape.com>
+Chris Seawood <cls@seawood.org>
+Christian Biesinger <cbiesinger@gmail.com>
+Christian Bodart <chris@bodar.com>
+Christian Schneider <c.schneider@scram.de>
+christine@netscape.com
+Christopher A. Aillon <christopher@aillon.com>
+Christopher Blizzard <blizzard@mozilla.org>
+Christopher Davis <chrisd@torproject.org>
+Christopher Nebergall <cneberg@sandia.gov>
+Christopher Thomas <cst@yecc.com>
+Chris Torek <torek@bsdi.com>
+Chris Waterson <waterson@netscape.com>
+Chris Wilson <chris@chris-wilson.co.uk>
+<chwu@nortelnetworks.com>
+Claudio Ciccani <klan@users.sf.net>
+Clayton Williams <claytonw@mit.edu>
+Clint Talbert <cmtalbert@gmail.com>
+Colin Barrett <cbarrett@mozilla.com>
+Colin Blake <colin@theblakes.com>
+<coliver@mminternet.com>
+Collabora Ltd
+Collin Jackson <mozilla@collinjackson.com>
+conor@the325project.org
+Conrad Carlen <conrad@ingress.com>
+Constantine A. Murenin <cnst+moz#bugmail.mojo.ru>
+Craig Topper <craig.topper@gmail.com>
+crock@veilnetworks.com
+Crocodile Clips Ltd
+Cryptography Research
+CSIRO
+Curtis Bartley <cbartley@mozilla.com>
+Cyrus Omar
+Cyrus Patel <cyp@fb14.uni-mainz.de>
+Dafydd Jones
+Dainis Jonitis <Dainis_Jonitis@swh-t.lv>
+Daniel Aquino <mr.danielaquino@gmail.com>
+Daniel Bratell <bratell@lysator.liu.se>
+Daniel Brooks <db48x@db48x.net>
+Daniel Glazman <daniel.glazman@disruptive-innovations.com>
+Daniel Holbert <dholbert@mozilla.com>
+Daniel Kouril <kouril@ics.muni.cz>
+Daniel Kraft <d@domob.eu>
+Daniel Krieg
+Daniel Veditz <dveditz@cruzio.com>
+Daniel Witte <dwitte@stanford.edu>
+Dan Matejka <danm@netscape.com>
+Dan Mills <thunder@mozilla.com>
+Dan Mosedale <dmose@mozilla.org>
+Dan Rosen <dr@netscape.com>
+Dan Witte <dwitte@mozilla.com>
+Dão Gottwald <dao@design-noir.de>
+Darin Fisher <darin@meer.net>
+darren.deridder@icarusproject.com
+Dave Camp <dcamp@mozilla.com>
+Dave Herman <dherman@mozilla.com>
+davel@mozilla.com
+Dave Mandelin <dmandelin@mozilla.com>
+Dave Reed
+Dave Townsend <dtownsend@oxymoronical.com>
+David Anderson <danderson@mozilla.com>
+David Baron <dbaron@dbaron.org>
+David Bienvenu <bienvenu@nventure.com>
+David Bradley <bradley@netscape.com>
+David Burns <dburns@mozilla.com>
+David Courtin <dcourtin@systemplus.fr>
+David Dahl <ddahl@mozilla.com>
+David Dick <ddick@cpan.org>
+David Drinan <ddrinan@netscape.com>
+David Einstein <Deinst@world.std.com>
+Davide Prina
+David Finch
+David Gardiner <david.gardiner@unisa.edu.au>
+David Greenspan
+David Haas <haasd@cae.wisc.edu>
+David Hamp-Gonsalves
+David Humphrey <david.humphrey@senecac.on.ca>
+David Hyatt <hyatt@mozilla.org>
+David James
+David J. Fiddes <D.J.Fiddes@hw.ac.uk>
+David Andersson <liorean@gmail.com>
+<davidm@netscape.com>
+David P. Caldwell <inonit@inonit.com>
+David Rajchenbach-Teller <dteller@mozilla.com>
+David Savage
+David S. Miller <davem@redhat.com>
+David Woodhouse <dwmw2@infradead.org>
+David Zbarsky <dzbarsky@gmail.com>
+Dean Tessman <dean_tessman@hotmail.com>
+<deneen@alum.bucknell.edu>
+Denis Antrushin <adu@sparc.spb.su>
+Denis Issoupov <denis@macadamian.com>
+Dennis Handly
+Derrick Rice <derrick.rice@gmail.com>
+<desale@netscape.com>
+diablohn
+Diane Trout <diane@ghic.org>
+Dietrich Ayala <dietrich@mozilla.com>
+Digital Creations 2, Inc
+Disruptive Innovations
+<djoham@criadvantage.com>
+Don Bragg <dbragg@netscape.com>
+Don Brown
+Don Cone <dcone@netscape.com>
+Doodle <doodle@scenergy.dfmk.hu>
+Doron Rosenberg <doronr@naboonline.com>
+Dorus Peelen
+Douglas Stebila <douglas@stebila.ca>
+Doug Sherk <dsherk@mozilla.com>
+Doug Turner <dougt@dougt.org>
+Doug Wright
+<drbrain-bugzilla@segment7.net>
+Drew Willcoxon <adw@mozilla.com>
+<drimbk@yahoo.com>
+Dr Stephen Henson <stephen.henson@gemplus.com>
+<d-russo@ti.com>
+Dr Vipul Gupta <vipul.gupta@sun.com>
+Dvornik Laszlo
+Ed Burns <edburns@acm.org>
+Edward Lee <edilee@mozilla.com>
+Egor Starkov <starkov.egor@gmail.com>
+Ehsan Akhgari <ehsan.akhgari@gmail.com>
+Eitan Isaacson <eitan@monotonous.org>
+Eli Friedman <sharparrow1@yahoo.com>
+Elika J. Etemad <fantasai@inkedblade.net>
+Emanuele Costa <emanuele.costa@gmail.com>
+emk <VYV03354@nifty.ne.jp>
+Emmanuel Pacaud <emmanuel.pacaud@free.fr>
+<epstein@tellme.com>
+Ere Maijala <emaijala@kolumbus.fi>
+Eric Anholt <eric@anholt.net>
+Eric Butler <zantifon@gmail.com>
+Eric Hedekar <afterthebeep@gmail.com>
+Eric J. Burley <ericb@neoplanet.com>
+Eric Promislow
+Eric Vaughan <evaughan@netscape.com>
+Erik Fabert <jerfa@yahoo.com>
+Erik van der Poel
+Erik Vold <erikvvold@gmail.com>
+Ervin Yan <ervin.yan@sun.com>
+Erwan Loisant <eloisant@gmail.com>
+Esben Mose Hansen <esben@oek.dk>
+Ethan Hugg
+Eugeniy Meshcheryakov <eugen@debian.org>
+Evan Yan <evan.yan@sun.com>
+Fabrice Desré <fabrice.desre@gmail.com>
+Federico Mena-Quintero <federico@novell.com>
+Felipe Gomes <felipc@gmail.com>
+Felix Fung <felix.the.cheshire.cat@gmail.com>
+<felix.meschberger@day.com>
+Feng Qian
+Fernando Herrera <fherrera@onirica.com>
+Fernando Jimenez <ferjmoreno@gmail.com>
+Flock Inc.
+Florian Boesch <pyalot@gmail.com>
+Florian Hänel <heeen@gmx.de>
+Florian Queze <florian@queze.net>
+Florian Scholz <elchi3@elchi3.de>
+<flying@dom.natm.ru>
+France Telecom Research and Development
+Franck
+Frank Tang <ftang@netscape.com>
+Frank Yan <fyan@mozilla.com>
+Franky Braem
+<franky@pacificconnections.com>
+Franz Sirl <Franz.Sirl-kernel@lauterbach.com>
+Frederic Plourde <frederic.plourde@polymtl.ca>
+Frederic Wang <fred.wang@free.fr>
+Fredrik Holmqvist <thesuckiestemail@yahoo.se>
+Fredrik Larsson <nossralf@gmail.com>
+Fritz Schneider <fritz@google.com>
+<fur@netscape.com>
+Gagan Saksena <gagan@netscape.com>
+Ming Gao <gaoming@cn.ibm.com>
+Garrett Arch Blythe
+Garrett Smith
+Garth Smedley <garths@oeone.com>
+Gary Kwong
+Gavin Sharp <gavin@gavinsharp.com>
+Gefferth Andras
+Geoff Lankow <geoff@darktrojan.net>
+George Kangas
+<george@vanous.com>
+George Wright <george@mozilla.com>
+Georgi Guninski <guninski@guninski.com>
+Georg Maaß <georg@bioshop.de>
+Gervase Markham <gerv@gerv.net>
+Gian-Carlo Pascutto <gpascutto@mozilla.com>
+Gianluca Turconi
+Gianugo Rabellino <gianugo@apache.org>
+Gijs Kruitbosch <gijskruitbosch@gmail.com>
+Ginn Chen <ginn.chen@sun.com>
+Giorgio Maone <g.maone@informaction.com>
+Girish Sharma <scrapmachines@gmail.com>
+Girts
+Giscard Girard
+Giuseppe Modugno
+Glen Nakamura <glen@imodulo.com>
+Glenn Randers-Pehrson <glennrp@gmail.com>
+Goldman Eleonora
+Google Inc.
+Gordon Sheridan <gordon@netscape.com>
+Graeme McCutcheon <graememcc_firefox@graeme-online.co.uk>
+Graydon Hoare <graydon@mozilla.com>
+Gregory Szorc <gps@mozilla.com>
+Grig Gheorghiu <grig@gheorghiu.net>
+Guillermo Robla Vicario <groblavicario@gmail.com>
+Guoxin Fan <gfan@sta.samsung.com>
+Gus Verdun <gustavoverdun@aol.com>
+<gwatmuff@geographicweb.com.au>
+Haamed Gheibi <gheibi@metanetworking.com>
+Håkan Waara <hwaara@gmail.com>
+Halacsy Peter
+<hannes@helma.at>
+Hanno Boeck <hanno@hboeck.de>
+Hans-Andreas Engel
+Harri Pitkanen
+Harshal Pradhan <keeda@hotpop.com>
+Heather Arthur <fayearthur@gmail.com>
+Heikki Toivonen <heikki@netscape.com>
+Hein Roehrig
+Henrik Gemal <mozilla@gemal.dk>
+Henrik Skupin <hskupin@gmail.com>
+Henri Sivonen <hsivonen@iki.fi>
+Henry Cejtin
+Henry Sobotka <sobotka@axess.com>
+Heriot-Watt University
+Hermann Schwab <hhschwab@gmail.com>
+Hermecz Vajk
+Hernan Rodriguez Colmeiro <colmeiro@gmail.com>.
+Hewlett-Packard Company
+Hiroshi Shimoda <piro@p.club.ne.jp>
+Hoa Nguyen <hoa.nguyen@intel.com>
+Honza Bambas <honzab@firemni.cz>
+Howard Chu <hyc@symas.com>
+Hubbie Shaw
+Hubert Figuière <hub@mozilla.com>
+Ian Gilman <ian@iangilman.com>
+Ian Hickson <ian@hixie.ch>
+Ian McGreer <mcgreer@netscape.com>
+Ian Melven <imelven@mozilla.com>
+Ian Oeschger
+IBM Corporation
+i-DNS.net International
+<igor3@apochta.com>
+Igor Bazarny <igor.bazarny@gmail.com>
+Igor Bukanov <igor@mir2.org>
+igor@fastmail.fm
+igor@icesoft.no
+Igor Tandetnik
+Ilya Konstantinov <mozilla-code@future.shiny.co.il>
+Intel Corporation
+Jaakko Kiviluoto <jaakko.kiviluoto@digia.com>
+Jacek Piskozub <piskozub@iopan.gda.pl>
+Jacob Bramley <Jacob.Bramely@arm.com>
+Jae-Seong Lee-Russo <lusian@gmail.com>
+James Boston <mozilla@jamesboston.ca>
+James Bunton <jamesbunton@fastmail.fm>
+James Justin Harrell
+James L. Nance
+James Ross <silver@warwickcompsoc.co.uk>
+James Willcox <jwillcox@mozilla.com>
+Jamie Zawinski <jwz@jwz.org>
+Jan Bambas <honzab@firemni.cz>
+Jan Darmochwal
+Jan de Mooij <jandemooij@gmail.com>
+Jan Horak <jhorak@redhat.com>
+Jan-Klaas Kollhof
+Jan Odvarko <odvarko@gmail.com>
+Jan Varga <Jan.Varga@gmail.com>
+Jan Wrobel <wrobel@blues.ath.cx>
+Jared Wein <jwein@mozilla.com>
+Jason Barnabe <jason_barnabe@fastmail.fm>
+Jason Duell <jduell.mcbugs@gmail.com>
+Jason Eager <jce2@po.cwru.edu>
+Jason Sachs <jmsachs@gmail.com>
+Jason Kersey <kerz@netscape.com>
+Jason Orendorff <jorendorff@mozilla.com>
+Jason Voll <jvoll@mozilla.com>
+Javier Delgadillo <javi@netscape.com>
+Javier Pedemonte <pedemont@us.ibm.com>
+Jay Patel <jay@mozilla.org>
+Jean-Francois Ducarroz <ducarroz@netscaape.com>
+Jean-Jacques Enser <jj@netscape.com>
+Jeff Gilbert <jgilbert@mozilla.com>
+Jeff Hammel <jhammel@mozilla.com>
+Jeff Muizelaar <jmuizelaar@mozilla.com>
+Jeff Thompson
+Jeff Walden <jwalden+bmo@mit.edu>
+Jens Bannmann <jens.b@web.de>
+Jens Hatlak <jh@junetz.de>
+Jeremias Bosch <jeremias.bosch@gmail.com>
+Jeremy D. Lea <reg@openpave.org>
+Jeroen Dobbelaere <jeroen.dobbelaere@acunia.com>
+<Jerry.Kirk@Nexwarecorp.com>
+Jesper Kristensen <mail@jesperkristensen.dk>
+Jesse Ruderman <jruderman@gmail.com>
+Jessica Blanco <jblanco@us.ibm.com>
+<jhs@lysator.liu.se>
+<ji_bo@yahoo.com>
+Jignesh Kakadiya <jigneshhk1992@gmail.com>
+Jim Blandy <jimb@mozilla.com>
+Jim Chen <jchen@mozilla.com>
+Jim Grandy
+Jim Ley <jim@jibbering.com>
+Jim Mathies <jmathies@mozilla.com>
+Jim Nance <jim_nance@yahoo.com>
+<jim-patterson@ncf.ca>
+Jim Roskind <jar@netscape.com>
+<jlaprise@delanotech.com>
+Joachim Kuebart
+Joaquin Cuenca Abela
+Joe Drew <joe@drew.ca>
+Joe Hewitt <hewitt@netscape.com>
+Joe Hughes <joe@retrovirus.com>
+Joel Maher <joel.maher@gmail.com>
+joerg.schaible@gmx.de
+Joe Walker <jwalker@mozilla.com>
+Joey Armstrong <joey@mozilla.com>
+Joey Minta <jminta@gmail.com>
+Johan Charlez <johan.charlez@gmail.com>
+Johann Petrak <johann@ai.univie.ac.at>
+Johnathan Nightingale <johnath@mozilla.com>
+John Bandhauer <jband@netscape.com>
+John B. Keiser
+John C. Griggs <johng@corel.com>
+John Daggett <jdaggett@mozilla.com>
+John Fairhurst <john_fairhurst@iname.com>
+John Ford <jhford@mozilla.com>
+John Gardiner Myers <jgmyers@speakeasy.net>
+John Gaunt <jgaunt@netscape.com>
+John Hanely
+John Morkel <jmorkel@gmail.com>
+John Morrison <jrgmorrison@aol.com>
+Johnny Stenback <jst@mozilla.com>
+John Resig <jresig@mozilla.com>
+John Schneider
+John Sun <john.sun@sun.com>
+John Taylor <jtaylor@netscape.com>
+John Zhang <jzhang@aptana.com>
+Jonas Jonsson <mozilla.nospam@fatbrain.org>
+Jonas Sicking <jonas@sicking.cc>
+Jonathan Granrose <granrose@netscape.com>
+Jonathan Griffin <jgriffin@mozilla.com>
+Jonathan Hage <hage.jonathan@gmail.com>
+Jonathan Kew <jfkthame@gmail.com>
+Jonathan Protzenko <jonathan.protzenko@gmail.com>
+Jonathan Watt <jwatt@jwatt.org>
+Jonathan Wilson <jonwil@tpgi.com.au>
+Jonathon Jongsma <jonathon.jongsma@collabora.co.uk>
+Jon Herron <leftturnsolutions@yahoo.com>
+Jono DiCarlo <jdicarlo@mozilla.com>
+Joonas Pihlaja <jpihlaja@cc.helsinki.fi>
+Jorge Villalobos <jorge@mozilla.com>
+Jory A. Pratt <geekypenguin@gmail.com>
+Josh Aas <josh@mozilla.com>
+Josh Lurz <jlurz24@gmail.com>
+Josh Matthews <josh@joshmatthews.net>
+Joshua M. <soapyhamhocks@gmail.com>
+Joshua Randall <jcrandall@alum.mit.edu>
+J. Paul Reed <preed@mozilla.com>
+Juan Lang
+Julian Seward <jseward@acm.org>
+Julian Viereck <jviereck@mozilla.com>
+Julien Lafon <julien.lafon@gmail.com>
+Julien Lecomte
+Jungshik Shin <jshin@mailaps.org>
+Justin Arthur <justinarthur@ieee.org>
+Justin Bradford <jab@atdot.org>
+Justin Dolske <dolske@mozilla.com>
+Justin Lebar <justin.lebar@gmail.com>
+Kai Engert <kaie@redhat.com>
+Kailas Patil <patilkr24@gmail.com>
+Kan-Ru Chen <kchen@mozilla.com>
+Karl Tomlinson <karlt+@karlt.net>
+Karsten Sperling <spiff@phreax.net>
+Kartikaya Gupta <kgupta@mozilla.com>
+Kaspar Brand <mozcontrib@velox.ch>
+Kathleen Brade <brade@pearlcrescent.com>
+Katsuhiko Momoi
+Keith Packard <keithp@keithp.com>
+Keith Rarick <kr@xph.us>
+Keith Schwarz <kschwarz@mozilla.com>
+Keith Visco <kvisco@ziplink.net>
+Ken Key <key+mozilla@ksquared.net>
+Kenneth Herron <kherron@fmailbox.com>
+Kenny Heaton <kennyheaton@gmail.com>
+Kevin Gerich <kevin@kmgerich.com>
+Kevin Hendricks <kevin.hendricks@sympatico.ca>
+Kevin McCluskey <kmcclusk@netscape.com>
+Kevin Puetz <puetzk@iastate.edu>
+<khanson@netscape.com>
+Kin Blas <kin@netscape.com>
+Kipp E.B. Hickman
+Kishore Arepalli <kishore.arepalli@gmail.com>
+<k.mike@gmx.net>
+Konstantin Mirny
+Korea Information Security Agency
+Kris Maglione <maglione.k@gmail.com>
+Kristian Høgsberg <krh@redhat.com>
+Kurt Lidl <lidl@pix.net>
+Kyle Huey <khuey@kylehuey.com>
+Kyle Machulis <kyle@nonpolynomial.com>
+Kyle Simpson <ksimpson@mozilla.com>
+Kyle Yuan <kyle.yuan@sun.com>
+Landry Breuil <landry@openbsd.org>
+Lan Qiang <jameslan@gmail.com>
+Larry Fitzpatrick <lef@opentext.com>
+Lars Erdmann
+Lars Knoll <knoll@kde.org>
+LastPass.com
+László Jánszky
+László Németh <nemethl@gyorsposta.hu>
+Laurent Jouanneau <laurent.jouanneau@disruptive-innovations.com>
+Lenka Fibikova <fibikova@exp-math.uni-essen.de>
+Leon Sha <leon.sha@oracle.com>
+Lev Serebryakov <lev@serebryakov.spb.ru>
+Le Zhang <r0bertz@gentoo.org>
+Liam Davis-Mead
+Lidong <lidong520@263.net>
+Lina Kemmel <lkemmel@il.ibm.com>
+Louie Zhao <louie.zhao@sun.com>
+Lubos Ures
+Lucas Rocha <lucasr@mozilla.com>
+Luke Wagner <lw@mozilla.com>
+<Lupin.wp@gmail.com>
+Maha Abou El Rous <mahar@eg.ibm.com>
+Makoto Kato <m_kato@ga2.so-net.ne.jp>
+Malcolm Rowe <malcolm-bmo@farside.org.uk>
+Malcolm Smith <malsmith@cs.rmit.edu.au>
+Malini Das <mdas@mozilla.com>
+Manish Singh <manish@flock.com>
+Marc Attinasi
+Marc Bevand <bevand_m@epita.fr>
+Marcin Lubonski
+Marc Mulcahy <marc.mulcahy@sun.com>
+Marco Bonardo <mak77@bonardo.net>
+Marco Castelluccio <mar.castelluccio@studenti.unina.it>
+Marco Fabbri
+Marco Pesenti Gritti <marco@gnome.org>
+Margaret Leibovic <margaret.leibovic@gmail.com>
+Marina Samuel <msamuel@mozilla.com>
+Mark Banner <bugzilla@standard8.plus.com>
+Mark Capella <markcapella@twcny.rr.com>
+Mark Cote <mcote@mozilla.com>
+Mark Finkle <mark.finkle@gmail.com>
+Mark Hammond <markh@activestate.com>
+Mark Mentovai <mark@moxienet.com>
+Mark Pilgrim <pilgrim@gmail.com>
+Mark Smith <mcs@pearlcrescent.com>
+Mark Steele <mwsteele@gmail.com>
+Markus G. Kuhn <mkuhn@acm.org>
+Markus Stange <mstange@themasta.com>
+Martijn Pieters <mj@digicool.com>
+Martijn Wargers <martijn.martijn@gmail.com>
+Martin Hassman <hassman@czilla.cz>
+Martin Honnen <martin.honnen@gmx.de>
+Martin McNickle <mmcnickle@gmail.com>
+Martin Schroeder <mschroeder@mozilla.x-home.org>
+Martin Stransky <stransky@redhat.com>
+Martin v. Loewis <martin@v.loewis.de>
+Martin Zvieger <martin.zvieger@sphinx.at>
+Masakazu Takahashi
+Masaki Katakai <katakai@japan.sun.com>
+Masatoshi Kimura <VYV03354@nifty.ne.jp>
+Masayuki Nakano <masayuki@d-toybox.com>
+Mathias Hasselmann <mathias.hasselmann@gmx.de>
+Mathieu Fenniak
+Mats Palmgren <matspal@gmail.com>
+Matt Brubeck <mbrubeck@mozilla.com>
+Matt Crocker <matt@songbirdnest.com>
+Matt Fisher <matt@netscape.com>
+Matthew Gregan <kinetik@flim.org>
+Matthew Noorenberghe <mnoorenberghe@mozilla.com>
+Matt Woodrow <mwoodrow@mozilla.com>
+Max Stepin <maxstepin@gmail.com>
+<mcmullen@netscape.com>
+Meena Vyas <meena.vyas@oracle.com>
+Mehdi Mulani <mmulani@mozilla.com>
+Merle Sterling <msterlin@us.ibm.com>
+<mff@research.att.com>
+Michael Ash <kal_el_1938@hotmail.com>
+Michael Daumling <daumling@adobe.com>
+Michael Emmel <mike.emmel@gmail.com>
+Michael Hanson <mhanson@mozilla.com>
+Michael J. Fromberger <sting@linguist.dartmouth.edu>
+Michael Johnston <special.michael@gmail.com>
+Michael Judge <mjudge@netscape.com>
+Michael Kohler <michaelkohler@live.com>
+Michael Kraft <morac99-firefox2@yahoo.com>
+Michael Lipp
+Michael Lowe <michael.lowe@bigfoot.com>
+Michael Martin
+michaelp
+Michael Ratcliffe <mratcliffe@mozilla.com>
+Michael Roovers
+Michael Ventnor <m.ventnor@gmail.com>
+Michael Wu <flamingice@sourmilk.net>
+Michael Yoshitaka Erlewine <mitcho@mitcho.com>
+Michal Novotny <michal.novotny@gmail.com>
+Michiel van Leeuwen <mvl@exedo.nl>
+Mihai Șucan <mihai.sucan@gmail.com>
+Miika Jarvinen <mjarvin@gmail.com>
+Mikeal Rogers <mikeal.rogers@gmail.com>
+Mike Beltzner <beltzner@mozilla.com>
+Mike Connor <mconnor@steelgryphon.com>
+Mike Hommey <mh@glandium.org>
+Mike Kaplinskiy <mike.kaplinskiy@gmail.com>
+Mike Kaply
+Mike Kowalski <mikejk@ameritech.net>
+Mike Kristoffersen <mikek@mikek.dk>
+Mike McCabe <mccabe@netscape.com>
+Mike Pinkerton <pinkerton@netscape.com>
+Mike Shaver <shaver@off.net>
+Milen Nankov
+Milind <sukhisoul@yahoo.com>
+Mitchell Field <mitch_1_2@live.com.au>
+Mitchell Stoltz <mstoltz@netscape.com>
+Mitesh Shah <mitesh@netscape.com>
+M Joonas Pihlaja <jpihlaja@cc.helsinki.fi>
+Mohammad R. Haghighat <mohammad.r.haghighat@intel.com>
+Mook <mook.moz@gmail.com>
+Morten Nilsen <morten@nilsen.com>
+Mounir Lamouri <mounir.lamouri@mozilla.com>
+moz_bug_r_a4
+Mozdev Group, Inc
+Mozilla Foundation
+Mozilla Japan
+<mozilla@pdavis.cx>
+Mrinal Kant <mrinal.kant@gmail.com>
+Ms2ger <ms2ger@gmail.com>
+Murali S R <murali.sr92@yahoo.com>
+Muzaffar Mahkamov <mmahkamov@eisst.com>
+Myk Melez <myk@mozilla.org>
+<myngs@hotmail.com>
+Nagendra Modadugu <ngm@google.com>
+Nagy Viktor
+Naoki Hotta <nhotta@netscape.com>
+Nao Toyamo
+Nate Nielsen <nielsen@memberwebs.com>
+Nattachai Ungsriwong <nattachai@gmail.com>
+Neil Deakin <enndeakin@gmail.com>
+Neil Rashbrook <neil@parkwaycc.co.uk>
+Nelson Bolyard <nelson@bolyard.me>
+Neo Liu <nian.liu@sun.com>
+Netscape Communications Corporation
+Nicholas Nethercote <nnethercote@mozilla.com>
+Nick Fitzgerald <nfitzgerald@mozilla.com>
+Nickolay Ponomarev <asqueella@gmail.com>
+Niels Provos <niels@google.com>
+Nikhil Marathe <nsm.nikhil@gmail.com>
+Nils Gura <nils.gura@sun.com>
+Nils Larsch <nla@trustcenter.de>
+Nils Maier <maierman@web.de>
+Ningjie Chen <chenn@email.uc.edu>
+Nino D'Aversa <ninodaversa@gmail.com>
+Nippon Telegraph and Telephone Corporation
+Nochum Sossonko <highmind63@gmail.com>
+Nokia Corporation
+Noll Janos
+Norris Boyd <nboyd@atg.com>
+Novell Corporation
+NVIDIA Corporation
+OEone Corporation
+<okin7@yahoo.fr>
+Oleg Romashin <romaxa@gmail.com>
+Oliver Hunt
+Olivier Cahagne
+Olivier Gerardin <ogerardin@vo.lu>
+Olli Pettay <Olli.Pettay@helsinki.fi>
+Ondrej Brablc <ondrej@allpeers.com>
+Oracle Corporation
+Oscar Fogelberg <osfo@home.se>
+Owen Taylor <otaylor@redhat.com>
+Øyvind Kolås <pippin@gimp.org>
+Pamela Greene <pamg.bugs@gmail.com>
+Panagiotis Astithas <past@mozilla.com>
+Paolo Amadini <http://www.amadzone.org/>
+Patipat Susumpow <kengggg@gmail.com>
+Patrick Beard <beard@netscape.com>
+Patrick Fey <bugzilla@nachtarbeiter.net>
+Patrick McManus <mcmanus@ducksong.com>
+Patrick Walton <pwalton@mozilla.com>
+Pattara Kiatisevi <ott@linux.thai.net>
+Paul Ashford <arougthopher@lizardland.net>
+Paul Biggar <pbiggar@mozilla.com>
+Paul Kocher
+Paul Kurczaba
+Paul O'Shannessy <paul@oshannessy.com>
+Paul Rouget <paul@mozilla.com>
+Paul Sandoz <paul.sandoz@sun.com>
+Pavel Cvrcek
+Pawel Chmielowski
+PenPal
+Pete Collins <petejc@collab.net>
+Peter Annema <disttsc@bart.nl>
+Peter Bajusz <hyp-x@inf.bme.hu>
+Peter Lubczynski <peterl@netscape.com>
+Peter Naulls
+Peter Parente <parente@cs.unc.edu>
+Peter Seliger
+Peter Van der Beken <peter@propagandism.org>
+Peter van der Woude
+Peter Weilbacher <mozilla@weilbacher.org>
+Pete Zha <pete.zha@sun.com>
+Petr Kostka <petr.kostka@st.com>
+Philipp Kewisch <mozilla@kewis.ch>
+Philipp Vogt <vogge@vlbg.dhs.org>
+Philipp von Weitershausen <philipp@weitershausen.de>
+Philip Taylor <philip.taylor@cl.cam.ac.uk>
+Phil Ringnalda
+Phil Schwartau <pschwartau@meer.net>
+Pierre Chanial <chanial@noos.fr>
+Pierre Phaneuf <pp@ludusdesign.com>
+Pierre Tardy <tardyp@gmail.com>
+POTI Inc
+Prabhat Hegde <prabhat.hegde@sun.com>
+Pranav Ravichandran <prp.1111@gmail.com>
+Prasad Sunkari <prasad@medhas.org>
+Priit Laes
+Proofpoint, Inc.
+Q42 <http://www.q42.nl>
+Radha Kulkarni <radha@netscape.com>
+Ramanathan Guha <guha@netscape.com>
+Ramiro Estrugo <ramiro@netscape.com>
+Randell Jesup
+Randolph Chung <tausq@debian.org>
+Rangan Sen <rangansen@netscape.com>
+Raúl Porcel <armin76@gentoo.org>
+Raymond Lee <raymond@appcoast.com>
+Red Hat, Inc
+Rene Engelhard
+Rene Pronk <r.pronk@its.tudelft.nl>
+Reto Laemmler
+<rhp@netscape.com>
+Ria Klaassen
+Richard C. Swift <swift@netscape.com>
+Richard L. Walsh <dragtext@e-vertise.com>
+Richard Newman <rnewman@mozilla.com>
+Richard Verhoeven <river@win.tue.nl>
+Richard Walsh
+Rich Dougherty
+Rich Salz
+Rich Walsh <dragtext@e-vertise.com>
+Rick Gessner <rickg@netscape.com>
+R.J. Keller <rlk@trfenv.com>
+Rob Arnold <tellrob@gmail.com>
+Rob Campbell <rcampbell@mozilla.com>
+Robert Accettura <robert@accettura.com>
+Robert Churchill <rjc@netscape.com>
+Robert Ginda <rginda@hacksrus.com>
+Robert Kaiser <kairo@kairo.at>
+Robert Longson <longsonr@gmail.com>
+Robert Miner <rminer@geomtech.com>
+Robert O'Callahan <robert@ocallahan.org>
+Roberto Estrada <roberto.estrada@yahoo.es>
+Robert Relyea <rrelyea@redhat.com>
+Robert Sayre <sayrer@gmail.com>
+Robert Sesek <rsesek@bluestatic.org>
+Robert Strong <robert.bugzilla@gmail.com>
+Robin Lu <robin.lu@sun.com>
+Rob McCool
+Rod Spears <rods@netscape.com>
+Roger B. Sidje <rbs@maths.uq.edu.au>
+<rogerl@netscape.com>
+<rokicki@instantis.com>
+Roland Mainz <roland.mainz@informatik.med.uni-giessen.de>
+Roman Ivanov <thingol@mail.ru>
+Ronny Perinke <ronny.perinke@gmx.de>
+Roozbeh Pournader <roozbeh@sharif.edu>
+Roy Frostig <rfrostig@mozilla.com>
+Roy Yokoyama <yokoyama@netscape.com>
+RSA Security, Inc
+Russell King <rmk@arm.linux.org.uk>
+Rusty Lynch <rusty.lynch@intel.com>
+Ryan Cassin <rcassin@supernova.org>
+Ryan Flint <rflint@dslr.net>
+Ryan Jones <sciguyryan@gmail.com>
+Ryan VanderMeulen <ryanvm@gmail.com>
+Ryoichi Furukawa <oliver@1000cp.com>
+sagdjb@softwareag.com
+Samir Gehani <sgehani@netscape.com>
+Sammy Ford
+Samphan Raruenrom
+Samuel Sieb <samuel@sieb.net>
+Sarlos Tamas
+scole@planetweb.com
+Scooter Morris <scootermorris@comcast.net>
+Scott Collins <scc@ScottCollins.net>
+Scott MacGregor <mscott@mozilla.org>
+Scott Putterman <putterman@netscape.com>
+Sean Cotter <cotter@netscape.com>
+Sean Dunn <seanedunn@yahoo.com>
+Sean Echevarria <sean@beatnik.com>
+Sean McMurray
+Sean Stangl <sstangl@mozilla.com>
+Sebastian Andrzej Siewior <bigeasy@linutronix.de>
+Sebastian Kromp <46b@gulli.com>
+Seno Aiko <Seno.Aiko@gmail.com>
+Serge Gautherie <sgautherie.bz@free.fr>
+Sergei Dolgov <sergei_d@fi.tartu.ee>
+Sergey Novikov <sergeyn@google.com>
+Seth Spitzer <sspitzer@mozilla.org>
+sfraser@netscape.com
+shadowpage
+Shailendra N Jain<shailen.n.jain@gmail.com>
+Shaohua Wen
+Shawn Gong <shawn@mozilla.com>
+Shawn Wilsher <me@shawnwilsher.com>
+Sheueling Chang Shantz <sheueling.chang@sun.com>,
+Shi-Jun He
+Shoji Matsumoto <shom@vinelinux.org>
+Shoshannah Forbes <xslf@xslf.com>
+shutdown@flashmail.com
+Shyjan Mahamud <mahamud@cs.cmu.edu>
+Shy Shalom <shooshX@gmail.com>
+Siarhei Siamashka <siarhei.siamashka@gmail.com>
+Siddharth Agarwal <sid.bugzilla@gmail.com>
+Sid Stamm <sid@mozilla.com>
+Silvia Zhao <silvia.zhao@sun.com>
+Silviu Trasca
+Simeon Morrison <smorrison@gte.com>
+Simmule Turner
+Simon Brouwer
+Simon Bünzli <zeniko@gmail.com>
+Simon Fraser <smfr@smfr.org>
+Simon Montagu <smontagu@smontagu.org>
+Simon Wilkinson <simon@sxw.org.uk>
+simonzack
+Sindre Dammann <sindrebugzilla@gmail.com>
+Sinker Li <thinker@codemud.net>
+Sion Fraser <sfraser@netscape.com>
+Siraj Razick <siraj.razick@collabora.co.uk>
+Sjoerd Visscher <sjoerd@w3future.com>
+Slavomir Katuscak <slavomir.katuscak@sun.com>
+smorrison@gte.com
+Soeren Munk Skroeder
+Sonja Mirtitsch
+Sonny Piers <sonny.piers@gmail.com>
+Søren Sandmann <sandmann@daimi.au.dk>
+Spyros Livathinos <livathinos.spyros@gmail.com>
+Sriram Ramasubramanian <sriram@mozilla.com>
+Srirang G Doddihal <brahmana@doddihal.com>
+Stanford University
+Stan Shebs <stanshebs@earthlink.net>
+Stefan Borggraefe
+Stefan Hundhammer <HuHa-zilla@gmx.de>
+Stefanik Gábor
+Stefan Sitter <ssitter@gmail.com>
+Steffen Imhof <steffen.imhof@gmail.com>
+Steffen Wilberg <steffen.wilberg@web.de>
+Stephen Blackheath <entangled.mooched.stephen@blacksapphire.com>
+Stephen Donner
+Stephen Fung <fungstep@hotmail.com>
+Stephen Horlander <shorlander@mozilla.com>
+Stephen Lamm <slamm@netscape.com>
+Steve Chapel <steven.chapel@sbcglobal.net>
+Steve Clark <buster@netscape.com>
+Steve Dagley <sdagley@netscape.com>
+Steve Fink <sfink@mozilla.org>
+Steve Lamm <slamm@netscape.com>
+Steve Meredith <smeredith@netscape.com>
+Steve Morse <morse@netscape.com>
+Steven Garrity <steven@silverorange.com>
+Steven Michaud <smichaud@pobox.com>
+Steve Roussey
+Steve Swanson <steve.swanson@mackichan.com>
+Stuart Morgan <stuart.morgan@alumni.case.edu>
+Stuart Parmenter <pavlov@pavlov.net>
+Sungjoon Steve Won <stevewon@gmail.com>
+Sun Microsystems, Inc.
+Suresh Duddi <dp@netscape.com>
+<svendtofte@svendtofte.com>
+Sylvain Pasche <sylvain.pasche@gmail.com>
+Takayuki Tei <taka@netscape.com>
+Takeshi Ichimaru <ayakawa.m@gmail.com>
+Takuro Ashie <ashie@clear-code.com>
+Tanner M. Young <mozilla@alyoung.com>
+Taras Glek <tglek@mozilla.com>
+Tatiana Meshkova <tanya.meshkova@gmail.com>
+Ted Mielczarek <ted@mielczarek.org>
+Tero Koskinen <tero.koskinen@iki.fi>
+Terrence Cole <terrence@mozilla.com>
+Terry Hayes <thayes@netscape.com>
+Teune van Steeg <t.vansteeg@gmail.com>
+The Hewlett-Packard Company
+The MITRE Corporation
+The Nokia Corporation
+Theppitak Karoonboonyanan <thep@linux.thai.net>
+The University of Queensland
+Thiemo Seufer <seufer@csv.ica.uni-stuttgart.de>
+Thomas Blatter <bebabo@swissonline.ch>
+Thomas de Grenier de Latour <tom.gl@free.fr>
+Thomas K. Dyas <tom.dyas@gmail.com>
+Tim Copperfield <timecop@network.email.ne.jp>
+timeless <timeless@mac.com>
+Tim Hill <tim@prismelite.com>
+Tim Miller <mille449@gmail.com>
+Timothy B. Terriberry <tterriberry@mozilla.com>
+Timothy Nikkel <tnikkel@gmail.com>
+Timothy Wall <twalljava@dev.java.net>
+Timothy Watt <riceman+moz@mail.rit.edu>
+Tim Rowley <tor@cs.brown.edu>
+Tim Taubert <tim.taubert@gmx.de>
+Tom Brinkman <reportbase@gmail.com>
+Tom Germeau <tom.germeau@epigoon.com>
+Tomi Leppikangas <tomi.leppikangas@oulu.fi>
+Tom Kneeland <tomk@mitre.org>
+Tom Pixley <joki@netscape.com>
+Tom Schuster <evilpies@gmail.com>
+Tom St Denis, tomstdenis@iahu.ca
+Tom Tromey
+Tony Chang <tony@ponderer.org>
+Tor Lillqvist
+Travis Bogard <travis@netscape.com>
+Trent Mick <TrentM@ActiveState.com>
+Trevor Fairey <tnfairey@gmail.com>
+Trevor Saunders <trev.saunders@gmail.com>
+Troy Farrell <troy@entheossoft.com>
+Tuukka Tolvanen <tt@lament.cjb.net>
+T. Zachary Laine <whatwasthataddress@gmail.com>
+Ulrich Drepper <drepper@redhat.com>
+University of Southern California
+Uri Bernstein <uriber@gmail.com>
+Varga Daniel
+Vee Satayamas <vsatayamas@gmail.com>
+Victor Porof <vporof@mozilla.com>
+Vidur Apparao <vidur@netscape.com>
+Vilya Harvey <vilya@nag.co.uk>
+Vincent Béron <vberon@hermes.usherb.ca>
+Vipul Gupta <vipul.gupta@sun.com>
+Viswanath Ramachandran <vishy@netscape.com>
+Vivien Nicolas <21@vingtetun.org>
+Vladan Djeric <vdjeric@mozilla.com>
+Vladimir Vukicevic <vladimir@pobox.com>
+Vlad Sukhoy <vladimir.sukhoy@gmail.com>
+WADA <m-wada@japan.com>
+Waldemar Horwat <waldemar@acm.org>
+Walter Meinl <wuno@lsvw.de>
+Warren Harris <warren@netscape.com>
+Wellington Fernando de Macedo <wfernandom2004@gmail.com>
+Werner Sharp
+Wesley Garland
+Wesley Johnston <wjohnston@mozilla.com>
+Will Guaraldi <will.guaraldi@pculture.org>
+William A. Law <law@netscape.com>
+William B. Ackerman
+William Chen <wchen@mozilla.com>
+William Cook <william.cook@crocodile-clips.com>
+William Jon McCann <william.jon.mccann@gmail.com>
+William Lachance <wlachance@mozilla.com>
+William Price <bugzilla@mob.rice.edu>
+William R. Price <wrprice@alumni.rice.edu>
+<william.tan@i-dns.net>
+Wladimir Palant <trev@gtchat.de>
+Wolfgang Rosenauer <wr@rosenauer.org>
+<wtam@bigfoot.com>
+Wyllys Ingersoll <wyllys.ingersoll@sun.com>
+<x00000000@freenet.de>
+Yueheng Xu <yueheng.xu@intel.com>
+Yuh-Ruey Chen
+Yury <async.processingjs@yahoo.com>
+Yury Delendik
+Zachary Weinberg <zweinberg@mozilla.com>
+Zach Linder <zakness@gmail.com>
+Zach Lipton <zach@zachlipton.com>
+Zack Rusin <zack@kde.org>
+<zack-weg@gmx.de>
+Zack Weinberg <zweinberg@mozilla.com>
+Zbigniew Braniecki <gandalf@e-gandalf.net>
+<zen-parse@gmx.net>
+Zero-Knowledge Systems, Inc
--- a/accessible/src/base/nsAccessibilityService.cpp
+++ b/accessible/src/base/nsAccessibilityService.cpp
@@ -1002,25 +1002,24 @@ nsAccessibilityService::GetOrCreateAcces
     // be ever lost and should be sensible).
     if (content->IsFocusable())
       roleMapEntry = nullptr;
     else
       return nullptr;
   }
 
   if (weakFrame.IsAlive() && !newAcc && isHTML) {  // HTML accessibles
-    bool tryTagNameOrFrame = true;
-
     nsIAtom *frameType = weakFrame.GetFrame()->GetType();
 
     bool partOfHTMLTable =
       frameType == nsGkAtoms::tableCaptionFrame ||
       frameType == nsGkAtoms::tableCellFrame ||
       frameType == nsGkAtoms::tableRowGroupFrame ||
       frameType == nsGkAtoms::tableRowFrame;
+    bool legalPartOfHTMLTable = partOfHTMLTable;
 
     if (partOfHTMLTable) {
       // Table-related frames don't get table-related roles
       // unless they are inside a table, but they may still get generic
       // accessibles
       nsIContent *tableContent = content;
       while ((tableContent = tableContent->GetParent()) != nullptr) {
         nsIFrame *tableFrame = tableContent->GetPrimaryFrame();
@@ -1052,60 +1051,60 @@ nsAccessibilityService::GetOrCreateAcces
             // Table-related descendants of presentation table are also
             // presentation if they aren't focusable and have not explicit ARIA
             // role (don't create accessibles for them unless they need to fire
             // focus events).
             return nullptr;
           }
 
           // otherwise create ARIA based accessible.
-          tryTagNameOrFrame = false;
+          legalPartOfHTMLTable = false;
           break;
         }
 
         if (tableContent->Tag() == nsGkAtoms::table) {
           // Stop before we are fooled by any additional table ancestors
           // This table cell frameis part of a separate ancestor table.
-          tryTagNameOrFrame = false;
+          legalPartOfHTMLTable = false;
           break;
         }
       }
 
       if (!tableContent)
-        tryTagNameOrFrame = false;
+        legalPartOfHTMLTable = false;
     }
 
     if (roleMapEntry) {
-      // Create ARIA grid/treegrid accessibles if node is not of a child or
-      // valid child of HTML table and is not a HTML table.
-      if ((!partOfHTMLTable || !tryTagNameOrFrame) &&
+      // Create ARIA grid/treegrid accessibles if node is not a child or legal
+      // child of HTML table and is not a HTML table.
+      if ((!partOfHTMLTable || !legalPartOfHTMLTable) &&
           frameType != nsGkAtoms::tableOuterFrame) {
 
         if (roleMapEntry->role == roles::TABLE ||
             roleMapEntry->role == roles::TREE_TABLE) {
           newAcc = new ARIAGridAccessibleWrap(content, docAcc);
 
         } else if (roleMapEntry->role == roles::GRID_CELL ||
             roleMapEntry->role == roles::ROWHEADER ||
             roleMapEntry->role == roles::COLUMNHEADER) {
           newAcc = new ARIAGridCellAccessibleWrap(content, docAcc);
         }
       }
     }
 
-    if (!newAcc && tryTagNameOrFrame) {
+    if (!newAcc) {
       // Prefer to use markup (mostly tag name, perhaps attributes) to
       // decide if and what kind of accessible to create.
       // The method creates accessibles for table related content too therefore
       // we do not call it if accessibles for table related content are
       // prevented above.
       newAcc = CreateHTMLAccessibleByMarkup(weakFrame.GetFrame(), content,
-                                            docAcc);
+                                            docAcc, legalPartOfHTMLTable);
 
-      if (!newAcc) {
+      if (!newAcc && (!partOfHTMLTable || legalPartOfHTMLTable)) {
         // Do not create accessible object subtrees for non-rendered table
         // captions. This could not be done in
         // nsTableCaptionFrame::GetAccessible() because the descendants of
         // the table caption would still be created. By setting
         // *aIsSubtreeHidden = true we ensure that no descendant accessibles
         // are created.
         nsIFrame* f = weakFrame.GetFrame();
         if (!f) {
@@ -1548,18 +1547,30 @@ nsAccessibilityService::CreateAccessible
 
   NS_IF_ADDREF(accessible);
   return accessible;
 }
 
 already_AddRefed<Accessible>
 nsAccessibilityService::CreateHTMLAccessibleByMarkup(nsIFrame* aFrame,
                                                      nsIContent* aContent,
-                                                     DocAccessible* aDoc)
+                                                     DocAccessible* aDoc,
+                                                     bool aIsLegalPartOfHTMLTable)
 {
+  if (aIsLegalPartOfHTMLTable) {
+    if (nsCoreUtils::IsHTMLTableHeader(aContent)) {
+      Accessible* accessible =
+        new HTMLTableHeaderCellAccessibleWrap(aContent, aDoc);
+      NS_IF_ADDREF(accessible);
+      return accessible;
+    }
+
+    return nullptr;
+  }
+
   // This method assumes we're in an HTML namespace.
   nsIAtom* tag = aContent->Tag();
   if (tag == nsGkAtoms::figcaption) {
     Accessible* accessible = new HTMLFigcaptionAccessible(aContent, aDoc);
     NS_IF_ADDREF(accessible);
     return accessible;
   }
 
@@ -1630,22 +1641,16 @@ nsAccessibilityService::CreateHTMLAccess
       tag == nsGkAtoms::h5 ||
       tag == nsGkAtoms::h6 ||
       tag == nsGkAtoms::q) {
     Accessible* accessible = new HyperTextAccessibleWrap(aContent, aDoc);
     NS_IF_ADDREF(accessible);
     return accessible;
   }
 
-  if (nsCoreUtils::IsHTMLTableHeader(aContent)) {
-    Accessible* accessible = new HTMLTableHeaderCellAccessibleWrap(aContent, aDoc);
-    NS_IF_ADDREF(accessible);
-    return accessible;
-  }
-
   if (tag == nsGkAtoms::output) {
     Accessible* accessible = new HTMLOutputAccessible(aContent, aDoc);
     NS_IF_ADDREF(accessible);
     return accessible;
   }
 
   if (tag == nsGkAtoms::progress) {
     Accessible* accessible =
--- a/accessible/src/base/nsAccessibilityService.h
+++ b/accessible/src/base/nsAccessibilityService.h
@@ -224,17 +224,18 @@ private:
   already_AddRefed<Accessible>
     CreateAccessibleByType(nsIContent* aContent, DocAccessible* aDoc);
 
   /**
    * Create accessible for HTML node by tag name.
    */
   already_AddRefed<Accessible>
     CreateHTMLAccessibleByMarkup(nsIFrame* aFrame, nsIContent* aContent,
-                                 DocAccessible* aDoc);
+                                 DocAccessible* aDoc,
+                                 bool aIsLegalPartOfHTMLTable);
 
   /**
    * Create accessible if parent is a deck frame.
    */
   already_AddRefed<Accessible>
     CreateAccessibleForDeckChild(nsIFrame* aFrame, nsIContent* aContent,
                                  DocAccessible* aDoc);
 
--- a/accessible/tests/mochitest/tree/Makefile.in
+++ b/accessible/tests/mochitest/tree/Makefile.in
@@ -12,16 +12,17 @@ relativesrcdir  = accessible/tree
 include $(DEPTH)/config/autoconf.mk
 
 MOCHITEST_A11Y_FILES =\
 		dockids.html \
 	$(warning test_applicationacc.xul temporarily disabled, see bug 561508) \
 		test_aria_globals.html \
 		test_aria_imgmap.html \
 		test_aria_presentation.html \
+		test_brokencontext.html \
 		test_button.xul \
 		test_canvas.html \
 		test_combobox.xul \
 		test_cssoverflow.html \
 		test_dochierarchy.html \
 		test_dockids.html \
 		test_filectrl.html \
 		test_formctrl.html \
new file mode 100644
--- /dev/null
+++ b/accessible/tests/mochitest/tree/test_brokencontext.html
@@ -0,0 +1,106 @@
+<!DOCTYPE html>
+<html>
+<head>
+  <title>Broken context hierarchy</title>
+  <link rel="stylesheet" type="text/css"
+        href="chrome://mochikit/content/tests/SimpleTest/test.css" />
+
+  <script type="application/javascript"
+          src="chrome://mochikit/content/tests/SimpleTest/SimpleTest.js"></script>
+
+  <script type="application/javascript"
+          src="../common.js"></script>
+  <script type="application/javascript"
+          src="../role.js"></script>
+  <script type="application/javascript"
+          src="../states.js"></script>
+
+  <script type="application/javascript">
+  function doTest()
+  {
+    ////////////////////////////////////////////////////////////////////////////
+    // HTML table elements outside table context.
+
+    ok(!isAccessible("tr_in_presentation_table"), "tr shouldn't be accessible");
+    ok(!isAccessible("th_in_presentation_table"), "th shouldn't be accessible");
+    ok(!isAccessible("td_in_presentation_table"), "td shouldn't be accessible");
+
+    var tree =
+      { PUSHBUTTON: [ // table
+        { NOTHING: [ // tbody
+          { NOTHING: [ // tr
+            { NOTHING: [ // th
+              { TEXT_LEAF: [ ] }
+            ] },
+            { NOTHING: [ // td
+              { TEXT_LEAF: [ ] }
+            ] }
+          ] },
+        ] },
+      ] };
+    testAccessibleTree("button_table", tree);
+
+    ////////////////////////////////////////////////////////////////////////////
+    // Styled as HTML table elements, accessible is created by tag name
+
+    tree =
+      { LINK: [ // a
+        { TEXT_LEAF: [ ] }
+      ] };
+    testAccessibleTree("a_as_td", tree);
+
+    tree =
+      { HEADING: [
+        { TEXT_LEAF: [ ] }
+      ] };
+    testAccessibleTree("h1_as_td", tree);
+    testAccessibleTree("h2_as_td", tree);
+    testAccessibleTree("h3_as_td", tree);
+    testAccessibleTree("h4_as_td", tree);
+    testAccessibleTree("h5_as_td", tree);
+    testAccessibleTree("h6_as_td", tree);
+
+    SimpleTest.finish();
+  }
+
+  SimpleTest.waitForExplicitFinish();
+  addA11yLoadEvent(doTest);
+  </script>
+</head>
+
+<body>
+  <a target="_blank"
+     href="https://bugzilla.mozilla.org/show_bug.cgi?id=706849"
+     title="Create accessible by tag name as fallback if table descendant style is used out of table context">
+    Mozilla Bug 706849
+  </a>
+  <p id="display"></p>
+  <div id="content" style="display: none"></div>
+  <pre id="test">
+  </pre>
+
+  <!-- HTML table elements out of table -->
+  <table role="presentation">
+    <tr id="tr_in_presentation_table">
+      <th id="th_in_presentation_table">not a header</th>
+      <td id="td_in_presentation_table">not a cell</td>
+    </tr>
+  </table>
+
+  <table role="button" id="button_table">
+    <tr id="tr_in_button_table">
+      <th id="th_in_button_table">not a header</th>
+      <td id="td_in_button_table">not a cell</td>
+    </tr>
+  </table>
+
+  <!-- styled as HTML table elements -->
+  <a id="a_as_td" style="display:table-cell;" href="http://www.google.com">Google</a>
+  <h1 id="h1_as_td" style="display: table-cell;">h1</h1>
+  <h2 id="h2_as_td" style="display: table-cell;">h2</h2>
+  <h3 id="h3_as_td" style="display: table-cell;">h3</h3>
+  <h4 id="h4_as_td" style="display: table-cell;">h4</h4>
+  <h5 id="h5_as_td" style="display: table-cell;">h5</h5>
+  <h6 id="h6_as_td" style="display: table-cell;">h6</h6>
+</body>
+</html>
--- a/accessible/tests/mochitest/tree/test_table.html
+++ b/accessible/tests/mochitest/tree/test_table.html
@@ -134,16 +134,17 @@
         { TABLE: [
           { ROW: [
             { CELL: [
               { TEXT_LEAF: [ ] }
             ] }
           ] } ]
         };
       testAccessibleTree("table4", accTree);
+
       SimpleTest.finish();
     }
 
     SimpleTest.waitForExplicitFinish();
     addA11yLoadEvent(doTest);
   </script>
 </head>
 <body>
--- a/b2g/installer/package-manifest.in
+++ b/b2g/installer/package-manifest.in
@@ -361,16 +361,18 @@
 #ifdef MOZ_GTK2
 @BINPATH@/components/nsFilePicker.manifest
 @BINPATH@/components/nsFilePicker.js
 #endif
 @BINPATH@/components/nsHelperAppDlg.manifest
 @BINPATH@/components/nsHelperAppDlg.js
 @BINPATH@/components/nsDownloadManagerUI.manifest
 @BINPATH@/components/nsDownloadManagerUI.js
+@BINPATH@/components/nsProxyAutoConfig.manifest
+@BINPATH@/components/nsProxyAutoConfig.js
 @BINPATH@/components/NetworkGeolocationProvider.manifest
 @BINPATH@/components/NetworkGeolocationProvider.js
 @BINPATH@/components/GPSDGeolocationProvider.manifest
 @BINPATH@/components/GPSDGeolocationProvider.js
 @BINPATH@/components/nsSidebar.manifest
 @BINPATH@/components/nsSidebar.js
 @BINPATH@/components/extensions.manifest
 @BINPATH@/components/addonManager.js
--- a/browser/app/profile/firefox.js
+++ b/browser/app/profile/firefox.js
@@ -389,17 +389,16 @@ pref("browser.tabs.maxOpenBeforeWarn", 1
 pref("browser.tabs.loadInBackground", true);
 pref("browser.tabs.opentabfor.middleclick", true);
 pref("browser.tabs.loadDivertedInBackground", false);
 pref("browser.tabs.loadBookmarksInBackground", false);
 pref("browser.tabs.tabClipWidth", 140);
 pref("browser.tabs.animate", true);
 pref("browser.tabs.onTop", true);
 pref("browser.tabs.drawInTitlebar", true);
-pref("browser.tabs.cropTitleRedundancy", true);
 
 // Where to show tab close buttons:
 // 0  on active tab only
 // 1  on all tabs until tabClipWidth is reached, then active tab only
 // 2  no close buttons at all
 // 3  at the end of the tabstrip
 pref("browser.tabs.closeButtons", 1);
 
--- a/browser/base/content/browser.js
+++ b/browser/base/content/browser.js
@@ -155,22 +155,16 @@ XPCOMUtils.defineLazyGetter(this, "SafeB
 #endif
 
 XPCOMUtils.defineLazyGetter(this, "gBrowserNewTabPreloader", function () {
   let tmp = {};
   Cu.import("resource:///modules/BrowserNewTabPreloader.jsm", tmp);
   return new tmp.BrowserNewTabPreloader();
 });
 
-XPCOMUtils.defineLazyGetter(this, "TabTitleAbridger", function() {
-  let tmp = {};
-  Cu.import("resource:///modules/TabTitleAbridger.jsm", tmp);
-  return new tmp.TabTitleAbridger(window);
-});
-
 let gInitialPages = [
   "about:blank",
   "about:newtab",
   "about:home",
   "about:privatebrowsing",
   "about:sessionrestore"
 ];
 
@@ -1418,17 +1412,16 @@ var gBrowserInit = {
     // Don't preload new tab pages when the toolbar is hidden
     // (i.e. when the current window is a popup window).
     if (window.toolbar.visible) {
       gBrowserNewTabPreloader.init(window);
     }
 
     gBrowserThumbnails.init();
     TabView.init();
-    TabTitleAbridger.init();
 
     setUrlAndSearchBarWidthForConditionalForwardButton();
     window.addEventListener("resize", function resizeHandler(event) {
       if (event.target == window)
         setUrlAndSearchBarWidthForConditionalForwardButton();
     });
 
     // Enable developer toolbar?
@@ -1606,17 +1599,16 @@ var gBrowserInit = {
         Win7Features.onCloseWindow();
 
       gPrefService.removeObserver(ctrlTab.prefName, ctrlTab);
       gPrefService.removeObserver(allTabs.prefName, allTabs);
       ctrlTab.uninit();
       TabView.uninit();
       gBrowserThumbnails.uninit();
       FullZoom.destroy();
-      TabTitleAbridger.destroy();
 
       Services.obs.removeObserver(gSessionHistoryObserver, "browser:purge-session-history");
       Services.obs.removeObserver(gXPInstallObserver, "addon-install-disabled");
       Services.obs.removeObserver(gXPInstallObserver, "addon-install-started");
       Services.obs.removeObserver(gXPInstallObserver, "addon-install-blocked");
       Services.obs.removeObserver(gXPInstallObserver, "addon-install-failed");
       Services.obs.removeObserver(gXPInstallObserver, "addon-install-complete");
       Services.obs.removeObserver(gFormSubmitObserver, "invalidformsubmit");
--- a/browser/base/content/tabbrowser.xml
+++ b/browser/base/content/tabbrowser.xml
@@ -1223,16 +1223,21 @@
 
             var t = document.createElementNS(
               "http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul",
                                              "tab");
 
             var uriIsBlankPage = !aURI || isBlankPageURL(aURI);
             var uriIsNotAboutBlank = aURI && aURI != "about:blank";
 
+            if (uriIsBlankPage)
+              t.setAttribute("label", this.mStringBundle.getString("tabs.emptyTabTitle"));
+            else
+              t.setAttribute("label", aURI);
+
             t.setAttribute("crop", "end");
             t.setAttribute("validate", "never");
             t.setAttribute("onerror", "this.removeAttribute('image');");
             t.className = "tabbrowser-tab";
 
             this.tabContainer._unlockTabSizing();
 
             // When overflowing, new tabs are scrolled into view smoothly, which
@@ -1336,24 +1341,16 @@
 
             // NB: this appendChild call causes us to run constructors for the
             // browser element, which fires off a bunch of notifications. Some
             // of those notifications can cause code to run that inspects our
             // state, so it is important that the tab element is fully
             // initialized by this point.
             this.mPanelContainer.appendChild(notificationbox);
 
-            // Happens after the browser is in the DOM: the TabTitleAbridger
-            // classifies tabs by domains, requiring access to the browser.
-            if (uriIsBlankPage) {
-              t.label = this.mStringBundle.getString("tabs.emptyTabTitle");
-            } else {
-              t.label = aURI;
-            }
-
             this.tabContainer.updateVisibility();
 
             if (uriIsNotAboutBlank) {
               // Stop the existing about:blank load.  Otherwise, if aURI
               // doesn't stop in-progress loads on its own, we'll get into
               // trouble with multiple parallel loads running at once.
               b.stop();
             }
@@ -2836,17 +2833,18 @@
     <implementation implements="nsIDOMEventListener">
       <constructor>
         <![CDATA[
           this.mTabClipWidth = Services.prefs.getIntPref("browser.tabs.tabClipWidth");
           this.mCloseButtons = Services.prefs.getIntPref("browser.tabs.closeButtons");
           this._closeWindowWithLastTab = Services.prefs.getBoolPref("browser.tabs.closeWindowWithLastTab");
 
           var tab = this.firstChild;
-          tab.label = this.tabbrowser.mStringBundle.getString("tabs.emptyTabTitle");
+          tab.setAttribute("label",
+                           this.tabbrowser.mStringBundle.getString("tabs.emptyTabTitle"));
           tab.setAttribute("crop", "end");
           tab.setAttribute("validate", "never");
           tab.setAttribute("onerror", "this.removeAttribute('image');");
           this.adjustTabstrip();
 
           Services.prefs.addObserver("browser.tabs.", this._prefObserver, false);
           window.addEventListener("resize", this, false);
           window.addEventListener("load", this, false);
@@ -3954,52 +3952,27 @@
                   class="tab-content" align="center">
           <xul:image xbl:inherits="fadein,pinned,busy,progress,selected"
                      class="tab-throbber"
                      role="presentation"/>
           <xul:image xbl:inherits="validate,src=image,fadein,pinned,selected"
                      class="tab-icon-image"
                      role="presentation"/>
           <xul:label flex="1"
-                     anonid="tab-label"
-                     xbl:inherits="value=visibleLabel,crop,accesskey,fadein,pinned,selected"
+                     xbl:inherits="value=label,crop,accesskey,fadein,pinned,selected"
                      class="tab-text tab-label"
                      role="presentation"/>
           <xul:toolbarbutton anonid="close-button"
                              xbl:inherits="fadein,pinned,selected"
                              class="tab-close-button"/>
         </xul:hbox>
       </xul:stack>
     </content>
 
     <implementation>
-      <property name="label">
-        <getter>
-          return this.getAttribute("label");
-        </getter>
-        <setter>
-          this.setAttribute("label", val);
-          let event = new CustomEvent("TabLabelModified", {
-            bubbles: true,
-            cancelable: true
-          });
-          this.dispatchEvent(event);
-
-          if (!event.defaultPrevented)
-            this.visibleLabel = val;
-        </setter>
-      </property>
-      <property name="visibleLabel">
-        <getter>
-          return this.getAttribute("visibleLabel");
-        </getter>
-        <setter>
-          this.setAttribute("visibleLabel", val);
-        </setter>
-      </property>
       <property name="pinned" readonly="true">
         <getter>
           return this.getAttribute("pinned") == "true";
         </getter>
       </property>
       <property name="hidden" readonly="true">
         <getter>
           return this.getAttribute("hidden") == "true";
--- a/browser/base/content/test/Makefile.in
+++ b/browser/base/content/test/Makefile.in
@@ -126,18 +126,16 @@ endif
                  browser_bug577121.js \
                  browser_bug578534.js \
                  browser_bug579872.js \
                  browser_bug580638.js \
                  browser_bug580956.js \
                  browser_bug581242.js \
                  browser_bug581253.js \
                  browser_bug581947.js \
-                 browser_bug583890.js \
-                 browser_bug583890_label.js \
                  browser_bug585785.js \
                  browser_bug585830.js \
                  browser_bug590206.js \
                  browser_bug592338.js \
                  browser_bug594131.js \
                  browser_bug595507.js \
                  browser_bug596687.js \
                  browser_bug597218.js \
deleted file mode 100644
--- a/browser/base/content/test/browser_bug583890.js
+++ /dev/null
@@ -1,377 +0,0 @@
-/* Any copyright is dedicated to the Public Domain.
- * http://creativecommons.org/publicdomain/zero/1.0/ */
-
-/**
- * Call the aCallback when aTab's label is equal to the aExpectedLabel.
- * Either happens immediately, or after successive checks.
- * In the case of failure, this will cause timeout of the test.
- *
- * @param aTab           the tab whose label is being tested
- * @param aExpectedLabel the value the tab's label must match
- * @param aCallback      the callback for use upon success
- */
-function waitForTabLabel(aTab, aExpectedLabel, aCallback) {
-  if (aTab.visibleLabel == aExpectedLabel) {
-    executeSoon(aCallback);
-  } else {
-    executeSoon(function () { waitForTabLabel(aTab, aExpectedLabel, aCallback); });
-  }
-}
-
-/**
- * Call the aCallback after adding aCount tabs.
- *
- * @param aCount         the number of tabs to add
- * @param aCallback      the callback for use upon success
- */
-function addTabs(aCount, aCallback) {
-  let addedTabs = [];
-  for (let i = aCount; i > 0; i--) {
-    addedTabs.push(gBrowser.addTab(null, {skipAnimation: true}));
-  }
-  executeSoon(function () { aCallback(addedTabs); });
-}
-
-/**
- * Call the aCallback after updating aTab's title and waiting for a label update
- * In the case of failure, this will cause timeout of the test.
- *
- * @param aTab           the tab whose title is set
- * @param aTitle         the value to give the tab title
- * @param aExpectedLabel the value the tab's label must match
- * @param aCallback      the callback for use upon success
- */
-function setTitleForTab(aTab, aTitle, aExpectedLabel, aCallback) {
-  gBrowser.tabContainer.addEventListener("TabLabelModified",
-                                         afterTabLabelModified, false);
-  // Only start polling for the label after the event has hit
-  function afterTabLabelModified() {
-    gBrowser.tabContainer.removeEventListener("TabLabelModified",
-                                              afterTabLabelModified, false);
-    waitForTabLabel(aTab, aExpectedLabel, aCallback);
-  }
-  // On the off chance we're trying to set the title on a too-young tab,
-  // we wait until it's mature
-  function doSetTitle() {
-    if (aTab.linkedBrowser && aTab.linkedBrowser.contentDocument) {
-      aTab.linkedBrowser.contentDocument.title = aTitle;
-    } else {
-      executeSoon(doSetTitle);
-    }
-  }
-  executeSoon(doSetTitle);
-}
-
-/**
- * Call the aCallback after updating aTab's label and waiting for a label update
- * In the case of failure, this will cause timeout of the test.
- *
- * @param aTab           the tab whose title is set
- * @param aTitle         the value to give the tab title
- * @param aExpectedLabel the value the tab's label must match
- * @param aCallback      the callback for use upon success
- */
-function setLabelForTab(aTab, aTitle, aExpectedLabel, aCallback) {
-  executeSoon(function () {
-    aTab.label = aTitle;
-    waitForTabLabel(aTab, aExpectedLabel, aCallback);
-  });
-}
-
-function GroupTest() {
-  this.groupNumber = 0;
-  this.tabs = [];
-}
-
-GroupTest.prototype = {
-  groups: [
-    [
-      /*
-       * Test proxying and suffix protection
-       */
-      [
-        "Foo - Bar - Baz",
-        "Foo - Baz - Baz",
-        "Foo - Baz - Baz",
-        "Foo - Baz - Qux"
-      ],
-      [
-        [
-          "Bar - Baz",
-          "Baz - Baz"
-        ],
-        [
-          "Bar - Baz",
-          "Baz - Baz",
-          "Baz - Baz"
-        ],
-        [
-          "Bar - Baz",
-          "Baz",
-          "Baz",
-          "Qux"
-        ]
-      ]
-    ],
-    [
-      /*
-       * Test pathmode
-       */
-      [
-        "http://example.com/foo.html",
-        "http://example.com/foo/bar.html",
-        "Browse - ftp://example.com/pub/",
-        "Browse - ftp://example.com/pub/src/"
-      ],
-      [
-        [
-          "foo.html",
-          "foo/bar.html"
-        ],
-        [
-          "foo.html",
-          "foo/bar.html",
-          "Browse - ftp://example.com/pub/"
-        ],
-        [
-          "foo.html",
-          "foo/bar.html",
-          "pub/",
-          "src/"
-        ]
-      ]
-    ],
-    [
-      /*
-       * Test that we don't leave a lone suffix
-       */
-      [
-        "'Zilla and the Foxes - Singles - Musical Monkey",
-        "'Zilla and the Foxes - Biography - Musical Monkey",
-        "'Zilla and the Foxes - Musical Monkey",
-        "'Zilla and the Foxes - Interviews - Musical Monkey"
-      ],
-      [
-        [
-          "Singles - Musical Monkey",
-          "Biography - Musical Monkey"
-        ],
-        [
-          "Singles - Musical Monkey",
-          "Biography - Musical Monkey",
-          "'Zilla and the Foxes - Musical Monkey"
-        ],
-        [
-          "Singles - Musical Monkey",
-          "Biography - Musical Monkey",
-          "'Zilla and the Foxes - Musical Monkey",
-          "Interviews - Musical Monkey"
-        ]
-      ]
-    ],
-    /*
-     * Test short endings for MIN_CHOP
-     */
-    [
-      [
-        "Foo - Bar - 0",
-        "Foo - Bar - 0 - extra - 0",
-        "Foo - Bar - 1",
-        "Foo - Bar - 2 - extra",
-        "Foo - Bar - 3"
-      ],
-      [
-        [
-          "Bar - 0",
-          "0 - extra - 0"
-        ],
-        [
-          "Bar - 0",
-          "0 - extra - 0",
-          "Bar - 1"
-        ],
-        [
-          "Bar - 0",
-          "0 - extra - 0",
-          "Bar - 1",
-          "2 - extra"
-        ],
-        [
-          "Bar - 0",
-          "0 - extra - 0",
-          "Bar - 1",
-          "2 - extra",
-          "Bar - 3"
-        ]
-      ]
-    ],
-    [
-      /*
-       * Test multiple whitespace
-       */
-      [
-        "Foo  - Bar -  Baz",
-        "Foo -  Bar -  Baz",
-        "Foo  -  Bar -  Baz",
-        "Foo  - Baz -  Baz"
-      ],
-      [
-        [
-          "Foo - Bar - Baz",
-          "Foo - Bar - Baz"
-        ],
-        [
-          "Foo - Bar - Baz",
-          "Foo - Bar - Baz",
-          "Foo - Bar - Baz"
-        ],
-        [
-          "Bar - Baz",
-          "Bar - Baz",
-          "Bar - Baz",
-          "Baz - Baz"
-        ]
-      ]
-    ]
-  ],
-
-  /**
-   * Either proceed with the next group, or finish group tests
-   */
-  nextGroup: function GroupTest_nextGroup() {
-    while (this.tabs.length) {
-      gBrowser.removeTab(this.tabs.pop());
-    }
-    if (this.groups.length) {
-      this.groupNumber++;
-      [this.labels, this.expectedLabels] = this.groups.shift();
-      this.nextTab();
-    } else {
-      runNextTest();
-    }
-  },
-
-  /**
-   * Runs tests for existing tabs, and adds the next tab (if group isn't empty)
-   * If the group is empty, starts the next group
-   */
-  nextTab: function GroupTest_nextTab() {
-    if (this.tabs.length > 1) {
-      let ourExpected = this.expectedLabels.shift();
-      for (let i = 0; i < this.tabs.length; i++) {
-        is(this.tabs[i].visibleLabel, ourExpected[i],
-          "Tab " + this.groupNumber + "." + (i + 1) + " has correct visibleLabel");
-      }
-    }
-    if (this.labels.length) {
-      this.tabs.push(gBrowser.addTab(
-        "data:text/html,<title>" + this.labels.shift() + "</title>",
-        {skipAnimation: true}));
-      if (this.tabs.length > 1) {
-        waitForTabLabel(this.tabs[this.tabs.length - 1],
-                        this.expectedLabels[0][this.expectedLabels[0].length - 1],
-                        this.nextTab.bind(this));
-      } else {
-        this.nextTab();
-      }
-    } else {
-      this.nextGroup();
-    }
-  }
-};
-
-let TESTS = [
-function test_about_blank() {
-  let tab1 = gBrowser.selectedTab;
-  let tab2;
-  let tab3;
-  addTabs(2, setup1);
-  function setup1(aTabs) {
-    [tab2, tab3] = aTabs
-    waitForTabLabel(tab3, "New Tab", setupComplete);
-  }
-  function setupComplete() {
-    is(tab1.visibleLabel, "New Tab", "First tab has original label");
-    is(tab2.visibleLabel, "New Tab", "Second tab has original label");
-    is(tab3.visibleLabel, "New Tab", "Third tab has original label");
-    runNextTest();
-  }
-},
-
-function test_two_tabs() {
-  let tab1 = gBrowser.selectedTab;
-  addTabs(1, setup1);
-  let tab2;
-  function setup1(aTabs) {
-    tab2 = aTabs[0];
-    setTitleForTab(tab1, "Foo - Bar - Baz", "Foo - Bar - Baz", setup2);
-  }
-  function setup2() {
-    setTitleForTab(tab2, "Foo - Baz - Baz", "Baz - Baz", setupComplete);
-  }
-  function setupComplete() {
-    is(tab1.visibleLabel, "Bar - Baz", "Removed exactly two tokens");
-    is(tab2.visibleLabel, "Baz - Baz", "Removed exactly two tokens");
-    gBrowser.removeTab(tab2);
-    waitForTabLabel(tab1, "Foo - Bar - Baz", afterRemoval);
-  }
-  function afterRemoval() {
-    is (tab1.visibleLabel, "Foo - Bar - Baz", "Single tab has full title");
-    runNextTest();
-  }
-},
-
-function test_direct_label() {
-  let tab1 = gBrowser.selectedTab;
-  addTabs(2, setup1);
-  let tab2;
-  let tab3;
-  function setup1(aTabs) {
-    [tab2, tab3] = aTabs;
-    setLabelForTab(tab1, "Foo  - Bar -  Baz", "Foo  - Bar -  Baz", setup2);
-  }
-  function setup2() {
-    setLabelForTab(tab2, "Foo -  Baz  - Baz", "Foo -  Baz  - Baz", setup3);
-  }
-  function setup3() {
-    setLabelForTab(tab3, "Foo  - Baz -  Baz", "Baz -  Baz", setupComplete);
-  }
-  function setupComplete() {
-    is(tab1.visibleLabel, "Bar -  Baz", "Removed exactly two tokens");
-    is(tab2.visibleLabel, "Foo -  Baz  - Baz", "Irregular spaces mean no match");
-    is(tab3.visibleLabel, "Baz -  Baz", "Removed exactly two tokens");
-    gBrowser.removeTab(tab3);
-    waitForTabLabel(tab1, "Foo  - Bar -  Baz", afterRemoval);
-  }
-  function afterRemoval() {
-    is (tab1.visibleLabel, "Foo  - Bar -  Baz", "Single tab has full title");
-    gBrowser.removeTab(tab2);
-    runNextTest();
-  }
-},
-
-function test_groups() {
-  let g = new GroupTest();
-  g.nextGroup();
-}
-];
-
-function runNextTest() {
-  if (TESTS.length == 0) {
-    finish();
-    return;
-  }
-
-  while (gBrowser.tabs.length > 1) {
-    gBrowser.removeTab(gBrowser.tabs[1]);
-  }
-
-  info("Running " + TESTS[0].name);
-  TESTS.shift()();
-};
-
-function test() {
-  waitForExplicitFinish();
-  runNextTest();
-}
-
deleted file mode 100644
--- a/browser/base/content/test/browser_bug583890_label.js
+++ /dev/null
@@ -1,88 +0,0 @@
-/* Any copyright is dedicated to the Public Domain.
- * http://creativecommons.org/publicdomain/zero/1.0/ */
-
-/* Tests:
- *   verify that the visibleLabel attribute works
- *   verify the TabLabelModified event works
- */
-
-function test() {
-  waitForExplicitFinish();
-  let tab = gBrowser.addTab("about:newtab",
-                            {skipAnimation: true});
-  tab.linkedBrowser.addEventListener("load", function onLoad(event) {
-    event.currentTarget.removeEventListener("load", onLoad, true);
-    gBrowser.selectedTab = tab;
-    executeSoon(afterLoad);
-  }, true);
-  tab.addEventListener("TabLabelModified", handleInTest, true);
-}
-
-// Prevent interference
-function handleInTest(aEvent) {
-  aEvent.preventDefault();
-  aEvent.stopPropagation();
-  aEvent.target.visibleLabel = aEvent.target.label;
-}
-
-function afterLoad() {
-  let tab = gBrowser.selectedTab;
-  let xulLabel = document.getAnonymousElementByAttribute(tab, "anonid",
-                                                         "tab-label");
-  // Verify we're starting out on the right foot
-  is(tab.label, "New Tab", "Initial tab label is default");
-  is(xulLabel.value, "New Tab", "Label element is default");
-  is(tab.visibleLabel, "New Tab", "visibleLabel is default");
-
-  // Check that a normal label setting works correctly
-  tab.label = "Hello, world!";
-  is(tab.label, "Hello, world!", "tab label attribute set via tab.label");
-  is(xulLabel.value, "Hello, world!", "xul:label set via tab.label");
-  is(tab.visibleLabel, "Hello, world!", "visibleLabel set via tab.label");
-
-  // Check that setting visibleLabel only affects the label element
-  tab.visibleLabel = "Goodnight, Irene";
-  is(tab.label, "Hello, world!", "Tab.label unaffected by visibleLabel setter");
-  is(xulLabel.value, "Goodnight, Irene",
-     "xul:label set by visibleLabel setter");
-  is(tab.visibleLabel, "Goodnight, Irene",
-     "visibleLabel attribute set by visibleLabel setter");
-
-  // Check that setting the label property hits everything
-  tab.label = "One more label";
-  is(tab.label, "One more label",
-     "Tab label set via label property after diverging from visibleLabel");
-  is(xulLabel.value, "One more label",
-     "xul:label set via label property after diverging from visibleLabel");
-  is(tab.visibleLabel, "One more label",
-     "visibleLabel set from label property after diverging from visibleLabel");
-
-  tab.removeEventListener("TabLabelModified", handleInTest, true);
-  tab.addEventListener("TabLabelModified", handleTabLabel, true);
-  tab.label = "This won't be the visibleLabel";
-}
-
-function handleTabLabel(aEvent) {
-  aEvent.target.removeEventListener("TabLabelModified", handleTabLabel, true);
-  aEvent.preventDefault();
-  aEvent.stopPropagation();
-  aEvent.target.visibleLabel = "Handler set this as the visible label";
-  executeSoon(checkTabLabelModified);
-}
-
-function checkTabLabelModified() {
-  let tab = gBrowser.selectedTab;
-  let xulLabel = document.getAnonymousElementByAttribute(tab, "anonid",
-                                                         "tab-label");
-
-  is(tab.label, "This won't be the visibleLabel",
-     "Tab label set via label property that triggered event");
-  is(xulLabel.value, "Handler set this as the visible label",
-     "xul:label set by TabLabelModified handler");
-  is(tab.visibleLabel, "Handler set this as the visible label",
-     "visibleLabel set by TabLabelModified handler");
-
-  gBrowser.removeCurrentTab({animate: false});
-  finish();
-}
-
--- a/browser/base/content/urlbarBindings.xml
+++ b/browser/base/content/urlbarBindings.xml
@@ -1588,52 +1588,25 @@
         document.getAnonymousElementByAttribute(this, "anonid", "promo-message");
       </field>
       <field name="_promolink" readonly="true">
         document.getAnonymousElementByAttribute(this, "anonid", "promo-link");
       </field>
       <field name="_brandBundle" readonly="true">
         Services.strings.createBundle("chrome://branding/locale/brand.properties");
       </field>
-      <property name="_viewsLeftMap">
-        <getter><![CDATA[
-          let viewsLeftMap = {};
-          try {
-            viewsLeftMap = JSON.parse(Services.prefs.getCharPref("browser.syncPromoViewsLeftMap"));
-          } catch (ex) {
-            // If the old preference exists, migrate it to the new one.
-            try {
-              let oldPref = Services.prefs.getIntPref("browser.syncPromoViewsLeft");
-              Services.prefs.clearUserPref("browser.syncPromoViewsLeft");
-              viewsLeftMap.bookmarks = oldPref;
-              viewsLeftMap.passwords = oldPref;
-              Services.prefs.setCharPref("browser.syncPromoViewsLeftMap",
-                                         JSON.stringify(viewsLeftMap));
-            } catch (ex2) {}
-          }
-          return viewsLeftMap;
-        ]]></getter>
-      </property>
       <property name="_viewsLeft">
         <getter><![CDATA[
-          let views = 5;
-          if (this._viewsLeftMap[this._notificationType] !== undefined) {
-            views = this._viewsLeftMap[this._notificationType];
-          }
-          return views;
+          try {
+            return Services.prefs.getIntPref("browser.syncPromoViewsLeft");
+          } catch(ex) {}
+          return 5;
         ]]></getter>
         <setter><![CDATA[
-          if (this._viewsLeftMap !== undefined) {
-            let map = this._viewsLeftMap;
-          } else {
-            let map = {};
-          }
-          map[this._notificationType] = val;
-          Services.prefs.setCharPref("browser.syncPromoViewsLeftMap",
-                                     JSON.stringify(map));
+          Services.prefs.setIntPref("browser.syncPromoViewsLeft", val);
           return val;
         ]]></setter>
       </property>
       <property name="_notificationType">
         <getter><![CDATA[
           // Use the popupid attribute to identify the notification type,
           // otherwise just rely on the panel id for common arrowpanels.
           let type = this._panel.firstChild.getAttribute("popupid") ||
--- a/browser/installer/package-manifest.in
+++ b/browser/installer/package-manifest.in
@@ -356,16 +356,18 @@
 #ifdef MOZ_GTK2
 @BINPATH@/components/nsFilePicker.manifest
 @BINPATH@/components/nsFilePicker.js
 #endif
 @BINPATH@/components/nsHelperAppDlg.manifest
 @BINPATH@/components/nsHelperAppDlg.js
 @BINPATH@/components/nsDownloadManagerUI.manifest
 @BINPATH@/components/nsDownloadManagerUI.js
+@BINPATH@/components/nsProxyAutoConfig.manifest
+@BINPATH@/components/nsProxyAutoConfig.js
 @BINPATH@/components/NetworkGeolocationProvider.manifest
 @BINPATH@/components/NetworkGeolocationProvider.js
 @BINPATH@/components/GPSDGeolocationProvider.manifest
 @BINPATH@/components/GPSDGeolocationProvider.js
 @BINPATH@/components/nsSidebar.manifest
 @BINPATH@/components/nsSidebar.js
 @BINPATH@/components/extensions.manifest
 @BINPATH@/components/addonManager.js
--- a/browser/installer/removed-files.in
+++ b/browser/installer/removed-files.in
@@ -82,18 +82,16 @@ components/dom_system_b2g.xpt
 components/uconvd.dll
 components/WeaveCrypto.js
 components/WeaveCrypto.manifest
 components/xmlextras.xpt
 components/xpcom.xpt
 components/xpti.dat
 components/xptitemp.dat
 components/nsMicrosummaryService.js
-components/nsProxyAutoConfig.manifest
-components/nsProxyAutoConfig.js
 D3DCompiler_42.dll
 d3dx9_42.dll
 defaults/pref/all.js
 defaults/pref/bug259708.js
 defaults/pref/bug307259.js
 defaults/pref/reporter.js
 defaults/pref/security-prefs.js
 defaults/pref/winpref.js
@@ -918,17 +916,16 @@ xpicleanup@BIN_SUFFIX@
   components/nsLoginInfo.js
   components/nsLoginManager.js
   components/nsLoginManagerPrompter.js
   components/nsPlacesAutoComplete.js
   components/nsPlacesDBFlush.js
   components/nsPlacesExpiration.js
   components/nsPrivateBrowsingService.js
   components/nsPrompter.js
-  components/nsProxyAutoConfig.manifest
   components/nsProxyAutoConfig.js
   components/nsSafebrowsingApplication.js
   components/nsSearchService.js
   components/nsSearchSuggestions.js
   components/nsSessionStartup.js
   components/nsSessionStore.js
   components/nsSetDefaultBrowser.js
   components/nsSidebar.js
--- a/browser/modules/Makefile.in
+++ b/browser/modules/Makefile.in
@@ -16,17 +16,16 @@ TEST_DIRS += test
 EXTRA_JS_MODULES = \
 	AboutHomeUtils.jsm \
 	BrowserNewTabPreloader.jsm \
 	openLocationLastURL.jsm \
 	NetworkPrioritizer.jsm \
 	NewTabUtils.jsm \
 	offlineAppCache.jsm \
 	SignInToWebsite.jsm \
-	TabTitleAbridger.jsm \
 	TelemetryTimestamps.jsm \
 	Social.jsm \
 	webappsUI.jsm \
 	$(NULL)
 
 ifeq ($(MOZ_WIDGET_TOOLKIT),windows)
 EXTRA_JS_MODULES += \
 	WindowsPreviewPerTab.jsm \
deleted file mode 100644
--- a/browser/modules/TabTitleAbridger.jsm
+++ /dev/null
@@ -1,604 +0,0 @@
-/* This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this file,
- * You can obtain one at http://mozilla.org/MPL/2.0/. */
-
-"use strict";
-
-let EXPORTED_SYMBOLS = ["TabTitleAbridger"];
-
-const Cu = Components.utils;
-const ABRIDGMENT_PREF = "browser.tabs.cropTitleRedundancy";
-
-Cu.import("resource://gre/modules/XPCOMUtils.jsm");
-Cu.import("resource://gre/modules/Services.jsm");
-
-XPCOMUtils.defineLazyServiceGetter(this, "gETLDService",
-  "@mozilla.org/network/effective-tld-service;1",
-  "nsIEffectiveTLDService");
-
-function TabTitleAbridger(aBrowserWin) {
-  this._tabbrowser = aBrowserWin.gBrowser;
-}
-
-TabTitleAbridger.prototype = {
-  /*
-   * Events we listen to.  We specifically do not listen for TabCreate, as we
-   * get TabLabelModified at the appropriate times.
-   */
-  _eventNames: [
-    "TabPinned",
-    "TabUnpinned",
-    "TabShow",
-    "TabHide",
-    "TabClose",
-    "TabLabelModified"
-  ],
-
-  init: function TabTitleAbridger_Initialize() {
-    this._cropTitleRedundancy = Services.prefs.getBoolPref(ABRIDGMENT_PREF);
-    Services.prefs.addObserver(ABRIDGMENT_PREF, this, false);
-    if (this._cropTitleRedundancy) {
-      this._domainSets = new DomainSets();
-      this._addListeners();
-    }
-  },
-
-  destroy: function TabTitleAbridger_Destroy() {
-    Services.prefs.removeObserver(ABRIDGMENT_PREF, this);
-    if (this._cropTitleRedundancy) {
-      this._dropListeners();
-    }
-  },
-
-  /**
-   * Preference observer
-   */
-  observe: function TabTitleAbridger_PrefObserver(aSubject, aTopic, aData) {
-    let val = Services.prefs.getBoolPref(aData);
-    if (this._cropTitleRedundancy && !val) {
-      this._dropListeners();
-      this._domainSets.destroy();
-      delete this._domainSets;
-      this._resetTabTitles();
-    } else if (!this._cropTitleRedundancy && val) {
-      this._addListeners();
-      // We're just turned on, so we want to abridge everything
-      this._domainSets = new DomainSets();
-      let domains = this._domainSets.bootstrap(this._tabbrowser.visibleTabs);
-      this._abridgeTabTitles(domains);
-    }
-    this._cropTitleRedundancy = val;
-  },
-
-  /**
-   * Adds all the necessary event listeners and listener-supporting objects for
-   * the instance.
-   */
-  _addListeners: function TabTitleAbridger_addListeners() {
-    let tabContainer = this._tabbrowser.tabContainer;
-    for (let eventName of this._eventNames) {
-      tabContainer.addEventListener(eventName, this, false);
-    }
-  },
-
-  /**
-   * Removes event listeners and listener-supporting objects for the instance.
-   */
-  _dropListeners: function TabTitleAbridger_dropListeners() {
-    let tabContainer = this._tabbrowser.tabContainer;
-    for (let eventName of this._eventNames) {
-      tabContainer.removeEventListener(eventName, this, false);
-    }
-  },
-
-  handleEvent: function TabTitleAbridger_handler(aEvent) {
-    let tab = aEvent.target;
-    let updateSets;
-
-    switch (aEvent.type) {
-      case "TabUnpinned":
-      case "TabShow":
-        updateSets = this._domainSets.addTab(tab);
-        break;
-      case "TabPinned":
-      case "TabHide":
-      case "TabClose":
-        updateSets = this._domainSets.removeTab(tab);
-        tab.visibleLabel = tab.label;
-        break;
-      case "TabLabelModified":
-        if (!tab.hidden && !tab.pinned) {
-          aEvent.preventDefault();
-          updateSets = this._domainSets.updateTab(tab);
-        }
-        break;
-    }
-    this._abridgeTabTitles(updateSets);
-  },
-
-  /**
-   * Make all tabs have their visibleLabels be their labels.
-   */
-  _resetTabTitles: function TabTitleAbridger_resetTabTitles() {
-    // We're freshly disabled, so reset unpinned, visible tabs (see handleEvent)
-    for (let tab of this._tabbrowser.visibleTabs) {
-      if (!tab.pinned && tab.visibleLabel != tab.label) {
-        tab.visibleLabel = tab.label;
-      }
-    }
-  },
-
-  /**
-   * Apply abridgment for the given tabset and chop list.
-   * @param aTabSet   Array of tabs to abridge
-   * @param aChopList Corresponding array of chop points for the tabs
-   */
-  _applyAbridgment: function TabTitleAbridger_applyAbridgment(aTabSet,
-                                                              aChopList) {
-    for (let i = 0; i < aTabSet.length; i++) {
-      let tab = aTabSet[i];
-      let label = tab.label || "";
-      if (label.length > 0) {
-        let chop = aChopList[i] || 0;
-        if (chop > 0) {
-          label = label.substr(chop);
-        }
-      }
-      if (label != tab.visibleLabel) {
-        tab.visibleLabel = label;
-      }
-    }
-  },
-
-  /**
-   * Abridges the tabs sets of tabs in the aTabSets array.
-   * @param aTabSets Array of tab sets needing abridgment
-   */
-  _abridgeTabTitles: function TabTitleAbridger_abridgeTabtitles(aTabSets) {
-    // Process each set
-    for (let tabSet of aTabSets) {
-      // Get a chop list for the set and apply it
-      let chopList = AbridgmentTools.getChopsForSet(tabSet);
-      this._applyAbridgment(tabSet, chopList);
-    }
-  }
-};
-
-/**
- * Maintains a mapping between tabs and domains, so that only the tabs involved
- * in a TabLabelModified event need to be modified by the TabTitleAbridger.
- */
-function DomainSets() {
-  this._domainSets = {};
-  this._tabsMappedToDomains = new WeakMap();
-}
-
-DomainSets.prototype = {
-  _noHostSchemes: {
-    chrome: true,
-    file: true,
-    resource: true,
-    data: true,
-    about: true
-  },
-
-  destroy: function DomainSets_destroy() {
-    delete this._domainSets;
-    delete this._tabsMappedToDomains;
-  },
-
-  /**
-   * Used to build the domainsets when enabled in mid-air, as opposed to when
-   * the window is coming up.
-   * @param The visibleTabs for the browser, or a set of tabs to check.
-   * @return An array containing the tabs in the domains they belong to, or
-   * an empty array if none of the tabs belonged to domains.
-   */
-  bootstrap: function DomainSets_bootstrap(aVisibleTabs) {
-    let needAbridgment = [];
-    for (let tab of aVisibleTabs) {
-      let domainSet = this.addTab(aTab)[0] || null;
-      if (domainSet && needAbridgment.indexOf(domainSet) == -1) {
-        needAbridgment.push(domainSet);
-      }
-    }
-    return needAbridgment;
-  },
-
-  /**
-   * Given a tab, include it in the domain sets.
-   * @param aTab The tab to include in the domain sets
-   * @param aTabDomain [optional] The known domain for the tab
-   * @return An array containing the tabs in the domain the tab was added to.
-   */
-  addTab: function DomainSets_addTab(aTab, aTabDomain) {
-    let tabDomain = aTabDomain || this._getDomainForTab(aTab);
-    if (!this._domainSets.hasOwnProperty(tabDomain)) {
-      this._domainSets[tabDomain] = [];
-    }
-    this._domainSets[tabDomain].push(aTab);
-    this._tabsMappedToDomains.set(aTab, tabDomain);
-    return [this._domainSets[tabDomain]];
-  },
-
-  /**
-   * Given a tab, remove it from the domain sets.
-   * @param aTab The tab to remove from the domain sets
-   * @param aTabDomain [optional] The known domain for the tab
-   * @return An array containing the tabs in the domain the tab was removed
-   * from, or an empty array if the tab was not removed from a domain set.
-   */
-  removeTab: function DomainSets_removeTab(aTab, aTabDomain) {
-    let oldTabDomain = aTabDomain || this._tabsMappedToDomains.get(aTab);
-    if (!this._domainSets.hasOwnProperty(oldTabDomain)) {
-      return [];
-    }
-    let index = this._domainSets[oldTabDomain].indexOf(aTab);
-    if (index == -1) {
-      return [];
-    }
-    this._domainSets[oldTabDomain].splice(index, 1);
-    this._tabsMappedToDomains.delete(aTab);
-    if (!this._domainSets[oldTabDomain].length) {
-      // Keep the sets clean of empty domains
-      delete this._domainSets[oldTabDomain];
-      return [];
-    }
-    return [this._domainSets[oldTabDomain]];
-  },
-
-  /**
-   * Given a tab, update the domain set it belongs to.
-   * @param aTab The tab to update the domain set for
-   * @return An array containing the tabs in the domain the tab belongs to, and
-   * (if changed) the domain the tab was removed from.
-   */
-  updateTab: function DomainSets_updateTab(aTab) {
-    let tabDomain = this._getDomainForTab(aTab);
-    let oldTabDomain = this._tabsMappedToDomains.get(aTab);
-    if (oldTabDomain != tabDomain) {
-      let needAbridgment = [];
-      // Probably swapping domain sets out; we pass the domains along to avoid
-      // re-getting them in addTab/removeTab
-      if (oldTabDomain) {
-        needAbridgment = needAbridgment.concat(
-          this.removeTab(aTab, oldTabDomain));
-      }
-      return needAbridgment.concat(this.addTab(aTab, tabDomain));
-    }
-    // No change was needed
-    return [this._domainSets[tabDomain]];
-  },
-
-  /**
-   * Given a tab, determine the URI scheme or host to categorize it.
-   * @param aTab The tab to get the domain for
-   * @return The domain or scheme for the tab
-   */
-  _getDomainForTab: function DomainSets_getDomainForTab(aTab) {
-    let browserURI = aTab.linkedBrowser.currentURI;
-    if (browserURI.scheme in this._noHostSchemes) {
-      return browserURI.scheme;
-    }
-
-    // throws for empty URI, host is IP, and disallowed characters
-    try {
-      return gETLDService.getBaseDomain(browserURI);
-    }
-    catch (e) {}
-
-    // this nsIURI may not be an nsStandardURL nsIURI, which means it
-    // might throw for the host
-    try {
-      return browserURI.host;
-    }
-    catch (e) {}
-
-    // Treat this URI as unique
-    return browserURI.spec;
-  }
-};
-
-let AbridgmentTools = {
-  /**
-   * Constant for the minimum remaining length allowed if a label is abridged.
-   * I.e., original:"abc - de" might be chopped to just "de", which is too
-   * small, so the label would be reverted to the next-longest version.
-   */
-  MIN_CHOP: 3,
-
-  /**
-   * Helper to determine if aStr is URI-like
-   * \s?            optional leading space
-   * [^\s\/]*       optional scheme or relative path component
-   * ([^\s\/]+:\/)? optional scheme separator, with at least one scheme char
-   * \/             at least one slash
-   * \/?            optional second (or third for eg, file scheme on UNIX) slash
-   * [^\s\/]*       optional path component
-   * ([^\s\/]+\/?)* optional more path components with optional end slash
-   * @param aStr the string to check for URI-likeness
-   * @return boolean value of whether aStr matches
-   */
-  _titleIsURI: function AbridgmentTools_titleIsURI(aStr) {
-    return /^\s?[^\s\/]*([^\s\/]+:\/)?\/\/?[^\s\/]*([^\s\/]+\/?)*$/.test(aStr);
-  },
-
-  /**
-   * Finds the proper abridgment indexes for the given tabs.
-   * @param aTabSet the array of tabs to find abridgments for
-   * @return an array of abridgment indexes corresponding to the tabs
-   */
-  getChopsForSet: function AbridgmentTools_getChopsForSet(aTabSet) {
-    let chopList = [];
-    let pathMode = false;
-
-    aTabSet.sort(function(aTab, bTab) {
-      let aLabel = aTab.label;
-      let bLabel = bTab.label;
-      return (aLabel < bLabel) ? -1 : (aLabel > bLabel) ? 1 : 0;
-    });
-
-    // build and apply the chopList for the set
-    for (let i = 0, next = 1; next < aTabSet.length; i = next++) {
-      next = this._abridgePair(aTabSet, i, next, chopList);
-    }
-    return chopList;
-  },
-
-  /**
-   * Handles the abridgment between aIndex and aNext, or in the case where the
-   * label at aNext is the same as at aIndex, moves aNext forward appropriately.
-   * @param aTabSet   Sorted array of tabs that the indices refer to
-   * @param aIndex    First tab index to use in abridgment
-   * @param aNext     Second tab index to use as the an initial comparison
-   * @param aChopList Array to add chop points to for the given tabs
-   * @return Index to replace aNext with, that is the index of the tab that was
-   * used in abridging the tab at aIndex
-   */
-  _abridgePair: function TabTitleAbridger_abridgePair(aTabSet, aIndex, aNext,
-                                                      aChopList) {
-    let tabStr = aTabSet[aIndex].label;
-    let pathMode = this._titleIsURI(tabStr);
-    let chop = RedundancyFinder.indexOfSep(pathMode, tabStr);
-
-    // Default to no chop
-    if (!aChopList[aIndex]) {
-      aChopList[aIndex] = 0;
-    }
-
-    // Siblings with same label get proxied by the first
-    let nextStr;
-    aNext = this._nextUnproxied(aTabSet, tabStr, aNext);
-    if (aNext < aTabSet.length) {
-      nextStr = aTabSet[aNext].label;
-    }
-
-    // Bail on these strings early, using the first as the basis
-    if (chop == -1 || aNext == aTabSet.length ||
-        !nextStr.startsWith(tabStr.substr(0, chop + 1))) {
-      chop = aChopList[aIndex];
-      if (aNext != aTabSet.length) {
-        aChopList[aNext] = 0;
-      }
-    } else {
-      [pathMode, chop] = this._getCommonChopPoint(pathMode, tabStr, nextStr,
-                                                  chop);
-      [chop, aChopList[aNext]] = this._adjustChops(pathMode, tabStr, nextStr,
-                                                  chop);
-      aChopList[aIndex] = chop;
-    }
-
-    // Mark chop on the relevant tabs
-    for (let j = aIndex; j < aNext; j++) {
-      let oldChop = aChopList[j];
-      if (!oldChop || oldChop < chop) {
-        aChopList[j] = chop;
-      }
-    }
-    return aNext;
-  },
-
-  /**
-   * Gets the index in aTabSet of the next tab that's not equal to aStr.
-   * @param aTabSet Sorted set of tabs to check
-   * @param aStr    Label string to check against
-   * @param aStart  First item to check for proxying
-   * @return The index of the next different tab.
-   */
-  _nextUnproxied: function AbridgmentTools_nextUnproxied(aTabSet, aTabStr,
-                                                              aStart) {
-    let nextStr = aTabSet[aStart].label;
-    while (aStart < aTabSet.length && aTabStr == nextStr) {
-      aStart += 1;
-      if (aStart < aTabSet.length) {
-        nextStr = aTabSet[aStart].label;
-      }
-    }
-    return aStart;
-  },
-
-  /**
-   * Get the common index where the aTabStr and aNextStr diverge.
-   * @param aPathMode Whether to use path mode
-   * @param aTabStr   Tab label
-   * @param aNextStr  Second tab label
-   * @param aChop     Current chop point being considered (index of aTabStr's
-   * first separator)
-   * @return An array containing the resulting path mode (in case it changes)
-   * and the diverence index for the labels.
-   */
-  _getCommonChopPoint: function AbridgmentTools_getCommonChopPoint(aPathMode,
-                                                                   aTabStr,
-                                                                   aNextStr,
-                                                                   aChop) {
-    aChop = RedundancyFinder.findCommonPrefix(aPathMode, aTabStr, aNextStr,
-                                              aChop);
-    // Does a URI remain?
-    if (!aPathMode) {
-      aPathMode = this._titleIsURI(aTabStr.substr(aChop));
-      if (aPathMode) {
-        aChop = RedundancyFinder.findCommonPrefix(aPathMode, aTabStr, aNextStr,
-                                                  aChop);
-      }
-    }
-
-    return [aPathMode, aChop + 1];
-  },
-
-  /**
-   * Adjusts the chop points based on their suffixes and lengths.
-   * @param aPathMode Whether to use path mode
-   * @param aTabStr   Tab label
-   * @param aNextStr  Second tab label
-   * @param aChop     Current chop point being considered
-   * @return An array containing the chop point for the two labels.
-   */
-  _adjustChops: function AbridgmentTools_adjustChops(aPathMode, aTabStr,
-                                                     aNextStr, aChop) {
-    let suffix = RedundancyFinder.findCommonSuffix(aPathMode, aTabStr,
-                                                   aNextStr);
-    let sufPos = aTabStr.length - suffix;
-    let nextSufPos = aNextStr.length - suffix;
-    let nextChop = aChop;
-
-    // Adjust the chop based on the suffix.
-    if (sufPos < aChop) {
-      // Only revert based on suffix for tab and any identicals
-      aChop = RedundancyFinder.lastIndexOfSep(aPathMode, aTabStr,
-                                              sufPos - 1)[1] + 1;
-    } else if (nextSufPos < aChop) {
-      // Only revert based on suffix for 'next'
-      nextChop = RedundancyFinder.lastIndexOfSep(aPathMode, aNextStr,
-                                                 nextSufPos - 1)[1] + 1;
-    }
-
-    if (aTabStr.length - aChop < this.MIN_CHOP) {
-      aChop = RedundancyFinder.lastIndexOfSep(aPathMode, aTabStr,
-                                              aChop - 2)[1] + 1;
-    }
-    if (aNextStr.length - nextChop < this.MIN_CHOP) {
-      nextChop = RedundancyFinder.lastIndexOfSep(aPathMode, aNextStr,
-                                                 nextChop - 2)[1] + 1;
-    }
-    return [aChop, nextChop];
-  }
-};
-
-let RedundancyFinder = {
-  /**
-   * Finds the first index of a matched separator after aStart.
-   * Separators will either be space-padded punctuation or slashes (in pathmode)
-   *
-   * ^.+?      at least one character, non-greedy match
-   * \s+       one or more whitespace characters
-   * [-:>\|]+  one or more separator characters
-   * \s+       one or more whitespace characters
-   *
-   * @param aPathMode true for path mode, false otherwise
-   * @param aStr      the string to look for a separator in
-   * @param aStart    (optional) an index to start the search from
-   * @return the next index of a separator or -1 for none
-   */
-  indexOfSep: function RedundancyFinder_indexOfSep(aPathMode, aStr, aStart) {
-    if (aPathMode) {
-      return aStr.indexOf('/', aStart);
-    }
-
-    let match = aStr.slice(aStart).match(/^.+?\s+[-:>\|]+\s+/);
-    if (match) {
-      return (aStart || 0) + match[0].length - 1;
-    }
-
-    return -1;
-  },
-
-  /**
-   * Compares a pair of strings, seeking an index where their redundancy ends
-   * @param aPathMode true for pathmode, false otherwise
-   * @param aStr      the string to decide an abridgment for
-   * @param aNextStr  the lexicographically next string to compare with
-   * @param aChop     the basis index, a best-known index to begin comparison
-   * @return the index at which aStr's abridged title should begin
-   */
-  findCommonPrefix: function RedundancyFinder_findCommonPrefix(aPathMode, aStr,
-                                                               aNextStr,
-                                                               aChop) {
-    // Advance until the end of the title or the pair diverges
-    do {
-      aChop = this.indexOfSep(aPathMode, aStr, aChop + 1);
-    } while (aChop != -1 && aNextStr.startsWith(aStr.substr(0, aChop + 1)));
-
-    if (aChop < 0) {
-      aChop = aStr.length;
-    }
-
-    // Return the last valid spot
-    return this.lastIndexOfSep(aPathMode, aStr, aChop - 1)[1];
-  },
-
-  /**
-   * Finds the range of a separator earlier than aEnd in aStr
-   * The range is required by findCommonSuffix() needing to know the beginning
-   * of the separator.
-   * Separators will either be space-padded punctuation or slashes (in pathmode)
-   *
-   * .+           one or more initial characters
-   * (            first group
-   *   (          second group
-   *     \s+      one or more whitespace characters
-   *     [-:>\|]+ one or more separator characters
-   *     \s+      one or more whitespace characters
-   *   )          end first group
-   *   .*?        zero or more characters, non-greedy match
-   * )            end second group
-   * $            end of input
-   *
-   * @param aPathMode true for pathmode, false otherwise
-   * @param aStr      the string to look for a separator in
-   * @param aEnd      (optional) an index to start the backwards search from
-   * @return an array containing the endpoints of a separator (-1, -1 for none)
-   */
-  lastIndexOfSep: function RedundancyFinder_lastIndexOfSep(aPathMode, aStr,
-                                                           aEnd) {
-    if (aPathMode) {
-      let path = aStr.lastIndexOf('/', aEnd);
-      return [path, path];
-    }
-
-    let string = aStr.slice(0, aEnd);
-    let match = string.match(/.+((\s+[-:>\|]+\s+).*?)$/);
-    if (match) {
-      let index = string.length - match[1].length;
-      return [index, index + match[2].length - 1];
-    }
-
-    return [-1, -1];
-  },
-
-  /**
-   * Finds a common suffix (redundancy at the end of) a pair of strings.
-   * @param aPathMode true for pathmode, false otherwise
-   * @param aStr      a base string to look for a suffix in
-   * @param aNextStr  a string that may share a common suffix with aStr
-   * @return an index indicating the divergence between the strings
-   */
-  findCommonSuffix: function RedundancyFinder_findCommonSuffix(aPathMode, aStr,
-                                                               aNextStr) {
-    let last = this.lastIndexOfSep(aPathMode, aStr)[0];
-
-    // Is there any suffix match?
-    if (!aNextStr.endsWith(aStr.slice(last))) {
-      return 0;
-    }
-
-    // Move backwards on the main string until the suffix diverges
-    let oldLast;
-    do {
-      oldLast = last;
-      last = this.lastIndexOfSep(aPathMode, aStr, last - 1)[0];
-    } while (last != -1 && aNextStr.endsWith(aStr.slice(last)));
-
-    return aStr.length - oldLast;
-  }
-};
-
--- a/build/unix/build-clang/build-clang.py
+++ b/build/unix/build-clang/build-clang.py
@@ -82,24 +82,27 @@ def build_tooltool_manifest():
         if item == 'algorithm':
             return 3
         return 4
 
     basedir = os.path.split(os.path.realpath(sys.argv[0]))[0]
     tooltool = basedir + '/tooltool.py'
     setup = basedir + '/setup.sh'
     manifest = 'clang.manifest'
-    check_run(['python', tooltool, '-m', 'clang.manifest', 'add',
+    check_run(['python', tooltool, '-m', manifest, 'add',
                setup, 'clang.tar.bz2'])
-    data = simplejson.load(file('clang.manifest'))
+    data = simplejson.load(file(manifest))
     data = [{'clang_version' : 'r%s' % llvm_revision }] + data
-    out = file('clang.manifest','w')
+    out = file(manifest,'w')
     simplejson.dump(data, out, indent=0, item_sort_key=key_sort)
     out.write('\n')
 
+    assert data[2]['filename'] == 'clang.tar.bz2'
+    os.rename('clang.tar.bz2', data[2]['digest'])
+
 isDarwin = platform.system() == "Darwin"
 
 def build_one_stage_aux(stage_dir, is_stage_one):
     os.mkdir(stage_dir)
 
     build_dir = stage_dir + "/build"
     inst_dir = stage_dir + "/clang"
 
@@ -122,16 +125,17 @@ if not os.path.exists(source_dir):
     svn_co("http://llvm.org/svn/llvm-project/cfe/trunk",
            clang_source_dir, llvm_revision)
     svn_co("http://llvm.org/svn/llvm-project/compiler-rt/trunk",
            compiler_rt_source_dir, llvm_revision)
     os.symlink("../../clang", llvm_source_dir + "/tools/clang")
     os.symlink("../../compiler-rt", llvm_source_dir + "/projects/compiler-rt")
     if not isDarwin:
         patch("old-ld-hack.patch", 1, llvm_source_dir)
+        patch("llvm-debug-frame.patch", 1, llvm_source_dir)
         patch("compiler-rt-gnu89-inline.patch", 0, compiler_rt_source_dir)
         patch("no-sse-on-linux.patch", 1, clang_source_dir)
 
 if os.path.exists(build_dir):
     shutil.rmtree(build_dir)
 os.makedirs(build_dir)
 
 stage1_dir = build_dir + '/stage1'
new file mode 100644
--- /dev/null
+++ b/build/unix/build-clang/llvm-debug-frame.patch
@@ -0,0 +1,13 @@
+diff --git a/lib/CodeGen/AsmPrinter/AsmPrinter.cpp b/lib/CodeGen/AsmPrinter/AsmPrinter.cpp
+index d6d4510..c488d4a 100644
+--- a/lib/CodeGen/AsmPrinter/AsmPrinter.cpp
++++ b/lib/CodeGen/AsmPrinter/AsmPrinter.cpp
+@@ -172,6 +172,8 @@ bool AsmPrinter::doInitialization(Module &M) {
+     OutStreamer.EmitFileDirective(M.getModuleIdentifier());
+   }
+ 
++  OutStreamer.EmitCFISections(true, true);
++
+   GCModuleInfo *MI = getAnalysisIfAvailable<GCModuleInfo>();
+   assert(MI && "AsmPrinter didn't require GCModuleInfo?");
+   for (GCModuleInfo::iterator I = MI->begin(), E = MI->end(); I != E; ++I)
--- a/content/base/public/nsDOMFile.h
+++ b/content/base/public/nsDOMFile.h
@@ -425,16 +425,30 @@ public:
       NS_ASSERTION(list_qi == static_cast<nsIDOMFileList*>(aSupports),
                    "Uh, fix QI!");
     }
 #endif
 
     return static_cast<nsDOMFileList*>(aSupports);
   }
 
+  nsIDOMFile* Item(uint32_t aIndex)
+  {
+    return mFiles.SafeObjectAt(aIndex);
+  }
+  nsIDOMFile* IndexedGetter(uint32_t aIndex, bool& aFound)
+  {
+    aFound = aIndex < static_cast<uint32_t>(mFiles.Count());
+    return aFound ? mFiles.ObjectAt(aIndex) : nullptr;
+  }
+  uint32_t Length()
+  {
+    return mFiles.Count();
+  }
+
 private:
   nsCOMArray<nsIDOMFile> mFiles;
   nsISupports *mParent;
 };
 
 class NS_STACK_CLASS nsDOMFileInternalUrlHolder {
 public:
   nsDOMFileInternalUrlHolder(nsIDOMBlob* aFile, nsIPrincipal* aPrincipal
--- a/content/base/public/nsINodeList.h
+++ b/content/base/public/nsINodeList.h
@@ -31,16 +31,35 @@ public:
    * is not in the list.
    */
   virtual int32_t IndexOf(nsIContent* aContent) = 0;
 
   /**
    * Get the root node for this nodelist.
    */
   virtual nsINode* GetParentObject() = 0;
+
+  using nsIDOMNodeList::Item;
+
+  uint32_t Length()
+  {
+    uint32_t length;
+    GetLength(&length);
+    return length;
+  }
+  nsIContent* Item(uint32_t aIndex)
+  {
+    return GetNodeAt(aIndex);
+  }
+  nsIContent* IndexedGetter(uint32_t aIndex, bool& aFound)
+  {
+    nsIContent* item = Item(aIndex);
+    aFound = !!item;
+    return item;
+  }
 };
 
 #define NS_NODELIST_OFFSET_AND_INTERFACE_TABLE_BEGIN(_class)                  \
   NS_OFFSET_AND_INTERFACE_TABLE_BEGIN_AMBIGUOUS(_class, nsINodeList)
 
 NS_DEFINE_STATIC_IID_ACCESSOR(nsINodeList, NS_INODELIST_IID)
 
 #endif /* nsINodeList_h___ */
--- a/content/base/src/Makefile.in
+++ b/content/base/src/Makefile.in
@@ -132,16 +132,17 @@ CPPSRCS		= \
 		nsBlobProtocolHandler.cpp \
 		nsBlobURI.cpp \
 		nsFrameMessageManager.cpp \
 		nsInProcessTabChildGlobal.cpp \
 		ThirdPartyUtil.cpp \
 		nsEventSource.cpp \
 		FileIOObject.cpp \
 		nsDOMMutationObserver.cpp \
+		nsMixedContentBlocker.cpp \
 		$(NULL)
 
 # Are we targeting x86-32 or x86-64?  If so, we want to include SSE2 code for
 # nsTextFragment.cpp
 ifneq (,$(INTEL_ARCHITECTURE))
 CPPSRCS += nsTextFragmentSSE2.cpp
 endif
 
--- a/content/base/src/nsContentList.cpp
+++ b/content/base/src/nsContentList.cpp
@@ -16,16 +16,17 @@
 #include "nsIDocument.h"
 #include "nsGenericElement.h"
 #include "nsWrapperCacheInlines.h"
 #include "nsContentUtils.h"
 #include "nsCCUncollectableMarker.h"
 #include "nsGkAtoms.h"
 
 #include "dombindings.h"
+#include "mozilla/dom/BindingUtils.h"
 
 // Form related includes
 #include "nsIDOMHTMLFormElement.h"
 
 #include "pldhash.h"
 
 #ifdef DEBUG_CONTENT_LIST
 #include "nsIContentIterator.h"
@@ -280,16 +281,38 @@ NS_GetContentList(nsINode* aRootNode,
     }
   }
 
   NS_ADDREF(list);
 
   return list;
 }
 
+#ifdef DEBUG
+const nsCacheableFuncStringContentList::ContentListType
+  nsCacheableFuncStringNodeList::sType = nsCacheableFuncStringContentList::eNodeList;
+const nsCacheableFuncStringContentList::ContentListType
+  nsCacheableFuncStringHTMLCollection::sType = nsCacheableFuncStringContentList::eHTMLCollection;
+#endif
+
+JSObject*
+nsCacheableFuncStringNodeList::WrapObject(JSContext *cx, JSObject *scope,
+                                          bool *triedToWrap)
+{
+  return oldproxybindings::NodeList::create(cx, scope, this, triedToWrap);
+}
+
+
+JSObject*
+nsCacheableFuncStringHTMLCollection::WrapObject(JSContext *cx, JSObject *scope,
+                                                bool *triedToWrap)
+{
+  return oldproxybindings::HTMLCollection::create(cx, scope, this, triedToWrap);
+}
+
 // Hashtable for storing nsCacheableFuncStringContentList
 static PLDHashTable gFuncStringContentListHashTable;
 
 struct FuncStringContentListHashEntry : public PLDHashEntryHdr
 {
   nsCacheableFuncStringContentList* mContentList;
 };
 
@@ -309,22 +332,23 @@ FuncStringContentListHashtableMatchEntry
   const FuncStringContentListHashEntry *e =
     static_cast<const FuncStringContentListHashEntry *>(entry);
   const nsFuncStringCacheKey* ourKey =
     static_cast<const nsFuncStringCacheKey *>(key);
 
   return e->mContentList->Equals(ourKey);
 }
 
+template<class ListType>
 already_AddRefed<nsContentList>
-NS_GetFuncStringContentList(nsINode* aRootNode,
-                            nsContentListMatchFunc aFunc,
-                            nsContentListDestroyFunc aDestroyFunc,
-                            nsFuncStringContentListDataAllocator aDataAllocator,
-                            const nsAString& aString)
+GetFuncStringContentList(nsINode* aRootNode,
+                         nsContentListMatchFunc aFunc,
+                         nsContentListDestroyFunc aDestroyFunc,
+                         nsFuncStringContentListDataAllocator aDataAllocator,
+                         const nsAString& aString)
 {
   NS_ASSERTION(aRootNode, "content list has to have a root");
 
   nsCacheableFuncStringContentList* list = nullptr;
 
   static PLDHashTableOps hash_table_ops =
   {
     PL_DHashAllocTable,
@@ -354,25 +378,29 @@ NS_GetFuncStringContentList(nsINode* aRo
     nsFuncStringCacheKey hashKey(aRootNode, aFunc, aString);
 
     // A PL_DHASH_ADD is equivalent to a PL_DHASH_LOOKUP for cases
     // when the entry is already in the hashtable.
     entry = static_cast<FuncStringContentListHashEntry *>
                        (PL_DHashTableOperate(&gFuncStringContentListHashTable,
                                              &hashKey,
                                              PL_DHASH_ADD));
-    if (entry)
+    if (entry) {
       list = entry->mContentList;
+#ifdef DEBUG
+      MOZ_ASSERT_IF(list, list->mType == ListType::sType);
+#endif
+    }
   }
 
   if (!list) {
     // We need to create a ContentList and add it to our new entry, if
     // we have an entry
-    list = new nsCacheableFuncStringContentList(aRootNode, aFunc, aDestroyFunc,
-                                                aDataAllocator, aString);
+    list = new ListType(aRootNode, aFunc, aDestroyFunc, aDataAllocator,
+                        aString);
     if (list && !list->AllocatedData()) {
       // Failed to allocate the data
       delete list;
       list = nullptr;
     }
 
     if (entry) {
       if (list)
@@ -386,16 +414,44 @@ NS_GetFuncStringContentList(nsINode* aRo
 
   NS_ADDREF(list);
 
   // Don't cache these lists globally
 
   return list;
 }
 
+already_AddRefed<nsContentList>
+NS_GetFuncStringNodeList(nsINode* aRootNode,
+                         nsContentListMatchFunc aFunc,
+                         nsContentListDestroyFunc aDestroyFunc,
+                         nsFuncStringContentListDataAllocator aDataAllocator,
+                         const nsAString& aString)
+{
+  return GetFuncStringContentList<nsCacheableFuncStringNodeList>(aRootNode,
+                                                                 aFunc,
+                                                                 aDestroyFunc,
+                                                                 aDataAllocator,
+                                                                 aString);
+}
+
+already_AddRefed<nsContentList>
+NS_GetFuncStringHTMLCollection(nsINode* aRootNode,
+                               nsContentListMatchFunc aFunc,
+                               nsContentListDestroyFunc aDestroyFunc,
+                               nsFuncStringContentListDataAllocator aDataAllocator,
+                               const nsAString& aString)
+{
+  return GetFuncStringContentList<nsCacheableFuncStringHTMLCollection>(aRootNode,
+                                                                       aFunc,
+                                                                       aDestroyFunc,
+                                                                       aDataAllocator,
+                                                                       aString);
+}
+
 // nsContentList implementation
 
 nsContentList::nsContentList(nsINode* aRootNode,
                              int32_t aMatchNameSpaceId,
                              nsIAtom* aHTMLMatchAtom,
                              nsIAtom* aXMLMatchAtom,
                              bool aDeep)
   : nsBaseContentList(),
@@ -614,30 +670,54 @@ nsContentList::NamedItem(const nsAString
     return CallQueryInterface(content, aReturn);
   }
 
   *aReturn = nullptr;
 
   return NS_OK;
 }
 
+nsGenericElement*
+nsContentList::GetElementAt(uint32_t aIndex)
+{
+  return static_cast<nsGenericElement*>(Item(aIndex, true));
+}
+
 nsIContent*
 nsContentList::GetNodeAt(uint32_t aIndex)
 {
-  return Item(aIndex, true);
+  return GetElementAt(aIndex);
 }
 
 nsISupports*
 nsContentList::GetNamedItem(const nsAString& aName, nsWrapperCache **aCache)
 {
   nsIContent *item;
   *aCache = item = NamedItem(aName, true);
   return item;
 }
 
+JSObject*
+nsContentList::NamedItem(JSContext* cx, const nsAString& name,
+                         mozilla::ErrorResult& error)
+{
+  nsIContent *item = NamedItem(name, true);
+  if (!item) {
+    return nullptr;
+  }
+  JSObject* wrapper = GetWrapper();
+  JSAutoCompartment ac(cx, wrapper);
+  JS::Value v;
+  if (!mozilla::dom::WrapObject(cx, wrapper, item, item, nullptr, &v)) {
+    error.Throw(NS_ERROR_FAILURE);
+    return nullptr;
+  }
+  return &v.toObject();
+}
+
 void
 nsContentList::AttributeChanged(nsIDocument *aDocument, Element* aElement,
                                 int32_t aNameSpaceID, nsIAtom* aAttribute,
                                 int32_t aModType)
 {
   NS_PRECONDITION(aElement, "Must have a content node to work with");
   
   if (!mFunc || !mFuncMayDependOnAttr || mState == LIST_DIRTY ||
--- a/content/base/src/nsContentList.h
+++ b/content/base/src/nsContentList.h
@@ -268,16 +268,20 @@ public:
   // nsBaseContentList overrides
   virtual int32_t IndexOf(nsIContent *aContent, bool aDoFlush);
   virtual int32_t IndexOf(nsIContent* aContent);
   virtual nsINode* GetParentObject()
   {
     return mRootNode;
   }
 
+  virtual nsIContent* GetNodeAt(uint32_t aIndex);
+  virtual JSObject* NamedItem(JSContext* cx, const nsAString& name,
+                              mozilla::ErrorResult& error);
+
   // nsContentList public methods
   NS_HIDDEN_(uint32_t) Length(bool aDoFlush);
   NS_HIDDEN_(nsIContent*) Item(uint32_t aIndex, bool aDoFlush);
   NS_HIDDEN_(nsIContent*) NamedItem(const nsAString& aName, bool aDoFlush);
 
   // nsIMutationObserver
   NS_DECL_NSIMUTATIONOBSERVER_ATTRIBUTECHANGED
   NS_DECL_NSIMUTATIONOBSERVER_CONTENTAPPENDED
@@ -472,53 +476,118 @@ private:
  * that case the destructor function should be a no-op.
  */
 typedef void* (*nsFuncStringContentListDataAllocator)(nsINode* aRootNode,
                                                       const nsString* aString);
 
 // aDestroyFunc is allowed to be null
 class nsCacheableFuncStringContentList : public nsContentList {
 public:
+  virtual ~nsCacheableFuncStringContentList();
+
+  bool Equals(const nsFuncStringCacheKey* aKey) {
+    return mRootNode == aKey->mRootNode && mFunc == aKey->mFunc &&
+      mString == aKey->mString;
+  }
+
+  bool AllocatedData() const { return !!mData; }
+
+#ifdef DEBUG
+  enum ContentListType {
+    eNodeList,
+    eHTMLCollection
+  };
+  ContentListType mType;
+#endif
+
+protected:
   nsCacheableFuncStringContentList(nsINode* aRootNode,
                                    nsContentListMatchFunc aFunc,
                                    nsContentListDestroyFunc aDestroyFunc,
                                    nsFuncStringContentListDataAllocator aDataAllocator,
                                    const nsAString& aString) :
     nsContentList(aRootNode, aFunc, aDestroyFunc, nullptr),
     mString(aString)
   {
     mData = (*aDataAllocator)(aRootNode, &mString);
   }
 
-  virtual ~nsCacheableFuncStringContentList();
-
-  bool Equals(const nsFuncStringCacheKey* aKey) {
-    return mRootNode == aKey->mRootNode && mFunc == aKey->mFunc &&
-      mString == aKey->mString;
-  }
-
-  bool AllocatedData() const { return !!mData; }
-protected:
   virtual void RemoveFromCaches() {
     RemoveFromFuncStringHashtable();
   }
   void RemoveFromFuncStringHashtable();
 
   nsString mString;
 };
 
+class nsCacheableFuncStringNodeList
+  : public nsCacheableFuncStringContentList
+{
+public:
+  nsCacheableFuncStringNodeList(nsINode* aRootNode,
+                                nsContentListMatchFunc aFunc,
+                                nsContentListDestroyFunc aDestroyFunc,
+                                nsFuncStringContentListDataAllocator aDataAllocator,
+                                const nsAString& aString)
+    : nsCacheableFuncStringContentList(aRootNode, aFunc, aDestroyFunc,
+                                       aDataAllocator, aString)
+  {
+#ifdef DEBUG
+    mType = eNodeList;
+#endif
+  }
+
+  virtual JSObject* WrapObject(JSContext *cx, JSObject *scope,
+                               bool *triedToWrap);
+
+#ifdef DEBUG
+  static const ContentListType sType;
+#endif
+};
+
+class nsCacheableFuncStringHTMLCollection
+  : public nsCacheableFuncStringContentList
+{
+public:
+  nsCacheableFuncStringHTMLCollection(nsINode* aRootNode,
+                                      nsContentListMatchFunc aFunc,
+                                      nsContentListDestroyFunc aDestroyFunc,
+                                      nsFuncStringContentListDataAllocator aDataAllocator,
+                                      const nsAString& aString)
+    : nsCacheableFuncStringContentList(aRootNode, aFunc, aDestroyFunc,
+                                       aDataAllocator, aString)
+  {
+#ifdef DEBUG
+    mType = eHTMLCollection;
+#endif
+  }
+
+  virtual JSObject* WrapObject(JSContext *cx, JSObject *scope,
+                               bool *triedToWrap);
+
+#ifdef DEBUG
+  static const ContentListType sType;
+#endif
+};
+
 // If aMatchNameSpaceId is kNameSpaceID_Unknown, this will return a
 // content list which matches ASCIIToLower(aTagname) against HTML
 // elements in HTML documents and aTagname against everything else.
 // For any other value of aMatchNameSpaceId, the list will match
 // aTagname against all elements.
 already_AddRefed<nsContentList>
 NS_GetContentList(nsINode* aRootNode,
                   int32_t aMatchNameSpaceId,
                   const nsAString& aTagname);
 
 already_AddRefed<nsContentList>
-NS_GetFuncStringContentList(nsINode* aRootNode,
-                            nsContentListMatchFunc aFunc,
-                            nsContentListDestroyFunc aDestroyFunc,
-                            nsFuncStringContentListDataAllocator aDataAllocator,
-                            const nsAString& aString);
+NS_GetFuncStringNodeList(nsINode* aRootNode,
+                         nsContentListMatchFunc aFunc,
+                         nsContentListDestroyFunc aDestroyFunc,
+                         nsFuncStringContentListDataAllocator aDataAllocator,
+                         const nsAString& aString);
+already_AddRefed<nsContentList>
+NS_GetFuncStringHTMLCollection(nsINode* aRootNode,
+                               nsContentListMatchFunc aFunc,
+                               nsContentListDestroyFunc aDestroyFunc,
+                               nsFuncStringContentListDataAllocator aDataAllocator,
+                               const nsAString& aString);
 #endif // nsContentList_h___
--- a/content/base/src/nsContentUtils.cpp
+++ b/content/base/src/nsContentUtils.cpp
@@ -6253,20 +6253,20 @@ AllocClassMatchingInfo(nsINode* aRootNod
 nsresult
 nsContentUtils::GetElementsByClassName(nsINode* aRootNode,
                                        const nsAString& aClasses,
                                        nsIDOMNodeList** aReturn)
 {
   NS_PRECONDITION(aRootNode, "Must have root node");
   
   nsContentList* elements =
-    NS_GetFuncStringContentList(aRootNode, MatchClassNames,
-                                DestroyClassNameArray,
-                                AllocClassMatchingInfo,
-                                aClasses).get();
+    NS_GetFuncStringHTMLCollection(aRootNode, MatchClassNames,
+                                   DestroyClassNameArray,
+                                   AllocClassMatchingInfo,
+                                   aClasses).get();
   NS_ENSURE_TRUE(elements, NS_ERROR_OUT_OF_MEMORY);
 
   // Transfer ownership
   *aReturn = elements;
 
   return NS_OK;
 }
 
--- a/content/base/src/nsDOMFile.cpp
+++ b/content/base/src/nsDOMFile.cpp
@@ -677,31 +677,31 @@ nsDOMFileList::WrapObject(JSContext *cx,
                           bool *triedToWrap)
 {
   return mozilla::dom::oldproxybindings::FileList::create(cx, scope, this, triedToWrap);
 }
 
 nsIDOMFile*
 nsDOMFileList::GetItemAt(uint32_t aIndex)
 {
-  return mFiles.SafeObjectAt(aIndex);
+  return Item(aIndex);
 }
 
 NS_IMETHODIMP
 nsDOMFileList::GetLength(uint32_t* aLength)
 {
-  *aLength = mFiles.Count();
+  *aLength = Length();
 
   return NS_OK;
 }
 
 NS_IMETHODIMP
 nsDOMFileList::Item(uint32_t aIndex, nsIDOMFile **aFile)
 {
-  NS_IF_ADDREF(*aFile = nsDOMFileList::GetItemAt(aIndex));
+  NS_IF_ADDREF(*aFile = Item(aIndex));
 
   return NS_OK;
 }
 
 ////////////////////////////////////////////////////////////////////////////
 // nsDOMFileInternalUrlHolder implementation
 
 nsDOMFileInternalUrlHolder::nsDOMFileInternalUrlHolder(nsIDOMBlob* aFile,
--- a/content/base/src/nsDOMTokenList.cpp
+++ b/content/base/src/nsDOMTokenList.cpp
@@ -8,16 +8,17 @@
 
 #include "nsDOMTokenList.h"
 
 #include "nsAttrValue.h"
 #include "nsContentUtils.h"
 #include "nsError.h"
 #include "nsGenericElement.h"
 #include "dombindings.h"
+#include "mozilla/ErrorResult.h"
 
 using namespace mozilla;
 using namespace mozilla::dom;
 
 nsDOMTokenList::nsDOMTokenList(nsGenericElement* aElement, nsIAtom* aAttrAtom)
   : mElement(aElement),
     mAttrAtom(aAttrAtom)
 {
@@ -44,41 +45,52 @@ NS_IMPL_CYCLE_COLLECTING_ADDREF(nsDOMTok
 NS_IMPL_CYCLE_COLLECTING_RELEASE(nsDOMTokenList)
 
 void
 nsDOMTokenList::DropReference()
 {
   mElement = nullptr;
 }
 
-NS_IMETHODIMP
-nsDOMTokenList::GetLength(uint32_t *aLength)
+uint32_t
+nsDOMTokenList::Length()
 {
   const nsAttrValue* attr = GetParsedAttr();
   if (!attr) {
-    *aLength = 0;
-    return NS_OK;
+    return 0;
   }
 
-  *aLength = attr->GetAtomCount();
+  return attr->GetAtomCount();
+}
+
+NS_IMETHODIMP
+nsDOMTokenList::GetLength(uint32_t *aLength)
+{
+  *aLength = Length();
 
   return NS_OK;
 }
 
-NS_IMETHODIMP
-nsDOMTokenList::Item(uint32_t aIndex, nsAString& aResult)
+void
+nsDOMTokenList::IndexedGetter(uint32_t aIndex, bool& aFound, nsAString& aResult)
 {
   const nsAttrValue* attr = GetParsedAttr();
 
-  if (!attr || aIndex >= static_cast<uint32_t>(attr->GetAtomCount())) {
-    SetDOMStringToNull(aResult);
-    return NS_OK;
+  if (attr && aIndex < static_cast<uint32_t>(attr->GetAtomCount())) {
+    aFound = true;
+    attr->AtomAt(aIndex)->ToString(aResult);
+  } else {
+    aFound = false;
   }
-  attr->AtomAt(aIndex)->ToString(aResult);
+}
 
+NS_IMETHODIMP
+nsDOMTokenList::MozItem(uint32_t aIndex, nsAString& aResult)
+{
+  Item(aIndex, aResult);
   return NS_OK;
 }
 
 nsresult
 nsDOMTokenList::CheckToken(const nsAString& aStr)
 {
   if (aStr.IsEmpty()) {
     return NS_ERROR_DOM_SYNTAX_ERR;
@@ -92,31 +104,34 @@ nsDOMTokenList::CheckToken(const nsAStri
     if (nsContentUtils::IsHTMLWhitespace(*iter))
       return NS_ERROR_DOM_INVALID_CHARACTER_ERR;
     ++iter;
   }
 
   return NS_OK;
 }
 
+bool
+nsDOMTokenList::Contains(const nsAString& aToken, ErrorResult& aError)
+{
+  aError = CheckToken(aToken);
+  if (aError.Failed()) {
+    return false;
+  }
+
+  const nsAttrValue* attr = GetParsedAttr();
+  return attr && attr->Contains(aToken);
+}
+
 NS_IMETHODIMP
 nsDOMTokenList::Contains(const nsAString& aToken, bool* aResult)
 {
-  nsresult rv = CheckToken(aToken);
-  NS_ENSURE_SUCCESS(rv, rv);
-
-  const nsAttrValue* attr = GetParsedAttr();
-  if (!attr) {
-    *aResult = false;
-    return NS_OK;
-  }
-
-  *aResult = attr->Contains(aToken);
-
-  return NS_OK;
+  ErrorResult rv;
+  *aResult = Contains(aToken, rv);
+  return rv.ErrorCode();
 }
 
 void
 nsDOMTokenList::AddInternal(const nsAttrValue* aAttr,
                             const nsAString& aToken)
 {
   if (!mElement) {
     return;
@@ -133,31 +148,39 @@ nsDOMTokenList::AddInternal(const nsAttr
           resultStr.CharAt(resultStr.Length() - 1))) {
     resultStr.Append(NS_LITERAL_STRING(" ") + aToken);
   } else {
     resultStr.Append(aToken);
   }
   mElement->SetAttr(kNameSpaceID_None, mAttrAtom, resultStr, true);
 }
 
-NS_IMETHODIMP
-nsDOMTokenList::Add(const nsAString& aToken)
+void
+nsDOMTokenList::Add(const nsAString& aToken, ErrorResult& aError)
 {
-  nsresult rv = CheckToken(aToken);
-  NS_ENSURE_SUCCESS(rv, rv);
+  aError = CheckToken(aToken);
+  if (aError.Failed()) {
+    return;
+  }
 
   const nsAttrValue* attr = GetParsedAttr();
 
   if (attr && attr->Contains(aToken)) {
-    return NS_OK;
+    return;
   }
 
   AddInternal(attr, aToken);
+}
 
-  return NS_OK;
+NS_IMETHODIMP
+nsDOMTokenList::Add(const nsAString& aToken)
+{
+  ErrorResult rv;
+  Add(aToken, rv);
+  return rv.ErrorCode();
 }
 
 void
 nsDOMTokenList::RemoveInternal(const nsAttrValue* aAttr,
                                const nsAString& aToken)
 {
   NS_ABORT_IF_FALSE(aAttr, "Need an attribute");
 
@@ -212,65 +235,82 @@ nsDOMTokenList::RemoveInternal(const nsA
       output.Append(Substring(copyStart, iter));
       copyStart = iter;
     }
   }
 
   mElement->SetAttr(kNameSpaceID_None, mAttrAtom, output, true);
 }
 
+void
+nsDOMTokenList::Remove(const nsAString& aToken, ErrorResult& aError)
+{
+  aError = CheckToken(aToken);
+  if (aError.Failed()) {
+    return;
+  }
+
+  const nsAttrValue* attr = GetParsedAttr();
+  if (!attr || !attr->Contains(aToken)) {
+    return;
+  }
+
+  RemoveInternal(attr, aToken);
+}
+
 NS_IMETHODIMP
 nsDOMTokenList::Remove(const nsAString& aToken)
 {
-  nsresult rv = CheckToken(aToken);
-  NS_ENSURE_SUCCESS(rv, rv);
+  ErrorResult rv;
+  Remove(aToken, rv);
+  return rv.ErrorCode();
+}
 
-  const nsAttrValue* attr = GetParsedAttr();
-  if (!attr) {
-    return NS_OK;
+bool
+nsDOMTokenList::Toggle(const nsAString& aToken, ErrorResult& aError)
+{
+  aError = CheckToken(aToken);
+  if (aError.Failed()) {
+    return false;
   }
 
-  if (!attr->Contains(aToken)) {
-    return NS_OK;
+  const nsAttrValue* attr = GetParsedAttr();
+
+  if (attr && attr->Contains(aToken)) {
+    RemoveInternal(attr, aToken);
+    return false;
   }
 
-  RemoveInternal(attr, aToken);
-
-  return NS_OK;
+  AddInternal(attr, aToken);
+  return true;
 }
 
 NS_IMETHODIMP
 nsDOMTokenList::Toggle(const nsAString& aToken, bool* aResult)
 {
-  nsresult rv = CheckToken(aToken);
-  NS_ENSURE_SUCCESS(rv, rv);
-
-  const nsAttrValue* attr = GetParsedAttr();
+  ErrorResult rv;
+  *aResult = Toggle(aToken, rv);
+  return rv.ErrorCode();
+}
 
-  if (attr && attr->Contains(aToken)) {
-    RemoveInternal(attr, aToken);
-    *aResult = false;
-  } else {
-    AddInternal(attr, aToken);
-    *aResult = true;
+void
+nsDOMTokenList::Stringify(nsAString& aResult)
+{
+  if (!mElement) {
+    aResult.Truncate();
+    return;
   }
 
-  return NS_OK;
+  mElement->GetAttr(kNameSpaceID_None, mAttrAtom, aResult);
 }
 
 NS_IMETHODIMP
 nsDOMTokenList::ToString(nsAString& aResult)
 {
-  if (!mElement) {
-    aResult.Truncate();
-    return NS_OK;
-  }
-
-  mElement->GetAttr(kNameSpaceID_None, mAttrAtom, aResult);
-
+  Stringify(aResult);
   return NS_OK;
 }
 
 JSObject*
 nsDOMTokenList::WrapObject(JSContext *cx, JSObject *scope, bool *triedToWrap)
 {
   return mozilla::dom::oldproxybindings::DOMTokenList::create(cx, scope, this,
                                                      triedToWrap);
--- a/content/base/src/nsDOMTokenList.h
+++ b/content/base/src/nsDOMTokenList.h
@@ -7,16 +7,19 @@
  */
 
 #ifndef nsDOMTokenList_h___
 #define nsDOMTokenList_h___
 
 #include "nsGenericElement.h"
 #include "nsIDOMDOMTokenList.h"
 
+namespace mozilla {
+class ErrorResult;
+}
 class nsAttrValue;
 
 // nsISupports must be on the primary inheritance chain 
 // because nsDOMSettableTokenList is traversed by nsGenericElement.
 class nsDOMTokenList : public nsIDOMDOMTokenList,
                        public nsWrapperCache
 {
 public:
@@ -38,16 +41,32 @@ public:
 
   const nsAttrValue* GetParsedAttr() {
     if (!mElement) {
       return nullptr;
     }
     return mElement->GetAttrInfo(kNameSpaceID_None, mAttrAtom).mValue;
   }
 
+  uint32_t Length();
+  void Item(uint32_t aIndex, nsAString& aResult)
+  {
+    bool found;
+    IndexedGetter(aIndex, found, aResult);
+    if (!found) {
+      SetDOMStringToNull(aResult);
+    }
+  }
+  void IndexedGetter(uint32_t aIndex, bool& aFound, nsAString& aResult);
+  bool Contains(const nsAString& aToken, mozilla::ErrorResult& aError);
+  void Add(const nsAString& aToken, mozilla::ErrorResult& aError);
+  void Remove(const nsAString& aToken, mozilla::ErrorResult& aError);
+  bool Toggle(const nsAString& aToken, mozilla::ErrorResult& aError);
+  void Stringify(nsAString& aResult);
+
 protected:
   virtual ~nsDOMTokenList();
 
   nsresult CheckToken(const nsAString& aStr);
   void AddInternal(const nsAttrValue* aAttr, const nsAString& aToken);
   void RemoveInternal(const nsAttrValue* aAttr, const nsAString& aToken);
 
   nsGenericElement* mElement;
--- a/content/base/src/nsGenericElement.h
+++ b/content/base/src/nsGenericElement.h
@@ -25,23 +25,23 @@
 #include "nsDOMAttributeMap.h"
 #include "nsIWeakReference.h"
 #include "nsCycleCollectionParticipant.h"
 #include "nsIDocument.h"
 #include "nsIDOMNodeSelector.h"
 #include "nsIDOMXPathNSResolver.h"
 #include "nsPresContext.h"
 #include "nsIDOMDOMStringMap.h"
-#include "nsContentList.h"
 #include "nsDOMClassInfoID.h" // DOMCI_DATA
 #include "nsIDOMTouchEvent.h"
 #include "nsIInlineEventHandlers.h"
 #include "mozilla/CORSMode.h"
 #include "mozilla/Attributes.h"
 #include "nsContentUtils.h"
+#include "nsINodeList.h"
 #include "nsISMILAttr.h"
 
 class nsIDOMAttr;
 class nsIDOMEventListener;
 class nsIFrame;
 class nsIDOMNamedNodeMap;
 class nsICSSDeclaration;
 class nsIDOMCSSStyleDeclaration;
--- a/content/base/src/nsGkAtomList.h
+++ b/content/base/src/nsGkAtomList.h
@@ -655,16 +655,17 @@ GK_ATOM(oncompositionupdate, "oncomposit
 GK_ATOM(onconnected, "onconnected")
 GK_ATOM(onconnecting, "onconnecting")
 GK_ATOM(oncontextmenu, "oncontextmenu")
 GK_ATOM(oncopy, "oncopy")
 GK_ATOM(oncut, "oncut")
 GK_ATOM(ondatachange, "ondatachange")
 GK_ATOM(ondblclick, "ondblclick")
 GK_ATOM(ondelivered, "ondelivered")
+GK_ATOM(ondevicecreated, "ondevicecreated")
 GK_ATOM(ondevicedisappeared, "ondevicedisappeared")
 GK_ATOM(ondevicefound, "ondevicefound")
 GK_ATOM(ondialing, "ondialing")
 GK_ATOM(ondisabled, "ondisabled")
 GK_ATOM(ondischargingtimechange, "ondischargingtimechange")
 GK_ATOM(ondisconnected, "ondisconnected")
 GK_ATOM(ondisconnecting, "ondisconnecting")
 GK_ATOM(ondownloading, "ondownloading")
new file mode 100644
--- /dev/null
+++ b/content/base/src/nsMixedContentBlocker.cpp
@@ -0,0 +1,201 @@
+/* -*- Mode: C++; tab-width: 2; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+#include "nsMixedContentBlocker.h"
+#include "nsContentPolicyUtils.h"
+
+#include "nsINode.h"
+#include "nsCOMPtr.h"
+#include "nsIDocShell.h"
+#include "nsISecurityEventSink.h"
+#include "nsIWebProgressListener.h"
+#include "nsContentUtils.h"
+#include "mozilla/Preferences.h"
+
+using namespace mozilla;
+
+// Is mixed script blocking (fonts, plugin content, scripts, stylesheets,
+// iframes, websockets, XHR) enabled?
+bool nsMixedContentBlocker::sBlockMixedScript = false;
+
+// Is mixed display content blocking (images, audio, video, <a ping>) enabled?
+bool nsMixedContentBlocker::sBlockMixedDisplay = false;
+
+// Fired at the document that attempted to load mixed content.  The UI could
+// handle this event, for example, by displaying an info bar that offers the
+// choice to reload the page with mixed content permitted.
+//
+// Disabled for now until bug 782654 is fixed
+/*
+class nsMixedContentBlockedEvent : public nsRunnable
+{
+public:
+  nsMixedContentBlockedEvent(nsISupports *aContext, unsigned short aType)
+    : mContext(aContext), mType(aType)
+  {}
+
+  NS_IMETHOD Run()
+  {
+    NS_ASSERTION(mContext,
+                 "You can't call this runnable without a requesting context");
+
+    // To update the security UI in the tab with the blocked mixed content, call
+    // nsISecurityEventSink::OnSecurityChange.  You can get to the event sink by
+    // calling NS_CP_GetDocShellFromContext on the context, and QI'ing to
+    // nsISecurityEventSink.
+
+    return NS_OK;
+  }
+private:
+  // The requesting context for the content load. Generally, a DOM node from
+  // the document that caused the load.
+  nsCOMPtr<nsISupports> mContext;
+
+  // The type of mixed content that was blocked, i.e. active or display
+  unsigned short mType;
+};
+*/
+
+nsMixedContentBlocker::nsMixedContentBlocker()
+{
+  // Cache the pref for mixed script blocking
+  Preferences::AddBoolVarCache(&sBlockMixedScript,
+                               "security.mixed_content.block_active_content");
+
+  // Cache the pref for mixed display blocking
+  Preferences::AddBoolVarCache(&sBlockMixedDisplay,
+                               "security.mixed_content.block_display_content");
+}
+
+nsMixedContentBlocker::~nsMixedContentBlocker()
+{
+}
+
+NS_IMPL_ISUPPORTS1(nsMixedContentBlocker, nsIContentPolicy)
+
+NS_IMETHODIMP
+nsMixedContentBlocker::ShouldLoad(PRUint32 aContentType,
+                                  nsIURI* aContentLocation,
+                                  nsIURI* aRequestingLocation,
+                                  nsISupports* aRequestingContext,
+                                  const nsACString& aMimeGuess,
+                                  nsISupports* aExtra,
+                                  nsIPrincipal* aRequestPrincipal,
+                                  PRInt16* aDecision)
+{
+  // Default policy: allow the load if we find no reason to block it.
+  *aDecision = nsIContentPolicy::ACCEPT;
+
+  // If mixed script blocking and mixed display blocking are turned off
+  // we can return early
+  if (!sBlockMixedScript && !sBlockMixedDisplay) {
+    return NS_OK;
+  }
+
+  // Top-level load cannot be mixed content so allow it
+  if (aContentType == nsIContentPolicy::TYPE_DOCUMENT) {
+    return NS_OK;
+  }
+
+  // We need aRequestingLocation to pull out the scheme. If it isn't passed
+  // in, get it from the DOM node.
+  if (!aRequestingLocation) {
+    nsCOMPtr<nsINode> node = do_QueryInterface(aRequestingContext);
+    if (node) {
+      nsCOMPtr<nsIURI> principalUri;
+      node->NodePrincipal()->GetURI(getter_AddRefs(principalUri));
+      aRequestingLocation = principalUri;
+    }
+    // If we still don't have a requesting location then we can't tell if
+    // this is a mixed content load.  Deny to be safe.
+    if (!aRequestingLocation) {
+      *aDecision = nsIContentPolicy::REJECT_REQUEST;
+      return NS_OK;
+    }
+  }
+
+  // Check the parent scheme. If it is not an HTTPS page then mixed content
+  // restrictions do not apply.
+  bool parentIsHttps;
+  if (NS_FAILED(aRequestingLocation->SchemeIs("https", &parentIsHttps)) ||
+      !parentIsHttps) {
+    return NS_OK;
+  }
+
+  // Get the scheme of the sub-document resource to be requested. If it is
+  // an HTTPS load then mixed content doesn't apply.
+  bool isHttps;
+  if (NS_FAILED(aContentLocation->SchemeIs("https", &isHttps)) || isHttps) {
+    return NS_OK;
+  }
+
+  // If we are here we have mixed content.
+
+  // Decide whether or not to allow the mixed content based on what type of
+  // content it is and if the user permitted it.
+  switch (aContentType) {
+    case nsIContentPolicy::TYPE_FONT:
+    case nsIContentPolicy::TYPE_OBJECT:
+    case nsIContentPolicy::TYPE_SCRIPT:
+    case nsIContentPolicy::TYPE_STYLESHEET:
+    case nsIContentPolicy::TYPE_SUBDOCUMENT:
+    case nsIContentPolicy::TYPE_WEBSOCKET:
+    case nsIContentPolicy::TYPE_XMLHTTPREQUEST:
+      // fonts, plugin content, scripts, stylesheets, iframes, websockets and
+      // XHRs are considered high risk for mixed content so these are blocked
+      // per the mixed script preference
+      if (sBlockMixedScript) {
+        *aDecision = nsIContentPolicy::REJECT_REQUEST;
+
+        // Fire the event from a script runner as it is unsafe to run script
+        // from within ShouldLoad
+        // Disabled until bug 782654 is fixed.
+        /*
+        nsContentUtils::AddScriptRunner(
+          new nsMixedContentBlockedEvent(aRequestingContext, eBlockedMixedScript));
+        */
+      }
+      break;
+
+    case nsIContentPolicy::TYPE_IMAGE:
+    case nsIContentPolicy::TYPE_MEDIA:
+    case nsIContentPolicy::TYPE_PING:
+      // display (static) content are considered moderate risk for mixed content
+      // so these will be blocked according to the mixed display preference
+      if (sBlockMixedDisplay) {
+        *aDecision = nsIContentPolicy::REJECT_REQUEST;
+
+        // Fire the event from a script runner as it is unsafe to run script
+        // from within ShouldLoad
+        // Disabled until bug 782654 is fixed.
+        /*
+        nsContentUtils::AddScriptRunner(
+          new nsMixedContentBlockedEvent(aRequestingContext, eBlockedMixedDisplay));
+        */
+      }
+      break;
+
+    default:
+      // other types of mixed content are allowed
+      break;
+  }
+
+  return NS_OK;
+}
+
+NS_IMETHODIMP
+nsMixedContentBlocker::ShouldProcess(PRUint32 aContentType,
+                                     nsIURI* aContentLocation,
+                                     nsIURI* aRequestingLocation,
+                                     nsISupports* aRequestingContext,
+                                     const nsACString& aMimeGuess,
+                                     nsISupports* aExtra,
+                                     nsIPrincipal* aRequestPrincipal,
+                                     PRInt16* aDecision)
+{
+  return ShouldLoad(aContentType, aContentLocation, aRequestingLocation,
+                    aRequestingContext, aMimeGuess, aExtra, aRequestPrincipal,
+                    aDecision);
+}
new file mode 100644
--- /dev/null
+++ b/content/base/src/nsMixedContentBlocker.h
@@ -0,0 +1,39 @@
+/* -*- Mode: C++; tab-width: 2; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+#ifndef nsMixedContentBlocker_h___
+#define nsMixedContentBlocker_h___
+
+#define NS_MIXEDCONTENTBLOCKER_CONTRACTID "@mozilla.org/mixedcontentblocker;1"
+/* daf1461b-bf29-4f88-8d0e-4bcdf332c862 */
+#define NS_MIXEDCONTENTBLOCKER_CID \
+{ 0xdaf1461b, 0xbf29, 0x4f88, \
+  { 0x8d, 0x0e, 0x4b, 0xcd, 0xf3, 0x32, 0xc8, 0x62 } }
+
+// This enum defines type of content that is blocked when an
+// nsMixedContentBlockedEvent fires
+enum MixedContentBlockedTypes {
+  // "Active" content, such as fonts, plugin content, JavaScript, stylesheets,
+  // iframes, WebSockets, and XHR
+  eBlockedMixedScript,
+  // "Display" content, such as images, audio, video, and <a ping>
+  eBlockedMixedDisplay
+};
+
+#include "nsIContentPolicy.h"
+
+class nsMixedContentBlocker : public nsIContentPolicy
+{
+public:
+  NS_DECL_ISUPPORTS
+  NS_DECL_NSICONTENTPOLICY
+
+  nsMixedContentBlocker();
+  virtual ~nsMixedContentBlocker();
+  static bool sBlockMixedScript;
+  static bool sBlockMixedDisplay;
+};
+
+#endif /* nsMixedContentBlocker_h___ */
--- a/content/base/src/nsTextNode.cpp
+++ b/content/base/src/nsTextNode.cpp
@@ -8,16 +8,17 @@
  */
 
 #include "nsTextNode.h"
 #include "nsContentUtils.h"
 #include "nsIDOMEventListener.h"
 #include "nsIDOMMutationEvent.h"
 #include "nsIDocument.h"
 #include "nsThreadUtils.h"
+#include "nsStubMutationObserver.h"
 #ifdef DEBUG
 #include "nsRange.h"
 #endif
 
 using namespace mozilla::dom;
 
 /**
  * class used to implement attr() generated content
--- a/content/base/src/nsXMLHttpRequest.cpp
+++ b/content/base/src/nsXMLHttpRequest.cpp
@@ -452,16 +452,20 @@ nsXMLHttpRequest::InitParameters(JSConte
 
   InitParameters(params.mozAnon, params.mozSystem);
   return NS_OK;
 }
 
 void
 nsXMLHttpRequest::InitParameters(bool aAnon, bool aSystem)
 {
+  if (!aAnon && !aSystem) {
+    return;
+  }
+
   // Check for permissions.
   nsCOMPtr<nsPIDOMWindow> window = do_QueryInterface(GetOwner());
   if (!window || !window->GetDocShell()) {
     return;
   }
 
   // Chrome is always allowed access, so do the permission check only
   // for non-chrome pages.
@@ -480,18 +484,17 @@ nsXMLHttpRequest::InitParameters(bool aA
     uint32_t permission;
     nsresult rv =
       permMgr->TestPermissionFromPrincipal(principal, "systemXHR", &permission);
     if (NS_FAILED(rv) || permission != nsIPermissionManager::ALLOW_ACTION) {
       return;
     }
   }
 
-  mIsAnon = aAnon;
-  mIsSystem = aSystem;
+  SetParameters(aAnon, aSystem);
 }
 
 void
 nsXMLHttpRequest::ResetResponse()
 {
   mResponseXML = nullptr;
   mResponseBody.Truncate();
   mResponseText.Truncate();
@@ -3148,17 +3151,19 @@ nsXMLHttpRequest::SetRequestHeader(const
         if (header.LowerCaseEqualsASCII(kCrossOriginSafeHeaders[i])) {
           safeHeader = true;
           break;
         }
       }
     }
 
     if (!safeHeader) {
-      mCORSUnsafeHeaders.AppendElement(header);
+      if (!mCORSUnsafeHeaders.Contains(header)) {
+        mCORSUnsafeHeaders.AppendElement(header);
+      }
     }
   }
 
   // We need to set, not add to, the header.
   nsresult rv = httpChannel->SetRequestHeader(header, value, false);
   if (rv == NS_ERROR_INVALID_ARG) {
     return NS_ERROR_DOM_SYNTAX_ERR;
   }
--- a/content/base/src/nsXMLHttpRequest.h
+++ b/content/base/src/nsXMLHttpRequest.h
@@ -198,16 +198,22 @@ public:
     BindToOwner(aOwnerWindow);
     mBaseURI = aBaseURI;
   }
 
   // Initialize XMLHttpRequestParameter object.
   nsresult InitParameters(JSContext* aCx, const jsval* aParams);
   void InitParameters(bool aAnon, bool aSystem);
 
+  void SetParameters(bool aAnon, bool aSystem)
+  {
+    mIsAnon = aAnon;
+    mIsSystem = aSystem;
+  }
+
   NS_DECL_ISUPPORTS_INHERITED
 
   // nsIXMLHttpRequest
   NS_DECL_NSIXMLHTTPREQUEST
 
   NS_FORWARD_NSIXMLHTTPREQUESTEVENTTARGET(nsXHREventTarget::)
 
   // nsIStreamListener
--- a/content/base/test/Makefile.in
+++ b/content/base/test/Makefile.in
@@ -552,16 +552,19 @@ MOCHITEST_FILES_B = \
 		test_bug753278.html \
 		test_bug761120.html \
 		test_XHR_onuploadprogress.html \
 		test_XHR_anon.html \
 		file_XHR_anon.sjs \
 		test_XHR_system.html \
 		test_XHR_parameters.html \
 		test_ipc_messagemanager_blob.html \
+		test_mixed_content_blocker.html \
+		file_mixed_content_main.html \
+		file_mixed_content_server.sjs \
 		$(NULL)
 
 MOCHITEST_CHROME_FILES =	\
 		test_bug357450.js \
 		$(NULL)
 
 MOCHITEST_FILES_PARTS = $(foreach s,A B,MOCHITEST_FILES_$(s))
 
new file mode 100644
--- /dev/null
+++ b/content/base/test/file_mixed_content_main.html
@@ -0,0 +1,209 @@
+<!DOCTYPE HTML>
+<html>
+<!--
+Tests for Mixed Content Blocker
+https://bugzilla.mozilla.org/show_bug.cgi?id=62178
+-->
+<head>
+  <meta charset="utf-8">
+  <title>Tests for Bug 62178</title>
+  <script type="application/javascript" src="/tests/SimpleTest/EventUtils.js"></script>
+</head>
+<body>
+<div id="testContent"></div>
+
+<!-- types the Mixed Content Blocker can block
+     /*
+  switch (aContentType) {
+  case nsIContentPolicy::TYPE_OBJECT:
+  case nsIContentPolicy::TYPE_SCRIPT:
+  case nsIContentPolicy::TYPE_STYLESHEET:
+  case nsIContentPolicy::TYPE_SUBDOCUMENT:
+  case nsIContentPolicy::TYPE_XMLHTTPREQUEST:
+
+  case nsIContentPolicy::TYPE_FONT: - NO TEST:
+    Load events for external fonts are not detectable by javascript.
+  case nsIContentPolicy::TYPE_WEBSOCKET: - NO TEST:
+    websocket connections over https require an encrypted websocket protocol (wss:)
+
+  case nsIContentPolicy::TYPE_IMAGE:
+  case nsIContentPolicy::TYPE_MEDIA:
+  case nsIContentPolicy::TYPE_PING:
+    our ping implementation is off by default and does not comply with the current spec (bug 786347)
+  }
+     */
+-->
+
+<script>
+  var baseUrl = "http://example.com/tests/content/base/test/file_mixed_content_server.sjs";
+
+  //For tests that require setTimeout, set the maximum polling time to 100 x 100ms = 10 seconds.
+  var MAX_COUNT = 100;
+  var TIMEOUT_INTERVAL = 100;
+
+  var testContent = document.getElementById("testContent");
+
+  /* Part 1: Mixed Script tests */
+
+  // Test 1a: insecure object
+  var object = document.createElement("object");
+  object.data = baseUrl + "?type=object";
+  object.type = "application/x-test";
+  object.width = "200";
+  object.height = "200";
+
+  testContent.appendChild(object);
+
+  var objectCount = 0;
+
+  function objectStatus(object) {
+    object instanceof Components.interfaces.nsIObjectLoadingContent;
+
+    if (object.displayedType != Components.interfaces.nsIObjectLoadingContent.TYPE_NULL) {
+      //object loaded
+      parent.postMessage({"test": "object", "msg": "insecure object loaded"}, "http://mochi.test:8888");
+    }
+    else {
+      if(objectCount < MAX_COUNT) {
+        objectCount++;
+        setTimeout(objectStatus, TIMEOUT_INTERVAL, object);
+      }
+      else {
+        //After we have called setTimeout the maximum number of times, assume object is blocked
+        parent.postMessage({"test": "object", "msg": "insecure object blocked"}, "http://mochi.test:8888");
+      }
+    }
+  }
+
+  // object does not have onload and onerror events. Hence we need a setTimeout to check the object's status
+  setTimeout(objectStatus, TIMEOUT_INTERVAL, object);
+
+  // Test 1b: insecure script
+  var script = document.createElement("script");
+  var scriptLoad = false;
+  var scriptCount = 0;
+  script.src = baseUrl + "?type=script";
+  script.onload = function() {
+    parent.postMessage({"test": "script", "msg": "insecure script loaded"}, "http://mochi.test:8888");
+    scriptLoad = true;
+  }
+  testContent.appendChild(script);
+
+  function scriptStatus(script)
+  {
+    if(scriptLoad) {
+      return;
+    }
+    else {
+      if(scriptCount < MAX_COUNT) {
+        scriptCount++;
+        setTimeout(scriptStatus, TIMEOUT_INTERVAL, script);
+      }
+      else {
+        //After we have called setTimeout the maximum number of times, assume script is blocked
+        parent.postMessage({"test": "script", "msg": "insecure script blocked"}, "http://mochi.test:8888");
+      }
+    }
+  }
+
+  // scripts blocked by Content Policy's do not have onerror events (see bug 789856).  Hence we need a setTimeout to check the script's status
+  setTimeout(scriptStatus, TIMEOUT_INTERVAL, script);
+
+
+  // Test 1c: insecure stylesheet
+  var cssStyleSheet = document.createElement("link");
+  cssStyleSheet.rel = "stylesheet";
+  cssStyleSheet.href = baseUrl + "?type=stylesheet";
+  cssStyleSheet.type = "text/css";
+  testContent.appendChild(cssStyleSheet);
+
+  var styleCount = 0;
+
+  function styleStatus(cssStyleSheet) {
+    if( cssStyleSheet.sheet || cssStyleSheet.styleSheet || cssStyleSheet.innerHTML ) {
+      parent.postMessage({"test": "stylesheet", "msg": "insecure stylesheet loaded"}, "http://mochi.test:8888");
+    } 
+    else {
+      if(styleCount < MAX_COUNT) {
+        styleCount++;
+        setTimeout(styleStatus, TIMEOUT_INTERVAL, cssStyleSheet);
+      }
+      else {
+        //After we have called setTimeout the maximum number of times, assume stylesheet is blocked
+        parent.postMessage({"test": "stylesheet", "msg": "insecure stylesheet blocked"}, "http://mochi.test:8888");
+      }
+    }
+  }
+
+  // link does not have onload and onerror events. Hence we need a setTimeout to check the link's status
+  window.setTimeout(styleStatus, TIMEOUT_INTERVAL, cssStyleSheet);
+
+  // Test 1d: insecure iframe
+  var iframe = document.createElement("iframe");
+  iframe.src = baseUrl + "?type=iframe";
+  iframe.onload = function() {
+    parent.postMessage({"test": "iframe", "msg": "insecure iframe loaded"}, "http://mochi.test:8888");
+  }
+  iframe.onerror = function() {
+    parent.postMessage({"test": "iframe", "msg": "insecure iframe blocked"}, "http://mochi.test:8888");
+  };
+  testContent.appendChild(iframe);
+
+
+  // Test 1e: insecure xhr
+  var xhrsuccess = true;
+  var xhr = new XMLHttpRequest;
+  try {
+    xhr.open("GET", baseUrl + "?type=xhr", true);
+  } catch(ex) {
+     xhrsuccess = false;
+     parent.postMessage({"test": "xhr", "msg": "insecure xhr blocked"}, "http://mochi.test:8888");
+  }
+
+  if(xhrsuccess) {
+    xhr.onreadystatechange = function (oEvent) {
+      var result = false;
+      if (xhr.readyState == 4) {
+        if (xhr.status == 200) {
+          parent.postMessage({"test": "xhr", "msg": "insecure xhr loaded"}, "http://mochi.test:8888");
+        }
+        else {
+          parent.postMessage({"test": "xhr", "msg": "insecure xhr blocked"}, "http://mochi.test:8888");
+        }
+      }
+    }
+
+    xhr.send(null);
+  }
+
+  /* Part 2: Mixed Display tests */
+
+  // Test 2a: insecure image
+  var img = document.createElement("img");
+  img.src = "http://mochi.test:8888/tests/image/test/mochitest/blue.png";
+  img.onload = function() {
+    parent.postMessage({"test": "image", "msg": "insecure image loaded"}, "http://mochi.test:8888");
+  }
+  img.onerror = function() {
+    parent.postMessage({"test": "image", "msg": "insecure image blocked"}, "http://mochi.test:8888");
+  }
+  // We don't need to append the image to the document. Doing so causes the image test to run twice.
+
+
+  // Test 2b: insecure media
+  var media = document.createElement("video");
+  media.src = "http://mochi.test:8888/tests/content/media/test/320x240.ogv?" + Math.floor((Math.random()*1000)+1);
+  media.width = "320";
+  media.height = "200";
+  media.type = "video/ogg";
+  media.onloadeddata = function() {
+    parent.postMessage({"test": "media", "msg": "insecure media loaded"}, "http://mochi.test:8888");
+  }
+  media.onerror = function() {
+    parent.postMessage({"test": "media", "msg": "insecure media blocked"}, "http://mochi.test:8888");
+  }
+  // We don't need to append the video to the document. Doing so causes the image test to run twice.
+
+</script>
+</body>
+</html>
new file mode 100644
--- /dev/null
+++ b/content/base/test/file_mixed_content_server.sjs
@@ -0,0 +1,45 @@
+
+function handleRequest(request, response)
+{
+  // get the Content-Type to serve from the query string
+  var contentType = null;
+  request.queryString.split('&').forEach( function (val) {
+     var [name, value] = val.split('=');
+       if (name == "type") {
+         contentType = unescape(value);
+       }
+  });
+
+  // avoid confusing cache behaviors
+  response.setHeader("Cache-Control", "no-cache", false);
+
+  switch (contentType) {
+    case "iframe":
+      response.setHeader("Content-Type", "text/html", false);
+      response.write("frame content");
+      break;
+
+    case "script":
+      response.setHeader("Content-Type", "application/javascript", false);
+      break;
+
+    case "stylesheet":
+      response.setHeader("Content-Type", "text/css", false);
+      break;
+
+    case "object":
+      response.setHeader("Content-Type", "application/x-test", false);
+      break;
+
+   case "xhr":
+      response.setHeader("Content-Type", "text/xml", false);
+      response.setHeader("Access-Control-Allow-Origin", "https://example.com");
+      response.write('<?xml version="1.0" encoding="UTF-8" ?><test></test>');
+      break;
+
+    default:
+      response.setHeader("Content-Type", "text/html", false);
+      response.write("<html><body>Hello World</body></html>");
+      break;
+  }
+}
--- a/content/base/test/test_XHR_parameters.html
+++ b/content/base/test/test_XHR_parameters.html
@@ -1,23 +1,23 @@
 
 
 <!DOCTYPE html>
 <html>
 <head>
   <meta charset="utf-8">
   <title>Test for XMLHttpRequest with system privileges</title>
-  <script type="text/javascript" src="/tests/SimpleTest/SimpleTest.js"></script>        
+  <script type="text/javascript" src="/tests/SimpleTest/SimpleTest.js"></script>
   <link rel="stylesheet" type="text/css" href="/tests/SimpleTest/test.css" />
 </head>
 <body onload="runTests();">
 <p id="display">
 </p>
 <div id="content" style="display: none">
-  
+
 </div>
 <pre id="test">
 <script class="testbody" type="application/javascript;version=1.8">
 
 function runTests() {
   SimpleTest.waitForExplicitFinish();
 
   let validParameters = [
new file mode 100644
--- /dev/null
+++ b/content/base/test/test_mixed_content_blocker.html
@@ -0,0 +1,142 @@
+<!DOCTYPE HTML>
+<html>
+<!--
+Tests for Mixed Content Blocker
+https://bugzilla.mozilla.org/show_bug.cgi?id=62178
+-->
+<head>
+  <meta charset="utf-8">
+  <title>Tests for Bug 62178</title>
+  <script type="application/javascript" src="/tests/SimpleTest/SimpleTest.js"></script>
+  <link rel="stylesheet" type="text/css" href="/tests/SimpleTest/test.css"/>
+
+  <script>
+
+  var origBlockDisplay = SpecialPowers.getBoolPref("security.mixed_content.block_display_content");
+  var origBlockActive = SpecialPowers.getBoolPref("security.mixed_content.block_active_content");
+
+  var counter = 0;
+  var settings = [ [true, true], [true, false], [false, true], [false, false] ];
+
+  var blockActive;
+  var blockDisplay;
+
+  //Cycle through 4 different preference settings.
+  function changePrefs(x) {
+    SpecialPowers.setBoolPref("security.mixed_content.block_display_content", settings[x][0]);
+    SpecialPowers.setBoolPref("security.mixed_content.block_active_content", settings[x][1]);
+    blockDisplay = SpecialPowers.getBoolPref("security.mixed_content.block_display_content");
+    blockActive = SpecialPowers.getBoolPref("security.mixed_content.block_active_content");
+  }
+
+  //Set the first set of settings (true, true) and increment the counter.
+  changePrefs(counter);
+  counter++;
+
+  var testsToRun = {
+    iframe: false,
+    image: false,
+    script: false,
+    stylesheet: false,
+    object: false,
+    media: false,
+    xhr: false,
+  };
+
+  function log(msg) {
+    document.getElementById("log").textContent += "\n" + msg;
+  }
+
+  function checkTestsCompleted() {
+    for (var prop in testsToRun) {
+      // some test hasn't run yet so we're not done
+      if (!testsToRun[prop])
+        return;
+    }
+    //if the testsToRun are all completed, chnage the pref and run the tests again until we have cycled through all the prefs.
+    if(counter < 4) {
+       for (var prop in testsToRun) {
+         testsToRun[prop] = false;
+       }
+      //call to change the preferences
+      changePrefs(counter);
+      counter++;
+      log("\nblockDisplay set to "+blockDisplay+", blockActive set to "+blockActive+".");
+      document.getElementById('framediv').innerHTML = '<iframe id="testHarness" src="https://example.com/tests/content/base/test/file_mixed_content_main.html"></iframe>';
+    }
+    else {
+      //set the prefs back to what they were set to originally
+      SpecialPowers.setBoolPref("security.mixed_content.block_display_content", origBlockDisplay);
+      SpecialPowers.setBoolPref("security.mixed_content.block_active_content", origBlockActive);
+      SimpleTest.finish();
+    }
+  }
+
+  var firstTest = true;
+
+  // listen for a messages from the mixed content test harness
+  window.addEventListener("message", receiveMessage, false);
+  function receiveMessage(event) {
+    if(firstTest) {
+      log("blockActive set to "+blockActive+", blockDisplay set to "+blockDisplay+".");
+      firstTest = false;
+    }
+
+    log("test: "+event.data.test+", msg: "+event.data.msg + " logging message.");
+    // test that the load type matches the pref for this type of content
+    // (i.e. active vs. display)
+
+    switch(event.data.test) {
+
+      /* Mixed Script tests */
+      case "iframe":
+        ok(blockActive == (event.data.msg == "insecure iframe blocked"), "iframe did not follow block_active_content pref");
+        testsToRun["iframe"] = true;
+        break;
+
+      case "object":
+        ok(blockActive == (event.data.msg == "insecure object blocked"), "object did not follow block_active_content pref");
+        testsToRun["object"] = true;
+        break;
+
+      case "script":
+        ok(blockActive == (event.data.msg == "insecure script blocked"), "script did not follow block_active_content pref");
+        testsToRun["script"] = true;
+        break;
+
+      case "stylesheet":
+        ok(blockActive == (event.data.msg == "insecure stylesheet blocked"), "stylesheet did not follow block_active_content pref");
+        testsToRun["stylesheet"] = true;
+        break;
+
+      case "xhr":
+        ok(blockActive == (event.data.msg == "insecure xhr blocked"), "xhr did not follow block_active_content pref");
+        testsToRun["xhr"] = true;
+        break;
+
+      /* Mixed Display tests */
+      case "image":
+        //test that the image load matches the pref for dipslay content
+        ok(blockDisplay == (event.data.msg == "insecure image blocked"), "image did not follow block_display_content pref");
+        testsToRun["image"] = true;
+        break;
+
+      case "media":
+        ok(blockDisplay == (event.data.msg == "insecure media blocked"), "media did not follow block_display_content pref");
+        testsToRun["media"] = true;
+        break;
+    }
+    checkTestsCompleted();
+  }
+
+  SimpleTest.waitForExplicitFinish();
+  </script>
+</head>
+
+<body>
+  <div id="framediv">
+    <iframe id="testHarness" src="https://example.com/tests/content/base/test/file_mixed_content_main.html"></iframe>
+  </div>
+  <pre id="log"></pre>
+</body>
+</html>
--- a/content/events/src/nsEventStateManager.cpp
+++ b/content/events/src/nsEventStateManager.cpp
@@ -378,21 +378,23 @@ static bool
 CanScrollOn(nsIScrollableFrame* aScrollFrame, double aDeltaX, double aDeltaY)
 {
   MOZ_ASSERT(aScrollFrame);
   NS_ASSERTION(aDeltaX || aDeltaY,
                "One of the delta values must be non-zero at least");
 
   nsPoint scrollPt = aScrollFrame->GetScrollPosition();
   nsRect scrollRange = aScrollFrame->GetScrollRange();
-
-  return ((aDeltaX && CanScrollInRange(scrollRange.x, scrollPt.x,
-                                       scrollRange.XMost(), aDeltaX)) ||
-          (aDeltaY && CanScrollInRange(scrollRange.y, scrollPt.y,
-                                       scrollRange.YMost(), aDeltaY)));
+  nscoord oneDevPixel =
+    aScrollFrame->GetScrolledFrame()->PresContext()->AppUnitsPerDevPixel();
+
+  return (aDeltaX && scrollRange.width >= oneDevPixel &&
+          CanScrollInRange(scrollRange.x, scrollPt.x, scrollRange.XMost(), aDeltaX)) ||
+         (aDeltaY && scrollRange.height >= oneDevPixel &&
+          CanScrollInRange(scrollRange.y, scrollPt.y, scrollRange.YMost(), aDeltaY));
 }
 
 void
 nsMouseWheelTransaction::BeginTransaction(nsIFrame* aTargetFrame,
                                           widget::WheelEvent* aEvent)
 {
   NS_ASSERTION(!sTargetFrame, "previous transaction is not finished!");
   sTargetFrame = aTargetFrame;
--- a/content/events/src/nsPaintRequest.cpp
+++ b/content/events/src/nsPaintRequest.cpp
@@ -61,24 +61,24 @@ NS_INTERFACE_TABLE_HEAD(nsPaintRequestLi
 NS_INTERFACE_MAP_END
 
 NS_IMPL_CYCLE_COLLECTING_ADDREF(nsPaintRequestList)
 NS_IMPL_CYCLE_COLLECTING_RELEASE(nsPaintRequestList)
 
 NS_IMETHODIMP    
 nsPaintRequestList::GetLength(uint32_t* aLength)
 {
-  *aLength = mArray.Count();
+  *aLength = Length();
   return NS_OK;
 }
 
 NS_IMETHODIMP    
 nsPaintRequestList::Item(uint32_t aIndex, nsIDOMPaintRequest** aReturn)
 {
-  NS_IF_ADDREF(*aReturn = nsPaintRequestList::GetItemAt(aIndex));
+  NS_IF_ADDREF(*aReturn = Item(aIndex));
   return NS_OK;
 }
 
 nsIDOMPaintRequest*
 nsPaintRequestList::GetItemAt(uint32_t aIndex)
 {
-  return mArray.SafeObjectAt(aIndex);
+  return Item(aIndex);
 }
--- a/content/events/src/nsPaintRequest.h
+++ b/content/events/src/nsPaintRequest.h
@@ -69,16 +69,31 @@ public:
       NS_ASSERTION(list_qi == static_cast<nsIDOMPaintRequestList*>(aSupports),
                    "Uh, fix QI!");
     }
 #endif
 
     return static_cast<nsPaintRequestList*>(aSupports);
   }
 
+  uint32_t Length()
+  {
+    return mArray.Count();
+  }
+
+  nsIDOMPaintRequest* Item(uint32_t aIndex)
+  {
+    return mArray.SafeObjectAt(aIndex);
+  }
+  nsIDOMPaintRequest* IndexedGetter(uint32_t aIndex, bool& aFound)
+  {
+    aFound = aIndex < static_cast<uint32_t>(mArray.Count());
+    return aFound ? mArray.ObjectAt(aIndex) : nullptr;
+  }
+
 private:
   ~nsPaintRequestList() {}
 
   nsCOMArray<nsIDOMPaintRequest> mArray;
   nsCOMPtr<nsIDOMEvent> mParent;
 };
 
 #endif /*NSPAINTREQUEST_H_*/
--- a/content/html/content/public/nsIHTMLCollection.h
+++ b/content/html/content/public/nsIHTMLCollection.h
@@ -2,34 +2,68 @@
 /* This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
 
 #ifndef nsIHTMLCollection_h___
 #define nsIHTMLCollection_h___
 
 #include "nsIDOMHTMLCollection.h"
+#include "nsWrapperCache.h"
 
+struct JSContext;
+struct JSObject;
 class nsINode;
-class nsWrapperCache;
+namespace mozilla {
+class ErrorResult;
+}
 
 // IID for the nsIHTMLCollection interface
 #define NS_IHTMLCOLLECTION_IID \
-{ 0xdea91ad6, 0x57d1, 0x4e7a, \
- { 0xb5, 0x5a, 0xdb, 0xfc, 0x36, 0x7b, 0xc8, 0x22 } }
+{ 0x5c6012c3, 0xa816, 0x4f28, \
+ { 0xab, 0x93, 0xe9, 0x8a, 0x36, 0x16, 0x88, 0xf2 } }
 
 /**
  * An internal interface
  */
 class nsIHTMLCollection : public nsIDOMHTMLCollection
 {
 public:
   NS_DECLARE_STATIC_IID_ACCESSOR(NS_IHTMLCOLLECTION_IID)
 
   /**
    * Get the root node for this HTML collection.
    */
   virtual nsINode* GetParentObject() = 0;
+
+  using nsIDOMHTMLCollection::Item;
+  using nsIDOMHTMLCollection::NamedItem;
+
+  uint32_t Length()
+  {
+    uint32_t length;
+    GetLength(&length);
+    return length;
+  }
+  nsGenericElement* Item(uint32_t index)
+  {
+    return GetElementAt(index);
+  }
+  nsGenericElement* IndexedGetter(uint32_t index, bool& aFound)
+  {
+    nsGenericElement* item = Item(index);
+    aFound = !!item;
+    return item;
+  }
+  virtual JSObject* NamedItem(JSContext* cx, const nsAString& name,
+                              mozilla::ErrorResult& error) = 0;
+  JSObject* NamedGetter(JSContext* cx, const nsAString& name,
+                        bool& found, mozilla::ErrorResult& error)
+  {
+    JSObject* namedItem = NamedItem(cx, name, error);
+    found = !!namedItem;
+    return namedItem;
+  }
 };
 
 NS_DEFINE_STATIC_IID_ACCESSOR(nsIHTMLCollection, NS_IHTMLCOLLECTION_IID)
 
 #endif /* nsIHTMLCollection_h___ */
--- a/content/html/content/src/HTMLPropertiesCollection.cpp
+++ b/content/html/content/src/HTMLPropertiesCollection.cpp
@@ -7,16 +7,18 @@
 #include "HTMLPropertiesCollection.h"
 #include "dombindings.h"
 #include "nsIDocument.h"
 #include "nsContentUtils.h"
 #include "nsGenericHTMLElement.h"
 #include "nsVariant.h"
 #include "nsDOMSettableTokenList.h"
 #include "nsAttrValue.h"
+#include "mozilla/ErrorResult.h"
+#include "nsWrapperCacheInlines.h"
 
 DOMCI_DATA(HTMLPropertiesCollection, mozilla::dom::HTMLPropertiesCollection)
 DOMCI_DATA(PropertyNodeList, mozilla::dom::PropertyNodeList)
 
 namespace mozilla {
 namespace dom {
 
 static PLDHashOperator
@@ -118,83 +120,101 @@ HTMLPropertiesCollection::GetLength(uint
   EnsureFresh();
   *aLength = mProperties.Length();
   return NS_OK;
 }
 
 NS_IMETHODIMP
 HTMLPropertiesCollection::Item(uint32_t aIndex, nsIDOMNode** aResult)
 {
-  EnsureFresh();
-  nsGenericHTMLElement* property = mProperties.SafeElementAt(aIndex);
-  *aResult = property ? property->AsDOMNode() : NULL;
-  NS_IF_ADDREF(*aResult);
+  nsINode* result = nsIHTMLCollection::Item(aIndex);
+  if (result) {
+    NS_ADDREF(*aResult = result->AsDOMNode());
+  } else {
+    *aResult = nullptr;
+  }
   return NS_OK;
 }
 
 NS_IMETHODIMP
 HTMLPropertiesCollection::NamedItem(const nsAString& aName,
                                     nsIDOMNode** aResult)
 {
   *aResult = NULL;
   return NS_OK;
 }
 
+JSObject*
+HTMLPropertiesCollection::NamedItem(JSContext* cx, const nsAString& name,
+                                    mozilla::ErrorResult& error)
+{
+  // HTMLPropertiesCollection.namedItem and the named getter call the NamedItem
+  // that returns a PropertyNodeList, calling HTMLCollection.namedItem doesn't
+  // make sense so this returns null.
+  return nullptr;
+}
+
 nsISupports*
 HTMLPropertiesCollection::GetNamedItem(const nsAString& aName,
                                        nsWrapperCache **aCache)
 {
-  EnsureFresh();
-  if (!mNames->ContainsInternal(aName)) {
+  if (!IsSupportedNamedProperty(aName)) {
     *aCache = NULL;
     return NULL;
   }
 
   nsRefPtr<PropertyNodeList> propertyList;
   if (!mNamedItemEntries.Get(aName, getter_AddRefs(propertyList))) {
     propertyList = new PropertyNodeList(this, mRoot, aName);
     mNamedItemEntries.Put(aName, propertyList);
   }
   *aCache = propertyList;
   return static_cast<nsIDOMPropertyNodeList*>(propertyList);
 }
 
-nsIContent*
-HTMLPropertiesCollection::GetNodeAt(uint32_t aIndex)
+nsGenericElement*
+HTMLPropertiesCollection::GetElementAt(uint32_t aIndex)
 {
   EnsureFresh();
   return mProperties.SafeElementAt(aIndex);
 }
 
 nsINode*
 HTMLPropertiesCollection::GetParentObject()
 {
   return mRoot;
 }
 
+PropertyNodeList*
+HTMLPropertiesCollection::NamedItem(const nsAString& aName)
+{
+  EnsureFresh();
+
+  PropertyNodeList* propertyList = mNamedItemEntries.GetWeak(aName);
+  if (!propertyList) {
+    nsRefPtr<PropertyNodeList> newPropertyList =
+      new PropertyNodeList(this, mRoot, aName);
+    mNamedItemEntries.Put(aName, newPropertyList);
+    propertyList = newPropertyList;
+  }
+  return propertyList;
+}
+
 NS_IMETHODIMP
 HTMLPropertiesCollection::NamedItem(const nsAString& aName,
                                     nsIDOMPropertyNodeList** aResult)
 {
-  EnsureFresh();
- 
-  nsRefPtr<PropertyNodeList> propertyList;
-  if (!mNamedItemEntries.Get(aName, getter_AddRefs(propertyList))) {
-    propertyList = new PropertyNodeList(this, mRoot, aName);
-    mNamedItemEntries.Put(aName, propertyList);
-  }
-  propertyList.forget(aResult);
+  NS_ADDREF(*aResult = NamedItem(aName));
   return NS_OK;
 }
 
 NS_IMETHODIMP
 HTMLPropertiesCollection::GetNames(nsIDOMDOMStringList** aResult)
 {
-  EnsureFresh();
-  NS_ADDREF(*aResult = mNames);
+  NS_ADDREF(*aResult = Names());
   return NS_OK;
 }
 
 void
 HTMLPropertiesCollection::AttributeChanged(nsIDocument *aDocument, Element* aElement,
                                            int32_t aNameSpaceID, nsIAtom* aAttribute,
                                            int32_t aModType)
 {
@@ -459,16 +479,34 @@ NS_INTERFACE_TABLE_HEAD(PropertyNodeList
                         nsIDOMPropertyNodeList,
                         nsIDOMNodeList,
                         nsINodeList,
                         nsIMutationObserver)
     NS_INTERFACE_TABLE_TO_MAP_SEGUE_CYCLE_COLLECTION(PropertyNodeList)
     NS_DOM_INTERFACE_MAP_ENTRY_CLASSINFO(PropertyNodeList)
 NS_INTERFACE_MAP_END
 
+void
+PropertyNodeList::GetValues(JSContext* aCx, nsTArray<JS::Value >& aResult,
+                            ErrorResult& aError)
+{
+  EnsureFresh();
+
+  JSObject* wrapper = GetWrapper();
+  JSAutoCompartment ac(aCx, wrapper);
+  uint32_t length = mElements.Length();
+  for (uint32_t i = 0; i < length; ++i) {
+    JS::Value v = mElements.ElementAt(i)->GetItemValue(aCx, wrapper, aError);
+    if (aError.Failed()) {
+      return;
+    }
+    aResult.AppendElement(v);
+  }
+}
+
 NS_IMETHODIMP
 PropertyNodeList::GetValues(nsIVariant** aValues)
 {
   EnsureFresh();
   nsCOMPtr<nsIWritableVariant> out = new nsVariant();
 
   // We have to use an nsTArray<nsIVariant*> here and do manual refcounting because 
   // nsWritableVariant::SetAsArray takes an nsIVariant**.
--- a/content/html/content/src/HTMLPropertiesCollection.h
+++ b/content/html/content/src/HTMLPropertiesCollection.h
@@ -40,33 +40,46 @@ public:
   NS_DECL_NSIDOMDOMSTRINGLIST
 
   bool ContainsInternal(const nsAString& aString);
 
 protected:
   nsRefPtr<HTMLPropertiesCollection> mCollection;
 };
 
-class HTMLPropertiesCollection : public nsIDOMHTMLPropertiesCollection,
+class HTMLPropertiesCollection : public nsIHTMLCollection,
+                                 public nsIDOMHTMLPropertiesCollection,
                                  public nsStubMutationObserver,
-                                 public nsWrapperCache,
-                                 public nsIHTMLCollection
+                                 public nsWrapperCache
 {
   friend class PropertyNodeList;
   friend class PropertyStringList;
 public:
   HTMLPropertiesCollection(nsGenericHTMLElement* aRoot);
   virtual ~HTMLPropertiesCollection();
 
   virtual JSObject* WrapObject(JSContext *cx, JSObject *scope,
                                bool *triedToWrap);
 
   NS_IMETHOD NamedItem(const nsAString& aName, nsIDOMNode** aResult);
   void SetDocument(nsIDocument* aDocument);
   nsINode* GetParentObject();
+  virtual JSObject* NamedItem(JSContext* cx, const nsAString& name,
+                              mozilla::ErrorResult& error);
+  PropertyNodeList* NamedItem(const nsAString& aName);
+  PropertyNodeList* NamedGetter(const nsAString& aName, bool& aFound)
+  {
+    aFound = IsSupportedNamedProperty(aName);
+    return aFound ? NamedItem(aName) : nullptr;
+  }
+  nsDOMStringList* Names()
+  {
+    EnsureFresh();
+    return mNames;
+  }
 
   NS_DECL_CYCLE_COLLECTING_ISUPPORTS
   NS_DECL_NSIDOMHTMLPROPERTIESCOLLECTION
 
   NS_DECL_NSIMUTATIONOBSERVER_ATTRIBUTECHANGED
   NS_DECL_NSIMUTATIONOBSERVER_CONTENTAPPENDED
   NS_DECL_NSIMUTATIONOBSERVER_CONTENTINSERTED
   NS_DECL_NSIMUTATIONOBSERVER_CONTENTREMOVED
@@ -81,16 +94,22 @@ protected:
   void EnsureFresh();
   
   // Crawl the properties of mRoot, following any itemRefs it may have
   void CrawlProperties();
 
   // Crawl startNode and its descendants, looking for items
   void CrawlSubtree(Element* startNode);
 
+  bool IsSupportedNamedProperty(const nsAString& aName)
+  {
+    EnsureFresh();
+    return mNames->ContainsInternal(aName);
+  }
+
   // the items that make up this collection
   nsTArray<nsRefPtr<nsGenericHTMLElement> > mProperties; 
   
   // the itemprop attribute of the properties
   nsRefPtr<PropertyStringList> mNames; 
  
   // The cached PropertyNodeLists that are NamedItems of this collection 
   nsRefPtrHashtable<nsStringHashKey, PropertyNodeList> mNamedItemEntries;
@@ -114,16 +133,19 @@ public:
                    nsIContent* aRoot, const nsAString& aName);
   virtual ~PropertyNodeList();
 
   virtual JSObject* WrapObject(JSContext *cx, JSObject *scope,
                                bool *triedToWrap);
 
   void SetDocument(nsIDocument* aDocument);
 
+  void GetValues(JSContext* aCx, nsTArray<JS::Value >& aResult,
+                 ErrorResult& aError);
+
   NS_DECL_NSIDOMPROPERTYNODELIST
 
   NS_DECL_CYCLE_COLLECTING_ISUPPORTS
 
   NS_DECL_CYCLE_COLLECTION_SCRIPT_HOLDER_CLASS_AMBIGUOUS(PropertyNodeList,
                                                          nsINodeList)
 
   NS_DECL_NSIMUTATIONOBSERVER_ATTRIBUTECHANGED
--- a/content/html/content/src/nsClientRect.cpp
+++ b/content/html/content/src/nsClientRect.cpp
@@ -81,31 +81,31 @@ NS_INTERFACE_MAP_END
 
 NS_IMPL_CYCLE_COLLECTING_ADDREF(nsClientRectList)
 NS_IMPL_CYCLE_COLLECTING_RELEASE(nsClientRectList)
 
 
 NS_IMETHODIMP    
 nsClientRectList::GetLength(uint32_t* aLength)
 {
-  *aLength = mArray.Count();
+  *aLength = Length();
   return NS_OK;
 }
 
 NS_IMETHODIMP    
 nsClientRectList::Item(uint32_t aIndex, nsIDOMClientRect** aReturn)
 {
-  NS_IF_ADDREF(*aReturn = nsClientRectList::GetItemAt(aIndex));
+  NS_IF_ADDREF(*aReturn = Item(aIndex));
   return NS_OK;
 }
 
 nsIDOMClientRect*
 nsClientRectList::GetItemAt(uint32_t aIndex)
 {
-  return mArray.SafeObjectAt(aIndex);
+  return Item(aIndex);
 }
 
 JSObject*
 nsClientRectList::WrapObject(JSContext *cx, JSObject *scope, bool *triedToWrap)
 {
   return mozilla::dom::oldproxybindings::ClientRectList::create(cx, scope, this,
                                                        triedToWrap);
 }
--- a/content/html/content/src/nsClientRect.h
+++ b/content/html/content/src/nsClientRect.h
@@ -69,16 +69,30 @@ public:
       NS_ASSERTION(list_qi == static_cast<nsIDOMClientRectList*>(aSupports),
                    "Uh, fix QI!");
     }
 #endif
 
     return static_cast<nsClientRectList*>(aSupports);
   }
 
+  uint32_t Length()
+  {
+    return mArray.Count();
+  }
+  nsIDOMClientRect* Item(uint32_t aIndex)
+  {
+    return mArray.SafeObjectAt(aIndex);
+  }
+  nsIDOMClientRect* IndexedGetter(uint32_t aIndex, bool& aFound)
+  {
+    aFound = aIndex < static_cast<uint32_t>(mArray.Count());
+    return aFound ? mArray.ObjectAt(aIndex) : nullptr;
+  }
+
 protected:
   virtual ~nsClientRectList() {}
 
   nsCOMArray<nsIDOMClientRect> mArray;
   nsCOMPtr<nsISupports> mParent;
 };
 
 #endif /*NSCLIENTRECT_H_*/
--- a/content/html/content/src/nsGenericHTMLElement.cpp
+++ b/content/html/content/src/nsGenericHTMLElement.cpp
@@ -89,16 +89,18 @@
 #include "mozilla/dom/FromParser.h"
 #include "mozilla/BloomFilter.h"
 
 #include "HTMLPropertiesCollection.h"
 #include "nsVariant.h"
 #include "nsDOMSettableTokenList.h"
 #include "nsThreadUtils.h"
 #include "nsTextFragment.h"
+#include "mozilla/dom/BindingUtils.h"
+#include "mozilla/ErrorResult.h"
 
 using namespace mozilla;
 using namespace mozilla::dom;
 using namespace mozilla::directionality;
 
 class nsINodeInfo;
 class nsIDOMNodeList;
 class nsRuleWalker;
@@ -4156,16 +4158,45 @@ nsGenericHTMLElement::ChangeEditableStat
   // We might as well wrap it all in one script blocker.
   nsAutoScriptBlocker scriptBlocker;
   MakeContentDescendantsEditable(this, document);
 }
 
 NS_IMPL_BOOL_ATTR(nsGenericHTMLElement, ItemScope, itemscope)
 NS_IMPL_URI_ATTR(nsGenericHTMLElement, ItemId, itemid)
 
+JS::Value
+nsGenericHTMLElement::GetItemValue(JSContext* aCx, JSObject* aScope,
+                                   ErrorResult& error)
+{
+  if (!HasAttr(kNameSpaceID_None, nsGkAtoms::itemprop)) {
+    return JS::NullValue();
+  }
+
+  bool itemScope;
+  GetItemScope(&itemScope);
+  if (itemScope) {
+    JS::Value v;
+    if (!mozilla::dom::WrapObject(aCx, aScope, this, &v)) {
+      error.Throw(NS_ERROR_FAILURE);
+      return JS::UndefinedValue();
+    }
+    return v;
+  }
+
+  nsString string;
+  GetItemValueText(string);
+  JS::Value v;
+  if (!xpc::NonVoidStringToJsval(aCx, string, &v)) {
+    error.Throw(NS_ERROR_FAILURE);
+    return JS::UndefinedValue();
+  }
+  return v;
+}
+
 NS_IMETHODIMP
 nsGenericHTMLElement::GetItemValue(nsIVariant** aValue)
 {
   nsCOMPtr<nsIWritableVariant> out = new nsVariant();
 
   if (!HasAttr(kNameSpaceID_None, nsGkAtoms::itemprop)) {
     out->SetAsEmpty();
     out.forget(aValue);
@@ -4290,33 +4321,33 @@ nsGenericHTMLElement::SetItemType(nsIVar
 {
   nsDOMSettableTokenList* itemType = GetTokenList(nsGkAtoms::itemtype);
   nsAutoString string;
   aValue->GetAsAString(string);
   return itemType->SetValue(string);
 }
 
 static void
-nsIDOMHTMLPropertiesCollectionDestructor(void *aObject, nsIAtom *aProperty,
-                                         void *aPropertyValue, void *aData)
+HTMLPropertiesCollectionDestructor(void *aObject, nsIAtom *aProperty,
+                                   void *aPropertyValue, void *aData)
 {
-  nsIDOMHTMLPropertiesCollection* properties = 
-    static_cast<nsIDOMHTMLPropertiesCollection*>(aPropertyValue);
+  HTMLPropertiesCollection* properties = 
+    static_cast<HTMLPropertiesCollection*>(aPropertyValue);
   NS_IF_RELEASE(properties);
 }
 
 NS_IMETHODIMP
 nsGenericHTMLElement::GetProperties(nsIDOMHTMLPropertiesCollection** aReturn)
 {
-  nsIDOMHTMLPropertiesCollection* properties = 
-    static_cast<nsIDOMHTMLPropertiesCollection*>(GetProperty(nsGkAtoms::microdataProperties));
+  HTMLPropertiesCollection* properties = 
+    static_cast<HTMLPropertiesCollection*>(GetProperty(nsGkAtoms::microdataProperties));
   if (!properties) {
      properties = new HTMLPropertiesCollection(this);
      NS_ADDREF(properties);
-     SetProperty(nsGkAtoms::microdataProperties, properties, nsIDOMHTMLPropertiesCollectionDestructor);
+     SetProperty(nsGkAtoms::microdataProperties, properties, HTMLPropertiesCollectionDestructor);
   }
   NS_ADDREF(*aReturn = properties);
   return NS_OK;
 }
 
 nsSize
 nsGenericHTMLElement::GetWidthHeightForImage(imgIRequest *aImageRequest)
 {
--- a/content/html/content/src/nsGenericHTMLElement.h
+++ b/content/html/content/src/nsGenericHTMLElement.h
@@ -30,16 +30,19 @@ class nsIEditor;
 struct nsRect;
 struct nsSize;
 class nsHTMLFormElement;
 class nsIDOMDOMStringMap;
 class nsIDOMHTMLMenuElement;
 class nsIDOMHTMLCollection;
 class nsDOMSettableTokenList;
 class nsIDOMHTMLPropertiesCollection;
+namespace mozilla {
+class ErrorResult;
+}
 
 typedef nsMappedAttributeElement nsGenericHTMLElementBase;
 
 /**
  * A common superclass for HTML elements
  */
 class nsGenericHTMLElement : public nsGenericHTMLElementBase
 {
@@ -116,16 +119,18 @@ public:
   NS_IMETHOD SetHidden(bool aHidden);
   NS_IMETHOD GetSpellcheck(bool* aSpellcheck);
   NS_IMETHOD SetSpellcheck(bool aSpellcheck);
   NS_IMETHOD GetDraggable(bool* aDraggable);
   NS_IMETHOD SetDraggable(bool aDraggable);
   NS_IMETHOD GetItemScope(bool* aItemScope);
   NS_IMETHOD SetItemScope(bool aItemScope);
   NS_IMETHOD GetItemValue(nsIVariant** aValue);
+  JS::Value GetItemValue(JSContext* aCx, JSObject* aScope,
+                         mozilla::ErrorResult& error);
   NS_IMETHOD SetItemValue(nsIVariant* aValue);
 protected:
   // These methods are used to implement element-specific behavior of Get/SetItemValue
   // when an element has @itemprop but no @itemscope.
   virtual void GetItemValueText(nsAString& text);
   virtual void SetItemValueText(const nsAString& text);
   nsDOMSettableTokenList* GetTokenList(nsIAtom* aAtom);
 public:
--- a/content/html/content/src/nsHTMLDataListElement.cpp
+++ b/content/html/content/src/nsHTMLDataListElement.cpp
@@ -3,16 +3,17 @@
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
 
 #include "nsIDOMHTMLDataListElement.h"
 #include "nsGenericHTMLElement.h"
 #include "nsIDOMEventTarget.h"
 #include "nsGkAtoms.h"
 #include "nsIDOMHTMLOptionElement.h"
+#include "nsContentList.h"
 
 
 class nsHTMLDataListElement : public nsGenericHTMLElement,
                               public nsIDOMHTMLDataListElement
 {
 public:
   nsHTMLDataListElement(already_AddRefed<nsINodeInfo> aNodeInfo);
   virtual ~nsHTMLDataListElement();
--- a/content/html/content/src/nsHTMLFieldSetElement.cpp
+++ b/content/html/content/src/nsHTMLFieldSetElement.cpp
@@ -6,16 +6,17 @@
 #include "nsHTMLFieldSetElement.h"
 #include "nsIDOMHTMLFormElement.h"
 #include "nsIDOMEventTarget.h"
 #include "nsStyleConsts.h"
 #include "nsIForm.h"
 #include "nsIFormControl.h"
 #include "nsGUIEvent.h"
 #include "nsEventDispatcher.h"
+#include "nsContentList.h"
 
 
 NS_IMPL_NS_NEW_HTML_ELEMENT(FieldSet)
 
 
 nsHTMLFieldSetElement::nsHTMLFieldSetElement(already_AddRefed<nsINodeInfo> aNodeInfo)
   : nsGenericHTMLFormElement(aNodeInfo)
   , mElements(nullptr)
--- a/content/html/content/src/nsHTMLFormElement.cpp
+++ b/content/html/content/src/nsHTMLFormElement.cpp
@@ -48,16 +48,17 @@
 #include "mozAutoDocUpdate.h"
 #include "nsIHTMLCollection.h"
 
 #include "nsIConstraintValidation.h"
 
 #include "nsIDOMHTMLButtonElement.h"
 #include "dombindings.h"
 #include "nsSandboxFlags.h"
+#include "mozilla/dom/BindingUtils.h"
 
 using namespace mozilla::dom;
 
 static const int NS_FORM_CONTROL_LIST_HASHTABLE_SIZE = 16;
 
 static const uint8_t NS_FORM_AUTOCOMPLETE_ON  = 1;
 static const uint8_t NS_FORM_AUTOCOMPLETE_OFF = 0;
 
@@ -92,16 +93,19 @@ public:
   // nsIDOMHTMLCollection interface
   NS_DECL_NSIDOMHTMLCOLLECTION
 
   virtual nsINode* GetParentObject()
   {
     return mForm;
   }
 
+  virtual JSObject* NamedItem(JSContext* cx, const nsAString& name,
+                              mozilla::ErrorResult& error);
+
   nsresult AddElementToTable(nsGenericHTMLFormElement* aChild,
                              const nsAString& aName);
   nsresult RemoveElementFromTable(nsGenericHTMLFormElement* aChild,
                                   const nsAString& aName);
   nsresult IndexOfControl(nsIFormControl* aControl,
                           int32_t* aIndex);
 
   nsISupports* NamedItemInternal(const nsAString& aName, bool aFlushContent);
@@ -2210,17 +2214,17 @@ nsFormControlList::GetLength(uint32_t* a
   FlushPendingNotifications();
   *aLength = mElements.Length();
   return NS_OK;
 }
 
 NS_IMETHODIMP
 nsFormControlList::Item(uint32_t aIndex, nsIDOMNode** aReturn)
 {
-  nsISupports* item = GetNodeAt(aIndex);
+  nsISupports* item = GetElementAt(aIndex);
   if (!item) {
     *aReturn = nullptr;
 
     return NS_OK;
   }
 
   return CallQueryInterface(item, aReturn);
 }
@@ -2507,23 +2511,41 @@ nsFormControlList::GetSortedControls(nsT
                "Not all form controls were added to the sorted list");
 #ifdef DEBUG
   AssertDocumentOrder(aControls, mForm);
 #endif
 
   return NS_OK;
 }
 
-nsIContent*
-nsFormControlList::GetNodeAt(uint32_t aIndex)
+nsGenericElement*
+nsFormControlList::GetElementAt(uint32_t aIndex)
 {
   FlushPendingNotifications();
 
   return mElements.SafeElementAt(aIndex, nullptr);
 }
 
 nsISupports*
 nsFormControlList::GetNamedItem(const nsAString& aName, nsWrapperCache **aCache)
 {
   nsISupports *item = NamedItemInternal(aName, true);
   *aCache = nullptr;
   return item;
 }
+
+JSObject*
+nsFormControlList::NamedItem(JSContext* cx, const nsAString& name,
+                             mozilla::ErrorResult& error)
+{
+  nsISupports *item = NamedItemInternal(name, true);
+  if (!item) {
+    return nullptr;
+  }
+  JSObject* wrapper = GetWrapper();
+  JSAutoCompartment ac(cx, wrapper);
+  JS::Value v;
+  if (!mozilla::dom::WrapObject(cx, wrapper, item, &v)) {
+    error.Throw(NS_ERROR_FAILURE);
+    return nullptr;
+  }
+  return &v.toObject();
+}
--- a/content/html/content/src/nsHTMLOptGroupElement.cpp
+++ b/content/html/content/src/nsHTMLOptGroupElement.cpp
@@ -1,80 +1,26 @@
 /* -*- Mode: C++; tab-width: 2; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
 /* This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
-#include "nsIDOMHTMLOptGroupElement.h"
+#include "nsHTMLOptGroupElement.h"
 #include "nsIDOMEventTarget.h"
-#include "nsGenericHTMLElement.h"
 #include "nsGkAtoms.h"
 #include "nsStyleConsts.h"
 #include "nsIFrame.h"
 #include "nsIFormControlFrame.h"
 #include "nsEventStates.h"
 
 #include "nsEventDispatcher.h"
 #include "nsHTMLSelectElement.h"
 
 /**
  * The implementation of &lt;optgroup&gt;
  */
-class nsHTMLOptGroupElement : public nsGenericHTMLElement,
-                              public nsIDOMHTMLOptGroupElement
-{
-public:
-  nsHTMLOptGroupElement(already_AddRefed<nsINodeInfo> aNodeInfo);
-  virtual ~nsHTMLOptGroupElement();
-
-  // nsISupports
-  NS_DECL_ISUPPORTS_INHERITED
-
-  // nsIDOMNode
-  NS_FORWARD_NSIDOMNODE(nsGenericHTMLElement::)
-
-  // nsIDOMElement
-  NS_FORWARD_NSIDOMELEMENT(nsGenericHTMLElement::)
-
-  // nsIDOMHTMLElement
-  NS_FORWARD_NSIDOMHTMLELEMENT(nsGenericHTMLElement::)
-
-  // nsIDOMHTMLOptGroupElement
-  NS_DECL_NSIDOMHTMLOPTGROUPELEMENT
-
-  // nsINode
-  virtual nsresult InsertChildAt(nsIContent* aKid, uint32_t aIndex,
-                                 bool aNotify);
-  virtual void RemoveChildAt(uint32_t aIndex, bool aNotify);
-
-  // nsIContent
-  virtual nsresult PreHandleEvent(nsEventChainPreVisitor& aVisitor);
-
-  virtual nsEventStates IntrinsicState() const;
- 
-  virtual nsresult Clone(nsINodeInfo *aNodeInfo, nsINode **aResult) const;
-
-  virtual nsXPCClassInfo* GetClassInfo();
-
-  virtual nsresult AfterSetAttr(int32_t aNameSpaceID, nsIAtom* aName,
-                                const nsAttrValue* aValue, bool aNotify);
-
-  virtual nsIDOMNode* AsDOMNode() { return this; }
-
-  virtual bool IsDisabled() const {
-    return HasAttr(kNameSpaceID_None, nsGkAtoms::disabled);
-  }
-protected:
-
-  /**
-   * Get the select content element that contains this option
-   * @param aSelectElement the select element [OUT]
-   */
-  nsIContent* GetSelect();
-};
-
 
 NS_IMPL_NS_NEW_HTML_ELEMENT(OptGroup)
 
 
 nsHTMLOptGroupElement::nsHTMLOptGroupElement(already_AddRefed<nsINodeInfo> aNodeInfo)
   : nsGenericHTMLElement(aNodeInfo)
 {
   // We start off enabled
new file mode 100644
--- /dev/null
+++ b/content/html/content/src/nsHTMLOptGroupElement.h
@@ -0,0 +1,65 @@
+/* -*- Mode: C++; tab-width: 2; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this file,
+ * You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+#ifndef nsGenericHTMLElement_h
+#define nsGenericHTMLElement_h
+
+#include "nsIDOMHTMLOptGroupElement.h"
+#include "nsGenericHTMLElement.h"
+
+class nsHTMLOptGroupElement : public nsGenericHTMLElement,
+                              public nsIDOMHTMLOptGroupElement
+{
+public:
+  nsHTMLOptGroupElement(already_AddRefed<nsINodeInfo> aNodeInfo);
+  virtual ~nsHTMLOptGroupElement();
+
+  // nsISupports
+  NS_DECL_ISUPPORTS_INHERITED
+
+  // nsIDOMNode
+  NS_FORWARD_NSIDOMNODE(nsGenericHTMLElement::)
+
+  // nsIDOMElement
+  NS_FORWARD_NSIDOMELEMENT(nsGenericHTMLElement::)
+
+  // nsIDOMHTMLElement
+  NS_FORWARD_NSIDOMHTMLELEMENT(nsGenericHTMLElement::)
+
+  // nsIDOMHTMLOptGroupElement
+  NS_DECL_NSIDOMHTMLOPTGROUPELEMENT
+
+  // nsINode
+  virtual nsresult InsertChildAt(nsIContent* aKid, uint32_t aIndex,
+                                 bool aNotify);
+  virtual void RemoveChildAt(uint32_t aIndex, bool aNotify);
+
+  // nsIContent
+  virtual nsresult PreHandleEvent(nsEventChainPreVisitor& aVisitor);
+
+  virtual nsEventStates IntrinsicState() const;
+ 
+  virtual nsresult Clone(nsINodeInfo *aNodeInfo, nsINode **aResult) const;
+
+  virtual nsXPCClassInfo* GetClassInfo();
+
+  virtual nsresult AfterSetAttr(int32_t aNameSpaceID, nsIAtom* aName,
+                                const nsAttrValue* aValue, bool aNotify);
+
+  virtual nsIDOMNode* AsDOMNode() { return this; }
+
+  virtual bool IsDisabled() const {
+    return HasAttr(kNameSpaceID_None, nsGkAtoms::disabled);
+  }
+protected:
+
+  /**
+   * Get the select content element that contains this option
+   * @param aSelectElement the select element [OUT]
+   */
+  nsIContent* GetSelect();
+};
+
+#endif /* nsGenericHTMLElement_h */
--- a/content/html/content/src/nsHTMLSelectElement.cpp
+++ b/content/html/content/src/nsHTMLSelectElement.cpp
@@ -31,16 +31,17 @@
 
 #include "nsError.h"
 #include "nsServiceManagerUtils.h"
 #include "nsRuleData.h"
 #include "nsEventDispatcher.h"
 #include "mozilla/dom/Element.h"
 #include "mozAutoDocUpdate.h"
 #include "dombindings.h"
+#include "mozilla/dom/BindingUtils.h"
 
 using namespace mozilla;
 using namespace mozilla::dom;
 
 NS_IMPL_ISUPPORTS1(nsSelectState, nsSelectState)
 NS_DEFINE_STATIC_IID_ACCESSOR(nsSelectState, NS_SELECT_STATE_IID)
 
 //----------------------------------------------------------------------
@@ -657,24 +658,17 @@ nsHTMLSelectElement::Add(nsIDOMHTMLEleme
     NS_ENSURE_TRUE(beforeElement, NS_ERROR_DOM_SYNTAX_ERR);
     return Add(aElement, beforeElement);
   }
 
   // otherwise, whether aBefore is long
   int32_t index;
   NS_ENSURE_SUCCESS(aBefore->GetAsInt32(&index), NS_ERROR_DOM_SYNTAX_ERR);
 
-  // If item index is out of range, insert to last.
-  // (since beforeElement becomes null, it is inserted to last)
-  nsCOMPtr<nsIDOMNode> beforeNode;
-  if (NS_SUCCEEDED(Item(index, getter_AddRefs(beforeNode)))) {
-    beforeElement = do_QueryInterface(beforeNode);
-  }
-
-  return Add(aElement, beforeElement);
+  return Add(aElement, index);
 }
 
 NS_IMETHODIMP
 nsHTMLSelectElement::Remove(int32_t aIndex)
 {
   nsCOMPtr<nsIDOMNode> option;
   Item(aIndex, getter_AddRefs(option));
 
@@ -2082,49 +2076,74 @@ nsHTMLOptionCollection::SetOption(uint32
     if (parent) {
       rv = parent->ReplaceChild(aOption, refChild, getter_AddRefs(ret));
     }
   }
 
   return rv;
 }
 
+int32_t
+nsHTMLOptionCollection::GetSelectedIndex(ErrorResult& aError)
+{
+  if (!mSelect) {
+    aError.Throw(NS_ERROR_UNEXPECTED);
+    return 0;
+  }
+
+  int32_t selectedIndex;
+  aError = mSelect->GetSelectedIndex(&selectedIndex);
+  return selectedIndex;
+}
+
 NS_IMETHODIMP
 nsHTMLOptionCollection::GetSelectedIndex(int32_t *aSelectedIndex)
 {
-  NS_ENSURE_TRUE(mSelect, NS_ERROR_UNEXPECTED);
+  ErrorResult rv;
+  *aSelectedIndex = GetSelectedIndex(rv);
+  return rv.ErrorCode();
+}
 
-  return mSelect->GetSelectedIndex(aSelectedIndex);
+void
+nsHTMLOptionCollection::SetSelectedIndex(int32_t aSelectedIndex,
+                                         ErrorResult& aError)
+{
+  if (!mSelect) {
+    aError.Throw(NS_ERROR_UNEXPECTED);
+    return;
+  }
+
+  aError = mSelect->SetSelectedIndex(aSelectedIndex);
 }
 
 NS_IMETHODIMP
 nsHTMLOptionCollection::SetSelectedIndex(int32_t aSelectedIndex)
 {
-  NS_ENSURE_TRUE(mSelect, NS_ERROR_UNEXPECTED);
-
-  return mSelect->SetSelectedIndex(aSelectedIndex);
+  ErrorResult rv;
+  SetSelectedIndex(aSelectedIndex, rv);
+  return rv.ErrorCode();
 }
 
 NS_IMETHODIMP
 nsHTMLOptionCollection::Item(uint32_t aIndex, nsIDOMNode** aReturn)
 {
-  nsISupports* item = GetNodeAt(aIndex);
+  nsISupports* item = GetElementAt(aIndex);
   if (!item) {
     *aReturn = nullptr;
 
     return NS_OK;
   }
 
   return CallQueryInterface(item, aReturn);
 }
 
-nsIContent*
-nsHTMLOptionCollection::GetNodeAt(uint32_t aIndex)
+nsGenericElement*
+nsHTMLOptionCollection::GetElementAt(uint32_t aIndex)
 {
-  return static_cast<nsIContent*>(ItemAsOption(aIndex));
+  return ItemAsOption(aIndex);
 }
 
 static nsHTMLOptionElement*
 GetNamedItemHelper(nsTArray<nsRefPtr<nsHTMLOptionElement> > &aElements,
                    const nsAString& aName)
 {
   uint32_t count = aElements.Length();
   for (uint32_t i = 0; i < count; i++) {
@@ -2148,28 +2167,46 @@ nsHTMLOptionCollection::GetNamedItem(con
   nsINode *item = GetNamedItemHelper(mElements, aName);
   *aCache = item;
   return item;
 }
 
 nsINode*
 nsHTMLOptionCollection::GetParentObject()
 {
-    return mSelect;
+  return mSelect;
 }
 
 NS_IMETHODIMP
 nsHTMLOptionCollection::NamedItem(const nsAString& aName,
                                   nsIDOMNode** aReturn)
 {
   NS_IF_ADDREF(*aReturn = GetNamedItemHelper(mElements, aName));
 
   return NS_OK;
 }
 
+JSObject*
+nsHTMLOptionCollection::NamedItem(JSContext* cx, const nsAString& name,
+                                  ErrorResult& error)
+{
+  nsINode *item = GetNamedItemHelper(mElements, name);
+  if (!item) {
+    return nullptr;
+  }
+  JSObject* wrapper = GetWrapper();
+  JSAutoCompartment ac(cx, wrapper);
+  JS::Value v;
+  if (!mozilla::dom::WrapObject(cx, wrapper, item, item, nullptr, &v)) {
+    error.Throw(NS_ERROR_FAILURE);
+    return nullptr;
+  }
+  return &v.toObject();
+}
+
 NS_IMETHODIMP
 nsHTMLOptionCollection::GetSelect(nsIDOMHTMLSelectElement **aReturn)
 {
   NS_IF_ADDREF(*aReturn = mSelect);
   return NS_OK;
 }
 
 NS_IMETHODIMP
@@ -2182,27 +2219,38 @@ nsHTMLOptionCollection::Add(nsIDOMHTMLOp
 
   if (!mSelect) {
     return NS_ERROR_NOT_INITIALIZED;
   }
 
   return mSelect->Add(aOption, aBefore);
 }
 
-NS_IMETHODIMP
-nsHTMLOptionCollection::Remove(int32_t aIndex)
+void
+nsHTMLOptionCollection::Remove(int32_t aIndex, ErrorResult& aError)
 {
-  NS_ENSURE_TRUE(mSelect, NS_ERROR_UNEXPECTED);
+  if (!mSelect) {
+    aError.Throw(NS_ERROR_UNEXPECTED);
+    return;
+  }
 
   uint32_t len = 0;
   mSelect->GetLength(&len);
   if (aIndex < 0 || (uint32_t)aIndex >= len)
     aIndex = 0;
 
-  return mSelect->Remove(aIndex);
+  aError = mSelect->Remove(aIndex);
+}
+
+NS_IMETHODIMP
+nsHTMLOptionCollection::Remove(int32_t aIndex)
+{
+  ErrorResult rv;
+  Remove(aIndex, rv);
+  return rv.ErrorCode();
 }
 
 void
 nsHTMLSelectElement::UpdateBarredFromConstraintValidation()
 {
   SetBarredFromConstraintValidation(IsDisabled());
 }
 
--- a/content/html/content/src/nsHTMLSelectElement.h
+++ b/content/html/content/src/nsHTMLSelectElement.h
@@ -5,57 +5,63 @@
 #ifndef nsHTMLSelectElement_h___
 #define nsHTMLSelectElement_h___
 
 #include "nsCOMPtr.h"
 #include "nsCOMArray.h"
 #include "nsGenericHTMLElement.h"
 #include "nsIDOMHTMLSelectElement.h"
 #include "nsIDOMHTMLFormElement.h"
+#include "nsIDOMHTMLOptGroupElement.h"
 #include "nsIDOMHTMLOptionElement.h"
 #include "nsIDOMHTMLOptionsCollection.h"
 #include "nsISelectControlFrame.h"
 #include "nsIHTMLCollection.h"
 #include "nsIConstraintValidation.h"
 
 // PresState
 #include "nsXPCOM.h"
 #include "nsPresState.h"
 #include "nsIComponentManager.h"
 #include "nsCheapSets.h"
 #include "nsError.h"
+#include "nsHTMLOptGroupElement.h"
 #include "nsHTMLOptionElement.h"
 #include "nsHTMLFormElement.h"
+#include "mozilla/ErrorResult.h"
+#include "mozilla/dom/UnionTypes.h"
 
 class nsHTMLSelectElement;
 
 /**
  * The collection of options in the select (what you get back when you do
  * select.options in DOM)
  */
-class nsHTMLOptionCollection: public nsIDOMHTMLOptionsCollection,
-                              public nsIHTMLCollection,
+class nsHTMLOptionCollection: public nsIHTMLCollection,
+                              public nsIDOMHTMLOptionsCollection,
                               public nsWrapperCache
 {
+typedef mozilla::dom::HTMLOptionElementOrHTMLOptGroupElement HTMLOptionOrOptGroupElement;
+typedef mozilla::dom::HTMLElementOrLong HTMLElementOrLong;
 public:
   nsHTMLOptionCollection(nsHTMLSelectElement* aSelect);
   virtual ~nsHTMLOptionCollection();
 
   NS_DECL_CYCLE_COLLECTING_ISUPPORTS
 
   virtual JSObject* WrapObject(JSContext *cx, JSObject *scope,
                                bool *triedToWrap);
 
   // nsIDOMHTMLOptionsCollection interface
   NS_DECL_NSIDOMHTMLOPTIONSCOLLECTION
 
   // nsIDOMHTMLCollection interface, all its methods are defined in
   // nsIDOMHTMLOptionsCollection
 
-  virtual nsIContent* GetNodeAt(uint32_t aIndex);
+  virtual nsGenericElement* GetElementAt(uint32_t aIndex);
   virtual nsINode* GetParentObject();
 
   NS_DECL_CYCLE_COLLECTION_SCRIPT_HOLDER_CLASS_AMBIGUOUS(nsHTMLOptionCollection,
                                                          nsIHTMLCollection)
 
   // Helpers for nsHTMLSelectElement
   /**
    * Insert an option
@@ -116,16 +122,31 @@ public:
    * @param aStartIndex the index to start looking at
    * @param aForward TRUE to look forward, FALSE to look backward
    * @return the option index
    */
   nsresult GetOptionIndex(mozilla::dom::Element* aOption,
                           int32_t aStartIndex, bool aForward,
                           int32_t* aIndex);
 
+  virtual JSObject* NamedItem(JSContext* aCx, const nsAString& aName,
+                              mozilla::ErrorResult& error);
+
+  inline void Add(const HTMLOptionOrOptGroupElement& aElement,
+                  const Nullable<HTMLElementOrLong>& aBefore,
+                  mozilla::ErrorResult& aError);
+  void Remove(int32_t aIndex, mozilla::ErrorResult& aError);
+  int32_t GetSelectedIndex(mozilla::ErrorResult& aError);
+  void SetSelectedIndex(int32_t aSelectedIndex, mozilla::ErrorResult& aError);
+  void IndexedSetter(uint32_t aIndex, nsIDOMHTMLOptionElement *aOption,
+                     mozilla::ErrorResult& aError)
+  {
+    aError = SetOption(aIndex, aOption);
+  }
+
 private:
   /** The list of options (holds strong references).  This is infallible, so
    * various members such as InsertOptionAt are also infallible. */
   nsTArray<nsRefPtr<nsHTMLOptionElement> > mElements;
   /** The select element that contains this array */
   nsHTMLSelectElement* mSelect;
 };
 
@@ -396,16 +417,30 @@ public:
   virtual nsXPCClassInfo* GetClassInfo();
 
   virtual nsIDOMNode* AsDOMNode() { return this; }
 
   // nsIConstraintValidation
   nsresult GetValidationMessage(nsAString& aValidationMessage,
                                 ValidityStateType aType);
 
+  /**
+   * Insert aElement before the node given by aBefore
+   */
+  nsresult Add(nsIDOMHTMLElement* aElement, nsIDOMHTMLElement* aBefore = nullptr);
+  nsresult Add(nsIDOMHTMLElement* aElement, int32_t aIndex)
+  {
+    // If item index is out of range, insert to last.
+    // (since beforeElement becomes null, it is inserted to last)
+    nsCOMPtr<nsIDOMHTMLElement> beforeElement =
+      do_QueryInterface(mOptions->GetElementAt(aIndex));
+
+    return Add(aElement, beforeElement);
+  }
+
 protected:
   friend class nsSafeOptionListMutation;
 
   // Helper Methods
   /**
    * Check whether the option specified by the index is selected
    * @param aIndex the index
    * @return whether the option at the index is selected
@@ -589,21 +624,16 @@ protected:
      */
     if (mForm && mForm->HasEverTriedInvalidSubmit()) {
       return true;
     }
 
     return mSelectionHasChanged;
   }
 
-  /**
-   * Insert aElement before the node given by aBefore
-   */
-  nsresult Add(nsIDOMHTMLElement* aElement, nsIDOMHTMLElement* aBefore = nullptr);
-
   /** The options[] array */
   nsRefPtr<nsHTMLOptionCollection> mOptions;
   /** false if the parser is in the middle of adding children. */
   bool            mIsDoneAddingChildren;
   /** true if our disabled state has changed from the default **/
   bool            mDisabledChanged;
   /** true if child nodes are being added or removed.
    *  Used by nsSafeOptionListMutation.
@@ -641,9 +671,30 @@ protected:
   int32_t   mSelectedIndex;
   /**
    * The temporary restore state in case we try to restore before parser is
    * done adding options
    */
   nsCOMPtr<nsSelectState> mRestoreState;
 };
 
+void
+nsHTMLOptionCollection::Add(const HTMLOptionOrOptGroupElement& aElement,
+                            const Nullable<HTMLElementOrLong>& aBefore,
+                            mozilla::ErrorResult& aError)
+{
+  nsIDOMHTMLElement* element;
+  if (aElement.IsHTMLOptionElement()) {
+    element = aElement.GetAsHTMLOptionElement();
+  } else {
+    element = aElement.GetAsHTMLOptGroupElement();
+  }
+
+  if (aBefore.IsNull()) {
+    aError = mSelect->Add(element, (nsIDOMHTMLElement*)nullptr);
+  } else if (aBefore.Value().IsHTMLElement()) {
+    aError = mSelect->Add(element, aBefore.Value().GetAsHTMLElement());
+  } else {
+    aError = mSelect->Add(element, aBefore.Value().GetAsLong());
+  }
+}
+
 #endif
--- a/content/html/content/src/nsHTMLStyleElement.cpp
+++ b/content/html/content/src/nsHTMLStyleElement.cpp
@@ -11,16 +11,17 @@
 #include "nsIDOMStyleSheet.h"
 #include "nsIStyleSheet.h"
 #include "nsStyleLinkElement.h"
 #include "nsNetUtil.h"
 #include "nsIDocument.h"
 #include "nsUnicharUtils.h"
 #include "nsThreadUtils.h"
 #include "nsContentUtils.h"
+#include "nsStubMutationObserver.h"
 
 class nsHTMLStyleElement : public nsGenericHTMLElement,
                            public nsIDOMHTMLStyleElement,
                            public nsStyleLinkElement,
                            public nsStubMutationObserver
 {
 public:
   nsHTMLStyleElement(already_AddRefed<nsINodeInfo> aNodeInfo);
--- a/content/html/content/src/nsHTMLTableElement.cpp
+++ b/content/html/content/src/nsHTMLTableElement.cpp
@@ -20,16 +20,18 @@
 #include "nsRuleData.h"
 #include "nsStyleContext.h"
 #include "nsIDocument.h"
 #include "nsContentUtils.h"
 #include "nsIDOMElement.h"
 #include "nsIHTMLCollection.h"
 #include "nsHTMLStyleSheet.h"
 #include "dombindings.h"
+#include "mozilla/ErrorResult.h"
+#include "mozilla/dom/BindingUtils.h"
 
 using namespace mozilla;
 
 /* ------------------------------ TableRowsCollection -------------------------------- */
 /**
  * This class provides a late-bound collection of rows in a table.
  * mParent is NOT ref-counted to avoid circular references
  */
@@ -43,16 +45,19 @@ public:
   NS_DECL_CYCLE_COLLECTING_ISUPPORTS
   NS_DECL_NSIDOMHTMLCOLLECTION
 
   virtual nsINode* GetParentObject()
   {
     return mParent;
   }
 
+  virtual JSObject* NamedItem(JSContext* cx, const nsAString& name,
+                              ErrorResult& error);
+
   NS_IMETHOD    ParentDestroyed();
 
   NS_DECL_CYCLE_COLLECTION_SCRIPT_HOLDER_CLASS(TableRowsCollection)
 
   // nsWrapperCache
   virtual JSObject* WrapObject(JSContext *cx, JSObject *scope,
                                bool *triedToWrap)
   {
@@ -186,54 +191,54 @@ TableRowsCollection::GetLength(uint32_t*
   );
 
   return NS_OK;
 }
 
 // Returns the item at index aIndex if available. If null is returned,
 // then aCount will be set to the number of rows in this row collection.
 // Otherwise, the value of aCount is undefined.
-static nsIContent*
+static nsGenericElement*
 GetItemOrCountInRowGroup(nsIDOMHTMLCollection* rows,
                          uint32_t aIndex, uint32_t* aCount)
 {
   *aCount = 0;
 
   if (rows) {
     rows->GetLength(aCount);
     if (aIndex < *aCount) {
-      nsCOMPtr<nsINodeList> list = do_QueryInterface(rows);
-      return list->GetNodeAt(aIndex);
+      nsIHTMLCollection* list = static_cast<nsIHTMLCollection*>(rows);
+      return list->GetElementAt(aIndex);
     }
   }
   
   return nullptr;
 }
 
-nsIContent*
-TableRowsCollection::GetNodeAt(uint32_t aIndex)
+nsGenericElement*
+TableRowsCollection::GetElementAt(uint32_t aIndex)
 {
   DO_FOR_EACH_ROWGROUP(
     uint32_t count;
-    nsIContent* node = GetItemOrCountInRowGroup(rows, aIndex, &count);
+    nsGenericElement* node = GetItemOrCountInRowGroup(rows, aIndex, &count);
     if (node) {
       return node; 
     }
 
     NS_ASSERTION(count <= aIndex, "GetItemOrCountInRowGroup screwed up");
     aIndex -= count;
   );
 
   return nullptr;
 }
 
 NS_IMETHODIMP 
 TableRowsCollection::Item(uint32_t aIndex, nsIDOMNode** aReturn)
 {
-  nsISupports* node = GetNodeAt(aIndex);
+  nsISupports* node = GetElementAt(aIndex);
   if (!node) {
     *aReturn = nullptr;
 
     return NS_OK;
   }
 
   return CallQueryInterface(node, aReturn);
 }
@@ -259,16 +264,37 @@ TableRowsCollection::GetNamedItem(const 
     if (item) {
       return item;
     }
   );
   *aCache = nullptr;
   return nullptr;
 }
 
+JSObject*
+TableRowsCollection::NamedItem(JSContext* cx, const nsAString& name,
+                               ErrorResult& error)
+{
+  nsWrapperCache* cache;
+  DO_FOR_EACH_ROWGROUP(
+    nsISupports* item = GetNamedItemInRowGroup(rows, name, &cache);
+    if (item) {
+      JSObject* wrapper = GetWrapper();
+      JSAutoCompartment ac(cx, wrapper);
+      JS::Value v;
+      if (!mozilla::dom::WrapObject(cx, wrapper, item, cache, nullptr, &v)) {
+        error.Throw(NS_ERROR_FAILURE);
+        return nullptr;
+      }
+      return &v.toObject();
+    }
+  );
+  return nullptr;
+}
+
 NS_IMETHODIMP 
 TableRowsCollection::NamedItem(const nsAString& aName,
                                nsIDOMNode** aReturn)
 {
   nsWrapperCache *cache;
   nsISupports* item = GetNamedItem(aName, &cache);
   if (!item) {
     *aReturn = nullptr;
--- a/content/html/content/src/nsHTMLTableRowElement.cpp
+++ b/content/html/content/src/nsHTMLTableRowElement.cpp
@@ -142,17 +142,17 @@ nsHTMLTableRowElement::GetRowIndex(int32
 
   nsCOMPtr<nsIDOMHTMLCollection> rows;
   table->GetRows(getter_AddRefs(rows));
 
   uint32_t numRows;
   rows->GetLength(&numRows);
 
   for (uint32_t i = 0; i < numRows; i++) {
-    if (rows->GetNodeAt(i) == static_cast<nsIContent*>(this)) {
+    if (rows->GetElementAt(i) == this) {
       *aValue = i;
       break;
     }
   }
   return NS_OK;
 }
 
 NS_IMETHODIMP
@@ -165,17 +165,17 @@ nsHTMLTableRowElement::GetSectionRowInde
   }
 
   nsCOMPtr<nsIDOMHTMLCollection> rows;
   section->GetRows(getter_AddRefs(rows));
 
   uint32_t numRows;
   rows->GetLength(&numRows);
   for (uint32_t i = 0; i < numRows; i++) {
-    if (rows->GetNodeAt(i) == static_cast<nsIContent*>(this)) {
+    if (rows->GetElementAt(i) == this) {
       *aValue = i;
       break;
     }
   }
 
   return NS_OK;
 }
 
--- a/content/html/content/src/nsHTMLTitleElement.cpp
+++ b/content/html/content/src/nsHTMLTitleElement.cpp
@@ -3,16 +3,17 @@
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
 #include "nsIDOMHTMLTitleElement.h"
 #include "nsIDOMEventTarget.h"
 #include "nsGenericHTMLElement.h"
 #include "nsStyleConsts.h"
 #include "nsIDocument.h"
 #include "nsContentUtils.h"
+#include "nsStubMutationObserver.h"
 
 class nsHTMLTitleElement : public nsGenericHTMLElement,
                            public nsIDOMHTMLTitleElement,
                            public nsStubMutationObserver
 {
 public:
   using nsGenericElement::GetText;
   using nsGenericElement::SetText;
--- a/content/html/content/src/nsTextEditorState.cpp
+++ b/content/html/content/src/nsTextEditorState.cpp
@@ -21,17 +21,17 @@
 #include "nsIControllers.h"
 #include "nsIDOMHTMLInputElement.h"
 #include "nsIDOMHTMLTextAreaElement.h"
 #include "nsITransactionManager.h"
 #include "nsIControllerContext.h"
 #include "nsAttrValue.h"
 #include "nsGenericHTMLElement.h"
 #include "nsIDOMEventListener.h"
-#include "nsIEditorObserver.h"
+#include "EditActionListener.h"
 #include "nsINativeKeyBindings.h"
 #include "nsIDocumentEncoder.h"
 #include "nsISelectionPrivate.h"
 #include "nsPIDOMWindow.h"
 #include "nsServiceManagerUtils.h"
 #include "nsIEditor.h"
 #include "nsTextEditRules.h"
 #include "mozilla/Selection.h"
@@ -610,17 +610,17 @@ nsTextInputSelectionImpl::CheckVisibilit
   nsCOMPtr<nsISelectionController> shell = do_QueryReferent(mPresShellWeak);
   NS_ENSURE_TRUE(shell, NS_ERROR_FAILURE);
 
   return shell->CheckVisibilityContent(aNode, aStartOffset, aEndOffset, aRetval);
 }
 
 class nsTextInputListener : public nsISelectionListener,
                             public nsIDOMEventListener,
-                            public nsIEditorObserver,
+                            public EditActionListener,
                             public nsSupportsWeakReference
 {
 public:
   /** the default constructor
    */ 
   explicit nsTextInputListener(nsITextControlElement* aTxtCtrlElement);
   /** the default destructor. virtual due to the possibility of derivation.
    */
@@ -635,17 +635,17 @@ public:
   void SetValueChanged(bool aSetValueChanged) { mSetValueChanged = aSetValueChanged; }
 
   NS_DECL_ISUPPORTS
 
   NS_DECL_NSISELECTIONLISTENER
 
   NS_DECL_NSIDOMEVENTLISTENER
 
-  NS_DECL_NSIEDITOROBSERVER
+  virtual void EditAction();
 
 protected:
 
   nsresult  UpdateTextInputCommands(const nsAString& commandsToUpdate);
 
   NS_HIDDEN_(nsINativeKeyBindings*) GetKeyBindings();
 
 protected:
@@ -692,19 +692,18 @@ nsTextInputListener::nsTextInputListener
 , mSetValueChanged(true)
 {
 }
 
 nsTextInputListener::~nsTextInputListener() 
 {
 }
 
-NS_IMPL_ISUPPORTS4(nsTextInputListener,
+NS_IMPL_ISUPPORTS3(nsTextInputListener,
                    nsISelectionListener,
-                   nsIEditorObserver,
                    nsISupportsWeakReference,
                    nsIDOMEventListener)
 
 // BEGIN nsIDOMSelectionListener
 
 NS_IMETHODIMP
 nsTextInputListener::NotifySelectionChanged(nsIDOMDocument* aDoc, nsISelection* aSel, int16_t aReason)
 {
@@ -825,19 +824,17 @@ nsTextInputListener::HandleEvent(nsIDOME
     if (handled) {
       aEvent->PreventDefault();
     }
   }
 
   return NS_OK;
 }
 
-// BEGIN nsIEditorObserver
-
-NS_IMETHODIMP
+void
 nsTextInputListener::EditAction()
 {
   nsWeakFrame weakFrame = mFrame;
 
   nsITextControlFrame* frameBase = do_QueryFrame(mFrame);
   nsTextControlFrame* frame = static_cast<nsTextControlFrame*> (frameBase);
   NS_ASSERTION(frame, "Where is our frame?");
   //
@@ -856,35 +853,30 @@ nsTextInputListener::EditAction()
     // Modify the menu if undo or redo items are different
     UpdateTextInputCommands(NS_LITERAL_STRING("undo"));
 
     mHadUndoItems = numUndoItems != 0;
     mHadRedoItems = numRedoItems != 0;
   }
 
   if (!weakFrame.IsAlive()) {
-    return NS_OK;
+    return;
   }
 
   // Make sure we know we were changed (do NOT set this to false if there are
   // no undo items; JS could change the value and we'd still need to save it)
   if (mSetValueChanged) {
     frame->SetValueChanged(true);
   }
 
   if (!mSettingValue) {
     mTxtCtrlElement->OnValueChanged(true);
   }
-
-  return NS_OK;
 }
 
-// END nsIEditorObserver
-
-
 nsresult
 nsTextInputListener::UpdateTextInputCommands(const nsAString& commandsToUpdate)
 {
   nsIContent* content = mFrame->GetContent();
   NS_ENSURE_TRUE(content, NS_ERROR_FAILURE);
   
   nsCOMPtr<nsIDocument> doc = content->GetDocument();
   NS_ENSURE_TRUE(doc, NS_ERROR_FAILURE);
@@ -1354,17 +1346,17 @@ nsTextEditorState::PrepareEditor(const n
 
   if (!mEditorInitialized) {
     newEditor->PostCreate();
     mEverInited = true;
     mEditorInitialized = true;
   }
 
   if (mTextListener)
-    newEditor->AddEditorObserver(mTextListener);
+    newEditor->SetEditorObserver(mTextListener);
 
   // Restore our selection after being bound to a new frame
   if (mSelectionCached) {
     if (mRestoringSelection) // paranoia
       mRestoringSelection->Revoke();
     mRestoringSelection = new RestoreSelectionState(this, mBoundFrame);
     if (mRestoringSelection) {
       nsContentUtils::AddScriptRunner(mRestoringSelection);
@@ -1378,17 +1370,17 @@ nsTextEditorState::PrepareEditor(const n
 }
 
 void
 nsTextEditorState::DestroyEditor()
 {
   // notify the editor that we are going away
   if (mEditorInitialized) {
     if (mTextListener)
-      mEditor->RemoveEditorObserver(mTextListener);
+      mEditor->RemoveEditorObserver();
 
     mEditor->PreDestroy(true);
     mEditorInitialized = false;
   }
 }
 
 void
 nsTextEditorState::UnbindFromFrame(nsTextControlFrame* aFrame)
--- a/content/html/document/src/nsHTMLDocument.cpp
+++ b/content/html/document/src/nsHTMLDocument.cpp
@@ -1855,18 +1855,18 @@ static void* CreateTokens(nsINode* aRoot
   }
   return tokens;
 }
 
 NS_IMETHODIMP
 nsHTMLDocument::GetItems(const nsAString& types, nsIDOMNodeList** aReturn)
 {
   nsRefPtr<nsContentList> elements = 
-    NS_GetFuncStringContentList(this, MatchItems, DestroyTokens, 
-                                CreateTokens, types);
+    NS_GetFuncStringNodeList(this, MatchItems, DestroyTokens, CreateTokens,
+                             types);
   NS_ENSURE_TRUE(elements, NS_ERROR_OUT_OF_MEMORY);
   elements.forget(aReturn);
   return NS_OK;
 }
 
 
 void
 nsHTMLDocument::AddedForm()
--- a/content/html/document/src/nsHTMLDocument.h
+++ b/content/html/document/src/nsHTMLDocument.h
@@ -100,18 +100,18 @@ public:
   nsISupports *GetDocumentAllResult(const nsAString& aID,
                                     nsWrapperCache **aCache,
                                     nsresult *aResult);
 
   nsIContent *GetBody();
   Element *GetHead() { return GetHeadElement(); }
   already_AddRefed<nsContentList> GetElementsByName(const nsAString & aName)
   {
-    return NS_GetFuncStringContentList(this, MatchNameAttribute, nullptr,
-                                       UseExistingNameString, aName);
+    return NS_GetFuncStringNodeList(this, MatchNameAttribute, nullptr,
+                                    UseExistingNameString, aName);
   }
 
   virtual nsresult ResolveName(const nsAString& aName,
                                nsIContent *aForm,
                                nsISupports **aResult,
                                nsWrapperCache **aCache);
 
   virtual void AddedForm();
--- a/content/svg/content/src/DOMSVGAnimatedLengthList.cpp
+++ b/content/svg/content/src/DOMSVGAnimatedLengthList.cpp
@@ -87,17 +87,17 @@ DOMSVGAnimatedLengthList::InternalBaseVa
   // we MUST keep our baseVal in sync. If we don't, script will either see a
   // list that is too short and be unable to access indexes that should be
   // valid, or else, MUCH WORSE, script will see a list that is too long and be
   // able to access "items" at indexes that are out of bounds (read/write to
   // bad memory)!!
 
   nsRefPtr<DOMSVGAnimatedLengthList> kungFuDeathGrip;
   if (mBaseVal) {
-    if (aNewValue.Length() < mBaseVal->Length()) {
+    if (aNewValue.Length() < mBaseVal->LengthNoFlush()) {
       // InternalListLengthWillChange might clear last reference to |this|.
       // Retain a temporary reference to keep from dying before returning.
       kungFuDeathGrip = this;
     }
     mBaseVal->InternalListLengthWillChange(aNewValue.Length());
   }
 
   // If our attribute is not animating, then our animVal mirrors our baseVal
--- a/content/svg/content/src/DOMSVGAnimatedNumberList.cpp
+++ b/content/svg/content/src/DOMSVGAnimatedNumberList.cpp
@@ -86,17 +86,17 @@ DOMSVGAnimatedNumberList::InternalBaseVa
   // we MUST keep our baseVal in sync. If we don't, script will either see a
   // list that is too short and be unable to access indexes that should be
   // valid, or else, MUCH WORSE, script will see a list that is too long and be
   // able to access "items" at indexes that are out of bounds (read/write to
   // bad memory)!!
 
   nsRefPtr<DOMSVGAnimatedNumberList> kungFuDeathGrip;
   if (mBaseVal) {
-    if (aNewValue.Length() < mBaseVal->Length()) {
+    if (aNewValue.Length() < mBaseVal->LengthNoFlush()) {
       // InternalListLengthWillChange might clear last reference to |this|.
       // Retain a temporary reference to keep from dying before returning.
       kungFuDeathGrip = this;
     }
     mBaseVal->InternalListLengthWillChange(aNewValue.Length());
   }
 
   // If our attribute is not animating, then our animVal mirrors our baseVal
--- a/content/svg/content/src/DOMSVGAnimatedTransformList.cpp
+++ b/content/svg/content/src/DOMSVGAnimatedTransformList.cpp
@@ -89,17 +89,17 @@ DOMSVGAnimatedTransformList::InternalBas
   // we MUST keep our baseVal in sync. If we don't, script will either see a
   // list that is too short and be unable to access indexes that should be
   // valid, or else, MUCH WORSE, script will see a list that is too long and be
   // able to access "items" at indexes that are out of bounds (read/write to
   // bad memory)!!
 
   nsRefPtr<DOMSVGAnimatedTransformList> kungFuDeathGrip;
   if (mBaseVal) {
-    if (aNewLength < mBaseVal->Length()) {
+    if (aNewLength < mBaseVal->LengthNoFlush()) {
       // InternalListLengthWillChange might clear last reference to |this|.
       // Retain a temporary reference to keep from dying before returning.
       kungFuDeathGrip = this;
     }
     mBaseVal->InternalListLengthWillChange(aNewLength);
   }
 
   // If our attribute is not animating, then our animVal mirrors our baseVal
--- a/content/svg/content/src/DOMSVGLengthList.cpp
+++ b/content/svg/content/src/DOMSVGLengthList.cpp
@@ -78,24 +78,18 @@ DOMSVGLengthList::WrapObject(JSContext *
 {
   return mozilla::dom::oldproxybindings::SVGLengthList::create(cx, scope, this,
                                                       triedToWrap);
 }
 
 nsIDOMSVGLength*
 DOMSVGLengthList::GetItemAt(uint32_t aIndex)
 {
-  if (IsAnimValList()) {
-    Element()->FlushAnimations();
-  }
-  if (aIndex < Length()) {
-    EnsureItemAt(aIndex);
-    return mItems[aIndex];
-  }
-  return nullptr;
+  ErrorResult rv;
+  return GetItem(aIndex, rv);
 }
 
 void
 DOMSVGLengthList::InternalListLengthWillChange(uint32_t aNewLength)
 {
   uint32_t oldLength = mItems.Length();
 
   if (aNewLength > DOMSVGLength::MaxListIndex()) {
@@ -139,115 +133,144 @@ DOMSVGLengthList::InternalList() const
 }
 
 // ----------------------------------------------------------------------------
 // nsIDOMSVGLengthList implementation:
 
 NS_IMETHODIMP
 DOMSVGLengthList::GetNumberOfItems(uint32_t *aNumberOfItems)
 {
-  if (IsAnimValList()) {
-    Element()->FlushAnimations();
-  }
-  *aNumberOfItems = Length();
+  *aNumberOfItems = NumberOfItems();
   return NS_OK;
 }
 
-NS_IMETHODIMP
-DOMSVGLengthList::Clear()
+void
+DOMSVGLengthList::Clear(ErrorResult& aError)
 {
   if (IsAnimValList()) {
-    return NS_ERROR_DOM_NO_MODIFICATION_ALLOWED_ERR;
+    aError.Throw(NS_ERROR_DOM_NO_MODIFICATION_ALLOWED_ERR);
+    return;
   }
 
-  if (Length() > 0) {
+  if (LengthNoFlush() > 0) {
     nsAttrValue emptyOrOldValue = Element()->WillChangeLengthList(AttrEnum());
     // Notify any existing DOM items of removal *before* truncating the lists
     // so that they can find their SVGLength internal counterparts and copy
     // their values. This also notifies the animVal list:
     mAList->InternalBaseValListWillChangeTo(SVGLengthList());
 
     mItems.Clear();
     InternalList().Clear();
     Element()->DidChangeLengthList(AttrEnum(), emptyOrOldValue);
     if (mAList->IsAnimating()) {
       Element()->AnimationNeedsResample();
     }
   }
-  return NS_OK;
 }
 
 NS_IMETHODIMP
-DOMSVGLengthList::Initialize(nsIDOMSVGLength *newItem,
-                             nsIDOMSVGLength **_retval)
+DOMSVGLengthList::Clear()
 {
-  *_retval = nullptr;
+  ErrorResult rv;
+  Clear(rv);
+  return rv.ErrorCode();
+}
+
+already_AddRefed<nsIDOMSVGLength>
+DOMSVGLengthList::Initialize(nsIDOMSVGLength *newItem,
+                             ErrorResult& error)
+{
   if (IsAnimValList()) {
-    return NS_ERROR_DOM_NO_MODIFICATION_ALLOWED_ERR;
+    error.Throw(NS_ERROR_DOM_NO_MODIFICATION_ALLOWED_ERR);
+    return nullptr;
   }
 
   // If newItem is already in a list we should insert a clone of newItem, and
   // for consistency, this should happen even if *this* is the list that
   // newItem is currently in. Note that in the case of newItem being in this
   // list, the Clear() call before the InsertItemBefore() call would remove it
   // from this list, and so the InsertItemBefore() call would not insert a
   // clone of newItem, it would actually insert newItem. To prevent that from
   // happening we have to do the clone here, if necessary.
 
   nsCOMPtr<DOMSVGLength> domItem = do_QueryInterface(newItem);
   if (!domItem) {
-    return NS_ERROR_DOM_SVG_WRONG_TYPE_ERR;
+    error.Throw(NS_ERROR_DOM_SVG_WRONG_TYPE_ERR);
+    return nullptr;
   }
   if (domItem->HasOwner()) {
     newItem = domItem->Copy();
   }
 
   Clear();
-  return InsertItemBefore(newItem, 0, _retval);
+  return InsertItemBefore(newItem, 0, error);
+}
+
+NS_IMETHODIMP
+DOMSVGLengthList::Initialize(nsIDOMSVGLength *newItem,
+                             nsIDOMSVGLength **_retval)
+{
+  ErrorResult rv;
+  *_retval = Initialize(newItem, rv).get();
+  return rv.ErrorCode();
+}
+
+nsIDOMSVGLength*
+DOMSVGLengthList::IndexedGetter(uint32_t index, bool& found, ErrorResult& error)
+{
+  if (IsAnimValList()) {
+    Element()->FlushAnimations();
+  }
+  found = index < LengthNoFlush();
+  if (found) {
+    EnsureItemAt(index);
+    return mItems[index];
+  }
+  return nullptr;
 }
 
 NS_IMETHODIMP
 DOMSVGLengthList::GetItem(uint32_t index,
                           nsIDOMSVGLength **_retval)
 {
-  *_retval = GetItemAt(index);
-  if (!*_retval) {
-    return NS_ERROR_DOM_INDEX_SIZE_ERR;
-  }
-  NS_ADDREF(*_retval);
-  return NS_OK;
+  ErrorResult rv;
+  NS_IF_ADDREF(*_retval = GetItem(index, rv));
+  return rv.ErrorCode();
 }
 
-NS_IMETHODIMP
+already_AddRefed<nsIDOMSVGLength>
 DOMSVGLengthList::InsertItemBefore(nsIDOMSVGLength *newItem,
                                    uint32_t index,
-                                   nsIDOMSVGLength **_retval)
+                                   ErrorResult& error)
 {
-  *_retval = nullptr;
   if (IsAnimValList()) {
-    return NS_ERROR_DOM_NO_MODIFICATION_ALLOWED_ERR;
+    error.Throw(NS_ERROR_DOM_NO_MODIFICATION_ALLOWED_ERR);
+    return nullptr;
   }
 
-  index = NS_MIN(index, Length());
+  index = NS_MIN(index, LengthNoFlush());
   if (index >= DOMSVGLength::MaxListIndex()) {
-    return NS_ERROR_DOM_INDEX_SIZE_ERR;
+    error.Throw(NS_ERROR_DOM_INDEX_SIZE_ERR);
+    return nullptr;
   }
 
   nsCOMPtr<DOMSVGLength> domItem = do_QueryInterface(newItem);
   if (!domItem) {
-    return NS_ERROR_DOM_SVG_WRONG_TYPE_ERR;
+    error.Throw(NS_ERROR_DOM_SVG_WRONG_TYPE_ERR);
+    return nullptr;
   }
   if (domItem->HasOwner()) {
     domItem = domItem->Copy(); // must do this before changing anything!
   }
 
   // Ensure we have enough memory so we can avoid complex error handling below:
   if (!mItems.SetCapacity(mItems.Length() + 1) ||
       !InternalList().SetCapacity(InternalList().Length() + 1)) {
-    return NS_ERROR_OUT_OF_MEMORY;
+    error.Throw(NS_ERROR_OUT_OF_MEMORY);
+    return nullptr;
   }
 
   nsAttrValue emptyOrOldValue = Element()->WillChangeLengthList(AttrEnum());
   // Now that we know we're inserting, keep animVal list in sync as necessary.
   MaybeInsertNullInAnimValListAt(index);
 
   InternalList().InsertItem(index, domItem->ToSVGLength());
   mItems.InsertElementAt(index, domItem.get());
@@ -258,36 +281,47 @@ DOMSVGLengthList::InsertItemBefore(nsIDO
   domItem->InsertingIntoList(this, AttrEnum(), index, IsAnimValList());
 
   UpdateListIndicesFromIndex(mItems, index + 1);
 
   Element()->DidChangeLengthList(AttrEnum(), emptyOrOldValue);
   if (mAList->IsAnimating()) {
     Element()->AnimationNeedsResample();
   }
-  domItem.forget(_retval);
-  return NS_OK;
+  return domItem.forget();
 }
 
 NS_IMETHODIMP
+DOMSVGLengthList::InsertItemBefore(nsIDOMSVGLength *newItem,
+                                   uint32_t index,
+                                   nsIDOMSVGLength **_retval)
+{
+  ErrorResult rv;
+  *_retval = InsertItemBefore(newItem, index, rv).get();
+  return rv.ErrorCode();
+}
+
+already_AddRefed<nsIDOMSVGLength>
 DOMSVGLengthList::ReplaceItem(nsIDOMSVGLength *newItem,
                               uint32_t index,
-                              nsIDOMSVGLength **_retval)
+                              ErrorResult& error)
 {
-  *_retval = nullptr;
   if (IsAnimValList()) {
-    return NS_ERROR_DOM_NO_MODIFICATION_ALLOWED_ERR;
+    error.Throw(NS_ERROR_DOM_NO_MODIFICATION_ALLOWED_ERR);
+    return nullptr;
   }
 
   nsCOMPtr<DOMSVGLength> domItem = do_QueryInterface(newItem);
   if (!domItem) {
-    return NS_ERROR_DOM_SVG_WRONG_TYPE_ERR;
+    error.Throw(NS_ERROR_DOM_SVG_WRONG_TYPE_ERR);
+    return nullptr;
   }
-  if (index >= Length()) {
-    return NS_ERROR_DOM_INDEX_SIZE_ERR;
+  if (index >= LengthNoFlush()) {
+    error.Throw(NS_ERROR_DOM_INDEX_SIZE_ERR);
+    return nullptr;
   }
   if (domItem->HasOwner()) {
     domItem = domItem->Copy(); // must do this before changing anything!
   }
 
   nsAttrValue emptyOrOldValue = Element()->WillChangeLengthList(AttrEnum());
   if (mItems[index]) {
     // Notify any existing DOM item of removal *before* modifying the lists so
@@ -301,70 +335,92 @@ DOMSVGLengthList::ReplaceItem(nsIDOMSVGL
   // This MUST come after the ToSVGPoint() call, otherwise that call
   // would end up reading bad data from InternalList()!
   domItem->InsertingIntoList(this, AttrEnum(), index, IsAnimValList());
 
   Element()->DidChangeLengthList(AttrEnum(), emptyOrOldValue);
   if (mAList->IsAnimating()) {
     Element()->AnimationNeedsResample();
   }
-  NS_ADDREF(*_retval = domItem.get());
-  return NS_OK;
+  return domItem.forget();
 }
 
 NS_IMETHODIMP
-DOMSVGLengthList::RemoveItem(uint32_t index,
-                             nsIDOMSVGLength **_retval)
+DOMSVGLengthList::ReplaceItem(nsIDOMSVGLength *newItem,
+                              uint32_t index,
+                              nsIDOMSVGLength **_retval)
 {
-  *_retval = nullptr;
+  ErrorResult rv;
+  *_retval = ReplaceItem(newItem, index, rv).get();
+  return rv.ErrorCode();
+}
+
+already_AddRefed<nsIDOMSVGLength>
+DOMSVGLengthList::RemoveItem(uint32_t index,
+                             ErrorResult& error)
+{
   if (IsAnimValList()) {
-    return NS_ERROR_DOM_NO_MODIFICATION_ALLOWED_ERR;
+    error.Throw(NS_ERROR_DOM_NO_MODIFICATION_ALLOWED_ERR);
+    return nullptr;
   }
 
-  if (index >= Length()) {
-    return NS_ERROR_DOM_INDEX_SIZE_ERR;
+  if (index >= LengthNoFlush()) {
+    error.Throw(NS_ERROR_DOM_INDEX_SIZE_ERR);
+    return nullptr;
   }
 
   nsAttrValue emptyOrOldValue = Element()->WillChangeLengthList(AttrEnum());
   // Now that we know we're removing, keep animVal list in sync as necessary.
   // Do this *before* touching InternalList() so the removed item can get its
   // internal value.
   MaybeRemoveItemFromAnimValListAt(index);
 
   // We have to return the removed item, so make sure it exists:
   EnsureItemAt(index);
 
   // Notify the DOM item of removal *before* modifying the lists so that the
   // DOM item can copy its *old* value:
   mItems[index]->RemovingFromList();
-  NS_ADDREF(*_retval = mItems[index]);
+  nsCOMPtr<nsIDOMSVGLength> result = mItems[index];
 
   InternalList().RemoveItem(index);
   mItems.RemoveElementAt(index);
 
   UpdateListIndicesFromIndex(mItems, index);
 
   Element()->DidChangeLengthList(AttrEnum(), emptyOrOldValue);
   if (mAList->IsAnimating()) {
     Element()->AnimationNeedsResample();
   }
-  return NS_OK;
+  return result.forget();
+}
+
+NS_IMETHODIMP
+DOMSVGLengthList::RemoveItem(uint32_t index,
+                             nsIDOMSVGLength **_retval)
+{
+  ErrorResult rv;
+  *_retval = RemoveItem(index, rv).get();
+  return rv.ErrorCode();
 }
 
 NS_IMETHODIMP
 DOMSVGLengthList::AppendItem(nsIDOMSVGLength *newItem,
                              nsIDOMSVGLength **_retval)
 {
-  return InsertItemBefore(newItem, Length(), _retval);
+  ErrorResult rv;
+  *_retval = AppendItem(newItem, rv).get();
+  return rv.ErrorCode();
 }
 
 NS_IMETHODIMP
-DOMSVGLengthList::GetLength(uint32_t *aNumberOfItems)
+DOMSVGLengthList::GetLength(uint32_t *aLength)
 {
-  return GetNumberOfItems(aNumberOfItems);
+  *aLength = Length();
+  return NS_OK;
 }
 
 void
 DOMSVGLengthList::EnsureItemAt(uint32_t aIndex)
 {
   if (!mItems[aIndex]) {
     mItems[aIndex] = new DOMSVGLength(this, AttrEnum(), aIndex, IsAnimValList());
   }
--- a/content/svg/content/src/DOMSVGLengthList.h
+++ b/content/svg/content/src/DOMSVGLengthList.h
@@ -9,16 +9,17 @@
 #include "DOMSVGAnimatedLengthList.h"
 #include "nsAutoPtr.h"
 #include "nsCycleCollectionParticipant.h"
 #include "nsDebug.h"
 #include "nsIDOMSVGLengthList.h"
 #include "nsTArray.h"
 #include "SVGLengthList.h"
 #include "mozilla/Attributes.h"
+#include "mozilla/ErrorResult.h"
 
 class nsIDOMSVGLength;
 class nsSVGElement;
 
 namespace mozilla {
 
 class DOMSVGLength;
 
@@ -79,26 +80,65 @@ public:
   {
     return static_cast<nsIContent*>(Element());
   }
 
   /**
    * This will normally be the same as InternalList().Length(), except if we've
    * hit OOM in which case our length will be zero.
    */
-  uint32_t Length() const {
+  uint32_t LengthNoFlush() const {
     NS_ABORT_IF_FALSE(mItems.Length() == 0 ||
                       mItems.Length() == InternalList().Length(),
                       "DOM wrapper's list length is out of sync");
     return mItems.Length();
   }
 
   /// Called to notify us to syncronize our length and detach excess items.
   void InternalListLengthWillChange(uint32_t aNewLength);
 
+  uint32_t NumberOfItems() const
+  {
+    if (IsAnimValList()) {
+      Element()->FlushAnimations();
+    }
+    return LengthNoFlush();
+  }
+  void Clear(ErrorResult& aError);
+  already_AddRefed<nsIDOMSVGLength> Initialize(nsIDOMSVGLength *newItem,
+                                               ErrorResult& error);
+  nsIDOMSVGLength* GetItem(uint32_t index, ErrorResult& error)
+  {
+    bool found;
+    nsIDOMSVGLength* item = IndexedGetter(index, found, error);
+    if (!found) {
+      error.Throw(NS_ERROR_DOM_INDEX_SIZE_ERR);
+    }
+    return item;
+  }
+  nsIDOMSVGLength* IndexedGetter(uint32_t index, bool& found,
+                                 ErrorResult& error);
+  already_AddRefed<nsIDOMSVGLength> InsertItemBefore(nsIDOMSVGLength *newItem,
+                                                     uint32_t index,
+                                                     ErrorResult& error);
+  already_AddRefed<nsIDOMSVGLength> ReplaceItem(nsIDOMSVGLength *newItem,
+                                                uint32_t index,
+                                                ErrorResult& error);
+  already_AddRefed<nsIDOMSVGLength> RemoveItem(uint32_t index,
+                                               ErrorResult& error);
+  already_AddRefed<nsIDOMSVGLength> AppendItem(nsIDOMSVGLength *newItem,
+                                               ErrorResult& error)
+  {
+    return InsertItemBefore(newItem, LengthNoFlush(), error);
+  }
+  uint32_t Length() const
+  {
+    return NumberOfItems();
+  }
+
 private:
 
   nsSVGElement* Element() const {
     return mAList->mElement;
   }
 
   uint8_t AttrEnum() const {
     return mAList->mAttrEnum;
--- a/content/svg/content/src/DOMSVGNumberList.cpp
+++ b/content/svg/content/src/DOMSVGNumberList.cpp
@@ -79,24 +79,18 @@ DOMSVGNumberList::WrapObject(JSContext *
 {
   return mozilla::dom::oldproxybindings::SVGNumberList::create(cx, scope, this,
                                                       triedToWrap);
 }
 
 nsIDOMSVGNumber*
 DOMSVGNumberList::GetItemAt(uint32_t aIndex)
 {
-  if (IsAnimValList()) {
-    Element()->FlushAnimations();
-  }
-  if (aIndex < Length()) {
-    EnsureItemAt(aIndex);
-    return mItems[aIndex];
-  }
-  return nullptr;
+  ErrorResult rv;
+  return GetItem(aIndex, rv);
 }
 
 void
 DOMSVGNumberList::InternalListLengthWillChange(uint32_t aNewLength)
 {
   uint32_t oldLength = mItems.Length();
 
   if (aNewLength > DOMSVGNumber::MaxListIndex()) {
@@ -140,115 +134,144 @@ DOMSVGNumberList::InternalList() const
 }
 
 // ----------------------------------------------------------------------------
 // nsIDOMSVGNumberList implementation:
 
 NS_IMETHODIMP
 DOMSVGNumberList::GetNumberOfItems(uint32_t *aNumberOfItems)
 {
-  if (IsAnimValList()) {
-    Element()->FlushAnimations();
-  }
-  *aNumberOfItems = Length();
+  *aNumberOfItems = NumberOfItems();
   return NS_OK;
 }
 
-NS_IMETHODIMP
-DOMSVGNumberList::Clear()
+void
+DOMSVGNumberList::Clear(ErrorResult& error)
 {
   if (IsAnimValList()) {
-    return NS_ERROR_DOM_NO_MODIFICATION_ALLOWED_ERR;
+    error.Throw(NS_ERROR_DOM_NO_MODIFICATION_ALLOWED_ERR);
+    return;
   }
 
-  if (Length() > 0) {
+  if (LengthNoFlush() > 0) {
     nsAttrValue emptyOrOldValue = Element()->WillChangeNumberList(AttrEnum());
     // Notify any existing DOM items of removal *before* truncating the lists
     // so that they can find their SVGNumber internal counterparts and copy
     // their values. This also notifies the animVal list:
     mAList->InternalBaseValListWillChangeTo(SVGNumberList());
 
     mItems.Clear();
     InternalList().Clear();
     Element()->DidChangeNumberList(AttrEnum(), emptyOrOldValue);
     if (mAList->IsAnimating()) {
       Element()->AnimationNeedsResample();
     }
   }
-  return NS_OK;
 }
 
 NS_IMETHODIMP
-DOMSVGNumberList::Initialize(nsIDOMSVGNumber *newItem,
-                             nsIDOMSVGNumber **_retval)
+DOMSVGNumberList::Clear()
 {
-  *_retval = nullptr;
+  ErrorResult rv;
+  Clear(rv);
+  return rv.ErrorCode();
+}
+
+already_AddRefed<nsIDOMSVGNumber>
+DOMSVGNumberList::Initialize(nsIDOMSVGNumber *newItem,
+                             ErrorResult& error)
+{
   if (IsAnimValList()) {
-    return NS_ERROR_DOM_NO_MODIFICATION_ALLOWED_ERR;
+    error.Throw(NS_ERROR_DOM_NO_MODIFICATION_ALLOWED_ERR);
+    return nullptr;
   }
 
   // If newItem is already in a list we should insert a clone of newItem, and
   // for consistency, this should happen even if *this* is the list that
   // newItem is currently in. Note that in the case of newItem being in this
   // list, the Clear() call before the InsertItemBefore() call would remove it
   // from this list, and so the InsertItemBefore() call would not insert a
   // clone of newItem, it would actually insert newItem. To prevent that from
   // happening we have to do the clone here, if necessary.
 
   nsCOMPtr<DOMSVGNumber> domItem = do_QueryInterface(newItem);
   if (!domItem) {
-    return NS_ERROR_DOM_SVG_WRONG_TYPE_ERR;
+    error.Throw(NS_ERROR_DOM_SVG_WRONG_TYPE_ERR);
+    return nullptr;
   }
   if (domItem->HasOwner()) {
     newItem = domItem->Clone();
   }
 
   Clear();
-  return InsertItemBefore(newItem, 0, _retval);
+  return InsertItemBefore(newItem, 0, error);
+}
+
+NS_IMETHODIMP
+DOMSVGNumberList::Initialize(nsIDOMSVGNumber *newItem,
+                             nsIDOMSVGNumber **_retval)
+{
+  ErrorResult rv;
+  *_retval = Initialize(newItem, rv).get();
+  return rv.ErrorCode();
+}
+
+nsIDOMSVGNumber*
+DOMSVGNumberList::IndexedGetter(uint32_t index, bool& found, ErrorResult& error)
+{
+  if (IsAnimValList()) {
+    Element()->FlushAnimations();
+  }
+  found = index < LengthNoFlush();
+  if (found) {
+    EnsureItemAt(index);
+    return mItems[index];
+  }
+  return nullptr;
 }
 
 NS_IMETHODIMP
 DOMSVGNumberList::GetItem(uint32_t index,
                           nsIDOMSVGNumber **_retval)
 {
-  *_retval = GetItemAt(index);
-  if (!*_retval) {
-    return NS_ERROR_DOM_INDEX_SIZE_ERR;
-  }
-  NS_ADDREF(*_retval);
-  return NS_OK;
+  ErrorResult rv;
+  NS_IF_ADDREF(*_retval = GetItem(index, rv));
+  return rv.ErrorCode();
 }
 
-NS_IMETHODIMP
+already_AddRefed<nsIDOMSVGNumber>
 DOMSVGNumberList::InsertItemBefore(nsIDOMSVGNumber *newItem,
                                    uint32_t index,
-                                   nsIDOMSVGNumber **_retval)
+                                   ErrorResult& error)
 {
-  *_retval = nullptr;
   if (IsAnimValList()) {
-    return NS_ERROR_DOM_NO_MODIFICATION_ALLOWED_ERR;
+    error.Throw(NS_ERROR_DOM_NO_MODIFICATION_ALLOWED_ERR);
+    return nullptr;
   }
 
-  index = NS_MIN(index, Length());
+  index = NS_MIN(index, LengthNoFlush());
   if (index >= DOMSVGNumber::MaxListIndex()) {
-    return NS_ERROR_DOM_INDEX_SIZE_ERR;
+    error.Throw(NS_ERROR_DOM_INDEX_SIZE_ERR);
+    return nullptr;
   }
 
   nsCOMPtr<DOMSVGNumber> domItem = do_QueryInterface(newItem);
   if (!domItem) {
-    return NS_ERROR_DOM_SVG_WRONG_TYPE_ERR;
+    error.Throw(NS_ERROR_DOM_SVG_WRONG_TYPE_ERR);
+    return nullptr;
   }
   if (domItem->HasOwner()) {
     domItem = domItem->Clone(); // must do this before changing anything!
   }
 
   // Ensure we have enough memory so we can avoid complex error handling below:
   if (!mItems.SetCapacity(mItems.Length() + 1) ||
       !InternalList().SetCapacity(InternalList().Length() + 1)) {
-    return NS_ERROR_OUT_OF_MEMORY;
+    error.Throw(NS_ERROR_OUT_OF_MEMORY);
+    return nullptr;
   }
 
   nsAttrValue emptyOrOldValue = Element()->WillChangeNumberList(AttrEnum());
   // Now that we know we're inserting, keep animVal list in sync as necessary.
   MaybeInsertNullInAnimValListAt(index);
 
   InternalList().InsertItem(index, domItem->ToSVGNumber());
   mItems.InsertElementAt(index, domItem.get());
@@ -259,36 +282,47 @@ DOMSVGNumberList::InsertItemBefore(nsIDO
   domItem->InsertingIntoList(this, AttrEnum(), index, IsAnimValList());
 
   UpdateListIndicesFromIndex(mItems, index + 1);
 
   Element()->DidChangeNumberList(AttrEnum(), emptyOrOldValue);
   if (mAList->IsAnimating()) {
     Element()->AnimationNeedsResample();
   }
-  domItem.forget(_retval);
-  return NS_OK;
+  return domItem.forget();
 }
 
 NS_IMETHODIMP
+DOMSVGNumberList::InsertItemBefore(nsIDOMSVGNumber *newItem,
+                                   uint32_t index,
+                                   nsIDOMSVGNumber **_retval)
+{
+  ErrorResult rv;
+  *_retval = InsertItemBefore(newItem, index, rv).get();
+  return rv.ErrorCode();
+}
+
+already_AddRefed<nsIDOMSVGNumber>
 DOMSVGNumberList::ReplaceItem(nsIDOMSVGNumber *newItem,
                               uint32_t index,
-                              nsIDOMSVGNumber **_retval)
+                              ErrorResult& error)
 {
-  *_retval = nullptr;
   if (IsAnimValList()) {
-    return NS_ERROR_DOM_NO_MODIFICATION_ALLOWED_ERR;
+    error.Throw(NS_ERROR_DOM_NO_MODIFICATION_ALLOWED_ERR);
+    return nullptr;
   }
 
   nsCOMPtr<DOMSVGNumber> domItem = do_QueryInterface(newItem);
   if (!domItem) {
-    return NS_ERROR_DOM_SVG_WRONG_TYPE_ERR;
+    error.Throw(NS_ERROR_DOM_SVG_WRONG_TYPE_ERR);
+    return nullptr;
   }
-  if (index >= Length()) {
-    return NS_ERROR_DOM_INDEX_SIZE_ERR;
+  if (index >= LengthNoFlush()) {
+    error.Throw(NS_ERROR_DOM_INDEX_SIZE_ERR);
+    return nullptr;
   }
   if (domItem->HasOwner()) {
     domItem = domItem->Clone(); // must do this before changing anything!
   }
 
   nsAttrValue emptyOrOldValue = Element()->WillChangeNumberList(AttrEnum());
   if (mItems[index]) {
     // Notify any existing DOM item of removal *before* modifying the lists so
@@ -302,70 +336,92 @@ DOMSVGNumberList::ReplaceItem(nsIDOMSVGN
   // This MUST come after the ToSVGPoint() call, otherwise that call
   // would end up reading bad data from InternalList()!
   domItem->InsertingIntoList(this, AttrEnum(), index, IsAnimValList());
 
   Element()->DidChangeNumberList(AttrEnum(), emptyOrOldValue);
   if (mAList->IsAnimating()) {
     Element()->AnimationNeedsResample();
   }
-  NS_ADDREF(*_retval = domItem.get());
-  return NS_OK;
+  return domItem.forget();
 }
 
 NS_IMETHODIMP
-DOMSVGNumberList::RemoveItem(uint32_t index,
-                             nsIDOMSVGNumber **_retval)
+DOMSVGNumberList::ReplaceItem(nsIDOMSVGNumber *newItem,
+                              uint32_t index,
+                              nsIDOMSVGNumber **_retval)
 {
-  *_retval = nullptr;
+  ErrorResult rv;
+  *_retval = ReplaceItem(newItem, index, rv).get();
+  return rv.ErrorCode();
+}
+
+already_AddRefed<nsIDOMSVGNumber>
+DOMSVGNumberList::RemoveItem(uint32_t index,
+                             ErrorResult& error)
+{
   if (IsAnimValList()) {
-    return NS_ERROR_DOM_NO_MODIFICATION_ALLOWED_ERR;
+    error.Throw(NS_ERROR_DOM_NO_MODIFICATION_ALLOWED_ERR);
+    return nullptr;
   }
 
-  if (index >= Length()) {
-    return NS_ERROR_DOM_INDEX_SIZE_ERR;
+  if (index >= LengthNoFlush()) {
+    error.Throw(NS_ERROR_DOM_INDEX_SIZE_ERR);
+    return nullptr;
   }
 
   // Now that we know we're removing, keep animVal list in sync as necessary.
   // Do this *before* touching InternalList() so the removed item can get its
   // internal value.
   MaybeRemoveItemFromAnimValListAt(index);
 
   // We have to return the removed item, so make sure it exists:
   EnsureItemAt(index);
 
   nsAttrValue emptyOrOldValue = Element()->WillChangeNumberList(AttrEnum());
   // Notify the DOM item of removal *before* modifying the lists so that the
   // DOM item can copy its *old* value:
   mItems[index]->RemovingFromList();
-  NS_ADDREF(*_retval = mItems[index]);
+  nsCOMPtr<nsIDOMSVGNumber> result = mItems[index];
 
   InternalList().RemoveItem(index);
   mItems.RemoveElementAt(index);
 
   UpdateListIndicesFromIndex(mItems, index);
 
   Element()->DidChangeNumberList(AttrEnum(), emptyOrOldValue);
   if (mAList->IsAnimating()) {
     Element()->AnimationNeedsResample();
   }
-  return NS_OK;
+  return result.forget();
+}
+
+NS_IMETHODIMP
+DOMSVGNumberList::RemoveItem(uint32_t index,
+                             nsIDOMSVGNumber **_retval)
+{
+  ErrorResult rv;
+  *_retval = RemoveItem(index, rv).get();
+  return rv.ErrorCode();
 }
 
 NS_IMETHODIMP
 DOMSVGNumberList::AppendItem(nsIDOMSVGNumber *newItem,
                              nsIDOMSVGNumber **_retval)
 {
-  return InsertItemBefore(newItem, Length(), _retval);
+  ErrorResult rv;
+  *_retval = AppendItem(newItem, rv).get();
+  return rv.ErrorCode();
 }
 
 NS_IMETHODIMP
-DOMSVGNumberList::GetLength(uint32_t *aNumberOfItems)
+DOMSVGNumberList::GetLength(uint32_t *aLength)
 {
-  return GetNumberOfItems(aNumberOfItems);
+  *aLength = Length();
+  return NS_OK;
 }
 
 void
 DOMSVGNumberList::EnsureItemAt(uint32_t aIndex)
 {
   if (!mItems[aIndex]) {
     mItems[aIndex] = new DOMSVGNumber(this, AttrEnum(), aIndex, IsAnimValList());
   }
--- a/content/svg/content/src/DOMSVGNumberList.h
+++ b/content/svg/content/src/DOMSVGNumberList.h
@@ -9,16 +9,17 @@
 #include "DOMSVGAnimatedNumberList.h"
 #include "nsAutoPtr.h"
 #include "nsCycleCollectionParticipant.h"
 #include "nsDebug.h"
 #include "nsIDOMSVGNumberList.h"
 #include "nsTArray.h"
 #include "SVGNumberList.h"
 #include "mozilla/Attributes.h"
+#include "mozilla/ErrorResult.h"
 
 class nsSVGElement;
 
 namespace mozilla {
 
 class DOMSVGNumber;
 
 /**
@@ -78,26 +79,65 @@ public:
   {
     return static_cast<nsIContent*>(Element());
   }
 
   /**
    * This will normally be the same as InternalList().Length(), except if we've
    * hit OOM in which case our length will be zero.
    */
-  uint32_t Length() const {
+  uint32_t LengthNoFlush() const {
     NS_ABORT_IF_FALSE(mItems.Length() == 0 ||
                       mItems.Length() == InternalList().Length(),
                       "DOM wrapper's list length is out of sync");
     return mItems.Length();
   }
 
   /// Called to notify us to syncronize our length and detach excess items.
   void InternalListLengthWillChange(uint32_t aNewLength);
 
+  uint32_t NumberOfItems() const
+  {
+    if (IsAnimValList()) {
+      Element()->FlushAnimations();
+    }
+    return LengthNoFlush();
+  }
+  void Clear(ErrorResult& error);
+  already_AddRefed<nsIDOMSVGNumber> Initialize(nsIDOMSVGNumber *newItem,
+                                               ErrorResult& error);
+  nsIDOMSVGNumber* GetItem(uint32_t index, ErrorResult& error)
+  {
+    bool found;
+    nsIDOMSVGNumber* item = IndexedGetter(index, found, error);
+    if (!found) {
+      error.Throw(NS_ERROR_DOM_INDEX_SIZE_ERR);
+    }
+    return item;
+  }
+  nsIDOMSVGNumber* IndexedGetter(uint32_t index, bool& found,
+                                 ErrorResult& error);
+  already_AddRefed<nsIDOMSVGNumber> InsertItemBefore(nsIDOMSVGNumber *newItem,
+                                                     uint32_t index,
+                                                     ErrorResult& error);
+  already_AddRefed<nsIDOMSVGNumber> ReplaceItem(nsIDOMSVGNumber *newItem,
+                                                uint32_t index,
+                                                ErrorResult& error);
+  already_AddRefed<nsIDOMSVGNumber> RemoveItem(uint32_t index,
+                                               ErrorResult& error);
+  already_AddRefed<nsIDOMSVGNumber> AppendItem(nsIDOMSVGNumber *newItem,
+                                               ErrorResult& error)
+  {
+    return InsertItemBefore(newItem, LengthNoFlush(), error);
+  }
+  uint32_t Length() const
+  {
+    return NumberOfItems();
+  }
+
 private:
 
   nsSVGElement* Element() const {
     return mAList->mElement;
   }
 
   uint8_t AttrEnum() const {
     return mAList->mAttrEnum;
--- a/content/svg/content/src/DOMSVGPathSegList.cpp
+++ b/content/svg/content/src/DOMSVGPathSegList.cpp
@@ -85,24 +85,18 @@ DOMSVGPathSegList::WrapObject(JSContext 
 {
   return mozilla::dom::oldproxybindings::SVGPathSegList::create(cx, scope, this,
                                                        triedToWrap);
 }
 
 nsIDOMSVGPathSeg*
 DOMSVGPathSegList::GetItemAt(uint32_t aIndex)
 {
-  if (IsAnimValList()) {
-    Element()->FlushAnimations();
-  }
-  if (aIndex < Length()) {
-    EnsureItemAt(aIndex);
-    return ItemAt(aIndex);
-  }
-  return nullptr;
+  ErrorResult rv;
+  return GetItem(aIndex, rv);
 }
 
 void
 DOMSVGPathSegList::InternalListWillChangeTo(const SVGPathData& aNewValue)
 {
   // When the number of items in our internal counterpart changes, we MUST stay
   // in sync. Everything in the scary comment in
   // DOMSVGLengthList::InternalBaseValListWillChangeTo applies here just as
@@ -239,31 +233,29 @@ DOMSVGPathSegList::InternalAList() const
 }
 
 // ----------------------------------------------------------------------------
 // nsIDOMSVGPathSegList implementation:
 
 NS_IMETHODIMP
 DOMSVGPathSegList::GetNumberOfItems(uint32_t *aNumberOfItems)
 {
-  if (IsAnimValList()) {
-    Element()->FlushAnimations();
-  }
-  *aNumberOfItems = Length();
+  *aNumberOfItems = NumberOfItems();
   return NS_OK;
 }
 
-NS_IMETHODIMP
-DOMSVGPathSegList::Clear()
+void
+DOMSVGPathSegList::Clear(ErrorResult& aError)
 {
   if (IsAnimValList()) {
-    return NS_ERROR_DOM_NO_MODIFICATION_ALLOWED_ERR;
+    aError.Throw(NS_ERROR_DOM_NO_MODIFICATION_ALLOWED_ERR);
+    return;
   }
 
-  if (Length() > 0) {
+  if (LengthNoFlush() > 0) {
     nsAttrValue emptyOrOldValue = Element()->WillChangePathSegList();
     // DOM list items that are to be removed must be removed before we change
     // the internal list, otherwise they wouldn't be able to copy their
     // internal counterparts' values!
 
     InternalListWillChangeTo(SVGPathData()); // clears mItems
 
     if (!AttrIsAnimating()) {
@@ -276,95 +268,127 @@ DOMSVGPathSegList::Clear()
     }
 
     InternalList().Clear();
     Element()->DidChangePathSegList(emptyOrOldValue);
     if (AttrIsAnimating()) {
       Element()->AnimationNeedsResample();
     }
   }
-  return NS_OK;
 }
 
 NS_IMETHODIMP
-DOMSVGPathSegList::Initialize(nsIDOMSVGPathSeg *aNewItem,
-                              nsIDOMSVGPathSeg **_retval)
+DOMSVGPathSegList::Clear()
 {
-  *_retval = nullptr;
+  ErrorResult rv;
+  Clear(rv);
+  return rv.ErrorCode();
+}
+
+already_AddRefed<nsIDOMSVGPathSeg>
+DOMSVGPathSegList::Initialize(nsIDOMSVGPathSeg *aNewItem, ErrorResult& aError)
+{
   if (IsAnimValList()) {
-    return NS_ERROR_DOM_NO_MODIFICATION_ALLOWED_ERR;
+    aError.Throw(NS_ERROR_DOM_NO_MODIFICATION_ALLOWED_ERR);
+    return nullptr;
   }
 
   // If aNewItem is already in a list we should insert a clone of aNewItem,
   // and for consistency, this should happen even if *this* is the list that
   // aNewItem is currently in. Note that in the case of aNewItem being in this
   // list, the Clear() call before the InsertItemBefore() call would remove it
   // from this list, and so the InsertItemBefore() call would not insert a
   // clone of aNewItem, it would actually insert aNewItem. To prevent that
   // from happening we have to do the clone here, if necessary.
 
   nsCOMPtr<DOMSVGPathSeg> domItem = do_QueryInterface(aNewItem);
   if (!domItem) {
-    return NS_ERROR_DOM_SVG_WRONG_TYPE_ERR;
+    aError.Throw(NS_ERROR_DOM_SVG_WRONG_TYPE_ERR);
+    return nullptr;
   }
   if (domItem->HasOwner()) {
     aNewItem = domItem->Clone();
   }
 
-  Clear();
-  return InsertItemBefore(aNewItem, 0, _retval);
+  Clear(aError);
+  MOZ_ASSERT(!aError.Failed(), "How could this fail?");
+  return InsertItemBefore(aNewItem, 0, aError);
+}
+
+NS_IMETHODIMP
+DOMSVGPathSegList::Initialize(nsIDOMSVGPathSeg *newItem,
+                              nsIDOMSVGPathSeg **_retval)
+{
+  ErrorResult rv;
+  *_retval = Initialize(newItem, rv).get();
+  return rv.ErrorCode();
+}
+
+nsIDOMSVGPathSeg*
+DOMSVGPathSegList::IndexedGetter(uint32_t aIndex, bool& aFound,
+                                 ErrorResult& aError)
+{
+  if (IsAnimValList()) {
+    Element()->FlushAnimations();
+  }
+  aFound = aIndex < LengthNoFlush();
+  if (aFound) {
+    EnsureItemAt(aIndex);
+    return ItemAt(aIndex);
+  }
+  return nullptr;
 }
 
 NS_IMETHODIMP
 DOMSVGPathSegList::GetItem(uint32_t aIndex,
                            nsIDOMSVGPathSeg **_retval)
 {
-  *_retval = GetItemAt(aIndex);
-  if (!*_retval) {
-    return NS_ERROR_DOM_INDEX_SIZE_ERR;
-  }
-  NS_ADDREF(*_retval);
-  return NS_OK;
+  ErrorResult rv;
+  NS_IF_ADDREF(*_retval = GetItem(aIndex, rv));
+  return rv.ErrorCode();
 }
 
-NS_IMETHODIMP
+already_AddRefed<nsIDOMSVGPathSeg>
 DOMSVGPathSegList::InsertItemBefore(nsIDOMSVGPathSeg *aNewItem,
                                     uint32_t aIndex,
-                                    nsIDOMSVGPathSeg **_retval)
+                                    ErrorResult& aError)
 {
-  *_retval = nullptr;
   if (IsAnimValList()) {
-    return NS_ERROR_DOM_NO_MODIFICATION_ALLOWED_ERR;
+    aError.Throw(NS_ERROR_DOM_NO_MODIFICATION_ALLOWED_ERR);
+    return nullptr;
   }
 
   uint32_t internalIndex;
-  if (aIndex < Length()) {
+  if (aIndex < LengthNoFlush()) {
     internalIndex = mItems[aIndex].mInternalDataIndex;
   } else {
-    aIndex = Length();
+    aIndex = LengthNoFlush();
     internalIndex = InternalList().mData.Length();
   }
   if (aIndex >= DOMSVGPathSeg::MaxListIndex()) {
-    return NS_ERROR_DOM_INDEX_SIZE_ERR;
+    aError.Throw(NS_ERROR_DOM_INDEX_SIZE_ERR);
+    return nullptr;
   }
 
   nsCOMPtr<DOMSVGPathSeg> domItem = do_QueryInterface(aNewItem);
   if (!domItem) {
-    return NS_ERROR_DOM_SVG_WRONG_TYPE_ERR;
+    aError.Throw(NS_ERROR_DOM_SVG_WRONG_TYPE_ERR);
+    return nullptr;
   }
   if (domItem->HasOwner()) {
     domItem = domItem->Clone(); // must do this before changing anything!
   }
 
   uint32_t argCount = SVGPathSegUtils::ArgCountForType(domItem->Type());
 
   // Ensure we have enough memory so we can avoid complex error handling below:
   if (!mItems.SetCapacity(mItems.Length() + 1) ||
       !InternalList().mData.SetCapacity(InternalList().mData.Length() + 1 + argCount)) {
-    return NS_ERROR_OUT_OF_MEMORY;
+    aError.Throw(NS_ERROR_OUT_OF_MEMORY);
+    return nullptr;
   }
 
   nsAttrValue emptyOrOldValue = Element()->WillChangePathSegList();
   // Now that we know we're inserting, keep animVal list in sync as necessary.
   MaybeInsertNullInAnimValListAt(aIndex, internalIndex, argCount);
 
   float segAsRaw[1 + NS_SVG_PATH_SEG_MAX_ARGS];
   domItem->ToSVGPathSegEncodedData(segAsRaw);
@@ -378,36 +402,47 @@ DOMSVGPathSegList::InsertItemBefore(nsID
   domItem->InsertingIntoList(this, aIndex, IsAnimValList());
 
   UpdateListIndicesFromIndex(aIndex + 1, argCount + 1);
 
   Element()->DidChangePathSegList(emptyOrOldValue);
   if (AttrIsAnimating()) {
     Element()->AnimationNeedsResample();
   }
-  domItem.forget(_retval);
-  return NS_OK;
+  return domItem.forget();
 }
 
 NS_IMETHODIMP
+DOMSVGPathSegList::InsertItemBefore(nsIDOMSVGPathSeg *aNewItem,
+                                    uint32_t aIndex,
+                                    nsIDOMSVGPathSeg **_retval)
+{
+  ErrorResult rv;
+  *_retval = InsertItemBefore(aNewItem, aIndex, rv).get();
+  return rv.ErrorCode();
+}
+
+already_AddRefed<nsIDOMSVGPathSeg>
 DOMSVGPathSegList::ReplaceItem(nsIDOMSVGPathSeg *aNewItem,
                                uint32_t aIndex,
-                               nsIDOMSVGPathSeg **_retval)
+                               ErrorResult& aError)
 {
-  *_retval = nullptr;
   if (IsAnimValList()) {
-    return NS_ERROR_DOM_NO_MODIFICATION_ALLOWED_ERR;
+    aError.Throw(NS_ERROR_DOM_NO_MODIFICATION_ALLOWED_ERR);
+    return nullptr;
   }
 
   nsCOMPtr<DOMSVGPathSeg> domItem = do_QueryInterface(aNewItem);
   if (!domItem) {
-    return NS_ERROR_DOM_SVG_WRONG_TYPE_ERR;
+    aError.Throw(NS_ERROR_DOM_SVG_WRONG_TYPE_ERR);
+    return nullptr;
   }
-  if (aIndex >= Length()) {
-    return NS_ERROR_DOM_INDEX_SIZE_ERR;
+  if (aIndex >= LengthNoFlush()) {
+    aError.Throw(NS_ERROR_DOM_INDEX_SIZE_ERR);
+    return nullptr;
   }
   if (domItem->HasOwner()) {
     domItem = domItem->Clone(); // must do this before changing anything!
   }
 
   nsAttrValue emptyOrOldValue = Element()->WillChangePathSegList();
   if (ItemAt(aIndex)) {
     // Notify any existing DOM item of removal *before* modifying the lists so
@@ -424,59 +459,70 @@ DOMSVGPathSegList::ReplaceItem(nsIDOMSVG
 
   float segAsRaw[1 + NS_SVG_PATH_SEG_MAX_ARGS];
   domItem->ToSVGPathSegEncodedData(segAsRaw);
 
   bool ok = !!InternalList().mData.ReplaceElementsAt(
                   internalIndex, 1 + oldArgCount,
                   segAsRaw, 1 + newArgCount);
   if (!ok) {
-    return NS_ERROR_OUT_OF_MEMORY;
+    aError.Throw(NS_ERROR_OUT_OF_MEMORY);
+    return nullptr;
   }
   ItemAt(aIndex) = domItem;
 
   // This MUST come after the ToSVGPathSegEncodedData call, otherwise that call
   // would end up reading bad data from InternalList()!
   domItem->InsertingIntoList(this, aIndex, IsAnimValList());
 
   uint32_t delta = newArgCount - oldArgCount;
   if (delta != 0) {
-    for (uint32_t i = aIndex + 1; i < Length(); ++i) {
+    for (uint32_t i = aIndex + 1; i < LengthNoFlush(); ++i) {
       mItems[i].mInternalDataIndex += delta;
     }
   }
 
   Element()->DidChangePathSegList(emptyOrOldValue);
   if (AttrIsAnimating()) {
     Element()->AnimationNeedsResample();
   }
-  NS_ADDREF(*_retval = domItem.get());
-  return NS_OK;
+  return domItem.forget();
 }
 
 NS_IMETHODIMP
-DOMSVGPathSegList::RemoveItem(uint32_t aIndex,
-                              nsIDOMSVGPathSeg **_retval)
+DOMSVGPathSegList::ReplaceItem(nsIDOMSVGPathSeg *aNewItem,
+                               uint32_t aIndex,
+                               nsIDOMSVGPathSeg **_retval)
 {
-  *_retval = nullptr;
+  ErrorResult rv;
+  *_retval = ReplaceItem(aNewItem, aIndex, rv).get();
+  return rv.ErrorCode();
+}
+
+already_AddRefed<nsIDOMSVGPathSeg>
+DOMSVGPathSegList::RemoveItem(uint32_t aIndex,
+                              ErrorResult& aError)
+{
   if (IsAnimValList()) {
-    return NS_ERROR_DOM_NO_MODIFICATION_ALLOWED_ERR;
+    aError.Throw(NS_ERROR_DOM_NO_MODIFICATION_ALLOWED_ERR);
+    return nullptr;
   }
 
-  if (aIndex >= Length()) {
-    return NS_ERROR_DOM_INDEX_SIZE_ERR;
+  if (aIndex >= LengthNoFlush()) {
+    aError.Throw(NS_ERROR_DOM_INDEX_SIZE_ERR);
+    return nullptr;
   }
   // We have to return the removed item, so make sure it exists:
   EnsureItemAt(aIndex);
 
   nsAttrValue emptyOrOldValue = Element()->WillChangePathSegList();
   // Notify the DOM item of removal *before* modifying the lists so that the
   // DOM item can copy its *old* value:
   ItemAt(aIndex)->RemovingFromList();
-  NS_ADDREF(*_retval = ItemAt(aIndex));
+  nsCOMPtr<nsIDOMSVGPathSeg> result = ItemAt(aIndex);
 
   uint32_t internalIndex = mItems[aIndex].mInternalDataIndex;
   uint32_t segType = SVGPathSegUtils::DecodeType(InternalList().mData[internalIndex]);
   uint32_t argCount = SVGPathSegUtils::ArgCountForType(segType);
 
   // Now that we know we're removing, keep animVal list in sync as necessary.
   // Do this *before* touching InternalList() so the removed item can get its
   // internal value.
@@ -486,24 +532,35 @@ DOMSVGPathSegList::RemoveItem(uint32_t a
   mItems.RemoveElementAt(aIndex);
 
   UpdateListIndicesFromIndex(aIndex, -(argCount + 1));
 
   Element()->DidChangePathSegList(emptyOrOldValue);
   if (AttrIsAnimating()) {
     Element()->AnimationNeedsResample();
   }
-  return NS_OK;
+  return result.forget();
+}
+
+NS_IMETHODIMP
+DOMSVGPathSegList::RemoveItem(uint32_t aIndex,
+                              nsIDOMSVGPathSeg **_retval)
+{
+  ErrorResult rv;
+  *_retval = RemoveItem(aIndex, rv).get();
+  return rv.ErrorCode();
 }
 
 NS_IMETHODIMP
 DOMSVGPathSegList::AppendItem(nsIDOMSVGPathSeg *aNewItem,
                               nsIDOMSVGPathSeg **_retval)
 {
-  return InsertItemBefore(aNewItem, Length(), _retval);
+  ErrorResult rv;
+  *_retval = AppendItem(aNewItem, rv).get();
+  return rv.ErrorCode();
 }
 
 NS_IMETHODIMP
 DOMSVGPathSegList::GetLength(uint32_t *aNumberOfItems)
 {
   return GetNumberOfItems(aNumberOfItems);
 }
 
--- a/content/svg/content/src/DOMSVGPathSegList.h
+++ b/content/svg/content/src/DOMSVGPathSegList.h
@@ -10,16 +10,17 @@
 #include "nsCOMPtr.h"
 #include "nsCycleCollectionParticipant.h"
 #include "nsDebug.h"
 #include "nsIDOMSVGPathSegList.h"
 #include "nsSVGElement.h"
 #include "nsTArray.h"
 #include "SVGPathData.h" // IWYU pragma: keep
 #include "mozilla/Attributes.h"
+#include "mozilla/ErrorResult.h"
 
 class nsIDOMSVGPathSeg;
 
 namespace mozilla {
 
 class DOMSVGPathSeg;
 class SVGAnimatedPathSegList;
 
@@ -95,17 +96,17 @@ public:
    */
   static DOMSVGPathSegList*
   GetDOMWrapperIfExists(void *aList);
 
   /**
    * This will normally be the same as InternalList().CountItems(), except if
    * we've hit OOM, in which case our length will be zero.
    */
-  uint32_t Length() const {
+  uint32_t LengthNoFlush() const {
     NS_ABORT_IF_FALSE(mItems.Length() == 0 ||
                       mItems.Length() == InternalList().CountItems(),
                       "DOM wrapper's list length is out of sync");
     return mItems.Length();
   }
 
   /**
    * WATCH OUT! If you add code to call this on a baseVal wrapper, then you
@@ -126,16 +127,55 @@ public:
   void InternalListWillChangeTo(const SVGPathData& aNewValue);
 
   /**
    * Returns true if our attribute is animating (in which case our animVal is
    * not simply a mirror of our baseVal).
    */
   bool AttrIsAnimating() const;
 
+  uint32_t NumberOfItems() const
+  {
+    if (IsAnimValList()) {
+      Element()->FlushAnimations();
+    }
+    return LengthNoFlush();
+  }
+  void Clear(ErrorResult& aError);
+  already_AddRefed<nsIDOMSVGPathSeg> Initialize(nsIDOMSVGPathSeg *aNewItem,
+                                                ErrorResult& aError);
+  nsIDOMSVGPathSeg* GetItem(uint32_t aIndex, ErrorResult& aError)
+  {
+    bool found;
+    nsIDOMSVGPathSeg* item = IndexedGetter(aIndex, found, aError);
+    if (!found) {
+      aError.Throw(NS_ERROR_DOM_INDEX_SIZE_ERR);
+    }
+    return item;
+  }
+  nsIDOMSVGPathSeg* IndexedGetter(uint32_t aIndex, bool& found,
+                                  ErrorResult& aError);
+  already_AddRefed<nsIDOMSVGPathSeg> InsertItemBefore(nsIDOMSVGPathSeg *aNewItem,
+                                                      uint32_t aIndex,
+                                                      ErrorResult& aError);
+  already_AddRefed<nsIDOMSVGPathSeg> ReplaceItem(nsIDOMSVGPathSeg *aNewItem,
+                                                 uint32_t aIndex,
+                                                 ErrorResult& aError);
+  already_AddRefed<nsIDOMSVGPathSeg> RemoveItem(uint32_t aIndex,
+                                                ErrorResult& aError);
+  already_AddRefed<nsIDOMSVGPathSeg> AppendItem(nsIDOMSVGPathSeg *aNewItem,
+                                                ErrorResult& aError)
+  {
+    return InsertItemBefore(aNewItem, LengthNoFlush(), aError);
+  }
+  uint32_t Length() const
+  {
+    return NumberOfItems();
+  }
+
 private:
 
   /**
    * Only our static GetDOMWrapper() factory method may create objects of our
    * type.
    */
   DOMSVGPathSegList(nsSVGElement *aElement, bool aIsAnimValList)
     : mElement(aElement)
@@ -143,17 +183,17 @@ private:
   {
     SetIsDOMBinding();
 
     InternalListWillChangeTo(InternalList()); // Sync mItems
   }
 
   ~DOMSVGPathSegList();
 
-  nsSVGElement* Element() {
+  nsSVGElement* Element() const {
     return mElement.get();
   }
 
   /// Used to determine if this list is the baseVal or animVal list.
   bool IsAnimValList() const {
     return mIsAnimValList;
   }
 
--- a/content/svg/content/src/DOMSVGPointList.cpp
+++ b/content/svg/content/src/DOMSVGPointList.cpp
@@ -107,17 +107,17 @@ DOMSVGPointList::WrapObject(JSContext *c
 }
 
 nsIDOMSVGPoint*
 DOMSVGPointList::GetItemAt(uint32_t aIndex)
 {
   if (IsAnimValList()) {
     Element()->FlushAnimations();
   }
-  if (aIndex < Length()) {
+  if (aIndex < LengthNoFlush()) {
     EnsureItemAt(aIndex);
     return mItems[aIndex];
   }
   return nullptr;
 }
 
 void
 DOMSVGPointList::InternalListWillChangeTo(const SVGPointList& aNewValue)
@@ -183,31 +183,29 @@ DOMSVGPointList::InternalAList() const
 }
 
 // ----------------------------------------------------------------------------
 // nsIDOMSVGPointList implementation:
 
 NS_IMETHODIMP
 DOMSVGPointList::GetNumberOfItems(uint32_t *aNumberOfItems)
 {
-  if (IsAnimValList()) {
-    Element()->FlushAnimations();
-  }
-  *aNumberOfItems = Length();
+  *aNumberOfItems = NumberOfItems();
   return NS_OK;
 }
 
-NS_IMETHODIMP
-DOMSVGPointList::Clear()
+void
+DOMSVGPointList::Clear(ErrorResult& aError)
 {
   if (IsAnimValList()) {
-    return NS_ERROR_DOM_NO_MODIFICATION_ALLOWED_ERR;
+    aError.Throw(NS_ERROR_DOM_NO_MODIFICATION_ALLOWED_ERR);
+    return;
   }
 
-  if (Length() > 0) {
+  if (LengthNoFlush() > 0) {
     nsAttrValue emptyOrOldValue = Element()->WillChangePointList();
     // DOM list items that are to be removed must be removed before we change
     // the internal list, otherwise they wouldn't be able to copy their
     // internal counterparts' values!
 
     InternalListWillChangeTo(SVGPointList()); // clears mItems
 
     if (!AttrIsAnimating()) {
@@ -220,87 +218,117 @@ DOMSVGPointList::Clear()
     }
 
     InternalList().Clear();
     Element()->DidChangePointList(emptyOrOldValue);
     if (AttrIsAnimating()) {
       Element()->AnimationNeedsResample();
     }
   }
-  return NS_OK;
 }
 
 NS_IMETHODIMP
-DOMSVGPointList::Initialize(nsIDOMSVGPoint *aNewItem,
-                            nsIDOMSVGPoint **_retval)
+DOMSVGPointList::Clear()
 {
-  *_retval = nullptr;
+  ErrorResult rv;
+  Clear(rv);
+  return rv.ErrorCode();
+}
+
+already_AddRefed<nsIDOMSVGPoint>
+DOMSVGPointList::Initialize(nsIDOMSVGPoint *aNewItem, ErrorResult& aError)
+{
   if (IsAnimValList()) {
-    return NS_ERROR_DOM_NO_MODIFICATION_ALLOWED_ERR;
+    aError.Throw(NS_ERROR_DOM_NO_MODIFICATION_ALLOWED_ERR);
+    return nullptr;
   }
 
   // If aNewItem is already in a list we should insert a clone of aNewItem,
   // and for consistency, this should happen even if *this* is the list that
   // aNewItem is currently in. Note that in the case of aNewItem being in this
   // list, the Clear() call before the InsertItemBefore() call would remove it
   // from this list, and so the InsertItemBefore() call would not insert a
   // clone of aNewItem, it would actually insert aNewItem. To prevent that
   // from happening we have to do the clone here, if necessary.
 
   nsCOMPtr<DOMSVGPoint> domItem = do_QueryInterface(aNewItem);
   if (!domItem) {
-    return NS_ERROR_DOM_SVG_WRONG_TYPE_ERR;
+    aError.Throw(NS_ERROR_DOM_SVG_WRONG_TYPE_ERR);
+    return nullptr;
   }
   if (domItem->HasOwner() || domItem->IsReadonly()) {
     aNewItem = domItem->Clone();
   }
 
   Clear();
-  return InsertItemBefore(aNewItem, 0, _retval);
+  return InsertItemBefore(aNewItem, 0, aError);
+}
+
+NS_IMETHODIMP
+DOMSVGPointList::Initialize(nsIDOMSVGPoint *aNewItem,
+                            nsIDOMSVGPoint **_retval)
+{
+  ErrorResult rv;
+  *_retval = Initialize(aNewItem, rv).get();
+  return rv.ErrorCode();
+}
+
+nsIDOMSVGPoint*
+DOMSVGPointList::IndexedGetter(uint32_t aIndex, bool& aFound,
+                               ErrorResult& aError)
+{
+  if (IsAnimValList()) {
+    Element()->FlushAnimations();
+  }
+  aFound = aIndex < LengthNoFlush();
+  if (aFound) {
+    EnsureItemAt(aIndex);
+    return mItems[aIndex];
+  }
+  return nullptr;
 }
 
 NS_IMETHODIMP
 DOMSVGPointList::GetItem(uint32_t aIndex,
                          nsIDOMSVGPoint **_retval)
 {
-  *_retval = GetItemAt(aIndex);
-  if (!*_retval) {
-    return NS_ERROR_DOM_INDEX_SIZE_ERR;
-  }
-  NS_ADDREF(*_retval);
-  return NS_OK;
+  ErrorResult rv;
+  NS_IF_ADDREF(*_retval = GetItem(aIndex, rv));
+  return rv.ErrorCode();
 }
 
-NS_IMETHODIMP
-DOMSVGPointList::InsertItemBefore(nsIDOMSVGPoint *aNewItem,
-                                  uint32_t aIndex,
-                                  nsIDOMSVGPoint **_retval)
+already_AddRefed<nsIDOMSVGPoint>
+DOMSVGPointList::InsertItemBefore(nsIDOMSVGPoint *aNewItem, uint32_t aIndex,
+                                  ErrorResult& aError)
 {
-  *_retval = nullptr;
   if (IsAnimValList()) {
-    return NS_ERROR_DOM_NO_MODIFICATION_ALLOWED_ERR;
+    aError.Throw(NS_ERROR_DOM_NO_MODIFICATION_ALLOWED_ERR);
+    return nullptr;
   }
 
-  aIndex = NS_MIN(aIndex, Length());
+  aIndex = NS_MIN(aIndex, LengthNoFlush());
   if (aIndex >= DOMSVGPoint::MaxListIndex()) {
-    return NS_ERROR_DOM_INDEX_SIZE_ERR;
+    aError.Throw(NS_ERROR_DOM_INDEX_SIZE_ERR);
+    return nullptr;
   }
 
   nsCOMPtr<DOMSVGPoint> domItem = do_QueryInterface(aNewItem);
   if (!domItem) {
-    return NS_ERROR_DOM_SVG_WRONG_TYPE_ERR;
+    aError.Throw(NS_ERROR_DOM_SVG_WRONG_TYPE_ERR);
+    return nullptr;
   }
   if (domItem->HasOwner() || domItem->IsReadonly()) {
     domItem = domItem->Clone(); // must do this before changing anything!
   }
 
   // Ensure we have enough memory so we can avoid complex error handling below:
   if (!mItems.SetCapacity(mItems.Length() + 1) ||
       !InternalList().SetCapacity(InternalList().Length() + 1)) {
-    return NS_ERROR_OUT_OF_MEMORY;
+    aError.Throw(NS_ERROR_OUT_OF_MEMORY);
+    return nullptr;
   }
 
   nsAttrValue emptyOrOldValue = Element()->WillChangePointList();
   // Now that we know we're inserting, keep animVal list in sync as necessary.
   MaybeInsertNullInAnimValListAt(aIndex);
 
   InternalList().InsertItem(aIndex, domItem->ToSVGPoint());
   mItems.InsertElementAt(aIndex, domItem.get());
@@ -311,36 +339,46 @@ DOMSVGPointList::InsertItemBefore(nsIDOM
   domItem->InsertingIntoList(this, aIndex, IsAnimValList());
 
   UpdateListIndicesFromIndex(mItems, aIndex + 1);
 
   Element()->DidChangePointList(emptyOrOldValue);
   if (AttrIsAnimating()) {
     Element()->AnimationNeedsResample();
   }
-  domItem.forget(_retval);
-  return NS_OK;
+  return domItem.forget();
 }
 
 NS_IMETHODIMP
-DOMSVGPointList::ReplaceItem(nsIDOMSVGPoint *aNewItem,
-                             uint32_t aIndex,
-                             nsIDOMSVGPoint **_retval)
+DOMSVGPointList::InsertItemBefore(nsIDOMSVGPoint *aNewItem,
+                                  uint32_t aIndex,
+                                  nsIDOMSVGPoint **_retval)
 {
-  *_retval = nullptr;
+  ErrorResult rv;
+  *_retval = InsertItemBefore(aNewItem, aIndex, rv).get();
+  return rv.ErrorCode();
+}
+
+already_AddRefed<nsIDOMSVGPoint>
+DOMSVGPointList::ReplaceItem(nsIDOMSVGPoint *aNewItem, uint32_t aIndex,
+                             ErrorResult& aError)
+{
   if (IsAnimValList()) {
-    return NS_ERROR_DOM_NO_MODIFICATION_ALLOWED_ERR;
+    aError.Throw(NS_ERROR_DOM_NO_MODIFICATION_ALLOWED_ERR);
+    return nullptr;
   }
 
   nsCOMPtr<DOMSVGPoint> domItem = do_QueryInterface(aNewItem);
   if (!domItem) {
-    return NS_ERROR_DOM_SVG_WRONG_TYPE_ERR;
+    aError.Throw(NS_ERROR_DOM_SVG_WRONG_TYPE_ERR);
+    return nullptr;
   }
-  if (aIndex >= Length()) {
-    return NS_ERROR_DOM_INDEX_SIZE_ERR;
+  if (aIndex >= LengthNoFlush()) {
+    aError.Throw(NS_ERROR_DOM_INDEX_SIZE_ERR);
+    return nullptr;
   }
   if (domItem->HasOwner() || domItem->IsReadonly()) {
     domItem = domItem->Clone(); // must do this before changing anything!
   }
 
   nsAttrValue emptyOrOldValue = Element()->WillChangePointList();
   if (mItems[aIndex]) {
     // Notify any existing DOM item of removal *before* modifying the lists so
@@ -354,70 +392,91 @@ DOMSVGPointList::ReplaceItem(nsIDOMSVGPo
   // This MUST come after the ToSVGPoint() call, otherwise that call
   // would end up reading bad data from InternalList()!
   domItem->InsertingIntoList(this, aIndex, IsAnimValList());
 
   Element()->DidChangePointList(emptyOrOldValue);
   if (AttrIsAnimating()) {
     Element()->AnimationNeedsResample();
   }
-  NS_ADDREF(*_retval = domItem.get());
-  return NS_OK;
+  return domItem.forget();
 }
 
 NS_IMETHODIMP
-DOMSVGPointList::RemoveItem(uint32_t aIndex,
-                            nsIDOMSVGPoint **_retval)
+DOMSVGPointList::ReplaceItem(nsIDOMSVGPoint *aNewItem,
+                             uint32_t aIndex,
+                             nsIDOMSVGPoint **_retval)
 {
-  *_retval = nullptr;
+  ErrorResult rv;
+  *_retval = ReplaceItem(aNewItem, aIndex, rv).get();
+  return rv.ErrorCode();
+}
+
+already_AddRefed<nsIDOMSVGPoint>
+DOMSVGPointList::RemoveItem(uint32_t aIndex, ErrorResult& aError)
+{
   if (IsAnimValList()) {
-    return NS_ERROR_DOM_NO_MODIFICATION_ALLOWED_ERR;
+    aError.Throw(NS_ERROR_DOM_NO_MODIFICATION_ALLOWED_ERR);
+    return nullptr;
   }
 
-  if (aIndex >= Length()) {
-    return NS_ERROR_DOM_INDEX_SIZE_ERR;
+  if (aIndex >= LengthNoFlush()) {
+    aError.Throw(NS_ERROR_DOM_INDEX_SIZE_ERR);
+    return nullptr;
   }
 
   nsAttrValue emptyOrOldValue = Element()->WillChangePointList();
   // Now that we know we're removing, keep animVal list in sync as necessary.
   // Do this *before* touching InternalList() so the removed item can get its
   // internal value.
   MaybeRemoveItemFromAnimValListAt(aIndex);
 
   // We have to return the removed item, so make sure it exists:
   EnsureItemAt(aIndex);
 
   // Notify the DOM item of removal *before* modifying the lists so that the
   // DOM item can copy its *old* value:
   mItems[aIndex]->RemovingFromList();
-  NS_ADDREF(*_retval = mItems[aIndex]);
+  nsCOMPtr<nsIDOMSVGPoint> result = mItems[aIndex];
 
   InternalList().RemoveItem(aIndex);
   mItems.RemoveElementAt(aIndex);
 
   UpdateListIndicesFromIndex(mItems, aIndex);
 
   Element()->DidChangePointList(emptyOrOldValue);
   if (AttrIsAnimating()) {
     Element()->AnimationNeedsResample();
   }
-  return NS_OK;
+  return result.forget();
+}
+
+NS_IMETHODIMP
+DOMSVGPointList::RemoveItem(uint32_t aIndex,
+                            nsIDOMSVGPoint **_retval)
+{
+  ErrorResult rv;
+  *_retval = RemoveItem(aIndex, rv).get();
+  return rv.ErrorCode();
 }
 
 NS_IMETHODIMP
 DOMSVGPointList::AppendItem(nsIDOMSVGPoint *aNewItem,
                             nsIDOMSVGPoint **_retval)
 {
-  return InsertItemBefore(aNewItem, Length(), _retval);
+  ErrorResult rv;
+  *_retval = AppendItem(aNewItem, rv).get();
+  return rv.ErrorCode();
 }
 
 NS_IMETHODIMP
-DOMSVGPointList::GetLength(uint32_t *aNumberOfItems)
+DOMSVGPointList::GetLength(uint32_t *aLength)
 {
-  return GetNumberOfItems(aNumberOfItems);
+  *aLength = LengthNoFlush();
+  return NS_OK;
 }
 
 void
 DOMSVGPointList::EnsureItemAt(uint32_t aIndex)
 {
   if (!mItems[aIndex]) {
     mItems[aIndex] = new DOMSVGPoint(this, aIndex, IsAnimValList());
   }
--- a/content/svg/content/src/DOMSVGPointList.h
+++ b/content/svg/content/src/DOMSVGPointList.h
@@ -10,16 +10,17 @@
 #include "nsCOMPtr.h"
 #include "nsCycleCollectionParticipant.h"
 #include "nsDebug.h"
 #include "nsIDOMSVGPointList.h"
 #include "nsSVGElement.h"
 #include "nsTArray.h"
 #include "SVGPointList.h" // IWYU pragma: keep
 #include "mozilla/Attributes.h"
+#include "mozilla/ErrorResult.h"
 
 class nsIDOMSVGPoint;
 
 namespace mozilla {
 
 class DOMSVGPoint;
 class SVGAnimatedPointList;
 
@@ -95,17 +96,17 @@ public:
    */
   static DOMSVGPointList*
   GetDOMWrapperIfExists(void *aList);
 
   /**
    * This will normally be the same as InternalList().Length(), except if
    * we've hit OOM, in which case our length will be zero.
    */
-  uint32_t Length() const {
+  uint32_t LengthNoFlush() const {
     NS_ABORT_IF_FALSE(mItems.Length() == 0 ||
                       mItems.Length() == InternalList().Length(),
                       "DOM wrapper's list length is out of sync");
     return mItems.Length();
   }
 
   /**
    * WATCH OUT! If you add code to call this on a baseVal wrapper, then you
@@ -126,16 +127,55 @@ public:
   void InternalListWillChangeTo(const SVGPointList& aNewValue);
 
   /**
    * Returns true if our attribute is animating (in which case our animVal is
    * not simply a mirror of our baseVal).
    */
   bool AttrIsAnimating() const;
 
+  uint32_t NumberOfItems() const
+  {
+    if (IsAnimValList()) {
+      Element()->FlushAnimations();
+    }
+    return LengthNoFlush();
+  }
+  void Clear(ErrorResult& aError);
+  already_AddRefed<nsIDOMSVGPoint> Initialize(nsIDOMSVGPoint *aNewItem,
+                                              ErrorResult& aError);
+  nsIDOMSVGPoint* GetItem(uint32_t aIndex, ErrorResult& aError)
+  {
+    bool found;
+    nsIDOMSVGPoint* item = IndexedGetter(aIndex, found, aError);
+    if (!found) {
+      aError.Throw(NS_ERROR_DOM_INDEX_SIZE_ERR);
+    }
+    return item;
+  }
+  nsIDOMSVGPoint* IndexedGetter(uint32_t aIndex, bool& aFound,
+                                ErrorResult& aError);
+  already_AddRefed<nsIDOMSVGPoint> InsertItemBefore(nsIDOMSVGPoint *aNewItem,
+                                                     uint32_t aIndex,
+                                                     ErrorResult& aError);
+  already_AddRefed<nsIDOMSVGPoint> ReplaceItem(nsIDOMSVGPoint *aNewItem,
+                                               uint32_t aIndex,
+                                               ErrorResult& aError);
+  already_AddRefed<nsIDOMSVGPoint> RemoveItem(uint32_t aIndex,
+                                              ErrorResult& aError);
+  already_AddRefed<nsIDOMSVGPoint> AppendItem(nsIDOMSVGPoint *aNewItem,
+                                              ErrorResult& aError)
+  {
+    return InsertItemBefore(aNewItem, LengthNoFlush(), aError);
+  }
+  uint32_t Length() const
+  {
+    return NumberOfItems();
+  }
+
 private:
 
   /**
    * Only our static GetDOMWrapper() factory method may create objects of our
    * type.
    */
   DOMSVGPointList(nsSVGElement *aElement, bool aIsAnimValList)
     : mElement(aElement)
@@ -143,17 +183,17 @@ private:
   {
     SetIsDOMBinding();
 
     InternalListWillChangeTo(InternalList()); // Sync mItems
   }
 
   ~DOMSVGPointList();
 
-  nsSVGElement* Element() {
+  nsSVGElement* Element() const {
     return mElement.get();
   }
 
   /// Used to determine if this list is the baseVal or animVal list.
   bool IsAnimValList() const {
     return mIsAnimValList;
   }
 
--- a/content/svg/content/src/DOMSVGTransformList.cpp
+++ b/content/svg/content/src/DOMSVGTransformList.cpp
@@ -79,24 +79,18 @@ DOMSVGTransformList::WrapObject(JSContex
 {
   return mozilla::dom::oldproxybindings::SVGTransformList::create(cx, scope, this,
                                                          triedToWrap);
 }
 
 nsIDOMSVGTransform*
 DOMSVGTransformList::GetItemAt(uint32_t aIndex)
 {
-  if (IsAnimValList()) {
-    Element()->FlushAnimations();
-  }
-  if (aIndex < Length()) {
-    EnsureItemAt(aIndex);
-    return mItems[aIndex];
-  }
-  return nullptr;
+  ErrorResult rv;
+  return GetItem(aIndex, rv);
 }
 
 void
 DOMSVGTransformList::InternalListLengthWillChange(uint32_t aNewLength)
 {
   uint32_t oldLength = mItems.Length();
 
   if (aNewLength > DOMSVGTransform::MaxListIndex()) {
@@ -143,126 +137,154 @@ DOMSVGTransformList::InternalList() cons
 
 //----------------------------------------------------------------------
 // nsIDOMSVGTransformList methods:
 
 /* readonly attribute unsigned long numberOfItems; */
 NS_IMETHODIMP
 DOMSVGTransformList::GetNumberOfItems(uint32_t *aNumberOfItems)
 {
-  if (IsAnimValList()) {
-    Element()->FlushAnimations();
-  }
-  *aNumberOfItems = Length();
+  *aNumberOfItems = NumberOfItems();
   return NS_OK;
 }
 
 /* readonly attribute unsigned long length; */
 NS_IMETHODIMP
 DOMSVGTransformList::GetLength(uint32_t *aLength)
 {
-  return GetNumberOfItems(aLength);
+  *aLength = Length();
+  return NS_OK;
 }
 
-/* void clear (); */
-NS_IMETHODIMP
-DOMSVGTransformList::Clear()
+void
+DOMSVGTransformList::Clear(ErrorResult& error)
 {
   if (IsAnimValList()) {
-    return NS_ERROR_DOM_NO_MODIFICATION_ALLOWED_ERR;
+    error.Throw(NS_ERROR_DOM_NO_MODIFICATION_ALLOWED_ERR);
+    return;
   }
 
-  if (Length() > 0) {
+  if (LengthNoFlush() > 0) {
     nsAttrValue emptyOrOldValue = Element()->WillChangeTransformList();
     // Notify any existing DOM items of removal *before* truncating the lists
     // so that they can find their SVGTransform internal counterparts and copy
     // their values. This also notifies the animVal list:
     mAList->InternalBaseValListWillChangeLengthTo(0);
 
     mItems.Clear();
     InternalList().Clear();
     Element()->DidChangeTransformList(emptyOrOldValue);
     if (mAList->IsAnimating()) {
       Element()->AnimationNeedsResample();
     }
   }
-  return NS_OK;
 }
 
-/* nsIDOMSVGTransform initialize (in nsIDOMSVGTransform newItem); */
+/* void clear (); */
 NS_IMETHODIMP
-DOMSVGTransformList::Initialize(nsIDOMSVGTransform *newItem,
-                                nsIDOMSVGTransform **_retval)
+DOMSVGTransformList::Clear()
 {
-  *_retval = nullptr;
+  ErrorResult rv;
+  Clear(rv);
+  return rv.ErrorCode();
+}
+
+already_AddRefed<nsIDOMSVGTransform>
+DOMSVGTransformList::Initialize(nsIDOMSVGTransform *newItem, ErrorResult& error)
+{
   if (IsAnimValList()) {
-    return NS_ERROR_DOM_NO_MODIFICATION_ALLOWED_ERR;
+    error.Throw(NS_ERROR_DOM_NO_MODIFICATION_ALLOWED_ERR);
+    return nullptr;
   }
 
   // If newItem is already in a list we should insert a clone of newItem, and
   // for consistency, this should happen even if *this* is the list that
   // newItem is currently in. Note that in the case of newItem being in this
   // list, the Clear() call before the InsertItemBefore() call would remove it
   // from this list, and so the InsertItemBefore() call would not insert a
   // clone of newItem, it would actually insert newItem. To prevent that from
   // happening we have to do the clone here, if necessary.
 
   nsCOMPtr<DOMSVGTransform> domItem = do_QueryInterface(newItem);
   if (!domItem) {
-    return NS_ERROR_DOM_SVG_WRONG_TYPE_ERR;
+    error.Throw(NS_ERROR_DOM_SVG_WRONG_TYPE_ERR);
+    return nullptr;
   }
   if (domItem->HasOwner()) {
     newItem = domItem->Clone();
   }
 
-  Clear();
-  return InsertItemBefore(newItem, 0, _retval);
+  Clear(error);
+  MOZ_ASSERT(!error.Failed(), "How could this fail?");
+  return InsertItemBefore(newItem, 0, error);
+}
+
+/* nsIDOMSVGTransform initialize (in nsIDOMSVGTransform newItem); */
+NS_IMETHODIMP
+DOMSVGTransformList::Initialize(nsIDOMSVGTransform *newItem,
+                                nsIDOMSVGTransform **_retval)
+{
+  ErrorResult rv;
+  *_retval = Initialize(newItem, rv).get();
+  return rv.ErrorCode();
+}
+
+nsIDOMSVGTransform*
+DOMSVGTransformList::IndexedGetter(uint32_t index, bool& found,
+                                   ErrorResult& error)
+{
+  if (IsAnimValList()) {
+    Element()->FlushAnimations();
+  }
+  found = index < LengthNoFlush();
+  if (found) {
+    EnsureItemAt(index);
+    return mItems[index];
+  }
+  return nullptr;
 }
 
 /* nsIDOMSVGTransform getItem (in unsigned long index); */
 NS_IMETHODIMP
 DOMSVGTransformList::GetItem(uint32_t index, nsIDOMSVGTransform **_retval)
 {
-  *_retval = GetItemAt(index);
-  if (!*_retval) {
-    return NS_ERROR_DOM_INDEX_SIZE_ERR;
-  }
-  NS_ADDREF(*_retval);
-  return NS_OK;
+  ErrorResult rv;
+  NS_IF_ADDREF(*_retval = GetItem(index, rv));
+  return rv.ErrorCode();
 }
 
-/* nsIDOMSVGTransform insertItemBefore (in nsIDOMSVGTransform newItem,
- *                                      in unsigned long index); */
-NS_IMETHODIMP
+already_AddRefed<nsIDOMSVGTransform>
 DOMSVGTransformList::InsertItemBefore(nsIDOMSVGTransform *newItem,
-                                      uint32_t index,
-                                      nsIDOMSVGTransform **_retval)
+                                      uint32_t index, ErrorResult& error)
 {
-  *_retval = nullptr;
   if (IsAnimValList()) {
-    return NS_ERROR_DOM_NO_MODIFICATION_ALLOWED_ERR;
+    error.Throw(NS_ERROR_DOM_NO_MODIFICATION_ALLOWED_ERR);
+    return nullptr;
   }
 
-  index = NS_MIN(index, Length());
+  index = NS_MIN(index, LengthNoFlush());
   if (index >= DOMSVGTransform::MaxListIndex()) {
-    return NS_ERROR_DOM_INDEX_SIZE_ERR;
+    error.Throw(NS_ERROR_DOM_INDEX_SIZE_ERR);
+    return nullptr;
   }
 
   nsCOMPtr<DOMSVGTransform> domItem = do_QueryInterface(newItem);
   if (!domItem) {
-    return NS_ERROR_DOM_SVG_WRONG_TYPE_ERR;
+    error.Throw(NS_ERROR_DOM_SVG_WRONG_TYPE_ERR);
+    return nullptr;
   }
   if (domItem->HasOwner()) {
     domItem = domItem->Clone(); // must do this before changing anything!
   }
 
   // Ensure we have enough memory so we can avoid complex error handling below:
   if (!mItems.SetCapacity(mItems.Length() + 1) ||
       !InternalList().SetCapacity(InternalList().Length() + 1)) {
-    return NS_ERROR_OUT_OF_MEMORY;
+    error.Throw(NS_ERROR_OUT_OF_MEMORY);
+    return nullptr;
   }
 
   nsAttrValue emptyOrOldValue = Element()->WillChangeTransformList();
   // Now that we know we're inserting, keep animVal list in sync as necessary.
   MaybeInsertNullInAnimValListAt(index);
 
   InternalList().InsertItem(index, domItem->ToSVGTransform());
   mItems.InsertElementAt(index, domItem.get());
@@ -273,38 +295,48 @@ DOMSVGTransformList::InsertItemBefore(ns
   domItem->InsertingIntoList(this, index, IsAnimValList());
 
   UpdateListIndicesFromIndex(mItems, index + 1);
 
   Element()->DidChangeTransformList(emptyOrOldValue);
   if (mAList->IsAnimating()) {
     Element()->AnimationNeedsResample();
   }
-  domItem.forget(_retval);
-  return NS_OK;
+  return domItem.forget();
 }
 
-/* nsIDOMSVGTransform replaceItem (in nsIDOMSVGTransform newItem,
- *                                 in unsigned long index); */
+/* nsIDOMSVGTransform insertItemBefore (in nsIDOMSVGTransform newItem,
+ *                                      in unsigned long index); */
 NS_IMETHODIMP
+DOMSVGTransformList::InsertItemBefore(nsIDOMSVGTransform *newItem,
+                                      uint32_t index,
+                                      nsIDOMSVGTransform **_retval)
+{
+  ErrorResult rv;
+  *_retval = InsertItemBefore(newItem, index, rv).get();
+  return rv.ErrorCode();
+}
+
+already_AddRefed<nsIDOMSVGTransform>
 DOMSVGTransformList::ReplaceItem(nsIDOMSVGTransform *newItem,
-                                 uint32_t index,
-                                 nsIDOMSVGTransform **_retval)
+                                 uint32_t index, ErrorResult& error)
 {
-  *_retval = nullptr;
   if (IsAnimValList()) {
-    return NS_ERROR_DOM_NO_MODIFICATION_ALLOWED_ERR;
+    error.Throw(NS_ERROR_DOM_NO_MODIFICATION_ALLOWED_ERR);
+    return nullptr;
   }
 
   nsCOMPtr<DOMSVGTransform> domItem = do_QueryInterface(newItem);
   if (!domItem) {
-    return NS_ERROR_DOM_SVG_WRONG_TYPE_ERR;
+    error.Throw(NS_ERROR_DOM_SVG_WRONG_TYPE_ERR);
+    return nullptr;
   }
-  if (index >= Length()) {
-    return NS_ERROR_DOM_INDEX_SIZE_ERR;
+  if (index >= LengthNoFlush()) {
+    error.Throw(NS_ERROR_DOM_INDEX_SIZE_ERR);
+    return nullptr;
   }
   if (domItem->HasOwner()) {
     domItem = domItem->Clone(); // must do this before changing anything!
   }
 
   nsAttrValue emptyOrOldValue = Element()->WillChangeTransformList();
   if (mItems[index]) {
     // Notify any existing DOM item of removal *before* modifying the lists so
@@ -318,108 +350,149 @@ DOMSVGTransformList::ReplaceItem(nsIDOMS
   // This MUST come after the ToSVGPoint() call, otherwise that call
   // would end up reading bad data from InternalList()!
   domItem->InsertingIntoList(this, index, IsAnimValList());
 
   Element()->DidChangeTransformList(emptyOrOldValue);
   if (mAList->IsAnimating()) {
     Element()->AnimationNeedsResample();
   }
-  NS_ADDREF(*_retval = domItem.get());
-  return NS_OK;
+  return domItem.forget();
 }
 
-/* nsIDOMSVGTransform removeItem (in unsigned long index); */
+/* nsIDOMSVGTransform replaceItem (in nsIDOMSVGTransform newItem,
+ *                                 in unsigned long index); */
 NS_IMETHODIMP
-DOMSVGTransformList::RemoveItem(uint32_t index, nsIDOMSVGTransform **_retval)
+DOMSVGTransformList::ReplaceItem(nsIDOMSVGTransform *newItem,
+                                 uint32_t index,
+                                 nsIDOMSVGTransform **_retval)
 {
-  *_retval = nullptr;
+  ErrorResult rv;
+  *_retval = ReplaceItem(newItem, index, rv).get();
+  return rv.ErrorCode();
+}
+
+already_AddRefed<nsIDOMSVGTransform>
+DOMSVGTransformList::RemoveItem(uint32_t index, ErrorResult& error)
+{
   if (IsAnimValList()) {
-    return NS_ERROR_DOM_NO_MODIFICATION_ALLOWED_ERR;
+    error.Throw(NS_ERROR_DOM_NO_MODIFICATION_ALLOWED_ERR);
+    return nullptr;
   }
 
-  if (index >= Length()) {
-    return NS_ERROR_DOM_INDEX_SIZE_ERR;
+  if (index >= LengthNoFlush()) {
+    error.Throw(NS_ERROR_DOM_INDEX_SIZE_ERR);
+    return nullptr;
   }
 
   nsAttrValue emptyOrOldValue = Element()->WillChangeTransformList();
   // Now that we know we're removing, keep animVal list in sync as necessary.
   // Do this *before* touching InternalList() so the removed item can get its
   // internal value.
   MaybeRemoveItemFromAnimValListAt(index);
 
   // We have to return the removed item, so make sure it exists:
   EnsureItemAt(index);
 
   // Notify the DOM item of removal *before* modifying the lists so that the
   // DOM item can copy its *old* value:
   mItems[index]->RemovingFromList();
-  NS_ADDREF(*_retval = mItems[index]);
+  nsCOMPtr<nsIDOMSVGTransform> result = mItems[index];
 
   InternalList().RemoveItem(index);
   mItems.RemoveElementAt(index);
 
   UpdateListIndicesFromIndex(mItems, index);
 
   Element()->DidChangeTransformList(emptyOrOldValue);
   if (mAList->IsAnimating()) {
     Element()->AnimationNeedsResample();
   }
-  return NS_OK;
+  return result.forget();
+}
+
+/* nsIDOMSVGTransform removeItem (in unsigned long index); */
+NS_IMETHODIMP
+DOMSVGTransformList::RemoveItem(uint32_t index, nsIDOMSVGTransform **_retval)
+{
+  ErrorResult rv;
+  *_retval = RemoveItem(index, rv).get();
+  return rv.ErrorCode();
 }
 
 /* nsIDOMSVGTransform appendItem (in nsIDOMSVGTransform newItem); */
 NS_IMETHODIMP
 DOMSVGTransformList::AppendItem(nsIDOMSVGTransform *newItem,
                                 nsIDOMSVGTransform **_retval)
 {
-  return InsertItemBefore(newItem, Length(), _retval);
+  ErrorResult rv;
+  *_retval = AppendItem(newItem, rv).get();
+  return rv.ErrorCode();
+}
+
+already_AddRefed<nsIDOMSVGTransform>
+DOMSVGTransformList::CreateSVGTransformFromMatrix(nsIDOMSVGMatrix *matrix,
+                                                  ErrorResult& error)
+{
+  nsCOMPtr<DOMSVGMatrix> domItem = do_QueryInterface(matrix);
+  if (!domItem) {
+    error.Throw(NS_ERROR_DOM_SVG_WRONG_TYPE_ERR);
+    return nullptr;
+  }
+
+  nsCOMPtr<nsIDOMSVGTransform> result = new DOMSVGTransform(domItem->Matrix());
+  return result.forget();
 }
 
 /* nsIDOMSVGTransform createSVGTransformFromMatrix (in nsIDOMSVGMatrix matrix);
  */
 NS_IMETHODIMP
 DOMSVGTransformList::CreateSVGTransformFromMatrix(nsIDOMSVGMatrix *matrix,
                                                   nsIDOMSVGTransform **_retval)
 {
-  nsCOMPtr<DOMSVGMatrix> domItem = do_QueryInterface(matrix);
-  if (!domItem) {
-    return NS_ERROR_DOM_SVG_WRONG_TYPE_ERR;
+  ErrorResult rv;
+  *_retval = CreateSVGTransformFromMatrix(matrix, rv).get();
+  return rv.ErrorCode();
+}
+
+already_AddRefed<nsIDOMSVGTransform>
+DOMSVGTransformList::Consolidate(ErrorResult& error)
+{
+  if (IsAnimValList()) {
+    error.Throw(NS_ERROR_DOM_NO_MODIFICATION_ALLOWED_ERR);
+    return nullptr;
   }
 
-  NS_ADDREF(*_retval = new DOMSVGTransform(domItem->Matrix()));
-  return NS_OK;
+  if (LengthNoFlush() == 0)
+    return nullptr;
+
+  // Note that SVG 1.1 says, "The consolidation operation creates new
+  // SVGTransform object as the first and only item in the list" hence, even if
+  // LengthNoFlush() == 1 we can't return that one item (after making it a
+  // matrix type). We must orphan the existing item and then make a new one.
+
+  // First calculate our matrix
+  gfxMatrix mx = InternalList().GetConsolidationMatrix();
+
+  // Then orphan the existing items
+  Clear(error);
+  MOZ_ASSERT(!error.Failed(), "How could this fail?");
+
+  // And append the new transform
+  nsRefPtr<DOMSVGTransform> transform = new DOMSVGTransform(mx);
+  return InsertItemBefore(transform, LengthNoFlush(), error);
 }
 
 /* nsIDOMSVGTransform consolidate (); */
 NS_IMETHODIMP
 DOMSVGTransformList::Consolidate(nsIDOMSVGTransform **_retval)
 {
-  *_retval = nullptr;
-  if (IsAnimValList()) {
-    return NS_ERROR_DOM_NO_MODIFICATION_ALLOWED_ERR;
-  }
-
-  if (Length() == 0)
-    return NS_OK;
-
-  // Note that SVG 1.1 says, "The consolidation operation creates new
-  // SVGTransform object as the first and only item in the list" hence, even if
-  // Length() == 1 we can't return that one item (after making it a matrix
-  // type). We must orphan the existing item and then make a new one.
-
-  // First calculate our matrix
-  gfxMatrix mx = InternalList().GetConsolidationMatrix();
-
-  // Then orphan the existing items
-  Clear();
-
-  // And append the new transform
-  nsRefPtr<DOMSVGTransform> transform = new DOMSVGTransform(mx);
-  return InsertItemBefore(transform, Length(), _retval);
+  ErrorResult rv;
+  *_retval = Consolidate(rv).get();
+  return rv.ErrorCode();
 }
 
 //----------------------------------------------------------------------
 // Implementation helpers:
 
 void
 DOMSVGTransformList::EnsureItemAt(uint32_t aIndex)
 {
--- a/content/svg/content/src/DOMSVGTransformList.h
+++ b/content/svg/content/src/DOMSVGTransformList.h
@@ -10,16 +10,17 @@
 #include "DOMSVGAnimatedTransformList.h"
 #include "nsAutoPtr.h"
 #include "nsCycleCollectionParticipant.h"
 #include "nsDebug.h"
 #include "nsIDOMSVGTransformList.h"
 #include "nsTArray.h"
 #include "SVGTransformList.h"
 #include "mozilla/Attributes.h"
+#include "mozilla/ErrorResult.h"
 
 class nsIDOMSVGTransform;
 class nsSVGElement;
 
 namespace mozilla {
 
 class DOMSVGTransform;
 
@@ -71,26 +72,68 @@ public:
   {
     return static_cast<nsIContent*>(Element());
   }
 
   /**
    * This will normally be the same as InternalList().Length(), except if we've
    * hit OOM in which case our length will be zero.
    */
-  uint32_t Length() const {
+  uint32_t LengthNoFlush() const {
     NS_ABORT_IF_FALSE(mItems.IsEmpty() ||
       mItems.Length() == InternalList().Length(),
       "DOM wrapper's list length is out of sync");
     return mItems.Length();
   }
 
   /// Called to notify us to synchronize our length and detach excess items.
   void InternalListLengthWillChange(uint32_t aNewLength);
 
+  uint32_t NumberOfItems() const
+  {
+    if (IsAnimValList()) {
+      Element()->FlushAnimations();
+    }
+    return LengthNoFlush();
+  }
+  void Clear(ErrorResult& error);
+  already_AddRefed<nsIDOMSVGTransform> Initialize(nsIDOMSVGTransform *newItem,
+                                                  ErrorResult& error);
+  nsIDOMSVGTransform* GetItem(uint32_t index, ErrorResult& error)
+  {
+    bool found;
+    nsIDOMSVGTransform* item = IndexedGetter(index, found, error);
+    if (!found) {
+      error.Throw(NS_ERROR_DOM_INDEX_SIZE_ERR);
+    }
+    return item;
+  }
+  nsIDOMSVGTransform* IndexedGetter(uint32_t index, bool& found,
+                                    ErrorResult& error);
+  already_AddRefed<nsIDOMSVGTransform> InsertItemBefore(nsIDOMSVGTransform *newItem,
+                                                        uint32_t index,
+                                                        ErrorResult& error);
+  already_AddRefed<nsIDOMSVGTransform> ReplaceItem(nsIDOMSVGTransform *newItem,
+                                                   uint32_t index,
+                                                   ErrorResult& error);
+  already_AddRefed<nsIDOMSVGTransform> RemoveItem(uint32_t index,
+                                                  ErrorResult& error);
+  already_AddRefed<nsIDOMSVGTransform> AppendItem(nsIDOMSVGTransform *newItem,
+                                                  ErrorResult& error)
+  {
+    return InsertItemBefore(newItem, LengthNoFlush(), error);
+  }
+  already_AddRefed<nsIDOMSVGTransform>
+    CreateSVGTransformFromMatrix(nsIDOMSVGMatrix *matrix, ErrorResult& error);
+  already_AddRefed<nsIDOMSVGTransform> Consolidate(ErrorResult& error);
+  uint32_t Length() const
+  {
+    return NumberOfItems();
+  }
+
 private:
 
   nsSVGElement* Element() const {
     return mAList->mElement;
   }
 
   /// Used to determine if this list is the baseVal or animVal list.
   bool IsAnimValList() const {
--- a/content/svg/content/src/nsSVGStyleElement.cpp
+++ b/content/svg/content/src/nsSVGStyleElement.cpp
@@ -5,16 +5,17 @@
 
 #include "nsSVGElement.h"
 #include "nsGkAtoms.h"
 #include "nsIDOMSVGStyleElement.h"
 #include "nsUnicharUtils.h"
 #include "nsIDocument.h"
 #include "nsStyleLinkElement.h"
 #include "nsContentUtils.h"
+#include "nsStubMutationObserver.h"
 
 using namespace mozilla;
 
 typedef nsSVGElement nsSVGStyleElementBase;
 
 class nsSVGStyleElement : public nsSVGStyleElementBase,
                           public nsIDOMSVGStyleElement,
                           public nsStyleLinkElement,
--- a/content/svg/content/src/nsSVGTitleElement.cpp
+++ b/content/svg/content/src/nsSVGTitleElement.cpp
@@ -1,15 +1,16 @@
 /* -*- Mode: C++; tab-width: 2; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
 /* This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
 
 #include "nsSVGStylableElement.h"
 #include "nsIDOMSVGTitleElement.h"
+#include "nsStubMutationObserver.h"
 
 typedef nsSVGStylableElement nsSVGTitleElementBase;
 
 class nsSVGTitleElement : public nsSVGTitleElementBase,
                           public nsIDOMSVGTitleElement,
                           public nsStubMutationObserver
 {
 protected:
--- a/dom/base/nsDOMClassInfo.cpp
+++ b/dom/base/nsDOMClassInfo.cpp
@@ -483,16 +483,17 @@ using mozilla::dom::indexedDB::IDBWrappe
 
 #include "nsIDOMMediaQueryList.h"
 
 #include "nsDOMTouchEvent.h"
 #include "nsDOMMutationObserver.h"
 
 #include "nsWrapperCacheInlines.h"
 #include "dombindings.h"
+#include "mozilla/dom/HTMLCollectionBinding.h"
 
 #include "nsIDOMBatteryManager.h"
 #include "BatteryManager.h"
 #include "nsIDOMPowerManager.h"
 #include "nsIDOMWakeLock.h"
 #include "nsIDOMSmsManager.h"
 #include "nsIDOMSmsMessage.h"
 #include "nsIDOMSmsEvent.h"
@@ -8854,25 +8855,26 @@ nsHTMLDocumentSH::GetDocumentAllNodeList
   // in a reserved slot (0) on the document.all JSObject.
   nsresult rv = NS_OK;
 
   jsval collection = JS_GetReservedSlot(obj, 0);
 
   if (!JSVAL_IS_PRIMITIVE(collection)) {
     // We already have a node list in our reserved slot, use it.
     JSObject *obj = JSVAL_TO_OBJECT(collection);
-    if (mozilla::dom::oldproxybindings::HTMLCollection::objIsWrapper(obj)) {
-      nsIHTMLCollection *native =
-        mozilla::dom::oldproxybindings::HTMLCollection::getNative(obj);
-      NS_ADDREF(*nodeList = static_cast<nsContentList*>(native));
+    nsIHTMLCollection* htmlCollection;
+    rv = mozilla::dom::UnwrapObject<nsIHTMLCollection>(cx, obj, htmlCollection);
+    if (NS_SUCCEEDED(rv)) {
+      NS_ADDREF(*nodeList = static_cast<nsContentList*>(htmlCollection));
     }
     else {
       nsISupports *native = sXPConnect->GetNativeOfWrapper(cx, obj);
       if (native) {
         NS_ADDREF(*nodeList = nsContentList::FromSupports(native));
+        rv = NS_OK;
       }
       else {
         rv = NS_ERROR_FAILURE;
       }
     }
   } else {
     // No node list for this document.all yet, create one...
 
@@ -9587,17 +9589,17 @@ nsHTMLSelectElementSH::NewResolve(nsIXPC
 {
   int32_t n = GetArrayIndexFromId(cx, id);
   if (n >= 0) {
     nsHTMLSelectElement *s =
       nsHTMLSelectElement::FromSupports(GetNative(wrapper, obj));
 
     nsHTMLOptionCollection *options = s->GetOptions();
     if (options) {
-      nsISupports *node = options->GetNodeAt(n);
+      nsISupports *node = options->GetElementAt(n);
       if (node) {
         *objp = obj;
         *_retval = JS_DefineElement(cx, obj, uint32_t(n), JSVAL_VOID, nullptr, nullptr,
                                     JSPROP_ENUMERATE | JSPROP_SHARED);
 
         return NS_OK;
       }
     }
@@ -9616,17 +9618,17 @@ nsHTMLSelectElementSH::GetProperty(nsIXP
   nsresult rv = NS_OK;
   if (n >= 0) {
     nsHTMLSelectElement *s =
       nsHTMLSelectElement::FromSupports(GetNative(wrapper, obj));
 
     nsHTMLOptionCollection *options = s->GetOptions();
 
     if (options) {
-      nsISupports *node = options->GetNodeAt(n);
+      nsISupports *node = options->GetElementAt(n);
 
       rv = WrapNative(cx, JS_GetGlobalForScopeChain(cx), node,
                       &NS_GET_IID(nsIDOMNode), true, vp);
       if (NS_SUCCEEDED(rv)) {
         rv = NS_SUCCESS_I_DID_SOMETHING;
       }
       return rv;
     }
--- a/dom/bindings/Bindings.conf
+++ b/dom/bindings/Bindings.conf
@@ -86,16 +86,24 @@ DOMInterfaces = {
     ],
     'resultNotAddRefed': [ 'canvas' ],
     'binaryNames': {
         'mozImageSmoothingEnabled': 'imageSmoothingEnabled',
         'mozFillRule': 'fillRule'
     }
 }],
 
+'ClientRectList': [
+{
+    'nativeType': 'nsClientRectList',
+    'headerFile': 'nsClientRect.h',
+    'prefable': True,
+    'resultNotAddRefed': [ 'item' ]
+}],
+
 'CSS2Properties': {
   'nativeType': 'nsDOMCSSDeclaration',
   'prefable': True,
 },
 
 'CSSStyleDeclaration': {
   'nativeType': 'nsICSSDeclaration',
   'prefable': True
@@ -104,16 +112,34 @@ DOMInterfaces = {
 'Document': [
 {
     'nativeType': 'nsIDocument',
 },
 {
     'workers': True,
 }],
 
+'DOMSettableTokenList': [
+{
+    'nativeType': 'nsDOMSettableTokenList',
+    'prefable': True,
+    'binaryNames': {
+        '__stringifier': 'Stringify'
+    }
+}],
+
+'DOMTokenList': [
+{
+    'nativeType': 'nsDOMTokenList',
+    'prefable': True,
+    'binaryNames': {
+        '__stringifier': 'Stringify'
+    }
+}],
+
 'Event': [
 {
 },
 {
     'workers': True,
 }],
 
 'EventListener': [
@@ -131,23 +157,56 @@ DOMInterfaces = {
     'prefable': True,
 },
 {
     'workers': True,
     'headerFile': 'mozilla/dom/workers/bindings/EventTarget.h',
     'concrete': False
 }],
 
+'FileList': [
+{
+    'nativeType': 'nsDOMFileList',
+    'headerFile': 'nsDOMFile.h',
+    'prefable': True,
+    'resultNotAddRefed': [ 'item' ]
+}],
+
 'FormData': [
 {
 },
 {
     'workers': True,
 }],
 
+'HTMLCollection': [
+{
+    'nativeType': 'nsIHTMLCollection',
+    'prefable': True,
+    'resultNotAddRefed': [ 'item' ]
+}],
+
+'HTMLOptionsCollection': [
+{
+    'nativeType': 'nsHTMLOptionCollection',
+    'headerFile': 'nsHTMLSelectElement.h',
+    'prefable': True,
+    'resultNotAddRefed': [ 'item' ],
+    'binaryNames': {
+        '__indexedsettercreator': 'SetOption'
+    }
+}],
+
+'HTMLPropertiesCollection': [
+{
+    'headerFile': 'HTMLPropertiesCollection.h',
+    'prefable': True,
+    'resultNotAddRefed': [ 'item', 'namedItem', 'names' ]
+}],
+
 'IID': [
 {
     'nativeType': 'nsIJSIID',
     'headerFile': 'xpcjsid.h',
 },
 {
     'workers': True,
 }],
@@ -165,31 +224,93 @@ DOMInterfaces = {
 {
     'nativeType': 'nsIChannel',
     'notflattened': True
 },
 {
     'workers': True,
 }],
 
+'NodeList': [
+{
+    'nativeType': 'nsINodeList',
+    'prefable': True,
+    'resultNotAddRefed': [ 'item' ]
+}],
+
+'PaintRequestList': [
+{
+    'nativeType': 'nsPaintRequestList',
+    'headerFile': 'nsPaintRequest.h',
+    'prefable': True,
+    'resultNotAddRefed': [ 'item' ]
+}],
+
 'Performance': {
     'nativeType': 'nsPerformance',
     'resultNotAddRefed': [ 'timing', 'navigation' ]
 },
 
 'PerformanceTiming': {
     'nativeType': 'nsPerformanceTiming',
     'headerFile': 'nsPerformance.h'
 },
 
 'PerformanceNavigation': {
     'nativeType': 'nsPerformanceNavigation',
     'headerFile': 'nsPerformance.h'
 },
 
+'PropertyNodeList': [
+{
+    'headerFile': 'HTMLPropertiesCollection.h',
+    'prefable': True,
+    'resultNotAddRefed': [ 'item' ]
+}],
+
+'SVGLengthList': [
+{
+    'nativeType': 'mozilla::DOMSVGLengthList',
+    'headerFile': 'DOMSVGLengthList.h',
+    'prefable': True,
+    'resultNotAddRefed': [ 'getItem' ]
+}],
+
+'SVGNumberList': [
+{
+    'nativeType': 'mozilla::DOMSVGNumberList',
+    'headerFile': 'DOMSVGNumberList.h',
+    'prefable': True,
+    'resultNotAddRefed': [ 'getItem' ]
+}],
+
+'SVGPathSegList': [
+{
+    'nativeType': 'mozilla::DOMSVGPathSegList',
+    'headerFile': 'DOMSVGPathSegList.h',
+    'prefable': True,
+    'resultNotAddRefed': [ 'getItem' ]
+}],
+
+'SVGPointList': [
+{
+    'nativeType': 'mozilla::DOMSVGPointList',
+    'headerFile': 'DOMSVGPointList.h',
+    'prefable': True,
+    'resultNotAddRefed': [ 'getItem' ]
+}],
+
+'SVGTransformList': [
+{
+    'nativeType': 'mozilla::DOMSVGTransformList',
+    'headerFile': 'DOMSVGTransformList.h',
+    'prefable': True,
+    'resultNotAddRefed': [ 'getItem' ]
+}],
+
 'WebGLRenderingContext': {
   'nativeType': 'mozilla::WebGLContext',
   'headerFile': 'WebGLContext.h',
   'prefable': True,
   'resultNotAddRefed': [ 'canvas', 'getContextAttributes', 'getExtension',
                          'getAttachedShaders' ],
   'implicitJSContext': [ 'texImage2D', 'texSubImage2D' ],
 },
@@ -352,24 +473,41 @@ def addExternalIface(iface, nativeType=N
 # macros added for it
 def addExternalHTMLElement(element):
    nativeElement = 'ns' + element
    addExternalIface(element, nativeType=nativeElement,
                     headerFile=nativeElement + '.h')
 
 addExternalHTMLElement('HTMLCanvasElement')
 addExternalHTMLElement('HTMLImageElement')
+addExternalHTMLElement('HTMLOptionElement')
+addExternalHTMLElement('HTMLOptGroupElement')
 addExternalHTMLElement('HTMLVideoElement')
 addExternalIface('CanvasGradient', headerFile='nsIDOMCanvasRenderingContext2D.h')
 addExternalIface('CanvasPattern', headerFile='nsIDOMCanvasRenderingContext2D.h')
+addExternalIface('ClientRect')
 addExternalIface('CSSRule')
 addExternalIface('CSSValue')
+addExternalIface('DOMStringList', nativeType='nsDOMStringList',
+                 headerFile='nsDOMLists.h')
+addExternalIface('Element', nativeType='nsGenericElement')
+addExternalIface('File')
 addExternalIface('HitRegionOptions', nativeType='nsISupports')
+addExternalIface('HTMLElement')
 addExternalIface('ImageData', nativeType='mozilla::dom::ImageData')
+addExternalIface('Node', nativeType='nsINode')
+addExternalIface('PaintRequest')
+addExternalIface('SVGLength')
+addExternalIface('SVGMatrix')
+addExternalIface('SVGNumber')
+addExternalIface('SVGPathSeg')
+addExternalIface('SVGPoint')
+addExternalIface('SVGTransform')
 addExternalIface('TextMetrics', headerFile='nsIDOMCanvasRenderingContext2D.h')
+addExternalIface('Touch', headerFile='nsIDOMTouchEvent.h')
 addExternalIface('WebGLActiveInfo', nativeType='mozilla::WebGLActiveInfo',
                  headerFile='WebGLContext.h')
 addExternalIface('WebGLBuffer', nativeType='mozilla::WebGLBuffer',
                  headerFile='WebGLContext.h')
 addExternalIface('WebGLContextAttributes', nativeType='JSObject',
                  headerFile='jsapi.h')
 addExternalIface('WebGLExtension', nativeType='nsIWebGLExtension',
                  headerFile='WebGLContext.h')
--- a/dom/bindings/Codegen.py
+++ b/dom/bindings/Codegen.py
@@ -1361,47 +1361,49 @@ class CGIsMethod(CGAbstractMethod):
         args = [Argument('JSObject*', 'obj')]
         CGAbstractMethod.__init__(self, descriptor, 'Is', 'bool', args)
 
     def definition_body(self):
         # Non-proxy implementation would check
         #   js::GetObjectJSClass(obj) == &Class.mBase
         return """  return IsProxy(obj);"""
 
+def CreateBindingJSObject(descriptor, parent):
+    if descriptor.proxy:
+        create = """  JSObject *obj = NewProxyObject(aCx, DOMProxyHandler::getInstance(),
+                                 JS::PrivateValue(aObject), proto, %s);
+  if (!obj) {
+    return NULL;
+  }
+
+"""
+    else:
+        create = """  JSObject* obj = JS_NewObject(aCx, &Class.mBase, proto, %s);
+  if (!obj) {
+    return NULL;
+  }
+
+  js::SetReservedSlot(obj, DOM_OBJECT_SLOT, PRIVATE_TO_JSVAL(aObject));
+"""
+    return create % parent
+
 class CGWrapWithCacheMethod(CGAbstractMethod):
     def __init__(self, descriptor):
         assert descriptor.interface.hasInterfacePrototypeObject()
         args = [Argument('JSContext*', 'aCx'), Argument('JSObject*', 'aScope'),
                 Argument(descriptor.nativeType + '*', 'aObject'),
                 Argument('nsWrapperCache*', 'aCache'),
                 Argument('bool*', 'aTriedToWrap')]
         CGAbstractMethod.__init__(self, descriptor, 'Wrap', 'JSObject*', args)
 
     def definition_body(self):
         if self.descriptor.workers:
             return """  *aTriedToWrap = true;
   return aObject->GetJSObject();"""
 
-        if self.descriptor.proxy:
-            create = """  JSObject *obj = NewProxyObject(aCx, DOMProxyHandler::getInstance(),
-                                 JS::PrivateValue(aObject), proto, parent);
-  if (!obj) {
-    return NULL;
-  }
-
-"""
-        else:
-            create = """  JSObject* obj = JS_NewObject(aCx, &Class.mBase, proto, parent);
-  if (!obj) {
-    return NULL;
-  }
-
-  js::SetReservedSlot(obj, DOM_OBJECT_SLOT, PRIVATE_TO_JSVAL(aObject));
-"""
-
         return """  *aTriedToWrap = true;
 
   JSObject* parent = WrapNativeParent(aCx, aScope, aObject->GetParentObject());
   if (!parent) {
     return NULL;
   }
 
   JSAutoCompartment ac(aCx, parent);
@@ -1412,17 +1414,18 @@ class CGWrapWithCacheMethod(CGAbstractMe
     return NULL;
   }
 
 %s
   NS_ADDREF(aObject);
 
   aCache->SetWrapper(obj);
 
-  return obj;""" % (CheckPref(self.descriptor, "global", "*aTriedToWrap", "NULL", "aCache"), create)
+  return obj;""" % (CheckPref(self.descriptor, "global", "*aTriedToWrap", "NULL", "aCache"),
+                    CreateBindingJSObject(self.descriptor, "parent"))
 
 class CGWrapMethod(CGAbstractMethod):
     def __init__(self, descriptor):
         # XXX can we wrap if we don't have an interface prototype object?
         assert descriptor.interface.hasInterfacePrototypeObject()
         args = [Argument('JSContext*', 'aCx'), Argument('JSObject*', 'aScope'),
                 Argument('T*', 'aObject'), Argument('bool*', 'aTriedToWrap')]
         CGAbstractMethod.__init__(self, descriptor, 'Wrap', 'JSObject*', args, inline=True, templateArgs=["class T"])
@@ -1441,25 +1444,20 @@ class CGWrapNonWrapperCacheMethod(CGAbst
     def definition_body(self):
         return """
   JSObject* global = JS_GetGlobalForObject(aCx, aScope);
   JSObject* proto = GetProtoObject(aCx, global, global);
   if (!proto) {
     return NULL;
   }
 
-  JSObject* obj = JS_NewObject(aCx, &Class.mBase, proto, global);
-  if (!obj) {
-    return NULL;
-  }
-
-  js::SetReservedSlot(obj, DOM_OBJECT_SLOT, PRIVATE_TO_JSVAL(aObject));
+%s
   NS_ADDREF(aObject);
 
-  return obj;"""
+  return obj;""" % CreateBindingJSObject(self.descriptor, "global")
 
 builtinNames = {
     IDLType.Tags.bool: 'bool',
     IDLType.Tags.int8: 'int8_t',
     IDLType.Tags.int16: 'int16_t',
     IDLType.Tags.int32: 'int32_t',
     IDLType.Tags.int64: 'int64_t',
     IDLType.Tags.uint8: 'uint8_t',
@@ -2817,20 +2815,23 @@ def infallibleForMember(member, type, de
     CURRENT ASSUMPTIONS:
         We assume that successCode for wrapping up return values cannot contain
         failure conditions.
     """
     return getWrapTemplateForType(type, descriptorProvider, 'result', None,\
                                   memberIsCreator(member))[1]
 
 def typeNeedsCx(type):
-    return (type is not None and
-            (type.isCallback() or type.isAny() or type.isObject() or
-             (type.isUnion() and
-              any(typeNeedsCx(t) for t in type.unroll().flatMemberTypes))))
+    if type is None:
+        return False
+    if type.isSequence() or type.isArray():
+        type = type.inner
+    if type.isUnion():
+        return any(typeNeedsCx(t) for t in type.unroll().flatMemberTypes)
+    return type.isCallback() or type.isAny() or type.isObject()
 
 # Returns a tuple consisting of a CGThing containing the type of the return
 # value, or None if there is no need for a return value, and a boolean signaling
 # whether the return value is passed in an out parameter.
 def getRetvalDeclarationForType(returnType, descriptorProvider,
                                 resultAlreadyAddRefed):
     if returnType is None or returnType.isVoid():
         # Nothing to declare
@@ -2853,17 +2854,17 @@ def getRetvalDeclarationForType(returnTy
             result = CGWrapper(result, pre="nsRefPtr<", post=">")
         else:
             result = CGWrapper(result, post="*")
         return result, False
     if returnType.isCallback():
         # XXXbz we're going to assume that callback types are always
         # nullable for now.
         return CGGeneric("JSObject*"), False
-    if returnType.tag() is IDLType.Tags.any:
+    if returnType.isAny():
         return CGGeneric("JS::Value"), False
     if returnType.isObject() or returnType.isSpiderMonkeyInterface():
         return CGGeneric("JSObject*"), False
     if returnType.isSequence():
         nullable = returnType.nullable()
         if nullable:
             returnType = returnType.inner
         # If our result is already addrefed, use the right type in the
--- a/dom/bindings/parser/WebIDL.py
+++ b/dom/bindings/parser/WebIDL.py
@@ -943,17 +943,17 @@ class IDLType(IDLObject):
 
     def isDictionary(self):
         return False
 
     def isInterface(self):
         return False
 
     def isAny(self):
-        return self.tag() == IDLType.Tags.any
+        return self.tag() == IDLType.Tags.any and not self.isSequence()
 
     def isDate(self):
         return self.tag() == IDLType.Tags.date
 
     def isObject(self):
         return self.tag() == IDLType.Tags.object
 
     def isComplete(self):
--- a/dom/bindings/test/TestBindingHeader.h
+++ b/dom/bindings/test/TestBindingHeader.h
@@ -290,16 +290,18 @@ public:
   void PassOptionalSequence(const Optional<Sequence<int32_t> >&);
   void PassOptionalNullableSequence(const Optional<Nullable<Sequence<int32_t> > >&);
   void PassOptionalNullableSequenceWithDefaultValue(const Nullable< Sequence<int32_t> >&);
   void PassOptionalObjectSequence(const Optional<Sequence<OwningNonNull<TestInterface> > >&);
 
   void ReceiveStringSequence(nsTArray<nsString>&);
   void PassStringSequence(const Sequence<nsString>&);
 
+  void ReceiveAnySequence(JSContext*, nsTArray<JS::Value>&);
+
   // Typed array types
   void PassArrayBuffer(ArrayBuffer&);
   void PassNullableArrayBuffer(ArrayBuffer*);
   void PassOptionalArrayBuffer(const Optional<ArrayBuffer>&);
   void PassOptionalNullableArrayBuffer(const Optional<ArrayBuffer*>&);
   void PassOptionalNullableArrayBufferWithDefaultValue(ArrayBuffer*);
   void PassArrayBufferView(ArrayBufferView&);
   void PassInt8Array(Int8Array&);
--- a/dom/bindings/test/TestCodeGen.webidl
+++ b/dom/bindings/test/TestCodeGen.webidl
@@ -211,16 +211,18 @@ interface TestInterface {
   void passOptionalSequence(optional sequence<long> arg);
   void passOptionalNullableSequence(optional sequence<long>? arg);
   void passOptionalNullableSequenceWithDefaultValue(optional sequence<long>? arg = null);
   void passOptionalObjectSequence(optional sequence<TestInterface> arg);
 
   sequence<DOMString> receiveStringSequence();
   void passStringSequence(sequence<DOMString> arg);
 
+  sequence<any> receiveAnySequence();
+
   // Typed array types
   void passArrayBuffer(ArrayBuffer arg);
   void passNullableArrayBuffer(ArrayBuffer? arg);
   void passOptionalArrayBuffer(optional ArrayBuffer arg);
   void passOptionalNullableArrayBuffer(optional ArrayBuffer? arg);
   void passOptionalNullableArrayBufferWithDefaultValue(optional ArrayBuffer? arg= null);
   void passArrayBufferView(ArrayBufferView arg);
   void passInt8Array(Int8Array arg);
--- a/dom/bluetooth/BluetoothAdapter.cpp
+++ b/dom/bluetooth/BluetoothAdapter.cpp
@@ -253,17 +253,16 @@ BluetoothAdapter::Create(nsPIDOMWindow* 
   if (!bs) {
     NS_WARNING("BluetoothService not available!");
     return nullptr;
   }
 
   nsRefPtr<BluetoothAdapter> adapter = new BluetoothAdapter(aOwner, aValue);
 
   bs->RegisterBluetoothSignalHandler(adapter->GetPath(), adapter);
-  bs->RegisterBluetoothSignalHandler(NS_LITERAL_STRING(REMOTE_AGENT_PATH), adapter);
 
   return adapter.forget();
 }
 
 void
 BluetoothAdapter::Notify(const BluetoothSignal& aData)
 {
   InfallibleTArray<BluetoothNamedValue> arr;
@@ -286,16 +285,32 @@ BluetoothAdapter::Notify(const Bluetooth
     NS_NewDOMBluetoothDeviceAddressEvent(getter_AddRefs(event), nullptr, nullptr);
 
     nsCOMPtr<nsIDOMBluetoothDeviceAddressEvent> e = do_QueryInterface(event);
     e->InitBluetoothDeviceAddressEvent(NS_LITERAL_STRING("devicedisappeared"),
                                        false, false, deviceAddress);
     e->SetTrusted(true);
     bool dummy;
     DispatchEvent(event, &dummy);
+  } else if (aData.name().EqualsLiteral("DeviceCreated")) {
+    NS_ASSERTION(aData.value().type() == BluetoothValue::TArrayOfBluetoothNamedValue,
+                 "DeviceCreated: Invalid value type");
+
+    nsRefPtr<BluetoothDevice> device = BluetoothDevice::Create(GetOwner(),
+                                                               GetPath(),
+                                                               aData.value());
+    nsCOMPtr<nsIDOMEvent> event;
+    NS_NewDOMBluetoothDeviceEvent(getter_AddRefs(event), nullptr, nullptr);
+
+    nsCOMPtr<nsIDOMBluetoothDeviceEvent> e = do_QueryInterface(event);
+    e->InitBluetoothDeviceEvent(NS_LITERAL_STRING("devicecreated"),
+                                false, false, device);
+    e->SetTrusted(true);
+    bool dummy;
+    DispatchEvent(event, &dummy);
   } else if (aData.name().EqualsLiteral("PropertyChanged")) {
     // Get BluetoothNamedValue, make sure array length is 1
     arr = aData.value().get_ArrayOfBluetoothNamedValue();
 
     NS_ASSERTION(arr.Length() == 1, "Got more than one property in a change message!");
     NS_ASSERTION(arr[0].value().type() == BluetoothValue::TArrayOfBluetoothNamedValue,
                  "PropertyChanged: Invalid value type");
 
@@ -623,13 +638,14 @@ BluetoothAdapter::SetAuthorization(const
   bool result = bs->SetAuthorizationInternal(aDeviceAddress, aAllow);
 
   return result ? NS_OK : NS_ERROR_FAILURE;
 }
 
 NS_IMPL_EVENT_HANDLER(BluetoothAdapter, propertychanged)
 NS_IMPL_EVENT_HANDLER(BluetoothAdapter, devicefound)
 NS_IMPL_EVENT_HANDLER(BluetoothAdapter, devicedisappeared)
+NS_IMPL_EVENT_HANDLER(BluetoothAdapter, devicecreated)
 NS_IMPL_EVENT_HANDLER(BluetoothAdapter, requestconfirmation)
 NS_IMPL_EVENT_HANDLER(BluetoothAdapter, requestpincode)
 NS_IMPL_EVENT_HANDLER(BluetoothAdapter, requestpasskey)
 NS_IMPL_EVENT_HANDLER(BluetoothAdapter, authorize)
 NS_IMPL_EVENT_HANDLER(BluetoothAdapter, cancel)
--- a/dom/bluetooth/BluetoothService.cpp
+++ b/dom/bluetooth/BluetoothService.cpp
@@ -265,16 +265,17 @@ BluetoothService::Init()
   // Only the main process should observe bluetooth settings changes.
   if (IsMainProcess() &&
       NS_FAILED(obs->AddObserver(this, MOZSETTINGS_CHANGED_ID, false))) {
     NS_WARNING("Failed to add settings change observer!");
     return false;
   }
 
   RegisterBluetoothSignalHandler(NS_LITERAL_STRING(LOCAL_AGENT_PATH), this);
+  RegisterBluetoothSignalHandler(NS_LITERAL_STRING(REMOTE_AGENT_PATH), this);
   mRegisteredForLocalAgent = true;
 
   return true;
 }
 
 void
 BluetoothService::Cleanup()
 {
@@ -703,16 +704,19 @@ SetJsObject(JSContext* aContext,
       JSString* JsData = JS_NewStringCopyN(aContext,
                                            NS_ConvertUTF16toUTF8(data).get(),
                                            data.Length());
       NS_ENSURE_TRUE(JsData, NS_ERROR_OUT_OF_MEMORY);
       v = STRING_TO_JSVAL(JsData);
     } else if (aData[i].value().type() == BluetoothValue::Tuint32_t) {
       int data = aData[i].value().get_uint32_t();
       v = INT_TO_JSVAL(data);
+    } else if (aData[i].value().type() == BluetoothValue::Tbool) {
+      bool data = aData[i].value().get_bool();
+      v = BOOLEAN_TO_JSVAL(data);
     } else {
       NS_WARNING("SetJsObject: Parameter is not handled");
     }
 
     if (!JS_SetProperty(aContext, aObj,
                         NS_ConvertUTF16toUTF8(aData[i].name()).get(),
                         &v)) {
       return false;
@@ -753,16 +757,19 @@ BluetoothService::Notify(const Bluetooth
     NS_ASSERTION(arr.Length() == 2, "RequestPinCode: Wrong length of parameters");
     type.AssignLiteral("bluetooth-requestpasskey");
   } else if (aData.name().EqualsLiteral("Authorize")) {
     NS_ASSERTION(arr.Length() == 2, "Authorize: Wrong length of parameters");
     type.AssignLiteral("bluetooth-authorize");
   } else if (aData.name().EqualsLiteral("Cancel")) {
     NS_ASSERTION(arr.Length() == 0, "Cancel: Wrong length of parameters");
     type.AssignLiteral("bluetooth-cancel");
+  } else if (aData.name().EqualsLiteral("PairedStatusChanged")) {
+    NS_ASSERTION(arr.Length() == 1, "PairedStatusChagned: Wrong length of parameters");
+    type.AssignLiteral("bluetooth-pairingstatuschanged");
   } else {
 #ifdef DEBUG
     nsCString warningMsg;
     warningMsg.AssignLiteral("Not handling service signal: ");
     warningMsg.Append(NS_ConvertUTF16toUTF8(aData.name()));
     NS_WARNING(warningMsg.get());
 #endif
   }
--- a/dom/bluetooth/BluetoothService.h
+++ b/dom/bluetooth/BluetoothService.h
@@ -153,31 +153,43 @@ public:
    * @param aAdapterPath Adapter to start discovery on
    *
    * @return NS_OK if discovery stopped correctly, false otherwise
    */
   virtual nsresult
   StartDiscoveryInternal(const nsAString& aAdapterPath,
                          BluetoothReplyRunnable* aRunnable) = 0;
 
-  /** 
+  /**
    * Fetches the propertes for the specified object
    *
    * @param aType Type of the object (see BluetoothObjectType in BluetoothCommon.h)
    * @param aPath Path of the object
    * @param aRunnable Runnable to return to after receiving callback
    *
    * @return NS_OK on function run, NS_ERROR_FAILURE otherwise
    */
   virtual nsresult
   GetProperties(BluetoothObjectType aType,
                 const nsAString& aPath,
                 BluetoothReplyRunnable* aRunnable) = 0;
 
   /** 
+   * Fetches the propertes for the specified device
+   *
+   * @param aDevicePath Path of the object
+   * @param aSignalPath Path to distrubute signal after receiving properties
+   *
+   * @return NS_OK on function run, NS_ERROR_FAILURE otherwise
+   */
+  virtual nsresult
+  GetDevicePropertiesInternal(const nsAString& aDevicePath,
+                              const nsAString& aSignalPath) = 0;
+
+  /**
    * Set a property for the specified object
    *
    * @param aPath Path to the object
    * @param aPropName Name of the property
    * @param aValue Boolean value
    * @param aRunnable Runnable to run on async reply
    *
    * @return NS_OK if property is set correctly, NS_ERROR_FAILURE otherwise
--- a/dom/bluetooth/ipc/BluetoothServiceChildProcess.cpp
+++ b/dom/bluetooth/ipc/BluetoothServiceChildProcess.cpp
@@ -98,16 +98,25 @@ nsresult
 BluetoothServiceChildProcess::GetDefaultAdapterPathInternal(
                                               BluetoothReplyRunnable* aRunnable)
 {
   SendRequest(aRunnable, DefaultAdapterPathRequest());
   return NS_OK;
 }
 
 nsresult
+BluetoothServiceChildProcess::GetDevicePropertiesInternal(
+                                                   const nsAString& aDevicePath,
+                                                   const nsAString& aSignalPath)
+{
+  MOZ_NOT_REACHED("Implement me!");
+  return NS_ERROR_NOT_IMPLEMENTED;
+}
+
+nsresult
 BluetoothServiceChildProcess::GetPairedDevicePropertiesInternal(
                                      const nsTArray<nsString>& aDeviceAddresses,
                                      BluetoothReplyRunnable* aRunnable)
 {
   DevicePropertiesRequest request;
   request.addresses().AppendElements(aDeviceAddresses);
 
   SendRequest(aRunnable, request);
--- a/dom/bluetooth/ipc/BluetoothServiceChildProcess.h
+++ b/dom/bluetooth/ipc/BluetoothServiceChildProcess.h
@@ -57,16 +57,20 @@ public:
                          BluetoothReplyRunnable* aRunnable) MOZ_OVERRIDE;
 
   virtual nsresult
   GetProperties(BluetoothObjectType aType,
                 const nsAString& aPath,
                 BluetoothReplyRunnable* aRunnable) MOZ_OVERRIDE;
 
   virtual nsresult
+  GetDevicePropertiesInternal(const nsAString& aDevicePath,
+                              const nsAString& aSignalPath) MOZ_OVERRIDE;
+
+  virtual nsresult
   SetProperty(BluetoothObjectType aType,
               const nsAString& aPath,
               const BluetoothNamedValue& aValue,
               BluetoothReplyRunnable* aRunnable) MOZ_OVERRIDE;
 
   virtual bool
   GetDevicePath(const nsAString& aAdapterPath,
                 const nsAString& aDeviceAddress,
--- a/dom/bluetooth/linux/BluetoothDBusService.cpp
+++ b/dom/bluetooth/linux/BluetoothDBusService.cpp
@@ -555,18 +555,16 @@ RegisterAgent(const nsAString& aAdapterP
         __FUNCTION__, REMOTE_AGENT_PATH);
 
     return false;
   }
 
   return true;
 }
 
-
-
 static void
 AddReservedServices(const nsAString& aAdapterPath)
 {
   MOZ_ASSERT(!NS_IsMainThread());
 
   nsTArray<uint32_t> uuids;
 
   uuids.AppendElement((uint32_t)(BluetoothServiceUuid::HandsfreeAG >> 32));
@@ -944,16 +942,28 @@ EventFilter(DBusConnection* aConn, DBusM
     if (!dbus_message_get_args(aMsg, &err,
                                DBUS_TYPE_OBJECT_PATH, &str,
                                DBUS_TYPE_INVALID)) {
       LOG_AND_FREE_DBUS_ERROR_WITH_MSG(&err, aMsg);
       errorStr.AssignLiteral("Cannot parse device path!");
     } else {
       v = NS_ConvertUTF8toUTF16(str);
     }
+
+    // Get device properties and then send to BluetoothAdapter
+    BluetoothService* bs = BluetoothService::Get();
+    if (!bs) {
+      NS_WARNING("BluetoothService not available!");
+    }
+
+    if (NS_FAILED(bs->GetDevicePropertiesInternal(v, signalPath))) {
+      NS_WARNING("get properties failed");
+    }
+
+    return DBUS_HANDLER_RESULT_HANDLED;
   } else if (dbus_message_is_signal(aMsg, DBUS_ADAPTER_IFACE, "DeviceRemoved")) {
     const char* str;
     if (!dbus_message_get_args(aMsg, &err,
                                DBUS_TYPE_OBJECT_PATH, &str,
                                DBUS_TYPE_INVALID)) {
       LOG_AND_FREE_DBUS_ERROR_WITH_MSG(&err, aMsg);
       errorStr.AssignLiteral("Cannot parse device path!");
     } else {
@@ -966,25 +976,33 @@ EventFilter(DBusConnection* aConn, DBusM
                         sAdapterProperties,
                         ArrayLength(sAdapterProperties));
   } else if (dbus_message_is_signal(aMsg, DBUS_DEVICE_IFACE, "PropertyChanged")) {
     ParsePropertyChange(aMsg,
                         v,
                         errorStr,
                         sDeviceProperties,
                         ArrayLength(sDeviceProperties));
+    if (v.get_ArrayOfBluetoothNamedValue()[0].name().EqualsLiteral("Paired")) {
+      // transfer signal to BluetoothService and 
+      // broadcast system message of bluetooth-pairingstatuschanged
+      signalName = NS_LITERAL_STRING("PairedStatusChagned");
+      signalPath = NS_LITERAL_STRING(LOCAL_AGENT_PATH);
+      v.get_ArrayOfBluetoothNamedValue()[0].name() = NS_LITERAL_STRING("paired");
+    }
   } else if (dbus_message_is_signal(aMsg, DBUS_MANAGER_IFACE, "AdapterAdded")) {
     const char* str;
     if (!dbus_message_get_args(aMsg, &err,
                                DBUS_TYPE_OBJECT_PATH, &str,
                                DBUS_TYPE_INVALID)) {
       LOG_AND_FREE_DBUS_ERROR_WITH_MSG(&err, aMsg);
       errorStr.AssignLiteral("Cannot parse manager path!");
     } else {
       sDefaultAdapterPath = NS_ConvertUTF8toUTF16(str);
+      AddReservedServices(sDefaultAdapterPath);
       v = sDefaultAdapterPath;
     }
   } else if (dbus_message_is_signal(aMsg, DBUS_MANAGER_IFACE, "PropertyChanged")) {
     ParsePropertyChange(aMsg,
                         v,
                         errorStr,
                         sManagerProperties,
                         ArrayLength(sManagerProperties));
@@ -1253,16 +1271,76 @@ BluetoothDBusService::StartDiscoveryInte
 {
   if (!mConnection) {
     NS_WARNING("Bluetooth service not started yet, cannot start discovery!");
     return NS_ERROR_FAILURE;
   }
   return SendDiscoveryMessage(aAdapterPath, "StartDiscovery", aRunnable);
 }
 
+class BluetoothDevicePropertiesRunnable : public nsRunnable
+{
+public:
+  BluetoothDevicePropertiesRunnable(const nsAString& aDevicePath,
+                                    const nsAString& aSignalPath) :
+    mDevicePath(aDevicePath),
+    mSignalPath(aSignalPath)
+  {
+    MOZ_ASSERT(NS_IsMainThread());
+  }
+
+  ~BluetoothDevicePropertiesRunnable()
+  {
+  }
+
+  NS_IMETHOD Run()
+  {
+    MOZ_ASSERT(!NS_IsMainThread());
+
+    DBusError err;
+    dbus_error_init(&err);
+
+    BluetoothValue v = InfallibleTArray<BluetoothNamedValue>();
+    nsString replyError;
+
+    DBusMessage* msg = dbus_func_args_timeout(gThreadConnection->GetConnection(),
+                                              1000,
+                                              &err,
+                                              NS_ConvertUTF16toUTF8(mDevicePath).get(),
+                                              DBUS_DEVICE_IFACE,
+                                              "GetProperties",
+                                              DBUS_TYPE_INVALID);
+    UnpackDevicePropertiesMessage(msg, &err, v, replyError);
+
+    if (!replyError.IsEmpty()) {
+      NS_WARNING("Failed to get device properties");
+      return NS_ERROR_FAILURE;
+    }
+    if (msg) {
+      dbus_message_unref(msg);
+    }
+
+    BluetoothSignal signal(NS_LITERAL_STRING("DeviceCreated"),
+                           mSignalPath, v);
+
+    nsRefPtr<DistributeBluetoothSignalTask> t = new DistributeBluetoothSignalTask(signal);
+
+    if (NS_FAILED(NS_DispatchToMainThread(t))) {
+       NS_WARNING("Failed to dispatch to main thread!");
+       return NS_ERROR_FAILURE;
+    }
+
+    return NS_OK;
+  }
+
+private:
+  nsString mDevicePath;
+  nsString mSignalPath;
+};
+
 class BluetoothPairedDevicePropertiesRunnable : public nsRunnable
 {
 public:
   BluetoothPairedDevicePropertiesRunnable(BluetoothReplyRunnable* aRunnable,
                                           const nsTArray<nsString>& aDeviceAddresses)
     : mRunnable(dont_AddRef(aRunnable)),
       mDeviceAddresses(aDeviceAddresses)
   {
@@ -1354,16 +1432,36 @@ BluetoothDBusService::GetProperties(Blue
     NS_WARNING("Could not start async function!");
     return NS_ERROR_FAILURE;
   }
   runnable.forget();
   return NS_OK;
 }
 
 nsresult
+BluetoothDBusService::GetDevicePropertiesInternal(const nsAString& aDevicePath,
+                                                  const nsAString& aSignalPath)
+{
+  NS_ASSERTION(NS_IsMainThread(), "Must be called from main thread!");
+
+  if (!mConnection || !gThreadConnection) {
+    NS_ERROR("Bluetooth service not started yet!");
+    return NS_ERROR_FAILURE;
+  }
+
+  nsRefPtr<nsRunnable> func(new BluetoothDevicePropertiesRunnable(aDevicePath, aSignalPath));
+  if (NS_FAILED(mBluetoothCommandThread->Dispatch(func, NS_DISPATCH_NORMAL))) {
+    NS_WARNING("Cannot dispatch task!");
+    return NS_ERROR_FAILURE;
+  }
+
+  return NS_OK;
+}
+
+nsresult
 BluetoothDBusService::GetPairedDevicePropertiesInternal(const nsTArray<nsString>& aDeviceAddresses,
                                                         BluetoothReplyRunnable* aRunnable)
 {
   if (!mConnection || !gThreadConnection) {
     NS_ERROR("Bluetooth service not started yet!");
     return NS_ERROR_FAILURE;
   }
   nsRefPtr<BluetoothReplyRunnable> runnable = aRunnable;
--- a/dom/bluetooth/linux/BluetoothDBusService.h
+++ b/dom/bluetooth/linux/BluetoothDBusService.h
@@ -33,16 +33,20 @@ public:
                                           BluetoothReplyRunnable* aRunnable);
   virtual nsresult StopDiscoveryInternal(const nsAString& aAdapterPath,
                                          BluetoothReplyRunnable* aRunnable);
   virtual nsresult
   GetProperties(BluetoothObjectType aType,
                 const nsAString& aPath,
                 BluetoothReplyRunnable* aRunnable);
   virtual nsresult
+  GetDevicePropertiesInternal(const nsAString& aDevicePath,
+                              const nsAString& aSignalPath);
+
+  virtual nsresult
   SetProperty(BluetoothObjectType aType,
               const nsAString& aPath,
               const BluetoothNamedValue& aValue,
               BluetoothReplyRunnable* aRunnable);
   virtual bool
   GetDevicePath(const nsAString& aAdapterPath,
                 const nsAString& aDeviceAddress,
                 nsAString& aDevicePath);
--- a/dom/bluetooth/nsIDOMBluetoothAdapter.idl
+++ b/dom/bluetooth/nsIDOMBluetoothAdapter.idl
@@ -4,17 +4,17 @@
  * License, v. 2.0. If a copy of the MPL was not distributed with this file,
  * You can obtain one at http://mozilla.org/MPL/2.0/. */
 
 #include "nsIDOMEventTarget.idl"
 
 interface nsIDOMDOMRequest;
 interface nsIDOMBluetoothDevice;
 
-[scriptable, builtinclass, uuid(4ea7d312-f37c-4777-8114-fc7312890199)]
+[scriptable, builtinclass, uuid(df1465c6-00b7-49ab-bd20-1b63721d118f)]
 interface nsIDOMBluetoothAdapter : nsIDOMEventTarget
 {
   readonly attribute DOMString address;
   [binaryname(AdapterClass)] readonly attribute unsigned long class;
   readonly attribute bool enabled;
   readonly attribute bool discovering;
 
   [implicit_jscontext]
@@ -40,16 +40,18 @@ interface nsIDOMBluetoothAdapter : nsIDO
   void setPasskey(in DOMString aDeviceAddress, in unsigned long aPasskey);
   void setPairingConfirmation(in DOMString aDeviceAddress, in bool aConfirmation);
   void setAuthorization(in DOMString aDeviceAddress, in bool aAllow);
 
   // Fired when discoverying and any device is discovered.
   [implicit_jscontext] attribute jsval ondevicefound;
   // Fired when any device is out of discoverable range.
   [implicit_jscontext] attribute jsval ondevicedisappeared;
+  // Fired when any device is created.
+  [implicit_jscontext] attribute jsval ondevicecreated;
   // Fired when a property of the adapter is changed
   [implicit_jscontext] attribute jsval onpropertychanged;
   // Pairing related events
   [implicit_jscontext] attribute jsval onrequestconfirmation;
   [implicit_jscontext] attribute jsval onrequestpincode;
   [implicit_jscontext] attribute jsval onrequestpasskey;
   [implicit_jscontext] attribute jsval onauthorize;
   [implicit_jscontext] attribute jsval oncancel;
--- a/dom/imptests/failures/html/tests/submission/Opera/microdata/test_001.html.json
+++ b/dom/imptests/failures/html/tests/submission/Opera/microdata/test_001.html.json
@@ -1,7 +1,6 @@
 {
-  "document.getItems must return a NodeList": true,
   "itemValue must reflect the src attribute on track elements": true,
   "itemValue must reflect the textContent of time elements with no datetime attribute": true,
   "itemValue must reflect the datetime attribute of time elements with a datetime attribute": true
 }
 
--- a/dom/interfaces/core/nsIDOMDOMTokenList.idl
+++ b/dom/interfaces/core/nsIDOMDOMTokenList.idl
@@ -12,16 +12,16 @@
  * For more information on this interface please see
  * <http://www.whatwg.org/html5/#domtokenlist>
  */
 [scriptable, uuid(c6f1e160-eeeb-404a-98b0-6f1246520b6e)]
 interface nsIDOMDOMTokenList : nsISupports
 {
   readonly attribute unsigned long length;
 
-  [getter] DOMString item(in unsigned long index);
+  [getter,binaryname(MozItem)] DOMString item(in unsigned long index);
   boolean            contains([Null(Stringify)] in DOMString token);
   void               add([Null(Stringify)] in DOMString token);
   void               remove([Null(Stringify)] in DOMString token);
   boolean            toggle([Null(Stringify)] in DOMString token);
 
   [stringifier] DOMString          toString();
 };
--- a/dom/interfaces/html/nsIDOMHTMLCollection.idl
+++ b/dom/interfaces/html/nsIDOMHTMLCollection.idl
@@ -1,39 +1,39 @@
 /* -*- Mode: IDL; tab-width: 2; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
 /* This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
 
 #include "domstubs.idl"
 
-interface nsIContent;
+interface nsGenericElement;
 
 /**
  * The nsIDOMHTMLCollection interface is an interface to a collection
  * of [X]HTML elements.
  *
  * This interface is trying to follow the DOM Level 2 HTML specification:
  * http://www.w3.org/TR/DOM-Level-2-HTML/
  *
  * with changes from the work-in-progress WHATWG HTML specification:
  * http://www.whatwg.org/specs/web-apps/current-work/
  */
 
-[scriptable, uuid(b7ccd7b3-86aa-4322-a50c-b972643bb662)]
+[scriptable, uuid(db690d8f-3bca-4198-be64-78adb7f38bf8)]
 interface nsIDOMHTMLCollection : nsISupports
 {
   readonly attribute unsigned long    length;
 
-  [getter,forward(getNodeAt)] nsIDOMNode    item(in unsigned long index);
+  [getter,forward(getElementAt)] nsIDOMNode item(in unsigned long index);
   [getter,forward(getNamedItem)] nsIDOMNode namedItem(in DOMString name);
 
   /**
    * Get the node at the index.  Returns null if the index is out of bounds.
    */
-  [noscript,notxpcom,nostdcall] nsIContent  getNodeAt(in unsigned long index);
+  [noscript,notxpcom,nostdcall] nsGenericElement getElementAt(in unsigned long index);
 
   /**
    * Get the node for the name.  Returns null if no node exists for the name.
    */
   [noscript,notxpcom,nostdcall] nsISupports getNamedItem(in DOMString name,
                                                          out nsWrapperCachePtr cache);
 };
--- a/dom/interfaces/html/nsIDOMHTMLPropertiesCollection.idl
+++ b/dom/interfaces/html/nsIDOMHTMLPropertiesCollection.idl
@@ -3,30 +3,32 @@
 /* This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
 
 #include "nsIDOMHTMLElement.idl"
 #include "nsIDOMPropertyNodeList.idl"
 #include "nsIDOMDOMStringList.idl"
 
+interface nsGenericElement;
+
 // This interface should extend nsIDOMHTMLCollection, which will be fixed when
 // it is converted to webidl.
-[scriptable, uuid(da1101db-d1d7-465d-9fd6-49ec9960cb20)]
+[scriptable, uuid(b7e84688-98e0-46b2-9d20-8a0e7329dd25)]
 interface nsIDOMHTMLPropertiesCollection : nsISupports
 {
   readonly attribute unsigned long    length;
   readonly attribute nsIDOMDOMStringList names;
 
-  [getter,forward(getNodeAt)] nsIDOMNode                item(in unsigned long index);
+  [getter,forward(getElementAt)] nsIDOMNode                item(in unsigned long index);
   nsIDOMPropertyNodeList namedItem(in DOMString name);
 
   /**
    * Get the node at the index.  Returns null if the index is out of bounds.
    */
-  [noscript,notxpcom,nostdcall] nsIContent  getNodeAt(in unsigned long index);
+  [noscript,notxpcom,nostdcall] nsGenericElement getElementAt(in unsigned long index);
 
   /**
    * Get the node for the name.  Returns null if no node exists for the name.
    */
   [noscript,notxpcom,nostdcall] nsISupports getNamedItem(in DOMString name,
                                                          out nsWrapperCachePtr cache);
 };
--- a/dom/plugins/base/nsPluginHost.cpp
+++ b/dom/plugins/base/nsPluginHost.cpp
@@ -26,17 +26,17 @@
 #include "nsIUploadChannel.h"
 #include "nsIByteRangeRequest.h"
 #include "nsIStreamListener.h"
 #include "nsIInputStream.h"
 #include "nsIOutputStream.h"
 #include "nsIURL.h"
 #include "nsXPIDLString.h"
 #include "nsReadableUtils.h"
-#include "nsIProtocolProxyService2.h"
+#include "nsIProtocolProxyService.h"
 #include "nsIStreamConverterService.h"
 #include "nsIFile.h"
 #if defined(XP_MACOSX)
 #include "nsILocalFileMac.h"
 #endif
 #include "nsIInputStream.h"
 #include "nsIIOService.h"
 #include "nsIURL.h"
@@ -738,40 +738,34 @@ nsresult nsPluginHost::FindProxyForURL(c
 {
   if (!url || !result) {
     return NS_ERROR_INVALID_ARG;
   }
   nsresult res;
 
   nsCOMPtr<nsIURI> uriIn;
   nsCOMPtr<nsIProtocolProxyService> proxyService;
-  nsCOMPtr<nsIProtocolProxyService2> proxyService2;
   nsCOMPtr<nsIIOService> ioService;
 
   proxyService = do_GetService(NS_PROTOCOLPROXYSERVICE_CONTRACTID, &res);
   if (NS_FAILED(res) || !proxyService)
     return res;
 
-  proxyService2 = do_QueryInterface(proxyService, &res);
-  if (NS_FAILED(res) || !proxyService)
-    return res;
-
   ioService = do_GetService(NS_IOSERVICE_CONTRACTID, &res);
   if (NS_FAILED(res) || !ioService)
     return res;
 
   // make an nsURI from the argument url
   res = ioService->NewURI(nsDependentCString(url), nullptr, nullptr, getter_AddRefs(uriIn));
   if (NS_FAILED(res))
     return res;
 
   nsCOMPtr<nsIProxyInfo> pi;
 
-  // Remove this with bug 778201
-  res = proxyService2->DeprecatedBlockingResolve(uriIn, 0, getter_AddRefs(pi));
+  res = proxyService->Resolve(uriIn, 0, getter_AddRefs(pi));
   if (NS_FAILED(res))
     return res;
 
   nsAutoCString host, type;
   int32_t port = -1;
 
   // These won't fail, and even if they do... we'll be ok.
   if (pi) {
--- a/dom/tests/mochitest/chrome/test_sandbox_bindings.xul
+++ b/dom/tests/mochitest/chrome/test_sandbox_bindings.xul
@@ -21,17 +21,17 @@ https://bugzilla.mozilla.org/show_bug.cg
   <![CDATA[
 
   /** Test for Bug 741267 **/
     function doTest() {
       var win = $("t").contentWindow;
       var sandbox = Components.utils.Sandbox(win, { sandboxPrototype: win });
       try {
         var nl = Components.utils.evalInSandbox("NodeList", sandbox);
-        is(nl, "[object NodeList]", "'NodeList' in a sandbox should return the NodeList interface prototype object");
+        is(nl, String(NodeList), "'NodeList' in a sandbox should return the NodeList interface prototype object");
       } catch (e) {
         ok(false, "'NodeList' shouldn't throw in a sandbox");
       }
       try {
         var et = Components.utils.evalInSandbox("EventTarget", sandbox);
         ok(et, "'EventTarget' in a sandbox should return the EventTarget interface prototype object");
       } catch (e) {
         ok(false, "'EventTarget' shouldn't throw in a sandbox");
new file mode 100644
--- /dev/null
+++ b/dom/webidl/ClientRectList.webidl
@@ -0,0 +1,12 @@
+/* -*- Mode: IDL; tab-width: 2; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this file,
+ * You can obtain one at http://mozilla.org/MPL/2.0/.
+ */
+
+interface ClientRect;
+
+interface ClientRectList {
+  readonly attribute unsigned long length;
+  getter ClientRect? item(unsigned long index);
+};
--- a/dom/webidl/DOMTokenList.webidl
+++ b/dom/webidl/DOMTokenList.webidl
@@ -8,14 +8,18 @@
  *
  * Copyright © 2012 W3C® (MIT, ERCIM, Keio), All Rights Reserved. W3C
  * liability, trademark and document use rules apply.
  */
 
 interface DOMTokenList {
   readonly attribute unsigned long length;
   getter DOMString? item(unsigned long index);
+  [Throws]
   boolean contains(DOMString token);
+  [Throws]
   void add(DOMString token);
+  [Throws]
   void remove(DOMString token);
+  [Throws]
   boolean toggle(DOMString token);
   stringifier DOMString ();
 };
new file mode 100644
--- /dev/null
+++ b/dom/webidl/FileList.webidl
@@ -0,0 +1,18 @@
+/* -*- Mode: IDL; tab-width: 2; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this file,
+ * You can obtain one at http://mozilla.org/MPL/2.0/.
+ *
+ * The origin of this IDL file is
+ * http://dev.w3.org/2006/webapi/FileAPI/
+ *
+ * Copyright © 2012 W3C® (MIT, ERCIM, Keio), All Rights Reserved. W3C
+ * liability, trademark and document use rules apply.
+ */
+
+interface File;
+
+interface FileList {
+  getter File? item(unsigned long index);
+  readonly attribute unsigned long length;
+};
--- a/dom/webidl/HTMLCollection.webidl
+++ b/dom/webidl/HTMLCollection.webidl
@@ -5,13 +5,16 @@
  *
  * The origin of this IDL file is
  * http://www.w3.org/TR/2012/WD-dom-20120105/
  *
  * Copyright © 2012 W3C® (MIT, ERCIM, Keio), All Rights Reserved. W3C
  * liability, trademark and document use rules apply.
  */
 
+interface Element;
+
 interface HTMLCollection {
   readonly attribute unsigned long length;
   getter Element? item(unsigned long index);
+  [Throws]
   getter object? namedItem(DOMString name); // only returns Element
 };
new file mode 100644
--- /dev/null
+++ b/dom/webidl/HTMLOptionsCollection.webidl
@@ -0,0 +1,29 @@
+/* -*- Mode: IDL; tab-width: 2; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this file,
+ * You can obtain one at http://mozilla.org/MPL/2.0/.
+ *
+ * The origin of this IDL file is
+ * http://www.w3.org/TR/2012/WD-html5-20120329/
+ *
+ * Copyright © 2012 W3C® (MIT, ERCIM, Keio), All Rights Reserved. W3C
+ * liability, trademark and document use rules apply.
+ */
+
+interface HTMLElement;
+interface HTMLOptionElement;
+interface HTMLOptGroupElement;
+
+interface HTMLOptionsCollection : HTMLCollection {
+           attribute unsigned long length;
+  [Throws]
+  getter object? namedItem(DOMString name);
+  [Throws]
+  setter creator void (unsigned long index, HTMLOptionElement option);
+  [Throws]
+  void add((HTMLOptionElement or HTMLOptGroupElement) element, optional (HTMLElement or long)? before = null);
+  [Throws]
+  void remove(long index);
+  [Throws]
+           attribute long selectedIndex;
+};
new file mode 100644
--- /dev/null
+++ b/dom/webidl/HTMLPropertiesCollection.webidl
@@ -0,0 +1,26 @@
+/* -*- Mode: IDL; tab-width: 2; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this file,
+ * You can obtain one at http://mozilla.org/MPL/2.0/.
+ *
+ * The origin of this IDL file is
+ * http://www.whatwg.org/specs/web-apps/current-work/
+ *
+ * Copyright © 2012 W3C® (MIT, ERCIM, Keio), All Rights Reserved. W3C
+ * liability, trademark and document use rules apply.
+ */
+
+interface DOMStringList;
+
+interface HTMLPropertiesCollection : HTMLCollection {
+  // inherits length and item()
+  getter PropertyNodeList? namedItem(DOMString name); // overrides inherited namedItem()
+  readonly attribute DOMStringList names;
+};
+
+typedef sequence<any> PropertyValueArray;
+
+interface PropertyNodeList : NodeList {
+  [Throws]
+  PropertyValueArray getValues();
+};
--- a/dom/webidl/NodeList.webidl
+++ b/dom/webidl/NodeList.webidl
@@ -5,12 +5,14 @@
  *
  * The origin of this IDL file is
  * http://www.w3.org/TR/2012/WD-dom-20120105/
  *
  * Copyright © 2012 W3C® (MIT, ERCIM, Keio), All Rights Reserved. W3C
  * liability, trademark and document use rules apply.
  */
 
+interface Node;
+
 interface NodeList {
   getter Node? item(unsigned long index);
   readonly attribute unsigned long length;
 };
new file mode 100644
--- /dev/null
+++ b/dom/webidl/PaintRequestList.webidl
@@ -0,0 +1,12 @@
+/* -*- Mode: IDL; tab-width: 2; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this file,
+ * You can obtain one at http://mozilla.org/MPL/2.0/.
+ */
+
+interface PaintRequest;
+
+interface PaintRequestList {
+  readonly attribute unsigned long length;
+  getter PaintRequest? item(unsigned long index);
+};
new file mode 100644
--- /dev/null
+++ b/dom/webidl/SVGLengthList.webidl
@@ -0,0 +1,34 @@
+/* -*- Mode: IDL; tab-width: 2; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this file,
+ * You can obtain one at http://mozilla.org/MPL/2.0/.
+ *
+ * The origin of this IDL file is
+ * http://www.w3.org/TR/SVG11/
+ *
+ * Copyright © 2012 W3C® (MIT, ERCIM, Keio), All Rights Reserved. W3C
+ * liability, trademark and document use rules apply.
+ */
+
+interface SVGLength;
+
+interface SVGLengthList {
+  readonly attribute unsigned long numberOfItems;
+  [Throws]
+  void clear();
+  [Throws]
+  SVGLength initialize(SVGLength newItem);
+  [Throws]
+  getter SVGLength getItem(unsigned long index);
+  [Throws]
+  SVGLength insertItemBefore(SVGLength newItem, unsigned long index);
+  [Throws]
+  SVGLength replaceItem(SVGLength newItem, unsigned long index);
+  [Throws]
+  SVGLength removeItem(unsigned long index);
+  [Throws]
+  SVGLength appendItem(SVGLength newItem);
+
+  // Mozilla-specific stuff
+  readonly attribute unsigned long length; // synonym for numberOfItems
+};
new file mode 100644
--- /dev/null
+++ b/dom/webidl/SVGNumberList.webidl
@@ -0,0 +1,34 @@
+/* -*- Mode: IDL; tab-width: 2; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this file,
+ * You can obtain one at http://mozilla.org/MPL/2.0/.
+ *
+ * The origin of this IDL file is
+ * http://www.w3.org/TR/SVG11/
+ *
+ * Copyright © 2012 W3C® (MIT, ERCIM, Keio), All Rights Reserved. W3C
+ * liability, trademark and document use rules apply.
+ */
+
+interface SVGNumber;
+
+interface SVGNumberList {
+  readonly attribute unsigned long numberOfItems;
+  [Throws]
+  void clear();
+  [Throws]
+  SVGNumber initialize(SVGNumber newItem);
+  [Throws]
+  getter SVGNumber getItem(unsigned long index);
+  [Throws]
+  SVGNumber insertItemBefore(SVGNumber newItem, unsigned long index);
+  [Throws]
+  SVGNumber replaceItem(SVGNumber newItem, unsigned long index);
+  [Throws]
+  SVGNumber removeItem(unsigned long index);
+  [Throws]
+  SVGNumber appendItem(SVGNumber newItem);
+
+  // Mozilla-specific stuff
+  readonly attribute unsigned long length; // synonym for numberOfItems
+};
new file mode 100644
--- /dev/null
+++ b/dom/webidl/SVGPathSegList.webidl
@@ -0,0 +1,34 @@
+/* -*- Mode: IDL; tab-width: 2; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this file,
+ * You can obtain one at http://mozilla.org/MPL/2.0/.
+ *
+ * The origin of this IDL file is
+ * http://www.w3.org/TR/SVG11/
+ *
+ * Copyright © 2012 W3C® (MIT, ERCIM, Keio), All Rights Reserved. W3C
+ * liability, trademark and document use rules apply.
+ */
+
+interface SVGPathSeg;
+
+interface SVGPathSegList {
+  readonly attribute unsigned long numberOfItems;
+  [Throws]
+  void clear();
+  [Throws]
+  SVGPathSeg initialize(SVGPathSeg newItem);
+  [Throws]
+  getter SVGPathSeg getItem(unsigned long index);
+  [Throws]
+  SVGPathSeg insertItemBefore(SVGPathSeg newItem, unsigned long index);
+  [Throws]
+  SVGPathSeg replaceItem(SVGPathSeg newItem, unsigned long index);
+  [Throws]
+  SVGPathSeg removeItem(unsigned long index);
+  [Throws]
+  SVGPathSeg appendItem(SVGPathSeg newItem);
+
+  // Mozilla-specific stuff
+  readonly attribute unsigned long length; // synonym for numberOfItems
+};
new file mode 100644
--- /dev/null
+++ b/dom/webidl/SVGPointList.webidl
@@ -0,0 +1,34 @@
+/* -*- Mode: IDL; tab-width: 2; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this file,
+ * You can obtain one at http://mozilla.org/MPL/2.0/.
+ *
+ * The origin of this IDL file is
+ * http://www.w3.org/TR/SVG11/
+ *
+ * Copyright © 2012 W3C® (MIT, ERCIM, Keio), All Rights Reserved. W3C
+ * liability, trademark and document use rules apply.
+ */
+
+interface SVGPoint;
+
+interface SVGPointList {
+  readonly attribute unsigned long numberOfItems;
+  [Throws]
+  void clear();
+  [Throws]
+  SVGPoint initialize(SVGPoint newItem);
+  [Throws]
+  getter SVGPoint getItem(unsigned long index);
+  [Throws]
+  SVGPoint insertItemBefore(SVGPoint newItem, unsigned long index);
+  [Throws]
+  SVGPoint replaceItem(SVGPoint newItem, unsigned long index);
+  [Throws]
+  SVGPoint removeItem(unsigned long index);
+  [Throws]
+  SVGPoint appendItem(SVGPoint newItem);
+
+  // Mozilla-specific stuff
+  readonly attribute unsigned long length; // synonym for numberOfItems
+};
new file mode 100644
--- /dev/null
+++ b/dom/webidl/SVGTransformList.webidl
@@ -0,0 +1,39 @@
+/* -*- Mode: IDL; tab-width: 2; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this file,
+ * You can obtain one at http://mozilla.org/MPL/2.0/.
+ *
+ * The origin of this IDL file is
+ * http://www.w3.org/TR/SVG11/
+ *
+ * Copyright © 2012 W3C® (MIT, ERCIM, Keio), All Rights Reserved. W3C
+ * liability, trademark and document use rules apply.
+ */
+
+interface SVGMatrix;
+interface SVGTransform;
+
+interface SVGTransformList {
+  readonly attribute unsigned long numberOfItems;
+  [Throws]
+  void clear();
+  [Throws]
+  SVGTransform initialize(SVGTransform newItem);
+  [Throws]
+  getter SVGTransform getItem(unsigned long index);
+  [Throws]
+  SVGTransform insertItemBefore(SVGTransform newItem, unsigned long index);
+  [Throws]
+  SVGTransform replaceItem(SVGTransform newItem, unsigned long index);
+  [Throws]
+  SVGTransform removeItem(unsigned long index);
+  [Throws]
+  SVGTransform appendItem(SVGTransform newItem);
+  [Throws]
+  SVGTransform createSVGTransformFromMatrix(SVGMatrix matrix);
+  [Throws]
+  SVGTransform consolidate();
+
+  // Mozilla-specific stuff
+  readonly attribute unsigned long length; // synonym for numberOfItems
+};
new file mode 100644
--- /dev/null
+++ b/dom/webidl/TouchList.webidl
@@ -0,0 +1,19 @@
+/* -*- Mode: IDL; tab-width: 2; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this file,
+ * You can obtain one at http://mozilla.org/MPL/2.0/.
+ *
+ * The origin of this IDL file is
+ * http://dvcs.w3.org/hg/webevents/raw-file/default/touchevents.html
+ *
+ * Copyright © 2012 W3C® (MIT, ERCIM, Keio), All Rights Reserved. W3C
+ * liability, trademark and document use rules apply.
+ */
+
+interface Touch;
+
+interface TouchList {
+  readonly attribute unsigned long length;
+  getter Touch? item(unsigned long index);
+  Touch identifiedTouch(long identifier);
+};
--- a/dom/webidl/WebIDL.mk
+++ b/dom/webidl/WebIDL.mk
@@ -7,23 +7,37 @@ webidl_base = $(topsrcdir)/dom/webidl
 generated_webidl_files = \
   CSS2Properties.webidl \
   $(NULL)
 
 webidl_files = \
   AudioContext.webidl \
   Blob.webidl \
   CanvasRenderingContext2D.webidl \
+  ClientRectList.webidl \
   CSSStyleDeclaration.webidl \
+  DOMTokenList.webidl \
+  DOMSettableTokenList.webidl \
   Function.webidl \
   EventListener.webidl \
   EventTarget.webidl \
+  FileList.webidl \
+  HTMLCollection.webidl \
+  HTMLOptionsCollection.webidl \
+  HTMLPropertiesCollection.webidl \
+  NodeList.webidl \
+  PaintRequestList.webidl \
   Performance.webidl \
   PerformanceNavigation.webidl \
   PerformanceTiming.webidl \
+  SVGLengthList.webidl \
+  SVGNumberList.webidl \
+  SVGPathSegList.webidl \
+  SVGPointList.webidl \
+  SVGTransformList.webidl \
   WebSocket.webidl \
   XMLHttpRequest.webidl \
   XMLHttpRequestEventTarget.webidl \
   XMLHttpRequestUpload.webidl \
   $(NULL)
 
 ifdef MOZ_WEBGL
 webidl_files += \
--- a/dom/workers/ScriptLoader.cpp
+++ b/dom/workers/ScriptLoader.cpp
@@ -492,18 +492,21 @@ public:
         // principal again.
         if (NS_FAILED(loadPrincipal->CheckMayLoad(finalURI, false, true))) {
           return NS_ERROR_DOM_BAD_URI;
         }
       }
 
       mWorkerPrivate->SetPrincipal(channelPrincipal);
 
-      // Set Eval and ContentSecurityPolicy
       if (parent) {
+        // XHR Params Allowed
+        mWorkerPrivate->SetXHRParamsAllowed(parent->XHRParamsAllowed());
+
+        // Set Eval and ContentSecurityPolicy
         mWorkerPrivate->SetCSP(parent->GetCSP());
         mWorkerPrivate->SetEvalAllowed(parent->IsEvalAllowed());
       }
     }
 
     return NS_OK;
   }
 
--- a/dom/workers/WorkerPrivate.cpp
+++ b/dom/workers/WorkerPrivate.cpp
@@ -10,16 +10,17 @@
 #include "nsIClassInfo.h"
 #include "nsIContentSecurityPolicy.h"
 #include "nsIConsoleService.h"
 #include "nsIDOMFile.h"
 #include "nsIDocument.h"
 #include "nsIDocShell.h"
 #include "nsIJSContextStack.h"
 #include "nsIMemoryReporter.h"
+#include "nsIPermissionManager.h"
 #include "nsIScriptError.h"
 #include "nsIScriptGlobalObject.h"
 #include "nsIScriptSecurityManager.h"
 #include "nsPIDOMWindow.h"
 #include "nsITextToSubURI.h"
 #include "nsITimer.h"
 #include "nsIURI.h"
 #include "nsIURL.h"
@@ -2453,25 +2454,27 @@ WorkerPrivate::WorkerPrivate(JSContext* 
                              JSContext* aParentJSContext,
                              const nsAString& aScriptURL, bool aIsChromeWorker,
                              const nsACString& aDomain,
                              nsCOMPtr<nsPIDOMWindow>& aWindow,
                              nsCOMPtr<nsIScriptContext>& aParentScriptContext,
                              nsCOMPtr<nsIURI>& aBaseURI,
                              nsCOMPtr<nsIPrincipal>& aPrincipal,
                              nsCOMPtr<nsIContentSecurityPolicy>& aCSP,
-                             bool aEvalAllowed)
+                             bool aEvalAllowed,
+                             bool aXHRParamsAllowed)
 : WorkerPrivateParent<WorkerPrivate>(aCx, aObject, aParent, aParentJSContext,
                                      aScriptURL, aIsChromeWorker, aDomain,
                                      aWindow, aParentScriptContext, aBaseURI,
                                      aPrincipal, aCSP, aEvalAllowed),
   mJSContext(nullptr), mErrorHandlerRecursionCount(0), mNextTimeoutId(1),
   mStatus(Pending), mSuspended(false), mTimerRunning(false),
   mRunningExpiredTimeouts(false), mCloseHandlerStarted(false),
-  mCloseHandlerFinished(false), mMemoryReporterRunning(false)
+  mCloseHandlerFinished(false), mMemoryReporterRunning(false),
+  mXHRParamsAllowed(aXHRParamsAllowed)
 {
   MOZ_COUNT_CTOR(mozilla::dom::workers::WorkerPrivate);
 }
 
 WorkerPrivate::~WorkerPrivate()
 {
   MOZ_COUNT_DTOR(mozilla::dom::workers::WorkerPrivate);
 }
@@ -2488,16 +2491,18 @@ WorkerPrivate::Create(JSContext* aCx, JS
   nsCOMPtr<nsIDocument> document;
   nsCOMPtr<nsPIDOMWindow> window;
   nsCOMPtr<nsIContentSecurityPolicy> csp;
 
   bool evalAllowed = true;
 
   JSContext* parentContext;
 
+  bool xhrParamsAllowed = false;
+
   if (aParent) {
     aParent->AssertIsOnWorkerThread();
 
     parentContext = aCx;
 
     // Domain is the only thing we can touch here. The rest will be handled by
     // the ScriptLoader.
     domain = aParent->Domain();
@@ -2610,16 +2615,18 @@ WorkerPrivate::Create(JSContext* aCx, JS
           }
 
           if (NS_FAILED(thirdPartyUtil->GetBaseDomain(codebase, domain))) {
             JS_ReportError(aCx, "Could not get domain!");
             return nullptr;
           }
         }
       }
+
+      xhrParamsAllowed = CheckXHRParamsAllowed(window);
     }