Merge from mozilla-central.
authorDavid Anderson <danderson@mozilla.com>
Mon, 26 Mar 2012 14:17:28 -0700
changeset 106094 5caeb193e6de12c5252280a0f8bd29fb32e821e7
parent 106093 cc2329cebf200e14eb320e6004903bcf95d4e42b (current diff)
parent 90381 df8ac2a1ecdd3223a110a15ee717b3ce6882effa (diff)
child 106095 349c49960e9e508d8dc538303442e2facea562d1
push id14706
push usereakhgari@mozilla.com
push dateTue, 11 Sep 2012 20:39:52 +0000
treeherdermozilla-inbound@d50bf1edaabe [default view] [failures only]
perfherder[talos] [build metrics] [platform microbench] (compared to previous push)
milestone14.0a1
first release with
nightly linux32
nightly linux64
nightly mac
nightly win32
nightly win64
last release without
nightly linux32
nightly linux64
nightly mac
nightly win32
nightly win64
Merge from mozilla-central.
accessible/src/base/nsAccUtils.cpp
accessible/src/base/nsAccUtils.h
accessible/src/base/nsAccessibilityService.h
accessible/src/base/nsAccessible.cpp
accessible/src/base/nsAccessible.h
accessible/src/base/nsBaseWidgetAccessible.h
accessible/src/html/nsHTMLImageMapAccessible.cpp
accessible/src/html/nsHyperTextAccessible.cpp
accessible/src/html/nsHyperTextAccessible.h
accessible/src/mac/mozTextAccessible.mm
accessible/src/mac/nsAccessibleWrap.mm
accessible/src/xul/nsXULFormControlAccessible.cpp
accessible/src/xul/nsXULFormControlAccessible.h
accessible/src/xul/nsXULListboxAccessible.cpp
accessible/src/xul/nsXULListboxAccessible.h
accessible/src/xul/nsXULTabAccessible.cpp
accessible/src/xul/nsXULTreeAccessible.cpp
accessible/src/xul/nsXULTreeGridAccessible.cpp
accessible/tests/mochitest/actions/test_tree.xul
accessible/tests/mochitest/attributes/test_obj_group.xul
accessible/tests/mochitest/common.js
accessible/tests/mochitest/events/test_focus_tree.xul
accessible/tests/mochitest/hittest/test_general.xul
accessible/tests/mochitest/relations/test_tree.xul
b2g/chrome/content/httpd.js
b2g/chrome/jar.mn
b2g/installer/package-manifest.in
browser/base/content/browser.js
browser/base/jar.mn
browser/components/migration/src/nsBrowserProfileMigratorUtils.cpp
browser/components/migration/src/nsBrowserProfileMigratorUtils.h
browser/components/migration/src/nsIEProfileMigrator.cpp
browser/components/migration/src/nsSafariProfileMigrator.cpp
browser/components/nsBrowserGlue.js
browser/components/sessionstore/src/nsSessionStore.js
browser/devtools/webconsole/test/browser_webconsole_bug_595934_message_categories.js
browser/devtools/webconsole/test/browser_webconsole_bug_642108_pruneTest.js
browser/devtools/webconsole/test/browser_webconsole_bug_653531_highlighter_console_helper.js
browser/devtools/webconsole/test/test-console-extras.html
browser/locales/en-US/chrome/browser/browser.dtd
build/mobile/devicemanagerADB.py
build/mobile/devicemanagerSUT.py
caps/src/nsJSPrincipals.cpp
config/autoconf.mk.in
configure.in
content/base/public/nsDOMFile.h
content/base/src/nsContentList.h
content/base/src/nsContentUtils.cpp
content/base/src/nsDOMFileReader.cpp
content/base/src/nsDOMTokenList.cpp
content/base/src/nsDocument.cpp
content/base/src/nsDocument.h
content/base/src/nsGenericElement.cpp
content/base/src/nsGenericElement.h
content/base/src/nsImageLoadingContent.h
content/base/src/nsObjectLoadingContent.cpp
content/base/src/nsScriptLoader.cpp
content/base/src/nsXMLHttpRequest.cpp
content/base/test/test_XHR.html
content/canvas/public/nsICanvasRenderingContextInternal.h
content/canvas/src/WebGLContext.cpp
content/canvas/src/WebGLContext.h
content/canvas/src/nsCanvasRenderingContext2D.cpp
content/canvas/src/nsCanvasRenderingContext2DAzure.cpp
content/events/src/nsDOMTouchEvent.h
content/events/src/nsEventListenerManager.cpp
content/html/content/public/nsHTMLCanvasElement.h
content/html/content/public/nsHTMLMediaElement.h
content/html/content/src/nsGenericHTMLElement.cpp
content/html/content/src/nsGenericHTMLElement.h
content/html/content/src/nsHTMLCanvasElement.cpp
content/html/content/src/nsHTMLFormElement.cpp
content/html/content/src/nsHTMLInputElement.cpp
content/html/content/src/nsHTMLMediaElement.cpp
content/html/content/src/nsHTMLSelectElement.cpp
content/html/content/src/nsHTMLTableElement.cpp
content/html/content/src/nsHTMLTextAreaElement.cpp
content/html/content/src/nsTextEditorState.h
content/html/document/src/nsHTMLDocument.cpp
content/svg/content/src/DOMSVGLengthList.h
content/svg/content/src/DOMSVGNumberList.h
content/svg/content/src/DOMSVGPathSegList.h
content/svg/content/src/DOMSVGPointList.h
content/svg/content/src/DOMSVGTransformList.h
content/xbl/src/nsBindingManager.cpp
content/xbl/src/nsXBLDocumentInfo.cpp
content/xbl/src/nsXBLPrototypeHandler.cpp
content/xml/document/src/nsXMLDocument.cpp
content/xslt/src/xslt/txMozillaXMLOutput.cpp
content/xul/content/src/nsXULElement.cpp
content/xul/document/src/nsXULDocument.cpp
content/xul/document/src/nsXULPrototypeCache.cpp
content/xul/document/src/nsXULPrototypeDocument.cpp
db/sqlite3/src/Makefile.in
docshell/base/nsDocShell.cpp
dom/base/nsDOMClassInfo.cpp
dom/base/nsDOMClassInfoClasses.h
dom/base/nsGlobalWindow.cpp
dom/base/nsGlobalWindow.h
dom/base/nsIScriptContext.h
dom/base/nsIScriptGlobalObject.h
dom/base/nsJSEnvironment.cpp
dom/base/nsJSEnvironment.h
dom/base/nsPIDOMWindow.h
dom/base/nsWrapperCache.h
dom/interfaces/core/nsIDOMDocument.idl
dom/interfaces/core/nsIDOMXMLDocument.idl
dom/interfaces/html/nsIDOMHTMLDocument.idl
dom/interfaces/svg/nsIDOMSVGDocument.idl
dom/system/nsDeviceMotion.cpp
dom/system/nsDeviceMotion.h
dom/system/nsDeviceSensors.cpp
dom/system/nsDeviceSensors.h
dom/workers/File.cpp
editor/libeditor/base/nsEditor.cpp
editor/libeditor/base/nsEditor.h
editor/libeditor/base/nsEditorEventListener.cpp
editor/libeditor/html/nsHTMLAnonymousUtils.cpp
editor/libeditor/html/nsHTMLDataTransfer.cpp
editor/libeditor/html/nsHTMLEditRules.cpp
editor/libeditor/html/nsHTMLEditor.cpp
editor/libeditor/html/nsHTMLObjectResizer.cpp
editor/libeditor/text/nsPlaintextDataTransfer.cpp
editor/libeditor/text/nsPlaintextEditor.cpp
editor/libeditor/text/nsTextEditRules.cpp
gfx/gl/GLContext.cpp
gfx/layers/basic/BasicLayers.cpp
gfx/layers/d3d10/CanvasLayerD3D10.cpp
gfx/layers/d3d10/CanvasLayerD3D10.h
gfx/layers/d3d9/CanvasLayerD3D9.cpp
gfx/layers/d3d9/CanvasLayerD3D9.h
gfx/layers/opengl/CanvasLayerOGL.cpp
gfx/layers/opengl/CanvasLayerOGL.h
gfx/thebes/gfxDWriteFontList.cpp
gfx/thebes/gfxDWriteFontList.h
gfx/thebes/gfxDWriteFonts.cpp
gfx/thebes/gfxDWriteFonts.h
gfx/thebes/gfxFT2FontList.cpp
gfx/thebes/gfxFT2FontList.h
gfx/thebes/gfxFT2Fonts.cpp
gfx/thebes/gfxFT2Fonts.h
gfx/thebes/gfxFont.cpp
gfx/thebes/gfxFont.h
gfx/thebes/gfxFontUtils.h
gfx/thebes/gfxGDIFont.cpp
gfx/thebes/gfxGDIFont.h
gfx/thebes/gfxGDIFontList.cpp
gfx/thebes/gfxGDIFontList.h
gfx/thebes/gfxMacFont.cpp
gfx/thebes/gfxMacFont.h
gfx/thebes/gfxMacPlatformFontList.h
gfx/thebes/gfxMacPlatformFontList.mm
gfx/thebes/gfxPlatformFontList.cpp
gfx/thebes/gfxPlatformFontList.h
gfx/thebes/gfxUtils.cpp
gfx/thebes/gfxUtils.h
image/decoders/nsPNGDecoder.cpp
image/src/Decoder.cpp
image/src/Decoder.h
image/src/RasterImage.cpp
image/src/RasterImage.h
image/src/imgFrame.cpp
image/src/imgFrame.h
intl/locale/src/windows/nsWin32Locale.cpp
intl/uconv/src/nsConverterInputStream.cpp
intl/uconv/util/nsUCSupport.h
js/src/Makefile.in
js/src/configure.in
js/src/frontend/BytecodeEmitter.h
js/src/js.msg
js/src/jsapi.cpp
js/src/jsapi.h
js/src/jsatom.cpp
js/src/jsatom.h
js/src/jscompartment.cpp
js/src/jsexn.cpp
js/src/jsfriendapi.h
js/src/jsfun.cpp
js/src/jsfun.h
js/src/jsgc.cpp
js/src/jsnum.h
js/src/jsobj.cpp
js/src/jsobj.h
js/src/jsprvtd.h
js/src/jspubtd.h
js/src/jsscope.cpp
js/src/jsscript.cpp
js/src/jsscript.h
js/src/jswrapper.cpp
js/src/jswrapper.h
js/src/jsxdrapi.cpp
js/src/jsxdrapi.h
js/src/vm/ArgumentsObject.cpp
js/src/vm/RegExpObject.cpp
js/src/vm/RegExpObject.h
js/xpconnect/loader/mozJSComponentLoader.cpp
js/xpconnect/src/XPCConvert.cpp
js/xpconnect/src/XPCJSRuntime.cpp
js/xpconnect/src/XPCWrappedJSClass.cpp
js/xpconnect/src/XPCWrappedNative.cpp
js/xpconnect/src/nsXPConnect.cpp
js/xpconnect/src/xpcpublic.h
js/xpconnect/tests/chrome/test_doublewrappedcompartments.xul
js/xpconnect/tests/mochitest/file_doublewrappedcompartments.html
js/xpconnect/wrappers/AccessCheck.cpp
js/xpconnect/wrappers/AccessCheck.h
js/xpconnect/wrappers/FilteringWrapper.cpp
js/xpconnect/wrappers/WrapperFactory.cpp
js/xpconnect/wrappers/WrapperFactory.h
js/xpconnect/wrappers/XrayWrapper.cpp
js/xpconnect/wrappers/XrayWrapper.h
layout/base/nsLayoutUtils.cpp
layout/base/nsPresContext.cpp
layout/build/nsLayoutModule.cpp
layout/generic/nsFrame.cpp
layout/generic/nsFrameList.cpp
layout/generic/nsHTMLReflowState.cpp
layout/generic/nsIFrame.h
layout/generic/nsObjectFrame.cpp
layout/generic/nsObjectFrame.h
layout/generic/nsQueryFrame.h
layout/generic/nsTextRunTransformations.cpp
layout/mathml/nsMathMLForeignFrameWrapper.cpp
layout/mathml/nsMathMLForeignFrameWrapper.h
layout/svg/base/src/SVGFELeafFrame.cpp
layout/svg/base/src/nsSVGClipPathFrame.cpp
layout/svg/base/src/nsSVGContainerFrame.cpp
layout/svg/base/src/nsSVGEffects.cpp
layout/svg/base/src/nsSVGFilterFrame.cpp
layout/svg/base/src/nsSVGForeignObjectFrame.cpp
layout/svg/base/src/nsSVGGeometryFrame.cpp
layout/svg/base/src/nsSVGGlyphFrame.cpp
layout/svg/base/src/nsSVGImageFrame.cpp
layout/svg/base/src/nsSVGInnerSVGFrame.cpp
layout/svg/base/src/nsSVGIntegrationUtils.cpp
layout/svg/base/src/nsSVGLeafFrame.cpp
layout/svg/base/src/nsSVGMarkerFrame.cpp
layout/svg/base/src/nsSVGMaskFrame.cpp
layout/svg/base/src/nsSVGOuterSVGFrame.cpp
layout/svg/base/src/nsSVGPaintServerFrame.cpp
layout/svg/base/src/nsSVGPathGeometryFrame.cpp
layout/svg/base/src/nsSVGPatternFrame.cpp
layout/svg/base/src/nsSVGStopFrame.cpp
layout/svg/base/src/nsSVGSwitchFrame.cpp
layout/svg/base/src/nsSVGTSpanFrame.cpp
layout/svg/base/src/nsSVGTextContainerFrame.cpp
layout/svg/base/src/nsSVGTextFrame.cpp
layout/svg/base/src/nsSVGUseFrame.cpp
layout/svg/base/src/nsSVGUtils.cpp
mobile/android/base/GeckoApp.java
mobile/android/base/Makefile.in
mobile/android/base/resources/menu-v11/gecko_menu.xml
mobile/android/base/resources/menu/gecko_menu.xml
modules/libpref/src/init/all.js
netwerk/base/src/nsIOService.cpp
parser/html/nsHtml5StreamParser.cpp
parser/html/nsHtml5StreamParser.h
parser/html/nsHtml5TreeBuilderCppSupplement.h
parser/html/nsHtml5TreeBuilderHSupplement.h
parser/html/nsHtml5TreeOpExecutor.cpp
parser/html/nsHtml5TreeOpExecutor.h
parser/html/nsHtml5TreeOperation.cpp
parser/html/nsHtml5TreeOperation.h
parser/htmlparser/public/nsIHTMLContentSink.h
parser/htmlparser/public/nsIHTMLFragmentContentSink.h
parser/htmlparser/public/nsIParser.h
parser/htmlparser/src/nsDTDUtils.h
security/manager/ssl/src/nsCRLManager.cpp
security/manager/ssl/src/nsNSSComponent.cpp
toolkit/components/places/nsPlacesImportExportService.cpp
toolkit/components/places/nsPlacesImportExportService.h
toolkit/mozapps/installer/packager.mk
toolkit/system/gnome/nsAlertsIconListener.cpp
widget/xpwidgets/nsBaseWidget.cpp
xpcom/glue/nsBaseHashtable.h
xpcom/glue/nsTArray.h
xpcom/glue/nsTHashtable.h
xpcom/system/nsIDeviceMotion.idl
xpcom/threads/nsThread.cpp
xpcom/threads/nsThread.h
xulrunner/installer/mac/Description.plist.in
xulrunner/installer/mac/Info.plist.in
xulrunner/installer/mac/Makefile.in
xulrunner/makefiles.sh
--- a/Makefile.in
+++ b/Makefile.in
@@ -67,16 +67,21 @@ tier_base_dirs = \
 
 ifndef LIBXUL_SDK
 ifeq (android,$(MOZ_WIDGET_TOOLKIT))
 tier_base_dirs += \
   other-licenses/android \
   other-licenses/skia-npapi \
   $(NULL)
 endif
+ifeq (gonk,$(MOZ_WIDGET_TOOLKIT))
+tier_base_dirs += \
+  other-licenses/android \
+  $(NULL)
+endif
 
 ifdef MOZ_MEMORY
 tier_base_dirs += memory/jemalloc
 endif
 tier_base_dirs += \
   mozglue \
   memory/mozalloc \
   $(NULL)
--- a/accessible/public/nsIAccessibleRole.idl
+++ b/accessible/public/nsIAccessibleRole.idl
@@ -788,14 +788,19 @@ interface nsIAccessibleRole : nsISupport
   const unsigned long ROLE_NOTE = 123;
 
   /**
    * A figure. Used for things like HTML5 figure element.
    */
   const unsigned long ROLE_FIGURE = 124;
 
   /**
+   * Represents a rich item with a check box.
+   */
+  const unsigned long ROLE_CHECK_RICH_OPTION = 125;
+
+  /**
    * It's not role actually. This constant is important to help ensure
    * nsRoleMap's are synchronized.
    */
-  const unsigned long ROLE_LAST_ENTRY = 125;
+  const unsigned long ROLE_LAST_ENTRY = 126;
 };
 
--- a/accessible/src/atk/nsMaiInterfaceEditableText.cpp
+++ b/accessible/src/atk/nsMaiInterfaceEditableText.cpp
@@ -95,17 +95,17 @@ insertTextCB(AtkEditableText *aText,
         return;
 
     nsCOMPtr<nsIAccessibleEditableText> accText;
     accWrap->QueryInterface(NS_GET_IID(nsIAccessibleEditableText),
                             getter_AddRefs(accText));
     if (!accText)
         return;
 
-    NS_ConvertUTF8toUTF16 strContent(aString);
+    NS_ConvertUTF8toUTF16 strContent(aString, aLength);
 
     // interface changed in nsIAccessibleEditableText.idl ???
     //
     // PRInt32 pos = *aPosition;
     // nsresult rv = accText->InsertText(strContent, aLength, &pos);
     // *aPosition = pos;
 
     accText->InsertText(strContent, *aPosition);
--- a/accessible/src/atk/nsRoleMap.h
+++ b/accessible/src/atk/nsRoleMap.h
@@ -165,11 +165,12 @@ static const PRUint32 atkRoleMap[] = {
     ATK_ROLE_LIST_ITEM,           // roles::OPTION               117
     ATK_ROLE_LIST_ITEM,           // roles::RICH_OPTION          118
     ATK_ROLE_LIST,                // roles::LISTBOX              119
     ATK_ROLE_UNKNOWN,             // roles::FLAT_EQUATION        120
     ATK_ROLE_TABLE_CELL,          // roles::GRID_CELL            121
     ATK_ROLE_PANEL,               // roles::EMBEDDED_OBJECT      122
     ATK_ROLE_SECTION,             // roles::NOTE                 123
     ATK_ROLE_PANEL,               // roles::FIGURE               124
+    ATK_ROLE_CHECK_BOX,           // roles::CHECK_RICH_OPTION    125
     kROLE_ATK_LAST_ENTRY          // roles::LAST_ENTRY
 };
 
--- a/accessible/src/base/AccGroupInfo.h
+++ b/accessible/src/base/AccGroupInfo.h
@@ -62,16 +62,18 @@ public:
     mozilla::a11y::role role = aAccessible->Role();
     if (role != mozilla::a11y::roles::ROW &&
         role != mozilla::a11y::roles::GRID_CELL &&
         role != mozilla::a11y::roles::OUTLINEITEM &&
         role != mozilla::a11y::roles::OPTION &&
         role != mozilla::a11y::roles::LISTITEM &&
         role != mozilla::a11y::roles::MENUITEM &&
         role != mozilla::a11y::roles::COMBOBOX_OPTION &&
+        role != mozilla::a11y::roles::RICH_OPTION &&
+        role != mozilla::a11y::roles::CHECK_RICH_OPTION &&
         role != mozilla::a11y::roles::PARENT_MENUITEM &&
         role != mozilla::a11y::roles::CHECK_MENU_ITEM &&
         role != mozilla::a11y::roles::RADIO_MENU_ITEM &&
         role != mozilla::a11y::roles::RADIOBUTTON &&
         role != mozilla::a11y::roles::PAGETAB)
       return nsnull;
 
     AccGroupInfo* info = new AccGroupInfo(aAccessible, BaseRole(role));
@@ -83,16 +85,20 @@ private:
   AccGroupInfo& operator =(const AccGroupInfo&);
 
   static mozilla::a11y::role BaseRole(mozilla::a11y::role aRole)
   {
     if (aRole == mozilla::a11y::roles::CHECK_MENU_ITEM ||
         aRole == mozilla::a11y::roles::PARENT_MENUITEM ||
         aRole == mozilla::a11y::roles::RADIO_MENU_ITEM)
       return mozilla::a11y::roles::MENUITEM;
+
+    if (aRole == mozilla::a11y::roles::CHECK_RICH_OPTION)
+      return mozilla::a11y::roles::RICH_OPTION;
+
     return aRole;
   }
 
   /**
    * Return true if the given parent role is conceptual parent of the given
    * role.
    */
   static bool IsConceptualParent(mozilla::a11y::role aRole,
--- a/accessible/src/base/Role.h
+++ b/accessible/src/base/Role.h
@@ -785,19 +785,24 @@ namespace roles {
   NOTE = 123,
 
   /**
    * A figure. Used for things like HTML5 figure element.
    */
   FIGURE = 124,
 
   /**
+   * Represents a rich item with a check box.
+   */
+  CHECK_RICH_OPTION = 125,
+
+  /**
    * It's not role actually. This constant is important to help ensure
    * nsRoleMap's are synchronized.
    */
-  LAST_ENTRY = 125
+  LAST_ENTRY = 126
   };
 } // namespace role
 typedef enum mozilla::a11y::roles::Role role;
 } // namespace a11y
 } // namespace mozilla
 
 #endif
--- a/accessible/src/base/nsAccUtils.cpp
+++ b/accessible/src/base/nsAccUtils.cpp
@@ -129,57 +129,16 @@ nsAccUtils::GetARIAOrDefaultLevel(nsAcce
                            nsGkAtoms::aria_level, &level);
 
   if (level != 0)
     return level;
 
   return GetDefaultLevel(aAccessible);
 }
 
-void
-nsAccUtils::GetPositionAndSizeForXULSelectControlItem(nsIContent *aContent,
-                                                      PRInt32 *aPosInSet,
-                                                      PRInt32 *aSetSize)
-{
-  nsCOMPtr<nsIDOMXULSelectControlItemElement> item(do_QueryInterface(aContent));
-  if (!item)
-    return;
-
-  nsCOMPtr<nsIDOMXULSelectControlElement> control;
-  item->GetControl(getter_AddRefs(control));
-  if (!control)
-    return;
-
-  PRUint32 itemsCount = 0;
-  control->GetItemCount(&itemsCount);
-
-  PRInt32 indexOf = 0;
-  control->GetIndexOfItem(item, &indexOf);
-
-  *aSetSize = itemsCount;
-  *aPosInSet = indexOf;
-
-  for (PRUint32 index = 0; index < itemsCount; index++) {
-    nsCOMPtr<nsIDOMXULSelectControlItemElement> currItem;
-    control->GetItemAtIndex(index, getter_AddRefs(currItem));
-    nsCOMPtr<nsINode> currNode(do_QueryInterface(currItem));
-
-    nsAccessible* itemAcc = currNode ?
-      GetAccService()->GetAccessible(currNode, nsnull) : nsnull;
-
-    if (!itemAcc || itemAcc->State() & states::INVISIBLE) {
-      (*aSetSize)--;
-      if (index < static_cast<PRUint32>(indexOf))
-        (*aPosInSet)--;
-    }
-  }
-
-  (*aPosInSet)++; // group position is 1-index based.
-}
-
 PRInt32
 nsAccUtils::GetLevelForXULContainerItem(nsIContent *aContent)
 {
   nsCOMPtr<nsIDOMXULContainerItemElement> item(do_QueryInterface(aContent));
   if (!item)
     return 0;
 
   nsCOMPtr<nsIDOMXULContainerElement> container;
--- a/accessible/src/base/nsAccUtils.h
+++ b/accessible/src/base/nsAccUtils.h
@@ -103,24 +103,16 @@ public:
 
   /**
    * Return ARIA level value or the default one if ARIA is missed for the
    * given accessible.
    */
   static PRInt32 GetARIAOrDefaultLevel(nsAccessible *aAccessible);
 
   /**
-   * Compute position in group (posinset) and group size (setsize) for
-   * nsIDOMXULSelectControlItemElement node.
-   */
-  static void GetPositionAndSizeForXULSelectControlItem(nsIContent *aContent,
-                                                        PRInt32 *aPosInSet,
-                                                        PRInt32 *aSetSize);
-
-  /**
    * Compute group level for nsIDOMXULContainerItemElement node.
    */
   static PRInt32 GetLevelForXULContainerItem(nsIContent *aContent);
 
   /**
    * Set container-foo live region attributes for the given node.
    *
    * @param aAttributes    where to store the attributes
--- a/accessible/src/base/nsAccessibilityService.h
+++ b/accessible/src/base/nsAccessibilityService.h
@@ -410,17 +410,18 @@ static const char kRoleNames[][20] = {
   "image map",           //ROLE_IMAGE_MAP
   "listbox option",      //ROLE_OPTION
   "listbox rich option", //ROLE_RICH_OPTION
   "listbox",             //ROLE_LISTBOX
   "flat equation",       //ROLE_FLAT_EQUATION
   "gridcell",            //ROLE_GRID_CELL
   "embedded object",     //ROLE_EMBEDDED_OBJECT
   "note",                //ROLE_NOTE
-  "figure"               //ROLE_FIGURE
+  "figure",              //ROLE_FIGURE
+  "check rich option"    //ROLE_CHECK_RICH_OPTION
 };
 
 /**
  * Map nsIAccessibleEvents constants to strings. Used by
  * nsIAccessibleRetrieval::getStringEventType() method.
  */
 static const char kEventTypeNames[][40] = {
   "unknown",                                 //
--- a/accessible/src/base/nsAccessible.cpp
+++ b/accessible/src/base/nsAccessible.cpp
@@ -1347,48 +1347,45 @@ nsAccessible::GetAttributes(nsIPersisten
   }
 
   return NS_OK;
 }
 
 nsresult
 nsAccessible::GetAttributesInternal(nsIPersistentProperties *aAttributes)
 {
+  // If the accessible isn't primary for its node (such as list item bullet or
+  // xul tree item then don't calculate content based attributes.
+  if (!IsPrimaryForNode())
+    return NS_OK;
+
   // Attributes set by this method will not be used to override attributes on a sub-document accessible
   // when there is a <frame>/<iframe> element that spawned the sub-document
-  nsCOMPtr<nsIDOMElement> element(do_QueryInterface(mContent));
-
-  nsAutoString tagName;
-  element->GetTagName(tagName);
-  if (!tagName.IsEmpty()) {
-    nsAutoString oldValueUnused;
-    aAttributes->SetStringProperty(NS_LITERAL_CSTRING("tag"), tagName,
-                                   oldValueUnused);
-  }
 
   nsEventShell::GetEventAttributes(GetNode(), aAttributes);
  
   // Expose class because it may have useful microformat information
   // Let the class from an iframe's document be exposed, don't override from <iframe class>
   nsAutoString _class;
   if (mContent->GetAttr(kNameSpaceID_None, nsGkAtoms::_class, _class))
     nsAccUtils::SetAccAttr(aAttributes, nsGkAtoms::_class, _class);
 
   // Get container-foo computed live region properties based on the closest container with
   // the live region attribute. 
   // Inner nodes override outer nodes within the same document --
   //   The inner nodes can be used to override live region behavior on more general outer nodes
   // However, nodes in outer documents override nodes in inner documents:
   //   Outer doc author may want to override properties on a widget they used in an iframe
-  nsIContent *startContent = mContent;
-  while (true) {
-    NS_ENSURE_STATE(startContent);
-    nsIDocument *doc = startContent->GetDocument();
+  nsIContent* startContent = mContent;
+  while (startContent) {
+    nsIDocument* doc = startContent->GetDocument();
     nsIContent* rootContent = nsCoreUtils::GetRoleContent(doc);
-    NS_ENSURE_STATE(rootContent);
+    if (!rootContent)
+      return NS_OK;
+
     nsAccUtils::SetLiveContainerAttributes(aAttributes, startContent,
                                            rootContent);
 
     // Allow ARIA live region markup from outer documents to override
     nsCOMPtr<nsISupports> container = doc->GetContainer(); 
     nsCOMPtr<nsIDocShellTreeItem> docShellTreeItem =
       do_QueryInterface(container);
     if (!docShellTreeItem)
@@ -1404,31 +1401,35 @@ nsAccessible::GetAttributesInternal(nsIP
       break;
 
     startContent = parentDoc->FindContentForSubDocument(doc);      
   }
 
   if (!mContent->IsElement())
     return NS_OK;
 
+  // Expose tag.
+  nsAutoString tagName;
+  mContent->NodeInfo()->GetName(tagName);
+  nsAccUtils::SetAccAttr(aAttributes, nsGkAtoms::tag, tagName);
+
   // Expose draggable object attribute?
   nsCOMPtr<nsIDOMHTMLElement> htmlElement = do_QueryInterface(mContent);
   if (htmlElement) {
     bool draggable = false;
     htmlElement->GetDraggable(&draggable);
     if (draggable) {
       nsAccUtils::SetAccAttr(aAttributes, nsGkAtoms::draggable,
                              NS_LITERAL_STRING("true"));
     }
   }
 
   // Don't calculate CSS-based object attributes when no frame (i.e.
-  // the accessible is not unattached form three) or when the accessible is not
-  // primary for node (like list bullet or XUL tree items).
-  if (!mContent->GetPrimaryFrame() || !IsPrimaryForNode())
+  // the accessible is unattached from the tree).
+  if (!mContent->GetPrimaryFrame())
     return NS_OK;
 
   // CSS style based object attributes.
   nsAutoString value;
   StyleInfo styleInfo(mContent->AsElement(), mDoc->PresShell());
 
   // Expose 'display' attribute.
   styleInfo.Display(value);
--- a/accessible/src/base/nsAccessible.h
+++ b/accessible/src/base/nsAccessible.h
@@ -645,17 +645,17 @@ protected:
    * Cache accessible children.
    */
   virtual void CacheChildren();
 
   /**
    * Set accessible parent and index in parent.
    */
   virtual void BindToParent(nsAccessible* aParent, PRUint32 aIndexInParent);
-  void UnbindFromParent();
+  virtual void UnbindFromParent();
 
   /**
    * Return sibling accessible at the given offset.
    */
   virtual nsAccessible* GetSiblingAtOffset(PRInt32 aOffset,
                                            nsresult *aError = nsnull) const;
 
   /**
--- a/accessible/src/base/nsBaseWidgetAccessible.cpp
+++ b/accessible/src/base/nsBaseWidgetAccessible.cpp
@@ -243,16 +243,26 @@ nsLinkableAccessible::BindToParent(nsAcc
     if (nsCoreUtils::HasClickListener(walkUpAcc->GetContent())) {
       mActionAcc = walkUpAcc;
       mIsOnclick = true;
       return;
     }
   }
 }
 
+void
+nsLinkableAccessible::UnbindFromParent()
+{
+  mActionAcc = nsnull;
+  mIsLink = false;
+  mIsOnclick = false;
+
+  nsAccessibleWrap::UnbindFromParent();
+}
+
 ////////////////////////////////////////////////////////////////////////////////
 // nsEnumRoleAccessible
 ////////////////////////////////////////////////////////////////////////////////
 
 nsEnumRoleAccessible::
   nsEnumRoleAccessible(nsIContent* aNode, nsDocAccessible* aDoc,
                        roles::Role aRole) :
   nsAccessibleWrap(aNode, aDoc), mRole(aRole)
--- a/accessible/src/base/nsBaseWidgetAccessible.h
+++ b/accessible/src/base/nsBaseWidgetAccessible.h
@@ -103,16 +103,17 @@ public:
   virtual KeyBinding AccessKey() const;
 
   // HyperLinkAccessible
   virtual already_AddRefed<nsIURI> AnchorURIAt(PRUint32 aAnchorIndex);
 
 protected:
   // nsAccessible
   virtual void BindToParent(nsAccessible* aParent, PRUint32 aIndexInParent);
+  virtual void UnbindFromParent();
 
   /**
    * Parent accessible that provides an action for this linkable accessible.
    */
   nsAccessible* mActionAcc;
   bool mIsLink;
   bool mIsOnclick;
 };
--- a/accessible/src/html/nsHTMLImageMapAccessible.cpp
+++ b/accessible/src/html/nsHTMLImageMapAccessible.cpp
@@ -211,63 +211,16 @@ nsHTMLAreaAccessible::Description(nsStri
   aDescription.Truncate();
 
   // Still to do - follow IE's standard here
   nsCOMPtr<nsIDOMHTMLAreaElement> area(do_QueryInterface(mContent));
   if (area) 
     area->GetShape(aDescription);
 }
 
-NS_IMETHODIMP
-nsHTMLAreaAccessible::GetBounds(PRInt32 *aX, PRInt32 *aY,
-                                PRInt32 *aWidth, PRInt32 *aHeight)
-{
-  NS_ENSURE_ARG_POINTER(aX);
-  *aX = 0;
-  NS_ENSURE_ARG_POINTER(aY);
-  *aY = 0;
-  NS_ENSURE_ARG_POINTER(aWidth);
-  *aWidth = 0;
-  NS_ENSURE_ARG_POINTER(aHeight);
-  *aHeight = 0;
-
-  if (IsDefunct())
-    return NS_ERROR_FAILURE;
-
-  // Essentially this uses GetRect on mAreas of nsImageMap from nsImageFrame.
-  nsPresContext *presContext = GetPresContext();
-  NS_ENSURE_TRUE(presContext, NS_ERROR_FAILURE);
-
-  nsIFrame *frame = GetFrame();
-  NS_ENSURE_TRUE(frame, NS_ERROR_FAILURE);
-  nsImageFrame *imageFrame = do_QueryFrame(frame);
-
-  nsImageMap* map = imageFrame->GetImageMap();
-  NS_ENSURE_TRUE(map, NS_ERROR_FAILURE);
-
-  nsRect rect;
-  nsresult rv = map->GetBoundsForAreaContent(mContent, rect);
-  NS_ENSURE_SUCCESS(rv, rv);
-
-  *aX = presContext->AppUnitsToDevPixels(rect.x);
-  *aY = presContext->AppUnitsToDevPixels(rect.y);
-
-  // XXX Areas are screwy; they return their rects as a pair of points, one pair
-  // stored into the width and height.
-  *aWidth  = presContext->AppUnitsToDevPixels(rect.width - rect.x);
-  *aHeight = presContext->AppUnitsToDevPixels(rect.height - rect.y);
-
-  // Put coords in absolute screen coords
-  nsIntRect orgRectPixels = frame->GetScreenRectExternal();
-  *aX += orgRectPixels.x;
-  *aY += orgRectPixels.y;
-
-  return NS_OK;
-}
-
 ////////////////////////////////////////////////////////////////////////////////
 // nsHTMLAreaAccessible: nsAccessNode public
 
 bool
 nsHTMLAreaAccessible::IsPrimaryForNode() const
 {
   // Make HTML area DOM element not accessible. HTML image map accessible
   // manages its tree itself.
@@ -321,8 +274,30 @@ nsHTMLAreaAccessible::EndOffset()
 ////////////////////////////////////////////////////////////////////////////////
 // nsHTMLAreaAccessible: nsAccessible protected
 
 void
 nsHTMLAreaAccessible::CacheChildren()
 {
   // No children for aria accessible.
 }
+
+void
+nsHTMLAreaAccessible::GetBoundsRect(nsRect& aBounds, nsIFrame** aBoundingFrame)
+{
+  nsIFrame* frame = GetFrame();
+  if (!frame)
+    return;
+
+  nsImageFrame* imageFrame = do_QueryFrame(frame);
+  nsImageMap* map = imageFrame->GetImageMap();
+
+  nsresult rv = map->GetBoundsForAreaContent(mContent, aBounds);
+  if (NS_FAILED(rv))
+    return;
+
+  // XXX Areas are screwy; they return their rects as a pair of points, one pair
+  // stored into the width and height.
+  aBounds.width -= aBounds.x;
+  aBounds.height -= aBounds.y;
+
+  *aBoundingFrame = frame;
+}
--- a/accessible/src/html/nsHTMLImageMapAccessible.h
+++ b/accessible/src/html/nsHTMLImageMapAccessible.h
@@ -91,20 +91,16 @@ nsAccessible::AsImageMap()
  * Accessible for image map areas - must be child of image.
  */
 class nsHTMLAreaAccessible : public nsHTMLLinkAccessible
 {
 public:
 
   nsHTMLAreaAccessible(nsIContent* aContent, nsDocAccessible* aDoc);
 
-  // nsIAccessible
-
-  NS_IMETHOD GetBounds(PRInt32 *x, PRInt32 *y, PRInt32 *width, PRInt32 *height);
-
   // nsAccessNode
   virtual bool IsPrimaryForNode() const;
 
   // nsAccessible
   virtual void Description(nsString& aDescription);
   virtual nsresult GetNameInternal(nsAString& aName);
   virtual PRUint64 NativeState();
   virtual nsAccessible* ChildAtPoint(PRInt32 aX, PRInt32 aY,
@@ -113,11 +109,12 @@ public:
   // HyperLinkAccessible
   virtual PRUint32 StartOffset();
   virtual PRUint32 EndOffset();
 
 protected:
 
   // nsAccessible
   virtual void CacheChildren();
+  virtual void GetBoundsRect(nsRect& aBounds, nsIFrame** aBoundingFrame);
 };
 
 #endif  
--- a/accessible/src/html/nsHyperTextAccessible.cpp
+++ b/accessible/src/html/nsHyperTextAccessible.cpp
@@ -1219,17 +1219,17 @@ nsHyperTextAccessible::GetAttributesInte
   nsIFrame *frame = GetFrame();
   if (frame && frame->GetType() == nsGkAtoms::blockFrame) {
     nsAutoString oldValueUnused;
     aAttributes->SetStringProperty(NS_LITERAL_CSTRING("formatting"), NS_LITERAL_STRING("block"),
                                    oldValueUnused);
   }
 
   if (FocusMgr()->IsFocused(this)) {
-    PRInt32 lineNumber = GetCaretLineNumber();
+    PRInt32 lineNumber = CaretLineNumber();
     if (lineNumber >= 1) {
       nsAutoString strLineNumber;
       strLineNumber.AppendInt(lineNumber);
       nsAccUtils::SetAccAttr(aAttributes, nsGkAtoms::lineNumber,
                              strLineNumber);
     }
   }
 
@@ -1675,17 +1675,17 @@ nsHyperTextAccessible::GetCaretOffset(PR
       return NS_OK;
   }
 
   DOMPointToHypertextOffset(focusNode, focusOffset, aCaretOffset);
   return NS_OK;
 }
 
 PRInt32
-nsHyperTextAccessible::GetCaretLineNumber()
+nsHyperTextAccessible::CaretLineNumber()
 {
   // Provide the line number for the caret, relative to the
   // currently focused node. Use a 1-based index
   nsRefPtr<nsFrameSelection> frameSelection = FrameSelection();
   if (!frameSelection)
     return -1;
 
   nsISelection* domSel =
--- a/accessible/src/html/nsHyperTextAccessible.h
+++ b/accessible/src/html/nsHyperTextAccessible.h
@@ -259,16 +259,32 @@ public:
    *
    * @param  aOffset  [in] the given text offset
    */
   nsAccessible* GetChildAtOffset(PRUint32 aOffset)
   {
     return GetChildAt(GetChildIndexAtOffset(aOffset));
   }
 
+  /**
+   * Return the bounds of the text between given start and end offset.
+   */
+  nsIntRect GetTextBounds(PRInt32 aStartOffset, PRInt32 aEndOffset)
+  {
+    nsIntRect bounds;
+    GetPosAndText(aStartOffset, aEndOffset, nsnull, nsnull, &bounds);
+    return bounds;
+  }
+
+  /**
+   * Provide the line number for the caret.
+   * @return 1-based index for the line number with the caret
+   */
+  PRInt32 CaretLineNumber();
+
   //////////////////////////////////////////////////////////////////////////////
   // EditableTextAccessible
 
   /**
    * Return the editor associated with the accessible.
    */
   virtual already_AddRefed<nsIEditor> GetEditor() const;
 
@@ -368,23 +384,16 @@ protected:
 
   /**
    * Return selection ranges within the accessible subtree.
    */
   void GetSelectionDOMRanges(PRInt16 aType, nsTArray<nsRange*>* aRanges);
 
   nsresult SetSelectionRange(PRInt32 aStartPos, PRInt32 aEndPos);
 
-  /**
-   * Provide the line number for the caret, relative to the
-   * current DOM node.
-   * @return 1-based index for the line number with the caret
-   */
-  PRInt32 GetCaretLineNumber();
-
   // Helpers
   nsresult GetDOMPointByFrameOffset(nsIFrame *aFrame, PRInt32 aOffset,
                                     nsIAccessible *aAccessible,
                                     nsIDOMNode **aNode, PRInt32 *aNodeOffset);
 
   
   /**
    * Return hyper text offset for the specified bound of the given DOM range.
--- a/accessible/src/mac/mozAccessible.h
+++ b/accessible/src/mac/mozAccessible.h
@@ -39,16 +39,28 @@
 #include "nsAccessibleWrap.h"
 
 #import <Cocoa/Cocoa.h>
 
 #import "mozAccessibleProtocol.h"
 
 @class mozRootAccessible;
 
+/**
+ * All mozAccessibles are either abstract objects (that correspond to XUL
+ * widgets, HTML frames, etc) or are attached to a certain view; for example
+ * a document view. When we hand an object off to an AT, we always want
+ * to give it the represented view, in the latter case.
+ */
+inline id <mozAccessible>
+GetObjectOrRepresentedView(id <mozAccessible> aObject)
+{
+  return [aObject hasRepresentedView] ? [aObject representedView] : aObject;
+}
+
 @interface mozAccessible : NSObject <mozAccessible>
 {
   /**
    * Weak reference; it owns us.
    */
   nsAccessibleWrap* mGeckoAccessible;
   
   /**
--- a/accessible/src/mac/mozAccessible.mm
+++ b/accessible/src/mac/mozAccessible.mm
@@ -66,31 +66,16 @@ using namespace mozilla::a11y;
 // of the screen), into a top-left screen point, that gecko can use.
 static inline void
 ConvertCocoaToGeckoPoint(NSPoint &aInPoint, nsPoint &aOutPoint)
 {
   float mainScreenHeight = [(NSView*)[[NSScreen screens] objectAtIndex:0] frame].size.height;
   aOutPoint.MoveTo ((nscoord)aInPoint.x, (nscoord)(mainScreenHeight - aInPoint.y));
 }
 
-// all mozAccessibles are either abstract objects (that correspond to XUL widgets, HTML frames, etc) or are
-// attached to a certain view; for example a document view. when we hand an object off to an AT, we always want
-// to give it the represented view, in the latter case.
-static inline id <mozAccessible>
-GetObjectOrRepresentedView(id <mozAccessible> anObject)
-{
-  NS_OBJC_BEGIN_TRY_ABORT_BLOCK_NIL;
-
-  if ([anObject hasRepresentedView])
-    return [anObject representedView];
-  return anObject;
-
-  NS_OBJC_END_TRY_ABORT_BLOCK_NIL;
-}
-
 // returns the passed in object if it is not ignored. if it's ignored, will return
 // the first unignored ancestor.
 static inline id
 GetClosestInterestingAccessible(id anObject)
 {
   NS_OBJC_BEGIN_TRY_ABORT_BLOCK_NIL;
 
   // this object is not ignored, so let's return it.
--- a/accessible/src/mac/mozTextAccessible.h
+++ b/accessible/src/mac/mozTextAccessible.h
@@ -5,18 +5,8 @@
 @interface mozTextAccessible : mozAccessible
 {
   // both of these are the same old mGeckoAccessible, but already
   // QI'd for us, to the right type, for convenience.
   nsHyperTextAccessible     *mGeckoTextAccessible;         // strong
   nsIAccessibleEditableText *mGeckoEditableTextAccessible; // strong
 }
 @end
-
-/* A combobox (in the mac world) is a textfield with an associated menu, for example
-   the location bar. */
-@interface mozComboboxAccessible : mozTextAccessible
-// equivalent to pressing return key in this textfield.
-- (void)confirm;
-
-// shows the menu for this combobox.
-- (void)showMenu;
-@end
--- a/accessible/src/mac/mozTextAccessible.mm
+++ b/accessible/src/mac/mozTextAccessible.mm
@@ -1,8 +1,10 @@
+/* -*- Mode: Objective-C++; tab-width: 2; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
+
 #include "nsAccessibleWrap.h"
 
 #include "nsCocoaUtils.h"
 #include "nsObjCExceptions.h"
 
 #import "mozTextAccessible.h"
 
 using namespace mozilla::a11y;
@@ -238,112 +240,15 @@ using namespace mozilla::a11y;
 }
 
 #pragma mark -
 
 - (void)valueDidChange
 {
   NS_OBJC_BEGIN_TRY_ABORT_BLOCK;
 
-  NSAccessibilityPostNotification([self hasRepresentedView] ? [self representedView] : self, 
+  NSAccessibilityPostNotification(GetObjectOrRepresentedView(self),
                                   NSAccessibilityValueChangedNotification);
 
   NS_OBJC_END_TRY_ABORT_BLOCK;
 }
 
 @end
-
-@implementation mozComboboxAccessible
-
-- (NSArray*)accessibilityAttributeNames
-{
-  NS_OBJC_BEGIN_TRY_ABORT_BLOCK_NIL;
-
-  static NSArray *supportedAttributes = nil;
-  if (!supportedAttributes) {
-    // standard attributes that are shared and supported by all generic elements.
-    supportedAttributes = [[NSArray alloc] initWithObjects:NSAccessibilityParentAttribute, // required
-                                                           NSAccessibilityRoleAttribute,   // required
-                                                           NSAccessibilityTitleAttribute,
-                                                           NSAccessibilityValueAttribute, // required
-                                                           NSAccessibilityHelpAttribute,
-                                                           NSAccessibilityRoleDescriptionAttribute,
-                                                           NSAccessibilityPositionAttribute, // required
-                                                           NSAccessibilitySizeAttribute, // required
-                                                           NSAccessibilityWindowAttribute, // required
-                                                           NSAccessibilityFocusedAttribute, // required
-                                                           NSAccessibilityEnabledAttribute, // required
-                                                           NSAccessibilityChildrenAttribute, // required
-                                                           NSAccessibilityHelpAttribute,
-                                                           // NSAccessibilityExpandedAttribute, // required
-                                                           NSAccessibilityTopLevelUIElementAttribute, // required
-                                                           NSAccessibilityDescriptionAttribute, // required
-                                                           /* text-specific attributes */
-                                                           NSAccessibilitySelectedTextAttribute, // required
-                                                           NSAccessibilitySelectedTextRangeAttribute, // required
-                                                           NSAccessibilityNumberOfCharactersAttribute, // required
-                                                           // TODO: NSAccessibilityVisibleCharacterRangeAttribute, // required
-                                                           // TODO: NSAccessibilityInsertionPointLineNumberAttribute
-#if DEBUG
-                                                           @"AXMozDescription",
-#endif
-                                                           nil];
-  }
-  return supportedAttributes;
-
-  NS_OBJC_END_TRY_ABORT_BLOCK_NIL;
-}
-
-- (NSArray *)accessibilityActionNames
-{
-  NS_OBJC_BEGIN_TRY_ABORT_BLOCK_NIL;
-
-  if ([self isEnabled]) {
-    return [NSArray arrayWithObjects:NSAccessibilityConfirmAction,
-                                     NSAccessibilityShowMenuAction,
-                                     nil];
-  }
-  return nil;
-
-  NS_OBJC_END_TRY_ABORT_BLOCK_NIL;
-}
-
-- (NSString *)accessibilityActionDescription:(NSString *)action
-{
-  NS_OBJC_BEGIN_TRY_ABORT_BLOCK_NIL;
-
-  if ([action isEqualToString:NSAccessibilityShowMenuAction])
-    return @"show menu";
-  if ([action isEqualToString:NSAccessibilityConfirmAction])
-    return @"confirm";
-    
-  return [super accessibilityActionDescription:action];
-
-  NS_OBJC_END_TRY_ABORT_BLOCK_NIL;
-}
-
-- (void)accessibilityPerformAction:(NSString *)action
-{
-  NS_OBJC_BEGIN_TRY_ABORT_BLOCK;
-
-  // both the ShowMenu and Click action do the same thing.
-  if ([self isEnabled]) {
-    if ([action isEqualToString:NSAccessibilityShowMenuAction])
-      [self showMenu];
-    if ([action isEqualToString:NSAccessibilityConfirmAction])
-      [self confirm];
-  }
-
-  NS_OBJC_END_TRY_ABORT_BLOCK;
-}
-
-- (void)showMenu
-{
-  // currently unimplemented. waiting for support in bug 363697
-}
-
-- (void)confirm
-{
-  // should be the same as pressing enter/return in this textfield.
-  // not yet implemented
-}
-
-@end
--- a/accessible/src/mac/nsAccessibleWrap.mm
+++ b/accessible/src/mac/nsAccessibleWrap.mm
@@ -105,19 +105,16 @@ nsAccessibleWrap::GetNativeType ()
     }
     
     case roles::PAGETAB:
       return [mozButtonAccessible class];
 
     case roles::CHECKBUTTON:
       return [mozCheckboxAccessible class];
       
-    case roles::AUTOCOMPLETE:
-      return [mozComboboxAccessible class];
-
     case roles::HEADING:
       return [mozHeadingAccessible class];
 
     case roles::PAGETABLIST:
       return [mozTabsAccessible class];
       
     case roles::ENTRY:
     case roles::STATICTEXT:
--- a/accessible/src/mac/nsRoleMap.h
+++ b/accessible/src/mac/nsRoleMap.h
@@ -137,17 +137,17 @@ static const NSString* AXRoles [] = {
   NSAccessibilityGroupRole,                     // ROLE_TEXT_CONTAINER
   NSAccessibilityButtonRole,                    // ROLE_TOGGLE_BUTTON
   NSAccessibilityTableRole,                     // ROLE_TREE_TABLE
   NSAccessibilityUnknownRole,                   // ROLE_VIEWPORT
   NSAccessibilityGroupRole,                     // ROLE_HEADER
   NSAccessibilityGroupRole,                     // ROLE_FOOTER
   NSAccessibilityGroupRole,                     // ROLE_PARAGRAPH
   @"AXRuler",                                   // ROLE_RULER. 10.4+ only, so we re-define the constant.
-  NSAccessibilityComboBoxRole,                  // ROLE_AUTOCOMPLETE
+  NSAccessibilityUnknownRole,                   // ROLE_AUTOCOMPLETE
   NSAccessibilityTextFieldRole,                 // ROLE_EDITBAR
   NSAccessibilityTextFieldRole,                 // ROLE_ENTRY
   NSAccessibilityStaticTextRole,                // ROLE_CAPTION
   NSAccessibilityScrollAreaRole,                // ROLE_DOCUMENT_FRAME
   @"AXHeading",                                 // ROLE_HEADING
   NSAccessibilityGroupRole,                     // ROLE_PAG
   NSAccessibilityGroupRole,                     // ROLE_SECTION
   NSAccessibilityUnknownRole,                   // ROLE_REDUNDANT_OBJECT
@@ -162,10 +162,11 @@ static const NSString* AXRoles [] = {
   NSAccessibilityRowRole,                       // ROLE_OPTION
   NSAccessibilityRowRole,                       // ROLE_RICH_OPTION
   NSAccessibilityListRole,                      // ROLE_LISTBOX
   NSAccessibilityUnknownRole,                   // ROLE_FLAT_EQUATION
   NSAccessibilityGroupRole,                     // ROLE_GRID_CELL
   NSAccessibilityGroupRole,                     // ROLE_EMBEDDED_OBJECT
   NSAccessibilityGroupRole,                     // ROLE_NOTE
   NSAccessibilityGroupRole,                     // ROLE_FIGURE
+  NSAccessibilityCheckBoxRole,                  // ROLE_CHECK_RICH_OPTION
   @"ROLE_LAST_ENTRY"                            // ROLE_LAST_ENTRY. bogus role that will never be shown (just marks the end of this array)!
 };
--- a/accessible/src/msaa/nsRoleMap.h
+++ b/accessible/src/msaa/nsRoleMap.h
@@ -444,12 +444,15 @@ static const WindowsRoleMapItem gWindows
   { USE_ROLE_STRING, IA2_ROLE_EMBEDDED_OBJECT },
 
   // roles::NOTE
   { USE_ROLE_STRING, IA2_ROLE_NOTE },
 
   // roles::FIGURE
   { ROLE_SYSTEM_GROUPING, ROLE_SYSTEM_GROUPING },
 
+  // roles::CHECK_RICH_OPTION
+  { ROLE_SYSTEM_CHECKBUTTON, ROLE_SYSTEM_CHECKBUTTON },
+
   // roles::LAST_ENTRY
   { ROLE_WINDOWS_LAST_ENTRY, ROLE_WINDOWS_LAST_ENTRY }
 };
 
--- a/accessible/src/xul/nsXULFormControlAccessible.cpp
+++ b/accessible/src/xul/nsXULFormControlAccessible.cpp
@@ -522,24 +522,16 @@ nsXULRadioButtonAccessible::NativeState(
     if (selected) {
       state |= states::CHECKED;
     }
   }
 
   return state;
 }
 
-void
-nsXULRadioButtonAccessible::GetPositionAndSizeInternal(PRInt32 *aPosInSet,
-                                                       PRInt32 *aSetSize)
-{
-  nsAccUtils::GetPositionAndSizeForXULSelectControlItem(mContent, aPosInSet,
-                                                        aSetSize);
-}
-
 ////////////////////////////////////////////////////////////////////////////////
 // nsXULRadioButtonAccessible: Widgets
 
 nsAccessible*
 nsXULRadioButtonAccessible::ContainerWidget() const
 {
   return mParent;
 }
--- a/accessible/src/xul/nsXULFormControlAccessible.h
+++ b/accessible/src/xul/nsXULFormControlAccessible.h
@@ -157,18 +157,16 @@ public:
  */
 class nsXULRadioButtonAccessible : public nsRadioButtonAccessible
 {
 
 public:
   nsXULRadioButtonAccessible(nsIContent* aContent, nsDocAccessible* aDoc);
 
   // nsAccessible
-  virtual void GetPositionAndSizeInternal(PRInt32 *aPosInSet,
-                                          PRInt32 *aSetSize);
   virtual PRUint64 NativeState();
 
   // Widgets
   virtual nsAccessible* ContainerWidget() const;
 };
 
 /**
  * Used for XUL radiogroup element.
--- a/accessible/src/xul/nsXULListboxAccessible.cpp
+++ b/accessible/src/xul/nsXULListboxAccessible.cpp
@@ -971,17 +971,17 @@ nsXULListitemAccessible::NativeRole()
     NS_ERROR("No list accessible for listitem accessible!");
     return roles::NOTHING;
   }
 
   if (list->Role() == roles::TABLE)
     return roles::ROW;
 
   if (mIsCheckbox)
-    return roles::CHECKBUTTON;
+    return roles::CHECK_RICH_OPTION;
 
   if (mParent && mParent->Role() == roles::COMBOBOX_LIST)
     return roles::COMBOBOX_OPTION;
 
   return roles::RICH_OPTION;
 }
 
 PRUint64
@@ -1026,24 +1026,16 @@ NS_IMETHODIMP nsXULListitemAccessible::G
 
 bool
 nsXULListitemAccessible::CanHaveAnonChildren()
 {
   // That indicates we should walk anonymous children for listitems
   return true;
 }
 
-void
-nsXULListitemAccessible::GetPositionAndSizeInternal(PRInt32 *aPosInSet,
-                                                    PRInt32 *aSetSize)
-{
-  nsAccUtils::GetPositionAndSizeForXULSelectControlItem(mContent, aPosInSet,
-                                                        aSetSize);
-}
-
 ////////////////////////////////////////////////////////////////////////////////
 // nsXULListitemAccessible: Widgets
 
 nsAccessible*
 nsXULListitemAccessible::ContainerWidget() const
 {
   return Parent();
 }
--- a/accessible/src/xul/nsXULListboxAccessible.h
+++ b/accessible/src/xul/nsXULListboxAccessible.h
@@ -134,18 +134,16 @@ public:
   NS_IMETHOD GetActionName(PRUint8 index, nsAString& aName);
   // Don't use XUL menuitems's description attribute
 
   // nsAccessible
   virtual void Description(nsString& aDesc);
   virtual nsresult GetNameInternal(nsAString& aName);
   virtual mozilla::a11y::role NativeRole();
   virtual PRUint64 NativeState();
-  virtual void GetPositionAndSizeInternal(PRInt32 *aPosInSet,
-                                          PRInt32 *aSetSize);
   virtual bool CanHaveAnonChildren();
 
   // Widgets
   virtual nsAccessible* ContainerWidget() const;
 
 protected:
   /**
    * Return listbox accessible for the listitem.
--- a/accessible/src/xul/nsXULTabAccessible.cpp
+++ b/accessible/src/xul/nsXULTabAccessible.cpp
@@ -159,24 +159,16 @@ nsXULTabAccessible::RelationByType(PRUin
   if (!tabpanelNode)
     return rel;
 
   nsCOMPtr<nsIContent> tabpanelContent(do_QueryInterface(tabpanelNode));
   rel.AppendTarget(tabpanelContent);
   return rel;
 }
 
-void
-nsXULTabAccessible::GetPositionAndSizeInternal(PRInt32 *aPosInSet,
-                                               PRInt32 *aSetSize)
-{
-  nsAccUtils::GetPositionAndSizeForXULSelectControlItem(mContent, aPosInSet,
-                                                        aSetSize);
-}
-
 
 ////////////////////////////////////////////////////////////////////////////////
 // nsXULTabsAccessible
 ////////////////////////////////////////////////////////////////////////////////
 
 nsXULTabsAccessible::
   nsXULTabsAccessible(nsIContent* aContent, nsDocAccessible* aDoc) :
   XULSelectControlAccessible(aContent, aDoc)
--- a/accessible/src/xul/nsXULTabAccessible.h
+++ b/accessible/src/xul/nsXULTabAccessible.h
@@ -54,18 +54,16 @@ public:
 
   nsXULTabAccessible(nsIContent* aContent, nsDocAccessible* aDoc);
 
   // nsIAccessible
   NS_IMETHOD GetActionName(PRUint8 aIndex, nsAString& aName);
   NS_IMETHOD DoAction(PRUint8 index);
 
   // nsAccessible
-  virtual void GetPositionAndSizeInternal(PRInt32 *aPosInSet,
-                                          PRInt32 *aSetSize);
   virtual mozilla::a11y::role NativeRole();
   virtual PRUint64 NativeState();
   virtual Relation RelationByType(PRUint32 aType);
 
   // ActionAccessible
   virtual PRUint8 ActionCount();
 };
 
--- a/accessible/src/xul/nsXULTreeAccessible.cpp
+++ b/accessible/src/xul/nsXULTreeAccessible.cpp
@@ -87,22 +87,26 @@ nsXULTreeAccessible::
 
 ////////////////////////////////////////////////////////////////////////////////
 // nsXULTreeAccessible: nsISupports and cycle collection implementation
 
 NS_IMPL_CYCLE_COLLECTION_CLASS(nsXULTreeAccessible)
 
 NS_IMPL_CYCLE_COLLECTION_TRAVERSE_BEGIN_INHERITED(nsXULTreeAccessible,
                                                   nsAccessible)
-CycleCollectorTraverseCache(tmp->mAccessibleCache, &cb);
+  NS_IMPL_CYCLE_COLLECTION_TRAVERSE_NSCOMPTR(mTree)
+  NS_IMPL_CYCLE_COLLECTION_TRAVERSE_NSCOMPTR(mTreeView)
+  CycleCollectorTraverseCache(tmp->mAccessibleCache, &cb);
 NS_IMPL_CYCLE_COLLECTION_TRAVERSE_END
 
 NS_IMPL_CYCLE_COLLECTION_UNLINK_BEGIN_INHERITED(nsXULTreeAccessible,
                                                 nsAccessible)
-ClearCache(tmp->mAccessibleCache);
+  NS_IMPL_CYCLE_COLLECTION_UNLINK_NSCOMPTR(mTree)
+  NS_IMPL_CYCLE_COLLECTION_UNLINK_NSCOMPTR(mTreeView)
+  ClearCache(tmp->mAccessibleCache);
 NS_IMPL_CYCLE_COLLECTION_UNLINK_END
 
 NS_INTERFACE_MAP_BEGIN_CYCLE_COLLECTION_INHERITED(nsXULTreeAccessible)
 NS_INTERFACE_MAP_STATIC_AMBIGUOUS(nsXULTreeAccessible)
 NS_INTERFACE_MAP_END_INHERITING(nsAccessible)
 
 NS_IMPL_ADDREF_INHERITED(nsXULTreeAccessible, nsAccessible)
 NS_IMPL_RELEASE_INHERITED(nsXULTreeAccessible, nsAccessible)
@@ -220,20 +224,20 @@ nsXULTreeAccessible::ChildAtPoint(PRInt3
     return nsnull;
 
   nsPresContext *presContext = frame->PresContext();
   nsCOMPtr<nsIPresShell> presShell = presContext->PresShell();
 
   nsIFrame *rootFrame = presShell->GetRootFrame();
   NS_ENSURE_TRUE(rootFrame, nsnull);
 
-  nsIntRect rootRect = rootFrame->GetScreenRectExternal();
+  nsIntRect rootRect = rootFrame->GetScreenRect();
 
-  PRInt32 clientX = presContext->DevPixelsToIntCSSPixels(aX - rootRect.x);
-  PRInt32 clientY = presContext->DevPixelsToIntCSSPixels(aY - rootRect.y);
+  PRInt32 clientX = presContext->DevPixelsToIntCSSPixels(aX) - rootRect.x;
+  PRInt32 clientY = presContext->DevPixelsToIntCSSPixels(aY) - rootRect.y;
 
   PRInt32 row = -1;
   nsCOMPtr<nsITreeColumn> column;
   nsCAutoString childEltUnused;
   mTree->GetCellAt(clientX, clientY, &row, getter_AddRefs(column),
                    childEltUnused);
 
   // If we failed to find tree cell for the given point then it might be
--- a/accessible/src/xul/nsXULTreeGridAccessible.cpp
+++ b/accessible/src/xul/nsXULTreeGridAccessible.cpp
@@ -701,20 +701,20 @@ nsXULTreeGridRowAccessible::ChildAtPoint
     return nsnull;
 
   nsPresContext *presContext = frame->PresContext();
   nsCOMPtr<nsIPresShell> presShell = presContext->PresShell();
 
   nsIFrame *rootFrame = presShell->GetRootFrame();
   NS_ENSURE_TRUE(rootFrame, nsnull);
 
-  nsIntRect rootRect = rootFrame->GetScreenRectExternal();
+  nsIntRect rootRect = rootFrame->GetScreenRect();
 
-  PRInt32 clientX = presContext->DevPixelsToIntCSSPixels(aX - rootRect.x);
-  PRInt32 clientY = presContext->DevPixelsToIntCSSPixels(aY - rootRect.y);
+  PRInt32 clientX = presContext->DevPixelsToIntCSSPixels(aX) - rootRect.x;
+  PRInt32 clientY = presContext->DevPixelsToIntCSSPixels(aY) - rootRect.y;
 
   PRInt32 row = -1;
   nsCOMPtr<nsITreeColumn> column;
   nsCAutoString childEltUnused;
   mTree->GetCellAt(clientX, clientY, &row, getter_AddRefs(column),
                    childEltUnused);
 
   // Return if we failed to find tree cell in the row for the given point.
--- a/accessible/tests/mochitest/actions/test_tree.xul
+++ b/accessible/tests/mochitest/actions/test_tree.xul
@@ -38,17 +38,17 @@
     }
 
     ////////////////////////////////////////////////////////////////////////////
     // Test
 
     // gA11yEventDumpID = "debug";
     //gA11yEventDumpToConsole = true; // debug
 
-    function doTestActions()
+    function doTest()
     {
       var treeNode = getNode("tree");
 
       var treeBodyNode = treeNode.boxObject.treeBody;
 
       var tree = getAccessible(treeNode);
       var expandedTreeItem = tree.getChildAt(2);
       var collapsedTreeItem = tree.getChildAt(5);
@@ -86,25 +86,18 @@
             testStates(this.ID, STATE_COLLAPSED);
           }
         }
       ];
 
       testActions(actions); // Will call SimpleTest.finish();
     }
 
-    function doTest()
-    {
-      var treeNode = getNode("tree");
-      waitForEvent(EVENT_REORDER, treeNode, doTestActions);
-      treeNode.view = new nsTreeTreeView();
-    }
-
     SimpleTest.waitForExplicitFinish();
-    addA11yLoadEvent(doTest);
+    addA11yXULTreeLoadEvent(doTest, "tree", new nsTreeTreeView());
   ]]>
   </script>
 
   <hbox flex="1" style="overflow: auto;">
     <body xmlns="http://www.w3.org/1999/xhtml">
       <a target="_blank"
          href="https://bugzilla.mozilla.org/show_bug.cgi?id=503727"
          title="Reorganize implementation of XUL tree accessibility">
--- a/accessible/tests/mochitest/attributes/test_obj.html
+++ b/accessible/tests/mochitest/attributes/test_obj.html
@@ -100,16 +100,20 @@ https://bugzilla.mozilla.org/show_bug.cg
       if (WIN) {
         var gfxInfo = Components.classes["@mozilla.org/gfx/info;1"].
           getService(Components.interfaces.nsIGfxInfo);
         var attrs = {
           "D2D": (gfxInfo.D2DEnabled ? "true" : "false")
         }
         testAttrs(getApplicationAccessible(), attrs, false);
       }
+
+      // no object attributes
+      testAbsentAttrs(getAccessible("listitem").firstChild, { "tag": "" });
+
       SimpleTest.finish();
     }
 
     SimpleTest.waitForExplicitFinish();
     addA11yLoadEvent(doTest);
   </script>
 </head>
 <body>
@@ -188,10 +192,14 @@ https://bugzilla.mozilla.org/show_bug.cg
   <input id="checkbox" type="checkbox"/>
   <div id="draggable" draggable="true">Draggable div</div>
   <table>
     <tr>
       <th id="th1"><abbr title="Social Security Number">SS#</abbr></th>
       <th id="th2" abbr="SS#" axis="social">Social Security Number</th>
     </tr>
   </table>
+
+  <ul>
+    <li id="listitem">item
+  </ul>
 </body>
 </html>
--- a/accessible/tests/mochitest/attributes/test_obj_css.html
+++ b/accessible/tests/mochitest/attributes/test_obj_css.html
@@ -1,28 +1,52 @@
 <html>
-<!--
-https://bugzilla.mozilla.org/show_bug.cgi?id=439566
-https://bugzilla.mozilla.org/show_bug.cgi?id=460932
-https://bugzilla.mozilla.org/show_bug.cgi?id=689540
--->
 <head>
   <title>CSS-like attributes tests</title>
   <link rel="stylesheet" type="text/css"
         href="chrome://mochikit/content/tests/SimpleTest/test.css" />
 
   <script type="application/javascript"
           src="chrome://mochikit/content/tests/SimpleTest/SimpleTest.js"></script>
 
   <script type="application/javascript"
           src="../common.js"></script>
   <script type="application/javascript"
           src="../attributes.js"></script>
+  <script type="application/javascript"
+          src="../events.js"></script>
 
   <script type="application/javascript">
+    var gQueue = null;
+
+    function removeElm(aID)
+    {
+      this.node = getNode(aID);
+      this.accessible = getAccessible(aID);
+
+      this.eventSeq = [
+        new invokerChecker(EVENT_HIDE, this.accessible)
+      ];
+
+      this.invoke = function removeElm_invoke()
+      {
+        this.node.parentNode.removeChild(this.node);
+      }
+
+      this.check = function removeElm_check()
+      {
+        testAbsentCSSAttrs(this.accessible);
+      }
+
+      this.getID = function removeElm_getID()
+      {
+        return "test CSS-based attributes on removed accessible";
+      }
+    }
+
     function doTest()
     {
       // CSS display
       testCSSAttrs("display_block");
       testCSSAttrs("display_inline");
       testCSSAttrs("display_inline-block");
       testCSSAttrs("display_list-item");
       testCSSAttrs("display_table");
@@ -80,17 +104,19 @@ https://bugzilla.mozilla.org/show_bug.cg
       testCSSAttrs("input");
       testCSSAttrs("table");
       testCSSAttrs("tr");
       testCSSAttrs("td");
 
       // no CSS-based object attributes
       testAbsentCSSAttrs(getAccessible("listitem").firstChild);
 
-      SimpleTest.finish();
+      gQueue = new eventQueue();
+      gQueue.push(new removeElm("div"));
+      gQueue.invoke(); // SimpleTest.finish();
     }
 
     SimpleTest.waitForExplicitFinish();
     addA11yLoadEvent(doTest);
   </script>
 </head>
 <body>
 
--- a/accessible/tests/mochitest/attributes/test_obj_group.xul
+++ b/accessible/tests/mochitest/attributes/test_obj_group.xul
@@ -72,18 +72,20 @@
 
     //gA11yEventDumpToConsole = true; // debug stuff
 
     var gQueue = null;
     function doTest()
     {
       //////////////////////////////////////////////////////////////////////////
       // xul:listbox (bug 417317)
-      testGroupAttrs("item1", 1, 2);
-      testGroupAttrs("item2", 2, 2);
+      testGroupAttrs("listitem1", 1, 4);
+      testGroupAttrs("listitem2", 2, 4);
+      testGroupAttrs("listitem3", 3, 4);
+      testGroupAttrs("listitem4", 4, 4);
 
       //////////////////////////////////////////////////////////////////////////
       // xul:tab
       testGroupAttrs("tab1", 1, 2);
       testGroupAttrs("tab2", 2, 2);
 
       //////////////////////////////////////////////////////////////////////////
       // xul:radio
@@ -138,19 +140,22 @@
     <p id="display"></p>
     <div id="content" style="display: none">
     </div>
     <pre id="test">
     </pre>
   </body>
 
   <vbox flex="1">
+
   <listbox>
-    <listitem label="item1" id="item1"/>
-    <listitem label="item2" id="item2"/>
+    <listitem label="listitem1" id="listitem1"/>
+    <listitem label="listitem2" id="listitem2" type="checkbox"/>
+    <listitem label="listitem3" id="listitem3" type="checkbox"/>
+    <listitem label="listitem4" id="listitem4"/>
   </listbox>
 
   <menubar>
     <menu label="item1" id="menu_item1">
       <menupopup>
         <menuitem label="item1.1" id="menu_item1.1"/>
         <menuseparator/>
         <menuitem label="item1.2" id="menu_item1.2"/>
--- a/accessible/tests/mochitest/attributes/test_obj_group_tree.xul
+++ b/accessible/tests/mochitest/attributes/test_obj_group_tree.xul
@@ -19,17 +19,17 @@
   <script type="application/javascript"
           src="../events.js" />
 
   <script type="application/javascript">
   <![CDATA[
     ////////////////////////////////////////////////////////////////////////////
     // Test
 
-    function doTestAttrs()
+    function doTest()
     {
       var treeNode = getNode("tree");
 
       var tree = getAccessible(treeNode);
       var treeitem1 = tree.firstChild.nextSibling;
       testGroupAttrs(treeitem1, 1, 4, 1);
 
       var treeitem2 = treeitem1.nextSibling;
@@ -45,25 +45,18 @@
       testGroupAttrs(treeitem5, 3, 4, 1);
 
       var treeitem6 = treeitem5.nextSibling;
       testGroupAttrs(treeitem6, 4, 4, 1);
 
       SimpleTest.finish();
     }
 
-    function doTest()
-    {
-      var treeNode = getNode("tree");
-      waitForEvent(EVENT_REORDER, treeNode, doTestAttrs);
-      treeNode.view = new nsTreeTreeView();
-    }
-
     SimpleTest.waitForExplicitFinish();
-    addA11yLoadEvent(doTest);
+    addA11yXULTreeLoadEvent(doTest, "tree", new nsTreeTreeView());
   ]]>
   </script>
 
   <hbox flex="1" style="overflow: auto;">
     <body xmlns="http://www.w3.org/1999/xhtml">
       <a target="_blank"
          href="https://bugzilla.mozilla.org/show_bug.cgi?id=503727"
          title="Reorganize implementation of XUL tree accessibility">
--- a/accessible/tests/mochitest/bounds/test_zoom.html
+++ b/accessible/tests/mochitest/bounds/test_zoom.html
@@ -2,48 +2,68 @@
 <html>
 <head>
   <title>Accessible boundaries when page is zoomed</title>
   <link rel="stylesheet" type="text/css"
         href="chrome://mochikit/content/tests/SimpleTest/test.css" />
 
   <script type="application/javascript"
           src="chrome://mochikit/content/tests/SimpleTest/SimpleTest.js"></script>
+  <script type="application/javascript"
+          src="chrome://mochikit/content/tests/SimpleTest/EventUtils.js"></script>
 
   <script type="application/javascript"
           src="../common.js"></script>
   <script type="application/javascript"
           src="../role.js"></script>
   <script type="application/javascript"
           src="../layout.js"></script>
   <script type="application/javascript"
           src="../browser.js"></script>
 
   <script type="application/javascript">
     function doTest()
     {
       var tabDocument = currentTabDocument();
-      var p1 = tabDocument.body.firstElementChild;
-      var p2 = tabDocument.body.lastElementChild;
+      var p1 = tabDocument.getElementById("p1");
+      var p2 = tabDocument.getElementById("p2");
+
+      var imgMap = tabDocument.getElementById("imgmap");
+      ensureImageMapTree(imgMap);
+      var imgMapAcc = getAccessible(imgMap);
+      var area = imgMapAcc.firstChild;
 
       testBounds(p1);
       testBounds(p2);
+      testBounds(area);
 
       zoomDocument(tabDocument, 2.0);
 
       testBounds(p1);
       testBounds(p2);
+      testBounds(area);
 
       closeBrowserWindow();
       SimpleTest.finish();
     }
 
+    var url = "data:text/html,<html><body>";
+    url += "<p id='p1'>para 1</p><p id='p2'>para 2</p>";
+    url += "<map name='atoz_map' id='map'>";
+    url += "  <area id='area1' href='http%3A%2F%2Fmozilla.org'";
+    url += "        coords=17,0,30,14' alt='mozilla.org' shape='rect'>";
+    url += "</map>";
+    url += "<img id='imgmap' width='447' height='15'";
+    url += "     usemap='%23atoz_map'";
+    url += "     src='chrome%3A%2F%2Fmochitests%2Fcontent%2Fa11y%2Faccessible%2Fletters.gif'>";
+    url += "</body></html>";
+
     SimpleTest.waitForExplicitFinish();
     openBrowserWindow(doTest,
-                      "data:text/html,<html><body><p>para 1</p><p>para 2</p></body></html>",
+                      url,
                       { left: 0, top: 0, width: 600, height: 600 });
   </script>
 </head>
 <body>
 
   <a target="_blank"
      href="https://bugzilla.mozilla.org/show_bug.cgi?id=650241"
      title="Location returned by accessibles incorrect when page zoomed">
--- a/accessible/tests/mochitest/browser.js
+++ b/accessible/tests/mochitest/browser.js
@@ -93,31 +93,16 @@ function urlbarInput()
 /**
  * Return reload button.
  */
 function reloadButton()
 {
   return browserWindow().document.getElementById("urlbar-reload-button");
 }
 
-/**
- * Zoom the given document.
- */
-function zoomDocument(aDocument, aZoom)
-{
-  var docShell = aDocument.defaultView.
-    QueryInterface(Components.interfaces.nsIInterfaceRequestor).
-    getInterface(Components.interfaces.nsIWebNavigation).
-    QueryInterface(Components.interfaces.nsIDocShell);
-  var docViewer = docShell.contentViewer.
-    QueryInterface(Components.interfaces.nsIMarkupDocumentViewer);
-
-  docViewer.fullZoom = aZoom;
-}
-
 ////////////////////////////////////////////////////////////////////////////////
 // private section
 
 Components.utils.import("resource://gre/modules/Services.jsm");
 
 var gBrowserContext =
 {
   browserWnd: null,
--- a/accessible/tests/mochitest/common.js
+++ b/accessible/tests/mochitest/common.js
@@ -110,16 +110,31 @@ function addA11yLoadEvent(aFunc, aWindow
       },
       0
     );
   }
 
   SimpleTest.waitForFocus(waitForDocLoad, aWindow);
 }
 
+/**
+ * Analogy of SimpleTest.is function used to compare objects.
+ */
+function isObject(aObj, aExpectedObj, aMsg)
+{
+  if (aObj == aExpectedObj) {
+    ok(true, aMsg);
+    return;
+  }
+
+  ok(false,
+     aMsg + " - got '" + prettyName(aObj) +
+            "', expected '" + prettyName(aExpectedObj) + "'");
+}
+
 ////////////////////////////////////////////////////////////////////////////////
 // Helpers for getting DOM node/accessible
 
 /**
  * Return the DOM node by identifier (may be accessible, DOM node or ID).
  */
 function getNode(aAccOrNodeOrID)
 {
@@ -489,17 +504,19 @@ function testDefunctAccessible(aAcc, aNo
 /**
  * Ensure that image map accessible tree is created.
  */
 function ensureImageMapTree(aID)
 {
   // XXX: We send a useless mouse move to the image to force it to setup its
   // image map, because flushing layout won't do it. Hopefully bug 135040
   // will make this not suck.
-  synthesizeMouse(getNode(aID), 10, 10, { type: "mousemove" });
+  var image = getNode(aID);
+  synthesizeMouse(image, 10, 10, { type: "mousemove" },
+                  image.ownerDocument.defaultView);
 
   // XXX This may affect a11y more than other code because imagemaps may not
   // get drawn or have an mouse event over them. Bug 570322 tracks a11y
   // dealing with this.
   todo(false, "Need to remove this image map workaround.");
 }
 
 /**
--- a/accessible/tests/mochitest/elm/test_landmarks.html
+++ b/accessible/tests/mochitest/elm/test_landmarks.html
@@ -29,22 +29,22 @@
 
       // Some AT may look for this
       testAttrs("nav", {"xml-roles" : "navigation"}, true);
       testAttrs("footer", {"xml-roles" : "contentinfo"}, true);
       testAttrs("aside", {"xml-roles" : "complementary"}, true);
       testAttrs("main", {"xml-roles" : "main"}, true); // ARIA override
 
       // And some AT may look for this
-      testAttrs("nav", {"tag" : "NAV"}, true);
-      testAttrs("header", {"tag" : "HEADER"}, true);
-      testAttrs("footer", {"tag" : "FOOTER"}, true);
-      testAttrs("article", {"tag" : "ARTICLE"}, true);
-      testAttrs("aside", {"tag" : "ASIDE"}, true);
-      testAttrs("main", {"tag" : "ARTICLE"}, true); // no override expected
+      testAttrs("nav", {"tag" : "nav"}, true);
+      testAttrs("header", {"tag" : "header"}, true);
+      testAttrs("footer", {"tag" : "footer"}, true);
+      testAttrs("article", {"tag" : "article"}, true);
+      testAttrs("aside", {"tag" : "aside"}, true);
+      testAttrs("main", {"tag" : "article"}, true); // no override expected
 
       SimpleTest.finish();
     }
 
     SimpleTest.waitForExplicitFinish();
     addA11yLoadEvent(doTest);
   </script>
 </head>
--- a/accessible/tests/mochitest/events/test_focus_tree.xul
+++ b/accessible/tests/mochitest/events/test_focus_tree.xul
@@ -24,33 +24,16 @@
           src="../events.js" />
 
   <script type="application/javascript">
   <![CDATA[
 
     ////////////////////////////////////////////////////////////////////////////
     // Invokers
 
-    function setTreeView(aTreeID, aView)
-    {
-      this.DOMNode = getNode(aTreeID);
-
-      this.eventSeq = [
-        new invokerChecker(EVENT_REORDER, this.DOMNode)
-      ];
-
-      this.invoke = function setTreeView_invoke()
-      {
-        this.DOMNode.treeBoxObject.view = aView;
-      }
-
-      this.getID = function setTreeView_getID()
-        { return "set tree view for " + prettyName(aTreeID); }
-    };
-
     function focusTree(aTreeID)
     {
       var checker = new focusChecker(getFirstTreeItem, aTreeID);
       this.__proto__ = new synthFocus(aTreeID, [ checker ]);
     }
 
     function moveToNextItem(aTreeID)
     {
@@ -77,29 +60,28 @@
 
     //gA11yEventDumpID = "debug"; // debugging
     //gA11yEventDumpToConsole = true; // debugging
 
     function doTest()
     {
       gQueue = new eventQueue();
 
-      gQueue.push(new setTreeView("tree", new nsTableTreeView(5)));
       gQueue.push(new focusTree("tree"));
       gQueue.push(new moveToNextItem("tree"));
       gQueue.push(new synthFocus("emptytree"));
 
       // no focus event for changed current item for unfocused tree
       gQueue.push(new changeCurrentItem("tree", 0));
 
       gQueue.invoke();
     }
 
     SimpleTest.waitForExplicitFinish();
-    addA11yLoadEvent(doTest);
+    addA11yXULTreeLoadEvent(doTest, "tree", new nsTableTreeView(5));
   ]]>
   </script>
 
   <hbox flex="1" style="overflow: auto;">
     <body xmlns="http://www.w3.org/1999/xhtml">
       <a target="_blank"
          href="https://bugzilla.mozilla.org/show_bug.cgi?id=386821"
          title="Need better solution for firing delayed event against xul tree">
--- a/accessible/tests/mochitest/focus/test_takeFocus.xul
+++ b/accessible/tests/mochitest/focus/test_takeFocus.xul
@@ -21,33 +21,16 @@
   <script type="application/javascript"
           src="../treeview.js" />
 
   <script type="application/javascript">
   <![CDATA[
     ////////////////////////////////////////////////////////////////////////////
     // Invokers
 
-    function setTreeView(aTreeID, aView)
-    {
-      this.DOMNode = getNode(aTreeID);
-
-      this.eventSeq = [
-        new invokerChecker(EVENT_REORDER, this.DOMNode)
-      ];
-
-      this.invoke = function setTreeView_invoke()
-      {
-        this.DOMNode.treeBoxObject.view = aView;
-      }
-
-      this.getID = function setTreeView_getID()
-        { return "set tree view for " + prettyName(aTreeID); }
-    };
-
     function takeFocusInvoker(aID, aArgConverterFunc)
     {
       this.targetFunc = aArgConverterFunc ? aArgConverterFunc : getAccessible;
 
       this.eventSeq = [ new focusChecker(this.targetFunc, aID) ];
 
       this.invoke = function takeFocusInvoker_invoke()
       {
@@ -72,25 +55,24 @@
     //gA11yEventDumpToConsole = true; // debug stuff
 
     var gQueue = null;
     function doTests()
     {
       // Test focus events.
       gQueue = new eventQueue();
 
-      gQueue.push(new setTreeView("tree", new nsTableTreeView(5)));
       gQueue.push(new takeFocusInvoker("tree", getLastChild));
       gQueue.push(new takeFocusInvoker("listitem2"));
 
       gQueue.invoke(); // Will call SimpleTest.finish();
     }
 
     SimpleTest.waitForExplicitFinish();
-    addA11yLoadEvent(doTests);
+    addA11yXULTreeLoadEvent(doTests, "tree", new nsTableTreeView(5));
   ]]>
   </script>
 
   <hbox flex="1" style="overflow: auto;">
     <body xmlns="http://www.w3.org/1999/xhtml">
       <a target="_blank"
          href="https://bugzilla.mozilla.org/show_bug.cgi?id=706067"
          title="Make takeFocus work on widget items">
--- a/accessible/tests/mochitest/hittest/Makefile.in
+++ b/accessible/tests/mochitest/hittest/Makefile.in
@@ -43,14 +43,15 @@ VPATH		= @srcdir@
 relativesrcdir  = accessible/hittest
 
 include $(DEPTH)/config/autoconf.mk
 include $(topsrcdir)/config/rules.mk
 
 _TEST_FILES = \
 		test_browser.html \
 		test_general.html \
-		test_general.xul \
+		test_zoom_tree.xul \
 		test_zoom.html \
+		zoom_tree.xul \
 		$(NULL)
 
 libs:: $(_TEST_FILES)
 	$(INSTALL) $(foreach f,$^,"$f") $(DEPTH)/_tests/testing/mochitest/a11y/$(relativesrcdir)
--- a/accessible/tests/mochitest/hittest/test_general.html
+++ b/accessible/tests/mochitest/hittest/test_general.html
@@ -14,53 +14,46 @@
 
   <script type="application/javascript">
     function doTest()
     {
       // Not specific case, child and deepchild testing.
       var list = getAccessible("list");
       var listitem = getAccessible("listitem");
       var image = getAccessible("image");
-      testChildAtPoint(list, 1, 1, false, listitem);
-      testChildAtPoint(list, 1, 1, true, image.firstChild);
+      testChildAtPoint(list, 1, 1, listitem, image.firstChild);
 
       // ::MustPrune case (in this case childAtPoint doesn't look inside a
       // textbox), point is inside of textbox.
       var txt = getAccessible("txt");
-      testChildAtPoint(txt, 1, 1, false, txt);
-      testChildAtPoint(txt, 1, 1, true, txt);
+      testChildAtPoint(txt, 1, 1, txt, txt);
 
       // ::MustPrune case, point is outside of textbox accessible but is in
       // document.
-      testChildAtPoint(txt, -1, 1, false, null);
-      testChildAtPoint(txt, -1, 1, true, null);
+      testChildAtPoint(txt, -1, 1, null, null);
 
       // ::MustPrune case, point is outside of root accessible.
-      testChildAtPoint(txt, -10000, 10000, false, null);
-      testChildAtPoint(txt, -10000, 10000, true, null);
+      testChildAtPoint(txt, -10000, 10000, null, null);
 
       // Not specific case, point is inside of btn accessible.
       var btn = getAccessible("btn");
       var btnText = btn.firstChild;
-      testChildAtPoint(btn, 1, 1, false, btnText);
-      testChildAtPoint(btn, 1, 1, true, btnText);
+      testChildAtPoint(btn, 1, 1, btnText, btnText);
   
       // Not specific case, point is outside of btn accessible.
-      testChildAtPoint(btn, -1, 1, false, null);
-      testChildAtPoint(btn, -1, 1, true, null);
+      testChildAtPoint(btn, -1, 1, null, null);
 
       // Out of flow accessible testing, do not return out of flow accessible
       // because it's not a child of the accessible even visually it is.
       var rectArea = getNode("area").getBoundingClientRect();
       var outOfFlow = getNode("outofflow");
       outOfFlow.style.left = rectArea.left + "px";
       outOfFlow.style.top = rectArea.top + "px";
 
-      testChildAtPoint("area", 1, 1, false, "area");
-      testChildAtPoint("area", 1, 1, true, "area");
+      testChildAtPoint("area", 1, 1, "area", "area");
 
       SimpleTest.finish();
     }
 
     SimpleTest.waitForExplicitFinish();
     addA11yLoadEvent(doTest);
   </script>
 </head>
rename from accessible/tests/mochitest/hittest/test_general.xul
rename to accessible/tests/mochitest/hittest/test_zoom_tree.xul
--- a/accessible/tests/mochitest/hittest/test_general.xul
+++ b/accessible/tests/mochitest/hittest/test_zoom_tree.xul
@@ -10,62 +10,92 @@
           src="chrome://mochikit/content/tests/SimpleTest/SimpleTest.js" />
 
   <script type="application/javascript"
           src="../treeview.js" />
 
   <script type="application/javascript"
           src="../common.js" />
   <script type="application/javascript"
+          src="../events.js" />
+  <script type="application/javascript"
           src="../layout.js" />
+  <script type="application/javascript"
+          src="../browser.js" />
 
   <script type="application/javascript">
   <![CDATA[
     function doTest()
     {
-      // Initialize the tree
-      var view = new nsTableTreeView(5);
+      var tabDocument = currentTabDocument();
+      var tabWindow = currentTabWindow();
+
+      var tree = tabDocument.getElementById("tree");
+      var treecols = tabDocument.getElementById("treecols");
+      var treecol1 = tabDocument.getElementById("treecol1");
 
-      var tree = getNode("tree");
-      var treeBox = tree.treeBoxObject;
-      treeBox.view = view;
+      // tree columns
+      hitTest(tree, treecols, treecol1);
+
+      // tree rows and cells
+      var treeBoxObject = tree.treeBoxObject;
+      var treeBodyBoxObj = tree.treeBoxObject.treeBody.boxObject;
+      var xObj = {}, yObj = {}, widthObj = {}, heightObj = {};
+      treeBoxObject.getCoordsForCellItem(1, tree.columns[0], "cell",
+                                         xObj, yObj, widthObj, heightObj);
 
-      // Tests
-      var treecols = getNode("treecols");
-      var x = treecols.boxObject.x;
-      var y = treecols.boxObject.y;
+      var treeAcc = getAccessible(tree, [nsIAccessibleTable]);
+      var cellAcc = treeAcc.getCellAt(1, 0);
+      var rowAcc = cellAcc.parent;
+
+      var cssX = xObj.value + treeBodyBoxObj.x;
+      var cssY = yObj.value + treeBodyBoxObj.y;
+      var [x, y] = CSSToDevicePixels(tabWindow, cssX, cssY);
+
+      testChildAtPoint(treeAcc, x, y, rowAcc, cellAcc);
+      testChildAtPoint(rowAcc, x, y, cellAcc, cellAcc);
 
-      testChildAtPoint(tree, x, y, false, treecols);
-      testChildAtPoint(tree, x, y, true, "col1");
+      // do zoom
+      zoomDocument(tabDocument, 1.5);
+
+      // tree columns
+      hitTest(tree, treecols, treecol1);
 
+      // tree rows and cells
+      var [x, y] = CSSToDevicePixels(tabWindow, cssX, cssY);
+      testChildAtPoint(treeAcc, x, y, rowAcc, cellAcc);
+      testChildAtPoint(rowAcc, x, y, cellAcc, cellAcc);
+
+      closeBrowserWindow();
       SimpleTest.finish();
     }
 
+    function prepareTest()
+    {
+      var tabDocument = currentTabDocument();
+      var tree = tabDocument.getElementById("tree");
+      loadXULTreeAndDoTest(doTest, tree, new nsTableTreeView(5));
+    }
+
     SimpleTest.waitForExplicitFinish();
-    addA11yLoadEvent(doTest);
+    openBrowserWindow(prepareTest,
+                      "chrome://mochitests/content/a11y/accessible/hittest/zoom_tree.xul",
+                      { left: 100, top: 100 });
   ]]>
   </script>
 
   <hbox flex="1" style="overflow: auto;">
     <body xmlns="http://www.w3.org/1999/xhtml">
       <a target="_blank"
          href="https://bugzilla.mozilla.org/show_bug.cgi?id=471493"
          title=" crash [@ nsPropertyTable::GetPropertyInternal]">
         Mozilla Bug 471493
       </a><br/>
       <p id="display"></p>
       <div id="content" style="display: none">
       </div>
       <pre id="test">
       </pre>
     </body>
-
-    <tree id="tree" flex="1">
-      <treecols id="treecols">
-        <treecol id="col1" flex="1" primary="true" label="column"/>
-        <treecol id="col2" flex="1" label="column 2"/>
-      </treecols>
-      <treechildren id="treechildren"/>
-    </tree>
   </hbox>
 
 </window>
 
new file mode 100644
--- /dev/null
+++ b/accessible/tests/mochitest/hittest/zoom_tree.xul
@@ -0,0 +1,18 @@
+<?xml version="1.0"?>
+<?xml-stylesheet href="chrome://global/skin" type="text/css"?>
+<?xml-stylesheet href="chrome://mochikit/content/tests/SimpleTest/test.css"
+                 type="text/css"?>
+
+<window xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul"
+        title="nsIAccessible::getChildAtPoint and getDeepestChildAtPoint for XUL trees">
+
+  <tree id="tree" flex="1">
+    <treecols id="treecols">
+      <treecol id="treecol1" flex="1" primary="true" label="column"/>
+      <treecol id="treecol2" flex="1" label="column 2"/>
+    </treecols>
+    <treechildren id="treechildren"/>
+  </tree>
+
+</window>
+
--- a/accessible/tests/mochitest/layout.js
+++ b/accessible/tests/mochitest/layout.js
@@ -1,53 +1,69 @@
 /**
- * Tests if the given accessible at the given point is expected.
+ * Tests if the given child and grand child accessibles at the given point are
+ * expected.
  *
- * @param aIdentifier        [in] accessible identifier
- * @param aX                 [in] x coordinate of the point relative accessible
- * @param aY                 [in] y coordinate of the point relative accessible
- * @param aFindDeepestChild  [in] points whether deepest or nearest child should
- *                           be returned
- * @param aChildIdentifier   [in] expected child accessible
+ * @param aID            [in] accessible identifier
+ * @param aX             [in] x coordinate of the point relative accessible
+ * @param aY             [in] y coordinate of the point relative accessible
+ * @param aChildID       [in] expected child accessible
+ * @param aGrandChildID  [in] expected child accessible
  */
-function testChildAtPoint(aIdentifier, aX, aY, aFindDeepestChild,
-                          aChildIdentifier)
+function testChildAtPoint(aID, aX, aY, aChildID, aGrandChildID)
 {
-  var childAcc = getAccessible(aChildIdentifier);
-  var actualChildAcc = getChildAtPoint(aIdentifier, aX, aY, aFindDeepestChild);
+  var child = getChildAtPoint(aID, aX, aY, false);
+  var expectedChild = getAccessible(aChildID);
 
-  var msg = "Wrong " + (aFindDeepestChild ? "deepest" : "direct");
-  msg += " child accessible [" + prettyName(actualChildAcc);
-  msg += "] at the point (" + aX + ", " + aY + ") of accessible [";
-  msg += prettyName(aIdentifier) + "]";
+  var msg = "Wrong direct child accessible at the point (" + aX + ", " + aY +
+    ") of " + prettyName(aID);
+  isObject(child, expectedChild, msg);
 
-  is(childAcc, actualChildAcc, msg);
+  var grandChild = getChildAtPoint(aID, aX, aY, true);
+  var expectedGrandChild = getAccessible(aGrandChildID);
+
+  msg = "Wrong deepest child accessible at the point (" + aX + ", " + aY +
+    ") of " + prettyName(aID);
+  isObject(grandChild, expectedGrandChild, msg);
 }
 
 /**
  * Test if getChildAtPoint returns the given child and grand child accessibles
  * at coordinates of child accessible (direct and deep hit test).
  */
 function hitTest(aContainerID, aChildID, aGrandChildID)
 {
   var container = getAccessible(aContainerID);
   var child = getAccessible(aChildID);
   var grandChild = getAccessible(aGrandChildID);
 
   var [x, y] = getBoundsForDOMElm(child);
 
   var actualChild = container.getChildAtPoint(x + 1, y + 1);
-  is(actualChild, child,
-     "Wrong child, expected: " + prettyName(child) +
-     ", got: " + prettyName(actualChild));
+  isObject(actualChild, child,
+           "Wrong direct child of " + prettyName(aContainerID));
 
   var actualGrandChild = container.getDeepestChildAtPoint(x + 1, y + 1);
-  is(actualGrandChild, grandChild,
-     "Wrong deepest child, expected: " + prettyName(grandChild) +
-     ", got: " + prettyName(actualGrandChild));
+  isObject(actualGrandChild, grandChild,
+           "Wrong deepest child of " + prettyName(aContainerID));
+}
+
+/**
+ * Zoom the given document.
+ */
+function zoomDocument(aDocument, aZoom)
+{
+  var docShell = aDocument.defaultView.
+    QueryInterface(Components.interfaces.nsIInterfaceRequestor).
+    getInterface(Components.interfaces.nsIWebNavigation).
+    QueryInterface(Components.interfaces.nsIDocShell);
+  var docViewer = docShell.contentViewer.
+    QueryInterface(Components.interfaces.nsIMarkupDocumentViewer);
+
+  docViewer.fullZoom = aZoom;
 }
 
 /**
  * Return child accessible at the given point.
  *
  * @param aIdentifier        [in] accessible identifier
  * @param aX                 [in] x coordinate of the point relative accessible
  * @param aY                 [in] y coordinate of the point relative accessible
@@ -102,21 +118,54 @@ function getBounds(aID)
 }
 
 /**
  * Return DOM node coordinates relative the screen and its size in device
  * pixels.
  */
 function getBoundsForDOMElm(aID)
 {
+  var x = 0, y = 0, width = 0, height = 0;
+
   var elm = getNode(aID);
+  if (elm.localName == "area") {
+    var mapName = elm.parentNode.getAttribute("name");
+    var selector = "[usemap='#" + mapName + "']";
+    var img = elm.ownerDocument.querySelector(selector);
+
+    var areaCoords = elm.coords.split(",");
+    var areaX = parseInt(areaCoords[0]);
+    var areaY = parseInt(areaCoords[1]);
+    var areaWidth = parseInt(areaCoords[2]) - areaX;
+    var areaHeight = parseInt(areaCoords[3]) - areaY;
+
+    var rect = img.getBoundingClientRect();
+    x = rect.left + areaX;
+    y = rect.top + areaY;
+    width = areaWidth;
+    height = areaHeight;
+  }
+  else {
+    var rect = elm.getBoundingClientRect();
+    x = rect.left;
+    y = rect.top;
+    width = rect.width;
+    height = rect.height;
+  }
+
   var elmWindow = elm.ownerDocument.defaultView;
-  var winUtil = elmWindow.
+  return CSSToDevicePixels(elmWindow,
+                           x + elmWindow.mozInnerScreenX,
+                           y + elmWindow.mozInnerScreenY,
+                           width,
+                           height);
+}
+
+function CSSToDevicePixels(aWindow, aX, aY, aWidth, aHeight)
+{
+  var winUtil = aWindow.
     QueryInterface(Components.interfaces.nsIInterfaceRequestor).
     getInterface(Components.interfaces.nsIDOMWindowUtils);
 
   var ratio = winUtil.screenPixelsPerCSSPixel;
-  var rect = elm.getBoundingClientRect();
-  return [ (rect.left + elmWindow.mozInnerScreenX) * ratio,
-           (rect.top + elmWindow.mozInnerScreenY) * ratio,
-           rect.width * ratio,
-           rect.height * ratio ];
+  return [aX * ratio, aY * ratio, aWidth * ratio, aHeight * ratio];
 }
+
--- a/accessible/tests/mochitest/relations/test_tree.xul
+++ b/accessible/tests/mochitest/relations/test_tree.xul
@@ -19,17 +19,17 @@
   <script type="application/javascript"
           src="../relations.js" />
 
   <script type="application/javascript">
   <![CDATA[
     ////////////////////////////////////////////////////////////////////////////
     // Test
 
-    function doTestRelations()
+    function doTest()
     {
       var treeNode = getNode("tree");
 
       var tree = getAccessible(treeNode);
       var treeitem1 = tree.firstChild.nextSibling;
       testRelation(treeitem1, RELATION_NODE_CHILD_OF, [tree]);
 
       var treeitem2 = treeitem1.nextSibling;
@@ -49,25 +49,18 @@
 
       // treeitems and treecells shouldn't pick up relations from tree
       testRelation(treeitem1, RELATION_LABELLED_BY, null);
       testRelation(treeitem1.firstChild, RELATION_LABELLED_BY, null);
 
       SimpleTest.finish();
     }
 
-    function doTest()
-    {
-      var treeNode = getNode("tree");
-      waitForEvent(EVENT_REORDER, treeNode, doTestRelations);
-      treeNode.view = new nsTreeTreeView();
-    }
-
     SimpleTest.waitForExplicitFinish();
-    addA11yLoadEvent(doTest);
+    addA11yXULTreeLoadEvent(doTest, "tree", new nsTreeTreeView());
   ]]>
   </script>
 
   <hbox flex="1" style="overflow: auto;">
     <body xmlns="http://www.w3.org/1999/xhtml">
       <a target="_blank"
          href="https://bugzilla.mozilla.org/show_bug.cgi?id=503727"
          title="Reorganize implementation of XUL tree accessibility">
--- a/accessible/tests/mochitest/table/test_headers_tree.xul
+++ b/accessible/tests/mochitest/table/test_headers_tree.xul
@@ -19,36 +19,21 @@
   <script type="application/javascript"
           src="../table.js" />
 
   <script type="application/javascript">
   <![CDATA[
     ////////////////////////////////////////////////////////////////////////////
     // Test
 
-    var gTree = null;
-    var gTreeBox = null;
-    var gTreeView = null;
-
     // gA11yEventDumpID = "debug";
 
     function doTest()
     {
-      // Initialize the tree
-      gTree = document.getElementById("tree");
-      gTreeBox = gTree.treeBoxObject;
-      gView = new nsTableTreeView(3);
-
-      waitForEvent(EVENT_REORDER, gTree, continueTest);
-      gTreeBox.view = gView;
-    }
-
-    function continueTest()
-    {
-      var treeAcc = getAccessible(gTree, [nsIAccessibleTable]);
+      var treeAcc = getAccessible("tree", [nsIAccessibleTable]);
 
       var headerInfoMap = [
         {
           cell: treeAcc.getCellAt(0, 0),
           rowHeaderCells: [],
           columnHeaderCells: [ "col" ]
         },
         {
@@ -79,17 +64,17 @@
       ];
 
       testHeaderCells(headerInfoMap);
 
       SimpleTest.finish();
     }
 
     SimpleTest.waitForExplicitFinish();
-    addA11yLoadEvent(doTest);
+    addA11yXULTreeLoadEvent(doTest, "tree", new nsTableTreeView(3));
   ]]>
   </script>
 
   <hbox flex="1" style="overflow: auto;">
     <body xmlns="http://www.w3.org/1999/xhtml">
       <a target="_blank"
          href="https://bugzilla.mozilla.org/show_bug.cgi?id=512424"
          title="implement IAccessibleTable2">
--- a/accessible/tests/mochitest/table/test_indexes_tree.xul
+++ b/accessible/tests/mochitest/table/test_indexes_tree.xul
@@ -19,47 +19,32 @@
   <script type="application/javascript"
           src="../table.js" />
 
   <script type="application/javascript">
   <![CDATA[
     ////////////////////////////////////////////////////////////////////////////
     // Test
 
-    var gTree = null;
-    var gTreeBox = null;
-    var gTreeView = null;
-
     // gA11yEventDumpID = "debug";
 
     function doTest()
     {
-      // Initialize the tree
-      gTree = document.getElementById("tree");
-      gTreeBox = gTree.treeBoxObject;
-      gView = new nsTableTreeView(3);
-
-      waitForEvent(EVENT_REORDER, gTree, continueTest);
-      gTreeBox.view = gView;
-    }
-
-    function continueTest()
-    {
       var idxes = [
         [0, 1],
         [2, 3],
         [4, 5]
       ];
-      testTableIndexes(gTree, idxes);
+      testTableIndexes("tree", idxes);
 
       SimpleTest.finish();
     }
 
     SimpleTest.waitForExplicitFinish();
-    addA11yLoadEvent(doTest);
+    addA11yXULTreeLoadEvent(doTest, "tree", new nsTableTreeView(3));
   ]]>
   </script>
 
   <hbox flex="1" style="overflow: auto;">
     <body xmlns="http://www.w3.org/1999/xhtml">
       <a target="_blank"
          href="https://bugzilla.mozilla.org/show_bug.cgi?id=503727"
          title="Reorganize implementation of XUL tree accessibility">
--- a/accessible/tests/mochitest/table/test_sels_tree.xul
+++ b/accessible/tests/mochitest/table/test_sels_tree.xul
@@ -21,51 +21,36 @@
   <script type="application/javascript"
           src="../table.js" />
 
   <script type="application/javascript">
   <![CDATA[
     ////////////////////////////////////////////////////////////////////////////
     // Test
 
-    var gTree = null;
-    var gTreeBox = null;
-    var gTreeView = null;
-
     // gA11yEventDumpID = "debug";
 
     function doTest()
     {
-      // Initialize the tree
-      gTree = document.getElementById("tree");
-      gTreeBox = gTree.treeBoxObject;
-      gView = new nsTableTreeView(3);
-
-      waitForEvent(EVENT_REORDER, gTree, continueTest);
-      gTreeBox.view = gView;
-    }
-
-    function continueTest()
-    {
       var cellsArray =
       [
         [false, false],
         [false, false],
         [false, false]
       ];
 
-      testTableSelection(gTree, cellsArray);
-      testSelectTableRow(gTree, 0, cellsArray);
-      testUnselectTableRow(gTree, 0, cellsArray);
+      testTableSelection("tree", cellsArray);
+      testSelectTableRow("tree", 0, cellsArray);
+      testUnselectTableRow("tree", 0, cellsArray);
 
       SimpleTest.finish();
     }
 
     SimpleTest.waitForExplicitFinish();
-    addA11yLoadEvent(doTest);
+    addA11yXULTreeLoadEvent(doTest, "tree", new nsTableTreeView(3));
   ]]>
   </script>
 
   <hbox flex="1" style="overflow: auto;">
     <body xmlns="http://www.w3.org/1999/xhtml">
       <a target="_blank"
          href="https://bugzilla.mozilla.org/show_bug.cgi?id=503727"
          title="Reorganize implementation of XUL tree accessibility">
--- a/accessible/tests/mochitest/table/test_struct_tree.xul
+++ b/accessible/tests/mochitest/table/test_struct_tree.xul
@@ -21,48 +21,33 @@
   <script type="application/javascript"
           src="../table.js" />
 
   <script type="application/javascript">
   <![CDATA[
     ////////////////////////////////////////////////////////////////////////////
     // Test
 
-    var gTree = null;
-    var gTreeBox = null;
-    var gTreeView = null;
-
     // gA11yEventDumpID = "debug";
 
     function doTest()
     {
-      // Initialize the tree
-      gTree = document.getElementById("table");
-      gTreeBox = gTree.treeBoxObject;
-      gView = new nsTableTreeView(3);
-
-      waitForEvent(EVENT_REORDER, gTree, continueTest);
-      gTreeBox.view = gView;
-    }
-
-    function continueTest()
-    {
       var cellsArray = [
         [kDataCell, kDataCell],
         [kDataCell, kDataCell],
         [kDataCell, kDataCell]
       ];
 
-      testTableStruct(gTree, cellsArray, kTreeColumnHeader);
+      testTableStruct("table", cellsArray, kTreeColumnHeader);
 
       SimpleTest.finish();
     }
 
     SimpleTest.waitForExplicitFinish();
-    addA11yLoadEvent(doTest);
+    addA11yXULTreeLoadEvent(doTest, "table", new nsTableTreeView(3));
   ]]>
   </script>
 
   <hbox flex="1" style="overflow: auto;">
     <body xmlns="http://www.w3.org/1999/xhtml">
       <a target="_blank"
          href="https://bugzilla.mozilla.org/show_bug.cgi?id=512424"
          title="implement IAccessibleTable2">
--- a/accessible/tests/mochitest/test_nsIAccessibleDocument.html
+++ b/accessible/tests/mochitest/test_nsIAccessibleDocument.html
@@ -35,17 +35,17 @@ https://bugzilla.mozilla.org/show_bug.cg
         // check if it is focusable, read-only.
         testStates(docAcc, (STATE_READONLY | STATE_FOCUSABLE));
 
         // No actions wanted on doc
         is(docAcc.numActions, 0, "Wrong number of actions for document!");
 
         // attributes should contain tag:body
         attributes = docAcc.attributes;
-        is(attributes.getStringProperty("tag"), "BODY",
+        is(attributes.getStringProperty("tag"), "body",
            "Wrong attribute on document!");
 
         // nsIAccessibleDocument
         // getRootDirectory() depends on broken chrome-harness.js include (bug
         // 736886)
         /*
         var rootDir = getRootDirectory(window.location.href);
         is(docAcc.URL, rootDir.path + "test_nsIAccessibleDocument.html",
--- a/accessible/tests/mochitest/treeview.js
+++ b/accessible/tests/mochitest/treeview.js
@@ -1,8 +1,59 @@
+/**
+ * Helper method to start a single XUL tree test.
+ */
+function loadXULTreeAndDoTest(aDoTestFunc, aTreeID, aTreeView)
+{
+  var doTestFunc = aDoTestFunc ? aDoTestFunc : gXULTreeLoadContext.doTestFunc;
+  var treeID = aTreeID ? aTreeID : gXULTreeLoadContext.treeID;
+  var treeView = aTreeView ? aTreeView : gXULTreeLoadContext.treeView;
+
+  function loadXULTree(aTreeID, aTreeView)
+  {
+    this.treeNode = getNode(aTreeID);
+
+    this.eventSeq = [
+      new invokerChecker(EVENT_REORDER, this.treeNode)
+    ];
+
+    this.invoke = function loadXULTree_invoke()
+    {
+      this.treeNode.treeBoxObject.view = aTreeView;
+    }
+
+    this.getID = function loadXULTree_getID()
+    {
+      return "Load XUL tree " + prettyName(aTreeID);
+    }
+  }
+
+  gXULTreeLoadContext.queue = new eventQueue();
+  gXULTreeLoadContext.queue.push(new loadXULTree(treeID, treeView));
+  gXULTreeLoadContext.queue.onFinish = function()
+  {
+    SimpleTest.executeSoon(doTestFunc);
+    return DO_NOT_FINISH_TEST;
+  }
+  gXULTreeLoadContext.queue.invoke();
+}
+
+/**
+ * Analogy of addA11yLoadEvent, nice helper to load XUL tree and start the test.
+ */
+function addA11yXULTreeLoadEvent(aDoTestFunc, aTreeID, aTreeView)
+{
+  gXULTreeLoadContext.doTestFunc = aDoTestFunc;
+  gXULTreeLoadContext.treeID = aTreeID;
+  gXULTreeLoadContext.treeView = aTreeView;
+
+  addA11yLoadEvent(loadXULTreeAndDoTest);
+}
+
+
 function nsTableTreeView(aRowCount)
 {
   this.__proto__ = new nsTreeView();
 
   for (var idx = 0; idx < aRowCount; idx++)
     this.mData.push(new treeItem("row" + String(idx) + "_"));
 }
 
@@ -227,8 +278,19 @@ function treeItem(aText, aOpen, aChildre
     this.children = aChildren;
 }
 
 function createAtom(aName)
 {
   return Components.classes["@mozilla.org/atom-service;1"]
     .getService(Components.interfaces.nsIAtomService).getAtom(aName);
 }
+
+/**
+ * Used in conjunction with loadXULTreeAndDoTest and addA11yXULTreeLoadEvent.
+ */
+var gXULTreeLoadContext =
+{
+  doTestFunc: null,
+  treeID: null,
+  treeView: null,
+  queue: null
+};
--- a/allmakefiles.sh
+++ b/allmakefiles.sh
@@ -69,16 +69,22 @@ config/doxygen.cfg
 config/expandlibs_config.py
 config/tests/src-simple/Makefile
 mfbt/Makefile
 probes/Makefile
 extensions/Makefile
 "
 
 if [ ! "$LIBXUL_SDK" ]; then
+  if [ "$STLPORT_SOURCES" ]; then
+    add_makefiles "
+      build/stlport/Makefile
+      build/stlport/stl/config/_android.h
+    "
+  fi
   add_makefiles "
     memory/mozalloc/Makefile
     mozglue/Makefile
     mozglue/build/Makefile
   "
   if [ "$MOZ_MEMORY" ]; then
     add_makefiles "
       memory/jemalloc/Makefile
--- a/b2g/app/b2g.js
+++ b/b2g/app/b2g.js
@@ -35,46 +35,70 @@
  *
  * ***** END LICENSE BLOCK ***** */
 
 #filter substitution
 
 pref("toolkit.defaultChromeURI", "chrome://browser/content/shell.xul");
 pref("browser.chromeURL", "chrome://browser/content/");
 #ifdef MOZ_OFFICIAL_BRANDING
-pref("browser.homescreenURL", "file:///system/home/homescreen.html");
+pref("browser.homescreenURL", "http://homescreen.gaiamobile.org/");
 #else
-pref("browser.homescreenURL", "file:///data/local/homescreen.html,file:///system/home/homescreen.html");
+pref("browser.homescreenURL", "http://homescreen.gaiamobile.org/");
 #endif
 
+// All the privileged domains
+// XXX TODO : we should read them from a file somewhere
+pref("b2g.privileged.domains", "http://browser.gaiamobile.org,
+	                            http://calculator.gaiamobile.org,
+	                            http://contacts.gaiamobile.org,
+	                            http://camera.gaiamobile.org,
+	                            http://clock.gaiamobile.org,
+	                            http://crystalskull.gaiamobile.org,
+	                            http://cubevid.gaiamobile.org,
+	                            http://dialer.gaiamobile.org,
+	                            http://gallery.gaiamobile.org,
+	                            http://homescreen.gaiamobile.org,
+	                            http://maps.gaiamobile.org,
+	                            http://market.gaiamobile.org,
+	                            http://music.gaiamobile.org,
+	                            http://penguinpop.gaiamobile.org,
+	                            http://settings.gaiamobile.org,
+	                            http://sms.gaiamobile.org,
+	                            http://towerjelly.gaiamobile.org,
+	                            http://video.gaiamobile.org");
+
 // URL for the dialer application.
-pref("dom.telephony.app.phone.url", "http://localhost:7777/data/local/apps/dialer/dialer.html,http://localhost:7777/data/local/apps/homescreen/homescreen.html,http://localhost:7777/apps/dialer/dialer.html,http://localhost:7777/apps/homescreen/homescreen.html");
+pref("dom.telephony.app.phone.url", "http://dialer.gaiamobile.org,http://homescreen.gaiamobile.org");
 
 // Device pixel to CSS px ratio, in percent. Set to -1 to calculate based on display density.
 pref("browser.viewport.scaleRatio", -1);
 
 /* disable text selection */
 pref("browser.ignoreNativeFrameTextSelection", true);
 
 /* cache prefs */
+#ifdef MOZ_WIDGET_GONK
 pref("browser.cache.disk.enable", true);
 pref("browser.cache.disk.capacity", 55000); // kilobytes
 pref("browser.cache.disk.parent_directory", "/cache");
+#endif
 pref("browser.cache.disk.smart_size.enabled", false);
 pref("browser.cache.disk.smart_size.first_run", false);
 
 pref("browser.cache.memory.enable", true);
 pref("browser.cache.memory.capacity", 1024); // kilobytes
 
 /* image cache prefs */
 pref("image.cache.size", 1048576); // bytes
 
 /* offline cache prefs */
 pref("browser.offline-apps.notify", false);
-pref("browser.cache.offline.enable", false);
+pref("browser.cache.offline.enable", true);
+pref("offline-apps.allow_by_default", true);
 
 /* protocol warning prefs */
 pref("network.protocol-handler.warn-external.tel", false);
 pref("network.protocol-handler.warn-external.mailto", false);
 pref("network.protocol-handler.warn-external.vnd.youtube", false);
 
 /* http prefs */
 pref("network.http.pipelining", true);
@@ -386,38 +410,38 @@ pref("security.fileuri.strict_origin_pol
 // Temporarily force-enable GL compositing.  This is default-disabled
 // deep within the bowels of the widgetry system.  Remove me when GL
 // compositing isn't default disabled in widget/android.
 pref("layers.acceleration.force-enabled", true);
 
 // screen.enabled and screen.brightness properties.
 pref("dom.screenEnabledProperty.enabled", true);
 pref("dom.screenBrightnessProperty.enabled", true);
-pref("dom.mozScreenWhitelist", "http://localhost:7777");
+pref("dom.mozScreenWhitelist", "http://homescreen.gaiamobile.org,http://settings.gaiamobile.org");
 
 // handle links targeting new windows
 // 1=current window/tab, 2=new window, 3=new tab in most recent window
 pref("browser.link.open_newwindow", 3);
 
 // 0: no restrictions - divert everything
 // 1: don't divert window.open at all
 // 2: don't divert window.open with features
 pref("browser.link.open_newwindow.restriction", 0);
 
 // Enable browser frame
 pref("dom.mozBrowserFramesEnabled", true);
-pref("dom.mozBrowserFramesWhitelist", "http://localhost:7777");
+pref("dom.mozBrowserFramesWhitelist", "http://homescreen.gaiamobile.org,http://browser.gaiamobile.org");
 
 // Temporary permission hack for WebSMS
 pref("dom.sms.enabled", true);
-pref("dom.sms.whitelist", "file://,http://localhost:7777");
+pref("dom.sms.whitelist", "file://,http://homescreen.gaiamobile.org,http://sms.gaiamobile.org");
 
 // Temporary permission hack for WebContacts
 pref("dom.mozContacts.enabled", true);
-pref("dom.mozContacts.whitelist", "http://localhost:7777");
+pref("dom.mozContacts.whitelist", "http://dialer.gaiamobile.org,http://sms.gaiamobile.org");
 
 // Ignore X-Frame-Options headers.
 pref("b2g.ignoreXFrameOptions", true);
 
 // controls if we want camera support
 pref("device.camera.enabled", true);
 pref("media.realtime_decoder.enabled", true);
 
@@ -435,17 +459,17 @@ pref("b2g.remote-js.enabled", true);
 pref("b2g.remote-js.port", 9999);
 
 // Handle hardware buttons in the b2g chrome package
 pref("b2g.keys.menu.enabled", true);
 pref("b2g.keys.search.enabled", false);
 
 // Screen timeout in minutes
 pref("power.screen.timeout", 60);
-pref("dom.power.whitelist", "http://localhost:7777");
+pref("dom.power.whitelist", "http://homescreen.gaiamobile.org,http://settings.gaiamobile.org");
 
 pref("full-screen-api.enabled", true);
 
 pref("media.volume.steps", 10);
 
 // Data connection settings. These will eventually live in the
 // navigator.settings API, or even in a database where we can look
 // it up automatically (bug 729440), but for this will have to do.
@@ -463,19 +487,22 @@ pref("marionette.defaultPrefs.port", 282
 pref("app.update.enabled", true);
 pref("app.update.auto", true);
 pref("app.update.silent", true);
 pref("app.update.mode", 0);
 pref("app.update.incompatible.mode", 0);
 pref("app.update.service.enabled", true);
 
 // The URL hosting the update manifest.
-//pref("app.update.url", "http://localhost/updates.xml");
+pref("app.update.url", "http://update.boot2gecko.org/m2.5/updates.xml");
 // Interval at which update manifest is fetched.  In units of seconds.
-pref("app.update.interval", 86400); // 24 hours
+pref("app.update.interval", 3600); // 1 hour
 // First interval to elapse before checking for update.  In units of
 // milliseconds.  Capped at 10 seconds.
 pref("app.update.timerFirstInterval", 30000);
+pref("app.update.timerMinimumDelay", 30); // seconds
+// Don't throttle background updates.
+pref("app.update.download.backgroundInterval", 0);
 
 // Enable update logging for now, to diagnose growing pains in the
 // field.
 pref("app.update.log", true);
 #endif
deleted file mode 100644
--- a/b2g/chrome/content/httpd.js
+++ /dev/null
@@ -1,5211 +0,0 @@
-/* -*- Mode: JavaScript; tab-width: 2; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
-/* vim:set ts=2 sw=2 sts=2 et: */
-/* ***** BEGIN LICENSE BLOCK *****
- * Version: MPL 1.1/GPL 2.0/LGPL 2.1
- *
- * The contents of this file are subject to the Mozilla Public License Version
- * 1.1 (the "License"); you may not use this file except in compliance with
- * the License. You may obtain a copy of the License at
- * http://www.mozilla.org/MPL/
- *
- * Software distributed under the License is distributed on an "AS IS" basis,
- * WITHOUT WARRANTY OF ANY KIND, either express or implied. See the License
- * for the specific language governing rights and limitations under the
- * License.
- *
- * The Original Code is the httpd.js server.
- *
- * The Initial Developer of the Original Code is
- * Mozilla Corporation.
- * Portions created by the Initial Developer are Copyright (C) 2006
- * the Initial Developer. All Rights Reserved.
- *
- * Contributor(s):
- *   Darin Fisher (v1, netwerk/test/TestServ.js)
- *   Christian Biesinger (v2, netwerk/test/unit/head_http_server.js)
- *   Jeff Walden <jwalden+code@mit.edu> (v3, netwerk/test/httpserver/httpd.js)
- *   Robert Sayre <sayrer@gmail.com>
- *
- * Alternatively, the contents of this file may be used under the terms of
- * either the GNU General Public License Version 2 or later (the "GPL"), or
- * the GNU Lesser General Public License Version 2.1 or later (the "LGPL"),
- * in which case the provisions of the GPL or the LGPL are applicable instead
- * of those above. If you wish to allow use of your version of this file only
- * under the terms of either the GPL or the LGPL, and not to allow others to
- * use your version of this file under the terms of the MPL, indicate your
- * decision by deleting the provisions above and replace them with the notice
- * and other provisions required by the GPL or the LGPL. If you do not delete
- * the provisions above, a recipient may use your version of this file under
- * the terms of any one of the MPL, the GPL or the LGPL.
- *
- * ***** END LICENSE BLOCK ***** */
-
-/*
- * An implementation of an HTTP server both as a loadable script and as an XPCOM
- * component.  See the accompanying README file for user documentation on
- * httpd.js.
- */
-
-Components.utils.import("resource://gre/modules/XPCOMUtils.jsm");
-
-const Cc = Components.classes;
-const Ci = Components.interfaces;
-const Cr = Components.results;
-const Cu = Components.utils;
-const CC = Components.Constructor;
-
-const PR_UINT32_MAX = Math.pow(2, 32) - 1;
-
-/** True if debugging output is enabled, false otherwise. */
-var DEBUG = false; // non-const *only* so tweakable in server tests
-
-/** True if debugging output should be timestamped. */
-var DEBUG_TIMESTAMP = false; // non-const so tweakable in server tests
-
-var gGlobalObject = this;
-
-/**
- * Asserts that the given condition holds.  If it doesn't, the given message is
- * dumped, a stack trace is printed, and an exception is thrown to attempt to
- * stop execution (which unfortunately must rely upon the exception not being
- * accidentally swallowed by the code that uses it).
- */
-function NS_ASSERT(cond, msg)
-{
-  if (DEBUG && !cond)
-  {
-    dumpn("###!!!");
-    dumpn("###!!! ASSERTION" + (msg ? ": " + msg : "!"));
-    dumpn("###!!! Stack follows:");
-
-    var stack = new Error().stack.split(/\n/);
-    dumpn(stack.map(function(val) { return "###!!!   " + val; }).join("\n"));
-
-    throw Cr.NS_ERROR_ABORT;
-  }
-}
-
-/** Constructs an HTTP error object. */
-function HttpError(code, description)
-{
-  this.code = code;
-  this.description = description;
-}
-HttpError.prototype =
-{
-  toString: function()
-  {
-    return this.code + " " + this.description;
-  }
-};
-
-/**
- * Errors thrown to trigger specific HTTP server responses.
- */
-const HTTP_400 = new HttpError(400, "Bad Request");
-const HTTP_401 = new HttpError(401, "Unauthorized");
-const HTTP_402 = new HttpError(402, "Payment Required");
-const HTTP_403 = new HttpError(403, "Forbidden");
-const HTTP_404 = new HttpError(404, "Not Found");
-const HTTP_405 = new HttpError(405, "Method Not Allowed");
-const HTTP_406 = new HttpError(406, "Not Acceptable");
-const HTTP_407 = new HttpError(407, "Proxy Authentication Required");
-const HTTP_408 = new HttpError(408, "Request Timeout");
-const HTTP_409 = new HttpError(409, "Conflict");
-const HTTP_410 = new HttpError(410, "Gone");
-const HTTP_411 = new HttpError(411, "Length Required");
-const HTTP_412 = new HttpError(412, "Precondition Failed");
-const HTTP_413 = new HttpError(413, "Request Entity Too Large");
-const HTTP_414 = new HttpError(414, "Request-URI Too Long");
-const HTTP_415 = new HttpError(415, "Unsupported Media Type");
-const HTTP_417 = new HttpError(417, "Expectation Failed");
-
-const HTTP_500 = new HttpError(500, "Internal Server Error");
-const HTTP_501 = new HttpError(501, "Not Implemented");
-const HTTP_502 = new HttpError(502, "Bad Gateway");
-const HTTP_503 = new HttpError(503, "Service Unavailable");
-const HTTP_504 = new HttpError(504, "Gateway Timeout");
-const HTTP_505 = new HttpError(505, "HTTP Version Not Supported");
-
-/** Creates a hash with fields corresponding to the values in arr. */
-function array2obj(arr)
-{
-  var obj = {};
-  for (var i = 0; i < arr.length; i++)
-    obj[arr[i]] = arr[i];
-  return obj;
-}
-
-/** Returns an array of the integers x through y, inclusive. */
-function range(x, y)
-{
-  var arr = [];
-  for (var i = x; i <= y; i++)
-    arr.push(i);
-  return arr;
-}
-
-/** An object (hash) whose fields are the numbers of all HTTP error codes. */
-const HTTP_ERROR_CODES = array2obj(range(400, 417).concat(range(500, 505)));
-
-
-/**
- * The character used to distinguish hidden files from non-hidden files, a la
- * the leading dot in Apache.  Since that mechanism also hides files from
- * easy display in LXR, ls output, etc. however, we choose instead to use a
- * suffix character.  If a requested file ends with it, we append another
- * when getting the file on the server.  If it doesn't, we just look up that
- * file.  Therefore, any file whose name ends with exactly one of the character
- * is "hidden" and available for use by the server.
- */
-const HIDDEN_CHAR = "^";
-
-/**
- * The file name suffix indicating the file containing overridden headers for
- * a requested file.
- */
-const HEADERS_SUFFIX = HIDDEN_CHAR + "headers" + HIDDEN_CHAR;
-
-/** Type used to denote SJS scripts for CGI-like functionality. */
-const SJS_TYPE = "sjs";
-
-/** Base for relative timestamps produced by dumpn(). */
-var firstStamp = 0;
-
-/** dump(str) with a trailing "\n" -- only outputs if DEBUG. */
-function dumpn(str)
-{
-  if (DEBUG)
-  {
-    var prefix = "HTTPD-INFO | ";
-    if (DEBUG_TIMESTAMP)
-    {
-      if (firstStamp === 0)
-        firstStamp = Date.now();
-
-      var elapsed = Date.now() - firstStamp; // milliseconds
-      var min = Math.floor(elapsed / 60000);
-      var sec = (elapsed % 60000) / 1000;
-
-      if (sec < 10)
-        prefix += min + ":0" + sec.toFixed(3) + " | ";
-      else
-        prefix += min + ":" + sec.toFixed(3) + " | ";
-    }
-
-    dump(prefix + str + "\n");
-  }
-}
-
-/** Dumps the current JS stack if DEBUG. */
-function dumpStack()
-{
-  // peel off the frames for dumpStack() and Error()
-  var stack = new Error().stack.split(/\n/).slice(2);
-  stack.forEach(dumpn);
-}
-
-
-/** The XPCOM thread manager. */
-var gThreadManager = null;
-
-/** The XPCOM prefs service. */
-var gRootPrefBranch = null;
-function getRootPrefBranch()
-{
-  if (!gRootPrefBranch)
-  {
-    gRootPrefBranch = Cc["@mozilla.org/preferences-service;1"]
-                        .getService(Ci.nsIPrefBranch);
-  }
-  return gRootPrefBranch;
-}
-
-/**
- * JavaScript constructors for commonly-used classes; precreating these is a
- * speedup over doing the same from base principles.  See the docs at
- * http://developer.mozilla.org/en/docs/Components.Constructor for details.
- */
-const ServerSocket = CC("@mozilla.org/network/server-socket;1",
-                        "nsIServerSocket",
-                        "init");
-const ScriptableInputStream = CC("@mozilla.org/scriptableinputstream;1",
-                                 "nsIScriptableInputStream",
-                                 "init");
-const Pipe = CC("@mozilla.org/pipe;1",
-                "nsIPipe",
-                "init");
-const FileInputStream = CC("@mozilla.org/network/file-input-stream;1",
-                           "nsIFileInputStream",
-                           "init");
-const ConverterInputStream = CC("@mozilla.org/intl/converter-input-stream;1",
-                                "nsIConverterInputStream",
-                                "init");
-const WritablePropertyBag = CC("@mozilla.org/hash-property-bag;1",
-                               "nsIWritablePropertyBag2");
-const SupportsString = CC("@mozilla.org/supports-string;1",
-                          "nsISupportsString");
-
-/* These two are non-const only so a test can overwrite them. */
-var BinaryInputStream = CC("@mozilla.org/binaryinputstream;1",
-                           "nsIBinaryInputStream",
-                           "setInputStream");
-var BinaryOutputStream = CC("@mozilla.org/binaryoutputstream;1",
-                            "nsIBinaryOutputStream",
-                            "setOutputStream");
-
-/**
- * Returns the RFC 822/1123 representation of a date.
- *
- * @param date : Number
- *   the date, in milliseconds from midnight (00:00:00), January 1, 1970 GMT
- * @returns string
- *   the representation of the given date
- */
-function toDateString(date)
-{
-  //
-  // rfc1123-date = wkday "," SP date1 SP time SP "GMT"
-  // date1        = 2DIGIT SP month SP 4DIGIT
-  //                ; day month year (e.g., 02 Jun 1982)
-  // time         = 2DIGIT ":" 2DIGIT ":" 2DIGIT
-  //                ; 00:00:00 - 23:59:59
-  // wkday        = "Mon" | "Tue" | "Wed"
-  //              | "Thu" | "Fri" | "Sat" | "Sun"
-  // month        = "Jan" | "Feb" | "Mar" | "Apr"
-  //              | "May" | "Jun" | "Jul" | "Aug"
-  //              | "Sep" | "Oct" | "Nov" | "Dec"
-  //
-
-  const wkdayStrings = ["Sun", "Mon", "Tue", "Wed", "Thu", "Fri", "Sat"];
-  const monthStrings = ["Jan", "Feb", "Mar", "Apr", "May", "Jun",
-                        "Jul", "Aug", "Sep", "Oct", "Nov", "Dec"];
-
-  /**
-   * Processes a date and returns the encoded UTC time as a string according to
-   * the format specified in RFC 2616.
-   *
-   * @param date : Date
-   *   the date to process
-   * @returns string
-   *   a string of the form "HH:MM:SS", ranging from "00:00:00" to "23:59:59"
-   */
-  function toTime(date)
-  {
-    var hrs = date.getUTCHours();
-    var rv  = (hrs < 10) ? "0" + hrs : hrs;
-    
-    var mins = date.getUTCMinutes();
-    rv += ":";
-    rv += (mins < 10) ? "0" + mins : mins;
-
-    var secs = date.getUTCSeconds();
-    rv += ":";
-    rv += (secs < 10) ? "0" + secs : secs;
-
-    return rv;
-  }
-
-  /**
-   * Processes a date and returns the encoded UTC date as a string according to
-   * the date1 format specified in RFC 2616.
-   *
-   * @param date : Date
-   *   the date to process
-   * @returns string
-   *   a string of the form "HH:MM:SS", ranging from "00:00:00" to "23:59:59"
-   */
-  function toDate1(date)
-  {
-    var day = date.getUTCDate();
-    var month = date.getUTCMonth();
-    var year = date.getUTCFullYear();
-
-    var rv = (day < 10) ? "0" + day : day;
-    rv += " " + monthStrings[month];
-    rv += " " + year;
-
-    return rv;
-  }
-
-  date = new Date(date);
-
-  const fmtString = "%wkday%, %date1% %time% GMT";
-  var rv = fmtString.replace("%wkday%", wkdayStrings[date.getUTCDay()]);
-  rv = rv.replace("%time%", toTime(date));
-  return rv.replace("%date1%", toDate1(date));
-}
-
-/**
- * Prints out a human-readable representation of the object o and its fields,
- * omitting those whose names begin with "_" if showMembers != true (to ignore
- * "private" properties exposed via getters/setters).
- */
-function printObj(o, showMembers)
-{
-  var s = "******************************\n";
-  s +=    "o = {\n";
-  for (var i in o)
-  {
-    if (typeof(i) != "string" ||
-        (showMembers || (i.length > 0 && i[0] != "_")))
-      s+= "      " + i + ": " + o[i] + ",\n";
-  }
-  s +=    "    };\n";
-  s +=    "******************************";
-  dumpn(s);
-}
-
-/**
- * Instantiates a new HTTP server.
- */
-function nsHttpServer()
-{
-  if (!gThreadManager)
-    gThreadManager = Cc["@mozilla.org/thread-manager;1"].getService();
-
-  /** The port on which this server listens. */
-  this._port = undefined;
-
-  /** The socket associated with this. */
-  this._socket = null;
-
-  /** The handler used to process requests to this server. */
-  this._handler = new ServerHandler(this);
-
-  /** Naming information for this server. */
-  this._identity = new ServerIdentity();
-
-  /**
-   * Indicates when the server is to be shut down at the end of the request.
-   */
-  this._doQuit = false;
-
-  /**
-   * True if the socket in this is closed (and closure notifications have been
-   * sent and processed if the socket was ever opened), false otherwise.
-   */
-  this._socketClosed = true;
-
-  /**
-   * Used for tracking existing connections and ensuring that all connections
-   * are properly cleaned up before server shutdown; increases by 1 for every
-   * new incoming connection.
-   */
-  this._connectionGen = 0;
-
-  /**
-   * Hash of all open connections, indexed by connection number at time of
-   * creation.
-   */
-  this._connections = {};
-}
-nsHttpServer.prototype =
-{
-  classID: Components.ID("{54ef6f81-30af-4b1d-ac55-8ba811293e41}"),
-
-  // NSISERVERSOCKETLISTENER
-
-  /**
-   * Processes an incoming request coming in on the given socket and contained
-   * in the given transport.
-   *
-   * @param socket : nsIServerSocket
-   *   the socket through which the request was served
-   * @param trans : nsISocketTransport
-   *   the transport for the request/response
-   * @see nsIServerSocketListener.onSocketAccepted
-   */
-  onSocketAccepted: function(socket, trans)
-  {
-    dumpn("*** onSocketAccepted(socket=" + socket + ", trans=" + trans + ")");
-
-    dumpn(">>> new connection on " + trans.host + ":" + trans.port);
-
-    const SEGMENT_SIZE = 8192;
-    const SEGMENT_COUNT = 1024;
-    try
-    {
-      var input = trans.openInputStream(0, SEGMENT_SIZE, SEGMENT_COUNT)
-                       .QueryInterface(Ci.nsIAsyncInputStream);
-      var output = trans.openOutputStream(0, 0, 0);
-    }
-    catch (e)
-    {
-      dumpn("*** error opening transport streams: " + e);
-      trans.close(Cr.NS_BINDING_ABORTED);
-      return;
-    }
-
-    var connectionNumber = ++this._connectionGen;
-
-    try
-    {
-      var conn = new Connection(input, output, this, socket.port, trans.port,
-                                connectionNumber);
-      var reader = new RequestReader(conn);
-
-      // XXX add request timeout functionality here!
-
-      // Note: must use main thread here, or we might get a GC that will cause
-      //       threadsafety assertions.  We really need to fix XPConnect so that
-      //       you can actually do things in multi-threaded JS.  :-(
-      input.asyncWait(reader, 0, 0, gThreadManager.mainThread);
-    }
-    catch (e)
-    {
-      // Assume this connection can't be salvaged and bail on it completely;
-      // don't attempt to close it so that we can assert that any connection
-      // being closed is in this._connections.
-      dumpn("*** error in initial request-processing stages: " + e);
-      trans.close(Cr.NS_BINDING_ABORTED);
-      return;
-    }
-
-    this._connections[connectionNumber] = conn;
-    dumpn("*** starting connection " + connectionNumber);
-  },
-
-  /**
-   * Called when the socket associated with this is closed.
-   *
-   * @param socket : nsIServerSocket
-   *   the socket being closed
-   * @param status : nsresult
-   *   the reason the socket stopped listening (NS_BINDING_ABORTED if the server
-   *   was stopped using nsIHttpServer.stop)
-   * @see nsIServerSocketListener.onStopListening
-   */
-  onStopListening: function(socket, status)
-  {
-    dumpn(">>> shutting down server on port " + socket.port);
-    this._socketClosed = true;
-    if (!this._hasOpenConnections())
-    {
-      dumpn("*** no open connections, notifying async from onStopListening");
-
-      // Notify asynchronously so that any pending teardown in stop() has a
-      // chance to run first.
-      var self = this;
-      var stopEvent =
-        {
-          run: function()
-          {
-            dumpn("*** _notifyStopped async callback");
-            self._notifyStopped();
-          }
-        };
-      gThreadManager.currentThread
-                    .dispatch(stopEvent, Ci.nsIThread.DISPATCH_NORMAL);
-    }
-  },
-
-  // NSIHTTPSERVER
-
-  //
-  // see nsIHttpServer.start
-  //
-  start: function(port)
-  {
-    this._start(port, "localhost")
-  },
-
-  _start: function(port, host)
-  {
-    if (this._socket)
-      throw Cr.NS_ERROR_ALREADY_INITIALIZED;
-
-    this._port = port;
-    this._doQuit = this._socketClosed = false;
-
-    this._host = host;
-
-    // The listen queue needs to be long enough to handle
-    // network.http.max-connections-per-server concurrent connections,
-    // plus a safety margin in case some other process is talking to
-    // the server as well.
-    var prefs = getRootPrefBranch();
-    var maxConnections =
-      prefs.getIntPref("network.http.max-connections-per-server") + 5;
-
-    try
-    {
-      var loopback = true;
-      if (this._host != "127.0.0.1" && this._host != "localhost") {
-        var loopback = false;
-      }
-
-      var socket = new ServerSocket(this._port,
-                                    loopback, // true = localhost, false = everybody
-                                    maxConnections);
-      dumpn(">>> listening on port " + socket.port + ", " + maxConnections +
-            " pending connections");
-      socket.asyncListen(this);
-      this._identity._initialize(port, host, true);
-      this._socket = socket;
-    }
-    catch (e)
-    {
-      dumpn("!!! could not start server on port " + port + ": " + e);
-      throw Cr.NS_ERROR_NOT_AVAILABLE;
-    }
-  },
-
-  //
-  // see nsIHttpServer.stop
-  //
-  stop: function(callback)
-  {
-    if (!callback)
-      throw Cr.NS_ERROR_NULL_POINTER;
-    if (!this._socket)
-      throw Cr.NS_ERROR_UNEXPECTED;
-
-    this._stopCallback = typeof callback === "function"
-                       ? callback
-                       : function() { callback.onStopped(); };
-
-    dumpn(">>> stopping listening on port " + this._socket.port);
-    this._socket.close();
-    this._socket = null;
-
-    // We can't have this identity any more, and the port on which we're running
-    // this server now could be meaningless the next time around.
-    this._identity._teardown();
-
-    this._doQuit = false;
-
-    // socket-close notification and pending request completion happen async
-  },
-
-  //
-  // see nsIHttpServer.registerFile
-  //
-  registerFile: function(path, file)
-  {
-    if (file && (!file.exists() || file.isDirectory()))
-      throw Cr.NS_ERROR_INVALID_ARG;
-
-    this._handler.registerFile(path, file);
-  },
-
-  //
-  // see nsIHttpServer.registerDirectory
-  //
-  registerDirectory: function(path, directory)
-  {
-    // XXX true path validation!
-    if (path.charAt(0) != "/" ||
-        path.charAt(path.length - 1) != "/" ||
-        (directory &&
-         (!directory.exists() || !directory.isDirectory())))
-      throw Cr.NS_ERROR_INVALID_ARG;
-
-    // XXX determine behavior of nonexistent /foo/bar when a /foo/bar/ mapping
-    //     exists!
-
-    this._handler.registerDirectory(path, directory);
-  },
-
-  //
-  // see nsIHttpServer.registerPathHandler
-  //
-  registerPathHandler: function(path, handler)
-  {
-    this._handler.registerPathHandler(path, handler);
-  },
-
-  //
-  // see nsIHttpServer.registerErrorHandler
-  //
-  registerErrorHandler: function(code, handler)
-  {
-    this._handler.registerErrorHandler(code, handler);
-  },
-
-  //
-  // see nsIHttpServer.setIndexHandler
-  //
-  setIndexHandler: function(handler)
-  {
-    this._handler.setIndexHandler(handler);
-  },
-
-  //
-  // see nsIHttpServer.registerContentType
-  //
-  registerContentType: function(ext, type)
-  {
-    this._handler.registerContentType(ext, type);
-  },
-
-  //
-  // see nsIHttpServer.serverIdentity
-  //
-  get identity()
-  {
-    return this._identity;
-  },
-
-  //
-  // see nsIHttpServer.getState
-  //
-  getState: function(path, k)
-  {
-    return this._handler._getState(path, k);
-  },
-
-  //
-  // see nsIHttpServer.setState
-  //
-  setState: function(path, k, v)
-  {
-    return this._handler._setState(path, k, v);
-  },
-
-  //
-  // see nsIHttpServer.getSharedState
-  //
-  getSharedState: function(k)
-  {
-    return this._handler._getSharedState(k);
-  },
-
-  //
-  // see nsIHttpServer.setSharedState
-  //
-  setSharedState: function(k, v)
-  {
-    return this._handler._setSharedState(k, v);
-  },
-
-  //
-  // see nsIHttpServer.getObjectState
-  //
-  getObjectState: function(k)
-  {
-    return this._handler._getObjectState(k);
-  },
-
-  //
-  // see nsIHttpServer.setObjectState
-  //
-  setObjectState: function(k, v)
-  {
-    return this._handler._setObjectState(k, v);
-  },
-
-
-  // NSISUPPORTS
-
-  //
-  // see nsISupports.QueryInterface
-  //
-  QueryInterface: function(iid)
-  {
-    if (iid.equals(Ci.nsIHttpServer) ||
-        iid.equals(Ci.nsIServerSocketListener) ||
-        iid.equals(Ci.nsISupports))
-      return this;
-
-    throw Cr.NS_ERROR_NO_INTERFACE;
-  },
-
-
-  // NON-XPCOM PUBLIC API
-
-  /**
-   * Returns true iff this server is not running (and is not in the process of
-   * serving any requests still to be processed when the server was last
-   * stopped after being run).
-   */
-  isStopped: function()
-  {
-    return this._socketClosed && !this._hasOpenConnections();
-  },
-
-  // PRIVATE IMPLEMENTATION
-
-  /** True if this server has any open connections to it, false otherwise. */
-  _hasOpenConnections: function()
-  {
-    //
-    // If we have any open connections, they're tracked as numeric properties on
-    // |this._connections|.  The non-standard __count__ property could be used
-    // to check whether there are any properties, but standard-wise, even
-    // looking forward to ES5, there's no less ugly yet still O(1) way to do
-    // this.
-    //
-    for (var n in this._connections)
-      return true;
-    return false;
-  },
-
-  /** Calls the server-stopped callback provided when stop() was called. */
-  _notifyStopped: function()
-  {
-    NS_ASSERT(this._stopCallback !== null, "double-notifying?");
-    NS_ASSERT(!this._hasOpenConnections(), "should be done serving by now");
-
-    //
-    // NB: We have to grab this now, null out the member, *then* call the
-    //     callback here, or otherwise the callback could (indirectly) futz with
-    //     this._stopCallback by starting and immediately stopping this, at
-    //     which point we'd be nulling out a field we no longer have a right to
-    //     modify.
-    //
-    var callback = this._stopCallback;
-    this._stopCallback = null;
-    try
-    {
-      callback();
-    }
-    catch (e)
-    {
-      // not throwing because this is specified as being usually (but not
-      // always) asynchronous
-      dump("!!! error running onStopped callback: " + e + "\n");
-    }
-  },
-
-  /**
-   * Notifies this server that the given connection has been closed.
-   *
-   * @param connection : Connection
-   *   the connection that was closed
-   */
-  _connectionClosed: function(connection)
-  {
-    NS_ASSERT(connection.number in this._connections,
-              "closing a connection " + this + " that we never added to the " +
-              "set of open connections?");
-    NS_ASSERT(this._connections[connection.number] === connection,
-              "connection number mismatch?  " +
-              this._connections[connection.number]);
-    delete this._connections[connection.number];
-
-    // Fire a pending server-stopped notification if it's our responsibility.
-    if (!this._hasOpenConnections() && this._socketClosed)
-      this._notifyStopped();
-    // Bug 508125: Add a GC here else we'll use gigabytes of memory running
-    // mochitests. We can't rely on xpcshell doing an automated GC, as that
-    // would interfere with testing GC stuff...
-    gc();
-  },
-
-  /**
-   * Requests that the server be shut down when possible.
-   */
-  _requestQuit: function()
-  {
-    dumpn(">>> requesting a quit");
-    dumpStack();
-    this._doQuit = true;
-  }
-};
-
-
-//
-// RFC 2396 section 3.2.2:
-//
-// host        = hostname | IPv4address
-// hostname    = *( domainlabel "." ) toplabel [ "." ]
-// domainlabel = alphanum | alphanum *( alphanum | "-" ) alphanum
-// toplabel    = alpha | alpha *( alphanum | "-" ) alphanum
-// IPv4address = 1*digit "." 1*digit "." 1*digit "." 1*digit
-//
-
-const HOST_REGEX =
-  new RegExp("^(?:" +
-               // *( domainlabel "." )
-               "(?:[a-z0-9](?:[a-z0-9-]*[a-z0-9])?\\.)*" +
-               // toplabel
-               "[a-z](?:[a-z0-9-]*[a-z0-9])?" +
-             "|" +
-               // IPv4 address 
-               "\\d+\\.\\d+\\.\\d+\\.\\d+" +
-             ")$",
-             "i");
-
-
-/**
- * Represents the identity of a server.  An identity consists of a set of
- * (scheme, host, port) tuples denoted as locations (allowing a single server to
- * serve multiple sites or to be used behind both HTTP and HTTPS proxies for any
- * host/port).  Any incoming request must be to one of these locations, or it
- * will be rejected with an HTTP 400 error.  One location, denoted as the
- * primary location, is the location assigned in contexts where a location
- * cannot otherwise be endogenously derived, such as for HTTP/1.0 requests.
- *
- * A single identity may contain at most one location per unique host/port pair;
- * other than that, no restrictions are placed upon what locations may
- * constitute an identity.
- */
-function ServerIdentity()
-{
-  /** The scheme of the primary location. */
-  this._primaryScheme = "http";
-
-  /** The hostname of the primary location. */
-  this._primaryHost = "127.0.0.1"
-
-  /** The port number of the primary location. */
-  this._primaryPort = -1;
-
-  /**
-   * The current port number for the corresponding server, stored so that a new
-   * primary location can always be set if the current one is removed.
-   */
-  this._defaultPort = -1;
-
-  /**
-   * Maps hosts to maps of ports to schemes, e.g. the following would represent
-   * https://example.com:789/ and http://example.org/:
-   *
-   *   {
-   *     "xexample.com": { 789: "https" },
-   *     "xexample.org": { 80: "http" }
-   *   }
-   *
-   * Note the "x" prefix on hostnames, which prevents collisions with special
-   * JS names like "prototype".
-   */
-  this._locations = { "xlocalhost": {} };
-}
-ServerIdentity.prototype =
-{
-  // NSIHTTPSERVERIDENTITY
-
-  //
-  // see nsIHttpServerIdentity.primaryScheme
-  //
-  get primaryScheme()
-  {
-    if (this._primaryPort === -1)
-      throw Cr.NS_ERROR_NOT_INITIALIZED;
-    return this._primaryScheme;
-  },
-
-  //
-  // see nsIHttpServerIdentity.primaryHost
-  //
-  get primaryHost()
-  {
-    if (this._primaryPort === -1)
-      throw Cr.NS_ERROR_NOT_INITIALIZED;
-    return this._primaryHost;
-  },
-
-  //
-  // see nsIHttpServerIdentity.primaryPort
-  //
-  get primaryPort()
-  {
-    if (this._primaryPort === -1)
-      throw Cr.NS_ERROR_NOT_INITIALIZED;
-    return this._primaryPort;
-  },
-
-  //
-  // see nsIHttpServerIdentity.add
-  //
-  add: function(scheme, host, port)
-  {
-    this._validate(scheme, host, port);
-
-    var entry = this._locations["x" + host];
-    if (!entry)
-      this._locations["x" + host] = entry = {};
-
-    entry[port] = scheme;
-  },
-
-  //
-  // see nsIHttpServerIdentity.remove
-  //
-  remove: function(scheme, host, port)
-  {
-    this._validate(scheme, host, port);
-
-    var entry = this._locations["x" + host];
-    if (!entry)
-      return false;
-
-    var present = port in entry;
-    delete entry[port];
-
-    if (this._primaryScheme == scheme &&
-        this._primaryHost == host &&
-        this._primaryPort == port &&
-        this._defaultPort !== -1)
-    {
-      // Always keep at least one identity in existence at any time, unless
-      // we're in the process of shutting down (the last condition above).
-      this._primaryPort = -1;
-      this._initialize(this._defaultPort, host, false);
-    }
-
-    return present;
-  },
-
-  //
-  // see nsIHttpServerIdentity.has
-  //
-  has: function(scheme, host, port)
-  {
-    this._validate(scheme, host, port);
-
-    return "x" + host in this._locations &&
-           scheme === this._locations["x" + host][port];
-  },
-
-  //
-  // see nsIHttpServerIdentity.has
-  //
-  getScheme: function(host, port)
-  {
-    this._validate("http", host, port);
-
-    var entry = this._locations["x" + host];
-    if (!entry)
-      return "";
-
-    return entry[port] || "";
-  },
-
-  //
-  // see nsIHttpServerIdentity.setPrimary
-  //
-  setPrimary: function(scheme, host, port)
-  {
-    this._validate(scheme, host, port);
-
-    this.add(scheme, host, port);
-
-    this._primaryScheme = scheme;
-    this._primaryHost = host;
-    this._primaryPort = port;
-  },
-
-
-  // NSISUPPORTS
-
-  //
-  // see nsISupports.QueryInterface
-  //
-  QueryInterface: function(iid)
-  {
-    if (iid.equals(Ci.nsIHttpServerIdentity) || iid.equals(Ci.nsISupports))
-      return this;
-
-    throw Cr.NS_ERROR_NO_INTERFACE;
-  },
-
-
-  // PRIVATE IMPLEMENTATION
-
-  /**
-   * Initializes the primary name for the corresponding server, based on the
-   * provided port number.
-   */
-  _initialize: function(port, host, addSecondaryDefault)
-  {
-    this._host = host;
-    if (this._primaryPort !== -1)
-      this.add("http", host, port);
-    else
-      this.setPrimary("http", "localhost", port);
-    this._defaultPort = port;
-
-    // Only add this if we're being called at server startup
-    if (addSecondaryDefault && host != "127.0.0.1")
-      this.add("http", "127.0.0.1", port);
-  },
-
-  /**
-   * Called at server shutdown time, unsets the primary location only if it was
-   * the default-assigned location and removes the default location from the
-   * set of locations used.
-   */
-  _teardown: function()
-  {
-    if (this._host != "127.0.0.1") {
-      // Not the default primary location, nothing special to do here
-      this.remove("http", "127.0.0.1", this._defaultPort);
-    }
-    
-    // This is a *very* tricky bit of reasoning here; make absolutely sure the
-    // tests for this code pass before you commit changes to it.
-    if (this._primaryScheme == "http" &&
-        this._primaryHost == this._host &&
-        this._primaryPort == this._defaultPort)
-    {
-      // Make sure we don't trigger the readding logic in .remove(), then remove
-      // the default location.
-      var port = this._defaultPort;
-      this._defaultPort = -1;
-      this.remove("http", this._host, port);
-
-      // Ensure a server start triggers the setPrimary() path in ._initialize()
-      this._primaryPort = -1;
-    }
-    else
-    {
-      // No reason not to remove directly as it's not our primary location
-      this.remove("http", this._host, this._defaultPort);
-    }
-  },
-
-  /**
-   * Ensures scheme, host, and port are all valid with respect to RFC 2396.
-   *
-   * @throws NS_ERROR_ILLEGAL_VALUE
-   *   if any argument doesn't match the corresponding production
-   */
-  _validate: function(scheme, host, port)
-  {
-    if (scheme !== "http" && scheme !== "https")
-    {
-      dumpn("*** server only supports http/https schemes: '" + scheme + "'");
-      dumpStack();
-      throw Cr.NS_ERROR_ILLEGAL_VALUE;
-    }
-    if (!HOST_REGEX.test(host))
-    {
-      dumpn("*** unexpected host: '" + host + "'");
-      throw Cr.NS_ERROR_ILLEGAL_VALUE;
-    }
-    if (port < 0 || port > 65535)
-    {
-      dumpn("*** unexpected port: '" + port + "'");
-      throw Cr.NS_ERROR_ILLEGAL_VALUE;
-    }
-  }
-};
-
-
-/**
- * Represents a connection to the server (and possibly in the future the thread
- * on which the connection is processed).
- *
- * @param input : nsIInputStream
- *   stream from which incoming data on the connection is read
- * @param output : nsIOutputStream
- *   stream to write data out the connection
- * @param server : nsHttpServer
- *   the server handling the connection
- * @param port : int
- *   the port on which the server is running
- * @param outgoingPort : int
- *   the outgoing port used by this connection
- * @param number : uint
- *   a serial number used to uniquely identify this connection
- */
-function Connection(input, output, server, port, outgoingPort, number)
-{
-  dumpn("*** opening new connection " + number + " on port " + outgoingPort);
-
-  /** Stream of incoming data. */
-  this.input = input;
-
-  /** Stream for outgoing data. */
-  this.output = output;
-
-  /** The server associated with this request. */
-  this.server = server;
-
-  /** The port on which the server is running. */
-  this.port = port;
-
-  /** The outgoing poort used by this connection. */
-  this._outgoingPort = outgoingPort;
-
-  /** The serial number of this connection. */
-  this.number = number;
-
-  /**
-   * The request for which a response is being generated, null if the
-   * incoming request has not been fully received or if it had errors.
-   */
-  this.request = null;
-
-  /** State variables for debugging. */
-  this._closed = this._processed = false;
-}
-Connection.prototype =
-{
-  /** Closes this connection's input/output streams. */
-  close: function()
-  {
-    dumpn("*** closing connection " + this.number +
-          " on port " + this._outgoingPort);
-
-    this.input.close();
-    this.output.close();
-    this._closed = true;
-
-    var server = this.server;
-    server._connectionClosed(this);
-
-    // If an error triggered a server shutdown, act on it now
-    if (server._doQuit)
-      server.stop(function() { /* not like we can do anything better */ });
-  },
-
-  /**
-   * Initiates processing of this connection, using the data in the given
-   * request.
-   *
-   * @param request : Request
-   *   the request which should be processed
-   */
-  process: function(request)
-  {
-    NS_ASSERT(!this._closed && !this._processed);
-
-    this._processed = true;
-
-    this.request = request;
-    this.server._handler.handleResponse(this);
-  },
-
-  /**
-   * Initiates processing of this connection, generating a response with the
-   * given HTTP error code.
-   *
-   * @param code : uint
-   *   an HTTP code, so in the range [0, 1000)
-   * @param request : Request
-   *   incomplete data about the incoming request (since there were errors
-   *   during its processing
-   */
-  processError: function(code, request)
-  {
-    NS_ASSERT(!this._closed && !this._processed);
-
-    this._processed = true;
-    this.request = request;
-    this.server._handler.handleError(code, this);
-  },
-
-  /** Converts this to a string for debugging purposes. */
-  toString: function()
-  {
-    return "<Connection(" + this.number +
-           (this.request ? ", " + this.request.path : "") +"): " +
-           (this._closed ? "closed" : "open") + ">";
-  }
-};
-
-
-
-/** Returns an array of count bytes from the given input stream. */
-function readBytes(inputStream, count)
-{
-  return new BinaryInputStream(inputStream).readByteArray(count);
-}
-
-
-
-/** Request reader processing states; see RequestReader for details. */
-const READER_IN_REQUEST_LINE = 0;
-const READER_IN_HEADERS      = 1;
-const READER_IN_BODY         = 2;
-const READER_FINISHED        = 3;
-
-
-/**
- * Reads incoming request data asynchronously, does any necessary preprocessing,
- * and forwards it to the request handler.  Processing occurs in three states:
- *
- *   READER_IN_REQUEST_LINE     Reading the request's status line
- *   READER_IN_HEADERS          Reading headers in the request
- *   READER_IN_BODY             Reading the body of the request
- *   READER_FINISHED            Entire request has been read and processed
- *
- * During the first two stages, initial metadata about the request is gathered
- * into a Request object.  Once the status line and headers have been processed,
- * we start processing the body of the request into the Request.  Finally, when
- * the entire body has been read, we create a Response and hand it off to the
- * ServerHandler to be given to the appropriate request handler.
- *
- * @param connection : Connection
- *   the connection for the request being read
- */
-function RequestReader(connection)
-{
-  /** Connection metadata for this request. */
-  this._connection = connection;
-
-  /**
-   * A container providing line-by-line access to the raw bytes that make up the
-   * data which has been read from the connection but has not yet been acted
-   * upon (by passing it to the request handler or by extracting request
-   * metadata from it).
-   */
-  this._data = new LineData();
-
-  /**
-   * The amount of data remaining to be read from the body of this request.
-   * After all headers in the request have been read this is the value in the
-   * Content-Length header, but as the body is read its value decreases to zero.
-   */
-  this._contentLength = 0;
-
-  /** The current state of parsing the incoming request. */
-  this._state = READER_IN_REQUEST_LINE;
-
-  /** Metadata constructed from the incoming request for the request handler. */
-  this._metadata = new Request(connection.port);
-
-  /**
-   * Used to preserve state if we run out of line data midway through a
-   * multi-line header.  _lastHeaderName stores the name of the header, while
-   * _lastHeaderValue stores the value we've seen so far for the header.
-   *
-   * These fields are always either both undefined or both strings.
-   */
-  this._lastHeaderName = this._lastHeaderValue = undefined;
-}
-RequestReader.prototype =
-{
-  // NSIINPUTSTREAMCALLBACK
-
-  /**
-   * Called when more data from the incoming request is available.  This method
-   * then reads the available data from input and deals with that data as
-   * necessary, depending upon the syntax of already-downloaded data.
-   *
-   * @param input : nsIAsyncInputStream
-   *   the stream of incoming data from the connection
-   */
-  onInputStreamReady: function(input)
-  {
-    dumpn("*** onInputStreamReady(input=" + input + ") on thread " +
-          gThreadManager.currentThread + " (main is " +
-          gThreadManager.mainThread + ")");
-    dumpn("*** this._state == " + this._state);
-
-    // Handle cases where we get more data after a request error has been
-    // discovered but *before* we can close the connection.
-    var data = this._data;
-    if (!data)
-      return;
-
-    try
-    {
-      data.appendBytes(readBytes(input, input.available()));
-    }
-    catch (e)
-    {
-      if (streamClosed(e))
-      {
-        dumpn("*** WARNING: unexpected error when reading from socket; will " +
-              "be treated as if the input stream had been closed");
-        dumpn("*** WARNING: actual error was: " + e);
-      }
-
-      // We've lost a race -- input has been closed, but we're still expecting
-      // to read more data.  available() will throw in this case, and since
-      // we're dead in the water now, destroy the connection.
-      dumpn("*** onInputStreamReady called on a closed input, destroying " +
-            "connection");
-      this._connection.close();
-      return;
-    }
-
-    switch (this._state)
-    {
-      default:
-        NS_ASSERT(false, "invalid state: " + this._state);
-        break;
-
-      case READER_IN_REQUEST_LINE:
-        if (!this._processRequestLine())
-          break;
-        /* fall through */
-
-      case READER_IN_HEADERS:
-        if (!this._processHeaders())
-          break;
-        /* fall through */
-
-      case READER_IN_BODY:
-        this._processBody();
-    }
-
-    if (this._state != READER_FINISHED)
-      input.asyncWait(this, 0, 0, gThreadManager.currentThread);
-  },
-
-  //
-  // see nsISupports.QueryInterface
-  //
-  QueryInterface: function(aIID)
-  {
-    if (aIID.equals(Ci.nsIInputStreamCallback) ||
-        aIID.equals(Ci.nsISupports))
-      return this;
-
-    throw Cr.NS_ERROR_NO_INTERFACE;
-  },
-
-
-  // PRIVATE API
-
-  /**
-   * Processes unprocessed, downloaded data as a request line.
-   *
-   * @returns boolean
-   *   true iff the request line has been fully processed
-   */
-  _processRequestLine: function()
-  {
-    NS_ASSERT(this._state == READER_IN_REQUEST_LINE);
-
-    // Servers SHOULD ignore any empty line(s) received where a Request-Line
-    // is expected (section 4.1).
-    var data = this._data;
-    var line = {};
-    var readSuccess;
-    while ((readSuccess = data.readLine(line)) && line.value == "")
-      dumpn("*** ignoring beginning blank line...");
-
-    // if we don't have a full line, wait until we do
-    if (!readSuccess)
-      return false;
-
-    // we have the first non-blank line
-    try
-    {
-      this._parseRequestLine(line.value);
-      this._state = READER_IN_HEADERS;
-      return true;
-    }
-    catch (e)
-    {
-      this._handleError(e);
-      return false;
-    }
-  },
-
-  /**
-   * Processes stored data, assuming it is either at the beginning or in
-   * the middle of processing request headers.
-   *
-   * @returns boolean
-   *   true iff header data in the request has been fully processed
-   */
-  _processHeaders: function()
-  {
-    NS_ASSERT(this._state == READER_IN_HEADERS);
-
-    // XXX things to fix here:
-    //
-    // - need to support RFC 2047-encoded non-US-ASCII characters
-
-    try
-    {
-      var done = this._parseHeaders();
-      if (done)
-      {
-        var request = this._metadata;
-
-        // XXX this is wrong for requests with transfer-encodings applied to
-        //     them, particularly chunked (which by its nature can have no
-        //     meaningful Content-Length header)!
-        this._contentLength = request.hasHeader("Content-Length")
-                            ? parseInt(request.getHeader("Content-Length"), 10)
-                            : 0;
-        dumpn("_processHeaders, Content-length=" + this._contentLength);
-
-        this._state = READER_IN_BODY;
-      }
-      return done;
-    }
-    catch (e)
-    {
-      this._handleError(e);
-      return false;
-    }
-  },
-
-  /**
-   * Processes stored data, assuming it is either at the beginning or in
-   * the middle of processing the request body.
-   *
-   * @returns boolean
-   *   true iff the request body has been fully processed
-   */
-  _processBody: function()
-  {
-    NS_ASSERT(this._state == READER_IN_BODY);
-
-    // XXX handle chunked transfer-coding request bodies!
-
-    try
-    {
-      if (this._contentLength > 0)
-      {
-        var data = this._data.purge();
-        var count = Math.min(data.length, this._contentLength);
-        dumpn("*** loading data=" + data + " len=" + data.length +
-              " excess=" + (data.length - count));
-
-        var bos = new BinaryOutputStream(this._metadata._bodyOutputStream);
-        bos.writeByteArray(data, count);
-        this._contentLength -= count;
-      }
-
-      dumpn("*** remaining body data len=" + this._contentLength);
-      if (this._contentLength == 0)
-      {
-        this._validateRequest();
-        this._state = READER_FINISHED;
-        this._handleResponse();
-        return true;
-      }
-      
-      return false;
-    }
-    catch (e)
-    {
-      this._handleError(e);
-      return false;
-    }
-  },
-
-  /**
-   * Does various post-header checks on the data in this request.
-   *
-   * @throws : HttpError
-   *   if the request was malformed in some way
-   */
-  _validateRequest: function()
-  {
-    NS_ASSERT(this._state == READER_IN_BODY);
-
-    dumpn("*** _validateRequest");
-
-    var metadata = this._metadata;
-    var headers = metadata._headers;
-
-    // 19.6.1.1 -- servers MUST report 400 to HTTP/1.1 requests w/o Host header
-    var identity = this._connection.server.identity;
-    if (metadata._httpVersion.atLeast(nsHttpVersion.HTTP_1_1))
-    {
-      if (!headers.hasHeader("Host"))
-      {
-        dumpn("*** malformed HTTP/1.1 or greater request with no Host header!");
-        throw HTTP_400;
-      }
-
-      // If the Request-URI wasn't absolute, then we need to determine our host.
-      // We have to determine what scheme was used to access us based on the
-      // server identity data at this point, because the request just doesn't
-      // contain enough data on its own to do this, sadly.
-      if (!metadata._host)
-      {
-        var host, port;
-        var hostPort = headers.getHeader("Host");
-        var colon = hostPort.indexOf(":");
-        if (colon < 0)
-        {
-          host = hostPort;
-          port = "";
-        }
-        else
-        {
-          host = hostPort.substring(0, colon);
-          port = hostPort.substring(colon + 1);
-        }
-
-        // NB: We allow an empty port here because, oddly, a colon may be
-        //     present even without a port number, e.g. "example.com:"; in this
-        //     case the default port applies.
-        if (!HOST_REGEX.test(host) || !/^\d*$/.test(port))
-        {
-          dumpn("*** malformed hostname (" + hostPort + ") in Host " +
-                "header, 400 time");
-          throw HTTP_400;
-        }
-
-        // If we're not given a port, we're stuck, because we don't know what
-        // scheme to use to look up the correct port here, in general.  Since
-        // the HTTPS case requires a tunnel/proxy and thus requires that the
-        // requested URI be absolute (and thus contain the necessary
-        // information), let's assume HTTP will prevail and use that.
-        port = +port || 80;
-
-        var scheme = identity.getScheme(host, port);
-        if (!scheme)
-        {
-          dumpn("*** unrecognized hostname (" + hostPort + ") in Host " +
-                "header, 400 time");
-          throw HTTP_400;
-        }
-
-        metadata._scheme = scheme;
-        metadata._host = host;
-        metadata._port = port;
-      }
-    }
-    else
-    {
-      NS_ASSERT(metadata._host === undefined,
-                "HTTP/1.0 doesn't allow absolute paths in the request line!");
-
-      metadata._scheme = identity.primaryScheme;
-      metadata._host = identity.primaryHost;
-      metadata._port = identity.primaryPort;
-    }
-
-    NS_ASSERT(identity.has(metadata._scheme, metadata._host, metadata._port),
-              "must have a location we recognize by now!");
-  },
-
-  /**
-   * Handles responses in case of error, either in the server or in the request.
-   *
-   * @param e
-   *   the specific error encountered, which is an HttpError in the case where
-   *   the request is in some way invalid or cannot be fulfilled; if this isn't
-   *   an HttpError we're going to be paranoid and shut down, because that
-   *   shouldn't happen, ever
-   */
-  _handleError: function(e)
-  {
-    // Don't fall back into normal processing!
-    this._state = READER_FINISHED;
-
-    var server = this._connection.server;
-    if (e instanceof HttpError)
-    {
-      var code = e.code;
-    }
-    else
-    {
-      dumpn("!!! UNEXPECTED ERROR: " + e +
-            (e.lineNumber ? ", line " + e.lineNumber : ""));
-
-      // no idea what happened -- be paranoid and shut down
-      code = 500;
-      server._requestQuit();
-    }
-
-    // make attempted reuse of data an error
-    this._data = null;
-
-    this._connection.processError(code, this._metadata);
-  },
-
-  /**
-   * Now that we've read the request line and headers, we can actually hand off
-   * the request to be handled.
-   *
-   * This method is called once per request, after the request line and all
-   * headers and the body, if any, have been received.
-   */
-  _handleResponse: function()
-  {
-    NS_ASSERT(this._state == READER_FINISHED);
-
-    // We don't need the line-based data any more, so make attempted reuse an
-    // error.
-    this._data = null;
-
-    this._connection.process(this._metadata);
-  },
-
-
-  // PARSING
-
-  /**
-   * Parses the request line for the HTTP request associated with this.
-   *
-   * @param line : string
-   *   the request line
-   */
-  _parseRequestLine: function(line)
-  {
-    NS_ASSERT(this._state == READER_IN_REQUEST_LINE);
-
-    dumpn("*** _parseRequestLine('" + line + "')");
-
-    var metadata = this._metadata;
-
-    // clients and servers SHOULD accept any amount of SP or HT characters
-    // between fields, even though only a single SP is required (section 19.3)
-    var request = line.split(/[ \t]+/);
-    if (!request || request.length != 3)
-      throw HTTP_400;
-
-    metadata._method = request[0];
-
-    // get the HTTP version
-    var ver = request[2];
-    var match = ver.match(/^HTTP\/(\d+\.\d+)$/);
-    if (!match)
-      throw HTTP_400;
-
-    // determine HTTP version
-    try
-    {
-      metadata._httpVersion = new nsHttpVersion(match[1]);
-      if (!metadata._httpVersion.atLeast(nsHttpVersion.HTTP_1_0))
-        throw "unsupported HTTP version";
-    }
-    catch (e)
-    {
-      // we support HTTP/1.0 and HTTP/1.1 only
-      throw HTTP_501;
-    }
-
-
-    var fullPath = request[1];
-    var serverIdentity = this._connection.server.identity;
-
-    var scheme, host, port;
-
-    if (fullPath.charAt(0) != "/")
-    {
-      // No absolute paths in the request line in HTTP prior to 1.1
-      if (!metadata._httpVersion.atLeast(nsHttpVersion.HTTP_1_1))
-        throw HTTP_400;
-
-      try
-      {
-        var uri = Cc["@mozilla.org/network/io-service;1"]
-                    .getService(Ci.nsIIOService)
-                    .newURI(fullPath, null, null);
-        fullPath = uri.path;
-        scheme = uri.scheme;
-        host = metadata._host = uri.asciiHost;
-        port = uri.port;
-        if (port === -1)
-        {
-          if (scheme === "http")
-            port = 80;
-          else if (scheme === "https")
-            port = 443;
-          else
-            throw HTTP_400;
-        }
-      }
-      catch (e)
-      {
-        // If the host is not a valid host on the server, the response MUST be a
-        // 400 (Bad Request) error message (section 5.2).  Alternately, the URI
-        // is malformed.
-        throw HTTP_400;
-      }
-
-      if (!serverIdentity.has(scheme, host, port) || fullPath.charAt(0) != "/")
-        throw HTTP_400;
-    }
-
-    var splitter = fullPath.indexOf("?");
-    if (splitter < 0)
-    {
-      // _queryString already set in ctor
-      metadata._path = fullPath;
-    }
-    else
-    {
-      metadata._path = fullPath.substring(0, splitter);
-      metadata._queryString = fullPath.substring(splitter + 1);
-    }
-
-    metadata._scheme = scheme;
-    metadata._host = host;
-    metadata._port = port;
-  },
-
-  /**
-   * Parses all available HTTP headers in this until the header-ending CRLFCRLF,
-   * adding them to the store of headers in the request.
-   *
-   * @throws
-   *   HTTP_400 if the headers are malformed
-   * @returns boolean
-   *   true if all headers have now been processed, false otherwise
-   */
-  _parseHeaders: function()
-  {
-    NS_ASSERT(this._state == READER_IN_HEADERS);
-
-    dumpn("*** _parseHeaders");
-
-    var data = this._data;
-
-    var headers = this._metadata._headers;
-    var lastName = this._lastHeaderName;
-    var lastVal = this._lastHeaderValue;
-
-    var line = {};
-    while (true)
-    {
-      NS_ASSERT(!((lastVal === undefined) ^ (lastName === undefined)),
-                lastName === undefined ?
-                  "lastVal without lastName?  lastVal: '" + lastVal + "'" :
-                  "lastName without lastVal?  lastName: '" + lastName + "'");
-
-      if (!data.readLine(line))
-      {
-        // save any data we have from the header we might still be processing
-        this._lastHeaderName = lastName;
-        this._lastHeaderValue = lastVal;
-        return false;
-      }
-
-      var lineText = line.value;
-      var firstChar = lineText.charAt(0);
-
-      // blank line means end of headers
-      if (lineText == "")
-      {
-        // we're finished with the previous header
-        if (lastName)
-        {
-          try
-          {
-            headers.setHeader(lastName, lastVal, true);
-          }
-          catch (e)
-          {
-            dumpn("*** e == " + e);
-            throw HTTP_400;
-          }
-        }
-        else
-        {
-          // no headers in request -- valid for HTTP/1.0 requests
-        }
-
-        // either way, we're done processing headers
-        this._state = READER_IN_BODY;
-        return true;
-      }
-      else if (firstChar == " " || firstChar == "\t")
-      {
-        // multi-line header if we've already seen a header line
-        if (!lastName)
-        {
-          // we don't have a header to continue!
-          throw HTTP_400;
-        }
-
-        // append this line's text to the value; starts with SP/HT, so no need
-        // for separating whitespace
-        lastVal += lineText;
-      }
-      else
-      {
-        // we have a new header, so set the old one (if one existed)
-        if (lastName)
-        {
-          try
-          {
-            headers.setHeader(lastName, lastVal, true);
-          }
-          catch (e)
-          {
-            dumpn("*** e == " + e);
-            throw HTTP_400;
-          }
-        }
-
-        var colon = lineText.indexOf(":"); // first colon must be splitter
-        if (colon < 1)
-        {
-          // no colon or missing header field-name
-          throw HTTP_400;
-        }
-
-        // set header name, value (to be set in the next loop, usually)
-        lastName = lineText.substring(0, colon);
-        lastVal = lineText.substring(colon + 1);
-      } // empty, continuation, start of header
-    } // while (true)
-  }
-};
-
-
-/** The character codes for CR and LF. */
-const CR = 0x0D, LF = 0x0A;
-
-/**
- * Calculates the number of characters before the first CRLF pair in array, or
- * -1 if the array contains no CRLF pair.
- *
- * @param array : Array
- *   an array of numbers in the range [0, 256), each representing a single
- *   character; the first CRLF is the lowest index i where
- *   |array[i] == "\r".charCodeAt(0)| and |array[i+1] == "\n".charCodeAt(0)|,
- *   if such an |i| exists, and -1 otherwise
- * @param start : uint
- *   start index from which to begin searching in array
- * @returns int
- *   the index of the first CRLF if any were present, -1 otherwise
- */
-function findCRLF(array, start)
-{
-  for (var i = array.indexOf(CR, start); i >= 0; i = array.indexOf(CR, i + 1))
-  {
-    if (array[i + 1] == LF)
-      return i;
-  }
-  return -1;
-}
-
-
-/**
- * A container which provides line-by-line access to the arrays of bytes with
- * which it is seeded.
- */
-function LineData()
-{
-  /** An array of queued bytes from which to get line-based characters. */
-  this._data = [];
-
-  /** Start index from which to search for CRLF. */
-  this._start = 0;
-}
-LineData.prototype =
-{
-  /**
-   * Appends the bytes in the given array to the internal data cache maintained
-   * by this.
-   */
-  appendBytes: function(bytes)
-  {
-    var count = bytes.length;
-    var quantum = 262144; // just above half SpiderMonkey's argument-count limit
-    if (count < quantum)
-    {
-      Array.prototype.push.apply(this._data, bytes);
-      return;
-    }
-
-    // Large numbers of bytes may cause Array.prototype.push to be called with
-    // more arguments than the JavaScript engine supports.  In that case append
-    // bytes in fixed-size amounts until all bytes are appended.
-    for (var start = 0; start < count; start += quantum)
-    {
-      var slice = bytes.slice(start, Math.min(start + quantum, count));
-      Array.prototype.push.apply(this._data, slice);
-    }
-  },
-
-  /**
-   * Removes and returns a line of data, delimited by CRLF, from this.
-   *
-   * @param out
-   *   an object whose "value" property will be set to the first line of text
-   *   present in this, sans CRLF, if this contains a full CRLF-delimited line
-   *   of text; if this doesn't contain enough data, the value of the property
-   *   is undefined
-   * @returns boolean
-   *   true if a full line of data could be read from the data in this, false
-   *   otherwise
-   */
-  readLine: function(out)
-  {
-    var data = this._data;
-    var length = findCRLF(data, this._start);
-    if (length < 0)
-    {
-      this._start = data.length;
-      return false;
-    }
-
-    // Reset for future lines.
-    this._start = 0;
-
-    //
-    // We have the index of the CR, so remove all the characters, including
-    // CRLF, from the array with splice, and convert the removed array
-    // (excluding the trailing CRLF characters) into the corresponding string.
-    //
-    var leading = data.splice(0, length + 2);
-    var quantum = 262144;
-    var line = "";
-    for (var start = 0; start < length; start += quantum)
-    {
-      var slice = leading.slice(start, Math.min(start + quantum, length));
-      line += String.fromCharCode.apply(null, slice);
-    }
-
-    out.value = line;
-    return true;
-  },
-
-  /**
-   * Removes the bytes currently within this and returns them in an array.
-   *
-   * @returns Array
-   *   the bytes within this when this method is called
-   */
-  purge: function()
-  {
-    var data = this._data;
-    this._data = [];
-    return data;
-  }
-};
-
-
-
-/**
- * Creates a request-handling function for an nsIHttpRequestHandler object.
- */
-function createHandlerFunc(handler)
-{
-  return function(metadata, response) { handler.handle(metadata, response); };
-}
-
-
-/**
- * The default handler for directories; writes an HTML response containing a
- * slightly-formatted directory listing.
- */
-function defaultIndexHandler(metadata, response)
-{
-  response.setHeader("Content-Type", "text/html", false);
-
-  var path = htmlEscape(decodeURI(metadata.path));
-
-  //
-  // Just do a very basic bit of directory listings -- no need for too much
-  // fanciness, especially since we don't have a style sheet in which we can
-  // stick rules (don't want to pollute the default path-space).
-  //
-
-  var body = '<html>\
-                <head>\
-                  <title>' + path + '</title>\
-                </head>\
-                <body>\
-                  <h1>' + path + '</h1>\
-                  <ol style="list-style-type: none">';
-
-  var directory = metadata.getProperty("directory");
-  NS_ASSERT(directory && directory.isDirectory());
-
-  var fileList = [];
-  var files = directory.directoryEntries;
-  while (files.hasMoreElements())
-  {
-    var f = files.getNext().QueryInterface(Ci.nsIFile);
-    var name = f.leafName;
-    if (!f.isHidden() &&
-        (name.charAt(name.length - 1) != HIDDEN_CHAR ||
-         name.charAt(name.length - 2) == HIDDEN_CHAR))
-      fileList.push(f);
-  }
-
-  fileList.sort(fileSort);
-
-  for (var i = 0; i < fileList.length; i++)
-  {
-    var file = fileList[i];
-    try
-    {
-      var name = file.leafName;
-      if (name.charAt(name.length - 1) == HIDDEN_CHAR)
-        name = name.substring(0, name.length - 1);
-      var sep = file.isDirectory() ? "/" : "";
-
-      // Note: using " to delimit the attribute here because encodeURIComponent
-      //       passes through '.
-      var item = '<li><a href="' + encodeURIComponent(name) + sep + '">' +
-                   htmlEscape(name) + sep +
-                 '</a></li>';
-
-      body += item;
-    }
-    catch (e) { /* some file system error, ignore the file */ }
-  }
-
-  body    += '    </ol>\
-                </body>\
-              </html>';
-
-  response.bodyOutputStream.write(body, body.length);
-}
-
-/**
- * Sorts a and b (nsIFile objects) into an aesthetically pleasing order.
- */
-function fileSort(a, b)
-{
-  var dira = a.isDirectory(), dirb = b.isDirectory();
-
-  if (dira && !dirb)
-    return -1;
-  if (dirb && !dira)
-    return 1;
-
-  var namea = a.leafName.toLowerCase(), nameb = b.leafName.toLowerCase();
-  return nameb > namea ? -1 : 1;
-}
-
-
-/**
- * Converts an externally-provided path into an internal path for use in
- * determining file mappings.
- *
- * @param path
- *   the path to convert
- * @param encoded
- *   true if the given path should be passed through decodeURI prior to
- *   conversion
- * @throws URIError
- *   if path is incorrectly encoded
- */
-function toInternalPath(path, encoded)
-{
-  if (encoded)
-    path = decodeURI(path);
-
-  var comps = path.split("/");
-  for (var i = 0, sz = comps.length; i < sz; i++)
-  {
-    var comp = comps[i];
-    if (comp.charAt(comp.length - 1) == HIDDEN_CHAR)
-      comps[i] = comp + HIDDEN_CHAR;
-  }
-  return comps.join("/");
-}
-
-
-/**
- * Adds custom-specified headers for the given file to the given response, if
- * any such headers are specified.
- *
- * @param file
- *   the file on the disk which is to be written
- * @param metadata
- *   metadata about the incoming request
- * @param response
- *   the Response to which any specified headers/data should be written
- * @throws HTTP_500
- *   if an error occurred while processing custom-specified headers
- */
-function maybeAddHeaders(file, metadata, response)
-{
-  var name = file.leafName;
-  if (name.charAt(name.length - 1) == HIDDEN_CHAR)
-    name = name.substring(0, name.length - 1);
-
-  var headerFile = file.parent;
-  headerFile.append(name + HEADERS_SUFFIX);
-
-  if (!headerFile.exists())
-    return;
-
-  const PR_RDONLY = 0x01;
-  var fis = new FileInputStream(headerFile, PR_RDONLY, 0444,
-                                Ci.nsIFileInputStream.CLOSE_ON_EOF);
-
-  try
-  {
-    var lis = new ConverterInputStream(fis, "UTF-8", 1024, 0x0);
-    lis.QueryInterface(Ci.nsIUnicharLineInputStream);
-
-    var line = {value: ""};
-    var more = lis.readLine(line);
-
-    if (!more && line.value == "")
-      return;
-
-
-    // request line
-
-    var status = line.value;
-    if (status.indexOf("HTTP ") == 0)
-    {
-      status = status.substring(5);
-      var space = status.indexOf(" ");
-      var code, description;
-      if (space < 0)
-      {
-        code = status;
-        description = "";
-      }
-      else
-      {
-        code = status.substring(0, space);
-        description = status.substring(space + 1, status.length);
-      }
-    
-      response.setStatusLine(metadata.httpVersion, parseInt(code, 10), description);
-
-      line.value = "";
-      more = lis.readLine(line);
-    }
-
-    // headers
-    while (more || line.value != "")
-    {
-      var header = line.value;
-      var colon = header.indexOf(":");
-
-      response.setHeader(header.substring(0, colon),
-                         header.substring(colon + 1, header.length),
-                         false); // allow overriding server-set headers
-
-      line.value = "";
-      more = lis.readLine(line);
-    }
-  }
-  catch (e)
-  {
-    dumpn("WARNING: error in headers for " + metadata.path + ": " + e);
-    throw HTTP_500;
-  }
-  finally
-  {
-    fis.close();
-  }
-}
-
-
-/**
- * An object which handles requests for a server, executing default and
- * overridden behaviors as instructed by the code which uses and manipulates it.
- * Default behavior includes the paths / and /trace (diagnostics), with some
- * support for HTTP error pages for various codes and fallback to HTTP 500 if
- * those codes fail for any reason.
- *
- * @param server : nsHttpServer
- *   the server in which this handler is being used
- */
-function ServerHandler(server)
-{
-  // FIELDS
-
-  /**
-   * The nsHttpServer instance associated with this handler.
-   */
-  this._server = server;
-
-  /**
-   * A FileMap object containing the set of path->nsILocalFile mappings for
-   * all directory mappings set in the server (e.g., "/" for /var/www/html/,
-   * "/foo/bar/" for /local/path/, and "/foo/bar/baz/" for /local/path2).
-   *
-   * Note carefully: the leading and trailing "/" in each path (not file) are
-   * removed before insertion to simplify the code which uses this.  You have
-   * been warned!
-   */
-  this._pathDirectoryMap = new FileMap();
-
-  /**
-   * Custom request handlers for the server in which this resides.  Path-handler
-   * pairs are stored as property-value pairs in this property.
-   *
-   * @see ServerHandler.prototype._defaultPaths
-   */
-  this._overridePaths = {};
-  
-  /**
-   * Custom request handlers for the error handlers in the server in which this
-   * resides.  Path-handler pairs are stored as property-value pairs in this
-   * property.
-   *
-   * @see ServerHandler.prototype._defaultErrors
-   */
-  this._overrideErrors = {};
-
-  /**
-   * Maps file extensions to their MIME types in the server, overriding any
-   * mapping that might or might not exist in the MIME service.
-   */
-  this._mimeMappings = {};
-
-  /**
-   * The default handler for requests for directories, used to serve directories
-   * when no index file is present.
-   */
-  this._indexHandler = defaultIndexHandler;
-
-  /** Per-path state storage for the server. */
-  this._state = {};
-
-  /** Entire-server state storage. */
-  this._sharedState = {};
-
-  /** Entire-server state storage for nsISupports values. */
-  this._objectState = {};
-}
-ServerHandler.prototype =
-{
-  // PUBLIC API
-
-  /**
-   * Handles a request to this server, responding to the request appropriately
-   * and initiating server shutdown if necessary.
-   *
-   * This method never throws an exception.
-   *
-   * @param connection : Connection
-   *   the connection for this request
-   */
-  handleResponse: function(connection)
-  {
-    var request = connection.request;
-    var response = new Response(connection);
-
-    var path = request.path;
-    dumpn("*** path == " + path);
-
-    try
-    {
-      try
-      {
-        if (path in this._overridePaths)
-        {
-          // explicit paths first, then files based on existing directory mappings,
-          // then (if the file doesn't exist) built-in server default paths
-          dumpn("calling override for " + path);
-          this._overridePaths[path](request, response);
-        }
-        else
-        {
-          this._handleDefault(request, response);
-        }
-      }
-      catch (e)
-      {
-        if (response.partiallySent())
-        {
-          response.abort(e);
-          return;
-        }
-
-        if (!(e instanceof HttpError))
-        {
-          dumpn("*** unexpected error: e == " + e);
-          throw HTTP_500;
-        }
-        if (e.code !== 404)
-          throw e;
-
-        dumpn("*** default: " + (path in this._defaultPaths));
-
-        response = new Response(connection);
-        if (path in this._defaultPaths)
-          this._defaultPaths[path](request, response);
-        else
-          throw HTTP_404;
-      }
-    }
-    catch (e)
-    {
-      if (response.partiallySent())
-      {
-        response.abort(e);
-        return;
-      }
-
-      var errorCode = "internal";
-
-      try
-      {
-        if (!(e instanceof HttpError))
-          throw e;
-
-        errorCode = e.code;
-        dumpn("*** errorCode == " + errorCode);
-
-        response = new Response(connection);
-        if (e.customErrorHandling)
-          e.customErrorHandling(response);
-        this._handleError(errorCode, request, response);
-        return;
-      }
-      catch (e2)
-      {
-        dumpn("*** error handling " + errorCode + " error: " +
-              "e2 == " + e2 + ", shutting down server");
-
-        connection.server._requestQuit();
-        response.abort(e2);
-        return;
-      }
-    }
-
-    response.complete();
-  },
-
-  //
-  // see nsIHttpServer.registerFile
-  //
-  registerFile: function(path, file)
-  {
-    if (!file)
-    {
-      dumpn("*** unregistering '" + path + "' mapping");
-      delete this._overridePaths[path];
-      return;
-    }
-
-    dumpn("*** registering '" + path + "' as mapping to " + file.path);
-    file = file.clone();
-
-    var self = this;
-    this._overridePaths[path] =
-      function(request, response)
-      {
-        if (!file.exists())
-          throw HTTP_404;
-
-        response.setStatusLine(request.httpVersion, 200, "OK");
-        self._writeFileResponse(request, file, response, 0, file.fileSize);
-      };
-  },
-
-  //
-  // see nsIHttpServer.registerPathHandler
-  //
-  registerPathHandler: function(path, handler)
-  {
-    // XXX true path validation!
-    if (path.charAt(0) != "/")
-      throw Cr.NS_ERROR_INVALID_ARG;
-
-    this._handlerToField(handler, this._overridePaths, path);
-  },
-
-  //
-  // see nsIHttpServer.registerDirectory
-  //
-  registerDirectory: function(path, directory)
-  {
-    // strip off leading and trailing '/' so that we can use lastIndexOf when
-    // determining exactly how a path maps onto a mapped directory --
-    // conditional is required here to deal with "/".substring(1, 0) being
-    // converted to "/".substring(0, 1) per the JS specification
-    var key = path.length == 1 ? "" : path.substring(1, path.length - 1);
-
-    // the path-to-directory mapping code requires that the first character not
-    // be "/", or it will go into an infinite loop
-    if (key.charAt(0) == "/")
-      throw Cr.NS_ERROR_INVALID_ARG;
-
-    key = toInternalPath(key, false);
-
-    if (directory)
-    {
-      dumpn("*** mapping '" + path + "' to the location " + directory.path);
-      this._pathDirectoryMap.put(key, directory);
-    }
-    else
-    {
-      dumpn("*** removing mapping for '" + path + "'");
-      this._pathDirectoryMap.put(key, null);
-    }
-  },
-
-  //
-  // see nsIHttpServer.registerErrorHandler
-  //
-  registerErrorHandler: function(err, handler)
-  {
-    if (!(err in HTTP_ERROR_CODES))
-      dumpn("*** WARNING: registering non-HTTP/1.1 error code " +
-            "(" + err + ") handler -- was this intentional?");
-
-    this._handlerToField(handler, this._overrideErrors, err);
-  },
-
-  //
-  // see nsIHttpServer.setIndexHandler
-  //
-  setIndexHandler: function(handler)
-  {
-    if (!handler)
-      handler = defaultIndexHandler;
-    else if (typeof(handler) != "function")
-      handler = createHandlerFunc(handler);
-
-    this._indexHandler = handler;
-  },
-
-  //
-  // see nsIHttpServer.registerContentType
-  //
-  registerContentType: function(ext, type)
-  {
-    if (!type)
-      delete this._mimeMappings[ext];
-    else
-      this._mimeMappings[ext] = headerUtils.normalizeFieldValue(type);
-  },
-
-  // PRIVATE API
-
-  /**
-   * Sets or remove (if handler is null) a handler in an object with a key.
-   *
-   * @param handler
-   *   a handler, either function or an nsIHttpRequestHandler
-   * @param dict
-   *   The object to attach the handler to.
-   * @param key
-   *   The field name of the handler.
-   */
-  _handlerToField: function(handler, dict, key)
-  {
-    // for convenience, handler can be a function if this is run from xpcshell
-    if (typeof(handler) == "function")
-      dict[key] = handler;
-    else if (handler)
-      dict[key] = createHandlerFunc(handler);
-    else
-      delete dict[key];
-  },
-
-  /**
-   * Handles a request which maps to a file in the local filesystem (if a base
-   * path has already been set; otherwise the 404 error is thrown).
-   *
-   * @param metadata : Request
-   *   metadata for the incoming request
-   * @param response : Response
-   *   an uninitialized Response to the given request, to be initialized by a
-   *   request handler
-   * @throws HTTP_###
-   *   if an HTTP error occurred (usually HTTP_404); note that in this case the
-   *   calling code must handle post-processing of the response
-   */
-  _handleDefault: function(metadata, response)
-  {
-    dumpn("*** _handleDefault()");
-
-    response.setStatusLine(metadata.httpVersion, 200, "OK");
-
-    var path = metadata.path;
-    NS_ASSERT(path.charAt(0) == "/", "invalid path: <" + path + ">");
-
-    // determine the actual on-disk file; this requires finding the deepest
-    // path-to-directory mapping in the requested URL
-    var file = this._getFileForPath(path);
-
-    // the "file" might be a directory, in which case we either serve the
-    // contained index.html or make the index handler write the response
-    if (file.exists() && file.isDirectory())
-    {
-      file.append("index.html"); // make configurable?
-      if (!file.exists() || file.isDirectory())
-      {
-        metadata._ensurePropertyBag();
-        metadata._bag.setPropertyAsInterface("directory", file.parent);
-        this._indexHandler(metadata, response);
-        return;
-      }
-    }
-
-    // alternately, the file might not exist
-    if (!file.exists())
-      throw HTTP_404;
-
-    var start, end;
-    if (metadata._httpVersion.atLeast(nsHttpVersion.HTTP_1_1) &&
-        metadata.hasHeader("Range") &&
-        this._getTypeFromFile(file) !== SJS_TYPE)
-    {
-      var rangeMatch = metadata.getHeader("Range").match(/^bytes=(\d+)?-(\d+)?$/);
-      if (!rangeMatch)
-        throw HTTP_400;
-
-      if (rangeMatch[1] !== undefined)
-        start = parseInt(rangeMatch[1], 10);
-
-      if (rangeMatch[2] !== undefined)
-        end = parseInt(rangeMatch[2], 10);
-
-      if (start === undefined && end === undefined)
-        throw HTTP_400;
-
-      // No start given, so the end is really the count of bytes from the
-      // end of the file.
-      if (start === undefined)
-      {
-        start = Math.max(0, file.fileSize - end);
-        end   = file.fileSize - 1;
-      }
-
-      // start and end are inclusive
-      if (end === undefined || end >= file.fileSize)
-        end = file.fileSize - 1;
-
-      if (start !== undefined && start >= file.fileSize) {
-        var HTTP_416 = new HttpError(416, "Requested Range Not Satisfiable");
-        HTTP_416.customErrorHandling = function(errorResponse)
-        {
-          maybeAddHeaders(file, metadata, errorResponse);
-        };
-        throw HTTP_416;
-      }
-
-      if (end < start)
-      {
-        response.setStatusLine(metadata.httpVersion, 200, "OK");
-        start = 0;
-        end = file.fileSize - 1;
-      }
-      else
-      {
-        response.setStatusLine(metadata.httpVersion, 206, "Partial Content");
-        var contentRange = "bytes " + start + "-" + end + "/" + file.fileSize;
-        response.setHeader("Content-Range", contentRange);
-      }
-    }
-    else
-    {
-      start = 0;
-      end = file.fileSize - 1;
-    }
-
-    // finally...
-    dumpn("*** handling '" + path + "' as mapping to " + file.path + " from " +
-          start + " to " + end + " inclusive");
-    this._writeFileResponse(metadata, file, response, start, end - start + 1);
-  },
-
-  /**
-   * Writes an HTTP response for the given file, including setting headers for
-   * file metadata.
-   *
-   * @param metadata : Request
-   *   the Request for which a response is being generated
-   * @param file : nsILocalFile
-   *   the file which is to be sent in the response
-   * @param response : Response
-   *   the response to which the file should be written
-   * @param offset: uint
-   *   the byte offset to skip to when writing
-   * @param count: uint
-   *   the number of bytes to write
-   */
-  _writeFileResponse: function(metadata, file, response, offset, count)
-  {
-    const PR_RDONLY = 0x01;
-
-    var type = this._getTypeFromFile(file);
-    if (type === SJS_TYPE)
-    {
-      var fis = new FileInputStream(file, PR_RDONLY, 0444,
-                                    Ci.nsIFileInputStream.CLOSE_ON_EOF);
-
-      try
-      {
-        var sis = new ScriptableInputStream(fis);
-        var s = Cu.Sandbox(gGlobalObject);
-        s.importFunction(dump, "dump");
-
-        // Define a basic key-value state-preservation API across requests, with
-        // keys initially corresponding to the empty string.
-        var self = this;
-        var path = metadata.path;
-        s.importFunction(function getState(k)
-        {
-          return self._getState(path, k);
-        });
-        s.importFunction(function setState(k, v)
-        {
-          self._setState(path, k, v);
-        });
-        s.importFunction(function getSharedState(k)
-        {
-          return self._getSharedState(k);
-        });
-        s.importFunction(function setSharedState(k, v)
-        {
-          self._setSharedState(k, v);
-        });
-        s.importFunction(function getObjectState(k, callback)
-        {
-          callback(self._getObjectState(k));
-        });
-        s.importFunction(function setObjectState(k, v)
-        {
-          self._setObjectState(k, v);
-        });
-        s.importFunction(function registerPathHandler(p, h)
-        {
-          self.registerPathHandler(p, h);
-        });
-
-        // Make it possible for sjs files to access their location
-        this._setState(path, "__LOCATION__", file.path);
-
-        try
-        {
-          // Alas, the line number in errors dumped to console when calling the
-          // request handler is simply an offset from where we load the SJS file.
-          // Work around this in a reasonably non-fragile way by dynamically
-          // getting the line number where we evaluate the SJS file.  Don't
-          // separate these two lines!
-          var line = new Error().lineNumber;
-          Cu.evalInSandbox(sis.read(file.fileSize), s);
-        }
-        catch (e)
-        {
-          dumpn("*** syntax error in SJS at " + file.path + ": " + e);
-          throw HTTP_500;
-        }
-
-        try
-        {
-          s.handleRequest(metadata, response);
-        }
-        catch (e)
-        {
-          dump("*** error running SJS at " + file.path + ": " +
-               e + " on line " +
-               (e instanceof Error
-               ? e.lineNumber + " in httpd.js"
-               : (e.lineNumber - line)) + "\n");
-          throw HTTP_500;
-        }
-      }
-      finally
-      {
-        fis.close();
-      }
-    }
-    else
-    {
-      try
-      {
-        response.setHeader("Last-Modified",
-                           toDateString(file.lastModifiedTime),
-                           false);
-      }
-      catch (e) { /* lastModifiedTime threw, ignore */ }
-
-      response.setHeader("Content-Type", type, false);
-      maybeAddHeaders(file, metadata, response);
-      response.setHeader("Content-Length", "" + count, false);
-
-      var fis = new FileInputStream(file, PR_RDONLY, 0444,
-                                    Ci.nsIFileInputStream.CLOSE_ON_EOF);
-
-      offset = offset || 0;
-      count  = count || file.fileSize;
-      NS_ASSERT(offset === 0 || offset < file.fileSize, "bad offset");
-      NS_ASSERT(count >= 0, "bad count");
-      NS_ASSERT(offset + count <= file.fileSize, "bad total data size");
-
-      try
-      {
-        if (offset !== 0)
-        {
-          // Seek (or read, if seeking isn't supported) to the correct offset so
-          // the data sent to the client matches the requested range.
-          if (fis instanceof Ci.nsISeekableStream)
-            fis.seek(Ci.nsISeekableStream.NS_SEEK_SET, offset);
-          else
-            new ScriptableInputStream(fis).read(offset);
-        }
-      }
-      catch (e)
-      {
-        fis.close();
-        throw e;
-      }
-
-      function writeMore()
-      {
-        gThreadManager.currentThread
-                      .dispatch(writeData, Ci.nsIThread.DISPATCH_NORMAL);
-      }
-
-      var input = new BinaryInputStream(fis);
-      var output = new BinaryOutputStream(response.bodyOutputStream);
-      var writeData =
-        {
-          run: function()
-          {
-            var chunkSize = Math.min(65536, count);
-            count -= chunkSize;
-            NS_ASSERT(count >= 0, "underflow");
-
-            try
-            {
-              var data = input.readByteArray(chunkSize);
-              NS_ASSERT(data.length === chunkSize,
-                        "incorrect data returned?  got " + data.length +
-                        ", expected " + chunkSize);
-              output.writeByteArray(data, data.length);
-              if (count === 0)
-              {
-                fis.close();
-                response.finish();
-              }
-              else
-              {
-                writeMore();
-              }
-            }
-            catch (e)
-            {
-              try
-              {
-                fis.close();
-              }
-              finally
-              {
-                response.finish();
-              }
-              throw e;
-            }
-          }
-        };
-
-      writeMore();
-
-      // Now that we know copying will start, flag the response as async.
-      response.processAsync();
-    }
-  },
-
-  /**
-   * Get the value corresponding to a given key for the given path for SJS state
-   * preservation across requests.
-   *
-   * @param path : string
-   *   the path from which the given state is to be retrieved
-   * @param k : string
-   *   the key whose corresponding value is to be returned
-   * @returns string
-   *   the corresponding value, which is initially the empty string
-   */
-  _getState: function(path, k)
-  {
-    var state = this._state;
-    if (path in state && k in state[path])
-      return state[path][k];
-    return "";
-  },
-
-  /**
-   * Set the value corresponding to a given key for the given path for SJS state
-   * preservation across requests.
-   *
-   * @param path : string
-   *   the path from which the given state is to be retrieved
-   * @param k : string
-   *   the key whose corresponding value is to be set
-   * @param v : string
-   *   the value to be set
-   */
-  _setState: function(path, k, v)
-  {
-    if (typeof v !== "string")
-      throw new Error("non-string value passed");
-    var state = this._state;
-    if (!(path in state))
-      state[path] = {};
-    state[path][k] = v;
-  },
-
-  /**
-   * Get the value corresponding to a given key for SJS state preservation
-   * across requests.
-   *
-   * @param k : string
-   *   the key whose corresponding value is to be returned
-   * @returns string
-   *   the corresponding value, which is initially the empty string
-   */
-  _getSharedState: function(k)
-  {
-    var state = this._sharedState;
-    if (k in state)
-      return state[k];
-    return "";
-  },
-
-  /**
-   * Set the value corresponding to a given key for SJS state preservation
-   * across requests.
-   *
-   * @param k : string
-   *   the key whose corresponding value is to be set
-   * @param v : string
-   *   the value to be set
-   */
-  _setSharedState: function(k, v)
-  {
-    if (typeof v !== "string")
-      throw new Error("non-string value passed");
-    this._sharedState[k] = v;
-  },
-
-  /**
-   * Returns the object associated with the given key in the server for SJS
-   * state preservation across requests.
-   *
-   * @param k : string
-   *  the key whose corresponding object is to be returned
-   * @returns nsISupports
-   *  the corresponding object, or null if none was present
-   */
-  _getObjectState: function(k)
-  {
-    if (typeof k !== "string")
-      throw new Error("non-string key passed");
-    return this._objectState[k] || null;
-  },
-
-  /**
-   * Sets the object associated with the given key in the server for SJS
-   * state preservation across requests.
-   *
-   * @param k : string
-   *  the key whose corresponding object is to be set
-   * @param v : nsISupports
-   *  the object to be associated with the given key; may be null
-   */
-  _setObjectState: function(k, v)
-  {
-    if (typeof k !== "string")
-      throw new Error("non-string key passed");
-    if (typeof v !== "object")
-      throw new Error("non-object value passed");
-    if (v && !("QueryInterface" in v))
-    {
-      throw new Error("must pass an nsISupports; use wrappedJSObject to ease " +
-                      "pain when using the server from JS");
-    }
-
-    this._objectState[k] = v;
-  },
-
-  /**
-   * Gets a content-type for the given file, first by checking for any custom
-   * MIME-types registered with this handler for the file's extension, second by
-   * asking the global MIME service for a content-type, and finally by failing
-   * over to application/octet-stream.
-   *
-   * @param file : nsIFile
-   *   the nsIFile for which to get a file type
-   * @returns string
-   *   the best content-type which can be determined for the file
-   */
-  _getTypeFromFile: function(file)
-  {
-    try
-    {
-      var name = file.leafName;
-      var dot = name.lastIndexOf(".");
-      if (dot > 0)
-      {
-        var ext = name.slice(dot + 1);
-        if (ext in this._mimeMappings)
-          return this._mimeMappings[ext];
-      }
-      return Cc["@mozilla.org/uriloader/external-helper-app-service;1"]
-               .getService(Ci.nsIMIMEService)
-               .getTypeFromFile(file);
-    }
-    catch (e)
-    {
-      return "application/octet-stream";
-    }
-  },
-
-  /**
-   * Returns the nsILocalFile which corresponds to the path, as determined using
-   * all registered path->directory mappings and any paths which are explicitly
-   * overridden.
-   *
-   * @param path : string
-   *   the server path for which a file should be retrieved, e.g. "/foo/bar"
-   * @throws HttpError
-   *   when the correct action is the corresponding HTTP error (i.e., because no
-   *   mapping was found for a directory in path, the referenced file doesn't
-   *   exist, etc.)
-   * @returns nsILocalFile
-   *   the file to be sent as the response to a request for the path
-   */
-  _getFileForPath: function(path)
-  {
-    // decode and add underscores as necessary
-    try
-    {
-      path = toInternalPath(path, true);
-    }
-    catch (e)
-    {
-      throw HTTP_400; // malformed path
-    }
-
-    // next, get the directory which contains this path
-    var pathMap = this._pathDirectoryMap;
-
-    // An example progression of tmp for a path "/foo/bar/baz/" might be:
-    // "foo/bar/baz/", "foo/bar/baz", "foo/bar", "foo", ""
-    var tmp = path.substring(1);
-    while (true)
-    {
-      // do we have a match for current head of the path?
-      var file = pathMap.get(tmp);
-      if (file)
-      {
-        // XXX hack; basically disable showing mapping for /foo/bar/ when the
-        //     requested path was /foo/bar, because relative links on the page
-        //     will all be incorrect -- we really need the ability to easily
-        //     redirect here instead
-        if (tmp == path.substring(1) &&
-            tmp.length != 0 &&
-            tmp.charAt(tmp.length - 1) != "/")
-          file = null;
-        else
-          break;
-      }
-
-      // if we've finished trying all prefixes, exit
-      if (tmp == "")
-        break;
-
-      tmp = tmp.substring(0, tmp.lastIndexOf("/"));
-    }
-
-    // no mapping applies, so 404
-    if (!file)
-      throw HTTP_404;
-
-
-    // last, get the file for the path within the determined directory
-    var parentFolder = file.parent;
-    var dirIsRoot = (parentFolder == null);
-
-    // Strategy here is to append components individually, making sure we
-    // never move above the given directory; this allows paths such as
-    // "<file>/foo/../bar" but prevents paths such as "<file>/../base-sibling";
-    // this component-wise approach also means the code works even on platforms
-    // which don't use "/" as the directory separator, such as Windows
-    var leafPath = path.substring(tmp.length + 1);
-    var comps = leafPath.split("/");
-    for (var i = 0, sz = comps.length; i < sz; i++)
-    {
-      var comp = comps[i];
-
-      if (comp == "..")
-        file = file.parent;
-      else if (comp == "." || comp == "")
-        continue;
-      else
-        file.append(comp);
-
-      if (!dirIsRoot && file.equals(parentFolder))
-        throw HTTP_403;
-    }
-
-    return file;
-  },
-
-  /**
-   * Writes the error page for the given HTTP error code over the given
-   * connection.
-   *
-   * @param errorCode : uint
-   *   the HTTP error code to be used
-   * @param connection : Connection
-   *   the connection on which the error occurred
-   */
-  handleError: function(errorCode, connection)
-  {
-    var response = new Response(connection);
-
-    dumpn("*** error in request: " + errorCode);
-
-    this._handleError(errorCode, new Request(connection.port), response);
-  }, 
-
-  /**
-   * Handles a request which generates the given error code, using the
-   * user-defined error handler if one has been set, gracefully falling back to
-   * the x00 status code if the code has no handler, and failing to status code
-   * 500 if all else fails.
-   *
-   * @param errorCode : uint
-   *   the HTTP error which is to be returned
-   * @param metadata : Request
-   *   metadata for the request, which will often be incomplete since this is an
-   *   error
-   * @param response : Response
-   *   an uninitialized Response should be initialized when this method
-   *   completes with information which represents the desired error code in the
-   *   ideal case or a fallback code in abnormal circumstances (i.e., 500 is a
-   *   fallback for 505, per HTTP specs)
-   */
-  _handleError: function(errorCode, metadata, response)
-  {
-    if (!metadata)
-      throw Cr.NS_ERROR_NULL_POINTER;
-
-    var errorX00 = errorCode - (errorCode % 100);
-
-    try
-    {
-      if (!(errorCode in HTTP_ERROR_CODES))
-        dumpn("*** WARNING: requested invalid error: " + errorCode);
-
-      // RFC 2616 says that we should try to handle an error by its class if we
-      // can't otherwise handle it -- if that fails, we revert to handling it as
-      // a 500 internal server error, and if that fails we throw and shut down
-      // the server
-
-      // actually handle the error
-      try
-      {
-        if (errorCode in this._overrideErrors)
-          this._overrideErrors[errorCode](metadata, response);
-        else
-          this._defaultErrors[errorCode](metadata, response);
-      }
-      catch (e)
-      {
-        if (response.partiallySent())
-        {
-          response.abort(e);
-          return;
-        }
-
-        // don't retry the handler that threw
-        if (errorX00 == errorCode)
-          throw HTTP_500;
-
-        dumpn("*** error in handling for error code " + errorCode + ", " +
-              "falling back to " + errorX00 + "...");
-        response = new Response(response._connection);
-        if (errorX00 in this._overrideErrors)
-          this._overrideErrors[errorX00](metadata, response);
-        else if (errorX00 in this._defaultErrors)
-          this._defaultErrors[errorX00](metadata, response);
-        else
-          throw HTTP_500;
-      }
-    }
-    catch (e)
-    {
-      if (response.partiallySent())
-      {
-        response.abort();
-        return;
-      }
-
-      // we've tried everything possible for a meaningful error -- now try 500
-      dumpn("*** error in handling for error code " + errorX00 + ", falling " +
-            "back to 500...");
-
-      try
-      {
-        response = new Response(response._connection);
-        if (500 in this._overrideErrors)
-          this._overrideErrors[500](metadata, response);
-        else
-          this._defaultErrors[500](metadata, response);
-      }
-      catch (e2)
-      {
-        dumpn("*** multiple errors in default error handlers!");
-        dumpn("*** e == " + e + ", e2 == " + e2);
-        response.abort(e2);
-        return;
-      }
-    }
-
-    response.complete();
-  },
-
-  // FIELDS
-
-  /**
-   * This object contains the default handlers for the various HTTP error codes.
-   */
-  _defaultErrors:
-  {
-    400: function(metadata, response)
-    {
-      // none of the data in metadata is reliable, so hard-code everything here
-      response.setStatusLine("1.1", 400, "Bad Request");
-      response.setHeader("Content-Type", "text/plain", false);
-
-      var body = "Bad request\n";
-      response.bodyOutputStream.write(body, body.length);
-    },
-    403: function(metadata, response)
-    {
-      response.setStatusLine(metadata.httpVersion, 403, "Forbidden");
-      response.setHeader("Content-Type", "text/html", false);
-
-      var body = "<html>\
-                    <head><title>403 Forbidden</title></head>\
-                    <body>\
-                      <h1>403 Forbidden</h1>\
-                    </body>\
-                  </html>";
-      response.bodyOutputStream.write(body, body.length);
-    },
-    404: function(metadata, response)
-    {
-      response.setStatusLine(metadata.httpVersion, 404, "Not Found");
-      response.setHeader("Content-Type", "text/html", false);
-
-      var body = "<html>\
-                    <head><title>404 Not Found</title></head>\
-                    <body>\
-                      <h1>404 Not Found</h1>\
-                      <p>\
-                        <span style='font-family: monospace;'>" +
-                          htmlEscape(metadata.path) +
-                       "</span> was not found.\
-                      </p>\
-                    </body>\
-                  </html>";
-      response.bodyOutputStream.write(body, body.length);
-    },
-    416: function(metadata, response)
-    {
-      response.setStatusLine(metadata.httpVersion,
-                            416,
-                            "Requested Range Not Satisfiable");
-      response.setHeader("Content-Type", "text/html", false);
-
-      var body = "<html>\
-                   <head>\
-                    <title>416 Requested Range Not Satisfiable</title></head>\
-                    <body>\
-                     <h1>416 Requested Range Not Satisfiable</h1>\
-                     <p>The byte range was not valid for the\
-                        requested resource.\
-                     </p>\
-                    </body>\
-                  </html>";
-      response.bodyOutputStream.write(body, body.length);
-    },
-    500: function(metadata, response)
-    {
-      response.setStatusLine(metadata.httpVersion,
-                             500,
-                             "Internal Server Error");
-      response.setHeader("Content-Type", "text/html", false);
-
-      var body = "<html>\
-                    <head><title>500 Internal Server Error</title></head>\
-                    <body>\
-                      <h1>500 Internal Server Error</h1>\
-                      <p>Something's broken in this server and\
-                        needs to be fixed.</p>\
-                    </body>\
-                  </html>";
-      response.bodyOutputStream.write(body, body.length);
-    },
-    501: function(metadata, response)
-    {
-      response.setStatusLine(metadata.httpVersion, 501, "Not Implemented");
-      response.setHeader("Content-Type", "text/html", false);
-
-      var body = "<html>\
-                    <head><title>501 Not Implemented</title></head>\
-                    <body>\
-                      <h1>501 Not Implemented</h1>\
-                      <p>This server is not (yet) Apache.</p>\
-                    </body>\
-                  </html>";
-      response.bodyOutputStream.write(body, body.length);
-    },
-    505: function(metadata, response)
-    {
-      response.setStatusLine("1.1", 505, "HTTP Version Not Supported");
-      response.setHeader("Content-Type", "text/html", false);
-
-      var body = "<html>\
-                    <head><title>505 HTTP Version Not Supported</title></head>\
-                    <body>\
-                      <h1>505 HTTP Version Not Supported</h1>\
-                      <p>This server only supports HTTP/1.0 and HTTP/1.1\
-                        connections.</p>\
-                    </body>\
-                  </html>";
-      response.bodyOutputStream.write(body, body.length);
-    }
-  },
-
-  /**
-   * Contains handlers for the default set of URIs contained in this server.
-   */
-  _defaultPaths:
-  {
-    "/": function(metadata, response)
-    {
-      response.setStatusLine(metadata.httpVersion, 200, "OK");
-      response.setHeader("Content-Type", "text/html", false);
-
-      var body = "<html>\
-                    <head><title>httpd.js</title></head>\
-                    <body>\
-                      <h1>httpd.js</h1>\
-                      <p>If you're seeing this page, httpd.js is up and\
-                        serving requests!  Now set a base path and serve some\
-                        files!</p>\
-                    </body>\
-                  </html>";
-
-      response.bodyOutputStream.write(body, body.length);
-    },
-
-    "/trace": function(metadata, response)
-    {
-      response.setStatusLine(metadata.httpVersion, 200, "OK");
-      response.setHeader("Content-Type", "text/plain", false);
-
-      var body = "Request-URI: " +
-                 metadata.scheme + "://" + metadata.host + ":" + metadata.port +
-                 metadata.path + "\n\n";
-      body += "Request (semantically equivalent, slightly reformatted):\n\n";
-      body += metadata.method + " " + metadata.path;
-
-      if (metadata.queryString)
-        body +=  "?" + metadata.queryString;
-        
-      body += " HTTP/" + metadata.httpVersion + "\r\n";
-
-      var headEnum = metadata.headers;
-      while (headEnum.hasMoreElements())
-      {
-        var fieldName = headEnum.getNext()
-                                .QueryInterface(Ci.nsISupportsString)
-                                .data;
-        body += fieldName + ": " + metadata.getHeader(fieldName) + "\r\n";
-      }
-
-      response.bodyOutputStream.write(body, body.length);
-    }
-  }
-};
-
-
-/**
- * Maps absolute paths to files on the local file system (as nsILocalFiles).
- */
-function FileMap()
-{
-  /** Hash which will map paths to nsILocalFiles. */
-  this._map = {};
-}
-FileMap.prototype =
-{
-  // PUBLIC API
-
-  /**
-   * Maps key to a clone of the nsILocalFile value if value is non-null;
-   * otherwise, removes any extant mapping for key.
-   *
-   * @param key : string
-   *   string to which a clone of value is mapped
-   * @param value : nsILocalFile
-   *   the file to map to key, or null to remove a mapping
-   */
-  put: function(key, value)
-  {
-    if (value)
-      this._map[key] = value.clone();
-    else
-      delete this._map[key];
-  },
-
-  /**
-   * Returns a clone of the nsILocalFile mapped to key, or null if no such
-   * mapping exists.
-   *
-   * @param key : string
-   *   key to which the returned file maps
-   * @returns nsILocalFile
-   *   a clone of the mapped file, or null if no mapping exists
-   */
-  get: function(key)
-  {
-    var val = this._map[key];
-    return val ? val.clone() : null;
-  }
-};
-
-
-// Response CONSTANTS
-
-// token       = *<any CHAR except CTLs or separators>
-// CHAR        = <any US-ASCII character (0-127)>
-// CTL         = <any US-ASCII control character (0-31) and DEL (127)>
-// separators  = "(" | ")" | "<" | ">" | "@"
-//             | "," | ";" | ":" | "\" | <">
-//             | "/" | "[" | "]" | "?" | "="
-//             | "{" | "}" | SP  | HT
-const IS_TOKEN_ARRAY =
-  [0, 0, 0, 0, 0, 0, 0, 0, //   0
-   0, 0, 0, 0, 0, 0, 0, 0, //   8
-   0, 0, 0, 0, 0, 0, 0, 0, //  16
-   0, 0, 0, 0, 0, 0, 0, 0, //  24
-
-   0, 1, 0, 1, 1, 1, 1, 1, //  32
-   0, 0, 1, 1, 0, 1, 1, 0, //  40
-   1, 1, 1, 1, 1, 1, 1, 1, //  48
-   1, 1, 0, 0, 0, 0, 0, 0, //  56
-
-   0, 1, 1, 1, 1, 1, 1, 1, //  64
-   1, 1, 1, 1, 1, 1, 1, 1, //  72
-   1, 1, 1, 1, 1, 1, 1, 1, //  80
-   1, 1, 1, 0, 0, 0, 1, 1, //  88
-
-   1, 1, 1, 1, 1, 1, 1, 1, //  96
-   1, 1, 1, 1, 1, 1, 1, 1, // 104
-   1, 1, 1, 1, 1, 1, 1, 1, // 112
-   1, 1, 1, 0, 1, 0, 1];   // 120
-
-
-/**
- * Determines whether the given character code is a CTL.
- *
- * @param code : uint
- *   the character code
- * @returns boolean
- *   true if code is a CTL, false otherwise
- */
-function isCTL(code)
-{
-  return (code >= 0 && code <= 31) || (code == 127);
-}
-
-/**
- * Represents a response to an HTTP request, encapsulating all details of that
- * response.  This includes all headers, the HTTP version, status code and
- * explanation, and the entity itself.
- *
- * @param connection : Connection
- *   the connection over which this response is to be written
- */
-function Response(connection)
-{
-  /** The connection over which this response will be written. */
-  this._connection = connection;
-
-  /**
-   * The HTTP version of this response; defaults to 1.1 if not set by the
-   * handler.
-   */
-  this._httpVersion = nsHttpVersion.HTTP_1_1;
-
-  /**
-   * The HTTP code of this response; defaults to 200.
-   */
-  this._httpCode = 200;
-
-  /**
-   * The description of the HTTP code in this response; defaults to "OK".
-   */
-  this._httpDescription = "OK";
-
-  /**
-   * An nsIHttpHeaders object in which the headers in this response should be
-   * stored.  This property is null after the status line and headers have been
-   * written to the network, and it may be modified up until it is cleared,
-   * except if this._finished is set first (in which case headers are written
-   * asynchronously in response to a finish() call not preceded by
-   * flushHeaders()).
-   */
-  this._headers = new nsHttpHeaders();
-
-  /**
-   * Set to true when this response is ended (completely constructed if possible
-   * and the connection closed); further actions on this will then fail.
-   */
-  this._ended = false;
-
-  /**
-   * A stream used to hold data written to the body of this response.
-   */
-  this._bodyOutputStream = null;
-
-  /**
-   * A stream containing all data that has been written to the body of this
-   * response so far.  (Async handlers make the data contained in this
-   * unreliable as a way of determining content length in general, but auxiliary
-   * saved information can sometimes be used to guarantee reliability.)
-   */
-  this._bodyInputStream = null;
-
-  /**
-   * A stream copier which copies data to the network.  It is initially null
-   * until replaced with a copier for response headers; when headers have been
-   * fully sent it is replaced with a copier for the response body, remaining
-   * so for the duration of response processing.
-   */
-  this._asyncCopier = null;
-
-  /**
-   * True if this response has been designated as being processed
-   * asynchronously rather than for the duration of a single call to
-   * nsIHttpRequestHandler.handle.
-   */
-  this._processAsync = false;
-
-  /**
-   * True iff finish() has been called on this, signaling that no more changes
-   * to this may be made.
-   */
-  this._finished = false;
-
-  /**
-   * True iff powerSeized() has been called on this, signaling that this
-   * response is to be handled manually by the response handler (which may then
-   * send arbitrary data in response, even non-HTTP responses).
-   */
-  this._powerSeized = false;
-}
-Response.prototype =
-{
-  // PUBLIC CONSTRUCTION API
-
-  //
-  // see nsIHttpResponse.bodyOutputStream
-  //
-  get bodyOutputStream()
-  {
-    if (this._finished)
-      throw Cr.NS_ERROR_NOT_AVAILABLE;
-
-    if (!this._bodyOutputStream)
-    {
-      var pipe = new Pipe(true, false, Response.SEGMENT_SIZE, PR_UINT32_MAX,
-                          null);
-      this._bodyOutputStream = pipe.outputStream;
-      this._bodyInputStream = pipe.inputStream;
-      if (this._processAsync || this._powerSeized)
-        this._startAsyncProcessor();
-    }
-
-    return this._bodyOutputStream;
-  },
-
-  //
-  // see nsIHttpResponse.write
-  //
-  write: function(data)
-  {
-    if (this._finished)
-      throw Cr.NS_ERROR_NOT_AVAILABLE;
-
-    var dataAsString = String(data);
-    this.bodyOutputStream.write(dataAsString, dataAsString.length);
-  },
-
-  //
-  // see nsIHttpResponse.setStatusLine
-  //
-  setStatusLine: function(httpVersion, code, description)
-  {
-    if (!this._headers || this._finished || this._powerSeized)
-      throw Cr.NS_ERROR_NOT_AVAILABLE;
-    this._ensureAlive();
-
-    if (!(code >= 0 && code < 1000))
-      throw Cr.NS_ERROR_INVALID_ARG;
-
-    try
-    {
-      var httpVer;
-      // avoid version construction for the most common cases
-      if (!httpVersion || httpVersion == "1.1")
-        httpVer = nsHttpVersion.HTTP_1_1;
-      else if (httpVersion == "1.0")
-        httpVer = nsHttpVersion.HTTP_1_0;
-      else
-        httpVer = new nsHttpVersion(httpVersion);
-    }
-    catch (e)
-    {
-      throw Cr.NS_ERROR_INVALID_ARG;
-    }
-
-    // Reason-Phrase = *<TEXT, excluding CR, LF>
-    // TEXT          = <any OCTET except CTLs, but including LWS>
-    //
-    // XXX this ends up disallowing octets which aren't Unicode, I think -- not
-    //     much to do if description is IDL'd as string
-    if (!description)
-      description = "";
-    for (var i = 0; i < description.length; i++)
-      if (isCTL(description.charCodeAt(i)) && description.charAt(i) != "\t")
-        throw Cr.NS_ERROR_INVALID_ARG;
-
-    // set the values only after validation to preserve atomicity
-    this._httpDescription = description;
-    this._httpCode = code;
-    this._httpVersion = httpVer;
-  },
-
-  //
-  // see nsIHttpResponse.setHeader
-  //
-  setHeader: function(name, value, merge)
-  {
-    if (!this._headers || this._finished || this._powerSeized)
-      throw Cr.NS_ERROR_NOT_AVAILABLE;
-    this._ensureAlive();
-
-    this._headers.setHeader(name, value, merge);
-  },
-
-  //
-  // see nsIHttpResponse.processAsync
-  //
-  processAsync: function()
-  {
-    if (this._finished)
-      throw Cr.NS_ERROR_UNEXPECTED;
-    if (this._powerSeized)
-      throw Cr.NS_ERROR_NOT_AVAILABLE;
-    if (this._processAsync)
-      return;
-    this._ensureAlive();
-
-    dumpn("*** processing connection " + this._connection.number + " async");
-    this._processAsync = true;
-
-    /*
-     * Either the bodyOutputStream getter or this method is responsible for
-     * starting the asynchronous processor and catching writes of data to the
-     * response body of async responses as they happen, for the purpose of
-     * forwarding those writes to the actual connection's output stream.
-     * If bodyOutputStream is accessed first, calling this method will create
-     * the processor (when it first is clear that body data is to be written
-     * immediately, not buffered).  If this method is called first, accessing
-     * bodyOutputStream will create the processor.  If only this method is
-     * called, we'll write nothing, neither headers nor the nonexistent body,
-     * until finish() is called.  Since that delay is easily avoided by simply
-     * getting bodyOutputStream or calling write(""), we don't worry about it.
-     */
-    if (this._bodyOutputStream && !this._asyncCopier)
-      this._startAsyncProcessor();
-  },
-
-  //
-  // see nsIHttpResponse.seizePower
-  //
-  seizePower: function()
-  {
-    if (this._processAsync)
-      throw Cr.NS_ERROR_NOT_AVAILABLE;
-    if (this._finished)
-      throw Cr.NS_ERROR_UNEXPECTED;
-    if (this._powerSeized)
-      return;
-    this._ensureAlive();
-
-    dumpn("*** forcefully seizing power over connection " +
-          this._connection.number + "...");
-
-    // Purge any already-written data without sending it.  We could as easily
-    // swap out the streams entirely, but that makes it possible to acquire and
-    // unknowingly use a stale reference, so we require there only be one of
-    // each stream ever for any response to avoid this complication.
-    if (this._asyncCopier)
-      this._asyncCopier.cancel(Cr.NS_BINDING_ABORTED);
-    this._asyncCopier = null;
-    if (this._bodyOutputStream)
-    {
-      var input = new BinaryInputStream(this._bodyInputStream);
-      var avail;
-      while ((avail = input.available()) > 0)
-        input.readByteArray(avail);
-    }
-
-    this._powerSeized = true;
-    if (this._bodyOutputStream)
-      this._startAsyncProcessor();
-  },
-
-  //
-  // see nsIHttpResponse.finish
-  //
-  finish: function()
-  {
-    if (!this._processAsync && !this._powerSeized)
-      throw Cr.NS_ERROR_UNEXPECTED;
-    if (this._finished)
-      return;
-
-    dumpn("*** finishing connection " + this._connection.number);
-    this._startAsyncProcessor(); // in case bodyOutputStream was never accessed
-    if (this._bodyOutputStream)
-      this._bodyOutputStream.close();
-    this._finished = true;
-  },
-
-
-  // NSISUPPORTS
-
-  //
-  // see nsISupports.QueryInterface
-  //
-  QueryInterface: function(iid)
-  {
-    if (iid.equals(Ci.nsIHttpResponse) || iid.equals(Ci.nsISupports))
-      return this;
-
-    throw Cr.NS_ERROR_NO_INTERFACE;
-  },
-
-
-  // POST-CONSTRUCTION API (not exposed externally)
-
-  /**
-   * The HTTP version number of this, as a string (e.g. "1.1").
-   */
-  get httpVersion()
-  {
-    this._ensureAlive();
-    return this._httpVersion.toString();
-  },
-
-  /**
-   * The HTTP status code of this response, as a string of three characters per
-   * RFC 2616.
-   */
-  get httpCode()
-  {
-    this._ensureAlive();
-
-    var codeString = (this._httpCode < 10 ? "0" : "") +
-                     (this._httpCode < 100 ? "0" : "") +
-                     this._httpCode;
-    return codeString;
-  },
-
-  /**
-   * The description of the HTTP status code of this response, or "" if none is
-   * set.
-   */
-  get httpDescription()
-  {
-    this._ensureAlive();
-
-    return this._httpDescription;
-  },
-
-  /**
-   * The headers in this response, as an nsHttpHeaders object.
-   */
-  get headers()
-  {
-    this._ensureAlive();
-
-    return this._headers;
-  },
-
-  //
-  // see nsHttpHeaders.getHeader
-  //
-  getHeader: function(name)
-  {
-    this._ensureAlive();
-
-    return this._headers.getHeader(name);
-  },
-
-  /**
-   * Determines whether this response may be abandoned in favor of a newly
-   * constructed response.  A response may be abandoned only if it is not being
-   * sent asynchronously and if raw control over it has not been taken from the
-   * server.
-   *
-   * @returns boolean
-   *   true iff no data has been written to the network
-   */
-  partiallySent: function()
-  {
-    dumpn("*** partiallySent()");
-    return this._processAsync || this._powerSeized;
-  },
-
-  /**
-   * If necessary, kicks off the remaining request processing needed to be done
-   * after a request handler performs its initial work upon this response.
-   */
-  complete: function()
-  {
-    dumpn("*** complete()");
-    if (this._processAsync || this._powerSeized)
-    {
-      NS_ASSERT(this._processAsync ^ this._powerSeized,
-                "can't both send async and relinquish power");
-      return;
-    }
-
-    NS_ASSERT(!this.partiallySent(), "completing a partially-sent response?");
-
-    this._startAsyncProcessor();
-
-    // Now make sure we finish processing this request!
-    if (this._bodyOutputStream)
-      this._bodyOutputStream.close();
-  },
-
-  /**
-   * Abruptly ends processing of this response, usually due to an error in an
-   * incoming request but potentially due to a bad error handler.  Since we
-   * cannot handle the error in the usual way (giving an HTTP error page in
-   * response) because data may already have been sent (or because the response
-   * might be expected to have been generated asynchronously or completely from
-   * scratch by the handler), we stop processing this response and abruptly
-   * close the connection.
-   *
-   * @param e : Error
-   *   the exception which precipitated this abort, or null if no such exception
-   *   was generated
-   */
-  abort: function(e)
-  {
-    dumpn("*** abort(<" + e + ">)");
-
-    // This response will be ended by the processor if one was created.
-    var copier = this._asyncCopier;
-    if (copier)
-    {
-      // We dispatch asynchronously here so that any pending writes of data to
-      // the connection will be deterministically written.  This makes it easier
-      // to specify exact behavior, and it makes observable behavior more
-      // predictable for clients.  Note that the correctness of this depends on
-      // callbacks in response to _waitToReadData in WriteThroughCopier
-      // happening asynchronously with respect to the actual writing of data to
-      // bodyOutputStream, as they currently do; if they happened synchronously,
-      // an event which ran before this one could write more data to the
-      // response body before we get around to canceling the copier.  We have
-      // tests for this in test_seizepower.js, however, and I can't think of a
-      // way to handle both cases without removing bodyOutputStream access and
-      // moving its effective write(data, length) method onto Response, which
-      // would be slower and require more code than this anyway.
-      gThreadManager.currentThread.dispatch({
-        run: function()
-        {
-          dumpn("*** canceling copy asynchronously...");
-          copier.cancel(Cr.NS_ERROR_UNEXPECTED);
-        }
-      }, Ci.nsIThread.DISPATCH_NORMAL);
-    }
-    else
-    {
-      this.end();
-    }
-  },
-
-  /**
-   * Closes this response's network connection, marks the response as finished,
-   * and notifies the server handler that the request is done being processed.
-   */
-  end: function()
-  {
-    NS_ASSERT(!this._ended, "ending this response twice?!?!");
-
-    this._connection.close();
-    if (this._bodyOutputStream)
-      this._bodyOutputStream.close();
-
-    this._finished = true;
-    this._ended = true;
-  },
-
-  // PRIVATE IMPLEMENTATION
-
-  /**
-   * Sends the status line and headers of this response if they haven't been
-   * sent and initiates the process of copying data written to this response's
-   * body to the network.
-   */
-  _startAsyncProcessor: function()
-  {
-    dumpn("*** _startAsyncProcessor()");
-
-    // Handle cases where we're being called a second time.  The former case
-    // happens when this is triggered both by complete() and by processAsync(),
-    // while the latter happens when processAsync() in conjunction with sent
-    // data causes abort() to be called.
-    if (this._asyncCopier || this._ended)
-    {
-      dumpn("*** ignoring second call to _startAsyncProcessor");
-      return;
-    }
-
-    // Send headers if they haven't been sent already and should be sent, then
-    // asynchronously continue to send the body.
-    if (this._headers && !this._powerSeized)
-    {
-      this._sendHeaders();
-      return;
-    }
-
-    this._headers = null;
-    this._sendBody();
-  },
-
-  /**
-   * Signals that all modifications to the response status line and headers are
-   * complete and then sends that data over the network to the client.  Once
-   * this method completes, a different response to the request that resulted
-   * in this response cannot be sent -- the only possible action in case of
-   * error is to abort the response and close the connection.
-   */
-  _sendHeaders: function()
-  {
-    dumpn("*** _sendHeaders()");
-
-    NS_ASSERT(this._headers);
-    NS_ASSERT(!this._powerSeized);
-
-    // request-line
-    var statusLine = "HTTP/" + this.httpVersion + " " +
-                     this.httpCode + " " +
-                     this.httpDescription + "\r\n";
-
-    // header post-processing
-
-    var headers = this._headers;
-    headers.setHeader("Connection", "close", false);
-    headers.setHeader("Server", "httpd.js", false);
-    if (!headers.hasHeader("Date"))
-      headers.setHeader("Date", toDateString(Date.now()), false);
-
-    // Any response not being processed asynchronously must have an associated
-    // Content-Length header for reasons of backwards compatibility with the
-    // initial server, which fully buffered every response before sending it.
-    // Beyond that, however, it's good to do this anyway because otherwise it's
-    // impossible to test behaviors that depend on the presence or absence of a
-    // Content-Length header.
-    if (!this._processAsync)
-    {
-      dumpn("*** non-async response, set Content-Length");
-
-      var bodyStream = this._bodyInputStream;
-      var avail = bodyStream ? bodyStream.available() : 0;
-
-      // XXX assumes stream will always report the full amount of data available
-      headers.setHeader("Content-Length", "" + avail, false);
-    }
-
-
-    // construct and send response
-    dumpn("*** header post-processing completed, sending response head...");
-
-    // request-line
-    var preambleData = [statusLine];
-
-    // headers
-    var headEnum = headers.enumerator;
-    while (headEnum.hasMoreElements())
-    {
-      var fieldName = headEnum.getNext()
-                              .QueryInterface(Ci.nsISupportsString)
-                              .data;
-      var values = headers.getHeaderValues(fieldName);
-      for (var i = 0, sz = values.length; i < sz; i++)
-        preambleData.push(fieldName + ": " + values[i] + "\r\n");
-    }
-
-    // end request-line/headers
-    preambleData.push("\r\n");
-
-    var preamble = preambleData.join("");
-
-    var responseHeadPipe = new Pipe(true, false, 0, PR_UINT32_MAX, null);
-    responseHeadPipe.outputStream.write(preamble, preamble.length);
-
-    var response = this;
-    var copyObserver =
-      {
-        onStartRequest: function(request, cx)
-        {
-          dumpn("*** preamble copying started");
-        },
-
-        onStopRequest: function(request, cx, statusCode)
-        {
-          dumpn("*** preamble copying complete " +
-                "[status=0x" + statusCode.toString(16) + "]");
-
-          if (!Components.isSuccessCode(statusCode))
-          {
-            dumpn("!!! header copying problems: non-success statusCode, " +
-                  "ending response");
-
-            response.end();
-          }
-          else
-          {
-            response._sendBody();
-          }
-        },
-
-        QueryInterface: function(aIID)
-        {
-          if (aIID.equals(Ci.nsIRequestObserver) || aIID.equals(Ci.nsISupports))
-            return this;
-
-          throw Cr.NS_ERROR_NO_INTERFACE;
-        }
-      };
-
-    var headerCopier = this._asyncCopier =
-      new WriteThroughCopier(responseHeadPipe.inputStream,
-                             this._connection.output,
-                             copyObserver, null);
-
-    responseHeadPipe.outputStream.close();
-
-    // Forbid setting any more headers or modifying the request line.
-    this._headers = null;
-  },
-
-  /**
-   * Asynchronously writes the body of the response (or the entire response, if
-   * seizePower() has been called) to the network.
-   */
-  _sendBody: function()
-  {
-    dumpn("*** _sendBody");
-
-    NS_ASSERT(!this._headers, "still have headers around but sending body?");
-
-    // If no body data was written, we're done
-    if (!this._bodyInputStream)
-    {
-      dumpn("*** empty body, response finished");
-      this.end();
-      return;
-    }
-
-    var response = this;
-    var copyObserver =
-      {
-        onStartRequest: function(request, context)
-        {
-          dumpn("*** onStartRequest");
-        },
-
-        onStopRequest: function(request, cx, statusCode)
-        {
-          dumpn("*** onStopRequest [status=0x" + statusCode.toString(16) + "]");
-
-          if (statusCode === Cr.NS_BINDING_ABORTED)
-          {
-            dumpn("*** terminating copy observer without ending the response");
-          }
-          else
-          {
-            if (!Components.isSuccessCode(statusCode))
-              dumpn("*** WARNING: non-success statusCode in onStopRequest");
-
-            response.end();
-          }
-        },
-
-        QueryInterface: function(aIID)
-        {
-          if (aIID.equals(Ci.nsIRequestObserver) || aIID.equals(Ci.nsISupports))
-            return this;
-
-          throw Cr.NS_ERROR_NO_INTERFACE;
-        }
-      };
-
-    dumpn("*** starting async copier of body data...");
-    this._asyncCopier =
-      new WriteThroughCopier(this._bodyInputStream, this._connection.output,
-                            copyObserver, null);
-  },
-
-  /** Ensures that this hasn't been ended. */
-  _ensureAlive: function()
-  {
-    NS_ASSERT(!this._ended, "not handling response lifetime correctly");
-  }
-};
-
-/**
- * Size of the segments in the buffer used in storing response data and writing
- * it to the socket.
- */
-Response.SEGMENT_SIZE = 8192;
-
-/** Serves double duty in WriteThroughCopier implementation. */
-function notImplemented()
-{
-  throw Cr.NS_ERROR_NOT_IMPLEMENTED;
-}
-
-/** Returns true iff the given exception represents stream closure. */
-function streamClosed(e)
-{
-  return e === Cr.NS_BASE_STREAM_CLOSED ||
-         (typeof e === "object" && e.result === Cr.NS_BASE_STREAM_CLOSED);
-}
-
-/** Returns true iff the given exception represents a blocked stream. */
-function wouldBlock(e)
-{
-  return e === Cr.NS_BASE_STREAM_WOULD_BLOCK ||
-         (typeof e === "object" && e.result === Cr.NS_BASE_STREAM_WOULD_BLOCK);
-}
-
-/**
- * Copies data from source to sink as it becomes available, when that data can
- * be written to sink without blocking.
- *
- * @param source : nsIAsyncInputStream
- *   the stream from which data is to be read
- * @param sink : nsIAsyncOutputStream
- *   the stream to which data is to be copied
- * @param observer : nsIRequestObserver
- *   an observer which will be notified when the copy starts and finishes
- * @param context : nsISupports
- *   context passed to observer when notified of start/stop
- * @throws NS_ERROR_NULL_POINTER
- *   if source, sink, or observer are null
- */
-function WriteThroughCopier(source, sink, observer, context)
-{
-  if (!source || !sink || !observer)
-    throw Cr.NS_ERROR_NULL_POINTER;
-
-  /** Stream from which data is being read. */
-  this._source = source;
-
-  /** Stream to which data is being written. */
-  this._sink = sink;
-
-  /** Observer watching this copy. */
-  this._observer = observer;
-
-  /** Context for the observer watching this. */
-  this._context = context;
-
-  /**
-   * True iff this is currently being canceled (cancel has been called, the
-   * callback may not yet have been made).
-   */
-  this._canceled = false;
-
-  /**
-   * False until all data has been read from input and written to output, at
-   * which point this copy is completed and cancel() is asynchronously called.
-   */
-  this._completed = false;
-
-  /** Required by nsIRequest, meaningless. */
-  this.loadFlags = 0;
-  /** Required by nsIRequest, meaningless. */
-  this.loadGroup = null;
-  /** Required by nsIRequest, meaningless. */
-  this.name = "response-body-copy";
-
-  /** Status of this request. */
-  this.status = Cr.NS_OK;
-
-  /** Arrays of byte strings waiting to be written to output. */
-  this._pendingData = [];
-
-  // start copying
-  try
-  {
-    observer.onStartRequest(this, context);
-    this._waitToReadData();
-    this._waitForSinkClosure();
-  }
-  catch (e)
-  {
-    dumpn("!!! error starting copy: " + e +
-          ("lineNumber" in e ? ", line " + e.lineNumber : ""));
-    dumpn(e.stack);
-    this.cancel(Cr.NS_ERROR_UNEXPECTED);
-  }
-}
-WriteThroughCopier.prototype =
-{
-  /* nsISupports implementation */
-
-  QueryInterface: function(iid)
-  {
-    if (iid.equals(Ci.nsIInputStreamCallback) ||
-        iid.equals(Ci.nsIOutputStreamCallback) ||
-        iid.equals(Ci.nsIRequest) ||
-        iid.equals(Ci.nsISupports))
-    {
-      return this;
-    }
-
-    throw Cr.NS_ERROR_NO_INTERFACE;
-  },
-
-
-  // NSIINPUTSTREAMCALLBACK
-
-  /**
-   * Receives a more-data-in-input notification and writes the corresponding
-   * data to the output.
-   *
-   * @param input : nsIAsyncInputStream
-   *   the input stream on whose data we have been waiting
-   */
-  onInputStreamReady: function(input)
-  {
-    if (this._source === null)
-      return;
-
-    dumpn("*** onInputStreamReady");
-
-    //
-    // Ordinarily we'll read a non-zero amount of data from input, queue it up
-    // to be written and then wait for further callbacks.  The complications in
-    // this method are the cases where we deviate from that behavior when errors
-    // occur or when copying is drawing to a finish.
-    //
-    // The edge cases when reading data are:
-    //
-    //   Zero data is read
-    //     If zero data was read, we're at the end of available data, so we can
-    //     should stop reading and move on to writing out what we have (or, if
-    //     we've already done that, onto notifying of completion).
-    //   A stream-closed exception is thrown
-    //     This is effectively a less kind version of zero data being read; the
-    //     only difference is that we notify of completion with that result
-    //     rather than with NS_OK.
-    //   Some other exception is thrown
-    //     This is the least kind result.  We don't know what happened, so we
-    //     act as though the stream closed except that we notify of completion
-    //     with the result NS_ERROR_UNEXPECTED.
-    //
-
-    var bytesWanted = 0, bytesConsumed = -1;
-    try
-    {
-      input = new BinaryInputStream(input);
-
-      bytesWanted = Math.min(input.available(), Response.SEGMENT_SIZE);
-      dumpn("*** input wanted: " + bytesWanted);
-
-      if (bytesWanted > 0)
-      {
-        var data = input.readByteArray(bytesWanted);
-        bytesConsumed = data.length;
-        this._pendingData.push(String.fromCharCode.apply(String, data));
-      }
-
-      dumpn("*** " + bytesConsumed + " bytes read");
-
-      // Handle the zero-data edge case in the same place as all other edge
-      // cases are handled.
-      if (bytesWanted === 0)
-        throw Cr.NS_BASE_STREAM_CLOSED;
-    }
-    catch (e)
-    {
-      if (streamClosed(e))
-      {
-        dumpn("*** input stream closed");
-        e = bytesWanted === 0 ? Cr.NS_OK : Cr.NS_ERROR_UNEXPECTED;
-      }
-      else
-      {
-        dumpn("!!! unexpected error reading from input, canceling: " + e);
-        e = Cr.NS_ERROR_UNEXPECTED;
-      }
-
-      this._doneReadingSource(e);
-      return;
-    }
-
-    var pendingData = this._pendingData;
-
-    NS_ASSERT(bytesConsumed > 0);
-    NS_ASSERT(pendingData.length > 0, "no pending data somehow?");
-    NS_ASSERT(pendingData[pendingData.length - 1].length > 0,
-              "buffered zero bytes of data?");
-
-    NS_ASSERT(this._source !== null);
-
-    // Reading has gone great, and we've gotten data to write now.  What if we
-    // don't have a place to write that data, because output went away just
-    // before this read?  Drop everything on the floor, including new data, and
-    // cancel at this point.
-    if (this._sink === null)
-    {
-      pendingData.length = 0;
-      this._doneReadingSource(Cr.NS_ERROR_UNEXPECTED);
-      return;
-    }
-
-    // Okay, we've read the data, and we know we have a place to write it.  We
-    // need to queue up the data to be written, but *only* if none is queued
-    // already -- if data's already queued, the code that actually writes the
-    // data will make sure to wait on unconsumed pending data.
-    try
-    {
-      if (pendingData.length === 1)
-        this._waitToWriteData();
-    }
-    catch (e)
-    {
-      dumpn("!!! error waiting to write data just read, swallowing and " +
-            "writing only what we already have: " + e);
-      this._doneWritingToSink(Cr.NS_ERROR_UNEXPECTED);
-      return;
-    }
-
-    // Whee!  We successfully read some data, and it's successfully queued up to
-    // be written.  All that remains now is to wait for more data to read.
-    try
-    {
-      this._waitToReadData();
-    }
-    catch (e)
-    {
-      dumpn("!!! error waiting to read more data: " + e);
-      this._doneReadingSource(Cr.NS_ERROR_UNEXPECTED);
-    }
-  },
-
-
-  // NSIOUTPUTSTREAMCALLBACK
-
-  /**
-   * Callback when data may be written to the output stream without blocking, or
-   * when the output stream has been closed.
-   *
-   * @param output : nsIAsyncOutputStream
-   *   the output stream on whose writability we've been waiting, also known as
-   *   this._sink
-   */
-  onOutputStreamReady: function(output)
-  {
-    if (this._sink === null)
-      return;
-
-    dumpn("*** onOutputStreamReady");
-
-    var pendingData = this._pendingData;
-    if (pendingData.length === 0)
-    {
-      // There's no pending data to write.  The only way this can happen is if
-      // we're waiting on the output stream's closure, so we can respond to a
-      // copying failure as quickly as possible (rather than waiting for data to
-      // be available to read and then fail to be copied).  Therefore, we must
-      // be done now -- don't bother to attempt to write anything and wrap
-      // things up.
-      dumpn("!!! output stream closed prematurely, ending copy");
-
-      this._doneWritingToSink(Cr.NS_ERROR_UNEXPECTED);
-      return;
-    }
-
-
-    NS_ASSERT(pendingData[0].length > 0, "queued up an empty quantum?");
-
-    //
-    // Write out the first pending quantum of data.  The possible errors here
-    // are:
-    //
-    //   The write might fail because we can't write that much data
-    //     Okay, we've written what we can now, so re-queue what's left and
-    //     finish writing it out later.
-    //   The write failed because the stream was closed
-    //     Discard pending data that we can no longer write, stop reading, and
-    //     signal that copying finished.
-    //   Some other error occurred.
-    //     Same as if the stream were closed, but notify with the status
-    //     NS_ERROR_UNEXPECTED so the observer knows something was wonky.
-    //
-
-    try
-    {
-      var quantum = pendingData[0];
-
-      // XXX |quantum| isn't guaranteed to be ASCII, so we're relying on
-      //     undefined behavior!  We're only using this because writeByteArray
-      //     is unusably broken for asynchronous output streams; see bug 532834
-      //     for details.
-      var bytesWritten = output.write(quantum, quantum.length);
-      if (bytesWritten === quantum.length)
-        pendingData.shift();
-      else
-        pendingData[0] = quantum.substring(bytesWritten);
-
-      dumpn("*** wrote " + bytesWritten + " bytes of data");
-    }
-    catch (e)
-    {
-      if (wouldBlock(e))
-      {
-        NS_ASSERT(pendingData.length > 0,
-                  "stream-blocking exception with no data to write?");
-        NS_ASSERT(pendingData[0].length > 0,
-                  "stream-blocking exception with empty quantum?");
-        this._waitToWriteData();
-        return;
-      }
-
-      if (streamClosed(e))
-        dumpn("!!! output stream prematurely closed, signaling error...");
-      else
-        dumpn("!!! unknown error: " + e + ", quantum=" + quantum);
-
-      this._doneWritingToSink(Cr.NS_ERROR_UNEXPECTED);
-      return;
-    }
-
-    // The day is ours!  Quantum written, now let's see if we have more data
-    // still to write.
-    try
-    {
-      if (pendingData.length > 0)
-      {
-        this._waitToWriteData();
-        return;
-      }
-    }
-    catch (e)
-    {
-      dumpn("!!! unexpected error waiting to write pending data: " + e);
-      this._doneWritingToSink(Cr.NS_ERROR_UNEXPECTED);
-      return;
-    }
-
-    // Okay, we have no more pending data to write -- but might we get more in
-    // the future?
-    if (this._source !== null)
-    {
-      /*
-       * If we might, then wait for the output stream to be closed.  (We wait
-       * only for closure because we have no data to write -- and if we waited
-       * for a specific amount of data, we would get repeatedly notified for no
-       * reason if over time the output stream permitted more and more data to
-       * be written to it without blocking.)
-       */
-       this._waitForSinkClosure();
-    }
-    else
-    {
-      /*
-       * On the other hand, if we can't have more data because the input
-       * stream's gone away, then it's time to notify of copy completion.
-       * Victory!
-       */
-      this._sink = null;
-      this._cancelOrDispatchCancelCallback(Cr.NS_OK);
-    }
-  },
-
-
-  // NSIREQUEST
-
-  /** Returns true if the cancel observer hasn't been notified yet. */
-  isPending: function()
-  {
-    return !this._completed;
-  },
-
-  /** Not implemented, don't use! */
-  suspend: notImplemented,
-  /** Not implemented, don't use! */
-  resume: notImplemented,
-
-  /**
-   * Cancels data reading from input, asynchronously writes out any pending
-   * data, and causes the observer to be notified with the given error code when
-   * all writing has finished.
-   *
-   * @param status : nsresult
-   *   the status to pass to the observer when data copying has been canceled
-   */
-  cancel: function(status)
-  {
-    dumpn("*** cancel(" + status.toString(16) + ")");
-
-    if (this._canceled)
-    {
-      dumpn("*** suppressing a late cancel");
-      return;
-    }
-
-    this._canceled = true;
-    this.status = status;
-
-    // We could be in the middle of absolutely anything at this point.  Both
-    // input and output might still be around, we might have pending data to
-    // write, and in general we know nothing about the state of the world.  We
-    // therefore must assume everything's in progress and take everything to its
-    // final steady state (or so far as it can go before we need to finish
-    // writing out remaining data).
-
-    this._doneReadingSource(status);
-  },
-
-
-  // PRIVATE IMPLEMENTATION
-
-  /**
-   * Stop reading input if we haven't already done so, passing e as the status
-   * when closing the stream, and kick off a copy-completion notice if no more
-   * data remains to be written.
-   *
-   * @param e : nsresult
-   *   the status to be used when closing the input stream
-   */
-  _doneReadingSource: function(e)
-  {
-    dumpn("*** _doneReadingSource(0x" + e.toString(16) + ")");
-
-    this._finishSource(e);
-    if (this._pendingData.length === 0)
-      this._sink = null;
-    else
-      NS_ASSERT(this._sink !== null, "null output?");
-
-    // If we've written out all data read up to this point, then it's time to
-    // signal completion.
-    if (this._sink === null)
-    {
-      NS_ASSERT(this._pendingData.length === 0, "pending data still?");
-      this._cancelOrDispatchCancelCallback(e);
-    }
-  },
-
-  /**
-   * Stop writing output if we haven't already done so, discard any data that
-   * remained to be sent, close off input if it wasn't already closed, and kick
-   * off a copy-completion notice.
-   *
-   * @param e : nsresult
-   *   the status to be used when closing input if it wasn't already closed
-   */
-  _doneWritingToSink: function(e)
-  {
-    dumpn("*** _doneWritingToSink(0x" + e.toString(16) + ")");
-
-    this._pendingData.length = 0;
-    this._sink = null;
-    this._doneReadingSource(e);
-  },
-
-  /**
-   * Completes processing of this copy: either by canceling the copy if it
-   * hasn't already been canceled using the provided status, or by dispatching
-   * the cancel callback event (with the originally provided status, of course)
-   * if it already has been canceled.
-   *
-   * @param status : nsresult
-   *   the status code to use to cancel this, if this hasn't already been
-   *   canceled
-   */
-  _cancelOrDispatchCancelCallback: function(status)
-  {
-    dumpn("*** _cancelOrDispatchCancelCallback(" + status + ")");
-
-    NS_ASSERT(this._source === null, "should have finished input");
-    NS_ASSERT(this._sink === null, "should have finished output");
-    NS_ASSERT(this._pendingData.length === 0, "should have no pending data");
-
-    if (!this._canceled)
-    {
-      this.cancel(status);
-      return;
-    }
-
-    var self = this;
-    var event =
-      {
-        run: function()
-        {
-          dumpn("*** onStopRequest async callback");
-
-          self._completed = true;
-          try
-          {
-            self._observer.onStopRequest(self, self._context, self.status);
-          }
-          catch (e)
-          {
-            NS_ASSERT(false,
-                      "how are we throwing an exception here?  we control " +
-                      "all the callers!  " + e);
-          }
-        }
-      };
-
-    gThreadManager.currentThread.dispatch(event, Ci.nsIThread.DISPATCH_NORMAL);
-  },
-
-  /**
-   * Kicks off another wait for more data to be available from the input stream.
-   */
-  _waitToReadData: function()
-  {
-    dumpn("*** _waitToReadData");
-    this._source.asyncWait(this, 0, Response.SEGMENT_SIZE,
-                           gThreadManager.mainThread);
-  },
-
-  /**
-   * Kicks off another wait until data can be written to the output stream.
-   */
-  _waitToWriteData: function()
-  {
-    dumpn("*** _waitToWriteData");
-
-    var pendingData = this._pendingData;
-    NS_ASSERT(pendingData.length > 0, "no pending data to write?");
-    NS_ASSERT(pendingData[0].length > 0, "buffered an empty write?");
-
-    this._sink.asyncWait(this, 0, pendingData[0].length,
-                         gThreadManager.mainThread);
-  },
-
-  /**
-   * Kicks off a wait for the sink to which data is being copied to be closed.
-   * We wait for stream closure when we don't have any data to be copied, rather
-   * than waiting to write a specific amount of data.  We can't wait to write
-   * data because the sink might be infinitely writable, and if no data appears
-   * in the source for a long time we might have to spin quite a bit waiting to
-   * write, waiting to write again, &c.  Waiting on stream closure instead means
-   * we'll get just one notification if the sink dies.  Note that when data
-   * starts arriving from the sink we'll resume waiting for data to be written,
-   * dropping this closure-only callback entirely.
-   */
-  _waitForSinkClosure: function()
-  {
-    dumpn("*** _waitForSinkClosure");
-
-    this._sink.asyncWait(this, Ci.nsIAsyncOutputStream.WAIT_CLOSURE_ONLY, 0,
-                         gThreadManager.mainThread);
-  },
-
-  /**
-   * Closes input with the given status, if it hasn't already been closed;
-   * otherwise a no-op.
-   *
-   * @param status : nsresult
-   *   status code use to close the source stream if necessary
-   */
-  _finishSource: function(status)
-  {
-    dumpn("*** _finishSource(" + status.toString(16) + ")");
-
-    if (this._source !== null)
-    {
-      this._source.closeWithStatus(status);
-      this._source = null;
-    }
-  }
-};
-
-
-/**
- * A container for utility functions used with HTTP headers.
- */
-const headerUtils =
-{
-  /**
-   * Normalizes fieldName (by converting it to lowercase) and ensures it is a
-   * valid header field name (although not necessarily one specified in RFC
-   * 2616).
-   *
-   * @throws NS_ERROR_INVALID_ARG
-   *   if fieldName does not match the field-name production in RFC 2616
-   * @returns string
-   *   fieldName converted to lowercase if it is a valid header, for characters
-   *   where case conversion is possible
-   */
-  normalizeFieldName: function(fieldName)
-  {
-    if (fieldName == "")
-      throw Cr.NS_ERROR_INVALID_ARG;
-
-    for (var i = 0, sz = fieldName.length; i < sz; i++)
-    {
-      if (!IS_TOKEN_ARRAY[fieldName.charCodeAt(i)])
-      {
-        dumpn(fieldName + " is not a valid header field name!");
-        throw Cr.NS_ERROR_INVALID_ARG;
-      }
-    }
-
-    return fieldName.toLowerCase();
-  },
-
-  /**
-   * Ensures that fieldValue is a valid header field value (although not
-   * necessarily as specified in RFC 2616 if the corresponding field name is
-   * part of the HTTP protocol), normalizes the value if it is, and
-   * returns the normalized value.
-   *
-   * @param fieldValue : string
-   *   a value to be normalized as an HTTP header field value
-   * @throws NS_ERROR_INVALID_ARG
-   *   if fieldValue does not match the field-value production in RFC 2616
-   * @returns string
-   *   fieldValue as a normalized HTTP header field value
-   */
-  normalizeFieldValue: function(fieldValue)
-  {
-    // field-value    = *( field-content | LWS )
-    // field-content  = <the OCTETs making up the field-value
-    //                  and consisting of either *TEXT or combinations
-    //                  of token, separators, and quoted-string>
-    // TEXT           = <any OCTET except CTLs,
-    //                  but including LWS>
-    // LWS            = [CRLF] 1*( SP | HT )
-    //
-    // quoted-string  = ( <"> *(qdtext | quoted-pair ) <"> )
-    // qdtext         = <any TEXT except <">>
-    // quoted-pair    = "\" CHAR
-    // CHAR           = <any US-ASCII character (octets 0 - 127)>
-
-    // Any LWS that occurs between field-content MAY be replaced with a single
-    // SP before interpreting the field value or forwarding the message
-    // downstream (section 4.2); we replace 1*LWS with a single SP
-    var val = fieldValue.replace(/(?:(?:\r\n)?[ \t]+)+/g, " ");
-
-    // remove leading/trailing LWS (which has been converted to SP)
-    val = val.replace(/^ +/, "").replace(/ +$/, "");
-
-    // that should have taken care of all CTLs, so val should contain no CTLs
-    for (var i = 0, len = val.length; i < len; i++)
-      if (isCTL(val.charCodeAt(i)))
-        throw Cr.NS_ERROR_INVALID_ARG;
-
-    // XXX disallows quoted-pair where CHAR is a CTL -- will not invalidly
-    //     normalize, however, so this can be construed as a tightening of the
-    //     spec and not entirely as a bug
-    return val;
-  }
-};
-
-
-
-/**
- * Converts the given string into a string which is safe for use in an HTML
- * context.
- *
- * @param str : string
- *   the string to make HTML-safe
- * @returns string
- *   an HTML-safe version of str
- */
-function htmlEscape(str)
-{
-  // this is naive, but it'll work
-  var s = "";
-  for (var i = 0; i < str.length; i++)
-    s += "&#" + str.charCodeAt(i) + ";";
-  return s;
-}
-
-
-/**
- * Constructs an object representing an HTTP version (see section 3.1).
- *
- * @param versionString
- *   a string of the form "#.#", where # is an non-negative decimal integer with
- *   or without leading zeros
- * @throws
- *   if versionString does not specify a valid HTTP version number
- */
-function nsHttpVersion(versionString)
-{
-  var matches = /^(\d+)\.(\d+)$/.exec(versionString);
-  if (!matches)
-    throw "Not a valid HTTP version!";
-
-  /** The major version number of this, as a number. */
-  this.major = parseInt(matches[1], 10);
-
-  /** The minor version number of this, as a number. */
-  this.minor = parseInt(matches[2], 10);
-
-  if (isNaN(this.major) || isNaN(this.minor) ||
-      this.major < 0    || this.minor < 0)
-    throw "Not a valid HTTP version!";
-}
-nsHttpVersion.prototype =
-{
-  /**
-   * Returns the standard string representation of the HTTP version represented
-   * by this (e.g., "1.1").
-   */
-  toString: function ()
-  {
-    return this.major + "." + this.minor;
-  },
-
-  /**
-   * Returns true if this represents the same HTTP version as otherVersion,
-   * false otherwise.
-   *
-   * @param otherVersion : nsHttpVersion
-   *   the version to compare against this
-   */
-  equals: function (otherVersion)
-  {
-    return this.major == otherVersion.major &&
-           this.minor == otherVersion.minor;
-  },
-
-  /** True if this >= otherVersion, false otherwise. */
-  atLeast: function(otherVersion)
-  {
-    return this.major > otherVersion.major ||
-           (this.major == otherVersion.major &&
-            this.minor >= otherVersion.minor);
-  }
-};
-
-nsHttpVersion.HTTP_1_0 = new nsHttpVersion("1.0");
-nsHttpVersion.HTTP_1_1 = new nsHttpVersion("1.1");
-
-
-/**
- * An object which stores HTTP headers for a request or response.
- *
- * Note that since headers are case-insensitive, this object converts headers to
- * lowercase before storing them.  This allows the getHeader and hasHeader
- * methods to work correctly for any case of a header, but it means that the
- * values returned by .enumerator may not be equal case-sensitively to the
- * values passed to setHeader when adding headers to this.
- */
-function nsHttpHeaders()
-{
-  /**
-   * A hash of headers, with header field names as the keys and header field
-   * values as the values.  Header field names are case-insensitive, but upon
-   * insertion here they are converted to lowercase.  Header field values are
-   * normalized upon insertion to contain no leading or trailing whitespace.
-   *
-   * Note also that per RFC 2616, section 4.2, two headers with the same name in
-   * a message may be treated as one header with the same field name and a field
-   * value consisting of the separate field values joined together with a "," in
-   * their original order.  This hash stores multiple headers with the same name
-   * in this manner.
-   */
-  this._headers = {};
-}
-nsHttpHeaders.prototype =
-{
-  /**
-   * Sets the header represented by name and value in this.
-   *
-   * @param name : string
-   *   the header name
-   * @param value : string
-   *   the header value
-   * @throws NS_ERROR_INVALID_ARG
-   *   if name or value is not a valid header component
-   */
-  setHeader: function(fieldName, fieldValue, merge)
-  {
-    var name = headerUtils.normalizeFieldName(fieldName);
-    var value = headerUtils.normalizeFieldValue(fieldValue);
-
-    // The following three headers are stored as arrays because their real-world
-    // syntax prevents joining individual headers into a single header using 
-    // ",".  See also <http://hg.mozilla.org/mozilla-central/diff/9b2a99adc05e/netwerk/protocol/http/src/nsHttpHeaderArray.cpp#l77>
-    if (merge && name in this._headers)
-    {
-      if (name === "www-authenticate" ||
-          name === "proxy-authenticate" ||
-          name === "set-cookie") 
-      {
-        this._headers[name].push(value);
-      }
-      else 
-      {
-        this._headers[name][0] += "," + value;
-        NS_ASSERT(this._headers[name].length === 1,
-            "how'd a non-special header have multiple values?")
-      }
-    }
-    else
-    {
-      this._headers[name] = [value];
-    }
-  },
-
-  /**
-   * Returns the value for the header specified by this.
-   *
-   * @throws NS_ERROR_INVALID_ARG
-   *   if fieldName does not constitute a valid header field name
-   * @throws NS_ERROR_NOT_AVAILABLE
-   *   if the given header does not exist in this
-   * @returns string
-   *   the field value for the given header, possibly with non-semantic changes
-   *   (i.e., leading/trailing whitespace stripped, whitespace runs replaced
-   *   with spaces, etc.) at the option of the implementation; multiple 
-   *   instances of the header will be combined with a comma, except for 
-   *   the three headers noted in the description of getHeaderValues
-   */
-  getHeader: function(fieldName)
-  {
-    return this.getHeaderValues(fieldName).join("\n");
-  },
-
-  /**
-   * Returns the value for the header specified by fieldName as an array.
-   *
-   * @throws NS_ERROR_INVALID_ARG
-   *   if fieldName does not constitute a valid header field name
-   * @throws NS_ERROR_NOT_AVAILABLE
-   *   if the given header does not exist in this
-   * @returns [string]
-   *   an array of all the header values in this for the given
-   *   header name.  Header values will generally be collapsed
-   *   into a single header by joining all header values together
-   *   with commas, but certain headers (Proxy-Authenticate,
-   *   WWW-Authenticate, and Set-Cookie) violate the HTTP spec
-   *   and cannot be collapsed in this manner.  For these headers
-   *   only, the returned array may contain multiple elements if
-   *   that header has been added more than once.
-   */
-  getHeaderValues: function(fieldName)
-  {
-    var name = headerUtils.normalizeFieldName(fieldName);
-
-    if (name in this._headers)
-      return this._headers[name];
-    else
-      throw Cr.NS_ERROR_NOT_AVAILABLE;
-  },
-
-  /**
-   * Returns true if a header with the given field name exists in this, false
-   * otherwise.
-   *
-   * @param fieldName : string
-   *   the field name whose existence is to be determined in this
-   * @throws NS_ERROR_INVALID_ARG
-   *   if fieldName does not constitute a valid header field name
-   * @returns boolean
-   *   true if the header's present, false otherwise
-   */
-  hasHeader: function(fieldName)
-  {
-    var name = headerUtils.normalizeFieldName(fieldName);
-    return (name in this._headers);
-  },
-
-  /**
-   * Returns a new enumerator over the field names of the headers in this, as
-   * nsISupportsStrings.  The names returned will be in lowercase, regardless of
-   * how they were input using setHeader (header names are case-insensitive per
-   * RFC 2616).
-   */
-  get enumerator()
-  {
-    var headers = [];
-    for (var i in this._headers)
-    {
-      var supports = new SupportsString();
-      supports.data = i;
-      headers.push(supports);
-    }
-
-    return new nsSimpleEnumerator(headers);
-  }
-};
-
-
-/**
- * Constructs an nsISimpleEnumerator for the given array of items.
- *
- * @param items : Array
- *   the items, which must all implement nsISupports
- */
-function nsSimpleEnumerator(items)
-{
-  this._items = items;
-  this._nextIndex = 0;
-}
-nsSimpleEnumerator.prototype =
-{
-  hasMoreElements: function()
-  {
-    return this._nextIndex < this._items.length;
-  },
-  getNext: function()
-  {
-    if (!this.hasMoreElements())
-      throw Cr.NS_ERROR_NOT_AVAILABLE;
-
-    return this._items[this._nextIndex++];
-  },
-  QueryInterface: function(aIID)
-  {
-    if (Ci.nsISimpleEnumerator.equals(aIID) ||
-        Ci.nsISupports.equals(aIID))
-      return this;
-
-    throw Cr.NS_ERROR_NO_INTERFACE;
-  }
-};
-
-
-/**
- * A representation of the data in an HTTP request.
- *
- * @param port : uint
- *   the port on which the server receiving this request runs
- */
-function Request(port)
-{
-  /** Method of this request, e.g. GET or POST. */
-  this._method = "";
-
-  /** Path of the requested resource; empty paths are converted to '/'. */
-  this._path = "";
-
-  /** Query string, if any, associated with this request (not including '?'). */
-  this._queryString = "";
-
-  /** Scheme of requested resource, usually http, always lowercase. */
-  this._scheme = "http";
-
-  /** Hostname on which the requested resource resides. */
-  this._host = undefined;
-
-  /** Port number over which the request was received. */
-  this._port = port;
-