--- a/dom/base/Element.cpp
+++ b/dom/base/Element.cpp
@@ -3098,23 +3098,16 @@ Element::AttrValueToCORSMode(const nsAtt
   }
 
   return CORSMode(aValue->GetEnumValue());
 }
 
 static const char*
 GetFullScreenError(nsIDocument* aDoc)
 {
-  // Block fullscreen requests in the chrome document when the fullscreen API
-  // is configured for content only.
-  if (nsContentUtils::IsFullscreenApiContentOnly() &&
-      nsContentUtils::IsChromeDoc(aDoc)) {
-    return "FullScreenDeniedContentOnly";
-  }
-
   nsCOMPtr<nsPIDOMWindow> win = aDoc->GetWindow();
   if (aDoc->NodePrincipal()->GetAppStatus() >= nsIPrincipal::APP_STATUS_INSTALLED) {
     // Request is in a web app and in the same origin as the web app.
     // Don't enforce as strict security checks for web apps, the user
     // is supposed to have trust in them. However documents cross-origin
     // to the web app must still confirm to the normal security checks.
     return nullptr;
   }

--- a/dom/base/nsContentUtils.cpp
+++ b/dom/base/nsContentUtils.cpp
@@ -242,17 +242,16 @@ nsString* nsContentUtils::sControlText =
 nsString* nsContentUtils::sMetaText = nullptr;
 nsString* nsContentUtils::sOSText = nullptr;
 nsString* nsContentUtils::sAltText = nullptr;
 nsString* nsContentUtils::sModifierSeparator = nullptr;
 
 bool nsContentUtils::sInitialized = false;
 bool nsContentUtils::sIsFullScreenApiEnabled = false;
 bool nsContentUtils::sTrustedFullScreenOnly = true;
-bool nsContentUtils::sFullscreenApiIsContentOnly = false;
 bool nsContentUtils::sIsPerformanceTimingEnabled = false;
 bool nsContentUtils::sIsResourceTimingEnabled = false;
 bool nsContentUtils::sIsUserTimingLoggingEnabled = false;
 bool nsContentUtils::sIsExperimentalAutocompleteEnabled = false;
 bool nsContentUtils::sEncodeDecodeURLHash = false;
 
 uint32_t nsContentUtils::sHandlingInputTimeout = 1000;
 
@@ -507,22 +506,16 @@ nsContentUtils::Init()
   sBlockedScriptRunners = new nsTArray< nsCOMPtr<nsIRunnable> >;
 
   Preferences::AddBoolVarCache(&sAllowXULXBL_for_file,
                                "dom.allow_XUL_XBL_for_file");
 
   Preferences::AddBoolVarCache(&sIsFullScreenApiEnabled,
                                "full-screen-api.enabled");
 
-  // Note: We deliberately read this pref here because this code runs
-  // before the profile loads, so users' changes to this pref in about:config
-  // won't have any effect on behaviour. We don't really want users messing
-  // with this pref, as it affects the security model of the fullscreen API.
-  sFullscreenApiIsContentOnly = Preferences::GetBool("full-screen-api.content-only", false);
-
   Preferences::AddBoolVarCache(&sTrustedFullScreenOnly,
                                "full-screen-api.allow-trusted-requests-only");
 
   Preferences::AddBoolVarCache(&sIsPerformanceTimingEnabled,
                                "dom.enable_performance", true);
 
   Preferences::AddBoolVarCache(&sIsResourceTimingEnabled,
                                "dom.enable_resource_timing", true);
@@ -6632,23 +6625,16 @@ nsContentUtils::IsRequestFullScreenAllow
 {
   return !sTrustedFullScreenOnly ||
          EventStateManager::IsHandlingUserInput() ||
          IsCallerChrome();
 }
 
 /* static */
 bool
-nsContentUtils::IsFullscreenApiContentOnly()
-{
-  return sFullscreenApiIsContentOnly;
-}
-
-/* static */
-bool
 nsContentUtils::HaveEqualPrincipals(nsIDocument* aDoc1, nsIDocument* aDoc2)
 {
   if (!aDoc1 || !aDoc2) {
     return false;
   }
   bool principalsEqual = false;
   aDoc1->NodePrincipal()->Equals(aDoc2->NodePrincipal(), &principalsEqual);
   return principalsEqual;
@@ -6747,26 +6733,26 @@ nsContentUtils::FireMutationEventsForDir
       childNodes.AppendElement(child);
     }
     FragmentOrElement::FireNodeInserted(aDoc, aDest, childNodes);
   }
 }
 
 /* static */
 nsIDocument*
-nsContentUtils::GetFullscreenAncestor(nsIDocument* aDoc)
-{
+nsContentUtils::GetRootDocument(nsIDocument* aDoc)
+{
+  if (!aDoc) {
+    return nullptr;
+  }
   nsIDocument* doc = aDoc;
-  while (doc) {
-    if (doc->IsFullScreenDoc()) {
-      return doc;
-    }
+  while (doc->GetParentDocument()) {
     doc = doc->GetParentDocument();
   }
-  return nullptr;
+  return doc;
 }
 
 /* static */
 bool
 nsContentUtils::IsInPointerLockContext(nsIDOMWindow* aWin)
 {
   if (!aWin) {
     return false;

--- a/dom/base/nsContentUtils.h
+++ b/dom/base/nsContentUtils.h
@@ -1855,42 +1855,16 @@ public:
   /**
    * Returns true if requests for full-screen are allowed in the current
    * context. Requests are only allowed if the user initiated them (like with
    * a mouse-click or key press), unless this check has been disabled by
    * setting the pref "full-screen-api.allow-trusted-requests-only" to false.
    */
   static bool IsRequestFullScreenAllowed();
 
-  /**
-   * Returns true if the DOM fullscreen API is restricted to content only.
-   * This mirrors the pref "full-screen-api.content-only". If this is true,
-   * fullscreen requests in chrome are denied, and fullscreen requests in
-   * content stop percolating upwards before they reach chrome documents.
-   * That is, when an element in content requests fullscreen, only its
-   * containing frames that are in content are also made fullscreen, not
-   * the containing frame in the chrome document.
-   *
-   * Note if the fullscreen API is running in content only mode then multiple
-   * branches of a doctree can be fullscreen at the same time, but no fullscreen
-   * document will have a common ancestor with another fullscreen document
-   * that is also fullscreen (since the only common ancestor they can have
-   * is the chrome document, and that can't be fullscreen). i.e. multiple
-   * child documents of the chrome document can be fullscreen, but the chrome
-   * document won't be fullscreen.
-   *
-   * Making the fullscreen API content only is useful on platforms where we
-   * still want chrome to be visible or accessible while content is
-   * fullscreen.
-   *
-   * Note that if the fullscreen API is content only, chrome can still go
-   * fullscreen by setting the "fullScreen" attribute on its XUL window.
-   */
-  static bool IsFullscreenApiContentOnly();
-
   /*
    * Returns true if the performance timing APIs are enabled.
    */
   static bool IsPerformanceTimingEnabled()
   {
     return sIsPerformanceTimingEnabled;
   }
   
@@ -1943,22 +1917,20 @@ public:
    * Returns true if the content is in a document and contains a plugin
    * which we don't control event dispatch for, i.e. do any plugins in this
    * doc tree receive key events outside of our control? This always returns
    * false on MacOSX.
    */
   static bool HasPluginWithUncontrolledEventDispatch(nsIContent* aContent);
 
   /**
-   * Returns the document that is the closest ancestor to aDoc that is
-   * fullscreen. If aDoc is fullscreen this returns aDoc. If aDoc is not
-   * fullscreen and none of aDoc's ancestors are fullscreen this returns
-   * nullptr.
+   * Returns the root document in a document hierarchy. Normally this
+   * will be the chrome document.
    */
-  static nsIDocument* GetFullscreenAncestor(nsIDocument* aDoc);
+  static nsIDocument* GetRootDocument(nsIDocument* aDoc);
 
   /**
    * Returns true if aWin and the current pointer lock document
    * have common scriptable top window.
    */
   static bool IsInPointerLockContext(nsIDOMWindow* aWin);
 
   /**
@@ -2447,17 +2419,16 @@ private:
   static uint32_t sScriptBlockerCountWhereRunnersPrevented;
 
   static nsIInterfaceRequestor* sSameOriginChecker;
 
   static bool sIsHandlingKeyBoardEvent;
   static bool sAllowXULXBL_for_file;
   static bool sIsFullScreenApiEnabled;
   static bool sTrustedFullScreenOnly;
-  static bool sFullscreenApiIsContentOnly;
   static uint32_t sHandlingInputTimeout;
   static bool sIsPerformanceTimingEnabled;
   static bool sIsResourceTimingEnabled;
   static bool sIsUserTimingLoggingEnabled;
   static bool sIsExperimentalAutocompleteEnabled;
   static bool sEncodeDecodeURLHash;
 
   static nsHtml5StringParser* sHTMLFragmentParser;

--- a/dom/base/nsDocument.cpp
+++ b/dom/base/nsDocument.cpp
@@ -11046,45 +11046,27 @@ public:
   }
 
 private:
   nsCOMPtr<nsIDocument> mDoc;
   bool mValue;
   nsRefPtr<gfx::VRHMDInfo> mHMD;
 };
 
-static nsIDocument*
-GetFullscreenRootDocument(nsIDocument* aDoc)
-{
-  if (!aDoc) {
-    return nullptr;
-  }
-  nsIDocument* doc = aDoc;
-  nsIDocument* parent;
-  while ((parent = doc->GetParentDocument()) &&
-         (!nsContentUtils::IsFullscreenApiContentOnly() ||
-          !nsContentUtils::IsChromeDoc(parent))) {
-    doc = parent;
-  }
-  return doc;
-}
-
 static void
 SetWindowFullScreen(nsIDocument* aDoc, bool aValue, gfx::VRHMDInfo *aVRHMD = nullptr)
 {
   // Maintain list of fullscreen root documents.
-  nsCOMPtr<nsIDocument> root = GetFullscreenRootDocument(aDoc);
+  nsCOMPtr<nsIDocument> root = nsContentUtils::GetRootDocument(aDoc);
   if (aValue) {
     FullscreenRoots::Add(root);
   } else {
     FullscreenRoots::Remove(root);
   }
-  if (!nsContentUtils::IsFullscreenApiContentOnly()) {
-    nsContentUtils::AddScriptRunner(new nsSetWindowFullScreen(aDoc, aValue, aVRHMD));
-  }
+  nsContentUtils::AddScriptRunner(new nsSetWindowFullScreen(aDoc, aValue, aVRHMD));
 }
 
 class nsCallExitFullscreen : public nsRunnable {
 public:
   explicit nsCallExitFullscreen(nsIDocument* aDoc)
     : mDoc(aDoc) {}
   NS_IMETHOD Run()
   {
@@ -11279,35 +11261,31 @@ GetFullscreenLeaf(nsIDocument* aDoc)
 {
   nsIDocument* leaf = nullptr;
   GetFullscreenLeaf(aDoc, &leaf);
   if (leaf) {
     return leaf;
   }
   // Otherwise we could be either in a non-fullscreen doc tree, or we're
   // below the fullscreen doc. Start the search from the root.
-  nsIDocument* root = GetFullscreenRootDocument(aDoc);
+  nsIDocument* root = nsContentUtils::GetRootDocument(aDoc);
   // Check that the root is actually fullscreen so we don't waste time walking
   // around its descendants.
   if (!root->IsFullScreenDoc()) {
     return nullptr;
   }
   GetFullscreenLeaf(root, &leaf);
   return leaf;
 }
 
 void
 nsDocument::RestorePreviousFullScreenState()
 {
   NS_ASSERTION(!IsFullScreenDoc() || !FullscreenRoots::IsEmpty(),
     "Should have at least 1 fullscreen root when fullscreen!");
-  NS_ASSERTION(!nsContentUtils::IsFullscreenApiContentOnly() ||
-               !nsContentUtils::IsChromeDoc(this),
-               "Should not run RestorePreviousFullScreenState() on "
-               "chrome document when fullscreen is content only");
 
   if (!IsFullScreenDoc() || !GetWindow() || FullscreenRoots::IsEmpty()) {
     return;
   }
 
   // If fullscreen mode is updated the pointer should be unlocked
   nsCOMPtr<Element> pointerLockedElement =
     do_QueryReferent(EventStateManager::sPointerLockedElement);
@@ -11372,30 +11350,30 @@ nsDocument::RestorePreviousFullScreenSta
       }
 
       if (!nsContentUtils::HaveEqualPrincipals(doc, fullScreenDoc)) {
         // The origin which is fullscreen changed. Send a notification to
         // the root process so that a warning or approval UI can be shown
         // as necessary.
         nsAutoString origin;
         nsContentUtils::GetUTFOrigin(doc->NodePrincipal(), origin);
-        nsIDocument* root = GetFullscreenRootDocument(doc);
+        nsIDocument* root = nsContentUtils::GetRootDocument(doc);
         nsCOMPtr<nsIObserverService> os = mozilla::services::GetObserverService();
         os->NotifyObservers(root, "fullscreen-origin-change", origin.get());
       }
 
       break;
     }
   }
 
   if (doc == nullptr) {
     // We moved all documents in this doctree out of fullscreen mode,
     // move the top-level window out of fullscreen mode.
-    NS_ASSERTION(!GetFullscreenRootDocument(this)->IsFullScreenDoc(),
-      "Should have cleared all docs' stacks");
+    NS_ASSERTION(!nsContentUtils::GetRootDocument(this)->IsFullScreenDoc(),
+                 "Should have cleared all docs' stacks");
     nsRefPtr<AsyncEventDispatcher> asyncDispatcher = new AsyncEventDispatcher(
       this, NS_LITERAL_STRING("MozExitedDomFullscreen"), true, true);
     asyncDispatcher->PostDOMEvent();
     SetWindowFullScreen(this, false);
   }
 }
 
 bool
@@ -11472,18 +11450,17 @@ LogFullScreenDenied(bool aLogFailure, co
                                   NS_LITERAL_CSTRING("DOM"), aDoc,
                                   nsContentUtils::eDOM_PROPERTIES,
                                   aMessage);
 }
 
 nsresult
 nsDocument::AddFullscreenApprovedObserver()
 {
-  if (mHasFullscreenApprovedObserver ||
-      !Preferences::GetBool("full-screen-api.approval-required")) {
+  if (mHasFullscreenApprovedObserver) {
     return NS_OK;
   }
 
   nsCOMPtr<nsIObserverService> os = mozilla::services::GetObserverService();
   NS_ENSURE_TRUE(os, NS_ERROR_FAILURE);
 
   nsresult res = os->AddObserver(this, "fullscreen-approved", true);
   NS_ENSURE_SUCCESS(res, res);
@@ -11661,17 +11638,17 @@ nsresult nsDocument::RemoteFrameFullscre
   // Origin changed in child process, send notifiction, so that chrome can
   // update the UI to reflect the fullscreen origin change if necessary.
   // The BrowserElementChild listens on this, and forwards it over its
   // parent process, where it is redispatched. Chrome (in the root process,
   // which could be *this* process) listens for this notification so that
   // it can show a warning or approval UI.
   if (!aOrigin.IsEmpty()) {
     nsCOMPtr<nsIObserverService> os = mozilla::services::GetObserverService();
-    os->NotifyObservers(GetFullscreenRootDocument(this),
+    os->NotifyObservers(nsContentUtils::GetRootDocument(this),
                         "fullscreen-origin-change",
                         PromiseFlatString(aOrigin).get());
   }
 
   return NS_OK;
 }
 
 nsresult nsDocument::RemoteFrameFullscreenReverted()
@@ -11706,23 +11683,16 @@ nsDocument::RequestFullScreen(Element* a
   if (aElement->OwnerDoc() != this) {
     LogFullScreenDenied(true, "FullScreenDeniedMovedDocument", this);
     return;
   }
   if (!GetWindow()) {
     LogFullScreenDenied(true, "FullScreenDeniedLostWindow", this);
     return;
   }
-  if (nsContentUtils::IsFullscreenApiContentOnly() &&
-      nsContentUtils::IsChromeDoc(this)) {
-    // Block fullscreen requests in the chrome document when the fullscreen API
-    // is configured for content only.
-    LogFullScreenDenied(true, "FullScreenDeniedContentOnly", this);
-    return;
-  }
   if (!IsFullScreenEnabled(aWasCallerChrome, true)) {
     // IsFullScreenEnabled calls LogFullScreenDenied, no need to log.
     return;
   }
   if (GetFullScreenElement() &&
       !nsContentUtils::ContentIsDescendantOf(aElement, GetFullScreenElement())) {
     // If this document is full-screen, only grant full-screen requests from
     // a descendant of the current full-screen element.
@@ -11759,17 +11729,17 @@ nsDocument::RequestFullScreen(Element* a
   // too. We're required by the spec to dispatch the events in root-to-leaf
   // order, but we traverse the doctree in a leaf-to-root order, so we save
   // references to the documents we must dispatch to so that we get the order
   // as specified.
   nsAutoTArray<nsIDocument*, 8> changed;
 
   // Remember the root document, so that if a full-screen document is hidden
   // we can reset full-screen state in the remaining visible full-screen documents.
-  nsIDocument* fullScreenRootDoc = GetFullscreenRootDocument(this);
+  nsIDocument* fullScreenRootDoc = nsContentUtils::GetRootDocument(this);
   if (fullScreenRootDoc->IsFullScreenDoc()) {
     // A document is already in fullscreen, unlock the mouse pointer
     // before setting a new document to fullscreen
     UnlockPointer();
   }
 
   // If a document is already in fullscreen, then unlock the mouse pointer
   // before setting a new document to fullscreen
@@ -11873,17 +11843,17 @@ nsDocument::RequestFullScreen(Element* a
   // root document knows the origin of the document which requested fullscreen.
   // This is used for the fullscreen approval UI. If we're in a child
   // process, the root BrowserElementChild listens for this notification,
   // and forwards it across to its BrowserElementParent, which
   // re-broadcasts the message for the root document in its process.
   if (aNotifyOnOriginChange &&
       !nsContentUtils::HaveEqualPrincipals(previousFullscreenDoc, this)) {
     nsCOMPtr<nsIObserverService> os = mozilla::services::GetObserverService();
-    nsIDocument* root = GetFullscreenRootDocument(this);
+    nsIDocument* root = nsContentUtils::GetRootDocument(this);
     nsAutoString origin;
     nsContentUtils::GetUTFOrigin(NodePrincipal(), origin);
     os->NotifyObservers(root, "fullscreen-origin-change", origin.get());
   }
 
   // Make the window full-screen. Note we must make the state changes above
   // before making the window full-screen, as then the document reports as
   // being in full-screen mode when the chrome "fullscreen" event fires,

--- a/dom/base/nsFocusManager.cpp
+++ b/dom/base/nsFocusManager.cpp
@@ -1226,26 +1226,25 @@ nsFocusManager::SetFocusInner(nsIContent
   }
 
   // Exit fullscreen if we're focusing a windowed plugin on a non-MacOSX
   // system. We don't control event dispatch to windowed plugins on non-MacOSX,
   // so we can't display the "Press ESC to leave fullscreen mode" warning on
   // key input if a windowed plugin is focused, so just exit fullscreen
   // to guard against phishing.
 #ifndef XP_MACOSX
-  nsIDocument* fullscreenAncestor;
   if (contentToFocus &&
-      (fullscreenAncestor = nsContentUtils::GetFullscreenAncestor(contentToFocus->OwnerDoc())) &&
+      nsContentUtils::GetRootDocument(contentToFocus->OwnerDoc())->IsFullScreenDoc() &&
       nsContentUtils::HasPluginWithUncontrolledEventDispatch(contentToFocus)) {
     nsContentUtils::ReportToConsole(nsIScriptError::warningFlag,
                                     NS_LITERAL_CSTRING("DOM"),
                                     contentToFocus->OwnerDoc(),
                                     nsContentUtils::eDOM_PROPERTIES,
                                     "FocusedWindowedPluginWhileFullScreen");
-    nsIDocument::ExitFullscreen(fullscreenAncestor, /* async */ true);
+    nsIDocument::ExitFullscreen(contentToFocus->OwnerDoc(), /* async */ true);
   }
 #endif
 
   // if the FLAG_NOSWITCHFRAME flag is used, only allow the focus to be
   // shifted away from the current element if the new shell to focus is
   // the same or an ancestor shell of the currently focused shell.
   bool allowFrameSwitch = !(aFlags & FLAG_NOSWITCHFRAME) ||
                             IsSameOrAncestor(newWindow, mFocusedWindow);

--- a/dom/base/nsIDocument.h
+++ b/dom/base/nsIDocument.h
@@ -1156,20 +1156,17 @@ public:
    * If aDocument is null, all fullscreen documents in all browser windows
    * exit fullscreen.
    *
    * If aDocument is non null, all documents from aDocument's fullscreen root
    * to the fullscreen leaf exit fullscreen. 
    *
    * Note that the fullscreen leaf is the bottom-most document which is
    * fullscreen, it may have non-fullscreen child documents. The fullscreen
-   * root is usually the chrome document, but if fullscreen is content-only,
-   * (see the comment in nsContentUtils.h on IsFullscreenApiContentOnly())
-   * the fullscreen root will be a direct child of the chrome document, and
-   * there may be other branches of the same doctree that are fullscreen.
+   * root is normally the chrome document.
    *
    * If aRunAsync is true, fullscreen is executed asynchronously.
    *
    * Note if aDocument is not fullscreen this function has no effect, even if
    * aDocument has fullscreen ancestors.
    */
   static void ExitFullscreen(nsIDocument* aDocument, bool aRunAsync);
 

--- a/dom/events/ContentEventHandler.cpp
+++ b/dom/events/ContentEventHandler.cpp
@@ -1048,16 +1048,17 @@ ContentEventHandler::OnQueryCaretRect(Wi
     if (offset == aEvent->mInput.mOffset) {
       if (!caretFrame) {
         return NS_ERROR_FAILURE;
       }
       rv = ConvertToRootViewRelativeOffset(caretFrame, caretRect);
       NS_ENSURE_SUCCESS(rv, rv);
       aEvent->mReply.mRect = LayoutDevicePixel::FromUntyped(
         caretRect.ToOutsidePixels(caretFrame->PresContext()->AppUnitsPerDevPixel()));
+      aEvent->mReply.mWritingMode = caretFrame->GetWritingMode();
       aEvent->mReply.mOffset = aEvent->mInput.mOffset;
       aEvent->mSucceeded = true;
       return NS_OK;
     }
   }
 
   // Otherwise, we should set the guessed caret rect.
   nsRefPtr<nsRange> range = new nsRange(mRootContent);
@@ -1081,16 +1082,17 @@ ContentEventHandler::OnQueryCaretRect(Wi
   rect.width = caretRect.width;
   rect.height = frame->GetSize().height;
 
   rv = ConvertToRootViewRelativeOffset(frame, rect);
   NS_ENSURE_SUCCESS(rv, rv);
 
   aEvent->mReply.mRect = LayoutDevicePixel::FromUntyped(
       rect.ToOutsidePixels(mPresContext->AppUnitsPerDevPixel()));
+  aEvent->mReply.mWritingMode = frame->GetWritingMode();
   aEvent->mSucceeded = true;
   return NS_OK;
 }
 
 nsresult
 ContentEventHandler::OnQueryContentState(WidgetQueryContentEvent* aEvent)
 {
   nsresult rv = Init(aEvent);

--- a/dom/events/IMEContentObserver.cpp
+++ b/dom/events/IMEContentObserver.cpp
@@ -27,16 +27,17 @@
 #include "nsIPresShell.h"
 #include "nsISelectionController.h"
 #include "nsISelectionPrivate.h"
 #include "nsISupports.h"
 #include "nsIWidget.h"
 #include "nsPresContext.h"
 #include "nsThreadUtils.h"
 #include "nsWeakReference.h"
+#include "WritingModes.h"
 
 namespace mozilla {
 
 using namespace widget;
 
 NS_IMPL_CYCLE_COLLECTION_CLASS(IMEContentObserver)
 
 NS_IMPL_CYCLE_COLLECTION_UNLINK_BEGIN(IMEContentObserver)
@@ -242,16 +243,22 @@ IMEContentObserver::UnregisterObservers(
   }
 
   if (mUpdatePreference.WantPositionChanged() && mDocShell) {
     mDocShell->RemoveWeakScrollObserver(this);
     mDocShell->RemoveWeakReflowObserver(this);
   }
 }
 
+nsPresContext*
+IMEContentObserver::GetPresContext() const
+{
+  return mESM ? mESM->GetPresContext() : nullptr;
+}
+
 void
 IMEContentObserver::Destroy()
 {
   // WARNING: When you change this method, you have to check Unlink() too.
 
   UnregisterObservers(false);
 
   mEditor = nullptr;
@@ -326,22 +333,49 @@ public:
     : mDispatcher(aDispatcher)
     , mCausedByComposition(aCausedByComposition)
   {
     MOZ_ASSERT(mDispatcher);
   }
 
   NS_IMETHOD Run()
   {
-    if (mDispatcher->GetWidget()) {
-      IMENotification notification(NOTIFY_IME_OF_SELECTION_CHANGE);
-      notification.mSelectionChangeData.mCausedByComposition =
-         mCausedByComposition;
-      mDispatcher->GetWidget()->NotifyIME(notification);
+    nsCOMPtr<nsIWidget> widget = mDispatcher->GetWidget();
+    nsPresContext* presContext = mDispatcher->GetPresContext();
+    if (!widget || !presContext) {
+      return NS_OK;
+    }
+
+    // XXX Cannot we cache some information for reducing the cost to compute
+    //     selection offset and writing mode?
+    WidgetQueryContentEvent selection(true, NS_QUERY_SELECTED_TEXT, widget);
+    ContentEventHandler handler(presContext);
+    handler.OnQuerySelectedText(&selection);
+    if (NS_WARN_IF(!selection.mSucceeded)) {
+      return NS_OK;
     }
+
+    // The widget might be destroyed during querying the content since it
+    // causes flushing layout.
+    widget = mDispatcher->GetWidget();
+    if (!widget || NS_WARN_IF(widget->Destroyed())) {
+      return NS_OK;
+    }
+
+    IMENotification notification(NOTIFY_IME_OF_SELECTION_CHANGE);
+    notification.mSelectionChangeData.mOffset =
+      selection.mReply.mOffset;
+    notification.mSelectionChangeData.mLength =
+      selection.mReply.mString.Length();
+    notification.mSelectionChangeData.SetWritingMode(
+                                        selection.GetWritingMode());
+    notification.mSelectionChangeData.mReversed = selection.mReply.mReversed;
+    notification.mSelectionChangeData.mCausedByComposition =
+      mCausedByComposition;
+    widget->NotifyIME(notification);
     return NS_OK;
   }
 
 private:
   nsRefPtr<IMEContentObserver> mDispatcher;
   bool mCausedByComposition;
 };
 

--- a/dom/events/IMEContentObserver.h
+++ b/dom/events/IMEContentObserver.h
@@ -74,16 +74,17 @@ public:
   void DisconnectFromEventStateManager();
   bool IsManaging(nsPresContext* aPresContext, nsIContent* aContent);
   bool IsEditorHandlingEventForComposition() const;
   bool KeepAliveDuringDeactive() const
   {
     return mUpdatePreference.WantDuringDeactive();
   }
   nsIWidget* GetWidget() const { return mWidget; }
+  nsPresContext* GetPresContext() const;
   nsresult GetSelectionAndRoot(nsISelection** aSelection,
                                nsIContent** aRoot) const;
 
   struct TextChangeData
   {
     // mStartOffset is the start offset of modified or removed text in
     // original content and inserted text in new content.
     uint32_t mStartOffset;

--- a/dom/ipc/TabParent.cpp
+++ b/dom/ipc/TabParent.cpp
@@ -1889,16 +1889,25 @@ TabParent::RecvNotifyIMESelection(const 
     mIMESelectionFocus = aFocus;
     mWritingMode = aWritingMode;
     const nsIMEUpdatePreference updatePreference =
       widget->GetIMEUpdatePreference();
     if (updatePreference.WantSelectionChange() &&
         (updatePreference.WantChangesCausedByComposition() ||
          !aCausedByComposition)) {
       IMENotification notification(NOTIFY_IME_OF_SELECTION_CHANGE);
+      notification.mSelectionChangeData.mOffset =
+        std::min(mIMESelectionAnchor, mIMESelectionFocus);
+      notification.mSelectionChangeData.mLength =
+        mIMESelectionAnchor > mIMESelectionFocus ?
+          mIMESelectionAnchor - mIMESelectionFocus :
+          mIMESelectionFocus - mIMESelectionAnchor;
+      notification.mSelectionChangeData.mReversed =
+        mIMESelectionFocus < mIMESelectionAnchor;
+      notification.mSelectionChangeData.SetWritingMode(mWritingMode);
       notification.mSelectionChangeData.mCausedByComposition =
         aCausedByComposition;
       widget->NotifyIME(notification);
     }
   }
   return true;
 }
 

--- a/dom/locales/en-US/chrome/dom/dom.properties
+++ b/dom/locales/en-US/chrome/dom/dom.properties
@@ -74,17 +74,16 @@ FullScreenDeniedHidden=Request for full-
 FullScreenDeniedIframeNotAllowed=Request for full-screen was denied because at least one of the document's containing iframes does not have an "allowfullscreen" attribute.
 FullScreenDeniedNotInputDriven=Request for full-screen was denied because Element.mozRequestFullScreen() was not called from inside a short running user-generated event handler.
 FullScreenDeniedNotInDocument=Request for full-screen was denied because requesting element is no longer in its document.
 FullScreenDeniedMovedDocument=Request for full-screen was denied because requesting element has moved document.
 FullScreenDeniedLostWindow=Request for full-screen was denied because we no longer have a window.
 FullScreenDeniedSubDocFullScreen=Request for full-screen was denied because a subdocument of the document requesting full-screen is already full-screen.
 FullScreenDeniedNotDescendant=Request for full-screen was denied because requesting element is not a descendant of the current full-screen element.
 FullScreenDeniedNotFocusedTab=Request for full-screen was denied because requesting element is not in the currently focused tab.
-FullScreenDeniedContentOnly=Request for full-screen was denied because requesting element is in the chrome document and the fullscreen API is configured for content only.
 RemovedFullScreenElement=Exited full-screen because full-screen element was removed from document.
 FocusedWindowedPluginWhileFullScreen=Exited full-screen because windowed plugin was focused.
 HTMLSyncXHRWarning=HTML parsing in XMLHttpRequest is not supported in the synchronous mode.
 InvalidRedirectChannelWarning=Unable to redirect to %S because the channel doesn't implement nsIWritablePropertyBag2.
 ResponseTypeSyncXHRWarning=Use of XMLHttpRequest's responseType attribute is no longer supported in the synchronous mode in window context.
 WithCredentialsSyncXHRWarning=Use of XMLHttpRequest's withCredentials attribute is no longer supported in the synchronous mode in window context.
 TimeoutSyncXHRWarning=Use of XMLHttpRequest's timeout attribute is not supported in the synchronous mode in window context.
 JSONCharsetWarning=An attempt was made to declare a non-UTF-8 encoding for JSON retrieved using XMLHttpRequest. Only UTF-8 is supported for decoding JSON.

--- a/dom/media/fmp4/wmf/WMFAudioMFTManager.cpp
+++ b/dom/media/fmp4/wmf/WMFAudioMFTManager.cpp
@@ -200,24 +200,27 @@ WMFAudioMFTManager::UpdateOutputType()
 
 HRESULT
 WMFAudioMFTManager::Output(int64_t aStreamOffset,
                            nsRefPtr<MediaData>& aOutData)
 {
   aOutData = nullptr;
   RefPtr<IMFSample> sample;
   HRESULT hr;
+  bool alreadyDidTypeChange = false;
   while (true) {
     hr = mDecoder->Output(&sample);
     if (hr == MF_E_TRANSFORM_NEED_MORE_INPUT) {
       return hr;
     }
     if (hr == MF_E_TRANSFORM_STREAM_CHANGE) {
       hr = UpdateOutputType();
       NS_ENSURE_TRUE(SUCCEEDED(hr), hr);
+      NS_ENSURE_FALSE(alreadyDidTypeChange, MF_E_TRANSFORM_STREAM_CHANGE);
+      alreadyDidTypeChange = true;
       continue;
     }
     break;
   }
 
   NS_ENSURE_TRUE(SUCCEEDED(hr), hr);
 
   RefPtr<IMFMediaBuffer> buffer;

--- a/dom/media/fmp4/wmf/WMFMediaDataDecoder.cpp
+++ b/dom/media/fmp4/wmf/WMFMediaDataDecoder.cpp
@@ -3,16 +3,17 @@
 /* This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
 
 #include "WMFMediaDataDecoder.h"
 #include "VideoUtils.h"
 #include "WMFUtils.h"
 #include "nsTArray.h"
+#include "mozilla/Telemetry.h"
 
 #include "prlog.h"
 
 PRLogModuleInfo* GetDemuxerLog();
 #define LOG(...) PR_LOG(GetDemuxerLog(), PR_LOG_DEBUG, (__VA_ARGS__))
 
 namespace mozilla {
 
@@ -39,16 +40,49 @@ WMFMediaDataDecoder::Init()
   MOZ_ASSERT(!mIsShutDown);
 
   mDecoder = mMFTManager->Init();
   NS_ENSURE_TRUE(mDecoder, NS_ERROR_FAILURE);
 
   return NS_OK;
 }
 
+// A single telemetry sample is reported for each MediaDataDecoder object
+// that has detected error or produced output successfully.
+static void
+SendTelemetry(HRESULT hr)
+{
+  // Collapse the error codes into a range of 0-0xff that can be viewed in
+  // telemetry histograms.  For most MF_E_* errors, unique samples are used,
+  // retaining the least significant 7 or 8 bits.  Other error codes are
+  // bucketed.
+  uint32_t sample;
+  if (SUCCEEDED(hr)) {
+    sample = 0;
+  } else if (hr < 0xc00d36b0) {
+    sample = 1; // low bucket
+  } else if (hr < 0xc00d3700) {
+    sample = hr & 0xffU; // MF_E_*
+  } else if (hr <= 0xc00d3705) {
+    sample = 0x80 + (hr & 0xfU); // more MF_E_*
+  } else if (hr < 0xc00d6d60) {
+    sample = 2; // mid bucket
+  } else if (hr <= 0xc00d6d78) {
+    sample = hr & 0xffU; // MF_E_TRANSFORM_*
+  } else {
+    sample = 3; // high bucket
+  }
+
+  nsCOMPtr<nsIRunnable> runnable = NS_NewRunnableFunction(
+    [sample] {
+      Telemetry::Accumulate(Telemetry::MEDIA_WMF_DECODE_ERROR, sample);
+    });
+  NS_DispatchToMainThread(runnable);
+}
+
 nsresult
 WMFMediaDataDecoder::Shutdown()
 {
   MOZ_DIAGNOSTIC_ASSERT(!mIsShutDown);
 
   if (mTaskQueue) {
     mTaskQueue->Dispatch(
       NS_NewRunnableMethod(this, &WMFMediaDataDecoder::ProcessShutdown));
@@ -60,16 +94,19 @@ WMFMediaDataDecoder::Shutdown()
 }
 
 void
 WMFMediaDataDecoder::ProcessShutdown()
 {
   if (mMFTManager) {
     mMFTManager->Shutdown();
     mMFTManager = nullptr;
+    if (!mRecordedError && mHasSuccessfulOutput) {
+      SendTelemetry(S_OK);
+    }
   }
   mDecoder = nullptr;
 }
 
 // Inserts data into the decoder's pipeline.
 nsresult
 WMFMediaDataDecoder::Input(MediaRawData* aSample)
 {
@@ -95,40 +132,49 @@ WMFMediaDataDecoder::ProcessDecode(Media
       return;
     }
   }
 
   HRESULT hr = mMFTManager->Input(aSample);
   if (FAILED(hr)) {
     NS_WARNING("MFTManager rejected sample");
     mCallback->Error();
+    if (!mRecordedError) {
+      SendTelemetry(hr);
+      mRecordedError = true;
+    }
     return;
   }
 
   mLastStreamOffset = aSample->mOffset;
 
   ProcessOutput();
 }
 
 void
 WMFMediaDataDecoder::ProcessOutput()
 {
   nsRefPtr<MediaData> output;
   HRESULT hr = S_OK;
   while (SUCCEEDED(hr = mMFTManager->Output(mLastStreamOffset, output)) &&
          output) {
+    mHasSuccessfulOutput = true;
     mCallback->Output(output);
   }
   if (hr == MF_E_TRANSFORM_NEED_MORE_INPUT) {
     if (mTaskQueue->IsEmpty()) {
       mCallback->InputExhausted();
     }
   } else if (FAILED(hr)) {
     NS_WARNING("WMFMediaDataDecoder failed to output data");
     mCallback->Error();
+    if (!mRecordedError) {
+      SendTelemetry(hr);
+      mRecordedError = true;
+    }
   }
 }
 
 void
 WMFMediaDataDecoder::ProcessFlush()
 {
   if (mDecoder) {
     mDecoder->Flush();

--- a/dom/media/fmp4/wmf/WMFMediaDataDecoder.h
+++ b/dom/media/fmp4/wmf/WMFMediaDataDecoder.h
@@ -104,13 +104,17 @@ private:
   // For access to and waiting on mIsFlushing
   Monitor mMonitor;
   // Set on reader/decode thread calling Flush() to indicate that output is
   // not required and so input samples on mTaskQueue need not be processed.
   // Cleared on mTaskQueue.
   bool mIsFlushing;
 
   bool mIsShutDown;
+
+  // For telemetry
+  bool mHasSuccessfulOutput = false;
+  bool mRecordedError = false;
 };
 
 } // namespace mozilla
 
 #endif // WMFMediaDataDecoder_h_

--- a/dom/media/fmp4/wmf/WMFVideoMFTManager.cpp
+++ b/dom/media/fmp4/wmf/WMFVideoMFTManager.cpp
@@ -477,40 +477,43 @@ WMFVideoMFTManager::CreateD3DVideoFrame(
 // Blocks until decoded sample is produced by the deoder.
 HRESULT
 WMFVideoMFTManager::Output(int64_t aStreamOffset,
                            nsRefPtr<MediaData>& aOutData)
 {
   RefPtr<IMFSample> sample;
   HRESULT hr;
   aOutData = nullptr;
+  bool alreadyDidTypeChange = false;
 
   // Loop until we decode a sample, or an unexpected error that we can't
   // handle occurs.
   while (true) {
     hr = mDecoder->Output(&sample);
     if (hr == MF_E_TRANSFORM_NEED_MORE_INPUT) {
       return MF_E_TRANSFORM_NEED_MORE_INPUT;
     }
     if (hr == MF_E_TRANSFORM_STREAM_CHANGE) {
       // Video stream output type change. Probably a geometric apperature
       // change. Reconfigure the video geometry, so that we output the
       // correct size frames.
       MOZ_ASSERT(!sample);
       hr = ConfigureVideoFrameGeometry();
       NS_ENSURE_TRUE(SUCCEEDED(hr), hr);
+      NS_ENSURE_FALSE(alreadyDidTypeChange, MF_E_TRANSFORM_STREAM_CHANGE);
       // Loop back and try decoding again...
+      alreadyDidTypeChange = true;
       continue;
     }
     if (SUCCEEDED(hr)) {
       break;
     }
     // Else unexpected error, assert, and bail.
     NS_WARNING("WMFVideoMFTManager::Output() unexpected error");
-    return E_FAIL;
+    return hr;
   }
 
   nsRefPtr<VideoData> frame;
   if (mUseHwAccel) {
     hr = CreateD3DVideoFrame(sample, aStreamOffset, getter_AddRefs(frame));
   } else {
     hr = CreateBasicVideoFrame(sample, aStreamOffset, getter_AddRefs(frame));
   }

--- a/dom/media/omx/AudioOffloadPlayer.cpp
+++ b/dom/media/omx/AudioOffloadPlayer.cpp
@@ -380,23 +380,16 @@ status_t AudioOffloadPlayer::DoSeek()
       MediaDecoder::SeekResolveValue val(mReachedEOS, mSeekTarget.mEventVisibility);
       mSeekPromise.Resolve(val, __func__);
     }
   }
 
   return OK;
 }
 
-double AudioOffloadPlayer::GetMediaTimeSecs()
-{
-  MOZ_ASSERT(NS_IsMainThread());
-  return (static_cast<double>(GetMediaTimeUs()) /
-      static_cast<double>(USECS_PER_S));
-}
-
 int64_t AudioOffloadPlayer::GetMediaTimeUs()
 {
   android::Mutex::Autolock autoLock(mLock);
 
   int64_t playPosition = 0;
   if (mSeekTarget.IsValid()) {
     return mSeekTarget.mTime;
   }

--- a/dom/media/omx/AudioOffloadPlayer.h
+++ b/dom/media/omx/AudioOffloadPlayer.h
@@ -83,17 +83,17 @@ public:
   // Start the source if it's not already started and open the GonkAudioSink to
   // create an offloaded audio track
   virtual status_t Start(bool aSourceAlreadyStarted = false) override;
 
   virtual status_t ChangeState(MediaDecoder::PlayState aState) override;
 
   virtual void SetVolume(double aVolume) override;
 
-  virtual double GetMediaTimeSecs() override;
+  virtual int64_t GetMediaTimeUs() override;
 
   // To update progress bar when the element is visible
   virtual void SetElementVisibility(bool aIsVisible) override;;
 
   // Update ready state based on current play state. Not checking data
   // availability since offloading is currently done only when whole compressed
   // data is available
   virtual MediaDecoderOwner::NextFrameStatus GetNextFrameStatus() override;
@@ -187,18 +187,16 @@ private:
   // It is triggered in Pause() and canceled when there is a Play() within
   // OFFLOAD_PAUSE_MAX_USECS. Used only from main thread so no lock is needed.
   nsCOMPtr<nsITimer> mResetTimer;
 
   // To avoid device suspend when mResetTimer is going to be triggered.
   // Used only from main thread so no lock is needed.
   nsRefPtr<mozilla::dom::WakeLock> mWakeLock;
 
-  int64_t GetMediaTimeUs();
-
   // Provide the playback position in microseconds from total number of
   // frames played by audio track
   int64_t GetOutputPlayPositionUs_l() const;
 
   // Fill the buffer given by audio sink with data from compressed audio
   // source. Also handles the seek by seeking audio source and stop the sink in
   // case of error
   size_t FillBuffer(void *aData, size_t aSize);

--- a/dom/media/omx/AudioOffloadPlayerBase.h
+++ b/dom/media/omx/AudioOffloadPlayerBase.h
@@ -49,17 +49,17 @@ public:
 
   virtual status_t ChangeState(MediaDecoder::PlayState aState)
   {
     return android::NO_INIT;
   }
 
   virtual void SetVolume(double aVolume) {}
 
-  virtual double GetMediaTimeSecs() { return 0; }
+  virtual int64_t GetMediaTimeUs() { return 0; }
 
   // To update progress bar when the element is visible
   virtual void SetElementVisibility(bool aIsVisible) {}
 
   // Update ready state based on current play state. Not checking data
   // availability since offloading is currently done only when whole compressed
   // data is available
   virtual MediaDecoderOwner::NextFrameStatus GetNextFrameStatus()

--- a/dom/media/omx/MediaOmxCommonDecoder.cpp
+++ b/dom/media/omx/MediaOmxCommonDecoder.cpp
@@ -239,17 +239,17 @@ int64_t
 MediaOmxCommonDecoder::CurrentPosition()
 {
   MOZ_ASSERT(NS_IsMainThread());
   if (!mAudioOffloadPlayer) {
     return MediaDecoder::CurrentPosition();
   }
 
   ReentrantMonitorAutoEnter mon(GetReentrantMonitor());
-  return mAudioOffloadPlayer->GetMediaTimeSecs();
+  return mAudioOffloadPlayer->GetMediaTimeUs();
 }
 
 void
 MediaOmxCommonDecoder::SetElementVisibility(bool aIsVisible)
 {
   MOZ_ASSERT(NS_IsMainThread());
   if (mAudioOffloadPlayer) {
     mAudioOffloadPlayer->SetElementVisibility(aIsVisible);

deleted file mode 100644
--- a/dom/media/webspeech/synth/ipc/test/file_ipc.html
+++ /dev/null
@@ -1,196 +0,0 @@
-<!DOCTYPE HTML>
-<html>
-<head>
-  <title>Test for OOP TTS</title>
-  <script type="application/javascript" src="../../test/common.js"></script>
-  <link rel="stylesheet" type="text/css" href="/tests/SimpleTest/test.css"/>
-</head>
-  <body>
-
-  <script type="application/javascript;version=1.7">
-    "use strict";
-
-    window.SimpleTest = parent.SimpleTest;
-    window.ok = parent.ok;
-    window.is = parent.is;
-    window.info = parent.info;
-
-    // The crash observer registration functions are stubbed out here to
-    // prevent the iframe test runner from breaking later crash-related tests.
-    function iframeScriptFirst() {
-      SpecialPowers.prototype.registerProcessCrashObservers = () => {};
-      SpecialPowers.prototype.unregisterProcessCrashObservers = () => {};
-
-      content.wrappedJSObject.RunSet.reloadAndRunAll({
-          preventDefault: function() { },
-          __exposedProps__: { preventDefault: 'r' }
-      });
-    }
-
-    function iframeScriptSecond() {
-      let TestRunner = content.wrappedJSObject.TestRunner;
-
-      let oldComplete = TestRunner.onComplete;
-
-      TestRunner.onComplete = function() {
-        TestRunner.onComplete = oldComplete;
-
-        sendAsyncMessage("test:SpeechSynthesis:ipcTestComplete", {
-          result: JSON.stringify(TestRunner._failedTests)
-        });
-
-        if (oldComplete) {
-          oldComplete();
-        }
-      };
-      TestRunner.structuredLogger._dumpMessage = function(msg) {
-        sendAsyncMessage("test:SpeechSynthesis:ipcTestMessage", { msg: msg });
-      }
-    }
-
-    let VALID_ACTIONS = ['suite_start', 'suite_end', 'test_start', 'test_end', 'test_status', 'process_output', 'log'];
-    function validStructuredMessage(message) {
-      return message.action !== undefined && VALID_ACTIONS.indexOf(message.action) >= 0;
-    }
-    function onTestMessage(data) {
-      let message = SpecialPowers.wrap(data).data.msg;
-
-      if (validStructuredMessage(message)) {
-        switch (message.action) {
-          case "test_status":
-          case "test_end":
-            let test_tokens = message.test.split("/");
-            let test_name = test_tokens[test_tokens.length - 1];
-            if (message.subtest) {
-                test_name += " | " + message.subtest;
-            }
-            ok(message.expected === undefined, test_name, message.message);
-            break;
-          case "log":
-            info(message.message);
-            break;
-          default:
-            // nothing
-        }
-      }
-    }
-
-    function onTestComplete() {
-      let comp = SpecialPowers.wrap(SpecialPowers.Components);
-      let mm = SpecialPowers.getBrowserFrameMessageManager(iframe);
-      let spObserver = comp.classes["@mozilla.org/special-powers-observer;1"]
-                            .getService(comp.interfaces.nsIMessageListener);
-
-      mm.removeMessageListener("SPPrefService", spObserver);
-      mm.removeMessageListener("SPProcessCrashService", spObserver);
-      mm.removeMessageListener("SPPingService", spObserver);
-      mm.removeMessageListener("SpecialPowers.Quit", spObserver);
-      mm.removeMessageListener("SPPermissionManager", spObserver);
-
-      mm.removeMessageListener("test:SpeechSynthesis:ipcTestMessage", onTestMessage);
-      mm.removeMessageListener("test:SpeechSynthesis:ipcTestComplete", onTestComplete);
-
-      let ppmm = SpecialPowers.Cc["@mozilla.org/parentprocessmessagemanager;1"]
-        .getService(SpecialPowers.Ci.nsIMessageBroadcaster);
-      ppmm.removeMessageListener("test:SpeechSynthesis:ipcSynthAddVoice", onSynthAddVoice);
-      ppmm.removeMessageListener("test:SpeechSynthesis:ipcSynthSetDefault", onSynthSetDefault);
-      ppmm.removeMessageListener("test:SpeechSynthesis:ipcSynthCleanup", onSynthCleanup);
-
-      SimpleTest.executeSoon(function () { SimpleTest.finish(); });
-    }
-
-    function onSynthAddVoice(data) {
-      let message = SpecialPowers.wrap(data).json;
-      return synthAddVoice.apply(synthAddVoice, message);
-    }
-
-    function onSynthSetDefault(data) {
-      let message = SpecialPowers.wrap(data).json;
-      synthSetDefault.apply(synthSetDefault, message);
-    }
-
-    function onSynthCleanup(data) {
-      synthCleanup();
-    }
-
-    function runTests() {
-      let iframe = document.createElement("iframe");
-      SpecialPowers.wrap(iframe).mozbrowser = true;
-      iframe.id = "iframe";
-      iframe.style.width = "100%";
-      iframe.style.height = "1000px";
-
-      function iframeLoadSecond() {
-        ok(true, "Got second iframe load event.");
-        iframe.removeEventListener("mozbrowserloadend", iframeLoadSecond);
-        let mm = SpecialPowers.getBrowserFrameMessageManager(iframe);
-        mm.loadFrameScript("data:,(" + iframeScriptSecond.toString() + ")();",
-                           false);
-      }
-
-      function iframeLoadFirst() {
-        ok(true, "Got first iframe load event.");
-        iframe.removeEventListener("mozbrowserloadend", iframeLoadFirst);
-        iframe.addEventListener("mozbrowserloadend", iframeLoadSecond);
-
-        let mm = SpecialPowers.getBrowserFrameMessageManager(iframe);
-
-        let comp = SpecialPowers.wrap(SpecialPowers.Components);
-
-        let spObserver =
-          comp.classes["@mozilla.org/special-powers-observer;1"]
-              .getService(comp.interfaces.nsIMessageListener);
-
-        mm.addMessageListener("SPPrefService", spObserver);
-        mm.addMessageListener("SPProcessCrashService", spObserver);
-        mm.addMessageListener("SPPingService", spObserver);
-        mm.addMessageListener("SpecialPowers.Quit", spObserver);
-        mm.addMessageListener("SPPermissionManager", spObserver);
-
-        mm.addMessageListener("test:SpeechSynthesis:ipcTestMessage", onTestMessage);
-        mm.addMessageListener("test:SpeechSynthesis:ipcTestComplete", onTestComplete);
-
-        let specialPowersBase = "chrome://specialpowers/content/";
-        mm.loadFrameScript(specialPowersBase + "MozillaLogger.js", false);
-        mm.loadFrameScript(specialPowersBase + "specialpowersAPI.js", false);
-        mm.loadFrameScript(specialPowersBase + "specialpowers.js", false);
-
-        mm.loadFrameScript("data:,(" + iframeScriptFirst.toString() + ")();", false);
-
-        let ppmm = SpecialPowers.Cc["@mozilla.org/parentprocessmessagemanager;1"]
-          .getService(SpecialPowers.Ci.nsIMessageBroadcaster);
-        ppmm.addMessageListener("test:SpeechSynthesis:ipcSynthAddVoice", onSynthAddVoice);
-        ppmm.addMessageListener("test:SpeechSynthesis:ipcSynthSetDefault", onSynthSetDefault);
-        ppmm.addMessageListener("test:SpeechSynthesis:ipcSynthCleanup", onSynthCleanup);
-      }
-
-      iframe.addEventListener("mozbrowserloadend", iframeLoadFirst);
-
-      // Strip this filename and one directory level and then add "/test".
-      let href =  window.location.href;
-      href = href.substring(0, href.lastIndexOf('/'));
-      href = href.substring(0, href.lastIndexOf('/'));
-      href = href.substring(0, href.lastIndexOf('/'));
-      iframe.src = href + "/test?consoleLevel=INFO";
-
-      document.body.appendChild(iframe);
-    }
-
-    addEventListener("load", function() {
-
-      SpecialPowers.addPermission("browser", true, document);
-      SpecialPowers.pushPrefEnv({
-        "set": [
-          // TODO: remove this as part of bug 820712
-          ["network.disable.ipc.security", true],
-
-          ["dom.ipc.browser_frames.oop_by_default", true],
-          ["dom.mozBrowserFramesEnabled", true],
-          ["browser.pagethumbnails.capturing_disabled", true]
-        ]
-      }, runTests);
-    });
-
-  </script>
-</body>
-</html>

deleted file mode 100644
--- a/dom/media/webspeech/synth/ipc/test/mochitest.ini
+++ /dev/null
@@ -1,7 +0,0 @@
-[DEFAULT]
-skip-if = e10s
-support-files =
-  file_ipc.html
-
-[test_ipc.html]
-skip-if = buildapp == 'b2g' || toolkit == 'android' #bug 857673 # b2g(comp.classes['@mozilla.org/special-powers-observer;1'] is undefined) b2g-debug(comp.classes['@mozilla.org/special-powers-observer;1'] is undefined) b2g-desktop(comp.classes['@mozilla.org/special-powers-observer;1'] is undefined)

deleted file mode 100644
--- a/dom/media/webspeech/synth/ipc/test/test_ipc.html
+++ /dev/null
@@ -1,17 +0,0 @@
-<!DOCTYPE HTML>
-<html>
-<head>
-  <title>Test for OOP TTS</title>
-  <script type="application/javascript" src="/tests/SimpleTest/SimpleTest.js"></script>
-  <link rel="stylesheet" type="text/css" href="/tests/SimpleTest/test.css"/>
-</head>
-  <body>
-  <iframe id="testFrame"></iframe>
-  <script type="application/javascript;version=1.7">
-    SimpleTest.waitForExplicitFinish();
-
-    SpecialPowers.pushPrefEnv({ set: [['media.webspeech.synth.enabled', true]] },
-                              function() { document.getElementById("testFrame").src = "file_ipc.html"; });
-  </script>
-</body>
-</html>

--- a/dom/media/webspeech/synth/moz.build
+++ b/dom/media/webspeech/synth/moz.build
@@ -1,16 +1,15 @@
 # vim: set filetype=python:
 # This Source Code Form is subject to the terms of the Mozilla Public
 # License, v. 2.0. If a copy of the MPL was not distributed with this
 # file, You can obtain one at http://mozilla.org/MPL/2.0/.
 
 if CONFIG['MOZ_WEBSPEECH']:
     MOCHITEST_MANIFESTS += [
-        'ipc/test/mochitest.ini',
         'test/mochitest.ini',
     ]
 
     XPIDL_MODULE = 'dom_webspeechsynth'
 
     XPIDL_SOURCES += [
         'nsISpeechService.idl',
         'nsISynthVoiceRegistry.idl'
@@ -29,16 +28,18 @@ if CONFIG['MOZ_WEBSPEECH']:
     UNIFIED_SOURCES += [
         'ipc/SpeechSynthesisChild.cpp',
         'ipc/SpeechSynthesisParent.cpp',
         'nsSpeechTask.cpp',
         'nsSynthVoiceRegistry.cpp',
         'SpeechSynthesis.cpp',
         'SpeechSynthesisUtterance.cpp',
         'SpeechSynthesisVoice.cpp',
+        'test/FakeSynthModule.cpp',
+        'test/nsFakeSynthServices.cpp'
     ]
 
     if CONFIG['MOZ_SYNTH_PICO']:
         DIRS = ['pico']
 
 IPDL_SOURCES += [
     'ipc/PSpeechSynthesis.ipdl',
     'ipc/PSpeechSynthesisRequest.ipdl',

--- a/dom/media/webspeech/synth/nsSpeechTask.cpp
+++ b/dom/media/webspeech/synth/nsSpeechTask.cpp
@@ -79,17 +79,17 @@ private:
   // and 'mSpeechTask' exclusively owns it and therefor exists as well.
   nsSpeechTask* mSpeechTask;
 
   bool mStarted;
 };
 
 // nsSpeechTask
 
-NS_IMPL_CYCLE_COLLECTION(nsSpeechTask, mSpeechSynthesis, mUtterance);
+NS_IMPL_CYCLE_COLLECTION(nsSpeechTask, mSpeechSynthesis, mUtterance, mCallback);
 
 NS_INTERFACE_MAP_BEGIN_CYCLE_COLLECTION(nsSpeechTask)
   NS_INTERFACE_MAP_ENTRY(nsISpeechTask)
   NS_INTERFACE_MAP_ENTRY_AMBIGUOUS(nsISupports, nsISpeechTask)
 NS_INTERFACE_MAP_END
 
 NS_IMPL_CYCLE_COLLECTING_ADDREF(nsSpeechTask)
 NS_IMPL_CYCLE_COLLECTING_RELEASE(nsSpeechTask)

new file mode 100644
--- /dev/null
+++ b/dom/media/webspeech/synth/test/FakeSynthModule.cpp
@@ -0,0 +1,55 @@
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+#include "mozilla/ModuleUtils.h"
+#include "nsIClassInfoImpl.h"
+
+#include "nsFakeSynthServices.h"
+
+using namespace mozilla::dom;
+
+#define FAKESYNTHSERVICE_CID \
+  {0xe7d52d9e, 0xc148, 0x47d8, {0xab, 0x2a, 0x95, 0xd7, 0xf4, 0x0e, 0xa5, 0x3d}}
+
+#define FAKESYNTHSERVICE_CONTRACTID "@mozilla.org/fakesynth;1"
+
+// Defines nsFakeSynthServicesConstructor
+NS_GENERIC_FACTORY_SINGLETON_CONSTRUCTOR(nsFakeSynthServices,
+                                         nsFakeSynthServices::GetInstanceForService)
+
+// Defines kFAKESYNTHSERVICE_CID
+NS_DEFINE_NAMED_CID(FAKESYNTHSERVICE_CID);
+
+static const mozilla::Module::CIDEntry kCIDs[] = {
+  { &kFAKESYNTHSERVICE_CID, true, nullptr, nsFakeSynthServicesConstructor },
+  { nullptr }
+};
+
+static const mozilla::Module::ContractIDEntry kContracts[] = {
+  { FAKESYNTHSERVICE_CONTRACTID, &kFAKESYNTHSERVICE_CID },
+  { nullptr }
+};
+
+static const mozilla::Module::CategoryEntry kCategories[] = {
+  { "profile-after-change", "Fake Speech Synth", FAKESYNTHSERVICE_CONTRACTID },
+  { nullptr }
+};
+
+static void
+UnloadFakeSynthmodule()
+{
+  nsFakeSynthServices::Shutdown();
+}
+
+static const mozilla::Module kModule = {
+  mozilla::Module::kVersion,
+  kCIDs,
+  kContracts,
+  kCategories,
+  nullptr,
+  nullptr,
+  UnloadFakeSynthmodule
+};
+
+NSMODULE_DEFN(fakesynth) = &kModule;

--- a/dom/media/webspeech/synth/test/common.js
+++ b/dom/media/webspeech/synth/test/common.js
@@ -1,204 +1,8 @@
-var gSpeechRegistry = SpecialPowers.Cc["@mozilla.org/synth-voice-registry;1"]
-  .getService(SpecialPowers.Ci.nsISynthVoiceRegistry);
-
-var gAddedVoices = [];
-
-function SpeechTaskCallback(onpause, onresume, oncancel) {
-  this.onpause = onpause;
-  this.onresume = onresume;
-  this.oncancel = oncancel;
-}
-
-SpeechTaskCallback.prototype = {
-  QueryInterface: function(iid) {
-    return this;
-  },
-
-  getInterfaces: function(c) {},
-
-  getScriptableHelper: function() {},
-
-  onPause: function onPause() {
-    if (this.onpause)
-      this.onpause();
-  },
-
-  onResume: function onResume() {
-    if (this.onresume)
-      this.onresume();
-  },
-
-  onCancel: function onCancel() {
-    if (this.oncancel)
-      this.oncancel();
-  }
-};
-
-var TestSpeechServiceWithAudio = SpecialPowers.wrapCallbackObject({
-  CHANNELS: 1,
-  SAMPLE_RATE: 16000,
-
-  serviceType: SpecialPowers.Ci.nsISpeechService.SERVICETYPE_DIRECT_AUDIO,
-
-  speak: function speak(aText, aUri, aVolume, aRate, aPitch, aTask) {
-    var task = SpecialPowers.wrap(aTask);
-
-    window.setTimeout(
-      function () {
-        task.setup(SpecialPowers.wrapCallbackObject(new SpeechTaskCallback()), this.CHANNELS, this.SAMPLE_RATE);
-        // 0.025 seconds per character.
-        task.sendAudio(new Int16Array((this.SAMPLE_RATE/40)*aText.length), []);
-        task.sendAudio(new Int16Array(0), []);
-      }.bind(this), 0);
-  },
-
-  QueryInterface: function(iid) {
-    return this;
-  },
-
-  getInterfaces: function(c) {},
-
-  getScriptableHelper: function() {}
-});
-
-var TestSpeechServiceNoAudio = SpecialPowers.wrapCallbackObject({
-  serviceType: SpecialPowers.Ci.nsISpeechService.SERVICETYPE_INDIRECT_AUDIO,
-
-  speak: function speak(aText, aUri, aVolume, aRate, aPitch, aTask) {
-    var pair = this.expectedSpeaks.shift();
-    if (pair) {
-      // XXX: These tests do not happen in OOP
-      var utterance = pair[0];
-      var expected = pair[1];
-
-      is(aText, utterance.text, "Speak text matches utterance text");
-
-      var args = {uri: aUri, rate: aRate, pitch: aPitch};
-
-      for (var attr in args) {
-        if (expected[attr] != undefined)
-          is(args[attr], expected[attr], "expected service arg " + attr);
-      }
-    }
-
-    // If the utterance contains the phrase 'callback events', we will dispatch
-    // an appropriate event for each callback method.
-    var no_events = (aText.indexOf('callback events') < 0);
-    // If the utterance contains the phrase 'never end', we don't immediately
-    // end the 'synthesis' of the utterance.
-    var end_utterance = (aText.indexOf('never end') < 0);
-
-    var task = SpecialPowers.wrap(aTask);
-    task.setup(SpecialPowers.wrapCallbackObject(new SpeechTaskCallback(
-      function() {
-        if (!no_events) {
-          task.dispatchPause(1, 1.23);
-        }
-      },
-      function() {
-        if (!no_events) {
-          task.dispatchResume(1, 1.23);
-        }
-      },
-      function() {
-        if (!no_events) {
-          task.dispatchEnd(1, 1.23);
-        }
-      })));
-    setTimeout(function () {
-                 task.dispatchStart();
-                 if (end_utterance) {
-                   setTimeout(function () {
-                                task.dispatchEnd(
-                                  aText.length / 2.0, aText.length);
-                              }, 0);
-                 }
-               }, 0);
-  },
-
-  QueryInterface: function(iid) {
-    return this;
-  },
-
-  getInterfaces: function(c) {},
-
-  getScriptableHelper: function() {},
-
-  expectedSpeaks: []
-});
-
-function synthAddVoice(aServiceName, aName, aLang, aIsLocal) {
-  if (SpecialPowers.isMainProcess()) {
-    var voicesBefore = speechSynthesis.getVoices().length;
-    var uri = "urn:moz-tts:mylittleservice:" + encodeURI(aName + '?' + aLang);
-    gSpeechRegistry.addVoice(window[aServiceName], uri, aName, aLang, aIsLocal);
-
-    gAddedVoices.push([window[aServiceName], uri]);
-    var voicesAfter = speechSynthesis.getVoices().length;
-
-    is(voicesBefore + 1, voicesAfter, "Voice added");
-    var voice = speechSynthesis.getVoices()[voicesAfter - 1];
-    is(voice.voiceURI, uri, "voice URI matches");
-    is(voice.name, aName, "voice name matches");
-    is(voice.lang, aLang, "voice lang matches");
-    is(voice.localService, aIsLocal, "voice localService matches");
-
-    return uri;
-  } else {
-    // XXX: It would be nice to check here that the child gets the voice
-    // added update, but alas, it is aynchronous.
-    var mm = SpecialPowers.Cc["@mozilla.org/childprocessmessagemanager;1"]
-      .getService(SpecialPowers.Ci.nsISyncMessageSender);
-
-    return mm.sendSyncMessage(
-      'test:SpeechSynthesis:ipcSynthAddVoice',
-      [aServiceName, aName, aLang, aIsLocal])[0];
-  }
-}
-
-function synthSetDefault(aUri, aIsDefault) {
-  if (SpecialPowers.isMainProcess()) {
-    gSpeechRegistry.setDefaultVoice(aUri, aIsDefault);
-    var voices = speechSynthesis.getVoices();
-    for (var i in voices) {
-      if (voices[i].voiceURI == aUri)
-        ok(voices[i]['default'], "Voice set to default");
-    }
-  } else {
-    // XXX: It would be nice to check here that the child gets the voice
-    // added update, but alas, it is aynchronous.
-    var mm = SpecialPowers.Cc["@mozilla.org/childprocessmessagemanager;1"]
-      .getService(SpecialPowers.Ci.nsISyncMessageSender);
-
-    return mm.sendSyncMessage(
-      'test:SpeechSynthesis:ipcSynthSetDefault', [aUri, aIsDefault])[0];
-  }
-}
-
-function synthCleanup() {
-  if (SpecialPowers.isMainProcess()) {
-    var voicesBefore = speechSynthesis.getVoices().length;
-    var toRemove = gAddedVoices.length;
-    var removeArgs;
-    while ((removeArgs = gAddedVoices.shift()))
-      gSpeechRegistry.removeVoice.apply(gSpeechRegistry.removeVoice, removeArgs);
-
-    var voicesAfter = speechSynthesis.getVoices().length;
-    is(voicesAfter, voicesBefore - toRemove, "Successfully removed test voices");
-  } else {
-    // XXX: It would be nice to check here that the child gets the voice
-    // removed update, but alas, it is aynchronous.
-    var mm = SpecialPowers.Cc["@mozilla.org/childprocessmessagemanager;1"]
-      .getService(SpecialPowers.Ci.nsISyncMessageSender);
-    mm.sendSyncMessage('test:SpeechSynthesis:ipcSynthCleanup');
-  }
-}
-
 function synthTestQueue(aTestArgs, aEndFunc) {
   var utterances = [];
   for (var i in aTestArgs) {
     var uargs = aTestArgs[i][0];
     var u = new SpeechSynthesisUtterance(uargs.text);
 
     delete uargs.text;
 
@@ -215,24 +19,33 @@ function synthTestQueue(aTestArgs, aEndF
         ok(speechSynthesis.pending, "other utterances queued");
       } else {
         ok(!speechSynthesis.pending, "queue is empty, nothing pending.");
         if (aEndFunc)
           aEndFunc();
       }
     }
 
+    u.addEventListener('start',
+      (function (expectedUri) {
+        return function (e) {
+          if (expectedUri) {
+            var chosenVoice = SpecialPowers.wrap(e).target.chosenVoiceURI;
+            is(chosenVoice, expectedUri, "Incorrect URI is used");
+          }
+        };
+      })(aTestArgs[i][1] ? aTestArgs[i][1].uri : null));
+
     u.addEventListener('end', onend_handler);
     u.addEventListener('error', onend_handler);
 
     u.addEventListener(
       'error', function onerror_handler(e) {
         ok(false, "Error in speech utterance '" + e.target.text + "'");
       });
 
     utterances.push(u);
-    TestSpeechServiceNoAudio.expectedSpeaks.push([u, aTestArgs[i][1]]);
     speechSynthesis.speak(u);
   }
 
   ok(!speechSynthesis.speaking, "speechSynthesis is not speaking yet.");
   ok(speechSynthesis.pending, "speechSynthesis has an utterance queued.");
 }

--- a/dom/media/webspeech/synth/test/file_indirect_service_events.html
+++ b/dom/media/webspeech/synth/test/file_indirect_service_events.html
@@ -21,56 +21,54 @@ https://bugzilla.mozilla.org/show_bug.cg
 <div id="content" style="display: none">
 
 </div>
 <pre id="test">
 <script type="application/javascript">
 
 /** Test for Bug 1155034 **/
 
-synthAddVoice('TestSpeechServiceNoAudio', 'Female 1', 'en-GB', true);
-
 function test_with_events() {
   info('test_with_events');
   var utterance = new SpeechSynthesisUtterance("never end, callback events");
+  utterance.lang = 'it-IT-noend';
 
   utterance.addEventListener('start', function(e) {
     speechSynthesis.pause();
   // Wait to see if we get some bad events we didn't expect.
   });
 
   utterance.addEventListener('pause', function(e) {
-    ok(e.charIndex, 1, 'pause event charIndex matches service arguments');
-    ok(e.elapsedTime, 1.23, 'pause event elapsedTime matches service arguments');
+    is(e.charIndex, 1, 'pause event charIndex matches service arguments');
+    is(e.elapsedTime, 1.5, 'pause event elapsedTime matches service arguments');
     speechSynthesis.resume();
   });
 
   utterance.addEventListener('resume', function(e) {
-    ok(e.charIndex, 1, 'resume event charIndex matches service arguments');
-    ok(e.elapsedTime, 1.23, 'resume event elapsedTime matches service arguments');
+    is(e.charIndex, 1, 'resume event charIndex matches service arguments');
+    is(e.elapsedTime, 1.5, 'resume event elapsedTime matches service arguments');
     speechSynthesis.cancel();
   });
 
   utterance.addEventListener('end', function(e) {
     ok(e.charIndex, 1, 'resume event charIndex matches service arguments');
-    ok(e.elapsedTime, 1.23, 'end event elapsedTime matches service arguments');
+    ok(e.elapsedTime, 1.5, 'end event elapsedTime matches service arguments');
     test_no_events();
   });
 
   speechSynthesis.speak(utterance);
 }
 
 function test_no_events() {
   var utterance = new SpeechSynthesisUtterance("never end");
-
+  utterance.lang = "it-IT-noevents-noend";
   utterance.addEventListener('start', function(e) {
     speechSynthesis.pause();
     // Wait to see if we get some bad events we didn't expect.
     setTimeout(function() {
-      synthCleanup();
       SimpleTest.finish();
     }, 1000);
   });
 
   utterance.addEventListener('pause', function(e) {
     ok(false, 'no pause event was explicitly dispatched from the service')
     speechSynthesis.resume();
   });

--- a/dom/media/webspeech/synth/test/file_setup.html
+++ b/dom/media/webspeech/synth/test/file_setup.html
@@ -20,22 +20,16 @@ https://bugzilla.mozilla.org/show_bug.cg
 <div id="content" style="display: none">
   
 </div>
 <pre id="test">
 <script type="application/javascript">
 
 /** Test for Bug 525444 **/
 
-synthAddVoice('TestSpeechServiceNoAudio', 'Bob Marley', 'en-JM', true);
-synthAddVoice('TestSpeechServiceNoAudio', 'Amy Winehouse', 'en-GB', true);
-synthAddVoice('TestSpeechServiceNoAudio', 'Leonard Cohen', 'en-CA', true);
-synthAddVoice('TestSpeechServiceNoAudio', 'Celine Dion', 'fr-CA', true);
-synthAddVoice('TestSpeechServiceNoAudio', 'Julieta Venegas', 'es-MX', true);
-
 ok(SpeechSynthesis, "SpeechSynthesis exists in global scope");
 ok(SpeechSynthesisVoice, "SpeechSynthesisVoice exists in global scope");
 ok(SpeechSynthesisEvent, "SpeechSynthesisEvent exists in global scope");
 
 // SpeechSynthesisUtterance is the only type that has a constructor
 //  and writable properties
 ok(SpeechSynthesisUtterance, "SpeechSynthesisUtterance exists in global scope");
 var ssu = new SpeechSynthesisUtterance("hello world");
@@ -70,15 +64,13 @@ var voices1 = speechSynthesis.getVoices(
 var voices2 = speechSynthesis.getVoices();
 
 ok(voices1.length == voices2.length, "Voice count matches");
 
 for (var i in voices1) {
   ok(voices1[i] == voices2[i], "Voice instance matches");
 }
 
-synthCleanup();
-
 SimpleTest.finish();
 </script>
 </pre>
 </body>
 </html>

--- a/dom/media/webspeech/synth/test/file_speech_cancel.html
+++ b/dom/media/webspeech/synth/test/file_speech_cancel.html
@@ -21,40 +21,58 @@ https://bugzilla.mozilla.org/show_bug.cg
 <div id="content" style="display: none">
 
 </div>
 <pre id="test">
 <script type="application/javascript">
 
 /** Test for Bug 1150315 **/
 
-synthAddVoice('TestSpeechServiceWithAudio', 'Male 1', 'en-GB', true);
-
 var gotEndEvent = false;
-var utterance = new SpeechSynthesisUtterance("Hello, world!");
+// A long utterance that we will interrupt.
+var utterance = new SpeechSynthesisUtterance("Donec ac nunc feugiat, posuere " +
+  "mauris id, pharetra velit. Donec fermentum orci nunc, sit amet maximus" +
+  "dui tincidunt ut. Sed ultricies ac nisi a laoreet. Proin interdum," +
+  "libero maximus hendrerit posuere, lorem risus egestas nisl, a" +
+  "ultricies massa justo eu nisi. Duis mattis nibh a ligula tincidunt" +
+  "tincidunt non eu erat. Sed bibendum varius vulputate. Cras leo magna," +
+  "ornare ac posuere vel, luctus id metus. Mauris nec quam ac augue" +
+  "consectetur bibendum. Integer a commodo tortor. Duis semper dolor eu" +
+  "facilisis facilisis. Etiam venenatis turpis est, quis tincidunt velit" +
+  "suscipit a. Cras semper orci in sapien rhoncus bibendum. Suspendisse" +
+  "eu ex lobortis, finibus enim in, condimentum quam. Maecenas eget dui" +
+  "ipsum. Aliquam tortor leo, interdum eget congue ut, tempor id elit.");
 utterance.addEventListener('start', function(e) {
+  ok(true, 'start utterance 1');
   speechSynthesis.cancel();
   speechSynthesis.speak(utterance2);
 });
 
-var utterance2 = new SpeechSynthesisUtterance("Hello, world 2!");
+var utterance2 = new SpeechSynthesisUtterance("Proin ornare neque vitae " +
+  "risus mattis rutrum. Suspendisse a velit ut est convallis aliquet." +
+  "Nullam ante elit, malesuada vel luctus rutrum, ultricies nec libero." +
+  "Praesent eu iaculis orci. Sed nisl diam, sodales ac purus et," +
+  "volutpat interdum tortor. Nullam aliquam porta elit et maximus. Cras" +
+  "risus lectus, elementum vel sodales vel, ultricies eget lectus." +
+  "Curabitur velit lacus, mollis vel finibus et, molestie sit amet" +
+  "sapien. Proin vitae dolor ac augue posuere efficitur ac scelerisque" +
+  "diam. Nulla sed odio elit.");
 utterance2.addEventListener('start', function() {
   speechSynthesis.cancel();
   speechSynthesis.speak(utterance3);
 });
 utterance2.addEventListener('end', function(e) {
   gotEndEvent = true;
 });
 
 var utterance3 = new SpeechSynthesisUtterance("Hello, world 3!");
 utterance3.addEventListener('start', function() {
-  ok(gotEndEvent, "didn't get start event for this utterance")
+  ok(gotEndEvent, "didn't get start event for this utterance");
 });
 utterance3.addEventListener('end', function(e) {
-  synthCleanup();
   SimpleTest.finish();
 });
 
 speechSynthesis.speak(utterance);
 ok(!speechSynthesis.speaking, "speechSynthesis is not speaking yet.");
 ok(speechSynthesis.pending, "speechSynthesis has an utterance queued.");
 
 </script>

--- a/dom/media/webspeech/synth/test/file_speech_queue.html
+++ b/dom/media/webspeech/synth/test/file_speech_queue.html
@@ -13,58 +13,64 @@ https://bugzilla.mozilla.org/show_bug.cg
     window.ok = parent.ok;
   </script>
   <script type="application/javascript" src="common.js"></script>
 </head>
 <body>
 <a target="_blank" href="https://bugzilla.mozilla.org/show_bug.cgi?id=525444">Mozilla Bug 525444</a>
 <p id="display"></p>
 <div id="content" style="display: none">
-  
+
 </div>
 <pre id="test">
 <script type="application/javascript">
 
 /** Test for Bug 525444 **/
 
-var englishJamaican = synthAddVoice('TestSpeechServiceNoAudio',
-                                    'Bob Marley', 'en-JM', true);
-var englishBritish = synthAddVoice('TestSpeechServiceNoAudio',
-                                   'Amy Winehouse', 'en-GB', true);
-var englishCanadian = synthAddVoice('TestSpeechServiceNoAudio',
-                                    'Leonard Cohen', 'en-CA', true);
-var frenchCanadian = synthAddVoice('TestSpeechServiceNoAudio',
-                                   'Celine Dion', 'fr-CA', true);
-var spanishMexican = synthAddVoice('TestSpeechServiceNoAudio',
-                                   'Julieta Venegas', 'es-MX', true);
+// XXX: Rate and pitch are not tested.
+
+var langUriMap = {};
 
-synthSetDefault(englishBritish, true);
+for (var voice of speechSynthesis.getVoices()) {
+  if (voice.voiceURI.indexOf('urn:moz-tts:fake-direct') < 0) {
+    continue;
+  }
+  langUriMap[voice.lang] = voice.voiceURI;
+  ok(true, voice.lang + ' ' + voice.voiceURI + ' ' + voice.default);
+  is(voice.default, voice.lang == 'en-JM', 'Only Jamaican voice should be default');
+}
+
+ok(langUriMap['en-JM'], 'No English-Jamaican voice');
+ok(langUriMap['en-GB'], 'No English-British voice');
+ok(langUriMap['en-CA'], 'No English-Canadian voice');
+ok(langUriMap['fr-CA'], 'No French-Canadian voice');
+ok(langUriMap['es-MX'], 'No Spanish-Mexican voice');
 
 synthTestQueue(
   [[{text: "Hello, world."},
-    { uri: englishBritish }],
+    { uri: langUriMap['en-JM'] }],
    [{text: "Bonjour tout le monde .", lang: "fr", rate: 0.5, pitch: 0.75},
-    { uri: frenchCanadian, rate: 0.5, pitch: 0.75}],
+    { uri: langUriMap['fr-CA'], rate: 0.5, pitch: 0.75}],
    [{text: "How are you doing?", lang: "en-GB"},
-    { rate: 1, pitch: 1, uri: englishBritish}],
-   [{text: "¡hasta mañana", lang: "es-ES"},
-    { uri: spanishMexican }]],
+    { rate: 1, pitch: 1, uri: langUriMap['en-GB']}],
+   [{text: "¡hasta mañana!", lang: "es-MX"},
+    { uri: langUriMap['es-MX'] }]],
   function () {
-    synthSetDefault(englishJamaican, true);
-    var test_data = [[{text: "I shot the  sheriff."},
-                      { uri: englishJamaican }]];
+    var test_data = [];
     var voices = speechSynthesis.getVoices();
-    for (var i in voices) {
-      test_data.push([{text: "Hello world", voice: voices[i]},
-                      {uri: voices[i].voiceURI}]);
+    for (var voice of voices) {
+      if (voice.voiceURI.indexOf('urn:moz-tts:fake-direct') < 0) {
+        continue;
+      }
+      test_data.push([{text: "Hello world", voice: voice},
+                      {uri: voice.voiceURI}]);
     }
 
     synthTestQueue(test_data,
                    function () {
-                     synthCleanup();
                      SimpleTest.finish();
                    });
   });
 
 
 
 </script>
 </pre>

--- a/dom/media/webspeech/synth/test/file_speech_simple.html
+++ b/dom/media/webspeech/synth/test/file_speech_simple.html
@@ -21,33 +21,30 @@ https://bugzilla.mozilla.org/show_bug.cg
 <div id="content" style="display: none">
   
 </div>
 <pre id="test">
 <script type="application/javascript">
 
 /** Test for Bug 525444 **/
 
-synthAddVoice('TestSpeechServiceWithAudio', 'Male 1', 'en-GB', true);
-
 var gotStartEvent = false;
 var gotBoundaryEvent = false;
 var utterance = new SpeechSynthesisUtterance("Hello, world!");
 utterance.addEventListener('start', function(e) {
   ok(speechSynthesis.speaking, "speechSynthesis is speaking.");
   ok(!speechSynthesis.pending, "speechSynthesis has no other utterances queued.");
   gotStartEvent = true;
 });
 
 utterance.addEventListener('end', function(e) {
   ok(!speechSynthesis.speaking, "speechSynthesis is not speaking.");
   ok(!speechSynthesis.pending, "speechSynthesis has no other utterances queued.");
   ok(gotStartEvent, "Got 'start' event.");
   info('end ' + e.elapsedTime);
-  synthCleanup();
   SimpleTest.finish();
 });
 
 speechSynthesis.speak(utterance);
 ok(!speechSynthesis.speaking, "speechSynthesis is not speaking yet.");
 ok(speechSynthesis.pending, "speechSynthesis has an utterance queued.");
 
 </script>

--- a/dom/media/webspeech/synth/test/mochitest.ini
+++ b/dom/media/webspeech/synth/test/mochitest.ini
@@ -1,19 +1,14 @@
 [DEFAULT]
-skip-if = e10s
 support-files =
   common.js
   file_setup.html
   file_speech_queue.html
   file_speech_simple.html
   file_speech_cancel.html
   file_indirect_service_events.html
 
 [test_setup.html]
 [test_speech_queue.html]
-skip-if = buildapp == 'b2g' # b2g(Test timed out)
 [test_speech_simple.html]
-skip-if = buildapp == 'b2g' # b2g(Test timed out)
 [test_speech_cancel.html]
-skip-if = toolkit == 'gonk' # b2g(Test timed out)
 [test_indirect_service_events.html]
-skip-if = toolkit == 'gonk' # b2g(Test timed out)

new file mode 100644
--- /dev/null
+++ b/dom/media/webspeech/synth/test/nsFakeSynthServices.cpp
@@ -0,0 +1,359 @@
+/* -*- Mode: C++; tab-width: 2; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
+/* vim:set ts=2 sw=2 sts=2 et cindent: */
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+#include "nsISupports.h"
+#include "nsFakeSynthServices.h"
+#include "nsPrintfCString.h"
+#include "nsIWeakReferenceUtils.h"
+#include "SharedBuffer.h"
+#include "nsISimpleEnumerator.h"
+
+#include "mozilla/dom/nsSynthVoiceRegistry.h"
+#include "mozilla/dom/nsSpeechTask.h"
+
+#include "nsThreadUtils.h"
+#include "prenv.h"
+#include "mozilla/Preferences.h"
+#include "mozilla/DebugOnly.h"
+
+#define CHANNELS 1
+#define SAMPLERATE 1600
+
+namespace mozilla {
+namespace dom {
+
+StaticRefPtr<nsFakeSynthServices> nsFakeSynthServices::sSingleton;
+
+enum VoiceFlags
+{
+  eSuppressEvents = 1,
+  eSuppressEnd = 2
+};
+
+struct VoiceDetails
+{
+  const char* uri;
+  const char* name;
+  const char* lang;
+  bool defaultVoice;
+  uint32_t flags;
+};
+
+static const VoiceDetails sDirectVoices[] = {
+  {"urn:moz-tts:fake-direct:bob", "Bob Marley", "en-JM", true, 0},
+  {"urn:moz-tts:fake-direct:amy", "Amy Winehouse", "en-GB", false, 0},
+  {"urn:moz-tts:fake-direct:lenny", "Leonard Cohen", "en-CA", false, 0},
+  {"urn:moz-tts:fake-direct:celine", "Celine Dion", "fr-CA", false, 0},
+  {"urn:moz-tts:fake-direct:julie", "Julieta Venegas", "es-MX", false, },
+};
+
+static const VoiceDetails sIndirectVoices[] = {
+  {"urn:moz-tts:fake-indirect:zanetta", "Zanetta Farussi", "it-IT", false, 0},
+  {"urn:moz-tts:fake-indirect:margherita", "Margherita Durastanti", "it-IT-noevents-noend", false, eSuppressEvents | eSuppressEnd},
+  {"urn:moz-tts:fake-indirect:teresa", "Teresa Cornelys", "it-IT-noend", false, eSuppressEnd},
+};
+
+// FakeSynthCallback
+class FakeSynthCallback : public nsISpeechTaskCallback
+{
+public:
+  explicit FakeSynthCallback(nsISpeechTask* aTask) : mTask(aTask) { }
+  NS_DECL_CYCLE_COLLECTING_ISUPPORTS
+  NS_DECL_CYCLE_COLLECTION_CLASS_AMBIGUOUS(FakeSynthCallback, nsISpeechTaskCallback)
+
+  NS_IMETHOD OnPause()
+  {
+    if (mTask) {
+      mTask->DispatchPause(1.5, 1);
+    }
+
+    return NS_OK;
+  }
+
+  NS_IMETHOD OnResume()
+  {
+    if (mTask) {
+      mTask->DispatchResume(1.5, 1);
+    }
+
+    return NS_OK;
+  }
+
+  NS_IMETHOD OnCancel()
+  {
+    if (mTask) {
+      mTask->DispatchEnd(1.5, 1);
+    }
+
+    return NS_OK;
+  }
+
+private:
+  virtual ~FakeSynthCallback() { }
+
+  nsCOMPtr<nsISpeechTask> mTask;
+};
+
+NS_IMPL_CYCLE_COLLECTION(FakeSynthCallback, mTask);
+
+NS_INTERFACE_MAP_BEGIN_CYCLE_COLLECTION(FakeSynthCallback)
+  NS_INTERFACE_MAP_ENTRY(nsISpeechTaskCallback)
+  NS_INTERFACE_MAP_ENTRY_AMBIGUOUS(nsISupports, nsISpeechTaskCallback)
+NS_INTERFACE_MAP_END
+
+NS_IMPL_CYCLE_COLLECTING_ADDREF(FakeSynthCallback)
+NS_IMPL_CYCLE_COLLECTING_RELEASE(FakeSynthCallback)
+
+// FakeDirectAudioSynth
+
+class FakeDirectAudioSynth : public nsISpeechService
+{
+
+public:
+  FakeDirectAudioSynth() { }
+
+  NS_DECL_ISUPPORTS
+  NS_DECL_NSISPEECHSERVICE
+
+private:
+  virtual ~FakeDirectAudioSynth() { }
+};
+
+NS_IMPL_ISUPPORTS(FakeDirectAudioSynth, nsISpeechService)
+
+NS_IMETHODIMP
+FakeDirectAudioSynth::Speak(const nsAString& aText, const nsAString& aUri,
+                            float aVolume, float aRate, float aPitch,
+                            nsISpeechTask* aTask)
+{
+  class Runnable final : public nsRunnable
+  {
+  public:
+    Runnable(nsISpeechTask* aTask, const nsAString& aText) :
+      mTask(aTask), mText(aText)
+    {
+    }
+
+    NS_IMETHOD Run() override
+    {
+      nsRefPtr<FakeSynthCallback> cb = new FakeSynthCallback(nullptr);
+      mTask->Setup(cb, CHANNELS, SAMPLERATE, 2);
+
+      // Just an arbitrary multiplier. Pretend that each character is
+      // synthesized to 40 frames.
+      uint32_t frames_length = 40 * mText.Length();
+      nsAutoArrayPtr<int16_t> frames(new int16_t[frames_length]());
+      mTask->SendAudioNative(frames, frames_length);
+
+      mTask->SendAudioNative(nullptr, 0);
+
+      return NS_OK;
+    }
+
+  private:
+    nsCOMPtr<nsISpeechTask> mTask;
+    nsString mText;
+  };
+
+  nsCOMPtr<nsIRunnable> runnable = new Runnable(aTask, aText);
+  NS_DispatchToMainThread(runnable);
+  return NS_OK;
+}
+
+NS_IMETHODIMP
+FakeDirectAudioSynth::GetServiceType(SpeechServiceType* aServiceType)
+{
+  *aServiceType = nsISpeechService::SERVICETYPE_DIRECT_AUDIO;
+  return NS_OK;
+}
+
+// FakeDirectAudioSynth
+
+class FakeIndirectAudioSynth : public nsISpeechService
+{
+
+public:
+  FakeIndirectAudioSynth() {}
+
+  NS_DECL_ISUPPORTS
+  NS_DECL_NSISPEECHSERVICE
+
+private:
+  virtual ~FakeIndirectAudioSynth() { }
+};
+
+NS_IMPL_ISUPPORTS(FakeIndirectAudioSynth, nsISpeechService)
+
+NS_IMETHODIMP
+FakeIndirectAudioSynth::Speak(const nsAString& aText, const nsAString& aUri,
+                              float aVolume, float aRate, float aPitch,
+                              nsISpeechTask* aTask)
+{
+  class DispatchStart final : public nsRunnable
+  {
+  public:
+    explicit DispatchStart(nsISpeechTask* aTask) :
+      mTask(aTask)
+    {
+    }
+
+    NS_IMETHOD Run() override
+    {
+      mTask->DispatchStart();
+
+      return NS_OK;
+    }
+
+  private:
+    nsCOMPtr<nsISpeechTask> mTask;
+  };
+
+  class DispatchEnd final : public nsRunnable
+  {
+  public:
+    DispatchEnd(nsISpeechTask* aTask, const nsAString& aText) :
+      mTask(aTask), mText(aText)
+    {
+    }
+
+    NS_IMETHOD Run() override
+    {
+      mTask->DispatchEnd(mText.Length()/2, mText.Length());
+
+      return NS_OK;
+    }
+
+  private:
+    nsCOMPtr<nsISpeechTask> mTask;
+    nsString mText;
+  };
+
+  uint32_t flags = 0;
+  for (uint32_t i = 0; i < ArrayLength(sIndirectVoices); i++) {
+    if (aUri.EqualsASCII(sIndirectVoices[i].uri)) {
+      flags = sIndirectVoices[i].flags;
+    }
+  }
+
+  nsRefPtr<FakeSynthCallback> cb = new FakeSynthCallback(
+    (flags & eSuppressEvents) ? nullptr : aTask);
+
+  aTask->Setup(cb, 0, 0, 0);
+
+  nsCOMPtr<nsIRunnable> runnable = new DispatchStart(aTask);
+  NS_DispatchToMainThread(runnable);
+
+  if ((flags & eSuppressEnd) == 0) {
+    runnable = new DispatchEnd(aTask, aText);
+    NS_DispatchToMainThread(runnable);
+  }
+
+  return NS_OK;
+}
+
+NS_IMETHODIMP
+FakeIndirectAudioSynth::GetServiceType(SpeechServiceType* aServiceType)
+{
+  *aServiceType = nsISpeechService::SERVICETYPE_INDIRECT_AUDIO;
+  return NS_OK;
+}
+
+// nsFakeSynthService
+
+NS_INTERFACE_MAP_BEGIN(nsFakeSynthServices)
+  NS_INTERFACE_MAP_ENTRY(nsIObserver)
+  NS_INTERFACE_MAP_ENTRY_AMBIGUOUS(nsISupports, nsIObserver)
+NS_INTERFACE_MAP_END
+
+NS_IMPL_ADDREF(nsFakeSynthServices)
+NS_IMPL_RELEASE(nsFakeSynthServices)
+
+nsFakeSynthServices::nsFakeSynthServices()
+{
+}
+
+nsFakeSynthServices::~nsFakeSynthServices()
+{
+}
+
+static void
+AddVoices(nsISpeechService* aService, const VoiceDetails* aVoices, uint32_t aLength)
+{
+  nsSynthVoiceRegistry* registry = nsSynthVoiceRegistry::GetInstance();
+  for (uint32_t i = 0; i < aLength; i++) {
+    NS_ConvertUTF8toUTF16 name(aVoices[i].name);
+    NS_ConvertUTF8toUTF16 uri(aVoices[i].uri);
+    NS_ConvertUTF8toUTF16 lang(aVoices[i].lang);
+    registry->AddVoice(aService, uri, name, lang, true);
+    if (aVoices[i].defaultVoice) {
+      registry->SetDefaultVoice(uri, true);
+    }
+  }
+}
+
+void
+nsFakeSynthServices::Init()
+{
+  mDirectService = new FakeDirectAudioSynth();
+  AddVoices(mDirectService, sDirectVoices, ArrayLength(sDirectVoices));
+
+  mIndirectService = new FakeIndirectAudioSynth();
+  AddVoices(mIndirectService, sIndirectVoices, ArrayLength(sIndirectVoices));
+}
+
+// nsIObserver
+
+NS_IMETHODIMP
+nsFakeSynthServices::Observe(nsISupports* aSubject, const char* aTopic,
+                             const char16_t* aData)
+{
+  MOZ_ASSERT(NS_IsMainThread());
+  NS_ENSURE_TRUE(!strcmp(aTopic, "profile-after-change"), NS_ERROR_UNEXPECTED);
+
+  if (Preferences::GetBool("media.webspeech.synth.test")) {
+    Init();
+  }
+
+  return NS_OK;
+}
+
+// static methods
+
+nsFakeSynthServices*
+nsFakeSynthServices::GetInstance()
+{
+  MOZ_ASSERT(NS_IsMainThread());
+  if (XRE_GetProcessType() != GeckoProcessType_Default) {
+    MOZ_ASSERT(false, "nsFakeSynthServices can only be started on main gecko process");
+    return nullptr;
+  }
+
+  if (!sSingleton) {
+    sSingleton = new nsFakeSynthServices();
+  }
+
+  return sSingleton;
+}
+
+already_AddRefed<nsFakeSynthServices>
+nsFakeSynthServices::GetInstanceForService()
+{
+  nsRefPtr<nsFakeSynthServices> picoService = GetInstance();
+  return picoService.forget();
+}
+
+void
+nsFakeSynthServices::Shutdown()
+{
+  if (!sSingleton) {
+    return;
+  }
+
+  sSingleton = nullptr;
+}
+
+} // namespace dom
+} // namespace mozilla

new file mode 100644
--- /dev/null
+++ b/dom/media/webspeech/synth/test/nsFakeSynthServices.h
@@ -0,0 +1,53 @@
+/* -*- Mode: C++; tab-width: 2; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
+/* vim:set ts=2 sw=2 sts=2 et cindent: */
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+#ifndef nsFakeSynthServices_h
+#define nsFakeSynthServices_h
+
+#include "nsAutoPtr.h"
+#include "nsTArray.h"
+#include "nsIObserver.h"
+#include "nsIThread.h"
+#include "nsISpeechService.h"
+#include "nsRefPtrHashtable.h"
+#include "mozilla/StaticPtr.h"
+#include "mozilla/Monitor.h"
+
+namespace mozilla {
+namespace dom {
+
+class nsFakeSynthServices : public nsIObserver
+{
+
+public:
+  NS_DECL_ISUPPORTS
+  NS_DECL_NSIOBSERVER
+
+  nsFakeSynthServices();
+
+  static nsFakeSynthServices* GetInstance();
+
+  static already_AddRefed<nsFakeSynthServices> GetInstanceForService();
+
+  static void Shutdown();
+
+private:
+
+  virtual ~nsFakeSynthServices();
+
+  void Init();
+
+  nsCOMPtr<nsISpeechService> mDirectService;
+
+  nsCOMPtr<nsISpeechService> mIndirectService;
+
+  static StaticRefPtr<nsFakeSynthServices> sSingleton;
+};
+
+} // namespace dom
+} // namespace mozilla
+
+#endif

--- a/image/decoders/nsGIFDecoder2.cpp
+++ b/image/decoders/nsGIFDecoder2.cpp
@@ -819,20 +819,25 @@ nsGIFDecoder2::WriteInternal(const char*
     case gif_skip_block:
       GETN(1, gif_consume_block);
       break;
 
     case gif_control_extension:
       mGIFStruct.is_transparent = *q & 0x1;
       mGIFStruct.tpixel = q[3];
       mGIFStruct.disposal_method = ((*q) >> 2) & 0x7;
-      // Some specs say 3rd bit (value 4), other specs say value 3
-      // Let's choose 3 (the more popular)
+
       if (mGIFStruct.disposal_method == 4) {
+        // Some specs say 3rd bit (value 4), other specs say value 3.
+        // Let's choose 3 (the more popular).
         mGIFStruct.disposal_method = 3;
+      } else if (mGIFStruct.disposal_method > 4) {
+        // This GIF is using a disposal method which is undefined in the spec.
+        // Treat it as DisposalMethod::NOT_SPECIFIED.
+        mGIFStruct.disposal_method = 0;
       }
 
       {
         DisposalMethod method = DisposalMethod(mGIFStruct.disposal_method);
         if (method == DisposalMethod::CLEAR_ALL ||
             method == DisposalMethod::CLEAR) {
           // We may have to display the background under this image during
           // animation playback, so we regard it as transparent.

--- a/image/src/DecodePool.cpp
+++ b/image/src/DecodePool.cpp
@@ -3,20 +3,22 @@
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
 
 #include "DecodePool.h"
 
 #include <algorithm>
 
 #include "mozilla/ClearOnShutdown.h"
+#include "mozilla/Monitor.h"
 #include "nsAutoPtr.h"
 #include "nsCOMPtr.h"
 #include "nsIObserverService.h"
 #include "nsIThreadPool.h"
+#include "nsThreadManager.h"
 #include "nsThreadUtils.h"
 #include "nsXPCOMCIDInternal.h"
 #include "prsystem.h"
 
 #ifdef MOZ_NUWA_PROCESS
 #include "ipc/Nuwa.h"
 #endif
 
@@ -102,79 +104,199 @@ public:
 private:
   explicit NotifyDecodeCompleteWorker(Decoder* aDecoder)
     : mDecoder(aDecoder)
   { }
 
   nsRefPtr<Decoder> mDecoder;
 };
 
-class DecodeWorker : public nsRunnable
-{
-public:
-  explicit DecodeWorker(Decoder* aDecoder)
-    : mDecoder(aDecoder)
-  {
-    MOZ_ASSERT(mDecoder);
-  }
-
-  NS_IMETHOD Run() override
-  {
-    MOZ_ASSERT(!NS_IsMainThread());
-    DecodePool::Singleton()->Decode(mDecoder);
-    return NS_OK;
-  }
-
-private:
-  nsRefPtr<Decoder> mDecoder;
-};
-
 #ifdef MOZ_NUWA_PROCESS
 
-class DecodePoolNuwaListener final : public nsIThreadPoolListener
-{
-public:
-  NS_DECL_THREADSAFE_ISUPPORTS
-
-  NS_IMETHODIMP OnThreadCreated()
-  {
-    if (IsNuwaProcess()) {
-      NuwaMarkCurrentThread(static_cast<void(*)(void*)>(nullptr), nullptr);
-    }
-    return NS_OK;
-  }
-
-  NS_IMETHODIMP OnThreadShuttingDown() { return NS_OK; }
-
-private:
-  ~DecodePoolNuwaListener() { }
-};
-
-NS_IMPL_ISUPPORTS(DecodePoolNuwaListener, nsIThreadPoolListener)
-
 class RegisterDecodeIOThreadWithNuwaRunnable : public nsRunnable
 {
 public:
   NS_IMETHOD Run()
   {
     NuwaMarkCurrentThread(static_cast<void(*)(void*)>(nullptr), nullptr);
     return NS_OK;
   }
 };
+
 #endif // MOZ_NUWA_PROCESS
 
 
 ///////////////////////////////////////////////////////////////////////////////
 // DecodePool implementation.
 ///////////////////////////////////////////////////////////////////////////////
 
 /* static */ StaticRefPtr<DecodePool> DecodePool::sSingleton;
 
 NS_IMPL_ISUPPORTS(DecodePool, nsIObserver)
 
+struct Work
+{
+  enum class Type {
+    DECODE,
+    SHUTDOWN
+  } mType;
+
+  nsRefPtr<Decoder> mDecoder;
+};
+
+class DecodePoolImpl
+{
+public:
+  MOZ_DECLARE_REFCOUNTED_TYPENAME(DecodePoolImpl)
+  NS_INLINE_DECL_THREADSAFE_REFCOUNTING(DecodePoolImpl)
+
+  DecodePoolImpl()
+    : mMonitor("DecodePoolImpl")
+    , mShuttingDown(false)
+  { }
+
+  /// Initialize the current thread for use by the decode pool.
+  void InitCurrentThread()
+  {
+    MOZ_ASSERT(!NS_IsMainThread());
+
+    mThreadNaming.SetThreadPoolName(NS_LITERAL_CSTRING("ImgDecoder"));
+
+#ifdef MOZ_NUWA_PROCESS
+    if (IsNuwaProcess()) {
+      NuwaMarkCurrentThread(static_cast<void(*)(void*)>(nullptr), nullptr);
+    }
+#endif // MOZ_NUWA_PROCESS
+  }
+
+  /// Shut down the provided decode pool thread.
+  static void ShutdownThread(nsIThread* aThisThread)
+  {
+    // Threads have to be shut down from another thread, so we'll ask the
+    // main thread to do it for us.
+    nsCOMPtr<nsIRunnable> runnable =
+      NS_NewRunnableMethod(aThisThread, &nsIThread::Shutdown);
+    NS_DispatchToMainThread(runnable);
+  }
+
+  /**
+   * Requests shutdown. New work items will be dropped on the floor, and all
+   * decode pool threads will be shut down once existing work items have been
+   * processed.
+   */
+  void RequestShutdown()
+  {
+    MonitorAutoLock lock(mMonitor);
+    mShuttingDown = true;
+    mMonitor.NotifyAll();
+  }
+
+  /// Pushes a new decode work item.
+  void PushWork(Decoder* aDecoder)
+  {
+    nsRefPtr<Decoder> decoder(aDecoder);
+
+    MonitorAutoLock lock(mMonitor);
+
+    if (mShuttingDown) {
+      // Drop any new work on the floor if we're shutting down.
+      return;
+    }
+
+    mQueue.AppendElement(Move(decoder));
+    mMonitor.Notify();
+  }
+
+  /// Pops a new work item, blocking if necessary.
+  Work PopWork()
+  {
+    Work work;
+
+    MonitorAutoLock lock(mMonitor);
+
+    do {
+      if (!mQueue.IsEmpty()) {
+        // XXX(seth): This is NOT efficient, obviously, since we're removing an
+        // element from the front of the array. However, it's not worth
+        // implementing something better right now, because we are replacing
+        // this FIFO behavior with LIFO behavior very soon.
+        work.mType = Work::Type::DECODE;
+        work.mDecoder = mQueue.ElementAt(0);
+        mQueue.RemoveElementAt(0);
+
+#ifdef MOZ_NUWA_PROCESS
+        nsThreadManager::get()->SetThreadWorking();
+#endif // MOZ_NUWA_PROCESS
+
+        return work;
+      }
+
+      if (mShuttingDown) {
+        work.mType = Work::Type::SHUTDOWN;
+        return work;
+      }
+
+#ifdef MOZ_NUWA_PROCESS
+      nsThreadManager::get()->SetThreadIdle(nullptr);
+#endif // MOZ_NUWA_PROCESS
+
+      // Nothing to do; block until some work is available.
+      mMonitor.Wait();
+    } while (true);
+  }
+
+private:
+  ~DecodePoolImpl() { }
+
+  nsThreadPoolNaming mThreadNaming;
+
+  // mMonitor guards mQueue and mShuttingDown.
+  Monitor mMonitor;
+  nsTArray<nsRefPtr<Decoder>> mQueue;
+  bool mShuttingDown;
+};
+
+class DecodePoolWorker : public nsRunnable
+{
+public:
+  explicit DecodePoolWorker(DecodePoolImpl* aImpl) : mImpl(aImpl) { }
+
+  NS_IMETHOD Run()
+  {
+    MOZ_ASSERT(!NS_IsMainThread());
+
+    mImpl->InitCurrentThread();
+
+    nsCOMPtr<nsIThread> thisThread;
+    nsThreadManager::get()->GetCurrentThread(getter_AddRefs(thisThread));
+
+    do {
+      Work work = mImpl->PopWork();
+      switch (work.mType) {
+        case Work::Type::DECODE:
+          DecodePool::Singleton()->Decode(work.mDecoder);
+          break;
+
+        case Work::Type::SHUTDOWN:
+          DecodePoolImpl::ShutdownThread(thisThread);
+          return NS_OK;
+
+        default:
+          MOZ_ASSERT_UNREACHABLE("Unknown work type");
+      }
+    } while (true);
+
+    MOZ_ASSERT_UNREACHABLE("Exiting thread without Work::Type::SHUTDOWN");
+    return NS_OK;
+  }
+
+private:
+  nsRefPtr<DecodePoolImpl> mImpl;
+};
+
 /* static */ void
 DecodePool::Initialize()
 {
   MOZ_ASSERT(NS_IsMainThread());
   DecodePool::Singleton();
 }
 
 /* static */ DecodePool*
@@ -185,40 +307,37 @@ DecodePool::Singleton()
     sSingleton = new DecodePool();
     ClearOnShutdown(&sSingleton);
   }
 
   return sSingleton;
 }
 
 DecodePool::DecodePool()
-  : mMutex("image::DecodePool")
+  : mImpl(new DecodePoolImpl)
+  , mMutex("image::DecodePool")
 {
-  // Initialize the thread pool.
-  mThreadPool = do_CreateInstance(NS_THREADPOOL_CONTRACTID);
-  MOZ_RELEASE_ASSERT(mThreadPool,
-                     "Should succeed in creating image decoding thread pool");
-
-  mThreadPool->SetName(NS_LITERAL_CSTRING("ImageDecoder"));
+  // Determine the number of threads we want.
   int32_t prefLimit = gfxPrefs::ImageMTDecodingLimit();
   uint32_t limit;
   if (prefLimit <= 0) {
     limit = max(PR_GetNumberOfProcessors(), 2) - 1;
   } else {
     limit = static_cast<uint32_t>(prefLimit);
   }
 
-  mThreadPool->SetThreadLimit(limit);
-  mThreadPool->SetIdleThreadLimit(limit);
-
-#ifdef MOZ_NUWA_PROCESS
-  if (IsNuwaProcess()) {
-    mThreadPool->SetListener(new DecodePoolNuwaListener());
+  // Initialize the thread pool.
+  for (uint32_t i = 0 ; i < limit ; ++i) {
+    nsCOMPtr<nsIRunnable> worker = new DecodePoolWorker(mImpl);
+    nsCOMPtr<nsIThread> thread;
+    nsresult rv = NS_NewThread(getter_AddRefs(thread), worker);
+    MOZ_RELEASE_ASSERT(NS_SUCCEEDED(rv) && thread,
+                       "Should successfully create image decoding threads");
+    mThreads.AppendElement(Move(thread));
   }
-#endif
 
   // Initialize the I/O thread.
   nsresult rv = NS_NewNamedThread("ImageIO", getter_AddRefs(mIOThread));
   MOZ_RELEASE_ASSERT(NS_SUCCEEDED(rv) && mIOThread,
                      "Should successfully create image I/O thread");
 
 #ifdef MOZ_NUWA_PROCESS
   nsCOMPtr<nsIRunnable> worker = new RegisterDecodeIOThreadWithNuwaRunnable();
@@ -238,49 +357,44 @@ DecodePool::~DecodePool()
   MOZ_ASSERT(NS_IsMainThread(), "Must shut down DecodePool on main thread!");
 }
 
 NS_IMETHODIMP
 DecodePool::Observe(nsISupports*, const char* aTopic, const char16_t*)
 {
   MOZ_ASSERT(strcmp(aTopic, "xpcom-shutdown-threads") == 0, "Unexpected topic");
 
-  nsCOMPtr<nsIThreadPool> threadPool;
+  nsCOMArray<nsIThread> threads;
   nsCOMPtr<nsIThread> ioThread;
 
   {
     MutexAutoLock lock(mMutex);
-    threadPool.swap(mThreadPool);
+    threads.AppendElements(mThreads);
+    mThreads.Clear();
     ioThread.swap(mIOThread);
   }
 
-  if (threadPool) {
-    threadPool->Shutdown();
+  mImpl->RequestShutdown();
+
+  for (int32_t i = 0 ; i < threads.Count() ; ++i) {
+    threads[i]->Shutdown();
   }
 
   if (ioThread) {
     ioThread->Shutdown();
   }
 
   return NS_OK;
 }
 
 void
 DecodePool::AsyncDecode(Decoder* aDecoder)
 {
   MOZ_ASSERT(aDecoder);
-
-  nsCOMPtr<nsIRunnable> worker = new DecodeWorker(aDecoder);
-
-  // Dispatch to the thread pool if it exists. If it doesn't, we're currently
-  // shutting down, so it's OK to just drop the job on the floor.
-  MutexAutoLock threadPoolLock(mMutex);
-  if (mThreadPool) {
-    mThreadPool->Dispatch(worker, nsIEventTarget::DISPATCH_NORMAL);
-  }
+  mImpl->PushWork(aDecoder);
 }
 
 void
 DecodePool::SyncDecodeIfSmall(Decoder* aDecoder)
 {
   MOZ_ASSERT(NS_IsMainThread());
   MOZ_ASSERT(aDecoder);
 
@@ -295,39 +409,23 @@ DecodePool::SyncDecodeIfSmall(Decoder* a
 void
 DecodePool::SyncDecodeIfPossible(Decoder* aDecoder)
 {
   MOZ_ASSERT(NS_IsMainThread());
   Decode(aDecoder);
 }
 
 already_AddRefed<nsIEventTarget>
-DecodePool::GetEventTarget()
-{
-  MutexAutoLock threadPoolLock(mMutex);
-  nsCOMPtr<nsIEventTarget> target = do_QueryInterface(mThreadPool);
-  return target.forget();
-}
-
-already_AddRefed<nsIEventTarget>
 DecodePool::GetIOEventTarget()
 {
   MutexAutoLock threadPoolLock(mMutex);
   nsCOMPtr<nsIEventTarget> target = do_QueryInterface(mIOThread);
   return target.forget();
 }
 
-already_AddRefed<nsIRunnable>
-DecodePool::CreateDecodeWorker(Decoder* aDecoder)
-{
-  MOZ_ASSERT(aDecoder);
-  nsCOMPtr<nsIRunnable> worker = new DecodeWorker(aDecoder);
-  return worker.forget();
-}
-
 void
 DecodePool::Decode(Decoder* aDecoder)
 {
   MOZ_ASSERT(aDecoder);
 
   nsresult rv = aDecoder->Decode();
 
   if (NS_SUCCEEDED(rv) && !aDecoder->GetDecodeDone()) {

--- a/image/src/DecodePool.h
+++ b/image/src/DecodePool.h
@@ -7,27 +7,30 @@
  * DecodePool manages the threads used for decoding raster images.
  */
 
 #ifndef mozilla_image_src_DecodePool_h
 #define mozilla_image_src_DecodePool_h
 
 #include "mozilla/Mutex.h"
 #include "mozilla/StaticPtr.h"
+#include "nsCOMArray.h"
 #include "nsCOMPtr.h"
 #include "nsIEventTarget.h"
 #include "nsIObserver.h"
+#include "nsRefPtr.h"
 
 class nsIThread;
 class nsIThreadPool;
 
 namespace mozilla {
 namespace image {
 
 class Decoder;
+class DecodePoolImpl;
 
 /**
  * DecodePool is a singleton class that manages decoding of raster images. It
  * owns a pool of image decoding threads that are used for asynchronous
  * decoding.
  *
  * DecodePool allows callers to run a decoder, handling management of the
  * decoder's lifecycle and whether it executes on the main thread,
@@ -59,56 +62,40 @@ public:
   /**
    * Run aDecoder synchronously if at all possible. If it can't complete
    * synchronously because the source data isn't complete, asynchronously decode
    * the rest.
    */
   void SyncDecodeIfPossible(Decoder* aDecoder);
 
   /**
-   * Returns an event target interface to the DecodePool's underlying thread
-   * pool. Callers can use this event target to submit work to the image
-   * decoding thread pool.
-   *
-   * @return An nsIEventTarget interface to the thread pool.
-   */
-  already_AddRefed<nsIEventTarget> GetEventTarget();
-
-  /**
    * Returns an event target interface to the DecodePool's I/O thread. Callers
    * who want to deliver data to workers on the DecodePool can use this event
    * target.
    *
    * @return An nsIEventTarget interface to the thread pool's I/O thread.
    */
   already_AddRefed<nsIEventTarget> GetIOEventTarget();
 
-  /**
-   * Creates a worker which can be used to attempt further decoding using the
-   * provided decoder.
-   *
-   * @return The new worker, which should be posted to the event target returned
-   *         by GetEventTarget.
-   */
-  already_AddRefed<nsIRunnable> CreateDecodeWorker(Decoder* aDecoder);
-
 private:
-  friend class DecodeWorker;
+  friend class DecodePoolWorker;
 
   DecodePool();
   virtual ~DecodePool();
 
   void Decode(Decoder* aDecoder);
   void NotifyDecodeComplete(Decoder* aDecoder);
   void NotifyProgress(Decoder* aDecoder);
 
   static StaticRefPtr<DecodePool> sSingleton;
 
-  // mMutex protects mThreadPool and mIOThread.
+  nsRefPtr<DecodePoolImpl>    mImpl;
+
+  // mMutex protects mThreads and mIOThread.
   Mutex                     mMutex;
-  nsCOMPtr<nsIThreadPool>   mThreadPool;
+  nsCOMArray<nsIThread>     mThreads;
   nsCOMPtr<nsIThread>       mIOThread;
 };
 
 } // namespace image
 } // namespace mozilla
 
 #endif // mozilla_image_src_DecodePool_h

--- a/image/src/Decoder.cpp
+++ b/image/src/Decoder.cpp
@@ -161,25 +161,17 @@ Decoder::Decode()
   return HasError() ? NS_ERROR_FAILURE : NS_OK;
 }
 
 void
 Decoder::Resume()
 {
   DecodePool* decodePool = DecodePool::Singleton();
   MOZ_ASSERT(decodePool);
-
-  nsCOMPtr<nsIEventTarget> target = decodePool->GetEventTarget();
-  if (MOZ_UNLIKELY(!target)) {
-    // We're shutting down and the DecodePool's thread pool has been destroyed.
-    return;
-  }
-
-  nsCOMPtr<nsIRunnable> worker = decodePool->CreateDecodeWorker(this);
-  target->Dispatch(worker, nsIEventTarget::DISPATCH_NORMAL);
+  decodePool->AsyncDecode(this);
 }
 
 bool
 Decoder::ShouldSyncDecode(size_t aByteLimit)
 {
   MOZ_ASSERT(aByteLimit > 0);
   MOZ_ASSERT(mIterator, "Should have a SourceBufferIterator");
 

--- a/image/src/RasterImage.cpp
+++ b/image/src/RasterImage.cpp
@@ -942,16 +942,20 @@ RasterImage::OnAddedFrame(uint32_t aNewF
     NS_DispatchToMainThread(runnable);
     return;
   }
 
   MOZ_ASSERT((mFrameCount == 1 && aNewFrameCount == 1) ||
              mFrameCount < aNewFrameCount,
              "Frame count running backwards");
 
+  if (mError) {
+    return;  // We're in an error state, possibly due to OOM. Bail.
+  }
+
   if (aNewFrameCount > mFrameCount) {
     mFrameCount = aNewFrameCount;
 
     if (aNewFrameCount == 2) {
       // We're becoming animated, so initialize animation stuff.
       MOZ_ASSERT(!mAnim, "Already have animation state?");
       mAnim = MakeUnique<FrameAnimator>(this, mSize, mAnimationMode);
 

--- a/image/src/moz.build
+++ b/image/src/moz.build
@@ -63,12 +63,14 @@ LOCAL_INCLUDES += [
     # Access to Skia headers for Downscaler
     '/gfx/2d',
     # We need to instantiate the decoders
     '/image/decoders',
     # Because VectorImage.cpp includes nsSVGUtils.h and nsSVGEffects.h
     '/layout/svg',
     # For URI-related functionality
     '/netwerk/base',
+    # DecodePool uses thread-related facilities.
+    '/xpcom/threads',
 ]
 
 # Because imgFrame.cpp includes "cairo.h"
 CXXFLAGS += CONFIG['MOZ_CAIRO_CFLAGS']

--- a/image/test/crashtests/crashtests.list
+++ b/image/test/crashtests/crashtests.list
@@ -42,8 +42,13 @@ load truncated-second-frame.png # bug 86
 # after we've gotten our size.
 load multiple-png-hassize.ico
 
 # Bug 856615
 # Asserts in the debug build
 load 856616.gif
 
 skip-if(AddressSanitizer) skip-if(B2G) load 944353.jpg
+
+# Bug 1160801: Ensure that we handle invalid disposal types.
+load invalid-disposal-method-1.gif
+load invalid-disposal-method-2.gif
+load invalid-disposal-method-3.gif

new file mode 100644
index e69de29bb2d1d6434b8b29ae775ad8c2e48c5391..30c61de188b9c63ea179c008c5171efad638f853
GIT binary patch
literal 167
zc${<hbhEHb)L_tH_{hW{sr6rbBl~|aQ2fav!o|SAp!iSFxhOTUBsE2$JhLQ2!QIn0
zfI$Z+!2r_4z@*;Ozw-23{>5{)-0I$ZZ_jW3wnrY*o^>vJb!yu??&F_)u7B%&{_C7F
SD+AC#29SZsdRvIpYYhO5fk;^Z

new file mode 100644
index e69de29bb2d1d6434b8b29ae775ad8c2e48c5391..66158d81a90b670d28b258a22f87f037542122f0
GIT binary patch
literal 167
zc${<hbhEHb)L_tH_{hW{sr6rbBl~|aQ2fav!NtJ9p!iSFxhOTUBsE2$JhLQ2!QIn0
zfI$Z+!2r_4z@*;Ozw-23{>5{)-0I$ZZ_jW3wnrY*o^>vJb!yu??&F_)u7B%&{_C7F
SD+AC#29SZsdRvIpYYhO7tw>z}

new file mode 100644
index e69de29bb2d1d6434b8b29ae775ad8c2e48c5391..0da0723773e1b6c4f3d4e9df6d47ebe753f6c087
GIT binary patch
literal 167
zc${<hbhEHb)L_tH_{hW{sr6rbBl~|aQ2fav!^ObBp!iSFxhOTUBsE2$JhLQ2!QIn0
zfI$Z+!2r_4z@*;Ozw-23{>5{)-0I$ZZ_jW3wnrY*o^>vJb!yu??&F_)u7B%&{_C7F
SD+AC#29SZsdRvIpYYhO9*+^jk

--- a/js/src/builtin/Map.js
+++ b/js/src/builtin/Map.js
@@ -27,8 +27,14 @@ function MapForEach(callbackfn, thisArg 
     while (true) {
         var result = callFunction(std_Map_iterator_next, entries);
         if (result.done)
             break;
         var entry = result.value;
         callFunction(callbackfn, thisArg, entry[1], entry[0], M);
     }
 }
+
+// ES6 final draft 23.1.2.2.
+function MapSpecies() {
+    // Step 1.
+    return this;
+}

--- a/js/src/builtin/MapObject.cpp
+++ b/js/src/builtin/MapObject.cpp
@@ -1045,42 +1045,50 @@ const JSFunctionSpec MapObject::methods[
     JS_FN("delete", delete_, 1, 0),
     JS_FN("keys", keys, 0, 0),
     JS_FN("values", values, 0, 0),
     JS_FN("clear", clear, 0, 0),
     JS_SELF_HOSTED_FN("forEach", "MapForEach", 2, 0),
     JS_FS_END
 };
 
+const JSPropertySpec MapObject::staticProperties[] = {
+    JS_SELF_HOSTED_SYM_GET(species, "MapSpecies", 0),
+    JS_PS_END
+};
+
 static JSObject*
 InitClass(JSContext* cx, Handle<GlobalObject*> global, const Class* clasp, JSProtoKey key, Native construct,
-          const JSPropertySpec* properties, const JSFunctionSpec* methods)
+          const JSPropertySpec* properties, const JSFunctionSpec* methods,
+          const JSPropertySpec* staticProperties)
 {
     RootedNativeObject proto(cx, global->createBlankPrototype(cx, clasp));
     if (!proto)
         return nullptr;
     proto->setPrivate(nullptr);
 
     Rooted<JSFunction*> ctor(cx, global->createConstructor(cx, construct, ClassName(key, cx), 0));
     if (!ctor ||
+        !JS_DefineProperties(cx, ctor, staticProperties) ||
         !LinkConstructorAndPrototype(cx, ctor, proto) ||
         !DefinePropertiesAndFunctions(cx, proto, properties, methods) ||
         !GlobalObject::initBuiltinConstructor(cx, global, key, ctor, proto))
     {
         return nullptr;
     }
     return proto;
 }
 
 JSObject*
 MapObject::initClass(JSContext* cx, JSObject* obj)
 {
     Rooted<GlobalObject*> global(cx, &obj->as<GlobalObject>());
     RootedObject proto(cx,
-        InitClass(cx, global, &class_, JSProto_Map, construct, properties, methods));
+        InitClass(cx, global, &class_, JSProto_Map, construct, properties, methods,
+                  staticProperties));
     if (proto) {
         // Define the "entries" method.
         JSFunction* fun = JS_DefineFunction(cx, proto, "entries", entries, 0, 0);
         if (!fun)
             return nullptr;
 
         // Define its alias.
         RootedValue funval(cx, ObjectValue(*fun));
@@ -1777,22 +1785,28 @@ const JSFunctionSpec SetObject::methods[
     JS_FN("add", add, 1, 0),
     JS_FN("delete", delete_, 1, 0),
     JS_FN("entries", entries, 0, 0),
     JS_FN("clear", clear, 0, 0),
     JS_SELF_HOSTED_FN("forEach", "SetForEach", 2, 0),
     JS_FS_END
 };
 
+const JSPropertySpec SetObject::staticProperties[] = {
+    JS_SELF_HOSTED_SYM_GET(species, "SetSpecies", 0),
+    JS_PS_END
+};
+
 JSObject*
 SetObject::initClass(JSContext* cx, JSObject* obj)
 {
     Rooted<GlobalObject*> global(cx, &obj->as<GlobalObject>());
     RootedObject proto(cx,
-        InitClass(cx, global, &class_, JSProto_Set, construct, properties, methods));
+        InitClass(cx, global, &class_, JSProto_Set, construct, properties, methods,
+                  staticProperties));
     if (proto) {
         // Define the "values" method.
         JSFunction* fun = JS_DefineFunction(cx, proto, "values", values, 0, 0);
         if (!fun)
             return nullptr;
 
         // Define its aliases.
         RootedValue funval(cx, ObjectValue(*fun));

--- a/js/src/builtin/MapObject.h
+++ b/js/src/builtin/MapObject.h
@@ -103,16 +103,17 @@ class MapObject : public NativeObject {
     static bool has(JSContext* cx, HandleObject obj, HandleValue key, bool* rval);
     static bool set(JSContext* cx, HandleObject obj, HandleValue key, HandleValue val);
     static bool clear(JSContext* cx, HandleObject obj);
     static bool iterator(JSContext* cx, IteratorKind kind, HandleObject obj, MutableHandleValue iter);
 
   private:
     static const JSPropertySpec properties[];
     static const JSFunctionSpec methods[];
+    static const JSPropertySpec staticProperties[];
     ValueMap* getData() { return static_cast<ValueMap*>(getPrivate()); }
     static ValueMap & extract(HandleObject o);
     static ValueMap & extract(CallReceiver call);
     static void mark(JSTracer* trc, JSObject* obj);
     static void finalize(FreeOp* fop, JSObject* obj);
     static bool construct(JSContext* cx, unsigned argc, Value* vp);
 
     static bool is(HandleValue v);
@@ -148,16 +149,17 @@ class SetObject : public NativeObject {
     static bool values(JSContext* cx, unsigned argc, Value* vp);
     static bool add(JSContext* cx, HandleObject obj, HandleValue key);
     static bool has(JSContext* cx, unsigned argc, Value* vp);
     static SetObject* create(JSContext* cx);
 
   private:
     static const JSPropertySpec properties[];
     static const JSFunctionSpec methods[];
+    static const JSPropertySpec staticProperties[];
     ValueSet* getData() { return static_cast<ValueSet*>(getPrivate()); }
     static ValueSet & extract(CallReceiver call);
     static void mark(JSTracer* trc, JSObject* obj);
     static void finalize(FreeOp* fop, JSObject* obj);
     static bool construct(JSContext* cx, unsigned argc, Value* vp);
 
     static bool is(HandleValue v);
 

--- a/js/src/builtin/Set.js
+++ b/js/src/builtin/Set.js
@@ -27,8 +27,14 @@ function SetForEach(callbackfn, thisArg 
     while (true) {
         var result = callFunction(std_Set_iterator_next, values);
         if (result.done)
             break;
         var value = result.value;
         callFunction(callbackfn, thisArg, value, value, S);
     }
 }
+
+// ES6 final draft 23.2.2.2.
+function SetSpecies() {
+    // Step 1.
+    return this;
+}

--- a/js/src/jsapi.h
+++ b/js/src/jsapi.h
@@ -2098,16 +2098,21 @@ inline int CheckIsSetterOp(JSSetterOp op
      { { nullptr, JS_CAST_STRING_TO(getterName, const JSJitInfo*) } }, \
      JSNATIVE_WRAPPER(nullptr) }
 #define JS_SELF_HOSTED_GETSET(name, getterName, setterName, flags) \
     {name, \
      uint8_t(JS_CHECK_ACCESSOR_FLAGS(flags) | JSPROP_SHARED | JSPROP_GETTER | JSPROP_SETTER), \
      { nullptr, JS_CAST_STRING_TO(getterName, const JSJitInfo*) },  \
      { nullptr, JS_CAST_STRING_TO(setterName, const JSJitInfo*) } }
 #define JS_PS_END { nullptr, 0, JSNATIVE_WRAPPER(nullptr), JSNATIVE_WRAPPER(nullptr) }
+#define JS_SELF_HOSTED_SYM_GET(symbol, getterName, flags) \
+    {reinterpret_cast<const char*>(uint32_t(::JS::SymbolCode::symbol) + 1), \
+     uint8_t(JS_CHECK_ACCESSOR_FLAGS(flags) | JSPROP_SHARED | JSPROP_GETTER), \
+     { { nullptr, JS_CAST_STRING_TO(getterName, const JSJitInfo*) } }, \
+     JSNATIVE_WRAPPER(nullptr) }
 
 /*
  * To define a native function, set call to a JSNativeWrapper. To define a
  * self-hosted function, set selfHostedName to the name of a function
  * compiled during JSRuntime::initSelfHosting.
  */
 struct JSFunctionSpec {
     const char*     name;
@@ -4350,22 +4355,23 @@ GetSymbolFor(JSContext* cx, HandleString
  */
 JS_PUBLIC_API(JSString*)
 GetSymbolDescription(HandleSymbol symbol);
 
 /* Well-known symbols. */
 enum class SymbolCode : uint32_t {
     iterator,                       // Symbol.iterator
     match,                          // Symbol.match
+    species,                        // Symbol.species
     InSymbolRegistry = 0xfffffffe,  // created by Symbol.for() or JS::GetSymbolFor()
     UniqueSymbol = 0xffffffff       // created by Symbol() or JS::NewSymbol()
 };
 
 /* For use in loops that iterate over the well-known symbols. */
-const size_t WellKnownSymbolLimit = 2;
+const size_t WellKnownSymbolLimit = 3;
 
 /*
  * Return the SymbolCode telling what sort of symbol `symbol` is.
  *
  * A symbol's SymbolCode never changes once it is created.
  */
 JS_PUBLIC_API(SymbolCode)
 GetSymbolCode(Handle<Symbol*> symbol);

new file mode 100644
--- /dev/null
+++ b/js/src/tests/ecma_6/Symbol/species.js
@@ -0,0 +1,22 @@
+var BUGNUMBER = 1131043;
+var summary = "Implement @@species getter for builtin types";
+
+print(BUGNUMBER + ": " + summary);
+
+for (var C of [Map, Set]) {
+  assertEq(C[Symbol.species], C);
+}
+
+for (C of [Map, Set]) {
+  var desc = Object.getOwnPropertyDescriptor(C, Symbol.species);
+  assertDeepEq(Object.keys(desc).sort(), ["configurable", "enumerable", "get", "set"]);
+  assertEq(desc.set, undefined);
+  assertEq(desc.enumerable, false);
+  assertEq(desc.configurable, true);
+  assertEq(desc.get.apply(null), null);
+  assertEq(desc.get.apply(undefined), undefined);
+  assertEq(desc.get.apply(42), 42);
+}
+
+if (typeof reportCompare === "function")
+    reportCompare(0, 0);

--- a/js/src/tests/ecma_6/Symbol/well-known.js
+++ b/js/src/tests/ecma_6/Symbol/well-known.js
@@ -1,14 +1,15 @@
 /* Any copyright is dedicated to the Public Domain.
  * http://creativecommons.org/licenses/publicdomain/ */
 
 var names = [
     "iterator",
     "match",
+    "species",
 ];
 
 for (var name of names) {
     // Well-known symbols exist.
     assertEq(typeof Symbol[name], "symbol");
 
     // They are never in the registry.
     assertEq(Symbol[name] !== Symbol.for("Symbol." + name), true);

--- a/js/src/tests/ecma_6/TypedArray/slice.js
+++ b/js/src/tests/ecma_6/TypedArray/slice.js
@@ -63,15 +63,15 @@ for (var constructor of constructors) {
     }, TypeError, "Assert that we have an invalid constructor");
 
     // If obj.constructor[@@species] is undefined or null -- which it has to be
     // if we don't implement @@species -- then the default constructor is used.
     var mathConstructor = new constructor(8);
     mathConstructor.constructor = Math.sin;
     assertDeepEq(mathConstructor.slice(4), new constructor(4));
 
-    assertEq("species" in Symbol, false,
-             "you've implemented @@species -- add real tests here!");
+    assertEq(Symbol.species in Int8Array, false,
+             "you've implemented %TypedArray%[@@species] -- add real tests here!");
 }
 
 if (typeof reportCompare === "function")
     reportCompare(true, true);
 

--- a/js/src/vm/CommonPropertyNames.h
+++ b/js/src/vm/CommonPropertyNames.h
@@ -243,20 +243,22 @@
     macro(number, number, "number") \
     macro(boolean, boolean, "boolean") \
     macro(null, null, "null") \
     macro(symbol, symbol, "symbol") \
     /* Well-known atom names must be continuous and ordered, matching \
      * enum JS::SymbolCode in jsapi.h. */ \
     macro(iterator, iterator, "iterator") \
     macro(match, match, "match") \
+    macro(species, species, "species") \
     /* Same goes for the descriptions of the well-known symbols. */ \
     macro(Symbol_create, Symbol_create, "Symbol.create") \
     macro(Symbol_hasInstance, Symbol_hasInstance, "Symbol.hasInstance") \
     macro(Symbol_isConcatSpreadable, Symbol_isConcatSpreadable, "Symbol.isConcatSpreadable") \
     macro(Symbol_isRegExp, Symbol_isRegExp, "Symbol.isRegExp") \
     macro(Symbol_iterator, Symbol_iterator, "Symbol.iterator") \
     macro(Symbol_match,    Symbol_match,    "Symbol.match") \
+    macro(Symbol_species,  Symbol_species,  "Symbol.species") \
     macro(Symbol_toPrimitive, Symbol_toPrimitive, "Symbol.toPrimitive") \
     macro(Symbol_toStringTag, Symbol_toStringTag, "Symbol.toStringTag") \
     macro(Symbol_unscopables, Symbol_unscopables, "Symbol.unscopables") \
 
 #endif /* vm_CommonPropertyNames_h */

--- a/js/src/vm/GlobalObject.cpp
+++ b/js/src/vm/GlobalObject.cpp
@@ -386,16 +386,24 @@ GlobalObject::initSelfHostingBuiltins(JS
     RootedValue std_iterator(cx);
     std_iterator.setSymbol(cx->wellKnownSymbols().get(JS::SymbolCode::iterator));
     if (!JS_DefineProperty(cx, global, "std_iterator", std_iterator,
                            JSPROP_PERMANENT | JSPROP_READONLY))
     {
         return false;
     }
 
+    RootedValue std_species(cx);
+    std_species.setSymbol(cx->wellKnownSymbols().get(JS::SymbolCode::species));
+    if (!JS_DefineProperty(cx, global, "std_species", std_species,
+                           JSPROP_PERMANENT | JSPROP_READONLY))
+    {
+        return false;
+    }
+
     return InitBareBuiltinCtor(cx, global, JSProto_Array) &&
            InitBareBuiltinCtor(cx, global, JSProto_TypedArray) &&
            InitBareBuiltinCtor(cx, global, JSProto_Uint8Array) &&
            InitBareBuiltinCtor(cx, global, JSProto_Uint32Array) &&
            InitBareWeakMapCtor(cx, global) &&
            initStopIterationClass(cx, global) &&
            InitSelfHostingCollectionIteratorFunctions(cx, global) &&
            JS_DefineFunctions(cx, global, builtins);

--- a/js/src/vm/Runtime.h
+++ b/js/src/vm/Runtime.h
@@ -425,16 +425,17 @@ namespace js {
  *
  * Well-known symbols are never GC'd. The description() of each well-known
  * symbol is a permanent atom.
  */
 struct WellKnownSymbols
 {
     js::ImmutableSymbolPtr iterator;
     js::ImmutableSymbolPtr match;
+    js::ImmutableSymbolPtr species;
 
     const ImmutableSymbolPtr& get(size_t u) const {
         MOZ_ASSERT(u < JS::WellKnownSymbolLimit);
         const ImmutableSymbolPtr* symbols = reinterpret_cast<const ImmutableSymbolPtr*>(this);
         return symbols[u];
     }
 
     const ImmutableSymbolPtr& get(JS::SymbolCode code) const {

--- a/layout/base/nsPresShell.cpp
+++ b/layout/base/nsPresShell.cpp
@@ -8051,42 +8051,35 @@ PresShell::HandleEventInternal(WidgetEve
     // XXX How about IME events and input events for plugins?
     if (aEvent->mFlags.mIsTrusted) {
       switch (aEvent->message) {
       case NS_KEY_PRESS:
       case NS_KEY_DOWN:
       case NS_KEY_UP: {
         nsIDocument* doc = GetCurrentEventContent() ?
                            mCurrentEventContent->OwnerDoc() : nullptr;
-        nsIDocument* fullscreenAncestor = nullptr;
         auto keyCode = aEvent->AsKeyboardEvent()->keyCode;
         if (keyCode == NS_VK_ESCAPE) {
-          if ((fullscreenAncestor = nsContentUtils::GetFullscreenAncestor(doc))) {
+          nsIDocument* root = nsContentUtils::GetRootDocument(doc);
+          if (root && root->IsFullScreenDoc()) {
             // Prevent default action on ESC key press when exiting
             // DOM fullscreen mode. This prevents the browser ESC key
             // handler from stopping all loads in the document, which
             // would cause <video> loads to stop.
             aEvent->mFlags.mDefaultPrevented = true;
             aEvent->mFlags.mOnlyChromeDispatch = true;
 
             // The event listeners in chrome can prevent this ESC behavior by
             // calling prevent default on the preceding keydown/press events.
             if (!mIsLastChromeOnlyEscapeKeyConsumed &&
                 aEvent->message == NS_KEY_UP) {
               // ESC key released while in DOM fullscreen mode.
-              // If fullscreen is running in content-only mode, exit the target
-              // doctree branch from fullscreen, otherwise fully exit all
-              // browser windows and documents from fullscreen mode.
-              // Note: in the content-only fullscreen case, we pass the
-              // fullscreenAncestor since |doc| may not actually be fullscreen
-              // here, and ExitFullscreen() has no affect when passed a
-              // non-fullscreen document.
-              nsIDocument::ExitFullscreen(
-                nsContentUtils::IsFullscreenApiContentOnly() ? fullscreenAncestor : nullptr,
-                /* async */ true);
+              // Fully exit all browser windows and documents from
+              // fullscreen mode.
+              nsIDocument::ExitFullscreen(nullptr, /* async */ true);
             }
           }
           nsCOMPtr<nsIDocument> pointerLockedDoc =
             do_QueryReferent(EventStateManager::sPointerLockedDoc);
           if (!mIsLastChromeOnlyEscapeKeyConsumed && pointerLockedDoc) {
             aEvent->mFlags.mDefaultPrevented = true;
             aEvent->mFlags.mOnlyChromeDispatch = true;
             if (aEvent->message == NS_KEY_UP) {

--- a/layout/generic/WritingModes.h
+++ b/layout/generic/WritingModes.h
@@ -25,16 +25,20 @@
 // such methods should only be used by other methods that have already checked
 // the writing modes.)
 
 #define CHECK_WRITING_MODE(param) \
    NS_ASSERTION(param == GetWritingMode(), "writing-mode mismatch")
 
 namespace mozilla {
 
+namespace widget {
+struct IMENotification;
+} // namespace widget
+
 // Physical axis constants.
 enum PhysicalAxis {
   eAxisVertical      = 0x0,
   eAxisHorizontal    = 0x1
 };
 
 inline bool IsInline(LogicalSide aSide) { return aSide & 0x2; }
 inline bool IsBlock(LogicalSide aSide) { return !IsInline(aSide); }
@@ -470,16 +474,20 @@ public:
 
 private:
   friend class LogicalPoint;
   friend class LogicalSize;
   friend class LogicalMargin;
   friend class LogicalRect;
 
   friend struct IPC::ParamTraits<WritingMode>;
+  // IMENotification cannot store this class directly since this has some
+  // constructors.  Therefore, it stores mWritingMode and recreate the
+  // instance from it.
+  friend struct widget::IMENotification;
 
   /**
    * Return a WritingMode representing an unknown value.
    */
   static inline WritingMode Unknown()
   {
     return WritingMode(eUnknownWritingMode);
   }

--- a/layout/generic/test/chrome.ini
+++ b/layout/generic/test/chrome.ini
@@ -2,16 +2,17 @@
 skip-if = buildapp == 'b2g'
 support-files =
   file_bug514732_window.xul
   frame_selection_underline-ref.xhtml
   frame_selection_underline.css
   frame_selection_underline.xhtml
 
 [test_backspace_delete.xul]
+skip-if = true # Bug 1163311
 [test_bug348681.html]
 [test_bug469613.xul]
 [test_bug469774.xul]
 [test_bug508115.xul]
 [test_bug514732-2.xul]
 [test_bug632379.xul]
 skip-if = buildapp == 'mulet'
 [test_selection_preventDefault.html]

--- a/modules/libpref/init/all.js
+++ b/modules/libpref/init/all.js
@@ -3064,16 +3064,44 @@ pref("intl.tsf.hack.easy_changjei.do_not
 // of selected clause of composition string.
 pref("intl.tsf.hack.google_ja_input.do_not_return_no_layout_error_at_first_char", true);
 // Whether use previous character rect for the result of
 // ITfContextView::GetTextExt() if the specified range is the caret of
 // composition string.
 pref("intl.tsf.hack.google_ja_input.do_not_return_no_layout_error_at_caret", true);
 #endif
 
+// If composition_font is set, Gecko sets the font to IME.  IME may use
+// the fonts on their window like candidate window.  If they are empty,
+// Gecko uses the system default font which is set to the IM context.
+// The font name must not start with '@'.  When the writing mode is vertical,
+// Gecko inserts '@' to the start of the font name automatically.
+// FYI: Changing these prefs requires to restart.
+pref("intl.imm.composition_font", "");
+
+// Japanist 2003's candidate window is broken if the font is "@System" which
+// is default composition font for vertical writing mode.
+// You can specify font to use on candidate window of Japanist 2003.
+// This value must not start with '@'.
+// FYI: Changing this pref requires to restart.
+pref("intl.imm.composition_font.japanist_2003", "MS PGothic");
+
+// Even if IME claims that they support vertical writing mode but it may not
+// support vertical writing mode for its candidate window.  This pref allows
+// to ignore the claim.
+// FYI: Changing this pref requires to restart.
+pref("intl.imm.vertical_writing.always_assume_not_supported", false);
+
+// We cannot retrieve active IME name with IMM32 API if a TIP of TSF is active.
+// This pref can specify active IME name when Japanese TIP is active.
+// For example:
+//   Google Japanese Input: "Google 日本語入力 IMM32 モジュール"
+//   ATOK 2011: "ATOK 2011" (similarly, e.g., ATOK 2013 is "ATOK 2013")
+pref("intl.imm.japanese.assume_active_tip_name_as", "");
+
 // See bug 448927, on topmost panel, some IMEs are not usable on Windows.
 pref("ui.panel.default_level_parent", false);
 
 pref("mousewheel.system_scroll_override_on_root_content.enabled", true);
 
 // High resolution scrolling with supported mouse drivers on Vista or later.
 pref("mousewheel.enable_pixel_scrolling", true);
 
@@ -4163,17 +4191,16 @@ pref("notification.feature.enabled", fal
 pref("dom.webnotifications.enabled", true);
 
 // Alert animation effect, name is disableSlidingEffect for backwards-compat.
 pref("alerts.disableSlidingEffect", false);
 
 // DOM full-screen API.
 pref("full-screen-api.enabled", false);
 pref("full-screen-api.allow-trusted-requests-only", true);
-pref("full-screen-api.content-only", false);
 pref("full-screen-api.pointer-lock.enabled", true);
 
 // DOM idle observers API
 pref("dom.idle-observers-api.enabled", true);
 
 // Time limit, in milliseconds, for EventStateManager::IsHandlingUserInput().
 // Used to detect long running handlers of user-generated events.
 pref("dom.event.handling-user-input-time-limit", 1000);

--- a/python/eme/gen-eme-voucher.py
+++ b/python/eme/gen-eme-voucher.py
@@ -2,39 +2,46 @@
 #
 # Copyright 2014 Adobe Systems Incorporated. All Rights Reserved.
 #
 # Adobe permits you to use, modify, and distribute this file in accordance
 # with the terms of the Mozilla Public License, v 2.0 accompanying it.  If
 # a copy of the MPL was not distributed with this file, You can obtain one
 # at http://mozilla.org/MPL/2.0/.
 #
-# Creates an Adobe Access signed voucher for any executable
+# Creates an Adobe Access signed voucher for x32/x64 windows executables
 #   Notes: This is currently python2.7 due to mozilla build system requirements
 
+from __future__ import print_function
+
 import argparse, bitstring, pprint, hashlib, os, subprocess, sys, tempfile
 from pyasn1.codec.der import encoder as der_encoder
 from pyasn1.type import univ, namedtype, namedval, constraint
 
+# Defined in WinNT.h from the Windows SDK
+IMAGE_SCN_MEM_EXECUTE = 0x20000000
+IMAGE_REL_BASED_HIGHLOW = 3
+IMAGE_REL_BASED_DIR64 = 10
+
 
 # CodeSectionDigest ::= SEQUENCE {
 #   offset				INTEGER --  section's file offset in the signed binary
 #   digestAlgorithm		OBJECT IDENTIFIER -- algorithm identifier for the hash value below. For now only supports SHA256.
 #   digestValue			OCTET STRING -- hash value of the TEXT segment.
 # }
 class CodeSectionDigest(univ.Sequence):
 	componentType = namedtype.NamedTypes(
 		namedtype.NamedType('offset', univ.Integer()),
 		namedtype.NamedType('digestAlgorithm', univ.ObjectIdentifier()),
 		namedtype.NamedType('digest', univ.OctetString()))
 
 
 # CodeSegmentDigest ::= SEQUENCE {
-#	 offset				INTEGER -- TEXT segment's file offset in the signed binary
-#	 codeSectionDigests			SET OF CodeSectionDigests
+#    offset				INTEGER -- TEXT segment's file offset in the signed binary
+#    codeSectionDigests			SET OF CodeSectionDigests
 # }
 
 class SetOfCodeSectionDigest(univ.SetOf):
 	componentType = CodeSectionDigest()
 
 
 class CodeSegmentDigest(univ.Sequence):
 	componentType = namedtype.NamedTypes(
@@ -94,16 +101,17 @@ class ApplicationDigest(univ.Sequence):
 def meets_requirements(items, requirements):
 	for r in requirements:
 		for n, v in r.items():
 			if n not in items or items[n] != v: return False
 	return True
 
 
 # return total number of bytes read from items_in excluding leaves
+# TODO: research replacing this with the python built-in struct module
 def parse_items(stream, items_in, items_out):
 	bits_read = 0
 	total_bits_read = 0
 
 	for item in items_in:
 		name = item[0]
 		t = item[1]
 		bits = 1 if ":" not in t else int(t[t.index(":") + 1:])
@@ -310,27 +318,28 @@ class COFFFileHeader:
 
 			for i in range(0, int((block_size - 8) / 2)):
 				data = stream.read('uintle:16')
 				typ = data >> 12
 				offset = data & 0xFFF
 
 				if offset == 0 and i > 0: continue
 
-				assert(typ == 3)
+				assert(typ == IMAGE_REL_BASED_HIGHLOW or typ == IMAGE_REL_BASED_DIR64)
 
 				cur_pos = stream.bitpos
 				sh, value_bytepos = self.get_rva_section(page_rva + offset)
 				stream.bytepos = value_bytepos
-				value = stream.read('uintle:32')
+				value = stream.read('uintle:32' if typ == IMAGE_REL_BASED_HIGHLOW else 'uintle:64')
 
 				# remove BaseAddress
 				value -= self.OptionalHeader.items['ImageBase']
 
-				stream.overwrite(bitstring.BitArray(uint=value, length=4 * 8), pos=value_bytepos * 8)
+				bit_size = (4 if typ == IMAGE_REL_BASED_HIGHLOW else 8) * 8
+				stream.overwrite(bitstring.BitArray(uint=value, length=bit_size), pos=value_bytepos * 8)
 				stream.pos = cur_pos
 
 		stream.bitpos = orig_pos
 
 	def get_rva_section(self, rva):
 		for sh in self.section_headers:
 			if rva < sh.items['VirtualAddress'] or rva >= sh.items['VirtualAddress'] + sh.items['VirtualSize']:
 				continue
@@ -340,25 +349,66 @@ class COFFFileHeader:
 
 		raise Exception('Could not match RVA to section')
 
 
 def create_temp_file(suffix=""):
 	fd, path = tempfile.mkstemp(suffix=suffix)
 	os.close(fd)
 	return path
-	
-# TIPS:
-#  How to convert PFX to PEM: openssl pkcs12 -in build/certificates/testPKI/IV.pfx -out build/certificates/testPKI/IV.cert.pem
+
+
+class ExpandPath(argparse.Action):
+	def __call__(self, parser, namespace, values, option_string=None):
+		setattr(namespace, self.dest, os.path.abspath(os.path.expanduser(values)))
+
+
+# this does a naming trick since windows doesn't allow multiple usernames for the same server
+def get_password(service_name, user_name):
+	try:
+		import keyring
+
+		# windows doesn't allow multiple usernames for the same server, argh
+		if sys.platform == "win32":
+			password = keyring.get_password(service_name + "-" + user_name, user_name)
+		else:
+			password = keyring.get_password(service_name, user_name)
+
+		return password
+	except:
+	    # This allows for manual testing where you do not wish to cache the password on the system 
+		print("Missing keyring module...getting password manually")
+
+	return None
+
+
+def openssl_cmd(app_args, args, password_in, password_out):
+	password = get_password(app_args.password_service, app_args.password_user) if (password_in or password_out) else None
+	env = None
+	args = [app_args.openssl_path] + args
+
+	if password is not None:
+		env = os.environ.copy()
+		env["COFF_PW"] = password
+
+		if password_in: args += ["-passin", "env:COFF_PW"]
+		if password_out: args += ["-passout", "env:COFF_PW", "-password", "env:COFF_PW"]
+
+	p = subprocess.Popen(args, env=env)
+	assert p.wait() == 0
+
+
 def main():
 	parser = argparse.ArgumentParser(description='PE/COFF Signer')
-	parser.add_argument('-input', required=True, help="File to parse.")
-	parser.add_argument('-output', required=True, help="File to write to.")
-	parser.add_argument('-openssl_path',help="Path to OpenSSL to create signed voucher")
-	parser.add_argument('-signer_cert',help="Path to certificate to use to sign voucher.  Must be PEM encoded.")
+	parser.add_argument('-input', action=ExpandPath, required=True, help="File to parse.")
+	parser.add_argument('-output', action=ExpandPath, required=True, help="File to write to.")
+	parser.add_argument('-openssl_path', action=ExpandPath, help="Path to OpenSSL to create signed voucher")
+	parser.add_argument('-signer_pfx', action=ExpandPath, help="Path to certificate to use to sign voucher.  Must contain full certificate chain.")
+	parser.add_argument('-password_service', help="Name of Keyring/Wallet service/host")
+	parser.add_argument('-password_user', help="Name of Keyring/Wallet user name")
 	parser.add_argument('-verbose', action='store_true', help="Verbose output.")
 	app_args = parser.parse_args()
 
 	# to simplify relocation handling we use a mutable BitStream so we can remove
 	# the BaseAddress from each relocation
 	stream = bitstring.BitStream(filename=app_args.input)
 
 	# find the COFF header.
@@ -380,17 +430,17 @@ def main():
 	arch_digest = ArchitectureDigest()
 	if coff_header.items['Machine'] == 0x14c:
 		arch_digest.setComponentByName('cpuType', CPUType('IMAGE_FILE_MACHINE_I386'))
 	elif coff_header.items['Machine'] == 0x8664:
 		arch_digest.setComponentByName('cpuType', CPUType('IMAGE_FILE_MACHINE_AMD64'))
 
 	arch_digest.setComponentByName('cpuSubType', CPUSubType('IMAGE_UNUSED'))
 
-	text_section_headers = list(filter(lambda x: (x.items['Characteristics'] & 0x20000000) == 0x20000000, coff_header.section_headers))
+	text_section_headers = list(filter(lambda x: (x.items['Characteristics'] & IMAGE_SCN_MEM_EXECUTE) == IMAGE_SCN_MEM_EXECUTE, coff_header.section_headers))
 
 	code_segment_digests = SetOfCodeSegmentDigest()
 	code_segment_idx = 0
 	for code_sect_header in text_section_headers:
 		stream.bytepos = code_sect_header.offset
 		code_sect_bytes = stream.read('bytes:' + str(code_sect_header.items['VirtualSize']))
 
 		digester = hashlib.sha256()
@@ -427,28 +477,43 @@ def main():
 
 	binaryDigest = der_encoder.encode(appDigest)
 
 	with open(app_args.output, 'wb') as f:
 		f.write(binaryDigest)
 
 	# sign with openssl if specified
 	if app_args.openssl_path is not None:
-		assert app_args.signer_cert is not None
-		
+		assert app_args.signer_pfx is not None
+
 		out_base, out_ext = os.path.splitext(app_args.output)
 		signed_path = out_base + ".signed" + out_ext
-		
+
 		# http://stackoverflow.com/questions/12507277/how-to-fix-unable-to-write-random-state-in-openssl
-		temp_file = None
+		temp_files = []
 		if sys.platform == "win32" and "RANDFILE" not in os.environ:
 			temp_file = create_temp_file()
+			temp_files += [temp_file]
 			os.environ["RANDFILE"] = temp_file
-			
+
 		try:
-			subprocess.check_call([app_args.openssl_path, "cms", "-sign", "-nodetach", "-md", "sha256", "-binary", "-in", app_args.output, "-outform", "der", "-out", signed_path, "-signer", app_args.signer_cert], )
+			# create PEM from PFX
+			pfx_pem_path = create_temp_file(".pem")
+			temp_files += [pfx_pem_path]
+			print("Extracting PEM from PFX to:" + pfx_pem_path)
+			openssl_cmd(app_args, ["pkcs12", "-in", app_args.signer_pfx, "-out", pfx_pem_path], True, True)
+
+			# extract CA certs
+			pfx_cert_path = create_temp_file(".cert")
+			temp_files += [pfx_cert_path]
+			print("Extracting cert from PFX to:" + pfx_cert_path)
+			openssl_cmd(app_args, ["pkcs12", "-in", app_args.signer_pfx, "-cacerts", "-nokeys", "-out", pfx_cert_path], True, False)
+
+			# we embed the public keychain for client validation
+			openssl_cmd(app_args, ["cms", "-sign", "-nodetach", "-md", "sha256", "-binary", "-in", app_args.output, "-outform", "der", "-out", signed_path, "-signer", pfx_pem_path, "-certfile", pfx_cert_path], True, False)
 		finally:
-			if temp_file is not None: 
-				del os.environ["RANDFILE"]
-				os.unlink(temp_file)
+			for t in temp_files:
+				if "RANDFILE" in os.environ and t == os.environ["RANDFILE"]:
+					del os.environ["RANDFILE"]
+				os.unlink(t)
 
 if __name__ == '__main__':
 	main()

--- a/security/apps/AppTrustDomain.cpp
+++ b/security/apps/AppTrustDomain.cpp
@@ -229,17 +229,17 @@ AppTrustDomain::DigestBuf(Input item,
                           DigestAlgorithm digestAlg,
                           /*out*/ uint8_t* digestBuf,
                           size_t digestBufLen)
 {
   return DigestBufNSS(item, digestAlg, digestBuf, digestBufLen);
 }
 
 Result
-AppTrustDomain::CheckRevocation(EndEntityOrCA, const CertID&, Time,
+AppTrustDomain::CheckRevocation(EndEntityOrCA, const CertID&, Time, Duration,
                                 /*optional*/ const Input*,
                                 /*optional*/ const Input*)
 {
   // We don't currently do revocation checking. If we need to distrust an Apps
   // certificate, we will use the active distrust mechanism.
   return Success;
 }
 

--- a/security/apps/AppTrustDomain.h
+++ b/security/apps/AppTrustDomain.h
@@ -29,16 +29,17 @@ public:
                               /*out*/ mozilla::pkix::TrustLevel& trustLevel)
                               override;
   virtual Result FindIssuer(mozilla::pkix::Input encodedIssuerName,
                             IssuerChecker& checker,
                             mozilla::pkix::Time time) override;
   virtual Result CheckRevocation(mozilla::pkix::EndEntityOrCA endEntityOrCA,
                                  const mozilla::pkix::CertID& certID,
                                  mozilla::pkix::Time time,
+                                 mozilla::pkix::Duration validityDuration,
                     /*optional*/ const mozilla::pkix::Input* stapledOCSPresponse,
                     /*optional*/ const mozilla::pkix::Input* aiaExtension) override;
   virtual Result IsChainValid(const mozilla::pkix::DERArray& certChain,
                               mozilla::pkix::Time time) override;
   virtual Result CheckSignatureDigestAlgorithm(
                    mozilla::pkix::DigestAlgorithm digestAlg) override;
   virtual Result CheckRSAPublicKeyModulusSizeInBits(
                    mozilla::pkix::EndEntityOrCA endEntityOrCA,