--- a/layout/base/nsCSSFrameConstructor.cpp
+++ b/layout/base/nsCSSFrameConstructor.cpp
@@ -880,17 +880,17 @@ nsFrameConstructorState::nsFrameConstruc
 #ifdef MOZ_XUL    
     mPopupItems(nullptr),
 #endif
     mFixedItems(aFixedContainingBlock),
     mAbsoluteItems(aAbsoluteContainingBlock),
     mFloatedItems(aFloatContainingBlock),
     // See PushAbsoluteContaningBlock below
     mFrameState(aHistoryState),
-    mAdditionalStateBits(nsFrameState(0)),
+    mAdditionalStateBits(0),
     // If the fixed-pos containing block is equal to the abs-pos containing
     // block, use the abs-pos containing block's abs-pos list for fixed-pos
 	// frames.
     mFixedPosIsAbsPos(aFixedContainingBlock == aAbsoluteContainingBlock),
     mHavePendingPopupgroup(false),
     mCreatingExtraFrames(false),
     mTreeMatchContext(true, nsRuleWalker::eRelevantLinkUnvisited,
                       aPresShell->GetDocument()),
@@ -914,17 +914,17 @@ nsFrameConstructorState::nsFrameConstruc
     mFrameManager(aPresShell->FrameManager()),
 #ifdef MOZ_XUL    
     mPopupItems(nullptr),
 #endif
     mFixedItems(aFixedContainingBlock),
     mAbsoluteItems(aAbsoluteContainingBlock),
     mFloatedItems(aFloatContainingBlock),
     // See PushAbsoluteContaningBlock below
-    mAdditionalStateBits(nsFrameState(0)),
+    mAdditionalStateBits(0),
     // If the fixed-pos containing block is equal to the abs-pos containing
     // block, use the abs-pos containing block's abs-pos list for fixed-pos
 	// frames.
     mFixedPosIsAbsPos(aFixedContainingBlock == aAbsoluteContainingBlock),
     mHavePendingPopupgroup(false),
     mCreatingExtraFrames(false),
     mTreeMatchContext(true, nsRuleWalker::eRelevantLinkUnvisited,
                       aPresShell->GetDocument()),
@@ -2870,17 +2870,17 @@ nsCSSFrameConstructor::ConstructSelectFr
   dom::HTMLSelectElement* sel = dom::HTMLSelectElement::FromContent(content);
   MOZ_ASSERT(sel);
   if (sel->IsCombobox()) {
     // Construct a frame-based combo box.
     // The frame-based combo box is built out of three parts. A display area, a button and
     // a dropdown list. The display area and button are created through anonymous content.
     // The drop-down list's frame is created explicitly. The combobox frame shares its content
     // with the drop-down list.
-    nsFrameState flags = NS_BLOCK_FLOAT_MGR;
+    uint32_t flags = NS_BLOCK_FLOAT_MGR;
     nsIFrame* comboboxFrame = NS_NewComboboxControlFrame(mPresShell, styleContext, flags);
 
     // Save the history state so we don't restore during construction
     // since the complete tree is required before we restore.
     nsILayoutHistoryState *historyState = aState.mFrameState;
     aState.mFrameState = nullptr;
     // Initialize the combobox frame
     InitAndRestoreFrame(aState, content,
@@ -8046,17 +8046,17 @@ nsCSSFrameConstructor::CreateContinuingF
     newFrame = NS_NewBlockFrame(shell, styleContext);
     newFrame->Init(content, aParentFrame, aFrame);
 #ifdef MOZ_XUL
   } else if (nsGkAtoms::XULLabelFrame == frameType) {
     newFrame = NS_NewXULLabelFrame(shell, styleContext);
     newFrame->Init(content, aParentFrame, aFrame);
 #endif  
   } else if (nsGkAtoms::columnSetFrame == frameType) {
-    newFrame = NS_NewColumnSetFrame(shell, styleContext, nsFrameState(0));
+    newFrame = NS_NewColumnSetFrame(shell, styleContext, 0);
     newFrame->Init(content, aParentFrame, aFrame);
   } else if (nsGkAtoms::pageFrame == frameType) {
     nsIFrame* canvasFrame;
     newFrame = ConstructPageFrame(shell, aPresContext, aParentFrame, aFrame,
                                   canvasFrame);
   } else if (nsGkAtoms::tableOuterFrame == frameType) {
     newFrame =
       CreateContinuingOuterTableFrame(shell, aPresContext, aFrame, aParentFrame,
@@ -10325,18 +10325,17 @@ nsCSSFrameConstructor::ConstructBlock(ns
   NS_ASSERTION(blockFrame->GetType() == nsGkAtoms::blockFrame, "not a block frame?");
   nsIFrame* parent = aParentFrame;
   nsRefPtr<nsStyleContext> blockStyle = aStyleContext;
   const nsStyleColumn* columns = aStyleContext->StyleColumn();
 
   if (columns->mColumnCount != NS_STYLE_COLUMN_COUNT_AUTO
       || columns->mColumnWidth.GetUnit() != eStyleUnit_Auto) {
     nsIFrame* columnSetFrame = nullptr;
-    columnSetFrame =
-      NS_NewColumnSetFrame(mPresShell, aStyleContext, nsFrameState(0));
+    columnSetFrame = NS_NewColumnSetFrame(mPresShell, aStyleContext, 0);
 
     InitAndRestoreFrame(aState, aContent, aParentFrame, columnSetFrame);
     blockStyle = mPresShell->StyleSet()->
       ResolveAnonymousBoxStyle(nsCSSAnonBoxes::columnContent, aStyleContext);
     parent = columnSetFrame;
     *aNewFrame = columnSetFrame;
 
     SetInitialSingleChild(columnSetFrame, blockFrame);

--- a/layout/base/nsIPresShell.h
+++ b/layout/base/nsIPresShell.h
@@ -36,17 +36,16 @@
 #include "nsWeakReference.h"
 #include <stdio.h> // for FILE definition
 #include "nsChangeHint.h"
 #include "nsRefPtrHashtable.h"
 #include "nsEventStates.h"
 #include "nsPresArena.h"
 #include "nsIImageLoadingContent.h"
 #include "nsMargin.h"
-#include "nsFrameState.h"
 
 class nsIContent;
 class nsDocShell;
 class nsIDocument;
 class nsIFrame;
 class nsPresContext;
 class nsStyleSet;
 class nsViewManager;
@@ -88,16 +87,17 @@ namespace a11y {
 class DocAccessible;
 } // namespace a11y
 } // namespace mozilla
 #endif
 class nsIWidget;
 struct nsArenaMemoryStats;
 
 typedef short SelectionType;
+typedef uint64_t nsFrameState;
 
 namespace mozilla {
 class Selection;
 
 namespace dom {
 class Element;
 class Touch;
 class ShadowRoot;

--- a/layout/forms/nsComboboxControlFrame.cpp
+++ b/layout/forms/nsComboboxControlFrame.cpp
@@ -93,17 +93,17 @@ public:
 
 NS_IMPL_ISUPPORTS1(nsComboButtonListener,
                    nsIDOMEventListener)
 
 // static class data member for Bug 32920
 nsComboboxControlFrame* nsComboboxControlFrame::sFocused = nullptr;
 
 nsIFrame*
-NS_NewComboboxControlFrame(nsIPresShell* aPresShell, nsStyleContext* aContext, nsFrameState aStateFlags)
+NS_NewComboboxControlFrame(nsIPresShell* aPresShell, nsStyleContext* aContext, uint32_t aStateFlags)
 {
   nsComboboxControlFrame* it = new (aPresShell) nsComboboxControlFrame(aContext);
 
   if (it) {
     // set the state flags (if any are provided)
     it->AddStateBits(aStateFlags);
   }
 

--- a/layout/forms/nsComboboxControlFrame.h
+++ b/layout/forms/nsComboboxControlFrame.h
@@ -41,17 +41,17 @@ class nsComboboxControlFrame : public ns
                                public nsIFormControlFrame,
                                public nsIComboboxControlFrame,
                                public nsIAnonymousContentCreator,
                                public nsISelectControlFrame,
                                public nsIRollupListener,
                                public nsIStatefulFrame
 {
 public:
-  friend nsIFrame* NS_NewComboboxControlFrame(nsIPresShell* aPresShell, nsStyleContext* aContext, nsFrameState aFlags);
+  friend nsIFrame* NS_NewComboboxControlFrame(nsIPresShell* aPresShell, nsStyleContext* aContext, uint32_t aFlags);
   friend class nsComboboxDisplayFrame;
 
   nsComboboxControlFrame(nsStyleContext* aContext);
   ~nsComboboxControlFrame();
 
   NS_DECL_QUERYFRAME
   NS_DECL_FRAMEARENA_HELPERS
 

--- a/layout/forms/nsSelectsAreaFrame.cpp
+++ b/layout/forms/nsSelectsAreaFrame.cpp
@@ -3,17 +3,17 @@
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
 #include "nsSelectsAreaFrame.h"
 #include "nsIContent.h"
 #include "nsListControlFrame.h"
 #include "nsDisplayList.h"
 
 nsIFrame*
-NS_NewSelectsAreaFrame(nsIPresShell* aShell, nsStyleContext* aContext, nsFrameState aFlags)
+NS_NewSelectsAreaFrame(nsIPresShell* aShell, nsStyleContext* aContext, uint32_t aFlags)
 {
   nsSelectsAreaFrame* it = new (aShell) nsSelectsAreaFrame(aContext);
 
   // We need NS_BLOCK_FLOAT_MGR to ensure that the options inside the select
   // aren't expanded by right floats outside the select.
   it->SetFlags(aFlags | NS_BLOCK_FLOAT_MGR);
 
   return it;

--- a/layout/forms/nsSelectsAreaFrame.h
+++ b/layout/forms/nsSelectsAreaFrame.h
@@ -8,17 +8,17 @@
 #include "mozilla/Attributes.h"
 #include "nsBlockFrame.h"
 
 class nsSelectsAreaFrame : public nsBlockFrame
 {
 public:
   NS_DECL_FRAMEARENA_HELPERS
 
-  friend nsIFrame* NS_NewSelectsAreaFrame(nsIPresShell* aShell, nsStyleContext* aContext, nsFrameState aFlags);
+  friend nsIFrame* NS_NewSelectsAreaFrame(nsIPresShell* aShell, nsStyleContext* aContext, uint32_t aFlags);
 
   virtual void BuildDisplayList(nsDisplayListBuilder*   aBuilder,
                                 const nsRect&           aDirtyRect,
                                 const nsDisplayListSet& aLists) MOZ_OVERRIDE;
 
   void BuildDisplayListInternal(nsDisplayListBuilder*   aBuilder,
                                 const nsRect&           aDirtyRect,
                                 const nsDisplayListSet& aLists);

--- a/layout/generic/moz.build
+++ b/layout/generic/moz.build
@@ -7,18 +7,16 @@
 TEST_DIRS += ['test']
 
 EXPORTS += [
     'nsCanvasFrame.h',
     'nsDirection.h',
     'nsFrameIdList.h',
     'nsFrameList.h',
     'nsFrameSelection.h',
-    'nsFrameState.h',
-    'nsFrameStateBits.h',
     'nsHTMLParts.h',
     'nsHTMLReflowMetrics.h',
     'nsHTMLReflowState.h',
     'nsIAnonymousContentCreator.h',
     'nsIFrame.h',
     'nsIFrameInlines.h',
     'nsIFrameUtil.h',
     'nsILineIterator.h',
@@ -58,17 +56,16 @@ UNIFIED_SOURCES += [
     'nsContainerFrame.cpp',
     'nsFirstLetterFrame.cpp',
     'nsFlexContainerFrame.cpp',
     'nsFloatManager.cpp',
     'nsFontInflationData.cpp',
     'nsFrame.cpp',
     'nsFrameList.cpp',
     'nsFrameSetFrame.cpp',
-    'nsFrameState.cpp',
     'nsFrameUtil.cpp',
     'nsGfxScrollFrame.cpp',
     'nsHTMLCanvasFrame.cpp',
     'nsHTMLReflowMetrics.cpp',
     'nsHTMLReflowState.cpp',
     'nsImageFrame.cpp',
     'nsImageMap.cpp',
     'nsInlineFrame.cpp',
@@ -121,9 +118,9 @@ LOCAL_INCLUDES += [
     '../base',
     '../forms',
     '../style',
     '../svg',
     '../tables',
     '../xul',
 ]
 
-JAR_MANIFESTS += ['jar.mn']
+JAR_MANIFESTS += ['jar.mn']
\ No newline at end of file

--- a/layout/generic/nsBlockFrame.cpp
+++ b/layout/generic/nsBlockFrame.cpp
@@ -240,17 +240,17 @@ NS_DECLARE_FRAME_PROPERTY(OverflowLinesP
 NS_DECLARE_FRAME_PROPERTY_FRAMELIST(OverflowOutOfFlowsProperty)
 NS_DECLARE_FRAME_PROPERTY_FRAMELIST(PushedFloatProperty)
 NS_DECLARE_FRAME_PROPERTY_FRAMELIST(OutsideBulletProperty)
 NS_DECLARE_FRAME_PROPERTY(InsideBulletProperty, nullptr)
 
 //----------------------------------------------------------------------
 
 nsIFrame*
-NS_NewBlockFrame(nsIPresShell* aPresShell, nsStyleContext* aContext, nsFrameState aFlags)
+NS_NewBlockFrame(nsIPresShell* aPresShell, nsStyleContext* aContext, uint32_t aFlags)
 {
   nsBlockFrame* it = new (aPresShell) nsBlockFrame(aContext);
   it->SetFlags(aFlags);
   return it;
 }
 
 NS_IMPL_FRAMEARENA_HELPERS(nsBlockFrame)
 

--- a/layout/generic/nsBlockFrame.h
+++ b/layout/generic/nsBlockFrame.h
@@ -65,16 +65,49 @@ class nsFirstLineFrame;
  * appear with the prev-in-flow before the next-in-flow.
  * -- While reflowing a block, its overflow line list
  * will usually be empty but in some cases will have lines
  * (while we reflow the block at its shrink-wrap width).
  * In this case any new overflowing content must be
  * prepended to the overflow lines.
  */
 
+// see nsHTMLParts.h for the public block state bits
+
+/**
+ * Something in the block has changed that requires Bidi resolution to be
+ * performed on the block. This flag must be either set on all blocks in a 
+ * continuation chain or none of them.
+ */
+#define NS_BLOCK_NEEDS_BIDI_RESOLUTION      NS_FRAME_STATE_BIT(20)
+#define NS_BLOCK_HAS_PUSHED_FLOATS          NS_FRAME_STATE_BIT(21)
+#define NS_BLOCK_HAS_LINE_CURSOR            NS_FRAME_STATE_BIT(24)
+#define NS_BLOCK_HAS_OVERFLOW_LINES         NS_FRAME_STATE_BIT(25)
+#define NS_BLOCK_HAS_OVERFLOW_OUT_OF_FLOWS  NS_FRAME_STATE_BIT(26)
+
+// Set on any block that has descendant frames in the normal
+// flow with 'clear' set to something other than 'none'
+// (including <BR CLEAR="..."> frames)
+#define NS_BLOCK_HAS_CLEAR_CHILDREN         NS_FRAME_STATE_BIT(27)
+
+// This block has had a child marked dirty, so before we reflow we need
+// to look through the lines to find any such children and mark
+// appropriate lines dirty.
+#define NS_BLOCK_LOOK_FOR_DIRTY_FRAMES      NS_FRAME_STATE_BIT(61)
+
+// Are our cached intrinsic widths intrinsic widths for font size
+// inflation?  i.e., what was the current state of
+// GetPresContext()->mInflationDisabledForShrinkWrap at the time they
+// were computed?
+// nsBlockFrame is the only thing that caches intrinsic widths that
+// needs to track this because it's the only thing that caches intrinsic
+// widths that lives inside of things (form controls) that do intrinsic
+// sizing with font inflation enabled.
+#define NS_BLOCK_FRAME_INTRINSICS_INFLATED  NS_FRAME_STATE_BIT(62)
+
 #define nsBlockFrameSuper nsContainerFrame
 
 /*
  * Base class for block and inline frames.
  * The block frame has an additional child list, kAbsoluteList, which
  * contains the absolutely positioned frames.
  */ 
 class nsBlockFrame : public nsBlockFrameSuper
@@ -94,17 +127,17 @@ public:
   const_line_iterator end_lines() const { return mLines.end(); }
   reverse_line_iterator rbegin_lines() { return mLines.rbegin(); }
   reverse_line_iterator rend_lines() { return mLines.rend(); }
   const_reverse_line_iterator rbegin_lines() const { return mLines.rbegin(); }
   const_reverse_line_iterator rend_lines() const { return mLines.rend(); }
   line_iterator line(nsLineBox* aList) { return mLines.begin(aList); }
   reverse_line_iterator rline(nsLineBox* aList) { return mLines.rbegin(aList); }
 
-  friend nsIFrame* NS_NewBlockFrame(nsIPresShell* aPresShell, nsStyleContext* aContext, nsFrameState aFlags);
+  friend nsIFrame* NS_NewBlockFrame(nsIPresShell* aPresShell, nsStyleContext* aContext, uint32_t aFlags);
 
   // nsQueryFrame
   NS_DECL_QUERYFRAME
 
   // nsIFrame
   virtual void Init(nsIContent*      aContent,
                     nsIFrame*        aParent,
                     nsIFrame*        aPrevInFlow) MOZ_OVERRIDE;

--- a/layout/generic/nsBulletFrame.cpp
+++ b/layout/generic/nsBulletFrame.cpp
@@ -30,22 +30,16 @@
 #endif
 
 using namespace mozilla;
 
 NS_DECLARE_FRAME_PROPERTY(FontSizeInflationProperty, nullptr)
 
 NS_IMPL_FRAMEARENA_HELPERS(nsBulletFrame)
 
-#ifdef DEBUG
-NS_QUERYFRAME_HEAD(nsBulletFrame)
-  NS_QUERYFRAME_ENTRY(nsBulletFrame)
-NS_QUERYFRAME_TAIL_INHERITING(nsFrame)
-#endif
-
 nsBulletFrame::~nsBulletFrame()
 {
 }
 
 void
 nsBulletFrame::DestroyFrom(nsIFrame* aDestructRoot)
 {
   // Stop image loading first

--- a/layout/generic/nsBulletFrame.h
+++ b/layout/generic/nsBulletFrame.h
@@ -11,16 +11,19 @@
 #include "mozilla/Attributes.h"
 #include "nsFrame.h"
 
 #include "imgINotificationObserver.h"
 
 class imgIContainer;
 class imgRequestProxy;
 
+#define BULLET_FRAME_IMAGE_LOADING NS_FRAME_STATE_BIT(63)
+#define BULLET_FRAME_HAS_FONT_INFLATION NS_FRAME_STATE_BIT(62)
+
 class nsBulletFrame;
 
 class nsBulletListener : public imgINotificationObserver
 {
 public:
   nsBulletListener();
   virtual ~nsBulletListener();
 
@@ -35,20 +38,16 @@ private:
 
 /**
  * A simple class that manages the layout and rendering of html bullets.
  * This class also supports the CSS list-style properties.
  */
 class nsBulletFrame : public nsFrame {
 public:
   NS_DECL_FRAMEARENA_HELPERS
-#ifdef DEBUG
-  NS_DECL_QUERYFRAME_TARGET(nsBulletFrame)
-  NS_DECL_QUERYFRAME
-#endif
 
   nsBulletFrame(nsStyleContext* aContext)
     : nsFrame(aContext)
   {
   }
   virtual ~nsBulletFrame();
 
   NS_IMETHOD Notify(imgIRequest *aRequest, int32_t aType, const nsIntRect* aData);

--- a/layout/generic/nsColumnSetFrame.cpp
+++ b/layout/generic/nsColumnSetFrame.cpp
@@ -16,17 +16,17 @@ using namespace mozilla::layout;
  * Tracking issues:
  *
  * XXX cursor movement around the top and bottom of colums seems to make the editor
  * lose the caret.
  *
  * XXX should we support CSS columns applied to table elements?
  */
 nsIFrame*
-NS_NewColumnSetFrame(nsIPresShell* aPresShell, nsStyleContext* aContext, nsFrameState aStateFlags)
+NS_NewColumnSetFrame(nsIPresShell* aPresShell, nsStyleContext* aContext, uint32_t aStateFlags)
 {
   nsColumnSetFrame* it = new (aPresShell) nsColumnSetFrame(aContext);
   it->AddStateBits(aStateFlags | NS_BLOCK_MARGIN_ROOT);
   return it;
 }
 
 NS_IMPL_FRAMEARENA_HELPERS(nsColumnSetFrame)
 

deleted file mode 100644
--- a/layout/generic/nsFrameState.cpp
+++ /dev/null
@@ -1,74 +0,0 @@
-/* -*- Mode: C++; tab-width: 2; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
-/* This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
-
-/* constants for frame state bits and a type to store them in a uint64_t */
-
-#include "nsFrameState.h"
-
-#include "nsBlockFrame.h"
-#include "nsBoxFrame.h"
-#include "nsBulletFrame.h"
-#include "nsGfxScrollFrame.h"
-#include "nsIFrame.h"
-#include "nsISVGChildFrame.h"
-#include "nsImageFrame.h"
-#include "nsInlineFrame.h"
-#include "nsPlaceholderFrame.h"
-#include "nsSVGContainerFrame.h"
-#include "nsTableCellFrame.h"
-#include "nsTableRowFrame.h"
-#include "nsTableRowGroupFrame.h"
-#include "nsTextFrame.h"
-
-namespace mozilla {
-
-#ifdef DEBUG
-nsCString
-GetFrameState(nsIFrame* aFrame)
-{
-  nsCString result;
-  nsAutoTArray<const char*,3> groups;
-
-  nsFrameState state = aFrame->GetStateBits();
-
-  if (state == nsFrameState(0)) {
-    result.AssignLiteral("0");
-    return result;
-  }
-
-#define FRAME_STATE_GROUP(name_, class_)                                      \
-  {                                                                           \
-    class_* frame = do_QueryFrame(aFrame);                                    \
-    if (frame && (groups.IsEmpty() || strcmp(groups.LastElement(), #name_))) {\
-      groups.AppendElement(#name_);                                           \
-    }                                                                         \
-  }
-#define FRAME_STATE_BIT(group_, value_, name_)                                \
-  if ((state & NS_FRAME_STATE_BIT(value_)) && groups.Contains(#group_)) {     \
-    if (!result.IsEmpty()) {                                                  \
-      result.Insert(" | ", 0);                                                \
-    }                                                                         \
-    result.Insert(#name_, 0);                                                 \
-    state = state & ~NS_FRAME_STATE_BIT(value_);                              \
-  }
-#include "nsFrameStateBits.h"
-#undef FRAME_STATE_GROUP
-#undef FRAME_STATE_BIT
-
-  if (state) {
-    result.AppendPrintf(" | 0x%0llx", state);
-  }
-
-  return result;
-}
-
-void
-PrintFrameState(nsIFrame* aFrame)
-{
-  printf("%s\n", GetFrameState(aFrame).get());
-}
-#endif
-
-} // namespace mozilla

deleted file mode 100644
--- a/layout/generic/nsFrameState.h
+++ /dev/null
@@ -1,73 +0,0 @@
-/* -*- Mode: C++; tab-width: 2; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
-/* This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
-
-/* constants for frame state bits and a type to store them in a uint64_t */
-
-#ifndef nsFrameState_h_
-#define nsFrameState_h_
-
-class nsIFrame;
-
-typedef uint64_t nsFrameState_size_t;
-
-#define NS_FRAME_STATE_BIT(n_) (nsFrameState(nsFrameState_size_t(1) << (n_)))
-
-enum nsFrameState : nsFrameState_size_t {
-#define FRAME_STATE_BIT(group_, value_, name_) \
-  name_ = NS_FRAME_STATE_BIT(value_),
-#include "nsFrameStateBits.h"
-#undef FRAME_STATE_BIT
-};
-
-inline nsFrameState operator|(nsFrameState aLeft, nsFrameState aRight)
-{
-  return nsFrameState(nsFrameState_size_t(aLeft) | nsFrameState_size_t(aRight));
-}
-
-inline nsFrameState operator&(nsFrameState aLeft, nsFrameState aRight)
-{
-  return nsFrameState(nsFrameState_size_t(aLeft) & nsFrameState_size_t(aRight));
-}
-
-inline nsFrameState& operator|=(nsFrameState& aLeft, nsFrameState aRight)
-{
-  aLeft = aLeft | aRight;
-  return aLeft;
-}
-
-inline nsFrameState& operator&=(nsFrameState& aLeft, nsFrameState aRight)
-{
-  aLeft = aLeft & aRight;
-  return aLeft;
-}
-
-inline nsFrameState operator~(nsFrameState aRight)
-{
-  return nsFrameState(~nsFrameState_size_t(aRight));
-}
-
-inline nsFrameState operator^(nsFrameState aLeft, nsFrameState aRight)
-{
-  return nsFrameState(nsFrameState_size_t(aLeft) ^ nsFrameState_size_t(aRight));
-}
-
-inline nsFrameState& operator^=(nsFrameState& aLeft, nsFrameState aRight)
-{
-  aLeft = aLeft ^ aRight;
-  return aLeft;
-}
-
-// Bits 20-31 and 60-63 of the frame state are reserved for implementations.
-#define NS_FRAME_IMPL_RESERVED                      nsFrameState(0xF0000000FFF00000)
-#define NS_FRAME_RESERVED                           ~NS_FRAME_IMPL_RESERVED
-
-namespace mozilla {
-#ifdef DEBUG
-nsCString GetFrameState(nsIFrame* aFrame);
-void PrintFrameState(nsIFrame* aFrame);
-#endif
-}
-
-#endif /* nsFrameState_h_ */ 

deleted file mode 100644
--- a/layout/generic/nsFrameStateBits.h
+++ /dev/null
@@ -1,581 +0,0 @@
-/* -*- Mode: C++; tab-width: 2; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
-/* This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
-
-/* a list of all frame state bits, for preprocessing */
-
-/******
-
-  This file contains definitions for frame state bits -- values used
-  in nsIFrame::mState -- and groups of frame state bits and which
-  classes they apply to.
-
-  There are two macros that can be defined before #including this
-  file:
-
-  FRAME_STATE_GROUP(name_, class_)
-
-    This denotes the existence of a named group of frame state bits.
-    name_ is the name of the group and class_ is the name of a frame
-    class that uses the frame state bits that are a part of the group.
-
-    The main group of frame state bits is named "Generic" and is
-    defined to apply to nsIFrame, i.e. all frames.  All of the global
-    frame state bits -- bits 0..19 and 32..59 -- are in this group.
-
-  FRAME_STATE_BIT(group_, value_, name_)
-
-    This denotes the existence of a frame state bit.  group_ indicates
-    which group the bit belongs to, value_ is the bit number (0..63),
-    and name_ is the name of the frame state bit constant.
-
-  Note that if you add a new frame state group, you'll need to #include
-  the header for its frame classes in nsFrameState.cpp and, if they don't
-  already, add nsQueryFrame implementations (which can be DEBUG-only) to
-  the frame classes.
-
- ******/
-
-#ifndef FRAME_STATE_GROUP
-#define FRAME_STATE_GROUP(name_, class_) /* nothing */
-#define DEFINED_FRAME_STATE_GROUP
-#endif
-
-#ifndef FRAME_STATE_BIT
-#define FRAME_STATE_BIT(group_, value_, name_) /* nothing */
-#define DEFINED_FRAME_STATE_BIT
-#endif
-
-// == Frame state bits that apply to all frames ===============================
-
-FRAME_STATE_GROUP(Generic, nsIFrame)
-
-FRAME_STATE_BIT(Generic, 0, NS_FRAME_IN_REFLOW)
-
-// This bit is set when a frame is created. After it has been reflowed
-// once (during the DidReflow with a finished state) the bit is
-// cleared.
-FRAME_STATE_BIT(Generic, 1, NS_FRAME_FIRST_REFLOW)
-
-// For a continuation frame, if this bit is set, then this a "fluid" 
-// continuation, i.e., across a line boundary. Otherwise it's a "hard"
-// continuation, e.g. a bidi continuation.
-FRAME_STATE_BIT(Generic, 2, NS_FRAME_IS_FLUID_CONTINUATION)
-
-// For nsIAnonymousContentCreator content that's created using ContentInfo.
-FRAME_STATE_BIT(Generic, 3, NS_FRAME_ANONYMOUSCONTENTCREATOR_CONTENT)
-
-// If this bit is set, then a reference to the frame is being held
-// elsewhere.  The frame may want to send a notification when it is
-// destroyed to allow these references to be cleared.
-FRAME_STATE_BIT(Generic, 4, NS_FRAME_EXTERNAL_REFERENCE)
-
-// If this bit is set, this frame or one of its descendants has a
-// percentage height that depends on an ancestor of this frame.
-// (Or it did at one point in the past, since we don't necessarily clear
-// the bit when it's no longer needed; it's an optimization.)
-FRAME_STATE_BIT(Generic, 5, NS_FRAME_CONTAINS_RELATIVE_HEIGHT)
-
-// If this bit is set, then the frame corresponds to generated content
-FRAME_STATE_BIT(Generic, 6, NS_FRAME_GENERATED_CONTENT)
-
-// If this bit is set the frame is a continuation that is holding overflow,
-// i.e. it is a next-in-flow created to hold overflow after the box's
-// height has ended. This means the frame should be a) at the top of the
-// page and b) invisible: no borders, zero height, ignored in margin
-// collapsing, etc. See nsContainerFrame.h
-FRAME_STATE_BIT(Generic, 7, NS_FRAME_IS_OVERFLOW_CONTAINER)
-
-// If this bit is set, then the frame has been moved out of the flow,
-// e.g., it is absolutely positioned or floated
-FRAME_STATE_BIT(Generic, 8, NS_FRAME_OUT_OF_FLOW)
-
-// Frame can be an abs/fixed pos. container, if its style says so.
-// MarkAs[Not]AbsoluteContainingBlock will assert that this bit is set.
-// NS_FRAME_HAS_ABSPOS_CHILDREN must not be set when this bit is unset.
-FRAME_STATE_BIT(Generic, 9, NS_FRAME_CAN_HAVE_ABSPOS_CHILDREN)
-
-// If this bit is set, then the frame and _all_ of its descendant frames need
-// to be reflowed.
-// This bit is set when the frame is first created.
-// This bit is cleared by DidReflow after the required call to Reflow has
-// finished.
-// Do not set this bit yourself if you plan to pass the frame to
-// nsIPresShell::FrameNeedsReflow.  Pass the right arguments instead.
-FRAME_STATE_BIT(Generic, 10, NS_FRAME_IS_DIRTY)
-
-// If this bit is set then the frame is too deep in the frame tree, and
-// we'll stop updating it and its children, to prevent stack overflow
-// and the like.
-FRAME_STATE_BIT(Generic, 11, NS_FRAME_TOO_DEEP_IN_FRAME_TREE)
-
-// If this bit is set, then either:
-//  1. the frame has at least one child that has the NS_FRAME_IS_DIRTY bit or
-//     NS_FRAME_HAS_DIRTY_CHILDREN bit set, or
-//  2. the frame has had at least one child removed since the last reflow, or
-//  3. the frame has had a style change that requires the frame to be reflowed
-//     but does not _necessarily_ require its descendants to be reflowed (e.g.,
-//     for a 'height', 'width', 'margin', etc. change, it's up to the
-//     applicable Reflow methods to decide whether the frame's children
-//     _actually_ need to be reflowed).
-// If this bit is set but the NS_FRAME_IS_DIRTY is not set, then Reflow still
-// needs to be called on the frame, but Reflow will likely not do as much work
-// as it would if NS_FRAME_IS_DIRTY were set. See the comment documenting
-// nsFrame::Reflow for more.
-// This bit is cleared by DidReflow after the required call to Reflow has
-// finished.
-// Do not set this bit yourself if you plan to pass the frame to
-// nsIPresShell::FrameNeedsReflow.  Pass the right arguments instead.
-FRAME_STATE_BIT(Generic, 12, NS_FRAME_HAS_DIRTY_CHILDREN)
-
-// If this bit is set, the frame has an associated view
-FRAME_STATE_BIT(Generic, 13, NS_FRAME_HAS_VIEW)
-
-// If this bit is set, the frame was created from anonymous content.
-FRAME_STATE_BIT(Generic, 14, NS_FRAME_INDEPENDENT_SELECTION)
-
-// If this bit is set, the frame is "special" (lame term, I know),
-// which means that it is part of the mangled frame hierarchy that
-// results when an inline has been split because of a nested block.
-// See the comments in nsCSSFrameConstructor::ConstructInline for
-// more details.
-FRAME_STATE_BIT(Generic, 15, NS_FRAME_IS_SPECIAL)
-
-// If this bit is set, then transforms (e.g. CSS or SVG transforms) are allowed
-// to affect the frame, and a transform may currently be in affect. If this bit
-// is not set, then any transforms on the frame will be ignored.
-// This is used primarily in GetTransformMatrix to optimize for the
-// common case.
-FRAME_STATE_BIT(Generic, 16, NS_FRAME_MAY_BE_TRANSFORMED)
-
-#ifdef IBMBIDI
-// If this bit is set, the frame itself is a bidi continuation,
-// or is incomplete (its next sibling is a bidi continuation)
-FRAME_STATE_BIT(Generic, 17, NS_FRAME_IS_BIDI)
-#endif
-
-// If this bit is set the frame has descendant with a view
-FRAME_STATE_BIT(Generic, 18, NS_FRAME_HAS_CHILD_WITH_VIEW)
-
-// If this bit is set, then reflow may be dispatched from the current
-// frame instead of the root frame.
-FRAME_STATE_BIT(Generic, 19, NS_FRAME_REFLOW_ROOT)
-
-// NOTE: Bits 20-31 and 60-63 of the frame state are reserved for specific
-// frame classes.
-
-// This bit is set on floats whose parent does not contain their
-// placeholder.  This can happen for two reasons:  (1) the float was
-// split, and this piece is the continuation, or (2) the entire float
-// didn't fit on the page.
-// Note that this bit is also shared by text frames for
-// TEXT_IS_IN_TOKEN_MATHML.  That's OK because we only check the
-// NS_FRAME_IS_PUSHED_FLOAT bit on frames which we already know are
-// out-of-flow.
-FRAME_STATE_BIT(Generic, 32, NS_FRAME_IS_PUSHED_FLOAT)
-
-// This bit acts as a loop flag for recursive paint server drawing.
-FRAME_STATE_BIT(Generic, 33, NS_FRAME_DRAWING_AS_PAINTSERVER)
-
-// Frame is a display root and the retained layer tree needs to be updated
-// at the next paint via display list construction.
-// Only meaningful for display roots, so we don't really need a global state
-// bit; we could free up this bit with a little extra complexity.
-FRAME_STATE_BIT(Generic, 36, NS_FRAME_UPDATE_LAYER_TREE)
-
-// Frame can accept absolutely positioned children.
-FRAME_STATE_BIT(Generic, 37, NS_FRAME_HAS_ABSPOS_CHILDREN)
-
-// A display item for this frame has been painted as part of a ThebesLayer.
-FRAME_STATE_BIT(Generic, 38, NS_FRAME_PAINTED_THEBES)
-
-// Frame is or is a descendant of something with a fixed height, unless that
-// ancestor is a body or html element, and has no closer ancestor that is
-// overflow:auto or overflow:scroll.
-FRAME_STATE_BIT(Generic, 39, NS_FRAME_IN_CONSTRAINED_HEIGHT)
-
-// This is only set during painting
-FRAME_STATE_BIT(Generic, 40, NS_FRAME_FORCE_DISPLAY_LIST_DESCEND_INTO)
-
-// Is this frame a container for font size inflation, i.e., is it a
-// frame whose width is used to determine the inflation factor for
-// everything whose nearest ancestor container for this frame?
-FRAME_STATE_BIT(Generic, 41, NS_FRAME_FONT_INFLATION_CONTAINER)
-
-// Does this frame manage a region in which we do font size inflation,
-// i.e., roughly, is it an element establishing a new block formatting
-// context?
-FRAME_STATE_BIT(Generic, 42, NS_FRAME_FONT_INFLATION_FLOW_ROOT)
-
-// This bit is set on SVG frames that are laid out using SVG's coordinate
-// system based layout (as opposed to any of the CSS layout models). Note that
-// this does not include nsSVGOuterSVGFrame since it takes part is CSS layout.
-FRAME_STATE_BIT(Generic, 43, NS_FRAME_SVG_LAYOUT)
-
-// Is this frame allowed to have generated (::before/::after) content?
-FRAME_STATE_BIT(Generic, 44, NS_FRAME_MAY_HAVE_GENERATED_CONTENT)
-
-// This bit is set on frames that create ContainerLayers with component
-// alpha children. With BasicLayers we avoid creating these, so we mark
-// the frames for future reference.
-FRAME_STATE_BIT(Generic, 45, NS_FRAME_NO_COMPONENT_ALPHA)
-
-// The frame is a descendant of SVGTextFrame and is thus used for SVG
-// text layout.
-FRAME_STATE_BIT(Generic, 47, NS_FRAME_IS_SVG_TEXT)
-
-// Frame is marked as needing painting
-FRAME_STATE_BIT(Generic, 48, NS_FRAME_NEEDS_PAINT)
-
-// Frame has a descendant frame that needs painting - This includes
-// cross-doc children.
-FRAME_STATE_BIT(Generic, 49, NS_FRAME_DESCENDANT_NEEDS_PAINT)
-
-// Frame is a descendant of a popup
-FRAME_STATE_BIT(Generic, 50, NS_FRAME_IN_POPUP)
-
-// Frame has only descendant frames that needs painting - This includes
-// cross-doc children. This guarantees that all descendents have 
-// NS_FRAME_NEEDS_PAINT and NS_FRAME_ALL_DESCENDANTS_NEED_PAINT, or they 
-// have no display items.
-FRAME_STATE_BIT(Generic, 51, NS_FRAME_ALL_DESCENDANTS_NEED_PAINT)
-
-// Frame is marked as NS_FRAME_NEEDS_PAINT and also has an explicit
-// rect stored to invalidate.
-FRAME_STATE_BIT(Generic, 52, NS_FRAME_HAS_INVALID_RECT)
-
-// Frame is not displayed directly due to it being, or being under, an SVG
-// <defs> element or an SVG resource element (<mask>, <pattern>, etc.)
-FRAME_STATE_BIT(Generic, 53, NS_FRAME_IS_NONDISPLAY)
-
-// Frame has a LayerActivityProperty property
-FRAME_STATE_BIT(Generic, 54, NS_FRAME_HAS_LAYER_ACTIVITY_PROPERTY)
-
-// Set for all descendants of MathML sub/supscript elements (other than the
-// base frame) to indicate that the SSTY font feature should be used.
-FRAME_STATE_BIT(Generic, 58, NS_FRAME_MATHML_SCRIPT_DESCENDANT)
-
-// This state bit is set on frames within token MathML elements if the
-// token represents an <mi> tag whose inner HTML consists of a single
-// non-whitespace character to allow special rendering behaviour.
-FRAME_STATE_BIT(Generic, 59, NS_FRAME_IS_IN_SINGLE_CHAR_MI)
-
-// NOTE: Bits 20-31 and 60-63 of the frame state are reserved for specific
-// frame classes.
-
-
-// == Frame state bits that apply to box frames ===============================
-
-FRAME_STATE_GROUP(Box, nsBoxFrame)
-
-FRAME_STATE_BIT(Box, 20, NS_STATE_BOX_CHILD_RESERVED)
-FRAME_STATE_BIT(Box, 21, NS_STATE_STACK_NOT_POSITIONED)
-FRAME_STATE_BIT(Box, 22, NS_STATE_IS_HORIZONTAL)
-FRAME_STATE_BIT(Box, 23, NS_STATE_AUTO_STRETCH)
-FRAME_STATE_BIT(Box, 24, NS_STATE_IS_ROOT)
-FRAME_STATE_BIT(Box, 25, NS_STATE_CURRENTLY_IN_DEBUG)
-FRAME_STATE_BIT(Box, 26, NS_STATE_SET_TO_DEBUG)
-FRAME_STATE_BIT(Box, 27, NS_STATE_DEBUG_WAS_SET)
-FRAME_STATE_BIT(Box, 28, NS_STATE_MENU_HAS_POPUP_LIST)
-FRAME_STATE_BIT(Box, 29, NS_STATE_BOX_WRAPS_KIDS_IN_BLOCK)
-FRAME_STATE_BIT(Box, 30, NS_STATE_EQUAL_SIZE)
-FRAME_STATE_BIT(Box, 31, NS_STATE_IS_DIRECTION_NORMAL)
-FRAME_STATE_BIT(Box, 60, NS_FRAME_MOUSE_THROUGH_ALWAYS)
-FRAME_STATE_BIT(Box, 61, NS_FRAME_MOUSE_THROUGH_NEVER)
-
-
-// == Frame state bits that apply to SVG frames ===============================
-
-FRAME_STATE_GROUP(SVG, nsISVGChildFrame)
-FRAME_STATE_GROUP(SVG, nsSVGContainerFrame)
-
-FRAME_STATE_BIT(SVG, 20, NS_STATE_IS_OUTER_SVG)
-
-// If this bit is set, we are a <clipPath> element or descendant.
-FRAME_STATE_BIT(SVG, 21, NS_STATE_SVG_CLIPPATH_CHILD)
-
-// For SVG text, the NS_FRAME_IS_DIRTY and NS_FRAME_HAS_DIRTY_CHILDREN bits
-// indicate that our anonymous block child needs to be reflowed, and that
-// mPositions will likely need to be updated as a consequence. These are set,
-// for example, when the font-family changes. Sometimes we only need to
-// update mPositions though. For example if the x/y attributes change.
-// mPositioningDirty is used to indicate this latter "things are dirty" case
-// to allow us to avoid reflowing the anonymous block when it is not
-// necessary.
-FRAME_STATE_BIT(SVG, 22, NS_STATE_SVG_POSITIONING_DIRTY)
-
-// For text, whether the values from x/y/dx/dy attributes have any percentage
-// values that are used in determining the positions of glyphs.  The value will
-// be true even if a positioning value is overridden by a descendant element's
-// attribute with a non-percentage length.  For example,
-// NS_STATE_SVG_POSITIONING_MAY_USE_PERCENTAGES would be set for:
-//
-//   <text x="10%"><tspan x="0">abc</tspan></text>
-//
-// Percentage values beyond the number of addressable characters, however, do
-// not influence NS_STATE_SVG_POSITIONING_MAY_USE_PERCENTAGES.  For example,
-// NS_STATE_SVG_POSITIONING_MAY_USE_PERCENTAGES would be false for:
-//
-//   <text x="10 20 30 40%">abc</text>
-//
-// NS_STATE_SVG_POSITIONING_MAY_USE_PERCENTAGES is used to determine whether
-// to recompute mPositions when the viewport size changes.  So although the 
-// first example above shows that NS_STATE_SVG_POSITIONING_MAY_USE_PERCENTAGES
-// can be true even if a viewport size change will not affect mPositions,
-// determining a completley accurate value for
-// NS_STATE_SVG_POSITIONING_MAY_USE_PERCENTAGES would require extra work that is
-// probably not worth it.
-FRAME_STATE_BIT(SVG, 23, NS_STATE_SVG_POSITIONING_MAY_USE_PERCENTAGES)
-
-FRAME_STATE_BIT(SVG, 24, NS_STATE_SVG_TEXT_IN_REFLOW)
-
-
-// == Frame state bits that apply to text frames ==============================
-
-FRAME_STATE_GROUP(Text, nsTextFrame)
-
-// -- Flags set during reflow -------------------------------------------------
-
-// nsTextFrame.cpp defines TEXT_REFLOW_FLAGS to be all of these bits.
-
-// This bit is set on the first frame in a continuation indicating
-// that it was chopped short because of :first-letter style.
-FRAME_STATE_BIT(Text, 20, TEXT_FIRST_LETTER)
-
-// This bit is set on frames that are logically adjacent to the start of the
-// line (i.e. no prior frame on line with actual displayed in-flow content).
-FRAME_STATE_BIT(Text, 21, TEXT_START_OF_LINE)
-
-// This bit is set on frames that are logically adjacent to the end of the
-// line (i.e. no following on line with actual displayed in-flow content).
-FRAME_STATE_BIT(Text, 22, TEXT_END_OF_LINE)
-
-// This bit is set on frames that end with a hyphenated break.
-FRAME_STATE_BIT(Text, 23, TEXT_HYPHEN_BREAK)
-
-// This bit is set on frames that trimmed trailing whitespace characters when
-// calculating their width during reflow.
-FRAME_STATE_BIT(Text, 24, TEXT_TRIMMED_TRAILING_WHITESPACE)
-
-// This bit is set on frames that have justification enabled. We record
-// this in a state bit because we don't always have the containing block
-// easily available to check text-align on.
-FRAME_STATE_BIT(Text, 25, TEXT_JUSTIFICATION_ENABLED)
-
-// Set this bit if the textframe has overflow area for IME/spellcheck underline.
-FRAME_STATE_BIT(Text, 26, TEXT_SELECTION_UNDERLINE_OVERFLOWED)
-
-// -- Cache bits for IsEmpty() ------------------------------------------------
-
-// nsTextFrame.cpp defines TEXT_WHITESPACE_FLAGS to be both of these bits.
-
-// Set this bit if the textframe is known to be only collapsible whitespace.
-FRAME_STATE_BIT(Text, 27, TEXT_IS_ONLY_WHITESPACE)
-
-// Set this bit if the textframe is known to be not only collapsible whitespace.
-FRAME_STATE_BIT(Text, 28, TEXT_ISNOT_ONLY_WHITESPACE)
-
-// -- Other state bits --------------------------------------------------------
-
-// Set when this text frame is mentioned in the userdata for mTextRun
-FRAME_STATE_BIT(Text, 29, TEXT_IN_TEXTRUN_USER_DATA)
-
-// This state bit is set on frames that have some non-collapsed characters after
-// reflow
-FRAME_STATE_BIT(Text, 31, TEXT_HAS_NONCOLLAPSED_CHARACTERS)
-
-// This state bit is set on children of token MathML elements.
-// NOTE: TEXT_IS_IN_TOKEN_MATHML has a global state bit value that is shared
-//       with NS_FRAME_IS_PUSHED_FLOAT.
-FRAME_STATE_BIT(Text, 32, TEXT_IS_IN_TOKEN_MATHML)
-
-// Set when this text frame is mentioned in the userdata for the
-// uninflated textrun property
-FRAME_STATE_BIT(Text, 60, TEXT_IN_UNINFLATED_TEXTRUN_USER_DATA)
-
-FRAME_STATE_BIT(Text, 61, TEXT_HAS_FONT_INFLATION)
-
-// If true, then this frame is being removed due to a SetLength() on a
-// previous continuation and the style context of that previous
-// continuation is the same as this frame's
-FRAME_STATE_BIT(Text, 62, TEXT_STYLE_MATCHES_PREV_CONTINUATION)
-
-// Whether this frame is cached in the Offset Frame Cache
-// (OffsetToFrameProperty)
-FRAME_STATE_BIT(Text, 63, TEXT_IN_OFFSET_CACHE)
-
-
-// == Frame state bits that apply to block frames =============================
-
-FRAME_STATE_GROUP(Block, nsBlockFrame)
-
-// See the meanings at http://www.mozilla.org/newlayout/doc/block-and-line.html
-
-// Something in the block has changed that requires Bidi resolution to be
-// performed on the block. This flag must be either set on all blocks in a 
-// continuation chain or none of them.
-FRAME_STATE_BIT(Block, 20, NS_BLOCK_NEEDS_BIDI_RESOLUTION)
-
-FRAME_STATE_BIT(Block, 21, NS_BLOCK_HAS_PUSHED_FLOATS)
-FRAME_STATE_BIT(Block, 22, NS_BLOCK_MARGIN_ROOT)
-FRAME_STATE_BIT(Block, 23, NS_BLOCK_FLOAT_MGR)
-FRAME_STATE_BIT(Block, 24, NS_BLOCK_HAS_LINE_CURSOR)
-FRAME_STATE_BIT(Block, 25, NS_BLOCK_HAS_OVERFLOW_LINES)
-FRAME_STATE_BIT(Block, 26, NS_BLOCK_HAS_OVERFLOW_OUT_OF_FLOWS)
-
-// Set on any block that has descendant frames in the normal
-// flow with 'clear' set to something other than 'none'
-// (including <BR CLEAR="..."> frames)
-FRAME_STATE_BIT(Block, 27, NS_BLOCK_HAS_CLEAR_CHILDREN)
-
-// NS_BLOCK_CLIP_PAGINATED_OVERFLOW is only set in paginated prescontexts, on
-// blocks which were forced to not have scrollframes but still need to clip
-// the display of their kids.
-FRAME_STATE_BIT(Block, 28, NS_BLOCK_CLIP_PAGINATED_OVERFLOW)
-
-// NS_BLOCK_HAS_FIRST_LETTER_STYLE means that the block has first-letter style,
-// even if it has no actual first-letter frame among its descendants.
-FRAME_STATE_BIT(Block, 29, NS_BLOCK_HAS_FIRST_LETTER_STYLE)
-
-// NS_BLOCK_FRAME_HAS_OUTSIDE_BULLET and NS_BLOCK_FRAME_HAS_INSIDE_BULLET
-// means the block has an associated bullet frame, they are mutually exclusive.
-FRAME_STATE_BIT(Block, 30, NS_BLOCK_FRAME_HAS_OUTSIDE_BULLET)
-FRAME_STATE_BIT(Block, 31, NS_BLOCK_FRAME_HAS_INSIDE_BULLET)
-
-// This block has had a child marked dirty, so before we reflow we need
-// to look through the lines to find any such children and mark
-// appropriate lines dirty.
-FRAME_STATE_BIT(Block, 61, NS_BLOCK_LOOK_FOR_DIRTY_FRAMES)
-
-// Are our cached intrinsic widths intrinsic widths for font size
-// inflation?  i.e., what was the current state of
-// GetPresContext()->mInflationDisabledForShrinkWrap at the time they
-// were computed?
-// nsBlockFrame is the only thing that caches intrinsic widths that
-// needs to track this because it's the only thing that caches intrinsic
-// widths that lives inside of things (form controls) that do intrinsic
-// sizing with font inflation enabled.
-FRAME_STATE_BIT(Block, 62, NS_BLOCK_FRAME_INTRINSICS_INFLATED)
-
-// NS_BLOCK_HAS_FIRST_LETTER_CHILD means that there is an inflow first-letter
-// frame among the block's descendants. If there is a floating first-letter
-// frame, or the block has first-letter style but has no first letter, this
-// bit is not set. This bit is set on the first continuation only.
-FRAME_STATE_BIT(Block, 63, NS_BLOCK_HAS_FIRST_LETTER_CHILD)
-
-
-// == Frame state bits that apply to bullet frames ============================
-
-FRAME_STATE_GROUP(Bullet, nsBulletFrame)
-
-FRAME_STATE_BIT(Block, 62, BULLET_FRAME_HAS_FONT_INFLATION)
-FRAME_STATE_BIT(Block, 63, BULLET_FRAME_IMAGE_LOADING)
-
-
-// == Frame state bits that apply to scroll frames ============================
-
-FRAME_STATE_GROUP(Scroll, nsIScrollableFrame)
-
-// When set, the next scroll operation on the scrollframe will invalidate its
-// entire contents. Useful for text-overflow.
-// This bit is cleared after each time the scrollframe is scrolled. Whoever
-// needs to set it should set it again on each paint.
-FRAME_STATE_BIT(Scroll, 20, NS_SCROLLFRAME_INVALIDATE_CONTENTS_ON_SCROLL)
-
-
-// == Frame state bits that apply to image frames =============================
-
-FRAME_STATE_GROUP(Image, nsImageFrame)
-
-FRAME_STATE_BIT(Image, 20, IMAGE_SIZECONSTRAINED)
-FRAME_STATE_BIT(Image, 21, IMAGE_GOTINITIALREFLOW)
-
-
-// == Frame state bits that apply to inline frames ============================
-
-FRAME_STATE_GROUP(Inline, nsInlineFrame)
-
-/**  In Bidi left (or right) margin/padding/border should be applied to left
- *  (or right) most frame (or a continuation frame).
- *  This state value shows if this frame is left (or right) most continuation
- *  or not.
- */
-
-FRAME_STATE_BIT(Inline, 21, NS_INLINE_FRAME_BIDI_VISUAL_STATE_IS_SET)
-FRAME_STATE_BIT(Inline, 22, NS_INLINE_FRAME_BIDI_VISUAL_IS_LEFT_MOST)
-FRAME_STATE_BIT(Inline, 23, NS_INLINE_FRAME_BIDI_VISUAL_IS_RIGHT_MOST)
-
-
-// == Frame state bits that apply to placeholder frames =======================
-
-FRAME_STATE_GROUP(Placeholder, nsPlaceholderFrame)
-
-// Frame state bits that are used to keep track of what this is a
-// placeholder for.
-
-FRAME_STATE_BIT(Placeholder, 20, PLACEHOLDER_FOR_FLOAT)
-FRAME_STATE_BIT(Placeholder, 21, PLACEHOLDER_FOR_ABSPOS)
-FRAME_STATE_BIT(Placeholder, 22, PLACEHOLDER_FOR_FIXEDPOS)
-FRAME_STATE_BIT(Placeholder, 23, PLACEHOLDER_FOR_POPUP)
-
-
-// == Frame state bits that apply to table cell frames ========================
-
-FRAME_STATE_GROUP(TableCell, nsTableCellFrame)
-
-FRAME_STATE_BIT(TableCell, 28, NS_TABLE_CELL_HAS_PCT_OVER_HEIGHT)
-FRAME_STATE_BIT(TableCell, 29, NS_TABLE_CELL_HAD_SPECIAL_REFLOW)
-FRAME_STATE_BIT(TableCell, 31, NS_TABLE_CELL_CONTENT_EMPTY)
-
-
-// == Frame state bits that apply to table column frames ======================
-
-// Bits 28-31 on nsTableColFrames are used to store the column type.
-
-
-// == Frame state bits that apply to table column group frames ================
-
-// Bits 30-31 on nsTableColGroupFrames are used to store the column type.
-
-
-// == Frame state bits that apply to table rows and table row group frames ====
-
-FRAME_STATE_GROUP(TableRowAndRowGroup, nsTableRowFrame)
-FRAME_STATE_GROUP(TableRowAndRowGroup, nsTableRowGroupFrame)
-
-// see nsTableRowGroupFrame::InitRepeatedFrame
-FRAME_STATE_BIT(TableRowAndRowGroup, 28, NS_REPEATED_ROW_OR_ROWGROUP)
-
-
-// == Frame state bits that apply to table row frames =========================
-
-FRAME_STATE_GROUP(TableRow, nsTableRowFrame)
-
-// Indicates whether this row has any cells that have
-// non-auto-height and rowspan=1
-FRAME_STATE_BIT(TableRow, 29, NS_ROW_HAS_CELL_WITH_STYLE_HEIGHT)
-
-FRAME_STATE_BIT(TableRow, 30, NS_TABLE_ROW_HAS_UNPAGINATED_HEIGHT)
-
-
-// == Frame state bits that apply to table row group frames ===================
-
-FRAME_STATE_GROUP(TableRowGroup, nsTableRowGroupFrame)
-
-FRAME_STATE_BIT(TableRowGroup, 27, NS_ROWGROUP_HAS_ROW_CURSOR)
-FRAME_STATE_BIT(TableRowGroup, 30, NS_ROWGROUP_HAS_STYLE_HEIGHT)
-
-// thead or tfoot should be repeated on every printed page
-FRAME_STATE_BIT(TableRowGroup, 31, NS_ROWGROUP_REPEATABLE)
-
-
-#ifdef DEFINED_FRAME_STATE_GROUP
-#undef DEFINED_FRAME_STATE_GROUP
-#undef FRAME_STATE_GROUP
-#endif
-
-#ifdef DEFINED_FRAME_STATE_BIT
-#undef DEFINED_FRAME_STATE_BIT
-#undef FRAME_STATE_BIT
-#endif

--- a/layout/generic/nsGfxScrollFrame.h
+++ b/layout/generic/nsGfxScrollFrame.h
@@ -30,16 +30,22 @@ class nsIScrollPositionListener;
 struct ScrollReflowState;
 
 namespace mozilla {
 namespace layout {
 class ScrollbarActivity;
 }
 }
 
+// When set, the next scroll operation on the scrollframe will invalidate its
+// entire contents. Useful for text-overflow.
+// This bit is cleared after each time the scrollframe is scrolled. Whoever
+// needs to set it should set it again on each paint.
+#define NS_SCROLLFRAME_INVALIDATE_CONTENTS_ON_SCROLL NS_FRAME_STATE_BIT(20)
+
 namespace mozilla {
 
 class ScrollFrameHelper : public nsIReflowCallback {
 public:
   typedef mozilla::CSSIntPoint CSSIntPoint;
   typedef mozilla::layout::ScrollbarActivity ScrollbarActivity;
 
   class AsyncScroll;

--- a/layout/generic/nsHTMLParts.h
+++ b/layout/generic/nsHTMLParts.h
@@ -21,16 +21,43 @@ class nsIHTMLContentSink;
 class nsIFragmentContentSink;
 class nsStyleContext;
 class nsIURI;
 class nsString;
 class nsIPresShell;
 class nsIChannel;
 class nsTableColFrame;
 
+/**
+ * Additional frame-state bits used by nsBlockFrame
+ * See the meanings at http://www.mozilla.org/newlayout/doc/block-and-line.html
+ *
+ * NS_BLOCK_CLIP_PAGINATED_OVERFLOW is only set in paginated prescontexts, on
+ *  blocks which were forced to not have scrollframes but still need to clip
+ *  the display of their kids.
+ *
+ * NS_BLOCK_HAS_FIRST_LETTER_STYLE means that the block has first-letter style,
+ *  even if it has no actual first-letter frame among its descendants.
+ *
+ * NS_BLOCK_HAS_FIRST_LETTER_CHILD means that there is an inflow first-letter
+ *  frame among the block's descendants. If there is a floating first-letter
+ *  frame, or the block has first-letter style but has no first letter, this
+ *  bit is not set. This bit is set on the first continuation only.
+ *
+ * NS_BLOCK_FRAME_HAS_OUTSIDE_BULLET and NS_BLOCK_FRAME_HAS_INSIDE_BULLET
+ * means the block has an associated bullet frame, they are mutually exclusive.
+ *
+ */
+#define NS_BLOCK_MARGIN_ROOT              NS_FRAME_STATE_BIT(22)
+#define NS_BLOCK_FLOAT_MGR                NS_FRAME_STATE_BIT(23)
+#define NS_BLOCK_CLIP_PAGINATED_OVERFLOW  NS_FRAME_STATE_BIT(28)
+#define NS_BLOCK_HAS_FIRST_LETTER_STYLE   NS_FRAME_STATE_BIT(29)
+#define NS_BLOCK_FRAME_HAS_OUTSIDE_BULLET NS_FRAME_STATE_BIT(30)
+#define NS_BLOCK_HAS_FIRST_LETTER_CHILD   NS_FRAME_STATE_BIT(31)
+#define NS_BLOCK_FRAME_HAS_INSIDE_BULLET  NS_FRAME_STATE_BIT(63)
 // These are all the block specific frame bits, they are copied from
 // the prev-in-flow to a newly created next-in-flow, except for the
 // NS_BLOCK_FLAGS_NON_INHERITED_MASK bits below.
 #define NS_BLOCK_FLAGS_MASK (NS_BLOCK_MARGIN_ROOT              | \
                              NS_BLOCK_FLOAT_MGR                | \
                              NS_BLOCK_CLIP_PAGINATED_OVERFLOW  | \
                              NS_BLOCK_HAS_FIRST_LETTER_STYLE   | \
                              NS_BLOCK_FRAME_HAS_OUTSIDE_BULLET | \
@@ -44,31 +71,31 @@ class nsTableColFrame;
                             (NS_BLOCK_FRAME_HAS_OUTSIDE_BULLET | \
                              NS_BLOCK_HAS_FIRST_LETTER_CHILD   | \
                              NS_BLOCK_FRAME_HAS_INSIDE_BULLET)
 
 // Factory methods for creating html layout objects
 
 // Create a frame that supports "display: block" layout behavior
 nsIFrame*
-NS_NewBlockFrame(nsIPresShell* aPresShell, nsStyleContext* aContext, nsFrameState aFlags = nsFrameState(0));
+NS_NewBlockFrame(nsIPresShell* aPresShell, nsStyleContext* aContext, uint32_t aFlags = 0);
 
 // Special Generated Content Node. It contains text taken from an
 // attribute of its *grandparent* content node. 
 nsresult
 NS_NewAttributeContent(nsNodeInfoManager *aNodeInfoManager,
                        int32_t aNameSpaceID, nsIAtom* aAttrName,
                        nsIContent** aResult);
 
 // Create a basic area frame but the GetFrameForPoint is overridden to always
 // return the option frame 
 // By default, area frames will extend
 // their height to cover any children that "stick out".
 nsIFrame*
-NS_NewSelectsAreaFrame(nsIPresShell* aPresShell, nsStyleContext* aContext, nsFrameState aFlags);
+NS_NewSelectsAreaFrame(nsIPresShell* aPresShell, nsStyleContext* aContext, uint32_t aFlags);
 
 // Create a block formatting context blockframe
 inline nsIFrame* NS_NewBlockFormattingContext(nsIPresShell* aPresShell,
                                               nsStyleContext* aStyleContext)
 {
   return NS_NewBlockFrame(aPresShell, aStyleContext,
                           NS_BLOCK_FLOAT_MGR | NS_BLOCK_MARGIN_ROOT);
 }
@@ -103,17 +130,17 @@ NS_NewContinuingTextFrame(nsIPresShell* 
 nsIFrame*
 NS_NewEmptyFrame(nsIPresShell* aPresShell, nsStyleContext* aContext);
 inline nsIFrame*
 NS_NewWBRFrame(nsIPresShell* aPresShell, nsStyleContext* aContext) {
   return NS_NewEmptyFrame(aPresShell, aContext);
 }
 
 nsIFrame*
-NS_NewColumnSetFrame(nsIPresShell* aPresShell, nsStyleContext* aContext, nsFrameState aStateFlags);
+NS_NewColumnSetFrame(nsIPresShell* aPresShell, nsStyleContext* aContext, uint32_t aStateFlags);
 
 nsIFrame*
 NS_NewSimplePageSequenceFrame(nsIPresShell* aPresShell, nsStyleContext* aContext);
 nsIFrame*
 NS_NewPageFrame(nsIPresShell* aPresShell, nsStyleContext* aContext);
 nsIFrame*
 NS_NewPageContentFrame(nsIPresShell* aPresShell, nsStyleContext* aContext);
 nsIFrame*
@@ -154,17 +181,17 @@ nsIFrame*
 NS_NewGfxRadioControlFrame(nsIPresShell* aPresShell, nsStyleContext* aContext);
 nsIFrame*
 NS_NewNativeRadioControlFrame(nsIPresShell* aPresShell, nsStyleContext* aContext);
 nsIFrame*
 NS_NewNativeSelectControlFrame(nsIPresShell* aPresShell, nsStyleContext* aContext);
 nsIFrame*
 NS_NewListControlFrame(nsIPresShell* aPresShell, nsStyleContext* aContext);
 nsIFrame*
-NS_NewComboboxControlFrame(nsIPresShell* aPresShell, nsStyleContext* aContext, nsFrameState aFlags);
+NS_NewComboboxControlFrame(nsIPresShell* aPresShell, nsStyleContext* aContext, uint32_t aFlags);
 nsIFrame*
 NS_NewProgressFrame(nsIPresShell* aPresShell, nsStyleContext* aContext);
 nsIFrame*
 NS_NewMeterFrame(nsIPresShell* aPresShell, nsStyleContext* aContext);
 nsIFrame*
 NS_NewRangeFrame(nsIPresShell* aPresShell, nsStyleContext* aContext);
 nsIFrame*
 NS_NewNumberControlFrame(nsIPresShell* aPresShell, nsStyleContext* aContext);

--- a/layout/generic/nsIFrame.h
+++ b/layout/generic/nsIFrame.h
@@ -30,17 +30,16 @@
 #include "FramePropertyTable.h"
 #include "mozilla/TypedEnum.h"
 #include "nsDirection.h"
 #include "WritingModes.h"
 #include <algorithm>
 #include "nsITheme.h"
 #include "gfx3DMatrix.h"
 #include "nsLayoutUtils.h"
-#include "nsFrameState.h"
 
 #ifdef ACCESSIBILITY
 #include "mozilla/a11y/AccTypes.h"
 #endif
 
 /**
  * New rules of reflow:
  * 1. you get a WillReflow() followed by a Reflow() followed by a DidReflow() in order
@@ -124,16 +123,240 @@ typedef uint32_t nsSplittableType;
 
 #define NS_FRAME_IS_NOT_SPLITTABLE(type)\
   (0 == ((type) & NS_FRAME_SPLITTABLE))
 
 #define NS_INTRINSIC_WIDTH_UNKNOWN nscoord_MIN
 
 //----------------------------------------------------------------------
 
+/**
+ * Frame state bits. Any bits not listed here are reserved for future
+ * extensions, but must be stored by the frames.
+ */
+typedef uint64_t nsFrameState;
+
+#define NS_FRAME_STATE_BIT(n_) (nsFrameState(1) << (n_))
+
+#define NS_FRAME_IN_REFLOW                          NS_FRAME_STATE_BIT(0)
+
+// This bit is set when a frame is created. After it has been reflowed
+// once (during the DidReflow with a finished state) the bit is
+// cleared.
+#define NS_FRAME_FIRST_REFLOW                       NS_FRAME_STATE_BIT(1)
+
+// For a continuation frame, if this bit is set, then this a "fluid" 
+// continuation, i.e., across a line boundary. Otherwise it's a "hard"
+// continuation, e.g. a bidi continuation.
+#define NS_FRAME_IS_FLUID_CONTINUATION              NS_FRAME_STATE_BIT(2)
+
+// For nsIAnonymousContentCreator content that's created using ContentInfo.
+#define NS_FRAME_ANONYMOUSCONTENTCREATOR_CONTENT    NS_FRAME_STATE_BIT(3)
+
+// If this bit is set, then a reference to the frame is being held
+// elsewhere.  The frame may want to send a notification when it is
+// destroyed to allow these references to be cleared.
+#define NS_FRAME_EXTERNAL_REFERENCE                 NS_FRAME_STATE_BIT(4)
+
+// If this bit is set, this frame or one of its descendants has a
+// percentage height that depends on an ancestor of this frame.
+// (Or it did at one point in the past, since we don't necessarily clear
+// the bit when it's no longer needed; it's an optimization.)
+#define  NS_FRAME_CONTAINS_RELATIVE_HEIGHT          NS_FRAME_STATE_BIT(5)
+
+// If this bit is set, then the frame corresponds to generated content
+#define NS_FRAME_GENERATED_CONTENT                  NS_FRAME_STATE_BIT(6)
+
+// If this bit is set the frame is a continuation that is holding overflow,
+// i.e. it is a next-in-flow created to hold overflow after the box's
+// height has ended. This means the frame should be a) at the top of the
+// page and b) invisible: no borders, zero height, ignored in margin
+// collapsing, etc. See nsContainerFrame.h
+#define NS_FRAME_IS_OVERFLOW_CONTAINER              NS_FRAME_STATE_BIT(7)
+
+// If this bit is set, then the frame has been moved out of the flow,
+// e.g., it is absolutely positioned or floated
+#define NS_FRAME_OUT_OF_FLOW                        NS_FRAME_STATE_BIT(8)
+
+// Frame can be an abs/fixed pos. container, if its style says so.
+// MarkAs[Not]AbsoluteContainingBlock will assert that this bit is set.
+// NS_FRAME_HAS_ABSPOS_CHILDREN must not be set when this bit is unset.
+#define NS_FRAME_CAN_HAVE_ABSPOS_CHILDREN           NS_FRAME_STATE_BIT(9)
+
+// If this bit is set, then the frame and _all_ of its descendant frames need
+// to be reflowed.
+// This bit is set when the frame is first created.
+// This bit is cleared by DidReflow after the required call to Reflow has
+// finished.
+// Do not set this bit yourself if you plan to pass the frame to
+// nsIPresShell::FrameNeedsReflow.  Pass the right arguments instead.
+#define NS_FRAME_IS_DIRTY                           NS_FRAME_STATE_BIT(10)
+
+// If this bit is set then the frame is too deep in the frame tree, and
+// we'll stop updating it and its children, to prevent stack overflow
+// and the like.
+#define NS_FRAME_TOO_DEEP_IN_FRAME_TREE             NS_FRAME_STATE_BIT(11)
+
+// If this bit is set, then either:
+//  1. the frame has at least one child that has the NS_FRAME_IS_DIRTY bit or
+//     NS_FRAME_HAS_DIRTY_CHILDREN bit set, or
+//  2. the frame has had at least one child removed since the last reflow, or
+//  3. the frame has had a style change that requires the frame to be reflowed
+//     but does not _necessarily_ require its descendants to be reflowed (e.g.,
+//     for a 'height', 'width', 'margin', etc. change, it's up to the
+//     applicable Reflow methods to decide whether the frame's children
+//     _actually_ need to be reflowed).
+// If this bit is set but the NS_FRAME_IS_DIRTY is not set, then Reflow still
+// needs to be called on the frame, but Reflow will likely not do as much work
+// as it would if NS_FRAME_IS_DIRTY were set. See the comment documenting
+// nsFrame::Reflow for more.
+// This bit is cleared by DidReflow after the required call to Reflow has
+// finished.
+// Do not set this bit yourself if you plan to pass the frame to
+// nsIPresShell::FrameNeedsReflow.  Pass the right arguments instead.
+#define NS_FRAME_HAS_DIRTY_CHILDREN                 NS_FRAME_STATE_BIT(12)
+
+// If this bit is set, the frame has an associated view
+#define NS_FRAME_HAS_VIEW                           NS_FRAME_STATE_BIT(13)
+
+// If this bit is set, the frame was created from anonymous content.
+#define NS_FRAME_INDEPENDENT_SELECTION              NS_FRAME_STATE_BIT(14)
+
+// If this bit is set, the frame is "special" (lame term, I know),
+// which means that it is part of the mangled frame hierarchy that
+// results when an inline has been split because of a nested block.
+// See the comments in nsCSSFrameConstructor::ConstructInline for
+// more details.
+#define NS_FRAME_IS_SPECIAL                         NS_FRAME_STATE_BIT(15)
+
+// If this bit is set, then transforms (e.g. CSS or SVG transforms) are allowed
+// to affect the frame, and a transform may currently be in affect. If this bit
+// is not set, then any transforms on the frame will be ignored.
+// This is used primarily in GetTransformMatrix to optimize for the
+// common case.
+#define  NS_FRAME_MAY_BE_TRANSFORMED                NS_FRAME_STATE_BIT(16)
+
+#ifdef IBMBIDI
+// If this bit is set, the frame itself is a bidi continuation,
+// or is incomplete (its next sibling is a bidi continuation)
+#define NS_FRAME_IS_BIDI                            NS_FRAME_STATE_BIT(17)
+#endif
+
+// If this bit is set the frame has descendant with a view
+#define NS_FRAME_HAS_CHILD_WITH_VIEW                NS_FRAME_STATE_BIT(18)
+
+// If this bit is set, then reflow may be dispatched from the current
+// frame instead of the root frame.
+#define NS_FRAME_REFLOW_ROOT                        NS_FRAME_STATE_BIT(19)
+
+// Bits 20-31 and 60-63 of the frame state are reserved for implementations.
+#define NS_FRAME_IMPL_RESERVED                      nsFrameState(0xF0000000FFF00000)
+#define NS_FRAME_RESERVED                           ~NS_FRAME_IMPL_RESERVED
+
+// This bit is set on floats whose parent does not contain their
+// placeholder.  This can happen for two reasons:  (1) the float was
+// split, and this piece is the continuation, or (2) the entire float
+// didn't fit on the page.
+// Note that this bit is also shared by text frames for
+// TEXT_IS_IN_TOKEN_MATHML.  That's OK because we only check the
+// NS_FRAME_IS_PUSHED_FLOAT bit on frames which we already know are
+// out-of-flow.
+#define NS_FRAME_IS_PUSHED_FLOAT                    NS_FRAME_STATE_BIT(32)
+
+// This bit acts as a loop flag for recursive paint server drawing.
+#define NS_FRAME_DRAWING_AS_PAINTSERVER             NS_FRAME_STATE_BIT(33)
+
+// Frame is a display root and the retained layer tree needs to be updated
+// at the next paint via display list construction.
+// Only meaningful for display roots, so we don't really need a global state
+// bit; we could free up this bit with a little extra complexity.
+#define NS_FRAME_UPDATE_LAYER_TREE                  NS_FRAME_STATE_BIT(36)
+
+// Frame can accept absolutely positioned children.
+#define NS_FRAME_HAS_ABSPOS_CHILDREN                NS_FRAME_STATE_BIT(37)
+
+// A display item for this frame has been painted as part of a ThebesLayer.
+#define NS_FRAME_PAINTED_THEBES                     NS_FRAME_STATE_BIT(38)
+
+// Frame is or is a descendant of something with a fixed height, unless that
+// ancestor is a body or html element, and has no closer ancestor that is
+// overflow:auto or overflow:scroll.
+#define NS_FRAME_IN_CONSTRAINED_HEIGHT              NS_FRAME_STATE_BIT(39)
+
+// This is only set during painting
+#define NS_FRAME_FORCE_DISPLAY_LIST_DESCEND_INTO    NS_FRAME_STATE_BIT(40)
+
+// Is this frame a container for font size inflation, i.e., is it a
+// frame whose width is used to determine the inflation factor for
+// everything whose nearest ancestor container for this frame?
+#define NS_FRAME_FONT_INFLATION_CONTAINER           NS_FRAME_STATE_BIT(41)
+
+// Does this frame manage a region in which we do font size inflation,
+// i.e., roughly, is it an element establishing a new block formatting
+// context?
+#define NS_FRAME_FONT_INFLATION_FLOW_ROOT           NS_FRAME_STATE_BIT(42)
+
+// This bit is set on SVG frames that are laid out using SVG's coordinate
+// system based layout (as opposed to any of the CSS layout models). Note that
+// this does not include nsSVGOuterSVGFrame since it takes part is CSS layout.
+#define NS_FRAME_SVG_LAYOUT                         NS_FRAME_STATE_BIT(43)
+
+// Is this frame allowed to have generated (::before/::after) content?
+#define NS_FRAME_MAY_HAVE_GENERATED_CONTENT         NS_FRAME_STATE_BIT(44)
+
+// This bit is set on frames that create ContainerLayers with component
+// alpha children. With BasicLayers we avoid creating these, so we mark
+// the frames for future reference.
+#define NS_FRAME_NO_COMPONENT_ALPHA                 NS_FRAME_STATE_BIT(45)
+
+// The frame is a descendant of SVGTextFrame and is thus used for SVG
+// text layout.
+#define NS_FRAME_IS_SVG_TEXT                        NS_FRAME_STATE_BIT(47)
+
+// Frame is marked as needing painting
+#define NS_FRAME_NEEDS_PAINT                        NS_FRAME_STATE_BIT(48)
+
+// Frame has a descendant frame that needs painting - This includes
+// cross-doc children.
+#define NS_FRAME_DESCENDANT_NEEDS_PAINT             NS_FRAME_STATE_BIT(49)
+
+// Frame is a descendant of a popup
+#define NS_FRAME_IN_POPUP                           NS_FRAME_STATE_BIT(50)
+
+// Frame has only descendant frames that needs painting - This includes
+// cross-doc children. This guarantees that all descendents have 
+// NS_FRAME_NEEDS_PAINT and NS_FRAME_ALL_DESCENDANTS_NEED_PAINT, or they 
+// have no display items.
+#define NS_FRAME_ALL_DESCENDANTS_NEED_PAINT         NS_FRAME_STATE_BIT(51)
+
+// Frame is marked as NS_FRAME_NEEDS_PAINT and also has an explicit
+// rect stored to invalidate.
+#define NS_FRAME_HAS_INVALID_RECT                   NS_FRAME_STATE_BIT(52)
+
+// Frame is not displayed directly due to it being, or being under, an SVG
+// <defs> element or an SVG resource element (<mask>, <pattern>, etc.)
+#define NS_FRAME_IS_NONDISPLAY                      NS_FRAME_STATE_BIT(53)
+
+// Frame has a LayerActivityProperty property
+#define NS_FRAME_HAS_LAYER_ACTIVITY_PROPERTY        NS_FRAME_STATE_BIT(54)
+
+// Set for all descendants of MathML sub/supscript elements (other than the
+// base frame) to indicate that the SSTY font feature should be used.
+#define NS_FRAME_MATHML_SCRIPT_DESCENDANT           NS_FRAME_STATE_BIT(58)
+
+// This state bit is set on token MathML elements if the token represents an
+// <mi> tag whose inner HTML consists of a single non-whitespace character
+// to allow special rendering behaviour.
+#define NS_FRAME_IS_IN_SINGLE_CHAR_MI               NS_FRAME_STATE_BIT(59)
+
+// Box layout bits
+#define NS_STATE_IS_HORIZONTAL                      NS_FRAME_STATE_BIT(22)
+#define NS_STATE_IS_DIRECTION_NORMAL                NS_FRAME_STATE_BIT(31)
+
+// Helper macros
 #define NS_SUBTREE_DIRTY(_frame)  \
   (((_frame)->GetStateBits() &      \
     (NS_FRAME_IS_DIRTY | NS_FRAME_HAS_DIRTY_CHILDREN)) != 0)
 
 /**
  * Constant used to indicate an unconstrained size.
  *
  * @see #Reflow()

--- a/layout/generic/nsImageFrame.h
+++ b/layout/generic/nsImageFrame.h
@@ -49,16 +49,19 @@ public:
   NS_DECL_IMGINOTIFICATIONOBSERVER
 
   void SetFrame(nsImageFrame *frame) { mFrame = frame; }
 
 private:
   nsImageFrame *mFrame;
 };
 
+#define IMAGE_SIZECONSTRAINED       NS_FRAME_STATE_BIT(20)
+#define IMAGE_GOTINITIALREFLOW      NS_FRAME_STATE_BIT(21)
+
 #define ImageFrameSuper nsSplittableFrame
 
 class nsImageFrame : public ImageFrameSuper,
                      public nsIReflowCallback {
 public:
   typedef mozilla::layers::ImageContainer ImageContainer;
   typedef mozilla::layers::ImageLayer ImageLayer;
   typedef mozilla::layers::LayerManager LayerManager;

--- a/layout/generic/nsInlineFrame.h
+++ b/layout/generic/nsInlineFrame.h
@@ -8,16 +8,27 @@
 #ifndef nsInlineFrame_h___
 #define nsInlineFrame_h___
 
 #include "mozilla/Attributes.h"
 #include "nsContainerFrame.h"
 
 class nsLineLayout;
 
+/**  In Bidi left (or right) margin/padding/border should be applied to left
+ *  (or right) most frame (or a continuation frame).
+ *  This state value shows if this frame is left (or right) most continuation
+ *  or not.
+ */
+#define NS_INLINE_FRAME_BIDI_VISUAL_STATE_IS_SET     NS_FRAME_STATE_BIT(21)
+
+#define NS_INLINE_FRAME_BIDI_VISUAL_IS_LEFT_MOST     NS_FRAME_STATE_BIT(22)
+
+#define NS_INLINE_FRAME_BIDI_VISUAL_IS_RIGHT_MOST    NS_FRAME_STATE_BIT(23)
+
 typedef nsContainerFrame nsInlineFrameBase;
 
 /**
  * Inline frame class.
  *
  * This class manages a list of child frames that are inline frames. Working with
  * nsLineLayout, the class will reflow and place inline frames on a line.
  */

--- a/layout/generic/nsPlaceholderFrame.cpp
+++ b/layout/generic/nsPlaceholderFrame.cpp
@@ -21,22 +21,16 @@ nsIFrame*
 NS_NewPlaceholderFrame(nsIPresShell* aPresShell, nsStyleContext* aContext,
                        nsFrameState aTypeBit)
 {
   return new (aPresShell) nsPlaceholderFrame(aContext, aTypeBit);
 }
 
 NS_IMPL_FRAMEARENA_HELPERS(nsPlaceholderFrame)
 
-#ifdef DEBUG
-NS_QUERYFRAME_HEAD(nsPlaceholderFrame)
-  NS_QUERYFRAME_ENTRY(nsPlaceholderFrame)
-NS_QUERYFRAME_TAIL_INHERITING(nsFrame)
-#endif
-
 /* virtual */ nsSize
 nsPlaceholderFrame::GetMinSize(nsBoxLayoutState& aBoxLayoutState)
 {
   nsSize size(0, 0);
   DISPLAY_MIN_SIZE(this, size);
   return size;
 }
 

--- a/layout/generic/nsPlaceholderFrame.h
+++ b/layout/generic/nsPlaceholderFrame.h
@@ -37,32 +37,34 @@
 #include "mozilla/Attributes.h"
 #include "nsFrame.h"
 #include "nsGkAtoms.h"
 
 nsIFrame* NS_NewPlaceholderFrame(nsIPresShell* aPresShell,
                                  nsStyleContext* aContext,
                                  nsFrameState aTypeBit);
 
+// Frame state bits that are used to keep track of what this is a
+// placeholder for.
+#define PLACEHOLDER_FOR_FLOAT    NS_FRAME_STATE_BIT(20)
+#define PLACEHOLDER_FOR_ABSPOS   NS_FRAME_STATE_BIT(21)
+#define PLACEHOLDER_FOR_FIXEDPOS NS_FRAME_STATE_BIT(22)
+#define PLACEHOLDER_FOR_POPUP    NS_FRAME_STATE_BIT(23)
 #define PLACEHOLDER_TYPE_MASK    (PLACEHOLDER_FOR_FLOAT | \
                                   PLACEHOLDER_FOR_ABSPOS | \
                                   PLACEHOLDER_FOR_FIXEDPOS | \
                                   PLACEHOLDER_FOR_POPUP)
 
 /**
  * Implementation of a frame that's used as a placeholder for a frame that
  * has been moved out of the flow.
  */
 class nsPlaceholderFrame MOZ_FINAL : public nsFrame {
 public:
   NS_DECL_FRAMEARENA_HELPERS
-#ifdef DEBUG
-  NS_DECL_QUERYFRAME_TARGET(nsPlaceholderFrame)
-  NS_DECL_QUERYFRAME
-#endif
 
   /**
    * Create a new placeholder frame.  aTypeBit must be one of the
    * PLACEHOLDER_FOR_* constants above.
    */
   friend nsIFrame* NS_NewPlaceholderFrame(nsIPresShell* aPresShell,
                                           nsStyleContext* aContext,
                                           nsFrameState aTypeBit);

--- a/layout/generic/nsTextFrame.cpp
+++ b/layout/generic/nsTextFrame.cpp
@@ -198,24 +198,77 @@ static void DestroyGlyphObserverList(voi
 /**
  * This property is set on text frames with TEXT_IN_TEXTRUN_USER_DATA set that
  * have potentially-animated glyphs.
  * The only reason this list is in a property is to automatically destroy the
  * list when the frame is deleted, unregistering the observers.
  */
 NS_DECLARE_FRAME_PROPERTY(TextFrameGlyphObservers, DestroyGlyphObserverList);
 
+// The following flags are set during reflow
+
+// This bit is set on the first frame in a continuation indicating
+// that it was chopped short because of :first-letter style.
+#define TEXT_FIRST_LETTER    NS_FRAME_STATE_BIT(20)
+// This bit is set on frames that are logically adjacent to the start of the
+// line (i.e. no prior frame on line with actual displayed in-flow content).
+#define TEXT_START_OF_LINE   NS_FRAME_STATE_BIT(21)
+// This bit is set on frames that are logically adjacent to the end of the
+// line (i.e. no following on line with actual displayed in-flow content).
+#define TEXT_END_OF_LINE     NS_FRAME_STATE_BIT(22)
+// This bit is set on frames that end with a hyphenated break.
+#define TEXT_HYPHEN_BREAK    NS_FRAME_STATE_BIT(23)
+// This bit is set on frames that trimmed trailing whitespace characters when
+// calculating their width during reflow.
+#define TEXT_TRIMMED_TRAILING_WHITESPACE NS_FRAME_STATE_BIT(24)
+// This bit is set on frames that have justification enabled. We record
+// this in a state bit because we don't always have the containing block
+// easily available to check text-align on.
+#define TEXT_JUSTIFICATION_ENABLED       NS_FRAME_STATE_BIT(25)
+// Set this bit if the textframe has overflow area for IME/spellcheck underline.
+#define TEXT_SELECTION_UNDERLINE_OVERFLOWED NS_FRAME_STATE_BIT(26)
+
 #define TEXT_REFLOW_FLAGS    \
   (TEXT_FIRST_LETTER|TEXT_START_OF_LINE|TEXT_END_OF_LINE|TEXT_HYPHEN_BREAK| \
    TEXT_TRIMMED_TRAILING_WHITESPACE|TEXT_JUSTIFICATION_ENABLED| \
    TEXT_HAS_NONCOLLAPSED_CHARACTERS|TEXT_SELECTION_UNDERLINE_OVERFLOWED)
 
+// Cache bits for IsEmpty().
+// Set this bit if the textframe is known to be only collapsible whitespace.
+#define TEXT_IS_ONLY_WHITESPACE    NS_FRAME_STATE_BIT(27)
+// Set this bit if the textframe is known to be not only collapsible whitespace.
+#define TEXT_ISNOT_ONLY_WHITESPACE NS_FRAME_STATE_BIT(28)
+
 #define TEXT_WHITESPACE_FLAGS      (TEXT_IS_ONLY_WHITESPACE | \
                                     TEXT_ISNOT_ONLY_WHITESPACE)
 
+// Set when this text frame is mentioned in the userdata for mTextRun
+#define TEXT_IN_TEXTRUN_USER_DATA  NS_FRAME_STATE_BIT(29)
+
+// nsTextFrame.h has
+// #define TEXT_HAS_NONCOLLAPSED_CHARACTERS NS_FRAME_STATE_BIT(31)
+
+// nsTextFrame.h has
+// #define TEXT_IS_IN_TOKEN_MATHML          NS_FRAME_STATE_BIT(32)
+
+// Set when this text frame is mentioned in the userdata for the
+// uninflated textrun property
+#define TEXT_IN_UNINFLATED_TEXTRUN_USER_DATA NS_FRAME_STATE_BIT(60)
+
+// nsTextFrame.h has
+// #define TEXT_HAS_FONT_INFLATION          NS_FRAME_STATE_BIT(61)
+
+// If true, then this frame is being removed due to a SetLength() on a
+// previous continuation and the style context of that previous
+// continuation is the same as this frame's
+#define TEXT_STYLE_MATCHES_PREV_CONTINUATION NS_FRAME_STATE_BIT(62)
+
+// Whether this frame is cached in the Offset Frame Cache (OffsetToFrameProperty)
+#define TEXT_IN_OFFSET_CACHE       NS_FRAME_STATE_BIT(63)
+
 /*
  * Some general notes
  * 
  * Text frames delegate work to gfxTextRun objects. The gfxTextRun object
  * transforms text to positioned glyphs. It can report the geometry of the
  * glyphs and paint them. Text frames configure gfxTextRuns by providing text,
  * spacing, language, and other information.
  * 

--- a/layout/generic/nsTextFrame.h
+++ b/layout/generic/nsTextFrame.h
@@ -12,16 +12,25 @@
 #include "nsLineBox.h"
 #include "gfxFont.h"
 #include "gfxSkipChars.h"
 #include "nsDisplayList.h"
 
 class nsTextPaintStyle;
 class PropertyProvider;
 
+// This state bit is set on frames that have some non-collapsed characters after
+// reflow
+#define TEXT_HAS_NONCOLLAPSED_CHARACTERS NS_FRAME_STATE_BIT(31)
+
+// This state bit is set on children of token MathML elements
+#define TEXT_IS_IN_TOKEN_MATHML          NS_FRAME_STATE_BIT(32)
+
+#define TEXT_HAS_FONT_INFLATION          NS_FRAME_STATE_BIT(61)
+
 typedef nsFrame nsTextFrameBase;
 
 class nsDisplayTextGeometry;
 class nsDisplayText;
 
 class nsTextFrameTextRunCache {
 public:
   static void Init();

--- a/layout/mathml/nsMathMLContainerFrame.cpp
+++ b/layout/mathml/nsMathMLContainerFrame.cpp
@@ -1527,17 +1527,17 @@ nsMathMLContainerFrame::TransmitAutomati
     mPresentationData.flags &= ~NS_MATHML_SPACE_LIKE;
   }
 
   return NS_OK;
 }
 
 /*static*/ void
 nsMathMLContainerFrame::PropagateFrameFlagFor(nsIFrame* aFrame,
-                                              nsFrameState  aFlags)
+                                              uint64_t  aFlags)
 {
   if (!aFrame || !aFlags)
     return;
 
   aFrame->AddStateBits(aFlags);
   nsIFrame* childFrame = aFrame->GetFirstPrincipalChild();
   while (childFrame) {
     PropagateFrameFlagFor(childFrame, aFlags);
@@ -1579,17 +1579,17 @@ nsMathMLContainerFrame::ReportInvalidChi
     { aChildTag->GetUTF16String(), mContent->Tag()->GetUTF16String() };
   return ReportErrorToConsole("InvalidChild", argv, 2);
 }
 
 //==========================
 
 nsIFrame*
 NS_NewMathMLmathBlockFrame(nsIPresShell* aPresShell, nsStyleContext* aContext,
-                           nsFrameState aFlags)
+                           uint32_t aFlags)
 {
   nsMathMLmathBlockFrame* it = new (aPresShell) nsMathMLmathBlockFrame(aContext);
   it->SetFlags(aFlags);
   return it;
 }
 
 NS_IMPL_FRAMEARENA_HELPERS(nsMathMLmathBlockFrame)
 

--- a/layout/mathml/nsMathMLContainerFrame.h
+++ b/layout/mathml/nsMathMLContainerFrame.h
@@ -337,17 +337,17 @@ public:
                                        int32_t         aFirstChildIndex,
                                        int32_t         aLastChildIndex,
                                        uint32_t        aFlagsValues,
                                        uint32_t        aFlagsToUpdate);
 
   // Sets flags on aFrame and all descendant frames
   static void
   PropagateFrameFlagFor(nsIFrame* aFrame,
-                        nsFrameState aFlags);
+                        uint64_t  aFlags);
 
   // helper to let the rebuild of automatic data (presentation data
   // and embellishement data) walk through a subtree that may contain
   // non-MathML container frames. Note that this method re-builds the
   // automatic data in the children -- not in aParentFrame itself (except
   // for those particular operations that the parent frame may do in its
   // TransmitAutomaticData()). The reason it works this way is because
   // a container frame knows what it wants for its children, whereas children
@@ -406,17 +406,17 @@ private:
 // 2) proper inter-frame spacing
 // 3) firing of Stretch() (in which case FinalizeReflow() would have to be cleaned)
 // Issues: If/when mathml becomes a pluggable component, the separation will be needed.
 class nsMathMLmathBlockFrame : public nsBlockFrame {
 public:
   NS_DECL_FRAMEARENA_HELPERS
 
   friend nsIFrame* NS_NewMathMLmathBlockFrame(nsIPresShell* aPresShell,
-          nsStyleContext* aContext, nsFrameState aFlags);
+          nsStyleContext* aContext, uint32_t aFlags);
 
   // beware, mFrames is not set by nsBlockFrame
   // cannot use mFrames{.FirstChild()|.etc} since the block code doesn't set mFrames
   NS_IMETHOD
   SetInitialChildList(ChildListID     aListID,
                       nsFrameList&    aChildList) MOZ_OVERRIDE
   {
     NS_ASSERTION(aListID == kPrincipalList, "unexpected frame list");

--- a/layout/mathml/nsMathMLParts.h
+++ b/layout/mathml/nsMathMLParts.h
@@ -30,15 +30,15 @@ nsIFrame* NS_NewMathMLmtrFrame(nsIPresSh
 nsIFrame* NS_NewMathMLmtdFrame(nsIPresShell* aPresShell, nsStyleContext* aContext);
 nsIFrame* NS_NewMathMLmtdInnerFrame(nsIPresShell* aPresShell, nsStyleContext* aContext);
 nsIFrame* NS_NewMathMLmsqrtFrame(nsIPresShell* aPresShell, nsStyleContext* aContext);
 nsIFrame* NS_NewMathMLmrootFrame(nsIPresShell* aPresShell, nsStyleContext* aContext);
 nsIFrame* NS_NewMathMLmactionFrame(nsIPresShell* aPresShell, nsStyleContext* aContext);
 nsIFrame* NS_NewMathMLmencloseFrame(nsIPresShell* aPresShell, nsStyleContext* aContext);
 nsIFrame* NS_NewMathMLsemanticsFrame(nsIPresShell* aPresShell, nsStyleContext* aContext);
 
-nsIFrame* NS_NewMathMLmathBlockFrame(nsIPresShell* aPresShell, nsStyleContext* aContext, nsFrameState aFlags);
+nsIFrame* NS_NewMathMLmathBlockFrame(nsIPresShell* aPresShell, nsStyleContext* aContext, uint32_t aFlags);
 nsIFrame* NS_NewMathMLmathInlineFrame(nsIPresShell* aPresShell, nsStyleContext* aContext);
 inline nsIFrame* NS_CreateNewMathMLmathBlockFrame(nsIPresShell* aPresShell, nsStyleContext* aContext)
 {
-  return NS_NewMathMLmathBlockFrame(aPresShell, aContext, nsFrameState(0));
+  return NS_NewMathMLmathBlockFrame(aPresShell, aContext, 0);
 }
 #endif /* nsMathMLParts_h___ */

--- a/layout/svg/nsSVGUtils.h
+++ b/layout/svg/nsSVGUtils.h
@@ -60,16 +60,61 @@ class SVGPreserveAspectRatio;
 namespace dom {
 class Element;
 } // namespace dom
 namespace gfx {
 class SourceSurface;
 }
 } // namespace mozilla
 
+// SVG Frame state bits
+#define NS_STATE_IS_OUTER_SVG                    NS_FRAME_STATE_BIT(20)
+
+// If this bit is set, we are a <clipPath> element or descendant.
+#define NS_STATE_SVG_CLIPPATH_CHILD              NS_FRAME_STATE_BIT(21)
+
+/**
+ * For text, the NS_FRAME_IS_DIRTY and NS_FRAME_HAS_DIRTY_CHILDREN bits indicate
+ * that our anonymous block child needs to be reflowed, and that mPositions
+ * will likely need to be updated as a consequence. These are set, for
+ * example, when the font-family changes. Sometimes we only need to
+ * update mPositions though. For example if the x/y attributes change.
+ * mPositioningDirty is used to indicate this latter "things are dirty" case
+ * to allow us to avoid reflowing the anonymous block when it is not
+ * necessary.
+ */
+#define NS_STATE_SVG_POSITIONING_DIRTY           NS_FRAME_STATE_BIT(22)
+
+/**
+ * For text, whether the values from x/y/dx/dy attributes have any percentage values
+ * that are used in determining the positions of glyphs.  The value will
+ * be true even if a positioning value is overridden by a descendant element's
+ * attribute with a non-percentage length.  For example,
+ * NS_STATE_SVG_POSITIONING_MAY_USE_PERCENTAGES would be set for:
+ *
+ *   <text x="10%"><tspan x="0">abc</tspan></text>
+ *
+ * Percentage values beyond the number of addressable characters, however, do
+ * not influence NS_STATE_SVG_POSITIONING_MAY_USE_PERCENTAGES.  For example,
+ * NS_STATE_SVG_POSITIONING_MAY_USE_PERCENTAGES would be false for:
+ *
+ *   <text x="10 20 30 40%">abc</text>
+ *
+ * NS_STATE_SVG_POSITIONING_MAY_USE_PERCENTAGES is used to determine whether
+ * to recompute mPositions when the viewport size changes.  So although the 
+ * first example above shows that NS_STATE_SVG_POSITIONING_MAY_USE_PERCENTAGES
+ * can be true even if a viewport size change will not affect mPositions,
+ * determining a completley accurate value for
+ * NS_STATE_SVG_POSITIONING_MAY_USE_PERCENTAGES would require extra work that is
+ * probably not worth it.
+ */
+#define NS_STATE_SVG_POSITIONING_MAY_USE_PERCENTAGES NS_FRAME_STATE_BIT(23)
+
+#define NS_STATE_SVG_TEXT_IN_REFLOW              NS_FRAME_STATE_BIT(24)
+
 // maximum dimension of an offscreen surface - choose so that
 // the surface size doesn't overflow a 32-bit signed int using
 // 4 bytes per pixel; in line with gfxASurface::CheckSurfaceSize
 // In fact Macs can't even manage that
 #define NS_SVG_OFFSCREEN_MAX_DIMENSION 4096
 
 #define SVG_HIT_TEST_FILL        0x01
 #define SVG_HIT_TEST_STROKE      0x02

--- a/layout/tables/nsTableCellFrame.h
+++ b/layout/tables/nsTableCellFrame.h
@@ -14,16 +14,23 @@
 #include "nsIPercentHeightObserver.h"
 #include "nsGkAtoms.h"
 #include "nsLayoutUtils.h"
 #include "nsTArray.h"
 
 class nsTableFrame;
 
 /**
+ * Additional frame-state bits
+ */
+#define NS_TABLE_CELL_CONTENT_EMPTY       NS_FRAME_STATE_BIT(31)
+#define NS_TABLE_CELL_HAD_SPECIAL_REFLOW  NS_FRAME_STATE_BIT(29)
+#define NS_TABLE_CELL_HAS_PCT_OVER_HEIGHT NS_FRAME_STATE_BIT(28)
+
+/**
  * nsTableCellFrame
  * data structure to maintain information about a single table cell's frame
  *
  * NOTE:  frames are not ref counted.  We expose addref and release here
  * so we can change that decsion in the future.  Users of nsITableCellLayout
  * should refcount correctly as if this object is being ref counted, though
  * no actual support is under the hood.
  *

--- a/layout/tables/nsTableColFrame.cpp
+++ b/layout/tables/nsTableColFrame.cpp
@@ -42,17 +42,17 @@ void
 nsTableColFrame::SetColType(nsTableColType aType) 
 {
   NS_ASSERTION(aType != eColAnonymousCol ||
                (GetPrevContinuation() &&
                 GetPrevContinuation()->GetNextContinuation() == this &&
                 GetPrevContinuation()->GetNextSibling() == this),
                "spanned content cols must be continuations");
   uint32_t type = aType - eColContent;
-  mState |= nsFrameState(type << COL_TYPE_OFFSET);
+  mState |= (type << COL_TYPE_OFFSET);
 }
 
 /* virtual */ void
 nsTableColFrame::DidSetStyleContext(nsStyleContext* aOldStyleContext)
 {
   nsSplittableFrame::DidSetStyleContext(aOldStyleContext);
 
   if (!aOldStyleContext) //avoid this on init

--- a/layout/tables/nsTableColGroupFrame.cpp
+++ b/layout/tables/nsTableColGroupFrame.cpp
@@ -22,17 +22,17 @@ nsTableColGroupType
 nsTableColGroupFrame::GetColType() const 
 {
   return (nsTableColGroupType)((mState & COL_GROUP_TYPE_BITS) >> COL_GROUP_TYPE_OFFSET);
 }
 
 void nsTableColGroupFrame::SetColType(nsTableColGroupType aType) 
 {
   uint32_t type = aType - eColGroupContent;
-  mState |= nsFrameState(type << COL_GROUP_TYPE_OFFSET);
+  mState |= (type << COL_GROUP_TYPE_OFFSET);
 }
 
 void nsTableColGroupFrame::ResetColIndices(nsIFrame*       aFirstColGroup,
                                            int32_t         aFirstColIndex,
                                            nsIFrame*       aStartColFrame)
 {
   nsTableColGroupFrame* colGroupFrame = (nsTableColGroupFrame*)aFirstColGroup;
   int32_t colIndex = aFirstColIndex;

--- a/layout/tables/nsTableRowFrame.h
+++ b/layout/tables/nsTableRowFrame.h
@@ -9,16 +9,25 @@
 #include "nscore.h"
 #include "nsContainerFrame.h"
 #include "nsTablePainter.h"
 
 class  nsTableFrame;
 class  nsTableCellFrame;
 struct nsTableCellReflowState;
 
+// This is also used on rows, from nsTableRowGroupFrame.h
+// #define NS_REPEATED_ROW_OR_ROWGROUP      NS_FRAME_STATE_BIT(28)
+
+// Indicates whether this row has any cells that have
+// non-auto-height and rowspan=1
+#define NS_ROW_HAS_CELL_WITH_STYLE_HEIGHT   NS_FRAME_STATE_BIT(29)
+
+#define NS_TABLE_ROW_HAS_UNPAGINATED_HEIGHT NS_FRAME_STATE_BIT(30)
+
 /**
  * nsTableRowFrame is the frame that maps table rows 
  * (HTML tag TR). This class cannot be reused
  * outside of an nsTableRowGroupFrame.  It assumes that its parent is an nsTableRowGroupFrame,  
  * and its children are nsTableCellFrames.
  * 
  * @see nsTableFrame
  * @see nsTableRowGroupFrame

--- a/layout/tables/nsTableRowGroupFrame.h
+++ b/layout/tables/nsTableRowGroupFrame.h
@@ -35,16 +35,25 @@ struct nsRowGroupReflowState {
     availSize.width  = reflowState.AvailableWidth();
     availSize.height = reflowState.AvailableHeight();
     y = 0;  
   }
 
   ~nsRowGroupReflowState() {}
 };
 
+// use the following bits from nsFrame's frame state 
+
+// thead or tfoot should be repeated on every printed page
+#define NS_ROWGROUP_REPEATABLE           NS_FRAME_STATE_BIT(31)
+#define NS_ROWGROUP_HAS_STYLE_HEIGHT     NS_FRAME_STATE_BIT(30)
+// the next is also used on rows (see nsTableRowGroupFrame::InitRepeatedFrame)
+#define NS_REPEATED_ROW_OR_ROWGROUP      NS_FRAME_STATE_BIT(28)
+#define NS_ROWGROUP_HAS_ROW_CURSOR       NS_FRAME_STATE_BIT(27)
+
 #define MIN_ROWS_NEEDING_CURSOR 20
 
 /**
  * nsTableRowGroupFrame is the frame that maps row groups 
  * (HTML tags THEAD, TFOOT, and TBODY). This class cannot be reused
  * outside of an nsTableFrame.  It assumes that its parent is an nsTableFrame, and 
  * its children are nsTableRowFrames.
  * 

--- a/layout/xul/nsBox.h
+++ b/layout/xul/nsBox.h
@@ -6,16 +6,20 @@
 #ifndef nsBox_h___
 #define nsBox_h___
 
 #include "mozilla/Attributes.h"
 #include "nsIFrame.h"
 
 class nsITheme;
 
+#define NS_STATE_IS_ROOT        NS_FRAME_STATE_BIT(24)
+#define NS_STATE_SET_TO_DEBUG   NS_FRAME_STATE_BIT(26)
+#define NS_STATE_DEBUG_WAS_SET  NS_FRAME_STATE_BIT(27)
+
 class nsBox : public nsIFrame {
 
 public:
 
   friend class nsIFrame;
 
   static void Shutdown();
 

--- a/layout/xul/nsBoxFrame.cpp
+++ b/layout/xul/nsBoxFrame.cpp
@@ -99,22 +99,16 @@ NS_NewBoxFrame(nsIPresShell* aPresShell,
 nsIFrame*
 NS_NewBoxFrame(nsIPresShell* aPresShell, nsStyleContext* aContext)
 {
   return new (aPresShell) nsBoxFrame(aPresShell, aContext);
 }
 
 NS_IMPL_FRAMEARENA_HELPERS(nsBoxFrame)
 
-#ifdef DEBUG
-NS_QUERYFRAME_HEAD(nsBoxFrame)
-  NS_QUERYFRAME_ENTRY(nsBoxFrame)
-NS_QUERYFRAME_TAIL_INHERITING(nsContainerFrame)
-#endif
-
 nsBoxFrame::nsBoxFrame(nsIPresShell* aPresShell,
                        nsStyleContext* aContext,
                        bool aIsRoot,
                        nsBoxLayout* aLayoutManager) :
   nsContainerFrame(aContext)
 {
   mState |= NS_STATE_IS_HORIZONTAL;
   mState |= NS_STATE_AUTO_STRETCH;

--- a/layout/xul/nsBoxFrame.h
+++ b/layout/xul/nsBoxFrame.h
@@ -16,31 +16,43 @@
 
 #include "mozilla/Attributes.h"
 #include "nsCOMPtr.h"
 #include "nsContainerFrame.h"
 #include "nsBoxLayout.h"
 
 class nsBoxLayoutState;
 
+// flags from box
+#define NS_STATE_BOX_CHILD_RESERVED      NS_FRAME_STATE_BIT(20)
+#define NS_STATE_STACK_NOT_POSITIONED    NS_FRAME_STATE_BIT(21)
+//#define NS_STATE_IS_HORIZONTAL           NS_FRAME_STATE_BIT(22)  moved to nsIFrame.h
+#define NS_STATE_AUTO_STRETCH            NS_FRAME_STATE_BIT(23)
+//#define NS_STATE_IS_ROOT                 NS_FRAME_STATE_BIT(24)  moved to nsBox.h
+#define NS_STATE_CURRENTLY_IN_DEBUG      NS_FRAME_STATE_BIT(25)
+//#define NS_STATE_SET_TO_DEBUG            NS_FRAME_STATE_BIT(26)  moved to nsBox.h
+//#define NS_STATE_DEBUG_WAS_SET           NS_FRAME_STATE_BIT(27)  moved to nsBox.h
+#define NS_STATE_MENU_HAS_POPUP_LIST       NS_FRAME_STATE_BIT(28) /* used on nsMenuFrame */
+#define NS_STATE_BOX_WRAPS_KIDS_IN_BLOCK NS_FRAME_STATE_BIT(29)
+#define NS_STATE_EQUAL_SIZE              NS_FRAME_STATE_BIT(30)
+//#define NS_STATE_IS_DIRECTION_NORMAL     NS_FRAME_STATE_BIT(31)  moved to nsIFrame.h
+#define NS_FRAME_MOUSE_THROUGH_ALWAYS    NS_FRAME_STATE_BIT(60)
+#define NS_FRAME_MOUSE_THROUGH_NEVER     NS_FRAME_STATE_BIT(61)
+
 nsIFrame* NS_NewBoxFrame(nsIPresShell* aPresShell,
                          nsStyleContext* aContext,
                          bool aIsRoot,
                          nsBoxLayout* aLayoutManager);
 nsIFrame* NS_NewBoxFrame(nsIPresShell* aPresShell,
                          nsStyleContext* aContext);
 
 class nsBoxFrame : public nsContainerFrame
 {
 public:
   NS_DECL_FRAMEARENA_HELPERS
-#ifdef DEBUG
-  NS_DECL_QUERYFRAME_TARGET(nsBoxFrame)
-  NS_DECL_QUERYFRAME
-#endif
 
   friend nsIFrame* NS_NewBoxFrame(nsIPresShell* aPresShell, 
                                   nsStyleContext* aContext,
                                   bool aIsRoot,
                                   nsBoxLayout* aLayoutManager);
   friend nsIFrame* NS_NewBoxFrame(nsIPresShell* aPresShell,
                                   nsStyleContext* aContext);
 

--- a/layout/xul/nsSprocketLayout.cpp
+++ b/layout/xul/nsSprocketLayout.cpp
@@ -198,17 +198,17 @@ nsSprocketLayout::Layout(nsIFrame* aBox,
   // specified width of 300.  If the kids total only 150 pixels of width, then
   // we have 150 pixels left over.  |clientRect| is going to hold a width of 150 and
   // is going to be adjusted based off the value of the PACK property.  If flexible
   // objects are in the box, then the two rects will match.
   nsRect originalClientRect(clientRect);
 
   // The frame state contains cached knowledge about our box, such as our orientation
   // and direction.
-  nsFrameState frameState = nsFrameState(0);
+  nsFrameState frameState = 0;
   GetFrameState(aBox, frameState);
 
   // Build a list of our children's desired sizes and computed sizes
   nsBoxSize*         boxSizes = nullptr;
   nsComputedBoxSize* computedBoxSizes = nullptr;
 
   nscoord min = 0;
   nscoord max = 0;
@@ -637,17 +637,17 @@ nsSprocketLayout::Layout(nsIFrame* aBox,
 void
 nsSprocketLayout::PopulateBoxSizes(nsIFrame* aBox, nsBoxLayoutState& aState, nsBoxSize*& aBoxSizes, nscoord& aMinSize, nscoord& aMaxSize, int32_t& aFlexes)
 {
   // used for the equal size flag
   nscoord biggestPrefWidth = 0;
   nscoord biggestMinWidth = 0;
   nscoord smallestMaxWidth = NS_INTRINSICSIZE;
 
-  nsFrameState frameState = nsFrameState(0);
+  nsFrameState frameState = 0;
   GetFrameState(aBox, frameState);
 
   //if (frameState & NS_STATE_CURRENTLY_IN_DEBUG)
   //   printf("In debug\n");
 
   aMinSize = 0;
   aMaxSize = NS_INTRINSICSIZE;
 
@@ -883,17 +883,17 @@ nsSprocketLayout::ComputeChildsNextPosit
                                       const nscoord& aCurX, 
                                       const nscoord& aCurY, 
                                       nscoord& aNextX, 
                                       nscoord& aNextY, 
                                       const nsRect& aCurrentChildSize)
 {
   // Get the position along the box axis for the child.
   // The out-of-axis position is not set.
-  nsFrameState frameState = nsFrameState(0);
+  nsFrameState frameState = 0;
   GetFrameState(aBox, frameState);
 
   if (IsHorizontal(aBox)) {
     // horizontal box's children.
     if (frameState & NS_STATE_IS_DIRECTION_NORMAL)
       aNextX = aCurX + aCurrentChildSize.width;
     else
       aNextX = aCurX - aCurrentChildSize.width;
@@ -906,17 +906,17 @@ nsSprocketLayout::ComputeChildsNextPosit
       aNextY = aCurY - aCurrentChildSize.height;
   }
 }
 
 void
 nsSprocketLayout::AlignChildren(nsIFrame* aBox,
                                 nsBoxLayoutState& aState)
 {
-  nsFrameState frameState = nsFrameState(0);
+  nsFrameState frameState = 0;
   GetFrameState(aBox, frameState);
   bool isHorizontal = (frameState & NS_STATE_IS_HORIZONTAL) != 0;
   nsRect clientRect;
   aBox->GetClientRect(clientRect);
 
   NS_PRECONDITION(!(frameState & NS_STATE_AUTO_STRETCH),
                   "Only AlignChildren() with non-stretch alignment");
 
@@ -1301,17 +1301,17 @@ nsSprocketLayout::GetPrefSize(nsIFrame* 
    bool isHorizontal = IsHorizontal(aBox);
 
    nscoord biggestPref = 0;
 
    // run through all the children and get their min, max, and preferred sizes
    // return us the size of the box
 
    nsIFrame* child = aBox->GetChildBox();
-   nsFrameState frameState = nsFrameState(0);
+   nsFrameState frameState = 0;
    GetFrameState(aBox, frameState);
    bool isEqual = !!(frameState & NS_STATE_EQUAL_SIZE);
    int32_t count = 0;
    
    while (child) 
    {  
       // ignore collapsed children
       if (!child->IsCollapsed())
@@ -1358,17 +1358,17 @@ nsSprocketLayout::GetMinSize(nsIFrame* a
 
    nscoord biggestMin = 0;
 
 
    // run through all the children and get their min, max, and preferred sizes
    // return us the size of the box
 
    nsIFrame* child = aBox->GetChildBox();
-   nsFrameState frameState = nsFrameState(0);
+   nsFrameState frameState = 0;
    GetFrameState(aBox, frameState);
    bool isEqual = !!(frameState & NS_STATE_EQUAL_SIZE);
    int32_t count = 0;
 
    while (child) 
    {  
        // ignore collapsed children
       if (!child->IsCollapsed())
@@ -1427,17 +1427,17 @@ nsSprocketLayout::GetMaxSize(nsIFrame* a
 
    nscoord smallestMax = NS_INTRINSICSIZE;
    nsSize maxSize (NS_INTRINSICSIZE, NS_INTRINSICSIZE);
 
    // run through all the children and get their min, max, and preferred sizes
    // return us the size of the box
 
    nsIFrame* child = aBox->GetChildBox();
-   nsFrameState frameState = nsFrameState(0);
+   nsFrameState frameState = 0;
    GetFrameState(aBox, frameState);
    bool isEqual = !!(frameState & NS_STATE_EQUAL_SIZE);
    int32_t count = 0;
 
    while (child) 
    {  
       // ignore collapsed children
       if (!child->IsCollapsed())

--- a/python/lldbutils/README.txt
+++ b/python/lldbutils/README.txt
@@ -79,29 +79,16 @@ called with a smart pointer like nsRefPt
   (lldb) p mDocumentURI
   (nsCOMPtr<nsIURI>) $3 = {
     mRawPtr = 0x0000000117163e50
   }
   (lldb) prefcnt mDocumentURI
   11
 
 
-* pstate EXPR
-
-  Shows the frame state bits (using their symbolic names) of a given frame.
-  EXPR is an expression that is evaluated, and must be an nsIFrame*.
-
-  (lldb) p this
-  (nsTextFrame *) $1 = 0x000000011f470b10
-  (lldb) p/x mState
-  (nsFrameState) $2 = 0x0000004080604000
-  (lldb) pstate this
-  TEXT_HAS_NONCOLLAPSED_CHARACTERS | TEXT_END_OF_LINE | TEXT_START_OF_LINE | NS_FRAME_PAINTED_THEBES | NS_FRAME_INDEPENDENT_SELECTION
-
-
 * ptag EXPR
 
   Shows the DOM tag name of a node.  EXPR is an expression that is
   evaluated, and can be either an nsINode pointer or a concrete DOM
   object.
 
   (lldb) p this
   (nsHTMLDocument *) $0 = 0x0000000116e9d800

--- a/python/lldbutils/lldbutils/layout.py
+++ b/python/lldbutils/lldbutils/layout.py
@@ -3,18 +3,13 @@ import lldb
 def frametree(debugger, command, result, dict):
     """Dumps the frame tree containing the given nsIFrame*."""
     debugger.HandleCommand('expr (' + command + ')->DumpFrameTree()')
 
 def frametreelimited(debugger, command, result, dict):
     """Dumps the subtree of a frame tree rooted at the given nsIFrame*."""
     debugger.HandleCommand('expr (' + command + ')->DumpFrameTreeLimited()')
 
-def pstate(debugger, command, result, dict):
-    """Displays a frame's state bits symbolically."""
-    debugger.HandleCommand('expr mozilla::PrintFrameState(' + command + ')')
-
 def init(debugger):
     debugger.HandleCommand('command script add -f lldbutils.layout.frametree frametree')
     debugger.HandleCommand('command script add -f lldbutils.layout.frametreelimited frametreelimited')
     debugger.HandleCommand('command alias ft frametree')
     debugger.HandleCommand('command alias ftl frametreelimited')
-    debugger.HandleCommand('command script add -f lldbutils.layout.pstate pstate');