--- a/accessible/build/Makefile.in
+++ b/accessible/build/Makefile.in
@@ -27,14 +27,18 @@ SHARED_LIBRARY_LIBS = \
   ../src/base/$(LIB_PREFIX)accessibility_base_s.$(LIB_SUFFIX) \
   ../src/generic/$(LIB_PREFIX)accessibility_generic_s.$(LIB_SUFFIX) \
   ../src/html/$(LIB_PREFIX)accessibility_html_s.$(LIB_SUFFIX) \
   ../src/xpcom/$(LIB_PREFIX)accessibility_xpcom_s.$(LIB_SUFFIX) \
   ../src/$(LIB_PREFIX)accessibility_toolkit_s.$(LIB_SUFFIX) \
   ../src/xforms/$(LIB_PREFIX)accessibility_xforms_s.$(LIB_SUFFIX) \
   $(NULL)
 
+ifeq ($(MOZ_WIDGET_TOOLKIT),windows)
+SHARED_LIBRARY_LIBS += ../src/windows/uia/$(LIB_PREFIX)accessibility_toolkit_uia_s.$(LIB_SUFFIX)
+endif
+
 ifdef MOZ_XUL
 SHARED_LIBRARY_LIBS += ../src/xul/$(LIB_PREFIX)accessibility_xul_s.$(LIB_SUFFIX)
 endif
 
 include $(topsrcdir)/config/rules.mk
 

--- a/accessible/public/nsIAccessibleProvider.idl
+++ b/accessible/public/nsIAccessibleProvider.idl
@@ -57,18 +57,18 @@ interface nsIAccessibleProvider : nsISup
   const long XULStatusBar = 0x00001014;
   const long XULRadioButton = 0x00001015;
   const long XULRadioGroup = 0x00001016;
 
   /** Used for XUL tab element */
   const long XULTab = 0x00001017;
   /** Used for XUL tabs element, a container for tab elements */
   const long XULTabs = 0x00001018;
-  /** Used for XUL tabpanels container element */
-  const long XULTabpanels = 0x00001019;
+  /** Used for XUL deck frame */
+  const long XULDeck = 0x00001019;
 
   const long XULText             = 0x0000101A;
   const long XULTextBox          = 0x0000101B;
   const long XULThumb            = 0x0000101C;
   const long XULTree             = 0x0000101D;
   const long XULTreeColumns      = 0x0000101E;
   const long XULTreeColumnItem   = 0x0000101F;
   const long XULToolbar          = 0x00001020;

--- a/accessible/src/Makefile.in
+++ b/accessible/src/Makefile.in
@@ -9,17 +9,20 @@ srcdir = @srcdir@
 VPATH = @srcdir@
 
 include $(DEPTH)/config/autoconf.mk
 
 ifeq ($(MOZ_WIDGET_TOOLKIT),gtk2)
 PLATFORM_DIR = atk
 else
 ifeq ($(MOZ_WIDGET_TOOLKIT),windows)
-PLATFORM_DIR = msaa
+PLATFORM_DIR = \
+  msaa \
+  windows \
+  $(null)
 else
 ifeq ($(MOZ_WIDGET_TOOLKIT),cocoa)
 PLATFORM_DIR += mac
 else
 PLATFORM_DIR += other
 endif
 endif
 endif

--- a/accessible/src/base/nsAccessibilityService.cpp
+++ b/accessible/src/base/nsAccessibilityService.cpp
@@ -1148,21 +1148,24 @@ nsAccessibilityService::GetOrCreateAcces
 
   if (!newAcc) {
     // Elements may implement nsIAccessibleProvider via XBL. This allows them to
     // say what kind of accessible to create.
     newAcc = CreateAccessibleByType(content, docAcc);
   }
 
   if (!newAcc) {
-    // Create generic accessibles for SVG and MathML nodes.
-    if (content->IsSVG(nsGkAtoms::svg)) {
+    // xul:deck does not have XBL and nsIFrame::CreateAccessible() is only called 
+    // on HTML elements
+    nsIAtom* tag = content->Tag();
+    if ((tag == nsGkAtoms::deck) || (tag == nsGkAtoms::tabpanels)) {
+      newAcc = new XULDeckAccessible(content, docAcc);
+    } else if (content->IsSVG(nsGkAtoms::svg)) {
       newAcc = new EnumRoleAccessible(content, docAcc, roles::DIAGRAM);
-    }
-    else if (content->IsMathML(nsGkAtoms::math)) {
+    } else if (content->IsMathML(nsGkAtoms::math)) {
       newAcc = new EnumRoleAccessible(content, docAcc, roles::EQUATION);
     }
   }
 
   if (!newAcc) {
     newAcc = CreateAccessibleForDeckChild(weakFrame.GetFrame(), content,
                                           docAcc);
   }
@@ -1321,16 +1324,20 @@ nsAccessibilityService::CreateAccessible
     case nsIAccessibleProvider::XULColorPickerTile:
       accessible = new XULColorPickerTileAccessible(aContent, aDoc);
       break;
 
     case nsIAccessibleProvider::XULCombobox:
       accessible = new XULComboboxAccessible(aContent, aDoc);
       break;
 
+    case nsIAccessibleProvider::XULDeck:
+      accessible = new XULDeckAccessible(aContent, aDoc);
+      break;
+
     case nsIAccessibleProvider::XULDropmarker:
       accessible = new XULDropmarkerAccessible(aContent, aDoc);
       break;
 
     case nsIAccessibleProvider::XULGroupbox:
       accessible = new XULGroupboxAccessible(aContent, aDoc);
       break;
 
@@ -1425,20 +1432,16 @@ nsAccessibilityService::CreateAccessible
     case nsIAccessibleProvider::XULTab:
       accessible = new XULTabAccessible(aContent, aDoc);
       break;
 
     case nsIAccessibleProvider::XULTabs:
       accessible = new XULTabsAccessible(aContent, aDoc);
       break;
 
-    case nsIAccessibleProvider::XULTabpanels:
-      accessible = new XULTabpanelsAccessible(aContent, aDoc);
-      break;
-
     case nsIAccessibleProvider::XULText:
       accessible = new XULLabelAccessible(aContent, aDoc);
       break;
 
     case nsIAccessibleProvider::XULTextBox:
       accessible = new XULTextFieldAccessible(aContent, aDoc);
       break;
 

--- a/accessible/src/generic/Accessible.h
+++ b/accessible/src/generic/Accessible.h
@@ -503,16 +503,18 @@ public:
   mozilla::a11y::ImageAccessible* AsImage();
 
   bool IsImageMapAccessible() const { return mFlags & eImageMapAccessible; }
   mozilla::a11y::HTMLImageMapAccessible* AsImageMap();
 
   inline bool IsXULTree() const { return mFlags & eXULTreeAccessible; }
   mozilla::a11y::XULTreeAccessible* AsXULTree();
 
+  inline bool IsXULDeck() const { return mFlags & eXULDeckAccessible; }
+
   inline bool IsListControl() const { return mFlags & eListControlAccessible; }
 
   inline bool IsMenuButton() const { return mFlags & eMenuButtonAccessible; }
 
   inline bool IsMenuPopup() const { return mFlags & eMenuPopupAccessible; }
 
   inline bool IsRoot() const { return mFlags & eRootAccessible; }
   mozilla::a11y::RootAccessible* AsRoot();
@@ -761,17 +763,18 @@ protected:
     eHTMLListItemAccessible = 1 << 11,
     eImageAccessible = 1 << 12,
     eImageMapAccessible = 1 << 13,
     eListControlAccessible = 1 << 14,
     eMenuButtonAccessible = 1 << 15,
     eMenuPopupAccessible = 1 << 16,
     eRootAccessible = 1 << 17,
     eTextLeafAccessible = 1 << 18,
-    eXULTreeAccessible = 1 << 19
+    eXULDeckAccessible = 1 << 19,
+    eXULTreeAccessible = 1 << 20
   };
 
   //////////////////////////////////////////////////////////////////////////////
   // Miscellaneous helpers
 
   /**
    * Return ARIA role (helper method).
    */

--- a/accessible/src/mac/AccessibleWrap.mm
+++ b/accessible/src/mac/AccessibleWrap.mm
@@ -54,16 +54,19 @@ AccessibleWrap::GetNativeInterface (void
 
 // overridden in subclasses to create the right kind of object. by default we create a generic
 // 'mozAccessible' node.
 Class
 AccessibleWrap::GetNativeType () 
 {
   NS_OBJC_BEGIN_TRY_ABORT_BLOCK_NIL;
 
+  if (IsXULDeck())
+    return [mozPaneAccessible class];
+  
   roles::Role role = Role();
   switch (role) {
     case roles::PUSHBUTTON:
     case roles::SPLITBUTTON:
     case roles::TOGGLE_BUTTON:
     {
       // if this button may show a popup, let's make it of the popupbutton type.
       return HasPopup() ? [mozPopupButtonAccessible class] : 
@@ -76,25 +79,27 @@ AccessibleWrap::GetNativeType ()
     case roles::CHECKBUTTON:
       return [mozCheckboxAccessible class];
       
     case roles::HEADING:
       return [mozHeadingAccessible class];
 
     case roles::PAGETABLIST:
       return [mozTabsAccessible class];
-      
+
     case roles::ENTRY:
     case roles::STATICTEXT:
     case roles::CAPTION:
     case roles::ACCEL_LABEL:
-    case roles::TEXT_LEAF:
     case roles::PASSWORD_TEXT:
       // normal textfield (static or editable)
-      return [mozTextAccessible class]; 
+      return [mozTextAccessible class];
+
+    case roles::TEXT_LEAF:
+      return [mozTextLeafAccessible class];
 
     case roles::LINK:
       return [mozLinkAccessible class];
 
     case roles::COMBOBOX:
       return [mozPopupButtonAccessible class];
       
     default:

--- a/accessible/src/mac/Makefile.in
+++ b/accessible/src/mac/Makefile.in
@@ -9,18 +9,16 @@ VPATH = @srcdir@
 
 include $(DEPTH)/config/autoconf.mk
 
 MODULE = accessibility
 LIBRARY_NAME = accessibility_toolkit_s
 EXPORT_LIBRARY = ..
 LIBXUL_LIBRARY = 1
 
-  
-  
 CMMSRCS = \
           AccessibleWrap.mm \
           ApplicationAccessibleWrap.mm \
           DocAccessibleWrap.mm \
           nsAccessNodeWrap.mm \
           mozAccessible.mm \
           mozDocAccessible.mm \
           mozActionElements.mm \
@@ -43,10 +41,12 @@ include $(topsrcdir)/config/rules.mk
 LOCAL_INCLUDES += \
   -I$(srcdir) \
   -I$(srcdir)/../base \
   -I$(srcdir)/../generic \
   -I$(srcdir)/../html \
   -I$(srcdir)/../xul \
   -I$(topsrcdir)/widget/cocoa \
   -I$(topsrcdir)/widget/xpwidgets \
+  -I$(topsrcdir)/layout/xul/base/src \
+  -I$(topsrcdir)/layout/generic \
   $(NULL)
 

--- a/accessible/src/mac/mozAccessible.h
+++ b/accessible/src/mac/mozAccessible.h
@@ -18,41 +18,41 @@
  * to give it the represented view, in the latter case.
  */
 inline id <mozAccessible>
 GetObjectOrRepresentedView(id <mozAccessible> aObject)
 {
   return [aObject hasRepresentedView] ? [aObject representedView] : aObject;
 }
 
+inline mozAccessible*
+GetNativeFromGeckoAccessible(nsIAccessible* aAccessible)
+{
+  mozAccessible* native = nil;
+  aAccessible->GetNativeInterface((void**)&native);
+  return native;
+}
+
 @interface mozAccessible : NSObject <mozAccessible>
 {
   /**
    * Weak reference; it owns us.
    */
   AccessibleWrap* mGeckoAccessible;
   
   /**
    * Strong ref to array of children
    */
   NSMutableArray* mChildren;
   
   /** 
    * Weak reference to the parent
    */
   mozAccessible* mParent;
-  
-  /**
-   * We can be marked as 'expired' if Shutdown() is called on our geckoAccessible.
-   * since we might still be retained by some third-party, we need to do cleanup
-   * in |expire|, and prevent any potential harm that could come from someone using us
-   * after this point.
-   */
-  BOOL mIsExpired;
-  
+
   /**
    * The nsIAccessible role of our gecko accessible.
    */
   mozilla::a11y::role        mRole;
 }
 
 // inits with the gecko owner.
 - (id)initWithAccessible:(AccessibleWrap*)geckoParent;

--- a/accessible/src/mac/mozAccessible.mm
+++ b/accessible/src/mac/mozAccessible.mm
@@ -4,28 +4,30 @@
  * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
  
 #import "mozAccessible.h"
 
 #import "MacUtils.h"
 #import "mozView.h"
 
 #include "Accessible-inl.h"
+#include "nsAccUtils.h"
 #include "nsIAccessibleRelation.h"
 #include "nsIAccessibleText.h"
 #include "nsIAccessibleEditableText.h"
 #include "Relation.h"
 #include "Role.h"
 #include "RootAccessible.h"
 
 #include "mozilla/Services.h"
 #include "nsRect.h"
 #include "nsCocoaUtils.h"
 #include "nsCoord.h"
 #include "nsObjCExceptions.h"
+#include "nsWhitespaceTokenizer.h"
 
 using namespace mozilla;
 using namespace mozilla::a11y;
 
 // converts a screen-global point in the cocoa coordinate system (with origo in the bottom-left corner
 // of the screen), into a top-left screen point, that gecko can use.
 static inline void
 ConvertCocoaToGeckoPoint(NSPoint &aInPoint, nsPoint &aOutPoint)
@@ -58,39 +60,26 @@ GetClosestInterestingAccessible(id anObj
   if ([unignoredObject respondsToSelector:@selector(hasRepresentedView)])
     return GetObjectOrRepresentedView(unignoredObject);
   
   return unignoredObject;
 
   NS_OBJC_END_TRY_ABORT_BLOCK_NIL;
 }
 
-static inline mozAccessible* 
-GetNativeFromGeckoAccessible(nsIAccessible *anAccessible)
-{
-  NS_OBJC_BEGIN_TRY_ABORT_BLOCK_NSNULL;
-
-  mozAccessible *native = nil;
-  anAccessible->GetNativeInterface ((void**)&native);
-  return native;
-
-  NS_OBJC_END_TRY_ABORT_BLOCK_NSNULL;
-}
-
 #pragma mark -
 
 @implementation mozAccessible
  
 - (id)initWithAccessible:(AccessibleWrap*)geckoAccessible
 {
   NS_OBJC_BEGIN_TRY_ABORT_BLOCK_NIL;
 
   if ((self = [super init])) {
     mGeckoAccessible = geckoAccessible;
-    mIsExpired = NO;
     mRole = geckoAccessible->Role();
   }
    
   return self;
 
   NS_OBJC_END_TRY_ABORT_BLOCK_NIL;
 }
 
@@ -107,27 +96,27 @@ GetNativeFromGeckoAccessible(nsIAccessib
 #pragma mark -
 
 - (BOOL)accessibilityIsIgnored
 {
   NS_OBJC_BEGIN_TRY_ABORT_BLOCK_RETURN;
 
   // unknown (either unimplemented, or irrelevant) elements are marked as ignored
   // as well as expired elements.
-  return mIsExpired || [[self role] isEqualToString:NSAccessibilityUnknownRole];
+  return !mGeckoAccessible || [[self role] isEqualToString:NSAccessibilityUnknownRole];
 
   NS_OBJC_END_TRY_ABORT_BLOCK_RETURN(NO);
 }
 
 - (NSArray*)accessibilityAttributeNames
 {
   NS_OBJC_BEGIN_TRY_ABORT_BLOCK_NIL;
 
   // if we're expired, we don't support any attributes.
-  if (mIsExpired)
+  if (!mGeckoAccessible)
     return [NSArray array];
   
   static NSArray *generalAttributes = nil;
   
   if (!generalAttributes) {
     // standard attributes that are shared and supported by all generic elements.
     generalAttributes = [[NSArray alloc] initWithObjects:  NSAccessibilityChildrenAttribute, 
                                                            NSAccessibilityParentAttribute,
@@ -155,17 +144,17 @@ GetNativeFromGeckoAccessible(nsIAccessib
 
   NS_OBJC_END_TRY_ABORT_BLOCK_NIL;
 }
 
 - (id)accessibilityAttributeValue:(NSString*)attribute
 {  
   NS_OBJC_BEGIN_TRY_ABORT_BLOCK_NIL;
 
-  if (mIsExpired)
+  if (!mGeckoAccessible)
     return nil;
 
 #if DEBUG
   if ([attribute isEqualToString:@"AXMozDescription"])
     return [NSString stringWithFormat:@"role = %u native = %@", mRole, [self class]];
 #endif
   
   if ([attribute isEqualToString:NSAccessibilityChildrenAttribute])
@@ -241,17 +230,17 @@ GetNativeFromGeckoAccessible(nsIAccessib
   if ([attribute isEqualToString:NSAccessibilityFocusedAttribute] && [value boolValue])
     [self focus];
 
   NS_OBJC_END_TRY_ABORT_BLOCK;
 }
 
 - (id)accessibilityHitTest:(NSPoint)point
 {
-  if (mIsExpired)
+  if (!mGeckoAccessible)
     return nil;
 
   // Convert from cocoa's coordinate system to gecko's. According to the docs
   // the point we're given is guaranteed to be bottom-left screen coordinates.
   nsPoint geckoPoint;
   ConvertCocoaToGeckoPoint (point, geckoPoint);
 
   nsCOMPtr<nsIAccessible> deepestFoundChild;
@@ -283,17 +272,17 @@ GetNativeFromGeckoAccessible(nsIAccessib
 }
 
 - (void)accessibilityPerformAction:(NSString*)action 
 {
 }
 
 - (id)accessibilityFocusedUIElement
 {
-  if (mIsExpired)
+  if (!mGeckoAccessible)
     return nil;
   
   Accessible* focusedGeckoChild = mGeckoAccessible->FocusedChild();
   if (focusedGeckoChild) {
     mozAccessible *focusedChild = GetNativeFromGeckoAccessible(focusedGeckoChild);
     if (focusedChild)
       return GetClosestInterestingAccessible(focusedChild);
   }
@@ -415,17 +404,17 @@ GetNativeFromGeckoAccessible(nsIAccessib
   mGeckoAccessible->GetBounds (&x, &y, &width, &height);  
   return [NSValue valueWithSize:NSMakeSize (width, height)];
 
   NS_OBJC_END_TRY_ABORT_BLOCK_NIL;
 }
 
 - (NSString*)role
 {
-  if (mIsExpired)
+  if (!mGeckoAccessible)
     return nil;
 
 #ifdef DEBUG
   NS_ASSERTION(nsAccUtils::IsTextInterfaceSupportCorrect(mGeckoAccessible),
                "Does not support nsIAccessibleText when it should");
 #endif
 
 #define ROLE(geckoRole, stringRole, atkRole, macRole, msaaRole, ia2Role) \
@@ -439,16 +428,52 @@ GetNativeFromGeckoAccessible(nsIAccessib
       return NSAccessibilityUnknownRole;
   }
 
 #undef ROLE
 }
 
 - (NSString*)subrole
 {
+  if (!mGeckoAccessible)
+    return nil;
+
+  // XXX maybe we should cache the subrole.
+  nsAutoString xmlRoles;
+  nsCOMPtr<nsIPersistentProperties> attributes;
+
+  // XXX we don't need all the attributes (see bug 771113)
+  nsresult rv = mGeckoAccessible->GetAttributes(getter_AddRefs(attributes));
+  if (NS_SUCCEEDED(rv) && attributes)
+    nsAccUtils::GetAccAttr(attributes, nsGkAtoms::xmlroles, xmlRoles);
+
+  nsWhitespaceTokenizer tokenizer(xmlRoles);
+
+  while (tokenizer.hasMoreTokens()) {
+    const nsDependentSubstring token(tokenizer.nextToken());
+
+    if (token.EqualsLiteral("banner"))
+      return @"AXLandmarkBanner";
+
+    if (token.EqualsLiteral("complementary"))
+      return @"AXLandmarkComplementary";
+
+    if (token.EqualsLiteral("contentinfo"))
+      return @"AXLandmarkContentInfo";
+
+    if (token.EqualsLiteral("main"))
+      return @"AXLandmarkMain";
+
+    if (token.EqualsLiteral("navigation"))
+      return @"AXLandmarkNavigation";
+
+    if (token.EqualsLiteral("search"))
+      return @"AXLandmarkSearch";
+  }
+
   switch (mRole) {
     case roles::LIST:
       return @"AXContentList"; // 10.6+ NSAccessibilityContentListSubrole;
 
     case roles::DEFINITION_LIST:
       return @"AXDefinitionList"; // 10.6+ NSAccessibilityDefinitionListSubrole;
 
     case roles::TERM:
@@ -463,34 +488,52 @@ GetNativeFromGeckoAccessible(nsIAccessib
 
   return nil;
 }
 
 - (NSString*)roleDescription
 {
   if (mRole == roles::DOCUMENT)
     return utils::LocalizedString(NS_LITERAL_STRING("htmlContent"));
-  
+
   NSString* subrole = [self subrole];
-  
+
   if ((mRole == roles::LISTITEM) && [subrole isEqualToString:@"AXTerm"])
     return utils::LocalizedString(NS_LITERAL_STRING("term"));
   if ((mRole == roles::PARAGRAPH) && [subrole isEqualToString:@"AXDefinition"])
     return utils::LocalizedString(NS_LITERAL_STRING("definition"));
-  
-  return NSAccessibilityRoleDescription([self role], subrole);
+
+  NSString* role = [self role];
+
+  // the WAI-ARIA Landmarks
+  if ([role isEqualToString:NSAccessibilityGroupRole]) {
+    if ([subrole isEqualToString:@"AXLandmarkBanner"])
+      return utils::LocalizedString(NS_LITERAL_STRING("banner"));
+    if ([subrole isEqualToString:@"AXLandmarkComplementary"])
+      return utils::LocalizedString(NS_LITERAL_STRING("complementary"));
+    if ([subrole isEqualToString:@"AXLandmarkContentInfo"])
+      return utils::LocalizedString(NS_LITERAL_STRING("content"));
+    if ([subrole isEqualToString:@"AXLandmarkMain"])
+      return utils::LocalizedString(NS_LITERAL_STRING("main"));
+    if ([subrole isEqualToString:@"AXLandmarkNavigation"])
+      return utils::LocalizedString(NS_LITERAL_STRING("navigation"));
+    if ([subrole isEqualToString:@"AXLandmarkSearch"])
+      return utils::LocalizedString(NS_LITERAL_STRING("search"));
+  }
+
+  return NSAccessibilityRoleDescription(role, subrole);
 }
 
 - (NSString*)title
 {
   NS_OBJC_BEGIN_TRY_ABORT_BLOCK_NIL;
 
   nsAutoString title;
   mGeckoAccessible->Name(title);
-  return title.IsEmpty() ? nil : [NSString stringWithCharacters:title.BeginReading() length:title.Length()];
+  return nsCocoaUtils::ToNSString(title);
 
   NS_OBJC_END_TRY_ABORT_BLOCK_NIL;
 }
 
 - (id)value
 {
   NS_OBJC_BEGIN_TRY_ABORT_BLOCK_NIL;
 
@@ -523,17 +566,18 @@ GetNativeFromGeckoAccessible(nsIAccessib
 {
   NS_OBJC_BEGIN_TRY_ABORT_BLOCK_NIL;
 
   if (mGeckoAccessible->IsDefunct())
     return nil;
 
   nsAutoString desc;
   mGeckoAccessible->Description(desc);
-  return desc.IsEmpty() ? nil : [NSString stringWithCharacters:desc.BeginReading() length:desc.Length()];
+
+  return nsCocoaUtils::ToNSString(desc);
 
   NS_OBJC_END_TRY_ABORT_BLOCK_NIL;
 }
 
 - (NSString*)help
 {
   NS_OBJC_BEGIN_TRY_ABORT_BLOCK_NIL;
 
@@ -556,28 +600,31 @@ GetNativeFromGeckoAccessible(nsIAccessib
 
 - (BOOL)isFocused
 {
   return FocusMgr()->IsFocused(mGeckoAccessible);
 }
 
 - (BOOL)canBeFocused
 {
-  return mGeckoAccessible->InteractiveState() & states::FOCUSABLE;
+  return mGeckoAccessible && (mGeckoAccessible->InteractiveState() & states::FOCUSABLE);
 }
 
 - (BOOL)focus
 {
+  if (!mGeckoAccessible)
+    return NO;
+  
   nsresult rv = mGeckoAccessible->TakeFocus();
   return NS_SUCCEEDED(rv);
 }
 
 - (BOOL)isEnabled
 {
-  return (mGeckoAccessible->InteractiveState() & states::UNAVAILABLE) == 0;
+  return mGeckoAccessible && ((mGeckoAccessible->InteractiveState() & states::UNAVAILABLE) == 0);
 }
 
 // The root accessible calls this when the focused node was
 // changed to us.
 - (void)didReceiveFocus
 {
   NS_OBJC_BEGIN_TRY_ABORT_BLOCK;
 
@@ -632,25 +679,24 @@ GetNativeFromGeckoAccessible(nsIAccessib
 }
 
 - (void)expire
 {
   NS_OBJC_BEGIN_TRY_ABORT_BLOCK;
 
   [self invalidateChildren];
 
-  mIsExpired = YES;
   mGeckoAccessible = nsnull;
   
   NS_OBJC_END_TRY_ABORT_BLOCK;
 }
 
 - (BOOL)isExpired
 {
-  return mIsExpired;
+  return !mGeckoAccessible;
 }
 
 #pragma mark -
 #pragma mark Debug methods
 #pragma mark -
 
 #ifdef DEBUG
 

--- a/accessible/src/mac/mozActionElements.h
+++ b/accessible/src/mac/mozActionElements.h
@@ -24,8 +24,15 @@
 
 /* Class for tabs - not individual tabs */
 @interface mozTabsAccessible : mozAccessible
 {
   NSMutableArray* mTabs;
 }
 -(id)tabs;
 @end
+
+/**
+ * Accessible for a PANE
+ */
+@interface mozPaneAccessible : mozAccessible
+
+@end

--- a/accessible/src/mac/mozActionElements.mm
+++ b/accessible/src/mac/mozActionElements.mm
@@ -2,18 +2,20 @@
 /* This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
 
 #import "mozActionElements.h"
 
 #import "MacUtils.h"
 #include "Accessible-inl.h"
+#include "DocAccessible.h"
 #include "XULTabAccessible.h"
 
+#include "nsDeckFrame.h"
 #include "nsObjCExceptions.h"
 
 using namespace mozilla::a11y;
 
 enum CheckboxValue {
   // these constants correspond to the values in the OS
   kUnchecked = 0,
   kChecked = 1,
@@ -66,17 +68,17 @@ enum CheckboxValue {
   
   return [super accessibilityAttributeValue:attribute];
 
   NS_OBJC_END_TRY_ABORT_BLOCK_NIL;
 }
 
 - (BOOL)accessibilityIsIgnored
 {
-  return mIsExpired;
+  return !mGeckoAccessible;
 }
 
 - (NSArray*)accessibilityActionNames
 {
   NS_OBJC_BEGIN_TRY_ABORT_BLOCK_NIL;
 
   if ([self isEnabled])
     return [NSArray arrayWithObject:NSAccessibilityPressAction];
@@ -328,8 +330,35 @@ enum CheckboxValue {
 {
   [super invalidateChildren];
 
   [mTabs release];
   mTabs = nil;
 }
 
 @end
+
+@implementation mozPaneAccessible
+
+- (NSArray*)children
+{
+  if (!mGeckoAccessible)
+    return nil;
+
+  nsDeckFrame* deckFrame = do_QueryFrame(mGeckoAccessible->GetFrame());
+  nsIFrame* selectedFrame = deckFrame ? deckFrame->GetSelectedBox() : nsnull;
+
+  Accessible* selectedAcc = nsnull;
+  if (selectedFrame) {
+    nsINode* node = selectedFrame->GetContent();
+    selectedAcc = mGeckoAccessible->Document()->GetAccessible(node);
+  }
+
+  if (selectedAcc) {
+    mozAccessible *curNative = GetNativeFromGeckoAccessible(selectedAcc);
+    if (curNative)
+      return [NSArray arrayWithObjects:GetObjectOrRepresentedView(curNative), nil];
+  }
+
+  return nil;
+}
+
+@end

--- a/accessible/src/mac/mozDocAccessible.mm
+++ b/accessible/src/mac/mozDocAccessible.mm
@@ -26,17 +26,17 @@ getNativeViewFromRootAccessible(Accessib
 
 @implementation mozRootAccessible
 
 - (NSArray*)accessibilityAttributeNames
 {
   NS_OBJC_BEGIN_TRY_ABORT_BLOCK_NIL;
   
   // if we're expired, we don't support any attributes.
-  if (mIsExpired)
+  if (!mGeckoAccessible)
     return [NSArray array];
   
   // standard attributes that are shared and supported by root accessible (AXMain) elements.
   static NSMutableArray* attributes = nil;
   
   if (!attributes) {
     attributes = [[super accessibilityAttributeNames] mutableCopy];
     [attributes addObject:NSAccessibilityMainAttribute];

--- a/accessible/src/mac/mozHTMLAccessible.mm
+++ b/accessible/src/mac/mozHTMLAccessible.mm
@@ -8,16 +8,27 @@
 #import "mozHTMLAccessible.h"
 
 #import "HyperTextAccessible.h"
 
 #import "nsCocoaUtils.h"
 
 @implementation mozHeadingAccessible
 
+- (NSString*)title
+{
+  nsAutoString title;
+  // XXX use the flattening API when there are available
+  // see bug 768298
+  nsresult rv = mGeckoAccessible->GetContent()->GetTextContent(title);
+  NS_ENSURE_SUCCESS(rv, nil);
+
+  return nsCocoaUtils::ToNSString(title);
+}
+
 - (id)value
 {
   if (!mGeckoAccessible || !mGeckoAccessible->IsHyperText())
     return nil;
 
   PRUint32 level = mGeckoAccessible->AsHyperText()->GetLevelInternal();
   return [NSNumber numberWithInt:level];
 }
@@ -28,17 +39,17 @@
 -(NSURL*)url;
 @end
 
 @implementation mozLinkAccessible
 
 - (NSArray*)accessibilityAttributeNames
 {
   // if we're expired, we don't support any attributes.
-  if (mIsExpired)
+  if (!mGeckoAccessible)
     return [NSArray array];
   
   static NSMutableArray* attributes = nil;
   
   if (!attributes) {
     attributes = [[super accessibilityAttributeNames] mutableCopy];
     [attributes addObject:NSAccessibilityURLAttribute];
   }
@@ -52,17 +63,17 @@
     return [self url];
 
   return [super accessibilityAttributeValue:attribute];
 }
 
 - (NSArray*)accessibilityActionNames 
 {
     // if we're expired, we don't support any attributes.
-  if (mIsExpired)
+  if (!mGeckoAccessible)
     return [NSArray array];
 
   static NSArray* actionNames = nil;
 
   if (!actionNames) {
     actionNames = [[NSArray alloc] initWithObjects:NSAccessibilityPressAction,
                                    nil];
   }

--- a/accessible/src/mac/mozTextAccessible.h
+++ b/accessible/src/mac/mozTextAccessible.h
@@ -9,8 +9,13 @@
 @interface mozTextAccessible : mozAccessible
 {
   // both of these are the same old mGeckoAccessible, but already
   // QI'd for us, to the right type, for convenience.
   HyperTextAccessible *mGeckoTextAccessible; // strong
   nsIAccessibleEditableText *mGeckoEditableTextAccessible; // strong
 }
 @end
+
+@interface mozTextLeafAccessible : mozAccessible
+{
+}
+@end

--- a/accessible/src/mac/mozTextAccessible.mm
+++ b/accessible/src/mac/mozTextAccessible.mm
@@ -1,15 +1,16 @@
 /* -*- Mode: Objective-C++; tab-width: 2; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
 /* This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
 
 
 #include "AccessibleWrap.h"
+#include "TextLeafAccessible.h"
 
 #include "nsCocoaUtils.h"
 #include "nsObjCExceptions.h"
 
 #import "mozTextAccessible.h"
 
 using namespace mozilla::a11y;
 
@@ -62,17 +63,17 @@ ToNSString(id aValue)
   }
   return self;
 
   NS_OBJC_END_TRY_ABORT_BLOCK_NIL;
 }
 
 - (BOOL)accessibilityIsIgnored
 {
-  return mIsExpired;
+  return !mGeckoAccessible;
 }
 
 - (NSArray*)accessibilityAttributeNames
 {
   NS_OBJC_BEGIN_TRY_ABORT_BLOCK_NIL;
 
   static NSMutableArray* supportedAttributes = nil;
   if (!supportedAttributes) {
@@ -105,23 +106,28 @@ ToNSString(id aValue)
     return [self caretLineNumber];
 
   if ([attribute isEqualToString:NSAccessibilitySelectedTextRangeAttribute])
     return [self selectedTextRange];
 
   if ([attribute isEqualToString:NSAccessibilitySelectedTextAttribute])
     return [self selectedText];
 
+  if ([attribute isEqualToString:NSAccessibilityTitleAttribute])
+    return @"";
+
   if ([attribute isEqualToString:NSAccessibilityValueAttribute]) {
     // Apple's SpeechSynthesisServer expects AXValue to return an AXStaticText
     // object's AXSelectedText attribute. See bug 674612 for details.
     // Also if there is no selected text, we return the full text. 
     // See bug 369710 for details.
-    if ([[self role] isEqualToString:NSAccessibilityStaticTextRole])
-      return [self selectedText] ? : [self text];
+    if ([[self role] isEqualToString:NSAccessibilityStaticTextRole]) {
+      NSString* selectedText = [self selectedText];
+      return (selectedText && [selectedText length]) ? selectedText : [self text];
+    }
 
     return [self text];
   }
 
   if ([attribute isEqualToString:@"AXRequired"])
     return [NSNumber numberWithBool:!!(mGeckoAccessible->State() & states::REQUIRED)];
 
   if ([attribute isEqualToString:@"AXInvalid"])
@@ -221,17 +227,17 @@ ToNSString(id aValue)
   return nil;
 }
 
 - (BOOL)accessibilityIsAttributeSettable:(NSString*)attribute
 {
   NS_OBJC_BEGIN_TRY_ABORT_BLOCK_RETURN;
 
   if ([attribute isEqualToString:NSAccessibilityValueAttribute])
-    return [self isReadOnly];
+    return ![self isReadOnly];
   
   if ([attribute isEqualToString:NSAccessibilitySelectedTextAttribute] ||
       [attribute isEqualToString:NSAccessibilitySelectedTextRangeAttribute] ||
       [attribute isEqualToString:NSAccessibilityVisibleCharacterRangeAttribute])
     return YES;
 
   return [super accessibilityIsAttributeSettable:attribute];
 
@@ -354,17 +360,17 @@ ToNSString(id aValue)
     mGeckoEditableTextAccessible->SetTextContents(text);
   }
 
   NS_OBJC_END_TRY_ABORT_BLOCK;
 }
 
 - (NSString*)text
 {
-  if (!mGeckoTextAccessible)
+  if (!mGeckoAccessible || !mGeckoTextAccessible)
     return nil;
 
   // A password text field returns an empty value
   if (mRole == roles::PASSWORD_TEXT)
     return @"";
 
   nsAutoString text;
   nsresult rv = mGeckoTextAccessible->
@@ -373,16 +379,19 @@ ToNSString(id aValue)
 
   return nsCocoaUtils::ToNSString(text);
 }
 
 - (long)textLength
 {
   NS_OBJC_BEGIN_TRY_ABORT_BLOCK_RETURN;
 
+  if (!mGeckoAccessible || !mGeckoTextAccessible)
+    return 0;
+
   return mGeckoTextAccessible ? mGeckoTextAccessible->CharacterCount() : 0;
 
   NS_OBJC_END_TRY_ABORT_BLOCK_RETURN(0);
 }
 
 - (long)selectedTextLength
 {
   NS_OBJC_BEGIN_TRY_ABORT_BLOCK_RETURN;
@@ -479,8 +488,50 @@ ToNSString(id aValue)
 
   nsAutoString text;
   mGeckoTextAccessible->GetText(range->location, 
                                 range->location + range->length, text);
   return nsCocoaUtils::ToNSString(text);
 }
 
 @end
+
+@implementation mozTextLeafAccessible
+
+- (NSArray*)accessibilityAttributeNames
+{
+  static NSMutableArray* supportedAttributes = nil;
+  if (!supportedAttributes) {
+    supportedAttributes = [[super accessibilityAttributeNames] mutableCopy];
+    [supportedAttributes removeObject:NSAccessibilityChildrenAttribute];
+  }
+
+  return supportedAttributes;
+}
+
+- (id)accessibilityAttributeValue:(NSString*)attribute
+{
+  if ([attribute isEqualToString:NSAccessibilityTitleAttribute])
+    return @"";
+
+  if ([attribute isEqualToString:NSAccessibilityValueAttribute])
+    return [self text];
+
+  return [super accessibilityAttributeValue:attribute];
+}
+
+- (NSString*)text
+{
+  if (!mGeckoAccessible)
+    return nil;
+
+  return nsCocoaUtils::ToNSString(mGeckoAccessible->AsTextLeaf()->Text());
+}
+
+- (long)textLength
+{
+  if (!mGeckoAccessible)
+    return 0;
+
+  return mGeckoAccessible->AsTextLeaf()->Text().Length();
+}
+
+@end

--- a/accessible/src/msaa/AccessibleWrap.cpp
+++ b/accessible/src/msaa/AccessibleWrap.cpp
@@ -3,49 +3,48 @@
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
 
 #include "AccessibleWrap.h"
 
 #include "Compatibility.h"
 #include "DocAccessible-inl.h"
 #include "EnumVariant.h"
+#include "ia2AccessibleRelation.h"
 #include "nsAccUtils.h"
 #include "nsCoreUtils.h"
+#include "nsIAccessibleEvent.h"
+#include "nsIAccessibleRelation.h"
 #include "nsWinUtils.h"
 #include "Relation.h"
 #include "Role.h"
+#include "RootAccessible.h"
 #include "States.h"
-
-#include "ia2AccessibleRelation.h"
-
-#include "nsIAccessibleEvent.h"
-#include "nsIAccessibleRelation.h"
-
-#include "Accessible2_i.c"
-#include "AccessibleRole.h"
-#include "AccessibleStates.h"
-#include "RootAccessible.h"
+#include "uiaRawElmProvider.h"
 
 #ifdef DEBUG
 #include "Logging.h"
 #endif
 
 #include "nsIMutableArray.h"
 #include "nsIFrame.h"
 #include "nsIScrollableFrame.h"
 #include "nsINameSpaceManager.h"
 #include "nsINodeInfo.h"
 #include "nsIServiceManager.h"
 #include "nsTextFormatter.h"
 #include "nsIView.h"
 #include "nsIViewManager.h"
 #include "nsEventMap.h"
 #include "nsArrayUtils.h"
+#include "mozilla/Preferences.h"
 
+#include "Accessible2_i.c"
+#include "AccessibleRole.h"
+#include "AccessibleStates.h"
 #include "OLEACC.H"
 
 using namespace mozilla;
 using namespace mozilla::a11y;
 
 const PRUint32 USE_ROLE_STRING = 0;
 
 /* For documentation of the accessibility architecture,
@@ -117,16 +116,42 @@ AccessibleWrap::QueryInterface(REFIID ii
     return nsAccessNodeWrap::QueryInterface(iid, ppv);
 
   (reinterpret_cast<IUnknown*>(*ppv))->AddRef();
 } __except(FilterA11yExceptions(::GetExceptionCode(), GetExceptionInformation())) { }
 
   return S_OK;
 }
 
+////////////////////////////////////////////////////////////////////////////////
+// IServiceProvider
+
+STDMETHODIMP
+AccessibleWrap::QueryService(REFGUID aGuidService, REFIID aIID,
+                             void** aInstancePtr)
+{
+  if (!aInstancePtr)
+    return E_INVALIDARG;
+
+  *aInstancePtr = NULL;
+
+  // UIA IAccessibleEx
+  if (aGuidService == IID_IAccessibleEx &&
+      Preferences::GetBool("accessibility.uia.enable")) {
+    IAccessibleEx* accEx = new uiaRawElmProvider(this);
+    HRESULT hr = accEx->QueryInterface(aIID, aInstancePtr);
+    if (FAILED(hr))
+      delete accEx;
+
+    return hr;
+  }
+
+  return nsAccessNodeWrap::QueryService(aGuidService, aIID, aInstancePtr);
+}
+
 //-----------------------------------------------------
 // IAccessible methods
 //-----------------------------------------------------
 
 STDMETHODIMP
 AccessibleWrap::get_accParent( IDispatch __RPC_FAR *__RPC_FAR *ppdispParent)
 {
 __try {

--- a/accessible/src/msaa/AccessibleWrap.h
+++ b/accessible/src/msaa/AccessibleWrap.h
@@ -12,61 +12,114 @@
 
 #include "nsCOMPtr.h"
 #include "Accessible.h"
 #include "Accessible2.h"
 #include "ia2AccessibleComponent.h"
 #include "ia2AccessibleHyperlink.h"
 #include "CAccessibleValue.h"
 
-#define DECL_IUNKNOWN_INHERITED                                               \
-public:                                                                       \
-STDMETHODIMP QueryInterface(REFIID, void**);                                  \
+#define DECL_IUNKNOWN                                                          \
+public:                                                                        \
+  virtual HRESULT STDMETHODCALLTYPE QueryInterface(REFIID, void**);            \
+  virtual ULONG STDMETHODCALLTYPE AddRef() MOZ_FINAL                           \
+    {  return ++mRefCnt; }                                                     \
+  virtual ULONG STDMETHODCALLTYPE Release() MOZ_FINAL                          \
+  {                                                                            \
+     mRefCnt--;                                                                \
+     if (mRefCnt)                                                              \
+       return mRefCnt;                                                         \
+                                                                               \
+     delete this;                                                              \
+     return 0;                                                                 \
+  }                                                                            \
+private:                                                                       \
+  ULONG mRefCnt;                                                               \
+public:
+
+#define DECL_IUNKNOWN_INHERITED                                                \
+public:                                                                        \
+virtual HRESULT STDMETHODCALLTYPE QueryInterface(REFIID, void**);              \
 
-#define IMPL_IUNKNOWN_QUERY_HEAD(Class)                                       \
-STDMETHODIMP                                                                  \
-Class::QueryInterface(REFIID iid, void** ppv)                                 \
-{                                                                             \
-  HRESULT hr = E_NOINTERFACE;                                                 \
-  *ppv = NULL;                                                                \
+#define IMPL_IUNKNOWN_QUERY_HEAD(Class)                                        \
+STDMETHODIMP                                                                   \
+Class::QueryInterface(REFIID aIID, void** aInstancePtr)                        \
+{                                                                              \
+__try {                                                                        \
+  if (!aInstancePtr)                                                           \
+    return E_INVALIDARG;                                                       \
+  *aInstancePtr = NULL;                                                        \
+                                                                               \
+  HRESULT hr = E_NOINTERFACE;
 
-#define IMPL_IUNKNOWN_QUERY_TAIL                                              \
-  return hr;                                                                  \
-}                                                                             \
+#define IMPL_IUNKNOWN_QUERY_TAIL                                               \
+  return hr;                                                                   \
+} __except(nsAccessNodeWrap::FilterA11yExceptions(::GetExceptionCode(),        \
+                                                  GetExceptionInformation())) { } \
+  return E_NOINTERFACE;                                                        \
+}
 
-#define IMPL_IUNKNOWN_QUERY_ENTRY(Class)                                      \
-  hr = Class::QueryInterface(iid, ppv);                                       \
-  if (SUCCEEDED(hr))                                                          \
-    return hr;                                                                \
+#define IMPL_IUNKNOWN_QUERY_IFACE(Iface)                                       \
+  if (aIID == IID_##Iface) {                                                   \
+    *aInstancePtr = static_cast<Iface*>(this);                                 \
+    AddRef();                                                                  \
+    return S_OK;                                                               \
+  }
 
-#define IMPL_IUNKNOWN_QUERY_ENTRY_COND(Class, Cond)                           \
-  if (Cond) {                                                                 \
-    hr = Class::QueryInterface(iid, ppv);                                     \
-    if (SUCCEEDED(hr))                                                        \
-      return hr;                                                              \
-  }                                                                           \
+#define IMPL_IUNKNOWN_QUERY_IFACE_AMBIGIOUS(Iface, aResolveIface)              \
+  if (aIID == IID_##Iface) {                                                   \
+    *aInstancePtr = static_cast<Iface*>(static_cast<aResolveIface*>(this));    \
+    AddRef();                                                                  \
+    return S_OK;                                                               \
+  }
+
+#define IMPL_IUNKNOWN_QUERY_CLASS(Class)                                       \
+  hr = Class::QueryInterface(aIID, aInstancePtr);                              \
+  if (SUCCEEDED(hr))                                                           \
+    return hr;
 
-#define IMPL_IUNKNOWN_INHERITED0(Class, Super)                                \
-  IMPL_IUNKNOWN_QUERY_HEAD(Class)                                             \
-  IMPL_IUNKNOWN_QUERY_ENTRY(Super)                                            \
-  IMPL_IUNKNOWN_QUERY_TAIL                                                    \
+#define IMPL_IUNKNOWN_QUERY_CLASS_COND(Class, Cond)                            \
+  if (Cond) {                                                                  \
+    hr = Class::QueryInterface(aIID, aInstancePtr);                            \
+    if (SUCCEEDED(hr))                                                         \
+      return hr;                                                               \
+  }
+
+#define IMPL_IUNKNOWN_QUERY_AGGR_COND(Member, Cond)                            \
+  if (Cond) {                                                                  \
+    hr = Member->QueryInterface(aIID, aInstancePtr);                           \
+    if (SUCCEEDED(hr))                                                         \
+      return hr;                                                               \
+  }
 
-#define IMPL_IUNKNOWN_INHERITED1(Class, Super, I1)                            \
-  IMPL_IUNKNOWN_QUERY_HEAD(Class)                                             \
-  IMPL_IUNKNOWN_QUERY_ENTRY(I1);                                              \
-  IMPL_IUNKNOWN_QUERY_ENTRY(Super)                                            \
-  IMPL_IUNKNOWN_QUERY_TAIL                                                    \
+#define IMPL_IUNKNOWN1(Class, I1)                                              \
+  IMPL_IUNKNOWN_QUERY_HEAD(Class)                                              \
+  IMPL_IUNKNOWN_QUERY_IFACE(I1);                                               \
+  IMPL_IUNKNOWN_QUERY_IFACE(IUnknown);                                         \
+  IMPL_IUNKNOWN_QUERY_TAIL                                                     \
+
+#define IMPL_IUNKNOWN2(Class, I1, I2)                                          \
+  IMPL_IUNKNOWN_QUERY_HEAD(Class)                                              \
+  IMPL_IUNKNOWN_QUERY_IFACE(I1);                                               \
+  IMPL_IUNKNOWN_QUERY_IFACE(I2);                                               \
+  IMPL_IUNKNOWN_QUERY_IFACE_AMBIGIOUS(IUnknown, I1);                           \
+  IMPL_IUNKNOWN_QUERY_TAIL                                                     \
 
-#define IMPL_IUNKNOWN_INHERITED2(Class, Super, I1, I2)                        \
-  IMPL_IUNKNOWN_QUERY_HEAD(Class)                                             \
-  IMPL_IUNKNOWN_QUERY_ENTRY(I1);                                              \
-  IMPL_IUNKNOWN_QUERY_ENTRY(I2);                                              \
-  IMPL_IUNKNOWN_QUERY_ENTRY(Super)                                            \
-  IMPL_IUNKNOWN_QUERY_TAIL                                                    \
+#define IMPL_IUNKNOWN_INHERITED1(Class, Super0, Super1)                        \
+  IMPL_IUNKNOWN_QUERY_HEAD(Class)                                              \
+  IMPL_IUNKNOWN_QUERY_CLASS(Super1);                                           \
+  IMPL_IUNKNOWN_QUERY_CLASS(Super0)                                            \
+  IMPL_IUNKNOWN_QUERY_TAIL                                                     \
 
+#define IMPL_IUNKNOWN_INHERITED2(Class, Super0, Super1, Super2)                \
+  IMPL_IUNKNOWN_QUERY_HEAD(Class)                                              \
+  IMPL_IUNKNOWN_QUERY_CLASS(Super1);                                           \
+  IMPL_IUNKNOWN_QUERY_CLASS(Super2);                                           \
+  IMPL_IUNKNOWN_QUERY_CLASS(Super0)                                            \
+  IMPL_IUNKNOWN_QUERY_TAIL
 
 class AccessibleWrap : public Accessible,
                        public ia2AccessibleComponent,
                        public ia2AccessibleHyperlink,
                        public CAccessibleValue,
                        public IAccessible2
 {
 public: // construction, destruction
@@ -78,16 +131,21 @@ public: // construction, destruction
     NS_DECL_ISUPPORTS_INHERITED
 
   public: // IUnknown methods - see iunknown.h for documentation
     STDMETHODIMP QueryInterface(REFIID, void**);
 
   // Return the registered OLE class ID of this object's CfDataObj.
     CLSID GetClassID() const;
 
+  // IServiceProvider
+  virtual HRESULT STDMETHODCALLTYPE QueryService(REFGUID aGuidService,
+                                                 REFIID aIID,
+                                                 void** aInstancePtr);
+
   public: // COM interface IAccessible
     virtual /* [id][propget] */ HRESULT STDMETHODCALLTYPE get_accParent( 
         /* [retval][out] */ IDispatch __RPC_FAR *__RPC_FAR *ppdispParent);
 
     virtual /* [id][propget] */ HRESULT STDMETHODCALLTYPE get_accChildCount( 
         /* [retval][out] */ long __RPC_FAR *pcountChildren);
 
     virtual /* [id][propget] */ HRESULT STDMETHODCALLTYPE get_accChild( 

--- a/accessible/src/msaa/EnumVariant.cpp
+++ b/accessible/src/msaa/EnumVariant.cpp
@@ -8,61 +8,21 @@
 
 using namespace mozilla;
 using namespace mozilla::a11y;
 
 ////////////////////////////////////////////////////////////////////////////////
 // ChildrenEnumVariant
 ////////////////////////////////////////////////////////////////////////////////
 
-STDMETHODIMP
-ChildrenEnumVariant::QueryInterface(REFIID aIID, void** aObject)
-{
-__try {
-  if (!aObject)
-    return E_INVALIDARG;
-
-  if (aIID == IID_IEnumVARIANT) {
-    *aObject = static_cast<IEnumVARIANT*>(this);
-    AddRef();
-    return S_OK;
-  }
-
-  if (aIID == IID_IUnknown) {
-    *aObject = static_cast<IUnknown*>(this);
-    AddRef();
-    return S_OK;
-  }
-
-  // Redirect QI to IAccessible this enum was retrieved for.
-  if (!mAnchorAcc->IsDefunct())
-    return mAnchorAcc->QueryInterface(aIID, aObject);
-
-} __except(nsAccessNodeWrap::FilterA11yExceptions(::GetExceptionCode(),
-                                                  GetExceptionInformation())) { }
-
-  return E_NOINTERFACE;
-}
-
-ULONG STDMETHODCALLTYPE
-ChildrenEnumVariant::AddRef()
-{
-  return ++mRefCnt;
-}
-
-ULONG STDMETHODCALLTYPE
-ChildrenEnumVariant::Release()
-{
-  mRefCnt--;
-  ULONG r = mRefCnt;
-  if (r == 0)
-    delete this;
-
-  return r;
-}
+IMPL_IUNKNOWN_QUERY_HEAD(ChildrenEnumVariant)
+IMPL_IUNKNOWN_QUERY_IFACE(IEnumVARIANT);
+IMPL_IUNKNOWN_QUERY_IFACE(IUnknown);
+IMPL_IUNKNOWN_QUERY_AGGR_COND(mAnchorAcc, !mAnchorAcc->IsDefunct());
+IMPL_IUNKNOWN_QUERY_TAIL
 
 STDMETHODIMP
 ChildrenEnumVariant::Next(ULONG aCount, VARIANT FAR* aItems,
                           ULONG FAR* aCountFetched)
 {
 __try {
   if (!aItems || !aCountFetched)
     return E_INVALIDARG;

--- a/accessible/src/msaa/EnumVariant.h
+++ b/accessible/src/msaa/EnumVariant.h
@@ -17,22 +17,17 @@ namespace a11y {
  */
 class ChildrenEnumVariant MOZ_FINAL : public IEnumVARIANT
 {
 public:
   ChildrenEnumVariant(AccessibleWrap* aAnchor) : mAnchorAcc(aAnchor),
     mCurAcc(mAnchorAcc->GetChildAt(0)), mCurIndex(0), mRefCnt(0) { }
 
   // IUnknown
-  virtual HRESULT STDMETHODCALLTYPE QueryInterface(
-    /* [in] */ REFIID aRefIID,
-    /* [annotation][iid_is][out] */ void** aObject);
-
-  virtual ULONG STDMETHODCALLTYPE AddRef();
-  virtual ULONG STDMETHODCALLTYPE Release();
+  DECL_IUNKNOWN
 
   // IEnumVariant
   virtual /* [local] */ HRESULT STDMETHODCALLTYPE Next(
     /* [in] */ ULONG aCount,
     /* [length_is][size_is][out] */ VARIANT* aItems,
     /* [out] */ ULONG* aCountFetched);
 
   virtual HRESULT STDMETHODCALLTYPE Skip(
@@ -51,17 +46,14 @@ private:
     mAnchorAcc(aEnumVariant.mAnchorAcc), mCurAcc(aEnumVariant.mCurAcc),
     mCurIndex(aEnumVariant.mCurIndex), mRefCnt(0) { }
   virtual ~ChildrenEnumVariant() { }
 
 protected:
   nsRefPtr<AccessibleWrap> mAnchorAcc;
   Accessible* mCurAcc;
   PRUint32 mCurIndex;
-
-private:
-  ULONG mRefCnt;
 };
 
 } // a11y namespace
 } // mozilla namespace
 
 #endif

--- a/accessible/src/msaa/Makefile.in
+++ b/accessible/src/msaa/Makefile.in
@@ -64,11 +64,12 @@ include $(topsrcdir)/config/rules.mk
 
 LOCAL_INCLUDES += \
   -I$(srcdir) \
   -I$(srcdir)/../base \
   -I$(srcdir)/../generic \
   -I$(srcdir)/../html \
   -I$(srcdir)/../xpcom \
   -I$(srcdir)/../xul \
+  -I$(srcdir)/../windows/uia \
   -I$(srcdir)/../../../content/base/src \
   -I$(srcdir)/../../../content/events/src \
   $(NULL)

--- a/accessible/src/msaa/XULListboxAccessibleWrap.cpp
+++ b/accessible/src/msaa/XULListboxAccessibleWrap.cpp
@@ -16,18 +16,18 @@ XULListboxAccessibleWrap::
   XULListboxAccessible(aContent, aDoc)
 {
 }
 
 NS_IMPL_ISUPPORTS_INHERITED0(XULListboxAccessibleWrap,
                              XULListboxAccessible)
 
 IMPL_IUNKNOWN_QUERY_HEAD(XULListboxAccessibleWrap)
-IMPL_IUNKNOWN_QUERY_ENTRY_COND(CAccessibleTable, IsMulticolumn());
-IMPL_IUNKNOWN_QUERY_ENTRY(AccessibleWrap)
+IMPL_IUNKNOWN_QUERY_CLASS_COND(CAccessibleTable, IsMulticolumn());
+IMPL_IUNKNOWN_QUERY_CLASS(AccessibleWrap)
 IMPL_IUNKNOWN_QUERY_TAIL
 
 
 ////////////////////////////////////////////////////////////////////////////////
 // XULListCellAccessibleWrap
 ////////////////////////////////////////////////////////////////////////////////
 
 XULListCellAccessibleWrap::

--- a/accessible/src/msaa/nsAccessNodeWrap.cpp
+++ b/accessible/src/msaa/nsAccessNodeWrap.cpp
@@ -19,18 +19,16 @@
 #include "nsAttrName.h"
 #include "nsIDOMNodeList.h"
 #include "nsIDOMHTMLElement.h"
 #include "nsIFrame.h"
 #include "nsINameSpaceManager.h"
 #include "nsPIDOMWindow.h"
 #include "nsIServiceManager.h"
 
-#include "mozilla/Preferences.h"
-
 using namespace mozilla;
 using namespace mozilla::a11y;
 
 AccTextChangeEvent* nsAccessNodeWrap::gTextEvent = nsnull;
 
 ////////////////////////////////////////////////////////////////////////////////
 // nsAccessNodeWrap
 ////////////////////////////////////////////////////////////////////////////////
@@ -82,32 +80,23 @@ STDMETHODIMP nsAccessNodeWrap::QueryInte
   return S_OK;
 }
 
 STDMETHODIMP
 nsAccessNodeWrap::QueryService(REFGUID guidService, REFIID iid, void** ppv)
 {
   *ppv = nsnull;
 
-  static const GUID IID_SimpleDOMDeprecated = {0x0c539790,0x12e4,0x11cf,0xb6,0x61,0x00,0xaa,0x00,0x4c,0xd6,0xd8};
-
   // Provide a special service ID for getting the accessible for the browser tab
   // document that contains this accessible object. If this accessible object
   // is not inside a browser tab then the service fails with E_NOINTERFACE.
   // A use case for this is for screen readers that need to switch context or
   // 'virtual buffer' when focus moves from one browser tab area to another.
-  static const GUID SID_IAccessibleContentDocument = {0xa5d8e1f3,0x3571,0x4d8f,0x95,0x21,0x07,0xed,0x28,0xfb,0x07,0x2e};
-
-  if (guidService != IID_ISimpleDOMNode &&
-      guidService != IID_SimpleDOMDeprecated &&
-      guidService != IID_IAccessible &&  guidService != IID_IAccessible2 &&
-      guidService != IID_IAccessibleApplication &&
-      guidService != SID_IAccessibleContentDocument)
-    return E_INVALIDARG;
-
+  static const GUID SID_IAccessibleContentDocument =
+    { 0xa5d8e1f3,0x3571,0x4d8f,0x95,0x21,0x07,0xed,0x28,0xfb,0x07,0x2e };
   if (guidService == SID_IAccessibleContentDocument) {
     if (iid != IID_IAccessible)
       return E_NOINTERFACE;
 
     nsCOMPtr<nsIDocShellTreeItem> docShellTreeItem = 
       nsCoreUtils::GetDocShellTreeItemFor(mContent);
     if (!docShellTreeItem)
       return E_UNEXPECTED;
@@ -134,17 +123,17 @@ nsAccessNodeWrap::QueryService(REFGUID g
 
     *ppv = static_cast<IAccessible*>(docAcc);
 
     (reinterpret_cast<IUnknown*>(*ppv))->AddRef();
     return NS_OK;
   }
 
   // Can get to IAccessibleApplication from any node via QS
-  if (iid == IID_IAccessibleApplication) {
+  if (guidService == IID_IAccessibleApplication) {
     ApplicationAccessible* applicationAcc = GetApplicationAccessible();
     if (!applicationAcc)
       return E_NOINTERFACE;
 
     nsresult rv = applicationAcc->QueryNativeInterface(iid, ppv);
     return NS_SUCCEEDED(rv) ? S_OK : E_NOINTERFACE;
   }
 
@@ -157,17 +146,24 @@ nsAccessNodeWrap::QueryService(REFGUID g
    * pAcc->QueryInterface(IID_IServiceProvider, (void**)&pServProv);
    * if (pServProv) {
    *   const GUID unused;
    *   pServProv->QueryService(unused, IID_ISimpleDOMDocument, (void**)&pAccDoc);
    *   pServProv->Release();
    * }
    */
 
-  return QueryInterface(iid, ppv);
+  static const GUID IID_SimpleDOMDeprecated =
+    { 0x0c539790,0x12e4,0x11cf,0xb6,0x61,0x00,0xaa,0x00,0x4c,0xd6,0xd8 };
+  if (guidService == IID_ISimpleDOMNode ||
+      guidService == IID_SimpleDOMDeprecated ||
+      guidService == IID_IAccessible ||  guidService == IID_IAccessible2)
+    return QueryInterface(iid, ppv);
+
+  return E_INVALIDARG;
 }
 
 //-----------------------------------------------------
 // ISimpleDOMNode methods
 //-----------------------------------------------------
 
 STDMETHODIMP nsAccessNodeWrap::get_nodeInfo( 
     /* [out] */ BSTR __RPC_FAR *aNodeName,

--- a/accessible/src/msaa/nsAccessNodeWrap.h
+++ b/accessible/src/msaa/nsAccessNodeWrap.h
@@ -29,40 +29,50 @@
 #include "OLEACC.H"
 #include <winuser.h>
 #ifdef MOZ_CRASHREPORTER
 #include "nsICrashReporter.h"
 #endif
 
 #include "nsRefPtrHashtable.h"
 
+#define A11Y_TRYBLOCK_BEGIN                                                    \
+  __try {
+
+#define A11Y_TRYBLOCK_END                                                      \
+  } __except(nsAccessNodeWrap::FilterA11yExceptions(::GetExceptionCode(),      \
+                                                    GetExceptionInformation()))\
+  { }                                                                          \
+  return E_FAIL;
 
 class AccTextChangeEvent;
 
 class nsAccessNodeWrap :  public nsAccessNode,
                           public nsIWinAccessNode,
                           public ISimpleDOMNode,
                           public IServiceProvider
 {
   public:
     NS_DECL_ISUPPORTS_INHERITED
     NS_DECL_NSIWINACCESSNODE
 
-  public: // IServiceProvider
-    STDMETHODIMP QueryService(REFGUID guidService, REFIID riid, void** ppv);
-
 public: // construction, destruction
   nsAccessNodeWrap(nsIContent* aContent, DocAccessible* aDoc);
   virtual ~nsAccessNodeWrap();
 
-    // IUnknown
-    STDMETHODIMP QueryInterface(REFIID, void**);
+  // IUnknown
+  virtual HRESULT STDMETHODCALLTYPE QueryInterface(REFIID aIID,
+                                                   void** aInstancePtr);
 
-  public:
+  // IServiceProvider
+  virtual HRESULT STDMETHODCALLTYPE QueryService(REFGUID aGuidService,
+                                                 REFIID aIID,
+                                                 void** aInstancePtr);
 
+  // ISimpleDOMNode
     virtual /* [id][propget] */ HRESULT STDMETHODCALLTYPE get_nodeInfo( 
         /* [out] */ BSTR __RPC_FAR *tagName,
         /* [out] */ short __RPC_FAR *nameSpaceID,
         /* [out] */ BSTR __RPC_FAR *nodeValue,
         /* [out] */ unsigned int __RPC_FAR *numChildren,
         /* [out] */ unsigned int __RPC_FAR *aUniqueID,
         /* [out][retval] */ unsigned short __RPC_FAR *nodeType);
   

new file mode 100644
--- /dev/null
+++ b/accessible/src/windows/Makefile.in
@@ -0,0 +1,16 @@
+#
+# This Source Code Form is subject to the terms of the Mozilla Public
+# License, v. 2.0. If a copy of the MPL was not distributed with this
+# file, You can obtain one at http://mozilla.org/MPL/2.0/.
+
+DEPTH = ../../..
+topsrcdir = @top_srcdir@
+srcdir = @srcdir@
+VPATH = @srcdir@
+
+include $(DEPTH)/config/autoconf.mk
+
+DIRS += uia \
+  $(null)
+
+include $(topsrcdir)/config/rules.mk

new file mode 100644
--- /dev/null
+++ b/accessible/src/windows/uia/Makefile.in
@@ -0,0 +1,36 @@
+# This Source Code Form is subject to the terms of the Mozilla Public
+# License, v. 2.0. If a copy of the MPL was not distributed with this
+# file, You can obtain one at http://mozilla.org/MPL/2.0/.
+
+DEPTH = ../../../..
+topsrcdir = @top_srcdir@
+srcdir = @srcdir@
+VPATH = @srcdir@
+
+include $(DEPTH)/config/autoconf.mk
+
+MODULE = accessibility
+LIBRARY_NAME = accessibility_toolkit_uia_s
+EXPORT_LIBRARY = ..
+LIBXUL_LIBRARY = 1
+
+
+CPPSRCS += \
+  uiaRawElmProvider.cpp \
+  $(NULL)
+
+# we don't want the shared lib, but we want to force the creation of a static lib.
+FORCE_STATIC_LIB = 1
+
+include $(topsrcdir)/config/config.mk
+include $(topsrcdir)/config/rules.mk
+
+LOCAL_INCLUDES += \
+  -I$(srcdir) \
+  -I$(srcdir)/../../base \
+  -I$(srcdir)/../../generic \
+  -I$(srcdir)/../../html \
+  -I$(srcdir)/../../msaa \
+  -I$(srcdir)/../../xpcom \
+  -I$(srcdir)/../../xul \
+  $(NULL)

new file mode 100644
--- /dev/null
+++ b/accessible/src/windows/uia/uiaRawElmProvider.cpp
@@ -0,0 +1,170 @@
+/* -*- Mode: C++; tab-width: 2; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
+/* vim: set ts=2 et sw=2 tw=80: */
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this file,
+ * You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+#include "uiaRawElmProvider.h"
+
+#include "AccessibleWrap.h"
+
+using namespace mozilla;
+using namespace mozilla::a11y;
+
+////////////////////////////////////////////////////////////////////////////////
+// uiaRawElmProvider
+////////////////////////////////////////////////////////////////////////////////
+
+IMPL_IUNKNOWN2(uiaRawElmProvider,
+               IAccessibleEx,
+               IRawElementProviderSimple)
+
+////////////////////////////////////////////////////////////////////////////////
+// IAccessibleEx
+
+STDMETHODIMP
+uiaRawElmProvider::GetObjectForChild(long aIdChild,
+                                     __RPC__deref_out_opt IAccessibleEx** aAccEx)
+{
+  A11Y_TRYBLOCK_BEGIN
+
+  if (!aAccEx)
+    return E_INVALIDARG;
+
+  *aAccEx = NULL;
+
+  return mAcc->IsDefunct() ? CO_E_OBJNOTCONNECTED : S_OK;
+
+  A11Y_TRYBLOCK_END
+}
+
+STDMETHODIMP
+uiaRawElmProvider::GetIAccessiblePair(__RPC__deref_out_opt IAccessible** aAcc,
+                                      __RPC__out long* aIdChild)
+{
+  A11Y_TRYBLOCK_BEGIN
+
+  if (!aAcc || !aIdChild)
+    return E_INVALIDARG;
+
+  *aAcc = NULL;
+  *aIdChild = 0;
+
+  if (mAcc->IsDefunct())
+    return CO_E_OBJNOTCONNECTED;
+
+  *aIdChild = CHILDID_SELF;
+  *aAcc = mAcc;
+  mAcc->AddRef();
+
+  return S_OK;
+
+  A11Y_TRYBLOCK_END
+}
+
+STDMETHODIMP
+uiaRawElmProvider::GetRuntimeId(__RPC__deref_out_opt SAFEARRAY** aRuntimeIds)
+{
+  A11Y_TRYBLOCK_BEGIN
+
+  if (!aRuntimeIds)
+    return E_INVALIDARG;
+
+  int ids[] = { UiaAppendRuntimeId, reinterpret_cast<int>(mAcc->UniqueID()) };
+  *aRuntimeIds = SafeArrayCreateVector(VT_I4, 0, 2);
+  if (!*aRuntimeIds)
+    return E_OUTOFMEMORY;
+
+  for (LONG i = 0; i < ArrayLength(ids); i++)
+    SafeArrayPutElement(*aRuntimeIds, &i, (void*)&(ids[i]));
+
+  return S_OK;
+
+  A11Y_TRYBLOCK_END
+}
+
+STDMETHODIMP
+uiaRawElmProvider::ConvertReturnedElement(__RPC__in_opt IRawElementProviderSimple* aRawElmProvider,
+                                          __RPC__deref_out_opt IAccessibleEx** aAccEx)
+{
+  A11Y_TRYBLOCK_BEGIN
+
+  if (!aRawElmProvider || !aAccEx)
+    return E_INVALIDARG;
+
+  *aAccEx = NULL;
+
+  void* instancePtr = NULL;
+  HRESULT hr = aRawElmProvider->QueryInterface(IID_IAccessibleEx, &instancePtr);
+  if (SUCCEEDED(hr))
+    *aAccEx = static_cast<IAccessibleEx*>(instancePtr);
+
+  return hr;
+
+  A11Y_TRYBLOCK_END
+}
+
+////////////////////////////////////////////////////////////////////////////////
+// IRawElementProviderSimple
+
+STDMETHODIMP
+uiaRawElmProvider::get_ProviderOptions(__RPC__out enum ProviderOptions* aOptions)
+{
+  A11Y_TRYBLOCK_BEGIN
+
+  if (!aOptions)
+    return E_INVALIDARG;
+
+  // This method is not used with IAccessibleEx implementations.
+  *aOptions = ProviderOptions_ServerSideProvider;
+  return S_OK;
+
+  A11Y_TRYBLOCK_END
+}
+
+STDMETHODIMP
+uiaRawElmProvider::GetPatternProvider(PATTERNID aPatternId,
+                                      __RPC__deref_out_opt IUnknown** aPatternProvider)
+{
+  A11Y_TRYBLOCK_BEGIN
+
+  if (!aPatternProvider)
+    return E_INVALIDARG;
+
+  *aPatternProvider = NULL;
+  return S_OK;
+
+  A11Y_TRYBLOCK_END
+}
+
+STDMETHODIMP
+uiaRawElmProvider::GetPropertyValue(PROPERTYID aPropertyId,
+                                    __RPC__out VARIANT* aPropertyValue)
+{
+  A11Y_TRYBLOCK_BEGIN
+
+  if (!aPropertyValue)
+    return E_INVALIDARG;
+
+  // UI Automation will attempt to get the property from the host
+  //window provider.
+  aPropertyValue->vt = VT_EMPTY;
+  return S_OK;
+
+  A11Y_TRYBLOCK_END
+}
+
+STDMETHODIMP
+uiaRawElmProvider::get_HostRawElementProvider(__RPC__deref_out_opt IRawElementProviderSimple** aRawElmProvider)
+{
+  A11Y_TRYBLOCK_BEGIN
+
+  if (!aRawElmProvider)
+    return E_INVALIDARG;
+
+  // This method is not used with IAccessibleEx implementations.
+  *aRawElmProvider = NULL;
+  return S_OK;
+
+  A11Y_TRYBLOCK_END
+}

new file mode 100644
--- /dev/null
+++ b/accessible/src/windows/uia/uiaRawElmProvider.h
@@ -0,0 +1,74 @@
+/* -*- Mode: C++; tab-width: 2; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
+/* vim: set ts=2 et sw=2 tw=80: */
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this file,
+ * You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+#ifndef mozilla_a11y_uiaRawElmProvider_h__
+#define mozilla_a11y_uiaRawElmProvider_h__
+
+#include "objbase.h"
+#include "AccessibleWrap.h"
+#include "UIAutomation.h"
+
+class AccessibleWrap;
+
+namespace mozilla {
+namespace a11y {
+
+/**
+ * IRawElementProviderSimple implementation (maintains IAccessibleEx approach).
+ */
+class uiaRawElmProvider MOZ_FINAL : public IAccessibleEx,
+                                    public IRawElementProviderSimple
+{
+public:
+  uiaRawElmProvider(AccessibleWrap* aAcc) : mAcc(aAcc), mRefCnt(0) { }
+
+  // IUnknown
+  DECL_IUNKNOWN
+
+  // IAccessibleEx
+  virtual HRESULT STDMETHODCALLTYPE GetObjectForChild(
+    /* [in] */ long aIdChild,
+    /* [retval][out] */ __RPC__deref_out_opt IAccessibleEx** aAccEx);
+
+  virtual HRESULT STDMETHODCALLTYPE GetIAccessiblePair(
+    /* [out] */ __RPC__deref_out_opt IAccessible** aAcc,
+    /* [out] */ __RPC__out long* aIdChild);
+
+  virtual HRESULT STDMETHODCALLTYPE GetRuntimeId(
+    /* [retval][out] */ __RPC__deref_out_opt SAFEARRAY** aRuntimeIds);
+
+  virtual HRESULT STDMETHODCALLTYPE ConvertReturnedElement(
+    /* [in] */ __RPC__in_opt IRawElementProviderSimple* aRawElmProvider,
+    /* [out] */ __RPC__deref_out_opt IAccessibleEx** aAccEx);
+
+  // IRawElementProviderSimple
+  virtual /* [propget] */ HRESULT STDMETHODCALLTYPE get_ProviderOptions(
+    /* [retval][out] */ __RPC__out enum ProviderOptions* aProviderOptions);
+
+  virtual HRESULT STDMETHODCALLTYPE GetPatternProvider(
+    /* [in] */ PATTERNID aPatternId,
+    /* [retval][out] */ __RPC__deref_out_opt IUnknown** aPatternProvider);
+
+  virtual HRESULT STDMETHODCALLTYPE GetPropertyValue(
+    /* [in] */ PROPERTYID aPropertyId,
+    /* [retval][out] */ __RPC__out VARIANT* aPropertyValue);
+
+  virtual /* [propget] */ HRESULT STDMETHODCALLTYPE get_HostRawElementProvider(
+    /* [retval][out] */ __RPC__deref_out_opt IRawElementProviderSimple** aRawElmProvider);
+
+private:
+  uiaRawElmProvider() MOZ_DELETE;
+  uiaRawElmProvider& operator =(const uiaRawElmProvider&) MOZ_DELETE;
+  uiaRawElmProvider(const uiaRawElmProvider&) MOZ_DELETE;
+
+protected:
+  nsRefPtr<AccessibleWrap> mAcc;
+};
+
+} // a11y namespace
+} // mozilla namespace
+
+#endif

--- a/accessible/src/xul/XULTabAccessible.cpp
+++ b/accessible/src/xul/XULTabAccessible.cpp
@@ -159,32 +159,25 @@ nsresult
 XULTabsAccessible::GetNameInternal(nsAString& aName)
 {
   // no name
   return NS_OK;
 }
 
 
 ////////////////////////////////////////////////////////////////////////////////
-// XULTabpanelsAccessible
+// XULDeckAccessible
 ////////////////////////////////////////////////////////////////////////////////
 
-XULTabpanelsAccessible::
-  XULTabpanelsAccessible(nsIContent* aContent, DocAccessible* aDoc) :
-  AccessibleWrap(aContent, aDoc)
-{
-}
-
 role
-XULTabpanelsAccessible::NativeRole()
+XULDeckAccessible::NativeRole()
 {
   return roles::PANE;
 }
 
-
 ////////////////////////////////////////////////////////////////////////////////
 // XULTabpanelAccessible
 ////////////////////////////////////////////////////////////////////////////////
 
 XULTabpanelAccessible::
   XULTabpanelAccessible(nsIContent* aContent, DocAccessible* aDoc) :
   AccessibleWrap(aContent, aDoc)
 {

--- a/accessible/src/xul/XULTabAccessible.h
+++ b/accessible/src/xul/XULTabAccessible.h
@@ -51,23 +51,25 @@ public:
   virtual nsresult GetNameInternal(nsAString& aName);
   virtual a11y::role NativeRole();
 
   // ActionAccessible
   virtual PRUint8 ActionCount();
 };
 
 
-/** 
+/**
  * A container of tab panels, xul:tabpanels element.
  */
-class XULTabpanelsAccessible : public AccessibleWrap
+class XULDeckAccessible : public AccessibleWrap
 {
 public:
-  XULTabpanelsAccessible(nsIContent* aContent, DocAccessible* aDoc);
+  XULDeckAccessible(nsIContent* aContent, DocAccessible* aDoc) :
+    AccessibleWrap(aContent, aDoc)
+    { mFlags |= eXULDeckAccessible; }
 
   // Accessible
   virtual a11y::role NativeRole();
 };
 
 
 /**
  * A tabpanel object, child elements of xul:tabpanels element. Note,the object

--- a/accessible/tests/mochitest/attributes/test_text.html
+++ b/accessible/tests/mochitest/attributes/test_text.html
@@ -537,16 +537,33 @@
 
       var attrs = {
         "auto-generated": "true"
       };
       testTextAttrs(ID, 0, attrs, defAttrs, 0, 2);
       testTextAttrs(ID, 2, { }, defAttrs, 2, 6);
       testTextAttrs(ID, 6, attrs, defAttrs, 6, 7);
 
+       //////////////////////////////////////////////////////////////////////////
+      // area19, "HTML5 mark tag" test
+      // text enclosed in mark tag will have a different background color
+      ID = "area19";
+      defAttrs = buildDefaultTextAttrs(ID, "12pt");
+
+      attrs = {};
+      testTextAttrs(ID, 0, attrs, defAttrs, 0, 10);
+      
+      tempElem = getNode(ID).firstChild.nextSibling;
+      gComputedStyle = document.defaultView.getComputedStyle(tempElem, "");
+      attrs = { "background-color": gComputedStyle.backgroundColor };
+      testTextAttrs(ID, 11, attrs, defAttrs, 10, 17);
+
+      attrs = {};
+      testTextAttrs(ID, 18, attrs, defAttrs, 17, 28);
+
       SimpleTest.finish();
     }
 
     SimpleTest.waitForExplicitFinish();
     addA11yLoadEvent(doTest);
   </script>
 </head>
 <body style="font-size: 12pt">
@@ -687,10 +704,14 @@
     </span><span style="text-decoration: line-through; -moz-text-decoration-style: wavy;">wavy
     </span>
   </p>
 
   <ul>
     <li id="area18" class="gencontent">item</li>
   </ul>
 
+  <p id="area19">uncolored
+    <mark>colored</mark> uncolored
+  </p>
+   
 </body>
 </html>

--- a/b2g/app/b2g.js
+++ b/b2g/app/b2g.js
@@ -373,16 +373,19 @@ pref("dom.ipc.tabs.disabled", false);
 pref("dom.ipc.browser_frames.oop_by_default", false);
 
 // Temporary permission hack for WebSMS
 pref("dom.sms.enabled", true);
 
 // Temporary permission hack for WebContacts
 pref("dom.mozContacts.enabled", true);
 
+// WebAlarms
+pref("dom.mozAlarms.enabled", true);
+
 // WebSettings
 pref("dom.mozSettings.enabled", true);
 
 // Ignore X-Frame-Options headers.
 pref("b2g.ignoreXFrameOptions", true);
 
 // controls if we want camera support
 pref("device.camera.enabled", true);

--- a/b2g/chrome/content/dbg-browser-actors.js
+++ b/b2g/chrome/content/dbg-browser-actors.js
@@ -156,17 +156,17 @@ DeviceTabActor.prototype = {
 
   grip: function DTA_grip() {
     dbg_assert(!this.exited,
                'grip() should not be called on exited browser actor.');
     dbg_assert(this.actorID,
                'tab should have an actorID.');
     return {
       'actor': this.actorID,
-      'title': this.browser.contentTitle,
+      'title': this.browser.title,
       'url': this.browser.document.documentURI
     }
   },
 
   /**
    * Called when the actor is removed from the connection.
    */
   disconnect: function DTA_disconnect() {
@@ -217,17 +217,17 @@ DeviceTabActor.prototype = {
    */
   _pushContext: function DTA_pushContext() {
     dbg_assert(!this._contextPool, "Can't push multiple contexts");
 
     this._contextPool = new ActorPool(this.conn);
     this.conn.addActorPool(this._contextPool);
 
     this.threadActor = new ThreadActor(this);
-    this._addDebuggees(this.browser.content.wrappedJSObject);
+    this._addDebuggees(this.browser.wrappedJSObject);
     this._contextPool.addActor(this.threadActor);
   },
 
   /**
    * Add the provided window and all windows in its frame tree as debuggees.
    */
   _addDebuggees: function DTA__addDebuggees(content) {
     this.threadActor.addDebuggee(content);
@@ -288,28 +288,28 @@ DeviceTabActor.prototype = {
 
     return { type: 'detached' };
   },
 
   /**
    * Prepare to enter a nested event loop by disabling debuggee events.
    */
   preNest: function DTA_preNest() {
-    let windowUtils = this.browser.content
+    let windowUtils = this.browser
                           .QueryInterface(Ci.nsIInterfaceRequestor)
                           .getInterface(Ci.nsIDOMWindowUtils);
     windowUtils.suppressEventHandling(true);
     windowUtils.suspendTimeouts();
   },
 
   /**
    * Prepare to exit a nested event loop by enabling debuggee events.
    */
   postNest: function DTA_postNest(aNestData) {
-    let windowUtils = this.browser.content
+    let windowUtils = this.browser
                           .QueryInterface(Ci.nsIInterfaceRequestor)
                           .getInterface(Ci.nsIDOMWindowUtils);
     windowUtils.resumeTimeouts();
     windowUtils.suppressEventHandling(false);
   }
 
 };
 

--- a/b2g/chrome/content/settings.js
+++ b/b2g/chrome/content/settings.js
@@ -74,20 +74,23 @@ SettingsListener.observe('language.curre
     SettingsListener.observe(key, false, function(value) {
       Services.prefs.setIntPref(key, value);
     });
   });
 })();
 
 
 // =================== Debugger ====================
-SettingsListener.observe('devtools.debugger.enabled', false, function(enabled) {
-  Services.prefs.setBoolPref('devtools.debugger.enabled', value);
+SettingsListener.observe('devtools.debugger.remote-enabled', false, function(enabled) {
+  Services.prefs.setBoolPref('devtools.debugger.remote-enabled', value);
 });
 
 SettingsListener.observe('devtools.debugger.log', false, function(value) {
   Services.prefs.setBoolPref('devtools.debugger.log', value);
 });
 
-SettingsListener.observe('devtools.debugger.port', 6000, function(value) {
-  Services.prefs.setIntPref('devtools.debugger.port', value);
+SettingsListener.observe('devtools.debugger.remote-port', 6000, function(value) {
+  Services.prefs.setIntPref('devtools.debugger.remote-port', value);
 });
 
+SettingsListener.observe('devtools.debugger.force-local', true, function(value) {
+  Services.prefs.setBoolPref('devtools.debugger.force-local', value);
+});

--- a/b2g/chrome/content/shell.js
+++ b/b2g/chrome/content/shell.js
@@ -9,16 +9,17 @@ const Ci = Components.interfaces;
 const Cu = Components.utils;
 const Cr = Components.results;
 
 Cu.import('resource://gre/modules/XPCOMUtils.jsm');
 Cu.import('resource://gre/modules/Services.jsm');
 Cu.import('resource://gre/modules/ContactService.jsm');
 Cu.import('resource://gre/modules/SettingsChangeNotifier.jsm');
 Cu.import('resource://gre/modules/Webapps.jsm');
+Cu.import('resource://gre/modules/AlarmService.jsm');
 
 XPCOMUtils.defineLazyServiceGetter(Services, 'env',
                                    '@mozilla.org/process/environment;1',
                                    'nsIEnvironment');
 
 XPCOMUtils.defineLazyServiceGetter(Services, 'ss',
                                    '@mozilla.org/content/style-sheet-service;1',
                                    'nsIStyleSheetService');
@@ -43,20 +44,20 @@ XPCOMUtils.defineLazyGetter(this, 'Debug
 });
 
 // FIXME Bug 707625
 // until we have a proper security model, add some rights to
 // the pre-installed web applications
 // XXX never grant 'content-camera' to non-gaia apps
 function addPermissions(urls) {
   let permissions = [
-    'indexedDB', 'indexedDB-unlimited', 'webapps-manage', 'offline-app', 'pin-app',
+    'indexedDB-unlimited', 'webapps-manage', 'offline-app', 'pin-app',
     'websettings-read', 'websettings-readwrite',
     'content-camera', 'webcontacts-manage', 'wifi-manage', 'desktop-notification',
-    'geolocation', 'device-storage'
+    'geolocation', 'device-storage', 'alarms'
   ];
   urls.forEach(function(url) {
     url = url.trim();
     let uri = Services.io.newURI(url, null, null);
     let allow = Ci.nsIPermissionManager.ALLOW_ACTION;
 
     permissions.forEach(function(permission) {
       Services.perms.add(uri, permission, allow);

--- a/b2g/config/mozconfigs/gb_armv7a_gecko/debug
+++ b/b2g/config/mozconfigs/gb_armv7a_gecko/debug
@@ -2,17 +2,16 @@ mk_add_options MOZ_OBJDIR=@TOPSRCDIR@/ob
 
 mk_add_options MOZ_MAKE_FLAGS="-j8"
 
 ac_add_options --enable-application=b2g
 
 ac_add_options --target=arm-android-eabi
 ac_add_options --with-gonk="$topsrcdir/gonk-toolchain"
 ac_add_options --with-gonk-toolchain-prefix="$topsrcdir/gonk-toolchain/prebuilt/$TOOLCHAIN_HOST/toolchain/arm-eabi-4.4.3/bin/arm-eabi-"
-ac_add_options --with-endian=little
 ac_add_options --disable-elf-hack
 ac_add_options --enable-debug-symbols
 ac_add_options --enable-debug
 ac_add_options --with-ccache
 ac_add_options --enable-marionette
 
 # Enable dump() from JS.
 export CXXFLAGS=-DMOZ_ENABLE_JS_DUMP

--- a/b2g/config/mozconfigs/gb_armv7a_gecko/nightly
+++ b/b2g/config/mozconfigs/gb_armv7a_gecko/nightly
@@ -2,17 +2,16 @@ mk_add_options MOZ_OBJDIR=@TOPSRCDIR@/ob
 
 mk_add_options MOZ_MAKE_FLAGS="-j8"
 
 ac_add_options --enable-application=b2g
 
 ac_add_options --target=arm-android-eabi
 ac_add_options --with-gonk="$topsrcdir/gonk-toolchain"
 ac_add_options --with-gonk-toolchain-prefix="$topsrcdir/gonk-toolchain/prebuilt/$TOOLCHAIN_HOST/toolchain/arm-eabi-4.4.3/bin/arm-eabi-"
-ac_add_options --with-endian=little
 ac_add_options --disable-elf-hack
 ac_add_options --enable-debug-symbols
 ac_add_options --enable-profiling
 ac_add_options --with-ccache
 ac_add_options --enable-marionette
 
 # Enable dump() from JS.
 export CXXFLAGS=-DMOZ_ENABLE_JS_DUMP

--- a/b2g/installer/Makefile.in
+++ b/b2g/installer/Makefile.in
@@ -50,16 +50,20 @@ ifeq (bundle, $(MOZ_FS_LAYOUT))
 BINPATH = $(_BINPATH)
 DEFINES += -DAPPNAME=$(_APPNAME)
 else
 # Every other platform just winds up in dist/bin
 BINPATH = bin
 endif
 DEFINES += -DBINPATH=$(BINPATH)
 
+ifneq (,$(filter WINNT Darwin Android,$(OS_TARGET)))
+DEFINES += -DMOZ_SHARED_MOZGLUE=1
+endif
+
 ifdef MOZ_PKG_MANIFEST_P
 $(MOZ_PKG_MANIFEST): $(MOZ_PKG_MANIFEST_P) FORCE
 	$(PYTHON) $(topsrcdir)/config/Preprocessor.py $(DEFINES) $(ACDEFINES) $< > $@
 
 GARBAGE += $(MOZ_PKG_MANIFEST)
 endif
 
 ifneq (,$(filter mac cocoa,$(MOZ_WIDGET_TOOLKIT)))

--- a/b2g/installer/package-manifest.in
+++ b/b2g/installer/package-manifest.in
@@ -77,21 +77,23 @@
 @BINPATH@/msvcp100.dll
 @BINPATH@/msvcr100.dll
 #endif
 #else
 @BINPATH@/mozcrt19.dll
 @BINPATH@/mozcpp19.dll
 #endif
 #endif
+#ifdef MOZ_SHARED_MOZGLUE
+@BINPATH@/@DLL_PREFIX@mozglue@DLL_SUFFIX@
+#endif
 #ifdef ANDROID
 @BINPATH@/AndroidManifest.xml
 @BINPATH@/resources.arsc
 @BINPATH@/classes.dex
-@BINPATH@/@DLL_PREFIX@mozglue@DLL_SUFFIX@
 @BINPATH@/res/drawable
 @BINPATH@/res/drawable-hdpi
 @BINPATH@/res/layout
 #endif
 
 [browser]
 ; [Base Browser Files]
 #ifndef XP_UNIX
@@ -156,16 +158,17 @@
 @BINPATH@/components/dom_system_gonk.xpt
 #endif
 @BINPATH@/components/dom_battery.xpt
 #ifdef MOZ_B2G_BT
 @BINPATH@/components/dom_bluetooth.xpt
 #endif
 @BINPATH@/components/dom_canvas.xpt
 @BINPATH@/components/dom_contacts.xpt
+@BINPATH@/components/dom_alarm.xpt
 @BINPATH@/components/dom_core.xpt
 @BINPATH@/components/dom_css.xpt
 @BINPATH@/components/dom_devicestorage.xpt
 @BINPATH@/components/dom_events.xpt
 @BINPATH@/components/dom_file.xpt
 @BINPATH@/components/dom_geolocation.xpt
 @BINPATH@/components/dom_media.xpt
 @BINPATH@/components/dom_network.xpt
@@ -312,16 +315,18 @@
 
 ; JavaScript components
 @BINPATH@/components/ConsoleAPI.manifest
 @BINPATH@/components/ConsoleAPI.js
 @BINPATH@/components/BrowserElementParent.manifest
 @BINPATH@/components/BrowserElementParent.js
 @BINPATH@/components/ContactManager.js
 @BINPATH@/components/ContactManager.manifest
+@BINPATH@/components/AlarmsManager.js
+@BINPATH@/components/AlarmsManager.manifest
 @BINPATH@/components/FeedProcessor.manifest
 @BINPATH@/components/FeedProcessor.js
 @BINPATH@/components/BrowserFeeds.manifest
 @BINPATH@/components/FeedConverter.js
 @BINPATH@/components/FeedWriter.js
 @BINPATH@/components/fuelApplication.manifest
 @BINPATH@/components/fuelApplication.js
 @BINPATH@/components/WebContentConverter.js

--- a/browser/app/profile/firefox.js
+++ b/browser/app/profile/firefox.js
@@ -1018,17 +1018,17 @@ pref("services.sync.prefs.sync.signon.re
 pref("services.sync.prefs.sync.spellchecker.dictionary", true);
 pref("services.sync.prefs.sync.xpinstall.whitelist.required", true);
 #endif
 
 // Disable the error console
 pref("devtools.errorconsole.enabled", false);
 
 // Developer toolbar and GCLI preferences
-pref("devtools.toolbar.enabled", false);
+pref("devtools.toolbar.enabled", true);
 pref("devtools.toolbar.visible", false);
 pref("devtools.gcli.allowSet", false);
 pref("devtools.commands.dir", "");
 
 // Enable the Inspector
 pref("devtools.inspector.enabled", true);
 pref("devtools.inspector.htmlHeight", 112);
 pref("devtools.inspector.htmlPanelOpen", false);
@@ -1068,16 +1068,21 @@ pref("devtools.tilt.intro_transition", t
 pref("devtools.tilt.outro_transition", true);
 
 // Enable the rules view
 pref("devtools.ruleview.enabled", true);
 
 // Enable the Scratchpad tool.
 pref("devtools.scratchpad.enabled", true);
 
+// The maximum number of recently-opened files stored.
+// Setting this preference to 0 will not clear any recent files, but rather hide
+// the 'Open Recent'-menu.
+pref("devtools.scratchpad.recentFilesMax", 10);
+
 // Enable the Style Editor.
 pref("devtools.styleeditor.enabled", true);
 pref("devtools.styleeditor.transitions", true);
 
 // Enable tools for Chrome development.
 pref("devtools.chrome.enabled", false);
 
 // Display the introductory text
@@ -1172,8 +1177,11 @@ pref("pdfjs.firstRun", true);
 // became the default.
 pref("pdfjs.previousHandler.preferredAction", 0);
 pref("pdfjs.previousHandler.alwaysAskBeforeHandling", false);
 
 // The maximum amount of decoded image data we'll willingly keep around (we
 // might keep around more than this, but we'll try to get down to this value).
 // (This is intentionally on the high side; see bug 746055.)
 pref("image.mem.max_decoded_image_kb", 256000);
+
+// Example social provider
+pref("social.manifest.motown", "{\"origin\":\"https://motown-dev.mozillalabs.com\",\"name\":\"MoTown\",\"workerURL\":\"https://motown-dev.mozillalabs.com/social/worker.js\"}");

--- a/browser/base/content/browser-appmenu.inc
+++ b/browser/base/content/browser-appmenu.inc
@@ -113,17 +113,17 @@
                 key="key_find"/>
       <menuseparator class="appmenu-menuseparator"/>
       <menuitem id="appmenu_savePage"
                 class="menuitem-tooltip"
                 label="&savePageCmd.label;"
                 command="Browser:SavePage"
                 key="key_savePage"/>
       <menuitem id="appmenu_sendLink"
-                label="&sendPageCmd.label;"
+                label="&emailPageCmd.label;"
                 command="Browser:SendLink"/>
       <splitmenu id="appmenu_print"
                  iconic="true"
                  label="&printCmd.label;"
                  command="cmd_print">
           <menupopup>
             <menuitem id="appmenu_print_popup"
                       class="menuitem-iconic"

--- a/browser/base/content/browser-context.inc
+++ b/browser/base/content/browser-context.inc
@@ -32,20 +32,16 @@
       <menuitem id="context-bookmarklink"
                 label="&bookmarkThisLinkCmd.label;"
                 accesskey="&bookmarkThisLinkCmd.accesskey;"
                 oncommand="gContextMenu.bookmarkLink();"/>
       <menuitem id="context-savelink"
                 label="&saveLinkCmd.label;"
                 accesskey="&saveLinkCmd.accesskey;"
                 oncommand="gContextMenu.saveLink();"/>
-      <menuitem id="context-sendlink"
-                label="&sendLinkCmd.label;"
-                accesskey="&sendLinkCmd.accesskey;"
-                oncommand="gContextMenu.sendLink();"/>
       <menuitem id="context-copyemail"
                 label="&copyEmailCmd.label;"
                 accesskey="&copyEmailCmd.accesskey;"
                 oncommand="gContextMenu.copyEmail();"/>
       <menuitem id="context-copylink"
                 label="&copyLinkCmd.label;"
                 accesskey="&copyLinkCmd.accesskey;"
                 oncommand="goDoCommand('cmd_copyLink');"/>
@@ -124,18 +120,18 @@
                 accesskey="&copyAudioURLCmd.accesskey;"
                 oncommand="gContextMenu.copyMediaLocation();"/>
       <menuseparator id="context-sep-copyimage"/>
       <menuitem id="context-saveimage"
                 label="&saveImageCmd.label;"
                 accesskey="&saveImageCmd.accesskey;"
                 oncommand="gContextMenu.saveMedia();"/>
       <menuitem id="context-sendimage"
-                label="&sendImageCmd.label;"
-                accesskey="&sendImageCmd.accesskey;"
+                label="&emailImageCmd.label;"
+                accesskey="&emailImageCmd.accesskey;"
                 oncommand="gContextMenu.sendMedia();"/>
       <menuitem id="context-setDesktopBackground"
                 label="&setDesktopBackgroundCmd.label;"
                 accesskey="&setDesktopBackgroundCmd.accesskey;"
                 oncommand="gContextMenu.setDesktopBackground();"/>
       <menuitem id="context-viewimageinfo"
                 label="&viewImageInfoCmd.label;"
                 accesskey="&viewImageInfoCmd.accesskey;"
@@ -148,22 +144,22 @@
                 label="&saveAudioCmd.label;"
                 accesskey="&saveAudioCmd.accesskey;"
                 oncommand="gContextMenu.saveMedia();"/>
       <menuitem id="context-video-saveimage"
                 accesskey="&videoSaveImage.accesskey;"
                 label="&videoSaveImage.label;"
                 oncommand="gContextMenu.saveVideoFrameAsImage();"/>
       <menuitem id="context-sendvideo"
-                label="&sendVideoCmd.label;"
-                accesskey="&sendVideoCmd.accesskey;"
+                label="&emailVideoCmd.label;"
+                accesskey="&emailVideoCmd.accesskey;"
                 oncommand="gContextMenu.sendMedia();"/>
       <menuitem id="context-sendaudio"
-                label="&sendAudioCmd.label;"
-                accesskey="&sendAudioCmd.accesskey;"
+                label="&emailAudioCmd.label;"
+                accesskey="&emailAudioCmd.accesskey;"
                 oncommand="gContextMenu.sendMedia();"/>
       <menuitem id="context-back"
                 label="&backCmd.label;"
                 accesskey="&backCmd.accesskey;"
                 command="Browser:BackOrBackDuplicate"
                 onclick="checkForMiddleClick(this, event);"/>
       <menuitem id="context-forward"
                 label="&forwardCmd.label;"
@@ -183,20 +179,16 @@
       <menuitem id="context-bookmarkpage"
                 label="&bookmarkPageCmd2.label;"
                 accesskey="&bookmarkPageCmd2.accesskey;"
                 oncommand="gContextMenu.bookmarkThisPage();"/>
       <menuitem id="context-savepage"
                 label="&savePageCmd.label;"
                 accesskey="&savePageCmd.accesskey2;"
                 oncommand="gContextMenu.savePageAs();"/>
-      <menuitem id="context-sendpage"
-                label="&sendPageCmd.label;"
-                accesskey="&sendPageCmd.accesskey;"
-                oncommand="gContextMenu.sendPage();"/>
       <menuseparator id="context-sep-viewbgimage"/>
       <menuitem id="context-viewbgimage"
                 label="&viewBGImageCmd.label;"
                 accesskey="&viewBGImageCmd.accesskey;"
                 oncommand="gContextMenu.viewBGImage(event);"
                 onclick="checkForMiddleClick(this, event);"/>
       <menuitem id="context-undo"
                 label="&undoCmd.label;"

--- a/browser/base/content/browser-menubar.inc
+++ b/browser/base/content/browser-menubar.inc
@@ -48,18 +48,18 @@
                           accesskey="&closeWindow.accesskey;"/>
                 <menuseparator/>
                 <menuitem id="menu_savePage"
                           label="&savePageCmd.label;"
                           accesskey="&savePageCmd.accesskey;"
                           key="key_savePage"
                           command="Browser:SavePage"/>
                 <menuitem id="menu_sendLink"
-                          label="&sendPageCmd.label;"
-                          accesskey="&sendPageCmd.accesskey;"
+                          label="&emailPageCmd.label;"
+                          accesskey="&emailPageCmd.accesskey;"
                           command="Browser:SendLink"/>
                 <menuseparator/>
                 <menuitem id="menu_printSetup"
                           label="&printSetupCmd.label;"
                           accesskey="&printSetupCmd.accesskey;"
                           command="cmd_pageSetup"/>
 #ifndef XP_MACOSX
                 <menuitem id="menu_printPreview"
@@ -514,17 +514,16 @@
                     label="&webDeveloperMenu.label;"
                     accesskey="&webDeveloperMenu.accesskey;">
                 <menupopup id="menuWebDeveloperPopup">
                   <menuitem id="menu_devToolbar"
                             type="checkbox"
                             autocheck="false"
                             hidden="true"
                             label="&devToolbarMenu.label;"
-                            accesskey="&devToolbarMenu.accesskey;"
                             key="key_devToolbar"
                             command="Tools:DevToolbar"/>
                   <menuitem id="webConsole"
                             type="checkbox"
                             label="&webConsoleCmd.label;"
                             accesskey="&webConsoleCmd.accesskey;"
                             key="key_webConsole"
                             command="Tools:WebConsole"/>

--- a/browser/base/content/browser-sets.inc
+++ b/browser/base/content/browser-sets.inc
@@ -220,23 +220,16 @@
 #ifdef XP_GNOME
     <key id="key_search2" key="&searchFocusUnix.commandkey;" command="Tools:Search" modifiers="accel"/>
     <key id="key_openDownloads" key="&downloadsUnix.commandkey;" command="Tools:Downloads" modifiers="accel,shift"/>
 #else
     <key id="key_openDownloads" key="&downloads.commandkey;" command="Tools:Downloads" modifiers="accel"/>
 #endif
     <key id="key_openAddons" key="&addons.commandkey;" command="Tools:Addons" modifiers="accel,shift"/>
     <key id="key_errorConsole" key="&errorConsoleCmd.commandkey;" oncommand="toJavaScriptConsole();" modifiers="accel,shift" disabled="true"/>
-    <key id="key_devToolbar" key="&devToolbar.commandkey;" command="Tools:DevToolbar"
-#ifdef XP_MACOSX
-         modifiers="accel,alt"
-#else
-         modifiers="accel,shift"
-#endif
-    />
     <key id="key_webConsole" key="&webConsoleCmd.commandkey;" oncommand="HUDConsoleUI.toggleHUD();"
 #ifdef XP_MACOSX
         modifiers="accel,alt"
 #else
         modifiers="accel,shift"
 #endif
     />
     <key id="key_debugger" key="&debuggerMenu.commandkey;" command="Tools:Debugger"

--- a/browser/base/content/browser.css
+++ b/browser/base/content/browser.css
@@ -563,16 +563,26 @@ html|*#gcli-output-frame,
 }
 
 .gclitoolbar-input-node,
 .gclitoolbar-complete-node,
 .gclitoolbar-prompt {
   direction: ltr;
 }
 
+#developer-toolbar-webconsole[error-count] > .toolbarbutton-icon {
+  display: none;
+}
+
+#developer-toolbar-webconsole[error-count]:before {
+  content: attr(error-count);
+  display: -moz-box;
+  -moz-box-pack: center;
+}
+
 /* Responsive Mode */
 
 vbox[anonid=browserContainer][responsivemode] {
   overflow: auto;
 }
 
 .devtools-responsiveui-toolbar:-moz-locale-dir(rtl) {
   -moz-box-pack: end;

--- a/browser/base/content/browser.js
+++ b/browser/base/content/browser.js
@@ -1395,17 +1395,17 @@ var gBrowserInit = {
       document.getElementById("menu_devToolbar").hidden = false;
       document.getElementById("Tools:DevToolbar").removeAttribute("disabled");
 #ifdef MENUBAR_CAN_AUTOHIDE
       document.getElementById("appmenu_devToolbar").hidden = false;
 #endif
 
       // Show the toolbar if it was previously visible
       if (gPrefService.getBoolPref("devtools.toolbar.visible")) {
-        DeveloperToolbar.show();
+        DeveloperToolbar.show(false);
       }
     }
 
     // Enable Inspector?
     let enabled = gPrefService.getBoolPref("devtools.inspector.enabled");
     if (enabled) {
       document.getElementById("menu_pageinspect").hidden = false;
       document.getElementById("Tools:Inspect").removeAttribute("disabled");
@@ -2605,23 +2605,26 @@ function BrowserOnClick(event) {
 
         let notificationBox = gBrowser.getNotificationBox();
         let value = "blocked-badware-page";
 
         let previousNotification = notificationBox.getNotificationWithValue(value);
         if (previousNotification)
           notificationBox.removeNotification(previousNotification);
 
-        notificationBox.appendNotification(
+        let notification = notificationBox.appendNotification(
           title,
           value,
           "chrome://global/skin/icons/blacklist_favicon.png",
           notificationBox.PRIORITY_CRITICAL_HIGH,
           buttons
         );
+        // Persist the notification until the user removes so it
+        // doesn't get removed on redirects.
+        notification.persistence = -1;
       }
     }
     else if (/^about:home$/i.test(ownerDoc.documentURI)) {
       if (ot == ownerDoc.getElementById("restorePreviousSession")) {
         let ss = Cc["@mozilla.org/browser/sessionstore;1"].
                  getService(Ci.nsISessionStore);
         if (ss.canRestoreLastSession)
           ss.restoreLastSession();
@@ -5256,20 +5259,19 @@ function middleMousePaste(event) {
   try {
     addToUrlbarHistory(url);
   } catch (ex) {
     // Things may go wrong when adding url to session history,
     // but don't let that interfere with the loading of the url.
     Cu.reportError(ex);
   }
 
-  // FIXME: Bug 631500, use openUILink directly
-  let where = whereToOpenLink(event, true);
-  openUILinkIn(url, where,
-               { disallowInheritPrincipal: !mayInheritPrincipal.value });
+  openUILink(url, event,
+             { ignoreButton: true,
+               disallowInheritPrincipal: !mayInheritPrincipal.value });
 
   event.stopPropagation();
 }
 
 function handleDroppedLink(event, url, name)
 {
   let postData = { };
   let uri = getShortcutOrURI(url, postData);
@@ -6909,38 +6911,53 @@ function getTabModalPromptBox(aWindow) {
 function getBrowser() gBrowser;
 function getNavToolbox() gNavToolbox;
 
 let gPrivateBrowsingUI = {
   _privateBrowsingService: null,
   _searchBarValue: null,
   _findBarValue: null,
   _inited: false,
+  _initCallbacks: [],
 
   init: function PBUI_init() {
     Services.obs.addObserver(this, "private-browsing", false);
     Services.obs.addObserver(this, "private-browsing-transition-complete", false);
 
     this._privateBrowsingService = Cc["@mozilla.org/privatebrowsing;1"].
                                    getService(Ci.nsIPrivateBrowsingService);
 
     if (this.privateBrowsingEnabled)
       this.onEnterPrivateBrowsing(true);
 
     this._inited = true;
+
+    this._initCallbacks.forEach(function (callback) callback.apply());
+    this._initCallbacks = [];
   },
 
   uninit: function PBUI_unint() {
     if (!this._inited)
       return;
 
     Services.obs.removeObserver(this, "private-browsing");
     Services.obs.removeObserver(this, "private-browsing-transition-complete");
   },
 
+  get initialized() {
+    return this._inited;
+  },
+
+  addInitializationCallback: function PBUI_addInitializationCallback(aCallback) {
+    if (this._inited)
+      return;
+
+    this._initCallbacks.push(aCallback);
+  },
+
   get _disableUIOnToggle() {
     if (this._privateBrowsingService.autoStarted)
       return false;
 
     try {
       return !gPrefService.getBoolPref("browser.privatebrowsing.keep_current_session");
     }
     catch (e) {
@@ -7133,24 +7150,26 @@ let gPrivateBrowsingUI = {
     if (!this.privateBrowsingEnabled)
       if (!this._shouldEnter())
         return;
 
     this._privateBrowsingService.privateBrowsingEnabled =
       !this.privateBrowsingEnabled;
   },
 
+  get autoStarted() {
+    return this._privateBrowsingService.autoStarted;
+  },
+
   get privateBrowsingEnabled() {
     return this._privateBrowsingService.privateBrowsingEnabled;
   },
 
   /**
-   * These accessors are used to support per-window Private Browsing mode.
-   * For now the getter returns nsIPrivateBrowsingService.privateBrowsingEnabled,
-   * and the setter should only be used in tests.
+   * This accessor is used to support per-window Private Browsing mode.
    */
   get privateWindow() {
     if (!gBrowser)
       return false;
 
     return gBrowser.docShell.QueryInterface(Ci.nsILoadContext)
                             .usePrivateBrowsing;
   }

--- a/browser/base/content/browser.xul
+++ b/browser/base/content/browser.xul
@@ -1032,31 +1032,31 @@
             <hbox class="gclitoolbar-prompt">
               <label class="gclitoolbar-prompt-label">&#187;</label>
             </hbox>
             <hbox class="gclitoolbar-complete-node"/>
             <textbox class="gclitoolbar-input-node" rows="1"/>
           </stack>
           <toolbarbutton id="developer-toolbar-webconsole"
                          label="&webConsoleButton.label;"
-                         class="devtools-toolbarbutton"
+                         class="developer-toolbar-button"
                          command="Tools:WebConsole"/>
           <toolbarbutton id="developer-toolbar-inspector"
                          label="&inspectorButton.label;"
-                         class="devtools-toolbarbutton"
+                         class="developer-toolbar-button"
                          hidden="true"
                          command="Tools:Inspect"/>
           <toolbarbutton id="developer-toolbar-styleeditor"
                          label="&styleeditor.label;"
-                         class="devtools-toolbarbutton"
+                         class="developer-toolbar-button"
                          hidden="true"
                          command="Tools:StyleEditor"/>
           <toolbarbutton id="developer-toolbar-debugger"
                          label="&debuggerMenu.label2;"
-                         class="devtools-toolbarbutton"
+                         class="developer-toolbar-button"
                          hidden="true"
                          command="Tools:Debugger"/>
 #ifndef XP_MACOSX
           <toolbarbutton id="developer-toolbar-closebutton"
                          class="devtools-closebutton"
                          oncommand="DeveloperToolbar.hide();"
                          tooltiptext="&devToolbarCloseButton.tooltiptext;"/>
 #endif

--- a/browser/base/content/newtab/drag.js
+++ b/browser/base/content/newtab/drag.js
@@ -33,20 +33,23 @@ let gDrag = {
    * @param aSite The site that's being dragged.
    * @param aEvent The 'dragstart' event.
    */
   start: function Drag_start(aSite, aEvent) {
     this._draggedSite = aSite;
 
     // Mark nodes as being dragged.
     let selector = ".newtab-site, .newtab-control, .newtab-thumbnail";
-    let nodes = aSite.node.parentNode.querySelectorAll(selector);
+    let parentCell = aSite.node.parentNode;
+    let nodes = parentCell.querySelectorAll(selector);
     for (let i = 0; i < nodes.length; i++)
       nodes[i].setAttribute("dragged", "true");
 
+    parentCell.setAttribute("dragged", "true");
+
     this._setDragData(aSite, aEvent);
 
     // Store the cursor offset.
     let node = aSite.node;
     let rect = node.getBoundingClientRect();
     this._offsetX = aEvent.clientX - rect.left;
     this._offsetY = aEvent.clientY - rect.top;
 
@@ -83,17 +86,17 @@ let gDrag = {
   },
 
   /**
    * Ends the current drag operation.
    * @param aSite The site that's being dragged.
    * @param aEvent The 'dragend' event.
    */
   end: function Drag_end(aSite, aEvent) {
-    let nodes = aSite.node.parentNode.querySelectorAll("[dragged]");
+    let nodes = gGrid.node.querySelectorAll("[dragged]")
     for (let i = 0; i < nodes.length; i++)
       nodes[i].removeAttribute("dragged");
 
     // Slide the dragged site back into its cell (may be the old or the new cell).
     gTransformation.slideSiteTo(aSite, aSite.cell, {unfreeze: true});
 
     this._draggedSite = null;
   },

--- a/browser/base/content/nsContextMenu.js
+++ b/browser/base/content/nsContextMenu.js
@@ -143,18 +143,19 @@ nsContextMenu.prototype = {
   },
 
   initNavigationItems: function CM_initNavigationItems() {
     var shouldShow = !(this.isContentSelected || this.onLink || this.onImage ||
                        this.onCanvas || this.onVideo || this.onAudio ||
                        this.onTextInput);
     this.showItem("context-back", shouldShow);
     this.showItem("context-forward", shouldShow);
-    this.showItem("context-reload", shouldShow);
-    this.showItem("context-stop", shouldShow);
+    var shouldShowReload = XULBrowserWindow.stopCommand.getAttribute("disabled") == "true";
+    this.showItem("context-reload", shouldShow && shouldShowReload);
+    this.showItem("context-stop", shouldShow && !shouldShowReload);
     this.showItem("context-sep-stop", shouldShow);
 
     // XXX: Stop is determined in browser.js; the canStop broadcaster is broken
     //this.setItemAttrFromNode( "context-stop", "disabled", "canStop" );
   },
 
   initLeaveDOMFullScreenItems: function CM_initLeaveFullScreenItem() {
     // only show the option if the user is in DOM fullscreen
@@ -166,21 +167,19 @@ nsContextMenu.prototype = {
         this.showItem("context-media-sep-commands", true);
   },
 
   initSaveItems: function CM_initSaveItems() {
     var shouldShow = !(this.onTextInput || this.onLink ||
                        this.isContentSelected || this.onImage ||
                        this.onCanvas || this.onVideo || this.onAudio);
     this.showItem("context-savepage", shouldShow);
-    this.showItem("context-sendpage", shouldShow);
 
-    // Save+Send link depends on whether we're in a link, or selected text matches valid URL pattern.
+    // Save link depends on whether we're in a link, or selected text matches valid URL pattern.
     this.showItem("context-savelink", this.onSaveableLink || this.onPlainTextLink);
-    this.showItem("context-sendlink", this.onSaveableLink || this.onPlainTextLink);
 
     // Save image depends on having loaded its content, video and audio don't.
     this.showItem("context-saveimage", this.onLoadedImage || this.onCanvas);
     this.showItem("context-savevideo", this.onVideo);
     this.showItem("context-saveaudio", this.onAudio);
     this.showItem("context-video-saveimage", this.onVideo);
     this.setItemAttr("context-savevideo", "disabled", !this.mediaURL);
     this.setItemAttr("context-saveaudio", "disabled", !this.mediaURL);
@@ -1045,21 +1044,16 @@ nsContextMenu.prototype = {
       linkText = document.commandDispatcher.focusedWindow.getSelection().toString().trim();
     else
       linkText = this.linkText();
     urlSecurityCheck(this.linkURL, doc.nodePrincipal);
 
     this.saveHelper(this.linkURL, linkText, null, true, doc);
   },
 
-  sendLink: function() {
-    // we don't know the title of the link so pass in an empty string
-    MailIntegration.sendMessage( this.linkURL, "" );
-  },
-
   // Backwards-compatibility wrapper
   saveImage : function() {
     if (this.onCanvas || this.onImage)
         this.saveMedia();
   },
 
   // Save URL of the clicked upon image, video, or audio.
   saveMedia: function() {
@@ -1398,20 +1392,16 @@ nsContextMenu.prototype = {
                                        }, window.top);
     }
   },
 
   savePageAs: function CM_savePageAs() {
     saveDocument(this.browser.contentDocument);
   },
 
-  sendPage: function CM_sendPage() {
-    MailIntegration.sendLinkForWindow(this.browser.contentWindow);  
-  },
-
   printFrame: function CM_printFrame() {
     PrintUtils.print(this.target.ownerDocument.defaultView);
   },
 
   switchPageDirection: function CM_switchPageDirection() {
     SwitchDocumentDirection(this.browser.contentWindow);
   },
 

--- a/browser/base/content/pageinfo/pageInfo.xul
+++ b/browser/base/content/pageinfo/pageInfo.xul
@@ -349,27 +349,32 @@
               <radio id="geo#2" command="cmd_geoToggle" label="&permBlock;"/>
             </radiogroup>
           </hbox>
         </vbox>
         <vbox class="permission">
           <label class="permissionLabel" id="permIndexedDBLabel"
                  value="&permIndexedDB;" control="indexedDBRadioGroup"/>
           <hbox role="group" aria-labelledby="permIndexedDBLabel">
-            <checkbox id="indexedDBDef" command="cmd_indexedDBDef" label="&permAskAlways;"/>
+            <checkbox id="indexedDBDef" command="cmd_indexedDBDef" label="&permUseDefault;"/>
+            <spacer flex="1"/>
+            <radiogroup id="indexedDBRadioGroup" orient="horizontal">
+              <!-- Ask and Allow are purposefully reversed here! -->
+              <radio id="indexedDB#1" command="cmd_indexedDBToggle" label="&permAskAlways;"/>
+              <radio id="indexedDB#0" command="cmd_indexedDBToggle" label="&permAllow;"/>
+              <radio id="indexedDB#2" command="cmd_indexedDBToggle" label="&permBlock;"/>
+            </radiogroup>
+          </hbox>
+          <hbox>
             <spacer flex="1"/>
             <vbox pack="center">
-              <label id="indexedDBStatus" control="indexedDBClear"/>
+              <label id="indexedDBStatus" control="indexedDBClear" hidden="true"/>
             </vbox>
-            <button id="indexedDBClear" label="&permClearStorage;"
+            <button id="indexedDBClear" label="&permClearStorage;" hidden="true"
                     accesskey="&permClearStorage.accesskey;" onclick="onIndexedDBClear();"/>
-            <radiogroup id="indexedDBRadioGroup" orient="horizontal">
-              <radio id="indexedDB#1" command="cmd_indexedDBToggle" label="&permAllow;"/>
-              <radio id="indexedDB#2" command="cmd_indexedDBToggle" label="&permBlock;"/>
-            </radiogroup>
           </hbox>
         </vbox>
         <vbox class="permission" id="permPluginsRow">
           <label class="permissionLabel" id="permPluginsLabel"
                  value="&permPlugins;" control="pluginsRadioGroup"/>
           <hbox role="group" aria-labelledby="permPluginsLabel">
             <checkbox id="pluginsDef" command="cmd_pluginsDef" label="&permAskAlways;"/>
             <spacer flex="1"/>

--- a/browser/base/content/pageinfo/permissions.js
+++ b/browser/base/content/pageinfo/permissions.js
@@ -46,17 +46,17 @@ var gPermObj = {
     return BLOCK;
   },
   geo: function getGeoDefaultPermissions()
   {
     return BLOCK;
   },
   indexedDB: function getIndexedDBDefaultPermissions()
   {
-    return BLOCK;
+    return UNKNOWN;
   },
   plugins: function getPluginsDefaultPermissions()
   {
     if (gPrefs.getBoolPref("plugins.click_to_play"))
       return BLOCK;
     return ALLOW;
   },
   fullscreen: function getFullscreenDefaultPermissions()
@@ -144,19 +144,16 @@ function onCheckboxClick(aPartId)
 {
   var permissionManager = Components.classes[PERMISSION_CONTRACTID]
                                     .getService(nsIPermissionManager);
 
   var command  = document.getElementById("cmd_" + aPartId + "Toggle");
   var checkbox = document.getElementById(aPartId + "Def");
   if (checkbox.checked) {
     permissionManager.remove(gPermURI.host, aPartId);
-    if (aPartId == "indexedDB") {
-      permissionManager.remove(gPermURI.host, "indexedDB-unlimited");
-    }
     command.setAttribute("disabled", "true");
     var perm = gPermObj[aPartId]();
     setRadioState(aPartId, perm);
   }
   else {
     onRadioClick(aPartId);
     command.removeAttribute("disabled");
   }
@@ -166,17 +163,18 @@ function onRadioClick(aPartId)
 {
   var permissionManager = Components.classes[PERMISSION_CONTRACTID]
                                     .getService(nsIPermissionManager);
 
   var radioGroup = document.getElementById(aPartId + "RadioGroup");
   var id = radioGroup.selectedItem.id;
   var permission = id.split('#')[1];
   permissionManager.add(gPermURI, aPartId, permission);
-  if (aPartId == "indexedDB" && permission == BLOCK) {
+  if (aPartId == "indexedDB" &&
+      (permission == ALLOW || permission == BLOCK)) {
     permissionManager.remove(gPermURI.host, "indexedDB-unlimited");
   }
   if (aPartId == "fullscreen" && permission == UNKNOWN) {
     permissionManager.remove(gPermURI.host, "fullscreen");
   }  
 }
 
 function setRadioState(aPartId, aValue)
@@ -202,17 +200,16 @@ function initIndexedDBRow()
 function onIndexedDBClear()
 {
   Components.classes["@mozilla.org/dom/indexeddb/manager;1"]
             .getService(nsIIndexedDatabaseManager)
             .clearDatabasesForURI(gPermURI);
 
   var permissionManager = Components.classes[PERMISSION_CONTRACTID]
                                     .getService(nsIPermissionManager);
-  permissionManager.remove(gPermURI.host, "indexedDB");
   permissionManager.remove(gPermURI.host, "indexedDB-unlimited");
   initIndexedDBRow();
 }
 
 function onIndexedDBUsageCallback(uri, usage, fileUsage)
 {
   if (!uri.equals(gPermURI)) {
     throw new Error("Callback received for bad URI: " + uri);

--- a/browser/base/content/tabbrowser.xml
+++ b/browser/base/content/tabbrowser.xml
@@ -1408,20 +1408,19 @@
         <![CDATA[
           var tabsToClose = (aAll ?
                                this.tabs.length - this._removingTabs.length :
                                this.visibleTabs.length - 1)
                             - gBrowser._numPinnedTabs;
           if (tabsToClose <= 1)
             return true;
 
+          var canDisablePrompt = !!aAll;
           const pref = "browser.tabs.warnOnClose";
-          var shouldPrompt = Services.prefs.getBoolPref(pref);
-
-          if (!shouldPrompt)
+          if (canDisablePrompt && !Services.prefs.getBoolPref(pref))
             return true;
 
           var ps = Services.prompt;
 
           // default to true: if it were false, we wouldn't get this far
           var warnOnClose = { value: true };
           var bundle = this.mStringBundle;
 
@@ -1435,21 +1434,23 @@
             ps.confirmEx(window,
                          bundle.getString("tabs.closeWarningTitle"),
                          bundle.getFormattedString("tabs.closeWarningMultipleTabs",
                                                    [tabsToClose]),
                          (ps.BUTTON_TITLE_IS_STRING * ps.BUTTON_POS_0)
                          + (ps.BUTTON_TITLE_CANCEL * ps.BUTTON_POS_1),
                          bundle.getString("tabs.closeButtonMultiple"),
                          null, null,
-                         bundle.getString('tabs.closeWarningPromptMe'),
+                         canDisablePrompt ?
+                           bundle.getString("tabs.closeWarningPromptMe") : null,
                          warnOnClose);
           var reallyClose = (buttonPressed == 0);
+
           // don't set the pref unless they press OK and it's false
-          if (reallyClose && !warnOnClose.value)
+          if (canDisablePrompt && reallyClose && !warnOnClose.value)
             Services.prefs.setBoolPref(pref, false);
 
           return reallyClose;
         ]]>
       </body>
       </method>
 
       <method name="removeAllTabsBut">

--- a/browser/base/content/test/Makefile.in
+++ b/browser/base/content/test/Makefile.in
@@ -148,16 +148,17 @@ endif
                  browser_bug655584.js \
                  browser_bug664672.js \
                  browser_bug710878.js \
                  browser_bug719271.js \
                  browser_bug735471.js \
                  browser_bug743421.js \
                  browser_bug749738.js \
                  browser_bug763468.js \
+                 browser_bug767836.js \
                  browser_canonizeURL.js \
                  browser_customize.js \
                  browser_findbarClose.js \
                  browser_homeDrop.js \
                  browser_keywordBookmarklets.js \
                  browser_contextSearchTabPosition.js \
                  browser_ctrlTab.js \
                  browser_customize_popupNotification.js \

--- a/browser/base/content/test/browser_bug477014.js
+++ b/browser/base/content/test/browser_bug477014.js
@@ -6,22 +6,22 @@
 const iconURLSpec = "data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAABAAAAAQCAYAAAAf8/9hAAAABGdBTUEAAK/INwWK6QAAABl0RVh0U29mdHdhcmUAQWRvYmUgSW1hZ2VSZWFkeXHJZTwAAAHWSURBVHjaYvz//z8DJQAggJiQOe/fv2fv7Oz8rays/N+VkfG/iYnJfyD/1+rVq7ffu3dPFpsBAAHEAHIBCJ85c8bN2Nj4vwsDw/8zQLwKiO8CcRoQu0DxqlWrdsHUwzBAAIGJmTNnPgYa9j8UqhFElwPxf2MIDeIrKSn9FwSJoRkAEEAM0DD4DzMAyPi/G+QKY4hh5WAXGf8PDQ0FGwJ22d27CjADAAIIrLmjo+MXA9R2kAHvGBA2wwx6B8W7od6CeQcggKCmCEL8bgwxYCbUIGTDVkHDBia+CuotgACCueD3TDQN75D4xmAvCoK9ARMHBzAw0AECiBHkAlC0Mdy7x9ABNA3obAZXIAa6iKEcGlMVQHwWyjYuL2d4v2cPg8vZswx7gHyAAAK7AOif7SAbOqCmn4Ha3AHFsIDtgPq/vLz8P4MSkJ2W9h8ggBjevXvHDo4FQUQg/kdypqCg4H8lUIACnQ/SOBMYI8bAsAJFPcj1AAEEjwVQqLpAbXmH5BJjqI0gi9DTAAgDBBCcAVLkgmQ7yKCZxpCQxqUZhAECCJ4XgMl493ug21ZD+aDAXH0WLM4A9MZPXJkJIIAwTAR5pQMalaCABQUULttBGCCAGCnNzgABBgAMJ5THwGvJLAAAAABJRU5ErkJggg==";
 var testPage="data:text/plain,test bug 477014";
 
 function test() {
   waitForExplicitFinish();
 
   var newWindow;
   var tabToDetach;
+  var documentToDetach;
 
   function onPageShow(event) {
     // we get here if the test is executed before the pageshow
     // event for the window's first tab
-    if (!tabToDetach ||
-        tabToDetach.linkedBrowser.contentDocument != event.target)
+    if (!tabToDetach || documentToDetach != event.target)
       return;
 
     event.currentTarget.removeEventListener("pageshow", onPageShow, false);
 
     if (!newWindow) {
       // prepare the tab (set icon and busy state)
       // we have to set these only after onState* notification, otherwise
       // they're overriden
@@ -41,11 +41,15 @@ function test() {
     }
 
     is(newWindow.gBrowser.selectedTab.hasAttribute("busy"), true);
     is(newWindow.gBrowser.getIcon(), iconURLSpec);
     newWindow.close();
     finish();
   }
 
-  gBrowser.addEventListener("pageshow", onPageShow, false);
   tabToDetach = gBrowser.addTab(testPage);
+  tabToDetach.linkedBrowser.addEventListener("load", function onLoad() {
+    tabToDetach.linkedBrowser.removeEventListener("load", onLoad, true);
+    documentToDetach = tabToDetach.linkedBrowser.contentDocument;
+    gBrowser.addEventListener("pageshow", onPageShow, false);
+  }, true);
 }

new file mode 100644
--- /dev/null
+++ b/browser/base/content/test/browser_bug767836.js
@@ -0,0 +1,93 @@
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this file,
+ * You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+// initialization
+const pb = Cc["@mozilla.org/privatebrowsing;1"].
+           getService(Ci.nsIPrivateBrowsingService);
+const PREF = "browser.newtab.url";
+const NEWTABURL = Services.prefs.getCharPref(PREF) || "about:blank";
+const TESTURL = "http://example.com/";
+  
+function test() {
+
+  waitForExplicitFinish();
+  // check whether the mode that we start off with is normal or not
+  ok(!pb.privateBrowsingEnabled, "private browsing is disabled");
+  // check whether any custom new tab url has been configured
+  ok(!Services.prefs.prefHasUserValue(PREF), "No custom newtab url is set");
+  
+  openNewTab(function () {
+    // Check the new tab opened while in normal mode
+    is(gBrowser.selectedBrowser.currentURI.spec, NEWTABURL,
+       "URL of NewTab should be browser.newtab.url in Normal mode");
+    // Set the custom newtab url
+    Services.prefs.setCharPref(PREF, TESTURL);
+    ok(Services.prefs.prefHasUserValue(PREF), "Custom newtab url is set");
+    
+    // Open a newtab after setting the custom newtab url
+    openNewTab(function () {
+      is(gBrowser.selectedBrowser.currentURI.spec, TESTURL,
+         "URL of NewTab should be the custom url");
+      
+      // clear the custom url preference
+      Services.prefs.clearUserPref(PREF);
+      ok(!Services.prefs.prefHasUserValue(PREF), "No custom newtab url is set");
+      
+      // enter private browsing mode
+      togglePrivateBrowsing(function () {
+        ok(pb.privateBrowsingEnabled, "private browsing is enabled");
+        
+        // Open a new tab page in private browsing mode
+        openNewTab(function () {
+          // Check the new tab opened while in private browsing mode
+          is(gBrowser.selectedBrowser.currentURI.spec, "about:privatebrowsing",
+             "URL of NewTab should be about:privatebrowsing in PB mode");
+          
+          Services.prefs.setCharPref(PREF, TESTURL);
+          ok(Services.prefs.prefHasUserValue(PREF), "Custom newtab url is set");
+          
+          // Open a newtab after setting the custom newtab url
+          openNewTab(function () {
+            is(gBrowser.selectedBrowser.currentURI.spec, TESTURL,
+               "URL of NewTab should be the custom url");
+
+            Services.prefs.clearUserPref(PREF);
+            ok(!Services.prefs.prefHasUserValue(PREF), "No custom newtab url is set");
+            
+            // exit private browsing mode
+            togglePrivateBrowsing(function () {
+              ok(!pb.privateBrowsingEnabled, "private browsing is disabled");
+              
+              gBrowser.removeTab(gBrowser.selectedTab);
+              gBrowser.removeTab(gBrowser.selectedTab);
+              finish();
+            });
+          });
+        });
+      });
+    });
+  });
+}
+
+function togglePrivateBrowsing(aCallback) {
+  let topic = "private-browsing-transition-complete";
+
+  Services.obs.addObserver(function observe() {
+    Services.obs.removeObserver(observe, topic);
+    executeSoon(aCallback);
+  }, topic, false);
+
+  pb.privateBrowsingEnabled = !pb.privateBrowsingEnabled;
+}
+
+function openNewTab(aCallback) {
+  // Open a new tab
+  BrowserOpenTab();
+  
+  let browser = gBrowser.selectedBrowser;
+  browser.addEventListener("load", function onLoad() {
+    browser.removeEventListener("load", onLoad, true);
+    executeSoon(aCallback);
+  }, true);
+}

--- a/browser/base/content/test/newtab/Makefile.in
+++ b/browser/base/content/test/newtab/Makefile.in
@@ -11,16 +11,17 @@ relativesrcdir  = browser/base/content/t
 include $(DEPTH)/config/autoconf.mk
 include $(topsrcdir)/config/rules.mk
 
 _BROWSER_FILES = \
 	browser_newtab_block.js \
 	browser_newtab_disable.js \
 	browser_newtab_drag_drop.js \
 	browser_newtab_drop_preview.js \
+	browser_newtab_focus.js \
 	browser_newtab_private_browsing.js \
 	browser_newtab_reset.js \
 	browser_newtab_tabsync.js \
 	browser_newtab_unpin.js \
 	browser_newtab_bug721442.js \
 	browser_newtab_bug722273.js \
 	browser_newtab_bug723102.js \
 	browser_newtab_bug723121.js \

--- a/browser/base/content/test/newtab/browser_newtab_block.js
+++ b/browser/base/content/test/newtab/browser_newtab_block.js
@@ -4,58 +4,58 @@
 /*
  * These tests make sure that blocking/removing sites from the grid works
  * as expected. Pinned tabs should not be moved. Gaps will be re-filled
  * if more sites are available.
  */
 function runTests() {
   // we remove sites and expect the gaps to be filled as long as there still
   // are some sites available
-  setLinks("0,1,2,3,4,5,6,7,8,9");
+  yield setLinks("0,1,2,3,4,5,6,7,8,9");
   setPinnedLinks("");
 
   yield addNewTabPageTab();
   checkGrid("0,1,2,3,4,5,6,7,8");
 
   yield blockCell(4);
   checkGrid("0,1,2,3,5,6,7,8,9");
 
   yield blockCell(4);
   checkGrid("0,1,2,3,6,7,8,9,");
 
   yield blockCell(4);
   checkGrid("0,1,2,3,7,8,9,,");
 
   // we removed a pinned site
   yield restore();
-  setLinks("0,1,2,3,4,5,6,7,8");
+  yield setLinks("0,1,2,3,4,5,6,7,8");
   setPinnedLinks(",1");
 
   yield addNewTabPageTab();
   checkGrid("0,1p,2,3,4,5,6,7,8");
 
   yield blockCell(1);
   checkGrid("0,2,3,4,5,6,7,8,");
 
   // we remove the last site on the grid (which is pinned) and expect the gap
   // to be re-filled and the new site to be unpinned
   yield restore();
-  setLinks("0,1,2,3,4,5,6,7,8,9");
+  yield setLinks("0,1,2,3,4,5,6,7,8,9");
   setPinnedLinks(",,,,,,,,8");
 
   yield addNewTabPageTab();
   checkGrid("0,1,2,3,4,5,6,7,8p");
 
   yield blockCell(8);
   checkGrid("0,1,2,3,4,5,6,7,9");
 
   // we remove the first site on the grid with the last one pinned. all cells
   // but the last one should shift to the left and a new site fades in
   yield restore();
-  setLinks("0,1,2,3,4,5,6,7,8,9");
+  yield setLinks("0,1,2,3,4,5,6,7,8,9");
   setPinnedLinks(",,,,,,,,8");
 
   yield addNewTabPageTab();
   checkGrid("0,1,2,3,4,5,6,7,8p");
 
   yield blockCell(0);
   checkGrid("1,2,3,4,5,6,7,9,8p");
 }

--- a/browser/base/content/test/newtab/browser_newtab_bug721442.js
+++ b/browser/base/content/test/newtab/browser_newtab_bug721442.js
@@ -1,23 +1,23 @@
 /* Any copyright is dedicated to the Public Domain.
    http://creativecommons.org/publicdomain/zero/1.0/ */
 
 function runTests() {
-  setLinks("0,1,2,3,4,5,6,7,8");
-  NewTabUtils.pinnedLinks._links = [
-    {url: "about:blank#7", title: ""},
-    {url: "about:blank#8", title: "title"},
-    {url: "about:blank#9", title: "about:blank#9"}
-  ];
+  yield setLinks("0,1,2,3,4,5,6,7,8");
+  setPinnedLinks([
+    {url: "http://example.com/#7", title: ""},
+    {url: "http://example.com/#8", title: "title"},
+    {url: "http://example.com/#9", title: "http://example.com/#9"}
+  ]);
 
   yield addNewTabPageTab();
   checkGrid("7p,8p,9p,0,1,2,3,4,5");
 
-  checkTooltip(0, "about:blank#7", "1st tooltip is correct");
-  checkTooltip(1, "title\nabout:blank#8", "2nd tooltip is correct");
-  checkTooltip(2, "about:blank#9", "3rd tooltip is correct");
+  checkTooltip(0, "http://example.com/#7", "1st tooltip is correct");
+  checkTooltip(1, "title\nhttp://example.com/#8", "2nd tooltip is correct");
+  checkTooltip(2, "http://example.com/#9", "3rd tooltip is correct");
 }
 
 function checkTooltip(aIndex, aExpected, aMessage) {
   let link = getCell(aIndex).node.querySelector(".newtab-link");
   is(link.getAttribute("title"), aExpected, aMessage);
 }

--- a/browser/base/content/test/newtab/browser_newtab_bug722273.js
+++ b/browser/base/content/test/newtab/browser_newtab_bug722273.js
@@ -1,59 +1,60 @@
 /* Any copyright is dedicated to the Public Domain.
    http://creativecommons.org/publicdomain/zero/1.0/ */
 
 const NOW = Date.now() * 1000;
 const URL = "http://fake-site.com/";
 
 let tmp = {};
-Cu.import("resource:///modules/NewTabUtils.jsm", tmp);
 Cc["@mozilla.org/moz/jssubscript-loader;1"]
   .getService(Ci.mozIJSSubScriptLoader)
   .loadSubScript("chrome://browser/content/sanitize.js", tmp);
 
-let {NewTabUtils, Sanitizer} = tmp;
-
-let bhist = Cc["@mozilla.org/browser/global-history;2"]
-  .getService(Ci.nsIBrowserHistory);
+let {Sanitizer} = tmp;
 
 function runTests() {
-  clearHistory();
-  yield fillHistory();
+  sanitizeHistory();
+  yield addFakeVisits();
   yield addNewTabPageTab();
 
   is(getCell(0).site.url, URL, "first site is our fake site");
 
   whenPagesUpdated();
-  yield clearHistory();
+  yield sanitizeHistory();
 
   ok(!getCell(0).site, "the fake site is gone");
 }
 
-function fillHistory() {
+function addFakeVisits() {
   let visits = [];
   for (let i = 59; i > 0; i--) {
     visits.push({
       visitDate: NOW - i * 60 * 1000000,
       transitionType: Ci.nsINavHistoryService.TRANSITION_LINK
     });
   }
   let place = {
     uri: makeURI(URL),
     title: "fake site",
     visits: visits
   };
   PlacesUtils.asyncHistory.updatePlaces(place, {
-    handleError: function () do_throw("Unexpected error in adding visit."),
-    handleResult: function () { },
-    handleCompletion: function () TestRunner.next()
+    handleError: function () ok(false, "couldn't add visit"),
+    handleResult: function () {},
+    handleCompletion: function () {
+      NewTabUtils.links.populateCache(function () {
+        NewTabUtils.allPages.update();
+        TestRunner.next();
+      }, true);
+    }
   });
 }
 
-function clearHistory() {
+function sanitizeHistory() {
   let s = new Sanitizer();
   s.prefDomain = "privacy.cpd.";
 
   let prefs = gPrefService.getBranch(s.prefDomain);
   prefs.setBoolPref("history", true);
   prefs.setBoolPref("downloads", false);
   prefs.setBoolPref("cache", false);
   prefs.setBoolPref("cookies", false);

--- a/browser/base/content/test/newtab/browser_newtab_bug723102.js
+++ b/browser/base/content/test/newtab/browser_newtab_bug723102.js
@@ -1,18 +1,18 @@
 /* Any copyright is dedicated to the Public Domain.
    http://creativecommons.org/publicdomain/zero/1.0/ */
 
 function runTests() {
   // create a new tab page and hide it.
-  setLinks("0,1,2,3,4,5,6,7,8");
+  yield setLinks("0,1,2,3,4,5,6,7,8");
   setPinnedLinks("");
 
   yield addNewTabPageTab();
   let firstTab = gBrowser.selectedTab;
 
   yield addNewTabPageTab();
   gBrowser.removeTab(firstTab);
 
-  ok(NewTabUtils.allPages.enabled, true, "page is enabled");
+  ok(NewTabUtils.allPages.enabled, "page is enabled");
   NewTabUtils.allPages.enabled = false;
   ok(getGrid().node.hasAttribute("page-disabled"), "page is disabled");
 }

--- a/browser/base/content/test/newtab/browser_newtab_bug723121.js
+++ b/browser/base/content/test/newtab/browser_newtab_bug723121.js
@@ -1,13 +1,13 @@
 /* Any copyright is dedicated to the Public Domain.
    http://creativecommons.org/publicdomain/zero/1.0/ */
 
 function runTests() {
-  setLinks("0,1,2,3,4,5,6,7,8");
+  yield setLinks("0,1,2,3,4,5,6,7,8");
   setPinnedLinks("");
 
   yield addNewTabPageTab();
   checkGridLocked(false, "grid is unlocked");
 
   let cell = getCell(0).node;
   let site = getCell(0).site.node;
   let link = site.querySelector(".newtab-link");

--- a/browser/base/content/test/newtab/browser_newtab_bug725996.js
+++ b/browser/base/content/test/newtab/browser_newtab_bug725996.js
@@ -1,23 +1,23 @@
 /* Any copyright is dedicated to the Public Domain.
    http://creativecommons.org/publicdomain/zero/1.0/ */
 
 function runTests() {
-  setLinks("0,1,2,3,4,5,6,7,8");
+  yield setLinks("0,1,2,3,4,5,6,7,8");
   setPinnedLinks("");
 
   yield addNewTabPageTab();
   checkGrid("0,1,2,3,4,5,6,7,8");
 
   let cell = getCell(0).node;
 
-  sendDragEvent("drop", cell, "about:blank#99\nblank");
-  is(NewTabUtils.pinnedLinks.links[0].url, "about:blank#99",
+  sendDragEvent("drop", cell, "http://example.com/#99\nblank");
+  is(NewTabUtils.pinnedLinks.links[0].url, "http://example.com/#99",
      "first cell is pinned and contains the dropped site");
 
   yield whenPagesUpdated();
   checkGrid("99p,0,1,2,3,4,5,6,7");
 
   sendDragEvent("drop", cell, "");
-  is(NewTabUtils.pinnedLinks.links[0].url, "about:blank#99",
+  is(NewTabUtils.pinnedLinks.links[0].url, "http://example.com/#99",
      "first cell is still pinned with the site we dropped before");
 }

--- a/browser/base/content/test/newtab/browser_newtab_bug734043.js
+++ b/browser/base/content/test/newtab/browser_newtab_bug734043.js
@@ -1,13 +1,13 @@
 /* Any copyright is dedicated to the Public Domain.
    http://creativecommons.org/publicdomain/zero/1.0/ */
 
 function runTests() {
-  setLinks("0,1,2,3,4,5,6,7,8");
+  yield setLinks("0,1,2,3,4,5,6,7,8");
   setPinnedLinks("");
 
   yield addNewTabPageTab();
   checkGrid("0,1,2,3,4,5,6,7,8");
 
   let receivedError = false;
   let block = getContentDocument().querySelector(".newtab-control-block");
 

--- a/browser/base/content/test/newtab/browser_newtab_bug735987.js
+++ b/browser/base/content/test/newtab/browser_newtab_bug735987.js
@@ -1,13 +1,13 @@
 /* Any copyright is dedicated to the Public Domain.
    http://creativecommons.org/publicdomain/zero/1.0/ */
 
 function runTests() {
-  setLinks("0,1,2,3,4,5,6,7,8");
+  yield setLinks("0,1,2,3,4,5,6,7,8");
   setPinnedLinks("");
 
   yield addNewTabPageTab();
   checkGrid("0,1,2,3,4,5,6,7,8");
 
   yield simulateDrop(1);
   checkGrid("0,99p,1,2,3,4,5,6,7");
 

--- a/browser/base/content/test/newtab/browser_newtab_disable.js
+++ b/browser/base/content/test/newtab/browser_newtab_disable.js
@@ -2,17 +2,17 @@
    http://creativecommons.org/publicdomain/zero/1.0/ */
 
 /*
  * These tests make sure that the 'New Tab Page' feature can be disabled if the
  * decides not to use it.
  */
 function runTests() {
   // create a new tab page and hide it.
-  setLinks("0,1,2,3,4,5,6,7,8");
+  yield setLinks("0,1,2,3,4,5,6,7,8");
   setPinnedLinks("");
 
   yield addNewTabPageTab();
   let gridNode = getGrid().node;
 
   ok(!gridNode.hasAttribute("page-disabled"), "page is not disabled");
 
   NewTabUtils.allPages.enabled = false;

--- a/browser/base/content/test/newtab/browser_newtab_drag_drop.js
+++ b/browser/base/content/test/newtab/browser_newtab_drag_drop.js
@@ -4,112 +4,112 @@
 /*
  * These tests make sure that dragging and dropping sites works as expected.
  * Sites contained in the grid need to shift around to indicate the result
  * of the drag-and-drop operation. If the grid is full and we're dragging
  * a new site into it another one gets pushed out.
  */
 function runTests() {
   // test a simple drag-and-drop scenario
-  setLinks("0,1,2,3,4,5,6,7,8");
+  yield setLinks("0,1,2,3,4,5,6,7,8");
   setPinnedLinks("");
 
   yield addNewTabPageTab();
   checkGrid("0,1,2,3,4,5,6,7,8");
 
   yield simulateDrop(1, 0);
   checkGrid("1,0p,2,3,4,5,6,7,8");
 
   // drag a cell to its current cell and make sure it's not pinned afterwards
-  setLinks("0,1,2,3,4,5,6,7,8");
+  yield setLinks("0,1,2,3,4,5,6,7,8");
   setPinnedLinks("");
 
   yield addNewTabPageTab();
   checkGrid("0,1,2,3,4,5,6,7,8");
 
   yield simulateDrop(0, 0);
   checkGrid("0,1,2,3,4,5,6,7,8");
 
   // ensure that pinned pages aren't moved if that's not necessary
-  setLinks("0,1,2,3,4,5,6,7,8");
+  yield setLinks("0,1,2,3,4,5,6,7,8");
   setPinnedLinks(",1,2");
 
   yield addNewTabPageTab();
   checkGrid("0,1p,2p,3,4,5,6,7,8");
 
   yield simulateDrop(3, 0);
   checkGrid("3,1p,2p,0p,4,5,6,7,8");
 
   // pinned sites should always be moved around as blocks. if a pinned site is
   // moved around, neighboring pinned are affected as well
-  setLinks("0,1,2,3,4,5,6,7,8");
+  yield setLinks("0,1,2,3,4,5,6,7,8");
   setPinnedLinks("0,1");
 
   yield addNewTabPageTab();
   checkGrid("0p,1p,2,3,4,5,6,7,8");
 
   yield simulateDrop(0, 2);
   checkGrid("2p,0p,1p,3,4,5,6,7,8");
 
   // pinned sites should not be pushed out of the grid (unless there are only
   // pinned ones left on the grid)
-  setLinks("0,1,2,3,4,5,6,7,8");
+  yield setLinks("0,1,2,3,4,5,6,7,8");
   setPinnedLinks(",,,,,,,7,8");
 
   yield addNewTabPageTab();
   checkGrid("0,1,2,3,4,5,6,7p,8p");
 
   yield simulateDrop(8, 2);
   checkGrid("0,1,3,4,5,6,7p,8p,2p");
 
   // make sure that pinned sites are re-positioned correctly
-  setLinks("0,1,2,3,4,5,6,7,8");
+  yield setLinks("0,1,2,3,4,5,6,7,8");
   setPinnedLinks("0,1,2,,,5");
 
   yield addNewTabPageTab();
   checkGrid("0p,1p,2p,3,4,5p,6,7,8");
 
   yield simulateDrop(4, 0);
   checkGrid("3,1p,2p,4,0p,5p,6,7,8");
 
   // drag a new site onto the very first cell
-  setLinks("0,1,2,3,4,5,6,7,8");
+  yield setLinks("0,1,2,3,4,5,6,7,8");
   setPinnedLinks(",,,,,,,7,8");
 
   yield addNewTabPageTab();
   checkGrid("0,1,2,3,4,5,6,7p,8p");
 
   yield simulateDrop(0);
   checkGrid("99p,0,1,2,3,4,5,7p,8p");
 
   // drag a new site onto the grid and make sure that pinned cells don't get
   // pushed out
-  setLinks("0,1,2,3,4,5,6,7,8");
+  yield setLinks("0,1,2,3,4,5,6,7,8");
   setPinnedLinks(",,,,,,,7,8");
 
   yield addNewTabPageTab();
   checkGrid("0,1,2,3,4,5,6,7p,8p");
 
   yield simulateDrop(7);
   checkGrid("0,1,2,3,4,5,7p,99p,8p");
 
   // drag a new site beneath a pinned cell and make sure the pinned cell is
   // not moved
-  setLinks("0,1,2,3,4,5,6,7,8");
+  yield setLinks("0,1,2,3,4,5,6,7,8");
   setPinnedLinks(",,,,,,,,8");
 
   yield addNewTabPageTab();
   checkGrid("0,1,2,3,4,5,6,7,8p");
 
   yield simulateDrop(7);
   checkGrid("0,1,2,3,4,5,6,99p,8p");
 
   // drag a new site onto a block of pinned sites and make sure they're shifted
   // around accordingly
-  setLinks("0,1,2,3,4,5,6,7,8");
+  yield setLinks("0,1,2,3,4,5,6,7,8");
   setPinnedLinks("0,1,2,,,,,,");
 
   yield addNewTabPageTab();
   checkGrid("0p,1p,2p");
 
   yield simulateDrop(1);
   checkGrid("0p,99p,1p,2p,3,4,5,6,7");
 }