Backed out 9 changesets (bug 1500257) for build bustage at /dom/TabParent.h on a CLOSED TREE
authorGurzau Raul <rgurzau@mozilla.com>
Sat, 09 Feb 2019 09:10:29 +0200
changeset 458345 2b27038adbe4e8d973019b070cf576babcc149d4
parent 458344 335ddf6a213a17764262041f46a51605fc931276
child 458346 3cf706639eda1303f57ce7c9105b69ad857b8172
push id111813
push userrgurzau@mozilla.com
push dateSat, 09 Feb 2019 07:11:21 +0000
treeherdermozilla-inbound@2b27038adbe4 [default view] [failures only]
perfherder[talos] [build metrics] [platform microbench] (compared to previous push)
bugs1500257
milestone67.0a1
backs out335ddf6a213a17764262041f46a51605fc931276
1e1b5cd23412a85fad19ab8ec5aacf31b3a9c9b6
4c85fb68f2ed297828bf4646301c2d80d1c8e0a1
ba62cc27c32f4d8a3fefff8eee5bf47d270130bc
b68b732411e2e1e6851799262246bff70e6649da
e33b9de7283e5fb6441e118b25af8d4ac3411bf2
002762a021c49287c1aad0db877a3a242ea3eba8
e72d9d31a8bc15e0d3e17d3bdae0b5717465c4b9
1615df089ad3b65333f50ac845a69e37c09b529f
first release with
nightly linux32
nightly linux64
nightly mac
nightly win32
nightly win64
last release without
nightly linux32
nightly linux64
nightly mac
nightly win32
nightly win64
Backed out 9 changesets (bug 1500257) for build bustage at /dom/TabParent.h on a CLOSED TREE Backed out changeset 335ddf6a213a (bug 1500257) Backed out changeset 1e1b5cd23412 (bug 1500257) Backed out changeset 4c85fb68f2ed (bug 1500257) Backed out changeset ba62cc27c32f (bug 1500257) Backed out changeset b68b732411e2 (bug 1500257) Backed out changeset e33b9de7283e (bug 1500257) Backed out changeset 002762a021c4 (bug 1500257) Backed out changeset e72d9d31a8bc (bug 1500257) Backed out changeset 1615df089ad3 (bug 1500257)
dom/base/nsFrameLoader.cpp
dom/base/nsFrameLoader.h
dom/ipc/PBrowser.ipdl
dom/ipc/PRemoteFrame.ipdl
dom/ipc/RemoteFrameChild.cpp
dom/ipc/RemoteFrameChild.h
dom/ipc/RemoteFrameParent.cpp
dom/ipc/RemoteFrameParent.h
dom/ipc/TabChild.cpp
dom/ipc/TabChild.h
dom/ipc/TabParent.cpp
dom/ipc/TabParent.h
dom/ipc/moz.build
dom/ipc/nsIContentParent.cpp
dom/ipc/tests/file_dummy.html
dom/ipc/tests/mochitest.ini
dom/ipc/tests/test_force_oop_iframe.html
gfx/vr/ipc/PVR.ipdl
layout/generic/nsSubDocumentFrame.cpp
layout/generic/nsSubDocumentFrame.h
layout/ipc/RenderFrame.cpp
layout/ipc/RenderFrame.h
modules/libpref/init/all.js
testing/mochitest/tests/SimpleTest/ChromeTask.js
testing/mochitest/tests/SimpleTest/moz.build
xpcom/ds/StaticAtoms.py
--- a/dom/base/nsFrameLoader.cpp
+++ b/dom/base/nsFrameLoader.cpp
@@ -96,18 +96,16 @@
 
 #include "mozilla/dom/ipc/StructuredCloneData.h"
 #include "mozilla/WebBrowserPersistLocalDocument.h"
 #include "mozilla/dom/Promise.h"
 #include "mozilla/dom/PromiseNativeHandler.h"
 #include "mozilla/dom/ParentSHistory.h"
 #include "mozilla/dom/ChildSHistory.h"
 #include "mozilla/dom/CanonicalBrowsingContext.h"
-#include "mozilla/dom/ContentChild.h"
-#include "mozilla/dom/RemoteFrameChild.h"
 
 #include "mozilla/dom/HTMLBodyElement.h"
 
 #include "mozilla/ContentPrincipal.h"
 
 #ifdef XP_WIN
 #  include "mozilla/plugins/PPluginWidgetParent.h"
 #  include "../plugins/ipc/PluginWidgetParent.h"
@@ -346,29 +344,23 @@ nsresult nsFrameLoader::ReallyStartLoadi
 
 nsresult nsFrameLoader::ReallyStartLoadingInternal() {
   NS_ENSURE_STATE(mURIToLoad && mOwnerContent &&
                   mOwnerContent->IsInComposedDoc());
 
   AUTO_PROFILER_LABEL("nsFrameLoader::ReallyStartLoadingInternal", OTHER);
 
   if (IsRemoteFrame()) {
-    if (!mRemoteBrowser && !mRemoteFrameChild && !TryRemoteBrowser()) {
+    if (!mRemoteBrowser && !TryRemoteBrowser()) {
       NS_WARNING("Couldn't create child process for iframe.");
       return NS_ERROR_FAILURE;
     }
 
-    if (mRemoteFrameChild) {
-      nsAutoCString spec;
-      mURIToLoad->GetSpec(spec);
-      Unused << mRemoteFrameChild->SendLoadURL(spec);
-    } else {
-      // FIXME get error codes from child
-      mRemoteBrowser->LoadURL(mURIToLoad);
-    }
+    // FIXME get error codes from child
+    mRemoteBrowser->LoadURL(mURIToLoad);
 
     if (!mRemoteBrowserShown) {
       // This can fail if it's too early to show the frame, we will retry later.
       Unused << ShowRemoteFrame(ScreenIntSize(0, 0));
     }
 
     return NS_OK;
   }
@@ -793,17 +785,17 @@ void nsFrameLoader::MarginsChanged(uint3
 }
 
 bool nsFrameLoader::ShowRemoteFrame(const ScreenIntSize& size,
                                     nsSubDocumentFrame* aFrame) {
   AUTO_PROFILER_LABEL("nsFrameLoader::ShowRemoteFrame", OTHER);
   NS_ASSERTION(IsRemoteFrame(),
                "ShowRemote only makes sense on remote frames.");
 
-  if (!mRemoteBrowser && !mRemoteFrameChild && !TryRemoteBrowser()) {
+  if (!mRemoteBrowser && !TryRemoteBrowser()) {
     NS_ERROR("Couldn't create child process.");
     return false;
   }
 
   // FIXME/bug 589337: Show()/Hide() is pretty expensive for
   // cross-process layers; need to figure out what behavior we really
   // want here.  For now, hack.
   if (!mRemoteBrowserShown) {
@@ -812,35 +804,22 @@ bool nsFrameLoader::ShowRemoteFrame(cons
     }
 
     // We never want to host remote frameloaders in simple popups, like menus.
     nsIWidget* widget = nsContentUtils::WidgetForContent(mOwnerContent);
     if (!widget || static_cast<nsBaseWidget*>(widget)->IsSmallPopup()) {
       return false;
     }
 
-    if (mRemoteFrameChild) {
-      nsCOMPtr<nsISupports> container =
-          mOwnerContent->OwnerDoc()->GetContainer();
-      nsCOMPtr<nsIBaseWindow> baseWindow = do_QueryInterface(container);
-      nsCOMPtr<nsIWidget> mainWidget;
-      baseWindow->GetMainWidget(getter_AddRefs(mainWidget));
-      nsSizeMode sizeMode =
-          mainWidget ? mainWidget->SizeMode() : nsSizeMode_Normal;
-
-      Unused << mRemoteFrameChild->SendShow(
-          size, ParentWindowIsActive(mOwnerContent->OwnerDoc()), sizeMode);
-      mRemoteBrowserShown = true;
-      return true;
+    RenderFrame* rf = GetCurrentRenderFrame();
+    if (!rf) {
+      return false;
     }
 
-    RenderFrame* rf =
-        mRemoteBrowser ? mRemoteBrowser->GetRenderFrame() : nullptr;
-
-    if (!rf || !rf->AttachLayerManager()) {
+    if (!rf->AttachLayerManager()) {
       // This is just not going to work.
       return false;
     }
 
     mRemoteBrowser->Show(size, ParentWindowIsActive(mOwnerContent->OwnerDoc()));
     mRemoteBrowserShown = true;
 
     nsCOMPtr<nsIObserverService> os = services::GetObserverService();
@@ -848,21 +827,17 @@ bool nsFrameLoader::ShowRemoteFrame(cons
       os->NotifyObservers(ToSupports(this), "remote-browser-shown", nullptr);
     }
   } else {
     nsIntRect dimensions;
     NS_ENSURE_SUCCESS(GetWindowDimensions(dimensions), false);
 
     // Don't show remote iframe if we are waiting for the completion of reflow.
     if (!aFrame || !(aFrame->GetStateBits() & NS_FRAME_FIRST_REFLOW)) {
-      if (mRemoteBrowser) {
-        mRemoteBrowser->UpdateDimensions(dimensions, size);
-      } else if (mRemoteFrameChild) {
-        mRemoteFrameChild->UpdateDimensions(dimensions, size);
-      }
+      mRemoteBrowser->UpdateDimensions(dimensions, size);
     }
   }
 
   return true;
 }
 
 void nsFrameLoader::Hide() {
   if (mHideCalled) {
@@ -941,21 +916,16 @@ nsresult nsFrameLoader::SwapWithOtherRem
   }
 
   nsIPresShell* ourShell = ourDoc->GetShell();
   nsIPresShell* otherShell = otherDoc->GetShell();
   if (!ourShell || !otherShell) {
     return NS_ERROR_NOT_IMPLEMENTED;
   }
 
-  // FIXME: Consider supporting FrameLoader swapping for remote sub frames.
-  if (mRemoteFrameChild) {
-    return NS_ERROR_NOT_IMPLEMENTED;
-  }
-
   if (!mRemoteBrowser || !aOther->mRemoteBrowser) {
     return NS_ERROR_NOT_IMPLEMENTED;
   }
 
   if (mRemoteBrowser->IsIsolatedMozBrowserElement() !=
       aOther->mRemoteBrowser->IsIsolatedMozBrowserElement()) {
     return NS_ERROR_NOT_IMPLEMENTED;
   }
@@ -1689,21 +1659,16 @@ void nsFrameLoader::DestroyDocShell() {
 
   // Ask the TabChild to fire the frame script "unload" event, destroy its
   // docshell, and finally destroy the PBrowser actor. This eventually leads to
   // nsFrameLoader::DestroyComplete being called.
   if (mRemoteBrowser) {
     mRemoteBrowser->Destroy();
   }
 
-  if (mRemoteFrameChild) {
-    Unused << mRemoteFrameChild->Send__delete__(mRemoteFrameChild);
-    mRemoteFrameChild = nullptr;
-  }
-
   // Fire the "unload" event if we're in-process.
   if (mChildMessageManager) {
     mChildMessageManager->FireUnloadEvent();
   }
 
   // Destroy the docshell.
   if (mDocShell) {
     mDocShell->Destroy();
@@ -1735,21 +1700,16 @@ void nsFrameLoader::DestroyComplete() {
 
   // Call TabParent::Destroy if we haven't already (in case of a crash).
   if (mRemoteBrowser) {
     mRemoteBrowser->SetOwnerElement(nullptr);
     mRemoteBrowser->Destroy();
     mRemoteBrowser = nullptr;
   }
 
-  if (mRemoteFrameChild) {
-    Unused << mRemoteFrameChild->Send__delete__(mRemoteFrameChild);
-    mRemoteFrameChild = nullptr;
-  }
-
   if (mMessageManager) {
     mMessageManager->Disconnect();
   }
 
   if (mChildMessageManager) {
     mChildMessageManager->Disconnect();
   }
 
@@ -1769,16 +1729,20 @@ void nsFrameLoader::SetOwnerContent(Elem
 
   JS::RootedObject wrapper(jsapi.cx(), GetWrapper());
   if (wrapper) {
     JSAutoRealm ar(jsapi.cx(), wrapper);
     IgnoredErrorResult rv;
     UpdateReflectorGlobal(jsapi.cx(), wrapper, rv);
     Unused << NS_WARN_IF(rv.Failed());
   }
+
+  if (RenderFrame* rfp = GetCurrentRenderFrame()) {
+    rfp->OwnerContentChanged(aContent);
+  }
 }
 
 bool nsFrameLoader::OwnerIsMozBrowserFrame() {
   nsCOMPtr<nsIMozBrowserFrame> browserFrame = do_QueryInterface(mOwnerContent);
   return browserFrame ? browserFrame->GetReallyIsBrowser() : false;
 }
 
 bool nsFrameLoader::OwnerIsIsolatedMozBrowserFrame() {
@@ -1811,23 +1775,16 @@ bool nsFrameLoader::ShouldUseRemoteProce
 
   // Don't try to launch nested children if we don't have OMTC.
   // They won't render!
   if (XRE_IsContentProcess() &&
       !CompositorBridgeChild::ChildProcessHasCompositorBridge()) {
     return false;
   }
 
-  // Check if the force fission test attribute is enabled.
-  if (XRE_IsContentProcess() &&
-      Preferences::GetBool("browser.fission.oopif.attribute", false) &&
-      mOwnerContent->HasAttr(kNameSpaceID_None, nsGkAtoms::fission)) {
-    return true;
-  }
-
   if (XRE_IsContentProcess() &&
       !(PR_GetEnv("MOZ_NESTED_OOP_TABS") ||
         Preferences::GetBool("dom.ipc.tabs.nested.enabled", false))) {
     return false;
   }
 
   // If we're an <iframe mozbrowser> and we don't have a "remote" attribute,
   // fall back to the default.
@@ -1839,16 +1796,24 @@ bool nsFrameLoader::ShouldUseRemoteProce
   // Otherwise, we're remote if we have "remote=true" and we're either a
   // browser frame or a XUL element.
   return (OwnerIsMozBrowserFrame() ||
           mOwnerContent->GetNameSpaceID() == kNameSpaceID_XUL) &&
          mOwnerContent->AttrValueIs(kNameSpaceID_None, nsGkAtoms::remote,
                                     nsGkAtoms::_true, eCaseMatters);
 }
 
+bool nsFrameLoader::IsRemoteFrame() {
+  if (mRemoteFrame) {
+    MOZ_ASSERT(!mDocShell, "Found a remote frame with a DocShell");
+    return true;
+  }
+  return false;
+}
+
 static already_AddRefed<BrowsingContext> CreateBrowsingContext(
     BrowsingContext* aParentContext, BrowsingContext* aOpenerContext,
     const nsAString& aName, bool aIsContent) {
   // If we're content but our parent isn't, we're going to want to start a new
   // browsing context tree.
   if (aIsContent && !aParentContext->IsContent()) {
     aParentContext = nullptr;
   }
@@ -2305,31 +2270,27 @@ nsresult nsFrameLoader::GetWindowDimensi
   nsCOMPtr<nsIBaseWindow> treeOwnerAsWin(do_GetInterface(parentOwner));
   treeOwnerAsWin->GetPosition(&aRect.x, &aRect.y);
   treeOwnerAsWin->GetSize(&aRect.width, &aRect.height);
   return NS_OK;
 }
 
 nsresult nsFrameLoader::UpdatePositionAndSize(nsSubDocumentFrame* aIFrame) {
   if (IsRemoteFrame()) {
-    if (mRemoteBrowser || mRemoteFrameChild) {
+    if (mRemoteBrowser) {
       ScreenIntSize size = aIFrame->GetSubdocumentSize();
       // If we were not able to show remote frame before, we should probably
       // retry now to send correct showInfo.
       if (!mRemoteBrowserShown) {
         ShowRemoteFrame(size, aIFrame);
       }
       nsIntRect dimensions;
       NS_ENSURE_SUCCESS(GetWindowDimensions(dimensions), NS_ERROR_FAILURE);
       mLazySize = size;
-      if (mRemoteBrowser) {
-        mRemoteBrowser->UpdateDimensions(dimensions, size);
-      } else if (mRemoteFrameChild) {
-        mRemoteFrameChild->UpdateDimensions(dimensions, size);
-      }
+      mRemoteBrowser->UpdateDimensions(dimensions, size);
     }
     return NS_OK;
   }
   UpdateBaseWindowPositionAndSize(aIFrame);
   return NS_OK;
 }
 
 void nsFrameLoader::UpdateBaseWindowPositionAndSize(
@@ -2421,17 +2382,17 @@ static Tuple<ContentParent*, TabParent*>
       tabParent->Manager()->IsContentParent()) {
     return MakeTuple(tabParent->Manager()->AsContentParent(), tabParent);
   }
 
   return ReturnTuple(nullptr, nullptr);
 }
 
 bool nsFrameLoader::TryRemoteBrowser() {
-  NS_ASSERTION(!mRemoteBrowser && !mRemoteFrameChild,
+  NS_ASSERTION(!mRemoteBrowser,
                "TryRemoteBrowser called with a remote browser already?");
 
   if (!mOwnerContent) {
     return false;
   }
 
   // XXXsmaug Per spec (2014/08/21) frameloader should not work in case the
   //         element isn't in document, only in shadow dom, but that will change
@@ -2467,19 +2428,17 @@ bool nsFrameLoader::TryRemoteBrowser() {
       openingTab->Manager()->IsContentParent()) {
     openerContentParent = openingTab->Manager()->AsContentParent();
   }
 
   // <iframe mozbrowser> gets to skip these checks.
   // iframes for JS plugins also get to skip these checks. We control the URL
   // that gets loaded, but the load is triggered from the document containing
   // the plugin.
-  // out of process iframes also get to skip this check.
-  if (!OwnerIsMozBrowserFrame() && !IsForJSPlugin() &&
-      !XRE_IsContentProcess()) {
+  if (!OwnerIsMozBrowserFrame() && !IsForJSPlugin()) {
     if (parentDocShell->ItemType() != nsIDocShellTreeItem::typeChrome) {
       // Allow about:addon an exception to this rule so it can load remote
       // extension options pages.
       //
       // Note that the new frame's message manager will not be a child of the
       // chrome window message manager, and, the values of window.top and
       // window.parent will be different than they would be for a non-remote
       // frame.
@@ -2539,24 +2498,16 @@ bool nsFrameLoader::TryRemoteBrowser() {
     // We may be in a window that was just opened, so try the
     // nsIBrowserDOMWindow API as a backup.
     if (!nextTabParentId && window) {
       Unused << window->GetNextTabParentId(&nextTabParentId);
     }
   }
 
   nsCOMPtr<Element> ownerElement = mOwnerContent;
-
-  // If we're in a content process, create a RemoteFrameChild actor.
-  if (XRE_IsContentProcess()) {
-    mRemoteFrameChild = RemoteFrameChild::Create(
-        this, context, NS_LITERAL_STRING(DEFAULT_REMOTE_TYPE));
-    return !!mRemoteFrameChild;
-  }
-
   mRemoteBrowser =
       ContentParent::CreateBrowser(context, ownerElement, openerContentParent,
                                    sameTabGroupAs, nextTabParentId);
   if (!mRemoteBrowser) {
     return false;
   }
 
   // We no longer need the remoteType attribute on the frame element.
@@ -2606,34 +2557,25 @@ bool nsFrameLoader::TryRemoteBrowser() {
   }
 
   ReallyLoadFrameScripts();
   InitializeBrowserAPI();
 
   return true;
 }
 
-bool nsFrameLoader::IsRemoteFrame() {
-  if (mRemoteFrame) {
-    MOZ_ASSERT(!mDocShell, "Found a remote frame with a DocShell");
-    return true;
-  }
-  return false;
-}
-
 mozilla::dom::PBrowserParent* nsFrameLoader::GetRemoteBrowser() const {
   return mRemoteBrowser;
 }
 
-mozilla::layers::LayersId nsFrameLoader::GetLayersId() const {
-  MOZ_ASSERT(mRemoteFrame);
+RenderFrame* nsFrameLoader::GetCurrentRenderFrame() const {
   if (mRemoteBrowser) {
-    return mRemoteBrowser->GetRenderFrame()->GetLayersId();
+    return mRemoteBrowser->GetRenderFrame();
   }
-  return mRemoteFrameChild->GetLayersId();
+  return nullptr;
 }
 
 void nsFrameLoader::ActivateRemoteFrame(ErrorResult& aRv) {
   if (!mRemoteBrowser) {
     aRv.Throw(NS_ERROR_UNEXPECTED);
     return;
   }
 
--- a/dom/base/nsFrameLoader.h
+++ b/dom/base/nsFrameLoader.h
@@ -19,17 +19,16 @@
 #include "nsSize.h"
 #include "nsWrapperCache.h"
 #include "nsIURI.h"
 #include "nsFrameMessageManager.h"
 #include "mozilla/dom/BindingUtils.h"
 #include "mozilla/dom/Element.h"
 #include "mozilla/dom/ParentSHistory.h"
 #include "mozilla/Attributes.h"
-#include "mozilla/layers/LayersTypes.h"
 #include "nsStubMutationObserver.h"
 #include "Units.h"
 #include "nsIFrame.h"
 #include "nsPluginTags.h"
 
 class nsIURI;
 class nsSubDocumentFrame;
 class nsView;
@@ -54,17 +53,16 @@ class ChromeMessageSender;
 class ContentParent;
 class InProcessTabChildMessageManager;
 class MessageSender;
 class PBrowserParent;
 class ProcessMessageManager;
 class Promise;
 class TabParent;
 class MutableTabContext;
-class RemoteFrameChild;
 
 namespace ipc {
 class StructuredCloneData;
 }  // namespace ipc
 
 }  // namespace dom
 
 namespace layout {
@@ -267,36 +265,33 @@ class nsFrameLoader final : public nsStu
   /**
    * Return the document that owns this, or null if we don't have
    * an owner.
    */
   Document* GetOwnerDoc() const {
     return mOwnerContent ? mOwnerContent->OwnerDoc() : nullptr;
   }
 
-  /**
-   * Returns whether this frame is a remote frame.
-   *
-   * This is true for either a top-level remote browser in the parent process,
-   * or a remote subframe in the child process.
-   */
-  bool IsRemoteFrame();
-
-  /**
-   * Returns the IPDL actor used if this is a top-level remote browser, or null
-   * otherwise.
-   */
   PBrowserParent* GetRemoteBrowser() const;
 
   /**
-   * Returns the layers ID that this remote frame is using to render.
+   * The "current" render frame is the one on which the most recent
+   * remote layer-tree transaction was executed.  If no content has
+   * been drawn yet, or the remote browser doesn't have any drawn
+   * content for whatever reason, return nullptr.  The returned render
+   * frame has an associated shadow layer tree.
    *
-   * This must only be called if this is a remote frame.
+   * Note that the returned render frame might not be a frame
+   * constructed for this->GetURL().  This can happen, e.g., if the
+   * <browser> was just navigated to a new URL, but hasn't painted the
+   * new page yet.  A render frame for the previous page may be
+   * returned.  (In-process <browser> behaves similarly, and this
+   * behavior seems desirable.)
    */
-  mozilla::layers::LayersId GetLayersId() const;
+  RenderFrame* GetCurrentRenderFrame() const;
 
   mozilla::dom::ChromeMessageSender* GetFrameMessageManager() {
     return mMessageManager;
   }
 
   mozilla::dom::Element* GetOwnerContent() { return mOwnerContent; }
 
   bool ShouldClampScrollPosition() { return mClampScrollPosition; }
@@ -358,16 +353,21 @@ class nsFrameLoader final : public nsStu
   nsFrameLoader(mozilla::dom::Element* aOwner, nsPIDOMWindowOuter* aOpener,
                 bool aNetworkCreated, int32_t aJSPluginID);
   ~nsFrameLoader();
 
   void SetOwnerContent(mozilla::dom::Element* aContent);
 
   bool ShouldUseRemoteProcess();
 
+  /**
+   * Return true if the frame is a remote frame. Return false otherwise
+   */
+  bool IsRemoteFrame();
+
   bool IsForJSPlugin() { return mJSPluginID != nsFakePluginTag::NOT_JSPLUGIN; }
 
   /**
    * Is this a frame loader for an isolated <iframe mozbrowser>?
    *
    * By default, mozbrowser frames are isolated.  Isolation can be disabled by
    * setting the frame's noisolation attribute.  Disabling isolation is
    * only allowed if the containing document is chrome.
@@ -451,19 +451,16 @@ class nsFrameLoader final : public nsStu
   RefPtr<Document> mContainerDocWhileDetached;
 
   // An opener window which should be used when the docshell is created.
   nsCOMPtr<nsPIDOMWindowOuter> mOpener;
 
   TabParent* mRemoteBrowser;
   uint64_t mChildID;
 
-  // This is used when this refers to a remote sub frame
-  RefPtr<mozilla::dom::RemoteFrameChild> mRemoteFrameChild;
-
   int32_t mJSPluginID;
 
   // Holds the last known size of the frame.
   mozilla::ScreenIntSize mLazySize;
 
   RefPtr<mozilla::dom::ParentSHistory> mParentSHistory;
 
   bool mDepthTooGreat : 1;
--- a/dom/ipc/PBrowser.ipdl
+++ b/dom/ipc/PBrowser.ipdl
@@ -14,17 +14,16 @@ include protocol PIndexedDBPermissionReq
 include protocol PPluginWidget;
 include protocol PRemotePrintJob;
 include protocol PChildToParentStream;
 include protocol PParentToChildStream;
 include protocol PFileDescriptorSet;
 include protocol PIPCBlobInputStream;
 include protocol PPaymentRequest;
 include protocol PWindowGlobal;
-include protocol PRemoteFrame;
 
 include DOMTypes;
 include IPCBlob;
 include IPCStream;
 include JavaScriptTypes;
 include URIParams;
 include PPrintingTypes;
 include PTabContext;
@@ -138,17 +137,16 @@ nested(upto inside_cpow) sync protocol P
 
     manages PColorPicker;
     manages PDocAccessible;
     manages PFilePicker;
     manages PIndexedDBPermissionRequest;
     manages PPluginWidget;
     manages PPaymentRequest;
     manages PWindowGlobal;
-    manages PRemoteFrame;
 
 both:
     async AsyncMessage(nsString aMessage, CpowEntry[] aCpows,
                        Principal aPrincipal, ClonedMessageData aData);
 
 parent:
     /**
      * Tell the parent process a new accessible document has been created.
@@ -172,21 +170,16 @@ parent:
 
     /**
      * Construct a new WindowGlobal actor for a window global in the given
      * BrowsingContext and with the given principal.
      */
     async PWindowGlobal(WindowGlobalInit init);
 
     /**
-     * Construct a new Remote iframe actor.
-     */
-    async PRemoteFrame(nsString aPresentationURL, nsString aRemoteType);
-
-    /**
      * Sends an NS_NATIVE_CHILD_OF_SHAREABLE_WINDOW to be adopted by the
      * widget's shareable window on the chrome side. Only used on Windows.
      */
     async SetNativeChildOfShareableWindow(uintptr_t childWindow);
 
     /**
      * When content moves focus from a native plugin window that's a child
      * of the native browser window we need to move native focus to the
deleted file mode 100644
--- a/dom/ipc/PRemoteFrame.ipdl
+++ /dev/null
@@ -1,42 +0,0 @@
-/* -*- Mode: C++; c-basic-offset: 4; indent-tabs-mode: nil; tab-width: 8 -*- */
-/* vim: set sw=4 ts=8 et tw=80 ft=cpp : */
-/* This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
-
-include protocol PBrowser;
-
-include DOMTypes;
-
-using ScreenIntSize from "Units.h";
-using nsSizeMode from "nsIWidgetListener.h";
-using mozilla::layers::LayersObserverEpoch from "mozilla/layers/LayersTypes.h";
-using mozilla::layers::LayersId from "mozilla/layers/LayersTypes.h";
-
-namespace mozilla {
-namespace dom {
-
-/**
- * PRemoteFrame corresponds to a remote iframe.
- */
-async protocol PRemoteFrame {
-  manager PBrowser;
-
-child:
-  async SetLayersId(LayersId layersId);
-
-parent:
-  // Destroy the remote web browser due to the nsFrameLoader going away.
-  async __delete__();
-
-  // DocShell messaging.
-  async LoadURL(nsCString aSpec);
-
-  // Out of process rendering.
-  async Show(ScreenIntSize size, bool parentIsActive, nsSizeMode sizeMode);
-  async UpdateDimensions(DimensionInfo dimensions) compressall;
-  async RenderLayers(bool aEnabled, bool aForceRepaint, LayersObserverEpoch aEpoch);
-};
-
-}  // namespace dom
-}  // namespace mozilla
deleted file mode 100644
--- a/dom/ipc/RemoteFrameChild.cpp
+++ /dev/null
@@ -1,88 +0,0 @@
-/* -*- Mode: C++; tab-width: 8; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
-/* vim: set ts=8 sts=2 et sw=2 tw=80: */
-/* This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
-
-#include "mozilla/dom/RemoteFrameChild.h"
-
-using namespace mozilla::ipc;
-
-namespace mozilla {
-namespace dom {
-
-RemoteFrameChild::RemoteFrameChild(nsFrameLoader* aFrameLoader)
-    : mLayersId{0}, mIPCOpen(true), mFrameLoader(aFrameLoader) {}
-
-RemoteFrameChild::~RemoteFrameChild() {}
-
-already_AddRefed<RemoteFrameChild> RemoteFrameChild::Create(
-    nsFrameLoader* aFrameLoader, const TabContext& aContext,
-    const nsString& aRemoteType) {
-  MOZ_ASSERT(XRE_IsContentProcess());
-
-  // Determine our embedder's TabChild actor.
-  RefPtr<Element> owner = aFrameLoader->GetOwnerContent();
-  MOZ_DIAGNOSTIC_ASSERT(owner);
-
-  nsCOMPtr<nsIDocShell> docShell = do_GetInterface(owner->GetOwnerGlobal());
-  MOZ_DIAGNOSTIC_ASSERT(docShell);
-
-  RefPtr<TabChild> tabChild = TabChild::GetFrom(docShell);
-  MOZ_DIAGNOSTIC_ASSERT(tabChild);
-
-  RefPtr<RemoteFrameChild> remoteFrame = new RemoteFrameChild(aFrameLoader);
-  // Reference is freed in TabChild::DeallocPRemoteFrameChild.
-  tabChild->SendPRemoteFrameConstructor(
-      do_AddRef(remoteFrame).take(),
-      PromiseFlatString(aContext.PresentationURL()), aRemoteType);
-  remoteFrame->mIPCOpen = true;
-
-  return remoteFrame.forget();
-}
-
-void RemoteFrameChild::UpdateDimensions(const nsIntRect& aRect,
-                                        const mozilla::ScreenIntSize& aSize) {
-  MOZ_DIAGNOSTIC_ASSERT(mIPCOpen);
-
-  RefPtr<Element> owner = mFrameLoader->GetOwnerContent();
-  nsCOMPtr<nsIWidget> widget = nsContentUtils::WidgetForContent(owner);
-  if (!widget) {
-    widget = nsContentUtils::WidgetForDocument(owner->OwnerDoc());
-  }
-  MOZ_DIAGNOSTIC_ASSERT(widget);
-
-  CSSToLayoutDeviceScale widgetScale = widget->GetDefaultScale();
-
-  LayoutDeviceIntRect devicePixelRect = ViewAs<LayoutDevicePixel>(
-      aRect, PixelCastJustification::LayoutDeviceIsScreenForTabDims);
-  LayoutDeviceIntSize devicePixelSize = ViewAs<LayoutDevicePixel>(
-      aSize, PixelCastJustification::LayoutDeviceIsScreenForTabDims);
-
-  // XXX What are clientOffset and chromeOffset used for? Are they meaningful
-  // for nested iframes with transforms?
-  LayoutDeviceIntPoint clientOffset;
-  LayoutDeviceIntPoint chromeOffset;
-
-  CSSRect unscaledRect = devicePixelRect / widgetScale;
-  CSSSize unscaledSize = devicePixelSize / widgetScale;
-  hal::ScreenOrientation orientation = hal::eScreenOrientation_Default;
-  DimensionInfo di(unscaledRect, unscaledSize, orientation, clientOffset,
-                   chromeOffset);
-
-  Unused << SendUpdateDimensions(di);
-}
-
-IPCResult RemoteFrameChild::RecvSetLayersId(
-    const mozilla::layers::LayersId& aLayersId) {
-  MOZ_ASSERT(!mLayersId.IsValid() && aLayersId.IsValid());
-  mLayersId = aLayersId;
-  return IPC_OK();
-}
-
-void RemoteFrameChild::ActorDestroy(ActorDestroyReason aWhy) {
-  mIPCOpen = false;
-}
-
-}  // namespace dom
-}  // namespace mozilla
deleted file mode 100644
--- a/dom/ipc/RemoteFrameChild.h
+++ /dev/null
@@ -1,55 +0,0 @@
-/* -*- Mode: C++; tab-width: 8; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
-/* vim: set ts=8 sts=2 et sw=2 tw=80: */
-/* This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
-
-#ifndef mozilla_dom_RemoteFrameChild_h
-#define mozilla_dom_RemoteFrameChild_h
-
-#include "mozilla/dom/PRemoteFrameChild.h"
-#include "mozilla/dom/TabChild.h"
-
-namespace mozilla {
-namespace dom {
-
-/**
- * Child side for a remote frame.
- */
-class RemoteFrameChild : public PRemoteFrameChild {
- public:
-  NS_INLINE_DECL_REFCOUNTING(RemoteFrameChild);
-
-  TabChild* Manager() {
-    MOZ_ASSERT(mIPCOpen);
-    return static_cast<TabChild*>(PRemoteFrameChild::Manager());
-  }
-
-  mozilla::layers::LayersId GetLayersId() { return mLayersId; }
-
-  static already_AddRefed<RemoteFrameChild> Create(nsFrameLoader* aFrameLoader,
-                                                   const TabContext& aContext,
-                                                   const nsString& aRemoteType);
-
-  void UpdateDimensions(const nsIntRect& aRect,
-                        const mozilla::ScreenIntSize& aSize);
-
- protected:
-  mozilla::ipc::IPCResult RecvSetLayersId(
-      const mozilla::layers::LayersId& aLayersId) override;
-
-  void ActorDestroy(ActorDestroyReason aWhy) override;
-
- private:
-  explicit RemoteFrameChild(nsFrameLoader* aFrameLoader);
-  ~RemoteFrameChild();
-
-  mozilla::layers::LayersId mLayersId;
-  bool mIPCOpen;
-  RefPtr<nsFrameLoader> mFrameLoader;
-};
-
-}  // namespace dom
-}  // namespace mozilla
-
-#endif  // !defined(mozilla_dom_RemoteFrameParent_h)
deleted file mode 100644
--- a/dom/ipc/RemoteFrameParent.cpp
+++ /dev/null
@@ -1,119 +0,0 @@
-/* -*- Mode: C++; tab-width: 8; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
-/* vim: set ts=8 sts=2 et sw=2 tw=80: */
-/* This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
-
-#include "mozilla/dom/RemoteFrameParent.h"
-#include "mozilla/dom/ContentParent.h"
-#include "mozilla/dom/ContentProcessManager.h"
-
-using namespace mozilla::ipc;
-using namespace mozilla::layout;
-
-namespace mozilla {
-namespace dom {
-
-RemoteFrameParent::RemoteFrameParent() : mIPCOpen(false) {}
-
-RemoteFrameParent::~RemoteFrameParent() {}
-
-nsresult RemoteFrameParent::Init(const nsString& aPresentationURL,
-                                 const nsString& aRemoteType) {
-  mIPCOpen = true;
-
-  // FIXME: This should actually use a non-bogus TabContext, probably inherited
-  // from our Manager().
-  OriginAttributes attrs;
-  attrs.mInIsolatedMozBrowser = false;
-  attrs.mAppId = nsIScriptSecurityManager::NO_APP_ID;
-  attrs.SyncAttributesWithPrivateBrowsing(false);
-  MutableTabContext tabContext;
-  tabContext.SetTabContext(false, 0, UIStateChangeType_Set,
-                           UIStateChangeType_Set, attrs, aPresentationURL);
-
-  ProcessPriority initialPriority = PROCESS_PRIORITY_FOREGROUND;
-
-  // Get our ConstructorSender object.
-  RefPtr<nsIContentParent> constructorSender =
-      ContentParent::GetNewOrUsedBrowserProcess(
-          nullptr, aRemoteType, initialPriority, nullptr, false);
-  if (NS_WARN_IF(!constructorSender)) {
-    MOZ_ASSERT(false, "Unable to allocate content process!");
-    return NS_ERROR_FAILURE;
-  }
-
-  ContentProcessManager* cpm = ContentProcessManager::GetSingleton();
-  TabId tabId(nsContentUtils::GenerateTabId());
-  cpm->RegisterRemoteFrame(tabId, ContentParentId(0), TabId(0),
-                           tabContext.AsIPCTabContext(),
-                           constructorSender->ChildID());
-
-  // Construct the TabParent object for our subframe.
-  uint32_t chromeFlags = 0;
-  RefPtr<TabParent> tabParent(
-      new TabParent(constructorSender, tabId, tabContext, chromeFlags));
-
-  PBrowserParent* browser = constructorSender->SendPBrowserConstructor(
-      // DeallocPBrowserParent() releases this ref.
-      tabParent.forget().take(), tabId, TabId(0), tabContext.AsIPCTabContext(),
-      chromeFlags, constructorSender->ChildID(),
-      constructorSender->IsForBrowser());
-  if (NS_WARN_IF(!browser)) {
-    MOZ_ASSERT(false, "Browser Constructor Failed");
-    return NS_ERROR_FAILURE;
-  }
-
-  // Set our TabParent object to the newly created browser.
-  mTabParent = TabParent::GetFrom(browser);
-  mTabParent->SetOwnerElement(Manager()->GetOwnerElement());
-  mTabParent->InitRendering();
-
-  RenderFrame* rf = mTabParent->GetRenderFrame();
-  if (NS_WARN_IF(!rf)) {
-    MOZ_ASSERT(false, "No RenderFrame");
-    return NS_ERROR_FAILURE;
-  }
-
-  // Send the newly created layers ID back into content.
-  Unused << SendSetLayersId(rf->GetLayersId());
-  return NS_OK;
-}
-
-IPCResult RemoteFrameParent::RecvShow(const ScreenIntSize& aSize,
-                                      const bool& aParentIsActive,
-                                      const nsSizeMode& aSizeMode) {
-  RenderFrame* rf = mTabParent->GetRenderFrame();
-  if (!rf->AttachLayerManager()) {
-    MOZ_CRASH();
-  }
-
-  Unused << mTabParent->SendShow(aSize, mTabParent->GetShowInfo(),
-                                 aParentIsActive, aSizeMode);
-  return IPC_OK();
-}
-
-IPCResult RemoteFrameParent::RecvLoadURL(const nsCString& aUrl) {
-  Unused << mTabParent->SendLoadURL(aUrl, mTabParent->GetShowInfo());
-  return IPC_OK();
-}
-
-IPCResult RemoteFrameParent::RecvUpdateDimensions(
-    const DimensionInfo& aDimensions) {
-  Unused << mTabParent->SendUpdateDimensions(aDimensions);
-  return IPC_OK();
-}
-
-IPCResult RemoteFrameParent::RecvRenderLayers(
-    const bool& aEnabled, const bool& aForceRepaint,
-    const layers::LayersObserverEpoch& aEpoch) {
-  Unused << mTabParent->SendRenderLayers(aEnabled, aForceRepaint, aEpoch);
-  return IPC_OK();
-}
-
-void RemoteFrameParent::ActorDestroy(ActorDestroyReason aWhy) {
-  mIPCOpen = false;
-}
-
-}  // namespace dom
-}  // namespace mozilla
deleted file mode 100644
--- a/dom/ipc/RemoteFrameParent.h
+++ /dev/null
@@ -1,56 +0,0 @@
-/* -*- Mode: C++; tab-width: 8; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
-/* vim: set ts=8 sts=2 et sw=2 tw=80: */
-/* This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
-
-#ifndef mozilla_dom_RemoteFrameParent_h
-#define mozilla_dom_RemoteFrameParent_h
-
-#include "mozilla/dom/PRemoteFrameParent.h"
-#include "mozilla/dom/TabParent.h"
-
-namespace mozilla {
-namespace dom {
-
-class RemoteFrameParent : public PRemoteFrameParent {
- public:
-  NS_INLINE_DECL_REFCOUNTING(RemoteFrameParent);
-
-  RemoteFrameParent();
-
-  // Initialize this actor after performing startup.
-  nsresult Init(const nsString& aPresentationURL, const nsString& aRemoteType);
-
-  TabParent* GetTabParent() { return mTabParent; }
-
-  // Get our manager actor.
-  TabParent* Manager() {
-    MOZ_ASSERT(mIPCOpen);
-    return static_cast<TabParent*>(PRemoteFrameParent::Manager());
-  }
-
- protected:
-  mozilla::ipc::IPCResult RecvShow(const ScreenIntSize& aSize,
-                                   const bool& aParentIsActive,
-                                   const nsSizeMode& aSizeMode) override;
-  mozilla::ipc::IPCResult RecvLoadURL(const nsCString& aUrl) override;
-  mozilla::ipc::IPCResult RecvUpdateDimensions(
-      const DimensionInfo& aDimensions) override;
-  mozilla::ipc::IPCResult RecvRenderLayers(
-      const bool& aEnabled, const bool& aForceRepaint,
-      const LayersObserverEpoch& aEpoch) override;
-
-  void ActorDestroy(ActorDestroyReason aWhy) override;
-
- private:
-  ~RemoteFrameParent();
-
-  RefPtr<TabParent> mTabParent;
-  bool mIPCOpen;
-};
-
-}  // namespace dom
-}  // namespace mozilla
-
-#endif  // !defined(mozilla_dom_RemoteFrameParent_h)
--- a/dom/ipc/TabChild.cpp
+++ b/dom/ipc/TabChild.cpp
@@ -25,17 +25,16 @@
 #include "mozilla/dom/indexedDB/PIndexedDBPermissionRequestChild.h"
 #include "mozilla/dom/LoadURIOptionsBinding.h"
 #include "mozilla/dom/MessageManagerBinding.h"
 #include "mozilla/dom/MouseEventBinding.h"
 #include "mozilla/dom/Nullable.h"
 #include "mozilla/dom/PaymentRequestChild.h"
 #include "mozilla/dom/PBrowser.h"
 #include "mozilla/dom/WindowProxyHolder.h"
-#include "mozilla/dom/RemoteFrameChild.h"
 #include "mozilla/gfx/CrossProcessPaint.h"
 #include "mozilla/IMEStateManager.h"
 #include "mozilla/ipc/URIUtils.h"
 #include "mozilla/layers/APZChild.h"
 #include "mozilla/layers/APZCCallbackHelper.h"
 #include "mozilla/layers/APZCTreeManagerChild.h"
 #include "mozilla/layers/APZEventState.h"
 #include "mozilla/layers/ContentProcessController.h"
@@ -3175,28 +3174,16 @@ PWindowGlobalChild* TabChild::AllocPWind
 }
 
 bool TabChild::DeallocPWindowGlobalChild(PWindowGlobalChild* aActor) {
   // This reference was added in WindowGlobalChild::Create.
   static_cast<WindowGlobalChild*>(aActor)->Release();
   return true;
 }
 
-PRemoteFrameChild* TabChild::AllocPRemoteFrameChild(const nsString&,
-                                                    const nsString&) {
-  MOZ_CRASH("We should never be manually allocating PRemoteFrameChild actors");
-  return nullptr;
-}
-
-bool TabChild::DeallocPRemoteFrameChild(PRemoteFrameChild* aActor) {
-  // This reference was added in RemoteFrameChild::Create.
-  static_cast<RemoteFrameChild*>(aActor)->Release();
-  return true;
-}
-
 ScreenIntSize TabChild::GetInnerSize() {
   LayoutDeviceIntSize innerSize =
       RoundedToInt(mUnscaledInnerSize * mPuppetWidget->GetDefaultScale());
   return ViewAs<ScreenPixel>(
       innerSize, PixelCastJustification::LayoutDeviceIsScreenForTabDims);
 };
 
 ScreenIntRect TabChild::GetOuterRect() {
--- a/dom/ipc/TabChild.h
+++ b/dom/ipc/TabChild.h
@@ -665,21 +665,16 @@ class TabChild final : public TabChildBa
  protected:
   virtual ~TabChild();
 
   virtual PWindowGlobalChild* AllocPWindowGlobalChild(
       const WindowGlobalInit& aInit) override;
 
   virtual bool DeallocPWindowGlobalChild(PWindowGlobalChild* aActor) override;
 
-  virtual PRemoteFrameChild* AllocPRemoteFrameChild(
-      const nsString& aName, const nsString& aRemoteType) override;
-
-  virtual bool DeallocPRemoteFrameChild(PRemoteFrameChild* aActor) override;
-
   virtual mozilla::ipc::IPCResult RecvDestroy() override;
 
   virtual mozilla::ipc::IPCResult RecvSetDocShellIsActive(
       const bool& aIsActive) override;
 
   virtual mozilla::ipc::IPCResult RecvRenderLayers(
       const bool& aEnabled, const bool& aForce,
       const layers::LayersObserverEpoch& aEpoch) override;
--- a/dom/ipc/TabParent.cpp
+++ b/dom/ipc/TabParent.cpp
@@ -17,17 +17,16 @@
 #include "mozilla/dom/ContentBridgeParent.h"
 #include "mozilla/dom/ContentParent.h"
 #include "mozilla/dom/DataTransfer.h"
 #include "mozilla/dom/DataTransferItemList.h"
 #include "mozilla/dom/Event.h"
 #include "mozilla/dom/indexedDB/ActorsParent.h"
 #include "mozilla/dom/IPCBlobUtils.h"
 #include "mozilla/dom/PaymentRequestParent.h"
-#include "mozilla/dom/RemoteFrameParent.h"
 #include "mozilla/EventStateManager.h"
 #include "mozilla/gfx/2D.h"
 #include "mozilla/gfx/DataSurfaceHelpers.h"
 #include "mozilla/gfx/GPUProcessManager.h"
 #include "mozilla/Hal.h"
 #include "mozilla/IMEStateManager.h"
 #include "mozilla/jsipc/CrossProcessObjectWrappers.h"
 #include "mozilla/layers/AsyncDragMetrics.h"
@@ -299,20 +298,16 @@ void TabParent::SetOwnerElement(Element*
   nsCOMPtr<nsIWidget> widget = GetTopLevelWidget();
   if (widget) {
     WindowsHandle widgetNativeData = reinterpret_cast<WindowsHandle>(
         widget->GetNativeData(NS_NATIVE_SHAREABLE_WINDOW));
     if (widgetNativeData) {
       Unused << SendSetWidgetNativeData(widgetNativeData);
     }
   }
-
-  if (mRenderFrame.IsInitialized()) {
-    mRenderFrame.OwnerContentChanged();
-  }
 }
 
 NS_IMETHODIMP TabParent::GetOwnerElement(Element** aElement) {
   *aElement = do_AddRef(GetOwnerElement()).take();
   return NS_OK;
 }
 
 void TabParent::AddWindowListeners() {
@@ -616,18 +611,26 @@ void TabParent::LoadURL(nsIURI* aURI) {
     mDelayedURL = spec;
     return;
   }
 
   Unused << SendLoadURL(spec, GetShowInfo());
 }
 
 void TabParent::InitRendering() {
+  RefPtr<nsFrameLoader> frameLoader = GetFrameLoader();
+
   MOZ_ASSERT(!mRenderFrame.IsInitialized());
-  mRenderFrame.Initialize(this);
+  MOZ_ASSERT(frameLoader);
+
+  if (!frameLoader) {
+    return;
+  }
+
+  mRenderFrame.Initialize(frameLoader);
   MOZ_ASSERT(mRenderFrame.IsInitialized());
 
   layers::LayersId layersId = mRenderFrame.GetLayersId();
   AddTabParentToTable(layersId, this);
 
   TextureFactoryIdentifier textureFactoryIdentifier;
   mRenderFrame.GetTextureFactoryIdentifier(&textureFactoryIdentifier);
   Unused << SendInitRendering(textureFactoryIdentifier, layersId,
@@ -1007,35 +1010,16 @@ PWindowGlobalParent* TabParent::AllocPWi
 }
 
 bool TabParent::DeallocPWindowGlobalParent(PWindowGlobalParent* aActor) {
   // Free reference from AllocPWindowGlobalParent.
   static_cast<WindowGlobalParent*>(aActor)->Release();
   return true;
 }
 
-IPCResult TabParent::RecvPRemoteFrameConstructor(PRemoteFrameParent* aActor,
-                                                 const nsString& aName,
-                                                 const nsString& aRemoteType) {
-  static_cast<RemoteFrameParent*>(aActor)->Init(aName, aRemoteType);
-  return IPC_OK();
-}
-
-PRemoteFrameParent* TabParent::AllocPRemoteFrameParent(
-    const nsString& aName, const nsString& aRemoteType) {
-  // Reference freed in DeallocPRemoteFrameParent.
-  return do_AddRef(new RemoteFrameParent()).take();
-}
-
-bool TabParent::DeallocPRemoteFrameParent(PRemoteFrameParent* aActor) {
-  // Free reference from AllocPRemoteFrameParent.
-  static_cast<RemoteFrameParent*>(aActor)->Release();
-  return true;
-}
-
 void TabParent::SendMouseEvent(const nsAString& aType, float aX, float aY,
                                int32_t aButton, int32_t aClickCount,
                                int32_t aModifiers,
                                bool aIgnoreRootScrollFrame) {
   if (!mIsDestroyed) {
     Unused << PBrowserParent::SendMouseEvent(nsString(aType), aX, aY, aButton,
                                              aClickCount, aModifiers,
                                              aIgnoreRootScrollFrame);
--- a/dom/ipc/TabParent.h
+++ b/dom/ipc/TabParent.h
@@ -311,25 +311,16 @@ class TabParent final : public PBrowserP
 
   PWindowGlobalParent* AllocPWindowGlobalParent(const WindowGlobalInit& aInit);
 
   bool DeallocPWindowGlobalParent(PWindowGlobalParent* aActor);
 
   virtual mozilla::ipc::IPCResult RecvPWindowGlobalConstructor(
       PWindowGlobalParent* aActor, const WindowGlobalInit& aInit) override;
 
-  virtual PRemoteFrameParent* AllocPRemoteFrameParent(
-      const nsString& aPresentationURL, const nsString& aRemoteType) override;
-
-  virtual bool DeallocPRemoteFrameParent(PRemoteFrameParent* aActor) override;
-
-  virtual mozilla::ipc::IPCResult RecvPRemoteFrameConstructor(
-      PRemoteFrameParent* aActor, const nsString& aPresentationURL,
-      const nsString& aRemoteType) override;
-
   void LoadURL(nsIURI* aURI);
 
   void InitRendering();
   void MaybeShowFrame();
 
   // XXX/cjones: it's not clear what we gain by hiding these
   // message-sending functions under a layer of indirection and
   // eating the return values
@@ -553,18 +544,16 @@ class TabParent final : public PBrowserP
   bool IsReadyToHandleInputEvents() { return mIsReadyToHandleInputEvents; }
 
   static bool AreRecordReplayTabsActive() {
     return gNumActiveRecordReplayTabs != 0;
   }
 
   void NavigateByKey(bool aForward, bool aForDocumentNavigation);
 
-  ShowInfo GetShowInfo();
-
  protected:
   bool ReceiveMessage(
       const nsString& aMessage, bool aSync, ipc::StructuredCloneData* aData,
       mozilla::jsipc::CpowHolder* aCpows, nsIPrincipal* aPrincipal,
       nsTArray<ipc::StructuredCloneData>* aJSONRetVal = nullptr);
 
   mozilla::ipc::IPCResult RecvAsyncAuthPrompt(const nsCString& aUri,
                                               const nsString& aRealm,
@@ -723,16 +712,18 @@ class TabParent final : public PBrowserP
   // and have to ensure that the child did not modify links to be loaded.
   bool QueryDropLinksForVerification();
   nsTArray<nsString> mVerifyDropLinks;
 
 #ifdef DEBUG
   int32_t mActiveSupressDisplayportCount;
 #endif
 
+  ShowInfo GetShowInfo();
+
  private:
   // This is used when APZ needs to find the TabParent associated with a layer
   // to dispatch events.
   typedef nsDataHashtable<nsUint64HashKey, TabParent*> LayerToTabParentTable;
   static LayerToTabParentTable* sLayerToTabParentTable;
 
   static void AddTabParentToTable(layers::LayersId aLayersId,
                                   TabParent* aTabParent);
--- a/dom/ipc/moz.build
+++ b/dom/ipc/moz.build
@@ -42,18 +42,16 @@ EXPORTS.mozilla.dom += [
     'FilePickerParent.h',
     'JSWindowActorChild.h',
     'JSWindowActorParent.h',
     'JSWindowActorService.h',
     'MemoryReportRequest.h',
     'nsIContentChild.h',
     'nsIContentParent.h',
     'PermissionMessageUtils.h',
-    'RemoteFrameChild.h',
-    'RemoteFrameParent.h',
     'TabChild.h',
     'TabContext.h',
     'TabMessageUtils.h',
     'TabParent.h',
     'URLClassifierChild.h',
     'URLClassifierParent.h',
     'WindowGlobalChild.h',
     'WindowGlobalParent.h',
@@ -83,18 +81,16 @@ UNIFIED_SOURCES += [
     'MemMapSnapshot.cpp',
     'MemoryReportRequest.cpp',
     'MMPrinter.cpp',
     'nsIContentChild.cpp',
     'nsIContentParent.cpp',
     'PermissionMessageUtils.cpp',
     'PreallocatedProcessManager.cpp',
     'ProcessPriorityManager.cpp',
-    'RemoteFrameChild.cpp',
-    'RemoteFrameParent.cpp',
     'SharedMap.cpp',
     'SharedStringMap.cpp',
     'StructuredCloneData.cpp',
     'TabChild.cpp',
     'TabContext.cpp',
     'TabMessageUtils.cpp',
     'TabParent.cpp',
     'URLClassifierParent.cpp',
@@ -119,17 +115,16 @@ IPDL_SOURCES += [
     'PContentPermission.ipdlh',
     'PContentPermissionRequest.ipdl',
     'PCycleCollectWithLogs.ipdl',
     'PFilePicker.ipdl',
     'PLoginReputation.ipdl',
     'PPluginWidget.ipdl',
     'PProcessHangMonitor.ipdl',
     'PrefsTypes.ipdlh',
-    'PRemoteFrame.ipdl',
     'PTabContext.ipdlh',
     'PURLClassifier.ipdl',
     'PURLClassifierInfo.ipdlh',
     'PURLClassifierLocal.ipdl',
     'PWindowGlobal.ipdl',
     'ServiceWorkerConfiguration.ipdlh',
 ]
 
--- a/dom/ipc/nsIContentParent.cpp
+++ b/dom/ipc/nsIContentParent.cpp
@@ -15,28 +15,26 @@
 #include "mozilla/dom/PermissionMessageUtils.h"
 #include "mozilla/dom/ProcessMessageManager.h"
 #include "mozilla/dom/TabParent.h"
 #include "mozilla/dom/ipc/IPCBlobInputStreamParent.h"
 #include "mozilla/dom/ipc/StructuredCloneData.h"
 #include "mozilla/jsipc/CrossProcessObjectWrappers.h"
 #include "mozilla/ipc/FileDescriptorSetParent.h"
 #include "mozilla/ipc/PFileDescriptorSetParent.h"
-#include "mozilla/ipc/PIPCBlobInputStreamParent.h"
 #include "mozilla/ipc/IPCStreamAlloc.h"
 #include "mozilla/ipc/IPCStreamDestination.h"
 #include "mozilla/ipc/IPCStreamSource.h"
 #include "mozilla/Unused.h"
 
 #include "MMPrinter.h"
 #include "nsIWebBrowserChrome.h"
 #include "nsPrintfCString.h"
 #include "xpcpublic.h"
 
-using namespace mozilla::ipc;
 using namespace mozilla::jsipc;
 
 // XXX need another bug to move this to a common header.
 #ifdef DISABLE_ASSERTS_FOR_FUZZING
 #  define ASSERT_UNLESS_FUZZING(...) \
     do {                             \
     } while (0)
 #else
deleted file mode 100644
--- a/dom/ipc/tests/file_dummy.html
+++ /dev/null
@@ -1,1 +0,0 @@
-<h1>This is a dummy file!</h1>
--- a/dom/ipc/tests/mochitest.ini
+++ b/dom/ipc/tests/mochitest.ini
@@ -18,12 +18,8 @@ skip-if = toolkit == 'cocoa' # cocoa: di
 skip-if = !(crashreporter && !e10s && (toolkit == 'gtk3' || toolkit == 'cocoa' || toolkit == 'windows'))
 [test_temporaryfile_stream.html]
 skip-if = !e10s
 support-files =
   blob_verify.sjs
   !/dom/canvas/test/captureStream_common.js
 [test_Preallocated.html]
 skip-if = !e10s
-[test_force_oop_iframe.html]
-skip-if = !e10s || webrender # oop-iframes trigger a debug assertion in webrender picture caching
-support-files =
-  file_dummy.html
deleted file mode 100644
--- a/dom/ipc/tests/test_force_oop_iframe.html
+++ /dev/null
@@ -1,55 +0,0 @@
-<!DOCTYPE HTML>
-<html>
-<head>
-  <script type="application/javascript" src="/tests/SimpleTest/SimpleTest.js"></script>
-  <script type="application/javascript" src="/tests/SimpleTest/AddTask.js"></script>
-  <script type="application/javascript" src="/tests/SimpleTest/ChromeTask.js"></script>
-  <link rel="stylesheet" type="text/css" href="/tests/SimpleTest/test.css"/>
-</head>
-<body>
-
-<script type="application/javascript">
-"use strict";
-/* eslint-env mozilla/frame-script */
-
-add_task(async function() {
-  await SpecialPowers.pushPrefEnv({"set": [["browser.fission.oopif.attribute", true]]});
-
-  // This iframe should be loaded out of process. Unfortunately as of the time
-  // of this test's creation, many different events which we could use to detect
-  // this load have not been implemented yet.
-  let contentCreated = ChromeTask.spawn(null, async function() {
-    let wgp = await new Promise(resolve => {
-      function observer(parent) {
-        info("WGP with origin: " + parent.documentPrincipal.origin);
-        if (parent.documentPrincipal.origin !== "http://mochi.test:8888") {
-          return;
-        }
-
-        Services.obs.removeObserver(observer, "window-global-created");
-        resolve(parent);
-      }
-      Services.obs.addObserver(observer, "window-global-created");
-    });
-
-    is(wgp.isInProcess, false, "not in-process");
-    ok(wgp.rootFrameLoader, "Has frameloader");
-    ok(wgp.documentPrincipal, "Has document principal");
-  });
-
-  var iframe = document.createElement("iframe");
-  iframe.setAttribute("fission", "true");
-  iframe.setAttribute("src", "file_dummy.html");
-  document.body.appendChild(iframe);
-
-  // Check that this isn't loaded in-process, or using a nested tabParent object.
-  let frameLoader = SpecialPowers.wrap(iframe).frameLoader;
-  is(frameLoader.docShell, null);
-  is(frameLoader.tabParent, null);
-
-  await contentCreated;
-});
-
-</script>
-</body>
-</html>
--- a/gfx/vr/ipc/PVR.ipdl
+++ b/gfx/vr/ipc/PVR.ipdl
@@ -1,15 +1,15 @@
 /* -*- Mode: C++; tab-width: 8; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
 /* This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
 
 using mozilla::TimeStamp from "mozilla/TimeStamp.h";
-using mozilla::gfx::OpenVRControllerType from "VRMessageUtils.h";
+using mozilla::gfx::OpenVRControllerType from "gfxVR.h";
 using mozilla::dom::NativeThreadId from "mozilla/dom/TabMessageUtils.h";
 
 include GraphicsMessages;
 include protocol PVRGPU;
 
 include "VRMessageUtils.h";
 
 namespace mozilla {
--- a/layout/generic/nsSubDocumentFrame.cpp
+++ b/layout/generic/nsSubDocumentFrame.cpp
@@ -296,25 +296,28 @@ static void WrapBackgroundColorInOwnLaye
   aList->AppendToTop(&tempItems);
 }
 
 void nsSubDocumentFrame::BuildDisplayList(nsDisplayListBuilder* aBuilder,
                                           const nsDisplayListSet& aLists) {
   if (!IsVisibleForPainting()) return;
 
   nsFrameLoader* frameLoader = FrameLoader();
-  bool isRemoteFrame = frameLoader && frameLoader->IsRemoteFrame();
+  RenderFrame* rf = nullptr;
+  if (frameLoader) {
+    rf = frameLoader->GetCurrentRenderFrame();
+  }
 
   // If we are pointer-events:none then we don't need to HitTest background
   bool pointerEventsNone =
       StyleUI()->mPointerEvents == NS_STYLE_POINTER_EVENTS_NONE;
   if (!aBuilder->IsForEventDelivery() || !pointerEventsNone) {
     nsDisplayListCollection decorations(aBuilder);
     DisplayBorderBackgroundOutline(aBuilder, decorations);
-    if (isRemoteFrame) {
+    if (rf) {
       // Wrap background colors of <iframe>s with remote subdocuments in their
       // own layer so we generate a ColorLayer. This is helpful for optimizing
       // compositing; we can skip compositing the ColorLayer when the
       // remote content is opaque.
       WrapBackgroundColorInOwnLayer(aBuilder, this,
                                     decorations.BorderBackground());
     }
     decorations.MoveTo(aLists);
@@ -327,17 +330,17 @@ void nsSubDocumentFrame::BuildDisplayLis
   // If we're passing pointer events to children then we have to descend into
   // subdocuments no matter what, to determine which parts are transparent for
   // hit-testing or event regions.
   bool needToDescend = aBuilder->GetDescendIntoSubdocuments();
   if (!mInnerView || !needToDescend) {
     return;
   }
 
-  if (isRemoteFrame) {
+  if (rf) {
     // We're the subdoc for <browser remote="true"> and it has
     // painted content.  Display its shadow layer tree.
     DisplayListClipState::AutoSaveRestore clipState(aBuilder);
 
     nsPoint offset = aBuilder->ToReferenceFrame(this);
     nsRect bounds = this->EnsureInnerView()->GetBounds() + offset;
     clipState.ClipContentDescendants(bounds);
 
@@ -990,16 +993,20 @@ nsFrameLoader* nsSubDocumentFrame::Frame
     nsCOMPtr<nsIFrameLoaderOwner> loaderOwner = do_QueryInterface(content);
     if (loaderOwner) {
       mFrameLoader = loaderOwner->GetFrameLoader();
     }
   }
   return mFrameLoader;
 }
 
+mozilla::layout::RenderFrame* nsSubDocumentFrame::GetRenderFrame() const {
+  return FrameLoader() ? FrameLoader()->GetCurrentRenderFrame() : nullptr;
+}
+
 // XXX this should be called ObtainDocShell or something like that,
 // to indicate that it could have side effects
 nsIDocShell* nsSubDocumentFrame::GetDocShell() {
   // How can FrameLoader() return null???
   if (NS_WARN_IF(!FrameLoader())) {
     return nullptr;
   }
   return mFrameLoader->GetDocShell(IgnoreErrors());
--- a/layout/generic/nsSubDocumentFrame.h
+++ b/layout/generic/nsSubDocumentFrame.h
@@ -113,24 +113,26 @@ class nsSubDocumentFrame final : public 
   bool PassPointerEventsToChildren();
 
   void MaybeShowViewer() {
     if (!mDidCreateDoc && !mCallingShow) {
       ShowViewer();
     }
   }
 
-  nsFrameLoader* FrameLoader() const;
+  mozilla::layout::RenderFrame* GetRenderFrame() const;
 
  protected:
   friend class AsyncFrameInit;
 
   // Helper method to look up the HTML marginwidth & marginheight attributes.
   mozilla::CSSIntSize GetMarginAttributes();
 
+  nsFrameLoader* FrameLoader() const;
+
   bool IsInline() { return mIsInline; }
 
   nscoord GetIntrinsicISize();
   nscoord GetIntrinsicBSize();
 
   // Show our document viewer. The document viewer is hidden via a script
   // runner, so that we can save and restore the presentation if we're
   // being reframed.
--- a/layout/ipc/RenderFrame.cpp
+++ b/layout/ipc/RenderFrame.cpp
@@ -3,17 +3,16 @@
 /* This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
 
 #include "base/basictypes.h"
 
 #include "mozilla/dom/ContentParent.h"
 #include "mozilla/dom/TabParent.h"
-#include "mozilla/dom/RemoteFrameChild.h"
 #include "mozilla/layers/CompositorBridgeParent.h"
 #include "mozilla/layers/CompositorTypes.h"
 #include "mozilla/layers/LayerTransactionParent.h"
 #include "nsFrameLoader.h"
 #include "nsStyleStructInlines.h"
 #include "nsSubDocumentFrame.h"
 #include "RenderFrame.h"
 #include "mozilla/gfx/GPUProcessManager.h"
@@ -24,99 +23,116 @@
 
 using namespace mozilla::dom;
 using namespace mozilla::gfx;
 using namespace mozilla::layers;
 
 namespace mozilla {
 namespace layout {
 
-static already_AddRefed<LayerManager> GetLayerManager(TabParent* aTabParent) {
-  if (Element* element = aTabParent->GetOwnerElement()) {
-    return nsContentUtils::LayerManagerForContent(element);
+static already_AddRefed<LayerManager> GetLayerManager(
+    nsFrameLoader* aFrameLoader) {
+  if (nsIContent* content = aFrameLoader->GetOwnerContent()) {
+    RefPtr<LayerManager> lm = nsContentUtils::LayerManagerForContent(content);
+    if (lm) {
+      return lm.forget();
+    }
   }
-  return nullptr;
+
+  Document* doc = aFrameLoader->GetOwnerDoc();
+  if (!doc) {
+    return nullptr;
+  }
+  return nsContentUtils::LayerManagerForDocument(doc);
 }
 
 RenderFrame::RenderFrame()
     : mLayersId{0},
-      mTabParent(nullptr),
+      mFrameLoader(nullptr),
       mLayerManager(nullptr),
       mInitialized(false),
       mLayersConnected(false) {}
 
 RenderFrame::~RenderFrame() {}
 
-bool RenderFrame::Initialize(TabParent* aTabParent) {
-  if (mInitialized || !aTabParent) {
+bool RenderFrame::Initialize(nsFrameLoader* aFrameLoader) {
+  if (mInitialized || !aFrameLoader) {
     return false;
   }
 
-  mTabParent = aTabParent;
-  RefPtr<LayerManager> lm = GetLayerManager(mTabParent);
+  mFrameLoader = aFrameLoader;
+  RefPtr<LayerManager> lm = GetLayerManager(mFrameLoader);
   PCompositorBridgeChild* compositor =
       lm ? lm->GetCompositorBridgeChild() : nullptr;
-  mTabProcessId = mTabParent->Manager()->AsContentParent()->OtherPid();
+
+  TabParent* browser = TabParent::GetFrom(aFrameLoader);
+  mTabProcessId = browser->Manager()->AsContentParent()->OtherPid();
 
   // Our remote frame will push layers updates to the compositor,
   // and we'll keep an indirect reference to that tree.
   GPUProcessManager* gpm = GPUProcessManager::Get();
   mLayersConnected = gpm->AllocateAndConnectLayerTreeId(
       compositor, mTabProcessId, &mLayersId, &mCompositorOptions);
 
   mInitialized = true;
   return true;
 }
 
 void RenderFrame::Destroy() {
   if (mLayersId.IsValid()) {
     GPUProcessManager::Get()->UnmapLayerTreeId(mLayersId, mTabProcessId);
   }
 
-  mTabParent = nullptr;
+  mFrameLoader = nullptr;
   mLayerManager = nullptr;
 }
 
 void RenderFrame::EnsureLayersConnected(CompositorOptions* aCompositorOptions) {
-  RefPtr<LayerManager> lm = GetLayerManager(mTabParent);
+  RefPtr<LayerManager> lm = GetLayerManager(mFrameLoader);
   if (!lm) {
     return;
   }
 
   if (!lm->GetCompositorBridgeChild()) {
     return;
   }
 
   mLayersConnected = lm->GetCompositorBridgeChild()->SendNotifyChildRecreated(
       mLayersId, &mCompositorOptions);
   *aCompositorOptions = mCompositorOptions;
 }
 
 LayerManager* RenderFrame::AttachLayerManager() {
   RefPtr<LayerManager> lm;
-  if (mTabParent) {
-    lm = GetLayerManager(mTabParent);
+  if (mFrameLoader) {
+    lm = GetLayerManager(mFrameLoader);
   }
 
   // Perhaps the document containing this frame currently has no presentation?
   if (lm && lm->GetCompositorBridgeChild() && lm != mLayerManager) {
     mLayersConnected =
         lm->GetCompositorBridgeChild()->SendAdoptChild(mLayersId);
     FrameLayerBuilder::InvalidateAllLayers(lm);
   }
 
   mLayerManager = lm.forget();
   return mLayerManager;
 }
 
-void RenderFrame::OwnerContentChanged() { Unused << AttachLayerManager(); }
+void RenderFrame::OwnerContentChanged(nsIContent* aContent) {
+  MOZ_ASSERT(!mFrameLoader || mFrameLoader->GetOwnerContent() == aContent,
+             "Don't build new map if owner is same!");
+
+  Unused << AttachLayerManager();
+}
 
 void RenderFrame::GetTextureFactoryIdentifier(
     TextureFactoryIdentifier* aTextureFactoryIdentifier) const {
-  RefPtr<LayerManager> lm = mTabParent ? GetLayerManager(mTabParent) : nullptr;
+  RefPtr<LayerManager> lm =
+      mFrameLoader ? GetLayerManager(mFrameLoader) : nullptr;
   // Perhaps the document containing this frame currently has no presentation?
   if (lm) {
     *aTextureFactoryIdentifier = lm->GetTextureFactoryIdentifier();
   } else {
     *aTextureFactoryIdentifier = TextureFactoryIdentifier();
   }
 }
 
@@ -164,58 +180,59 @@ nsDisplayRemote::nsDisplayRemote(nsDispl
   if (aBuilder->IsInsidePointerEventsNoneDoc() || frameIsPointerEventsNone) {
     mEventRegionsOverride |= EventRegionsOverride::ForceEmptyHitRegion;
   }
   if (nsLayoutUtils::HasDocumentLevelListenersForApzAwareEvents(
           aFrame->PresShell())) {
     mEventRegionsOverride |= EventRegionsOverride::ForceDispatchToContent;
   }
 
-  if (nsFrameLoader* frameLoader = GetFrameLoader()) {
-    // TODO: We need to handle acquiring a TabId in the remote sub-frame case
-    // for fission.
-    if (TabParent* browser = TabParent::GetFrom(frameLoader)) {
+  nsFrameLoader* frameLoader = GetRenderFrame()->GetFrameLoader();
+  if (frameLoader) {
+    TabParent* browser = TabParent::GetFrom(frameLoader);
+    if (browser) {
       mTabId = browser->GetTabId();
     }
   }
 }
 
 mozilla::LayerState nsDisplayRemote::GetLayerState(
     nsDisplayListBuilder* aBuilder, LayerManager* aManager,
     const ContainerLayerParameters& aParameters) {
   if (IsTempLayerManager(aManager)) {
     return mozilla::LAYER_NONE;
   }
   return mozilla::LAYER_ACTIVE_FORCE;
 }
 
 bool nsDisplayRemote::HasDeletedFrame() const {
   // RenderFrame might change without invalidating nsSubDocumentFrame.
-  return !GetFrameLoader() || nsDisplayItem::HasDeletedFrame();
+  return !GetRenderFrame() || nsDisplayItem::HasDeletedFrame();
 }
 
 already_AddRefed<Layer> nsDisplayRemote::BuildLayer(
     nsDisplayListBuilder* aBuilder, LayerManager* aManager,
     const ContainerLayerParameters& aContainerParameters) {
+  MOZ_ASSERT(GetRenderFrame());
   MOZ_ASSERT(mFrame, "Makes no sense to have a shadow tree without a frame");
 
   if (IsTempLayerManager(aManager)) {
     // This can happen if aManager is a "temporary" manager, or if the
     // widget's layer manager changed out from under us.  We need to
     // FIXME handle the former case somehow, probably with an API to
     // draw a manager's subtree.  The latter is bad bad bad, but the the
     // MOZ_ASSERT() above will flag it.  Returning nullptr here will just
     // cause the shadow subtree not to be rendered.
     if (!aContainerParameters.mForEventsAndPluginsOnly) {
       NS_WARNING("Remote iframe not rendered");
     }
     return nullptr;
   }
 
-  LayersId remoteId = GetRemoteLayersId();
+  LayersId remoteId = GetRenderFrame()->GetLayersId();
 
   if (!remoteId.IsValid()) {
     return nullptr;
   }
 
   RefPtr<Layer> layer =
       aManager->GetLayerBuilder()->GetLeafLayerFor(aBuilder, this);
 
@@ -290,17 +307,16 @@ bool nsDisplayRemote::UpdateScrollData(
     aLayerData->SetTransform(
         mozilla::gfx::Matrix4x4::Translation(mOffset.x, mOffset.y, 0.0));
     aLayerData->SetEventRegionsOverride(mEventRegionsOverride);
   }
   return true;
 }
 
 LayersId nsDisplayRemote::GetRemoteLayersId() const {
-  nsFrameLoader* frameLoader = GetFrameLoader();
-  MOZ_ASSERT(frameLoader && frameLoader->IsRemoteFrame());
-  return frameLoader->GetLayersId();
+  MOZ_ASSERT(GetRenderFrame());
+  return GetRenderFrame()->GetLayersId();
 }
 
-nsFrameLoader* nsDisplayRemote::GetFrameLoader() const {
-  return mFrame ? static_cast<nsSubDocumentFrame*>(mFrame)->FrameLoader()
+mozilla::layout::RenderFrame* nsDisplayRemote::GetRenderFrame() const {
+  return mFrame ? static_cast<nsSubDocumentFrame*>(mFrame)->GetRenderFrame()
                 : nullptr;
 }
--- a/layout/ipc/RenderFrame.h
+++ b/layout/ipc/RenderFrame.h
@@ -16,83 +16,77 @@
 #include "mozilla/layers/LayersTypes.h"
 #include "nsDisplayList.h"
 
 class nsFrameLoader;
 class nsSubDocumentFrame;
 
 namespace mozilla {
 
-namespace dom {
-class TabParent;
-}  // namespace dom
-
 namespace layers {
 struct TextureFactoryIdentifier;
 }  // namespace layers
 
 namespace layout {
 
-/**
- * RenderFrame connects and manages layer trees for remote frames. It is
- * directly owned by a TabParent and always lives in the parent process.
- */
 class RenderFrame final {
   typedef mozilla::layers::CompositorOptions CompositorOptions;
   typedef mozilla::layers::LayerManager LayerManager;
   typedef mozilla::layers::LayersId LayersId;
   typedef mozilla::layers::TextureFactoryIdentifier TextureFactoryIdentifier;
 
  public:
   RenderFrame();
   virtual ~RenderFrame();
 
-  bool Initialize(dom::TabParent* aTabParent);
+  bool Initialize(nsFrameLoader* aFrameLoader);
   void Destroy();
 
   void EnsureLayersConnected(CompositorOptions* aCompositorOptions);
   LayerManager* AttachLayerManager();
-  void OwnerContentChanged();
+  void OwnerContentChanged(nsIContent* aContent);
 
+  nsFrameLoader* GetFrameLoader() const { return mFrameLoader; }
   LayersId GetLayersId() const { return mLayersId; }
   CompositorOptions GetCompositorOptions() const { return mCompositorOptions; }
 
   void GetTextureFactoryIdentifier(
       TextureFactoryIdentifier* aTextureFactoryIdentifier) const;
 
   bool IsInitialized() const { return mInitialized; }
   bool IsLayersConnected() const { return mLayersConnected; }
 
  private:
-  // The process id of the remote frame. This is used by the compositor to
-  // do security checks on incoming layer transactions.
   base::ProcessId mTabProcessId;
-  // The layers id of the remote frame.
+  // When our child frame is pushing transactions directly to the
+  // compositor, this is the ID of its layer tree in the compositor's
+  // context.
   LayersId mLayersId;
   // The compositor options for this layers id. This is only meaningful if
   // the compositor actually knows about this layers id (i.e. when
   // mLayersConnected is true).
   CompositorOptions mCompositorOptions;
 
-  dom::TabParent* mTabParent;
+  RefPtr<nsFrameLoader> mFrameLoader;
   RefPtr<LayerManager> mLayerManager;
 
   bool mInitialized;
   // A flag that indicates whether or not the compositor knows about the
   // layers id. In some cases this RenderFrame is not connected to the
   // compositor and so this flag is false.
   bool mLayersConnected;
 };
 
 }  // namespace layout
 }  // namespace mozilla
 
 /**
- * A nsDisplayRemote will graft a remote frame's shadow layer tree (for a given
- * nsFrameLoader) into its parent frame's layer tree.
+ * A DisplayRemote exists solely to graft a child process's shadow
+ * layer tree (for a given RenderFrame) into its parent
+ * process's layer tree.
  */
 class nsDisplayRemote final : public nsDisplayItem {
   typedef mozilla::dom::TabId TabId;
   typedef mozilla::gfx::Matrix4x4 Matrix4x4;
   typedef mozilla::layers::EventRegionsOverride EventRegionsOverride;
   typedef mozilla::layers::Layer Layer;
   typedef mozilla::layers::LayersId LayersId;
   typedef mozilla::layers::RefLayer RefLayer;
@@ -124,16 +118,16 @@ class nsDisplayRemote final : public nsD
   bool UpdateScrollData(
       mozilla::layers::WebRenderScrollData* aData,
       mozilla::layers::WebRenderLayerScrollData* aLayerData) override;
 
   NS_DISPLAY_DECL_NAME("Remote", TYPE_REMOTE)
 
  private:
   LayersId GetRemoteLayersId() const;
-  nsFrameLoader* GetFrameLoader() const;
+  RenderFrame* GetRenderFrame() const;
 
   TabId mTabId;
   LayoutDeviceIntPoint mOffset;
   EventRegionsOverride mEventRegionsOverride;
 };
 
 #endif  // mozilla_layout_RenderFrame_h
--- a/modules/libpref/init/all.js
+++ b/modules/libpref/init/all.js
@@ -2677,17 +2677,17 @@ pref("security.notification_enable_delay
 
 #if defined(DEBUG) && !defined(ANDROID)
 pref("csp.about_uris_without_csp", "blank,printpreview,srcdoc,about,addons,cache-entry,config,crashes,debugging,devtools,downloads,home,memory,networking,newtab,performance,plugins,policies,profiles,restartrequired,searchreset,serviceworkers,sessionrestore,support,sync-log,telemetry,url-classifier,webrtc,welcomeback");
 // the following prefs are for testing purposes only.
 pref("csp.overrule_about_uris_without_csp_whitelist", false);
 pref("csp.skip_about_page_has_csp_assert", false);
 // assertion flag will be set to false after fixing Bug 1473549
 pref("security.allow_eval_with_system_principal", false);
-pref("security.uris_using_eval_with_system_principal", "autocomplete.xml,redux.js,react-redux.js,content-task.js,content-task.js,tree.xml,dialog.xml,preferencesbindings.js,wizard.xml,lodash.js,jszip.js,ajv-4.1.1.js,updates.js,setup,jsol.js,parent_utils.js,chrometask_chromescript");
+pref("security.uris_using_eval_with_system_principal", "autocomplete.xml,redux.js,react-redux.js,content-task.js,content-task.js,tree.xml,dialog.xml,preferencesbindings.js,wizard.xml,lodash.js,jszip.js,ajv-4.1.1.js,updates.js,setup,jsol.js,parent_utils.js");
 #endif
 
 // Default Content Security Policy to apply to signed contents.
 pref("security.signed_content.CSP.default", "script-src 'self'; style-src 'self'");
 
 // Mixed content blocking
 pref("security.mixed_content.block_active_content", false);
 pref("security.mixed_content.block_display_content", false);
deleted file mode 100644
--- a/testing/mochitest/tests/SimpleTest/ChromeTask.js
+++ /dev/null
@@ -1,179 +0,0 @@
-/* -*- indent-tabs-mode: nil; js-indent-level: 2 -*- */
-/* vim: set ts=2 et sw=2 tw=80 filetype=javascript: */
-/* This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this file,
- * You can obtain one at http://mozilla.org/MPL/2.0/. */
-
-"use strict";
-
-function ChromeTask_ChromeScript() {
-  "use strict";
-
-  const {Task} = ChromeUtils.import("resource://testing-common/Task.jsm");
-  const {Services} = ChromeUtils.import("resource://gre/modules/Services.jsm");
-  const AssertCls = ChromeUtils.import("resource://testing-common/Assert.jsm", null).Assert;
-
-  addMessageListener("chrome-task:spawn", function(aData) {
-    let id = aData.id;
-    let source = aData.runnable || "()=>{}";
-
-    function getStack(aStack) {
-      let frames = [];
-      for (let frame = aStack; frame; frame = frame.caller) {
-        frames.push(frame.filename + ":" + frame.name + ":" + frame.lineNumber);
-      }
-      return frames.join("\n");
-    }
-
-    /* eslint-disable no-unused-vars */
-    var Assert = new AssertCls((err, message, stack) => {
-      sendAsyncMessage("chrome-task:test-result", {
-        id,
-        condition: !err,
-        name: err ? err.message : message,
-        stack: getStack(err ? err.stack : stack),
-      });
-    });
-
-    var ok = Assert.ok.bind(Assert);
-    var is = Assert.equal.bind(Assert);
-    var isnot = Assert.notEqual.bind(Assert);
-
-    function todo(expr, name) {
-      sendAsyncMessage("chrome-task:test-todo", {id, expr, name});
-    }
-
-    function todo_is(a, b, name) {
-      sendAsyncMessage("chrome-task:test-todo_is", {id, a, b, name});
-    }
-
-    function info(name) {
-      sendAsyncMessage("chrome-task:test-info", {id, name});
-    }
-    /* eslint-enable no-unused-vars */
-
-    try {
-      let runnablestr = `
-        (() => {
-          return (${source});
-        })();`;
-
-      // eslint-disable-next-line no-eval
-      let runnable = eval(runnablestr);
-      let iterator = runnable.call(this, aData.arg);
-      Task.spawn(iterator).then((val) => {
-        sendAsyncMessage("chrome-task:complete", {
-          id,
-          result: val,
-        });
-      }, (e) => {
-        sendAsyncMessage("chrome-task:complete", {
-          id,
-          error: e.toString(),
-        });
-      });
-    } catch (e) {
-      sendAsyncMessage("chrome-task:complete", {
-        id,
-        error: e.toString(),
-      });
-    }
-  });
-}
-
-
-/**
- * This object provides the public module functions.
- */
-var ChromeTask = {
-  /**
-   * the ChromeScript if it has already been loaded.
-   */
-  _chromeScript: null,
-
-  /**
-   * Mapping from message id to associated promise.
-   */
-  _promises: new Map(),
-
-  /**
-   * Incrementing integer to generate unique message id.
-   */
-  _messageID: 1,
-
-  /**
-   * Creates and starts a new task in the chrome process.
-   *
-   * @param arg A single serializable argument that will be passed to the
-   *             task when executed on the content process.
-   * @param task
-   *        - A generator or function which will be serialized and sent to
-   *          the remote browser to be executed. Unlike Task.spawn, this
-   *          argument may not be an iterator as it will be serialized and
-   *          sent to the remote browser.
-   * @return A promise object where you can register completion callbacks to be
-   *         called when the task terminates.
-   * @resolves With the final returned value of the task if it executes
-   *           successfully.
-   * @rejects An error message if execution fails.
-   */
-  spawn: function ChromeTask_spawn(arg, task) {
-    // Load the frame script if needed.
-    let handle = ChromeTask._chromeScript;
-    if (!handle) {
-      handle = SpecialPowers.loadChromeScript(ChromeTask_ChromeScript);
-      handle.addMessageListener("chrome-task:complete", ChromeTask.onComplete);
-      handle.addMessageListener("chrome-task:test-result", ChromeTask.onResult);
-      handle.addMessageListener("chrome-task:test-info", ChromeTask.onInfo);
-      handle.addMessageListener("chrome-task:test-todo", ChromeTask.onTodo);
-      handle.addMessageListener("chrome-task:test-todo_is", ChromeTask.onTodoIs);
-      ChromeTask._chromeScript = handle;
-    }
-
-    let deferred = {};
-    deferred.promise = new Promise((resolve, reject) => {
-      deferred.resolve = resolve;
-      deferred.reject = reject;
-    });
-
-    let id = ChromeTask._messageID++;
-    ChromeTask._promises.set(id, deferred);
-
-    handle.sendAsyncMessage(
-      "chrome-task:spawn",
-      {
-        id,
-        runnable: task.toString(),
-        arg,
-      });
-
-    return deferred.promise;
-  },
-
-  onComplete(aData) {
-    let deferred = ChromeTask._promises.get(aData.id);
-    ChromeTask._promises.delete(aData.id);
-
-    if (aData.error) {
-      deferred.reject(aData.error);
-    } else {
-      deferred.resolve(aData.result);
-    }
-  },
-
-  onResult(aData) {
-    SimpleTest.record(aData.condition, aData.name);
-  },
-
-  onInfo(aData) {
-    SimpleTest.info(aData.name);
-  },
-
-  onTodo(aData) {
-    SimpleTest.todo(aData.expr, aData.name);
-  },
-
-  onTodoIs(aData) {
-    SimpleTest.todo_is(aData.a, aData.b, aData.name);
-  },
-};
--- a/testing/mochitest/tests/SimpleTest/moz.build
+++ b/testing/mochitest/tests/SimpleTest/moz.build
@@ -3,17 +3,16 @@
 # This Source Code Form is subject to the terms of the Mozilla Public
 # License, v. 2.0. If a copy of the MPL was not distributed with this
 # file, You can obtain one at http://mozilla.org/MPL/2.0/.
 
 TEST_HARNESS_FILES.testing.mochitest.tests.SimpleTest += [
     '/docshell/test/chrome/docshell_helpers.js',
     '/testing/specialpowers/content/MozillaLogger.js',
     'AddTask.js',
-    'ChromeTask.js',
     'EventUtils.js',
     'ExtensionTestUtils.js',
     'iframe-between-tests.html',
     'LogController.js',
     'MemoryStats.js',
     'MockObjects.js',
     'NativeKeyCodes.js',
     'paint_listener.js',
--- a/xpcom/ds/StaticAtoms.py
+++ b/xpcom/ds/StaticAtoms.py
@@ -419,17 +419,16 @@ STATIC_ATOMS = [
     Atom("featurePolicyViolation", "feature-policy-violation"),
     Atom("field", "field"),
     Atom("fieldset", "fieldset"),
     Atom("file", "file"),
     Atom("figcaption", "figcaption"),
     Atom("figure", "figure"),
     Atom("findbar", "findbar"),
     Atom("fixed", "fixed"),
-    Atom("fission", "fission"),
     Atom("flags", "flags"),
     Atom("flex", "flex"),
     Atom("flip", "flip"),
     Atom("floating", "floating"),
     Atom("floor", "floor"),
     Atom("flowlength", "flowlength"),
     Atom("focus", "focus"),
     Atom("focused", "focused"),